rrt/artifacts/exports/rt3-1.06/function-map.csv

address,size,name,subsystem,calling_convention,prototype_status,source_tool,confidence,notes,verified_against
0x004010f0,521,city_compute_connection_bonus_candidate_weight,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Computes one city-side weight for the connection-bonus news and placement lanes. The helper rejects early when the city subtype field `[this+0x23e]` is nonzero, then builds a base float from the city-side scalar fields `[this+0x306]`, `[this+0x30a]`, and `[this+0x30e]`. When the optional stack company id is nonzero it also resolves the city's derived coordinates through `0x00455800` and `0x00455810`, probes the live world root at `0x0062c120` through `0x0044e270`, and rejects the city unless the selected company passes the follow-on world-side ownership or access check through `0x00424010`. The helper then scans the live placed-structure collection at `0x006cec20`, filters peers through `0x0041f6e0` plus the linked-instance class test `0x0047de00 -> 0x0040c990 == 1`, counts qualifying linked sites in the city, and detects whether one rival company already has an eligible linked site there. The final weight is scaled down by the inverse of `(qualifying_site_count + 1)` and then further damped when rival ownership is present, so the current grounded meaning is a city connection-bonus opportunity weight rather than a simple population or size score. Current grounded callers are the company-side news sweep at `0x00406050` and one neighboring setup-side branch at `0x00404d90`.","objdump + caller xrefs + callsite inspection + city-bonus correlation"
0x004014b0,1194,company_try_buy_unowned_industry_near_city_and_publish_news,simulation,thiscall,inferred,objdump + callsite inspection + RT3.lng strings,2,"Company-side acquisition and headline helper beneath the broader periodic company service pass at `0x004019e0`. The function requires at least two linked transit sites through `company_count_linked_transit_sites` `0x00426590`, rejects when scenario finance toggle `[0x006cec78+0x4abf]` is set, and then scans the live building or structure collection at `0x0062b26c` for the best current acquisition target. Current grounded candidate filters are: the record must not already have an owner in `[site+0x276]`, its linked candidate subtype gate through `0x0040d360` must identify subtype `4`, the company-specific price or affordability metric from `0x0040d540` must stay below the current company metric window, and the record must be at least three years old from `[site+0x3d5]`. Surviving candidates are scored through local profitability or demand helpers around `0x0040cac0`, `0x0042c820`, `0x00455f60`, and the current company support scalar, and the best surviving site id is then committed through `0x004269b0`. On success the helper localizes the acquired structure type through `localization_lookup_display_label_by_stem_or_fallback` `0x0051c920`, resolves the nearby city or region entry through `0x004220b0`, and emits RT3.lng `2880` `%1 has bought a %2 near %3` through the shell news helper at `0x004554e0`. This is now the strongest current match for the acquisition-side sibling beneath the broader company periodic pass, though some lower structure-side helper semantics remain open.","objdump + callsite inspection + RT3.lng strings + acquisition-news correlation + structure-scan correlation"
0x00401860,221,company_query_cached_linked_transit_route_anchor_entry_id,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Returns one cached route-entry anchor id used by the linked-transit company cache family. The helper first validates the cached id at `[this+0x0d35]` against the live route-entry collection `0x006cfca8`, requiring the resolved record to carry this company id in word `[entry+0x22e]` and byte value `2` in `[entry+0x216]`; otherwise it clears the cache to `-1`. When the cache is empty but the three company-side count lanes `[this+0x7664]`, `[this+0x7668]`, and `[this+0x766c]` still sum positive, it scans the route-entry collection for the first record that satisfies those same owner and class predicates and then caches the record's linked anchor id from `[entry+0x202]`. Current grounded caller is `placed_structure_is_linked_transit_site_reachable_from_company_route_anchor` `0x004801a0`, where the returned route-entry id is used as the company-side anchor for the narrower linked-transit reachability gate.","objdump + caller xrefs + callsite inspection + route-entry-anchor correlation"
0x00401940,152,company_reset_linked_transit_caches_and_reseed_empty_train_routes,simulation,thiscall,inferred,objdump + callsite inspection + linked-transit correlation,2,"Small linked-transit reset helper beneath the broader company service family. The function clears the two company-side linked-transit cache timestamps at `[this+0x0d3e]` and `[this+0x0d3a]`, immediately re-enters `company_service_linked_transit_site_caches` `0x00409720`, and then walks the live train collection `0x006cfcbc` for company-owned trains. For owned trains in operating modes `0x0a` or `0x13` it removes every existing route-list entry through `train_route_list_remove_entry_and_compact` `0x004b3000`; when the route list is empty it then re-enters `train_try_append_linked_transit_autoroute_entry` `0x00409770`. Current grounded meaning is a local linked-transit cache reset plus empty-route reseed pass rather than a broader train-service sweep.","objdump + callsite inspection + linked-transit correlation + train-route-reset correlation"
0x004019e0,611,company_service_periodic_city_connection_finance_and_linked_transit_lanes,simulation,thiscall,inferred,objdump + callsite inspection + caller correlation + RT3.lng strings,2,"Broader periodic company-side service pass above the currently grounded city-connection, finance, and linked-transit lanes. The helper first rejects inactive or special-case companies through `[this+0x3f]` and `0x00425b90`, clears the transient company-side latches at `[this+0x0d17]`, `[this+0x0d18]`, and `[this+0x0d56]`, and temporarily mirrors one locomotive-derived byte from `[this+0x0d17]` into scenario field `[0x006cec78+0x4c74]` while the earlier route-building side of the body runs, restoring the original scenario value on exit. Current evidence now bounds those byte latches more narrowly: `[this+0x0d17]` is this transient route-search preference override, currently seeded only when `company_select_preferred_available_locomotive_id` `0x004078a0` resolves one locomotive whose engine-type dword `[record+0x10]` equals `2`; wider engine-type evidence now makes that best-read as the electric lane, since the linked approval helper around `0x0041d550` dispatches the same `0/1/2` field across three scenario opinion slots while the local language family `706..709` and help text `3848` bound the player-facing triplet as `Steam`, `Diesel`, and `Electric`. The route-search side is tighter now too: this mirrored byte is not just reusing a display preference slot abstractly, it feeds the same initial path-sweep branch in `route_entry_collection_run_initial_candidate_path_sweep` `0x0049bd40` that explicit route-policy byte `4` uses, selecting the larger `1.8` quality multiplier instead of `1.4` before the later acceptance checks. `[this+0x0d18]` is the city-connection announcement-side latch reused by `company_evaluate_and_publish_city_connection_bonus_news` `0x00406050`; and `[this+0x0d56]` is the linked-transit train-service latch later set by the train-add, train-upgrade, and route-builder-side cache-refresh family around `0x00409830`, `0x00409300`, and `0x0040457e -> 0x004093d0`. The ordering matters too: this owner clears those latches up front, runs the city-connection and linked-transit branches first, and only later enters `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`, so the finance helper is reading same-cycle side-channel state rather than stale long-lived flags. It then gates and schedules several narrower service families: the city-connection announcement side through `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0` and `company_evaluate_and_publish_city_connection_bonus_news` `0x00406050`; the acquisition-side sibling through `company_try_buy_unowned_industry_near_city_and_publish_news` `0x004014b0`; the linked-transit train side through `company_balance_linked_transit_train_roster` `0x00409950`; the broader annual finance and governance helper through `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`; and the linked-transit cache refresh tail through either `company_rebuild_linked_transit_site_peer_cache` `0x004093d0` or `company_rebuild_linked_transit_autoroute_site_score_cache` `0x00407bd0` depending on current scenario mode byte `[0x006cec78+0x0f]`. This name stays intentionally conservative: it is the broader periodic owner above those lanes, not a fully split policy map yet.","objdump + callsite inspection + caller correlation + RT3.lng strings + linked-transit correlation + city-connection correlation + acquisition correlation + latch correlation + sequencing correlation + temporary-route-preference correlation + locomotive-choice correlation + engine-type correlation + route-search-threshold correlation"
0x004078a0,815,company_select_preferred_available_locomotive_id,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Selects one preferred locomotive id for the current company from the live locomotive collection at `0x006ada84`. The helper iterates the live locomotive records, applies company-and-chairman availability gating through the linked approval family around `0x0041d550`, accumulates one weighted preference score from locomotive fields `[record+0x20]`, `[+0x28]`, `[+0x18]`, `[+0x1c]`, `[+0x0c]`, and the linked class or era record at `[record+0x72]`, and keeps the strongest surviving locomotive id, falling back to `locomotive_collection_select_best_era_matched_non_electric_fallback_id` `0x00461cd0` when no scored candidate survives. Current grounded callers are the periodic company service pass `0x004019e0`, the temporary route-side mode chooser around `0x00402d5f`, the linked-transit train-upgrade news helper `0x00409300`, and the linked-transit train-add helper `0x00409830`. Current evidence now also bounds one route-policy side effect above it: `0x004019e0` only arms its temporary `[company+0x0d17] -> [0x006cec78+0x4c74]` override when the chosen locomotive record carries engine-type value `2` in `[record+0x10]`, which now best aligns with the electric lane rather than an unnamed class slot.","objdump + caller xrefs + callsite inspection + locomotive-collection correlation + preferred-choice correlation + engine-type correlation"
0x00401c50,3016,company_evaluate_annual_finance_policy_and_publish_news,simulation,thiscall,inferred,objdump + callsite inspection + RT3.lng strings,2,"Large annual company finance-policy helper beneath the broader periodic service pass at `0x004019e0`. The earliest creditor-pressure or bankruptcy lane is now bounded more tightly: it requires scenario mode `0x0c`, the bankruptcy toggle `[0x006cec78+0x4a8f]` to be clear, at least `13` years since the last bankruptcy stamp at `[this+0x163]`, and at least `4` years since founding year `[this+0x157]`. It then scans the last three years of derived finance lanes through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0`, accumulating the net-profits lane `0x2b`, counting one three-year failure condition from the revenue aggregate `0x2c`, selecting one negative cash-and-debt stress ladder `-600000 / -1100000 / -1600000 / -2000000` from the current slot-`0x2c` band split at roughly `120000 / 230000 / 340000`, requiring the current support-adjusted share-price scalar from `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` to be at least `15` or `20` depending on whether all three years failed, checking the current fuel-cost lane in slot `0x09` against `0.08` times that ladder, and requiring both `edi >= 2` plus the three-year slot-`0x2b` accumulator to clear one final `-60000` threshold before it commits bankruptcy through `company_declare_bankruptcy_and_halve_bond_debt` `0x00425a90` and formats RT3.lng `2881` `%1 has declared bankruptcy!`. The helper also has one later deep-distress fallback bankruptcy lane on the no-action fallthrough before the build-`1.03+` stock-issue branch: with the same bankruptcy toggle clear, current cash below `-300000`, at least `3` years since founding, no recent automatic finance action already chosen, the first three recent net-profits lanes each at or below `-20000`, and at least `5` years since the last bankruptcy stamp, it commits the same bankruptcy path and news family again. The later debt-capital restructuring family mutates the live company through `company_repay_bond_slot_and_compact_debt_table` `0x00423d70`, `company_issue_bond_and_record_terms` `0x004275c0`, `company_repurchase_public_shares_and_reduce_capital` `0x004273c0`, and `company_issue_public_shares_and_raise_capital` `0x00427450`, then formats the RT3.lng `2882..2886` headlines `%1 has refinanced %2 of debt.`, `%1 has refinanced %2 of debt and borrowed %3 on top of that.`, `%1 has refinanced %2 and paid off a further %3 of debt.`, `%1 has paid off %2 of its debt.`, and `%1 has borrowed %2 in debt.` The message-side tail is tighter now too: it accumulates total retired principal in one counter and total newly issued principal in another, then chooses the debt headline family by comparing those two totals directly: equal -> `2882` refinance only, issued greater -> `2883` refinance plus extra borrowing, retired greater -> `2884` refinance plus additional payoff, issued zero -> `2885` debt payoff only, and retired zero with issued positive -> `2886` straight new borrowing. The middle annual bond lane is tighter now too: when the bond toggle `[+0x4a8b]` is clear, it first simulates full bond repayment through repeated `company_repay_bond_slot_and_compact_debt_table` `0x00423d70`, then uses the resulting cash-side window with the fixed `-250000` and `-30000` thresholds plus the broader linked-transit train-service latch `[this+0x0d56]` to decide whether to stage one or more `500000` principal, `30`-year bond issues through `company_issue_bond_and_record_terms` `0x004275c0`. The repurchase lane is distinct from the later share-issue path: when the city-connection announcement-side latch `[this+0x0d18]` is set, editor growth setting `2` does not suppress it, and the stock toggle `[+0x4a87]` is clear, it starts from one `1000`-share batch and one default factor `1.0`, can replace that with a linked-chairman personality scalar `([table byte * 39] + 300) / 400`, scales that factor by `1.6` when growth setting `[0x006cec78+0x4c7c] == 1`, uses the resulting factor in one `800000` stock-value gate and one support-adjusted share-price scalar times factor times `1000` times `1.2` affordability gate, requires enough unassigned shares through `company_count_unassigned_shares_after_active_chairman_holdings` `0x004261b0`, and then commits repeated `1000`-share repurchases through `company_repurchase_public_shares_and_reduce_capital` `0x004273c0`; this is the current strongest threshold owner behind RT3.lng `2887`. The repurchase tail also now reads cleanly: it accumulates the total repurchased public-share count in a dedicated counter and publishes `2887` from that total after the debt headline branch. The sequencing above this helper now bounds those two latch reads more clearly: `0x004019e0` clears them first, then the city-connection and linked-transit branches may set them earlier in the same periodic pass, so the bond and repurchase lanes are currently best read as same-cycle reaction policy rather than long-term company-state policy. The later stock-issue lane is now tighter in exact order, not just broad shape: it only opens on build `1.03+`, only after the earlier bankruptcy, bond, and repurchase outcomes stay inactive, and with the bond and stock toggles `[+0x4a8b]` and `[+0x4a87]` clear, at least two bond slots live, and at least one year since founding. It derives one prospective equity tranche from roughly one-tenth of the current outstanding-share count, rounded down to `1000`-share lots with floor `2000`, trims that tranche downward until the pressured support-adjusted share-price scalar times tranche no longer exceeds the `55000` proceeds cap, recomputes the same share-price scalar under the negative tranche pressure term, clamps `Book Value Per Share` from stat-family `0x2329/0x1d` to a minimum `1.0`, and forms the normalized price-to-book ratio before any approval tests. The tested gates then run in a fixed order: share-price floor `>= 22`, pressured proceeds floor `>= 55000`, current cash from `0x2329/0x0d` against the highest-coupon live bond principal plus the fixed `5000` buffer, one later issue-cooldown or last-issue timestamp gate from `[this+0x16b..]`, and only then the piecewise coupon-versus-price-to-book ladder `0.07/1.3`, `0.08/1.2`, `0.09/1.1`, `0.10/0.95`, `0.11/0.8`, `0.12/0.62`, `0.13/0.5`, and `0.14/0.35`. On success it issues two same-sized public-share tranches through repeated `company_issue_public_shares_and_raise_capital` `0x00427450` calls and formats a separate equity-offering news family rooted at localized id `4053`, not the earlier `2882..2887` debt-or-buyback headlines. The dividend-side branch is now bounded too: it requires the dividend toggle `[0x006cec78+0x4a93]` to be clear, scenario mode `0x0c`, at least `1` year since `[this+0x0d2d]`, and at least `2` years since founding; it then converts a weighted `3/2/1` blend of the last three net-profits lanes `0x2b` into one tentative dividend-per-share target, supplements that target with current cash only on the tiny-unassigned-share branch below `1000`, and still folds in the map-editor building-density growth setting `[0x006cec78+0x4c7c]`. Current grounded postblend behavior is: growth setting `1` scales the existing dividend by `0.66`, growth setting `2` zeros it, computed deltas at or below `0.1` collapse to zero, larger deltas are quantized in tenths, and the final value is clamped against `company_compute_board_approved_dividend_rate_ceiling` `0x00426260`. The tail also refreshes `CompanyDetail.win` when the selected company matches `[0x006cfe4c]`. This now grounds the main finance verbs and first-layer threshold ordering under the annual policy pass, though some lower helper semantics still remain open.","objdump + callsite inspection + RT3.lng strings + finance-policy correlation + bankruptcy/debt-news correlation + repurchase-news correlation + equity-offering-news correlation + finance-mutator correlation + threshold correlation + latch correlation + sequencing correlation + stock-data-label correlation + highest-coupon-bond correlation + income-statement-row correlation + derived-report-metric correlation + valuation-vs-borrowing correlation + weighted-dividend-target correlation + deep-distress-bankruptcy correlation + debt-headline-tail correlation + repurchase-headline-tail correlation + stock-issue-ordering correlation"
0x00402c90,19,placed_structure_resolve_linked_candidate_record,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,2,"Tiny placed-structure-to-candidate resolver over the global candidate collection at `0x0062b268`. The helper reads one candidate id from `[this+0x173]`, re-enters the shared indexed-collection record resolver at `0x00518140`, and returns the resulting candidate record pointer. Current grounded caller is the BuildingDetail-side branch at `0x00506441`, where it is used immediately after resolving one placed-structure record from `0x0062b2fc`. This now looks like the direct placed-structure linked-candidate accessor rather than another anonymous local helper.","objdump + caller xrefs + callsite inspection + collection-resolver correlation"
0x00402cb0,3457,city_connection_try_build_route_with_optional_direct_site_placement,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Shared heavy route-builder and optional direct-placement helper beneath the city-connection route and news family. The function starts at a clean prologue at `0x00402cb0`, seeds one builder-state latch band at `[this+0xf5]`, `[this+0xf6]`, `[this+0xf8]`, `[this+0xfa]`, `[this+0xfc]`, and `[this+0x10a]`, and then splits into three grounded internal lanes. The first is an early route-entry search or synthesis lane through `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` over the global route-entry store `0x006cfca8`, which can seed the builder-state block and succeed without placing a new site. The second is a single-endpoint direct-placement lane around `0x00403d92..0x00403ef3`: it scans the live placed-structure collection `0x0062b2fc` for `Maintenance` and `ServiceTower` stems, projects one candidate placement through `0x00417840`, validates it through `0x004197e0`, and then commits through the first direct placement branch `0x00403ed5 -> placed_structure_collection_allocate_and_construct_entry` `0x004134d0` -> `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`. The third is a later paired-endpoint fallback lane around `0x00403f41..0x00404489`: it seeds two endpoint candidates from the same `Maintenance` and `ServiceTower` stem scan, builds one temporary route-entry candidate list, iterates that list against span and year-scaled step terms, projects trial placements through `0x00417840`, and on success commits through the second direct placement branch `0x0040446b -> 0x004134d0 -> 0x0040ef10` before clearing a small exclusion window in the temporary list. Outside those lanes it also re-enters geometry, region, and route-store helpers around `0x004423a0`, `0x00482e00`, `0x004931e0`, `0x00494310`, and the global route-entry stores `0x006cfcb4` / `0x006cfca8`, and it can still unwind through route-state cleanup without committing new placed structures. Current grounded external callers are still entirely in the city-connection family: the compact region-entry wrapper `city_connection_bonus_try_compact_route_builder_from_region_entry` `0x00404640`, the peer-route candidate builder `city_connection_bonus_build_peer_route_candidate` `0x004046a0`, the direct region-entry pair wrapper `city_connection_try_build_route_between_region_entry_pair` `0x00404c60`, and the direct retry paths inside `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0`. This now bounds the old unresolved `0x00403xxx..0x00404631` placement chooser as one shared city-connection route or placement helper with a cleaner internal policy split, even though some lower helper semantics remain open.","objdump + caller xrefs + callsite inspection + placement-correlation + route-builder correlation + Maintenance/ServiceTower scan correlation + route-entry search correlation"
0x004046a0,1388,city_connection_bonus_build_peer_route_candidate,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Reusable candidate builder beneath the city-connection bonus news and status family. The helper starts from one region or city entry in the collection at `0x0062bae0`, samples that entry's two derived coordinate terms through `0x00455800` and `0x00455810`, then re-enters `city_connection_bonus_select_first_matching_peer_site` at `0x00420280` with both selector flags forced on so it can recover one representative connected peer site. When a peer is found it samples the peer's derived coordinates through `0x0047df30` and `0x0047df50`; when an explicit caller-owned route anchor is present it first tries the heavier route builder at `0x00402cb0`, otherwise it falls back to the smaller helper at `0x00404640`. If neither early path succeeds the function collects one local candidate band from the two global route-entry stores at `0x006cfcb4` and `0x006cfca8`, filters those entries against the current city id and several route-state predicates, computes one compact bounding window around each surviving candidate, and then chooses the best remaining candidate by smallest span before retrying `0x00402cb0`. Current grounded callers are the wider company-side city-connection bonus sweep at `0x00406050` and one neighboring branch at `0x00406b73`, which together make this look like the shared peer-route candidate builder above the city bonus peer-selector family rather than a direct UI formatter.","objdump + caller xrefs + callsite inspection + peer-selector correlation + route-builder correlation"
0x00404640,82,city_connection_bonus_try_compact_route_builder_from_region_entry,map,thiscall,inferred,objdump + caller inspection + route-builder correlation,3,"Small route-builder helper beneath `city_connection_bonus_build_peer_route_candidate` `0x004046a0`. The helper resolves one caller-supplied region or city entry id through collection `0x0062bae0`, derives that entry's compact coordinate pair through `0x00401000`, reads one explicit route-anchor or peer-site id from `[this+0x00]`, and then re-enters the heavier route builder at `0x00402cb0` with that resolved coordinate pair plus default wildcard arguments `-1/0/-1` in the remaining route slots. Current grounded caller is the city-connection bonus candidate builder at `0x004047bf`, where this helper is used as the smaller fallback path when the earlier explicit-anchor route attempt does not apply. This now looks like the compact region-entry wrapper around the shared route builder rather than a generic coordinate helper.","objdump + caller inspection + route-builder correlation + city-bonus fallback correlation"
0x00404c60,124,city_connection_try_build_route_between_region_entry_pair,map,fastcall,inferred,objdump + caller inspection + route-builder correlation,3,"Compact fastcall route-builder above the shared route store at `0x006cfca8`. The helper resolves the two caller-supplied region or city entry ids through collection `0x0062bae0`, derives both endpoint coordinate pairs through `0x00401000`, and then re-enters the heavier route builder at `0x00402cb0` with those two endpoints plus the caller's remaining stack-side policy tuple. Current grounded callers are the pair-selection sweeps inside `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0`, where it is used both for the early dense score matrix and the later selected-pair retry. This now looks like the direct region-entry pair wrapper around the shared route builder rather than another anonymous internal callsite.","objdump + caller inspection + route-builder correlation + pair-selection correlation"
0x00404ce0,3124,simulation_try_select_and_publish_company_start_or_city_connection_news,simulation,fastcall,inferred,objdump + caller inspection + RT3.lng strings,3,"Broad fastcall city-pair chooser and news publisher above `city_connection_try_build_route_between_region_entry_pair` `0x00404c60`. When the stack company-id argument is zero the helper sweeps up to `0xa0` region-or-city entries from `0x0062bae0`; when it is nonzero it first validates that company through collection `0x0062be10`, stat family `0x2329` mode `0x0d` via `0x0042a5d0`, and the territory-access gate `0x00424010`. Eligible city entries are filtered through `city_connection_bonus_exists_matching_peer_site` `0x00420030`, weighted through `city_compute_connection_bonus_candidate_weight` `0x004010f0`, damped by map-size terms, territory access, and current region flags, and stored into temporary score bands. The helper then builds one dense pair matrix, repeatedly re-enters `0x00404c60` to validate candidate city pairs, can update one company-side selected endpoint pair through `0x00426f20`, and finally publishes shell news through `0x004554e0`. Current grounded publication ids are `2889` `%1 has started a new company - the %2` and `2890` `%1 has connected %2 to %3.`. Current grounded callers are `0x00401455`, which temporarily clears region-state dwords `[0x006cfc9c+0x2d]` before a global pass, and `0x00401b36`, which re-enters the same chooser with the active company and linked chairman after the smaller company-side city-connection bonus lane falls through. This now looks like the broader company-start-or-city-connection headline chooser above the smaller city-connection bonus sweep at `0x00406050` rather than another anonymous route-builder.","objdump + caller inspection + RT3.lng strings + route-builder correlation + pair-selection correlation + publication-path correlation"
0x00405920,189,company_query_min_linked_site_distance_to_xy,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Queries the minimum distance from one company to an input X or Y point pair. The helper walks the live placed-structure collection at `0x006cec20`, keeps only sites whose linked company id from `placed_structure_query_linked_company_id` at `0x0047efe0` matches `[this+0x00]`, samples each surviving site's derived coordinates through `0x0047ded0` and `0x0047df00`, and then computes one scalar distance against the caller-supplied coordinate pair through `0x0051dbe0`. It returns the minimum observed distance across all linked sites, clamped to a floor of `1.0` when a closer or degenerate result would go lower. The current grounded caller is `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050`, where this helper provides the distance term later blended into each city candidate score.","objdump + caller xrefs + callsite inspection + distance-term correlation"
0x00406050,2966,company_evaluate_and_publish_city_connection_bonus_news,simulation,thiscall,inferred,objdump + caller inspection + RT3.lng strings,4,"Broader company-side city-connection bonus sweep above `city_connection_bonus_build_peer_route_candidate` at `0x004046a0`. The function starts by building one announcement-value floor from several company-side support or governance helpers: the generic metric readers at `0x0042a5d0` and `0x00426ef0`, the linked transit-site counter `company_count_linked_transit_sites` at `0x00426590`, the small bonus-lane gate at `0x00427590`, and the longer company value ladder at `0x00425320`. Once that floor is high enough it walks the region-or-city collection at `0x0062bae0` and computes one per-city opportunity score from three terms: the city-side opportunity weight from `city_compute_connection_bonus_candidate_weight` at `0x004010f0`, the minimum linked-site distance from `company_query_min_linked_site_distance_to_xy` at `0x00405920`, and one city-side coordinate or spacing term around `0x00455800` and `0x00455810`. Those city scores are then adjusted by rival-company presence, chairman-profile scaling, the map-editor building-density setting at `0x006cec78+0x4c78`, and a linked-transit-site-count cap before the function keeps up to ten city ids in the persistent band at `[this+0x0d42]`. It repeatedly re-enters `city_connection_bonus_build_peer_route_candidate` to validate the best remaining entry, and when one validated winner survives it formats company and city names into the localized news strings `2888` `%1 has connected to %2.`, `2890` `%1 has connected %2 to %3.`, or `2921` `%1 has put a station in %2, but to win the %3 connection bonus, this station must be connected to ANOTHER city.` before publishing the result through the shell news helper at `0x004554e0`. When no winner survives it sets the byte latch at `[this+0x0d18]` instead. This is now the first grounded announcement owner above the city-connection bonus status formatter and peer-selector pair rather than just an anonymous caller around `0x004064c0`.","objdump + caller inspection + RT3.lng strings + peer-route candidate correlation + publication-path correlation + score-component correlation"
0x00407bd0,1697,company_rebuild_linked_transit_autoroute_site_score_cache,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Slower per-company follow-on above the fast linked-transit peer cache. The helper stamps the current scenario tick into `[this+0x0d3a]`, then walks the live placed-structure collection and keeps only sites whose company-side cache cell at `[site+0x5bd][company_id]` is present and eligible. For each such site it refreshes the cache-cell tick at `+0x0a`, zeroes the three accumulated float lanes at `+0x0e`, `+0x12`, and `+0x16`, and then rebuilds those lanes from two phases. First it uses `placed_structure_count_candidates_with_local_service_metrics` `0x0047e330`, `0x0047e620`, and the issue-opinion helper `0x00437d20` to populate bounded candidate-local amount bands at stack `0x1a0..` and normalized scaling bands at `0x350..`. Then it re-enters the per-site peer buffer at cache `+0x06`, resolves each peer site's live service words through `0x0047de20`, and only keeps candidate lanes whose local amount still exceeds the peer baseline. The surviving excess amount accumulates raw into cache float `+0x12`, while the continuity share at peer float `+0x09` and route-step count at peer dword `+0x05` feed a second step-biased weighted accumulator in cache float `+0x0e` through the local `+0x28` denominator bias. A later grouped promotion pass chooses the strongest adjacent candidate bands and folds their weighted contribution into cache float `+0x16`, which is the final site-ranking lane consumed by the downstream site selector. That split now matters for the tracker compatibility question too: the pre-`1.03` versus `1.03+` pair-metric dispatcher at `0x004a65b0` can perturb peer step counts and continuity share, but on current evidence that only flows into the weighted `+0x0e` and promoted `+0x16` lanes, not the raw `+0x12` amount total. Current grounded callers are the company-side mode gate at `0x00401c2a`, the timed wrapper at `0x00409766`, and the fast-cache tail path at `0x004093cd`. This now reads as the slower autoroute-site score rebuild over the linked-transit peer cache family rather than an unnamed tail call.","objdump + caller xrefs + callsite inspection + linked-transit score-cache correlation + linked-transit consumer correlation + version-compatibility impact correlation"
0x00408280,255,company_select_best_owned_linked_transit_site_by_autoroute_score,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Selects one owned linked transit site from the company-side autoroute cache family. The helper walks the live placed-structure collection, keeps only sites whose company cache cell `[site+0x5bd][company_id]` is present and eligible, whose linked company id matches the current company, and which still pass the station-or-transit gate `0x0047fd50`. It then ranks the surviving sites by cache float `[cell+0x16]`, applying a small bonus when the placed-structure-side lanes `[site+0x5c1]` and `[site+0x5c5]` are both clear, and returns the winning site id or `-1` when no candidate survives. Current grounded caller is `company_build_linked_transit_autoroute_entry` `0x00408380`, where this helper provides the fallback start site when the caller does not already supply one.","objdump + caller xrefs + callsite inspection + linked-transit autoroute correlation"
0x00408380,3215,company_build_linked_transit_autoroute_entry,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Builds one `0x33`-byte train route-list entry from the company-side linked-transit autoroute caches. When the caller-supplied site id is absent or invalid, the helper first falls back to `company_select_best_owned_linked_transit_site_by_autoroute_score` `0x00408280`. It then walks the chosen site's peer buffer from `[site+0x5bd][company_id]+0x06`, recomputes grouped candidate-local deltas against the peer site's service words from `0x0047de20`, chooses the strongest surviving peer site, and finally formats one route-list record into the caller-owned output buffer: it clears the `0x33`-byte record, preserves the low nibble of flag byte `+0x28`, writes the chosen target site id into word `+0x29`, seeds the route-kind dword at `+0x24` with `0x384`, and fills the remaining route-anchor or metadata lanes through the auxiliary route-entry tracker family at `0x006cfcb4` when a linked train record is supplied. The downstream effect boundary is tighter now too: because this builder ranks peer-site candidates from the weighted peer-derived bands rather than the raw site totals, the pre-`1.03` versus `1.03+` tracker metric split is now best read as perturbing autoroute peer choice and seeded route-entry selection here, not the later company-wide train-pressure target at `0x00408f70`. Current grounded callers are `train_try_seed_route_list_from_company_linked_transit_sites` `0x00409770` and two neighboring stack-built retry branches in the same family. This now looks like the shared route-entry builder above the linked-transit autoroute cache rather than another raw site query.","objdump + caller xrefs + callsite inspection + route-list-entry correlation + linked-transit autoroute correlation + version-compatibility impact correlation"
0x00408f70,864,company_compute_owned_linked_transit_site_score_total,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Aggregates one company-side linked-transit train-pressure target from the placed-structure cache family. The helper walks the live placed-structure collection at `0x006cec20`, keeps only records whose company-specific cache cell `[site+0x5bd][company_id]` is present and eligible, whose linked company id matches the current company, and which still pass the narrower station-or-transit gate `0x0047fd50`, then accumulates the raw site score float at cache offset `+0x12` across the surviving sites while also retaining the first two representative site pointers and the eligible-site count. It then converts that raw total into the returned roster target through a year-dependent divisor ladder, later year-side multipliers, and site-count bands. On build `1.03+`, when exactly two eligible sites survive, it also measures the inter-site distance between those retained sites and applies an extra distance-side scaling branch before the final train-balance comparison. The compatibility boundary is now tighter too: because this helper sums cache `+0x12` rather than the weighted `+0x0e` or promoted `+0x16` lanes, current evidence says the pre-`1.03` versus `1.03+` tracker metric split does not directly change this company-wide roster target except through any earlier coarse candidate-survival effects, not through the step-count or continuity-weighting lanes themselves. Current grounded caller is the linked-transit train-roster balancer at `0x00409950`, where this returned float is compared against the current owned-train count and train-age heuristics before the add, upgrade, or removal branches run.","objdump + caller xrefs + callsite inspection + linked-transit score-total correlation + linked-transit consumer correlation + version-compatibility impact correlation"
0x00409300,200,company_publish_train_upgrade_news,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,3,"Formats and publishes the linked-transit train-upgrade news item. After one scenario gate through `[0x006cec78+0x4a97]`, the helper chooses one preferred locomotive id through `0x004078a0`, resolves the caller-supplied train id through the live train collection `0x006cfcbc`, formats the old and new locomotive names through the locomotive collection `0x006ada84` and the name helper at `0x00461ca0`, and then emits RT3.lng id `2897` `%1 has just upgraded a %2 to a %3.` through the shell news helper at `0x004554e0`. It finally sets the byte latch at `[company+0x0d56]`. Current grounded callers are the train-roster balancer at `0x00409950` and one neighboring branch at `0x00409b52`, so this now reads as the shared company-side train-upgrade headline helper rather than an anonymous news formatter.","objdump + caller xrefs + callsite inspection + RT3.lng strings + train-upgrade news correlation"
0x004093d0,837,company_rebuild_linked_transit_site_peer_cache,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Per-company fast refresh over the placed-structure-side linked-transit peer cache. The helper stamps the current scenario tick from `[0x006cec78+0x15]` into `[this+0x0d3e]`, then walks the live placed-structure collection at `0x006cec20`. For each site it resolves the company-specific cache cell from the site's pointer table `[site+0x5bd][company_id]`, marks the cell present, clears its eligible byte, and frees any prior peer-record buffer at `+0x06`. It then marks a site eligible when it passes the station-or-transit gate `0x0047fd50`, the linked-instance class test `0x0047de00 -> 0x0040c990 == 1`, and either already belongs to this company through `placed_structure_query_linked_company_id` `0x0047efe0` or survives the neighboring route-anchor reachability gate `0x004801a0` plus the minimum-distance threshold built from `company_query_min_linked_site_distance_to_xy` `0x00405920`. In the second pass each eligible site receives a zeroed `(eligible_count*0x0d)+1` byte peer buffer at cache offset `+0x06`, and the helper fills one `0x0d`-byte record per eligible peer: byte `+0x00` is a route-side reachability flag, dword `+0x01` stores the peer site id, dword `+0x05` stores the returned route-step count from `aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks` `0x004a6630`, and float `+0x09` stores the normalized continuity share computed from that step count and the companion mismatch-count output of the same helper. The function then tails into the heavier company-side follow-on at `0x00407bd0`. Current grounded callers are the company-side world or service wrapper `0x00409742`, the mode-gated company pass at `0x00401c23`, the route-builder-side company refresh at `0x0040457e`, and the active-company collection sweep `0x00429c5b`.","objdump + caller xrefs + callsite inspection + linked-transit cache correlation + placed-structure cache-cell correlation + route-step-count correlation + continuity-ratio correlation"
0x00409720,80,company_service_linked_transit_site_caches,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Timed service wrapper above the two company-side linked-transit cache lanes. The helper refreshes the fast peer cache through `company_rebuild_linked_transit_site_peer_cache` `0x004093d0` when `[this+0x0d3e]` is zero or older than `0x7ff80` ticks, and otherwise refreshes the slower follow-on lane at `0x00407bd0` when `[this+0x0d3a]` is zero or older than `0x31380` ticks. Current grounded direct callers are `0x004097b8`, which re-enters it after one larger local mode change, and several neighboring company-side service paths. This now looks like the bounded timed owner for the company-side linked-transit cache family rather than another anonymous small wrapper.","objdump + caller xrefs + callsite inspection + timed-service correlation"
0x00409770,88,train_try_append_linked_transit_autoroute_entry,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Attempts to append one linked-transit autoroute entry onto a live train route list. After validating the train-side state and one current route-kind gate through `0x004a8840`, the helper clears one local staging byte, re-enters `company_service_linked_transit_site_caches` `0x00409720` on the owning company, and then asks `company_build_linked_transit_autoroute_entry` `0x00408380` for a single staged `0x33`-byte route-list record using the current anchor site id at `[this+0x0a0]`. On success it either appends that record through `train_route_list_insert_staged_entry_at_index` `0x004b3160` and refreshes the new trailing selection through `train_route_list_select_entry_and_refresh_linked_site_state` `0x004b2f00`, or when the list is already at the local two-entry cap it rotates the target slot via `[this+0x08] mod [this+0x04]` and overwrites that `0x33`-byte entry in place. The weighted linked-transit cache lanes stay indirect here too: this helper inherits ranked site and peer choice only through `0x00408380`, not by reading cache `+0x0e/+0x16` itself. Current grounded caller is the company-side service sweep at `0x004019cc`, so this now reads as the single-entry train-side autoroute append helper rather than a two-entry seeding pass.","objdump + caller xrefs + callsite inspection + linked-transit autoroute correlation + train-route-list correlation + weighted-consumer-boundary correlation"
0x00409830,274,company_try_add_linked_transit_train_and_publish_news,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,3,"Local add-train branch beneath the linked-transit company train-roster balancer. The helper first respects scenario gate `[0x006cec78+0x4aa3]`, clears and seeds one staged route-entry buffer through `0x004b2ba0`, services the owning company's linked-transit caches, asks `company_build_linked_transit_autoroute_entry` `0x00408380` for two route-list entries, inserts those entries through `train_route_list_insert_staged_entry_at_index` `0x004b3160`, chooses one preferred locomotive id through `0x004078a0`, and then hands the staged route plus locomotive choice into the train-construction helper at `0x004b2140`. On success it emits RT3.lng id `2896` `%1 has added a new train (%2) at %3` through `0x004554e0` and sets the byte latch at `[company+0x0d56]`. The weighted linked-transit cache lanes stay indirect here too: this add-train path inherits ranked site and peer choice only through the two `0x00408380` builder calls, while the separate roster-pressure decision above it still comes from raw cache `+0x12` through `0x00408f70`. Current grounded callers are the local add branches inside `company_balance_linked_transit_train_roster` `0x00409950`, while multiplayer callers package opcode `0x75` instead.","objdump + caller xrefs + callsite inspection + RT3.lng strings + linked-transit train-add correlation + weighted-consumer-boundary correlation"
0x00409950,923,company_balance_linked_transit_train_roster,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Balances one company's linked-transit train roster against the linked-site cache family. The helper first requires at least one linked transit site through `company_count_linked_transit_sites` `0x00426590`, then computes one aggregate train-pressure target through `company_compute_owned_linked_transit_site_score_total` `0x00408f70` and counts currently owned trains through `company_count_owned_trains` `0x004264c0`. It walks the live train collection `0x006cfcbc`, keeps only trains owned by the current company, derives one year-dependent age scalar from current scenario year `[0x006cec78+0x0d]`, and applies that scaled age against two thresholds. Very old trains above the upper band are either removed outright through the train collection vtable when the roster already exceeds target, or upgraded in place through `company_publish_train_upgrade_news` `0x00409300` when the target still needs capacity. Mid-age trains above the lower band can trigger one narrower upgrade branch when the roster is still below target. After pruning, it computes the remaining deficit between the aggregate target and the owned-train count, then repeatedly either packages multiplayer opcode `0x75` through `0x00469d30` or locally re-enters `company_try_add_linked_transit_train_and_publish_news` `0x00409830` until that deficit collapses, with one later add-train retry branch when the residual target is still high enough. Current grounded callers are the company-side service sweep at `0x00401b9d` and a neighboring company wrapper at `0x004097b8`, so this now looks like the live train-balance owner above the linked-transit autoroute and news helpers rather than an unnamed local maintenance pass.","objdump + caller xrefs + callsite inspection + linked-transit train-balance correlation + linked-transit consumer correlation"
0x004264c0,96,company_count_owned_trains,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Counts the live trains owned by the current company. The helper walks the train collection at `0x006cfcbc`, compares each record's owning company byte at `[train+0x51]` against `[this+0x00]`, and returns the number of matches. Current grounded callers are the linked-transit train-roster balancer at `0x00409950` and the `LoadScreen.win` company train-list page at `0x004e7670`, where the count gates the no-trains fallback before the detailed roster rows are built.","objdump + caller xrefs + callsite inspection + company-owned train count correlation"
0x00426590,135,company_count_linked_transit_sites,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Counts the live linked placed structures for this company that also pass the station-or-transit gate. The helper walks the placed-structure collection at `0x006cec20`, keeps only peers whose linked company id from `placed_structure_query_linked_company_id` at `0x0047efe0` matches `[this+0x00]`, requires the linked-instance class byte through `0x0047de00 -> 0x0040c990 == 1`, and optionally enforces the narrower station-or-transit predicate through `0x0047fd50` when the caller passes a nonzero stack flag. The current grounded caller is `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050`, where the helper contributes the current linked transit-site count used in the bonus-value ladder and later building-density caps.","objdump + caller xrefs + callsite inspection + connection-bonus count correlation"
0x00427590,47,company_credit_rating_score_meets_threshold_5,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Small boolean gate over the bounded company credit-rating score at `0x00425320`. The helper rejects immediately when scenario-state flag `0x006cec78+0x4a8b` is set or when the company-side count or age-like field `[this+0x5b]` has reached `0x14`; otherwise it computes the zero-argument credit-rating score and returns true only when the resulting integer value is at least `5`. Current grounded callers are `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050` and the neighboring branch around `0x004064a9`, so this is currently safest as a small reusable threshold gate over the same debt-market or company-strength score rather than a dedicated shell-only bond predicate.","objdump + caller xrefs + callsite inspection + credit-rating correlation + threshold-gate correlation"
0x00409e80,192,world_set_selected_year_and_refresh_calendar_presentation_state,simulation,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small world-side year setter beneath the periodic step family and the later world-entry staged-profile rehydrate band. The helper stores the caller-supplied selected absolute calendar counter at `[this+0x15]`, resolves the paired mixed-radix calendar-point tuple through `0x0051d460` into `[this+0x0d/+0x11]`, recomputes several derived year-fraction or presentation scalars rooted at `[this+0x0bfa]`, refreshes the live shell controller at `0x006d4024` through `0x0051f070`, `0x00527c70`, and `0x00527c20`, and updates the controller's cached doubled-year field at `[controller+0x2c]`. When the unpacked year field at `[this+0x0d]` actually changes it also re-enters `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`. Current grounded callers are the smaller periodic-step wrapper at `0x0040a150`, the larger simulation-advance family through `0x0040a590/0x0040ab50`, and the late staged-profile rehydrate lane inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared selected-year/calendar refresh helper rather than a one-off world-entry setter.","objdump + caller inspection + local disassembly + periodic-step correlation + world-entry rehydrate correlation + year-bucket-companion correlation + calendar-counter model correlation"
0x0040a590,892,simulation_service_periodic_boundary_work,simulation,cdecl,inferred,objdump + analysis-context,3,"Periodic simulation-maintenance dispatcher inside the world-step family. It switches on the local calendar or phase byte at [this+0x0f] routes one heavy mode through the larger recurring service branch at 0x0040a160 falls back to the simpler one-step advance at 0x00409e80 for other modes and runs several global manager sweeps across 0x0062be10 0x006ceb9c 0x006cfcbc 0x006cec20 and 0x0062bae0 before handing control back to the enclosing stepper. Its scenario-runtime handoff is now explicit too: the grounded calls at `0x0040a276`, `0x0040a55f`, `0x0040a6cb`, and `0x0040a7a3` re-enter `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with trigger kinds `1`, `0`, `3`, and `2` respectively. The route-style lane is tighter here now too: the neighboring recurring branch at `0x0040a91f` re-enters `placed_structure_collection_refresh_quarter_subset_route_style_state` `0x00413580`, then later drives the same runtime-effect collection loop with trigger kinds `5` and `4` at `0x0040a930` and `0x0040a9ac`. One conditional branch also re-enters shell_map_file_world_bundle_coordinator at 0x00445de0 which keeps the save-or-package family connected to the live simulation cadence.",objdump + analysis-context + caller xrefs + runtime-effect trigger-kind correlation
0x0040ab50,339,simulation_advance_to_target_calendar_point,simulation,cdecl,inferred,objdump + analysis-context,3,"Advances the active world state toward one caller-selected mixed-radix calendar target while guarded by the recursion counter at `0x0062b240`. The helper compares the current local calendar-point tuple fields `[this+0x0d]`, `[this+0x0f]`, `[this+0x11]`, and `[this+0x14]` against a target resolved through `0x0051d550` and `0x0051d5f0`, then either recurses in larger `0x168`-sized chunks or advances through the smaller periodic step family rooted at `0x00409e80` and `0x0040a9c0`. Current tuple evidence now bounds this as the same mixed-radix counter family used by `0x0051d3c0/0x0051d460`: a packed year-plus-subfield calendar point rather than a plain year or month-only target. Each successful step notifies the live world root at `0x0062c120` through `0x00450030`. Grounded callers include the frame-time accumulator at `0x00439140`, the larger fast-forward helper at `0x00437b20`, and one shell UI command path.","objdump + analysis-context + caller xrefs + calendar-counter model correlation"
0x0040c950,18,placed_structure_construct_concrete_specialization_vtable_5c8c50,map,thiscall,inferred,objdump + allocator caller correlation + constructor chain inspection,2,"Small constructor thunk used by the shared placed-structure allocator `0x004134d0`. The helper first re-enters `0x0045b680`, which seeds the common placed-structure base table `0x005cb4c0`, clears the derived field band `[this+0x23a..+0x26a]`, and re-enters the older base initializer `0x00455610`; it then installs the concrete placed-structure specialization table `0x005c8c50` and returns `this`. Current grounded callers are the live allocator path at `0x004134d0` and the temporary stack-object path at `0x00413363`, so this is the safest current read for the concrete placed-structure constructor thunk beneath the shared placement family rather than a standalone helper object constructor.","objdump + allocator caller correlation + constructor chain inspection + vtable install correlation"
0x0040c970,11,placed_structure_reset_concrete_specialization_to_base_vtable_5cb4c0,map,thiscall,inferred,objdump + allocator caller correlation + destructor chain inspection,2,"Small cleanup or destructor-style thunk paired with `0x0040c950`. The helper briefly reinstalls the concrete specialization table `0x005c8c50`, then immediately tails into `0x0045b040`, which demotes the record back to the common base table `0x005cb4c0` and re-enters the base cleanup path `0x00455650`. Current grounded callers are the stack-object teardown sites at `0x00413363` and `0x0041353a`, both immediately before freeing or unwinding the temporary placed-structure object, so this is the safest current read for the specialization-to-base cleanup thunk rather than another constructor.","objdump + allocator caller correlation + destructor chain inspection + vtable demotion correlation"
0x0040c980,5,placed_structure_serialize_concrete_specialization_payload_via_0x45b560,map,thiscall,inferred,objdump + vtable scan + serializer chain inspection,2,"Tiny serializer thunk in the concrete placed-structure specialization table `0x005c8c50`. The helper simply tails into `0x0045b560`, which first re-enters the common base serializer `0x004559d0` and then emits the derived payload bracketed by tags `0x5dc1/0x5dc2` over fields `[this+0x23e]`, `[this+0x242]`, `[this+0x246]`, `[this+0x24e]`, and `[this+0x252]`. This is the safest current read for the specialization-side serializer entry rather than an independent data-writer.","objdump + vtable scan + serializer chain inspection"
0x0040cbc0,4,placed_structure_clear_shared_byte42_state_flag,map,thiscall,inferred,objdump + local disassembly,2,"Tiny raw setter over shared placed-structure byte `[this+0x42]`, storing literal `0`. The byte is also manipulated by the linked-peer route-entry toggle pair `0x0040dba0/0x0040dbf0` and read back through the raw getter `0x0040cbf0`, so this is the safest current read for the direct clear accessor over that shared site-state byte rather than a standalone semantic owner.","objdump + local disassembly + neighboring accessor correlation"
0x0040cbd0,4,placed_structure_set_shared_byte42_state_flag,map,thiscall,inferred,objdump + local disassembly,2,"Tiny raw setter over shared placed-structure byte `[this+0x42]`, storing literal `1`. The byte is also manipulated by the linked-peer route-entry toggle pair `0x0040dba0/0x0040dbf0` and read back through the raw getter `0x0040cbf0`, so this is the safest current read for the direct set accessor over that shared site-state byte rather than a standalone semantic owner.","objdump + local disassembly + neighboring accessor correlation"
0x0040cbe0,3,runtime_object_false_stub_vtable_5cfd00_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-false virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
0x0040cbf0,5,placed_structure_query_shared_byte42_state_flag,map,thiscall,inferred,objdump + local disassembly,2,"Tiny raw getter over shared placed-structure byte `[this+0x42]`, zero-extending that byte into `EAX`. Current local evidence keeps this on the same byte-lane as the direct setters `0x0040cbc0/0x0040cbd0` and the linked-peer route-entry toggle pair `0x0040dba0/0x0040dbf0`, so this is the safest current read for the direct query accessor over that shared site-state byte.","objdump + local disassembly + neighboring accessor correlation"
0x0040cc00,6,runtime_object_true_stub_vtable_5cfd00_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-true virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
0x0040cc10,3,placed_structure_specialization_false_stub_vtable_5c8c50_slot0,map,thiscall,inferred,objdump + vtable scan,1,"Tiny pure-false stub in the concrete placed-structure specialization table `0x005c8c50`. The helper clears `EAX` and returns immediately, with no field access or side effects. Current evidence only grounds it as one literal-false virtual slot beneath the specialization, so the note stays structural rather than semantic.","objdump + vtable scan"
0x0040cc20,3,placed_structure_specialization_false_stub_vtable_5c8c50_slot1,map,thiscall,inferred,objdump + vtable scan,1,"Second tiny pure-false stub in specialization table `0x005c8c50`. Like the neighboring false slots, it simply clears `EAX` and returns. Current evidence grounds this only as a literal-false virtual slot rather than a named predicate.","objdump + vtable scan"
0x0040cc30,3,placed_structure_specialization_false_stub_vtable_5c8c50_slot2,map,thiscall,inferred,objdump + vtable scan,1,"Third tiny pure-false stub in specialization table `0x005c8c50`. The helper only returns `0`, with no field reads or writes. Current evidence does not yet justify a semantic predicate name beyond that structural role.","objdump + vtable scan"
0x0040cc40,32,placed_structure_subject_candidate_is_subtype1,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small shared candidate-profile predicate adjacent to the `0x005c8c50` specialization cluster. The helper follows candidate or profile id `[this+0x173]` through collection `0x0062b268`, reads candidate subtype byte `[candidate+0x32]`, and returns `1` only when that subtype equals `1`. Current grounded caller is `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where the returned boolean becomes one of the two mode inputs for `0x00415020`. This is the safest current read for a subtype-`1` predicate over the linked candidate/profile chain rather than a specialization-vtable slot.","objdump + caller inspection + local disassembly + candidate-subtype correlation"
0x0040cc60,26,placed_structure_subject_candidate_query_flag_byte_ba,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny shared candidate-profile accessor adjacent to the specialization cluster. The helper follows id `[this+0x173]` through candidate collection `0x0062b268` and returns byte `[candidate+0xba]`. Current grounded caller is `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where the byte is only used as a boolean mode input. Current evidence grounds the field access but not the higher semantic name of candidate byte `0xba`, so the note stays deliberately raw.","objdump + caller inspection + local disassembly + candidate-byte-field correlation"
0x0040cc80,42,placed_structure_subject_candidate_is_subtype1_class3,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared candidate-profile predicate over the same `[this+0x173] -> 0x0062b268` chain as `0x0040cc40`. The helper returns `1` only when candidate subtype byte `[candidate+0x32]` equals `1` and candidate class byte `[candidate+0x8c]` equals `3`. Current grounded caller is `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where this branch helps select the flagged-region float-stat mode beneath `0x00415020`. This is the safest current read for the combined subtype-`1` plus class-`3` predicate rather than a direct specialization method.","objdump + caller inspection + local disassembly + candidate-subtype correlation + candidate-class correlation"
0x0040ccb0,14,placed_structure_has_cached_linked_site_id,map,thiscall,inferred,objdump + vtable scan + local disassembly,2,"Small specialization-side predicate over cached linked-site id `[this+0x2a8]`. The helper returns `1` when that dword is nonzero and `0` otherwise. Because it sits directly in the `0x005c8c50` vtable beside the linked-peer UI and route-anchor family, this is the safest current read for the specialization's cached-linked-site-id presence predicate rather than a broader linked-site resolver.","objdump + vtable scan + local disassembly + linked-site-field correlation"
0x0040ccc0,6,placed_structure_specialization_true_stub_vtable_5c8c50_slot,map,thiscall,inferred,objdump + vtable scan,1,"Tiny pure-true stub in specialization table `0x005c8c50`. The helper loads literal `1` into `EAX` and returns immediately. Current evidence grounds it only as a literal-true virtual slot beneath the specialization, not yet as a named capability predicate.","objdump + vtable scan"
0x0040ccd0,30,world_grid_resolve_cell_pointer_by_xy_indices,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small world-grid address calculator over the live world root at `0x0062c120`. The helper multiplies the caller-supplied Y-like index by world width `[this+0x2145]`, adds the X-like index, scales the resulting linear slot by fixed cell stride `0x1d7`, and returns the corresponding cell pointer under base `[this+0x2129]`. Current grounded callers include the placed-structure cargo-service bitset sweep around `0x0042c386`, several world-grid or overlay-side passes at `0x004525bc..0x00452bb2`, and one later shell-side caller at `0x004df4d4`, so this is the safest current read for the shared `(x,y) -> world-cell*` resolver rather than an object-specific helper.","objdump + caller inspection + local disassembly + world-grid correlation + cell-stride correlation"
0x0040ccf0,23,placed_structure_query_linked_instance_candidate_class_byte,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small linked-instance candidate-class reader adjacent to the specialization cluster. The helper first resolves one linked instance through `0x0047de00`, then follows that instance's vtable `+0x80` owner chain, and finally returns candidate class byte `[candidate+0x8c]`. Current grounded callers include later world or UI-side branches at `0x00480fb5` and `0x004b03ce`, where the returned class is compared against `3` and `4`. This is the safest current read for a linked-instance candidate-class accessor rather than a general placed-structure vtable slot.","objdump + caller inspection + local disassembly + candidate-class correlation"
0x0040cd10,88,placed_structure_scan_center_cell_site_roster_when_shell_gate_enabled,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Gated center-cell site-roster sweep adjacent to the specialization cluster. The helper first requires shell or modal latch `[0x006cec74+0x1c3]` and creation-mode byte `[this+0x3d4] == 1`, then resolves the current subject's center world-grid cell through `0x00455f60`, reads the local roster count and packed site-id list at `[cell+0xeb]` and `[cell+0xef]`, and resolves each listed placed-structure id through collection `0x006cec20`. Current grounded caller is the broader collection walk at `0x00413860`, so this is the safest current read for a gated center-cell linked-site roster scan rather than another candidate predicate or direct vtable override.","objdump + caller inspection + local disassembly + center-cell roster correlation"
0x0040cd70,228,placed_structure_resolve_cached_source_and_candidate_ids_from_current_stem_or_warn,map,thiscall,inferred,objdump + local disassembly + string correlation + collection correlation,3,"Common specialization-side stem refresh helper beneath `0x0040ce60`. The helper clears cached ids `[this+0x3cc]` and `[this+0x3d0]`, scans source collection `0x0062b2fc` for a case-sensitive stem match against `[this+0x3ae]`, and on the first match stores the matched source id into `[this+0x3cc]` plus the corresponding candidate or profile id from `[source+0x173]` into `[this+0x3d0]`. When no source stem matches, it formats localized id `0x00ad` with the current stem buffer and publishes that warning through `0x0051e980`. Current local callers are the radio-stem canonicalizer `0x0040ce60` and the broader placed-structure constructor or geometry refresh family, so this is the safest current read for the cached source/candidate resolver beneath the `0x005c8c50` specialization rather than a generic geometry helper.","objdump + local disassembly + string correlation + collection correlation + cached-id-field correlation"
0x0040ce60,83,placed_structure_canonicalize_radio_station_stem_and_refresh_specialization_state,map,thiscall,inferred,objdump + local disassembly + string correlation,2,"Small specialization-side stem normalizer. The helper compares the site stem at `[this+0x3ae]` against the literal `Radio Station`, and when that compare matches it rewrites the same stem buffer to the compact form `RadioStation`. It then re-enters the common stem or geometry refresh helper `0x0040cd70` and the neighboring specialization-side follow-on `0x0045c150` with the caller-supplied stack argument. Current local evidence is strong enough to ground the `Radio Station -> RadioStation` normalization, but not the broader semantic role of the owning specialization table `0x005c8c50`, so this note stays narrow.","objdump + local disassembly + string correlation + neighboring specialization-method correlation"
0x0040cec0,18,placed_structure_resolve_cached_source_record_from_id3cc,map,thiscall,inferred,objdump + local disassembly,2,"Tiny cached-record resolver over source id `[this+0x3cc]`. The helper resolves and returns the corresponding entry through source collection `0x0062b2fc`. Current local callers sit on the `0x005c8c50` specialization side beside the stem refresh family, so this is the safest current read for the direct cached source-record resolver rather than another generic collection helper.","objdump + local disassembly + cached-id-field correlation"
0x0040cee0,18,placed_structure_resolve_cached_candidate_record_from_id3d0,map,thiscall,inferred,objdump + vtable scan + local disassembly,2,"Tiny cached-record resolver over candidate or profile id `[this+0x3d0]`. The helper resolves and returns the corresponding entry through collection `0x0062b268`. Because this function is itself a `0x005c8c50` vtable slot and directly follows the stem-refresh family, this is the safest current read for the specialization's cached candidate-record resolver rather than an unrelated collection bridge.","objdump + vtable scan + local disassembly + cached-id-field correlation"
0x0040cf00,527,placed_structure_build_secondary_specialization_transient_handle_with_four_slot_offsets,map,thiscall,inferred,objdump + local disassembly + transient-family correlation,2,"Heavier specialization-side transient build branch beneath the `0x005c8c50` table. The helper first requires creation-mode byte `[this+0x3d4] == 1` and live transient seed `[this+0x24e]`, then re-enters the neighboring cleanup gate `0x0045b370(1)`, derives one scaled float from current local geometry through `[this+0x14]`, `[this+0x21]`, `[this+0x3a]`, and the constant at `0x005c8cf4`, and allocates one new handle through `0x00475ed0` into `[this+0x25a]`. It then resolves a current world-position tuple through `0x00414450` and `0x0052e720`, publishes several local offset triplets through `0x00475010`, and configures four numbered channels on the new handle through `0x00475030` with selector ids `1..4`. Current evidence grounds this as a second transient-handle builder in the same specialization-side payload family as `0x0045c310/0x0045b210`, but not yet the user-facing subtype semantics of the handle itself.","objdump + local disassembly + transient-family correlation + geometry-derived offset correlation"
0x0040d170,56,placed_structure_build_primary_specialization_transient_when_candidate_flag4b_enabled,map,thiscall,inferred,objdump + local disassembly + candidate-flag correlation,2,"Small specialization-side hook that conditionally builds the primary transient handle through `0x0045c310`. The helper resolves the current candidate from cached stem id `[this+0x3cc]`, follows that candidate's profile or source id through `[entry+0x173]`, and reads dword flag `[candidate+0x4b]`. When that flag is nonzero it tail-calls `placed_structure_specialization_build_primary_transient_handle_from_payload_strings` `0x0045c310`; otherwise it returns immediately. This is the strongest current owner for the candidate-flag-gated primary transient build hook in the `0x005c8c50` specialization family.","objdump + local disassembly + candidate-flag correlation + transient-build correlation"
0x0040d1b0,56,placed_structure_release_primary_specialization_transient_when_candidate_flag4b_enabled,map,thiscall,inferred,objdump + local disassembly + candidate-flag correlation,2,"Release-side companion to `0x0040d170`. The helper resolves the same candidate chain from cached stem id `[this+0x3cc]`, reads dword flag `[candidate+0x4b]`, and when that flag is nonzero tail-calls `placed_structure_specialization_release_primary_transient_handle_and_siblings` `0x0045c3c0`; otherwise it returns immediately. Current evidence grounds this as the candidate-flag-gated release hook for the primary specialization transient rather than a generic cleanup entry.","objdump + local disassembly + candidate-flag correlation + transient-release correlation"
0x0040d1f0,23,placed_structure_resolve_linked_peer_record_from_cached_site_id,map,thiscall,inferred,objdump + local disassembly,3,"Tiny cached-record resolver over linked site id `[this+0x2a8]`. When that id is nonzero the helper resolves and returns the linked placed-structure record through collection `0x006cec20`; otherwise it returns null. Current grounded callers include the contextual status publisher `0x0040e4e0` and the linked-anchor service family, so this is the safest current read for the direct linked-peer resolver rather than another boolean gate.","objdump + local disassembly + linked-peer resolver correlation"
0x0040d210,26,placed_structure_resolve_owner_record_from_cached_owner_id,map,thiscall,inferred,objdump + local disassembly,2,"Tiny cached-record resolver over owner id `[this+0x276]`. When that id is nonzero the helper resolves and returns the corresponding record through collection `0x0062be10`; otherwise it returns null. Current local callers sit on the UI-facing specialization side near `0x0040e9d0`, so the safest current read is one direct owner-record resolver rather than a wider ownership test.","objdump + local disassembly + owner-resolver correlation"
0x0040d230,60,placed_structure_has_linked_station_or_transit_peer,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Boolean linked-peer gate over one placed structure. The helper first requires the placed-structure vtable `+0x70` latch, then resolves optional linked site id `[this+0x2a8]` through the live placed-structure collection `0x006cec20`, and finally re-enters `placed_structure_is_station_or_transit_site_class` `0x0047fd50` on that linked peer. Current local callers include the broader `cargo id 0` bypass family and several neighboring linked-site maintenance branches, so this is the safest current read for the narrower linked-peer station-or-transit gate rather than a cargo-reference helper.","objdump + caller xrefs + local disassembly + linked-peer gate correlation"
0x0040d2d0,128,placed_structure_refresh_linked_peer_overlay_when_linked_peer_flagged,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Linked-peer visual or state refresh beneath the broader placed-structure rebuild family. The helper first re-enters placed-structure vtable `+0x54` with stack argument `0`, then requires scenario latch `[0x006cec78+0x4ae7]`, the placed-structure vtable `+0x70` linked-site-capable latch, and the narrower linked-peer class gate `0x0047fd50` over optional linked site id `[this+0x2a8]`. When the resolved linked peer carries nonzero byte `[peer+0x5bc]`, it re-enters placed-structure vtable `+0x58` on the current site with literal arguments `(0x5f, 0x5f, 0xff)`. Current grounded caller is `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`, so this is the safest current read for a linked-peer-dependent overlay or status refresh rather than a cargo-side helper.","objdump + caller xrefs + local disassembly + linked-peer flag correlation"
0x0040dba0,66,placed_structure_clear_linked_route_entry_state_byte_and_dispatch_unbound_anchor_toggle,map,thiscall,inferred,objdump + caller xrefs + local disassembly + rdata method-table scan,2,"Small linked-site route-entry state helper. The function first requires the placed-structure vtable `+0x70` linked-site-capable latch, then resolves optional linked site id `[this+0x2a8]` through the placed-structure collection `0x006cec20`, forwards the resulting linked peer (or null) plus literal stack flag `1` into `0x0047dda0`, and finally clears local byte `[this+0x42]` to `0`. Current local callers are neighboring placed-structure maintenance branches, and the paired companion at `0x0040dbf0` performs the same route-entry dispatch with the opposite literal and byte writeback. A local `.rdata` scan now tightens the owner split too: `0x0040dba0` and `0x0040dbf0` each appear exactly once, together with getter `0x0040cbf0`, in one concrete placed-structure specialization table rooted at `0x005c8c50`, so this is now the safest current read for one half of a specialization-specific linked-site route-entry state toggle pair rather than a generic family-wide setter.","objdump + caller xrefs + local disassembly + linked-route-entry-toggle correlation + rdata method-table correlation + constructor-chain correlation"
0x0040dbf0,65,placed_structure_set_linked_route_entry_state_byte_and_dispatch_unbound_anchor_toggle,map,thiscall,inferred,objdump + caller xrefs + local disassembly + rdata method-table scan,2,"Companion linked-site route-entry state helper paired with `0x0040dba0`. The function first requires the placed-structure vtable `+0x70` linked-site-capable latch, resolves optional linked site id `[this+0x2a8]` through the placed-structure collection `0x006cec20`, forwards the resulting linked peer (or null) plus literal stack flag `0` into `0x0047dda0`, and finally sets local byte `[this+0x42]` to `1`. Current local callers are neighboring placed-structure maintenance branches. A local `.rdata` scan now shows that this paired override appears only in the same concrete placed-structure specialization table at `0x005c8c50` as `0x0040dba0` and `0x0040cbf0`, which keeps this on the specialization-specific linked-site route-entry side rather than on one generic shared-byte setter lane.","objdump + caller xrefs + local disassembly + linked-route-entry-toggle correlation + rdata method-table correlation + constructor-chain correlation"
0x0040e360,235,placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Subtype-specific local-runtime follow-on beneath `0x0040eba0` and `0x0040ee10`. The helper resolves the current placed structure's candidate from `[this+0x3cc]` through `0x0062b2fc` and `0x0062b268`, requires subtype byte `[candidate+0x32] == 1` plus candidate class byte `[candidate+0x8c] == 3`, then requires a linked site id at `[this+0x2a8]`. When the linked peer exists and its route-entry anchor at `[peer+0x08]` is live in collection `0x006cfca8`, the helper samples one anchor-side float through `0x0048aab0`, subtracts the fixed offset at `0x005c8738`, combines that result with the current placed structure's coordinate pair through `0x00455810` and `0x00455800`, and publishes the resulting triplet through the shared position setter `0x00530720`. Current grounded caller is the broader local side helper `0x0040ee10`, plus the heavier subtype-driven refresh path at `0x0040eba0`, so this is now the safest current read for the linked-site anchor position-triplet refresh beneath the placed-structure local-runtime family rather than a generic route query.","objdump + caller inspection + local disassembly + linked-site-anchor correlation + local-runtime correlation"
0x0040e450,131,placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small wrapper that rebuilds one placed structure's cloned local-runtime record from its current candidate stem and cached profile slot. The helper copies the current stem string from the candidate referenced by `[this+0x3cc]`, resolves the matching live candidate id through `indexed_collection_resolve_live_entry_id_by_stem_string` `0x00416e20`, seeds the projected-rectangle profile-slot cache from `[this+0x252]` through `placed_structure_cache_projected_rect_profile_slot_id` `0x00414470`, and then re-enters `placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds` `0x00418a60` with the current placed-structure pointer. It stores the returned cloned record into `[this+0x24e]`, refreshes the local cached profile slot from `[record+0x732]` into `[this+0x252]`, and ties the clone back to the owning placed structure through `[record+0x73a] = this`. Current grounded caller is the collection-wide wrapper `0x004133b0`, so this now reads as the cloned local-runtime rebuild helper for one live placed structure rather than an unowned stem lookup.","objdump + caller inspection + local disassembly + local-runtime-clone correlation + projected-rect-profile correlation"
0x0040e4e0,921,placed_structure_publish_contextual_status_text_for_linked_peer_and_selection_state,map,thiscall,inferred,objdump + local disassembly + localization-call correlation,2,"Large contextual status-text publisher in the same concrete placed-structure specialization family rooted at `0x005c8c50`. The helper first requires creation-mode byte `[this+0x3d4] == 1`, the specialization's linked-site-capable vtable `+0x70` latch, and several shell or modal gates under `0x006d1a8c` and `0x006d12f0`; it then branches across linked-peer checks through `placed_structure_has_linked_station_or_transit_peer` `0x0040d230`, world-mode fields `[0x0062c120+0x2171/+0x2175/+0x2179/+0x2181]`, current owner checks through `0x004337a0`, and candidate or linked-peer display-name lookups through `0x0051c920`. The resulting text is localized through ids such as `0x00af`, `0x00b0`, `0x00b1`, `0x00b2`, `0x00b3`, and `0x0afd`, assembled through `0x00518de0`, and finally pushed into the shell presenter `0x00538c70` with mode `3`. Several branches also trigger world-side follow-ons through `0x00452db0` and `0x00452fa0`, so this is best read as a contextual linked-peer or selection-status publisher with mode-specific side effects rather than a pure formatter.","objdump + local disassembly + localization-call correlation + linked-peer gate correlation + shell-presenter correlation"
0x0040e880,329,placed_structure_dispatch_primary_context_action_and_reset_status_presenter,map,thiscall,inferred,objdump + local disassembly + linked-peer gate correlation,2,"Primary context-action dispatcher paired with `placed_structure_publish_contextual_status_text_for_linked_peer_and_selection_state` `0x0040e4e0`. The helper first resets the active shell presenter through `0x00538c70` using the fixed token rooted at `0x005c87a8`, then reuses the same linked-site-capable vtable `+0x70` latch, creation-mode byte `[this+0x3d4] == 1`, linked-peer path `0x0040d230 -> 0x0047f310 -> 0x0048b660`, and world-mode gates `[0x0062c120+0x2175/+0x2179/+0x2181]` to dispatch one of several follow-ons including `0x00413620`, `0x00453510`, `0x00452db0`, and `0x00452fa0`. Current evidence grounds this as the specialization-side primary action or activation dispatcher that accompanies the contextual status publisher, not as another local-runtime refresh helper.","objdump + local disassembly + linked-peer gate correlation + shell-presenter correlation + world-mode branch correlation"
0x0040e9d0,464,placed_structure_format_context_label_or_owner_name_for_ui_query,map,thiscall,inferred,objdump + local disassembly + string correlation,2,"Query-style label formatter in the same specialization table `0x005c8c50`. The helper first short-circuits when vtable slot `+0x14` says the current object should not answer, then chooses between three outcomes: when shell branch `[0x006cec74+0x74]` is live it formats one localized label through id `0x00b4`, appends the fixed suffix `\\nAbsIndex %d`, copies that text into the caller buffer through `0x0051d8a0`, and returns `1`; under a narrower owner or company-state path gated by `[this+0x276]`, shell mode `[0x006cec74+0x253]`, the linked-site latch, and the active modal state at `0x006d12f0`, it resolves one company-side display label through `0x00426b10`, stores it through the caller out-pointer, and returns `2`; otherwise it falls back to `0x00455860`. This is therefore the safest current read for a specialization-side UI label or owner-name query wrapper rather than another action dispatcher.","objdump + local disassembly + string correlation + ui-query correlation"
0x0040eba0,620,placed_structure_set_world_coords_and_refresh_local_runtime_side_state,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Heavier placed-structure world-coordinate mutation helper above the local-runtime side refresh family. The function updates the current record's world position through `0x00455860`, recomputes cached grid coordinates `[this+0x388]` and `[this+0x38c]`, and rewrites the world-grid owner mapping through `0x0042c9f0` and `0x0042c9a0`. On the candidate subtype-`4` branch it also removes and then re-appends the current site to the nearby-transit proximity bucket family through `placed_structure_collection_remove_site_id_from_all_proximity_bucket_lists` `0x004814c0` and `placed_structure_collection_append_site_into_all_proximity_bucket_lists` `0x00481480`. After that it rebuilds the same local position or scalar triplet family later serviced by `0x0040ee10`, caches the accepted scalar pair in `[this+0x392]` and `[this+0x396]`, publishes the chosen triplet through the shared setter `0x00530720`, optionally refreshes the linked peer route-entry anchor through `0x00480710`, and finally tails into `placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime` `0x0040e360`. Current grounded callers include the broader rebuild paths `0x0040ef10` and `0x0040f6d0`, later site-mutation branches `0x00419110`, `0x0046ef40`, `0x004707da`, and `0x00473bf0`, plus shell-side subject updates around `0x00507cf0` and `0x00508bb0`, so this is now the safest current owner for world-coordinate updates plus local-runtime side-state refresh rather than a generic movement helper.","objdump + caller inspection + local disassembly + world-coordinate mutation correlation + local-runtime correlation + proximity-bucket correlation"
0x0040ee10,248,placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small placed-structure local-runtime side refresh over one live record. The helper samples the current structure coordinate pair through `0x00455800` and `0x00455810`, converts that pair through the basis at `0x006d4024`, `0x0051f090`, and `0x00534490` into one base scalar, and then conditionally adjusts that scalar when the linked candidate-side structure record keeps nonzero byte `[candidate+0xba]` via the rounded world-grid sampler `0x0044ae40` and the fixed subtractive offset at `0x005c8840`. When the auxiliary preview owner gate `shell_has_auxiliary_preview_owner` `0x00434050` is active, it rounds that scalar to an integer float. It then publishes the resulting position triplet through the shared setter `0x00530720` and tails into `placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime` `0x0040e360`. Current grounded callers are the collection-wide local-runtime refresh wrapper `0x004133b0` and the connected-component recursion tail `placed_structure_recursive_collect_connected_component_tile_bounds` `0x00415f20`, so this is now the strongest current owner for the per-site local-runtime position-triplet refresh rather than a generic coordinate helper.","objdump + caller inspection + local disassembly + local-runtime correlation + connected-component correlation"
0x0040ef10,1984,placed_structure_finalize_creation_or_rebuild_local_runtime_state,map,thiscall,inferred,objdump + caller inspection + placement and mutation correlation,3,"Broad placed-structure post-create or post-edit rebuild above the narrower route-style lane. The helper validates several linked-site and world-state preconditions before keeping the current site live, increments the global live-site count at `0x0062be40`, seeds runtime mode and year fields at `[this+0x390]`, `[this+0x3d4]`, and `[this+0x3d5]`, refreshes the adjacent site-status or overlay family through `0x0040d2d0`, and rebuilds one larger local owner or service bundle through `0x00418be0`, `0x0040eba0`, and the scalar-staging family `0x00475ed0` / `0x00474fe0` / `0x00475010` / `0x00475030` into fields such as `[this+0x24e]`, `[this+0x252]`, `[this+0x25a]`, and `[this+0x25e]`. Later in the same body it re-enters `0x0040db30`, and when the local latch at `[this+0x29e]` is still zero it also re-enters `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0` with stack flag `1`. The tail is tighter now too: when creation-mode byte `[this+0x3d4]` equals `1`, the branch at `0x0040f692` triggers `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with kind `6` just before the local live-site follow-on at `0x433b80`. Current grounded callers include the placement-side builders at `0x00403ef3` and `0x00404489`, later site-mutation paths at `0x0046f073` and `0x004707ff`, and one train-side site operation at `0x005098eb`, so this now looks like the broad post-create or post-edit runtime rebuild above route-style scoring and peer-link emission rather than a route-style-only helper.","objdump + caller inspection + placement and mutation correlation + route-style rebuild correlation + runtime-effect trigger-kind correlation"
0x0040f6d0,891,placed_structure_construct_entry_from_candidate_and_world_args,map,thiscall,inferred,objdump + constructor inspection + caller correlation,3,"Lower constructor beneath the shared placed-structure allocator at `0x004134d0`. The helper writes the new placed-structure id into `[this+0x2a4]`, clears a large band of local runtime fields, copies the candidate stem or label payload from the caller-supplied construction scratch record, initializes local world geometry through `0x0040cd70`, `0x0045b9b0`, `0x00455750`, and `0x00455720`, quantizes the input coordinates into the cached grid terms at `[this+0x388]` and `[this+0x38c]`, seeds the current scenario year into `[this+0x3d5]`, and initializes the class-weight lanes near `[this+0x28a]` from the linked candidate vtable owner. It then zeroes the local route-style and service-score bands, conditionally builds the first local owner or service record through `0x00418be0` and `0x0040eba0`, resolves the initial linked site id at `[this+0x2a8]` through `0x00481390` when the backing candidate subtype byte `[candidate+0x32]` is `1`, seeds region linkage through `0x0044a800` and `0x0041f7e0`, optionally re-enters `0x0040db30` for subtype `4`, and finally seeds the trailing random-like dwords at `[this+0x3d9]` and `[this+0x3dd]` from `0x518d70`. Current grounded caller is `placed_structure_collection_allocate_and_construct_entry` `0x004134d0`, so this is now the concrete placed-structure constructor rather than an anonymous lower helper beneath the placement-side builders.","objdump + constructor inspection + caller correlation + placed-structure runtime-state correlation"
0x0040fbe0,224,placed_structure_endpoint_pair_has_shared_route_entry_key,map,thiscall,inferred,objdump + caller inspection + world-grid chain comparison,3,"Boolean peer-test between one placed structure and one caller-supplied peer site id. The helper converts the current site and the peer site into their derived world-grid owner records through `0x00455800`, `0x00455810`, the world-grid tables rooted at `[0x0062c120+0x2129]`, and the placed-structure resolver `0x0040fa50`. It then compares the two route-entry chains rooted at `[cell+0x0ef]`, using the chain lengths at `[cell+0x0eb]`, and returns `1` on the first shared leading `u16` route-entry key; otherwise it returns `0`. Current grounded callers are the route-link emitter at `0x0040fef0`, where it blocks duplicate endpoint pairing before `placed_structure_route_link_allocate_site_pair_for_candidate_class` `0x00467f50`, and the neighboring cleanup sweep at `0x0040d2aa`, where it decides whether an existing site-owned route-link should be erased. This now looks like the shared duplicate-or-overlap test for the route-link family rather than a generic proximity check.","objdump + caller inspection + world-grid chain comparison + route-link duplicate-check correlation"
0x0040fef0,752,placed_structure_try_emit_best_route_style_peer_link_for_candidate_class,map,thiscall,inferred,objdump + caller inspection + placed-structure sweep inspection,3,"Scans the live placed-structure collection for one best peer site and emits a missing route-link for one caller-selected candidate class when a qualifying endpoint pair survives. The helper first derives one distance cap from the current placed-structure population size at `0x0062b26c`, scales that cap by the caller-supplied float, and then walks the live placed-structure ids in a wrapped pseudo-random order. Candidate peers must have a positive class-specific weight in the placed-structure lane `[peer+class*4+0x27e]`, differ from the source site, pass the linked-instance class gate `0x0040c990 == 1`, and lie inside the chosen distance window after the coordinate and span checks built from `0x00455800`, `0x00455810`, `0x00455f60`, and nearby math helpers. The strongest surviving peer is kept through a weighted comparison, and if one remains the helper re-enters `placed_structure_endpoint_pair_has_shared_route_entry_key` `0x0040fbe0`; only when that duplicate check fails does it call `placed_structure_route_link_allocate_site_pair_for_candidate_class` `0x00467f50` with the source site id from `[this+0x2a4]`, the chosen peer id, and the same candidate-class argument. Current grounded callers are the larger per-site world pass around `0x00410665` and the route-style grid contribution branch at `0x0042cafe`, so this now looks like the current peer-selection emitter for site-owned route-style links rather than a low-level allocator wrapper.","objdump + caller inspection + placed-structure sweep inspection + route-link emission correlation"
0x004101e0,6843,placed_structure_rebuild_route_style_candidate_scores_and_peer_links,map,thiscall,inferred,objdump + caller inspection + route-style emission correlation,3,"Large per-site rebuild pass above the route-style link emitter. The helper first requires the current placed structure to pass the linked-instance class gate `0x0040c990 == 1` and several scenario-state gates rooted at `0x006cec78` and `0x006cec7c`, then derives one set of per-class route-style score scalars from the current site's local state, scenario opinion multipliers through `0x00436590`, year-dependent dampers, and the placed-structure class-weight lanes near `[this+0x28a]`. The early compatibility side is tighter now too: it probes the current placed-structure stem against `Nuclear Power Plant`, `Electric Plant`, and `Recycling Plant`, stages three local boolean latches from those matches, and then clears the `Recycling Plant` latch again when the shared build-version query `0x00482e00` reports below `0x68` (`1.04`), so that stem-specific branch is now bounded as a post-`1.04` compatibility lane rather than one timeless route-style rule. For the first three route-style classes it conditionally re-enters `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0` with the caller-supplied mode flag and one computed float score. The function then continues into a larger descriptor-driven scoring phase over the current candidate's runtime descriptor array at `[candidate+0x37]`, building temporary score bands and normalizing them against the same local totals before later write-back. That later phase has another bounded version gate: on one descriptor-accumulation subbranch the helper consults `0x00482e00` again at `0x41109f`, and build `1.05+` (`>= 0x69`) skips one older fallback attenuation path that earlier builds still apply through the local multiplier tables. Current grounded callers are the local per-site branch at `0x0040f640`, which reaches it with stack flag `1`, and the broader placed-structure sweep at `0x004135e3`, which reaches it with stack flag `0`; this is therefore the strongest current owner for route-style candidate scoring and peer-link emission on one live placed structure rather than a narrow one-off helper.","objdump + caller inspection + route-style emission correlation + descriptor-loop inspection + version-gate correlation + stem-probe correlation"
0x004134d0,112,placed_structure_collection_allocate_and_construct_entry,map,thiscall,inferred,objdump + caller xrefs + constructor inspection,3,"Shared direct placement helper above the broader placed-structure runtime rebuild. The helper first obtains one temporary `0x3e1`-sized construction scratch object through `0x53b070` and `0x0040c950`, then allocates one live placed-structure entry from the current collection through `0x518900`, resolves the new record through `0x518140`, and finally re-enters the lower constructor at `0x0040f6d0` with the new entry id plus the caller-supplied coordinate and candidate payload tuple. Current grounded callers include the candidate-placement branches at `0x00403ed5`, `0x0040446b`, and `world_region_try_place_candidate_structure` `0x00422ee0`, plus later mutation or editor-side branches at `0x0046efbf`, `0x0047074b`, `0x00472bef`, `0x00472d03`, and `0x00508fd1`. This now looks like the shared placed-structure allocator and constructor entrypoint beneath the placement-side builders rather than a route-style-specific helper.","objdump + caller xrefs + constructor inspection + placement correlation"
0x0041d550,574,locomotive_era_and_engine_type_pass_company_policy_gate,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + engine-type correlation,2,"Policy gate beneath the preferred-locomotive chooser and its non-electric fallback. The helper operates on one locomotive-era or availability record whose linked locomotive id sits at `[this+0x126]`. On the fuller policy path, reached when record field `[this+0x41]` is `2` or `3`, it first respects several scenario-state locks rooted at `[0x006cec74+0x180]`, `[0x006cec78+0x4c8c]`, `[0x006cec7c+0x82]`, and `[0x006cec74+0x247]`, then resolves the linked locomotive record from `0x006ada84` and dispatches its engine-type dword `[locomotive+0x10]` across three scenario opinion slots through `scenario_state_sum_issue_opinion_terms_raw` `0x00436710`: `0x1c6`, `0x1c7`, and `0x1c8`, which current evidence now best aligns with the steam, diesel, and electric lanes. It also special-cases the locomotive stem at `[locomotive+0x34]` against the local string `WhaleL`; current data-file correlation now ties that stem to the `Orca NX462` locomotive family and its `WhaleL_NE` asset set, and when that compare hits the helper explicitly zeros the accumulated issue-opinion result before the later availability checks, so that family loses the positive-opinion shortcut rather than taking a bonus branch. It then consults one neighboring locomotive-derived issue or policy id through `0x00442a85`, and applies a late scenario availability triplet from `[0x006cec78+0x4c97..0x4c99]` against three per-record bytes `[this+0x30..0x32]` plus record field `[this+0x7b]`. That triplet now has a stronger player-facing read: the same three scenario bytes are the live editor-policy fields owned by `map_editor_locomotive_availability_panel_construct` `0x004cd680` and `map_editor_locomotive_availability_panel_handle_message` `0x004cf0d0`, and their localized labels `2863..2865` are `All Steam Locos Avail.`, `All Diesel Locos Avail.`, and `All Electric Locos Avail.`. The current gate is narrower than a plain override: when the issue-opinion result stays positive and none of those three editor bytes are enabled, that positive result alone seeds the local availability flag; but once any of the editor family bytes is nonzero, the helper instead requires one matching intersection between the per-record family bytes `[this+0x30..0x32]` and the corresponding scenario bytes `0x4c97..0x4c99`. Independent of that family check, record field `[this+0x7b]` can still carry the path into the later year-window gate. On the simpler path it falls straight to an era-window gate using the current scenario year with floor `0x726` against `[this+0x105]` and `[this+0x109]`, plus one current-month-like check from `[0x006cec78+0x0f]`. The helper returns `1` when the era and engine family pass those combined scenario, opinion, availability, and year gates; otherwise `0`. Current grounded callers are `company_select_preferred_available_locomotive_id` `0x004078a0` and `locomotive_collection_select_best_era_matched_non_electric_fallback_id` `0x00461cd0`.","objdump + caller xrefs + callsite inspection + engine-type correlation + year-window correlation + scenario-gate correlation + editor-locomotive-availability correlation + WhaleL carveout correlation + engine-data correlation"
0x00417790,160,map_angle_rotate_grid_offset_pair_into_world_offset_pair,map,cdecl,inferred,objdump + callsite inspection + math-table correlation,2,"Small angle-table rotation helper beneath the placement projection family. The helper normalizes the caller-supplied heading float into the engine's cyclic angle domain, indexes one sine or cosine-like basis table under `0x006d4024`, and then applies that basis pair to the caller-supplied X or Y grid offsets before writing the rotated world-space offset pair through the two out-pointers. Current grounded caller is `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, so this now looks like the low-level offset-rotation helper rather than a generic trig wrapper.","objdump + callsite inspection + math-table correlation"
0x00417840,205,placed_structure_project_candidate_grid_extent_offset_by_rotation,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Projects one candidate-sized local grid extent into rotated world-space X or Y offsets for placement and mutation previews. The helper resolves the caller-supplied placed-structure id through the current collection, pulls one local grid basis pair through `0x00413d80`, reads the linked candidate footprint bytes `[candidate+0xb8]` and `[candidate+0xb9]`, converts those grid extents into local offset terms, and then re-enters `map_angle_rotate_grid_offset_pair_into_world_offset_pair` `0x00417790` with the caller-supplied heading float to produce the rotated output pair. Current grounded callers include the city-connection placement chooser `0x00402cb0`, the placed-structure local rebuild lane at `0x0040de78`, subtype-`1` placement validation inside `0x004197e0`, and later world-side update branches at `0x00417b6f`, `0x00417e27`, `0x0041a250`, `0x0041a615`, `0x004802c6`, `0x00480875`, and `0x00480d50`. This now looks like the shared projected-footprint offset helper beneath placement validation rather than an unnamed geometry routine.","objdump + caller xrefs + callsite inspection + placement-correlation"
0x00417b40,986,route_entry_collection_try_reuse_covering_entry_for_site_coords_and_heading,map,thiscall,inferred,objdump + caller xrefs + local disassembly + callsite inspection,3,"Tries to reuse one already-existing route entry from the global route-entry collection `0x006cfca8` for a caller-supplied site id, world-space point, and heading instead of synthesizing a new endpoint entry. The helper first projects the current candidate footprint through `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, probes the route-entry collection through `0x00494cb0`, and then subjects the returned entry plus its linked neighbors at `[entry+0x206/+0x20a/+0x20e]` to a tighter compatibility screen: `[entry+0x226]` must be clear, `[entry+0x222]` must be unset or already owned by the same site id, `[entry+0x20e]` must be `-1`, and the neighboring entries cannot already point back through the same side-link pattern selected by byte `[entry+0x201]`. When a candidate survives, the helper computes one accepted local heading and anchor offset through `0x0048bb40`, `0x005a1390`, `0x005a152e`, `0x0048a1a0`, `0x0048a1c0`, and `0x0051db80`, writes the accepted world-space pair and heading back through the caller out-pointers, optionally stores the reused route-entry id through stack arg `+0x2c`, and returns `1`; otherwise it returns `0`. Current grounded callers are the linked-site constructor `0x00480210`, the linked-site runtime refresh owner `0x00480710`, the broader route-anchor chooser around `0x0041a137`, and the StationPlace orientation-search helper `0x00508040`, so this is the safest current read for the reusable covering-route-entry search path rather than another route-synthesis owner.","objdump + caller xrefs + local disassembly + route-entry reuse correlation + linked-site correlation + station-place correlation"
0x004185a0,100,world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Small world-grid mask helper beneath the neighboring projected-rectangle raster family. The helper walks one caller-supplied rectangle from the four dwords rooted at stack arg `+0x04`, reads the aligned float sample band from the caller buffer at stack arg `+0x08`, skips cells whose sample is still the sentinel `0x497423f0`, and otherwise toggles bit `0x01` in the grid-byte mask rooted at `[0x0062c120+0x2135]` by XORing it with the low bit of the caller-supplied byte flag at stack arg `+0x0c`. Current grounded callers are the higher projected-rectangle workers at `0x00418610`, `0x00418a60`, and `0x00418d40`, so this is now bounded as a non-sentinel mask-toggle helper rather than another generic grid writer.","objdump + caller inspection + local disassembly + grid-mask correlation"
0x00418610,584,world_grid_refresh_projected_rect_sample_band_and_flag_mask,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared projected-rectangle world-grid helper above the flagged-region float-stats refresher `0x00415020` and the non-sentinel mask-toggle helper `0x004185a0`. The function resolves one placed-structure record from the caller-supplied id, optionally clears an out flag, validates the current global scan rectangle at `0x0062b7a8..0x0062b7b4` against the live world bounds, and then derives the two boolean mode inputs for `0x00415020` from the linked candidate helpers `0x0040cc80`, `0x0040cc60`, and `0x0040cc40`. On success it repopulates the temporary float band at `0x0062b7d0` by sampling every cell in the rectangle through `0x00448aa0`, publishes the rectangle through `0x0044d410`, and on the single-sample path re-enters `0x004185a0` to toggle the corresponding bit-mask cells. The richer branch also probes the current candidate subtype and per-candidate flags, checks local neighborhood acceptance through `0x00414c50`, samples one midpoint float through `0x00448bd0`, and stamps one or more world-grid cells through `0x0044dca0`. Current grounded callers are the neighboring placed-structure runtime helper at `0x00418be0` and the placement validator `placed_structure_validate_projected_candidate_placement` `0x004197e0`, so the safest current read is a projected-rectangle sample-band and flag-mask refresh pass rather than a generic float scan.","objdump + caller inspection + local disassembly + world-grid sample-band correlation + placement-validator correlation"
0x00419110,234,placed_structure_collection_refresh_local_runtime_side_state_in_rect_from_cell_bucket_map,map,cdecl,inferred,objdump + caller xrefs + local disassembly + bucket-map correlation,3,"Rectangular placed-structure refresh wrapper over a hashed per-cell bucket map. The helper clamps the caller rectangle against live world dimensions `[0x0062c120+0x2155/+0x2159]`, packs each cell key as `(row << 16) | col`, resolves one bucket head through the caller-supplied map root at `[arg0+0x88]` and the shared hash lookup `0x0053dae0`, and then walks the returned linked chain. For every resolved bucket entry it forwards the stored coordinate pair from `[entry+0x04/+0x08]` plus two zero stack flags into `placed_structure_set_world_coords_and_refresh_local_runtime_side_state` `0x0040eba0` on the current placed-structure owner carried by that entry, so the current effect is a local-runtime side-state refresh across every bucketed site in the rectangle rather than a generic collection iterator. Current grounded caller is the edit-side branch at `0x004bc851`, immediately after the neighboring nibble and companion-float mutations, so this is the safest current read for the bucket-map-driven rect refresh wrapper rather than another world-grid brush helper.","objdump + caller xrefs + local disassembly + bucket-map correlation + local-runtime-side-state correlation"
0x00419200,41,world_grid_query_projected_rect_scratch_cell_dword_if_present,map,cdecl,inferred,objdump + caller xrefs + local disassembly + projected-rect correlation,3,"Tiny projected-rectangle scratch-bank getter over the temporary dword cell-value bank rooted at `0x0062b300`. When that bank exists, the helper flattens the caller-supplied cell coordinates through live world width `[0x0062c120+0x2155]` and returns the corresponding dword from the bank; otherwise it returns `0`. Current grounded caller is the later world-side branch at `0x0048af99`, which uses the returned nonzero test as one score or gating input, so this is the safest current read for the projected-rect scratch-cell dword getter rather than another permanent world-grid query.","objdump + caller xrefs + local disassembly + projected-rect correlation + scratch-bank correlation"
0x0041ab50,6,city_database_entry_constant_38_stub_vtable_5c9750_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot immediately before the city-database entry load and handle-refresh pair in table `0x005c9750`. The helper returns literal `38` in `EAX` and exits. Current evidence does not justify a higher semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly"
0x0041ab60,6,city_database_entry_constant_34_stub_vtable_5c9750_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot immediately before the city-database entry load and handle-refresh pair in table `0x005c9750`. The helper returns literal `34` in `EAX` and exits. Current evidence does not justify a higher semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly"
0x0041ab70,5,city_database_entry_load_tagged_payload_via_0x45c6f0,map,thiscall,inferred,objdump + vtable correlation + local disassembly,2,"Tiny city-database-entry-family loader thunk in the sibling vtable rooted at `0x005c9750`. The helper simply jumps into `0x0045c6f0`, which stages tag family `0x61a9/0x61aa/0x61ab`, restores two strings into `[this+0x32e]` and `[this+0x332]`, and iterates the child runtime band rooted at `[this+0x316]`. The table-family alignment is now direct: `map_load_city_database` `0x00474610` iterates its loaded records and dispatches vtable slot `+0x44`, which in `0x005c9750` resolves into the same record family immediately adjacent to this loader slot.","objdump + vtable correlation + local disassembly + city-database loader correlation"
0x0041ab80,127,city_database_entry_refresh_named_handle_and_return_scaled_primary_float,map,thiscall,inferred,objdump + caller inspection + local disassembly + city-database family correlation,2,"City-database-entry-family method in the sibling vtable rooted at `0x005c9750`. The helper clears and rebuilds one named handle under owner `0x006d4020`, stores the result into `[this+0x1c]`, queries three base floats through `0x0045c480`, and returns one scaled float derived from the first queried component and constant `0x005c97c0`. Current grounded callers are later world-side branches at `0x0046e4f7`, `0x004aafee`, and `0x004ab020`. The exact user-facing semantic of the handle is still open, but the owning family now aligns structurally with the city-database collection loaded by `0x00474610`.","objdump + caller inspection + local disassembly + city-database family correlation"
0x0041ac00,3,city_database_entry_false_stub_vtable_5c9750_slot0,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-false virtual slot adjacent to `0x0041ab80` in the city-database-entry table `0x005c9750`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
0x0041ac10,3,city_database_entry_false_stub_vtable_5c9750_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Second tiny literal-false virtual slot adjacent to `0x0041ab80` in the city-database-entry table `0x005c9750`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
0x0041ac20,3,city_database_entry_false_stub_vtable_5c9750_slot2,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Third tiny literal-false virtual slot adjacent to `0x0041ab80` in the city-database-entry table `0x005c9750`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
0x0041ac30,6,city_database_entry_constant_10_stub_vtable_5c9750_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot in the city-database-entry table `0x005c9750`. The helper returns literal `10` in `EAX` and exits. Current evidence does not yet justify a higher semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly"
0x0041ac40,6,city_database_entry_true_stub_vtable_5c9750_slot0,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-true virtual slot adjacent to `0x0041ac30` in the city-database-entry table `0x005c9750`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
0x0041ac50,6,city_database_entry_true_stub_vtable_5c9750_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Second tiny literal-true virtual slot adjacent to `0x0041ac30` in the city-database-entry table `0x005c9750`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
0x0041f5c0,134,runtime_object_vtable_5c9a60_load_tagged_payload_and_build_dynamic_helper_field_0x37f,map,thiscall,inferred,objdump + vtable scan + local disassembly + sibling-table correlation,2,"Payload-side virtual slot in the sibling runtime-object table rooted at `0x005c9a60`. The helper clamps scalar `[this+0x31b]` to at least `1.0`, clears `[this+0x317]` when that clamp fires, reloads the shared tagged string-triplet payload through `0x00455fc0`, allocates one `0x88`-byte helper through `0x0053b070`, constructs that helper through `0x00518b90`, stores it into `[this+0x37f]`, and then forwards the caller-supplied bundle or stream context into that helper through `0x00518680`. The function returns the accumulated size from the payload reload plus helper load. Current evidence keeps the subtype name open, but the ownership of dynamic helper field `[this+0x37f]` is now grounded.","objdump + vtable scan + local disassembly + sibling-table correlation + dynamic-helper correlation"
0x0041f650,31,runtime_object_vtable_5c9a60_serialize_tagged_string_triplet_and_forward_stream_to_dynamic_helper_0x37f,map,thiscall,inferred,objdump + vtable scan + local disassembly + sibling-table correlation,2,"Small stream-side virtual slot in the same sibling runtime-object table `0x005c9a60`. The helper first emits the tagged string-triplet payload through `0x004559d0`, then forwards the same caller-supplied bundle or stream context into helper `[this+0x37f]` through `0x00517d90`. Current evidence now only grounds it as a tagged string-triplet serializer plus dynamic-helper wrapper over field `[this+0x37f]`, not as a broader collection rebuild.","objdump + vtable scan + local disassembly + sibling-table correlation + dynamic-helper correlation"
0x0041f680,25,runtime_object_vtable_5c9a60_refresh_global_preview_helper_and_dispatch_mode1_with_field_0x23a,map,thiscall,inferred,objdump + vtable scan + local disassembly + sibling-table correlation,2,"Small virtual slot in the sibling runtime-object table `0x005c9a60`. The helper first re-enters `0x00455de0`, which refreshes the current global preview or helper owner from the runtime object's normalized coordinates and anchor triplet. It then loads owner handle `[this+0x23a]`, sets `ECX = 1`, and tails into `0x004cf830`, which allocates or refreshes one `0xa0`-byte helper object before forwarding both values into `0x004cf550`. The exact user-facing subtype remains open, so the current note stays structural around the global-preview refresh plus mode-1 dispatch using field `[this+0x23a]`.","objdump + vtable scan + local disassembly + sibling-table correlation + global-preview-helper correlation"
0x0041f6a0,11,runtime_object_query_dynamic_helper_slot_count_field_0x37f,map,thiscall,inferred,objdump + local disassembly + sibling-table correlation,2,"Tiny sibling-family helper that treats field `[this+0x37f]` as one indexed collection and returns its current slot count through `indexed_collection_slot_count` `0x00517cf0`. Current grounded caller is `world_region_balance_structure_demand_and_place_candidates` `0x004235c0`, where it bounds one region-local profile or structure-count loop.","objdump + local disassembly + sibling-table correlation + slot-count correlation"
0x0041f6b0,40,runtime_object_query_world_scalar_at_rounded_normalized_coords,map,thiscall,inferred,objdump + local disassembly + shared-coordinate-helper correlation,2,"Small shared helper over the broader `0x23a` runtime-object family. It queries the normalized secondary and primary coordinates through `0x00455810` and `0x00455800`, rounds both through `0x005a10d0`, then forwards the resulting integer pair plus the active world root `0x0062c120` into `0x0044afa0`. Current evidence is strong enough only for the rounded-coordinate world-scalar query shape, not for a more semantic name for the returned scalar.","objdump + local disassembly + shared-coordinate-helper correlation + world-scalar-query correlation"
0x0041f6e0,12,runtime_object_center_world_grid_cell_has_packed_u16_token,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small helper that resolves the current object's center world-grid cell through `world_region_resolve_center_world_grid_cell` `0x00455f60` and then tails into `world_grid_cell_has_packed_u16_token_in_6byte_roster` `0x0042b2d0` with the caller-supplied `u16` token. Current grounded callers include the city-connection bonus sweep `0x004010f0`, where it acts as a center-cell token probe rather than a broader route or ownership query.","objdump + local disassembly + caller correlation + packed-roster correlation"
0x0041f6f0,5,runtime_object_query_flag_byte_0x42,map,thiscall,inferred,objdump + local disassembly + field inspection,1,"Tiny raw byte getter over field `[this+0x42]`. The helper zero-extends that byte into `EAX` and returns immediately, with no side effect. Current evidence does not yet justify a tighter semantic name for the flag itself.","objdump + local disassembly + field inspection"
0x0041f700,3,runtime_object_false_stub_vtable_5cfd00_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-false virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
0x0041f710,6,runtime_object_true_stub_vtable_5cfd00_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-true virtual slot immediately after `0x0041f700` in the sibling `Infrastructure`-side table `0x005cfd00`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
0x0041f720,136,runtime_object_vtable_5c9a60_format_name_and_conditionally_dispatch_action_0x12,map,thiscall,inferred,objdump + vtable scan + local disassembly + caller correlation,2,"Virtual slot in the sibling runtime-object table rooted at `0x005c9a60`. The helper formats the current name lane `[this+0x356]` into one stack-local shell text buffer through `0x005193f0` and `0x00518de0`, publishes that buffer through `0x00538c70`, and then checks world state `[0x0062c120+0x2175]`. When that state is `0` or `0x15`, it dispatches `0x00452fa0` with current helper handle `[this+0x23a]`, literal action `0x12`, and the paired sentinel dwords `0x1869f/0x1869f`. The subtype name behind `0x005c9a60` is still open, so the current note stays structural around the formatted-name publish plus conditional action dispatch.","objdump + vtable scan + local disassembly + caller correlation + sibling-table correlation"
0x0041f7b0,42,runtime_object_vtable_5c9a60_publish_fixed_shell_payload_and_jump_0x453510_when_world_state_0x12,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Small virtual slot in the same sibling runtime-object table `0x005c9a60`. The helper publishes the fixed payload at `0x005c87a8` through `0x00538c70`, then checks world state `[0x0062c120+0x2175]`; when that state equals `0x12`, it tails into `0x00453510`. Current evidence is strong enough for the publish-plus-conditional-dispatch shape but not yet for a user-facing subtype name.","objdump + vtable scan + local disassembly + sibling-table correlation"
0x0041f7e0,35,placed_structure_prepend_peer_id_into_cached_u16_chain_head_field_0x383,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Small chain-link helper beneath the placed-structure constructor family. The current record supplies cached head word `[this+0x383]`; the caller-supplied peer record receives that old head in `[peer+0x270]`, and the current record then replaces `[this+0x383]` with the peer's own placed-structure id `[peer+0x2a4]`. Current grounded caller is `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0`, which reaches this helper immediately after seeding `[site+0x26e]` and `[site+0x270]`, so the safest read is a prepend into one cached `u16` link chain rather than a broader region or ownership transfer.","objdump + caller xrefs + local disassembly + link-chain correlation"
0x0041f810,51,placed_structure_resolve_live_record_from_cached_u16_chain_head_field_0x383,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Small resolver over cached head word `[this+0x383]`. The helper first asks collection `0x0062b26c` whether that `u16` id is still live through `0x00517d40`; when present it resolves and returns the corresponding record through `0x00518140`, otherwise it returns null. Current grounded caller is the higher route-style or transient branch at `0x0043bd62`, which uses the returned record before re-entering `0x0040cf00`.","objdump + caller xrefs + local disassembly + link-chain correlation"
0x0041f850,126,placed_structure_remove_peer_from_cached_u16_chain_and_clear_peer_link_words_0x26e_0x270,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Removal-side companion to `0x0041f7e0` beneath the placed-structure rebuild family. The current record owns cached head word `[this+0x383]`, while the caller-supplied peer contributes its placed-structure id `[peer+0x2a4]` and next-link word `[peer+0x270]`. When the head equals the peer id, the helper replaces `[this+0x383]` with the peer's next link; otherwise it walks the current linked `u16` chain through collection `0x0062b26c` and each record's own `[record+0x270]` until it finds the predecessor, then patches that predecessor's `[record+0x270]` to the peer's next link. Before returning it clears both peer link words `[peer+0x26e]` and `[peer+0x270]`. Current grounded caller is the placed-structure rebuild branch at `0x0040e25e`.","objdump + caller xrefs + local disassembly + link-chain correlation"
0x0041f8d0,55,placed_structure_clear_cached_u16_chain_from_head_field_0x383,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Small chain-clear helper over cached head word `[this+0x383]`. Starting from that `u16` head id, the helper repeatedly resolves each live record through collection `0x0062b26c`, follows link word `[record+0x270]`, and clears both `[record+0x26e]` and `[record+0x270]` on every traversed record until the chain reaches zero. Current grounded caller is the release-side helper `0x00420670`, which uses this pass immediately before tailing into base cleanup `0x00455d20`.","objdump + caller xrefs + local disassembly + link-chain correlation"
0x0041f910,46,runtime_object_query_mode_gate_or_flag_byte_0x42_when_class0,map,thiscall,inferred,objdump + local disassembly + mode-gate correlation,2,"Small mode-gated flag query adjacent to the sibling runtime-object family. It first checks shell mode gate `0x004338c0` on the active scenario root `0x006cec78`; when that gate is inactive it returns literal `1`. When the gate is active it also returns `1` for nonzero class dword `[this+0x23e]`, and only on the class-0 path does it return byte `[this+0x42]`. This keeps the current note structural around the mode-gated runtime-flag query rather than overnaming the flag itself.","objdump + local disassembly + mode-gate correlation + field inspection"
0x00412af0,117,indexed_collection_find_live_entry_id_by_casefolded_name_at_field_0x04,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small indexed-collection lookup by casefolded name. The helper walks the live entries through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, compares the first byte of the caller string against entry field `[entry+0x04]` after normalizing both through `0x0051d660`, and then falls back to full string comparison through `0x005a57cf`. On the first exact match it returns that live entry id; otherwise it returns `0`. Current grounded caller is `0x00412b70`, which uses it over the structure-candidate pool `0x0062b268`.","objdump + local disassembly + caller correlation + collection-name-lookup correlation"
0x00412b70,35,indexed_collection_resolve_live_entry_by_casefolded_name_at_field_0x04,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small resolve-by-name wrapper over `indexed_collection_find_live_entry_id_by_casefolded_name_at_field_0x04` `0x00412af0`. It searches the current collection for the caller-supplied casefolded name, and when a live id is found it resolves and returns the backing record through `indexed_collection_resolve_live_entry_by_id` `0x00518140`; otherwise it returns null. Current grounded callers are the region-profile helpers `0x0041f940` and `0x0041f9b0`, where it resolves structure-candidate records from region-profile labels against the global candidate pool `0x0062b268`.","objdump + local disassembly + caller correlation + collection-name-lookup correlation"
0x0041f940,88,world_region_count_structure_profiles_passing_availability_gate,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Counts the current region subcollection entries at `[region+0x37f]` whose backing candidate resolves through `0x00412b70` and passes the neighboring availability gate `0x0041f998`. The helper walks the live subcollection backward through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, increments the running count only for candidates that survive both gates, and returns that total. Current grounded caller is the editor-side region panel family around `0x004cbe19`, where it acts as the ungated companion to the stricter year-filtered counter `0x0041f9b0`.","objdump + local disassembly + caller correlation + region-subcollection correlation"
0x0041f998,23,structure_candidate_availability_gate_reject_subtype2_without_availability_word_or_recipe_runtime,map,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Tiny flag-setting predicate over one structure-candidate record. Candidates whose subtype byte `[candidate+0x32]` is not `2` pass immediately. Subtype-`2` candidates only pass when availability word `[candidate+0xba]` is nonzero or runtime recipe latch `[candidate+0x7ac]` is nonzero; when both are zero the helper leaves the zero flag set so its callers reject the candidate. Current grounded callers are the two region-profile counters `0x0041f940` and `0x0041f9b0`.","objdump + local disassembly + caller correlation + candidate-availability correlation"
0x0041f9b0,126,world_region_count_structure_profiles_matching_subtype_and_max_year_after_availability_gate,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Counts the current region subcollection entries at `[region+0x37f]` whose backing candidate resolves through `0x00412b70`, passes the neighboring availability gate `0x0041f998`, has subtype byte `[candidate+0x32]` equal to the caller-supplied subtype, and has year word `[candidate+0x26]` less than or equal to the caller-supplied max-year threshold. The helper walks the same live subcollection as `0x0041f940` through `0x00517cf0/0x00518380/0x00518140`, increments only when all four gates pass, and returns that stricter count. Grounded callers include the editor region panel around `0x004cbd41`, where it supplies the subtype-`2`, year-`0x726` companion count, and the later summary or warning pass at `0x004d0b1f`.","objdump + local disassembly + caller correlation + region-subcollection correlation + editor-panel correlation"
0x0041fa30,133,world_region_query_profile_weight_by_casefolded_label,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Linearly scans the current region subcollection `[region+0x37f]`, compares each live profile label against the caller-supplied casefolded string through `0x005a57cf`, and returns float field `[entry+0x1e]` from the first match. When no label matches, the helper returns the shared zero float at `0x005c8598`. The editor copy-industry and region-summary paths already ground `[entry+0x1e]` as the mutable profile-weight lane, so the safest read is a casefolded profile-weight query by label rather than a broader scalar lookup.","objdump + local disassembly + caller correlation + region-subcollection correlation + profile-weight correlation"
0x0041fac0,59,world_region_copy_nth_profile_label_and_weight_by_1_based_ordinal,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Resolves the caller-requested 1-based ordinal out of the current region subcollection root `[region+0x37f]`, copies the matched live profile label string into the caller buffer, and stores float field `[entry+0x1e]` through the caller-supplied out pointer. The helper uses `0x00518380/0x00518140` beneath the same subcollection root as `0x0041f940/0x0041fa30`, and grounded editor callers around `0x00421db7`, `0x00421ec7`, and `0x004d1817` use it as the ordinal enumerator for region profile labels plus weights. The current evidence is strong enough for a 1-based ordinal copy helper, not for a broader iterator name.","objdump + local disassembly + caller correlation + region-subcollection correlation + profile-weight correlation"
0x0041fb00,1130,world_region_class0_stamp_local_secondary_overlay_and_scored_refinement_pass,map,thiscall,inferred,objdump + caller xrefs + local disassembly + raster-helper correlation,3,"Heavy per-region helper used only on class-0 region records. The function skips any region whose class dword `[region+0x23e]` is nonzero, rounds the region's normalized coordinates through `0x00455800`, `0x00455810`, and `0x005a10d0`, derives one orientation bucket from `(x+y)&3`, and then runs two bounded local passes around that center. The first pass walks one orientation-dependent ring pattern from the static offset tables `0x00624b28/0x00624b48`, probes quarter-resolution secondary-raster cells through `0x00534e10`, and when that predicate stays clear marks the local secondary overlay through `0x004497a0(world, x, y, 1, 3, 1)`. The second pass scans a bounded square around the same center, scores each in-bounds cell through `math_measure_float_xy_pair_distance` `0x0051db80`, and then combines the local helper cluster `0x00534040`, `0x005340a0`, `0x00534100`, and `0x00533fe0` before returning. Current grounded callers are the region collection walk at `0x00421d04` and the earlier world-build special case at `0x0044308e`, where the same helper runs immediately before `world_region_collection_clear_cell_region_word_and_assign_nearest_region_ids` `0x00421730`.","objdump + caller xrefs + local disassembly + raster-helper correlation + region-build correlation"
0x0041fff0,61,world_query_shell_mode2_or_thresholded_preview_scalar_gate,map,cdecl,inferred,objdump + caller xrefs + local disassembly + global-field correlation,2,"Small global gate over shell state `0x006cec74` and preview owner `0x0062be68`. The helper reads dword `[shell+0x2bb]` and returns `1` immediately when that mode equals `2`; when the mode is nonzero but not `2` it instead compares preview scalar `[0x0062be68+0x20]` against float threshold `0x005c9a9c` and returns `1` only when that comparison passes. Zero mode returns `0`. Current grounded callers are the scored world-scalar helper `0x0044afa0` and the city-connection status formatter band around `0x00420b09`, so the safest current read is the shared shell-mode-or-thresholded-preview gate rather than a region-only predicate.","objdump + caller xrefs + local disassembly + global-field correlation + threshold-gate correlation"
0x00455660,131,runtime_object_publish_world_anchor_triplet_from_normalized_xy_and_height_bias,map,thiscall,inferred,objdump + caller xrefs + local disassembly + sibling-vtable correlation,2,"Shared helper over the broader `0x23a` runtime-object family. The function scales the caller-supplied normalized coordinate pair through `0x005c8700`, converts that pair through world-basis owner `0x006d4024` plus `0x0051f090` and `0x00534490`, adds one caller-supplied integer height bias, optionally rounds that height when `shell_has_auxiliary_preview_owner` `0x00434050` is active, and publishes the resulting world-anchor triplet through `0x00530720`. It is used directly from both the city-entry side (`0x00455d09`, `0x00474253`) and the placed-structure specialization side through `0x0045b110`, so the safest current read is one shared world-anchor triplet publisher from normalized XY plus height bias rather than a city-only geometry helper.","objdump + caller xrefs + local disassembly + sibling-vtable correlation + world-anchor correlation"
0x004557b0,64,record_collection_release_global_iteration_root_0x6acd40_if_present,map,cdecl,inferred,objdump + caller xrefs + local disassembly,2,"Small release-side helper over the current global iteration root at `0x006acd40`. When that root is live the helper clears companion dword `0x006acd3c`, re-enters `0x0045b160` and `0x0045b040` on the pointed record, frees the record through `0x0053b080`, and finally clears `0x006acd40` itself. Current grounded callers include the shell detail-panel manager `0x004ddfc1`, the earlier world-side branch `0x00434a8c`, the building-detail side branch `0x004b6f64`, and later shell constructors at `0x00505dc6` and `0x005147e4`, so the safest current read is one shared global-iteration-root release helper rather than a tool-window-specific cleanup path.","objdump + caller xrefs + local disassembly + global-root correlation"
0x00455800,13,runtime_object_query_normalized_primary_coord,map,thiscall,inferred,objdump + caller xrefs + field inspection + sibling-vtable correlation,2,"Tiny float getter shared across the broader `0x23a` runtime-object family. The helper loads the float at `[this+0x1e2]`, divides it by scale constant `0x005c8700`, and returns the normalized result. It is used pervasively beside `0x00455810` from city-side, placed-structure, route-link, and world-grid callers, and now also appears under both the city-entry table `0x005c9750` and the sibling `Infrastructure` table `0x005cfd00`, so the safest current read is one normalized primary coordinate getter rather than a fully named X/Y accessor.","objdump + caller xrefs + field inspection + sibling-vtable correlation"
0x00455810,13,runtime_object_query_normalized_secondary_coord,map,thiscall,inferred,objdump + caller xrefs + field inspection + sibling-vtable correlation,2,"Tiny float getter paired with `0x00455800` across the broader `0x23a` runtime-object family. The helper loads the float at `[this+0x1ea]`, divides it by scale constant `0x005c8700`, and returns the normalized result. It is used pervasively beside `0x00455800` and appears under both the city-entry table `0x005c9750` and the sibling `Infrastructure` table `0x005cfd00`, so the safest current read is one normalized secondary coordinate getter rather than a fully named X/Y accessor.","objdump + caller xrefs + field inspection + sibling-vtable correlation"
0x00455930,148,runtime_object_serialize_two_triplet_scalar_bands,map,thiscall,inferred,objdump + local disassembly + serializer symmetry + sibling-vtable correlation,2,"Shared serializer over the broader `0x23a` runtime-object family. The helper first queries two triplet-like scalar bands through `0x0052e720` and `0x0052e880`, then writes the six resulting dwords to the caller-supplied bundle or stream through `0x00531030`. The grounded load-side stream counterpart is `0x00455870`, which reads those same six four-byte lanes back through `0x00531150` and republishes the resulting triplets. The same serializer slot appears in both the city-entry table `0x005c9750` and the sibling `Infrastructure` table `0x005cfd00`, so the safest current read is one shared serializer for two triplet scalar bands rather than a city-only stream helper.","objdump + local disassembly + serializer symmetry + sibling-vtable correlation"
0x004559d0,102,runtime_object_serialize_tagged_string_triplet_and_dispatch_slot_0x4c,map,thiscall,inferred,objdump + local disassembly + serializer symmetry + sibling-vtable correlation,2,"Shared tagged string-triplet serializer beneath the broader `0x23a` runtime-object family. The helper writes bracket tags `0x55f1/0x55f2/0x55f3` through `0x00531340`, emits the three string lanes `[this+0x206/+0x20a/+0x20e]` through `0x00531410`, dispatches vtable slot `+0x4c`, then re-enters `0x0052ec50` before writing the closing tag. Current grounded callers include the common placed-structure serializer path `0x0045b560` and the sibling-table wrapper `0x0041f650`, so this is the safest current read for the tagged string-triplet save-side helper rather than a load-side mirror.","objdump + local disassembly + serializer symmetry + sibling-vtable correlation + tagged-string correlation"
0x00455a40,3,record_collection_dispatch_entry_virtual_slot_0x44,map,thiscall,inferred,objdump + caller xrefs + local disassembly,1,"Tiny collection-side dispatcher that jumps directly through the current entry vtable slot `+0x44`. Current grounded caller is the linked-list sweep at `0x0048a766`, where it is used while iterating sibling records under `0x00556ef0/0x00556f00`. The safest current read is a raw `slot+0x44` dispatch helper rather than a more semantic serializer name.","objdump + caller xrefs + local disassembly + linked-list sweep correlation"
0x00455a50,28,record_collection_dispatch_entry_virtual_slot_0x40_and_clear_global_iteration_roots,map,thiscall,inferred,objdump + caller xrefs + local disassembly,1,"Small collection-side wrapper that pushes one caller argument into current entry vtable slot `+0x40`, then clears the three global roots at `0x006acd38`, `0x006acd3c`, and `0x006acd40`. Current grounded caller is the object-construction path at `0x0048dd77`, so the safest current read is a raw `slot+0x40` dispatch plus global-iteration-root reset helper rather than a more semantic load or attach name.","objdump + caller xrefs + local disassembly + global-root reset correlation"
0x00455a70,135,runtime_object_publish_current_position_triplet_with_height_bias,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Small runtime-object helper that queries the current position pair through `0x0052e720`, converts that pair through `0x006d4024 -> 0x0051f090 -> 0x00534490`, adds one caller-supplied integer height bias, optionally rounds the result through `0x005a10d0` when `shell_has_auxiliary_preview_owner` `0x00434050` is active, and publishes the resulting triplet through `0x00530720`. Current grounded callers are the bounded-region sweeps at `0x00421fef` and `0x00461808`, which makes this the safest current read for a generic current-position triplet publisher rather than a city-entry-only helper.","objdump + caller xrefs + local disassembly + position-triplet correlation"
0x00455820,23,runtime_object_store_byte43_triplet_from_three_bytes_and_recurse_children,map,thiscall,inferred,objdump + local disassembly + wrapper inspection,2,"Tiny wrapper over `0x0052e680`. The helper forwards three caller-supplied byte lanes plus literal recursion flag `1`, causing the downstream packed-byte setter to write byte-triplet lane `[this+0x43]` and recurse across child list `[this+0x75]` when present. The safest current read is a convenience wrapper that seeds the shared packed-byte-triplet family from three explicit byte arguments.","objdump + local disassembly + wrapper inspection + packed-byte-family correlation"
0x00455840,23,runtime_object_store_byte43_triplet_from_packed_u24_and_recurse_children,map,thiscall,inferred,objdump + local disassembly + wrapper inspection,2,"Tiny wrapper over `0x0052e680`. The helper unpacks one caller-supplied dword into three byte lanes, forces recursion flag `1`, and forwards the result into the shared packed-byte setter for lane `[this+0x43]`. The safest current read is a convenience wrapper that seeds the shared packed-byte-triplet family from one packed `u24`-style value rather than three explicit byte arguments.","objdump + local disassembly + wrapper inspection + packed-byte-family correlation"
0x00455860,5,runtime_object_thunk_to_shared_formatter_0x530820,map,thiscall,inferred,objdump + local disassembly + caller correlation,1,"Tiny tail-jump thunk that forwards directly into `0x00530820`. Current grounded callers include the placed-structure UI formatter `0x0040e9d0` and the city-site connection-status formatter `0x004207d0`, so the safest current read is a shared fallback formatter thunk rather than a standalone owner.","objdump + local disassembly + caller correlation"
0x00455870,83,runtime_object_load_two_triplet_scalar_bands_from_stream_and_publish_them,map,thiscall,inferred,objdump + local disassembly + stream-load symmetry,2,"Shared load-side helper over the broader `0x23a` runtime-object family. The function reads six four-byte lanes from the caller-supplied stream through `0x00531150`, then publishes the first three as one triplet through `0x00530720` and the second three through `0x0052e8b0`. The accumulated return value is the summed byte count from those six `0x531150` reads. This is the strongest current load-side counterpart to `runtime_object_serialize_two_triplet_scalar_bands` `0x00455930` rather than an unrelated stream helper.","objdump + local disassembly + stream-load symmetry + triplet-publish correlation"
0x00455b20,72,runtime_object_initialize_base_0x23a_record_fields,map,thiscall,inferred,objdump + caller xrefs + local disassembly + field-layout correlation,2,"Shared base initializer for one `0x23a`-sized runtime object family. The helper installs base vtable `0x005cb1c0`, clears the scalar bands `[this+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroes the seven-dword block `[this+0x212..+0x22a]`, and re-enters `0x0052ecd0` before returning `this`. Current grounded callers include the city-entry temporary constructor `0x00474110`, multiple specialization loaders around `0x0045b683/0x0045c893`, and the object-construction path at `0x0048dd65`, so the safest current read is a shared base-field initializer rather than a city-only constructor.","objdump + caller xrefs + local disassembly + field-layout correlation + object-size correlation"
0x00455b00,1,runtime_object_noop_stub_vtable_5cfd00_slot0,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Literal no-op stub in the sibling `Infrastructure`-side table `0x005cfd00`. The function returns immediately with no field access or side effect. Current evidence does not justify a stronger semantic name.","objdump + vtable scan + local disassembly"
0x00455b10,1,runtime_object_noop_stub_vtable_5cfd00_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Second literal no-op stub in the sibling `Infrastructure`-side table `0x005cfd00`. The function returns immediately with no field access or side effect. Current evidence does not justify a stronger semantic name.","objdump + vtable scan + local disassembly"
0x00455b70,266,runtime_object_initialize_scalar_bands_from_optional_string_triplet_and_mode_defaults,map,thiscall,inferred,objdump + caller xrefs + local disassembly + field-layout correlation,2,"Shared initializer over the same `0x23a`-sized runtime object family. The helper clears the scalar bands `[this+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroes the seven-dword block `[this+0x212..+0x22a]`, re-enters `0x0052ecd0`, optionally copies up to three caller-supplied strings into `[this+0x206]`, `[this+0x20a]`, and `[this+0x20e]` through `0x0051d820`, synthesizes one default local token buffer when the middle string is absent through `0x00518de0`, chooses one effective mode string from the third or first input, derives one owner handle or transform token through `0x0051f090` unless the caller suppresses that path, and then re-enters `0x0052edf0` plus `0x0052e670` to seed the remaining runtime scalar band. Current grounded callers span the city-entry constructor `0x004741e3`, several specialization-side rebuilds, and later object constructors at `0x0048a299`, `0x0048a31d`, and `0x00490a79`, so the safest current read is a shared scalar-band initializer from optional string triplet plus mode defaults rather than a city-only helper.","objdump + caller xrefs + local disassembly + field-layout correlation + optional-string correlation + mode-default correlation"
0x00455fc0,250,runtime_object_load_tagged_string_triplet_and_reseed_scalar_bands,map,thiscall,inferred,objdump + local disassembly + serializer symmetry + sibling-vtable correlation,2,"Shared tagged-payload loader over the broader `0x23a` runtime-object family. The helper clears the scalar bands `[this+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroes `[this+0x212..+0x22a]`, re-enters `0x0052ecd0`, opens the tagged bracket `0x55f1..0x55f3`, reads three temporary strings through `0x00531380`, reseeds the runtime scalar band through `runtime_object_initialize_scalar_bands_from_optional_string_triplet_and_mode_defaults` `0x00455b70` with default float lanes `1.0/1.0` and flag `0`, then dispatches vtable slot `+0x48` and re-enters `0x0052ebd0`. Current grounded callers include the city-entry refresh helper `0x00474260` and the placed-structure specialization loader `0x0045c150`, so the safest current read is a shared tagged string-triplet loader plus scalar-band reseed rather than a city-only payload helper.","objdump + local disassembly + serializer symmetry + sibling-vtable correlation + scalar-band reseed correlation"
0x004560c0,53,runtime_object_query_nested_lookup_float_via_fields_0x14_0x3a_0x21,map,thiscall,inferred,objdump + local disassembly + field-chain correlation,1,"Small shared float query over the broader `0x23a` runtime-object family. When lookup root `[this+0x14]` is nonnull, the helper derives one nested table offset from `[this+0x3a]` and `[this+0x21]`, follows that chain, and returns the float at the resolved record's `+0x18`; otherwise it returns `0.0`. Current evidence grounds the lookup chain but not the higher semantic meaning of those fields, so the note stays deliberately structural.","objdump + local disassembly + field-chain correlation"
0x00418a60,372,placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small local-runtime record builder above the projected-rectangle and connected-component helpers. The function selects one template slot from the local runtime scratch family rooted at `0x0062b2f8` using index `0x0062ba74`, resolves one caller-supplied subject coordinate pair through `0x0052e720`, clones the chosen template block into one queued runtime record from the caller-owned list, refreshes its local side fields through `0x00415820`, and then re-enters `world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples` `0x004185a0` plus `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh` `0x00416170` over the cloned record's rectangle at `[record+0x4a0]`. It also refreshes several subject-link fields including `[record+0x742]`, `[record+0x74a]`, and the optional derived value at `[record+0x736]` through `placed_structure_try_select_projected_rect_profile_slot` `0x00415570`, then increments `0x0062ba74` and returns the cloned record. Current grounded caller is `0x0040e450`, which stores the result into `[site+0x24e]` and ties it back to the current placed-structure through `[record+0x73a]`, so this now looks like the current-subject local-runtime clone or refresh helper rather than another generic grid scan.","objdump + caller inspection + local disassembly + local-runtime-template correlation + projected-rect-profile correlation"
0x00418be0,346,placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader local-runtime record builder used during placed-structure construction and rebuild. The helper first resolves one live candidate id from the caller-supplied stem string through `indexed_collection_resolve_live_entry_id_by_stem_string` `0x00416e20`, then builds one projected runtime scratch payload through `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0`. It next re-enters `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, optionally refreshes one neighboring local scratch result through `placed_structure_render_local_runtime_overlay_payload_from_projected_bounds` `0x00418040`, and then copies the finished scratch block rooted at `0x0062b308` into one queued runtime record from the caller-owned list. After seeding the cloned record's link fields at `[record+0x742]`, `[record+0x74a]`, and `[record+0x736]`, it finally re-enters `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh` `0x00416170` when the record's rectangle at `[record+0x4a0]` is valid. Current grounded callers are `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`, `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0`, and the neighboring local-runtime refresh caller at `0x0040dc40`, so this is now the strongest current owner for building one placed-structure local runtime record from candidate stem plus projected scratch rather than an unnamed neighboring helper.","objdump + caller inspection + local disassembly + local-runtime-record correlation + overlay-payload correlation"
0x004197e0,5232,placed_structure_validate_projected_candidate_placement,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavy placement validator beneath the city-connection chooser and several direct mutation paths. The helper resolves one anchor placed-structure id from the current collection at `0x0062b2fc`, optionally validates the caller-supplied company through `0x0062be10`, scenario-state and shell-mode gates around `0x004338c0` and `[0x006cec7c+0x82]`, the current world tile through `0x00414bd0` and `0x00534e10`, and territory access through `0x00424010`, and then walks a large footprint-validation pass over the linked candidate record from `0x0062b268`. That deeper pass uses the candidate footprint bytes `[candidate+0xb8]` and `[candidate+0xb9]`, multiple temporary occupancy banks on the stack, route or road-side probes through `0x00448af0`, `0x004499c0`, and `0x00413df0`, and subtype-specific follow-on branches keyed by `[candidate+0x32]` plus optional route-entry and company-side arguments. The strongest current subtype-specific branch is `[candidate+0x32] == 1`, where the helper re-enters `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, checks route-entry ownership and company track-laying capacity through `0x004240a0`, tries one explicit track-attachment path through `0x00494cb0`, and then falls back to one steeper world-space sweep through `0x00448bd0`. In that branch the optional failure buffer now has a concrete station-attachment or upgrade-style family: `0x0b55` `2901` not enough room to upgrade the station, `0x0b56` `2902` ground not flat enough for the upgraded station, `0x0b57` `2903` not your track, `0x0b58` `2904` not enough available track laying capacity, `0x0b59` `2905` cannot connect to existing track but too close to lay new track, and `0x0b5a` `2906` ground too steep for this building, with older fallback strings `0x00be/0x00bf` still used on neighboring exits. The helper returns a placement-success boolean and is currently grounded as the shared go-or-no-go gate immediately before direct placement commits, without yet proving that every caller is station-only. Current grounded callers include both direct-placement lanes inside `city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0`, the placed-structure local rebuild branch at `0x0040dedb`, later mutation or editor-side branches at `0x00422afa`, `0x0046ef6b`, `0x0047070f`, `0x00472bcc`, `0x00472cd4`, and two shell-side callers at `0x00507f57` and `0x005083cc`.","objdump + caller xrefs + callsite inspection + company-access correlation + footprint-validation correlation + RT3.lng failure-text correlation"
0x00480210,448,placed_structure_construct_linked_site_record_from_anchor_and_coords,map,thiscall,inferred,objdump + caller inspection + constructor inspection,3,"Lower constructor beneath the linked-site allocator at `0x00481390`. The helper writes the new placed-structure id into `[this+0x00]`, stages one anchor or parent placed-structure id at `[this+0x04]`, clears the route-anchor field at `[this+0x08]`, the display-name buffer at `[this+0x46b]`, and several local list or scratch bands rooted at `[this+0x18]`, `[this+0x112]`, and `[this+0x5bd]`, then seeds local world-space state from the anchor site through `0x00455730`, `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, and the grid helper at `0x0040cec0`. It quantizes the caller-supplied coordinate pair into `[this+0x4a8]` and `[this+0x4ac]`, initializes one grid-keyed owner lane through `0x0042bbb0`, and then chooses an initial route-entry anchor into `[this+0x08]` through `0x00417b40` when one compatible route entry already covers the projected point window. When that early anchor path does not hold, the helper falls back into the neighboring literal-policy-`1` route-entry synthesis family around `0x00493cf0`: current caller correlation says that byte is the direct linked-site endpoint-anchor creation or replacement lane, after which the helper rebinds `[this+0x08]` through `0x0048abc0` and updates the boolean marker at `[this+0x46a]`. Current direct caller is `placed_structure_collection_allocate_and_construct_linked_site_record` `0x00481390`, which makes this the clearest current lower constructor for the linked-site records later published through `[site+0x2a8]`.","objdump + caller inspection + constructor inspection + route-anchor correlation + linked-site correlation + linked-site policy-byte split correlation"
0x0048a1e0,336,runtime_object_attach_infrastructure_child_with_optional_first_child_triplet_clone,map,thiscall,inferred,objdump + caller xrefs + local disassembly + rdata correlation,2,"Shared `Infrastructure` child-attach helper over the broader `0x23a` runtime-object family. The function first checks the caller's child list at `[this+0x08]`. When that list holds more than one child, it samples the first child's two triplet scalar bands through `0x0052e880` and `0x0052e720`, destroys the caller-selected prior child through vtable slot `+0x18(0)`, allocates a fresh `0x23a` object, installs vtable `0x005cfd00`, seeds it through `0x00455b70` with literal stem `Infrastructure`, attaches it back to the owner through `0x005395d0`, and republishes the sampled triplets through `0x0052e8b0` and `0x00530720`. When the owner has at most one child, it still allocates and seeds the same `Infrastructure` object but attaches it through `0x0053a5d0` without the cloned-triplet republish. Current grounded callers are the repeated builder branches around `0x004a2cde..0x004a37d9`, so this is the safest current read for attaching one seeded `Infrastructure` child with an optional first-child triplet clone rather than a subtype-specific UI helper.","objdump + caller xrefs + local disassembly + rdata correlation + child-attach correlation"
0x0048abc0,11,linked_site_set_route_entry_anchor_id_field_0x222,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Tiny direct setter over linked-site dword `[this+0x222]`. The helper stores the caller-supplied route-entry id and returns. Current grounded callers are the linked-site constructor and refresh family at `0x00480210`, `0x00480bb0`, and nearby repair branches `0x00480463`, `0x00480968`, `0x00480ac1`, and `0x00480da1`, where this field is treated as the currently chosen route-entry anchor id. The safest current read is therefore a direct linked-site route-entry-anchor setter rather than a generic scalar write.","objdump + caller xrefs + local disassembly + route-anchor correlation"
0x0048abd0,1,linked_site_noop_stub,map,thiscall,inferred,objdump + local disassembly,1,"Literal no-op stub adjacent to the linked-site route-entry-anchor helpers. The function returns immediately with no field access or side effect. Current evidence does not justify a stronger semantic name.","objdump + local disassembly"
0x0048abe0,15,linked_site_query_mode_field_0x226_equals_2,map,thiscall,inferred,objdump + local disassembly,2,"Tiny predicate over linked-site dword `[this+0x226]`. The helper returns `1` only when that field equals literal `2`. Current local callers are still indirect through the linked-site vtable, so the field's player-facing meaning remains open; the safest current read is a direct `mode == 2` predicate over linked-site field `0x226`.","objdump + local disassembly + linked-site-field correlation"
0x0048dd50,359,runtime_object_rebuild_infrastructure_children_and_refresh_primary_child_slot,map,thiscall,inferred,objdump + local disassembly + caller correlation + rdata correlation,2,"Loop-driven `Infrastructure` child rebuild beneath the same `0x005cfd00` family. For each ordinal `0..count-1`, the helper allocates a fresh `Infrastructure` child, dispatches that child through `record_collection_dispatch_entry_virtual_slot_0x40_and_clear_global_iteration_roots` `0x00455a50`, and either tears the child down when the current ordinal is above `5` or attaches it back to the owner through `0x005395d0` after republishing the child's current triplet bands. When owner field `[this+0x248]` still points at the same ordinal index byte, it replaces that cached primary-child slot with the rebuilt child. After the loop it recomputes one grid anchor from current world-space fields, refreshes the current world cell through `0x00448a70`, conditionally re-enters `0x00493660` and `0x0048b660` when byte `[this+0x216]` equals `1`, and finally re-enters `0x0048b660` once more before returning. The current note stays structural because the user-facing subtype semantics remain open, but the `Infrastructure` child-rebuild ownership is strong.","objdump + local disassembly + caller correlation + rdata correlation + child-rebuild correlation"
0x0048e140,24,runtime_object_resolve_route_entry_from_field_0x206,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Tiny direct resolver over owner dword `[this+0x206]`. When the current object is nonnull, the helper resolves that id through route-entry collection `0x006cfca8` and returns the resulting record; otherwise it returns null. Current grounded callers include the repeated `Infrastructure`-side builder family around `0x004a2cec` and the tracker regroup helper `0x004a4ff0`.","objdump + caller xrefs + local disassembly + route-entry-field correlation"
0x0048e160,24,runtime_object_resolve_route_entry_from_field_0x20a,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Tiny direct resolver over owner dword `[this+0x20a]`. When the current object is nonnull, the helper resolves that id through route-entry collection `0x006cfca8` and returns the resulting record; otherwise it returns null. Current grounded callers include the repeated `Infrastructure`-side builder family around `0x004a2d15` and the tracker regroup helper `0x004a4ff0`.","objdump + caller xrefs + local disassembly + route-entry-field correlation"
0x0048e180,24,runtime_object_resolve_route_entry_from_field_0x20e,map,thiscall,inferred,objdump + local disassembly + route-entry-field correlation,2,"Tiny direct resolver over owner dword `[this+0x20e]`. When the current object is nonnull, the helper resolves that id through route-entry collection `0x006cfca8` and returns the resulting record; otherwise it returns null. It is the third direct sibling of `0x0048e140` and `0x0048e160` over the same triplet-backed route-entry field family.","objdump + local disassembly + route-entry-field correlation"
0x00490a3c,123,runtime_object_attach_optional_infrastructure_child_and_seed_three_position_lanes,map,thiscall,inferred,objdump + local disassembly + rdata correlation,2,"Optional `Infrastructure` child-attach branch beneath the same broader runtime-object family. When the caller-supplied payload stem is nonnull, the helper allocates a fresh `0x23a` object, installs vtable `0x005cfd00`, seeds it through `0x00455b70` with literal stem `Infrastructure`, and attaches it back to the current owner through `0x005395d0`. It then publishes two caller-supplied position lanes through `0x00539530`, one third lane through `0x0053a5b0`, and optionally stores the new child into owner field `[this+0x248]` when the trailing pointer argument is nonnull. The safest current read is therefore an optional `Infrastructure` child attach plus three-lane seed helper rather than a broader constructor for the whole owner object.","objdump + local disassembly + rdata correlation + child-attach correlation"
0x00413580,160,placed_structure_collection_refresh_quarter_subset_route_style_state,map,thiscall,inferred,objdump + caller inspection + collection-iteration inspection,3,"Collection-wide placed-structure sweep that refreshes one quartered subset of the route-style lane on each call. The helper computes a start index from the scenario time byte at `0x006cec78+0x11` modulo `4`, then walks every fourth live placed-structure record in the collection, requiring each record to pass the linked-instance class gate `0x0040c990 == 1` before re-entering `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0` with stack flag `0`. After each qualifying per-site rebuild it seeds the two trailing dword fields at `[site+0x3d9]` and `[site+0x3dd]` from `0x518d70`. Current grounded caller is the recurring simulation-maintenance branch at `0x0040a91f`, which makes this the strongest current owner for the periodic quarter-subset refresh of route-style peer-link state rather than a one-shot world-build pass.","objdump + caller inspection + collection-iteration inspection + periodic-cadence correlation"
0x00414fa0,118,world_grid_count_flagged_cells_and_collect_float_samples,map,cdecl,inferred,objdump + callsite inspection,3,"Counts flagged cells inside the current global rectangular scan window rooted at `0x0062b7a8..0x0062b7b4` and collects one float sample per hit. The helper walks the byte-mask grid rooted through `0x0062c120+0x2135`, requires bit `0x01` on each scanned cell, reads the aligned float field through `0x00448aa0`, stores the samples into the caller buffer, and returns the number of collected entries. Current grounded caller is `0x00415020`, where this sample list is reduced into one mean value before the wider flagged-region pass continues.","objdump + callsite inspection + world-grid scan correlation"
0x00415020,1968,world_grid_refresh_flagged_region_float_extrema_and_mean,map,cdecl,inferred,objdump + caller inspection,3,"Refreshes one global flagged-region float summary family rooted at `0x0062b7b8`, `0x0062b7bc`, `0x0062b7c0`, and `0x0062b7c4`. The helper first resets the current extrema sentinels, seeds one region-dependent threshold from the world-side `0x0062b2fc+0x9c` latch, collects up to `0x80` flagged-cell float samples through `world_grid_count_flagged_cells_and_collect_float_samples` `0x00414fa0`, and reduces them to one average stored at `0x0062b7c4`. It then rescans the same flagged rectangle, updating the min and max extrema from per-cell float values while applying one build-`1.04+` compatibility branch at `0x41518e`: when no current mode override is active and the world-side latch at `0x0062b2fc+0x9c` is clear, builds below `1.04` still allow one older fallback acceptance path that later builds skip. The tail publishes one blended midpoint into `0x0062b7c0` and can reject the whole pass through the neighboring scenario or world-state gates before returning success. Current grounded caller is the higher world-grid worker at `0x0041870d`, so this is now bounded as the flagged-region float-stats refresher rather than one route-entry helper.","objdump + caller inspection + version-gate correlation + world-grid scan correlation"
0x00415f20,403,placed_structure_recursive_collect_connected_component_tile_bounds,map,thiscall,inferred,objdump + caller inspection,3,"Recursive connected-component bounds collector over linked placed-structure records. Starting from one placed-structure node, the helper expands four caller-owned tile-bound out slots from the record-local rectangle fields `[record+0x4a0..0x4ac]`, tags the record with the current component pass id at `[record+0x73e]`, then walks the component membership map rooted at `0x0062ba7c` to find adjacent records whose packed tile key falls inside the current rectangle and whose prior pass id differs. Matching adjacent records recurse through the same helper until the reachable component rectangle is exhausted. On return the helper also seeds one default local rectangle owner through `0x004159e0` when `[record+0x732] == -1`, then refreshes the neighboring runtime side through `0x0040ee10`. Current grounded callers are the wrapper at `0x004160c0` and internal recursive self-calls.","objdump + caller inspection + recursive-component correlation + placed-structure-bound correlation"
0x004160c0,168,placed_structure_collect_connected_component_tile_bounds_with_version_gate,map,cdecl,inferred,objdump + caller inspection,3,"Wrapper above `placed_structure_recursive_collect_connected_component_tile_bounds` `0x00415f20`. The helper initializes four tile-bound accumulators to sentinel values, increments one world-grid reentry depth counter at `0x0062c120+0x2205`, and then chooses between two paths. On builds `1.03` and earlier, or when scenario field `[0x006cec78+0x46c38]` is still clear, it re-enters the recursive component walk through `0x00415f20`; otherwise it skips that older walk entirely. In both cases it decrements the reentry counter and then expands the surviving rectangle by `2` tiles on each side before publishing it through `0x0044d410`. Current grounded caller is the route-entry-backed component wrapper at `0x004161a0`, so this now looks like the version-gated connected-component bounds collector rather than another generic tracker helper.","objdump + caller inspection + version-gate correlation + connected-component correlation"
