Extend terrain and support helper annotations
This commit is contained in:
parent
27172e3786
commit
c28bafbc64
2 changed files with 1155 additions and 35 deletions
|
|
@ -30,8 +30,43 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
|
|||
0x00409e80,192,world_set_selected_year_and_refresh_calendar_presentation_state,simulation,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small world-side year setter beneath the periodic step family and the later world-entry staged-profile rehydrate band. The helper stores the caller-supplied selected absolute calendar counter at `[this+0x15]`, resolves the paired mixed-radix calendar-point tuple through `0x0051d460` into `[this+0x0d/+0x11]`, recomputes several derived year-fraction or presentation scalars rooted at `[this+0x0bfa]`, refreshes the live shell controller at `0x006d4024` through `0x0051f070`, `0x00527c70`, and `0x00527c20`, and updates the controller's cached doubled-year field at `[controller+0x2c]`. When the unpacked year field at `[this+0x0d]` actually changes it also re-enters `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`. Current grounded callers are the smaller periodic-step wrapper at `0x0040a150`, the larger simulation-advance family through `0x0040a590/0x0040ab50`, and the late staged-profile rehydrate lane inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared selected-year/calendar refresh helper rather than a one-off world-entry setter.","objdump + caller inspection + local disassembly + periodic-step correlation + world-entry rehydrate correlation + year-bucket-companion correlation + calendar-counter model correlation"
|
||||
0x0040a590,892,simulation_service_periodic_boundary_work,simulation,cdecl,inferred,objdump + analysis-context,3,"Periodic simulation-maintenance dispatcher inside the world-step family. It switches on the local calendar or phase byte at [this+0x0f] routes one heavy mode through the larger recurring service branch at 0x0040a160 falls back to the simpler one-step advance at 0x00409e80 for other modes and runs several global manager sweeps across 0x0062be10 0x006ceb9c 0x006cfcbc 0x006cec20 and 0x0062bae0 before handing control back to the enclosing stepper. Its scenario-runtime handoff is now explicit too: the grounded calls at `0x0040a276`, `0x0040a55f`, `0x0040a6cb`, and `0x0040a7a3` re-enter `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with trigger kinds `1`, `0`, `3`, and `2` respectively. The route-style lane is tighter here now too: the neighboring recurring branch at `0x0040a91f` re-enters `placed_structure_collection_refresh_quarter_subset_route_style_state` `0x00413580`, then later drives the same runtime-effect collection loop with trigger kinds `5` and `4` at `0x0040a930` and `0x0040a9ac`. One conditional branch also re-enters shell_map_file_world_bundle_coordinator at 0x00445de0 which keeps the save-or-package family connected to the live simulation cadence.",objdump + analysis-context + caller xrefs + runtime-effect trigger-kind correlation
|
||||
0x0040ab50,339,simulation_advance_to_target_calendar_point,simulation,cdecl,inferred,objdump + analysis-context,3,"Advances the active world state toward one caller-selected mixed-radix calendar target while guarded by the recursion counter at `0x0062b240`. The helper compares the current local calendar-point tuple fields `[this+0x0d]`, `[this+0x0f]`, `[this+0x11]`, and `[this+0x14]` against a target resolved through `0x0051d550` and `0x0051d5f0`, then either recurses in larger `0x168`-sized chunks or advances through the smaller periodic step family rooted at `0x00409e80` and `0x0040a9c0`. Current tuple evidence now bounds this as the same mixed-radix counter family used by `0x0051d3c0/0x0051d460`: a packed year-plus-subfield calendar point rather than a plain year or month-only target. Each successful step notifies the live world root at `0x0062c120` through `0x00450030`. Grounded callers include the frame-time accumulator at `0x00439140`, the larger fast-forward helper at `0x00437b20`, and one shell UI command path.","objdump + analysis-context + caller xrefs + calendar-counter model correlation"
|
||||
0x0040c950,18,placed_structure_construct_concrete_specialization_vtable_5c8c50,map,thiscall,inferred,objdump + allocator caller correlation + constructor chain inspection,2,"Small constructor thunk used by the shared placed-structure allocator `0x004134d0`. The helper first re-enters `0x0045b680`, which seeds the common placed-structure base table `0x005cb4c0`, clears the derived field band `[this+0x23a..+0x26a]`, and re-enters the older base initializer `0x00455610`; it then installs the concrete placed-structure specialization table `0x005c8c50` and returns `this`. Current grounded callers are the live allocator path at `0x004134d0` and the temporary stack-object path at `0x00413363`, so this is the safest current read for the concrete placed-structure constructor thunk beneath the shared placement family rather than a standalone helper object constructor.","objdump + allocator caller correlation + constructor chain inspection + vtable install correlation"
|
||||
0x0040c970,11,placed_structure_reset_concrete_specialization_to_base_vtable_5cb4c0,map,thiscall,inferred,objdump + allocator caller correlation + destructor chain inspection,2,"Small cleanup or destructor-style thunk paired with `0x0040c950`. The helper briefly reinstalls the concrete specialization table `0x005c8c50`, then immediately tails into `0x0045b040`, which demotes the record back to the common base table `0x005cb4c0` and re-enters the base cleanup path `0x00455650`. Current grounded callers are the stack-object teardown sites at `0x00413363` and `0x0041353a`, both immediately before freeing or unwinding the temporary placed-structure object, so this is the safest current read for the specialization-to-base cleanup thunk rather than another constructor.","objdump + allocator caller correlation + destructor chain inspection + vtable demotion correlation"
|
||||
0x0040c980,5,placed_structure_serialize_concrete_specialization_payload_via_0x45b560,map,thiscall,inferred,objdump + vtable scan + serializer chain inspection,2,"Tiny serializer thunk in the concrete placed-structure specialization table `0x005c8c50`. The helper simply tails into `0x0045b560`, which first re-enters the common base serializer `0x004559d0` and then emits the derived payload bracketed by tags `0x5dc1/0x5dc2` over fields `[this+0x23e]`, `[this+0x242]`, `[this+0x246]`, `[this+0x24e]`, and `[this+0x252]`. This is the safest current read for the specialization-side serializer entry rather than an independent data-writer.","objdump + vtable scan + serializer chain inspection"
|
||||
0x0040cbc0,4,placed_structure_clear_shared_byte42_state_flag,map,thiscall,inferred,objdump + local disassembly,2,"Tiny raw setter over shared placed-structure byte `[this+0x42]`, storing literal `0`. The byte is also manipulated by the linked-peer route-entry toggle pair `0x0040dba0/0x0040dbf0` and read back through the raw getter `0x0040cbf0`, so this is the safest current read for the direct clear accessor over that shared site-state byte rather than a standalone semantic owner.","objdump + local disassembly + neighboring accessor correlation"
|
||||
0x0040cbd0,4,placed_structure_set_shared_byte42_state_flag,map,thiscall,inferred,objdump + local disassembly,2,"Tiny raw setter over shared placed-structure byte `[this+0x42]`, storing literal `1`. The byte is also manipulated by the linked-peer route-entry toggle pair `0x0040dba0/0x0040dbf0` and read back through the raw getter `0x0040cbf0`, so this is the safest current read for the direct set accessor over that shared site-state byte rather than a standalone semantic owner.","objdump + local disassembly + neighboring accessor correlation"
|
||||
0x0040cbe0,3,runtime_object_false_stub_vtable_5cfd00_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-false virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
|
||||
0x0040cbf0,5,placed_structure_query_shared_byte42_state_flag,map,thiscall,inferred,objdump + local disassembly,2,"Tiny raw getter over shared placed-structure byte `[this+0x42]`, zero-extending that byte into `EAX`. Current local evidence keeps this on the same byte-lane as the direct setters `0x0040cbc0/0x0040cbd0` and the linked-peer route-entry toggle pair `0x0040dba0/0x0040dbf0`, so this is the safest current read for the direct query accessor over that shared site-state byte.","objdump + local disassembly + neighboring accessor correlation"
|
||||
0x0040cc00,6,runtime_object_true_stub_vtable_5cfd00_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-true virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
|
||||
0x0040cc10,3,placed_structure_specialization_false_stub_vtable_5c8c50_slot0,map,thiscall,inferred,objdump + vtable scan,1,"Tiny pure-false stub in the concrete placed-structure specialization table `0x005c8c50`. The helper clears `EAX` and returns immediately, with no field access or side effects. Current evidence only grounds it as one literal-false virtual slot beneath the specialization, so the note stays structural rather than semantic.","objdump + vtable scan"
|
||||
0x0040cc20,3,placed_structure_specialization_false_stub_vtable_5c8c50_slot1,map,thiscall,inferred,objdump + vtable scan,1,"Second tiny pure-false stub in specialization table `0x005c8c50`. Like the neighboring false slots, it simply clears `EAX` and returns. Current evidence grounds this only as a literal-false virtual slot rather than a named predicate.","objdump + vtable scan"
|
||||
0x0040cc30,3,placed_structure_specialization_false_stub_vtable_5c8c50_slot2,map,thiscall,inferred,objdump + vtable scan,1,"Third tiny pure-false stub in specialization table `0x005c8c50`. The helper only returns `0`, with no field reads or writes. Current evidence does not yet justify a semantic predicate name beyond that structural role.","objdump + vtable scan"
|
||||
0x0040cc40,32,placed_structure_subject_candidate_is_subtype1,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small shared candidate-profile predicate adjacent to the `0x005c8c50` specialization cluster. The helper follows candidate or profile id `[this+0x173]` through collection `0x0062b268`, reads candidate subtype byte `[candidate+0x32]`, and returns `1` only when that subtype equals `1`. Current grounded caller is `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where the returned boolean becomes one of the two mode inputs for `0x00415020`. This is the safest current read for a subtype-`1` predicate over the linked candidate/profile chain rather than a specialization-vtable slot.","objdump + caller inspection + local disassembly + candidate-subtype correlation"
|
||||
0x0040cc60,26,placed_structure_subject_candidate_query_flag_byte_ba,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny shared candidate-profile accessor adjacent to the specialization cluster. The helper follows id `[this+0x173]` through candidate collection `0x0062b268` and returns byte `[candidate+0xba]`. Current grounded caller is `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where the byte is only used as a boolean mode input. Current evidence grounds the field access but not the higher semantic name of candidate byte `0xba`, so the note stays deliberately raw.","objdump + caller inspection + local disassembly + candidate-byte-field correlation"
|
||||
0x0040cc80,42,placed_structure_subject_candidate_is_subtype1_class3,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared candidate-profile predicate over the same `[this+0x173] -> 0x0062b268` chain as `0x0040cc40`. The helper returns `1` only when candidate subtype byte `[candidate+0x32]` equals `1` and candidate class byte `[candidate+0x8c]` equals `3`. Current grounded caller is `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where this branch helps select the flagged-region float-stat mode beneath `0x00415020`. This is the safest current read for the combined subtype-`1` plus class-`3` predicate rather than a direct specialization method.","objdump + caller inspection + local disassembly + candidate-subtype correlation + candidate-class correlation"
|
||||
0x0040ccb0,14,placed_structure_has_cached_linked_site_id,map,thiscall,inferred,objdump + vtable scan + local disassembly,2,"Small specialization-side predicate over cached linked-site id `[this+0x2a8]`. The helper returns `1` when that dword is nonzero and `0` otherwise. Because it sits directly in the `0x005c8c50` vtable beside the linked-peer UI and route-anchor family, this is the safest current read for the specialization's cached-linked-site-id presence predicate rather than a broader linked-site resolver.","objdump + vtable scan + local disassembly + linked-site-field correlation"
|
||||
0x0040ccc0,6,placed_structure_specialization_true_stub_vtable_5c8c50_slot,map,thiscall,inferred,objdump + vtable scan,1,"Tiny pure-true stub in specialization table `0x005c8c50`. The helper loads literal `1` into `EAX` and returns immediately. Current evidence grounds it only as a literal-true virtual slot beneath the specialization, not yet as a named capability predicate.","objdump + vtable scan"
|
||||
0x0040ccd0,30,world_grid_resolve_cell_pointer_by_xy_indices,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small world-grid address calculator over the live world root at `0x0062c120`. The helper multiplies the caller-supplied Y-like index by world width `[this+0x2145]`, adds the X-like index, scales the resulting linear slot by fixed cell stride `0x1d7`, and returns the corresponding cell pointer under base `[this+0x2129]`. Current grounded callers include the placed-structure cargo-service bitset sweep around `0x0042c386`, several world-grid or overlay-side passes at `0x004525bc..0x00452bb2`, and one later shell-side caller at `0x004df4d4`, so this is the safest current read for the shared `(x,y) -> world-cell*` resolver rather than an object-specific helper.","objdump + caller inspection + local disassembly + world-grid correlation + cell-stride correlation"
|
||||
0x0040ccf0,23,placed_structure_query_linked_instance_candidate_class_byte,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small linked-instance candidate-class reader adjacent to the specialization cluster. The helper first resolves one linked instance through `0x0047de00`, then follows that instance's vtable `+0x80` owner chain, and finally returns candidate class byte `[candidate+0x8c]`. Current grounded callers include later world or UI-side branches at `0x00480fb5` and `0x004b03ce`, where the returned class is compared against `3` and `4`. This is the safest current read for a linked-instance candidate-class accessor rather than a general placed-structure vtable slot.","objdump + caller inspection + local disassembly + candidate-class correlation"
|
||||
0x0040cd10,88,placed_structure_scan_center_cell_site_roster_when_shell_gate_enabled,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Gated center-cell site-roster sweep adjacent to the specialization cluster. The helper first requires shell or modal latch `[0x006cec74+0x1c3]` and creation-mode byte `[this+0x3d4] == 1`, then resolves the current subject's center world-grid cell through `0x00455f60`, reads the local roster count and packed site-id list at `[cell+0xeb]` and `[cell+0xef]`, and resolves each listed placed-structure id through collection `0x006cec20`. Current grounded caller is the broader collection walk at `0x00413860`, so this is the safest current read for a gated center-cell linked-site roster scan rather than another candidate predicate or direct vtable override.","objdump + caller inspection + local disassembly + center-cell roster correlation"
|
||||
0x0040cd70,228,placed_structure_resolve_cached_source_and_candidate_ids_from_current_stem_or_warn,map,thiscall,inferred,objdump + local disassembly + string correlation + collection correlation,3,"Common specialization-side stem refresh helper beneath `0x0040ce60`. The helper clears cached ids `[this+0x3cc]` and `[this+0x3d0]`, scans source collection `0x0062b2fc` for a case-sensitive stem match against `[this+0x3ae]`, and on the first match stores the matched source id into `[this+0x3cc]` plus the corresponding candidate or profile id from `[source+0x173]` into `[this+0x3d0]`. When no source stem matches, it formats localized id `0x00ad` with the current stem buffer and publishes that warning through `0x0051e980`. Current local callers are the radio-stem canonicalizer `0x0040ce60` and the broader placed-structure constructor or geometry refresh family, so this is the safest current read for the cached source/candidate resolver beneath the `0x005c8c50` specialization rather than a generic geometry helper.","objdump + local disassembly + string correlation + collection correlation + cached-id-field correlation"
|
||||
0x0040ce60,83,placed_structure_canonicalize_radio_station_stem_and_refresh_specialization_state,map,thiscall,inferred,objdump + local disassembly + string correlation,2,"Small specialization-side stem normalizer. The helper compares the site stem at `[this+0x3ae]` against the literal `Radio Station`, and when that compare matches it rewrites the same stem buffer to the compact form `RadioStation`. It then re-enters the common stem or geometry refresh helper `0x0040cd70` and the neighboring specialization-side follow-on `0x0045c150` with the caller-supplied stack argument. Current local evidence is strong enough to ground the `Radio Station -> RadioStation` normalization, but not the broader semantic role of the owning specialization table `0x005c8c50`, so this note stays narrow.","objdump + local disassembly + string correlation + neighboring specialization-method correlation"
|
||||
0x0040cec0,18,placed_structure_resolve_cached_source_record_from_id3cc,map,thiscall,inferred,objdump + local disassembly,2,"Tiny cached-record resolver over source id `[this+0x3cc]`. The helper resolves and returns the corresponding entry through source collection `0x0062b2fc`. Current local callers sit on the `0x005c8c50` specialization side beside the stem refresh family, so this is the safest current read for the direct cached source-record resolver rather than another generic collection helper.","objdump + local disassembly + cached-id-field correlation"
|
||||
0x0040cee0,18,placed_structure_resolve_cached_candidate_record_from_id3d0,map,thiscall,inferred,objdump + vtable scan + local disassembly,2,"Tiny cached-record resolver over candidate or profile id `[this+0x3d0]`. The helper resolves and returns the corresponding entry through collection `0x0062b268`. Because this function is itself a `0x005c8c50` vtable slot and directly follows the stem-refresh family, this is the safest current read for the specialization's cached candidate-record resolver rather than an unrelated collection bridge.","objdump + vtable scan + local disassembly + cached-id-field correlation"
|
||||
0x0040cf00,527,placed_structure_build_secondary_specialization_transient_handle_with_four_slot_offsets,map,thiscall,inferred,objdump + local disassembly + transient-family correlation,2,"Heavier specialization-side transient build branch beneath the `0x005c8c50` table. The helper first requires creation-mode byte `[this+0x3d4] == 1` and live transient seed `[this+0x24e]`, then re-enters the neighboring cleanup gate `0x0045b370(1)`, derives one scaled float from current local geometry through `[this+0x14]`, `[this+0x21]`, `[this+0x3a]`, and the constant at `0x005c8cf4`, and allocates one new handle through `0x00475ed0` into `[this+0x25a]`. It then resolves a current world-position tuple through `0x00414450` and `0x0052e720`, publishes several local offset triplets through `0x00475010`, and configures four numbered channels on the new handle through `0x00475030` with selector ids `1..4`. Current evidence grounds this as a second transient-handle builder in the same specialization-side payload family as `0x0045c310/0x0045b210`, but not yet the user-facing subtype semantics of the handle itself.","objdump + local disassembly + transient-family correlation + geometry-derived offset correlation"
|
||||
0x0040d170,56,placed_structure_build_primary_specialization_transient_when_candidate_flag4b_enabled,map,thiscall,inferred,objdump + local disassembly + candidate-flag correlation,2,"Small specialization-side hook that conditionally builds the primary transient handle through `0x0045c310`. The helper resolves the current candidate from cached stem id `[this+0x3cc]`, follows that candidate's profile or source id through `[entry+0x173]`, and reads dword flag `[candidate+0x4b]`. When that flag is nonzero it tail-calls `placed_structure_specialization_build_primary_transient_handle_from_payload_strings` `0x0045c310`; otherwise it returns immediately. This is the strongest current owner for the candidate-flag-gated primary transient build hook in the `0x005c8c50` specialization family.","objdump + local disassembly + candidate-flag correlation + transient-build correlation"
|
||||
0x0040d1b0,56,placed_structure_release_primary_specialization_transient_when_candidate_flag4b_enabled,map,thiscall,inferred,objdump + local disassembly + candidate-flag correlation,2,"Release-side companion to `0x0040d170`. The helper resolves the same candidate chain from cached stem id `[this+0x3cc]`, reads dword flag `[candidate+0x4b]`, and when that flag is nonzero tail-calls `placed_structure_specialization_release_primary_transient_handle_and_siblings` `0x0045c3c0`; otherwise it returns immediately. Current evidence grounds this as the candidate-flag-gated release hook for the primary specialization transient rather than a generic cleanup entry.","objdump + local disassembly + candidate-flag correlation + transient-release correlation"
|
||||
0x0040d1f0,23,placed_structure_resolve_linked_peer_record_from_cached_site_id,map,thiscall,inferred,objdump + local disassembly,3,"Tiny cached-record resolver over linked site id `[this+0x2a8]`. When that id is nonzero the helper resolves and returns the linked placed-structure record through collection `0x006cec20`; otherwise it returns null. Current grounded callers include the contextual status publisher `0x0040e4e0` and the linked-anchor service family, so this is the safest current read for the direct linked-peer resolver rather than another boolean gate.","objdump + local disassembly + linked-peer resolver correlation"
|
||||
0x0040d210,26,placed_structure_resolve_owner_record_from_cached_owner_id,map,thiscall,inferred,objdump + local disassembly,2,"Tiny cached-record resolver over owner id `[this+0x276]`. When that id is nonzero the helper resolves and returns the corresponding record through collection `0x0062be10`; otherwise it returns null. Current local callers sit on the UI-facing specialization side near `0x0040e9d0`, so the safest current read is one direct owner-record resolver rather than a wider ownership test.","objdump + local disassembly + owner-resolver correlation"
|
||||
0x0040d230,60,placed_structure_has_linked_station_or_transit_peer,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Boolean linked-peer gate over one placed structure. The helper first requires the placed-structure vtable `+0x70` latch, then resolves optional linked site id `[this+0x2a8]` through the live placed-structure collection `0x006cec20`, and finally re-enters `placed_structure_is_station_or_transit_site_class` `0x0047fd50` on that linked peer. Current local callers include the broader `cargo id 0` bypass family and several neighboring linked-site maintenance branches, so this is the safest current read for the narrower linked-peer station-or-transit gate rather than a cargo-reference helper.","objdump + caller xrefs + local disassembly + linked-peer gate correlation"
|
||||
0x0040d2d0,128,placed_structure_refresh_linked_peer_overlay_when_linked_peer_flagged,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Linked-peer visual or state refresh beneath the broader placed-structure rebuild family. The helper first re-enters placed-structure vtable `+0x54` with stack argument `0`, then requires scenario latch `[0x006cec78+0x4ae7]`, the placed-structure vtable `+0x70` linked-site-capable latch, and the narrower linked-peer class gate `0x0047fd50` over optional linked site id `[this+0x2a8]`. When the resolved linked peer carries nonzero byte `[peer+0x5bc]`, it re-enters placed-structure vtable `+0x58` on the current site with literal arguments `(0x5f, 0x5f, 0xff)`. Current grounded caller is `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`, so this is the safest current read for a linked-peer-dependent overlay or status refresh rather than a cargo-side helper.","objdump + caller xrefs + local disassembly + linked-peer flag correlation"
|
||||
0x0040dba0,66,placed_structure_clear_linked_route_entry_state_byte_and_dispatch_unbound_anchor_toggle,map,thiscall,inferred,objdump + caller xrefs + local disassembly + rdata method-table scan,2,"Small linked-site route-entry state helper. The function first requires the placed-structure vtable `+0x70` linked-site-capable latch, then resolves optional linked site id `[this+0x2a8]` through the placed-structure collection `0x006cec20`, forwards the resulting linked peer (or null) plus literal stack flag `1` into `0x0047dda0`, and finally clears local byte `[this+0x42]` to `0`. Current local callers are neighboring placed-structure maintenance branches, and the paired companion at `0x0040dbf0` performs the same route-entry dispatch with the opposite literal and byte writeback. A local `.rdata` scan now tightens the owner split too: `0x0040dba0` and `0x0040dbf0` each appear exactly once, together with getter `0x0040cbf0`, in one concrete placed-structure specialization table rooted at `0x005c8c50`, so this is now the safest current read for one half of a specialization-specific linked-site route-entry state toggle pair rather than a generic family-wide setter.","objdump + caller xrefs + local disassembly + linked-route-entry-toggle correlation + rdata method-table correlation + constructor-chain correlation"
|
||||
0x0040dbf0,65,placed_structure_set_linked_route_entry_state_byte_and_dispatch_unbound_anchor_toggle,map,thiscall,inferred,objdump + caller xrefs + local disassembly + rdata method-table scan,2,"Companion linked-site route-entry state helper paired with `0x0040dba0`. The function first requires the placed-structure vtable `+0x70` linked-site-capable latch, resolves optional linked site id `[this+0x2a8]` through the placed-structure collection `0x006cec20`, forwards the resulting linked peer (or null) plus literal stack flag `0` into `0x0047dda0`, and finally sets local byte `[this+0x42]` to `1`. Current local callers are neighboring placed-structure maintenance branches. A local `.rdata` scan now shows that this paired override appears only in the same concrete placed-structure specialization table at `0x005c8c50` as `0x0040dba0` and `0x0040cbf0`, which keeps this on the specialization-specific linked-site route-entry side rather than on one generic shared-byte setter lane.","objdump + caller xrefs + local disassembly + linked-route-entry-toggle correlation + rdata method-table correlation + constructor-chain correlation"
|
||||
0x0040e360,235,placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Subtype-specific local-runtime follow-on beneath `0x0040eba0` and `0x0040ee10`. The helper resolves the current placed structure's candidate from `[this+0x3cc]` through `0x0062b2fc` and `0x0062b268`, requires subtype byte `[candidate+0x32] == 1` plus candidate class byte `[candidate+0x8c] == 3`, then requires a linked site id at `[this+0x2a8]`. When the linked peer exists and its route-entry anchor at `[peer+0x08]` is live in collection `0x006cfca8`, the helper samples one anchor-side float through `0x0048aab0`, subtracts the fixed offset at `0x005c8738`, combines that result with the current placed structure's coordinate pair through `0x00455810` and `0x00455800`, and publishes the resulting triplet through the shared position setter `0x00530720`. Current grounded caller is the broader local side helper `0x0040ee10`, plus the heavier subtype-driven refresh path at `0x0040eba0`, so this is now the safest current read for the linked-site anchor position-triplet refresh beneath the placed-structure local-runtime family rather than a generic route query.","objdump + caller inspection + local disassembly + linked-site-anchor correlation + local-runtime correlation"
|
||||
0x0040e450,131,placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small wrapper that rebuilds one placed structure's cloned local-runtime record from its current candidate stem and cached profile slot. The helper copies the current stem string from the candidate referenced by `[this+0x3cc]`, resolves the matching live candidate id through `indexed_collection_resolve_live_entry_id_by_stem_string` `0x00416e20`, seeds the projected-rectangle profile-slot cache from `[this+0x252]` through `placed_structure_cache_projected_rect_profile_slot_id` `0x00414470`, and then re-enters `placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds` `0x00418a60` with the current placed-structure pointer. It stores the returned cloned record into `[this+0x24e]`, refreshes the local cached profile slot from `[record+0x732]` into `[this+0x252]`, and ties the clone back to the owning placed structure through `[record+0x73a] = this`. Current grounded caller is the collection-wide wrapper `0x004133b0`, so this now reads as the cloned local-runtime rebuild helper for one live placed structure rather than an unowned stem lookup.","objdump + caller inspection + local disassembly + local-runtime-clone correlation + projected-rect-profile correlation"
|
||||
0x0040e4e0,921,placed_structure_publish_contextual_status_text_for_linked_peer_and_selection_state,map,thiscall,inferred,objdump + local disassembly + localization-call correlation,2,"Large contextual status-text publisher in the same concrete placed-structure specialization family rooted at `0x005c8c50`. The helper first requires creation-mode byte `[this+0x3d4] == 1`, the specialization's linked-site-capable vtable `+0x70` latch, and several shell or modal gates under `0x006d1a8c` and `0x006d12f0`; it then branches across linked-peer checks through `placed_structure_has_linked_station_or_transit_peer` `0x0040d230`, world-mode fields `[0x0062c120+0x2171/+0x2175/+0x2179/+0x2181]`, current owner checks through `0x004337a0`, and candidate or linked-peer display-name lookups through `0x0051c920`. The resulting text is localized through ids such as `0x00af`, `0x00b0`, `0x00b1`, `0x00b2`, `0x00b3`, and `0x0afd`, assembled through `0x00518de0`, and finally pushed into the shell presenter `0x00538c70` with mode `3`. Several branches also trigger world-side follow-ons through `0x00452db0` and `0x00452fa0`, so this is best read as a contextual linked-peer or selection-status publisher with mode-specific side effects rather than a pure formatter.","objdump + local disassembly + localization-call correlation + linked-peer gate correlation + shell-presenter correlation"
|
||||
0x0040e880,329,placed_structure_dispatch_primary_context_action_and_reset_status_presenter,map,thiscall,inferred,objdump + local disassembly + linked-peer gate correlation,2,"Primary context-action dispatcher paired with `placed_structure_publish_contextual_status_text_for_linked_peer_and_selection_state` `0x0040e4e0`. The helper first resets the active shell presenter through `0x00538c70` using the fixed token rooted at `0x005c87a8`, then reuses the same linked-site-capable vtable `+0x70` latch, creation-mode byte `[this+0x3d4] == 1`, linked-peer path `0x0040d230 -> 0x0047f310 -> 0x0048b660`, and world-mode gates `[0x0062c120+0x2175/+0x2179/+0x2181]` to dispatch one of several follow-ons including `0x00413620`, `0x00453510`, `0x00452db0`, and `0x00452fa0`. Current evidence grounds this as the specialization-side primary action or activation dispatcher that accompanies the contextual status publisher, not as another local-runtime refresh helper.","objdump + local disassembly + linked-peer gate correlation + shell-presenter correlation + world-mode branch correlation"
|
||||
0x0040e9d0,464,placed_structure_format_context_label_or_owner_name_for_ui_query,map,thiscall,inferred,objdump + local disassembly + string correlation,2,"Query-style label formatter in the same specialization table `0x005c8c50`. The helper first short-circuits when vtable slot `+0x14` says the current object should not answer, then chooses between three outcomes: when shell branch `[0x006cec74+0x74]` is live it formats one localized label through id `0x00b4`, appends the fixed suffix `\\nAbsIndex %d`, copies that text into the caller buffer through `0x0051d8a0`, and returns `1`; under a narrower owner or company-state path gated by `[this+0x276]`, shell mode `[0x006cec74+0x253]`, the linked-site latch, and the active modal state at `0x006d12f0`, it resolves one company-side display label through `0x00426b10`, stores it through the caller out-pointer, and returns `2`; otherwise it falls back to `0x00455860`. This is therefore the safest current read for a specialization-side UI label or owner-name query wrapper rather than another action dispatcher.","objdump + local disassembly + string correlation + ui-query correlation"
|
||||
0x0040eba0,620,placed_structure_set_world_coords_and_refresh_local_runtime_side_state,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Heavier placed-structure world-coordinate mutation helper above the local-runtime side refresh family. The function updates the current record's world position through `0x00455860`, recomputes cached grid coordinates `[this+0x388]` and `[this+0x38c]`, and rewrites the world-grid owner mapping through `0x0042c9f0` and `0x0042c9a0`. On the candidate subtype-`4` branch it also removes and then re-appends the current site to the nearby-transit proximity bucket family through `placed_structure_collection_remove_site_id_from_all_proximity_bucket_lists` `0x004814c0` and `placed_structure_collection_append_site_into_all_proximity_bucket_lists` `0x00481480`. After that it rebuilds the same local position or scalar triplet family later serviced by `0x0040ee10`, caches the accepted scalar pair in `[this+0x392]` and `[this+0x396]`, publishes the chosen triplet through the shared setter `0x00530720`, optionally refreshes the linked peer route-entry anchor through `0x00480710`, and finally tails into `placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime` `0x0040e360`. Current grounded callers include the broader rebuild paths `0x0040ef10` and `0x0040f6d0`, later site-mutation branches `0x00419110`, `0x0046ef40`, `0x004707da`, and `0x00473bf0`, plus shell-side subject updates around `0x00507cf0` and `0x00508bb0`, so this is now the safest current owner for world-coordinate updates plus local-runtime side-state refresh rather than a generic movement helper.","objdump + caller inspection + local disassembly + world-coordinate mutation correlation + local-runtime correlation + proximity-bucket correlation"
|
||||
0x0040ee10,248,placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small placed-structure local-runtime side refresh over one live record. The helper samples the current structure coordinate pair through `0x00455800` and `0x00455810`, converts that pair through the basis at `0x006d4024`, `0x0051f090`, and `0x00534490` into one base scalar, and then conditionally adjusts that scalar when the linked candidate-side structure record keeps nonzero byte `[candidate+0xba]` via the rounded world-grid sampler `0x0044ae40` and the fixed subtractive offset at `0x005c8840`. When the auxiliary preview owner gate `shell_has_auxiliary_preview_owner` `0x00434050` is active, it rounds that scalar to an integer float. It then publishes the resulting position triplet through the shared setter `0x00530720` and tails into `placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime` `0x0040e360`. Current grounded callers are the collection-wide local-runtime refresh wrapper `0x004133b0` and the connected-component recursion tail `placed_structure_recursive_collect_connected_component_tile_bounds` `0x00415f20`, so this is now the strongest current owner for the per-site local-runtime position-triplet refresh rather than a generic coordinate helper.","objdump + caller inspection + local disassembly + local-runtime correlation + connected-component correlation"
|
||||
0x0040ef10,1984,placed_structure_finalize_creation_or_rebuild_local_runtime_state,map,thiscall,inferred,objdump + caller inspection + placement and mutation correlation,3,"Broad placed-structure post-create or post-edit rebuild above the narrower route-style lane. The helper validates several linked-site and world-state preconditions before keeping the current site live, increments the global live-site count at `0x0062be40`, seeds runtime mode and year fields at `[this+0x390]`, `[this+0x3d4]`, and `[this+0x3d5]`, refreshes the adjacent site-status or overlay family through `0x0040d2d0`, and rebuilds one larger local owner or service bundle through `0x00418be0`, `0x0040eba0`, and the scalar-staging family `0x00475ed0` / `0x00474fe0` / `0x00475010` / `0x00475030` into fields such as `[this+0x24e]`, `[this+0x252]`, `[this+0x25a]`, and `[this+0x25e]`. Later in the same body it re-enters `0x0040db30`, and when the local latch at `[this+0x29e]` is still zero it also re-enters `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0` with stack flag `1`. The tail is tighter now too: when creation-mode byte `[this+0x3d4]` equals `1`, the branch at `0x0040f692` triggers `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with kind `6` just before the local live-site follow-on at `0x433b80`. Current grounded callers include the placement-side builders at `0x00403ef3` and `0x00404489`, later site-mutation paths at `0x0046f073` and `0x004707ff`, and one train-side site operation at `0x005098eb`, so this now looks like the broad post-create or post-edit runtime rebuild above route-style scoring and peer-link emission rather than a route-style-only helper.","objdump + caller inspection + placement and mutation correlation + route-style rebuild correlation + runtime-effect trigger-kind correlation"
|
||||
|
|
@ -45,10 +80,72 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
|
|||
0x00417840,205,placed_structure_project_candidate_grid_extent_offset_by_rotation,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Projects one candidate-sized local grid extent into rotated world-space X or Y offsets for placement and mutation previews. The helper resolves the caller-supplied placed-structure id through the current collection, pulls one local grid basis pair through `0x00413d80`, reads the linked candidate footprint bytes `[candidate+0xb8]` and `[candidate+0xb9]`, converts those grid extents into local offset terms, and then re-enters `map_angle_rotate_grid_offset_pair_into_world_offset_pair` `0x00417790` with the caller-supplied heading float to produce the rotated output pair. Current grounded callers include the city-connection placement chooser `0x00402cb0`, the placed-structure local rebuild lane at `0x0040de78`, subtype-`1` placement validation inside `0x004197e0`, and later world-side update branches at `0x00417b6f`, `0x00417e27`, `0x0041a250`, `0x0041a615`, `0x004802c6`, `0x00480875`, and `0x00480d50`. This now looks like the shared projected-footprint offset helper beneath placement validation rather than an unnamed geometry routine.","objdump + caller xrefs + callsite inspection + placement-correlation"
|
||||
0x004185a0,100,world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Small world-grid mask helper beneath the neighboring projected-rectangle raster family. The helper walks one caller-supplied rectangle from the four dwords rooted at stack arg `+0x04`, reads the aligned float sample band from the caller buffer at stack arg `+0x08`, skips cells whose sample is still the sentinel `0x497423f0`, and otherwise toggles bit `0x01` in the grid-byte mask rooted at `[0x0062c120+0x2135]` by XORing it with the low bit of the caller-supplied byte flag at stack arg `+0x0c`. Current grounded callers are the higher projected-rectangle workers at `0x00418610`, `0x00418a60`, and `0x00418d40`, so this is now bounded as a non-sentinel mask-toggle helper rather than another generic grid writer.","objdump + caller inspection + local disassembly + grid-mask correlation"
|
||||
0x00418610,584,world_grid_refresh_projected_rect_sample_band_and_flag_mask,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared projected-rectangle world-grid helper above the flagged-region float-stats refresher `0x00415020` and the non-sentinel mask-toggle helper `0x004185a0`. The function resolves one placed-structure record from the caller-supplied id, optionally clears an out flag, validates the current global scan rectangle at `0x0062b7a8..0x0062b7b4` against the live world bounds, and then derives the two boolean mode inputs for `0x00415020` from the linked candidate helpers `0x0040cc80`, `0x0040cc60`, and `0x0040cc40`. On success it repopulates the temporary float band at `0x0062b7d0` by sampling every cell in the rectangle through `0x00448aa0`, publishes the rectangle through `0x0044d410`, and on the single-sample path re-enters `0x004185a0` to toggle the corresponding bit-mask cells. The richer branch also probes the current candidate subtype and per-candidate flags, checks local neighborhood acceptance through `0x00414c50`, samples one midpoint float through `0x00448bd0`, and stamps one or more world-grid cells through `0x0044dca0`. Current grounded callers are the neighboring placed-structure runtime helper at `0x00418be0` and the placement validator `placed_structure_validate_projected_candidate_placement` `0x004197e0`, so the safest current read is a projected-rectangle sample-band and flag-mask refresh pass rather than a generic float scan.","objdump + caller inspection + local disassembly + world-grid sample-band correlation + placement-validator correlation"
|
||||
0x00419110,234,placed_structure_collection_refresh_local_runtime_side_state_in_rect_from_cell_bucket_map,map,cdecl,inferred,objdump + caller xrefs + local disassembly + bucket-map correlation,3,"Rectangular placed-structure refresh wrapper over a hashed per-cell bucket map. The helper clamps the caller rectangle against live world dimensions `[0x0062c120+0x2155/+0x2159]`, packs each cell key as `(row << 16) | col`, resolves one bucket head through the caller-supplied map root at `[arg0+0x88]` and the shared hash lookup `0x0053dae0`, and then walks the returned linked chain. For every resolved bucket entry it forwards the stored coordinate pair from `[entry+0x04/+0x08]` plus two zero stack flags into `placed_structure_set_world_coords_and_refresh_local_runtime_side_state` `0x0040eba0` on the current placed-structure owner carried by that entry, so the current effect is a local-runtime side-state refresh across every bucketed site in the rectangle rather than a generic collection iterator. Current grounded caller is the edit-side branch at `0x004bc851`, immediately after the neighboring nibble and companion-float mutations, so this is the safest current read for the bucket-map-driven rect refresh wrapper rather than another world-grid brush helper.","objdump + caller xrefs + local disassembly + bucket-map correlation + local-runtime-side-state correlation"
|
||||
0x00419200,41,world_grid_query_projected_rect_scratch_cell_dword_if_present,map,cdecl,inferred,objdump + caller xrefs + local disassembly + projected-rect correlation,3,"Tiny projected-rectangle scratch-bank getter over the temporary dword cell-value bank rooted at `0x0062b300`. When that bank exists, the helper flattens the caller-supplied cell coordinates through live world width `[0x0062c120+0x2155]` and returns the corresponding dword from the bank; otherwise it returns `0`. Current grounded caller is the later world-side branch at `0x0048af99`, which uses the returned nonzero test as one score or gating input, so this is the safest current read for the projected-rect scratch-cell dword getter rather than another permanent world-grid query.","objdump + caller xrefs + local disassembly + projected-rect correlation + scratch-bank correlation"
|
||||
0x0041ab50,6,city_database_entry_constant_38_stub_vtable_5c9750_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot immediately before the city-database entry load and handle-refresh pair in table `0x005c9750`. The helper returns literal `38` in `EAX` and exits. Current evidence does not justify a higher semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly"
|
||||
0x0041ab60,6,city_database_entry_constant_34_stub_vtable_5c9750_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot immediately before the city-database entry load and handle-refresh pair in table `0x005c9750`. The helper returns literal `34` in `EAX` and exits. Current evidence does not justify a higher semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly"
|
||||
0x0041ab70,5,city_database_entry_load_tagged_payload_via_0x45c6f0,map,thiscall,inferred,objdump + vtable correlation + local disassembly,2,"Tiny city-database-entry-family loader thunk in the sibling vtable rooted at `0x005c9750`. The helper simply jumps into `0x0045c6f0`, which stages tag family `0x61a9/0x61aa/0x61ab`, restores two strings into `[this+0x32e]` and `[this+0x332]`, and iterates the child runtime band rooted at `[this+0x316]`. The table-family alignment is now direct: `map_load_city_database` `0x00474610` iterates its loaded records and dispatches vtable slot `+0x44`, which in `0x005c9750` resolves into the same record family immediately adjacent to this loader slot.","objdump + vtable correlation + local disassembly + city-database loader correlation"
|
||||
0x0041ab80,127,city_database_entry_refresh_named_handle_and_return_scaled_primary_float,map,thiscall,inferred,objdump + caller inspection + local disassembly + city-database family correlation,2,"City-database-entry-family method in the sibling vtable rooted at `0x005c9750`. The helper clears and rebuilds one named handle under owner `0x006d4020`, stores the result into `[this+0x1c]`, queries three base floats through `0x0045c480`, and returns one scaled float derived from the first queried component and constant `0x005c97c0`. Current grounded callers are later world-side branches at `0x0046e4f7`, `0x004aafee`, and `0x004ab020`. The exact user-facing semantic of the handle is still open, but the owning family now aligns structurally with the city-database collection loaded by `0x00474610`.","objdump + caller inspection + local disassembly + city-database family correlation"
|
||||
0x0041ac00,3,city_database_entry_false_stub_vtable_5c9750_slot0,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-false virtual slot adjacent to `0x0041ab80` in the city-database-entry table `0x005c9750`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
|
||||
0x0041ac10,3,city_database_entry_false_stub_vtable_5c9750_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Second tiny literal-false virtual slot adjacent to `0x0041ab80` in the city-database-entry table `0x005c9750`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
|
||||
0x0041ac20,3,city_database_entry_false_stub_vtable_5c9750_slot2,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Third tiny literal-false virtual slot adjacent to `0x0041ab80` in the city-database-entry table `0x005c9750`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
|
||||
0x0041ac30,6,city_database_entry_constant_10_stub_vtable_5c9750_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot in the city-database-entry table `0x005c9750`. The helper returns literal `10` in `EAX` and exits. Current evidence does not yet justify a higher semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly"
|
||||
0x0041ac40,6,city_database_entry_true_stub_vtable_5c9750_slot0,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-true virtual slot adjacent to `0x0041ac30` in the city-database-entry table `0x005c9750`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
|
||||
0x0041ac50,6,city_database_entry_true_stub_vtable_5c9750_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Second tiny literal-true virtual slot adjacent to `0x0041ac30` in the city-database-entry table `0x005c9750`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
|
||||
0x0041f5c0,134,runtime_object_vtable_5c9a60_load_tagged_payload_and_build_dynamic_helper_field_0x37f,map,thiscall,inferred,objdump + vtable scan + local disassembly + sibling-table correlation,2,"Payload-side virtual slot in the sibling runtime-object table rooted at `0x005c9a60`. The helper clamps scalar `[this+0x31b]` to at least `1.0`, clears `[this+0x317]` when that clamp fires, reloads the shared tagged string-triplet payload through `0x00455fc0`, allocates one `0x88`-byte helper through `0x0053b070`, constructs that helper through `0x00518b90`, stores it into `[this+0x37f]`, and then forwards the caller-supplied bundle or stream context into that helper through `0x00518680`. The function returns the accumulated size from the payload reload plus helper load. Current evidence keeps the subtype name open, but the ownership of dynamic helper field `[this+0x37f]` is now grounded.","objdump + vtable scan + local disassembly + sibling-table correlation + dynamic-helper correlation"
|
||||
0x0041f650,31,runtime_object_vtable_5c9a60_load_tagged_string_triplet_and_forward_stream_to_dynamic_helper_0x37f,map,thiscall,inferred,objdump + vtable scan + local disassembly + sibling-table correlation,2,"Small load-side virtual slot in the same sibling runtime-object table `0x005c9a60`. The helper reloads the tagged string-triplet payload through `0x004559d0`, then forwards the same caller-supplied bundle or stream context into helper `[this+0x37f]` through `0x00517d90`. The safest current read is a tagged string-triplet load plus dynamic-helper import wrapper over field `[this+0x37f]`, not a broader collection rebuild.","objdump + vtable scan + local disassembly + sibling-table correlation + dynamic-helper correlation"
