437 KiB
437 KiB
| 1 | address | size | name | subsystem | calling_convention | prototype_status | source_tool | confidence | notes | verified_against |
|---|---|---|---|---|---|---|---|---|---|---|
| 2 | 0x0040a590 | 892 | simulation_service_periodic_boundary_work | simulation | cdecl | inferred | objdump + analysis-context | 3 | Periodic simulation-maintenance dispatcher inside the world-step family. It switches on the local calendar or phase byte at [this+0x0f] routes one heavy mode through the larger recurring service branch at 0x0040a160 falls back to the simpler one-step advance at 0x00409e80 for other modes and runs several global manager sweeps across 0x0062be10 0x006ceb9c 0x006cfcbc 0x006cec20 and 0x0062bae0 before handing control back to the enclosing stepper. One conditional branch also re-enters shell_map_file_world_bundle_coordinator at 0x00445de0 which keeps the save-or-package family connected to the live simulation cadence. | objdump + analysis-context + caller xrefs |
| 3 | 0x0040ab50 | 339 | simulation_advance_to_target_calendar_point | simulation | cdecl | inferred | objdump + analysis-context | 3 | Advances the active world state toward one caller-selected packed calendar target while guarded by the recursion counter at 0x0062b240. The helper compares the current local tuple fields [this+0x0d] [this+0x0f] [this+0x11] and [this+0x14] against a target resolved through 0x0051d550 and 0x0051d5f0 then either recurses in larger 0x168-sized chunks or advances through the smaller periodic step family rooted at 0x00409e80 and 0x0040a9c0. Each successful step notifies the live world root at 0x0062c120 through 0x00450030. Grounded callers include the frame-time accumulator at 0x00439140 the larger fast-forward helper at 0x00437b20 and one shell UI command path. | objdump + analysis-context + caller xrefs |
| 4 | 0x00411ee0 | 451 | structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables | map | thiscall | inferred | objdump + callsite inspection | 3 | Rebuilds the per-candidate cargo summary tables after one runtime descriptor array has been materialized. The helper clears the two cargo-id pointer tables at `[this+0x79c]` and `[this+0x7a0]`, their counts at `[this+0x7a4]` and `[this+0x7a8]`, and one float-like per-cargo accumulator band rooted at `[this+0x0a1]`, then walks every live `0xbc` descriptor in `[this+0x37]` against the current scenario year at `[0x006cec78+0x0d]`. For each active subordinate cargo row in the descriptor-owned `0x1c`-byte entry band it resolves one cargo id through the global cargo collection at `0x0062ba8c`, updates the per-cargo accumulator, and tracks one or two levels of cargo membership before compacting those marks into the two emitted cargo-id tables. The stronger production-mode result is now bounded here rather than only in the editor importer: when the descriptor-side mode flag at `[desc+0x00]` is zero the subordinate row amount is multiplied by the shared recipe-book production cap at `[this+0x2a]` and divided by the descriptor amount at `[desc+0x04]`; when that mode flag is nonzero the helper bypasses that scaling path. That matches the editor-side split where production mode keeps the entered annual amount on the supply half while the demand half is normalized to `1.0`, so the demand-side production branch now looks like a normalized input selector or gate while the supply side is the branch that receives cap-scaled runtime rates. Current grounded callers are the collection-wide rebuild sweeps at `0x00412bd0` and `0x00412d70`. | objdump + callsite inspection + scenario-state correlation + cargo-collection correlation |
| 5 | 0x00412560 | 144 | structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Descriptor-level activity gate beneath the port or warehouse cargo runtime family. The helper first special-cases descriptor mode `0` by resolving the primary cargo id at `[desc+0x1c]` through the global cargo collection at `0x0062ba8c`; it then requires the current scenario year at `[0x006cec78+0x0d]` to lie inside the descriptor year window `[desc+0x20]..[desc+0x22]`, and finally checks one caller-selected mode byte at `[desc+0x24]` or `[desc+0x25]` for the active mode bank. When the runtime cargo-economy latch at `[0x006cec78+0x4afb]` is clear and the descriptor owns subordinate cargo rows, it also requires every subordinate cargo id in the `0x1c`-byte row band at `[desc+0x44]` to resolve through the same cargo collection. Current grounded callers are `structure_candidate_count_active_scaled_supply_descriptors` at `0x004125f0`, `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, and neighboring world-side query branches around `0x0040fb8d`, `0x00410721`, and `0x00410b71`. | objdump + caller xrefs + callsite inspection + cargo-collection correlation |
| 6 | 0x004125f0 | 87 | structure_candidate_count_active_scaled_supply_descriptors | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Counts active runtime descriptors that participate in the scaled supply-side production lane for one caller-selected mode bank. The helper walks the current descriptor array at `[this+0x37]`, selects only descriptors whose mode dword at `[desc+0x00]` is zero and whose subordinate row count at `[desc+0x2c]` is positive, and then reuses `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560` before incrementing the returned count. Current grounded caller is `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, where the resulting count is used to divide the shared production-cap float across the active scaled-supply descriptors. | objdump + caller xrefs + callsite inspection |
| 7 | 0x00412650 | 543 | structure_candidate_query_cargo_runtime_summary_channels | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Lazy per-candidate cargo summary query over the runtime descriptor array rebuilt from the editor's port or warehouse recipe books. On a year change it clears four `0x6a`-dword summary banks rooted at `[this+0x0e8]`, `[this+0x290]`, `[this+0x438]`, and `[this+0x5e0]`, then walks every live `0xbc` descriptor across two mode banks through `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560`. Demand-side descriptors with nonzero mode dword accumulate subordinate-row weights into the bank rooted at `[this+0x10e]`; direct supply descriptors with no subordinate rows accumulate annual amounts into `[this+0x03a]`; and scaled supply descriptors with subordinate rows first divide the shared production-cap float at `[this+0x2a]` by the active-descriptor count from `structure_candidate_count_active_scaled_supply_descriptors` at `0x004125f0`, then publish the per-descriptor share into `[this+0x0a4]` and the subrow-scaled outputs into `[this+0x178]`. The helper finally returns one caller-selected cargo entry from all four banks through out-pointers, so current grounded meaning is one direct-supply channel, one cap-normalized supply channel, one demand or input channel, and one scaled production-output subrow channel rather than a single aggregate total. Current grounded callers are the lightweight wrappers at `0x00412960` and `0x004129a0`, the cargo-membership helper at `0x004129d0`, and the broader world-side accumulator at `0x0041e7be`. | objdump + caller xrefs + callsite inspection + scenario-state correlation |
| 8 | 0x004129d0 | 179 | structure_candidate_supports_or_references_cargo_id | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Returns whether the current runtime structure candidate materially references one requested cargo id. The helper first scans the compact secondary cargo-membership table rooted at `[this+0x7a0]` with count `[this+0x7a8]`; when no direct match is found it queries `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650` for mode bank `0` and treats the candidate as relevant when the returned demand-side plus scaled-output channels are positive. One final fallback checks the cached per-cargo accumulator bands rooted at `[this+0x0a1]` and `[this+0x0ad]` through the candidate-to-collection remap at `0x0062ba8c+0x9a`, which keeps the direct runtime cargo-membership arrays tied into the same decision. Current grounded caller is the placed-structure sweep around `0x00452e60`, where the result gates per-instance activation against one requested cargo id. | objdump + caller xrefs + callsite inspection + cargo-summary correlation |
| 9 | 0x00412d70 | 563 | structure_candidate_collection_rebuild_runtime_records_from_scenario_state | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Collection-wide runtime-state rebuild over the structure or candidate manager at `0x0062ba8c`. The helper iterates the collection twice against the paired availability bytes at `[candidate+0xba]` and `[candidate+0xbb]`, chooses one existing record to clone when the scenario-side owner id at `[candidate+0x794]` matches, otherwise clears the target record, and then repopulates the candidate runtime fields from the active scenario state rooted at `0x006cec78`. For each rebuilt candidate it copies the recipe-line count from `[state+0x1024]`, the shared production-cap float from `[state+0x13d4]`, and the packed `0xbc` descriptor array from `[state+0x1028]`, then refreshes the dependent cargo summary tables through `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` at `0x00411ee0` and the neighboring mode-flag pass at `0x00411ce0`. One bounded text side branch also republishes the candidate label from the scenario-side recipe-book name around `[state+0x0fe8]` when that string ends in `:`. Current grounded callers are the tail of `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` at `0x00435630` and the larger collection load path at `0x00412fb0`, so this now looks like the candidate-side bridge that projects editor recipe-book state into live runtime records rather than another generic collection copy loop. | objdump + caller xrefs + callsite inspection + scenario-state correlation |
| 10 | 0x00412ca0 | 192 | world_region_pick_commercial_profile_label_by_region_rank | map | thiscall | inferred | objdump + strings + callsite inspection | 4 | Selects one category-3 candidate label from the global structure pool `0x0062b268` for the current region bucket. The helper converts the caller-supplied region rank through the region-count manager at `0x0062bae0`, uses that derived bucket to read per-candidate weights from `[candidate+region_index*4+0x8d]`, repeatedly subtracts those weights across up to five passes while only considering pool entries whose category byte at `[candidate+0x32]` is `3`, and copies the chosen candidate name into the caller buffer. When no weighted category-3 candidate survives the sweep it falls back to the static token `Commercial` at `0x005c92e8`. A later region-stats panel lines the same third slot up with localized id `1040` `City Support`, so current evidence treats this as the low-level label picker for a broader city-support family whose fallback token happens to be `Commercial`. The current grounded caller is `world_region_balance_structure_demand_and_place_candidates` at `0x004235c0`. | objdump + rdata strings + callsite inspection + region stats disassembly + RT3.lng strings |
| 11 | 0x0041ea50 | 179 | world_setup_building_collection_phase | map | cdecl | inferred | objdump + strings + callsite inspection | 3 | Post-load world-generation subphase inside world_run_post_load_generation_pipeline. The helper iterates the building-related collection at `0x0062ba8c`, chooses either the full pass or one modulo-selected bucket from the current world byte at `[0x006cec78+0x0f]`, resolves each entry through `0x00518380` and `0x00518140`, and then dispatches the selected record into the lower setup worker at `0x0041e2b0`. Current grounded callsite is the early collection sweep inside world_run_post_load_generation_pipeline immediately before the localized progress update `Setting up Players and Companies...`, so this looks like the collection-owned building-setup staging phase rather than one of the later player-speed or shell-frame loops. | objdump + caller context + RT3.lng strings |
| 12 | 0x0041e220 | 52 | structure_candidate_is_enabled_for_current_year | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Common live-availability gate for one structure-candidate record. The helper first requires the cargo-economy or editor filter flag at `[this+0x56]` to be nonzero, then compares the current scenario year against the candidate threshold at `[this+0x21]`, using either `[0x006cec78+0x05]` or `[+0x0d]` depending on the runtime branch latched at `[0x006cec78+0x46c38]`. Current grounded callers include the collection counter refresh at `0x0041e970`, the placed-structure cargo-bitset sweep at `0x0042c690`, and several later shell or world-side candidate-selection branches, so this now looks like the shared year-and-filter gate beneath the editor's cargo-economy path rather than a setup-only helper. | objdump + caller xrefs + callsite inspection + cargo-economy filter correlation |
| 13 | 0x0041e2b0 | 589 | structure_candidate_rebuild_local_service_metrics | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Setup-side local-metrics rebuild for one live structure candidate after it has passed `structure_candidate_is_enabled_for_current_year` at `0x0041e220`. The helper clears the metric bands at `[this+0x6a]`, `[+0x6e]`, `[+0x72]`, `[+0x76]`, and `[+0x7a]`, then samples repeated world-grid slices off the active world root at `0x0062c120` through `0x0042c960` and the per-cell tables rooted at `[world+0x2129]`. It accumulates one broad local magnitude at `[this+0x6a]`, folds two optional positive channels into `[this+0x6e]` and `[this+0x72]`, and finally normalizes and scales the trailing summary pair `[this+0x76]` and `[this+0x7a]` with fixed constants. Current grounded caller is `world_setup_building_collection_phase` at `0x0041ea50`, so this still looks like a setup-time local service or demand scorer rather than the recurring owner of the whole cargo-economy lane, but it is now one clear downstream consumer of the same `[candidate+0x56]` live-availability gate. | objdump + caller xrefs + callsite inspection + world-grid correlation |
| 14 | 0x0042c1b0 | 886 | placed_structure_redistribute_local_service_pressure_from_neighbors | map | thiscall | inferred | objdump + caller xrefs + neighborhood sweep inspection | 3 | Neighbor-aware local-service post-pass for one placed-structure or site record. The helper first builds a bounded set of nearby site references by scanning offset patterns from `0x00624b28` and `0x00624b48` against the world-grid tables rooted at `[0x0062c120+0x2129]`, keeping only neighbors whose state byte at `+0x0e6` is compatible with the current site and recording per-neighbor weights derived from the local word tables near `[site+0x00]` and `[site+0x0f3]`. It then walks the live candidate collection and, for each live non-remapped candidate, chooses the strongest positive neighbor deficit after scaling through the candidate-side weight at `[candidate+0x52]`; when a positive deficit remains it commits the redistribution through `0x0042bf80`. Current grounded caller is the composite local refresh `0x0042d580`, so this looks like the neighboring-site redistribution pass beneath the local service-score bundle rather than an independent outer loop. | objdump + caller xrefs + neighborhood sweep inspection + candidate-weight correlation |
| 15 | 0x0041eac0 | 794 | structure_candidate_collection_refresh_cargo_economy_filter_flags | map | thiscall | inferred | objdump + caller xrefs + callsite inspection + rdata strings | 3 | Collection-wide refresh of one cargo-economy-sensitive candidate flag in the live structure collection at `0x0062ba8c`. The helper first walks the global candidate pool at `0x0062b268`, filters category-`2` entries through the paired availability bytes `[candidate+0xba]` and `[candidate+0xbb]` plus the recipe-runtime latch `[candidate+0x7ac]`, and builds one temporary per-cargo mask keyed by cargo names such as `Clothing`, `Cheese`, `Meat`, `Ammunition`, `Weapons`, `Diesel`, `Troops`, and `Passengers`; one special-case branch also uses structure labels such as `Barracks` and `Recycling Plant` while consulting the region collection at `0x0062bae0`. It then iterates the live structure collection itself, combines that temporary cargo mask with the candidate-local bytes `[entry+0x47]`, `[entry+0x48]`, and `[entry+0x49]`, the runtime cargo-economy latch at `[0x006cec74+0x25f]`, and one neighboring mode gate at `[0x006cec78+0x4afb]`, and writes the resulting enabled-or-filtered state into `[entry+0x56]` before re-entering `0x0041e970` to rebuild the derived visible counts. Current grounded callers are the collection-side setup path around `0x0041f4cb` and the runtime toggle branch at `0x0046577c`, where the same `0x006cec74+0x25f` bit is flipped directly; that makes this the strongest current bridge from the editor's `Disable Cargo Economy` rule into live structure-candidate filtering rather than a purely editor-side helper. | objdump + caller xrefs + callsite inspection + rdata strings + special-condition correlation |
| 16 | 0x00421b60 | 180 | world_region_collection_seed_default_regions | map | thiscall | inferred | objdump + strings + callsite inspection | 4 | Seeds the default numbered region family on the manager collection at `0x0062bae0`. The helper pumps shell progress through `0x004834e0`, repeatedly creates collection entries through `0x00421660`, formats their labels from localized string id `2908` `Region %1` plus the `%02d` pattern at `0x005c9aec`, marks the created records live through `[entry+0x23e]`, and then finalizes the region set through `0x00421730` against the active world root at `0x0062c120`. Current grounded callsites are the post-load generation pipeline at `0x004384d0` and the broader world-build path around `0x004476ec`, so this now looks like region-set seeding rather than generic player or company setup. | objdump + RT3.lng strings + caller xrefs + callsite inspection |
| 17 | 0x00421c20 | 187 | world_region_collection_run_building_population_pass | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Region-owned building-population dispatcher over the collection at `0x0062bae0`. For each region entry it forwards one caller-selected scale and mode flag into the lower worker at `0x004235c0`, pumps shell progress through `0x004834e0` between entries, and guards the sweep with the region-collection reentrancy counter at `[this+0x88]`. The same setup lane now shows one direct shell-state coupling too: constructor-time helpers in the same region family copy shell-state gate `[0x006cec74+0x174]` into local region-side state, and the post-load pipeline only reaches this dispatcher behind that same gate after posting localized id `320` `Setting Up Buildings...`. The per-region worker consults the region subcollection at `[region+0x37f]`, the global candidate pool at `0x0062b268`, the placed-instance registry at `0x0062b26c`, and one world-side notification or state owner at `0x0062b2fc`, which makes this look like a building spawn or allocation pass rather than a generic region refresh. Grounded callers include the post-load `Setting Up Buildings...` branch in world_run_post_load_generation_pipeline with arguments `(1.0, 1)` and a slower recurring simulation-side caller at `0x0040a804/0x0040a826` with scale `0.08333334` and mode `0`, which suggests the same lower subsystem also has a later maintenance cadence after initial setup. | objdump + caller xrefs + callsite inspection |
| 18 | 0x0041f9b0 | 125 | world_region_count_structure_profiles_before_year_for_category | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Counts region-subcollection structure profiles whose backing candidate resolves through `0x00412b70`, passes the availability gate at `0x0041f998`, matches one caller-selected category byte, and has threshold year `[profile+0x26]` less than or equal to the caller-supplied year. Current grounded callers include the region stats path at `0x004cbd41`, where category `2` feeds the localized `Industry Weightings` report, and the deeper per-region worker at `0x004235c0`, where the same count bounds demand for the weighted category-2 profile family. | objdump + caller xrefs + callsite inspection + RT3.lng strings |
| 19 | 0x0041fa30 | 133 | world_region_find_named_structure_profile_weight | map | thiscall | inferred | objdump + strings + caller xrefs | 3 | Looks up one named structure profile in the current region subcollection `[region+0x37f]`. The helper linearly compares the caller-supplied text against each profile label and returns the float-like weight at `[profile+0x1e]` for the first exact match, otherwise `0.0`. The same region-subcollection string block is now partially grounded from nearby `.rdata` as labels such as `House`, `Hotel`, `Iron Mine`, `Furniture Factory`, `Fertilizer Factory`, and `farm`. Current grounded callers sit in world-side UI or telemetry branches around `0x004cbb74`, `0x004cc054`, and `0x004ccc54`. | objdump + caller xrefs + rdata strings |
| 20 | 0x0041fac0 | 60 | world_region_read_structure_profile_label_and_weight_by_index | map | thiscall | inferred | objdump + caller xrefs + strings | 4 | Reads one 1-based structure-profile entry from the current region subcollection `[region+0x37f]`. It copies the profile label string into the caller buffer and writes the float-like weight at `[profile+0x1e]` into the caller-provided out-slot. This is the label/value helper used beneath the region structure-demand worker and the adjacent UI or telemetry callers. The grounded profile-name block around `0x005c9100` now includes labels such as `House`, `Hotel`, `Iron Mine`, `Furniture Factory`, and `Fertilizer Factory`. | objdump + caller xrefs + rdata strings |
| 21 | 0x00422900 | 352 | world_region_accumulate_structure_category_totals | map | thiscall | inferred | objdump + callsite inspection | 3 | Aggregates the current structure-category totals for one region entry. The helper walks the placed-instance chain rooted at `[region+0x383]` through the global registry `0x0062b26c`, resolves each live record's category byte through the vtable `+0x80` object view, and returns both counts and accumulated weight-like totals across four categories via the caller-provided out-pointers. Current grounded caller is world_region_balance_structure_demand_and_place_candidates at `0x004235c0`, where the outputs feed the later demand-balancing logic for the region-owned building-population pass. | objdump + callsite inspection |
| 22 | 0x00422be0 | 768 | world_region_count_placed_structures_for_category | map | thiscall | inferred | objdump + callsite inspection | 3 | Counts already-placed structures in one requested category for the current region entry. It walks the placed-instance chain rooted at `[region+0x383]` through `0x0062b26c`, filters live records by the requested category byte, and applies several additional placement gates including one cap on `[record+0x276]`, one disable byte at `[record+0x390]`, and special handling for category `2`. Current grounded caller is world_region_balance_structure_demand_and_place_candidates at `0x004235c0`, where the result is subtracted from the region's computed category demand before more candidates are chosen. | objdump + callsite inspection |
| 23 | 0x00422ee0 | 884 | world_region_try_place_candidate_structure | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Attempts one candidate-structure placement for the current region entry and requested category. It derives one region-ranking bucket from `[region+0x256]` and `[region+0x25e]`, uses the region count at `0x0062bae0` to index the weighting table at `0x005ee1e0`, chooses one trial budget of `10` or `15` depending on the setup latch at `[0x006cec78+0x46c3c]`, and then repeatedly evaluates candidates from the global site pool `0x0062b268`. The chooser matches candidate names and scores against region subcollection entries, rejects over-cap or already-satisfied sites through the placed-instance registry `0x0062b26c`, and when successful either dispatches one direct placement through `0x004134d0` or routes the selected site into the shell-facing side path through `0x004337c0`. Current grounded callers are the region building worker at `0x004235c0` and the separate world-side branch at `0x004d1871`, so this now looks like the core candidate-placement helper beneath the region-owned building-population family. | objdump + caller xrefs + callsite inspection |
| 24 | 0x004235c0 | 1887 | world_region_balance_structure_demand_and_place_candidates | map | thiscall | inferred | objdump + callsite inspection | 4 | Core per-region worker beneath world_region_collection_run_building_population_pass. It first checks the broader shell-state master flag at `[0x006cec74+0x68]` and diverts into a separate alternate path when that flag is nonzero. The same flag now aligns with the editor-map `.gmp` family in the shell file coordinators, so the ordinary demand-balancing and placement flow currently looks grounded for the non-editor world mode while the alternate branch likely belongs to the editor-map side. In that ordinary path it aggregates existing category counts and weights through world_region_accumulate_structure_category_totals at `0x00422900`, samples the current region subcollection size through `0x0041f6a0`, and computes target demand for three structure categories by comparing those totals against caller-provided scale and mode inputs plus several randomized clamps. The three grounded category families are now narrower: category `0` uses the fixed fallback label `House` from `0x005c9114`; category `2` is the year-gated weighted region-profile family read through world_region_read_structure_profile_label_and_weight_by_index at `0x0041fac0` and bounded by world_region_count_structure_profiles_before_year_for_category at `0x0041f9b0`, which also feeds the localized `Industry Weightings` report in the region stats UI; and category `3` reaches world_region_pick_commercial_profile_label_by_region_rank at `0x00412ca0`, whose fallback token is `Commercial` but whose aligned region-stats label slot is localized as `City Support`. After subtracting already-placed coverage through world_region_count_placed_structures_for_category at `0x00422be0`, the worker tries placements through world_region_try_place_candidate_structure at `0x00422ee0` until demand is exhausted or the attempt budget runs out. This makes the worker a region structure-demand balancing and placement pass over houses, weighted region profiles, and the broader city-support branch rather than a generic setup loop. | objdump + callsite inspection + region stats disassembly + RT3.lng strings + rdata strings + file-flow correlation |
| 25 | 0x00423d70 | 176 | company_repay_bond_slot_and_compact_debt_table | simulation | thiscall | inferred | objdump + caller inspection | 4 | Repays and removes one indexed bond entry from the live company debt table. The helper validates the requested slot against the current bond count at `[this+0x5b]`, compacts the remaining 12-byte entries rooted at `[this+0x5f]`, and then recomputes the dependent finance accumulators through `0x0042a040` and `0x0042a080`. Current grounded shell caller is the repay-bond branch beneath `CompanyDetail.win`, which makes this the company-side debt-table mutator rather than a territory-access helper. | objdump + caller inspection + finance-field correlation |
| 26 | 0x00424010 | 29 | company_has_territory_access_rights | simulation | thiscall | inferred | objdump + caller inspection | 4 | Returns whether the current company has access rights in one requested territory id. The helper indexes the per-territory access byte at `[this + territory*0x38d + 0x1d9f]` and returns `1` when that byte is nonzero. Current grounded callers are the `CompanyDetail.win` territory-access summary helper at `0x004c1b60` and the territory-access purchase flow at `0x004c5fc9`. | objdump + caller inspection + territory-access table correlation |
| 27 | 0x00424030 | 22 | company_set_territory_access_rights_byte | simulation | thiscall | inferred | objdump + caller inspection | 4 | Stores one territory-access byte for the requested company and territory id. The helper writes the supplied byte value into the same per-territory access table rooted at `[this + territory*0x38d + 0x1d9f]`. Current grounded shell caller is the immediate commit path inside `shell_company_detail_buy_territory_access_rights_flow` at `0x004c5fc9`, where the purchase path writes value `1` after the access-rights dialog is accepted. | objdump + caller inspection + territory-access table correlation |
| 28 | 0x004241e0 | 23 | company_sum_control_transfer_offer_policy_fields_raw | simulation | thiscall | inferred | objdump + caller inspection | 4 | Returns the raw sum of two company-side floating fields at `[this+0x124f]` and `[this+0x12a7]`. Current grounded callers are the merger-offer builder around `0x004eb5a9` and adjacent control-transfer offer-side stat readers, where the returned value is paired with surrounding formatter setup for mode `0x0b` but is not itself passed an issue argument. This now looks like a narrow raw control-transfer offer policy total rather than a generic finance calculation. | objdump + caller inspection + merger-offer dialog correlation |
| 29 | 0x00424200 | 37 | company_sum_control_transfer_offer_policy_fields_scaled_tenths | simulation | thiscall | inferred | objdump + caller inspection | 4 | Returns the same `[this+0x124f] + [this+0x12a7]` company-side policy total as `company_sum_control_transfer_offer_policy_fields_raw`, but scaled by the `0.1` constant at `0x005c9b50`. Current grounded callers are the merger and chairmanship-takeover offer builders at `0x004eb588` and `0x0050c7cb`, where the scaled result is immediately paired with surrounding formatter setup for mode `0x0b`. The helper itself does not consume an issue id, so this now reads as the scaled control-transfer offer policy total rather than a broader vote-weight function. | objdump + caller inspection + takeover and merger dialog correlation |
| 30 | 0x004248d0 | 759 | company_compute_cached_recent_performance_support_score | simulation | thiscall | inferred | objdump + caller inspection | 3 | Builds one cached company-side support score from recent yearly metric history and current scenario difficulty. When the company is inactive via `[this+0x3f]` it returns the fixed negative fallback at `0x005c8598`; otherwise it reuses the cache in `[this+0x0cfb]` and `[this+0x0cff]` when the current year at `[0x006cec78+0x15]` matches. On a cold pass it walks the recent year window above the founding year at `[this+0x157]`, queries multiple yearly stat ids through `0x0042a5d0` including `0x1f`, `0x1e`, `0x20`, and `0x1d`, blends those results with recency weights and one difficulty table under `0x005f33b8`, clamps intermediate ratios, stores one bounded subscore into `[this+0x0d19]`, and finally caches the resulting float in `[this+0x0cff]` with the current year in `[this+0x0cfb]`. Current grounded callers are the public-support blend helper at `0x00424fd0` and nearby company telemetry or policy branches. | objdump + caller inspection + cache-field correlation |
| 31 | 0x00425a90 | 194 | company_declare_bankruptcy_and_halve_bond_debt | simulation | thiscall | inferred | objdump + RT3.lng strings + caller inspection | 4 | Runs the grounded company bankruptcy commit path. The helper walks the live bond table rooted at `[this+0x5f]`, halves each outstanding principal, recomputes finance metrics through `0x0042a040` and `0x00424fd0`, reduces the company value field at `[this+0x47]`, and stamps the current year into `[this+0x163]` as the localized bankruptcy-cooldown anchor. Current grounded shell caller is `shell_company_detail_bankruptcy_flow` on the `CompanyDetail.win` path. | objdump + RT3.lng strings + caller inspection + finance-field correlation |
| 32 | 0x004261b0 | 74 | company_count_unassigned_shares_after_active_chairman_holdings | simulation | thiscall | inferred | objdump + caller inspection | 4 | Returns the current company share pool at `[this+0x47]` minus the positive holdings found in each active chairman profile record under `0x006ceb9c`. The helper uses the company collection index from `[this+0x00]` to read per-profile holdings from `[profile + company_index*4 + 0x15d]`, sums only positive entries, and subtracts that total from the company share count. Current grounded callers are the takeover and merger vote resolvers, which stage the result into `0x006d1a04` and `0x006d1104` before the lower public-vote support formulas run. | objdump + caller inspection + takeover and merger vote correlation |
| 33 | 0x00426890 | 68 | company_find_collection_index_by_company_id | simulation | thiscall | inferred | objdump + caller inspection | 4 | Finds one live company collection index by comparing the requested company id against the first dword of each entry in the company manager at `0x0062be10`. The helper returns the zero-based index on a match or `-1` when no live company record matches. Current grounded callers are the takeover and merger vote resolvers, which use that index before reading profile-side per-company holdings from `0x006ceb9c`. | objdump + caller inspection + company collection correlation |
| 34 | 0x00426be0 | 53 | company_can_purchase_territory_access_rights | simulation | thiscall | inferred | objdump + caller inspection + RT3.lng strings | 4 | Returns whether the current company may purchase territory-access rights for one requested territory id. The helper first rejects territories where the company already has access through the byte table at `[this + territory*0x38d + 0x1d9f]`, then resolves the territory through `0x006cfc9c` and only returns `1` when the territory-side mode byte at `[territory+0x2d]` equals `1`. Current grounded callers are the `CompanyDetail.win` territory-access summary helper at `0x004c1b60` and the buy-rights flow at `0x004c5fc9`, where this is the direct gate between localized ids `947` and `948` plus the actionable `961` purchase prompt. | objdump + caller inspection + RT3.lng strings + territory-flag correlation |
| 35 | 0x0042a2e0 | 645 | company_read_control_transfer_metric_slot | simulation | thiscall | inferred | objdump + caller inspection | 3 | Reads one derived company metric from the bounded slot family `0x13..0x2a` used by control-transfer, public-support, and annual governance logic. The dispatcher mixes direct company fields such as `[this+0x4b]`, `[this+0x53]`, `[this+0x323]`, `[this+0x327]`, `[this+0x333]`, `[this+0x33f]`, and the later counters near `[this+0x34b]` and `[this+0x14f]` with a few computed ratios and helper-backed terms. The first grounded slot `0x13` already resolves through `company_compute_public_support_vote_scalar` at `0x00424fd0`, while nearby governance callers also use slots such as `0x1f`, `0x29`, `0x2b`, and `0x2c` in the annual shareholder-revolt and creditor-warning lane surfaced by localized ids `300..304`. This now looks like a generic company support-and-governance metric dispatcher rather than a merger-only issue reader. | objdump + caller inspection + metric-slot correlation + governance-string correlation |
| 36 | 0x0042a5d0 | 131 | company_read_year_or_control_transfer_metric_value | simulation | thiscall | inferred | objdump + caller inspection + RT3.lng strings | 3 | Reads one company-side float from either a year-relative stat series or the local support-and-governance metric slot family. When the family argument is `0x2329` or one of the neighboring current-year offsets, the helper resolves one year-relative table entry from the series rooted at `[this+0x0d7f]`; when the request falls back to the bounded slot family it delegates to `company_read_control_transfer_metric_slot` at `0x0042a2e0`. The `0x2329` token is no longer treated as an issue id here: it is the stat-family selector paired with the localized company-stat label id `2329`, and current grounded callers use this wrapper beneath merger, takeover, bankruptcy, annual shareholder-revolt, creditor-liquidation, and other company-policy dialogs to fetch yearly or current support-side values. This makes the helper a generic company stat reader rather than an issue-specific vote formula. | objdump + caller inspection + RT3.lng strings + stat-family correlation + governance-string correlation |
| 37 | 0x0042c690 | 311 | placed_structure_rebuild_candidate_cargo_service_bitsets | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Rebuilds two per-cargo bitsets on one placed-structure or site record using the live structure-candidate collection at `0x0062ba8c`. The helper clears the bitsets rooted at `[this+0x0d8]` and `[this+0x0df]`, walks the linked placed-structure chain starting at `[this+0x0d6]` through `0x0062b26c`, selects only linked instances whose backing candidate resolves through vtable `+0x80` with category byte `2`, and then scans the live candidate collection for entries that pass `structure_candidate_is_enabled_for_current_year` at `0x0041e220`. For each passing candidate it queries the direct and scaled supply-side cargo channels through the wrappers at `0x00412960` and `0x004129a0`; positive direct supply sets bits in `[this+0x0df]`, while positive scaled supply on candidates with runtime cargo state at `[candidate+0x78c]` sets bits in `[this+0x0d8]`. Current grounded callers sit immediately above the sibling helper at `0x0042cdf0`, which makes this the strongest current steady-state consumer of the rebuilt editor cargo runtime tables rather than a pure setup path. | objdump + caller xrefs + callsite inspection + cargo-summary correlation |
| 38 | 0x0042c8f0 | 112 | placed_structure_refresh_linked_candidate_flag4 | map | thiscall | inferred | objdump + caller xrefs + linked-instance inspection | 3 | Refreshes bit `0x4` in the placed-structure state byte at `[this+0x0e6]` from the currently linked placed-instance chain rooted at `[this+0x0d6]`. The helper walks linked instances through `0x0062b26c`, keeps only entries whose backing instance passes `0x0040c990 == 1`, resolves each surviving instance through vtable slot `+0x80`, and sets the local flag when any resolved candidate record has nonzero byte `[candidate+0xba]`; otherwise it clears that bit. Current grounded callers are the immediate wrapper `0x0042cdf0` plus the relink helpers at `0x0042c9a0` and `0x0042c9f0`, so this looks like the sibling state refresh that runs beside the cargo-service bitset rebuild even though the exact player-facing meaning of `[candidate+0xba]` is still open. | objdump + caller xrefs + linked-instance inspection + candidate-flag correlation |
| 39 | 0x0042cb30 | 124 | placed_structure_clamp_candidate_service_age_table | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Late clamp pass over the primary per-candidate word table rooted at `[this+0x00]`. When the site owns a nonzero route latch at `[this+0x0d4]` and `0x0042c880` signals the pass should run, the helper walks every live non-remapped candidate, queries one route-linked age or freshness value through `0x0042c110`, shifts that result into the local word-table scale, and replaces `[this+candidate*2]` with the smaller of the current value and the new clamp. Current grounded callers are the local bundle wrapper `0x0042d580` and the later world-grid sweep at `0x00450133`, so this now looks like the final recent-service clamp on the local candidate age table rather than another raw scoring helper. | objdump + caller xrefs + callsite inspection + route-age correlation |
| 40 | 0x0042cbb0 | 145 | placed_structure_route_supports_candidate_local_service_mode | map | thiscall | inferred | objdump + caller xrefs + route-record inspection | 3 | Boolean route-linked predicate for one candidate-local service branch. The helper walks the route or service record chain owned by the current site through `[this+0x0d4]` and collection `0x006cec20`, reads one candidate-indexed float lane at `[route+0x3e]`, and compares the route-side threshold at `[route+0x112]` against the current local word-table value for that candidate after scaling through `0x00437d20`. It returns `1` on the first matching route record and `0` otherwise. Current grounded caller is `placed_structure_rebuild_candidate_local_service_tables` at `0x0042ce00`, where this predicate selects one of the route-backed scoring transforms. | objdump + caller xrefs + route-record inspection + candidate-table correlation |
| 41 | 0x0042cc50 | 402 | placed_structure_apply_route_linked_service_caps | map | thiscall | inferred | objdump + caller xrefs + route-record inspection | 3 | Route-linked cap pass over the aligned local service tables. The helper walks the route or service record chain rooted at `[this+0x0d4]` through `0x006cec20`, then for each live non-remapped candidate that passes `structure_candidate_is_enabled_for_current_year` it compares the route-side candidate float at `[route+0x42]` against the current site float table at `[this+0x107]` and the current primary word-table value at `[this+0x00]`. When the route-linked ratio stays inside the live clamp window it writes a lower capped value back into the primary word table. Current grounded caller is the composite local refresh `0x0042d580`, so this now looks like the first route-backed cap pass that shapes the rebuilt local service tables before the later neighborhood redistribution and recent-service clamp run. | objdump + caller xrefs + route-record inspection + local-table correlation |
| 42 | 0x0042cdf0 | 16 | placed_structure_refresh_candidate_service_state | map | thiscall | inferred | objdump + caller xrefs + wrapper inspection | 4 | Tiny composite refresh for one placed-structure or site record. The helper first rebuilds the candidate cargo-service bitsets through `placed_structure_rebuild_candidate_cargo_service_bitsets` at `0x0042c690`, then tail-calls `placed_structure_refresh_linked_candidate_flag4` at `0x0042c8f0` to refresh the sibling state bit at `[this+0x0e6]`. Current grounded callers include the world-grid sweep at `0x00450003`, so this now looks like the common steady-state placed-structure service-state refresh immediately above the editor-driven cargo runtime tables. | objdump + caller xrefs + wrapper inspection |
| 43 | 0x0042ce00 | 1394 | placed_structure_rebuild_candidate_local_service_tables | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Large per-site rebuild over the live candidate collection at `0x0062ba8c`. The helper walks every candidate with live runtime state at `[collection+0x16e]` and no remap entry at `[collection+0x9a]`, decays positive floats in the aligned per-candidate table rooted at `[this+0x107]`, and commits those float updates back through `0x0041e1b0`. It then combines that float table with two aligned per-candidate word tables rooted at `[this+0x02]` and `[this+0x6c]`, the direct-supply cargo bitset at `[this+0x0df]`, the site-side latch at `[this+0x0d4]`, and the branch predicate `0x0042cbb0` to choose among several normalized scoring transforms before writing the quantized result back into the destination word table. Current grounded callers now put this directly under the local wrapper at `0x0042d580`, so this looks like the first real site-side candidate service-score rebuild above the editor-driven cargo runtime lane rather than another candidate-only helper. | objdump + caller xrefs + callsite inspection + table-layout correlation |
| 44 | 0x0042d580 | 26 | placed_structure_refresh_local_service_score_bundle | map | thiscall | inferred | objdump + caller xrefs + wrapper inspection | 4 | Composite local-service refresh for one placed-structure or site record. The helper first runs `placed_structure_rebuild_candidate_local_service_tables` at `0x0042ce00`, then immediately chains into the neighboring local post-passes at `0x0042cc50`, `0x0042c1b0`, and `0x0042cb30` before returning. Current grounded caller is the world-grid sweep at `0x00450110`, which uses this as the stronger per-site local-service refresh after the lighter cargo-service-state pass at `0x00450003`. | objdump + caller xrefs + wrapper inspection |
| 45 | 0x00428a10 | 22 | company_clear_selected_chairman_if_current_profile | simulation | thiscall | inferred | objdump + caller inspection | 4 | Clears the linked chairman for the current company when the supplied profile id matches `[this+0x3b]`. On a match the helper zeroes the incoming profile id and tail-calls `0x00427c70`; otherwise it returns without changing company state. Current grounded shell caller is `shell_company_detail_resign_chairmanship_flow`, which uses this as the commit step behind the localized resignation confirmation. | objdump + caller inspection + chairman-link correlation |
| 46 | 0x00424fd0 | 751 | company_compute_public_support_vote_scalar | simulation | thiscall | inferred | objdump + caller inspection | 3 | Computes one bounded public-support scalar used by company policy, takeover or merger voting, and the adjacent annual governance lane. The helper starts from `company_compute_cached_recent_performance_support_score` at `0x004248d0`, blends that score with the company-side field `[this+0x57]`, applies extra startup or age smoothing when the current year is still within five years of `[this+0x157]`, and optionally updates the mutable support field `[this+0x4f]` when the caller supplies nonzero control arguments. It then folds in company value `[this+0x47]`, one profile or company affinity term from `0x00436590`, the current linked chairman id `[this+0x3b]`, and one difficulty table under `0x005f33b8`, clamps the result into a bounded 0-to-positive range, and returns the final float. Current grounded callers include the merger vote resolver at `0x004ebd10`, the company-side takeover and policy family, and the annual shareholder-revolt or creditor-pressure path that surfaces localized ids `300..304`. The direct scenario-state issue lane here uses issue id `0x37`, which now looks like the broader company-management or public-sentiment slot rather than the narrower merger-only management-attitude slot. | objdump + caller inspection + support-field correlation + issue-id correlation + governance-string correlation |
| 47 | 0x00429990 | 86 | company_collection_get_nth_active_company_id | simulation | thiscall | inferred | objdump + caller inspection | 4 | Returns the company id of one requested active-company ordinal within the live company collection rooted at `0x0062be10`. The helper linearly walks collection slots through `0x00518380`, tests the active company-state flag at `[entry+0x3f]`, decrements the caller-supplied ordinal only for active entries, and returns the first company id whose active ordinal matches zero. Current grounded callers use it as the forward mapping between active-company page indices and concrete company ids in shell-side roster, detail, and picker flows. | objdump + caller inspection + active-company roster correlation |
| 48 | 0x004299f0 | 84 | company_collection_count_active_companies_before_company_id | simulation | thiscall | inferred | objdump + caller inspection | 4 | Counts how many active companies precede one requested company id in the live company collection at `0x0062be10`. The helper linearly walks collection slots through `0x00518380`, stops when the entry id matches the requested company id, and increments the return counter only for active entries whose state flag at `[entry+0x3f]` is nonzero. Current grounded callers use this as the inverse mapping for shell-side company paging and company-relative selector paths before converting back through `company_collection_get_nth_active_company_id` at `0x00429990`. | objdump + caller inspection + active-company roster correlation |
| 49 | 0x00429a50 | 62 | company_collection_count_active_companies | simulation | thiscall | inferred | objdump + caller inspection | 4 | Counts active companies in the live company collection rooted at `0x0062be10`. The helper walks collection slots through `0x00518380`, resolves each record through `0x00518140`, and increments the total only when the active-state flag at `[entry+0x3f]` is nonzero. Current grounded callers use this as the active-company roster size for shell-side company browsing and neighboring selector math. | objdump + caller inspection + active-company roster correlation |
| 50 | 0x00434300 | 881 | world_runtime_release_global_services | map | cdecl | inferred | objdump + analysis-context | 3 | Releases or clears a broad set of world-runtime global services owned by the current map object before a new world entry or sibling save branch continues. The helper walks the owner collection at [this+0x66b2] and then touches many global manager slots including 0x0062b244 0x0062cfcbc 0x0062be10 0x0062c120 0x0062ba8c 0x0062ba88 0x0062b2fc 0x0062b268 0x006cea4c and 0x006acd34 through repeated release-style calls and nulling writes. Current grounded callers are the heavier world-entry branch at 0x00443a50 the sibling .smp world-state branch at 0x00446d40 and shell_transition_mode at 0x00482ec0. | objdump + analysis-context + caller xrefs |
| 51 | 0x0043cb00 | 295 | world_view_step_heading_quadrant | shell | thiscall | inferred | objdump + caller xrefs | 3 | Applies one discrete heading-step command to the live world-view owner at 0x0062be68. The helper quantizes the current heading-like field [this+0x10] into one of four wrapped sectors derives the neighboring sector selected by the signed caller step and writes the resulting snapped heading back before rebuilding the dependent view state through 0x0043a750 0x0052d640 and 0x0043bde0. Current grounded callers are the paired shell UI command branches at 0x004de83d and 0x004de857 so this looks like the discrete rotate-view command family rather than free camera drag. | objdump + caller xrefs + callsite inspection |
| 52 | 0x0043cc30 | 437 | world_view_step_zoom_bucket | shell | thiscall | inferred | objdump + caller xrefs | 3 | Applies one discrete zoom or view-height bucket step to the live world-view owner at 0x0062be68. It derives a seven-entry threshold table under 0x005ee4dc and 0x0062be4c compares the current view-height field [this+0x18] against those thresholds chooses the neighboring bucket selected by the signed caller step clamps the result into the supported range and then rebuilds the dependent view state through 0x0043c610 0x00439820 and 0x0043bde0. Current grounded callers are the signed shell UI command pair at 0x004de871 and 0x004de88b and the keyboard-owned smoothing branch inside world_view_service_shell_input_pan_and_hover at 0x0043dca4. | objdump + caller xrefs + callsite inspection |
| 53 | 0x0043d050 | 111 | world_view_set_focus_position_xyz | shell | thiscall | inferred | objdump + caller xrefs | 4 | Stores one new world-view focus position into the owner at 0x0062be68 by updating [this+0x04] [this+0x08] and [this+0x0c] as the requested X Y and Z coordinates then rebuilding the dependent view state through 0x0043cec0 0x0043a750 0x0052d640 0x00439820 and 0x0043b0e0. The helper also clamps the view-height or distance field at [this+0x18] before recomputing the derived pitch-like field at [this+0x14]. Current grounded callers are the screen-delta wrapper at 0x0043d0c0 the relative pan helper at 0x0043d130 and two larger world-view service branches at 0x0043ee76 and 0x0043f32d. | objdump + caller xrefs |
| 54 | 0x0043af60 | 205 | world_view_should_drive_primary_pan_channel | shell | thiscall | inferred | objdump | 3 | Returns whether the world-view owner should drive its primary pan channel on this pass. The predicate first honors the latched override at [this+0xa2] then checks several shell-view gates through 0x00543e00 0x00543e20 and 0x00543e40 on the active controller node plus one optional guard under 0x006d1a8c and the world-mode flag at [0x006cec74+0x120]. When the controller view is active it also treats packed shell input bits 0x3 in 0x006d4018+0xa8c as one enabling condition; `shell_input_apply_window_key_transition` grounds those bits as the left and right Shift modifiers from scan codes 0x2a and 0x36 which ties held Shift state back into the same world-view pan family. Current grounded callers sit in the larger recurring world-view input service at 0x0043db00 and the smaller motion helper at 0x0043e610. | objdump + callsite inspection |
| 55 | 0x0043b030 | 173 | world_view_should_drive_secondary_pan_channel | shell | thiscall | inferred | objdump | 3 | Returns whether the world-view owner should drive its secondary pan channel on this pass. Like the neighboring primary predicate it combines shell controller view gates through 0x00543e00 0x00543e20 and 0x00543e40 optional suppression under 0x006d1a8c and one world-mode check at [0x006cec74+0x120]; when the active controller view is present it also treats packed shell input bits 0x3 in 0x006d4018+0xa8c as an enabling condition. Those bits are now grounded as the left and right Shift modifiers from scan codes 0x2a and 0x36 rather than an opaque gameplay-only flag source. Current grounded callers sit in the larger recurring world-view input service at 0x0043db00 and in the smaller motion helpers at 0x0043e610 and 0x0043f4f0. | objdump + callsite inspection |
| 56 | 0x0043d0c0 | 111 | world_view_apply_screen_delta_to_focus_position | shell | thiscall | inferred | objdump + caller xrefs | 4 | Converts one screen-relative drag delta into a new world-view focus position and forwards it through world_view_set_focus_position_xyz. When the auxiliary object at [this+0x6e] is live it samples a derived center or height term through 0x00534490 and scales both incoming deltas by the world-view projection constant at 0x005c8700 before calling the lower focus-position setter. The current grounded caller is the cursor-drag helper at 0x00478d31 inside the larger input loop at 0x00478cb0. | objdump + caller xrefs |
| 57 | 0x0043d130 | 292 | world_view_pan_relative_offset_in_camera_plane | shell | thiscall | inferred | objdump + caller xrefs | 4 | Applies one local X/Z pan offset to the world-view owner at 0x0062be68 in the current camera plane and forwards the result through world_view_set_focus_position_xyz. The helper derives a scale from the active view-height field [this+0x18] rotates the incoming offset by the current heading-like field [this+0x10] through sine and cosine calls at 0x005a13e4 and 0x005a1494 adds the rotated result onto the current world focus position in [this+0x04] and [this+0x0c] preserves the current Y term in [this+0x08] and then calls the lower focus-position setter. Current grounded callers are the GameUppermost hotspot path at 0x004e094b and the keyboard-owned service branch inside world_view_service_keyboard_turn_and_pan_bindings at 0x0043dae4 which together indicate a shared world-view pan action rather than a separate gameplay command dispatcher. | objdump + caller xrefs |
| 58 | 0x0043d740 | 937 | world_view_service_keyboard_turn_pan_and_zoom_bindings | shell | thiscall | inferred | objdump + callsite inspection | 4 | Keyboard-driven world-view interaction helper beneath world_view_service_shell_input_pan_and_hover. It samples elapsed wall-clock time through 0x0051d890 against the previous timestamp at 0x0062be74 clamps the per-pass delta into the 0x08 through 0xc8 range and polls four configurable binding-pair families through the shell input table at 0x006d4018 via 0x0054e7d0. The first two pair families at [this+0x0a6] through [this+0x0b2] and [this+0x0b6] through [this+0x0c2] now ground as the default `Camera Forward` or `Camera Backward` pair and `Camera Left` or `Camera Right` pair. The third family at [this+0x0c6] through [this+0x0d2] produces a signed zoom-step or view-height delta that is returned through the caller-owned out-parameter for later smoothing and grounds as the default `Camera Zoom In` or `Camera Zoom Out` pair, while the fourth family at [this+0x0d6] through [this+0x0e2] applies continuous heading turns through 0x0043c810 and grounds as the default `Camera Rotate Left` or `Camera Rotate Right` pair. When the pan families are active the helper reaches world_view_pan_relative_offset_in_camera_plane at 0x0043d130 after checking the active world-view state. Current grounded caller is world_view_service_shell_input_pan_and_hover at 0x0043db00. | objdump + callsite inspection + caller xrefs + registration xrefs + RT3.lng |
| 59 | 0x00439e40 | 557 | world_view_seed_keyboard_binding_slot_pairs | shell | thiscall | inferred | objdump + callsite inspection | 4 | Initializes the eight world-view keyboard binding slot pairs rooted at [this+0x0a6] through [this+0x0e2]. The helper zeroes the paired 4-byte fields then queries the global action-binding registry through 0x0045f370 using eight distinct stub roots at 0x0043d2a0 through 0x0043d310. The registration block at 0x00460769 through 0x004608e7 plus `Data/Language/RT3.lng` show those eight roots are seeded as four labeled directional pairs: `Camera Forward` id 0x0d8a on Up, `Camera Backward` id 0x0d8b on Down, `Camera Left` id 0x0d8c on Left, `Camera Right` id 0x0d8d on Right, `Camera Zoom In` id 0x0d8e on Up, `Camera Zoom Out` id 0x0d8f on Down, `Camera Rotate Left` id 0x0d90 on Left, and `Camera Rotate Right` id 0x0d91 on Right. The first bank feeds the pan pairs later consumed at [this+0x0a6] through [this+0x0c2], while the second bank feeds the zoom-step and heading-turn pairs later consumed at [this+0x0c6] through [this+0x0e2]. After the registry lookups the helper normalizes several legacy companion values across all eight pairs by remapping 0x2 to 0x10 0x20 to 0x12 and 0x4 to 0x11 before storing the results back. This now looks like the live world-view setup path above world_view_service_keyboard_turn_pan_and_zoom_bindings at 0x0043d740 rather than a separate config-side binding store. | objdump + callsite inspection + callee inspection + registration xrefs + RT3.lng |