0x00416170,345,placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Tile-range wrapper above `placed_structure_collect_connected_component_tile_bounds_with_version_gate` `0x004160c0`. The helper seeds the current connected-component pass keys at `0x0062ba7c` and `0x0062ba80`, iterates the caller-supplied tile rectangle, allocates or reuses one small per-tile record from the caller-owned queue, and looks up the packed `(row << 16) | col` key through the component map rooted at `0x0062ba7c` via `0x0053dae0`. When one mapped component record exists and the current placed-structure owner at stack arg `+0x0c` still has `[site+0x732] == -1`, the world-side latch at `[0x0062b2fc+0x9c]` is clear, scenario field `[0x006cec74+0x4fd]` is clear, and the caller-supplied suppress-refresh flag at stack arg `+0x10` is zero, it follows the mapped component chain and re-enters `0x004160c0` for each linked record; otherwise it clears one world-grid byte through `0x00448a70`. The resolved or refreshed record is then stored back through `0x0053d9e0` and `0x0053d960`. Current grounded callers are the neighboring local-runtime passes at `0x00418a60` and `0x00418be0`, so this is now the strongest current owner for mapping one tile rectangle into connected-component records with optional bounds refresh rather than another bare recursive walk.","objdump + caller inspection + local disassembly + connected-component-map correlation"
0x00416e20,156,indexed_collection_resolve_live_entry_id_by_stem_string,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small live-entry resolver over an indexed collection. The helper walks the live slot count through `indexed_collection_slot_count` `0x00517cf0`, fetches each live id through `indexed_collection_get_nth_live_entry_id` `0x00518380`, resolves the backing record through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and compares the caller-supplied string against the record stem at `[record+0x04]` through `0x005a57cf`. On success it returns the matching live id. On failure it emits localized id `189` through the shell string helpers and returns `-1`. Current grounded callers are the neighboring placed-structure local-runtime builders at `0x00418be0` and `0x0040e450`, plus one shell-side branch at `0x00507e80`, so this is now the strongest current match for a stem-to-live-id resolver rather than an unowned search loop.","objdump + caller inspection + local disassembly + stem-compare correlation"
0x00416ec0,1867,placed_structure_build_projected_runtime_scratch_from_candidate_and_coords,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Heavy projected-runtime scratch builder beneath the neighboring local placed-structure runtime family. The helper resolves one candidate record from the caller-supplied id, derives rotated footprint extents and centered world-space bounds from the caller-supplied coordinate and heading inputs, allocates and clears several temporary per-footprint mask bands on the stack, then walks up to four candidate-side shape or access sublanes rooted at `[candidate+0xcf]`, `[candidate+0xd3]`, `[candidate+0xd7]`, and `[candidate+0xdb]`. Within that deeper loop it projects rotated footprint cells through the basis pair at `0x006d4024`, rejects out-of-bounds or duplicate cells, checks multiple world-grid acceptance gates through `0x00448af0`, `0x00534e10`, `0x004499c0`, and `0x00413df0`, and marks the surviving cells into both temporary stack masks and the live world-grid byte lane at `[0x0062c120+0x2131]`. The tail publishes the finished scratch payload through `0x00416620`. Current grounded caller is `0x00418be0`, which then copies that scratch block into one queued local runtime record, so this is now the safest current name for the projected-runtime scratch builder rather than a generic placement validator.","objdump + caller inspection + local disassembly + projected-footprint correlation"
0x00418040,1168,placed_structure_render_local_runtime_overlay_payload_from_projected_bounds,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Heavy local-runtime overlay-payload builder beneath the broader local-runtime record family. The helper derives one projected bounds rectangle through `0x004142e0` and `0x00417f20`, rejects very small payloads, allocates one temporary dword buffer, folds that buffer through `0x00415370`, and then walks the projected rectangle producing one packed dword payload per cell. Current bounded gates include a duplicate-entry or occupancy fast path keyed by `[var_10h]`, world-grid rejection through `0x004499c0`, and several distance- and ratio-shaped thresholds built from the projected rectangle geometry. On accepted cells it writes one four-byte packed value into the caller output stream. Current grounded caller is `placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch` `0x00418be0`, where the result is stored into `[0x0062b7c8]`, so this is now the safest current read for the local-runtime overlay payload renderer rather than a generic geometric sweep.","objdump + caller inspection + local disassembly + overlay-payload correlation"
0x00414470,10,placed_structure_cache_projected_rect_profile_slot_id,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Tiny setter for the projected-rectangle profile-slot cache at `0x005ee030`. The helper just stores the caller-supplied dword into that global cache. Current grounded caller is `0x0040e450`, where the cached value is set immediately before the current-subject local-runtime clone path at `0x00418a60`.","objdump + caller inspection + local disassembly + global-cache correlation"
0x00416620,521,placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Publishes one projected-runtime rectangle and its companion globals beneath the local-runtime scratch builder. The helper copies the current scratch owner id from `0x0062b304` into `0x0062b308`, stores the caller-supplied pair into `0x0062b30c/0x0062b310`, grows the active rectangle bounds at `0x0062b7ac` and `0x0062b7b4` when needed, clears one current index slot in `0x0062b318`, and then validates the rectangle against the route-entry store `0x006cfca8` through `route_entry_collection_query_rect_window_passes_entry_type_gate` `0x00494240`. On failure it raises localized id `185`; on one special-candidate branch keyed by `[record+0x123]` it re-enters `placed_structure_try_select_projected_rect_profile_slot` `0x00415570`, either expands the rectangle by three cells on each side and refreshes the per-cell side tables through `world_grid_refresh_projected_rect_surface_and_region_byte_tables` `0x00414e10` or fails with localized id `186`; and on the ordinary branch it can scan the temporary cell-value bank at `0x0062b300` across the rectangle and fail with localized id `187` before again tailing into `0x00414e10`. Current grounded callers are `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0` and the placement validator `0x004197e0`, so this now looks like the projected-runtime rectangle publisher plus side-window validator rather than an anonymous scratch tail.","objdump + caller inspection + local disassembly + projected-rectangle-global correlation"
0x00415570,317,placed_structure_try_select_projected_rect_profile_slot,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Small projected-rectangle profile selector beneath `0x00416620`. The helper ensures the temporary dword cell-value bank at `0x0062b300` exists, resets the shared slot id at `0x0062ba3a`, derives one companion value through `0x00413eb0` into `0x0062ba3e`, and then probes the current rectangle at `0x0062b7a8..0x0062b7b4` through repeated `0x004153f0` checks. One fast path reuses the cached selector at `0x005ee030`; another starts from localized id `11` through `0x00518be0`; and both update `0x0062ba3a` on success. Current grounded caller is the special-candidate branch inside `0x00416620`, where the returned success decides whether the rectangle can be expanded and the companion byte tables refreshed. This is therefore best-read as a projected-rectangle profile-slot selector rather than a broad route or placement policy helper.","objdump + caller inspection + local disassembly + rectangle-probe correlation"
0x00414e10,200,world_grid_refresh_projected_rect_surface_and_region_byte_tables,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Refreshes two compact per-cell byte tables for the current projected rectangle rooted at `0x0062b7a8..0x0062b7b4`. The helper scans every cell in that rectangle, counts processed entries in `0x0062ba36`, writes one nibble-packed byte into the table at `0x0062b96c` from the paired world-grid queries `0x00534040` and `0x005340a0`, writes one companion byte into `0x0062b9d1` through `0x00533f80`, and zeroes both tables for out-of-bounds cells. Current grounded callers are the two success paths inside `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows` `0x00416620`, so this is now the safest current read for the projected-rectangle per-cell surface or region byte refresh rather than a generic grid scan.","objdump + caller inspection + local disassembly + projected-rectangle-byte-table correlation"
0x00494240,195,route_entry_collection_query_rect_window_passes_entry_type_gate,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Rectangle-window gate over the route-entry collection `0x006cfca8`. The helper first derives one route-entry search window from the caller-supplied projected rectangle through `0x00449df0`, then scans every route-entry id in that window through `0x00492130` and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. It rejects when a covered entry owns byte `[entry+0x226]` outside the tolerated family, except for the caller-enabled permissive branch that still admits kinds `0x0c` and `0x0d`. Current grounded caller is `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows` `0x00416620`, where a failing result produces localized id `185`, so this is now the strongest current read for the route-entry-type gate over the projected rectangle rather than a generic collection scan.","objdump + caller inspection + local disassembly + route-entry-window correlation"
0x00411ee0,451,structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables,map,thiscall,inferred,objdump + callsite inspection,3,"Rebuilds the per-candidate cargo summary tables after one runtime descriptor array has been materialized. The helper clears the two cargo-id pointer tables at `[this+0x79c]` and `[this+0x7a0]`, their counts at `[this+0x7a4]` and `[this+0x7a8]`, and one float-like per-cargo accumulator band rooted at `[this+0x0a1]`, then walks every live `0xbc` descriptor in `[this+0x37]` against the current scenario year at `[0x006cec78+0x0d]`. For each active subordinate cargo row in the descriptor-owned `0x1c`-byte entry band it resolves one cargo id through the global cargo collection at `0x0062ba8c`, updates the per-cargo accumulator, and tracks one or two levels of cargo membership before compacting those marks into the two emitted cargo-id tables. The stronger production-mode result is now bounded here rather than only in the editor importer: when the descriptor-side mode flag at `[desc+0x00]` is zero the subordinate row amount is multiplied by the shared recipe-book production cap at `[this+0x2a]` and divided by the descriptor amount at `[desc+0x04]`; when that mode flag is nonzero the helper bypasses that scaling path. That matches the editor-side split where production mode keeps the entered annual amount on the supply half while the demand half is normalized to `1.0`, so the demand-side production branch now looks like a normalized input selector or gate while the supply side is the branch that receives cap-scaled runtime rates. Current grounded callers are the collection-wide rebuild sweeps at `0x00412bd0` and `0x00412d70`.","objdump + callsite inspection + scenario-state correlation + cargo-collection correlation"
0x00412560,144,structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Descriptor-level activity gate beneath the port or warehouse cargo runtime family. The helper first special-cases descriptor mode `0` by resolving the primary cargo id at `[desc+0x1c]` through the global cargo collection at `0x0062ba8c`; it then requires the current scenario year at `[0x006cec78+0x0d]` to lie inside the descriptor year window `[desc+0x20]..[desc+0x22]`, and finally checks one caller-selected mode byte at `[desc+0x24]` or `[desc+0x25]` for the active mode bank. When special-condition slot `31` `Use Wartime Cargos` at `[0x006cec78+0x4afb]` is clear and the descriptor owns subordinate cargo rows, it also requires every subordinate cargo id in the `0x1c`-byte row band at `[desc+0x44]` to resolve through the same cargo collection. Current grounded callers are `structure_candidate_count_active_scaled_supply_descriptors` at `0x004125f0`, `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, and neighboring world-side query branches around `0x0040fb8d`, `0x00410721`, and `0x00410b71`.","objdump + caller xrefs + callsite inspection + cargo-collection correlation + special-condition correlation"
0x004125f0,87,structure_candidate_count_active_scaled_supply_descriptors,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Counts active runtime descriptors that participate in the scaled supply-side production lane for one caller-selected mode bank. The helper walks the current descriptor array at `[this+0x37]`, selects only descriptors whose mode dword at `[desc+0x00]` is zero and whose subordinate row count at `[desc+0x2c]` is positive, and then reuses `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560` before incrementing the returned count. Current grounded caller is `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, where the resulting count is used to divide the shared production-cap float across the active scaled-supply descriptors.","objdump + caller xrefs + callsite inspection"
0x00412650,543,structure_candidate_query_cargo_runtime_summary_channels,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Lazy per-candidate cargo summary query over the runtime descriptor array rebuilt from the editor's port or warehouse recipe books. On a year change it clears four `0x6a`-dword summary banks rooted at `[this+0x0e8]`, `[this+0x290]`, `[this+0x438]`, and `[this+0x5e0]`, then walks every live `0xbc` descriptor across two mode banks through `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560`. Demand-side descriptors with nonzero mode dword accumulate subordinate-row weights into the bank rooted at `[this+0x10e]`; direct supply descriptors with no subordinate rows accumulate annual amounts into `[this+0x03a]`; and scaled supply descriptors with subordinate rows first divide the shared production-cap float at `[this+0x2a]` by the active-descriptor count from `structure_candidate_count_active_scaled_supply_descriptors` at `0x004125f0`, then publish the per-descriptor share into `[this+0x0a4]` and the subrow-scaled outputs into `[this+0x178]`. The index lanes are tighter now too: the no-subrow paths use the resolved cargo id at `[desc+0x1c]` directly, and the subordinate-row loop indexes each output lane directly from `[desc+0x44+row*0x1c]`, with no post-resolution failure guard in this consumer. So the strongest current read is that unresolved imported marker rows would still fall into the first summary-bank bucket here, while the semantic meaning of cargo id `0` itself remains ungrounded. The helper finally returns one caller-selected cargo entry from all four banks through out-pointers, so current grounded meaning is one direct-supply channel, one cap-normalized supply channel, one demand or input channel, and one scaled production-output subrow channel rather than a single aggregate total. Current grounded callers are the lightweight wrappers at `0x00412960` and `0x004129a0`, the cargo-membership helper at `0x004129d0`, and the broader world-side accumulator at `0x0041e7be`.","objdump + caller xrefs + callsite inspection + scenario-state correlation"
0x00412960,49,structure_candidate_query_direct_and_normalized_supply_channels,map,thiscall,inferred,objdump + callsite inspection,3,"Tiny wrapper over `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650`. It forwards the caller's mode-bank and cargo id unchanged, then returns the sum of the wrapper's two supply-side out lanes rather than exposing all four summary channels directly. Current grounded steady-state caller is `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690`, where a positive result is treated as the direct-supply-side cargo presence test. The wrapper does not add any post-query special case for unresolved cargo bucket `0`; it just sums the returned supply-side floats.","objdump + callsite inspection + wrapper-correlation"
0x004129a0,45,structure_candidate_query_scaled_production_output_channel,map,thiscall,inferred,objdump + callsite inspection,3,"Tiny wrapper over `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650`. It forwards the caller's mode-bank and cargo id unchanged, then returns the single scaled production-output subrow channel without combining it with the neighboring supply lanes. Current grounded steady-state caller is `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690`, where a positive result is treated as the scaled-supply or production-side cargo presence test. Like the sibling wrapper at `0x00412960`, it does not special-case unresolved cargo bucket `0` after the underlying query returns.","objdump + callsite inspection + wrapper-correlation"
0x004129d0,179,structure_candidate_supports_or_references_cargo_id,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Returns whether the current runtime structure candidate materially references one requested cargo id. The helper first scans the compact secondary cargo-membership table rooted at `[this+0x7a0]` with count `[this+0x7a8]`; when no direct match is found it queries `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650` for mode bank `0` and treats the candidate as relevant when the returned demand-side plus scaled-output channels are positive. One final fallback checks the cached per-cargo accumulator bands rooted at `[this+0x0a1]` and `[this+0x0ad]` through the candidate-to-collection remap at `0x0062ba8c+0x9a`, which keeps the direct runtime cargo-membership arrays tied into the same decision. The current caller picture is tighter too: the placed-structure sweep around `0x00452e60` only enters this helper when the requested cargo id is nonzero. When that sweep receives requested id `0`, it explicitly routes around the cargo-reference branch into a separate linked-site or station-or-transit gate over the current placed structure's subtype latch, linked site id `[site+0x2a8]`, and the narrower linked-site predicate at `0x0047fd50`. So this helper itself does not currently look like the intentional owner for a null-cargo query.","objdump + caller xrefs + callsite inspection + cargo-summary correlation + caller-branch correlation + linked-site-bypass correlation"
0x00412d70,563,structure_candidate_collection_rebuild_runtime_records_from_scenario_state,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Collection-wide runtime-state rebuild over the structure or candidate manager at `0x0062ba8c`. The helper iterates the collection twice against the paired availability bytes at `[candidate+0xba]` and `[candidate+0xbb]`, chooses one existing record to clone when the scenario-side owner id at `[candidate+0x794]` matches, otherwise clears the target record, and then repopulates the candidate runtime fields from the active scenario state rooted at `0x006cec78`. For each rebuilt candidate it copies the recipe-line count from `[state+0x1024]`, the shared production-cap float from `[state+0x13d4]`, and the packed `0xbc` descriptor array from `[state+0x1028]`, then refreshes the dependent cargo summary tables through `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` at `0x00411ee0` and the neighboring mode-flag pass at `0x00411ce0`. One bounded text side branch also republishes the candidate label from the scenario-side recipe-book name around `[state+0x0fe8]` when that string ends in `:`. Current grounded callers are the tail of `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` at `0x00435630` and the larger collection load path at `0x00412fb0`, so this now looks like the candidate-side bridge that projects editor recipe-book state into live runtime records rather than another generic collection copy loop.","objdump + caller xrefs + callsite inspection + scenario-state correlation"
0x00412ca0,192,world_region_pick_commercial_profile_label_by_region_rank,map,thiscall,inferred,objdump + strings + callsite inspection,4,"Selects one category-3 candidate label from the global structure pool `0x0062b268` for the current region bucket. The helper converts the caller-supplied region rank through the region-count manager at `0x0062bae0`, uses that derived bucket to read per-candidate weights from `[candidate+region_index*4+0x8d]`, repeatedly subtracts those weights across up to five passes while only considering pool entries whose category byte at `[candidate+0x32]` is `3`, and copies the chosen candidate name into the caller buffer. When no weighted category-3 candidate survives the sweep it falls back to the static token `Commercial` at `0x005c92e8`. A later region-stats panel lines the same third slot up with localized id `1040` `City Support`, so current evidence treats this as the low-level label picker for a broader city-support family whose fallback token happens to be `Commercial`. The current grounded caller is `world_region_balance_structure_demand_and_place_candidates` at `0x004235c0`.","objdump + rdata strings + callsite inspection + region stats disassembly + RT3.lng strings"
0x004133b0,132,placed_structure_collection_refresh_local_runtime_records_and_position_scalars,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Collection-wide wrapper above the placed-structure local-runtime clone and side-refresh helpers. The function first drains the queued placed-structure id list rooted at `0x0062ba64/0x0062ba6c/0x0062ba70` by reading the queue count through `placed_structure_local_runtime_site_id_queue_count` `0x00414480` and popping ids through `placed_structure_local_runtime_site_id_queue_pop_next` `0x00413f50`; for each popped id it resolves the owning placed structure through collection `0x0062b26c` and re-enters `placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem` `0x0040e450`. It then pumps the scenario-side service at `0x004834e0`, walks every live placed structure in `0x0062b26c`, and re-enters `placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon` `0x0040ee10` on each one. The current grounded caller is no longer just an anonymous raw callsite: it sits inside the `Setting up Players and Companies...` `319` lane of `world_run_post_load_generation_pipeline` immediately after the auxiliary route-entry tracker collection refresh on `0x006cfcb4` through `0x004a41b0`, and immediately before the flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0` plus the later route-entry post-pass `0x00491c20` on `0x006cfca8`. That makes this the clearest current owner for refreshing cloned local-runtime records plus the per-site position-scalar side pass rather than an anonymous collection sweep.","objdump + caller inspection + local disassembly + local-runtime-queue correlation + collection-refresh correlation + post-load-pipeline correlation"
0x00413f50,47,placed_structure_local_runtime_site_id_queue_pop_next,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Pop-next helper over the temporary placed-structure id queue rooted at `0x0062ba64/0x0062ba6c/0x0062ba70`. When queue storage exists and the current count at `0x0062ba64` is positive, the helper returns the current head dword from `0x0062ba70`, advances that cursor by four bytes, and decrements the count; otherwise it returns `-1`. Current grounded caller is `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, where the popped ids are resolved through collection `0x0062b26c` before cloned local-runtime records are rebuilt.","objdump + caller inspection + local disassembly + local-runtime-queue correlation"
0x00414480,6,placed_structure_local_runtime_site_id_queue_count,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Tiny count getter over the temporary placed-structure id queue used by the local-runtime refresh family. The helper simply returns the current queue count at `0x0062ba64`. Current grounded caller is `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, where the returned count bounds the queue-drain loop before the later all-sites side refresh.","objdump + caller inspection + local disassembly + local-runtime-queue correlation"
0x0041e8e0,63,structure_candidate_collection_write_filter_and_year_visible_summary_blocks,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small packed-state write wrapper over the live structure-candidate collection at `0x0062ba8c`. The helper opens two tagged packed blocks through `0x00531360` with ids `0x6979` and `0x697a`, forwards the caller's packed-state sink plus side flag into `0x00518680`, and returns the combined emitted size. Current grounded caller is the later world-entry or restore-side branch at `0x00444375`, immediately after the candidate-count refresh family has run, so this is the safest current read for the candidate-summary packed-state write sibling rather than a direct count recompute helper.","objdump + local disassembly + caller correlation + packed-state correlation"
0x0041e930,48,structure_candidate_collection_read_filter_and_year_visible_summary_blocks,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small packed-state read wrapper over the same structure-candidate summary family at `0x0062ba8c`. The helper opens the tagged blocks `0x6979` and `0x697a` through `0x00531340`, forwards the caller's packed-state source plus side flag into `0x00517d90`, and returns after both reads complete. Current grounded caller is the neighboring world-entry-side branch at `0x00445226`, which uses this read-side companion after shell service and before later post-load status updates, so this is the safest current read for the candidate-summary packed-state import sibling rather than a direct filter refresh helper.","objdump + local disassembly + caller correlation + packed-state correlation"
0x0041e970,121,structure_candidate_collection_refresh_filter_and_year_visible_counts,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide counter refresh over the live structure-candidate pool at `0x0062ba8c`. The helper clears aggregate counts `[this+0x242]` and `[this+0x31a]`, then walks all `0x35` candidate slots through the collection accessors. For each live slot it stores the cargo-economy or editor-filter flag `[entry+0x56]` into one per-slot band rooted at `[this+0x246]`, increments `[this+0x31a]` when that flag is nonzero, re-enters `structure_candidate_is_enabled_for_current_year` `0x0041e220`, stores that result into the paired per-slot band rooted at `[this+0x16e]`, and increments `[this+0x242]` when the year-visible gate succeeds. Current grounded callers include the periodic boundary-service path at `0x0040a56a`, the post-fast-forward setup tail at `0x00437192`, the cargo-economy filter refresh family at `0x0041eac0/0x0041f584`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and one neighboring locomotive-side bridge at `0x00464aa8`, so this is the safest current read for the shared candidate-collection filter and year-visible count rebuild rather than a one-off world-entry helper.","objdump + local disassembly + caller correlation + candidate-count correlation + year-visible correlation"
0x0041ea50,179,world_setup_building_collection_phase,map,cdecl,inferred,objdump + strings + callsite inspection,3,"Post-load world-generation subphase inside world_run_post_load_generation_pipeline. The helper iterates the building-related collection at `0x0062ba8c`, chooses either the full pass or one modulo-selected bucket from the current world byte at `[0x006cec78+0x0f]`, resolves each entry through `0x00518380` and `0x00518140`, and then dispatches the selected record into the lower setup worker at `0x0041e2b0`. Current grounded callsite is the early collection sweep inside world_run_post_load_generation_pipeline immediately before the localized progress update `Setting up Players and Companies...`, so this looks like the collection-owned building-setup staging phase rather than one of the later player-speed or shell-frame loops.",objdump + caller context + RT3.lng strings
0x0041e220,52,structure_candidate_is_enabled_for_current_year,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Common live-availability gate for one structure-candidate record. The helper first requires the cargo-economy or editor filter flag at `[this+0x56]` to be nonzero, then compares the current scenario year against the candidate threshold at `[this+0x21]`, using either `[0x006cec78+0x05]` or `[+0x0d]` depending on the runtime branch latched at `[0x006cec78+0x46c38]`. Current grounded callers include the collection counter refresh at `0x0041e970`, the placed-structure cargo-bitset sweep at `0x0042c690`, and several later shell or world-side candidate-selection branches, so this now looks like the shared year-and-filter gate beneath the editor's cargo-economy path rather than a setup-only helper.","objdump + caller xrefs + callsite inspection + cargo-economy filter correlation"
0x0041e650,142,structure_candidate_query_route_style_or_local_availability_metric,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + collection-correlation,3,"Returns one candidate-side float metric whose meaning splits on the route-style byte at `[this+0x46]`. When that byte is zero the helper simply returns the cached local float at `[this+0x5a]`. When it is nonzero it resolves one grouped routing-class value from candidate field `[this+0x3e]` through the structure-candidate collection side table at `0x0062ba8c+0x9a`, then walks collection `0x006ada90` through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` to count entries whose class byte at `[entry+0x10]` matches, whose state byte at `[entry+0x12]` carries bit `0x2`, and whose word at `[entry+0x08]` is zero. It returns that matched count divided by the fixed float constant at `0x005c8554`. Current grounded callers include two sortable-value branches inside `shell_load_screen_render_map_cargo_list_panel` at `0x004e9460` and one neighboring shell renderer around `0x004f46d0`, so this now looks like the shared route-style-versus-local availability metric beneath candidate cargo summaries rather than a generic price reader.","objdump + caller xrefs + callsite inspection + collection-correlation + route-style-byte correlation"
0x00467eb0,104,placed_structure_route_link_attach_site_owner,map,thiscall,inferred,objdump + caller xrefs + chain-layout inspection,3,"Attaches one `0x006ada90` route-link record onto the owner chain of one placed structure. The helper first detaches the current record through `0x00467df0`, stages the caller-supplied placed-structure id into route-link field `+0x0a`, links the record into the placed-structure-owned chain at `[site+0x272]` through route-link field `+0x04`, and then re-enters `0x00467c30` to recompute the route-link flag byte at `+0x12` against neighboring site pairs. When that flag byte keeps bit `0x2` set, the helper also projects one class-indexed signed contribution through `0x0040fa50` and accumulates it into the placed structure through `0x0042b310`. Current grounded caller is the route-link allocator path at `0x00468067`, which makes this the clearest current owner bridge from one freshly allocated `0x006ada90` record into the site-linked chain later scanned by `placed_structure_query_candidate_directional_route_overlay_summary` at `0x0047e690` and `structure_candidate_query_route_style_or_local_availability_metric` at `0x0041e650`.","objdump + caller xrefs + chain-layout inspection + route-link-correlation"
0x00467df0,183,placed_structure_route_link_detach_current_owner_chain,map,thiscall,inferred,objdump + caller xrefs + chain-layout inspection,3,"Detaches one `0x006ada90` route-link record from whichever owner chain currently anchors it. The helper first checks route-link field `+0x08`; when nonzero it treats that field as one route-node-like owner id in collection `0x006cfcbc` and unlinks the record through owner field `+0x04` plus route-node link slot `+0x29`. Otherwise it falls back to the placed-structure owner path, using route-link field `+0x0a` as one site id in collection `0x0062b26c`, optionally applying the same class-indexed signed contribution rollback through `0x0040fa50` and `0x0042b310` when flag byte `+0x12` keeps bit `0x2` set, and then unlinking through `[site+0x272]`. Current grounded callers are the site-owner attach path at `0x00467eb0`, the route-node attach path at `0x00467f20`, and the route-link destructor path at `0x004680b0`, so this now looks like the shared detach helper beneath all owner-chain rewrites for the route-link family.","objdump + caller xrefs + chain-layout inspection + owner-slot correlation"
0x00467c30,443,placed_structure_route_link_recompute_endpoint_pair_state,map,thiscall,inferred,objdump + caller xrefs + endpoint-pair inspection,3,"Recomputes the route-link state byte at `+0x12` from the active site-endpoint pair and updates the linked site contribution when that state flips. The helper only runs on the site-owned branch where route-link field `+0x08` is zero; it resolves the two endpoint site ids from fields `+0x0a` and `+0x0e` through collection `0x0062b26c`, clears the prior bit-`0x2` state, then compares the two endpoint-side route-entry chains through `0x00455f60`, `0x0047de00`, `0x0040c990`, and `0x0047f2d0` until it finds a compatible shared peer. On the first match it restores bit `0x2` in the state byte. If the boolean substate derived from bit `0x1` changes across the recomputation, the helper applies one signed class-indexed contribution through candidate class byte `+0x10`, the class-weight table at `0x0062ba8c+0x8e`, and `0x0042b310` against the first endpoint owner. Current grounded callers are the site-owner attach path `0x00467eb0`, the route-link rebuild sweep around `0x004682e6`, and the route-link allocator path at `0x0046809b`, so this now looks like the endpoint-pair state reconciler beneath the route-link family rather than a generic chain walk.","objdump + caller xrefs + endpoint-pair inspection + shared-peer correlation"
0x00467f20,45,placed_structure_route_link_attach_route_node_owner,map,thiscall,inferred,objdump + caller xrefs + chain-layout inspection,3,"Attaches one `0x006ada90` route-link record onto the owner chain of one route-node-like record in collection `0x006cfcbc`. The helper first detaches the current record through `0x00467df0`, then stages the caller-supplied route-node id into route-link field `+0x08` and links the route-link through owner field `+0x04` plus route-node link slot `+0x29`. Current grounded caller is the route-node-side rewrite path at `0x004680e0`, which keeps this as the route-node owner companion to `placed_structure_route_link_attach_site_owner` rather than another site-chain helper.","objdump + caller xrefs + chain-layout inspection + route-node-owner correlation"
0x00467f50,352,placed_structure_route_link_allocate_site_pair_for_candidate_class,map,cdecl,inferred,objdump + caller xrefs + stack-layout inspection + class-counter correlation,3,"Allocates and seeds one new `0x006ada90` route-link record for a caller-supplied placed-structure pair and candidate class. The helper builds one `0x19`-byte local template whose current grounded creation-side writes seed route-link fields `+0x0c` and `+0x0e` from the two input site ids, class byte `+0x10` from the supplied candidate-class argument, and one masked initial state template from the class side table at `0x005f2adc[class]`. It then allocates the live record from the route-link collection, attaches it to the first site through `placed_structure_route_link_attach_site_owner` `0x00467eb0`, increments the grouped class counters at `[class_record+0x5a]` and `[class_record+0x5e]` through the candidate-class table at `0x0062ba8c+0x8e`, and finally re-enters `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30`. Current direct creation-side caller is `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0`, while grounded internal calls land at `0x00468067` and `0x0046809b`; this is therefore the strongest current owner for creation-side site-pair seeding in the route-link family.","objdump + caller xrefs + stack-layout inspection + class-counter correlation + route-link-collection correlation"
0x004680b0,96,placed_structure_route_link_release_and_detach,map,thiscall,inferred,objdump + caller xrefs + class-counter correlation,3,"Releases one live `0x006ada90` route-link record's class-side counters and then detaches it from its current owner chain. The helper resolves the candidate-class record from route-link byte `+0x10` through `0x0062ba8c+0x8e`, subtracts the fixed creation-side increment from `[class_record+0x5a]`, then chooses one of the two trailing accumulator slots `[class_record+0x62]` or `[class_record+0x66]` by testing state byte `+0x12 & 0x1`. After that class-side rollback it tails into `placed_structure_route_link_detach_current_owner_chain` `0x00467df0`. Current grounded caller is the route-link collection sweep around `0x004681ae`, which keeps this as the clearest release-side companion to `placed_structure_route_link_allocate_site_pair_for_candidate_class` rather than another attach helper.","objdump + caller xrefs + class-counter correlation + detach-tail correlation"
0x00468110,39,placed_structure_route_link_collection_construct,map,thiscall,inferred,objdump + world-bringup correlation + collection-layout inspection,3,"Constructs the world-side route-link collection later published at `0x006ada90`. The helper seeds the collection vtable at `0x005ce130`, then initializes one indexed collection through `0x00518570` with grounded parameters `(record_size=0x19, initial_slots=0x64, growth=0x64, id_base=1)`. Current grounded caller is the world bring-up path at `0x004488a3`, where the resulting manager is stored into `0x006ada90` beside the placed-structure and candidate collections. This is the strongest current owner name for the record family later scanned by the route-style overlay and availability helpers.","objdump + world-bringup correlation + collection-layout inspection + manager-publication correlation"
0x00468140,18,placed_structure_route_link_collection_destroy,map,thiscall,inferred,objdump + world-shutdown correlation + collection-layout inspection,3,"Destroys the world-side route-link collection rooted at `0x006ada90`. The helper restores the same collection vtable at `0x005ce130`, releases the indexed-collection payload through `0x00518600`, and then tails into the common collection teardown at `0x00518bd0`. Current grounded callers are the global world-shutdown path at `0x0044931d` and the route-link collection sweep at `0x004681ae`, which keep this as the clear destructor companion to `placed_structure_route_link_collection_construct`.","objdump + world-shutdown correlation + collection-layout inspection + manager-publication correlation"
0x004681f0,100,placed_structure_route_link_collection_remove_links_touching_site_id,map,thiscall,inferred,objdump + caller xrefs + field-match inspection,3,"Collection-wide cleanup sweep over `0x006ada90` that removes every route-link record whose grounded site-reference triple matches one caller-supplied placed-structure id. The helper walks the live route-link collection and deletes any record whose `u16` fields at `+0x0a`, `+0x0c`, or `+0x0e` equal the requested id, reusing the collection erase vfunc for each match. Current grounded callers include the placed-structure teardown path at `0x0040e23b`, where the supplied id comes from `[site+0x2a4]`, so this now looks like the site-side cleanup companion for the route-link family rather than a generic collection filter.","objdump + caller xrefs + field-match inspection + site-cleanup correlation"
0x00468260,84,placed_structure_route_link_collection_remove_links_by_route_node_id,map,thiscall,inferred,objdump + caller xrefs + field-match inspection,3,"Collection-wide cleanup sweep over `0x006ada90` that removes every route-link record whose route-node owner field at `+0x08` matches one caller-supplied id. The helper walks the live route-link collection, compares each record's `u16` field `+0x08` against the requested route-node id, and erases matching records through the same collection vfunc used by the broader cleanup paths. Current grounded caller is the neighboring runtime teardown at `0x004acf03`, which keeps this as the route-node-side cleanup companion to `placed_structure_route_link_collection_remove_links_touching_site_id` rather than another site sweep.","objdump + caller xrefs + field-match inspection + route-node-cleanup correlation"
0x004682c0,58,placed_structure_route_link_collection_recompute_all_endpoint_pair_state,map,thiscall,inferred,objdump + caller inspection + collection-iteration inspection,3,"Collection-wide recompute sweep over the live `0x006ada90` route-link family. The helper iterates every live route-link id through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then re-enters `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30` on each resolved record. This is the clean whole-collection state refresh companion to the per-record recompute helper rather than another allocator or cleanup path.","objdump + caller inspection + collection-iteration inspection + recompute-helper correlation"
0x00468300,235,placed_structure_route_link_rebuild_route_style_grid_counters_and_endpoint_state,map,thiscall,inferred,objdump + caller inspection + world-grid correlation + collection-iteration inspection,3,"Higher-level rebuild pass above the route-link family that resets the route-style world-grid counters and then recomputes live endpoint state across `0x006ada90`. The helper first reads three candidate-class ids from the structure-candidate side table at `0x0062ba8c+0x88/+0x8a/+0x8c`, walks the active world-grid tables rooted at `[0x0062c120+0x2129]`, and clears the aligned per-cell dword lanes at offset `+0x103` for those three classes. It then iterates every live route-link record in `0x006ada90`, clears state bit `0x2` in each record's flag byte at `+0x12`, and re-enters `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30`. Current grounded callers include the recurring simulation-maintenance branch at `0x0040a575`, the world bring-up side near `0x00444b2f`, and one later world-side update path at `0x00481157`, which makes this the clearest current owner of the full-family route-style counter-and-state rebuild rather than just another collection walk.","objdump + caller inspection + world-grid correlation + collection-iteration inspection + route-style-class correlation"
0x0041e2b0,589,structure_candidate_rebuild_local_service_metrics,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Setup-side local-metrics rebuild for one live structure candidate after it has passed `structure_candidate_is_enabled_for_current_year` at `0x0041e220`. The helper clears the metric bands at `[this+0x6a]`, `[+0x6e]`, `[+0x72]`, `[+0x76]`, and `[+0x7a]`, then samples repeated world-grid slices off the active world root at `0x0062c120` through `0x0042c960` and the per-cell tables rooted at `[world+0x2129]`. It accumulates one broad local magnitude at `[this+0x6a]`, folds two optional positive channels into `[this+0x6e]` and `[this+0x72]`, and finally normalizes and scales the trailing summary pair `[this+0x76]` and `[this+0x7a]` with fixed constants. Current grounded caller is `world_setup_building_collection_phase` at `0x0041ea50`, so this still looks like a setup-time local service or demand scorer rather than the recurring owner of the whole cargo-economy lane, but it is now one clear downstream consumer of the same `[candidate+0x56]` live-availability gate.","objdump + caller xrefs + callsite inspection + world-grid correlation"
0x0042db20,1040,scenario_event_refresh_runtime_record_from_packed_state,scenario,thiscall,inferred,objdump + caller inspection + local disassembly + shell-event-window correlation,2,"Heavy per-event runtime materializer beneath the live event collection at `0x0062be18`. The helper reads one packed event definition from the caller-supplied state or stream object, conditionally clears and repopulates several fixed text bands on the destination event record at offsets such as `+0x0e0`, `+0x401`, `+0x4ca`, `+0x593`, `+0x65c`, and `+0x725`, then rebuilds two event-runtime row families from caller-supplied counts and packed row payloads. Current shell-side xrefs now tighten that split. The first family allocates `0x1e`-byte rows, fills scalar and byte fields from the packed source, conditionally extends the row on later-format branches, remaps bounded id ranges through the live structure-candidate collection `0x0062ba8c`, and links the resulting rows through one standalone event-side list anchor; the adjacent helper cluster `0x0042df30/0x0042df70/0x0042dfb0/0x0042dff0` is only consumed by `EventConditions.win`, so this first family now reads as the runtime condition-row list. The second family repeats the same materialization pattern with `0x28`-byte rows across four grouped slots on the destination event record, applying version-gated field extension and bounded remap logic against the locomotive collection `0x006ada84`, the live structure-candidate collection `0x0062ba8c`, and the global candidate pool `0x0062b268` before linking each rebuilt row into one of four grouped list anchors; the generic deep-copy helper `0x0042e050` now clones those same grouped lists during event duplication, so this second family still reads as the grouped event-effect row side rather than another condition list. Current grounded caller is the collection-wide wrapper `0x00433130`, so this is now the safest current read for one live event's runtime-record refresh from packed scenario-state data rather than a generic collection helper.","objdump + caller inspection + local disassembly + event-record materialization correlation + candidate-and-locomotive-remap correlation + shell-event-window correlation"
0x0042d700,59,scenario_event_query_standalone_condition_row_list_class_and_modifier_flags,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + local disassembly,2,"Aggregates the class and modifier bits implied by one live event's standalone `0x1e`-row condition list. The helper first short-circuits to literal `0x7f` when event byte `[event+0x82b]` is set, then otherwise walks the list rooted at `[event+0x00]`, OR-ing the static row-class byte from `0x005f3e04 + id*0x81` for ordinary nonnegative row ids and using the negative-id fallback branch only to preserve special marker value `0x7f`. Current grounded callers are the condition-window summary refreshes `0x004d9970` and the broader control refresh `0x004da0f0`, so this is the safest current read for the standalone condition-list class or modifier aggregate rather than a generic linked-list scan.","objdump + EventConditions.win refresh correlation + local disassembly + condition-row-class-table correlation"
0x0042d740,87,scenario_event_query_grouped_effect_row_list_type_flags,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + local disassembly,2,"Aggregates one grouped effect-row type bitfield for a live event. The caller supplies the grouped list ordinal on the stack, and the helper walks the selected grouped anchor at `[event + group*4 + 0x04]`, OR-ing one descriptor byte from `0x006103fd + opcode*0x6e` across the linked `0x28`-row family. One caller-controlled boolean also enables a narrower normalization path that remaps a small special opcode subset to shared bit `0x08` before the OR step. Current grounded callers are the conditions-window refresh family `0x004d9d10` and `0x004da0f0`, plus one world-side branch at `0x00431120`, so this is the safest current read for grouped effect-row type flags rather than a standalone condition helper.","objdump + EventConditions.win refresh correlation + local disassembly + grouped-effect-descriptor correlation"
0x0042df30,63,scenario_event_condition_row_list_has_class_bit0_or_flag7f9_fallback,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + static-bit-table inspection,2,"Tiny predicate over the standalone `0x1e`-row event-condition list rebuilt by `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20`. The helper walks the linked list rooted at the caller-supplied event record, tests each nonnegative row id against class-bit `0x01` in the static per-condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to event-record byte `[event+0x7f9]`. Current grounded callers are the `EventConditions.win` refresh path at `0x004da19a` and `0x004da23c`, so this now reads as the class-bit-0 condition-summary gate rather than a generic list scan.","objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-flag correlation"
0x0042df70,63,scenario_event_condition_row_list_has_class_bit1_or_flag7fa_fallback,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + static-bit-table inspection,2,"Companion predicate over the standalone `0x1e`-row event-condition list. The helper walks the same linked list as `0x0042df30`, tests each nonnegative row id against class-bit `0x02` in the static condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to event-record byte `[event+0x7fa]`. Current grounded caller is the `EventConditions.win` refresh path at `0x004da1de`, so this now reads as the class-bit-1 condition-summary gate rather than another anonymous list helper.","objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-flag correlation"
0x0042dfb0,62,scenario_event_condition_row_list_has_class_bit2_or_type63_fallback,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + static-bit-table inspection,2,"Companion predicate over the standalone `0x1e`-row event-condition list. The helper walks the same linked list as `0x0042df30`, tests each nonnegative row id against class-bit `0x04` in the static condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to the event-record dword check `[event+0x7f0] == 0x63`. Current grounded caller is the `EventConditions.win` refresh path at `0x004da2be`, so this now reads as the class-bit-2 condition-summary gate rather than another generic scan.","objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-type correlation"
0x0042dff0,82,scenario_event_condition_row_list_has_any_class_bit012_or_special_fallback,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + static-bit-table inspection,2,"Broad predicate over the standalone `0x1e`-row event-condition list. The helper walks the same linked list as the smaller `0x0042df30/0x0042df70/0x0042dfb0` family, tests each nonnegative row id against any of class bits `0x01|0x02|0x04` in the static condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to any of the three special event-record checks `[event+0x7f9]`, `[event+0x7fa]`, or `[event+0x7f0] == 0x63`. Current grounded caller is the early `EventConditions.win` refresh gate at `0x004da17d`, so this now reads as the broad condition-summary eligibility probe rather than a generic linked-list walk.","objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-flag correlation"
0x0042e050,603,scenario_event_clone_runtime_record_deep_copy,scenario,cdecl,inferred,objdump + caller xrefs + local disassembly + shell-event-window correlation,2,"Deep-copy helper for one already-materialized live event runtime record. The helper copies the six fixed text bands at destination offsets `+0x0e0`, `+0x401`, `+0x4ca`, `+0x593`, `+0x65c`, and `+0x725`, mirrors the compact event metadata band at `+0x7ee..+0x80e`, then deep-copies the standalone `0x1e`-row linked list and the four grouped `0x28`-row linked lists from one live event-runtime record into the caller-supplied destination record. Current grounded caller is `shell_event_conditions_window_append_blank_or_clone_selected_event_via_name_modal` `0x004db8b0`, where it clones the currently selected live event into a newly created event record before selector refresh. This is therefore the safest current owner for deep-copy of an already-materialized event runtime record rather than another packed-state loader or an effects-only staging helper.","objdump + caller xrefs + local disassembly + shell-event-window correlation + deep-copy correlation"
0x0042c1b0,886,placed_structure_redistribute_local_service_pressure_from_neighbors,map,thiscall,inferred,objdump + caller xrefs + neighborhood sweep inspection,3,"Neighbor-aware local-service post-pass for one placed-structure or site record. The helper first builds a bounded set of nearby site references by scanning offset patterns from `0x00624b28` and `0x00624b48` against the world-grid tables rooted at `[0x0062c120+0x2129]`, keeping only neighbors whose state byte at `+0x0e6` is compatible with the current site and recording per-neighbor weights derived from the local word tables near `[site+0x00]` and `[site+0x0f3]`. It then walks the live candidate collection and, for each live non-remapped candidate, chooses the strongest positive neighbor deficit after scaling through the candidate-side weight at `[candidate+0x52]`; when a positive deficit remains it commits the redistribution through `0x0042bf80`. Current grounded caller is the composite local refresh `0x0042d580`, so this looks like the neighboring-site redistribution pass beneath the local service-score bundle rather than an independent outer loop.","objdump + caller xrefs + neighborhood sweep inspection + candidate-weight correlation"
0x0041eac0,794,structure_candidate_collection_refresh_cargo_economy_filter_flags,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + rdata strings,3,"Collection-wide refresh of one cargo-economy-sensitive candidate flag in the live structure collection at `0x0062ba8c`. The helper first walks the global candidate pool at `0x0062b268`, filters category-`2` entries through the paired availability bytes `[candidate+0xba]` and `[candidate+0xbb]` plus the recipe-runtime latch `[candidate+0x7ac]`, and builds one temporary per-cargo mask keyed by cargo names such as `Clothing`, `Cheese`, `Meat`, `Ammunition`, `Weapons`, `Diesel`, `Troops`, and `Passengers`; one special-case branch also uses structure labels such as `Barracks` and `Recycling Plant` while consulting the region collection at `0x0062bae0`. It then iterates the live structure collection itself, combines that temporary cargo mask with the candidate-local bytes `[entry+0x47]`, `[entry+0x48]`, and `[entry+0x49]`, the runtime cargo-economy latch at `[0x006cec74+0x25f]`, and the live copy of special-condition slot `31` `Use Wartime Cargos` at `[0x006cec78+0x4afb]`; when that slot is set the branch at `0x0041ed37` further tests the wartime cargo family `Clothing`, `Cheese`, `Meat`, `Ammunition`, `Weapons`, and `Diesel` before writing the resulting enabled-or-filtered state into `[entry+0x56]` and re-entering `0x0041e970` to rebuild the derived visible counts. Current grounded callers are the collection-side setup path around `0x0041f4cb` and the runtime toggle branch at `0x0046577c`, where the same `0x006cec74+0x25f` bit is flipped directly; that makes this the strongest current bridge from the editor's `Disable Cargo Economy` rule plus the `Use Wartime Cargos` scenario rule into live structure-candidate filtering rather than a purely editor-side helper.","objdump + caller xrefs + callsite inspection + rdata strings + special-condition correlation"
0x00421b60,180,world_region_collection_seed_default_regions,map,thiscall,inferred,objdump + strings + callsite inspection,4,"Seeds the default numbered region family on the manager collection at `0x0062bae0`. The helper pumps shell progress through `0x004834e0`, repeatedly creates collection entries through `0x00421660`, formats their labels from localized string id `2908` `Region %1` plus the `%02d` pattern at `0x005c9aec`, marks the created records live through `[entry+0x23e]`, and then finalizes the region set through `0x00421730` against the active world root at `0x0062c120`. Current grounded callsites are the post-load generation pipeline at `0x004384d0` and the broader world-build path around `0x004476ec`, so this now looks like region-set seeding rather than generic player or company setup.","objdump + RT3.lng strings + caller xrefs + callsite inspection"
0x00421c20,187,world_region_collection_run_building_population_pass,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Region-owned building-population dispatcher over the collection at `0x0062bae0`. For each region entry it forwards one caller-selected scale and mode flag into the lower worker at `0x004235c0`, pumps shell progress through `0x004834e0` between entries, and guards the sweep with the region-collection reentrancy counter at `[this+0x88]`. The same setup lane now shows one direct shell-state coupling too: constructor-time helpers in the same region family copy shell-state gate `[0x006cec74+0x174]` into local region-side state, and the post-load pipeline only reaches this dispatcher behind that same gate after posting localized id `320` `Setting Up Buildings...`. The per-region worker consults the region subcollection at `[region+0x37f]`, the global candidate pool at `0x0062b268`, the placed-instance registry at `0x0062b26c`, and one world-side notification or state owner at `0x0062b2fc`, which makes this look like a building spawn or allocation pass rather than a generic region refresh. Grounded callers include the post-load `Setting Up Buildings...` branch in world_run_post_load_generation_pipeline with arguments `(1.0, 1)` and a slower recurring simulation-side caller at `0x0040a804/0x0040a826` with scale `0.08333334` and mode `0`, which suggests the same lower subsystem also has a later maintenance cadence after initial setup.","objdump + caller xrefs + callsite inspection"
0x0042b2d0,49,world_grid_cell_has_packed_u16_token_in_6byte_roster,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small world-grid cell probe over one packed six-byte roster rooted at `[cell+0xef]` with count `[cell+0xeb]`. The helper walks that roster linearly, compares the caller-supplied `u16` token against the first word of each six-byte record, and returns `1` on the first match or `0` when no record matches. Current grounded callers include the city-connection peer probes `0x00420030/0x00420280`, where it filters site-class tokens from the caller's six-byte class table, plus the center-cell wrapper `0x0041f6e0`.","objdump + local disassembly + caller correlation + packed-roster correlation"
0x0041f9b0,125,world_region_count_structure_profiles_before_year_for_category,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Counts region-subcollection structure profiles whose backing candidate resolves through `0x00412b70`, passes the availability gate at `0x0041f998`, matches one caller-selected category byte, and has threshold year `[profile+0x26]` less than or equal to the caller-supplied year. Current grounded callers include the region stats path at `0x004cbd41`, where category `2` feeds the localized `Industry Weightings` report, and the deeper per-region worker at `0x004235c0`, where the same count bounds demand for the weighted category-2 profile family.",objdump + caller xrefs + callsite inspection + RT3.lng strings
0x0041fa30,133,world_region_find_named_structure_profile_weight,map,thiscall,inferred,objdump + strings + caller xrefs,3,"Looks up one named structure profile in the current region subcollection `[region+0x37f]`. The helper linearly compares the caller-supplied text against each profile label and returns the float-like weight at `[profile+0x1e]` for the first exact match, otherwise `0.0`. The same region-subcollection string block is now partially grounded from nearby `.rdata` as labels such as `House`, `Hotel`, `Iron Mine`, `Furniture Factory`, `Fertilizer Factory`, and `farm`. Current grounded callers sit in world-side UI or telemetry branches around `0x004cbb74`, `0x004cc054`, and `0x004ccc54`.","objdump + caller xrefs + rdata strings"
0x0041fac0,60,world_region_read_structure_profile_label_and_weight_by_index,map,thiscall,inferred,objdump + caller xrefs + strings,4,"Reads one 1-based structure-profile entry from the current region subcollection `[region+0x37f]`. It copies the profile label string into the caller buffer and writes the float-like weight at `[profile+0x1e]` into the caller-provided out-slot. This is the label/value helper used beneath the region structure-demand worker and the adjacent UI or telemetry callers. The grounded profile-name block around `0x005c9100` now includes labels such as `House`, `Hotel`, `Iron Mine`, `Furniture Factory`, and `Fertilizer Factory`.","objdump + caller xrefs + rdata strings"
0x00422320,1320,world_region_normalize_cached_structure_balance_scalars,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Collection-wide region normalization pass over the live region manager `0x0062bae0`. The helper first early-outs in sandbox/editor-side mode through `[0x006cec7c+0x82]` and the active-mode latch `[0x006cec78+0x4aef]`, then runs one per-region prepass through `0x00420d40`, and finally performs two cohort sweeps split by region live byte `[region+0x23e]`. Across those sweeps it accumulates the cached scalar bands `[region+0x2b2/+0x2b6/+0x2ba/+0x2be/+0x2c2/+0x2c6]`, derives bounded normalization ratios, and writes the resulting cached growth-balance band back to `[region+0x2e2/+0x2e6/+0x2ea/+0x2ee]`. The player-facing meaning is tighter now from the editor growth report at `0x004d1d60`: `[region+0x2e2]` is the cached weighted-profit-margin scalar and `[region+0x2ee]` is the cached annual-density-adjust scalar later formatted as a percent, while `[region+0x2e6]` and `[region+0x2ea]` are the intermediate normalized-delta and clamped companion slots beneath that final annual-density adjust. The helper also uses world_region_count_linked_placed_structures_by_category `0x004228b0` as the direct category-count companion during the writeback sweep, and it applies one final live-value adjustment into `[region+0x25e]` when the shell latch `[0x006cec78+0x46c38]` is clear. Current grounded caller is the recurring simulation-maintenance branch at `0x0040a265` inside `simulation_service_periodic_boundary_work` `0x0040a590`, so this is now the safest current read for the region cached growth-balance normalization pass rather than a one-time setup helper.","objdump + local disassembly + caller inspection + recurring-maintenance correlation + editor-growth-report correlation"
0x004228b0,68,world_region_count_linked_placed_structures_by_category,map,thiscall,inferred,objdump + local disassembly,3,"Counts linked placed-structure records in the current region entry whose category byte matches one caller-supplied value. The helper walks the placed-instance chain rooted at `[region+0x383]` through the global registry `0x0062b26c`, resolves each live record's category byte through the vtable `+0x80` object view, and increments one simple match count without applying the heavier cap or availability filters used by `0x00422be0`. The current grounded local caller is the broader region-side worker around `0x00422320`, where this helper is used as the direct category-count companion to the later aggregate and placement passes rather than as a full demand-balancing gate.","objdump + local disassembly + local caller correlation"
0x00422850,91,world_region_count_class0_regions_passing_city_connection_peer_probe_variant,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Counts live class-0 regions in the current region collection that pass one specific `city_connection_bonus_exists_matching_peer_site` variant through `0x00420030`. The helper skips non-class-0 records, calls `0x00420030` with fixed boolean flags `(1,1,1)` plus one caller-supplied trailing dword, and increments a simple count only when that probe returns nonzero. Current grounded callers are the script or query dispatch at `0x0042f856` and the region-stats formatter at `0x004d2088`, so the safest current read is the narrow class-0 count wrapper over that peer-probe variant rather than a broader city-growth metric.","objdump + local disassembly + caller correlation + city-connection-probe correlation"
0x00422900,352,world_region_accumulate_structure_category_totals,map,thiscall,inferred,objdump + callsite inspection,3,"Aggregates the current structure-category totals for one region entry. The helper walks the placed-instance chain rooted at `[region+0x383]` through the global registry `0x0062b26c`, resolves each live record's category byte through the vtable `+0x80` object view, and returns both counts and accumulated weight-like totals across four categories via the caller-provided out-pointers. Current grounded caller is world_region_balance_structure_demand_and_place_candidates at `0x004235c0`, where the outputs feed the later demand-balancing logic for the region-owned building-population pass.","objdump + callsite inspection"
0x00422a70,355,world_region_validate_and_commit_candidate_placement,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Shared placement-validation and commit gate beneath the region candidate-placement family. The helper takes one region entry in `ECX`, one candidate or profile id on the stack, one candidate world-coordinate pair, one caller-controlled side flag, one direct-versus-staged commit flag, and one optional out-pointer for the created placed-structure id. It first clears the optional out-slot, conditionally snaps the candidate coordinate pair to integers under the preview gate `0x434050 -> 0x46d2b0`, then validates projected placement through `placed_structure_validate_projected_candidate_placement` `0x004197e0`. On the direct-commit lane it additionally resolves the candidate world cell through `0x0044a800` and requires that cell's region id to match `[region+0x23a]`. When placement is allowed and the shell-side latch `[0x006cec78+0x46c3c]` is clear, one branch emits the staged side path through `0x0046d260`; otherwise it commits directly through `placed_structure_collection_allocate_and_construct_entry` `0x004134d0` and stores the resulting placed-structure id in the caller's out-slot. Current grounded callers are `world_region_try_place_candidate_structure` `0x00422ee0` and the world-side randomized batch helper `world_try_place_random_structure_batch_from_compact_record` `0x00430270`, so this is best read as the shared region-side candidate-placement validator and commit gate rather than as one region-worker-private helper.","objdump + local disassembly + caller correlation + placement-validator correlation"
0x00422be0,768,world_region_count_placed_structures_for_category,map,thiscall,inferred,objdump + callsite inspection,3,"Counts already-placed structures in one requested category for the current region entry. It walks the placed-instance chain rooted at `[region+0x383]` through `0x0062b26c`, filters live records by the requested category byte, and applies several additional placement gates including one cap on `[record+0x276]`, one disable byte at `[record+0x390]`, and special handling for category `2`. Current grounded caller is world_region_balance_structure_demand_and_place_candidates at `0x004235c0`, where the result is subtracted from the region's computed category demand before more candidates are chosen.","objdump + callsite inspection"
0x00422ee0,884,world_region_try_place_candidate_structure,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Attempts one candidate-structure placement for the current region entry and requested category. It derives one region-ranking bucket from `[region+0x256]` and `[region+0x25e]`, uses the region count at `0x0062bae0` to index the weighting table at `0x005ee1e0`, chooses one trial budget of `10` or `15` depending on the setup latch at `[0x006cec78+0x46c3c]`, and then repeatedly evaluates candidates from the global site pool `0x0062b268`. The chooser matches candidate names and scores against region subcollection entries, rejects over-cap or already-satisfied sites through the placed-instance registry `0x0062b26c`, and when successful either dispatches one direct placement through `0x004134d0` or routes the selected site into the shell-facing side path through `0x004337c0`. Current grounded callers are the region building worker at `0x004235c0` and the separate world-side branch at `0x004d1871`, so this now looks like the core candidate-placement helper beneath the region-owned building-population family.","objdump + caller xrefs + callsite inspection"
0x004235c0,1887,world_region_balance_structure_demand_and_place_candidates,map,thiscall,inferred,objdump + callsite inspection,4,"Core per-region worker beneath world_region_collection_run_building_population_pass. It first checks the broader shell-state master flag at `[0x006cec74+0x68]` and diverts into a separate alternate path when that flag is nonzero. The same flag now aligns with the editor-map `.gmp` family in the shell file coordinators, so the ordinary demand-balancing and placement flow currently looks grounded for the non-editor world mode while the alternate branch likely belongs to the editor-map side. In that ordinary path it aggregates existing category counts and weights through world_region_accumulate_structure_category_totals at `0x00422900`, samples the current region subcollection size through `0x0041f6a0`, queries projected structure-count scalars through `world_region_query_projected_structure_count_scalar_by_category` `0x004234e0`, and then computes target demand for three structure categories by comparing those projected totals against live placed counts plus several randomized clamps. The three grounded category families are now narrower: category `0` uses the fixed fallback label `House` from `0x005c9114`; category `2` is the year-gated weighted region-profile family read through world_region_read_structure_profile_label_and_weight_by_index at `0x0041fac0` and bounded by world_region_count_structure_profiles_before_year_for_category at `0x0041f9b0`, which also feeds the localized `Industry Weightings` report in the region stats UI; and category `3` reaches world_region_pick_commercial_profile_label_by_region_rank at `0x00412ca0`, whose fallback token is `Commercial` but whose aligned region-stats label slot is localized as `City Support`. After subtracting already-placed coverage through world_region_count_placed_structures_for_category at `0x00422be0`, the worker tries placements through world_region_try_place_candidate_structure at `0x00422ee0` until demand is exhausted or the attempt budget runs out. This makes the worker a region structure-demand balancing and placement pass over houses, weighted region profiles, and the broader city-support branch rather than a generic setup loop.","objdump + callsite inspection + region stats disassembly + RT3.lng strings + rdata strings + file-flow correlation + projected-demand correlation"
0x004234e0,211,world_region_query_projected_structure_count_scalar_by_category,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Returns one projected structure-count scalar for the requested region and category family. On the live-region branch `[region+0x23e] != 0`, the helper indexes the category table at `0x005ee1b0` by `(live_region_class, category)`, scales it by scenario difficulty and the normalized region-density field `[region+0x25e]`, then multiplies by the cached building-count slot `[region+0x242]`. On the fallback branch it instead derives one region bucket from `[region+0x25e]`, combines the two static tables `0x005ee138` and `0x005ee1b0`, and applies the alternate scenario-difficulty scale before returning the final float. Current grounded callers are the per-region placement worker `0x004236dc`, the map-editor city-count stats report `0x004d0420`, and the shell-side stats formatter around `0x004cc816`, where categories `2`, `3`, and `0` are aggregated into the projected starting industry and non-industry totals. This is therefore the shared projected region structure-count accessor rather than another placement mutator.","objdump + local disassembly + caller correlation + city-count-stats correlation"
0x00423d30,51,world_region_refresh_cached_category_totals_and_weight_slots,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Refreshes one small cached region summary band rooted at `[this+0x27a]`. The helper forwards three out-pointers `+0x27a/+0x27e/+0x282` plus one return slot `+0x286` into world_region_accumulate_structure_category_totals `0x00422900`, forcing the remaining category outputs and optional aggregate pointers to zero. Current grounded caller is the post-load seeding-burst tail around `0x00437bdc`, which sweeps the live region collection `0x0062bae0` after simulation_run_chunked_fast_forward_burst `0x00437b20`. This is therefore the narrow cached-category-summary refresher beneath that region-side setup and maintenance family rather than a company debt-table helper.","objdump + local disassembly + caller inspection + post-load caller correlation"
0x00423d70,176,company_repay_bond_slot_and_compact_debt_table,simulation,thiscall,inferred,objdump + caller inspection,4,"Repays and removes one indexed bond entry from the live company debt table. The helper validates the requested slot against the current bond count at `[this+0x5b]`, compacts the remaining 12-byte entries rooted at `[this+0x5f]`, and then recomputes the dependent finance accumulators through `0x0042a040` and `0x0042a080`. Current grounded shell caller is the repay-bond branch beneath `CompanyDetail.win`, which makes this the company-side debt-table mutator rather than a territory-access helper.","objdump + caller inspection + finance-field correlation"
0x00423ec0,33,company_adjust_available_track_laying_capacity_with_floor_zero,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,2,"Small saturating company-side counter adjuster over `[this+0x7680]`. When that field is not `-1`, the helper adds the caller-supplied delta, clamps the result at zero on underflow, and writes it back. The surrounding lifecycle is tighter now too: nearby company initialization around `0x004285c0` seeds `[this+0x7680]` to `50` when scenario byte `[0x006cec78+0x4aaf]` is enabled and to sentinel `-1` otherwise, while the companion getter `0x004240a0` returns either the live counter or fixed fallback `29999`. Current language-table correlation now gives that scenario byte a stronger player-facing read: it is the live gate behind RT3.lng `2576` `Company track laying is limited...` and event variable label `2358` `Company Track Pieces Buildable`. Current grounded caller is `route_entry_collection_create_endpoint_entry_from_coords_and_policy` `0x00493cf0`, where company-bound endpoint synthesis passes either `-1` or `-2` through this helper before the new route-entry payload is committed. That makes this the strongest current match for available track-laying capacity consumption rather than a generic finance counter.","objdump + caller xrefs + callsite inspection + route-build-capacity correlation + capacity-lifecycle correlation + RT3.lng correlation"
0x004240a0,28,company_query_available_track_laying_capacity_or_unlimited,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,2,"Returns the current company's available track-laying capacity. When scenario byte `[0x006cec78+0x4aaf]` is enabled, the helper returns the live company counter at `[this+0x7680]`; otherwise it returns fixed fallback `29999`, which currently reads as an effectively-unlimited path. Current language-table correlation now ties that scenario byte to RT3.lng `2576` `Company track laying is limited...` and event variable label `2358` `Company Track Pieces Buildable`, so this helper is best read as the live getter beneath that scenario rule rather than only as an internal company counter accessor. Current grounded callers include `placed_structure_validate_projected_candidate_placement` `0x004197e0`, `route_entry_collection_create_endpoint_entry_from_coords_and_policy` `0x00493cf0`, and `route_entry_collection_search_path_between_entry_or_coord_endpoints` `0x0049d380`, where the returned value is used as the company-side track-laying-capacity gate for route synthesis and station-attachment placement.","objdump + caller xrefs + callsite inspection + track-laying-capacity correlation + RT3.lng correlation"
0x00424010,29,company_has_territory_access_rights,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns whether the current company has access rights in one requested territory id. The helper indexes the per-territory access byte at `[this + territory*0x38d + 0x1d9f]` and returns `1` when that byte is nonzero. Current grounded callers are the `CompanyDetail.win` territory-access summary helper at `0x004c1b60` and the territory-access purchase flow at `0x004c5fc9`.","objdump + caller inspection + territory-access table correlation"
0x00423e40,112,company_compute_weighted_average_bond_interest_rate,simulation,thiscall,inferred,objdump + caller xrefs + debt-record inspection,4,"Computes the company's current weighted average bond interest rate from the live debt table rooted at `[this+0x5f]`. The helper rejects inactive companies and companies with no live bond slots, then walks each 12-byte debt record, accumulates total principal from `[slot+0x00]`, accumulates principal-times-rate from `[slot+0x08]`, and returns the weighted quotient `sum(principal*rate) / sum(principal)`. Current grounded callers are the bond-quote wrapper at `0x00427540`, the CompanyDetail capital summary panel at `0x004c23a0`, and the city-connection bonus ladder at `0x00425320`, so this is the shared average coupon or interest-rate helper rather than a generic finance multiplier.","objdump + caller xrefs + debt-record inspection + finance-summary correlation + bond-quote correlation"
0x00423eb0,6,company_query_cached_share_price_scalar,simulation,thiscall,inferred,objdump + caller xrefs + per-share panel correlation,3,"Tiny cached-float accessor that returns the company field at `[this+0x0d7b]`. Current grounded shell callers are the CompanyDetail per-share panel at `0x004c2720` and later train-side consumer paths, where this cached scalar is used in the same lane as the `Share Price` readout. The write-side owner is now tighter too: `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` optionally snapshots its final float into the same field when the caller requests a cache refresh, so this remains the narrow cached share-price accessor rather than an arbitrary finance-field read.","objdump + caller xrefs + per-share panel correlation + cached-float-field correlation + stock-price-cache-write correlation"
0x00424030,22,company_set_territory_access_rights_byte,simulation,thiscall,inferred,objdump + caller inspection,4,"Stores one territory-access byte for the requested company and territory id. The helper writes the supplied byte value into the same per-territory access table rooted at `[this + territory*0x38d + 0x1d9f]`. Current grounded shell caller is the immediate commit path inside `shell_company_detail_buy_territory_access_rights_flow` at `0x004c5fc9`, where the purchase path writes value `1` after the access-rights dialog is accepted.","objdump + caller inspection + territory-access table correlation"
0x004241e0,23,company_sum_control_transfer_offer_policy_fields_raw,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns the raw sum of two company-side floating fields at `[this+0x124f]` and `[this+0x12a7]`. Current grounded callers are the merger-offer builder around `0x004eb5a9` and adjacent control-transfer offer-side stat readers, where the returned value is paired with surrounding formatter setup for mode `0x0b` but is not itself passed an issue argument. This now looks like a narrow raw control-transfer offer policy total rather than a generic finance calculation.","objdump + caller inspection + merger-offer dialog correlation"
0x00424200,37,company_sum_control_transfer_offer_policy_fields_scaled_tenths,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns the same `[this+0x124f] + [this+0x12a7]` company-side policy total as `company_sum_control_transfer_offer_policy_fields_raw`, but scaled by the `0.1` constant at `0x005c9b50`. Current grounded callers are the merger and chairmanship-takeover offer builders at `0x004eb588` and `0x0050c7cb`, where the scaled result is immediately paired with surrounding formatter setup for mode `0x0b`. The helper itself does not consume an issue id, so this now reads as the scaled control-transfer offer policy total rather than a broader vote-weight function.","objdump + caller inspection + takeover and merger dialog correlation"
0x004248d0,759,company_compute_cached_recent_per_share_performance_subscore,simulation,thiscall,inferred,objdump + caller inspection,3,"Builds one cached company-side per-share performance subscore from recent yearly stock-data history and current scenario difficulty. When the company is inactive via `[this+0x3f]` it returns the fixed negative fallback at `0x005c8598`; otherwise it reuses the cache in `[this+0x0cfb]` and `[this+0x0cff]` when the current year at `[0x006cec78+0x15]` matches. On a cold pass it first walks up to five recent years above founding year `[this+0x157]`, weighting yearly `Earnings Per Share` from slot `0x1f` and yearly `Revenue Per Share` from slot `0x1e` through `0x0042a5d0`; the current partial year uses weight `(5 * [world+0x0f]) - 5`, while the prior four full years use `48`, `36`, `24`, and `12`. That yields two normalized history lanes: `EPS * 10` into the first lane and `Revenue Per Share` into the second. It then runs a second trend pass over `Dividend Per Share` slot `0x20`, rewarding adjacent year pairs where the newer dividend does not fall below the previous year's value; that pairwise ladder uses weights `9`, `8`, `7`, and `6` from newest to oldest surviving comparison. The third lane is a dividend-strength score derived from that rewarded ratio, the previous-year dividend, and the constants `0.5`, `0.6`, `30`, and `230`, then floored to `1.13 * min(max(EPS lane, 1.0), revenue lane, current Book Value Per Share slot 0x1d)`. The fourth lane is current `Book Value Per Share` from slot `0x1d`. Negative lanes are clamped to zero. Base lane weights come from `0x005ee208` as `40/10/20/30`, and for company age under five years they are ramped through the four-dword rows at `0x005ee218`: `0/0/0/100`, `25/25/35/100`, `50/50/65/100`, `75/75/85/100`, and `100/100/100/100`. The strongest lane then gets weight `*1.25` while the weakest gets `*0.8`, and the resulting weighted blend ratio is stored as bounded intermediate `[this+0x0d19]` after multiplying by `((difficulty_table[[world+0x2d]] + 1.0) / 2.0)` and flooring at `0.5`. The final cached score recomputes that same base blend, multiplies it by the raw difficulty scalar table at `0x005f33b8` (`0.8/0.9/1.0/1.1/1.2/0.9/0.95/1.0`), applies post-bankruptcy smoothing for companies within ten years of `[this+0x163]` as `score * ((0.025 * years_since_bankruptcy) + 0.5)`, floors the result at `1.0`, and finally caches the float in `[this+0x0cff]` with the current year in `[this+0x0cfb]`. Current grounded caller is `company_compute_public_support_adjusted_share_price_scalar` at `0x00424fd0`, where this helper now reads as the recent per-share performance feeder rather than a generic governance-support history walker.","objdump + caller inspection + cache-field correlation + stock-data-family correlation + per-share-panel correlation + weight-ladder correlation + dividend-trend correlation + age-ramp-table correlation + difficulty-table correlation"
0x00425a90,194,company_declare_bankruptcy_and_halve_bond_debt,simulation,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the grounded company bankruptcy commit path. The helper walks the live bond table rooted at `[this+0x5f]`, halves each outstanding principal, recomputes finance metrics through `0x0042a040` and `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`, reduces the company value field at `[this+0x47]`, and stamps the current year into `[this+0x163]` as the localized bankruptcy-cooldown anchor. Current grounded shell caller is `shell_company_detail_bankruptcy_flow` on the `CompanyDetail.win` path.","objdump + RT3.lng strings + caller inspection + finance-field correlation"
0x004261b0,74,company_count_unassigned_shares_after_active_chairman_holdings,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns the current company share pool at `[this+0x47]` minus the positive holdings found in each active chairman profile record under `0x006ceb9c`. The helper uses the company collection index from `[this+0x00]` to read per-profile holdings from `[profile + company_index*4 + 0x15d]`, sums only positive entries, and subtracts that total from the company share count. Current grounded callers are the takeover and merger vote resolvers, which stage the result into `0x006d1a04` and `0x006d1104` before the lower public-vote support formulas run.","objdump + caller inspection + takeover and merger vote correlation"
0x00426260,607,company_compute_board_approved_dividend_rate_ceiling,simulation,thiscall,inferred,objdump + caller inspection,4,"Computes one nonnegative per-share dividend ceiling for the selected company. The helper starts from the current support or governance lane `0x2329/0x0d`, normalizes that value by the current outstanding-share band at `[this+0x47]`, then scans a bounded recent-year window relative to the founding year `[this+0x157]` and current scenario year `[0x006cec78+0x0d]`, taking minima from the shareholder-facing slots `0x2b` and `0x2c`. In the early-company path it also folds in `[this+0x57]` and the previous-year slot `0x1c`, applies several scale constants, and clamps the result at zero before returning the final per-share ceiling. Current grounded shell caller is `shell_company_detail_handle_change_dividend_rate_dialog_message` at `0x004c5140`, where this is the direct board-approval limit behind localized id `991` when the player tries to raise the dividend too far.","objdump + caller inspection + dividend-ceiling correlation"
0x004273c0,132,company_repurchase_public_shares_and_reduce_capital,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Repurchases one caller-supplied quantity of public shares and reduces company capital accordingly. The helper converts the share count into one cash-side total through the current support-adjusted share-price scalar from `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` and fixed market-scale constants, posts the resulting negative amount into company stat slots `0x0c` and `0x0d` through `0x0042a080` and `0x0042a040`, and subtracts the same share count from the outstanding-share field `[this+0x47]`. Current grounded callers are the `CompanyDetail.win` stock-buyback flow at `0x004c46d0` and the annual finance-policy helper at `0x00401c50`, where it contributes the RT3.lng `2887` repurchase headline.","objdump + caller xrefs + callsite inspection + stock-buyback correlation + annual-finance correlation"
0x00427450,224,company_issue_public_shares_and_raise_capital,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Issues one caller-supplied quantity of public shares and increases company capital. When the optional pricing flag is clear, the helper derives one implied share-price scalar from `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`, the current company credit-rating score at `0x00425320`, and fixed underwriting constants; when the flag is set it reuses the caller-supplied scalar instead. It then posts the resulting proceeds into company stat slot `0x0c`, records the issued-share quantity in stat slot `0x0d`, snapshots the prior current-issue packed calendar tuple from `[this+0x16b/+0x16f]` into `[this+0x173/+0x177]`, writes the active world tuple from `[0x006cec78+0x0d/+0x11]` back into `[this+0x16b/+0x16f]` when taking the derived-pricing lane, and increases the outstanding-share field `[this+0x47]` by the issued quantity. Current grounded callers are the `CompanyDetail.win` stock-issue flow at `0x004c3f30` and the annual finance-policy helper at `0x00401c50`, where it contributes the debt-refinance-plus-borrowing and straight new-borrow capital side.","objdump + caller xrefs + callsite inspection + stock-issue correlation + annual-finance correlation + calendar-tuple-stamp correlation"
0x00427540,76,company_compute_bond_interest_rate_quote,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Computes one company-specific bond interest-rate quote from the requested term and current credit or rate state. When the company is active it combines the current company credit-rating score from `0x00425320`, the prime-rate helper `company_compute_prime_rate_from_issue39_scenario_baseline` `0x00424580`, and one term-dependent adjustment from the caller-supplied year span, then returns the resulting float rate; otherwise it falls back to `1.0`. Current grounded caller is `company_issue_bond_and_record_terms` `0x004275c0`, where this helper supplies the quoted rate when the caller does not already provide one.","objdump + caller xrefs + callsite inspection + bond-rate correlation + credit-rating correlation + prime-rate correlation"
0x004275c0,255,company_issue_bond_and_record_terms,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Issues one new bond and appends its term record to the live company debt table. The helper first rejects companies already at the `0x14` bond-slot cap, computes or accepts one quoted interest rate through `company_compute_bond_interest_rate_quote` `0x00427540`, posts the bond proceeds into company stat slot `0x0c`, posts the principal into stat slot `0x12`, posts the coupon rate into stat slot `0x0d`, and then writes one new three-dword bond record into the next 12-byte entry rooted at `[this+0x5f]`: principal, maturity year, and quoted rate. It increments the bond count at `[this+0x5b]` and returns success. Current grounded callers are the `CompanyDetail.win` bond-issue flow at `0x004c3890` and the annual finance-policy helper at `0x00401c50`, where it supplies both straight new borrowing and refinance-plus-borrow follow-ons.","objdump + caller xrefs + callsite inspection + bond-issue correlation + annual-finance correlation"
0x00426890,68,company_find_collection_index_by_company_id,simulation,thiscall,inferred,objdump + caller inspection,4,"Finds one live company collection index by comparing the requested company id against the first dword of each entry in the company manager at `0x0062be10`. The helper returns the zero-based index on a match or `-1` when no live company record matches. Current grounded callers are the takeover and merger vote resolvers, which use that index before reading profile-side per-company holdings from `0x006ceb9c`.","objdump + caller inspection + company collection correlation"
0x00426be0,53,company_can_purchase_territory_access_rights,simulation,thiscall,inferred,objdump + caller inspection + RT3.lng strings,4,"Returns whether the current company may purchase territory-access rights for one requested territory id. The helper first rejects territories where the company already has access through the byte table at `[this + territory*0x38d + 0x1d9f]`, then resolves the territory through `0x006cfc9c` and only returns `1` when the territory-side mode byte at `[territory+0x2d]` equals `1`. Current grounded callers are the `CompanyDetail.win` territory-access summary helper at `0x004c1b60` and the buy-rights flow at `0x004c5fc9`, where this is the direct gate between localized ids `947` and `948` plus the actionable `961` purchase prompt.","objdump + caller inspection + RT3.lng strings + territory-flag correlation"
0x00426d60,393,company_deactivate_and_clear_chairman_share_links,simulation,thiscall,inferred,objdump + caller inspection + collection-state correlation,4,"Runs the destructive selected-company clear path currently reached from `CompanyDetail.win`. The helper first rejects inactive companies through `[this+0x3f]`, then zeroes all active-chairman share holdings for this company across `0x006ceb9c`, clears the linked chairman backpointer `[company+0x3b]` and the profile-side owning-company field `[profile+0x1dd]`, clears the selected-company latch when the scenario currently points at this company, marks the company inactive by zeroing `[company+0x3f]`, and walks two live collections to drop or invalidate remaining references that still point back to this company. The tail then rebuilds one local name block from `[company+0x4]` and publishes the change through the scenario-state helper at `0x004360d0`. Current grounded shell caller is the `0x9493` section-0 control under `shell_company_detail_window_handle_message`, so current best meaning is a company deactivation or liquidation-style clear path rather than an ordinary governance vote helper.","objdump + caller inspection + collection-state correlation + CompanyDetail control correlation"
0x00426ef0,43,company_get_linked_chairman_profile_record,simulation,thiscall,inferred,objdump + caller inspection,4,"Resolves the linked chairman profile record for one company. The helper reads the linked chairman id from `[this+0x3b]`, validates it against the live profile collection at `0x006ceb9c`, and returns the resolved profile record through `0x00518140`; zero or invalid ids return null. Current grounded callers include the CompanyDetail section-0 overview formatter at `0x004e5cf0`, where this is the direct bridge from a selected company to the chairman profile used for ownership and governance text.","objdump + caller inspection + chairman-link correlation"
0x0042a0e0,77,company_query_highest_coupon_bond_slot_index,simulation,thiscall,inferred,objdump + caller inspection + debt-record layout correlation,3,"Returns the live bond-slot index with the highest coupon rate from the debt table rooted at `[this+0x5f]`. The helper walks the current bond count at `[this+0x5b]`, compares each slot's rate field at `[this+0x67 + slot*0xc]`, and returns the zero-based index of the strongest surviving slot or `-1` when no bond slots are live. Current grounded caller is the annual finance-policy helper at `0x00401c50`, where this picks the reference bond used by the build-`1.03+` stock-issue lane before it checks current cash against that slot's principal plus a small fixed buffer.","objdump + caller inspection + debt-record layout correlation + annual-finance correlation"
0x0042a040,55,company_add_delta_into_stat_series_and_current_slot,simulation,thiscall,inferred,objdump + caller xrefs + field-write correlation,3,"Adds one caller-supplied float delta into the company stat-family series lane selected by the requested slot id. The helper increments both the year-indexed series rooted at `[this+0x0d7f]` and the current aggregate lane rooted at `[this+0x1c47]`, but does not touch the broader cash-side shadow totals. Current grounded callers include bond repayment `0x00423d70`, bankruptcy `0x00425a90`, stock buyback `0x004273c0`, territory-access purchase `0x004c5fc9`, and several placement or world-service mutations, so this now reads as the shared company stat poster without the optional cash-side follow-on.","objdump + caller xrefs + field-write correlation + finance-mutator correlation"
0x0042a080,95,company_add_delta_into_stat_series_current_slot_and_optional_cash_totals,simulation,thiscall,inferred,objdump + caller xrefs + field-write correlation,3,"Adds one caller-supplied float delta into the selected company stat-family lane, exactly like `company_add_delta_into_stat_series_and_current_slot` `0x0042a040`, and optionally mirrors the same delta into the broader cash-side shadow totals when the third argument is nonzero. The shared stat writes still land in the year-indexed series rooted at `[this+0x0d7f]` and current aggregate lane `[this+0x1c47]`; the optional follow-on also increments the cash-pair totals at `[this+0x11f7]` and `[this+0x1caf]`. Current grounded callers include stock buyback `0x004273c0`, chairman-salary and dividend policy paths around `0x00427920`, linked world-service updates, and several company-side cash or capital mutators, so this is the stronger shared company stat poster when cash-side shadow totals must stay synchronized.","objdump + caller xrefs + field-write correlation + cash-pair correlation + finance-mutator correlation"
0x0042a2e0,645,company_read_control_transfer_metric_slot,simulation,thiscall,inferred,objdump + caller inspection,3,"Reads one derived company metric from the bounded slot family `0x13..0x2f` used by control-transfer, public-support, annual governance logic, report-history pages, and stock-data readouts. The dispatcher mixes direct company fields such as `[this+0x4b]`, `[this+0x53]`, `[this+0x323]`, `[this+0x327]`, `[this+0x333]`, `[this+0x33f]`, and the later counters near `[this+0x34b]` and `[this+0x14f]` with a few computed ratios and helper-backed terms. The first grounded slot `0x13` already resolves through `company_compute_public_support_adjusted_share_price_scalar` at `0x00424fd0`, which now reads as a broader investor-support and share-price lane rather than a vote-only term. Wider shell-side xrefs now tighten the stock-data subfamily too: slot `0x1c` is `Share Price`, slot `0x1d` is `Book Value Per Share`, slot `0x1e` is `Revenue Per Share`, slot `0x1f` is `Earnings Per Share`, slot `0x20` is `Dividend Per Share`, slot `0x21` now routes through `company_compute_five_year_weighted_shareholder_return` `0x004246b0` for `5 Year Weighted Return`, and the adjacent slot `0x23` is now best bounded as the hidden current or fallback shareholder-payout lane rooted at `[this+0x53]` that feeds that five-year return formula. The higher derived switch at `company_read_derived_financial_report_metric_slot` `0x00429c70` also now narrows the shared finance-family semantics reused beside this slot reader: `0x2b` is the net-profits-style derived lane, `0x2c` is the broader revenue aggregate, and raw slot `0x09` aligns with the Income Statement fuel-cost lane surfaced by tooltip `1309`; the adjacent special interest-help row uses a different metric id and `2815` rather than raw slot `0x09` itself. That keeps nearby annual finance, CompanyDetail, and ledger readouts consistent with shell labels such as `925` `Profits:`, `928` `Largest Shareholders`, `929` `Shares`, and `930` `Per Share Data`. This now looks like a generic company support-and-finance metric dispatcher rather than a merger-only issue reader.","objdump + caller inspection + metric-slot correlation + governance-string correlation + company-detail correlation + stock-data-label correlation + income-statement-row correlation + derived-report-metric correlation + share-price-scalar correlation + weighted-return correlation + shareholder-payout-lane correlation"
0x0042a5d0,131,company_read_year_or_control_transfer_metric_value,simulation,thiscall,inferred,objdump + caller inspection + RT3.lng strings,3,"Reads one company-side float from either a year-relative stat series or the local support-and-governance metric slot family. When the family argument is `0x2329` or one of the neighboring current-year offsets, the helper resolves one year-relative table entry from the series rooted at `[this+0x0d7f]`; when the request falls back to the bounded slot family it delegates to `company_read_control_transfer_metric_slot` at `0x0042a2e0`, and requests at `0x2b` or above then continue into `company_read_derived_financial_report_metric_slot` `0x00429c70`. The `0x2329` token is no longer treated as an issue id here: it is the stat-family selector paired with the localized company-stat label id `2329`, and current grounded callers use this wrapper beneath merger, takeover, bankruptcy, annual shareholder-revolt, creditor-liquidation, and other company-policy dialogs to fetch yearly or current support-side values. This makes the helper a generic company stat reader rather than an issue-specific vote formula.","objdump + caller inspection + RT3.lng strings + stat-family correlation + governance-string correlation + derived-report-metric correlation"
0x0042c690,311,placed_structure_rebuild_candidate_cargo_service_bitsets,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Rebuilds two per-cargo bitsets on one placed-structure or site record using the live structure-candidate collection at `0x0062ba8c`. The helper clears the bitsets rooted at `[this+0x0d8]` and `[this+0x0df]`, walks the linked placed-structure chain starting at `[this+0x0d6]` through `0x0062b26c`, selects only linked instances whose backing candidate resolves through vtable `+0x80` with category byte `2`, and then scans the live candidate collection for entries that pass `structure_candidate_is_enabled_for_current_year` at `0x0041e220`. For each passing candidate it queries the direct and scaled supply-side cargo channels through the wrappers at `0x00412960` and `0x004129a0`; positive direct supply sets bits in `[this+0x0df]`, while positive scaled supply on candidates with runtime cargo state at `[candidate+0x78c]` sets bits in `[this+0x0d8]`. The cargo-id sweep is tighter now too: the inner loop starts at cargo id `1` and runs upward through the current live cargo count, so this steady-state bitset owner never intentionally queries cargo id `0`. Current grounded callers sit immediately above the sibling helper at `0x0042cdf0`, which makes this the strongest current steady-state consumer of the rebuilt editor cargo runtime tables rather than a pure setup path.","objdump + caller xrefs + callsite inspection + cargo-summary correlation + cargo-id-loop correlation"
0x0042c8f0,112,placed_structure_refresh_linked_candidate_flag4,map,thiscall,inferred,objdump + caller xrefs + linked-instance inspection,3,"Refreshes bit `0x4` in the placed-structure state byte at `[this+0x0e6]` from the currently linked placed-instance chain rooted at `[this+0x0d6]`. The helper walks linked instances through `0x0062b26c`, keeps only entries whose backing instance passes `0x0040c990 == 1`, resolves each surviving instance through vtable slot `+0x80`, and sets the local flag when any resolved candidate record has nonzero byte `[candidate+0xba]`; otherwise it clears that bit. Current grounded callers are the immediate wrapper `0x0042cdf0` plus the relink helpers at `0x0042c9a0` and `0x0042c9f0`, so this looks like the sibling state refresh that runs beside the cargo-service bitset rebuild even though the exact player-facing meaning of `[candidate+0xba]` is still open.","objdump + caller xrefs + linked-instance inspection + candidate-flag correlation"
0x0042cab0,117,placed_structure_accumulate_candidate_metric_or_emit_route_style_peer_link,map,thiscall,inferred,objdump + caller inspection + route-style remap inspection,3,"Small candidate-side projection helper used by the broader route-style rebuild lane. The helper starts by querying one integer local metric through `0x0042c960` for the caller-supplied candidate index, then resolves the matching structure-candidate record through `0x0062ba8c` and re-enters `0x0041e1f0` to stage one floating contribution. It next reads the candidate's route-style remap slot at `0x0062ba8c+0x9a`: when that slot is negative it adds the contribution directly into the local route-style grid lane at `[this+candidate*4+0x103]`; when the slot is nonnegative it instead re-enters `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0` with the remapped class id and the same floating contribution. Current grounded caller is the larger per-site route-style rebuild pass at `0x004101e0`, which makes this the clearest current branch where ordinary candidate metrics stay local but remapped route-style candidates become peer-link emission requests.","objdump + caller inspection + route-style remap inspection + peer-link emission correlation"
0x0042cb30,124,placed_structure_clamp_candidate_service_age_table,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Late clamp pass over the primary per-candidate word table rooted at `[this+0x00]`. When the site owns a nonzero route latch at `[this+0x0d4]` and `0x0042c880` signals the pass should run, the helper walks every live non-remapped candidate, queries one route-linked age or freshness value through `0x0042c110`, shifts that result into the local word-table scale, and replaces `[this+candidate*2]` with the smaller of the current value and the new clamp. Current grounded callers are the local bundle wrapper `0x0042d580` and the later world-grid sweep at `0x00450133`, so this now looks like the final recent-service clamp on the local candidate age table rather than another raw scoring helper.","objdump + caller xrefs + callsite inspection + route-age correlation"
0x0042cbb0,145,placed_structure_route_supports_candidate_local_service_mode,map,thiscall,inferred,objdump + caller xrefs + route-record inspection,3,"Boolean route-linked predicate for one candidate-local service branch. The helper walks the route or service record chain owned by the current site through `[this+0x0d4]` and collection `0x006cec20`, reads one candidate-indexed float lane at `[route+0x3e]`, and compares the route-side threshold at `[route+0x112]` against the current local word-table value for that candidate after scaling through `0x00437d20`. It returns `1` on the first matching route record and `0` otherwise. Current grounded caller is `placed_structure_rebuild_candidate_local_service_tables` at `0x0042ce00`, where this predicate selects one of the route-backed scoring transforms.","objdump + caller xrefs + route-record inspection + candidate-table correlation"
0x0042cc50,402,placed_structure_apply_route_linked_service_caps,map,thiscall,inferred,objdump + caller xrefs + route-record inspection,3,"Route-linked cap pass over the aligned local service tables. The helper walks the route or service record chain rooted at `[this+0x0d4]` through `0x006cec20`, then for each live non-remapped candidate that passes `structure_candidate_is_enabled_for_current_year` it compares the route-side candidate float at `[route+0x42]` against the current site float table at `[this+0x107]` and the current primary word-table value at `[this+0x00]`. When the route-linked ratio stays inside the live clamp window it writes a lower capped value back into the primary word table. Current grounded caller is the composite local refresh `0x0042d580`, so this now looks like the first route-backed cap pass that shapes the rebuilt local service tables before the later neighborhood redistribution and recent-service clamp run.","objdump + caller xrefs + route-record inspection + local-table correlation"
0x0042cdf0,16,placed_structure_refresh_candidate_service_state,map,thiscall,inferred,objdump + caller xrefs + wrapper inspection,4,"Tiny composite refresh for one placed-structure or site record. The helper first rebuilds the candidate cargo-service bitsets through `placed_structure_rebuild_candidate_cargo_service_bitsets` at `0x0042c690`, then tail-calls `placed_structure_refresh_linked_candidate_flag4` at `0x0042c8f0` to refresh the sibling state bit at `[this+0x0e6]`. Current grounded callers include the world-grid sweep at `0x00450003`, so this now looks like the common steady-state placed-structure service-state refresh immediately above the editor-driven cargo runtime tables.","objdump + caller xrefs + wrapper inspection"
0x0042ce00,1394,placed_structure_rebuild_candidate_local_service_tables,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Large per-site rebuild over the live candidate collection at `0x0062ba8c`. The helper walks every candidate with live runtime state at `[collection+0x16e]` and no remap entry at `[collection+0x9a]`, decays positive floats in the aligned per-candidate table rooted at `[this+0x107]`, and commits those float updates back through `0x0041e1b0`. It then combines that float table with two aligned per-candidate word tables rooted at `[this+0x02]` and `[this+0x6c]`, the direct-supply cargo bitset at `[this+0x0df]`, the site-side latch at `[this+0x0d4]`, and the branch predicate `0x0042cbb0` to choose among several normalized scoring transforms before writing the quantized result back into the destination word table. Current grounded callers now put this directly under the local wrapper at `0x0042d580`, so this looks like the first real site-side candidate service-score rebuild above the editor-driven cargo runtime lane rather than another candidate-only helper.","objdump + caller xrefs + callsite inspection + table-layout correlation"
0x0042d580,26,placed_structure_refresh_local_service_score_bundle,map,thiscall,inferred,objdump + caller xrefs + wrapper inspection,4,"Composite local-service refresh for one placed-structure or site record. The helper first runs `placed_structure_rebuild_candidate_local_service_tables` at `0x0042ce00`, then immediately chains into the neighboring local post-passes at `0x0042cc50`, `0x0042c1b0`, and `0x0042cb30` before returning. Current grounded caller is the world-grid sweep at `0x00450110`, which uses this as the stronger per-site local-service refresh after the lighter cargo-service-state pass at `0x00450003`.","objdump + caller xrefs + wrapper inspection"
0x00428a10,22,company_clear_selected_chairman_if_current_profile,simulation,thiscall,inferred,objdump + caller inspection,4,"Clears the linked chairman for the current company when the supplied profile id matches `[this+0x3b]`. On a match the helper zeroes the incoming profile id and tail-calls `0x00427c70`; otherwise it returns without changing company state. Current grounded shell caller is `shell_company_detail_resign_chairmanship_flow`, which uses this as the commit step behind the localized resignation confirmation.","objdump + caller inspection + chairman-link correlation"
0x00425320,607,company_compute_credit_rating_score,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,4,"Computes the bounded company credit-rating score reused by the debt-side shell and several adjacent company-policy gates. The helper returns a fixed floor when the company-active flag at `[this+0x3f]` is clear; otherwise it starts from a weighted four-year net-profits-minus-fuel ladder over slots `0x2b` and `0x09`, blends in the current debt total from stat-family `0x2329/0x12`, folds in the weighted average bond interest rate through `company_compute_weighted_average_bond_interest_rate` `0x00423e40`, conditionally adds the prime-rate baseline and raw issue-39 total through `company_compute_prime_rate_from_issue39_scenario_baseline` `0x00424580`, then derives several debt- or liquidity-side ratios from derived stat slots `0x30` and `0x31` before applying company-age smoothing. The tail then adds the raw issue-38 total through `scenario_state_sum_issue_opinion_terms_raw` `0x00436710`, rounds the result, and uses that bounded score both for the CompanyDetail credit row and for bond-offer gating. Current grounded callers are the city-connection news owner `0x00406050`, the bond-interest quote wrapper `0x00427540`, the bond-side boolean gate `0x00427590`, the generic derived-metric reader at `0x0042a2e0` for the credit-rating-style slot, the CompanyDetail debt-credit-rate summary panel `0x004c23a0`, and the CompanyDetail bond-issue flow `0x004c3890`. The surrounding text anchors are explicit: shell localized id `952` is `Credit Rating:`, and localized id `974` says new bonds require a strong enough credit rating. This is therefore the safest current read for the debt-market or creditworthiness score, distinct from the issue-39 prime-rate lane and from the broader issue-37 equity-support lane.","objdump + caller xrefs + callsite inspection + RT3.lng strings + credit-rating correlation + bond-dialog correlation + prime-rate contrast + issue-38 correlation"
0x00424fd0,751,company_compute_public_support_adjusted_share_price_scalar,simulation,thiscall,inferred,objdump + caller inspection,3,"Computes one bounded investor-support and share-price scalar used by stock-capital policy, cached share-price readouts, and adjacent governance or control-transfer vote lanes. The helper starts from `company_compute_cached_recent_per_share_performance_subscore` at `0x004248d0`. If the older company-side support field `[this+0x57]` is still at least as strong as that fresh score and the company is within five years of founding year `[this+0x157]`, it interpolates the two through a capped startup-progress term derived from the current world calendar counter `[0x006cec78+0x15]`, the company stamp `[this+0x0d07]`, and the founding year, with the progress side capped at `50`; otherwise it keeps the fresh per-share score directly. The first caller argument is then normalized by current outstanding shares `[this+0x47]` and clamped into the narrow pressure band `[-0.2, 0.2]`. When the caller supplies nonzero control arguments, that pressure term can also refresh the mutable support field `[this+0x4f]` by blending the prior field with the staged delta. The later share-price body is tighter now too: it derives a share-count growth term from outstanding shares through the power helper `0x005a1b60` on `(shares / 20000)^0.33`, scales that by `1.4`, folds it back against current shares, and then runs a piecewise compression or clamp ladder over the resulting support scalar at thresholds `0.6`, `0.45`, `0.3`, `1.7`, `2.5`, `4.0`, and `6.0`. After that it multiplies by the scenario issue-opinion multiplier from `scenario_state_compute_issue_opinion_multiplier` `0x00436590` using issue id `0x37`, rounds through `0x005a10d0`, floors the rounded result at `0.0001`, and optionally snapshots it into the cached share-price field `[this+0x0d7b]` when the second control argument is nonzero. Current grounded callers include the cached share-price accessor `0x00423eb0`, the stock buyback and stock issue mutators `0x004273c0` and `0x00427450`, the bankruptcy recompute path `0x00425a90`, the merger vote resolver at `0x004ebd10`, the company-side takeover and policy family, and the annual creditor-pressure or shareholder-policy lane that surfaces localized ids `300..304`. The surrounding finance split is now tighter too: `company_compute_credit_rating_score` `0x00425320` feeds the explicit `Credit Rating` shell rows and bond-offer rejection flow, while `company_compute_prime_rate_from_issue39_scenario_baseline` `0x00424580` feeds the explicit `Prime Rate` row and cash interest helpers. That leaves issue `0x37` as the broader equity-market or investor-confidence lane behind company or chairman performance. The strongest direct text anchors are still localized ids `300/301` `Shareholders revolt against poor management`, `1217` `Investors are somewhat pleased with the chairman's performance.`, and `3048/3049` `Investors are %1 your performance./the chairman's performance.`. A deeper follow-up now rules out three tempting label shortcuts: the nearby `0x460a90..0x460c53` and `0x473620..0x47366a` registration families are camera-view and related shell-command bindings, not finance issue owners; the editor-side `Stock Prices` label belongs to the separate float-tuning block `[state+0x0bde..0x0bf6]`, not the issue table behind `0x37`; and the extracted `CompanyDetail.win` shell resource from `rt3_2WIN.PK4` does not expose any separate plain-English investor or finance caption for this lane, which matches the owner-side read that section-0 is a dynamic text widget (`0x947f`) fed by `shell_format_company_governance_and_economy_status_panel` `0x004e5cf0` rather than a fixed label row.","objdump + caller inspection + support-field correlation + issue-id correlation + governance-string correlation + stock-buyback correlation + stock-issue correlation + share-price-cache correlation + per-share-performance correlation + pressure-band correlation + startup-interpolation correlation + power-helper correlation + credit-vs-prime-rate correlation + negative-label-owner correlation + shell-resource extraction negative-result"
0x00424580,82,company_compute_prime_rate_from_issue39_scenario_baseline,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Small company-side rate helper that produces the current prime-rate-style baseline from scenario state plus issue `0x39`. It first reads one normalized scenario baseline through `0x00433740` on active scenario state `0x006cec78`, then adds the scaled raw issue-39 total from `scenario_state_sum_issue_opinion_terms_raw` at `0x00436710` using the current company id `[this+0x00]`, linked chairman id `[this+0x3b]`, and no territory argument. Current grounded callers now bound the player-facing meaning more tightly: the bond-interest quote wrapper at `0x00427540`, the negative and positive cash interest helpers at `0x00425880` and `0x004258c0`, and the CompanyDetail capital summary row labeled `954` `Prime Rate:` at `0x004c23a0`. This now reads as the shared prime-rate or market-rate helper rather than a generic company-support scalar.","objdump + caller xrefs + callsite inspection + issue-39 correlation + prime-rate correlation + bond-quote correlation"
0x004246b0,544,company_compute_five_year_weighted_shareholder_return,simulation,thiscall,inferred,objdump + caller inspection + RT3.lng strings,3,"Computes the stock-data lane surfaced as `5 Year Weighted Return`. Inactive companies fall back to the fixed scalar at `0x005c8598`; otherwise the helper walks up to five recent years above founding year `[this+0x157]`, samples yearly `Share Price` from slot `0x1c`, measures year-over-year price appreciation against the prior sample, blends that with the paired historical shareholder-payout lane from slot `0x23`, and weights recent years more heavily through the same scenario-side year weighting byte at `[0x006cec78+0x0f]`. Current evidence now bounds that paired lane more tightly: slot `0x23` falls back to direct company field `[this+0x53]` on the current-company path and is only consumed here, so the strongest current read is the historical dividend-per-share or shareholder-payout component paired with yearly price appreciation. The tail normalizes the accumulated weighted return by the accumulated weights and returns one bounded annualized-style float. Current grounded caller is `company_read_control_transfer_metric_slot` at `0x0042a2e0` for slot `0x21`, which matches the stock-data label `942` `5 Year Weighted Return:` and tooltip `936`.","objdump + caller inspection + RT3.lng strings + stock-data-label correlation + weighted-return correlation + shareholder-payout-lane correlation"
0x00425880,64,company_compute_negative_cash_balance_interest_rate,shell,thiscall,inferred,objdump + LoadScreen report correlation + localized string correlation,4,"Small company-side rate helper used only by the shared `LoadScreen.win` report-history renderer at `0x004e9b20`. The helper reads one control-transfer or yearly metric through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` using family `0x2329` and slot `0x22`, combines that with the prime-rate helper `company_compute_prime_rate_from_issue39_scenario_baseline` at `0x00424580`, normalizes the result through two fixed constants, and returns one bounded float formatted as the first `%1` insert in localized strings `2815` and `2816`. Current grounded meaning is the company's negative-cash borrowing interest rate, i.e. the rate the company currently pays on negative cash balances in the Income Statement and Balance Sheet help rows.","objdump + LoadScreen report correlation + localized string correlation + helper call inspection + prime-rate correlation"
0x004258c0,396,company_compute_positive_cash_balance_interest_rate,shell,thiscall,inferred,objdump + LoadScreen report correlation + localized string correlation,4,"Company-side rate helper paired with `company_compute_negative_cash_balance_interest_rate` beneath the shared `LoadScreen.win` report-history renderer at `0x004e9b20`. The helper starts from the same prime-rate helper at `0x00424580`, subtracts one baseline constant, then reads the company cash metric through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` using family `0x2329` and slot `0x0d`. It applies a piecewise threshold ladder over that cash or liquidity lane, clamps the result into several fixed bands, and returns the second `%2` insert for localized strings `2815` and `2816`. Current grounded meaning is the company's positive-cash deposit interest rate, i.e. the rate the company currently earns on positive cash balances in the Income Statement and Balance Sheet help rows.","objdump + LoadScreen report correlation + localized string correlation + helper call inspection + piecewise-threshold correlation + prime-rate correlation"
0x00429c70,976,company_read_derived_financial_report_metric_slot,simulation,thiscall,inferred,objdump + caller inspection + shell-label correlation,3,"Reads one derived company metric from the higher report-style slot family rooted at `0x2b`. The jump-table body now has one safe finance-side core: slot `0x2c` sums raw slots `0x01..0x04` into the broader revenue aggregate, slot `0x2d` combines the neighboring expense-side derived lanes, and slot `0x2b` then combines `0x2c` and `0x2d` into the net-profits-style lane reused by shell labels `1212` `Profits`, `925` `Profits:`, and the annual finance policy. The same helper also owns several later derived ratios and aggregates, including one asset-side pair around `0x30/0x31` and the per-unit revenue lanes that divide the revenue aggregate `0x2c` by count or distance slots such as `0x24`, `0x16`, and `0x17`. Current grounded callers arrive indirectly through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0`, so this is the shared derived financial-report metric reader beneath CompanyDetail, LoadScreen, and annual finance rather than a shell-only formatter helper.","objdump + caller inspection + shell-label correlation + derived-metric correlation + income-statement correlation"
0x00429990,86,company_collection_get_nth_active_company_id,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns the company id of one requested active-company ordinal within the live company collection rooted at `0x0062be10`. The helper linearly walks collection slots through `0x00518380`, tests the active company-state flag at `[entry+0x3f]`, decrements the caller-supplied ordinal only for active entries, and returns the first company id whose active ordinal matches zero. Current grounded callers use it as the forward mapping between active-company page indices and concrete company ids in shell-side roster, detail, and picker flows.","objdump + caller inspection + active-company roster correlation"
0x004299f0,84,company_collection_count_active_companies_before_company_id,simulation,thiscall,inferred,objdump + caller inspection,4,"Counts how many active companies precede one requested company id in the live company collection at `0x0062be10`. The helper linearly walks collection slots through `0x00518380`, stops when the entry id matches the requested company id, and increments the return counter only for active entries whose state flag at `[entry+0x3f]` is nonzero. Current grounded callers use this as the inverse mapping for shell-side company paging and company-relative selector paths before converting back through `company_collection_get_nth_active_company_id` at `0x00429990`.","objdump + caller inspection + active-company roster correlation"
0x00429a50,62,company_collection_count_active_companies,simulation,thiscall,inferred,objdump + caller inspection,4,"Counts active companies in the live company collection rooted at `0x0062be10`. The helper walks collection slots through `0x00518380`, resolves each record through `0x00518140`, and increments the total only when the active-state flag at `[entry+0x3f]` is nonzero. Current grounded callers use this as the active-company roster size for shell-side company browsing and neighboring selector math.","objdump + caller inspection + active-company roster correlation"
0x00430270,225,world_try_place_random_structure_batch_from_compact_record,map,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Shared world-side retry loop that tries to place multiple structures from one compact spawn record. The caller supplies one small record whose fields now read most safely as a structure or profile token at `+0x00`, requested placement count at `+0x11`, center coordinates at `+0x12/+0x14`, and placement radius or extent at `+0x16`. The helper translates the token through the static table at `0x0061039c` into the live structure-profile collection `0x0062b268`, increments the region-manager reentrancy counter at `[0x0062bae0+0x88]`, and then runs up to `200` randomized attempts while placements remain. Each attempt samples a candidate coordinate inside the requested radius, rejects points outside the live world bounds at `[0x0062c120+0x2155/+0x2159]`, resolves the owning region through `0x0044a800` and `0x0062bae0`, adapts the candidate through `0x00412880`, and finally re-enters `world_region_validate_and_commit_candidate_placement` `0x00422a70`. Successful placements decrement the remaining batch count and reset the local retry counter. Current grounded caller is the world-side dispatch branch at `0x00431b43`, where only compact record classes in the `0x1f7..0x265` table range enter this batch placer. This is therefore the strongest current read for the world-side randomized structure-batch placement loop rather than a region-worker-private helper.","objdump + local disassembly + caller correlation + placement-batch correlation"
0x00430b50,624,scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets,scenario,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Builds one runtime-effect record in the live scenario event collection from a compact source record plus the caller's currently resolved targets. The helper first allocates a new runtime-effect entry through `scenario_event_collection_allocate_runtime_effect_record_from_compact_payload` `0x00432ea0`, then seeds several per-record control bytes and target selectors in the new object, including mode byte `[record+0x7ef]`, optional gating bytes `[record+0x7f4/+0x7f9/+0x7fa]`, a primary selector at `[record+0x7f0]`, and optional comparison ids at `[record+0x82c/+0x830]`. Current grounded callers are the compact runtime-effect dispatcher `0x00431b20`, where fallback branches synthesize follow-on runtime effects from one compact linked record, and the shell-side branch at `0x004d60fd`, where the same builder is reached with a caller-owned output slot. This is therefore the current safest read for the runtime-effect follow-on record builder rather than a generic collection insert wrapper.","objdump + local disassembly + caller correlation + runtime-effect-builder correlation"
0x00431b20,399,world_apply_compact_runtime_effect_record_to_resolved_targets,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Dispatches one linked compact runtime-effect record against the caller-resolved target context. The record token at `[*record+0x00]` is translated through the static table at `0x0061039c`; when the translated class lies in the `0x1f7..0x265` range the helper immediately re-enters `world_try_place_random_structure_batch_from_compact_record` `0x00430270`. Otherwise it jumps through the local class table at `0x004320b4/0x004320fc` into a mixed effect family that now includes: shell-state modifier branches over `0x006cec78`, signed scalar adjustments on resolved company/profile/territory targets through the `0x004d6611/0x004d6617` numeric readers, territory-access writes through `company_set_territory_access_rights_byte` `0x00424030`, selected-profile updates through `0x00434890/0x004348c0`, and several collection-side erase or follow-on branches. Current grounded caller is the outer loop at `0x00432317`, which walks linked compact records via `[record+0x24]` and supplies optional resolved company, chairman-profile, and adjacent owner context before each dispatch. This is therefore the current safest read for the wider compact runtime-effect dispatcher above the separate world-side structure-batch placement branch rather than as a placement-only helper.","objdump + local disassembly + caller correlation + effect-dispatch correlation"
0x004323a0,842,scenario_runtime_effect_record_service_and_dispatch_linked_compact_effects,scenario,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Per-record service pass over one live runtime-effect record in the scenario event collection. The helper first enforces several activation gates over the record's local control bytes and shell-side preview state, including one one-shot latch at `[this+0x81f]`, mode byte `[this+0x7ef]`, optional preview-policy byte `[this+0x7f4]`, and shell-side state at `0x006cec78/0x006cec74`. Once active it formats the optional status line through shell news helper `0x004554e0`, derives a target-availability bitmask through `0x0042d700`, resolves optional company/chairman/territory target pools, and then walks the linked compact effect chain rooted at `[this+0x00]`. Each linked record is dispatched through `world_apply_compact_runtime_effect_record_to_resolved_targets` `0x00431b20`, while fallback branches synthesize follow-on runtime-effect records through `scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets` `0x00430b50`. When any effect fires it may refresh company share-price caches through `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`, and records with nonzero `[this+0x7f5]` set the one-shot latch `[this+0x81f]`. Current grounded caller is the collection-wide service loop `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40`. This is therefore the current safest read for the runtime-effect record service and linked-effect dispatcher rather than a low-level target iterator.","objdump + local disassembly + caller correlation + runtime-effect-service correlation"
0x00433130,169,scenario_event_collection_refresh_runtime_records_from_packed_state,scenario,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Collection-wide runtime materialization pass over the live event collection at `0x0062be18`. The helper stages one small packed header read from the caller-supplied state or stream object, walks every live event record in the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and re-enters `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20` on each resolved record. When the sweep completes it clears the collection-side reentrancy or dirty latch at `[this+0x88]`. Current grounded callers are the `Setting up Players and Companies...` `319` lane inside `world_entry_transition_and_runtime_bringup` `0x00443a50` and one neighboring world-build path at `0x00448020`, so this now reads as the event-side runtime refresh pass beneath post-load world setup rather than an anonymous collection walk.","objdump + caller xrefs + local disassembly + event-collection correlation + post-load-pipeline correlation"
0x004336d0,95,world_runtime_reset_startup_dispatch_state_bands,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small runtime-object zero-init helper immediately above `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890`. The helper clears a bounded startup-owned state band on the caller object, including `[+0x4cae]`, `[+0x4cb2]`, `[+0x46a80..+0x46aa0]`, `[+0x66b2]`, `[+0x66b6]`, `[+0x46c34]`, and `[+0x66ae]`, then returns the same pointer. Current grounded callers are the mode-`4` `LoadScreen.win` lane inside `shell_transition_mode` at `0x004830b6` and the multiplayer preview launch lane at `0x0046b8c9`, both of which then publish the returned object into `0x006cec78` and immediately call `0x00438890`. This is therefore the safest current read for the pre-dispatch runtime reset helper rather than another world-release path.","objdump + caller xrefs + local disassembly + pre-dispatch-state correlation"
0x00432ea0,103,scenario_event_collection_allocate_runtime_effect_record_from_compact_payload,scenario,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Allocates and initializes one live runtime-effect record in the scenario event collection at `0x0062be18` from a compact payload source. The helper allocates one temporary `0x88f` payload object, inserts a new collection entry through the generic collection allocator path, resolves the inserted live entry, and then initializes that entry from the caller-supplied compact payload through `0x0042d670` before freeing the temporary object. Current grounded callers are `scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets` `0x00430b50` and the shell-side branch at `0x004db9f1`, where the returned live entry id is stored back into the caller object. This is therefore the current safest read for the scenario event collection's runtime-effect allocator rather than a generic collection clone helper.","objdump + local disassembly + caller correlation + runtime-effect-allocation correlation"
0x00432f40,267,scenario_event_collection_service_runtime_effect_records_for_trigger_kind,scenario,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide service loop over the live scenario event collection at `0x0062be18` for one caller-selected trigger kind byte. The helper first rejects fast-forward and editor-map gates through `0x006cec78+0x46c38`, `[0x006cec7c+0x82]`, and `[0x006cec74+0x68]` unless the trigger kind is `9`, then walks every live runtime-effect record through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. Each resolved record is serviced through `scenario_runtime_effect_record_service_and_dispatch_linked_compact_effects` `0x004323a0` with the selected trigger kind and optional text sink. When any record fires, the helper refreshes every active company's cached share price through `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`; when the collection dirty latch at `[this+0x88]` is raised it clears that latch and immediately reruns the whole pass with trigger kind `0x0a`. The caller split is now tighter too: recurring simulation maintenance drives kinds `1`, `0`, `3`, and `2` through `0x0040a276`, `0x0040a55f`, `0x0040a6cb`, and `0x0040a7a3`, while the neighboring route-style follow-on at `0x0040a91f` drives kinds `5` and `4` through `0x0040a930` and `0x0040a9ac`; world or startup-side company creation branches at `0x00407682`, `0x0047d293`, `0x0047d42b`, and `0x0047d6de` drive kind `7`; the kind-`6` branch is now tighter too, covering the placed-structure post-create tail at `0x0040f69e`, the build-version-gated company-startup or roster-refresh tail at `0x00428406`, and the route-entry post-change sweep at `0x004a3eae`; the kind-`8` world-entry one-shot gate now sits inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, where it fires after the post-load company or route setup passes and then clears shell-profile latch `[0x006cec7c+0x97]`; and the `LoadScreen.win` briefing page at `0x004e520b` drives kind `9`. This is therefore the current safest read for the scenario event collection's collection-wide runtime-effect service loop rather than a generic text-query helper.","objdump + local disassembly + caller correlation + collection-service correlation + trigger-kind callsite decode"
0x00433bd0,546,world_refresh_selected_year_bucket_scalar_band,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shared selected-year companion beneath `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`. The helper reads the packed world year at `[this+0x0d]`, bins it against the threshold table at `0x005f3978/0x005f3980`, derives one interpolated bucket fraction when the current year falls inside a nontrivial range, and writes the resulting float band into `[this+0x65]`, `[this+0x69]`, `[this+0x6d]`, and `[this+0x4ca2]` after one build-version-sensitive clamp through `0x00482e00`. Current grounded callers are the year-step path in `simulation_service_periodic_boundary_work` around `0x0040a123`, the post-fast-forward setup tail around `0x00437168`, and the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared year-bucket scalar rebuild helper rather than a world-entry-only follow-on.","objdump + local disassembly + caller inspection + year-bucket-table correlation + world-entry correlation"
0x00434050,11,shell_has_auxiliary_preview_owner,shell,cdecl,inferred,objdump + caller inspection + side-owner correlation,4,"Tiny presence probe over the auxiliary preview or side owner rooted at `0x006cd8d8`. The helper returns `1` when that owner pointer is nonnull and `0` otherwise. Current grounded callers include the `.gmt` save-side branch in `shell_map_file_world_bundle_coordinator` `0x00445de0`, the shell-state frame service pass `0x00482160`, the `BuildingDetail.win` subject-sync and tutorial gate lane around `0x004b9e10` and `0x004bb9e0`, and adjacent train-side branches that round route scalars or finalize auxiliary route buffers only when this side owner is live.","objdump + caller inspection + side-owner correlation + caller xrefs"
0x00434080,80,scenario_state_query_cached_available_locomotive_rating_clamped_for_shell,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small read-side helper over cached scenario-state float `[this+0x4cbe]`. The helper returns that cached available-locomotive rating in `st(0)` when it stays under the local threshold, and otherwise falls back to one fixed shell-side float constant before returning. Current grounded caller is the shell-side formatter band around `0x004b11c5`, where this cached value is optionally rounded to an integer and then compared against display thresholds `40/50/70/85/100`. This is therefore the safest current read for the query-side companion of the later locomotive-rating refresh rather than a broader world-state getter.","objdump + caller inspection + local disassembly + shell-threshold correlation + display-bucket correlation"
0x00434300,881,world_runtime_release_global_services,map,cdecl,inferred,objdump + analysis-context,3,Releases or clears a broad set of world-runtime global services owned by the current map object before a new world entry or sibling save branch continues. The helper walks the owner collection at [this+0x66b2] and then touches many global manager slots including 0x0062b244 0x0062cfcbc 0x0062be10 0x0062c120 0x0062ba8c 0x0062ba88 0x0062b2fc 0x0062b268 0x006cea4c and 0x006acd34 through repeated release-style calls and nulling writes. Current grounded callers are the heavier world-entry branch at 0x00443a50 the sibling .smp world-state branch at 0x00446d40 and shell_transition_mode at 0x00482ec0.,objdump + analysis-context + caller xrefs
0x00434d40,100,placed_structure_collection_seed_candidate_subtype2_runtime_latch,map,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Shared post-setup sweep over the live placed-structure collection at `0x0062b26c`. The helper walks every live placed structure through the indexed-collection accessors, resolves each linked candidate or structure descriptor through vtable slot `+0x80`, and when the resolved record's subtype byte `[candidate+0x32]` equals `2` it writes `1` to runtime dword `[candidate+0x7b0]`. Local field evidence is now tight enough to keep the name structural: the same dword is zeroed during candidate runtime materialization around `0x00412112`, read as a one-shot guard in the world-side placement branch around `0x00423c43`, and also written there after the guarded follow-on fires. Current grounded callers are the post-fast-forward setup tail at `0x00437bf9` and the late `0x197` checkpoint inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared subtype-`2` candidate-runtime latch seeder rather than a one-off world-entry patch.","objdump + local disassembly + caller correlation + candidate-runtime-latch correlation"
0x004354a0,355,world_publish_shell_controller_progress_scalar_from_year_thresholds_or_selector_overrides,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Shared shell-facing scalar publisher beneath selected-year changes, shell-state selector updates, and the late world-entry reactivation band. The helper always resolves the current shell presentation object through controller `0x006d4024 -> [controller+0x18]` and writes one clamped `0..255` integer into `[object+0x15]` through `0x00523d60`. Its source split is now bounded enough to name conservatively: when tutorial flag `0x006d3b4c` is live it forces `0`; otherwise it first honors the temporary shell-state selector pair `[0x006cec74+0x1df/+0x1e3]`, then the persisted selector pair `[0x006cec74+0x23b/+0x23f]` when sandbox bit `[0x006cec7c+0x82]` is set, and only when no selector override is active does it derive one interpolated scalar from the current year `[this+0x15]` against the ensured threshold band `[this+0x51/+0x55/+0x59/+0x5d/+0x61]` plus the base value at `[this+0x3a]`, re-entering `scenario_state_ensure_derived_year_threshold_band` `0x00435603` before the year-band path needs it. Current grounded callers are the simulation year-advance path at `0x0040ab39`, the shell-state setter at `0x00482878`, the startup-side branch at `0x005173d3`, and the late `0x197` checkpoint inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared shell-controller progress-scalar publisher rather than a world-entry-only helper.","objdump + local disassembly + caller correlation + shell-controller correlation + year-threshold-band correlation"
0x00434ea0,124,scenario_state_query_named_candidate_availability_record_value,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Read-side lookup over the scenario-side named candidate-availability collection at `[this+0x66b2]`. The helper normalizes the first byte of the caller-supplied candidate name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches full names through `0x005a57cf` after a first-byte fast reject on `[entry+0x00]`. When a matching record is found it returns the dword at `[entry+0x1e]`; otherwise it returns zero. The insert sibling `0x00434f20` shows the exact record shape now too: each collection entry is a zero-initialized `0x22`-byte blob with a fixed zero-terminated name slot at `[entry+0x00..+0x1d]` and one trailing availability dword at `[entry+0x1e]`. Current grounded callers are the runtime refresh pass `0x00412c10`, the editor-side detail and summary formatters at `0x004cc209`, `0x004cdfa3`, `0x004d14b8`, and `0x004d1684`, and the same startup-side candidate filter family that later writes `[candidate+0x7ac]`. This is therefore the current safest read for the candidate-side lookup sibling of the named availability helpers rather than a generic string-table query.","objdump + caller xrefs + local disassembly + scenario-state collection correlation + candidate-filter refresh correlation + record-layout correlation"
0x00434f20,272,scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Upserts one named candidate-availability record into the scenario-side collection at `[this+0x66b2]` and then refreshes dependent runtime candidate filters. The helper normalizes the first byte of the caller-supplied name buffer, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches candidate names through the shared string compare at `0x005a57cf` after the same first-byte fast reject on `[entry+0x00]`. When a matching record already exists it rewrites the candidate-availability dword at `[entry+0x1e]`; otherwise it allocates a new collection entry through the collection vtable, zero-initializes one fixed `0x22`-byte record, copies the supplied zero-terminated candidate name into `[entry+0x00..+0x1d]`, and seeds that same trailing dword. When the live candidate pool `0x0062b268` exists it then re-enters the neighboring runtime refresh at `0x00412c10`, where the returned value is stored into `[candidate+0x7ac]`. The write-side caller set is now tight enough to close the remaining semantic gap too: the grounded startup prepasses at `0x00437743` and `0x00436ad7` and the editor-side `Industry (Overall)` handler `0x004cf430` all supply only boolean values, so `[entry+0x1e]` now reads safely as a real candidate-availability override bit rather than a wider mode enum.","objdump + caller xrefs + local disassembly + scenario-state collection correlation + candidate-filter refresh correlation + record-layout correlation + callsite-argument correlation"
0x00435030,124,scenario_state_query_named_locomotive_availability_record_value,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Read-side lookup over the scenario-side named locomotive-availability collection at `[this+0x66b6]`. The helper normalizes the first byte of the caller-supplied locomotive name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches full names through `0x005a57cf` after a first-byte fast reject on `[entry+0x00]`. When a matching record is found it returns the dword at `[entry+0x3d]`; otherwise it returns zero. The insert sibling `0x004350b0` shows the exact record shape now too: each collection entry is a zero-initialized `0x41`-byte blob with a fixed zero-terminated locomotive-name slot at `[entry+0x00..+0x3c]` and one trailing availability dword at `[entry+0x3d]`. Current grounded callers are the shell-side `Locomotives` availability page constructor `map_editor_locomotive_availability_panel_construct` `0x004cd680`, the locomotive-side stats and summary branches at `0x004d0e5f` and `0x00461ed5`, and the neighboring startup or restore-side upsert family at `0x00438d6b` and `0x004478ea`. This is therefore the safest current read for the locomotive-side lookup sibling of the named availability helpers rather than a generic string-table query.","objdump + caller xrefs + local disassembly + scenario-state collection correlation + locomotive-availability correlation + record-layout correlation"
0x004350b0,249,scenario_state_upsert_named_locomotive_availability_record_and_refresh_runtime_usage,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Upserts one named locomotive-availability record into the scenario-side collection at `[this+0x66b6]` and then refreshes dependent runtime locomotive usage state. The helper normalizes the first byte of the caller-supplied locomotive name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches existing names through `0x005a57cf` after the same first-byte fast reject on `[entry+0x00]`. When a matching record already exists it rewrites the locomotive-availability dword at `[entry+0x3d]`; otherwise it allocates a new collection entry through the collection vtable, zero-initializes one fixed `0x41`-byte record, copies the supplied zero-terminated locomotive name into `[entry+0x00..+0x3c]`, and seeds that same trailing dword. When the live locomotive pool `0x006ada84` exists it then re-enters `0x00461e00`, where the queried value is later stored into `[loco+0x7b]`. The write-side caller set is now tight enough to close the remaining semantic gap here too: the grounded startup or restore-side seeding lanes at `0x00438d6b`, `0x004478ea`, and `0x00461eab` and the shell-side `Locomotives` availability handler family at `0x004cf178`, `0x004cf1fe`, `0x004cf2f9`, and `0x004cf3fc` all supply only boolean values, so `[entry+0x3d]` now reads safely as a real locomotive-availability override bit rather than a broader policy enum.","objdump + caller xrefs + local disassembly + scenario-state collection correlation + locomotive-runtime-refresh correlation + record-layout correlation + callsite-argument correlation"
0x00436af0,384,scenario_state_refresh_cached_available_locomotive_rating,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shared scenario-side refresh over cached float `[this+0x4cbe]` after selected-year or locomotive-availability changes. The helper seeds one year-dependent baseline from the current scenario year at `[0x006cec78+0x0d]`, then, when the live locomotive pool `0x006ada84` exists, walks every live locomotive record, filters them through the locomotive-era policy gate `0x0041d550` plus the named-availability lane rooted at `[loco+0x7b]`, and keeps the strongest surviving locomotive-side rating scalar from `[loco+0x20]`. It then normalizes and clamps that winning value into `[this+0x4cbe]`, where the shell-side read helper later buckets it against display thresholds `40/50/70/85/100`. Current grounded callers are the periodic year-step path around `0x0040a317`, the post-fast-forward setup tail at `0x004371ad`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and the tail of `locomotive_collection_refresh_runtime_availability_overrides_and_usage_state` `0x00461e00`, so this is the safest current read for the cached available-locomotive rating refresh rather than a world-entry-only helper.","objdump + local disassembly + caller inspection + locomotive-availability correlation + selected-year correlation + cached-scalar correlation + display-bucket correlation"
0x0043cb00,295,world_view_step_heading_quadrant,shell,thiscall,inferred,objdump + caller xrefs,3,Applies one discrete heading-step command to the live world-view owner at 0x0062be68. The helper quantizes the current heading-like field [this+0x10] into one of four wrapped sectors derives the neighboring sector selected by the signed caller step and writes the resulting snapped heading back before rebuilding the dependent view state through 0x0043a750 0x0052d640 and 0x0043bde0. Current grounded callers are the paired shell UI command branches at 0x004de83d and 0x004de857 so this looks like the discrete rotate-view command family rather than free camera drag.,objdump + caller xrefs + callsite inspection
0x0043cc30,437,world_view_step_zoom_bucket,shell,thiscall,inferred,objdump + caller xrefs,3,Applies one discrete zoom or view-height bucket step to the live world-view owner at 0x0062be68. It derives a seven-entry threshold table under 0x005ee4dc and 0x0062be4c compares the current view-height field [this+0x18] against those thresholds chooses the neighboring bucket selected by the signed caller step clamps the result into the supported range and then rebuilds the dependent view state through 0x0043c610 0x00439820 and 0x0043bde0. Current grounded callers are the signed shell UI command pair at 0x004de871 and 0x004de88b and the keyboard-owned smoothing branch inside world_view_service_shell_input_pan_and_hover at 0x0043dca4.,objdump + caller xrefs + callsite inspection
0x0043d050,111,world_view_set_focus_position_xyz,shell,thiscall,inferred,objdump + caller xrefs,4,Stores one new world-view focus position into the owner at 0x0062be68 by updating [this+0x04] [this+0x08] and [this+0x0c] as the requested X Y and Z coordinates then rebuilding the dependent view state through 0x0043cec0 0x0043a750 0x0052d640 0x00439820 and 0x0043b0e0. The helper also clamps the view-height or distance field at [this+0x18] before recomputing the derived pitch-like field at [this+0x14]. Current grounded callers are the screen-delta wrapper at 0x0043d0c0 the relative pan helper at 0x0043d130 and two larger world-view service branches at 0x0043ee76 and 0x0043f32d.,objdump + caller xrefs
0x0043af60,205,world_view_should_drive_primary_pan_channel,shell,thiscall,inferred,objdump,3,Returns whether the world-view owner should drive its primary pan channel on this pass. The predicate first honors the latched override at [this+0xa2] then checks several shell-view gates through 0x00543e00 0x00543e20 and 0x00543e40 on the active controller node plus one optional guard under 0x006d1a8c and the world-mode flag at [0x006cec74+0x120]. When the controller view is active it also treats packed shell input bits 0x3 in 0x006d4018+0xa8c as one enabling condition; `shell_input_apply_window_key_transition` grounds those bits as the left and right Shift modifiers from scan codes 0x2a and 0x36 which ties held Shift state back into the same world-view pan family. Current grounded callers sit in the larger recurring world-view input service at 0x0043db00 and the smaller motion helper at 0x0043e610.,objdump + callsite inspection
0x0043b030,173,world_view_should_drive_secondary_pan_channel,shell,thiscall,inferred,objdump,3,Returns whether the world-view owner should drive its secondary pan channel on this pass. Like the neighboring primary predicate it combines shell controller view gates through 0x00543e00 0x00543e20 and 0x00543e40 optional suppression under 0x006d1a8c and one world-mode check at [0x006cec74+0x120]; when the active controller view is present it also treats packed shell input bits 0x3 in 0x006d4018+0xa8c as an enabling condition. Those bits are now grounded as the left and right Shift modifiers from scan codes 0x2a and 0x36 rather than an opaque gameplay-only flag source. Current grounded callers sit in the larger recurring world-view input service at 0x0043db00 and in the smaller motion helpers at 0x0043e610 and 0x0043f4f0.,objdump + callsite inspection
0x0043b2c0,133,world_view_store_camera_view_slot_snapshot,shell,thiscall,inferred,objdump + caller inspection + world-view correlation,4,"Stores one live camera-view snapshot into a fixed slot family rooted inside the world-view owner at `0x0062be68`. The helper expands the caller slot selector into one `0x30`-byte record, sets slot-valid dword `[slot+0x10e]`, copies the current scenario-side focus-kind pair from `[0x006cec78+0x45/+0x49]` into `[slot+0x112/+0x116]`, and then mirrors the live world-view focus and camera fields `[view+0x04/+0x08/+0x0c/+0x18/+0x10/+0x14/+0x1c/+0x20/+0x24]` into `[slot+0x11a..+0x13a]`. Current grounded caller is the shell-side assignment owner `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`, which uses this helper for the ten-slot `Assign Camera View` family. This is therefore the safest current read for the fixed camera-view snapshot writer rather than a generic view-state copier.","objdump + caller inspection + world-view correlation + slot-layout correlation"
0x0043ca20,223,world_view_restore_camera_view_slot_snapshot_if_populated,shell,thiscall,inferred,objdump + caller inspection + world-view correlation,4,"Restores one previously saved camera-view snapshot from the fixed slot family inside the live world-view owner at `0x0062be68`. The helper expands the caller slot selector into the same `0x30`-byte record used by `world_view_store_camera_view_slot_snapshot` `0x0043b2c0`, rejects immediately when slot-valid dword `[slot+0x10e]` is zero, re-enters `0x004349f0` to clear or normalize scenario-side focus state, restores the saved focus and camera fields back into `[view+0x04/+0x08/+0x0c/+0x18/+0x10/+0x14/+0x1c/+0x20/+0x24]`, clamps the restored heading through `0x005a1390`, optionally replays the saved focus-kind pair `[slot+0x112/+0x116]` through `shell_world_focus_selected_subject_kind_and_id` `0x00437a90`, and finally rebuilds the dependent view state through `0x0043db00` and `0x0043bde0` before returning `1`. Empty slots return `0` without side effects. Current grounded caller is the shell-side selection owner `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`, which uses this helper for the ten-slot `Select Camera View` family. This is therefore the safest current read for the fixed camera-view snapshot restore helper rather than a generic world-view reset.","objdump + caller inspection + world-view correlation + slot-layout correlation + focus-replay correlation"
0x0043d0c0,111,world_view_apply_screen_delta_to_focus_position,shell,thiscall,inferred,objdump + caller xrefs,4,Converts one screen-relative drag delta into a new world-view focus position and forwards it through world_view_set_focus_position_xyz. When the auxiliary object at [this+0x6e] is live it samples a derived center or height term through 0x00534490 and scales both incoming deltas by the world-view projection constant at 0x005c8700 before calling the lower focus-position setter. The current grounded caller is the cursor-drag helper at 0x00478d31 inside the larger input loop at 0x00478cb0.,objdump + caller xrefs
0x0043d130,292,world_view_pan_relative_offset_in_camera_plane,shell,thiscall,inferred,objdump + caller xrefs,4,Applies one local X/Z pan offset to the world-view owner at 0x0062be68 in the current camera plane and forwards the result through world_view_set_focus_position_xyz. The helper derives a scale from the active view-height field [this+0x18] rotates the incoming offset by the current heading-like field [this+0x10] through sine and cosine calls at 0x005a13e4 and 0x005a1494 adds the rotated result onto the current world focus position in [this+0x04] and [this+0x0c] preserves the current Y term in [this+0x08] and then calls the lower focus-position setter. Current grounded callers are the GameUppermost hotspot path at 0x004e094b and the keyboard-owned service branch inside world_view_service_keyboard_turn_and_pan_bindings at 0x0043dae4 which together indicate a shared world-view pan action rather than a separate gameplay command dispatcher.,objdump + caller xrefs
0x0043d740,937,world_view_service_keyboard_turn_pan_and_zoom_bindings,shell,thiscall,inferred,objdump + callsite inspection,4,"Keyboard-driven world-view interaction helper beneath world_view_service_shell_input_pan_and_hover. It samples elapsed wall-clock time through 0x0051d890 against the previous timestamp at 0x0062be74 clamps the per-pass delta into the 0x08 through 0xc8 range and polls four configurable binding-pair families through the shell input table at 0x006d4018 via 0x0054e7d0. The first two pair families at [this+0x0a6] through [this+0x0b2] and [this+0x0b6] through [this+0x0c2] now ground as the default `Camera Forward` or `Camera Backward` pair and `Camera Left` or `Camera Right` pair. The third family at [this+0x0c6] through [this+0x0d2] produces a signed zoom-step or view-height delta that is returned through the caller-owned out-parameter for later smoothing and grounds as the default `Camera Zoom In` or `Camera Zoom Out` pair, while the fourth family at [this+0x0d6] through [this+0x0e2] applies continuous heading turns through 0x0043c810 and grounds as the default `Camera Rotate Left` or `Camera Rotate Right` pair. When the pan families are active the helper reaches world_view_pan_relative_offset_in_camera_plane at 0x0043d130 after checking the active world-view state. Current grounded caller is world_view_service_shell_input_pan_and_hover at 0x0043db00.",objdump + callsite inspection + caller xrefs + registration xrefs + RT3.lng
0x0045ea90,365,shell_input_binding_format_display_label_from_registry_entry,shell,cdecl,inferred,objdump + local disassembly + registry correlation,4,"Formats one user-facing binding label directly from a live registry entry. The helper clears the destination buffer, rejects entries whose primary binding code `[entry+0x0c]` is `0xff`, prepends up to three localized prefix fragments from ids `0xdef`, `0xdf0`, and `0xdf1` according to bits `0x4`, `0x2`, and `0x1` in mode field `[entry+0x94]`, then scans the static binding-descriptor table rooted at `0x005f0a34` for the current action id `[entry+0x0c]`. When the descriptor-side localized caption id at `[row+0x04]` exists and `0x0051c900` accepts it, the helper appends that localized caption through `0x005193f0`; otherwise it appends the fallback literal stem at `[row+0x08]`. Current grounded caller is `shell_input_binding_registry_format_display_label_by_action_stem` `0x0045f3d0`, which uses this helper beneath the camera-view modal family and the hotkey report path. This is therefore the safest current read for the lower binding-label formatter rather than a generic string helper.","objdump + local disassembly + registry correlation + descriptor-table correlation + localized-prefix correlation"
0x0045ec00,108,shell_input_binding_split_plus_prefixed_label_into_primary_and_modifier_fragments,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Splits one compound binding label into a primary token plus one optional modifier fragment. The helper copies the caller source string into the primary destination unchanged when the string either begins with `+`, does not contain the localized token from id `0xdf2`, or contains no later `+` delimiter. Otherwise it trims the source at the first `+`, copies the suffix after that delimiter into the primary destination, and copies the preserved prefix fragment into the secondary destination buffer. Current grounded caller is the hotkey import worker `0x0045f420`, where it prepares one imported binding label for action lookup and modifier parsing before the rebucket helper `0x0045ef00`. This is therefore the safest current read for the localized plus-split helper rather than a generic string tokenizer.","objdump + caller inspection + local disassembly + hotkey-import correlation"
0x0045ec70,88,shell_input_binding_descriptor_query_action_id_by_localized_label,shell,cdecl,inferred,objdump + local disassembly + descriptor-table correlation,4,"Resolves one action id from the binding-descriptor table rooted at `0x005f0a34` by matching a user-facing label. The helper rejects empty input with `0xff`, then walks the descriptor rows and compares the caller text against either the localized caption at `[row+0x04]` when `0x0051c900` accepts that id or the fallback literal stem at `[row+0x08]` otherwise. On success it returns the descriptor action id at `[row+0x00]`; failure returns `-1`. Current grounded caller is the hotkey import worker `0x0045f420`, which uses this helper after `shell_input_binding_split_plus_prefixed_label_into_primary_and_modifier_fragments` `0x0045ec00` to recover the target action id for one imported binding row.","objdump + local disassembly + descriptor-table correlation + localized-caption correlation + hotkey-import correlation"
0x0045e940,216,placed_structure_build_attached_emitter_variant_list_by_owner_stem,map,cdecl,inferred,objdump + local disassembly + literal inspection + caller inspection,2,"Builds a repeated attached-emitter list for one owner stem on top of the global emitter table. The helper rejects literal `Stadium` immediately, clears caller flag bit `0x10` when the owner stem matches `ParticleCar`, then iterates `effect_emitter_table_select_next_existing_formatted_3dp_variant` `0x00474860` first with reset mode `1` and then resume mode `0`. For each accepted formatted variant it creates one attached sprite emitter through `effect_slot_create_attached_sprite_emitter` `0x00474e20`, optionally ORs flag `0x10000` when startup latch `[0x006cec78+0x46c3c]` is live, ORs emitter flag `0x02` for literal `Nuclear`, appends the created emitter into the caller output array when that array is present, and terminates the list with a trailing null when at least one output slot was available. Current grounded callers are the heavier placed-structure transient builders around `0x0045b828` and `0x0045e23e`, so this is best read as the owner-stem-driven attached-emitter variant-list builder rather than a one-off specialization stub.","objdump + local disassembly + literal inspection + caller inspection + formatted-variant correlation + transient-family correlation"
0x0045ea20,61,shell_emit_indexed_audio_feedback_nudge_if_live,shell,cdecl,inferred,objdump + caller correlation + local disassembly,4,"Small indexed audio-feedback helper used by shell command paths and tutorial guidance. When selector `ECX` is in the bounded range `2..0x40` and the two audio override gates at `0x00ccba14` and the service-side `0x00531e10` checks remain clear, the helper looks up one pair of table-driven dwords from `0x005f0828/0x005f082c`, forwards them together with the caller scalar and three zero trailing arguments into the shell audio service at `0x006d402c` through `0x00531e10`, and otherwise returns without side effects. Current grounded callers include the pause-toggle shell command `0x00440880` with selector `0x2c` and the tutorial-step advance path `0x00516be0`, which makes this the reusable indexed feedback-nudge owner rather than a one-off pause-only stub.","objdump + caller correlation + local disassembly + audio-service correlation"
0x0045ecd0,155,shell_input_binding_parse_modifier_fragment_to_compact_mode_code,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Parses one binding-label modifier fragment into a small compact mode code. The helper normalizes the caller text through `0x005a2abe`, probes it for one localized header token from `0xdf3` and the follow-on localized fragments `0xdf4` and `0xdf5`, and then returns one of four compact codes: default `1` when the header token is absent, `4` when only the middle fragment is absent, `2` when the trailing fragment is absent, and `0` for the fully matched final branch. Current grounded caller is the hotkey import worker `0x0045f420`, which uses this compact code immediately before `shell_input_binding_expand_compact_mode_code_to_registry_mask` `0x0045ed70` and the rebucket helper `0x0045ef00`. This is therefore the safest current read for the localized modifier-fragment parser rather than a stronger semantic mode-name decoder.","objdump + local disassembly + caller inspection + hotkey-import correlation"
0x0045ed70,26,shell_input_binding_expand_compact_mode_code_to_registry_mask,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Tiny compact-mode projector for the input-binding family. The helper expands the caller compact code in `ECX` into the registry-facing mode mask over bits `0x1`, `0x2`, and `0x4` using the low two bits plus one high nibble bit, then returns that mask in `EAX`. Current grounded caller is the hotkey import path at `0x00500205`, where it immediately feeds the result into `shell_input_binding_registry_rebucket_entry_by_stem_to_action_id_and_mode_mask` `0x0045ef00`.","objdump + local disassembly + caller inspection + hotkey-import correlation"