|
||||
0x0041f680,25,runtime_object_vtable_5c9a60_refresh_global_preview_helper_and_dispatch_mode1_with_field_0x23a,map,thiscall,inferred,objdump + vtable scan + local disassembly + sibling-table correlation,2,"Small virtual slot in the sibling runtime-object table `0x005c9a60`. The helper first re-enters `0x00455de0`, which refreshes the current global preview or helper owner from the runtime object's normalized coordinates and anchor triplet. It then loads owner handle `[this+0x23a]`, sets `ECX = 1`, and tails into `0x004cf830`, which allocates or refreshes one `0xa0`-byte helper object before forwarding both values into `0x004cf550`. The exact user-facing subtype remains open, so the current note stays structural around the global-preview refresh plus mode-1 dispatch using field `[this+0x23a]`.","objdump + vtable scan + local disassembly + sibling-table correlation + global-preview-helper correlation"
|
||||
0x0041f6a0,11,runtime_object_query_dynamic_helper_slot_count_field_0x37f,map,thiscall,inferred,objdump + local disassembly + sibling-table correlation,2,"Tiny sibling-family helper that treats field `[this+0x37f]` as one indexed collection and returns its current slot count through `indexed_collection_slot_count` `0x00517cf0`. Current grounded caller is `world_region_balance_structure_demand_and_place_candidates` `0x004235c0`, where it bounds one region-local profile or structure-count loop.","objdump + local disassembly + sibling-table correlation + slot-count correlation"
|
||||
0x0041f6b0,40,runtime_object_query_world_scalar_at_rounded_normalized_coords,map,thiscall,inferred,objdump + local disassembly + shared-coordinate-helper correlation,2,"Small shared helper over the broader `0x23a` runtime-object family. It queries the normalized secondary and primary coordinates through `0x00455810` and `0x00455800`, rounds both through `0x005a10d0`, then forwards the resulting integer pair plus the active world root `0x0062c120` into `0x0044afa0`. Current evidence is strong enough only for the rounded-coordinate world-scalar query shape, not for a more semantic name for the returned scalar.","objdump + local disassembly + shared-coordinate-helper correlation + world-scalar-query correlation"
|
||||
0x0041f6e0,12,runtime_object_center_world_grid_cell_has_packed_u16_token,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small helper that resolves the current object's center world-grid cell through `world_region_resolve_center_world_grid_cell` `0x00455f60` and then tails into `world_grid_cell_has_packed_u16_token_in_6byte_roster` `0x0042b2d0` with the caller-supplied `u16` token. Current grounded callers include the city-connection bonus sweep `0x004010f0`, where it acts as a center-cell token probe rather than a broader route or ownership query.","objdump + local disassembly + caller correlation + packed-roster correlation"
|
||||
0x0041f6f0,5,runtime_object_query_flag_byte_0x42,map,thiscall,inferred,objdump + local disassembly + field inspection,1,"Tiny raw byte getter over field `[this+0x42]`. The helper zero-extends that byte into `EAX` and returns immediately, with no side effect. Current evidence does not yet justify a tighter semantic name for the flag itself.","objdump + local disassembly + field inspection"
|
||||
0x0041f700,3,runtime_object_false_stub_vtable_5cfd00_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-false virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
|
||||
0x0041f710,6,runtime_object_true_stub_vtable_5cfd00_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-true virtual slot immediately after `0x0041f700` in the sibling `Infrastructure`-side table `0x005cfd00`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
|
||||
0x0041f720,136,runtime_object_vtable_5c9a60_format_name_and_conditionally_dispatch_action_0x12,map,thiscall,inferred,objdump + vtable scan + local disassembly + caller correlation,2,"Virtual slot in the sibling runtime-object table rooted at `0x005c9a60`. The helper formats the current name lane `[this+0x356]` into one stack-local shell text buffer through `0x005193f0` and `0x00518de0`, publishes that buffer through `0x00538c70`, and then checks world state `[0x0062c120+0x2175]`. When that state is `0` or `0x15`, it dispatches `0x00452fa0` with current helper handle `[this+0x23a]`, literal action `0x12`, and the paired sentinel dwords `0x1869f/0x1869f`. The subtype name behind `0x005c9a60` is still open, so the current note stays structural around the formatted-name publish plus conditional action dispatch.","objdump + vtable scan + local disassembly + caller correlation + sibling-table correlation"
|
||||
0x0041f7b0,42,runtime_object_vtable_5c9a60_publish_fixed_shell_payload_and_jump_0x453510_when_world_state_0x12,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Small virtual slot in the same sibling runtime-object table `0x005c9a60`. The helper publishes the fixed payload at `0x005c87a8` through `0x00538c70`, then checks world state `[0x0062c120+0x2175]`; when that state equals `0x12`, it tails into `0x00453510`. Current evidence is strong enough for the publish-plus-conditional-dispatch shape but not yet for a user-facing subtype name.","objdump + vtable scan + local disassembly + sibling-table correlation"
|
||||
0x0041f7e0,35,placed_structure_prepend_peer_id_into_cached_u16_chain_head_field_0x383,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Small chain-link helper beneath the placed-structure constructor family. The current record supplies cached head word `[this+0x383]`; the caller-supplied peer record receives that old head in `[peer+0x270]`, and the current record then replaces `[this+0x383]` with the peer's own placed-structure id `[peer+0x2a4]`. Current grounded caller is `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0`, which reaches this helper immediately after seeding `[site+0x26e]` and `[site+0x270]`, so the safest read is a prepend into one cached `u16` link chain rather than a broader region or ownership transfer.","objdump + caller xrefs + local disassembly + link-chain correlation"
|
||||
0x0041f810,51,placed_structure_resolve_live_record_from_cached_u16_chain_head_field_0x383,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Small resolver over cached head word `[this+0x383]`. The helper first asks collection `0x0062b26c` whether that `u16` id is still live through `0x00517d40`; when present it resolves and returns the corresponding record through `0x00518140`, otherwise it returns null. Current grounded caller is the higher route-style or transient branch at `0x0043bd62`, which uses the returned record before re-entering `0x0040cf00`.","objdump + caller xrefs + local disassembly + link-chain correlation"
|
||||
0x0041f850,126,placed_structure_remove_peer_from_cached_u16_chain_and_clear_peer_link_words_0x26e_0x270,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Removal-side companion to `0x0041f7e0` beneath the placed-structure rebuild family. The current record owns cached head word `[this+0x383]`, while the caller-supplied peer contributes its placed-structure id `[peer+0x2a4]` and next-link word `[peer+0x270]`. When the head equals the peer id, the helper replaces `[this+0x383]` with the peer's next link; otherwise it walks the current linked `u16` chain through collection `0x0062b26c` and each record's own `[record+0x270]` until it finds the predecessor, then patches that predecessor's `[record+0x270]` to the peer's next link. Before returning it clears both peer link words `[peer+0x26e]` and `[peer+0x270]`. Current grounded caller is the placed-structure rebuild branch at `0x0040e25e`.","objdump + caller xrefs + local disassembly + link-chain correlation"
|
||||
0x0041f8d0,55,placed_structure_clear_cached_u16_chain_from_head_field_0x383,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Small chain-clear helper over cached head word `[this+0x383]`. Starting from that `u16` head id, the helper repeatedly resolves each live record through collection `0x0062b26c`, follows link word `[record+0x270]`, and clears both `[record+0x26e]` and `[record+0x270]` on every traversed record until the chain reaches zero. Current grounded caller is the release-side helper `0x00420670`, which uses this pass immediately before tailing into base cleanup `0x00455d20`.","objdump + caller xrefs + local disassembly + link-chain correlation"
|
||||
0x0041f910,46,runtime_object_query_mode_gate_or_flag_byte_0x42_when_class0,map,thiscall,inferred,objdump + local disassembly + mode-gate correlation,2,"Small mode-gated flag query adjacent to the sibling runtime-object family. It first checks shell mode gate `0x004338c0` on the active scenario root `0x006cec78`; when that gate is inactive it returns literal `1`. When the gate is active it also returns `1` for nonzero class dword `[this+0x23e]`, and only on the class-0 path does it return byte `[this+0x42]`. This keeps the current note structural around the mode-gated runtime-flag query rather than overnaming the flag itself.","objdump + local disassembly + mode-gate correlation + field inspection"
|
||||
0x00412af0,117,indexed_collection_find_live_entry_id_by_casefolded_name_at_field_0x04,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small indexed-collection lookup by casefolded name. The helper walks the live entries through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, compares the first byte of the caller string against entry field `[entry+0x04]` after normalizing both through `0x0051d660`, and then falls back to full string comparison through `0x005a57cf`. On the first exact match it returns that live entry id; otherwise it returns `0`. Current grounded caller is `0x00412b70`, which uses it over the structure-candidate pool `0x0062b268`.","objdump + local disassembly + caller correlation + collection-name-lookup correlation"
|
||||
0x00412b70,35,indexed_collection_resolve_live_entry_by_casefolded_name_at_field_0x04,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small resolve-by-name wrapper over `indexed_collection_find_live_entry_id_by_casefolded_name_at_field_0x04` `0x00412af0`. It searches the current collection for the caller-supplied casefolded name, and when a live id is found it resolves and returns the backing record through `indexed_collection_resolve_live_entry_by_id` `0x00518140`; otherwise it returns null. Current grounded callers are the region-profile helpers `0x0041f940` and `0x0041f9b0`, where it resolves structure-candidate records from region-profile labels against the global candidate pool `0x0062b268`.","objdump + local disassembly + caller correlation + collection-name-lookup correlation"
|
||||
0x0041f940,88,world_region_count_structure_profiles_passing_availability_gate,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Counts the current region subcollection entries at `[region+0x37f]` whose backing candidate resolves through `0x00412b70` and passes the neighboring availability gate `0x0041f998`. The helper walks the live subcollection backward through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, increments the running count only for candidates that survive both gates, and returns that total. Current grounded caller is the editor-side region panel family around `0x004cbe19`, where it acts as the ungated companion to the stricter year-filtered counter `0x0041f9b0`.","objdump + local disassembly + caller correlation + region-subcollection correlation"
|
||||
0x0041f998,23,structure_candidate_availability_gate_reject_subtype2_without_availability_word_or_recipe_runtime,map,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Tiny flag-setting predicate over one structure-candidate record. Candidates whose subtype byte `[candidate+0x32]` is not `2` pass immediately. Subtype-`2` candidates only pass when availability word `[candidate+0xba]` is nonzero or runtime recipe latch `[candidate+0x7ac]` is nonzero; when both are zero the helper leaves the zero flag set so its callers reject the candidate. Current grounded callers are the two region-profile counters `0x0041f940` and `0x0041f9b0`.","objdump + local disassembly + caller correlation + candidate-availability correlation"
|
||||
0x0041fb00,1130,world_region_class0_stamp_local_secondary_overlay_and_scored_refinement_pass,map,thiscall,inferred,objdump + caller xrefs + local disassembly + raster-helper correlation,3,"Heavy per-region helper used only on class-0 region records. The function skips any region whose class dword `[region+0x23e]` is nonzero, rounds the region's normalized coordinates through `0x00455800`, `0x00455810`, and `0x005a10d0`, derives one orientation bucket from `(x+y)&3`, and then runs two bounded local passes around that center. The first pass walks one orientation-dependent ring pattern from the static offset tables `0x00624b28/0x00624b48`, probes quarter-resolution secondary-raster cells through `0x00534e10`, and when that predicate stays clear marks the local secondary overlay through `0x004497a0(world, x, y, 1, 3, 1)`. The second pass scans a bounded square around the same center, scores each in-bounds cell through `math_measure_float_xy_pair_distance` `0x0051db80`, and then combines the local helper cluster `0x00534040`, `0x005340a0`, `0x00534100`, and `0x00533fe0` before returning. Current grounded callers are the region collection walk at `0x00421d04` and the earlier world-build special case at `0x0044308e`, where the same helper runs immediately before `world_region_collection_clear_cell_region_word_and_assign_nearest_region_ids` `0x00421730`.","objdump + caller xrefs + local disassembly + raster-helper correlation + region-build correlation"
|
||||
0x0041fff0,61,world_query_shell_mode2_or_thresholded_preview_scalar_gate,map,cdecl,inferred,objdump + caller xrefs + local disassembly + global-field correlation,2,"Small global gate over shell state `0x006cec74` and preview owner `0x0062be68`. The helper reads dword `[shell+0x2bb]` and returns `1` immediately when that mode equals `2`; when the mode is nonzero but not `2` it instead compares preview scalar `[0x0062be68+0x20]` against float threshold `0x005c9a9c` and returns `1` only when that comparison passes. Zero mode returns `0`. Current grounded callers are the scored world-scalar helper `0x0044afa0` and the city-connection status formatter band around `0x00420b09`, so the safest current read is the shared shell-mode-or-thresholded-preview gate rather than a region-only predicate.","objdump + caller xrefs + local disassembly + global-field correlation + threshold-gate correlation"
|
||||
0x00455660,131,runtime_object_publish_world_anchor_triplet_from_normalized_xy_and_height_bias,map,thiscall,inferred,objdump + caller xrefs + local disassembly + sibling-vtable correlation,2,"Shared helper over the broader `0x23a` runtime-object family. The function scales the caller-supplied normalized coordinate pair through `0x005c8700`, converts that pair through world-basis owner `0x006d4024` plus `0x0051f090` and `0x00534490`, adds one caller-supplied integer height bias, optionally rounds that height when `shell_has_auxiliary_preview_owner` `0x00434050` is active, and publishes the resulting world-anchor triplet through `0x00530720`. It is used directly from both the city-entry side (`0x00455d09`, `0x00474253`) and the placed-structure specialization side through `0x0045b110`, so the safest current read is one shared world-anchor triplet publisher from normalized XY plus height bias rather than a city-only geometry helper.","objdump + caller xrefs + local disassembly + sibling-vtable correlation + world-anchor correlation"
|
||||
0x004557b0,64,record_collection_release_global_iteration_root_0x6acd40_if_present,map,cdecl,inferred,objdump + caller xrefs + local disassembly,2,"Small release-side helper over the current global iteration root at `0x006acd40`. When that root is live the helper clears companion dword `0x006acd3c`, re-enters `0x0045b160` and `0x0045b040` on the pointed record, frees the record through `0x0053b080`, and finally clears `0x006acd40` itself. Current grounded callers include the shell detail-panel manager `0x004ddfc1`, the earlier world-side branch `0x00434a8c`, the building-detail side branch `0x004b6f64`, and later shell constructors at `0x00505dc6` and `0x005147e4`, so the safest current read is one shared global-iteration-root release helper rather than a tool-window-specific cleanup path.","objdump + caller xrefs + local disassembly + global-root correlation"
|
||||
0x00455800,13,runtime_object_query_normalized_primary_coord,map,thiscall,inferred,objdump + caller xrefs + field inspection + sibling-vtable correlation,2,"Tiny float getter shared across the broader `0x23a` runtime-object family. The helper loads the float at `[this+0x1e2]`, divides it by scale constant `0x005c8700`, and returns the normalized result. It is used pervasively beside `0x00455810` from city-side, placed-structure, route-link, and world-grid callers, and now also appears under both the city-entry table `0x005c9750` and the sibling `Infrastructure` table `0x005cfd00`, so the safest current read is one normalized primary coordinate getter rather than a fully named X/Y accessor.","objdump + caller xrefs + field inspection + sibling-vtable correlation"
|
||||
0x00455810,13,runtime_object_query_normalized_secondary_coord,map,thiscall,inferred,objdump + caller xrefs + field inspection + sibling-vtable correlation,2,"Tiny float getter paired with `0x00455800` across the broader `0x23a` runtime-object family. The helper loads the float at `[this+0x1ea]`, divides it by scale constant `0x005c8700`, and returns the normalized result. It is used pervasively beside `0x00455800` and appears under both the city-entry table `0x005c9750` and the sibling `Infrastructure` table `0x005cfd00`, so the safest current read is one normalized secondary coordinate getter rather than a fully named X/Y accessor.","objdump + caller xrefs + field inspection + sibling-vtable correlation"
|
||||
0x00455930,148,runtime_object_serialize_two_triplet_scalar_bands,map,thiscall,inferred,objdump + local disassembly + serializer symmetry + sibling-vtable correlation,2,"Shared serializer over the broader `0x23a` runtime-object family. The helper first queries two triplet-like scalar bands through `0x0052e720` and `0x0052e880`, then writes the six resulting dwords to the caller-supplied bundle or stream through `0x00531030`. The recovered load-side counterpart at `0x004559d0` restores the same `[this+0x206/+0x20a/+0x20e]` band beneath tags `0x55f1..0x55f3`, and the same serializer slot appears in both the city-entry table `0x005c9750` and the sibling `Infrastructure` table `0x005cfd00`, so the safest current read is one shared serializer for two triplet scalar bands rather than a city-only stream helper.","objdump + local disassembly + serializer symmetry + sibling-vtable correlation"
|
||||
0x004559d0,102,runtime_object_load_tagged_string_triplet_and_dispatch_slot_0x4c,map,thiscall,inferred,objdump + local disassembly + serializer symmetry + sibling-vtable correlation,2,"Shared tagged load-side mirror beneath the broader `0x23a` runtime-object family. The helper opens tags `0x55f1/0x55f2/0x55f3`, restores the three string lanes `[this+0x206/+0x20a/+0x20e]` through `0x00531410`, dispatches vtable slot `+0x4c`, then re-enters `0x0052ec50` before closing the tagged bracket. It is the strongest current tagged load-side counterpart to `runtime_object_serialize_two_triplet_scalar_bands` `0x00455930`, not an unrelated bundle helper.","objdump + local disassembly + serializer symmetry + sibling-vtable correlation"
|
||||
0x00455a40,3,record_collection_dispatch_entry_virtual_slot_0x44,map,thiscall,inferred,objdump + caller xrefs + local disassembly,1,"Tiny collection-side dispatcher that jumps directly through the current entry vtable slot `+0x44`. Current grounded caller is the linked-list sweep at `0x0048a766`, where it is used while iterating sibling records under `0x00556ef0/0x00556f00`. The safest current read is a raw `slot+0x44` dispatch helper rather than a more semantic serializer name.","objdump + caller xrefs + local disassembly + linked-list sweep correlation"
|
||||
0x00455a50,28,record_collection_dispatch_entry_virtual_slot_0x40_and_clear_global_iteration_roots,map,thiscall,inferred,objdump + caller xrefs + local disassembly,1,"Small collection-side wrapper that pushes one caller argument into current entry vtable slot `+0x40`, then clears the three global roots at `0x006acd38`, `0x006acd3c`, and `0x006acd40`. Current grounded caller is the object-construction path at `0x0048dd77`, so the safest current read is a raw `slot+0x40` dispatch plus global-iteration-root reset helper rather than a more semantic load or attach name.","objdump + caller xrefs + local disassembly + global-root reset correlation"
|
||||
0x00455a70,135,runtime_object_publish_current_position_triplet_with_height_bias,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Small runtime-object helper that queries the current position pair through `0x0052e720`, converts that pair through `0x006d4024 -> 0x0051f090 -> 0x00534490`, adds one caller-supplied integer height bias, optionally rounds the result through `0x005a10d0` when `shell_has_auxiliary_preview_owner` `0x00434050` is active, and publishes the resulting triplet through `0x00530720`. Current grounded callers are the bounded-region sweeps at `0x00421fef` and `0x00461808`, which makes this the safest current read for a generic current-position triplet publisher rather than a city-entry-only helper.","objdump + caller xrefs + local disassembly + position-triplet correlation"
|
||||
0x00455820,23,runtime_object_store_byte43_triplet_from_three_bytes_and_recurse_children,map,thiscall,inferred,objdump + local disassembly + wrapper inspection,2,"Tiny wrapper over `0x0052e680`. The helper forwards three caller-supplied byte lanes plus literal recursion flag `1`, causing the downstream packed-byte setter to write byte-triplet lane `[this+0x43]` and recurse across child list `[this+0x75]` when present. The safest current read is a convenience wrapper that seeds the shared packed-byte-triplet family from three explicit byte arguments.","objdump + local disassembly + wrapper inspection + packed-byte-family correlation"
|
||||
0x00455840,23,runtime_object_store_byte43_triplet_from_packed_u24_and_recurse_children,map,thiscall,inferred,objdump + local disassembly + wrapper inspection,2,"Tiny wrapper over `0x0052e680`. The helper unpacks one caller-supplied dword into three byte lanes, forces recursion flag `1`, and forwards the result into the shared packed-byte setter for lane `[this+0x43]`. The safest current read is a convenience wrapper that seeds the shared packed-byte-triplet family from one packed `u24`-style value rather than three explicit byte arguments.","objdump + local disassembly + wrapper inspection + packed-byte-family correlation"
|
||||
0x00455860,5,runtime_object_thunk_to_shared_formatter_0x530820,map,thiscall,inferred,objdump + local disassembly + caller correlation,1,"Tiny tail-jump thunk that forwards directly into `0x00530820`. Current grounded callers include the placed-structure UI formatter `0x0040e9d0` and the city-site connection-status formatter `0x004207d0`, so the safest current read is a shared fallback formatter thunk rather than a standalone owner.","objdump + local disassembly + caller correlation"
|
||||
0x00455870,83,runtime_object_load_two_triplet_scalar_bands_from_stream_and_publish_them,map,thiscall,inferred,objdump + local disassembly + stream-load symmetry,2,"Shared load-side helper over the broader `0x23a` runtime-object family. The function reads six four-byte lanes from the caller-supplied stream through `0x00531150`, then publishes the first three as one triplet through `0x00530720` and the second three through `0x0052e8b0`. The accumulated return value is the summed byte count from those six `0x531150` reads. This is the strongest current load-side counterpart to `runtime_object_serialize_two_triplet_scalar_bands` `0x00455930` rather than an unrelated stream helper.","objdump + local disassembly + stream-load symmetry + triplet-publish correlation"
|
||||
0x00455b20,72,runtime_object_initialize_base_0x23a_record_fields,map,thiscall,inferred,objdump + caller xrefs + local disassembly + field-layout correlation,2,"Shared base initializer for one `0x23a`-sized runtime object family. The helper installs base vtable `0x005cb1c0`, clears the scalar bands `[this+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroes the seven-dword block `[this+0x212..+0x22a]`, and re-enters `0x0052ecd0` before returning `this`. Current grounded callers include the city-entry temporary constructor `0x00474110`, multiple specialization loaders around `0x0045b683/0x0045c893`, and the object-construction path at `0x0048dd65`, so the safest current read is a shared base-field initializer rather than a city-only constructor.","objdump + caller xrefs + local disassembly + field-layout correlation + object-size correlation"
|
||||
0x00455b00,1,runtime_object_noop_stub_vtable_5cfd00_slot0,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Literal no-op stub in the sibling `Infrastructure`-side table `0x005cfd00`. The function returns immediately with no field access or side effect. Current evidence does not justify a stronger semantic name.","objdump + vtable scan + local disassembly"
|
||||
0x00455b10,1,runtime_object_noop_stub_vtable_5cfd00_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Second literal no-op stub in the sibling `Infrastructure`-side table `0x005cfd00`. The function returns immediately with no field access or side effect. Current evidence does not justify a stronger semantic name.","objdump + vtable scan + local disassembly"
|
||||
0x00455b70,266,runtime_object_initialize_scalar_bands_from_optional_string_triplet_and_mode_defaults,map,thiscall,inferred,objdump + caller xrefs + local disassembly + field-layout correlation,2,"Shared initializer over the same `0x23a`-sized runtime object family. The helper clears the scalar bands `[this+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroes the seven-dword block `[this+0x212..+0x22a]`, re-enters `0x0052ecd0`, optionally copies up to three caller-supplied strings into `[this+0x206]`, `[this+0x20a]`, and `[this+0x20e]` through `0x0051d820`, synthesizes one default local token buffer when the middle string is absent through `0x00518de0`, chooses one effective mode string from the third or first input, derives one owner handle or transform token through `0x0051f090` unless the caller suppresses that path, and then re-enters `0x0052edf0` plus `0x0052e670` to seed the remaining runtime scalar band. Current grounded callers span the city-entry constructor `0x004741e3`, several specialization-side rebuilds, and later object constructors at `0x0048a299`, `0x0048a31d`, and `0x00490a79`, so the safest current read is a shared scalar-band initializer from optional string triplet plus mode defaults rather than a city-only helper.","objdump + caller xrefs + local disassembly + field-layout correlation + optional-string correlation + mode-default correlation"
|
||||
0x00455fc0,250,runtime_object_load_tagged_string_triplet_and_reseed_scalar_bands,map,thiscall,inferred,objdump + local disassembly + serializer symmetry + sibling-vtable correlation,2,"Shared tagged-payload loader over the broader `0x23a` runtime-object family. The helper clears the scalar bands `[this+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroes `[this+0x212..+0x22a]`, re-enters `0x0052ecd0`, opens the tagged bracket `0x55f1..0x55f3`, reads three temporary strings through `0x00531380`, reseeds the runtime scalar band through `runtime_object_initialize_scalar_bands_from_optional_string_triplet_and_mode_defaults` `0x00455b70` with default float lanes `1.0/1.0` and flag `0`, then dispatches vtable slot `+0x48` and re-enters `0x0052ebd0`. Current grounded callers include the city-entry refresh helper `0x00474260` and the placed-structure specialization loader `0x0045c150`, so the safest current read is a shared tagged string-triplet loader plus scalar-band reseed rather than a city-only payload helper.","objdump + local disassembly + serializer symmetry + sibling-vtable correlation + scalar-band reseed correlation"
|
||||
0x004560c0,53,runtime_object_query_nested_lookup_float_via_fields_0x14_0x3a_0x21,map,thiscall,inferred,objdump + local disassembly + field-chain correlation,1,"Small shared float query over the broader `0x23a` runtime-object family. When lookup root `[this+0x14]` is nonnull, the helper derives one nested table offset from `[this+0x3a]` and `[this+0x21]`, follows that chain, and returns the float at the resolved record's `+0x18`; otherwise it returns `0.0`. Current evidence grounds the lookup chain but not the higher semantic meaning of those fields, so the note stays deliberately structural.","objdump + local disassembly + field-chain correlation"
|
||||
0x00418a60,372,placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small local-runtime record builder above the projected-rectangle and connected-component helpers. The function selects one template slot from the local runtime scratch family rooted at `0x0062b2f8` using index `0x0062ba74`, resolves one caller-supplied subject coordinate pair through `0x0052e720`, clones the chosen template block into one queued runtime record from the caller-owned list, refreshes its local side fields through `0x00415820`, and then re-enters `world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples` `0x004185a0` plus `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh` `0x00416170` over the cloned record's rectangle at `[record+0x4a0]`. It also refreshes several subject-link fields including `[record+0x742]`, `[record+0x74a]`, and the optional derived value at `[record+0x736]` through `placed_structure_try_select_projected_rect_profile_slot` `0x00415570`, then increments `0x0062ba74` and returns the cloned record. Current grounded caller is `0x0040e450`, which stores the result into `[site+0x24e]` and ties it back to the current placed-structure through `[record+0x73a]`, so this now looks like the current-subject local-runtime clone or refresh helper rather than another generic grid scan.","objdump + caller inspection + local disassembly + local-runtime-template correlation + projected-rect-profile correlation"
|
||||
0x00418be0,346,placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader local-runtime record builder used during placed-structure construction and rebuild. The helper first resolves one live candidate id from the caller-supplied stem string through `indexed_collection_resolve_live_entry_id_by_stem_string` `0x00416e20`, then builds one projected runtime scratch payload through `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0`. It next re-enters `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, optionally refreshes one neighboring local scratch result through `placed_structure_render_local_runtime_overlay_payload_from_projected_bounds` `0x00418040`, and then copies the finished scratch block rooted at `0x0062b308` into one queued runtime record from the caller-owned list. After seeding the cloned record's link fields at `[record+0x742]`, `[record+0x74a]`, and `[record+0x736]`, it finally re-enters `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh` `0x00416170` when the record's rectangle at `[record+0x4a0]` is valid. Current grounded callers are `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`, `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0`, and the neighboring local-runtime refresh caller at `0x0040dc40`, so this is now the strongest current owner for building one placed-structure local runtime record from candidate stem plus projected scratch rather than an unnamed neighboring helper.","objdump + caller inspection + local disassembly + local-runtime-record correlation + overlay-payload correlation"
|
||||
0x004197e0,5232,placed_structure_validate_projected_candidate_placement,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavy placement validator beneath the city-connection chooser and several direct mutation paths. The helper resolves one anchor placed-structure id from the current collection at `0x0062b2fc`, optionally validates the caller-supplied company through `0x0062be10`, scenario-state and shell-mode gates around `0x004338c0` and `[0x006cec7c+0x82]`, the current world tile through `0x00414bd0` and `0x00534e10`, and territory access through `0x00424010`, and then walks a large footprint-validation pass over the linked candidate record from `0x0062b268`. That deeper pass uses the candidate footprint bytes `[candidate+0xb8]` and `[candidate+0xb9]`, multiple temporary occupancy banks on the stack, route or road-side probes through `0x00448af0`, `0x004499c0`, and `0x00413df0`, and subtype-specific follow-on branches keyed by `[candidate+0x32]` plus optional route-entry and company-side arguments. The strongest current subtype-specific branch is `[candidate+0x32] == 1`, where the helper re-enters `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, checks route-entry ownership and company track-laying capacity through `0x004240a0`, tries one explicit track-attachment path through `0x00494cb0`, and then falls back to one steeper world-space sweep through `0x00448bd0`. In that branch the optional failure buffer now has a concrete station-attachment or upgrade-style family: `0x0b55` `2901` not enough room to upgrade the station, `0x0b56` `2902` ground not flat enough for the upgraded station, `0x0b57` `2903` not your track, `0x0b58` `2904` not enough available track laying capacity, `0x0b59` `2905` cannot connect to existing track but too close to lay new track, and `0x0b5a` `2906` ground too steep for this building, with older fallback strings `0x00be/0x00bf` still used on neighboring exits. The helper returns a placement-success boolean and is currently grounded as the shared go-or-no-go gate immediately before direct placement commits, without yet proving that every caller is station-only. Current grounded callers include both direct-placement lanes inside `city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0`, the placed-structure local rebuild branch at `0x0040dedb`, later mutation or editor-side branches at `0x00422afa`, `0x0046ef6b`, `0x0047070f`, `0x00472bcc`, `0x00472cd4`, and two shell-side callers at `0x00507f57` and `0x005083cc`.","objdump + caller xrefs + callsite inspection + company-access correlation + footprint-validation correlation + RT3.lng failure-text correlation"
|
||||
0x00480210,448,placed_structure_construct_linked_site_record_from_anchor_and_coords,map,thiscall,inferred,objdump + caller inspection + constructor inspection,3,"Lower constructor beneath the linked-site allocator at `0x00481390`. The helper writes the new placed-structure id into `[this+0x00]`, stages one anchor or parent placed-structure id at `[this+0x04]`, clears the route-anchor field at `[this+0x08]`, the display-name buffer at `[this+0x46b]`, and several local list or scratch bands rooted at `[this+0x18]`, `[this+0x112]`, and `[this+0x5bd]`, then seeds local world-space state from the anchor site through `0x00455730`, `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, and the grid helper at `0x0040cec0`. It quantizes the caller-supplied coordinate pair into `[this+0x4a8]` and `[this+0x4ac]`, initializes one grid-keyed owner lane through `0x0042bbb0`, and then chooses an initial route-entry anchor into `[this+0x08]` through `0x00417b40` when one compatible route entry already covers the projected point window. When that early anchor path does not hold, the helper falls back into the neighboring literal-policy-`1` route-entry synthesis family around `0x00493cf0`: current caller correlation says that byte is the direct linked-site endpoint-anchor creation or replacement lane, after which the helper rebinds `[this+0x08]` through `0x0048abc0` and updates the boolean marker at `[this+0x46a]`. Current direct caller is `placed_structure_collection_allocate_and_construct_linked_site_record` `0x00481390`, which makes this the clearest current lower constructor for the linked-site records later published through `[site+0x2a8]`.","objdump + caller inspection + constructor inspection + route-anchor correlation + linked-site correlation + linked-site policy-byte split correlation"
|
||||
0x0048a1e0,336,runtime_object_attach_infrastructure_child_with_optional_first_child_triplet_clone,map,thiscall,inferred,objdump + caller xrefs + local disassembly + rdata correlation,2,"Shared `Infrastructure` child-attach helper over the broader `0x23a` runtime-object family. The function first checks the caller's child list at `[this+0x08]`. When that list holds more than one child, it samples the first child's two triplet scalar bands through `0x0052e880` and `0x0052e720`, destroys the caller-selected prior child through vtable slot `+0x18(0)`, allocates a fresh `0x23a` object, installs vtable `0x005cfd00`, seeds it through `0x00455b70` with literal stem `Infrastructure`, attaches it back to the owner through `0x005395d0`, and republishes the sampled triplets through `0x0052e8b0` and `0x00530720`. When the owner has at most one child, it still allocates and seeds the same `Infrastructure` object but attaches it through `0x0053a5d0` without the cloned-triplet republish. Current grounded callers are the repeated builder branches around `0x004a2cde..0x004a37d9`, so this is the safest current read for attaching one seeded `Infrastructure` child with an optional first-child triplet clone rather than a subtype-specific UI helper.","objdump + caller xrefs + local disassembly + rdata correlation + child-attach correlation"
|
||||
0x0048abc0,11,linked_site_set_route_entry_anchor_id_field_0x222,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Tiny direct setter over linked-site dword `[this+0x222]`. The helper stores the caller-supplied route-entry id and returns. Current grounded callers are the linked-site constructor and refresh family at `0x00480210`, `0x00480bb0`, and nearby repair branches `0x00480463`, `0x00480968`, `0x00480ac1`, and `0x00480da1`, where this field is treated as the currently chosen route-entry anchor id. The safest current read is therefore a direct linked-site route-entry-anchor setter rather than a generic scalar write.","objdump + caller xrefs + local disassembly + route-anchor correlation"
|
||||
0x0048abd0,1,linked_site_noop_stub,map,thiscall,inferred,objdump + local disassembly,1,"Literal no-op stub adjacent to the linked-site route-entry-anchor helpers. The function returns immediately with no field access or side effect. Current evidence does not justify a stronger semantic name.","objdump + local disassembly"
|
||||
0x0048abe0,15,linked_site_query_mode_field_0x226_equals_2,map,thiscall,inferred,objdump + local disassembly,2,"Tiny predicate over linked-site dword `[this+0x226]`. The helper returns `1` only when that field equals literal `2`. Current local callers are still indirect through the linked-site vtable, so the field's player-facing meaning remains open; the safest current read is a direct `mode == 2` predicate over linked-site field `0x226`.","objdump + local disassembly + linked-site-field correlation"
|
||||
0x0048dd50,359,runtime_object_rebuild_infrastructure_children_and_refresh_primary_child_slot,map,thiscall,inferred,objdump + local disassembly + caller correlation + rdata correlation,2,"Loop-driven `Infrastructure` child rebuild beneath the same `0x005cfd00` family. For each ordinal `0..count-1`, the helper allocates a fresh `Infrastructure` child, dispatches that child through `record_collection_dispatch_entry_virtual_slot_0x40_and_clear_global_iteration_roots` `0x00455a50`, and either tears the child down when the current ordinal is above `5` or attaches it back to the owner through `0x005395d0` after republishing the child's current triplet bands. When owner field `[this+0x248]` still points at the same ordinal index byte, it replaces that cached primary-child slot with the rebuilt child. After the loop it recomputes one grid anchor from current world-space fields, refreshes the current world cell through `0x00448a70`, conditionally re-enters `0x00493660` and `0x0048b660` when byte `[this+0x216]` equals `1`, and finally re-enters `0x0048b660` once more before returning. The current note stays structural because the user-facing subtype semantics remain open, but the `Infrastructure` child-rebuild ownership is strong.","objdump + local disassembly + caller correlation + rdata correlation + child-rebuild correlation"
|
||||
0x0048e140,24,runtime_object_resolve_route_entry_from_field_0x206,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Tiny direct resolver over owner dword `[this+0x206]`. When the current object is nonnull, the helper resolves that id through route-entry collection `0x006cfca8` and returns the resulting record; otherwise it returns null. Current grounded callers include the repeated `Infrastructure`-side builder family around `0x004a2cec` and the tracker regroup helper `0x004a4ff0`.","objdump + caller xrefs + local disassembly + route-entry-field correlation"
|
||||
0x0048e160,24,runtime_object_resolve_route_entry_from_field_0x20a,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Tiny direct resolver over owner dword `[this+0x20a]`. When the current object is nonnull, the helper resolves that id through route-entry collection `0x006cfca8` and returns the resulting record; otherwise it returns null. Current grounded callers include the repeated `Infrastructure`-side builder family around `0x004a2d15` and the tracker regroup helper `0x004a4ff0`.","objdump + caller xrefs + local disassembly + route-entry-field correlation"
|
||||
0x0048e180,24,runtime_object_resolve_route_entry_from_field_0x20e,map,thiscall,inferred,objdump + local disassembly + route-entry-field correlation,2,"Tiny direct resolver over owner dword `[this+0x20e]`. When the current object is nonnull, the helper resolves that id through route-entry collection `0x006cfca8` and returns the resulting record; otherwise it returns null. It is the third direct sibling of `0x0048e140` and `0x0048e160` over the same triplet-backed route-entry field family.","objdump + local disassembly + route-entry-field correlation"
|
||||
0x00490a3c,123,runtime_object_attach_optional_infrastructure_child_and_seed_three_position_lanes,map,thiscall,inferred,objdump + local disassembly + rdata correlation,2,"Optional `Infrastructure` child-attach branch beneath the same broader runtime-object family. When the caller-supplied payload stem is nonnull, the helper allocates a fresh `0x23a` object, installs vtable `0x005cfd00`, seeds it through `0x00455b70` with literal stem `Infrastructure`, and attaches it back to the current owner through `0x005395d0`. It then publishes two caller-supplied position lanes through `0x00539530`, one third lane through `0x0053a5b0`, and optionally stores the new child into owner field `[this+0x248]` when the trailing pointer argument is nonnull. The safest current read is therefore an optional `Infrastructure` child attach plus three-lane seed helper rather than a broader constructor for the whole owner object.","objdump + local disassembly + rdata correlation + child-attach correlation"
|
||||
0x00413580,160,placed_structure_collection_refresh_quarter_subset_route_style_state,map,thiscall,inferred,objdump + caller inspection + collection-iteration inspection,3,"Collection-wide placed-structure sweep that refreshes one quartered subset of the route-style lane on each call. The helper computes a start index from the scenario time byte at `0x006cec78+0x11` modulo `4`, then walks every fourth live placed-structure record in the collection, requiring each record to pass the linked-instance class gate `0x0040c990 == 1` before re-entering `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0` with stack flag `0`. After each qualifying per-site rebuild it seeds the two trailing dword fields at `[site+0x3d9]` and `[site+0x3dd]` from `0x518d70`. Current grounded caller is the recurring simulation-maintenance branch at `0x0040a91f`, which makes this the strongest current owner for the periodic quarter-subset refresh of route-style peer-link state rather than a one-shot world-build pass.","objdump + caller inspection + collection-iteration inspection + periodic-cadence correlation"
|
||||
0x00414fa0,118,world_grid_count_flagged_cells_and_collect_float_samples,map,cdecl,inferred,objdump + callsite inspection,3,"Counts flagged cells inside the current global rectangular scan window rooted at `0x0062b7a8..0x0062b7b4` and collects one float sample per hit. The helper walks the byte-mask grid rooted through `0x0062c120+0x2135`, requires bit `0x01` on each scanned cell, reads the aligned float field through `0x00448aa0`, stores the samples into the caller buffer, and returns the number of collected entries. Current grounded caller is `0x00415020`, where this sample list is reduced into one mean value before the wider flagged-region pass continues.","objdump + callsite inspection + world-grid scan correlation"
|
||||
0x00415020,1968,world_grid_refresh_flagged_region_float_extrema_and_mean,map,cdecl,inferred,objdump + caller inspection,3,"Refreshes one global flagged-region float summary family rooted at `0x0062b7b8`, `0x0062b7bc`, `0x0062b7c0`, and `0x0062b7c4`. The helper first resets the current extrema sentinels, seeds one region-dependent threshold from the world-side `0x0062b2fc+0x9c` latch, collects up to `0x80` flagged-cell float samples through `world_grid_count_flagged_cells_and_collect_float_samples` `0x00414fa0`, and reduces them to one average stored at `0x0062b7c4`. It then rescans the same flagged rectangle, updating the min and max extrema from per-cell float values while applying one build-`1.04+` compatibility branch at `0x41518e`: when no current mode override is active and the world-side latch at `0x0062b2fc+0x9c` is clear, builds below `1.04` still allow one older fallback acceptance path that later builds skip. The tail publishes one blended midpoint into `0x0062b7c0` and can reject the whole pass through the neighboring scenario or world-state gates before returning success. Current grounded caller is the higher world-grid worker at `0x0041870d`, so this is now bounded as the flagged-region float-stats refresher rather than one route-entry helper.","objdump + caller inspection + version-gate correlation + world-grid scan correlation"
|
||||
|
|
@ -64,10 +161,12 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
|
|||
0x00414e10,200,world_grid_refresh_projected_rect_surface_and_region_byte_tables,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Refreshes two compact per-cell byte tables for the current projected rectangle rooted at `0x0062b7a8..0x0062b7b4`. The helper scans every cell in that rectangle, counts processed entries in `0x0062ba36`, writes one nibble-packed byte into the table at `0x0062b96c` from the paired world-grid queries `0x00534040` and `0x005340a0`, writes one companion byte into `0x0062b9d1` through `0x00533f80`, and zeroes both tables for out-of-bounds cells. Current grounded callers are the two success paths inside `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows` `0x00416620`, so this is now the safest current read for the projected-rectangle per-cell surface or region byte refresh rather than a generic grid scan.","objdump + caller inspection + local disassembly + projected-rectangle-byte-table correlation"
|
||||
0x00494240,195,route_entry_collection_query_rect_window_passes_entry_type_gate,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Rectangle-window gate over the route-entry collection `0x006cfca8`. The helper first derives one route-entry search window from the caller-supplied projected rectangle through `0x00449df0`, then scans every route-entry id in that window through `0x00492130` and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. It rejects when a covered entry owns byte `[entry+0x226]` outside the tolerated family, except for the caller-enabled permissive branch that still admits kinds `0x0c` and `0x0d`. Current grounded caller is `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows` `0x00416620`, where a failing result produces localized id `185`, so this is now the strongest current read for the route-entry-type gate over the projected rectangle rather than a generic collection scan.","objdump + caller inspection + local disassembly + route-entry-window correlation"
|
||||
0x00411ee0,451,structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables,map,thiscall,inferred,objdump + callsite inspection,3,"Rebuilds the per-candidate cargo summary tables after one runtime descriptor array has been materialized. The helper clears the two cargo-id pointer tables at `[this+0x79c]` and `[this+0x7a0]`, their counts at `[this+0x7a4]` and `[this+0x7a8]`, and one float-like per-cargo accumulator band rooted at `[this+0x0a1]`, then walks every live `0xbc` descriptor in `[this+0x37]` against the current scenario year at `[0x006cec78+0x0d]`. For each active subordinate cargo row in the descriptor-owned `0x1c`-byte entry band it resolves one cargo id through the global cargo collection at `0x0062ba8c`, updates the per-cargo accumulator, and tracks one or two levels of cargo membership before compacting those marks into the two emitted cargo-id tables. The stronger production-mode result is now bounded here rather than only in the editor importer: when the descriptor-side mode flag at `[desc+0x00]` is zero the subordinate row amount is multiplied by the shared recipe-book production cap at `[this+0x2a]` and divided by the descriptor amount at `[desc+0x04]`; when that mode flag is nonzero the helper bypasses that scaling path. That matches the editor-side split where production mode keeps the entered annual amount on the supply half while the demand half is normalized to `1.0`, so the demand-side production branch now looks like a normalized input selector or gate while the supply side is the branch that receives cap-scaled runtime rates. Current grounded callers are the collection-wide rebuild sweeps at `0x00412bd0` and `0x00412d70`.","objdump + callsite inspection + scenario-state correlation + cargo-collection correlation"