| 60 | 0x0043db00 | 1968 | world_view_service_shell_input_pan_and_hover | shell | thiscall | inferred | objdump + callsite inspection | 4 | Recurring world-view service that fuses shell input state into the live world-view owner at 0x0062be68. It begins by delegating keyboard-bound turn pan and zoom work to world_view_service_keyboard_turn_pan_and_zoom_bindings at 0x0043d740 then samples controller and view state through 0x00543c50 and 0x00543ba0 caches successive shell input coordinates from 0x006d4018 offsets 0xa94 and 0xa98 derives smoothed cursor or hover deltas against [this+0x2f6] [this+0x2fa] and [this+0x2fe] updates one world-under-cursor cache through 0x00448ac0 and 0x00448bd0 and refreshes the GameUppermost overlay through 0x004e0730 when the pan state changes. The helper repeatedly consults world_view_should_drive_primary_pan_channel at 0x0043af60 and world_view_should_drive_secondary_pan_channel at 0x0043b030 drives one of the lower motion branches at 0x0043e610 0x0043f4f0 or 0x0043e2c0 and smooths the keyboard zoom-step channel through the shared accumulator at 0x0062be78 before issuing discrete view-height bucket steps through world_view_step_zoom_bucket at 0x0043cc30. Current grounded callers include the recurring world-frame path at 0x00439730 and two setup or transition loops at 0x00516859 and 0x00516921. This now looks like the shared shell-input coordinator above keyboard turn pan zoom cursor drag and hotspot world-view motion rather than a mouse-only helper. | objdump + callsite inspection + caller xrefs |
| 61 | 0x00439140 | 1086 | simulation_frame_accumulate_and_step_world | simulation | cdecl | inferred | objdump + analysis-context | 4 | Frame-owned simulation cadence after world bring-up and still directly called from shell_service_pump_iteration at 0x00483f70 rather than a separately grounded outer gameplay loop. The routine samples elapsed time through 0x0051d890 mixes shell and mode scalars into a simulation quantum keeps leftover fractional time in [this+0x4c80] and when enough time has accumulated repeatedly calls simulation_advance_to_target_calendar_point at 0x0040ab50 using the current step quantum from 0x005f2b38. Around those simulation steps it refreshes shell-facing presentation helpers under 0x006d4024 and 0x006d0818 updates multiple world collections and transport or scenario side structures and services the recurring GameMessage.win branch through 0x004e0720 before later follow-up work. One deeper world-mode sidecar inside the same frame path now looks grounded too: after delegating to world_view_service_shell_input_pan_and_hover at 0x0043db00 the frame compares the active controller-view pointer at [0x006d4024+0x18]+0x366e against the latched world object at [this+0x66a2], releases the previous object through vtable slot +0x64, and when the new object passes its own availability test at slot +0x1c plus shell-detail control gate 0x07d6 on 0x006d0818 it latches the new object and calls slot +0x60. That makes the frame owner the first grounded non-camera world-input coordinator for hover or focus-target transitions beneath the shell-fed camera stack, even though click or command semantics are still unresolved. This is the strongest grounded owner so far for the recurring gameplay simulation cadence that follows world_entry_transition_and_runtime_bringup. | objdump + analysis-context + caller xrefs + callsite inspection |
| 62 | 0x004384d0 | 570 | world_run_post_load_generation_pipeline | map | cdecl | inferred | objdump + strings + caller xrefs | 4 | Large post-load world-generation pipeline reached after world entry and shell-side file-load success paths. It increments the world-root generation counter at `[0x0062c120+0x2205]`, can run one preliminary branch through `0x00437743`, and then advances through a more bounded staged setup sequence with shell progress updates through `0x004834e0`. The visible banner order is now grounded from the direct string ids in the function body: id `318` `Computing Transportation and Pricing...` is posted first and remains active while the pipeline runs world_compute_transport_and_pricing_grid at `0x0044fb70`, the early collection pass world_setup_building_collection_phase at `0x0041ea50`, and the conditional region pair world_region_collection_seed_default_regions at `0x00421b60` plus world_region_border_overlay_rebuild at `0x004882e0`; only after those complete does the pipeline post id `319` `Setting up Players and Companies...`. That `319` lane is no longer just gate plumbing: the primary grounded work there is still the chairman-profile pair world_seed_default_chairman_profile_slots at `0x004377a0` plus world_build_chairman_profile_slot_records at `0x00437220`, but current neighboring setup flow also exposes one conditional company-side helper at `0x0047d440` under sandbox or non-editor shell-state conditions. Current evidence is tighter on the remaining gates too: `[0x006cec74+0x68]` now aligns with the editor-map `.gmp` mode in the shell file coordinators and acts as the broader master editor-mode flag that suppresses both later world-generation branches and diverts region-side calculations into alternate paths; `[0x006cec74+0x174]` is the direct building-population gate above id `320` `Setting Up Buildings...` and world_region_collection_run_building_population_pass at `0x00421c20`; `[0x006cec74+0x178]` is the direct seeding-burst gate above id `321` `Seeding Economy...` and simulation_run_chunked_fast_forward_burst at `0x00437b20`; and id `322` `Calculating Heights...` finishes through `0x0044d410`. The body fans into the live world root at `0x0062c120`, manager collections `0x0062ba8c`, `0x0062bae0`, and `0x006cfc9c`. Current grounded callers are the world-entry side around `0x004390ea` and the shell file-load side around `0x004dccfc`. | objdump + RT3.lng strings + caller xrefs + callsite inspection + file-flow correlation |
| 63 | 0x00435630 | 648 | scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables | map | thiscall | inferred | objdump + caller xrefs + state-layout inspection | 4 | Rebuilds the runtime port-or-warehouse cargo-line tables from the scenario-side recipe-book state rooted at `[this+0x0fe7]`. The helper first biases into the recipe-book payload at `[this+0x13d4]`, then iterates all `12` recipe-book blocks in `0x4e1`-byte steps. For each book it clamps the shared maximum annual production float that precedes the first line, counts active lines across five repeated `0x30`-byte line records, and then imports those five lines into one parallel runtime array of `0xbc`-byte descriptors. The importer treats every line slot symmetrically rather than special-casing any row index: each slot reads one mode dword, one annual amount, and two cargo-token strings, resolves nonempty cargo strings through the global cargo collection at `0x0062ba8c`, and builds paired runtime halves for the mode families `2/3` and `1/3`. Current mode gating is now tight enough to treat the polarity as grounded rather than provisional: the source token at `line+0x08` is the supplied-cargo field because it is the branch activated for `Supply Only` and `Production Demand->Supply`, while the source token at `line+0x1c` is the demanded-cargo field because it is the branch activated for `Demand Only` and `Production Demand->Supply`. The constructor and handler now tighten the amount semantics too: `line+0x04` is the per-line annual-demand field only in mode `1`, but it becomes the annual-supply field in modes `2/3`. The importer matches that split by copying `line+0x04` directly into the supply-side runtime half for modes `2/3`, while the production-mode demand half is normalized to `1.0` rather than reusing the entered amount. That makes the five editor-side row entries look like generic cargo-line slots rather than five fixed named production roles. Current grounded callers include the scenario-state initializer at `0x00436ee0`, world-load or map-entry side branches at `0x00443ebc`, `0x00444ac1`, and `0x00448126`, plus the live editor page constructor at `0x004cf935`. | objdump + caller xrefs + state-layout inspection + cargo-collection correlation + mode-table correlation + constructor correlation |
| 64 | 0x00437b20 | 218 | simulation_run_chunked_fast_forward_burst | simulation | thiscall | inferred | objdump | 3 | Shell-mediated burst advance helper above simulation_advance_to_target_calendar_point. It marks a local fast-forward latch at `[this+0x46c38]`, derives one loop count from shell-state `0x006cec74+0x178` and active-mode flag `[0x006cec78+0x4af7]`, then repeatedly advances the world toward fixed target `0x05a0` through simulation_advance_to_target_calendar_point while pumping the shell-side service helper at `0x004834e0` between chunks. After the burst it clears the latch, sweeps the world collection at `0x0062bae0`, and tails into the neighboring cleanup path at `0x00434d40`. The current grounded owner is world_run_post_load_generation_pipeline at `0x004384d0`, where the helper sits behind shell-state gate `[0x006cec74+0x178]` under the localized `Seeding Economy...` phase after the earlier transportation-pricing and building-setup work has already run. This keeps the helper on the map or scenario setup side rather than the ordinary player-facing speed-control path. | objdump + caller context + RT3.lng strings + phase ordering |
| 65 | 0x00434680 | 435 | world_set_game_speed_mode | simulation | thiscall | inferred | objdump + strings | 3 | Primary game-speed setter for the live world object. It clamps the requested mode against the normal `0..5` range or the wider `0..9` range when shell-state gate `[0x006cec74+0x2c8]` is active, stores the current mode at `[this+0x19]`, preserves the nonzero resume mode at `[this+0x1d]`, updates the shell detail control `0x74` when `0x006d0818` is live, and can format the localized status line `Game Speed: %1` using speed labels `Paused` through `Very Fast` and the hidden `Ultra Fast 6..9` strings. When the caller requests propagation and the multiplayer preview path is active it also routes the new speed through the multiplayer-side handoff around `0x00407870`, which matches the localized restriction `Only the host may change the game speed.` | objdump + RT3.lng strings + multiplayer handoff |
| 66 | 0x00434850 | 19 | world_adjust_game_speed_mode_delta | simulation | thiscall | inferred | objdump | 3 | Small relative front end over world_set_game_speed_mode. It adds the signed caller delta to the current mode at `[this+0x19]` and then re-enters world_set_game_speed_mode with both notification and propagation flags enabled. | objdump + callee inspection |
| 67 | 0x00437220 | 279 | world_build_chairman_profile_slot_records | map | thiscall | inferred | objdump + strings + caller xrefs | 4 | Post-load chairman-profile materialization pass reached under banner id `319` `Setting up Players and Companies...`. The helper first refreshes one local occupancy map through `0x0047bc80`, optionally waits on the multiplayer preview owner at `0x006cd8d8`, then walks the 16 selector bytes at `[0x006cec7c+0x87]` together with the per-slot staging table rooted at `[this+0x69d8]`. Current slot-field semantics are tighter now: `[slot+0x00]` is the staged chairman profile id, `[slot+0x01]` is the Optional-versus-Mandatory byte with nonzero=`Optional` and zero=`Mandatory`, `[slot+0x02]` is the ordinary seat-enable byte that combines with the separate per-slot gate at `[this+0x0bc3+slot*9]` to surface `Human`, `Computer`, and `Human or Computer`, `[slot+0x03]` is the special occupied-seat byte, and `[slot+0x04]` is the numeric tuning field copied into the resolved profile. Zero selectors take the random unused-profile path; nonzero selectors map directly onto one persona index; and campaign mode at `[0x006cec7c+0xc5]` can override back through the scenario slot table. Each resolved profile record is pulled from the global persona collection at `0x006ceb9c`, formatted through `0x0050a16f`, and seeded from the static persona table at `0x005f2d28`, whose localized ids include `2730` `Unassigned`, the named-chairman range `2731+`, and the adjacent biography range `2495+`. Both this helper and the neighboring selector seeder treat either `[slot+0x02]` or `[slot+0x03]` as enough to keep a slot live, but current grounded writes only seed `[slot+0x03]` on slot zero and later move it solely by whole-record compaction. That makes `[slot+0x03]` the strongest current anchor for the distinguished primary-human-seat marker rather than a generic role byte. The helper leaves one per-slot record family live in the resolved persona objects, stores per-profile numeric tuning from `[slot+0x04]` into `[profile+0x154]` and `[profile+0x158]`, and finishes by writing the selected profile id to `[this+0x25]` plus the linked owner-company id from `[profile+0x1dd]` to `[this+0x21]`. Current grounded callers are the main post-load generation pipeline at `0x004384d0` and the saved-runtime restore side around `0x00444b79`. | objdump + RT3.lng strings + caller xrefs + table inspection + shell editor cross-check |
| 68 | 0x004377a0 | 693 | world_seed_default_chairman_profile_slots | map | thiscall | inferred | objdump + caller xrefs + strings | 4 | Seeds the 16 scenario-side chairman selector bytes at `[0x006cec7c+0x87]` from the local chairman-slot table rooted at `[this+0x69d8]` before the later profile-record materialization pass runs. In editor-map mode the helper first compacts the 16 local 9-byte slot records so occupied slots bubble forward whenever a later slot has either the ordinary seat-enable byte `[slot+0x02]` or the special occupied-seat byte `[slot+0x03]` set and an earlier slot has neither; it then clears selectors for empty slots and assigns deterministic defaults for occupied ones, using selector `1` for the first occupied slot and selector `0x64+n` for later occupied slots. The same slot layout is now bounded more tightly by the editor window family around `0x004cc2d0`: `[slot+0x00]` is the staged chairman profile id, `[slot+0x01]` is the Optional-versus-Mandatory flag with nonzero=`Optional` and zero=`Mandatory`, `[slot+0x02]` is the ordinary seat-enable byte, `[slot+0x03]` is the special occupied-seat byte, and `[slot+0x04]` is the numeric tuning field. Current grounded writes seed `[slot+0x03]` on slot zero and the compaction pass moves it only by swapping whole 9-byte records, which matches the selector policy: one distinguished first slot gets selector `1`, and the remaining occupied slots get the `0x64+n` opponent range. After the selector seeding pass it walks the selector array, resolves each chosen persona through the global collection at `0x006ceb9c`, constructs or refreshes the per-profile record through `0x00476140`, copies the numeric tuning field from `[slot+0x04]` into `[profile+0x154]` and `[profile+0x158]`, and finally seeds the scenario-state summary pair from the first persona entry: `[this+0x25]` becomes the selected profile id while `[this+0x21]` becomes the linked owner-company id through `[profile+0x1dd]`. Current grounded caller is the neighboring world bring-up path around `0x00438692`, where this helper runs after the setup-side burst branch and immediately before the localized `Calculating Heights...` progress update. | objdump + caller xrefs + RT3.lng strings + slot-table inspection + shell editor cross-check |
| 69 | 0x00434870 | 23 | scenario_state_get_selected_chairman_company_record | map | thiscall | inferred | objdump + global-state inspection | 4 | Returns the currently selected company record for the shell-side scenario state object at `0x006cec78`. The helper reads `[this+0x21]` as a company id and resolves that id through the live company collection at `0x0062be10`; zero or negative ids return null. This is the clearest direct accessor yet for the summary field written by the post-load chairman-profile lane. | objdump + global-state inspection + caller correlation |
| 70 | 0x00434890 | 35 | scenario_state_set_selected_chairman_profile | map | thiscall | inferred | objdump + global-state inspection | 4 | Sets the currently selected chairman profile on the shell-side scenario state object at `0x006cec78`. The helper stores the incoming persona id into `[this+0x25]`, resolves that persona through the global profile collection at `0x006ceb9c`, and then copies the linked owner-company id from `[profile+0x1dd]` into `[this+0x21]`. This grounds the summary pair used by the post-load chairman-profile setup lane: `[state+0x25]` is the selected chairman profile id and `[state+0x21]` is the corresponding owning company id. | objdump + global-state inspection + caller correlation |
| 71 | 0x004348c0 | 23 | scenario_state_get_selected_chairman_profile_record | map | thiscall | inferred | objdump + global-state inspection | 4 | Returns the currently selected chairman profile record for the shell-side scenario state object at `0x006cec78`. The helper reads `[this+0x25]` as a profile id and resolves it through the global persona collection at `0x006ceb9c`; zero or negative ids return null. This pairs directly with scenario_state_set_selected_chairman_profile at `0x00434890`. | objdump + global-state inspection + caller correlation |
| 72 | 0x00436590 | 372 | scenario_state_compute_issue_opinion_multiplier | simulation | thiscall | inferred | objdump + caller inspection | 4 | Computes one bounded opinion multiplier for a caller-selected issue slot on the active scenario or shell state rooted at `0x006cec78`. The helper starts from the base issue term at `[this + issue*4 + 0x8a]`, clamps that raw value to a floor of `-99`, normalizes it into a multiplier around `1.0`, and then optionally folds in up to three issue-specific override tables: a company-side term from `[company + issue*4 + 0x35b]`, a chairman-profile term from `[profile + issue*4 + 0x2ab]`, and a territory-side term from `[territory + issue*4 + 0x3b5]`. When the profile argument is omitted but a valid company is supplied, it implicitly reuses that company's linked chairman id from `[company+0x3b]`. The final multiplier is clamped to a small positive floor near `0.01` before return. Current grounded callers include the public-support blend helper at `0x00424fd0`, the merger vote resolver at `0x004ebd10` with issue id `0x3a`, and several other company-policy and shell-side opinion branches. The merger-side `0x3a` use now lines up directly with `RT3.lng` id `726`, which says public merger votes depend on their attitude toward the management of the two companies, so this issue slot is now best read as the merger-management-attitude multiplier. | objdump + caller inspection + issue-table correlation + merger-text correlation |
| 73 | 0x00437a60 | 41 | world_toggle_pause_or_restore_game_speed | simulation | thiscall | inferred | objdump + strings | 3 | Pause or resume toggle over the world game-speed fields. When the current mode at `[this+0x19]` is above zero it re-enters world_set_game_speed_mode with target `0` to pause; otherwise it restores the saved nonzero resume mode from `[this+0x1d]`. This matches the player-facing speed-control family rooted in `Paused` through `Very Fast` and their tooltips in `RT3.lng` ids `1795..1800`. | objdump + RT3.lng strings |
| 74 | 0x00443a50 | 1073 | world_entry_transition_and_runtime_bringup | map | cdecl | inferred | objdump + analysis-context | 4 | First grounded gameplay-world entry coordinator reached from shell_map_file_entry_coordinator. It stages the selected file path into 0x0062bee0 dismisses the shell detail-panel controller at 0x006d0818 drives shell_transition_mode through 0x00482ec0 and shell_state_service_active_mode_frame then marks shell state for the transition and resets the previous world bundle through world_runtime_release_global_services and the neighboring allocator branch at 0x00438890. After the transition wait it builds temporary bundle payloads from %1\\%2 and %1.tmp allocates or serializes several world-entry records through 0x00530c80 0x00531150 and 0x00531360 allocates the new world root at 0x0062c120 from the staged filename through 0x0044e910 notifies the shell owner at 0x0062be68 and then initializes multiple world-facing global managers including 0x0062ba8c 0x0062b2fc 0x0062b26c and 0x006ada90. This now looks like the first real shell-to-gameplay world-entry bring-up path rather than shell-only staging. | objdump + analysis-context + caller xrefs + strings |
| 75 | 0x00444dd0 | 3301 | map_bundle_open_reference_databases | map | cdecl | inferred | ghidra-headless | 3 | Opens and registers a broad reference-database bundle for the active map path. The routine formats %1\\%2 paths allocates bundle state through 0x00530c80 and wires many global datasets including gpdLabelDB gpdCityDB and related city geographic and map reference tables before later shell and map loaders continue. | ghidra + rizin + llvm-objdump + strings |
| 76 | 0x00445ac0 | 790 | shell_map_file_entry_coordinator | map | cdecl | inferred | objdump + analysis-context | 4 | Broad shell-side file-open and restore coordinator reached from tutorial launch shell UI editor-panel flows and scenario batch processing. It accepts either an incoming filename seed or a generated Quicksave base name and then chooses between the heavier world-entry branch at 0x00443a50 and the sibling saved-runtime restore branch at 0x00446d40. Bit 0x1 in its flag argument now grounds the Quicksave path from the shared string table at 0x005ca9cc. The non-Quicksave interactive path is tighter now too: it routes through shell_file_request_dialog_collect_target_path at 0x004dd010 using load mode 4=.gmp when EditorPanel.win is live and the paired non-editor open modes 8=.gms 9=.gmc and 10=.gmx. The shell-state master flag `[0x006cec74+0x68]` now reinforces that same mapping on the direct Quicksave branch too: when it is nonzero the coordinator appends the `.gmp` token immediately instead of choosing among the scenario families, which makes the flag the strongest current shell-side anchor for editor-map mode rather than a generic post-load toggle. Current surrounding shell evidence now makes the non-editor trio much less anonymous: `.gmx` aligns with sandbox mode because the sibling shell branch at 0x004dc923 gates on 0x006cec7c+0x82 and surfaces string 3898 `The briefing is not available in sandbox games`; `.gmc` aligns with campaign scenarios because 0x004dc9cd gates on 0x006cec7c+0xc5 and surfaces string 3018 about resigning back to the campaign screen; the remaining default `.gms` branch is therefore the standalone scenario family. When a live runtime world is already active the helper appends .smp instead of the non-runtime extensions before the restore branch continues. | objdump + analysis-context + caller xrefs + strings + mode-table inspection + string correlation + Quicksave branch inspection |
| 77 | 0x00445de0 | 1115 | shell_map_file_world_bundle_coordinator | map | cdecl | inferred | objdump + analysis-context | 4 | Broad shell-side file-save and package coordinator used by direct shell commands scenario batch processing and neighboring shell-editor callers. It accepts either an incoming filename seed a generated Quicksave base name from flag bit 0x1 or the localized `Autosave` seed from flag bit 0x2 string id 387. Its non-Quicksave interactive path is now tighter: it routes through shell_file_request_dialog_collect_target_path at 0x004dd010 using save mode 3=.gmp for the editor-map package path 0=.gms for standalone scenarios 1=.gmc for campaign-scenario saves and 2=.gmx for sandbox saves plus one auxiliary 11=.gmt branch reached only through the separate 0x00434050 check on the side owner at 0x006cd8d8. The shell-state master flag `[0x006cec74+0x68]` now reinforces that editor mapping on the direct save and Quicksave side too: when it is nonzero the coordinator chooses the `.gmp` package mode immediately before the scenario-family checks, which makes the flag the strongest current shell-side anchor for editor-map mode rather than a generic setup toggle. That `.gmt` path no longer looks like another scenario family: when the auxiliary owner is present the coordinator packages the chosen path into the owner-local request block near 0x006cd8d8+0x8f48 and submits it through 0x00469d30; only when that owner is absent does it fall back to map_bundle_open_reference_databases at 0x00444dd0. The campaign mapping is now backed by the numbered `%s%02d.gmc` helper at 0x00517c70 which formats one campaign-progress slot from 0x006cec7c+0xc4 before re-entering this coordinator, while the sandbox mapping is backed by the neighboring shell restriction string 3898 on 0x006cec7c+0x82. When a live runtime world is active the mainline branch still appends .smp and invokes world_runtime_serialize_smp_bundle at 0x00446240. This makes the helper the save-side sibling of shell_map_file_entry_coordinator rather than another restore dispatcher, with `.gmt` now bounded as an auxiliary preview-surface side path instead of a fourth gameplay save family. | objdump + analysis-context + caller xrefs + strings + mode-table inspection + string correlation + side-owner branch inspection + direct save branch inspection |
| 78 | 0x00446240 | 2807 | world_runtime_serialize_smp_bundle | map | cdecl | inferred | objdump + analysis-context | 3 | Serializes the current live world state into the `.smp` branch used by shell_map_file_world_bundle_coordinator. After dismissing the shell detail controller and running one shell-state service step it allocates a bundle through 0x00530c80 seeds many typed records through repeated 0x00531030 and 0x00531340 calls walks world collections under 0x0062c120 and 0x006ada80 and emits runtime-state payloads through helpers such as 0x00534e50 0x00534ec0 0x00534f00 and 0x00534f40 before finalizing through 0x00530a00. Current grounded caller is 0x00445de0 on the `.smp` path so this looks like the live-world save or package serializer rather than the restore path. | objdump + analysis-context + caller xrefs + strings |
| 79 | 0x00446d40 | 5401 | world_load_saved_runtime_state_bundle | map | cdecl | inferred | objdump + analysis-context | 4 | Loads one saved runtime world-state bundle from the `.smp` branch selected by shell_map_file_entry_coordinator. The helper dismisses the shell detail controller releases the prior world runtime drives shell mode and status transitions builds a bundle through 0x00530c80 and repeated 0x00531150 reads allocates a new world root at 0x0062c120 through 0x0044cf70 and then fills that root through repeated grid and object writes including 0x0044dca0 0x00448c20 0x00448cb0 0x00448d90 0x00448e60 0x00448e90 and 0x0044de30. This is the first grounded gameplay save-load restore dispatcher for `.smp` content rather than the broader reference-database map-entry flow. | objdump + analysis-context + caller xrefs + strings |
| 80 | 0x0044fb70 | 1117 | world_compute_transport_and_pricing_grid | map | cdecl | inferred | objdump + strings + callsite inspection | 3 | Post-load world-generation subphase inside world_run_post_load_generation_pipeline. Reached directly under the localized progress update `Computing Transportation and Pricing...`, the helper iterates the active world grid through dimensions and bounds rooted at `[0x0062c120+0x2145]`, `[+0x2149]`, `[+0x2155]`, `[+0x2159]`, and `[+0x2129]`, samples neighborhood offsets from `0x00624b28` and `0x00624b48`, combines local terrain or transport values through repeated calls to `0x00534e50` and `0x00448aa0`, and writes bounded 16-bit results back into the grid cells. This now looks like the map-wide transportation-cost or pricing-field computation pass rather than a recurring simulation-step loop. | objdump + caller context + RT3.lng strings |
| 81 | 0x004882e0 | 199 | world_region_border_overlay_rebuild | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 4 | Rebuilds the border-overlay companion for the numbered region set owned by `0x0062bae0`. After pumping shell progress through `0x004834e0` the helper seeds a companion record family on `0x006cfc9c`, counts active region entries, scans the active world grid at `0x0062c120`, compares neighboring cell-region ids, and emits border-segment geometry through `0x00536ea0` whenever adjacent cells belong to different mapped regions. Current grounded callsites are the post-load generation pipeline at `0x004384d0` and the broader world-build path around `0x00447560`, which makes this look like a region-border overlay rebuild rather than another generic player or company manager pass. | objdump + caller xrefs + RT3.lng strings + grid-neighbor inspection |
| 82 | 0x004c9da0 | 496 | map_editor_chairman_slot_panel_format_slot_card | map | cdecl | inferred | objdump + RT3.lng strings + control-flow inspection | 4 | Formats one selected chairman-slot card for the shell editor panel rooted under control group `0x5a6e`. The helper reads the 9-byte local slot record rooted at `[0x006cec78+slot*9+0x69d8]`, formats the staged chairman profile label from the static persona table at `0x005f2d28`, appends the localized `Optional` versus `Mandatory` suffix from ids `2997` and `2998` based on `[slot+0x01]` with nonzero=`Optional` and zero=`Mandatory`, then appends one of `Human` `Computer` or `Human or Computer` from ids `3001` `3000` and `2999` based on `[slot+0x02]` plus the separate per-slot gate at `[0x006cec78+slot*9+0x0bc3]`. It also formats the numeric tuning field from `[slot+0x04]` into the same card. Current grounded caller is the selection callback rooted at `0x004cc230`. | objdump + RT3.lng strings + UI callback inspection |
| 83 | 0x004ca010 | 432 | map_editor_chairman_slot_panel_refresh_selected_slot | map | thiscall | inferred | objdump + RT3.lng strings + UI control inspection | 4 | Refreshes the active detail controls for one selected chairman slot in the shell editor panel. It stores the selected slot index at `[this+0x80]`, publishes the staged profile id from `[slot+0x00]`, the persona icon byte from `0x005f2d29`, and the localized profile label from `0x005f2d47`, then updates the role and policy controls from the same local record. `[slot+0x01]` drives the Optional-versus-Mandatory control pair with nonzero=`Optional` and zero=`Mandatory`; `[slot+0x02]` plus the separate per-slot gate at `[0x006cec78+slot*9+0x0bc3]` drive the `Human`, `Computer`, and `Human or Computer` controls; and `[slot+0x04]` is surfaced through the numeric field editor. Current grounded caller is the list-selection callback at `0x004cc230`. | objdump + RT3.lng strings + UI control inspection |
| 84 | 0x004ca1c0 | 514 | map_editor_chairman_slot_panel_refresh_slot_counters | map | thiscall | inferred | objdump + UI control inspection | 3 | Recomputes the aggregate slot counters displayed by the chairman-slot editor panel. The helper walks the 16 local slot records rooted at `[0x006cec78+0x69d8]`, splits them by the Optional-versus-Mandatory byte `[slot+0x01]`, and separately counts slots whose live-seat markers come from the ordinary seat byte `[slot+0x02]` versus the special occupied-seat byte `[slot+0x03]`. It then formats the resulting `%1/%2` summaries through the shared pattern block at `0x005cfda8`, republishes those summaries to the panel controls under groups `0x5a6f`, `0x5a70`, and `0x5a71`, and stores the aggregate counts at `0x006cec78+0x6a68..0x6a7c` for neighboring shell validation. Current grounded callers are the panel constructor at `0x004cc2d0` and the role-policy update handlers in `0x004cecc0`. | objdump + UI control inspection + format-string inspection |
| 85 | 0x004ca540 | 304 | map_editor_available_chairman_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + static-table inspection | 4 | Constructs the shell-side `Player Pool` page in the map-editor control panel. The helper binds the row formatter `0x004ca450` and range callback `0x004ca430` on the shared panel root `0x5aa0`, walks the 40-entry persona table slice at `0x005f2d6e` in `0x27`-byte steps, publishes one localized chairman-name row for each persona, counts enabled scenario-side availability bytes in `[0x006cec78+0x6987..]`, and then republishes the `%1 out of %2 are selected.` summary from localized id `1035` through control `0x5aa4`. The neighboring localized page text `996` `Player Pool` plus help text `1016` `Control of which specific players (i.e. Jay Cooke) allowed in the scenario.` now make this the strongest current shell owner for the scenario's available-chairman pool rather than another generic persona browser. | objdump + RT3.lng strings + static-table inspection + UI callback inspection |
| 86 | 0x004ca670 | 280 | map_editor_scenario_metadata_panel_refresh_briefing_mode | map | thiscall | inferred | objdump + RT3.lng strings + UI control inspection | 4 | Refreshes the briefing-mode controls inside one shell-side map-editor scenario metadata panel. The helper uses the global selector `0x621f50` to choose whether the visible long-text editor is the ordinary scenario briefing or the multiplayer briefing, publishes the corresponding heading from localized ids `1491` `Briefing (dialog appears when scenario starts):` and `3586` `Multi-Player Briefing (dialog appears when scenario starts):` onto control `0x5b73`, flips the paired selector controls around `0x5b71` and `0x5b72`, and republishes the stored single-player and multiplayer briefing texts from `[0x006cec78+0x4f30]` and `[+0x5ae9]` into the paired edit controls `0x5b6d` and `0x5b6f`. Current grounded caller is the broader scenario metadata refresh at `0x004ca790`. | objdump + RT3.lng strings + UI control inspection + state-field correlation |
| 87 | 0x004ca790 | 384 | map_editor_scenario_metadata_panel_refresh_controls | map | thiscall | inferred | objdump + RT3.lng strings + UI control inspection | 4 | Refreshes the shell-side map-editor scenario metadata controls under the shared control band `0x5b69..0x5b74`. The helper first re-enters `map_editor_scenario_metadata_panel_refresh_briefing_mode` at `0x004ca670`, then republishes the scenario description from `[0x006cec78+0x672e]` to control `0x5b69`, the start-year trio from `[+0x66ca]`, `[+0x66d2]`, and `[+0x66ce]` into `0x5b6a`, `0x5b6c`, and `0x5b6b`, and the two boolean flags `[+0x66de]` and inverse `[+0x66f3]` into controls `0x5b6e` and `0x5b74`. The neighboring message dispatcher at `0x004cb4a0` clamps the three year fields to `1829..2100` and maintains `minimum <= default <= maximum`, which aligns this panel with the localized editor strings `Description:` `Minimum Start Year:` `Default Start Year:` `Maximum Start Year:` and the paired briefing labels in `RT3.lng` ids `1483..1492` and `3586`. | objdump + RT3.lng strings + UI control inspection + state-field correlation |
| 88 | 0x004ca910 | 474 | map_editor_building_density_panel_refresh_controls | map | thiscall | inferred | objdump + RT3.lng strings + caller inspection + UI control inspection | 4 | Refreshes the shell-side `Building Density` page in the map-editor control panel. The helper reads two scenario-state bytes at `[0x006cec78+0x4c78]` and `[+0x4c7c]` and reflects them into two separate three-choice control bands `0x5c3a..0x5c3c` and `0x5c44..0x5c46`, with both fields seeded to the middle state `1` by constructor-time defaults and persisted through the ordinary map-state bundle path. The localized field captions now make the page materially tighter: `[state+0x4c78]` is the `Starting Building Density Level:` selector from ids `1642` and `1643`, where the default middle state `1` corresponds to the documented `100%` baseline and the lower world-building branches later treat the stored ordinal as a real three-state numeric mode; `[state+0x4c7c]` is the paired `Building Density Growth:` selector from id `1644`, which combines with city or region-specific density changes as described by `1641` and is likewise consumed later as a three-state growth-mode byte rather than a pure UI label. Related localized report text such as `1037`, `1048`, and `1070` points back to this same pair as the map-wide starting-density and later growth controls. | objdump + RT3.lng strings + caller inspection + UI control inspection + save-load correlation |
| 89 | 0x004ca980 | 315 | map_editor_economic_cost_slider_dispatch | map | thiscall | inferred | objdump + RT3.lng strings + .data descriptor table inspection | 3 | Slider-update dispatcher for one shell-side map-editor economic tuning family. The helper handles the bounded slider event range `0xa433..0xa43d`, converts the incoming integer slider delta or position into normalized floats, writes six tuned values into the adjacent scenario-state block at `[0x006cec78+0x0be2]`, `[+0x0be6]`, `[+0x0bea]`, `[+0x0bee]`, `[+0x0bf2]`, and `[+0x0bf6]`, mirrors the first value into `[state+0x0bde]`, and then re-enters the live panel owner through `0x004cadf0` when `0x006cff84` is present. Current neighboring constructor evidence binds this callback to six visible controls under `0x5bcd..0x5bd7`, while the surrounding `.data` descriptor run at `0x00611c70..0x00612220` now bounds the wider editor lane as the live owner for `Prime Rate`, `Merger Premium`, and the construction and maintenance cost labels `Build Stations Cost` through `Steam Engine Cost` with help texts `2433..2437`, rather than leaving that help-text family orphaned. | objdump + slider jump-table inspection + state-field correlation + RT3.lng strings + .data descriptor table inspection |
| 90 | 0x004cadf0 | 751 | map_editor_economic_cost_slider_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + caller inspection + .data descriptor table inspection | 4 | Constructs one shell-side map-editor economic cost tuning panel. The helper registers `map_editor_economic_cost_slider_dispatch` at `0x004ca980` on the six slider controls `0x5bcd`, `0x5bcf`, `0x5bd1`, `0x5bd3`, `0x5bd5`, and `0x5bd7`, attaches the neighboring preview or formatter callback `0x004caaf0` on control `0x5be1`, and then republishes the current scenario-state tuning values from `[0x006cec78+0x0be2..0x0bf6]` back into those controls through the shared slider formatting helpers. Current surrounding evidence now grounds this as the live editor-side economic tuning subsystem that was previously only visible through the orphaned help-text family: the adjacent descriptor block at `0x00611c70..0x00612220` pairs the wider lane with localized fields `Prime Rate`, `Merger Premium`, and `Build Stations Cost` through `Steam Engine Cost`, plus help texts `2433..2437`. Current grounded caller is the larger editor-panel dispatcher at `0x004ce244`. | objdump + caller inspection + slider registration + state-field correlation + RT3.lng strings + .data descriptor table inspection |
| 91 | 0x004cb2b0 | 485 | map_editor_scenario_special_conditions_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + static-table inspection | 4 | Constructs the special-conditions side of the shell map-editor scenario setup page. The helper binds the row formatter `0x004cb1c0` and range callback `0x004cb1a0` on list control `0xa7fa` through `Setup_Options_Buttons.imb`, walks the 36-entry static toggle table at `0x005f3ab0`, counts enabled dword flags in `[0x006cec78+0x4a7f]`, formats each row from paired label/help ids such as `2535/2564` `Disable Stock Buying and Selling`, `2874/2875` `Use Bio-Accelerator Cars`, `3722/3723` `Disable Cargo Economy`, `3850/3851` `Disable Train Crashes`, `3852/3853` `Disable Train Crashes AND Breakdowns`, and `3920/3921` `AI Ignore Territories At Startup`, and republishes the `Special Conditions In Effect` summary from localized id `1053` through control `0xa7f8`. It then re-enters `map_editor_scenario_metadata_panel_refresh_controls` at `0x004ca790`, which makes this a bounded scenario special-conditions panel rather than a generic option list. Current grounded caller is the larger editor-panel dispatcher at `0x004ce28e`. | objdump + RT3.lng strings + static-table inspection + UI callback inspection |
| 92 | 0x004cb4a0 | 468 | map_editor_scenario_metadata_panel_handle_message | map | thiscall | inferred | objdump + RT3.lng strings + UI dispatch inspection | 4 | Message dispatcher for the adjacent map-editor scenario metadata controls. The helper handles the bounded event band `0xa497..0xa4a2`, writing the scenario description from the edit-control payload into `[0x006cec78+0x672e]`, the single-player and multiplayer briefing texts into `[+0x4f30]` and `[+0x5ae9]`, flipping the briefing selector at `0x621f50` between the single-player and multiplayer views, toggling the two boolean bytes `[+0x66de]` and `[+0x66f3]`, and committing the three start-year fields `[+0x66ca]`, `[+0x66ce]`, and `[+0x66d2]` after clamping each incoming value to `1829..2100`. Before returning it also normalizes the year trio so `minimum <= default <= maximum` and then re-enters `map_editor_scenario_metadata_panel_refresh_controls` at `0x004ca790`, which confirms that the shared control band `0x5b69..0x5b74` is the live scenario description, briefing, and start-year editor rather than another generic editor options block. Current grounded caller is the panel callback installation rooted at `0x004ce28e`. | objdump + RT3.lng strings + UI dispatch inspection + state-field correlation |
| 93 | 0x004cb6f0 | 496 | map_editor_available_chairman_panel_handle_message | map | thiscall | inferred | objdump + RT3.lng strings + static-table inspection + UI dispatch inspection | 4 | Message dispatcher for the shell-side `Player Pool` editor page. The helper handles the three bulk-selection buttons `0x5aa1..0x5aa3` by rewriting the scenario-side availability bytes rooted at `[0x006cec78+0x6987]` from preset-selection bytes embedded in the same `0x005f2d28` persona table family, and it also commits direct per-row toggle changes from the control range `0x5aaa..0x5b03` back into that byte array. After either path it re-enters `map_editor_available_chairman_panel_construct` at `0x004ca540`, which keeps the visible chairman-name list and the `selected out of total` summary in sync. The localized page text `996` `Player Pool` and help text `1016` now make this the live owner for the scenario's chairman-availability mask rather than a passive list callback block. | objdump + RT3.lng strings + static-table inspection + UI dispatch inspection + state-field correlation |
| 94 | 0x004cb8e0 | 271 | map_editor_scenario_special_conditions_panel_handle_message | map | thiscall | inferred | objdump + static-table inspection + UI dispatch inspection | 4 | Message dispatcher for the special-conditions side of the shell map-editor scenario setup page. The helper handles the bulk selection controls `0xa7fb` and `0xa7fc` by writing the whole special-condition dword array rooted at `[0x006cec78+0x4a7f]`, commits direct per-row state changes from the callback band `0xabe0..0xafc7` into that same array, and then re-enters `map_editor_scenario_special_conditions_panel_construct` at `0x004cb2b0` to refresh the visible list and the `Special Conditions In Effect` summary. Two row ids are also special-cased through immediate helper calls after commit, which marks this as the live state owner for the scenario rule-toggle matrix rather than only a passive list callback block. | objdump + static-table inspection + UI dispatch inspection + state-field correlation |
| 95 | 0x004cb9f0 | 134 | map_editor_building_density_panel_handle_message | map | thiscall | inferred | objdump + RT3.lng strings + caller inspection + UI dispatch inspection | 4 | Message dispatcher for the shell-side `Building Density` page. The helper handles the two three-choice control bands `0x5c3a..0x5c3c` and `0x5c44..0x5c46`, committing ordinal values `0`, `1`, or `2` into the scenario-state bytes `[0x006cec78+0x4c78]` and `[+0x4c7c]` respectively before re-entering the same page refresh path at `0x004ca910`. The localized captions now pin the semantics more directly: `[state+0x4c78]` is the map-wide `Starting Building Density Level:` selector whose default middle state is the documented `100%` baseline, while `[state+0x4c7c]` is the paired `Building Density Growth:` selector. Current downstream xrefs also show both stored bytes steering later world-generation and growth math as concrete three-state mode selectors rather than only UI summaries. | objdump + RT3.lng strings + caller inspection + UI dispatch inspection + state-field correlation |
| 96 | 0x004cc980 | 943 | map_editor_city_region_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `Cities/Regions` editor page. The helper uses the current selected city-or-region id in `0x006cff74`, falls back to the first live entry in the region collection at `0x0062bae0`, and shows the empty-page warning from localized id `1045` `You currently have no cities or regions to edit.` when the collection is empty. In the live path it binds the list-row formatter `0x004cc340` and selection callback `0x004cc930`, populates the visible city-or-region list from `0x0062bae0`, publishes detail fields through controls `0x50dc..0x50e2`, and formats the page summary from localized ids including `3002`, all of which makes this the main owner for the `Cities/Regions` editor section rather than a subordinate helper. | objdump + RT3.lng strings + UI callback inspection + region-collection correlation |
| 97 | 0x004cc250 | 112 | map_editor_chairman_slot_panel_refresh_slot_list | map | thiscall | inferred | objdump + UI control inspection | 4 | Rebuilds the visible slot list in the chairman-slot editor panel. It clears the list control under group `0x5a6e`, then walks the 16 local slot records rooted at `[0x006cec78+0x69d8]` and appends one row for each slot whose active-seat bytes `[slot+0x02]` or `[slot+0x03]` are set. After repopulating the list it re-enters `map_editor_chairman_slot_panel_refresh_slot_counters` at `0x004ca1c0`. Current grounded callers are the panel constructor at `0x004cc2d0` and several message-handler update paths in `0x004cecc0`. | objdump + UI control inspection |
| 98 | 0x004cc2d0 | 99 | map_editor_chairman_slot_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `Players` editor panel under control group `0x5a6e`. The helper attaches the selected-slot formatter at `0x004c9da0`, the profile-cycle button at `0x004c9fa0`, and the list-selection callback at `0x004cc230`, then populates the current slot list through `map_editor_chairman_slot_panel_refresh_slot_list` and publishes one top-level panel control. The localized page text `995` `Players` plus help text `1015` `Control of how many players, human and/or A.I., allowed in the scenario.` now make this the clearest current shell owner for the local chairman-slot record family rooted at `0x006cec78+0x69d8`. | objdump + RT3.lng strings + UI callback inspection |
| 99 | 0x004ceb90 | 291 | map_editor_chairman_slot_panel_cycle_selected_slot_profile | map | thiscall | inferred | objdump + static-table inspection | 4 | Cycles the staged chairman profile assigned to the currently selected local slot. Starting from the slot-local profile id at `[slot+0x00]`, the helper wraps through the bounded persona id range `0..40`, skips any profile already marked busy in the static persona table byte at `0x005f2d28`, writes the chosen id back to `[slot+0x00]`, and mirrors the same choice into any already-materialized persona object in `0x006ceb9c`, including its display name, biography text, and icon byte. Current grounded callers are the profile-cycle control in `map_editor_chairman_slot_panel_handle_message` and the neighboring shell callback block around `0x004c9fa0`. | objdump + static-table inspection + UI callback inspection |
| 100 | 0x004cecc0 | 1049 | map_editor_chairman_slot_panel_handle_message | map | thiscall | inferred | objdump + RT3.lng strings + UI dispatch inspection | 4 | Message dispatcher for the shell chairman-slot editor panel rooted at `0x5a6e`. The helper handles add and remove slot actions, profile cycling, the Optional-versus-Mandatory toggle, the three-way `Human` `Computer` `Human or Computer` role group, and numeric tuning edits for the selected slot. The current slot-record semantics are bounded directly from these branches: control id `0x5a77` writes `[slot+0x01]=1` for `Optional`, `0x5a78` writes `[slot+0x01]=0` for `Mandatory`, and `0x5a79`, `0x5a7a`, plus `0x5a7b` select `Human`, `Computer`, and `Human or Computer` by combining the ordinary seat byte `[slot+0x02]` with the separate per-slot gate at `[0x006cec78+slot*9+0x0bc3]`; `0x5a7c` commits the numeric tuning field back to `[slot+0x04]`. The add-slot path allocates a new live slot, seeds `[slot+0x00]` to one persona id, `[slot+0x01]` to `Optional`, `[slot+0x02]` to the broad `Human or Computer` state, mirrors that same broad state into the external gate at `+0x0bc3`, and seeds `[slot+0x04]` to the default `100000` tuning value. The remove path clears the whole 9-byte record rooted at `[slot+0x00]`, resets `[slot+0x04]` back to `100000`, and clears any already-materialized persona object, but it does not directly write the special occupied-seat byte `[slot+0x03]`, which remains seeded elsewhere in the currently grounded code. Current grounded caller is the shell panel callback attachment in `map_editor_chairman_slot_panel_construct` at `0x004cc2d0`. | objdump + RT3.lng strings + UI dispatch inspection |
| 101 | 0x004ce070 | 1549 | map_editor_panel_select_active_section | map | thiscall | inferred | objdump + caller inspection + UI dispatch inspection | 4 | Top-level map-editor control-panel section selector. The helper switches over the active page byte at `[this+0x78]`, tears down or replaces the current page owner at `[this+0x7c]`, and then constructs the bounded editor pages reached so far including the scenario metadata panel `0x004ca790`, city-or-region page `0x004cc980`, territory page `0x004cd070`, available-chairman panel `0x004ca540`, economic tuning panel `0x004cadf0`, locomotives-availability page `0x004cd680`, industry-availability page `0x004cdbd0`, special-conditions panel `0x004cb2b0`, the bounded dual tri-state policy panel rooted at `0x004ca910`, the now-grounded `Port/Warehouse Cargos` page `0x004cf910`, and the resolved report pages at `0x004d3000`, `0x004d3020`, `0x004d3060`, `0x004d3080`, `0x004d30a0`, `0x004d4110`, and `0x004d4130`. Current neighboring shell evidence is enough to treat this as the broad editor-side page owner rather than another local panel helper. | objdump + caller inspection + UI dispatch inspection + page-constructor correlation |
| 102 | 0x004ce380 | 1174 | map_editor_city_region_panel_handle_message | map | thiscall | inferred | objdump + RT3.lng strings + UI dispatch inspection | 4 | Message dispatcher for the shell-side `Cities/Regions` editor page. The helper routes list-selection and navigation traffic through the city-or-region controls around `0x507e..0x5088`, opens the rename prompt from localized id `1054` `Enter the new name:` for the currently selected city-or-region, and also owns the copy-industry-data flow anchored by localized id `1055` `Choose the city to copy industry data from`. One bounded branch walks the candidate pool at `0x0062b268` and reapplies per-candidate enable or weighting state against the selected city-or-region through `0x004206b0` before re-entering `map_editor_city_region_panel_construct`. Current grounded globals `0x006cff74`, `0x006cff78`, and the region collection `0x0062bae0` make this the live handler for the `Cities/Regions` editor section rather than a generic shell callback block. | objdump + RT3.lng strings + UI dispatch inspection + region and candidate correlation |
| 103 | 0x004ce820 | 1221 | map_editor_territory_panel_handle_message | map | thiscall | inferred | objdump + RT3.lng strings + UI dispatch inspection | 4 | Message dispatcher for the shell-side `Territories` editor page. The handler uses the selected territory ids in `0x00621f48` and `0x00621f4c`, routes selection and navigation through controls around `0x50dc..0x50df`, opens the territory rename prompt from localized id `1054`, and owns the border-remap or hide-border policy path that warns through localized ids `1056` and `1057` when a territory's borders cannot be hidden because other territories already remap to it. After committing the selected territory's border and remap fields it re-enters `map_editor_territory_panel_construct`, which makes this the live `Territories` page handler rather than another local modal callback. | objdump + RT3.lng strings + UI dispatch inspection + territory-state correlation |
| 104 | 0x004cd070 | 1280 | map_editor_territory_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `Territories` editor page. The helper uses `0x00621f48` and `0x00621f4c` as the selected-territory latches, falls back to the first live territory in the territory collection at `0x006cfc9c`, and shows the empty-page warning from localized id `1046` `You currently have no territories to edit.` when no territories exist. In the live path it populates the visible territory list from `0x006cfc9c`, publishes the selected territory's id, name, border mode, remap target, and numeric tuning fields through controls `0x50dc..0x50e5`, and builds the secondary remap list from other territories that reference the currently selected one. Current grounded neighbors make this the main owner for the `Territories` editor section. | objdump + RT3.lng strings + UI callback inspection + territory-collection correlation |
| 105 | 0x004cd680 | 1168 | map_editor_locomotive_availability_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `Locomotives` availability page in the map-editor control panel. The helper reflects three scenario-state policy bytes from `[0x006cec78+0x4c97]`, `[+0x4c98]`, and `[+0x4c99]` into controls `0x5b09..0x5b0b`, binds the row formatter `0x004cd570` and the neighboring callback `0x004ca960` on root control `0x5b05`, and iterates the collection at `0x006ada84` to build the visible locomotive list plus the localized title from id `1050` `Locomotives Available\n\n%1 of %2 available`. The detail path formats each selected locomotive through `EditorDetail.win` and counts live world usage by resolving the record through `0x00461c80` and the world-side lookup at `0x00435030`. Current grounded evidence is therefore strong enough to treat this as the main locomotives-available page rather than a generic detail widget. | objdump + RT3.lng strings + UI callback inspection + locomotive-usage correlation |
| 106 | 0x004cf0d0 | 861 | map_editor_locomotive_availability_panel_handle_message | map | thiscall | inferred | objdump + RT3.lng strings + UI dispatch inspection | 4 | Message dispatcher for the shell-side `Locomotives` availability page. The helper routes selection and bulk-toggle traffic through controls `0x5b06..0x5b0c`, rewrites the three scenario-state policy bytes at `[0x006cec78+0x4c97]`, `[+0x4c98]`, and `[+0x4c99]`, and walks the locomotive collection at `0x006ada84` to commit per-row availability changes through the same record family used by the constructor. Bulk branches apply enable or disable policy across the visible locomotive set before the handler re-enters `map_editor_locomotive_availability_panel_construct` at `0x004cd680`, which makes this the live availability-policy owner rather than a local detail callback. | objdump + RT3.lng strings + UI dispatch inspection + locomotive-policy correlation |
| 107 | 0x004cdbd0 | 1357 | map_editor_industry_availability_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `Industry (Overall)` availability page in the map-editor control panel. The helper binds the detail-row callback `0x004cc130` and the neighboring callback `0x004c9d80` on root control `0x9c42`, then walks the global candidate pool at `0x0062b268`, skipping the category-1 family and sorting the remaining candidates by label before building the visible industry list. The detail side formats the selected industry through `EditorDetail.win`, appends up to eight compatible city-or-region names from the region collection at `0x0062bae0`, and publishes the localized summary from id `1051` `There are %1 Cities and/or Regions using %2 right now`, while the page title uses id `1052` `Industries Available\n\nIndustries: %1 of %2 available`. Current grounded evidence therefore treats this as the main industry-availability page rather than an unnamed detail browser. | objdump + RT3.lng strings + UI callback inspection + candidate-pool correlation |
| 108 | 0x004cf430 | 714 | map_editor_industry_availability_panel_handle_message | map | thiscall | inferred | objdump + RT3.lng strings + UI dispatch inspection | 4 | Message dispatcher for the shell-side `Industry (Overall)` availability page. The handler routes navigation and toggle traffic through the control band `0x9c43..0xa40f`, updates candidate-availability state through `0x00434f20` for the currently selected industry rows, and then re-enters `map_editor_industry_availability_panel_construct` at `0x004cdbd0` so the visible count and compatible-city summary refresh against the candidate pool at `0x0062b268`. Current grounded control usage and localized strings now make this the live industry-availability handler rather than another shared editor callback block. | objdump + RT3.lng strings + UI dispatch inspection + candidate-state correlation |