0x0045ed90,69,shell_input_binding_descriptor_query_bucket_key_for_action_id_when_mode_mask_is_singular,shell,cdecl,inferred,objdump + local disassembly + descriptor-table correlation,4,"Descriptor-side bucket-key query for the shell input-binding registry. The helper scans the static descriptor table rooted at `0x005f0a34` for the caller action id in `ECX`, counts the number of set bits in the caller mode mask in `EDX`, and only when that bit count is `0` or `1` returns the descriptor-side bucket key at `[row-0x04]` / `[row+0x30]`; multi-bit masks return `0`. Current grounded callers are `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`, the hotkey message path at `0x005001e1`, and the rebucket helper `0x0045ef00`, which all use this helper as the singular-mode bucket discriminator above the live registry buckets. This is therefore the safest current read for the descriptor-side bucket-key query rather than a generic action-table scan.","objdump + local disassembly + descriptor-table correlation + mode-mask correlation + bucket-key correlation"
0x0045f370,95,shell_input_binding_registry_lookup_primary_code_and_mode_bits_by_action_id,shell,cdecl,inferred,objdump + caller inspection + registry correlation,4,"Lookup helper over the shell input-binding registry rooted at `0x006acd78..0x006ad960`. The helper scans each linked per-bucket list for a record whose action id at `[entry+0xa0]` matches the caller key in `ECX`; on success it writes the entry's primary binding code `[entry+0x0c]` through the first out-parameter and packs three mode bits from `[entry+0x94]` into a small output mask through the second out-parameter before returning `1`. Failure returns `0`. Current grounded caller is `world_view_seed_keyboard_binding_slot_pairs` `0x00439e40`, where this helper resolves the default `Camera Forward/Backward/Left/Right/Zoom/Rotate` action ids before the resulting codes are normalized into the world-view slot-pair band. This is therefore the safest current read for the action-binding query helper rather than a generic shell hash-table scan.","objdump + caller inspection + registry correlation + output-mask correlation"
0x0045ede0,88,shell_input_binding_registry_resolve_entry_by_action_stem,shell,cdecl,inferred,objdump + local disassembly + registry correlation,4,"Resolves one shell input-binding registry entry by stem text. The helper copies the caller string into a local `0x80`-byte buffer, normalizes it through `0x0053d810`, hashes or canonicalizes that normalized stem, and then scans the linked registry buckets rooted at `0x006acd78..0x006ad960` for an entry whose cached normalized token at `[entry+0x90]` matches the derived value. On success it returns the live registry entry pointer; otherwise it returns null. Current grounded callers are `shell_input_binding_registry_format_display_label_by_action_stem` `0x0045f3d0` and `shell_input_binding_registry_query_primary_code_by_action_stem` `0x0045f400`, which use this helper as the shared action-stem lookup beneath the camera-view modal family. This is therefore the safest current read for the stem-to-binding-entry resolver rather than a generic string hash helper.","objdump + local disassembly + registry correlation + normalized-stem correlation"
0x0045ef00,568,shell_input_binding_registry_rebucket_entry_by_stem_to_action_id_and_mode_mask,shell,cdecl,inferred,objdump + local disassembly + caller inspection + registry correlation,4,"Rehomes one existing binding entry into a different action bucket and mode-mask family while preserving its current binding data. The helper first resolves the target descriptor bucket through `shell_input_binding_descriptor_query_bucket_key_for_action_id_when_mode_mask_is_singular` `0x0045ed90` unless the requested action id is `0xff`, then resolves the source live entry by stem through `shell_input_binding_registry_resolve_entry_by_action_stem` `0x0045ede0`, allocates one fresh record from the pool owner at `0x006acd6c`, copies the source entry payload into that fresh record, overwrites the new action id `[entry+0x0c]` and mode mask `[entry+0x94]`, unlinks the old record from its current per-bucket list, optionally moves the old record into the detached `0xff` side list rooted at `0x006ad96c..0x006ad974`, and finally links the new record into the requested target bucket at `0x006acd78..0x006ad960`. Failure at either the descriptor-bucket or source-entry step returns `0`; success returns `1`. Current grounded caller is the hotkey message path at `0x0050020f`, where this helper commits one imported or reassigned binding row after the local label split and modifier decode. This is therefore the safest current read for the binding-entry rebucket helper rather than a generic pool copier.","objdump + local disassembly + caller inspection + registry correlation + pool-allocation correlation + detached-list correlation"
0x0045f250,278,shell_input_binding_report_iterate_next_entry_in_sorted_priority_order,shell,cdecl,inferred,objdump + caller inspection + local disassembly + registry correlation,4,"Iterates the next live binding entry in one temporary sorted report order. On first use when sentinel `0x005f0fe0 == 1`, the helper allocates a small queue owner at `0x006acd74`, initializes it through `0x0053d740`, walks every live registry bucket at `0x006acd78..0x006ad960`, and pushes each entry into that queue with priority `0x7ffffffe - [entry+0x9c]`. Each call then pops one entry through `0x0053d540`; when one record is available it formats the user-facing label into scratch `0x006ad980` through `shell_input_binding_format_display_label_from_registry_entry` `0x0045ea90`, copies the action stem from `[entry+0x10]` into `0x006ada00`, mirrors the binding code and companion field into `0x006ad978` and `0x006ad97c`, and returns `0x006ad978`. When the queue is exhausted it destroys the temporary owner, resets `0x006acd74` to null, restores sentinel `0x005f0fe0` to `1`, and returns `0`. Current grounded callers are the hotkey-report writer `0x0045f550` and the hotkeys-window refresh path at `0x004fed16/0x004fedb2`, which makes this the current sorted binding-report iterator rather than a generic priority-queue wrapper.","objdump + caller inspection + local disassembly + registry correlation + temporary-queue correlation + report-scratch correlation"
0x0045f3d0,33,shell_input_binding_registry_format_display_label_by_action_stem,shell,cdecl,inferred,objdump + caller inspection + registry correlation,3,"Small display-label helper above `shell_input_binding_registry_resolve_entry_by_action_stem` `0x0045ede0`. The helper resolves the caller action stem into one registry entry, then forwards the destination buffer plus that entry into `0x0045ea90` to format the user-facing label string. Success returns `1`; unresolved stems return `0`. Current grounded callers are the camera-view command owners `0x004408f0` and `0x004409c0`, where it formats the optional current focus labels embedded in the assignment and unassigned-view modals.","objdump + caller inspection + registry correlation + modal-text correlation"
0x0045f400,18,shell_input_binding_registry_query_primary_code_by_action_stem,shell,cdecl,inferred,objdump + local disassembly + registry correlation,3,"Tiny primary-code accessor above `shell_input_binding_registry_resolve_entry_by_action_stem` `0x0045ede0`. The helper resolves the caller action stem into one registry entry and, on success, returns that entry's primary binding code from `[entry+0x0c]`; unresolved stems return `0`. Current local evidence only grounds the raw field access, not a stronger player-facing meaning beyond the shared binding-registry lane.","objdump + local disassembly + registry correlation + field-access correlation"
0x0045f420,296,shell_input_import_hotkeys_file_and_rebucket_registry_entries_from_compound_labels,shell,thiscall,inferred,objdump + local disassembly + caller correlation + import-file correlation,4,"Imports one saved hotkeys file and rehomes matching live binding entries into the requested action or mode buckets. The helper first loads one parsed text resource through the small loader pair `0x00557320 -> 0x00557630`, retrying with the secondary `(0x28,0x29)` selector pair when the primary `(0x21,0x7e)` load fails. On the success path it walks the resulting nested record lists at `[root] -> [group+0x108] -> [entry+0x104]`, splits each imported `foo+bar` label through `shell_input_binding_split_plus_prefixed_label_into_primary_and_modifier_fragments` `0x0045ec00`, normalizes both fragments through `0x00557280/0x005572e0`, resolves the target action id from the descriptor table through `shell_input_binding_descriptor_query_action_id_by_localized_label` `0x0045ec70`, decodes the modifier fragment through `shell_input_binding_parse_modifier_fragment_to_compact_mode_code` `0x0045ecd0`, and finally commits the rebucket through `shell_input_binding_registry_rebucket_entry_by_stem_to_action_id_and_mode_mask` `0x0045ef00` using the preserved stem at `[entry+0x04]`. A fully successful import returns `1`; early parse or load failures return the loader status unchanged. Current grounded caller is the registry constructor `0x00461120`, which tail-jumps here with the fixed path `hotkeys\\hotkeys.txt` when the caller requests saved-hotkey import. This is therefore the safest current read for the hotkeys-file import worker rather than a generic text-resource walker.","objdump + local disassembly + caller correlation + import-file correlation + nested-record-walk correlation + rebucket correlation"
0x0045f550,382,shell_input_write_hotkeys_report_file,shell,cdecl,inferred,objdump + caller inspection + local disassembly + literal correlation,4,"Writes the current hotkey report to the fixed output path `hotkeys\\hotkeys.txt`. The helper opens that file through mode string `wt`, writes the fixed report header `!Hotkeys~\\n`, appends the localized heading strip from ids `0xdf6` through `0xdfc`, then iterates the current binding set through `shell_input_binding_report_iterate_next_entry_in_sorted_priority_order` `0x0045f250`. For each returned record it copies the action stem at `[entry+0x08]` into a local `0x20`-byte padded column, falls back to the localized empty-label string `0x0b3e` when the stem is empty, and formats each output line through the fixed template `%s = %s\\n`; rows whose leading dword is zero instead use the alternate template `%s = %s\\n` with the shifted value pointer at `[entry+0x08]`. Current grounded callers are the shell command path at `0x00461082` and the hotkeys-window message path at `0x00500153/0x0050021d`, which makes this the current shared hotkey-report writer rather than a generic file dump helper.","objdump + caller inspection + local disassembly + literal correlation + report-iterator correlation + hotkeys-path correlation"
0x0045f6d0,334,shell_input_register_action_binding_with_mode_specific_defaults,shell,cdecl,inferred,objdump + caller inspection + registry correlation,4,"Shared registration helper over the shell input-binding registry rooted at `0x006acd78..0x006ad960`. The helper first selects one mode-specific `(binding_code, companion_value)` pair from the caller's four fallback pairs according to shell mode dword `0x006d3c84`; when the selected binding code is not `0xff`, it re-enters `0x0045ed90` to resolve or create the target registry bucket, optionally updates an existing entry for the same companion discriminator `[entry+0x94]` through `0x0045f8a0`, or allocates and links a fresh entry from the pool owner at `0x006acd6c` and the monotonic id source `0x006acd68`. The new or updated record stores the action id, mode flags, callback pointer, localized label string, and the selected default pair before it is linked back into the per-action bucket family. Current grounded callers include the camera-view command registration block at `0x00460903..0x00460cac` and the world-view keyboard registration block at `0x00460720..0x004608e7`, which makes this the current shared action-binding registration helper rather than a camera-specific leaf.","objdump + caller inspection + registry correlation + allocation-pool correlation + mode-specific-default correlation"
0x0045f8a0,315,shell_input_binding_registry_replace_existing_entry_by_action_bucket_and_mode_mask,shell,cdecl,inferred,objdump + local disassembly + caller inspection + registry correlation,4,"Updates one existing binding entry for a specific action bucket plus mode-mask discriminator. The helper first scans the requested live bucket at `0x006acd78..0x006ad960` for an entry whose stored mode mask `[entry+0x94]` matches the caller value in `EDX`; when found it copies the full record to a local stack frame, unlinks and releases the live record from both its bucket and the pool owner at `0x006acd6c`, then re-enters `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0` with the preserved callback pointer, localized label pointer, default-pair payload, and the copied companion values while forcing the binding-code selector to `0xff`. Current grounded caller is the registration helper `0x0045f6d0`, which uses this path when a same-bucket same-mode entry already exists for the target action. This is therefore the safest current read for the existing-entry replacement helper rather than a generic free-and-realloc wrapper.","objdump + local disassembly + caller inspection + registry correlation + preserved-payload correlation"
0x0045f9e0,598,shell_input_seed_default_binding_registry_entries_from_static_table,shell,cdecl,inferred,objdump + local disassembly + static-table inspection,4,"Seeds the shell input-binding registry from the static default table rooted at `0x005ecadc`. The helper walks `0x71` eight-byte rows, localizes each row label id at `+0x04`, decodes the packed row policy word at `+0x06` into the mode-specific default tuple expected by `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`, and installs each resulting binding into the live registry. After the fixed table pass it appends a smaller manual post-table strip for adjacent shell commands such as the wrappers at `0x00441a00`, `0x00441940`, `0x00441980`, `0x00482b00`, `0x004408b0`, `0x00441ac0`, `0x004408d0`, and `0x00441af0`, using localized ids `0x0d4a` through the neighboring `0x0d53` band. Current grounded caller is the registry initializer `0x00461120`, which runs this helper after rebuilding the pool and queue roots. This is therefore the safest current read for the default binding seeder rather than a generic command-registration batch.","objdump + local disassembly + static-table inspection + post-table registration-strip correlation"
0x00460fe0,52,shell_input_register_localized_binding_command_id_0xdb5_to_action_0x6b,shell,cdecl,inferred,objdump + local disassembly + installer correlation,2,"Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db5`, then installs one default binding row with action id `0x6b`, callback `0x00441cb0`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits immediately beside the paired `0x0db6` half-step registration. The exact user-facing command name is still open, so the current annotation stays at the concrete localized-id plus action-id level.","objdump + local disassembly + installer correlation + registration-strip correlation"
0x00461000,52,shell_input_register_localized_binding_command_id_0xdb6_to_action_0x6d,shell,cdecl,inferred,objdump + local disassembly + installer correlation,2,"Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db6`, then installs one default binding row with action id `0x6d`, callback `0x00441d20`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits beside the other fixed shell input command registrations. The exact user-facing command name is still open, so the current annotation stays at the concrete localized-id plus action-id level.","objdump + local disassembly + installer correlation + registration-strip correlation"
0x00461040,40,shell_input_register_localized_binding_command_id_0xdb7_to_action_0x6a,shell,cdecl,inferred,objdump + local disassembly + installer correlation,2,"Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db7`, then installs one default binding row with action id `0x6a`, callback `0x004413e0`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits beside the other fixed shell input command registrations. The exact user-facing command name is still open, so the current annotation stays at the concrete localized-id plus action-id level.","objdump + local disassembly + installer correlation + registration-strip correlation"
0x00461070,170,shell_input_binding_registry_destroy_all_roots_and_reset_globals,shell,cdecl,inferred,objdump + local disassembly + global-field correlation,4,"Destroys the live shell input-binding registry and clears all of its global roots. The helper first re-enters `shell_input_write_hotkeys_report_file` `0x0045f550` when the main pool owner at `0x006acd6c` is present, then releases the main pool owner `0x006acd6c`, the companion owner at `0x006acd70`, zeroes every bucket head/tail/count triple across `0x006acd78..0x006ad974`, and finally releases the temporary report queue owner at `0x006acd74` if it is still live. Current grounded caller is the setup helper `0x00461120`, which uses this as the hard reset before rebuilding the registry state. This is therefore the safest current read for the binding-registry teardown and global reset owner rather than a one-off file export command.","objdump + local disassembly + global-field correlation + teardown correlation + hotkey-report correlation"
0x00461120,171,shell_input_binding_registry_initialize_roots_seed_defaults_and_optionally_import_hotkeys_file,shell,thiscall,inferred,objdump + local disassembly + caller correlation,4,"Constructs the live shell input-binding registry, seeds the default action set, and optionally imports the saved hotkeys file. The helper first hard-resets the old registry through `shell_input_binding_registry_destroy_all_roots_and_reset_globals` `0x00461070`, zeros the monotonic id source `0x006acd68`, allocates and clears the primary pool owner at `0x006acd6c`, allocates the two companion owners at `0x006acd70` and `0x006acd74`, seeds the default bindings through `shell_input_seed_default_binding_registry_entries_from_static_table` `0x0045f9e0`, and when the caller flag in `ECX` equals `1` immediately tail-jumps into the hotkey import worker `0x0045f420` using the fixed path literal `hotkeys\\hotkeys.txt`. This is therefore the safest current read for the binding-registry constructor and optional hotkey-import owner rather than a generic allocator batch.","objdump + local disassembly + caller correlation + pool-allocation correlation + default-seed correlation + hotkey-import correlation"
0x00439e40,557,world_view_seed_keyboard_binding_slot_pairs,shell,thiscall,inferred,objdump + callsite inspection,4,"Initializes the eight world-view keyboard binding slot pairs rooted at [this+0x0a6] through [this+0x0e2]. The helper zeroes the paired 4-byte fields then queries the global action-binding registry through 0x0045f370 using eight distinct stub roots at 0x0043d2a0 through 0x0043d310. The registration block at 0x00460769 through 0x004608e7 plus `Data/Language/RT3.lng` show those eight roots are seeded as four labeled directional pairs: `Camera Forward` id 0x0d8a on Up, `Camera Backward` id 0x0d8b on Down, `Camera Left` id 0x0d8c on Left, `Camera Right` id 0x0d8d on Right, `Camera Zoom In` id 0x0d8e on Up, `Camera Zoom Out` id 0x0d8f on Down, `Camera Rotate Left` id 0x0d90 on Left, and `Camera Rotate Right` id 0x0d91 on Right. The first bank feeds the pan pairs later consumed at [this+0x0a6] through [this+0x0c2], while the second bank feeds the zoom-step and heading-turn pairs later consumed at [this+0x0c6] through [this+0x0e2]. After the registry lookups the helper normalizes several legacy companion values across all eight pairs by remapping 0x2 to 0x10 0x20 to 0x12 and 0x4 to 0x11 before storing the results back. This now looks like the live world-view setup path above world_view_service_keyboard_turn_pan_and_zoom_bindings at 0x0043d740 rather than a separate config-side binding store.",objdump + callsite inspection + callee inspection + registration xrefs + RT3.lng
0x0043db00,1968,world_view_service_shell_input_pan_and_hover,shell,thiscall,inferred,objdump + callsite inspection,4,Recurring world-view service that fuses shell input state into the live world-view owner at 0x0062be68. It begins by delegating keyboard-bound turn pan and zoom work to world_view_service_keyboard_turn_pan_and_zoom_bindings at 0x0043d740 then samples controller and view state through 0x00543c50 and 0x00543ba0 caches successive shell input coordinates from 0x006d4018 offsets 0xa94 and 0xa98 derives smoothed cursor or hover deltas against [this+0x2f6] [this+0x2fa] and [this+0x2fe] updates one world-under-cursor cache through 0x00448ac0 and 0x00448bd0 and refreshes the GameUppermost overlay through 0x004e0730 when the pan state changes. The helper repeatedly consults world_view_should_drive_primary_pan_channel at 0x0043af60 and world_view_should_drive_secondary_pan_channel at 0x0043b030 drives one of the lower motion branches at 0x0043e610 0x0043f4f0 or 0x0043e2c0 and smooths the keyboard zoom-step channel through the shared accumulator at 0x0062be78 before issuing discrete view-height bucket steps through world_view_step_zoom_bucket at 0x0043cc30. Current grounded callers include the recurring world-frame path at 0x00439730 and two setup or transition loops at 0x00516859 and 0x00516921. This now looks like the shared shell-input coordinator above keyboard turn pan zoom cursor drag and hotspot world-view motion rather than a mouse-only helper.,objdump + callsite inspection + caller xrefs
0x00420030,578,city_connection_bonus_exists_matching_peer_site,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Reusable placed-structure scan beneath the city-connection bonus note family. The helper walks the live placed-structure collection at `0x006cec20`, first requiring each candidate peer to match one site-class token from the caller's local six-byte class table through `0x0042b2d0`, then applying four bounded caller-controlled filters before returning success on the first matching peer. Current filter roles are tighter now: the first stack flag enables the station-or-transit site-type gate through `0x0047fd50`; the second stack flag enables the linked-instance class-byte test through `0x0047de00 -> 0x0040c990 == 1`; the third stack flag enables the deeper route or peer-reachability sweep through `0x0047f310` and `0x0048e3c0`; and the fourth stack dword is an optional owning-company id that is matched through `placed_structure_query_linked_company_id` at `0x0047efe0`. Current grounded callers include the adjacent city bonus or status formatter around `0x004207d0`, where the helper's boolean combinations choose localized ids `3868` through `3873`, plus wider world-side sweeps at `0x00404d66`, `0x004221ea`, `0x00422264`, `0x00435930`, and `0x00435944`. This now looks like the common city-connection peer probe rather than a generic anonymous scan.","objdump + caller xrefs + callsite inspection + city-bonus note correlation + filter-role decoding"
0x00420280,204,city_connection_bonus_select_first_matching_peer_site,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Companion selector beside `city_connection_bonus_exists_matching_peer_site`. The helper walks the live placed-structure collection at `0x006cec20`, requires each candidate peer to match one site-class token from the caller's six-byte class table through `0x0042b2d0`, and then applies two caller-controlled filters before returning the first matching placed-structure id from the collection instead of a boolean. The first stack flag enables the same station-or-transit site-type gate through `0x0047fd50`; the second stack flag enables the stricter linked-instance class-byte requirement through `0x0047de00 -> 0x0040c990 == 1`; when either flag is zero the corresponding predicate becomes permissive. Current grounded callers are the city bonus or status formatter at `0x004207d0`, which uses the selected peer to recover linked-company context after the boolean note checks, and the earlier world-side branch at `0x004046f5`, which passes both flags as `1` before sampling the selected peer's derived coordinates through `0x0047df30` and `0x0047df50`. This now reads as the first-match peer selector paired with the broader existence probe rather than as a second generic scan.","objdump + caller xrefs + callsite inspection + filter-role decoding + peer-selector correlation"
0x004207d0,1053,city_site_format_connection_bonus_status_label,map,thiscall,inferred,objdump + caller inspection + RT3.lng strings,4,"Adjacent city-site label formatter above the city-connection peer helpers at `0x00420030` and `0x00420280`. When the preview-global `0x0062be84` is armed or the city-side subtype field `[this+0x23e]` is nonzero the function falls back into the neighboring virtual-style formatter at `0x00455860`; otherwise it builds one visible text block from the base city label at `[this+0x356]`, optionally appends the numeric value in `[this+0x276]`, and can append localized id `207` `(Connected)` when the active linked world object and city class checks succeed. If `[this+0x276]` is nonzero it then chooses one of the city-connection bonus note strings `3868` through `3873` by calling `city_connection_bonus_exists_matching_peer_site` at `0x00420030` with three meaningful filter combinations: a deeper peer-reachability pass, an active-company-only pass using `scenario_state_get_selected_chairman_company_record` at `0x004337a0`, and a broader any-company pass. After those boolean note checks it also re-enters `city_connection_bonus_select_first_matching_peer_site` at `0x00420280` to recover one representative matching peer site, resolves that peer's linked company through `placed_structure_query_linked_company_id` at `0x0047efe0`, and uses the selected company record when formatting the follow-on company-oriented text lane. That current grounded split is enough to tie `3869` `Connected By Another Station`, `3870` `Already Connected`, `3871` `Connected By Another Company`, `3872` `Already Connected by Another Company`, and `3873` `Not Connected` to this formatter boundary rather than to the station-detail overlay body. The helper also writes one caller-owned color field and label-priority scalar before returning style code `3`, so it currently reads as a world-label or hover-summary formatter for city connection-bonus state rather than a generic text helper.","objdump + caller inspection + RT3.lng strings + city-bonus note correlation + filter-combination decoding + peer-selector correlation"
0x0043f610,13,world_clear_station_detail_candidate_service_preview_pair_globals,map,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Tiny shared reset for the two preview globals at `0x005ee4fc` and `0x005ee500`. The helper writes `-1` into both lanes and returns. Current grounded callers are the shell-side preview clear and teardown paths in `StationDetail.win` at `0x00504a90` and `0x00505bf0`, where those globals hold the active `(station id, candidate id)` pair used by the world-side overlay scanner `0x0043f640`. This is the safest current read for the direct candidate-service preview-pair reset helper.","objdump + caller inspection + local disassembly + preview-pair correlation"
0x0043f620,20,world_store_station_detail_candidate_service_preview_pair_globals,map,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Tiny shared setter for the same preview globals at `0x005ee4fc` and `0x005ee500`. The helper stores its two caller dwords into those lanes unchanged and returns. Current grounded caller is `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, where the pair is the active `(station id, candidate id)` selection later consumed by `world_render_station_candidate_service_map_overlay` `0x0043f640`. This is the safest current read for the direct candidate-service preview-pair setter.","objdump + caller inspection + local disassembly + preview-pair correlation"
0x0043f640,3797,world_render_station_candidate_service_map_overlay,render,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Renders the world-side map overlay behind the active `StationDetail.win` candidate-service preview. The helper reads the currently previewed `(station id, candidate id)` pair from `0x005ee4fc` and `0x005ee500`, rejects early when shell preview mode or cargo-economy gates are inactive, re-enters `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`, and then scans the placed-structure collection at `0x006cec20` through either the direct local-service path or the heavier route-side helper at `0x0047e690`. The candidate byte at `[candidate+0x46]` now looks like the key legend split: when it is nonzero the overlay formats the directional route rows `3874` `Coming To %1` and `3875` `Going From %1`; when it is zero the same two legend lanes instead format `3876` `Current Supply @ < %1` and `3877` `Current Demand @ > %1`. Empty directional lanes collapse to `3878` `--None--`, and the title lane falls back to literal `All` when no specific candidate label is active. The neighboring connection-state notes `3872` `Already Connected by Another Company` and `3873` `Not Connected` no longer look like direct overlay-body emits; current grounded disassembly keeps them in the adjacent city bonus or status formatter `city_site_format_connection_bonus_status_label` at `0x004207d0`, which reuses `city_connection_bonus_exists_matching_peer_site` at `0x00420030` plus `placed_structure_query_linked_company_id` at `0x0047efe0` before choosing those strings. `3879` `Out of Sync` is also outside this function body and belongs to the multiplayer preview dataset path at `0x0046b780`. This now looks like the first grounded world-side owner above the shell preview pair armed by `shell_station_detail_set_active_candidate_service_preview` at `0x00504ae0` rather than a generic hidden scanner.","objdump + RT3.lng strings + caller inspection + preview-overlay correlation + legend-branch correlation + adjacent-formatter boundary check"
0x00439140,1086,simulation_frame_accumulate_and_step_world,simulation,cdecl,inferred,objdump + analysis-context,4,"Frame-owned simulation cadence after world bring-up and still directly called from shell_service_pump_iteration at 0x00483f70 rather than a separately grounded outer gameplay loop. The routine samples elapsed time through 0x0051d890 mixes shell and mode scalars into a simulation quantum keeps leftover fractional time in [this+0x4c80] and when enough time has accumulated repeatedly calls simulation_advance_to_target_calendar_point at 0x0040ab50 using the current step quantum from 0x005f2b38. Around those simulation steps it refreshes shell-facing presentation helpers under 0x006d4024 and 0x006d0818 updates multiple world collections and transport or scenario side structures and services the recurring GameMessage.win branch through `game_message_window_service_if_present` `0x004e0720` before later follow-up work. The shell-owned cadence evidence is tighter here now too: one direct frame-side branch at `0x0043970f` opens or focuses `LoadScreen.win` through `shell_open_or_focus_load_screen_page` `0x004e4ee0`, and the post-step shell-window ladder then services several sibling shell windows by presence-probe plus dirty-latch pairs instead of any detached gameplay-only owner. Current grounded members of that ladder now include the shared custom modal through `shell_has_live_custom_modal_dialog` `0x004c8680` plus `shell_mark_custom_modal_dialog_dirty` `0x004c8670`, the file-options dialog through `shell_has_file_options_dialog` `0x004dc7d0` plus `shell_mark_file_options_dialog_dirty` `0x004dc7e0`, `LoadScreen.win` through `shell_has_live_load_screen_window` `0x004e1f50` plus `shell_mark_load_screen_window_dirty` `0x004e1f60`, `SettingsWindow.win` through `shell_has_settings_window` `0x004fe120` plus `shell_mark_settings_window_dirty` `0x004fe130`, `Overview.win` through `shell_has_live_overview_window` `0x004f2e80` plus `shell_mark_overview_window_dirty` `0x004f2e90`, `BuildingDetail.win` through `shell_has_live_building_detail_window` `0x004b9d70` plus `shell_mark_building_detail_window_dirty` `0x004b9d80`, and now `Trainbuy.win` through `shell_has_live_trainbuy_window` `0x0050f740` plus `shell_mark_trainbuy_window_dirty` `0x0050f750`. One deeper world-mode sidecar inside the same frame path now looks grounded too: after delegating to world_view_service_shell_input_pan_and_hover at 0x0043db00 the frame compares the active controller-view pointer at [0x006d4024+0x18]+0x366e against the latched world object at [this+0x66a2], releases the previous object through vtable slot +0x64, and when the new object passes its own availability test at slot +0x1c plus shell-detail control gate 0x07d6 on 0x006d0818 it latches the new object and calls slot +0x60. That makes the frame owner the first grounded non-camera world-input coordinator for hover or focus-target transitions beneath the shell-fed camera stack, even though click or command semantics are still unresolved. This is the strongest grounded owner so far for the recurring gameplay simulation cadence that follows world_entry_transition_and_runtime_bringup.","objdump + analysis-context + caller xrefs + callsite inspection + frame-disassembly correlation"
0x00433a40,82,shell_can_open_company_list_or_detail_panel_or_warn,shell,thiscall,inferred,objdump + caller inspection + shell-detail correlation,4,"Shared availability gate above the shell-side company-list and selected-company-detail lanes. The helper reads scenario toggle `[0x006cec78+0x4aef]`; when that dword is nonzero it raises the shared shell modal rooted at localized id `334` through `0x005193f0 -> 0x004c98a0` and returns `0`, otherwise it returns `1`. Current grounded callers are the direct shell command branches `0x004405b3` and `0x0044062c`, plus the broader shell-strip and page-side handlers `0x004de2e3` and `0x004de3ae`, all of which open company-list or selected-company-detail panels only on success. This is therefore the safest current read for the company list/detail availability gate rather than a generic scenario-action blocker.","objdump + caller inspection + shell-detail correlation + modal-path correlation"
0x00433aa0,95,shell_can_open_stockbuy_window_or_warn,shell,thiscall,inferred,objdump + caller inspection + stockbuy correlation,4,"Shared availability gate above the shell-side `StockBuy.win` family. The helper first rejects scenario states where toggle `[0x006cec78+0x4aa7]` is nonzero, surfacing the same shared shell modal rooted at localized id `334` through `0x005193f0 -> 0x004c98a0`. When the scenario toggle allows the action, it still requires a nonzero selected-company id at `[scenario+0x21]`; if no company is currently selected it raises the sibling shell modal rooted at localized id `335` and returns `0`. Only the success path returns `1` to the callers at `0x00440673` and `0x004de50f`, both of which immediately open detail-panel mode `0x0c` that later refreshes through the `StockBuy.win` family. This is therefore the safest current read for the stock-buy availability gate rather than a generic company-selection check.","objdump + caller inspection + stockbuy correlation + modal-path correlation"
0x00433b00,117,shell_can_open_trainbuy_window_or_warn,shell,thiscall,inferred,objdump + caller inspection + RT3.lng strings,4,"Shared availability gate above the shell-side `Trainbuy.win` family. The helper first rejects scenario states where the train-buy action is globally disabled through `[0x006cec78+0x4aa3]`, surfacing localized id `334` `That action is not allowed in this scenario.` through the shared shell modal path when blocked. It then checks whether the active company or world object state supplied by the caller allows train purchase; if no company is active it raises id `337` `You can't buy a train without starting a company first!`, and if no track has been placed it raises id `338` `You can't buy a locomotive until some track has been placed!`. Only the success path returns nonzero to the callers at `0x004406d3` and `0x004de7d9`, both of which immediately enter `shell_open_or_focus_trainbuy_window` at `0x00512c50`.","objdump + caller inspection + RT3.lng strings + train-buy gate correlation"
0x00434db0,91,shell_can_open_detail_panel_mode_0x0b_or_warn,shell,thiscall,inferred,objdump + caller inspection + shell-detail correlation,3,"Shared availability gate above one still-unresolved shell detail-panel mode `0x0b`. The helper first re-enters `shell_can_open_company_list_or_detail_panel_or_warn` `0x00433a40`; only when that broader company-family gate succeeds does it consult the additional scenario toggle `[0x006cec78+0x4a7f]`. When that second toggle is nonzero it raises the shared shell modal rooted at localized id `334` through `0x005193f0 -> 0x004c98a0` and returns `0`; otherwise it returns `1`. Current grounded callers are the direct shell command branch `0x00440543` and the page-side launcher `0x004de4a0`, both of which immediately open detail-panel mode `0x0b` on success. This is therefore the safest current read for the mode-`0x0b` availability gate rather than a tighter family name we have not yet recovered.","objdump + caller inspection + shell-detail correlation + modal-path correlation"
0x00434e20,128,shell_can_open_detail_panel_mode_0x06_or_warn,shell,thiscall,inferred,objdump + caller inspection + shell-detail correlation,3,"Shared availability gate above one still-unresolved shell detail-panel mode `0x06`. The helper first checks the three scenario toggles `[0x006cec78+0x4ab3]`, `[+0x4ab7]`, and `[+0x4abf]`; only when all three are nonzero does it raise the shared shell modal rooted at localized id `334` and return `0`. Otherwise it checks editor-map mode `[0x006cec74+0x68]`; outside editor mode it also requires a nonzero selected-company id at `[scenario+0x21]`, raising the sibling shell modal rooted at localized id `336` when that company selection is absent. Only the success path returns `1` to the callers at `0x004406a3` and `0x004de280`, both of which immediately open detail-panel mode `0x06`. This is therefore the safest current read for the mode-`0x06` availability gate rather than a tighter family name we have not yet grounded.","objdump + caller inspection + shell-detail correlation + modal-path correlation + editor-mode gating correlation"
0x00433b80,69,scenario_state_run_optional_collection_refresh_hooks_when_mutation_depth_zero,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Runs a small dispatcher of optional collection-side refresh hooks, but only when global mutation depth `0x0062be40` has fallen back to zero. On the active path it conditionally refreshes four live collection families through shell-state-controlled gates: the placed-structure collection at `0x006cec20` through `0x00481430`, the sibling placed-structure helper family at `0x0062b26c` through `0x00413860`, the train-side collection at `0x006cfcbc` through `0x004b2a90`, and the route-entry collection at `0x006cfca8` through `0x004931e0`. Current grounded callers include the periodic maintenance branch at `0x0040a914`, the placed-structure finalize path at `0x0040f6b4` after it decrements `0x0062be40`, and several shell or editor mutation branches around `0x0049d3a8` and `0x00508f97/0x0050900a`. This is therefore the safest current read for the zero-depth optional collection-refresh dispatcher rather than a single collection owner.","objdump + local disassembly + caller correlation + zero-depth-dispatch correlation + collection-refresh correlation"
0x00433da0,367,shell_open_detail_panel_mode_0x19_variant_and_refresh_game_uppermost_overlay,shell,cdecl,inferred,objdump + caller inspection + overlay-control correlation,3,"Shared owner beneath the paired shell commands `0x00441260` and `0x004412a0` for the mode-`0x19` overlay family. The helper takes one caller-supplied presenter-state boolean and one variant selector, restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across the detail-panel control band `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and then forwards the same variant into world helper `0x0043a0a0`. Current grounded callers are the two registered shell commands that derive the presenter-state boolean from `[0x006d4024+0x114216] == 1` and pass variant `0` or `1`, which makes this the safest current read for the shared mode-`0x19` variant-open and overlay-refresh owner rather than another anonymous control restyler.","objdump + caller inspection + overlay-control correlation + mode-0x19 correlation + detail-panel transition correlation"
0x00439820,91,world_view_sample_local_clearance_ring_clamp_eye_height_and_optionally_republish_triplet,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared world-view helper beneath the local controller strip. The function samples five nearby heights through `0x00534490` at the current eye X/Z pair `[this+0x1c/+0x24]` and four axis-offset probes, keeps the highest sampled clearance, rounds and expands that limit through `0x0052d0c0` plus fixed scalar margins, and then compares the result against current eye height `[this+0x20]`. When the smoothed or clamped target exceeds the current eye height it republishes the eye triplet through `0x0052d1e0`; when local smoothing latch `[this+0x60]` is live it also uses gain `[this+0x34e]` and cached scalar `[this+0x34a]` before that republish. Current grounded callers are the shell-input controller path `0x0043a1d4`, the camera-restore and step buckets at `0x0043c967`, `0x0043cdd4`, `0x0043d0a6`, and the neighboring motion branches `0x0043e4d5` and `0x0043f427`, so this is the safest current read for the local clearance-ring clamp and republish helper rather than a generic terrain-height query.","objdump + caller inspection + local disassembly + world-view correlation + local-clearance correlation + eye-triplet correlation"
0x0043a0a0,76,world_view_set_mode_0x19_variant_latch_seed_controller_blend_and_mark_dirty,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small world-view owner reached directly from the mode-`0x19` shell strip. The helper stores the inverse of its caller-supplied variant selector into presenter dword `[0x006d4024+0x114216]`, seeds four controller scalars through `0x0052d140` on the live world-view root `0x0062be68`, calls that same object's vtable slot `+0x00`, and then sets dirty byte `[world_view+0x65] = 1`. The seeded scalar quadruple is either `(1.0, 1.0, 0.0, 0.0)` or `(0.7, 1.0, 0.0, 0.0)` depending on the selected mode-`0x19` variant. Current grounded caller is `shell_open_detail_panel_mode_0x19_variant_and_refresh_game_uppermost_overlay` `0x00433da0`, so this is the safest current read for the world-view-side variant latch plus controller-blend seed owner rather than a generic shell flag setter.","objdump + caller inspection + local disassembly + world-view correlation + mode-0x19 correlation + controller-band correlation"
0x0043a1a0,61,world_view_store_two_scaled_controller_inputs_and_mark_projection_dirty,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small world-view helper over the same local controller strip. The helper scales its two caller floats by `100.0`, forwards them together with current controller dword `[this+0x0c]` into `0x0052d180`, forces controller scalar `[this+0x34e] = 1.0`, and then re-enters `0x00439820` to refresh the dependent view-projection state. Current grounded caller is `shell_world_view_apply_one_normalized_input_pair_from_shell_frame` `0x00516837`, which makes this the safest current read for the two-input controller setter plus projection-dirty publish rather than a higher-level camera mode owner.","objdump + caller inspection + local disassembly + world-view correlation + controller-input correlation + projection-refresh correlation"
0x0043a1e0,890,world_view_service_controller_transient_offsets_and_selection_handle,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader world-view-side service owner above the same controller strip. When activation dword `[this+0x38e]` is nonzero, the helper derives time-varying transient offsets into `[this+0x3a6/+0x3aa/+0x3ae]` from the current timer fields `[+0x392/+0x396]` and several fixed scalar thresholds, updates or clears one selection-like handle at `[this+0x3b2]` through `0x00531790` and `0x005317b0`, and can drop the activation dword plus all three offsets back to zero when the transient expires. On the live path it also republishes the accumulated offset-adjusted controller position through `0x0052d180` and restores controller gain `[this+0x34e] = 1.0`. Current grounded callers are the recurring simulation-frame path `0x0043916c`, the selection-side refresh strip at `0x0043bd1a`, and the neighboring motion branch at `0x0043e2a4`, so this is the safest current read for the controller transient-offset and selection-handle service owner rather than a static constructor or one-shot callback.","objdump + caller inspection + local disassembly + world-view correlation + transient-offset correlation + selection-handle correlation"
0x0043a560,64,world_view_release_controller_selection_handle_and_reset_embedded_controller_base,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Teardown-side sibling for the same world-view controller family. The helper temporarily restores one local vtable root at `[this]`, releases selection-like handle `[this+0x3b2]` through `0x005317b0(0)` when it is still live, clears the matching presenter-side owner slot through `0x0052d3e0`, and then tail-jumps into the embedded controller-base reset at `0x0052d570`. This is the safest current read for the controller-family release and base-reset helper rather than a generic shell singleton destructor.","objdump + local disassembly + caller inspection + world-view correlation + controller-reset correlation + selection-handle correlation"
0x0043a5a0,421,world_view_construct_reset_controller_state_and_seed_keyboard_bindings,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Broader world-view constructor or reset owner above the same controller strip. The helper first resets the embedded controller base through `0x0052d5a0`, clears a large local scalar and handle band rooted at `[this+0x8a..+0x38e]`, seeds a few fixed defaults such as `[this+0x38a] = -999.0f` and `[this+0x34e] = 1.0f`, and then tail-jumps into `world_view_seed_keyboard_binding_slot_pairs` `0x00439e40`. The resulting boundary is strong enough to treat this as the real world-view reset and keyboard-binding seed owner rather than a small camera-only helper.","objdump + local disassembly + caller inspection + world-view correlation + reset-owner correlation + keyboard-binding correlation"
0x0043ac30,235,world_view_load_camera_snapshot_release_pending_helper_and_reseed_blend_scalars,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Load-side world-view owner above the embedded controller snapshot loader. The helper first releases any pending helper handle from `[this+0x3b2]` through `0x005317b0`, clears presenter owner slot through `0x0052d3e0`, and resets the local controller strip through `0x0043a5a0`. It then loads one stored camera-view snapshot from the caller stream through `0x0052d750`, conditionally reads either `8` or `10` extra `0x30`-byte rows into `[this+0x10e]` according to startup-side scalar `[0x006cec78+0x46c34]`, consumes one trailing `0x14`-byte block, reseeds the four controller blend scalars through `0x0052d140(0, 0, 1.0, 0.7)`, calls vtable slot `+0x10`, and finally normalizes the heading lane `[this+0x10]`. Current evidence is strongest for a camera-snapshot load owner with one optional extra-row band rather than a generic stream-reader wrapper.","objdump + caller inspection + local disassembly + world-view correlation + stream-load correlation + controller-base correlation"
0x0043bde0,2037,world_view_refresh_dependent_projection_visibility_and_presentation_scalars,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader dependent-refresh owner beneath the same world-view family. After re-entering `0x00439be0`, the helper derives one large band of projection, visibility, and presentation-side scalars from the current focus and eye triplets `[this+0x04..+0x24]`, current controller defaults `[+0x38/+0x3c/+0x40/+0x44/+0x4c]`, world-side mode gates, and several fixed threshold tables. Along that path it calls `0x0052cec0`, `0x00484af0`, `0x00533100`, `0x0043a940`, and repeated world-cell validity checks through `0x00534e50`, and can set dirty byte `[this+0x65]` when the resulting bounds or visibility envelopes move outside tolerated ranges. Current grounded callers are the camera-restore path `0x0043caee`, the heading and zoom-step paths `0x0043cb1d/0x0043cddb`, the shell-input controller service `0x00516842`, and several neighboring motion branches, so this is the safest current read for the world-view dependent projection and presentation refresh owner rather than a smaller math helper.","objdump + caller inspection + local disassembly + world-view correlation + projection-refresh correlation + presentation-scalar correlation"
0x0050f740,6,shell_has_live_trainbuy_window,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Tiny presence probe for the shell-side `Trainbuy.win` singleton rooted at `0x006d3ac8`. The helper returns the live-flag dword at `0x006d3ae4`, which is set during `shell_open_or_focus_trainbuy_window` at `0x00512c50` and cleared after that family tears the singleton down. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where it sits beside the sibling overview, building-detail, load-screen, settings, custom-modal, and file-options probes.","objdump + caller inspection + strings correlation + singleton correlation"
0x0050f750,11,shell_mark_trainbuy_window_dirty,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Tiny dirty-latch setter paired with `shell_has_live_trainbuy_window`. The helper stores `1` into `0x006d3adc`, which current nearby call patterns treat as the `Trainbuy.win` refresh or service request latch once the live singleton family rooted at `0x006d3ac8` exists. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, and the same latch is consumed on the message-`0` service path inside the family handler at `0x00512202` through the `0x00512c09` branch.","objdump + caller inspection + nearby-family correlation + singleton correlation + service-path inspection"
0x0050f760,45,shell_trainbuy_window_query_selected_locomotive_id,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Returns the currently selected locomotive id or `0` when the shell-side `Trainbuy.win` family has no valid active selection. The helper first checks whether the live singleton at `0x006d3ac8` exists and whether control resource `0x2afe` exposes one nonnegative selected row through `0x0055fba0`; on success it returns that selected locomotive id. Current grounded callers include the route, upgrade-cost, and purchase-confirmation branches inside `shell_trainbuy_window_handle_message`, where this value is then resolved through the locomotive collection at `0x006ada84`.","objdump + caller inspection + strings correlation + selected-row correlation"
0x0050f790,241,shell_trainbuy_window_compute_selected_upgrade_total_and_count,shell,thiscall,inferred,objdump + caller inspection + RT3.lng strings,4,"Computes the current selected-train upgrade summary beneath the shell-side `Trainbuy.win` family. The helper counts all flagged train entries in the `0x2000`-byte selection array rooted at `0x006d1aa8`, resolves the currently selected locomotive choice through `shell_trainbuy_window_query_selected_locomotive_id` at `0x0050f760`, and then multiplies the resulting selected-train count by the per-train upgrade cost from `0x004619c0` after converting the current and target locomotive ids through `0x004337b0` and `0x004337a0`. It writes the total upgrade cost through the first out-parameter and the number of selected trains through the second. Current grounded callers are the summary formatter at `0x0050f890` and the purchase-or-upgrade confirmation path inside `shell_trainbuy_window_handle_message`.","objdump + caller inspection + RT3.lng strings + selection-array correlation + upgrade-cost correlation"
0x0050f890,368,shell_trainbuy_window_render_selected_train_upgrade_summary,shell,cdecl,inferred,objdump + caller inspection + RT3.lng strings,4,"Formats the selected-train upgrade summary text in the shell-side `Trainbuy.win` family. After resolving the currently selected locomotive id through `shell_trainbuy_window_query_selected_locomotive_id` at `0x0050f760`, the helper calls `shell_trainbuy_window_compute_selected_upgrade_total_and_count` at `0x0050f790` and then builds the player-facing status string from localized ids `1338` `No trains currently selected to upgrade.`, `1339` `Total Cost to Upgrade the %1 Selected Trains to %2 is %3.`, and `1340` `Total Cost to Upgrade the 1 Selected Train to %1 is %2.`. It publishes the resulting heap-backed text through the callback-driven shell control path rooted at control resource `0x275c`. Current grounded callers are the family refresh path at `0x00511500` and the row-selection branch at `0x00512ac7`.","objdump + caller inspection + RT3.lng strings + upgrade-summary correlation"
0x0050fc00,1003,shell_trainbuy_window_render_selected_train_route_and_state_panel,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Renders the richer selected-train detail panel beneath the shell-side `Trainbuy.win` family. The helper resolves the currently selected train and its linked locomotive definition, formats one header block through the shared shell text path at `0x005519f0`, and then builds the lower route or cargo state block through `0x0053de00`, `0x0041d540`, and `0x00552560`. When the runtime latch at `[0x006cec74+0x180]` is set it also appends up to three localized fragments through ids `1341..1343`, gated by bytes `[train+0x30..0x32]`, before laying the final text out. Current grounded callers are the per-row hover or selection refresh paths beneath `Trainbuy.win`; the evidence is strong enough to treat it as the selected-train route-and-state renderer even though the exact player-facing captions for the three optional fragments are still unrecovered.","objdump + caller inspection + nearby-family correlation + selected-train correlation"
0x00511500,2941,shell_trainbuy_window_construct,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Constructs the shell-side `Trainbuy.win` singleton later published at `0x006d3ac8`. The constructor binds the window resource through `0x0053fa50`, caches three shell runtime handles in `0x006d3abc..0x006d3ac4`, seeds the live singleton pointer at `0x006d3ac8`, builds one filtered locomotive-choice list under `0x006d3ae8`, and then wires the family controls and callbacks through `0x00540120`. Current grounded control ownership is broad enough to treat this as the full `Trainbuy.win` family rather than a small helper: it binds the main action and selection controls under resources `0x2afa..0x2aff`, the selected-train summary path through `shell_trainbuy_window_render_selected_train_upgrade_summary` at `0x0050f890`, the per-row hover helpers at `0x0050fa00` and `0x0050fc00`, the selected-row refresh helper at `0x00511170`, and the selection-paging helper at `0x00512080`. Current grounded caller is `shell_open_or_focus_trainbuy_window` at `0x00512c50`.","objdump + caller inspection + strings correlation + control-wiring inspection + singleton correlation"
0x00512080,372,shell_trainbuy_window_refresh_controls,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Refreshes the visible control state for the shell-side `Trainbuy.win` family. The helper consumes and clears the temporary refresh gate at `0x006d3ae1`, clamps the current selected locomotive-row index from control resource `0x2aff` against the live filtered choice list length at `0x006d3aec`, rewrites the list-selection state across control `0x88`, updates the current mode-strip and list-state controls rooted at `0x00622b28`, and then tail-calls the selected-row detail refresher at `0x00511170`. Current grounded callers are the family constructor at `0x00511500`, the action path after row or mode changes inside `shell_trainbuy_window_handle_message`, and the initial open path in `shell_open_or_focus_trainbuy_window` at `0x00512dd5`.","objdump + caller inspection + strings correlation + list-state correlation"
0x00512c50,615,shell_open_or_focus_trainbuy_window,shell,cdecl,inferred,objdump + caller inspection + strings correlation + RT3.lng strings,4,"Shared opener for the shell-side `Trainbuy.win` singleton rooted at `0x006d3ac8`. The helper first rejects duplicate opens through the live flag at `0x006d3ae4`, seeds the family globals `0x006d3ad0..0x006d3ad8`, `0x006d3acc`, `0x006d3aa8`, `0x006d1aa0`, `0x006d1aa4`, `0x006d3af0`, `0x006d3af4`, `0x00622b24`, and the filtered locomotive-choice list at `0x006d3ae8`, allocates an `0x80`-byte shell window object, constructs it through `shell_trainbuy_window_construct` at `0x00511500`, refreshes it through `shell_trainbuy_window_refresh_controls` at `0x00512080`, and publishes it to the shell runtime at `0x006d401c`. Current grounded callers are the direct train-buy shell command branches at `0x004406ee` and `0x004de7f4` after `shell_can_open_trainbuy_window_or_warn` at `0x00433b00`, plus the sibling train-side action family around `0x00514c97` and `0x00514d7e`. The current family semantics are broader than a bare locomotive picker: nearby message and summary paths show that the same window also stages selected-train upgrade state and train-route editing affordances, but the strongest resource-name anchor remains `Trainbuy.win`.","objdump + caller inspection + strings correlation + RT3.lng strings + singleton correlation + control-family correlation"
0x00512f80,193,shell_trainbuy_window_refresh_selection_side_toggle,shell,thiscall,inferred,objdump + caller inspection + control-flow inspection,4,"Refreshes the small side-toggle strip beneath `Trainbuy.win` and stores the chosen side in `0x006d3b28`. The helper converts the caller-supplied boolean into two opposing style states on controls `0x6593` and `0x6594`, rewrites one small layout block through `0x0053fe90`, and keeps the current side latched for the surrounding message paths that call it with `0` and `1` at `0x00514fed` and `0x00514fd8`. Current grounded caller is the neighboring train-side window family rooted at `0x006d3b20`, which reuses the same selected-train context but is not yet safely named.","objdump + caller inspection + control-flow inspection + side-toggle correlation"
0x005130f0,62,shell_trainbuy_window_query_selected_train_record,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Returns the currently selected train record or `0` when the active shell detail controller at `0x006d0818` does not hold one valid train id in `[this+0x90]`. The helper validates that selected id against the train collection at `0x006cfcbc` and then resolves the live record through `0x00518140`. Current grounded callers include the neighboring train-side shell window family around `0x005146d6`, `0x00514ce2`, and `0x00515176`, which repeatedly reuse the same selected-train pointer for route, upgrade, and warning flows.","objdump + caller inspection + nearby-family correlation + selected-train correlation"
0x00513130,51,shell_trainbuy_window_query_selected_train_id,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Returns the currently selected train id from the active shell detail controller at `0x006d0818` when that id is positive and still present in the train collection at `0x006cfcbc`; otherwise returns `-1`. Current grounded callers are the same neighboring train-side shell families that package selected-train requests for local and multiplayer follow-on work.","objdump + caller inspection + nearby-family correlation + selected-train-id correlation"
0x00513170,44,shell_trainbuy_window_has_valid_selected_train,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Boolean validity probe above `shell_trainbuy_window_query_selected_train_id`. The helper returns `1` only when the active shell detail controller at `0x006d0818` currently holds one positive train id in `[this+0x90]` and that id is still live in the train collection at `0x006cfcbc`. Current grounded callers include the train-side command family around `0x00514c66`, `0x00514cb5`, `0x00514d9c`, and `0x0051515c`, where it gates nearly every selected-train verb before deeper ownership or route checks run.","objdump + caller inspection + nearby-family correlation + selected-train-id correlation"
0x005131a0,125,shell_trainbuy_window_selected_train_belongs_to_selected_company,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Boolean ownership probe for the currently selected train. After resolving the selected train record through the same `0x006d0818` plus `0x006cfcbc` path as `shell_trainbuy_window_query_selected_train_record`, the helper compares that record's linked company id at `[train+0x51]` against the current scenario-selected company from `0x004337a0`. It returns `1` only when they match. Current grounded callers include the neighboring train-side command family, where failure falls into the explicit warning path at `0x00513220`.","objdump + caller inspection + nearby-family correlation + company-match correlation"
0x00513220,351,shell_trainbuy_window_warn_selected_train_not_owned_by_current_company,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Shared warning modal raised when a selected train does not belong to the current scenario-selected company. The helper resolves one player-facing label through `0x004a8bd0` when a live selected train exists, falls back to the static string block at `0x005c87a8` otherwise, formats localized id `0x250`, and then opens the standard callback-driven shell modal through `shell_open_custom_modal_dialog_with_callbacks` at `0x004c98a0`. Current grounded caller is the ownership-failure branch immediately after `shell_trainbuy_window_selected_train_belongs_to_selected_company` at `0x00514a35`.","objdump + caller inspection + nearby-family correlation + modal correlation"
0x00513720,168,shell_trainbuy_window_refresh_selection_column_empty_state_labels,shell,thiscall,inferred,objdump + caller inspection + control-flow inspection,4,"Refreshes the paired empty-state labels and styles on controls `0x65a1` and `0x65a2`. The helper inspects the currently active side resource `0x65a3/0x65a4`, checks whether its list selection at `[resource+0x1d6]` is negative, and then switches the two visible placeholder strings between localized ids `0x25b..0x25e` while also rewriting both controls' styles through `0x00540120`. Current grounded callers are the neighboring train-side shell window family constructor at `0x005145f3` and the row-selection action lane at `0x005148f3`.","objdump + caller inspection + control-flow inspection + placeholder-label correlation"
0x00514110,67,shell_train_detail_window_refresh_selected_train_name_label,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Small dynamic-label refresher beneath the shell-side `TrainDetail.win` family rooted at `0x006d3b20`. After validating the currently selected train id from the shell detail controller at `0x006d0818`, the helper resolves control `0x659d` inside the live `TrainDetail.win` singleton and forwards the caller-supplied subject string through `0x004bffc0`. Current grounded caller is the family constructor at `0x00514420`, which binds this helper as the dynamic-text callback for control `0x659d`.","objdump + caller inspection + strings correlation + callback binding"
0x00514160,704,shell_train_detail_window_refresh_controls,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Refreshes the visible control state for the shell-side `TrainDetail.win` family rooted at `0x006d3b20`. The helper rewrites the two top selection bands `0x65a3` and `0x65a4` from the current side latch at `0x006d3b24`, rebuilds the selected train's nested row state from the current train record resolved through the shell detail controller at `0x006d0818`, installs the per-row callbacks and renderers for the metric rows `0x65b6`, `0x65b9`, `0x65bc`, and `0x65bf`, updates the placeholder and summary text controls `0x659a`, `0x659b`, and `0x659d`, and then refreshes the current row selection plus the paired empty-state labels through `0x004bf320` and `shell_trainbuy_window_refresh_selection_column_empty_state_labels` at `0x00513720`. Current grounded callers are the family constructor at `0x00514420`, the opener at `0x00514620`, and several action paths inside the family message dispatcher at `0x00514690`.","objdump + caller inspection + strings correlation + callback binding + row-state correlation"
0x00514420,512,shell_train_detail_window_construct,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Constructs the shell-side `TrainDetail.win` singleton later published at `0x006d3b20`. The constructor seeds the local vtable at `0x005d1990`, caches three shell runtime handles in `0x006d3b14..0x006d3b1c`, binds the `TrainDetail.win` resource directly through `0x0053fa50` using the embedded string at `0x005d19c0`, and then wires the family controls and callbacks through `0x00540120`. Current grounded bindings are broad enough to treat this as the full `TrainDetail.win` family: it installs row-click callbacks on `0x65a3` and `0x65a4`, metric renderers on `0x65ab` and `0x65ac`, the selected-train callback on `0x659c`, the dynamic-name label callback on `0x659d`, seeds the side-toggle state through `shell_trainbuy_window_refresh_selection_side_toggle` at `0x00512f80`, and then refreshes the full window through `shell_train_detail_window_refresh_controls` at `0x00514160`. Current grounded callers are the shell detail-panel transition manager at `0x004ddda1` and the direct opener at `0x00514620`.","objdump + caller inspection + strings correlation + callback binding + singleton correlation"
0x00514620,110,shell_open_or_focus_train_detail_window,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Shared opener or focus path for the shell-side `TrainDetail.win` singleton. When the caller supplies one valid train id present in the train collection at `0x006cfcbc`, the helper can seed the selected train subject through `0x004a7390`; when a live `TrainDetail.win` singleton already exists at `0x006d3b20` and the current shell runtime subject matches the incoming one, it simply refreshes that window and pings the shell runtime. Current grounded direct caller is the surrounding shell command path at `0x0046cbda`, and the existing constructor edge at `0x004ddda1` confirms that this opener sits above the same `TrainDetail.win` family rather than the neighboring `Trainbuy.win` singleton.","objdump + caller inspection + strings correlation + singleton correlation"
0x00514690,1920,shell_train_detail_window_handle_message,shell,thiscall,inferred,objdump + caller inspection + control-flow inspection + RT3.lng strings,4,"Primary message dispatcher for the shell-side `TrainDetail.win` family rooted at `0x006d3b20`. The handler processes shell messages `0`, `0xca`, `0xcb`, and the recurring service message `0x3e9`; routes the top-level side-toggle, list-selection, and metric-row controls through a dispatch table over resources `0x659c..0x6947`; repeatedly reuses the currently selected train via the helper family at `0x005130f0..0x00513220`; and fans out into several now-bounded train verbs. Current explicit branches include one selected-train engine-replacement or trainbuy handoff lane that checks scenario gate `[0x006cec78+0x4a97]`, raises localized ids `593` `That action is not allowed in this scenario.` and `594` `You can not replace the engine while the train is broken-down.` on failure, and otherwise re-enters `shell_open_or_focus_trainbuy_window` at `0x00512c50` or the neighboring local follow-on path at `0x00436820`; one selected-train retirement lane that checks `[0x006cec78+0x4a9b]`, rejects blocked states through ids `595` and `597`, confirms through id `596`, and then either tears the train down locally through the train collection plus `shell_detail_panel_transition_manager` mode `2` or packages multiplayer opcode `0x37`; plus one tighter route-edit lane over the shared `0x33`-stride route-entry family, where removal re-enters `train_route_list_remove_entry_and_compact` at `0x004b3000` and staged insertion re-enters `train_route_list_insert_staged_entry_at_index` at `0x004b3160`, then validates the resulting route through `train_route_list_validate_reachability_and_station_pair` at `0x004b2c10` and commits the follow-on train state through `train_set_route_operating_mode_and_scalar` at `0x004ab980`, with multiplayer opcode mirrors `0x3d`, `0x3f`, and `0x41`. It also consumes the family refresh path through `shell_train_detail_window_refresh_controls` at `0x00514160`. Current evidence is broad enough to treat this as the full `TrainDetail.win` message owner even though several deeper per-action verbs remain semantically open.","objdump + caller inspection + control-flow inspection + dispatch-table inspection + selected-train helper correlation + RT3.lng strings"
0x004a01a0,789,route_entry_collection_try_build_path_between_optional_endpoint_entries,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavy route-entry collection method over the global route store at `0x006cfca8`. The helper accepts up to two optional endpoint-entry pointers or ids, two endpoint coordinate pairs, a route-policy or mode byte, and optional output slots for the chosen endpoint-entry ids. It first resolves any supplied route-entry ids through `0x00518140` and projects them back to compact coordinate pairs through `0x0048a170`, rejects early when either endpoint lands on an invalid world tile through `0x00449980`, and computes one span scalar through `0x004952f0`. When the leading endpoint entry is absent it can synthesize one fresh route entry from the supplied coordinates and policy arguments through `0x00493cf0`; after that it resolves the chosen entry, copies four `3*dword` route-shape or bounding blocks from that entry into the collection-owned builder-state area at `[this+0x139]..[this+0x167]` through `0x005394b0`, stores the chosen endpoint coordinates at `[this+0x11d]` and `[this+0x121]`, latches one active-builder flag at `[this+0x118]`, and stages one linked entry field from `[entry+0x202]` into `[this+0x125]`. On one newly synthesized-entry path and policy bytes `1/2` it also touches the auxiliary route-entry family at `0x006cfcb4` through `0x004a42b0`, `0x00494f00`, and `0x004a4340`. Current caller evidence now narrows one more policy case: both the later world-side caller at `0x00480cd0` and the linked-site refresh helper `placed_structure_refresh_linked_site_display_name_and_route_anchor` `0x00480bb0` enter this helper with both optional endpoint-entry ids unset and literal policy byte `2`, so the strongest current read for that byte is a full linked-site route-anchor rebuild between optional endpoint entries rather than the narrower direct endpoint-anchor creation or replacement lane carried by literal byte `1` in `0x00493cf0`. The helper then resets the collection's transient path-search state through `0x00495480`, re-enters the deeper route-search core at `0x0049d380`, optionally writes the chosen endpoint-entry ids back through the caller-supplied output pointers on success, and finally tears down the transient search state through `0x00495540` and `0x0049ad90`. Current grounded callers are the early route-search lane inside `city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0`, two neighboring retry branches at `0x004030d0` and `0x00403330`, a paired startup-connection branch at `0x00403ac0`, that later world-side caller at `0x00480cd0`, and the linked-site refresh helper at `0x00480bb0`. This now looks like the shared route-entry search or synthesis owner above the deeper path-search core rather than a generic route-store mutator.","objdump + caller xrefs + callsite inspection + route-entry search correlation + builder-state correlation + partial-mode-byte correlation + linked-site refresh correlation + linked-site policy-byte split correlation"
0x004a3db0,272,route_entry_collection_service_recent_entry_state_promotions_and_followon_refreshes,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Collection-wide post-change sweep over the global route-entry store at `0x006cfca8`. The helper first snapshots collection field `[this+0x90]` into `[this+0x94]`, then, when shell-state gate `[0x006cec74+0x94]` is set, walks every live route entry through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. The current changed-entry lane is now bounded: for entries newer than collection threshold `[this+0x102]` via `[entry+0x240]` and still carrying state byte `[entry+0x216] == 1`, it promotes that state through `0x0048b830(entry, 2)` and then releases any queued side list at `[entry+0x244]` through `0x00489f40`. After that sweep it drains the collection-owned linked list at `[this+0x98]`, resets `[this+0x88] = -1`, and, when shell runtime `0x006d401c` is live while collection latch `[this+0xed]` is clear, posts shell status id `0xbb` through `0x00538e00`. When any entry was promoted it also re-enters `0x004358d0` on the active mode object at `0x006cec78`, triggers `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with kind `6`, and then tails into `placed_structure_route_link_collection_recompute_all_endpoint_pair_state` `0x004682c0` on `0x006ada90`. Current grounded callers include the city-connection route-builder tail at `0x00404564`, the linked-site route-anchor refresh tail at `0x00480d1c`, and TrackLay-side follow-ons at `0x0050d7ed` and `0x0050db24`, so this is now the safest current read for the route-entry collection's recent-entry state-promotion and follow-on refresh sweep rather than a generic collection walk.","objdump + caller inspection + local disassembly + route-entry collection correlation + state-promotion correlation + runtime-effect trigger-kind correlation + route-link followon correlation"
0x00489f80,11,route_entry_assign_aux_tracker_group_id,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,3,"Tiny route-entry helper that writes the caller-supplied auxiliary tracker id into route-entry field `+0x212`. Current grounded callers include the synthesis-side lane in `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0`, the route-search core `0x0049d380`, the broader regrouping pass `0x004a45f0`, and neighboring tracker-update branches at `0x004996e0`, `0x004a4380`, `0x004a4ce0`, and `0x004a4ff0`. This now looks like the direct route-entry aux-tracker group-id assignment helper rather than a generic field store.","objdump + caller xrefs + field-layout inspection + tracker-family correlation"
0x00493cf0,456,route_entry_collection_create_endpoint_entry_from_coords_and_policy,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Creates one fresh route-entry endpoint record from caller-supplied coordinates and a small policy tuple. The helper rejects when either coordinate pair falls outside the live world bounds in `0x0062c120`, optionally validates the supplied company id through `0x0062be10` and `company_query_available_track_laying_capacity_or_unlimited` `0x004240a0`, allocates a new route-entry-like record from the current collection through `0x00518900` with type `0x257`, applies one company-side setup branch through `company_adjust_available_track_laying_capacity_with_floor_zero` `0x00423ec0` when the company id is nonzero, and then commits the detailed endpoint payload through `0x00490ac0`. It can also re-enter `0x00491e60` when the created record or the owning collection keeps one follow-on latch set, and if the collection field `[this+0x88]` is still unset it seeds that field from the created record's word at `+0x240`. Current mode-byte evidence is still partial but tighter now. Literal policy byte `1` is the strongest current match for direct linked-site endpoint-anchor creation or replacement, because the linked-site constructor and its nearby repair branches at `0x00480463`, `0x00480a77`, and `0x00480b69` all pass that byte before rebinding one chosen anchor through `0x0048abc0`. The TrackLay-side callers at `0x0050df1e` and `0x0050eec6` are tighter now too: they derive the passed policy byte from the shared TrackLay mode `0x00622b0c` through `route_entry_collection_map_track_lay_mode_to_endpoint_policy_byte` `0x004955b0`, which currently gives the strongest read `policy 1 = single-track endpoint synthesis` and `policy 4 = double-track endpoint synthesis`. Bytes `1/2` are also the ones later reused by `0x004a01a0` to enable the auxiliary tracker lane, while the company-side charge split is no longer vague: when a company id is present, ordinary company-bound synthesis passes `-1` into `0x00423ec0`, while byte `4` instead passes `-2`, so the current strongest read is that policy byte `4` consumes a larger company-side available-track-laying-capacity unit rather than skipping the company setup branch outright. The older builder-state path at `0x0046f2d1` still passes a dynamic byte from `[esi+0x05]`. The function returns the newly created route-entry id or `-1` on failure. Current grounded callers include `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0`, those neighboring route-building branches, and the TrackLay-side callers at `0x0050df1e` and `0x0050eec6`, so this now looks like the shared endpoint-entry synthesis helper rather than a generic collection allocator.","objdump + caller xrefs + callsite inspection + route-entry creation correlation + partial-mode-byte correlation + caller-pattern correlation + route-build-capacity correlation + linked-site policy-byte split correlation + TrackLay mode correlation"
0x00494e40,61,aux_route_entry_tracker_reset,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,2,"Zeroes or reinitializes one small auxiliary route-entry tracker record. The helper seeds the two endpoint-entry ids at `+0x04` and `+0x08` to `-1`, clears the small refcount at `+0x10`, clears the cached route-key and class-signature words at `+0x18` and `+0x1e`, resets the boolean latch at `+0x1c` to `0`, and clears the trailing payload band through `+0x42`. Current grounded callers are the tracker allocator paths at `0x004a42b0` and several neighboring `0x006cfcb4` setup sites, so this is the clearest current initializer for the auxiliary route-entry tracker family.","objdump + caller xrefs + field-layout inspection + tracker-family correlation"
0x00494e90,15,aux_route_entry_tracker_seed_owner_entry_id,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,2,"Seeds one auxiliary route-entry tracker with its owner or primary route-entry id. The helper writes the caller-supplied id into tracker field `+0x00` and clears the small accumulator fields at `+0x42` and `+0x46`. Current grounded callers are the tracker allocator paths at `0x004a42b0`, which use it immediately after allocating one `0x006cfcb4` record keyed by a route-entry id.","objdump + caller xrefs + field-layout inspection + tracker-family correlation"
0x00494eb0,15,aux_route_entry_tracker_adjust_refcount,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,2,"Adds the caller-supplied delta into the small refcount field at tracker offset `+0x10` and returns the updated total. Current grounded callers are the collection-side tracker updater `0x004a4340`, where a zero result triggers the tracker's destruction path.","objdump + caller xrefs + field-layout inspection + tracker-family correlation"
0x00494ed0,26,aux_route_entry_tracker_contains_endpoint_entry_id,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,2,"Small membership probe over one auxiliary route-entry tracker. The helper returns `1` when the caller-supplied route-entry id matches either tracker endpoint slot `+0x04` or `+0x08`, and `0` otherwise. Current grounded callers include several tracker-regroup and repair branches around `0x00490d62`, `0x0049a9ed`, `0x0049f162`, and `0x004a4ce0`, where it acts as the cheap endpoint-membership test beneath adjacent-chain transfer and duplicate-split logic.","objdump + caller xrefs + field-layout inspection + tracker-family correlation"
0x00494f00,176,aux_route_entry_tracker_merge_or_bind_endpoint_entry,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Binds one route-entry id into the two-endpoint auxiliary tracker record. The helper resolves the supplied route-entry through `0x006cfca8`, derives one route-key-like value through `0x0048aa70`, reads the route-entry signature fields at `+0x22e` and byte `+0x44`, and then either seeds both endpoint slots `+0x04/+0x08` on the first bind or merges the new entry into one side when the signature, route-key, and boolean class latch match the tracker's existing state. On failure it returns `0`; on success it returns `1`. Current grounded callers are the synthesis-side lane in `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` and several neighboring `0x006cfcb4` tracker update branches around `0x0049f1ce`, `0x0049f38d`, `0x0049f90b`, `0x004a4685`, `0x004a4830`, `0x004a4982`, `0x004a5175`, and `0x004a5189`. This now looks like the tracker-side endpoint bind or merge helper rather than a generic route-entry accessor.","objdump + caller xrefs + callsite inspection + tracker-family correlation"
0x00494fb0,97,aux_route_entry_tracker_refresh_boolean_class_latch_and_notify_owner,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Refreshes the small boolean class latch at tracker offset `+0x1c` and notifies the owning route-entry group when that latch changes. When the route-store latch `[0x006cfca8+0xf1]` is clear, the helper resolves the current endpoint-entry ids from `+0x04` and `+0x08`, recomputes whether the bound endpoint pair carries the nonzero route-entry byte `+0x44` on both sides, writes the resulting boolean back into `+0x1c`, compares it against the previous latch value, and on change calls `0x004a6360` on the auxiliary tracker collection `0x006cfcb4` with the owner entry id at `+0x00`. Current grounded callers are the neighboring route-state branch at `0x004915e0` and the compatible endpoint-slot rewrite helper `aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch` `0x004950f0`. This now looks like the tracker-side boolean class-latch refresh plus owner-notify path rather than a generic predicate helper.","objdump + caller xrefs + callsite inspection + tracker-family correlation + owner-notify correlation"
0x00495020,188,aux_route_entry_tracker_refresh_cached_match_fields_and_maybe_split_duplicate_pair,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + field-layout inspection,3,"Refreshes one auxiliary tracker's cached match metadata and clears its trailing relationship payload band. Under two scenario-threshold branches keyed by `[0x006cec78+0x46c34]`, the helper seeds or refreshes tracker cache fields from the currently bound endpoint pair: it derives one route-key-like value through `0x0048aa30`, reuses one endpoint signature word from route-entry field `+0x22e`, and falls back to constant `1` when no endpoint slot is available on the active branch. After that it zeroes the trailing payload band at `+0x24..+0x46`. When both endpoint slots `+0x04` and `+0x08` still point to the same route-entry id and the tracker refcount `+0x10` is greater than `1`, it tail-calls the deeper split or reseed path at `0x004a51a0` with the owner route-entry id at `+0x00`. Current grounded caller is the broader tracker-side branch at `0x004a41b0`. The current objdump shape keeps the exact `+0x18/+0x1e` destination split slightly irregular on the second threshold path, so this row stays conservative about the final field assignment while still grounding the helper as cached-match refresh plus duplicate-pair split prep.","objdump + caller xrefs + callsite inspection + field-layout inspection + tracker-family correlation"
0x004950f0,128,aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Rewrites one matching endpoint slot in an auxiliary tracker after compatibility checks. The helper validates the replacement route-entry id, derives its route-key-like value through `0x0048aa70`, requires that value plus the route-entry signature word `+0x22e` to match the tracker's cached comparison fields, and then only replaces endpoint slot `+0x04` or `+0x08` when the caller-supplied old endpoint id currently occupies that slot. After any replacement it re-enters `aux_route_entry_tracker_refresh_boolean_class_latch_and_notify_owner` `0x00494fb0` so the boolean class latch at `+0x1c` stays in sync. It returns `1` when a slot was replaced and `0` otherwise. Current grounded callers include the route-search core `0x0049d380`, the broader regrouping pass `0x004a45f0`, the neighboring route-state helpers at `0x00490bf0` and `0x004996e0`, and the tracker-side link-rewrite family at `0x004a4ce0`. This now looks like the compatibility-checked endpoint-slot rewrite helper beneath the auxiliary tracker family rather than a generic record mutator.","objdump + caller xrefs + callsite inspection + tracker-family correlation + endpoint-slot rewrite correlation"
0x004955b0,43,route_entry_collection_map_track_lay_mode_to_endpoint_policy_byte,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Small mapper from the live TrackLay primary mode into one of the endpoint-synthesis policy bytes consumed by `route_entry_collection_create_endpoint_entry_from_coords_and_policy` `0x00493cf0`. The helper returns `1` immediately when the caller-supplied mode dword is `1`; otherwise it inspects two route-store state fields at `[this+0x1e1]` and `[this+0x1fd]` before either keeping that same `1` fallback or returning `4`. Current grounded callers are the TrackLay-side branches at `0x0050df00` and `0x0050eea8`, where the input mode comes directly from the shared TrackLay state at `0x00622b0c` already bounded as `Lay single track.` `0x1`, `Lay double track.` `0x4`, and `Bulldoze` `0x40`. That makes the strongest current read `policy 1 = single-track endpoint synthesis` and `policy 4 = double-track endpoint synthesis`, with one route-store-state-dependent fallback still preventing a fully closed user-facing name.","objdump + caller xrefs + callsite inspection + TrackLay mode correlation + partial-policy-byte correlation"
0x004952f0,208,math_compute_quadrant_adjusted_heading_angle_from_xy_pair,map,cdecl,inferred,objdump + caller xrefs + arithmetic inspection,4,"Computes one quadrant-adjusted heading angle from two float XY point pairs. The helper handles the vertical-line degeneracy explicitly by returning `pi/2` or `3*pi/2`, otherwise computes one arctangent ratio through the CRT helper at `0x005a1270` and then adds either `pi` or `2*pi` when the caller's delta pair lands in the corresponding quadrant. The result is a normalized heading-like angle in the `0 .. 2*pi` range. Current grounded callers include the route-entry search family at `0x004a01a0`, `0x0049d380`, and `0x0049c900`, plus several neighboring route and world-side geometry branches.","objdump + caller xrefs + arithmetic inspection + constant correlation"
0x004953c0,95,math_normalize_subtracted_angle_delta_and_report_wrap,map,thiscall,inferred,objdump + caller xrefs + arithmetic inspection,4,"Subtracts one angle from another and normalizes the resulting delta back into the principal `[-pi, pi]` range. When the optional pointer in `ECX` is nonnull the helper clears it to `0`, then sets it to `1` only when the delta had to be wrapped by adding or subtracting `2*pi`. Current grounded callers include the route-entry search family at `0x0049d380` and `0x0049c900`, several route-node or waypoint geometry branches, and neighboring world-side angle tests. This now grounds `0x004953c0` as a reusable wrapped-angle-delta helper rather than another anonymous quality check.","objdump + caller xrefs + arithmetic inspection + constant correlation"
0x0049d380,1134,route_entry_collection_search_path_between_entry_or_coord_endpoints,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavy internal route-search core beneath the route-entry synthesis family. The helper accepts a leading route-entry id, one company id, two endpoint coordinate pairs, a route-policy tuple, one optional external target entry id, and several scratch or output buffers. It begins by validating the company id through `0x0062be10` and `company_query_available_track_laying_capacity_or_unlimited` `0x004240a0` when present, then packages the current search context into the collection-owned builder state, including one current-search latch at `[this+0x1d5]` and one distance-like scalar at `[this+0x1d1]`. From there it runs three bounded internal stages. First, it enters the deeper candidate path sweep at `0x0049bd40`; this can return a direct matching route-entry id or leave the search unresolved. Second, when that first stage does not settle the search, it rehydrates the returned route entry through `0x0048a170`, evaluates point-to-point distance, span, and angle-like quality terms through `math_measure_float_xy_pair_distance` `0x0051db80`, `0x004952f0`, `0x004953c0`, and `0x005a152e`, and only accepts the result when those quality gates pass. Third, when the quality gates or initial sweep fail, it can fall back to route-entry extension helpers `0x00494cb0` and `0x0049c900`, plus route-state propagation through `0x0048e600`, while rewriting several collection-side path blocks rooted at `[this+0x169]`, `[this+0x175]`, `[this+0x181]`, `[this+0x18d]`, `[this+0x199]`, `[this+0x1a5]`, `[this+0x1b1]`, and `[this+0x1bd]`. The function returns one resolved route-entry id or `-1`, and current direct callers are only internal route-entry family wrappers at `0x004a0470`, `0x004a0870`, `0x004a0b2a`, and `0x004a0cef`. In current evidence this is the search core that the higher wrapper `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` hands off to after endpoint reuse or synthesis, rather than a user-facing route mutator by itself.","objdump + caller xrefs + callsite inspection + path-search correlation + builder-state correlation + distance-helper correlation + track-laying-capacity correlation"
0x0049bd40,982,route_entry_collection_run_initial_candidate_path_sweep,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Runs the first candidate route sweep beneath `route_entry_collection_search_path_between_entry_or_coord_endpoints` `0x0049d380`. The helper clears any prior temporary path list through `0x0049ad90`, seeds two caller-owned status dwords, resolves the starting route-entry id through the collection, rejects one trivial or degenerate local-delta case, and then seeds an initial extension attempt through `0x00494cb0`. From there it builds one temporary candidate chain in `[this+0x1cd]`, derives route quality terms from point-to-point distance through `math_measure_float_xy_pair_distance` `0x0051db80`, re-enters the route-node search against the auxiliary tracker collection `0x006cfcb4` through `0x004a6630`, and on a passing result publishes one follow-on route-entry id through the caller-supplied output slot. Current evidence now narrows the internal quality policy too: when the route-state gate at `[this+0xe9]` stays clear the helper selects a larger quality multiplier of `1.8` on route-policy byte `4` or field `[0x006cec78+0x4c74]`, and otherwise uses `1.4`; the same branch also folds in one signed angle-bias term `+/-0.181000038854627` before the later acceptance checks. That field is still the same player-facing TrackLay preference slot grounded elsewhere as `Auto-Show Grade During Track Lay`, but on this route-search lane it now reads more concretely as a temporary search-quality override: the shared city-connection builder `0x00402cb0` and the broader company periodic pass `0x004019e0` both mirror electric-locomotive context into it specifically to force this same larger initial-sweep multiplier branch. Current grounded direct caller is the search core `0x0049d380`, where this helper is the first stage before the later quality-gate and extension fallbacks. This now looks like the initial candidate path sweep rather than a generic collection iterator.","objdump + caller xrefs + callsite inspection + candidate-sweep correlation + tracker-family correlation + quality-threshold constant correlation + distance-helper correlation + temporary-override correlation"
0x0049c900,829,route_entry_collection_try_extend_search_frontier_toward_target_coords,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Tries to extend the current route-search frontier toward one target coordinate pair. The helper starts from two endpoint coordinate pairs plus one caller-owned result slot, initializes that result slot to `-1`, computes span and angle-like quality terms through `0x004952f0`, `0x005a152e`, and the same constant families used by the search core, and then repeatedly advances the search sample window until one candidate route extension passes the quality thresholds. Current evidence now narrows those thresholds too: this helper reuses the same signed angle-bias family `+/-0.181000038854627` seen in the initial candidate sweep before deciding whether to probe a covering entry. On successful passes it re-enters `route_entry_collection_try_find_route_entry_covering_point_window` `0x00494cb0`, verifies the returned entry through `0x0048ba40`, `0x004953c0`, and neighboring state bytes, and publishes the accepted route-entry id through the caller-owned result pointer. On failure it leaves that pointer at `-1`. Current grounded direct callers are the search core `0x0049d380` and the neighboring route wrapper at `0x004a0740`, which together make this the clearest current extension or frontier-advance helper beneath the route-entry search family rather than a free-standing world query.","objdump + caller xrefs + callsite inspection + frontier-extension correlation + quality-threshold constant correlation"
0x00494cb0,398,route_entry_collection_try_find_route_entry_covering_point_window,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Searches the current route-entry collection for one entry whose sampled span covers the caller's point window. The helper rejects immediately when the supplied window radius is nonpositive, quantizes the caller's center coordinates into world-grid bounds, iterates the resulting rectangular tile window inside `0x0062c120`, and repeatedly re-enters `0x004921a0` on each candidate tile or route bucket until it finds one acceptable route-entry id. Current grounded callers include the station-attachment validation lane at `0x00403d30`, the placement validator at `0x00417ba1` and `0x0041a2c9`, the world-side route mutation lane at `0x00480d88`, the initial candidate sweep `0x0049bd40`, the search core `0x0049d724`, and several neighboring route-search branches. This now looks like the shared route-entry point-window coverage query beneath both placement-side track attachment and the heavier route-entry search family rather than a generic tile scan.","objdump + caller xrefs + callsite inspection + world-grid correlation + route-window correlation"
0x004a42b0,79,aux_route_entry_tracker_collection_allocate_entry,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Allocates one new tracker record in the auxiliary route-entry collection at `0x006cfcb4` and seeds it for one owner route-entry id. The helper resets a small local tracker template through `aux_route_entry_tracker_reset` `0x00494e40`, allocates one live record from the collection through `0x00518900`, resolves that record, seeds its owner entry id through `aux_route_entry_tracker_seed_owner_entry_id` `0x00494e90`, and returns the new tracker id. Current grounded callers include `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` and several neighboring route-state branches at `0x0049e174`, `0x0049e3d8`, `0x0049e427`, `0x0049e45c`, `0x0049f1b0`, `0x0049f3b5`, `0x0049f91a`, `0x004a466d`, `0x004a4814`, `0x004a4966`, and `0x004a5054`, so this is now the clearest current allocator for the auxiliary route-entry tracker family.","objdump + caller xrefs + callsite inspection + tracker-family correlation"
0x004a4340,55,aux_route_entry_tracker_collection_adjust_refcount_or_destroy,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Looks up one tracker record in the auxiliary route-entry collection at `0x006cfcb4`, adjusts its small refcount through `aux_route_entry_tracker_adjust_refcount` `0x00494eb0`, and destroys the record through the collection vtable when the resulting count reaches zero. Current grounded callers include the synthesis-side lane in `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` and several neighboring route-state branches at `0x00490da5`, `0x0049a9b8`, `0x0049abca`, `0x0049f178`, `0x0049f1a2`, `0x0049f1e0`, `0x0049f37e`, `0x0049f3a7`, `0x004a4f9c`, `0x004a4fb0`, and `0x004a5161`. This now looks like the shared refcount or destroy path for the auxiliary route-entry tracker family rather than another anonymous collection helper.","objdump + caller xrefs + callsite inspection + tracker-family correlation"
0x004a4380,619,aux_route_entry_tracker_collection_try_split_route_entry_chain_into_fresh_group,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Broader prepass beneath the auxiliary route-entry tracker regrouping family at `0x006cfcb4`. Starting from one existing tracker id, the helper snapshots the source tracker's cached match tuple at `+0x18/+0x1c/+0x1e` plus its endpoint slots `+0x04/+0x08`, walks the adjacent route-entry chain through the `+0x206/+0x20a/+0x20e` family, and watches for a subchain whose route-key-like value from `0x0048aa70`, signature word `+0x22e`, or boolean class byte `+0x44` no longer matches the source tracker. When that mismatch survives the surrounding guards, it allocates one fresh tracker through `aux_route_entry_tracker_collection_allocate_entry` `0x004a42b0`, seeds or binds the moved entries through `aux_route_entry_tracker_seed_owner_entry_id` `0x00494e90` and `aux_route_entry_tracker_merge_or_bind_endpoint_entry` `0x00494f00`, reassigns the traversed route entries through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, and rebalances the two trackers' counts through `aux_route_entry_tracker_adjust_refcount` `0x00494eb0`. Current grounded direct caller is `aux_route_entry_tracker_collection_refresh_route_entry_group_membership` `0x004a45f0`, where this helper runs as the early split prepass keyed by the current route entry's tracker id. This now looks like the chain-splitting helper that carves a mismatching adjacent subchain into one fresh tracker group rather than a generic collection walk.","objdump + caller xrefs + callsite inspection + tracker-family correlation + regrouping prepass correlation"
0x004a45f0,1420,aux_route_entry_tracker_collection_refresh_route_entry_group_membership,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavy regrouping pass over the auxiliary route-entry tracker collection at `0x006cfcb4`. The helper starts from one route-entry record, rejects the trivial case where both adjacent route-entry fields `[entry+0x206]` and `[entry+0x20a]` are unset, optionally runs `aux_route_entry_tracker_collection_try_split_route_entry_chain_into_fresh_group` `0x004a4380` keyed by the route entry's current tracker id in `[entry+0x212]`, and then refreshes ownership around that id. On the simpler branch it can allocate one fresh tracker through `aux_route_entry_tracker_collection_allocate_entry` `0x004a42b0`, bind one or more route-entry ids into it through `aux_route_entry_tracker_merge_or_bind_endpoint_entry` `0x00494f00`, assign the resulting tracker id back into route-entry field `+0x212` through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, and rebalance tracker refcounts through `aux_route_entry_tracker_adjust_refcount` `0x00494eb0`. The current endpoint-bind semantics are tighter now too: the bind helper groups entries only when their route-key-like value from `0x0048aa70`, route-entry signature word `+0x22e`, and boolean class latch derived from byte `+0x44` all agree. On the larger branch this pass walks adjacent route-entry links through the `+0x206/+0x20a/+0x20e` family, can re-enter `aux_route_entry_tracker_collection_try_transfer_adjacent_chain_between_groups` `0x004a4ce0` to migrate compatible neighboring subchains between tracker groups, uses `aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch` `0x004950f0` to rewrite compatible endpoint slots, and can re-enter the nearby cached-match refresh path `0x00495020` before dropping empty tracker records through the collection vtable. Current grounded caller is `placed_structure_refresh_linked_site_display_name_and_route_anchor` `0x00480bb0`, where this pass runs immediately after literal-policy-`2` route-anchor rebuild and bind. This now looks like the auxiliary tracker regrouping pass beneath the broader linked-site route-anchor rebuild lane rather than a generic collection sweep.","objdump + caller xrefs + callsite inspection + tracker-family correlation + linked-site refresh correlation + endpoint-match-tuple correlation + chain-transfer correlation"
0x004a4c00,224,aux_route_entry_tracker_route_entry_pair_pass_adjacent_chain_transfer_gate,map,thiscall,inferred,objdump + callsite inspection + field-layout inspection,3,"Compatibility gate used before adjacent tracker-chain transfers. Given two route-entry records, the helper validates both current tracker ids in the auxiliary tracker collection at `0x006cfcb4`, resolves the two tracker records, and then requires a matching cached comparison tuple across both trackers: byte `+0x1d` must be nonzero on both sides, dwords `+0x18` and `+0x1e` must match, and boolean latch byte `+0x1c` must match. It also requires both candidate route entries to keep their special side fields at `+0x20e` and `+0x222` unset at `-1`. Only when all of those checks pass does it return `1`; otherwise it returns `0`. Current grounded direct caller is `aux_route_entry_tracker_collection_refresh_owner_adjacent_compatible_group_links` `0x004a6360`, where this gate sits directly above the adjacent-chain transfer helper `0x004a4ce0`. This now looks like the reusable adjacent-chain transfer compatibility gate rather than a generic pairwise predicate.","objdump + callsite inspection + field-layout inspection + tracker-family correlation + transfer-gate correlation"
0x004a4ce0,777,aux_route_entry_tracker_collection_try_transfer_adjacent_chain_between_groups,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Reusable cross-group migration helper beneath the auxiliary route-entry tracker collection at `0x006cfcb4`. Given two tracker ids plus one cached match tuple, the helper first verifies that collection-busy latches are clear, validates the destination tracker's cached fields at `+0x18/+0x1c/+0x1d/+0x1e`, then walks one adjacent route-entry chain through the `+0x206/+0x20a/+0x20e` family while using `aux_route_entry_tracker_contains_endpoint_entry_id` `0x00494ed0` to avoid trampling the destination tracker's existing endpoint entries. Compatible traversed entries are reassigned into the destination group through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, source and destination tracker populations are rebalanced through `aux_route_entry_tracker_collection_adjust_refcount_or_destroy` `0x004a4340` and the raw `+0x14` count field, and the destination endpoint slots can be rewritten through `aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch` `0x004950f0` before any emptied source tracker is destroyed. Current grounded callers include the owner-refresh family at `0x004a6360` plus neighboring route-state branches at `0x0049ac78`, `0x0049ff6e`, and `0x004a645a..0x004a65a3`. This now looks like the adjacent-chain transfer helper between compatible tracker groups rather than a generic collection mutator.","objdump + caller xrefs + callsite inspection + tracker-family correlation + adjacent-chain transfer correlation"
0x004a4ff0,454,aux_route_entry_tracker_collection_reseed_group_from_route_entry_component,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Repair or reseed helper over the auxiliary route-entry tracker collection at `0x006cfcb4`. Starting from one route-entry id whose current tracker membership is missing or invalid, the helper allocates one fresh tracker through `aux_route_entry_tracker_collection_allocate_entry` `0x004a42b0`, assigns that tracker id into the starting entry through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, walks the connected route-entry component through `0x0048e140` and `0x0048e160`, and migrates each adjacent member that still carries the stale tracker id into the new group while counting the moved entries. It then updates the involved tracker populations, binds the new component's endpoint entries back into the fresh tracker through two calls to `aux_route_entry_tracker_merge_or_bind_endpoint_entry` `0x00494f00`, and returns. Current grounded callers include the route-state repair branch at `0x0048b896` and the broader tracker traversal pass at `0x004a6244`. This now looks like the component-level tracker-group reseed helper used when a route-entry component has lost valid tracker ownership rather than a generic regrouping walk.","objdump + caller xrefs + callsite inspection + tracker-family correlation + reseed correlation"
0x004a5fc0,928,aux_route_entry_tracker_collection_refresh_component_labels_and_reseed_invalid_groups,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Collection-wide traversal refresh for the auxiliary route-entry tracker family at `0x006cfcb4`. The helper clears the collection dirty latch at `[this+0x8c]`, allocates one temporary queue array at `[this+0x94]`, resets every live tracker's traversal label field at `+0x0c` to `-1`, and then repeatedly walks connected tracker groups until every live record has one stable component label. While traversing, it destroys dead tracker records whose active count has fallen nonpositive, follows adjacent route-entry links outward from each tracker endpoint through the `+0x206/+0x20a/+0x20e` route-entry family, and when one neighboring route entry carries an invalid tracker id it repairs that side immediately through `aux_route_entry_tracker_collection_reseed_group_from_route_entry_component` `0x004a4ff0` before continuing the walk. The refreshed component labels are stored back into tracker field `+0x0c`, and neighboring collection-side queries reuse them after the dirty latch has been cleared. Current grounded callers are the adjacent tracker-query helper at `0x004a6320` and neighboring owner-refresh branches that first test `[this+0x8c]` before trusting cached component labels. This now looks like the collection-wide connected-component refresh and invalid-group reseed pass rather than a generic sweep.","objdump + caller xrefs + callsite inspection + tracker-family correlation + traversal-label correlation + reseed correlation"
0x004a6360,592,aux_route_entry_tracker_collection_refresh_owner_adjacent_compatible_group_links,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Owner-side adjacent-group refresh beneath the auxiliary route-entry tracker family at `0x006cfcb4`. Starting from one owner route-entry id, the helper validates the current tracker, requires its tracker-side enable byte `+0x1d` to be nonzero, resolves the two bound endpoint entries from tracker slots `+0x04` and `+0x08`, and first requires those endpoint entries to agree on the boolean class state derived from route-entry byte `+0x44`. It then inspects adjacent route-entry links hanging off both endpoint sides through the `+0x206/+0x20a` family and, whenever a neighboring route entry belongs to a different tracker group, runs `aux_route_entry_tracker_route_entry_pair_pass_adjacent_chain_transfer_gate` `0x004a4c00` before re-entering `aux_route_entry_tracker_collection_try_transfer_adjacent_chain_between_groups` `0x004a4ce0` to migrate that compatible adjacent chain into the owner's tracker group. Current grounded caller is `aux_route_entry_tracker_refresh_boolean_class_latch_and_notify_owner` `0x00494fb0`, which invokes this helper only when the tracker's boolean class latch at `+0x1c` changes. This now looks like the owner-adjacent compatible-group refresh path triggered by latch changes rather than a generic tracker walk.","objdump + caller xrefs + callsite inspection + tracker-family correlation + owner-refresh correlation + compatibility-gate correlation"
0x004a62c0,79,aux_route_entry_tracker_query_tracker_component_labels_match,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Small dirty-aware equality test over tracker component labels in the auxiliary route-entry tracker collection at `0x006cfcb4`. Given two tracker ids, the helper first refreshes stale labels through `aux_route_entry_tracker_collection_refresh_component_labels_and_reseed_invalid_groups` `0x004a5fc0` when collection dirty latch `[this+0x8c]` is set, resolves both tracker records, and returns `1` only when both ids are live and tracker field `+0x0c` matches across the pair. Invalid tracker ids return `0`. Current grounded callers include the alternate recursive pair-metric branch at `0x004a5900`, where this helper gates same-component recursion before adjacent-neighbor expansion.","objdump + caller xrefs + callsite inspection + tracker-family correlation + component-label equality correlation"
0x004a6320,64,aux_route_entry_tracker_collection_query_component_label_by_tracker_id,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Dirty-aware query helper over the auxiliary route-entry tracker collection at `0x006cfcb4`. The helper first checks collection dirty latch `[this+0x8c]` and re-enters `aux_route_entry_tracker_collection_refresh_component_labels_and_reseed_invalid_groups` `0x004a5fc0` when the cached component labels are stale. It then validates the caller-supplied tracker id through the collection, resolves the live tracker record, and returns the connected-component label stored in tracker field `+0x0c`; invalid tracker ids return `-1`. Current grounded callers are the heavier pair-selection family around `0x004a6630`, where this helper is the reusable query side of the component-label sweep rather than another traversal owner.","objdump + caller xrefs + callsite inspection + tracker-family correlation + component-label query correlation"
0x004a65b0,128,aux_route_entry_tracker_dispatch_route_entry_pair_metric_query,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Build-compatibility-switched lower metric query beneath the auxiliary route-entry tracker pair-selection family. The helper forwards one fixed route-entry pair, one companion output pair, and the surrounding score or scratch arguments into one of two heavier internal algorithms: it dispatches to `0x004a5280` when the shared build-version query at `runtime_query_hundredths_scaled_build_version` `0x00482e00(0x006cec74)` reports at least `0x67`, and otherwise dispatches to `0x004a5900`. The recovered cutovers now line up with executable build values `0x67/0x68/0x69/0x6a == 1.03/1.04/1.05/1.06`, and the version source itself can come from either the local `RT3.EXE` version resource or the multiplayer session-side companion path at `0x0046a4b0`, so this branch now reads most safely as a pre-`1.03` versus `1.03+` route-metric compatibility dispatcher rather than any gameplay time or era gate. Current grounded caller is the broader chooser at `0x004a6630`, which can invoke this helper repeatedly across multiple endpoint combinations, keep the smallest non-`-1` returned score, and publish the chosen route-entry pair through out pointers. Current evidence is therefore tight enough to treat this as the reusable route-entry-pair metric dispatcher beneath that chooser, while the deeper user-facing meaning of the returned metric still lives mostly in the linked-transit and route-validation consumers rather than inside this switch itself.","objdump + caller xrefs + callsite inspection + tracker-family correlation + pair-metric correlation + version-gate correlation + multiplayer-session-version correlation"
0x004a5280,1664,aux_route_entry_tracker_query_route_entry_pair_metric_via_weighted_recursive_search,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavier weighted search branch beneath the auxiliary tracker pair-metric family. Starting from one source route-entry id and one target route-entry id, the helper validates tracker membership, can require endpoint-capable entry type byte `[entry+0x216] == 2` when the caller's looser gate is clear, and on top-level entry initializes one global prune threshold at `0x006cfcb0` plus one per-tracker best-cost cache at `0x006cfcac`. It then evaluates up to four candidate continuations: one direct paired-side route entry plus adjacent links `+0x206`, `+0x20a`, and `+0x20e`. For each surviving candidate it resolves route-entry coordinates through `0x0048a170`, computes one float heuristic through `0x0051dbb0`, orders the candidates by that heuristic, accumulates integer step and mismatch penalties, and recursively re-enters itself while pruning against the current best threshold and the per-tracker cache. On success it writes the best integer metric back through one out pointer, the paired companion metric through another, and returns one chosen downstream route-entry id; top-level calls free the temporary cache block before returning. Current grounded direct callers are the mode-switched dispatcher `0x004a65b0` and internal recursive self-calls. This now looks like the weighted recursive route-entry-pair metric search rather than a generic tracker walk.","objdump + caller xrefs + callsite inspection + tracker-family correlation + weighted-search correlation + heuristic-ordering correlation + recursive-search correlation"
0x004a5900,1728,aux_route_entry_tracker_query_route_entry_pair_metric_via_recursive_neighbor_walk,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Alternate recursive neighbor-walk metric branch beneath the auxiliary tracker pair-metric family. Starting from one source route-entry id and one target route-entry id, the helper validates top-level endpoint eligibility in the same broad way as `0x004a5280`, initializes the same global prune threshold and per-tracker cache on top-level entry, and then recursively explores neighboring route entries through the `+0x206`, `+0x20a`, and `+0x20e` link family. The search stays within compatible tracker-component context through `aux_route_entry_tracker_query_tracker_component_labels_match` `0x004a62c0`, applies optional boolean-class and company gates through tracker latch byte `+0x1c` and `0x00424010`, and accumulates one integer route-step count plus one mismatch penalty count, adding extra cost when route-entry signature word `+0x22e` differs from the caller-supplied filter. The best surviving branch writes the minimal metric and companion penalty back through out pointers, and top-level calls free the temporary per-tracker cache block before returning one chosen downstream route-entry id or one adjacent fallback entry when no recursive hit survives. Current grounded direct callers are the mode-switched dispatcher `0x004a65b0` and internal recursive self-calls. This now looks like the simpler recursive neighbor-walk metric query beneath the weighted branch rather than a generic collection scan.","objdump + caller xrefs + callsite inspection + tracker-family correlation + recursive-neighbor-walk correlation + component-label correlation"
0x004a6630,892,aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavier chooser above the auxiliary route-entry tracker pair-metric dispatcher. Given two route-entry ids plus several out slots and optional gates, the helper validates both route entries and their tracker ids, rejects one caller-requested boolean-class mismatch when the source route-entry byte `+0x44` stays clear, and then has two bounded modes. When both entries pass `0x0048b870`, it directly re-enters `aux_route_entry_tracker_dispatch_route_entry_pair_metric_query` `0x004a65b0` for that fixed pair. Otherwise it resolves the current tracker endpoint slots `+0x04/+0x08` for both sides, derives up to four endpoint-pair combinations from those two tracker groups, and invokes `0x004a65b0` on each surviving combination while keeping the smallest non-`-1` returned metric. The winning route-entry id and companion peer id are written back through out pointers, and current grounded callers reuse the chooser beneath the initial candidate route sweep `0x0049bd40`, the company linked-transit peer-cache builder `0x004093d0`, and the train route validator `0x004b2c10`. This now looks like the best route-entry-pair metric chooser with tracker-endpoint fallbacks rather than a generic sweep.","objdump + caller xrefs + callsite inspection + tracker-family correlation + endpoint-fallback correlation + pair-chooser correlation"
0x004a77b0,24,train_resolve_linked_route_object_or_null,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Tiny train-side resolver over linked route-object id `[train+0x41]`. The helper treats `-1` as empty, otherwise resolves that id through collection `0x0062ba84` via `0x00518140` and returns the live linked route object pointer. Current grounded callers are broad and consistent: the whistle command `0x00441870`, the multiplayer train-apply and callback families at `0x0046d780`, `0x0046e250`, and `0x00470bb0`, the train list renderers around `0x004e7670`, and many neighboring simulation-side train helpers. This is therefore the safest current read for the shared train-to-linked-route-object resolver rather than a metrics-owner-only helper.","objdump + local disassembly + caller inspection + linked-route-object correlation + train-family correlation"
0x004a77d0,51,train_query_linked_route_object_metric_pair_or_default_10f,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small train-side wrapper above the linked route-object metric helper `0x0041add0`. When linked route-object id `[train+0x41]` is live, the helper resolves that route object through collection `0x0062ba84` and tail-calls `0x0041add0` with the original two out-float pointers. When the train has no linked route object, it instead writes `10.0f` to both caller out-float slots and returns. Current evidence is strongest for a generic two-float linked-route metric pair rather than a narrower semantic name, but the default path and ownership boundary are now explicit.","objdump + local disassembly + caller inspection + linked-route-object correlation + two-float-out-parameter correlation"
0x004a7810,183,train_refresh_linked_route_object_steam_emitter_enable_flags,simulation,thiscall,inferred,objdump + local disassembly + caller inspection + effect-family correlation,3,"Iterates the linked route-object row band rooted at `[route+0x316]` / count `[route+0x31a]` after resolving the train's linked route object through `[train+0x41]`. For each `0xc0`-stride row it probes the optional emitter definition at `[row+0x60]`, uses `effect_name_matches_literal_steam` `0x004749a0` to separate the literal `steam` family, and then either clears row byte `[row+0x1d8]`, resets scalar `[row+0xcc]` to `1.0f`, and re-enters `0x00554920`, or sets `[row+0x1d8] = 1` on the non-steam or missing-emitter branch. This is the safest current read for the linked-route-object steam-emitter enable-state refresh rather than a broader train visual owner.","objdump + local disassembly + caller inspection + effect-family correlation + linked-route-object correlation + row-band correlation"
0x004a9460,65,train_current_route_context_uses_strict_reachability_mode,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Small boolean gate keyed off the train's current linked route object at `[this+0x41]`. The helper resolves that route object through `0x0062ba84`, follows its class or profile reference through `0x0041adb0`, uses the resulting id at `[profile+0x126]` to query the small class table rooted at `0x006ada84`, and returns `1` only when the final type field at `[entry+0x10]` equals `2`. Current grounded callers include the local and multiplayer route-entry insertion success paths at `0x00515430` and `0x004718fe`, where a true result triggers the stricter second `train_route_list_validate_reachability_and_station_pair` pass before mode `0x13` is selected, and several neighboring simulation branches such as `0x004ad5e2` and `0x004b1ec5` that use the same gate before re-entering the stronger route-state path. Current evidence is therefore tight enough to treat this as a shared current-route-context gate for the stricter reachability or operating-mode family even though the player-facing meaning of class type `2` remains open.","objdump + caller xrefs + callsite inspection + route-context correlation"
0x004a94b0,381,train_finalize_aux_route_entry_buffer_preserving_subflags,simulation,thiscall,inferred,objdump + caller xrefs + route-entry inspection,3,"One train-side cleanup or finalize helper over the auxiliary route-entry wrapper at `[this+0x1c6]`. When that wrapper is present, the helper walks the embedded `0x33`-stride route-entry list rooted at `[aux+0x0c]`, rewrites one bounded payload band back into the selected entries, and explicitly preserves route-entry flag bits `0x40`, `0x20`, and `0x10` in byte `+0x28` across the rewrite. It then frees the auxiliary wrapper through `0x005a1145` and clears `[this+0x1c6]`. Current grounded caller is the larger train-side route-state branch at `0x004b0cf0`, where this helper sits behind the scenario-state gate at `0x00434050` and ahead of the later current-route-entry resolution path. Current evidence is therefore strong enough to treat this as an auxiliary route-entry buffer finalize step that preserves the lower route-entry subflags even though the exact player-facing meaning of those bits remains open.","objdump + caller xrefs + route-entry inspection + auxiliary-buffer correlation"
0x004ad7a0,595,train_trigger_crash_state_effects_and_optional_owner_notifications,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng strings,3,"Broader train-side crash owner reached both from the cheat-code selector branch in `shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats` `0x00437d70` and from the direct shell command strip around `0x00441810`, where localized id `365` warns `There is no train available to crash!` when no candidate train survives. The helper first enforces the usual crash-side global gates: it rejects when shell byte `[0x006cec78+0x4c8e]` is already set, when world or shell latches under `0x006cec74` block the action, or when the train already carries a nonzero operating mode at `[train+0xe8]`. On the active path it resolves the current linked route object through `[train+0x41]`, marks route field `[route+0x33e]`, enables the shared three-selector and selector-`5` train-visual effect families through `train_visual_toggle_three_selector_effect_slots_and_reseed_shared_anchors` `0x0045cc90(1)` and its selector-`5` sibling `0x0045d1e0(1)`, clears several transient train fields `[+0x55/+0x59/+0x5d/+0x1a7]`, and then walks the linked route-object chain to drive byte `[train+0xf4]` plus the paired visual refresh lane through `0x0052fb70`, `0x0045c8d0`, and `0x004a8100`. It finishes by writing crash mode `0x11` into `[train+0xe8]`, seeding scalar `[train+0xec] = 0x46924000`, rebuilding the local event payload through `0x004a9360`, and, when the crashing train belongs to the currently selected company, publishing both a shell-side notice through `0x004554e0` and the follow-on company update through `0x00423fd0`. Current neighboring caller `0x004af9e8` also treats this body as the crash-side branch opposite `0x004ada00`, so the safest current read is the shared train crash-state, effect, and owner-notification owner rather than a generic operating-mode setter.","objdump + caller xrefs + local disassembly + RT3.lng strings + train-visual correlation + crash-command correlation + route-state correlation"
0x004ada00,543,train_trigger_breakdown_state_effects_and_optional_owner_notifications,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng strings,3,"Breakdown-state sibling of `train_trigger_crash_state_effects_and_optional_owner_notifications` `0x004ad7a0`. The helper is reached from the direct shell command strip around `0x004418a0`, where localized id `366` warns `There is no train available to break down!`, and from the neighboring train-state branch at `0x004af9f7`. It enforces the same crash-side global gates and the same `[train+0xe8] == 0` requirement, but on the active path it marks route field `[route+0x342]`, enables the selector-`5` and selector-`2` train-visual effect families through `0x0045cf40(1)` and `0x0045d1e0(2)`, clears the same transient train fields `[+0x55/+0x59/+0x5d/+0x1a7]`, and drives the same linked route-object byte `[train+0xf4]` plus refresh lane through `0x0052fb70`, `0x0045c8d0`, and `0x004a8100`. It then writes breakdown mode `0x12` into `[train+0xe8]`, seeds the same scalar `[train+0xec] = 0x46924000`, rebuilds the local event payload through `0x004a9360`, and, when the affected train belongs to the currently selected company, publishes the shell-side notice through `0x004554e0` and the paired company follow-on through `0x00423fe0`. Current neighboring caller `0x004af9f7` uses this body as the direct opposite branch of `0x004ad7a0`, so the safest current read is the shared train breakdown-state, effect, and owner-notification owner rather than another generic operating-mode setter.","objdump + caller xrefs + local disassembly + RT3.lng strings + breakdown-command correlation + train-visual correlation + route-state correlation"
0x004ab980,760,train_set_route_operating_mode_and_scalar,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Shared train-side mode setter beneath route editing and adjacent operating-state transitions. The helper clears several transient route-state fields at `[this+0x55]`, `[this+0x59]`, `[this+0x5d]`, and `[this+0x1a7]`, optionally rounds the caller-supplied scalar argument to an integer when the scenario-state gate at `0x00434050` is active, dispatches over mode ids `0..0x13`, and in several branches toggles the train byte at `[this+0xf4]` across the linked route-object chain rooted at `[this+0x41]` before notifying follow-on state refresh helpers `0x004a8100` or `0x004a81b0`. Every successful path writes the chosen mode id to `[this+0xe8]` and the final scalar to `[this+0xec]`. Current grounded callers include the local and multiplayer route-entry insertion success path at `0x004718a0` and `0x00515450`, which select mode `0x13` after the stricter post-insertion validation succeeds and mode `0x0a` after the looser fallback path. Current evidence is therefore tight enough to treat this as the shared train route operating-mode and scalar setter even though the player-facing names of the individual mode ids remain open.","objdump + caller xrefs + callsite inspection + mode-write correlation + route-edit correlation"
0x004b2b80,29,train_route_list_count_live_site_reference_entries,simulation,thiscall,inferred,objdump + caller xrefs + route-entry inspection,4,"Counts the subset of entries in the same train-owned `0x33`-stride route-entry list whose flag byte at `+0x28` is nonnegative. Current grounded callsites make that sign-bit split meaningful: sign bit clear entries are the live placed-structure-backed family, while sign bit set entries use the direct route-node payload side instead. Current callers include the shell-side formatter branches at `0x004be50c` and `0x004be53c`, plus the train purchase or readiness path at `0x005126c2`, where the count must reach at least `2` before the deeper route validation lane is allowed to continue. Current evidence is therefore tight enough to treat this as the shared count of live site-reference route entries rather than a generic row counter.","objdump + caller xrefs + route-entry inspection + callsite inspection"
0x004b2c10,656,train_route_list_validate_reachability_and_station_pair,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,4,"Shared route validator above the train route-entry insertion and edit family. The helper walks the same train-owned `0x33`-stride route-entry list and splits on route-entry flag byte `+0x28`: sign bit clear entries resolve live placed-structure ids from field `+0x29` through the placed-structure collection at `0x006cec20` before mapping those structures into the route-node collection at `0x006cfca8`, while sign bit set entries take one direct route-node payload from field `+0x2b`. It then re-enters `0x004a6630` for each successive route step and one optional caller-supplied external target. While scanning, it also tracks up to two distinct station-like placed-structure ids through `0x0047fd50`; the final result fails when any placed structure or route node cannot be resolved, when any `0x004a6630` sweep leaves the output marker at `-1`, or when the scan never accumulates both ends of that station pair. Current grounded callers include the local and multiplayer insertion paths at `0x004718a0` and `0x00515450`, where failure leads to localized route warnings `3089` `At least one station on the route is not connected to the others.`, `3090` `This train cannot reach the station you've selected.`, and `3091` `This train cannot reach the track waypoint you've selected.`. Current evidence is therefore tight enough to treat this as the shared route reachability and terminal-station-pair validator rather than a generic list scan.","objdump + caller xrefs + callsite inspection + RT3.lng strings + placed-structure correlation + route-warning correlation + route-entry flag split"
0x004b2f00,250,train_route_list_select_entry_and_refresh_linked_site_state,simulation,thiscall,inferred,objdump + caller xrefs + state-layout inspection,4,"Shared selector helper for one train-owned route-entry list whose records are `0x33` bytes wide. The helper clamps the requested selected index against the current count at `[this+0x4]`, stores the new selection in `[this+0x8]`, and only when route-entry flag byte `+0x28` has its sign bit clear does it extract the previous and new placed-structure ids from field `+0x29` and forward that old/new site pair into `0x004819b0`; sign bit set entries skip that placed-structure extraction path. It then refreshes the linked train-side state through `0x004abca0`, `0x004ad260`, and `0x004b2ea0`. When the caller requests it, it also marks the owning train record's byte `[train+0x1b9]`. Current grounded callers include the local `TrainDetail.win` route-entry branch at `0x00514a96`, the multiplayer-side route-entry handlers at `0x00471730` and `0x004097f9`, and the removal helper `train_route_list_remove_entry_and_compact` at `0x004b3000`. The same route family is now also tied to localized reachability warnings `3089..3091`, so this reads as a train route-stop or waypoint selection helper rather than a generic row selector.","objdump + caller xrefs + state-layout inspection + placed-structure-id correlation + route-warning correlation + route-entry flag split"
0x004b3000,341,train_route_list_remove_entry_and_compact,simulation,thiscall,inferred,objdump + caller xrefs + state-layout inspection,4,"Removes one entry from the same `0x33`-stride train-owned route list and compacts the remaining records. The helper validates the caller-supplied index against current count `[this+0x4]`, repairs the selected index `[this+0x8]`, re-enters `train_route_list_select_entry_and_refresh_linked_site_state` at `0x004b2f00` when the removed row was the selected one, allocates a shorter replacement buffer, copies the prefix and suffix segments around the removed row, decrements the list count, frees the old buffer, and then refreshes the linked train-side state through `0x004abca0`, `0x004ad260`, and `0x004b2ea0`. Current grounded callers include the local `TrainDetail.win` route-entry removal branch at `0x00515211` and the multiplayer-side handler at `0x00471823`.","objdump + caller xrefs + state-layout inspection + compacting-buffer correlation + route-list correlation"
0x004b3160,530,train_route_list_insert_staged_entry_at_index,simulation,thiscall,inferred,objdump + caller xrefs + state-layout inspection + RT3.lng strings,4,"Inserts one staged `0x33`-byte route-entry record into the same train-owned route list at one caller-selected index. Before insertion the helper seeds parts of the staged record from the prior terminal route entry and preserves the currently grounded lower route-entry subflags `0x40`, `0x20`, and `0x10` in field `+0x28`. That same flag byte also carries the top-level entry split: sign bit clear entries use one live placed-structure id in field `+0x29`, while sign bit set entries use one direct route-node payload in field `+0x2b`. Only the live site-reference branch can re-enter the narrower tutorial gate `tutorial_validate_train_route_station_indicator_step` at `0x00516d00`, and only when the staged placed-structure id is station-or-transit-like and the shell tutorial family rooted at `0x006d3b4c` is active. The helper then allocates a `(count+1)` replacement buffer, copies the prefix rows, writes the staged record at the requested insertion index, copies the suffix rows, frees the old buffer, bumps the count, repairs the selected index, and refreshes the linked train-side state. Current grounded callers include the local `TrainDetail.win` insertion or staging branch at `0x00515417`, the multiplayer-side handlers at `0x004718e5` and `0x004097eb`, and the nearby validation path that surfaces localized reachability warnings `3090` `This train cannot reach the station you've selected.` and `3091` `This train cannot reach the track waypoint you've selected.`. Current evidence is therefore tight enough to treat this as the route-stop or waypoint insertion helper above that validation family rather than as a generic record copier.","objdump + caller xrefs + state-layout inspection + RT3.lng strings + insertion-buffer correlation + route-warning correlation + route-entry flag split + subflag preservation"
0x00516be0,284,tutorial_advance_step_and_refresh_expected_control_ids,shell,cdecl,inferred,objdump + caller xrefs + local disassembly + tutorial-table inspection,4,"Advances one active shell tutorial step and refreshes the small expected-control cache under `0x00622b34..0x00622b3c`. The helper first returns immediately when the tutorial-active flag at `0x006d3b4c` is zero; otherwise it increments the current tutorial step index at `0x006d3b50`, consults the `0x40`-byte descriptor table rooted at `0x00622b48`, and skips several currently grounded step codes when their extra world or shell-state predicates fail. After choosing the next live step it copies the previous expected control id from `0x00622b34` into `0x00622b38`, then loads the new expected control id and one current alternate-accepted control id from descriptor offsets `+0x34` and `+0x38` into `0x00622b34` and `0x00622b3c`. Current shell-command correlation is now tight enough to support that narrower reading: the generic shell control path around `0x004de199` and `0x004de724` compares incoming control ids directly against `0x00622b3c` and suppresses the tutorial-only `3587` rejection when they match, which makes `0x00622b3c` look like a current companion control id rather than a page or mode selector. The helper also rate-limits one small shell-side nudge through `0x0045ea20` while the tutorial runs. Current grounded callers are the generic shell control path at `0x00540cca` and the train-route tutorial validator at `0x00516d93`, which makes this the current best owner for the tutorial step-advance and expected-control cache instead of leaving `0x00622b34/38/3c` as anonymous globals.","objdump + caller xrefs + local disassembly + tutorial-table inspection + control-cache correlation + shell-command correlation"
0x00516d00,143,tutorial_validate_train_route_station_indicator_step,shell,thiscall,inferred,objdump + caller xrefs + callsite inspection + nearby-state inspection + RT3.lng strings,4,"Small shell-side tutorial gate used before one live station-or-transit site id is committed into the train route-entry list. The helper only matters while the tutorial state family rooted at `0x006d3b4c` is active: it consults the current tutorial step index at `0x006d3b50`, reads that step's code from the `0x40`-byte tutorial descriptor table rooted at `0x00622b48`, and accepts only the currently grounded step codes `0x172` and `0x17c`, which align with localized tutorial prompts `3777` `Click on the yellow station indicator for Milan.` and `3778` `Now click on the station indicator for Turin`. For accepted steps it stages the caller-supplied site id into `0x006d3b5c` and, in the second step, advances the surrounding tutorial state through `0x00516be0` only when the incoming site differs from the currently staged one. For incompatible tutorial steps it opens one callback-driven shell modal through `0x004c98a0` and returns `0`, which causes `train_route_list_insert_staged_entry_at_index` at `0x004b3160` to abort before the record is inserted. Current evidence is therefore tight enough to treat this as the tutorial-side train-route station-indicator validator rather than a general `TrainDetail.win` row-kind gate.","objdump + caller xrefs + callsite inspection + nearby-state inspection + RT3.lng strings + modal correlation"
0x00517d40,66,indexed_collection_entry_id_is_live,simulation,thiscall,inferred,objdump + caller inspection + collection-bitset inspection,4,"Shared indexed-collection presence test over the common collection layout that uses `[this+0x14]` as the upper id bound and `[this+0x34]` as the tombstone or disabled-bitset. The helper rejects nonpositive or out-of-range ids and otherwise returns `1` only when the bit for the requested id is clear, i.e. when the entry is currently live. Current grounded callers include `shell_building_detail_refresh_subject_cargo_and_service_rows` `0x004ba3d0`, where it guards ordinary candidate ids before `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and neighboring collection walkers that treat the same ids as positive live-record selectors rather than zero-based dense ordinals.","objdump + caller inspection + collection-bitset inspection + callsite correlation"
0x00517cf0,3,indexed_collection_slot_count,simulation,thiscall,inferred,objdump + caller inspection + collection-layout inspection,4,"Tiny shared accessor that returns the current slot-count field `[this+0x18]` from the common indexed-collection layout. Current grounded callers use it as the upper bound for zero-based slot walks before resolving one nth live entry id through `indexed_collection_get_nth_live_entry_id` `0x00518380`.","objdump + caller inspection + collection-layout inspection + slot-walk correlation"
0x00518140,89,indexed_collection_resolve_live_entry_by_id,simulation,thiscall,inferred,objdump + caller inspection + collection-layout inspection,4,"Shared indexed-collection record resolver over the same common collection layout. The helper rejects nonpositive, out-of-range, or tombstoned ids through the `[this+0x14]` bound and `[this+0x34]` bitset, then returns one live record pointer from the payload rooted at `[this+0x30]`. When collection flag dword `[this+0x04]` is nonzero it treats that payload as a flat `stride=[this+0x08]` record array and returns `base + stride*id`; otherwise it treats the payload as an array of record pointers stored in `stride=[this+0x08]` slots and returns the pointer loaded from `base + stride*id`. Current grounded callers include the company, profile, train, and structure-candidate families, where it is the common bridge from one positive collection id to one concrete live record pointer.","objdump + caller inspection + collection-layout inspection + direct-vs-indirect payload correlation"
0x00518380,364,indexed_collection_get_nth_live_entry_id,simulation,thiscall,inferred,objdump + caller inspection + collection-layout inspection,4,"Shared nth-live-entry selector over the same indexed-collection layout. With traversal mode `0` it walks slot ids in forward order, skipping tombstoned ids through the bitset at `[this+0x34]`, and returns the positive entry id whose zero-based live ordinal matches the caller-supplied index; recent results are memoized in the small cache bands rooted at `[this+0x68]` and `[this+0x78]`. With nonzero traversal mode it reuses the auxiliary link banks rooted at `[this+0x38]`, `[this+0x48]`, and `[this+0x58]` to step through one alternate live-order chain before returning the resulting id. Current grounded callers across company, profile, structure-candidate, and placed-structure families mostly use traversal mode `0`, where this is the shared bridge from one zero-based live ordinal to one positive collection entry id.","objdump + caller inspection + collection-layout inspection + cache-band inspection + alternate-chain correlation"
0x0051c920,223,localization_lookup_display_label_by_stem_or_fallback,shell,thiscall,inferred,objdump + caller inspection + language-table correlation + static-table inspection,4,"Shared shell-side label helper that turns one ASCII stem string into one player-facing display label. The helper case-folds the first letter, scans the static `(stem, string-id)` table rooted at `0x006243c8`, compares candidate stems case-insensitively, and returns the localized text for the first matching string id through `0x005193f0` when that localized entry is nonempty. The current table correlation already grounds entries such as `Alcohol`, `Aluminum Mill`, `Automobiles`, `Bauxite`, and `Big Boy` against RT3.lng ids `3202..3220`. When no table entry matches, the helper falls back to localized id `3866` `Could not find a translation table entry for '%1'`. Current grounded callers include `shell_building_detail_refresh_subject_cargo_and_service_rows` `0x004ba3d0`, where it sits directly above candidate field `[record+0x04]`, and several neighboring list and detail renderers that need one display label from the same stem family.","objdump + caller inspection + language-table correlation + static-table inspection + RT3.lng correlation"
0x0051d3c0,44,calendar_point_pack_tuple_to_absolute_counter,support,fastcall,inferred,objdump + caller inspection + local arithmetic correlation,3,"Tiny packed-calendar helper that converts one local tuple rooted at the caller pointer in `ECX` into the same absolute calendar counter family later stored at `[world+0x15]`. It reads one year word plus four packed calendar subfields from `[tuple+0x00/+0x02/+0x04/+0x05/+0x06]`, combines them as one mixed-radix `12 x 28 x 3 x 60` progression, and returns the resulting scalar for direct subtraction against `[0x006cec78+0x15]`. That is now the strongest current read for the world-side calendar model: a packed year-plus-subfield point converted into one absolute counter rather than a plain year or month stamp. Current grounded finance caller is the stock-issue cooldown gate inside `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`, where it converts the current issue tuple at `[company+0x16b/+0x16f]` before comparing that scalar against the active world counter.","objdump + caller inspection + local arithmetic correlation + finance-cooldown correlation + world-calendar-counter correlation + mixed-radix decode"
0x0051d460,131,calendar_point_unpack_absolute_counter_to_tuple,support,fastcall,inferred,objdump + caller inspection + local arithmetic correlation,3,"Inverse packed-calendar helper for the absolute counter family rooted at `[world+0x15]`. It accepts one absolute calendar counter in `ECX`, decomposes it back into the same mixed-radix year-plus-subfield tuple, and returns the reconstructed pair of dwords in `EAX:EDX` for storage into fields such as `[world+0x0d]` and `[world+0x11]`. Current local arithmetic now bounds the inverse against the same `12 x 28 x 3 x 60` model as `0x0051d3c0`, which keeps this tuple in the world-side calendar-point family rather than as an unrelated packed timestamp. Current grounded callers are `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`, which refreshes `[world+0x0d/+0x11]` from the selected absolute counter at `[world+0x15]`, plus the target-resolution wrappers `0x0051d550` and `0x0051d5f0` used by `simulation_advance_to_target_calendar_point` `0x0040ab50`.","objdump + caller inspection + local arithmetic correlation + world-calendar-tuple correlation + target-resolution correlation + mixed-radix decode"
0x004f2e80,14,shell_has_live_overview_window,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Tiny presence probe for the shell-side `Overview.win` singleton rooted at `0x006d12bc`. The helper returns `1` when that live overview object pointer is nonnull and `0` otherwise. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where it sits beside other shell-window probes, and the overview family itself around `0x004f3a10`, which uses the same singleton to suppress duplicate opens.","objdump + caller inspection + nearby-family correlation + singleton correlation"
0x004f2e90,11,shell_mark_overview_window_dirty,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Tiny dirty-latch setter paired with `shell_has_live_overview_window`. The helper stores `1` into `0x006d12cc`, which current nearby call patterns treat as the `Overview.win` refresh or service request latch once the live overview singleton at `0x006d12bc` exists. Current grounded caller is the same post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`.","objdump + caller inspection + nearby-family correlation + singleton correlation"
0x004f38a0,67,shell_overview_window_construct,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Constructs the shell-side `Overview.win` object later published at `0x006d12bc`. The constructor seeds the local vtable at `0x005d1368`, binds the shell window resource through `0x0053fa50`, clears the selected subject field at `[this+0x7c]`, and installs the shared control callback `0x004f3880` on control `0x88bf`. Current grounded caller is `shell_open_or_focus_overview_window` at `0x004f3a10`, and current string-table correlation leaves `Overview.win` as the strongest owner name for this singleton family.","objdump + caller inspection + strings correlation + singleton correlation"
0x004f38f0,562,shell_overview_window_handle_message,shell,thiscall,inferred,objdump + caller inspection + control-flow inspection,4,"Primary message dispatcher for the shell-side `Overview.win` family rooted at `0x006d12bc`. The handler processes the usual shell message ids `0`, `0xca`, and `0xcb`; uses the current subject object at `[this+0x78]`; opens follow-on detail lanes through `0x004f2ea0`; and raises simple shell modals through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` when the requested drill-down path is currently invalid. It also consumes the family dirty latch at `0x006d12cc` on the recurring service path. Current grounded caller is the shell runtime after construction through `shell_open_or_focus_overview_window`.","objdump + caller inspection + control-flow inspection + dirty-latch correlation"
0x004f3a10,272,shell_open_or_focus_overview_window,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Shared opener for the shell-side `Overview.win` singleton. When a valid overview subject exists under the live world-side owner at `0x006cea4c` and no current overview window is open, the helper allocates an `0x80`-byte shell object, constructs it through `shell_overview_window_construct` at `0x004f38a0`, publishes it through the shell runtime at `0x006d401c`, and stages the selected subject pointer into the live singleton at `0x006d12bc` before routing it into the family message path at `0x004f2ea0`. When an overview window already exists it leaves the current singleton in place. Current grounded callers include the world-side action branches at `0x004396ae` and `0x004414c6`, both of which pass one subject object resolved from `0x006cea4c` before opening the overview path.","objdump + caller inspection + strings correlation + singleton correlation + publish-path inspection"
0x004b99c0,88,structure_candidate_collection_get_nth_active_candidate_id,map,cdecl,inferred,objdump + caller inspection + collection iteration,4,"Returns the zero-based nth active candidate id from the structure-candidate collection at `0x0062ba8c`. The helper iterates the collection through `0x517cf0` and `0x518380`, skips candidates whose active byte in the returned record is clear, decrements the caller-supplied ordinal only across the surviving entries, and finally returns the matching candidate id or `0` when the requested active slot does not exist. Current grounded callers are the shell-side building-detail branches at `0x004ba01f`, `0x004bbcfd`, and `0x004bbd56`, where ordinals `page-3` are translated back into live candidate ids before the selected-building service and capability rows are refreshed.","objdump + caller inspection + collection iteration + active-candidate correlation"
0x004b9a20,833,shell_building_detail_refresh_flagged_service_capability_rows,shell,thiscall,inferred,objdump + caller inspection + control-range inspection,3,"Shared `BuildingDetail.win` refresh helper for the flagged service or capability row bands driven from the currently selected building subject at `0x006cfe04`. The helper repeatedly restyles controls in the `0x7d07..0x7d1c` range through `0x540120`, using route-entry flag byte `+0x28` from the selected building subject as the decision source. Current local control correlation now bounds that mask family more tightly than a generic bit consumer: `0x7d07/0x7d08` split the zero-versus-nonzero `0x30` mask, `0x7d11/0x7d12` split the bit-`0x20`-only case, `0x7d13/0x7d14` split the exclusive-or `0x20^0x10` case, `0x7d17/0x7d1a` track bit `0x20`, `0x7d18/0x7d1b` track bit-`0x10`-only, and `0x7d19/0x7d1c` track the combined `0x30` case. The later repeated row family rooted at `0x7f58..0x801f` also consults bit `0x40` together with the currently selected candidate or service id in subject field `+0x24`, but current evidence now narrows that lane too: it is a selected-ordinal highlight band rather than a generic restyle loop. The special express-side triplet at `0x7f58..0x7f5a` is the fixed table-driven branch; after that the helper falls through into the ordinary active-candidate/service rows. When the selected id is below `0x384`, the helper translates it through `structure_candidate_collection_get_nth_active_candidate_id` at `0x004b99c0` and highlights ordinal `3 + active-candidate-rank` for the current subject id; otherwise it treats `0x384..` as the parallel express-side family directly. Current grounded callers include the broader building-detail refresh path at `0x004bae97`, the constructor-adjacent refreshes at `0x004bbcf3` and `0x004bbd0d`, and neighboring handler branches at `0x004bb8e3`, `0x004bbe5c`, and `0x004bc039`. Current evidence is therefore strong enough to treat this as the shared shell-side consumer of route-entry subflags `0x10`, `0x20`, and `0x40` even though the ordinary candidate-row captions still remain open.","objdump + caller inspection + control-range inspection + route-entry flag correlation + active-candidate correlation + control-family triplet correlation + row-mask partition correlation + selected-ordinal highlight correlation"
0x004ba3d0,2380,shell_building_detail_refresh_subject_cargo_and_service_rows,shell,thiscall,inferred,objdump + caller inspection + strings correlation,3,"Large `BuildingDetail.win` refresh helper for the selected subject row families centered on controls `0x7d06`, `0x7d96..`, `0x7d0e`, and the adjacent `0x7d6a/0x7d6b` and `0x7d9d` visual lanes. The helper walks the selected building subject at `0x006cfe04`, iterates the per-subject id list rooted at `[subject+0x01]`, validates ordinary ids through the structure-candidate collection at `0x0062ba8c` with `indexed_collection_entry_id_is_live` `0x00517d40`, resolves them into concrete live candidate records through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and then uses candidate field `[record+0x04]` as the shared stem for both the ordinary row asset path `%s.imb` and the neighboring display-label lookup through `localization_lookup_display_label_by_stem_or_fallback` `0x0051c920`. Only when that ordinary candidate branch fails does it fall back to the fixed express-side special ids `0x384..0x386`. Current table correlation now bounds that fixed branch more sharply: `0x00621df8` seeds the short-label controls `0x7dc8..0x7dca` with localized ids `494..496` `Any Cargo`, `Any Freight`, and `Any Express`, while `0x00621e10` seeds the adjacent asset-name controls `0x7e90..0x7e92` with `AnyCargo`, `AnyFreight`, and `PassMail` before `%1.imb` formatting. The helper also uses `Cargo.imb`, `Caboose.imb`, and the adjacent asset string `Dining.imb` while rebuilding the visible row payloads; current RT3.lng alignment now ties the longer descriptive popup/help side to `497/498` for freight/express and the two special service rows to localized labels `911` `Dining Car` and `912` `Caboose`. One resource-side boundary is tighter now too: the extracted `BuildingDetail.win` blob currently exposes only a sparse embedded text table with the help line `0xbb8`, the asset-name string `0xbb9`, and one standalone caption entry `0xbba` `Cargo`, which is the strongest current resource-side anchor for the row header around `0x7d06` and simultaneously reinforces that the deeper ordinary rows are being labeled from live candidate-record stems rather than from a larger hidden caption table. Current subflag correlation is tighter too: the extra visual lanes `0x7d6a`, `0x7d6b`, and `0x7d9d` are driven from the same selected-subject flag byte at `+0x28`, with `0x7d9d` on the bit-`0x20` branch using `Caboose.imb` and the sibling bit-`0x10` special lane using `Dining.imb`. The helper then re-enters both `shell_building_detail_refresh_subject_pair_value_rows` at `0x004bad20` and the flagged-row helper `shell_building_detail_refresh_flagged_service_capability_rows` at `0x004b9a20`. Current grounded callers include the main building-detail refresh at `0x004baedd`, constructor-adjacent and handler-side refreshes at `0x004bb8dc`, `0x004bbc89`, `0x004bbd6a`, and `0x004bc02b`. Current evidence is therefore strong enough to treat this as the selected-building cargo or service row owner even though several ordinary candidate-row captions remain unrecovered.","objdump + caller inspection + strings correlation + control-range inspection + candidate-id correlation + collection-helper correlation + stem-label correlation + subflag-row correlation + asset-string block correlation + RT3.lng correlation + table-entry correlation + win-resource extraction"
0x004ba270,311,shell_building_detail_handle_subject_value_row_band_action,shell,cdecl,inferred,objdump + callsite inspection + local disassembly,3,"Small `BuildingDetail.win` row-band action callback over the control-id family `0x7d07..0x7d14`. The helper switches on the clicked control id minus `0x7d07`, updates the selected building subject rooted at `0x006cfe04`, and treats subject bytes `+0x21`, `+0x22`, and `+0x23` as one current selection plus one bounded low/high pair. On change it increments the family dirty latch at `0x006cfe0c`, writes the refreshed current or bound value back through the shared shell control helper on code `0x66`, and when the side list helper at `0x006cfe08` is active it re-enters the neighboring follow-up refresh path at `0x004b9ec0`. Current direct installation site is the `0x7d0e` widget branch inside `shell_building_detail_refresh_subject_cargo_and_service_rows` at `0x004bacc9`, which keeps this bounded as the live action owner for the paired value rows rather than another passive formatter.","objdump + callsite inspection + local disassembly + selected-subject field correlation"
0x004bad20,461,shell_building_detail_refresh_subject_pair_value_rows,shell,thiscall,inferred,objdump + caller inspection + control-range inspection,3,"Shared `BuildingDetail.win` helper for the mutually exclusive subject-value row pairs around controls `0x7d05..0x7d14`. The helper first styles the leading pair `0x7d05/0x7d06`, then chooses between the value-row pairs `0x7d07/0x7d08`, `0x7d11/0x7d12`, and `0x7d13/0x7d14` from the selected building subject at `0x006cfe04`, using the same flag byte at `+0x28` that drives the neighboring cargo or service rows. On the nonzero selector branch it instead refreshes the current-selection status around `0x7d0d/0x7d0e` from the subject count byte and the subject field at `+0x21`, then tails back into `shell_building_detail_refresh_subject_cargo_and_service_rows` at `0x004ba3d0`. Current payload values for the mutually exclusive pairs come from subject fields `+0x22` and `+0x23`, and current grounded caller correlation keeps this bounded as one shared pair-value row owner rather than a separate top-level widget family.","objdump + caller inspection + control-range inspection + subject-field correlation + flag-branch correlation"
0x004b9d70,14,shell_has_live_building_detail_window,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Tiny presence probe for the shell-side `BuildingDetail.win` singleton rooted at `0x006cfe00`. The helper returns `1` when that live detail object pointer is nonnull and `0` otherwise. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where it sits beside the sibling overview, load-screen, settings, custom-modal, and file-options probes.","objdump + caller inspection + strings correlation + singleton correlation"
0x004b9d80,11,shell_mark_building_detail_window_dirty,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Tiny dirty-latch setter paired with `shell_has_live_building_detail_window`. The helper stores `1` into `0x006cfe10`, which current nearby call patterns treat as the `BuildingDetail.win` refresh or service request latch once the live singleton at `0x006cfe00` exists. Current grounded caller is the same post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`.","objdump + caller inspection + nearby-family correlation + singleton correlation"
0x004b9e10,166,shell_building_detail_submit_aux_owner_subject_sync_request,shell,cdecl,inferred,objdump + caller inspection + state-block inspection,3,"Small side-owner sync helper for `BuildingDetail.win`. When the auxiliary owner at `0x006cd8d8` is present and the local dirty counter `0x006cfe0c` is nonzero, the helper allocates a `0x3f`-byte request block, stamps a small header through `0x005216c0` and `0x00513130`, stores one mirrored-subject mode bit in request word `+0x08`, stores the current building-detail ordinal from `0x00621df4`, then copies the full staged building subject record from `0x006cfe04` into the request body before queueing it through `0x00469d30` on the owner-local request list at `[0x006cd8d8+0x8f48]`. Current direct callers are the `0x7d01` and `0x7d09/0x7d0a` branches inside `shell_building_detail_window_handle_message` `0x004bb9e0`, and both now clearly source that mode bit from the side-list mirror latch at `[0x006cfe08+0x0c]`, which keeps this bounded as an auxiliary-owner subject-sync path that preserves local mirror-state rather than a generic widget refresh. The helper also currently suppresses submission when the neighboring live-flag dword at `0x006d3ae4` is nonzero.","objdump + caller inspection + state-block inspection + side-owner queue correlation + mirror-latch correlation"
0x004b9ec0,272,shell_building_detail_propagate_selected_subject_state_into_side_list,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Shared follow-up helper for `BuildingDetail.win` when the sibling side-list owner at `0x006cfe08` is active and its mirror latch at `+0x0c` is nonzero. The helper walks every indexed side-list subject through `0x004b2b60`, copies the currently selected subject state from `0x006cfe04` into each sibling record, mirrors the current service or capability id at `[subject+0x24]`, and propagates the mutable subflag family in byte `+0x28` with bits `0x40`, `0x20`, and `0x10` preserved from the active subject. It also copies the current-selection fields `+0x21/+0x22/+0x23` and the live id list rooted at `+0x01`, which is why the paired value-row action helper at `0x004ba270` and several handler-side selector branches re-enter this path after mutating the active subject. Current grounded callers are `shell_building_detail_handle_subject_value_row_band_action` at `0x004ba270` and the handler-side refresh branches at `0x004bbc9d`, `0x004bbd81`, and `0x004bbe55`.","objdump + caller inspection + local disassembly + selected-subject field correlation + side-list iteration correlation + mirror-latch correlation"
0x004b9fd0,672,shell_building_detail_present_flagged_service_capability_popup,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Popup callback installed on the larger `BuildingDetail.win` flagged-row band. The helper takes one clicked control id in the `0x7f58..0x801f` family, resolves either one fixed express-side descriptor from table `0x00621e04` for the first three rows or one active candidate/service id from the selected subject at `0x006cfe04+0x24`, and then formats an explanatory shell popup before returning through `0x538c70`. Current table correlation now closes that first triplet more cleanly: `0x00621e04` supplies localized ids `494`, `497`, and `498`, so the fixed popup/help branch is specifically `Any Cargo`, `Any Freight\\n(Freight is everything but Passengers, Mail, and Troops)`, and `Any Express\\n(Express is Passengers, Mail, and Troops)` for controls `0x7f58..0x7f5a`. Current language-table correlation also tightens the ordinary popup split: one single-line availability popup uses localized id `3922` `%1\\nLoads available at %2: %3`, while the ordinary candidate branch uses localized id `2981` `%1\\nLoads available at %2: %3     Current Price: %4` and can append localized id `2982` `Price at next station, %1: %2 (%3%4)`. On that ordinary branch it resolves the current candidate through `structure_candidate_collection_get_nth_active_candidate_id` at `0x004b99c0`, compares the selected site against the current subject site at `+0x29`, queries local service metrics through `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`, and conditionally computes the nearby-site delta line before presenting the final text. Current direct installation sites are the callback-registration branches at `0x004bb43f` and `0x004bb8a6`, which keeps this bounded as the live explanatory popup owner for the `0x7f58..0x801f` selector rows rather than another passive formatter.","objdump + caller inspection + local disassembly + callback-registration correlation + popup-path correlation + candidate-metric correlation + RT3.lng correlation + table-entry correlation"
0x004bb9e0,2183,shell_building_detail_window_handle_message,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Primary message dispatcher for the shell-side `BuildingDetail.win` family rooted at `0x006cfe00`. The handler switches over shell messages `0`, `0xca`, and `0xcb`; updates the staged building subject in `0x006cfe04` and its list helper at `0x006cfe08`; refreshes the visible control ranges `0x7d..0x8051`; and consumes the dirty latch at `0x006cfe10` on the recurring service path. Its action cases are now tighter than a generic navigation bucket. The `0x7d01` branch is no longer just an isolated oddball either: extracted `BuildingDetail.win` text now makes `Set the initial cargo amount for 'Disable Cargo Economy' scenarios.` the strongest current caption candidate for that control, the message path can mirror that action through `shell_building_detail_submit_aux_owner_subject_sync_request` `0x004b9e10` when `shell_has_auxiliary_preview_owner` `0x00434050` reports the side owner live, and one later rejection path now clearly raises localized id `3587` `This option is only available by following the tutorial.` behind the active tutorial flag at `0x006d3b4c` plus the cached previous expected-control id at `0x00622b38`. The `0x7d02/0x7d03` pair flips selected-subject bit `0x40` and re-enters `shell_building_detail_refresh_subject_pair_value_rows` `0x004bad20`, which makes that pair the real top-level mode switch between the bounded pair-value branch and the current-selection/status branch around `0x7d0d/0x7d0e`. The `0x7d09/0x7d0a` pair steps neighboring building subjects through `0x004b2b60`, skipping disallowed subjects on the local iteration path, and the same branch can also mirror the new selected subject through `0x004b9e10` when that auxiliary owner is present. The `0x7d0f/0x7d10` pair flips selected-subject bits `0x20` and `0x10`, i.e. the same special-service subflags later rendered as `Caboose` and `Dining Car`, and then re-clamps the paired value widgets through the same shared refresh path. The `0x7f58..0x801f` selector band changes the current service or capability id at `[subject+0x24]` before re-entering `shell_building_detail_refresh_flagged_service_capability_rows` `0x004b9a20`; current refresh-side correlation now shows that band as one selected-ordinal picker over three fixed express rows plus the ordinary active-candidate rows rather than an undifferentiated list. The `0x8020..0x8051` action band is now tighter too: it is primarily a per-row removal family over the selected subject's live id list rooted at `+0x01`, zeroing one indexed entry, compacting the remaining dword ids, decrementing count byte `+0x00`, clamping the current-selection byte `+0x21`, and then refreshing the visible row bands. Two special row indices inside that same band re-route into the adjacent `0x7d0f/0x7d10` subflag-clearing path instead of ordinary list compaction when the current `0x20/0x10` service-bit state requires it. The handler can also open simple shell modals through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` when one building-side action is disallowed. Current grounded callers are the shell runtime after construction and the explicit dirty-latch service path.","objdump + caller inspection + strings correlation + control-range inspection + dirty-latch correlation + selected-subject mutation correlation + RT3.lng correlation + selected-ordinal correlation + remove-entry compaction correlation + auxiliary-owner sync correlation + tutorial-rejection correlation + expected-control-cache correlation"