|
||||
0x00412560,144,structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Descriptor-level activity gate beneath the port or warehouse cargo runtime family. The helper first special-cases descriptor mode `0` by resolving the primary cargo id at `[desc+0x1c]` through the global cargo collection at `0x0062ba8c`; it then requires the current scenario year at `[0x006cec78+0x0d]` to lie inside the descriptor year window `[desc+0x20]..[desc+0x22]`, and finally checks one caller-selected mode byte at `[desc+0x24]` or `[desc+0x25]` for the active mode bank. When the runtime cargo-economy latch at `[0x006cec78+0x4afb]` is clear and the descriptor owns subordinate cargo rows, it also requires every subordinate cargo id in the `0x1c`-byte row band at `[desc+0x44]` to resolve through the same cargo collection. Current grounded callers are `structure_candidate_count_active_scaled_supply_descriptors` at `0x004125f0`, `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, and neighboring world-side query branches around `0x0040fb8d`, `0x00410721`, and `0x00410b71`.","objdump + caller xrefs + callsite inspection + cargo-collection correlation"
|
||||
0x00412560,144,structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Descriptor-level activity gate beneath the port or warehouse cargo runtime family. The helper first special-cases descriptor mode `0` by resolving the primary cargo id at `[desc+0x1c]` through the global cargo collection at `0x0062ba8c`; it then requires the current scenario year at `[0x006cec78+0x0d]` to lie inside the descriptor year window `[desc+0x20]..[desc+0x22]`, and finally checks one caller-selected mode byte at `[desc+0x24]` or `[desc+0x25]` for the active mode bank. When special-condition slot `31` `Use Wartime Cargos` at `[0x006cec78+0x4afb]` is clear and the descriptor owns subordinate cargo rows, it also requires every subordinate cargo id in the `0x1c`-byte row band at `[desc+0x44]` to resolve through the same cargo collection. Current grounded callers are `structure_candidate_count_active_scaled_supply_descriptors` at `0x004125f0`, `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, and neighboring world-side query branches around `0x0040fb8d`, `0x00410721`, and `0x00410b71`.","objdump + caller xrefs + callsite inspection + cargo-collection correlation + special-condition correlation"
|
||||
0x004125f0,87,structure_candidate_count_active_scaled_supply_descriptors,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Counts active runtime descriptors that participate in the scaled supply-side production lane for one caller-selected mode bank. The helper walks the current descriptor array at `[this+0x37]`, selects only descriptors whose mode dword at `[desc+0x00]` is zero and whose subordinate row count at `[desc+0x2c]` is positive, and then reuses `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560` before incrementing the returned count. Current grounded caller is `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, where the resulting count is used to divide the shared production-cap float across the active scaled-supply descriptors.","objdump + caller xrefs + callsite inspection"
|
||||
0x00412650,543,structure_candidate_query_cargo_runtime_summary_channels,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Lazy per-candidate cargo summary query over the runtime descriptor array rebuilt from the editor's port or warehouse recipe books. On a year change it clears four `0x6a`-dword summary banks rooted at `[this+0x0e8]`, `[this+0x290]`, `[this+0x438]`, and `[this+0x5e0]`, then walks every live `0xbc` descriptor across two mode banks through `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560`. Demand-side descriptors with nonzero mode dword accumulate subordinate-row weights into the bank rooted at `[this+0x10e]`; direct supply descriptors with no subordinate rows accumulate annual amounts into `[this+0x03a]`; and scaled supply descriptors with subordinate rows first divide the shared production-cap float at `[this+0x2a]` by the active-descriptor count from `structure_candidate_count_active_scaled_supply_descriptors` at `0x004125f0`, then publish the per-descriptor share into `[this+0x0a4]` and the subrow-scaled outputs into `[this+0x178]`. The helper finally returns one caller-selected cargo entry from all four banks through out-pointers, so current grounded meaning is one direct-supply channel, one cap-normalized supply channel, one demand or input channel, and one scaled production-output subrow channel rather than a single aggregate total. Current grounded callers are the lightweight wrappers at `0x00412960` and `0x004129a0`, the cargo-membership helper at `0x004129d0`, and the broader world-side accumulator at `0x0041e7be`.","objdump + caller xrefs + callsite inspection + scenario-state correlation"
|
||||
0x004129d0,179,structure_candidate_supports_or_references_cargo_id,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Returns whether the current runtime structure candidate materially references one requested cargo id. The helper first scans the compact secondary cargo-membership table rooted at `[this+0x7a0]` with count `[this+0x7a8]`; when no direct match is found it queries `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650` for mode bank `0` and treats the candidate as relevant when the returned demand-side plus scaled-output channels are positive. One final fallback checks the cached per-cargo accumulator bands rooted at `[this+0x0a1]` and `[this+0x0ad]` through the candidate-to-collection remap at `0x0062ba8c+0x9a`, which keeps the direct runtime cargo-membership arrays tied into the same decision. Current grounded caller is the placed-structure sweep around `0x00452e60`, where the result gates per-instance activation against one requested cargo id.","objdump + caller xrefs + callsite inspection + cargo-summary correlation"
|
||||
0x00412650,543,structure_candidate_query_cargo_runtime_summary_channels,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Lazy per-candidate cargo summary query over the runtime descriptor array rebuilt from the editor's port or warehouse recipe books. On a year change it clears four `0x6a`-dword summary banks rooted at `[this+0x0e8]`, `[this+0x290]`, `[this+0x438]`, and `[this+0x5e0]`, then walks every live `0xbc` descriptor across two mode banks through `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560`. Demand-side descriptors with nonzero mode dword accumulate subordinate-row weights into the bank rooted at `[this+0x10e]`; direct supply descriptors with no subordinate rows accumulate annual amounts into `[this+0x03a]`; and scaled supply descriptors with subordinate rows first divide the shared production-cap float at `[this+0x2a]` by the active-descriptor count from `structure_candidate_count_active_scaled_supply_descriptors` at `0x004125f0`, then publish the per-descriptor share into `[this+0x0a4]` and the subrow-scaled outputs into `[this+0x178]`. The index lanes are tighter now too: the no-subrow paths use the resolved cargo id at `[desc+0x1c]` directly, and the subordinate-row loop indexes each output lane directly from `[desc+0x44+row*0x1c]`, with no post-resolution failure guard in this consumer. So the strongest current read is that unresolved imported marker rows would still fall into the first summary-bank bucket here, while the semantic meaning of cargo id `0` itself remains ungrounded. The helper finally returns one caller-selected cargo entry from all four banks through out-pointers, so current grounded meaning is one direct-supply channel, one cap-normalized supply channel, one demand or input channel, and one scaled production-output subrow channel rather than a single aggregate total. Current grounded callers are the lightweight wrappers at `0x00412960` and `0x004129a0`, the cargo-membership helper at `0x004129d0`, and the broader world-side accumulator at `0x0041e7be`.","objdump + caller xrefs + callsite inspection + scenario-state correlation"
|
||||
0x00412960,49,structure_candidate_query_direct_and_normalized_supply_channels,map,thiscall,inferred,objdump + callsite inspection,3,"Tiny wrapper over `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650`. It forwards the caller's mode-bank and cargo id unchanged, then returns the sum of the wrapper's two supply-side out lanes rather than exposing all four summary channels directly. Current grounded steady-state caller is `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690`, where a positive result is treated as the direct-supply-side cargo presence test. The wrapper does not add any post-query special case for unresolved cargo bucket `0`; it just sums the returned supply-side floats.","objdump + callsite inspection + wrapper-correlation"
|
||||
0x004129a0,45,structure_candidate_query_scaled_production_output_channel,map,thiscall,inferred,objdump + callsite inspection,3,"Tiny wrapper over `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650`. It forwards the caller's mode-bank and cargo id unchanged, then returns the single scaled production-output subrow channel without combining it with the neighboring supply lanes. Current grounded steady-state caller is `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690`, where a positive result is treated as the scaled-supply or production-side cargo presence test. Like the sibling wrapper at `0x00412960`, it does not special-case unresolved cargo bucket `0` after the underlying query returns.","objdump + callsite inspection + wrapper-correlation"
|
||||
0x004129d0,179,structure_candidate_supports_or_references_cargo_id,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Returns whether the current runtime structure candidate materially references one requested cargo id. The helper first scans the compact secondary cargo-membership table rooted at `[this+0x7a0]` with count `[this+0x7a8]`; when no direct match is found it queries `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650` for mode bank `0` and treats the candidate as relevant when the returned demand-side plus scaled-output channels are positive. One final fallback checks the cached per-cargo accumulator bands rooted at `[this+0x0a1]` and `[this+0x0ad]` through the candidate-to-collection remap at `0x0062ba8c+0x9a`, which keeps the direct runtime cargo-membership arrays tied into the same decision. The current caller picture is tighter too: the placed-structure sweep around `0x00452e60` only enters this helper when the requested cargo id is nonzero. When that sweep receives requested id `0`, it explicitly routes around the cargo-reference branch into a separate linked-site or station-or-transit gate over the current placed structure's subtype latch, linked site id `[site+0x2a8]`, and the narrower linked-site predicate at `0x0047fd50`. So this helper itself does not currently look like the intentional owner for a null-cargo query.","objdump + caller xrefs + callsite inspection + cargo-summary correlation + caller-branch correlation + linked-site-bypass correlation"
|
||||
0x00412d70,563,structure_candidate_collection_rebuild_runtime_records_from_scenario_state,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Collection-wide runtime-state rebuild over the structure or candidate manager at `0x0062ba8c`. The helper iterates the collection twice against the paired availability bytes at `[candidate+0xba]` and `[candidate+0xbb]`, chooses one existing record to clone when the scenario-side owner id at `[candidate+0x794]` matches, otherwise clears the target record, and then repopulates the candidate runtime fields from the active scenario state rooted at `0x006cec78`. For each rebuilt candidate it copies the recipe-line count from `[state+0x1024]`, the shared production-cap float from `[state+0x13d4]`, and the packed `0xbc` descriptor array from `[state+0x1028]`, then refreshes the dependent cargo summary tables through `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` at `0x00411ee0` and the neighboring mode-flag pass at `0x00411ce0`. One bounded text side branch also republishes the candidate label from the scenario-side recipe-book name around `[state+0x0fe8]` when that string ends in `:`. Current grounded callers are the tail of `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` at `0x00435630` and the larger collection load path at `0x00412fb0`, so this now looks like the candidate-side bridge that projects editor recipe-book state into live runtime records rather than another generic collection copy loop.","objdump + caller xrefs + callsite inspection + scenario-state correlation"
|
||||
0x00412ca0,192,world_region_pick_commercial_profile_label_by_region_rank,map,thiscall,inferred,objdump + strings + callsite inspection,4,"Selects one category-3 candidate label from the global structure pool `0x0062b268` for the current region bucket. The helper converts the caller-supplied region rank through the region-count manager at `0x0062bae0`, uses that derived bucket to read per-candidate weights from `[candidate+region_index*4+0x8d]`, repeatedly subtracts those weights across up to five passes while only considering pool entries whose category byte at `[candidate+0x32]` is `3`, and copies the chosen candidate name into the caller buffer. When no weighted category-3 candidate survives the sweep it falls back to the static token `Commercial` at `0x005c92e8`. A later region-stats panel lines the same third slot up with localized id `1040` `City Support`, so current evidence treats this as the low-level label picker for a broader city-support family whose fallback token happens to be `Commercial`. The current grounded caller is `world_region_balance_structure_demand_and_place_candidates` at `0x004235c0`.","objdump + rdata strings + callsite inspection + region stats disassembly + RT3.lng strings"
|
||||
0x004133b0,132,placed_structure_collection_refresh_local_runtime_records_and_position_scalars,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Collection-wide wrapper above the placed-structure local-runtime clone and side-refresh helpers. The function first drains the queued placed-structure id list rooted at `0x0062ba64/0x0062ba6c/0x0062ba70` by reading the queue count through `placed_structure_local_runtime_site_id_queue_count` `0x00414480` and popping ids through `placed_structure_local_runtime_site_id_queue_pop_next` `0x00413f50`; for each popped id it resolves the owning placed structure through collection `0x0062b26c` and re-enters `placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem` `0x0040e450`. It then pumps the scenario-side service at `0x004834e0`, walks every live placed structure in `0x0062b26c`, and re-enters `placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon` `0x0040ee10` on each one. The current grounded caller is no longer just an anonymous raw callsite: it sits inside the `Setting up Players and Companies...` `319` lane of `world_run_post_load_generation_pipeline` immediately after the auxiliary route-entry tracker collection refresh on `0x006cfcb4` through `0x004a41b0`, and immediately before the flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0` plus the later route-entry post-pass `0x00491c20` on `0x006cfca8`. That makes this the clearest current owner for refreshing cloned local-runtime records plus the per-site position-scalar side pass rather than an anonymous collection sweep.","objdump + caller inspection + local disassembly + local-runtime-queue correlation + collection-refresh correlation + post-load-pipeline correlation"
|
||||
|
|
@ -101,9 +200,10 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
|
|||
0x0042dff0,82,scenario_event_condition_row_list_has_any_class_bit012_or_special_fallback,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + static-bit-table inspection,2,"Broad predicate over the standalone `0x1e`-row event-condition list. The helper walks the same linked list as the smaller `0x0042df30/0x0042df70/0x0042dfb0` family, tests each nonnegative row id against any of class bits `0x01|0x02|0x04` in the static condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to any of the three special event-record checks `[event+0x7f9]`, `[event+0x7fa]`, or `[event+0x7f0] == 0x63`. Current grounded caller is the early `EventConditions.win` refresh gate at `0x004da17d`, so this now reads as the broad condition-summary eligibility probe rather than a generic linked-list walk.","objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-flag correlation"
|
||||
0x0042e050,603,scenario_event_clone_runtime_record_deep_copy,scenario,cdecl,inferred,objdump + caller xrefs + local disassembly + shell-event-window correlation,2,"Deep-copy helper for one already-materialized live event runtime record. The helper copies the six fixed text bands at destination offsets `+0x0e0`, `+0x401`, `+0x4ca`, `+0x593`, `+0x65c`, and `+0x725`, mirrors the compact event metadata band at `+0x7ee..+0x80e`, then deep-copies the standalone `0x1e`-row linked list and the four grouped `0x28`-row linked lists from one live event-runtime record into the caller-supplied destination record. Current grounded caller is `shell_event_conditions_window_append_blank_or_clone_selected_event_via_name_modal` `0x004db8b0`, where it clones the currently selected live event into a newly created event record before selector refresh. This is therefore the safest current owner for deep-copy of an already-materialized event runtime record rather than another packed-state loader or an effects-only staging helper.","objdump + caller xrefs + local disassembly + shell-event-window correlation + deep-copy correlation"
|
||||
0x0042c1b0,886,placed_structure_redistribute_local_service_pressure_from_neighbors,map,thiscall,inferred,objdump + caller xrefs + neighborhood sweep inspection,3,"Neighbor-aware local-service post-pass for one placed-structure or site record. The helper first builds a bounded set of nearby site references by scanning offset patterns from `0x00624b28` and `0x00624b48` against the world-grid tables rooted at `[0x0062c120+0x2129]`, keeping only neighbors whose state byte at `+0x0e6` is compatible with the current site and recording per-neighbor weights derived from the local word tables near `[site+0x00]` and `[site+0x0f3]`. It then walks the live candidate collection and, for each live non-remapped candidate, chooses the strongest positive neighbor deficit after scaling through the candidate-side weight at `[candidate+0x52]`; when a positive deficit remains it commits the redistribution through `0x0042bf80`. Current grounded caller is the composite local refresh `0x0042d580`, so this looks like the neighboring-site redistribution pass beneath the local service-score bundle rather than an independent outer loop.","objdump + caller xrefs + neighborhood sweep inspection + candidate-weight correlation"
|
||||
0x0041eac0,794,structure_candidate_collection_refresh_cargo_economy_filter_flags,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + rdata strings,3,"Collection-wide refresh of one cargo-economy-sensitive candidate flag in the live structure collection at `0x0062ba8c`. The helper first walks the global candidate pool at `0x0062b268`, filters category-`2` entries through the paired availability bytes `[candidate+0xba]` and `[candidate+0xbb]` plus the recipe-runtime latch `[candidate+0x7ac]`, and builds one temporary per-cargo mask keyed by cargo names such as `Clothing`, `Cheese`, `Meat`, `Ammunition`, `Weapons`, `Diesel`, `Troops`, and `Passengers`; one special-case branch also uses structure labels such as `Barracks` and `Recycling Plant` while consulting the region collection at `0x0062bae0`. It then iterates the live structure collection itself, combines that temporary cargo mask with the candidate-local bytes `[entry+0x47]`, `[entry+0x48]`, and `[entry+0x49]`, the runtime cargo-economy latch at `[0x006cec74+0x25f]`, and one neighboring mode gate at `[0x006cec78+0x4afb]`, and writes the resulting enabled-or-filtered state into `[entry+0x56]` before re-entering `0x0041e970` to rebuild the derived visible counts. Current grounded callers are the collection-side setup path around `0x0041f4cb` and the runtime toggle branch at `0x0046577c`, where the same `0x006cec74+0x25f` bit is flipped directly; that makes this the strongest current bridge from the editor's `Disable Cargo Economy` rule into live structure-candidate filtering rather than a purely editor-side helper.","objdump + caller xrefs + callsite inspection + rdata strings + special-condition correlation"
|
||||
0x0041eac0,794,structure_candidate_collection_refresh_cargo_economy_filter_flags,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + rdata strings,3,"Collection-wide refresh of one cargo-economy-sensitive candidate flag in the live structure collection at `0x0062ba8c`. The helper first walks the global candidate pool at `0x0062b268`, filters category-`2` entries through the paired availability bytes `[candidate+0xba]` and `[candidate+0xbb]` plus the recipe-runtime latch `[candidate+0x7ac]`, and builds one temporary per-cargo mask keyed by cargo names such as `Clothing`, `Cheese`, `Meat`, `Ammunition`, `Weapons`, `Diesel`, `Troops`, and `Passengers`; one special-case branch also uses structure labels such as `Barracks` and `Recycling Plant` while consulting the region collection at `0x0062bae0`. It then iterates the live structure collection itself, combines that temporary cargo mask with the candidate-local bytes `[entry+0x47]`, `[entry+0x48]`, and `[entry+0x49]`, the runtime cargo-economy latch at `[0x006cec74+0x25f]`, and the live copy of special-condition slot `31` `Use Wartime Cargos` at `[0x006cec78+0x4afb]`; when that slot is set the branch at `0x0041ed37` further tests the wartime cargo family `Clothing`, `Cheese`, `Meat`, `Ammunition`, `Weapons`, and `Diesel` before writing the resulting enabled-or-filtered state into `[entry+0x56]` and re-entering `0x0041e970` to rebuild the derived visible counts. Current grounded callers are the collection-side setup path around `0x0041f4cb` and the runtime toggle branch at `0x0046577c`, where the same `0x006cec74+0x25f` bit is flipped directly; that makes this the strongest current bridge from the editor's `Disable Cargo Economy` rule plus the `Use Wartime Cargos` scenario rule into live structure-candidate filtering rather than a purely editor-side helper.","objdump + caller xrefs + callsite inspection + rdata strings + special-condition correlation"
|
||||
0x00421b60,180,world_region_collection_seed_default_regions,map,thiscall,inferred,objdump + strings + callsite inspection,4,"Seeds the default numbered region family on the manager collection at `0x0062bae0`. The helper pumps shell progress through `0x004834e0`, repeatedly creates collection entries through `0x00421660`, formats their labels from localized string id `2908` `Region %1` plus the `%02d` pattern at `0x005c9aec`, marks the created records live through `[entry+0x23e]`, and then finalizes the region set through `0x00421730` against the active world root at `0x0062c120`. Current grounded callsites are the post-load generation pipeline at `0x004384d0` and the broader world-build path around `0x004476ec`, so this now looks like region-set seeding rather than generic player or company setup.","objdump + RT3.lng strings + caller xrefs + callsite inspection"
|
||||
0x00421c20,187,world_region_collection_run_building_population_pass,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Region-owned building-population dispatcher over the collection at `0x0062bae0`. For each region entry it forwards one caller-selected scale and mode flag into the lower worker at `0x004235c0`, pumps shell progress through `0x004834e0` between entries, and guards the sweep with the region-collection reentrancy counter at `[this+0x88]`. The same setup lane now shows one direct shell-state coupling too: constructor-time helpers in the same region family copy shell-state gate `[0x006cec74+0x174]` into local region-side state, and the post-load pipeline only reaches this dispatcher behind that same gate after posting localized id `320` `Setting Up Buildings...`. The per-region worker consults the region subcollection at `[region+0x37f]`, the global candidate pool at `0x0062b268`, the placed-instance registry at `0x0062b26c`, and one world-side notification or state owner at `0x0062b2fc`, which makes this look like a building spawn or allocation pass rather than a generic region refresh. Grounded callers include the post-load `Setting Up Buildings...` branch in world_run_post_load_generation_pipeline with arguments `(1.0, 1)` and a slower recurring simulation-side caller at `0x0040a804/0x0040a826` with scale `0.08333334` and mode `0`, which suggests the same lower subsystem also has a later maintenance cadence after initial setup.","objdump + caller xrefs + callsite inspection"
|
||||
0x0042b2d0,49,world_grid_cell_has_packed_u16_token_in_6byte_roster,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small world-grid cell probe over one packed six-byte roster rooted at `[cell+0xef]` with count `[cell+0xeb]`. The helper walks that roster linearly, compares the caller-supplied `u16` token against the first word of each six-byte record, and returns `1` on the first match or `0` when no record matches. Current grounded callers include the city-connection peer probes `0x00420030/0x00420280`, where it filters site-class tokens from the caller's six-byte class table, plus the center-cell wrapper `0x0041f6e0`.","objdump + local disassembly + caller correlation + packed-roster correlation"
|
||||
0x0041f9b0,125,world_region_count_structure_profiles_before_year_for_category,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Counts region-subcollection structure profiles whose backing candidate resolves through `0x00412b70`, passes the availability gate at `0x0041f998`, matches one caller-selected category byte, and has threshold year `[profile+0x26]` less than or equal to the caller-supplied year. Current grounded callers include the region stats path at `0x004cbd41`, where category `2` feeds the localized `Industry Weightings` report, and the deeper per-region worker at `0x004235c0`, where the same count bounds demand for the weighted category-2 profile family.",objdump + caller xrefs + callsite inspection + RT3.lng strings
|
||||
0x0041fa30,133,world_region_find_named_structure_profile_weight,map,thiscall,inferred,objdump + strings + caller xrefs,3,"Looks up one named structure profile in the current region subcollection `[region+0x37f]`. The helper linearly compares the caller-supplied text against each profile label and returns the float-like weight at `[profile+0x1e]` for the first exact match, otherwise `0.0`. The same region-subcollection string block is now partially grounded from nearby `.rdata` as labels such as `House`, `Hotel`, `Iron Mine`, `Furniture Factory`, `Fertilizer Factory`, and `farm`. Current grounded callers sit in world-side UI or telemetry branches around `0x004cbb74`, `0x004cc054`, and `0x004ccc54`.","objdump + caller xrefs + rdata strings"
|
||||
0x0041fac0,60,world_region_read_structure_profile_label_and_weight_by_index,map,thiscall,inferred,objdump + caller xrefs + strings,4,"Reads one 1-based structure-profile entry from the current region subcollection `[region+0x37f]`. It copies the profile label string into the caller buffer and writes the float-like weight at `[profile+0x1e]` into the caller-provided out-slot. This is the label/value helper used beneath the region structure-demand worker and the adjacent UI or telemetry callers. The grounded profile-name block around `0x005c9100` now includes labels such as `House`, `Hotel`, `Iron Mine`, `Furniture Factory`, and `Fertilizer Factory`.","objdump + caller xrefs + rdata strings"
|
||||
|
|
@ -142,7 +242,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
|
|||
0x0042a080,95,company_add_delta_into_stat_series_current_slot_and_optional_cash_totals,simulation,thiscall,inferred,objdump + caller xrefs + field-write correlation,3,"Adds one caller-supplied float delta into the selected company stat-family lane, exactly like `company_add_delta_into_stat_series_and_current_slot` `0x0042a040`, and optionally mirrors the same delta into the broader cash-side shadow totals when the third argument is nonzero. The shared stat writes still land in the year-indexed series rooted at `[this+0x0d7f]` and current aggregate lane `[this+0x1c47]`; the optional follow-on also increments the cash-pair totals at `[this+0x11f7]` and `[this+0x1caf]`. Current grounded callers include stock buyback `0x004273c0`, chairman-salary and dividend policy paths around `0x00427920`, linked world-service updates, and several company-side cash or capital mutators, so this is the stronger shared company stat poster when cash-side shadow totals must stay synchronized.","objdump + caller xrefs + field-write correlation + cash-pair correlation + finance-mutator correlation"
|
||||
0x0042a2e0,645,company_read_control_transfer_metric_slot,simulation,thiscall,inferred,objdump + caller inspection,3,"Reads one derived company metric from the bounded slot family `0x13..0x2f` used by control-transfer, public-support, annual governance logic, report-history pages, and stock-data readouts. The dispatcher mixes direct company fields such as `[this+0x4b]`, `[this+0x53]`, `[this+0x323]`, `[this+0x327]`, `[this+0x333]`, `[this+0x33f]`, and the later counters near `[this+0x34b]` and `[this+0x14f]` with a few computed ratios and helper-backed terms. The first grounded slot `0x13` already resolves through `company_compute_public_support_adjusted_share_price_scalar` at `0x00424fd0`, which now reads as a broader investor-support and share-price lane rather than a vote-only term. Wider shell-side xrefs now tighten the stock-data subfamily too: slot `0x1c` is `Share Price`, slot `0x1d` is `Book Value Per Share`, slot `0x1e` is `Revenue Per Share`, slot `0x1f` is `Earnings Per Share`, slot `0x20` is `Dividend Per Share`, slot `0x21` now routes through `company_compute_five_year_weighted_shareholder_return` `0x004246b0` for `5 Year Weighted Return`, and the adjacent slot `0x23` is now best bounded as the hidden current or fallback shareholder-payout lane rooted at `[this+0x53]` that feeds that five-year return formula. The higher derived switch at `company_read_derived_financial_report_metric_slot` `0x00429c70` also now narrows the shared finance-family semantics reused beside this slot reader: `0x2b` is the net-profits-style derived lane, `0x2c` is the broader revenue aggregate, and raw slot `0x09` aligns with the Income Statement fuel-cost lane surfaced by tooltip `1309`; the adjacent special interest-help row uses a different metric id and `2815` rather than raw slot `0x09` itself. That keeps nearby annual finance, CompanyDetail, and ledger readouts consistent with shell labels such as `925` `Profits:`, `928` `Largest Shareholders`, `929` `Shares`, and `930` `Per Share Data`. This now looks like a generic company support-and-finance metric dispatcher rather than a merger-only issue reader.","objdump + caller inspection + metric-slot correlation + governance-string correlation + company-detail correlation + stock-data-label correlation + income-statement-row correlation + derived-report-metric correlation + share-price-scalar correlation + weighted-return correlation + shareholder-payout-lane correlation"
|
||||
0x0042a5d0,131,company_read_year_or_control_transfer_metric_value,simulation,thiscall,inferred,objdump + caller inspection + RT3.lng strings,3,"Reads one company-side float from either a year-relative stat series or the local support-and-governance metric slot family. When the family argument is `0x2329` or one of the neighboring current-year offsets, the helper resolves one year-relative table entry from the series rooted at `[this+0x0d7f]`; when the request falls back to the bounded slot family it delegates to `company_read_control_transfer_metric_slot` at `0x0042a2e0`, and requests at `0x2b` or above then continue into `company_read_derived_financial_report_metric_slot` `0x00429c70`. The `0x2329` token is no longer treated as an issue id here: it is the stat-family selector paired with the localized company-stat label id `2329`, and current grounded callers use this wrapper beneath merger, takeover, bankruptcy, annual shareholder-revolt, creditor-liquidation, and other company-policy dialogs to fetch yearly or current support-side values. This makes the helper a generic company stat reader rather than an issue-specific vote formula.","objdump + caller inspection + RT3.lng strings + stat-family correlation + governance-string correlation + derived-report-metric correlation"
|
||||
0x0042c690,311,placed_structure_rebuild_candidate_cargo_service_bitsets,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Rebuilds two per-cargo bitsets on one placed-structure or site record using the live structure-candidate collection at `0x0062ba8c`. The helper clears the bitsets rooted at `[this+0x0d8]` and `[this+0x0df]`, walks the linked placed-structure chain starting at `[this+0x0d6]` through `0x0062b26c`, selects only linked instances whose backing candidate resolves through vtable `+0x80` with category byte `2`, and then scans the live candidate collection for entries that pass `structure_candidate_is_enabled_for_current_year` at `0x0041e220`. For each passing candidate it queries the direct and scaled supply-side cargo channels through the wrappers at `0x00412960` and `0x004129a0`; positive direct supply sets bits in `[this+0x0df]`, while positive scaled supply on candidates with runtime cargo state at `[candidate+0x78c]` sets bits in `[this+0x0d8]`. Current grounded callers sit immediately above the sibling helper at `0x0042cdf0`, which makes this the strongest current steady-state consumer of the rebuilt editor cargo runtime tables rather than a pure setup path.","objdump + caller xrefs + callsite inspection + cargo-summary correlation"
|
||||
0x0042c690,311,placed_structure_rebuild_candidate_cargo_service_bitsets,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Rebuilds two per-cargo bitsets on one placed-structure or site record using the live structure-candidate collection at `0x0062ba8c`. The helper clears the bitsets rooted at `[this+0x0d8]` and `[this+0x0df]`, walks the linked placed-structure chain starting at `[this+0x0d6]` through `0x0062b26c`, selects only linked instances whose backing candidate resolves through vtable `+0x80` with category byte `2`, and then scans the live candidate collection for entries that pass `structure_candidate_is_enabled_for_current_year` at `0x0041e220`. For each passing candidate it queries the direct and scaled supply-side cargo channels through the wrappers at `0x00412960` and `0x004129a0`; positive direct supply sets bits in `[this+0x0df]`, while positive scaled supply on candidates with runtime cargo state at `[candidate+0x78c]` sets bits in `[this+0x0d8]`. The cargo-id sweep is tighter now too: the inner loop starts at cargo id `1` and runs upward through the current live cargo count, so this steady-state bitset owner never intentionally queries cargo id `0`. Current grounded callers sit immediately above the sibling helper at `0x0042cdf0`, which makes this the strongest current steady-state consumer of the rebuilt editor cargo runtime tables rather than a pure setup path.","objdump + caller xrefs + callsite inspection + cargo-summary correlation + cargo-id-loop correlation"
|
||||
0x0042c8f0,112,placed_structure_refresh_linked_candidate_flag4,map,thiscall,inferred,objdump + caller xrefs + linked-instance inspection,3,"Refreshes bit `0x4` in the placed-structure state byte at `[this+0x0e6]` from the currently linked placed-instance chain rooted at `[this+0x0d6]`. The helper walks linked instances through `0x0062b26c`, keeps only entries whose backing instance passes `0x0040c990 == 1`, resolves each surviving instance through vtable slot `+0x80`, and sets the local flag when any resolved candidate record has nonzero byte `[candidate+0xba]`; otherwise it clears that bit. Current grounded callers are the immediate wrapper `0x0042cdf0` plus the relink helpers at `0x0042c9a0` and `0x0042c9f0`, so this looks like the sibling state refresh that runs beside the cargo-service bitset rebuild even though the exact player-facing meaning of `[candidate+0xba]` is still open.","objdump + caller xrefs + linked-instance inspection + candidate-flag correlation"
|
||||
0x0042cab0,117,placed_structure_accumulate_candidate_metric_or_emit_route_style_peer_link,map,thiscall,inferred,objdump + caller inspection + route-style remap inspection,3,"Small candidate-side projection helper used by the broader route-style rebuild lane. The helper starts by querying one integer local metric through `0x0042c960` for the caller-supplied candidate index, then resolves the matching structure-candidate record through `0x0062ba8c` and re-enters `0x0041e1f0` to stage one floating contribution. It next reads the candidate's route-style remap slot at `0x0062ba8c+0x9a`: when that slot is negative it adds the contribution directly into the local route-style grid lane at `[this+candidate*4+0x103]`; when the slot is nonnegative it instead re-enters `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0` with the remapped class id and the same floating contribution. Current grounded caller is the larger per-site route-style rebuild pass at `0x004101e0`, which makes this the clearest current branch where ordinary candidate metrics stay local but remapped route-style candidates become peer-link emission requests.","objdump + caller inspection + route-style remap inspection + peer-link emission correlation"
|
||||
0x0042cb30,124,placed_structure_clamp_candidate_service_age_table,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Late clamp pass over the primary per-candidate word table rooted at `[this+0x00]`. When the site owns a nonzero route latch at `[this+0x0d4]` and `0x0042c880` signals the pass should run, the helper walks every live non-remapped candidate, queries one route-linked age or freshness value through `0x0042c110`, shifts that result into the local word-table scale, and replaces `[this+candidate*2]` with the smaller of the current value and the new clamp. Current grounded callers are the local bundle wrapper `0x0042d580` and the later world-grid sweep at `0x00450133`, so this now looks like the final recent-service clamp on the local candidate age table rather than another raw scoring helper.","objdump + caller xrefs + callsite inspection + route-age correlation"
|
||||
|
|
@ -288,6 +388,15 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
|
|||
0x004baef0,2793,shell_building_detail_window_refresh_controls,shell,thiscall,inferred,objdump + caller inspection + control-range inspection,4,"Primary refresh path for the shell-side `BuildingDetail.win` family. The helper rebuilds the top-level control bands under `0x7d02..0x8051`, including the paired mode switch `0x7d02/0x7d03` from subject flag `0x40`, the smaller special-service toggles `0x7d0f/0x7d10` from subject bits `0x20` and `0x10`, the current-selection status widget around `0x7d0d/0x7d0e`, the selected-building cargo or service rows through `shell_building_detail_refresh_subject_cargo_and_service_rows` at `0x004ba3d0`, the paired subject-value rows through `shell_building_detail_refresh_subject_pair_value_rows` at `0x004bad20`, and the flagged service or capability rows through `shell_building_detail_refresh_flagged_service_capability_rows` at `0x004b9a20`. Current control-building correlation now makes the leading special-row bands explicit too: the short-label triplet `0x7dc8..0x7dca`, its adjacent asset/icon triplet `0x7e90..0x7e92`, and the popup/selectable triplet `0x7f58..0x7f5a` are the fixed express-side branch before the broader ordinary candidate rows. Current branch structure is tighter too: when subject bit `0x40` is set the refresh ends on the selected-subject cargo/service family rooted at `0x004ba3d0`, while the clear branch instead ends on the flagged capability-selector family rooted at `0x004b9a20`. It also hides or shows the larger control ranges `0x7dc8..0x7f57`, `0x7f58..0x801f`, and `0x8020..0x8051` through the shared shell control toggles at `0x53fe00`. Current grounded callers are the main constructor-side and focus refreshes at `0x004bbace`, `0x004bc0cc`, and `0x004bc0de`, and the message dispatcher at `0x004bb9e0`.","objdump + caller inspection + control-range inspection + subject-flag correlation + helper-family correlation + branch-end correlation + control-family triplet correlation"
|
||||
0x004bc0a0,71,shell_building_detail_window_construct,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Constructs the shell-side `BuildingDetail.win` object later published at `0x006cfe00`. The constructor seeds the local vtable at `0x005d05e0`, binds the window resource through `0x0053fa50`, and immediately refreshes the visible subject and control bands through `0x004baef0`. Current grounded caller is `shell_open_or_focus_building_detail_window` at `0x004bc100`, and current string-table correlation leaves `BuildingDetail.win` as the strongest owner name for this singleton family.","objdump + caller inspection + strings correlation + singleton correlation"
|
||||
0x004bc100,203,shell_open_or_focus_building_detail_window,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Shared opener for the shell-side `BuildingDetail.win` singleton. The caller supplies the building-detail list helper in `ECX`, one current building subject in `EDX`, and one selected ordinal on the stack. The helper seeds the shared family globals at `0x006cfe04`, `0x006cfe08`, and `0x00621df4`, validates that the supplied building subject resolves to one live world object through the placed-structure collection at `0x006cec20`, allocates a `0x78`-byte shell object when no detail window is live, constructs it through `shell_building_detail_window_construct` at `0x004bc0a0`, publishes it through the shell runtime at `0x006d401c`, and tears it back down on return while clearing `0x006cfe00`. Current grounded callers include the world-side branch around `0x004bbace`, which updates the current building subject before opening this detail family. Current string-table correlation leaves `BuildingDetail.win` as the strongest owner name for this singleton family.","objdump + caller inspection + strings correlation + publish-path inspection + singleton correlation"
|
||||
0x004bcdd0,352,shell_change_trees_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `ChangeTrees.win` tool window. The constructor installs vtable `0x005d06bc`, binds `ChangeTrees.win` through `0x0053fa50`, seeds the current ordinal and paired scalar lanes from globals `0x00621ec0..0x00621ec8`, formats the visible scalar caption through `0x0051f070` and `0x00527de0`, copies one localized six-row label table from `0x005ef3ec`, stores the live singleton at `0x006cfe18`, and then refreshes the visible selection band through `0x004bccd0`. Current grounded caller is the detail-panel manager branch at `0x004ddf32`, which keeps this on the shell tool-window side rather than the larger company- or station-detail lanes.","objdump + strings + detail-manager correlation + control-table correlation + singleton correlation"
|
||||
0x004bcc20,50,shell_change_trees_window_select_scalar_and_refresh_caption,shell,thiscall,inferred,objdump + message-owner inspection + caption-table correlation,4,"Small `ChangeTrees.win` setter for the scalar selection lane. The helper stores the requested scalar ordinal in `[this+0x78]`, looks up one float caption value through table `0x00621ecc`, converts that value into shell text through `0x0051f070` and `0x00527de0` on presenter `0x006d4024`, and returns without touching the broader row bands. Current grounded caller is the message owner `0x004bcf30`, where controls `0x1389..0x138f` forward through this helper before the wider control refresh runs.","objdump + message-owner inspection + caption-table correlation + shell-presenter correlation"
|
||||
0x004bcc60,80,shell_change_trees_window_select_four_state_mode_and_publish_group_event,shell,thiscall,inferred,objdump + message-owner inspection + shell-presenter correlation,4,"Small `ChangeTrees.win` mode selector beneath the broader control refresh. The helper stores the requested `0..3` value in `[this+0x84]` and then publishes one grouped selector event through `0x0053f000` on presenter `0x00ccbb20`: mode `0` maps to event `0x16`, mode `1` maps to `0x07`, mode `2` maps to `0x01`, and mode `3` currently falls through without publishing an event. Current grounded callers are the constructor `0x004bcdd0` and the message owner `0x004bcf30`, which keeps this as a shell-side mode-group selector rather than a world brush mutation path.","objdump + message-owner inspection + shell-presenter correlation + constructor correlation"
|
||||
0x004bccd0,250,shell_change_trees_window_refresh_control_bands,shell,thiscall,inferred,objdump + constructor correlation + message-owner inspection,4,"Refreshes the visible row bands for the shell-side `ChangeTrees.win` family. The helper walks five grouped control strips and republishes them through `0x00540120` with the standard selected-vs-unselected style split `0x87/0x65`: the scalar strip `0x1389..0x138f` from `[this+0x78]`, the sibling strip `0x13ed..0x13f3` from `[this+0x80]`, the third strip `0x1451..0x1457` from `[this+0x7c]`, the four-state strip `0x14b5..0x14b8` from `[this+0x84]`, and the larger localized row band `0x139c..0x13b7` from `[this+0x8c]`. Current grounded callers are the constructor `0x004bcdd0` and the message owner `0x004bcf30`, which makes this the current owner-side refresh pass for `ChangeTrees.win` rather than one generic tree-paint helper.","objdump + constructor correlation + message-owner inspection + control-band correlation"
|
||||
0x004bcf30,924,shell_change_trees_window_handle_message,shell,thiscall,inferred,objdump + constructor correlation + caller inspection,4,"Primary message dispatcher for the shell-side `ChangeTrees.win` tool window. Under message `0xc8`, controls `0x1389..0x138f` update the scalar lane through `shell_change_trees_window_select_scalar_and_refresh_caption` `0x004bcc20`, controls `0x13ed..0x13f3` update `[this+0x80]` and global `0x00621ec4`, controls `0x1451..0x1457` update the paired row lane through `0x004bcc60` and global `0x006cfe1c`, and controls `0x139c..0x13b7` update the larger localized row-band selection in `[this+0x8c]` and `0x006cfe20`; each of those branches re-enters `shell_change_trees_window_refresh_control_bands` `0x004bccd0`. Control `0x07d6` owns the shared world-surface latch `[this+0x88]`: it arms the latch after the standard hit-test gate `0x00448ac0`, snapshots anchor coords in `[this+0x90/+0x94]`, and then enters the broader brush-distance/math branch rooted at `0x004bd083`. Current grounded owner correlation is the constructor `0x004bcdd0` and the live shell message flow, which keeps this on the `ChangeTrees.win` tool-window side of the shared world-surface family rather than a generic terrain-detail page.","objdump + constructor correlation + caller inspection + world-surface latch correlation + control-band correlation"
|
||||
0x004bc210,67,shell_world_surface_brush_set_selected_ordinal_and_refresh_scalar_caption,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small setter beneath the shell world-surface brush family. The helper stores the caller-selected ordinal into `[this+0x78]`, resolves the corresponding dword from table `0x00621e24`, converts that value into a float caption through `0x0051f070` and `0x00527de0` under shell owner `0x006d4024`, and returns. Current grounded caller is the `0x0fa0..0x0fa7` ordinal-strip branch inside `shell_world_surface_brush_handle_message_for_control_0x07d6_and_mode_family_0x0fa0_0x0faf` `0x004bc350`, so this is the safest current read for the selected-ordinal setter plus scalar-caption refresh rather than a generic text helper.","objdump + caller inspection + local disassembly + ordinal-strip correlation + scalar-caption correlation"
|
||||
0x004bc260,43,shell_world_surface_brush_query_cached_world_coords_and_selected_scalar,shell,thiscall,inferred,objdump + local disassembly + field correlation,2,"Tiny cached-parameter getter beneath the same shell world-surface brush family. The helper copies cached world coordinates `[this+0x80]` and `[this+0x84]` into the two caller out-pointers and returns the current selected scalar from table `0x00621e24[ordinal]`, where the ordinal is stored at `[this+0x78]`, through the third out-pointer. Current local field correlation keeps this bounded as the brush-family cached-parameter query rather than a generic subject getter.","objdump + local disassembly + field correlation + ordinal-table correlation"
|
||||