| 109 | 0x004cf910 | 1770 | map_editor_port_warehouse_cargo_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `Port/Warehouse Cargos` page in the map-editor control panel. The helper uses the selected recipe-book index latches at `0x006cffa0` and `0x006cffa4`, falls back across the per-book state blocks rooted at `[0x006cec78+0x0fe7+index*0x4e1]`, and populates the visible cargo-page controls under `0x59d8`, `0x5a0a`, and `0x5b74`. Current page-state work now bounds the structure more concretely too: the selected recipe-book index wraps modulo `12`, each recipe-book block stores the shared maximum annual production float at `book+0x3ed`, and the constructor then walks five fixed cargo-line entries starting at `book+0x3f1` with stride `0x30`. Each line now grounds as one row-owned mode dword at `+0x00`, one annual amount float at `+0x04`, one supplied-cargo token at `+0x08`, and one demanded-cargo token at `+0x1c`; the constructor resolves the two token strings against the global cargo collection and then reflects the resulting selector indices back into the page controls. The row-control mapping is now bounded too: the selector and label pair at `+0x14/+0x1e` is the supplied-cargo side because it is the pair enabled in modes `2/3`, while the pair at `+0x28/+0x0a` is the demanded-cargo side because it is the pair enabled in modes `1/3`. The same gating also tightens the single numeric field at `+0x46/+0x32`: it is labeled `Annual Demand:` only for mode `1`, but `Annual Supply:` for modes `2/3`. The localized page-title and help-text cluster now bounds the page much more tightly: `1001` `Port/Warehouse Cargos`, `1021` `Control over what ports and warehouses demand and supply.`, `1499` `Port/Warehouse Cargo Recipe Book:`, `1671` `Rename this cargo recipe book`, `1672` and `1673` for previous or next recipe-book cycling, `1674` and `1675` for the shared maximum annual production field, `1676` `Demanded:`, `1677` `Supplied:`, and `1678` for the per-cargo annual amount field. The same constructor also surfaces the four per-cargo mode labels `501` `<Disabled>`, `502` `Demand Only`, `503` `Supply Only`, and `504` `Production Demand->Supply`, publishes the annual demand or supply captions from `510` and `511`, formats rename and usage summaries through localized ids `507`, `508`, and `509`, and exposes the sandbox toggle text from id `3901` `Sandbox Allowed`. Current mode gating now makes the fourth mode tighter too: `Production Demand->Supply` is the only line state that clearly keeps both supplied-cargo and demanded-cargo branches active, while the shared numeric field stays on the supply side in that mode. That matches the wording around `1674`, `1675`, and `504` that ties it to one shared production-capacity pool and raw-material conversion into supplied output. It also emits the bounded high-production and high-load warnings from ids `505` and `506`, both of which explicitly reference ports or warehouses, which makes this the strongest current owner for the recipe-book or port-cargo editor lane rather than another generic detail page. | objdump + RT3.lng strings + UI callback inspection + recipe-book state correlation + mode-table correlation + control-gating correlation |
| 110 | 0x004d0040 | 1643 | map_editor_port_warehouse_cargo_panel_handle_message | map | thiscall | inferred | objdump + RT3.lng strings + UI dispatch inspection | 4 | Message dispatcher for the shell-side `Port/Warehouse Cargos` editor page. The helper routes selection and navigation traffic through the same recipe-book control bands rooted at `0x59d8`, `0x5a0a`, and `0x5b74`, opens the rename prompt from localized id `507`, and commits per-book cargo policy, sandbox-allowed state, and recipe-book text changes back into the scenario-state blocks at `[0x006cec78+0x0fe7+index*0x4e1]`. The edit-side dispatch is now tighter than before: the recipe-book selector wraps modulo `12`; the dedicated top-level numeric field under `0x59de` writes the shared maximum annual production float at `book+0x3ed`; and the per-line edit groups commit into five fixed cargo-line records beginning at `book+0x3f1` with stride `0x30`. Those line groups now ground as one mode dword at `+0x00`, one annual amount float at `+0x04`, one supplied-cargo token string at `+0x08`, and one demanded-cargo token string at `+0x1c`. The concrete control writes are now bounded too: the mode-`2/3` selector pair writes the supplied token through the `+0x14` control into `+0x08`, while the mode-`1/3` selector pair writes the demanded token through the `+0x28` control into `+0x1c`. The same handler keeps the single amount field on the demand side only for mode `1`; in modes `2/3` it writes that same `+0x04` field as annual supply, which matches the constructor captions `510` `Annual Demand:` versus `511` `Annual Supply:`. Current localized row text now makes the bounded edit surface much clearer: the page cycles among recipe books through `1672` and `1673`, renames them through `1671`, updates the shared maximum annual production field under `1674` and `1675`, and edits five fixed per-book line entries whose mode labels are `501` `<Disabled>`, `502` `Demand Only`, `503` `Supply Only`, and `504` `Production Demand->Supply` with annual amount captions `510` `Annual Demand:` and `511` `Annual Supply:` plus row labels `1676` `Demanded:` and `1677` `Supplied:`. The wording on `1675` also tightens the fourth mode specifically: `Production Demand->Supply` is the branch where the shared production-cap field is relevant and raw materials on hand are converted through production lines into supplied output, rather than only free-standing demand or free-standing supply. One bounded branch walks the city-or-region collection at `0x0062bae0` while rebuilding the usage summaries from localized ids `508` and `509`, and the warning branches re-use ids `505` and `506` when production-rate or supply-demand settings become too high for ports or warehouses. Before returning it re-enters `map_editor_port_warehouse_cargo_panel_construct` at `0x004cf910`, which makes this the live handler for the port or warehouse recipe-book page rather than a shared page-table callback. | objdump + RT3.lng strings + UI dispatch inspection + recipe-book state correlation + mode-table correlation + control-write correlation |
| 111 | 0x004cf700 | 370 | map_editor_panel_dispatch_active_section_message | map | thiscall | inferred | objdump + caller inspection + UI dispatch inspection | 4 | Top-level message dispatcher for the active map-editor control-panel section. The helper reuses the same page selector byte at `[this+0x78]` and routes incoming shell messages to the current page-local handlers, including the grounded city-or-region handler `0x004ce380`, territory handler `0x004ce820`, scenario metadata handler `0x004cb4a0`, available-chairman handler `0x004cb6f0`, special-conditions handler `0x004cb8e0`, the bounded dual tri-state handler `0x004cb9f0`, the grounded port-or-warehouse cargo handler `0x004d0040`, and the resolved report-page handlers rooted at `0x004d38c0`, `0x004d3d90`, and the neighboring editor report family. Current grounded caller and page-table evidence now make this the broad editor-side active-page dispatcher rather than another page-local callback block. | objdump + caller inspection + UI dispatch inspection + page-handler correlation |
| 112 | 0x004d0420 | 1618 | map_editor_city_count_stats_report | map | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Formats the localized `City Count Stats` editor report. The helper aggregates land-cell and city counts from the active world and region collections, derives per-10K density ratios, and formats the visible summary through localized ids `1059..1070`, including `Total Land Cells`, `Total Cities`, `Average City Building Density`, `Average Region Building Density`, and the projected starting-industry and non-industry building counts. Current grounded caller is the neighboring report-page constructor at `0x004d30a0`. | objdump + RT3.lng strings + caller inspection + world and region count correlation |
| 113 | 0x004d0a90 | 3416 | map_editor_general_validation_report | map | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Formats the localized `General Validation` editor report. The helper walks the current scenario and world state looking for high-level validation failures, including missing industry in a city or region, mismatches between available player slots and the current player-pool setup, missing briefing text, and missing scenario description, then emits the matching warning lines through localized ids such as `1071`, `1073`, `1074`, and `1075`. Current grounded caller is the page constructor at `0x004d3080`, which makes this the actual general-validation report rather than the tree-stats page previously grouped under that label. | objdump + RT3.lng strings + caller inspection + validation-string correlation |
| 114 | 0x004d1b80 | 536 | map_editor_tree_stats_report | map | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Formats the localized `Tree Stats` editor report. The helper scans the active world grid through dimensions rooted at `0x0062c120`, accumulates total-tree and density counts into the neighboring global scratch slots at `0x006cffa8` and `0x006cffb8`, and then formats the visible report through localized id `1086`, which includes `Total Trees`, `Trees per any cell`, `Trees per land cell`, and the adjacent performance guidance text. Current grounded caller is the tree-stats page constructor at `0x004d3060`. | objdump + RT3.lng strings + caller inspection + world-grid scan correlation |
| 115 | 0x004d1d60 | 1679 | map_editor_city_region_growth_stats_report | map | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Formats the localized `Stats - City/Region` growth report. The helper walks the city or region collection at `0x0062bae0`, reads display names from each entry, and formats the multi-column growth summary through localized ids `1087..1096`, including `Industry Bldg Count`, `Industry Revenue`, `Industry Profit`, `Modified Rail Revenue`, `Weighted Profit Margin`, `Annual Density Adjust`, `Start Density`, `Current Density`, `Start Bldg Count`, and `Current Bldg Count`. The neighboring constructor also publishes localized id `1114`, whose explanatory text says cities grow from industry profit margins plus modified rail revenue, so this now looks like the main city-region growth analytics page rather than a generic validation helper. Current grounded caller is `0x004d3020`. | objdump + RT3.lng strings + caller inspection + city-region stat correlation |
| 116 | 0x004d2430 | 1597 | map_editor_cargo_stats_report | map | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Formats the localized `Stats - Cargo` editor report. The helper iterates the cargo or building candidate pool at `0x0062b268`, groups entries by category, and emits the report columns from localized ids `1097..1113`, including `Category`, `Raw Producers`, `Factories`, `Total`, and the adjacent supply-demand and weighted-price summary fields. Current grounded caller is the neighboring page constructor at `0x004d3000`. | objdump + RT3.lng strings + caller inspection + cargo-pool correlation |
| 117 | 0x004d3000 | 32 | map_editor_cargo_stats_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `Stats - Cargo` page in the map-editor control panel. The helper binds the report callback `0x004d2430` and attaches the resulting page into the broader editor section owner. Current grounded neighboring labels and report fields align this page with the cargo analytics family rather than with general validation. | objdump + RT3.lng strings + UI callback inspection + page-constructor correlation |
| 118 | 0x004d3020 | 32 | map_editor_city_region_growth_stats_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `Stats - City/Region` page in the map-editor control panel. The helper binds the report callback `0x004d1d60`, and the surrounding page text includes localized id `1114`, whose explanatory note about city growth from industry profit margins and modified rail revenue matches the same report callback. Current grounded evidence therefore treats this as the city-region growth analytics page. | objdump + RT3.lng strings + UI callback inspection + page-constructor correlation |
| 119 | 0x004d3060 | 100 | map_editor_tree_stats_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `Stats - Trees` page in the map-editor control panel. The helper binds the report callback `0x004d1b80` and attaches it into the broader editor page owner. This corrects the earlier overbroad validation naming: current grounded evidence says this constructor owns the dedicated tree-stats page rather than the whole general-validation lane. | objdump + RT3.lng strings + UI callback inspection + page-constructor correlation |
| 120 | 0x004d3080 | 32 | map_editor_general_validation_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `General Validation` page in the map-editor control panel. The helper binds the report callback `0x004d0a90` and sits alongside the neighboring stats and event-report pages in the same page table. Current grounded warning strings and validation checks make this the actual general-validation page rather than the adjacent tree-stats constructor. | objdump + RT3.lng strings + UI callback inspection + page-constructor correlation |
| 121 | 0x004d30a0 | 32 | map_editor_city_count_stats_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `Stats - City Count` page in the map-editor control panel. The helper binds the report callback `0x004d0420` and sits alongside the other editor report constructors in the active-section page table. Current grounded labels and report fields align it with the city-count and projected-density summary page. | objdump + RT3.lng strings + UI callback inspection + page-constructor correlation |
| 122 | 0x004d38c0 | 1228 | map_editor_event_variable_values_report | map | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Formats the localized `Event Variable Values` editor tracking report. The helper walks the active scenario issue-state arrays across the game, company, player-profile, and territory slices and emits the visible rows through localized ids `1118..1125`, including `Game : %1`, `Comp. : %1 : %2`, `Player : %1 : %2`, `Terr. : %1 : %2`, and the page title `Event Variable Values`. Current grounded caller is the event-variable page constructor at `0x004d4110`. | objdump + RT3.lng strings + caller inspection + scenario-issue-array correlation |
| 123 | 0x004d3d90 | 878 | map_editor_event_validation_report | map | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Formats the editor event-validation report over the live event collection at `0x0062be18`. The helper checks for missing required outcome events and per-event validation failures, then emits the bounded result strings `No Status event.`, `No Lose event.`, `No Win - Gold event.`, `No Win - Silver event.`, `No Win - Bronze event.`, `Error with event %1.`, and `No event errors detected.` from localized ids `1127..1133`. Current grounded caller is the neighboring page constructor at `0x004d4130`. | objdump + RT3.lng strings + caller inspection + event-collection correlation |
| 124 | 0x004d4110 | 32 | map_editor_event_variable_values_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side `Event Variable Values` tracking page in the map-editor control panel. The helper binds the report callback `0x004d38c0` and sits beside the neighboring event-validation page in the active-section page table. | objdump + RT3.lng strings + UI callback inspection + page-constructor correlation |
| 125 | 0x004d4130 | 32 | map_editor_event_validation_panel_construct | map | thiscall | inferred | objdump + RT3.lng strings + UI callback inspection | 4 | Constructs the shell-side event-validation page in the map-editor control panel. The helper binds the report callback `0x004d3d90`, which checks for missing status or win-lose events and other per-event errors before formatting the result list. | objdump + RT3.lng strings + UI callback inspection + page-constructor correlation |
| 126 | 0x00456920 | 3247 | unit_visual_init_weapon_airframe_and_exhaust_effects | bootstrap | thiscall | inferred | ghidra-headless | 4 | Initializes one armed-unit visual bundle spanning turret and cannon hardware exhaust emitters and aircraft airframe attachments. The routine creates static Turret Mantlet Cannon and MuzzleFlash assets at [this+0x31a] through [this+0x326] direct JetExhaust and PropExhaust sprite emitters at [this+0x2f6] and [this+0x2fa] a cannon-audio attachment at [this+0x32a] indexed WingL and WingR assets plus plane-audio state at [this+0x32e] through [this+0x346] and cached Aileron Elevator Rudder and Thrust vectors at [this+0x2d1] [this+0x2c5] [this+0x2b9] and [this+0x2dd]. | ghidra + rizin + llvm-objdump + strings |
| 127 | 0x00461650 | 120 | map_load_geographic_label_database | map | cdecl | inferred | ghidra-headless | 3 | Loads the geographic-label database branch inside the broader reference-bundle setup. It stages resource ids 0x5209 through 0x520b binds the selected bundle through 0x517d90 iterates the loaded collection with 0x517cf0 0x518380 and 0x518140 and dispatches each record through vtable slot +0x44 using the current map path context. | ghidra + rizin + llvm-objdump + strings |
| 128 | 0x00464410 | 12679 | shell_dispatch_ui_command | shell | cdecl | inferred | ghidra-headless | 4 | Large shell UI command dispatcher reached from shell-side event callbacks and direct command pushes. It switches over many command ids including 0x7530 through 0x7532 graphics-preset commands that route into 0x0051ebc0 0x00484590 and 0x004853c0; 0x7533 through 0x7534 TigerTank viewer actions; and 0x7540 through 0x7543 scenario-text report build and batch-processing commands that route into 0x00489830 0x004886e0 and 0x00489a20. | ghidra + rizin + llvm-objdump + strings |
| 129 | 0x00474610 | 120 | map_load_city_database | map | cdecl | inferred | ghidra-headless | 3 | Loads the city database branch in the same pattern as the geographic-label loader. It stages resource ids 0x61a9 through 0x61ab binds the selected bundle through 0x517d90 iterates the collection with 0x517cf0 0x518380 and 0x518140 and dispatches each record through vtable slot +0x44. | ghidra + rizin + llvm-objdump + strings |
| 130 | 0x00474e20 | 336 | effect_slot_create_attached_sprite_emitter | bootstrap | thiscall | inferred | ghidra-headless | 3 | Creates or clones one attached sprite emitter for an effect slot on the owning object. Depending on flag bit 0x400 it either clones through 0x00556ce0 or allocates a fresh 0x1fd template through 0x00556920 then attaches the emitter to the owner at [emitter+0x60] and optionally sets persistent flag [emitter+0xbc]. | ghidra + rizin + llvm-objdump |
| 131 | 0x00474f70 | 97 | effect_slot_update_attached_sprite_emitters | bootstrap | thiscall | inferred | ghidra-headless | 3 | Advances every sprite emitter stored in one effect-slot container by iterating its pointer list and calling 0x00555e50 with update mode zero. When the caller passes null it instead walks the global linked slot list rooted at 0x006cea74. | ghidra + rizin + llvm-objdump |
| 132 | 0x00477820 | 59 | profile_collection_count_active_chairman_records | map | thiscall | inferred | objdump + callsite inspection | 4 | Counts active chairman-profile records in the global persona collection at `0x006ceb9c`. The helper iterates the collection and increments the result only for entries whose live flag at `[profile+0x4]` is nonzero. Current grounded caller is `world_conditionally_seed_named_starting_railroad_companies` at `0x0047d440`, where count `>= 2` gates whether the second seeded railroad can be bound to another active chairman profile. | objdump + callsite inspection + caller correlation |
| 133 | 0x00477860 | 90 | profile_collection_get_nth_active_chairman_record | map | thiscall | inferred | objdump + callsite inspection | 4 | Returns one zero-based active chairman-profile record from the global persona collection at `0x006ceb9c`. The helper skips any entry whose live flag `[profile+0x4]` is zero and decrements the requested ordinal across the remaining active entries until it resolves one record or returns null. Current grounded caller is `world_conditionally_seed_named_starting_railroad_companies` at `0x0047d440`, which requests ordinal `1` to bind the second seeded railroad to the second active chairman profile when present. | objdump + callsite inspection + caller correlation |
| 134 | 0x00478200 | 291 | shell_queue_single_world_anchor_overlay | shell | cdecl | inferred | ghidra-headless | 3 | Builds one world-anchor overlay packet for the current owner object. It samples the owner transform through 0x00455800 and 0x00455810 derives projected half-height and half-width through 0x00477a10 world_anchor_measure_projected_half_height and world_anchor_measure_projected_half_width and then enqueues the finished marker through shell_queue_world_anchor_marker. | ghidra + rizin + llvm-objdump |
| 135 | 0x00478330 | 2432 | shell_queue_world_anchor_overlay_list | shell | cdecl | inferred | ghidra-headless | 3 | Builds and queues a repeated world-anchor overlay list for one owner-managed collection. The routine iterates several owner sublists and state branches repeatedly derives projected extents through 0x00477a10 0x004779c0 world_anchor_measure_projected_half_height and world_anchor_measure_projected_half_width and emits one shell_queue_world_anchor_marker packet per accepted overlay entry. | ghidra + rizin + llvm-objdump |
| 136 | 0x0047d080 | 186 | start_new_company_dialog_open | shell | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Opens the shell-side `Start New Company...` dialog rooted at localized id `574`. The helper rolls one persona-dependent shell color or portrait token through a small static table, allocates the modal shell window through the constructor/callback pair `0x0047c590` and `0x0047c3a0`, increments the scenario-side start-company generation counter at `[0x006cec78+0x41]`, and stores the live dialog owner at `0x006d3b4c`. Current grounded caller is the company-list window handler at `0x004c6f30`, which reaches this helper from the synthetic company-row id `0x7fff` after optional resignation confirmation through localized string `272` `You're currently chairman of the %1... Proceed?`. | objdump + RT3.lng strings + caller inspection |
| 137 | 0x0047d120 | 509 | start_new_company_dialog_commit_create_company | shell | cdecl | inferred | objdump + caller inspection + company-constructor inspection | 4 | Commits the shell-side `Start New Company...` dialog and creates one fresh live company record rather than claiming one of the pre-seeded named railroads. After validating the dialog state it resolves the selected chairman-profile summary from `0x006cec78`, unlinks any existing company from that chairman through `0x00427c70`, allocates a new company id from the live company collection at `0x0062be10`, formats the dialog-owned company-name buffer at `0x006cebd8`, and initializes the new company through `0x00428420`. It then clamps one startup-funding lane against the new company's local limit fields, writes the chosen funding back to `0x006cec14`, updates one per-profile financing slot at `[profile+company_id*4+0x15d]`, applies the resulting debt through `0x00476050`, publishes the new selected company id through `0x00433790`, and triggers one shell refresh through `0x00432f40`. When the dialog instead diverts into the `0x3f2` side path, it packages the same staged company payload into the Multiplayer preview request owner at `0x006cd8d8` through `0x00469d30`. | objdump + caller inspection + company-constructor inspection + global-state correlation |
| 138 | 0x0047d320 | 280 | start_new_company_request_create_company | map | thiscall | inferred | objdump + caller inspection + company-constructor inspection | 4 | Creates one fresh company record from a compact startup-company request block. The request layout is now partly grounded: `[this+0x0]` is the chairman profile id in `0x006ceb9c`, `[this+0x4]` is the localized railroad-name id or equivalent name token, `[this+0x8]` plus `[this+0xc]` form the startup-funding total later divided by the new company rate lane, and `[this+0x10]` is the staged company-name buffer. The helper unlinks any existing company from the referenced chairman through `0x00427c70`, allocates a fresh company id from the live company collection at `0x0062be10`, initializes that company through `0x00428420`, and updates one per-profile financing slot at `[profile+company_id*4+0x15d]`. If the request chairman matches the current selected chairman summary from `0x006cec78`, it also publishes the new selected company id through `0x00433790`. Current grounded caller is the neighboring startup-company branch at `0x00470e48`, which reaches this helper when the request cannot be resolved to an existing company record. | objdump + caller inspection + company-constructor inspection + global-state correlation |
| 139 | 0x0047e240 | 240 | placed_structure_query_candidate_local_service_metrics | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Queries one candidate-specific local service metric pair for the current placed-structure or site context. The helper first resolves the requested candidate index through the live structure collection at `0x0062ba8c` and rejects entries that fail `structure_candidate_is_enabled_for_current_year` at `0x0041e220`; on rejection it returns `0`, writes count `0` to the optional first out-pointer, and writes fallback float `1.0` to the optional second out-pointer. For live candidates it resolves the optional linked placed instance at `[this+0x04]`, passes that context through `0x00455f60`, and queries the base integer metric through `0x0042c960`; when the caller has a nonzero local sample list at `[this+0x38]` and `[this+0x34]`, it then accumulates matching per-cell float contributions from the world-grid table rooted at `[0x0062c120+0x2129]` into the second out-value. Current grounded callers include the shell or world-side branches at `0x0043f72e`, `0x0043f936`, `0x0047e365`, `0x0047ecd3`, `0x0047faff`, `0x004ba072`, `0x004bb51c`, and `0x00504d0f`, so this now looks like the first higher-level site query above the cargo-service bitset lane rather than another raw editor-runtime helper. | objdump + caller xrefs + callsite inspection + world-grid correlation |
| 140 | 0x0047e330 | 96 | placed_structure_count_candidates_with_local_service_metrics | map | thiscall | inferred | objdump + caller xrefs + callsite inspection | 3 | Counts how many live structure candidates currently produce a valid local service-metric result for the current placed-structure or site context. The helper walks the full candidate collection at `0x0062ba8c`, resolves each entry id through `0x00518380`, and reuses `placed_structure_query_candidate_local_service_metrics` at `0x0047e240` with null out-pointers; it increments the return value only when that lower query succeeds. Current grounded callers keep this in the same site-query family as `0x0047e240`, so it now looks like the bounded count wrapper above the candidate-local service-metric lane. | objdump + caller xrefs + callsite inspection |
| 141 | 0x0047e390 | 656 | placed_structure_query_cached_express_service_class_score | map | thiscall | inferred | objdump + caller xrefs + string correlation + callsite inspection | 3 | Cached site-side query for one express-service class score. The helper special-cases request ids `0x384`, `0x385`, and `0x386` through three cached float-plus-timestamp pairs at `[this+0x14]/[+0x20]`, `[this+0x10]/[+0x1c]`, and `[this+0x0c]/[+0x18]`; when a cached value is younger than `0x0b40` ticks it returns immediately. On a cold path it scans all `0x35` live structure candidates, uses `0x0041e260` to keep only candidates that match the requested class, and then accumulates local per-cell contributions from the repeated sample list at `[this+0x34]` and the same world-grid tables under `[0x0062c120+0x2129]`. Nearby strings now strongly align the three class ids with the express cargo family `Passengers`, `Mail`, and `Troops`, but current grounded callers still treat this as a generic class-score query rather than a fully named UI lane. Current grounded callers include the shell or world-side branches at `0x00506c2d`, `0x00506c3d`, `0x00506e97`, and `0x00506ebf`. | objdump + caller xrefs + string correlation + callsite inspection + express-family correlation |
| 142 | 0x0047d440 | 845 | world_conditionally_seed_named_starting_railroad_companies | map | cdecl | inferred | objdump + caller xrefs + global-state inspection | 4 | Conditional company-side setup helper adjacent to the `Setting up Players and Companies...` lane. Current grounded callers are the neighboring bring-up flow after world_seed_default_chairman_profile_slots at `0x004377a0` and a second setup-side branch around `0x00438300`, both under the same sandbox or non-editor shell-state conditions: it runs only when the Multiplayer preview dataset owner at `0x006cd8d8` is absent and either sandbox flag `[0x006cec7c+0x82]` is set or shell-state flag `[0x006cec74+0x14c]` is set while editor-map mode `[0x006cec74+0x68]` is clear. The helper first realigns the selected company from the chosen chairman profile when the current summary pair points at a missing company, then iterates exactly three fixed localized railroad-name ids through `0x00428420`: `0x23f` `Missouri Pacific`, `0x240` `New York Central`, and `0x241` `Grand Trunk Railroad` from `RT3.lng` ids `575..577`. That makes the branch look like a seeded trio of named starting railroad companies rather than a generic company refresh. The first seeded company is tied to the selected chairman-profile summary from `0x006cec78`, tuned from that selected chairman's per-profile fields `[profile+0x154]` and `[profile+0x158]`, and then written back as the selected company id through `0x00433790`. The second company is narrower now too: it only binds when `profile_collection_count_active_chairman_records` at `0x00477820` reports at least two live chairman records, and it then links through `profile_collection_get_nth_active_chairman_record` at `0x00477860` with ordinal `1`, so the second railroad is specifically the second active chairman-owned company rather than an arbitrary extra bind. The third railroad currently gets no matching chairman-link branch in the grounded code and therefore remains an unchaired named company in the live roster. All three records are constructed or refreshed from the live company collection at `0x0062be10` through `0x00428420`, while chairman-to-company ownership links are applied through `0x00427c70` and neighboring writes to `[profile+0x1dd]`. | objdump + caller xrefs + global-state inspection + state-accessor correlation + RT3.lng strings + company-constructor inspection + profile-helper inspection |
| 143 | 0x00483f70 | 352 | shell_service_pump_iteration | shell | thiscall | inferred | objdump + analysis-context | 4 | Executes one outer shell-service iteration on the shell state rooted at 0x006cec74. The helper can queue service event 0xcc through the shell bundle at 0x006d4018 polls that bundle through 0x00483ea0 refreshes active-mode or shell-state flags ensures the controller work pointer [0x006d4024+0x28] defaults to 0x0062be68 runs several global maintenance helpers and auxiliary cleanup then dispatches shell_state_service_active_mode_frame; when shell-state flag [this+0x501] is set it also marks the controller layout dirty through 0x0051f070 before returning the loop-continue result. bootstrap_init_shell_window_services calls it in the repeating shell loop that appears to own the observed shell lifetime before teardown. | objdump + analysis-context + caller xrefs |
| 144 | 0x00485750 | 14 | shell_has_tiger_tank_viewer | shell | cdecl | inferred | ghidra-headless | 4 | Returns whether the dedicated TigerTank shell viewer object at 0x006cfc8c is currently active. The 0x7533 open and 0x7534 close commands both gate on this global before showing status text or mutating viewer state. | ghidra + rizin + llvm-objdump + strings |
| 145 | 0x004840e0 | 863 | bootstrap_init_shell_window_services | bootstrap | cdecl | inferred | ghidra-headless | 4 | Consumes the early bootstrap object then allocates and installs the shell service bundle rooted at 0x006d4024 seeds a 640x480 fallback and enters the bootstrap-owned shell loop around shell_service_pump_iteration at 0x00483f70 until shell state [this+0x10] changes; after each break it drives the next shell mode transition through 0x00482ec0 and when the shell lifetime finally ends it tears the shell bundle back down through 0x00521390 before returning to app_bootstrap_main. | ghidra + rizin + llvm-objdump |
| 146 | 0x00484440 | 323 | app_bootstrap_main | bootstrap | cdecl | inferred | ghidra-headless | 4 | Primary post-CRT bootstrap coordinator; initializes COM and branding strings probes host state allocates the shell state at 0x006cec74 and then hands shell execution into bootstrap_init_shell_window_services. After that helper returns it releases the shell globals and finishes the remaining process-tail cleanup before exiting back through the CRT. | ghidra + rizin + llvm-objdump |
| 147 | 0x00484590 | 887 | shell_init_graphics_preset_state | shell | cdecl | inferred | ghidra-headless | 3 | Initializes the shell graphics-preset state block rooted at [this+0x70]. It clears a large option buffer seeds many default fields and applies one of three coarse mode layouts from its integer argument before later preset application or config-save helpers continue. | ghidra + rizin + llvm-objdump |
| 148 | 0x00484910 | 105 | shell_save_graphics_config | shell | cdecl | inferred | ghidra-headless | 4 | Persistently writes the current shell graphics configuration to data\\configuration\\game.cfg. It optionally syncs the global display runtime through 0x0051eea0 then writes config keys 0x429 and 0x48d from the shell state block before closing the file. | ghidra + rizin + llvm-objdump + strings |
| 149 | 0x00484980 | 212 | shell_load_graphics_config_or_init_defaults | shell | cdecl | inferred | ghidra-headless | 4 | Loads the shell graphics configuration from data\\configuration\\game.cfg during early shell setup. It optionally pulls the larger display-runtime blob through 0x0051ef20 validates key 0x429 reads key 0x48d into the shell state block at [this+0x70] and falls back to 0x00484590 plus 0x00484910 when the file is missing or invalid. | ghidra + rizin + llvm-objdump + strings |
| 150 | 0x00484a60 | 125 | shell_match_legacy_gpu_profile_token | shell | cdecl | inferred | ghidra-headless | 4 | Collects the current display-adapter descriptor string then scans the legacy GPU-profile table at 0x0062142c for the first matching token. The table contains vendor and chipset strings such as geforce radeon Voodoo matrox i810 sis savage and 3dfx; the returned index or -1 then drives the preset-tier tables in 0x004853c0. | ghidra + rizin + llvm-objdump + strings |
| 151 | 0x00484d70 | 700 | shell_apply_graphics_option_runtime_effects | shell | thiscall | inferred | ghidra-headless | 3 | Walks the pending graphics-option array rooted at [this+0x1c] and applies runtime side effects for the dirty entries selected by the caller mask. The cases fan into the active engine object at 0x0062c120 and shell globals under 0x006d4024 and 0x006d4030 updating several float scaled thresholds integer quality values and display capability bytes before clearing the dirty array and notifying the active shell object at 0x0062be68. | ghidra + rizin + llvm-objdump |
| 152 | 0x004852e0 | 210 | shell_apply_default_graphics_master_profile | shell | thiscall | inferred | ghidra-headless | 4 | Reads the default master graphics profile value from 0x006211dc currently 6 and broadcasts it across option ids 1 through 16 in the shell settings block. Special option ids 10 11 12 and 13 are remapped through the preset tables at 0x00621250 through 0x00621358 before the function refreshes runtime side effects through 0x00484d70 updates shell display-profile flags under 0x006d4024 and persists game.cfg through 0x00484910. | ghidra + rizin + llvm-objdump |
| 153 | 0x004853c0 | 740 | shell_apply_graphics_preset_bundle | shell | cdecl | inferred | ghidra-headless | 4 | Applies one table-driven graphics preset bundle to the shell settings object. It derives a preset tier from shell state and runtime capability probes then writes per-setting values through repeated 0x00485060 calls refreshes dependent runtime state through 0x00484d70 optionally saves game.cfg through 0x00484910 and updates several display capability flags under 0x006d4024. | ghidra + rizin + llvm-objdump |
| 154 | 0x00485060 | 635 | shell_set_graphics_option_with_fanout | shell | thiscall | inferred | ghidra-headless | 4 | Writes one graphics option value into the shell settings arrays at [this+0xac] and coordinates grouped fanout updates. Primary preset selectors recursively expand into dependent option ids 1 through 16 using preset remap tables at 0x00621250 through 0x00621358. The function compares the new normalized value against the previous setting invokes 0x00484d70 when a runtime refresh is needed and persists game.cfg through 0x00484910 once the update batch completes. | ghidra + rizin + llvm-objdump |
| 155 | 0x00485760 | 2746 | vehicle_visual_init_running_gear_and_smoke_effects | bootstrap | thiscall | inferred | ghidra-headless | 4 | Builds a larger vehicle visual bundle covering running-gear assets smoke effects and attachment-audio objects. The routine fills indexed road-wheel visual arrays from RoadWheelR and RoadWheelL asset strings creates direct MuzzleSmoke and ExhaustSmoke sprite emitters at [this+0x216] and [this+0x21a] and then creates five fixed attachment objects at [this+0x3cc] through [this+0x3dc] for diesel1 tracks german88 turret and mantlet audio assets before registering them on the owner. | ghidra + rizin + llvm-objdump + strings |
| 156 | 0x004883f0 | 325 | scenario_text_export_append_numbered_entry | scenario | cdecl | inferred | ghidra-headless | 4 | Formats and appends one numbered translation entry into the scenario-text export buffer. It duplicates the source text applies the export wrapper template through helper formatters and appends the finished block through 0x531030 while updating the running non-comment word count at 0x006cfca0. | ghidra + rizin + llvm-objdump + strings |
| 157 | 0x004886e0 | 3796 | scenario_text_export_build_language_file | scenario | cdecl | inferred | ghidra-headless | 4 | Builds one MAPS\\%s.lng scenario-text export for the active map and returns the non-comment word count. It writes translator guidance and section headers then walks map briefing territory city geographic-label station company and event collections appending numbered entries through 0x004883f0 before finalizing the output buffer. | ghidra + rizin + llvm-objdump + strings |
| 158 | 0x00487450 | 153 | shell_open_tiger_tank_viewer | shell | cdecl | inferred | ghidra-headless | 3 | Allocates and shows the dedicated TigerTank shell viewer object when no viewer is active. It samples shell-owned placement data allocates a 0x434-byte object initializes it through 0x00485760 with the TigerTank title and stores the resulting viewer pointer in 0x006cfc8c. | ghidra + rizin + llvm-objdump + strings |
| 159 | 0x004874f0 | 70 | shell_close_tiger_tank_viewer | shell | cdecl | inferred | ghidra-headless | 4 | Closes and frees the dedicated TigerTank shell viewer rooted at 0x006cfc8c. It detaches the viewer if currently selected in the shell owner at 0x0062be68 destroys its internal resources through 0x00530680 frees the object and clears the global viewer slot. | ghidra + rizin + llvm-objdump + strings |
| 160 | 0x00489830 | 496 | scenario_text_export_report_language_file | scenario | cdecl | inferred | ghidra-headless | 3 | Opens one existing MAPS\\%s.lng file for the selected map and reports on its parsed contents without rebuilding it. The routine loads the file into memory iterates numbered entries through 0x00488540 formats summary strings through 0x004895c0 and presents success or failure dialogs when interactive mode is enabled. | ghidra + rizin + llvm-objdump + strings |
| 161 | 0x00489a20 | 1085 | scenario_text_export_batch_process_maps | scenario | cdecl | inferred | ghidra-headless | 4 | Enumerates maps\\*.gmp and batch-processes every scenario through the scenario-text export branch. Command 0x7542 runs the build path through 0x004886e0 while command 0x7543 runs the report path through 0x00489830; the wrapper tracks progress formats per-map status strings and emits a final summary dialog. | ghidra + rizin + llvm-objdump + strings |
| 162 | 0x004c1b60 | 462 | shell_company_detail_refresh_selected_territory_access_summary | shell | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Refreshes the selected-territory status summary in `CompanyDetail.win`. The helper caches the active territory id in `0x006cfe5c`, resolves the territory through `0x006cfc9c`, and formats one of three localized status texts for the current selected company: id `946` when the company already has access rights, id `947` when rights are unavailable but purchasable, or id `948` when the company cannot purchase rights at all. It also republishes the selected-territory control rooted at `0x948c`. Current grounded callers are the territory-summary callbacks at `0x004c1d30`, `0x004c1d70`, and `0x004c22e0`. | objdump + RT3.lng strings + caller inspection + territory-status correlation |
| 163 | 0x004c3890 | 693 | shell_company_detail_issue_bond_offer_flow | shell | thiscall | inferred | objdump + RT3.lng strings + caller inspection | 4 | Runs the `CompanyDetail.win` bond-issue action flow. The helper resolves the currently selected company through the shell detail owner at `0x006d0818`, rejects requests when the company already has too many outstanding bonds through localized id `973`, rejects weak credit through localized id `974` plus the credit-rating tables at `0x00620d00..0x00620d14`, and otherwise opens the underwriter offer dialog for localized ids `968` through `972`. On acceptance it issues the bond through the selected-company method at `0x004275c0`; when the multiplayer-side shell owner is active it instead packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded caller is `shell_company_detail_window_handle_message` at `0x004c56a0`. | objdump + RT3.lng strings + caller inspection + bond-dialog correlation |
| 164 | 0x004c3f30 | 968 | shell_company_detail_issue_stock_offer_flow | shell | thiscall | inferred | objdump + RT3.lng strings + caller inspection | 4 | Runs the `CompanyDetail.win` stock-issue action flow. The helper derives a proposed share count and proceeds from the selected company into the local globals `0x006cfe64` and `0x006cfe68`, rejects weak offerings through localized id `979`, rejects oversaturated issuance through localized id `980`, and otherwise opens the underwriter offer dialog for localized ids `975` through `978`. On acceptance it issues the stock through the selected-company method at `0x00427450`; when the multiplayer-side shell owner is active it routes the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded caller is `shell_company_detail_window_handle_message` at `0x004c56a0`. | objdump + RT3.lng strings + caller inspection + stock-issue correlation |
| 165 | 0x004c46d0 | 1420 | shell_company_detail_buyback_stock_flow | shell | thiscall | inferred | objdump + RT3.lng strings + caller inspection | 4 | Runs the `CompanyDetail.win` stock-buyback action flow. The helper computes a proposed repurchase quantity and total cash cost into `0x006cfe64` and `0x006cfe68`, rejects cases with no public float through localized id `985`, rejects requests that would retire the final protected share band through id `986`, rejects insufficient company cash through id `987`, and otherwise opens the broker buyback dialog for localized ids `981` through `984`. On acceptance it repurchases the shares through the selected-company method at `0x004273c0`; when the multiplayer-side shell owner is active it routes the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded caller is `shell_company_detail_window_handle_message` at `0x004c56a0`. | objdump + RT3.lng strings + caller inspection + stock-buyback correlation |
| 166 | 0x004c5360 | 472 | shell_company_detail_change_dividend_rate_flow | shell | thiscall | inferred | objdump + RT3.lng strings + caller inspection | 4 | Runs the `CompanyDetail.win` dividend-rate action flow. The helper seeds the current dividend-per-share value from `[company+0x4b]` into `0x006cfe48`, opens the shared finance dialog rooted at callbacks `0x004c4c70`, `0x004c4e30`, and `0x004c5140` under localized ids `988` through `990`, and then commits the accepted new dividend rate through the selected-company method at `0x00423fb0`. When the multiplayer-side shell owner is active the same request is packaged through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded caller is `shell_company_detail_window_handle_message` at `0x004c56a0`. | objdump + RT3.lng strings + caller inspection + dividend-dialog correlation |
| 167 | 0x004c2ca0 | 1964 | shell_company_detail_window_refresh_controls | shell | thiscall | inferred | objdump + strings + caller inspection | 4 | Shared refresh pass for the shell-side `CompanyDetail.win` family rooted at `0x006cfe4c`. The helper first requires a live shell detail-panel owner at `0x006d0818` with a selected company id in `[detail+0x90]`, resolves that company through the live collection at `0x0062be10`, and then repopulates the control bands rooted at `0x9476`, `0x947b`, `0x9480`, `0x948f`, and `0x9490`. Current grounded cases include a four-tab selector strip keyed by `0x006cfe60`, per-company chairman text or vacancy text through localized ids `0x3be` and `0x3bf`, and repeated control-tree updates through `0x00540120` and `0x0053f830`. The constructor at `0x004c5540` and many message-side branches at `0x004c56a0` converge back into this helper, which makes it the current owner-side refresh pass for the CompanyDetail window rather than a generic company-list helper. | objdump + strings + caller inspection + control-band correlation |
| 168 | 0x004c5540 | 347 | shell_company_detail_window_construct | shell | thiscall | inferred | objdump + strings + detail-manager correlation | 4 | Constructs the shell-side `CompanyDetail.win` panel later published at `0x006cfe4c`. The constructor installs vtable `0x005d0858`, binds `CompanyDetail.imb` and `CompanyDetail.win` through `0x0053d110` and `0x0053fa50`, seeds the primary action controls `0x9470`, `0x9471`, `0x947d`, `0x947e`, `0x948c`, `0x948d`, and `0x948e` through callbacks `0x004c1730`, `0x004c1ab0`, `0x004c1ec0`, `0x004c22e0`, `0x004c1d70`, and `0x004c1d30`, stores the singleton resources at `0x006cfe50..0x006cfe58`, and then immediately repopulates the visible state through `shell_company_detail_window_refresh_controls` at `0x004c2ca0`. A grounded shell detail-manager caller reaches this constructor at `0x004dde24`, which corrects the earlier assumption that the post-roster company branch still had no recovered detail-window owner. | objdump + strings + detail-manager correlation + caller inspection |
| 169 | 0x004c56a0 | 4228 | shell_company_detail_window_handle_message | shell | thiscall | inferred | objdump + strings + caller inspection | 4 | Primary message dispatcher for the shell-side `CompanyDetail.win` family rooted at vtable `0x005d0858`. The helper switches on the incoming shell message id and then on wide control bands beginning at `0x94e8` and `0x9510`, routes the grounded finance actions into `shell_company_detail_issue_bond_offer_flow` `0x004c3890`, `shell_company_detail_issue_stock_offer_flow` `0x004c3f30`, `shell_company_detail_buyback_stock_flow` `0x004c46d0`, and `shell_company_detail_change_dividend_rate_flow` `0x004c5360`, and also grounds the non-finance action lanes through `shell_company_detail_resign_chairmanship_flow` `0x004c5a0e`, `shell_company_detail_bankruptcy_flow` `0x004c5b99`, `shell_company_detail_buy_territory_access_rights_flow` `0x004c5fc9`, `shell_company_detail_attempt_merger_flow` `0x004ec640`, and `shell_company_detail_attempt_chairmanship_takeover_flow` `0x0050ccc0`. It repeatedly converges back into `shell_company_detail_window_refresh_controls` at `0x004c2ca0` after state changes. Current grounded evidence is enough to treat this as the real company-detail owner path, while the remaining uncertainty has narrowed to deeper election or merger result-resolution helpers rather than the ownership of the action lanes themselves. | objdump + strings + caller inspection + control-band correlation |
| 170 | 0x004c5a0e | 268 | shell_company_detail_resign_chairmanship_flow | shell | thiscall | inferred | objdump + RT3.lng strings + caller inspection | 4 | Runs the `CompanyDetail.win` resignation confirmation flow. The branch opens localized confirmation id `964` `Are you sure you want to resign the chairman's position?` and on acceptance commits the change through `company_clear_selected_chairman_if_current_profile` at `0x00428a10`. When the multiplayer-side shell owner is active it packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8` instead of mutating the company immediately. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`. | objdump + RT3.lng strings + caller inspection + dialog correlation |
| 171 | 0x004c5b99 | 428 | shell_company_detail_bankruptcy_flow | shell | thiscall | inferred | objdump + RT3.lng strings + caller inspection | 4 | Runs the `CompanyDetail.win` bankruptcy action flow. The branch checks the localized cooldown and eligibility strings `965` through `967`, rejects requests when the selected company is not yet bankruptable, and on acceptance commits the change through `company_declare_bankruptcy_and_halve_bond_debt` at `0x00425a90`. When the multiplayer-side shell owner is active it packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8` instead of mutating the company immediately. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`. | objdump + RT3.lng strings + caller inspection + bankruptcy-dialog correlation |
| 172 | 0x004c5fc9 | 659 | shell_company_detail_buy_territory_access_rights_flow | shell | thiscall | inferred | objdump + RT3.lng strings + caller inspection | 4 | Runs the `CompanyDetail.win` territory-access purchase flow for the currently selected territory. The branch first resolves the selected territory from the territory-summary controls rooted at `0x948c..0x948e`, requires that the detail panel is still showing the current chairman-owned company, then splits cleanly by access state. When the company lacks rights but the territory is purchasable, it computes the access-rights price through `0x004879f0`, shows localized id `961` when purchase is possible, id `962` when cash is insufficient, and id `963` when rights cannot be purchased at all. Accepting id `961` commits the change through `company_set_territory_access_rights_byte` at `0x00424030` and the cash-side mutation at `0x0042a040`; when the multiplayer-side shell owner is active it instead packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`. | objdump + RT3.lng strings + caller inspection + territory-access branch correlation |
| 173 | 0x004eb890 | 381 | shell_present_merger_vote_outcome_dialog | shell | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Single-player merger-vote outcome presenter used by the merger result path. The helper resolves the two merger companies from `0x006d10dc` and `0x006d10de`, chooses localized title id `729` `Merger Succeeds!!!` or `730` `Merger Fails!!!`, formats the vote tally labels `731` `Votes In Favor:` and `732` `Votes Against:`, and renders the final result dialog through the shell presentation callback rooted at `0x006d111c`. Current grounded caller is `shell_resolve_merger_vote_and_commit_outcome` at `0x004ebd10` on the single-player branch. | objdump + RT3.lng strings + caller inspection + merger-result dialog correlation |
| 174 | 0x004ebd10 | 1202 | shell_resolve_merger_vote_and_commit_outcome | shell | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Resolves the single merger vote, commits the outcome, and records cooldown state. The helper walks the active chairman profile collection at `0x006ceb9c`, computes weighted votes for and against the proposed merger between companies `0x006d10dc` and `0x006d10de`, accumulates the affirmative share count into `0x006d110c`, compares that total against half the target-company value, and then splits by single-player versus multiplayer. In single-player it presents the result through `shell_present_merger_vote_outcome_dialog` at `0x004eb890`; in multiplayer it formats localized id `3059` `Merger between '%1' and '%2' has %3.` with result strings `3060` or `3061` and routes the payload through the shell transport. On success it commits the merger through `0x00427e20`; on failure it stamps the current year into `[company+0x15f]` as the grounded merger-cooldown field. | objdump + RT3.lng strings + caller inspection + merger-vote resolution correlation |
| 175 | 0x004ec640 | 732 | shell_company_detail_attempt_merger_flow | shell | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Runs the `CompanyDetail.win` merger-attempt flow. The helper rejects empty worlds through localized id `727`, rejects recent failed merger cooldown cases through id `728`, and then opens the merger offer or vote dialog family rooted at the local globals `0x006d10cc..0x006d1120`. The grounded single-player path checks the proposed premium against company cash through localized id `3889`, can open a premium-confirmation prompt through id `4067`, and on acceptance commits through the company merger helper at `0x00427e20` or the broader vote-resolution path at `0x004ebd10`. When the multiplayer-side shell owner is active it packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8` instead of mutating company state immediately. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`. | objdump + RT3.lng strings + caller inspection + merger-dialog correlation |
| 176 | 0x00504a90 | 70 | shell_station_detail_clear_active_candidate_service_preview | shell | thiscall | inferred | objdump + caller inspection + state correlation | 4 | Clears the active candidate-service preview owned by `StationDetail.win`. The helper first resets the shared `(placed-structure id, candidate id)` pair at `0x005ee4fc` and `0x005ee500` through `0x0043f610`, then tears down the local station-detail preview latch at `[this+0x7c]` and decrements the sibling global refcount `0x0062be84` when that preview was armed. When the live world owner at `0x0062c120` is in the matching preview-capable mode gate rooted at `[+0x2171]` and `[+0x2175]`, it tails into the neighboring world-side clear path at `0x00452d30`. Current grounded callers are the station-detail selection reset branches around `0x00504bca`, `0x00504bda`, and the later cleanup family at `0x00505bff` and `0x00505c0a`. | objdump + caller inspection + world-preview correlation |
| 177 | 0x00504ae0 | 174 | shell_station_detail_set_active_candidate_service_preview | shell | thiscall | inferred | objdump + caller inspection + state correlation | 4 | Arms the active candidate-service preview for `StationDetail.win`. The helper begins by clearing the old preview through `shell_station_detail_clear_active_candidate_service_preview` at `0x00504a90`, then when the supplied candidate id is nonzero and the live world owner at `0x0062c120` is in the matching preview-capable mode gate it routes the current detail-panel station id through the world-side preview family at `0x00452f60`, `0x00452d80`, `0x00452db0`, and `0x00452ca0`. On success it latches the preview-active bit at `[this+0x7c]`, increments the sibling global refcount `0x0062be84`, and stores the active `(station id, candidate id)` pair into `0x005ee4fc` and `0x005ee500` through `0x0043f620`. This is the shell-side owner that feeds the broader world scanner rooted at `0x0043f640` with the currently inspected station-detail candidate pair. | objdump + caller inspection + world-preview correlation + global-pair correlation |
| 178 | 0x00504bea | 722 | shell_station_detail_format_candidate_local_service_summary | shell | thiscall | inferred | objdump + RT3.lng strings + caller inspection | 4 | Formats the candidate-local-service summary lane inside `StationDetail.win`. The helper validates the current station id from the detail manager through collection `0x006cec20`, resolves the candidate record through `0x0062ba8c`, and when the ordinary station-detail path is active it re-enters `shell_station_detail_set_active_candidate_service_preview` at `0x00504ae0` before querying `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`. It then formats the visible candidate text using localized ids `681` `%1: Loads available: %2`, `682` `Current Price: %1`, and the explanatory text `2813` `Prices shown are the average profit per load for delivering %1 from %2 to that station...`; neighboring branches also use localized ids `688` and `689` for the nearby-structure jump affordance. This now looks like the shell-side candidate-service readout above the same local service metric lane used by the station freight and express summaries. | objdump + RT3.lng strings + caller inspection + service-query correlation |