0x004baef0,2793,shell_building_detail_window_refresh_controls,shell,thiscall,inferred,objdump + caller inspection + control-range inspection,4,"Primary refresh path for the shell-side `BuildingDetail.win` family. The helper rebuilds the top-level control bands under `0x7d02..0x8051`, including the paired mode switch `0x7d02/0x7d03` from subject flag `0x40`, the smaller special-service toggles `0x7d0f/0x7d10` from subject bits `0x20` and `0x10`, the current-selection status widget around `0x7d0d/0x7d0e`, the selected-building cargo or service rows through `shell_building_detail_refresh_subject_cargo_and_service_rows` at `0x004ba3d0`, the paired subject-value rows through `shell_building_detail_refresh_subject_pair_value_rows` at `0x004bad20`, and the flagged service or capability rows through `shell_building_detail_refresh_flagged_service_capability_rows` at `0x004b9a20`. Current control-building correlation now makes the leading special-row bands explicit too: the short-label triplet `0x7dc8..0x7dca`, its adjacent asset/icon triplet `0x7e90..0x7e92`, and the popup/selectable triplet `0x7f58..0x7f5a` are the fixed express-side branch before the broader ordinary candidate rows. Current branch structure is tighter too: when subject bit `0x40` is set the refresh ends on the selected-subject cargo/service family rooted at `0x004ba3d0`, while the clear branch instead ends on the flagged capability-selector family rooted at `0x004b9a20`. It also hides or shows the larger control ranges `0x7dc8..0x7f57`, `0x7f58..0x801f`, and `0x8020..0x8051` through the shared shell control toggles at `0x53fe00`. Current grounded callers are the main constructor-side and focus refreshes at `0x004bbace`, `0x004bc0cc`, and `0x004bc0de`, and the message dispatcher at `0x004bb9e0`.","objdump + caller inspection + control-range inspection + subject-flag correlation + helper-family correlation + branch-end correlation + control-family triplet correlation"
0x004bc0a0,71,shell_building_detail_window_construct,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Constructs the shell-side `BuildingDetail.win` object later published at `0x006cfe00`. The constructor seeds the local vtable at `0x005d05e0`, binds the window resource through `0x0053fa50`, and immediately refreshes the visible subject and control bands through `0x004baef0`. Current grounded caller is `shell_open_or_focus_building_detail_window` at `0x004bc100`, and current string-table correlation leaves `BuildingDetail.win` as the strongest owner name for this singleton family.","objdump + caller inspection + strings correlation + singleton correlation"
0x004bc100,203,shell_open_or_focus_building_detail_window,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Shared opener for the shell-side `BuildingDetail.win` singleton. The caller supplies the building-detail list helper in `ECX`, one current building subject in `EDX`, and one selected ordinal on the stack. The helper seeds the shared family globals at `0x006cfe04`, `0x006cfe08`, and `0x00621df4`, validates that the supplied building subject resolves to one live world object through the placed-structure collection at `0x006cec20`, allocates a `0x78`-byte shell object when no detail window is live, constructs it through `shell_building_detail_window_construct` at `0x004bc0a0`, publishes it through the shell runtime at `0x006d401c`, and tears it back down on return while clearing `0x006cfe00`. Current grounded callers include the world-side branch around `0x004bbace`, which updates the current building subject before opening this detail family. Current string-table correlation leaves `BuildingDetail.win` as the strongest owner name for this singleton family.","objdump + caller inspection + strings correlation + publish-path inspection + singleton correlation"
0x004bcdd0,352,shell_change_trees_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `ChangeTrees.win` tool window. The constructor installs vtable `0x005d06bc`, binds `ChangeTrees.win` through `0x0053fa50`, seeds the current ordinal and paired scalar lanes from globals `0x00621ec0..0x00621ec8`, formats the visible scalar caption through `0x0051f070` and `0x00527de0`, copies one localized six-row label table from `0x005ef3ec`, stores the live singleton at `0x006cfe18`, and then refreshes the visible selection band through `0x004bccd0`. Current grounded caller is the detail-panel manager branch at `0x004ddf32`, which keeps this on the shell tool-window side rather than the larger company- or station-detail lanes.","objdump + strings + detail-manager correlation + control-table correlation + singleton correlation"
0x004bcc20,50,shell_change_trees_window_select_scalar_and_refresh_caption,shell,thiscall,inferred,objdump + message-owner inspection + caption-table correlation,4,"Small `ChangeTrees.win` setter for the scalar selection lane. The helper stores the requested scalar ordinal in `[this+0x78]`, looks up one float caption value through table `0x00621ecc`, converts that value into shell text through `0x0051f070` and `0x00527de0` on presenter `0x006d4024`, and returns without touching the broader row bands. Current grounded caller is the message owner `0x004bcf30`, where controls `0x1389..0x138f` forward through this helper before the wider control refresh runs.","objdump + message-owner inspection + caption-table correlation + shell-presenter correlation"
0x004bcc60,80,shell_change_trees_window_select_four_state_mode_and_publish_group_event,shell,thiscall,inferred,objdump + message-owner inspection + shell-presenter correlation,4,"Small `ChangeTrees.win` mode selector beneath the broader control refresh. The helper stores the requested `0..3` value in `[this+0x84]` and then publishes one grouped selector event through `0x0053f000` on presenter `0x00ccbb20`: mode `0` maps to event `0x16`, mode `1` maps to `0x07`, mode `2` maps to `0x01`, and mode `3` currently falls through without publishing an event. Current grounded callers are the constructor `0x004bcdd0` and the message owner `0x004bcf30`, which keeps this as a shell-side mode-group selector rather than a world brush mutation path.","objdump + message-owner inspection + shell-presenter correlation + constructor correlation"
0x004bccd0,250,shell_change_trees_window_refresh_control_bands,shell,thiscall,inferred,objdump + constructor correlation + message-owner inspection,4,"Refreshes the visible row bands for the shell-side `ChangeTrees.win` family. The helper walks five grouped control strips and republishes them through `0x00540120` with the standard selected-vs-unselected style split `0x87/0x65`: the scalar strip `0x1389..0x138f` from `[this+0x78]`, the sibling strip `0x13ed..0x13f3` from `[this+0x80]`, the third strip `0x1451..0x1457` from `[this+0x7c]`, the four-state strip `0x14b5..0x14b8` from `[this+0x84]`, and the larger localized row band `0x139c..0x13b7` from `[this+0x8c]`. Current grounded callers are the constructor `0x004bcdd0` and the message owner `0x004bcf30`, which makes this the current owner-side refresh pass for `ChangeTrees.win` rather than one generic tree-paint helper.","objdump + constructor correlation + message-owner inspection + control-band correlation"
0x004bcf30,924,shell_change_trees_window_handle_message,shell,thiscall,inferred,objdump + constructor correlation + caller inspection,4,"Primary message dispatcher for the shell-side `ChangeTrees.win` tool window. Under message `0xc8`, controls `0x1389..0x138f` update the scalar lane through `shell_change_trees_window_select_scalar_and_refresh_caption` `0x004bcc20`, controls `0x13ed..0x13f3` update `[this+0x80]` and global `0x00621ec4`, controls `0x1451..0x1457` update the paired row lane through `0x004bcc60` and global `0x006cfe1c`, and controls `0x139c..0x13b7` update the larger localized row-band selection in `[this+0x8c]` and `0x006cfe20`; each of those branches re-enters `shell_change_trees_window_refresh_control_bands` `0x004bccd0`. Control `0x07d6` owns the shared world-surface latch `[this+0x88]`: it arms the latch after the standard hit-test gate `0x00448ac0`, snapshots anchor coords in `[this+0x90/+0x94]`, and then enters the broader brush-distance/math branch rooted at `0x004bd083`. Current grounded owner correlation is the constructor `0x004bcdd0` and the live shell message flow, which keeps this on the `ChangeTrees.win` tool-window side of the shared world-surface family rather than a generic terrain-detail page.","objdump + constructor correlation + caller inspection + world-surface latch correlation + control-band correlation"
0x004bc210,67,shell_world_surface_brush_set_selected_ordinal_and_refresh_scalar_caption,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small setter beneath the shell world-surface brush family. The helper stores the caller-selected ordinal into `[this+0x78]`, resolves the corresponding dword from table `0x00621e24`, converts that value into a float caption through `0x0051f070` and `0x00527de0` under shell owner `0x006d4024`, and returns. Current grounded caller is the `0x0fa0..0x0fa7` ordinal-strip branch inside `shell_world_surface_brush_handle_message_for_control_0x07d6_and_mode_family_0x0fa0_0x0faf` `0x004bc350`, so this is the safest current read for the selected-ordinal setter plus scalar-caption refresh rather than a generic text helper.","objdump + caller inspection + local disassembly + ordinal-strip correlation + scalar-caption correlation"
0x004bc260,43,shell_world_surface_brush_query_cached_world_coords_and_selected_scalar,shell,thiscall,inferred,objdump + local disassembly + field correlation,2,"Tiny cached-parameter getter beneath the same shell world-surface brush family. The helper copies cached world coordinates `[this+0x80]` and `[this+0x84]` into the two caller out-pointers and returns the current selected scalar from table `0x00621e24[ordinal]`, where the ordinal is stored at `[this+0x78]`, through the third out-pointer. Current local field correlation keeps this bounded as the brush-family cached-parameter query rather than a generic subject getter.","objdump + local disassembly + field correlation + ordinal-table correlation"
0x004bc290,192,shell_world_surface_brush_refresh_ordinal_and_mode_button_rows,shell,thiscall,inferred,objdump + caller inspection + control-family correlation,3,"Shared control refresh helper for the shell world-surface brush family. The first loop restyles the ordinal strip `0x0fa1..0x0fa7` through `0x00540120`, highlighting the current selected ordinal at `[this+0x78]`. The second loop restyles the mode strip `0x0faa..0x0faf` by mapping the current mode dword `[0x006d0818+0x8c]` from `0x0e..0x13` into local indices `0..5` and highlighting the matching button through the same shell control helper. Current grounded callers are the ordinal-strip branch at `0x004bc3fc` and the mode-change path beneath `shell_world_surface_brush_handle_message_for_control_0x07d6_and_mode_family_0x0fa0_0x0faf` `0x004bc350`, so this is the safest current read for the ordinal and mode button-row refresh owner rather than a generic widget restyler.","objdump + caller inspection + control-family correlation + ordinal-mode-strip correlation"
0x004bc350,1496,shell_world_surface_brush_handle_message_for_control_0x07d6_and_mode_family_0x0fa0_0x0faf,shell,thiscall,inferred,objdump + local disassembly + control-family correlation,3,"Shell-side message owner for one world-surface brush family whose current grounded controls are the shared main-world surface `0x07d6`, the ordinal strip `0x0fa0..0x0fa7`, and the mode buttons `0x0faa..0x0faf`. The `0x07d6` branch first resolves world coordinates through `0x00448ac0`, latches drag-active byte `[this+0x7c]`, stores the accepted world coordinate pair into `[this+0x80/+0x84]`, and caches the incoming scalar at `[this+0x88]`. When that latch is active, the helper dispatches the current mode dword `[0x006d0818+0x8c]` across six grounded edit branches: mode `0x0e` and `0x13` re-enter `world_raise_companion_float_grid_local_peak_in_rect_with_optional_class_3_5_bias` `0x0044da70`; mode `0x0f` re-enters `world_relax_companion_float_grid_cross_average_in_rect_with_raster_bit0_gate` `0x0044d4e0`; modes `0x10` and `0x11` re-enter `world_raise_companion_float_grid_toward_center_sample_in_rect` `0x0044d880`; and mode `0x12` toggles the secondary-raster low nibble through `world_secondary_raster_xor_cell_byte2_low_nibble_mask` `0x00448e20` before re-entering `placed_structure_collection_refresh_local_runtime_side_state_in_rect_from_cell_bucket_map` `0x00419110`. The same owner also routes the ordinal strip `0x0fa0..0x0fa7` through `0x004bc210/0x004bc290` and updates the shared brush ordinal at `0x00621e20`, while the mode buttons `0x0faa..0x0faf` dispatch `0x004ddbd0` with mode ids `0x0e..0x13`. Current evidence is strong enough to treat this as a shell world-surface brush and mode dispatcher even though the exact window-family resource name is still open.","objdump + local disassembly + control-family correlation + world-surface correlation + brush-mode correlation"
0x004384d0,570,world_run_post_load_generation_pipeline,map,cdecl,inferred,objdump + strings + caller xrefs,4,"Large post-load world-generation pipeline reached after world entry and shell-side file-load success paths. It increments the world-root generation counter at `[0x0062c120+0x2205]` and, on the caller-selected setup path, first runs the preliminary candidate-availability prepass at `0x00437743` before the visible progress phases begin. The visible phase order is now grounded directly from the function body instead of only from scattered callers: id `318` `Computing Transportation and Pricing...` is posted first and remains active while the pipeline runs `world_compute_transport_and_pricing_grid` `0x0044fb70`, the early collection pass `world_setup_building_collection_phase` `0x0041ea50`, and the conditional region pair `world_region_collection_seed_default_regions` `0x00421b60` plus `world_region_border_overlay_rebuild` `0x004882e0`; if shell-state gate `[0x006cec74+0x174]` is set, id `320` `Setting Up Buildings...` then drives `world_region_collection_run_building_population_pass` `0x00421c20`; if `[0x006cec74+0x178] > 0`, id `321` `Seeding Economy...` then drives `simulation_run_chunked_fast_forward_burst` `0x00437b20`; only after those setup-side gates does the pipeline post id `319` `Setting up Players and Companies...`; and id `322` `Calculating Heights...` finally tails into `0x0044d410`. That `319` lane is no longer just gate plumbing: the primary grounded work there is still the chairman-profile pair `world_seed_default_chairman_profile_slots` `0x004377a0` plus `world_build_chairman_profile_slot_records` `0x00437220`, and current neighboring setup flow also exposes one conditional company-side helper at `0x0047d440` under sandbox or non-editor shell-state conditions. The later interior ordering of the same `319` lane is tighter now too: after the route-entry collection refresh on `0x006cfca8` through `0x00493be0`, the pipeline refreshes the auxiliary route-entry tracker collection `0x006cfcb4` through `0x004a41b0`, then re-enters `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, runs a flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0`, and only after that re-enters the route-entry post-pass `0x00491c20` before continuing into later persona, route-style, region, and world-manager setup families. Current evidence is tighter on the remaining gates too: `[0x006cec74+0x68]` now aligns with the editor-map `.gmp` mode in the shell file coordinators and acts as the broader master editor-mode flag that suppresses both later world-generation branches and diverts region-side calculations into alternate paths. The body fans into the live world root at `0x0062c120`, manager collections `0x0062ba8c`, `0x0062bae0`, `0x006cfca8`, `0x006cfcb4`, and `0x006cfc9c`. Current grounded callers are the world-entry side around `0x004390ea` and the shell file-load side around `0x004dccfc`.","objdump + RT3.lng strings + caller xrefs + callsite inspection + file-flow correlation + post-load-stage-order correlation"
0x00437743,93,world_preseed_named_candidate_availability_records_from_live_pool,map,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Preliminary post-load candidate-availability prepass reached only from `world_run_post_load_generation_pipeline` `0x004384d0` when the caller requests the fuller setup path. The helper iterates the live candidate pool at `0x0062b268` in reverse order, derives one small boolean mode from candidate bytes `[candidate+0xba]` and `[candidate+0x32]`, and then re-enters `scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters` `0x00434f20` on the active scenario state `0x006cec78` using the candidate name at `+0x04`. The whole pass is skipped once global threshold `0x00620e94` reaches `0x26ad`. Current evidence is therefore strongest for an early scenario-side named candidate-availability seeding pass rather than another visible progress phase.","objdump + local disassembly + caller correlation + candidate-pool correlation"
0x00438890,644,shell_active_mode_run_profile_startup_and_load_dispatch,map,thiscall,inferred,objdump + caller xrefs + debugger comparison,4,"Large active-mode startup and profile-dispatch owner rooted at the live mode object in `0x006cec78`. At entry it clears local state at `[this+0x00]` and `[this+0x4c80]`, posts several shell progress or status updates through `0x5193f0/0x540120`, enumerates one shell-managed list off `0x006d4020+0x429b0`, and then switches over the runtime-profile selector at `[0x006cec7c+0x01]`, which is now clearly a separate seven-way startup selector rather than the shell mode id itself. The jump table has four grounded branch bodies: selector values `1` and `7` share the tutorial map lane at `0x00438f67`, which writes `[0x006cec74+0x6c]=2` and calls shell_map_file_entry_coordinator `0x00445ac0` with `Tutorial_2.gmp` or `Tutorial_1.gmp`; selector `2` is a world-root initialization lane at `0x00438a66..0x00438c00` that first refreshes one support-family type-`7` record from setup path buffer `0x006d1370` through `global_banked_type7_record_refresh_from_openable_path_basename_and_stem` `0x0053d130`, strips the basename extension into a local label buffer, briefly drops the nested mouse-cursor selection hold through `0x0053f310`, builds three progress-text payloads, re-enters the hold through `0x0053f2f0`, and only then allocates `0x0062c120` when absent, runs `0x0044faf0`, and forces the selector to `3`; selector `4` is the setup-side world reset or regeneration lane at `0x00439038`, which tears down and reallocates `0x0062c120` from setup globals `0x006d14cc/0x006d14d0`, then runs `0x00535100` and `0x0040b830`; and selector values `3`, `5`, and `6` collapse into the same profile-seeded file-load lane at `0x004390b0..0x004390ea`. The write side is tighter now too: `Campaign.win` writes selector `6` at `0x004b8a2f`; `Multiplayer.win` writes selector `3` on one pending-status branch at `0x004f041e`; and the larger `Setup.win` dispatcher around `0x005033d0..0x00503b7b` writes selectors `2`, `3`, `4`, and `5` on several validated launch branches, including the setup-size path through `0x0050394c`, the generation branch at `0x00503a12`, and the profile-file validation branch at `0x00503a74/0x00503a7d`. The shared file-load lane is therefore no longer anonymous: selector `6` is the grounded campaign-side variant and selectors `3/5` are grounded setup or multiplayer variants, while selector `6` is also the only variant that first writes `[0x006cec74+0x6c]=1` before all three values call shell_map_file_entry_coordinator `0x00445ac0` with `([0x006cec7c]+0x11, 4, &out_success)`, re-enter shell service `0x004834e0`, conditionally run world_run_post_load_generation_pipeline `0x004384d0` when `out_success != 0`, drain the counter object at `0x00ccbb20` through `0x0053f310`, and service `0x004834e0` again. The caller split above that branch is tighter now too: `0x004830ca` is the shell startup or `LoadScreen.win` lane and calls this owner as `(1, 0)` after publishing `0x006cec78`, while `0x00443b57` world entry and `0x00446d7f` saved-runtime restore both enter with `(0, 0)` immediately after dismissing the current detail panel and servicing `0x004834e0(0, 0)`. `0x0046b8bc` remains the distinct multiplayer-preview relaunch owner, also entering as `(0, 0)` before a later staged `0x00445ac0` call.","objdump + caller xrefs + manual-load breakpoint comparison + owner-tail disassembly + caller-shape comparison + selector-jump-table decode + tutorial-string correlation + selector-writer correlation + selector2-support-record correlation + cursor-hold choreography correlation"
0x00435603,10,scenario_state_ensure_derived_year_threshold_band,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Tiny guard wrapper over one derived scenario-state year-threshold band rooted at `[this+0x3a/+0x51/+0x55/+0x59/+0x5d/+0x61]`. When the small mode or threshold byte at `[this+0x3a]` is already `>= 2` the helper returns immediately; otherwise it falls back into the heavier rebuild body at `0x004351c0`, which refreshes those companion thresholds from the current year and shell-controller-side values before continuing. Current grounded callers are the post-fast-forward selected-year tail at `0x00437170`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, the compact runtime-effect side branch at `0x00431e03`, and the shell-command lane at `0x004661c0/0x004661e9`, so this is the safest current read for the small year-threshold ensure wrapper rather than a generic boolean probe.","objdump + local disassembly + caller correlation + year-threshold-band correlation"
0x00435630,648,scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables,map,thiscall,inferred,objdump + caller xrefs + state-layout inspection,4,"Rebuilds the runtime port-or-warehouse cargo-line tables from the scenario-side recipe-book state rooted at `[this+0x0fe7]`. The helper first biases into the recipe-book payload at `[this+0x13d4]`, then iterates all `12` recipe-book blocks in `0x4e1`-byte steps. For each book it clamps the shared maximum annual production float that precedes the first line, counts active lines across five repeated `0x30`-byte line records, and then imports those five lines into one parallel runtime array of `0xbc`-byte descriptors. The importer treats every line slot symmetrically rather than special-casing any row index: each slot reads one mode dword, one annual amount, and two cargo-token strings, resolves nonempty cargo strings through the global cargo collection at `0x0062ba8c`, and builds paired runtime halves for the mode families `2/3` and `1/3`. Current mode gating is now tight enough to treat the polarity as grounded rather than provisional: the source token at `line+0x08` is the supplied-cargo field because it is the branch activated for `Supply Only` and `Production Demand->Supply`, while the source token at `line+0x1c` is the demanded-cargo field because it is the branch activated for `Demand Only` and `Production Demand->Supply`. The constructor and handler now tighten the amount semantics too: `line+0x04` is the per-line annual-demand field only in mode `1`, but it becomes the annual-supply field in modes `2/3`. The importer matches that split by copying `line+0x04` directly into the supply-side runtime half for modes `2/3`, while the production-mode demand half is normalized to `1.0` rather than reusing the entered amount. That makes the five editor-side row entries look like generic cargo-line slots rather than five fixed named production roles. Current grounded callers include the scenario-state initializer at `0x00436ee0`, world-load or map-entry side branches at `0x00443ebc`, `0x00444ac1`, and `0x00448126`, plus the live editor page constructor at `0x004cf935`.","objdump + caller xrefs + state-layout inspection + cargo-collection correlation + mode-table correlation + constructor correlation"
0x00437b20,218,simulation_run_chunked_fast_forward_burst,simulation,thiscall,inferred,objdump,3,"Shell-mediated burst advance helper above simulation_advance_to_target_calendar_point. It marks a local fast-forward latch at `[this+0x46c38]`, derives one loop count from shell-state `0x006cec74+0x178` and active-mode flag `[0x006cec78+0x4af7]`, then repeatedly advances the world toward fixed target `0x05a0` through simulation_advance_to_target_calendar_point while pumping the shell-side service helper at `0x004834e0` between chunks. After the burst it clears the latch, sweeps the world collection at `0x0062bae0`, and tails into the neighboring cleanup path at `0x00434d40`. The current grounded owner is world_run_post_load_generation_pipeline at `0x004384d0`, where the helper sits behind shell-state gate `[0x006cec74+0x178]` under the localized `Seeding Economy...` phase after the earlier transportation-pricing and building-setup work has already run. This keeps the helper on the map or scenario setup side rather than the ordinary player-facing speed-control path.","objdump + caller context + RT3.lng strings + phase ordering"
0x00434680,435,world_set_game_speed_mode,simulation,thiscall,inferred,objdump + strings,3,"Primary game-speed setter for the live world object. It clamps the requested mode against the normal `0..5` range or the wider `0..9` range when shell-state gate `[0x006cec74+0x2c8]` is active, stores the current mode at `[this+0x19]`, preserves the nonzero resume mode at `[this+0x1d]`, updates the shell detail control `0x74` when `0x006d0818` is live, and can format the localized status line `Game Speed: %1` using speed labels `Paused` through `Very Fast` and the hidden `Ultra Fast 6..9` strings. When the caller requests propagation and the multiplayer preview path is active it also routes the new speed through the multiplayer-side handoff around `0x00407870`, which matches the localized restriction `Only the host may change the game speed.`","objdump + RT3.lng strings + multiplayer handoff"
0x00434850,19,world_adjust_game_speed_mode_delta,simulation,thiscall,inferred,objdump,3,"Small relative front end over world_set_game_speed_mode. It adds the signed caller delta to the current mode at `[this+0x19]` and then re-enters world_set_game_speed_mode with both notification and propagation flags enabled.","objdump + callee inspection"
0x004338c0,12,shell_mode_gate_is_active,shell,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Tiny boolean wrapper over the shell-side gate at `0x006d07b4`. The helper simply forwards `0x004d4150`, normalizes the result to `0/1`, and returns. Current grounded callers use it as a coarse mode gate before trusting several scenario-side and runtime-object fields, including the flag-byte readers at `0x0041f910`, `0x00461500`, and `0x00474430`, plus broader world or shell-side branches such as `0x004197e0`, `0x00440e4d`, and `0x0044ccdc`. The exact player-facing owner of `0x006d07b4` is still open, so the safest current name stays structural around one active shell-mode gate.","objdump + local disassembly + caller correlation + gate reuse correlation"
0x00433790,8,scenario_state_set_selected_chairman_company_id,map,thiscall,inferred,objdump + global-state inspection + caller correlation,4,"Tiny raw setter over the shell-side scenario state object at `0x006cec78`. The helper stores the caller-supplied company id directly into `[this+0x21]` and returns. Current grounded callers are the company and chairman reassignment flows at `0x00426dd4`, `0x00427d06`, `0x00427d93`, and the startup-company seeding or rotation paths around `0x0047d282`, `0x0047d409`, and `0x0047d609`, where it keeps the raw selected-company summary in sync with later chairman or ownership changes. This is therefore the direct id-level companion to the higher record accessor `scenario_state_get_selected_chairman_company_record` `0x00434870` rather than a broader state mutator.","objdump + global-state inspection + caller correlation + selected-company-summary correlation"
0x004337a0,4,scenario_state_get_selected_chairman_company_id,map,thiscall,inferred,objdump + global-state inspection + caller correlation,4,"Tiny raw getter over the shell-side scenario state object at `0x006cec78`. The helper returns company id field `[this+0x21]` directly without resolving it through the live company collection. Current grounded callers include the linked-site status formatter `0x0040e4e0`, the company or chairman reassignment families around `0x00426dd4`, `0x004427aac`, and `0x0047d462`, the startup-company seeding branches around `0x0047d4ed`, and many shell-side overview or ledger renderers that compare the current row against the scenario-selected company before choosing text or style. This is therefore the raw selected-company-id accessor beneath the higher record resolver `scenario_state_get_selected_chairman_company_record` `0x00434870`.","objdump + global-state inspection + caller correlation + selected-company-summary correlation"
0x004337b0,4,scenario_state_get_selected_chairman_profile_id,map,thiscall,inferred,objdump + global-state inspection + caller correlation,4,"Tiny raw getter over the shell-side scenario state object at `0x006cec78`. The helper returns chairman profile id field `[this+0x25]` directly without resolving it through the global persona collection. Current grounded callers include the company-detail and load-screen style selectors, chairman rotation or reassignment branches around `0x00427cf4`, `0x00427d80`, `0x004295ef`, and `0x0047d3f9`, and many shell-side renderers that compare the current row's linked chairman against the scenario-selected chairman before choosing visible styling. This is therefore the raw selected-chairman-profile-id accessor beneath the higher record resolver `scenario_state_get_selected_chairman_profile_record` `0x004348c0`.","objdump + global-state inspection + caller correlation + selected-chairman-summary correlation"
0x00433900,160,shell_world_view_center_on_object_with_mode_specific_zoom_policy,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Mode-aware world-view centering helper above the live world-view owner at `0x0062be68`. The helper takes one object pointer plus one small mode argument. Except for the early mode-`2` no-op path, it first refreshes shell control `0x7922`, derives one `(distance,height)` preset from the target object's virtual classification through slots `+0x70`, `+0x6c`, and `+0x28`, optionally overrides that preset for mode `1`, and then re-enters `world_view_center_on_runtime_object` `0x0043c9a0` with the chosen preset and object pointer. Current grounded callers include the shell station and company list modifier paths, several detail-panel and window-side center actions, the tutorial or event-follow branches around `0x00435b2d` and `0x0044c75e`, and broader shell-side center helpers around `0x00505e0c`, `0x005060f7`, and `0x0051486b`. This is therefore the shared shell-facing center-on-object helper with one caller-selected zoom-policy mode rather than a station-only centering path.","objdump + caller xrefs + local disassembly + world-view-center correlation"
0x004339b0,144,scenario_state_set_investor_confidence_issue_lane_and_refresh_company_support_scalars,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Clamps one small scenario-side issue lane and refreshes the company-side support scalar family derived from it. The helper clamps the incoming value to `0..4`, stores the result in `[this+0x2d]`, derives one companion float in `[this+0x29]` through the fixed affine mapping at `0x005c85b8/0x005c8658`, and then walks the live company collection at `0x0062be10`, re-entering `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` on every live company to refresh the dependent support-side cache. Current grounded callers include the compact runtime-effect dispatcher branch at `0x00431db2`, the local setup or reset lane at `0x00436e05`, and the neighboring scenario-side text or collection refresh branch at `0x00434d23`, which keeps this helper bounded as the shared setter for the investor-confidence-style issue lane beneath equity-support and share-price logic rather than a generic scalar write.","objdump + local disassembly + caller correlation + company-support-refresh correlation"
0x00433850,109,scenario_state_refresh_active_chairman_profiles_with_reentrancy_guard,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Re-entrant-safe refresh dispatcher over the active chairman-profile family. The helper uses globals `0x0062be20` and `0x0062be1c` as a guard plus rerun latch: when no refresh is in progress it raises the guard, clears the rerun latch, walks the global persona collection at `0x006ceb9c` through `profile_collection_count_active_chairman_records` `0x00477820` and `profile_collection_get_nth_active_chairman_record` `0x00477860`, and re-enters `0x004771e0` on each active chairman record before dropping the guard. If any nested path re-raises the rerun latch, the outer loop repeats until the latch stays clear. Current grounded callers include the periodic service branch at `0x0040a7ae`, the chairman cash or tuning adjustment paths at `0x00476541` and `0x004771ca`, and several neighboring company-side mutation branches, so this is the safest current read for the shared active-chairman refresh pass rather than a one-off persona walker.","objdump + local disassembly + caller correlation + active-chairman refresh correlation + reentrancy-guard correlation"
0x00437220,279,world_build_chairman_profile_slot_records,map,thiscall,inferred,objdump + strings + caller xrefs,4,"Post-load chairman-profile materialization pass reached under banner id `319` `Setting up Players and Companies...`. The helper first refreshes one local occupancy map through `0x0047bc80`, optionally waits on the multiplayer preview owner at `0x006cd8d8`, then walks the 16 selector bytes at `[0x006cec7c+0x87]` together with the per-slot staging table rooted at `[this+0x69d8]`. Current slot-field semantics are tighter now: `[slot+0x00]` is the staged chairman profile id, `[slot+0x01]` is the Optional-versus-Mandatory byte with nonzero=`Optional` and zero=`Mandatory`, `[slot+0x02]` is the ordinary seat-enable byte that combines with the separate per-slot gate at `[this+0x0bc3+slot*9]` to surface `Human`, `Computer`, and `Human or Computer`, `[slot+0x03]` is the special occupied-seat byte, and `[slot+0x04]` is the numeric tuning field copied into the resolved profile. Zero selectors take the random unused-profile path; nonzero selectors map directly onto one persona index; and campaign mode at `[0x006cec7c+0xc5]` can override back through the scenario slot table. Each resolved profile record is pulled from the global persona collection at `0x006ceb9c`, formatted through `0x0050a16f`, and seeded from the static persona table at `0x005f2d28`, whose localized ids include `2730` `Unassigned`, the named-chairman range `2731+`, and the adjacent biography range `2495+`. Both this helper and the neighboring selector seeder treat either `[slot+0x02]` or `[slot+0x03]` as enough to keep a slot live, but current grounded writes only seed `[slot+0x03]` on slot zero and later move it solely by whole-record compaction. That makes `[slot+0x03]` the strongest current anchor for the distinguished primary-human-seat marker rather than a generic role byte. The helper leaves one per-slot record family live in the resolved persona objects, stores per-profile numeric tuning from `[slot+0x04]` into `[profile+0x154]` and `[profile+0x158]`, and finishes by writing the selected profile id to `[this+0x25]` plus the linked owner-company id from `[profile+0x1dd]` to `[this+0x21]`. Current grounded callers are the main post-load generation pipeline at `0x004384d0` and the saved-runtime tail inside `world_entry_transition_and_runtime_bringup` `0x00443a50`.","objdump + RT3.lng strings + caller xrefs + table inspection + shell editor cross-check"
0x004377a0,693,world_seed_default_chairman_profile_slots,map,thiscall,inferred,objdump + caller xrefs + strings,4,"Seeds the 16 scenario-side chairman selector bytes at `[0x006cec7c+0x87]` from the local chairman-slot table rooted at `[this+0x69d8]` before the later profile-record materialization pass runs. In editor-map mode the helper first compacts the 16 local 9-byte slot records so occupied slots bubble forward whenever a later slot has either the ordinary seat-enable byte `[slot+0x02]` or the special occupied-seat byte `[slot+0x03]` set and an earlier slot has neither; it then clears selectors for empty slots and assigns deterministic defaults for occupied ones, using selector `1` for the first occupied slot and selector `0x64+n` for later occupied slots. The same slot layout is now bounded more tightly by the editor window family around `0x004cc2d0`: `[slot+0x00]` is the staged chairman profile id, `[slot+0x01]` is the Optional-versus-Mandatory flag with nonzero=`Optional` and zero=`Mandatory`, `[slot+0x02]` is the ordinary seat-enable byte, `[slot+0x03]` is the special occupied-seat byte, and `[slot+0x04]` is the numeric tuning field. Current grounded writes seed `[slot+0x03]` on slot zero and the compaction pass moves it only by swapping whole 9-byte records, which matches the selector policy: one distinguished first slot gets selector `1`, and the remaining occupied slots get the `0x64+n` opponent range. After the selector seeding pass it walks the selector array, resolves each chosen persona through the global collection at `0x006ceb9c`, constructs or refreshes the per-profile record through `0x00476140`, copies the numeric tuning field from `[slot+0x04]` into `[profile+0x154]` and `[profile+0x158]`, and finally seeds the scenario-state summary pair from the first persona entry: `[this+0x25]` becomes the selected profile id while `[this+0x21]` becomes the linked owner-company id through `[profile+0x1dd]`. Current grounded caller is the neighboring world bring-up path around `0x00438692`, where this helper runs after the setup-side burst branch and immediately before the localized `Calculating Heights...` progress update.","objdump + caller xrefs + RT3.lng strings + slot-table inspection + shell editor cross-check"
0x00434870,23,scenario_state_get_selected_chairman_company_record,map,thiscall,inferred,objdump + global-state inspection,4,"Returns the currently selected company record for the shell-side scenario state object at `0x006cec78`. The helper reads `[this+0x21]` as a company id and resolves that id through the live company collection at `0x0062be10`; zero or negative ids return null. This is the clearest direct accessor yet for the summary field written by the post-load chairman-profile lane.","objdump + global-state inspection + caller correlation"
0x00434890,35,scenario_state_set_selected_chairman_profile,map,thiscall,inferred,objdump + global-state inspection,4,"Sets the currently selected chairman profile on the shell-side scenario state object at `0x006cec78`. The helper stores the incoming persona id into `[this+0x25]`, resolves that persona through the global profile collection at `0x006ceb9c`, and then copies the linked owner-company id from `[profile+0x1dd]` into `[this+0x21]`. This grounds the summary pair used by the post-load chairman-profile setup lane: `[state+0x25]` is the selected chairman profile id and `[state+0x21]` is the corresponding owning company id.","objdump + global-state inspection + caller correlation"
0x004348c0,23,scenario_state_get_selected_chairman_profile_record,map,thiscall,inferred,objdump + global-state inspection,4,"Returns the currently selected chairman profile record for the shell-side scenario state object at `0x006cec78`. The helper reads `[this+0x25]` as a profile id and resolves it through the global persona collection at `0x006ceb9c`; zero or negative ids return null. This pairs directly with scenario_state_set_selected_chairman_profile at `0x00434890`.","objdump + global-state inspection + caller correlation"
0x004337c0,128,scenario_state_append_runtime_effect_or_queue_record,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Allocates one zeroed `0x20`-byte node through `0x005a125d`, copies one caller-supplied string or payload seed into `[node+0x04..]` through `0x0051d820`, stores six further caller dwords at `[node+0x08..+0x1c]`, and appends the finished node to the singly linked list rooted at `[this+0x66a6]`. Current grounded callers include `world_region_collection_pick_periodic_candidate_region_and_queue_scaled_event_record` `0x00422100`, which appends literal-kind-`7` records keyed by one chosen class-0 region id and scaled amount, plus the shell-facing side path inside `world_region_try_place_candidate_structure` `0x00422ee0`, several startup-company branches around `0x0047d282/0x0047d409/0x0047d609`, and the broader runtime-effect service family. The exact gameplay label of this linked `0x20`-byte record family is still open, so the safest current name stays structural around appending one runtime-effect or queue record node beneath scenario state.","objdump + local disassembly + caller correlation + queue-node-list correlation"
0x00436590,372,scenario_state_compute_issue_opinion_multiplier,simulation,thiscall,inferred,objdump + caller inspection,4,"Computes one bounded opinion multiplier for a caller-selected issue slot on the active scenario or shell state rooted at `0x006cec78`. The helper starts from the base issue term at `[this + issue*4 + 0x8a]`, clamps that raw value to a floor of `-99`, normalizes it into a multiplier around `1.0`, and then optionally folds in up to three issue-specific override tables: a company-side term from `[company + issue*4 + 0x35b]`, a chairman-profile term from `[profile + issue*4 + 0x2ab]`, and a territory-side term from `[territory + issue*4 + 0x3b5]`. When the profile argument is omitted but a valid company is supplied, it implicitly reuses that company's linked chairman id from `[company+0x3b]`. The final multiplier is clamped to a small positive floor near `0.01` before return. Current grounded callers include the broader support-adjusted share-price helper at `0x00424fd0`, the merger vote resolver at `0x004ebd10` with issue id `0x3a`, and several other company-policy and shell-side opinion branches. The merger-side `0x3a` use now lines up directly with `RT3.lng` id `726`, which says public merger votes depend on their attitude toward the management of the two companies, so this issue slot is now best read as the merger-management-attitude multiplier.","objdump + caller inspection + issue-table correlation + merger-text correlation"
0x004768c0,53,chairman_profile_owns_all_company_shares,simulation,thiscall,inferred,objdump + caller inspection,4,"Boolean ownership predicate over one chairman profile and company id. The helper resolves the requested company through the live company collection at `0x0062be10`, reads the company's full outstanding-share count from `[company+0x47]`, and compares it against the current profile's holding slot for that same company at `[profile + company_id*4 + 0x15d]`. It returns `1` only when the profile holds the full outstanding-share band and `0` otherwise. Current grounded caller is the CompanyDetail section-0 overview formatter at `0x004e5cf0`, where this is the decision point between the wholly-owned text family `3046/3047` and the investor-attitude text family `3048/3049`.","objdump + caller inspection + ownership-predicate correlation"
0x00436710,163,scenario_state_sum_issue_opinion_terms_raw,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Raw additive companion to `scenario_state_compute_issue_opinion_multiplier` on the active scenario or shell state rooted at `0x006cec78`. The helper starts from the base issue term at `[this + issue*4 + 0x8a]`, then optionally adds the company override term at `[company + issue*4 + 0x35b]`, the chairman-profile override term at `[profile + issue*4 + 0x2ab]`, and the territory override term at `[territory + issue*4 + 0x3b5]` without normalizing or clamping the result into a multiplier. When the profile argument is omitted but a valid company is supplied, it implicitly reuses that company's linked chairman id from `[company+0x3b]`. Current grounded callers include the city-connection bonus lane through `company_compute_issue39_opinion_bias_scalar` at `0x00424580` and several neighboring policy or setup branches that treat the returned integer as one raw issue-opinion total rather than a finished probability or vote scalar.","objdump + caller xrefs + callsite inspection + issue-table correlation + raw-sum correlation"
0x00437a60,41,world_toggle_pause_or_restore_game_speed,simulation,thiscall,inferred,objdump + strings,3,"Pause or resume toggle over the world game-speed fields. When the current mode at `[this+0x19]` is above zero it re-enters world_set_game_speed_mode with target `0` to pause; otherwise it restores the saved nonzero resume mode from `[this+0x1d]`. This matches the player-facing speed-control family rooted in `Paused` through `Very Fast` and their tooltips in `RT3.lng` ids `1795..1800`.","objdump + RT3.lng strings"
0x00437d70,736,shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats,shell,thiscall,inferred,objdump + local disassembly + static-table decode + RT3.lng strings,4,"Broader shell-side cheat owner reached from the registered command wrapper `shell_command_dispatch_scenario_followon_0x437d70_if_active` `0x00441340`. After the usual single-profile gate through `0x004349a0`, the helper increments shell counter `[0x006d401c+0xc60]`, opens the callback-driven modal rooted at `RT3.lng` id `2922` `Do I detect a cheater in the house?\\n\\nEnter code (or <ESC> to cancel):` through `0x005193f0 -> 0x004c98a0`, and then scans the fixed 26-entry cheat table at `0x005ee2c8`. Current grounded case coverage is real: selector `0` dispatches winner or loss outcome modes through `0x004367c0` using labels `3618/3619/3620/3622`; selector `1` jumps out to `0x004d676c`, where it clears the selected-company stat bands rooted at `[company+0x0cfb]`, `[company+0x0d7f]`, and `[company+0x1c47]`; selector `2` posts one caller-supplied float delta into the selected company through `company_add_delta_into_stat_series_current_slot_and_optional_cash_totals` `0x0042a080`; selector `3` posts one signed integer delta into the selected chairman profile through `profile_entry_add_signed_integer_delta_into_qword_field_0x154` `0x00476050`; selector `4` resolves one locomotive record by primary or alias stem through `0x00461c00` and applies it to every train owned by the selected company through `0x004aefb0`; selector `5` walks the live territory collection and forces access-rights byte `1` through `company_set_territory_access_rights_byte` `0x00424030`; selector `6` toggles scenario byte `[state+0x4c8f]`; selector `7` runs the train-wide branch through `0x004ad7a0(1)`; and selectors `8/9/10` toggle scenario bytes `[state+0x4c8e/+0x4c8d/+0x4c8c]`. The same table also contains later labeled rows `3634` `Orca` and alias-only names `Katie..Seymour`, but their selector values lie above the visible jump-table bound `0x0a`, so current evidence only supports treating them as unreached or separately handled tail entries rather than active cases in this owner.","objdump + local disassembly + static-table decode + RT3.lng strings + cheat-table correlation + selected-company/profile mutation correlation"
0x00448aa0,28,world_sample_companion_float_grid_value_by_cell,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny float-raster sampler over the companion world grid rooted at `[this+0x1605]`. The helper uses width field `[this+0x15d9]`, flattens the caller-supplied cell coordinates with an extra `+1` row stride, reads one `float` from that raster, and returns it in `st(0)`. Current grounded callers include `world_compute_transport_and_pricing_grid` `0x0044fb70`, the flagged-cell sample collector `world_grid_count_flagged_cells_and_collect_float_samples` `0x00414fa0`, the projected-rectangle helper `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, and several neighboring shell or presentation branches, so this is the safest current read for the shared companion float-grid sampler rather than a transport-only helper.","objdump + caller inspection + field correlation + float-raster correlation"
0x00448af0,206,world_query_compact_grid_flag_bitset_membership_by_mode,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Boolean compact-bitset query over three neighboring world-grid flag banks. The helper uses dimensions `[this+0x215d/+0x2161]` to flatten the caller-supplied cell coordinates into one bit index, rejects out-of-bounds cells, and then checks one or more compact bitset banks depending on the caller mode argument: mode `0` checks both `[this+0x2139]` and `[this+0x213d]`, mode `1` checks `[this+0x213d]` only, mode `2` checks `[this+0x2139]` only, and mode `3` checks `[this+0x2141]` only. It returns `1` when any selected bank contains the bit and `0` otherwise. Current grounded callers include the post-load `319` cleanup lane inside `world_run_post_load_generation_pipeline` `0x004384d0`, the placement validator `placed_structure_validate_projected_candidate_placement` `0x004197e0`, the projected-runtime scratch builder `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0`, several neighboring world-scan or presentation branches around `0x004512b5..0x00451393`, and later world-side routes or scenario handlers, so this is the safest current read for the shared compact grid-flag-bitset membership query rather than one specific road- or route-only gate.","objdump + caller inspection + field correlation + compact-bitset correlation + post-load-cleanup correlation"
0x00448c20,132,world_secondary_raster_reclass_cell_to_low3bit_1_or_4_and_clear_primary_companion_plane,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small secondary-raster mutator over one world cell. After rejecting cells whose current secondary class already lies in subset `1/4` through `world_secondary_raster_query_cell_class_in_set_1_4` `0x00534e50`, the helper clears the primary companion byte plane at `[this+0x1655]` for that cell and rewrites the low 3 class bits of the packed secondary record at `[this+0x165d]` to `4` when the old class was `2`, or to `1` otherwise. It then notifies the shell-side world presentation through `0x00534270` with mode `6`. Current grounded callers are the `.smp` restore path inside `world_load_saved_runtime_state_bundle` `0x00446d40` and several shell-side map-editing or painting branches around `0x004f9c17` and `0x004fbcc9`, so this is the safest current read for the shared class-`1/4` demotion helper rather than a more player-facing terrain brush.","objdump + caller inspection + field correlation + secondary-raster correlation"
0x00448cb0,132,world_secondary_raster_reclass_cell_to_low3bit_3_or_5_and_clear_primary_companion_plane,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Sibling of world_secondary_raster_reclass_cell_to_low3bit_1_or_4_and_clear_primary_companion_plane for the `3/5` class family. After rejecting cells already in subset `3/5` through `world_secondary_raster_query_cell_class_in_set_3_5` `0x00534f00`, the helper clears the primary companion byte plane at `[this+0x1655]` for that cell and rewrites the low 3 class bits of the packed secondary record at `[this+0x165d]` to `5` when the old class was `2`, or to `3` otherwise. It then emits the same shell-presentation refresh through `0x00534270` with mode `6`. Current grounded callers are the `.smp` restore path inside `world_load_saved_runtime_state_bundle` `0x00446d40` and shell-side world-editing branches around `0x004f9c05` and `0x004fbce4`.","objdump + caller inspection + field correlation + secondary-raster correlation"
0x00448d40,78,world_secondary_raster_write_primary_companion_plane_byte_and_clear_low3bit_class_tag,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Writes one caller-supplied byte into the primary companion plane at `[this+0x1655]` for the selected world cell, then clears the low 3 class bits in the parallel packed secondary record at `[this+0x165d]`. The written byte comes from `0x00532a30` in the grounded callers, and the helper finishes by notifying the shell-side world presentation through the virtual owner at `0x0062be68`. Current grounded callers are shell-side painting and editing branches around `0x004f9c0e` and `0x004fbcfa`, so this is the safest current read for the shared primary-companion-byte write helper rather than a player-facing terrain label.","objdump + caller inspection + field correlation + secondary-raster correlation"
0x00448d90,43,world_secondary_raster_set_cell_byte2_bit0x10,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small write-side companion to world_secondary_raster_query_cell_byte2_bit0x10_set `0x00448f30`. The helper resolves one packed secondary cell record at `[this+0x165d]`, sets bit `0x10` in byte `2`, and then notifies the shell-side world presentation. Current grounded callers are the `.smp` restore path inside `world_load_saved_runtime_state_bundle` `0x00446d40` and one shell-side scan branch around `0x004fc45d`.","objdump + caller inspection + field correlation + secondary-raster correlation"
0x00448dc0,43,world_secondary_raster_clear_cell_byte2_bit0x10,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Clear-side companion to world_secondary_raster_set_cell_byte2_bit0x10. The helper resolves one packed secondary cell record at `[this+0x165d]`, clears bit `0x10` in byte `2`, and then notifies the shell-side world presentation. Current grounded caller is the shell-side scan branch around `0x004fc464`.","objdump + caller inspection + field correlation + secondary-raster correlation"
0x00448df0,33,world_secondary_raster_query_cell_byte2_low_nibble,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny nibble query over byte `2` of the packed secondary cell record rooted at `[this+0x165d]`. The helper flattens the caller-supplied coordinates, reads byte `2`, masks to the low nibble, and returns that `0..15` value. Current grounded callers are shell-side editing branches around `0x004faab3`, `0x004fabff`, `0x004faf9c`, `0x004fb007`, `0x004fb021`, and `0x004fca0e`, where the nibble is compared against small brush-state counts before the sibling write helper runs.","objdump + caller inspection + field correlation + secondary-raster correlation"
0x00448e20,47,world_secondary_raster_xor_cell_byte2_low_nibble_mask,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small low-nibble update helper over byte `2` of the packed secondary cell record rooted at `[this+0x165d]`. The helper XORs the caller-supplied low-nibble mask with the current low nibble and writes the merged result back without disturbing the upper nibble. Current grounded callers are shell-side editing branches around `0x004faba7` and `0x004fac18`.","objdump + caller inspection + field correlation + secondary-raster correlation"
0x00448e60,30,world_secondary_overlay_vector_x_byte_plane_set_cell_value,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small write helper for the signed X-component byte plane rooted at `[this+0x1661]`. It flattens one world-cell coordinate through width `[this+0x15dd]` and stores the caller byte directly. Current grounded callers are the `.smp` restore path inside `world_load_saved_runtime_state_bundle` `0x00446d40` and shell-side editing branches around `0x004faa59`. Later world-side rebuild logic in `0x00536710` treats this plane together with `[this+0x1665]` as a 2D signed vector field rather than a generic scratch buffer.","objdump + caller inspection + field correlation + vector-plane correlation"
0x00448e90,30,world_secondary_overlay_vector_y_byte_plane_set_cell_value,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Write-side sibling of world_secondary_overlay_vector_x_byte_plane_set_cell_value over the signed Y-component byte plane rooted at `[this+0x1665]`. The helper flattens one world-cell coordinate through width `[this+0x15dd]` and stores the caller byte directly. Current grounded callers are the `.smp` restore path inside `world_load_saved_runtime_state_bundle` `0x00446d40` and shell-side editing branches around `0x004faa6e`, while the later rebuild pass `0x00536710` consumes this plane together with `[this+0x1661]` as a paired local vector field.","objdump + caller inspection + field correlation + vector-plane correlation"
0x00448ec0,27,world_secondary_overlay_vector_x_byte_plane_query_cell_value,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny signed-byte accessor for the X-component overlay vector plane rooted at `[this+0x1661]`. Current grounded callers include neighboring world-side presentation or setup branches around `0x00446458` and shell-side editing branches around `0x004fa9cc`, so this is the safest current read for the X-component vector-plane cell query.","objdump + caller inspection + field correlation + vector-plane correlation"
0x00448ee0,27,world_secondary_overlay_vector_y_byte_plane_query_cell_value,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny signed-byte accessor for the Y-component overlay vector plane rooted at `[this+0x1665]`. Current grounded callers include neighboring world-side presentation or setup branches around `0x00446478` and shell-side editing branches around `0x004fa9e0`, so this is the safest current read for the Y-component vector-plane cell query rather than a generic companion-byte accessor.","objdump + caller inspection + field correlation + vector-plane correlation"
0x00448f00,40,world_secondary_raster_query_cell_low3bit_tag_nonzero,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny predicate over the secondary 3-byte raster rooted at `[this+0x165d]`. The helper flattens the caller-supplied cell coordinates through width `[this+0x15dd]`, reads the first byte of the 3-byte cell record, masks its low 3 bits, and returns `1` when that low-bit tag is nonzero and `0` otherwise. Current grounded callers consistently treat the zero case as the countable or eligible path: the region-border overlay count rebuild `0x004881b0`, the map-editor stats reports at `0x004d0472` and `0x004d1bd3`, and several neighboring world-side scans or scoring branches around `0x00403550`, `0x00450ffc`, and `0x00454599`.","objdump + caller inspection + field correlation + secondary-raster correlation"
0x00448f30,42,world_secondary_raster_query_cell_byte2_bit0x10_set,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small companion predicate over the same secondary 3-byte raster rooted at `[this+0x165d]`. The helper flattens the caller-supplied cell coordinates through width `[this+0x15dd]`, reads byte `2` of the 3-byte cell record, and returns `1` when bit `0x10` is set and `0` otherwise. Current grounded callers include neighboring world-side setup or presentation branches around `0x00446498` and `0x00451090`, plus one shell-side scan at `0x004fc43c`, so this is the safest current read for the shared secondary-raster bit-`0x10` predicate rather than a more player-facing terrain label.","objdump + caller inspection + field correlation + secondary-raster correlation"
0x004490f0,18,world_query_sidecar_plane_cell_count,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny size helper for the sidecar byte-plane family hanging off the live world object. It returns `([this+0x15d9]+1)*([this+0x15d5]+1)`, which is the per-plane cell count used by the four-plane sidecar raster copies. Current grounded callers include the shell-side plane-copy branches around `0x004f5ad6..0x004f5cc7`, so this is the safest current read for the shared sidecar-plane cell-count query rather than a generic world-size helper.","objdump + caller inspection + field correlation + sidecar-plane correlation"
0x00448f60,114,world_load_four_sidecar_byte_planes_from_runtime_bundle,map,thiscall,inferred,objdump + caller inspection + bundle-tag correlation,4,"Loads four sidecar byte-plane buffers tied to the live world raster from one runtime bundle owner. The helper opens chunk family `0x9471..0x9472` through `0x00531360`, computes one plane size through `world_query_sidecar_plane_cell_count` `0x004490f0`, resolves four destination plane pointers through `world_query_sidecar_byte_plane_ptr_by_index` `0x00533b40` from `[this+0x1631 + index*4]`, and fills those four buffers through repeated `0x00531150` reads before closing the chunk family. Current grounded callers are the `.smp` restore path inside world_load_saved_runtime_state_bundle `0x00446d40` and the neighboring world-side bundle-load branch at `0x0044d350`, so this is the safest current read for the shared four-plane runtime-bundle load helper rather than a generic deserializer.","objdump + caller inspection + bundle-tag correlation + sidecar-plane correlation"
0x00448fe0,108,world_serialize_four_sidecar_byte_planes_into_runtime_bundle,map,thiscall,inferred,objdump + caller inspection + bundle-tag correlation,4,"Save-side sibling of world_load_four_sidecar_byte_planes_from_runtime_bundle. The helper opens chunk family `0x9471..0x9472` for output through `0x00531340`, computes the same one-plane size through `world_query_sidecar_plane_cell_count` `0x004490f0`, resolves four source plane pointers through `world_query_sidecar_byte_plane_ptr_by_index` `0x00533b40` from `[this+0x1631 + index*4]`, and writes those four buffers through repeated `0x00531030` calls before closing the chunk family. Current grounded callers are the `.smp` serializer inside world_runtime_serialize_smp_bundle `0x00446240` and the neighboring world-side bundle-save branch at `0x00449714`, so this is the safest current read for the shared four-plane runtime-bundle serializer rather than a generic writer.","objdump + caller inspection + bundle-tag correlation + sidecar-plane correlation"
0x0044afa0,439,world_query_local_companion_float_relief_score_at_cell_with_distance_and_mode_bias,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Composed local world-scalar query over the live world root. The helper first derives one distance-like term from the caller cell to global preview anchor fields `[0x0062be68+0x24/+0x1c]` through the precomputed radial helper `0x0051dc00`; distances above `0x32` contribute one clamped bias term. It then samples the companion float raster rooted at `[world+0x1605]` at the caller cell and across two 8-direction rings from the static offset tables `0x00624b28/0x00624b48`, keeps the highest rounded neighbor sample, and folds the local rise above the center sample into the running score. When preview scalar `[0x0062be68+0x20]` exceeds threshold `0x005ca190` it adds one further scaled bias, and when the neighboring shell-mode gate `0x0041fff0` passes it adds `0x32` more before returning the final score plus base offset `0x8c`. Current grounded callers are the shared rounded-coordinate wrapper `0x0041f6b0` and the sibling virtual wrapper `0x004614d0`.","objdump + caller xrefs + local disassembly + float-grid correlation + radial-distance-helper correlation"
0x00444dc5,11,world_query_global_stage_counter_reached_late_reactivation_threshold,map,cdecl,inferred,objdump + caller inspection + threshold correlation,3,"Tiny signed compare helper over the shared stage counter at `0x00620e94`. It returns the raw comparison against threshold `0x9901`, so current callers only test whether the counter is still below that later reactivation threshold. Grounded callers are the two late world-entry checkpoints at `0x00444044` and `0x00444a83` inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, where a negative result clears `[world+0x39]`. Nearby evidence also shows the same global is seeded to `0x26ad` by `map_bundle_open_reference_databases` `0x00444dd0`, copied into save-side payload state around `0x00441ec5`, and reused as the earlier preseed cutoff by `world_preseed_named_candidate_availability_records_from_live_pool` `0x00437743`, so the safest current read is a shared stage-threshold comparator rather than a one-off world-field helper.","objdump + caller inspection + threshold correlation + global-stage-counter correlation"
0x0044c670,2544,world_service_secondary_grid_marked_cell_overlay_cache,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Recurring world-side service pass over the secondary raster rooted at `[this+0x2135]` after `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60` has cached min/max/count bounds into `[this+0x21c6..+0x21d6]`. The helper first requires shell-state gate `[0x006cec78+0x4af3]`, then consumes the cached bounds to normalize the marked-cell band and rewrite per-cell bits in the same secondary raster. Its later overlay side is tighter now too: after resolving scaled surface dimensions through `shell_world_presentation_query_scaled_surface_dimensions` `0x00534c50`, it walks one local 3-by-32 sample lattice through the static offset tables at `0x00624b28/0x00624b48`, keeps only secondary-raster classes `4..0x0d`, folds several interpolated samples through repeated `0x0051db80` evaluation into one strongest local score, writes packed overlay pixels into the staged surface buffer, and only then publishes that staged overlay through `shell_world_presentation_publish_staged_overlay_surfaces_and_release_buffer` `0x00534af0`. The lower helper cluster beneath that owner is now explicit too: `0x00533e70` clears coarse overlay chunks in a rectangle, `0x00534160` ensures one coarse chunk and seeds local marks, and `0x00534e90` is the neighboring marked-bit predicate over the same 3-byte raster family. Current grounded callers are the recurring simulation-maintenance route-style branch at `0x0040a9f4` inside `simulation_service_periodic_boundary_work` `0x0040a590` and one startup-side world branch at `0x00448168`, so this is the safest current read for the shared secondary-grid marked-cell overlay-cache service rather than a one-shot startup helper or a fully player-facing panel renderer.","objdump + local disassembly + caller inspection + secondary-raster correlation + recurring-maintenance correlation + staged-overlay publish correlation"
0x00443a50,4979,world_entry_transition_and_runtime_bringup,map,cdecl,inferred,objdump + analysis-context,4,"First grounded gameplay-world entry coordinator reached from `shell_map_file_entry_coordinator` `0x00445ac0`. The function boundary is now grounded as the full `0x00443a50..0x00444dc2` bringup span rather than just the early transition head. It stages the selected file path into `0x0062bee0`, dismisses the shell detail-panel controller at `0x006d0818`, drives `shell_transition_mode` through `0x00482ec0`, and resets the previous world bundle through `world_runtime_release_global_services` plus the neighboring startup-profile owner `0x00438890`. After the transition wait it builds temporary bundle payloads from `%1\\%2` and `%1.tmp`, allocates or serializes world-entry records through `0x00530c80`, `0x00531150`, and `0x00531360`, allocates the new world root at `0x0062c120` from the staged filename through `0x0044e910`, notifies the shell owner at `0x0062be68`, and then continues through the larger post-load generation pipeline instead of returning immediately. The later `319` tail is tighter now too: before the final world and shell reactivation it runs one post-bundle status-and-runtime-refresh phase that posts shell progress ids `0x196` and `0x197` through `0x005193f0/0x00540120` with paired `0x004834e0` follow-ons, refreshes event runtime records through `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`, rebuilds the scenario-side port-or-warehouse cargo recipe runtime tables through `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630`, runs the named-candidate availability preseed through `world_preseed_named_candidate_availability_records_from_live_pool` `0x00437743`, and then enters one later staged-profile or availability rehydrate band before the broader reactivation sweep. That rehydrate band posts progress ids `0x32dc/0x3714/0x3715`, reads one `0x108`-byte packed profile block through `0x00531150`, conditionally copies staged runtime-profile bytes from the loaded bundle back into `0x006cec7c` when latch `[profile+0x97]` is set, mirrors the grounded campaign-scenario bit `[profile+0xc5]` and sandbox bit `[profile+0x82]` into world bytes `[world+0x66de]` and `[world+0x66f2]`, restores the selected year or profile choice lane through `[profile+0x77]` into `[world+0x05/+0x09/+0x15]`, and then rehydrates the named locomotive-availability collection at `[world+0x66b6]` before the later world-wide service passes continue. That later reactivation tail is narrower now too: it includes `world_clear_and_reseed_region_center_world_grid_flag_bit` `0x0044c4b0`, then `world_rebuild_all_grid_cell_candidate_cargo_service_bitsets` `0x0044c450`, then `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60`, then the recurring secondary-raster overlay-cache service `world_service_secondary_grid_marked_cell_overlay_cache` `0x0044c670`, before the later route-style rebuild, shell-window, and briefing branches. Only after that later tail does it re-enter the one-shot world-entry runtime-effect service through `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with kind `8`, after which shell-profile latch `[0x006cec7c+0x97]` is cleared. This is therefore the current safest read for the full shell-to-gameplay world-entry transition and runtime bringup owner rather than only the front half of file staging and world allocation.","objdump + analysis-context + caller xrefs + strings + post-load-pipeline correlation + late-tail phase-order correlation + staged-profile-rehydrate correlation"
0x00440530,46,shell_open_or_focus_detail_panel_mode_0x0b_if_allowed,shell,cdecl,inferred,objdump + caller inspection + shell-detail correlation,3,"Direct shell command branch that opens one still-unresolved shell detail-panel mode `0x0b`. The helper first requires the live detail-panel controller at `0x006d0818` and active scenario root `0x006cec78`, then re-enters `shell_can_open_detail_panel_mode_0x0b_or_warn` `0x00434db0`; on success it forwards `(-1, 0x0b)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. Current grounded companion caller is the page-side launcher at `0x004de49a`, which uses the same gate and mode. This is therefore the safest current read for the direct mode-`0x0b` opener rather than a tighter family name we have not yet grounded.","objdump + caller inspection + shell-detail correlation + mode-transition correlation"
0x00440560,22,shell_open_or_focus_detail_panel_mode_0x01_if_present,shell,cdecl,inferred,objdump + local disassembly + shell-detail correlation,2,"Tiny direct shell command stub over the live detail-panel controller at `0x006d0818`. When that controller exists, the helper forwards `(-1, 1)` into `shell_detail_panel_transition_manager` `0x004ddbd0` and otherwise returns immediately. Current local evidence is only strong enough for the structural mode-`1` opener, not for a tighter family name.","objdump + local disassembly + shell-detail correlation"
0x00440580,22,shell_open_or_focus_detail_panel_mode_0x04_if_present,shell,cdecl,inferred,objdump + local disassembly + shell-detail correlation,2,"Tiny direct shell command stub over the live detail-panel controller at `0x006d0818`. When that controller exists, the helper forwards `(-1, 4)` into `shell_detail_panel_transition_manager` `0x004ddbd0` and otherwise returns immediately. Current local evidence is only strong enough for the structural mode-`4` opener, not for a tighter family name.","objdump + local disassembly + shell-detail correlation"
0x004405a0,46,shell_open_or_focus_company_list_panel_if_allowed,shell,cdecl,inferred,objdump + caller inspection + shell-detail correlation,4,"Direct shell command branch that opens the company-list panel through detail-panel mode `7`. The helper first requires the live detail-panel controller at `0x006d0818` and active scenario root `0x006cec78`, then re-enters `shell_can_open_company_list_or_detail_panel_or_warn` `0x00433a40`; on success it forwards `(-1, 7)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. Current grounded companion caller is the page-side command strip at `0x004de2dd`, which uses the same gate and mode. This is therefore the safest current read for the direct company-list opener rather than a generic mode-toggle stub.","objdump + caller inspection + shell-detail correlation + mode-transition correlation"
0x004405d0,126,shell_open_or_focus_selected_company_detail_panel_with_start_company_fallback,shell,cdecl,inferred,objdump + caller inspection + company-detail correlation,4,"Direct shell command branch above the selected-company `CompanyDetail.win` lane. The helper first requires the live detail-panel controller at `0x006d0818`; if no selected-company id is available through `scenario_state_get_selected_chairman_company_id` `0x004337a0`, it raises localized id `368` through the shared shell modal path and, when the current chairman still passes `0x00476d10`, it offers the `Start New Company` dialog through `0x0047d080` before retrying the selected-company lookup. Once a selected-company id exists it re-enters `shell_can_open_company_list_or_detail_panel_or_warn` `0x00433a40` and then forwards `(selected_company_id, 8)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. Current grounded companion caller is the load-screen side launcher strip at `0x004de3a8`, which shares the same gate, fallback dialog, and selected-company handoff. This is therefore the safest current read for the direct selected-company-detail opener with start-company fallback rather than a generic company-command branch.","objdump + caller inspection + company-detail correlation + start-company fallback correlation + mode-transition correlation"
0x00440660,46,shell_open_or_focus_stockbuy_window_for_selected_company_if_allowed,shell,cdecl,inferred,objdump + caller inspection + stockbuy correlation,4,"Direct shell command branch that opens the shell-side `StockBuy.win` family through detail-panel mode `0x0c`. The helper first requires the live detail-panel controller at `0x006d0818` and active scenario root `0x006cec78`, then re-enters `shell_can_open_stockbuy_window_or_warn` `0x00433aa0`; on success it forwards `(-1, 0x0c)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. The later same-mode refresh tail inside `0x004ddbd0` also special-cases mode `0x0c` through `0x00493150`, which keeps this on the `StockBuy.win` family rather than another company-side page. Current grounded companion caller is the page-side launcher at `0x004de50f`.","objdump + caller inspection + stockbuy correlation + mode-transition correlation + same-mode-refresh correlation"
0x00440690,46,shell_open_or_focus_detail_panel_mode_0x06_if_allowed,shell,cdecl,inferred,objdump + caller inspection + shell-detail correlation,3,"Direct shell command branch that opens one still-unresolved shell detail-panel mode `0x06`. The helper first requires the live detail-panel controller at `0x006d0818` and active scenario root `0x006cec78`, then re-enters `shell_can_open_detail_panel_mode_0x06_or_warn` `0x00434e20`; on success it forwards `(-1, 0x06)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. Current grounded companion caller is the page-side launcher at `0x004de27a`, which uses the same gate and mode. This is therefore the safest current read for the direct mode-`0x06` opener rather than a tighter family name we have not yet grounded.","objdump + caller inspection + shell-detail correlation + mode-transition correlation"
0x004406c0,51,shell_open_or_focus_trainbuy_window_if_allowed,shell,cdecl,inferred,objdump + caller inspection + trainbuy correlation,4,"Direct shell command branch above the shell-side `Trainbuy.win` family. The helper first requires the live detail-panel controller at `0x006d0818` and active scenario root `0x006cec78`, then re-enters `shell_can_open_trainbuy_window_or_warn` `0x00433b00`; on success it calls `shell_open_or_focus_trainbuy_window` `0x00512c50` with the fixed singleton-open argument set used by the same family elsewhere. Current grounded companion caller is the page-side launcher at `0x004de7d9`, which shares the same gate and opener. This is therefore the safest current read for the direct train-buy opener rather than a generic shell command stub.","objdump + caller inspection + trainbuy correlation + singleton-open correlation"
0x00440700,22,shell_open_or_focus_load_screen_page_1_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `1` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table already grounds page `1` as the company-overview wrapper.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x00440720,22,shell_open_or_focus_load_screen_page_3_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `3` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `3` as the income-statement slice.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x00440740,22,shell_open_or_focus_load_screen_page_4_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `4` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `4` as the balance-sheet slice.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x00440760,22,shell_open_or_focus_load_screen_page_5_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `5` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `5` as the haulage-report slice.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x00440780,22,shell_open_or_focus_load_screen_page_6_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `6` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `6` as the stock-data slice.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x004407a0,22,shell_open_or_focus_load_screen_page_0x0a_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `0x0a` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `0x0a` as the train-list slice.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x004407c0,22,shell_open_or_focus_load_screen_page_0x0c_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `0x0c` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `0x0c` as the station-list slice.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x004407e0,22,shell_open_or_focus_load_screen_page_0x0f_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `0x0f` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `0x0f` as the industry-list slice.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x00440800,22,shell_open_or_focus_load_screen_page_0x0e_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `0x0e` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `0x0e` as the cargo-list slice.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x00440820,22,shell_open_or_focus_load_screen_page_2_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `2` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `2` as the company-list slice.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x00440840,22,shell_open_or_focus_load_screen_page_7_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `7` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `7` as the player-list slice.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x00440860,22,shell_open_or_focus_load_screen_page_9_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `9` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `9` as the game-status slice.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x00440880,35,shell_toggle_pause_or_restore_game_speed_and_emit_feedback_nudge,shell,cdecl,inferred,objdump + caller inspection + game-speed correlation,2,"Tiny shell command stub over the active scenario root `0x006cec78`. When the scenario object exists, the helper first re-enters `world_toggle_pause_or_restore_game_speed` `0x00437a60` with caller flag `1`, then immediately re-enters the indexed shell feedback helper `0x0045ea20` with selector `0x2c` and scalar `0.5f`. Current local evidence is only strong enough for the pause-toggle plus feedback-nudge structure, not for a tighter player-facing label for the second helper.","objdump + caller inspection + game-speed correlation + feedback-helper correlation"
0x004408b0,21,shell_invoke_world_bundle_coordinator_with_zero_flag_triplet_if_scenario_active,shell,cdecl,inferred,objdump + caller inspection + bundle-coordinator correlation,2,"Tiny shell command stub above `shell_map_file_world_bundle_coordinator` `0x00445de0`. When the active scenario root `0x006cec78` exists, the helper forwards three zero stack arguments into that coordinator and otherwise returns immediately. Current local evidence is only strong enough for the structural zero-flag-triplet wrapper, not for the exact user-facing command name.","objdump + caller inspection + bundle-coordinator correlation"
0x004408d0,21,shell_invoke_world_bundle_coordinator_with_flag_triplet_0_1_0_if_scenario_active,shell,cdecl,inferred,objdump + caller inspection + bundle-coordinator correlation,2,"Tiny shell command stub above `shell_map_file_world_bundle_coordinator` `0x00445de0`. When the active scenario root `0x006cec78` exists, the helper forwards stack flags `(0, 1, 0)` into that coordinator and otherwise returns immediately. Current local evidence is only strong enough for that structural flag-triplet wrapper, not for the exact user-facing command name.","objdump + caller inspection + bundle-coordinator correlation"
0x004408f0,207,shell_assign_camera_view_slot_and_publish_confirmation,shell,cdecl,inferred,objdump + command-registration correlation + world-view correlation,4,"Direct shell command branch for the camera-view assignment family. The helper requires the live world-view owner at `0x0062be68`, stores one camera-view snapshot into the selected slot through `world_view_store_camera_view_slot_snapshot` `0x0043b2c0`, formats one slot label through `0x0051b700`, localizes ids `369` and `370` through `0x005193f0`, resolves one optional current focus label through `0x0045f3d0`, and finally publishes a two-line shell modal through the shared shell modal owner `0x004554e0`. Current direct wrappers `0x00440b00..0x00440b90` map the slot selector in `ECX` to camera views `1..9` and `0`, and the shell command-registration block at `0x0046092f..0x00460cab` ties those wrappers to the localized `Assign Camera View 1..9` and `Assign Camera View 0` command strip. This is therefore the safest current read for the shared camera-view assignment owner rather than a generic world-view modal helper.","objdump + command-registration correlation + world-view correlation + shell-modal correlation + slot-wrapper correlation"
0x004409c0,303,shell_select_camera_view_slot_or_publish_unassigned_warning,shell,cdecl,inferred,objdump + command-registration correlation + world-view correlation,4,"Direct shell command branch for the camera-view selection family. The helper first requires the live world-view owner at `0x0062be68`, then re-enters `world_view_restore_camera_view_slot_snapshot_if_populated` `0x0043ca20`. When the selected slot is populated the restore helper updates the live world-view immediately and this wrapper returns without opening a modal. When the slot is still unassigned, the wrapper formats one slot label through `0x0051b700`, localizes ids `371`, `372`, and `373` through `0x005193f0`, resolves up to two optional focus-label strings through repeated `0x0045f3d0` calls, and then publishes the resulting three-line warning through `0x004554e0`. Current direct wrappers `0x00440ba0..0x00440c30` map the slot selector in `ECX` to camera views `1..9` and `0`, and the shell command-registration block at `0x00460903..0x00460c7a` ties those wrappers to the localized `Select Camera View 1..9` and `Select Camera View 0` command strip. This is therefore the safest current read for the shared camera-view selection owner rather than a generic world-view restore path.","objdump + command-registration correlation + world-view correlation + shell-modal correlation + slot-wrapper correlation"
0x00440b00,12,shell_assign_camera_view_1,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`. It fixes slot selector `1` in `ECX` before tail-jumping into the shared assignment owner. The command-registration block at `0x00460939` ties this wrapper to localized command id `3475`, the `Assign Camera View 1` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440b10,12,shell_assign_camera_view_2,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`. It fixes slot selector `2` in `ECX` before tail-jumping into the shared assignment owner. The command-registration block at `0x0046099c` ties this wrapper to localized command id `3477`, the `Assign Camera View 2` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440b20,12,shell_assign_camera_view_3,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`. It fixes slot selector `3` in `ECX` before tail-jumping into the shared assignment owner. The command-registration block at `0x004609fe` ties this wrapper to localized command id `3479`, the `Assign Camera View 3` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440b30,12,shell_assign_camera_view_4,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`. It fixes slot selector `4` in `ECX` before tail-jumping into the shared assignment owner. The command-registration block at `0x00460a60` ties this wrapper to localized command id `3481`, the `Assign Camera View 4` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440b40,12,shell_assign_camera_view_5,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`. It fixes slot selector `5` in `ECX` before tail-jumping into the shared assignment owner. The command-registration block at `0x00460ac2` ties this wrapper to localized command id `3483`, the `Assign Camera View 5` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440b50,12,shell_assign_camera_view_6,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`. It fixes slot selector `6` in `ECX` before tail-jumping into the shared assignment owner. The command-registration block at `0x00460b24` ties this wrapper to localized command id `3485`, the `Assign Camera View 6` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440b60,12,shell_assign_camera_view_7,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`. It fixes slot selector `7` in `ECX` before tail-jumping into the shared assignment owner. The command-registration block at `0x00460b86` ties this wrapper to localized command id `3487`, the `Assign Camera View 7` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440b70,12,shell_assign_camera_view_8,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`. It fixes slot selector `8` in `ECX` before tail-jumping into the shared assignment owner. The command-registration block at `0x00460be8` ties this wrapper to localized command id `3489`, the `Assign Camera View 8` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440b80,12,shell_assign_camera_view_9,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`. It fixes slot selector `9` in `ECX` before tail-jumping into the shared assignment owner. The command-registration block at `0x00460c4a` ties this wrapper to localized command id `3491`, the `Assign Camera View 9` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440b90,9,shell_assign_camera_view_0,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`. It fixes slot selector `0` in `ECX` before tail-jumping into the shared assignment owner. The command-registration block at `0x00460cac` ties this wrapper to localized command id `3493`, the `Assign Camera View 0` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440ba0,12,shell_select_camera_view_1,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `1` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460909` ties this wrapper to localized command id `3474`, the `Select Camera View 1` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440bb0,12,shell_select_camera_view_2,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `2` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x0046096b` ties this wrapper to localized command id `3476`, the `Select Camera View 2` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440bc0,12,shell_select_camera_view_3,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `3` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x004609cd` ties this wrapper to localized command id `3478`, the `Select Camera View 3` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440bd0,12,shell_select_camera_view_4,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `4` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460a2f` ties this wrapper to localized command id `3480`, the `Select Camera View 4` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440be0,12,shell_select_camera_view_5,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `5` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460a91` ties this wrapper to localized command id `3482`, the `Select Camera View 5` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440bf0,12,shell_select_camera_view_6,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `6` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460af3` ties this wrapper to localized command id `3484`, the `Select Camera View 6` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440c00,12,shell_select_camera_view_7,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `7` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460b55` ties this wrapper to localized command id `3486`, the `Select Camera View 7` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440c10,12,shell_select_camera_view_8,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `8` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460bb7` ties this wrapper to localized command id `3488`, the `Select Camera View 8` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440c20,12,shell_select_camera_view_9,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `9` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460c19` ties this wrapper to localized command id `3490`, the `Select Camera View 9` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440c30,9,shell_select_camera_view_0,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `0` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460c7b` ties this wrapper to localized command id `3492`, the `Select Camera View 0` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440e00,274,shell_command_step_active_window_subject_forward_or_publish_contextual_notice,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,3,"Paired shell command owner for the forward-step action registered at `0x45ffae` with action id `0x22` and localized label id `0x0d65`. The helper first prefers live `StationDetail.win` singleton `0x006d16d8`, where it re-enters `shell_station_detail_cycle_to_next_station_preserving_owner_and_station_site_class` `0x00505e30`. Failing that it prefers the live building-detail singleton `0x006cfd04` and re-enters `0x004b6fc0`, then the live company-detail singleton `0x006cfe4c` when no custom modal is active through `shell_has_live_custom_modal_dialog` `0x004c8680`, where it re-enters `shell_company_detail_select_next_active_company` `0x004c3540`, and finally the sibling live singleton `0x006d3b20`, where it re-enters `0x00514880`. When no supported live window family is active but scenario state `0x006cec78` exists, it builds one contextual notice through localized ids `0x017a/0x017b`, validates the modal path through `0x0045f3d0`, and publishes that notice through `0x004554e0`. This is therefore the broad forward-step shell command above several live detail-window families rather than another StationDetail-only helper.","objdump + command-registration correlation + local disassembly + caller inspection + live-window-priority correlation"
0x00440f20,274,shell_command_step_active_window_subject_backward_or_publish_contextual_notice,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,3,"Backward-step sibling of `shell_command_step_active_window_subject_forward_or_publish_contextual_notice` `0x00440e00`, registered at `0x45ffdf` with action id `0x21` and localized label id `0x0d66`. The helper walks the same live window-family priority chain: `StationDetail.win` through `shell_station_detail_cycle_to_previous_station_preserving_owner_and_station_site_class` `0x00505e40`, then the building-detail singleton `0x006cfd04` through `0x004b6fd0`, then the company-detail singleton `0x006cfe4c` through `shell_company_detail_select_previous_active_company` `0x004c3550` when no custom modal is active, and finally the sibling singleton `0x006d3b20` through `0x00514890`. When none of those families is live but scenario state `0x006cec78` exists, it builds and conditionally publishes the paired contextual notice through localized ids `0x017c/0x017d`, `0x0045f3d0`, and `0x004554e0`. This is therefore the broad reverse-step shell command above several live detail-window families rather than another StationDetail-only helper.","objdump + command-registration correlation + local disassembly + caller inspection + live-window-priority correlation"
0x00441040,131,shell_open_or_focus_train_detail_for_current_or_first_owned_train,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,4,"Direct shell command branch registered at `0x45ff1b` with action id `0x54` and localized label id `0x0d62`. The helper first requires active scenario state `0x006cec78` and the live detail-panel controller `0x006d0818`, then reads the current train-subject id from `[detail+0x78]` and validates it against the live train collection `0x006cfcbc`. When that current subject is invalid it resolves the selected chairman company through `scenario_state_get_selected_chairman_company_record` `0x00434870`, counts that company's owned trains through `company_count_owned_trains` `0x004264c0`, and falls back to the first owned-train id through `0x00426520`. Once a valid train id survives it forwards `(train_id, 2)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. This is therefore the direct train-detail opener or refresher for the current subject with first-owned-train fallback, not a generic collection query.","objdump + command-registration correlation + local disassembly + caller inspection + train-detail correlation + first-owned-train fallback correlation"
0x004410d0,138,shell_open_or_focus_station_detail_for_current_or_first_owned_linked_station,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,4,"Direct shell command branch registered at `0x45ff7d` with action id `0x53` and localized label id `0x0d64`. The helper first requires active scenario state `0x006cec78` and the live detail-panel controller `0x006d0818`, then reads the current station-subject id from `[detail+0x80]` and validates it against the live placed-structure collection `0x006cec20`. When that current subject is invalid it resolves the selected chairman company through `scenario_state_get_selected_chairman_company_record` `0x00434870`, counts that company's owned linked stations through `company_count_linked_transit_sites` `0x00426590(0)`, and falls back to the first owned linked-station id through `0x00426620(1, 0)`. Once a valid station id survives it forwards `(station_id, 5)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. This is therefore the direct station-detail opener or refresher for the current subject with first-owned-station fallback, not a generic collection query.","objdump + command-registration correlation + local disassembly + caller inspection + station-detail correlation + first-owned-station fallback correlation"
0x00441160,50,shell_command_dispatch_live_world_followon_by_query_0x450150,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly,2,"Small registered shell command sibling beneath the same command table. The helper requires active scenario state `0x006cec78` plus the live world root `0x0062c120`, re-enters query helper `0x00450150`, and then dispatches one of two world-root follow-ons: `0x00453370` when that query returns zero, or `0x00453780` when it returns nonzero. The registration block at `0x460286` ties this body to localized label id `0x0d73` and command id `0x47`. Current evidence is strong enough for the dispatch shape and owner level, but not yet for a tighter user-facing verb.","objdump + command-registration correlation + local disassembly + world-root followon correlation"
0x004411a0,52,shell_command_dispatch_live_route_store_followon_by_query_0x4934a0_zero,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly,2,"Small registered shell command sibling over the live route-store root `0x006cfca8`. The helper requires active scenario state `0x006cec78` plus a live route-store owner, re-enters `0x004934a0(0)`, and then dispatches one of two route-store follow-ons: `0x00491880` when that query returns nonzero, or `0x004932a0` when it returns zero. The registration block at `0x4602b7` ties this body to localized label id `0x0f01` and the same command id `0x47` family. Current evidence is strong enough for the dispatch shape and owner level, but not yet for a tighter user-facing verb.","objdump + command-registration correlation + local disassembly + route-store followon correlation"
0x00441240,21,shell_command_toggle_shared_world_preview_global_0x62be84,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + global-state correlation,2,"Tiny registered shell command that flips global dword `0x0062be84` between `0` and `1`. The same global is already grounded on the station-detail candidate-service preview side and on the city-site connection-bonus label formatter, so this command currently reads as a shared world-preview-global toggle rather than a detail-window-local helper. The registration block at `0x4602e8` ties it to action id `0x4e` and localized label id `0x0d74`.","objdump + command-registration correlation + local disassembly + global-state correlation + shared-preview-global correlation"
0x00441260,49,shell_command_open_detail_panel_mode_0x19_variant_0_via_game_uppermost_overlay,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + overlay-control correlation,3,"Registered shell command beneath action id `0x09` and localized label id `0x0d70`. The helper first rejects while sibling singleton `0x006d3b4c` is live, then requires active scenario state `0x006cec78` and the main shell presenter root `0x006d4024`. It derives one boolean from presenter field `[root+0x114216] == 1`, passes that boolean together with variant selector `0` into `0x00433da0`, and that shared helper in turn restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across detail-panel controls `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and forwards the variant into world helper `0x0043a0a0`. Current evidence is strong enough for the mode-`0x19` variant-open owner shape, but not yet for a tighter user-facing label.","objdump + command-registration correlation + local disassembly + overlay-control correlation + mode-0x19 correlation"
0x004412a0,49,shell_command_open_detail_panel_mode_0x19_variant_1_via_game_uppermost_overlay,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + overlay-control correlation,3,"Variant-`1` sibling of `shell_command_open_detail_panel_mode_0x19_variant_0_via_game_uppermost_overlay` `0x00441260`, registered under the same action id `0x09` family with localized label id `0x0d71`. The helper enforces the same `0x006d3b4c` / scenario-state / presenter-root gates, derives the same presenter boolean from `[0x006d4024+0x114216] == 1`, and then re-enters `0x00433da0` with variant selector `1`, which restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across controls `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and forwards the selected variant into world helper `0x0043a0a0`. Current evidence is strong enough for the paired mode-`0x19` variant-open owner shape, but not yet for a tighter user-facing label.","objdump + command-registration correlation + local disassembly + overlay-control correlation + mode-0x19 correlation"
0x004412e0,85,shell_command_enable_shell_state_band_0x1df_and_refresh_derived_year_thresholds,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + shell-state correlation,3,"Registered shell command beneath action id `0x45` and localized label id `0x0d75`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, and then accepts either when shell-state probe `0x00435480` succeeds or when shell flag `[0x006cec74+0x1df]` is already nonzero through `0x00482840`. On the active path it re-enters `scenario_state_rebuild_derived_year_threshold_band` `0x004351c0` with stack flag `1` and then writes shell dwords `[0x006cec74+0x1df/+0x1e3] = 0/0` through `0x00482850`, which also triggers the follow-on refresh helper `0x004354a0`. Current evidence is strong enough for the shell-state-band and year-threshold refresh owner shape, but not yet for a tighter user-facing command name.","objdump + command-registration correlation + local disassembly + shell-state correlation + year-threshold-band correlation"
0x004411e0,31,shell_command_toggle_presenter_flag_0x114276_if_present,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + presenter-root correlation,2,"Small registered shell command beneath action id `0x48` and localized label id `0x0d79`. The helper probes the main shell presenter root at `0x006d4024` and, when that root is live, flips the dword at `[presenter+0x114276]` between `0` and `1`. Current evidence is only strong enough for the direct toggle and owner boundary, not for a tighter user-facing semantic name for that presenter-side latch.","objdump + command-registration correlation + local disassembly + presenter-root correlation + toggle-latch correlation"
0x00441200,52,shell_command_send_message_0xcb_to_control_0x9858_if_active_scenario,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + shell-message correlation,2,"Small registered shell command beneath action id `0x5a` and localized label id `0x0d7b`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, and then forwards shell message `0xcb` with control id `0x9858` plus three zero trailing arguments into the shared shell runtime at `0x006d401c` through `0x00538e00`. Current evidence is strong enough for the message-injection owner shape, but not yet for a tighter user-facing command name for control `0x9858`.","objdump + command-registration correlation + local disassembly + shell-message correlation + active-scenario correlation"
0x00441340,15,shell_command_dispatch_cheat_code_modal_if_active_scenario,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + cheat-owner correlation,2,"Tiny registered shell command beneath action id `0x00be` and localized label id `0x0d7c`. The helper requires active scenario state `0x006cec78` and then tail-calls `shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats` `0x00437d70`. This is therefore the direct command-table entry for the cheat-code modal owner rather than a generic scenario follow-on.","objdump + command-registration correlation + local disassembly + cheat-owner correlation"
0x00441360,68,shell_command_focus_subject_from_collection_0x62b244_via_selector_0x40b2d0,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + focus-handoff correlation,3,"Registered shell command beneath action id `0x47` and localized label id `0x0db3`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, requires live collection root `0x0062b244`, then queries selector `0x0040b2d0(0, 1)`. When that selector returns a nonzero subject id, the helper forwards `(1, 3, subject_id)` into `shell_world_focus_selected_subject_kind_and_id` `0x00437a90`. Current evidence is strong enough for the focus-handoff owner shape, but not yet for a tighter user-facing verb or subject family name.","objdump + command-registration correlation + local disassembly + focus-handoff correlation + selector-correlation"
0x00441790,111,shell_resolve_focused_or_fallback_train_owned_by_selected_company,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Shared current-train resolver beneath the shell-side train command strip. The helper first probes the live world-view owner at `0x0062be68`, and when a focused subject exists through `[view+0x60]` plus vtable slot `+0x6c`, it resolves the corresponding live train from collection `0x006cfcbc` by id `[subject+0x390]`. It then requires that train's owner company id `[train+0x51]` to match the current scenario-selected company through `scenario_state_get_selected_chairman_company_id` `0x004337a0`; otherwise it falls back to `0x005130f0` and repeats the same ownership test on that fallback train. Success returns the live train pointer; failure returns null. Current grounded callers are the adjacent shell command leaves `0x00441810`, `0x00441870`, and `0x004418a0`, so this is the safest current read for the focused-or-fallback owned-train resolver rather than a broader world-view query.","objdump + local disassembly + caller inspection + world-view correlation + selected-company correlation + train-command-strip correlation"
0x00441810,79,shell_command_crash_current_or_fallback_owned_train_or_warn,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + RT3.lng strings,3,"Registered shell command beneath action id `0x43` and localized label id `0x0d77` `Current train crashes`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, and then resolves one owned train through `shell_resolve_focused_or_fallback_train_owned_by_selected_company` `0x00441790`. When no train survives it opens the simple shell modal rooted at localized id `365` `There is no train available to crash!` through `0x005193f0 -> 0x004c98a0`. Otherwise it forwards the resolved train into `train_trigger_crash_state_effects_and_optional_owner_notifications` `0x004ad7a0(1)`.","objdump + command-registration correlation + local disassembly + RT3.lng strings + crash-owner correlation"
0x00441870,34,shell_command_mark_current_or_fallback_owned_train_whistle_request,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + RT3.lng strings,2,"Registered shell command beneath action id `0x57` and localized label id `0x0d76` `Current train whistles`. The helper resolves one owned train through `shell_resolve_focused_or_fallback_train_owned_by_selected_company` `0x00441790`; when that succeeds it resolves the train-side visual owner through `0x004a77b0` and writes request dword `1` into `[owner+0x33a]`. Failure is silent and returns `0`. Current evidence is strong enough for the whistle-request owner shape even though the deeper user-facing meaning of `[owner+0x33a]` remains open.","objdump + command-registration correlation + local disassembly + RT3.lng strings + train-visual-owner correlation"
0x004418a0,79,shell_command_break_down_current_or_fallback_owned_train_or_warn,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + RT3.lng strings,3,"Registered shell command beneath action id `0x42` and localized label id `0x0d78` `Current train breaks down`. The helper enforces the same active-scenario and single-profile gate as the crash sibling `0x00441810`, resolves one owned train through `shell_resolve_focused_or_fallback_train_owned_by_selected_company` `0x00441790`, and when no train survives opens the simple shell modal rooted at localized id `366` `There is no train available to break down!` through `0x005193f0 -> 0x004c98a0`. Otherwise it forwards the train into the sibling failure-state owner `0x004ada00(1)`. Current evidence is strongest for the breakdown-command wrapper above that sibling train-state body rather than a generic shell modal leaf.","objdump + command-registration correlation + local disassembly + RT3.lng strings + failure-state sibling correlation"
0x00441900,53,shell_command_toggle_overview_window_page_0_or_close_if_already_active,shell,cdecl,inferred,objdump + local disassembly + detail-manager correlation,3,"Small shell command-style helper in the `Overview.win` page-toggle strip. The helper probes the shell detail-panel controller at `0x006d0818`; when current mode `[detail+0x8c]` already equals `9` and current overview page `[detail+0x90]` already equals `0`, it closes that page by forwarding `(-1, 0)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. Otherwise it requests mode `9`, page `0` through the same owner. Current evidence is strong enough for the page-toggle shape, but I have not grounded the exact registration row for this specific wrapper yet.","objdump + local disassembly + detail-manager correlation + Overview.win same-mode correlation"
0x00441940,52,shell_command_toggle_overview_window_page_1_or_close_if_already_active,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + detail-manager correlation,3,"Registered shell command beneath action id `0x73` and localized label id `0x0d4b`. The helper mirrors `0x00441900`, but it tests for `Overview.win` mode `9` page `1` at `[0x006d0818+0x90]`; a same-page hit closes through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)`, otherwise it requests mode `9`, page `1`. This is the safest current read for the second `Overview.win` page-toggle command rather than another anonymous detail-manager wrapper.","objdump + command-registration correlation + local disassembly + detail-manager correlation + Overview.win same-mode correlation"
0x00441980,52,shell_command_toggle_overview_window_page_2_or_close_if_already_active,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + detail-manager correlation,3,"Registered shell command beneath action id `0x74` and localized label id `0x0d4c`. The helper mirrors the adjacent page-toggle siblings, but it tests for `Overview.win` mode `9` page `2`; same-page hits close through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)`, while every other case requests mode `9`, page `2`. This is the safest current read for the third `Overview.win` page-toggle command rather than another generic shell leaf.","objdump + command-registration correlation + local disassembly + detail-manager correlation + Overview.win same-mode correlation"
0x004419c0,52,shell_command_toggle_overview_window_page_3_or_close_if_already_active,shell,cdecl,inferred,objdump + local disassembly + detail-manager correlation,3,"Small shell command-style helper in the same `Overview.win` page-toggle strip. The helper tests the live detail manager for mode `9`, page `3`, closes that exact page through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)` when already active, and otherwise requests mode `9`, page `3`. Current evidence is strong enough to keep this as the fourth overview-page toggle, but I have not grounded the exact registration row for this specific wrapper yet.","objdump + local disassembly + detail-manager correlation + Overview.win same-mode correlation"
0x00441a00,52,shell_command_toggle_overview_window_page_4_or_close_if_already_active,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + detail-manager correlation,3,"Registered shell command beneath action id `0x72` and localized label id `0x0d4a`. The helper tests the live detail manager for mode `9`, page `4`, closes that exact page through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)` when already active, and otherwise requests mode `9`, page `4`. This is the current safest read for the fifth overview-page toggle command rather than a more semantic page-name claim.","objdump + command-registration correlation + local disassembly + detail-manager correlation + Overview.win same-mode correlation"
0x00441ac0,39,shell_command_invoke_map_file_entry_coordinator_flags_0_0_0_if_scenario_active_and_shell_idle,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + map-file-coordinator correlation,2,"Small registered shell command beneath action id `0x77` and localized label id `0x0d4f`. The helper requires active scenario state `0x006cec78`, rejects when shell counter `[0x006d401c+0xc64]` is already positive, and then forwards three zero stack arguments into `shell_map_file_entry_coordinator` `0x00445ac0`. Current evidence is strong enough for the wrapper shape and gate conditions, but not yet for the exact player-facing verb mapped onto that zero-triplet coordinator call.","objdump + command-registration correlation + local disassembly + map-file-coordinator correlation + shell-idle-gate correlation"
0x00441af0,39,shell_command_invoke_map_file_entry_coordinator_flags_0_1_0_if_scenario_active_and_shell_idle,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + map-file-coordinator correlation,2,"Small registered shell command beneath action id `0x77` and localized label id `0x0d51`. The helper mirrors `0x00441ac0`, but forwards stack flags `(0, 1, 0)` into `shell_map_file_entry_coordinator` `0x00445ac0` after the same active-scenario and shell-idle gate. Current evidence is strong enough for the wrapper shape and flag triplet, but not yet for the exact user-facing command name for this coordinator variant.","objdump + command-registration correlation + local disassembly + map-file-coordinator correlation + shell-idle-gate correlation"
0x00441b20,39,shell_command_clamp_world_dword_0x168d_not_below_0x1689_if_world_live,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + world-root correlation,2,"Small registered shell command beneath action id `0x48` and localized label id `0x0d72`. The helper requires live world root `0x0062c120`, compares dwords `[world+0x1689]` and `[world+0x168d]`, and rewrites `[world+0x168d]` so it is never below `[world+0x1689]`. Current evidence is only strong enough for that direct clamp and owner boundary, not for a tighter semantic name for this world-side scalar pair.","objdump + command-registration correlation + local disassembly + world-root correlation + clamp correlation"
0x00441b50,358,shell_command_toggle_editor_map_mode_with_one_shot_warning_modals,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,3,"Broader registered shell command sibling above the editor-map-mode setter `0x00482e50`. The helper requires active scenario state `0x006cec78` and the live shell-state root `0x006cec74`, then branches on current editor-map mode lane `[shell+0x68]`. When editor-map mode is already active it uses one-shot latch `0x0062be88` to optionally publish localized modal `0x017e` through `0x005193f0 -> 0x004c98a0`; when editor-map mode is inactive it instead opens warning `0x0b6e` if the active-profile-count gate `0x004349a0` exceeds `1`, or uses one-shot latch `0x0062be8c` to optionally publish modal `0x0b24`. After those gates it computes target mode `([shell+0x68] == 0)` and forwards that boolean into `shell_set_editor_map_mode_and_refresh_detail_panel_world_and_graphics_side_effects` `0x00482e50`. Current evidence is strong enough to treat this as the real editor-map-mode toggle command with one-shot warning modals rather than another anonymous scenario-side follow-on.","objdump + command-registration correlation + local disassembly + caller inspection + editor-map-mode correlation + warning-modal correlation"
0x00441cb0,111,shell_command_raise_startup_selected_year_scalar_by_half_step_and_refresh_calendar,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + calendar-refresh correlation,3,"Registered shell command beneath action id `0x6b` and localized label id `0x0db5`. The helper requires active scenario state `0x006cec78`, rejects when the active-profile-count gate `0x004349a0` exceeds `1`, clears shell dwords `[0x006cec74+0x233]` and `[+0x124]`, adds `0.5` to startup-side scalar `[0x006cec78+0xbfa]`, then re-enters `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` with absolute counter `[0x006cec78+0x15]` before refreshing the live view owner at `0x0062be68` through `0x00439a80`. Current evidence is strongest for a paired half-step raise on the startup selected-year presentation scalar rather than a tighter player-facing command name.","objdump + command-registration correlation + local disassembly + calendar-refresh correlation + startup-scalar correlation"
0x00441d20,111,shell_command_lower_startup_selected_year_scalar_by_half_step_and_refresh_calendar,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + calendar-refresh correlation,3,"Registered shell command beneath action id `0x6d` and localized label id `0x0db6`. The helper mirrors `0x00441cb0`, but subtracts `0.5` from startup-side scalar `[0x006cec78+0xbfa]` before re-entering `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` with absolute counter `[0x006cec78+0x15]` and refreshing the live view owner through `0x00439a80`. It shares the same active-scenario gate, active-profile-count gate, and shell dword clears `[0x006cec74+0x233]` and `[+0x124]`. This is the current safest read for the paired half-step lower command rather than a stronger user-facing label claim.","objdump + command-registration correlation + local disassembly + calendar-refresh correlation + startup-scalar correlation"
0x00441d90,135,shell_build_percent_status_payload_clamped_0_to_100,shell,cdecl,inferred,objdump + local disassembly + caller inspection + status-publisher correlation,3,"Shared percentage-status payload builder used by the save or load progress strip. The helper divides one caller float by one caller integer, multiplies by fixed scalar `100.0f`, rounds through `0x005a10d0`, clamps the result to at most `100`, and then packages that percentage into the small status payload built through `0x0051b700`, `0x005193f0`, and `0x00518de0`, returning the final shell text handle rooted at `0x0062c0d8`. Current grounded callers include the repeated progress-notice loop inside `shell_map_file_world_bundle_coordinator` `0x00445de0` and the adjacent throttled progress callback `0x00441e20`, so this is best read as the shared percent-status payload builder rather than a one-off modal helper.","objdump + local disassembly + caller inspection + status-publisher correlation + save-load-progress correlation"
0x00441e20,155,shell_progress_callback_publish_incremental_percent_status_until_target,shell,cdecl,inferred,objdump + caller inspection + local disassembly + progress-callback correlation,3,"Shared incremental progress callback above `shell_build_percent_status_payload_clamped_0_to_100` `0x00441d90`. The helper first checks global progress latches `0x0062bec8`, `0x0062becc`, and `0x0062c118`; when the caller target count has not advanced it returns immediately, and when the target equals `0x64` it instead advances `0x0062becc` by `0x14` and clears `0x0062c118`. Otherwise it increments `0x0062c118`, derives one intermediate percentage from the caller target divided by `3`, scaled by `100.0`, offset by current base `0x0062becc`, and then re-enters `shell_build_percent_status_payload_clamped_0_to_100` before publishing the resulting status through `0x00538c70` and servicing the shell frame through `0x00482160`. Current grounded owner correlation is the callback installation at `0x00442960`, which writes this function into global `0x00d93988` before entering a longer staged work loop, plus the same save or load progress family around `0x00445de0`. This is the safest current read for the throttled percent-status callback rather than another direct shell command leaf.","objdump + caller inspection + local disassembly + progress-callback correlation + staged-work correlation + shell-status correlation"
0x00441ec0,107,shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2,map,cdecl,inferred,objdump + local disassembly + caller inspection + tagged-bundle correlation,2,"Small tagged-bundle helper in the adjacent map-bundle and companion-image strip. On the save-side branch it writes one caller dword through `global_indexed_slot_table_write_bytes` `0x00531030` and then emits tagged headers `0x2ee0`, `0x03c2`, and `0x2ee1` through `0x00531340`; on the load-side branch it mirrors the same triplet through `0x005a276f` after opening the incoming staged object. Current grounded callers are the two companion-image file siblings `0x00441f70` and `0x004420f0`, where it serializes the selector byte at `[record+0x09]`, the payload size lane `[record+0x04]`, and the copied dword at `[record+0x00]` beside the external `_A.tga/_A.jpg` file path. This is the safest current read for the shared companion-image tag strip rather than a generic slot-table header helper.","objdump + local disassembly + caller inspection + tagged-bundle correlation + companion-image correlation"
0x00441f70,384,shell_map_bundle_load_companion_image_file_into_global_staging_buffer_and_sync_tags,map,cdecl,inferred,objdump + local disassembly + caller inspection + literal inspection,3,"Broader companion-image load helper paired with `0x004420f0`. The helper derives an extensionless stem from the caller path through `support_copy_string_stem_before_first_dot` `0x0051dde0`, appends either `_A.tga` or `_A.jpg` according to selector byte `[record+0x09]`, opens the resulting path in mode `r+b`, streams the file through `0x005a1b05` into a temporary `0x200`-byte loop buffer, and then mirrors the loaded bytes through `0x005a276f` before writing the companion-image selector tags through `shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2` `0x00441ec0`. Current grounded caller is the broader save or load coordinator strip around `0x00445983`, and the sibling overlay-surface owner `0x00535430` later consumes the same global fallback descriptor rooted at `0x0062bed4/0x0062bed8`. This is the safest current read for the companion-image file import path rather than a generic external file loader.","objdump + local disassembly + caller inspection + literal inspection + companion-image correlation + global-fallback-buffer correlation"
0x004420f0,476,shell_map_bundle_write_global_staging_buffer_to_companion_image_file_and_return_path,map,cdecl,inferred,objdump + local disassembly + caller inspection + literal inspection,3,"Write-side sibling of `0x00441f70` for the same companion-image family. The helper derives an extensionless stem from the caller destination path, appends either `_A.tga` or `_A.jpg` by selector byte `[record+0x09]`, tries to open that file in mode `r+b`, and when no existing file is present allocates or reuses the global staging buffer rooted at `0x0062bed4/0x0062bed8` before streaming bytes from the source handle in `0x200`-byte chunks. On the existing-file path it writes the same chunks through `0x005a276f`; on completion it clears the temporary typed cache through `0x0053c900`, copies the final companion path into the caller out-buffer, and returns. Current grounded caller is the save-side branch at `0x00443d1c`, which immediately follows this helper by writing the paired tagged headers `0x2ee0/0x2ee1`. The later world-presentation fallback path `0x00535430` also consumes the same global staging descriptor, so this is the safest current read for the companion-image export path rather than a generic file-copy helper.","objdump + local disassembly + caller inspection + literal inspection + companion-image correlation + global-fallback-buffer correlation"
0x00450150,7,world_query_preview_mode_0x15_latch_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny getter for the shared world-side preview-mode latch byte `[this+0x21c5]`. The helper returns that byte unchanged as a boolean-like integer. Current grounded callers are the shell command strip at `0x00441173`, which chooses between the enter and exit siblings `0x00453370` and `0x00453780`, and the TrackLay destructor path at `0x0050db8d`, which only re-enters `0x00453510` when this latch is clear while world mode `[world+0x2175]` still equals `0x15`. This is therefore the safest current read for the direct mode-`0x15` preview-latch query rather than a broader world-mode predicate.","objdump + caller inspection + local disassembly + mode-0x15 correlation + preview-latch correlation"
0x00450160,816,world_recompute_mode3_preview_normalization_window_0x2195_0x2199,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Mode-`3` prepass beneath the shared world preview rebuild owner `0x00450520`. The helper walks the live secondary-grid cells rooted at `[this+0x2129]` across world dimensions `[+0x2145/+0x2149]`, skips blocked class lanes when cell byte `[cell+0xe6]` carries bit `0x01` without `0x04`, and scores each surviving cell either with fixed `200.0f` or with `0x0042c960(remainder(id, 0x35))` against the current primary preview id `[this+0x2179]`. It tracks min, max, average, and one farther qualifying score through `0x0042b350`, then writes the resulting float window into `[this+0x2195]` and `[this+0x2199]`, clamping the final scale lane to at least `1.0f`. Current grounded caller is the shared active preview or tool overlay rebuild owner `0x00450520`, which invokes this prepass only when current world preview mode `[this+0x2175]` equals `3`. This is the safest current read for the mode-`3` normalization-window recompute helper rather than a broader map-load statistic pass.","objdump + caller inspection + local disassembly + mode-3 correlation + normalization-window correlation"
0x00450490,144,world_query_mode3_preview_cell_best_matching_six_byte_list_color,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small per-cell query beneath the same mode-`3` world preview family. The helper indexes one secondary-grid cell from `(x, y)` through `[this+0x2129]`, reads the six-byte entry list described by count dword `[cell+0xeb]` and pointer `[cell+0xef]`, and searches for the strongest matching entry when the caller-supplied selector id matches the row's leading `u16` or when that selector id is `0`. When any match is found it returns the shared tagged color lane `[0x006cec78+0x66ba] | 0x2c000000`; otherwise it returns zero. Current grounded callers are the mode-`3` pixel cases inside `world_rebuild_active_preview_or_tool_overlay_surface_and_publish_normalized_bounds` `0x00450520`, where this helper acts as the local linked-site or service-list color query rather than as a top-level roster scan.","objdump + caller inspection + local disassembly + mode-3 correlation + per-cell list correlation + tagged-color correlation"
0x00450520,4074,world_rebuild_active_preview_or_tool_overlay_surface_and_publish_normalized_bounds,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Broader shared rebuild owner for the world-side preview or tool-mode family rooted at `[this+0x2175]`, `[+0x2179..+0x2191]`, and transient surface root `[this+0x478]`. The helper first rejects when no active mode is set, runs the mode-`3` normalization prepass `world_recompute_mode3_preview_normalization_window_0x2195_0x2199` `0x00450160` when required, derives the current world-cell rectangle and float scale from the active mode table at `0x005ee5e0/0x005ee5e4`, clamps the active sub-rectangle against the live world dimensions and shell presentation caps, reuses or rebuilds the transient overlay surface through `0x00532490`, `0x00534f80`, and `0x005323f0`, then fills that surface by switching over the active mode and computing one packed color per cell. The per-mode pixel cases mix checkerboard fallbacks with several grounded world queries, including mode-`3` helper `world_query_mode3_preview_cell_best_matching_six_byte_list_color` `0x00450490`, the secondary-grid and overlay classifiers `0x00534e10/0x00534e50/0x00534e90/0x00534ec0/0x00534f00/0x00534f40`, terrain and grid queries `0x00448af0`, `0x00448f00`, `0x00448f30`, and one scalar ramp through `0x0051dfc0`. After rasterizing the active rectangle it publishes the active mode byte through `0x00532510`, refreshes the overlay live flag through `0x00532460`, and pushes the normalized preview bounds back through `0x00532520` and `0x005324e0`. Current grounded callers include the shared wrappers `0x00452d80`, `0x00452db0`, `0x00452f20`, `0x00452f60`, and `0x00452fa0`, plus the mode-`0x15` entry or clear siblings `0x00453370` and `0x00453510`. This is therefore the safest current read for the shared active preview or tool overlay rebuild owner rather than any one window family's private raster pass.","objdump + caller inspection + local disassembly + active-mode correlation + overlay-surface correlation + normalized-bounds correlation + paint-tool correlation"
0x00452d30,68,world_clear_aux_preview_mode_0x2171_and_overlay_companion_live_flag,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small shared clear path inside the world-side preview or tool-mode family. When auxiliary preview mode dword `[this+0x2171]` equals `1`, the helper also clears optional flag dword `[this+0x219d]` and decrements the paired shell-presenter counters `[0x006d4024+0x114272/+0x114266]` when flag `[this+0x21a1]` is still set. It then zeroes `[this+0x2171]` unconditionally and tail-jumps into `world_presentation_clear_overlay_companion_block_live_flag` `0x00532360`. Current grounded callers are the mode-`0x15` entry or clear owners `0x00453370` and `0x00453510`, plus the shell-side cleanup paths in `BuildingDetail.win` at `0x004bc1f1` and `StationDetail.win` at `0x00504a90/0x00505bf0`. This is therefore the safest current read for the auxiliary preview-mode clear helper rather than a generic overlay reset.","objdump + caller inspection + local disassembly + auxiliary-preview correlation + overlay-companion correlation"
0x00452ca0,137,world_set_aux_preview_mode_0x2171_and_reseed_overlay_companion_grid,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small shared setter beside the same world-side preview family. The helper stores the caller mode into auxiliary preview dword `[this+0x2171]`, conditionally arms optional companion flag `[this+0x219d]` when the caller mode is `1`, and increments the paired shell-presenter counters `[0x006d4024+0x114272/+0x114266]` when live flag `[this+0x21a1]` is already set at that moment. It then chooses one of three coarse tile-size lanes (`0x40`, `4`, or `1`) from the auxiliary preview mode and forwards those dimensions plus live world size `[0x0062c120+0x2155/+0x2159]` into `0x00532310` to reseed the local overlay-companion grid. Current grounded callers are `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, which passes mode `1`, and `shell_change_height_window_construct` `0x004bcb50`, which passes mode `6`. This is therefore the safest current read for the auxiliary preview-mode setter and companion-grid reseed helper rather than a station-detail-only preview latch.","objdump + caller inspection + local disassembly + auxiliary-preview correlation + companion-grid correlation"
0x00452d80,33,world_store_preview_scalar_0x217d_and_refresh_active_mode_if_nonzero,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny setter in the same world-side preview family. The helper stores one caller dword into `[this+0x217d]` and, when current mode `[this+0x2175]` is already nonzero, re-enters `0x00450520(0)` to rebuild the active preview or tool state. Current grounded caller is `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, which forwards the current station-detail row through this helper after staging the candidate id. This is the safest current read for the direct scalar setter plus active-mode refresh rather than a more semantic station-only helper.","objdump + caller inspection + local disassembly + preview-scalar correlation"
0x00452db0,88,world_store_preview_linked_site_id_0x2181_rebind_mode3_and_refresh_if_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Shared linked-site id setter beneath the same world-side preview family. The helper first unregisters the previous linked site through `0x00413620` when current mode `[this+0x2175]` equals `3` and old id `[this+0x2181]` is nonzero, stores the caller id into `[this+0x2181]`, then registers the new id through `0x00413750` when mode `3` is still active and the new id is nonzero. When any preview or tool mode is already active it finally re-enters `0x00450520(0)` to rebuild that mode. Current grounded callers are the linked-peer action branches at `0x0040e5b1`, `0x0040e65d`, and `0x0040e97d`, plus `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, which uses it while arming the current station preview. This is therefore the safest current read for the preview-family linked-site setter and mode-3 rebind owner rather than a plain id store.","objdump + caller inspection + local disassembly + linked-site correlation + mode-3 rebind correlation"
0x00452e10,136,placed_structure_collection_dispatch_virtual_slot_0x0c_or_0x10_by_optional_subject_and_linked_peer_gate,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Collection-side dispatch helper over every live placed structure in `0x0062b26c`. For each record it chooses between vtable slot `+0x0c` and `+0x10`. When the caller mode arg is not `-1`, slot `+0x0c` is chosen if either the optional subject id resolves through vtable slot `+0x80` plus `0x004129d0` or the structure already satisfies `placed_structure_has_linked_station_or_transit_peer` `0x0040d230`; otherwise the helper falls back to slot `+0x10`. Current grounded callers are the world preview-mode owners `0x00453370`, `0x00453510`, and the broader mode-switch body `0x00452fa0`, which use this helper while entering, leaving, or changing the same site-aware preview states. This is the safest current read for the collection-wide virtual dispatch gate rather than a narrower route-builder helper.","objdump + caller inspection + local disassembly + placed-structure-collection correlation + linked-peer gate correlation"
0x00452ea0,117,world_refresh_preview_flag_0x21a1_from_world_view_float_and_presenter_counters,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small flag-refresh helper in the same world-side preview family. The helper samples float `[0x0062be68+0x20]` from the live world-view owner against one fixed threshold, normalizes the result to boolean flag `[this+0x21a1]`, and only mutates the paired shell-presenter counters `[0x006d4024+0x114272/+0x114266]` when companion enable dword `[this+0x219d]` is already nonzero and the sampled boolean changed. Current grounded caller is the nearby world-view follow-on at `0x0043c5f6`, which invokes this helper before the later local owner refresh path at `0x0043b350`. This is the safest current read for the view-scalar-driven preview-flag updater rather than a broader camera or zoom-mode owner.","objdump + caller inspection + local disassembly + world-view correlation + preview-flag correlation + presenter-counter correlation"
0x00452f20,48,world_refresh_active_preview_mode_from_four_dword_parameter_block,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small active-mode refresh wrapper over the same preview or tool-mode family. The helper copies four caller dwords into a local parameter block and forwards that block into `0x00450520`, leaving the current mode selector unchanged. Current grounded callers are the world-facing preview publish tails at `0x00436164`, `0x004f7958`, `0x004fb4c4`, `0x004fc4a0`, `0x004fc61a`, and `0x004fd4dc`, where it is used as the parameter-block refresh step rather than a top-level mode switch. This is the safest current read for the four-dword active-mode refresh wrapper.","objdump + caller inspection + local disassembly + parameter-block correlation"
0x00452f60,51,world_store_preview_primary_id_0x2179_dispatch_mode3_collection_and_refresh_if_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared primary-id setter in the same world-side preview family. The helper stores one caller dword into `[this+0x2179]`; when current mode `[this+0x2175]` equals `3` it first re-enters `0x00452e10` with that same id to update the placed-structure collection dispatch, and when any mode is active it then re-enters `0x00450520(0)` to rebuild the current preview state. Current grounded caller is `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, which uses this helper to stage the candidate id before syncing the station row and linked-site id. This is the safest current read for the primary-id setter plus mode-3 dispatch refresh rather than a station-only helper.","objdump + caller inspection + local disassembly + primary-id correlation + mode-3 collection correlation"
0x00452fa0,704,world_switch_preview_or_tool_mode_and_seed_parameter_block,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Broader shared mode-switch owner for the world-side preview or tool family rooted at `[this+0x2171..+0x2191]`. The helper first releases transient surface root `[this+0x478]` through `world_presentation_release_transient_surface_handle_0x478_and_clear_flag_0x159b` `0x00534f80`, reconciles the current mode's presenter counters and placed-structure bindings for the grounded families `3`, `6`, and `7`, and then seeds the caller-supplied parameter block into `[this+0x217d/+0x2181/+0x2185/+0x2189/+0x218d/+0x2191]` together with primary scalar `[this+0x2179]` and target mode `[this+0x2175]`. It finishes by re-entering `0x00450520` on that new state and then replaying the mode-specific side binds such as `0x00413750` for mode `6` and `0x00413620/0x00413750/0x00452e10` for mode `3`. Current grounded callers include `PaintRegion.win`, `PaintSound.win`, and `PaintTerritory.win` constructors and message handlers at `0x004f539f`, `0x004f549e`, `0x004f5784`, `0x004fcd10`, and `0x004fcf30`, plus the linked-peer action branches around `0x0040e60a`, `0x0040e9c2`, and `0x00464f8f`. This is therefore the safest current read for the shared world-side preview or tool mode switch owner rather than a single window-family helper.","objdump + caller inspection + local disassembly + mode-switch correlation + parameter-block correlation + paint-tool correlation + linked-peer action correlation"
0x00453370,405,world_enable_preview_mode_0x15_latch_and_enter_if_idle,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Shared world-side owner for entering the preview-capable mode `0x15`. The helper first rejects when latch byte `[this+0x21c5]` is already nonzero; otherwise it sets that latch and only continues when current mode `[this+0x2175]` is still `0`. On the active path it releases transient surface root `[this+0x478]` through `world_presentation_release_transient_surface_handle_0x478_and_clear_flag_0x159b` `0x00534f80`, reconciles prior shell-presenter counters for the neighboring mode families `3` and `7` plus optional flag pair `[this+0x219d/+0x21a1]`, adjusts the shared presenter count lane `[0x006d4024+0x11426e]` from the mode table at `0x005ee5e8/0x005ee6e4`, seeds mode `0x15` into `[this+0x2175]`, clears the local scalar band `[+0x2179..+0x2189]`, seeds both timeout-like dwords `[+0x218d/+0x2191] = 0x1869f`, and re-enters `0x00450520` before tailing through `0x00452d30` according to shell field `[0x006cec74+0x12c]`. Current grounded caller is the shell command strip at `0x00441182`, which dispatches here when active scenario plus world state exist and the same preview latch is still clear. This is the safest current read for the mode-`0x15` preview-latch entry owner rather than a generic world reset.","objdump + caller inspection + local disassembly + mode-0x15 correlation + presenter-counter correlation + preview-latch correlation"
0x00453510,621,world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Shared teardown-or-reseed owner for the same world-side preview-mode family rooted at mode byte `[this+0x2175]` and latch `[this+0x21c5]`. The helper first reconciles the auxiliary preview byte `[this+0x2171]` through the small clear tail at `0x00452d30`, then tears down the current mode state through `0x00532360`, `0x00532500`, and `world_presentation_release_transient_surface_handle_0x478_and_clear_flag_0x159b` `0x00534f80`, clears the current mode dword `[this+0x2175]`, and decrements the same shell-presenter counter families used by the entry sibling for prior modes `3` and `7` plus optional flags `[this+0x219d/+0x21a1]`. When preview latch byte `[this+0x21c5]` is still set, it then replays the same mode-`0x15` reset strip against the live world root `0x0062c120`, re-seeding `[world+0x2175] = 0x15`, the scalar band `[+0x2179..+0x2191]`, and the later `0x00450520 -> 0x00452d30` tail. When that latch is clear it returns with the mode fully torn down. Current grounded callers include the shell-side linked-peer action branch at `0x0040e94c`, the route or preview wrappers at `0x00449467` and `0x00464f2d`, many shell tool-window destructors such as `0x004f3b50`, `0x004f50fa`, `0x004f5784`, and `0x0050db9c`, plus the explicit latch-clear sibling `0x004537a0`. This is therefore the safest current read for the shared preview-mode clear-or-reseed owner rather than a one-window destructor helper.","objdump + caller inspection + local disassembly + mode-0x15 correlation + presenter-counter correlation + preview-latch correlation + tool-window teardown correlation"
0x00453780,38,world_disable_preview_mode_0x15_latch_and_clear_if_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Tiny paired exit helper for the same world-side preview-mode family. When latch byte `[this+0x21c5]` is nonzero the helper clears that latch and, if current mode `[this+0x2175]` still equals `0x15`, tail-jumps into `world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched` `0x00453510`; otherwise it returns immediately. Current grounded callers are the shell command strip at `0x0044118a` and the neighboring settings-side wrapper at `0x004ff90c/0x004ff94a`, which use it as the direct preview-mode unlatch path when the same mode-`0x15` latch is already active. This is the safest current read for the paired latch-clear helper rather than another generic world-mode toggle.","objdump + caller inspection + local disassembly + mode-0x15 correlation + preview-latch correlation"
0x004422d0,96,shell_status_stack_push_four_shell_dwords_and_startup_byte,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Small status-stack push helper rooted at the local ring or stack `0x0062be90` with depth index `0x0062bedc`. The helper snapshots five live status lanes into one `5`-byte slot selected by the current depth: shell dwords `[0x006cec74+0x140]`, `[+0x13c]`, `[+0x138]`, and `[+0x144]`, plus startup byte `[0x006cec78+0x4c74]`, then increments the depth. Current grounded callers include the heavier wrappers `0x004423a0`, the live-world save path inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and one neighboring save-load branch at `0x00446d40`, so this is the safest current read for the shared shell or startup status-band push beneath save-load and world-tool choreography rather than a file-family-specific helper.","objdump + caller xrefs + local disassembly + status-stack correlation"
0x00442330,112,shell_status_stack_pop_restore_four_shell_dwords_and_startup_byte,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Small status-stack pop helper paired with `shell_status_stack_push_four_shell_dwords_and_startup_byte` `0x004422d0`. The helper decrements stack depth `0x0062bedc`, restores the same five status lanes from the selected `0x0062be90` slot back into shell dwords `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` and startup byte `[0x006cec78+0x4c74]`, and returns. Current grounded callers include the higher wrapper `0x004423d0`, the live-world save path inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and one neighboring save-load branch at `0x00446d40`, so this is the safest current read for the shared status-band restore beneath save-load and world-tool choreography rather than an ordinary shell-mode setter.","objdump + caller xrefs + local disassembly + status-stack correlation"
0x004423a0,48,shell_status_stack_push_and_service_active_tracklay_and_stationplace_tools,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared higher wrapper over the same shell/startup status-band stack. It first re-enters `shell_status_stack_push_four_shell_dwords_and_startup_byte` `0x004422d0`, then, when the live TrackLay.win tool object at `0x006d1a8c` is present, calls `0x0050e070`, and when the live StationPlace.win tool object at `0x006d1720` is present, tail-jumps into `0x00507a50`. Current grounded callers include the city-connection route builder `0x00402cb0`, the periodic simulation-side tool wrapper `0x0040a9c0`, the live `.smp` serializer `0x00446240`, and the neighboring collection-side world branch `0x0046b9f0`, so this is the safest current read for pushing the shared status band and then bracketing active world-tool windows rather than another generic shell transition helper.","objdump + caller xrefs + local disassembly + tool-window correlation + status-stack correlation"
0x004423d0,48,shell_status_stack_pop_restore_and_service_active_stationplace_and_tracklay_tools,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared higher restore wrapper paired with `0x004423a0`. It first re-enters `shell_status_stack_pop_restore_four_shell_dwords_and_startup_byte` `0x00442330`, then, when the live StationPlace.win tool object at `0x006d1720` is present, calls `station_place_window_service_frame` `0x0050a530`, and when the live TrackLay.win tool object at `0x006d1a8c` is present, tail-jumps into `track_lay_window_service_frame` `0x0050e1e0`. Current grounded callers include the periodic simulation-side tool wrapper `0x0040a9c0`, the live `.smp` serializer `0x00446240`, the neighboring save-load path `0x00446d40`, and the collection-side world branch `0x0046b9f0`, so this is the safest current read for restoring the shared shell/startup status band and then servicing active world-tool windows rather than a generic post-frame notifier.","objdump + caller xrefs + local disassembly + tool-window correlation + status-stack correlation"
0x00442400,930,shell_setup_load_selected_profile_bundle_into_payload_record,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Setup-side payload loader beneath `shell_setup_window_publish_selected_profile_labels_and_preview_surface` `0x00502220`. The helper takes one staged profile-path seed in `ECX`, one destination payload record in `EDX`, and one small caller flag on the stack; clears the full `0x100f2`-byte payload record; builds one rooted input path from either the default setup file-root query at `0x004839e0` or the caller's alternate root override; opens that bundle through `0x00530c80`; and then branches on `shell_setup_query_file_list_uses_map_extension_pattern` `0x004839b0` to read the structured chunk families through `0x00531150` and `0x00531360`. The ordinary saved-profile side reads the smaller startup payload and preview-surface chunks rooted at ids `0x0001` and `0x03c2`, while the map-style side reads the larger setup payload chunks rooted at ids `0x0004`, `0x2ee0`, and `0x2ee1`, with the exact chunk mix gated by the parsed bundle-header word in the local scratch. Current grounded caller is `0x00502220`, which immediately follows this helper by copying payload fields `+0x14/+0x3b2/+0x3ba/+0x20` into the staged runtime profile through `0x0047be50`.","objdump + local disassembly + caller inspection + chunk-family correlation"
0x004425d0,139,shell_setup_validate_selected_profile_bundle_and_stage_launch_profile,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Validated setup-profile launch helper above shell request `0x0cc`. It allocates one large local scratch block, re-enters `shell_setup_load_selected_profile_bundle_into_payload_record` `0x00442400` on the caller path seed, and only proceeds when the loaded payload carries a nonzero leading byte. On success it force-stages runtime-profile byte `[0x006cec7c+0xc5] = 1`, copies payload byte `+0x22` into profile `+0xc4`, copies payload byte `+0x33` into profile `+0x7d`, mirrors the payload token block `+0x23..+0x32` into profile `+0xc6..+0xd5`, and then issues shell request `0x0cc` through `0x0054e790`. Current grounded callers are the validated setup launch controls inside `shell_setup_window_handle_message` `0x005033d0`, where selector-`3` and selector-`5` siblings share this same staging bridge before the later startup-profile owner runs.","objdump + local disassembly + caller inspection + setup-launch correlation + runtime-profile-staging correlation"
0x00442660,209,shell_publish_progress_sample_notice_from_byte_delta_and_elapsed_ticks,shell,cdecl,inferred,objdump + caller inspection + local disassembly + status-notice correlation,2,"Shared progress-sample notice helper in the surrounding save or load strip. The helper measures the current byte counter through `0x00530b70`, derives one rounded kilobyte delta against previous counter `0x0062c11c`, formats that delta through `%5d`, measures elapsed ticks against `0x0062bed0` through `0x0051d890`, formats the elapsed field through `% 4d`, and then packages both fields plus the caller-supplied status stem into the shared shell text builder `0x005193f0 -> 0x00518de0 -> 0x0051d680`. It finally updates `0x0062c11c` to the current byte counter. Current grounded callers include the bundle-service strip at `0x00413469/0x004134b4` and the save-side progress path inside `shell_map_file_world_bundle_coordinator` around `0x00445098`, so this is the safest current read for the shared byte-delta and elapsed-time progress notice helper rather than a one-off formatter.","objdump + caller inspection + local disassembly + status-notice correlation + save-load-progress correlation"
0x00442740,128,shell_build_temp_surface_from_payload_preview_pixels_and_query_named_resource_field_0x46,shell,cdecl,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Short companion helper in the same save or export strip. The function allocates a temporary `0x40000`-byte RGBA copy of the embedded preview pixel block rooted at `[record+0x03c2]`, constructs one temporary `0xec`-byte surface-like owner through `0x0053b070 -> 0x00543980( pixels, 0x100, 0x100, 0 )`, and then forwards the caller path seed plus fixed selector `0x46` into `0x00542f50`, storing the returned dword into payload field `[record+0x18]`. It finally releases the temporary owner through `0x00542c90 + 0x0053b080`. Current grounded caller is the save-side bundle branch at `0x00445925`, immediately after tagged setup-preview payload export and before the shared progress notice path, so this is the safest current read for the temporary-surface query helper rather than a generic image copier.","objdump + caller inspection + local disassembly + surface-family correlation + save-side bundle correlation"
0x004427c0,624,shell_map_bundle_rewrite_companion_payload_file_via_tmp_path_and_progress_callback,shell,cdecl,inferred,objdump + caller inspection + local disassembly + companion-image correlation,3,"Broader companion-payload rewrite owner in the same save or export strip. The helper copies the caller path into a local buffer, strips its extension through `support_strip_extension_in_place` `0x0051df90`, appends the fixed `%1.tmp` suffix, opens the source file, allocates one full-size heap buffer, and reads the file body through `0x005a1b05`. It then installs `shell_progress_callback_publish_incremental_percent_status_until_target` `0x00441e20` into global `0x00d93988`, forwards the source tail plus destination tail rooted at `+0x03ce` into `0x00553000`, and writes the rewritten output back through `0x005a276f`, preserving the leading `0x03ce` bytes and the trailing untouched source bands around the transformed middle region. On completion it updates payload dword `[record+0x18]`, re-enters `shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2` `0x00441ec0`, frees the temporary buffers, and clears `0x00d93988` again. Current grounded caller is the save-side branch at `0x00443cd3`, which enters this helper only when payload byte `[record+0x66c9]` is set before deriving the external `_A.tga/_A.jpg` companion path. This is the safest current read for the temporary-path companion-payload rewrite owner rather than a generic file copy helper.","objdump + caller inspection + local disassembly + companion-image correlation + tmp-path correlation + progress-callback correlation"
0x00442900,304,shell_map_bundle_rewrite_companion_payload_file_from_record_offsets_and_sync_tags,shell,cdecl,inferred,objdump + caller inspection + local disassembly + companion-image correlation,3,"Sibling companion-payload rewrite owner in the same save or export strip. The helper takes the live payload record in `EAX` plus one caller path on the stack, reads the whole source file into a temporary heap buffer, installs progress callback `0x00441e20` in `0x00d93988`, and then rewrites the middle payload band through `0x00553000` using the stored file offsets in `[record+0x18/+0x1c]`. It writes the rebuilt output in four spans through `0x005a276f`: the leading `0x03ce` bytes, the transformed middle payload, the untouched interval `[record+0x18 .. record+0x1c)`, and the remaining tail. On completion it stores the caller path back into `[record+0x18]`, re-enters `shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2` `0x00441ec0`, frees the temporary buffers, and clears `0x00d93988` again. Current grounded caller is the save-side branch at `0x004459dd`, reached after companion-image import `0x00441f70` when payload byte `[record+0x66c9]` is set, so this is the safest current read for the offset-driven companion-payload rewrite sibling rather than another generic file copier.","objdump + caller inspection + local disassembly + companion-image correlation + progress-callback correlation + save-side bundle correlation"
0x00442a40,31,locomotive_policy_issue_id_is_in_primary_engine_family_band,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save-load correlation,3,"Small range-membership predicate in the locomotive-policy strip. The helper returns true only for issue ids in the two disjoint bands `0x0f1..0x15f` and `0x1c9..0x1da`, and false everywhere else. Current grounded callers are the stream-load path `0x0042ddd0`, the stream-save inverse path `0x00430feb`, the scenario availability-owner path `0x0043160b`, the setup-side terrain or candidate branch `0x004d6125`, and the neighboring primary forward mapper `0x00442a85`, so this is the safest current read for the primary locomotive-engine-family issue-band membership test rather than a generic range helper.","objdump + caller xrefs + local disassembly + stream-save-load correlation + locomotive-policy correlation"
0x00442a5f,38,locomotive_policy_issue_id_is_in_secondary_engine_family_band,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save-load correlation,3,"Sibling range-membership predicate in the same locomotive-policy strip. The helper returns true only for issue ids in the disjoint bands `0x160..0x1c4` and `0x1db..0x1f6`, and false everywhere else. Current grounded callers are the same stream-load and stream-save pair `0x0042ddde` and `0x00431000`, plus the neighboring secondary forward mapper `0x00442aac`, so this is the safest current read for the secondary locomotive-engine-family issue-band membership test rather than another anonymous range check.","objdump + caller xrefs + local disassembly + stream-save-load correlation + locomotive-policy correlation"
0x00442a85,23,locomotive_policy_map_primary_engine_family_index_to_issue_id,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + editor-policy correlation,3,"Primary forward mapper in the locomotive-policy strip. The helper treats the caller value as one compact engine-family or policy index, leaves `0` unchanged, maps `1..0x6f` into issue ids `0x0f1..0x15f`, maps `0x70..` into issue ids `0x1c9..0x1da` by inserting a fixed gap `0x69`, and then bounds the result against the upper limit `0x1db`. Current grounded callers are `locomotive_era_and_engine_type_pass_company_policy_gate` `0x0041d550`, the stream-load branch `0x0042de19`, and the neighboring primary row resolver `0x00442a9c`, so this is the safest current read for the forward map from the primary locomotive engine-family index space into raw issue ids rather than a plain arithmetic shim.","objdump + caller xrefs + local disassembly + editor-policy correlation + locomotive-policy correlation"
0x00442a9c,16,locomotive_policy_resolve_primary_issue_row_ptr_from_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + table-layout correlation,3,"Primary row resolver over the fixed issue table rooted at `0x00610398`. The helper first maps the caller through `locomotive_policy_map_primary_engine_family_index_to_issue_id` `0x00442a85`, then multiplies that issue id by stride `0x6e`, adds the table base `0x00610398`, stores the resulting row pointer in `EDI`, and returns it in `EAX`. Current grounded caller is the shell-side formatter strip at `0x00462449`, which uses the returned row to resolve the primary localized issue-name path. This is the safest current read for the primary issue-row resolver rather than a generic table indexer.","objdump + caller xrefs + local disassembly + table-layout correlation + issue-row correlation"
0x00442aac,23,locomotive_policy_map_secondary_engine_family_index_to_issue_id,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + caller correlation,3,"Secondary forward mapper in the same locomotive-policy strip. The helper leaves index `0` unchanged, maps `1..0x65` into issue ids `0x15f..0x1c4`, maps higher indices into issue ids `0x1db..0x1f6` by inserting fixed gap `0x16`, and bounds the result against the upper limit `0x1f7`. Current grounded callers are the stream-load branch `0x0042de19`, the locomotive scalar owner `0x00461a06`, and the neighboring secondary row resolver `0x00442ac3`, so this is the safest current read for the secondary locomotive-engine-family index-to-issue-id map rather than another plain arithmetic helper.","objdump + caller xrefs + local disassembly + caller correlation + locomotive-policy correlation"
0x00442ac3,16,locomotive_policy_resolve_secondary_issue_row_ptr_from_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + table-layout correlation,3,"Secondary row resolver over the same fixed issue table rooted at `0x00610398`. The helper maps the caller through `locomotive_policy_map_secondary_engine_family_index_to_issue_id` `0x00442aac`, multiplies the resulting issue id by stride `0x6e`, adds the base `0x00610398`, stores the row pointer in `EDI`, and returns it in `EAX`. Current grounded caller is the sibling shell-side formatter strip at `0x004624ae`, where it resolves the alternate localized issue-name row. This is the safest current read for the secondary issue-row resolver rather than a generic pointer arithmetic stub.","objdump + caller xrefs + local disassembly + table-layout correlation + issue-row correlation"
0x00442ad3,14,locomotive_policy_map_primary_issue_id_to_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save correlation,3,"Inverse sibling of `0x00442a85` in the same locomotive-policy strip. The helper subtracts base issue id `0x0f0`, and when the resulting compact index rises above `0x6f` it removes the inserted gap `0x69` to recover the original primary engine-family or policy index. Current grounded caller is the stream-save path `0x00430ff2`, which uses this inverse map when serializing the primary issue band back into the compact save-side index space. This is the safest current read for the primary issue-id-to-index inverse rather than a free-standing subtractive helper.","objdump + caller xrefs + local disassembly + stream-save correlation + locomotive-policy correlation"
0x00442ae1,14,locomotive_policy_map_secondary_issue_id_to_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save correlation,3,"Inverse sibling of `0x00442aac` in the same locomotive-policy strip. The helper subtracts base issue id `0x15f`, and when the resulting compact index rises above `0x65` it removes the inserted gap `0x16` to recover the original secondary engine-family or policy index. Current grounded caller is the stream-save path `0x00431007`, which uses this inverse map when serializing the secondary issue band back into the compact save-side index space. This is the safest current read for the secondary issue-id-to-index inverse rather than another subtractive arithmetic stub.","objdump + caller xrefs + local disassembly + stream-save correlation + locomotive-policy correlation"
0x00442ba0,143,shell_export_live_setup_preview_payload_record_and_normalize_pixel_block_0x100x0x100,shell,thiscall,inferred,objdump + caller inspection + local disassembly + payload-export correlation,3,"Concrete live-payload export helper in the setup and map-bundle strip. The helper copies the full live payload record from `[this+0x66be]` into the caller buffer, forces the leading validity byte to `1`, patches the exported world dimensions from `[0x0062c120+0x2155/+0x2159]` into offsets `+0x01/+0x05`, mirrors three shell-side state bytes from `[0x006d4024+0x11471a]`, `[0x006d4024+0x11471e]`, and `0x0062bec4` into offsets `+0x09..+0x0b`, and then normalizes the embedded pixel block at `+0x03c2` through `0x0047a120` with fixed dimensions `0x100 x 0x100`. Current grounded callers are the save-side setup export path at `0x00444f42`, which immediately forwards the resulting record into the companion-image tag strip `0x00441ec0`, and the slot-table bundle serializer at `0x00446312`, which emits the same copied record under tags `0x2ee0/0x03c2/0x2ee1`. This is the safest current read for the live setup-preview payload exporter rather than a generic memcpy wrapper.","objdump + caller inspection + local disassembly + payload-export correlation + companion-image correlation + bundle-tag correlation"
0x00442c30,3600,shell_apply_scenario_name_specific_post_load_world_and_object_fixups,shell,thiscall,inferred,objdump + caller inspection + local disassembly + scenario-string correlation,4,"Broad post-load fixup owner reached from `world_entry_transition_and_runtime_bringup` at `0x00444b50`. The helper compares the caller-supplied scenario title against many fixed `.rdata` names including `Go West!`, `Germany`, `France`, `State of Germany`, `New Beginnings`, `Dutchlantis`, `Britain`, `New Zealand`, `South East Australia`, `Tex-Mex`, `Germantown`, `The American`, `Central Pacific`, and `Orient Express`, with several branches further gated by setup payload byte `[this+0x66de]`. Matching branches then perform targeted live-world and collection edits: they mutate object-state dwords and bytes inside collections rooted at `0x0062be18`, `0x0062bae0`, and `0x006ada80`; retune selected float and scalar fields; copy paired ten-dword record blocks when specific name or class pairs match; patch secondary-raster bits through the fixed table `0x005ee508..0x005ee5cc`; update one later collection at `0x0062b268`; and inject several scenario-specific text lines into the shell-owned band `[this+0x4f30]` through repeated `0x0051e5d0`. This is the safest current read for the scenario-name-specific post-load fixup owner rather than a generic string-dispatch helper.","objdump + caller inspection + local disassembly + scenario-string correlation + live-world mutation correlation + post-load-fixup correlation"
0x0044c450,96,world_rebuild_all_grid_cell_candidate_cargo_service_bitsets,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Late world-reactivation sweep inside `world_entry_transition_and_runtime_bringup` `0x00443a50`. The helper walks the full live world grid rooted at `[this+0x2129]` through dimensions `[this+0x2145/+0x2149]`, resolves each cell pointer, and re-enters `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` on every cell record. Current grounded caller is the later world-entry tail at `0x444b24`, immediately after `world_clear_and_reseed_region_center_world_grid_flag_bit` `0x0044c4b0` and before the route-style link rebuild at `0x468300`, so this is the current safest read for the world-wide grid-cell cargo-service-bitset refresh wrapper rather than another generic world-grid loop.","objdump + local disassembly + caller inspection + world-grid correlation + cargo-service correlation"
0x0044c4b0,192,world_clear_and_reseed_region_center_world_grid_flag_bit,map,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Late world-reactivation helper inside `world_entry_transition_and_runtime_bringup` `0x00443a50`. The first sweep walks the full live world grid rooted at `[0x0062c120+0x2129]` through dimensions `[+0x2145/+0x2149]` and clears bit `0x10` in each cell byte `[cell+0xe6]`. It then walks the live region collection at `0x0062bae0`, keeps only regions whose class byte `[region+0x23e]` is zero, resolves one representative center cell through `world_region_resolve_center_world_grid_cell` `0x00455f60`, and sets that same bit on the resolved cell. Current grounded caller is the later world-entry tail at `0x444b19`, between the post-bundle runtime refresh phase and the later shell or company-cache follow-ons, so this is the current safest read for the region-center world-grid flag reseed pass rather than another generic grid scrub.","objdump + local disassembly + caller inspection + region-grid correlation"