0x004bc290,192,shell_world_surface_brush_refresh_ordinal_and_mode_button_rows,shell,thiscall,inferred,objdump + caller inspection + control-family correlation,3,"Shared control refresh helper for the shell world-surface brush family. The first loop restyles the ordinal strip `0x0fa1..0x0fa7` through `0x00540120`, highlighting the current selected ordinal at `[this+0x78]`. The second loop restyles the mode strip `0x0faa..0x0faf` by mapping the current mode dword `[0x006d0818+0x8c]` from `0x0e..0x13` into local indices `0..5` and highlighting the matching button through the same shell control helper. Current grounded callers are the ordinal-strip branch at `0x004bc3fc` and the mode-change path beneath `shell_world_surface_brush_handle_message_for_control_0x07d6_and_mode_family_0x0fa0_0x0faf` `0x004bc350`, so this is the safest current read for the ordinal and mode button-row refresh owner rather than a generic widget restyler.","objdump + caller inspection + control-family correlation + ordinal-mode-strip correlation"
|
||||
0x004bc350,1496,shell_world_surface_brush_handle_message_for_control_0x07d6_and_mode_family_0x0fa0_0x0faf,shell,thiscall,inferred,objdump + local disassembly + control-family correlation,3,"Shell-side message owner for one world-surface brush family whose current grounded controls are the shared main-world surface `0x07d6`, the ordinal strip `0x0fa0..0x0fa7`, and the mode buttons `0x0faa..0x0faf`. The `0x07d6` branch first resolves world coordinates through `0x00448ac0`, latches drag-active byte `[this+0x7c]`, stores the accepted world coordinate pair into `[this+0x80/+0x84]`, and caches the incoming scalar at `[this+0x88]`. When that latch is active, the helper dispatches the current mode dword `[0x006d0818+0x8c]` across six grounded edit branches: mode `0x0e` and `0x13` re-enter `world_raise_companion_float_grid_local_peak_in_rect_with_optional_class_3_5_bias` `0x0044da70`; mode `0x0f` re-enters `world_relax_companion_float_grid_cross_average_in_rect_with_raster_bit0_gate` `0x0044d4e0`; modes `0x10` and `0x11` re-enter `world_raise_companion_float_grid_toward_center_sample_in_rect` `0x0044d880`; and mode `0x12` toggles the secondary-raster low nibble through `world_secondary_raster_xor_cell_byte2_low_nibble_mask` `0x00448e20` before re-entering `placed_structure_collection_refresh_local_runtime_side_state_in_rect_from_cell_bucket_map` `0x00419110`. The same owner also routes the ordinal strip `0x0fa0..0x0fa7` through `0x004bc210/0x004bc290` and updates the shared brush ordinal at `0x00621e20`, while the mode buttons `0x0faa..0x0faf` dispatch `0x004ddbd0` with mode ids `0x0e..0x13`. Current evidence is strong enough to treat this as a shell world-surface brush and mode dispatcher even though the exact window-family resource name is still open.","objdump + local disassembly + control-family correlation + world-surface correlation + brush-mode correlation"
|
||||
0x004384d0,570,world_run_post_load_generation_pipeline,map,cdecl,inferred,objdump + strings + caller xrefs,4,"Large post-load world-generation pipeline reached after world entry and shell-side file-load success paths. It increments the world-root generation counter at `[0x0062c120+0x2205]` and, on the caller-selected setup path, first runs the preliminary candidate-availability prepass at `0x00437743` before the visible progress phases begin. The visible phase order is now grounded directly from the function body instead of only from scattered callers: id `318` `Computing Transportation and Pricing...` is posted first and remains active while the pipeline runs `world_compute_transport_and_pricing_grid` `0x0044fb70`, the early collection pass `world_setup_building_collection_phase` `0x0041ea50`, and the conditional region pair `world_region_collection_seed_default_regions` `0x00421b60` plus `world_region_border_overlay_rebuild` `0x004882e0`; if shell-state gate `[0x006cec74+0x174]` is set, id `320` `Setting Up Buildings...` then drives `world_region_collection_run_building_population_pass` `0x00421c20`; if `[0x006cec74+0x178] > 0`, id `321` `Seeding Economy...` then drives `simulation_run_chunked_fast_forward_burst` `0x00437b20`; only after those setup-side gates does the pipeline post id `319` `Setting up Players and Companies...`; and id `322` `Calculating Heights...` finally tails into `0x0044d410`. That `319` lane is no longer just gate plumbing: the primary grounded work there is still the chairman-profile pair `world_seed_default_chairman_profile_slots` `0x004377a0` plus `world_build_chairman_profile_slot_records` `0x00437220`, and current neighboring setup flow also exposes one conditional company-side helper at `0x0047d440` under sandbox or non-editor shell-state conditions. The later interior ordering of the same `319` lane is tighter now too: after the route-entry collection refresh on `0x006cfca8` through `0x00493be0`, the pipeline refreshes the auxiliary route-entry tracker collection `0x006cfcb4` through `0x004a41b0`, then re-enters `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, runs a flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0`, and only after that re-enters the route-entry post-pass `0x00491c20` before continuing into later persona, route-style, region, and world-manager setup families. Current evidence is tighter on the remaining gates too: `[0x006cec74+0x68]` now aligns with the editor-map `.gmp` mode in the shell file coordinators and acts as the broader master editor-mode flag that suppresses both later world-generation branches and diverts region-side calculations into alternate paths. The body fans into the live world root at `0x0062c120`, manager collections `0x0062ba8c`, `0x0062bae0`, `0x006cfca8`, `0x006cfcb4`, and `0x006cfc9c`. Current grounded callers are the world-entry side around `0x004390ea` and the shell file-load side around `0x004dccfc`.","objdump + RT3.lng strings + caller xrefs + callsite inspection + file-flow correlation + post-load-stage-order correlation"
|
||||
0x00437743,93,world_preseed_named_candidate_availability_records_from_live_pool,map,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Preliminary post-load candidate-availability prepass reached only from `world_run_post_load_generation_pipeline` `0x004384d0` when the caller requests the fuller setup path. The helper iterates the live candidate pool at `0x0062b268` in reverse order, derives one small boolean mode from candidate bytes `[candidate+0xba]` and `[candidate+0x32]`, and then re-enters `scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters` `0x00434f20` on the active scenario state `0x006cec78` using the candidate name at `+0x04`. The whole pass is skipped once global threshold `0x00620e94` reaches `0x26ad`. Current evidence is therefore strongest for an early scenario-side named candidate-availability seeding pass rather than another visible progress phase.","objdump + local disassembly + caller correlation + candidate-pool correlation"
|
||||
0x00438890,644,shell_active_mode_run_profile_startup_and_load_dispatch,map,thiscall,inferred,objdump + caller xrefs + debugger comparison,4,"Large active-mode startup and profile-dispatch owner rooted at the live mode object in `0x006cec78`. At entry it clears local state at `[this+0x00]` and `[this+0x4c80]`, posts several shell progress or status updates through `0x5193f0/0x540120`, enumerates one shell-managed list off `0x006d4020+0x429b0`, and then switches over the runtime-profile selector at `[0x006cec7c+0x01]`, which is now clearly a separate seven-way startup selector rather than the shell mode id itself. The jump table has four grounded branch bodies: selector values `1` and `7` share the tutorial map lane at `0x00438f67`, which writes `[0x006cec74+0x6c]=2` and calls shell_map_file_entry_coordinator `0x00445ac0` with `Tutorial_2.gmp` or `Tutorial_1.gmp`; selector `2` is a world-root initialization lane at `0x00438fbe` that allocates `0x0062c120` when absent, runs `0x0044faf0`, and then forces the selector to `3`; selector `4` is the setup-side world reset or regeneration lane at `0x00439038`, which tears down and reallocates `0x0062c120` from setup globals `0x006d14cc/0x006d14d0`, then runs `0x00535100` and `0x0040b830`; and selector values `3`, `5`, and `6` collapse into the same profile-seeded file-load lane at `0x004390b0..0x004390ea`. The write side is tighter now too: `Campaign.win` writes selector `6` at `0x004b8a2f`; `Multiplayer.win` writes selector `3` on one pending-status branch at `0x004f041e`; and the larger `Setup.win` dispatcher around `0x005033d0..0x00503b7b` writes selectors `2`, `3`, `4`, and `5` on several validated launch branches, including the setup-size path through `0x0050394c`, the generation branch at `0x00503a12`, and the profile-file validation branch at `0x00503a74/0x00503a7d`. The shared file-load lane is therefore no longer anonymous: selector `6` is the grounded campaign-side variant and selectors `3/5` are grounded setup or multiplayer variants, while selector `6` is also the only variant that first writes `[0x006cec74+0x6c]=1` before all three values call shell_map_file_entry_coordinator `0x00445ac0` with `([0x006cec7c]+0x11, 4, &out_success)`, re-enter shell service `0x004834e0`, conditionally run world_run_post_load_generation_pipeline `0x004384d0` when `out_success != 0`, drain the counter object at `0x00ccbb20` through `0x0053f310`, and service `0x004834e0` again. The caller split above that branch is tighter now too: `0x004830ca` is the shell startup or `LoadScreen.win` lane and calls this owner as `(1, 0)` after publishing `0x006cec78`, while `0x00443b57` world entry and `0x00446d7f` saved-runtime restore both enter with `(0, 0)` immediately after dismissing the current detail panel and servicing `0x004834e0(0, 0)`. `0x0046b8bc` remains the distinct multiplayer-preview relaunch owner, also entering as `(0, 0)` before a later staged `0x00445ac0` call.","objdump + caller xrefs + manual-load breakpoint comparison + owner-tail disassembly + caller-shape comparison + selector-jump-table decode + tutorial-string correlation + selector-writer correlation"
|
||||
|
|
@ -323,6 +432,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
|
|||
0x004490f0,18,world_query_sidecar_plane_cell_count,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny size helper for the sidecar byte-plane family hanging off the live world object. It returns `([this+0x15d9]+1)*([this+0x15d5]+1)`, which is the per-plane cell count used by the four-plane sidecar raster copies. Current grounded callers include the shell-side plane-copy branches around `0x004f5ad6..0x004f5cc7`, so this is the safest current read for the shared sidecar-plane cell-count query rather than a generic world-size helper.","objdump + caller inspection + field correlation + sidecar-plane correlation"
|
||||
0x00448f60,114,world_load_four_sidecar_byte_planes_from_runtime_bundle,map,thiscall,inferred,objdump + caller inspection + bundle-tag correlation,4,"Loads four sidecar byte-plane buffers tied to the live world raster from one runtime bundle owner. The helper opens chunk family `0x9471..0x9472` through `0x00531360`, computes one plane size through `world_query_sidecar_plane_cell_count` `0x004490f0`, resolves four destination plane pointers through `world_query_sidecar_byte_plane_ptr_by_index` `0x00533b40` from `[this+0x1631 + index*4]`, and fills those four buffers through repeated `0x00531150` reads before closing the chunk family. Current grounded callers are the `.smp` restore path inside world_load_saved_runtime_state_bundle `0x00446d40` and the neighboring world-side bundle-load branch at `0x0044d350`, so this is the safest current read for the shared four-plane runtime-bundle load helper rather than a generic deserializer.","objdump + caller inspection + bundle-tag correlation + sidecar-plane correlation"
|
||||
0x00448fe0,108,world_serialize_four_sidecar_byte_planes_into_runtime_bundle,map,thiscall,inferred,objdump + caller inspection + bundle-tag correlation,4,"Save-side sibling of world_load_four_sidecar_byte_planes_from_runtime_bundle. The helper opens chunk family `0x9471..0x9472` for output through `0x00531340`, computes the same one-plane size through `world_query_sidecar_plane_cell_count` `0x004490f0`, resolves four source plane pointers through `world_query_sidecar_byte_plane_ptr_by_index` `0x00533b40` from `[this+0x1631 + index*4]`, and writes those four buffers through repeated `0x00531030` calls before closing the chunk family. Current grounded callers are the `.smp` serializer inside world_runtime_serialize_smp_bundle `0x00446240` and the neighboring world-side bundle-save branch at `0x00449714`, so this is the safest current read for the shared four-plane runtime-bundle serializer rather than a generic writer.","objdump + caller inspection + bundle-tag correlation + sidecar-plane correlation"
|
||||
0x0044afa0,439,world_query_local_companion_float_relief_score_at_cell_with_distance_and_mode_bias,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Composed local world-scalar query over the live world root. The helper first derives one distance-like term from the caller cell to global preview anchor fields `[0x0062be68+0x24/+0x1c]` through the precomputed radial helper `0x0051dc00`; distances above `0x32` contribute one clamped bias term. It then samples the companion float raster rooted at `[world+0x1605]` at the caller cell and across two 8-direction rings from the static offset tables `0x00624b28/0x00624b48`, keeps the highest rounded neighbor sample, and folds the local rise above the center sample into the running score. When preview scalar `[0x0062be68+0x20]` exceeds threshold `0x005ca190` it adds one further scaled bias, and when the neighboring shell-mode gate `0x0041fff0` passes it adds `0x32` more before returning the final score plus base offset `0x8c`. Current grounded callers are the shared rounded-coordinate wrapper `0x0041f6b0` and the sibling virtual wrapper `0x004614d0`.","objdump + caller xrefs + local disassembly + float-grid correlation + radial-distance-helper correlation"
|
||||
0x00444dc5,11,world_query_global_stage_counter_reached_late_reactivation_threshold,map,cdecl,inferred,objdump + caller inspection + threshold correlation,3,"Tiny signed compare helper over the shared stage counter at `0x00620e94`. It returns the raw comparison against threshold `0x9901`, so current callers only test whether the counter is still below that later reactivation threshold. Grounded callers are the two late world-entry checkpoints at `0x00444044` and `0x00444a83` inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, where a negative result clears `[world+0x39]`. Nearby evidence also shows the same global is seeded to `0x26ad` by `map_bundle_open_reference_databases` `0x00444dd0`, copied into save-side payload state around `0x00441ec5`, and reused as the earlier preseed cutoff by `world_preseed_named_candidate_availability_records_from_live_pool` `0x00437743`, so the safest current read is a shared stage-threshold comparator rather than a one-off world-field helper.","objdump + caller inspection + threshold correlation + global-stage-counter correlation"
|
||||
0x0044c670,2544,world_service_secondary_grid_marked_cell_overlay_cache,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Recurring world-side service pass over the secondary raster rooted at `[this+0x2135]` after `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60` has cached min/max/count bounds into `[this+0x21c6..+0x21d6]`. The helper first requires shell-state gate `[0x006cec78+0x4af3]`, then consumes the cached bounds to normalize the marked-cell band and rewrite per-cell bits in the same secondary raster. Its later overlay side is tighter now too: after resolving scaled surface dimensions through `shell_world_presentation_query_scaled_surface_dimensions` `0x00534c50`, it walks one local 3-by-32 sample lattice through the static offset tables at `0x00624b28/0x00624b48`, keeps only secondary-raster classes `4..0x0d`, folds several interpolated samples through repeated `0x0051db80` evaluation into one strongest local score, writes packed overlay pixels into the staged surface buffer, and only then publishes that staged overlay through `shell_world_presentation_publish_staged_overlay_surfaces_and_release_buffer` `0x00534af0`. The lower helper cluster beneath that owner is now explicit too: `0x00533e70` clears coarse overlay chunks in a rectangle, `0x00534160` ensures one coarse chunk and seeds local marks, and `0x00534e90` is the neighboring marked-bit predicate over the same 3-byte raster family. Current grounded callers are the recurring simulation-maintenance route-style branch at `0x0040a9f4` inside `simulation_service_periodic_boundary_work` `0x0040a590` and one startup-side world branch at `0x00448168`, so this is the safest current read for the shared secondary-grid marked-cell overlay-cache service rather than a one-shot startup helper or a fully player-facing panel renderer.","objdump + local disassembly + caller inspection + secondary-raster correlation + recurring-maintenance correlation + staged-overlay publish correlation"
|
||||
0x00443a50,4979,world_entry_transition_and_runtime_bringup,map,cdecl,inferred,objdump + analysis-context,4,"First grounded gameplay-world entry coordinator reached from `shell_map_file_entry_coordinator` `0x00445ac0`. The function boundary is now grounded as the full `0x00443a50..0x00444dc2` bringup span rather than just the early transition head. It stages the selected file path into `0x0062bee0`, dismisses the shell detail-panel controller at `0x006d0818`, drives `shell_transition_mode` through `0x00482ec0`, and resets the previous world bundle through `world_runtime_release_global_services` plus the neighboring startup-profile owner `0x00438890`. After the transition wait it builds temporary bundle payloads from `%1\\%2` and `%1.tmp`, allocates or serializes world-entry records through `0x00530c80`, `0x00531150`, and `0x00531360`, allocates the new world root at `0x0062c120` from the staged filename through `0x0044e910`, notifies the shell owner at `0x0062be68`, and then continues through the larger post-load generation pipeline instead of returning immediately. The later `319` tail is tighter now too: before the final world and shell reactivation it runs one post-bundle status-and-runtime-refresh phase that posts shell progress ids `0x196` and `0x197` through `0x005193f0/0x00540120` with paired `0x004834e0` follow-ons, refreshes event runtime records through `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`, rebuilds the scenario-side port-or-warehouse cargo recipe runtime tables through `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630`, runs the named-candidate availability preseed through `world_preseed_named_candidate_availability_records_from_live_pool` `0x00437743`, and then enters one later staged-profile or availability rehydrate band before the broader reactivation sweep. That rehydrate band posts progress ids `0x32dc/0x3714/0x3715`, reads one `0x108`-byte packed profile block through `0x00531150`, conditionally copies staged runtime-profile bytes from the loaded bundle back into `0x006cec7c` when latch `[profile+0x97]` is set, mirrors the grounded campaign-scenario bit `[profile+0xc5]` and sandbox bit `[profile+0x82]` into world bytes `[world+0x66de]` and `[world+0x66f2]`, restores the selected year or profile choice lane through `[profile+0x77]` into `[world+0x05/+0x09/+0x15]`, and then rehydrates the named locomotive-availability collection at `[world+0x66b6]` before the later world-wide service passes continue. That later reactivation tail is narrower now too: it includes `world_clear_and_reseed_region_center_world_grid_flag_bit` `0x0044c4b0`, then `world_rebuild_all_grid_cell_candidate_cargo_service_bitsets` `0x0044c450`, then `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60`, then the recurring secondary-raster overlay-cache service `world_service_secondary_grid_marked_cell_overlay_cache` `0x0044c670`, before the later route-style rebuild, shell-window, and briefing branches. Only after that later tail does it re-enter the one-shot world-entry runtime-effect service through `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with kind `8`, after which shell-profile latch `[0x006cec7c+0x97]` is cleared. This is therefore the current safest read for the full shell-to-gameplay world-entry transition and runtime bringup owner rather than only the front half of file staging and world allocation.","objdump + analysis-context + caller xrefs + strings + post-load-pipeline correlation + late-tail phase-order correlation + staged-profile-rehydrate correlation"
|
||||
|
|
@ -330,13 +440,31 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
|
|||
0x004425d0,139,shell_setup_validate_selected_profile_bundle_and_stage_launch_profile,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Validated setup-profile launch helper above shell request `0x0cc`. It allocates one large local scratch block, re-enters `shell_setup_load_selected_profile_bundle_into_payload_record` `0x00442400` on the caller path seed, and only proceeds when the loaded payload carries a nonzero leading byte. On success it force-stages runtime-profile byte `[0x006cec7c+0xc5] = 1`, copies payload byte `+0x22` into profile `+0xc4`, copies payload byte `+0x33` into profile `+0x7d`, mirrors the payload token block `+0x23..+0x32` into profile `+0xc6..+0xd5`, and then issues shell request `0x0cc` through `0x0054e790`. Current grounded callers are the validated setup launch controls inside `shell_setup_window_handle_message` `0x005033d0`, where selector-`3` and selector-`5` siblings share this same staging bridge before the later startup-profile owner runs.","objdump + local disassembly + caller inspection + setup-launch correlation + runtime-profile-staging correlation"
|
||||
0x0044c450,96,world_rebuild_all_grid_cell_candidate_cargo_service_bitsets,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Late world-reactivation sweep inside `world_entry_transition_and_runtime_bringup` `0x00443a50`. The helper walks the full live world grid rooted at `[this+0x2129]` through dimensions `[this+0x2145/+0x2149]`, resolves each cell pointer, and re-enters `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` on every cell record. Current grounded caller is the later world-entry tail at `0x444b24`, immediately after `world_clear_and_reseed_region_center_world_grid_flag_bit` `0x0044c4b0` and before the route-style link rebuild at `0x468300`, so this is the current safest read for the world-wide grid-cell cargo-service-bitset refresh wrapper rather than another generic world-grid loop.","objdump + local disassembly + caller inspection + world-grid correlation + cargo-service correlation"
|
||||
0x0044c4b0,192,world_clear_and_reseed_region_center_world_grid_flag_bit,map,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Late world-reactivation helper inside `world_entry_transition_and_runtime_bringup` `0x00443a50`. The first sweep walks the full live world grid rooted at `[0x0062c120+0x2129]` through dimensions `[+0x2145/+0x2149]` and clears bit `0x10` in each cell byte `[cell+0xe6]`. It then walks the live region collection at `0x0062bae0`, keeps only regions whose class byte `[region+0x23e]` is zero, resolves one representative center cell through `world_region_resolve_center_world_grid_cell` `0x00455f60`, and sets that same bit on the resolved cell. Current grounded caller is the later world-entry tail at `0x444b19`, between the post-bundle runtime refresh phase and the later shell or company-cache follow-ons, so this is the current safest read for the region-center world-grid flag reseed pass rather than another generic grid scrub.","objdump + local disassembly + caller inspection + region-grid correlation"
|
||||
0x0044c570,256,world_mark_secondary_raster_clear_cell_mask_0x3e_as_class_2_and_cache_bounds,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Small secondary-raster mutation helper beneath the later marked-cell scan and overlay-cache family. After clamping the caller cell coordinates against the current secondary-grid dimensions, the helper resolves the byte raster rooted at `[this+0x2135]` using row stride `[this+0x2155] + 1` and only proceeds when the target byte has no bits in mask `0x3e` and the parallel class predicate `world_secondary_raster_query_cell_class_in_set_1_3_4_5` `0x00534e10` also reports false. On the admit path it widens cached min/max bounds `[this+0x21c6..+0x21d2]`, increments the marked-cell count `[this+0x21d6]`, and then rewrites the target raster byte with `(byte & 0xc3) | 0x02`, i.e. it preserves the outer two bits and the low bit while forcing the masked class field to `0x02`. Current grounded caller is the later radial mutation branch at `0x0044e8e7`, and the written bounds/count fields are the same ones later scanned by `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60`, so this is the safest current read for the small secondary-raster cell-marker helper rather than another generic bounds updater.","objdump + caller xrefs + local disassembly + secondary-raster correlation + marked-cell-bound correlation"
|
||||
0x0044ce60,272,world_scan_secondary_grid_marked_cell_bounds,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Secondary world-raster bounds scan beneath the later world-entry reactivation tail. The helper clears cached fields `[this+0x21c6/+0x21ca/+0x21ce/+0x21d2/+0x21d6]`, requires the shell-state gate `[0x006cec78+0x4af3]` to be nonzero, and then scans the byte raster rooted at `[this+0x2135]` through dimensions `[this+0x2155/+0x2159]`. Every cell whose byte has any bits in mask `0x3e` contributes to the cached min-X, min-Y, max-X, max-Y, and marked-cell-count slots at those same `0x21c6..0x21d6` fields. Current grounded callers are the later world-entry tail at `0x444c36`, one neighboring startup-side world branch at `0x448168`, and the small count accessor at `0x42f8d8`, so this is the safest current read for the shared marked-cell bounding-box scan over the secondary world raster rather than a fully player-facing overlay owner.","objdump + local disassembly + caller inspection + secondary-raster correlation"
|
||||
0x0044cfb0,1120,world_load_runtime_grid_and_secondary_raster_tables_from_bundle,map,thiscall,inferred,objdump + caller xrefs + local disassembly + bundle-tag correlation,3,"Heavy world-root bundle-load body beneath `world_construct_root_and_load_bundle_payload_thunk` `0x0044e910`. After the immediate base setup and neighboring local initializers `0x00449270` and `0x00448260`, the helper reads one rooted payload through repeated `0x00531150/0x00531360` calls, storing the core grid and stride scalars into `[this+0x2145/+0x2149/+0x214d/+0x2151/+0x2155/+0x2159/+0x215d/+0x2161/+0x2201]`. It allocates the route-entry collection `0x006cfca8` through `0x00491af0`, allocates or zero-fills the main world arrays `[this+0x2139/+0x213d/+0x2141/+0x2131/+0x2135/+0x212d/+0x2129]` from chunk families `0x2ee2/0x2ee3/0x2ef4/0x2ef5/0x2ef6/0x2ee4/0x2ee5/0x2f43/0x2f44`, and on one loaded-raster path clears low bit `0x01` across every byte in `[this+0x2135]` after the bundle read succeeds. The tail then seeds every live world-grid cell record through `0x0042ae50`, re-enters `world_compute_transport_and_pricing_grid` `0x0044fb70`, refreshes neighboring presentation state through `0x00449f20`, and issues one shell-mode pulse through `0x00484d70` before returning. Current grounded caller is the world-root constructor thunk `0x0044e910` at `0x0044e931`, reached from the world-allocation branch inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the heavy world-grid and secondary-raster bundle-load body rather than the broader bringup owner.","objdump + caller xrefs + local disassembly + bundle-tag correlation + world-grid-array correlation"
|
||||
0x0044d4e0,512,world_relax_companion_float_grid_cross_average_in_rect_with_raster_bit0_gate,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Local five-pass relaxer over the companion float grid rooted at `[this+0x1605]`. The helper clamps the caller rectangle inward against the live world bounds, derives one radial falloff from the supplied center and radius through `0x0051dc00` when the caller radius is nonzero, averages the four cardinal neighbors around each admitted cell, subtracts the current cell, scales that delta by the falloff, the fixed coefficient at `0x005c8628`, and the caller gain, and only then accumulates the result back into the current float cell. The admit gate is explicit: cells whose paired raster byte in `[this+0x2135]` still has bit `0x01` set are skipped. After the five local passes it always re-enters `world_calculate_height_support_fields_in_rect_and_notify_dependents` `0x0044d410` on the same surviving rectangle. Current grounded caller is the neighboring world-side branch at `0x004bc5d3`, so this is the safest current read for the local cross-neighbor relaxer under the same height-support family rather than a broader global smoothing owner.","objdump + caller xrefs + local disassembly + float-grid correlation + local-relaxation correlation"
|
||||
0x0044d6e0,912,world_relax_companion_float_grid_cross_average_in_rect_with_acceptance_gate,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Second local five-pass relaxer over the same companion float grid rooted at `[this+0x1605]`. Like the sibling at `0x0044d4e0`, it clamps the caller rectangle, averages the four cardinal neighbors, subtracts the current cell, and scales the resulting delta by a fixed coefficient before optionally accumulating it back into the current float slot. The admit path is tighter here: the cell is skipped whenever the paired raster byte in `[this+0x2135]` still has bit `0x01` set, and otherwise it also consults the neighboring acceptance gate `0x004499c0` before applying the delta. The final caller flag then decides whether the helper tails into `world_calculate_height_support_fields_in_rect_and_notify_dependents` `0x0044d410` on the same rectangle or returns immediately. Current grounded caller is the world-side branch at `0x004190b4`, where it is dispatched once per admitted local cell before the outer owner re-enters `0x0044d410`, so this is the safest current read for the acceptance-gated local cross-neighbor relaxer rather than another generic scalar write.","objdump + caller xrefs + local disassembly + float-grid correlation + acceptance-gate correlation"
|
||||
0x0044d880,496,world_raise_companion_float_grid_toward_center_sample_in_rect,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Local neighborhood raise helper over the companion float grid rooted at `[this+0x1605]`. The function first validates the caller center cell against live dimensions, optionally seeds one baseline value from the current center sample when the caller gain is positive, expands a square neighborhood around that center by the caller radius, and then for each admitted cell derives one radial falloff through `0x0051dc00`. The body computes a delta from the current cell toward that baseline center sample, scales it by the falloff, the fixed coefficient at `0x005c8628`, and the caller gain, and accumulates the result back into the current float slot. After the neighborhood pass it always re-enters `world_calculate_height_support_fields_in_rect_and_notify_dependents` `0x0044d410` on the same surviving rectangle. Current grounded callers are the nearby world-side branches at `0x004bc676` and `0x004bc716`, so this is the safest current read for the center-sample-biased companion-float raise helper rather than another generic brush or setter.","objdump + caller xrefs + local disassembly + float-grid correlation + center-sample correlation"
|
||||
0x0044da70,560,world_raise_companion_float_grid_local_peak_in_rect_with_optional_class_3_5_bias,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Local peak-raising helper over the companion float grid rooted at `[this+0x1605]`. The function expands one square neighborhood around the caller cell, clamps that neighborhood to the live world bounds, and then for each admitted cell derives a falloff through `0x0051dc00` when the caller radius is nonzero, scales the current float sample by the caller gain, and quantizes the resulting candidate peak through `0x005a10d0`. When the final caller byte is nonzero it also probes one extra candidate cell through `world_secondary_raster_query_cell_class_in_set_3_5` `0x00534f00`, quantizes that extra sample too, and keeps the larger of the two integer peaks before writing the chosen value back into the float grid. After the neighborhood pass it always re-enters `world_calculate_height_support_fields_in_rect_and_notify_dependents` `0x0044d410` on the same surviving rectangle. Current grounded callers are the nearby world-side branches at `0x004bc51e`, `0x004bc81f`, `0x004f9c74..0x004f9d26`, and `0x004fab45..0x004fad45`, so this is the safest current read for the local peak-raising companion under the same height-support family rather than a generic paint brush.","objdump + caller xrefs + local disassembly + float-grid correlation + local-peak correlation"
|
||||
0x0044d410,208,world_calculate_height_support_fields_in_rect_and_notify_dependents,map,thiscall,inferred,objdump + caller xrefs + local disassembly + stage-order correlation,3,"Top-level rectangle owner under post-load progress id `322` `Calculating Heights...`. The helper first rejects while generation counter `[this+0x2205]` is live or when the neighboring rect supplier `0x00449e90` cannot produce a surviving work window. On the active path it forwards that rectangle into the shared support owners `0x005374d0`, `0x00533e70`, and `0x00537010`, then notifies the shell owner at `0x0062be68` and refreshes neighboring region or manager companions through `0x00421f50`, `0x00461770`, and `0x00415340`. Current grounded callers include `world_run_post_load_generation_pipeline` `0x004384d0`, the startup-side world path at `0x0044733d`, several recursive local helpers at `0x0044d6cf/0x0044d86e/0x0044da60/0x0044dc86`, and later world-side branches at `0x004143cd`, `0x00415f06`, `0x0041615d`, `0x00418a25`, `0x00418eb7`, `0x004190f0`, and `0x004fb55a..0x004fba30`, so this is the safest current read for the shared height-support and dependent-refresh owner rather than one narrow scalar smoother.","objdump + caller xrefs + local disassembly + stage-order correlation + support-surface correlation"
|
||||
0x0044dca0,80,world_write_companion_float_grid_cell_and_optionally_refresh_rect,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Small write-side helper over the companion float grid rooted at `[this+0x1605]`. The helper flattens the caller-supplied cell coordinates with world width `[this+0x15d9] + 1`, stores the caller-supplied dword into that one grid slot, and when the final caller flag is nonzero immediately re-enters `world_calculate_height_support_fields_in_rect_and_notify_dependents` `0x0044d410` on the same coordinates as a local rectangle. Current grounded callers include world-side branches at `0x00414398`, `0x00415df2`, `0x00415ec5`, `0x00418956/0x00418977/0x00418996/0x004189b3`, the startup-side world path at `0x00446f20`, and later world-side branches at `0x004fb90b..0x004fb9fb`, so this is the safest current read for the companion-float-grid cell setter with optional local recompute rather than a generic scalar write.","objdump + caller xrefs + local disassembly + float-grid correlation + local-recompute correlation"
|
||||
0x0044dcf0,316,world_refresh_secondary_raster_marked_bit_from_local_class_2_4_5_neighbors_in_rect,map,thiscall,inferred,objdump + local disassembly + internal caller correlation,3,"Local rectangle refresh helper over the same 3-byte secondary-raster family. The function first normalizes the caller rectangle through `0x00449df0`, then walks every cell in that bounded window and checks the eight immediate neighbors through the shared offset tables `0x00624b28/0x00624b48`. A small border-mode split is now explicit: for interior cells it rejects out-of-bounds neighbors early, while on the border path it treats the clipped edge more permissively. If any admissible neighbor belongs to secondary-raster class set `2/4/5` through `0x00534ec0`, the helper sets bit `0x200` in the current cell's companion word; otherwise it clears that bit. Current grounded callers are the two local mutation helpers `0x0044df03` and `0x0044dfcb`, so this is the safest current read for the marked-bit refresh companion under the same secondary-raster mutation family rather than a standalone overlay scan.","objdump + local disassembly + internal caller correlation + secondary-raster marked-bit correlation"
|
||||
0x0044df10,208,world_clear_local_secondary_raster_cell_sidecars_demote_class_and_refresh_marked_bits,map,thiscall,inferred,objdump + local disassembly + caller xrefs + secondary-raster correlation,3,"Small local secondary-raster clear helper. When the target cell is in class set `2/4/5` through `0x00534ec0`, the function clears the three local sidecar byte planes rooted at `[this+0x162d]`, `[this+0x1661]`, and `[this+0x1665]` for that cell, then rewrites the cell's low three class bits in place: class `4` is demoted to `1`, class `5` is demoted to `3`, and all other admitted cases have those low class bits cleared. After that local demotion it expands the affected window by one cell in each direction and re-enters `world_refresh_secondary_raster_marked_bit_from_local_class_2_4_5_neighbors_in_rect` `0x0044dcf0` on that surrounding rectangle. Current grounded callers are the higher-level rect refresh owner `0x0044e500` and one later world-side caller at `0x004fa81b`, so this is the safest current read for the local class-demotion and sidecar-clear companion beneath the secondary-raster mutation family.","objdump + local disassembly + caller xrefs + secondary-raster correlation + local-class-demotion correlation"
|
||||
0x0044e500,720,world_refresh_secondary_raster_edge_flags_in_rect_and_reseed_pending_component,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Rectangle-wide secondary-raster edge refresh owner. The helper first normalizes the caller rectangle through `0x00449df0`, then scans every cell in that window that belongs to class set `2/4/5` through `0x00534ec0`. For each admitted cell it snapshots the eight-neighbor occupancy pattern into a local byte ring, counts total plus parity-split neighbors, and then runs two grounded mutation branches. The first branch handles sparse single-neighbor interior cells: when byte-1 edge flags `0x04/0x08` are still clear and the cell is not on the outer border, it derives one aligned neighbor index from the current cell header and sets either bit `0x04` or `0x08` on byte `[cell+0x1]`. The second branch handles denser or incompatible local patterns: it re-enters `world_clear_local_secondary_raster_cell_sidecars_demote_class_and_refresh_marked_bits` `0x0044df10` on selected cells when the local parity counts or alternating-neighbor pattern fail the expected shape. After the full rectangle pass it also checks the pending global seed coordinates at `[0x006d1304+0x78/+0x7c]`; when those are valid it re-enters `world_seed_secondary_raster_class_2_4_5_component_walk_from_cell` `0x0044c200` and then clears that pending pair back to `-1`. Current grounded caller is the broader owner `0x0044e982`, so this is the safest current read for the rect-wide secondary-raster edge refresh plus pending-component reseed owner rather than a generic area scan.","objdump + caller xrefs + local disassembly + secondary-raster correlation + rect-edge-refresh correlation"
|
||||
0x0044e7d0,320,world_stamp_radial_secondary_raster_class_2_marks_from_world_coords,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Radial secondary-raster stamp helper over world-space coordinates. After validating the caller float coordinate pair through `0x00414bd0`, the helper converts the center into one clamped integer bounding box using the paired radius constants at `0x005c8dc0` and `0x005c8c30`, then walks every cell in that box. For each candidate cell it evaluates the radial falloff helper `0x0051db80` against the current center and only when that score stays positive does it re-enter `world_mark_secondary_raster_clear_cell_mask_0x3e_as_class_2_and_cache_bounds` `0x0044c570`. Current grounded caller is the placed-structure-side branch at `0x0041d2c4`, which first checks shell gate `[0x006cec78+0x4af3]`, candidate family `[entry+0x41] == 5`, and then forwards the owner's normalized coordinates through `0x00455800/0x00455810`, so this is the safest current read for the shared radial class-`2` stamp helper rather than a generic brush or preview-only rasterizer.","objdump + caller xrefs + local disassembly + secondary-raster correlation + radial-falloff correlation"
|
||||
0x0044e910,44,world_construct_root_and_load_bundle_payload_thunk,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small world-root constructor thunk. It first runs the immediate base initializer `0x00534f60`, installs vtable `0x005ca9fc`, re-enters the neighboring setup helper `0x00448260`, and then forwards the two caller-supplied constructor arguments into the heavier payload-load body `0x0044cfb0` before returning `this`. Current grounded caller is the world-allocation branch at `0x004442c2`, which allocates the `0x2209`-byte world root and then stores the constructed instance into `0x0062c120`, so this is the safest current read for the small world-root construct-and-load thunk rather than the larger runtime bringup owner itself.","objdump + caller xrefs + local disassembly + world-allocation correlation"
|
||||
0x0044e940,1792,world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Broad rectangle-scoped rebuild owner over the live secondary-raster derived presentation family. The helper first clamps the caller rectangle through `0x00449df0` and reruns `world_refresh_secondary_raster_edge_flags_in_rect_and_reseed_pending_component` `0x0044e500`. It then lazily ensures one presentation target through `0x0051f090` plus `0x00534910/0x00534920/0x00534930`, refreshes neighboring world-presentation state through `0x00449f20`, resolves scaled target dimensions through `0x00534c50`, and allocates a temporary `width*height` mask. The main scan then walks the live secondary raster `[this+0x165d]` and class predicates `0x00534e10/0x00534e50/0x00534f00/0x00534ec0`: class-`1/3/4/5` cells force `0xff` into the four sidecar byte planes `[this+0x1631..+0x163d]`, while the broader per-cell pass computes local windows, emits packed values into the ensured target through `0x00534730`, and also updates nibble lanes at byte offsets `+0x2` and `+0x5` inside the same three-byte secondary-raster cell family. After the publish it notifies the shell owner at `0x0062be68`, re-enters `0x00449f80` and `0x004881b0`, frees the temporary mask, expands the caller rectangle by dirty bounds `[this+0x21ad..+0x21b9]` through `0x00536710`, and finally seeds companion byte `[this+0x162d]` with `0xc4` on cells selected from mask plane `[this+0x1655]`. Current grounded callers include the post-load generation path at `0x00444a42`, the shell-mode toggle branch at `0x004480ec`, the sibling owner at `0x0044fac6`, and later world-side branches at `0x004fb1f9`, `0x004fc21e`, and `0x004ffee4`, so this is the safest current read for the broad secondary-raster derived-surface and companion-plane rebuild owner rather than a one-off shell preview draw.","objdump + caller xrefs + local disassembly + secondary-raster correlation + derived-surface publish correlation"
|
||||
0x00414bd0,112,world_query_float_coords_within_live_grid_bounds,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small float-coordinate bounds predicate over the live world grid. The helper returns true only when both caller-supplied float coordinates are `>= 0` and `<= [world+0x15d9]-1` / `<= [world+0x15d5]-1` respectively; otherwise it returns false. Current grounded callers include `placed_structure_validate_projected_candidate_placement` `0x004197e0`, the radial secondary-raster stamp helper `0x0044e7d0`, several later world-side branches around `0x00480af8`, `0x00498278`, and `0x004982cb`, and the StationPlace world-surface branch at `0x005085a4`, so this is the safest current read for the shared float grid-bounds gate rather than a tool-specific placement check.","objdump + caller xrefs + local disassembly + grid-bounds correlation"
|
||||
0x00449df0,144,world_clamp_rect_coords_to_live_grid_and_validate_nonempty,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small rectangle clamp-and-validate helper over integer world-grid coordinates. The function takes four caller-owned coordinate pointers, clamps the two lower bounds to zero, clamps the two upper bounds to `[world+0x2155]-1` and `[world+0x2159]-1`, and then returns true only when the resulting rectangle is still nonempty and fully within those live dimensions. Current grounded callers include the local marked-bit refresh helper `0x0044dcf0`, the rect-wide secondary-raster edge refresh owner `0x0044e500`, the broader owner `0x0044e982`, later secondary-raster siblings around `0x0044ec93` and `0x0044eee9`, the route-entry window gate `route_entry_collection_query_rect_window_passes_entry_type_gate` `0x00494240`, and one later world-side caller at `0x00494261`, so this is the safest current read for the shared rect clamp-and-validity predicate rather than a serializer-only rectangle helper.","objdump + caller xrefs + local disassembly + rect-clamp correlation"
|
||||
0x00444dd0,3301,map_bundle_open_reference_databases,map,cdecl,inferred,ghidra-headless,3,Opens and registers a broad reference-database bundle for the active map path. The routine formats %1\\%2 paths allocates bundle state through 0x00530c80 and wires many global datasets including gpdLabelDB gpdCityDB and related city geographic and map reference tables before later shell and map loaders continue.,ghidra + rizin + llvm-objdump + strings
|
||||
0x00445ac0,790,shell_map_file_entry_coordinator,map,cdecl,inferred,objdump + analysis-context,4,"Broad shell-side file-open and restore coordinator reached from tutorial launch shell UI editor-panel flows and scenario batch processing. It accepts either an incoming filename seed or a generated Quicksave base name and then chooses between the heavier world-entry branch at 0x00443a50 and the sibling saved-runtime restore branch at 0x00446d40. Bit 0x1 in its flag argument now grounds the Quicksave path from the shared string table at 0x005ca9cc. The non-Quicksave interactive path is tighter now too: it routes through shell_file_request_dialog_collect_target_path at 0x004dd010 using load mode 4=.gmp when EditorPanel.win is live and the paired non-editor open modes 8=.gms 9=.gmc and 10=.gmx. The shell-state master flag `[0x006cec74+0x68]` now reinforces that same mapping on the direct Quicksave branch too: when it is nonzero the coordinator appends the `.gmp` token immediately instead of choosing among the scenario families, which makes the flag the strongest current shell-side anchor for editor-map mode rather than a generic post-load toggle. Current surrounding shell evidence now makes the non-editor trio much less anonymous: `.gmx` aligns with sandbox mode because the sibling shell branch at 0x004dc923 gates on 0x006cec7c+0x82 and surfaces string 3898 `The briefing is not available in sandbox games`; `.gmc` aligns with campaign scenarios because 0x004dc9cd gates on 0x006cec7c+0xc5 and surfaces string 3018 about resigning back to the campaign screen; the remaining default `.gms` branch is therefore the standalone scenario family. When a live runtime world is already active the helper appends .smp instead of the non-runtime extensions before the restore branch continues.",objdump + analysis-context + caller xrefs + strings + mode-table inspection + string correlation + Quicksave branch inspection
|
||||
0x00445de0,1115,shell_map_file_world_bundle_coordinator,map,cdecl,inferred,objdump + analysis-context,4,"Broad shell-side file-save and package coordinator used by direct shell commands scenario batch processing and neighboring shell-editor callers. It accepts either an incoming filename seed a generated Quicksave base name from flag bit 0x1 or the localized `Autosave` seed from flag bit 0x2 string id 387. Its non-Quicksave interactive path is now tighter: it routes through shell_file_request_dialog_collect_target_path at 0x004dd010 using save mode 3=.gmp for the editor-map package path 0=.gms for standalone scenarios 1=.gmc for campaign-scenario saves and 2=.gmx for sandbox saves plus one auxiliary 11=.gmt branch reached only through the separate 0x00434050 check on the side owner at 0x006cd8d8. The shell-state master flag `[0x006cec74+0x68]` now reinforces that editor mapping on the direct save and Quicksave side too: when it is nonzero the coordinator chooses the `.gmp` package mode immediately before the scenario-family checks, which makes the flag the strongest current shell-side anchor for editor-map mode rather than a generic setup toggle. That `.gmt` path no longer looks like another scenario family: when the auxiliary owner is present the coordinator packages the chosen path into the owner-local request block near 0x006cd8d8+0x8f48 and submits it through 0x00469d30; only when that owner is absent does it fall back to map_bundle_open_reference_databases at 0x00444dd0. The campaign mapping is now backed by the numbered `%s%02d.gmc` helper at 0x00517c70 which formats one campaign-progress slot from 0x006cec7c+0xc4 before re-entering this coordinator, while the sandbox mapping is backed by the neighboring shell restriction string 3898 on 0x006cec7c+0x82. When a live runtime world is active the mainline branch still appends .smp and invokes world_runtime_serialize_smp_bundle at 0x00446240. This makes the helper the save-side sibling of shell_map_file_entry_coordinator rather than another restore dispatcher, with `.gmt` now bounded as an auxiliary preview-surface side path instead of a fourth gameplay save family.",objdump + analysis-context + caller xrefs + strings + mode-table inspection + string correlation + side-owner branch inspection + direct save branch inspection
|