| 179 | 0x0050c500 | 426 | shell_present_chairmanship_takeover_vote_outcome_dialog | shell | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Single-player chairmanship-takeover outcome presenter used by the special election path. The helper resolves the target company from `0x006d1a0c`, chooses localized title id `626` `New Chairman Takes Over!!!` or `627` `Chairmanship Takeover Fails!!!`, formats the tally labels `628` `Votes in favor` and `629` `Votes Against`, and renders the final result dialog through the shell presentation callback rooted at `0x006d1a34`. Current grounded caller is `shell_resolve_chairmanship_takeover_vote_and_commit_outcome` at `0x0050c940` on the single-player branch. | objdump + RT3.lng strings + caller inspection + takeover-result dialog correlation |
| 180 | 0x0050c940 | 880 | shell_resolve_chairmanship_takeover_vote_and_commit_outcome | shell | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Resolves the special chairman's election, commits the outcome, and records cooldown state. The helper walks the active chairman profile collection at `0x006ceb9c`, computes weighted votes for and against the takeover of company `0x006d1a0c` by chairman profile `0x006d1a0e`, accumulates the affirmative share count into `0x006d1a30`, compares that total against half the target-company value, and then splits by single-player versus multiplayer. In single-player it presents the result through `shell_present_chairmanship_takeover_vote_outcome_dialog` at `0x0050c500`; in multiplayer it formats localized id `3082` `Takeover attempt of '%1' by '%2' has %3.` with result strings `3060` or `3061` and routes the payload through the shell transport. On success it transfers chairmanship through `0x00428a30`; on failure it stamps the current year into `[company+0x289]` as the grounded takeover-cooldown field. | objdump + RT3.lng strings + caller inspection + takeover-vote resolution correlation |
| 181 | 0x0050ccc0 | 709 | shell_company_detail_attempt_chairmanship_takeover_flow | shell | thiscall | inferred | objdump + RT3.lng strings + caller inspection | 4 | Runs the `CompanyDetail.win` chairmanship-takeover flow against the currently selected company. The helper reads the caller's current share ownership in the target company, rejects insufficient holdings through localized id `623`, rejects recent failed takeover cooldown cases through id `624`, and otherwise opens the special chairman's election confirmation under id `625`. The grounded single-player path seeds the local takeover-election state at `0x006d1a08..0x006d1a38` and launches the follow-on election helper at `0x0050c940`; when the multiplayer-side shell owner is active it instead packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`. | objdump + RT3.lng strings + caller inspection + takeover-election correlation |
| 182 | 0x004c6b40 | 105 | shell_company_list_format_company_or_start_row | shell | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Formats one row in the shell-side company list. When the incoming row id is the synthetic sentinel `0x7fff`, the helper formats localized id `266` `<<Start New Company>>` and stores it through the current row widget at `0x006cfe78`. Otherwise it resolves the live company id through the company collection at `0x0062be10` and delegates the richer row text to `0x004bfb30`. Current grounded caller is `shell_company_list_window_refresh_rows` at `0x004c6c30`. | objdump + RT3.lng strings + caller inspection |
| 183 | 0x004c6bb0 | 123 | shell_company_list_activate_or_shift_center_company | shell | cdecl | inferred | objdump + RT3.lng strings + caller inspection | 4 | Handles activation on one live company row in the shell company list. The helper first verifies that the company id exists in the live company collection at `0x0062be10`, then notifies the shell detail-panel family at `0x006d0818`. If Shift is held through shell-input bits `[0x006d4018+0xa8c]&0x3` and the row is not the currently selected chairman company, it resolves the company's primary station or anchor through `0x00427260`, translates that station into a world-view target through `0x0047de00`, and centers the active world view through `0x0043c9a0`. That matches localized help string `2992` `Shift-Click to center on this company's primary station.` | objdump + RT3.lng strings + caller inspection + shell-input correlation |
| 184 | 0x004c6c30 | 765 | shell_company_list_window_refresh_rows | shell | thiscall | inferred | objdump + RT3.lng strings + caller inspection | 4 | Rebuilds the shell company-list window rows. The helper clears the two mirrored list controls under ids `0x2ee1` and `0x2ee2`, iterates the live company collection at `0x0062be10`, and formats each company row with one of three localized status strings: id `267` `You are the chairman of the %1!` for the currently selected chairman company from `0x00434870`, id `268` `The %1 has no chairman at the moment.` when `[company+0x3b]` is zero, or id `269` `%1 is the chairman of the %2.` plus suffix id `270` `Double-click for details.` when another chairman profile is attached. When the row also has a primary station, the helper appends localized help id `2992` `Shift-Click to center on this company's primary station.` After the live-company rows are rebuilt, it conditionally appends the synthetic row id `0x7fff` through `shell_company_list_format_company_or_start_row` so `<<Start New Company>>` appears as a separate affordance rather than as part of the seeded trio itself. It also refreshes the currently selected list index at `[this+0x78]`. | objdump + RT3.lng strings + caller inspection + company-list iteration |
| 185 | 0x004c6f30 | 704 | shell_company_list_window_handle_message | shell | thiscall | inferred | objdump + RT3.lng strings + caller inspection | 4 | Message dispatcher for the shell company-list window. Selection changes on controls `0x2ee1` and `0x2ee2` toggle the mirrored list selection state and the local start-company affordance latch at `0x006cfe7c`. Activating one live company row routes through `shell_company_list_activate_or_shift_center_company` at `0x004c6bb0` or opens its detail path through the shell detail-panel manager `0x004ddbd0`. Activating the synthetic row id `0x7fff` instead checks whether the current chairman can start a new company, optionally shows localized confirmation id `272` `You're currently chairman of the %1... Proceed?`, and then opens the dedicated `Start New Company...` dialog through `start_new_company_dialog_open` at `0x0047d080`. When that dialog closes while the company-list window remains active, the handler rebuilds the rows through `shell_company_list_window_refresh_rows` at `0x004c6c30`. | objdump + RT3.lng strings + caller inspection + dialog correlation |
| 186 | 0x004c7200 | 212 | shell_company_list_window_construct | shell | thiscall | inferred | objdump + caller inspection + strings | 4 | Constructs the shell company-list window rooted at globals `0x006cfe70..0x006cfe7c`. The helper allocates two mirrored list widgets under ids `0x2ee1` and `0x2ee2`, attaches the row formatter `shell_company_list_format_company_or_start_row` at `0x004c6b40`, the live-row activation handler `shell_company_list_activate_or_shift_center_company` at `0x004c6bb0`, publishes the current selected-index storage at `[this+0x78]`, and then calls `shell_company_list_window_refresh_rows` at `0x004c6c30`. It also toggles the start-company affordance controls `0x2ee3` and `0x2ee4` from the global latch `0x006cfe7c`, which matches the handler-side selection logic for the synthetic `<<Start New Company>>` row. | objdump + caller inspection + control wiring |
| 187 | 0x005068c0 | 443 | shell_station_detail_window_construct | shell | thiscall | inferred | objdump + strings + detail-manager correlation | 4 | Constructs the shell-side `StationDetail.win` panel owned by detail-manager mode `8`. The constructor installs the singleton at `0x006d16d8`, binds `StationDetail.imb` and `StationDetail.win` through `0x0053d110` and `0x0053fa50`, seeds the paired action controls `0xb3b7` and `0xb3b8` through callback `0x00506610`, toggles the adjacent navigation controls `0xb3b3` and `0xb3b4`, and conditionally refreshes the gated action control `0xb3f8` through `0x005044b0`. This corrects the older company-browser reading: current grounded resource names and control wiring put mode `8` on a station-detail lane rather than on a company-detail browser. | objdump + strings + detail-manager correlation + caller inspection |
| 188 | 0x00506be0 | 360 | shell_station_detail_format_freight_and_express_summary | shell | cdecl | inferred | objdump + strings + caller inspection | 4 | Formats the visible freight and express summary lines on the shell-side `StationDetail.win` panel. The helper resolves the selected placed-structure record, builds the weighted freight total through the neighboring cargo-summary helper at `0x005519f0`, queries the cached express-side service totals through `placed_structure_query_cached_express_service_class_score` at `0x0047e390` for class ids `0x0385` and `0x0386`, and then writes the localized lines `Freight: %1` and `Express: %1` through string ids `239` and `240`. This is the first grounded shell-detail consumer of the local service bundle rebuilt beneath `0x0042d580`. | objdump + strings + caller inspection + service-query correlation |
| 189 | 0x00506d50 | 252 | shell_station_list_handle_center_or_rename_action | shell | cdecl | inferred | objdump + strings + caller inspection | 4 | Handles the station-list row modifier actions after the active station row is resolved from collection `0x006cec20`. The helper reads the packed shell input modifier bits from `0x006d4018+0xa8c`; with Shift it recenters the world view on the selected station through `0x0047de00` and `0x00433900`, and with Control it opens the station rename prompt through localized id `3732` `Enter station name:`. This helper is the modifier-aware side-action lane paired with the visible freight or express station-row summaries. | objdump + strings + caller inspection + input-state correlation |
| 190 | 0x00506e50 | 221 | shell_station_list_format_freight_and_express_availability_summary | shell | cdecl | inferred | objdump + strings + caller inspection | 4 | Formats the visible `StationList.win` row summary for one selected station. The helper resolves the placed-structure record from collection `0x006cec20`, queries the cached express-side service totals through `placed_structure_query_cached_express_service_class_score` at `0x0047e390` for class ids `0x0385` and `0x0386`, and then emits the localized composite summary `3890` `%1 has %2 freight loads and %3 express loads available for hauling...`. This is the first grounded shell-list consumer of the same service-score lane used by `shell_station_detail_format_freight_and_express_summary`. | objdump + strings + caller inspection + service-query correlation |
| 191 | 0x005071e0 | 494 | shell_station_list_window_handle_message | shell | thiscall | inferred | objdump + strings + detail-manager correlation | 4 | Primary message dispatcher for the shell-side `StationList.win` family rooted at vtable `0x005d177c`. The helper owns the paired station-row controls `0x61a9` and `0x61aa`, the side selector controls `0x61ab` and `0x61ac`, and the two status labels `0x61af` and `0x61b0`. It periodically updates the currently highlighted station id through `0x00622ae4`, mirrors row selections into `0x006cec78+0x4cba`, and on activation resolves the selected station object through collection `0x006cec20`, optionally recenters the world view through `0x00433900`, then re-enters the shell detail-panel manager with mode `5` and that same station id. The `0x61ab` and `0x61ac` controls toggle the active side bit at `0x006d1710` and reopen the station-pick helper rooted at `0x00507620`. | objdump + strings + detail-manager correlation + UI dispatch inspection |
| 192 | 0x005074c0 | 235 | shell_station_list_window_construct | shell | thiscall | inferred | objdump + strings + detail-manager correlation | 4 | Constructs the shell-side `StationList.win` panel later published at `0x006d1708`. The constructor binds the paired station-row controls `0x61a9` and `0x61aa`, seeds the side-selector controls `0x61ab` and `0x61ac` from the current active-side bit at `0x006d1710`, stores the selected-entry latch at `[this+0x78]`, and then calls the row-refresh helper at `0x00506f30`. Current grounded evidence places this panel on a station-oriented shell lane below the company roster rather than on a direct company-detail or chairmanship-claim path. | objdump + strings + detail-manager correlation + caller inspection |
| 193 | 0x00507620 | 656 | shell_station_pick_window_construct | shell | thiscall | inferred | objdump + strings + caller inspection | 4 | Constructs the shell-side `StationPick.win` helper window. The constructor binds the list control `0x80ea`, the scroll or selector controls `0x80e8` and `0x80e9`, publishes the helper at `0x006d1718`, and then populates the visible station rows from collection `0x006cec20`. The same family feeds the selected station id through `0x00622ae8` and returns it to the caller when the helper closes. Current grounded callers put this helper under the `StationList.win` selector branch rather than under the startup-company flow. | objdump + strings + caller inspection + helper correlation |
| 194 | 0x005076c0 | 501 | shell_station_pick_window_populate_station_rows | shell | cdecl | inferred | objdump + strings + caller inspection | 4 | Populates the visible row set for the shell-side `StationPick.win` helper. The helper iterates collection `0x006cec20`, filters entries through `0x0047fd50`, sorts them by the display-name field at `[entry+0x46b]`, and publishes the resulting station names through the helper list control `0x80ea`. It also mirrors the chosen station ids back into the helper-local scratch arrays, updates one status lane through control event `0xaf`, and refreshes the visible row count through control event `0x66`. Current grounded caller is `shell_station_pick_window_construct` at `0x00507620`. | objdump + strings + caller inspection + collection iteration |
| 195 | 0x004d4500 | 88 | shell_ensure_editor_panel_window | shell | cdecl | inferred | objdump + analysis-context | 4 | Ensures the shell-side EditorPanel.win helper window rooted at 0x006d07b4 exists. When the panel is absent it allocates a 0x7c-byte window object seeds the vtable at 0x005d0cb8 binds the EditorPanel.win resource through 0x0053fa50 publishes the object to the shell runtime through 0x00538e50 event 0x1e and then runs the shared panel-open helper at 0x004d4160. | objdump + analysis-context + strings |
| 196 | 0x004dc670 | 368 | shell_file_options_dialog_construct | shell | thiscall | inferred | objdump + strings | 4 | Constructs the shared shell file-options dialog rooted at fileopt.win. The helper clears the three downstream branch flags at 0x006d07f8 0x006d07ec and 0x006d07f0 binds the fileopt.win resource through 0x0053fa50 publishes the object to the shell runtime and populates several mode-dependent labels and status text before user input is handled. | objdump + strings |
| 197 | 0x004dc7f0 | 477 | shell_file_options_dialog_handle_message | shell | thiscall | inferred | objdump + strings | 4 | Handles the fileopt.win command flow and selects exactly one downstream branch before the shared detail-panel completion dispatcher runs. Successful commands dismiss the dialog then set 0x006d07f8 for the load or restore side 0x006d07ec for the save or package side or 0x006d07f0 for the sibling settings-window escape. The settings branch gates on shell_has_settings_window at 0x004fe120 and lazily opens the shared SettingsWindow.win object through 0x00501e50 while sibling branches show prerequisite dialogs when the requested file operation is not currently allowed. | objdump + strings + caller xrefs |
| 198 | 0x004dd010 | 890 | shell_file_request_dialog_collect_target_path | shell | cdecl | inferred | objdump + strings | 4 | Builds the modal filerqst.win request dialog and resolves one chosen target path back into the caller buffer. The helper treats dialog modes 0 1 2 3 and 11 as save-side requests and the paired modes 4 8 9 and 10 as load-side requests then swaps the button and prompt text between localized ids 249 250 and 251 252. On success it appends one extension from the static mode table at 0x005f3d58 where 0 or 8=.gms 1 or 9=.gmc 2 or 10=.gmx 3 or 4=.gmp and 11=.gmt. Current neighboring callers tighten that last mode too: the normal shell map coordinators use the `.gms/.gmc/.gmx/.gmp` families for scenario and editor flows, while save mode 11 is only consumed by the auxiliary `.gmt` preview-surface branch shared with the side owner at 0x006cd8d8. When a live runtime world is already active through 0x004839b0 the helper overrides that non-runtime table and appends .smp instead, which makes it the shared bridge between the broad shell coordinators and the runtime-state serializer or restore path rather than only a generic filename prompt. | objdump + strings + mode-table inspection + caller correlation |
| 199 | 0x004ddbd0 | 1096 | shell_detail_panel_transition_manager | shell | thiscall | inferred | objdump + analysis-context | 3 | Transitions the shell detail-panel controller rooted at 0x006d0818 between many window or panel states tracked in [this+0x8c] with optional selection ids cached at [this+0x78] through [this+0x90]. The manager tears down the prior child panel at [this+0x88] through 0x004dd950 updates selector or status UI through 0x004dd410 conditionally opens helper windows such as EditorPanel.win through 0x004d4500 and then allocates one of many shell-facing detail windows including TrainDetail.win TrainList.win and neighboring panel objects before publishing the new child through the shell runtime at 0x006d401c. shell_transition_mode reaches this manager on one branch but the current evidence keeps it on the shell-detail path rather than the first gameplay-world-entry coordinator. | objdump + analysis-context + strings |
| 200 | 0x004dfdf0 | 84 | shell_ensure_game_message_window | shell | cdecl | inferred | objdump + strings | 4 | Ensures the standalone GameMessage.win shell object rooted at 0x006d081c exists. When absent it allocates a 0x94-byte window object seeds the vtable at 0x005d0ed0 binds the GameMessage.win resource through 0x0053fa50 stores the result in 0x006d081c and publishes the object to the shell runtime through 0x00538e50. | objdump + strings + caller xrefs |
| 201 | 0x004e0210 | 1217 | game_message_window_service_frame | shell | thiscall | inferred | objdump + strings | 4 | Per-frame service pass for the GameMessage.win object rooted at 0x006d081c. It walks up to seven active message or notification records from the collection at 0x006acd34 populates the window slots around ids 0x8ca8 and neighboring controls chooses icon and portrait assets such as Portrait.imb note.imb smiley.imb and smalleye.imb maps selected message records into shell and world collections including 0x006ceb9c 0x0062be10 0x0062b26c and 0x0062bae0 and updates the visible action entries through repeated 0x00540120 calls. Current grounded caller is the simulation frame path through 0x004e0720. | objdump + strings + caller xrefs |
| 202 | 0x004e0720 | 15 | game_message_window_service_if_present | shell | cdecl | inferred | objdump + caller xrefs | 4 | Services the GameMessage.win branch only when the global object at 0x006d081c is live by tail-calling game_message_window_service_frame. The current grounded caller is simulation_frame_accumulate_and_step_world which keeps this world-facing message overlay inside the shell-owned recurring frame cadence. | objdump + caller xrefs |
| 203 | 0x004e0780 | 468 | game_uppermost_window_service_world_hotspot_band | shell | thiscall | inferred | objdump + strings + caller xrefs | 4 | Per-frame world-facing hotspot service for the GameUppermost.win overlay rooted at 0x006d0820. The helper clears the previously latched hotspot id at [this+0x78] when the shell runtime selection changes then requires an active world-mode branch at [0x006cec74+0x114] a live shell runtime node at [0x006d401c+0xc6d] an unobscured controller view through 0x00543e20 and 0x00543e40 and one selected control id in the narrow band 0x7918 through 0x7921. It rate-limits repeats through the runtime timestamp at [selected+0xd2] remaps the two rightmost ids onto the sibling left-side base actions 0x791c and 0x791e rechecks shell_input_cursor_inside_active_view at 0x0054f540 scales one table-driven coordinate pair from 0x006066c8 and 0x006066e8 and finally pushes that world-relative offset into the live world owner at 0x0062be68 through 0x0043d130. Current grounded caller is game_uppermost_window_handle_message at 0x004e0ba0. | objdump + strings + caller xrefs |
| 204 | 0x004e0960 | 432 | game_uppermost_window_refresh_controls | shell | thiscall | inferred | objdump + strings + caller xrefs | 4 | Refreshes the visible control state for the GameUppermost.win overlay at 0x006d0820. The helper repopulates the hotspot control band 0x7918 through 0x7921 through repeated 0x00540120 calls chooses one of two layout or visibility selectors based on the active world-mode state under 0x006cec74 and resolves the localized label `Hide Bottom Interface (Toggle)` for control 0x7923 before publishing it back into the window tree. Grounded callers include the overlay constructor at 0x004e0b20 the overlay message handler at 0x004e0ba0 and a later world-mode state-change branch at 0x004ff3f5. | objdump + strings + caller xrefs |
| 205 | 0x004e0b20 | 118 | game_uppermost_window_construct | shell | thiscall | inferred | objdump + strings + caller xrefs | 4 | Constructs the GameUppermost.win overlay object later stored at 0x006d0820. The helper seeds the vtable at 0x005d0f3c binds the GameUppermost.win resource through 0x0053fa50 registers the shared control callback at 0x004e0a70 for ids 0x7918 through 0x7921 refreshes the initial control state through game_uppermost_window_refresh_controls and initializes sibling control 0x7922 before returning the live overlay object. The ensure helper at 0x004e0e40 is the current grounded caller. | objdump + strings + caller xrefs |
| 206 | 0x004e0ba0 | 95 | game_uppermost_window_handle_message | shell | thiscall | inferred | objdump + strings + caller xrefs | 4 | Message dispatcher for the GameUppermost.win overlay object. It seeds one visual-speed field on the command object returned by 0x0053f830 then switches on the incoming message id through the local jump table at 0x004e0d04. The current grounded cases call game_uppermost_window_service_world_hotspot_band during the recurring service path refresh the overlay controls through game_uppermost_window_refresh_controls on a sibling state-change path and route control 0x7922 into the world-mode toggle helper at 0x004349f0 which also updates the same overlay object at 0x006d0820. | objdump + strings + caller xrefs |
| 207 | 0x004e0e40 | 75 | shell_ensure_game_uppermost_window | shell | cdecl | inferred | objdump + strings + caller xrefs | 4 | Ensures the world-facing GameUppermost.win overlay rooted at 0x006d0820 exists. When absent it allocates a 0xae-byte window object constructs it through game_uppermost_window_construct at 0x004e0b20 stores the result globally and publishes it through the shell runtime at 0x006d401c via 0x00538e50. A grounded caller sits in the shell_transition_mode path near 0x004831c0 immediately after the GameMessage.win bring-up branch which ties this overlay to world-mode entry rather than generic shell UI. | objdump + strings + caller xrefs |
| 208 | 0x004fe120 | 14 | shell_has_settings_window | shell | cdecl | inferred | objdump | 4 | Returns whether the shared settings window object rooted at 0x006d1350 is currently live. The fileopt settings escape branch and direct shell command wrappers both gate on this before opening SettingsWindow.win again. | objdump + caller xrefs |
| 209 | 0x00500640 | 487 | shell_settings_window_construct | shell | thiscall | inferred | objdump + strings | 4 | Constructs the shared SettingsWindow.win object later stored at 0x006d1350. The helper binds the SettingsWindow.win resource through 0x0053fa50 allocates a page-selection helper at 0x006d1358 walks the 13-entry category table rooted at 0x00622870 and populates the resulting shell control tree with the page labels and ordering data before the window is shown. | objdump + strings |
| 210 | 0x00501e50 | 201 | shell_open_settings_window | shell | cdecl | inferred | objdump + strings | 4 | Lazily allocates and shows the shared SettingsWindow.win shell object at 0x006d1350. When no settings window is live it allocates a 0x78-byte object constructs it through shell_settings_window_construct publishes it to the shell runtime through 0x00538f10 and then notifies the active shell owner at 0x0062be68. Current grounded callers are the direct shell command wrapper at 0x00482b00 the fileopt settings escape branch and one larger shell UI dispatcher branch near 0x0050366a. | objdump + strings + caller xrefs |
| 211 | 0x00468d00 | 222 | multiplayer_update_semicolon_name_list | shell | cdecl | inferred | ghidra-headless | 4 | Adds or removes one player-name token in the semicolon-delimited moderation list rooted at `[ecx+0x905c]`. With mode `1` it appends the supplied token only when not already present writing `;` as the delimiter; with mode `0` it removes the matched token collapses the remainder left and skips an adjacent delimiter when present. | ghidra + rizin + llvm-objdump + strings |
| 212 | 0x00468de0 | 14 | multiplayer_session_event_forward_action1_request | shell | unknown | inferred | ghidra-headless | 2 | Session-event callback wrapper that always forwards request id `1` through multiplayer_set_pending_session_substate with a zero auxiliary payload. The callback clears EDX before the shared setter call and currently lands on a request id that does not yet map to a visible pending substate so this row remains structural. | ghidra + rizin + llvm-objdump |
| 213 | 0x00468e00 | 188 | multiplayer_session_event_publish_pair_chat_template | shell | unknown | inferred | ghidra-headless | 3 | Session-event callback that formats one two-string chat/status line through multiplayer_route_chat_line when the callback status in EDX is zero and the current live session count is not positive. A selector near `[esp+0x214]` chooses the template `%s* %s` `%s %s` or `%s > %s`; the helper length-checks both inputs against the local 0x1f4-byte buffer before formatting and returns without publishing when either string is null or too long. | ghidra + rizin + llvm-objdump + strings |
| 214 | 0x00468ec0 | 144 | multiplayer_session_event_publish_action2_single_name | shell | unknown | inferred | ghidra-headless | 3 | Session-event callback wrapper for the one-name action-2 status path. When the callback status in EDX is zero and the current session count is positive it length-checks the supplied name formats localized text id `0xb73` routes the resulting line through multiplayer_route_chat_line and then forwards request id `2` through multiplayer_set_pending_session_substate with that same name payload. The currently grounded setter does not visibly store a pending substate for id `2` so this row stays partly structural. | ghidra + rizin + llvm-objdump |
| 215 | 0x00468f50 | 192 | multiplayer_session_event_publish_action2_pair | shell | unknown | inferred | ghidra-headless | 3 | Session-event callback wrapper for the two-string action-2 status path. When the callback status in EDX is zero and the supplied name lengths fit within the local buffer it formats localized text id `0xb74` or `0xe34` depending on whether the first string is present routes the resulting line through multiplayer_route_chat_line and then forwards request id `2` through multiplayer_set_pending_session_substate with the second string as the target payload and the first string as the auxiliary payload. The currently grounded setter does not visibly store a pending substate for id `2` so this row stays partly structural. | ghidra + rizin + llvm-objdump |
| 216 | 0x00469010 | 30 | multiplayer_session_event_forward_action4_request | shell | unknown | inferred | ghidra-headless | 3 | Session-event callback wrapper that forwards request id `4` only when both supplied payload pointers are non-null. It passes the second stack argument as the action payload and a zero auxiliary argument through multiplayer_set_pending_session_substate. The currently grounded setter does not visibly store a pending substate for id `4` so this row remains structural. | ghidra + rizin + llvm-objdump |
| 217 | 0x00469030 | 30 | multiplayer_session_event_forward_action7_request | shell | unknown | inferred | ghidra-headless | 2 | Session-event callback wrapper that forwards one payload pointer through multiplayer_set_pending_session_substate with request id `7` when the callback status in EDX is nonzero. The wrapper normalizes its incoming pointer into the second stack slot before tail-calling the shared setter but the currently grounded setter does not map request id `7` to a visible pending substate so this row remains structural. | ghidra + rizin + llvm-objdump |
| 218 | 0x00469060 | 3 | multiplayer_session_event_noop_12byte_stub | shell | unknown | inferred | ghidra-headless | 4 | Three-byte no-op callback stub in the Multiplayer.win session-event registration table. It returns immediately with `ret 0xc` and does not touch any state. | ghidra + rizin + llvm-objdump |
| 219 | 0x00469070 | 87 | multiplayer_session_event_publish_status_value | shell | unknown | inferred | ghidra-headless | 3 | Session-event callback that publishes one status value into the destination text builder passed in the third stack argument. It first compares the supplied index against the live session count from `0x006d40d0`; out-of-range entries publish the fixed fallback text at `0x005c87a8`; in-range entries publish integer `100` through 0x0058cd40 when event code EDX is `0x18`; publish the string at `0x00521d40+0x08` when EDX is `0x15`; and otherwise fall back to the same fixed text token. | ghidra + rizin + llvm-objdump + strings |
| 220 | 0x004690d0 | 15 | multiplayer_session_event_publish_fixed_status_text | shell | unknown | inferred | ghidra-headless | 3 | Session-event callback that appends the fixed status text token at `0x005c87a8` into the destination text builder passed in the second stack argument. This is the smallest text-publisher sibling in the same callback family and shares the same append helper 0x0058bce0 used by 0x00469070. | ghidra + rizin + llvm-objdump |
| 221 | 0x004690f0 | 106 | multiplayer_session_event_seed_control_id_list | shell | unknown | inferred | ghidra-headless | 3 | Session-event callback that seeds a byte-list builder with the fixed control-id set `3 1 8 10 11 19 4 5` when the callback status in EDX is zero. It appends each id through 0x0058bcb0 into the destination builder passed in the first stack argument and returns immediately when the callback status is nonzero. | ghidra + rizin + llvm-objdump |
| 222 | 0x00469160 | 26 | multiplayer_session_event_query_session_count | shell | unknown | inferred | ghidra-headless | 4 | Session-event callback helper that returns the live session count from `0x006d40d0` through 0x00521670 only when the callback mode in EDX equals `1`; all other modes return zero. This looks like the count-query slot in the same registration table. | ghidra + rizin + llvm-objdump |
| 223 | 0x00469180 | 3 | multiplayer_session_event_noop_8byte_stub | shell | unknown | inferred | ghidra-headless | 4 | Three-byte no-op callback stub in the Multiplayer.win session-event registration table. It returns immediately with `ret 8` and does not touch any state. | ghidra + rizin + llvm-objdump |
| 224 | 0x00469190 | 8 | multiplayer_session_event_latch_status_code | shell | unknown | inferred | ghidra-headless | 4 | Small session-event callback helper that stores the incoming status code from EDX into `0x006cd974` and returns. The registration branch later clears the same global before transport teardown or retry reset. | ghidra + rizin + llvm-objdump |
| 225 | 0x004691a0 | 45 | multiplayer_session_event_notify_owner_and_queue_action8 | shell | unknown | inferred | ghidra-headless | 3 | Session-event callback wrapper that first notifies the current Multiplayer.win owner through multiplayer_notify_window_owner. When the callback status in EDX is zero it then queues request id `8` through multiplayer_set_pending_session_substate with the same payload pointer; otherwise it returns after the owner notification only. | ghidra + rizin + llvm-objdump |
| 226 | 0x004691d0 | 39 | multiplayer_find_session_event_capacity_entry | shell | unknown | inferred | ghidra-headless | 4 | Scans the fixed 0x80-entry session-event capacity array for a live record owned by the supplied key pointer in EDX. Each 0x11c-byte record is live when [entry+0x104] is nonzero and a match requires [entry+0x10c] to equal the incoming key. The helper returns the matched entry pointer or null. | ghidra + rizin + llvm-objdump |
| 227 | 0x00469200 | 428 | multiplayer_sync_session_event_capacity_entry | shell | unknown | inferred | ghidra-headless | 3 | Session-event cache-field callback that creates updates or clears one cached capacity record for the supplied owner key. Mode `0` creates the first free 0x11c-byte record when none exists mode `1` updates an existing record and mode `2` clears an existing record by zeroing [entry+0x104]. The create and update paths store the owner key at [entry+0x10c] seed [entry+0x104] with 0x2328 resolve `numplayers` and `maxplayers` handles through 0x0058d6d0 and copy the current display string into [entry+0x84]. | ghidra + rizin + llvm-objdump + strings |
| 228 | 0x004693b0 | 80 | multiplayer_session_event_cache_line_callback | shell | unknown | inferred | ghidra-headless | 4 | Transport-side callback that appends one incoming status line into the cached session-event line store at `0x006ae4d8`. When the callback status in EDX is nonzero and the incoming line pointer is valid it copies the string from the third stack argument into slot `0x006cd97c << 8` subject to the `0x1f4` entry cap and a small flag filter on the fourth stack argument then increments `0x006cd97c` for later iteration. | ghidra + rizin + llvm-objdump |
| 229 | 0x00469410 | 56 | multiplayer_init_session_event_transport_state | shell | unknown | inferred | ghidra-headless | 3 | Initializes the Multiplayer.win session-event transport state rooted at `0x006cd970`. The helper latches the incoming mode or state into `0x006cd978`; when that value is nonzero it zeroes the large scratch block at `0x006ae4d8` resets `0x006cd97c` and registers the cached-line callback block rooted at `0x004693b0` through multiplayer_transport_register_selector_callback before returning. | ghidra + rizin + llvm-objdump |
| 230 | 0x00469450 | 97 | multiplayer_teardown_session_event_transport | shell | unknown | inferred | ghidra-headless | 3 | Tears down the active session-event transport object at `0x006cd970`. When the latched mode at `0x006cd978` is nonzero and the multiplayer session object at `0x006cd920` exists it first switches the transport back to status route `0` through multiplayer_transport_select_status_route clears the status pump through multiplayer_transport_clear_status_pump disconnects through multiplayer_transport_disconnect shuts the object down through multiplayer_transport_shutdown and finally clears `0x006cd970`. | ghidra + rizin + llvm-objdump |
| 231 | 0x004694c0 | 57 | multiplayer_publish_session_event_fixed_token | shell | unknown | inferred | ghidra-headless | 3 | Small session-event transport helper that publishes one fixed token through the active transport object when the latched mode and multiplayer session object are both present. It first switches the transport to status route `1` through multiplayer_transport_select_status_route and then sends the fixed token at `0x005c87a8` plus flag `1` through multiplayer_transport_publish_fixed_token_message. The current grounded caller is the Multiplayer.win branch at `0x0046c3c0`. | ghidra + rizin + llvm-objdump + strings |
| 232 | 0x00469500 | 27 | multiplayer_flush_session_event_transport | shell | unknown | inferred | ghidra-headless | 3 | Lightweight session-event transport flush wrapper. When the active transport object at `0x006cd970` exists it first forces a status flush through multiplayer_transport_force_status_flush and then tail-calls multiplayer_transport_flush_and_maybe_shutdown on that same object. Current grounded callers include the top-level Multiplayer.win service loop and neighboring preview-reset or initializer branches, which makes this the shell-side cadence bridge into the deeper transport pump. | ghidra + rizin + llvm-objdump |
| 233 | 0x00469520 | 94 | multiplayer_register_session_event_cache_fields | shell | unknown | inferred | ghidra-headless | 3 | Registers the session-event cache-field subscription set for the active Multiplayer.win object. When no multiplayer session object is present it marks `[this+0x8f18]` armed and subscribes callback `0x00469200` through multiplayer_transport_subscribe_field_callback_set with the fixed field-id list `3 1 4 8 10 11 19 5` rooted at `[this+0x10]`. | ghidra + rizin + llvm-objdump |
| 234 | 0x00469580 | 65 | multiplayer_begin_session_event_line_iteration | shell | unknown | inferred | ghidra-headless | 4 | Primes iteration over the cached session-event line store at `0x006ae4d8`. When the multiplayer session object at `0x006cd920` is absent it sets `[this+0x9874]` armed clears the cached line slots and line index at `0x006cd97c` and re-registers the line callback `0x004693b0` through multiplayer_transport_register_selector_callback before returning. | ghidra + rizin + llvm-objdump |
| 235 | 0x004695d0 | 66 | multiplayer_next_session_event_cached_line | shell | unknown | inferred | ghidra-headless | 4 | Returns the next non-empty cached session-event line from the fixed store at `0x006ae4d8`. On first use after multiplayer_begin_session_event_line_iteration it resets `0x006cd97c` and clears `[this+0x9874]`; afterwards it returns the current 0x100-byte slot pointer when the first byte is nonzero and advances `0x006cd97c` or returns null when no further cached lines remain. | ghidra + rizin + llvm-objdump |
| 236 | 0x00469620 | 52 | multiplayer_submit_owner_notified_session_event_text | shell | unknown | inferred | ghidra-headless | 3 | Submits one caller-supplied text buffer through the active session-event transport using callback multiplayer_session_event_notify_owner_and_queue_action8. The helper first sanitizes the input string into a local 0x100-byte transport record through multiplayer_transport_sanitize_identifier and then forwards that record through multiplayer_transport_submit_text_record with fixed mode arguments `0` and `1`. | ghidra + rizin + llvm-objdump |
| 237 | 0x00469660 | 27 | multiplayer_send_session_event_text_selector0 | shell | unknown | inferred | ghidra-headless | 3 | Thin session-event transport wrapper that sends one caller-supplied text pointer through multiplayer_transport_send_selector_text with selector `0` when the pointer is non-null. The current grounded caller is the Multiplayer.win control dispatcher around `0x00469d30`. | ghidra + rizin + llvm-objdump |
| 238 | 0x00469680 | 14 | multiplayer_pump_session_event_status | shell | unknown | inferred | ghidra-headless | 3 | Thin session-event transport wrapper that immediately requests a status pump through multiplayer_transport_request_status_pump on the active transport object at `0x006cd970` and discards one stack argument. Current grounded callers use it after updating Multiplayer.win status text ids `0xe60` and `0xe61`. | ghidra + rizin + llvm-objdump |
| 239 | 0x00469700 | 27 | multiplayer_preview_dataset_stage_selected_path | shell | thiscall | inferred | objdump + caller xrefs | 3 | Small Multiplayer preview-dataset helper that copies one caller-supplied selected path string into the dataset-local staging buffer at `[this+0x8f48]`. Current grounded callers feed it the active session-entry path from the live session list before later preview or launch-side dataset work. | objdump + caller xrefs |
| 240 | 0x00469720 | 221 | multiplayer_preview_dataset_service_frame | shell | thiscall | inferred | objdump + caller xrefs | 3 | Recurring shell-frame service for the Multiplayer preview dataset rooted at `0x006cd8d8`. When the gating global at `0x006cd910` and the dataset render target at `[this+0x9884]` are live it walks the active session list under `0x006d40d0`, formats one roster or status line per entry through the template at `0x005ce1ac`, and then pushes the accumulated text through the render/update helper at `0x005519f0` with fixed presentation parameters. The current grounded caller is `shell_state_service_active_mode_frame`, which makes this a shell-owned per-frame refresh path for multiplayer preview text rather than a transport I/O loop. | objdump + caller xrefs + strings |
| 241 | 0x0046a6c0 | 307 | multiplayer_session_event_publish_registration_field | shell | unknown | inferred | ghidra-headless | 3 | Switch-driven session-event callback that publishes one Multiplayer.win registration/status field into the destination builder passed on the stack. Depending on selector EDX it emits the local session name from `0x006cec74` the profile text at `0x006cd8d8+0x8e10` the constant `0x2328` the live session count from `0x006d40d0` the field at `[0x006d1270+0x3b6]` the active profile string at `[0x006cec7c+0x44]` or fixed strings such as `Initializing...` `openstaging` and `closedplaying`; unsupported selectors fall back to the fixed token at `0x005c87a8`. | ghidra + rizin + llvm-objdump + strings |
| 242 | 0x0046a830 | 194 | multiplayer_session_event_retry_with_random_player_name | shell | unknown | inferred | ghidra-headless | 3 | Registration-side callback that increments the retry counter at `0x006cd984` and on early retries formats a randomized `RT3Player%d` name into `0x006ae0c0` sanitizes it into a local notification object notifies the current Multiplayer.win owner and forwards that object through multiplayer_transport_set_local_name. On the first retry it also routes request id `5` or `6` through multiplayer_set_pending_session_substate depending on the incoming status flag; after 25 retries it resets `0x006cd984` and `0x006cd974` and calls multiplayer_transport_reset_and_maybe_shutdown instead. | ghidra + rizin + llvm-objdump + strings |
| 243 | 0x0046a900 | 522 | multiplayer_register_session_event_callbacks | shell | thiscall | inferred | ghidra-headless | 4 | Builds and registers the Multiplayer.win session-event callback table rooted at the local block on `[esp+0x28]`. The function seeds slots with multiplayer_session_event_forward_action1_request multiplayer_session_event_publish_pair_chat_template multiplayer_session_event_publish_action2_single_name multiplayer_session_event_publish_action2_pair multiplayer_session_event_forward_action4_request multiplayer_session_event_forward_action7_request multiplayer_session_event_noop_12byte_stub multiplayer_session_event_publish_registration_field multiplayer_session_event_publish_status_value multiplayer_session_event_publish_fixed_status_text multiplayer_session_event_seed_control_id_list multiplayer_session_event_query_session_count multiplayer_session_event_noop_8byte_stub multiplayer_session_event_latch_status_code multiplayer_session_event_notify_owner_and_queue_action8 multiplayer_init_session_event_transport_state and multiplayer_session_event_retry_with_random_player_name. It allocates the transport callback object under `0x006cd970` stages the session name into the local descriptor block and then finishes registration through multiplayer_transport_register_callback_table which in turn routes through multiplayer_transport_attach_callback_table_descriptor multiplayer_transport_enqueue_descriptor_block_record and multiplayer_transport_dispatch_callback_table_binding. | ghidra + rizin + llvm-objdump + strings |
| 244 | 0x0046c360 | 32 | multiplayer_route_chat_line | shell | cdecl | inferred | ghidra-headless | 3 | Routes one multiplayer chat line through the active transport object at `0x006cec78` when present or falls back to the local Multiplayer.win chat publisher otherwise. The transport path forwards the supplied text into 0x4554e0 with fixed mode arguments `5 1 0`; the local fallback tail-calls multiplayer_publish_wrapped_chat_message. | ghidra + rizin + llvm-objdump |
| 245 | 0x0046f960 | 2209 | multiplayer_dispatch_chat_command | shell | cdecl | inferred | ghidra-headless | 4 | Parses and dispatches one slash-prefixed Multiplayer.win chat command line from `[eax+0x08]`. The parser normalizes `/` to `\\` and handles the grounded command family `\\kick` `\\clear` `\\whois` `\\me` `\\unban` `\\ban` `\\snore` `\\sneeze` `\\hurry` `\\trackisfree` `\\loadgame` and `\\sendgame`. The strongest branches are now clear: `\\kick` resolves a typed peer name through the active session tables and forwards the resulting peer object through multiplayer_request_peer_session_control when the target is neither null nor the local player; `\\clear` clears the local chat pane through multiplayer_publish_wrapped_chat_message(null); `\\whois` finds a named peer and emits multi-line `%s Ip = %s` `Cpu` `Game` and `Build Time` diagnostics through multiplayer_route_chat_line; `\\ban` and `\\unban` resolve either a dotted player name or the selected peer name then update the semicolon-delimited moderation list through multiplayer_update_semicolon_name_list with add/remove modes while `\\unban` can also forward a live peer object through multiplayer_request_peer_session_control; `\\snore` `\\sneeze` and `\\hurry` build transient presentation objects then broadcast text ids `0xb79` `0xb7a` and `0xb7b`; `\\loadgame` copies the requested filename into `0x006ce630` and arms flag `0x006ce9bc`; `\\trackisfree` arms flag `0x006ce9b4`; and `\\sendgame` allocates one 0x5c-byte transfer record under `0x006ce290` for the chosen player slot. The parser returns `1` only when a command branch handled the line and otherwise leaves the caller to treat it as ordinary chat text. | ghidra + rizin + llvm-objdump + strings |
| 246 | 0x00470210 | 119 | multiplayer_submit_chat_or_command_line | shell | cdecl | inferred | ghidra-headless | 4 | Submits one Multiplayer.win chat-entry line. The wrapper first calls multiplayer_dispatch_chat_command on the raw line buffer; when the parser returns zero it formats a normal `%s > %s` named chat line from the sender object at `[edi+0x08]` and the message payload; then either publishes it locally through multiplayer_publish_wrapped_chat_message or routes it through the active transport object at `0x006cec78`. When the parser returns nonzero the wrapper skips normal chat formatting because the slash-command branch already consumed the line. | ghidra + rizin + llvm-objdump + strings |
| 247 | 0x004ecc90 | 52 | multiplayer_set_pending_session_substate | shell | unknown | inferred | ghidra-headless | 2 | Small pending-session-substate setter used by the multiplayer session-event callback family. The grounded stores are request id `5` to substate `5` request id `6` to substate `6` and request id `8` to substate `8` at `0x006d1288`. Other current callback-family callers still pass ids `1` `2` `4` and `7` without a visible store in this helper so this row stays structural for now. | ghidra + rizin + llvm-objdump |
| 248 | 0x004edce0 | 19 | multiplayer_notify_window_owner | shell | unknown | inferred | ghidra-headless | 3 | Thin Multiplayer.win owner-notification wrapper. It loads the current window owner singleton from `0x006d1268` and when present forwards the supplied payload pointer into 0x004eccd0 for owner-side handling; current grounded callers are the session-event callback family around 0x004691a0 and the related registration path near 0x0046a8b3. | ghidra + rizin + llvm-objdump |
| 249 | 0x004ecb20 | 101 | multiplayer_reset_local_session_slot_state | shell | cdecl | inferred | ghidra-headless | 4 | Resets the local Multiplayer.win session-slot state before window init or add-open-slot flows. The helper marks the local state at `0x006cec7c+0x97` initialized clears the local slot counters at `+0x79` and `+0x7b` zeroes the slot-marker bytes at `+0x87` clears the local summary block at `+0x44` and zero-fills the large session backing block at `0x006d1270` when present. | ghidra + rizin + llvm-objdump |
| 250 | 0x004ecb90 | 191 | multiplayer_probe_or_allocate_open_player_slot | shell | cdecl | inferred | ghidra-headless | 3 | Probes or allocates one open local player-slot marker against the active Multiplayer.win session block at 0x006d1270. In probe mode `ecx=1` the helper checks that the local open-slot count and slot-marker bytes at `0x006cec7c+0x87` still fit within the remote slot counts and occupancy bytes rooted at `session+0x31b` and `session+0x3a3` and returns nonzero only when one additional slot can be claimed. In allocate mode `ecx=0` it finds the first locally empty slot whose remote occupancy byte is nonzero writes marker `0x64+index` into the local slot array increments `0x006cec7c+0x7b` and returns `0xff` on success. | ghidra + rizin + llvm-objdump |
| 251 | 0x004ed590 | 224 | multiplayer_sync_staged_text_controls | shell | cdecl | inferred | ghidra-headless | 3 | Synchronizes the shared Multiplayer.win staged-text buffer into the two mirrored text controls at ids 0xe48 and 0xe5d and then copies the same string back into the active selection buffer at 0x006cec74+0x1ef when it changed. The helper reallocates each control-owned backing string as needed and is used from the larger window initializer pending-status service and one delayed service-loop recovery branch. | ghidra + rizin + llvm-objdump |
| 252 | 0x004ed800 | 109 | multiplayer_preview_dataset_construct | shell | thiscall | inferred | objdump + caller xrefs | 3 | Constructor-style zero initializer for the large Multiplayer preview-dataset object later stored at `0x006cd8d8`. It clears the leading linkage and mode fields, resets the request and staging words around `0x8f18..0x8f44`, zeroes the shell-mode snapshot slots at `0x9050` and `0x9054`, clears the dataset state word at `0x985c`, seeds `0x9860` to `-1`, and leaves the object ready for the follow-on reset and dispatch paths. | objdump + caller xrefs |
| 253 | 0x004ed890 | 164 | multiplayer_schedule_requested_action | shell | cdecl | inferred | ghidra-headless | 3 | Initializes one requested Multiplayer.win action and resets the shared action globals before later dispatch. The helper writes the requested action id from EDI into 0x006d127c marks the action-active bit at 0x006d1274 clears the pending-step and substate fields at 0x006d1278 0x006d1280 and 0x006d1288 tears down the prior helper object at 0x006d1294 and allocates a fresh 0x10-byte helper. The currently named action writers above it queue action ids 1 and 4 from preview-dataset reset 2 from staged text-entry dialog setup 3 from staged text-entry commit and 5 or 6 from selected-preview follow-up branches. | ghidra + rizin + llvm-objdump |
| 254 | 0x004ed940 | 235 | multiplayer_rebuild_open_player_slot_markers | shell | cdecl | inferred | ghidra-headless | 3 | Rebuilds the local Multiplayer.win open-player slot markers from the active session slot table and republishes the resulting count. The helper clears any existing local slot bytes above `0x64` from `0x006cec7c+0x87` while decrementing `0x006cec7c+0x7b` then walks the remote slot records at `session+0x31b` with count `session+0x3ae`. For each remotely open record it uses multiplayer_probe_or_allocate_open_player_slot to claim the next local marker when capacity remains and then formats the updated open-slot count into shell control `0x6f` with resource id `0xe36`. | ghidra + rizin + llvm-objdump |
| 255 | 0x004edc40 | 145 | multiplayer_reset_preview_dataset_and_request_action | shell | cdecl | inferred | ghidra-headless | 3 | Resets the active Multiplayer.win preview dataset object at 0x006cd8d8 and immediately schedules the next requested action. The helper destroys any existing 0x9898-byte dataset object allocates and constructs a fresh one through 0x004ed800 clears the text control at id 0xe47 and the staged entry buffer at 0x006d11a8 and then queues action id 1 when the caller passes zero or action id 4 when the caller passes a nonzero dataset-related value. | ghidra + rizin + llvm-objdump |
| 256 | 0x004ee0e0 | 225 | multiplayer_open_staged_text_entry_dialog | shell | cdecl | inferred | ghidra-headless | 3 | Opens the small Multiplayer.win staged text-entry dialog and queues requested action 2. The helper chooses one of two prompt ids from the current preview mode copies the current profile text from 0x006cec74+0x1ef into the staging buffer at 0x006d1128 persists the profile state through 0x00484910 builds a formatted prompt string through 0x00518de0 and opens the modal shell dialog through 0x004c98a0 with the local callbacks at 0x004ed100 and 0x004ed4c0 before queuing action 2. | ghidra + rizin + llvm-objdump |
| 257 | 0x004ee1d0 | 456 | multiplayer_commit_staged_text_entry | shell | cdecl | inferred | ghidra-headless | 3 | Commits one staged Multiplayer.win text entry and queues requested action 3 when validation succeeds. The helper refreshes the mode-dependent prompt text saves the shared profile state through 0x00484910 copies either the caller-provided string or the text control 0xe47 into the staging buffer at 0x006d11a8 derives the companion buffer at 0x006d1228 from the current preview object or fallback globals and when the staged text exceeds five bytes schedules action 3 through multiplayer_schedule_requested_action; otherwise it clears the staged buffer and text control. | ghidra + rizin + llvm-objdump |
| 258 | 0x004ee3a0 | 244 | multiplayer_reset_tool_globals | shell | thiscall | inferred | ghidra-headless | 3 | Resets the smaller multiplayer-tool singleton state rooted around 0x006d1268 through 0x006d1270 for one shell mode created from 0x00482ec0. The helper seeds the shared vtable clears or rebinds the active singleton pointers and performs the same early shell-service notifications used by the larger Multiplayer.win initializer before later selection or preview code runs. | ghidra + rizin + llvm-objdump + strings |
| 259 | 0x004ee430 | 141 | multiplayer_update_preview_mode_labels | shell | cdecl | inferred | ghidra-headless | 3 | Updates the small mode-dependent label widget pair used by the Multiplayer.win preview branch. The helper chooses one of two label-id pairs anchored by string ids 0xe12 0xe18 and 0xe73 then writes them through 0x00540120 into shell controls such as ids 0x65 0x6d 0x86 and 0x87. It is called from multiplayer_load_selected_map_preview_surface the larger multiplayer initializer and the restore-from-globals callback. | ghidra + rizin + llvm-objdump + strings |
| 260 | 0x004ee4c0 | 49 | multiplayer_publish_control_0x69_mode | shell | cdecl | inferred | ghidra-headless | 2 | Publishes the current mode for Multiplayer.win control 0x69 from the presence of the session-related singleton at 0x006d40dc. The helper pushes mode 3 when that object exists or mode 1 otherwise through 0x00469d30 and is used after preview and count-setting branches to keep that control in sync with session state. | ghidra + rizin + llvm-objdump |
| 261 | 0x004ee500 | 50 | multiplayer_are_all_peer_ready | shell | cdecl | inferred | ghidra-headless | 4 | Returns true only when every element in the shell-owned multiplayer peer list exposed through 0x00521680 has ready flag bit 0x01 set at offset +0x5c. The service loop uses this gate before committing the larger multiplayer launch or transition branch. | ghidra + rizin + llvm-objdump |
| 262 | 0x004ee540 | 352 | multiplayer_refresh_peer_roster_list | shell | cdecl | inferred | ghidra-headless | 3 | Refreshes the Multiplayer.win peer-roster list for preview modes 0xe12 and 0xe13. The helper chooses one of two mode-dependent text ids updates control 0x8b when the current roster selection is valid enumerates either the direct peer list at 0x006d40d0 or the fallback dataset-backed names from 0x006cd8d8 into repeated control-0x88 entries and when no roster entries remain forces a preview-dataset reset through multiplayer_reset_preview_dataset_and_request_action. It also republishes one session-state byte into shell control 9 before returning. | ghidra + rizin + llvm-objdump |
| 263 | 0x004ee6a0 | 359 | multiplayer_refresh_map_entry_list | shell | cdecl | inferred | ghidra-headless | 3 | Refreshes the Multiplayer.win map-entry list for preview modes 0xe11 and 0xe13. The helper chooses one of two mode-dependent text ids writes the active selection header into control 0x8b walks up to 0x80 0x11c-byte records from the list object exposed by control 0xe47 publishes each entry into repeated control-0x88 rows and mirrors the currently selected matching row into control 0x66. The comparison path uses the current staged selection text copied into a local buffer before the list walk. | ghidra + rizin + llvm-objdump |