0x0044c570,256,world_mark_secondary_raster_clear_cell_mask_0x3e_as_class_2_and_cache_bounds,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Small secondary-raster mutation helper beneath the later marked-cell scan and overlay-cache family. After clamping the caller cell coordinates against the current secondary-grid dimensions, the helper resolves the byte raster rooted at `[this+0x2135]` using row stride `[this+0x2155] + 1` and only proceeds when the target byte has no bits in mask `0x3e` and the parallel class predicate `world_secondary_raster_query_cell_class_in_set_1_3_4_5` `0x00534e10` also reports false. On the admit path it widens cached min/max bounds `[this+0x21c6..+0x21d2]`, increments the marked-cell count `[this+0x21d6]`, and then rewrites the target raster byte with `(byte & 0xc3) | 0x02`, i.e. it preserves the outer two bits and the low bit while forcing the masked class field to `0x02`. Current grounded caller is the later radial mutation branch at `0x0044e8e7`, and the written bounds/count fields are the same ones later scanned by `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60`, so this is the safest current read for the small secondary-raster cell-marker helper rather than another generic bounds updater.","objdump + caller xrefs + local disassembly + secondary-raster correlation + marked-cell-bound correlation"
0x0044ce60,272,world_scan_secondary_grid_marked_cell_bounds,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Secondary world-raster bounds scan beneath the later world-entry reactivation tail. The helper clears cached fields `[this+0x21c6/+0x21ca/+0x21ce/+0x21d2/+0x21d6]`, requires the shell-state gate `[0x006cec78+0x4af3]` to be nonzero, and then scans the byte raster rooted at `[this+0x2135]` through dimensions `[this+0x2155/+0x2159]`. Every cell whose byte has any bits in mask `0x3e` contributes to the cached min-X, min-Y, max-X, max-Y, and marked-cell-count slots at those same `0x21c6..0x21d6` fields. Current grounded callers are the later world-entry tail at `0x444c36`, one neighboring startup-side world branch at `0x448168`, and the small count accessor at `0x42f8d8`, so this is the safest current read for the shared marked-cell bounding-box scan over the secondary world raster rather than a fully player-facing overlay owner.","objdump + local disassembly + caller inspection + secondary-raster correlation"
0x0044cfb0,1120,world_load_runtime_grid_and_secondary_raster_tables_from_bundle,map,thiscall,inferred,objdump + caller xrefs + local disassembly + bundle-tag correlation,3,"Heavy world-root bundle-load body beneath `world_construct_root_and_load_bundle_payload_thunk` `0x0044e910`. After the immediate base setup and neighboring local initializers `0x00449270` and `0x00448260`, the helper reads one rooted payload through repeated `0x00531150/0x00531360` calls, storing the core grid and stride scalars into `[this+0x2145/+0x2149/+0x214d/+0x2151/+0x2155/+0x2159/+0x215d/+0x2161/+0x2201]`. It allocates the route-entry collection `0x006cfca8` through `0x00491af0`, allocates or zero-fills the main world arrays `[this+0x2139/+0x213d/+0x2141/+0x2131/+0x2135/+0x212d/+0x2129]` from chunk families `0x2ee2/0x2ee3/0x2ef4/0x2ef5/0x2ef6/0x2ee4/0x2ee5/0x2f43/0x2f44`, and on one loaded-raster path clears low bit `0x01` across every byte in `[this+0x2135]` after the bundle read succeeds. The tail then seeds every live world-grid cell record through `0x0042ae50`, re-enters `world_compute_transport_and_pricing_grid` `0x0044fb70`, refreshes neighboring presentation state through `0x00449f20`, and issues one shell-mode pulse through `0x00484d70` before returning. Current grounded caller is the world-root constructor thunk `0x0044e910` at `0x0044e931`, reached from the world-allocation branch inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the heavy world-grid and secondary-raster bundle-load body rather than the broader bringup owner.","objdump + caller xrefs + local disassembly + bundle-tag correlation + world-grid-array correlation"
0x0044e270,63,world_resolve_secondary_raster_class_record_at_float_xy,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small float-XY lookup over the live world secondary-raster class table. The helper rounds the two caller-supplied float coordinates through `0x005a10d0`, indexes the active byte raster at `[world+0x2131]` with row stride `[world+0x2155]`, shifts the selected byte right by three, and resolves the resulting class token through collection `0x006cfc9c`. Current grounded callers include `city_compute_connection_bonus_candidate_weight` `0x004010f0` and the linked-instance wrapper `0x0047f1f0`, so this is the safest current read for the world-side secondary-raster class-record lookup rather than a city-only predicate.","objdump + caller xrefs + local disassembly + secondary-raster-class correlation"
0x00491af0,295,route_entry_collection_construct_indexed_owner_and_zero_slot_array,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Concrete constructor for the route-entry collection rooted at `0x006cfca8`. The helper installs vtable `0x005cfe18`, re-enters the shared indexed-collection constructor path `0x00518570` with capacity-like scalars `0x3e8` and `0x1f4`, zeros the local side bands `[this+0x88..+0x10a]`, seeds `[this+0x88]` to `-1` and `[this+0x206]` to `-1.0f`, clears the small trailing triplet at `[this+0x10b]`, and allocates then zero-fills the separate slot-array pointer `[this+0x8c]` from caller count argument `arg0 * 4`. Current grounded caller is the world bundle-load body `world_load_runtime_grid_and_secondary_raster_tables_from_bundle` `0x0044cfb0`, so this is the safest current read for the route-entry collection constructor rather than a generic list init.","objdump + caller inspection + local disassembly + indexed-collection correlation + route-entry-collection correlation"
0x00491c20,56,route_entry_collection_refresh_all_live_entries_derived_visual_bands,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small collection-wide post-pass over the route-entry collection `0x006cfca8`. The helper enumerates all live entries through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then re-enters `route_entry_recompute_derived_visual_scalar_bands_and_optional_display_buffer` `0x00539640` on each resolved route entry. Current grounded caller is the later `319`-lane post-load pipeline inside `world_run_post_load_generation_pipeline` `0x004384d0`, where the same pass runs after placed-structure local-runtime refresh and flagged world-grid cleanup, so this is the safest current read for the collection-wide route-entry visual-band refresh pass rather than an anonymous indexed sweep.","objdump + caller inspection + local disassembly + indexed-collection correlation + post-load-pipeline correlation"
0x0044d4e0,512,world_relax_companion_float_grid_cross_average_in_rect_with_raster_bit0_gate,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Local five-pass relaxer over the companion float grid rooted at `[this+0x1605]`. The helper clamps the caller rectangle inward against the live world bounds, derives one radial falloff from the supplied center and radius through `0x0051dc00` when the caller radius is nonzero, averages the four cardinal neighbors around each admitted cell, subtracts the current cell, scales that delta by the falloff, the fixed coefficient at `0x005c8628`, and the caller gain, and only then accumulates the result back into the current float cell. The admit gate is explicit: cells whose paired raster byte in `[this+0x2135]` still has bit `0x01` set are skipped. After the five local passes it always re-enters `world_calculate_height_support_fields_in_rect_and_notify_dependents` `0x0044d410` on the same surviving rectangle. Current grounded caller is the neighboring world-side branch at `0x004bc5d3`, so this is the safest current read for the local cross-neighbor relaxer under the same height-support family rather than a broader global smoothing owner.","objdump + caller xrefs + local disassembly + float-grid correlation + local-relaxation correlation"
0x0044d6e0,912,world_relax_companion_float_grid_cross_average_in_rect_with_acceptance_gate,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Second local five-pass relaxer over the same companion float grid rooted at `[this+0x1605]`. Like the sibling at `0x0044d4e0`, it clamps the caller rectangle, averages the four cardinal neighbors, subtracts the current cell, and scales the resulting delta by a fixed coefficient before optionally accumulating it back into the current float slot. The admit path is tighter here: the cell is skipped whenever the paired raster byte in `[this+0x2135]` still has bit `0x01` set, and otherwise it also consults the neighboring acceptance gate `0x004499c0` before applying the delta. The final caller flag then decides whether the helper tails into `world_calculate_height_support_fields_in_rect_and_notify_dependents` `0x0044d410` on the same rectangle or returns immediately. Current grounded caller is the world-side branch at `0x004190b4`, where it is dispatched once per admitted local cell before the outer owner re-enters `0x0044d410`, so this is the safest current read for the acceptance-gated local cross-neighbor relaxer rather than another generic scalar write.","objdump + caller xrefs + local disassembly + float-grid correlation + acceptance-gate correlation"
0x0044d880,496,world_raise_companion_float_grid_toward_center_sample_in_rect,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Local neighborhood raise helper over the companion float grid rooted at `[this+0x1605]`. The function first validates the caller center cell against live dimensions, optionally seeds one baseline value from the current center sample when the caller gain is positive, expands a square neighborhood around that center by the caller radius, and then for each admitted cell derives one radial falloff through `0x0051dc00`. The body computes a delta from the current cell toward that baseline center sample, scales it by the falloff, the fixed coefficient at `0x005c8628`, and the caller gain, and accumulates the result back into the current float slot. After the neighborhood pass it always re-enters `world_calculate_height_support_fields_in_rect_and_notify_dependents` `0x0044d410` on the same surviving rectangle. Current grounded callers are the nearby world-side branches at `0x004bc676` and `0x004bc716`, so this is the safest current read for the center-sample-biased companion-float raise helper rather than another generic brush or setter.","objdump + caller xrefs + local disassembly + float-grid correlation + center-sample correlation"
0x0044da70,560,world_raise_companion_float_grid_local_peak_in_rect_with_optional_class_3_5_bias,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Local peak-raising helper over the companion float grid rooted at `[this+0x1605]`. The function expands one square neighborhood around the caller cell, clamps that neighborhood to the live world bounds, and then for each admitted cell derives a falloff through `0x0051dc00` when the caller radius is nonzero, scales the current float sample by the caller gain, and quantizes the resulting candidate peak through `0x005a10d0`. When the final caller byte is nonzero it also probes one extra candidate cell through `world_secondary_raster_query_cell_class_in_set_3_5` `0x00534f00`, quantizes that extra sample too, and keeps the larger of the two integer peaks before writing the chosen value back into the float grid. After the neighborhood pass it always re-enters `world_calculate_height_support_fields_in_rect_and_notify_dependents` `0x0044d410` on the same surviving rectangle. Current grounded callers are the nearby world-side branches at `0x004bc51e`, `0x004bc81f`, `0x004f9c74..0x004f9d26`, and `0x004fab45..0x004fad45`, so this is the safest current read for the local peak-raising companion under the same height-support family rather than a generic paint brush.","objdump + caller xrefs + local disassembly + float-grid correlation + local-peak correlation"
0x0044d410,208,world_calculate_height_support_fields_in_rect_and_notify_dependents,map,thiscall,inferred,objdump + caller xrefs + local disassembly + stage-order correlation,3,"Top-level rectangle owner under post-load progress id `322` `Calculating Heights...`. The helper first rejects while generation counter `[this+0x2205]` is live or when the neighboring rect supplier `0x00449e90` cannot produce a surviving work window. On the active path it forwards that rectangle into the shared support owners `0x005374d0`, `0x00533e70`, and `0x00537010`, then notifies the shell owner at `0x0062be68` and refreshes neighboring region or manager companions through `0x00421f50`, `0x00461770`, and `0x00415340`. Current grounded callers include `world_run_post_load_generation_pipeline` `0x004384d0`, the startup-side world path at `0x0044733d`, several recursive local helpers at `0x0044d6cf/0x0044d86e/0x0044da60/0x0044dc86`, and later world-side branches at `0x004143cd`, `0x00415f06`, `0x0041615d`, `0x00418a25`, `0x00418eb7`, `0x004190f0`, and `0x004fb55a..0x004fba30`, so this is the safest current read for the shared height-support and dependent-refresh owner rather than one narrow scalar smoother.","objdump + caller xrefs + local disassembly + stage-order correlation + support-surface correlation"
0x0044dca0,80,world_write_companion_float_grid_cell_and_optionally_refresh_rect,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Small write-side helper over the companion float grid rooted at `[this+0x1605]`. The helper flattens the caller-supplied cell coordinates with world width `[this+0x15d9] + 1`, stores the caller-supplied dword into that one grid slot, and when the final caller flag is nonzero immediately re-enters `world_calculate_height_support_fields_in_rect_and_notify_dependents` `0x0044d410` on the same coordinates as a local rectangle. Current grounded callers include world-side branches at `0x00414398`, `0x00415df2`, `0x00415ec5`, `0x00418956/0x00418977/0x00418996/0x004189b3`, the startup-side world path at `0x00446f20`, and later world-side branches at `0x004fb90b..0x004fb9fb`, so this is the safest current read for the companion-float-grid cell setter with optional local recompute rather than a generic scalar write.","objdump + caller xrefs + local disassembly + float-grid correlation + local-recompute correlation"
0x0044dcf0,316,world_refresh_secondary_raster_marked_bit_from_local_class_2_4_5_neighbors_in_rect,map,thiscall,inferred,objdump + local disassembly + internal caller correlation,3,"Local rectangle refresh helper over the same 3-byte secondary-raster family. The function first normalizes the caller rectangle through `0x00449df0`, then walks every cell in that bounded window and checks the eight immediate neighbors through the shared offset tables `0x00624b28/0x00624b48`. A small border-mode split is now explicit: for interior cells it rejects out-of-bounds neighbors early, while on the border path it treats the clipped edge more permissively. If any admissible neighbor belongs to secondary-raster class set `2/4/5` through `0x00534ec0`, the helper sets bit `0x200` in the current cell's companion word; otherwise it clears that bit. Current grounded callers are the two local mutation helpers `0x0044df03` and `0x0044dfcb`, so this is the safest current read for the marked-bit refresh companion under the same secondary-raster mutation family rather than a standalone overlay scan.","objdump + local disassembly + internal caller correlation + secondary-raster marked-bit correlation"
0x0044df10,208,world_clear_local_secondary_raster_cell_sidecars_demote_class_and_refresh_marked_bits,map,thiscall,inferred,objdump + local disassembly + caller xrefs + secondary-raster correlation,3,"Small local secondary-raster clear helper. When the target cell is in class set `2/4/5` through `0x00534ec0`, the function clears the three local sidecar byte planes rooted at `[this+0x162d]`, `[this+0x1661]`, and `[this+0x1665]` for that cell, then rewrites the cell's low three class bits in place: class `4` is demoted to `1`, class `5` is demoted to `3`, and all other admitted cases have those low class bits cleared. After that local demotion it expands the affected window by one cell in each direction and re-enters `world_refresh_secondary_raster_marked_bit_from_local_class_2_4_5_neighbors_in_rect` `0x0044dcf0` on that surrounding rectangle. Current grounded callers are the higher-level rect refresh owner `0x0044e500` and one later world-side caller at `0x004fa81b`, so this is the safest current read for the local class-demotion and sidecar-clear companion beneath the secondary-raster mutation family.","objdump + local disassembly + caller xrefs + secondary-raster correlation + local-class-demotion correlation"
0x0044e500,720,world_refresh_secondary_raster_edge_flags_in_rect_and_reseed_pending_component,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Rectangle-wide secondary-raster edge refresh owner. The helper first normalizes the caller rectangle through `0x00449df0`, then scans every cell in that window that belongs to class set `2/4/5` through `0x00534ec0`. For each admitted cell it snapshots the eight-neighbor occupancy pattern into a local byte ring, counts total plus parity-split neighbors, and then runs two grounded mutation branches. The first branch handles sparse single-neighbor interior cells: when byte-1 edge flags `0x04/0x08` are still clear and the cell is not on the outer border, it derives one aligned neighbor index from the current cell header and sets either bit `0x04` or `0x08` on byte `[cell+0x1]`. The second branch handles denser or incompatible local patterns: it re-enters `world_clear_local_secondary_raster_cell_sidecars_demote_class_and_refresh_marked_bits` `0x0044df10` on selected cells when the local parity counts or alternating-neighbor pattern fail the expected shape. After the full rectangle pass it also checks the pending global seed coordinates at `[0x006d1304+0x78/+0x7c]`; when those are valid it re-enters `world_seed_secondary_raster_class_2_4_5_component_walk_from_cell` `0x0044c200` and then clears that pending pair back to `-1`. Current grounded caller is the broader owner `0x0044e982`, so this is the safest current read for the rect-wide secondary-raster edge refresh plus pending-component reseed owner rather than a generic area scan.","objdump + caller xrefs + local disassembly + secondary-raster correlation + rect-edge-refresh correlation"
0x0044e7d0,320,world_stamp_radial_secondary_raster_class_2_marks_from_world_coords,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Radial secondary-raster stamp helper over world-space coordinates. After validating the caller float coordinate pair through `0x00414bd0`, the helper converts the center into one clamped integer bounding box using the paired radius constants at `0x005c8dc0` and `0x005c8c30`, then walks every cell in that box. For each candidate cell it evaluates the radial falloff helper `0x0051db80` against the current center and only when that score stays positive does it re-enter `world_mark_secondary_raster_clear_cell_mask_0x3e_as_class_2_and_cache_bounds` `0x0044c570`. Current grounded caller is the placed-structure-side branch at `0x0041d2c4`, which first checks shell gate `[0x006cec78+0x4af3]`, candidate family `[entry+0x41] == 5`, and then forwards the owner's normalized coordinates through `0x00455800/0x00455810`, so this is the safest current read for the shared radial class-`2` stamp helper rather than a generic brush or preview-only rasterizer.","objdump + caller xrefs + local disassembly + secondary-raster correlation + radial-falloff correlation"
0x0044e910,44,world_construct_root_and_load_bundle_payload_thunk,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small world-root constructor thunk. It first runs the immediate base initializer `0x00534f60`, installs vtable `0x005ca9fc`, re-enters the neighboring setup helper `0x00448260`, and then forwards the two caller-supplied constructor arguments into the heavier payload-load body `0x0044cfb0` before returning `this`. Current grounded caller is the world-allocation branch at `0x004442c2`, which allocates the `0x2209`-byte world root and then stores the constructed instance into `0x0062c120`, so this is the safest current read for the small world-root construct-and-load thunk rather than the larger runtime bringup owner itself.","objdump + caller xrefs + local disassembly + world-allocation correlation"
0x0044e940,1792,world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Broad rectangle-scoped rebuild owner over the live secondary-raster derived presentation family. The helper first clamps the caller rectangle through `0x00449df0` and reruns `world_refresh_secondary_raster_edge_flags_in_rect_and_reseed_pending_component` `0x0044e500`. It then lazily ensures one presentation target through `0x0051f090` plus `0x00534910/0x00534920/0x00534930`, refreshes neighboring world-presentation state through `0x00449f20`, resolves scaled target dimensions through `0x00534c50`, and allocates a temporary `width*height` mask. The main scan then walks the live secondary raster `[this+0x165d]` and class predicates `0x00534e10/0x00534e50/0x00534f00/0x00534ec0`: class-`1/3/4/5` cells force `0xff` into the four sidecar byte planes `[this+0x1631..+0x163d]`, while the broader per-cell pass computes local windows, emits packed values into the ensured target through `0x00534730`, and also updates nibble lanes at byte offsets `+0x2` and `+0x5` inside the same three-byte secondary-raster cell family. After the publish it notifies the shell owner at `0x0062be68`, re-enters `0x00449f80` and `0x004881b0`, frees the temporary mask, expands the caller rectangle by dirty bounds `[this+0x21ad..+0x21b9]` through `0x00536710`, and finally seeds companion byte `[this+0x162d]` with `0xc4` on cells selected from mask plane `[this+0x1655]`. Current grounded callers include the post-load generation path at `0x00444a42`, the shell-mode toggle branch at `0x004480ec`, the sibling owner at `0x0044fac6`, and later world-side branches at `0x004fb1f9`, `0x004fc21e`, and `0x004ffee4`, so this is the safest current read for the broad secondary-raster derived-surface and companion-plane rebuild owner rather than a one-off shell preview draw.","objdump + caller xrefs + local disassembly + secondary-raster correlation + derived-surface publish correlation"
0x00414bd0,112,world_query_float_coords_within_live_grid_bounds,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small float-coordinate bounds predicate over the live world grid. The helper returns true only when both caller-supplied float coordinates are `>= 0` and `<= [world+0x15d9]-1` / `<= [world+0x15d5]-1` respectively; otherwise it returns false. Current grounded callers include `placed_structure_validate_projected_candidate_placement` `0x004197e0`, the radial secondary-raster stamp helper `0x0044e7d0`, several later world-side branches around `0x00480af8`, `0x00498278`, and `0x004982cb`, and the StationPlace world-surface branch at `0x005085a4`, so this is the safest current read for the shared float grid-bounds gate rather than a tool-specific placement check.","objdump + caller xrefs + local disassembly + grid-bounds correlation"
0x00449df0,144,world_clamp_rect_coords_to_live_grid_and_validate_nonempty,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small rectangle clamp-and-validate helper over integer world-grid coordinates. The function takes four caller-owned coordinate pointers, clamps the two lower bounds to zero, clamps the two upper bounds to `[world+0x2155]-1` and `[world+0x2159]-1`, and then returns true only when the resulting rectangle is still nonempty and fully within those live dimensions. Current grounded callers include the local marked-bit refresh helper `0x0044dcf0`, the rect-wide secondary-raster edge refresh owner `0x0044e500`, the broader owner `0x0044e982`, later secondary-raster siblings around `0x0044ec93` and `0x0044eee9`, the route-entry window gate `route_entry_collection_query_rect_window_passes_entry_type_gate` `0x00494240`, and one later world-side caller at `0x00494261`, so this is the safest current read for the shared rect clamp-and-validity predicate rather than a serializer-only rectangle helper.","objdump + caller xrefs + local disassembly + rect-clamp correlation"
0x00444dd0,3301,map_bundle_open_reference_databases,map,cdecl,inferred,ghidra-headless,3,Opens and registers a broad reference-database bundle for the active map path. The routine formats %1\\%2 paths allocates bundle state through 0x00530c80 and wires many global datasets including gpdLabelDB gpdCityDB and related city geographic and map reference tables before later shell and map loaders continue.,ghidra + rizin + llvm-objdump + strings
0x00445ac0,790,shell_map_file_entry_coordinator,map,cdecl,inferred,objdump + analysis-context,4,"Broad shell-side file-open and restore coordinator reached from tutorial launch shell UI editor-panel flows and scenario batch processing. It accepts either an incoming filename seed or a generated Quicksave base name and then chooses between the heavier world-entry branch at 0x00443a50 and the sibling saved-runtime restore branch at 0x00446d40. Bit 0x1 in its flag argument now grounds the Quicksave path from the shared string table at 0x005ca9cc. The non-Quicksave interactive path is tighter now too: it routes through shell_file_request_dialog_collect_target_path at 0x004dd010 using load mode 4=.gmp when EditorPanel.win is live and the paired non-editor open modes 8=.gms 9=.gmc and 10=.gmx. The shell-state master flag `[0x006cec74+0x68]` now reinforces that same mapping on the direct Quicksave branch too: when it is nonzero the coordinator appends the `.gmp` token immediately instead of choosing among the scenario families, which makes the flag the strongest current shell-side anchor for editor-map mode rather than a generic post-load toggle. Current surrounding shell evidence now makes the non-editor trio much less anonymous: `.gmx` aligns with sandbox mode because the sibling shell branch at 0x004dc923 gates on 0x006cec7c+0x82 and surfaces string 3898 `The briefing is not available in sandbox games`; `.gmc` aligns with campaign scenarios because 0x004dc9cd gates on 0x006cec7c+0xc5 and surfaces string 3018 about resigning back to the campaign screen; the remaining default `.gms` branch is therefore the standalone scenario family. When a live runtime world is already active the helper appends .smp instead of the non-runtime extensions before the restore branch continues.",objdump + analysis-context + caller xrefs + strings + mode-table inspection + string correlation + Quicksave branch inspection
0x00445de0,1115,shell_map_file_world_bundle_coordinator,map,cdecl,inferred,objdump + analysis-context,4,"Broad shell-side file-save and package coordinator used by direct shell commands scenario batch processing and neighboring shell-editor callers. It accepts either an incoming filename seed a generated Quicksave base name from flag bit 0x1 or the localized `Autosave` seed from flag bit 0x2 string id 387. Its non-Quicksave interactive path is now tighter: it routes through shell_file_request_dialog_collect_target_path at 0x004dd010 using save mode 3=.gmp for the editor-map package path 0=.gms for standalone scenarios 1=.gmc for campaign-scenario saves and 2=.gmx for sandbox saves plus one auxiliary 11=.gmt branch reached only through the separate 0x00434050 check on the side owner at 0x006cd8d8. The shell-state master flag `[0x006cec74+0x68]` now reinforces that editor mapping on the direct save and Quicksave side too: when it is nonzero the coordinator chooses the `.gmp` package mode immediately before the scenario-family checks, which makes the flag the strongest current shell-side anchor for editor-map mode rather than a generic setup toggle. That `.gmt` path no longer looks like another scenario family: when the auxiliary owner is present the coordinator packages the chosen path into the owner-local request block near 0x006cd8d8+0x8f48 and submits it through 0x00469d30; only when that owner is absent does it fall back to map_bundle_open_reference_databases at 0x00444dd0. The campaign mapping is now backed by the numbered `%s%02d.gmc` helper at 0x00517c70 which formats one campaign-progress slot from 0x006cec7c+0xc4 before re-entering this coordinator, while the sandbox mapping is backed by the neighboring shell restriction string 3898 on 0x006cec7c+0x82. When a live runtime world is active the mainline branch still appends .smp and invokes world_runtime_serialize_smp_bundle at 0x00446240. This makes the helper the save-side sibling of shell_map_file_entry_coordinator rather than another restore dispatcher, with `.gmt` now bounded as an auxiliary preview-surface side path instead of a fourth gameplay save family.",objdump + analysis-context + caller xrefs + strings + mode-table inspection + string correlation + side-owner branch inspection + direct save branch inspection
0x00455f60,96,world_region_resolve_center_world_grid_cell,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small region-to-grid resolver that converts one region's cached center coordinate pair into a pointer into the live world-grid cell table rooted at `[0x0062c120+0x2129]`. It reads the cached floats at `[this+0x1ea]` and `[this+0x1e2]`, scales and rounds them through `0x005a10d0`, multiplies the Y-like term by world width `[0x0062c120+0x2145]`, adds the X-like term, and returns the corresponding grid-cell pointer. Current grounded callers include the world-entry region-center flag reseed pass `0x0044c4b0` and several older site- or route-style world-grid query helpers, so this is now the safest current read for the shared region-center world-grid-cell resolver.","objdump + local disassembly + caller inspection + world-grid correlation"
0x00446240,2807,world_runtime_serialize_smp_bundle,map,cdecl,inferred,objdump + analysis-context,3,"Serializes the current live world state into the `.smp` branch used by shell_map_file_world_bundle_coordinator. After dismissing the shell detail controller and running one shell-state service step it first pushes the nested mouse-cursor selection hold through `0x0053f2f0`, snapshots one startup-side status band through `0x004423a0`, allocates a bundle through `0x00530c80`, seeds many typed records through repeated `0x00531030` and `0x00531340` calls, walks world collections under `0x0062c120` and `0x006ada80`, and emits runtime-state payloads through helpers such as `0x00534e50`, `0x00534ec0`, `0x00534f00`, and `0x00534f40`; at the tail it mirrors the paired status follow-on through `0x004423d0`, pops the same mouse-cursor hold through `0x0053f310`, and posts the fixed shell status line through `0x00538c70`. The status-band choreography is tighter now too: `0x004423a0/0x004423d0` bracket the same four shell dwords `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` plus startup byte `[0x006cec78+0x4c74]` through the `0x0062be90` stack while also servicing active TrackLay.win and StationPlace.win tool windows. The raster side is tighter now too, because the serializer writes the two one-byte overlay mask planes separately through chunk ids `0x2cee` for `[world+0x1655]` and `0x2d51` for `[world+0x1659]`, then re-enters world_serialize_four_sidecar_byte_planes_into_runtime_bundle `0x00448fe0` to write four additional byte planes under chunk family `0x9471..0x9472` from the world-owned pointer band at `[world+0x1631 + index*4]` before finalizing through `0x00530a00`. One late fixed-band save is tighter now too: at version `>= 0x400` the serializer writes `49` dwords from `[world+0x4a7f..+0x4b3f]` and one trailing dword from `[world+0x4b43]`, which grounds a direct `.smp` save of the editor-side scenario-rule band rather than only the smaller fixed matrix inferred from checked `gmp/gms/gmx` files. Current grounded caller is `0x00445de0` on the `.smp` path so this looks like the live-world save or package serializer rather than the restore path.","objdump + analysis-context + caller xrefs + strings + sidecar-plane correlation + mask-plane bundle-tag correlation + fixed-runtime-band correlation + cursor-hold choreography correlation + status-stack correlation"
0x00446d40,5401,world_load_saved_runtime_state_bundle,map,cdecl,inferred,objdump + analysis-context,4,"Loads one saved runtime world-state bundle from the `.smp` branch selected by shell_map_file_entry_coordinator. The helper dismisses the shell detail controller releases the prior world runtime drives shell mode and status transitions builds a bundle through 0x00530c80 and repeated 0x00531150 reads allocates a new world root at 0x0062c120 through 0x0044cf70 and then fills that root through repeated grid and object writes, including the secondary-raster class mutators world_secondary_raster_reclass_cell_to_low3bit_1_or_4_and_clear_primary_companion_plane `0x00448c20` and world_secondary_raster_reclass_cell_to_low3bit_3_or_5_and_clear_primary_companion_plane `0x00448cb0`, the byte2-flag and companion-byte writers `0x00448d90`, `0x00448e60`, and `0x00448e90`, and the broader restore-side world-cell helper `0x0044de30`; the raster side is tighter now too, because the loader restores the two one-byte overlay mask planes separately from chunk ids `0x2cee` into `[world+0x1655]` and `0x2d51` into `[world+0x1659]`, and then, for versioned bundles at `>= 0x3ec`, re-enters world_load_four_sidecar_byte_planes_from_runtime_bundle `0x00448f60` to restore four extra byte planes under chunk family `0x9471..0x9472` into the world-owned pointer band `[world+0x1631 + index*4]`. One later fixed-band restore is tighter now too: at version `>= 0x3fc` the loader reads `49` dwords directly into `[world+0x4a7f..+0x4b3f]` and one trailing dword into `[world+0x4b43]`, which grounds a direct `.smp` restore of the editor-side scenario-rule band rather than only the smaller fixed matrix inferred in the checked `gmp/gms/gmx` families. This is the first grounded gameplay save-load restore dispatcher for `.smp` content rather than the broader reference-database map-entry flow.","objdump + analysis-context + caller xrefs + strings + sidecar-plane correlation + mask-plane bundle-tag correlation + fixed-runtime-band correlation"
0x0044f840,176,world_build_transport_pricing_preview_surface_from_secondary_raster,map,thiscall,inferred,objdump + caller inspection + local disassembly + secondary-raster correlation,3,"Small transport/pricing-side preview builder beneath `world_compute_transport_and_pricing_grid` `0x0044fb70`. The helper allocates one default presentation target through `0x00534930`, queries its dimensions through `0x00534c50`, seeds five fallback palette entries through repeated `0x0051de10` calls, and then walks the target pixels. Each pixel is mapped back into the live secondary raster `[this+0x165d]` through `0x00533970/0x00533980`; low-3-bit classes other than `1/4` get one fixed fallback color, while class-`1/4` pixels scan a local `+/-4` neighborhood for zero-tag cells, score those through the radial falloff helper `0x0051db80`, and then choose either one of the seeded palette entries or the alternate fallback color `0x5f040566`. After filling the whole surface it re-enters `world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940` on the full `0..0x270f` rectangle rooted at that target. Current grounded caller is the null-build path at `0x0044fb31` inside `world_compute_transport_and_pricing_grid`, so this is the safest current read for the transport/pricing preview-surface builder rather than another generic overlay helper.","objdump + caller inspection + local disassembly + secondary-raster correlation + preview-surface correlation"
0x0044faf0,128,world_ensure_transport_pricing_preview_surface_and_publish_if_missing,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Thin world-side ensure/publish wrapper above `world_build_transport_pricing_preview_surface_from_secondary_raster` `0x0044f840`. The helper first forwards the caller rectangle and output pointer into `0x00538060`, then samples shell state through `0x0040b830` and the paired shell notifier `0x004834e0`. When the returned preview handle is null it rebuilds the preview surface by re-entering `0x0044f840`; in either case it then refreshes neighboring world presentation through `0x00449f80`, re-enters the region-border overlay refresh `0x004881b0`, posts the same shell notifier again, and finally issues one mode pulse through `0x00484d70` before returning the ensured handle. Current grounded caller is the world-side path at `0x0043901a`, so this is the safest current read for the transport/pricing preview ensure-and-publish wrapper rather than another generic surface allocator.","objdump + caller inspection + local disassembly + world-presentation correlation"
0x0044fb70,1117,world_compute_transport_and_pricing_grid,map,cdecl,inferred,objdump + strings + callsite inspection,3,"Post-load world-generation subphase inside world_run_post_load_generation_pipeline. Reached directly under the localized progress update `Computing Transportation and Pricing...`, the helper iterates the active world grid through dimensions and bounds rooted at `[0x0062c120+0x2145]`, `[+0x2149]`, `[+0x2155]`, `[+0x2159]`, and `[+0x2129]`, samples neighborhood offsets from `0x00624b28` and `0x00624b48`, combines local terrain or transport values through repeated calls to `0x00534e50` and `0x00448aa0`, and writes bounded 16-bit results back into the grid cells. This now looks like the map-wide transportation-cost or pricing-field computation pass rather than a recurring simulation-step loop.",objdump + caller context + RT3.lng strings
0x00487540,221,world_region_border_overlay_reset_companion_record,map,thiscall,inferred,objdump + caller xrefs + field-reset inspection,4,"Shared companion-record initializer under the region-border overlay family rooted at `0x006cfc9c`. The helper zeroes the live region id and accumulated contribution fields, seeds the enable and remap dwords at `[this+0x31]` and `[this+0x35]` to `1`, seeds the budget-like dword `[this+0x39]` to `0x186a0`, clears the paired float or score bands at `[this+0x45/+0x49/+0x4d/+0x51]` and `[this+0x1fd/+0x201/+0x205/+0x209]`, zeros the later summary slots at `[this+0xd51..+0xd69]`, resets `[this+0xd4d]` to `1`, and clears the two large tail arrays rooted at `[this+0x3b5]` and `[this+0xd6d]`. Current grounded callers are the plain wrapper `0x00487620` and the id-setting wrapper `0x00487650`, both used under world_region_border_overlay_rebuild.","objdump + caller xrefs + field-reset inspection"
0x00487650,16,world_region_border_overlay_reset_companion_record_and_assign_region_id,map,thiscall,inferred,objdump + caller xrefs + wrapper inspection,4,"Thin wrapper around world_region_border_overlay_reset_companion_record. After resetting the full companion record, the helper stores the caller-supplied live region id into `[this+0x00]` and returns. Current grounded callers are the region-border overlay setup loops at `0x00487d77` and `0x0048836e`.","objdump + caller xrefs + wrapper inspection"
0x004881b0,272,world_region_border_overlay_refresh_raw_region_cell_counts_from_world_grid,map,thiscall,inferred,objdump + caller xrefs + raster-count inspection,4,"Shared region-raster counting pass over the companion region set `0x006cfc9c`. The helper zeroes one `0x3e8`-entry local count table, sweeps the active world raster at `[0x0062c120+0x2131]` across `[world+0x2155/+0x2159]`, keeps only cells whose secondary-raster low-3-bit tag predicate `world_secondary_raster_query_cell_low3bit_tag_nonzero` `0x00448f00` returns `0`, and bins each surviving cell by the compact region id `cell_byte >> 3`. It then walks the companion region records, stores the corresponding raw cell count into `[entry+0x3d]`, and clears `[entry+0x41]` before later owners fold or reuse those totals. Current grounded callers are the region-border overlay rebuild at `0x004882e0`, the world-build paths around `0x004431ea`, `0x004476ad`, `0x0044f657`, and `0x0044fb43`, plus one shell-side caller at `0x004fcc05`.","objdump + caller xrefs + raster-count inspection + caller correlation + secondary-raster predicate correlation"
0x00487de0,752,world_region_border_overlay_emit_segment_geometry_from_region_grid,map,cdecl,inferred,objdump + caller xrefs + grid-neighbor inspection,4,"Heavy inner geometry pass under world_region_border_overlay_rebuild. The helper first clears or prepares the current overlay surface through `0x00533cf0` on the active world presentation rooted at `0x0062c120`, then walks the companion region-set family at `0x006cfc9c`, counting entries whose enable byte `[entry+0x31]` is nonzero or whose accumulated contribution pair `[entry+0x3d]+[entry+0x41]` stays positive. It seeds a local remap table from either the live region id `[entry+0x00]` or the fallback remap id `[entry+0x35]`, scans the world raster at `[world+0x2131]` across `[world+0x2155/+0x2159]` in two axis directions, compares neighboring mapped ids, and emits border-segment geometry through `0x00536ea0` whenever adjacent cells belong to different mapped regions. Current grounded caller is `0x004882c6` under world_region_border_overlay_rebuild.","objdump + caller xrefs + grid-neighbor inspection + geometry-emitter inspection"
0x004882e0,199,world_region_border_overlay_rebuild,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Rebuilds the border-overlay companion for the numbered region set owned by `0x0062bae0`. After pumping shell progress through `0x004834e0` the helper seeds or refreshes the companion record family at `0x006cfc9c`, using world_region_border_overlay_reset_companion_record_and_assign_region_id `0x00487650` to reset each resolved record before folding active contribution counts back into `[entry+0x3d]+[entry+0x41]`. It then refreshes the raw per-region cell-count band through world_region_border_overlay_refresh_raw_region_cell_counts_from_world_grid `0x004881b0`, and only after that hands the actual world-grid border-segment emission to `world_region_border_overlay_emit_segment_geometry_from_region_grid` `0x00487de0`. Current grounded callsites are the post-load generation pipeline at `0x004384d0` and the broader world-build path around `0x00447560`, which makes this look like a region-border overlay rebuild rather than another generic player or company manager pass.","objdump + caller xrefs + RT3.lng strings + grid-neighbor inspection"
0x00533cf0,180,world_region_border_overlay_clear_all_chunk_segment_queues,map,thiscall,inferred,objdump + caller xrefs + queue teardown inspection,4,"One-owner teardown helper under world_region_border_overlay_emit_segment_geometry_from_region_grid. The helper walks every coarse chunk bucket in the world-presentation table `[this+0x167d]`, and for each bucket with queued nodes it repeatedly pops the queued payload pointers through `0x00556ef0/0x00556f00`, frees those segment records through `0x005a1145`, and then resets the bucket through `0x005570b0`. Current grounded caller is `0x00487df8`, which uses it to clear the prior border-overlay segment queues before rebuilding them from the live region grid.","objdump + caller xrefs + queue teardown inspection"
0x00536ea0,96,world_region_border_overlay_allocate_and_queue_segment_record,map,thiscall,inferred,objdump + caller xrefs + intrusive-queue inspection,4,"One-owner record allocator under world_region_border_overlay_emit_segment_geometry_from_region_grid. The helper allocates one `0x31`-byte segment record through `0x005a125d`, copies the caller-supplied endpoint and orientation fields into that record, optionally expands cached float coordinates through repeated `0x00534490` calls when the final byte flag is nonzero, resolves one coarse bucket in `[this+0x167d]` from the segment midpoint, and appends the finished record to that bucket through `intrusive_queue_push_back` `0x00556e10`. Current grounded caller is `0x00488072` inside the border-overlay geometry emitter.","objdump + caller xrefs + intrusive-queue inspection + segment midpoint bucketing"
0x00533100,16,runtime_object_set_indexed_f32_field_family_0x14e4,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny indexed float setter under the broader `0x23a` runtime-object family. The helper stores the caller float into `[this+0x14e4 + index*4]` and returns. Current grounded callers are the paired setup strips around `0x0043c442/0x0043c479` and `0x00484e6b/0x00484e90`, so the safest current read is an indexed `f32` field-family store rather than a named gameplay scalar.","objdump + caller inspection + local disassembly + field-family correlation"
0x00533120,13,runtime_object_get_indexed_f32_field_family_0x14e4,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny indexed float getter for the same `0x23a` runtime-object field family rooted at `[this+0x14e4]`. The helper loads one caller-selected float slot and returns it on the FPU stack. Current grounded caller is `runtime_object_quantize_world_position_sample_group_metric_and_select_subrecord` `0x0052f370`, where it contributes one sampled scalar to the grouped-subrecord selection metric.","objdump + caller inspection + local disassembly + field-family correlation + quantized-selector correlation"
0x00533130,11,runtime_object_set_dword_field_0x1534,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny dword setter for field `[this+0x1534]` under the shared runtime-object or presentation-owner family. Current grounded callers are the setup strips around `0x0043b807`, `0x00484eb3`, `0x0052be9a`, `0x0052bf04`, and `0x0052cb83`, so the safest current read is a direct field setter rather than a higher-level mode helper.","objdump + caller inspection + local disassembly + field correlation"
0x00533140,7,runtime_object_get_dword_field_0x1534,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny dword getter for field `[this+0x1534]` in the same shared runtime-object family. Current grounded callers include `0x005294e7`, `0x0052be8f`, `0x0052c23b`, and `0x0052cb6f`, which keep this safely bounded as the read-side companion to `0x00533130`.","objdump + caller inspection + local disassembly + field correlation"
0x00533150,11,runtime_object_set_dword_field_0x1540,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny dword setter for field `[this+0x1540]` under the shared runtime-object family. Current grounded callers are the setup strips around `0x00484ef9`, `0x0052bfb0`, and `0x0052bfc1`.","objdump + caller inspection + local disassembly + field correlation"
0x00533160,7,runtime_object_get_dword_field_0x1540,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny dword getter for field `[this+0x1540]` in the same shared runtime-object family. Current grounded callers include `0x005246b7`, `0x00524754`, `0x0052a346`, `0x0052bf82`, and `0x0052c262`; together with `0x00533180`, this forms the currently grounded threshold pair sampled by `shell_emit_ranked_overlay_cell_items` `0x00524780`.","objdump + caller inspection + local disassembly + field correlation + ranked-overlay correlation"
0x00533170,11,runtime_object_set_dword_field_0x153c,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny dword setter for field `[this+0x153c]` under the shared runtime-object family. Current grounded callers are the setup strips around `0x00484f1c`.","objdump + caller inspection + local disassembly + field correlation"
0x00533180,7,runtime_object_get_dword_field_0x153c,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny dword getter for field `[this+0x153c]` in the same shared runtime-object family. Current grounded callers include `0x005247b2`, and together with `0x00533160` this forms the currently grounded two-dword threshold pair sampled by `shell_emit_ranked_overlay_cell_items` `0x00524780`.","objdump + caller inspection + local disassembly + field correlation + ranked-overlay correlation"
0x00533190,11,runtime_object_set_dword_field_0x1544,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny dword setter for field `[this+0x1544]` under the shared runtime-object family. Current grounded callers are the setup strips around `0x0043b89d`.","objdump + caller inspection + local disassembly + field correlation"
0x005331a0,7,runtime_object_get_dword_field_0x1544,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny dword getter for field `[this+0x1544]` in the same shared runtime-object family. Current grounded callers include `0x0052bf99` and `0x0052bfa8`, which keep this bounded as the direct read-side companion to `0x00533190`.","objdump + caller inspection + local disassembly + field correlation"
0x005331b0,11,runtime_object_set_f32_field_0x14e0,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny float setter for field `[this+0x14e0]` under the shared runtime-object family. Current grounded caller is the setup strip around `0x00484e2e`.","objdump + caller inspection + local disassembly + field correlation"
0x005331c0,7,runtime_object_get_f32_field_0x14e0,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny float getter for field `[this+0x14e0]` in the same shared runtime-object family. Current grounded callers include `0x0043b468`, `0x0043b48a`, `0x00484de9`, and `0x00484e07`, which keep this bounded as the direct read-side companion to `0x005331b0`.","objdump + caller inspection + local disassembly + field correlation"
0x005331d0,7,runtime_object_get_dword_field_0x1548,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny dword getter for field `[this+0x1548]` under the shared runtime-object family. Current grounded callers include `0x0052bd13`, `0x0052bd41`, and `0x0052bd6f`. The matching setter remains outside the current local strip.","objdump + caller inspection + local disassembly + field correlation"
0x005331e0,592,world_rebuild_overlay_sample_triplet_cell_for_scale,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Scale-specific local reducer under the secondary-overlay multiscale support family. Given one selected cell plus one scale index, the helper clamps a local neighborhood to the live world bounds, walks the per-scale float surface rooted at `[this+0x15ed + scale*4]`, accumulates three float channels across that neighborhood, normalizes by sample count, rescales the local vector magnitude against shared constants, and writes one packed three-float sample record into the matching per-scale triplet buffer family rooted at `[this+0x15f1 + (scale-1)*4]`. Current grounded callers are `0x00533845` and `0x00533929`, both inside `world_rebuild_secondary_overlay_multiscale_support_surfaces_in_rect` `0x00533890`.","objdump + caller inspection + field correlation + multiscale-support correlation"
0x00532310,80,world_presentation_store_seven_dword_overlay_companion_block_and_mark_live,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small local setter in the world-presentation overlay family. The helper copies seven caller-supplied dwords into the companion block `[this+0x15b5..+0x15cd]` and then marks byte `[this+0x15b4] = 1`. Current grounded caller is the neighboring overlay-family setup strip, so the safest current read is a seven-dword companion-block store plus live mark rather than a broader reset.","objdump + caller inspection + local disassembly + overlay-companion-block correlation"
0x00532360,16,world_presentation_clear_overlay_companion_block_live_flag,map,thiscall,inferred,objdump + local disassembly,1,"Tiny companion to `world_presentation_store_seven_dword_overlay_companion_block_and_mark_live` `0x00532310`. The helper clears byte `[this+0x15b4]` and returns immediately. Current evidence grounds it only as the live-flag clear side of the same local seven-dword block.","objdump + local disassembly + overlay-companion-block correlation"
0x00532370,16,world_presentation_query_overlay_companion_block_live_flag,map,thiscall,inferred,objdump + local disassembly,1,"Tiny getter for overlay-family live flag byte `[this+0x15b4]`. The helper returns that byte as an integer without additional side effects. Current evidence grounds it only as the direct live-flag query for the neighboring seven-dword companion block.","objdump + local disassembly + overlay-companion-block correlation"
0x00532380,96,world_presentation_copy_seven_dword_overlay_companion_block_out,map,thiscall,inferred,objdump + local disassembly,1,"Small read-side companion to the local seven-dword overlay companion block `[this+0x15b5..+0x15cd]`. The helper copies those seven dwords into caller output storage and returns. Current evidence grounds it only as the direct copy-out helper for the same block set by `0x00532310`.","objdump + local disassembly + overlay-companion-block correlation"
0x005323e0,16,world_presentation_overlay_family_trivial_ret_0x14_stub,map,stdcall,inferred,objdump + local disassembly,1,"Tiny five-argument stdcall stub that only executes `ret 0x14`. The function currently has no grounded side effects or local ownership beyond sitting inside the same overlay-family strip, so the safest current read is a literal no-op vtable or callback stub.","objdump + local disassembly + stdcall-stub correlation"
0x005323f0,112,world_presentation_lazy_ensure_cached_surface_root_0x478_and_stage_saved_dims,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Lazy ensure helper over cached surface root `[this+0x478]` in the world-presentation overlay family. When that root is null, the helper allocates one backing object through `0x00543980` using saved dimensions `[this+0x159c/+0x15a0]`, stores the result into `[this+0x478]`, and then dispatches the live root through `0x00541970`. Current grounded callers are the neighboring cached-surface service strip and broader overlay rebuild paths, so the safest current read is a cached-surface ensure plus staged-dimension setup owner rather than a generic allocator.","objdump + caller inspection + local disassembly + cached-surface correlation"
0x00532460,48,world_presentation_service_cached_surface_root_0x478_and_publish,map,thiscall,inferred,objdump + local disassembly,1,"Small service companion to the cached surface root `[this+0x478]`. The helper dispatches that root through `0x00541970` and then through `0x005438d0`, which makes it the publish or finalize side of the same cached-surface strip rather than another allocator.","objdump + local disassembly + cached-surface correlation"
0x00532490,80,world_presentation_query_from_cached_surface_root_for_saved_dims,map,thiscall,inferred,objdump + local disassembly,1,"Read-side helper over cached surface root `[this+0x478]` plus saved dimensions `[this+0x159c/+0x15a0]`. The helper resolves one current result from the live root using those dimensions and forwards the answer back through caller out-storage. Current evidence grounds it only as a cached-surface query sibling of `0x005323f0` and `0x00532460`.","objdump + local disassembly + cached-surface correlation"
0x005324e0,32,world_presentation_mark_cached_surface_live_flag_if_root_present,map,thiscall,inferred,objdump + local disassembly,1,"Tiny cached-surface flag helper. When root `[this+0x478]` is nonnull, the helper marks byte `[this+0x159b] = 1`; otherwise it leaves that byte unchanged. Current evidence grounds it only as the live-flag set side for the cached-surface strip.","objdump + local disassembly + cached-surface-flag correlation"
0x00532500,16,world_presentation_clear_cached_surface_live_flag,map,thiscall,inferred,objdump + local disassembly,1,"Tiny companion to `world_presentation_mark_cached_surface_live_flag_if_root_present` `0x005324e0`. The helper clears byte `[this+0x159b]` and returns. Current evidence grounds it only as the cached-surface live-flag clear path.","objdump + local disassembly + cached-surface-flag correlation"
0x00532510,16,world_presentation_store_overlay_mode_byte_0x159a,map,thiscall,inferred,objdump + local disassembly,1,"Tiny setter for overlay-family mode byte `[this+0x159a]`. The helper stores caller byte arg0 and returns immediately. Current evidence grounds it only as a direct local mode-byte setter.","objdump + local disassembly + local-mode-byte correlation"
0x00532520,48,world_presentation_store_saved_overlay_dimension_quad,map,thiscall,inferred,objdump + local disassembly,1,"Small setter over the saved dimension quad `[this+0x15a4..+0x15b0]` in the world-presentation overlay family. The helper copies four caller-supplied dwords into that quad and returns. Current evidence grounds it only as the direct saved-dimension store for the neighboring cached-surface strip.","objdump + local disassembly + saved-dimension correlation"
0x00532550,64,world_presentation_copy_saved_overlay_dimension_quad_out,map,thiscall,inferred,objdump + local disassembly,1,"Read-side companion to `world_presentation_store_saved_overlay_dimension_quad` `0x00532520`. The helper copies the four saved dwords from `[this+0x15a4..+0x15b0]` into caller output storage and returns. Current evidence grounds it only as the direct copy-out helper for that saved-dimension quad.","objdump + local disassembly + saved-dimension correlation"
0x00532590,455,world_presentation_reset_overlay_runtime_state_and_pointer_roots,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Broad hard-reset owner beneath the world-presentation overlay family. The helper clears the live overlay-state bytes `[this+0x1588/+0x1599/+0x159b/+0x15b4]`, reseeds `[this+0x159a]` to `1`, resets scalar fields like `[this+0x154c/+0x155c/+0x15d9/+0x15d5]`, nulls the main pointer roots `[this+0x478]`, `[this+0x1558..+0x1570]`, `[this+0x159c/+0x15a0]`, `[this+0x15e1]`, the support-family roots `[this+0x1605/+0x15f1/+0x1619/+0x162d]`, the four sidecar byte planes `[this+0x1631..+0x163d]`, both mask planes `[this+0x1655/+0x1659]`, the packed raster `[this+0x165d]`, the vector byte planes `[this+0x1661/+0x1665]`, and the neighboring overlay tables `[this+0x1669..+0x1685]`, then zero-fills the local `0x100` slot band at `[this+0x08]` and the `0x1b`-entry companion slot table at `[this+0x40c]`. Current grounded callers are the local constructor at `0x00534f73` and the broader presentation reinitializer `0x00537e70`, so this is the safest current read for the shared overlay-family hard reset rather than a narrow resize helper.","objdump + caller inspection + field correlation + overlay-reset correlation"
0x00532760,64,world_presentation_release_current_overlay_slot_root_by_index_0x1558,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small release helper in the same world-presentation overlay family. When selector dword `[this+0x1558]` is nonzero, the helper resolves one slot root from `[this+0x08 + [this+0x1558]*4]`, releases that object through `0x00542c90` plus `0x0053b080`, and clears the slot pointer back to `0`. Current grounded caller is the neighboring setup strip at `0x00534fe3`, so the safest current read is a current-slot release helper rather than a broader reset.","objdump + caller inspection + local disassembly + overlay-slot-release correlation"
0x005327a0,192,world_presentation_clamp_two_surface_dimensions_to_supported_power_of_two_and_display_caps,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Shared surface-dimension clamp beneath the world-presentation overlay family. The helper first derives one minimum supported dimension from shell memory-budget queries `0x0051fa40` and `0x0055d430`, choosing either `0x100` or `0x400`, then round-down-clamps the two caller dimension pointers to exact powers of two through `0x0051df50`, and finally enforces shell display caps from `[0x006d4024+0x114243]` and `[0x006d4024+0x114247]` after converting those cap lanes back into four-pixel units. Current grounded callers are the local overlay rebuild paths `0x00535115` and `0x00535492`, so the safest current read is a shared supported-surface dimension clamp rather than a one-shot texture allocator.","objdump + caller inspection + local disassembly + power-of-two correlation + display-cap correlation"
0x00532860,243,world_presentation_stitch_12_overlay_slot_surfaces_from_parallel_bands_and_finalize_primary,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Local stitching pass over twelve consecutive overlay-slot families starting at selector `[this+0x155c]`. For each of those twelve entries the helper queries buffer pointers and row geometry from the parallel slot roots in the `[this+0x08 + index*4]` and `[this+0x18 + index*4]` bands through `0x00541970`, copies one terminal row from the latter buffer into the former, and on indices whose local position is not `3 mod 4` it also queries the sibling root in `[this+0x0c + index*4]` and copies one leading-column dword from that sibling into the right edge of the `[this+0x18 + index*4]` buffer. After each local stitch it finalizes the primary root through `0x00541c10`. Current grounded callers are the two neighboring rebuild branches `0x00527d05` and `0x00527d6a`, so the safest current read is a twelve-slot surface-edge stitching pass rather than a generic allocator or publish helper.","objdump + caller inspection + local disassembly + parallel-slot-band correlation + surface-stitch correlation"
0x00532960,115,world_presentation_project_two_out_offsets_from_grid_pair_through_4x4_and_16x16_quanta,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small paired projection helper beneath the same overlay family. The function rounds live grid dimensions `[this+0x15d9/+0x15d5]` up to both `16`-cell and `4`-cell quanta, scales the two caller input dwords by `4`, divides each by the corresponding `16`-cell quantum, multiplies by the opposite-axis `4`-cell quantum, and writes the resulting projected offsets back through the two caller out-pointers. Current grounded caller is the neighboring branch `0x00525ce9`, so the safest current read is a paired coarse-offset projection helper rather than a more semantic placement or cell-query owner.","objdump + caller inspection + local disassembly + coarse-projection correlation"
0x005329e0,48,world_presentation_map_xy_into_coarse_4x4_overlay_region_index,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small coordinate packer beneath the same overlay family. The helper rounds live grid dimensions `[this+0x15d9/+0x15d5]` up to `16`-cell quanta, scales the two caller coordinates by `4`, divides them by those rounded quanta, and returns one `1`-based coarse region index laid out as a `4x4` grid. Current grounded caller is the neighboring builder branch `0x00526f8a`, so the safest current read is a reusable `(x,y) -> coarse 4x4 overlay region id` helper rather than a broader geometry transform.","objdump + caller inspection + local disassembly + coarse-region-index correlation"
0x00532a30,7,world_presentation_query_overlay_slot_band_live_count_or_tag_0x1554,map,thiscall,inferred,objdump + caller inspection + field correlation,1,"Tiny direct getter over dword `[this+0x1554]` in the same overlay family. The field is cleared by the slot-band reset owner `0x00532b30`, feeds the primary companion-plane write helper `0x00448d40`, and is also sampled by neighboring world-presentation branches around `0x00525c07`, `0x0052b3b5`, and `0x0052ba0d`. Current evidence supports only the structural read that this dword is the live count or tag for the local overlay slot band, not a tighter semantic label yet.","objdump + caller inspection + field correlation + overlay-slot-band correlation"
0x00532d90,464,world_normalize_secondary_overlay_float_summary_plane_globally,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Global normalization pass over the base secondary-overlay float summary plane rooted at `[this+0x1605]`. The helper first scans the full live plane across `[this+0x15d9/+0x15d5]` to find one global maximum, clamps that maximum into a stable range, synthesizes a `0..100` weight table from the resulting scale factor, and then reruns the full plane to remap every positive cell through that table. Current grounded caller is `0x005385ea` inside the larger secondary-overlay rebuild owner around `0x00538360`, immediately before the companion radius-expansion pass `0x00532f60`.","objdump + caller inspection + field correlation + global-normalization correlation"
0x00532f60,403,world_expand_positive_secondary_overlay_float_summary_by_radius,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Radius-style expansion pass over the same base secondary-overlay float summary plane rooted at `[this+0x1605]`. Given one caller radius, the helper walks the full live plane, keeps only positive source cells, samples their local neighborhood with distance falloff, and writes back the strongest surviving propagated value into the same float plane. Current grounded caller is `0x005385fd` inside the larger secondary-overlay rebuild owner around `0x00538360`, immediately after `world_normalize_secondary_overlay_float_summary_plane_globally` `0x00532d90`.","objdump + caller inspection + field correlation + radius-expansion correlation"
0x00532a40,80,world_presentation_query_time_selected_slot_from_first_seeded_overlay_band,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Time-selected query over the first template-seeded overlay slot band. The helper samples one shared tick source through function pointer `0x005c8068`, scales that tick against count field `[this+0x156c]`, caches the resulting local index in `[this+0x1570]`, adds base slot index `[this+0x1568]`, and returns the corresponding slot root from `[this+0x08 + slot*4]`. Current grounded caller is the neighboring world-presentation branch `0x0052c41a`, and the stored fields align with the first slot-band seeder `0x005356e0`, so the safest current read is a time-selected query over that first seeded overlay band rather than a generic random picker.","objdump + caller inspection + local disassembly + seeded-slot-band correlation"
0x00532a90,16,world_presentation_query_trailing_fallback_slot_from_first_seeded_overlay_band,map,thiscall,inferred,objdump + local disassembly + field correlation,1,"Tiny getter for trailing fallback slot index `[this+0x1578]` in the first template-seeded overlay slot band. The corresponding fallback slot is seeded by `world_presentation_seed_first_overlay_slot_band_from_static_templates` `0x005356e0`, so the safest current read is a direct fallback-slot query rather than an independent selector.","objdump + local disassembly + field correlation + seeded-slot-band correlation"
0x00532aa0,48,world_presentation_query_time_selected_slot_from_second_seeded_overlay_band,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Time-selected query over the second template-seeded overlay slot band. The helper samples the same shared tick source, folds that tick through the reciprocal divide sequence keyed by count field `[this+0x1564]`, adds base slot index `[this+0x1560]`, and returns the corresponding slot root from `[this+0x08 + slot*4]`. Current grounded caller is shell-side branch `0x0054e2f0`, and the stored fields align with the second slot-band seeder `0x00535890`, so the safest current read is a time-selected query over that second seeded overlay band rather than another generic slot accessor.","objdump + caller inspection + local disassembly + seeded-slot-band correlation"
0x00532b30,332,world_presentation_release_overlay_slot_band_and_reset_band_indices,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared release or reset owner for the local overlay slot band at `[this+0x08]`. The helper first releases slot `0` through either `0x00542c90 + 0x0053b080` or `0x0053c000` depending on shell flag `[0x006d4024+0x11422e]`, then walks slots `1..count-1` where count comes from `[this+0x1554]`, releasing each live root with the same split except that the special forced-direct range `1..0x10` always goes through `0x00542c90 + 0x0053b080`. After the sweep it clears the live slot pointers and resets the controlling band fields `[this+0x1554]`, `[this+0x1568]`, `[this+0x1570]`, `[this+0x155c]`, `[this+0x1560]`, and `[this+0x1564]`. Current grounded caller is the default companion-set refresh path `0x00537356`, so the safest current read is a shared overlay-slot-band release plus band-index reset owner rather than another broad world reset.","objdump + caller inspection + local disassembly + overlay-slot-band correlation + release-path split correlation"
0x00527ce0,243,world_presentation_ensure_dim_tag_matched_stitched_overlay_helper_and_clear_global_scratch_planes,map,thiscall,inferred,objdump + local disassembly + cache-field correlation,2,"Broader owner directly above the stitched overlay-slot family. The helper queries current grid extents from the world presentation object through `0x00533970/0x00533980`, compares those against cached globals `0x00624d40/0x00624d3c` and the world-side tag `[world+0x2121]` mirrored in `0x00624d38`, and when any of those differ it re-enters the twelve-slot stitch pass `0x00532860`, rebuilds local helper `[this+0x65]` through `0x0053b070` and `0x00565370`, or releases the prior helper through `0x00565440` plus `0x0053b080`. Whether rebuilt or unchanged, it then clears the two large global scratch planes rooted at `0x008f2520` and `0x00b33530`. Current evidence keeps the helper structural rather than fully semantic, but it is clearly the dimension-and-tag-matched stitched-overlay ensure owner above `0x00532860`.","objdump + local disassembly + cache-field correlation + stitched-overlay correlation"
0x00532ad0,81,world_presentation_allocate_overlay_slot_from_static_template,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small shared slot allocator over the local `0x100` overlay pointer band at `[this+0x08]`. The helper finds the first empty slot, forwards the caller-supplied static template row into `0x0053c1c0` together with the fixed tuple `(0, 0, 0x7f)`, stores the resulting object pointer into `[this+0x08 + slot*4]`, and increments live count `[this+0x04]`. Current grounded callers are the neighboring setup owners `0x00535070`, `0x005356e0`, and `0x00535890`, the broader reinitializer `0x00537e60`, and one earlier world-presentation branch at `0x00454f40`, so this is the safest current read for the shared static-template overlay-slot allocator rather than one narrow UI control helper.","objdump + caller inspection + field correlation + static-template correlation"
0x00532c80,529,world_allocate_base_secondary_overlay_planes_for_current_dimensions,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Lower secondary-overlay allocator or reset owner for the current world-grid dimensions. The helper clears shift field `[this+0x15e1]`, optionally overwrites live grid dimensions `[this+0x15d9/+0x15d5/+0x15dd]` from caller width and height, allocates the base float-summary plane `[this+0x1605]`, the four sidecar byte planes `[this+0x1631..+0x163d]`, the two one-byte mask planes `[this+0x1655]` and `[this+0x1659]`, and the packed secondary 3-byte raster `[this+0x165d]`, then seeds those planes with their default byte patterns: `0x02` for the primary mask plane, `0x01` for the secondary mask plane, and zero for the packed raster. Current grounded callers are the broader presentation reinitializer `0x00537e60` and the shell-side size-reset path around `0x00537f1a`, so this is the safest current read for the base secondary-overlay plane allocator rather than the wider multiscale support owner.","objdump + caller inspection + field correlation + mask-plane default correlation"
0x00533430,368,world_rebuild_overlay_float_plane_cell_for_scale,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Scale-specific float-plane sibling under the secondary-overlay multiscale support family. The helper clamps one local neighborhood around the selected cell, reads the contributing float samples from the per-scale plane rooted at `[this+0x1601 + (scale-1)*4]`, averages that neighborhood, and stores the resulting float into the companion per-scale summary plane family rooted at `[this+0x1605 + (scale-1)*4]` for the same cell. Current grounded callers are `0x0053384f` and `0x00533933`, both inside `world_rebuild_secondary_overlay_multiscale_support_surfaces_in_rect` `0x00533890`.","objdump + caller inspection + field correlation + multiscale-support correlation"
0x005335a0,320,world_rebuild_overlay_rank_u16_plane_cell_for_scale,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Scale-specific 16-bit smoothing sibling under the same multiscale support family. The helper reads one per-scale unsigned-word plane from the family rooted at `[this+0x1615 + (scale-1)*4]`, gathers the clamped eight-neighbor ring around the selected cell, averages those values, and stores the resulting word into the companion smoothed-plane family rooted at `[this+0x1619 + (scale-1)*4]`. Current grounded callers are `0x00533859` and `0x0053393d`, both inside `world_rebuild_secondary_overlay_multiscale_support_surfaces_in_rect` `0x00533890`.","objdump + caller inspection + field correlation + multiscale-support correlation"
0x00533890,224,world_rebuild_secondary_overlay_multiscale_support_surfaces_in_rect,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Rectangle-wide multiscale support-surface rebuild above the raw secondary-overlay byte planes. The helper clamps the caller rectangle to the live world bounds, then for scale levels `1..4` downshifts that rectangle and re-enters three scale-specific reducers: `world_rebuild_overlay_sample_triplet_cell_for_scale` `0x005331e0` refreshes the five-entry packed sample-triplet buffer family rooted at `[this+0x15f1..+0x1601]`, `world_rebuild_overlay_float_plane_cell_for_scale` `0x00533430` refreshes the five-entry float summary family rooted at `[this+0x1605..+0x1615]`, and `world_rebuild_overlay_rank_u16_plane_cell_for_scale` `0x005335a0` refreshes the five-entry smoothed unsigned-word family rooted at `[this+0x1619..+0x1629]`. Current grounded caller is `0x005375b2` inside the larger rect owner `0x005374d0`, and the same helper also has one tiny local wrapper at `0x00533845..0x00533859`, so this is the safest current read for the shared multiscale secondary-overlay support rebuild rather than another raw cell accessor.","objdump + caller inspection + field correlation + multiscale-support correlation"
0x00533970,7,world_query_world_grid_max_x_cell_index,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny dimension getter over the live world-grid family. The helper returns the cached maximum X cell index from `[this+0x15d9]` directly. Current grounded callers are shell-side presentation and staging branches around `0x0043b0ea`, `0x0044d893`, `0x00523edd`, `0x00524e9b`, `0x00525b4c`, `0x005266ae`, and `0x0056935e`, which consistently pair it with `world_query_world_grid_max_y_cell_index` `0x00533980` rather than treating it as a more player-facing world metric.","objdump + caller inspection + field correlation"
0x00533980,7,world_query_world_grid_max_y_cell_index,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Y-axis sibling of world_query_world_grid_max_x_cell_index. The helper returns the cached maximum Y cell index from `[this+0x15d5]` directly. Current grounded callers are the same shell-side presentation and staging branches that pair it with `0x00533970`, including `0x0043b101`, `0x0044d8af`, `0x00523eeb`, `0x00524ea6`, `0x00525b57`, `0x005273e9`, and `0x00569368`.","objdump + caller inspection + field correlation"
0x00533990,11,world_store_secondary_overlay_shift_field_0x15e1,map,thiscall,inferred,objdump + local disassembly + field correlation,2,"Tiny setter for the secondary-overlay shift or scale-selector dword `[this+0x15e1]`. Current local evidence grounds it only as the direct write-side accessor under the broader multiscale overlay family.","objdump + local disassembly + field correlation"
0x00533ae0,7,world_query_secondary_raster_root,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny root-pointer getter for the packed secondary 3-byte cell raster at `[this+0x165d]`. Current grounded callers include shell-side staging branches around `0x00524eb1` and `0x00569351`, while the same root is also consumed directly by the neighboring secondary-raster read/write helpers `0x00448eec..0x00448f57` and several world-side scans, so this is the safest current read for the raw secondary-raster base accessor.","objdump + caller inspection + field correlation + secondary-raster correlation"
0x00533af0,7,world_query_secondary_overlay_vector_x_byte_plane_root,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny root-pointer getter for the signed X-component overlay vector byte plane at `[this+0x1661]`. Current grounded callers are the shell-side staging path around `0x0056933d`, while neighboring byte read/write helpers at `0x00448e60` and `0x00448ec0` plus the rectangle rebuild pass `0x00536710` use the same root directly.","objdump + caller inspection + field correlation + vector-plane correlation"
0x00533b00,7,world_query_secondary_overlay_vector_y_byte_plane_root,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny root-pointer getter for the signed Y-component overlay vector byte plane at `[this+0x1665]`. Current grounded callers are the shell-side staging path around `0x00569347`, and the same root is consumed directly by `world_secondary_overlay_vector_y_byte_plane_query_cell_value` `0x00448ee0`, `world_secondary_overlay_vector_y_byte_plane_set_cell_value` `0x00448e90`, and the rectangle rebuild pass `0x00536710`.","objdump + caller inspection + field correlation + vector-plane correlation"
0x00533b10,7,world_query_companion_float_raster_root,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny root-pointer getter for the companion float raster family rooted at `[this+0x1605]`. Current grounded callers are shell-side presentation and staging branches around `0x00524e87`, `0x0052525b89`, `0x00526bb4`, `0x00528253`, `0x0052ae97`, `0x0052b4fa`, `0x0054dd60`, and `0x0056b2dd`, which consistently pair it with neighboring LUT or dimension getters rather than treating it as a gameplay scalar owner.","objdump + caller inspection + field correlation"
0x00533b20,7,world_query_overlay_normalized_x_coordinate_lut_ptr,map,thiscall,inferred,objdump + caller inspection + allocation-path inspection,3,"Tiny root-pointer getter for the X-axis normalized coordinate lookup table at `[this+0x15e9]`. The table is allocated in the world-presentation setup path around `0x00537b48` and then filled from the current grid width quarter-count in `0x00537c45..0x00537c5c`. Current grounded caller is the shell-side overlay staging branch at `0x00525b65`, which consumes it together with the Y-axis sibling and the companion sample tables.","objdump + caller inspection + allocation-path inspection + field correlation"
0x00533b30,7,world_query_overlay_normalized_y_coordinate_lut_ptr,map,thiscall,inferred,objdump + caller inspection + allocation-path inspection,3,"Y-axis sibling of world_query_overlay_normalized_x_coordinate_lut_ptr. The helper returns the normalized coordinate lookup table pointer from `[this+0x15ed]`. The table is allocated in the same setup path around `0x00537b28` and filled from the current grid height quarter-count in `0x00537c82..0x00537c99`. Current grounded caller is the same shell-side overlay staging branch at `0x00525b70`.","objdump + caller inspection + allocation-path inspection + field correlation"
0x00533b40,13,world_query_sidecar_byte_plane_ptr_by_index,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny indexed accessor over the four-plane sidecar byte-raster family rooted at `[this+0x1631]`. The helper treats the caller byte argument as an index `0..3` and returns the corresponding plane pointer from `[this+0x1631 + index*4]`. Current grounded callers include the four-plane bundle load/save siblings `0x00448f60` and `0x00448fe0`, plus shell-side plane-copy branches around `0x004f5ae6`, `0x004f5bfb`, `0x004f5cc7`, and `0x0052b0a4`, so this is the safest current read for the shared sidecar byte-plane pointer accessor rather than a more player-facing raster helper.","objdump + caller inspection + field correlation + sidecar-plane correlation"
0x00533b50,7,world_query_secondary_overlay_primary_mask_byte_plane_root,map,thiscall,inferred,objdump + caller inspection + allocation-path inspection,3,"Tiny root-pointer getter for the primary mask or occupancy byte plane at `[this+0x1655]`. The plane is allocated in the world-presentation setup path around `0x0053775e` and initialized to byte value `0x02`. Current grounded callers are the shell-side overlay staging branch at `0x00525b9f`, several world-side mutators around `0x00448c38`, `0x00448cc8`, and `0x00448d53`, the later vector-field rebuild path `0x00536710`, and the neighboring world-side scan around `0x005383f0`, which all treat nonzero cells in this plane as blocking, occupied, or already-classified samples.","objdump + caller inspection + allocation-path inspection + field correlation + mask-plane correlation"
0x00533b60,7,world_query_secondary_overlay_secondary_mask_byte_plane_root,map,thiscall,inferred,objdump + caller inspection + allocation-path inspection,3,"Tiny root-pointer getter for the second one-byte overlay mask plane at `[this+0x1659]`. The plane is allocated in the same setup path around `0x00537799` and initialized to byte value `0x01`. The only grounded getter caller is the shell-side overlay staging branch at `0x00525bad`, and that branch immediately discards the returned pointer before calling `0x005458a0`. Beyond that, current local evidence only grounds allocation, default-seed, bulk copy, bundle save-load, zero-fill, rectangle-clear, teardown, and existence-gate behavior on this plane, not a distinct semantic reader comparable to the primary mask plane at `[this+0x1655]`. Taken together with the asymmetry in `0x00538360`, the safest current read is that this is the separately persisted secondary mask-plane base accessor, not a second actively rebuilt runtime mask root.","objdump + caller inspection + allocation-path inspection + field correlation + negative-consumer correlation + persisted-sibling-plane correlation"
0x00536710,1660,world_rebuild_secondary_overlay_vector_byte_planes_in_rect,map,thiscall,inferred,objdump + caller inspection + field correlation,4,"Rectangle-wide rebuild pass over the secondary overlay byte-plane family. The helper clamps the caller rectangle to the live world bounds, scans the packed secondary raster at `[this+0x165d]` together with the primary mask plane `[this+0x1655]`, clears or preserves local state according to the low-3-bit class families, writes signed distance-scaled byte components into the paired vector planes `[this+0x1661]` and `[this+0x1665]`, and invalidates four neighboring sidecar byte planes at `[this+0x1631/+0x1635/+0x1639/+0x163d]` where needed. Current grounded callers are the post-build world-side rectangle refresh around `0x0044f6d7` and the two local owner passes at `0x005374bf` and `0x0053759b`, so this is the safest current read for the shared overlay-vector rebuild owner rather than another tiny cell helper.","objdump + caller inspection + field correlation + vector-plane correlation + sidecar-plane invalidation correlation"
0x00535070,138,world_presentation_ensure_primary_overlay_surface_or_fallback_template_slot,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small setup owner under the broader world-presentation reinitializer. The helper clears the local `0x100` overlay slot band `[this+0x08]`, resets live count `[this+0x04]`, and then splits on the shell presentation gate at `[0x006d4024+0x11422e]`: when that gate is armed it allocates one `0xec`-byte surface object, initializes it through `0x00541b00` and `0x005417e0` with the current shell root plus fixed `0x100 x 0x100` dimensions, stores the resulting object in slot `0`, and updates byte `[0x006d4024+0x1146eb]` on failure; otherwise it falls back to one static-template slot allocation through `world_presentation_allocate_overlay_slot_from_static_template` `0x00532ad0` using template row `0x005dd26c`. Current grounded caller is `world_presentation_apply_grid_dimensions_and_reinitialize_secondary_overlay_family` `0x00537e60`, so this is the safest current read for the primary overlay-surface-or-template setup owner rather than a more specific player-facing panel builder.","objdump + caller inspection + field correlation + static-template correlation"
0x00535100,816,world_presentation_apply_requested_dimensions_and_rebuild_four_overlay_surface_slots,map,thiscall,inferred,objdump + caller inspection + local disassembly + field correlation,3,"Broader world-presentation resize or rebuild owner above the short four-slot surface band rooted at `[this+0x08 + [this+0x155c]*4]`. The helper first clamps the caller-supplied dimensions through `0x005327a0`, stores the resulting quarter-scaled widths into `[this+0x157c/+0x1580]`, ensures or reuses a contiguous four-slot output band under selector `[this+0x155c]`, and then builds one temporary RGBA buffer sized from the new scaled dimensions. When the optional third argument is non-null it samples that source through `0x00541970` and resamples it into the temporary buffer; otherwise it fills the buffer with the fixed pattern seeded through `0x557f50`. It then allocates four `0xec`-byte destination surfaces through `0x00543980` and stores them into the selected four-slot band. Current grounded callers include the setup-side world reset or regeneration branch at `0x004390a0`, the load-side bundle path at `0x004473d4`, and the neighboring owner wrappers at `0x00535654` and `0x005356a9`, so this is the safest current read for the shared requested-dimension apply and four-slot overlay-surface rebuild owner rather than a smaller slot allocator.","objdump + caller inspection + local disassembly + field correlation + four-slot-band correlation + optional-source-resample correlation"
0x005356e0,428,world_presentation_seed_first_overlay_slot_band_from_static_templates,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Static-template slot-band seeder under the broader world-presentation reinitializer. The helper allocates or reuses one anchor slot through `world_presentation_allocate_overlay_slot_from_static_template` `0x00532ad0` using template row `0x005dd2b0`, records that anchor index and running count in `[this+0x1568]` and `[this+0x156c]`, then seeds a contiguous slot band from template rows `0x005dd2a4` upward for ids `0x66..0x84`. After that first series it revisits the created slots, clears byte `[slot+0x05]`, runs `0x00542550` on the earlier series, and fills two trailing fallback slots from template rows `0x005dd298` and `0x005dd28c`, storing the resulting indices in `[this+0x1574]` and `[this+0x1578]`. Current grounded caller is `world_presentation_apply_grid_dimensions_and_reinitialize_secondary_overlay_family` `0x00537e60`, so this is the safest current read for the first template-driven overlay slot-band seeder rather than a stronger UI-label owner.","objdump + caller inspection + field correlation + static-template correlation"
0x00535890,177,world_presentation_seed_second_overlay_slot_band_from_static_templates,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Second static-template slot-band seeder under the broader world-presentation reinitializer. The helper allocates one anchor slot through `world_presentation_allocate_overlay_slot_from_static_template` `0x00532ad0` using template row `0x005dd2d0`, stores that anchor index in `[this+0x1560]`, then seeds a contiguous slot band from template rows rooted at `0x005dd2bc` for ids `2..0x20`, finally storing the terminal count `0x20` in `[this+0x1564]`. Current grounded caller is `world_presentation_apply_grid_dimensions_and_reinitialize_secondary_overlay_family` `0x00537e60`, so this is the safest current read for the second template-driven overlay slot-band seeder rather than a more player-facing overlay panel owner.","objdump + caller inspection + field correlation + static-template correlation"
0x00535430,687,world_presentation_rebuild_four_overlay_surface_slots_from_source_or_fallback,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Broader four-slot overlay-surface rebuild owner under the world-presentation reinitializer. The helper derives local dimensions through `0x005327a0`, increments the shared shell-side progress counter at `[0x006d4024+0x11427e]`, allocates one temporary RGBA buffer sized from the quarter-scaled dimensions in `[this+0x157c/+0x1580]`, and then fills that buffer either by resampling the caller-supplied source surface or by falling back to a global descriptor at `0x0062bed4` when present. It uses several shell-side resource and range queries through `0x00518de0` and `0x0053c930`, can stage a temporary source surface through `0x0053c1c0`, `0x00541930`, and `0x00541970`, and then emits up to four `0xec`-byte destination surface objects through `0x00543980`, storing them into the local overlay slot band starting at `[this+0x08 + [this+0x155c]*4]`. Current grounded callers are the broader world-presentation reinitializer `0x00537e60` and one neighboring owner at `0x00538060`, so this is the safest current read for the shared four-slot overlay-surface rebuild owner rather than a more specific UI panel constructor.","objdump + caller inspection + field correlation + temporary-surface correlation"
0x00535950,112,world_presentation_allocate_overlay_companion_record_from_static_template,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small allocator over the local `0x1b`-entry overlay companion slot table at `[this+0x40c]`. The helper finds the first empty companion slot, allocates one `0x141`-byte record, seeds it through `0x00554830` from the caller-supplied static template row, stores the resulting pointer into `[this+0x40c + slot*4]`, and increments live count `[this+0x408]`. Current grounded caller is `world_presentation_seed_default_overlay_companion_record_set` `0x005373b0`, which invokes it seven times with static template rows `0x005dd300..0x005dd378`, so this is the safest current read for the shared companion-record allocator rather than a broader overlay rebuild owner.","objdump + caller inspection + field correlation + static-template correlation"
0x00536044,468,world_presentation_release_secondary_overlay_support_buffers,map,thiscall,inferred,objdump + local inspection + field correlation,3,"Teardown owner for the secondary-overlay support family. The helper frees the five-entry packed sample-triplet family rooted at `[this+0x15f1..+0x1601]`, the five-entry float summary family rooted at `[this+0x1605..+0x1615]`, the five-entry smoothed unsigned-word family rooted at `[this+0x1619..+0x1629]`, the packed local-byte staging buffer `[this+0x162d]`, the four sidecar byte planes `[this+0x1631..+0x163d]`, the neighboring coarse-cell and support tables, both one-byte mask planes `[this+0x1655]` and `[this+0x1659]`, the packed secondary raster `[this+0x165d]`, and the signed vector byte planes `[this+0x1661]` and `[this+0x1665]`, then nulls the corresponding pointers. The body also re-enters several neighboring support-family destructors `0x00535b40/0x00535c70/0x00535d30/0x00535df0/0x00535a10/0x00535f20`, so this is the safest current read for the shared overlay-support teardown owner rather than another generic presentation reset.","objdump + local inspection + field correlation + multiscale-support correlation + teardown correlation"
0x005375c0,2144,world_presentation_ensure_secondary_overlay_support_buffers_and_seed_defaults,map,thiscall,inferred,objdump + caller inspection + allocation-path inspection,3,"Broad setup or ensure-owner above the secondary-overlay support family. When the caller-supplied enable byte is nonzero, the helper allocates and zero-fills the five-entry packed sample-triplet family rooted at `[this+0x15f1..+0x1601]`, the five-entry float summary family rooted at `[this+0x1605..+0x1615]`, the five-entry smoothed unsigned-word family rooted at `[this+0x1619..+0x1629]`, the packed local-byte staging buffer `[this+0x162d]`, the four neighboring sidecar byte planes `[this+0x1631..+0x163d]`, the packed secondary 3-byte raster `[this+0x165d]`, the signed vector byte planes `[this+0x1661]` and `[this+0x1665]`, the ranked-overlay and geographic-label coarse cell tables `[this+0x1685]` and `[this+0x1675]`, plus several neighboring support tables. The same body also allocates and seeds the two one-byte mask planes with different defaults: `[this+0x1655]` is filled with byte `0x02`, while `[this+0x1659]` is filled with byte `0x01`. Later in the same body it rebuilds the local support surfaces through `0x00536230`, `0x00536420`, `0x00537420`, and the neighbor object allocator `0x005337f0`. Current grounded callers are the shell world-mode branch at `0x00484e47`, the world-presentation resize or rebuild tail at `0x00537f44`, one neighboring world-side refresh at `0x00538629`, and the `.smp`-side restore or reload branch at `0x00553539`, so this is the safest current read for the shared secondary-overlay support-buffer ensure and default-seed owner rather than a narrower vector-field helper.","objdump + caller inspection + allocation-path inspection + multiscale-support correlation + mask-plane default correlation"
0x00537e60,503,world_presentation_apply_grid_dimensions_and_reinitialize_secondary_overlay_family,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Broader world-presentation reinitializer above the secondary-overlay family. The helper publishes one shell progress step, stores the incoming live grid dimensions into `[this+0x15d9/+0x15d5/+0x15dd]`, re-enters `world_allocate_base_secondary_overlay_planes_for_current_dimensions` `0x00532c80` when the dimensions are nonzero, then re-enters `world_presentation_ensure_secondary_overlay_support_buffers_and_seed_defaults` `0x005375c0` and several neighboring overlay initializers or constant-table publishers (`0x00535070`, `0x00535430`, `0x00532ad0`, `0x005356e0`, `0x00534fc0`, `0x00535890`, `0x005373b0`) before returning. Current grounded callers are the world-side reattach branch at `0x0044922a` and the `.smp` restore-side presentation rebuild path at `0x005532d7`, so this is the safest current read for the shared dimension-apply and secondary-overlay-family reinitializer rather than one narrow resize helper.","objdump + caller inspection + field correlation + overlay-reinitialization correlation"
0x00538060,992,world_load_named_tga_into_secondary_overlay_float_summary_and_publish_transport_preview,map,thiscall,inferred,objdump + caller inspection + local disassembly + field correlation,3,"Transport/pricing-preview-side owner beneath `world_ensure_transport_pricing_preview_surface_and_publish_if_missing` `0x0044faf0`. The helper first builds a short descriptor around literal `C_` through `0x00518de0`, re-enters `world_presentation_rebuild_four_overlay_surface_slots_from_source_or_fallback` `0x00535430` to seed one preview handle, temporarily overrides shell globals `[0x006d4024+0x11423b/+0x11423f/+0x114254/+0x114255]`, and then loads `%1.tga` through `0x0053c1c0 -> 0x00541970`. After clamping the sampled dimensions into the `0x401 x 0x401` range, it rewrites the base secondary-overlay float summary plane `[this+0x1605]` together with mask planes `[this+0x1655/+0x1659]` and the packed raster `[this+0x165d]` from the sampled image, optionally re-enters `world_normalize_secondary_overlay_float_summary_plane_globally` `0x00532d90` and `world_expand_positive_secondary_overlay_float_summary_by_radius` `0x00532f60`, republishes the preview handle through `0x0053c000`, re-enters `world_presentation_ensure_secondary_overlay_support_buffers_and_seed_defaults` `0x005375c0(1, 0, 0)`, and returns the handle originally produced by `0x00535430`. Current grounded caller is `0x0044faf0`, so this is the safest current read for the named-TGA preview loader plus secondary-overlay summary rebuild owner rather than a generic surface import helper.","objdump + caller inspection + local disassembly + field correlation + named-tga correlation + transport-preview correlation"
0x00538360,732,world_rebuild_secondary_overlay_base_float_summary_and_primary_mask,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Broader rebuild owner for the base secondary-overlay float-summary plane rooted at `[this+0x1605]` and the paired one-byte mask planes `[this+0x1655]` and `[this+0x1659]`. The helper samples one caller-supplied coarse lookup field, writes one unclamped float score per live cell into the base summary plane, clears both mask planes across the same rectangle, and updates the packed secondary raster at `[this+0x165d]` as it goes. The later interior pass is the useful asymmetry: after the clear, the helper only repopulates the primary mask plane `[this+0x1655]` for low-3-bit class-`1` cells whose neighboring float-summary samples cross the positive threshold, while the second mask plane `[this+0x1659]` remains only reset or preserved for later owners. After that interior sweep it re-enters `world_normalize_secondary_overlay_float_summary_plane_globally` `0x00532d90`, then `world_expand_positive_secondary_overlay_float_summary_by_radius` `0x00532f60`, calls the neighboring refresh owner `0x0053c000`, and finally re-enters `world_presentation_ensure_secondary_overlay_support_buffers_and_seed_defaults` `0x005375c0`. This asymmetry now closes the local split: the helper actively rebuilds only the primary runtime mask, while the second plane stays as the separately persisted sibling for later setup, restore, or compatibility paths.","objdump + caller inspection + field correlation + mask-plane asymmetry correlation + local-split-closure correlation"
0x00538640,160,shell_control_status_owner_construct_and_zero_active_token_tables,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Constructor for the shell-global owner stored at `0x006d401c` during the bootstrap path around `0x0052130b`. The helper zero-fills the `1000`-byte active-token table `[this+0x20]`, clears byte `[this+0xc68]`, allocates one `0x88`-byte helper through `0x0053b070 -> 0x00518b90` into `[this+0xc69]`, clears the remaining text, handle, and deadline fields `[this+0x00..+0x1c]`, `[this+0xc58/+0xc60/+0xc64]`, and seeds scalar `[this+0xc5c] = 0.25f`. Current grounded caller is the bootstrap-side allocation path at `0x0052130b`, so this is the safest current read for the shell status/control owner constructor rather than a generic list-model initializer.","objdump + caller inspection + local disassembly + bootstrap-global correlation"
0x005386e0,192,shell_control_status_owner_publish_primary_text_with_timeout,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Primary timed-text publisher over the shell-global owner at `0x006d401c`. Guarded by reentrancy latch `0x00ccba18`, the helper refreshes owned string field `[this+0x14]` through `0x0051d820`, ensures or releases helper handle `[this+0x18]` through `0x0053c6f0(7)` or `0x0053c000` depending on whether the new text is non-empty, and then writes deadline `[this+0x1c]` as `shell_get_elapsed_tick_count_since_bootstrap_seed` `0x0051d890` plus the caller-supplied timeout or zero when the timeout is absent. Current grounded callers include the shell-side status publishers at `0x00434785`, `0x004829e1`, `0x00482ab7`, `0x00483948`, `0x00538a80`, and `0x00538b94`, so this is the safest current read for the owner's primary timed-text lane rather than a generic string setter.","objdump + caller inspection + local disassembly + timed-text correlation + global-owner correlation"
0x005387a0,112,shell_control_status_owner_publish_secondary_text_with_fixed_10s_timeout,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Secondary timed-text publisher over the same shell-global owner at `0x006d401c`. Guarded by reentrancy latch `0x00ccba1c`, the helper writes deadline `[this+0x08] = shell_get_elapsed_tick_count_since_bootstrap_seed() + 0x2710`, refreshes owned string field `[this+0x10]` through `0x0051d820`, and leaves the lane untouched when the guard is already armed. Current grounded callers include the shell-side publishers at `0x0046d1b3`, `0x0046d4f7`, `0x00483a93`, `0x00483ab3`, `0x00483ad5`, `0x00489b52`, `0x00489c16`, and `0x004df7a7`, so this is the safest current read for the owner's fixed-10-second secondary text lane rather than another generic string setter.","objdump + caller inspection + local disassembly + timed-text correlation + global-owner correlation"
0x00538810,48,shell_find_registered_window_containing_child_control_id,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Search helper over the shell-global owner at `0x006d401c`. The helper walks the registered shell-window list rooted at `[this+0x00]`, asks each window whether it owns the requested child control id through `shell_window_find_registered_child_control_by_id` `0x0053f830`, and returns the first matching window pointer or null. Current grounded callers include the `Setup.win`-adjacent shell paths at `0x004beeb1`, `0x004c9ade`, `0x004c9b30`, `0x004c9b58`, `0x004e07a2`, and `0x0056301f`, so this is the safest current read for the global window-by-child-control-id lookup rather than another child-list walker.","objdump + caller inspection + local disassembly + child-control correlation + global-owner correlation"
0x00538840,64,shell_control_status_owner_clear_active_tokens_for_child_control_id,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Clears every active token-table entry in the shell-global owner whose recorded 16-bit child control id matches the caller input. The helper linearly scans the `1000`-entry id table `[this+0x408]` together with the parallel active-byte table `[this+0x20]`, and for each active matching entry clears the corresponding active byte. Current grounded callers are the two child-control teardown or replacement paths at `0x0055fc8a` and `0x00561632`, so this is the safest current read for the owner's control-id-based token invalidation helper rather than a generic list clear.","objdump + caller inspection + local disassembly + token-table correlation + child-control teardown correlation"
0x00538880,16,shell_control_status_owner_release_active_token_handle,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny release companion for the shell-global active token table. The helper treats the caller dword as one previously returned token handle and clears the corresponding active-byte slot in `[this+0x20]`. Current grounded callers are the local shell-control paths at `0x0055a0fe`, `0x0055a12a`, and `0x00561652`, so this is the safest current read for the owner's token-handle release helper rather than a broader table reset.","objdump + caller inspection + local disassembly + token-table correlation"
0x00538890,64,shell_control_status_owner_allocate_active_token_handle_for_child_control_id,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Allocates one active token-table slot for the caller-supplied 16-bit child control id. The helper linearly scans the `1000`-entry active-byte table `[this+0x20]` for the first clear slot, marks it active, stores the control id into the parallel id table `[this+0x408]`, and returns the opaque token handle `0xea60 + slot_index`; when no free slot exists it returns `0`. Current grounded callers are the shell-control allocation or replacement paths at `0x0055a3cd`, `0x0055a4a4`, `0x00560140`, `0x00561322`, and `0x00561428`, so this is the safest current read for the owner's control-id-scoped token allocator rather than a generic id registry.","objdump + caller inspection + local disassembly + token-table correlation + child-control correlation"
0x005388d0,177,shell_dispatch_12_dword_descriptor_across_registered_windows_with_optional_override,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Dispatch owner for one stack- or caller-supplied `12`-dword shell descriptor. The helper first copies the descriptor into a local work buffer, then consults the optional override validator at `[0x006d401c+0xc75]` through vtable slot `+0x04`; when that override vetoes the descriptor it falls back to the registered shell-window list rooted at `[this+0x00]` and forwards the same descriptor through `0x0053fe90` on each window until one handler returns the stop code. When the incoming kind dword is `6`, the helper also recursively redispatches a rewritten copy with kind `0xb7`. Current grounded callers include the higher publishers `0x00538c70`, `0x00538e00`, and `0x00538f10`, so this is the safest current read for the shared shell descriptor dispatcher rather than a window-family-local callback.","objdump + caller inspection + local disassembly + registered-window correlation + descriptor-rewrite correlation"
0x00538990,48,shell_registered_window_list_call_virtual_slot_0_until_one_returns_zero,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small list-walk gate over the registered shell-window list rooted at `[this+0x00]`. The helper walks each node through link field `+0x58`, calls that node's vtable slot `+0x00` with the caller payload, and stops on the first zero return; when the list is empty it returns `1`. Current grounded caller is the shell dispatch gate at `0x00483a47`, which uses the helper as an early allow or veto pass before deeper message handling, so this is the safest current read for the registered-window virtual-slot gate rather than a generic iterator.","objdump + caller inspection + local disassembly + shell-window-list correlation"
0x005389c0,80,shell_registered_window_list_unlink_node_and_optionally_release,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Unlinks one shell-window or shell-node record from the doubly linked list rooted at `[this+0x00/+0x04]`. When the caller-supplied node is non-null the helper first re-enters `0x005400c0(node)` to run the node's local release or reset path, then repairs predecessor and successor links through fields `+0x54/+0x58`, and updates the list root or tail when the removed node occupied either end. Current grounded callers include the shell-window teardown paths at `0x00482f17`, `0x004830d9`, `0x004bc19c`, `0x004c9b92`, `0x004cf8cc`, `0x004ddc56`, `0x004e1c99`, `0x004e5010`, `0x00501ef2`, `0x00507942`, and `0x00517512`, so this is the safest current read for the shared registered-window unlink helper rather than a window-family-specific destructor.","objdump + caller inspection + local disassembly + shell-window-list correlation + doubly-linked-list correlation"
0x00538a10,16,shell_control_status_owner_query_float_scalar_0xc5c,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny x87 getter over float scalar `[this+0xc5c]` in the shell-global owner at `0x006d401c`. Current grounded caller is `0x0053decb`, which multiplies the returned value into one presentation-side scalar chain, so the safest current read stays structural around the direct float getter.","objdump + caller inspection + local disassembly"
0x00538a20,16,shell_control_status_owner_set_float_scalar_0xc5c,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny setter companion for float scalar `[this+0xc5c]` in the shell-global owner at `0x006d401c`. Current grounded callers are the shell-mode branches at `0x00483025`, `0x00483182`, `0x00483294`, `0x004832c2`, `0x004832f0`, `0x0048331e`, `0x00483348`, and `0x00483372`, so the safest current read stays structural around the direct float setter.","objdump + caller inspection + local disassembly"
0x00538a30,16,shell_control_status_owner_increment_counter_0xc60,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny increment helper over counter dword `[this+0xc60]` in the shell-global owner at `0x006d401c`. Current grounded callers include shell and world-side branches at `0x00437d99`, `0x004416dd`, `0x004561ba`, `0x00464548`, `0x004b92a3`, `0x004c7ff9`, `0x004ed8a8`, `0x004fec80`, `0x00517512`, and `0x0055c0bd`, so the safest current read stays structural around the direct counter bump rather than a stronger semantic label.","objdump + caller inspection + local disassembly"
0x00538a40,19,shell_control_status_owner_decrement_counter_0xc60_clamped_to_zero,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny decrement companion for counter dword `[this+0xc60]` in the shell-global owner at `0x006d401c`. The helper decrements the counter in place and clamps the stored value back to `0` when the subtraction would underflow below zero. Current local context keeps this as the direct counter-decrement helper rather than a stronger named semaphore owner.","objdump + caller inspection + local disassembly"
0x00538a60,16,shell_control_status_owner_query_counter_0xc60_is_zero,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny boolean gate over counter dword `[this+0xc60]` in the shell-global owner at `0x006d401c`. The helper returns `1` when that counter is zero and `0` otherwise. Current grounded callers include the shell dispatch-side branches at `0x0043d753`, `0x00483a2b`, `0x00483b20`, `0x004fe485`, `0x004fec71`, and `0x00500423`, so the safest current read stays structural around the zero-counter predicate.","objdump + caller inspection + local disassembly"
0x00538a70,272,shell_control_status_owner_publish_reset_text_and_release_registered_windows,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader teardown owner over the shell-global status/control object at `0x006d401c`. The helper first republishes the fixed text payload `0x005c87a8` through `shell_control_status_owner_publish_primary_text_with_timeout` `0x005386e0(0xbb8)`, then walks the registered shell-window list rooted at `[this+0x00/+0x04]`, releasing each node through `0x005400c0` and unlinking it from the list. After that it frees the counted pointer band `[this+0xbd8]` using count `[this+0xc58]`, clears the owned text buffers rooted at `[this+0x10]` and `[this+0x14]`, and releases payload handle `[this+0x0c]` through `0x0053c000` when present. Current grounded caller is the bootstrap-side teardown path at `0x0052146e`, which immediately follows by freeing the owner and nulling `0x006d401c`, so this is the safest current read for the global status/control owner reset-and-release body rather than a generic shell shutdown.","objdump + caller inspection + local disassembly + bootstrap-teardown correlation + shell-window-list correlation"
0x00538b60,272,shell_runtime_prime_service_registered_windows_and_timed_text_lanes,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Primary service owner over the shell-global runtime object at `0x006d401c`. When disable byte `[this+0xc68]` is clear, the helper first re-enters `0x0054f6a0`, refreshes the primary timed-text lane by comparing deadline `[this+0x1c]` against `shell_get_elapsed_tick_count_since_bootstrap_seed` `0x0051d890` and republishing fixed payload `0x005c87a8` through `0x005386e0(0xbb8)` when that deadline has expired, then walks the registered shell-window list from tail `[this+0x04]` through link field `+0x54`, servicing each node through `shell_service_one_object_child_queue_and_deferred_state` `0x0053fda0` and `0x0051f1d0`. After the walk it conditionally presents the secondary lane `[this+0x10/+0x0c]` while deadline `[this+0x08]` is still live, and then presents the primary lane `[this+0x14/+0x18]` when its text is non-empty. Current grounded callers are the shell-state service branches at `0x0048218e`, `0x004835ed`, and `0x00483d2e`, so this is the safest current read for the shell runtime-prime service owner rather than a narrow text-only publisher.","objdump + caller inspection + local disassembly + shell-runtime-prime correlation + timed-text correlation + registered-window-service correlation"
0x00538c70,400,shell_control_status_owner_publish_prioritized_cached_text_and_dispatch_descriptor_0xae,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader cached-text publisher on the shell-global owner at `0x006d401c`. Guarded first by shell-global byte `[0x006d4024+0x57]`, the helper falls back to default text pointer `0x00624d64` when the caller passes null, compares the new request against the currently cached text band `[this+0xbd8/+0xbdc/+0xbe0/+0xbe4]`, and suppresses the update when one still-live cached entry of equal-or-higher priority is already active. Otherwise it replaces the owned cached string at `[this+0xbd8]`, stores the caller priority at `[this+0xbdc]`, stores the caller style or lane token at `[this+0xbe0]`, derives one near or long-lived deadline into `[this+0xbe4]`, and then emits the corresponding shell descriptor by rewriting local kind `0xae` through `shell_dispatch_12_dword_descriptor_across_registered_windows_with_optional_override` `0x005388d0`. Current grounded callers include the linked-peer status publishers at `0x0040e4e0`, `0x0041f720`, `0x0041f7b0`, `0x004b84f0`, and several shell detail or popup builders, so this is the safest current read for the prioritized status-text-plus-descriptor owner rather than a plain string cache.","objdump + caller inspection + local disassembly + priority-cache correlation + descriptor-dispatch correlation + shell-status correlation"
0x00538e00,77,shell_dispatch_synthetic_12_dword_descriptor_from_five_scalars,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small descriptor-synthesis wrapper above `shell_dispatch_12_dword_descriptor_across_registered_windows_with_optional_override` `0x005388d0`. The helper zero-fills one local `12`-dword descriptor, copies the caller's five scalar arguments into the leading five slots, and then forwards that synthetic descriptor into `0x005388d0`. Current grounded callers include `shell_transition_mode` `0x00482ec0` and the route-entry collection follow-on at `0x004c3470`, which use it to post compact shell events without building a full descriptor structure by hand.","objdump + caller inspection + local disassembly + descriptor-synthesis correlation"
0x00538e50,100,shell_registered_window_list_insert_node_sorted_by_priority_and_optionally_prepare_node,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Insertion owner for the registered shell-window list rooted at `[this+0x00/+0x04]`. When the caller-supplied prepare flag is nonzero, the helper first re-enters `0x0053f7f0(node, 1)` on the node itself, then inserts that node into the doubly linked list using sort key dword `[node+0x21]`, walking backward from the current tail through link field `+0x54` until the insertion point is found and repairing predecessor or successor fields `+0x54/+0x58`. Current grounded callers include `shell_transition_mode` `0x00482ec0`, several shell window ensure paths, and the broader blocking loop `0x00538f10`, so this is the safest current read for the shared registered-window insert owner rather than a window-family-local show helper.","objdump + caller inspection + local disassembly + doubly-linked-list correlation + sort-key correlation"
0x00538ec0,72,shell_control_status_owner_refresh_indexed_helper_collection_c69,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Refresh sweep over the indexed helper collection rooted at `[this+0xc69]` in the shell-global owner `0x006d401c`. The helper enumerates live entries through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then forwards each resolved entry into `0x0053e2b0`. Current grounded callers are shell-global setter paths such as `0x00464e4f`, `0x00464e7c`, `0x0051f9d4`, and `0x0051f9f4`, so this is the safest current read for the owner's helper-collection refresh sweep after selection-state changes rather than a generic collection walk.","objdump + caller inspection + local disassembly + indexed-collection correlation + shell-selection correlation"
0x00538f10,657,shell_publish_optional_window_and_run_blocking_descriptor_loop,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader blocking shell loop owner over the shell-global runtime object at `0x006d401c`. The helper first increments nested-loop counter `[this+0xc64]`, optionally seeds one caller-supplied shell window by writing sort key `[window+0x21]` and auxiliary dword `[window+0x6c]` before publishing it through `shell_registered_window_list_insert_node_sorted_by_priority_and_optionally_prepare_node` `0x00538e50`, optionally resolves and nudges one child control id through `shell_find_registered_window_containing_child_control_id` `0x00538810` and `0x0055c8b0`, snapshots shell controller state through `0x0054e7e0/0x0054f4d0`, and then loops on one `12`-dword descriptor buffer. Inside that loop it special-cases descriptor kind `6` into `0xb7` through `0x005388d0`, consults the optional global override validator at `[0x006d401c+0xc75]`, lets one optional global filter at `0x006d3b4c` and the caller-supplied window's vtable slot `+0x04` inspect the descriptor, pumps the shell controller through `0x0051f950`, and exits when the descriptor reaches one of the explicit completion kinds `0xc9` or `0xcd`, deriving the final return code from descriptor word `+0x04` or from `0x0054e9c0`. Current grounded callers include the modal window openers at `0x004d9dc0` and `0x004d9e40`, the shell settings opener `0x00501e50`, and several broader shell teardown or transition branches, so this is the safest current read for the optional-window publish plus blocking descriptor loop rather than a simple show-window helper.","objdump + caller inspection + local disassembly + descriptor-loop correlation + modal-loop correlation + registered-window correlation"
0x005391b0,121,route_entry_release_optional_world_space_attachment_and_owned_buffer_then_dispatch_vtable_slot_0,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Release-side helper in the broader route-entry family. When the caller-supplied boolean is nonzero and shell-global gate `[0x006d4024+0x114256]` is clear, the helper projects current world-space floats `[this+0x0c/+0x10]` into local integers, forwards them together with byte `[this+0x55]` into `0x00533e00` on attachment root `[this+0x04]`, then frees owned pointer `[this+0x1e3]` through `0x005a1145` when present and finally dispatches the object's vtable slot `+0x00`. Current grounded callers include the route-entry-side branches at `0x00490f6e` and `0x0053a598`, so this is the safest current read for the optional world-space attachment release plus virtual teardown helper rather than a generic destructor.","objdump + caller inspection + local disassembly + route-entry correlation + attachment-release correlation"
0x00539230,336,route_entry_apply_local_visual_scalar_preset_by_state_byte,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Applies one of several local visual-scalar presets to a route-entry-family object from one small state byte. The helper writes the chosen state into byte `[this+0x5a]` and then seeds paired float bands at `[this+0x73/+0x77/+0x8b/+0x8f/+0xa3/+0xa7/+0xbb/+0xbf/+0xd3/+0xd7/+0xeb/+0xef/+0x103/+0x107/+0x11b/+0x11f]`, with distinct layouts for the grounded caller states `0`, `1`, `2`, and `3`. Current grounded callers include the route-entry-side update branches at `0x0048a003`, `0x0048a00f`, `0x0048b5ab`, and `0x0048b61e`, so this is the safest current read for the route-entry local visual-scalar preset setter rather than a generic float initializer.","objdump + caller inspection + local disassembly + route-entry correlation + visual-scalar correlation"
0x00539380,295,route_entry_apply_table_driven_visual_profile_and_optional_display_latch,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Table-driven profile setter in the same route-entry family. The helper first normalizes the caller's state byte into one compact profile index, optionally maps the 'display-latched' byte `[this+0x44]` from that index, and then copies several static table-driven dwords into the object's higher visual bands, including `[this+0x1f5/+0x1f9]`, `[this+0x17b..+0x1af]`, `[this+0x193/+0x197]`, `[this+0x1c3/+0x1c7]`, `[this+0x1db/+0x1df]`, and `[this+0x1fd]`. Current grounded callers include `0x0048f59d`, `0x0049154a`, `0x004916ae`, and `0x0053ae23`, where the same helper runs immediately before the neighboring route-entry visual refresh `0x00539640`, so this is the safest current read for the route-entry table-driven visual profile loader rather than a generic palette setter.","objdump + caller inspection + local disassembly + route-entry correlation + table-driven-profile correlation"
0x005394b0,112,route_entry_copy_four_3d_triplet_bands_out,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small export helper over four consecutive `3*dword` triplet bands in the route-entry-family object. The helper copies the optional output triplets from `[this+0x14]`, `[this+0x20]`, `[this+0x2c]`, and `[this+0x38]` into up to four caller-supplied output pointers. Current grounded caller is `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0`, which uses the helper to stage the current route-entry shape or bounding triplets into its builder-state area before deeper search continues, so this is the safest current read for the four-triplet export helper rather than a generic memcpy wrapper.","objdump + caller inspection + local disassembly + route-entry-builder correlation + triplet-band correlation"
0x00539580,77,route_entry_broadcast_three_scalar_args_to_each_attached_handle_in_list_8,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small broadcast helper over the optional attached-handle list rooted at `[this+0x08]` in the same route-entry-family object. When that list exists and yields live entries through `0x00556ef0/0x00556f00`, the helper forwards the caller's three scalar arguments into `0x00530720` on each resolved attached handle. Current grounded caller is `0x0053a5b0`, which forwards current scalar lanes `[this+0x0c/+0x10]` plus one caller argument through this helper, so this is the safest current read for the route-entry attached-handle broadcast owner rather than a generic collection walk.","objdump + caller inspection + local disassembly + route-entry correlation + attached-handle-list correlation"
0x005395d0,112,route_entry_ensure_attached_handle_list_add_handle_and_publish_aggregate_scalar,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Attach-and-publish helper in the same route-entry-family object. The helper ensures attached-handle list root `[this+0x08]` through `0x0053b070(0x18) -> 0x00556db0`, adds the caller-supplied handle into that list through `0x00556e10`, derives one aggregate scalar from the four local scalar lanes `[this+0x18/+0x24/+0x30/+0x3c]` plus one caller-supplied height or bias term, and then publishes the resulting three-scalar packet through `0x00530720` using the local head lanes `[this+0x0c/+0x10]`. Current grounded caller is the small wrapper `0x0053a5b0`, which keeps the safest current read structural around attached-handle registration plus aggregate-scalar publish rather than a stronger subtype label.","objdump + caller inspection + local disassembly + route-entry correlation + attached-handle-list correlation + aggregate-scalar correlation"
0x00539640,1854,route_entry_recompute_derived_visual_scalar_bands_and_optional_display_buffer,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Heavy derived-band rebuild in the same route-entry family. The helper first treats the four stored `3*dword` triplet bands at `[this+0x14]`, `[+0x20]`, `[+0x2c]`, and `[+0x38]` as two endpoint pairs, derives midpoint and half-delta scalars on each axis, and then uses profile weights `[this+0x1f5/+0x1f9/+0x1fd]` plus repeated root query `0x00534490([this+0x04], x, y)` to populate the larger derived visual bands rooted at `[this+0x63]`, `[+0x7b]`, `[+0x93]`, `[+0xab]`, `[+0xc3]`, `[+0xdb]`, `[+0xf3]`, `[+0x10b]`, `[+0x123]`, `[+0x13b]`, `[+0x153]`, `[+0x16b]`, `[+0x183]`, `[+0x19b]`, `[+0x1b3]`, and `[+0x1cb]`. It also updates one global sample lane through `0x00624e00` selected by `0x00ccba24`, clamps several rebuild results against constants `0x005c8c18` and `0x005c8888`, refreshes the center scalars `[this+0x0c/+0x10]`, and conditionally maintains the optional owned `0xc0`-byte display buffer at `[this+0x1e3]`: display-state byte `[this+0x44] == 0` frees it, state `1` writes a compact two-column layout from the raw triplet endpoints and local offset dwords `[this+0x45/+0x49/+0x4d/+0x51]`, and states `2/3` populate the same buffer from weighted midpoint and half-delta bands. Current grounded callers include the route-entry profile setters `0x0048f5aa`, `0x00491599`, `0x004916bf`, collection-wide post-pass `0x00491c20`, and the local rebuild wrappers `0x0053a7f9`, `0x0053a910`, `0x0053a94c`, and `0x0053ac90`, so this is the safest current read for the main route-entry derived-visual-band and optional-display-buffer rebuild rather than a generic interpolation helper.","objdump + caller inspection + local disassembly + route-entry correlation + weighted-derived-band correlation + optional-display-buffer correlation"
0x0053a520,63,global_replace_optional_shell_owned_root_0xccba20_from_single_payload_ptr,bootstrap,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Small global replace helper over root `0x00ccba20`. When the caller-supplied payload pointer is non-null, the helper first releases any existing owned root at `0x00ccba20` through shell owner `0x006d4020` plus `0x0053c000`, then rebuilds that root through `0x0053c1c0(payload,0,0,0x7f)` and stores the result back into `0x00ccba20`. Current grounded caller is the broader bootstrap-side branch at `0x0055e739`, so this is the safest current read for the small replace-in-global-root helper rather than a route-entry-local constructor.","objdump + caller inspection + local disassembly + global-root correlation"
0x0053a560,32,global_release_optional_shell_owned_root_0xccba20,bootstrap,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Tiny release-side companion over global root `0x00ccba20`. When that root is live, the helper releases it through shell owner `0x006d4020` plus `0x0053c000` and then clears `0x00ccba20` back to null. Current grounded caller is the broader shutdown branch at `0x0055e171`, so this is the safest current read for the focused global-root release helper rather than a family-local destructor.","objdump + caller inspection + local disassembly + global-root correlation"
0x0053a590,13,route_entry_vtable_5dd3d8_release_thunk_set_vtable_and_reenter_optional_attachment_teardown,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny release thunk in the route-entry object family. The helper reinstalls vtable `0x005dd3d8`, pushes release flag `1`, and immediately re-enters `route_entry_release_optional_world_space_attachment_and_owned_buffer_then_dispatch_vtable_slot_0` `0x005391b0`. This is the safest current read for the route-entry release thunk rather than a standalone destructor body.","objdump + caller inspection + local disassembly + route-entry correlation"
0x0053a5b0,18,route_entry_broadcast_current_head_lanes_and_caller_scalar_to_attached_handles,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny wrapper above `route_entry_broadcast_three_scalar_args_to_each_attached_handle_in_list_8` `0x00539580`. The helper forwards current head lanes `[this+0x0c/+0x10]` together with the caller-supplied scalar to every live attached handle in `[this+0x08]`. This is the safest current read for the simple attached-handle broadcast wrapper rather than a broader update owner.","objdump + caller inspection + local disassembly + route-entry correlation"
0x0053a5d0,247,route_entry_attach_handle_ensure_list_and_optionally_clone_seed_from_first_live_entry,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader attached-handle add helper in the same route-entry family. When attached-handle list root `[this+0x08]` is null, the helper ensures that list and falls straight through to `route_entry_ensure_attached_handle_list_add_handle_and_publish_aggregate_scalar` `0x005395d0`. When the list already exists, it resolves the first live entry, clones one temporary helper from that seed through `0x0052e880/0x0052e8b0/0x0052e720`, releases the temporary source through `0x00530680 + 0x0053b080`, publishes the cloned handle through `0x00530720`, and finally inserts that cloned handle back into `[this+0x08]` through `0x00556e10`. Current grounded caller is the optional `Infrastructure` child-attach branch `0x0048a325`, so this is the safest current read for the attached-handle ensure plus seed-clone path rather than a plain list add.","objdump + caller inspection + local disassembly + route-entry correlation + attached-handle-clone correlation"
0x0053a6d0,101,route_entry_release_attached_handle_list_and_entries,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Release helper over the optional attached-handle list rooted at `[this+0x08]` in the same route-entry family. The helper walks every live attached handle through `0x00556ef0/0x00556f00`, releases each one through `0x00530680`, frees it through `0x0053b080`, tears the list root down through `0x005570b0` and `0x005571d0`, and finally clears `[this+0x08]` back to null. This is the safest current read for the attached-handle-list teardown owner rather than a broader route-entry destructor.","objdump + caller inspection + local disassembly + route-entry correlation + attached-handle-release correlation"
0x0053a740,322,route_entry_copy_four_triplets_refresh_attachment_tile_and_recompute_center_scalars,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Primary four-triplet setter in the route-entry family. The helper copies up to four caller-supplied triplet buffers into the local bands `[this+0x14]`, `[+0x20]`, `[+0x2c]`, and `[+0x38]`, and when shell-global gate `[0x006d4024+0x114256]` is clear and root `[this+0x04]` is present it quantizes current world-space floats `[this+0x0c/+0x10]` into coarse tile coords, re-enters `route_entry_recompute_derived_visual_scalar_bands_and_optional_display_buffer` `0x00539640`, and refreshes optional attachment id `[this+0x55]` by releasing the previous attachment through `0x00533e00(root, old_id, old_x, old_y)` and acquiring the new one through `0x00533dd0(root, this, new_x, new_y)`. It finally recomputes center scalars `[this+0x1ed/+0x1f1]` from the second and fourth triplets. Current grounded callers include `0x0053ac82` and `0x0053ae53`, so this is the safest current read for the shared four-triplet setter plus attachment refresh owner rather than another raw memcpy wrapper.","objdump + caller inspection + local disassembly + four-triplet correlation + attachment-refresh correlation"
0x0053a890,137,route_entry_reproject_all_four_triplet_midlines_and_rebuild,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small route-entry rebuild wrapper above `0x00539640`. The helper reprojects the Y component of all four stored triplets by re-entering `0x00534490([this+0x04], x, z)` on each pair, normalizes the second and fourth triplets so each pair collapses to its lower or upper member when inverted, recomputes center scalars `[this+0x1ed/+0x1f1]`, and then re-enters `route_entry_recompute_derived_visual_scalar_bands_and_optional_display_buffer` `0x00539640`. Current grounded callers are the route-entry world-refresh branches around `0x0053a5b0`, so this is the safest current read for the local reproject-and-rebuild wrapper rather than a generic sort helper.","objdump + caller inspection + local disassembly + root-height-query correlation + route-entry-rebuild correlation"
0x0053a920,51,route_entry_fill_all_four_triplets_and_center_scalars_from_uniform_scalar_then_rebuild,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Uniform-scalar reset wrapper in the route-entry family. The helper writes the same caller-supplied dword into all four triplet bands rooted at `[this+0x18]`, copies that same scalar into center lanes `[this+0x1ed/+0x1f1]`, and then re-enters `route_entry_recompute_derived_visual_scalar_bands_and_optional_display_buffer` `0x00539640`. This is the safest current read for the uniform triplet-fill reset path rather than another scalar setter.","objdump + caller inspection + local disassembly + uniform-triplet-fill correlation"
0x0053ac40,91,route_entry_rebind_root_reset_attachment_and_optionally_rebuild_from_current_triplets,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Root-rebind reset helper in the route-entry family. The helper detaches and forgets optional display buffer `[this+0x1e3]`, current root `[this+0x04]`, and current attachment id `[this+0x55]`, resolves one fresh root through `0x0051f090`, re-enters `route_entry_copy_four_triplets_refresh_attachment_tile_and_recompute_center_scalars` `0x0053a740` with the current local triplet bands, clears attached-handle list pointer `[this+0x08]`, and only re-enters `route_entry_recompute_derived_visual_scalar_bands_and_optional_display_buffer` `0x00539640` when an owned display buffer was present before the reset. This is the safest current read for the route-entry root rebind plus optional rebuild helper rather than a bare clear routine.","objdump + caller inspection + local disassembly + root-rebind correlation + optional-rebuild correlation"
0x0053aca0,357,route_entry_construct_default_state_and_seed_visual_profile_tables,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Concrete constructor for the same route-entry object family. The helper installs vtable `0x005dd3d8`, clears root, attachment, and optional display-buffer pointers `[this+0x04/+0x55/+0x1e3]`, seeds local style bytes `[this+0x44]=0` and `[this+0x5a]=0xff`, initializes the larger visual-color bands to repeated packed default `0xff7f7f7f`, seeds four local offset dwords `[this+0x45/+0x49/+0x4d/+0x51]`, seeds several default scalar bands such as `[this+0x73/+0x77/+0x8b/+0x8f/+0xa3/+0xa7/+0xbb/+0xbf/+0xd3/+0xd7/+0xeb/+0xef/+0x103/+0x107/+0x11b/+0x11f]`, loads default profile-table dwords from `0x00624d88..0x00624dd4` into `[this+0x17b..]`, `[+0x163..]`, `[+0x133..]`, `[+0x14b..]`, and `[+0x1fd]`, clears the triplet bands and center scalars `[this+0x0c/+0x10/+0x1ed/+0x1f1]`, and normalizes style byte `[this+0x59]` to keep the low nibble while forcing bit `0x10`. This is the safest current read for the default route-entry constructor rather than a generic visual preset helper.","objdump + caller inspection + local disassembly + constructor-state correlation + default-profile-table correlation"
0x0053ae10,85,route_entry_bind_root_apply_state_profile_copy_four_triplets_and_reset_style_latch,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small construction-time binder above the route-entry helpers. The helper stores caller root at `[this+0x04]`, applies the requested state byte through `route_entry_apply_table_driven_visual_profile_and_optional_display_latch` `0x00539380`, zeroes live center scalars `[this+0x0c/+0x10]` and attachment id `[this+0x55]`, copies four caller-supplied triplets through `route_entry_copy_four_triplets_refresh_attachment_tile_and_recompute_center_scalars` `0x0053a740`, then clears the low-nibble style bits in `[this+0x59]` and resets packed color dword `[this+0x5f]` to `0xff7f7f7f`. This is the safest current read for the root-bind plus profile-and-triplet initialization wrapper rather than another plain setter.","objdump + caller inspection + local disassembly + root-bind correlation + state-profile correlation"
0x005373b0,112,world_presentation_seed_default_overlay_companion_record_set,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Seeds the default static overlay-companion record set after a broader presentation reinit. The helper zero-fills the local `0x1b`-entry companion slot table at `[this+0x40c]`, clears live count `[this+0x408]`, and then invokes `world_presentation_allocate_overlay_companion_record_from_static_template` `0x00535950` seven times with the static template rows `0x005dd300`, `0x005dd314`, `0x005dd328`, `0x005dd33c`, `0x005dd350`, `0x005dd364`, and `0x005dd378`. Current grounded caller is `0x0053804e` inside `world_presentation_apply_grid_dimensions_and_reinitialize_secondary_overlay_family` `0x00537e60`, so this is the safest current read for the shared default companion-record seeder rather than a later border-overlay rebuild owner.","objdump + caller inspection + field correlation + static-template correlation"
0x005374d0,240,world_refresh_secondary_overlay_support_surfaces_and_vector_field_in_rect,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Rectangle-wide owner above the secondary-overlay support family. The helper clamps the caller rectangle to the live world bounds, clears shift field `[this+0x15e1]`, runs `0x00536230` across the selected cells to refresh one packed three-float local sample field rooted at `[this+0x15f1]`, runs `0x00536420` across the same rectangle to rebuild one companion unsigned-word field rooted at `[this+0x1619]`, then rebuilds the signed vector byte planes through `world_rebuild_secondary_overlay_vector_byte_planes_in_rect` `0x00536710`, and finally regenerates the multiscale support surfaces through `world_rebuild_secondary_overlay_multiscale_support_surfaces_in_rect` `0x00533890`. Current grounded callers are the late world-side rectangle branch at `0x0044d45c` and the shell-side scan or brush branch at `0x004fc4bf`, so this is the safest current read for the shared secondary-overlay rectangle refresh owner rather than a one-shot startup allocator.","objdump + caller inspection + field correlation + multiscale-support correlation + vector-plane correlation"
0x00533b70,7,world_query_overlay_strip_offset_lut_ptr,map,thiscall,inferred,objdump + caller inspection + allocation-path inspection,3,"Tiny root-pointer getter for the overlay strip-offset lookup table at `[this+0x15e5]`. The table is allocated in the world-presentation setup path around `0x00537b68` and filled with `i * 0x5c` offsets in `0x00537cb0..0x00537ccc`. Current grounded callers are shell-side presentation and staging branches around `0x00524e92`, `0x00525b7e`, `0x0052ae90`, `0x0052b4ef`, and `0x0054dd50`, which consume it together with the normalized coordinate LUTs and sample-record roots.","objdump + caller inspection + allocation-path inspection + field correlation"
0x00533b90,7,world_query_overlay_sample_triplet_buffer_ptr,map,thiscall,inferred,objdump + caller inspection + allocation-path inspection,3,"Tiny root-pointer getter for the packed overlay sample-triplet buffer at `[this+0x15f1]`. The buffer is allocated in the world-presentation setup path around `0x00537616` at `3 * 4` bytes per entry, and the neighboring producer `0x005333eb` writes three floats per selected sample record into that buffer. Current grounded caller is the shell-side overlay staging branch at `0x00525b94`, which uses it alongside the normalized coordinate LUTs and strip-offset table rather than as a standalone geometry owner.","objdump + caller inspection + allocation-path inspection + field correlation"
0x00534f40,29,world_secondary_raster_resolve_cell_record_ptr,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small address resolver for the secondary 3-byte raster rooted at `[this+0x165d]`. The helper flattens the caller-supplied cell coordinates through width `[this+0x15dd]`, multiplies the linear index by `3`, and returns a direct pointer to that 3-byte cell record. Current grounded callers include neighboring world-side presentation or scan branches around `0x004464b8`, `0x00447120`, `0x0044be9c`, `0x00450f8b`, and `0x004fa7a2`, plus the `.smp` serializer `world_runtime_serialize_smp_bundle` `0x00446240`, so this is the safest current read for the shared secondary-raster cell-pointer resolver rather than a more player-facing overlay helper.","objdump + caller inspection + field correlation + secondary-raster correlation"
0x004c9da0,496,map_editor_chairman_slot_panel_format_slot_card,map,cdecl,inferred,objdump + RT3.lng strings + control-flow inspection,4,"Formats one selected chairman-slot card for the shell editor panel rooted under control group `0x5a6e`. The helper reads the 9-byte local slot record rooted at `[0x006cec78+slot*9+0x69d8]`, formats the staged chairman profile label from the static persona table at `0x005f2d28`, appends the localized `Optional` versus `Mandatory` suffix from ids `2997` and `2998` based on `[slot+0x01]` with nonzero=`Optional` and zero=`Mandatory`, then appends one of `Human` `Computer` or `Human or Computer` from ids `3001` `3000` and `2999` based on `[slot+0x02]` plus the separate per-slot gate at `[0x006cec78+slot*9+0x0bc3]`. It also formats the numeric tuning field from `[slot+0x04]` into the same card. Current grounded caller is the selection callback rooted at `0x004cc230`.","objdump + RT3.lng strings + UI callback inspection"
0x004ca010,432,map_editor_chairman_slot_panel_refresh_selected_slot,map,thiscall,inferred,objdump + RT3.lng strings + UI control inspection,4,"Refreshes the active detail controls for one selected chairman slot in the shell editor panel. It stores the selected slot index at `[this+0x80]`, publishes the staged profile id from `[slot+0x00]`, the persona icon byte from `0x005f2d29`, and the localized profile label from `0x005f2d47`, then updates the role and policy controls from the same local record. `[slot+0x01]` drives the Optional-versus-Mandatory control pair with nonzero=`Optional` and zero=`Mandatory`; `[slot+0x02]` plus the separate per-slot gate at `[0x006cec78+slot*9+0x0bc3]` drive the `Human`, `Computer`, and `Human or Computer` controls; and `[slot+0x04]` is surfaced through the numeric field editor. Current grounded caller is the list-selection callback at `0x004cc230`.","objdump + RT3.lng strings + UI control inspection"
0x004ca1c0,514,map_editor_chairman_slot_panel_refresh_slot_counters,map,thiscall,inferred,objdump + UI control inspection,3,"Recomputes the aggregate slot counters displayed by the chairman-slot editor panel. The helper walks the 16 local slot records rooted at `[0x006cec78+0x69d8]`, splits them by the Optional-versus-Mandatory byte `[slot+0x01]`, and separately counts slots whose live-seat markers come from the ordinary seat byte `[slot+0x02]` versus the special occupied-seat byte `[slot+0x03]`. It then formats the resulting `%1/%2` summaries through the shared pattern block at `0x005cfda8`, republishes those summaries to the panel controls under groups `0x5a6f`, `0x5a70`, and `0x5a71`, and stores the aggregate counts at `0x006cec78+0x6a68..0x6a7c` for neighboring shell validation. Current grounded callers are the panel constructor at `0x004cc2d0` and the role-policy update handlers in `0x004cecc0`.","objdump + UI control inspection + format-string inspection"
0x004ca540,304,map_editor_available_chairman_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + static-table inspection,4,"Constructs the shell-side `Player Pool` page in the map-editor control panel. The helper binds the row formatter `0x004ca450` and range callback `0x004ca430` on the shared panel root `0x5aa0`, walks the 40-entry persona table slice at `0x005f2d6e` in `0x27`-byte steps, publishes one localized chairman-name row for each persona, counts enabled scenario-side availability bytes in `[0x006cec78+0x6987..]`, and then republishes the `%1 out of %2 are selected.` summary from localized id `1035` through control `0x5aa4`. The neighboring localized page text `996` `Player Pool` plus help text `1016` `Control of which specific players (i.e. Jay Cooke) allowed in the scenario.` now make this the strongest current shell owner for the scenario's available-chairman pool rather than another generic persona browser.","objdump + RT3.lng strings + static-table inspection + UI callback inspection"
0x004ca670,280,map_editor_scenario_metadata_panel_refresh_briefing_mode,map,thiscall,inferred,objdump + RT3.lng strings + UI control inspection,4,"Refreshes the briefing-mode controls inside one shell-side map-editor scenario metadata panel. The helper uses the global selector `0x621f50` to choose whether the visible long-text editor is the ordinary scenario briefing or the multiplayer briefing, publishes the corresponding heading from localized ids `1491` `Briefing (dialog appears when scenario starts):` and `3586` `Multi-Player Briefing (dialog appears when scenario starts):` onto control `0x5b73`, flips the paired selector controls around `0x5b71` and `0x5b72`, and republishes the stored single-player and multiplayer briefing texts from `[0x006cec78+0x4f30]` and `[+0x5ae9]` into the paired edit controls `0x5b6d` and `0x5b6f`. Current grounded caller is the broader scenario metadata refresh at `0x004ca790`.","objdump + RT3.lng strings + UI control inspection + state-field correlation"
0x004ca790,384,map_editor_scenario_metadata_panel_refresh_controls,map,thiscall,inferred,objdump + RT3.lng strings + UI control inspection,4,"Refreshes the shell-side map-editor scenario metadata controls under the shared control band `0x5b69..0x5b74`. The helper first re-enters `map_editor_scenario_metadata_panel_refresh_briefing_mode` at `0x004ca670`, then republishes the scenario description from `[0x006cec78+0x672e]` to control `0x5b69`, the start-year trio from `[+0x66ca]`, `[+0x66d2]`, and `[+0x66ce]` into `0x5b6a`, `0x5b6c`, and `0x5b6b`, the direct campaign-designated byte `[+0x66de]` into control `0x5b6e`, and the inverse of the paired metadata byte `[+0x66f3]` into control `0x5b74`. The resource-side anchor is now explicit too: `editorDetail.win` contains one control record rooted at `0x5b6e` that carries localized ids `3160/3161` `Campaign Scenario` and `If checked, this map will be reserved as a campaign scenario.` before the next control record begins at `0x5b74`, which grounds `[+0x66de]` as the actual campaign-scenario flag rather than a generic metadata boolean. The neighboring message dispatcher at `0x004cb4a0` clamps the three year fields to `1829..2100` and maintains `minimum <= default <= maximum`, which aligns the rest of this panel with the localized editor strings `Description:` `Minimum Start Year:` `Default Start Year:` `Maximum Start Year:` and the paired briefing labels in `RT3.lng` ids `1483..1492` and `3586`.","objdump + RT3.lng strings + UI control inspection + state-field correlation + editorDetail.win resource record"
0x004ca910,474,map_editor_building_density_panel_refresh_controls,map,thiscall,inferred,objdump + RT3.lng strings + caller inspection + UI control inspection,4,"Refreshes the shell-side `Building Density` page in the map-editor control panel. The helper reads two scenario-state bytes at `[0x006cec78+0x4c78]` and `[+0x4c7c]` and reflects them into two separate three-choice control bands `0x5c3a..0x5c3c` and `0x5c44..0x5c46`, with both fields seeded to the middle state `1` by constructor-time defaults and persisted through the ordinary map-state bundle path. The localized field captions now make the page materially tighter: `[state+0x4c78]` is the `Starting Building Density Level:` selector from ids `1642` and `1643`, where the default middle state `1` corresponds to the documented `100%` baseline and the lower world-building branches later treat the stored ordinal as a real three-state numeric mode; `[state+0x4c7c]` is the paired `Building Density Growth:` selector from id `1644`, which combines with city or region-specific density changes as described by `1641` and is likewise consumed later as a three-state growth-mode byte rather than a pure UI label. Related localized report text such as `1037`, `1048`, and `1070` points back to this same pair as the map-wide starting-density and later growth controls.","objdump + RT3.lng strings + caller inspection + UI control inspection + save-load correlation"
0x004ca980,315,map_editor_economic_cost_slider_dispatch,map,thiscall,inferred,objdump + RT3.lng strings + .data descriptor table inspection,3,"Slider-update dispatcher for one shell-side map-editor economic tuning family. The helper handles the bounded slider event range `0xa433..0xa43d`, converts the incoming integer slider delta or position into normalized floats, writes six tuned values into the adjacent scenario-state block at `[0x006cec78+0x0be2]`, `[+0x0be6]`, `[+0x0bea]`, `[+0x0bee]`, `[+0x0bf2]`, and `[+0x0bf6]`, mirrors the first value into `[state+0x0bde]`, and then re-enters the live panel owner through `0x004cadf0` when `0x006cff84` is present. Current neighboring constructor evidence binds this callback to six visible controls under `0x5bcd..0x5bd7`, while the surrounding `.data` descriptor run at `0x00611c70..0x00612220` now bounds the wider editor lane as the live owner for `Prime Rate`, `Merger Premium`, and the construction and maintenance cost labels `Build Stations Cost` through `Steam Engine Cost` with help texts `2433..2437`, rather than leaving that help-text family orphaned.","objdump + slider jump-table inspection + state-field correlation + RT3.lng strings + .data descriptor table inspection"
0x004cadf0,751,map_editor_economic_cost_slider_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + caller inspection + .data descriptor table inspection,4,"Constructs one shell-side map-editor economic cost tuning panel. The helper registers `map_editor_economic_cost_slider_dispatch` at `0x004ca980` on the six slider controls `0x5bcd`, `0x5bcf`, `0x5bd1`, `0x5bd3`, `0x5bd5`, and `0x5bd7`, attaches the neighboring preview or formatter callback `0x004caaf0` on control `0x5be1`, and then republishes the current scenario-state tuning values from `[0x006cec78+0x0be2..0x0bf6]` back into those controls through the shared slider formatting helpers. Current surrounding evidence now grounds this as the live editor-side economic tuning subsystem that was previously only visible through the orphaned help-text family: the adjacent descriptor block at `0x00611c70..0x00612220` pairs the wider lane with localized fields `Prime Rate`, `Merger Premium`, and `Build Stations Cost` through `Steam Engine Cost`, plus help texts `2433..2437`. Current grounded caller is the larger editor-panel dispatcher at `0x004ce244`.","objdump + caller inspection + slider registration + state-field correlation + RT3.lng strings + .data descriptor table inspection"
0x004cb2b0,485,map_editor_scenario_special_conditions_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + static-table inspection,4,"Constructs the special-conditions side of the shell map-editor scenario setup page. The helper binds the row formatter `0x004cb1c0` and range callback `0x004cb1a0` on list control `0xa7fa` through `Setup_Options_Buttons.imb`, walks the 49-entry static toggle table at `0x005f3ab0`, counts enabled dword flags in `[0x006cec78+0x4a7f]`, formats each row from paired label/help ids such as `2535/2564` `Disable Stock Buying and Selling`, `2874/2875` `Use Bio-Accelerator Cars`, `3722/3723` `Disable Cargo Economy`, `3850/3851` `Disable Train Crashes`, `3852/3853` `Disable Train Crashes AND Breakdowns`, and `3920/3921` `AI Ignore Territories At Startup`, and republishes the `Special Conditions In Effect` summary from localized id `1053` through control `0xa7f8`. The same constructor also reads one trailing dword at `[0x006cec78+0x4b43]`, so the live editor-owned scenario-rule band is now best bounded as `49` dwords plus one scalar rather than the smaller fixed matrix inferred in the checked `gmp/gms/gmx` files. It then re-enters `map_editor_scenario_metadata_panel_refresh_controls` at `0x004ca790`, which makes this a bounded scenario special-conditions panel rather than a generic option list. Current grounded caller is the larger editor-panel dispatcher at `0x004ce28e`.","objdump + RT3.lng strings + static-table inspection + UI callback inspection + fixed-runtime-band correlation"
0x004cb4a0,468,map_editor_scenario_metadata_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the adjacent map-editor scenario metadata controls. The helper handles the bounded event band `0xa497..0xa4a2`, writing the scenario description from the edit-control payload into `[0x006cec78+0x672e]`, the single-player and multiplayer briefing texts into `[+0x4f30]` and `[+0x5ae9]`, flipping the briefing selector at `0x621f50` between the single-player and multiplayer views, toggling the direct campaign-scenario byte `[+0x66de]` plus the paired metadata byte `[+0x66f3]`, and committing the three start-year fields `[+0x66ca]`, `[+0x66ce]`, and `[+0x66d2]` after clamping each incoming value to `1829..2100`. The resource correlation is now explicit too: `editorDetail.win` ties control `0x5b6e` to localized ids `3160/3161` `Campaign Scenario` and `If checked, this map will be reserved as a campaign scenario.`, so the direct toggle path at `0x4cb519` is now grounded as the editor-side campaign-designation bit rather than a generic metadata checkbox. Before returning it also normalizes the year trio so `minimum <= default <= maximum` and then re-enters `map_editor_scenario_metadata_panel_refresh_controls` at `0x004ca790`, which confirms that the shared control band `0x5b69..0x5b74` is the live scenario description, briefing, and start-year editor rather than another generic editor options block. Current grounded caller is the panel callback installation rooted at `0x004ce28e`.","objdump + RT3.lng strings + UI dispatch inspection + state-field correlation + editorDetail.win resource record"
0x004cb6f0,496,map_editor_available_chairman_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + static-table inspection + UI dispatch inspection,4,"Message dispatcher for the shell-side `Player Pool` editor page. The helper handles the three bulk-selection buttons `0x5aa1..0x5aa3` by rewriting the scenario-side availability bytes rooted at `[0x006cec78+0x6987]` from preset-selection bytes embedded in the same `0x005f2d28` persona table family, and it also commits direct per-row toggle changes from the control range `0x5aaa..0x5b03` back into that byte array. After either path it re-enters `map_editor_available_chairman_panel_construct` at `0x004ca540`, which keeps the visible chairman-name list and the `selected out of total` summary in sync. The localized page text `996` `Player Pool` and help text `1016` now make this the live owner for the scenario's chairman-availability mask rather than a passive list callback block.","objdump + RT3.lng strings + static-table inspection + UI dispatch inspection + state-field correlation"
0x004cb8e0,271,map_editor_scenario_special_conditions_panel_handle_message,map,thiscall,inferred,objdump + static-table inspection + UI dispatch inspection,4,"Message dispatcher for the special-conditions side of the shell map-editor scenario setup page. The helper handles the bulk selection controls `0xa7fb` and `0xa7fc` by writing the whole `49`-dword special-condition array rooted at `[0x006cec78+0x4a7f]`, commits direct per-row state changes from the callback band `0xabe0..0xafc7` into that same array, and updates the neighboring scalar at `[0x006cec78+0x4b43]` through control id `0xa7ff` before re-entering `map_editor_scenario_special_conditions_panel_construct` at `0x004cb2b0` to refresh the visible list and the `Special Conditions In Effect` summary. Two row ids are also special-cased through immediate helper calls after commit, which marks this as the live state owner for the wider scenario rule-toggle matrix rather than only a passive list callback block.","objdump + static-table inspection + UI dispatch inspection + state-field correlation + fixed-runtime-band correlation"
0x004cb9f0,134,map_editor_building_density_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + caller inspection + UI dispatch inspection,4,"Message dispatcher for the shell-side `Building Density` page. The helper handles the two three-choice control bands `0x5c3a..0x5c3c` and `0x5c44..0x5c46`, committing ordinal values `0`, `1`, or `2` into the scenario-state bytes `[0x006cec78+0x4c78]` and `[+0x4c7c]` respectively before re-entering the same page refresh path at `0x004ca910`. The localized captions now pin the semantics more directly: `[state+0x4c78]` is the map-wide `Starting Building Density Level:` selector whose default middle state is the documented `100%` baseline, while `[state+0x4c7c]` is the paired `Building Density Growth:` selector. Current downstream xrefs also show both stored bytes steering later world-generation and growth math as concrete three-state mode selectors rather than only UI summaries.","objdump + RT3.lng strings + caller inspection + UI dispatch inspection + state-field correlation"
0x004cc980,943,map_editor_city_region_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Cities/Regions` editor page. The helper uses the current selected city-or-region id in `0x006cff74`, falls back to the first live entry in the region collection at `0x0062bae0`, and shows the empty-page warning from localized id `1045` `You currently have no cities or regions to edit.` when the collection is empty. In the live path it binds the list-row formatter `0x004cc340` and selection callback `0x004cc930`, populates the visible city-or-region list from `0x0062bae0`, publishes detail fields through controls `0x50dc..0x50e2`, and formats the page summary from localized ids including `3002`, all of which makes this the main owner for the `Cities/Regions` editor section rather than a subordinate helper.","objdump + RT3.lng strings + UI callback inspection + region-collection correlation"
0x004cc250,112,map_editor_chairman_slot_panel_refresh_slot_list,map,thiscall,inferred,objdump + UI control inspection,4,"Rebuilds the visible slot list in the chairman-slot editor panel. It clears the list control under group `0x5a6e`, then walks the 16 local slot records rooted at `[0x006cec78+0x69d8]` and appends one row for each slot whose active-seat bytes `[slot+0x02]` or `[slot+0x03]` are set. After repopulating the list it re-enters `map_editor_chairman_slot_panel_refresh_slot_counters` at `0x004ca1c0`. Current grounded callers are the panel constructor at `0x004cc2d0` and several message-handler update paths in `0x004cecc0`.","objdump + UI control inspection"
0x004cc2d0,99,map_editor_chairman_slot_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Players` editor panel under control group `0x5a6e`. The helper attaches the selected-slot formatter at `0x004c9da0`, the profile-cycle button at `0x004c9fa0`, and the list-selection callback at `0x004cc230`, then populates the current slot list through `map_editor_chairman_slot_panel_refresh_slot_list` and publishes one top-level panel control. The localized page text `995` `Players` plus help text `1015` `Control of how many players, human and/or A.I., allowed in the scenario.` now make this the clearest current shell owner for the local chairman-slot record family rooted at `0x006cec78+0x69d8`.","objdump + RT3.lng strings + UI callback inspection"
0x004ceb90,291,map_editor_chairman_slot_panel_cycle_selected_slot_profile,map,thiscall,inferred,objdump + static-table inspection,4,"Cycles the staged chairman profile assigned to the currently selected local slot. Starting from the slot-local profile id at `[slot+0x00]`, the helper wraps through the bounded persona id range `0..40`, skips any profile already marked busy in the static persona table byte at `0x005f2d28`, writes the chosen id back to `[slot+0x00]`, and mirrors the same choice into any already-materialized persona object in `0x006ceb9c`, including its display name, biography text, and icon byte. Current grounded callers are the profile-cycle control in `map_editor_chairman_slot_panel_handle_message` and the neighboring shell callback block around `0x004c9fa0`.","objdump + static-table inspection + UI callback inspection"
0x004cecc0,1049,map_editor_chairman_slot_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell chairman-slot editor panel rooted at `0x5a6e`. The helper handles add and remove slot actions, profile cycling, the Optional-versus-Mandatory toggle, the three-way `Human` `Computer` `Human or Computer` role group, and numeric tuning edits for the selected slot. The current slot-record semantics are bounded directly from these branches: control id `0x5a77` writes `[slot+0x01]=1` for `Optional`, `0x5a78` writes `[slot+0x01]=0` for `Mandatory`, and `0x5a79`, `0x5a7a`, plus `0x5a7b` select `Human`, `Computer`, and `Human or Computer` by combining the ordinary seat byte `[slot+0x02]` with the separate per-slot gate at `[0x006cec78+slot*9+0x0bc3]`; `0x5a7c` commits the numeric tuning field back to `[slot+0x04]`. The add-slot path allocates a new live slot, seeds `[slot+0x00]` to one persona id, `[slot+0x01]` to `Optional`, `[slot+0x02]` to the broad `Human or Computer` state, mirrors that same broad state into the external gate at `+0x0bc3`, and seeds `[slot+0x04]` to the default `100000` tuning value. The remove path clears the whole 9-byte record rooted at `[slot+0x00]`, resets `[slot+0x04]` back to `100000`, and clears any already-materialized persona object, but it does not directly write the special occupied-seat byte `[slot+0x03]`, which remains seeded elsewhere in the currently grounded code. Current grounded caller is the shell panel callback attachment in `map_editor_chairman_slot_panel_construct` at `0x004cc2d0`.","objdump + RT3.lng strings + UI dispatch inspection"
0x004ce070,1549,map_editor_panel_select_active_section,map,thiscall,inferred,objdump + caller inspection + UI dispatch inspection,4,"Top-level map-editor control-panel section selector. The helper switches over the active page byte at `[this+0x78]`, tears down or replaces the current page owner at `[this+0x7c]`, and then constructs the bounded editor pages reached so far including the scenario metadata panel `0x004ca790`, city-or-region page `0x004cc980`, territory page `0x004cd070`, available-chairman panel `0x004ca540`, economic tuning panel `0x004cadf0`, locomotives-availability page `0x004cd680`, industry-availability page `0x004cdbd0`, special-conditions panel `0x004cb2b0`, the bounded dual tri-state policy panel rooted at `0x004ca910`, the now-grounded `Port/Warehouse Cargos` page `0x004cf910`, and the resolved report pages at `0x004d3000`, `0x004d3020`, `0x004d3060`, `0x004d3080`, `0x004d30a0`, `0x004d4110`, and `0x004d4130`. Current neighboring shell evidence is enough to treat this as the broad editor-side page owner rather than another local panel helper.","objdump + caller inspection + UI dispatch inspection + page-constructor correlation"
0x004ce380,1174,map_editor_city_region_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Cities/Regions` editor page. The helper routes list-selection and navigation traffic through the city-or-region controls around `0x507e..0x5088`, opens the rename prompt from localized id `1054` `Enter the new name:` for the currently selected city-or-region, and also owns the copy-industry-data flow anchored by localized id `1055` `Choose the city to copy industry data from`. One bounded branch walks the candidate pool at `0x0062b268` and reapplies per-candidate enable or weighting state against the selected city-or-region through `0x004206b0` before re-entering `map_editor_city_region_panel_construct`. Current grounded globals `0x006cff74`, `0x006cff78`, and the region collection `0x0062bae0` make this the live handler for the `Cities/Regions` editor section rather than a generic shell callback block.","objdump + RT3.lng strings + UI dispatch inspection + region and candidate correlation"
0x004ce820,1221,map_editor_territory_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Territories` editor page. The handler uses the selected territory ids in `0x00621f48` and `0x00621f4c`, routes selection and navigation through controls around `0x50dc..0x50df`, opens the territory rename prompt from localized id `1054`, and owns the border-remap or hide-border policy path that warns through localized ids `1056` and `1057` when a territory's borders cannot be hidden because other territories already remap to it. After committing the selected territory's border and remap fields it re-enters `map_editor_territory_panel_construct`, which makes this the live `Territories` page handler rather than another local modal callback.","objdump + RT3.lng strings + UI dispatch inspection + territory-state correlation"
0x004cd070,1280,map_editor_territory_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Territories` editor page. The helper uses `0x00621f48` and `0x00621f4c` as the selected-territory latches, falls back to the first live territory in the territory collection at `0x006cfc9c`, and shows the empty-page warning from localized id `1046` `You currently have no territories to edit.` when no territories exist. In the live path it populates the visible territory list from `0x006cfc9c`, publishes the selected territory's id, name, border mode, remap target, and numeric tuning fields through controls `0x50dc..0x50e5`, and builds the secondary remap list from other territories that reference the currently selected one. Current grounded neighbors make this the main owner for the `Territories` editor section.","objdump + RT3.lng strings + UI callback inspection + territory-collection correlation"
0x004cd680,1168,map_editor_locomotive_availability_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Locomotives` availability page in the map-editor control panel. The helper reflects three scenario-state policy bytes from `[0x006cec78+0x4c97]`, `[+0x4c98]`, and `[+0x4c99]` into controls `0x5b09..0x5b0b`, binds the row formatter `0x004cd570` and the neighboring callback `0x004ca960` on root control `0x5b05`, and iterates the collection at `0x006ada84` to build the visible locomotive list plus the localized title from id `1050` `Locomotives Available\n\n%1 of %2 available`. The detail path formats each selected locomotive through `EditorDetail.win` and counts live world usage by resolving the record through `0x00461c80` and the world-side lookup at `0x00435030`. Current grounded evidence is therefore strong enough to treat this as the main locomotives-available page rather than a generic detail widget.","objdump + RT3.lng strings + UI callback inspection + locomotive-usage correlation"