||||
0x00455f60,96,world_region_resolve_center_world_grid_cell,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small region-to-grid resolver that converts one region's cached center coordinate pair into a pointer into the live world-grid cell table rooted at `[0x0062c120+0x2129]`. It reads the cached floats at `[this+0x1ea]` and `[this+0x1e2]`, scales and rounds them through `0x005a10d0`, multiplies the Y-like term by world width `[0x0062c120+0x2145]`, adds the X-like term, and returns the corresponding grid-cell pointer. Current grounded callers include the world-entry region-center flag reseed pass `0x0044c4b0` and several older site- or route-style world-grid query helpers, so this is now the safest current read for the shared region-center world-grid-cell resolver.","objdump + local disassembly + caller inspection + world-grid correlation"
|
||||
0x00446240,2807,world_runtime_serialize_smp_bundle,map,cdecl,inferred,objdump + analysis-context,3,"Serializes the current live world state into the `.smp` branch used by shell_map_file_world_bundle_coordinator. After dismissing the shell detail controller and running one shell-state service step it allocates a bundle through 0x00530c80 seeds many typed records through repeated 0x00531030 and 0x00531340 calls walks world collections under 0x0062c120 and 0x006ada80 and emits runtime-state payloads through helpers such as 0x00534e50 0x00534ec0 0x00534f00 and 0x00534f40; the raster side is tighter now too, because the serializer writes the two one-byte overlay mask planes separately through chunk ids `0x2cee` for `[world+0x1655]` and `0x2d51` for `[world+0x1659]`, then re-enters world_serialize_four_sidecar_byte_planes_into_runtime_bundle `0x00448fe0` to write four additional byte planes under chunk family `0x9471..0x9472` from the world-owned pointer band at `[world+0x1631 + index*4]` before finalizing through 0x00530a00. Current grounded caller is 0x00445de0 on the `.smp` path so this looks like the live-world save or package serializer rather than the restore path.","objdump + analysis-context + caller xrefs + strings + sidecar-plane correlation + mask-plane bundle-tag correlation"
|
||||
0x00446d40,5401,world_load_saved_runtime_state_bundle,map,cdecl,inferred,objdump + analysis-context,4,"Loads one saved runtime world-state bundle from the `.smp` branch selected by shell_map_file_entry_coordinator. The helper dismisses the shell detail controller releases the prior world runtime drives shell mode and status transitions builds a bundle through 0x00530c80 and repeated 0x00531150 reads allocates a new world root at 0x0062c120 through 0x0044cf70 and then fills that root through repeated grid and object writes, including the secondary-raster class mutators world_secondary_raster_reclass_cell_to_low3bit_1_or_4_and_clear_primary_companion_plane `0x00448c20` and world_secondary_raster_reclass_cell_to_low3bit_3_or_5_and_clear_primary_companion_plane `0x00448cb0`, the byte2-flag and companion-byte writers `0x00448d90`, `0x00448e60`, and `0x00448e90`, and the broader restore-side world-cell helper `0x0044de30`; the raster side is tighter now too, because the loader restores the two one-byte overlay mask planes separately from chunk ids `0x2cee` into `[world+0x1655]` and `0x2d51` into `[world+0x1659]`, and then, for versioned bundles at `>= 0x3ec`, re-enters world_load_four_sidecar_byte_planes_from_runtime_bundle `0x00448f60` to restore four extra byte planes under chunk family `0x9471..0x9472` into the world-owned pointer band `[world+0x1631 + index*4]`. This is the first grounded gameplay save-load restore dispatcher for `.smp` content rather than the broader reference-database map-entry flow.","objdump + analysis-context + caller xrefs + strings + sidecar-plane correlation + mask-plane bundle-tag correlation"
|
||||
0x00446240,2807,world_runtime_serialize_smp_bundle,map,cdecl,inferred,objdump + analysis-context,3,"Serializes the current live world state into the `.smp` branch used by shell_map_file_world_bundle_coordinator. After dismissing the shell detail controller and running one shell-state service step it allocates a bundle through 0x00530c80 seeds many typed records through repeated 0x00531030 and 0x00531340 calls walks world collections under 0x0062c120 and 0x006ada80 and emits runtime-state payloads through helpers such as 0x00534e50 0x00534ec0 0x00534f00 and 0x00534f40; the raster side is tighter now too, because the serializer writes the two one-byte overlay mask planes separately through chunk ids `0x2cee` for `[world+0x1655]` and `0x2d51` for `[world+0x1659]`, then re-enters world_serialize_four_sidecar_byte_planes_into_runtime_bundle `0x00448fe0` to write four additional byte planes under chunk family `0x9471..0x9472` from the world-owned pointer band at `[world+0x1631 + index*4]` before finalizing through 0x00530a00. One late fixed-band save is tighter now too: at version `>= 0x400` the serializer writes `49` dwords from `[world+0x4a7f..+0x4b3f]` and one trailing dword from `[world+0x4b43]`, which grounds a direct `.smp` save of the editor-side scenario-rule band rather than only the smaller fixed matrix inferred from checked `gmp/gms/gmx` files. Current grounded caller is 0x00445de0 on the `.smp` path so this looks like the live-world save or package serializer rather than the restore path.","objdump + analysis-context + caller xrefs + strings + sidecar-plane correlation + mask-plane bundle-tag correlation + fixed-runtime-band correlation"
|
||||
0x00446d40,5401,world_load_saved_runtime_state_bundle,map,cdecl,inferred,objdump + analysis-context,4,"Loads one saved runtime world-state bundle from the `.smp` branch selected by shell_map_file_entry_coordinator. The helper dismisses the shell detail controller releases the prior world runtime drives shell mode and status transitions builds a bundle through 0x00530c80 and repeated 0x00531150 reads allocates a new world root at 0x0062c120 through 0x0044cf70 and then fills that root through repeated grid and object writes, including the secondary-raster class mutators world_secondary_raster_reclass_cell_to_low3bit_1_or_4_and_clear_primary_companion_plane `0x00448c20` and world_secondary_raster_reclass_cell_to_low3bit_3_or_5_and_clear_primary_companion_plane `0x00448cb0`, the byte2-flag and companion-byte writers `0x00448d90`, `0x00448e60`, and `0x00448e90`, and the broader restore-side world-cell helper `0x0044de30`; the raster side is tighter now too, because the loader restores the two one-byte overlay mask planes separately from chunk ids `0x2cee` into `[world+0x1655]` and `0x2d51` into `[world+0x1659]`, and then, for versioned bundles at `>= 0x3ec`, re-enters world_load_four_sidecar_byte_planes_from_runtime_bundle `0x00448f60` to restore four extra byte planes under chunk family `0x9471..0x9472` into the world-owned pointer band `[world+0x1631 + index*4]`. One later fixed-band restore is tighter now too: at version `>= 0x3fc` the loader reads `49` dwords directly into `[world+0x4a7f..+0x4b3f]` and one trailing dword into `[world+0x4b43]`, which grounds a direct `.smp` restore of the editor-side scenario-rule band rather than only the smaller fixed matrix inferred in the checked `gmp/gms/gmx` families. This is the first grounded gameplay save-load restore dispatcher for `.smp` content rather than the broader reference-database map-entry flow.","objdump + analysis-context + caller xrefs + strings + sidecar-plane correlation + mask-plane bundle-tag correlation + fixed-runtime-band correlation"
|
||||
0x0044f840,176,world_build_transport_pricing_preview_surface_from_secondary_raster,map,thiscall,inferred,objdump + caller inspection + local disassembly + secondary-raster correlation,3,"Small transport/pricing-side preview builder beneath `world_compute_transport_and_pricing_grid` `0x0044fb70`. The helper allocates one default presentation target through `0x00534930`, queries its dimensions through `0x00534c50`, seeds five fallback palette entries through repeated `0x0051de10` calls, and then walks the target pixels. Each pixel is mapped back into the live secondary raster `[this+0x165d]` through `0x00533970/0x00533980`; low-3-bit classes other than `1/4` get one fixed fallback color, while class-`1/4` pixels scan a local `+/-4` neighborhood for zero-tag cells, score those through the radial falloff helper `0x0051db80`, and then choose either one of the seeded palette entries or the alternate fallback color `0x5f040566`. After filling the whole surface it re-enters `world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940` on the full `0..0x270f` rectangle rooted at that target. Current grounded caller is the null-build path at `0x0044fb31` inside `world_compute_transport_and_pricing_grid`, so this is the safest current read for the transport/pricing preview-surface builder rather than another generic overlay helper.","objdump + caller inspection + local disassembly + secondary-raster correlation + preview-surface correlation"
|
||||
0x0044faf0,128,world_ensure_transport_pricing_preview_surface_and_publish_if_missing,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Thin world-side ensure/publish wrapper above `world_build_transport_pricing_preview_surface_from_secondary_raster` `0x0044f840`. The helper first forwards the caller rectangle and output pointer into `0x00538060`, then samples shell state through `0x0040b830` and the paired shell notifier `0x004834e0`. When the returned preview handle is null it rebuilds the preview surface by re-entering `0x0044f840`; in either case it then refreshes neighboring world presentation through `0x00449f80`, re-enters the region-border overlay refresh `0x004881b0`, posts the same shell notifier again, and finally issues one mode pulse through `0x00484d70` before returning the ensured handle. Current grounded caller is the world-side path at `0x0043901a`, so this is the safest current read for the transport/pricing preview ensure-and-publish wrapper rather than another generic surface allocator.","objdump + caller inspection + local disassembly + world-presentation correlation"
|
||||
0x0044fb70,1117,world_compute_transport_and_pricing_grid,map,cdecl,inferred,objdump + strings + callsite inspection,3,"Post-load world-generation subphase inside world_run_post_load_generation_pipeline. Reached directly under the localized progress update `Computing Transportation and Pricing...`, the helper iterates the active world grid through dimensions and bounds rooted at `[0x0062c120+0x2145]`, `[+0x2149]`, `[+0x2155]`, `[+0x2159]`, and `[+0x2129]`, samples neighborhood offsets from `0x00624b28` and `0x00624b48`, combines local terrain or transport values through repeated calls to `0x00534e50` and `0x00448aa0`, and writes bounded 16-bit results back into the grid cells. This now looks like the map-wide transportation-cost or pricing-field computation pass rather than a recurring simulation-step loop.",objdump + caller context + RT3.lng strings
|
||||
0x00487540,221,world_region_border_overlay_reset_companion_record,map,thiscall,inferred,objdump + caller xrefs + field-reset inspection,4,"Shared companion-record initializer under the region-border overlay family rooted at `0x006cfc9c`. The helper zeroes the live region id and accumulated contribution fields, seeds the enable and remap dwords at `[this+0x31]` and `[this+0x35]` to `1`, seeds the budget-like dword `[this+0x39]` to `0x186a0`, clears the paired float or score bands at `[this+0x45/+0x49/+0x4d/+0x51]` and `[this+0x1fd/+0x201/+0x205/+0x209]`, zeros the later summary slots at `[this+0xd51..+0xd69]`, resets `[this+0xd4d]` to `1`, and clears the two large tail arrays rooted at `[this+0x3b5]` and `[this+0xd6d]`. Current grounded callers are the plain wrapper `0x00487620` and the id-setting wrapper `0x00487650`, both used under world_region_border_overlay_rebuild.","objdump + caller xrefs + field-reset inspection"
|
||||
0x00487650,16,world_region_border_overlay_reset_companion_record_and_assign_region_id,map,thiscall,inferred,objdump + caller xrefs + wrapper inspection,4,"Thin wrapper around world_region_border_overlay_reset_companion_record. After resetting the full companion record, the helper stores the caller-supplied live region id into `[this+0x00]` and returns. Current grounded callers are the region-border overlay setup loops at `0x00487d77` and `0x0048836e`.","objdump + caller xrefs + wrapper inspection"
|
||||
|
|
@ -389,10 +517,10 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
|
|||
0x004ca910,474,map_editor_building_density_panel_refresh_controls,map,thiscall,inferred,objdump + RT3.lng strings + caller inspection + UI control inspection,4,"Refreshes the shell-side `Building Density` page in the map-editor control panel. The helper reads two scenario-state bytes at `[0x006cec78+0x4c78]` and `[+0x4c7c]` and reflects them into two separate three-choice control bands `0x5c3a..0x5c3c` and `0x5c44..0x5c46`, with both fields seeded to the middle state `1` by constructor-time defaults and persisted through the ordinary map-state bundle path. The localized field captions now make the page materially tighter: `[state+0x4c78]` is the `Starting Building Density Level:` selector from ids `1642` and `1643`, where the default middle state `1` corresponds to the documented `100%` baseline and the lower world-building branches later treat the stored ordinal as a real three-state numeric mode; `[state+0x4c7c]` is the paired `Building Density Growth:` selector from id `1644`, which combines with city or region-specific density changes as described by `1641` and is likewise consumed later as a three-state growth-mode byte rather than a pure UI label. Related localized report text such as `1037`, `1048`, and `1070` points back to this same pair as the map-wide starting-density and later growth controls.","objdump + RT3.lng strings + caller inspection + UI control inspection + save-load correlation"
|
||||
0x004ca980,315,map_editor_economic_cost_slider_dispatch,map,thiscall,inferred,objdump + RT3.lng strings + .data descriptor table inspection,3,"Slider-update dispatcher for one shell-side map-editor economic tuning family. The helper handles the bounded slider event range `0xa433..0xa43d`, converts the incoming integer slider delta or position into normalized floats, writes six tuned values into the adjacent scenario-state block at `[0x006cec78+0x0be2]`, `[+0x0be6]`, `[+0x0bea]`, `[+0x0bee]`, `[+0x0bf2]`, and `[+0x0bf6]`, mirrors the first value into `[state+0x0bde]`, and then re-enters the live panel owner through `0x004cadf0` when `0x006cff84` is present. Current neighboring constructor evidence binds this callback to six visible controls under `0x5bcd..0x5bd7`, while the surrounding `.data` descriptor run at `0x00611c70..0x00612220` now bounds the wider editor lane as the live owner for `Prime Rate`, `Merger Premium`, and the construction and maintenance cost labels `Build Stations Cost` through `Steam Engine Cost` with help texts `2433..2437`, rather than leaving that help-text family orphaned.","objdump + slider jump-table inspection + state-field correlation + RT3.lng strings + .data descriptor table inspection"
|
||||
0x004cadf0,751,map_editor_economic_cost_slider_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + caller inspection + .data descriptor table inspection,4,"Constructs one shell-side map-editor economic cost tuning panel. The helper registers `map_editor_economic_cost_slider_dispatch` at `0x004ca980` on the six slider controls `0x5bcd`, `0x5bcf`, `0x5bd1`, `0x5bd3`, `0x5bd5`, and `0x5bd7`, attaches the neighboring preview or formatter callback `0x004caaf0` on control `0x5be1`, and then republishes the current scenario-state tuning values from `[0x006cec78+0x0be2..0x0bf6]` back into those controls through the shared slider formatting helpers. Current surrounding evidence now grounds this as the live editor-side economic tuning subsystem that was previously only visible through the orphaned help-text family: the adjacent descriptor block at `0x00611c70..0x00612220` pairs the wider lane with localized fields `Prime Rate`, `Merger Premium`, and `Build Stations Cost` through `Steam Engine Cost`, plus help texts `2433..2437`. Current grounded caller is the larger editor-panel dispatcher at `0x004ce244`.","objdump + caller inspection + slider registration + state-field correlation + RT3.lng strings + .data descriptor table inspection"
|
||||
0x004cb2b0,485,map_editor_scenario_special_conditions_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + static-table inspection,4,"Constructs the special-conditions side of the shell map-editor scenario setup page. The helper binds the row formatter `0x004cb1c0` and range callback `0x004cb1a0` on list control `0xa7fa` through `Setup_Options_Buttons.imb`, walks the 36-entry static toggle table at `0x005f3ab0`, counts enabled dword flags in `[0x006cec78+0x4a7f]`, formats each row from paired label/help ids such as `2535/2564` `Disable Stock Buying and Selling`, `2874/2875` `Use Bio-Accelerator Cars`, `3722/3723` `Disable Cargo Economy`, `3850/3851` `Disable Train Crashes`, `3852/3853` `Disable Train Crashes AND Breakdowns`, and `3920/3921` `AI Ignore Territories At Startup`, and republishes the `Special Conditions In Effect` summary from localized id `1053` through control `0xa7f8`. It then re-enters `map_editor_scenario_metadata_panel_refresh_controls` at `0x004ca790`, which makes this a bounded scenario special-conditions panel rather than a generic option list. Current grounded caller is the larger editor-panel dispatcher at `0x004ce28e`.","objdump + RT3.lng strings + static-table inspection + UI callback inspection"
|
||||
0x004cb2b0,485,map_editor_scenario_special_conditions_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + static-table inspection,4,"Constructs the special-conditions side of the shell map-editor scenario setup page. The helper binds the row formatter `0x004cb1c0` and range callback `0x004cb1a0` on list control `0xa7fa` through `Setup_Options_Buttons.imb`, walks the 49-entry static toggle table at `0x005f3ab0`, counts enabled dword flags in `[0x006cec78+0x4a7f]`, formats each row from paired label/help ids such as `2535/2564` `Disable Stock Buying and Selling`, `2874/2875` `Use Bio-Accelerator Cars`, `3722/3723` `Disable Cargo Economy`, `3850/3851` `Disable Train Crashes`, `3852/3853` `Disable Train Crashes AND Breakdowns`, and `3920/3921` `AI Ignore Territories At Startup`, and republishes the `Special Conditions In Effect` summary from localized id `1053` through control `0xa7f8`. The same constructor also reads one trailing dword at `[0x006cec78+0x4b43]`, so the live editor-owned scenario-rule band is now best bounded as `49` dwords plus one scalar rather than the smaller fixed matrix inferred in the checked `gmp/gms/gmx` files. It then re-enters `map_editor_scenario_metadata_panel_refresh_controls` at `0x004ca790`, which makes this a bounded scenario special-conditions panel rather than a generic option list. Current grounded caller is the larger editor-panel dispatcher at `0x004ce28e`.","objdump + RT3.lng strings + static-table inspection + UI callback inspection + fixed-runtime-band correlation"
|
||||
0x004cb4a0,468,map_editor_scenario_metadata_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the adjacent map-editor scenario metadata controls. The helper handles the bounded event band `0xa497..0xa4a2`, writing the scenario description from the edit-control payload into `[0x006cec78+0x672e]`, the single-player and multiplayer briefing texts into `[+0x4f30]` and `[+0x5ae9]`, flipping the briefing selector at `0x621f50` between the single-player and multiplayer views, toggling the direct campaign-scenario byte `[+0x66de]` plus the paired metadata byte `[+0x66f3]`, and committing the three start-year fields `[+0x66ca]`, `[+0x66ce]`, and `[+0x66d2]` after clamping each incoming value to `1829..2100`. The resource correlation is now explicit too: `editorDetail.win` ties control `0x5b6e` to localized ids `3160/3161` `Campaign Scenario` and `If checked, this map will be reserved as a campaign scenario.`, so the direct toggle path at `0x4cb519` is now grounded as the editor-side campaign-designation bit rather than a generic metadata checkbox. Before returning it also normalizes the year trio so `minimum <= default <= maximum` and then re-enters `map_editor_scenario_metadata_panel_refresh_controls` at `0x004ca790`, which confirms that the shared control band `0x5b69..0x5b74` is the live scenario description, briefing, and start-year editor rather than another generic editor options block. Current grounded caller is the panel callback installation rooted at `0x004ce28e`.","objdump + RT3.lng strings + UI dispatch inspection + state-field correlation + editorDetail.win resource record"
|
||||
0x004cb6f0,496,map_editor_available_chairman_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + static-table inspection + UI dispatch inspection,4,"Message dispatcher for the shell-side `Player Pool` editor page. The helper handles the three bulk-selection buttons `0x5aa1..0x5aa3` by rewriting the scenario-side availability bytes rooted at `[0x006cec78+0x6987]` from preset-selection bytes embedded in the same `0x005f2d28` persona table family, and it also commits direct per-row toggle changes from the control range `0x5aaa..0x5b03` back into that byte array. After either path it re-enters `map_editor_available_chairman_panel_construct` at `0x004ca540`, which keeps the visible chairman-name list and the `selected out of total` summary in sync. The localized page text `996` `Player Pool` and help text `1016` now make this the live owner for the scenario's chairman-availability mask rather than a passive list callback block.","objdump + RT3.lng strings + static-table inspection + UI dispatch inspection + state-field correlation"
|
||||
0x004cb8e0,271,map_editor_scenario_special_conditions_panel_handle_message,map,thiscall,inferred,objdump + static-table inspection + UI dispatch inspection,4,"Message dispatcher for the special-conditions side of the shell map-editor scenario setup page. The helper handles the bulk selection controls `0xa7fb` and `0xa7fc` by writing the whole special-condition dword array rooted at `[0x006cec78+0x4a7f]`, commits direct per-row state changes from the callback band `0xabe0..0xafc7` into that same array, and then re-enters `map_editor_scenario_special_conditions_panel_construct` at `0x004cb2b0` to refresh the visible list and the `Special Conditions In Effect` summary. Two row ids are also special-cased through immediate helper calls after commit, which marks this as the live state owner for the scenario rule-toggle matrix rather than only a passive list callback block.","objdump + static-table inspection + UI dispatch inspection + state-field correlation"
|
||||
0x004cb8e0,271,map_editor_scenario_special_conditions_panel_handle_message,map,thiscall,inferred,objdump + static-table inspection + UI dispatch inspection,4,"Message dispatcher for the special-conditions side of the shell map-editor scenario setup page. The helper handles the bulk selection controls `0xa7fb` and `0xa7fc` by writing the whole `49`-dword special-condition array rooted at `[0x006cec78+0x4a7f]`, commits direct per-row state changes from the callback band `0xabe0..0xafc7` into that same array, and updates the neighboring scalar at `[0x006cec78+0x4b43]` through control id `0xa7ff` before re-entering `map_editor_scenario_special_conditions_panel_construct` at `0x004cb2b0` to refresh the visible list and the `Special Conditions In Effect` summary. Two row ids are also special-cased through immediate helper calls after commit, which marks this as the live state owner for the wider scenario rule-toggle matrix rather than only a passive list callback block.","objdump + static-table inspection + UI dispatch inspection + state-field correlation + fixed-runtime-band correlation"
|
||||
0x004cb9f0,134,map_editor_building_density_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + caller inspection + UI dispatch inspection,4,"Message dispatcher for the shell-side `Building Density` page. The helper handles the two three-choice control bands `0x5c3a..0x5c3c` and `0x5c44..0x5c46`, committing ordinal values `0`, `1`, or `2` into the scenario-state bytes `[0x006cec78+0x4c78]` and `[+0x4c7c]` respectively before re-entering the same page refresh path at `0x004ca910`. The localized captions now pin the semantics more directly: `[state+0x4c78]` is the map-wide `Starting Building Density Level:` selector whose default middle state is the documented `100%` baseline, while `[state+0x4c7c]` is the paired `Building Density Growth:` selector. Current downstream xrefs also show both stored bytes steering later world-generation and growth math as concrete three-state mode selectors rather than only UI summaries.","objdump + RT3.lng strings + caller inspection + UI dispatch inspection + state-field correlation"
|
||||
0x004cc980,943,map_editor_city_region_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Cities/Regions` editor page. The helper uses the current selected city-or-region id in `0x006cff74`, falls back to the first live entry in the region collection at `0x0062bae0`, and shows the empty-page warning from localized id `1045` `You currently have no cities or regions to edit.` when the collection is empty. In the live path it binds the list-row formatter `0x004cc340` and selection callback `0x004cc930`, populates the visible city-or-region list from `0x0062bae0`, publishes detail fields through controls `0x50dc..0x50e2`, and formats the page summary from localized ids including `3002`, all of which makes this the main owner for the `Cities/Regions` editor section rather than a subordinate helper.","objdump + RT3.lng strings + UI callback inspection + region-collection correlation"
|
||||
0x004cc250,112,map_editor_chairman_slot_panel_refresh_slot_list,map,thiscall,inferred,objdump + UI control inspection,4,"Rebuilds the visible slot list in the chairman-slot editor panel. It clears the list control under group `0x5a6e`, then walks the 16 local slot records rooted at `[0x006cec78+0x69d8]` and appends one row for each slot whose active-seat bytes `[slot+0x02]` or `[slot+0x03]` are set. After repopulating the list it re-enters `map_editor_chairman_slot_panel_refresh_slot_counters` at `0x004ca1c0`. Current grounded callers are the panel constructor at `0x004cc2d0` and several message-handler update paths in `0x004cecc0`.","objdump + UI control inspection"
|
||||
|
|
@ -425,10 +553,34 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
|
|||
0x004d4110,32,map_editor_event_variable_values_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Event Variable Values` tracking page in the map-editor control panel. The helper binds the report callback `0x004d38c0` and sits beside the neighboring event-validation page in the active-section page table.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
|
||||
0x004d4130,32,map_editor_event_validation_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side event-validation page in the map-editor control panel. The helper binds the report callback `0x004d3d90`, which checks for missing status or win-lose events and other per-event errors before formatting the result list.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
|
||||
0x00456920,3247,unit_visual_init_weapon_airframe_and_exhaust_effects,bootstrap,thiscall,inferred,ghidra-headless,4,Initializes one armed-unit visual bundle spanning turret and cannon hardware exhaust emitters and aircraft airframe attachments. The routine creates static Turret Mantlet Cannon and MuzzleFlash assets at [this+0x31a] through [this+0x326] direct JetExhaust and PropExhaust sprite emitters at [this+0x2f6] and [this+0x2fa] a cannon-audio attachment at [this+0x32a] indexed WingL and WingR assets plus plane-audio state at [this+0x32e] through [this+0x346] and cached Aileron Elevator Rudder and Thrust vectors at [this+0x2d1] [this+0x2c5] [this+0x2b9] and [this+0x2dd].,ghidra + rizin + llvm-objdump + strings
|
||||
0x0045b120,64,placed_structure_specialization_publish_small_payload_record_from_arg_string,map,thiscall,inferred,objdump + local disassembly + allocator correlation,2,"Small specialization-side publisher beneath the concrete placed-structure table `0x005c8c50`. The helper allocates a fixed `0x35`-byte record through `0x0053b070`, populates that record from the caller-supplied string plus `this` through `0x00553ac0`, and then forwards the resulting pointer into `0x0052d9a0`; on allocation failure it forwards `null` through that same sink. Current local evidence grounds the fixed-size allocation and the arg-string forwarding, but not the exact semantic role of the published record, so this note stays at the payload-record level.","objdump + local disassembly + allocator correlation + specialization-table correlation"
|
||||
0x0045b160,176,placed_structure_specialization_release_transient_handles_and_payload_strings,map,thiscall,inferred,objdump + local disassembly + field-release inspection,3,"Release-side cleanup helper in the concrete placed-structure specialization family. The function sets bit `0` in `[this+0x23a]`, clears `[this+0x24a]`, conditionally tears down the transient handles rooted at `[this+0x256]`, `[this+0x25a]`, `[this+0x25e]`, and `[this+0x24e]` through `0x0045af50`, `0x00475100`, and `0x00418d40`, then re-enters vtable slot `+0x78`, the common placed-structure cleanup slice `0x00455d20`, and finally frees the two payload strings rooted at `[this+0x23e]` and `[this+0x242]` through `0x0053aff0`. This is the strongest current owner for releasing the specialization's transient handles and payload strings rather than a base destructor.","objdump + local disassembly + field-release inspection + cleanup-chain correlation"
|
||||
0x0045b210,352,placed_structure_specialization_build_ambient_transient_from_candidate_payload,map,thiscall,inferred,objdump + local disassembly + string correlation,2,"Transient-build helper beneath the concrete placed-structure specialization table `0x005c8c50`. The function requires a live candidate through vtable slot `+0x80`, formats one payload string around the literal `amb_%1_01.wav` through `0x00518de0`, allocates a `0x141`-byte transient object through `0x0053b070`, initializes that object through `0x00554830`, `0x00554340`, and `0x00554450`, stores the result at `[this+0x24a]`, and registers it through `0x0052da00`. The `amb_%1_01.wav` literal grounds this as one ambient-side transient builder, but not the exact user-facing subtype name of the owning specialization.","objdump + local disassembly + string correlation + transient-build correlation"
|
||||
0x0045b5f0,123,placed_structure_specialization_refresh_ambient_transient_from_current_world_position,map,thiscall,inferred,objdump + local disassembly + world-position correlation,2,"Ambient-transient refresh helper for the same concrete placed-structure specialization. The function resolves the current local position through `0x0052e720`, converts that position through the world or view helpers `0x0051f090` and `0x00534490`, then forwards the derived scalar plus one caller-supplied argument into `placed_structure_specialization_build_ambient_transient_from_candidate_payload` `0x0045b210`. When the resulting ambient transient at `[this+0x24a]` is live it immediately re-enters `0x005543f0(0)`. Current evidence grounds this as a refresh of the ambient-side transient from current world position rather than the primary transient-handle builder.","objdump + local disassembly + world-position correlation + ambient-transient correlation"
|
||||
0x0045b6f0,694,placed_structure_specialization_rebuild_named_variant_descriptors_and_effect_handles,map,thiscall,inferred,objdump + local disassembly + string-table correlation,2,"Large subtype-specific rebuild helper beneath the concrete placed-structure specialization table `0x005c8c50`. The function first clears the optional handles at `[this+0x25a]` and `[this+0x25e]`, then builds and probes multiple named variant families rooted in `[this+0x23e]` through format strings such as `%1_`, `%1_Upgrade1`, `%1_Anim%2.3dp`, `%1_Upgrade1Anim%2.3dp`, and `%1_Upgrade1Light%2.3dp`. It loops over numbered variants `1..0xfe`, probes resource existence through `0x0053c930`, materializes follow-on records through `0x00530640`, publishes them through `0x0052d8a0`, and couples the ambient-side refresh path through `placed_structure_specialization_refresh_ambient_transient_from_current_world_position` `0x0045b5f0` plus the ambient builder `0x0045b210`. The exact subtype semantics remain open, but this is now the strongest current owner for rebuilding the specialization's named animation, light, and sibling effect descriptors rather than a generic serializer-side helper.","objdump + local disassembly + string-table correlation + descriptor-rebuild correlation"
|
||||
0x0045baf0,850,placed_structure_specialization_service_timed_anim_light_and_random_sound_variants,map,thiscall,inferred,objdump + local disassembly + string-table correlation + timer-field inspection,2,"Timed service or emission helper for the same concrete placed-structure specialization. The function updates the two timer-like fields `[this+0x26a]` and `[this+0x266]`, derives local world-grid and distance terms from `[this+0x1e2/+0x1e6/+0x1ea]`, gates on candidate availability through vtable slot `+0x80` and the nearby candidate-side workers `0x00411e10/0x00411e50`, and when the local timing and distance checks pass it formats one output around the literal `rnd_%1_%2.wav` together with the neighboring anim or light string family `%1_Anim%2.3dp`, `%1_Upgrade1Anim%2.3dp`, and `%1_Upgrade1Light%2.3dp`. The final dispatch goes through `0x00531e50` under owner `0x006d402c`. Current evidence is strongest for a timed anim, light, or random-sound variant service lane rather than another payload loader or steady-state scalar updater.","objdump + local disassembly + string-table correlation + timer-field inspection + random-sound correlation"
|
||||
0x0045be50,768,placed_structure_specialization_service_runtime_scalar_and_transient_state,map,thiscall,inferred,objdump + local disassembly + field correlation,2,"Recurring runtime-service helper for the same concrete placed-structure specialization. The function consults transient handle `[this+0x256]`, site-side link `[this+0x75]`, scenario globals under `0x006cec78`, and the iterator pair `0x00556ef0/0x00556f00`; it then updates the derived scalar triplet `[this+0x22e]`, `[this+0x232]`, and `[this+0x236]`, republishes that triplet through `0x00530720`, and re-enters `0x0052e8e0` for the final side-effect. The exact high-level behavior remains open, but the field ownership is strong enough to ground this as the runtime scalar and transient-state service slice for the specialization rather than another serializer or constructor.","objdump + local disassembly + field correlation + service-loop correlation"
|
||||
0x0045c150,448,placed_structure_specialization_load_payload_and_rebuild_transients,map,thiscall,inferred,objdump + local disassembly + serializer-tag correlation,3,"Primary payload-loader counterpart to `0x0045b560` in the concrete placed-structure specialization family. The helper reseeds the derived field band `[this+0x23a..+0x26a]`, re-enters the common placed-structure initializers `0x00455610` and `0x00455fc0`, opens the derived payload bracket tagged `0x5dc1`, reads two string-like payload fields through `0x00531380`, copies them into `[this+0x23e]` and `[this+0x242]` via `0x0051d820`, clears the transient handle roots `[this+0x24e]`, `[this+0x256]`, `[this+0x25a]`, and `[this+0x25e]`, rebuilds follow-on specialization state through `0x0045b5f0` and `0x0045b6f0`, conditionally dispatches vtable slot `+0x74`, reads back `[this+0x24e]` and `[this+0x252]`, and finally closes the bracket tagged `0x5dc2`. This is now the strongest current owner for specialization payload load plus transient rebuild rather than a generic stem-refresh helper.","objdump + local disassembly + serializer-tag correlation + transient-rebuild correlation"
|
||||
0x0045c310,176,placed_structure_specialization_build_primary_transient_handle_from_payload_strings,map,thiscall,inferred,objdump + local disassembly + field correlation,2,"Specialization-side transient builder rooted in payload strings `[this+0x23e]` and `[this+0x242]`. The helper formats one payload around the literal family at `0x005cb5d4`, allocates a `0x23a`-byte object through `0x0053b070`, initializes it through `0x00456100`, stores the handle at `[this+0x246]`, registers it through `0x00530720`, re-enters `0x0045b6f0(1)`, forwards the handle into `0x0052d8a0`, and when the current placed structure is active through `0x004557f0` it also dispatches vtable slot `+0x5c`. This is the strongest current owner for the primary specialization transient-handle build path rather than the ambient-side `[this+0x24a]` builder.","objdump + local disassembly + field correlation + transient-build correlation"
|
||||
0x0045c3c0,160,placed_structure_specialization_release_primary_transient_handle_and_siblings,map,thiscall,inferred,objdump + local disassembly + field-release inspection,2,"Release-side companion to `0x0045c310`. When `[this+0x246]` is live the helper re-enters `0x00455d20`, iterates the linked transient family through `0x00556ef0/0x00556f00`, destroys every sibling object except the current `[this+0x246]` through `0x00530680` and `0x0053b080`, conditionally re-enters `0x0045b6f0(0)` when bit `0` in `[this+0x23a]` is clear, then destroys `[this+0x246]` through `0x00455650`, frees it, clears the field, and tails into `0x005570b0`. Current evidence grounds this as the primary transient-handle release path for the specialization rather than another base cleanup thunk.","objdump + local disassembly + field-release inspection + transient-release correlation"
|
||||
0x004614d0,40,runtime_object_vtable_wrapper_query_local_companion_float_relief_score_at_rounded_coords,map,thiscall,inferred,objdump + local disassembly + wrapper correlation,2,"Tiny virtual-style wrapper over `world_query_local_companion_float_relief_score_at_cell_with_distance_and_mode_bias` `0x0044afa0`. It rounds the current object's normalized secondary and primary coordinates through `0x00455810`, `0x00455800`, and `0x005a10d0`, then forwards the resulting cell pair plus world root `0x0062c120` into `0x0044afa0`. Current evidence grounds it only as the table-local wrapper over the heavier world-scalar query, not the owning subtype name.","objdump + local disassembly + wrapper correlation + world-scalar-query correlation"
|
||||
0x00461500,39,runtime_object_query_flag_byte_0x42_with_class0_true_fallback_when_mode_gate_inactive,map,thiscall,inferred,objdump + local disassembly + mode-gate correlation,2,"Small mode-gated flag query on the same virtual-family boundary as `0x004614d0`. The helper first checks shell mode gate `0x004338c0` on scenario root `0x006cec78`; when that gate is active it returns byte `[this+0x42]` directly. When the gate is inactive it returns literal `1` only for class-0 records with `[this+0x23e] == 0`, and otherwise falls back to the same byte `[this+0x42]`. Current evidence is strong enough only for that structural fallback rule, not for a tighter semantic name for the flag or owning subtype.","objdump + local disassembly + mode-gate correlation + field inspection"
|
||||
0x00461650,120,map_load_geographic_label_database,map,cdecl,inferred,ghidra-headless,3,Loads the geographic-label database branch inside the broader reference-bundle setup. It stages resource ids 0x5209 through 0x520b binds the selected bundle through 0x517d90 iterates the loaded collection with 0x517cf0 0x518380 and 0x518140 and dispatches each record through vtable slot +0x44 using the current map path context.,ghidra + rizin + llvm-objdump + strings
|
||||
0x00461cd0,298,locomotive_collection_select_best_era_matched_non_electric_fallback_id,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + engine-type correlation,2,"Fallback locomotive chooser beneath `company_select_preferred_available_locomotive_id` `0x004078a0`. The helper walks the live locomotive collection, explicitly skips records whose engine-type dword `[record+0x10]` is `2`, and then scores the remaining records from the linked era record at `[record+0x72]`: the current grounded score uses the absolute distance from the current scenario year to the era start field `[era+0x105]`, adds `500` when the era has not started yet, adds `50` when the current year has passed the era-end field `[era+0x109]`, and adds `2000` when the linked approval helper `0x0041d550` rejects the era or engine family for the current context. The lowest-penalty locomotive id wins, so the current best read is an era-matched non-electric fallback rather than a general preferred-locomotive chooser. Current grounded caller is `company_select_preferred_available_locomotive_id` `0x004078a0`.","objdump + caller xrefs + callsite inspection + engine-type correlation + fallback-choice correlation"
|
||||
0x00461e00,262,locomotive_collection_refresh_runtime_availability_overrides_and_usage_state,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Collection-wide runtime refresh over the live locomotive pool at `0x006ada84`. The helper guards itself with reentrancy latch `0x006ada88`, walks every live locomotive record, resolves the linked era record through `[loco+0x72]`, and combines the locomotive-side requirement bytes `[loco+0x30/+0x31/+0x32]` with the active scenario-state availability toggles at `[0x006cec78+0x4c97..+0x4c99]`. When the current locomotive or its linked era passes those gates it upserts one boolean availability override through `scenario_state_upsert_named_locomotive_availability_record_and_refresh_runtime_usage` `0x004350b0`; it then immediately queries the resulting named override through `scenario_state_query_named_locomotive_availability_record_value` `0x00435030` and stores that value into `[loco+0x7b]`. When the collection sweep finishes it tails into `0x00436af0` to rebuild the dependent locomotive-side scalar band. Current grounded callers are the world-entry rehydrate tail inside `world_entry_transition_and_runtime_bringup` `0x00443a50` and the startup or restore-side upsert family that also re-enters this helper through `0x004350b0`, so this is the safest current read for the collection-wide locomotive runtime-availability refresh rather than a single dialog-owned toggle helper.","objdump + caller xrefs + local disassembly + locomotive-availability correlation + scenario-state override correlation + reentrancy-latch correlation"
|
||||
0x00464410,12679,shell_dispatch_ui_command,shell,cdecl,inferred,ghidra-headless,4,Large shell UI command dispatcher reached from shell-side event callbacks and direct command pushes. It switches over many command ids including 0x7530 through 0x7532 graphics-preset commands that route into 0x0051ebc0 0x00484590 and 0x004853c0; 0x7533 through 0x7534 TigerTank viewer actions; and 0x7540 through 0x7543 scenario-text report build and batch-processing commands that route into 0x00489830 0x004886e0 and 0x00489a20.,ghidra + rizin + llvm-objdump + strings
|
||||
0x00474030,167,city_database_entry_build_mode_selected_anchor_helper_from_triplet,map,cdecl,inferred,objdump + caller xrefs + local disassembly + city-database family correlation,2,"Small helper-object builder beneath the current city-database entry family. The function switches over caller-supplied mode enum `0..10`, maps those cases into `0x00475ed0` with selector families `4`, `0xd`, or `0xe` plus fixed scalar constants `0.5`, `0.75`, `1.0`, `1.5`, or `2.0`, and when helper allocation succeeds it publishes the caller-supplied world triplet through the helper-owned pointer at `[helper+0x4]` via `0x00530720`. Current grounded callers are `0x004741ac` during constructor-side setup and `0x004742bd` during refresh, so this is now the strongest current read for the mode-selected anchor-helper builder rather than a generic effect allocator.","objdump + caller xrefs + local disassembly + city-database family correlation + helper-builder correlation"
|
||||
0x00474110,32,city_database_entry_initialize_stack_temporary_entry,map,thiscall,inferred,objdump + caller xrefs + local disassembly + city-database family correlation,2,"Tiny temporary-entry initializer in the city-database entry family. The helper re-enters shared base initializer `0x00455b20`, clears helper fields `[this+0x23a]` and `[this+0x242]`, installs vtable `0x005ce428`, and returns `this`. Current grounded callers are the stack-local temporary-entry paths at `0x004744ae` and `0x004745ae`.","objdump + caller xrefs + local disassembly + city-database family correlation + temp-entry correlation"
|
||||
0x00474130,195,city_database_entry_construct_from_id_coords_mode_and_default_triplet,map,thiscall,inferred,objdump + caller xrefs + local disassembly + city-database family correlation,2,"Primary constructor beneath the current city-database entry family. The helper stores the caller-supplied entry id into `[this+0x23e]`, clears the trailing helper payload block at `[this+0x246..+0x24e]`, stores the caller-supplied mode into `[this+0x242]`, derives one world-height scalar from the supplied coordinate pair through `0x00448bd0`, builds helper field `[this+0x23a]` through `city_database_entry_build_mode_selected_anchor_helper_from_triplet` `0x00474030`, and then seeds the remaining default scalar or flag tuple through `0x00455b70` using the fixed default bundle at `0x005ce49c/0x005ce4a0/0x005ce4a4`. Current grounded caller is the live-entry allocator `0x004744ed`.","objdump + caller xrefs + local disassembly + city-database family correlation + constructor correlation"
|
||||
0x00474260,111,city_database_entry_reload_payload_and_refresh_mode_selected_anchor_helper,map,thiscall,inferred,objdump + caller inspection + local disassembly + city-database family correlation,2,"Refresh-side helper in the current city-database entry family. The function first re-enters `0x00455fc0` on the caller-supplied payload stream, then samples the entry's normalized secondary and primary coordinates through `0x00455810` and `0x00455800`, derives one world-height scalar through the world helper `0x00448bd0`, rebuilds helper field `[this+0x23a]` through `city_database_entry_build_mode_selected_anchor_helper_from_triplet` `0x00474030` using mode `[this+0x242]`, and returns the status from the earlier `0x00455fc0` reload. Current evidence is strongest for a payload reload plus mode-selected anchor-helper refresh rather than a generic constructor.","objdump + caller inspection + local disassembly + city-database family correlation + helper-refresh correlation"
|
||||
0x004743d0,42,city_database_entry_release_mode_selected_anchor_helper_and_base_payload,map,thiscall,inferred,objdump + caller xrefs + local disassembly + city-database family correlation,2,"Release-side helper in the current city-database entry family. The function destroys helper field `[this+0x23a]` through `0x00475100` when live, clears that field, restores the base vtable tag at `[this] = 0x005ce428`, and then tails into base cleanup `0x00455650`. Current grounded callers are the temporary-entry teardown inside `0x004744f6` and the collection load loop at `0x004745d0`, so this is the safest current read for releasing the mode-selected anchor helper plus base payload state.","objdump + caller xrefs + local disassembly + city-database family correlation + release-path correlation"
|
||||
0x00474400,36,city_database_entry_release_mode_selected_anchor_helper_and_dynamic_payload,map,thiscall,inferred,objdump + caller xrefs + local disassembly + city-database family correlation,2,"Sibling release helper beside `0x004743d0`. It destroys helper field `[this+0x23a]` through `0x00475100` when live, clears the field, and then tails into `0x00455d20` rather than the smaller base cleanup at `0x00455650`. Current grounded caller is the collection removal path at `0x00474520`, so the safest current read is a release helper for mode-selected anchor helper plus the heavier dynamic-payload branch.","objdump + caller xrefs + local disassembly + city-database family correlation + removal-path correlation"
|
||||
0x00474430,29,city_database_entry_query_mode_gate_or_runtime_flag_byte_0x42,map,thiscall,inferred,objdump + local disassembly + city-database family correlation,1,"Small city-database-entry-family predicate over byte `[this+0x42]`. When shell mode gate `0x004338c0` is inactive it returns literal `1`; otherwise it returns the current entry byte `[this+0x42]`. The exact player-facing meaning of that byte is still open, so the safest read is a mode-gated runtime-flag query.","objdump + local disassembly + city-database family correlation + mode-gate correlation"
|
||||
0x00474450,39,city_database_entry_collection_construct_with_fixed_capacity_0x14,map,thiscall,inferred,objdump + caller xrefs + local disassembly + collection-layout correlation,2,"Constructor for the current city-database entry collection rooted at vtable `0x005ce4a8`. The helper resets collection state through `0x00517ce0`, installs vtable `0x005ce4a8`, and then initializes the collection through `0x00518570` with the fixed parameter tuple `(0, 0, 0, 0x14, 0x0a, 0, 0)`. Current grounded caller is the global collection bootstrap at `0x004487a9`, which stores the resulting pointer into `0x006cea50`.","objdump + caller xrefs + local disassembly + collection-layout correlation + bootstrap correlation"
|
||||
0x00474480,18,city_database_entry_collection_release_and_free,map,thiscall,inferred,objdump + caller xrefs + local disassembly + collection-layout correlation,1,"Small destructor-side wrapper for the current city-database entry collection. The helper installs collection vtable `0x005ce4a8`, re-enters `0x00518600`, and then tails into `0x00518bd0`. Current grounded caller is the global teardown path at `0x004492c3`, which frees the collection rooted at `0x006cea50`.","objdump + caller xrefs + local disassembly + collection-layout correlation + teardown correlation"