| 264 | 0x004ee810 | 308 | multiplayer_publish_wrapped_chat_message | shell | cdecl | inferred | ghidra-headless | 4 | Publishes one Multiplayer.win chat or status message into the mode-dependent chat pane. The helper chooses text resource `0xe32` or `0xe5c` from the current preview mode at `[window+0x7c]`; resolves the corresponding text list object through `0x0053f830`; word-wraps the supplied string to width `0x3e`; emits each wrapped row into control `0x88` through `0x00540120`; stores per-row metadata back into the list object; and finally updates the summary row in control `0x66` or clears the pane when the caller passes a null string. It is used by the local chat transport fallback; the named `%s > %s` message publisher; and the Multiplayer.win launch-side action wrappers. | ghidra + rizin + llvm-objdump + strings |
| 265 | 0x004eed30 | 208 | multiplayer_sync_selected_map_entry | shell | cdecl | inferred | ghidra-headless | 3 | Selection wrapper above 0x004ee950 for the multiplayer map-preview branch. It walks the current 0x25a-byte multiplayer entry table compares the selected record string against the shell selection buffer near 0x006cec7c and then calls 0x004ee950 with either the matching strings or null inputs to refresh the active preview state. | ghidra + rizin + llvm-objdump |
| 266 | 0x004ee950 | 982 | multiplayer_load_selected_map_preview_surface | shell | cdecl | inferred | ghidra-headless | 4 | Loads or refreshes the currently selected .gmt-backed preview surface for the multiplayer window family rooted at 0x006d1270. The routine validates the selected filename suffix copies selected strings into the active record updates preview or status values under offsets such as +0x3b2 and +0x3b6 formats several shell text fields through 0x00540120 and finishes by decoding a 256x256 image through 0x0053f830 and surface_init_rgba_pixel_buffer. The branch is anchored by the larger Multiplayer.win initializer at 0x004efe80. | ghidra + rizin + llvm-objdump + strings |
| 267 | 0x004eee00 | 649 | multiplayer_refresh_map_preview_panel | shell | cdecl | inferred | ghidra-headless | 3 | Refreshes the multiplayer map-preview panel for one requested preview state or sentinel value. The helper stores the requested state at [this+0x78] updates several shell text fields through 0x00540120 handles the special active state 0xe15 and the fallback -1 case copies the selected entry strings out of the multiplayer entry table at 0x006d126c into the shell selection buffer near 0x006cec7c and then routes through multiplayer_sync_selected_map_entry or multiplayer_load_selected_map_preview_surface before returning. | ghidra + rizin + llvm-objdump + strings |
| 268 | 0x004ef090 | 365 | multiplayer_select_preview_mode_and_refresh | shell | cdecl | inferred | ghidra-headless | 3 | Selects one of the top-level multiplayer preview modes identified by command ids 0xe10 through 0xe13 then refreshes the preview panel. The helper stores the requested mode at [this+0x7c] updates the four mode-button states through 0x00540120 handles the special 0xe12 branch with extra multiplayer refresh helpers and a direct multiplayer_refresh_map_preview_panel call for state 0xe15 emits a summary status field at 0xe55 falls back through multiplayer_refresh_map_preview_panel(-1) and finally refreshes the panel timestamp at [this+0x80] through 0x0051d890. | ghidra + rizin + llvm-objdump + strings |
| 269 | 0x004ef200 | 1786 | multiplayer_service_pending_status_state_machine | shell | cdecl | inferred | ghidra-headless | 4 | Services the pending Multiplayer.win status or transition state machine when the global flag at `0x006d1278` is set. The routine clears the pending flag switches over the queued step id at `0x006d1280` and now has several grounded branches: step `1` builds modal status `0xe4f` optionally appends owner text from `0x006d4118/0x006d411c` tears down the preview dataset at `0x006cd8d8` and refreshes control `0xcc`; step `2` clears `0x006cd920` destroys the preview dataset and opens status `0xe50`; step `3` gates on latch byte `0x006d1292` and warns with `0xe51`; step `4` requires `0x006cd920 != 0` and `0x006ae3c8 >= 3` or warns with `0xe52` otherwise it seeds a random `RT3Player%d` name into the staged-text controls through multiplayer_sync_staged_text_controls and sets `0x006ae3c4 = 2`; step `5` opens status `0xe54` then rebuilds the preview dataset through multiplayer_reset_preview_dataset_and_request_action. A second substate switch on `0x006d1284` formats statuses `0xe55..0xe5f` `0xe92` and `0xf53`; its `0x5` and `0x8` families either force preview mode `0xe13` or reseed the default player-name path before syncing the staged-text controls. | ghidra + rizin + llvm-objdump + strings |
| 270 | 0x004ef960 | 1260 | multiplayer_dispatch_requested_action | shell | cdecl | inferred | ghidra-headless | 4 | Dispatches the current requested Multiplayer.win action stored in `0x006d127c`. The switch drives six higher-level action cases that combine immediate mode changes through multiplayer_select_preview_mode_and_refresh with deferred pending-step writes into `0x006d1278` and `0x006d1280`. The grounded wrappers are now broader than before: action `1` either enters preview mode `0xe11` immediately or schedules pending step `1`; action `2` resets the local session-slot state through multiplayer_reset_local_session_slot_state copies the staged text buffers into the active dataset seeds one local open-slot marker refreshes the local player rows enters preview mode `0xe12` and rebuilds the open-slot markers; action `3` copies the staged text buffers back into the active multiplayer object and then uses the dataset mode at `[0x006cd8d8+0x0c]` to schedule pending steps `0xa` `0xb` `0xc` `0xe` or fallback `0x2` while its resolved-mode branch re-enters preview mode `0xe12` clears latches `0x006d1291/0x006d1292` and seeds the local player panel; action `4` promotes the committed staged text into preview mode `0xe13` or schedules pending step `5` or `6` from the launcher substate at `0x006d1288`; action `5` pumps the selected-map follow-up callback then either rebuilds the open-slot markers and refreshes status control `0x109` or schedules pending step `1` with control `0x11` updates depending on the current launch-side state; action `6` validates the staged text against the active dataset and schedules pending step `6` when the launcher substate remains armed. | ghidra + rizin + llvm-objdump |
| 271 | 0x004efe80 | 1388 | multiplayer_window_init_globals | shell | thiscall | inferred | ghidra-headless | 4 | Initializes the Multiplayer.win shell window family and its large backing state block. The constructor seeds the shared vtable at 0x005d12ac clears multiplayer globals under 0x006d1274 through 0x006d1288 allocates and zeroes a 0x100f2-byte data block stored at 0x006d1270 registers the active singleton at 0x006d1268 pushes the Multiplayer.win resource into the standard shell window setup helper and then continues with multiplayer-specific list and status initialization. | ghidra + rizin + llvm-objdump + strings |
| 272 | 0x004f03f0 | 3612 | multiplayer_window_service_loop | shell | cdecl | inferred | ghidra-headless | 3 | Top-level Multiplayer.win service loop. The function performs an early startup countdown through `0x006cd90c` calls multiplayer_service_pending_status_state_machine processes the special pending-step-10 gate with latch byte `0x006d1292` clears one text field when pending step 2 completes and then continues into the broader multiplayer update loop with timed retries staged-text synchronization peer-roster and map-entry list refresh helpers object-state checks and several mode-specific update branches. It queues requested action 5 after rebuilding one selected-map preview follow-up path and requested action 6 after the validated staged-text follow-up dialog branch. The launch-side inline wrappers now separate into three behaviors: a peers-not-ready warning dialog on resource `0xf15`; an add-open-slot path that seeds `0x006cec7c+0x83` stores the callback owner in `0x006d4110` and refreshes status control `0x109`; and a missing-session or slot-capacity warning path that opens modal dialogs on resources `0x2cf` `0x2b8` or `0x2b9`. | ghidra + rizin + llvm-objdump |
| 273 | 0x004f13e0 | 167 | multiplayer_restore_preview_state_from_globals | shell | thiscall | inferred | ghidra-headless | 3 | Restores the Multiplayer.win preview UI from the current global mode and preview-state fields. The callback refreshes the mode-dependent labels through multiplayer_update_preview_mode_labels mirrors selection presence into the active shell object toggles the 0x006d1291 recursion guard replays multiplayer_select_preview_mode_and_refresh and multiplayer_refresh_map_preview_panel using the saved fields at [this+0x7c] and [this+0x78] and if the active preview resources are missing schedules pending status step 7 by writing 0x006d1278 and 0x006d1280 instead of forcing an immediate redraw. | ghidra + rizin + llvm-objdump + strings |
| 274 | 0x00502220 | 813 | paint_terrain_load_selected_gmt_surface | shell | cdecl | inferred | ghidra-headless | 4 | Loads or refreshes the currently selected .gmt-backed preview surface for the PaintTerrain tool family rooted at 0x006d14bc and tied to the PaintTerrain.win or GroundTerrain.tga branch. The routine validates the selected filename suffix copies selected strings into the active record updates tool status bytes and counters formats several shell text fields through 0x00540120 and finishes by decoding a 256x256 image through 0x0053f830 and surface_init_rgba_pixel_buffer. | ghidra + rizin + llvm-objdump + strings |
| 275 | 0x00502550 | 456 | paint_terrain_refresh_status_panel | shell | cdecl | inferred | ghidra-headless | 3 | Refreshes the PaintTerrain tool status or selection panel after the active .gmt surface changes. The helper reads the PaintTerrain singleton at 0x006d14bc consults shell selection globals and lookup tables formats several text or numeric fields through 0x00540120 and toggles the side flag at 0x006d14a8 before returning. | ghidra + rizin + llvm-objdump + strings |
| 276 | 0x00502720 | 144 | paint_terrain_tool_init_globals | shell | thiscall | inferred | ghidra-headless | 4 | Initializes the PaintTerrain shell tool singleton rooted at 0x006d14bc. The constructor seeds the tool vtable and default fields registers the active instance globally and is selected directly from shell_transition_mode alongside the neighboring terrain-edit tool constructor at 0x004ee3a0. | ghidra + rizin + llvm-objdump + strings |
| 277 | 0x00481d00 | 612 | bootstrap_parse_command_line_flags | bootstrap | cdecl | inferred | ghidra-headless | 4 | Parses the startup command line from ECX handling slash and dash switches and writes multiple bootstrap globals and option buffers before shell service init. | ghidra + rizin |
| 278 | 0x00481fd0 | 348 | bootstrap_scan_autorun_media | bootstrap | cdecl | inferred | ghidra-headless | 4 | Scans drive letters for RT3 autorun marker files rt3d1.txt and rt3d2.txt using GetDriveTypeA and open or close helpers before deeper shell init. | ghidra + rizin |
| 279 | 0x00482160 | 101 | shell_state_service_active_mode_frame | shell | thiscall | inferred | objdump + analysis-context | 4 | Acts as the broader shell-state service pass around one active-mode update on the shell state rooted at 0x006cec74. The helper increments nested-service depth at [this+0x64] optionally notifies the active mode object at 0x006cec78 through 0x0051f940 and 0x00434050 primes the shell runtime at 0x006d401c through 0x00538b60 conditionally services the Multiplayer preview-dataset object at 0x006cd8d8 through 0x00469720 and then dispatches shell_service_frame_cycle on the global shell controller at 0x006d4024 before decrementing the depth counter. | objdump + analysis-context + caller xrefs |
| 280 | 0x004821d0 | 1019 | shell_recompute_layout_slots | bootstrap | thiscall | inferred | ghidra-headless | 4 | Recomputes the shell layout-slot table after resolution or related display selectors change; derives normalized coordinates from static float tables updates 144 slot entries through the shell bundle child at [0x006d4024+0x18] and then commits the refreshed state. | ghidra + rizin |
| 281 | 0x00482ec0 | 1359 | shell_transition_mode | bootstrap | thiscall | inferred | ghidra-headless | 4 | Switches the shell state's active mode at [this+0x08] tearing down any prior mode object selecting one of seven mode-specific handlers and updating globals like 0x006cec78 before notifying the shell bundle through 0x00538e50. | ghidra + rizin |
| 282 | 0x005a2d64 | 101 | crt_init_exit_handlers | startup | cdecl | inferred | ghidra-headless | 3 | Initializes on-exit tables and registers atexit handling before control reaches application startup. | ghidra + rizin |
| 283 | 0x005a30f2 | 34 | __amsg_exit | startup | cdecl | inferred | ghidra-headless | 4 | CRT fatal-exit helper that forwards startup failures into __exit. | ghidra + rizin |
| 284 | 0x005a3117 | 36 | crt_fast_error_exit | startup | cdecl | inferred | ghidra-headless | 4 | Startup error path that optionally emits the CRT banner then formats the failure and terminates through ___crtExitProcess. | ghidra + rizin |
| 285 | 0x005a313b | 423 | crt_startup_entrypoint | startup | cdecl | inferred | ghidra-headless | 4 | PE entrypoint for patch 1.06; performs CRT and environment setup then validates early state before handing off to application bootstrap. | sha256:01b0d2496cddefd80e7e8678930e00b13eb8607dd4960096f527564f02af36d4 + ghidra + rizin + llvm-objdump |
| 286 | 0x0053b020 | 70 | bootstrap_reset_locale_state | bootstrap | unknown | inferred | ghidra-headless | 2 | Calls the locale helper at 0x0053ae70 then frees and clears related global pointers before later shell setup continues. | ghidra + rizin |
| 287 | 0x0053b010 | 11 | bootstrap_mark_runtime_started | bootstrap | cdecl | inferred | ghidra-headless | 2 | Single-purpose bootstrap helper that flips a process-global started flag to one before branding and shell setup continue. | ghidra + rizin |
| 288 | 0x0054e6d0 | 42 | bootstrap_capture_keyboard_state | bootstrap | cdecl | inferred | ghidra-headless | 4 | Single-purpose bootstrap probe that snapshots the host keyboard state through GetKeyboardState. | ghidra + rizin |
| 289 | 0x0055da40 | 424 | bootstrap_probe_system_profile | bootstrap | cdecl | inferred | ghidra-headless | 4 | Collects GlobalMemoryStatus and CPUID feature bits then stores coarse machine capability flags used by later bootstrap decisions. | ghidra + rizin |
| 290 | 0x00507b90 | 346 | station_place_refresh_category_controls | shell | cdecl | inferred | objdump + strings + RT3.lng | 4 | Refreshes the StationPlace.win category and mode controls for the current placement mode stored at 0x00622af4. The helper now grounds the six top-level category buttons rooted at 0x697c through 0x6981 as `Place a small station` 2197, `Place a medium station` 2198, `Place a large station` 2199, `Place a service tower` 2200, `Place a maintenance facility` 2201, and `Place a non-station building` 2202. It also refreshes the dependent controls around 0x69c8 0x69c9 0x6985 0x6986 and 0x6983 through 0x00540120; current evidence now bounds 0x6985 and 0x6986 as a two-state station-rotation policy toggle keyed by 0x006d1728, where 0x6985 aligns with `When placing the building, it will rotate itself as needed to orient to track or avoid obstacles.` string 2207 and 0x6986 aligns with `When placing the building, it will strictly adhere to the rotation specified by the circle above.` string 2206. In non-station-building mode 5 it can also seed [this+0x8c] from the active StationPlace list control under 0x006d1720 before preview formatting continues. | objdump + strings + RT3.lng + caller xrefs + callsite inspection |
| 291 | 0x00508550 | 363 | station_place_format_selected_site_summary | shell | cdecl | inferred | objdump + strings | 3 | Formats the selected StationPlace target summary for the live tool object. It looks up the active placement record index [this+0x8c] in 0x0062b2fc follows secondary data through field +0x173 into 0x0062b268 combines that with the current staged world coordinates at 0x006d1738 and 0x006d173c and emits the localized summary block through 0x00540120 into the StationPlace.win status area. | objdump + strings + caller xrefs + callsite inspection |
| 292 | 0x00508730 | 292 | station_place_format_preview_panel | shell | cdecl | inferred | objdump + strings | 4 | Formats the StationPlace.win preview panel for the currently selected placement record stored at [arg_4h+0x8c]. It chooses preview assets like 2DLabel.imb 2DCity.imb 2DVent.imb 2DMist.imb and 2DVolcano.imb for control 0x6982 and emits the matching text block through control 0x6984 using the geography tables rooted at 0x0062b2fc and 0x0062b268. | objdump + strings + caller xrefs + callsite inspection |
| 293 | 0x00508880 | 727 | station_place_select_category_and_refresh | shell | cdecl | inferred | objdump + strings + RT3.lng | 4 | Primary StationPlace.win category and selection refresh helper. It stores the requested placement mode at 0x00622af4, where current grounded evidence now maps 0..5 to small station, medium station, large station, service tower, maintenance facility, and non-station building. For the three station modes it also enables the secondary style strip rooted at 0x6988 0x6989 and 0x698c, where 0x6988 and 0x6989 cycle the current building style and 0x698c displays the active style token built from `StationSml` `StationMed` or `StationLrg` plus one of the six localized architecture styles `Victorian` 2672 `Tudor` 2671 `Southwest` 2670 `Persian` 2669 `Kyoto` 2668 and `Clapboard` 2667; the player-facing tooltip for that strip is `Scroll through building styles.` string 2203. The helper resolves the current selection through 0x00622af0 and 0x00622aec, repopulates the StationPlace list controls at 0x69df and 0x69e3, and then refreshes the preview and category panels through 0x00508730 and 0x00507b90. | objdump + strings + RT3.lng + caller xrefs + callsite inspection |
| 294 | 0x00508bb0 | 510 | station_place_world_surface_sync_and_dispatch | shell | thiscall | inferred | objdump + caller xrefs + strings | 4 | Shared world-surface helper for the active StationPlace.win tool object. It accepts direct `0x07d6` control traffic from the window dispatcher or falls back to the same shell detail-panel surface looked up through 0x006d0818, rechecks flag bit 0x4 on that control, performs world hit tests through 0x00448ac0, stages world coordinates into 0x006d1738 and 0x006d173c, refreshes the selected-site summary through 0x00508550, and updates the live placement selection globals at 0x00622af0 0x00622aec and 0x006d1740 plus helper objects rooted at [this+0x80] [this+0x84] and [this+0x88]. This makes it the clearest StationPlace-side consumer of the shared main-world interaction surface rather than only a passive status refresh helper. | objdump + caller xrefs + strings + callsite inspection |
| 295 | 0x005091b0 | 967 | station_place_window_handle_message | shell | thiscall | inferred | objdump + strings + RT3.lng | 4 | Primary message dispatcher for the StationPlace.win tool object at 0x006d1720. It switches over the incoming shell message id then handles the StationPlace control family rooted at category ids 0x697c through 0x6981, now grounded as the player-facing small station, medium station, large station, service tower, maintenance facility, and non-station-building buttons from strings 2197 through 2202. It also handles the style-strip controls at 0x6988 and 0x6989, which cycle the current building-style override used by station categories, the dependent controls around 0x6985 and 0x6986, now bounded as the two station-rotation policy choices from strings 2207 and 2206, the dedicated station-rotation circle control 0x6987, the list controls 0x69df and 0x69e3, and the shared world-surface control 0x07d6. The handler routes category and selection changes through 0x00508880 and 0x00507b90, uses 0x00507d80 for the live station-rotation drag/update branch, and delegates the world-hit-test path through 0x00508bb0. That makes it the clearest grounded owner for StationPlace player-facing tool commands rather than only a constructor plus frame hook. | objdump + strings + RT3.lng + caller xrefs + callsite inspection |
| 296 | 0x00509d80 | 1936 | station_place_window_construct | shell | thiscall | inferred | objdump + strings + RT3.lng | 4 | Constructs the StationPlace.win world-tool window object later published at 0x006d1720. The constructor seeds the vtable at 0x005d17c0 binds the StationPlace.imb helper asset and StationPlace.win resource through 0x0053d110 and 0x0053fa50 clears local selection and preview fields rooted at [this+0x7c] through [this+0x94], seeds the dedicated station-rotation circle control at 0x6987 through callback 0x00507a90, seeds the list controls 0x69df and 0x69e3, and stores the singleton plus helper handle globally at 0x006d1720 and 0x006d1724. Current evidence ties that 0x6987 branch to the player-facing `Click to rotate the building. You can also use bracket keys [ and ] to rotate buildings.` string 2208 rather than to the older `Building placement center` string 671; current recovered StationPlace code paths do not show a direct live lookup of string id 671 at all, which makes it look more like a stale or legacy label than a surviving control caption in the present window flow. The current grounded caller is the shell detail-panel constructor branch at 0x004dddc4. | objdump + strings + RT3.lng + caller xrefs + callsite inspection |
| 297 | 0x0050a530 | 64 | station_place_window_service_frame | shell | thiscall | inferred | objdump + caller xrefs | 3 | Recurring StationPlace.win service pass for the live station-placement tool object at 0x006d1720. The helper checks the local latch at [this+0x94] plus current shell or world selection state and then delegates one branch into 0x00508bb0 for follow-up station-placement synchronization on the same shared `0x07d6` main-world surface used by the dispatcher when the surrounding world tool remains active. Current grounded callers sit in the same recurring world and shell post-frame hooks used by sibling world-tool windows at 0x004423df 0x00444eda and 0x00445a64. | objdump + caller xrefs + callsite inspection |
| 298 | 0x0050d2d0 | 1245 | track_lay_window_refresh_controls | shell | thiscall | inferred | objdump + strings + RT3.lng | 4 | Refreshes the visible TrackLay.win control state after mode or preference changes. The helper highlights the three mutually exclusive primary mode buttons rooted at control ids 0x985e 0x985f and 0x9860 from the shared track-lay mode field at 0x00622b0c; current primary evidence now strongly aligns those grounded values as 1=`Lay single track.` string id 2054 4=`Lay double track.` string id 2055 and 0x40=`Bulldoze` string id 1721. The same refresh pass also updates the bridge-type selector family rooted at 0x006cec74+0x138 through controls 0x9861 and above; formats the two wrapped frequency values at 0x006cec74+0x140 and 0x006cec74+0x13c into controls 0x9870 and 0x9871 using the localized `Never` through `Common` string ids 615 through 618; and updates the two boolean preference toggles rooted at 0x006cec74+0x144 and 0x006cec78+0x4c74 through controls 0x986e and 0x986d. Current evidence now strongly aligns that pairing as 0x986e or 0x006cec74+0x144 = `Auto-Hide Trees During Track Lay` strings 1838 and 1839 and 0x986d or 0x006cec78+0x4c74 = `Auto-Show Grade During Track Lay` strings 3904 and 3905: the first toggle lives in the compact track-lay preference block alongside bridge and frequency settings while the second lives in the broader display-runtime block and fits the grade-overlay behavior. The same refresh path also updates the electrify-all action control at 0x9873 and the surrounding status widgets, which makes it the clearest grounded owner for the TrackLay.win status panel rather than only a generic shell redraw. | objdump + strings + RT3.lng + callsite inspection |
| 299 | 0x0050e1e0 | 534 | track_lay_window_service_frame | shell | thiscall | inferred | objdump + caller xrefs + strings | 4 | Recurring TrackLay.win service pass for the active track-lay tool object at 0x006d1a8c. The helper decrements the local reentry guard at [this+0x87] and when the pass is active it either routes the current track-lay drag state through 0x0050d740 while the grounded `Bulldoze` mode value 0x40 is live in 0x00622b0c or synchronizes the staged world-interaction state back into the live world owner through 0x006cfca8 and 0x0050dce0. The same service family also special-cases control id 0x07d6 through the tool-owned current-control field [this+0x7e], which now strongly suggests that 0x07d6 is the shared main-world interaction surface for TrackLay.win rather than a generic shell-detail button. Current grounded callers sit in the recurring world and shell post-frame hooks at 0x004423ee 0x00444ee9 and 0x00445a73. | objdump + caller xrefs + strings + callsite inspection |
| 300 | 0x0050e400 | 448 | track_lay_window_construct | shell | thiscall | inferred | objdump + caller xrefs + strings | 4 | Constructs the TrackLay.win world-tool window object later published at 0x006d1a8c. The constructor seeds the vtable at 0x005d191c clears the tool-state fields rooted at [this+0x78] [this+0x7d] [this+0x82] and [this+0x87] binds the TrackLay.win resource through 0x0053fa50 refreshes the visible control set through 0x0050dc00 snapshots one world span from 0x0062c120 into 0x006d1a94 and stores the singleton globally before returning. The current grounded caller is the shell detail-panel constructor branch at 0x004ddecd. | objdump + caller xrefs + strings + callsite inspection |
| 301 | 0x0050e5c0 | 3867 | track_lay_window_handle_message | shell | thiscall | inferred | objdump + strings + RT3.lng | 4 | Primary message dispatcher for the TrackLay.win tool object at 0x006d1a8c. It switches over the incoming shell message id then handles control ids in the TrackLay.win family such as 0x9858 through 0x9874 plus the special world-surface control 0x07d6. The handler uses world hit tests through 0x00448ac0 to arm and release the drag latch at [this+0x7d] on 0x07d6 transitions, routes the active mode through the shared track-lay state at 0x00622b0c including the now-bounded primary values 1=`Lay single track.` 4=`Lay double track.` and 0x40=`Bulldoze`, updates the selected world object path rooted at 0x006cfca8+0x118, and refreshes the tool UI through 0x0050d2d0 0x0050d740 and 0x0050dce0. The same dispatcher also owns the TrackLay.win preference and action controls: it toggles the two boolean track-lay options rooted at 0x006cec74+0x144 and 0x006cec78+0x4c74, where current evidence now strongly aligns the first control branch at 0x985a with `Auto-Hide Trees During Track Lay` and the later `0x006cec78+0x4c74` branch with `Auto-Show Grade During Track Lay`; it also cycles the bridge-type selector family at 0x006cec74+0x138, wraps the two frequency settings at 0x006cec74+0x140 and 0x006cec74+0x13c, and routes the electrify-all command through the localized confirmation and failure strings 3083 3084 3837 and 3900. This makes it the clearest grounded owner for player-facing TrackLay.win commands rather than only a passive status panel. | objdump + strings + RT3.lng + callsite inspection |
| 302 | 0x0051d900 | 155 | string_find_substring_ex | support | cdecl | inferred | ghidra-headless | 3 | Reusable substring finder that returns a pointer to the first matching window in the haystack or null. It precomputes both string lengths then slides across the haystack calling one of two compare helpers depending on the mode flag pushed on the stack; the graphics branch uses it to probe adapter strings for legacy GPU-profile tokens and bootstrap code uses it for startup media or compatibility string checks. | ghidra + rizin + llvm-objdump |
| 303 | 0x0051d870 | 21 | bootstrap_seed_tick_count | bootstrap | cdecl | inferred | ghidra-headless | 4 | Lazily snapshots GetTickCount into a bootstrap-global cache so later subsystems start from a nonzero host tick baseline. | ghidra + rizin |
| 304 | 0x0051ebc0 | 731 | shell_reset_display_runtime_defaults | shell | cdecl | inferred | ghidra-headless | 3 | Resets the global display runtime defaults rooted at 0x006d4024. It clears the large display-settings block under offsets 0x11468a and above seeds default resolution and capability flags from mode 0x006d4028 and reinitializes several shell display toggles before later preset application continues. | ghidra + rizin + llvm-objdump |
| 305 | 0x0051eea0 | 128 | shell_save_display_runtime_config | shell | cdecl | inferred | ghidra-headless | 4 | Writes the larger display-runtime blob to data\\configuration\\engine.cfg. It stores version key 0x41b serializes the 0x1e4-byte runtime block rooted at [this+0x11468a] and writes an additional 0x1ec-byte companion block before closing the file. | ghidra + rizin + llvm-objdump + strings |
| 306 | 0x0051ef20 | 194 | shell_load_display_runtime_config_or_init_defaults | shell | cdecl | inferred | ghidra-headless | 4 | Loads the larger display-runtime blob from data\\configuration\\engine.cfg. When the file is missing invalid or already superseded by mode state at 0x006d4028 it falls back to 0x0051ebc0 and 0x0051eea0; otherwise it validates key 0x41b restores the 0x1e4-byte and 0x1ec-byte blocks and clears one shell display flag when [this+0x11474a] is set. | ghidra + rizin + llvm-objdump + strings |
| 307 | 0x0051f0f0 | 3 | shell_controller_get_window_handle | shell | thiscall | inferred | objdump + import-table | 4 | Returns the native shell window handle stored at [this+0x00]. Callers forward the returned handle into USER32 imports such as SetFocus SetMenu and SetCapture during shell startup and presentation interaction. | objdump + USER32 import table + callsite xrefs |
| 308 | 0x0051f1d0 | 90 | shell_signal_deferred_work_item_shutdown | shell | thiscall | inferred | ghidra-headless | 3 | Walks the shell deferred-work item queue at [this+0x1136a5] and inspects each queued payload object's nested message queue at [item+0xe4]. When intrusive_queue_peek_tail_payload finds a nonnull tail payload it clears the outer queued-handle slot at [item+0xe8] and appends a null sentinel into the nested queue through intrusive_queue_push_back before continuing iteration. | ghidra + rizin + llvm-objdump |
| 309 | 0x0051f230 | 128 | shell_enqueue_deferred_work_message | shell | thiscall | inferred | ghidra-headless | 4 | Routes one deferred-work message through the shell queue system. When the global routing gate at 0x006d4034 and shell flag [this+0x11369c] are both set it feeds the special queue at [this+0x11369d]; otherwise a nonnull payload object is queued once in [this+0x1136a5] with the returned queue-node handle cached at [item+0xe8] and the message is appended to the payload-owned nested queue at [item+0xe4] while a null payload appends directly into the fallback queue at [this+0x1136a1]. | ghidra + rizin + llvm-objdump |
| 310 | 0x0051f2b0 | 104 | shell_post_deferred_message_type5 | shell | thiscall | inferred | ghidra-headless | 4 | Allocates one 0x5e-byte deferred-message record from the shell-owned slab rooted at [this+0x5c] using count [this+0x58] tags it as type 0x05 stores four caller dwords at offsets +0x01 +0x05 +0x09 and +0x0d and then posts the record directly into the shell deferred queue roots through [this+0x11369d] or [this+0x1136a1]. | ghidra + rizin + llvm-objdump |
| 311 | 0x0051f320 | 72 | shell_post_deferred_message_type6 | shell | thiscall | inferred | ghidra-headless | 4 | Allocates one 0x5e-byte deferred-message record from the same shell slab and tags it as type 0x06 before posting it directly into the shell deferred queue roots. This is the minimal direct-post sibling of the type-0x05 builder and uses the same count field at [this+0x58] and slab base at [this+0x5c]. | ghidra + rizin + llvm-objdump |
| 312 | 0x0051f370 | 229 | shell_enqueue_deferred_message_type4 | shell | thiscall | inferred | ghidra-headless | 4 | Allocates one 0x5e-byte deferred-message record from the shell-local slab at [this+0x5c] populates the larger multi-field payload tags it as type 0x04 mixes the shell byte [this+0x114227] into record byte +0x5d and routes the finished record through shell_enqueue_deferred_work_message. | ghidra + rizin + llvm-objdump |
| 313 | 0x0051f460 | 173 | shell_enqueue_deferred_message_type1 | shell | thiscall | inferred | ghidra-headless | 4 | Allocates one 0x5e-byte deferred-message record from the same shell-local slab fills the smaller type-0x01 payload subset mixes the shell byte [this+0x114227] into record byte +0x5d and routes the finished record through shell_enqueue_deferred_work_message. | ghidra + rizin + llvm-objdump |
| 314 | 0x0051f510 | 48 | shell_set_gamma_ramp_scalar | shell | thiscall | inferred | ghidra-headless | 4 | Applies one shell gamma-ramp scalar to the active display runtime state. When the presentation service pointer at [this+0x0c] is live it forwards the scalar into 0x00547f20 for an immediate hardware upload; otherwise it only caches the requested value at [this+0x1146b9] until the service is ready. | ghidra + rizin + llvm-objdump |
| 315 | 0x0051fd70 | 516 | shell_update_frame_time_history | shell | thiscall | inferred | ghidra-headless | 4 | Updates a 256-sample frame-time history from successive GetTickCount deltas. The helper advances the ring index in 0x006d403c stores each delta under [this+0x11428a] and derives a smoothed frame scalar at [this+0x114282] for later shell frame consumers such as 0x0051ff80 and the presentation-frame path. | ghidra + rizin + llvm-objdump |
| 316 | 0x0051ff80 | 7 | shell_get_smoothed_frame_scalar | shell | thiscall | inferred | objdump | 4 | Returns the smoothed frame scalar cached at [this+0x114282]. shell_update_frame_time_history refreshes that field each frame and shell_refresh_presentation_frame consumes it during the main presentation refresh path. | objdump + callsite xrefs |
| 317 | 0x0051ff90 | 24 | shell_install_global_controller | shell | thiscall | inferred | objdump + analysis-context | 4 | Installs one shell controller as the process-global singleton at 0x006d4024 clears controller flag [this+0x114201] reruns the local state reset helper at 0x0051ea80 and returns the same controller pointer. bootstrap_init_shell_window_services calls it immediately after allocating the 0x11486e-byte controller object. | objdump + analysis-context + startup xrefs |
| 318 | 0x00521d10 | 38 | multiplayer_request_peer_session_control | shell | cdecl | inferred | ghidra-headless | 3 | Requests one direct session-control action for a resolved multiplayer peer object. When the live session transport at `0x006d40dc` is present it follows the transport-owned interface at `[ecx+0x18e]->+0x08` and invokes vtable slot `+0x68` with the target peer object and three zero trailing arguments; the current grounded callers are the `\\kick` branch and the online-peer `\\unban` follow-up path. | ghidra + rizin + llvm-objdump |
| 319 | 0x0051fa00 | 56 | shell_get_memory_budget_ceiling_bytes | shell | thiscall | inferred | ghidra-headless | 3 | Returns the current upper memory-budget bucket in bytes for the shell display runtime. When override field [this+0x1146ca] is set it maps that tier through the shared table at 0x00624c34 containing 0 1MB 2MB and 4MB entries; otherwise it starts from baseline field [this+0x1136ad] and adjusts it by the active lower-tier delta derived from [this+0x1146c6] and [this+0x1136a9] before clamping negative results to zero. | ghidra + rizin + llvm-objdump |
| 320 | 0x0051fa40 | 25 | shell_get_memory_budget_floor_bytes | shell | thiscall | inferred | ghidra-headless | 3 | Returns the current lower memory-budget bucket in bytes for the shell display runtime. When field [this+0x1146c6] is nonzero it maps that tier through the shared 0 1MB 2MB 4MB table at 0x00624c34; otherwise it falls back to baseline field [this+0x1136a9]. | ghidra + rizin + llvm-objdump |
| 321 | 0x0051fa60 | 63 | shell_get_nonnegative_memory_budget_floor_bytes | shell | thiscall | inferred | ghidra-headless | 3 | Returns a nonnegative lower memory-budget value for float consumers in the shell and presentation paths. It prefers explicit tier field [this+0x1146ce] then the active floor bucket behind [this+0x1146c6] and finally baseline field [this+0x1136a9] using the shared 0 1MB 2MB 4MB table at 0x00624c34 and clamping negative results to zero. | ghidra + rizin + llvm-objdump |
| 322 | 0x005204b0 | 128 | shell_flush_deferred_work_queues | shell | thiscall | inferred | ghidra-headless | 4 | Flushes the shell controller's three deferred-work queue roots at [this+0x1136a1] [this+0x11369d] and [this+0x1136a5]. The helper clears the first two containers through intrusive_queue_clear_and_release then rewinds the deferred-item queue through intrusive_queue_rewind_iterator repeatedly pops each queued payload through intrusive_queue_next_iterator_node clears its outer queued-handle slot at [item+0xe8] and finally releases the remaining queue storage before returning. It is used at the end of shell_service_frame_cycle and from the broader shell-mode helper at 0x00443a50. | ghidra + rizin + llvm-objdump |
| 323 | 0x00520620 | 141 | shell_service_frame_cycle | shell | thiscall | inferred | ghidra-headless | 4 | Acts as the outer owner for one pending shell frame cycle on the active controller. When pending-frame state is armed through [this+0x56] and controller pointers [this+0x18] [this+0x1c] and [this+0x28] are live it runs shell_refresh_presentation_frame through 0x0052b990; otherwise it still updates frame timing through 0x0051fd70 runs the mouse-cursor frame updater 0x0053f4e0 requests the deeper layout-state rebuild path through 0x00565110 performs a one-time ShowWindow on the controller window handle at [this] drains deferred work through 0x005204b0 and clears the pending flags at [this+0x56] and [this+0x58]. | ghidra + rizin + llvm-objdump |
| 324 | 0x00521060 | 805 | bootstrap_init_shell_service_bundle | bootstrap | cdecl | inferred | ghidra-headless | 4 | Builds the shell-facing singleton bundle stored through globals like 0x006d4024 0x006d402c and 0x006d4030 wiring startup width and height state an rt3_ prefixed service path and the separate shell input-state object rooted at 0x006d4018. | ghidra + rizin + objdump |
| 325 | 0x00521390 | 486 | bootstrap_destroy_shell_service_bundle | bootstrap | cdecl | inferred | ghidra-headless | 4 | Destroys the shell service bundle created by 0x00521060 releasing each global singleton and clearing 0x006d4024 0x006d402c 0x006d4030 0x006d4020 and 0x006d4018. | ghidra + rizin |
| 326 | 0x00523d90 | 65 | shell_commit_layout_updates | bootstrap | thiscall | inferred | ghidra-headless | 3 | Applies pending layout-slot changes from the shell controller into its subordinate layout-state object at [this+0x2d] by walking embedded service pointers and issuing the follow-on rebuild or refresh calls that make the updated slot table live. | ghidra + rizin |
| 327 | 0x00523e40 | 51 | shell_invalidate_layout_state | bootstrap | thiscall | inferred | ghidra-headless | 4 | Marks the shell controller's layout-state path dirty by setting flags [this+0x3747] [this+0x3748] and [this+0x3749] then forwarding two state parameters into the subordinate object at [this+0x2d]. | ghidra + rizin |
| 328 | 0x005270d0 | 8 | shell_mark_layout_dirty | bootstrap | thiscall | inferred | ghidra-headless | 2 | Marks the shell layout child dirty by setting byte flag [this+0x3749] before later code forces a commit pass. | ghidra + rizin |
| 329 | 0x00527650 | 1476 | shell_publish_texture_budget_report | shell | thiscall | inferred | ghidra-headless | 4 | Builds and publishes a shell-side texture budget report through the current layout state at [this+0x2d]. The routine formats the current memory-budget floor and ceiling buckets from 0x0051fa40 and 0x0051fa00 converts them to kilobytes adds the current texture-change counter through 0x0055d390 appends labels like Texture changes per frame Texture SRAM and Texture VRAM and forwards the assembled text into 0x00566980. | ghidra + rizin + llvm-objdump + strings |
| 330 | 0x00527e10 | 868 | shell_update_layout_tracking_sample | bootstrap | thiscall | inferred | ghidra-headless | 4 | Samples a tracked shell target from the object argument computes distance heading and orientation deltas against cached values at [this+0x36b8..0x36cc] consults the dirty flags and index helper at 0x00526590 and returns whether the controller should drive a fresh layout-state apply; on success it updates the cached sample fields and the global tick at 0x00cc3b4c. | ghidra + rizin |
| 331 | 0x0052b990 | 4993 | shell_refresh_presentation_frame | shell | thiscall | inferred | ghidra-headless | 3 | Main shell frame-style refresh pass for the active controller and layout-state path. It handles mode-sensitive layout-state rebuilds and dirties updates tracked shell samples through 0x00527e10 runs the nearby geographic-label static-cell animated-quad ranked-overlay and ranked-billboard sweeps applies presentation-node properties and cached vertex spans optionally publishes the texture budget report through 0x00527650 may request a deeper rebuild through 0x00565110 and can recurse once for a follow-up presentation pass before downstream timing or present helpers run. | ghidra + rizin + llvm-objdump |
| 332 | 0x0052da00 | 102 | vehicle_visual_register_attachment_object | bootstrap | thiscall | inferred | ghidra-headless | 3 | Registers one prebuilt attachment object on the owning vehicle visual. The helper lazily allocates a small attachment list at [this+0x81] pushes the object through 0x00556e10 copies the owner tint triple from [this+0x1e2] [this+0x1e6] and [this+0x1ea] into the object through 0x005545d0 and links the owner back through 0x005540a0. | ghidra + rizin + llvm-objdump |
| 333 | 0x00529840 | 400 | shell_build_static_cell_triangle_sweep | bootstrap | thiscall | inferred | ghidra-headless | 4 | Builds the fixed-cell triangle sweep over the grid returned by 0x00533cd0. It samples shell brightness to derive one grayscale packed color binds the layout-state vertex24 table once and then expands each accepted 0x24-byte cell record into six vertex24 records by emitting the same three-point face twice before committing the span and restoring presentation state. | ghidra + rizin + llvm-objdump |
| 334 | 0x00529b50 | 1149 | shell_build_geographic_label_vertex24_sweep | bootstrap | thiscall | inferred | ghidra-headless | 4 | Builds the geographic-label vertex24 sweep over the grid returned by 0x00533db0. It gates on config byte [this+0x29+0x63] primes one vertex24 span and text presentation state samples shell brightness and the 0x006d9098 priority map to derive per-item alpha rejects items through virtual check +0x0c emits per-item geographic-label frame geometry through 0x00539fb0 optionally emits geographic-label text through 0x0053a960 and commits buffered spans through the layout-state presentation helpers. The naming matches the dedicated geographic-label asset family backed by gpdLabelDB and 2DLabel.imb. | ghidra + rizin + llvm-objdump |
| 335 | 0x00528d90 | 1824 | shell_process_nearby_presentation_item | bootstrap | thiscall | inferred | ghidra-headless | 3 | Processes one candidate item for the nearby-presentation sweep. It rejects disabled entries and mode-mismatched flags optionally gates by forward-range tests around the caller origin lazily assigns the item's segment-record window from the layout-state tables stores accepted nearest-candidate distances in the side buffer at [this+0xa9] and [this+0xad] and forwards the item plus eligible child collections into the active presentation lists. | ghidra + rizin + llvm-objdump |
| 336 | 0x005294b0 | 912 | shell_update_nearby_presentation_sweep | bootstrap | thiscall | inferred | ghidra-headless | 3 | Performs the higher-level nearby-presentation sweep for the current shell state. It scans candidate cells from the offset table at [this+0x374f] using the priority map at 0x006d9098 enumerates item lists for each accepted cell normalizes the first accepted direction vector binds the segment-record presentation table through 0x0054bab0 calls 0x00528d90 for each candidate and then selects the nearest buffered item into [this+0x366e] before refreshing presentation batches through 0x00548da0. | ghidra + rizin + llvm-objdump |
| 337 | 0x00529fd0 | 793 | shell_build_cell_vertex24_sweep | bootstrap | thiscall | inferred | ghidra-headless | 4 | Builds the animated-quad cell sweep over the grid returned by 0x00533e30 depending on the boolean mode argument. It gates on configuration bytes [this+0x29+0x5f] or [this+0x29+0x60] walks candidate-cell offsets from [this+0x374f] selects the primary list at [cell+0x1c] or alternate list at [cell+0x20] initializes the layout-state vertex24 table once through 0x0054bb70 streams each list through 0x00567c70 or 0x00567ce0 and then commits the accumulated span through 0x00545c50 before restoring presentation state. | ghidra + rizin + llvm-objdump |
| 338 | 0x0052a2f0 | 736 | shell_build_ranked_overlay_vertex24_sweep | bootstrap | thiscall | inferred | ghidra-headless | 3 | Builds a ranked secondary vertex24 overlay pass over the cell grid returned by 0x00533e50 and two object collections at [this+0x85] and [this+0x81]. It computes a per-frame packed tint from the current shell brightness gathers and sorts candidate items by priority field [item+0x1d9] binds the layout-state vertex24 table and emits accepted items through 0x00524780 and 0x00554e70 before committing the span. | ghidra + rizin + llvm-objdump |
| 339 | 0x0052a5d0 | 1784 | shell_build_ranked_object_billboard_sweep | bootstrap | thiscall | inferred | ghidra-headless | 3 | Builds the sibling ranked object-overlay pass gated by config byte [this+0x29+0x5e]. It merges candidates from the object collections at [this+0x85] and [this+0x81] sorts them by priority field [item+0x1d9] prepares billboard basis state through 0x00566670 and emits accepted entries through 0x00554e70 before committing the vertex24 span. | ghidra + rizin + llvm-objdump |
| 340 | 0x0052dd00 | 864 | shell_expand_segment_record_triplets | bootstrap | thiscall | inferred | ghidra-headless | 4 | Expands one active presentation-batch record into three transformed 0x20-byte segment records inside the caller-provided buffer; each output record is two vec3 blocks at +0x00 and +0x0c plus scalar slots at +0x18 and +0x1c. The selected batch record supplies a source-array pointer at +0x04 a source-count at +0x0c and 0x4c-byte packed source entries that carry four point sources plus three scalar pairs for the emitted triplet. | ghidra + rizin |
| 341 | 0x0053f4e0 | 739 | mouse_cursor_update_frame_state | shell | thiscall | inferred | ghidra-headless | 4 | Per-frame MouseCursor.cpp updater for the global cursor controller at 0x00ccbb20. It refreshes elapsed tick state through 0x0051d890 re-arms the active cursor selection through 0x0053f450 and 0x0053f000 when the 150 ms and 15 s idle thresholds trip resets per-frame cursor globals through 0x0054f6c0 and 0x0054f6d0 samples cursor placement and world-relative state through world_anchor_measure_projected_half_width world_anchor_measure_projected_half_height and shell_queue_world_anchor_marker and publishes the resulting cursor presentation state through shell_publish_text_callout_presentation before finalizing through 0x0054f6e0. | ghidra + rizin + llvm-objdump + strings |
| 342 | 0x0052e060 | 537 | shell_expand_vertex24_triplets | bootstrap | thiscall | inferred | ghidra-headless | 4 | Sibling emitter for the same active presentation-batch record family; expands each 0x4c-byte packed source entry into three 0x18-byte vertex24 records in the caller-provided buffer. Each emitted record stores a vec3 at +0x00 a style dword from [this+0x43] at +0x0c and scalar slots at +0x10 and +0x14 while the output-count accumulator advances by count*3. | ghidra + rizin |
| 343 | 0x0052eb20 | 51 | shell_read_optional_presentation_extents4 | bootstrap | thiscall | inferred | ghidra-headless | 4 | Reads an optional four-float extent block from the active presentation-batch record when byte flag [this+0x25] is set; copies dwords at +0x26 +0x2a +0x2e and +0x32 into caller outparams for the presentation-extents helper at 0x547d10. | ghidra + rizin |
| 344 | 0x0052eca0 | 43 | shell_get_next_presentation_batch_record | bootstrap | thiscall | inferred | ghidra-headless | 4 | Returns the next 0x45-byte presentation-batch record for the active item family rooted at [this+0x14] if current index [this+0x21] plus one is still below the family count at [+0x14]; otherwise returns null. | ghidra + rizin |
| 345 | 0x00524780 | 1252 | shell_emit_ranked_overlay_cell_items | bootstrap | thiscall | inferred | ghidra-headless | 3 | Processes one ranked-overlay cell list for 0x0052a2f0. It samples shell range thresholds through 0x00533180 and 0x00533160 filters cell items by distance and intensity derives an alpha-biased packed color from the caller input and emits accepted items into the current vertex24 span through layout helper 0x005468c0. | ghidra + rizin + llvm-objdump |
| 346 | 0x00533ba0 | 39 | shell_grid_get_nearby_presentation_cell | bootstrap | thiscall | inferred | ghidra-headless | 4 | Returns one tile-grid cell from the nearby-presentation layer rooted at [this+0x1671]. The helper converts world coordinates into 16x16 tile coordinates multiplies by the grid width stored at [this+0x15d9] and indexes the cell-pointer table at [this+0x1671]. | ghidra + rizin + llvm-objdump |
| 347 | 0x00533cd0 | 39 | shell_grid_get_static_vertex24_cell | bootstrap | thiscall | inferred | ghidra-headless | 4 | Returns one tile-grid cell from the fixed-geometry vertex24 layer rooted at [this+0x167d]. The helper converts world coordinates into 16x16 tile coordinates multiplies by the grid width stored at [this+0x15d9] and indexes the cell-pointer table at [this+0x167d]. | ghidra + rizin + llvm-objdump |
| 348 | 0x00533db0 | 30 | shell_grid_get_geographic_label_cell | bootstrap | thiscall | inferred | ghidra-headless | 4 | Returns one tile-grid cell from the geographic-label layer rooted at [this+0x1675]. The helper converts world coordinates into 16x16 tile coordinates multiplies by the grid width stored at [this+0x15d9] and indexes the cell-pointer table at [this+0x1675]. | ghidra + rizin + llvm-objdump |
| 349 | 0x00533e30 | 32 | shell_grid_get_animated_quad_cell | bootstrap | thiscall | inferred | ghidra-headless | 4 | Returns one tile-grid cell from the animated-quad presentation layer rooted at [this+0x1681]. The helper converts world coordinates into 16x16 tile coordinates multiplies by the grid width stored at [this+0x15d9] and indexes the cell-pointer table at [this+0x1681]. | ghidra + rizin + llvm-objdump |
| 350 | 0x00533e50 | 32 | shell_grid_get_ranked_overlay_cell | bootstrap | thiscall | inferred | ghidra-headless | 4 | Returns one tile-grid cell from the ranked secondary overlay layer rooted at [this+0x1685]. The helper uses the same 16x16 tile addressing and grid width field at [this+0x15d9] as the other shell cell-grid accessors and currently feeds 0x0052a2f0. | ghidra + rizin + llvm-objdump |
| 351 | 0x00539fb0 | 924 | shell_emit_geographic_label_frame_vertex24_records | bootstrap | thiscall | inferred | ghidra-headless | 4 | Expands the current geographic-label item into cached frame vertex24 records inside the caller buffer. The helper patches packed alpha into up to sixteen prebuilt 0x18-byte records copies additional 24-byte frame blocks from fixed item offsets and returns the emitted vertex count for the label border or backing geometry. | ghidra + rizin + llvm-objdump |
| 352 | 0x0053a440 | 14 | shell_set_geographic_label_item_alpha | bootstrap | thiscall | inferred | ghidra-headless | 4 | Stores an 8-bit alpha input into the high-byte color field at [this+0x5b] for the current geographic-label item before frame or text emission. | ghidra + rizin + llvm-objdump |
| 353 | 0x0053a960 | 723 | shell_emit_geographic_label_text_span | bootstrap | thiscall | inferred | ghidra-headless | 4 | Builds and emits one geographic-label text span for the current cell item. The helper calls the item vtable at +0x10 to materialize a null-terminated display string up to 0x12c bytes computes placement from item float fields and shell service state checks visibility through the shell bundle and forwards the resolved text payload into the presentation path through 0x005519f0. The item family aligns with gpdLabelDB and 2DLabel.imb rather than the parallel city assets. | ghidra + rizin + llvm-objdump |
| 354 | 0x00543f10 | 853 | layout_state_bind_presentation_asset_bundle | bootstrap | thiscall | inferred | ghidra-headless | 4 | Initial bind-time asset loader for the layout state's presentation node at [this+0x25df]; pulls a fixed presentation bundle through the node vtable at +0x5c and +0x60 including standalone assets stored around 0x2643 0x2647 0x264b 0x264f 0x2653 0x265b 0x265f and 0x2663 plus a 64-entry asset bank at 0x31ab while advancing an internal asset-offset cursor at [this+0x2543]. | ghidra + rizin |
| 355 | 0x00554830 | 142 | attachment_object_init_named_asset | bootstrap | thiscall | inferred | ghidra-headless | 3 | Initializes one named attachment object from a caller-supplied asset string and placement parameters. The helper copies the asset name into the local object buffer at [this+0x10] stores attachment selectors at [this+0x130] and [this+0x138] optionally derives a cached scale pair at [this+0x120] and [this+0x124] and then finalizes object state through 0x005545d0. | ghidra + rizin + llvm-objdump |
| 356 | 0x005455e0 | 224 | layout_state_set_slot_triplet_lo | bootstrap | thiscall | inferred | ghidra-headless | 4 | Updates the first three cached per-slot presentation scalars in the 24-byte slot table at [this+0x2597+slot*24]. In notify mode it compares against the cached values and forwards only changed fields into the bound presentation node through vtable slot +0xfc with subproperty ids 1 through 3. | ghidra + rizin + llvm-objdump |
| 357 | 0x005456d0 | 240 | layout_state_set_slot_triplet_hi | bootstrap | thiscall | inferred | ghidra-headless | 4 | Updates the second three cached per-slot presentation scalars in the same 24-byte slot table at [this+0x2597+slot*24]. In notify mode it compares against the cached values and forwards only changed fields into the bound presentation node through vtable slot +0xfc with subproperty ids 4 through 6. | ghidra + rizin + llvm-objdump |
| 358 | 0x005458f0 | 169 | layout_state_read_segment_record_window | bootstrap | thiscall | inferred | ghidra-headless | 4 | Gates the 32-byte segment-record table at [this+0x2643]; queries record bounds then copies a start-to-end or wrapped window into scratch storage at [this+0x2657] through vtable slot +0x2c while toggling byte flag [this+0x254e]. The downstream shell path treats each 0x20-byte record as two vec3 blocks plus two trailing scalars. | ghidra + rizin |
| 359 | 0x005459a0 | 69 | layout_state_read_segment_record_block | bootstrap | thiscall | inferred | ghidra-headless | 4 | Reads one 32-byte-indexed segment-record block from the same [this+0x2643] table into scratch storage at [this+0x2657] through vtable slot +0x2c using a fixed 0x2800-byte transfer span. | ghidra + rizin |
| 360 | 0x00545b10 | 57 | layout_state_read_vertex24_block | bootstrap | thiscall | inferred | ghidra-headless | 4 | Reads one 24-byte-indexed vertex block from the presentation table at [this+0x2647] through vtable slot +0x2c using index*24 addressing and returns the copied pointer through a stack outparam. The downstream shell emitter treats each record as vec3 plus a style dword plus two trailing scalars. | ghidra + rizin |
| 361 | 0x00545b50 | 59 | layout_state_read_vertex24_window | bootstrap | thiscall | inferred | ghidra-headless | 4 | Copies a window between two 24-byte vertex indices from [this+0x2647] into scratch storage at [this+0x2657] through vtable slot +0x2c using index*24 addressing and a fixed 0x1800-byte transfer span. The downstream shell emitter treats each record as vec3 plus a style dword plus two trailing scalars. | ghidra + rizin |
| 362 | 0x00545c50 | 67 | layout_state_commit_vertex24_span | bootstrap | thiscall | inferred | ghidra-headless | 4 | Converts a start and end vertex index range into a triplet count by dividing the delta by three accumulates that count at [this+0x3711] and notifies the bound presentation node at [this+0x25df] through vtable slot +0x118 with primitive-type argument 4. | ghidra + rizin |
| 363 | 0x00546a30 | 333 | layout_state_rebuild_variant_asset_cache | bootstrap | thiscall | inferred | ghidra-headless | 3 | Releases any loaded entries in the 64-slot presentation asset bank rooted at 0x31ab then rebuilds the paired-key metadata table at 0x266b tracking active entries count at [this+0x2667] and sibling or reuse links for later keyed lookups. | ghidra + rizin |
| 364 | 0x005467a0 | 50 | layout_state_enable_presentation_gate | bootstrap | thiscall | inferred | ghidra-headless | 4 | Ensures the presentation node gate property 0x1c is enabled once for the layout state when the template flag at [[this+0x83c]+0x2e] permits it by setting [this+0x2549] and forwarding the toggle into the node at [this+0x25df]. | ghidra + rizin |