0x004cf0d0,861,map_editor_locomotive_availability_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Locomotives` availability page. The helper routes selection and bulk-toggle traffic through controls `0x5b06..0x5b0c`, rewrites the three scenario-state policy bytes at `[0x006cec78+0x4c97]`, `[+0x4c98]`, and `[+0x4c99]`, and walks the locomotive collection at `0x006ada84` to commit per-row availability changes through the same record family used by the constructor. Bulk branches apply enable or disable policy across the visible locomotive set before the handler re-enters `map_editor_locomotive_availability_panel_construct` at `0x004cd680`, which makes this the live availability-policy owner rather than a local detail callback.","objdump + RT3.lng strings + UI dispatch inspection + locomotive-policy correlation"
0x004cdbd0,1357,map_editor_industry_availability_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Industry (Overall)` availability page in the map-editor control panel. The helper binds the detail-row callback `0x004cc130` and the neighboring callback `0x004c9d80` on root control `0x9c42`, then walks the global candidate pool at `0x0062b268`, skipping the category-1 family and sorting the remaining candidates by label before building the visible industry list. The detail side formats the selected industry through `EditorDetail.win`, appends up to eight compatible city-or-region names from the region collection at `0x0062bae0`, and publishes the localized summary from id `1051` `There are %1 Cities and/or Regions using %2 right now`, while the page title uses id `1052` `Industries Available\n\nIndustries: %1 of %2 available`. Current grounded evidence therefore treats this as the main industry-availability page rather than an unnamed detail browser.","objdump + RT3.lng strings + UI callback inspection + candidate-pool correlation"
0x004cf430,714,map_editor_industry_availability_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Industry (Overall)` availability page. The handler routes navigation and toggle traffic through the control band `0x9c43..0xa40f`, updates candidate-availability state through `0x00434f20` for the currently selected industry rows, and then re-enters `map_editor_industry_availability_panel_construct` at `0x004cdbd0` so the visible count and compatible-city summary refresh against the candidate pool at `0x0062b268`. Current grounded control usage and localized strings now make this the live industry-availability handler rather than another shared editor callback block.","objdump + RT3.lng strings + UI dispatch inspection + candidate-state correlation"
0x004cf910,1770,map_editor_port_warehouse_cargo_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Port/Warehouse Cargos` page in the map-editor control panel. The helper uses the selected recipe-book index latches at `0x006cffa0` and `0x006cffa4`, falls back across the per-book state blocks rooted at `[0x006cec78+0x0fe7+index*0x4e1]`, and populates the visible cargo-page controls under `0x59d8`, `0x5a0a`, and `0x5b74`. Current page-state work now bounds the structure more concretely too: the selected recipe-book index wraps modulo `12`, each recipe-book block stores the shared maximum annual production float at `book+0x3ed`, and the constructor then walks five fixed cargo-line entries starting at `book+0x3f1` with stride `0x30`. Each line now grounds as one row-owned mode dword at `+0x00`, one annual amount float at `+0x04`, one supplied-cargo token at `+0x08`, and one demanded-cargo token at `+0x1c`; the constructor resolves the two token strings against the global cargo collection and then reflects the resulting selector indices back into the page controls. The row-control mapping is now bounded too: the selector and label pair at `+0x14/+0x1e` is the supplied-cargo side because it is the pair enabled in modes `2/3`, while the pair at `+0x28/+0x0a` is the demanded-cargo side because it is the pair enabled in modes `1/3`. The same gating also tightens the single numeric field at `+0x46/+0x32`: it is labeled `Annual Demand:` only for mode `1`, but `Annual Supply:` for modes `2/3`. The localized page-title and help-text cluster now bounds the page much more tightly: `1001` `Port/Warehouse Cargos`, `1021` `Control over what ports and warehouses demand and supply.`, `1499` `Port/Warehouse Cargo Recipe Book:`, `1671` `Rename this cargo recipe book`, `1672` and `1673` for previous or next recipe-book cycling, `1674` and `1675` for the shared maximum annual production field, `1676` `Demanded:`, `1677` `Supplied:`, and `1678` for the per-cargo annual amount field. The same constructor also surfaces the four per-cargo mode labels `501` `<Disabled>`, `502` `Demand Only`, `503` `Supply Only`, and `504` `Production Demand->Supply`, publishes the annual demand or supply captions from `510` and `511`, formats rename and usage summaries through localized ids `507`, `508`, and `509`, and exposes the sandbox toggle text from id `3901` `Sandbox Allowed`. Current mode gating now makes the fourth mode tighter too: `Production Demand->Supply` is the only line state that clearly keeps both supplied-cargo and demanded-cargo branches active, while the shared numeric field stays on the supply side in that mode. That matches the wording around `1674`, `1675`, and `504` that ties it to one shared production-capacity pool and raw-material conversion into supplied output. It also emits the bounded high-production and high-load warnings from ids `505` and `506`, both of which explicitly reference ports or warehouses, which makes this the strongest current owner for the recipe-book or port-cargo editor lane rather than another generic detail page.","objdump + RT3.lng strings + UI callback inspection + recipe-book state correlation + mode-table correlation + control-gating correlation"
0x004d0040,1643,map_editor_port_warehouse_cargo_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Port/Warehouse Cargos` editor page. The helper routes selection and navigation traffic through the same recipe-book control bands rooted at `0x59d8`, `0x5a0a`, and `0x5b74`, opens the rename prompt from localized id `507`, and commits per-book cargo policy, sandbox-allowed state, and recipe-book text changes back into the scenario-state blocks at `[0x006cec78+0x0fe7+index*0x4e1]`. The edit-side dispatch is now tighter than before: the recipe-book selector wraps modulo `12`; the dedicated top-level numeric field under `0x59de` writes the shared maximum annual production float at `book+0x3ed`; and the per-line edit groups commit into five fixed cargo-line records beginning at `book+0x3f1` with stride `0x30`. Those line groups now ground as one mode dword at `+0x00`, one annual amount float at `+0x04`, one supplied-cargo token string at `+0x08`, and one demanded-cargo token string at `+0x1c`. The concrete control writes are now bounded too: the mode-`2/3` selector pair writes the supplied token through the `+0x14` control into `+0x08`, while the mode-`1/3` selector pair writes the demanded token through the `+0x28` control into `+0x1c`. The same handler keeps the single amount field on the demand side only for mode `1`; in modes `2/3` it writes that same `+0x04` field as annual supply, which matches the constructor captions `510` `Annual Demand:` versus `511` `Annual Supply:`. Current localized row text now makes the bounded edit surface much clearer: the page cycles among recipe books through `1672` and `1673`, renames them through `1671`, updates the shared maximum annual production field under `1674` and `1675`, and edits five fixed per-book line entries whose mode labels are `501` `<Disabled>`, `502` `Demand Only`, `503` `Supply Only`, and `504` `Production Demand->Supply` with annual amount captions `510` `Annual Demand:` and `511` `Annual Supply:` plus row labels `1676` `Demanded:` and `1677` `Supplied:`. The wording on `1675` also tightens the fourth mode specifically: `Production Demand->Supply` is the branch where the shared production-cap field is relevant and raw materials on hand are converted through production lines into supplied output, rather than only free-standing demand or free-standing supply. One bounded branch walks the city-or-region collection at `0x0062bae0` while rebuilding the usage summaries from localized ids `508` and `509`, and the warning branches re-use ids `505` and `506` when production-rate or supply-demand settings become too high for ports or warehouses. Before returning it re-enters `map_editor_port_warehouse_cargo_panel_construct` at `0x004cf910`, which makes this the live handler for the port or warehouse recipe-book page rather than a shared page-table callback.","objdump + RT3.lng strings + UI dispatch inspection + recipe-book state correlation + mode-table correlation + control-write correlation"
0x004cf700,370,map_editor_panel_dispatch_active_section_message,map,thiscall,inferred,objdump + caller inspection + UI dispatch inspection,4,"Top-level message dispatcher for the active map-editor control-panel section. The helper reuses the same page selector byte at `[this+0x78]` and routes incoming shell messages to the current page-local handlers, including the grounded city-or-region handler `0x004ce380`, territory handler `0x004ce820`, scenario metadata handler `0x004cb4a0`, available-chairman handler `0x004cb6f0`, special-conditions handler `0x004cb8e0`, the bounded dual tri-state handler `0x004cb9f0`, the grounded port-or-warehouse cargo handler `0x004d0040`, and the resolved report-page handlers rooted at `0x004d38c0`, `0x004d3d90`, and the neighboring editor report family. Current grounded caller and page-table evidence now make this the broad editor-side active-page dispatcher rather than another page-local callback block.","objdump + caller inspection + UI dispatch inspection + page-handler correlation"
0x004d0420,1618,map_editor_city_count_stats_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the localized `City Count Stats` editor report. The helper aggregates land-cell and city counts from the active world and region collections, derives per-10K density ratios, and formats the visible summary through localized ids `1059..1070`, including `Total Land Cells`, `Total Cities`, `Average City Building Density`, `Average Region Building Density`, and the projected starting-industry and non-industry building counts. The projected-building side is tighter now too: it walks the live region collection `0x0062bae0`, sums world_region_query_projected_structure_count_scalar_by_category `0x004234e0` for categories `2`, `3`, and `0`, and then combines those projected category scalars with the live-region count byte `[region+0x242]` and density float `[region+0x25a]` to build the final industry and non-industry summary terms. Current grounded caller is the neighboring report-page constructor at `0x004d30a0`.","objdump + RT3.lng strings + caller inspection + world and region count correlation + projected-structure-scalar correlation"
0x004d0a90,3416,map_editor_general_validation_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the localized `General Validation` editor report. The helper walks the current scenario and world state looking for high-level validation failures, including missing industry in a city or region, mismatches between available player slots and the current player-pool setup, missing briefing text, and missing scenario description, then emits the matching warning lines through localized ids such as `1071`, `1073`, `1074`, and `1075`. Current grounded caller is the page constructor at `0x004d3080`, which makes this the actual general-validation report rather than the tree-stats page previously grouped under that label.","objdump + RT3.lng strings + caller inspection + validation-string correlation"
0x004d1b80,536,map_editor_tree_stats_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the localized `Tree Stats` editor report. The helper scans the active world grid through dimensions rooted at `0x0062c120`, accumulates total-tree and density counts into the neighboring global scratch slots at `0x006cffa8` and `0x006cffb8`, and then formats the visible report through localized id `1086`, which includes `Total Trees`, `Trees per any cell`, `Trees per land cell`, and the adjacent performance guidance text. Current grounded caller is the tree-stats page constructor at `0x004d3060`.","objdump + RT3.lng strings + caller inspection + world-grid scan correlation"
0x004d1d60,1679,map_editor_city_region_growth_stats_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the localized `Stats - City/Region` growth report. The helper walks the city or region collection at `0x0062bae0`, reads display names from each entry, and formats the multi-column growth summary through localized ids `1087..1096`, including `Industry Bldg Count`, `Industry Revenue`, `Industry Profit`, `Modified Rail Revenue`, `Weighted Profit Margin`, `Annual Density Adjust`, `Start Density`, `Current Density`, `Start Bldg Count`, and `Current Bldg Count`. The column-to-field mapping is tighter now too: the report prints the weighted-profit-margin scalar from `[region+0x2e2]` as `%3.2f`, the annual-density-adjust scalar from `[region+0x2ee]` as `%3.1f%%`, the start/current density pair from `[region+0x25a/+0x25e]`, and the start/current building-count pair from `[region+0x286/+0x296]`. The neighboring constructor also publishes localized id `1114`, whose explanatory text says cities grow from industry profit margins plus modified rail revenue, so this now looks like the main city-region growth analytics page rather than a generic validation helper. Current grounded caller is `0x004d3020`.","objdump + RT3.lng strings + caller inspection + city-region stat correlation + column-field correlation"
0x004d2430,1597,map_editor_cargo_stats_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the localized `Stats - Cargo` editor report. The helper iterates the cargo or building candidate pool at `0x0062b268`, groups entries by category, and emits the report columns from localized ids `1097..1113`, including `Category`, `Raw Producers`, `Factories`, `Total`, and the adjacent supply-demand and weighted-price summary fields. Current grounded caller is the neighboring page constructor at `0x004d3000`.","objdump + RT3.lng strings + caller inspection + cargo-pool correlation"
0x004d3000,32,map_editor_cargo_stats_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Stats - Cargo` page in the map-editor control panel. The helper binds the report callback `0x004d2430` and attaches the resulting page into the broader editor section owner. Current grounded neighboring labels and report fields align this page with the cargo analytics family rather than with general validation.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
0x004d3020,32,map_editor_city_region_growth_stats_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Stats - City/Region` page in the map-editor control panel. The helper binds the report callback `0x004d1d60`, and the surrounding page text includes localized id `1114`, whose explanatory note about city growth from industry profit margins and modified rail revenue matches the same report callback. Current grounded evidence therefore treats this as the city-region growth analytics page.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
0x004d3060,100,map_editor_tree_stats_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Stats - Trees` page in the map-editor control panel. The helper binds the report callback `0x004d1b80` and attaches it into the broader editor page owner. This corrects the earlier overbroad validation naming: current grounded evidence says this constructor owns the dedicated tree-stats page rather than the whole general-validation lane.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
0x004d3080,32,map_editor_general_validation_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `General Validation` page in the map-editor control panel. The helper binds the report callback `0x004d0a90` and sits alongside the neighboring stats and event-report pages in the same page table. Current grounded warning strings and validation checks make this the actual general-validation page rather than the adjacent tree-stats constructor.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
0x004d30a0,32,map_editor_city_count_stats_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Stats - City Count` page in the map-editor control panel. The helper binds the report callback `0x004d0420` and sits alongside the other editor report constructors in the active-section page table. Current grounded labels and report fields align it with the city-count and projected-density summary page.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
0x004d38c0,1228,map_editor_event_variable_values_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the localized `Event Variable Values` editor tracking report. The helper walks the active scenario issue-state arrays across the game, company, player-profile, and territory slices and emits the visible rows through localized ids `1118..1125`, including `Game : %1`, `Comp. : %1 : %2`, `Player : %1 : %2`, `Terr. : %1 : %2`, and the page title `Event Variable Values`. Current grounded caller is the event-variable page constructor at `0x004d4110`.","objdump + RT3.lng strings + caller inspection + scenario-issue-array correlation"
0x004d3d90,878,map_editor_event_validation_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the editor event-validation report over the live event collection at `0x0062be18`. The helper checks for missing required outcome events and per-event validation failures, then emits the bounded result strings `No Status event.`, `No Lose event.`, `No Win - Gold event.`, `No Win - Silver event.`, `No Win - Bronze event.`, `Error with event %1.`, and `No event errors detected.` from localized ids `1127..1133`. Current grounded caller is the neighboring page constructor at `0x004d4130`.","objdump + RT3.lng strings + caller inspection + event-collection correlation"
0x004d4110,32,map_editor_event_variable_values_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Event Variable Values` tracking page in the map-editor control panel. The helper binds the report callback `0x004d38c0` and sits beside the neighboring event-validation page in the active-section page table.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
0x004d4130,32,map_editor_event_validation_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side event-validation page in the map-editor control panel. The helper binds the report callback `0x004d3d90`, which checks for missing status or win-lose events and other per-event errors before formatting the result list.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
0x00456920,3247,unit_visual_init_weapon_airframe_and_exhaust_effects,bootstrap,thiscall,inferred,ghidra-headless,4,Initializes one armed-unit visual bundle spanning turret and cannon hardware exhaust emitters and aircraft airframe attachments. The routine creates static Turret Mantlet Cannon and MuzzleFlash assets at [this+0x31a] through [this+0x326] direct JetExhaust and PropExhaust sprite emitters at [this+0x2f6] and [this+0x2fa] a cannon-audio attachment at [this+0x32a] indexed WingL and WingR assets plus plane-audio state at [this+0x32e] through [this+0x346] and cached Aileron Elevator Rudder and Thrust vectors at [this+0x2d1] [this+0x2c5] [this+0x2b9] and [this+0x2dd].,ghidra + rizin + llvm-objdump + strings
0x0045a700,240,placed_structure_specialization_accumulate_anim_record_anchor_delta_for_key,map,cdecl,inferred,objdump + local disassembly + field correlation,2,"Small shared helper beneath the specialization `%1_Anim.3dp` transient family. Starting from either the base or alternate basis bands rooted at `0x006acd4c+0x04/+0x34` and `0x006acd4c+0x40/+0x70`, the helper scans every live `0x168`-byte row in the current shared collection `0x006acd50`, filters rows whose key dword matches the supplied id and whose `[row+0x8c]` does not carry bit `0x400`, converts the paired integer triplets through the current basis floats, and accumulates the resulting three-float offset into the caller output vector. Current grounded callers are the heavier shared animation-record service body at `0x0045a9c0`, so this is the safest current read for a keyed anchor-delta accumulator rather than a constructor or renderer.","objdump + local disassembly + field correlation + shared-collection correlation"
0x0045a7f0,453,placed_structure_specialization_replace_anim_record_key_rebind_references_and_activate_selected_effect_slot,map,thiscall,inferred,objdump + local disassembly + global-state correlation,2,"Keyed replace-or-publish helper for the same shared `%1_Anim.3dp` transient family. After validating the caller object through `0x00459c30`, the helper scans the current shared record collection rooted at `0x006acd50/0x006acd4c`, replaces every matching record key dword with the supplied replacement pointer, and also rewrites that same key through the embedded four-lane pointer bands inside each live row while setting row flag bit `0x40` when the top-level record key changes. When the current mode gate in global state `0x006acd48` is negative and the replacement row is not already linked, it inserts that row into the intrusive active list rooted at `0x006acd5c`, stores the caller object at `[row+0x04]`, mirrors the replacement pointer into `[0x006acd48-0x04]`, conditionally dispatches vtable slot `+0x10` on the replacement object, clears byte bit `0x20` when the current shared controller says no emitter owner is active, and if selector table `0x006acd44` is live it allocates one selector-`0` effect slot through `0x00475ed0` before forwarding that slot into `0x00475240(-1,0)`. Current grounded caller is the specialization animation-record build pass at `0x0045b760`, so this is the safest current owner for keyed anim-record replacement plus selected effect-slot activation rather than a generic container insert helper.","objdump + local disassembly + global-state correlation + shared-collection correlation + effect-slot correlation"
0x0045a9c0,1043,placed_structure_specialization_service_shared_anim_record_for_owner_and_publish_two_triplets,map,thiscall,inferred,objdump + local disassembly + global-state correlation,2,"Heavier per-record service body beneath the shared `%1_Anim.3dp` transient family. After validating the caller object through `0x00459c30`, the helper first honors the current controller gates in `0x006acd48/0x006acd58`: when the active selector-owner list `0x006acd44` is live it clears and re-arms flag bit `0x01000000` plus `0x555e50(0)` across those effect slots, and it also mirrors one caller dword into row field `[row+0x80]` when controller bit `0x20` is armed. It then resolves two current world-anchor triplets for the owner through `0x0052e880` and `0x0052e720`, scans every matching row in the current shared collection `0x006acd50/0x006acd4c`, updates each row's timing or countdown fields, derives three local scalar deltas through `0x0045a280`, accumulates those deltas into two caller-facing triplets, optionally subtracts keyed anchor-delta corrections through `0x0045a700`, and finally republishes the finished triplets through `0x0052e8b0` and `0x00530720`. Current grounded caller is the shared 15-tick service loop at `0x0045ade0`, so this is the safest current owner for per-owner anim-record service and triplet republish rather than a constructor or generic transform helper.","objdump + local disassembly + global-state correlation + shared-collection correlation + triplet-publish correlation"
0x0045ade0,158,placed_structure_specialization_service_shared_anim_record_list_in_15_tick_windows,map,cdecl,inferred,objdump + local disassembly + global-state correlation,2,"Shared service loop for the `%1_Anim.3dp` transient list rooted at `0x006acd5c`. On first entry it seeds the current tick cursor `0x006acd60` from `[0x006cec78+0x15]`; thereafter it marks reentrancy latch `0x006acd58 = 1`, advances the cursor in `0x0f`-tick windows until it catches the current world tick, and for every linked record whose owner pointer at `[record+0xf0]` is live it dispatches the heavier per-record service body at `0x0045a9c0(owner, cursor, 0)`. Once the cursor catches the current tick it clears the latch again. Current evidence is strongest for a windowed shared anim-record service loop rather than another global constructor or teardown helper.","objdump + local disassembly + global-state correlation + shared-list correlation"
0x0045ae80,206,placed_structure_specialization_load_shared_anim_payload_root_if_percent1_anim_present,map,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Bootstrap side for the shared `%1_Anim.3dp` payload root used by the specialization animation-record family. The helper formats literal `%1_Anim.3dp`, probes the named-bank owner `0x006d4020` through `0x0053c930`, resolves the matched entry handle through `0x0053b5c0`, queries its payload length through `0x0053c9c0`, reads the raw bytes through `0x0053bd40`, copies them into a fresh heap buffer through `0x0053b7c0`, and lazily allocates the intrusive list root `0x006acd5c` when it does not already exist. On success it returns the loaded payload buffer; otherwise it returns null. Current grounded caller is the specialization build pass at `0x0045b760`, so this is the safest current read for `%1_Anim.3dp` payload-root bootstrap rather than a generic bank read helper.","objdump + local disassembly + literal inspection + named-bank correlation + shared-list correlation"
0x0045af50,232,placed_structure_specialization_bind_shared_anim_row_collection_and_prune_owner_active_records,map,thiscall,inferred,objdump + local disassembly + global-state correlation,2,"Shared collection bind or reset helper for the same `%1_Anim.3dp` transient family. The helper clears globals `0x006acd44/48/54`, publishes the caller row collection into `0x006acd50`, computes the current row-data base into `0x006acd4c`, and scans every row header to mirror the last seen row selector into `0x006acd44` while releasing any oversize selector root through `0x00475100` when the per-row count exceeds `0x0f`. It then walks the intrusive active list rooted at `0x006acd5c`, removes every linked record whose owner pointer at `[record+0xf0]` matches the current collection owner, and frees the list root itself when the list becomes empty. Current grounded callers are the specialization release and rebuild family around `0x0045b160`, so this is the safest current read for shared anim-row collection bind plus owner-prune rather than a generic destructor.","objdump + local disassembly + global-state correlation + shared-list correlation + collection-bind correlation"
0x0045b040,11,placed_structure_specialization_demote_to_base_vtable_and_tail_into_common_cleanup,map,thiscall,inferred,objdump + caller correlation,2,"Tiny specialization-to-base cleanup thunk. The helper overwrites the current vtable with base table `0x005cb4c0` and then tails directly into the common placed-structure cleanup path at `0x00455650`. Current grounded callers are the specialization teardown wrappers at `0x0040c970` and `0x0045b160`, so this is the safest current read for a direct demote-to-base cleanup leaf rather than another constructor or publish helper.","objdump + caller correlation + vtable-demotion correlation"
0x0045b050,86,placed_structure_specialization_reset_payload_and_transient_fields_and_optionally_clear_base_state,map,thiscall,inferred,objdump + local disassembly + field correlation,2,"Small reset helper for the concrete placed-structure specialization. The function clears payload roots `[this+0x23e]` and `[this+0x242]`, transient handles `[this+0x246]`, `[this+0x24a]`, and `[this+0x24e]`, resets `[this+0x262] = -1`, zeroes timer or state fields `[this+0x266]` and `[this+0x26a]`, clears the packed flag band at `[this+0x23a..+0x23d]`, and when the caller argument is nonzero it re-enters the common placed-structure clear path at `0x00455610`. This is the safest current read for specialization field reset plus optional base-state clear rather than another constructor or destructor thunk.","objdump + local disassembly + field correlation + specialization-family correlation"
0x0045b0b0,53,placed_structure_specialization_publish_integer_triplet_to_owner_and_primary_transient_if_live,map,thiscall,inferred,objdump + local disassembly + field correlation,2,"Small publish-side helper in the same concrete placed-structure specialization family. The function forwards one caller-supplied integer triplet plus fixed mode `1` through `0x0052e680` on the specialization owner itself, then repeats the same publish into the primary transient handle `[this+0x246]` when that handle is live. Current evidence is strongest for one integer-triplet publish leaf shared by the owner and its primary transient rather than a builder or teardown helper.","objdump + local disassembly + field correlation + triplet-publish correlation"
0x0045b0f0,23,placed_structure_specialization_forward_packed_rgb_triplet_into_vtable_slot_0x58,map,thiscall,inferred,objdump + local disassembly,2,"Tiny packed-color forwarder in the concrete placed-structure specialization family. The helper splits one caller-supplied packed dword into its low, middle, and high bytes and dispatches those three components through vtable slot `+0x58` on the current object. Current evidence is only strong enough for a packed RGB-triplet forwarder, not a stronger user-facing semantic name.","objdump + local disassembly + packed-byte-split correlation"
0x0045b110,5,placed_structure_specialization_tail_into_shared_world_anchor_triplet_publisher,map,thiscall,inferred,objdump + caller correlation,2,"Tiny tail-call wrapper into `runtime_object_publish_world_anchor_triplet_from_normalized_xy_and_height_bias` `0x00455660`. Current grounded callers are the nearby specialization-side rebuild and refresh branches, so this is safest as a direct wrapper into the shared world-anchor triplet publisher rather than as a distinct geometry owner.","objdump + caller correlation + world-anchor-wrapper correlation"
0x0045b120,64,placed_structure_specialization_publish_small_payload_record_from_arg_string,map,thiscall,inferred,objdump + local disassembly + allocator correlation,2,"Small specialization-side publisher beneath the concrete placed-structure table `0x005c8c50`. The helper allocates a fixed `0x35`-byte record through `0x0053b070`, populates that record from the caller-supplied string plus `this` through `0x00553ac0`, and then forwards the resulting pointer into `0x0052d9a0`; on allocation failure it forwards `null` through that same sink. Current local evidence grounds the fixed-size allocation and the arg-string forwarding, but not the exact semantic role of the published record, so this note stays at the payload-record level.","objdump + local disassembly + allocator correlation + specialization-table correlation"
0x0045b160,176,placed_structure_specialization_release_transient_handles_and_payload_strings,map,thiscall,inferred,objdump + local disassembly + field-release inspection,3,"Release-side cleanup helper in the concrete placed-structure specialization family. The function sets bit `0` in `[this+0x23a]`, clears `[this+0x24a]`, conditionally tears down the transient handles rooted at `[this+0x256]`, `[this+0x25a]`, `[this+0x25e]`, and `[this+0x24e]` through `0x0045af50`, `0x00475100`, and `0x00418d40`, then re-enters vtable slot `+0x78`, the common placed-structure cleanup slice `0x00455d20`, and finally frees the two payload strings rooted at `[this+0x23e]` and `[this+0x242]` through `0x0053aff0`. This is the strongest current owner for releasing the specialization's transient handles and payload strings rather than a base destructor.","objdump + local disassembly + field-release inspection + cleanup-chain correlation"
0x0045b210,352,placed_structure_specialization_build_ambient_transient_from_candidate_payload,map,thiscall,inferred,objdump + local disassembly + string correlation,2,"Transient-build helper beneath the concrete placed-structure specialization table `0x005c8c50`. The function requires a live candidate through vtable slot `+0x80`, formats one payload string around the literal `amb_%1_01.wav` through `0x00518de0`, allocates a `0x141`-byte transient object through `0x0053b070`, initializes that object through `0x00554830`, `0x00554340`, and `0x00554450`, stores the result at `[this+0x24a]`, and registers it through `0x0052da00`. The `amb_%1_01.wav` literal grounds this as one ambient-side transient builder, but not the exact user-facing subtype name of the owning specialization.","objdump + local disassembly + string correlation + transient-build correlation"
0x0045b5f0,123,placed_structure_specialization_refresh_ambient_transient_from_current_world_position,map,thiscall,inferred,objdump + local disassembly + world-position correlation,2,"Ambient-transient refresh helper for the same concrete placed-structure specialization. The function resolves the current local position through `0x0052e720`, converts that position through the world or view helpers `0x0051f090` and `0x00534490`, then forwards the derived scalar plus one caller-supplied argument into `placed_structure_specialization_build_ambient_transient_from_candidate_payload` `0x0045b210`. When the resulting ambient transient at `[this+0x24a]` is live it immediately re-enters `0x005543f0(0)`. Current evidence grounds this as a refresh of the ambient-side transient from current world position rather than the primary transient-handle builder.","objdump + local disassembly + world-position correlation + ambient-transient correlation"
0x0045b6f0,694,placed_structure_specialization_rebuild_named_variant_descriptors_and_effect_handles,map,thiscall,inferred,objdump + local disassembly + string-table correlation,2,"Large subtype-specific rebuild helper beneath the concrete placed-structure specialization table `0x005c8c50`. The function first clears the optional handles at `[this+0x25a]` and `[this+0x25e]`, then builds and probes multiple named variant families rooted in `[this+0x23e]` through format strings such as `%1_`, `%1_Upgrade1`, `%1_Anim%2.3dp`, `%1_Upgrade1Anim%2.3dp`, and `%1_Upgrade1Light%2.3dp`. It loops over numbered variants `1..0xfe`, probes resource existence through `0x0053c930`, materializes follow-on records through `0x00530640`, publishes them through `0x0052d8a0`, and couples the ambient-side refresh path through `placed_structure_specialization_refresh_ambient_transient_from_current_world_position` `0x0045b5f0` plus the ambient builder `0x0045b210`. The exact subtype semantics remain open, but this is now the strongest current owner for rebuilding the specialization's named animation, light, and sibling effect descriptors rather than a generic serializer-side helper.","objdump + local disassembly + string-table correlation + descriptor-rebuild correlation"
0x0045b760,583,placed_structure_specialization_build_base_or_upgrade_variant_descriptors_emitters_and_anim_records,map,thiscall,inferred,objdump + local disassembly + literal inspection,2,"Broader specialization-side builder beneath the same `0x005c8c50` family. The helper first scans one base-or-upgrade descriptor family rooted in `[this+0x23e]` through `%1_` or `%1_Upgrade1`, probing each numbered variant through `0x0053c930` and dispatching every accepted hit through vtable slot `+0x7c`. It then builds the matching attached-emitter list through `placed_structure_build_attached_emitter_variant_list_by_owner_stem` `0x0045e940`, ensures transient root `[this+0x256]` exists through `0x0045ae80`, and finally scans one animation family through `%1_Anim%2.3dp` or `%1_Upgrade1Anim%2.3dp`, materializing each accepted hit into a `0x206` record through `0x00530640`, publishing that record through `0x0052d8a0`, hashing the generated name through `0x0053d810`, and forwarding the result into `[this+0x256]` through `0x0045a7f0`. Current evidence is strongest for a base-or-upgrade descriptor, emitter, and animation-record build pass rather than a serializer or teardown helper.","objdump + local disassembly + literal inspection + specialization-family correlation + transient-record correlation"
0x0045baf0,850,placed_structure_specialization_service_timed_anim_light_and_random_sound_variants,map,thiscall,inferred,objdump + local disassembly + string-table correlation + timer-field inspection,2,"Timed service or emission helper for the same concrete placed-structure specialization. The function updates the two timer-like fields `[this+0x26a]` and `[this+0x266]`, derives local world-grid and distance terms from `[this+0x1e2/+0x1e6/+0x1ea]`, gates on candidate availability through vtable slot `+0x80` and the nearby candidate-side workers `0x00411e10/0x00411e50`, and when the local timing and distance checks pass it formats one output around the literal `rnd_%1_%2.wav` together with the neighboring anim or light string family `%1_Anim%2.3dp`, `%1_Upgrade1Anim%2.3dp`, and `%1_Upgrade1Light%2.3dp`. The final dispatch goes through `0x00531e50` under owner `0x006d402c`. Current evidence is strongest for a timed anim, light, or random-sound variant service lane rather than another payload loader or steady-state scalar updater.","objdump + local disassembly + string-table correlation + timer-field inspection + random-sound correlation"
0x0045be50,768,placed_structure_specialization_service_runtime_scalar_and_transient_state,map,thiscall,inferred,objdump + local disassembly + field correlation,2,"Recurring runtime-service helper for the same concrete placed-structure specialization. The function consults transient handle `[this+0x256]`, site-side link `[this+0x75]`, scenario globals under `0x006cec78`, and the iterator pair `0x00556ef0/0x00556f00`; it then updates the derived scalar triplet `[this+0x22e]`, `[this+0x232]`, and `[this+0x236]`, republishes that triplet through `0x00530720`, and re-enters `0x0052e8e0` for the final side-effect. The exact high-level behavior remains open, but the field ownership is strong enough to ground this as the runtime scalar and transient-state service slice for the specialization rather than another serializer or constructor.","objdump + local disassembly + field correlation + service-loop correlation"
0x0045c150,448,placed_structure_specialization_load_payload_and_rebuild_transients,map,thiscall,inferred,objdump + local disassembly + serializer-tag correlation,3,"Primary payload-loader counterpart to `0x0045b560` in the concrete placed-structure specialization family. The helper reseeds the derived field band `[this+0x23a..+0x26a]`, re-enters the common placed-structure initializers `0x00455610` and `0x00455fc0`, opens the derived payload bracket tagged `0x5dc1`, reads two string-like payload fields through `0x00531380`, copies them into `[this+0x23e]` and `[this+0x242]` via `0x0051d820`, clears the transient handle roots `[this+0x24e]`, `[this+0x256]`, `[this+0x25a]`, and `[this+0x25e]`, rebuilds follow-on specialization state through `0x0045b5f0` and `0x0045b6f0`, conditionally dispatches vtable slot `+0x74`, reads back `[this+0x24e]` and `[this+0x252]`, and finally closes the bracket tagged `0x5dc2`. This is now the strongest current owner for specialization payload load plus transient rebuild rather than a generic stem-refresh helper.","objdump + local disassembly + serializer-tag correlation + transient-rebuild correlation"
0x0045c310,176,placed_structure_specialization_build_primary_transient_handle_from_payload_strings,map,thiscall,inferred,objdump + local disassembly + field correlation,2,"Specialization-side transient builder rooted in payload strings `[this+0x23e]` and `[this+0x242]`. The helper formats one payload around the literal family at `0x005cb5d4`, allocates a `0x23a`-byte object through `0x0053b070`, initializes it through `0x00456100`, stores the handle at `[this+0x246]`, registers it through `0x00530720`, re-enters `0x0045b6f0(1)`, forwards the handle into `0x0052d8a0`, and when the current placed structure is active through `0x004557f0` it also dispatches vtable slot `+0x5c`. This is the strongest current owner for the primary specialization transient-handle build path rather than the ambient-side `[this+0x24a]` builder.","objdump + local disassembly + field correlation + transient-build correlation"
0x0045c3c0,160,placed_structure_specialization_release_primary_transient_handle_and_siblings,map,thiscall,inferred,objdump + local disassembly + field-release inspection,2,"Release-side companion to `0x0045c310`. When `[this+0x246]` is live the helper re-enters `0x00455d20`, iterates the linked transient family through `0x00556ef0/0x00556f00`, destroys every sibling object except the current `[this+0x246]` through `0x00530680` and `0x0053b080`, conditionally re-enters `0x0045b6f0(0)` when bit `0` in `[this+0x23a]` is clear, then destroys `[this+0x246]` through `0x00455650`, frees it, clears the field, and tails into `0x005570b0`. Current evidence grounds this as the primary transient-handle release path for the specialization rather than another base cleanup thunk.","objdump + local disassembly + field-release inspection + transient-release correlation"
0x0045cc90,677,train_visual_toggle_three_selector_effect_slots_and_reseed_shared_anchors,map,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Paired build-or-release owner for three selector-driven effect slots stored at `[table+0x34]`, `[table+0x38]`, and `[table+0x3c]` inside the train visual row table rooted at `[this+0x316]`. In build mode `arg0 == 1`, the helper derives one mode scale from current local geometry, allocates selector `1`, `2`, and `3` bundles through `0x00475ed0`, writes those handles into the three table fields, reseeds their shared anchors through `0x00475010/0x00475030`, and then enables every live attached emitter in the main row-object list by writing byte `1` into `[emitter+0x1d8]`. In release mode it tears those same three slot handles down through `0x00475100`, clears the table fields, and disables the same emitter list by writing byte `0` into `[emitter+0x1d8]`. Current grounded callers include the train visual-family teardown `0x0045e3d6` and later world-side service branches `0x004ad841` and `0x004b1944`, so this is best read as the shared three-slot train-effect toggle rather than a generic emitter helper.","objdump + local disassembly + caller inspection + train-visual correlation + effect-slot correlation"
0x0045cf40,224,train_visual_toggle_selector5_effect_slot_and_row_emitter_enable_state,map,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Sibling build-or-release owner for the selector-`5` effect slot stored at `[table+0x40]` inside the same train visual row table rooted at `[this+0x316]`. In build mode `arg0 == 1`, the helper derives one mode scale from current local geometry, allocates selector `5` through `0x00475ed0`, stores that handle into `[table+0x40]`, and then enables every live emitter in the main row-object list by writing byte `1` into `[emitter+0x1d8]`. In release mode it tears that one slot down through `0x00475100`, clears `[table+0x40]`, and disables the same emitter list by writing byte `0` into `[emitter+0x1d8]`. Current grounded callers include the train visual-family teardown `0x0045e3de` and later world-side service branches `0x004ab942`, `0x004adaa1`, and `0x004b18d6`, so this is best read as the selector-`5` sibling toggle for the train visual family rather than another generic emitter-slot wrapper.","objdump + local disassembly + caller inspection + train-visual correlation + effect-slot correlation"
0x0045d130,176,train_effect_attach_named_handle_by_owner_profile_and_register,map,thiscall,inferred,objdump + local disassembly + literal inspection + caller inspection,2,"Builds and registers one named train-effect handle beneath the adjacent train-side transient family. The helper first resolves one owner-side profile through the collection at `0x006ada84`, allocates a `0x141`-byte object through `0x0053b070`, and initializes it through `0x00554830` using one mode-selected stem from the small selector at `0x0045d22e`, the caller's owner and anchor parameters, and one fixed mode byte `1`. It then writes two fixed float-like parameters through `0x00554340` and `0x00554450`, stores the live handle at `[this+0x336]`, and finally forwards that handle into `0x0052da00`. Current grounded caller is the broader train-side effect builder at `0x0045e375`, so this is best read as the shared attach-and-register builder for one named train effect handle rather than a generic pool allocation stub.","objdump + local disassembly + literal inspection + caller inspection + train-effect correlation"
0x0045d260,120,train_effect_update_live_handle_rate_distance_and_optional_mode,map,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Updates one previously attached train-effect handle stored at `[this+0x336]`. When that handle is live, the helper queries one current scalar through `0x00554230`, multiplies it by the caller float, clamps the result into `0x1f40..0xac44`, writes the clamped value through `0x005542c0`, pushes the caller gain through `0x00554450`, and when the live handle mode at `[handle+0x138]` equals `1` also forwards zero through `0x005543f0`. Current grounded caller is the later world-side service path at `0x004a8cf9`, so the safest current read is a live train-effect parameter updater rather than a constructor.","objdump + local disassembly + caller inspection + handle-parameter correlation"
0x0045d2e0,451,train_effect_refresh_breakdown_or_burning_sound_handle,map,thiscall,inferred,objdump + local disassembly + literal inspection + caller inspection,2,"Owns the sound-side branch above the adjacent train-effect handle helpers. The function first republishes the current world anchor triplet through `0x0052e720`; when an attached sound handle already exists at `[this+0x346]` it updates that live handle's anchor fields `[+0x10/+0x14/+0x18]` through `0x00531ef0` and marks flag bit `0x02`. Otherwise it selects one sound stem according to the current train-state latches `[this+0x33a/+0x33e/+0x342]`: fixed `Train_Burning.wav`, fixed `Train_Breakdown_loop.wav`, or one dynamic stem from the table at `0x005f3a84` after the `0x0041b8f0 -> 0x004a8840` branch. It then creates a fresh sound handle through `0x00531e50`, stores it into `[this+0x346]`, sets fixed flag bits `0x18`, seeds two scale fields from the chosen mode factor through constants at `0x005c8c48` and `0x005cb698`, and finally clears the three state latches again. Current grounded caller is the train-side world service branch at `0x004acf5d`, so this is best read as the breakdown-or-burning train sound-handle refresh owner rather than another generic transient setter.","objdump + local disassembly + literal inspection + caller inspection + train-effect correlation + sound-handle correlation"
0x0045d4b0,1684,train_visual_preload_variant_tables_and_service_point_body_handles,map,thiscall,inferred,objdump + local disassembly + literal inspection + caller inspection,2,"Large train-side preload owner above the adjacent sound and handle helpers. The function optionally clears prior state through `0x00455610`, copies the caller primary and secondary stems into `[this+0x32e]` and `[this+0x332]`, probes the named-bank owner `0x006d4020` for the secondary stem, then falls back through the primary stem and the suffixed `_C.tga` form at `0x005cb7e8`. It resolves one `ServicePoint.3dp` payload into `[this+0x23e/+0x23a]`, one `Body.3dp` payload into `[this+0x242/+0x246]`, counts existing `%1_Truck%2.3dp` variants into `[this+0x31a]`, allocates the larger per-variant table at `[this+0x316]`, and then enters the later subloops that populate the cargo-icon, bogie, drivewheel, piston, connecting-rod, coupling-bar, body, and track-point bands. Current grounded callers are the train-side setup or refresh branches at `0x0041ce2f`, `0x0042acc6`, and `0x0045e653`, so this is best read as the train visual variant-table and service-point or body preload owner rather than a small local helper.","objdump + local disassembly + literal inspection + caller inspection + train-visual correlation + variant-table correlation"
0x0045e390,415,train_visual_release_sound_handle_variant_table_and_payload_strings,map,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Release-side owner for the same train visual family. The helper drops the optional sound handle `[this+0x346]` through `0x00531ef0` plus the mode-gated `0x005317b0` path, clears the live train-effect handle root `[this+0x336]` by re-entering `0x0045cc90(0)` and `0x0045cf40(0)`, iterates the variant table at `[this+0x316]` to free per-row pointer arrays, the two per-row heap buffers at offsets `+0x98/+0x9c`, and any nested owned list rooted at `[row+0x0c]->[+0x75]`, then frees the main table itself and finally releases the two payload strings at `[this+0x32e]` and `[this+0x332]`. Current grounded caller is the train-side teardown branch at `0x0042ac49`, so this is best read as the train visual-family release owner rather than another generic destructor.","objdump + local disassembly + caller inspection + train-visual correlation + teardown correlation"
0x0045e530,855,train_visual_load_payload_rebuild_variant_table_and_optional_child_records,map,thiscall,inferred,objdump + local disassembly + serializer-tag correlation + local disassembly,2,"Load-side owner for the same train visual family. The helper clears the current table and string roots, opens bundle tags `0x61a9` and `0x61aa` through `0x00531360`, reads two variable-length heap strings through `0x00531380`, optionally rewrites the first caller string by scanning the live collection at `[0x006d4020+0x429b8]`, then rebuilds the train visual family through `train_visual_preload_variant_tables_and_service_point_body_handles` `0x0045d4b0` with unit scale `1.0f`. After that it republishes the early per-row handles through `0x005548d0`, frees the temporary heap strings, and when scenario latch `[0x006cec78+0x46c34] > 0x2585` is true it enters the optional child-record branch under tag `0x61b2`, dispatching vtable slot `+0x48` across the rebuilt row collection before closing tag `0x61ab`. This is the clearest current load-side owner for the train visual payload plus optional child-record branch rather than another small table helper.","objdump + local disassembly + serializer-tag correlation + train-visual correlation + load-branch correlation"
0x0045e8c0,124,train_visual_service_row_object_strip_and_optionally_refresh_selected_entry,map,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small service helper over the fixed 32-entry row-object strip rooted at `[this+0x277]`. The function first walks all 32 slots and, for every live row object pointer, dispatches vtable slot `+0x10`. When the caller passes a valid row index instead of `-1`, it then resolves that selected row again, dispatches vtable slot `+0x0c`, and when the paired per-row flag byte in the neighboring strip is nonzero it also pushes `0,0,1.0f,1.0f` through `0x0052eab0` on that selected row object. Current grounded callers are the two train-side update branches at `0x0041c680` and `0x0041c69a`, which derive the selected index from byte `[cargo+0x20]`, so this is best read as the row-object service plus optional selected-entry refresh helper rather than a generic list walk.","objdump + local disassembly + caller inspection + train-visual correlation + row-object-strip correlation"
0x004614d0,40,runtime_object_vtable_wrapper_query_local_companion_float_relief_score_at_rounded_coords,map,thiscall,inferred,objdump + local disassembly + wrapper correlation,2,"Tiny virtual-style wrapper over `world_query_local_companion_float_relief_score_at_cell_with_distance_and_mode_bias` `0x0044afa0`. It rounds the current object's normalized secondary and primary coordinates through `0x00455810`, `0x00455800`, and `0x005a10d0`, then forwards the resulting cell pair plus world root `0x0062c120` into `0x0044afa0`. Current evidence grounds it only as the table-local wrapper over the heavier world-scalar query, not the owning subtype name.","objdump + local disassembly + wrapper correlation + world-scalar-query correlation"
0x00461500,39,runtime_object_query_flag_byte_0x42_with_class0_true_fallback_when_mode_gate_inactive,map,thiscall,inferred,objdump + local disassembly + mode-gate correlation,2,"Small mode-gated flag query on the same virtual-family boundary as `0x004614d0`. The helper first checks shell mode gate `0x004338c0` on scenario root `0x006cec78`; when that gate is active it returns byte `[this+0x42]` directly. When the gate is inactive it returns literal `1` only for class-0 records with `[this+0x23e] == 0`, and otherwise falls back to the same byte `[this+0x42]`. Current evidence is strong enough only for that structural fallback rule, not for a tighter semantic name for the flag or owning subtype.","objdump + local disassembly + mode-gate correlation + field inspection"
0x00461650,120,map_load_geographic_label_database,map,cdecl,inferred,ghidra-headless,3,Loads the geographic-label database branch inside the broader reference-bundle setup. It stages resource ids 0x5209 through 0x520b binds the selected bundle through 0x517d90 iterates the loaded collection with 0x517cf0 0x518380 and 0x518140 and dispatches each record through vtable slot +0x44 using the current map path context.,ghidra + rizin + llvm-objdump + strings
0x00461c00,126,locomotive_collection_resolve_entry_by_primary_or_alias_stem,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shared string resolver over the live locomotive collection at `0x006ada84`. The helper walks every live locomotive row, first compares the caller text against the primary stem at `[entry+0x34]`, then against the alias or secondary stem at `[entry+0x53]`, and returns the first matching live row pointer through the collection accessors `0x00518380/0x00518140`. Failure returns null. Current grounded caller is the cheat-code owner `0x00437d70`, where selector `4` resolves stems like the hidden locomotive cheat aliases before applying them to every train owned by the selected company through `0x004aefb0`. This is therefore the safest current read for the primary-or-alias locomotive stem resolver rather than a more specific dialog helper.","objdump + local disassembly + caller inspection + locomotive-stem correlation + cheat-branch correlation"
0x00461c80,30,locomotive_entry_query_linked_era_name_ptr,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small accessor over one live locomotive entry. The helper resolves linked era id `[loco+0x72]` through the era collection at `0x0062ba88` and, on success, returns the raw era-name pointer at `[era+0x45]`; missing era ids return null. Current grounded callers are the locomotives-availability and recipe-side editor families around `0x004cd641`, `0x004cdaf2`, `0x004cf16c`, `0x004cf1f2`, `0x004cf2ed`, `0x004cf3f0`, the world-entry rehydrate lane at `0x004478de`, and the smaller shell-side branch at `0x00438d5f`, so this is the safest current read for the linked-era name-pointer accessor rather than a display-only helper.","objdump + local disassembly + caller inspection + era-collection correlation + locomotive-editor correlation"
0x00461ca0,35,locomotive_entry_format_linked_era_name_or_null,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Formatting companion to `locomotive_entry_query_linked_era_name_ptr` `0x00461c80`. The helper resolves linked era id `[loco+0x72]` through the same era collection at `0x0062ba88` and, on success, forwards the era-name pointer `[era+0x45]` into `0x0051c920`; missing era ids return null. Current grounded callers are the train-upgrade news formatter `0x00409300` and the neighboring company-side upgrade branch at `0x00409903`, where it supplies the old and new locomotive-era display names embedded in localized news id `2897`.","objdump + local disassembly + caller inspection + era-name formatting correlation + train-upgrade-news correlation"
0x00461cd0,298,locomotive_collection_select_best_era_matched_non_electric_fallback_id,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + engine-type correlation,2,"Fallback locomotive chooser beneath `company_select_preferred_available_locomotive_id` `0x004078a0`. The helper walks the live locomotive collection, explicitly skips records whose engine-type dword `[record+0x10]` is `2`, and then scores the remaining records from the linked era record at `[record+0x72]`: the current grounded score uses the absolute distance from the current scenario year to the era start field `[era+0x105]`, adds `500` when the era has not started yet, adds `50` when the current year has passed the era-end field `[era+0x109]`, and adds `2000` when the linked approval helper `0x0041d550` rejects the era or engine family for the current context. The lowest-penalty locomotive id wins, so the current best read is an era-matched non-electric fallback rather than a general preferred-locomotive chooser. Current grounded caller is `company_select_preferred_available_locomotive_id` `0x004078a0`.","objdump + caller xrefs + callsite inspection + engine-type correlation + fallback-choice correlation"
0x00461e00,262,locomotive_collection_refresh_runtime_availability_overrides_and_usage_state,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Collection-wide runtime refresh over the live locomotive pool at `0x006ada84`. The helper guards itself with reentrancy latch `0x006ada88`, walks every live locomotive record, resolves the linked era record through `[loco+0x72]`, and combines the locomotive-side requirement bytes `[loco+0x30/+0x31/+0x32]` with the active scenario-state availability toggles at `[0x006cec78+0x4c97..+0x4c99]`. When the current locomotive or its linked era passes those gates it upserts one boolean availability override through `scenario_state_upsert_named_locomotive_availability_record_and_refresh_runtime_usage` `0x004350b0`; it then immediately queries the resulting named override through `scenario_state_query_named_locomotive_availability_record_value` `0x00435030` and stores that value into `[loco+0x7b]`. When the collection sweep finishes it tails into `0x00436af0` to rebuild the dependent locomotive-side scalar band. Current grounded callers are the world-entry rehydrate tail inside `world_entry_transition_and_runtime_bringup` `0x00443a50` and the startup or restore-side upsert family that also re-enters this helper through `0x004350b0`, so this is the safest current read for the collection-wide locomotive runtime-availability refresh rather than a single dialog-owned toggle helper.","objdump + caller xrefs + local disassembly + locomotive-availability correlation + scenario-state override correlation + reentrancy-latch correlation"
0x00464410,12679,shell_dispatch_ui_command,shell,cdecl,inferred,ghidra-headless,4,Large shell UI command dispatcher reached from shell-side event callbacks and direct command pushes. It switches over many command ids including 0x7530 through 0x7532 graphics-preset commands that route into 0x0051ebc0 0x00484590 and 0x004853c0; 0x7533 through 0x7534 TigerTank viewer actions; and 0x7540 through 0x7543 scenario-text report build and batch-processing commands that route into 0x00489830 0x004886e0 and 0x00489a20.,ghidra + rizin + llvm-objdump + strings
0x00474030,167,city_database_entry_build_mode_selected_anchor_helper_from_triplet,map,cdecl,inferred,objdump + caller xrefs + local disassembly + city-database family correlation,2,"Small helper-object builder beneath the current city-database entry family. The function switches over caller-supplied mode enum `0..10`, maps those cases into `0x00475ed0` with selector families `4`, `0xd`, or `0xe` plus fixed scalar constants `0.5`, `0.75`, `1.0`, `1.5`, or `2.0`, and when helper allocation succeeds it publishes the caller-supplied world triplet through the helper-owned pointer at `[helper+0x4]` via `0x00530720`. Current grounded callers are `0x004741ac` during constructor-side setup and `0x004742bd` during refresh, so this is now the strongest current read for the mode-selected anchor-helper builder rather than a generic effect allocator.","objdump + caller xrefs + local disassembly + city-database family correlation + helper-builder correlation"
0x00474110,32,city_database_entry_initialize_stack_temporary_entry,map,thiscall,inferred,objdump + caller xrefs + local disassembly + city-database family correlation,2,"Tiny temporary-entry initializer in the city-database entry family. The helper re-enters shared base initializer `0x00455b20`, clears helper fields `[this+0x23a]` and `[this+0x242]`, installs vtable `0x005ce428`, and returns `this`. Current grounded callers are the stack-local temporary-entry paths at `0x004744ae` and `0x004745ae`.","objdump + caller xrefs + local disassembly + city-database family correlation + temp-entry correlation"
0x00474130,195,city_database_entry_construct_from_id_coords_mode_and_default_triplet,map,thiscall,inferred,objdump + caller xrefs + local disassembly + city-database family correlation,2,"Primary constructor beneath the current city-database entry family. The helper stores the caller-supplied entry id into `[this+0x23e]`, clears the trailing helper payload block at `[this+0x246..+0x24e]`, stores the caller-supplied mode into `[this+0x242]`, derives one world-height scalar from the supplied coordinate pair through `0x00448bd0`, builds helper field `[this+0x23a]` through `city_database_entry_build_mode_selected_anchor_helper_from_triplet` `0x00474030`, and then seeds the remaining default scalar or flag tuple through `0x00455b70` using the fixed default bundle at `0x005ce49c/0x005ce4a0/0x005ce4a4`. Current grounded caller is the live-entry allocator `0x004744ed`.","objdump + caller xrefs + local disassembly + city-database family correlation + constructor correlation"
0x00474260,111,city_database_entry_reload_payload_and_refresh_mode_selected_anchor_helper,map,thiscall,inferred,objdump + caller inspection + local disassembly + city-database family correlation,2,"Refresh-side helper in the current city-database entry family. The function first re-enters `0x00455fc0` on the caller-supplied payload stream, then samples the entry's normalized secondary and primary coordinates through `0x00455810` and `0x00455800`, derives one world-height scalar through the world helper `0x00448bd0`, rebuilds helper field `[this+0x23a]` through `city_database_entry_build_mode_selected_anchor_helper_from_triplet` `0x00474030` using mode `[this+0x242]`, and returns the status from the earlier `0x00455fc0` reload. Current evidence is strongest for a payload reload plus mode-selected anchor-helper refresh rather than a generic constructor.","objdump + caller inspection + local disassembly + city-database family correlation + helper-refresh correlation"
0x004743d0,42,city_database_entry_release_mode_selected_anchor_helper_and_base_payload,map,thiscall,inferred,objdump + caller xrefs + local disassembly + city-database family correlation,2,"Release-side helper in the current city-database entry family. The function destroys helper field `[this+0x23a]` through `0x00475100` when live, clears that field, restores the base vtable tag at `[this] = 0x005ce428`, and then tails into base cleanup `0x00455650`. Current grounded callers are the temporary-entry teardown inside `0x004744f6` and the collection load loop at `0x004745d0`, so this is the safest current read for releasing the mode-selected anchor helper plus base payload state.","objdump + caller xrefs + local disassembly + city-database family correlation + release-path correlation"
0x00474400,36,city_database_entry_release_mode_selected_anchor_helper_and_dynamic_payload,map,thiscall,inferred,objdump + caller xrefs + local disassembly + city-database family correlation,2,"Sibling release helper beside `0x004743d0`. It destroys helper field `[this+0x23a]` through `0x00475100` when live, clears the field, and then tails into `0x00455d20` rather than the smaller base cleanup at `0x00455650`. Current grounded caller is the collection removal path at `0x00474520`, so the safest current read is a release helper for mode-selected anchor helper plus the heavier dynamic-payload branch.","objdump + caller xrefs + local disassembly + city-database family correlation + removal-path correlation"
0x00474430,29,city_database_entry_query_mode_gate_or_runtime_flag_byte_0x42,map,thiscall,inferred,objdump + local disassembly + city-database family correlation,1,"Small city-database-entry-family predicate over byte `[this+0x42]`. When shell mode gate `0x004338c0` is inactive it returns literal `1`; otherwise it returns the current entry byte `[this+0x42]`. The exact player-facing meaning of that byte is still open, so the safest read is a mode-gated runtime-flag query.","objdump + local disassembly + city-database family correlation + mode-gate correlation"
0x00474450,39,city_database_entry_collection_construct_with_fixed_capacity_0x14,map,thiscall,inferred,objdump + caller xrefs + local disassembly + collection-layout correlation,2,"Constructor for the current city-database entry collection rooted at vtable `0x005ce4a8`. The helper resets collection state through `0x00517ce0`, installs vtable `0x005ce4a8`, and then initializes the collection through `0x00518570` with the fixed parameter tuple `(0, 0, 0, 0x14, 0x0a, 0, 0)`. Current grounded caller is the global collection bootstrap at `0x004487a9`, which stores the resulting pointer into `0x006cea50`.","objdump + caller xrefs + local disassembly + collection-layout correlation + bootstrap correlation"
0x00474480,18,city_database_entry_collection_release_and_free,map,thiscall,inferred,objdump + caller xrefs + local disassembly + collection-layout correlation,1,"Small destructor-side wrapper for the current city-database entry collection. The helper installs collection vtable `0x005ce4a8`, re-enters `0x00518600`, and then tails into `0x00518bd0`. Current grounded caller is the global teardown path at `0x004492c3`, which frees the collection rooted at `0x006cea50`.","objdump + caller xrefs + local disassembly + collection-layout correlation + teardown correlation"
0x004744a0,101,city_database_entry_collection_allocate_and_construct_entry,map,thiscall,inferred,objdump + local disassembly + caller xrefs + collection-layout correlation,2,"Shared allocator and constructor beneath the city-database entry collection. The helper initializes one stack-local temporary entry through `0x00474110`, allocates a `0x250`-byte live record through `0x00518900`, resolves that record through `0x00518140`, then constructs it through `0x00474130` with the caller-supplied entry id plus three caller arguments, and finally tears down the temporary entry through `0x004743d0`. Current grounded caller is the collection load or clone lane at `0x004744ed`.","objdump + local disassembly + caller xrefs + collection-layout correlation + temp-entry correlation"
0x00474510,32,city_database_entry_collection_remove_entry_by_id_and_release,map,thiscall,inferred,objdump + local disassembly + collection-layout correlation,2,"Small collection-side removal helper for the current city-database entry family. The function resolves the caller-supplied entry id through `0x00518140`, releases the resolved entry through `0x00474400`, and then removes the id from the collection through `0x00518a30`.","objdump + local disassembly + collection-layout correlation + removal-path correlation"
0x00474540,197,city_database_entry_collection_load_records_from_bundle_context,map,thiscall,inferred,objdump + caller xrefs + local disassembly + collection-load correlation,2,"Underlying collection-owned load loop beneath `map_load_city_database` `0x00474610`. The helper opens tag family `0x61a9/0x61aa/0x61ab` on the caller-supplied bundle, binds the selected path context through `0x00518680`, iterates every live record in the current collection, seeds a stack-local temporary entry through `0x00474110`, dispatches each record's vtable slot `+0x40` with the current bundle context, accumulates the returned byte count, tears the temporary entry down through `0x004743d0`, and finally closes tag `0x61ab`. Current grounded caller is the map-load branch at `0x00444834`, so this is now the safest current read for the collection-owned city-database record load loop.","objdump + caller xrefs + local disassembly + collection-load correlation + bundle-tag correlation"
0x00474610,120,city_database_entry_collection_reload_records_from_bound_bundle_context,map,cdecl,inferred,objdump + local disassembly + collection-load correlation,2,"Bundle-side reload owner for the live city-database entry collection. The helper opens tag family `0x61a9/0x61aa/0x61ab` on the caller bundle through `0x00531340`, binds the selected path or payload context into the collection through `0x00517d90`, walks every live record through `0x00517cf0/0x00518380/0x00518140`, and dispatches each record through vtable slot `+0x44` with the same bundle context before finally closing tag `0x61ab`. This is the strongest current read for the direct bundle-reload companion to the collection-owned load loop `0x00474540`, rather than a generic map-load stub.","objdump + local disassembly + collection-load correlation + bundle-tag correlation"
0x00474690,107,effect_emitter_table_publish_mode1_ratio_labels,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Walks the global emitter-definition table rooted at `0x006cea60` and, for each live entry whose mode dword `[entry+0x30]` equals `1`, derives one rounded ratio from float fields `[entry+0x00] / [entry+0x08]`, combines that with keyed field `[entry+0x34] | 0x10000` through `0x0053d810`, and forwards the resulting token into owner `0x006d4030` through `0x00556c50`. Current evidence grounds the iteration and derived ratio shape, but not the exact user-facing caption of the published label lane.","objdump + local disassembly + literal inspection + emitter-table correlation"
0x00474700,133,effect_table_load_particles_dat_into_global_root_and_register_particles_texture,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Reloads the global particle-data table from banked file `particles.dat`. The helper frees any previous root at `0x006cea5c`, checks for the named banked record through `0x0053c930`, resolves its keyed handle and payload length through `0x0053b5c0/0x0053c9c0`, allocates a new payload slab, reads that payload through `0x0053b7c0`, stores the resulting root at `0x006cea5c`, and finally registers literal `ParticlesTexture` through `0x00556370` on owner `0x006d4030`. This is the clearest current owner for the `particles.dat` load path rather than a generic banked-record fetch helper.","objdump + local disassembly + literal inspection + banked-record correlation + particle-table correlation"
0x00474790,133,effect_table_load_emitters_dat_into_global_root,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Reloads the global emitter-definition table from banked file `emitters.dat`. The helper frees any previous root at `0x006cea60`, checks for the named banked record through `0x0053c930`, resolves its keyed handle and payload length through `0x0053b5c0/0x0053c9c0`, allocates a new payload slab, reads that payload through `0x0053b7c0`, and stores the resulting root at `0x006cea60`. This is the clearest current owner for the `emitters.dat` load path rather than a generic banked-record fetch wrapper.","objdump + local disassembly + literal inspection + banked-record correlation + emitter-table correlation"
0x00474820,58,effect_emitter_table_find_entry_by_hashed_name,bootstrap,thiscall,inferred,objdump + local disassembly + literal inspection,2,"Hashes the caller-supplied NUL-terminated name through `0x0053d810(…,1)` and linearly scans the global emitter-definition table rooted at `0x006cea60` for the first entry whose leading dword matches that hash. On success it returns the matched entry root; otherwise `0`. Current grounded callers are the emitter-builder families at `0x00475420`, `0x00475550`, and their neighbors, where the names come from literal stems such as `steam`.","objdump + local disassembly + literal inspection + emitter-table correlation + hashed-name correlation"
0x00474860,257,effect_emitter_table_select_next_existing_formatted_3dp_variant,bootstrap,thiscall,inferred,objdump + local disassembly + literal inspection + caller inspection,2,"Selector-style iterator over the global emitter-definition table rooted at `0x006cea60`. When the caller passes `EDX = 1`, the helper resets global scan state `0x005f2c30` and row ordinal `0x006ceb94`; otherwise it resumes from that saved state. For each remaining emitter row it formats one candidate name into the local stack buffer through format string `%s%s%i.3dp` at `0x005ce4e8`, using the caller-supplied owner stem, the current row suffix at `[row+0x04]`, and the current ordinal. It then probes that formatted name through `0x0053c930`; on the first accepted variant it stores the chosen row root into `0x006cea90`, copies the formatted name into `0x006cea94`, advances the saved ordinal state, and returns `0x006cea90`. On exhaustion it restores the scan state to `(1,0)` and returns `0`. Current grounded caller is the attached-emitter build loop at `0x0045e940`, so this is best read as the formatted `*.3dp` variant enumerator above the emitter instantiator rather than a general banked-record lookup helper.","objdump + local disassembly + literal inspection + caller inspection + emitter-table correlation + formatted-variant correlation"
0x00474970,39,effect_handle_array_release_all_handles,bootstrap,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Linear release helper over one simple handle-array root whose live handle count sits at `[this+0x08]` and whose first handle pointer sits at `[this+0x0c]`. The helper forwards each live handle into `0x00554d50` and returns. Current grounded caller is the broader emitter-template teardown path at `0x00474db0`.","objdump + local disassembly + caller inspection + handle-array correlation"
0x004749a0,33,effect_name_matches_literal_steam,bootstrap,thiscall,inferred,objdump + local disassembly + literal inspection,1,"Tiny literal-compare predicate that tests the caller string at `[this+0x44]` against literal `steam` at `0x005ce4f4` through `0x005a57cf` and returns `1` only on an exact match.","objdump + local disassembly + literal inspection + string-compare correlation"
0x004749d0,653,effect_apply_emitter_definition_to_attached_sprite_handle,bootstrap,cdecl,inferred,objdump + local disassembly + caller inspection + table correlation,2,"Lower emitter-definition applicator beneath `effect_slot_create_attached_sprite_emitter` `0x00474e20`. The helper copies multiple scaled float bands and packed dword fields from the caller emitter-definition row into the target attached-emitter handle, seeds the handle transform or extent bands at `[handle+0x70..+0x90]` and `[handle+0xf0..+0x108]`, resolves the particle-data row named by the emitter definition through `0x0053d810` against the global `particles.dat` table rooted at `0x006cea5c` and mirrors that row into `[handle+0x10c..]`, applies several flag-sensitive scalar adjustments from definition fields `[+0xc0]` and `[+0xc8]`, and writes one referenced owner-side template or handle field into `[handle+0x1ac]`. Current grounded callers are the flagged emitter-template prebuild `0x00474c60` and the broader attached-emitter creator `0x00474e20`, so this is the safest current read for the concrete definition-to-handle materialization body rather than another table lookup or slot allocator.","objdump + local disassembly + caller inspection + emitter-table correlation + particle-table correlation + handle-layout correlation"
0x00474c60,114,effect_emitter_table_build_attached_emitter_templates_for_flagged_entries,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection + caller inspection,2,"Walks the global emitter-definition table rooted at `0x006cea60` and, for each live entry whose build-flag dword `[entry+0xb8]` equals `1`, hashes its inline name at `[entry+0x04]`, resolves or reuses one owner-side template through `0x00556ce0` on `0x006d4030`, mirrors emitter flags `[entry+0xbc] | 0x10004` into both that owner-side template and the later attached-emitter build call, and then creates the attached emitter through `effect_slot_create_attached_sprite_emitter` `0x004749d0` with scale `1.0f`. Current grounded caller is the global bootstrap path `0x00474ce0`, so this is the clearest current owner for the flagged emitter-template prebuild pass.","objdump + local disassembly + literal inspection + caller inspection + emitter-table correlation + bootstrap correlation"
0x00474ce0,195,effect_system_bootstrap_particle_tables_slot_pool_and_flagged_emitter_templates,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection + caller inspection,2,"Global bootstrap owner for the particle or emitter subsystem rooted at `0x006cea54..0x006cea98`. The helper reloads `emitters.dat` through `0x00474790`, reloads `particles.dat` through `0x00474700`, publishes current mode-`1` ratio labels through `0x00474690`, lazily allocates one pooled slot descriptor root of size `0x1c` at `0x006cea58`, allocates the backing slab `0x88b80` into `0x006cea54`, seeds that slab into the pooled descriptor through `0x0053dcf0(…,0x38,0x2710,1)`, clears the global linked-slot heads `0x006cea74/78/7c` and shared anchor globals `0x006cea68/6c/70/80/84/88`, marks latch `0x006ceb98 = 1`, rebuilds flagged emitter templates through `0x00474c60`, and finally publishes enable state `1` through owner `0x006d4030` via `0x00556500`. This is the clearest current bootstrap owner for the grounded `particles.dat` and `emitters.dat` globals rather than another small table loader.","objdump + local disassembly + literal inspection + caller inspection + pooled-slot correlation + particle-table correlation + emitter-table correlation"
0x00474db0,112,effect_system_teardown_particle_tables_and_pooled_slot_root,bootstrap,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Global teardown companion for the same particle or emitter subsystem rooted at `0x006cea54..0x006cea60`. The helper frees backing slab `0x006cea54`, particle table root `0x006cea5c`, and emitter-definition table root `0x006cea60` through `0x005a1145`; then, when the pooled slot descriptor root `0x006cea58` is live, it resets that descriptor through `0x0053dcb0`, frees it through `0x0053b080`, and clears the global root. Current grounded callers include the emitter data reload family around `0x00474700/0x00474790`, so this is the clearest current owner for subsystem teardown rather than a slot-local release helper.","objdump + local disassembly + caller inspection + pooled-slot correlation + particle-table correlation + emitter-table correlation"
0x00474e20,336,effect_slot_create_or_clone_attached_sprite_emitter_from_definition_and_optional_owner_template,bootstrap,thiscall,inferred,objdump + local disassembly + caller inspection + table correlation,2,"Creates one attached sprite emitter from one emitter-definition row, either by cloning an owner-side template or by constructing a fresh runtime handle. The helper first seeds or allocates the optional `0x206` owner record when the caller did not supply one, strips high flag bits from `CargoMoney_DollarSign`, clears incoming flag bit `0x400` when definition gate `[def+0xb8]` is zero, and then takes one of two branches. When final flags still carry `0x400`, it hashes the definition name at `[def+0x04]` together with owner token `[def+0x84]`, resolves or reuses one owner-side template through `0x00556ce0` on `0x006d4030`, and uses that clone as the live emitter. Otherwise it derives one rounded scale index from `[def+0x88] / [def+0x90]`, allocates a fresh `0x1fd` emitter through `0x0053b070`, constructs it through `0x00556920`, and then materializes the definition fields into that handle through `effect_apply_emitter_definition_to_attached_sprite_handle` `0x004749d0`. On success it publishes the created emitter through `0x0052d950`, stores the owner definition pointer into `[emitter+0x60]`, and when the final flags carry `0x02000000` it forces persistent flag dword `[emitter+0xbc] = 1`. Current grounded callers are the slot builders under `0x004752d0..0x00475e30` plus the owner-stem loop at `0x0045e940`, so this is the safest current owner for attached sprite-emitter creation or clone selection rather than a generic slot helper.","objdump + local disassembly + caller inspection + emitter-table correlation + template-clone correlation + handle-construction correlation"
0x00474f70,112,effect_slot_service_emitters_or_all_globally_linked_slots_with_update_mode_zero,bootstrap,thiscall,inferred,objdump + local disassembly + global-list correlation,2,"Shared update sweep for attached sprite emitters. When the caller supplies one slot container, the helper iterates that slot's live emitter pointer band `[slot+0x0c..]` and dispatches each emitter through `0x00555e50(0)`. When the caller passes null instead, it walks the global linked slot list rooted at `0x006cea74` and runs the same per-emitter `0x00555e50(0)` sweep across every linked slot. This is the clearest current owner for the common emitter service pass rather than just another slot-local iterator.","objdump + local disassembly + global-list correlation + emitter-slot correlation"
0x00474fe0,38,effect_slot_write_emitter_flag_dword_to_all_emitters,bootstrap,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small per-slot flag writer over the attached-emitter container. The helper iterates every live emitter pointer in `[this+0x0c..]` and writes the caller-supplied dword from `EDX` directly into each emitter's flag field `[emitter+0xbc]`. Current grounded callers are the placed-structure transient rebuild branches `0x0040cf79`, `0x0040f137`, `0x0040f35c`, and the later world-side service path `0x004a87e8`, so this is best read as the shared emitter-flag broadcast helper rather than a fuller update pass.","objdump + local disassembly + caller inspection + emitter-slot correlation + flag-field correlation"
0x00475010,25,effect_slot_cache_shared_anchor_triplet,bootstrap,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Caches the caller-supplied world-anchor triplet into globals `0x006cea68`, `0x006cea6c`, and `0x006cea70`. Current grounded callers are the attached-emitter setup paths `0x0040cf00` and several higher emitter-slot builders starting at `0x004752d0`.","objdump + local disassembly + caller inspection + shared-triplet correlation"
0x00475030,101,effect_slot_apply_cached_shared_anchor_triplet_to_all_or_one_emitters,bootstrap,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Copies the cached triplet globals `0x006cea68/0x006cea6c/0x006cea70` into the per-emitter triplet band at `[emitter+0x1b0..+0x1b8]` for either all emitters in the current slot container or one selected emitter index. When the caller passes `-1` in `EDX`, the helper updates every live emitter pointer in `[this+0x0c..]`; otherwise it updates only the selected slot index. Current grounded callers include the placed-structure transient builder `0x0040cf00`.","objdump + local disassembly + caller inspection + shared-triplet correlation + emitter-slot correlation"
0x00475100,308,effect_slot_release_emitters_unlink_global_list_and_recycle_or_free_slot,bootstrap,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Release-side owner for one attached-emitter slot container. The helper walks any owner-side intrusive list reachable from `[this+0x04]->[+0x79]`, releasing matching attached emitters stored in `[this+0x0c..]` through the `0x00556ef0/0x00556f00/0x00556f20` sweep; when slot flag dword `[this+0x34] == 1` it also unlinks the current slot from the global linked list rooted at `0x006cea74/0x006cea78/0x006cea7c`. Finally it either recycles the slot into the pooled descriptor rooted at `0x006cea58` when the slot address falls inside that pool range or frees it directly through `0x0053b080`. Current grounded callers are the placed-structure and city-entry helper release paths at `0x0045b160`, `0x004743d0`, and `0x00474400`.","objdump + local disassembly + caller inspection + emitter-slot correlation + pooled-slot correlation"
0x00475240,108,effect_slot_set_emitter_enabled_state_for_all_or_one,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Toggles the per-emitter enable byte at `[emitter+0x1d8]` for either all emitters in the current slot container or one selected emitter index. When caller mode `EDX == 1`, the helper writes byte `0` to the selected emitters; otherwise it writes byte `1`. Passing index `-1` applies the update to every live emitter pointer in `[this+0x0c..]`. Current evidence is strongest for an enabled-state setter because the paired query `0x004752b0` reports true only when this byte stays zero.","objdump + local disassembly + emitter-slot correlation + enable-flag correlation"
0x004752b0,31,effect_slot_query_emitter_is_enabled_by_index,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Returns `1` when the selected emitter pointer in `[this+0x0c + index*4]` exists and its enable byte `[emitter+0x1d8]` is zero; otherwise returns `0`. This is the paired boolean query beside `effect_slot_set_emitter_enabled_state_for_all_or_one` `0x00475240`.","objdump + local disassembly + emitter-slot correlation + enable-flag correlation"
0x004752d0,340,effect_slot_construct_broken_down_steam_flame_and_crash_smoke_bundle,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a three-emitter slot bundle beneath the same pooled effect-slot family rooted at `0x006cea58`. After acquiring one slot container, the helper resolves emitter definitions `BrokenDown_Steam`, `FlamespoutB`, and `Crash_SmokeA` from the global emitter table `0x006cea60` through `effect_emitter_table_find_entry_by_hashed_name` `0x00474820`, creates three attached emitters through `effect_slot_create_attached_sprite_emitter` `0x00474e20`, stores those emitters into `[slot+0x0c/+0x10/+0x14]`, and sets slot count `[slot+0x08] = 3`. This is the clearest current owner for the named broken-down fire/steam/crash-smoke bundle rather than a generic slot allocator.","objdump + local disassembly + literal inspection + emitter-table correlation + named-bundle correlation"
0x00475420,302,effect_slot_construct_tier_selected_volcano_lava_and_black_smoke_bundle,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a two-emitter volcano bundle in the pooled effect-slot family rooted at `0x006cea58`. The helper first selects one literal pair from `Volcano_BlackSmoke1..4` plus `Volcano_Lava1..4` or the untiered `Volcano_BlackSmoke` plus `Volcano_Lava`, based on the caller float tier `0.5f`, `0.75f`, `1.0f`, `1.5f`, or `2.0f`; it then resolves those emitter definitions through `effect_emitter_table_find_entry_by_hashed_name` `0x00474820`, creates the black-smoke emitter first with flags `arg3 | 0x10000`, copies the selected black-smoke descriptor field `[def+0xc8]` into the created emitter at `[emitter+0x94]`, creates the paired lava emitter second, stores the two emitters into `[slot+0x0c/+0x10]`, stamps one fixed dword `0x371c0732` into the second emitter at `[emitter+0x1e9]`, and sets slot count `[slot+0x08] = 2`. This is the clearest current owner for the tier-selected volcano lava or smoke pair rather than a generic two-emitter allocator.","objdump + local disassembly + literal inspection + emitter-table correlation + named-bundle correlation"
0x00475550,244,effect_slot_construct_broken_down_steam_and_smoke_bundle,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a two-emitter slot bundle in the same pooled effect-slot family. After acquiring one slot container, the helper resolves `BrokenDown_Steam` and `BrokenDown_Smoke` from the global emitter table `0x006cea60` through `0x00474820`, creates the two attached emitters through `effect_slot_create_attached_sprite_emitter` `0x00474e20`, stores them into `[slot+0x0c/+0x10]`, and sets slot count `[slot+0x08] = 2`. This is the current grounded two-emitter broken-down steam/smoke bundle owner.","objdump + local disassembly + literal inspection + emitter-table correlation + named-bundle correlation"
0x00475650,339,effect_slot_construct_service_tower_water_triple_bundle,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a three-emitter service-tower water bundle in the same pooled effect-slot family. After acquiring one slot container, the helper resolves the literal pairs `ServiceTower_Water2` plus `ServiceTower_Anim2#water.3dp`, `ServiceTower_Water` plus `ServiceTower_Anim3#water.3dp`, and `ServiceTower_Water3` plus `ServiceTower_Anim4#water.3dp` from the global emitter table `0x006cea60`; it creates three attached emitters through `effect_slot_create_attached_sprite_emitter` `0x00474e20`, threads the default attachment token from the first emitter into the second and third builds when the caller did not supply one, stores the resulting emitters into `[slot+0x0c/+0x10/+0x14]`, and sets slot count `[slot+0x08] = 3`. This is the clearest current owner for the named three-stage service-tower water bundle rather than another anonymous effect-slot builder.","objdump + local disassembly + literal inspection + emitter-table correlation + named-bundle correlation"
0x004757b0,339,effect_slot_construct_fireworks_rocket_triple_bundle,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a three-emitter fireworks bundle in the pooled effect-slot family. After acquiring one slot container, the helper resolves `Rocket_Flame` plus `Fireworks_Anim2#water.3dp`, `Rocket_Smoke` plus `Fireworks_Anim3#water.3dp`, and `Rocket_Sparkle` plus `Fireworks_Anim4#water.3dp` from the global emitter table `0x006cea60`; it creates the three attached emitters through `effect_slot_create_attached_sprite_emitter` `0x00474e20`, threads the first emitter's default attachment token into the later two builds when the caller did not supply one, stores the resulting emitters into `[slot+0x0c/+0x10/+0x14]`, and sets slot count `[slot+0x08] = 3`. This is the clearest current owner for the named fireworks rocket bundle rather than a generic multi-emitter constructor.","objdump + local disassembly + literal inspection + emitter-table correlation + named-bundle correlation"
0x00475910,218,effect_slot_construct_random_fireworks_single_emitter,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a one-emitter fireworks slot bundle with one randomized named variant. The helper advances the shared PRNG state at `0x00624324`, rejects the immediately previous residue stored at `0x005f2c2c`, selects one of the three emitter names `Fireworks1`, `Fireworks2`, or `Fireworks3`, resolves that emitter from the global emitter table `0x006cea60`, creates one attached emitter through `effect_slot_create_attached_sprite_emitter` `0x00474e20` using literal `Fireworks_Anim5#water.3dp`, stores the emitter into `[slot+0x0c]`, writes fixed dword `0x3c` into `[emitter+0xbc]`, and sets slot count `[slot+0x08] = 1`. This is the clean local owner for the randomized single-firework effect bundle.","objdump + local disassembly + literal inspection + PRNG-state correlation + emitter-table correlation + named-bundle correlation"
0x004759f0,154,effect_slot_construct_cargo_money_dollar_sign_emitter,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a one-emitter slot bundle around literal `CargoMoney_DollarSign`. After acquiring one slot container, the helper resolves that named emitter from the global emitter table `0x006cea60`, creates one attached emitter through `effect_slot_create_attached_sprite_emitter` `0x00474e20` with flags `arg2 | 0xc000`, stores the emitter into `[slot+0x0c]`, and sets slot count `[slot+0x08] = 1`. This is the clean local owner for the cargo-money dollar-sign effect bundle.","objdump + local disassembly + literal inspection + emitter-table correlation + named-bundle correlation"
0x00475a90,154,effect_slot_construct_select_object_emitter,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a one-emitter slot bundle around literal `SelectObject`. After acquiring one slot container, the helper resolves that named emitter from the global emitter table `0x006cea60`, creates one attached emitter through `effect_slot_create_attached_sprite_emitter` `0x00474e20`, stores it into `[slot+0x0c]`, and sets slot count `[slot+0x08] = 1`. This is the current grounded owner for the standalone select-object effect bundle.","objdump + local disassembly + literal inspection + emitter-table correlation + named-bundle correlation"
0x00475b30,154,effect_slot_construct_spend_money_dollar_sign_emitter,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a one-emitter slot bundle around literal `SpendMoney_DollarSign`. After acquiring one slot container, the helper resolves that named emitter from the global emitter table `0x006cea60`, creates one attached emitter through `effect_slot_create_attached_sprite_emitter` `0x00474e20` with flags `arg2 | 0xc000`, stores the emitter into `[slot+0x0c]`, and sets slot count `[slot+0x08] = 1`. This is the clean local owner for the spend-money dollar-sign effect bundle.","objdump + local disassembly + literal inspection + emitter-table correlation + named-bundle correlation"
0x00475bd0,480,effect_slot_construct_construct_pos_left_right_back_forward_bundle,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a five-emitter slot bundle from the directional construction literals `Construct_Pos`, `Construct_Left`, `Construct_Right`, `Construct_Back`, and `Construct_Forward`. After acquiring one slot container, the helper resolves each named emitter from the global emitter table `0x006cea60`, creates the five attached emitters through `effect_slot_create_attached_sprite_emitter` `0x00474e20` with flags `arg2 | 0xc000`, threads the first emitter's default attachment token into the later four builds when the caller did not supply one, stores the resulting emitters into `[slot+0x0c/+0x10/+0x14/+0x18/+0x1c]`, and sets slot count `[slot+0x08] = 5`. This is the clearest current owner for the directional construction effect bundle rather than a generic multi-emitter constructor.","objdump + local disassembly + literal inspection + emitter-table correlation + named-bundle correlation"
0x00475dc0,106,effect_slot_construct_mist_or_mist_small_emitter,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a one-emitter slot bundle around either `Mist` or `MistSmall`. After acquiring one slot container, the helper chooses `Mist` when the caller float argument differs from `1.0f` and chooses `MistSmall` when it equals `1.0f`, resolves that named emitter from the global emitter table `0x006cea60`, creates one attached emitter through `effect_slot_create_attached_sprite_emitter` `0x00474e20`, stores it into `[slot+0x0c]`, and sets slot count `[slot+0x08] = 1`. This is the clean local owner for the mist-effect single-emitter bundle.","objdump + local disassembly + literal inspection + emitter-table correlation + named-bundle correlation"
0x00475e30,152,effect_slot_construct_vent_emitter,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a one-emitter slot bundle around literal `Vent`. After acquiring one slot container, the helper resolves that named emitter from the global emitter table `0x006cea60`, creates one attached emitter through `effect_slot_create_attached_sprite_emitter` `0x00474e20`, stores it into `[slot+0x0c]`, and sets slot count `[slot+0x08] = 1`. This is the current grounded owner for the standalone vent effect bundle.","objdump + local disassembly + literal inspection + emitter-table correlation + named-bundle correlation"
0x00475ed0,315,effect_slot_construct_named_bundle_by_selector_and_optionally_link_globally,bootstrap,thiscall,inferred,objdump + local disassembly + caller inspection + literal inspection,2,"Selector-dispatch owner above the current named effect-slot builders. The helper treats `EDX-1` as a small selector spanning the broken-down, volcano, service-tower, money-sign, construction, fireworks, select-object, mist, and vent bundle constructors rooted at `0x004752d0`, `0x00475420`, `0x00475550`, `0x00475650`, `0x004757b0`, `0x00475910`, `0x004759f0`, `0x00475a90`, `0x00475b30`, `0x00475bd0`, `0x00475dc0`, and `0x00475e30`. After building the selected slot bundle it mirrors the first emitter's attachment token into `[slot+0x04]`, stores caller mode into `[slot+0x34]`, and when that mode equals `1` pushes the finished slot onto the global linked active list rooted at `0x006cea74/0x006cea78/0x006cea7c`. This is the clearest current local owner for selector-driven named effect-slot construction rather than another low-level emitter helper.","objdump + local disassembly + caller inspection + literal inspection + named-bundle correlation + global-linked-list correlation"
0x00476050,31,profile_entry_add_signed_integer_delta_into_qword_field_0x154,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Tiny signed-accumulate helper over one profile-style object field. The helper converts the caller-supplied integer delta into floating-point and adds it into qword field `[this+0x154]`, then returns. Current grounded callers are the preset multiplayer normalization passes `0x00470ed0` and `0x00470fa0` over the guarded named-profile table `0x006ceb9c`, and the new-company commit path `0x0047d120`, so the safest current read is a signed additive update for field `0x154` rather than a more semantic metric name.","objdump + local disassembly + caller inspection + qword-field correlation + named-profile correlation"
0x004760a0,35,profile_entry_resolve_company_dword_slot_0x2ab_by_index_and_optionally_refresh_generation,shell,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small raw field helper over one named-profile record. The function compares the caller-supplied generation or stamp dword against `[this+0xc43]`; when they already match or the caller stamp is zero it returns `0`, otherwise it updates `[this+0xc43]` and returns the address of the indexed dword slot `[this + company_index*4 + 0x2ab]`. Current evidence only grounds the raw field relationship and the optional generation-stamp write, not the higher semantic meaning of either field.","objdump + local disassembly + caller correlation + raw-field correlation"
0x004760c6,29,profile_entry_store_company_dword_slot_0x2ab_by_index_and_optionally_refresh_generation,shell,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Companion raw setter for the same named-profile record family. The helper stores the caller dword into indexed slot `[this + company_index*4 + 0x2ab]` and, when the caller-supplied stamp in `EDX` is nonzero, also writes that stamp into `[this+0xc43]`. Current evidence grounds it only as the paired store-side helper beside `0x004760a0`.","objdump + local disassembly + caller correlation + raw-field correlation"
0x004760f0,77,profile_static_persona_table_allocate_wrapped_unused_row_flag,map,cdecl,inferred,objdump + local disassembly + table correlation + caller inspection,2,"Allocates one wrapped unused row out of the static persona table rooted at `0x005f2d28`. Starting from one bounded pseudo-random seed from `0x00518be0(0,0x28)`, the helper walks the row flag byte at stride `0x27` until it finds a zero entry, wrapping modulo `0x29` across the table. It then marks that row flag byte to `1` and returns the chosen row index. Current grounded caller is the named-profile constructor `0x00476140`, so this is the safest current read for the static persona-row allocator rather than a broader profile generator.","objdump + local disassembly + table correlation + caller inspection + static-persona correlation"
0x00476140,471,named_profile_record_construct_with_default_fields_strings_and_static_persona_row,shell,thiscall,inferred,objdump + local disassembly + caller correlation + table correlation,3,"Broad constructor for one named-profile record in the collection rooted at `0x006ceb9c`. The helper seeds several fixed state bytes under `[this+0x291..+0x295]`, stores the caller profile id at `[this+0x00]`, marks the record live through `[this+0x04] = 1`, zeros several local counters and state dwords including `[this+0x154]`, `[this+0x296]`, `[this+0x29a]`, `[this+0x2a7]`, and `[this+0x29e]`, seeds `[this+0x158]` to `7.763f`, zeroes the large record band `[this+0x1e9..]`, mirrors the special `id == 1` case into guard dword `[this+0x1e1]`, allocates one static persona-row flag through `0x004760f0`, copies the caller byte into `[this+0x15c]`, formats a localized fallback name through `0x005193f0(0x0b87)` when the caller name string is empty or otherwise copies that name into `[this+0x08]`, copies the caller biography string into `[this+0x27]`, seeds one random multiple-of-`0x5a0` scalar into `[this+0x1e5]`, and finally clears the per-company dword band `[this+0x2ab..]` plus the trailing state strip `[this+0xc66..]`. Current grounded callers are the chairman-profile seeding and materialization passes `0x004377a0` and `0x00437220`, so this is the clearest current owner for named-profile record construction rather than a generic string-copy helper.","objdump + local disassembly + caller correlation + table correlation + chairman-profile seeding correlation"
0x00476320,131,profile_entry_sum_per_company_holding_value_using_selected_company_scalar_source,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Accumulates one direct weighted sum across the per-company dword band `[this+0x15d..+0x1d9]`. For each positive entry, the helper resolves the matching live company record from `0x0062be10`; when the caller stack flag is nonzero it queries the cached company scalar through `0x00423eb0`, otherwise it queries the broader company scalar through `0x00424fd0(0,0)`. It then multiplies that company scalar by the corresponding profile holding dword and adds the result into one running floating accumulator. Current grounded caller is the `LoadScreen.win` player-list renderer `0x004e6ef0`, where this is one of the chairman-side ranking metrics.","objdump + local disassembly + caller correlation + per-company-holding correlation + player-list metric correlation"
0x004763b0,166,profile_entry_sum_threshold_adjusted_per_company_holding_value_using_selected_company_scalar_source,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Companion weighted accumulator over the same per-company holding band `[this+0x15d..+0x1d9]`. For each positive entry, the helper resolves the matching live company record from `0x0062be10`, queries either `0x00423eb0` or `0x00424fd0(0,0)` by the same caller flag split as `0x00476320`, and then folds the resulting per-company contribution through a thresholded transform using constants `0x005c8608` and `0x005c85d0` before adding it into one running floating accumulator. Current grounded caller is again the `LoadScreen.win` player-list renderer `0x004e6ef0`, so the safest current read is a threshold-adjusted holding-value accumulator rather than a fully named finance metric.","objdump + local disassembly + caller correlation + per-company-holding correlation + player-list metric correlation"
0x00476460,243,profile_entry_sell_company_holding_units_and_add_cash_metric,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Sell-side mutation over one named-profile record's per-company holding slot. The helper resolves the target company from `0x0062be10`, clamps the caller-requested unit count against current slot `[this + company_id*4 + 0x15d]` and, on the negative-holding branch, against company-side limit query `0x00429910(0)`. It then queries the company scalar through `0x00424fd0(-units,1)`, rounds the resulting proceeds twice through `0x005a10d0`, subtracts the sold unit count from `[this + company_id*4 + 0x15d]`, adds the scaled proceeds into qword cash-like field `[this+0x154]`, and finally refreshes scenario-side chairman state through `0x00433850` and `0x0050a670`. Current grounded callers are the two shell-side trade branches around `0x0050bf82` and `0x0050c24e`, plus the earlier policy branch at `0x0040722f`, so this is the clearest current sell or liquidation helper over the chairman holding band rather than another raw slot mutator.","objdump + local disassembly + caller inspection + holding-slot correlation + cash-metric correlation + trade-branch correlation"
0x00476560,539,profile_entry_apply_issue39_tiered_cash_metric_adjustment,simulation,thiscall,inferred,objdump + local disassembly + caller inspection + issue-39 correlation,3,"Applies one issue-39-driven periodic adjustment to qword cash-like field `[this+0x154]`. When scenario gate `[0x006cec78+0x46c38]` is clear, the helper first reads one scenario baseline through `0x00433740`, adds the raw issue-39 total through `scenario_state_sum_issue_opinion_terms_raw` `0x00436710(issue=0x39, company=0, profile=this[0], territory=0)`, and then clamps the resulting factor against several current-cash thresholds using constants `0x005c8608`, `0x005ce820`, `0x005ce818`, `0x005ce810`, and `0x005c8810`. The tail multiplies that factor by `[this+0x154]`, divides by `0x005c8978`, rounds through `0x005a10d0`, and adds the resulting integer delta back into `[this+0x154]`. Current grounded caller is the collection sweep at `0x0040a760`, which applies this adjustment to every active chairman profile before firing trigger kind `2` through `0x00432f40`, so this is the safest current read for an issue-39-tiered periodic cash-metric adjustment rather than a generic profile scaler.","objdump + local disassembly + caller inspection + issue-39 correlation + cash-metric correlation + collection-sweep correlation"
0x00476780,21,profile_entry_query_direct_holding_total_plus_cash_metric,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper that queries the direct per-company holding total through `0x00476320` and then adds qword cash-like field `[this+0x154]` before returning the resulting floating total. Current grounded callers are the player-list renderer `0x004e6ef0`, the ratio-style helper at `0x00406da9`, and the later support branch at `0x0050acc7`, so this is the clean direct-total-plus-cash sibling beside the threshold-adjusted path at `0x00476c20`.","objdump + local disassembly + caller inspection + cash-metric correlation + holdings-total correlation"
0x00476950,224,profile_entry_query_start_new_company_funding_scale_factor,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + field correlation,2,"Queries one bounded funding-scale factor from the current chairman profile for the `Start New Company` dialog family. The helper defaults to a constant factor when profile gate `[this+0x1e1]` is clear; otherwise it optionally adjusts one local score from owner-company field `[company+0x43]` and selected-chairman lane `[0x006cec78+0x0d]`, folds that delta into profile dword `[this+0x28d]`, converts the result through the local float constants at `0x005c85d8/0x005c85f0`, and clamps the final factor into a bounded positive range before returning it. Current grounded caller is the funding-band helper `0x0047bea0`, so this is the clean profile-side scale-factor source for the start-company funding UI rather than a general wealth metric.","objdump + local disassembly + caller correlation + field correlation + start-company funding correlation"
0x004767a0,96,profile_entry_query_cash_or_direct_holding_metric_by_selector,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small selector wrapper over the same chairman profile metric strip. Selector `0` returns qword cash-like field `[this+0x154]` directly, selector `1` returns the direct holding-value total from `0x00476320(0)`, selector `2` returns their sum by recursively combining selectors `0` and `1`, and all other selectors return the constant floor at `0x005c8608`. Current grounded callers are the local cache refresher `0x00476810`, the player-list renderer `0x004e5577/0x004e561f`, and the policy-side branch `0x0042ebb5/0x0042ebd4`, so this is the safest current read for the direct cash-versus-holdings metric selector rather than a broader ranking owner.","objdump + local disassembly + caller inspection + cash-metric correlation + selector-branch correlation"
0x00476810,170,profile_entry_refresh_cached_cash_and_direct_holding_metric_pair,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Refreshes two cached qword metric lanes under one named-profile record. After clearing the local cache band `[this+0x1e9..+0x278]`, the helper stores selector `0` and selector `1` outputs from `profile_entry_query_cash_or_direct_holding_metric_by_selector` `0x004767a0` into the two qword slots rooted at `[this+0x1e9]` and `[this+0x1f1]`. Current grounded caller is the active-profile sweep at `0x0040a3fe`, so this is the strongest current read for the cash-plus-direct-holdings cache refresh pass rather than a generic record reset.","objdump + local disassembly + caller inspection + cache-band correlation + selector-branch correlation"
0x00476a60,80,scenario_state_query_named_profile_trade_or_replace_gate_enabled,map,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Small scenario-side gate used by the named-profile transaction and replacement family. The helper returns true when any of three scenario conditions is active: toggle `[0x006cec78+0x4acb]` with `0x004337a0` returning nonzero, toggle `[0x006cec78+0x4ad7]` with the selected chairman profile record from `0x004348c0` having `[profile+0x2a7] >= 1`, or toggle `[0x006cec78+0x4ad3]`. Otherwise it returns false. Current grounded callers are the broader profile-side owner `0x00476d10` and two shell renderers `0x004e5ab6` and `0x004e6911`, so the safest current read is a named-profile trade-or-replace gate rather than a stronger user-facing policy name.","objdump + local disassembly + caller inspection + scenario-toggle correlation + selected-profile correlation"
0x00476ab0,122,profile_static_persona_row_query_string_ptr_0x40_by_profile_byte_0x15c_or_fallback,shell,thiscall,inferred,objdump + local disassembly + caller inspection + table correlation,2,"Resolves one pointer into the static persona table rooted at `[0x006d4020+0x429b4]` by matching the profile stem buffer `[this+0xc47]` against each row and then returns the matching row's `+0x40` field; on lookup failure it falls back to `[this+0x40]`. Current grounded caller is the load-screen renderer branch at `0x004e207e`, where the returned string is copied into a local buffer before the surrounding shell payload build continues. The safest current read is therefore a structural `+0x40` persona-row string-pointer query rather than a more semantic biography or title name.","objdump + local disassembly + caller inspection + table correlation + string-buffer correlation"
0x00476b30,122,profile_static_persona_row_query_asset_stem_ptr_by_profile_byte_0x15c_or_fallback,shell,thiscall,inferred,objdump + local disassembly + caller inspection + table correlation,2,"Resolves one pointer into the static persona table rooted at `[0x006d4020+0x429b4]` by matching the profile stem buffer `[this+0xc47]` against each row and then returns the matching row's `+0x20` field; on lookup failure it falls back to `[this+0x20]`. Current grounded callers are the CompanyDetail chairman portrait band at `0x004c2ec9/0x004c2ef0` and the load-screen side renderers, where the returned string is passed onward as a banked asset key through `0x0053c930`, so this is the safest current read for the persona-row asset-stem pointer query rather than a generic string helper.","objdump + local disassembly + caller inspection + table correlation + asset-key correlation"
0x00476bb0,112,profile_static_persona_table_query_row_index_by_profile_byte_0x15c_and_stem,shell,thiscall,inferred,objdump + local disassembly + caller inspection + table correlation,2,"Resolves the zero-based row index inside the static persona table rooted at `[0x006d4020+0x429b4]` whose row key matches profile stem buffer `[this+0xc47]`. The helper returns `-1` when no row matches. Current grounded callers are the load-screen player-detail and shell status renderers around `0x004e5332`, `0x004e72d8`, `0x004e736d`, `0x0050a932`, and `0x0050a994`, where the resulting row index is folded into the visible persona byte at `[profile+0x15c]`. This is therefore the current row-index query sibling beside the pointer-returning helpers at `0x00476ab0` and `0x00476b30`.","objdump + local disassembly + caller inspection + table correlation + persona-byte correlation"
0x00476c20,21,profile_entry_query_threshold_adjusted_holding_total_plus_cash_metric,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper that queries the threshold-adjusted holding-value total through `0x004763b0` and then adds qword cash-like field `[this+0x154]` before returning the resulting floating total. Current grounded callers are the player-list renderer `0x004e7133/0x004e74cc`, the overview-side branch `0x0047c085`, and the later support path `0x0050acd0`, so this is the clean threshold-adjusted-total-plus-cash sibling beside `0x00476780`.","objdump + local disassembly + caller inspection + threshold-adjusted correlation + cash-metric correlation"
0x00476c40,208,profile_entry_query_can_reduce_company_holding_slot_by_units_with_optional_threshold_fallback,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Sell-side or reduction-side feasibility gate over one chairman profile and company slot. The helper resolves the target company from `0x0062be10`, defaults the requested unit count through `0x00476e50(company_id,0)` when the caller passes zero, and succeeds immediately when current slot `[this + company_id*4 + 0x15d]` already covers that reduction. When the direct slot check fails, the helper only continues on the caller's fallback branch; there it rejects reductions against the profile's own company id `[company+0x3b] == [this+0x00]`, requires the requested units to remain below company-side limit query `0x00429910(arg4)`, and then compares `company_scalar(0,0) * units` against the threshold-adjusted-total-plus-cash lane from `0x00476c20(1)`. Current grounded callers are the trade-block helper `0x00476e50`, the ratio or policy branch `0x00406e13`, and several shell-side sell branches around `0x0050b681`, `0x0050b747`, and `0x0050beaf`, so this is the safest current read for the reduction-feasibility sibling beside the buy gate `0x00476ff0`.","objdump + local disassembly + caller inspection + holding-slot correlation + threshold-fallback correlation + trade-branch correlation"
0x00476d10,318,profile_entry_query_can_start_new_company_or_publish_failure_notice,shell,thiscall,inferred,objdump + local disassembly + caller inspection + RT3.lng correlation,3,"Start-new-company eligibility gate above the shell dialog paths. The helper first checks scenario gate `0x00476a60`; when that gate is active it formats localized id `0x0b88` `2952` `You're not able to start a new company.` and routes the result through `0x004c98a0` as a notice, then returns failure. Otherwise it queries the caller profile's threshold-adjusted-total-plus-cash value through `0x004763b0(1) + [this+0x154]` and succeeds immediately when that result reaches threshold `0x005c8830`. When the threshold fails, it resolves the currently selected chairman profile through `0x004348c0`, formats localized id `0x010f` `271` `You don't have enough money to start a new company!...` with the required threshold and the selected chairman's current purchasing-power figure, publishes that notice through `0x004c98a0`, and returns failure. Current grounded callers are the company-list and load-screen branches at `0x004c7134` and `0x004de3f0`, so this is the clearest current owner for the start-new-company eligibility check plus failure-notice path rather than a generic purchasing-power helper.","objdump + local disassembly + caller inspection + RT3.lng correlation + purchasing-power correlation + start-company dialog correlation"
0x00476e50,407,profile_entry_compute_rounded_company_trade_block_size_by_mode,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Computes one rounded trade-block size for a caller-selected company slot. When profile guard `[this+0x1e1]` is clear the helper returns the floor block `1000`. Otherwise it derives a tentative block size from the current holding slot `[this + company_id*4 + 0x15d]`, rounds that size to the nearest `1000` through the shared `0x10624dd3` divide sequence, and then constrains it through either the buy-feasibility helper `0x00476ff0` or the sell-feasibility helper `0x00476c40` depending on the caller mode flag. On the positive path it also clamps against company-side availability query `0x004261b0`, then rounds the final result back to a `1000`-sized block with midpoint bias `+500`. Current grounded callers are the buy-feasibility and buy-commit path at `0x00476ff0/0x00477110` and the shell-side commit branches at `0x0050c16d/0x0050c20d`, so this is the safest current read for the rounded trade-block-size helper rather than a general metric scaler.","objdump + local disassembly + caller inspection + holding-slot correlation + trade-block correlation"
0x00476ff0,275,profile_entry_query_can_buy_company_holding_units_with_optional_cash_fallback,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Buy-side feasibility gate over one chairman profile and company slot. The helper resolves the target company from `0x0062be10`, defaults the requested unit count through `0x00476e50(company_id,1)` when the caller passes zero, clamps that request to at least `1`, and rejects it when company-side availability query `0x004261b0` is smaller. It then compares the cash-like field `[this+0x154]` against the current purchase cost derived from `0x00424fd0(0,0)` times the requested units. When that cash test fails and the caller's fallback flag is nonzero, it retries the same comparison after adding the direct holdings total from `0x00476320(1)` to `[this+0x154]`. Current grounded callers are the buy commit path `0x00477110`, the ratio branch `0x00406df1`, and several shell-side trade branches around `0x0050b3ba`, `0x0050b4b4`, and `0x0050bcf0`, so this is the clearest current owner for the company-holding buy-affordability gate rather than a generic transaction predicate.","objdump + local disassembly + caller inspection + trade-affordability correlation + cash-metric correlation + holding-total fallback correlation"
0x00477110,202,profile_entry_buy_company_holding_units_and_subtract_cash_metric,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Buy-side mutation over one named-profile record's per-company holding slot. Unless the caller explicitly bypasses the precheck, the helper first requires `profile_entry_query_can_buy_company_holding_units_with_optional_cash_fallback` `0x00476ff0` to succeed for the requested company and unit count. It then resolves the target company from `0x0062be10`, applies the company-side update path through `0x00424fd0(1, units)` and `0x00424fd0(0,0)`, adds the requested units into holding slot `[this + company_id*4 + 0x15d]`, converts the resulting purchase cost through `0x005a10d0` and constant `0x005c8930`, subtracts that scaled cost from qword cash-like field `[this+0x154]`, and finally refreshes scenario-side chairman state through `0x00433850` and `0x0050a670`. Current grounded callers are the shell-side buy branches around `0x0050c1ae` and the broader transaction family beside `0x00476460`, so this is the clearest current buy companion to the sell-side helper.","objdump + local disassembly + caller inspection + holding-slot correlation + cash-metric correlation + trade-branch correlation"
0x00477820,59,profile_collection_count_active_chairman_records,map,thiscall,inferred,objdump + callsite inspection,4,"Counts active chairman-profile records in the global persona collection at `0x006ceb9c`. The helper iterates the collection and increments the result only for entries whose live flag at `[profile+0x4]` is nonzero. Current grounded caller is `world_conditionally_seed_named_starting_railroad_companies` at `0x0047d440`, where count `>= 2` gates whether the second seeded railroad can be bound to another active chairman profile.","objdump + callsite inspection + caller correlation"
0x00477860,90,profile_collection_get_nth_active_chairman_record,map,thiscall,inferred,objdump + callsite inspection,4,"Returns one zero-based active chairman-profile record from the global persona collection at `0x006ceb9c`. The helper skips any entry whose live flag `[profile+0x4]` is zero and decrements the requested ordinal across the remaining active entries until it resolves one record or returns null. Current grounded caller is `world_conditionally_seed_named_starting_railroad_companies` at `0x0047d440`, which requests ordinal `1` to bind the second seeded railroad to the second active chairman profile when present.","objdump + callsite inspection + caller correlation"
0x004778c0,84,profile_collection_get_nth_active_chairman_record_id,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Returns the live collection id of the zero-based active chairman-profile entry selected by the caller ordinal. The helper walks the global persona collection at `0x006ceb9c`, skips any entry whose live flag `[profile+0x4]` is zero, decrements the requested ordinal across the remaining active entries, and returns the matched live record id through `indexed_collection_get_nth_live_entry_id` `0x00518380`; on failure it returns `0`. Current grounded caller is the `LoadScreen.win` player-list renderer `0x004e6ef0`.","objdump + local disassembly + caller correlation + active-chairman correlation"
0x00477920,91,profile_collection_count_active_chairmen_before_record_id,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Counts how many active chairman-profile records appear before one caller-supplied live record id in the global persona collection at `0x006ceb9c`. The helper walks the live collection in order, stops when the current live id equals the target id, increments the running count only for entries whose live flag `[profile+0x4]` is nonzero, and returns that active-prefix count; missing targets return `0`. Current grounded caller is the `LoadScreen.win` player-list renderer `0x004e6ef0`, where it provides the active-rank position for one selected profile id.","objdump + local disassembly + caller correlation + active-chairman correlation"
0x00477a70,94,shell_overlay_state_measure_scaled_max_world_span_with_min_floor,shell,thiscall,inferred,objdump + local disassembly + field correlation,2,"Small scalar helper over the local shell overlay-state strip. The function compares the current world-cell span widths `[this+0xbb]-[this+0xb3]` and `[this+0xbf]-[this+0xb7]`, clamps the larger span upward to minimum floor `[this+0x11f]`, scales that result by factor `[this+0xdb]`, rounds through `0x005a10d0`, and returns the final floating-point span. Current grounded caller is the nearby clamp-and-refresh owner `0x00479510`, so this is the safest current read for the overlay state's scaled max-span query rather than a generic arithmetic helper.","objdump + local disassembly + field correlation + caller correlation"
0x00477ad0,16,shell_overlay_try_get_primary_active_mode_collection,shell,thiscall,inferred,objdump + local disassembly + flag correlation,1,"Tiny mode-gated accessor over shell flag band `[this+0x33]`. When bit `0x00010000` is set it tail-jumps into `0x005130f0` and returns that active-mode collection root; otherwise it returns `0`. Current grounded caller is the broader overlay-list family around `0x00478330`.","objdump + local disassembly + flag correlation + caller correlation"
0x00477af0,272,shell_overlay_state_reset_default_world_bounds_and_normalized_rect,shell,thiscall,inferred,objdump + local disassembly + field correlation,2,"Constructor-style reset for the local shell overlay-state strip used by the world-anchor overlay builders. The helper seeds type word `[this+0x06] = 0x1000`, clears several cached ids and bounds lanes `[this+0xa3..+0xb7]` and `[this+0x10f..+0x11b]`, clamps minimum span floor `[this+0x11f]` against current world dims `0x0062c120+0x2155/+0x2159` with ceiling `0xa0`, seeds default cell bounds `[this+0xbb/+0xbf/+0xcb/+0xcf] = 10`, seeds scalar bands `[this+0xdb/+0xd3/+0xd7/+0xf3/+0x103/+0x10b] = 1.0`, and seeds the paired integer lanes `[this+0xdf/+0xe3/+0xe7/+0xeb] = 5`. Current grounded callers sit in the adjacent overlay owner family, so this is the safest current read for the overlay-state default reset rather than a generic shell constructor.","objdump + local disassembly + field correlation + world-dimension correlation"
0x00477c10,353,shell_overlay_map_screen_point_to_world_cell_pair_under_current_bounds,shell,thiscall,inferred,objdump + local disassembly + caller correlation + field correlation,2,"Maps one screen-space point into a world-cell pair under the current shell overlay-state bounds. When flag band `[this+0x33]` carries `0x02030000`, the helper uses the current bound rectangle `[this+0xc3..+0xcf]`, world-anchor bias `[this+0x86]+0x05/+0x09`, local offsets `[this+0x0b/+0x0f]`, and scale lanes `[this+0x13/+0x17]` to convert the caller point into two output floats. Otherwise it falls back to live world dims `0x0062c120+0x2155/+0x2159`, compensates for aspect mismatch, and derives the same two outputs from the broader full-world view. Current grounded caller is the drag-side owner `0x00478cb0`, so this is the safest current read for the overlay screen-point mapper rather than a generic projection helper.","objdump + local disassembly + caller correlation + field correlation + world-dimension correlation"
0x00478200,291,shell_queue_single_city_database_owner_world_anchor_overlay,shell,cdecl,inferred,objdump + local disassembly + caller-side field correlation,2,"Builds and queues one world-anchor marker for the city-database-style owner referenced by id `[this+0x11b]` in collection `0x0062bae0`. The helper first validates that owner id through `0x00517d40`, resolves the live owner through `0x00518140`, samples its normalized XY through `0x00455800/0x00455810`, derives one localized overlay label through `0x0053de00([this+0xaf],2)`, measures projected half-height through `0x00477a10` using caller bounds `[this+0xc3/+0xcb]`, local height bias `[this+0x0b]`, scale `[this+0x13]`, and owner-side vertical bias `[this+0x86]+0x05`, and finally queues the finished marker through `0x005521a0/0x00552160/0x00552560`. This is the strongest current read for the single-owner city-database overlay builder rather than a generic object marker wrapper.","objdump + local disassembly + caller-side field correlation + city-database collection correlation + world-anchor marker correlation"
0x00478330,2432,shell_queue_world_anchor_overlay_markers_for_active_mode_collections_and_optional_region_focus,shell,cdecl,inferred,objdump + local disassembly + caller-side field correlation + collection correlation,2,"Broad shell-side overlay marker owner above `shell_queue_single_city_database_owner_world_anchor_overlay` `0x00478200`. The helper first chooses one active-mode source collection through flags `[this+0x33] & 0x00010000/0x00020000` and derives the current world-space view box from `[this+0xc3/+0xc7/+0xcb/+0xcf]` plus live world dims `[0x0062c120+0x2155/+0x2159]`. It then runs six category passes `0..5`: one pass walks the active-mode collection returned by `0x005130f0 -> 0x004b2b70` or `0x0050f600` and emits bounded label ids `0x3d..0x44` for accepted rows; the other passes walk live placed structures in `0x006cec20`, filter them through station-or-transit gate `0x0047fd50`, owner/category tests, and local bounds queries `0x0047df30/0x0047df50`, and then emit category-specific overlay labels through `0x0053de00` and marker builders `0x00477a10/0x004779c0/0x005521a0/0x00552160/0x00552560`. After those six passes it also walks collection `0x006cfcbc` and, when optional focused region id `[this+0x113]` resolves in `0x006cfca8`, emits one final label-`0x3c` marker from `0x0048a170`. This is the strongest current read for the active-mode world-anchor overlay list owner rather than a single collection iterator.","objdump + local disassembly + caller-side field correlation + collection correlation + world-anchor marker correlation"
0x00478cb0,272,shell_overlay_drag_loop_apply_view_focus_updates_and_refresh_overlay_state,shell,thiscall,inferred,objdump + local disassembly + caller correlation + state correlation,2,"Interactive drag-side owner above the local shell overlay-state strip. The helper snapshots the initial controller cursor position from `[0x006d4018+0xa94/+0xa98]`, enters the surrounding shell input or capture mode through `0x0054e7e0`, repeatedly maps the current cursor through `shell_overlay_map_screen_point_to_world_cell_pair_under_current_bounds` `0x00477c10`, applies the resulting screen delta to the world view through `world_view_apply_screen_delta_to_focus_position` `0x0043d0c0`, pumps the shell-side timing or input path through `0x0054f4d0` and `0x0051d890`, and exits through `0x0054e7f0` once the current drag state reaches terminal value `7`. Current grounded sibling is the later clamp-and-refresh pass `0x00479510`, so this is the safest current read for the overlay drag loop rather than a generic modal input helper.","objdump + local disassembly + caller correlation + state correlation + world-view correlation"
0x00478dc0,1855,shell_overlay_state_rebuild_world_cell_bounds_and_normalized_rect_from_mode_flags,shell,thiscall,inferred,objdump + local disassembly + field correlation,2,"Heavy rebuild pass over the same shell overlay-state strip used by the world-anchor overlay builders. When shell flag band `[this+0x33]` lacks bits `0x02030000`, the helper leaves the derived screen rect at defaults `[this+0xef/+0xf3/+0xf7/+0xfb] = (0,1,0,1)` and returns. Otherwise it rebuilds current cell bounds `[this+0xb3..+0xbf]` either from full-world dims or by scanning world raster byte `0x0062c120+0x2131` for flag bit `0x02`, derives extent and density scalars into `[this+0xd3/+0xd7/+0xdb/+0xdf/+0xe3]`, optionally checks live placed structures in `0x006cec20` against the rebuilt bounds through `0x0047efe0`, `0x0047df00`, and `0x0047ded0`, and finally projects the resulting cell rectangle into normalized screen rect `[this+0xef/+0xf3/+0xf7/+0xfb]` using scalar bands `[this+0xff/+0x103/+0x107/+0x10b]`. This is the strongest current read for the overlay-state rebuild owner above the marker-list builders rather than a generic shell geometry helper.","objdump + local disassembly + field correlation + world-raster correlation + placed-structure correlation"
0x00479510,1134,shell_overlay_state_clamp_recenter_bounds_and_refresh_normalized_rect,shell,thiscall,inferred,objdump + local disassembly + field correlation + caller correlation,2,"Clamp-and-refresh companion for the same shell overlay-state strip. When flag band `[this+0x33]` lacks bits `0x02030000`, the helper resets normalized rect `[this+0xef/+0xf3/+0xf7/+0xfb]` to `(0,1,0,1)` and returns. Otherwise it copies current derived bounds `[this+0xb3..+0xbf]` into working bounds `[this+0xc3..+0xcf]`, uses `shell_overlay_state_measure_scaled_max_world_span_with_min_floor` `0x00477a70` plus scalar bands `[this+0xdf/+0xe3/+0xdb]` to expand or recenter those bounds when needed, clamps the resulting rectangle back inside live world dims `0x0062c120+0x2155/+0x2159`, refreshes scale lane `[this+0xd7]`, and reprojects the clamped cell rectangle into normalized rect `[this+0xef/+0xf3/+0xf7/+0xfb]` through `[this+0xff/+0x103/+0x107/+0x10b]`. Current grounded caller is the drag-or-zoom-side owner `0x00478cb0`, so this is the safest current read for the overlay-state clamp and normalized-rect refresh sibling rather than a second constructor.","objdump + local disassembly + field correlation + caller correlation + world-dimension correlation"
0x00479b50,475,shell_overlay_find_nearest_placed_structure_or_region_within_pick_radius,shell,thiscall,inferred,objdump + local disassembly + field correlation + collection correlation,2,"Nearest-target query under the same shell overlay-state family. The helper zeroes the caller's optional placed-structure and region out-ids, derives one pick radius from the current overlay width `[this+0xcb]-[this+0xc3]`, scales that radius by current shell metric `[0x006d4018+0xa8c]`, then scans live placed structures in `0x006cec20` using local coordinates `0x0047df30/0x0047df50` and Euclidean distance `0x0051db80`; when the candidate passes `0x0047fd50` it applies one extra weighting before comparing against the current best radius and writing the winning placed-structure id through the first out-pointer. When no placed structure wins and shell metric flag bit `0x4` is set, it then scans regions in `0x006cfca8` through `0x0048a170`, applies the same nearest-distance test, and writes winning region-like field `[region+0x202]` through the second out-pointer. The function returns success when either out-id becomes nonzero. Current grounded caller is the click-side owner `0x00479d30`, so this is the safest current read for the nearest overlay target query rather than a generic distance helper.","objdump + local disassembly + field correlation + collection correlation + nearest-target correlation"
0x00479d30,1519,shell_overlay_handle_click_target_dispatch_or_preview_request,shell,thiscall,inferred,objdump + local disassembly + caller correlation + request-packet correlation,2,"Click-side dispatch owner for the same shell overlay family. The helper first maps the caller screen point through `shell_overlay_map_screen_point_to_world_cell_pair_under_current_bounds` `0x00477c10`, resolves the nearest placed-structure or region target through `shell_overlay_find_nearest_placed_structure_or_region_within_pick_radius` `0x00479b50`, and then takes one of three bounded paths. Under the active-mode collection path it can reject the clicked region through `0x0048e3c0` and publish restriction notices `0x0c12/0x0c13` through `0x004c98a0`. Otherwise it packages one small local request block rooted at stack id `0x384`, populates that block from the resolved target, and either forwards it to the Multiplayer preview owner `0x006cd8d8` through `0x00407870(selector 0x41)` or dispatches it through the local active-mode handlers `0x004b3160`, `0x004b2c10`, and `0x004ab980`. The tail always eases one shell scalar through `0x0045ea20(0x38,0.5f)`. This is the strongest current read for the overlay click-dispatch owner rather than a generic modal or point-query wrapper.","objdump + local disassembly + caller correlation + request-packet correlation + active-mode dispatch correlation + multiplayer-preview correlation"
0x0047a120,3919,shell_overlay_rasterize_visible_map_classification_buffer_and_stage_rect,shell,thiscall,inferred,objdump + local disassembly + field correlation + caller correlation,2,"Broad rasterization owner above the same shell overlay-state family. The helper first resolves or stages one visible overlay rect through `0x00534930/0x00534c50`, optionally allocates a caller-owned RGBA buffer when the caller did not supply one, and then, when live world root `0x0062c120` is present, rasterizes the visible map window into that buffer. Under caller flag `0x00400000` it builds two temporary `0x100`-entry lookup tables from collection `0x006cfc9c` and helper `0x004c16f0`, then fills the visible rect by sampling world classification helpers such as `0x00534e50`, `0x00534f00`, `0x00449bd0`, and `0x00448aa0`, mapping the resulting classes through palette table `0x005f2c34`, and finally marking city-database owners from `0x0062bae0` into the same raster. When the caller supplied staging out-pointers it finishes by publishing the staged rect through `0x00534af0(1)`. This is the strongest current read for the shell-side visible overlay rasterizer rather than a small per-cell helper or the later marker builders.","objdump + local disassembly + field correlation + caller correlation + visible-raster correlation + rect-staging correlation"
0x0047b070,83,shell_overlay_state_construct_from_controller_template_copy,shell,thiscall,inferred,objdump + local disassembly + caller correlation + field correlation,2,"Small constructor beneath the shell overlay rasterizer family. The helper seeds base state through `0x00558580`, installs vtable `0x005ce840`, resets local overlay defaults through `shell_overlay_state_reset_default_world_bounds_and_normalized_rect` `0x00477af0`, allocates one temporary `0x60`-byte slab through `0x005a125d`, fills that slab from controller-owned source `0x006d4020` through `0x0053b7c0`, copies it into the live overlay state through `0x00557f80`, mirrors trailing byte `[template+0x5f]` into `[this+0xa2]`, and frees the temporary slab. This is the safest current read for the controller-template copy constructor rather than a generic allocator.","objdump + local disassembly + caller correlation + field correlation + constructor correlation"
0x0047b0d0,47,shell_overlay_state_construct_from_supplied_template_block,shell,thiscall,inferred,objdump + local disassembly + field correlation,2,"Direct copy-constructor sibling for the same shell overlay-state family. The helper seeds base state through `0x00558580`, installs vtable `0x005ce840`, reuses `shell_overlay_state_reset_default_world_bounds_and_normalized_rect` `0x00477af0`, copies trailing template byte `[src+0x5f]` into `[this+0xa2]`, and then returns the constructed overlay state. Compared with `0x0047b070`, this sibling assumes the caller already owns the source `0x60`-byte template block.","objdump + local disassembly + field correlation + constructor correlation"
0x0047b110,87,shell_overlay_state_release_template_handle_and_surface_then_tail_into_base_release,shell,thiscall,inferred,objdump + local disassembly + field correlation,2,"Primary release body for the same `0x005ce840` overlay-state family. The helper reinstalls vtable `0x005ce840`, drops optional template handle `[this+0xaf]` through `0x0053c000` on controller-owned root `0x006d4020`, releases optional surface or payload root `[this+0xab]` through `0x00542c90` and `0x0053b080`, clears both fields, and then tail-jumps into common base release `0x00558000`.","objdump + local disassembly + field correlation + release-path correlation"
0x0047b170,591,shell_overlay_state_service_surface_and_queue_overlay_markers,shell,thiscall,inferred,objdump + local disassembly + field correlation + caller correlation,2,"Main service or render owner for the `0x005ce840` overlay-state family. When the state is active and live world root `0x0062c120` exists, the helper checks whether the current overlay bounds intersect the visible world rectangle through `0x0051f2b0`, refreshes the clamped normalized rect through `shell_overlay_state_clamp_recenter_bounds_and_refresh_normalized_rect` `0x00479510`, draws the current overlay surface `[this+0xab]` through `0x0054f640/0x0051f460`, and then queues one of the overlay marker families depending on shell flag band `[this+0x33]`: the repeated active-mode list `0x00478330`, the single city-database owner marker `0x00478200`, or the fallback quad builder `0x00477d80`. When controller mask `[0x006d401c+0xc79]` includes this state's type word `[this+0x06]`, it also pushes one or two extra framed quads through `0x0054f9f0` from the local offset bands `[this+0x0b..+0x27]`. On the positive visibility path it exits through `0x0051f320` to restore the shell view state. This is the strongest current read for the overlay-state service and draw owner rather than a generic per-frame helper.","objdump + local disassembly + field correlation + caller correlation + overlay-marker correlation"
0x0047b3d0,123,shell_overlay_state_rasterize_into_surface_handle,shell,thiscall,inferred,objdump + local disassembly + caller correlation + field correlation,2,"Surface-rasterization wrapper for the same overlay-state family. When surface handle `[this+0xab]` is live, the helper acquires one temporary raster target through `0x00541970`, forwards the current overlay bounds, flags, cached ids, and normalized rect bands into `shell_overlay_rasterize_visible_map_classification_buffer_and_stage_rect` `0x0047a120`, and then commits that rasterized payload back into the live surface through `0x005438d0`. This is the safest current read for the overlay-state rasterize-to-surface wrapper rather than a second constructor or free helper.","objdump + local disassembly + caller correlation + field correlation + raster-wrapper correlation"
0x0047b450,27,shell_overlay_state_destructor_thunk_with_optional_free,shell,thiscall,inferred,objdump + local disassembly + caller correlation,1,"Destructor thunk for the `0x005ce840` overlay-state family. It re-enters `shell_overlay_state_release_template_handle_and_surface_then_tail_into_base_release` `0x0047b110` and, when the caller's low flag bit is set, frees the state object through `0x0053b080`.","objdump + local disassembly + caller correlation + destructor-thunk correlation"
0x0047b470,360,shell_overlay_state_ensure_surface_allocated_with_zoom_scaled_power_of_two_dims,shell,thiscall,inferred,objdump + local disassembly + field correlation + caller correlation,2,"Surface-allocation owner for the same `0x005ce840` overlay-state family. When live surface handle `[this+0xab]` is absent, the helper derives requested width and height either from the caller or from the current shell zoom table rooted at `[0x006d4024+0x11421e/+0x34]`, scales those dimensions by local float bands `[this+0x13]` and `[this+0x17]`, rounds them through `0x005a10d0`, and then grows each axis as a power of two starting at `0x40` until it reaches the scaled threshold bounded by the controller caps `[0x006d4024+0x11423b/+0x11423f]`. It stores the selected dimensions in `[this+0xa3/+0xa7]`, allocates one `0xec`-byte surface-like owner through `0x0053b070 -> 0x00543980(0,width,height,1)`, stores that root in `[this+0xab]`, and immediately reruns `shell_overlay_state_rasterize_into_surface_handle` `0x0047b3d0`. If the surface already exists it simply returns it. This is the strongest current read for the overlay-state ensure-surface owner rather than another constructor or draw helper.","objdump + local disassembly + field correlation + caller correlation + shell-zoom-table correlation + surface-allocation correlation"
0x0047b5e0,304,shell_overlay_state_update_hover_target_or_class_cell_and_forward_cursor_state,shell,thiscall,inferred,objdump + local disassembly + field correlation + caller correlation,2,"Pointer-move or hover-update owner for the same shell overlay-state family. The helper first maps the current screen point through `shell_overlay_map_screen_point_to_world_cell_pair_under_current_bounds` `0x00477c10`. Under overlay flag `0x00400000`, it rounds the mapped cell pair, validates it through `0x00534e50/0x00534f00`, resolves one classification-word pointer through `0x0044ade0`, and compares the resulting hovered class id against cached field `[this+0x117]`; when that class changes it stores the new id and reruns `shell_overlay_state_rasterize_into_surface_handle` `0x0047b3d0`. Otherwise it resolves the nearest placed-structure or region target through `shell_overlay_find_nearest_placed_structure_or_region_within_pick_radius` `0x00479b50`, clears cached target ids `[this+0x10f/+0x113]`, and when a hit exists stores those two resolved ids. The tail always forwards the caller coordinates plus the mapped world pair into `0x00558760`. This is the safest current read for the overlay-state hover or cursor-state updater rather than a general click dispatcher.","objdump + local disassembly + field correlation + caller correlation + hover-class correlation + nearest-target correlation"
0x0047b720,613,shell_overlay_state_handle_message,shell,thiscall,inferred,objdump + local disassembly + caller correlation + message-switch correlation,2,"Main message dispatcher for the `0x005ce840` overlay-state family. The helper switches on a small sparse message-id set rooted at `msg_id-6`, with current grounded cases for id `6`, the refresh pair `0xba/0xbb`, and the scalar-update id `0xbc`. On id `6` it first checks the state's live interaction gates through vtable slots `+0x30` and `+0x20` plus `0x005586c0`; if optional callback `[this+0x9a]` is present it forwards local-space coordinates derived from `[this+0x86]` and offset bands `[this+0x0b/+0x0f]`, otherwise it either enters `shell_overlay_handle_click_target_dispatch_or_preview_request` `0x00479d30` under flag mask `0x00030000` or the drag or focus-update owner `0x00478cb0`. On `0xba/0xbb` it toggles global gate `0x006ceba0` only for `0xbb`, ensures or rerasterizes the live surface through `0x0047b470/0x0047b3d0`, and rebuilds bounds through `0x00478dc0`. On `0xbc` it rescales cached world-span bands `[this+0xdf/+0xe3]` from message floats through `shell_overlay_state_measure_scaled_max_world_span_with_min_floor` `0x00477a70`. Every live case exits through `0x00558a10` with the original message. This is the strongest current read for the overlay-state message owner rather than a loose callback trampoline.","objdump + local disassembly + caller correlation + message-switch correlation + overlay-interaction correlation"
0x0047ba60,17,shell_overlay_reset_global_pointer_marker_slots,shell,cdecl,inferred,objdump + caller correlation + global-state correlation,2,"Clears the ten-entry global pointer-marker slot table rooted at `0x006ceba4`. The helper simply zeroes ten dwords and returns. Current grounded caller is the world-side setup or rebuild branch at `0x00449252`, so this is the clean global reset sibling for the later pointer-marker slot constructors rather than a generic scratch clear.","objdump + caller correlation + global-state correlation + pointer-marker slot-table correlation"
0x0047ba80,268,shell_overlay_rebuild_global_pointer_marker_slot,shell,thiscall,inferred,objdump + caller correlation + local disassembly + literal correlation,2,"Rebuilds one indexed global pointer-marker slot in the ten-entry table rooted at `0x006ceba4`. The caller supplies the slot index in `ECX`, one variant selector in `EDX`, two world-space anchor coordinates on the stack, and one scalar lane that is rounded through `0x005a10d0`. If the indexed slot already owns a live marker object, the helper releases it through `0x0045b160`, `0x0045b040`, and `0x0053b080`. It then allocates one `0x26e`-byte placed-structure-specialization-like object through `0x0053b070 -> 0x0045b680`, seeds it through `0x0045b9b0` from one of the three literal roots `pointer`, `pointer2`, or `pointer3`, publishes the caller world anchor through `0x004556f0`, applies scalar `0.8f` through `0x00455720`, and clears bit `0x20` in the derived state byte `[slot+0x20]`. Current grounded callers are the clustered world-side branches at `0x0051677b`, `0x00516797`, `0x005167df`, and `0x005167fe`, which makes this the indexed global pointer-marker slot builder rather than a general placed-structure constructor.","objdump + caller correlation + local disassembly + literal correlation + slot-table correlation + specialization-constructor correlation"
0x0047bb90,60,shell_overlay_release_global_pointer_marker_slots,shell,cdecl,inferred,objdump + caller correlation + global-state correlation,2,"Releases the ten-entry global pointer-marker slot table rooted at `0x006ceba4`. The helper walks each slot, and for any live marker object re-enters `0x0045b160`, `0x0045b040`, and `0x0053b080` before clearing the slot pointer. Current grounded callers are the world-side teardown branches at `0x00449292` and `0x005166d8`, so this is the matching global release loop for `shell_overlay_rebuild_global_pointer_marker_slot` `0x0047ba80`.","objdump + caller correlation + global-state correlation + slot-release correlation"
0x0047bbf0,95,runtime_profile_reset_default_setup_and_campaign_seed_fields,shell,thiscall,inferred,objdump + caller correlation + field correlation,2,"Resets the staged `0x108`-byte runtime-profile record to its default setup or campaign seed state. The helper clears the whole record, seeds compact option byte `[this+0x7d] = 1`, selected-year lane `[this+0x77] = 0x726`, live-row threshold `[this+0x79] = 1`, scroll lane `[this+0x7b] = 0`, clears bytes `[this+0x82]`, `[this+0xc4]`, `[this+0xc5]`, and `[this+0x01]`, writes one bounded random-like dword from `0x00518d70(0,0x7fff)` into `[this+0x83]`, and forces bytes `[this+0x87] = 1` plus `[this+0x97] = 1`. Current grounded callers are the setup constructor side at `0x005040aa` and the late world-entry branch at `0x004440f1`, so this is the clean default-profile reset helper rather than a setup-only local clear.","objdump + caller correlation + field correlation + staged-profile correlation"
0x0047bc50,37,runtime_profile_query_first_campaign_selector_byte_below_2,shell,cdecl,inferred,objdump + caller correlation + field correlation,2,"Scans the staged campaign selector band `[0x006cec7c+0xc6..+0xd5]` and returns the first index whose byte value is below `2`, or `16` if none match. Current grounded caller is the campaign-window side branch at `0x004b908e`, which keeps this on the staged campaign selector or unlock side of the profile rather than the earlier setup payload fields.","objdump + caller correlation + field correlation + campaign-selector-band correlation"
0x0047bea0,368,start_new_company_dialog_rebuild_primary_funding_band_and_publish_card,shell,cdecl,inferred,objdump + local disassembly + caller correlation + field correlation,2,"Rebuilds the primary funding-band globals for the `Start New Company` dialog and republishes the matching summary controls. The helper resolves the selected chairman profile through `0x004348c0`, queries one profile-side scale factor through `profile_entry_query_start_new_company_funding_scale_factor` `0x00476950`, multiplies that factor by current funding lane `0x006cec14`, chooses a step-size bucket, derives a bounded snapped band into globals `0x006cebcc`, `0x006cebd0`, and count `0x005f2c50`, and then formats the resulting range summary into controls `0x73` and `0x66` on window root `0x006cec18` through localized id `0x7150`. Current grounded callers are the dialog open path at `0x0047d051/0x0047d062/0x0047d070`, the snap-and-republish helper `0x0047c220`, and the child-control callback gate `0x0047c360`, so this is the clean primary funding-band builder beneath the dialog rather than a generic slider formatter.","objdump + local disassembly + caller correlation + field correlation + funding-band correlation"
0x0047c070,273,start_new_company_dialog_rebuild_secondary_funding_band_and_publish_card,shell,cdecl,inferred,objdump + local disassembly + caller correlation + field correlation,2,"Rebuilds the secondary funding-band globals for the `Start New Company` dialog and republishes the matching summary controls. The helper resolves the selected chairman profile through `0x004348c0(1)`, queries the threshold-adjusted total-plus-cash lane through `profile_entry_query_threshold_adjusted_holding_total_plus_cash_metric` `0x00476c20`, chooses a bounded step-size bucket, writes the resulting snapped band into globals `0x006cebd4`, `0x006cec0c`, and count `0x005f2c4c`, and then formats the summary into controls `0x73` and optionally `0x66` through localized id `0x714f` on window root `0x006cec18`. Current grounded caller is the start-company open path at `0x0047d047`, so this is the secondary funding-band sibling beside `0x0047bea0`.","objdump + local disassembly + caller correlation + field correlation + funding-band correlation"
0x0047c190,138,start_new_company_dialog_publish_current_funding_pair_labels,shell,cdecl,inferred,objdump + local disassembly + caller correlation + control-id correlation,2,"Publishes the two current funding-lane values for the `Start New Company` dialog. The helper formats current globals `0x006cec14` and `0x006cec10` through `0x0051c000` and writes them into controls `0x6f:0x7149` and `0x6f:0x714a` on the live dialog root `0x006cec18`. Current grounded caller is the funding snap-and-republish helper `0x0047c220`, so this is the narrow current-value label publisher beneath the broader funding-band builders.","objdump + local disassembly + caller correlation + control-id correlation + funding-label correlation"
0x0047c220,314,start_new_company_dialog_snap_current_funding_pair_to_band_steps_and_republish,shell,thiscall,inferred,objdump + local disassembly + caller correlation + control-id correlation,2,"Snaps the two current funding lanes for the `Start New Company` dialog into their currently computed band steps and republishes the affected labels. The helper first realigns current value `0x006cec14` inside the primary band rooted at `0x006cebd4..0x006cec0c` using the live control extent for id `0x714f`; it then optionally rebuilds the primary funding band through `0x0047bea0(0)`, realigns current value `0x006cec10` inside the secondary band rooted at `0x006cebcc..0x006cebd0` using the live control extent for id `0x7150`, rebuilds that band through `0x0047bea0(0)`, and finally republishes the current pair labels through `0x0047c190`. Current grounded callers are the dialog open path at `0x0047d058/0x0047d069` and the child-control callback gate `0x0047c360`, so this is the funding-lane snap-and-refresh owner beneath the start-company dialog.","objdump + local disassembly + caller correlation + control-id correlation + funding-band correlation"
0x0047c360,52,start_new_company_dialog_child_control_callback_refresh_funding_bands,shell,thiscall,inferred,objdump + local disassembly + caller correlation + control-id correlation,2,"Small child-control callback gate for the `Start New Company` funding dialog. The helper uses recursion latch `0x006cec1c`, checks whether the callback owner control id is `0x714f`, and then re-enters `start_new_company_dialog_snap_current_funding_pair_to_band_steps_and_republish` `0x0047c220` with the corresponding primary-band flag before clearing the latch. Current grounded caller is the dialog constructor `0x0047c590`, which installs this beneath the same funding-label family.","objdump + local disassembly + caller correlation + control-id correlation + callback-latch correlation"
0x0047c3a0,1573,start_new_company_dialog_handle_message,shell,thiscall,inferred,objdump + local disassembly + caller correlation + control-id correlation,2,"Primary message dispatcher for the `Start New Company` dialog family. The current grounded control split is narrower now: the helper handles shell messages `0xca/0xcb`, routes control `0x714b` into the staged company-name buffer at `0x006cebd8`, routes the two funding-step controls `0x714c/0x714d` through the local step selector around `0x005f2c48` and the `0x714e` summary lane, and keeps the confirmation or warning branch rooted at ids `0x03f2/0x03f4` on the modal-notice side through `0x004c98a0`. The handler also reuses the funding-band family through `0x0047c220` and the staged funding globals `0x006cec14/0x006cec10`, so the safest current read is the dialog's main message owner rather than a narrow name-field callback.","objdump + local disassembly + caller correlation + control-id correlation + funding-band correlation + modal-notice correlation"
0x0047c590,2631,start_new_company_dialog_construct,shell,thiscall,inferred,objdump + local disassembly + caller correlation + control-id correlation,2,"Constructs the modal `Start New Company` dialog instance used by `0x0047d080`. The constructor publishes the live dialog root at `0x006cec18`, builds the staged funding summary controls `0x714f`, `0x7150`, `0x7149`, and `0x714a`, installs the funding callback `0x0047c360` on the two band controls, seeds the staged company-name field `0x714b`, the step or arrow family `0x714c/0x714d`, and the companion summary lane `0x714e`, and allocates the required child-control payload blocks through the `0x0053b070 -> 0x0055ba70/0x0055ab50/0x0055a040/0x00540430` constructor strip before registering them through `0x0053f9c0`. Current grounded caller is the pre-open modal path at `0x0047d0fd`, so this is the clean dialog constructor above the funding-band and name-buffer helpers rather than a generic shell child builder.","objdump + local disassembly + caller correlation + control-id correlation + constructor-strip correlation"
0x0047d020,92,start_new_company_dialog_prepare_name_buffer_and_funding_bands,shell,cdecl,inferred,objdump + local disassembly + caller correlation + field correlation,2,"Pre-open preparation helper for the `Start New Company` dialog. The helper optionally resolves one staged name buffer through `0x0055ba70`, publishes that text through `0x0053f9c0`, frees the temporary heap copy through `0x005a1145`, and then rebuilds the dialog's funding-band state through the clustered sequence `0x0047c070(1) -> 0x0047bea0(1) -> 0x0047c220(0) -> 0x0047bea0(1) -> 0x0047c220(0) -> 0x0047bea0(0)`. This is the strongest current read for the start-company pre-open seed path directly above `start_new_company_dialog_open` `0x0047d080`.","objdump + local disassembly + caller correlation + field correlation + pre-open funding-band correlation"
0x0047d080,186,start_new_company_dialog_open,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Opens the shell-side `Start New Company...` dialog rooted at localized id `574`. The helper rolls one persona-dependent shell color or portrait token through a small static table, allocates the modal shell window through the constructor/callback pair `0x0047c590` and `0x0047c3a0`, increments the scenario-side start-company generation counter at `[0x006cec78+0x41]`, and enters the shared callback-driven modal path through `shell_open_custom_modal_dialog_with_callbacks` at `0x004c98a0`. Current grounded caller is the company-list window handler at `0x004c6f30`, which reaches this helper from the synthetic company-row id `0x7fff` after optional resignation confirmation through localized string `272` `You're currently chairman of the %1... Proceed?`. The older claim that this helper stored one live dialog owner at `0x006d3b4c` is no longer supported by direct disassembly; current stronger evidence treats `0x006d3b4c` as part of the broader shell tutorial state family instead.","objdump + RT3.lng strings + caller inspection + modal-path inspection + tutorial-state correction"
0x0047d120,509,start_new_company_dialog_commit_create_company,shell,cdecl,inferred,objdump + caller inspection + company-constructor inspection,4,"Commits the shell-side `Start New Company...` dialog and creates one fresh live company record rather than claiming one of the pre-seeded named railroads. After validating the dialog state it resolves the selected chairman-profile summary from `0x006cec78`, unlinks any existing company from that chairman through `0x00427c70`, allocates a new company id from the live company collection at `0x0062be10`, formats the dialog-owned company-name buffer at `0x006cebd8`, and initializes the new company through `0x00428420`. It then clamps one startup-funding lane against the new company's local limit fields, writes the chosen funding back to `0x006cec14`, updates one per-profile financing slot at `[profile+company_id*4+0x15d]`, applies the resulting debt through `0x00476050`, publishes the new selected company id through `0x00433790`, and triggers one shell refresh through `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with trigger kind `7`. When the dialog instead diverts into the `0x3f2` side path, it packages the same staged company payload into the Multiplayer preview request owner at `0x006cd8d8` through `0x00469d30`.","objdump + caller inspection + company-constructor inspection + global-state correlation + runtime-effect trigger-kind correlation"
0x0047d320,280,start_new_company_request_create_company,map,thiscall,inferred,objdump + caller inspection + company-constructor inspection,4,"Creates one fresh company record from a compact startup-company request block. The request layout is now partly grounded: `[this+0x0]` is the chairman profile id in `0x006ceb9c`, `[this+0x4]` is the localized railroad-name id or equivalent name token, `[this+0x8]` plus `[this+0xc]` form the startup-funding total later divided by the new company rate lane, and `[this+0x10]` is the staged company-name buffer. The helper unlinks any existing company from the referenced chairman through `0x00427c70`, allocates a fresh company id from the live company collection at `0x0062be10`, initializes that company through `0x00428420`, and updates one per-profile financing slot at `[profile+company_id*4+0x15d]`. If the request chairman matches the current selected chairman summary from `0x006cec78`, it also publishes the new selected company id through `0x00433790`. The surrounding startup-company owner is tighter now too: the neighboring post-create branch at `0x0047d42b` immediately re-enters `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with trigger kind `7`. Current grounded caller is the neighboring startup-company branch at `0x00470e48`, which reaches this helper when the request cannot be resolved to an existing company record.","objdump + caller inspection + company-constructor inspection + global-state correlation + runtime-effect trigger-kind correlation"
0x0047df70,208,placed_structure_service_candidate_local_service_comparison_cache_decay_and_row_propagation,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Broad aging and propagation pass over the placed-structure local service-comparison cache bands. The helper first resolves the optional linked placed instance through `0x00455f60`, then walks all `0x35` candidate lanes in the paired float tables rooted at `[this+0x3e]` and `[this+0x112]`, comparing their age stamps at `[this+0x1e6]` against the current scenario tick `[0x006cec78+0x15]`: entries older than `0x1d8800` are zeroed, while younger positive entries are decayed by the fixed scales at `0x005ce900` and `0x005ce8f8`. It then walks the three five-float row bands referenced by `[this+0x24]`, `[this+0x28]`, and `[this+0x2c]`, bumps active rows by the small constant at `0x005c9f18`, and propagates stronger marked row values back into the current site when the peer row-marker bytes at offsets `+0x04`, `+0x09`, `+0x0e`, or `+0x13` are set. Current grounded caller is the world-side sweep at `0x0040a6aa`, immediately before the same pass re-enters `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with trigger kind `3`, so this is the safest current read for the recurring local-service comparison-cache service pass rather than a one-off overlay helper.","objdump + caller xrefs + local disassembly + cache-age correlation + marked-row propagation correlation"
0x0047e240,240,placed_structure_query_candidate_local_service_metrics,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Queries one candidate-specific local service metric pair for the current placed-structure or site context. The helper first resolves the requested candidate index through the live structure collection at `0x0062ba8c` and rejects entries that fail `structure_candidate_is_enabled_for_current_year` at `0x0041e220`; on rejection it returns `0`, writes count `0` to the optional first out-pointer, and writes fallback float `1.0` to the optional second out-pointer. For live candidates it resolves the optional linked placed instance at `[this+0x04]`, passes that context through `0x00455f60`, and queries the base integer metric through `0x0042c960`; when the caller has a nonzero local sample list at `[this+0x38]` and `[this+0x34]`, it then accumulates matching per-cell float contributions from the world-grid table rooted at `[0x0062c120+0x2129]` into the second out-value. Current grounded callers include the shell or world-side branches at `0x0043f72e`, `0x0043f936`, `0x0047e365`, `0x0047ecd3`, `0x0047faff`, `0x004ba072`, `0x004bb51c`, and `0x00504d0f`, so this now looks like the first higher-level site query above the cargo-service bitset lane rather than another raw editor-runtime helper.","objdump + caller xrefs + callsite inspection + world-grid correlation"
0x0047e330,96,placed_structure_count_candidates_with_local_service_metrics,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Counts how many live structure candidates currently produce a valid local service-metric result for the current placed-structure or site context. The helper walks the full candidate collection at `0x0062ba8c`, resolves each entry id through `0x00518380`, and reuses `placed_structure_query_candidate_local_service_metrics` at `0x0047e240` with null out-pointers; it increments the return value only when that lower query succeeds. Current grounded callers keep this in the same site-query family as `0x0047e240`, so it now looks like the bounded count wrapper above the candidate-local service-metric lane.","objdump + caller xrefs + callsite inspection"