|
||||
0x004744a0,101,city_database_entry_collection_allocate_and_construct_entry,map,thiscall,inferred,objdump + local disassembly + caller xrefs + collection-layout correlation,2,"Shared allocator and constructor beneath the city-database entry collection. The helper initializes one stack-local temporary entry through `0x00474110`, allocates a `0x250`-byte live record through `0x00518900`, resolves that record through `0x00518140`, then constructs it through `0x00474130` with the caller-supplied entry id plus three caller arguments, and finally tears down the temporary entry through `0x004743d0`. Current grounded caller is the collection load or clone lane at `0x004744ed`.","objdump + local disassembly + caller xrefs + collection-layout correlation + temp-entry correlation"
|
||||
0x00474510,32,city_database_entry_collection_remove_entry_by_id_and_release,map,thiscall,inferred,objdump + local disassembly + collection-layout correlation,2,"Small collection-side removal helper for the current city-database entry family. The function resolves the caller-supplied entry id through `0x00518140`, releases the resolved entry through `0x00474400`, and then removes the id from the collection through `0x00518a30`.","objdump + local disassembly + collection-layout correlation + removal-path correlation"
|
||||
0x00474540,197,city_database_entry_collection_load_records_from_bundle_context,map,thiscall,inferred,objdump + caller xrefs + local disassembly + collection-load correlation,2,"Underlying collection-owned load loop beneath `map_load_city_database` `0x00474610`. The helper opens tag family `0x61a9/0x61aa/0x61ab` on the caller-supplied bundle, binds the selected path context through `0x00518680`, iterates every live record in the current collection, seeds a stack-local temporary entry through `0x00474110`, dispatches each record's vtable slot `+0x40` with the current bundle context, accumulates the returned byte count, tears the temporary entry down through `0x004743d0`, and finally closes tag `0x61ab`. Current grounded caller is the map-load branch at `0x00444834`, so this is now the safest current read for the collection-owned city-database record load loop.","objdump + caller xrefs + local disassembly + collection-load correlation + bundle-tag correlation"
|
||||
0x00474610,120,map_load_city_database,map,cdecl,inferred,ghidra-headless,3,Loads the city database branch in the same pattern as the geographic-label loader. It stages resource ids 0x61a9 through 0x61ab binds the selected bundle through 0x517d90 iterates the collection with 0x517cf0 0x518380 and 0x518140 and dispatches each record through vtable slot +0x44.,ghidra + rizin + llvm-objdump + strings
|
||||
0x00474e20,336,effect_slot_create_attached_sprite_emitter,bootstrap,thiscall,inferred,ghidra-headless,3,Creates or clones one attached sprite emitter for an effect slot on the owning object. Depending on flag bit 0x400 it either clones through 0x00556ce0 or allocates a fresh 0x1fd template through 0x00556920 then attaches the emitter to the owner at [emitter+0x60] and optionally sets persistent flag [emitter+0xbc].,ghidra + rizin + llvm-objdump
|
||||
0x00474f70,97,effect_slot_update_attached_sprite_emitters,bootstrap,thiscall,inferred,ghidra-headless,3,Advances every sprite emitter stored in one effect-slot container by iterating its pointer list and calling 0x00555e50 with update mode zero. When the caller passes null it instead walks the global linked slot list rooted at 0x006cea74.,ghidra + rizin + llvm-objdump
|
||||
|
|
@ -445,10 +597,13 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
|
|||
0x0047e620,112,placed_structure_get_nth_candidate_id_with_local_service_metrics,map,thiscall,inferred,objdump + caller xrefs + local disassembly + callsite inspection,3,"Resolves the `n`th live structure candidate that currently produces a valid local service-metric result for the current placed-structure or site context. The helper walks the full candidate collection at `0x0062ba8c`, resolves each entry id through `0x00518380`, reuses `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`, and decrements the caller-supplied ordinal only on successful matches before returning the surviving candidate id. Current grounded callers keep this firmly on the read-side: `shell_station_detail_refresh_candidate_service_rows` `0x00505760` uses it to enumerate the visible service rows, while `company_rebuild_linked_transit_autoroute_site_score_cache` `0x00407bd0` uses it to walk the bounded candidate-local amount and scaling bands that feed the downstream site-ranking cache. That makes this the ordinal selector sibling above the local service-metric query rather than a mutation-side helper.","objdump + caller xrefs + local disassembly + callsite inspection + station-row correlation + company-score-cache correlation"
|
||||
0x0047eb90,1048,placed_structure_refresh_candidate_local_service_comparison_cache_against_peer_site,map,thiscall,inferred,objdump + caller xrefs + local disassembly + callsite inspection,3,"Rebuilds one per-candidate local service comparison cache for a `(current site, peer site)` pair. The helper resolves both sites' linked placed instances through `0x00455f60`, scans the full candidate collection at `0x0062ba8c`, filters candidates through `0x0041e260` plus `placed_structure_query_candidate_local_service_metrics` `0x0047e240`, and then computes several bounded float bands in three stack-local `0x35`-entry arrays before blending the result back into the caller-owned cache at `[this+0x3e]`, `[this+0x112]`, and `[this+0x1e6]`. The grounded caller at `0x004adcf5` immediately follows this rebuild by reading directional route-summary state through `0x0047de50` and `0x0047de90`, which keeps this helper on the comparison or preview side of the site-service family rather than the mutation side.","objdump + caller xrefs + local disassembly + callsite inspection + peer-site comparison correlation + route-summary correlation"
|
||||
0x0047f910,1080,placed_structure_select_best_candidate_id_by_local_service_score,map,thiscall,inferred,objdump + caller xrefs + local disassembly + callsite inspection,3,"Selects the strongest candidate id for the current placed-structure or site context under one caller-supplied candidate-class filter. The helper scans the live candidate collection at `0x0062ba8c`, keeps only candidates allowed by `0x0041e260`, and scores each survivor through either the direct local-service query `0x0047e240` or the heavier directional-route helper `0x0047e690` when route-backed state is present. It then applies the current shell or world-mode gates from `0x006cec74`, `0x006cec78`, and `0x006cec7c`, tracks the best candidate id and one parallel winner flag, and optionally writes the selected id or winner-state back through caller-owned out-pointers. Current grounded callers at `0x004ac8d6` and `0x004ac917` use it as a best-candidate selector inside a larger service-summary or preview family, which keeps it on the read-side selection path rather than the mutation path.","objdump + caller xrefs + local disassembly + callsite inspection + route-helper correlation + shell-gate correlation"
|
||||
0x0047dda0,83,placed_structure_linked_route_entry_dispatch_primary_or_secondary_vfunc_if_anchor_slots_empty,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Linked-peer route-entry dispatcher beneath the placed-structure linked-site maintenance family. The helper reads route-entry anchor id `[this+0x08]` from the caller-supplied linked peer, resolves that anchor through the live route-entry collection `0x006cfca8`, and then re-enters `0x0048a090` with stack flag `1`. Only when that gate reports false does it dispatch one of two route-entry vtable calls on the resolved route-entry object: stack flag nonzero takes vtable `+0x4`, stack flag zero takes vtable `+0x8`. Current grounded callers are the paired placed-structure helpers `0x0040dba0` and `0x0040dbf0`, so this is the safest current read for the narrower linked-peer route-entry state dispatcher rather than a route builder.","objdump + caller xrefs + local disassembly + linked-route-entry-dispatch correlation"
|
||||
0x0047fd50,60,placed_structure_is_station_or_transit_site_class,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Boolean class allowlist over one linked placed-structure record. The helper resolves the linked peer id at `[this+0x04]` through the live placed-structure collection `0x0062b26c`, re-enters that peer's candidate vtable `+0x80`, reads candidate class byte `[candidate+0x8c]`, and returns true only for class values `0`, `1`, or `2`; values `3`, `4`, and anything above `4` fail. Current grounded callers include the linked-transit company cache family at `0x00408280`, `0x00408f70`, and `0x004093d0`, the `cargo id 0` bypass branch inside the placed-structure sweep at `0x00452e60`, the nearby-site bucket builder `0x0047fdb0`, the linked-transit reachability gate `0x004801a0`, and the linked-site display-name or route-anchor refresh at `0x00480bb0`, so this is the safest current read for the narrower station-or-transit class gate rather than a route-reachability helper.","objdump + caller xrefs + callsite inspection + candidate-class correlation"
|
||||
0x0047e690,784,placed_structure_query_candidate_directional_route_overlay_summary,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Builds the heavier directional route-summary channel used by the station-detail candidate-service overlay when the active candidate carries a nonzero route-style byte at `[candidate+0x46]`. The helper converts one caller-supplied distance or bucket limit into a capped step count up to `0x28`, resolves the requested candidate's grouped routing class from `0x0062ba8c+0x9a`, then walks the current placed structure's linked route list at `[this+0x466]` and follows each route-linked placed structure through the live instance collections at `0x0062b26c` and the route-link collection `0x006ada90`. For matching class entries it re-enters `0x004676a0` to measure one directional route value against the peer placed-structure argument, keeps the strongest bounded values in a sorted local lane, and finally accumulates those kept route values into the caller-owned out-pointers. Current grounded overlay callers at `0x0043f89a` and `0x0043f8ee` invoke it in both directions between the preview station and each scanned placed structure before `world_render_station_candidate_service_map_overlay` turns those two returned channels into the `Coming To` and `Going From` legend rows.","objdump + caller xrefs + callsite inspection + overlay-caller correlation + legend-correlation + route-link-collection correlation"
|
||||
0x0047d440,845,world_conditionally_seed_named_starting_railroad_companies,map,cdecl,inferred,objdump + caller xrefs + global-state inspection,4,"Conditional company-side setup helper adjacent to the `Setting up Players and Companies...` lane. Current grounded callers are the neighboring bring-up flow after world_seed_default_chairman_profile_slots at `0x004377a0` and a second setup-side branch around `0x00438300`, both under the same sandbox or non-editor shell-state conditions: it runs only when the Multiplayer preview dataset owner at `0x006cd8d8` is absent and either sandbox flag `[0x006cec7c+0x82]` is set or shell-state flag `[0x006cec74+0x14c]` is set while editor-map mode `[0x006cec74+0x68]` is clear. The helper first realigns the selected company from the chosen chairman profile when the current summary pair points at a missing company, then iterates exactly three fixed localized railroad-name ids through `0x00428420`: `0x23f` `Missouri Pacific`, `0x240` `New York Central`, and `0x241` `Grand Trunk Railroad` from `RT3.lng` ids `575..577`. That makes the branch look like a seeded trio of named starting railroad companies rather than a generic company refresh. The first seeded company is tied to the selected chairman-profile summary from `0x006cec78`, tuned from that selected chairman's per-profile fields `[profile+0x154]` and `[profile+0x158]`, and then written back as the selected company id through `0x00433790`. The second company is narrower now too: it only binds when `profile_collection_count_active_chairman_records` at `0x00477820` reports at least two live chairman records, and it then links through `profile_collection_get_nth_active_chairman_record` at `0x00477860` with ordinal `1`, so the second railroad is specifically the second active chairman-owned company rather than an arbitrary extra bind. The third railroad currently gets no matching chairman-link branch in the grounded code and therefore remains an unchaired named company in the live roster. All three records are constructed or refreshed from the live company collection at `0x0062be10` through `0x00428420`, while chairman-to-company ownership links are applied through `0x00427c70` and neighboring writes to `[profile+0x1dd]`. The tail is tighter now too: once at least three startup companies have been considered, the branch at `0x0047d6de` re-enters `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with trigger kind `7`.","objdump + caller xrefs + global-state inspection + state-accessor correlation + RT3.lng strings + company-constructor inspection + profile-helper inspection + runtime-effect trigger-kind correlation"
|
||||
0x0047efe0,28,placed_structure_query_linked_company_id,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Returns the owning company id for one placed structure when a linked placed-instance record is present. The helper resolves `[this+0x04]` through the live placed-instance collection at `0x0062b26c` and then returns the company-like field at `[instance+0x276]`; when no linked instance is present it falls back to `0`. Current grounded callers include the station candidate-service overlay at `0x0043fff7`, where the returned company id is compared against the active company selector before the overlay chooses whether a scanned site should carry the `Already Connected by Another Company` note.","objdump + caller xrefs + callsite inspection + overlay-owner correlation"
|
||||
0x0047f010,195,placed_structure_append_unique_route_entry,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Appends one unique six-byte route-entry record onto the placed-structure route list rooted at `[this+0x462]` and `[this+0x466]`. The helper first scans the existing list for the incoming leading `u16` key and returns early on duplicates; otherwise it allocates a new `(count*6)+6` byte buffer, copies the existing records, writes the new `u16` key at offset `+0x0` and the caller-supplied `u32` payload at `+0x2`, frees the previous buffer, and increments the route-entry count. Current grounded callers include the placed-structure side at `0x0042c554`, which walks the linked instance chain through `[site+0x0d6]` and `[instance+0x2a2]` while appending entries, and the world-side branch at `0x0040db7d`, which appends one selected placed-structure id plus a companion payload from a route-like table. This is therefore the current reusable append-if-missing helper above the route-entry list later consumed by `placed_structure_query_candidate_directional_route_overlay_summary` at `0x0047e690`.","objdump + caller xrefs + callsite inspection + buffer-layout correlation"
|
||||
0x0048a090,65,route_entry_has_any_bound_anchor_slot_pair_or_triplet,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Small boolean gate over one route-entry record. With caller flag `0`, the helper returns true when either route-entry dword `[this+0x206]` or `[this+0x20a]` is not `-1`; with caller flag nonzero, it only returns false when all three dwords `[this+0x206]`, `[this+0x20a]`, and `[this+0x20e]` equal `-1`. Current grounded callers include the linked-peer route-entry dispatcher `0x0047dda0`, the placed-structure rebuild lane inside `0x0040ef10`, several linked-site route-anchor refresh branches around `0x00480603/0x00480927/0x00480993/0x00480be5`, the route builder family near `0x0049bbf2/0x0049d5a8/0x0049dc50/0x0049ded9`, and one later shell-side branch at `0x0050de1a`. This is therefore the safest current read for a route-entry anchor-slot occupancy gate rather than a placement or cargo predicate.","objdump + caller xrefs + local disassembly + route-entry-anchor-slot correlation"
|
||||
0x00483f70,352,shell_service_pump_iteration,shell,thiscall,inferred,objdump + analysis-context,4,Executes one outer shell-service iteration on the shell state rooted at 0x006cec74. The helper can queue service event 0xcc through the shell bundle at 0x006d4018 polls that bundle through 0x00483ea0 refreshes active-mode or shell-state flags ensures the controller work pointer [0x006d4024+0x28] defaults to 0x0062be68 runs several global maintenance helpers and auxiliary cleanup then dispatches shell_state_service_active_mode_frame; when shell-state flag [this+0x501] is set it also marks the controller layout dirty through 0x0051f070 before returning the loop-continue result. bootstrap_init_shell_window_services calls it in the repeating shell loop that appears to own the observed shell lifetime before teardown.,objdump + analysis-context + caller xrefs
|
||||
0x00485750,14,shell_has_tiger_tank_viewer,shell,cdecl,inferred,ghidra-headless,4,Returns whether the dedicated TigerTank shell viewer object at 0x006cfc8c is currently active. The 0x7533 open and 0x7534 close commands both gate on this global before showing status text or mutating viewer state.,ghidra + rizin + llvm-objdump + strings
|
||||
0x004840e0,863,bootstrap_init_shell_window_services,bootstrap,cdecl,inferred,ghidra-headless,4,Consumes the early bootstrap object then allocates and installs the shell service bundle rooted at 0x006d4024 seeds a 640x480 fallback and enters the bootstrap-owned shell loop around shell_service_pump_iteration at 0x00483f70 until shell state [this+0x10] changes; after each break it drives the next shell mode transition through 0x00482ec0 and when the shell lifetime finally ends it tears the shell bundle back down through 0x00521390 before returning to app_bootstrap_main.,ghidra + rizin + llvm-objdump
|
||||
|
|
@ -469,6 +624,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
|
|||
0x00489830,496,scenario_text_export_report_language_file,scenario,cdecl,inferred,ghidra-headless,3,Opens one existing MAPS\\%s.lng file for the selected map and reports on its parsed contents without rebuilding it. The routine loads the file into memory iterates numbered entries through 0x00488540 formats summary strings through 0x004895c0 and presents success or failure dialogs when interactive mode is enabled.,ghidra + rizin + llvm-objdump + strings
|
||||
0x00489a20,1085,scenario_text_export_batch_process_maps,scenario,cdecl,inferred,ghidra-headless,4,Enumerates maps\\*.gmp and batch-processes every scenario through the scenario-text export branch. Command 0x7542 runs the build path through 0x004886e0 while command 0x7543 runs the report path through 0x00489830; the wrapper tracks progress formats per-map status strings and emits a final summary dialog.,ghidra + rizin + llvm-objdump + strings
|
||||
0x004bfb30,956,shell_format_company_financial_summary_card,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Reusable shell company financial-summary formatter shared by `CompanyDetail.win` and the company-list row lane. The helper resolves the linked chairman and current selected profile through `0x006cec78` and `0x006ceb9c`, highlights the card when the company belongs to the selected chairman, formats the visible company header text, and then renders a compact three-row finance block under localized ids `633` `Cash:`, `607` `Revenue:`, and `925` `Profits:`. The grounded metric mapping is now tighter too: `Cash:` comes from `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` with slot `0x0d` and stat-family selector `0x2329`, `Revenue:` comes from the same reader with slot `0x2c`, and `Profits:` comes from slot `0x2b`; the revenue and profit rows also switch color when the readback is negative. Grounded callers are `shell_company_detail_render_company_summary_card` at `0x004c1ab0` and `shell_company_list_format_company_or_start_row` at `0x004c6b40`.","objdump + RT3.lng strings + caller inspection + shared shell formatter correlation + compact-metric-row correlation"
|
||||
0x004c5540,347,shell_company_detail_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `CompanyDetail.win` panel later published at `0x006cfe4c`. The constructor installs vtable `0x005d0858`, binds `CompanyDetail.imb` and `CompanyDetail.win` through `0x0053d110` and `0x0053fa50`, seeds the primary action controls `0x9470`, `0x9471`, `0x947d`, `0x947e`, `0x948c`, `0x948d`, and `0x948e` through callbacks `0x004c1730`, `0x004c1ab0`, `0x004c1ec0`, `0x004c22e0`, `0x004c1d70`, and `0x004c1d30`, stores the singleton resources at `0x006cfe50..0x006cfe58`, and then immediately repopulates the visible state through `shell_company_detail_window_refresh_controls` at `0x004c2ca0`. One negative boundary is useful too: current constructor-time binding still does not install dedicated per-row callbacks for the broader section-0 governance bands `0x94d4..0x9537` and `0x9538..0x959b`, which keeps those rows looking more like resource-defined display bands gated and restyled by the refresh pass than like individually code-rendered widgets. A grounded shell detail-manager caller reaches this constructor at `0x004dde24`, which corrects the earlier assumption that the post-roster company branch still had no recovered detail-window owner.","objdump + strings + detail-manager correlation + caller inspection + constructor-binding absence correlation"
|
||||
0x004c0160,2214,shell_format_company_stock_data_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Shared shell stock-data formatter used by `LoadScreen.win` page `6`. The helper resolves the selected company through the live collection at `0x0062be10`, builds the section headers `928` `Largest Shareholders`, `929` `Shares`, and `930` `Per Share Data`, ranks the top positive active-chairman holdings for that company through the profile collection at `0x006ceb9c`, and renders up to four shareholder rows with the current share counts from `[profile + company_id*4 + 0x15d]`. It then formats the full six-row per-share block: help texts `931..936` and labels `937..942`, with `Share Price` from stat-family `0x2329/0x1c`, `Book Value Per Share` from `0x2329/0x1d`, `Revenue Per Share` from `0x2329/0x1e`, `Earnings Per Share` from `0x2329/0x1f`, `Dividend Per Share` from `0x2329/0x20`, and `5 Year Weighted Return` from `0x2329/0x21` via `company_compute_five_year_weighted_shareholder_return` `0x004246b0`. Current grounded caller is `shell_load_screen_render_company_stock_data_panel` at `0x004e5130`.","objdump + RT3.lng strings + caller inspection + shareholder-ranking correlation + stock-data-label correlation + per-share-metric correlation + weighted-return correlation"
|
||||
0x004c1610,48,shell_company_detail_bind_bond_row_band_for_active_panel,shell,cdecl,inferred,objdump + caller inspection,4,"Tiny CompanyDetail helper that binds one contiguous debt-row control band to whichever bond panel is active. When the source control id is `0x947e` it enables the upper row band `0x94e8..0x950f`; otherwise it enables the sibling row band `0x9510..0x9537`. Current grounded owner is the CompanyDetail refresh path at `0x004c2ca0`, where this helper sits beside the shared bond readout callback for controls `0x947d` and `0x947e` and makes those two controls read as twin bond-slot list owners rather than as one-off buttons.","objdump + caller inspection + bond-row-band correlation"
|
||||
0x004c16b0,35,shell_company_detail_copy_selected_company_debt_slot_triplet,shell,cdecl,inferred,objdump + caller inspection,3,"Small CompanyDetail helper that copies one 12-byte triplet from the currently selected company's debt-record band near `[company+0x5f + slot*0xc]` into a caller-supplied output buffer. Current grounded callers use it while building the bond maturity and repay readout lane and the adjacent action-message debt checks.","objdump + caller inspection + debt-slot correlation"
|
||||
|
|
@ -496,7 +652,6 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
|
|||
0x004c5140,544,shell_company_detail_handle_change_dividend_rate_dialog_message,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Custom message callback for the `CompanyDetail.win` change-dividend dialog. The helper handles shell message `0xcb` from the paired adjust controls `0x99e8` and `0xc0f9`, raises or lowers the staged dividend-per-share value in `0x006cfe48`, clamps decrements at zero, and clamps increments against the board-approved per-share ceiling from `company_compute_board_approved_dividend_rate_ceiling` at `0x00426260`. When the player tries to raise the dividend beyond that ceiling it opens localized id `991` `Your board of directors feels that the company is not financially strong enough for a higher dividend...` through the shared modal path instead of accepting the increase. Current grounded caller is `shell_company_detail_change_dividend_rate_flow` at `0x004c5360`, which passes this helper as the dialog message owner into `0x004c98a0`.","objdump + RT3.lng strings + caller inspection + dividend-dialog message correlation + dividend-ceiling correlation"
|
||||
0x004c5360,472,shell_company_detail_change_dividend_rate_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` dividend-rate action flow. The helper seeds the current dividend-per-share value from `[company+0x4b]` into `0x006cfe48`, opens the shared finance dialog rooted at callbacks `0x004c4c70`, `0x004c4e30`, and `0x004c5140` under localized ids `988` through `990`, and then commits the accepted new dividend rate through the selected-company method at `0x00423fb0`. When the multiplayer-side shell owner is active the same request is packaged through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded caller is `shell_company_detail_window_handle_message` at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + dividend-dialog correlation"
|
||||
0x004c2ca0,1964,shell_company_detail_window_refresh_controls,shell,thiscall,inferred,objdump + strings + caller inspection,4,"Shared refresh pass for the shell-side `CompanyDetail.win` family rooted at `0x006cfe4c`. The helper first requires a live shell detail-panel owner at `0x006d0818` with a selected company id in `[detail+0x90]`, resolves that company through the live collection at `0x0062be10`, and then repopulates the section strip and section-specific control bands rooted at `0x9472..0x9490`. Current grounded state is keyed by section index `0x006cfe60`: section `0` is the chairman/governance slice around `0x9480` and the dynamic multi-line overview widget `0x947f`, section `1` is the debt-and-capital slice around `0x947d`, `0x947e`, and `0x9488`, section `2` is the per-share slice around `0x948a`, and section `3` is the territory-access slice around `0x948c`, `0x948d`, and `0x948e`. The same refresh now cleanly splits the four visible section selectors `0x9472..0x9475` from their companion visual controls `0x9476..0x9479`, keeps the adjacent section-navigation or decoration bands around `0x947b..0x947c` and `0x948f..0x9490` synchronized with the current section, and formats the current chairman summary through localized ids `958` `Chairman: %1` and `959` `Chairman: None` together with the portrait-backed chairman band on `0x9480`. The section-0-only bind for `0x947f` is tighter now too: the refresh passes a dedicated stack-built dynamic-text payload through the special `0x6f` control path instead of using the normal callback-widget lane, and the shared helpers `shell_control_refresh_matching_dynamic_text_payload` at `0x00540a47` plus `shell_control_release_dynamic_text_payload` at `0x005639d2` now show that type `0x6f` frees or swaps one heap-backed text payload and then short-circuits as a special case. That keeps `shell_format_company_governance_and_economy_status_panel` at `0x004e5cf0` as the strongest current semantic match for `0x947f` while making the widget itself look more clearly like a display-only dynamic-text control rather than a normal callback widget. One wider action-row split is tighter now that the range loops are explicit: the helper walks `0x94d4..0x9537` as the selected-company-owned governance/action band and applies style `0x65` when the selected company matches the scenario-selected company at `0x00434870`, otherwise `0x87`; it then walks `0x9538..0x959b` as the linked-chairman-owned band and applies style `0x87` when the selected company's linked chairman id `[company+0x3b]` matches the scenario-selected chairman at `0x004337b0`, otherwise `0x65`. The selected-company side is no longer one vague gated block either: scenario-state toggle `[0x006cec78+0x4a8f]` re-enables bankruptcy row `0x94d6` together with passive companion row `0x94d4`, `[0x006cec78+0x4a8b]` re-enables issue-bond row `0x94d7` together with passive companion row `0x94d5`, `[0x006cec78+0x4a87]` re-enables stock issue and stock buyback rows `0x94d8..0x94d9`, `[0x006cec78+0x4a93]` re-enables dividend row `0x94da` together with the same passive companion row `0x94d5`, `[0x006cec78+0x4adb]` re-enables merger row `0x94db`, `[0x006cec78+0x4acb]` re-enables resign row `0x94dc`, and `[0x006cec78+0x4acf]` re-enables takeover row `0x9538`; `0x9493` only re-enables when editor-map mode `[0x006cec74+0x68]` is clear. That makes `0x94d4/0x94d5` read more like passive companion or heading widgets than hidden verbs. The constructor at `0x004c5540` and many message-side branches at `0x004c56a0` converge back into this helper, which makes it the current owner-side refresh pass for the CompanyDetail window rather than a generic company-list helper.","objdump + strings + caller inspection + section-switch correlation + chairman-band correlation + governance-band gating correlation + selected-company styling correlation + dynamic-overview-widget correlation + passive-companion-row gating correlation + scenario-toggle correlation + explicit-row-loop correlation + type-0x6f control correlation"
|
||||
0x004c5540,347,shell_company_detail_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `CompanyDetail.win` panel later published at `0x006cfe4c`. The constructor installs vtable `0x005d0858`, binds `CompanyDetail.imb` and `CompanyDetail.win` through `0x0053d110` and `0x0053fa50`, seeds the primary action controls `0x9470`, `0x9471`, `0x947d`, `0x947e`, `0x948c`, `0x948d`, and `0x948e` through callbacks `0x004c1730`, `0x004c1ab0`, `0x004c1ec0`, `0x004c22e0`, `0x004c1d70`, and `0x004c1d30`, stores the singleton resources at `0x006cfe50..0x006cfe58`, and then immediately repopulates the visible state through `shell_company_detail_window_refresh_controls` at `0x004c2ca0`. One negative boundary is useful too: current constructor-time binding still does not install dedicated per-row callbacks for the broader section-0 governance bands `0x94d4..0x9537` and `0x9538..0x959b`, which keeps those rows looking more like resource-defined display bands gated and restyled by the refresh pass than like individually code-rendered widgets. A grounded shell detail-manager caller reaches this constructor at `0x004dde24`, which corrects the earlier assumption that the post-roster company branch still had no recovered detail-window owner.","objdump + strings + detail-manager correlation + caller inspection + constructor-binding absence correlation"
|
||||
0x004c56a0,4228,shell_company_detail_window_handle_message,shell,thiscall,inferred,objdump + strings + caller inspection,4,"Primary message dispatcher for the shell-side `CompanyDetail.win` family rooted at vtable `0x005d0858`. The helper switches on the incoming shell message id and now has a grounded section-selector lane too: message `0xca` on controls `0x9472..0x9475` writes `control-0x9472` into section index `0x006cfe60` before re-entering `shell_company_detail_window_refresh_controls` `0x004c2ca0`. Its broader action band is now tighter as well. Under message `0xcb`, control `0x94b5` routes into `shell_company_detail_buy_territory_access_rights_flow` `0x004c5fc9`, `0x94b6` routes into `shell_company_detail_bankruptcy_flow` `0x004c5b99`, `0x94cf` routes into `shell_company_detail_issue_bond_offer_flow` `0x004c3890`, `0x94d0` routes into `shell_company_detail_issue_stock_offer_flow` `0x004c3f30`, `0x94d1` routes into `shell_company_detail_buyback_stock_flow` `0x004c46d0`, `0x94d2` routes into `shell_company_detail_change_dividend_rate_flow` `0x004c5360`, `0x9493` routes into the destructive company-clear helper `company_deactivate_and_clear_chairman_share_links` `0x00426d60`, `0x94d6` routes into `shell_company_detail_bankruptcy_flow` `0x004c5b99`, `0x94d7` routes into `shell_company_detail_issue_bond_offer_flow` `0x004c3890`, `0x94d8` routes into `shell_company_detail_issue_stock_offer_flow` `0x004c3f30`, `0x94d9` routes into `shell_company_detail_buyback_stock_flow` `0x004c46d0`, `0x94da` routes into `shell_company_detail_change_dividend_rate_flow` `0x004c5360`, `0x94db` routes into `shell_company_detail_attempt_merger_flow` `0x004ec640`, `0x94dc` routes into `shell_company_detail_resign_chairmanship_flow` `0x004c5a0e`, and `0x9538` routes into `shell_company_detail_attempt_chairmanship_takeover_flow` `0x0050ccc0`. The same `0xcb` jump table now makes the passive/action split explicit rather than inferred: in the dispatch byte map rooted at `0x004c6640`, offsets `0x4b..0x51` for controls `0x94d6..0x94dc` map to cases `0x06..0x0c`, offset `0xad` for control `0x9538` maps to case `0x0d`, and the neighboring companion rows `0x94d4` and `0x94d5` stay on the default `0x0e` path. The debt-side row bands are narrower now too: under the same `0xcb` path, controls `0x94e8..0x950f` and `0x9510..0x9537` resolve a selected debt-slot index beneath the two bond panels `0x947d` and `0x947e`, reject repayment when the selected slot's principal exceeds the current cash-side metric through localized id `2990`, otherwise open the localized early-repayment confirmation rooted at id `2991`, and on acceptance either commit through `company_repay_bond_slot_and_compact_debt_table` `0x00423d70` or package the same request through the multiplayer shell transport. The same dispatcher also now bounds most of the section-0 control cluster: control `0x948b` is a tutorial-guarded escape or back control that either shows localized id `3724` `This option is disabled in the tutorial.` or falls back to `0x004ddbd0`, controls `0x9491` and `0x9492` only restyle the paired visual controls `0x948f` and `0x9490`, and control `0x9494` opens localized id `3635` `Enter the amount that your company's cash should be` through the shell numeric-entry dialog family and then writes the accepted value into the selected company cash pair at `[company+0x11f7]` and `[company+0x11fb]`. Current `0xcb` dispatch does not treat `0x948f`, `0x9490`, `0x94d4`, or `0x94d5` as standalone action cases, and the refresh-side gates now sharpen that split further: `0x94d4` is the passive companion row that comes back beside bankruptcy `0x94d6`, while `0x94d5` is the passive companion row that comes back with the issue-bond/dividend side of the finance cluster `0x94d7` and `0x94da`. The remaining open section-0 control is therefore mainly `0x947f`, plus the still-unsplit render-side text rows inside the broader governance bands `0x94d4..0x9537` and `0x9538..0x959b`. It repeatedly converges back into `shell_company_detail_window_refresh_controls` after state changes. Current grounded evidence is enough to treat this as the real company-detail owner path, while the remaining uncertainty has narrowed to the last section-0 summary binding and deeper governance-row semantics rather than the ownership of the action lanes themselves.","objdump + strings + caller inspection + jump-table correlation + section-selector correlation + debt-row-band correlation + cash-edit dialog correlation + tutorial-guard correlation + governance-band companion-row correlation + passive-companion-row gating correlation + control-jump-table byte-map correlation"
|
||||
0x004c5a0e,268,shell_company_detail_resign_chairmanship_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` resignation confirmation flow. The branch opens localized confirmation id `964` `Are you sure you want to resign the chairman's position?` and on acceptance commits the change through `company_clear_selected_chairman_if_current_profile` at `0x00428a10`. When the multiplayer-side shell owner is active it packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8` instead of mutating the company immediately. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + dialog correlation"
|
||||
0x004c5b99,428,shell_company_detail_bankruptcy_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` bankruptcy action flow. The branch checks the localized cooldown and eligibility strings `965` through `967`, rejects requests when the selected company is not yet bankruptable, and on acceptance commits the change through `company_declare_bankruptcy_and_halve_bond_debt` at `0x00425a90`. When the multiplayer-side shell owner is active it packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8` instead of mutating the company immediately. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + bankruptcy-dialog correlation"
|
||||
|
|
@ -608,8 +763,53 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
|
|||
0x004dc7e0,11,shell_mark_file_options_dialog_dirty,shell,cdecl,inferred,objdump + nearby-constructor correlation + frame-caller inspection,4,"Tiny dirty-latch setter paired with `shell_has_file_options_dialog`. The helper stores `1` into `0x006d07fc`, which current nearby call patterns treat as the `fileopt.win` refresh or service request latch once the shared file-options dialog exists. Current grounded caller is the same post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`.","objdump + nearby-constructor correlation + frame-caller inspection + fileopt correlation"
|
||||
0x004dc7f0,477,shell_file_options_dialog_handle_message,shell,thiscall,inferred,objdump + strings,4,Handles the fileopt.win command flow and selects exactly one downstream branch before the shared detail-panel completion dispatcher runs. Successful commands dismiss the dialog then set 0x006d07f8 for the load or restore side 0x006d07ec for the save or package side or 0x006d07f0 for the sibling settings-window escape. The settings branch gates on shell_has_settings_window at 0x004fe120 and lazily opens the shared SettingsWindow.win object through 0x00501e50 while sibling branches show prerequisite dialogs when the requested file operation is not currently allowed.,objdump + strings + caller xrefs
|
||||
0x004dd010,890,shell_file_request_dialog_collect_target_path,shell,cdecl,inferred,objdump + strings,4,"Builds the modal filerqst.win request dialog and resolves one chosen target path back into the caller buffer. The helper treats dialog modes 0 1 2 3 and 11 as save-side requests and the paired modes 4 8 9 and 10 as load-side requests then swaps the button and prompt text between localized ids 249 250 and 251 252. On success it appends one extension from the static mode table at 0x005f3d58 where 0 or 8=.gms 1 or 9=.gmc 2 or 10=.gmx 3 or 4=.gmp and 11=.gmt. Current neighboring callers tighten that last mode too: the normal shell map coordinators use the `.gms/.gmc/.gmx/.gmp` families for scenario and editor flows, while save mode 11 is only consumed by the auxiliary `.gmt` preview-surface branch shared with the side owner at 0x006cd8d8. When a live runtime world is already active through 0x004839b0 the helper overrides that non-runtime table and appends .smp instead, which makes it the shared bridge between the broad shell coordinators and the runtime-state serializer or restore path rather than only a generic filename prompt.",objdump + strings + mode-table inspection + caller correlation
|
||||
0x004ddbd0,1096,shell_detail_panel_transition_manager,shell,thiscall,inferred,objdump + analysis-context,3,Transitions the shell detail-panel controller rooted at 0x006d0818 between many window or panel states tracked in [this+0x8c] with optional selection ids cached at [this+0x78] through [this+0x90]. The manager tears down the prior child panel at [this+0x88] through 0x004dd950 updates selector or status UI through 0x004dd410 conditionally opens helper windows such as EditorPanel.win through 0x004d4500 and then allocates one of many shell-facing detail windows including TrainDetail.win TrainList.win and neighboring panel objects before publishing the new child through the shell runtime at 0x006d401c. shell_transition_mode reaches this manager on one branch but the current evidence keeps it on the shell-detail path rather than the first gameplay-world-entry coordinator.,objdump + analysis-context + strings
|
||||
0x004dd630,144,shell_detail_panel_publish_mode_group_selector_event,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small post-switch helper beneath the shell detail-panel controller at `0x006d0818`. The helper reads current mode dword `[this+0x8c]`, classifies modes `6..0x1a` through the local byte table at `0x004dd6ec`, and then publishes one grouped selector event id `0x09`, `0x16`, `0x0c`, `0x15`, `0x02`, `0x08`, or fallback `0x01` through `0x0053f000` on the shared shell presenter rooted at `0x00ccbb20`. Current grounded caller is the detail-panel transition manager tail at `0x004ddfec`, where it runs after the old child has been torn down, the new child has been published, and the selector/status refresh helpers have already run. This is therefore the safest current read for the detail-panel mode-group publisher rather than a standalone control callback.","objdump + caller inspection + local disassembly + mode-group correlation + shell-presenter correlation"
|
||||
0x004ddbd0,1096,shell_detail_panel_transition_manager,shell,thiscall,inferred,objdump + strings + caller inspection + case-table correlation,4,"Primary transition owner for the shell detail-panel controller rooted at `0x006d0818`. The helper tracks current mode in `[this+0x8c]`, current child at `[this+0x88]`, and optional selection ids cached in `[this+0x78]` through `[this+0x90]`. On every mode or subject change it first special-cases current mode `0x19`, updates or preserves cached selection ids, tears down the old child through `0x004dd950`, releases one shared global iteration root through `0x004557b0`, publishes the replacement child through the shell runtime at `0x006d401c`, refreshes selector or status UI through `0x004dd410`, re-enters the shared shell follow-on `0x004d44f0`, and finally pushes one grouped selector event through `0x004dd630`. The case table is now tighter too: current grounded constructor branches include `CompanyDetail.win` `0x004c5540`, `CompanyList.win` `0x004c7200`, `LoadScreen.win` `0x004e3a80` side-family siblings, `BuildingDetail.win` `0x004b81d0`, `Bulldoze.win` `0x004b8720`, `ChangeHeight.win` `0x004bcb50`, `ChangeTrees.win` `0x004bcdd0`, `Overview.win` `0x004f5020`, `PaintRegion.win` `0x004f54d0`, `PaintSound.win` `0x004f5670`, `PaintTerrain.win` `0x004f7ce0`, `PaintTerritory.win` `0x004fcf30`, `StockBuy.win` `0x0050c290`, `TrackLay.win` `0x0050e400`, `TrainDetail.win` `0x00514420`, and `StationDetail.win` `0x005068c0`, together with the helper-window ensure path for `EditorPanel.win` `0x004d4500`. The same-mode refresh branch is bounded now too: when the requested mode matches the current mode, the helper still reruns `0x004dd410` and `0x004d44f0`, keeps the mode-`8` company-side refresh special case through `0x004c2ca0`, keeps the mode-`9` `Overview.win` side refresh through `0x004f4970`, and preserves the mode-`2` branch that re-enters `0x00514410`. Current direct callers now include the world-surface brush mode buttons at `0x004bc87a..0x004bc918`, the `LoadScreen.win` row-click detail handoff lanes, and the broader shell state transition side around `0x00482ec0`, so this is the current safest read for the real shell detail-window and tool-window transition owner rather than a generic mode switch wrapper.","objdump + strings + caller inspection + case-table correlation + same-mode refresh correlation"
|
||||
0x004dfbe0,393,shell_game_window_construct,shell,thiscall,inferred,objdump + strings + caller xrefs,4,"Constructs the shell-side `Game.win` detail window published at `0x006d0818`. The constructor seeds vtable `0x005d0eb8`, binds the `Game.win` resource through `0x0053fa50`, stores the singleton, creates the primary control strip rooted at ids `0x74`, `0x7d1`, `0x7d2`, `0x7d7`, `0x7f9`, `0x804`, `0x833`, and `0x837`, mirrors runtime booleans from `0x006cec7c+0x82`, `0x006cec74+0x2c3/+0x283`, and the active mode object at `0x006cec78`, and serves as the broad world-facing shell panel above the sibling `GameMessage.win` helper. `shell_transition_mode` now grounds this as its mode-`1` constructor family, while `0x004dfd70` is the paired old-mode teardown path and `0x004dfdf0` ensures the standalone `GameMessage.win` overlay on entry.","objdump + strings + caller xrefs + branch correlation"
|
||||
0x004f5020,96,shell_overview_window_construct_and_seed_selection,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `Overview.win` window. The constructor installs vtable `0x005d13b4`, binds `Overview.win` through `0x0053fa50`, seeds live singleton `0x006d12f0`, initializes selection fields `[this+0x78/+0x7c]` to `-1`, clears companion global `0x006d12d4`, and then immediately re-enters `0x004f4970` with the current overview selection id from `0x006d12d8`. Current grounded caller is the detail-panel manager branch at `0x004dde47`, which keeps this on the shell detail-window side rather than the later world-side overview consumers that only test the singleton's presence.","objdump + strings + detail-manager correlation + singleton correlation + selection-seed correlation"
|
||||
0x004f5080,67,shell_paint_region_window_select_ordinal_and_refresh_caption,shell,thiscall,inferred,objdump + message-owner inspection + caption-table correlation,4,"Small setter beneath the shell-side `PaintRegion.win` family. The helper stores the requested ordinal in `[this+0x78]`, reads one float caption value through table `0x006226e8`, formats that caption through `0x0051f070` and `0x00527de0` on presenter `0x006d4024`, and returns without touching the broader control strips. Current grounded caller is the message owner `0x004f52c0`, where control band `0x4651..0x4657` forwards through this helper before the main refresh pass.","objdump + message-owner inspection + caption-table correlation + shell-presenter correlation"
|
||||
0x004f50d0,55,shell_paint_region_window_destroy,shell,thiscall,inferred,objdump + detail-manager teardown correlation,4,"Destructor-side wrapper for the shell-side `PaintRegion.win` family. The helper restores vtable `0x005d13f8`, re-enters the shared presenter-side destroy tail through `0x00523e20`, and when live world mode already equals `0x10` it also replays `0x00453510` before tail-calling the common shell-object teardown `0x0053f7d0`. Current grounded caller is the detail-panel transition manager teardown branch at `0x004ddbd0`, which keeps this on the shell tool-window side rather than the later region-service helpers.","objdump + detail-manager teardown correlation + world-mode branch correlation"
|
||||
0x004f5110,432,shell_paint_region_window_refresh_control_bands,shell,thiscall,inferred,objdump + constructor correlation + message-owner inspection,4,"Owner-side refresh pass for the shell-side `PaintRegion.win` family. The helper first restyles the seven ordinal controls `0x4651..0x4657` from `[this+0x78]` and the 24-entry region row band `0x4664..0x467b` from `[this+0x80]`, then resolves the live region collection at `0x0062bae0` and repopulates the dynamic-text rows `0x46c8..0x46df`. Each row uses the special type-`0x6f` control path through `0x00540120`, derives its label from the region entry at `0x00518140`, and formats the paired summary metrics through localized ids `0x00e6` and the numeric formatter family `0x0051b700/0x005193f0`. Current grounded callers are the constructor `0x004f54d0` and the message owner `0x004f52c0`, which makes this the current `PaintRegion.win` refresh owner rather than a world-region rebuild helper.","objdump + constructor correlation + message-owner inspection + dynamic-text control correlation + region-collection correlation"
|
||||
0x004f52c0,512,shell_paint_region_window_handle_message,shell,thiscall,inferred,objdump + constructor correlation + caller inspection,4,"Primary message dispatcher for the shell-side `PaintRegion.win` tool window. Under message `0xc8`, controls `0x4664..0x467b` update the current region row in `[this+0x80]` and global `0x006226e0`, then immediately route the world-side tool state through `0x00450520` when live world mode is `0x10` or through `0x00452fa0` with mode id `0x10` otherwise before re-entering `shell_paint_region_window_refresh_control_bands` `0x004f5110`. Controls `0x4651..0x4657` update the ordinal lane through `shell_paint_region_window_select_ordinal_and_refresh_caption` `0x004f5080`, then store the ordinal in global `0x006226e4` and refresh. Control `0x07d6` owns the shared world-surface latch `[this+0x7c]`; while that latch is live, the helper hit-tests through `0x00448ac0`, resolves the current ordinal value through table `0x006226e8`, and forwards the staged world coordinates plus the current region row through `0x0044a320` before mirroring the row pointer back through `0x00450520` or `0x00452fa0`. Current grounded owner correlation is the constructor `0x004f54d0` and the live shell message flow, which keeps this on the `PaintRegion.win` tool-window side of the shared world-surface family.","objdump + constructor correlation + caller inspection + world-surface latch correlation + tool-state dispatch correlation"