| 365 | 0x00547d10 | 288 | layout_state_apply_presentation_extents4 | bootstrap | thiscall | inferred | ghidra-headless | 4 | Applies a four-float extent or quad block onto presentation property 0x18 for the bound node at [this+0x25df]. If all four inputs are nonpositive it clears the property through vtable slot +0xfc; otherwise it builds a 0x10-field stack block with the four caller values and a unit scalar then commits it through node slots +0xfc and +0x94. | ghidra + rizin + llvm-objdump |
| 366 | 0x00547f20 | 177 | layout_state_apply_gamma_ramp_scalar | bootstrap | thiscall | inferred | ghidra-headless | 4 | Builds a 256-entry three-channel gamma-ramp buffer from the caller scalar and uploads it through vtable slot +0x48 on the bound presentation node at [this+0x25df]. The helper clamps each 16-bit ramp entry stores the accepted scalar in the subordinate state block at [[this+0x83c]+0x2f] and respects shell capability guards under 0x006d4024 before touching the display device. | ghidra + rizin + llvm-objdump |
| 367 | 0x00548da0 | 1328 | layout_state_refresh_presentation_batches | bootstrap | thiscall | inferred | ghidra-headless | 4 | Walks the active presentation-batch list and refreshes the bound node state for each selected item. The routine applies batch extents through 0x00547d10 pushes style and gate properties including packed color property 0x3c updates per-slot triplets through 0x005455e0 and 0x005456d0 and emits segment-record or vertex24 spans from the current batch family before advancing to the next record. | ghidra + rizin + llvm-objdump |
| 368 | 0x005492d0 | 3747 | layout_state_probe_d3d8_capabilities | bootstrap | thiscall | inferred | ghidra-headless | 4 | Creates a Direct3D8 probe object and walks adapter or device capability queries for the layout-state presentation path. The routine caches probed texture-memory style fields into shell globals under 0x006d4024 including the values later reported as Texture SRAM and Texture VRAM consults the shell memory-budget helpers 0x0051fa40 and 0x0051fa60 refreshes the gamma ramp through 0x00547f20 when needed and assigns a local renderer capability tier at [this+0x04]. | ghidra + rizin + llvm-objdump + strings |
| 369 | 0x0054a280 | 626 | layout_state_apply_presentation_properties | bootstrap | thiscall | inferred | ghidra-headless | 4 | Pushes visibility color and mode-dependent scalar properties from the layout state into the bound presentation node at [this+0x25df]; toggles gate property 0x1c writes packed color property 0x22 from bytes 0x2510..0x2512 updates mode properties 0x23 through 0x26 from template flags and caller-supplied scalars and caches the leading scalar at [this+0x25b3]. | ghidra + rizin |
| 370 | 0x0054bab0 | 89 | layout_state_bind_segment_record_table | bootstrap | thiscall | inferred | ghidra-headless | 4 | Binds the current 32-byte segment-record table at [this+0x2643] onto the presentation node if it changed since the last bind. The helper drives node property 0x112 through vtable slots +0x130 and +0x14c with record size 0x20 and clears the local dirty byte at [this+0x263b]. | ghidra + rizin + llvm-objdump |
| 371 | 0x0054bb70 | 90 | layout_state_bind_vertex24_table | bootstrap | thiscall | inferred | ghidra-headless | 4 | Binds the current 24-byte vertex24 table at [this+0x2647] onto the presentation node if it changed since the last bind. The helper drives node property 0x142 through vtable slots +0x130 and +0x14c with record size 0x18 and clears the local dirty byte at [this+0x263b]. | ghidra + rizin + llvm-objdump |
| 372 | 0x0054bc10 | 592 | shell_init_layout_state_defaults | bootstrap | thiscall | inferred | ghidra-headless | 4 | Initializes the large subordinate layout-state object allocated by 0x0055e2b0; seeds default float and flag fields points [this+0x83c] at a shell-bundle template block near 0x006d4024+0x11468a optionally copies a 0x72c-byte preset table and notifies the shell bundle service at [0x006d4024+0x28]. | ghidra + rizin |
| 373 | 0x0054bea0 | 1399 | layout_state_apply_interpolated_pose | bootstrap | thiscall | inferred | ghidra-headless | 4 | Applies an interpolated pose and palette sample on the subordinate layout-state object using the controller counters passed by callers; clamps the time window blends preset tables at offsets 0x840 through 0x86f updates color bytes at 0x2510 through 0x2512 invokes the bound presentation node at [this+0x25df] and finishes through 0x0054a280. | ghidra + rizin |
| 374 | 0x0054e3a0 | 528 | shell_controller_window_message_dispatch | shell | stdcall | inferred | objdump | 4 | Primary window-message ingress for the active shell controller window. The dispatcher branches over low window lifecycle messages handles `WM_KEYDOWN` and `WM_KEYUP` by first updating the shell controller through 0x0051f0c0 or 0x0051f0d0 and then forwarding the transition into shell_input_apply_window_key_transition at 0x0054f290 on the shell input object rooted at 0x006d4018 routes `WM_COMMAND` through 0x0054eb10 routes mouse messages in the `0x0200..0x0208` family through 0x0054ee50 and falls back to `DefWindowProcA` for unhandled cases. This is the first grounded shell-side input ingest path rather than only a generic message drain. | objdump + import table + callsite inspection |
| 375 | 0x0054e5d0 | 88 | shell_drain_pending_window_messages | shell | cdecl | inferred | objdump + analysis-context | 4 | Shared pending-message drain that loops on `PeekMessageA` with remove mode 1 and feeds each dequeued record through `TranslateMessage` and `DispatchMessageA` until the queue is empty. Shell modal waits layout rebuild paths mouse-cursor frame work and the keyboard-toggle helpers all reuse this routine so it sits below the real input handlers rather than serving as the input dispatcher itself. | objdump + analysis-context + import table |
| 376 | 0x0054e710 | 110 | shell_input_state_init | shell | thiscall | inferred | objdump + analysis-context | 3 | Initializes the standalone shell input-state object later stored at 0x006d4018. It zeroes the 0xaa8-byte state block resets counters and flags under +0xa88 through +0xa9c caches host metrics through `GetSystemMetrics` and `GetDoubleClickTime` and clears the per-key state storage that later window-message handlers update. | objdump + analysis-context + import table |
| 377 | 0x0054f290 | 480 | shell_input_apply_window_key_transition | shell | thiscall | inferred | objdump + analysis-context | 4 | Normalizes one `WM_KEYDOWN` or `WM_KEYUP` transition for the shell input object at 0x006d4018. The helper samples `GetKeyboardState` optionally derives an ASCII byte through `ToAscii` updates the 256-byte per-key table starting at [this+0x100] and maps selected keyboard scan codes into packed modifier flags at [this+0xa8c]: 0x1d sets or clears bit 0x4 Control 0x2a sets or clears bit 0x2 Left Shift 0x36 sets or clears bit 0x1 Right Shift and 0x38 sets or clears bit 0x20 Alt. It then forwards the synthesized event record through 0x0054e9c0 for later shell consumers. The shell controller window dispatcher at 0x0054e3a0 is the grounded caller. | objdump + analysis-context + import table + callsite inspection |
| 378 | 0x0054f4d0 | 109 | shell_input_snapshot_dispatch_state | shell | thiscall | inferred | objdump + analysis-context | 3 | Captures one filtered snapshot of the current shell input object state into a 0x30-byte caller buffer while temporarily zeroing the nested-dispatch counter at [this+0xa90]. Several shell and cursor consumers use this as the read-side companion to shell_input_apply_window_key_transition optionally passing the snapshot through the callback hook stored at 0x006d4008 before consuming it. | objdump + analysis-context + caller xrefs |
| 379 | 0x0054f540 | 111 | shell_input_cursor_inside_active_view | shell | cdecl | inferred | objdump + analysis-context | 3 | Returns whether the current cursor position should count as being inside the active shell controller view. When controller byte [0x006d4024+0x114226] is already set it returns true immediately; otherwise it samples the host cursor through `GetCursorPos` converts it into client coordinates for the active controller window through `ScreenToClient` and checks that point against the current view bounds selected from the shell controller table at [0x006d4024+0x34] and [0x006d4024+0x11421e]. Current grounded callers are the mouse-cursor mode helper at 0x0053f450 and the shell camera action helper at 0x004e0780 which suggests later world-relative cursor work still reuses the same shell controller path rather than a separate gameplay-only input object. | objdump + analysis-context + import table + caller xrefs |
| 380 | 0x0054f640 | 83 | shell_step_global_presentation_phase_scalar | shell | cdecl | inferred | ghidra-headless | 2 | Steps the shared presentation-phase scalar stored at 0x00d93850 downward by a small constant then clamps the returned value against fixed lower-bound constants. Callout-marker world-anchor and other presentation helpers use this as a common time-varying scalar after one of the nearby setters has seeded the global phase. | ghidra + rizin + llvm-objdump |
| 381 | 0x0054f700 | 12 | shell_set_global_presentation_phase_scalar | shell | cdecl | inferred | ghidra-headless | 3 | Stores one caller-supplied float into the shared presentation-phase scalar at 0x00d93850. Mouse-cursor geographic-label and other presentation helpers seed this global before later batch or marker helpers consume it through 0x0054f640. | ghidra + rizin + llvm-objdump |
| 382 | 0x0054f710 | 729 | shell_queue_callout_segment_marker | shell | cdecl | inferred | ghidra-headless | 2 | Queues one short world-space callout segment or marker packet using the shell zoom table rooted at [0x006d4024+0x11421e] and [0x006d4024+0x34]. The helper derives scaled endpoint deltas from the caller inputs applies flag-controlled clamps from arg_14h and emits three type-0x01 deferred messages through shell_enqueue_deferred_message_type1. | ghidra + rizin + llvm-objdump |
| 383 | 0x0054f9f0 | 281 | shell_queue_callout_frame_segments | shell | cdecl | inferred | ghidra-headless | 4 | Builds a four-segment callout frame around one projected extent box. The helper samples the same shell zoom and reciprocal scale tables under 0x006d4024 computes the four box legs from the caller extent inputs and emits each side through shell_queue_callout_segment_marker. | ghidra + rizin + llvm-objdump |
| 384 | 0x0054fb10 | 699 | shell_queue_callout_leader_path | shell | cdecl | inferred | ghidra-headless | 3 | Builds one longer world-space callout leader path between two points. It derives slope and angle terms from the caller inputs recursively reuses itself or 0x0054f710 for shorter segments chooses style branches from distance and flag tests and enqueues the resulting type-0x01 deferred messages. shell_publish_text_callout_presentation uses this helper for text-associated leader geometry. | ghidra + rizin + llvm-objdump |
| 385 | 0x0054fdd0 | 256 | shell_queue_presentation_batch_pair | shell | cdecl | inferred | ghidra-headless | 2 | Queues a two-record presentation batch through the shell deferred-message path. One branch emits a single trailing type-0x04 record while the other brackets two type-0x04 payload posts with direct type-0x05 and type-0x06 begin-end records; both legs seed their animated scalar through shell_step_global_presentation_phase_scalar before routing through the shell bundle at 0x006d4024. | ghidra + rizin + llvm-objdump |
| 386 | 0x0054fed0 | 440 | shell_queue_presentation_batch_quad | shell | cdecl | inferred | ghidra-headless | 2 | Queues a four-record presentation batch through the same deferred-message family. It posts a type-0x05 begin record emits four type-0x04 payload records with refreshed phase scalars from shell_step_global_presentation_phase_scalar and finally closes the batch with a type-0x06 end record. The current high-level callers build this from four related point or extent tuples. | ghidra + rizin + llvm-objdump |
| 387 | 0x005519f0 | 902 | shell_publish_text_callout_presentation | shell | cdecl | inferred | ghidra-headless | 3 | Publishes one styled text or callout presentation payload through the active shell bundle at 0x006d4024. It accepts text placement and style inputs conditionally emits a leader path through 0x0054fb10 allocates backing text resources through 0x0051f0b0 and 0x00543c10 sets presentation flags from the mode arguments and finalizes the payload through 0x0051fc20. Geographic-label text and mouse-cursor presentation both feed this helper. | ghidra + rizin + llvm-objdump + strings |
| 388 | 0x00552160 | 56 | world_anchor_measure_projected_half_width | shell | cdecl | inferred | ghidra-headless | 3 | Measures one absolute projected half-width-like extent from the caller world-anchor object. It chooses the X or Z span depending on orientation byte [this+0x24] scales by the owner coefficients at +0x2e or +0x32 multiplies by local width scalar [this+0x1c] and returns the absolute result for later cursor or marker placement code. | ghidra + rizin + llvm-objdump |
| 389 | 0x005521a0 | 56 | world_anchor_measure_projected_half_height | shell | cdecl | inferred | ghidra-headless | 3 | Measures one absolute projected half-height-like extent from the caller world-anchor object. It chooses the complementary axis span using the same orientation byte [this+0x24] scales by owner coefficients at +0x2e or +0x32 multiplies by local height scalar [this+0x20] and returns the absolute result for later cursor or marker placement code. | ghidra + rizin + llvm-objdump |
| 390 | 0x005521e0 | 894 | world_anchor_project_screen_extent_pair | shell | cdecl | inferred | ghidra-headless | 3 | Projects one world-anchor object into a paired screen-space extent result. The helper samples the shell zoom table under 0x006d4024 computes integer-scaled axis spans from the anchor geometry converts them through multiple clamp or reciprocal stages and writes two output integers through the caller pointers before later marker builders use the results for anchor presentation sizing. | ghidra + rizin + llvm-objdump |
| 391 | 0x00552560 | 916 | shell_queue_world_anchor_marker | shell | cdecl | inferred | ghidra-headless | 3 | Builds one world-anchor marker packet from the caller point object and optional scale or style inputs. It samples anchor extents from the object fields converts them through 0x0053dde0 0x0053ddf0 and world_anchor_project_screen_extent_pair consults the shell zoom table rooted at [0x006d4024+0x11421e] and [0x006d4024+0x34] and finally enqueues one type-0x01 deferred message through shell_enqueue_deferred_message_type1. mouse_cursor_update_frame_state uses it for one branch of cursor world-relative presentation. | ghidra + rizin + llvm-objdump |
| 392 | 0x00552900 | 1304 | shell_queue_projected_world_anchor_quad | shell | cdecl | inferred | ghidra-headless | 3 | Builds one oriented projected quad around the caller world-anchor object. It derives four projected corner points from the anchor extents and orientation computes edge and diagonal lengths through 0x0051db80 samples the shared presentation phase through shell_step_global_presentation_phase_scalar refines screen-space bounds through world_anchor_project_screen_extent_pair and finally emits two type-0x04 deferred-message posts through shell_enqueue_deferred_message_type4. | ghidra + rizin + llvm-objdump |
| 393 | 0x00554d70 | 248 | billboard_item_build_anchor_point_cache | bootstrap | thiscall | inferred | ghidra-headless | 3 | Builds or refreshes the cached point list for one billboard item at [this+0x1dd]. When source points exist at [this+0x10] it transforms them through the owner object matrix near [this+0x0c]+0xce; otherwise it seeds a one-point fallback from the baked vector at [this+0xfe..0x106]. | ghidra + rizin + llvm-objdump |
| 394 | 0x00554e70 | 680 | shell_emit_ranked_sprite_billboard_item | bootstrap | thiscall | inferred | ghidra-headless | 4 | Emits one ranked sprite-billboard item into the current vertex24 span. The helper computes a distance-weighted fade against shell and world state stores the derived scalar at [item+0xdc] and then walks either the item's linked child list at [item+0x4] or the cached anchor list at [item+0x1dd] to write textured quad geometry through 0x005662a0. | ghidra + rizin + llvm-objdump |
| 395 | 0x00555740 | 49 | billboard_item_refresh_child_sprite_colors | bootstrap | thiscall | inferred | ghidra-headless | 3 | Refreshes packed child-sprite colors for one billboard item by iterating the linked child list at [this+0x4] recomputing each child color through 0x005554f0 and storing the 24-bit result at [child+0x70]. | ghidra + rizin + llvm-objdump |
| 396 | 0x00555780 | 1739 | sprite_billboard_spawn_particle_instance | bootstrap | thiscall | inferred | ghidra-headless | 4 | Builds one emitted sprite-billboard instance from the template item. It randomizes local offsets through fields [this+0x7c..0x90] optionally samples anchor points from the owner matrix or cached path data chooses atlas uv bounds from [this+0x110..0x124] applies scale and fade terms from [this+0x94..0x108] recomputes packed colors through 0x005554f0 and finalizes the instance through 0x00565e80 and 0x00565f40. | ghidra + rizin + llvm-objdump |
| 397 | 0x00555e50 | 1808 | sprite_billboard_update_particle_emitter | bootstrap | thiscall | inferred | ghidra-headless | 4 | Advances one sprite-billboard emitter template and spawns new instances through 0x00555780. The routine updates emitter clocks and travel bounds in [this+0x68..0xc8] applies burst or repeat controls through [this+0x1ed..0x1f9] walks up to [this+0x34] spawn lanes resolves anchor positions from cached or owner-derived points and refreshes the active emitter origin at [this+0xc0] and [this+0xc4]. | ghidra + rizin + llvm-objdump |
| 398 | 0x0055d430 | 6 | system_get_total_physical_memory_bytes | support | cdecl | inferred | ghidra-headless | 4 | Returns the cached total physical-memory byte count from the shared MEMORYSTATUS block at 0x00d9754c. The graphics preset bundle uses this value as one of its coarse runtime capability probes after the cache has been refreshed through GlobalMemoryStatus nearby. | ghidra + rizin + llvm-objdump |
| 399 | 0x0055d440 | 17 | system_refresh_available_physical_memory_bytes | support | cdecl | inferred | ghidra-headless | 4 | Refreshes the shared MEMORYSTATUS block at 0x00d97548 through GlobalMemoryStatus and returns the resulting available physical-memory byte count from dwAvailPhys. This is the active memory-availability probe companion to 0x0055d430. | ghidra + rizin + llvm-objdump + strings |
| 400 | 0x0055d460 | 81 | os_is_non_nt_platform | support | cdecl | inferred | ghidra-headless | 4 | Calls GetVersionExA and returns true only when the platform id is not VER_PLATFORM_WIN32_NT. The graphics preset bundle inverts this result into an NT-family capability flag before finalizing several display-runtime bytes under 0x006d4024. | ghidra + rizin + llvm-objdump + strings |
| 401 | 0x0055d8d0 | 138 | display_get_primary_adapter_descriptor | support | cdecl | inferred | ghidra-headless | 4 | Enumerates display devices through USER32.EnumDisplayDevicesA until it finds the primary adapter flag then copies the adapter DeviceString field into the global buffer at 0x00d97448 and returns that buffer. When enumeration fails it leaves the descriptor empty and still returns the same shared buffer pointer. The graphics preset matcher at 0x00484a60 consumes this descriptor text directly. | ghidra + rizin + llvm-objdump + strings |
| 402 | 0x005a0f70 | 209 | stream_cipher_xor_in_place | support | cdecl | inferred | rizin | 4 | Applies one stateful stream-cipher pass in place over the caller buffer in ECX for the caller byte count in EDX using the 0x102-byte cipher state block passed on the stack. The helper mutates the two state bytes at offsets `+0x100` and `+0x101` and uses the 0x100-byte permutation table at the start of the state block to XOR every byte in the buffer. Current grounded callers are the multiplayer transport text-stream receive and send paths. | rizin + llvm-objdump |
| 403 | 0x005a18a0 | 292 | string_copy_bounded_zerofill | support | cdecl | inferred | ghidra-headless | 4 | Shared bounded string-copy helper that copies up to count bytes from source to destination stops after the first NUL byte and zero-fills the remaining span before returning the destination pointer. The graphics preset matcher uses it to stage the primary adapter descriptor into a local probe buffer before substring token scans | ghidra + rizin + llvm-objdump |
| 404 | 0x00556620 | 305 | sprite_billboard_manager_reset | bootstrap | thiscall | inferred | ghidra-headless | 3 | Releases the shared sprite-billboard manager state including emitter slots at [this+0x10] queued templates at [this+0x18] and owned resource handles or containers before zeroing the manager pointers again. | ghidra + rizin + llvm-objdump |
| 405 | 0x00556770 | 420 | sprite_billboard_manager_init_pools | bootstrap | thiscall | inferred | ghidra-headless | 4 | Initializes the shared sprite-billboard manager when the shell first needs emitter templates. It allocates the long-lived emitter arrays and container objects at [this+0x10] [this+0x18] [this+0x8] [this+0x4] and [this+0x0] with a default capacity of 0xc350 slots unless the caller overrides it. | ghidra + rizin + llvm-objdump |
| 406 | 0x00556920 | 814 | sprite_billboard_init_emitter_template | bootstrap | thiscall | inferred | ghidra-headless | 4 | Initializes one sprite-billboard emitter template from optional source geometry color flags and atlas bounds. It copies source points or seeds a fallback anchor path stores owner position seeds default fade and timing fields across [this+0x94..0xd8] computes atlas uv steps from [this+0xe0..0xec] into [this+0x110..0x124] and optionally prewarms the spawn list through 0x00554ce0 when the caller flags request it. | ghidra + rizin + llvm-objdump |
| 407 | 0x00556c50 | 143 | sprite_billboard_manager_create_template_node | bootstrap | thiscall | inferred | ghidra-headless | 4 | Allocates or reuses one manager node then creates a fresh sprite-billboard template through 0x00556920 with flag 0x400 forced on. The helper stores the new template at [node+0x4] and queues the node into the manager container at [this+0x8]. | ghidra + rizin + llvm-objdump |
| 408 | 0x00556ce0 | 160 | sprite_billboard_manager_clone_template_node | bootstrap | thiscall | inferred | ghidra-headless | 4 | Looks up one existing manager node and either returns its current template or clones a new sprite-billboard template from it through 0x00556920. On the first clone path it prewarms the source template through 0x00554ce0 and then queues the new node into the manager container at [this+0x4]. | ghidra + rizin + llvm-objdump |
| 409 | 0x00556e10 | 54 | intrusive_queue_push_back | support | cdecl | inferred | ghidra-headless | 4 | Allocates one intrusive-queue node then appends the caller payload pointer to the tail of the container. The helper writes the payload at [node+0x00] links the previous tail through [node+0x04] and [tail+0x08] updates the head and tail slots when needed and increments the queued-node count at [this+0x0c]. | ghidra + rizin + llvm-objdump |
| 410 | 0x00556ef0 | 6 | intrusive_queue_rewind_iterator | support | cdecl | inferred | ghidra-headless | 4 | Resets one intrusive-queue iterator by copying the container head pointer at [this+0x00] into the current-iterator slot at [this+0x04]. The helper is reused broadly across shell presentation and gameplay container walkers before repeated next-node calls. | ghidra + rizin + llvm-objdump |
| 411 | 0x00556f00 | 19 | intrusive_queue_next_iterator_node | support | cdecl | inferred | ghidra-headless | 4 | Returns the current intrusive-queue iterator node from [this+0x04] then advances the iterator to the linked next pointer at [node+0x08]. When the iterator is exhausted it returns null without mutating any payload state. | ghidra + rizin + llvm-objdump |
| 412 | 0x00556f90 | 13 | intrusive_queue_peek_tail_payload | support | cdecl | inferred | ghidra-headless | 4 | Returns the payload pointer stored in the current tail node at [this+0x08]. When the container is empty it returns null without mutating the queue state. | ghidra + rizin + llvm-objdump |
| 413 | 0x00557010 | 159 | intrusive_queue_clear_owned_nodes | support | cdecl | inferred | ghidra-headless | 3 | Specialized intrusive-queue clear path for containers with an auxiliary owner or context pointer at [this+0x14]. It iterates the owned node chain through the queue iterator helpers releases nested payload state unlinks each node and decrements the queue count before returning to the outer container clear helper. | ghidra + rizin + llvm-objdump |
| 414 | 0x005570b0 | 80 | intrusive_queue_clear_and_release | support | cdecl | inferred | ghidra-headless | 4 | Clears and releases every node in one intrusive queue container. When [this+0x14] is present it routes through intrusive_queue_clear_owned_nodes; otherwise it walks the linked nodes directly releases them zeroes the head iterator and tail slots and resets the queued-node count at [this+0x0c]. | ghidra + rizin + llvm-objdump |
| 415 | 0x00559520 | 166 | surface_init_rgba_pixel_buffer | support | thiscall | inferred | ghidra-headless | 3 | Initializes or refreshes a small 0xec-byte RGBA pixel-buffer object from caller-supplied image data and dimensions. On first use it allocates the backing object through 0x0053b070 stores width and height at [this+0xa2] and [this+0xa6] seeds the inner surface through 0x00543980 and 0x00541970 then copies width*height*4 bytes from the source buffer before finalizing through 0x005438d0. Current callers use it from the PaintTerrain preview path and the Multiplayer.win map-preview branch. | ghidra + rizin + llvm-objdump + strings |
| 416 | 0x00565110 | 600 | shell_rebuild_layout_state_and_optional_texture_report | shell | thiscall | inferred | ghidra-headless | 3 | Rebuilds the active shell layout-state branch when the current mode requires a deeper reset and optionally publishes the texture budget report through 0x00527650. The routine checks the current layout mode through 0x00545e00 tears down and recreates layout-state services through 0x0055dd80 and 0x0055e2b0 optionally notifies global shell services and when the caller flag is set emits the report then commits one layout refresh step through 0x00545d60. | ghidra + rizin + llvm-objdump + strings |
| 417 | 0x0058bc90 | 23 | multiplayer_gamespy_route_set_extended_payload_callback | shell | thiscall | inferred | objdump | 3 | Tiny callback-slot helper for one GameSpy-style route object. It stores the caller callback pointer in `[route+0xa0]`, or in the default route singleton at `0x00629948` when `ecx` is null. The current grounded transport-side caller is multiplayer_transport_try_connect_status_route, which patches the status route's validated extended-payload callback slot to `0x597330` after route construction. | objdump |
| 418 | 0x0058c9b0 | 404 | multiplayer_gamespy_route_construct_and_seed_callback_vector | shell | thiscall | inferred | objdump | 3 | Constructs or replaces one 0x108-byte GameSpy-style route object and seeds its callback vector. The helper allocates the route object when the caller owner slot is non-null, copies two caller strings into the local route buffers at `+0x04` and `+0x44`, stores the supplied callback table across `[route+0x88]` through `[route+0x9c]`, records the owner context at `[route+0x104]`, initializes the route cookie state and recent-cookie ring, and explicitly zeroes the secondary callback slots `[route+0xa0]`, `[route+0xa4]`, and `[route+0xd4]` before any later patch-up. Current grounded callers are multiplayer_transport_try_connect_status_route and multiplayer_transport_try_connect_live_route through the wrapper at `0x58cc40` or the constructor directly. | objdump |
| 419 | 0x0058d7a0 | 55 | multiplayer_transport_set_local_name | shell | thiscall | inferred | ghidra-headless | 3 | Updates the local identity string stored in the session-event transport object. When the transport is already configured through [this+0x44] and the incoming name pointer is non-null and non-empty it copies up to 0x40 bytes into [this+0x04] clears byte [this+0x43] and then forwards the same name into the lower transport update path through 0x0058f330. | ghidra + rizin + llvm-objdump |
| 420 | 0x0058d830 | 40 | multiplayer_transport_disconnect | shell | thiscall | inferred | ghidra-headless | 3 | Disconnects the session-event transport object from its current live route. The helper flips the internal active state through 0x005965d0 and 0x005961b0 calls the shared teardown block at 0x0058d810 and finally clears byte [this+0x60] and the copied local name at [this+0xaf4]. | ghidra + rizin + llvm-objdump |
| 421 | 0x0058d860 | 59 | multiplayer_transport_release_worker_and_reset_runtime_state | shell | cdecl | inferred | rizin | 3 | Small runtime-reset wrapper for the outer session-event transport object. When the owned worker pointer at [this] is present it first tears that worker down through multiplayer_transport_worker_shutdown_gracefully then clears the worker pointer the configured flag byte at [this+0x04] the text-stream owner slots at [this+0x44] and [this+0x48] reruns 0x00593370 and the shared reset block at 0x0058d810 and finally clears the live route and deferred-runtime fields at [this+0x180c] [this+0x1810] and [this+0x1edc]. | rizin + llvm-objdump |
| 422 | 0x0058d8d0 | 143 | multiplayer_transport_service_frame | shell | cdecl | inferred | objdump + caller xrefs | 3 | Recurring service pump for the outer session-event transport object. When the transport is configured through `[this+0x44]` or `[this+0x48]` it first services one worker step through multiplayer_transport_service_worker_once on the owned worker at `[this]`; if deferred reset is armed at `[this+0x1edc]` and the outstanding-work count has reached zero it falls straight into the common reset path at `0x0058de50`. Otherwise it conditionally emits the keepalive text at `0x005e1c24` after roughly `0x493e0` ms of inactivity, services the deeper selector or route helpers through `0x00596210` and `0x00597380`, finalizes deferred reset when the work count at `[this+0x1808]` reaches zero, and finishes by forwarding the caller selector through `0x00592800`. Current grounded callers reach it through multiplayer_transport_flush_and_maybe_shutdown and the immediate-drain submission paths, which places it at the center of the shell-owned multiplayer transport cadence. | objdump + caller xrefs + strings |
| 423 | 0x0058c340 | 144 | multiplayer_gamespy_decode_triplet_control_payload | shell | cdecl | inferred | objdump | 3 | Decodes one length-coded three-part GameSpy control payload and re-emits it through the shared packet-field builder at `0x58c0c0`. The helper reads up to three bounded variable-length slices from the caller payload, then packages them as field classes `0`, `1`, and `2`. The current grounded caller is subtype `0` of multiplayer_gamespy_route_dispatch_inbound_packet's `0xfe 0xfd` switch. | objdump |
| 424 | 0x0058c5c0 | 60 | multiplayer_gamespy_build_backslash_query_response | shell | cdecl | inferred | objdump + strings | 3 | Builds one backslash-delimited GameSpy query reply into the caller buffer. It seeds the leading `\\`, emits three callback-driven field groups through `0x58c3e0` for selectors `0`, `1`, and `2`, appends the fixed terminator token at `0x005e1b6c`, and leaves the result ready for immediate send. The current grounded caller is the backslash-packet branch inside multiplayer_gamespy_route_dispatch_inbound_packet. | objdump + strings |
| 425 | 0x0058c600 | 142 | multiplayer_gamespy_dispatch_natneg_or_raw_callback | shell | cdecl | inferred | objdump + strings | 3 | Dispatches one validated extended GameSpy payload into route-owner callbacks. When the payload begins with the six-byte magic `fd fc 1e 66 6a b2` it treats bytes `[payload+6..+9]` as a little-endian value, materializes a small wrapper object through `0x5b31f8`, and forwards it through the route callback at `[route+0xa0]`; otherwise it falls back to the raw payload callback at `[route+0xa4]`. Both slots are optional: the helper tests them for null and returns without dispatch when the selected callback is absent. The current grounded caller is subtype `6` of multiplayer_gamespy_route_dispatch_inbound_packet. | objdump + strings |
| 426 | 0x0058c690 | 58 | multiplayer_gamespy_route_dedupe_recent_cookie | shell | cdecl | inferred | objdump | 3 | Maintains a small ring of the last ten 32-bit route cookies or packet ids under `[route+0xd8]` and `[route+0x100]`. It returns `1` when the caller id is already present and otherwise inserts it into the rotating slot table and returns `0`. The current grounded caller is subtype `6` of multiplayer_gamespy_route_dispatch_inbound_packet before dispatching the validated extended payload. | objdump |
| 427 | 0x0058c6d0 | 606 | multiplayer_gamespy_route_dispatch_inbound_packet | shell | cdecl | inferred | objdump + strings | 3 | Main inbound packet parser for one GameSpy-style route object. It sends semicolon-prefixed lines through the route callback at `[route+0xd4]`, but only when that slot is non-null; otherwise the semicolon branch returns without additional work. It treats backslash-prefixed packets as query requests and answers them by building a reply through multiplayer_gamespy_build_backslash_query_response, and otherwise requires at least seven bytes plus the `0xfe 0xfd` header before entering a subtype switch on byte `2`. The grounded subtype branches are now tighter: subtype `0` decodes a three-slice control payload through multiplayer_gamespy_decode_triplet_control_payload; subtype `1` copies one bounded NUL-terminated string through `0x58c030`; subtype `2` copies up to `0x20` raw bytes into the local packet builder as field class `5`; subtype `4` validates the four-byte route cookie at `[route+0x84]`, clears `[route+0xb0]`, and dispatches the remaining payload through the validated route callback at `[route+0x9c]`, which the transport-owned status and live routes seed to `0x5972c0`; subtype `6` validates the same cookie, emits a field-class `7` record with the next dword, dedupes that dword through multiplayer_gamespy_route_dedupe_recent_cookie, and then dispatches the trailing payload through multiplayer_gamespy_dispatch_natneg_or_raw_callback. In the currently grounded transport-owned status route, that extended callback layer is patched after construction so `[route+0xa0]` points at `0x597330`; the raw fallback slot `[route+0xa4]` remains unresolved and currently no-ops when null. Subtypes `3` and `5` currently fall through without additional work. The current grounded caller is multiplayer_gamespy_route_drain_inbound_packets. | objdump + strings |
| 428 | 0x0058cfd0 | 107 | multiplayer_gamespy_route_release_and_free | shell | thiscall | inferred | objdump | 3 | Common teardown helper for one GameSpy-style route object. When the route still looks live through `[route+0xb4]` it first sends the mode-`2` control frame through `0x58cd70`, closes the current route handle at `[route]` when needed through `0x58bc4e`, resets the handle and last-send timestamp fields, and finally frees the route object through `0x58f3c0` when it is not the default singleton at `0x00629840`. Current grounded callers are multiplayer_transport_release_status_route, multiplayer_transport_release_live_route, and the status-route reconnect path. | objdump |
| 429 | 0x0058ccd0 | 107 | multiplayer_gamespy_route_drain_inbound_packets | shell | cdecl | inferred | objdump + strings | 3 | Inbound packet drain for one GameSpy-style route object. While the route receive queue remains non-empty it pulls one datagram through `0x58bc7e`, routes the payload into `multiplayer_gamespy_route_dispatch_inbound_packet`, and then repeats. The parser accepts semicolon-prefixed lines through the route callback at `[route+0xd4]`, backslash-delimited key bundles, and `0xfe 0xfd` GameSpy control packets. The current grounded caller is the lower route-service helper at `0x58d040`. | objdump + strings |
| 430 | 0x0058cee0 | 164 | multiplayer_gamespy_route_service_retry_and_keepalive_timers | shell | cdecl | inferred | objdump + strings | 3 | Timer and retry side of one GameSpy-style route object. It checks the active route handle and challenge or retry fields around `[route+0xa8]`, `[route+0xac]`, and `[route+0xb0]`, emits outbound control traffic through the local send helper when the `master.gamespy.com` challenge or state flow stalls, raises the `No challenge value was received from the master server.` callback through `[route+0x9c]` after repeated failures, and periodically refreshes the auxiliary timestamp through `0x58c950`. The current grounded caller is the lower route-service helper at `0x58d040`, which makes this the timer or retry half of the recurring GameSpy route cadence. | objdump + strings |
| 431 | 0x0058d040 | 37 | multiplayer_gamespy_route_service_frame | shell | cdecl | inferred | objdump + strings | 3 | Low-level recurring service step for one GameSpy-style route object. When the route handle state at `[route+0xb4]` is live it first services retry and keepalive timers through `multiplayer_gamespy_route_service_retry_and_keepalive_timers` and then drains inbound packets through `multiplayer_gamespy_route_drain_inbound_packets`. Current grounded callers are `multiplayer_transport_service_status_and_live_routes`, which uses the same helper for both the auxiliary status route at `[transport+0xaf0]` and the current live route at `[transport+0x1ecc]`. | objdump + strings |
| 432 | 0x0058d960 | 7 | multiplayer_transport_select_status_route | shell | thiscall | inferred | ghidra-headless | 3 | Thin route-selector wrapper for the session-event transport. It forwards the requested small route id in EDX into multiplayer_transport_set_mode_q_flag which updates [this+0x560] formats the underlying `MODE %s -q` or `MODE %s +q` command text and reconfigures the transport-side callback plumbing. | ghidra + rizin + llvm-objdump |
| 433 | 0x0058d970 | 89 | multiplayer_transport_subscribe_field_callback_set | shell | thiscall | inferred | ghidra-headless | 3 | Registers one field-subscription callback set on the session-event transport. When the transport is active byte [this+0x60] is set it stores the caller metadata at [this+0x176c] and [this+0x1770] then forwards the field-id list string callback and context into multiplayer_transport_register_field_subscription_bundle; on failure it falls back through multiplayer_transport_enqueue_field_snapshot_record. | ghidra + rizin + llvm-objdump |
| 434 | 0x0058d9e0 | 55 | multiplayer_transport_send_selector_text | shell | thiscall | inferred | ghidra-headless | 3 | Sends one caller-supplied text pointer through a selector-specific transport slot. The helper looks up the selector entry from the handler table rooted at [this+0x390] and when both the text pointer and slot are valid forwards the string plus caller flag into the lower send helper at 0x0058e7e0 using the descriptor block at [this+0x80+selector*0x101]. | ghidra + rizin + llvm-objdump |
| 435 | 0x0058da60 | 75 | multiplayer_transport_register_selector_callback | shell | thiscall | inferred | ghidra-headless | 3 | Registers or dispatches one selector callback against the transport slot table rooted at [this+0x390]. When the selected slot is absent it directly invokes the supplied callback with mode -1 and null payloads; otherwise it packages the caller context on the stack and walks the registered slot through 0x00594ac0 using helper 0x0058da20. | ghidra + rizin + llvm-objdump |
| 436 | 0x0058db00 | 23 | multiplayer_transport_request_status_pump | shell | thiscall | inferred | ghidra-headless | 3 | Marks the session-event transport status path dirty by setting [this+0xb44] to 1 and then calling multiplayer_transport_service_status_pump when the transport is active. | ghidra + rizin + llvm-objdump |
| 437 | 0x0058db20 | 53 | multiplayer_transport_clear_status_pump | shell | thiscall | inferred | ghidra-headless | 3 | Clears the session-event transport status-pump flag at [this+0xb44] then reruns multiplayer_transport_service_status_pump. When the transport still owns the auxiliary object at [this+0xaf0] it follows up with either 0x00597370 or 0x00597350 depending on whether selector slot [this+0x398] is present. | ghidra + rizin + llvm-objdump |
| 438 | 0x0058db60 | 5 | multiplayer_transport_force_status_flush | shell | thiscall | inferred | ghidra-headless | 3 | Tail-call wrapper into 0x00597370 for the active session-event transport object. The shell flush path uses it immediately before multiplayer_transport_flush_and_maybe_shutdown. | ghidra + rizin + llvm-objdump |
| 439 | 0x0058dc30 | 22 | multiplayer_transport_is_route_mode_active_nonterminal | shell | cdecl | inferred | ghidra-headless | 3 | Tiny predicate over the route-mode field at [this+0x18b8]. It returns false when the mode is zero or terminal mode `5` and true for the other active route modes. Current grounded callers use it to decide whether route callbacks can run inline or whether route work must be re-enqueued. | ghidra + rizin + llvm-objdump |
| 440 | 0x0058de90 | 95 | multiplayer_transport_shutdown | shell | thiscall | inferred | ghidra-headless | 3 | Shuts down the session-event transport object and either marks deferred-close state or tears the object down immediately. It preserves [this+0x178c] across the common shutdown helper at 0x0058de50 disconnects active routes through multiplayer_transport_disconnect and when no outstanding work remains drops into the reset path at 0x0058d8a0; otherwise it latches deferred-close flag [this+0x1ee0]. | ghidra + rizin + llvm-objdump |
| 441 | 0x0058def0 | 40 | multiplayer_transport_flush_and_maybe_shutdown | shell | thiscall | inferred | ghidra-headless | 3 | Flushes the transport state through 0x0058d8d0 with selector -1 and when deferred-close flag [this+0x1ee0] is set and the outstanding-work count at [this+0x1808] has reached zero immediately falls into multiplayer_transport_shutdown. | ghidra + rizin + llvm-objdump |
| 442 | 0x0058df20 | 131 | multiplayer_transport_submit_text_record | shell | thiscall | inferred | ghidra-headless | 3 | Submits one prepared text record through the session-event transport using a caller-supplied callback wrapper. The helper allocates a transient transport record through multiplayer_transport_next_work_sequence sends it through multiplayer_transport_try_submit_text_record_fastpath and when that fast path declines packages the caller callback mode and payload into 0x00593170. When the caller requested immediate draining it also services the transport queue through 0x0058d8d0 and 0x0058d720 and may fall into multiplayer_transport_shutdown when deferred close is armed. | ghidra + rizin + llvm-objdump |
| 443 | 0x0058e100 | 230 | multiplayer_transport_publish_fixed_token_message | shell | thiscall | inferred | ghidra-headless | 3 | Publishes one fixed-token status message through selector `2` on the session-event transport. The helper requires the transport to be active and fully configured builds a formatted status line from the caller token plus internal fields such as [this+0x282] and [this+0x54] sends that line through multiplayer_transport_send_selector_text sets [this+0xb44] to 1 reruns the status pump and when appropriate nudges the downstream mode helper at 0x00595650 or the auxiliary object paths 0x00597350 and 0x00597370. | ghidra + rizin + llvm-objdump + strings |
| 444 | 0x0058e200 | 211 | multiplayer_transport_register_callback_table | shell | thiscall | inferred | ghidra-headless | 3 | Registers or refreshes the session-event transport callback table and descriptor block. When the transport is not yet fully configured it copies the local name into [this+0x04] stores the callback-table pointers at [this+0x4c] and [this+0x5c] sets [this+0x44] active and forwards the descriptor block plus caller metadata into multiplayer_transport_attach_callback_table_descriptor. It then routes the resolved table through multiplayer_transport_dispatch_callback_table_binding and optionally drains queued work through 0x0058d8d0 and 0x0058d720 before honoring deferred-close state. | ghidra + rizin + llvm-objdump |
| 445 | 0x0058e2e0 | 38 | multiplayer_transport_reset_and_maybe_shutdown | shell | thiscall | inferred | ghidra-headless | 3 | Resets the common transport state through 0x0058de50 and when deferred-close flag [this+0x1ee0] is armed and the outstanding-work count at [this+0x1808] has reached zero immediately falls into multiplayer_transport_shutdown. | ghidra + rizin + llvm-objdump |
| 446 | 0x0058e370 | 33 | multiplayer_transport_is_request_pending | shell | cdecl | inferred | ghidra-headless | 3 | Returns true while the caller transport request still appears in either the queued request collection at [this+0x550] or the secondary active-work collection checked through 0x0059c540. Immediate-drain callers use it as the loop predicate after pumping queued text and sleeping for 10 ms. | ghidra + rizin + llvm-objdump |
| 447 | 0x0058e3f0 | 137 | multiplayer_transport_drain_request_text_queue | shell | cdecl | inferred | ghidra-headless | 3 | Immediate-drain helper for one transport request. When request kind [req+0x20] is `1` it walks queued transport text lines under [this+0x1c] republishes them through 0x0059b790 and notifies the small observer table through 0x0058e310 until the queue is empty. When request kind `2` drains it also publishes `Disconnected`. Both paths refresh timeout state through 0x00598030 and finish by forwarding the request into 0x0059c470. | ghidra + rizin + llvm-objdump + strings |
| 448 | 0x0058e480 | 105 | multiplayer_transport_worker_shutdown_gracefully | shell | cdecl | inferred | rizin | 3 | Graceful shutdown wrapper for one multiplayer transport worker. If the callback object at `[this+0x538]` and its owner slot `[this+0x544]` are present it first emits a final owner notification through the callback vtable using fallback text at `0x005c87a8`. When the owned text-stream socket at `[this+0x1c]` is still live it appends `QUIT :Later!` through multiplayer_transport_text_stream_append_crlf_line and services one I/O step through multiplayer_transport_text_stream_service_io before destroying the registered-name store at `[this+0x548]`, the pending-template dispatch store at `[this+0x54c]`, the text-stream object at `[this+0x1c]`, and finally the worker backing block itself. | rizin + llvm-objdump + strings |
| 449 | 0x0058e4f0 | 12 | multiplayer_transport_service_worker_once | shell | cdecl | inferred | objdump | 3 | Very small bridge from the outer session-event transport object into its owned worker. It forwards the worker pointer in `[this]` into multiplayer_transport_drain_request_text_queue with a null request pointer, making it the one-step worker service helper used by the recurring transport pump. | objdump |
| 450 | 0x0058e650 | 80 | multiplayer_transport_sanitize_identifier | shell | cdecl | inferred | ghidra-headless | 4 | Normalizes a caller-supplied identifier string into the destination buffer by replacing leading punctuation and any later disallowed characters with underscores while preserving acceptable bytes from the source. Current grounded callers use it for the randomized `RT3Player%d` retry name and for locally submitted session-event text records. | ghidra + rizin + llvm-objdump + strings |
| 451 | 0x0058e6b0 | 98 | multiplayer_transport_set_mode_q_flag | shell | thiscall | inferred | ghidra-headless | 4 | Updates the transport mode-q flag tracked at [this+0x560]. When the requested value changes it formats either `MODE %s -q` or `MODE %s +q` against the active name buffer at [this+0x36c] stores the new flag and for mode `0` refreshes the downstream callback plumbing through 0x0059e070 and 0x0059de00 using helper 0x0058e6a0. | ghidra + rizin + llvm-objdump + strings |
| 452 | 0x0058e8c0 | 37 | multiplayer_transport_publish_topic_status_line | shell | thiscall | inferred | ghidra-headless | 3 | Formats and publishes one `TOPIC %s :%s` status line through the active transport text buffer at [this+0x1c]. When the caller text is null it falls back to the shared empty sample at 0x005c87a8. Current grounded caller is multiplayer_transport_handle_names_query_response. | ghidra + rizin + llvm-objdump + strings |
| 453 | 0x0058e8f0 | 56 | multiplayer_transport_publish_mode_key_status_line | shell | thiscall | inferred | ghidra-headless | 3 | Formats and publishes one mode-key status line through the active transport text buffer at [this+0x1c]. Depending on the caller flag it emits either `MODE %s +k %s` or `MODE %s -k %s`. Current grounded caller is multiplayer_transport_handle_bound_route_request. | ghidra + rizin + llvm-objdump + strings |
| 454 | 0x0058e930 | 53 | multiplayer_transport_publish_mode_level_status_line | shell | thiscall | inferred | ghidra-headless | 3 | Formats and publishes one mode-level status line through the active transport text buffer at [this+0x1c]. Depending on whether the caller level value is nonzero it emits either `MODE %s +l %d` or `MODE %s -l`. Current grounded caller is multiplayer_transport_handle_names_query_response. | ghidra + rizin + llvm-objdump + strings |
| 455 | 0x0058e970 | 36 | multiplayer_transport_invoke_registered_name_query_callback | shell | cdecl | inferred | ghidra-headless | 3 | Small callback shim used by the registered-name fast path. It loads the caller callback object from the dispatch frame and invokes its entry method with success flag `1`; the queried sample string; and the collected callback-entry arrays produced by multiplayer_transport_collect_registered_name_callback_entries. | ghidra + rizin + llvm-objdump |
| 456 | 0x0058e9a0 | 177 | multiplayer_transport_submit_names_query_with_callback | shell | thiscall | inferred | ghidra-headless | 3 | Builds and submits one `NAMES %s` query against the active transport text buffer at [this+0x1c]. When the caller sample is already present it bypasses transport submission through multiplayer_transport_dispatch_registered_name_query_fastpath. Otherwise it validates the sample through multiplayer_transport_has_registered_name packages the request through multiplayer_transport_enqueue_names_query_record and when immediate draining is requested loops through multiplayer_transport_drain_request_text_queue system_sleep_milliseconds and multiplayer_transport_is_request_pending. Current grounded callers are multiplayer_transport_handle_bound_route_request and multiplayer_transport_handle_selector_text_route_request. | ghidra + rizin + llvm-objdump + strings |
| 457 | 0x0058eb70 | 212 | multiplayer_transport_append_getkey_command | shell | cdecl | inferred | rizin | 3 | Formats one `GETKEY %s %s 0 :` command into a temporary 0x200-byte stack buffer and appends it to the owned transport text stream through multiplayer_transport_text_stream_append_crlf_line. After the fixed header it walks the caller string-vector argument and appends each additional item separated by backslashes. Current grounded caller is the synchronous submit wrapper at 0x0058ec50. | rizin + llvm-objdump + strings |
| 458 | 0x0058ec50 | 140 | multiplayer_transport_submit_getkey_command_and_wait | shell | cdecl | inferred | rizin | 3 | Synchronous `GETKEY` submit wrapper for the multiplayer transport worker. It resolves the query name from the caller string or falls back to [this+0x36c] primes one transient request through 0x0058eb30 emits the command text through multiplayer_transport_append_getkey_command and then loops through multiplayer_transport_drain_request_text_queue system_sleep_milliseconds and multiplayer_transport_is_request_pending until the request completes. | rizin + llvm-objdump + strings |
| 459 | 0x0058ece0 | 197 | multiplayer_transport_append_setchankey_or_setckey_command | shell | cdecl | inferred | rizin | 3 | Formats either `SETCHANKEY %s :` or `SETCKEY %s %s :` into a temporary 0x200-byte stack buffer and appends the resulting line to the owned transport text stream through multiplayer_transport_text_stream_append_crlf_line. The two-token `SETCKEY` form is selected when the optional caller key string at arg_210h is present and non-empty; otherwise the helper emits the simpler channel-key form. | rizin + llvm-objdump + strings |
| 460 | 0x0058edb0 | 367 | multiplayer_transport_append_setchankey_pair_list_command | shell | cdecl | inferred | rizin | 2 | Builds one larger backslash-delimited channel-key payload and appends it to the owned transport text stream through multiplayer_transport_text_stream_append_crlf_line. The helper formats normalized `\\%s\\%s` pair fragments in a 0x200-byte stack buffer converts backslashes to forward slashes in one staging path handles wildcard samples through the `*` token at 0x005e1e1c and is the main text builder beneath the synchronous submit wrapper at 0x0058ef20. | rizin + llvm-objdump + strings |
| 461 | 0x0058ef20 | 199 | multiplayer_transport_submit_setchankey_pair_list_command_and_wait | shell | cdecl | inferred | rizin | 2 | Synchronous channel-key submit wrapper for the multiplayer transport worker. It primes one transient request through 0x0058eb30 emits the larger backslash-delimited key payload through multiplayer_transport_append_setchankey_pair_list_command dispatches the caller result path through 0x005983b0 or 0x005984c0 depending on the staged optional arguments and then loops through multiplayer_transport_drain_request_text_queue system_sleep_milliseconds and multiplayer_transport_is_request_pending until the request completes. | rizin + llvm-objdump + strings |
| 462 | 0x0058eff0 | 78 | multiplayer_transport_is_valid_nick_string | shell | cdecl | inferred | rizin | 4 | Validates one transport nick string. It rejects null or empty strings rejects a leading digit or `-` through 0x005a53f2 and then scans every remaining byte against the allowed nick-character table at 0x005e1c70. It returns 1 when the full string is acceptable and 0 otherwise. | rizin + llvm-objdump + strings |
| 463 | 0x0058f040 | 90 | multiplayer_transport_dispatch_or_release_callback_binding | shell | cdecl | inferred | rizin | 3 | Generic dispatcher for one optional transport callback-binding structure. When binding field [this+0x0c] is present it packages the caller mode from EDX together with binding fields [this+0x18] and [this+0x36c] into opcode 0x1a through 0x0059b790. Otherwise it clears [this+0x04] and if callback pointer [this+0x14] is installed invokes it directly with the owner cookie at [this+0x18] and a zero status value. | rizin + llvm-objdump + strings |
| 464 | 0x0058f380 | 64 | tracked_heap_alloc_with_header | support | cdecl | inferred | ghidra-headless | 4 | Allocates one caller-sized heap block through the shared allocator at 0x005a125d stores the payload size in a 4-byte header immediately before the returned pointer and updates the global allocation counters at 0x00dba4c8 through 0x00dba4d0. Callers treat the returned value as a payload pointer just past the size header. | rizin + llvm-objdump |
| 465 | 0x0058f3c0 | 43 | tracked_heap_free_with_header | support | cdecl | inferred | ghidra-headless | 4 | Releases one heap block previously returned by tracked_heap_alloc_with_header. It reads the stored payload size from the 4-byte header decrements the shared allocation counters at 0x00dba4c8 and 0x00dba4cc and frees the underlying base pointer through 0x005a1145. | rizin + llvm-objdump |
| 466 | 0x0058f3f0 | 94 | tracked_heap_resize_with_header | support | cdecl | inferred | ghidra-headless | 4 | Resizes one header-tracked heap block to a new payload size. Null plus nonzero size falls through to tracked_heap_alloc_with_header; nonnull plus zero size frees through tracked_heap_free_with_header; and the main path reallocates through 0x005a5922 while preserving and re-accounting the payload size tracked in the 4-byte header. | rizin + llvm-objdump |
| 467 | 0x0058f460 | 8 | system_sleep_milliseconds | support | cdecl | inferred | ghidra-headless | 4 | Tiny wrapper over `Sleep` that forwards the caller millisecond delay in `ecx`. Current grounded callers use it as the 10 ms backoff inside immediate transport-drain loops. | rizin + llvm-objdump |
| 468 | 0x005928a0 | 189 | multiplayer_transport_enqueue_opcode_record | shell | cdecl | inferred | ghidra-headless | 3 | Common allocator and queue-submit helper for session-event transport opcode records. It allocates a zeroed caller-sized record through tracked_heap_alloc_with_header invokes the opcode-specific initializer from the handler table at 0x005e2004 plus opcode times 0x10 packages the resulting payload together with caller metadata into 0x0059e4d0 and increments [this+0x1800] on success. Allocation or initializer failure releases the temporary record through tracked_heap_free_with_header and returns -1. | ghidra + rizin + llvm-objdump |
| 469 | 0x00592a40 | 40 | multiplayer_transport_dispatch_callback_table_binding | shell | cdecl | inferred | ghidra-headless | 2 | Small binding-dispatch wrapper over multiplayer_transport_enqueue_opcode_record with opcode `4`. Current grounded callers use it after preparing callback-table descriptor fields from a live transport registration object and then continue through the common transport cleanup or release path. | ghidra + rizin + llvm-objdump |