0x0047e390,656,placed_structure_query_cached_express_service_class_score,map,thiscall,inferred,objdump + caller xrefs + string correlation + callsite inspection,3,"Cached site-side query for one express-service class score. The helper special-cases request ids `0x384`, `0x385`, and `0x386` through three cached float-plus-timestamp pairs at `[this+0x14]/[+0x20]`, `[this+0x10]/[+0x1c]`, and `[this+0x0c]/[+0x18]`; when a cached value is younger than `0x0b40` ticks it returns immediately. On a cold path it scans all `0x35` live structure candidates, uses `0x0041e260` to keep only candidates that match the requested class, and then accumulates local per-cell contributions from the repeated sample list at `[this+0x34]` and the same world-grid tables under `[0x0062c120+0x2129]`. Nearby strings now strongly align the three class ids with the express cargo family `Passengers`, `Mail`, and `Troops`, but current grounded callers still treat this as a generic class-score query rather than a fully named UI lane. Current grounded callers include the shell or world-side branches at `0x00506c2d`, `0x00506c3d`, `0x00506e97`, and `0x00506ebf`.","objdump + caller xrefs + string correlation + callsite inspection + express-family correlation"
0x0047e620,112,placed_structure_get_nth_candidate_id_with_local_service_metrics,map,thiscall,inferred,objdump + caller xrefs + local disassembly + callsite inspection,3,"Resolves the `n`th live structure candidate that currently produces a valid local service-metric result for the current placed-structure or site context. The helper walks the full candidate collection at `0x0062ba8c`, resolves each entry id through `0x00518380`, reuses `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`, and decrements the caller-supplied ordinal only on successful matches before returning the surviving candidate id. Current grounded callers keep this firmly on the read-side: `shell_station_detail_refresh_candidate_service_rows` `0x00505760` uses it to enumerate the visible service rows, while `company_rebuild_linked_transit_autoroute_site_score_cache` `0x00407bd0` uses it to walk the bounded candidate-local amount and scaling bands that feed the downstream site-ranking cache. That makes this the ordinal selector sibling above the local service-metric query rather than a mutation-side helper.","objdump + caller xrefs + local disassembly + callsite inspection + station-row correlation + company-score-cache correlation"
0x0047eb90,1048,placed_structure_refresh_candidate_local_service_comparison_cache_against_peer_site,map,thiscall,inferred,objdump + caller xrefs + local disassembly + callsite inspection,3,"Rebuilds one per-candidate local service comparison cache for a `(current site, peer site)` pair. The helper resolves both sites' linked placed instances through `0x00455f60`, scans the full candidate collection at `0x0062ba8c`, filters candidates through `0x0041e260` plus `placed_structure_query_candidate_local_service_metrics` `0x0047e240`, and then computes several bounded float bands in three stack-local `0x35`-entry arrays before blending the result back into the caller-owned cache at `[this+0x3e]`, `[this+0x112]`, and `[this+0x1e6]`. The grounded caller at `0x004adcf5` immediately follows this rebuild by reading directional route-summary state through `0x0047de50` and `0x0047de90`, which keeps this helper on the comparison or preview side of the site-service family rather than the mutation side.","objdump + caller xrefs + local disassembly + callsite inspection + peer-site comparison correlation + route-summary correlation"
0x0047f910,1080,placed_structure_select_best_candidate_id_by_local_service_score,map,thiscall,inferred,objdump + caller xrefs + local disassembly + callsite inspection,3,"Selects the strongest candidate id for the current placed-structure or site context under one caller-supplied candidate-class filter. The helper scans the live candidate collection at `0x0062ba8c`, keeps only candidates allowed by `0x0041e260`, and scores each survivor through either the direct local-service query `0x0047e240` or the heavier directional-route helper `0x0047e690` when route-backed state is present. It then applies the current shell or world-mode gates from `0x006cec74`, `0x006cec78`, and `0x006cec7c`, tracks the best candidate id and one parallel winner flag, and optionally writes the selected id or winner-state back through caller-owned out-pointers. Current grounded callers at `0x004ac8d6` and `0x004ac917` use it as a best-candidate selector inside a larger service-summary or preview family, which keeps it on the read-side selection path rather than the mutation path.","objdump + caller xrefs + local disassembly + callsite inspection + route-helper correlation + shell-gate correlation"
0x0047dda0,83,placed_structure_linked_route_entry_dispatch_primary_or_secondary_vfunc_if_anchor_slots_empty,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Linked-peer route-entry dispatcher beneath the placed-structure linked-site maintenance family. The helper reads route-entry anchor id `[this+0x08]` from the caller-supplied linked peer, resolves that anchor through the live route-entry collection `0x006cfca8`, and then re-enters `0x0048a090` with stack flag `1`. Only when that gate reports false does it dispatch one of two route-entry vtable calls on the resolved route-entry object: stack flag nonzero takes vtable `+0x4`, stack flag zero takes vtable `+0x8`. Current grounded callers are the paired placed-structure helpers `0x0040dba0` and `0x0040dbf0`, so this is the safest current read for the narrower linked-peer route-entry state dispatcher rather than a route builder.","objdump + caller xrefs + local disassembly + linked-route-entry-dispatch correlation"
0x0047fd50,60,placed_structure_is_station_or_transit_site_class,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Boolean class allowlist over one linked placed-structure record. The helper resolves the linked peer id at `[this+0x04]` through the live placed-structure collection `0x0062b26c`, re-enters that peer's candidate vtable `+0x80`, reads candidate class byte `[candidate+0x8c]`, and returns true only for class values `0`, `1`, or `2`; values `3`, `4`, and anything above `4` fail. Current grounded callers include the linked-transit company cache family at `0x00408280`, `0x00408f70`, and `0x004093d0`, the `cargo id 0` bypass branch inside the placed-structure sweep at `0x00452e60`, the nearby-site bucket builder `0x0047fdb0`, the linked-transit reachability gate `0x004801a0`, and the linked-site display-name or route-anchor refresh at `0x00480bb0`, so this is the safest current read for the narrower station-or-transit class gate rather than a route-reachability helper.","objdump + caller xrefs + callsite inspection + candidate-class correlation"
0x0047f320,1511,placed_structure_rebuild_local_service_sampled_cell_list_and_reset_route_link_scratch,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Broader linked-site runtime rebuild owner over the sampled local-service cell list rooted at `[this+0x34]/[this+0x38]`. The helper resolves the effective comparison mode from the linked candidate class byte `[candidate+0x8c]` unless the caller overrides it, derives one radius threshold from current world coordinates `[this+0x4a8/+0x4ac]`, frees the prior sampled-cell buffer at `[this+0x34]`, always clears the route-link scratch pair `[this+0x462/+0x466]`, and then scans one bounded world-grid rectangle through `[0x0062c120+0x2129]` with per-cell distance measured by `math_measure_float_xy_pair_distance` `0x0051db80`. For accepted cells it emits one temporary twelve-byte `(grid x, grid y, sampled score)` row through `0x0042b190`, `0x0042c530`, and `0x0042c580`; when caller arg0 is zero it then compacts one representative subset of those temporary rows into a newly allocated persistent list at `[this+0x34]` and stores the surviving row count in `[this+0x38]`, while nonzero arg0 callers use the same helper as a clear-and-scan companion without the final materialization step. Current grounded callers are the linked-site refresh and teardown strip at `0x00480542`, `0x004805c2`, `0x00480727`, and `0x004807e2`, so this is the safest current read for the local sampled-cell list rebuild plus route-link scratch reset rather than a plain route-entry-list clear helper.","objdump + caller xrefs + callsite inspection + local-service sampled-cell correlation + linked-site-runtime correlation"
0x0047e690,784,placed_structure_query_candidate_directional_route_overlay_summary,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Builds the heavier directional route-summary channel used by the station-detail candidate-service overlay when the active candidate carries a nonzero route-style byte at `[candidate+0x46]`. The helper converts one caller-supplied distance or bucket limit into a capped step count up to `0x28`, resolves the requested candidate's grouped routing class from `0x0062ba8c+0x9a`, then walks the current placed structure's linked route list at `[this+0x466]` and follows each route-linked placed structure through the live instance collections at `0x0062b26c` and the route-link collection `0x006ada90`. For matching class entries it re-enters `0x004676a0` to measure one directional route value against the peer placed-structure argument, keeps the strongest bounded values in a sorted local lane, and finally accumulates those kept route values into the caller-owned out-pointers. Current grounded overlay callers at `0x0043f89a` and `0x0043f8ee` invoke it in both directions between the preview station and each scanned placed structure before `world_render_station_candidate_service_map_overlay` turns those two returned channels into the `Coming To` and `Going From` legend rows.","objdump + caller xrefs + callsite inspection + overlay-caller correlation + legend-correlation + route-link-collection correlation"
0x0047e9a0,315,placed_structure_query_candidate_route_or_local_service_comparison_score,map,thiscall,inferred,objdump + caller xrefs + local disassembly + callsite inspection,2,"Bridges the heavier directional-route overlay summary path and the simpler local-service comparison lane. When the requested candidate carries a grouped routing class at `0x0062ba8c+0x9a`, the helper forwards the full query to `placed_structure_query_candidate_directional_route_overlay_summary` `0x0047e690` with the final flag forced to `0`. Otherwise it resolves the current placed structure's linked instance through `0x00455f60`, samples the current site's local float table at `[cell+0x103]` for the requested candidate lane, optionally re-enters `0x0042c080` on each local sample record at `[this+0x34/+0x38]`, and writes the bounded result back into the same comparison-cache bands rooted at `[this+0x1e6]`, `[this+0x2ba]`, and `[this+0x38e]`. Current grounded caller is the candidate-side score branch at `0x0041bbe2`, so this is the safest current read for the route-or-local comparison wrapper above `0x0047e690` rather than another route-list helper.","objdump + caller xrefs + local disassembly + callsite inspection + cache-band correlation"
0x0047d440,845,world_conditionally_seed_named_starting_railroad_companies,map,cdecl,inferred,objdump + caller xrefs + global-state inspection,4,"Conditional company-side setup helper adjacent to the `Setting up Players and Companies...` lane. Current grounded callers are the neighboring bring-up flow after world_seed_default_chairman_profile_slots at `0x004377a0` and a second setup-side branch around `0x00438300`, both under the same sandbox or non-editor shell-state conditions: it runs only when the Multiplayer preview dataset owner at `0x006cd8d8` is absent and either sandbox flag `[0x006cec7c+0x82]` is set or shell-state flag `[0x006cec74+0x14c]` is set while editor-map mode `[0x006cec74+0x68]` is clear. The helper first realigns the selected company from the chosen chairman profile when the current summary pair points at a missing company, then iterates exactly three fixed localized railroad-name ids through `0x00428420`: `0x23f` `Missouri Pacific`, `0x240` `New York Central`, and `0x241` `Grand Trunk Railroad` from `RT3.lng` ids `575..577`. That makes the branch look like a seeded trio of named starting railroad companies rather than a generic company refresh. The first seeded company is tied to the selected chairman-profile summary from `0x006cec78`, tuned from that selected chairman's per-profile fields `[profile+0x154]` and `[profile+0x158]`, and then written back as the selected company id through `0x00433790`. The second company is narrower now too: it only binds when `profile_collection_count_active_chairman_records` at `0x00477820` reports at least two live chairman records, and it then links through `profile_collection_get_nth_active_chairman_record` at `0x00477860` with ordinal `1`, so the second railroad is specifically the second active chairman-owned company rather than an arbitrary extra bind. The third railroad currently gets no matching chairman-link branch in the grounded code and therefore remains an unchaired named company in the live roster. All three records are constructed or refreshed from the live company collection at `0x0062be10` through `0x00428420`, while chairman-to-company ownership links are applied through `0x00427c70` and neighboring writes to `[profile+0x1dd]`. The tail is tighter now too: once at least three startup companies have been considered, the branch at `0x0047d6de` re-enters `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with trigger kind `7`.","objdump + caller xrefs + global-state inspection + state-accessor correlation + RT3.lng strings + company-constructor inspection + profile-helper inspection + runtime-effect trigger-kind correlation"
0x0047efe0,28,placed_structure_query_linked_company_id,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Returns the owning company id for one placed structure when a linked placed-instance record is present. The helper resolves `[this+0x04]` through the live placed-instance collection at `0x0062b26c` and then returns the company-like field at `[instance+0x276]`; when no linked instance is present it falls back to `0`. Current grounded callers include the station candidate-service overlay at `0x0043fff7`, where the returned company id is compared against the active company selector before the overlay chooses whether a scanned site should carry the `Already Connected by Another Company` note.","objdump + caller xrefs + callsite inspection + overlay-owner correlation"
0x0047f010,195,placed_structure_append_unique_route_entry,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Appends one unique six-byte route-entry record onto the placed-structure route list rooted at `[this+0x462]` and `[this+0x466]`. The helper first scans the existing list for the incoming leading `u16` key and returns early on duplicates; otherwise it allocates a new `(count*6)+6` byte buffer, copies the existing records, writes the new `u16` key at offset `+0x0` and the caller-supplied `u32` payload at `+0x2`, frees the previous buffer, and increments the route-entry count. Current grounded callers include the placed-structure side at `0x0042c554`, which walks the linked instance chain through `[site+0x0d6]` and `[instance+0x2a2]` while appending entries, and the world-side branch at `0x0040db7d`, which appends one selected placed-structure id plus a companion payload from a route-like table. This is therefore the current reusable append-if-missing helper above the route-entry list later consumed by `placed_structure_query_candidate_directional_route_overlay_summary` at `0x0047e690`.","objdump + caller xrefs + callsite inspection + buffer-layout correlation"
0x0047f0e0,131,placed_structure_resolve_linked_instance_secondary_raster_class_record,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Resolves one secondary-raster class record for the current placed structure's linked instance coordinates. The helper resolves `[this+0x04]` through the live placed-instance collection `0x0062b26c`, reads the linked instance's normalized coordinate pair through `0x00455800` and `0x00455810`, indexes the active secondary-raster byte plane at `[0x0062c120+0x2131]`, shifts the selected byte right by three, and resolves the resulting class token through collection `0x006cfc9c`. Current grounded callers are the world-side station or site branches at `0x004ac0bd` and `0x004ac11b`, so this is the safest current read for the direct linked-instance secondary-raster class-record wrapper rather than a generic terrain query.","objdump + caller xrefs + local disassembly + linked-instance-coordinate correlation + secondary-raster-class correlation"
0x0047f170,119,placed_structure_query_linked_instance_secondary_raster_class_id,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Returns the raw secondary-raster class id for the current placed structure's linked instance coordinates. The helper resolves `[this+0x04]` through `0x0062b26c`, reads the same linked-instance coordinate pair through `0x00455800` and `0x00455810`, indexes the live secondary-raster byte plane at `[0x0062c120+0x2131]`, and returns the selected byte shifted right by three without resolving it through `0x006cfc9c`. Current grounded callers at `0x004816dd` and `0x00487aa6` use it as the raw class gate beneath the station-or-transit and linked-company filters, so this is the safest current read for the linked-instance secondary-raster class-id query rather than a route-anchor helper.","objdump + caller xrefs + local disassembly + linked-instance-coordinate correlation + secondary-raster-class correlation"
0x0047f1f0,95,placed_structure_resolve_linked_instance_secondary_raster_class_record_via_world_query,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Thin linked-instance wrapper over the world-side secondary-raster class lookup `0x0044e270`. The helper resolves `[this+0x04]` through `0x0062b26c`, samples the linked instance's normalized coordinate pair through `0x00455800` and `0x00455810`, and then forwards those coordinates into the live world root at `0x0062c120`. Current grounded callers at `0x00487af1` and `0x00487b2c` use the returned class record as the companion object-side discriminator beside the raw class-id gate `0x0047f170`, so this is the safest current read for the record-returning linked-instance terrain wrapper.","objdump + caller xrefs + local disassembly + linked-instance-coordinate correlation + world-query correlation"
0x0047f250,60,placed_structure_route_anchor_matches_or_reaches_route_entry_id,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Boolean route-entry-anchor gate over one placed structure. The helper first compares the caller-supplied route-entry id against the current site's cached route-entry anchor at `[this+0x08]`; on a direct match it returns true immediately. Otherwise it resolves that cached anchor through the live route-entry collection `0x006cfca8` and re-enters `0x0048e050` with mode `2` and fallback `-1`, then normalizes the result to a strict boolean. Current grounded callers include the world-side branches at `0x0042ff29` and `0x0044bc0e`, where it gates later linked-instance or route-style work, so this is the safest current read for the placed-structure route-anchor match-or-reachability gate rather than a plain id compare.","objdump + caller xrefs + local disassembly + route-entry-anchor correlation + reachability-helper correlation"
0x0047f290,59,placed_structure_set_overlay_mark_byte_and_refresh_linked_peer_overlay_if_changed,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small setter over placed-structure byte `[this+0x5bc]`. When the caller-supplied byte differs from the current value, the helper stores the new byte and then resolves the linked instance at `[this+0x04]` through `0x0062b26c` before re-entering `placed_structure_refresh_linked_peer_overlay_when_linked_peer_flagged` `0x0040d2d0`. Current grounded callers include the world-side branches at `0x004ae424` and `0x004b2260`, which use it while toggling selected-site or route-preview state, so this is the safest current read for the shared overlay-mark setter rather than a route-entry mutation helper.","objdump + caller xrefs + local disassembly + linked-peer-overlay correlation"
0x0047f2d0,47,route_link_route_entry_reaches_peer_site_route_group,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Boolean route-group compatibility gate over one route-link record. The helper resolves the caller-supplied peer site id through the live placed-structure collection `0x006cec20`, reads that site's cached route-entry anchor from `[site+0x08]`, resolves the current route-link record's own anchor from `[this+0x08]` through the live route-entry collection `0x006cfca8`, and then re-enters `0x0048e3c0` to test whether the two anchors belong to the same reachable route-side family. Current grounded caller is `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30`, so this is the safest current read for the route-link-side peer reachability check beneath the endpoint-pair state reconciler.","objdump + caller xrefs + local disassembly + route-link correlation + route-group correlation"
0x0047f310,15,placed_structure_resolve_route_entry_anchor_record,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Tiny cached-record resolver over the placed structure's route-entry anchor id at `[this+0x08]`. The helper resolves that id directly through the live route-entry collection `0x006cfca8` and returns the resulting route-entry record. Current grounded callers include the linked-peer status and action branches `0x0040e54f` and `0x0040e907`, the city bonus filter at `0x004201aa`, and the later peer-route scan at `0x00487b6a`, so this is the safest current read for the direct route-entry-anchor resolver rather than a route-builder owner.","objdump + caller xrefs + local disassembly + route-entry-anchor correlation"
0x0048a090,65,route_entry_has_any_bound_anchor_slot_pair_or_triplet,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Small boolean gate over one route-entry record. With caller flag `0`, the helper returns true when either route-entry dword `[this+0x206]` or `[this+0x20a]` is not `-1`; with caller flag nonzero, it only returns false when all three dwords `[this+0x206]`, `[this+0x20a]`, and `[this+0x20e]` equal `-1`. Current grounded callers include the linked-peer route-entry dispatcher `0x0047dda0`, the placed-structure rebuild lane inside `0x0040ef10`, several linked-site route-anchor refresh branches around `0x00480603/0x00480927/0x00480993/0x00480be5`, the route builder family near `0x0049bbf2/0x0049d5a8/0x0049dc50/0x0049ded9`, and one later shell-side branch at `0x0050de1a`. This is therefore the safest current read for a route-entry anchor-slot occupancy gate rather than a placement or cargo predicate.","objdump + caller xrefs + local disassembly + route-entry-anchor-slot correlation"
0x00483f70,352,shell_service_pump_iteration,shell,thiscall,inferred,objdump + analysis-context,4,Executes one outer shell-service iteration on the shell state rooted at 0x006cec74. The helper can queue service event 0xcc through the shell bundle at 0x006d4018 polls that bundle through 0x00483ea0 refreshes active-mode or shell-state flags ensures the controller work pointer [0x006d4024+0x28] defaults to 0x0062be68 runs several global maintenance helpers and auxiliary cleanup then dispatches shell_state_service_active_mode_frame; when shell-state flag [this+0x501] is set it also marks the controller layout dirty through 0x0051f070 before returning the loop-continue result. bootstrap_init_shell_window_services calls it in the repeating shell loop that appears to own the observed shell lifetime before teardown.,objdump + analysis-context + caller xrefs
0x00485750,14,shell_has_tiger_tank_viewer,shell,cdecl,inferred,ghidra-headless,4,Returns whether the dedicated TigerTank shell viewer object at 0x006cfc8c is currently active. The 0x7533 open and 0x7534 close commands both gate on this global before showing status text or mutating viewer state.,ghidra + rizin + llvm-objdump + strings
0x004840e0,863,bootstrap_init_shell_window_services,bootstrap,cdecl,inferred,ghidra-headless,4,Consumes the early bootstrap object then allocates and installs the shell service bundle rooted at 0x006d4024 seeds a 640x480 fallback and enters the bootstrap-owned shell loop around shell_service_pump_iteration at 0x00483f70 until shell state [this+0x10] changes; after each break it drives the next shell mode transition through 0x00482ec0 and when the shell lifetime finally ends it tears the shell bundle back down through 0x00521390 before returning to app_bootstrap_main.,ghidra + rizin + llvm-objdump
0x00484440,323,app_bootstrap_main,bootstrap,cdecl,inferred,ghidra-headless,4,Primary post-CRT bootstrap coordinator; initializes COM and branding strings probes host state allocates the shell state at 0x006cec74 and then hands shell execution into bootstrap_init_shell_window_services. After that helper returns it releases the shell globals and finishes the remaining process-tail cleanup before exiting back through the CRT.,ghidra + rizin + llvm-objdump
0x00484590,887,shell_init_graphics_preset_state,shell,cdecl,inferred,ghidra-headless,3,Initializes the shell graphics-preset state block rooted at [this+0x70]. It clears a large option buffer seeds many default fields and applies one of three coarse mode layouts from its integer argument before later preset application or config-save helpers continue.,ghidra + rizin + llvm-objdump
0x00484910,105,shell_save_graphics_config,shell,cdecl,inferred,ghidra-headless,4,Persistently writes the current shell graphics configuration to data\\configuration\\game.cfg. It optionally syncs the global display runtime through 0x0051eea0 then writes config keys 0x429 and 0x48d from the shell state block before closing the file.,ghidra + rizin + llvm-objdump + strings
0x00484980,212,shell_load_graphics_config_or_init_defaults,shell,cdecl,inferred,ghidra-headless,4,Loads the shell graphics configuration from data\\configuration\\game.cfg during early shell setup. It optionally pulls the larger display-runtime blob through 0x0051ef20 validates key 0x429 reads key 0x48d into the shell state block at [this+0x70] and falls back to 0x00484590 plus 0x00484910 when the file is missing or invalid.,ghidra + rizin + llvm-objdump + strings
0x00484a60,125,shell_match_legacy_gpu_profile_token,shell,cdecl,inferred,ghidra-headless,4,Collects the current display-adapter descriptor string then scans the legacy GPU-profile table at 0x0062142c for the first matching token. The table contains vendor and chipset strings such as geforce radeon Voodoo matrox i810 sis savage and 3dfx; the returned index or -1 then drives the preset-tier tables in 0x004853c0.,ghidra + rizin + llvm-objdump + strings
0x00484d70,700,shell_apply_graphics_option_runtime_effects,shell,thiscall,inferred,ghidra-headless,3,Walks the pending graphics-option array rooted at [this+0x1c] and applies runtime side effects for the dirty entries selected by the caller mask. The cases fan into the active engine object at 0x0062c120 and shell globals under 0x006d4024 and 0x006d4030 updating several float scaled thresholds integer quality values and display capability bytes before clearing the dirty array and notifying the active shell object at 0x0062be68.,ghidra + rizin + llvm-objdump
0x004852e0,210,shell_apply_default_graphics_master_profile,shell,thiscall,inferred,ghidra-headless,4,Reads the default master graphics profile value from 0x006211dc currently 6 and broadcasts it across option ids 1 through 16 in the shell settings block. Special option ids 10 11 12 and 13 are remapped through the preset tables at 0x00621250 through 0x00621358 before the function refreshes runtime side effects through 0x00484d70 updates shell display-profile flags under 0x006d4024 and persists game.cfg through 0x00484910.,ghidra + rizin + llvm-objdump
0x004853c0,740,shell_apply_graphics_preset_bundle,shell,cdecl,inferred,ghidra-headless,4,Applies one table-driven graphics preset bundle to the shell settings object. It derives a preset tier from shell state and runtime capability probes then writes per-setting values through repeated 0x00485060 calls refreshes dependent runtime state through 0x00484d70 optionally saves game.cfg through 0x00484910 and updates several display capability flags under 0x006d4024.,ghidra + rizin + llvm-objdump
0x00485060,635,shell_set_graphics_option_with_fanout,shell,thiscall,inferred,ghidra-headless,4,Writes one graphics option value into the shell settings arrays at [this+0xac] and coordinates grouped fanout updates. Primary preset selectors recursively expand into dependent option ids 1 through 16 using preset remap tables at 0x00621250 through 0x00621358. The function compares the new normalized value against the previous setting invokes 0x00484d70 when a runtime refresh is needed and persists game.cfg through 0x00484910 once the update batch completes.,ghidra + rizin + llvm-objdump
0x00485760,2746,vehicle_visual_init_running_gear_and_smoke_effects,bootstrap,thiscall,inferred,ghidra-headless,4,Builds a larger vehicle visual bundle covering running-gear assets smoke effects and attachment-audio objects. The routine fills indexed road-wheel visual arrays from RoadWheelR and RoadWheelL asset strings creates direct MuzzleSmoke and ExhaustSmoke sprite emitters at [this+0x216] and [this+0x21a] and then creates five fixed attachment objects at [this+0x3cc] through [this+0x3dc] for diesel1 tracks german88 turret and mantlet audio assets before registering them on the owner.,ghidra + rizin + llvm-objdump + strings
0x004858e0,1677,vehicle_visual_build_exhaust_running_gear_track_and_mantlet_attachment_children,bootstrap,thiscall,inferred,objdump + local disassembly + rdata literal inspection,2,"Broader vehicle-side child-builder under `vehicle_visual_init_running_gear_and_smoke_effects` `0x00485760`. The helper formats and allocates one attachment child for `%1_ExhaustSmoke.3dp`, one payload record for `%1_MuzzleFlash.3dp`, then builds and registers a larger running-gear strip including `%1_RoadWheelL%2.3dp`, `%1_RoadWheelR%2.3dp`, `%1_IdlerWheelL.3dp`, `%1_IdlerWheelR.3dp`, `%1_DriveWheelL.3dp`, `%1_DriveWheelR.3dp`, `%1_TrackL.3dp`, `%1_TrackR.3dp`, and `%1_MantletLight1.3dp`. Along that path it publishes child handles through `0x0052d8a0/0x0052d9a0`, derives local triplet bands through `0x0052e780`, and uses `0x0052db10/0x0052dc00` to materialize and threshold-bucket grouped packet rows on the two running-gear child roots at `[this+0x232]` and `[this+0x236]`. Current evidence is strongest for the exhaust, wheel, track, and mantlet attachment-child builder rather than the top-level vehicle visual constructor itself.","objdump + local disassembly + rdata literal inspection + vehicle-visual correlation + grouped-subrecord correlation"
0x004883f0,325,scenario_text_export_append_numbered_entry,scenario,cdecl,inferred,ghidra-headless,4,Formats and appends one numbered translation entry into the scenario-text export buffer. It duplicates the source text applies the export wrapper template through helper formatters and appends the finished block through 0x531030 while updating the running non-comment word count at 0x006cfca0.,ghidra + rizin + llvm-objdump + strings
0x004886e0,3796,scenario_text_export_build_language_file,scenario,cdecl,inferred,ghidra-headless,4,Builds one MAPS\\%s.lng scenario-text export for the active map and returns the non-comment word count. It writes translator guidance and section headers then walks map briefing territory city geographic-label station company and event collections appending numbered entries through 0x004883f0 before finalizing the output buffer.,ghidra + rizin + llvm-objdump + strings
0x00487450,153,shell_open_tiger_tank_viewer,shell,cdecl,inferred,ghidra-headless,3,Allocates and shows the dedicated TigerTank shell viewer object when no viewer is active. It samples shell-owned placement data allocates a 0x434-byte object initializes it through 0x00485760 with the TigerTank title and stores the resulting viewer pointer in 0x006cfc8c.,ghidra + rizin + llvm-objdump + strings
0x004874f0,70,shell_close_tiger_tank_viewer,shell,cdecl,inferred,ghidra-headless,4,Closes and frees the dedicated TigerTank shell viewer rooted at 0x006cfc8c. It detaches the viewer if currently selected in the shell owner at 0x0062be68 destroys its internal resources through 0x00530680 frees the object and clears the global viewer slot.,ghidra + rizin + llvm-objdump + strings
0x00489830,496,scenario_text_export_report_language_file,scenario,cdecl,inferred,ghidra-headless,3,Opens one existing MAPS\\%s.lng file for the selected map and reports on its parsed contents without rebuilding it. The routine loads the file into memory iterates numbered entries through 0x00488540 formats summary strings through 0x004895c0 and presents success or failure dialogs when interactive mode is enabled.,ghidra + rizin + llvm-objdump + strings
0x00489a20,1085,scenario_text_export_batch_process_maps,scenario,cdecl,inferred,ghidra-headless,4,Enumerates maps\\*.gmp and batch-processes every scenario through the scenario-text export branch. Command 0x7542 runs the build path through 0x004886e0 while command 0x7543 runs the report path through 0x00489830; the wrapper tracks progress formats per-map status strings and emits a final summary dialog.,ghidra + rizin + llvm-objdump + strings
0x004bfb30,956,shell_format_company_financial_summary_card,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Reusable shell company financial-summary formatter shared by `CompanyDetail.win` and the company-list row lane. The helper resolves the linked chairman and current selected profile through `0x006cec78` and `0x006ceb9c`, highlights the card when the company belongs to the selected chairman, formats the visible company header text, and then renders a compact three-row finance block under localized ids `633` `Cash:`, `607` `Revenue:`, and `925` `Profits:`. The grounded metric mapping is now tighter too: `Cash:` comes from `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` with slot `0x0d` and stat-family selector `0x2329`, `Revenue:` comes from the same reader with slot `0x2c`, and `Profits:` comes from slot `0x2b`; the revenue and profit rows also switch color when the readback is negative. Grounded callers are `shell_company_detail_render_company_summary_card` at `0x004c1ab0` and `shell_company_list_format_company_or_start_row` at `0x004c6b40`.","objdump + RT3.lng strings + caller inspection + shared shell formatter correlation + compact-metric-row correlation"
0x004c5540,347,shell_company_detail_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `CompanyDetail.win` panel later published at `0x006cfe4c`. The constructor installs vtable `0x005d0858`, binds `CompanyDetail.imb` and `CompanyDetail.win` through `0x0053d110` and `0x0053fa50`, seeds the primary action controls `0x9470`, `0x9471`, `0x947d`, `0x947e`, `0x948c`, `0x948d`, and `0x948e` through callbacks `0x004c1730`, `0x004c1ab0`, `0x004c1ec0`, `0x004c22e0`, `0x004c1d70`, and `0x004c1d30`, stores the singleton resources at `0x006cfe50..0x006cfe58`, and then immediately repopulates the visible state through `shell_company_detail_window_refresh_controls` at `0x004c2ca0`. One negative boundary is useful too: current constructor-time binding still does not install dedicated per-row callbacks for the broader section-0 governance bands `0x94d4..0x9537` and `0x9538..0x959b`, which keeps those rows looking more like resource-defined display bands gated and restyled by the refresh pass than like individually code-rendered widgets. A grounded shell detail-manager caller reaches this constructor at `0x004dde24`, which corrects the earlier assumption that the post-roster company branch still had no recovered detail-window owner.","objdump + strings + detail-manager correlation + caller inspection + constructor-binding absence correlation"
0x004c0160,2214,shell_format_company_stock_data_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Shared shell stock-data formatter used by `LoadScreen.win` page `6`. The helper resolves the selected company through the live collection at `0x0062be10`, builds the section headers `928` `Largest Shareholders`, `929` `Shares`, and `930` `Per Share Data`, ranks the top positive active-chairman holdings for that company through the profile collection at `0x006ceb9c`, and renders up to four shareholder rows with the current share counts from `[profile + company_id*4 + 0x15d]`. It then formats the full six-row per-share block: help texts `931..936` and labels `937..942`, with `Share Price` from stat-family `0x2329/0x1c`, `Book Value Per Share` from `0x2329/0x1d`, `Revenue Per Share` from `0x2329/0x1e`, `Earnings Per Share` from `0x2329/0x1f`, `Dividend Per Share` from `0x2329/0x20`, and `5 Year Weighted Return` from `0x2329/0x21` via `company_compute_five_year_weighted_shareholder_return` `0x004246b0`. Current grounded caller is `shell_load_screen_render_company_stock_data_panel` at `0x004e5130`.","objdump + RT3.lng strings + caller inspection + shareholder-ranking correlation + stock-data-label correlation + per-share-metric correlation + weighted-return correlation"
0x004c1610,48,shell_company_detail_bind_bond_row_band_for_active_panel,shell,cdecl,inferred,objdump + caller inspection,4,"Tiny CompanyDetail helper that binds one contiguous debt-row control band to whichever bond panel is active. When the source control id is `0x947e` it enables the upper row band `0x94e8..0x950f`; otherwise it enables the sibling row band `0x9510..0x9537`. Current grounded owner is the CompanyDetail refresh path at `0x004c2ca0`, where this helper sits beside the shared bond readout callback for controls `0x947d` and `0x947e` and makes those two controls read as twin bond-slot list owners rather than as one-off buttons.","objdump + caller inspection + bond-row-band correlation"
0x004c16b0,35,shell_company_detail_copy_selected_company_debt_slot_triplet,shell,cdecl,inferred,objdump + caller inspection,3,"Small CompanyDetail helper that copies one 12-byte triplet from the currently selected company's debt-record band near `[company+0x5f + slot*0xc]` into a caller-supplied output buffer. Current grounded callers use it while building the bond maturity and repay readout lane and the adjacent action-message debt checks.","objdump + caller inspection + debt-slot correlation"
0x004c16f0,59,shell_company_detail_resolve_selected_company,shell,cdecl,inferred,objdump + caller inspection,4,"Resolves the current `CompanyDetail.win` company into the live company collection and returns the validated company record pointer or null. The helper reads the selected company id from shell detail owner `0x006d0818+0x90`, rejects nonpositive ids, verifies existence through company collection `0x0062be10`, and then returns the concrete record through `0x00518140`. It is the common shared accessor beneath the CompanyDetail read-side panels, finance actions, territory-access lane, and company-governance flows.","objdump + caller inspection + shared CompanyDetail accessor correlation"
0x004c1730,546,shell_company_detail_render_financial_history_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"CompanyDetail-specific widget callback for control `0x9470`. The helper resolves the currently selected company through the shell detail owner at `0x006d0818`, lays out a five-step history strip, and renders localized labels `607` `Revenue:`, `944` `Expenses:`, `945` `Interest:`, `610` `Profit:`, and `611` `Lifetime`. Current grounded metric reads come from the same wider company history family through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0`, notably slots `0x2c`, `0x2e`, `0x2f`, and `0x2b`. Current grounded owner is the CompanyDetail constructor `0x004c5540`, which binds this callback onto the finance-history panel rather than onto a generic company-list row.","objdump + RT3.lng strings + caller inspection + CompanyDetail panel correlation"
0x004c1ab0,169,shell_company_detail_render_company_summary_card,shell,cdecl,inferred,objdump + caller inspection + shared formatter correlation,4,"Thin `CompanyDetail.win` widget callback for control `0x9471`. The helper resolves the current selected company through the shell detail owner at `0x006d0818` and forwards the draw to `shell_format_company_financial_summary_card` at `0x004bfb30` using the widget rectangle supplied by the current control tree. Current grounded owner is the CompanyDetail constructor `0x004c5540`, which binds this callback beside the separate financial-history panel callback at `0x004c1730`.","objdump + caller inspection + shared formatter correlation"
0x004c1d30,48,shell_company_detail_select_territory_access_row,shell,cdecl,inferred,objdump + caller inspection,4,"Small `CompanyDetail.win` territory-picker selection callback bound to the adjacent control pair `0x948d` and `0x948e`. When the incoming row ordinal is nonnegative, the helper resolves the current picker widget under `0x948c`, reads the chosen territory id from the row field at `[widget+0x117]`, and then forwards that territory id into `shell_company_detail_refresh_selected_territory_access_summary` at `0x004c1b60`. A negative row ordinal falls back to territory id zero before the same summary refresh.","objdump + caller inspection + picker-field correlation"
0x004c1d70,323,shell_company_detail_render_territory_access_row,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Territory-row renderer for the `CompanyDetail.win` access-rights lane. The callback resolves the currently selected company through `0x006d0818`, resolves the supplied territory id through the territory collection at `0x006cfc9c`, and then renders the territory row through the shell text widgets rooted at `0x006cfe50` and `0x006cfe58`. Current grounded logic also checks access rights through `company_has_territory_access_rights` at `0x00424010`, varies the row styling accordingly, and triggers the focused-row highlight path through `0x0054f710` when the rendered territory matches the globally selected territory id at `0x006cfe5c`. The CompanyDetail constructor binds this callback onto the paired territory-row controls `0x948d` and `0x948e`.","objdump + RT3.lng strings + caller inspection + territory-row correlation"
0x004c1b60,462,shell_company_detail_refresh_selected_territory_access_summary,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Refreshes the selected-territory status summary in `CompanyDetail.win`. The helper caches the active territory id in `0x006cfe5c`, resolves the territory through `0x006cfc9c`, and formats one of three localized status texts for the current selected company: id `946` when the company already has access rights, id `947` when rights are unavailable but purchasable, or id `948` when the company cannot purchase rights at all. It also republishes the selected-territory control rooted at `0x948c`. Current grounded callers are the territory-summary callbacks at `0x004c1d30`, `0x004c1d70`, and `0x004c22e0`.","objdump + RT3.lng strings + caller inspection + territory-status correlation"
0x004c1ec0,587,shell_company_detail_render_bond_maturity_and_repay_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"CompanyDetail-specific bond readout callback bound to controls `0x947d` and `0x947e`. The helper resolves the currently selected company through `0x006d0818`, indexes one 12-byte debt-record slot from the selected company near `[company+0x5f + slot*0xc]`, formats the maturity caption through localized id `949` `Due %1`, formats the current bond amount or value through the shared numeric formatter family at `0x0051c000`, and then renders the repay affordance through localized id `950` `Repay this bond.`. In the surrounding refresh path this panel is paired with `shell_company_detail_bind_bond_row_band_for_active_panel` at `0x004c1610`, so the two controls now read as the owners of twin repayable bond-slot row bands `0x94e8..0x950f` and `0x9510..0x9537` rather than as isolated text widgets. Current grounded owner is the CompanyDetail constructor `0x004c5540`, which binds this callback onto the adjacent debt-panel controls rather than onto the territory or finance-history lanes.","objdump + RT3.lng strings + caller inspection + debt-panel correlation + bond-row-band correlation"
0x004c22e0,56,shell_company_detail_sync_selected_territory_from_picker,shell,cdecl,inferred,objdump + caller inspection,4,"Small `CompanyDetail.win` territory-sync callback for control `0x948c`. The helper resolves the current territory-picker widget through the live CompanyDetail window at `0x006cfe4c`, reads the currently focused territory id from `[widget+0x117]` when a picker row is present, and then forwards that territory id into `shell_company_detail_refresh_selected_territory_access_summary` at `0x004c1b60`. When no picker row is active it falls back to territory id zero before refreshing the same summary.","objdump + caller inspection + picker-sync correlation"
0x004c23a0,1259,shell_company_detail_render_debt_credit_and_rate_summary_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"CompanyDetail-specific summary callback bound to control `0x9488`. The helper resolves the currently selected company through `0x006d0818` and renders the player-facing debt and rate block under localized ids `951` `Total Debt:`, `952` `Credit Rating:`, `953` `Average Interest Rate:`, and `954` `Prime Rate:`. Current grounded logic now has concrete helper ownership for the rate rows: `company_compute_weighted_average_bond_interest_rate` `0x00423e40` feeds `Average Interest Rate`, `company_compute_prime_rate_from_issue39_scenario_baseline` `0x00424580` feeds `Prime Rate`, the credit-rating text table at `0x00620d00..0x00620d14` is chosen from the rounded company credit-rating score at `0x00425320`, and the leading debt total comes from the current metric family through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0` using stat-family `0x2329` and slot `0x12`. The CompanyDetail refresh path wires this callback onto the same read-side tab family as the bond and stock-summary panels.","objdump + RT3.lng strings + caller inspection + finance-summary correlation + average-interest correlation + prime-rate correlation + debt-total correlation"
0x004c2720,1394,shell_company_detail_render_share_value_and_dividend_summary_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"CompanyDetail-specific stock-summary callback bound to control `0x948a`. The helper resolves the currently selected company through `0x006d0818` and renders the player-facing share-value and payout block under localized ids `937` `Share Price:`, `724` `Shares Outstanding:`, `955` `Market Cap:`, `956` `Annual Dividend:`, and `957` `Annual Dividend Payments:`. Current grounded helper ownership is tighter now too: `company_query_cached_share_price_scalar` `0x00423eb0` feeds `Share Price`, the outstanding-share count comes from `[company+0x47]`, `Market Cap` multiplies those two lanes together, `Annual Dividend` comes from the current-year stat-family read `0x2329/0x20`, and `Annual Dividend Payments` multiplies that dividend-per-share lane by the outstanding-share count. The broader six-row per-share data family `938..942` instead sits in the shared stock-data formatter `shell_format_company_stock_data_panel` at `0x004c0160`. Current grounded owner is the CompanyDetail refresh path, which binds this panel beside the debt or credit or rate summary block rather than inside the action-message dispatcher.","objdump + RT3.lng strings + caller inspection + stock-summary correlation + share-price correlation + dividend-payout correlation"
0x004c3470,621,shell_company_detail_step_selected_active_company_delta,shell,cdecl,inferred,objdump + caller inspection,4,"CompanyDetail-specific company-navigation helper. The routine resolves the currently selected company id through the detail owner at `0x006d0818`, converts it to an active-company ordinal through `company_collection_count_active_companies_before_company_id` `0x004299f0`, wraps `ordinal + delta` modulo the active-company count from `company_collection_count_active_companies` `0x00429a50`, resolves the replacement company id through `company_collection_get_nth_active_company_id` `0x00429990`, writes it back through detail-manager setter `0x004dd8a0`, refreshes the visible panel through `shell_company_detail_window_refresh_controls` `0x004c2ca0`, notifies the detail manager through `0x004dd410`, and resets territory picker control `0x948c` through `0x00538e00`. Current grounded wrappers are the next and previous company selectors at `0x004c3540` and `0x004c3550`.","objdump + caller inspection + CompanyDetail navigation correlation"
0x004c3540,5,shell_company_detail_select_next_active_company,shell,cdecl,inferred,objdump + caller inspection,4,"Trivial CompanyDetail wrapper that seeds delta `+1` in `ecx` and tail-calls `shell_company_detail_step_selected_active_company_delta` `0x004c3470`. Current grounded callers include shell-side world and company-detail navigation paths.","objdump + caller inspection + wrapper correlation"
0x004c3550,5,shell_company_detail_select_previous_active_company,shell,cdecl,inferred,objdump + caller inspection,4,"Trivial CompanyDetail wrapper that seeds delta `-1` in `ecx` and tail-calls `shell_company_detail_step_selected_active_company_delta` `0x004c3470`. Current grounded callers include shell-side world and company-detail navigation paths.","objdump + caller inspection + wrapper correlation"
0x004c3560,816,shell_company_detail_render_issue_bond_offer_dialog,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Dedicated shell renderer for the `CompanyDetail.win` bond-offer dialog. The helper resolves the currently selected company from the live collection at `0x0062be10`, derives the staged offer terms from the same local bond-offer state later committed by `shell_company_detail_issue_bond_offer_flow`, and then lays out the localized underwriter lines `968..972`: `Underwriters offer to issue bonds as follows:`, `Amount:`, `Interest Rate:`, `Underwriting Fees:`, and `Go ahead and issue the bond?`. Current grounded caller is the issue-bond flow at `0x004c3890`, which passes this helper as the custom dialog renderer into the shared shell finance modal path at `0x004c98a0`.","objdump + RT3.lng strings + caller inspection + finance-dialog correlation"
0x004c3890,693,shell_company_detail_issue_bond_offer_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` bond-issue action flow. The helper resolves the currently selected company through the shell detail owner at `0x006d0818`, rejects requests when the company already has too many outstanding bonds through localized id `973`, rejects weak credit through localized id `974` plus the credit-rating tables at `0x00620d00..0x00620d14`, and otherwise opens the underwriter offer dialog for localized ids `968` through `972` using the dedicated renderer `shell_company_detail_render_issue_bond_offer_dialog` at `0x004c3560`. On acceptance it issues the bond through the selected-company method at `0x004275c0`; when the multiplayer-side shell owner is active it instead packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded caller is `shell_company_detail_window_handle_message` at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + bond-dialog correlation"
0x004c3b50,992,shell_company_detail_render_issue_stock_offer_dialog,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Dedicated shell renderer for the `CompanyDetail.win` stock-issue offer dialog. The helper resolves the currently selected company from the live collection at `0x0062be10`, reads the staged offer state from `0x006cfe64` and `0x006cfe68`, and lays out the localized stock-offer lines `975..978`: `Underwriters offer to issue stock as follows:`, `Shares:`, `Total Proceeds:`, and `Go ahead and issue the stock?`. Current grounded caller is `shell_company_detail_issue_stock_offer_flow` at `0x004c3f30`, which passes this helper as the custom dialog renderer into the shared shell finance modal path at `0x004c98a0`.","objdump + RT3.lng strings + caller inspection + finance-dialog correlation"
0x004c3f30,968,shell_company_detail_issue_stock_offer_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` stock-issue action flow. The helper derives a proposed share count and proceeds from the selected company into the local globals `0x006cfe64` and `0x006cfe68`, rejects weak offerings through localized id `979`, rejects oversaturated issuance through localized id `980`, and otherwise opens the underwriter offer dialog for localized ids `975` through `978`. On acceptance it issues the stock through the selected-company method at `0x00427450`; when the multiplayer-side shell owner is active it routes the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded caller is `shell_company_detail_window_handle_message` at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + stock-issue correlation"
0x004c4300,976,shell_company_detail_render_stock_buyback_offer_dialog,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Dedicated shell renderer for the `CompanyDetail.win` stock-buyback offer dialog. The helper resolves the currently selected company from the live collection at `0x0062be10`, reads the staged buyback state from `0x006cfe64` and `0x006cfe68`, and lays out the localized broker-offer lines `981..984`: `Brokers are able to locate the following shares on the market:`, `Brokerage Fees:`, `Total Cost:`, and `Go ahead and buy back the stock?`. Current grounded caller is `shell_company_detail_buyback_stock_flow` at `0x004c46d0`, which passes this helper as the custom dialog renderer into the shared shell finance modal path at `0x004c98a0`.","objdump + RT3.lng strings + caller inspection + finance-dialog correlation"
0x004c46d0,1420,shell_company_detail_buyback_stock_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` stock-buyback action flow. The helper computes a proposed repurchase quantity and total cash cost into `0x006cfe64` and `0x006cfe68`, rejects cases with no public float through localized id `985`, rejects requests that would retire the final protected share band through id `986`, rejects insufficient company cash through id `987`, and otherwise opens the broker buyback dialog for localized ids `981` through `984` using the dedicated renderer `shell_company_detail_render_stock_buyback_offer_dialog` at `0x004c4300`. On acceptance it repurchases the shares through the selected-company method at `0x004273c0`; when the multiplayer-side shell owner is active it routes the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded caller is `shell_company_detail_window_handle_message` at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + stock-buyback correlation"
0x004c4c70,448,shell_company_detail_setup_dividend_rate_adjust_controls,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Custom setup callback for the `CompanyDetail.win` dividend-rate dialog opened by `shell_company_detail_change_dividend_rate_flow` at `0x004c5360`. The helper resolves the currently selected company, stages two small shell control descriptors, and binds the paired dividend-adjust controls with ids `0x99e8` and `0xc0f9` back into the shared finance modal through the shell control-registration path rooted at `0x0053f9c0`. Current grounded behavior makes this the control-setup half of the dividend modal beside the text renderer at `0x004c4e30` and the message handler at `0x004c5140`.","objdump + RT3.lng strings + caller inspection + dividend-dialog control-setup correlation"
0x004c4e30,784,shell_company_detail_render_change_dividend_rate_dialog,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Dedicated shell renderer for the `CompanyDetail.win` change-dividend dialog. The helper resolves the currently selected company from the live collection at `0x0062be10`, renders the localized prompt and value lines `988..990`: `Change Dividend Rate`, `Dividend Rate:`, and `Total Annual Dividends:`, formats the staged per-share dividend from `0x006cfe48`, and derives the annual total from that same staged rate times the current outstanding-share count at `[company+0x47]`. Current grounded caller is `shell_company_detail_change_dividend_rate_flow` at `0x004c5360`, which passes this helper into the shared shell finance modal path at `0x004c98a0`.","objdump + RT3.lng strings + caller inspection + dividend-dialog renderer correlation"
0x004c5140,544,shell_company_detail_handle_change_dividend_rate_dialog_message,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Custom message callback for the `CompanyDetail.win` change-dividend dialog. The helper handles shell message `0xcb` from the paired adjust controls `0x99e8` and `0xc0f9`, raises or lowers the staged dividend-per-share value in `0x006cfe48`, clamps decrements at zero, and clamps increments against the board-approved per-share ceiling from `company_compute_board_approved_dividend_rate_ceiling` at `0x00426260`. When the player tries to raise the dividend beyond that ceiling it opens localized id `991` `Your board of directors feels that the company is not financially strong enough for a higher dividend...` through the shared modal path instead of accepting the increase. Current grounded caller is `shell_company_detail_change_dividend_rate_flow` at `0x004c5360`, which passes this helper as the dialog message owner into `0x004c98a0`.","objdump + RT3.lng strings + caller inspection + dividend-dialog message correlation + dividend-ceiling correlation"
0x004c5360,472,shell_company_detail_change_dividend_rate_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` dividend-rate action flow. The helper seeds the current dividend-per-share value from `[company+0x4b]` into `0x006cfe48`, opens the shared finance dialog rooted at callbacks `0x004c4c70`, `0x004c4e30`, and `0x004c5140` under localized ids `988` through `990`, and then commits the accepted new dividend rate through the selected-company method at `0x00423fb0`. When the multiplayer-side shell owner is active the same request is packaged through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded caller is `shell_company_detail_window_handle_message` at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + dividend-dialog correlation"
0x004c2ca0,1964,shell_company_detail_window_refresh_controls,shell,thiscall,inferred,objdump + strings + caller inspection,4,"Shared refresh pass for the shell-side `CompanyDetail.win` family rooted at `0x006cfe4c`. The helper first requires a live shell detail-panel owner at `0x006d0818` with a selected company id in `[detail+0x90]`, resolves that company through the live collection at `0x0062be10`, and then repopulates the section strip and section-specific control bands rooted at `0x9472..0x9490`. Current grounded state is keyed by section index `0x006cfe60`: section `0` is the chairman/governance slice around `0x9480` and the dynamic multi-line overview widget `0x947f`, section `1` is the debt-and-capital slice around `0x947d`, `0x947e`, and `0x9488`, section `2` is the per-share slice around `0x948a`, and section `3` is the territory-access slice around `0x948c`, `0x948d`, and `0x948e`. The same refresh now cleanly splits the four visible section selectors `0x9472..0x9475` from their companion visual controls `0x9476..0x9479`, keeps the adjacent section-navigation or decoration bands around `0x947b..0x947c` and `0x948f..0x9490` synchronized with the current section, and formats the current chairman summary through localized ids `958` `Chairman:  %1` and `959` `Chairman:  None` together with the portrait-backed chairman band on `0x9480`. The section-0-only bind for `0x947f` is tighter now too: the refresh passes a dedicated stack-built dynamic-text payload through the special `0x6f` control path instead of using the normal callback-widget lane, and the shared helpers `shell_control_refresh_matching_dynamic_text_payload` at `0x00540a47` plus `shell_control_release_dynamic_text_payload` at `0x005639d2` now show that type `0x6f` frees or swaps one heap-backed text payload and then short-circuits as a special case. That keeps `shell_format_company_governance_and_economy_status_panel` at `0x004e5cf0` as the strongest current semantic match for `0x947f` while making the widget itself look more clearly like a display-only dynamic-text control rather than a normal callback widget. One wider action-row split is tighter now that the range loops are explicit: the helper walks `0x94d4..0x9537` as the selected-company-owned governance/action band and applies style `0x65` when the selected company matches the scenario-selected company at `0x00434870`, otherwise `0x87`; it then walks `0x9538..0x959b` as the linked-chairman-owned band and applies style `0x87` when the selected company's linked chairman id `[company+0x3b]` matches the scenario-selected chairman at `0x004337b0`, otherwise `0x65`. The selected-company side is no longer one vague gated block either: scenario-state toggle `[0x006cec78+0x4a8f]` re-enables bankruptcy row `0x94d6` together with passive companion row `0x94d4`, `[0x006cec78+0x4a8b]` re-enables issue-bond row `0x94d7` together with passive companion row `0x94d5`, `[0x006cec78+0x4a87]` re-enables stock issue and stock buyback rows `0x94d8..0x94d9`, `[0x006cec78+0x4a93]` re-enables dividend row `0x94da` together with the same passive companion row `0x94d5`, `[0x006cec78+0x4adb]` re-enables merger row `0x94db`, `[0x006cec78+0x4acb]` re-enables resign row `0x94dc`, and `[0x006cec78+0x4acf]` re-enables takeover row `0x9538`; `0x9493` only re-enables when editor-map mode `[0x006cec74+0x68]` is clear. That makes `0x94d4/0x94d5` read more like passive companion or heading widgets than hidden verbs. The constructor at `0x004c5540` and many message-side branches at `0x004c56a0` converge back into this helper, which makes it the current owner-side refresh pass for the CompanyDetail window rather than a generic company-list helper.","objdump + strings + caller inspection + section-switch correlation + chairman-band correlation + governance-band gating correlation + selected-company styling correlation + dynamic-overview-widget correlation + passive-companion-row gating correlation + scenario-toggle correlation + explicit-row-loop correlation + type-0x6f control correlation"
0x004c56a0,4228,shell_company_detail_window_handle_message,shell,thiscall,inferred,objdump + strings + caller inspection,4,"Primary message dispatcher for the shell-side `CompanyDetail.win` family rooted at vtable `0x005d0858`. The helper switches on the incoming shell message id and now has a grounded section-selector lane too: message `0xca` on controls `0x9472..0x9475` writes `control-0x9472` into section index `0x006cfe60` before re-entering `shell_company_detail_window_refresh_controls` `0x004c2ca0`. Its broader action band is now tighter as well. Under message `0xcb`, control `0x94b5` routes into `shell_company_detail_buy_territory_access_rights_flow` `0x004c5fc9`, `0x94b6` routes into `shell_company_detail_bankruptcy_flow` `0x004c5b99`, `0x94cf` routes into `shell_company_detail_issue_bond_offer_flow` `0x004c3890`, `0x94d0` routes into `shell_company_detail_issue_stock_offer_flow` `0x004c3f30`, `0x94d1` routes into `shell_company_detail_buyback_stock_flow` `0x004c46d0`, `0x94d2` routes into `shell_company_detail_change_dividend_rate_flow` `0x004c5360`, `0x9493` routes into the destructive company-clear helper `company_deactivate_and_clear_chairman_share_links` `0x00426d60`, `0x94d6` routes into `shell_company_detail_bankruptcy_flow` `0x004c5b99`, `0x94d7` routes into `shell_company_detail_issue_bond_offer_flow` `0x004c3890`, `0x94d8` routes into `shell_company_detail_issue_stock_offer_flow` `0x004c3f30`, `0x94d9` routes into `shell_company_detail_buyback_stock_flow` `0x004c46d0`, `0x94da` routes into `shell_company_detail_change_dividend_rate_flow` `0x004c5360`, `0x94db` routes into `shell_company_detail_attempt_merger_flow` `0x004ec640`, `0x94dc` routes into `shell_company_detail_resign_chairmanship_flow` `0x004c5a0e`, and `0x9538` routes into `shell_company_detail_attempt_chairmanship_takeover_flow` `0x0050ccc0`. The same `0xcb` jump table now makes the passive/action split explicit rather than inferred: in the dispatch byte map rooted at `0x004c6640`, offsets `0x4b..0x51` for controls `0x94d6..0x94dc` map to cases `0x06..0x0c`, offset `0xad` for control `0x9538` maps to case `0x0d`, and the neighboring companion rows `0x94d4` and `0x94d5` stay on the default `0x0e` path. The debt-side row bands are narrower now too: under the same `0xcb` path, controls `0x94e8..0x950f` and `0x9510..0x9537` resolve a selected debt-slot index beneath the two bond panels `0x947d` and `0x947e`, reject repayment when the selected slot's principal exceeds the current cash-side metric through localized id `2990`, otherwise open the localized early-repayment confirmation rooted at id `2991`, and on acceptance either commit through `company_repay_bond_slot_and_compact_debt_table` `0x00423d70` or package the same request through the multiplayer shell transport. The same dispatcher also now bounds most of the section-0 control cluster: control `0x948b` is a tutorial-guarded escape or back control that either shows localized id `3724` `This option is disabled in the tutorial.` or falls back to `0x004ddbd0`, controls `0x9491` and `0x9492` only restyle the paired visual controls `0x948f` and `0x9490`, and control `0x9494` opens localized id `3635` `Enter the amount that your company's cash should be` through the shell numeric-entry dialog family and then writes the accepted value into the selected company cash pair at `[company+0x11f7]` and `[company+0x11fb]`. Current `0xcb` dispatch does not treat `0x948f`, `0x9490`, `0x94d4`, or `0x94d5` as standalone action cases, and the refresh-side gates now sharpen that split further: `0x94d4` is the passive companion row that comes back beside bankruptcy `0x94d6`, while `0x94d5` is the passive companion row that comes back with the issue-bond/dividend side of the finance cluster `0x94d7` and `0x94da`. The remaining open section-0 control is therefore mainly `0x947f`, plus the still-unsplit render-side text rows inside the broader governance bands `0x94d4..0x9537` and `0x9538..0x959b`. It repeatedly converges back into `shell_company_detail_window_refresh_controls` after state changes. Current grounded evidence is enough to treat this as the real company-detail owner path, while the remaining uncertainty has narrowed to the last section-0 summary binding and deeper governance-row semantics rather than the ownership of the action lanes themselves.","objdump + strings + caller inspection + jump-table correlation + section-selector correlation + debt-row-band correlation + cash-edit dialog correlation + tutorial-guard correlation + governance-band companion-row correlation + passive-companion-row gating correlation + control-jump-table byte-map correlation"
0x004c5a0e,268,shell_company_detail_resign_chairmanship_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` resignation confirmation flow. The branch opens localized confirmation id `964` `Are you sure you want to resign the chairman's position?` and on acceptance commits the change through `company_clear_selected_chairman_if_current_profile` at `0x00428a10`. When the multiplayer-side shell owner is active it packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8` instead of mutating the company immediately. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + dialog correlation"
0x004c5b99,428,shell_company_detail_bankruptcy_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` bankruptcy action flow. The branch checks the localized cooldown and eligibility strings `965` through `967`, rejects requests when the selected company is not yet bankruptable, and on acceptance commits the change through `company_declare_bankruptcy_and_halve_bond_debt` at `0x00425a90`. When the multiplayer-side shell owner is active it packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8` instead of mutating the company immediately. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + bankruptcy-dialog correlation"
0x004c5fc9,659,shell_company_detail_buy_territory_access_rights_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` territory-access purchase flow for the currently selected territory. The branch first resolves the selected territory from the territory-summary controls rooted at `0x948c..0x948e`, requires that the detail panel is still showing the current chairman-owned company, then splits cleanly by access state. When the company lacks rights but the territory is purchasable, it computes the access-rights price through `0x004879f0`, shows localized id `961` when purchase is possible, id `962` when cash is insufficient, and id `963` when rights cannot be purchased at all. Accepting id `961` commits the change through `company_set_territory_access_rights_byte` at `0x00424030` and the cash-side mutation at `0x0042a040`; when the multiplayer-side shell owner is active it instead packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + territory-access branch correlation"
0x004c98a0,880,shell_open_custom_modal_dialog_with_callbacks,shell,cdecl,inferred,objdump + caller inspection,4,"Generic shell modal opener for callback-driven custom dialogs. The helper snapshots the current detail-owner context, stores one caller-supplied mode or prompt token at `0x00621f40`, stores one optional custom control callback or row-owner token at `0x006cfeb0`, allocates a shared `0xa0`-byte modal object with vtable `0x005d0a04`, and seeds it through the lower constructor at `0x004c86c0` using the caller's custom message, setup, and render callbacks plus the surrounding button or style parameters. When the optional callback slot is present it also binds that callback onto control `0x03ed`. The same helper temporarily pushes shell modal state through `0x0053f000`, enters the visible modal loop through `0x00538f10`, and then tears the object back down while restoring the surrounding shell or world presentation state. Current grounded callers include the CompanyDetail finance dialogs for bond issue, stock issue, stock buyback, and dividend changes, plus `multiplayer_open_staged_text_entry_dialog` at `0x004ee0e0`.","objdump + caller inspection + modal-lifecycle correlation"
0x004d57c0,540,shell_event_conditions_window_construct,shell,thiscall,inferred,objdump + EventConditions.win string xref + control-binding inspection,3,"Constructs the shell-side `EventConditions.win` window. The constructor installs vtable `0x005d0cd4`, binds `EventConditions.win` through `0x0053fa50`, stores the incoming live event record pointer at `[this+0x84]`, seeds the selected condition row id at `[this+0x78]` plus the adjacent subselector at `[this+0x7c]`, binds the condition-row action callbacks at `0x004d5790` and `0x004d57b0`, and then populates the visible controls and status rows through the same window-local refresh path. Current grounded string xref is direct at `0x004d5803`, which makes this the clean owner for the conditions window rather than just another anonymous scenario dialog.","objdump + EventConditions.win string xref + control-binding inspection + state-field correlation"
0x004d59e0,166,shell_event_conditions_window_handle_message,shell,thiscall,inferred,objdump + EventConditions.win vtable slot + local disassembly,3,"Primary shell-message dispatcher bound in vtable slot `0x005d0cd8` for `EventConditions.win`. The handler switches on incoming shell messages `0xc9`, `0xca`, and the callback-style `0x04` path, remaps the constructor-bound callback controls at `0x4f73` and `0x4fd1` into the `0xc9` branch after validation through `0x004d54d0`, and dispatches the window-local command strip rooted at ids such as `0x4fb4..0x509c` through helpers like `0x004d4560`, `0x004d4838`, and `0x004d4d10`. Current direct evidence is the `EventConditions.win` vtable at `0x005d0cd4`, whose second slot points to `0x004d59e0`, so this is the clean message owner for the conditions window rather than just another small callback helper.","objdump + EventConditions.win vtable slot + local disassembly + callback-remap correlation"
0x004d5d00,605,shell_event_effects_window_refresh_effect_type_selector,shell,thiscall,inferred,objdump + EventEffects.win constructor and handler correlation + local disassembly,3,"Selector refresh beneath `EventEffects.win`. The helper rebuilds the effect-type list control rooted at `0x4fb2` from the static descriptor family starting near `0x006103e7`, filters entries by the current availability or permission state from control `0x5033`, selects the best current row by the descriptor float lane, and republishes the chosen effect-type index through `[this+0x7c]` plus the visible selector control state. Current grounded callers are the effects-window constructor `0x004d6d60`, the message dispatcher `0x004d7060`, and the selected-editor refresh family under `0x004d6090`, so this is now the safest current owner for the effect-type selector rather than an anonymous table walk.","objdump + EventEffects.win constructor and handler correlation + local disassembly + selector-table correlation"
0x004d5f50,320,shell_event_effects_window_refresh_selected_effect_parameter_rows,shell,thiscall,inferred,objdump + EventEffects.win constructor and handler correlation + local disassembly,3,"Parameter-row refresh beneath `EventEffects.win`. The helper reads the current effect-type index at `[this+0x7c]`, consults the compact descriptor tables rooted at `0x004d5fde` and `0x004d600a`, and then repaints the grouped parameter-label or parameter-enable rows through the generic control path under control family `0x4ff6` plus the smaller row-style helper `0x004d5f83`. Current grounded callers are the effects-window constructor `0x004d6d60`, the message dispatcher `0x004d7060`, and the heavier editor refresh at `0x004d6090`, so this is the safest current read for the selected-effect parameter-row repaint rather than another anonymous row helper.","objdump + EventEffects.win constructor and handler correlation + local disassembly + parameter-table correlation"
0x004d6090,1752,shell_event_effects_window_refresh_selected_staged_effect_editor_panels,shell,thiscall,inferred,objdump + EventEffects.win constructor and handler correlation + local disassembly,3,"Heavier editor refresh beneath `EventEffects.win`. The helper first resets the smaller grouped parameter rows through `0x004d5f83`, then interprets the currently staged effect row at `[this+0x78]` by reading opcode byte `+0x08`, scalar dword `+0x04`, grouped value lanes `+0x09` and `+0x0d`, and the bounded numeric fields `+0x11`, `+0x12`, `+0x14`, and `+0x16`. It uses that staged row plus the current effect-type descriptor state at `[this+0x7c]` to repaint the main effect-editor controls rooted at ids such as `0x4fc7`, `0x4fce`, `0x4ff6`, `0x4ff9`, `0x4ffc`, `0x5041`, `0x5044`, `0x5046`, and `0x5047`, including the numeric-entry affordances, sign or comparator toggles, and the type-specific parameter bands. Current grounded callers are the effects-window constructor `0x004d6d60` and message dispatcher `0x004d7060`, which keeps this as the clearest current owner for staged effect-editor repaint rather than a generic event formatter.","objdump + EventEffects.win constructor and handler correlation + local disassembly + staged-row-field correlation"
0x004d77b0,251,shell_event_conditions_window_refresh_grouped_effect_summary_band_affordances,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Refreshes the grouped-effect summary band affordances beneath `EventConditions.win`. The helper checks whether selected-event mode control `0x4e8f` is active and whether the current selector rooted at `0x5000` resolves to control `0x5002`; only on that branch does it enable the grouped summary-band controls `0x4fed..0x4ff0`, otherwise it disables that four-control band with style `0x87`. Current grounded callers include the mode-dependent detail-row switch `0x004d9390` and nearby condition-window refresh tails around `0x004d9970` and `0x004daf40`, so this is the safest current read for grouped summary-band affordance refresh rather than another anonymous style helper.","objdump + caller xrefs + local disassembly + grouped-band-control correlation + selector-gate correlation"
0x004d7ef0,301,shell_event_effects_window_refresh_event_selector_list_and_selected_event_id,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Event-selector refresh beneath the broader event editor family. The helper clears the current selected event id at `[this+0x84]`, the visible row count at `[this+0x90]`, and the adjacent selection latches at `[this+0x88]` and `[this+0x8c]`, then iterates the live event collection `0x0062be18` to populate the visible selector control rooted at `0x4e84` with each event name from `+0x18` plus the paired count field at `+0x14`. When at least one live event exists it republishes the chosen event id through `[this+0x84]` and enables the list-selection affordance on control `0x4e84`. Current grounded caller is the effects-side command family near `0x004dbb35`, which makes this the safest current owner for event-list selector refresh rather than a generic event walk.","objdump + caller correlation + local disassembly + event-collection iteration correlation"
0x004d8120,1968,shell_event_conditions_window_refresh_condition_row_list_panel,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Heavier row-list refresh beneath `EventConditions.win`. The helper resolves the currently selected live event through `[this+0x84]`, walks the standalone condition-row list rooted at `[event+0x00]`, and repaints the condition-row panel rooted at `0x4eaf` by formatting special sentinel rows `-1` and `-2` through fixed localized ids `0x47e` and `0x47f` while ordinary rows derive their caption and comparator text from the condition tables rooted near `0x005f3de3` and `0x004d88cc`. The same pass also rebuilds the current selected-row index at `[this+0x94]`, maintains the per-row seen bitmap on the stack, and republishes the current selection row list through the generic control path before the surrounding condition-window refresh continues. Current grounded callers are the add, edit, and remove condition-row verbs `0x004da640`, `0x004da700`, and `0x004d9ed0`, so this is the safest current owner for condition-row list repaint rather than a generic formatter.","objdump + caller correlation + local disassembly + condition-row-list correlation"
0x004d88f0,1115,shell_event_conditions_window_refresh_selected_grouped_effect_row_list_panel,shell,thiscall,inferred,objdump + local disassembly + RT3.lng correlation + grouped-effect-descriptor correlation,3,"Grouped effect-row list refresh beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, uses current grouped selector `[this+0x9c]` to walk the grouped `0x28`-byte row list anchored at `[event + group*4 + 0x04]`, clears list control `0x4ed5`, and resets selected grouped row index `[this+0x98] = -1` before rebuilding the visible row band. Formatting is now tighter than a generic list repaint: ordinary grouped rows flow through the effect descriptor table at `0x006103a0` and RT3.lng `1154..1159` to build `Set %1 to FALSE/TRUE`, timed `for %1 months/years`, and scalar assignment lines, while opcode byte `+0x08 == 8` takes the wider multivalue path over fields `+0x11/+0x12/+0x14/+0x16` before publishing the finished text into `0x4ed5`. The helper finishes by re-enabling `0x4ed5` with active style when the selected grouped list is nonempty. Current grounded callers are the selected-event refresh family `0x004db120/0x004d9390/0x004dbf93` plus grouped effect add, edit, and remove verbs `0x004da7c0/0x004da860/0x004da920`, so this is the safest current read for selected grouped-effect row-list repaint rather than an anonymous formatter.","objdump + local disassembly + RT3.lng correlation + grouped-effect-descriptor correlation + grouped-list-anchor correlation"
0x004d8d50,320,shell_event_conditions_window_commit_current_grouped_effect_summary_state_before_group_switch,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng correlation,3,"Small commit helper beneath `EventConditions.win` that snapshots the current grouped-effect summary editor state back into the selected live event before the grouped selector changes. The helper resolves the selected event through `[this+0x84]`, uses current grouped index `[this+0x9c]`, samples control `0x500a` into event byte lane `[event + group*4 + 0x7ff]`, maps the hidden mutually exclusive selector family rooted at `0x5006` into ordinal byte `[event + group + 0x7fb] = 0..8`, and stores current local selector state `[this+0x8c]` into event dword lane `[event + group*4 + 0x80f]`. The ordinal mapping is now explicit in the commit-side jump table: controls `0x5006..0x500e` store values `0..8`, and the refresh side later maps those same ordinals one-to-one onto visible controls `0x5014..0x501c`. Current evidence therefore reads `0x5006..0x500e` as the hidden canonical selector family and `0x5014..0x501c` as its visible display mirror, not as two distinct semantic families. The strongest current RT3.lng fit for the stored scope family is `object being evaluated`, `whole game`, `all/human/AI companies`, `specified territories`, and `all/human/AI players`. Current grounded caller is the grouped-band dispatcher case at `0x004dbf93`, so this is the safest current read for grouped-effect summary-state commit before group switch rather than a generic editor helper.","objdump + caller xrefs + local disassembly + grouped-selector-state correlation + ordinal-mapping correlation + RT3.lng correlation"
0x004d8ea0,1165,shell_event_conditions_window_commit_current_selected_event_text_panels_before_selection_change,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Selected-event commit helper beneath `EventConditions.win` that snapshots the currently visible mode-strip text panels back into the live event record before selection, grouped-action, or grouped-band changes. The helper resolves the selected live event through `[this+0x84]`, samples active controls `0x4e8e`, `0x4e8f`, `0x4ed9`, `0x4edb`, `0x4edd`, and `0x4e91`, and uses those active-state checks to rewrite event mode byte `[event+0x7ee]` plus the fixed text bands at `[event+0x0e0]`, `[event+0x401]`, `[event+0x4ca]`, `[event+0x593]`, `[event+0x65c]`, and `[event+0x725]` from the current shell control payloads. Current grounded callers are selected-event previous and next navigation `0x004db520/0x004db5e0`, the selected-event id setter `0x004db6a0`, and the grouped-action selector case at `0x004dbfca`, so this is the safest current read for committing current selected-event text panels before selection change rather than another repaint helper.","objdump + caller xrefs + local disassembly + event-text-band correlation + selection-change correlation"
0x004d91e0,343,shell_event_conditions_window_commit_selected_event_summary_headers_and_group_mode,shell,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Selected-event summary-header and grouped-mode commit helper beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, snapshots the active modifier bands rooted at `0x4fd7` and `0x4fd8` into event bytes `[event+0x7f9]` and `[event+0x7fa]`, stores the inverted toggle state of control `0x4e93` into event byte `[event+0x800]`, writes summary header control `0x4ead` into event dword `[event+0x7f5]`, mirrors window field `[this+0x88]` into event dword `[event+0x7f0]`, re-enters `shell_event_conditions_window_commit_current_grouped_effect_summary_state_before_group_switch` `0x004d8d50`, and then commits one grouped-mode choice from controls `0x4eca/0x4ecb/0x4ecc` into event byte `[event+0x7f4]`. Current grounded caller is the broader selected-event strip refresh at `0x004db120`, so this is the safest current read for committing selected-event summary headers and grouped mode rather than another grouped-action helper.","objdump + local disassembly + caller correlation + control-band correlation + event-record-field correlation"
0x004d9360,43,shell_event_conditions_window_remove_selected_event_and_refresh_selector,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Delete verb for the selected live event beneath `EventConditions.win`. When `[this+0x84]` holds a valid event id, the helper resolves collection `0x0062be18`, removes that live event through the collection vtable delete slot, and then immediately rebuilds the visible event selector through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`. Current grounded dispatcher caller is control `0x4e8a` through `0x004dbc48`, so this is the safest current read for selected-event deletion and selector refresh rather than a generic collection wrapper.","objdump + local disassembly + dispatcher correlation + collection-delete correlation"
0x004d9390,1504,shell_event_conditions_window_refresh_selected_event_mode_dependent_detail_rows,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Mode-dependent detail-row switch beneath `EventConditions.win`. The helper samples which selected-event mode button is active across controls `0x4e8f`, `0x4e90`, `0x4e91`, and `0x4e92`, then shows or hides the corresponding detail-row families rooted at `0x4ed7..0x4edd` and `0x4fdb..0x4fe6` through the generic shell control path. The same pass also re-enters `shell_event_conditions_window_refresh_grouped_effect_summary_band_affordances` `0x004d77b0`, resets grouped selection field `[this+0x9c]` when the chosen mode does not keep it, refreshes the grouped row list through `0x004d88f0`, and toggles the trailing affordance at `0x4fed`. Current grounded callers are the selected-event strip refresh `0x004d9f50`, the broader condition-window dispatcher `0x004dbb80`, and one nearby secondary dispatcher at `0x004daf40`, so this is the safest current read for selected-event mode-dependent detail rows rather than a generic control-style helper.","objdump + caller xrefs + local disassembly + mode-button correlation + detail-row-band correlation + grouped-band-affordance correlation"
0x004d9970,925,shell_event_conditions_window_refresh_condition_class_summary_and_group_rows,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng correlation,3,"Refreshes the condition-class summary and grouped-row affordance bands beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, queries the standalone condition-row aggregate flags through `scenario_event_query_standalone_condition_row_list_class_and_modifier_flags` `0x0042d700`, and then restyles the summary header or status rows rooted at `0x4eae`, `0x4eb4`, `0x4fd9`, `0x4fda`, `0x4ec0..0x4ec4`, and `0x4eb6..0x4eba`. Current local bit correlation is tighter than a generic status repaint: aggregate bit `0x01` drives the `0x4fd9` / `0x4ec0..0x4ec4` band, aggregate bit `0x02` drives the `0x4fda` / `0x4eb6..0x4eba` band, aggregate bit `0x04` drives the header pair `0x4eae` and `0x4eb4`, and the higher modifier bits `0x10` and `0x20` refine the style of `0x4ec1` and `0x4eb6`. Current RT3.lng adjacency now gives the strongest current player-facing fit for this whole branch too: selector `0x5001` above it reads as the `1573` `Test against...` side, with the grouped company and player target-family rows under `0x4ec0..0x4ec4` and `0x4eb6..0x4eba` aligning to the adjacent `1574..1592` company/player test-scope text family. Event byte `[event+0x7f4]` also gates one special affordance in each grouped band. Current grounded callers include the add, edit, and remove condition-row verbs `0x004da640`, `0x004da700`, and `0x004d9ed0`, plus several surrounding condition-window refresh tails, so this is the safest current owner for the condition-summary and grouped-row repaint rather than a generic style loop.","objdump + caller xrefs + local disassembly + condition-aggregate correlation + grouped-band correlation + RT3.lng correlation"
0x004d9d10,53,shell_event_conditions_window_refresh_selected_grouped_effect_territory_target_affordance,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng correlation,3,"Small territory-target affordance refresh beneath `EventConditions.win` for the current grouped effect selection. The helper resolves the selected live event at `[this+0x84]`, queries grouped effect-row type flags for the current grouped selector `[this+0x9c]` through `scenario_event_query_grouped_effect_row_list_type_flags` `0x0042d740`, and enables control `0x500b` only when the returned flags include bit `0x04` and the neighboring controls `0x5019` plus `0x5002` are already active. Otherwise it disables the same affordance with style `0x87`. The strongest current label fit is that `0x5019/0x500b` are the RT3.lng `1619/1620` `to territories` lane, with `0x500b` carrying the stored territory-target parameter from `[event + group*4 + 0x80f]`. Current grounded callers are the broader condition-window refresh `0x004da0f0` and the main dispatcher `0x004dbb80`, so this is the safest current read for the selected grouped-effect territory-target affordance rather than a generic control-style toggle.","objdump + caller xrefs + local disassembly + grouped-flag correlation + control-enable correlation + RT3.lng correlation"
0x004d67f0,456,shell_event_effects_window_commit_current_editor_state_into_staged_row,shell,thiscall,inferred,objdump + EventEffects.win constructor and handler correlation + local disassembly,3,"Commit helper beneath `EventEffects.win` that normalizes the current editor controls back into the staged effect row at `[this+0x78]`. The helper stores the selected effect-type index from `[this+0x7c]` into row dword `+0x00`, rewrites opcode byte `+0x08` and scalar dword `+0x04` through the descriptor-driven mapper at `0x004d64a0`, preserves or clears the sign bit on the opcode byte as needed, and then refreshes the smaller boolean or numeric side fields before the staged row is ready for the higher-level window logic. Current grounded callers are the constructor `0x004d6d60`, the vtable-bound message dispatcher `0x004d7060`, and the smaller callback remap path around `0x004d70a2`, so this is the safest current read for editor-state commit into the staged effect row rather than another formatter.","objdump + EventEffects.win constructor and handler correlation + local disassembly + staged-row-commit correlation"
0x004d6d60,763,shell_event_effects_window_construct,shell,thiscall,inferred,objdump + EventEffects.win string xref + control-binding inspection,3,"Constructs the shell-side `EventEffects.win` window. The constructor installs vtable `0x005d0cf4`, binds `EventEffects.win` through `0x0053fa50`, stores the incoming staged effect-row record at `[this+0x78]`, mirrors its key fields into the local window state at `[this+0x7c]` and the stack-built numeric caches used by the row editors, binds the grouped effect-row callbacks at `0x004d6d30`, and then repaints the visible controls through the same window-local refresh family. Current grounded string xref is direct at `0x004d6da5`, which makes this the clean owner for the effects window rather than a generic event editor child.","objdump + EventEffects.win string xref + control-binding inspection + staged-row-field correlation"
0x004d7060,166,shell_event_effects_window_handle_message,shell,thiscall,inferred,objdump + EventEffects.win vtable slot + local disassembly,3,"Primary shell-message dispatcher bound in vtable slot `0x005d0cf8` for `EventEffects.win`. The handler switches on incoming shell messages `0xc9`, `0xca`, and the callback-style `0x04` path, remaps the constructor-bound callback controls at `0x4fb1` and `0x4fd4` into the `0xc9` branch, validates staged effect-row state through `0x004d67f0`, and dispatches the effect-window command strip rooted at ids such as `0x4fb3..0x5047` through the grouped-row and detail refresh helpers `0x004d5d00`, `0x004d5f50`, and `0x004d6090`. Current direct evidence is the `EventEffects.win` vtable at `0x005d0cf4`, whose second slot points to `0x004d7060`, so this is the clean message owner for the effects window rather than just the smaller callback lane.","objdump + EventEffects.win vtable slot + local disassembly + callback-remap correlation"
0x004d9dc0,123,shell_open_event_conditions_modal_and_return_result,shell,cdecl,inferred,objdump + constructor call correlation + local disassembly,3,"Shared modal opener for `EventConditions.win`. The helper allocates an `0x88`-byte window object, constructs it through `shell_event_conditions_window_construct` `0x004d57c0` with the caller-supplied live condition row pointer plus the extra boolean argument, enters the common shell modal loop through `0x538f10`, then destroys and frees the modal object before returning the dialog result code. Current grounded callers are the add and edit condition-row verbs around `0x004da640` and `0x004da700`, which makes this the clean owner for condition-row modal launch rather than an anonymous allocator wrapper.","objdump + constructor call correlation + local disassembly + modal-loop correlation"
0x004d9e40,120,shell_open_event_effects_modal_and_return_result,shell,cdecl,inferred,objdump + constructor call correlation + local disassembly,3,"Shared modal opener for `EventEffects.win`. The helper allocates an `0x80`-byte window object, constructs it through `shell_event_effects_window_construct` `0x004d6d60` with the caller-supplied staged effect-row pointer, enters the common shell modal loop through `0x538f10`, then runs the effect-window close tail at `0x004d5b90`, destroys the modal object, and returns the dialog result code. Current grounded callers are the add and edit grouped-effect verbs around `0x004da7c0` and `0x004da860`, which makes this the clean owner for the effect-row modal launch rather than another small wrapper.","objdump + constructor call correlation + local disassembly + modal-loop correlation"
0x004d9ed0,116,shell_event_conditions_window_remove_selected_condition_row,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Remove verb beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, uses the current selected condition-row index at `[this+0x94]` to unlink one node from the standalone condition-row list rooted at `[event+0x00]`, frees the removed `0x1e`-row allocation through `0x53b080`, then refreshes the visible row list through `shell_event_conditions_window_refresh_condition_row_list_panel` `0x004d8120` and re-enters the surrounding condition-window repaint tail at `0x004d9970`. Current grounded caller is the conditions-side command family under `0x004dbcc3`, so this is the safest current read for selected condition-row deletion rather than a generic list unlink helper.","objdump + caller correlation + local disassembly + linked-list-unlink correlation"
0x004d9f50,546,shell_event_conditions_window_refresh_selected_event_mode_strip_and_summary_panels,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Refreshes the selected-event mode strip and summary text panels beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, republishes the boolean toggle on control `0x4e93` from event byte `[event+0x800]`, selects one mode button across `0x4e8f/0x4e90/0x4e91` from event byte `[event+0x7ee]`, and restyles the whole mode strip `0x4e8e..0x4e92` with the current active choice. It then re-enters `shell_event_conditions_window_refresh_selected_event_mode_dependent_detail_rows` `0x004d9390` and republishes several dynamic-text controls from the current event record, including the main summary text at `[event+0x0e0]` into `0x4eac` and the later fixed text bands rooted at offsets `+0x4ca`, `+0x593`, and `+0x65c` into controls such as `0x4fdf`, `0x4fe0`, and `0x4fe1`. Current grounded callers are the broader conditions refresh family `0x004db120` and the main conditions-window dispatcher `0x004dbb80`, so this is the safest current read for the selected-event mode strip and summary-panel refresh rather than a generic text repaint.","objdump + caller xrefs + local disassembly + mode-strip correlation + dynamic-text-panel correlation"
0x004da640,185,shell_event_conditions_window_append_default_condition_row_via_modal,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Add verb beneath `EventConditions.win`. The helper allocates and zero-initializes one default `0x1e`-byte condition row, seeds row dword `+0x00` with default id `0x0e` plus row byte `+0x04` with subtype `4`, then opens the condition-row modal through `shell_open_event_conditions_modal_and_return_result` `0x004d9dc0`. When the modal returns accept code `0x4f73`, the helper either appends the resulting row at the end of the current condition-row list or installs it as the first row on an empty event, then refreshes the visible list through `0x004d8120` and the surrounding condition-window repaint through `0x004d9970`. Current grounded caller is the conditions-side command family at `0x004dbca8`, which makes this the clean current owner for default condition-row creation rather than an anonymous allocator branch.","objdump + caller correlation + local disassembly + modal-return correlation"
0x004da700,182,shell_event_conditions_window_edit_selected_condition_row_via_modal,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Edit verb beneath `EventConditions.win`. The helper resolves the selected live event and selected condition-row index `[this+0x94]`, walks the standalone condition-row list to the chosen row, and opens the current row in the condition modal through `shell_open_event_conditions_modal_and_return_result` `0x004d9dc0`. On accept code `0x4f73`, it writes the edited row back in place; one negative-id branch also duplicates the selected row into a fresh `0x1e` allocation before reinserting it at the head. The helper then refreshes the row list through `0x004d8120` and the surrounding condition-window repaint through `0x004d9970`. Current grounded caller is the conditions-side command family at `0x004dbcb1`, so this is the safest current read for selected condition-row edit rather than another raw list walk.","objdump + caller correlation + local disassembly + modal-return correlation"
0x004da7c0,155,shell_event_effects_window_append_grouped_effect_row_via_modal,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Add verb beneath `EventEffects.win`. The helper allocates and zero-initializes one default `0x28`-byte grouped effect row, seeds row dword `+0x00` with default opcode `2`, opens the effects modal through `shell_open_event_effects_modal_and_return_result` `0x004d9e40`, and on accept code `0x4fb1` appends the resulting row to the currently selected effect-group list anchor `[event + group*4 + 0x04]` using the active group index at `[this+0x9c]`. It then refreshes the grouped effect rows through `0x004d88f0` and re-enters the broader effects-window repaint through `0x004da0f0`. Current grounded caller is the effects-side command family at `0x004dbc84`, which makes this the clean current owner for grouped effect-row creation rather than another allocator stub.","objdump + caller correlation + local disassembly + grouped-list-append correlation"
0x004da860,179,shell_event_effects_window_edit_selected_grouped_effect_row_via_modal,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Edit verb beneath `EventEffects.win`. The helper resolves the selected live event, selected effect group `[this+0x9c]`, and selected row index `[this+0x98]`, copies the chosen `0x28`-byte grouped effect row into a stack staging buffer, and opens the effects modal through `shell_open_event_effects_modal_and_return_result` `0x004d9e40`. On accept code `0x4fb1` it writes the edited row back in place, then refreshes the grouped effect rows through `0x004d88f0` and the broader effects-window repaint through `0x004da0f0`. Current grounded caller is the effects-side command family at `0x004dbd02`, so this is the safest current read for selected grouped effect-row edit rather than another modal wrapper.","objdump + caller correlation + local disassembly + grouped-row-staging correlation"
0x004da920,126,shell_event_effects_window_remove_selected_grouped_effect_row,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Remove verb beneath `EventEffects.win`. The helper resolves the selected live event, selected effect group `[this+0x9c]`, and selected row index `[this+0x98]`, unlinks one node from the chosen grouped effect-row list anchored at `[event + group*4 + 0x04]`, frees the removed `0x28`-byte allocation through `0x53b080`, then refreshes the grouped effect rows through `0x004d88f0` and the broader effects-window repaint through `0x004da0f0`. Current grounded caller is the effects-side command family at `0x004dbd1d`, so this is the safest current read for selected grouped effect-row deletion rather than a generic list helper.","objdump + caller correlation + local disassembly + grouped-list-unlink correlation"
0x004da9a0,400,shell_event_conditions_window_refresh_current_grouped_effect_summary_state_from_selected_event,shell,thiscall,inferred,objdump + local disassembly + RT3.lng correlation,3,"Selected grouped-summary state refresh beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, uses current grouped selector `[this+0x9c]`, republishes checkbox control `0x500a` from event byte lane `[event + group*4 + 0x7ff]`, mirrors event dword lane `[event + group*4 + 0x80f]` into local selector field `[this+0x8c]` and control `0x500b` when that stored value is nonnegative, and then republishes grouped target-scope ordinal byte `[event + group + 0x7fb] = 0..8` through the visible target-scope display family `0x5014..0x501c`. The jump table is now explicit here too: ordinal `0..8` activates visible controls `0x5014..0x501c` one-to-one, which is the strongest current evidence that those visible rows are a display mirror over the hidden canonical selector family `0x5006..0x500e` rather than a second label-distinct mode family. Current strongest label fit for those stored ordinals is `object being evaluated`, `whole game`, `all/human/AI companies`, `specified territories`, and `all/human/AI players`; each ordinal case then tails directly into the broader grouped-effect target-scope refresh at `0x004da0f0`. Current grounded callers are the selected-event strip refresh `0x004db120` and grouped-band selection tail `0x004dbf93`, so this is the safest current read for republishing the currently selected grouped summary state from stored event data rather than a generic control write loop.","objdump + local disassembly + grouped-summary-state correlation + ordinal-mapping correlation + RT3.lng correlation"
0x004dab60,212,shell_event_conditions_window_refresh_selected_grouped_effect_target_scope_strip,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng correlation + grouped-band dispatch-table decode,3,"Refreshes the selected grouped-effect target-scope strip beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, reads current grouped selector `[this+0x9c]`, republishes checkbox control `0x500a` from event byte lane `[event + group*4 + 0x7ff]`, and then republishes grouped target-scope ordinal byte `[event + group + 0x7fb] = 0..8` through the visible display family `0x5014..0x501c`. The surrounding enable logic is tighter too: grouped effect-row type mask bit `0x08` gates `0x5015` (`whole game`), bit `0x01` gates the company-target trio `0x5016..0x5018`, bit `0x02` gates the player-target trio `0x501a..0x501c`, and bit `0x04` gates the paired territory-target lane `0x500b/0x5019`. When the territory lane is absent the helper falls back to local selector state `[this+0x8c]` for `0x500b`; and when any target-scope lane is active it first tries to re-enable one hidden selector from `0x5006..0x500e`, falling back to the persisted control id in `0x00622074` only when no current visible target-scope display row is already active. Current code now makes the hidden/display split firmer too: `0x5006..0x500e` are the canonical hidden selectors stored by `0x004d8d50`, while `0x5014..0x501c` are the visible one-to-one mirror rows republished by `0x004da9a0` and styled here. The grouped-band `0x4dc09c` table keeps the remaining boundary explicit: visible rows `0x5014..0x501c` do not dispatch to the target-scope selector case directly; they only re-enter the smaller `0x004d9d10` territory-target affordance path on the `0xcf` side, so this helper remains the safest current owner for the actual stored target-scope refresh rather than a generic control-style helper.","objdump + caller xrefs + local disassembly + ordinal-mapping correlation + persisted-selection correlation + RT3.lng correlation + grouped-band dispatch-table decode"
0x004daf40,367,shell_event_conditions_window_reset_selected_event_summary_placeholders,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Selection-bootstrap helper beneath `EventConditions.win` that clears and republishes the dynamic-text placeholder band when the selected event changes or no live event is currently active. The helper writes the same fixed placeholder text block rooted at `0x005c87a8` back into controls `0x4eaf`, `0x4eac`, `0x4ed9`, `0x4edb`, and `0x4fdf..0x4fe2`, then repaints those controls through the generic shell path before the broader selected-event refresh continues. Current grounded callers are `shell_event_conditions_window_set_selected_event_id_and_refresh_if_open` `0x004db6a0` and the callback-binding bootstrap `0x004db6f0`, so this is the safest current read for selected-event summary placeholder reset rather than another local dispatcher fragment.","objdump + caller xrefs + local disassembly + placeholder-control correlation"
0x004da0f0,1350,shell_event_conditions_window_refresh_controls,shell,thiscall,inferred,objdump + caller xrefs + EventConditions.win correlation + RT3.lng correlation + grouped-band dispatch-table decode,3,"Shared refresh pass for `EventConditions.win`. The helper resolves the currently selected live event record from collection `0x0062be18`, samples grouped effect-row type flags for the current grouped selector `[this+0x9c]` through `scenario_event_query_grouped_effect_row_list_type_flags` `0x0042d740`, then consults the adjacent runtime-condition helpers `0x0042dff0`, `0x0042df30`, `0x0042df70`, and `0x0042dfb0` to decide which condition rows should be enabled, disabled, or summarized through the condition-side controls rooted at ids such as `0x5005..0x501c`. The selector pair `0x5001/0x5002` now has a tighter split here: `0x5001` gates the standalone condition test-scope side consumed by `0x004d9970`, with RT3.lng `1573` `Test against...` now the strongest current label fit, while `0x5002` gates the grouped-effect target-scope side, with RT3.lng `1606` `Apply effects...` now the strongest current label fit. On that `0x5002` branch, when control `0x4ed5` is active and the current condition aggregates permit it, the helper builds dynamic-text control `0x5014` from RT3.lng `1160..1164`, yielding `to the company/player/player (i.e. chairman)/territory for which the condition is TRUE`; current RT3.lng correlation then gives the strongest current label fit for the remaining visible target-scope display rows as `0x5015 = to the whole game`, `0x5016..0x5018 = to all/human/AI companies`, `0x5019 + 0x500b = to territories` with a stored target parameter, and `0x501a..0x501c = to all/human/AI players`. The same pass now has a tighter mask split too: grouped effect-row type flag bit `0x08` gates `0x5015`, bit `0x01` gates the company-target trio `0x5016..0x5018`, bit `0x04` gates the territory-target lane `0x500b/0x5019`, and bit `0x02` gates the player-target trio `0x501a..0x501c`. The grouped-band `0x4dc09c` table now keeps the interaction boundary honest too: controls `0x5001/0x5002` are the only `0x4fed..0x501c` entries that route into the grouped target-scope selector case `0x004dbfca` on the `0xcf` side, while visible rows `0x5014..0x501c` route only to the smaller `0x004d9d10` affordance path. The same pass also re-enters `shell_event_conditions_window_refresh_condition_class_summary_and_group_rows` `0x004d9970`, `shell_event_conditions_window_refresh_selected_event_mode_strip_and_summary_panels` `0x004d9f50`, and the smaller territory-target affordance helper `0x004d9d10` before finishing the common window-side repaint tail. Current grounded callers sit in the surrounding event-condition message family near `0x004dbce0`, which makes this the safest current owner for condition-window refresh rather than only a one-off formatter.","objdump + caller xrefs + EventConditions.win correlation + condition-helper correlation + grouped-effect-flag correlation + RT3.lng correlation + grouped-band dispatch-table decode"
0x004db120,1024,shell_event_conditions_window_refresh_selected_event_strip_and_navigation,shell,thiscall,inferred,objdump + local disassembly + caller xrefs + event-selector correlation,3,"Broad selected-event repaint beneath `EventConditions.win`. The helper first enables or disables the selected-event strip rooted at `0x4e84..0x5077` depending on whether `[this+0x84]` holds a live event id, seeds grouped selector `[this+0x9c]` to `0`, re-enables the first grouped summary band `0x4fed`, republishes the persisted grouped target-scope selector id from `0x00622074`, and then resolves the selected live event through collection `0x0062be18` before re-entering `0x004dab60`, `shell_event_conditions_window_refresh_selected_event_mode_strip_and_summary_panels` `0x004d9f50`, `shell_event_conditions_window_refresh_condition_class_summary_and_group_rows` `0x004d9970`, `shell_event_conditions_window_refresh_condition_row_list_panel` `0x004d8120`, and the grouped-row refresh tail `0x004d88f0`. The same pass also republishes the fixed selected-event selector band `0x4e98..0x4ea2` from event byte `[event+0x7ef]`, the summary headers `0x4ead/0x4eae` from `[event+0x7f5]` and `[event+0x7f0]`, the modifier bands `0x4ec0..0x4ec4` and `0x4eb6..0x4eb9` from `[event+0x7f9]` and `[event+0x7fa]`, and the grouped-mode trio `0x4eca..0x4ecc` from `[event+0x7f4]`. The closing count check against `0x0062be18` also gates navigation controls `0x4e85` and `0x4e86`, so this is the safest current owner for selected-event strip and navigation refresh rather than a generic repaint tail.","objdump + local disassembly + caller xrefs + event-record-field correlation + grouped-selection-bootstrap correlation + navigation-control correlation"
0x004db520,192,shell_event_conditions_window_select_previous_event_and_refresh,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Backward selected-event stepping verb beneath `EventConditions.win`. When `[this+0x84]` holds a live event id, the helper resolves the current event record, queries the neighboring live event id through collection helper `0x005184f0(..., 2)`, and when a valid predecessor exists it clears staged condition selection through `0x004d8ea0`, copies the stepped event id into `[this+0x84]`, rebuilds the selector list through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`, and re-enters the broader selected-event repaint `0x004db120`. It finally republishes control `0x4e84` with the new selected row. Current grounded dispatcher caller is the first event-strip navigation case at `0x004dbc5c`, so this is the safest current read for selected-event previous-step and refresh rather than a generic collection walk.","objdump + local disassembly + dispatcher correlation + event-selector-list correlation"
0x004db5e0,192,shell_event_conditions_window_select_next_event_and_refresh,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Forward selected-event stepping verb beneath `EventConditions.win`. The helper mirrors `0x004db520`, but after querying the stepped event id through `0x005184f0(..., 2)` it rejects the end-of-strip sentinel when the returned ordinal reaches current field `[this+0x90]`, then commits the next live event into `[this+0x84]`, rebuilds the selector list through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`, re-enters `shell_event_conditions_window_refresh_selected_event_strip_and_navigation` `0x004db120`, and republishes control `0x4e84` with the new selected row. Current grounded dispatcher caller is the sibling event-strip navigation case at `0x004dbc70`, so this is the safest current read for selected-event next-step and refresh rather than another generic list walk.","objdump + local disassembly + dispatcher correlation + end-of-strip-sentinel correlation"
0x004db6a0,80,shell_event_conditions_window_set_selected_event_id_and_refresh_if_open,shell,cdecl,inferred,objdump + local disassembly + callback-binder correlation,3,"Shared selected-event setter beneath `EventConditions.win`. The helper accepts one live event id in `edx`, checks whether the global conditions-window singleton at `0x006cff84` is either inactive or ready for refresh through `0x004d8ea0`, and then writes the requested event id into `[window+0x84]`, re-enters `0x004daf40` plus the broader selected-event repaint `0x004db120`, and mirrors the same id into pending field `0x00622070`. Current grounded caller is the event-selector callback bound on control `0x4e84` from `0x004db6f0`, so this is the safest current owner for selected-event id publish and refresh rather than a generic global setter.","objdump + local disassembly + callback-binder correlation + pending-selection-field correlation"
0x004db6f0,1168,shell_event_conditions_window_bind_event_selector_callbacks_and_seed_pending_selection,shell,thiscall,inferred,rizin + local disassembly + callback-binding correlation,3,"Post-construction callback binder and pending-selection bootstrap for `EventConditions.win`. The helper installs callback-style bindings across the selected-event and summary controls, including the event selector `0x4e84` through `shell_event_conditions_window_set_selected_event_id_and_refresh_if_open` `0x004db6a0` and several summary bands through the window-local callback family rooted at `0x004d71b0`, `0x004d78d0`, `0x004d7950`, `0x004d7960`, `0x004d7970`, and `0x004d7980`. It then seeds the current event selection from pending id `0x00622070`, resets grouped selection `[this+0x9c]`, refreshes the smaller summary side through `0x004d7fe0`, rebuilds the event selector list through `0x004d7ef0`, re-enters `0x004daf40`, and finishes with the broader selected-event repaint `0x004db120`. Current grounded caller is the neighboring conditions-window bring-up branch at `0x004ce204`, so this is the safest current read for event-selector callback binding and pending-selection bootstrap rather than a generic constructor fragment.","rizin + local disassembly + callback-binding correlation + pending-selection-bootstrap correlation"
0x004db8b0,718,shell_event_conditions_window_append_blank_or_clone_selected_event_via_name_modal,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + dispatcher correlation,3,"Selected-event add or clone helper beneath `EventConditions.win`. One caller-controlled boolean selects between a blank event path and a clone-selected-event path: boolean `0` seeds the modal text from localized ids `0x47a` and `0x47c`, while boolean `1` uses the current selected event name plus localized ids `0x47b` and `0x47c`. On accept the helper opens the shared custom modal through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0`, creates and selects a new live event through `0x00432ea0`, optionally deep-copies the currently selected live event into that new record through `scenario_event_clone_runtime_record_deep_copy` `0x0042e050`, then rebuilds the selector list through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`, re-enters the broader selected-event repaint `0x004db120`, and republishes control `0x4e84`. Current grounded dispatcher callers are controls `0x4e87` and `0x4e88` through `0x004dbbfd` and `0x004dbc1e`, so this is the safest current read for blank-event append or selected-event clone via name modal rather than an effects-window refresh.","objdump + caller xrefs + local disassembly + dispatcher correlation + modal-name-flow correlation"
0x004dba90,236,shell_event_conditions_window_rename_selected_event_via_name_modal,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Rename verb for the selected live event beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, copies the current name field `[event+0x18]`, opens the shared custom modal through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` with localized id `0x47d`, and on accept writes the edited name back into the live event record before rebuilding the selector list through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`, restoring the selected id, re-entering `shell_event_conditions_window_refresh_selected_event_strip_and_navigation` `0x004db120`, and republishing control `0x4e84`. Current grounded dispatcher caller is control `0x4e89` through `0x004dbd6e`, so this is the safest current read for selected-event rename via name modal rather than another selector refresh tail.","objdump + local disassembly + dispatcher correlation + modal-rename correlation"
0x004dbe7a,100,shell_event_conditions_window_open_choice_event_single_player_only_warning_modal,shell,thiscall,inferred,objdump + local disassembly + switch-table decode + RT3.lng string correlation,3,"Small warning-modal branch beneath `EventConditions.win` reached from the `0x4ec6/0x4ec7` control pair. The helper first checks whether selected-event mode control `0x4e8f` is active, and only on that branch forces grouped-mode control `0x4eca` active before opening the shared custom modal through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` with localized id `0x0f2f` `3887`, whose grounded RT3.lng text warns that `Choice` events are single-player only and not allowed in multiplayer games. The branch does not otherwise mutate persistent event state, so this is the safest current read for a choice-event single-player-only warning modal rather than a grouped-action commit path.","objdump + local disassembly + switch-table decode + RT3.lng string correlation + mode-control correlation"
0x004dbeeb,116,shell_event_conditions_window_publish_pending_shared_summary_text_triplet,shell,thiscall,inferred,objdump + local disassembly + switch-table decode,3,"Pending dynamic-text publish helper beneath `EventConditions.win` reached from control `0x4ed9` when global latch `0x006d07d8` is clear. The helper copies one current shell text payload into a local `0x7d0` buffer, republishes that same text into controls `0x4eac`, `0x4ed9`, and `0x4edb` through the generic type-`0x6f` dynamic-text path, and then clears `0x006d07d8`. This is therefore the safest current read for publishing one pending shared summary-text triplet rather than a generic selection refresh.","objdump + local disassembly + switch-table decode + dynamic-text-control correlation"
0x004dbb80,1074,shell_event_conditions_window_dispatch_selected_event_strip_and_grouped_band_actions,shell,thiscall,inferred,objdump + local disassembly + switch-table decode + control-id correlation + grouped-band dispatch-table decode,3,"Broader `EventConditions.win` command dispatcher above the selected-event strip and grouped-band controls. The helper switches on shell messages `0xca`, `0xcb`, and `0xcf`, then uses the decoded `0x4dc000`, `0x4dc018`, `0x4dc050`, and `0x4dc08c` tables to route control families rooted at `0x4e84..0x4ea1`, `0x4eac..0x4ed9`, and `0x4fed..0x501c`. The selected-event strip is now explicit on the `0xcb` side: controls `0x4e85/0x4e86` step previous or next events through `0x004db520/0x004db5e0`, `0x4e87/0x4e88` add a blank event or clone the selected event through `0x004db8b0(0/1)`, `0x4e89` renames the selected event through `0x004dba90`, and `0x4e8a` deletes it through `0x004d9360`. The `0xca` side also owns the selected-event mode strip rooted at `0x4e98..0x4ea1`, where the baseline band writes event byte `[event+0x7ee] = 0` before re-entering `0x004d9f50`, while control `0x4ea1` writes special mode `4` and then refreshes the same strip. The later grouped-band `0xcf` cases are now bounded more tightly by the `0x4dc09c` byte map: grouped summary controls `0x4fed..0x4ff0` route to `0x004dbf93`, selector pair `0x5001/0x5002` route to `0x004dbfca`, visible target-scope display rows `0x5014..0x501c` route only to `0x004dbf7f -> 0x004d9d10`, and the remaining `0x4ff1..0x5013` span falls through the default no-op case. This is therefore the safest current owner for selected-event strip and grouped-band action dispatch rather than leaving those bands distributed across unnamed case blocks.","objdump + local disassembly + switch-table decode + control-id correlation + grouped-band correlation + grouped-band dispatch-table decode"
0x004dbfca,32,shell_event_conditions_window_select_grouped_effect_target_scope_mode_and_refresh,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation + grouped-band dispatch-table decode + RT3.lng correlation,3,"Grouped target-scope mode selector case beneath `EventConditions.win` on the `0xcf` grouped-band path. The helper first commits the currently visible selected-event text panels through `shell_event_conditions_window_commit_current_selected_event_text_panels_before_selection_change` `0x004d8ea0`, then refreshes the grouped-effect target-scope strip through `shell_event_conditions_window_refresh_selected_grouped_effect_target_scope_strip` `0x004dab60`, and finally stores the clicked control id into global `0x00622074` so the same target-scope selector can be re-enabled during later selected-event bring-up at `0x004db120`. The `0x4dc09c` dispatch table now keeps the control family honest: this case is only reached by controls `0x5001` and `0x5002`, not by visible rows `0x5014..0x501c`. Current RT3.lng adjacency gives those two controls their strongest current player-facing fit too: `0x5001` is the condition-side `Test against...` mode and `0x5002` is the grouped-effect-side `Apply effects...` mode. This is therefore the safest current read for grouped target-scope mode selection and refresh rather than for the whole visible target-scope display family.","objdump + local disassembly + dispatcher correlation + grouped-band dispatch-table decode + persisted-selection correlation + RT3.lng correlation"
0x004dbf93,55,shell_event_conditions_window_select_grouped_effect_summary_band_and_refresh,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Grouped-band selector verb beneath `EventConditions.win`. The helper first commits the current grouped-effect summary editor state through `shell_event_conditions_window_commit_current_grouped_effect_summary_state_before_group_switch` `0x004d8d50`, stores the newly chosen grouped selector ordinal `control_id - 0x4fed` into `[this+0x9c]`, refreshes the visible grouped rows through `0x004d88f0`, re-enters the surrounding condition-window repaint through `0x004da0f0`, and then finishes with the smaller grouped summary tail at `0x004da9a0`. Current grounded dispatcher caller is the `0x4fed..0x4ff0` case family under `0x004dbb80`, so this is the safest current read for grouped-effect summary band selection and refresh rather than a generic selector write.","objdump + local disassembly + dispatcher correlation + grouped-band-selector correlation"
0x004c8670,11,shell_mark_custom_modal_dialog_dirty,shell,cdecl,inferred,objdump + nearby-constructor correlation + frame-caller inspection,4,"Tiny dirty-latch setter paired with the shared callback-driven custom modal family rooted at `0x006cfeb4`. The helper stores `1` into `0x006cfeac`, which current nearby call patterns treat as the custom-modal refresh or service request latch after the lower constructor at `0x004c86c0` and opener `shell_open_custom_modal_dialog_with_callbacks` have published a live modal object. Current grounded caller is the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`.","objdump + nearby-constructor correlation + frame-caller inspection + custom-modal correlation"
0x004c8680,14,shell_has_live_custom_modal_dialog,shell,cdecl,inferred,objdump + nearby-constructor correlation + frame-caller inspection,4,"Tiny presence probe for the shared callback-driven custom modal family. The helper reads the live modal singleton at `0x006cfeb4`, returns `1` when that pointer is positive or nonnull, and returns `0` otherwise. Current grounded caller is the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where this branch now sits beside the `LoadScreen`, file-options, and other shell-window probes rather than any detached gameplay-only UI owner.","objdump + nearby-constructor correlation + frame-caller inspection + custom-modal correlation"
0x004e1d60,1169,shell_load_screen_refresh_page_strip_and_page_kind_controls,shell,thiscall,inferred,objdump + descriptor-table decode + caller inspection,4,"Shared refresh helper beneath the shell-side `LoadScreen.win` family. The helper reads the active 13-byte page descriptor record at `0x006220a0 + page*0x0d` using current page id `[this+0x78]`, where the record now grounds as `{ page_kind_dword, title_string_id, back_link_page_dword, selected_company_header_flag_byte }`. It copies the descriptor kind into `[this+0x80]`, refreshes the page-strip and companion controls `0x3e80`, `0x3e81`, `0x3eee..0x3ef7`, `0x3ef8`, `0x3efb`, `0x3efc`, `0x3f0a`, `0x3f0b`, and `0x3f0e` through the generic shell control path at `0x00540120`, and applies page-specific row-band styling from current page-local row state `[this+0x7c]`, row count `[this+0x84]`, and stacked selection history `[this+0x0a0..0x118]`. The descriptor decode now also bounds control `0x3ef8` as the table-driven backlink affordance: page `0` keeps backlink `0`, page `1` backlinks to page `2`, page `8` backlinks to page `7`, page `0x0b` backlinks to page `0x0a`, and page `0x0d` backlinks to page `0x0c`. Current descriptor decode therefore keeps page `0` as kind `0`, title id `1200` `XXX`, backlink `0`, and header flag `0`; page `1` as company-overview kind `1` with backlink page `2`; page `8` as player-detail kind `3` with backlink page `7`; page `0x0b` as dormant train-detail title with backlink page `0x0a`; and page `0x0d` as dormant station-detail title with backlink page `0x0c`. Current grounded caller is `shell_load_screen_select_page_subject_and_refresh` at `0x004e2c10`, which uses this helper after storing a new page or subject selection.","objdump + descriptor-table decode + caller inspection + control-style correlation + backlink-control correlation"
0x004e2c10,3472,shell_load_screen_select_page_subject_and_refresh,shell,thiscall,inferred,objdump + caller inspection + state-flow correlation,4,"Shared page or subject selector beneath the shell-side `LoadScreen.win` family rooted at `0x006d10b0`. The helper accepts a page id, a page-local subselector, and an optional subject id; defaults of `-1` reuse the current fields at `[this+0x78]`, `[this+0x7c]`, and caller-selected company or profile state. It stores the chosen page in `[this+0x78]`, the subselector in `[this+0x7c]`, resets several page-local fields including `[this+0x84]` and the report-row latch at `[this+0x75c]`, updates the current company id `[this+0x88]` or profile id `[this+0x8c]` depending on page ownership, and then repaints the active page controls through `0x00563250` and `0x0053fe00`. Several page-specific branches also recompute bounded row-count state for the report lists on pages `0x0a`, `0x0c`, `0x0f`, and `0x0e`, including row styling over control band `0x3f48..`. The surrounding descriptor table now makes one narrower part of this family explicit too: when control `0x3ef8` is used as a backlink affordance, the selected page target comes from the current descriptor backlink dword rather than from a separate hardcoded detail-page branch. Current grounded callers include the broad `LoadScreen.win` dispatcher at `0x004e3a80`, the page-specific stock-holdings branch at `0x004e45d0`, and the selected-company or selected-profile step helpers at `0x004e3a00` plus `0x004e45d0`, so this now reads as the family-wide page or subject refresh owner rather than a CompanyDetail helper.","objdump + caller inspection + state-flow correlation + page-refresh correlation + backlink-target correlation"
0x004e3a00,112,shell_load_screen_step_selected_company_delta,shell,thiscall,inferred,objdump + caller inspection + company-collection correlation,4,"Steps the current `LoadScreen.win` selected company forward or backward across the active company roster. The helper wraps `selected_company + delta` through `company_collection_count_active_companies` at `0x00429a50`, resolves the replacement id through `company_collection_get_nth_active_company_id` at `0x00429990`, stores it into `[this+0x88]`, and then re-enters `shell_load_screen_select_page_subject_and_refresh` at `0x004e2c10` with the current page id in `[this+0x78]`. Current grounded callers are the `0x3efd/0x3efe` year or company navigation lane inside `LoadScreen.win`.","objdump + caller inspection + company-collection correlation + page-refresh correlation"
0x004e3a80,2900,shell_load_screen_window_handle_message,shell,thiscall,inferred,objdump + caller inspection + resource correlation,4,"Primary message dispatcher for the shell-side `LoadScreen.win` family rooted at singleton `0x006d10b0`. The handler switches on the incoming shell message id and owns page state `[this+0x78]`, page-local substate `[this+0x7c]`, page-kind byte `[this+0x80]`, current company `[this+0x88]`, current chairman profile `[this+0x8c]`, display year `[this+0x9c]`, and the page-local report-row latch `[this+0x118]`. Message `0xcb` on the page-strip controls routes through the page-kind dispatch rooted at `[this+0x80]`, where several cases re-enter `shell_load_screen_select_page_subject_and_refresh` at `0x004e2c10`, the company-step helper at `0x004e3a00`, or narrower page handlers such as `0x004e45d0`. One separate control band `0x3fd4..0x4073` selects report or list pages by updating `[this+0x75c]` and a boolean accent latch `[this+0x760]` before refreshing control `0x3fac`. The row band `0x3f48..0x3f51` is tighter now too: on page `7` it promotes one selected player row into page `8` through `shell_load_screen_select_page_subject_and_refresh`; on page `0x0a` it routes the chosen train through the shell detail-panel manager `0x004ddbd0` in mode `2` and then centers via `0x00437a90`; on page `0x0c` it routes the chosen station through the same manager in mode `5` and then centers via `0x00437a90`; and on page `0x0f` it routes the chosen industry or building through the same manager in mode `0x0a` before the same centering path. Current grounded ownership therefore includes the company or profile page routes for ids `0`, `2`, `7`, `8`, `9`, `0x0a`, `0x0c`, `0x0e`, and `0x0f`, while the title-table detail ids `0x0b` and `0x0d` still do not appear on the live row-click path or any recovered page-strip action lane. This makes `0x004e3a80` the real outer `LoadScreen.win` message owner above the sibling renderers at `0x004e5300`, `0x004e5a80`, and `0x004e5cf0` rather than a loose shared helper.","objdump + caller inspection + resource correlation + page-dispatch correlation + report-tab correlation + row-click-route correlation"
0x004e39e0,19,company_query_display_year_or_current_year,simulation,thiscall,inferred,objdump + caller inspection,4,"Tiny company-side helper that returns the optional display year cached at `[this+0x9c]` when nonzero, otherwise falls back to the current scenario year at `[0x006cec78+0x0d]`. Current grounded callers include the shared governance or economy shell formatter at `0x004e5cf0` and several nearby company-readout helpers in the same shell display family.","objdump + caller inspection + year-fallback correlation"
0x004e1f50,14,shell_has_live_load_screen_window,shell,cdecl,inferred,objdump + global-state inspection + frame-caller inspection,4,"Tiny shell-side presence probe for `LoadScreen.win`. The helper reads the live ledger singleton at `0x006d10a8`, returns `1` when that pointer is nonnull, and returns `0` otherwise. Current grounded callers include the frame-owned cadence at `simulation_frame_accumulate_and_step_world` `0x00439140`, where this branch now sits beside other shell-window service probes rather than any detached gameplay-only input owner.","objdump + global-state inspection + frame-caller inspection + LoadScreen singleton correlation"
0x004e1f60,11,shell_mark_load_screen_window_dirty,shell,cdecl,inferred,objdump + global-state inspection + frame-caller inspection,4,"Tiny shell-side dirty-flag setter paired with `shell_has_live_load_screen_window`. The helper stores `1` into `0x006d10a4`, which current nearby call patterns treat as the `LoadScreen.win` refresh or service request latch once the live ledger singleton at `0x006d10a8` exists. Current grounded caller is the post-step shell-window service ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`.","objdump + global-state inspection + frame-caller inspection + LoadScreen singleton correlation"
0x004e45d0,757,shell_load_screen_profile_stock_holdings_page_handle_message,shell,thiscall,inferred,objdump + RT3.lng strings + control-id inspection,4,"Page-specific message handler for the `LoadScreen.win` stock-holdings slice. The handler owns controls `0x3ef6..0x3f1d` while page-kind `[this+0x80]` selects this branch from the outer dispatcher at `0x004e3a80`. Current grounded state includes the selected profile id `[this+0x8c]`, selected company id `[this+0x88]`, optional display year `[this+0x9c]`, and a local row index `[this+0x118]`. Controls `0x3ef6` and `0x3ef7` step `[this+0x118]` backward or forward within a bounded `0..10` band before re-entering `shell_load_screen_select_page_subject_and_refresh` at `0x004e2c10`; `0x3ef8`, `0x3efb`, and `0x3efc` reuse that same helper to activate or step the current company row and page-local selector state. The later jump-table lane rooted at `0x3f07` also cycles the selected profile through the active-chairman collection at `0x006ceb9c` using `profile_collection_count_active_chairman_records` at `0x00477820`, `0x005184f0`, and `0x00518380`, then refreshes the current page through `0x004e2c10`. The same page branch adjusts the display year `[this+0x9c]` through the company-step helper `0x004e3a00` and the fallback reader `company_query_display_year_or_current_year` at `0x004e39e0`. Current grounded meaning is the stock-holdings page handler beneath `LoadScreen.win`, not the outer window dispatcher.","objdump + RT3.lng strings + control-id inspection + active-profile-cycle correlation + year-step correlation + row-selection correlation"
0x004e4b10,720,shell_load_screen_reset_runtime_state_and_seed_selection,shell,thiscall,inferred,objdump + caller inspection + state-flow correlation,3,"Lower reset or seed helper used by the `LoadScreen.win` opener before the visible ledger loop begins. The helper clears page state `[this+0x78]`, page-local substate `[this+0x7c]`, display year `[this+0x9c]`, selected company `[this+0x88]`, selected chairman profile `[this+0x8c]`, the page-kind cache `[this+0x80]`, the page-strip history stack rooted at `[this+0x0a0]`, and several presentation-side pointers including `[this+0x0b2d]` and `[this+0x0b31]`. It then seeds the selected company and chairman from the current scenario state through `0x004337a0` and `0x004337b0`, allocates the main text surface at `[this+0x0e55]`, builds several descriptor or name caches under `[this+0x0b25]`, `[this+0x0b29]`, `[this+0x0761..]`, `[this+0x0995..]`, and `[this+0x0b35..]`, binds three callback-style controls `0x3ee4`, `0x3ef4`, and `0x3ee5` through the generic shell control path at `0x00540120`, and stores the caller-selected display year into `[this+0x9c]`. Current grounded caller is the higher `LoadScreen` opener at `0x004e4ee0`, which later enters the page-selection refresh path. This now reads as the runtime reset and cache-seed helper beneath ledger opening rather than as a page renderer.","objdump + caller inspection + state-flow correlation + cache-seed correlation"
0x004e4ee0,406,shell_open_or_focus_load_screen_page,shell,thiscall,inferred,objdump + caller inspection + RT3.lng strings + launch-flow correlation,4,"Shared higher-level opener for the shell-side `LoadScreen.win` ledger family. The caller supplies one requested page id in `ECX`. When sandbox flag byte `[0x006cec7c+0x82]` is set the helper does not open the ledger; instead it raises a simple shell modal through `shell_open_custom_modal_dialog_with_callbacks` using localized id `3899` `The ledger is not available in sandbox mode.`. Outside sandbox it first checks for an existing live ledger runtime at `0x006d10a8`: when one is already open and the requested page id is nonzero it simply re-enters `shell_load_screen_select_page_subject_and_refresh` at `0x004e2c10` with that page; when the live runtime exists and the requested page id is zero it leaves the current page unchanged. When no live runtime exists it allocates the transient ledger object into `0x006d10a8`, resets and seeds it through `shell_load_screen_reset_runtime_state_and_seed_selection` at `0x004e4b10`, enters the visible shell modal loop through `0x00538f10`, and then tears the object back down while restoring the surrounding shell presentation state. Current grounded callers include the world-frame command path at `0x0043970f`, the grouped shell command stubs at `0x0044070e..0x0044086e` for pages `1`, `2`, `3`, `4`, `5`, `6`, `7`, `9`, `0x0a`, `0x0c`, `0x0e`, and `0x0f`, and the shell detail-side launcher at `0x004de82b`; no current recovered opener in that family requests page `0x0b` or `0x0d`. This now reads as the shared open-or-focus ledger-page owner rather than an unnamed helper beside the page family.","objdump + caller inspection + RT3.lng strings + launch-flow correlation + sandbox-guard correlation"
0x004e5130,186,shell_load_screen_render_company_stock_data_panel,shell,thiscall,inferred,objdump + RT3.lng strings + helper correlation,4,"Selected-company stock-data page renderer inside `LoadScreen.win`. The helper first validates the current company id at `[this+0x88]` through the live company collection at `0x0062be10`. When no company is active it emits localized id `1299` `No stocks to view at this time...` through the shell text presenter and restyles control `0x3efd` inactive. On the populated path it falls through into the shared stock-data builder at `0x004c0160` using the temporary holdings buffer at `[this+0x995]`, current row or subselector state at `[this+0x0b25]` and `[this+0x0b29]`, and the stock-data descriptor table rooted at `0x00622098`. That lower helper iterates the active chairman roster, ranks the largest positive holders for the selected company, and formats the `Largest Shareholders`, `Shares`, and `Per Share Data` family under localized ids `928..930`, with the first three per-share rows now bounded as `Share Price`, `Book Value Per Share`, and `Revenue Per Share` from stat-family slots `0x1c..0x1e`. Current grounded caller is page `7` of `shell_load_screen_render_active_page_panel` at `0x004ea060`, so current best page meaning is the `Stock Data` slice rather than another generic company list.","objdump + RT3.lng strings + helper correlation + shareholder-ranking correlation + stock-data fallback correlation + per-share-label correlation"
0x004e51ea,246,shell_load_screen_render_game_status_briefing_panel,shell,thiscall,inferred,objdump + RT3.lng strings + helper correlation,4,"Game-status-side briefing renderer inside `LoadScreen.win`. The helper uses page-local subselector `[this+0x7c]` to build one packed key and then queries the live scenario text store at `0x0062be18` through `0x00432f40` with kind `9`, writing the returned briefing text into a stack buffer before presenting it through the shell text surface rooted at `[this+0x0e55]`. It then appends the localized title or help pair `1772` `Briefing` and `1773` `View the scenario briefing.` through the smaller shell text-widget writer at `0x00563290`. Current grounded caller is page `3` of `shell_load_screen_render_active_page_panel` at `0x004ea060`, so current best meaning is the `Game Status` briefing page or panel rather than a company-owned report list.","objdump + RT3.lng strings + helper correlation + scenario-text-store correlation + briefing-string correlation"
0x004e5300,1899,shell_load_screen_render_player_detail_stock_holdings_panel,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection + page-title-table decode,4,"Renders the selected-profile stock-holdings summary panel inside the shell-side `LoadScreen.win` family. The helper resolves the selected profile id at `[this+0x8c]` through the live chairman collection at `0x006ceb9c`, builds the top summary rows under localized ids `1204` `Stock Value:`, `1205` `Total Assets:`, and `1206` `Stock Holdings:`, then walks the active company roster through `company_collection_count_active_companies` at `0x00429a50` plus `company_collection_get_nth_active_company_id` at `0x00429a90`. For each active company with positive profile holdings in `[profile + company_id*4 + 0x15d]`, it formats one company row under ids `1201` `Click to view details on %1.`, `1207` `%1 Shares`, and `1208` `%1 Value`; when no positive holdings survive the sweep it emits fallback id `1209` `None`. The panel also checks the scenario-selected chairman through `0x004348c0`, and only for that currently selected profile does it append localized id `3029` `Click to change player name and portrait.` together with the adjacent `1941` `Change` affordance through the shell text-widget writer at `0x00563290`. The `LoadScreen.win` page-title descriptor table rooted at `0x006220a4` now ties current grounded caller page `8` to localized title id `1192` `PLAYER DETAIL`, so this renderer is no longer just a generic holdings page.","objdump + RT3.lng strings + caller inspection + active-company-iteration correlation + holdings-slot correlation + selected-profile affordance correlation + page-title-table decode"
0x004e5a80,2368,shell_render_company_overview_panel_header_and_optional_change_affordance,shell,thiscall,inferred,objdump + RT3.lng strings + helper correlation,4,"Broader company-side overview-panel renderer above the shared text-formatting entry later mapped at `0x004e5cf0`. The wrapper first checks the selected company id at `[this+0x88]`. When that id is absent or no longer resolves through the live company collection at `0x0062be10`, it chooses one of three fallback text families `1210` `You haven't started a company yet...`, `3043` `You don't control a company at the moment...`, or `3888` `You don't control a company at the moment.` from current chairman/company state, paints that fallback into the current shell text surface, and styles controls `0x3f06` and `0x3f07` inactive through the generic control path at `0x00540120`. When a valid company is present, it styles those same controls active, falls through into the shared metric/governance body later labeled at `0x004e5cf0`, and on the narrower branch where the selected company matches the scenario-selected company at `0x00434870` it also appends localized id `3044` `Click to change company name and logo.` and publishes the adjacent `1941` `Change` affordance through the shell text-widget writer at `0x00563290`. Current evidence therefore keeps the name/logo affordance outside the normal `CompanyDetail.win` callback dispatcher and makes `0x004e5cf0` read more like the shared text-formatting subentry within this wider overview-panel renderer than like a full standalone owner by itself.","objdump + RT3.lng strings + helper correlation + fallback-text correlation + overview-wrapper correlation"
0x004e5cf0,1844,shell_format_company_governance_and_economy_status_panel,shell,cdecl,inferred,objdump + RT3.lng strings + helper correlation,4,"Shared shell text formatter for one company-side overview panel. The helper first renders a five-line company-metric preamble from the generic stat reader `0x0042a5d0` using display-year-aware company slots `0x2c`, `0x2b`, `0x17`, and `0x26` plus one derived ratio branch. That preamble is now grounded through localized ids `1211..1215`: `Revenues` from slot `0x2c`, `Profits` from slot `0x2b`, `Load miles hauled` from slot `0x17`, `Revenue per load mile` from the derived `slot 0x2c / slot 0x17` branch with a safe `1.0` fallback when the load-mile value is nonpositive, and `Average speed` from slot `0x26` rendered through localized value formatter `1216` `%1 m.p.h.`. Its governance branch is now tighter too: when the selected company has no linked chairman it emits localized id `3045` `This company is controlled by the shareholder's committee...`; when the company is wholly owned it emits `3046` `You have complete ownership...` for the scenario-selected chairman or `3047` `This company is wholly owned by %1` for another linked chairman; otherwise it emits the investor-attitude lines `3048` `Investors are %1 your performance.` or `3049` `Investors are %1 the chairman's performance.` using the adjective table at `0x00622170`. The salary branch is bounded now too: it computes a signed salary delta from the company fields at `[company+0x14f]` and `[company+0x0d59]`, formats the absolute change and current salary value through the numeric helpers at `0x0051bfe0`, and then chooses `3050..3052` when the linked chairman is the scenario-selected chairman or `3053..3055` for another linked chairman depending on whether the delta is negative, positive, or zero. The bonus branch is narrower as well: only when the display year from `company_query_display_year_or_current_year` `0x004e39e0` matches the recorded bonus year at `[company+0x34f]` does it append `3056` `You have been awarded a bonus of %1.` or `3057` `The chairman has been awarded a bonus of %1.` using the bonus amount at `[company+0x353]`. The same formatter then appends the localized economy tail caption `1218` `Economy status - %1.` from the current scenario economy state at `[0x006cec78+0x2d]` and continues by staging the adjacent selected-company report or list help-title pairs `1219/1220` `Income Statement`, `1221/1222` `Balance Sheet`, `1223/1224` `Haulage Report`, `1225/1226` `Stock Report`, `1227/1228` `Train List`, `1229/1230` `Station List`, `1231/1232` `Industry List`, and `1233/1234` `Cargo List`. Current evidence still does not recover separate `CompanyDetail.win` action controls for those report or list labels under `shell_company_detail_window_handle_message` at `0x004c56a0`, so this strip currently reads as staged overview text or help content rather than as a closed dispatcher-owned launcher family. It uses the linked-chairman accessor `0x00426ef0`, the company-ownership test at `0x004768c0`, the display-year bucket helper `0x004240c0`, and the economy-status table at `0x00620cc0`. Current direct shell binding is still open, but the section-0 refresh for `CompanyDetail.win` now routes control `0x947f` through a dedicated stack-built dynamic text path, so this remains the strongest current shared formatter family aligned with that overview widget.","objdump + RT3.lng strings + helper correlation + governance-status string correlation + CompanyDetail overview correlation + metric-preamble correlation + report-launch-strip correlation + ownership-branch correlation + salary-bonus branch correlation + negative-dispatch-boundary correlation + preamble-label-table correlation"
0x004e68e0,1521,shell_load_screen_render_company_list_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection + page-title-table decode,4,"Renders the active-company comparison page inside `LoadScreen.win`. The helper first rejects the empty-company case with one fallback text branch rooted at localized ids `1210`, `3043`, or `3888`, then clears the shared row buffer at `[this+0x11c]`, stages the visible company-comparison column family `1235..1242`, and iterates the active company roster through `company_collection_count_active_companies` at `0x00429a50` plus `company_collection_get_nth_active_company_id` at `0x00429a90`. The caller-supplied page-local selector chooses which company metric to rank on: revenue through slot `0x2c`, profit through slot `0x2b`, cash through slot `0x0d`, or track mileage through slot `0x25`, all read through the generic company stat reader at `0x0042a5d0`. The emitted row lane also stages the adjacent company-report affordances `1243` `Click to view %1's income statement.`, `1244` `Click to view %1's balance sheet.`, and `1245` `Click to view %1's haulage reports.` on top of the ranked company rows, while applying the stronger highlight path when the row company matches the scenario-selected chairman's current company. The `LoadScreen.win` page-title descriptor table rooted at `0x006220a4` now ties current grounded caller page `2` to localized title id `1186` `COMPANY LIST`, so this renderer is now bounded as the company-list page rather than only a generic financial ranking helper.","objdump + RT3.lng strings + caller inspection + active-company-iteration correlation + company-stat-slot correlation + report-affordance correlation + page-title-table decode"
0x004e6ef0,1879,shell_load_screen_render_player_list_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection + page-title-table decode,4,"Renders the active-chairman comparison page inside `LoadScreen.win`. The helper clears the shared row buffer at `[this+0x11c]`, stages the visible chairman-comparison headers from the localized family `1237`, `1241`, `1246`, `1247`, `1248`, `1249`, and `1250`, then iterates the active chairman profile collection at `0x006ceb9c` through `profile_collection_count_active_chairman_records` and the `nth active` accessors rooted at `0x00477820`, `0x00477860`, and `0x004778c0`. The caller-supplied selector chooses which chairman-side metric drives the ranking: cash, one direct profile-held total, one direct-total-plus-cash lane, one threshold-adjusted-total-plus-cash lane, or the active-rank lane read through `0x00476320`, `0x00476780`, `0x00476c20`, and `0x004778c0`. The row builder also uses the profile-side name and portrait-family tables around `0x00622192..0x006221a4`, with special-cased current-player text on the zero-th row and the stronger highlight path when one ranked profile matches the scenario-selected chairman. The `LoadScreen.win` page-title descriptor table rooted at `0x006220a4` now ties current grounded caller page `7` to localized title id `1191` `PLAYER LIST`, so this renderer is now bounded as the player-list page rather than only a chairman-wealth ranking helper.","objdump + RT3.lng strings + caller inspection + active-profile-iteration correlation + profile-metric correlation + wealth-ranking-string correlation + page-title-table decode"
0x004e7670,3033,shell_load_screen_render_company_train_list_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Renders the company-owned train list page inside `LoadScreen.win`. The helper first rejects missing selected-company state through localized id `1210` and then rejects companies with no trains through id `1251` `This company does not have any trains.` after querying the current company through the live company collection at `0x0062be10` and the train-count helper at `0x004264c0`. On the populated path it clears the `0x190`-dword row buffer at `[this+0x11c]`, reads the optional display year through `company_query_display_year_or_current_year` at `0x004e39e0`, stages the visible column headers and sort-help family `1235..1242`, and then iterates the selected company's live train roster through the company-side train accessors around `0x004264c0`, `0x00426520`, `0x004a7270`, `0x004a77b0`, and `0x0041adb0`. The emitted row family matches the player-facing train-list strip: revenue, profit, cash, track mileage, engine type, age, oil, water, sand, speed, and profit rows from `1252..1266`, plus the per-row camera-centering affordance `1267` `Click to center the camera on %1`. Current grounded caller is the wider `LoadScreen.win` render family around `0x004ea499`, which keeps this as one company-list page sibling beside the holdings, building, station, and cargo pages rather than a `CompanyDetail.win` subpanel.","objdump + RT3.lng strings + caller inspection + company-train-roster correlation + train-list-string correlation"
0x004e8270,2336,shell_load_screen_render_company_industry_list_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection + page-title-table decode,4,"Renders the selected-company industry list page inside `LoadScreen.win`. The helper rejects missing selected-company state through localized id `1210` and rejects companies with no owned buildings through id `1268` `This company does not own any buildings.` after resolving the current company through `0x0062be10` and the building-count helper at `0x004266c0`. On the populated path it clears the shared row buffer at `[this+0x11c]`, stages the visible header and sort-help family `1269..1278`, and then walks the selected company's owned placed-structure set through the building-side accessors around `0x004266c0`, `0x004267f0`, `0x0062b26c`, `0x0047de00`, `0x0040cac0`, `0x0040ca70`, `0x0040ca80`, and `0x0040d360`. The rendered rows align with the player-facing industry list strip: industry or building type, year built, profitability, loads consumed, loads generated, and the surrounding sort hints. The `LoadScreen.win` page-title descriptor table rooted at `0x006220a4` now ties current grounded caller page `15` to localized title id `1199` `INDUSTRY LIST`, which makes this the industry-list page rather than a generic building-list sibling.","objdump + RT3.lng strings + caller inspection + company-building iteration correlation + building-list-string correlation + page-title-table decode"
0x004e8bb0,2198,shell_load_screen_render_company_station_list_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Renders the company-owned station list page inside `LoadScreen.win`. The helper rejects missing selected-company state through localized id `1210` and rejects companies with no stations through id `1279` `This company does not have any stations.` after resolving the selected company and probing the company-owned station count through `0x00426590`. On the populated path it clears the shared row buffer at `[this+0x11c]`, stages the station-list header and sort-help family `1280..1288`, and then walks the selected company's owned station or placed-structure set through the station-side accessors around `0x00426620`, `0x006cec20`, `0x0047d7d0`, `0x0047d7c0`, `0x0047d7f0`, `0x0047d7e0`, and `0x0047de00`. The emitted rows match the visible station-list strip: cargo out, cargo in, revenue out, revenue in, and the adjacent sort affordances. Current grounded caller is the wider `LoadScreen.win` render family around `0x004ea499`, which keeps this as the company-station page sibling beside the train, building, and cargo pages.","objdump + RT3.lng strings + caller inspection + company-station iteration correlation + station-list-string correlation"
0x004e9460,1694,shell_load_screen_render_map_cargo_list_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Renders the map-wide cargo list page inside `LoadScreen.win`. The helper clears the shared row buffer at `[this+0x11c]`, stages the cargo-list header and sort-help family `1289..1298`, and then iterates the live structure-candidate collection at `0x0062ba8c` rather than one selected company roster. It filters candidates through `structure_candidate_is_enabled_for_current_year` at `0x0041e220`, then derives one sortable per-cargo metric from `structure_candidate_query_route_style_or_local_availability_metric` at `0x0041e650` plus the direct candidate fields at `+0x5e`, `+0x62`, `+0x6a`, and route-style flag `+0x46`. That keeps the same candidate split visible on this page too: route-style rows use the normalized route-side availability metric from `0x0041e650`, while ordinary rows can still surface the direct local float at `[candidate+0x5a]`. The resulting rows align with the player-facing cargo page: cargo name, number of loads, new loads, loads used, price, and the surrounding sort hints. Current grounded caller is the wider `LoadScreen.win` render family around `0x004ea499`, which keeps this as the cargo-list page sibling beside the selected-profile holdings page and the selected-company train, building, and station lists.","objdump + RT3.lng strings + caller inspection + cargo-candidate iteration correlation + cargo-list-string correlation + route-style-metric correlation"
0x004e9b20,1330,shell_load_screen_render_company_report_history_panel,shell,cdecl,inferred,objdump + caller inspection + page-jump-table correlation + RT3.lng correlation,4,"Shared multi-year company report-table renderer inside `LoadScreen.win`. The helper validates the selected company through the live company collection at `0x0062be10`, derives a bounded display-year window from current display year `[this+0x9c]` and company founding year `[company+0x157]`, clears and repopulates the shared row buffer at `[this+0x11c]`, and then renders one of three page-local report modes selected by its caller-supplied mode argument. The descriptor table rooted at `0x00622192..0x006221a4` now grounds those modes as page `4` `Income Statement`, page `5` `Balance Sheet`, and page `6` `Haulage Report`: mode `0` walks the revenue and expense family `1301..1315`, mode `1` walks the asset and liability family `2816`, `1317..1322`, and mode `2` walks the haulage and operating-stat family `1323..1335`. Ordinary rows read yearly values through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0`. The two special row families are tighter now too: they feed the `%1/%2` rate inserts for localized strings `2815` and `2816` through `company_compute_negative_cash_balance_interest_rate` at `0x00425880` and `company_compute_positive_cash_balance_interest_rate` at `0x004258c0`. Current grounded callers are the page `4`, `5`, and `6` arms of `shell_load_screen_render_active_page_panel` at `0x004ea060`, so ownership and page semantics are now both bounded.","objdump + caller inspection + page-jump-table correlation + selected-company validation correlation + report-table mode correlation + RT3.lng row-family correlation + descriptor-table decode + special-rate-row correlation"
0x004ea060,1403,shell_load_screen_render_active_page_panel,shell,thiscall,inferred,objdump + caller inspection + page-jump-table correlation + page-title-table decode,4,"Family-wide render dispatcher beneath the shell-side `LoadScreen.win` singleton `0x006d10b0`. The helper first formats the active page heading from the 13-byte page descriptor table rooted at `0x006220a0` using current page id `[this+0x78]`, specifically the title-string dword at record offset `+0x04`. It then lays out the common panel containers through the shell control family rooted at `[this+0x0b31]`, and conditionally exposes the selected-company header affordance on control `0x3f13` when the descriptor header-flag byte at record offset `+0x0c` is set and the current company `[this+0x88]` still resolves through the live company collection at `0x0062be10`. It then switches on the same page id `[this+0x78]` and dispatches into the active page body. Current grounded routes include page `0` through the localized fallback `1203` `Unable to display page`, page `1` through the broader company-overview wrapper around `0x004e5a70/0x004e5a80`, page `2` through `shell_load_screen_render_company_list_panel` at `0x004e68e0`, page `3` through `shell_load_screen_render_company_report_history_panel` at `0x004e9b20` in `Income Statement` mode, page `4` through the same renderer in `Balance Sheet` mode, page `5` through the same renderer in `Haulage Report` mode, page `6` through `shell_load_screen_render_company_stock_data_panel` at `0x004e5130`, page `7` through `shell_load_screen_render_player_list_panel` at `0x004e6ef0`, page `8` through `shell_load_screen_render_player_detail_stock_holdings_panel` at `0x004e5300`, page `9` through `shell_load_screen_render_game_status_briefing_panel` at `0x004e51ea`, page `0x0a` through `shell_load_screen_render_company_train_list_panel` at `0x004e7670`, page `0x0b` through the same localized `1203` fallback, page `0x0c` through `shell_load_screen_render_company_station_list_panel` at `0x004e8bb0`, page `0x0d` through the same localized `1203` fallback, page `0x0e` through `shell_load_screen_render_map_cargo_list_panel` at `0x004e9460`, and page `0x0f` through `shell_load_screen_render_company_industry_list_panel` at `0x004e8270`. That now makes the rendered title order concrete too: `XXX`, `COMPANY OVERVIEW`, `COMPANY LIST`, `INCOME STATEMENT`, `BALANCE SHEET`, `HAULAGE REPORT`, `STOCK DATA`, `PLAYER LIST`, `PLAYER DETAIL`, `GAME STATUS`, `TRAIN LIST`, `TRAIN DETAIL`, `STATION LIST`, `STATION DETAIL`, `CARGO LIST`, and `INDUSTRY LIST`. Current grounded click flow is narrower than that title table: list-page row activation now re-enters page `8` for player detail, but train, station, and industry rows jump out through the shell detail-panel manager instead of switching to page `0x0b` or `0x0d`; no current recovered opener targets `0x0b` or `0x0d`; and no current post-constructor selector path has been recovered for page `0`, whose descriptor remains kind `0`, title `1200` `XXX`, backlink `0`, and header flag `0`. The outer ownership is now clear: this is the shared active-page body renderer above the individual `LoadScreen.win` pages rather than just one more page-local helper.","objdump + caller inspection + page-jump-table correlation + page-table correlation + selected-company header correlation + page-mode decode + page-title-table decode + row-click-route correlation"
0x004ea620,219,shell_load_screen_window_construct,shell,thiscall,inferred,objdump + resource strings + constructor inspection,4,"Constructs the shell-side `LoadScreen.win` family later stored at singleton `0x006d10b0`. The constructor installs vtable `0x005d1194`, binds the random background image `LoadScreen%d.imb` through the format string at `0x005d1180`, binds `LoadScreen.win` through `0x0053fa50`, initializes current page `[this+0x78]` to `0`, stores the singleton at `0x006d10b0`, and seeds the first three visible page-strip controls starting at `0x84d3` through the generic control path at `0x00540120`. It also randomizes one background index into shell state byte `[0x006cec74+0x2c7]` while avoiding the immediately previous choice. Current neighboring helpers at `0x004ea720` and `0x004ea730` provide the live-singleton query and destructor for the same family, which makes this the broad owner-side constructor above the page dispatcher at `0x004e3a80` and the sibling renderers at `0x004e5300`, `0x004e5a80`, and `0x004e5cf0`.","objdump + resource strings + constructor inspection + singleton-state correlation + page-strip correlation"
0x004ea720,14,shell_load_screen_window_is_open,shell,cdecl,inferred,objdump + singleton inspection,4,"Tiny singleton-presence probe for `LoadScreen.win`. It returns `1` when global `0x006d10b0` is non-null and `0` otherwise, which matches the constructor and destructor pair at `0x004ea620` and `0x004ea730`.","objdump + singleton inspection + sibling correlation"
0x004ea730,53,shell_load_screen_window_destroy,shell,thiscall,inferred,objdump + singleton inspection,4,"Destructor for the `LoadScreen.win` singleton rooted at `0x006d10b0`. It restores the vtable header `0x005d1194`, clears the singleton global, releases the shared shell object rooted at `0x006cfd34` when present, and then tails into the common shell object destructor path. This is the destructor sibling of `shell_load_screen_window_construct` `0x004ea620` and is one of the explicit old-mode teardown branches reached from `shell_transition_mode`.","objdump + singleton inspection + destructor correlation"
0x004eb0b0,101,shell_open_grayscale_map_tga_picker_and_stage_selection,shell,cdecl,inferred,objdump + literal inspection + caller correlation,3,"Opens the small shell picker used by `Setup.win` to choose one grayscale source map from `TGA Files (*.tga)` rooted at `.\Data\GrayscaleMaps`. The helper forwards the caller-supplied output pointers in `ECX` and `EDX`, constructs the modal shell object family at `0x004ea940`, and on return copies the staged globals at `0x006d10b4` and `0x006d10b8` back into those outputs. It reports success only when the modal result equals control id `0x3f2`. Current grounded caller is the `Setup.win` branch at `0x0050394c`, which then writes startup selector `4` before shell request `0x0cc` continues. This makes the branch a grayscale-map/new-world picker rather than another saved-profile validator.","objdump + literal inspection + caller correlation + modal-result correlation"
0x004eb890,381,shell_present_merger_vote_outcome_dialog,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Single-player merger-vote outcome presenter used by the merger result path. The helper resolves the two merger companies from `0x006d10dc` and `0x006d10de`, chooses localized title id `729` `Merger Succeeds!!!` or `730` `Merger Fails!!!`, formats the vote tally labels `731` `Votes In Favor:` and `732` `Votes Against:`, and renders the final result dialog through the shell presentation callback rooted at `0x006d111c`. Current grounded caller is `shell_resolve_merger_vote_and_commit_outcome` at `0x004ebd10` on the single-player branch.","objdump + RT3.lng strings + caller inspection + merger-result dialog correlation"