|
||||
0x004f54d0,224,shell_paint_region_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `PaintRegion.win` tool window. The constructor installs vtable `0x005d13f8`, binds `PaintRegion.win` through `0x0053fa50`, seeds the live singleton from globals `0x006226e0..0x006226e8`, refreshes the visible selection band through `0x004f5110`, and then routes the initial world-side tool state through `0x00450520` or `0x00452fa0` depending on current world mode `0x10`. Current grounded caller is the detail-panel manager branch at `0x004ddf6a`, which keeps this on the shell tool-window side rather than the later world-side region or route families.","objdump + strings + detail-manager correlation + singleton correlation + tool-state dispatch correlation"
|
||||
0x004f55b0,67,shell_paint_sound_window_select_family_and_refresh_caption,shell,thiscall,inferred,objdump + message-owner inspection + caption-table correlation,4,"Small setter beneath the shell-side `PaintSound.win` family. The helper stores the requested sound-family ordinal in `[this+0x78]`, reads one caption value through table `0x0062270c`, and formats that caption through `0x0051f070` and `0x00527de0` on presenter `0x006d4024`. Current grounded caller is the message owner `0x004f57a0`, where control band `0x1195..0x119b` forwards through this helper before the main refresh pass.","objdump + message-owner inspection + caption-table correlation + shell-presenter correlation"
|
||||
0x004f5600,102,shell_paint_sound_window_refresh_control_bands,shell,thiscall,inferred,objdump + constructor correlation + message-owner inspection,4,"Small owner-side refresh pass for the shell-side `PaintSound.win` family. The helper restyles the seven family controls `0x1195..0x119b` from `[this+0x78]` and the five subordinal controls `0x119e..0x11a2` from `[this+0x7c]`, republishing each row through `0x00540120` with the selected-vs-unselected style split `0x87/0x65`. Current grounded callers are the constructor `0x004f5670` and the message owner `0x004f57a0`, which keeps this as a shell-side control refresh rather than a world ambient-service helper.","objdump + constructor correlation + message-owner inspection + control-band correlation"
|
||||
0x004f5670,224,shell_paint_sound_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `PaintSound.win` tool window. The constructor installs vtable `0x005d1424`, binds `PaintSound.win` through `0x0053fa50`, seeds the current sound-family ordinal and subordinal from globals `0x00622704..0x0062270c`, stores the live singleton at `0x006d12fc`, refreshes the visible row bands through `0x004f5600`, and then routes the initial world-side tool state through `0x00450520` or `0x00452fa0` depending on current world mode `0x11`. Current grounded caller is the detail-panel manager branch at `0x004ddfa2`, which keeps this on the shell tool-window side rather than the later world-side sound or ambient subsystems.","objdump + strings + detail-manager correlation + singleton correlation + tool-state dispatch correlation"
|
||||
0x004f5750,65,shell_paint_sound_window_destroy,shell,thiscall,inferred,objdump + detail-manager teardown correlation,4,"Destructor-side wrapper for the shell-side `PaintSound.win` family. The helper restores vtable `0x005d1424`, re-enters the shared presenter-side destroy tail through `0x00523e20`, clears the companion global latch `0x006cfe18`, and when live world mode already equals `0x11` it also replays `0x00453510` before tail-calling the common shell-object teardown `0x0053f7d0`. Current grounded caller is the detail-panel transition manager teardown branch at `0x004ddbd0`, which keeps this on the shell tool-window side rather than the later sound-preview consumers.","objdump + detail-manager teardown correlation + companion-global clear correlation + world-mode branch correlation"
|
||||
0x004f57a0,426,shell_paint_sound_window_handle_message,shell,thiscall,inferred,objdump + constructor correlation + caller inspection,4,"Primary message dispatcher for the shell-side `PaintSound.win` tool window. Under message `0xc8`, controls `0x1195..0x119b` update the family ordinal through `shell_paint_sound_window_select_family_and_refresh_caption` `0x004f55b0`, store the ordinal in global `0x00622704`, and then refresh through `0x004f5600`. Controls `0x119e..0x11a2` update the paired subordinal in `[this+0x7c]` and global `0x00622708`, then either dispatch immediately through `0x00452fa0` with mode id `0x11` or mirror back through `0x00450520` when the live world mode already equals `0x11`. Control `0x07d6` owns the shared world-surface latch `[this+0x80]`; while that latch is live, the helper hit-tests through `0x00448ac0`, resolves the current family caption value through `0x0062270c`, and forwards the staged world coordinates plus the current subordinal through `0x0044a0e0` before refreshing the live world-side tool state. Current grounded owner correlation is the constructor `0x004f5670` and the active shell message loop, which keeps this on the `PaintSound.win` side of the shared world-surface family rather than the later sound-preview callback band.","objdump + constructor correlation + caller inspection + world-surface latch correlation + tool-state dispatch correlation"
|
||||
0x004f5960,138,shell_paint_terrain_window_set_primary_scalar_slot_and_refresh_label,shell,cdecl,inferred,objdump + constructor correlation + callback registration correlation,4,"Numeric callback beneath the shell-side `PaintTerrain.win` family for the first four-scalar strip rooted at controls `0x2922..0x2925`. The helper converts the incoming integer payload into a normalized float, stores the result into global lane table `0x00622728`, formats the corresponding label text through `0x0051b700`, and republishes the text into the paired dynamic-text controls `0x292c..0x292f` through type `0x6f` on callback root `0x006d1334`. Current grounded owner is the terrain-window constructor `0x004f7ce0`, which registers this callback directly through `0x00540120`.","objdump + constructor correlation + callback registration correlation + scalar-table correlation"
|
||||
0x004f59f0,138,shell_paint_terrain_window_set_secondary_scalar_slot_and_refresh_label,shell,cdecl,inferred,objdump + constructor correlation + callback registration correlation,4,"Numeric callback beneath the shell-side `PaintTerrain.win` family for the second four-scalar strip rooted at controls `0x2936..0x2939`. The helper mirrors `0x004f5960`: it converts the incoming integer payload into a normalized float, stores the result into global lane table `0x00622738`, formats the corresponding label text through `0x0051b700`, and republishes that text into the paired dynamic-text controls `0x2940..0x2943` through type `0x6f` on callback root `0x006d1334`. Current grounded owner is the terrain-window constructor `0x004f7ce0`, which registers this callback directly through `0x00540120`.","objdump + constructor correlation + callback registration correlation + scalar-table correlation"
|
||||
0x004f5a80,423,shell_paint_terrain_window_push_undo_snapshot,shell,thiscall,inferred,objdump + constructor correlation + message-owner caller correlation,4,"Terrain-window local undo or snapshot push helper. The routine copies the current primary raster from `[this+0x114]` into the next snapshot slot under `[this+0x11c]`, captures four sibling render-target buffers from the live render root `0x0062c120` into the parallel snapshot band `[this+0x144]`, and increments the local stack depth `[this+0x1e4]` up to a bounded ten-entry ring. When the stack is already full it rotates the stored snapshot pointers and then copies the current buffers into the last slot instead. Current grounded callers are the terrain-window constructor `0x004f7ce0` and the larger terrain message owner `0x004f6f50`, which keeps this on the shell-side preview or undo family rather than the world-side raster mutation path.","objdump + constructor correlation + message-owner caller correlation + snapshot-ring correlation"
|
||||
0x004f5c30,188,shell_paint_terrain_window_pop_undo_snapshot,shell,thiscall,inferred,objdump + message-owner caller correlation + snapshot-ring correlation,4,"Terrain-window local undo or snapshot pop helper. When the bounded snapshot depth `[this+0x1e4]` is positive, the routine decrements that depth, restores the saved primary raster back into `[this+0x114]`, resizes the live render root through `0x0051f090/0x00534730`, and then restores the four sibling render-target buffers from the parallel snapshot band `[this+0x144]`. Current grounded callers are the terrain-side dispatcher `0x004f6a60` and the larger terrain message owner `0x004f6f50`, where control `0x2775` routes into this helper as the current explicit undo affordance.","objdump + message-owner caller correlation + snapshot-ring correlation + undo-control correlation"
|
||||
0x004f5cf0,224,shell_paint_terrain_window_publish_active_scalar_caption,shell,thiscall,inferred,objdump + constructor correlation + caller inspection,4,"Shared terrain-window caption publisher for the currently active scalar lane. The helper latches the requested scalar index into `[this+0x98]`, selects one current source value either from the fixed scalar global `0x006227b4` or from one of the per-mode float tables `0x006227ac`, `0x006227c8`, `0x006227e4`, `0x00622800`, and `0x0062281c`, and then formats the resulting caption through `0x0051f070/0x00527de0` on presenter `0x006d4024`. Current grounded callers are the terrain-window constructor `0x004f7ce0`, the terrain mode setter `0x004f6b50`, and the larger terrain message-owner refresh tail near `0x004f6f20`.","objdump + constructor correlation + caller inspection + scalar-caption correlation"
|
||||
0x004f5dd0,25,shell_paint_terrain_window_select_active_scalar_group_and_refresh_caption,shell,thiscall,inferred,objdump + direct body inspection + message-owner caller correlation,4,"Tiny selector helper beneath the shell-side `PaintTerrain.win` family. The helper stores the caller-supplied scalar-group ordinal into `[this+0x8c]`, swaps the current active caption index `[this+0x98]` into the stack argument slot, and then tail-calls `shell_paint_terrain_window_publish_active_scalar_caption` `0x004f5cf0`. Current grounded caller is the direct terrain message-owner branch at `0x004f7500`, which keeps this on the shell-side selector and caption family rather than the world-side raster brush path.","objdump + direct body inspection + message-owner caller correlation + caption-selector correlation"
|
||||
0x004f5ea0,27,shell_paint_terrain_window_is_mode5_variant2,shell,thiscall,inferred,objdump + direct body inspection + caller correlation,4,"Tiny predicate beneath the shell-side `PaintTerrain.win` family. The helper returns true only when current terrain mode `[this+0x90]` equals `5` and the paired variant lane `[this+0x94]` equals `2`; otherwise it returns false. Current grounded callers are the mode-dispatch bridge `0x004f6250` and the larger path-preview compositor `0x004f8bb0`, which keeps this on the terrain special-mode gating family rather than any direct world-side raster mutation path.","objdump + direct body inspection + caller correlation + special-mode predicate correlation"
|
||||
0x004f5ec0,27,shell_paint_terrain_window_is_mode4_variant2,shell,thiscall,inferred,objdump + direct body inspection + caller correlation,4,"Tiny predicate beneath the shell-side `PaintTerrain.win` family. The helper returns true only when current terrain mode `[this+0x90]` equals `4` and the paired variant lane `[this+0xb4]` equals `2`; otherwise it returns false. Current grounded caller is the message-owner branch at `0x004f784b`, which uses this as one narrow terrain special-mode gate before entering the heavier preview path.","objdump + direct body inspection + caller correlation + special-mode predicate correlation"
|
||||
0x004f5df0,675,shell_paint_terrain_window_refresh_control_bands,shell,thiscall,inferred,objdump + constructor correlation + message-owner caller correlation,4,"Broad owner-side refresh pass for the shell-side `PaintTerrain.win` family. The helper republishes the active terrain mode strip `0x28dd..0x28e6`, several adjacent selector bands rooted at `0x27d9`, `0x283d`, `0x28a1`, `0x28d3`, `0x290d`, `0x2913`, `0x2915`, `0x2917`, `0x291f`, and `0x2954`, the current mode-dependent summary labels around `0x291a`, `0x296a`, and `0x296b`, and the three paired scalar rows `0x2a38..0x2a3d` plus the four dynamic rows rooted at `0x292c`. The same pass also propagates the current color preview from `[this+0x80]`, the current mode selector from `[this+0x90]`, and the cached mode-specific scalar lanes `[this+0x94]..[this+0xc8]`. Current grounded callers are the constructor `0x004f7ce0`, the terrain-side dispatcher `0x004f6a60`, the terrain mode setter `0x004f6b50`, and the larger message owner `0x004f6f50`, which keeps this on the shell-side control-band family rather than the world raster brush path.","objdump + constructor correlation + message-owner caller correlation + control-band correlation"
|
||||
0x004f6070,326,shell_paint_terrain_window_set_rgb_component_and_refresh_preview,shell,cdecl,inferred,objdump + constructor correlation + callback registration correlation,4,"Numeric callback beneath the shell-side `PaintTerrain.win` family for the three RGB-style component controls rooted at `0x294c`, `0x294e`, and `0x2950`. The helper formats the incoming integer payload through localized ids `0x00df`, `0x00e0`, or `0x00e1` depending on the triggering control id, writes the resulting component byte back into global byte strip `0x006d1300..0x006d1302`, composes the preview color dword at `[0x006d1334+0x80]`, and republishes both the dynamic text row and the color preview control `0x296a`. Current grounded owner is the terrain-window constructor `0x004f7ce0`, which registers this callback directly through `0x00540120`.","objdump + constructor correlation + callback registration correlation + color-preview correlation"
|
||||
0x004f61c0,144,shell_paint_terrain_window_increment_generation_count_and_refresh_caption,shell,cdecl,inferred,objdump + callback registration correlation + counter-caption correlation,3,"Small terrain-window callback that increments the current generation or count lane at `[0x006d1334+0xc4]`, mirrors that same value into global `0x0062275c`, formats the new 1-based count through `0x0051b700/0x005193f0` with localized id `0x00e2`, and republishes the result into dynamic-text control `0x290c`. This helper sits on the same callback-root family as the other `PaintTerrain.win` numeric updaters, but the current constructor slice does not yet ground the exact triggering control id.","objdump + callback registration correlation + counter-caption correlation"
|
||||
0x004f6250,309,shell_paint_terrain_window_dispatch_current_mode_to_world,shell,thiscall,inferred,objdump + caller inspection + mode-constant correlation,4,"Mode-dependent world-dispatch helper beneath the shell-side `PaintTerrain.win` family. The helper reads current terrain mode `[this+0x90]` and forwards one matching world-mode request through `0x00452fa0`, currently including constants `0x18`, `0x19`, `0x1a`, `0x1c`, `0x1d`, and `0x2c`, with one fallback path gated through `0x004f5ea0`. When no explicit dispatch is needed it optionally replays the current world-side refresh through `0x00453510` if the caller requested it. Current grounded callers are the terrain mode setter `0x004f6b50`, the larger terrain message owner `0x004f6f50`, and the current brush-state refresh tails that need to mirror the selected shell mode back into world state.","objdump + caller inspection + mode-constant correlation + world-dispatch correlation"
|
||||
0x004f6390,920,shell_paint_terrain_window_refresh_mode_panels,shell,thiscall,inferred,objdump + constructor correlation + repeated caller correlation,4,"Broad terrain-window mode-panel refresh owner. The helper repaints the current grouped mode selectors and availability strips rooted at `0x2711`, `0x27d9`, `0x283d`, `0x28a1`, `0x28d3`, `0x290d`, `0x2913`, `0x2915`, `0x2917`, `0x291f`, and `0x29cd`, toggles the mode families `0x28ab..0x28b4` and `0x28ae..0x28b0`, refreshes current scalar or color readouts under `0x291a`, `0x296a`, and `0x296b`, and repositions three callback-backed rows `0x2a3b..0x2a3d` from the paired coordinate band `[this+0xd8..+0xec]`. It also gates several row styles through the current mode state `[this+0x8c/+0x90/+0x94..+0xc0]`, the helper predicates `0x005586c0` and `0x004f5ea0`, and the live world mode at `0x0062c120+0x2175`. Current grounded callers are the terrain constructor `0x004f7ce0`, the terrain mode setter `0x004f6b50`, the terrain-side dispatcher `0x004f6a60`, and many direct message-owner subbranches under `0x004f6f50`.","objdump + constructor correlation + repeated caller correlation + control-band correlation + mode-panel correlation"
|
||||
0x004f6930,161,shell_paint_terrain_window_sample_primary_raster_at_world_coords,shell,thiscall,inferred,objdump + caller inspection + field-layout correlation,4,"World-coordinate sample helper beneath the shell-side `PaintTerrain.win` family. The routine converts the caller-supplied world-space float pair into integer sample coordinates by scaling against live world dimensions `[0x0062c120+0x2155/+0x2159]` and the current preview-raster dimensions `[this+0xfc/+0x100]`, clamps those indices against the current primary preview buffer, and on success returns the sampled dword from `[this+0x114]`; otherwise it returns `0`. Current grounded callers are the direct terrain message-owner color-preview branch at `0x004f7186` and the neighboring shell-side setup branch at `0x004deb7b`, so the safest current read is the current preview-raster sampler rather than a direct world-cell query.","objdump + caller inspection + field-layout correlation + preview-raster correlation"
|
||||
0x004f69e0,148,shell_paint_terrain_window_set_triplet_scalar_and_refresh_label,shell,cdecl,inferred,objdump + constructor correlation + callback registration correlation,4,"Numeric callback beneath the shell-side `PaintTerrain.win` family for the three-entry scalar strip rooted at controls `0x2a32..0x2a34`. The helper formats the incoming integer payload through the shared terrain template at `0x005d0b18`, republishes the resulting label through the dynamic-text control immediately above the triggering control id, stores the raw integer into the paired triplet state under callback root `0x006d1334`, and then refreshes the live mode panels through `0x004f5df0` when the constructor-side bulk-update latch `0x006d1330` is clear. Current grounded owner is the terrain-window constructor `0x004f7ce0`, which registers this callback directly through `0x00540120`.","objdump + constructor correlation + callback registration correlation + bulk-update-latch correlation"
|
||||
0x004f6b50,991,shell_paint_terrain_window_select_mode_and_refresh,shell,thiscall,inferred,objdump + constructor correlation + caller inspection,4,"Primary mode-selector setter for the shell-side `PaintTerrain.win` family. The helper writes the requested terrain mode into `[this+0x90]`, repaints the ten-entry mode strip rooted at `0x28dd`, normalizes paired selector state under `[this+0x8c]` for modes `3` and `8`, toggles several mode-specific row bands, refreshes the grouped terrain panels through `0x004f6390`, dispatches the selected mode back into world state through `0x004f6250(1)`, and finally republishes the active scalar caption through `0x004f5cf0([this+0x98])`. Current grounded callers are the terrain constructor `0x004f7ce0`, the direct message-owner subbranch at `0x004f7525`, and several later message-owner update paths, which keeps this on the shell-side terrain mode family rather than the later world brush implementation itself.","objdump + constructor correlation + caller inspection + mode-strip correlation + world-dispatch correlation"
|
||||
0x004f6f50,3075,shell_paint_terrain_window_handle_message,shell,thiscall,inferred,objdump + constructor correlation + local disassembly + control-family correlation,4,"Primary message owner for the shell-side `PaintTerrain.win` family. The function grounds three top-level message lanes directly from the body: message `2` owns live world-surface control `0x07d6`, message `0xca` owns the bulk selector and callback-backed control strips, and message `0xcb` currently routes explicit undo control `0x2775` into `shell_paint_terrain_window_pop_undo_snapshot` `0x004f5c30`. Under the main `0xca` lane, the grounded control families are tighter now: `0x2711..0x2730` update the current grouped selector and cached mode ordinal, `0x27d9..0x27df` update the paired terrain-family row, `0x283d..0x2843` select the active scalar caption through `0x004f5cf0`, `0x28a1..0x28e6` fan into the cached mode or scalar lanes rooted at `0x006d1308..0x006d1328` and `0x00622748..0x0062276c`, `0x2915..0x291e` toggle several mode-dependent booleans and dispatch one world-mode subset, `0x2964..0x2967` dispatch world modes `0x20..0x23`, and `0x29cd..` updates the current brush-radius family in `[this+0xa8]` and global `0x00622758`. The live drag branch under control `0x07d6` is tighter too: after hit-testing through `0x00448ac0`, it updates the current preview color through `shell_paint_terrain_window_sample_primary_raster_at_world_coords` `0x004f6930`, routes the staged coordinates into the heavier preview workers `0x004fb5e0`, `0x004fc280`, `0x004fc4d0`, or `0x004fc630` depending on current terrain mode, and then mirrors the resulting preview or world update back through `0x00452f20`, `0x00452fa0`, `0x00453510`, and the shell-surface publish path. Current grounded owner correlation is the constructor `0x004f7ce0` plus the active shell message loop, which keeps this on the `PaintTerrain.win` side of the shared brush family rather than the later world raster mutation owners themselves.","objdump + constructor correlation + local disassembly + control-family correlation + drag-latch correlation + preview-worker correlation"
|
||||
0x004f7ce0,304,shell_paint_terrain_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `PaintTerrain.win` tool window. The constructor installs vtable `0x005d1430`, binds `PaintTerrain.win` through `0x0053fa50`, carries the adjacent `GroundTerrain.tga` resource in the same family, seeds live shell singleton `0x006d1304`, seeds the callback-side root `0x006d1334`, marks tool bytes `0x006d1330/0x006d1331`, snapshots the current terrain mode, selector, scalar, and color lanes from globals `0x00622748..0x00622788` and `0x006d1308..0x006d1324`, builds the local undo or snapshot ring through `0x004f5a80`, seeds the current mode through `0x004f6b50`, and registers the numeric callback family `0x004f5960`, `0x004f59f0`, `0x004f6070`, and `0x004f69e0` through `0x00540120`. Current grounded caller is the detail-panel manager branch at `0x004ddf4e`, and the later world-side secondary-raster owner still only consumes `[0x006d1304+0x78/+0x7c]` as one pending component-seed pair, so the safest current read remains the shell paint-terrain window constructor rather than a direct world raster owner.","objdump + strings + detail-manager correlation + singleton correlation + tool-state snapshot correlation + callback-registration correlation"
|
||||
0x004f81e0,400,shell_paint_terrain_window_blend_descriptor_palette_sample_into_preview_pixel,shell,thiscall,inferred,objdump + caller inspection + local disassembly + descriptor-blend correlation,4,"Late preview helper beneath the shell-side `PaintTerrain.win` family. The helper resolves one live preview pixel at `[this+0x114]` from the caller-supplied preview-space `(x,y)` coordinate, resolves one matching descriptor-raster pixel from the current terrain descriptor surface `[this+0x1fc]` by re-quantizing the caller-supplied world-grid coordinate through `[this+0x1e8/+0x1f0/+0x1f4]`, and then linearly blends the two BGRA pixels channel-by-channel with the caller-supplied float weight before writing the result back into the live preview raster. Current grounded caller is the late path-preview phase at `0x004fb081` inside `shell_paint_terrain_window_rasterize_drag_path_preview_into_preview_surface` `0x004f8bb0`, which keeps this on the descriptor-overlay preview family rather than the direct world raster mutation path.","objdump + caller inspection + local disassembly + descriptor-blend correlation + preview-pixel correlation"
|
||||
0x004f8370,1024,shell_paint_terrain_window_smooth_interior_preview_pixel_from_neighbor_samples,shell,thiscall,inferred,objdump + caller inspection + local disassembly + smoothing correlation,4,"Late preview smoothing helper beneath the shell-side `PaintTerrain.win` family. The helper requires one interior preview-space `(x,y)` cell, gathers the surrounding preview-raster bytes from `[this+0x114]` in the local 3x3 neighborhood, repeatedly averages paired channel bytes through the fixed `0.5` weight at `0x005c8d48`, and then writes the resulting smoothed BGRA pixel back into the live preview raster. Current grounded caller is the final interior sweep at `0x004fb0f4` inside `shell_paint_terrain_window_rasterize_drag_path_preview_into_preview_surface` `0x004f8bb0`, which keeps this on the shell-side preview-smoothing family rather than the world-side terrain raster path.","objdump + caller inspection + local disassembly + smoothing correlation + preview-raster correlation"
|
||||
0x004f8770,570,shell_paint_terrain_window_sample_weighted_average_rgb_from_preview_raster,shell,thiscall,inferred,objdump + caller inspection + local disassembly + color-sampling correlation,4,"Local color-sampling helper beneath the shell-side `PaintTerrain.win` family. The helper selects one source raster from the current path-preview buffer `[this+0x118]`, the top undo snapshot under `[this+0x118 + depth*4]`, or the live preview raster `[this+0x114]`, derives one bounded square neighborhood around the caller-supplied preview-space coordinates from scalar lane `[this+0xc4]`, and then accumulates distance-weighted red, green, and blue byte sums across every sampled pixel in that neighborhood. When the accumulated weight stays positive it normalizes those sums through `0x005a10d0` and returns the averaged RGB bytes through three caller-supplied output pointers. Current grounded callers are the two later mode-`9` preview branches at `0x004f9fde` and `0x004fc097`, which keeps this on the shell-side terrain color-sampling family rather than the world-side raster mutation path.","objdump + caller inspection + local disassembly + color-sampling correlation + preview-buffer correlation"
|
||||
0x004f89b0,512,shell_paint_terrain_window_grow_component_on_byte_grid_from_seed,shell,cdecl,inferred,objdump + caller inspection + local disassembly + flood-fill correlation,4,"Local byte-grid component grower beneath the shell-side `PaintTerrain.win` family. The helper seeds the caller-supplied byte grid with state `2` at the requested `(x,y)` cell, repeatedly promotes reachable `2` cells to `3`, expands that frontier through the eight-neighbor offset tables `0x00624b28/0x00624b48`, and marks any newly reached byte-`1` cells as `2` while tracking the surviving min/max rectangle of the connected component. After the frontier exhausts it clears every remaining byte-`1` cell back to `0`, leaving only the grown component marked. Current grounded caller is the preview-raster rebuild worker `0x004fb76c`, which invokes this helper after quantizing one float seed point into preview-grid coordinates, so the safest current read is a local connected-component grower for the terrain preview mask rather than a generic world flood fill.","objdump + caller inspection + local disassembly + flood-fill correlation + byte-grid correlation"
|
||||
0x004f8bb0,10800,shell_paint_terrain_window_rasterize_drag_path_preview_into_preview_surface,shell,thiscall,inferred,objdump + caller inspection + local disassembly + preview-raster correlation,4,"Primary path-preview compositor beneath the shell-side `PaintTerrain.win` family. The helper consumes the drag-sample strip rooted at `[this+0xf0/+0xf4/+0xf8]`, the current scalar or mode lanes `[this+0x8c/+0x90/+0x94/+0x98/+0xa0/+0xb4/+0xb8/+0xc0/+0xc4/+0xd8..+0xec]`, and several caller-supplied preview buffers, then derives one bounded preview-space rectangle, quantizes the current brush span into preview-space radii, and allocates several temporary float and byte grids for path blending. Within that bounded rectangle it evaluates multiple per-mode preview branches: some modes reuse the current terrain descriptor tables rooted at `0x005f3500`, later mode `9` branches call `shell_paint_terrain_window_sample_weighted_average_rgb_from_preview_raster` `0x004f8770`, one path grows connected regions through `shell_paint_terrain_window_grow_component_on_byte_grid_from_seed` `0x004f89b0`, and other branches sample the live world raster through `0x00448cb0`, `0x00448d40`, `0x00449ab0`, `0x0044a9a0`, and companion helpers before writing final RGBA pixels back into the caller preview surface. The late world-raster tail is tighter now too: the mode-`4`, variant-`2` branch toggles secondary-raster byte-2 bit `0x20` by comparing the current and previous cell records through `0x00534f40`; the broader mode-`4/5` branch samples class set `2/4/5` through `0x00534ec0`, re-enters `0x0044de30` and `0x0044df10`, latches pending world coordinates into `[0x006d1304+0x78/+0x7c]`, and updates the low nibble plus the signed overlay-vector planes through `0x00448df0`, `0x00448e20`, `0x00448ec0`, `0x00448ee0`, `0x00448e60`, and `0x00448e90`. After the optional mode-`5` smoothing sweep through `0x004f8370`, the publish tail either materializes one shell preview surface through `0x0051f090 -> 0x00534730` or, for the mode-`4/5` world-facing variants, converts the surviving preview rectangle back into world-space bounds and re-enters `0x0044e940`, `0x00452f20`, and `0x0044d410`. Current grounded caller is the fallback drag-path worker `0x004fcace` inside `shell_paint_terrain_window_append_drag_sample_and_rebuild_path_preview` `0x004fc630`, so the safest current read is the main drag-path preview rasterizer and compositor rather than a direct world brush.","objdump + caller inspection + local disassembly + preview-raster correlation + drag-path correlation + temporary-grid correlation + late-tail world-raster correlation"
|
||||
0x004fb5e0,1603,shell_paint_terrain_window_rebuild_preview_raster_from_world_coords_and_settings,shell,thiscall,inferred,objdump + caller inspection + local disassembly + preview-surface correlation,4,"Large terrain-preview raster rebuild worker beneath the shell-side `PaintTerrain.win` family. The helper derives one temporary occupancy mask over the live world grid from the caller-supplied world coordinates, current brush or scalar settings, and the current terrain-mode family rooted at `[this+0x90/+0x94/+0x98/+0x9c/+0xac/+0xb0/+0xbc/+0xc0/+0xcc]`; depending on those settings it fills that mask through the live world samplers `0x00448c00`, `0x00448c20`, `0x00448cb0`, `0x00448d40`, `0x00448f30`, and the companion-float cell setter `0x0044dca0`, with one later mode-`5` neighborhood branch also forcing corner writes and a final full-rect rebuild through `0x0044e940`. After the mask pass it walks the current preview raster `[this+0x114]`, converts the selected world samples or current preview colors into RGBA pixels through several per-mode blend branches, and then republishes the rebuilt preview surface into the shared shell controller at `0x006d0818` through `0x0047b3d0`. The caller split is tighter now too: `0x004f726c` is the early rebuild branch that first copies the live preview raster into `[this+0x118]` and then immediately snapshots undo state through `0x004f5a80`, while `0x004f7ada` is the later drag-active branch that allocates a temporary occupancy mask before rebuilding and conditionally mirrors that mask into `0x00450520` on the world-mode-`0x17` side path. Current grounded callers are those two direct drag-path branches inside `shell_paint_terrain_window_handle_message` `0x004f6f50`, so the safest current read is the current terrain-preview raster builder rather than a direct world-terrain mutation owner.","objdump + caller inspection + local disassembly + preview-surface correlation + mask-build correlation + shell-surface publish correlation + callsite split correlation"
|
||||
0x004fc280,592,shell_paint_terrain_window_apply_mode7_secondary_raster_bit0x10_brush_from_world_coords,shell,thiscall,inferred,objdump + caller inspection + local disassembly + secondary-raster correlation,4,"Mode-`7` drag worker beneath the shell-side `PaintTerrain.win` family. The helper derives a bounded radial neighborhood around the caller-supplied world coordinates from the current scalar lane `0x0062281c[index]`, then scans that neighborhood against the live secondary-raster bit-`0x10` predicate `world_secondary_raster_query_cell_byte2_bit0x10_set` `0x00448f30`. The desired state comes from `[this+0xac]`: when the live bit differs, the helper either sets or clears it through `world_secondary_raster_set_cell_byte2_bit0x10` `0x00448d90` or `world_secondary_raster_clear_cell_byte2_bit0x10` `0x00448dc0`. When any cell changed it republishes the surviving rectangle through `0x00452f20`. Current grounded caller is the mode-`7` drag branch at `0x004f797a` inside `shell_paint_terrain_window_handle_message` `0x004f6f50`, so the safest current read is the radius brush over secondary-raster bit `0x10` rather than a generic terrain sample helper.","objdump + caller inspection + local disassembly + secondary-raster correlation + radial-brush correlation"
|
||||
0x004fc4d0,342,shell_paint_terrain_window_apply_mode6_compact_grid_mode3_brush_from_world_coords,shell,thiscall,inferred,objdump + caller inspection + local disassembly + compact-grid correlation,4,"Mode-`6` drag worker beneath the shell-side `PaintTerrain.win` family. The helper scales the caller-supplied world coordinates by the fixed brush factor at `0x005c8568`, derives one bounded radial neighborhood from the current scalar lane `0x00622800[index]`, and then scans that disk through `math_measure_float_xy_pair_distance` `0x0051dc00` plus compact-grid membership query `world_query_compact_grid_flag_bitset_membership_by_mode` `0x00448af0` with mode `3`. The desired bitset state is derived from `[this+0xb0]`; when the live compact-grid bit mismatches that desired state, the helper stamps the requested value back through `0x004497a0(world, x, y, desired, 3, 1)`. When any cell changed it republishes the surviving rectangle through `0x00452f20`. Current grounded caller is the mode-`6` drag branch at `0x004f799c` inside `shell_paint_terrain_window_handle_message` `0x004f6f50`, so the safest current read is the radius brush over compact-grid bank `3` rather than a direct float-grid painter.","objdump + caller inspection + local disassembly + compact-grid correlation + radial-brush correlation"
|
||||
0x004fc630,1213,shell_paint_terrain_window_append_drag_sample_and_rebuild_path_preview,shell,thiscall,inferred,objdump + caller inspection + local disassembly + path-preview correlation,4,"Default drag-path worker beneath the shell-side `PaintTerrain.win` family for the terrain modes that do not route into the narrower mode-`6` or mode-`7` world brushes. The helper first measures radial distance from the cached brush center `0x00622844/0x00622848` through `0x0051db80`, rejects when the current point falls outside the active span gates, and then maintains the shell-side drag-path sample arrays rooted at `[this+0xf0..+0x118]`, including one optional whole-world nibble snapshot cached at `0x006d132c` through `world_secondary_raster_query_cell_byte2_low_nibble` `0x00448df0` for the current special mode families. After updating those path arrays it forwards the accumulated sample strip, current scalar and mode lanes, and the current preview buffers into `0x004f8bb0`, then mirrors the last accepted world coordinate back into `0x00622844/0x00622848`. Current grounded caller is the fallback drag branch at `0x004f79bb` inside `shell_paint_terrain_window_handle_message` `0x004f6f50`, so the safest current read is the shell-side drag-sample accumulator plus path-preview rebuild owner rather than a direct world mutation helper.","objdump + caller inspection + local disassembly + path-preview correlation + nibble-snapshot correlation"
|
||||
0x004fcaf0,67,shell_paint_territory_window_select_ordinal_and_refresh_caption,shell,thiscall,inferred,objdump + message-owner inspection + caption-table correlation,4,"Small setter beneath the shell-side `PaintTerritory.win` family. The helper stores the requested ordinal in `[this+0x78]`, reads one caption value through table `0x00622854`, and formats that caption through `0x0051f070` and `0x00527de0` on presenter `0x006d4024`. Current grounded caller is the message owner `0x004fcd10`, where control band `0xbb81..0xbb87` forwards through this helper before the main refresh pass.","objdump + message-owner inspection + caption-table correlation + shell-presenter correlation"
|
||||
0x004fcb40,51,shell_paint_territory_window_destroy,shell,thiscall,inferred,objdump + detail-manager teardown correlation,4,"Destructor-side wrapper for the shell-side `PaintTerritory.win` family. The helper restores vtable `0x005d1480`, re-enters the shared presenter-side destroy tail through `0x00523e20`, and when live world mode already equals `0x1e` it also replays `0x00453510` before tail-calling the common shell-object teardown `0x0053f7d0`. Current grounded caller is the detail-panel transition manager teardown branch at `0x004ddbd0`, which keeps this on the shell tool-window side rather than the later territory-access consumers.","objdump + detail-manager teardown correlation + world-mode branch correlation"
|
||||
0x004fcb80,400,shell_paint_territory_window_refresh_control_bands,shell,thiscall,inferred,objdump + constructor correlation + message-owner inspection,4,"Owner-side refresh pass for the shell-side `PaintTerritory.win` family. The helper first restyles the seven ordinal controls `0xbb81..0xbb87` from `[this+0x78]` and the 24-entry territory row band `0xbb94..0xbbab` from `[this+0x80]`, then resolves the live territory collection at `0x006cfc9c` and republishes the dynamic-text rows `0xbbf8..0xbc0f` through the special type-`0x6f` control path. It derives the row label from territory name bytes near `[entry+0x04]`, derives the paired summary metrics from fields `[entry+0x3d]` and `[entry+0x41]`, and formats those metrics through the same numeric-text family `0x0051b700/0x005193f0` used by sibling tool windows. Current grounded callers are the constructor `0x004fcf30` and the message owner `0x004fcd10`, which makes this the current `PaintTerritory.win` refresh owner rather than a company-access refresh lane.","objdump + constructor correlation + message-owner inspection + dynamic-text control correlation + territory-collection correlation"
|
||||
0x004fcd10,530,shell_paint_territory_window_handle_message,shell,thiscall,inferred,objdump + constructor correlation + caller inspection,4,"Primary message dispatcher for the shell-side `PaintTerritory.win` tool window. Under message `0xc8`, controls `0xbb94..0xbbab` update the current territory row in `[this+0x80]` and global `0x0062284c`, then route the world-side tool state through `0x00450520` when live world mode is `0x1e` or through `0x00452fa0` with mode id `0x1e` otherwise before re-entering `shell_paint_territory_window_refresh_control_bands` `0x004fcb80`. Controls `0xbb81..0xbb87` update the ordinal lane through `shell_paint_territory_window_select_ordinal_and_refresh_caption` `0x004fcaf0`, store the ordinal in global `0x00622850`, and refresh. Control `0x07d6` owns the shared world-surface latch `[this+0x7c]`; while that latch is live, the helper hit-tests through `0x00448ac0`, resolves the current ordinal value through table `0x00622854`, and forwards the staged world coordinates plus the current territory row through `0x0044a560` before mirroring the row pointer back through `0x00450520` or `0x00452fa0`. Current grounded owner correlation is the constructor `0x004fcf30` and the live shell message loop, which keeps this on the `PaintTerritory.win` side of the shared world-surface family rather than the company-detail territory-access dispatcher.","objdump + constructor correlation + caller inspection + world-surface latch correlation + tool-state dispatch correlation"
|
||||
0x004fcf30,224,shell_paint_territory_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `PaintTerritory.win` tool window. The constructor installs vtable `0x005d1480`, binds `PaintTerritory.win` through `0x0053fa50`, seeds the current ordinal and the paired scalar or selection lane from globals `0x0062284c..0x00622854`, refreshes the visible selection band through `0x004fcb80`, and then routes the initial world-side tool state through `0x00450520` or `0x00452fa0` with world-mode constant `0x1e`. Current grounded caller is the detail-panel manager branch at `0x004ddf86`, which keeps this on the shell tool-window side rather than the later territory-access and company-governance families.","objdump + strings + detail-manager correlation + singleton correlation + tool-state dispatch correlation"
|
||||
0x0050c290,624,shell_stock_buy_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `StockBuy.win` family. The constructor installs vtable `0x005d18f0`, binds `StockBuy.win` plus the companion `GameWindow.imb` resource through `0x0053d110` and `0x0053fa50`, seeds live singleton `0x006d19f0`, scans the chairman-profile collection at `0x006ceb9c` to identify the currently selected chairman index in `0x006d19f4`, seeds several cached list or selector handles at `0x006d19d8..0x006d19ec`, and wires the control family through callbacks such as `0x0050a730`, `0x0050a570`, and `0x0050b910`. Current grounded caller is the detail-panel manager branch at `0x004ddeaa`, which keeps this on the shell finance/detail side rather than the company-detail action dispatcher itself.","objdump + strings + detail-manager correlation + collection-scan correlation + control-wiring correlation + singleton correlation"
|
||||
0x004dfd70,57,shell_game_window_destroy,shell,thiscall,inferred,objdump + strings + caller xrefs,4,"Destructor for the shell-side `Game.win` detail window rooted at `0x006d0818`. It restores vtable `0x005d0eb8`, clears the singleton global, releases the child panel or selector object stored at `[this+0x8c]` through `0x004dd950`, and then tails into the common shell object destructor path. `shell_transition_mode` now uses this as the old-mode teardown branch when leaving mode `1`.","objdump + strings + caller xrefs + destructor correlation"
|
||||
0x004dfdf0,84,shell_ensure_game_message_window,shell,cdecl,inferred,objdump + strings,4,Ensures the standalone GameMessage.win shell object rooted at 0x006d081c exists. When absent it allocates a 0x94-byte window object seeds the vtable at 0x005d0ed0 binds the GameMessage.win resource through 0x0053fa50 stores the result in 0x006d081c and publishes the object to the shell runtime through 0x00538e50.,objdump + strings + caller xrefs
|
||||
0x004e0210,1217,game_message_window_service_frame,shell,thiscall,inferred,objdump + strings,4,Per-frame service pass for the GameMessage.win object rooted at 0x006d081c. It walks up to seven active message or notification records from the collection at 0x006acd34 populates the window slots around ids 0x8ca8 and neighboring controls chooses icon and portrait assets such as Portrait.imb note.imb smiley.imb and smalleye.imb maps selected message records into shell and world collections including 0x006ceb9c 0x0062be10 0x0062b26c and 0x0062bae0 and updates the visible action entries through repeated 0x00540120 calls. Current grounded caller is the simulation frame path through 0x004e0720.,objdump + strings + caller xrefs
|
||||
|
|
@ -724,6 +924,18 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
|
|||
0x00433260,400,shell_setup_filter_candidate_file_by_dataset_and_payload_flags,shell,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Filters one candidate `Setup.win` filename against the current dataset id and the small payload-flag family recovered from the staged bundle. Editor-map mode short-circuits to success immediately through `shell_setup_query_file_list_uses_map_extension_pattern` `0x004839b0`; otherwise the helper builds one rooted path from `shell_setup_query_file_list_root_dir_name` `0x004839e0`, opens the candidate bundle through `0x00530c80`, reads the small chunk family `0x2ee0/0x3c2` through `0x00531150/0x00531360`, and then applies dataset-specific acceptance rules to three recovered flag bytes. The current split is tighter now: dataset `10` requires the sandbox-side payload-flag family, dataset `9` requires a different nonzero payload-flag family, dataset `8` stays on the plain non-sandbox path, and dataset `12` adds one literal stem check through `0x005c9cf8` before the later payload-flag gate. Current grounded caller is `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0`, which uses this helper as the real extension-and-payload filter beneath the file-backed setup lists.","objdump + local disassembly + caller correlation + setup-dataset correlation + payload-flag gating correlation"
|
||||
0x004333f0,674,shell_setup_build_file_list_records_from_current_root_and_pattern,shell,thiscall,inferred,objdump + literal inspection + caller correlation,3,"Builds one normalized `Setup.win` file-list record block under the small collection object passed in `ECX`. The helper queries the current root directory through `shell_setup_query_file_list_root_dir_name` `0x004839e0`, chooses either `*.gm*` or `*.smp` through `shell_setup_query_file_list_uses_map_extension_pattern` `0x004839b0`, enumerates the resulting search spec, filters out leading-dot names and extension mismatches through `0x00433260`, counts the surviving rows, allocates `count * 0x25a + 1` bytes, and then repopulates each row with the raw filename at offset `0` plus the normalized display label at `+0x12d`. Dataset ids `5`, `6`, and `7` take the alternate normalization path through `0x0051c920`; sibling dataset ids keep the direct `0x0051df90` text normalization lane. The surrounding selector now bounds the current file-backed mapping more tightly too: submode `4 -> dataset 5`, `9 -> 4`, `6 -> 8`, `10 -> 6`, `12 -> 10`, and `14 -> 9`. Current grounded wrapper is `shell_setup_file_list_construct_and_scan_dataset` `0x004336a0`.","objdump + literal inspection + caller correlation + record-layout reconstruction + dataset-normalization correlation + setup-submode-dataset mapping"
|
||||
0x004336a0,33,shell_setup_file_list_construct_and_scan_dataset,shell,thiscall,inferred,objdump + caller correlation,3,"Small constructor wrapper above `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0`. The helper stores the caller-supplied dataset id at `[this+0x04]`, zeroes the row count `[this+0x00]` and payload pointer `[this+0x08]`, and then immediately enters the deeper scan-and-build body. Current grounded caller is `shell_setup_window_select_launch_mode_and_apply_shell_state` `0x00502c00`, whose exact file-backed setup mapping is now bounded as submode `4 -> dataset 5`, `9 -> 4`, `6 -> 8`, `10 -> 6`, `12 -> 10`, and `14 -> 9`.","objdump + caller correlation + setup-dataset reconstruction + setup-submode-dataset mapping"
|
||||
0x0051dc60,242,support_insertion_sort_fixed_records_by_embedded_key_offset,support,fastcall,inferred,objdump + local disassembly + caller correlation,3,"Generic adjacent-swap insertion sort over fixed-width records. The helper takes a base pointer in `ECX`, record count in `EDX`, and caller-supplied `record_size` plus `key_offset` on the stack, allocates one temporary record buffer through `0x005a125d`, and then runs the classic nested insertion pass over adjacent records. Each comparison forwards the two embedded key pointers `record + key_offset` into `0x005a57cf`; when the left key sorts after the right key, the helper swaps the two full `record_size`-byte records through the scratch buffer with `rep movs`. It finally releases the scratch buffer through `0x005a1145`. Current grounded caller is `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0`, which passes `record_size = 0x25a` and `key_offset = 0x12d` to sort `Setup.win` file-list rows by their normalized display label rather than by the raw filename at offset `0`.","objdump + local disassembly + caller correlation + setup-file-list-sort correlation"
|
||||
0x00420650,32,runtime_object_lazy_seed_field_0x317_from_shell_profile_word_0x0d_and_reenter_local_refresh,map,thiscall,inferred,objdump + local disassembly + shell-state correlation,2,"Small lazy-initialization helper in the sibling runtime-object family. When dword `[this+0x317]` is already nonzero it returns immediately. Otherwise it copies shell-profile word `[0x006cec78+0x0d]` into `[this+0x317]` and then jumps into the heavier local refresh body at `0x00420350`. Current grounded caller is the linked-site display-name refresh `0x00480bb0`, where it runs after the linked-site naming and anchor rebuild work.","objdump + local disassembly + shell-state correlation + lazy-init correlation"
|
||||