| 470 | 0x00592a70 | 109 | multiplayer_transport_probe_or_enqueue_route_record | shell | cdecl | inferred | ghidra-headless | 2 | Small route-probe wrapper over multiplayer_transport_enqueue_opcode_record. It first calls multiplayer_transport_is_route_mode_active_nonterminal and when that succeeds with caller mode `2` directly invokes the supplied callback; otherwise it falls back to an 0x08-byte opcode `1` record built from the caller callback and payload fields. | ghidra + rizin + llvm-objdump |
| 471 | 0x00592ae0 | 111 | multiplayer_transport_enqueue_descriptor_block_record | shell | cdecl | inferred | ghidra-headless | 2 | Copies one caller-supplied seven-dword descriptor block into a local buffer and enqueues it through multiplayer_transport_enqueue_opcode_record as a 0x1c-byte opcode `2` record. Current grounded callers come from the deeper callback-table registration path. | ghidra + rizin + llvm-objdump |
| 472 | 0x00592b50 | 226 | multiplayer_transport_enqueue_field_snapshot_record | shell | cdecl | inferred | ghidra-headless | 3 | Builds and enqueues one field-snapshot transport record through multiplayer_transport_enqueue_opcode_record using opcode `3` and a 0x14-byte payload. Depending on the caller mode it can first remove prior matching entries through 0x005929f0 then normalizes the `hostname` field against `(No Name)` samples the `gamemode` field and compares it against `openstaging` computes a 0 to 100 progress scalar from counters around [this+0x1734] [this+0x1740] and [this+0x1774] and packages the subscribed callback pointers from [this+0x176c] and [this+0x1770]. | ghidra + rizin + llvm-objdump + strings |
| 473 | 0x00592c40 | 54 | multiplayer_transport_enqueue_callback_binding_record | shell | cdecl | inferred | ghidra-headless | 2 | Builds and enqueues one 0x08-byte opcode `4` callback-binding record through multiplayer_transport_enqueue_opcode_record. The helper uses the registered callback-table pointer at [this+0x4c] and is the direct worker beneath multiplayer_transport_dispatch_callback_table_binding. | ghidra + rizin + llvm-objdump |
| 474 | 0x00592c80 | 80 | multiplayer_transport_enqueue_callback_slot9_record | shell | cdecl | inferred | ghidra-headless | 2 | Gated callback-slot wrapper that enqueues one 0x10-byte opcode `9` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x1790] is set. The record is built around the callback-side state rooted near [this+0x17f8]. | ghidra + rizin + llvm-objdump |
| 475 | 0x00592cd0 | 85 | multiplayer_transport_enqueue_callback_slot10_record | shell | cdecl | inferred | ghidra-headless | 2 | Gated callback-slot wrapper that enqueues one 0x14-byte opcode `10` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x1794] is set. The record is built around the callback-side state rooted near [this+0x17f8]. | ghidra + rizin + llvm-objdump |
| 476 | 0x00592d30 | 62 | multiplayer_transport_enqueue_callback_slot11_record | shell | cdecl | inferred | ghidra-headless | 2 | Gated callback-slot wrapper that enqueues one 0x04-byte opcode `11` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x1798] is set. The record is built around the callback-side state rooted near [this+0x17f8]. | ghidra + rizin + llvm-objdump |
| 477 | 0x00592d70 | 77 | multiplayer_transport_enqueue_callback_slot12_record | shell | cdecl | inferred | ghidra-headless | 2 | Gated callback-slot wrapper that copies a caller-supplied seven-dword block and enqueues it as a 0x20-byte opcode `12` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x179c] is set. The record is built around the callback-side state rooted near [this+0x17f8]. | ghidra + rizin + llvm-objdump |
| 478 | 0x00592dc0 | 72 | multiplayer_transport_enqueue_callback_slot13_record | shell | cdecl | inferred | ghidra-headless | 2 | Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `13` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a0] is set. The record is built around the callback-side state rooted near [this+0x17f8]. | ghidra + rizin + llvm-objdump |
| 479 | 0x00592e10 | 72 | multiplayer_transport_enqueue_callback_slot14_record | shell | cdecl | inferred | ghidra-headless | 2 | Gated callback-slot wrapper that enqueues one 0x10-byte opcode `14` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a4] is set. The record is built around the callback-side state rooted near [this+0x17f8]. | ghidra + rizin + llvm-objdump |
| 480 | 0x00592ee0 | 62 | multiplayer_transport_enqueue_callback_slot17_record | shell | cdecl | inferred | objdump | 2 | Gated callback-slot wrapper that enqueues one 0x08-byte opcode `17` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17b0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is the current-selector profile-key callback root at `0x59f8b0`, which submits one profile-key bundle and then forwards the same selector context through this owner-callback lane. | objdump + caller xrefs |
| 481 | 0x00592f20 | 69 | multiplayer_transport_enqueue_callback_slot18_record | shell | cdecl | inferred | objdump | 2 | Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `18` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17b4]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. | objdump |
| 482 | 0x00592f70 | 72 | multiplayer_transport_enqueue_callback_slot19_record | shell | cdecl | inferred | objdump | 2 | Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `19` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17b8]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is one selector-view callback-table branch at `0x59f850`, which resets selector-side state and then forwards the same selector-name pair through this owner-callback lane. | objdump + caller xrefs |
| 483 | 0x00592fc0 | 50 | multiplayer_transport_enqueue_callback_slot20_record | shell | cdecl | inferred | objdump | 2 | Gated callback-slot wrapper that enqueues one 0x04-byte opcode `20` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17bc]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. | objdump |
| 484 | 0x00593000 | 69 | multiplayer_transport_enqueue_callback_slot21_record | shell | cdecl | inferred | objdump | 2 | Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `21` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17c0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. | objdump |
| 485 | 0x00593050 | 77 | multiplayer_transport_enqueue_callback_slot22_record | shell | cdecl | inferred | objdump | 3 | Gated callback-slot wrapper that enqueues one 0x10-byte opcode `22` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17c4]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. Current grounded callers are the per-key profile callback helper at `0x596970`, which forwards one selector name plus the parsed `X...X|%d` marker pair or a zeroed `(END)` sentinel payload, and the same helper's sibling path at `0x596a45`, which republishes the currently armed selector-view probe tuple. | objdump + caller xrefs |
| 486 | 0x005930a0 | 50 | multiplayer_transport_enqueue_callback_slot23_record | shell | cdecl | inferred | objdump | 2 | Gated callback-slot wrapper that enqueues one 0x04-byte opcode `23` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x178c]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is the callback root at `0x59f5c0`, which first arms deferred-close state at `[this+0x1edc]`. | objdump + caller xrefs |
| 487 | 0x005930e0 | 62 | multiplayer_transport_enqueue_callback_slot24_record | shell | cdecl | inferred | objdump | 3 | Gated callback-slot wrapper that enqueues one 0x08-byte opcode `24` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17cc]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is multiplayer_transport_commit_selector_view_refresh_probe_success, which forwards the selector-view entry pointer together with the current averaged probe sample through this owner-callback lane. | objdump + caller xrefs |
| 488 | 0x00593120 | 72 | multiplayer_transport_enqueue_callback_slot25_record | shell | cdecl | inferred | objdump | 2 | Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `25` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17d0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is one selector-view callback-table branch at `0x59f560`, which first updates selector-view runtime state through `0x5948f0` and then forwards the same selector-name pair through this owner-callback lane. | objdump + caller xrefs |
| 489 | 0x00592e60 | 64 | multiplayer_transport_enqueue_callback_slot15_record | shell | cdecl | inferred | ghidra-headless | 2 | Gated callback-slot wrapper that enqueues one 0x08-byte opcode `15` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a8] is set. The record is built around the callback-side state rooted near [this+0x17f8]. | ghidra + rizin + llvm-objdump |
| 490 | 0x00592ea0 | 64 | multiplayer_transport_enqueue_callback_slot16_record | shell | cdecl | inferred | ghidra-headless | 2 | Gated callback-slot wrapper that enqueues one 0x08-byte opcode `16` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17ac] is set. The record is built around the callback-side state rooted near [this+0x17f8]. | ghidra + rizin + llvm-objdump |
| 491 | 0x0059f2e0 | 64 | multiplayer_transport_is_selector_control_line | shell | cdecl | inferred | objdump | 2 | Small selector-text classifier used in the second callback descriptor lane. It returns true only when the caller string is at least four bytes long and begins with `@@@` but not `@@@ `, which makes it the current gate between control-line handling and the ordinary selector-name callback lanes. | objdump + caller xrefs + strings |
| 492 | 0x0059f320 | 131 | multiplayer_transport_split_selector_payload_token_and_tail | shell | cdecl | inferred | objdump | 2 | Splits one selector payload string at the first space into the two shared scratch buffers `0x00db9dd0` and `0x00db9dd8`. Current grounded callers are the mode-`3/4` selector callback helpers at `0x59f650` and `0x59f720`, which use that token-plus-tail pair as the payload for callback slots `14` and `10`. | objdump + caller xrefs + strings |
| 493 | 0x0059f5e0 | 111 | multiplayer_transport_sync_selector_view_nfo_r_flag | shell | cdecl | inferred | objdump | 3 | Local `@@@NFO` helper shared by the selector callback lanes at `0x59f650` and `0x59f720`. It only accepts control lines ending in the literal tail `X\\`, searches the same line for the field marker `\\$flags$\\`, and then sets or clears bit `0x2` in the selector-view entry flag word at `[entry+0x64]` depending on whether the following flag segment contains the letter `r` before the next backslash. The current grounded entry gate is `[entry+0x48]`, so this path is specific to selector entries that participate in the third selector slot. | objdump + caller xrefs + strings |
| 494 | 0x00593460 | 87 | multiplayer_transport_mark_selector_slot_records_stale | shell | cdecl | inferred | ghidra-headless | 3 | Scans the queued transport request collection at [this+0x1780] for records of type `1` or `2` whose selector-slot field at +0x1c matches the requested slot id. Matching records are marked stale by setting byte or dword field +0x38 to one. Current grounded caller is multiplayer_transport_reset_selector_slot. | ghidra + rizin + llvm-objdump |
| 495 | 0x00593790 | 351 | multiplayer_transport_handle_names_query_response | shell | cdecl | inferred | ghidra-headless | 3 | Completion callback for multiplayer_transport_submit_names_query_with_callback. If the request is already stale at +0x38 it just unlinks through 0x5933a0. On nonzero result it can update route-binding state through multiplayer_transport_is_route_mode_active_nonterminal and multiplayer_transport_try_connect_status_route_once seeds selector slot `2` through multiplayer_transport_init_selector_slot upserts returned name records through multiplayer_transport_upsert_selector_name_entry publishes `TOPIC` and `MODE` lines through multiplayer_transport_publish_topic_status_line and multiplayer_transport_publish_mode_level_status_line and may promote one deferred route binding into [this+0x1ec8]. On zero result it resets selector slot `2` and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request. | ghidra + rizin + llvm-objdump + strings |
| 496 | 0x005938f0 | 145 | multiplayer_transport_handle_bound_route_request | shell | cdecl | inferred | ghidra-headless | 3 | Completion callback for multiplayer_transport_submit_bound_route_request. If the request is already stale at +0x38 it just unlinks through 0x5933a0. On nonzero result it can publish [req+0x24] through multiplayer_transport_publish_mode_key_status_line and then schedules multiplayer_transport_handle_names_query_response through multiplayer_transport_submit_names_query_with_callback. On zero result it resets selector slot `2` and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request. | ghidra + rizin + llvm-objdump |
| 497 | 0x00594620 | 106 | multiplayer_transport_reset_selector_view_entry_runtime_state | shell | cdecl | inferred | objdump | 2 | Clears the extended runtime fields of one selector-view entry. When the transport-side selector-view layer is present through `[this+0xac8]` it zeroes the entry block from `+0x68` through `+0xa8`, including the dirty or refresh flags at `+0xa0`, `+0xa4`, and `+0xa8`, then returns success. Current grounded caller is the selector-view snapshot export path at `0x594ee0`. | objdump |
| 498 | 0x00594690 | 76 | multiplayer_transport_mark_selector_slot_views_dirty | shell | cdecl | inferred | ghidra-headless | 2 | Marks one selector slot dirty in the transport-side selector-view layer rooted at `[this+0xab4]` with backing arrays around `[this+0xad0]..[this+0xae4]`. It sets slot-specific dirty bits at `+0xa0` and `+0xa4` when the matching backing arrays are populated and also sets `+0xa8` for selector slot `2`. Current grounded callers are multiplayer_transport_set_selector_slot_flags and multiplayer_transport_upsert_selector_name_entry. | ghidra + rizin + llvm-objdump |
| 499 | 0x005949a0 | 80 | multiplayer_transport_ensure_selector_view_store | shell | thiscall | inferred | objdump | 3 | Ensures the keyed selector-view store used by the multiplayer transport. When the gate at `[this+0xab0]` is clear it allocates a `0xac`-byte keyed container through `0x58faf0`, stores the resulting root at `[this+0xab4]`, and resets the three per-slot generation counters at `[this+0xab8]`, `[this+0xabc]`, and `[this+0xac0]`. Current grounded callers are the transport setup and reset path around `0x58d7ee`. | objdump + caller xrefs |
| 500 | 0x005949f0 | 56 | multiplayer_transport_release_selector_view_store | shell | thiscall | inferred | objdump | 3 | Releases the keyed selector-view store used by the multiplayer transport. When the gate at `[this+0xab0]` is clear it frees the root at `[this+0xab4]` through `0x58f8b0`, clears that root, and resets the three per-slot generation counters at `[this+0xab8]`, `[this+0xabc]`, and `[this+0xac0]`. Current grounded callers are the transport teardown path around `0x58d81a`. | objdump + caller xrefs |
| 501 | 0x00594a40 | 80 | multiplayer_transport_find_selector_view_entry_by_name | shell | cdecl | inferred | objdump | 3 | Looks up one selector-view entry by its bounded name string. It copies up to `0x40` bytes of the caller key into a local buffer, then probes the keyed selector-view store rooted at `[this+0xab4]` through `0x58f9c0` and returns the matching entry pointer or null. Current grounded callers include multiplayer_transport_set_selector_slot_flags, multiplayer_transport_merge_selector_mode_mask, multiplayer_transport_upsert_selector_name_entry, and several later selector-view formatting helpers. | objdump + caller xrefs |
| 502 | 0x00594d50 | 28 | multiplayer_transport_selector_view_entry_slot_has_presence_mask | shell | cdecl | inferred | objdump | 3 | Small selector-view predicate over one slot-local flag dword. When the requested slot has a live pointer at `[entry+0x40+slot*4]`, it returns whether the paired slot flag word at `[entry+0x5c+slot*4]` carries either presence bit `0x20` or `0x40`. Current grounded caller is multiplayer_transport_filter_insert_refreshable_selector_view_entry, which uses slot `2` to bias entry ordering and dedupe inside the periodic refreshable-entry collector. | objdump + caller xrefs |
| 503 | 0x00594d70 | 21 | multiplayer_transport_selector_view_entry_has_gml_disconnect_gate | shell | cdecl | inferred | objdump | 3 | Tiny selector-view predicate used only in the current grounded `GML` control path. It returns nonzero only when the selector-view entry participates in the third selector slot through `[entry+0x48]` and bit `0x20` is set in the entry flag word at `[entry+0x64]`. The current grounded caller is multiplayer_transport_handle_gml_or_png_selector_control, where it gates the `GML Disconnected` branch before the transport forces one status-pump pass, emits callback slot `16`, and re-enters route mode `5`. | objdump + caller xrefs + strings |
| 504 | 0x0059f5c0 | 20 | multiplayer_transport_callback_arm_deferred_close_and_enqueue_slot23 | shell | cdecl | inferred | objdump | 2 | Small callback-root helper installed through the transport-side callback descriptor table at `0x59f5c0`. It takes the owner transport pointer from the first stack argument, sets deferred-close latch `[this+0x1edc]` to one, and then forwards into multiplayer_transport_enqueue_callback_slot23. | objdump + caller xrefs |
| 505 | 0x00594150 | 65 | multiplayer_transport_schedule_selector_view_entry_refresh_probe | shell | cdecl | inferred | objdump | 3 | Arms one deferred refresh probe for a selector-view entry when no probe is already pending at `[entry+0x74]`. It schedules callback `0x594110` after `0x1388` ms, latches the pending flag at `[entry+0x74]`, stores the current tick count at `[entry+0x68]`, and clears the entry-local transient field at `[entry+0xa8]`. The current grounded caller is the periodic selector-view service path at `0x594540`. | objdump + caller xrefs |
| 506 | 0x005941a0 | 376 | multiplayer_transport_filter_insert_refreshable_selector_view_entry | shell | cdecl | inferred | objdump | 3 | Store-walk callback used by the periodic selector-view service path. It filters one selector-view entry before insertion into a temporary refresh list: the entry must have local backing at `[entry+0xa0]`, live state at `[entry+0x58]`, no pending probe at `[entry+0x74]`, and no blocker at `[entry+0x4c]`; if slot pointers `[entry+0x40]`, `[entry+0x44]`, or `[entry+0x48]` are present, the corresponding slot flag words `[entry+0x5c]`, `[entry+0x60]`, and `[entry+0x64]` must not carry mask `0x0c`, which matches the `g`/`a` bits produced by multiplayer_transport_parse_selector_mode_letters. Eligible entries then pass slot-aware retry timing based on `[entry+0x68]`, `[entry+0x6c]`, `[entry+0x78]`, and `[entry+0x7c]`, after which the helper inserts the entry into the caller list while biasing third-slot entries through multiplayer_transport_selector_view_entry_slot_has_presence_mask and name comparisons. | objdump + caller xrefs + existing slot-flag map |
| 507 | 0x00594320 | 115 | multiplayer_transport_collect_refreshable_selector_view_entries | shell | cdecl | inferred | objdump | 3 | Collects a bounded list of refreshable selector-view entries from the keyed selector-view store rooted at `[this+0xab4]`. It clears the caller count to at most `0x0c` entries, walks the store through callback `0x5941a0`, and returns the finished temporary entry pointer list. The current grounded caller is the periodic selector-view service path at `0x594540`, which then schedules deferred refresh probes for the collected entries. | objdump + caller xrefs |
| 508 | 0x005940d0 | 61 | multiplayer_transport_finish_selector_view_refresh_probe_if_matching | shell | cdecl | inferred | objdump | 3 | Probe-completion callback used by the deferred selector-view refresh path. When the entry still has a pending probe at `[entry+0x74]`, live selector-view state at `[entry+0x58]`, and the callback request id matches `[entry+0x50]`, it clears the pending latch. Result `-1` increments the consecutive-failure counter at `[entry+0x7c]`; any other result forwards the returned payload pointer into multiplayer_transport_commit_selector_view_refresh_probe_success. | objdump + caller xrefs |
| 509 | 0x00594110 | 48 | multiplayer_transport_dispatch_selector_view_refresh_probe_result | shell | cdecl | inferred | objdump | 3 | Deferred callback shim for selector-view refresh probes. It walks the keyed selector-view store at `[transport+0xab4]` and runs multiplayer_transport_finish_selector_view_refresh_probe_if_matching against each entry using the completed request descriptor on the stack. Current grounded caller is multiplayer_transport_schedule_selector_view_entry_refresh_probe. | objdump + caller xrefs |
| 510 | 0x00593f00 | 171 | multiplayer_transport_commit_selector_view_refresh_probe_success | shell | cdecl | inferred | objdump | 3 | Success path for one selector-view refresh probe. It increments the probe-success generation at `[entry+0x78]`, clears the consecutive-failure counter at `[entry+0x7c]`, stamps the last-success tick at `[entry+0x6c]`, writes the returned sample value into the rolling history at `[entry+0x84..]`, grows the bounded sample-count at `[entry+0x94]` up to four, computes the current average into `[entry+0x80]`, increments total-success count `[entry+0x98]`, and publishes the averaged sample through multiplayer_transport_enqueue_callback_slot24_record. | objdump + caller xrefs |
| 511 | 0x00594b60 | 104 | multiplayer_transport_arm_selector_view_probe_tracking | shell | cdecl | inferred | objdump | 3 | Resolves one selector-view entry by name and arms its fast probe-tracking fields. It stores the parsed marker request id at `[entry+0x50]`, stores the parsed companion value at `[entry+0x54]`, sets the live probe gate at `[entry+0x58]`, and refreshes the per-slot dirty gates at `+0xa0/+0xa4/+0xa8` for any active selector slots through multiplayer_transport_mark_selector_slot_views_dirty. Current grounded callers are the profile-key callback-table lanes around `0x596a18` and `0x59f929`, both after parsing one `X...X|%d` marker through `0x5977b0`. | objdump + caller xrefs |
| 512 | 0x005943a0 | 231 | multiplayer_transport_stage_selector_view_progress_snapshot | shell | cdecl | inferred | objdump | 3 | Slow selector-view sidecar helper reached from multiplayer_transport_service_selector_view_refresh_cycle after multiplayer_transport_select_stale_selector_view_progress_entry picks one candidate. It requires the entry-local progress gate at `[entry+0xa4]`, formats one `PNG %s %d` line around the selector-view sample string rooted at `[entry+0x80]`, appends up to three selector-slot-specific `PNG` fragments when the corresponding slot pointers and generation counters are live, then marks the entry progress snapshot in-flight at `[entry+0x9c]` and stamps both `[entry+0x70]` and the transport-wide throttle tick `[transport+0xaec]`. | objdump + caller xrefs + strings |
| 513 | 0x00594490 | 83 | multiplayer_transport_pick_stale_selector_view_progress_entry | shell | cdecl | inferred | objdump | 3 | Store-walk callback used by multiplayer_transport_select_stale_selector_view_progress_entry. It only considers selector-view entries whose slow progress gate `[entry+0xa4]` is set, blocker `[entry+0x4c]` is clear, total-success count `[entry+0x98]` is nonzero, and in-flight progress latch `[entry+0x9c]` is clear; among those, it requires at least `0x1388` ms since the last progress tick `[entry+0x70]` and keeps the stalest candidate in the caller scratch slot. | objdump + caller xrefs |
| 514 | 0x005944f0 | 69 | multiplayer_transport_select_stale_selector_view_progress_entry | shell | cdecl | inferred | objdump | 3 | Walks the keyed selector-view store at `[transport+0xab4]` through callback `0x594490` and returns the stalest eligible selector-view entry for the slow progress-snapshot lane, or null when none qualify. Current grounded caller is multiplayer_transport_service_selector_view_refresh_cycle. | objdump + caller xrefs |
| 515 | 0x00594540 | 214 | multiplayer_transport_service_selector_view_refresh_cycle | shell | thiscall | inferred | objdump | 3 | Recurring selector-view maintenance pass beneath the multiplayer transport frame owner. When the selector-view layer is enabled and not blocked by the `g`/`a` route gates at `[this+0xb44]` and `[this+0x180c]`, it first rate-limits and runs the fast probe lane by collecting refreshable entries through multiplayer_transport_collect_refreshable_selector_view_entries and scheduling deferred probes through multiplayer_transport_schedule_selector_view_entry_refresh_probe. It then runs a slower sidecar lane every `0x7d0` ms by selecting one stale progress entry through multiplayer_transport_select_stale_selector_view_progress_entry and staging a progress snapshot through multiplayer_transport_stage_selector_view_progress_snapshot before falling into the shared timer service at `0x5a05d0`. | objdump + caller xrefs |
| 516 | 0x0059f3c0 | 498 | multiplayer_transport_handle_gml_or_png_selector_control | shell | cdecl | inferred | objdump | 3 | Small control-token handler reached from the slot-`25` selector-view callback lane after multiplayer_transport_split_selector_payload_token_and_tail. When the token is `GML` and the tail is `Disconnected`, it requires the current selector-view entry to pass multiplayer_transport_selector_view_entry_has_gml_disconnect_gate, then forces one status-pump pass, emits callback slot `16` with the tail text, and re-enters route mode `5`. Its sibling `PNG` branch resolves a named selector-view entry from the tail text and, when that entry overlaps the active selector-slot ownership, refreshes selector-view runtime state through `0x5948f0` and republishes callback slot `25`. | objdump + caller xrefs + strings |
| 517 | 0x0059f650 | 193 | multiplayer_transport_callback_dispatch_selector_name_payload_lane | shell | cdecl | inferred | objdump | 3 | Main selector-name branch in the second transport-side callback descriptor lane. It first classifies the incoming payload through multiplayer_transport_is_selector_control_line. `@@@NFO` control lines resolve one selector-view entry through multiplayer_transport_find_selector_view_entry_by_name and forward into multiplayer_transport_sync_selector_view_nfo_r_flag; non-control mode-`3/4` payloads split through multiplayer_transport_split_selector_payload_token_and_tail and publish callback slot `14`; and the remaining non-control payloads publish callback slot `13`. | objdump + caller xrefs + strings |
| 518 | 0x0059f720 | 289 | multiplayer_transport_callback_dispatch_current_selector_payload_lane | shell | cdecl | inferred | objdump | 3 | Sibling callback root that first resolves the current selector through `0x5951a0` and then dispatches one payload against that active selector context. It reuses multiplayer_transport_is_selector_control_line, the `@@@GML` and `@@@NFO` control tokens, and the shared token-tail splitter at `0x59f320`: `@@@NFO` lines flow into multiplayer_transport_sync_selector_view_nfo_r_flag, `@@@GML` lines plus mode-`3/4` payloads feed callback slot `10`, and the remaining non-control payloads feed callback slot `9`. | objdump + caller xrefs + strings |
| 519 | 0x0059f850 | 87 | multiplayer_transport_callback_reset_selector_and_enqueue_slot19 | shell | cdecl | inferred | objdump | 2 | Callback-root helper from the second transport-side descriptor lane. It resolves the current selector slot through `0x5951a0`, resets that selector text path through `0x5954b0`, forwards the supplied selector-name pair through multiplayer_transport_enqueue_callback_slot19, and when the resolved selector is `2` plus route mode is still active it re-enters multiplayer_transport_set_route_mode with mode `1`. | objdump + caller xrefs |
| 520 | 0x00594bd0 | 97 | multiplayer_transport_set_selector_slot_flags | shell | cdecl | inferred | ghidra-headless | 3 | Updates one selector-slot flag dword at [entry+0x5c] after resolving the current selector entry through 0x00594a40. When selector index `2` flips bit `1` it forwards the new bit value through multiplayer_transport_enqueue_callback_slot15_record and then notifies the shared selector-change callback path through 0x00593250 with selector id old flags and new flags. | ghidra + rizin + llvm-objdump |
| 521 | 0x00594c40 | 103 | multiplayer_transport_parse_selector_mode_letters | shell | cdecl | inferred | ghidra-headless | 3 | Parses one selector-mode letter string into a small bitmask by probing for the letters `s` `r` `g` `a` and `h`. Current grounded callers merge this mask into the selector-slot flags that live at [entry+0x5c]. | ghidra + rizin + llvm-objdump + strings |
| 522 | 0x00594cb0 | 65 | multiplayer_transport_merge_selector_mode_mask | shell | cdecl | inferred | ghidra-headless | 3 | Resolves one selector entry through 0x00594a40 parses the caller mode-letter string through multiplayer_transport_parse_selector_mode_letters preserves the current presence bits 0x20 and 0x40 from [entry+0x5c] and commits the merged result through multiplayer_transport_set_selector_slot_flags. | ghidra + rizin + llvm-objdump + strings |
| 523 | 0x00594d00 | 72 | multiplayer_transport_set_selector_presence_mask | shell | cdecl | inferred | ghidra-headless | 3 | Overwrites the selector presence bits 0x20 and 0x40 in [entry+0x5c] from one caller byte mask while preserving the rest of the selector-slot flags. The helper then commits the new value through multiplayer_transport_set_selector_slot_flags. | ghidra + rizin + llvm-objdump |
| 524 | 0x00594f20 | 142 | multiplayer_transport_upsert_selector_name_entry | shell | cdecl | inferred | ghidra-headless | 3 | Looks up or creates one selector-name entry for the requested selector slot. It resolves the current slot entry through 0x594a40 allocates a new entry through 0x594e70 when no match exists marks the selector index active at [entry+0x40+slot*4] increments the per-slot generation counter at [this+0xab8+slot*4] applies the caller flag bits 0x20 and 0x40 into [entry+0x5c+slot*4] and then marks the slot views dirty through multiplayer_transport_mark_selector_slot_views_dirty. Current grounded callers come from multiplayer_transport_handle_names_query_response and multiplayer_transport_handle_selector_update_response. | ghidra + rizin + llvm-objdump |
| 525 | 0x005950d0 | 101 | multiplayer_transport_reset_selector_tables | shell | cdecl | inferred | ghidra-headless | 4 | Resets the three selector registration tables rooted at [this+0x80] [this+0x390] and [this+0x39c] together with state at [this+0x9a8] and [this+0x9ac]. When [this+0xab0] is set it preserves selector slot `0`; otherwise it clears all three selector slots. | ghidra + rizin + llvm-objdump |
| 526 | 0x00595140 | 89 | multiplayer_transport_set_selector_name | shell | cdecl | inferred | ghidra-headless | 4 | Copies one selector name into the fixed 0x101-byte selector-name slot at [this+0x80+index*0x101] when the caller string fits. It then marks the selector present at [this+0x384+index*4] and clears the paired transient pointer at [this+0x99c+index*4]. | ghidra + rizin + llvm-objdump |
| 527 | 0x005951a0 | 67 | multiplayer_transport_find_selector_name | shell | cdecl | inferred | ghidra-headless | 4 | Scans the three selector-name slots rooted at [this+0x80] for an exact string match and returns the matching selector index through the caller pointer. The callback-slot wrapper family uses this helper before enqueueing several selector-bound opcode records. | ghidra + rizin + llvm-objdump |
| 528 | 0x005951f0 | 579 | multiplayer_transport_service_status_pump | shell | cdecl | inferred | ghidra-headless | 3 | Central session-event transport status-pump and route-service loop. It inspects selector presence under [this+0x384] and [this+0x390] builds temporary selector-mode masks through multiplayer_transport_parse_selector_mode_letters emits status text and field updates through multiplayer_transport_append_setchankey_or_setckey_command multiplayer_transport_dispatch_field_snapshot_mode and related helpers and drives the deeper route-state machine through multiplayer_transport_init_selector_slot multiplayer_transport_reset_selector_slot 0x005965d0 0x0059f3c0 and related helpers. | ghidra + rizin + llvm-objdump + strings |
| 529 | 0x00595440 | 98 | multiplayer_transport_init_selector_slot | shell | cdecl | inferred | ghidra-headless | 3 | Initializes one selector slot under [this+0x384] and [this+0x390]. It copies caller text or the default sample at 0x005c87a8 into the fixed selector buffer at [slot+0x39c] clears byte [slot+0x59b] reruns multiplayer_transport_service_status_pump and then notifies multiplayer_transport_submit_profile_key_query_bundle_default for the refreshed selector slot. | ghidra + rizin + llvm-objdump + strings |
| 530 | 0x005954b0 | 238 | multiplayer_transport_reset_selector_slot | shell | cdecl | inferred | ghidra-headless | 3 | Resets one selector slot under [this+0x384] and [this+0x390]. When the slot is active it tears the current selector object down through 0x593460 optionally republishes caller text through 0x58e7a0 refreshes selector bookkeeping through 0x5950a0 and clears the active and present flags before returning. | ghidra + rizin + llvm-objdump |
| 531 | 0x00595620 | 35 | multiplayer_transport_release_route_binding | shell | cdecl | inferred | ghidra-headless | 3 | Releases the current route binding stored at [this+0x1ec8]. It detaches the binding from the descriptor object at [this+0x1ed0] through 0x58f3c0 unlinks it through 0x5933a0 and clears [this+0x1ec8]. | ghidra + rizin + llvm-objdump |
| 532 | 0x00595650 | 688 | multiplayer_transport_set_route_mode | shell | cdecl | inferred | ghidra-headless | 3 | Main route-mode state machine for the session-event transport. It latches the requested small mode at [this+0x18b8] and dispatches modes `0` through `5` across live-route teardown selector-slot init or reset am-rating route seeding live-route connect and route-binding release paths. The currently grounded mode transitions converge by tearing live routes down through multiplayer_transport_release_live_route and rebuilding them through multiplayer_transport_try_connect_live_route rather than mutating the live route object's callback slots in place. The branch uses multiplayer_transport_release_live_route multiplayer_transport_try_seed_am_rating_route_table multiplayer_transport_try_connect_live_route and multiplayer_transport_release_route_binding to converge on the next stable mode. | ghidra + rizin + llvm-objdump + strings |
| 533 | 0x005958e0 | 156 | multiplayer_transport_try_stage_route_callback_payload | shell | cdecl | inferred | ghidra-headless | 2 | Builds one staged route-callback payload from the caller route object and transport-local text buffer at [this+0x60]. It extracts several caller fields through the 0x58d1f0 0x58d240 0x58d220 and 0x58d250 or 0x58d200 helpers packs them through multiplayer_transport_format_gsp_payload submits the staged text through multiplayer_transport_submit_selector_text_route_request and on success stores the cloned callback payload returned by multiplayer_transport_clone_staged_callback_payload at [this+0xb50]. | ghidra + rizin + llvm-objdump + strings |
| 534 | 0x00595980 | 84 | multiplayer_transport_handle_route_status_result | shell | cdecl | inferred | ghidra-headless | 2 | Completion callback used by multiplayer_transport_submit_route_status_request. When the callback result is nonzero it compares the live status counters at [this+0xac0] and [this+0xb48] and advances the route-mode state machine through mode `2` or modes `3` or `4`. When the callback result is zero it sets [this+0x1ed8] and re-enters multiplayer_transport_set_route_mode using the current am-rating route state at [this+0x1ed4]. | ghidra + rizin + llvm-objdump |
| 535 | 0x005959e0 | 81 | multiplayer_transport_submit_route_status_request | shell | cdecl | inferred | ghidra-headless | 3 | Submits one route-status request for the current binding at [this+0x1ec8]. It gathers the binding fields at +0x2c and +0x30 together with the local counter at [this+0xb48] and default sample text at 0x005c87a8 then sends that request through 0x593980 using multiplayer_transport_handle_route_status_result as the completion callback. Failure sets [this+0x1ed8] so the route-mode setter can fall back immediately. | ghidra + rizin + llvm-objdump |
| 536 | 0x00596270 | 70 | multiplayer_transport_clone_staged_callback_payload | shell | cdecl | inferred | ghidra-headless | 3 | Clones one staged route-callback payload block by allocating a same-sized object through 0x58d5b0 copying the first nine dwords and then registering a cleanup callback through 0x58fa00 with shim 0x596260. Current grounded caller is multiplayer_transport_try_stage_route_callback_payload. | ghidra + rizin + llvm-objdump |
| 537 | 0x00597720 | 96 | multiplayer_transport_format_gsp_payload | shell | cdecl | inferred | ghidra-headless | 3 | Formats one transport text payload with the `#GSP!%s!%c%s%c` template at 0x005e2358. Depending on whether the global formatter state at 0x00dba4c4 is present it builds either a 0x58-byte or 0x4d-byte intermediate fragment through 0x597590 or 0x5976c0 and then emits the final string through 0x5a19c4. Current grounded callers are multiplayer_transport_submit_bound_route_request and multiplayer_transport_try_stage_route_callback_payload. | ghidra + rizin + llvm-objdump + strings |
| 538 | 0x005977b0 | 127 | multiplayer_transport_parse_selector_view_probe_marker | shell | cdecl | inferred | objdump | 3 | Parses one selector-view probe marker in the local `X%sX|%d` family. It requires a length of at least `0x0c`, accepts the marker only when byte `0` or byte `9` is `X`, decodes the wrapped request-id fragment through `0x597630`, parses the decimal tail after the `|` through `0x5a1ea5`, and returns those two values through caller output pointers. Current grounded callers are the profile-key callback lanes at `0x596a01` and `0x59f912`, which forward the parsed request id and companion value into multiplayer_transport_arm_selector_view_probe_tracking. | objdump + caller xrefs + format string |
| 539 | 0x00597840 | 30 | multiplayer_transport_format_selector_view_probe_marker | shell | cdecl | inferred | objdump | 3 | Formats one selector-view probe marker in the local `X%sX|%d` family. It encodes the caller request id through `0x597590`, then wraps the result with sentinel `X` bytes and a trailing `|%d` suffix into the destination buffer. Current grounded caller is multiplayer_transport_stage_selector_view_progress_snapshot, which uses `[entry+0x50]` as the marker id when building `PNG %s %d` progress lines. | objdump + caller xrefs + format string |
| 540 | 0x00593980 | 382 | multiplayer_transport_submit_bound_route_request | shell | cdecl | inferred | ghidra-headless | 3 | Builds and submits one bound-route request using the current transport text buffers and a caller-supplied binding id or fallback route id. It formats the request payload through multiplayer_transport_format_gsp_payload allocates a type `1` transient request record through 0x5934e0 stores route and callback metadata on that record publishes selector `2` text through multiplayer_transport_set_selector_name and finally submits the request through 0x58e720 using multiplayer_transport_handle_bound_route_request. A nonempty caller text sample sets [this+0xb4c]. | ghidra + rizin + llvm-objdump + strings |
| 541 | 0x00593b00 | 161 | multiplayer_transport_handle_selector_update_response | shell | cdecl | inferred | ghidra-headless | 3 | Follow-up callback used by multiplayer_transport_handle_selector_text_route_request. When the callback succeeds it initializes or repopulates selector slot [req+0x1c] through multiplayer_transport_init_selector_slot and multiplayer_transport_upsert_selector_name_entry. When it fails it resets that selector slot. Both paths finish by enqueueing a route record through multiplayer_transport_probe_or_enqueue_route_record and unlinking the request through 0x5933a0. | ghidra + rizin + llvm-objdump |
| 542 | 0x00593bb0 | 144 | multiplayer_transport_handle_selector_text_route_request | shell | cdecl | inferred | ghidra-headless | 3 | Completion callback for multiplayer_transport_submit_selector_text_route_request. If the request is already stale at +0x38 it clears the transient state through 0x5962c0 and unlinks the request. On nonzero result it schedules multiplayer_transport_handle_selector_update_response through multiplayer_transport_submit_names_query_with_callback. On zero result it resets selector slot [req+0x1c] and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request. | ghidra + rizin + llvm-objdump |
| 543 | 0x00593c40 | 177 | multiplayer_transport_submit_selector_text_route_request | shell | cdecl | inferred | ghidra-headless | 3 | Builds and submits one selector-text route request. It validates the caller text defaults the sample text to 0x005c87a8 allocates a type `2` transient request record through 0x5934e0 stores the selector id at +0x1c refreshes selector naming through 0x59fc80 and multiplayer_transport_set_selector_name and then submits the request through 0x58e720 using multiplayer_transport_handle_selector_text_route_request. | ghidra + rizin + llvm-objdump + strings |
| 544 | 0x00595a40 | 245 | multiplayer_transport_dispatch_field_snapshot_mode | shell | cdecl | inferred | ghidra-headless | 3 | Dispatches several session-field snapshot update modes into multiplayer_transport_enqueue_field_snapshot_record. Depending on the mode it can enqueue hostname or gamemode snapshots clear the progress scalar at [this+0x1774] reset the callback payload to zero or copy one dword from [eax+0x490] into [this+0x54] while updating the local field cache rooted at [this+0x1724]. | ghidra + rizin + llvm-objdump + strings |
| 545 | 0x00595b60 | 25 | multiplayer_transport_enqueue_field_snapshot_mode1_if_enabled | shell | cdecl | inferred | ghidra-headless | 2 | Tiny field-snapshot wrapper that enqueues one mode-1 field snapshot only when the caller enable flag is zero. The helper is a thin front end over multiplayer_transport_enqueue_field_snapshot_record. | ghidra + rizin + llvm-objdump |
| 546 | 0x00595b80 | 50 | multiplayer_transport_clear_progress_field_cache | shell | cdecl | inferred | ghidra-headless | 3 | Clears the progress-related field cache rooted at [this+0xba0] and then clears the local field cache at [this+0x1724]. It finishes by forwarding mode `3` into 0x005929a0 to remove the matching queued field-snapshot records. | ghidra + rizin + llvm-objdump + strings |
| 547 | 0x00595bc0 | 272 | multiplayer_transport_enqueue_capacity_descriptor_record | shell | cdecl | inferred | ghidra-headless | 3 | Builds and enqueues one descriptor-block transport record tied to the capacity or progress cache at [this+0x1778]. One branch forwards cached descriptor fields directly through multiplayer_transport_enqueue_descriptor_block_record while the live branch samples hostname openstaging gamemode and numplayers strings from the current transport object before enqueueing the same opcode-2 descriptor record. | ghidra + rizin + llvm-objdump + strings |
| 548 | 0x00595ce0 | 22 | multiplayer_transport_clear_capacity_descriptor_cache | shell | cdecl | inferred | ghidra-headless | 3 | Clears the auxiliary capacity-descriptor cache when [this+0xba0] is present by forwarding the embedded object at [this+0xba4] into 0x00590740. Current grounded callers use this before disconnect or larger route-state cleanup. | ghidra + rizin + llvm-objdump |
| 549 | 0x00595d60 | 84 | multiplayer_transport_check_openstaging_capacity_gate | shell | cdecl | inferred | ghidra-headless | 2 | Checks whether the current transport object still matches the cached openstaging-like descriptor and whether numplayers remains below maxplayers. When the cached route object at [this+0x1ecc] already matches the current transport identifiers it returns success immediately; otherwise it compares the current maxplayers and numplayers fields and on success falls into 0x00592710 for the caller's route transition path. | ghidra + rizin + llvm-objdump + strings |
| 550 | 0x00595dc0 | 79 | multiplayer_transport_try_transition_after_capacity_gate | shell | cdecl | inferred | ghidra-headless | 2 | Rejects when [this+0x1e8c] or selector slot [this+0x38c] is busy then runs multiplayer_transport_check_openstaging_capacity_gate refreshes route-side state through 0x5973b0 and 0x5954b0 forwards the caller event into 0x5958e0 and on success transitions through 0x595650 mode `0`. | ghidra + rizin + llvm-objdump |
| 551 | 0x00595e10 | 321 | multiplayer_transport_dispatch_route_event_mode | shell | cdecl | inferred | ghidra-headless | 2 | Dispatches route-event modes for the callback branch rooted at [this+0x18bc]. Depending on the mode it may update [this+0x18bc] or [this+0x1e7c] reuse multiplayer_transport_try_transition_after_capacity_gate force mode `2` through 0x595650 or copy a selected descriptor pointer into [this+0x54]. Current surrounding evidence ties this branch to the `gsi_am_rating` route table. | ghidra + rizin + llvm-objdump |
| 552 | 0x00595f70 | 237 | multiplayer_transport_dispatch_am_rating_route_callback | shell | cdecl | inferred | ghidra-headless | 3 | Callback handler for the `gsi_am_rating` route branch rooted at [this+0x18bc]. Mode `0` forwards directly into multiplayer_transport_try_transition_after_capacity_gate while mode `2` prunes stale route entries against multiplayer_transport_check_openstaging_capacity_gate updates surviving entries through 0x58d130 with the `gsi_am_rating` token and either forces mode `2` or forwards the surviving head entry into 0x5958e0 before transitioning through 0x595650 mode `0`. | ghidra + rizin + llvm-objdump + strings |
| 553 | 0x00596060 | 48 | multiplayer_transport_reset_am_rating_route_state | shell | cdecl | inferred | ghidra-headless | 3 | Small reset helper for the active `gsi_am_rating` route state. When [this+0xba0] is set it clears the route callback table at [this+0x18bc] resets [this+0x1ec4] to zero and clears the auxiliary route cache at [this+0x1e7c]. | ghidra + rizin + llvm-objdump + strings |
| 554 | 0x00596090 | 272 | multiplayer_transport_init_route_callback_tables | shell | cdecl | inferred | ghidra-headless | 3 | Initializes route callback tables at [this+0xba4] [this+0x1724] [this+0x1164] [this+0x18bc] and [this+0x1e7c]. Installs handlers 0x00595a40 0x00595b60 0x00595bc0 0x00595e10 and multiplayer_transport_dispatch_am_rating_route_callback seeds default selector text from static tables and sets [this+0xba0]. | ghidra + rizin + llvm-objdump |
| 555 | 0x005961b0 | 92 | multiplayer_transport_teardown_route_callback_tables | shell | cdecl | inferred | ghidra-headless | 4 | Clears progress and capacity caches destroys the callback tables at [this+0xba4] [this+0x1164] and [this+0x18bc] clears the related caches at [this+0x1724] and [this+0x1e7c] and resets [this+0x1ec4] to zero. | ghidra + rizin + llvm-objdump |
| 556 | 0x00596210 | 71 | multiplayer_transport_service_route_callback_tables | shell | cdecl | inferred | objdump | 3 | Recurring service sweep for the transport-owned callback tables and field caches. When route callback plumbing is enabled at `[this+0xba0]` it services the callback tables at `[this+0xba4]`, `[this+0x1164]`, and `[this+0x18bc]` through the shared table-service helper `0x591290`, services the cache blocks at `[this+0x1724]` and `[this+0x1e7c]` through `0x5a0c80`, and otherwise returns immediately. The current grounded caller is multiplayer_transport_service_frame, which makes this the callback-table side of the recurring multiplayer transport cadence. | objdump |
| 557 | 0x005962e0 | 583 | multiplayer_transport_register_field_subscription_bundle | shell | cdecl | inferred | ghidra-headless | 3 | Builds one field-subscription bundle from the field-id list optional suffix text and selector-name table. Rebuilds the callback table at [this+0xba4] seeds the local field cache at [this+0x1724] installs the subscription block through 0x590ed0 sets [this+0x1774] on success and enqueues an immediate mode-3 field snapshot through multiplayer_transport_enqueue_field_snapshot_record. | ghidra + rizin + llvm-objdump |
| 558 | 0x00596530 | 101 | multiplayer_transport_try_seed_am_rating_route_table | shell | cdecl | inferred | ghidra-headless | 2 | Used by the larger route-mode setter around 0x595650. It first calls multiplayer_transport_reset_am_rating_route_state then rebuilds one mode `4` route entry in the callback table at [this+0x18bc] from the stored descriptor at [this+0x1ed0]. Success clears [this+0x1ed4] sets [this+0x1ec4] to one and failure reverts through multiplayer_transport_reset_am_rating_route_state before setting [this+0x1ed4]. | ghidra + rizin + llvm-objdump + strings |
| 559 | 0x005965a0 | 44 | multiplayer_transport_try_connect_status_route_once | shell | cdecl | inferred | ghidra-headless | 3 | Single-shot wrapper for the auxiliary status-route object at [this+0xaf0]. When the in-flight latch at [this+0xb40] is already set it returns false immediately. Otherwise it sets that latch and forwards the caller route id into multiplayer_transport_try_connect_status_route then booleanizes the result. Current grounded caller is multiplayer_transport_handle_names_query_response. | ghidra + rizin + llvm-objdump |
| 560 | 0x00596970 | 404 | multiplayer_transport_handle_profile_key_query_result | shell | cdecl | inferred | objdump | 3 | Per-key callback helper for the profile-key query bundle family. It ignores empty selector names, treats a null fallback text as `0x005c87a8`, special-cases the `username` key by parsing one `X...X|%d` marker through multiplayer_transport_parse_selector_view_probe_marker, arming selector-view probe tracking through multiplayer_transport_arm_selector_view_probe_tracking, and optionally publishing callback slot `22` with the selector name plus the parsed marker pair or a zeroed `(END)` sentinel payload. It also special-cases `b_flags` by forwarding the returned mode-letter string into multiplayer_transport_merge_selector_mode_mask, then hashes the selector name, key name, and resolved value text through `0x58f4a0` and upserts that triplet into the caller table through hashed_entry_table_upsert. | objdump + strings + caller context |
| 561 | 0x00596da0 | 497 | multiplayer_transport_submit_profile_key_query_bundle | shell | cdecl | inferred | rizin | 2 | Wrapper above the transport key-command builders that stages a small named-key query bundle around the strings `username` and `b_flags`. It allocates temporary key-name arrays and callback-entry tables submits the first request through multiplayer_transport_submit_getkey_command_and_wait folds returned key results into transport-owned callback state through 0x0058f8f0 and 0x0058fa00 and then follows with the larger channel-key submission path through multiplayer_transport_submit_setchankey_pair_list_command_and_wait when the staged key set is nonempty. | rizin + llvm-objdump + strings |
| 562 | 0x00596fa0 | 19 | multiplayer_transport_submit_profile_key_query_bundle_with_context | shell | cdecl | inferred | rizin | 2 | Thin wrapper over multiplayer_transport_submit_profile_key_query_bundle that preserves the caller selector or route context in `edx` and forwards the stack-supplied context pointer as the extra bundle argument. Current grounded use is through the local callback table rooted at 0x0059f8b0. | rizin + llvm-objdump |
| 563 | 0x00596fc0 | 14 | multiplayer_transport_submit_profile_key_query_bundle_default | shell | cdecl | inferred | rizin | 3 | Thin wrapper over multiplayer_transport_submit_profile_key_query_bundle that preserves the caller selector slot in `edx` and forces a null extra-context argument. Current grounded caller is multiplayer_transport_init_selector_slot and the same wrapper is also installed through the local callback table rooted at 0x0059fb60. | rizin + llvm-objdump |
| 564 | 0x0059f8b0 | 260 | multiplayer_transport_callback_upsert_current_selector_and_request_profile_keys | shell | cdecl | inferred | objdump | 3 | Callback-root helper adjacent to the second transport-side descriptor lane. It resolves the current selector through multiplayer_transport_find_selector_name, upserts that selector name into the selector-view store through multiplayer_transport_upsert_selector_name_entry, optionally reuses a cached `username` marker from `0x58eb10` to arm selector-view probe tracking through multiplayer_transport_parse_selector_view_probe_marker and multiplayer_transport_arm_selector_view_probe_tracking, then submits one profile-key query bundle through multiplayer_transport_submit_profile_key_query_bundle_with_context and publishes callback slot `17`. When selector `2` is active, the same helper can also force the route-mode transitions `2 -> 3 -> 4` through multiplayer_transport_set_route_mode after checking the status-route latch at `[this+0xb54]`, route activity, and the generation gate `[this+0xac0] >= [this+0xb48]`. | objdump + caller xrefs + strings |
| 565 | 0x00596fd0 | 441 | multiplayer_transport_dispatch_status_route_event | shell | cdecl | inferred | rizin | 3 | Main local callback dispatcher for the auxiliary status-route object. It gates on [this+0x398] [this+0xb44] and flag bits in [this+0xb38] then maps route event ids through the local table at 0x005970c4 into selector text publication openstaging publication boolean status publication and callback forwarding paths. The dispatcher publishes through multiplayer_transport_send_selector_text and multiplayer_transport_publish_fixed_token_message and can also invoke the owner callback at [this+0x17dc] with payload [this+0x17f8]. | rizin + llvm-objdump + strings |
| 566 | 0x005972c0 | 97 | multiplayer_transport_handle_validated_route_cookie_event | shell | cdecl | inferred | objdump | 3 | Validated subtype-`4` callback for the transport-owned GameSpy route family. The route constructor seeds this helper into `[route+0x9c]`; after multiplayer_gamespy_route_dispatch_inbound_packet validates the current route cookie it forwards the event id in `ecx`, the remaining payload pointer in `edx`, and the owner transport context from `[route+0x104]`. When multiplayer_transport_is_route_mode_active_nonterminal succeeds it marks `[this+0x1ed8]` and re-enters multiplayer_transport_set_route_mode with a mode-selection bit derived from `[this+0x1ed4]` and `[this+0x18b8]`; otherwise it falls back to the owner callback at `[this+0x17f0]` using context `[this+0x17f8]`. | objdump |
| 567 | 0x00597330 | 28 | multiplayer_transport_forward_validated_extended_route_payload | shell | cdecl | inferred | objdump | 3 | Small forwarding callback used for the transport-owned status route's validated extended-payload slot. It treats `edx` as the owner transport object, checks the owner callback pointer at `[this+0x17f4]`, and when present forwards the validated payload wrapper in `ecx` together with owner context `[this+0x17f8]`. Current grounded caller is the status-route connect helper through multiplayer_gamespy_route_set_extended_payload_callback. | objdump |
| 568 | 0x00597350 | 30 | multiplayer_transport_release_status_route | shell | cdecl | inferred | ghidra-headless | 3 | Releases the auxiliary status-route object stored at [this+0xaf0] through 0x58cfd0 and clears the owner slot afterward. Status-pump cleanup fixed-token publishing and the auxiliary route connect helper use this before rebuilding status-route state. | ghidra + rizin + llvm-objdump |
| 569 | 0x00597380 | 34 | multiplayer_transport_service_status_and_live_routes | shell | cdecl | inferred | objdump | 3 | Recurring route-object sweep for the session-event transport. It services the auxiliary status-route object at `[this+0xaf0]` through the shared low-level route tick helper `0x58d040` when present and then services the current live route at `[this+0x1ecc]` through that same helper. The current grounded caller is multiplayer_transport_service_frame, which makes this the route-object side of the recurring multiplayer transport cadence. | objdump |
| 570 | 0x005973d0 | 170 | multiplayer_transport_try_connect_status_route | shell | cdecl | inferred | ghidra-headless | 3 | Attempts to connect or rebuild the auxiliary status-route object at [this+0xaf0]. It first tears any existing status route down through multiplayer_transport_release_status_route then builds a callback table from the local handler set rooted at multiplayer_transport_dispatch_status_route_event through multiplayer_transport_handle_validated_route_cookie_event chooses either the default route id `0x1964` or the caller route id and connects through `0x58cc40` or multiplayer_gamespy_route_construct_and_seed_callback_vector. On success it copies [this+0x9a8] into [this+0xb3c] patches the created route object's extended-payload callback slot through multiplayer_gamespy_route_set_extended_payload_callback using callback `0x597330` and clears [this+0xb38]. | ghidra + rizin + llvm-objdump + strings |
| 571 | 0x005973b0 | 30 | multiplayer_transport_release_live_route | shell | cdecl | inferred | ghidra-headless | 4 | Releases the current live route object stored at [this+0x1ecc] through 0x58cfd0 and clears the owner slot afterward. The route-mode setter and connect helper use it before rebuilding or switching live route state. | ghidra + rizin + llvm-objdump |