0x00420670,56,runtime_object_release_dynamic_payload_clear_cached_link_chain_and_tail_base_cleanup,map,thiscall,inferred,objdump + caller xrefs + local disassembly + sibling-table correlation,2,"Release-side helper in the sibling runtime-object family that owns the cached `u16` chain fields around `[this+0x26e/+0x270/+0x383]`. The function frees optional dynamic payload pointer `[this+0x37f]` through `0x00518bd0` plus `0x0053b080`, clears that field, re-enters `placed_structure_clear_cached_u16_chain_from_head_field_0x383` `0x0041f8d0`, and then tails into base cleanup `0x00455d20`. Current grounded caller is the collection-side remove helper `0x00421700`, and local `.rdata` places the associated behavioral slots under the sibling table rooted at `0x005c9a60`.","objdump + caller xrefs + local disassembly + sibling-table correlation + link-chain correlation"
|
||||
0x004206b0,274,world_region_upsert_or_remove_structure_profile_weight_by_name,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Editor-facing region-subcollection mutation helper over `[region+0x37f]`. The function linearly scans the current live subcollection for one exact profile-label match through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and `0x005a57cf`. On the not-found path it creates a new entry through collection virtual slot `+0x04` only when the caller-supplied weight is positive. On the found path it either removes the matching entry through collection virtual slot `+0x08` when the weight is non-positive or rewrites the existing entry weight at `[entry+0x1e]` when the weight stays positive. All three branches then re-enter `0x00420410` to refresh the region's derived profile cache. Current grounded caller is the `Cities/Regions` editor handler `0x004ce380`, where it reapplies per-candidate industry weighting state to the selected region.","objdump + local disassembly + caller correlation + region-subcollection correlation + editor-weighting correlation"
|
||||
0x00420350,96,runtime_object_refresh_local_scalar_field_0x31b_from_seed_word_0x317_and_shell_profile_word_0x0d,map,thiscall,inferred,objdump + caller xrefs + local disassembly + shell-state correlation,2,"Small scalar-refresh helper in the sibling runtime-object family. It treats word or dword `[this+0x317]` as the seed year/profile lane, compares it against shell-profile word `[0x006cec78+0x0d]`, and writes the derived float result to `[this+0x31b]` through a bounded piecewise curve: zero seed produces `1.0f`, deltas `0..2` map upward from a larger base, deltas `3..0x14` keep the field at `1.0f`, and larger deltas taper back down through a scaled subtraction path. When object class dword `[this+0x23e]` is nonzero it applies one extra affine adjustment before returning. Current grounded entry points are the lazy seeder `0x00420650` and the second jump-in at `0x00420d39`, so the safest current read is the shared `[0x317] -> [0x31b]` local scalar refresh rather than a named UI-only slider.","objdump + caller xrefs + local disassembly + shell-state correlation + scalar-curve correlation"
|
||||
0x00420d40,173,world_region_accumulate_linked_structure_balance_prepass_and_tail_growth_scalar_refresh,map,thiscall,inferred,objdump + caller xrefs + local disassembly + region-normalization correlation,3,"Per-region prepass beneath `world_region_normalize_cached_structure_balance_scalars` `0x00422320`. The helper clears cached float accumulators `[region+0x306/+0x30a/+0x30e]`, then walks the linked placed-structure chain rooted at `[region+0x383]` through the live registry `0x0062b26c`. For each linked record it accumulates two float-like local metrics through the neighboring placed-structure helpers `0x0040ca70` and `0x0040ca80`, and when the resolved candidate class byte `[candidate+0x32]` is zero it also resolves the backing source record through `0x0040cec0` and adds integer field `[source+0x141]` into the third accumulator. After the chain drains it tails into `0x00420560` for the follow-on refresh. Current grounded caller is the collection-wide normalization sweep `0x00422320`, where this helper is the explicit per-region prepass before the later cohort normalization and category-count writeback stages.","objdump + caller xrefs + local disassembly + region-normalization correlation + linked-structure-chain correlation"
|
||||
0x00420560,235,world_region_refresh_cached_structure_class_mix_scalar_0x312_from_linked_chain,map,thiscall,inferred,objdump + caller xrefs + local disassembly + region-normalization correlation,3,"Per-region linked-structure refresh over cached float `[region+0x312]`. The helper runs only on class-0 regions with a nonempty linked placed-structure chain at `[region+0x383]`, walks that chain through the live registry `0x0062b26c`, resolves each record's candidate through vtable slot `+0x80`, and then folds class-specific contributions into `[region+0x312]`. The current grounded split is structural but real: candidate class `0` contributes a source-derived term from `[source+0x141]` through `0x0040cec0`, class `2` contributes one branch keyed by candidate field `[candidate+0x78c]` plus placed-structure field `[site+0x246]`, class `3` adds one fixed increment, and class `1` currently contributes nothing. Current grounded callers are the prepass tail `0x00420d40`, one broader region worker at `0x00423d17`, the late world-entry region sweep at `0x00444baa`, and the paired editor-side or scenario branches at `0x00472c16` and `0x00472d2c`, so the safest current read is the shared linked-structure class-mix refresh under the broader region normalization family rather than a one-off stats formatter.","objdump + caller xrefs + local disassembly + region-normalization correlation + linked-chain-class-split correlation"
|
||||
0x00420e00,453,world_region_rebuild_profile_collection_from_source_region_and_seed_default_weights,map,thiscall,inferred,objdump + caller xrefs + local disassembly + editor-copy-flow correlation,3,"Region-side subcollection rebuild helper over `[region+0x37f]`. The function first frees and recreates the current `0x88`-byte indexed collection at `[region+0x37f]`, then when the caller supplies one source region it walks that source region's live subcollection, copies each entry label into a local stack buffer, and replays the copied weight at `[entry+0x1e]` through `world_region_upsert_or_remove_structure_profile_weight_by_name` `0x004206b0`. When no source region is supplied it instead seeds one default profile set directly through repeated `0x004206b0` calls with fixed label literals and weight `0.2f`, splitting later by region live byte `[region+0x23e]`. Current grounded caller is the `Cities/Regions` editor copy-industry branch at `0x004ce72c`, so this is the safest current read for the region profile-collection rebuild plus copy-or-default seeding path rather than a generic collection allocator.","objdump + caller xrefs + local disassembly + editor-copy-flow correlation + profile-subcollection rebuild correlation"
|
||||
0x00420ed0,803,world_region_rebuild_profile_collection_and_seed_class_split_default_weights,map,thiscall,inferred,objdump + caller xrefs + local disassembly + region-profile correlation,3,"Companion region-side subcollection rebuild helper over `[region+0x37f]` for the no-source default path. Like `world_region_rebuild_profile_collection_from_source_region_and_seed_default_weights` `0x00420e00`, the function first frees and recreates the current `0x88`-byte indexed collection at `[region+0x37f]`. It then immediately seeds one fixed profile-label set through repeated `world_region_upsert_or_remove_structure_profile_weight_by_name` `0x004206b0`, but the exact label set splits by region class dword `[region+0x23e]`: nonzero-class regions take one all-`0.2f` default set, while class-0 regions take a different default family that starts with one `0.3f` entry and then continues with repeated `0.2f` entries. Current grounded caller is the neighboring default-region initialization path at `0x0042141c`, so this is the safest current read for the shared class-split default profile seeding companion beneath the broader region-profile collection family rather than another editor-only copy helper.","objdump + caller xrefs + local disassembly + region-profile correlation + class-split default-set correlation"
|
||||
0x00420410,167,world_region_refresh_profile_availability_summary_bytes_0x2f6_0x2fa_0x2fe,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small derived-summary refresh over the current region subcollection `[region+0x37f]`. The helper clears the three dword summary lanes `[region+0x2f6/+0x2fa/+0x2fe]`, walks every live profile entry through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, resolves the backing structure candidate by name through `0x00412b70`, and then inspects candidate bytes `[candidate+0xba]` and `[candidate+0xbb]`. When either byte is nonzero it sets `[region+0x2f6] = 1`; a nonzero `[candidate+0xba]` sets `[region+0x2fa] = 1`, while the complementary branch sets `[region+0x2fe] = 1`. Current grounded caller is the editor-side mutation helper `0x004206b0`, which runs this refresh after every profile add, remove, or weight update.","objdump + local disassembly + caller correlation + region-subcollection correlation + summary-byte correlation"
|
||||
0x00421700,32,runtime_object_collection_remove_entry_by_id_release_record_and_erase_id,map,thiscall,inferred,objdump + local disassembly + collection-layout correlation,2,"Small collection-side removal helper for the sibling runtime-object family tied to table `0x005c9a60`. The function resolves the caller-supplied entry id through `0x00518140`, releases the resulting record through `0x00420670`, and then removes that id from the current collection through `0x00518a30`. Current evidence grounds this as the collection-owned remove-and-release wrapper rather than a wider rebuild pass.","objdump + local disassembly + collection-layout correlation + sibling-table correlation"
|
||||
0x00421730,560,world_region_collection_clear_cell_region_word_and_assign_nearest_region_ids,map,thiscall,inferred,objdump + local disassembly + caller inspection + region-correlation,3,"Region-side world-grid finalizer beneath the default region seeding path. The helper first clears the per-cell region word at `[world+0x212d] + cell*4 + 1` across the full live world raster using dimensions `[world+0x214d/+0x2151]`. It then seeds each live region entry with default bounds and helper fields `[region+0x242/+0x24e/+0x252] = 0` and `[region+0x246/+0x24a] = 0x270f`, and for every class-0 region computes one square neighborhood around the region center from `[region+0x256]`, `0x00455800`, and `0x00455810`. Within that bounded cell rectangle it evaluates one distance-like score through `0x0051dbb0` and writes the current region id `[region+0x23a]` into the per-cell word when the slot is empty or when the current region beats the previously assigned region on the same score. Current grounded callers are `world_region_collection_seed_default_regions` `0x00421b60` and the broader world-build path around `0x004476ec`, so this is the safest current read for clearing and repopulating the world-cell region-id raster rather than a generic collection sweep.","objdump + local disassembly + caller inspection + region-correlation + raster-assignment correlation"
|
||||
0x0042a970,188,shell_open_file_dialog_copy_selected_path_and_restore_cwd,shell,thiscall,inferred,objdump + literal correlation,3,"Small shell-side file-open dialog wrapper. The helper clears the caller output buffer, snapshots the current working directory through one import pair, builds a `0x4c`-byte open-file dialog record on the stack, calls the file-open import, restores the previous working directory, and returns true only when the caller buffer is left non-empty. Current grounded caller is the `Setup.win` branch at `0x005039cd`, which passes the `TGA Files (*.tga)` filter at `0x005d1674` and root `.\Data\GrayscaleMaps` at `0x005d1690`, so this is now the generic picker beneath the grayscale-heightmap generation lane rather than another multiplayer helper.","objdump + literal correlation + setup-branch reconstruction"
|
||||
0x005411c0,79,shell_query_tga_header_is_supported_truecolor_image,shell,cdecl,inferred,objdump + error-string correlation,3,"Small image-header validator used by the `Setup.win` grayscale-heightmap lane. The helper opens the caller path, reads `0x12` bytes into a local buffer, closes the handle, and returns true only when the read succeeds, the error byte remains clear, and the header's image-type byte equals `2`. Current grounded caller is the `0x005039fe` branch beneath `0x005033d0`, where failure raises localized error `0x0e13` (`The selected image is not useable by the game... true-color ... Targa image.`).","objdump + caller correlation + error-string correlation + TGA-header inspection"
|
||||
0x004801a0,105,placed_structure_is_linked_transit_site_reachable_from_company_route_anchor,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Boolean gate between one linked transit site and one company-side route anchor. The helper first requires the current placed structure to pass the station-or-transit gate `0x0047fd50`, then requires its linked-instance class test through `0x0040c990 == 1`. It resolves the caller-supplied company id through the live company collection `0x0062be10`, asks that company for one cached route-anchor entry id through `company_query_cached_linked_transit_route_anchor_entry_id` `0x00401860`, resolves the site's own route-entry anchor through collection `0x006cfca8`, and finally re-enters `0x0048e3c0` to test whether the two route-entry anchors lie in the same reachable route-side family. Current grounded caller is `company_rebuild_linked_transit_site_peer_cache` `0x004093d0`, where this helper gates whether a foreign linked transit site can still participate in the current company's peer cache.","objdump + caller xrefs + callsite inspection + linked-transit reachability correlation"
|
||||
|
|
@ -757,6 +969,11 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
|
|||
0x00508bb0,510,station_place_world_surface_sync_and_dispatch,shell,thiscall,inferred,objdump + caller xrefs + strings,4,"Shared world-surface helper for the active StationPlace.win tool object. It accepts direct `0x07d6` control traffic from the window dispatcher or falls back to the same shell detail-panel surface looked up through 0x006d0818, rechecks flag bit 0x4 on that control, performs world hit tests through 0x00448ac0, stages world coordinates into 0x006d1738 and 0x006d173c, refreshes the selected-site summary through 0x00508550, and updates the live placement selection globals at 0x00622af0 0x00622aec and 0x006d1740 plus helper objects rooted at [this+0x80] [this+0x84] and [this+0x88]. This makes it the clearest StationPlace-side consumer of the shared main-world interaction surface rather than only a passive status refresh helper.",objdump + caller xrefs + strings + callsite inspection
|
||||
0x005091b0,967,station_place_window_handle_message,shell,thiscall,inferred,objdump + strings + RT3.lng,4,"Primary message dispatcher for the StationPlace.win tool object at 0x006d1720. It switches over the incoming shell message id then handles the StationPlace control family rooted at category ids 0x697c through 0x6981, now grounded as the player-facing small station, medium station, large station, service tower, maintenance facility, and non-station-building buttons from strings 2197 through 2202. It also handles the style-strip controls at 0x6988 and 0x6989, which cycle the current building-style override used by station categories, the dependent controls around 0x6985 and 0x6986, now bounded as the two station-rotation policy choices from strings 2207 and 2206, the dedicated station-rotation circle control 0x6987, the list controls 0x69df and 0x69e3, and the shared world-surface control 0x07d6. The handler routes category and selection changes through 0x00508880 and 0x00507b90, uses 0x00507d80 for the live station-rotation drag/update branch, and delegates the world-hit-test path through 0x00508bb0. That makes it the clearest grounded owner for StationPlace player-facing tool commands rather than only a constructor plus frame hook.",objdump + strings + RT3.lng + caller xrefs + callsite inspection
|
||||
0x00509d80,1936,station_place_window_construct,shell,thiscall,inferred,objdump + strings + RT3.lng,4,"Constructs the StationPlace.win world-tool window object later published at 0x006d1720. The constructor seeds the vtable at 0x005d17c0 binds the StationPlace.imb helper asset and StationPlace.win resource through 0x0053d110 and 0x0053fa50 clears local selection and preview fields rooted at [this+0x7c] through [this+0x94], seeds the dedicated station-rotation circle control at 0x6987 through callback 0x00507a90, seeds the list controls 0x69df and 0x69e3, and stores the singleton plus helper handle globally at 0x006d1720 and 0x006d1724. Current evidence ties that 0x6987 branch to the player-facing `Click to rotate the building. You can also use bracket keys [ and ] to rotate buildings.` string 2208 rather than to the older `Building placement center` string 671; current recovered StationPlace code paths do not show a direct live lookup of string id 671 at all, which makes it look more like a stale or legacy label than a surviving control caption in the present window flow. The current grounded caller is the shell detail-panel constructor branch at 0x004dddc4.",objdump + strings + RT3.lng + caller xrefs + callsite inspection
|
||||
0x004b81d0,336,shell_building_detail_window_construct_and_bind_core_rows,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `BuildingDetail.win` family rooted at singleton `0x006cfd04`. The constructor installs vtable `0x005d00dc`, binds the helper asset `StationIcons.imb` plus `BuildingDetail.win` through `0x0053d110` and `0x0053fa50`, seeds three shell presenter handles at `0x006cfcf8..0x006cfd00`, clears local bytes `0x006cfd08/0x006cfd09`, wires the paired core action controls `0xbd17` and `0xbd18`, binds the smaller summary callbacks `0xbd13` and `0xbd14`, conditionally binds the extra row trio `0xbd19..0xbd1b` when `[0x006d3c84] == 1`, and then refreshes the visible selection band through `0x004b71b0`. Current grounded caller is the detail-panel manager branch at `0x004dde67`, which keeps this on the shell building-detail side rather than the later standalone opener rooted at `0x004bc100`.","objdump + strings + detail-manager correlation + control-wiring correlation + singleton correlation"
|
||||
0x004b84b0,55,shell_bulldoze_window_refresh_ordinal_strip,shell,thiscall,inferred,objdump + constructor correlation + message-owner inspection,4,"Small refresh helper for the shell-side `Bulldoze.win` family. The helper walks the seven ordinal controls `0xbf69..0xbf6f`, compares each row against the current selected ordinal stored at `[this+0x78]`, and republishes the row styling through `0x00540120` with the usual selected-vs-unselected style split `0x87/0x65`. Current grounded callers are the constructor `0x004b8720` and the message owner `0x004b84f0`, which keeps this on the shell bulldoze tool-window side rather than the deeper world bulldoze chooser.","objdump + constructor correlation + message-owner inspection + control-strip correlation"
|
||||
0x004b84f0,560,shell_bulldoze_window_handle_message,shell,thiscall,inferred,objdump + constructor correlation + caller inspection,4,"Primary message dispatcher for the shell-side `Bulldoze.win` tool window. Under message `0xc8`, control ids `0xbf69..0xbf6f` update the current ordinal at `[this+0x78]` and global `0x00621cc4` through the local setter `0x004b8470`, then re-enter `shell_bulldoze_window_refresh_ordinal_strip` `0x004b84b0`. Control `0x07d6` arms or clears the world-surface latch `[this+0x7c]` after the standard hit-test gate `0x00448ac0`. While that latch is live, the helper re-samples world coordinates, tracks the last accepted pair in globals `0x00621ce4/0x00621ce8`, queries one local world score through `0x0044b160`, and then publishes one status line through `0x00538c70` on shell runtime `0x006d401c`. Current grounded callers or owners are the constructor `0x004b8720` and the live shell message loop, which keeps this on the bulldoze tool-window side of the shared `0x07d6` world-surface family rather than on a generic shell-detail row path.","objdump + constructor correlation + caller inspection + world-surface latch correlation + local-score query correlation"
|
||||
0x004b8720,128,shell_bulldoze_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `Bulldoze.win` tool window. The constructor installs vtable `0x005d02b4`, seeds the current ordinal from `0x00621cc4`, formats the visible scalar caption from `0x00621cc8` through `0x0051f070` and `0x00527de0`, binds `Bulldoze.win` through `0x0053fa50`, clears local field `[this+0x7c]`, refreshes the visible selection rows through `0x004b84b0`, and then re-enters `0x00523e10` on the shell presenter. Current grounded caller is the detail-panel manager branch at `0x004ddef0`, which keeps this on the shell tool-window side above the broader world-side bulldoze chooser `0x0044b160`.","objdump + strings + detail-manager correlation + scalar-caption correlation + singleton correlation"
|
||||
0x004bcb50,160,shell_change_height_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `ChangeHeight.win` tool window. The constructor installs vtable `0x005d0690`, seeds the current ordinal from `0x00621e20`, formats the visible scalar caption from `0x00621e24`, binds `ChangeHeight.win` through `0x0053fa50`, stores live singleton `0x006cfe18`, refreshes the visible selection and mode rows through `0x004bc290`, and then triggers one world-side follow-on through `0x00452ca0` with mode id `6`. Current grounded caller is the detail-panel manager branch at `0x004ddf13`, which keeps this on the shell terrain-edit tool side rather than the generic world-surface brush owner itself.","objdump + strings + detail-manager correlation + singleton correlation + control-refresh correlation"
|
||||
0x0050a530,64,station_place_window_service_frame,shell,thiscall,inferred,objdump + caller xrefs,3,Recurring StationPlace.win service pass for the live station-placement tool object at 0x006d1720. The helper checks the local latch at [this+0x94] plus current shell or world selection state and then delegates one branch into 0x00508bb0 for follow-up station-placement synchronization on the same shared `0x07d6` main-world surface used by the dispatcher when the surrounding world tool remains active. Current grounded callers sit in the same recurring world and shell post-frame hooks used by sibling world-tool windows at 0x004423df 0x00444eda and 0x00445a64.,objdump + caller xrefs + callsite inspection
|
||||
0x0050d2d0,1245,track_lay_window_refresh_controls,shell,thiscall,inferred,objdump + strings + RT3.lng,4,"Refreshes the visible TrackLay.win control state after mode or preference changes. The helper highlights the three mutually exclusive primary mode buttons rooted at control ids 0x985e 0x985f and 0x9860 from the shared track-lay mode field at 0x00622b0c; current primary evidence now strongly aligns those grounded values as 1=`Lay single track.` string id 2054 4=`Lay double track.` string id 2055 and 0x40=`Bulldoze` string id 1721. The same refresh pass also updates the bridge-type selector family rooted at 0x006cec74+0x138 through controls 0x9861 and above; formats the two wrapped frequency values at 0x006cec74+0x140 and 0x006cec74+0x13c into controls 0x9870 and 0x9871 using the localized `Never` through `Common` string ids 615 through 618; and updates the two boolean preference toggles rooted at 0x006cec74+0x144 and 0x006cec78+0x4c74 through controls 0x986e and 0x986d. Current evidence now strongly aligns that pairing as 0x986e or 0x006cec74+0x144 = `Auto-Hide Trees During Track Lay` strings 1838 and 1839 and 0x986d or 0x006cec78+0x4c74 = `Auto-Show Grade During Track Lay` strings 3904 and 3905: the first toggle lives in the compact track-lay preference block alongside bridge and frequency settings while the second lives in the broader display-runtime block and fits the grade-overlay behavior. The same refresh path also updates the electrify-all action control at 0x9873 and the surrounding status widgets, which makes it the clearest grounded owner for the TrackLay.win status panel rather than only a generic shell redraw.",objdump + strings + RT3.lng + callsite inspection
|
||||
0x0050e1e0,534,track_lay_window_service_frame,shell,thiscall,inferred,objdump + caller xrefs + strings,4,"Recurring TrackLay.win service pass for the active track-lay tool object at 0x006d1a8c. The helper decrements the local reentry guard at [this+0x87] and when the pass is active it either routes the current track-lay drag state through 0x0050d740 while the grounded `Bulldoze` mode value 0x40 is live in 0x00622b0c or synchronizes the staged world-interaction state back into the live world owner through 0x006cfca8 and 0x0050dce0. The same service family also special-cases control id 0x07d6 through the tool-owned current-control field [this+0x7e], which now strongly suggests that 0x07d6 is the shared main-world interaction surface for TrackLay.win rather than a generic shell-detail button. Current grounded callers sit in the recurring world and shell post-frame hooks at 0x004423ee 0x00444ee9 and 0x00445a73.",objdump + caller xrefs + strings + callsite inspection
|
||||
|
|
@ -804,6 +1021,9 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
|
|||
0x0053f4e0,739,mouse_cursor_update_frame_state,shell,thiscall,inferred,ghidra-headless,4,Per-frame MouseCursor.cpp updater for the global cursor controller at 0x00ccbb20. It refreshes elapsed tick state through 0x0051d890 re-arms the active cursor selection through 0x0053f450 and 0x0053f000 when the 150 ms and 15 s idle thresholds trip resets per-frame cursor globals through 0x0054f6c0 and 0x0054f6d0 samples cursor placement and world-relative state through world_anchor_measure_projected_half_width world_anchor_measure_projected_half_height and shell_queue_world_anchor_marker and publishes the resulting cursor presentation state through shell_publish_text_callout_presentation before finalizing through 0x0054f6e0.,ghidra + rizin + llvm-objdump + strings
|
||||
0x0052e060,537,shell_expand_vertex24_triplets,bootstrap,thiscall,inferred,ghidra-headless,4,Sibling emitter for the same active presentation-batch record family; expands each 0x4c-byte packed source entry into three 0x18-byte vertex24 records in the caller-provided buffer. Each emitted record stores a vec3 at +0x00 a style dword from [this+0x43] at +0x0c and scalar slots at +0x10 and +0x14 while the output-count accumulator advances by count*3.,ghidra + rizin
|
||||
0x0052eb20,51,shell_read_optional_presentation_extents4,bootstrap,thiscall,inferred,ghidra-headless,4,Reads an optional four-float extent block from the active presentation-batch record when byte flag [this+0x25] is set; copies dwords at +0x26 +0x2a +0x2e and +0x32 into caller outparams for the presentation-extents helper at 0x547d10.,ghidra + rizin
|
||||
0x0052eb60,6,runtime_object_constant_0x46_stub_vtable_5cfd00_slot0,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper returns literal `0x46` in `EAX` and exits immediately. Current evidence does not justify a stronger semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly"
|
||||
0x0052eb70,6,runtime_object_constant_0x46_stub_vtable_5cfd00_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Second tiny constant-return virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper also returns literal `0x46` in `EAX` and exits immediately. Current evidence does not justify a stronger semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly"
|
||||
0x0052eb80,7,runtime_object_constant_float_1_25_stub_vtable_5cfd00_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly + rdata inspection,1,"Tiny float-return virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper loads and returns the constant float at `0x005dd1e8`, which is `1.25f`. Current evidence grounds it only as a fixed float-return slot.","objdump + vtable scan + local disassembly + rdata inspection"
|
||||
0x0052eca0,43,shell_get_next_presentation_batch_record,bootstrap,thiscall,inferred,ghidra-headless,4,Returns the next 0x45-byte presentation-batch record for the active item family rooted at [this+0x14] if current index [this+0x21] plus one is still below the family count at [+0x14]; otherwise returns null.,ghidra + rizin
|
||||
0x00524780,1252,shell_emit_ranked_overlay_cell_items,bootstrap,thiscall,inferred,ghidra-headless,3,Processes one ranked-overlay cell list for 0x0052a2f0. It samples shell range thresholds through 0x00533180 and 0x00533160 filters cell items by distance and intensity derives an alpha-biased packed color from the caller input and emits accepted items into the current vertex24 span through layout helper 0x005468c0.,ghidra + rizin + llvm-objdump
|
||||
0x00533ba0,39,shell_grid_get_nearby_presentation_cell,bootstrap,thiscall,inferred,ghidra-headless,4,Returns one tile-grid cell from the nearby-presentation layer rooted at [this+0x1671]. The helper converts world coordinates into 16x16 tile coordinates multiplies by the grid width stored at [this+0x15d9] and indexes the cell-pointer table at [this+0x1671].,ghidra + rizin + llvm-objdump
|
||||
|
|
@ -865,6 +1085,20 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
|
|||
0x00552560,916,shell_queue_world_anchor_marker,shell,cdecl,inferred,ghidra-headless,3,Builds one world-anchor marker packet from the caller point object and optional scale or style inputs. It samples anchor extents from the object fields converts them through 0x0053dde0 0x0053ddf0 and world_anchor_project_screen_extent_pair consults the shell zoom table rooted at [0x006d4024+0x11421e] and [0x006d4024+0x34] and finally enqueues one type-0x01 deferred message through shell_enqueue_deferred_message_type1. mouse_cursor_update_frame_state uses it for one branch of cursor world-relative presentation.,ghidra + rizin + llvm-objdump
|
||||
0x00552900,1304,shell_queue_projected_world_anchor_quad,shell,cdecl,inferred,ghidra-headless,3,Builds one oriented projected quad around the caller world-anchor object. It derives four projected corner points from the anchor extents and orientation computes edge and diagonal lengths through 0x0051db80 samples the shared presentation phase through shell_step_global_presentation_phase_scalar refines screen-space bounds through world_anchor_project_screen_extent_pair and finally emits two type-0x04 deferred-message posts through shell_enqueue_deferred_message_type4.,ghidra + rizin + llvm-objdump
|
||||
0x0051db80,32,math_measure_float_xy_pair_distance,support,cdecl,inferred,objdump + caller xrefs + callsite inspection,4,"Tiny shared float distance helper. It subtracts one caller-supplied X or Y point pair from the other, squares both deltas, sums them, and returns the Euclidean distance `sqrt(dx*dx + dy*dy)`. Current grounded callers include the city-connection chooser at `0x00402cb0`, the route-entry search family at `0x0049bd40` and `0x0049d380`, several company and world-side scoring branches, and shell presentation helpers such as `shell_queue_projected_world_anchor_quad` `0x00552900`. This now grounds `0x0051db80` as a generic float XY distance primitive rather than another opaque quality helper.","objdump + caller xrefs + callsite inspection + arithmetic inspection"
|
||||
0x0051dbb0,32,math_measure_float_xy_pair_distance_squared,support,cdecl,inferred,objdump + caller xrefs + arithmetic inspection,4,"Tiny squared-distance sibling of `math_measure_float_xy_pair_distance` `0x0051db80`. It subtracts one caller-supplied float X or Y pair from the other, squares both deltas, sums them, and returns that raw squared Euclidean distance without the final `sqrt`. Current grounded callers include the region-cell nearest-assignment pass `world_region_collection_clear_cell_region_word_and_assign_nearest_region_ids` `0x00421730` and the weighted auxiliary route-entry tracker metric family around `0x004a5280`, where the unsquared ordering is enough and the exact root would be wasted work. This now grounds `0x0051dbb0` as the generic float XY squared-distance primitive rather than another opaque scoring helper.","objdump + caller xrefs + arithmetic inspection + squared-distance correlation"
|
||||
0x0051dbe0,32,math_measure_int_xy_pair_distance_squared,support,fastcall,inferred,objdump + caller xrefs + arithmetic inspection,4,"Small integer squared-distance helper. It takes one integer XY pair in `ECX/EDX`, subtracts the caller-supplied comparison pair from the stack, squares both integer deltas, sums them, and returns that raw squared distance without `sqrt`. Current grounded callers include `company_query_min_linked_site_distance_to_xy` `0x00405920`, where it ranks linked sites before the winning integer distance is later converted back to `float`, so the safest current read is a compact integer XY squared-distance primitive rather than another gameplay-specific metric.","objdump + caller xrefs + arithmetic inspection + company-distance correlation"
|
||||
0x0051dc00,96,math_lookup_precomputed_abs_xy_distance_or_exact_euclidean_u16,support,fastcall,inferred,objdump + caller xrefs + arithmetic inspection,4,"Small radial-distance helper. It first converts the caller's two coordinate pairs into absolute X and Y deltas. When both deltas are below `0x418`, it indexes the precomputed `u16` distance table at `0x006d9098` using row stride `0x418` and returns that cached value. Otherwise it falls back to the exact Euclidean distance path by squaring both deltas, summing them, taking `sqrt`, rounding through `0x005a10d0`, and returning that integer result. Current grounded callers include the composed world-scalar query `0x0044afa0`, several world-side sample or scan branches around `0x0044d5b0..0x0044db34`, multiple placed-structure or specialization branches at `0x00452290`, `0x004524bf`, `0x0045bb97`, and `0x0045bbe2`, and later route-side callers around `0x00494a48` and `0x004a8a7f`, so this now reads as a shared precomputed-or-exact XY radial distance primitive rather than a one-off lookup table wrapper.","objdump + caller xrefs + arithmetic inspection + precomputed-distance-table correlation"
|
||||
0x0051dd60,114,support_trim_ascii_spaces_and_optional_newlines_in_place,support,fastcall,inferred,objdump + caller xrefs + local disassembly,3,"In-place ASCII trimming helper over one mutable NUL-terminated string. Starting from the end, the helper removes trailing spaces unconditionally and also strips trailing CR or LF when caller flag `EDX` is nonzero; it then removes leading spaces by shifting the remaining payload left through `0x005a20b0`. Current grounded callers include shell-side status, profile, and filename formatting branches around `0x004317d7`, `0x00444cfa`, `0x0048923d`, `0x004acc13`, `0x004dcf85`, and the lower text helper at `0x005176d3`, so this is the safest current read for the shared ASCII trim-in-place helper rather than a file-family-specific normalizer.","objdump + caller xrefs + local disassembly + string-trim correlation"
|
||||
0x0051dde0,46,support_copy_string_stem_before_first_dot,support,fastcall,inferred,objdump + caller xrefs + local disassembly,3,"Small string-stem copier. The helper copies bytes from source `ECX` into destination `EDX` until it reaches either NUL or the first literal `'.'`, then writes one terminating NUL and returns. Current grounded callers include save/load and runtime-bundle text branches around `0x00441fac`, `0x00442076`, `0x0044211f`, and `0x00443cf4`, where it is used to derive extensionless stems before appending localized suffixes or looking up sibling resources. This now reads as the shared copy-until-dot stem helper rather than a gameplay-specific formatter.","objdump + caller xrefs + local disassembly + stem-copy correlation"
|
||||
0x0051de10,303,support_blend_packed_rgba_dwords_by_float_weight,support,thiscall,inferred,objdump + caller xrefs + local disassembly + color-packing correlation,3,"Packed-color blend helper over two caller-supplied 32-bit RGBA-like dwords in `ECX` and `EDX`. The function derives the complementary blend weight `1.0 - weight`, unpacks all four byte lanes from both colors, blends each lane independently through the caller float weight, rounds each blended lane through `0x005a10d0`, and repacks the result into one 32-bit return value. Current grounded caller is `world_build_transport_pricing_preview_surface_from_secondary_raster` `0x0044f840`, where it blends the fixed fallback colors `0x5f040566` and `0x96586131` into the five seeded palette entries rather than manipulating a general-purpose image buffer directly.","objdump + caller xrefs + local disassembly + color-packing correlation + preview-palette correlation"
|
||||
0x0051df50,55,support_query_or_round_down_to_power_of_two,support,fastcall,inferred,objdump + caller xrefs + local disassembly,3,"Small power-of-two helper. Given one positive integer in `ECX`, it first finds the least power of two greater than or equal to that value. If the input is already an exact power of two it returns the input unchanged; if it is not exact and caller flag `EDX` is zero, it returns the next lower power of two; otherwise it returns `0`. Current grounded caller is the resource-side sizing branch at `0x005327eb/0x005327fa`, which passes `EDX = 0` to clamp two dimensions down to usable power-of-two texture sizes before later minimum-size enforcement. This now reads as a generic exact-or-round-down power-of-two helper rather than a texture-only magic-constant block.","objdump + caller xrefs + local disassembly + power-of-two correlation + resource-sizing correlation"
|
||||
0x0051df90,39,support_strip_extension_in_place_from_last_dot,support,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small in-place extension stripper. The helper walks to the end of the caller-owned NUL-terminated string, scans backward for the last literal `'.'`, and when found overwrites that dot with NUL; strings without any dot are left unchanged. Current grounded callers include `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0` and several save/load or scenario-text formatting branches around `0x004427df`, `0x00445d53`, `0x00461847`, `0x004f0b78`, and `0x00553784`, where it is used to normalize display labels from extension-bearing resource names. This now reads as the shared strip-extension-in-place helper rather than another file-family-specific normalizer.","objdump + caller xrefs + local disassembly + extension-strip correlation"
|
||||
0x0051dfc0,522,support_remap_clamped_unit_scalar_into_piecewise_packed_preview_color,support,cdecl,inferred,objdump + caller xrefs + local disassembly + color-ramp correlation,3,"Piecewise scalar-to-color helper over one caller float. The function first clamps the input into the unit interval `[0,1]`, then derives one remapped scalar and its complement through a piecewise curve with explicit breakpoints around `0.25`, `0.5`, and `0.75`. It finally packs those remapped values into one `0xcf`-alpha 32-bit preview color, with a small mode switch keyed by `[0x006d4024+0x11474e]` deciding whether the packed result duplicates one grayscale lane or preserves a two-lane split. Current grounded callers include world-side preview and overlay branches around `0x0045092e`, `0x00450b0f`, `0x00450cc9`, and `0x00450ddd`, plus several route-style and runtime-object presentation branches at `0x0048a860`, `0x0048e033`, `0x00493048`, `0x004b2a24`, and `0x004bd379`, so the safest current read is a shared clamped scalar-to-packed-preview-color ramp rather than a single-family palette helper.","objdump + caller xrefs + local disassembly + color-ramp correlation + preview-color correlation"
|
||||
0x0044bd10,152,world_query_region_category_byte_at_world_coords,map,thiscall,inferred,objdump + caller xrefs + local disassembly + region-raster correlation,3,"Small world-grid lookup helper over the per-cell region word family rooted at `[world+0x212d]`. The function converts caller float coordinates into rounded cell indices through the world-cell scale at `0x005c8568`, clamps those indices to live dimensions `[world+0x214d/+0x2151]`, resolves the current cell record from `[world+0x212d] + cell*4`, and treats the record as a mixed byte-or-word id: when the trailing `u16` lane at `+1` is nonzero it uses that wider id, otherwise it falls back to the first byte. It then resolves the resulting region or city entry through collection `0x0062bae0` and returns entry dword `[entry+0x272]`, with fixed fallback `5` when no entry resolves. Current grounded callers include the structure-side formatter at `0x00403ba7` and the StationPlace world-surface branches at `0x00508b80`, `0x00508d59`, and `0x0050a4e6`, where this helper feeds the current selected-site category latch `0x00622af0`.","objdump + caller xrefs + local disassembly + region-raster correlation + StationPlace category correlation"
|
||||
0x0044b160,936,world_try_bulldoze_near_coords_and_format_failure_message,map,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng strings,3,"Shared bulldoze-side chooser and commit helper beneath the TrackLay and sibling world-surface bulldoze lanes. The function first clears the caller-owned failure-text buffer and one output slot, validates the supplied company id through the live company collection `0x0062be10`, and on the ordinary non-editor path formats RT3.lng `419` `You can't bulldoze without a company.` when no valid company is available. It then performs two grounded passes over nearby runtime collections around the caller's world coordinates and radius: the early pass estimates or selects the best current bulldoze target while tracking the strongest nearby route-entry distance split, and the later pass performs the actual delete-or-commit branches. The target-family split is now real too. It scans the live route-entry collection `0x006cfca8`, the city-or-region collection `0x0062bae0`, the broader structure collection `0x006cea50`, linked placed structures in `0x0062b26c`, the route-side blocker collection `0x0062ba84`, and the live placed-structure collection `0x006cec20`, repeatedly sampling coordinates through `0x00455800/0x00455810`, `0x0048a1a0/0x0048a1c0`, `0x0047ded0/0x0047df00`, and the radial helper `0x0051db80`. The rejection ladder is now grounded by string ids: mismatched building ownership formats `421` `You can't bulldoze this building - it's owned by another railroad!`, mismatched track ownership formats `422`, nearby rolling-stock blockage formats `423`, and the placed-structure blocker lane localizes the two colliding structure stems through `0x0051c920` before formatting `424` `You can't bulldoze that track - it's too close to a %1. Try bulldozing the %2 first.`. The cost gate is grounded too: on the ordinary company path it reads the company treasury through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0` on stat family `0x2329` mode `0x0d`, formats `420` when the chosen bulldoze cost exceeds available cash, and otherwise commits the cost through `company_apply_bulldoze_or_local_action_cost_scalar` `0x0042a080`. On success the helper dispatches the actual bulldoze branch through the selected owner family: route-entry and route-anchor targets commit through `0x004937f0`, `0x004941a0`, and `0x0048abf0`, while building or linked-site targets commit through the surrounding placed-structure virtual slot `+0x58` and neighboring collection erases. Current grounded direct callers are the TrackLay bulldoze branches at `0x0050d83e` and `0x0050d8fc` plus the neighboring world-surface branches at `0x00473050` and `0x004b8685`, so this is the safest current read for the shared bulldoze chooser-plus-failure-message helper rather than a generic proximity scan.","objdump + caller xrefs + local disassembly + RT3.lng strings + TrackLay bulldoze correlation + rejection-ladder correlation"
|
||||
0x0044bdb0,107,world_count_neighbor_cells_in_secondary_raster_class_set_2_4_5,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Eight-neighbor count helper over the secondary-raster class subset owned by `world_secondary_raster_query_cell_class_in_set_2_4_5` `0x00534ec0`. Starting from one caller cell coordinate pair, the helper walks the shared `0x00624b28/0x00624b48` offset tables across the eight immediate neighbors, bounds-checks each neighbor against world dimensions `[world+0x2155/+0x2159]`, and increments the result only when `0x00534ec0` reports that the neighbor cell belongs to class set `2/4/5`. Current grounded callers are the neighboring secondary-raster service branches at `0x0044bf9d`, `0x0044bfc8`, `0x0044c0d5`, `0x0044c348`, and `0x0044c37b`, so this is the safest current read for the local class-subset neighbor counter rather than another generic lattice scan.","objdump + caller xrefs + local disassembly + secondary-raster correlation + 8-neighbor offset-table correlation"
|
||||
0x0044be20,992,world_secondary_raster_walk_connected_class_2_4_5_component_and_refresh_edge_flags,map,thiscall,inferred,objdump + local disassembly + internal caller correlation,3,"Recursive connected-component walker beneath the late secondary-raster neighborhood service band. The helper first widens dirty min/max bounds `[this+0x21ad..+0x21b9]` to include the current cell, marks the temporary visit bitmap at `0x0062c128`, resolves the current 3-byte raster cell through `world_secondary_raster_resolve_cell_record_ptr` `0x00534f40`, and writes one 3-bit orientation lane into the companion word using the lookup table at `0x005ee5cc` plus the caller-supplied direction index and polarity. It then walks all eight bounded neighbors through the shared offset tables `0x00624b28/0x00624b48`, keeps only neighbors in secondary-raster class set `2/4/5` through `0x00534ec0`, tracks local degree and visitation in two caller-local byte rings, and on admissible neighbors recurses back into itself while setting the same temporary visit bitmap. The admissibility split is tighter too: when world mode gate `[this+0x21bd]` is clear and the current or neighbor cell carries byte-2 flag `0x20`, it re-enters `world_count_neighbor_cells_in_secondary_raster_class_set_2_4_5` `0x0044bdb0` and rejects neighbors with degree `>= 3`. After the recursive walk it clears edge bits `0x04/0x08` in the current cell byte-1 lane, conditionally restores one of those bits for sparse interior cells, and on the byte-2 `0x20` family may rewrite the companion-word orientation lane again from the surviving neighbor pattern. Current grounded direct callers are the internal owner paths at `0x0044c029`, `0x0044c3ea`, and `0x0044c422`, all inside the same connected-component owner `0x0044c200`, so this is the safest current read for the recursive class-`2/4/5` component walker rather than a generic flood fill.","objdump + local disassembly + internal caller correlation + secondary-raster component correlation + edge-flag update correlation"
|
||||
0x0044c200,592,world_seed_secondary_raster_class_2_4_5_component_walk_from_cell,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Connected-component owner beneath the late secondary-raster neighborhood service band. The helper first validates the caller seed cell through `world_secondary_raster_query_cell_class_in_set_2_4_5` `0x00534ec0`; when that test fails it returns immediately. On success it snapshots shell input flag bit `0x4` from `[0x006d4018+0xa8c]` into world dword `[this+0x21bd]`, seeds dirty min/max bounds `[this+0x21ad..+0x21b9]` from the starting cell, allocates a temporary visited-cell bitmap of `width*height` bytes through `0x005a125d`, clears it, and marks the seed cell. It then resolves the seed raster cell through `0x00534f40`, derives one starting direction index from the seed cell header byte via the remap table at `0x005ee5d4`, and walks the eight immediate neighbors through `0x00624b28/0x00624b48`. Every bounded neighbor that remains in class set `2/4/5`, passes the same byte-2 `0x20` plus degree filter used by `0x0044be20`, and survives the local turn-distance test is forwarded into `world_secondary_raster_walk_connected_class_2_4_5_component_and_refresh_edge_flags` `0x0044be20` with the derived direction index and one branch-polarity flag. After the first fan-out it re-enters that same recursive walker once more on the seed cell itself with the final surviving direction and polarity, then releases the temporary visit bitmap through `0x005a1145`. Current grounded caller is the later mutation branch at `0x0044e796`, so this is the safest current read for the seed-and-own wrapper of the connected class-`2/4/5` walk rather than another one-shot scan.","objdump + caller xrefs + local disassembly + secondary-raster correlation + connected-component owner correlation"
|
||||
0x00554d70,248,billboard_item_build_anchor_point_cache,bootstrap,thiscall,inferred,ghidra-headless,3,Builds or refreshes the cached point list for one billboard item at [this+0x1dd]. When source points exist at [this+0x10] it transforms them through the owner object matrix near [this+0x0c]+0xce; otherwise it seeds a one-point fallback from the baked vector at [this+0xfe..0x106].,ghidra + rizin + llvm-objdump
|
||||
0x00554e70,680,shell_emit_ranked_sprite_billboard_item,bootstrap,thiscall,inferred,ghidra-headless,4,Emits one ranked sprite-billboard item into the current vertex24 span. The helper computes a distance-weighted fade against shell and world state stores the derived scalar at [item+0xdc] and then walks either the item's linked child list at [item+0x4] or the cached anchor list at [item+0x1dd] to write textured quad geometry through 0x005662a0.,ghidra + rizin + llvm-objdump
|
||||
0x00555740,49,billboard_item_refresh_child_sprite_colors,bootstrap,thiscall,inferred,ghidra-headless,3,Refreshes packed child-sprite colors for one billboard item by iterating the linked child list at [this+0x4] recomputing each child color through 0x005554f0 and storing the 24-bit result at [child+0x70].,ghidra + rizin + llvm-objdump
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
Loading…
Add table
Add a link
Reference in a new issue