| 572 | 0x00597480 | 261 | multiplayer_transport_try_connect_live_route | shell | cdecl | inferred | ghidra-headless | 3 | Attempts to connect or rebuild the current live route object at [this+0x1ecc]. It first clears any existing live route through multiplayer_transport_release_live_route then formats a local identifier from [this+0x60] and 0x005dccfc chooses either the default route id `0x1964` or the binding-specific id and connects through 0x58cc40 or multiplayer_gamespy_route_construct_and_seed_callback_vector. In the currently grounded connect path it does not patch `[route+0xa0]`, `[route+0xa4]`, or `[route+0xd4]` after construction the way the status-route helper patches `[route+0xa0]`; on success it only updates [this+0x1ed8] and preserves the new live route state for the route-mode setter. | ghidra + rizin + llvm-objdump + strings |
| 573 | 0x00598230 | 67 | multiplayer_transport_enqueue_names_query_record | shell | cdecl | inferred | ghidra-headless | 3 | Allocates one 0x10-byte transient names-query work item zeroes its four dword fields and submits it through 0x5980f0 as request kind `3` using the caller-provided sample or callback context pointer. The helper returns the allocated work item on success and null on allocation or submit failure. Current grounded caller is multiplayer_transport_submit_names_query_with_callback. | ghidra + rizin + llvm-objdump |
| 574 | 0x0058f0a0 | 99 | multiplayer_transport_append_user_and_optional_nick_commands | shell | cdecl | inferred | rizin | 3 | Builds the initial identity command bundle for one multiplayer transport worker. It appends `USER %s %s %s :%s` to the owned text stream using worker text fields at [this+0x3ac] [this+0x42c] and [this+0x4b0] together with the fallback host `127.0.0.1` then checks the current nick through multiplayer_transport_is_valid_nick_string and either falls through multiplayer_transport_dispatch_or_release_callback_binding with mode `1` or appends `NICK %s` directly through the same text-stream path. | rizin + llvm-objdump + strings |
| 575 | 0x0058f920 | 72 | hashed_entry_table_upsert | support | cdecl | inferred | rizin | 4 | Generic hashed-entry-table upsert over a bucket array of contiguous vectors. It computes the bucket index through the table hash callback at [this+0x0c] looks for an existing matching entry through hashed_entry_table_lookup and when found overwrites that slot through generic_vector_overwrite_with_callback; otherwise it appends the caller record into the selected bucket vector through 0x0059e4d0. | rizin + llvm-objdump |
| 576 | 0x0058f970 | 69 | hashed_entry_table_remove | support | cdecl | inferred | rizin | 4 | Generic hashed-entry-table remove over a bucket array of contiguous vectors. It hashes the caller key into one bucket and erases the matching slot through generic_vector_erase_with_callback when present; otherwise it returns false. | rizin + llvm-objdump |
| 577 | 0x0058f9c0 | 63 | hashed_entry_table_lookup | support | cdecl | inferred | rizin | 4 | Generic hashed-entry-table lookup over a bucket array of contiguous vectors. It hashes the caller key into one bucket resolves the matching index through generic_vector_find_index and returns the matched entry pointer or null. | rizin + llvm-objdump |
| 578 | 0x0058f110 | 465 | multiplayer_transport_worker_init | shell | cdecl | inferred | rizin | 3 | Initializes one heap-backed multiplayer transport worker and its owned text-stream and store state. It zeroes the `0x5e4`-byte worker copies caller identifier strings into the fixed buffers at `[this+0x00]`, `[this+0x36c]`, `[this+0x3ac]`, `[this+0x42c]`, and `[this+0x4b0]`, copies one 5-dword descriptor block into `[this+0x534]`, seeds the state fields at `[this+0x04]` and `[this+0x558]`, initializes the registered-name store at `[this+0x548]`, the pending-template dispatch store at `[this+0x54c]`, and the owned text-stream object at `[this+0x1c]`, and tears partial state back down on failure. | rizin + llvm-objdump |
| 579 | 0x0058f2f0 | 60 | multiplayer_transport_worker_create | shell | cdecl | inferred | rizin | 3 | Thin allocation wrapper for multiplayer_transport_worker_init. It allocates one `0x5e4`-byte worker block through tracked_heap_alloc_with_header and then forwards the descriptor pointer already staged in `EDX` plus the caller argument bundle into multiplayer_transport_worker_init. | rizin + llvm-objdump |
| 580 | 0x0059d430 | 47 | string_hash_sum_mod | support | cdecl | inferred | rizin | 3 | Small string-hash helper that accumulates one normalized integer value per input byte through 0x005a5900 and returns the running sum modulo the caller divisor. Current grounded callers use it as the bucket-selector callback for registered-name entry tables. | rizin + llvm-objdump |
| 581 | 0x0059d470 | 57 | multiplayer_transport_lookup_registered_name | shell | cdecl | inferred | ghidra-headless | 3 | Copies one caller string into a stack-local buffer and looks it up against the registered-name store rooted at [this+0x548] through hashed_entry_table_lookup. It returns the matched entry pointer or null. Current grounded callers are multiplayer_transport_has_registered_name and the deeper names-query payload helper family. | ghidra + rizin + llvm-objdump |
| 582 | 0x0059d520 | 91 | multiplayer_transport_init_registered_name_store | shell | thiscall | inferred | rizin | 4 | Initializes the transport-side registered-name store by allocating the hashed bucket table at [this+0x548] with 7 buckets and a 0x1e0-byte entry shape through 0x0058f840 and then allocating the companion flat entry vector at [this+0x54c] through 0x0059e0b0. On allocation failure it tears any partial state back down. | rizin + llvm-objdump |
| 583 | 0x0059d580 | 35 | multiplayer_transport_destroy_registered_name_store | shell | thiscall | inferred | rizin | 4 | Destroys the transport-side registered-name store by releasing the hashed bucket table at [this+0x548] through 0x0058f8b0 and the companion flat entry vector at [this+0x54c] through generic_vector_destroy when present. | rizin + llvm-objdump |
| 584 | 0x0059d610 | 81 | multiplayer_transport_contains_registered_name_entry | shell | cdecl | inferred | rizin | 3 | Linear membership check over the flat registered-name entry vector at [this+0x54c]. It compares each live entry against the caller key through 0x005a57cf and returns true on the first exact match. | rizin + llvm-objdump |
| 585 | 0x0059d670 | 240 | multiplayer_transport_upsert_registered_name_entry | shell | cdecl | inferred | rizin | 3 | Builds one temporary 0x1e0-byte registered-name entry on the stack from the caller descriptor and name string; allocates the entry-owned callback table through 0x0058f840; removes any older flat-vector entry with the same key from [this+0x54c]; and then inserts or replaces the canonical entry in the hashed registered-name store at [this+0x548] through hashed_entry_table_upsert. | rizin + llvm-objdump |
| 586 | 0x0059d760 | 103 | multiplayer_transport_remove_registered_name_entry | shell | cdecl | inferred | rizin | 4 | Copies the caller name into a stack-local temporary key; removes any matching entry from the flat registered-name vector at [this+0x54c]; and then removes the canonical hashed-store entry from [this+0x548] through hashed_entry_table_remove. | rizin + llvm-objdump |
| 587 | 0x0058fa00 | 49 | generic_callback_list_for_each | support | cdecl | inferred | ghidra-headless | 4 | Generic callback-list walker over one `[items count]` style callback collection. It uses generic_vector_for_each to visit every entry pointer and forwards the caller context through the supplied callback shim unchanged. Transport registration and the registered-name fast path reuse it to fan out one callback over all registered entries. | rizin + llvm-objdump |
| 588 | 0x0059e110 | 3 | generic_vector_count | support | cdecl | inferred | rizin | 4 | Returns the current element count from dword [this+0x00] for one contiguous vector-style container. | rizin + llvm-objdump |
| 589 | 0x0059e120 | 10 | generic_vector_index_ptr | support | cdecl | inferred | rizin | 4 | Computes one element pointer as base [this+0x14] plus index times stride [this+0x08]. Most higher-level vector helpers funnel slot access through this helper. | rizin + llvm-objdump |
| 590 | 0x0059e130 | 58 | generic_vector_erase | support | cdecl | inferred | rizin | 4 | Removes one indexed element from a contiguous vector. When the erased slot is not already the tail it memmoves the trailing span down and then decrements the element count at [this+0x00]. | rizin + llvm-objdump |
| 591 | 0x0059e170 | 21 | generic_vector_sort | support | cdecl | inferred | rizin | 4 | Sorts the backing element range at [this+0x14] through the shared qsort-style helper using the current count and stride from the vector header. | rizin + llvm-objdump |
| 592 | 0x0059e190 | 49 | generic_vector_for_each | support | cdecl | inferred | rizin | 4 | Forward iterator for one contiguous vector. It walks indices `0..count-1` resolves each slot through generic_vector_index_ptr and invokes the caller callback with the shared context argument. | rizin + llvm-objdump |
| 593 | 0x0059e1d0 | 42 | generic_vector_for_each_reverse | support | cdecl | inferred | rizin | 4 | Reverse iterator for one contiguous vector. It walks indices `count-1..0` and invokes the caller callback on each resolved slot pointer. | rizin + llvm-objdump |
| 594 | 0x0059e200 | 61 | generic_vector_find_first | support | cdecl | inferred | rizin | 4 | Scans the vector from the front and returns the first element pointer whose caller predicate returns zero. When no match is found it returns null. | rizin + llvm-objdump |
| 595 | 0x0059e2f0 | 19 | generic_vector_invoke_element_callback | support | cdecl | inferred | rizin | 4 | Invokes the optional per-element callback stored at [this+0x10] for one indexed slot when that callback pointer is nonnull. Erase overwrite and destroy helpers reuse it before mutating storage. | rizin + llvm-objdump |
| 596 | 0x0059e310 | 31 | generic_vector_store_at | support | cdecl | inferred | rizin | 4 | Copies one caller-supplied element record into the indexed slot resolved through generic_vector_index_ptr using the current element stride from the vector header. | rizin + llvm-objdump |
| 597 | 0x0059e330 | 49 | generic_vector_destroy | support | cdecl | inferred | rizin | 4 | Walks all live elements through generic_vector_invoke_element_callback then frees the backing storage at [this+0x14] and finally releases the vector object itself through tracked_heap_free_with_header. | rizin + llvm-objdump |
| 598 | 0x0059e370 | 87 | generic_vector_insert_copy_at | support | cdecl | inferred | rizin | 4 | Ensures capacity grows through 0x0059e090 when full increments the count shifts the tail upward when inserting before the end and copies the caller element record into the requested slot through generic_vector_store_at. | rizin + llvm-objdump |
| 599 | 0x0059e3d0 | 22 | generic_vector_erase_with_callback | support | cdecl | inferred | rizin | 4 | Calls generic_vector_invoke_element_callback for the indexed slot and then removes that slot through generic_vector_erase. Current grounded callers use it for registered-name and callback-entry teardown paths. | rizin + llvm-objdump |
| 600 | 0x0059e3f0 | 33 | generic_vector_overwrite_with_callback | support | cdecl | inferred | rizin | 4 | Invokes generic_vector_invoke_element_callback for one indexed slot and then copies the caller replacement record back into that same slot through generic_vector_store_at. Hashed entry-table upsert uses it when replacing an existing matching record. | rizin + llvm-objdump |
| 601 | 0x0059e420 | 137 | generic_vector_find_index | support | cdecl | inferred | rizin | 4 | Returns the index of one matching element within the contiguous vector or `-1` when none is found. Depending on the caller flag it uses either the linear comparator scan at 0x0059e240 or the ordered search helper at 0x0059e290 and derives the final index from the matched element pointer and stride. | rizin + llvm-objdump |
| 602 | 0x0059d7f0 | 86 | multiplayer_transport_collect_registered_name_callback_entries | shell | cdecl | inferred | ghidra-headless | 3 | Callback collector used by the registered-name fast path. For each callback entry in the name entry's callback list it grows two parallel pointer arrays in the caller scratch frame through tracked_heap_resize_with_header and appends the callback entry pointer plus its `[entry+0xdc]` payload pointer. Current grounded caller is multiplayer_transport_dispatch_registered_name_query_fastpath through generic_callback_list_for_each. | ghidra + rizin + llvm-objdump |
| 603 | 0x0059d850 | 114 | multiplayer_transport_dispatch_registered_name_query_fastpath | shell | cdecl | inferred | ghidra-headless | 3 | Fast path for multiplayer_transport_submit_names_query_with_callback when the queried sample already exists in the registered-name table. It resolves the name entry through multiplayer_transport_lookup_registered_name collects entry-owned callback state through multiplayer_transport_collect_registered_name_callback_entries and invokes the caller callback through multiplayer_transport_invoke_registered_name_query_callback without enqueueing a transport names-query record. Temporary callback arrays are released through tracked_heap_free_with_header on exit. | ghidra + rizin + llvm-objdump |
| 604 | 0x0059d8d0 | 15 | multiplayer_transport_has_registered_name | shell | cdecl | inferred | ghidra-headless | 3 | Boolean wrapper over multiplayer_transport_lookup_registered_name. It returns true when the caller string resolves to one registered-name entry in the transport-side table and false otherwise. Current grounded caller is multiplayer_transport_submit_names_query_with_callback. | ghidra + rizin + llvm-objdump |
| 605 | 0x0059d8e0 | 64 | multiplayer_transport_try_read_registered_name_header_block | shell | cdecl | inferred | rizin | 4 | Looks up one registered-name entry and when the header-valid flag at `[entry+0x154]` is set copies the 7-dword header block at `[entry+0x138]` into the caller buffer and returns true. Otherwise it returns false without mutating the destination. | rizin + llvm-objdump |
| 606 | 0x0059d920 | 48 | multiplayer_transport_set_registered_name_header_block | shell | cdecl | inferred | rizin | 4 | Looks up one registered-name entry copies 7 caller-supplied dwords into the header block at `[entry+0x138]` and sets the paired valid flag at `[entry+0x154]` to one. | rizin + llvm-objdump |
| 607 | 0x0059d950 | 112 | multiplayer_transport_set_registered_name_status_text | shell | cdecl | inferred | rizin | 3 | Looks up one registered-name entry frees the prior heap string at `[entry+0x158]` and replaces it with a heap copy of the caller text or the shared empty string when the caller passes null. The helper currently looks like the main per-name status or topic text setter for the registered-name store. | rizin + llvm-objdump |
| 608 | 0x0059d9c0 | 32 | multiplayer_transport_mark_registered_name_dirty | shell | cdecl | inferred | rizin | 3 | Looks up one registered-name entry and sets the dword dirty or active flag at `[entry+0x15c]` to one. | rizin + llvm-objdump |
| 609 | 0x0059d9e0 | 32 | multiplayer_transport_get_registered_name_dirty | shell | cdecl | inferred | rizin | 3 | Looks up one registered-name entry and returns the current dword dirty or active flag stored at `[entry+0x15c]` or zero when the entry is absent. | rizin + llvm-objdump |
| 610 | 0x0059da00 | 64 | multiplayer_transport_set_registered_name_display_text | shell | cdecl | inferred | rizin | 3 | Looks up one registered-name entry copies up to 0x80 bytes of caller text into the embedded buffer at `[entry+0x160]` through string_copy_bounded_zerofill and clears the trailing byte flag at `[entry+0x1df]`. This is a second inline text field distinct from the heap string at `[entry+0x158]`. | rizin + llvm-objdump |
| 611 | 0x0059da40 | 208 | multiplayer_transport_upsert_registered_name_callback_entry | shell | cdecl | inferred | rizin | 4 | Looks up one registered-name entry zeroes a temporary 0xe0-byte nested callback-entry record copies the secondary key string into the local record and when both payload blocks are provided copies 0x18 bytes into `[record+0x80]` and 0x40 bytes into `[record+0x98]` sets the local active flag at `[record+0xd8]` and stores one caller dword at `[record+0xdc]` before upserting the record into the entry-owned callback table at `[entry+0x134]` through hashed_entry_table_upsert. | rizin + llvm-objdump |
| 612 | 0x0059db10 | 80 | multiplayer_transport_remove_registered_name_callback_entry | shell | cdecl | inferred | rizin | 4 | Looks up one registered-name entry copies the caller secondary key into a stack-local temporary and removes the matching nested callback-entry record from the entry-owned callback table at `[entry+0x134]` through hashed_entry_table_remove. | rizin + llvm-objdump |
| 613 | 0x0059db90 | 96 | multiplayer_transport_dispatch_registered_name_callback_entry | shell | cdecl | inferred | rizin | 3 | Fans one callback descriptor over the transport-side registered-name store. It copies the primary name into a stack-local key builds a small dispatch frame and visits all registered-name entries through generic_callback_list_for_each where helper 0x0059db60 resolves the matching nested callback-entry record and invokes the descriptor function pointer at `[desc+0x08]` with the descriptor owner context plus the secondary key plus the payload cookie plus the owning registered-name entry. | rizin + llvm-objdump |
| 614 | 0x0059dcb0 | 48 | multiplayer_transport_update_registered_name_callback_key | shell | cdecl | inferred | rizin | 3 | Visits every registered-name entry through generic_callback_list_for_each and runs helper 0x0059dbf0 to rewrite one nested callback-entry key. The helper removes the existing nested record from `[entry+0x134]` copies the replacement key into the local record reinserts it through hashed_entry_table_upsert and conditionally emits transport opcode 8 through 0x0059b790 when the name entry is marked dirty and has owner callbacks installed. | rizin + llvm-objdump |
| 615 | 0x0059dce0 | 256 | multiplayer_transport_update_registered_name_callback_flags | shell | cdecl | inferred | rizin | 4 | Looks up one registered-name entry then resolves one nested callback-entry record by secondary key from the entry-owned callback table at `[entry+0x134]`. Depending on the caller mode flag it ORs or clears the caller bitmask against `[subentry+0xdc]` and when the parent entry has transport callbacks installed publishes an opcode-11 update through 0x0059b790 carrying the primary name plus the secondary key plus the new flag mask. | rizin + llvm-objdump |
| 616 | 0x0059de00 | 64 | multiplayer_transport_dispatch_registered_name_callbacks | shell | cdecl | inferred | rizin | 3 | If the owning transport is active at `[*this]` it walks the full registered-name store through generic_callback_list_for_each and helper 0x0059dde0 increments a dispatch count and invokes the caller-provided callback function for each live registered-name entry. | rizin + llvm-objdump |
| 617 | 0x0059de40 | 96 | multiplayer_transport_stage_registered_name_callback_payload | shell | cdecl | inferred | rizin | 3 | Resolves one nested callback-entry record by secondary key from the caller registered-name entry then copies a 0x18-byte payload block into `[subentry+0x80]` and a 0x40-byte payload block into `[subentry+0x98]` null-terminates both copied regions and sets the active flag at `[subentry+0xd8]` to one. | rizin + llvm-objdump |
| 618 | 0x0059dea0 | 96 | multiplayer_transport_stage_registered_name_callback_payload_for_name | shell | cdecl | inferred | rizin | 3 | Looks up one primary registered-name entry then fans helper multiplayer_transport_stage_registered_name_callback_payload across the registered-name store through generic_callback_list_for_each using the caller secondary key plus the two payload buffers. Current grounded role is a primary-name keyed payload staging wrapper for nested callback-entry records. | rizin + llvm-objdump |
| 619 | 0x0059df00 | 96 | multiplayer_transport_try_resolve_registered_name_callback_payload | shell | cdecl | inferred | rizin | 4 | Fast resolver for one nested callback-entry payload. When the descriptor either has no selector string or matches the shared two-byte default token at 0x005e1e1c it looks up the nested callback-entry record by key from `[entry+0x134]` and if the entry is active at `[subentry+0xd8]` marks the descriptor successful and returns pointers to the staged payload blocks at `[subentry+0x80]` and `[subentry+0x98]`. | rizin + llvm-objdump |
| 620 | 0x005934c0 | 30 | multiplayer_transport_next_work_sequence | shell | thiscall | inferred | ghidra-headless | 3 | Returns the next monotonically increasing transport work-sequence value by incrementing dword [this+0x177c] and clamping negative wraparound back to zero. Current grounded callers use the returned value when allocating transient transport records for text submission registration and related async work. | ghidra + rizin + llvm-objdump |
| 621 | 0x00593650 | 229 | multiplayer_transport_attach_callback_table_descriptor | shell | cdecl | inferred | ghidra-headless | 3 | Builds one transport-side callback-table descriptor from the caller table pointers and metadata. The helper allocates a temporary registration object through 0x005934e0 installs callback vectors from the 0x0059f5c0 and 0x0059f650 tables copies the caller transport pointer into the local stack frame and finishes by linking the result through 0x0058f2f0 and 0x005933a0. The current grounded caller is multiplayer_transport_register_callback_table. | ghidra + rizin + llvm-objdump |
| 622 | 0x00593d60 | 66 | multiplayer_transport_try_submit_text_record_fastpath | shell | cdecl | inferred | ghidra-headless | 3 | Attempts the fast submission path for one prepared transport text record. It allocates a type-9 transient record through 0x005934e0 and when that succeeds forwards the caller callback and payload through 0x0058e510 with callback shim 0x00593d00. The current grounded caller is multiplayer_transport_submit_text_record. | ghidra + rizin + llvm-objdump |
| 623 | 0x00598d50 | 496 | multiplayer_transport_handle_registered_name_callback_bind_record_mode1 | shell | cdecl | inferred | rizin | 3 | Owner-side wrapper for record mode 1 in the registered-name branch. It parses the mode prefix from the secondary key string at record field `+0x08` checks whether the primary name matches the local transport name at `[this+0x36c]` and either seeds one local registered-name entry through multiplayer_transport_upsert_registered_name_entry plus multiplayer_transport_set_registered_name_status_text or upserts one nested callback-entry record through multiplayer_transport_upsert_registered_name_callback_entry and emits follow-up opcode 6 or opcode 12 notifications when the target name entry is already marked dirty. | rizin + llvm-objdump |
| 624 | 0x00598f40 | 255 | multiplayer_transport_handle_registered_name_callback_remove_record_mode1 | shell | cdecl | inferred | rizin | 3 | Owner-side removal wrapper for registered-name record mode 1. It resolves the primary and secondary key strings from the caller record removes the matching nested callback-entry through multiplayer_transport_remove_registered_name_callback_entry and then emits opcode 7 or opcode 12 notifications from the current registered-name owner callbacks when the target entry is dirty. | rizin + llvm-objdump |
| 625 | 0x00599040 | 308 | multiplayer_transport_handle_registered_name_callback_remove_record_mode23 | shell | cdecl | inferred | rizin | 3 | Owner-side removal wrapper for registered-name record modes 2 and 3. It removes one nested callback-entry record by secondary key and then branches on whether the primary name matches the local transport name. The local-owner branch can emit opcode 5 and remove the whole registered-name entry through multiplayer_transport_remove_registered_name_entry while the remote branch emits opcode 7 subtype notifications through the installed owner callbacks. | rizin + llvm-objdump |
| 626 | 0x00599180 | 160 | multiplayer_transport_publish_registered_name_callback_remove_mode1 | shell | cdecl | inferred | rizin | 3 | Small publish helper for registered-name callback-removal mode 1. It removes the named nested callback-entry and then emits the same owner callback notifications as the wider mode-1 removal path through opcode 7 and opcode 12 when the target entry is dirty and callback-enabled. | rizin + llvm-objdump |
| 627 | 0x00599230 | 25 | multiplayer_transport_dispatch_registered_name_callback_remove_mode1 | shell | cdecl | inferred | rizin | 3 | Dispatch shim for registered-name callback-removal mode 1. When the input record kind equals 1 it forwards the primary name and one mode-1 removal helper descriptor into multiplayer_transport_dispatch_registered_name_callback_entry so the removal helper runs against each matching registered-name entry. | rizin + llvm-objdump |
| 628 | 0x00599250 | 160 | multiplayer_transport_publish_registered_name_callback_remove_mode3 | shell | cdecl | inferred | rizin | 3 | Small publish helper for registered-name callback-removal mode 3. It removes the named nested callback-entry and emits the mode-3 owner callback notifications through opcode 7 and opcode 12 when the target registered-name entry is dirty and callback-enabled. | rizin + llvm-objdump |
| 629 | 0x00599300 | 25 | multiplayer_transport_dispatch_registered_name_callback_remove_mode3 | shell | cdecl | inferred | rizin | 3 | Dispatch shim for registered-name callback-removal mode 3. When the input record kind equals 2 it forwards the primary name and one mode-3 removal helper descriptor into multiplayer_transport_dispatch_registered_name_callback_entry. | rizin + llvm-objdump |
| 630 | 0x00599320 | 93 | multiplayer_transport_handle_registered_name_display_text_record_mode2 | shell | cdecl | inferred | rizin | 4 | Owner-side wrapper for registered-name display-text record mode 2. It copies the record string into the inline display buffer through multiplayer_transport_set_registered_name_display_text and when the target registered-name entry has an installed owner callback emits opcode 9 carrying the primary name and copied display text. | rizin + llvm-objdump |
| 631 | 0x00599380 | 253 | multiplayer_transport_apply_registered_name_update_bundle | shell | cdecl | inferred | rizin | 4 | Applies one parsed update bundle to an existing registered-name entry. It walks the decoded element list from 0x00598630 and uses the element tags to route updates into multiplayer_transport_update_registered_name_callback_flags multiplayer_transport_set_registered_name_status_text and the header read or write pair multiplayer_transport_try_read_registered_name_header_block plus multiplayer_transport_set_registered_name_header_block before releasing the decoded bundle object. | rizin + llvm-objdump |
| 632 | 0x005997f0 | 177 | multiplayer_transport_handle_registered_name_display_text_record_mode3 | shell | cdecl | inferred | rizin | 3 | Owner-side wrapper for registered-name display-text record mode 3. It stores the supplied display text into the inline registered-name buffer and either resolves one pending template node through multiplayer_transport_find_pending_template_node plus multiplayer_transport_dispatch_pending_template_node or falls back to emitting opcode 9 through the installed owner callback for the target registered-name entry. | rizin + llvm-objdump |
| 633 | 0x005998b0 | 171 | multiplayer_transport_handle_registered_name_display_text_clear_record | shell | cdecl | inferred | rizin | 3 | Owner-side wrapper for clearing registered-name display text. It builds a small mode-2 template with the shared empty string and either satisfies that request through multiplayer_transport_find_pending_template_node plus multiplayer_transport_dispatch_pending_template_node or emits opcode 9 with the empty display text through the installed owner callback for the target registered-name entry. | rizin + llvm-objdump |
| 634 | 0x00599960 | 144 | multiplayer_transport_handle_pending_template_pair_record_mode3 | shell | cdecl | inferred | llvm-objdump | 3 | Structural mode-3 wrapper over the pending-template path. It builds one single-entry pending-template query from the pair of caller strings then resolves a matching node through multiplayer_transport_find_pending_template_node and dispatches it through multiplayer_transport_dispatch_pending_template_node. When no pending node exists it falls back to the transport-side callback at `[this+0x04]` through multiplayer_transport_dispatch_or_release_callback_binding. | llvm-objdump |
| 635 | 0x005999f0 | 412 | multiplayer_transport_handle_registered_name_callback_payload_record_mode8 | shell | cdecl | inferred | rizin | 3 | Owner-side wrapper for registered-name record mode 8. It stages the supplied nested callback-entry payload blocks through multiplayer_transport_stage_registered_name_callback_payload_for_name and then walks the returned template nodes to emit higher-level follow-up notifications including opcode 0x16 and opcode 0x17 based on the decoded template kinds and the marker characters found in the staged payload text through multiplayer_transport_find_pending_template_node plus multiplayer_transport_dispatch_pending_template_node. | rizin + llvm-objdump |
| 636 | 0x00599c40 | 96 | multiplayer_transport_copy_backslash_segment | shell | cdecl | inferred | llvm-objdump | 4 | Copies one backslash-delimited segment from the caller text into a freshly allocated heap string and writes the consumed byte count back through the out-parameter. Higher-level pending-template handlers reuse it to split multi-segment payloads before dispatch or callback fallback. | llvm-objdump |
| 637 | 0x00599ca0 | 320 | multiplayer_transport_handle_segment_list_template_record_mode4 | shell | cdecl | inferred | llvm-objdump | 3 | Mode-4 pending-template wrapper for template kind 0x0c. It resolves one pending node through multiplayer_transport_find_pending_template_node splits the caller payload into a temporary heap string list with multiplayer_transport_copy_backslash_segment and then either dispatches that list through multiplayer_transport_dispatch_pending_template_node or falls back to emitting opcode 0x1e through the node-owned callback path before freeing the temporary segments. | llvm-objdump |
| 638 | 0x00599de0 | 128 | multiplayer_transport_handle_pair_template_record_mode4 | shell | cdecl | inferred | llvm-objdump | 3 | Compact mode-4 pending-template wrapper for template kind 0x0c. After multiplayer_transport_find_pending_template_node succeeds it forwards two dword values from the matched node-owned payload block into one simple dispatch descriptor and completes the request through multiplayer_transport_dispatch_pending_template_node. | llvm-objdump |
| 639 | 0x00599e60 | 768 | multiplayer_transport_handle_segment_broadcast_template_record_mode5 | shell | cdecl | inferred | llvm-objdump | 3 | Structural mode-5 pending-template wrapper over split payload broadcasting. One branch matches a fixed token and walks the registered-name owner callback list to emit opcode 0x1d once per backslash-delimited segment. The other branch resolves one template-kind 0x0d pending node builds a temporary split-string array with multiplayer_transport_copy_backslash_segment optionally appends node-owned paired strings and then either dispatches the finished descriptor through multiplayer_transport_dispatch_pending_template_node or falls back to opcode 0x1f through the node callback path. | llvm-objdump |
| 640 | 0x0059a160 | 128 | multiplayer_transport_handle_triplet_template_record_mode4 | shell | cdecl | inferred | llvm-objdump | 3 | Compact mode-4 pending-template wrapper for template kind 0x0d. After multiplayer_transport_find_pending_template_node succeeds it forwards the caller primary string plus two dword fields from the matched node payload block through multiplayer_transport_dispatch_pending_template_node. | llvm-objdump |
| 641 | 0x0059a1e0 | 1024 | multiplayer_transport_handle_segment_pair_template_record_mode4 | shell | cdecl | inferred | llvm-objdump | 3 | Structural mode-4 sibling of the split-payload template path for template kind 0x0e. One branch matches the fixed auxiliary token and emits opcode 0x1d once per backslash-delimited segment through the installed registered-name owner callbacks. The other branch resolves one pending node builds a temporary split-string array with multiplayer_transport_copy_backslash_segment appends paired node-owned strings and completes the request through multiplayer_transport_dispatch_pending_template_node. | llvm-objdump |
| 642 | 0x0059a650 | 64 | multiplayer_transport_mark_pending_template_kind1_ready | shell | cdecl | inferred | llvm-objdump | 3 | Small pending-template helper that looks up one kind-1 node through multiplayer_transport_find_pending_template_node and sets the first dword in its payload block to one when present. | llvm-objdump |
| 643 | 0x0059a690 | 448 | multiplayer_transport_stage_pending_template_triplet_record_mode4 | shell | cdecl | inferred | llvm-objdump | 3 | Mode-4 helper for pending-template kind 1. It resolves one kind-1 node through multiplayer_transport_find_pending_template_node duplicates the caller strings plus one normalized helper string into heap storage emits opcode 0x0e through 0x0059b790 using the node-owned callback metadata and appends the three staged values into the node payload's parallel pointer arrays for later dispatch. | llvm-objdump |
| 644 | 0x0059a850 | 112 | multiplayer_transport_dispatch_pending_template_quintuple_helper | shell | cdecl | inferred | llvm-objdump | 3 | Small helper that resolves one kind-5 pending-template node through multiplayer_transport_find_pending_template_node and forwards the four dword payload fields stored at `[node+0x1c+0x04..0x10]` through multiplayer_transport_dispatch_pending_template_node. | llvm-objdump |
| 645 | 0x0059a8c0 | 272 | multiplayer_transport_handle_registered_name_update_bundle_record_mode3plus | shell | cdecl | inferred | llvm-objdump | 3 | Owner-side registered-name update handler for record kinds 3 and above. It decodes one update bundle through 0x00598630 and 0x00598860 tries the registered-name header read or write path through multiplayer_transport_try_read_registered_name_header_block plus multiplayer_transport_set_registered_name_header_block publishes opcode 0x0a when the target entry already has owner callbacks and then completes any waiting kind-5 pending-template node through multiplayer_transport_find_pending_template_node plus multiplayer_transport_dispatch_pending_template_node. | llvm-objdump |
| 646 | 0x0059a9d0 | 320 | multiplayer_transport_handle_pending_template_triplet_record_mode6 | shell | cdecl | inferred | llvm-objdump | 3 | Mode-6 pending-template wrapper that looks up either a kind-4 or kind-7 node through multiplayer_transport_find_pending_template_node. The kind-4 branch copies three caller strings into the node-owned payload slots while the kind-7 branch formats a derived string through 0x0059cbd0 and completes the request through multiplayer_transport_dispatch_pending_template_node. | llvm-objdump |
| 647 | 0x0059ab10 | 256 | multiplayer_transport_handle_token_list_template_record_mode3 | shell | cdecl | inferred | llvm-objdump | 3 | Mode-3 pending-template helper for kind 4. It parses the caller text into a token list with 0x005a3db9 trims leading `-` `@` and `+` markers duplicates each token into heap storage and appends the cleaned strings into the node-owned dynamic vector after multiplayer_transport_find_pending_template_node succeeds. | llvm-objdump |
| 648 | 0x0059ac10 | 144 | multiplayer_transport_dispatch_extended_template_record_mode3 | shell | cdecl | inferred | llvm-objdump | 3 | Mode-3 helper for kind-4 pending-template nodes. After multiplayer_transport_find_pending_template_node succeeds it builds one extended dispatch descriptor from the caller string a boolean derived from the first payload dword and the remaining four dwords stored in the node payload block then completes the request through multiplayer_transport_dispatch_pending_template_node. | llvm-objdump |
| 649 | 0x0059aca0 | 176 | multiplayer_transport_append_string_template_record_mode8 | shell | cdecl | inferred | llvm-objdump | 3 | Helper for pending-template kind 8. It resolves one node through multiplayer_transport_find_pending_template_node grows the node-owned pointer vector through tracked_heap_resize_with_header duplicates the caller string and appends that heap string to the vector. | llvm-objdump |
| 650 | 0x0059ad50 | 112 | multiplayer_transport_dispatch_string_vector_template_record_mode3 | shell | cdecl | inferred | llvm-objdump | 3 | Mode-3 dispatch helper for pending-template kind 8. It resolves one node through multiplayer_transport_find_pending_template_node then forwards the caller key together with the node-owned string-count and string-vector pointers through multiplayer_transport_dispatch_pending_template_node. | llvm-objdump |
| 651 | 0x0059adc0 | 96 | multiplayer_transport_handle_local_name_record_mode2 | shell | cdecl | inferred | llvm-objdump | 4 | Mode-2 transport-state setter for the local name buffer at `[this+0x36c]`. It copies the caller string into that fixed buffer clears state dword `[this+0x04]` sets active flag `[this+0x00]` and when the transport owner callback at `[this+0x14]` is installed invokes it with mode `1` and the owner cookie at `[this+0x18]`. | llvm-objdump |
| 652 | 0x0059ae20 | 176 | multiplayer_transport_handle_transport_text_pair_record_mode3 | shell | cdecl | inferred | llvm-objdump | 3 | Mode-3 transport-state setter for a pair of fixed text buffers. It copies the caller strings into the fixed buffers at `[this+0x564]` and `[this+0x140]` updates the associated length or dirty fields through helpers 0x005a1050 and 0x005a0d00 marks `[this+0x13c]` active and refreshes the transport-side status line rooted at `[this+0x1c]` through 0x0059caf0. | llvm-objdump |
| 653 | 0x0059aed0 | 112 | multiplayer_transport_handle_normalized_pair_template_record_mode3 | shell | cdecl | inferred | llvm-objdump | 3 | Mode-3 wrapper that normalizes the secondary caller string through 0x005a1ea5 then resolves one kind-0x10 pending-template node through multiplayer_transport_find_pending_template_node and completes it through multiplayer_transport_dispatch_pending_template_node with the normalized value plus the original secondary string. | llvm-objdump |
| 654 | 0x00597920 | 56 | multiplayer_transport_find_pending_template_kind0c_by_key | shell | cdecl | inferred | llvm-objdump | 4 | Searches the linked pending-template list rooted at `[this+0x550]` for the first kind-0x0c node whose payload string at `[node+0x1c+0x08]` exactly matches the caller key. It returns the matched node or null. | llvm-objdump |
| 655 | 0x0059af40 | 186 | multiplayer_transport_dispatch_fallback_template_record_mode3 | shell | cdecl | inferred | llvm-objdump | 3 | Mode-3 fallback wrapper over the pending-template path. It first queries for either a kind-1 or kind-5 node keyed by the caller string through multiplayer_transport_find_pending_template_node and dispatches the matching node through multiplayer_transport_dispatch_pending_template_node with a minimal descriptor. When neither node exists it falls back to multiplayer_transport_find_pending_template_kind0c_by_key and completes that node with an empty descriptor instead. | llvm-objdump |
| 656 | 0x0059b000 | 103 | multiplayer_transport_dispatch_kind1_string_template_record_mode6 | shell | cdecl | inferred | llvm-objdump | 3 | Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `6` and the original string payload. | llvm-objdump |
| 657 | 0x0059b070 | 103 | multiplayer_transport_dispatch_kind1_string_template_record_mode2 | shell | cdecl | inferred | llvm-objdump | 3 | Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `2` and the original string payload. | llvm-objdump |
| 658 | 0x0059b0e0 | 103 | multiplayer_transport_dispatch_kind1_string_template_record_mode3 | shell | cdecl | inferred | llvm-objdump | 3 | Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `3` and the original string payload. | llvm-objdump |
| 659 | 0x0059b150 | 103 | multiplayer_transport_dispatch_kind1_string_template_record_mode4 | shell | cdecl | inferred | llvm-objdump | 3 | Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `4` and the original string payload. | llvm-objdump |
| 660 | 0x0059b1c0 | 103 | multiplayer_transport_dispatch_kind1_string_template_record_mode5 | shell | cdecl | inferred | llvm-objdump | 3 | Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `5` and the original string payload. | llvm-objdump |
| 661 | 0x0059b230 | 103 | multiplayer_transport_dispatch_kind1_string_template_record_mode8 | shell | cdecl | inferred | llvm-objdump | 3 | Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `8` and the original string payload. | llvm-objdump |
| 662 | 0x0059b2a0 | 1 | multiplayer_transport_noop_cleanup_callback | shell | cdecl | inferred | llvm-objdump | 2 | Trivial no-op cleanup callback that returns immediately. Current grounded role is as a placeholder callback target in the transport cleanup layer. | llvm-objdump |
| 663 | 0x0059b2b0 | 17 | multiplayer_transport_release_optional_callback_binding | shell | cdecl | inferred | llvm-objdump | 2 | Small cleanup helper that checks the optional callback binding stored at `[this+0x04]` and when present forwards it into multiplayer_transport_dispatch_or_release_callback_binding with mode `1`. | llvm-objdump |
| 664 | 0x0059b2d0 | 8 | multiplayer_transport_free_template_entry_owner_string | shell | cdecl | inferred | llvm-objdump | 3 | Small element cleanup helper that releases the owner string pointer stored at `[entry+0x14]` through tracked_heap_free_with_header. The companion pending-template container uses it as the per-element cleanup callback when destroying its flat vector. | llvm-objdump |
| 665 | 0x0059b2e0 | 1239 | multiplayer_transport_destroy_pending_template_dispatch_record | shell | cdecl | inferred | llvm-objdump | 3 | Type-switched destructor for one pending-template dispatch record. It reads the record kind at `[record+0x00]` and frees the owned payload graph under `[record+0x08]` through tracked_heap_free_with_header including nested string arrays and paired pointer vectors for the more complex template kinds before finally releasing the top-level payload block itself. | llvm-objdump |
| 666 | 0x0059b710 | 40 | multiplayer_transport_init_pending_template_dispatch_store | shell | thiscall | inferred | llvm-objdump | 3 | Initializes the companion flat pending-template dispatch store at `[this+0x55c]` by allocating a stride-0x18 contiguous vector through 0x0059e0b0 and installing multiplayer_transport_free_template_entry_owner_string as the per-element cleanup callback. Returns true on success. | llvm-objdump |
| 667 | 0x0059b740 | 74 | multiplayer_transport_destroy_pending_template_dispatch_store | shell | thiscall | inferred | llvm-objdump | 3 | Destroys the companion flat pending-template dispatch store at `[this+0x55c]`. It walks every live element through multiplayer_transport_destroy_pending_template_dispatch_record and then releases the backing vector through generic_vector_destroy. | llvm-objdump |
| 668 | 0x0059c220 | 458 | multiplayer_transport_dispatch_pending_template_dispatch_record | shell | unknown | inferred | rizin | 3 | Switch-driven dispatcher for one flat pending-template dispatch-store record after the store manager has removed it from the vector. It reads the record kind at `[record+0x00]` invokes the record-owned callback at `[record+0x04]` with a payload tuple rooted at `[record+0x08]` and the owner string or selector at `[record+0x0c]` and then destroys the record through multiplayer_transport_destroy_pending_template_dispatch_record. Case `16` also resolves the registered-name dirty flag through 0x0059d9c0 before invoking the callback. | rizin + llvm-objdump |
| 669 | 0x0059c470 | 203 | multiplayer_transport_service_pending_template_dispatch_store | shell | unknown | inferred | rizin | 3 | Services the flat pending-template dispatch store at `[this+0x55c]`. It walks every live 0x18-byte entry; entries whose owner string at `[entry+0x14]` no longer resolves through multiplayer_transport_has_registered_name are destroyed and erased immediately, while surviving entries are dispatched only when their registered-name dirty flag is nonzero and the optional filter value in EDX is zero or matches `[entry+0x10]`. Dispatching copies the 0x18-byte record to stack storage, erases the vector slot, and forwards the copied record into multiplayer_transport_dispatch_pending_template_dispatch_record. | rizin + llvm-objdump |
| 670 | 0x0059c540 | 70 | multiplayer_transport_find_pending_template_dispatch_record_index | shell | unknown | inferred | rizin | 4 | Searches the flat pending-template dispatch store at `[this+0x55c]` for the first record whose selector or request field at `[entry+0x10]` matches the caller key. It returns the zero-based vector index on success or `-1` when no record matches. | rizin + llvm-objdump |
| 671 | 0x0059c590 | 21 | multiplayer_transport_has_pending_template_dispatch_record | shell | unknown | inferred | rizin | 4 | Boolean wrapper over multiplayer_transport_find_pending_template_dispatch_record_index. It returns true when the flat pending-template dispatch store currently contains one record for the caller key and false otherwise. | rizin + llvm-objdump |
| 672 | 0x0059c5b0 | 40 | growable_text_buffer_init | support | unknown | inferred | rizin | 3 | Initializes one heap-backed growable text buffer structure. It clears the used-length field at `[buf+0x04]`, seeds the initial capacity at `[buf+0x08]` to `0x2000`, allocates a `0x2001`-byte NUL-terminated backing block through tracked_heap_alloc_with_header, stores that pointer at `[buf+0x00]`, and returns true on success. | rizin + llvm-objdump |
| 673 | 0x0059c5e0 | 3 | growable_text_buffer_free | support | unknown | inferred | rizin | 4 | Small wrapper that frees the heap-backed buffer pointer stored at `[buf+0x00]` through tracked_heap_free_with_header. | rizin + llvm-objdump |
| 674 | 0x0059c5f0 | 65 | growable_text_buffer_reserve_append | support | unknown | inferred | rizin | 4 | Ensures that one growable text buffer has room to append the requested byte count in ECX while preserving a trailing NUL terminator. When `[buf+0x04] + requested` would exceed capacity `[buf+0x08]` it rounds the new capacity up in 0x2000-byte chunks resizes the backing block through tracked_heap_resize_with_header stores the new pointer at `[buf+0x00]` and updates `[buf+0x08]` before returning success or failure. | rizin + llvm-objdump |
| 675 | 0x0059c670 | 76 | multiplayer_transport_text_stream_init | shell | thiscall | inferred | rizin | 3 | Initializes one multiplayer transport text-stream object. It zeroes the 0x350-byte state block seeds socket `[this+0x00]` to `-1` and allocates two growable text buffers at `[this+0x108]` and `[this+0x114]` through growable_text_buffer_init. Failure to allocate the second buffer frees the first and returns false. | rizin + llvm-objdump |
| 676 | 0x0059c790 | 194 | multiplayer_transport_text_stream_destroy | shell | thiscall | inferred | rizin | 4 | Destroys one multiplayer transport text-stream object. If socket `[this+0x00]` is live it shuts it down with `shutdown(..., 2)` and `closesocket`, marks state `[this+0x04]` as closed, frees the two growable text buffers at `[this+0x108]` and `[this+0x114]`, releases the fixed pointer fields at `[this+0x328]` through `[this+0x344]`, then walks and frees the pointer vector rooted at `[this+0x348]` before freeing that vector itself. | rizin + llvm-objdump |
| 677 | 0x0059c860 | 300 | multiplayer_transport_select_socket_ready_flags | shell | cdecl | inferred | rizin | 4 | Small `select` wrapper for one transport socket. It takes the socket on the stack plus up to three optional out-pointers for read write and exception readiness, builds the requested `fd_set` structures on the stack, calls `select(0x40, ...)` with a null timeout, and stores `1` or `0` into each requested out-slot depending on whether `__WSAFDIsSet` reports that socket as ready. | rizin + llvm-objdump |
| 678 | 0x0059c990 | 113 | multiplayer_transport_text_stream_send_pump | shell | thiscall | inferred | rizin | 4 | Attempts to flush queued bytes from the transport text-stream send buffer at `[this+0x114]`. While buffered length `[this+0x118]` remains nonzero it probes writability through multiplayer_transport_select_socket_ready_flags, sends up to `min(len, 0x400)` bytes with `send`, slides any remaining buffered bytes down through `0x0059c640`, and continues until the socket is no longer writable or the buffer is empty. | rizin + llvm-objdump |
| 679 | 0x0059ca10 | 190 | multiplayer_transport_text_stream_recv_pump | shell | thiscall | inferred | rizin | 3 | Receives available socket text into the transport text-stream receive buffer at `[this+0x108]`. It first probes readability through multiplayer_transport_select_socket_ready_flags then repeatedly reserves 0x1000 bytes through growable_text_buffer_reserve_append calls `recv` into the free tail of the buffer optionally applies the stream-cipher helper at 0x005a0f70 when `[this+0x120]` is armed advances the used-length field at `[this+0x10c]` NUL-terminates the buffer and loops while readability remains set. Socket errors store closed-state value `2` into `[this+0x04]`. | rizin + llvm-objdump |
| 680 | 0x0059cad0 | 25 | multiplayer_transport_text_stream_service_io | shell | thiscall | inferred | rizin | 4 | Services one multiplayer transport text-stream I/O step unless state `[this+0x04]` is already closed. It first flushes queued outbound bytes through multiplayer_transport_text_stream_send_pump and then pumps inbound socket text through multiplayer_transport_text_stream_recv_pump. | rizin + llvm-objdump |
| 681 | 0x0059caf0 | 216 | multiplayer_transport_text_stream_append_crlf_line | shell | thiscall | inferred | rizin | 4 | Appends one caller text line plus `\\r\\n` to the transport text-stream send buffer at `[this+0x114]`. It ignores requests when state `[this+0x04]` is already closed, reserves `strlen(text) + 2` bytes through growable_text_buffer_reserve_append, copies the bytes into the current tail tracked by `[this+0x118]`, appends CRLF, and updates the used-length field. When the stream-cipher gate at `[this+0x120]` is armed it post-processes the newly appended span through 0x005a0f70 using the send-side cipher state rooted at `[this+0x226]`. | rizin + llvm-objdump |
| 682 | 0x00597880 | 159 | multiplayer_transport_find_pending_template_node | shell | cdecl | inferred | rizin | 4 | Searches the linked pending-template list rooted at `[this+0x550]` for the first node whose caller-provided query tuple array matches the node kind and its primary and secondary string selectors. When it finds a match it refreshes the node timeout field at `[node+0x04]` from GetTickCount plus 0xea60 and returns that node pointer otherwise it returns null. | rizin + llvm-objdump |
| 683 | 0x005979d0 | 1164 | multiplayer_transport_dispatch_pending_template_node | shell | cdecl | inferred | rizin | 3 | Consumes one pending-template node and one caller dispatch descriptor. Depending on the node kind it emits one or more transport notifications through 0x0059b790 using the node-owned strings arrays and callback state then releases the node-owned heap strings arrays and child lists before unlinking the node from the pending-template list. Higher-level registered-name wrappers reuse it as the common completion path after multiplayer_transport_find_pending_template_node succeeds. | rizin + llvm-objdump |
| 684 | 0x005996c0 | 304 | multiplayer_transport_handle_pending_template_record_mode3 | shell | cdecl | inferred | llvm-objdump | 3 | Structural mode-3 wrapper over the pending-template path for registered-name updates. It normalizes the caller selector string against the shared default token at 0x005e1e1c builds a four-way pending-template query and dispatches the matched node through multiplayer_transport_dispatch_pending_template_node. Depending on the matched node kind it can mark the registered-name entry dirty through multiplayer_transport_mark_registered_name_dirty or forward the node-owned payload fields into the dispatch descriptor. | llvm-objdump |
| 685 | 0x00565c90 | 208 | shell_queue_indexed_world_anchor_marker | shell | cdecl | inferred | ghidra-headless | 3 | Variant world-anchor marker emitter that selects one indexed entry from the owner table at +0x24 using byte [this+0xd8] derives scale and packed color from the entry fields and enqueues the resulting type-0x01 deferred message through shell_enqueue_deferred_message_type1. | ghidra + rizin + llvm-objdump |
| 686 | 0x005662a0 | 964 | shell_emit_sprite_billboard_quad_vertex24 | bootstrap | thiscall | inferred | ghidra-headless | 4 | Expands one sprite billboard into six vertex24 records forming two textured triangles. It derives an alpha byte from item timing flags at [this+0x48] [this+0x4c] and [this+0x5c] combines that alpha with packed color [this+0x70] scales a prepared four-corner basis by [this+0x44] and writes six 24-byte vertices using atlas uv pairs from [this+0x2c..0x38]. | ghidra + rizin + llvm-objdump |
| 687 | 0x00566670 | 84 | shell_prepare_sprite_billboard_basis | bootstrap | thiscall | inferred | ghidra-headless | 3 | Builds the temporary four-corner sprite-billboard basis used by 0x005662a0 from the current shell transform state and writes the result into global scratch vectors around 0x00d97ae0 and 0x00d97b98. | ghidra + rizin + llvm-objdump |
| 688 | 0x0055e2b0 | 179 | shell_create_layout_state | bootstrap | thiscall | inferred | ghidra-headless | 4 | Allocates a 0x3715-byte layout-state object for the shell controller stores it at [this+0x2d] seeds the dirty flags invokes 0x0054bc10 with owner state and a template byte from the shell bundle then binds the first presentation asset bundle through 0x00543f10 before later update hooks run. | ghidra + rizin |
| 689 | 0x005679b0 | 569 | shell_emit_animated_quad_vertex24 | bootstrap | thiscall | inferred | ghidra-headless | 4 | Expands one cell-list item into four `vertex24` corner records with a time-varying color phase. The helper derives an 8-step brightness cycle from GetTickCount plus item field [this+0x3a] combines that phase with per-corner bytes at +0x35 through +0x38 and mask bytes at +0x31 through +0x34 and writes four 24-byte vertices from the quad corner positions stored across +0x00..+0x2c. | ghidra + rizin + llvm-objdump |
| 690 | 0x00567c70 | 103 | shell_stream_primary_cell_quad_list | bootstrap | thiscall | inferred | ghidra-headless | 4 | Streams the primary quad-item list rooted at [this+0x1c] into the caller's `vertex24` buffer. It seeds the shared color input through 0x00d97bbc iterates each list entry through 0x005679b0 and advances the destination pointer by count*0x90 for four vertices per item. | ghidra + rizin + llvm-objdump |
| 691 | 0x00567ce0 | 105 | shell_stream_alternate_cell_quad_list | bootstrap | thiscall | inferred | ghidra-headless | 4 | Streams the alternate quad-item list rooted at [this+0x20] into the caller's `vertex24` buffer using the same quad writer at 0x005679b0. Unlike the primary path it forwards an extra caller-supplied selector value into each emitted quad before advancing the destination pointer by count*0x90. | ghidra + rizin + llvm-objdump |
| 692 | 0x005a644d | 81 | __heap_init | startup | cdecl | inferred | ghidra-headless | 4 | Initializes the CRT heap path via ___heap_select and ___sbh_heap_init before later allocations occur. | ghidra + rizin |
| 693 | 0x005abd49 | 111 | startup_init_tls_state | startup | unknown | inferred | ghidra-headless | 3 | Initializes per-thread startup state: mt locks plus TLS slot allocation and current-thread bookkeeping. | ghidra + rizin |
| 694 | 0x005abf1b | 510 | startup_init_file_handle_table | startup | cdecl | inferred | ghidra-headless | 4 | Allocates and seeds the CRT file descriptor table then consumes STARTUPINFO handles and classifies inherited std handles. | ghidra + rizin |
| 695 | 0x005aca5d | 61 | startup_run_init_callback_table | startup | unknown | inferred | ghidra-headless | 3 | Walks a startup callback table and invokes non-null entries before continuing the CRT path. | ghidra + rizin |
| 696 | 0x005ad12d | 199 | __setenvp | startup | cdecl | inferred | ghidra-headless | 4 | Builds the process envp array by counting environment strings and splitting name/value entries around '='. | ghidra + rizin |
| 697 | 0x005ad360 | 162 | startup_build_argv | startup | cdecl | inferred | ghidra-headless | 3 | Initializes the multibyte table and uses a two-pass helper to count and copy argv entries from the process command line. | ghidra + rizin |
| 698 | 0x005ad402 | 290 | ___crtGetEnvironmentStringsA | startup | cdecl | inferred | ghidra-headless | 4 | Copies the Windows environment block into CRT-owned storage before envp construction. | ghidra + rizin |