0x004ebd10,1202,shell_resolve_merger_vote_and_commit_outcome,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Resolves the single merger vote, commits the outcome, and records cooldown state. The helper walks the active chairman profile collection at `0x006ceb9c`, computes weighted votes for and against the proposed merger between companies `0x006d10dc` and `0x006d10de`, accumulates the affirmative share count into `0x006d110c`, compares that total against half the target-company value, and then splits by single-player versus multiplayer. In single-player it presents the result through `shell_present_merger_vote_outcome_dialog` at `0x004eb890`; in multiplayer it formats localized id `3059` `Merger between '%1' and '%2' has %3.` with result strings `3060` or `3061` and routes the payload through the shell transport. On success it commits the merger through `0x00427e20`; on failure it stamps the current year into `[company+0x15f]` as the grounded merger-cooldown field.","objdump + RT3.lng strings + caller inspection + merger-vote resolution correlation"
0x004ec640,732,shell_company_detail_attempt_merger_flow,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` merger-attempt flow. The helper rejects empty worlds through localized id `727`, rejects recent failed merger cooldown cases through id `728`, and then opens the merger offer or vote dialog family rooted at the local globals `0x006d10cc..0x006d1120`. The grounded single-player path checks the proposed premium against company cash through localized id `3889`, can open a premium-confirmation prompt through id `4067`, and on acceptance commits through the company merger helper at `0x00427e20` or the broader vote-resolution path at `0x004ebd10`. When the multiplayer-side shell owner is active it packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8` instead of mutating company state immediately. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + merger-dialog correlation"
0x005042c0,170,shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Small dirty-clear helper beneath `StationDetail.win`. When global dirty latch `0x006d16f0` is set and the live station-detail singleton `0x006d16d8` exists, the helper clears the candidate-service and nearby-structure row bands through `0x0053fe00` over control ranges `0xb414..0xb4db`, `0xb4dc..0xb5a3`, `0xb40a..0xb413`, and `0xb400..0xb409`, disables the paired haul-summary widgets `0xb3f6` and `0xb3f7`, and then resets `0x006d16f0` back to `0`. Current grounded caller is `shell_station_detail_window_refresh_controls` `0x00506610`, so this is the safest current read for the dirty-clear owner beneath the broader station-detail refresh family.","objdump + local disassembly + caller inspection + StationDetail dirty-clear correlation"
0x00504370,24,shell_station_detail_has_valid_selected_station,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny validity probe for the currently selected station id in detail-manager state `[0x006d0818+0x90]`. The helper checks that id against the live placed-structure collection `0x006cec20` through `0x00517d40` and returns the boolean result. Current grounded callers are the neighboring StationDetail helper strip beneath `0x00506610`, where this is the narrow selected-station presence gate rather than a general collection query.","objdump + local disassembly + caller inspection + selected-station correlation"
0x00504390,96,shell_station_detail_selected_station_belongs_to_selected_company,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Small selected-station ownership predicate for `StationDetail.win`. The helper validates the current station id from detail-manager state, resolves the live station from collection `0x006cec20`, compares its owner through `0x0047efe0` against the currently selected company id from `0x004337a0`, and returns `1` only when they match. Current grounded callers are the neighboring station-detail action helpers, so this is the safest current read for the selected-company ownership gate beneath the broader station-detail refresh family.","objdump + local disassembly + caller inspection + StationDetail ownership correlation"
0x005043f0,179,shell_station_detail_present_selected_station_not_controlled_notice,shell,cdecl,inferred,objdump + RT3.lng strings + local disassembly,3,"Ownership-blocked notice helper beneath the `StationDetail.win` action family. After validating the current selected station id, the helper resolves the station owner through `0x0047efb0`; if that owner resolves it formats localized id `3595` `You can't take that action, because this station is owned by a railroad (%1) that you do not control.` with the owner's display name, otherwise it falls back to the empty-string root `0x005c87a8`. It then presents the result through the shell message-box path at `0x004c98a0`. Current grounded callers are the neighboring station-detail action branches that first test `shell_station_detail_selected_station_belongs_to_selected_company` `0x00504390`, so this is the safest current read for the not-controlled notice rather than a general station popup helper.","objdump + RT3.lng strings + local disassembly + ownership-block correlation"
0x005044b0,221,shell_station_detail_refresh_class_gated_action_controls_0xb3bb_to_0xb3bf,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Refreshes the lower class-gated action controls inside `StationDetail.win`. After validating the current selected station id, the helper resolves the linked candidate class byte `[candidate+0x8c]` and uses that class to restyle controls `0xb3bb`, `0xb3bc`, `0xb3bd`, `0xb3be`, and `0xb3bf` between the shell affordance states rooted at `0x65` and `0x87` through repeated `0x00540120` calls. Current grounded caller is the `StationDetail.win` constructor `0x005068c0`, so this is the safest current read for the class-gated lower-action refresh strip rather than a station-detail message owner.","objdump + local disassembly + caller inspection + StationDetail lower-action correlation"
0x00504590,468,shell_station_detail_present_scenario_station_connection_triplet_popup,shell,cdecl,inferred,objdump + local disassembly + caller inspection + format-string correlation,3,"Formats and presents the scenario-latched `StationDetail.win` popup beneath action controls `0xb3b7` and `0xb3b8`. After validating the current station from detail-manager state `0x006d0818+0x90`, the helper walks the selected station's per-destination table rooted at `[station+0x30]`, skips invalid or self station ids, copies each other station name into the local text buffer, and then appends three per-destination scalar lanes from the current station's five-byte-stepped metric arrays. Active lanes format through the local `%1 : ` and ` %5.2f` helpers at `0x005d16f0` and `0x005d16e8`, while missing lanes fall back to `N/C` at `0x005d16e0`; the stacked result is then published through `shell_publish_text_callout_presentation` `0x005519f0` using helper root `0x006d16e8`. Current grounded caller is `shell_station_detail_window_refresh_controls` `0x00506610` when scenario latch `[0x006cec74+0x1db]` is set, so the safest current read is a scenario-side station connection triplet popup rather than an ordinary haul or candidate-service branch.","objdump + local disassembly + caller inspection + format-string correlation + scenario-latch correlation"
0x00504770,786,shell_station_detail_present_to_from_haul_stats_popup,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats and presents the `StationDetail.win` hauled-traffic popup for one of the two `To` or `From` summary widgets. The helper validates the current station from detail-manager state `0x006d0818+0x90`, resolves the selected station record through `0x006cec20`, and then chooses the localized direction strings `676` `...hauled TO this station.` or `679` `...hauled FROM this station.` plus the singular or plural `load` and `loads` labels `677/678` based on the triggering control id `0xb3f6` versus `0xb3f7`. It formats the current-year and lifetime load and value totals through the station haul-stat helpers at `0x0047d7e0` or `0x0047d7f0`, then presents the final popup text through the shell message-box path at `0x00538c70`. Current grounded owner is the neighboring `To` or `From` summary-widget builder at `0x00505150`.","objdump + RT3.lng strings + caller inspection + hauled-traffic popup correlation"
0x00504a90,70,shell_station_detail_clear_active_candidate_service_preview,shell,thiscall,inferred,objdump + caller inspection + state correlation,4,"Clears the active candidate-service preview owned by `StationDetail.win`. The helper first resets the shared `(placed-structure id, candidate id)` pair at `0x005ee4fc` and `0x005ee500` through `0x0043f610`, then tears down the local station-detail preview latch at `[this+0x7c]` and decrements the sibling global refcount `0x0062be84` when that preview was armed. When the live world owner at `0x0062c120` is in the matching preview-capable mode gate rooted at `[+0x2171]` and `[+0x2175]`, it tails into the neighboring world-side clear path at `0x00452d30`. Current grounded callers are the station-detail selection reset branches around `0x00504bca`, `0x00504bda`, and the later cleanup family at `0x00505bff` and `0x00505c0a`.","objdump + caller inspection + world-preview correlation"
0x00504ae0,174,shell_station_detail_set_active_candidate_service_preview,shell,thiscall,inferred,objdump + caller inspection + state correlation,4,"Arms the active candidate-service preview for `StationDetail.win`. The helper begins by clearing the old preview through `shell_station_detail_clear_active_candidate_service_preview` at `0x00504a90`, then when the supplied candidate id is nonzero and the live world owner at `0x0062c120` is in the matching preview-capable mode gate it routes the current detail-panel station id through the world-side preview family at `world_store_preview_primary_id_0x2179_dispatch_mode3_collection_and_refresh_if_active` `0x00452f60`, `world_store_preview_scalar_0x217d_and_refresh_active_mode_if_nonzero` `0x00452d80`, `world_store_preview_linked_site_id_0x2181_rebind_mode3_and_refresh_if_active` `0x00452db0`, and `world_set_aux_preview_mode_0x2171_and_reseed_overlay_companion_grid` `0x00452ca0`. On success it latches the preview-active bit at `[this+0x7c]`, increments the sibling global refcount `0x0062be84`, and stores the active `(station id, candidate id)` pair into `0x005ee4fc` and `0x005ee500` through `0x0043f620`. This is the shell-side owner that feeds the broader world scanner rooted at `0x0043f640` with the currently inspected station-detail candidate pair.","objdump + caller inspection + world-preview correlation + global-pair correlation"
0x00504ba0,796,shell_station_detail_update_candidate_service_entry,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Updates one candidate-service entry inside `StationDetail.win`. With zero in the first stack slot the helper either re-arms the globally remembered candidate through `shell_station_detail_set_active_candidate_service_preview` at `0x00504ae0` or clears the current preview through `shell_station_detail_clear_active_candidate_service_preview` at `0x00504a90`. On the ordinary nonzero path it validates the current station from detail-manager state `0x006d0818+0x90`, rejects disallowed modifier combinations from `0x006d4018+0xa8c`, resolves the candidate from `0x0062ba8c`, and then either updates the hover anchor at `0x006d16fc/0x006d1700` or re-enters `placed_structure_query_candidate_local_service_metrics` at `0x0047e240` to format the visible entry text. Current grounded text lanes use localized ids `681`, `682`, and `2813` for the loads-available, current-price, and average-profit explanation strings, plus ids `688` and `689` for the nearby-structure jump text. This is the clearest shell-side owner above the active candidate-service preview pair and the station-detail candidate service readout.","objdump + RT3.lng strings + caller inspection + service-preview correlation"
0x00504bea,722,shell_station_detail_format_candidate_local_service_summary,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the candidate-local-service summary lane inside `StationDetail.win`. The helper validates the current station id from the detail manager through collection `0x006cec20`, resolves the candidate record through `0x0062ba8c`, and when the ordinary station-detail path is active it re-enters `shell_station_detail_set_active_candidate_service_preview` at `0x00504ae0` before querying `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`. It then formats the visible candidate text using localized ids `681` `%1: Loads available: %2`, `682` `Current Price: %1`, and the explanatory text `2813` `Prices shown are the average profit per load for delivering %1 from %2 to that station...`; neighboring branches also use localized ids `688` and `689` for the nearby-structure jump affordance. This now looks like the shell-side candidate-service readout above the same local service metric lane used by the station freight and express summaries.","objdump + RT3.lng strings + caller inspection + service-query correlation"
0x00505150,796,shell_station_detail_build_to_from_haul_summary_widget,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Builds one of the two `To` or `From` hauled-traffic summary widgets inside `StationDetail.win`. The helper chooses the localized heading `686` `To` or `687` `From` from its first argument, paints a bounded 10-step summary strip from the supplied float lane and the paired station haul-stat queries at `0x0047d7e0` or `0x0047d7f0`, and formats the one-line direction-specific labels and totals through the same `load` or `loads` family later used by the popup callback. On first build it also registers the matching control id `0xb3f6` or `0xb3f7` through callback `shell_station_detail_present_to_from_haul_stats_popup` at `0x00504770`, so the same widget owns both the visible `To` or `From` strip and the click-through stats popup. Current grounded caller is the larger station-detail refresh pass at `0x00506610`, which constructs the `To` and `From` widgets back to back.","objdump + RT3.lng strings + caller inspection + control registration correlation"
0x00505470,738,shell_station_detail_refresh_nearby_structure_jump_rows,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,3,"Refreshes the five-row nearby-structure jump lane inside `StationDetail.win`. The helper validates the current station, iterates the fixed five nearby-structure categories, counts matching nearby entries through `0x0047dc90`, and formats the player-facing jump text from localized ids `688` `This station has %1 %2(s) nearby...` and `689` `first ` together with the per-category name table rooted at `0x00620dc4`. It then builds the paired per-row controls and descriptive text blocks under the `0xb400..0xb413` control band that the later station-detail message handler uses to center the map or jump into the matching nearby structure detail. This currently looks like the shell-side owner of the nearby-structure lane that sits beside the later candidate-service preview rows.","objdump + RT3.lng strings + caller inspection + nearby-structure correlation"
0x00505760,1159,shell_station_detail_refresh_candidate_service_rows,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Refreshes the visible candidate-service row lane inside `StationDetail.win`. The helper counts currently active candidate-service entries through `placed_structure_count_candidates_with_local_service_metrics` at `0x0047e330`, resolves each visible row candidate through the neighboring ordinal helper at `0x0047e620`, and then colors and formats the row from the candidate-local-service metrics, the candidate display name, and the same localized strings `681`, `682`, and `2813` used by `shell_station_detail_update_candidate_service_entry`. It registers the per-row click path through callback `shell_station_detail_update_candidate_service_entry` at `0x00504ba0`, keeps the selected and hovered candidate ids in the globals `0x006d16f8` and `0x006d16f4`, and toggles the current preview highlight as rows are rebuilt. Current grounded caller is the broader station-detail refresh pass at `0x00506610`.","objdump + RT3.lng strings + caller inspection + candidate-service row correlation"
0x00504ec0,644,shell_station_detail_refresh_class_3_or_4_train_service_matrix,shell,thiscall,inferred,objdump + local disassembly + caller inspection + RT3.lng string-id correlation,3,"Alternate `StationDetail.win` refresh branch for selected station classes `3` and `4`. After validating the current station and republishing the station name through helper root `0x006d16e4`, the helper rebuilds a five-row by two-column train-service matrix: the column headers come from localized ids `684` `Trains Serviced` and `685` `Trains Maintained`, the per-row category labels resolve through the world-side lookup table at `0x006cec78+0x46a84` plus `0x0053de00/0x00552560`, and the underlying counts come from the station-side integer lanes at `0x0047d800`. When the detail view is not already marked live it also rebuilds the shared popup-capable haul widget lane and reuses `shell_station_detail_present_to_from_haul_stats_popup` `0x00504770` as the click-through callback. Current grounded caller is `shell_station_detail_window_refresh_controls` `0x00506610`, which routes class-`3/4` stations into this helper instead of the ordinary nearby-structure, haul-summary, and candidate-service strip.","objdump + local disassembly + caller inspection + RT3.lng string-id correlation + class-3-4-branch correlation"
0x00506610,688,shell_station_detail_window_refresh_controls,shell,cdecl,inferred,objdump + local disassembly + caller inspection + child-helper correlation,4,"Broad refresh owner for the shell-side `StationDetail.win` family. The helper first validates the currently selected station id from detail-manager state `[0x006d0818+0x90]`, resolves the live station from collection `0x006cec20`, and publishes the upper summary lane through `shell_publish_text_callout_presentation` `0x005519f0` using helper root `0x006d16ec`. When scenario-side latch `[0x006cec74+0x1db]` is set it re-enters `shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty` `0x005042c0` and `shell_station_detail_present_scenario_station_connection_triplet_popup` `0x00504590` for the paired action controls `0xb3b7` and `0xb3b8`; otherwise it checks the resolved candidate class byte `[candidate+0x8c]`, routes classes `3` and `4` into `shell_station_detail_refresh_class_3_or_4_train_service_matrix` `0x00504ec0`, and for the ordinary branch it publishes the station name, rebuilds the nearby-structure jump lane through `shell_station_detail_refresh_nearby_structure_jump_rows` `0x00505470`, rebuilds the `To` and `From` hauled-traffic widgets through `shell_station_detail_build_to_from_haul_summary_widget` `0x00505150`, rebuilds the candidate-service rows through `shell_station_detail_refresh_candidate_service_rows` `0x00505760`, and finally marks the detail view live through `0x006d16f0 = 1`. Current grounded callers are the constructor-side control wiring under `shell_station_detail_window_construct` `0x005068c0` and the paired action-control callbacks on `0xb3b7/0xb3b8`, so this is the safest current read for the main StationDetail refresh owner rather than a narrower popup callback.","objdump + local disassembly + caller inspection + child-helper correlation + StationDetail control correlation"
0x00505e50,766,shell_station_detail_window_handle_message,shell,thiscall,inferred,objdump + local disassembly + caller inspection + control-range correlation,4,"Primary message dispatcher for the shell-side `StationDetail.win` panel rooted at singleton `0x006d16d8`. The helper validates the current selected station from the detail-manager state under `0x006d0818+0x90`, mirrors that station into live world latch `[0x006cec78+0x4cba]` on the message-`0` setup branch, clears or preserves the active candidate-service preview state under `0x006d16f8/0x006d16fc/0x006d1700`, and can leave the panel through `shell_detail_panel_transition_manager` `0x004ddbd0` when the selected station is no longer valid. The message-`0xca` branch owns two concrete row families: candidate-service controls `0xb4dc..0xb5a3`, which either hand off into the `Overview.win` lane through `0x004ddbd0(..., 9, ...)` plus `0x004f4970` when Ctrl is held or else re-arm or clear the world preview through `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0` and `0x00504a90`; and nearby-structure controls `0xb40a..0xb413`, which resolve site ids through `0x0047dc90/0x0047dcb0`, transition the detail manager with mode `0x0a`, and optionally recenter the world view through `0x00433900` plus the target object's vtable `+0x5c` callback when no modal overlay is active. The message-`0x3ea` branch refreshes the dirty dynamic rows through `shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty` `0x005042c0` and `shell_station_detail_refresh_class_gated_action_controls_0xb3bb_to_0xb3bf` `0x005044b0`, then restyles control `0xb3f8` from selected-station byte `[station+0x5c9]` and re-arms the active preview if one is selected. The message-`0xcb` action band owns the paired navigation or selector toggles on `0xb3b3/0xb3b4`, the tutorial-gated back or escape branch beneath localized id `0xe8c`, and the lower `0xb3b5..0xb3bf` class-gated action dispatch that first checks selected-company ownership through `0x00504390/0x005043f0`, then resolves linked site and candidate class state through `0x0047de00`, `0x0040cec0`, and `0x0047fd50` before re-entering the world-side action helper strip under `0x00419590`. This is the current grounded owner above the already-mapped refresh helper `shell_station_detail_window_refresh_controls` `0x00506610`, not just one narrow control callback.","objdump + local disassembly + caller inspection + control-range correlation + StationDetail message-branch correlation"
0x0050c500,426,shell_present_chairmanship_takeover_vote_outcome_dialog,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Single-player chairmanship-takeover outcome presenter used by the special election path. The helper resolves the target company from `0x006d1a0c`, chooses localized title id `626` `New Chairman Takes Over!!!` or `627` `Chairmanship Takeover Fails!!!`, formats the tally labels `628` `Votes in favor` and `629` `Votes Against`, and renders the final result dialog through the shell presentation callback rooted at `0x006d1a34`. Current grounded caller is `shell_resolve_chairmanship_takeover_vote_and_commit_outcome` at `0x0050c940` on the single-player branch.","objdump + RT3.lng strings + caller inspection + takeover-result dialog correlation"
0x0050c940,880,shell_resolve_chairmanship_takeover_vote_and_commit_outcome,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Resolves the special chairman's election, commits the outcome, and records cooldown state. The helper walks the active chairman profile collection at `0x006ceb9c`, computes weighted votes for and against the takeover of company `0x006d1a0c` by chairman profile `0x006d1a0e`, accumulates the affirmative share count into `0x006d1a30`, compares that total against half the target-company value, and then splits by single-player versus multiplayer. In single-player it presents the result through `shell_present_chairmanship_takeover_vote_outcome_dialog` at `0x0050c500`; in multiplayer it formats localized id `3082` `Takeover attempt of '%1' by '%2' has %3.` with result strings `3060` or `3061` and routes the payload through the shell transport. On success it transfers chairmanship through `0x00428a30`; on failure it stamps the current year into `[company+0x289]` as the grounded takeover-cooldown field.","objdump + RT3.lng strings + caller inspection + takeover-vote resolution correlation"
0x0050ccc0,709,shell_company_detail_attempt_chairmanship_takeover_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` chairmanship-takeover flow against the currently selected company. The helper reads the caller's current share ownership in the target company, rejects insufficient holdings through localized id `623`, rejects recent failed takeover cooldown cases through id `624`, and otherwise opens the special chairman's election confirmation under id `625`. The grounded single-player path seeds the local takeover-election state at `0x006d1a08..0x006d1a38` and launches the follow-on election helper at `0x0050c940`; when the multiplayer-side shell owner is active it instead packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + takeover-election correlation"
0x004c6b40,105,shell_company_list_format_company_or_start_row,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats one row in the shell-side company list. When the incoming row id is the synthetic sentinel `0x7fff`, the helper formats localized id `266` `<<Start New Company>>` and stores it through the current row widget at `0x006cfe78`. Otherwise it resolves the live company id through the company collection at `0x0062be10` and delegates the richer row text to `0x004bfb30`. Current grounded caller is `shell_company_list_window_refresh_rows` at `0x004c6c30`.","objdump + RT3.lng strings + caller inspection"
0x004c6bb0,123,shell_company_list_activate_or_shift_center_company,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Handles activation on one live company row in the shell company list. The helper first verifies that the company id exists in the live company collection at `0x0062be10`, then notifies the shell detail-panel family at `0x006d0818`. If Shift is held through shell-input bits `[0x006d4018+0xa8c]&0x3` and the row is not the currently selected chairman company, it resolves the company's primary station or anchor through `0x00427260`, translates that station into a world-view target through `0x0047de00`, and centers the active world view through `0x0043c9a0`. That matches localized help string `2992` `Shift-Click to center on this company's primary station.`","objdump + RT3.lng strings + caller inspection + shell-input correlation"
0x004c6c30,765,shell_company_list_window_refresh_rows,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Rebuilds the shell company-list window rows. The helper clears the two mirrored list controls under ids `0x2ee1` and `0x2ee2`, iterates the live company collection at `0x0062be10`, and formats each company row with one of three localized status strings: id `267` `You are the chairman of the %1!` for the currently selected chairman company from `0x00434870`, id `268` `The %1 has no chairman at the moment.` when `[company+0x3b]` is zero, or id `269` `%1 is the chairman of the %2.` plus suffix id `270` `Double-click for details.` when another chairman profile is attached. When the row also has a primary station, the helper appends localized help id `2992` `Shift-Click to center on this company's primary station.` After the live-company rows are rebuilt, it conditionally appends the synthetic row id `0x7fff` through `shell_company_list_format_company_or_start_row` so `<<Start New Company>>` appears as a separate affordance rather than as part of the seeded trio itself. It also refreshes the currently selected list index at `[this+0x78]`.","objdump + RT3.lng strings + caller inspection + company-list iteration"
0x004c6f30,704,shell_company_list_window_handle_message,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Message dispatcher for the shell company-list window. Selection changes on controls `0x2ee1` and `0x2ee2` toggle the mirrored list selection state and the local start-company affordance latch at `0x006cfe7c`. Activating one live company row routes through `shell_company_list_activate_or_shift_center_company` at `0x004c6bb0` or opens its detail path through the shell detail-panel manager `0x004ddbd0`. Activating the synthetic row id `0x7fff` instead checks whether the current chairman can start a new company, optionally shows localized confirmation id `272` `You're currently chairman of the %1... Proceed?`, and then opens the dedicated `Start New Company...` dialog through `start_new_company_dialog_open` at `0x0047d080`. When that dialog closes while the company-list window remains active, the handler rebuilds the rows through `shell_company_list_window_refresh_rows` at `0x004c6c30`.","objdump + RT3.lng strings + caller inspection + dialog correlation"
0x004c7200,212,shell_company_list_window_construct,shell,thiscall,inferred,objdump + caller inspection + strings,4,"Constructs the shell company-list window rooted at globals `0x006cfe70..0x006cfe7c`. The helper allocates two mirrored list widgets under ids `0x2ee1` and `0x2ee2`, attaches the row formatter `shell_company_list_format_company_or_start_row` at `0x004c6b40`, the live-row activation handler `shell_company_list_activate_or_shift_center_company` at `0x004c6bb0`, publishes the current selected-index storage at `[this+0x78]`, and then calls `shell_company_list_window_refresh_rows` at `0x004c6c30`. It also toggles the start-company affordance controls `0x2ee3` and `0x2ee4` from the global latch `0x006cfe7c`, which matches the handler-side selection logic for the synthetic `<<Start New Company>>` row.","objdump + caller inspection + control wiring"
0x005068c0,443,shell_station_detail_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `StationDetail.win` panel owned by detail-manager mode `8`. The constructor installs the singleton at `0x006d16d8`, binds `StationDetail.imb` and `StationDetail.win` through `0x0053d110` and `0x0053fa50`, seeds the paired action controls `0xb3b7` and `0xb3b8` through callback `0x00506610`, toggles the adjacent navigation controls `0xb3b3` and `0xb3b4`, conditionally restyles the special action control `0xb3f8` from the editor latch `[0x006cec74+0x68]`, special-condition slot `[0x006cec78+0x4af7]`, and selected-station byte `[station+0x5c9]`, and then refreshes the lower class-gated action strip `0xb3bb..0xb3bf` through `0x005044b0`. This corrects the older company-browser reading: current grounded resource names and control wiring put mode `8` on a station-detail lane rather than on a company-detail browser.","objdump + strings + detail-manager correlation + caller inspection + special-action-control correlation + lower-action-strip correlation"
0x00506a80,64,shell_station_list_window_destruct_release_helpers_and_clear_singleton,shell,thiscall,inferred,objdump + vtable scan + local disassembly,2,"Primary `StationList.win` destructor. The helper restores vtable `0x005d177c`, releases the two helper handles rooted at `0x006d1704` and `0x006d170c` through the shared owner `0x006d4020 -> 0x0053c000`, clears singleton `0x006d1708`, and then tail-jumps into the common shell-window teardown at `0x0053f7d0`. Current evidence comes from the StationList constructor or vtable pair, so this is the safest current read for the concrete list-window destroy path rather than another shared shell stub.","objdump + vtable scan + local disassembly + StationList destructor correlation"
0x00506ac0,656,shell_station_list_row_callback_publish_station_callout_card,shell,cdecl,inferred,objdump + local disassembly + caller inspection + callout correlation,3,"Row-side callout publisher beneath the visible `StationList.win` controls `0x61a9` and `0x61aa`. Given one selected station id and one caller-supplied screen anchor tuple, the helper resolves the live station from collection `0x006cec20`, derives one category or type label through the linked record path `0x0062b26c -> 0x0040cec0`, builds one localized header through `0x0053de00` and `0x00552560`, copies the station display name from `[station+0x46b]`, queries the weighted freight lane through `0x005519f0`, queries the cached express or freight class totals through `placed_structure_query_cached_express_service_class_score` `0x0047e390` for ids `0x0386` and `0x0385`, and then publishes the resulting stacked text card through repeated `shell_publish_text_callout_presentation` `0x005519f0` calls using the helper payload roots at `0x006d1704` and `0x006d170c`. Current grounded caller is `shell_station_list_window_refresh_rows_selection_and_status` `0x00506f30`, which wires this callback onto both station row controls with event `0x7a`.","objdump + local disassembly + caller inspection + callout correlation + StationList row-callback correlation"
0x00506be0,360,shell_station_detail_format_freight_and_express_summary,shell,cdecl,inferred,objdump + strings + caller inspection,4,"Formats the visible freight and express summary lines on the shell-side `StationDetail.win` panel. The helper resolves the selected placed-structure record, builds the weighted freight total through the neighboring cargo-summary helper at `0x005519f0`, queries the cached express-side service totals through `placed_structure_query_cached_express_service_class_score` at `0x0047e390` for class ids `0x0385` and `0x0386`, and then writes the localized lines `Freight: %1` and `Express: %1` through string ids `239` and `240`. This is the first grounded shell-detail consumer of the local service bundle rebuilt beneath `0x0042d580`.","objdump + strings + caller inspection + service-query correlation"
0x00506d50,252,shell_station_list_handle_center_or_rename_action,shell,cdecl,inferred,objdump + strings + caller inspection,4,"Handles the station-list row modifier actions after the active station row is resolved from collection `0x006cec20`. The helper reads the packed shell input modifier bits from `0x006d4018+0xa8c`; with Shift it recenters the world view on the selected station through `0x0047de00` and `0x00433900`, and with Control it opens the station rename prompt through localized id `3732` `Enter station name:`. This helper is the modifier-aware side-action lane paired with the visible freight or express station-row summaries.","objdump + strings + caller inspection + input-state correlation"
0x00506e50,221,shell_station_list_format_freight_and_express_availability_summary,shell,cdecl,inferred,objdump + strings + caller inspection,4,"Formats the visible `StationList.win` row summary for one selected station. The helper resolves the placed-structure record from collection `0x006cec20`, queries the cached express-side service totals through `placed_structure_query_cached_express_service_class_score` at `0x0047e390` for class ids `0x0385` and `0x0386`, and then emits the localized composite summary `3890` `%1 has %2 freight loads and %3 express loads available for hauling...`. This is the first grounded shell-list consumer of the same service-score lane used by `shell_station_detail_format_freight_and_express_summary`.","objdump + strings + caller inspection + service-query correlation"
0x00506f30,672,shell_station_list_window_refresh_rows_selection_and_status,shell,thiscall,inferred,objdump + caller inspection + local disassembly + collection scan,4,"Broad row and status refresh owner for the shell-side `StationList.win` panel. The helper clears the two visible row controls `0x61a9` and `0x61aa`, scans collection `0x006cec20`, filters candidate rows through `placed_structure_is_station_or_transit_site_class` `0x0047fd50`, the linked-site class check at `0x0040c990`, and the current selected-company gate `0x004337a0 == 0x0047efe0`, then republishes matching station ids into both row controls. It also wires the visible summary callback `shell_station_list_format_freight_and_express_availability_summary` `0x00506e50`, the row-activation callback `0x00506ac0`, and the modifier-action callback `shell_station_list_handle_center_or_rename_action` `0x00506d50`, restores the highlighted row from `0x00622ae4`, mirrors the shared selected station latch `0x006cec78+0x4cba` when it still belongs to the current company, and refreshes the two status labels `0x61af` and `0x61b0`. Current grounded caller is `shell_station_list_window_construct` `0x005074c0`, and the same body is re-entered from the later message owner.","objdump + caller inspection + local disassembly + collection scan + row-refresh correlation"
0x005071e0,494,shell_station_list_window_handle_message,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Primary message dispatcher for the shell-side `StationList.win` family rooted at vtable `0x005d177c`. The helper owns the paired station-row controls `0x61a9` and `0x61aa`, the side selector controls `0x61ab` and `0x61ac`, and the two status labels `0x61af` and `0x61b0`. It periodically updates the currently highlighted station id through `0x00622ae4`, mirrors row selections into `0x006cec78+0x4cba`, and on activation resolves the selected station object through collection `0x006cec20`, optionally recenters the world view through `0x00433900`, then re-enters the shell detail-panel manager with mode `5` and that same station id. The `0x61ab` and `0x61ac` controls toggle the active side bit at `0x006d1710`, refresh the side-selector affordances, and reopen the modal station-pick helper through `shell_station_pick_window_open_modal_and_return_selected_station_id` `0x005078c0`.","objdump + strings + detail-manager correlation + UI dispatch inspection + station-pick-modal correlation"
0x005074c0,235,shell_station_list_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `StationList.win` panel later published at `0x006d1708`. The constructor binds the paired station-row controls `0x61a9` and `0x61aa`, seeds the side-selector controls `0x61ab` and `0x61ac` from the current active-side bit at `0x006d1710`, stores the selected-entry latch at `[this+0x78]`, and then calls `shell_station_list_window_refresh_rows_selection_and_status` `0x00506f30`. Current grounded evidence places this panel on a station-oriented shell lane below the company roster rather than on a direct company-detail or chairmanship-claim path.","objdump + strings + detail-manager correlation + caller inspection + row-refresh correlation"
0x005075b0,16,shell_station_pick_window_noop_list_aux_callback,shell,cdecl,inferred,objdump + constructor wiring,1,"Tiny no-op callback that immediately returns. Current grounded caller is `shell_station_pick_window_construct` `0x00507620`, which wires it onto list control `0x80ea` with event `0x79`, so this is best read as the inert auxiliary callback slot for the StationPick list rather than as a meaningful command owner.","objdump + constructor wiring + no-op correlation"
0x005075c0,96,shell_station_pick_window_rewrite_list_and_scroll_messages_to_primary_select_event,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Tiny `StationPick.win` message normalizer over one incoming shell message record. The helper recognizes the helper's list and scroll messages `0xc9`, `0xca`, and `0xcb`; rewrites list control `0x80ea` and scroll controls `0x80e8/0x80e9` onto the primary select message `0xc9`; and when the rewritten branch comes from control `0x80e9` it also clears the staged station-id latch `0x00622ae8` back to `-1`. This is the safest current read for the StationPick list-or-scroll normalization helper rather than an independent command owner.","objdump + caller inspection + local disassembly + StationPick message normalization"
0x00507620,656,shell_station_pick_window_construct,shell,thiscall,inferred,objdump + strings + caller inspection,4,"Constructs the shell-side `StationPick.win` helper window. The constructor binds the list control `0x80ea`, the scroll or selector controls `0x80e8` and `0x80e9`, publishes the helper at `0x006d1718`, and then populates the visible station rows from collection `0x006cec20`. The same family feeds the selected station id through `0x00622ae8`, normalizes list and scroll messages through `shell_station_pick_window_rewrite_list_and_scroll_messages_to_primary_select_event` `0x005075c0`, and returns the chosen id to the caller when the modal opener closes. Current grounded callers put this helper under the `StationList.win` selector branch rather than under the startup-company flow.","objdump + strings + caller inspection + helper correlation + StationPick normalization correlation"
0x005076c0,501,shell_station_pick_window_populate_station_rows,shell,cdecl,inferred,objdump + strings + caller inspection,4,"Populates the visible row set for the shell-side `StationPick.win` helper. The helper iterates collection `0x006cec20`, filters entries through `0x0047fd50`, sorts them by the display-name field at `[entry+0x46b]`, and publishes the resulting station names through the helper list control `0x80ea`. It also mirrors the chosen station ids back into the helper-local scratch arrays, updates one status lane through control event `0xaf`, and refreshes the visible row count through control event `0x66`. Current grounded caller is `shell_station_pick_window_construct` at `0x00507620`.","objdump + strings + caller inspection + collection iteration"
0x005078c0,192,shell_station_pick_window_open_modal_and_return_selected_station_id,shell,fastcall,inferred,objdump + caller inspection + local disassembly,3,"Modal StationPick helper opener above `shell_station_pick_window_construct` `0x00507620`. If the live station collection `0x006cec20` is empty the helper returns `-1` immediately. Otherwise it allocates one `0x78`-byte helper object through `0x0053b070`, constructs the `StationPick.win` window, stores the live helper at `0x006d1718`, optionally nudges one presentation float at `[helper+0x05]` when caller flag `CL` is nonzero, brackets the modal show path through `0x00483450`, `0x00538f10`, `0x004834a0`, and `0x005389c0`, then destroys the helper, clears `0x006d1718`, and returns the selected station id from `0x00622ae8`. Current grounded caller is the side-selector branch inside `shell_station_list_window_handle_message` `0x005071e0`.","objdump + caller inspection + local disassembly + modal-helper correlation"
0x00505bf0,188,shell_station_detail_window_destruct_release_preview_helpers_and_clear_singleton,shell,thiscall,inferred,objdump + vtable scan + local disassembly + helper-root correlation,3,"Primary `StationDetail.win` destructor rooted at vtable `0x005d1748`. The helper first restores that same vtable, clears the active candidate-service preview pair through two calls into the world-side reset helper `0x0043f610`, drops the local preview latch `[this+0x7c]` together with sibling refcount `0x0062be84`, optionally re-enters the world-side preview clear path `0x00452d30` when the live world owner at `0x0062c120` is still in the matching preview-capable mode gate, releases the five shell helper handles at `0x006d16dc`, `0x006d16e0`, `0x006d16e4`, `0x006d16e8`, and `0x006d16ec` through the shared owner `0x006d4020 -> 0x0053c000`, clears singleton `0x006d16d8`, and then tail-jumps into the common shell-window teardown at `0x0053f7d0`. Current grounded caller is the shell detail-panel teardown side at `0x004dd9fa`.","objdump + vtable scan + local disassembly + helper-root correlation + preview-teardown correlation"
0x00505cb0,382,shell_station_detail_cycle_selected_station_by_direction_preserving_owner_and_station_site_class,shell,fastcall,inferred,objdump + local disassembly + caller inspection + collection-walk correlation,3,"Direction-driven station-selection helper beneath the `StationDetail.win` family. The first register argument in `ECX` is a signed step direction, and the helper first validates the current selected station from detail-manager state `0x006d0818+0x90`, resolves that station's owner through `0x0047efe0`, and gets its current live-slot position in collection `0x006cec20`. It then walks the live station collection circularly by the requested direction until it finds another entry that passes the same station-or-transit-site class allowlist `0x0047fd50` and shares the same linked company id. When a match is found it releases the current global iteration root through `record_collection_release_global_iteration_root_0x6acd40_if_present` `0x004557b0`, republishes the selected station into the shell detail-panel family through `0x004dd8a0`, and, when no modal overlay is active under `[0x0062be68+0x60]`, recenters the world view through `shell_world_view_center_on_object_with_mode_specific_zoom_policy` `0x00433900` before tail-calling the target object's vtable `+0x5c` callback. This is the current grounded owner for StationDetail next-or-previous station stepping rather than a generic collection iterator.","objdump + local disassembly + caller inspection + collection-walk correlation + owner-filter correlation"
0x00505e30,10,shell_station_detail_cycle_to_next_station_preserving_owner_and_station_site_class,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper that seeds direction `+1` into `shell_station_detail_cycle_selected_station_by_direction_preserving_owner_and_station_site_class` `0x00505cb0`. Current grounded caller is the broader shell command branch at `0x00440e0f` when `StationDetail.win` is live.","objdump + local disassembly + caller inspection + wrapper correlation"
0x00505e40,8,shell_station_detail_cycle_to_previous_station_preserving_owner_and_station_site_class,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper that seeds direction `-1` into `shell_station_detail_cycle_selected_station_by_direction_preserving_owner_and_station_site_class` `0x00505cb0`. Current grounded caller is the paired shell command branch at `0x00440f2f` when `StationDetail.win` is live.","objdump + local disassembly + caller inspection + wrapper correlation"
0x004d4500,88,shell_ensure_editor_panel_window,shell,cdecl,inferred,objdump + analysis-context,4,Ensures the shell-side EditorPanel.win helper window rooted at 0x006d07b4 exists. When the panel is absent it allocates a 0x7c-byte window object seeds the vtable at 0x005d0cb8 binds the EditorPanel.win resource through 0x0053fa50 publishes the object to the shell runtime through 0x00538e50 event 0x1e and then runs the shared panel-open helper at 0x004d4160.,objdump + analysis-context + strings
0x004dc670,368,shell_file_options_dialog_construct,shell,thiscall,inferred,objdump + strings,4,Constructs the shared shell file-options dialog rooted at fileopt.win. The helper clears the three downstream branch flags at 0x006d07f8 0x006d07ec and 0x006d07f0 binds the fileopt.win resource through 0x0053fa50 publishes the object to the shell runtime and populates several mode-dependent labels and status text before user input is handled.,objdump + strings
0x004dc7d0,14,shell_has_file_options_dialog,shell,cdecl,inferred,objdump + nearby-constructor correlation + frame-caller inspection,4,"Tiny presence probe for the shared shell file-options dialog rooted at `0x006d0800`. The helper returns `1` when the live `fileopt.win` object is present and `0` otherwise. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where this check now sits beside the `LoadScreen` and custom-modal probes.","objdump + nearby-constructor correlation + frame-caller inspection + fileopt correlation"
0x004dc7e0,11,shell_mark_file_options_dialog_dirty,shell,cdecl,inferred,objdump + nearby-constructor correlation + frame-caller inspection,4,"Tiny dirty-latch setter paired with `shell_has_file_options_dialog`. The helper stores `1` into `0x006d07fc`, which current nearby call patterns treat as the `fileopt.win` refresh or service request latch once the shared file-options dialog exists. Current grounded caller is the same post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`.","objdump + nearby-constructor correlation + frame-caller inspection + fileopt correlation"
0x004dc7f0,477,shell_file_options_dialog_handle_message,shell,thiscall,inferred,objdump + strings,4,Handles the fileopt.win command flow and selects exactly one downstream branch before the shared detail-panel completion dispatcher runs. Successful commands dismiss the dialog then set 0x006d07f8 for the load or restore side 0x006d07ec for the save or package side or 0x006d07f0 for the sibling settings-window escape. The settings branch gates on shell_has_settings_window at 0x004fe120 and lazily opens the shared SettingsWindow.win object through 0x00501e50 while sibling branches show prerequisite dialogs when the requested file operation is not currently allowed.,objdump + strings + caller xrefs
0x004dd010,890,shell_file_request_dialog_collect_target_path,shell,cdecl,inferred,objdump + strings,4,"Builds the modal filerqst.win request dialog and resolves one chosen target path back into the caller buffer. The helper treats dialog modes 0 1 2 3 and 11 as save-side requests and the paired modes 4 8 9 and 10 as load-side requests then swaps the button and prompt text between localized ids 249 250 and 251 252. On success it appends one extension from the static mode table at 0x005f3d58 where 0 or 8=.gms 1 or 9=.gmc 2 or 10=.gmx 3 or 4=.gmp and 11=.gmt. Current neighboring callers tighten that last mode too: the normal shell map coordinators use the `.gms/.gmc/.gmx/.gmp` families for scenario and editor flows, while save mode 11 is only consumed by the auxiliary `.gmt` preview-surface branch shared with the side owner at 0x006cd8d8. When a live runtime world is already active through 0x004839b0 the helper overrides that non-runtime table and appends .smp instead, which makes it the shared bridge between the broad shell coordinators and the runtime-state serializer or restore path rather than only a generic filename prompt.",objdump + strings + mode-table inspection + caller correlation
0x004dd630,144,shell_detail_panel_publish_mode_group_selector_event,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small post-switch helper beneath the shell detail-panel controller at `0x006d0818`. The helper reads current mode dword `[this+0x8c]`, classifies modes `6..0x1a` through the local byte table at `0x004dd6ec`, and then publishes one grouped selector event id `0x09`, `0x16`, `0x0c`, `0x15`, `0x02`, `0x08`, or fallback `0x01` through `0x0053f000` on the shared shell presenter rooted at `0x00ccbb20`. Current grounded caller is the detail-panel transition manager tail at `0x004ddfec`, where it runs after the old child has been torn down, the new child has been published, and the selector/status refresh helpers have already run. This is therefore the safest current read for the detail-panel mode-group publisher rather than a standalone control callback.","objdump + caller inspection + local disassembly + mode-group correlation + shell-presenter correlation"
0x004ddbd0,1096,shell_detail_panel_transition_manager,shell,thiscall,inferred,objdump + strings + caller inspection + case-table correlation,4,"Primary transition owner for the shell detail-panel controller rooted at `0x006d0818`. The helper tracks current mode in `[this+0x8c]`, current child at `[this+0x88]`, and optional selection ids cached in `[this+0x78]` through `[this+0x90]`. On every mode or subject change it first special-cases current mode `0x19`, updates or preserves cached selection ids, tears down the old child through `0x004dd950`, releases one shared global iteration root through `0x004557b0`, publishes the replacement child through the shell runtime at `0x006d401c`, refreshes selector or status UI through `0x004dd410`, re-enters the shared shell follow-on `0x004d44f0`, and finally pushes one grouped selector event through `0x004dd630`. The case table is now tighter too: current grounded constructor branches include `CompanyDetail.win` `0x004c5540`, `CompanyList.win` `0x004c7200`, `LoadScreen.win` `0x004e3a80` side-family siblings, `BuildingDetail.win` `0x004b81d0`, `Bulldoze.win` `0x004b8720`, `ChangeHeight.win` `0x004bcb50`, `ChangeTrees.win` `0x004bcdd0`, `Overview.win` `0x004f5020`, `PaintRegion.win` `0x004f54d0`, `PaintSound.win` `0x004f5670`, `PaintTerrain.win` `0x004f7ce0`, `PaintTerritory.win` `0x004fcf30`, `StockBuy.win` `0x0050c290`, `TrackLay.win` `0x0050e400`, `TrainDetail.win` `0x00514420`, and `StationDetail.win` `0x005068c0`, together with the helper-window ensure path for `EditorPanel.win` `0x004d4500`. The same-mode refresh branch is bounded now too: when the requested mode matches the current mode, the helper still reruns `0x004dd410` and `0x004d44f0`, keeps the mode-`8` company-side refresh special case through `0x004c2ca0`, keeps the mode-`9` `Overview.win` side refresh through `0x004f4970`, and preserves the mode-`2` branch that re-enters `0x00514410`. Current direct callers now include the world-surface brush mode buttons at `0x004bc87a..0x004bc918`, the `LoadScreen.win` row-click detail handoff lanes, and the broader shell state transition side around `0x00482ec0`, so this is the current safest read for the real shell detail-window and tool-window transition owner rather than a generic mode switch wrapper.","objdump + strings + caller inspection + case-table correlation + same-mode refresh correlation"
0x004dfbe0,393,shell_game_window_construct,shell,thiscall,inferred,objdump + strings + caller xrefs,4,"Constructs the shell-side `Game.win` detail window published at `0x006d0818`. The constructor seeds vtable `0x005d0eb8`, binds the `Game.win` resource through `0x0053fa50`, stores the singleton, creates the primary control strip rooted at ids `0x74`, `0x7d1`, `0x7d2`, `0x7d7`, `0x7f9`, `0x804`, `0x833`, and `0x837`, mirrors runtime booleans from `0x006cec7c+0x82`, `0x006cec74+0x2c3/+0x283`, and the active mode object at `0x006cec78`, and serves as the broad world-facing shell panel above the sibling `GameMessage.win` helper. `shell_transition_mode` now grounds this as its mode-`1` constructor family, while `0x004dfd70` is the paired old-mode teardown path and `0x004dfdf0` ensures the standalone `GameMessage.win` overlay on entry.","objdump + strings + caller xrefs + branch correlation"
0x004f5020,96,shell_overview_window_construct_and_seed_selection,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `Overview.win` window. The constructor installs vtable `0x005d13b4`, binds `Overview.win` through `0x0053fa50`, seeds live singleton `0x006d12f0`, initializes selection fields `[this+0x78/+0x7c]` to `-1`, clears companion global `0x006d12d4`, and then immediately re-enters `0x004f4970` with the current overview selection id from `0x006d12d8`. Current grounded caller is the detail-panel manager branch at `0x004dde47`, which keeps this on the shell detail-window side rather than the later world-side overview consumers that only test the singleton's presence.","objdump + strings + detail-manager correlation + singleton correlation + selection-seed correlation"
0x004f5080,67,shell_paint_region_window_select_ordinal_and_refresh_caption,shell,thiscall,inferred,objdump + message-owner inspection + caption-table correlation,4,"Small setter beneath the shell-side `PaintRegion.win` family. The helper stores the requested ordinal in `[this+0x78]`, reads one float caption value through table `0x006226e8`, formats that caption through `0x0051f070` and `0x00527de0` on presenter `0x006d4024`, and returns without touching the broader control strips. Current grounded caller is the message owner `0x004f52c0`, where control band `0x4651..0x4657` forwards through this helper before the main refresh pass.","objdump + message-owner inspection + caption-table correlation + shell-presenter correlation"
0x004f50d0,55,shell_paint_region_window_destroy,shell,thiscall,inferred,objdump + detail-manager teardown correlation,4,"Destructor-side wrapper for the shell-side `PaintRegion.win` family. The helper restores vtable `0x005d13f8`, re-enters the shared presenter-side destroy tail through `0x00523e20`, and when live world mode already equals `0x10` it also replays `0x00453510` before tail-calling the common shell-object teardown `0x0053f7d0`. Current grounded caller is the detail-panel transition manager teardown branch at `0x004ddbd0`, which keeps this on the shell tool-window side rather than the later region-service helpers.","objdump + detail-manager teardown correlation + world-mode branch correlation"
0x004f5110,432,shell_paint_region_window_refresh_control_bands,shell,thiscall,inferred,objdump + constructor correlation + message-owner inspection,4,"Owner-side refresh pass for the shell-side `PaintRegion.win` family. The helper first restyles the seven ordinal controls `0x4651..0x4657` from `[this+0x78]` and the 24-entry region row band `0x4664..0x467b` from `[this+0x80]`, then resolves the live region collection at `0x0062bae0` and repopulates the dynamic-text rows `0x46c8..0x46df`. Each row uses the special type-`0x6f` control path through `0x00540120`, derives its label from the region entry at `0x00518140`, and formats the paired summary metrics through localized ids `0x00e6` and the numeric formatter family `0x0051b700/0x005193f0`. Current grounded callers are the constructor `0x004f54d0` and the message owner `0x004f52c0`, which makes this the current `PaintRegion.win` refresh owner rather than a world-region rebuild helper.","objdump + constructor correlation + message-owner inspection + dynamic-text control correlation + region-collection correlation"
0x004f52c0,512,shell_paint_region_window_handle_message,shell,thiscall,inferred,objdump + constructor correlation + caller inspection,4,"Primary message dispatcher for the shell-side `PaintRegion.win` tool window. Under message `0xc8`, controls `0x4664..0x467b` update the current region row in `[this+0x80]` and global `0x006226e0`, then immediately route the world-side tool state through `0x00450520` when live world mode is `0x10` or through `0x00452fa0` with mode id `0x10` otherwise before re-entering `shell_paint_region_window_refresh_control_bands` `0x004f5110`. Controls `0x4651..0x4657` update the ordinal lane through `shell_paint_region_window_select_ordinal_and_refresh_caption` `0x004f5080`, then store the ordinal in global `0x006226e4` and refresh. Control `0x07d6` owns the shared world-surface latch `[this+0x7c]`; while that latch is live, the helper hit-tests through `0x00448ac0`, resolves the current ordinal value through table `0x006226e8`, and forwards the staged world coordinates plus the current region row through `0x0044a320` before mirroring the row pointer back through `0x00450520` or `0x00452fa0`. Current grounded owner correlation is the constructor `0x004f54d0` and the live shell message flow, which keeps this on the `PaintRegion.win` tool-window side of the shared world-surface family.","objdump + constructor correlation + caller inspection + world-surface latch correlation + tool-state dispatch correlation"
0x004f54d0,224,shell_paint_region_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `PaintRegion.win` tool window. The constructor installs vtable `0x005d13f8`, binds `PaintRegion.win` through `0x0053fa50`, seeds the live singleton from globals `0x006226e0..0x006226e8`, refreshes the visible selection band through `0x004f5110`, and then routes the initial world-side tool state through `0x00450520` or `0x00452fa0` depending on current world mode `0x10`. Current grounded caller is the detail-panel manager branch at `0x004ddf6a`, which keeps this on the shell tool-window side rather than the later world-side region or route families.","objdump + strings + detail-manager correlation + singleton correlation + tool-state dispatch correlation"
0x004f55b0,67,shell_paint_sound_window_select_family_and_refresh_caption,shell,thiscall,inferred,objdump + message-owner inspection + caption-table correlation,4,"Small setter beneath the shell-side `PaintSound.win` family. The helper stores the requested sound-family ordinal in `[this+0x78]`, reads one caption value through table `0x0062270c`, and formats that caption through `0x0051f070` and `0x00527de0` on presenter `0x006d4024`. Current grounded caller is the message owner `0x004f57a0`, where control band `0x1195..0x119b` forwards through this helper before the main refresh pass.","objdump + message-owner inspection + caption-table correlation + shell-presenter correlation"
0x004f5600,102,shell_paint_sound_window_refresh_control_bands,shell,thiscall,inferred,objdump + constructor correlation + message-owner inspection,4,"Small owner-side refresh pass for the shell-side `PaintSound.win` family. The helper restyles the seven family controls `0x1195..0x119b` from `[this+0x78]` and the five subordinal controls `0x119e..0x11a2` from `[this+0x7c]`, republishing each row through `0x00540120` with the selected-vs-unselected style split `0x87/0x65`. Current grounded callers are the constructor `0x004f5670` and the message owner `0x004f57a0`, which keeps this as a shell-side control refresh rather than a world ambient-service helper.","objdump + constructor correlation + message-owner inspection + control-band correlation"
0x004f5670,224,shell_paint_sound_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `PaintSound.win` tool window. The constructor installs vtable `0x005d1424`, binds `PaintSound.win` through `0x0053fa50`, seeds the current sound-family ordinal and subordinal from globals `0x00622704..0x0062270c`, stores the live singleton at `0x006d12fc`, refreshes the visible row bands through `0x004f5600`, and then routes the initial world-side tool state through `0x00450520` or `0x00452fa0` depending on current world mode `0x11`. Current grounded caller is the detail-panel manager branch at `0x004ddfa2`, which keeps this on the shell tool-window side rather than the later world-side sound or ambient subsystems.","objdump + strings + detail-manager correlation + singleton correlation + tool-state dispatch correlation"
0x004f5750,65,shell_paint_sound_window_destroy,shell,thiscall,inferred,objdump + detail-manager teardown correlation,4,"Destructor-side wrapper for the shell-side `PaintSound.win` family. The helper restores vtable `0x005d1424`, re-enters the shared presenter-side destroy tail through `0x00523e20`, clears the companion global latch `0x006cfe18`, and when live world mode already equals `0x11` it also replays `0x00453510` before tail-calling the common shell-object teardown `0x0053f7d0`. Current grounded caller is the detail-panel transition manager teardown branch at `0x004ddbd0`, which keeps this on the shell tool-window side rather than the later sound-preview consumers.","objdump + detail-manager teardown correlation + companion-global clear correlation + world-mode branch correlation"
0x004f57a0,426,shell_paint_sound_window_handle_message,shell,thiscall,inferred,objdump + constructor correlation + caller inspection,4,"Primary message dispatcher for the shell-side `PaintSound.win` tool window. Under message `0xc8`, controls `0x1195..0x119b` update the family ordinal through `shell_paint_sound_window_select_family_and_refresh_caption` `0x004f55b0`, store the ordinal in global `0x00622704`, and then refresh through `0x004f5600`. Controls `0x119e..0x11a2` update the paired subordinal in `[this+0x7c]` and global `0x00622708`, then either dispatch immediately through `0x00452fa0` with mode id `0x11` or mirror back through `0x00450520` when the live world mode already equals `0x11`. Control `0x07d6` owns the shared world-surface latch `[this+0x80]`; while that latch is live, the helper hit-tests through `0x00448ac0`, resolves the current family caption value through `0x0062270c`, and forwards the staged world coordinates plus the current subordinal through `0x0044a0e0` before refreshing the live world-side tool state. Current grounded owner correlation is the constructor `0x004f5670` and the active shell message loop, which keeps this on the `PaintSound.win` side of the shared world-surface family rather than the later sound-preview callback band.","objdump + constructor correlation + caller inspection + world-surface latch correlation + tool-state dispatch correlation"
0x004f5960,138,shell_paint_terrain_window_set_primary_scalar_slot_and_refresh_label,shell,cdecl,inferred,objdump + constructor correlation + callback registration correlation,4,"Numeric callback beneath the shell-side `PaintTerrain.win` family for the first four-scalar strip rooted at controls `0x2922..0x2925`. The helper converts the incoming integer payload into a normalized float, stores the result into global lane table `0x00622728`, formats the corresponding label text through `0x0051b700`, and republishes the text into the paired dynamic-text controls `0x292c..0x292f` through type `0x6f` on callback root `0x006d1334`. Current grounded owner is the terrain-window constructor `0x004f7ce0`, which registers this callback directly through `0x00540120`.","objdump + constructor correlation + callback registration correlation + scalar-table correlation"
0x004f59f0,138,shell_paint_terrain_window_set_secondary_scalar_slot_and_refresh_label,shell,cdecl,inferred,objdump + constructor correlation + callback registration correlation,4,"Numeric callback beneath the shell-side `PaintTerrain.win` family for the second four-scalar strip rooted at controls `0x2936..0x2939`. The helper mirrors `0x004f5960`: it converts the incoming integer payload into a normalized float, stores the result into global lane table `0x00622738`, formats the corresponding label text through `0x0051b700`, and republishes that text into the paired dynamic-text controls `0x2940..0x2943` through type `0x6f` on callback root `0x006d1334`. Current grounded owner is the terrain-window constructor `0x004f7ce0`, which registers this callback directly through `0x00540120`.","objdump + constructor correlation + callback registration correlation + scalar-table correlation"
0x004f5a80,423,shell_paint_terrain_window_push_undo_snapshot,shell,thiscall,inferred,objdump + constructor correlation + message-owner caller correlation,4,"Terrain-window local undo or snapshot push helper. The routine copies the current primary raster from `[this+0x114]` into the next snapshot slot under `[this+0x11c]`, captures four sibling render-target buffers from the live render root `0x0062c120` into the parallel snapshot band `[this+0x144]`, and increments the local stack depth `[this+0x1e4]` up to a bounded ten-entry ring. When the stack is already full it rotates the stored snapshot pointers and then copies the current buffers into the last slot instead. Current grounded callers are the terrain-window constructor `0x004f7ce0` and the larger terrain message owner `0x004f6f50`, which keeps this on the shell-side preview or undo family rather than the world-side raster mutation path.","objdump + constructor correlation + message-owner caller correlation + snapshot-ring correlation"
0x004f5c30,188,shell_paint_terrain_window_pop_undo_snapshot,shell,thiscall,inferred,objdump + message-owner caller correlation + snapshot-ring correlation,4,"Terrain-window local undo or snapshot pop helper. When the bounded snapshot depth `[this+0x1e4]` is positive, the routine decrements that depth, restores the saved primary raster back into `[this+0x114]`, resizes the live render root through `0x0051f090/0x00534730`, and then restores the four sibling render-target buffers from the parallel snapshot band `[this+0x144]`. Current grounded callers are the terrain-side dispatcher `0x004f6a60` and the larger terrain message owner `0x004f6f50`, where control `0x2775` routes into this helper as the current explicit undo affordance.","objdump + message-owner caller correlation + snapshot-ring correlation + undo-control correlation"
0x004f5cf0,224,shell_paint_terrain_window_publish_active_scalar_caption,shell,thiscall,inferred,objdump + constructor correlation + caller inspection,4,"Shared terrain-window caption publisher for the currently active scalar lane. The helper latches the requested scalar index into `[this+0x98]`, selects one current source value either from the fixed scalar global `0x006227b4` or from one of the per-mode float tables `0x006227ac`, `0x006227c8`, `0x006227e4`, `0x00622800`, and `0x0062281c`, and then formats the resulting caption through `0x0051f070/0x00527de0` on presenter `0x006d4024`. Current grounded callers are the terrain-window constructor `0x004f7ce0`, the terrain mode setter `0x004f6b50`, and the larger terrain message-owner refresh tail near `0x004f6f20`.","objdump + constructor correlation + caller inspection + scalar-caption correlation"
0x004f5dd0,25,shell_paint_terrain_window_select_active_scalar_group_and_refresh_caption,shell,thiscall,inferred,objdump + direct body inspection + message-owner caller correlation,4,"Tiny selector helper beneath the shell-side `PaintTerrain.win` family. The helper stores the caller-supplied scalar-group ordinal into `[this+0x8c]`, swaps the current active caption index `[this+0x98]` into the stack argument slot, and then tail-calls `shell_paint_terrain_window_publish_active_scalar_caption` `0x004f5cf0`. Current grounded caller is the direct terrain message-owner branch at `0x004f7500`, which keeps this on the shell-side selector and caption family rather than the world-side raster brush path.","objdump + direct body inspection + message-owner caller correlation + caption-selector correlation"
0x004f5ea0,27,shell_paint_terrain_window_is_mode5_variant2,shell,thiscall,inferred,objdump + direct body inspection + caller correlation,4,"Tiny predicate beneath the shell-side `PaintTerrain.win` family. The helper returns true only when current terrain mode `[this+0x90]` equals `5` and the paired variant lane `[this+0x94]` equals `2`; otherwise it returns false. Current grounded callers are the mode-dispatch bridge `0x004f6250` and the larger path-preview compositor `0x004f8bb0`, which keeps this on the terrain special-mode gating family rather than any direct world-side raster mutation path.","objdump + direct body inspection + caller correlation + special-mode predicate correlation"
0x004f5ec0,27,shell_paint_terrain_window_is_mode4_variant2,shell,thiscall,inferred,objdump + direct body inspection + caller correlation,4,"Tiny predicate beneath the shell-side `PaintTerrain.win` family. The helper returns true only when current terrain mode `[this+0x90]` equals `4` and the paired variant lane `[this+0xb4]` equals `2`; otherwise it returns false. Current grounded caller is the message-owner branch at `0x004f784b`, which uses this as one narrow terrain special-mode gate before entering the heavier preview path.","objdump + direct body inspection + caller correlation + special-mode predicate correlation"
0x004f5df0,675,shell_paint_terrain_window_refresh_control_bands,shell,thiscall,inferred,objdump + constructor correlation + message-owner caller correlation,4,"Broad owner-side refresh pass for the shell-side `PaintTerrain.win` family. The helper republishes the active terrain mode strip `0x28dd..0x28e6`, several adjacent selector bands rooted at `0x27d9`, `0x283d`, `0x28a1`, `0x28d3`, `0x290d`, `0x2913`, `0x2915`, `0x2917`, `0x291f`, and `0x2954`, the current mode-dependent summary labels around `0x291a`, `0x296a`, and `0x296b`, and the three paired scalar rows `0x2a38..0x2a3d` plus the four dynamic rows rooted at `0x292c`. The same pass also propagates the current color preview from `[this+0x80]`, the current mode selector from `[this+0x90]`, and the cached mode-specific scalar lanes `[this+0x94]..[this+0xc8]`. Current grounded callers are the constructor `0x004f7ce0`, the terrain-side dispatcher `0x004f6a60`, the terrain mode setter `0x004f6b50`, and the larger message owner `0x004f6f50`, which keeps this on the shell-side control-band family rather than the world raster brush path.","objdump + constructor correlation + message-owner caller correlation + control-band correlation"
0x004f6070,326,shell_paint_terrain_window_set_rgb_component_and_refresh_preview,shell,cdecl,inferred,objdump + constructor correlation + callback registration correlation,4,"Numeric callback beneath the shell-side `PaintTerrain.win` family for the three RGB-style component controls rooted at `0x294c`, `0x294e`, and `0x2950`. The helper formats the incoming integer payload through localized ids `0x00df`, `0x00e0`, or `0x00e1` depending on the triggering control id, writes the resulting component byte back into global byte strip `0x006d1300..0x006d1302`, composes the preview color dword at `[0x006d1334+0x80]`, and republishes both the dynamic text row and the color preview control `0x296a`. Current grounded owner is the terrain-window constructor `0x004f7ce0`, which registers this callback directly through `0x00540120`.","objdump + constructor correlation + callback registration correlation + color-preview correlation"
0x004f61c0,144,shell_paint_terrain_window_increment_generation_count_and_refresh_caption,shell,cdecl,inferred,objdump + callback registration correlation + counter-caption correlation,3,"Small terrain-window callback that increments the current generation or count lane at `[0x006d1334+0xc4]`, mirrors that same value into global `0x0062275c`, formats the new 1-based count through `0x0051b700/0x005193f0` with localized id `0x00e2`, and republishes the result into dynamic-text control `0x290c`. This helper sits on the same callback-root family as the other `PaintTerrain.win` numeric updaters, but the current constructor slice does not yet ground the exact triggering control id.","objdump + callback registration correlation + counter-caption correlation"
0x004f6250,309,shell_paint_terrain_window_dispatch_current_mode_to_world,shell,thiscall,inferred,objdump + caller inspection + mode-constant correlation,4,"Mode-dependent world-dispatch helper beneath the shell-side `PaintTerrain.win` family. The helper reads current terrain mode `[this+0x90]` and forwards one matching world-mode request through `0x00452fa0`, currently including constants `0x18`, `0x19`, `0x1a`, `0x1c`, `0x1d`, and `0x2c`, with one fallback path gated through `0x004f5ea0`. When no explicit dispatch is needed it optionally replays the current world-side refresh through `0x00453510` if the caller requested it. Current grounded callers are the terrain mode setter `0x004f6b50`, the larger terrain message owner `0x004f6f50`, and the current brush-state refresh tails that need to mirror the selected shell mode back into world state.","objdump + caller inspection + mode-constant correlation + world-dispatch correlation"
0x004f6390,920,shell_paint_terrain_window_refresh_mode_panels,shell,thiscall,inferred,objdump + constructor correlation + repeated caller correlation,4,"Broad terrain-window mode-panel refresh owner. The helper repaints the current grouped mode selectors and availability strips rooted at `0x2711`, `0x27d9`, `0x283d`, `0x28a1`, `0x28d3`, `0x290d`, `0x2913`, `0x2915`, `0x2917`, `0x291f`, and `0x29cd`, toggles the mode families `0x28ab..0x28b4` and `0x28ae..0x28b0`, refreshes current scalar or color readouts under `0x291a`, `0x296a`, and `0x296b`, and repositions three callback-backed rows `0x2a3b..0x2a3d` from the paired coordinate band `[this+0xd8..+0xec]`. It also gates several row styles through the current mode state `[this+0x8c/+0x90/+0x94..+0xc0]`, the helper predicates `0x005586c0` and `0x004f5ea0`, and the live world mode at `0x0062c120+0x2175`. Current grounded callers are the terrain constructor `0x004f7ce0`, the terrain mode setter `0x004f6b50`, the terrain-side dispatcher `0x004f6a60`, and many direct message-owner subbranches under `0x004f6f50`.","objdump + constructor correlation + repeated caller correlation + control-band correlation + mode-panel correlation"
0x004f6930,161,shell_paint_terrain_window_sample_primary_raster_at_world_coords,shell,thiscall,inferred,objdump + caller inspection + field-layout correlation,4,"World-coordinate sample helper beneath the shell-side `PaintTerrain.win` family. The routine converts the caller-supplied world-space float pair into integer sample coordinates by scaling against live world dimensions `[0x0062c120+0x2155/+0x2159]` and the current preview-raster dimensions `[this+0xfc/+0x100]`, clamps those indices against the current primary preview buffer, and on success returns the sampled dword from `[this+0x114]`; otherwise it returns `0`. Current grounded callers are the direct terrain message-owner color-preview branch at `0x004f7186` and the neighboring shell-side setup branch at `0x004deb7b`, so the safest current read is the current preview-raster sampler rather than a direct world-cell query.","objdump + caller inspection + field-layout correlation + preview-raster correlation"
0x004f69e0,148,shell_paint_terrain_window_set_triplet_scalar_and_refresh_label,shell,cdecl,inferred,objdump + constructor correlation + callback registration correlation,4,"Numeric callback beneath the shell-side `PaintTerrain.win` family for the three-entry scalar strip rooted at controls `0x2a32..0x2a34`. The helper formats the incoming integer payload through the shared terrain template at `0x005d0b18`, republishes the resulting label through the dynamic-text control immediately above the triggering control id, stores the raw integer into the paired triplet state under callback root `0x006d1334`, and then refreshes the live mode panels through `0x004f5df0` when the constructor-side bulk-update latch `0x006d1330` is clear. Current grounded owner is the terrain-window constructor `0x004f7ce0`, which registers this callback directly through `0x00540120`.","objdump + constructor correlation + callback registration correlation + bulk-update-latch correlation"
0x004f6b50,991,shell_paint_terrain_window_select_mode_and_refresh,shell,thiscall,inferred,objdump + constructor correlation + caller inspection,4,"Primary mode-selector setter for the shell-side `PaintTerrain.win` family. The helper writes the requested terrain mode into `[this+0x90]`, repaints the ten-entry mode strip rooted at `0x28dd`, normalizes paired selector state under `[this+0x8c]` for modes `3` and `8`, toggles several mode-specific row bands, refreshes the grouped terrain panels through `0x004f6390`, dispatches the selected mode back into world state through `0x004f6250(1)`, and finally republishes the active scalar caption through `0x004f5cf0([this+0x98])`. Current grounded callers are the terrain constructor `0x004f7ce0`, the direct message-owner subbranch at `0x004f7525`, and several later message-owner update paths, which keeps this on the shell-side terrain mode family rather than the later world brush implementation itself.","objdump + constructor correlation + caller inspection + mode-strip correlation + world-dispatch correlation"
0x004f6f50,3075,shell_paint_terrain_window_handle_message,shell,thiscall,inferred,objdump + constructor correlation + local disassembly + control-family correlation,4,"Primary message owner for the shell-side `PaintTerrain.win` family. The function grounds three top-level message lanes directly from the body: message `2` owns live world-surface control `0x07d6`, message `0xca` owns the bulk selector and callback-backed control strips, and message `0xcb` currently routes explicit undo control `0x2775` into `shell_paint_terrain_window_pop_undo_snapshot` `0x004f5c30`. Under the main `0xca` lane, the grounded control families are tighter now: `0x2711..0x2730` update the current grouped selector and cached mode ordinal, `0x27d9..0x27df` update the paired terrain-family row, `0x283d..0x2843` select the active scalar caption through `0x004f5cf0`, `0x28a1..0x28e6` fan into the cached mode or scalar lanes rooted at `0x006d1308..0x006d1328` and `0x00622748..0x0062276c`, `0x2915..0x291e` toggle several mode-dependent booleans and dispatch one world-mode subset, `0x2964..0x2967` dispatch world modes `0x20..0x23`, and `0x29cd..` updates the current brush-radius family in `[this+0xa8]` and global `0x00622758`. The live drag branch under control `0x07d6` is tighter too: after hit-testing through `0x00448ac0`, it updates the current preview color through `shell_paint_terrain_window_sample_primary_raster_at_world_coords` `0x004f6930`, routes the staged coordinates into the heavier preview workers `0x004fb5e0`, `0x004fc280`, `0x004fc4d0`, or `0x004fc630` depending on current terrain mode, and then mirrors the resulting preview or world update back through `0x00452f20`, `0x00452fa0`, `0x00453510`, and the shell-surface publish path. Current grounded owner correlation is the constructor `0x004f7ce0` plus the active shell message loop, which keeps this on the `PaintTerrain.win` side of the shared brush family rather than the later world raster mutation owners themselves.","objdump + constructor correlation + local disassembly + control-family correlation + drag-latch correlation + preview-worker correlation"
0x004f7ce0,304,shell_paint_terrain_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `PaintTerrain.win` tool window. The constructor installs vtable `0x005d1430`, binds `PaintTerrain.win` through `0x0053fa50`, carries the adjacent `GroundTerrain.tga` resource in the same family, seeds live shell singleton `0x006d1304`, seeds the callback-side root `0x006d1334`, marks tool bytes `0x006d1330/0x006d1331`, snapshots the current terrain mode, selector, scalar, and color lanes from globals `0x00622748..0x00622788` and `0x006d1308..0x006d1324`, builds the local undo or snapshot ring through `0x004f5a80`, seeds the current mode through `0x004f6b50`, and registers the numeric callback family `0x004f5960`, `0x004f59f0`, `0x004f6070`, and `0x004f69e0` through `0x00540120`. Current grounded caller is the detail-panel manager branch at `0x004ddf4e`, and the later world-side secondary-raster owner still only consumes `[0x006d1304+0x78/+0x7c]` as one pending component-seed pair, so the safest current read remains the shell paint-terrain window constructor rather than a direct world raster owner.","objdump + strings + detail-manager correlation + singleton correlation + tool-state snapshot correlation + callback-registration correlation"
0x004f81e0,400,shell_paint_terrain_window_blend_descriptor_palette_sample_into_preview_pixel,shell,thiscall,inferred,objdump + caller inspection + local disassembly + descriptor-blend correlation,4,"Late preview helper beneath the shell-side `PaintTerrain.win` family. The helper resolves one live preview pixel at `[this+0x114]` from the caller-supplied preview-space `(x,y)` coordinate, resolves one matching descriptor-raster pixel from the current terrain descriptor surface `[this+0x1fc]` by re-quantizing the caller-supplied world-grid coordinate through `[this+0x1e8/+0x1f0/+0x1f4]`, and then linearly blends the two BGRA pixels channel-by-channel with the caller-supplied float weight before writing the result back into the live preview raster. Current grounded caller is the late path-preview phase at `0x004fb081` inside `shell_paint_terrain_window_rasterize_drag_path_preview_into_preview_surface` `0x004f8bb0`, which keeps this on the descriptor-overlay preview family rather than the direct world raster mutation path.","objdump + caller inspection + local disassembly + descriptor-blend correlation + preview-pixel correlation"
0x004f8370,1024,shell_paint_terrain_window_smooth_interior_preview_pixel_from_neighbor_samples,shell,thiscall,inferred,objdump + caller inspection + local disassembly + smoothing correlation,4,"Late preview smoothing helper beneath the shell-side `PaintTerrain.win` family. The helper requires one interior preview-space `(x,y)` cell, gathers the surrounding preview-raster bytes from `[this+0x114]` in the local 3x3 neighborhood, repeatedly averages paired channel bytes through the fixed `0.5` weight at `0x005c8d48`, and then writes the resulting smoothed BGRA pixel back into the live preview raster. Current grounded caller is the final interior sweep at `0x004fb0f4` inside `shell_paint_terrain_window_rasterize_drag_path_preview_into_preview_surface` `0x004f8bb0`, which keeps this on the shell-side preview-smoothing family rather than the world-side terrain raster path.","objdump + caller inspection + local disassembly + smoothing correlation + preview-raster correlation"
0x004f8770,570,shell_paint_terrain_window_sample_weighted_average_rgb_from_preview_raster,shell,thiscall,inferred,objdump + caller inspection + local disassembly + color-sampling correlation,4,"Local color-sampling helper beneath the shell-side `PaintTerrain.win` family. The helper selects one source raster from the current path-preview buffer `[this+0x118]`, the top undo snapshot under `[this+0x118 + depth*4]`, or the live preview raster `[this+0x114]`, derives one bounded square neighborhood around the caller-supplied preview-space coordinates from scalar lane `[this+0xc4]`, and then accumulates distance-weighted red, green, and blue byte sums across every sampled pixel in that neighborhood. When the accumulated weight stays positive it normalizes those sums through `0x005a10d0` and returns the averaged RGB bytes through three caller-supplied output pointers. Current grounded callers are the two later mode-`9` preview branches at `0x004f9fde` and `0x004fc097`, which keeps this on the shell-side terrain color-sampling family rather than the world-side raster mutation path.","objdump + caller inspection + local disassembly + color-sampling correlation + preview-buffer correlation"
0x004f89b0,512,shell_paint_terrain_window_grow_component_on_byte_grid_from_seed,shell,cdecl,inferred,objdump + caller inspection + local disassembly + flood-fill correlation,4,"Local byte-grid component grower beneath the shell-side `PaintTerrain.win` family. The helper seeds the caller-supplied byte grid with state `2` at the requested `(x,y)` cell, repeatedly promotes reachable `2` cells to `3`, expands that frontier through the eight-neighbor offset tables `0x00624b28/0x00624b48`, and marks any newly reached byte-`1` cells as `2` while tracking the surviving min/max rectangle of the connected component. After the frontier exhausts it clears every remaining byte-`1` cell back to `0`, leaving only the grown component marked. Current grounded caller is the preview-raster rebuild worker `0x004fb76c`, which invokes this helper after quantizing one float seed point into preview-grid coordinates, so the safest current read is a local connected-component grower for the terrain preview mask rather than a generic world flood fill.","objdump + caller inspection + local disassembly + flood-fill correlation + byte-grid correlation"
0x004f8bb0,10800,shell_paint_terrain_window_rasterize_drag_path_preview_into_preview_surface,shell,thiscall,inferred,objdump + caller inspection + local disassembly + preview-raster correlation,4,"Primary path-preview compositor beneath the shell-side `PaintTerrain.win` family. The helper consumes the drag-sample strip rooted at `[this+0xf0/+0xf4/+0xf8]`, the current scalar or mode lanes `[this+0x8c/+0x90/+0x94/+0x98/+0xa0/+0xb4/+0xb8/+0xc0/+0xc4/+0xd8..+0xec]`, and several caller-supplied preview buffers, then derives one bounded preview-space rectangle, quantizes the current brush span into preview-space radii, and allocates several temporary float and byte grids for path blending. Within that bounded rectangle it evaluates multiple per-mode preview branches: some modes reuse the current terrain descriptor tables rooted at `0x005f3500`, later mode `9` branches call `shell_paint_terrain_window_sample_weighted_average_rgb_from_preview_raster` `0x004f8770`, one path grows connected regions through `shell_paint_terrain_window_grow_component_on_byte_grid_from_seed` `0x004f89b0`, and other branches sample the live world raster through `0x00448cb0`, `0x00448d40`, `0x00449ab0`, `0x0044a9a0`, and companion helpers before writing final RGBA pixels back into the caller preview surface. The late world-raster tail is tighter now too: the mode-`4`, variant-`2` branch toggles secondary-raster byte-2 bit `0x20` by comparing the current and previous cell records through `0x00534f40`; the broader mode-`4/5` branch samples class set `2/4/5` through `0x00534ec0`, re-enters `0x0044de30` and `0x0044df10`, latches pending world coordinates into `[0x006d1304+0x78/+0x7c]`, and updates the low nibble plus the signed overlay-vector planes through `0x00448df0`, `0x00448e20`, `0x00448ec0`, `0x00448ee0`, `0x00448e60`, and `0x00448e90`. After the optional mode-`5` smoothing sweep through `0x004f8370`, the publish tail either materializes one shell preview surface through `0x0051f090 -> 0x00534730` or, for the mode-`4/5` world-facing variants, converts the surviving preview rectangle back into world-space bounds and re-enters `0x0044e940`, `0x00452f20`, and `0x0044d410`. Current grounded caller is the fallback drag-path worker `0x004fcace` inside `shell_paint_terrain_window_append_drag_sample_and_rebuild_path_preview` `0x004fc630`, so the safest current read is the main drag-path preview rasterizer and compositor rather than a direct world brush.","objdump + caller inspection + local disassembly + preview-raster correlation + drag-path correlation + temporary-grid correlation + late-tail world-raster correlation"
0x004fb5e0,1603,shell_paint_terrain_window_rebuild_preview_raster_from_world_coords_and_settings,shell,thiscall,inferred,objdump + caller inspection + local disassembly + preview-surface correlation,4,"Large terrain-preview raster rebuild worker beneath the shell-side `PaintTerrain.win` family. The helper derives one temporary occupancy mask over the live world grid from the caller-supplied world coordinates, current brush or scalar settings, and the current terrain-mode family rooted at `[this+0x90/+0x94/+0x98/+0x9c/+0xac/+0xb0/+0xbc/+0xc0/+0xcc]`; depending on those settings it fills that mask through the live world samplers `0x00448c00`, `0x00448c20`, `0x00448cb0`, `0x00448d40`, `0x00448f30`, and the companion-float cell setter `0x0044dca0`, with one later mode-`5` neighborhood branch also forcing corner writes and a final full-rect rebuild through `0x0044e940`. After the mask pass it walks the current preview raster `[this+0x114]`, converts the selected world samples or current preview colors into RGBA pixels through several per-mode blend branches, and then republishes the rebuilt preview surface into the shared shell controller at `0x006d0818` through `0x0047b3d0`. The caller split is tighter now too: `0x004f726c` is the early rebuild branch that first copies the live preview raster into `[this+0x118]` and then immediately snapshots undo state through `0x004f5a80`, while `0x004f7ada` is the later drag-active branch that allocates a temporary occupancy mask before rebuilding and conditionally mirrors that mask into `0x00450520` on the world-mode-`0x17` side path. Current grounded callers are those two direct drag-path branches inside `shell_paint_terrain_window_handle_message` `0x004f6f50`, so the safest current read is the current terrain-preview raster builder rather than a direct world-terrain mutation owner.","objdump + caller inspection + local disassembly + preview-surface correlation + mask-build correlation + shell-surface publish correlation + callsite split correlation"
0x004fc280,592,shell_paint_terrain_window_apply_mode7_secondary_raster_bit0x10_brush_from_world_coords,shell,thiscall,inferred,objdump + caller inspection + local disassembly + secondary-raster correlation,4,"Mode-`7` drag worker beneath the shell-side `PaintTerrain.win` family. The helper derives a bounded radial neighborhood around the caller-supplied world coordinates from the current scalar lane `0x0062281c[index]`, then scans that neighborhood against the live secondary-raster bit-`0x10` predicate `world_secondary_raster_query_cell_byte2_bit0x10_set` `0x00448f30`. The desired state comes from `[this+0xac]`: when the live bit differs, the helper either sets or clears it through `world_secondary_raster_set_cell_byte2_bit0x10` `0x00448d90` or `world_secondary_raster_clear_cell_byte2_bit0x10` `0x00448dc0`. When any cell changed it republishes the surviving rectangle through `0x00452f20`. Current grounded caller is the mode-`7` drag branch at `0x004f797a` inside `shell_paint_terrain_window_handle_message` `0x004f6f50`, so the safest current read is the radius brush over secondary-raster bit `0x10` rather than a generic terrain sample helper.","objdump + caller inspection + local disassembly + secondary-raster correlation + radial-brush correlation"
0x004fc4d0,342,shell_paint_terrain_window_apply_mode6_compact_grid_mode3_brush_from_world_coords,shell,thiscall,inferred,objdump + caller inspection + local disassembly + compact-grid correlation,4,"Mode-`6` drag worker beneath the shell-side `PaintTerrain.win` family. The helper scales the caller-supplied world coordinates by the fixed brush factor at `0x005c8568`, derives one bounded radial neighborhood from the current scalar lane `0x00622800[index]`, and then scans that disk through `math_measure_float_xy_pair_distance` `0x0051dc00` plus compact-grid membership query `world_query_compact_grid_flag_bitset_membership_by_mode` `0x00448af0` with mode `3`. The desired bitset state is derived from `[this+0xb0]`; when the live compact-grid bit mismatches that desired state, the helper stamps the requested value back through `0x004497a0(world, x, y, desired, 3, 1)`. When any cell changed it republishes the surviving rectangle through `0x00452f20`. Current grounded caller is the mode-`6` drag branch at `0x004f799c` inside `shell_paint_terrain_window_handle_message` `0x004f6f50`, so the safest current read is the radius brush over compact-grid bank `3` rather than a direct float-grid painter.","objdump + caller inspection + local disassembly + compact-grid correlation + radial-brush correlation"
0x004fc630,1213,shell_paint_terrain_window_append_drag_sample_and_rebuild_path_preview,shell,thiscall,inferred,objdump + caller inspection + local disassembly + path-preview correlation,4,"Default drag-path worker beneath the shell-side `PaintTerrain.win` family for the terrain modes that do not route into the narrower mode-`6` or mode-`7` world brushes. The helper first measures radial distance from the cached brush center `0x00622844/0x00622848` through `0x0051db80`, rejects when the current point falls outside the active span gates, and then maintains the shell-side drag-path sample arrays rooted at `[this+0xf0..+0x118]`, including one optional whole-world nibble snapshot cached at `0x006d132c` through `world_secondary_raster_query_cell_byte2_low_nibble` `0x00448df0` for the current special mode families. After updating those path arrays it forwards the accumulated sample strip, current scalar and mode lanes, and the current preview buffers into `0x004f8bb0`, then mirrors the last accepted world coordinate back into `0x00622844/0x00622848`. Current grounded caller is the fallback drag branch at `0x004f79bb` inside `shell_paint_terrain_window_handle_message` `0x004f6f50`, so the safest current read is the shell-side drag-sample accumulator plus path-preview rebuild owner rather than a direct world mutation helper.","objdump + caller inspection + local disassembly + path-preview correlation + nibble-snapshot correlation"
0x004fcaf0,67,shell_paint_territory_window_select_ordinal_and_refresh_caption,shell,thiscall,inferred,objdump + message-owner inspection + caption-table correlation,4,"Small setter beneath the shell-side `PaintTerritory.win` family. The helper stores the requested ordinal in `[this+0x78]`, reads one caption value through table `0x00622854`, and formats that caption through `0x0051f070` and `0x00527de0` on presenter `0x006d4024`. Current grounded caller is the message owner `0x004fcd10`, where control band `0xbb81..0xbb87` forwards through this helper before the main refresh pass.","objdump + message-owner inspection + caption-table correlation + shell-presenter correlation"
0x004fcb40,51,shell_paint_territory_window_destroy,shell,thiscall,inferred,objdump + detail-manager teardown correlation,4,"Destructor-side wrapper for the shell-side `PaintTerritory.win` family. The helper restores vtable `0x005d1480`, re-enters the shared presenter-side destroy tail through `0x00523e20`, and when live world mode already equals `0x1e` it also replays `0x00453510` before tail-calling the common shell-object teardown `0x0053f7d0`. Current grounded caller is the detail-panel transition manager teardown branch at `0x004ddbd0`, which keeps this on the shell tool-window side rather than the later territory-access consumers.","objdump + detail-manager teardown correlation + world-mode branch correlation"
0x004fcb80,400,shell_paint_territory_window_refresh_control_bands,shell,thiscall,inferred,objdump + constructor correlation + message-owner inspection,4,"Owner-side refresh pass for the shell-side `PaintTerritory.win` family. The helper first restyles the seven ordinal controls `0xbb81..0xbb87` from `[this+0x78]` and the 24-entry territory row band `0xbb94..0xbbab` from `[this+0x80]`, then resolves the live territory collection at `0x006cfc9c` and republishes the dynamic-text rows `0xbbf8..0xbc0f` through the special type-`0x6f` control path. It derives the row label from territory name bytes near `[entry+0x04]`, derives the paired summary metrics from fields `[entry+0x3d]` and `[entry+0x41]`, and formats those metrics through the same numeric-text family `0x0051b700/0x005193f0` used by sibling tool windows. Current grounded callers are the constructor `0x004fcf30` and the message owner `0x004fcd10`, which makes this the current `PaintTerritory.win` refresh owner rather than a company-access refresh lane.","objdump + constructor correlation + message-owner inspection + dynamic-text control correlation + territory-collection correlation"
0x004fcd10,530,shell_paint_territory_window_handle_message,shell,thiscall,inferred,objdump + constructor correlation + caller inspection,4,"Primary message dispatcher for the shell-side `PaintTerritory.win` tool window. Under message `0xc8`, controls `0xbb94..0xbbab` update the current territory row in `[this+0x80]` and global `0x0062284c`, then route the world-side tool state through `0x00450520` when live world mode is `0x1e` or through `0x00452fa0` with mode id `0x1e` otherwise before re-entering `shell_paint_territory_window_refresh_control_bands` `0x004fcb80`. Controls `0xbb81..0xbb87` update the ordinal lane through `shell_paint_territory_window_select_ordinal_and_refresh_caption` `0x004fcaf0`, store the ordinal in global `0x00622850`, and refresh. Control `0x07d6` owns the shared world-surface latch `[this+0x7c]`; while that latch is live, the helper hit-tests through `0x00448ac0`, resolves the current ordinal value through table `0x00622854`, and forwards the staged world coordinates plus the current territory row through `0x0044a560` before mirroring the row pointer back through `0x00450520` or `0x00452fa0`. Current grounded owner correlation is the constructor `0x004fcf30` and the live shell message loop, which keeps this on the `PaintTerritory.win` side of the shared world-surface family rather than the company-detail territory-access dispatcher.","objdump + constructor correlation + caller inspection + world-surface latch correlation + tool-state dispatch correlation"
0x004fcf30,224,shell_paint_territory_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `PaintTerritory.win` tool window. The constructor installs vtable `0x005d1480`, binds `PaintTerritory.win` through `0x0053fa50`, seeds the current ordinal and the paired scalar or selection lane from globals `0x0062284c..0x00622854`, refreshes the visible selection band through `0x004fcb80`, and then routes the initial world-side tool state through `0x00450520` or `0x00452fa0` with world-mode constant `0x1e`. Current grounded caller is the detail-panel manager branch at `0x004ddf86`, which keeps this on the shell tool-window side rather than the later territory-access and company-governance families.","objdump + strings + detail-manager correlation + singleton correlation + tool-state dispatch correlation"
0x0050a570,104,shell_stock_buy_window_render_selected_company_stock_data_panel,shell,thiscall,inferred,objdump + local disassembly + constructor correlation,3,"Control callback beneath the shell-side `StockBuy.win` family that renders the selected-company stock-data panel through the shared formatter `0x004c0160`. The helper first validates current selected company id `0x00622b00` against company-count query `0x00429a50`, then forwards that selected company together with the cached panel roots `0x006d19dc/0x006d19e0`, the holdings-name table `0x006d1748`, and toggle byte band `0x00622b04` into the stock-data formatter using localized token `0x3e4e`. Current grounded owner correlation is the `StockBuy.win` constructor `0x0050c290`, which wires this helper into control `0x3aa0`.","objdump + local disassembly + constructor correlation + stock-data formatter correlation + selected-company correlation"
0x0050a5e0,29,shell_stock_buy_window_invalidate_selected_company_summary_control_unconditionally,shell,cdecl,inferred,objdump + constructor correlation + local disassembly,3,"Tiny invalidation callback under the shell-side `StockBuy.win` family. The helper re-enters the shared shell tick `0x00563250` and then unconditionally republishes the standard shell invalidation triple `(0x3b60, 0x3e7f, 0)` through `0x0053fe00` using the live window singleton at `0x006d19f0`. Current grounded owner correlation is the constructor-side callback wiring at `0x0050ba9f`, which binds this helper to control `0x3a9a` with selector `0x83`, so this is the cleanest current selected-company summary invalidation callback rather than a post-trade helper.","objdump + constructor correlation + local disassembly + control-0x3a9a correlation + summary-invalidation correlation"
0x0050a600,93,shell_stock_buy_window_buy_confirmation_modal_tutorial_gate_callback,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Small callback-driven tutorial gate beneath the shell-side `StockBuy.win` buy-confirmation modal. The helper only intercepts shell message `0xcb` on control `0x03f4`; when that exact button path fires while tutorial flag `0x006d3b4c` is live, it opens one sibling shell modal rooted at localized id `0x0e8c` through `0x005193f0 -> 0x004c98a0` and returns `0`. All other message or control combinations return `1` immediately. Current grounded owner correlation is the local stock-buy dispatcher `0x0050bbe0`, which pushes this helper as the callback argument when it opens the buy-side confirmation modal rooted at localized id `0x0292`.","objdump + caller inspection + local disassembly + modal-callback correlation + tutorial-flag correlation"
0x0050a660,10,shell_stock_buy_window_set_selected_chairman_row_index,shell,cdecl,inferred,objdump + caller inspection,3,"Tiny setter under the shell-side `StockBuy.win` family. The helper stores the caller-supplied row index directly into global `0x006d19f4`, which the window constructor `0x0050c290` and later refresh paths use as the current selected chairman-row lane. Current grounded caller `0x004e017e` derives that row index through `0x00477920` from one player-list profile id before publishing it here, so this is the cleanest current raw selected-row setter for `StockBuy.win`.","objdump + caller inspection + selected-row correlation"
0x0050a670,33,shell_stock_buy_window_refresh_if_live,shell,cdecl,inferred,objdump + caller inspection,3,"Small refresh-if-live wrapper for the shell-side `StockBuy.win` singleton rooted at `0x006d19f0`. The helper first re-enters the shared shell state tick `0x00563250`, then when the window object is live it republishes the standard shell invalidation triple `(0x3b60, 0x3e7f, 0)` through `0x0053fe00`. Current grounded callers are the buy and sell chairman-profile mutation helpers `0x00477110` and `0x00476460`, so this is the clearest current post-trade refresh hook for the live stock-buy window rather than a general finance-panel redraw.","objdump + caller inspection + singleton correlation + post-trade refresh correlation"
0x0050a6a0,33,shell_stock_buy_window_invalidate_after_local_trade_message_branch,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Unconditional invalidation sibling beneath the shell-side `StockBuy.win` family. The helper mirrors the same shell tick `0x00563250` and standard invalidation triple `(0x3b60, 0x3e7f, 0)` used by `0x0050a670`, but it does not first guard on the live-window singleton. Current grounded callers are the two local trade message branches at `0x0050bddf` and `0x0050bf8b`, immediately after they commit rounded buy or sell blocks through `0x00477110` and `0x00476460`, so this is the clearest current unconditional refresh hook for the in-window trade path.","objdump + caller inspection + local disassembly + local-trade correlation + summary-invalidation correlation"
0x0050a6d0,86,shell_stock_buy_window_publish_selected_company_or_none_and_refresh_affordance,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Publishes one selected company id into the shell-side `StockBuy.win` family and refreshes the paired availability affordance. The helper compares the caller-supplied company id against current company-count query `0x00429a50`; valid ids are stored into global `0x00622b00`, while out-of-range ids collapse to `-1`. It then maps that validity test onto control-style selector `0x6d/0x86`, republishes control `0x3a9b` through `0x00540120`, and invalidates the same `StockBuy.win` shell triple through `0x0053fe00`. Current grounded callers are the player-list handoff at `0x004e01a0`, the stock-buy window bring-up tail at `0x0050ba0a`, and the local buy/sell selection branches at `0x0050c013/0x0050c037`, so this is the clearest current selected-company publisher beneath `StockBuy.win`.","objdump + caller inspection + local disassembly + selected-company correlation + affordance refresh correlation"
0x0050a730,757,shell_stock_buy_window_refresh_profile_rows_and_metric_cards,shell,thiscall,inferred,objdump + local disassembly + constructor correlation,3,"Broad refresh owner for the shell-side `StockBuy.win` profile-row and metric-card surface. The helper iterates the active chairman-profile collection through `0x00477820/0x00477860`, lays out the selected row and the remaining visible row cards using the cached widget roots at `0x006d19d8`, `0x006d19dc`, `0x006d19e8`, and `0x006d19ec`, formats persona or name labels through `0x00476bb0` and `0x0053de00`, and pulls the currently grounded chairman metric lanes through `0x00476320`, `0x00476780`, and `0x00476c20`. The same pass also formats selected-company ownership text and several numeric card values before publishing them into the live `StockBuy.win` widget tree. Current grounded owner correlation is the `StockBuy.win` constructor `0x0050c290`, which wires this function into the control family as one of the primary refresh callbacks.","objdump + local disassembly + constructor correlation + active-profile correlation + metric-card correlation"
0x0050ae50,1810,shell_stock_buy_window_render_selected_company_summary_panel,shell,thiscall,inferred,objdump + local disassembly + constructor correlation,3,"Broad renderer for the selected-company summary panel beneath the shell-side `StockBuy.win` family. The helper resolves the current selected company through `0x00518140(0x0062be10, company_id)`, resolves the currently selected chairman row through `0x00477860(0x006ceb9c, 0x006d19f4)`, chooses one of the cached panel roots at `0x006d19e8/0x006d19ec`, and then formats a large mixed text-plus-metric surface using company-side share and stock helpers such as `0x00423eb0`, `0x00426b10`, and `0x00426ef0` together with localized ownership-status ids `0x0e0d/0x0e0e/0x0e0f`. Current grounded owner correlation is the `StockBuy.win` constructor `0x0050c290`, which binds this body to control `0x3a9a` with selector `0x7a`, so the safest current read is the main selected-company summary renderer rather than another narrow status-line helper.","objdump + local disassembly + constructor correlation + selected-company correlation + summary-panel correlation"
0x0050b910,216,shell_stock_buy_window_publish_selected_company_ownership_status_line,shell,thiscall,inferred,objdump + local disassembly + constructor correlation,3,"Publishes one selected-company ownership or status line for the shell-side `StockBuy.win` family. The helper first validates current selected company id `0x00622b00` against company-count query `0x00429a50`, resolves the live company record through `0x00429a90`, and then formats one of three localized text records `0x0e10`, `0x0e11`, or `0x0e12` depending on company owner field `[company+0x3b]` relative to the currently selected chairman id `[0x006cec78+0x25]`. When the company has an owning profile it also queries that owner label through `0x00426ef0` and appends the company display name from `[company+0x04]` before publishing the final line through shell presenter `0x00538c70`. Current grounded owner correlation is the `StockBuy.win` constructor `0x0050c290`, which wires this helper into the live control family.","objdump + local disassembly + constructor correlation + selected-company correlation + ownership-status correlation"
0x0050ba00,57,shell_stock_buy_window_refresh_selected_company_summary_tail,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Internal summary-refresh tail beneath the shell-side `StockBuy.win` family. The helper republishes current selected company id `0x00622b00` through `shell_stock_buy_window_publish_selected_company_or_none_and_refresh_affordance` `0x0050a6d0`, invalidates the standard `StockBuy.win` shell triple through `0x0053fe00`, and then republishes companion control `0x3a9a` through `0x00540120` with fixed selector `0x8b`. Current grounded callers are the mode-`0x0b` stock-buy refresh wrapper `0x0050c130` and the broader company-selection setter `0x0050c470`, so this is the clearest current shared refresh tail for the selected-company summary pane.","objdump + caller inspection + local disassembly + selected-company correlation + summary-pane correlation"
0x0050bac0,293,shell_stock_buy_window_destroy,shell,thiscall,inferred,objdump + local disassembly + constructor correlation,4,"Destructor for the shell-side `StockBuy.win` family rooted at `0x006d19f0`. The helper restores vtable `0x005d18f0`, releases the cached widget or selector roots at `0x006d19d8..0x006d19ec` through `0x0053c000`, walks the live company collection under `0x006d4020+0x429b4` to release the per-company stock-data handles cached in `0x006d1748`, invalidates the standard shell triple `(0x3b60, 0x3e7f, 0)` plus the stock-data control `0x3e4e`, clears singleton `0x006d19f0`, and then tails into the common shell-object teardown `0x0053f7d0`. This is the clear destructor-side counterpart to `shell_stock_buy_window_construct` `0x0050c290`.","objdump + local disassembly + constructor correlation + singleton correlation + destructor correlation"
0x0050bbe0,1357,shell_stock_buy_window_handle_message,shell,thiscall,inferred,objdump + local disassembly + constructor correlation,4,"Primary message dispatcher for the shell-side `StockBuy.win` family. Under message `0xcb`, controls `0x3aa1..0x3aa3` wrap the selected company id in `0x00622b00` across the live company count, controls `0x3d54..0x3db7` select one company row through `0x004299f0` and then re-enter `shell_stock_buy_window_publish_selected_company_or_none_and_refresh_affordance` `0x0050a6d0`, controls `0x3afc..0x3b5f` select one chairman row into `0x006d19f4` and mirror that chosen profile back into the live scenario-selected chairman path when world-mode gates allow it, and controls `0x3aad..0x3ab2` write one incoming byte straight into the toggle band `0x00622b04..0x00622b09`. Under message `0xca`, the buy row band `0x3c8c..0x3cef` resolves one company slot, optionally raises tutorial or confirmation modals, and on success commits the rounded buy through `0x00477110` before re-entering `0x0050a6a0`; the sell row band `0x3cf0..0x3d53` mirrors the same pattern through `0x00476460`; and control `0x3a9a` routes into the same shared summary family beside `0x0050ba00`. Current grounded owner correlation is the constructor `0x0050c290`, which wires the surrounding control family onto this dispatcher.","objdump + local disassembly + constructor correlation + control-band correlation + buy-sell row correlation + selected-company correlation"
0x0050c130,21,shell_stock_buy_window_refresh_if_detail_panel_mode_0x0b_is_active,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Small shell-side refresh wrapper for the live `StockBuy.win` detail-panel mode `0x0b`. The helper re-enters the shared shell state tick `0x00563250`, and when singleton `0x006d19f0` is live it jumps into the broader stock-buy refresh tail at `0x0050ba00` instead of returning directly. Current grounded callers are the two mode-sensitive shell refresh wrappers at `0x0043609f` and `0x00436139`, both of which first verify that the detail-panel manager `0x006d0818` is currently in mode `0x0b`.","objdump + caller inspection + local disassembly + detail-panel-mode correlation + stock-buy refresh correlation"
0x0050c150,155,shell_stock_buy_window_apply_payload_buy_rounded_company_block,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Applies one payload-driven buy transaction beneath the shell-side `StockBuy.win` family. The helper treats payload dwords `[this+0x00]` and `[this+0x04]` as chairman-profile id and company id, resolves the live chairman record through `0x00518140`, derives the rounded buy block through `0x00476e50(company_id,1)`, optionally emits the local selected-chairman shell cue through `0x0045ea20(0x36,1.0)` plus `0x0053f000(1,0,0)`, and then commits the transaction through `0x00477110(company_id, block, 1, 0)`. The tail re-enters the shared shell tick `0x00563250` and refresh path through `0x0053fe00` when the `StockBuy.win` singleton at `0x006d19f0` is still live. Current grounded callers are the multiplayer selector wrapper `0x0046c9f0` and the local stock-buy message family, so this is the clearest current payload-side rounded buy-block commit owner.","objdump + local disassembly + caller inspection + rounded-trade correlation + shell-cue correlation"
0x0050c1f0,155,shell_stock_buy_window_apply_payload_sell_rounded_company_block,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Applies one payload-driven sell transaction beneath the shell-side `StockBuy.win` family. The helper treats payload dwords `[this+0x00]` and `[this+0x04]` as chairman-profile id and company id, resolves the live chairman record through `0x00518140`, derives the rounded sell block through `0x00476e50(company_id,0)`, optionally emits the local selected-chairman shell cue through `0x0045ea20(0x37,1.0)` plus `0x0053f000(1,0,0)`, and then commits the transaction through `0x00476460(company_id, block, 1, 0)`. The tail mirrors the same shared shell tick `0x00563250` and refresh path through `0x0053fe00` used by the buy-side sibling `0x0050c150`. Current grounded callers are the multiplayer selector wrapper `0x0046ca10` and the local stock-buy message family, so this is the clearest current payload-side rounded sell-block commit owner.","objdump + local disassembly + caller inspection + rounded-trade correlation + shell-cue correlation"
0x0050c290,624,shell_stock_buy_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `StockBuy.win` family. The constructor installs vtable `0x005d18f0`, binds `StockBuy.win` plus the companion `GameWindow.imb` resource through `0x0053d110` and `0x0053fa50`, seeds live singleton `0x006d19f0`, scans the chairman-profile collection at `0x006ceb9c` to identify the currently selected chairman index in `0x006d19f4`, seeds several cached list or selector handles at `0x006d19d8..0x006d19ec`, and wires the control family through callbacks such as `0x0050a730`, `0x0050a570`, and `0x0050b910`. Current grounded caller is the detail-panel manager branch at `0x004ddeaa`, which keeps this on the shell finance/detail side rather than the company-detail action dispatcher itself.","objdump + strings + detail-manager correlation + collection-scan correlation + control-wiring correlation + singleton correlation"
0x0050c470,103,shell_stock_buy_window_clamp_selected_company_and_rebuild_summary,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Clamps the current selected company id for the shell-side `StockBuy.win` family and rebuilds the selected-company summary pane. The helper validates global company id `0x00622b00` against company-count query `0x00429a50`, stores the clamped id back into that same global, republishes control `0x3a9b` through `0x00540120`, invalidates the standard shell triple through `0x0053fe00`, and then re-enters the shared summary-refresh tail `0x0050ba00`. Current grounded owner correlation is the same local stock-buy refresh family rooted at `0x0050c290`; the helper is also the strongest current direct caller of `0x0050ba00`.","objdump + local disassembly + caller inspection + selected-company correlation + summary-refresh correlation"
0x0050c4e0,19,shell_store_ten_dword_chairmanship_takeover_vote_bitmap_state,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Tiny cache setter for local chairmanship-takeover vote bitmap state rooted at `0x006d1a08`. The helper copies exactly ten dwords from the caller-supplied buffer into that global block. Current grounded caller is multiplayer selector body `0x00471fd0`, which builds two ten-slot bitmap arrays from selector-`0x4b` payload bytes `[+0x04]`, `[+0x05]`, and bitmask dword `[+0x06]` before forwarding the resulting block here immediately ahead of `shell_resolve_chairmanship_takeover_vote_and_commit_outcome` `0x0050c940`.","objdump + caller inspection + local disassembly + selector-0x4b correlation + takeover-vote-state correlation"
0x004dfd70,57,shell_game_window_destroy,shell,thiscall,inferred,objdump + strings + caller xrefs,4,"Destructor for the shell-side `Game.win` detail window rooted at `0x006d0818`. It restores vtable `0x005d0eb8`, clears the singleton global, releases the child panel or selector object stored at `[this+0x8c]` through `0x004dd950`, and then tails into the common shell object destructor path. `shell_transition_mode` now uses this as the old-mode teardown branch when leaving mode `1`.","objdump + strings + caller xrefs + destructor correlation"
0x004dfdf0,84,shell_ensure_game_message_window,shell,cdecl,inferred,objdump + strings,4,Ensures the standalone GameMessage.win shell object rooted at 0x006d081c exists. When absent it allocates a 0x94-byte window object seeds the vtable at 0x005d0ed0 binds the GameMessage.win resource through 0x0053fa50 stores the result in 0x006d081c and publishes the object to the shell runtime through 0x00538e50.,objdump + strings + caller xrefs
0x004e0210,1217,game_message_window_service_frame,shell,thiscall,inferred,objdump + strings,4,Per-frame service pass for the GameMessage.win object rooted at 0x006d081c. It walks up to seven active message or notification records from the collection at 0x006acd34 populates the window slots around ids 0x8ca8 and neighboring controls chooses icon and portrait assets such as Portrait.imb note.imb smiley.imb and smalleye.imb maps selected message records into shell and world collections including 0x006ceb9c 0x0062be10 0x0062b26c and 0x0062bae0 and updates the visible action entries through repeated 0x00540120 calls. Current grounded caller is the simulation frame path through 0x004e0720.,objdump + strings + caller xrefs
0x004e0720,15,game_message_window_service_if_present,shell,cdecl,inferred,objdump + caller xrefs,4,Services the GameMessage.win branch only when the global object at 0x006d081c is live by tail-calling game_message_window_service_frame. The current grounded caller is simulation_frame_accumulate_and_step_world which keeps this world-facing message overlay inside the shell-owned recurring frame cadence.,objdump + caller xrefs
0x004e0780,468,game_uppermost_window_service_world_hotspot_band,shell,thiscall,inferred,objdump + strings + caller xrefs,4,Per-frame world-facing hotspot service for the GameUppermost.win overlay rooted at 0x006d0820. The helper clears the previously latched hotspot id at [this+0x78] when the shell runtime selection changes then requires an active world-mode branch at [0x006cec74+0x114] a live shell runtime node at [0x006d401c+0xc6d] an unobscured controller view through 0x00543e20 and 0x00543e40 and one selected control id in the narrow band 0x7918 through 0x7921. It rate-limits repeats through the runtime timestamp at [selected+0xd2] remaps the two rightmost ids onto the sibling left-side base actions 0x791c and 0x791e rechecks shell_input_cursor_inside_active_view at 0x0054f540 scales one table-driven coordinate pair from 0x006066c8 and 0x006066e8 and finally pushes that world-relative offset into the live world owner at 0x0062be68 through 0x0043d130. Current grounded caller is game_uppermost_window_handle_message at 0x004e0ba0.,objdump + strings + caller xrefs
0x004e0960,432,game_uppermost_window_refresh_controls,shell,thiscall,inferred,objdump + strings + caller xrefs,4,Refreshes the visible control state for the GameUppermost.win overlay at 0x006d0820. The helper repopulates the hotspot control band 0x7918 through 0x7921 through repeated 0x00540120 calls chooses one of two layout or visibility selectors based on the active world-mode state under 0x006cec74 and resolves the localized label `Hide Bottom Interface (Toggle)` for control 0x7923 before publishing it back into the window tree. Grounded callers include the overlay constructor at 0x004e0b20 the overlay message handler at 0x004e0ba0 and a later world-mode state-change branch at 0x004ff3f5.,objdump + strings + caller xrefs
0x004e0b20,118,game_uppermost_window_construct,shell,thiscall,inferred,objdump + strings + caller xrefs,4,Constructs the GameUppermost.win overlay object later stored at 0x006d0820. The helper seeds the vtable at 0x005d0f3c binds the GameUppermost.win resource through 0x0053fa50 registers the shared control callback at 0x004e0a70 for ids 0x7918 through 0x7921 refreshes the initial control state through game_uppermost_window_refresh_controls and initializes sibling control 0x7922 before returning the live overlay object. The ensure helper at 0x004e0e40 is the current grounded caller.,objdump + strings + caller xrefs
0x004e0ba0,95,game_uppermost_window_handle_message,shell,thiscall,inferred,objdump + strings + caller xrefs,4,Message dispatcher for the GameUppermost.win overlay object. It seeds one visual-speed field on the command object returned by 0x0053f830 then switches on the incoming message id through the local jump table at 0x004e0d04. The current grounded cases call game_uppermost_window_service_world_hotspot_band during the recurring service path refresh the overlay controls through game_uppermost_window_refresh_controls on a sibling state-change path and route control 0x7922 into the world-mode toggle helper at 0x004349f0 which also updates the same overlay object at 0x006d0820.,objdump + strings + caller xrefs
0x004e0e40,75,shell_ensure_game_uppermost_window,shell,cdecl,inferred,objdump + strings + caller xrefs,4,Ensures the world-facing GameUppermost.win overlay rooted at 0x006d0820 exists. When absent it allocates a 0xae-byte window object constructs it through game_uppermost_window_construct at 0x004e0b20 stores the result globally and publishes it through the shell runtime at 0x006d401c via 0x00538e50. A grounded caller sits in the shell_transition_mode path near 0x004831c0 immediately after the GameMessage.win bring-up branch which ties this overlay to world-mode entry rather than generic shell UI.,objdump + strings + caller xrefs
0x004fe120,14,shell_has_settings_window,shell,cdecl,inferred,objdump,4,Returns whether the shared settings window object rooted at 0x006d1350 is currently live. The fileopt settings escape branch and direct shell command wrappers both gate on this before opening SettingsWindow.win again.,objdump + caller xrefs
0x004fe130,11,shell_mark_settings_window_dirty,shell,cdecl,inferred,objdump + global-state inspection + frame-caller inspection,4,"Tiny dirty-latch setter paired with `shell_has_settings_window`. The helper stores `1` into `0x006d1360`, which current nearby call patterns treat as the `SettingsWindow.win` refresh or service request latch once the live settings singleton at `0x006d1350` exists. Current grounded callers include the post-step shell-window service ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, and the same latch is also cleared during settings-window open or rebuild paths near `0x00501e50`.","objdump + global-state inspection + frame-caller inspection + settings-window open-path correlation"
0x004fd730,415,shell_settings_window_refresh_miscellaneous_input_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation,3,"Refreshes the later `Miscellaneous` page selected by page index `11` in the `SettingsWindow.win` category table. The helper first republishes container controls `0x7546`, `0x7547`, `0x7593`, `0x7594`, `0x759f`, and `0x75a0`, installs four option labels from the paired localized-id table `0x006228d8/0x006228dc` into control `0x7546`, clamps shell field `[0x006cec74+0x10c]` into the visible selector slot for that same control, then mirrors additional shell and world fields through controls `0x7547`, `0x7593`, `0x7594`, `0x759f`, and `0x75a0` using the current values at `[0x006d4024+0x1146d7]`, `[0x006cec74+0x283]`, `[0x006cec74+0x28b]`, `[0x006cec74+0x311]`, and `[0x006cec74+0x315]`. The exact player-facing semantics of those fields are still open, but the page ownership and control strip are now grounded.","objdump + local disassembly + settings-window page correlation + control-strip correlation"
0x004fd8d0,104,shell_settings_window_refresh_sandbox_options_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Sandbox Options` page selected by page index `12` in the `SettingsWindow.win` category table. The helper republishes container control `0x759e`, installs five localized option labels from `0x00622a08` into that control, and mirrors the current world-side selector from `[0x006d4024+0x11474e]` back into the visible selection slot. This is the current direct page-refresh owner for the page rooted at localized id `0x55d` `Sandbox Options`, even though the deeper semantics of the underlying selector values are still open.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + selector-mirror correlation"
0x004fd940,223,shell_settings_window_refresh_dialogs_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Dialogs` page selected by page index `10` in the `SettingsWindow.win` category table. The helper republishes controls `0x7545` and `0x758c..0x7590`, mirrors one shell scalar from `[0x006cec74+0xf8]` into control `0x7545`, and then writes the five dialog-toggle booleans derived from shell fields `[0x006cec74+0x26b]`, `[+0x26f]`, `[+0x273]`, `[+0x277]`, and `[+0x27b]` into controls `0x758c` through `0x7590`. This is therefore the direct dialogs-page refresh owner rather than a generic checkbox helper.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + toggle-band correlation"
0x004fda20,368,shell_settings_window_refresh_gameplay_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,3,"Refreshes the `Gameplay` page selected by page index `0` in the `SettingsWindow.win` category table. The helper republishes container controls `0x7548`, `0x7591`, `0x7592`, `0x7599`, `0x759c`, and `0x7544`, installs six option labels from `0x006228f8` into control `0x7548` and three paired labels from `0x00622910/0x00622914` into control `0x7591`, then mirrors several current shell or world values through those controls from `[0x006cec74+0xf4]`, `[+0x22f]`, `[+0x263]`, `[+0x2cc]`, `[+0x309]`, `[+0x0a8]`, and `[0x006d4024+0x114742]`. The exact gameplay-setting meanings of the individual fields are still open, but the page ownership and control strip are now grounded.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + control-strip correlation"
0x004fdb90,480,shell_settings_window_refresh_sound_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Sound` page selected by page index `1` in the `SettingsWindow.win` category table. The helper first queries the active sound backend through `0x005314b0`; when no backend is available it disables the main controls `0x7534` and `0x753f`. On the live-backend path it republishes control families `0x7551` and `0x754f`, enumerates six backend labels from `0x006229e4`, mirrors one backend selection through `0x00531640/0x005316d0`, installs the localized sample-rate or quality label rooted at id `0x584`, and then writes the derived backend scalar or enable state back into the visible controls. This is now the direct sound-page refresh owner rather than an unnamed backend probe loop.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + audio-backend correlation"
0x004fd550,250,shell_settings_window_refresh_draw_distance_companion_controls,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + localized-label correlation,4,"Refreshes the companion selector strip beneath the main `Draw Distance` page choice. The helper republishes controls `0x7566`, `0x7596`, `0x7560`, `0x7562`, and `0x7564`, then mirrors the current shell graphics-option slots selected through `0x00484ae0(8)`, `0x00484ae0(0x0d)`, `0x00484ae0(7)`, and `0x00484ae0(9)` back into those controls. The `0x7566` label family uses the localized quality table rooted at ids `0x578..0x57d` plus `0x269`, and control `0x7596` shows the inverted small scalar `4 - option(0x0d)`. Current grounded caller is `shell_settings_window_refresh_draw_distance_page` `0x004feb20`, and the local graphics-selector callback strip also re-enters this helper, so the safest current read is the draw-distance companion-control refresh owner rather than a generic selector helper.","objdump + local disassembly + settings-window page correlation + localized-label correlation + selector-mirror correlation"
0x004fd650,211,shell_settings_window_refresh_textures_companion_controls,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + selector-mirror correlation,4,"Refreshes the companion selector strip beneath the main `Textures` page choice. The helper republishes controls `0x756e`, `0x756a`, `0x756c`, and `0x7570`, then mirrors the current shell graphics-option slots selected through `0x00484ae0(6)`, `0x00484ae0(4)`, `0x00484ae0(5)`, and `0x00484ae0(3)` into those visible controls. Current grounded caller is the textures-side selector callback path immediately below the settings dispatcher, so this is the strongest current read for the textures companion-control refresh helper rather than a generic selector mirror.","objdump + local disassembly + settings-window page correlation + selector-mirror correlation"
0x004fe770,490,shell_settings_window_refresh_graphics_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the top-level `Graphics` page selected by page index `2` in the `SettingsWindow.win` category table. The helper mirrors world byte `[0x006d4024+0x114226]` into control `0x7554`, probes the graphics backend rooted at `0x00ccbb20` through `0x0053ef60` and `0x0053ef70` to derive the availability state for controls `0x757c` and `0x759a`, mirrors shell field `[0x006cec74+0x2c3]` into control `0x7595`, mirrors world dword `[0x006d4024+0x114206]` into control `0x7556`, conditionally formats the graphics-range fields through `0x0051fd40` and `0x0051fd60` into controls `0x7555` and `0x7578` when graphics mode byte `[0x006d4024+0x114226]` is nonzero, and then installs six localized labels from `0x00622964` into control `0x7557` plus the current selector derived from `0x00484ae0(0)`. This is therefore the direct graphics-page refresh owner rather than a generic backend capability probe.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + graphics-backend correlation"
0x004fe960,446,shell_settings_window_refresh_model_detail_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Model Detail` page selected by page index `3` in the `SettingsWindow.win` category table. The helper installs five localized labels from `0x00622940` into control `0x755a` and mirrors the current selector derived from `0x00484ae0(0x0a)` into that control, installs four localized labels from `0x00622954` into control `0x755b` and mirrors the selector from `0x00484ae0(0x0b)`, conditionally republishes control `0x7558` from world float `[0x006d4024+0x1146b9]` when the graphics-mode byte `[0x006d4024+0x114226]` is nonzero, mirrors world byte `[0x006d4024+0x1146eb]` into control `0x755c`, mirrors world byte `[0x006d4024+0x1146e9]` into control `0x755d`, mirrors world dword `[0x006d4024+0x114697]` into control `0x755e`, and republishes the shared six-label family at `0x7557` through the local companion helper `0x004fe4c0`. This is therefore the direct model-detail-page refresh owner rather than another generic graphics helper.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + selector-family correlation"
0x004fe4c0,560,shell_settings_window_rebuild_custom_resolution_list_control,shell,thiscall,inferred,objdump + local disassembly + settings-window callback correlation + string-format inspection,4,"Rebuilds the custom-resolution list control `0x7553` used by the graphics-side settings family. The helper clears the list, walks the live display-mode table rooted at `[0x006d4024+0x34]` with count `[+0x30]` through `0x0051f830`, filters modes to the bounded range `640x480 .. 1600x1200`, deduplicates repeated width-height pairs unless the earlier retained mode uses a non-`0x20` third lane, formats the surviving entries through the literal `%1x%2` at `0x005d14b0`, appends them to control `0x7553`, and finally mirrors the selected row index back into field `0x66`. Current grounded dispatcher-side caller is the graphics/custom-resolution settings branch at `0x004ffbdc`, which first persists the display-runtime block through `0x0051eea0` and then re-enters this helper. This is therefore the custom-resolution list rebuild owner rather than a generic mode-enumerator.","objdump + local disassembly + settings-window callback correlation + string-format inspection + display-mode-table correlation"
0x004fe6f0,53,shell_settings_window_refresh_draw_distance_primary_selector,shell,thiscall,inferred,objdump + local disassembly + settings-window callback correlation,4,"Small selector-mirror helper for the main `Draw Distance` control `0x755f`. The helper reads shell graphics option slot `1` through `0x00484ae0`, remaps non-`-1` selections through the compact table at `0x00622990`, and republishes the resulting visible selector index into field `0x66` on control `0x755f`. Current grounded caller is the graphics-settings callback branch at `0x004ff1f3` immediately after `shell_set_graphics_option_with_fanout` stores option `9`, so this is the draw-distance primary-selector refresh sibling rather than a generic table lookup.","objdump + local disassembly + settings-window callback correlation + selector-remap correlation"
0x004fe730,53,shell_settings_window_refresh_textures_primary_selector,shell,thiscall,inferred,objdump + local disassembly + settings-window callback correlation,4,"Small selector-mirror helper for the main `Textures` control `0x7569`. The helper reads shell graphics option slot `2` through `0x00484ae0`, remaps non-`-1` selections through the same compact table at `0x00622990`, and republishes the resulting visible selector index into field `0x66` on control `0x7569`. Current grounded caller is the neighboring graphics-settings callback branch at `0x004ff30c` immediately after `shell_set_graphics_option_with_fanout` stores option `3`, so this is the textures primary-selector refresh sibling rather than a generic table lookup.","objdump + local disassembly + settings-window callback correlation + selector-remap correlation"
0x004feb20,176,shell_settings_window_refresh_draw_distance_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Draw Distance` page selected by page index `4` in the `SettingsWindow.win` category table. The helper installs the shared six-label selector family from `0x00622964` into control `0x755f`, mirrors the current selector derived from `0x00484ae0(1)` into that control, re-enters `0x004fd550` for the paired companion refresh, and mirrors world byte `[0x006d4024+0x1146b8]` into control `0x7568`. This is now the direct draw-distance-page refresh owner rather than a generic selector helper.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + selector-family correlation"
0x004febd0,112,shell_settings_window_refresh_textures_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Textures` page selected by page index `5` in the `SettingsWindow.win` category table. The helper installs the shared six-label selector family from `0x00622964` into control `0x7569`, mirrors the current selector derived from `0x00484ae0(2)` into that control, and re-enters `0x004fe730` to republish the compact visible selector state. This is now the direct textures-page refresh owner rather than another generic selector helper.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + selector-family correlation"
0x004fdd70,432,shell_settings_window_refresh_graphics_misc_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation,3,"Refreshes the first `Miscellaneous` page selected by page index `6` in the `SettingsWindow.win` category table. The helper republishes control families `0x7573` and `0x7574`, installs three paired localized option rows from ids `0xe18..0xe1d`, mirrors one world selector from `[0x006d4024+0x114736]`, mirrors another from `[0x006d4024+0x1146b3]`, compares world float `[0x006d4024+0x1146af]` against the fixed threshold at `0x005c8628`, mirrors world byte `[0x006d4024+0x1146a8]`, mirrors world byte `[0x006d4024+0x1146e3]`, and finally mirrors one shell-side gate derived through `0x00484af0(0x0c)` into control `0x7586`. The exact player-facing names of those toggles remain open, but the page ownership and world-field strip are now grounded.","objdump + local disassembly + settings-window page correlation + control-strip correlation + world-field correlation"
0x004fdf20,164,shell_settings_window_refresh_scrolling_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Scrolling` page selected by page index `8` in the `SettingsWindow.win` category table. The helper mirrors four shell-side scalar settings from `[0x006cec74+0x114]`, `[+0x118]`, `[+0x11c]`, and `[+0x120]` into controls `0x757d`, `0x757f`, `0x7581`, and `0x7584`, and then mirrors the boolean companion derived from `[0x006cec74+0x120]` into control `0x7585`. This is therefore the direct scrolling-page refresh owner rather than a generic slider helper.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + shell-scalar correlation"
0x004fdfd0,421,shell_settings_window_refresh_camera_controls_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Camera Controls` page selected by page index `9` in the `SettingsWindow.win` category table. The helper republishes control families `0x7587` and `0x7588`, installs twenty-five localized labels from `0x00620dd8` into control `0x7587`, mirrors the current shell-side selector from `[0x006cec74+0x233]` plus companion `[+0x237]` back into that control, then installs ten localized labels `0x0a9f..0x0aa8` from `0x00620e3c` into control `0x7588` and mirrors the paired shell-side selector from `[0x006cec74+0x23b]` plus companion `[+0x23f]`. The current label tables now ground `0x7587` as the day-night cycling selector rooted at `Normal day/night cycling` through `Frozen at 11pm`, and `0x7588` as the weather-cycling selector rooted at `Normal weather cycling` through `Frozen at storms`. This is therefore the direct camera-controls page refresh owner rather than a partially anonymous page helper.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + label-table correlation + selector-family correlation"
0x004fec60,383,shell_settings_window_rebuild_hotkeys_list_control_from_sorted_binding_report,shell,thiscall,inferred,objdump + local disassembly + settings-window correlation,4,"Rebuilds one `SettingsWindow.win` list control from the current sorted hotkey report. The helper first resolves the live settings window shell object through control id `0x757a`, caches the current selection dword from `[control+0x1e2]`, destroys and reallocates the temporary list owner at `0x006d1354`, and seeds that owner as an `0x88`-stride list model through `0x00518b90`. It then iterates the current binding report through `shell_input_binding_report_iterate_next_entry_in_sorted_priority_order` `0x0045f250`, formats the action-stem column and the display-label column into local strings, appends each row through the list-model vtable at `[0x006d1354]+0x04`, and republishes the finished row into the live window through `0x00540120(control_id=0x757a, field_id=0x88, ...)`. After the rebuild it restores the saved selection through `0x00561840`. Current grounded caller is the `SettingsWindow.win` hotkeys side around `0x004fed16`, so the safest current read is the hotkeys-list rebuild body rather than a generic shell list refresher.","objdump + local disassembly + settings-window correlation + list-model correlation + hotkey-report correlation"
0x004fede0,5680,shell_settings_window_handle_message,shell,thiscall,inferred,objdump + local disassembly + settings-window correlation,3,"Primary message or command dispatcher for the shared `SettingsWindow.win` singleton at `0x006d1350`. The handler normalizes incoming control ids into the `0x8ab7..` band and switches through the local jump tables at `0x004ff47c` and `0x004ff4c0`. The fully grounded hotkeys side now does three concrete things: one branch at `0x00500147` hard-resets the live binding registry through `shell_input_binding_registry_initialize_roots_seed_defaults_and_optionally_import_hotkeys_file` `0x00461120(0)`, immediately rewrites `hotkeys\\hotkeys.txt` through `shell_input_write_hotkeys_report_file` `0x0045f550`, and rebuilds the hotkeys list through `shell_settings_window_rebuild_hotkeys_list_control_from_sorted_binding_report` `0x004fec60`; another branch at `0x00500186..0x0050022b` resolves the selected hotkeys row from control `0x757a` and model `0x006d1354`, validates the requested action bucket through `shell_input_binding_descriptor_query_bucket_key_for_action_id_when_mode_mask_is_singular` `0x0045ed90`, skips the Enter and Escape keys, expands the compact modifier code through `shell_input_binding_expand_compact_mode_code_to_registry_mask` `0x0045ed70`, commits the rebucket through `shell_input_binding_registry_rebucket_entry_by_stem_to_action_id_and_mode_mask` `0x0045ef00`, and then rewrites the report file plus rebuilds the same list; and the surrounding settings cases toggle several persisted shell or world flags such as `[0x006cec74+0x247]`, `[0x006cec74+0x24b]`, `[0x006cec74+0x243]`, `[0x006cec74+0x120]`, and world byte `[0x006d4024+0x1146e3]`, forwarding their persistence or refresh tails through `0x00484910`, `0x0051eea0`, `0x00531560`, and `0x0051f510`. The full switch table is still broader than the current annotation, but this is now safely the `SettingsWindow.win` message owner rather than an unplaced UI body.","objdump + local disassembly + settings-window correlation + hotkeys-branch correlation + toggle-branch correlation"
0x004fe140,32,shell_graphics_backend_query_primary_or_fallback_status_nonzero,shell,thiscall,inferred,objdump + settings-window caller correlation,3,"Composite predicate over the graphics backend. The helper returns true when either `graphics_backend_query_primary_status_dword_18` `0x0053ef60` is nonzero or `graphics_backend_query_both_status_slots_clear` `0x0053ef70` returns true; otherwise it returns false. Current grounded caller is the timer-gated graphics settings service branch near `0x004ffb1d`, which uses this predicate to choose between the paired backend follow-on calls `0x0053f170` and `0x0053f2c0` before republishing the graphics page.","objdump + settings-window caller correlation + backend-branch correlation"
0x004fe160,76,shell_audio_backend_change_follow_on_refresh,shell,cdecl,inferred,objdump + sound-settings caller correlation,3,"Follow-on refresh path used after the sound-backend selector changes. The helper first re-enters two subordinate runtime owners rooted at `0x006cec78` through `0x0040b7d0` and `0x0040b830` when that global is live, then re-enters shell object `[0x006cec74+0x14]` through `0x004686d0`, and finally resolves one shell controller subobject through `0x0051f070` before conditionally tail-calling `0x00563ed0`. Current grounded caller is `shell_settings_window_handle_sound_backend_selection_change` `0x004fefb0`, so the safest current read is the sound-backend follow-on refresh owner rather than a general shell service helper.","objdump + sound-settings caller correlation + global-owner correlation"
0x004fe270,84,shell_apply_custom_resolution_tuple_if_changed_and_persist,shell,cdecl,inferred,objdump + graphics-settings callback correlation,4,"Helper beneath the custom-resolution selector path. The function rejects re-entrant refreshes, compares the requested packed width-height tuple in `EDX` against the current live display-mode tuple at `[0x006d4024+0x34 + mode_index*0x15]`, and when they differ re-enters `shell_apply_display_mode_tuple_and_optional_graphics_mode` `0x005206b0` with the new width and height before persisting the larger display-runtime block through `0x0051eea0`. Current grounded caller is `shell_settings_window_handle_custom_resolution_selection_change` `0x004ff070`.","objdump + graphics-settings callback correlation + display-mode-apply correlation + persistence correlation"
0x004fe2d0,220,shell_apply_graphics_primary_selector_and_republish_backend_controls,shell,cdecl,inferred,objdump + graphics-settings callback correlation,4,"Helper beneath the top-level graphics selector callback. The function rejects re-entrant refreshes, remaps the chosen visible selector through the compact table `0x006211d0`, stores it through `shell_set_graphics_option_with_fanout` `0x00485060`, re-arms the graphics service through `0x00484910(1)`, and then repopulates the backend-dependent controls `0x757c` and `0x759a` using the live graphics backend via `0x0053ef60` and `0x0053ef70`. Current grounded caller is `shell_settings_window_handle_graphics_primary_selector_change` `0x004ff0d0`.","objdump + graphics-settings callback correlation + backend-control republish correlation"
0x004fe3b0,75,shell_apply_draw_distance_selector_and_refresh_companion_controls,shell,cdecl,inferred,objdump + graphics-settings callback correlation,4,"Helper beneath the draw-distance selector callback. The function rejects re-entrant refreshes, remaps the chosen visible selector through table `0x006211d0`, stores it through `shell_set_graphics_option_with_fanout` `0x00485060` as option family `1`, raises the local refresh latch `0x006d135c`, refreshes the draw-distance companion strip through `0x004fd550`, clears the latch again, and then re-arms the graphics service through `0x00484910(1)`. Current grounded caller is `shell_settings_window_handle_draw_distance_selector_change` `0x004ff1b0`.","objdump + graphics-settings callback correlation + companion-refresh correlation"
0x004fe400,75,shell_apply_textures_selector_and_refresh_companion_controls,shell,cdecl,inferred,objdump + graphics-settings callback correlation,4,"Helper beneath the textures selector callback. The function rejects re-entrant refreshes, remaps the chosen visible selector through table `0x006211d0`, stores it through `shell_set_graphics_option_with_fanout` `0x00485060` as option family `2`, raises the local refresh latch `0x006d135c`, refreshes the textures companion strip through `0x004fd650`, clears the latch again, and then re-arms the graphics service through `0x00484910(1)`. Current grounded caller is the textures-selector change path adjacent to `0x004ff2e0`.","objdump + graphics-settings callback correlation + companion-refresh correlation"
0x004fefb0,179,shell_settings_window_handle_sound_backend_selection_change,shell,thiscall,inferred,objdump + local disassembly + settings-window callback correlation,4,"Settings-window callback for the sound-backend selector family. The helper rejects `-1` selections and re-entrant refreshes, updates the active sound-backend selection on shell service `0x006d402c` through `0x00532230`, republishes the visible selector on control `0x7551` when the backend normalizes differently through `0x00531640`, mirrors the derived availability flag from `0x005316d0` into control `0x7550`, stores the resolved backend index into world field `[0x006d4024+0x114706]`, triggers the sound-runtime follow-on through `0x004fe160`, and then persists the larger display-runtime block through `0x0051eea0` plus the adjacent save tail `0x00484910`. Current grounded control family is the `Sound` page row rooted at `0x7551/0x7550`, which makes this the backend-selection change owner rather than a generic shell list callback.","objdump + local disassembly + settings-window callback correlation + sound-backend correlation + persistence-tail correlation"
0x004ff070,85,shell_settings_window_handle_custom_resolution_selection_change,shell,cdecl,inferred,objdump + local disassembly + settings-window callback correlation,4,"Settings-window callback for the custom-resolution list under control `0x7553`. The helper rejects `-1` selections and re-entrant refreshes, decodes the packed width-height pair from the incoming selector payload, compares it against the current live display-mode tuple at `[0x006d4024+0x34 + mode_index*0x15]`, and when the pair changed re-enters `shell_apply_display_mode_tuple_and_optional_graphics_mode` `0x005206b0` with the new width and height. This is therefore the compact custom-resolution selection owner rather than another generic selector wrapper.","objdump + local disassembly + settings-window callback correlation + display-mode-apply correlation"
0x004ff0d0,220,shell_settings_window_handle_graphics_primary_selector_change,shell,cdecl,inferred,objdump + local disassembly + settings-window callback correlation,4,"Settings-window callback for the top-level `Graphics` page selector family rooted at the compact remap table `0x006211d0`. The helper rejects `-1` selections and re-entrant refreshes, remaps the chosen visible selector through `shell_set_graphics_option_with_fanout` `0x00485060`, re-arms the graphics service through `0x00484910(1)`, and then republishes the backend-dependent controls `0x757c` and `0x759a` using `0x0053ef60` and `0x0053ef70` before returning. This is now the clearest owner for the graphics primary-selector change branch rather than an anonymous settings callback.","objdump + local disassembly + settings-window callback correlation + graphics-backend republish correlation"
0x004ff1b0,115,shell_settings_window_handle_draw_distance_selector_change,shell,cdecl,inferred,objdump + local disassembly + settings-window callback correlation,4,"Settings-window callback for the main `Draw Distance` selector. The helper packages the chosen visible selector through `shell_set_graphics_option_with_fanout` `0x00485060` as option slot `9`, skips further work when the local refresh latch `0x006d135c` is armed, and otherwise re-enters `shell_settings_window_refresh_draw_distance_primary_selector` `0x004fe6f0`. Current grounded dispatcher-side callsite sits at `0x004ff1f3`, which makes this the draw-distance selector-change owner rather than a generic option setter.","objdump + local disassembly + settings-window callback correlation + selector-refresh correlation"
0x004ff2e0,52,shell_settings_window_handle_textures_selector_change,shell,cdecl,inferred,objdump + local disassembly + settings-window callback correlation,4,"Settings-window callback for the main `Textures` selector. The helper packages the chosen visible selector through `shell_set_graphics_option_with_fanout` `0x00485060` as option slot `3`, skips the follow-on when local latch `0x006d135c` is armed, and otherwise re-enters `shell_settings_window_refresh_textures_primary_selector` `0x004fe730`. Current grounded dispatcher-side callsite sits at `0x004ff30c`, which makes this the textures selector-change owner rather than another compact remap stub.","objdump + local disassembly + settings-window callback correlation + selector-refresh correlation"
0x004ff58a,33,shell_settings_window_toggle_misc_input_page_display_runtime_byte_1146d7,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for the later `Miscellaneous` input page field mirrored from display-runtime byte `[0x006d4024+0x1146d7]` into control `0x7547`. The helper flips the byte and persists the display-runtime block through `0x0051eea0`. This is therefore the direct toggle owner for that page-owned byte rather than an anonymous dispatcher leaf.","objdump + local disassembly + settings-window page correlation + persistence correlation"
0x004ff5b6,37,shell_settings_window_toggle_misc_input_page_shell_flag_28b,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for the later `Miscellaneous` input page field `[0x006cec74+0x28b]`, currently mirrored into control `0x7594`. The helper flips the dword between `0` and `1`, raises the shared shell config-save tail through `0x00484910(1)`, and returns. Current evidence keeps the label field-based because the exact caption is still open.","objdump + local disassembly + settings-window page correlation + config-save correlation"
0x004ff5e6,70,shell_settings_window_toggle_misc_input_page_shell_flag_283_and_refresh_game_window_affordance,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,4,"Toggle branch for the later `Miscellaneous` input page field `[0x006cec74+0x283]`, currently mirrored into control `0x7593`. The helper flips the dword, persists shell config through `0x00484910(1)`, and when the live `Game.win` singleton at `0x006d0818` exists it republishes one page-local affordance through `0x004dd8d0` using the new boolean value. This is therefore the direct owner for the `+0x283` settings toggle plus its `Game.win` follow-on refresh.","objdump + local disassembly + settings-window page correlation + config-save correlation + Game.win follow-on correlation"
0x004ff637,37,shell_settings_window_toggle_dialogs_page_shell_scalar_f8,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for the `Dialogs` page scalar `[0x006cec74+0xf8]`, mirrored into control `0x7545`. The helper flips the dword between `0` and `1`, persists shell config through `0x00484910(1)`, and returns. Current evidence keeps the label structural because the caption is not yet grounded.","objdump + local disassembly + settings-window page correlation + config-save correlation"
0x004ff667,37,shell_settings_window_toggle_dialogs_page_flag_26b,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for `Dialogs` page field `[0x006cec74+0x26b]`, currently mirrored into the checkbox strip rooted at control `0x758c`. The helper flips the dword and persists shell config through `0x00484910(1)`.","objdump + local disassembly + settings-window page correlation + config-save correlation"
0x004ff697,37,shell_settings_window_toggle_dialogs_page_flag_26f,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for `Dialogs` page field `[0x006cec74+0x26f]`, currently mirrored into the checkbox strip rooted at control `0x758d`. The helper flips the dword and persists shell config through `0x00484910(1)`.","objdump + local disassembly + settings-window page correlation + config-save correlation"
0x004ff6c7,37,shell_settings_window_toggle_dialogs_page_flag_273,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for `Dialogs` page field `[0x006cec74+0x273]`, currently mirrored into the checkbox strip rooted at control `0x758e`. The helper flips the dword and persists shell config through `0x00484910(1)`.","objdump + local disassembly + settings-window page correlation + config-save correlation"
0x004ff6f7,37,shell_settings_window_toggle_dialogs_page_flag_277,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for `Dialogs` page field `[0x006cec74+0x277]`, currently mirrored into the checkbox strip rooted at control `0x758f`. The helper flips the dword and persists shell config through `0x00484910(1)`.","objdump + local disassembly + settings-window page correlation + config-save correlation"
0x004ff727,37,shell_settings_window_toggle_dialogs_page_flag_27b,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for `Dialogs` page field `[0x006cec74+0x27b]`, currently mirrored into the checkbox strip rooted at control `0x7590`. The helper flips the dword and persists shell config through `0x00484910(1)`.","objdump + local disassembly + settings-window page correlation + config-save correlation"
0x004ff757,52,shell_settings_window_toggle_gameplay_page_display_runtime_dword_114742_and_refresh_building_detail_if_live,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,4,"Toggle branch for the `Gameplay` page display-runtime dword `[0x006d4024+0x114742]`, one of the fields mirrored by `shell_settings_window_refresh_gameplay_page` `0x004fda20`. The helper flips the dword, re-enters `0x004b2ae0` when the live `BuildingDetail.win` singleton at `0x006cfcbc` is present, and then persists shell config through `0x00484910(1)`. This is therefore the direct toggle owner for that gameplay-page display-runtime field plus its building-detail follow-on refresh.","objdump + local disassembly + settings-window page correlation + building-detail follow-on correlation + config-save correlation"
0x004ff796,37,shell_settings_window_toggle_gameplay_page_shell_flag_a8,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for the `Gameplay` page shell field `[0x006cec74+0x0a8]`, one of the values mirrored by `shell_settings_window_refresh_gameplay_page` `0x004fda20`. The helper flips the dword and persists shell config through `0x00484910(1)`.","objdump + local disassembly + settings-window page correlation + config-save correlation"
0x004ff7c6,113,shell_settings_window_toggle_gameplay_page_shell_flag_263_and_refresh_live_world_tool_sidecar,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,4,"Toggle branch for the `Gameplay` page shell field `[0x006cec74+0x263]`, mirrored by `shell_settings_window_refresh_gameplay_page` `0x004fda20`. The helper flips the dword and, when the live shell detail manager at `0x006d0818` is on page `0x0c`, updates one world-tool sidecar rooted at `0x0062c120+0x1689/0x168d` before persisting shell config through `0x00484910(1)`. This is therefore the direct owner for the `+0x263` gameplay toggle plus its narrow live-tool follow-on.","objdump + local disassembly + settings-window page correlation + live-tool follow-on correlation + config-save correlation"
0x004ff84e,109,shell_settings_window_toggle_gameplay_page_shell_flag_309_and_refresh_live_tool_counters,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,4,"Toggle branch for the `Gameplay` page shell field `[0x006cec74+0x309]`, mirrored by `shell_settings_window_refresh_gameplay_page` `0x004fda20`. The helper flips the dword and, when the live tool at `0x006d1a8c` plus world-side owner `0x006cfca8` are present, chooses between the small follow-on decrements `0x00491880` and `0x004932a0` before persisting shell config through `0x00484910(1)`. This is therefore the direct owner for the `+0x309` gameplay toggle plus its live-tool counter refresh side effect.","objdump + local disassembly + settings-window page correlation + live-tool follow-on correlation + config-save correlation"
0x004ffafb,102,shell_settings_window_service_graphics_backend_status_and_repaint_page,shell,cdecl,inferred,objdump + local disassembly + settings-window service correlation,4,"Timer-gated graphics-page service branch beneath `SettingsWindow.win`. The helper samples elapsed wall-clock time through `shell_get_elapsed_tick_count_since_bootstrap_seed` `0x0051d890` against the global deadline `0x006d136c`, rearms that deadline by `1000` ms, chooses between graphics-backend follow-on calls `0x0053f170` and `0x0053f2c0` from the composite predicate `shell_graphics_backend_query_primary_or_fallback_status_nonzero` `0x004fe140`, raises the shared shell refresh latch through `0x00484910(1)`, repaints the live graphics page through `shell_settings_window_refresh_graphics_page` `0x004fe770`, and then shortens the next service deadline to `60` ms. This is therefore the active graphics-backend service-and-repaint owner rather than just another generic timer callback.","objdump + local disassembly + settings-window service correlation + graphics-page refresh correlation"
0x004ffb64,96,shell_settings_window_service_graphics_backend_status_without_page_repaint,shell,cdecl,inferred,objdump + local disassembly + settings-window service correlation,4,"Sibling timer-gated graphics-backend service branch beneath `SettingsWindow.win`. The helper uses the same elapsed-tick gate at `0x006d136c`, rearms the `1000` ms coarse deadline through `shell_get_elapsed_tick_count_since_bootstrap_seed` `0x0051d890`, chooses between `0x0053f0f0` and `0x0053f210` from `graphics_backend_query_both_status_slots_clear` `0x0053ef70`, raises the shared shell refresh latch through `0x00484910(1)`, and then shortens the next service deadline to `60` ms without directly repainting the graphics page. Current local evidence keeps this as the no-page-repaint companion to `0x004ffafb` rather than a detached backend poller.","objdump + local disassembly + settings-window service correlation + backend-follow-on correlation"
0x004ffbc0,244,shell_settings_window_handle_custom_resolution_or_graphics_range_refresh,shell,cdecl,inferred,objdump + local disassembly + settings-window callback correlation + persistence correlation,3,"Settings-window callback branch that persists the display-runtime block through `0x0051eea0`, rebuilds the custom-resolution list through `0x004fe4c0`, and then republishes the graphics-range controls `0x7555` and `0x7578` depending on whether graphics mode byte `[0x006d4024+0x114226]` is nonzero. The branch is timer or service gated through `0x006d136c` and the surrounding settings dispatcher. This is still somewhat structural, but it is now clearly the graphics custom-resolution or range-refresh owner rather than an unrelated timer path.","objdump + local disassembly + settings-window callback correlation + persistence correlation + graphics-range-control correlation"
0x004ffd10,351,shell_settings_window_handle_graphics_range_custom_mode_toggle,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,4,"Settings-window callback branch for the graphics-range custom-mode affordance rooted at control `0x7555`. When the custom-mode flag from `shell_query_graphics_range_custom_mode_flag` `0x0051fd40` is already set it disables that flag through `shell_set_graphics_range_custom_mode_flag_and_reapply_if_needed` `0x00520fd0(0)` and persists the display-runtime block through `0x0051eea0`. Otherwise it first checks `shell_query_graphics_range_has_live_custom_payload` `0x0051fd00`; when no live custom payload exists it clears the control and presents one small localized notice through `0x005193f0(0x0e17) -> 0x004c98a0(mode=1)`. When a live payload does exist it uses shell byte `[0x006cec74+0x2d1]` as a one-shot warning gate, raises the shared shell refresh latch through `0x00484910(1)`, presents the confirmation dialog `0x005193f0(0x0e16) -> 0x004c98a0(mode=3)`, and only on the affirmative path re-enters `shell_set_graphics_range_custom_mode_flag_and_reapply_if_needed` `0x00520fd0(1)`, persists the display runtime, and republishes the same control. If the setter immediately clears the flag again it falls back to the localized notice path `0x005193f0(0x0e93) -> 0x004c98a0(mode=1)`. This is therefore the user-facing graphics-range custom-mode toggle owner rather than a generic dialog wrapper.","objdump + local disassembly + settings-window dispatcher correlation + graphics-range-control correlation + dialog-path correlation"
0x004ffe72,48,shell_settings_window_handle_graphics_range_scalar_zero_nonzero_toggle,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,4,"Small graphics-range scalar toggle beneath `SettingsWindow.win`. The helper reads the current scalar through `shell_query_graphics_range_scalar` `0x0051fd60`, collapses that to a zero-vs-nonzero boolean, inverts it, forwards the requested replacement through `shell_set_graphics_range_scalar_and_reapply_if_needed` `0x00521030`, and then persists the display-runtime block through `0x0051eea0`. Current grounded location is the same graphics-side callback strip as `0x004ffd10`, so this is the safest current read for the zero/nonzero graphics-range scalar toggle rather than a generic integer setter.","objdump + local disassembly + settings-window dispatcher correlation + graphics-range-scalar correlation"
0x004ffea4,91,shell_settings_window_toggle_display_runtime_preview_rect_notify_flag,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,3,"Toggle branch for display-runtime byte `[0x006d4024+0x1146eb]` beneath `SettingsWindow.win`. The helper flips the byte, and when the global world-root at `0x0062c120` is live and the new value becomes zero it emits one large world-space rect notification through `0x0044e940(0,0,0x270f,0x270f,0)` before persisting the display-runtime block through `0x0051eea0`. Current evidence safely bounds this as one preview-rect notify toggle in the graphics-side settings family rather than a fully named presentation option.","objdump + local disassembly + settings-window dispatcher correlation + world-rect-notify correlation"
0x004ffeff,46,shell_settings_window_toggle_display_runtime_dword_114697,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,3,"Toggle branch for display-runtime dword `[0x006d4024+0x114697]` beneath `SettingsWindow.win`. The helper flips the dword between `0` and `1` and immediately persists the display-runtime block through `0x0051eea0`. Current evidence keeps the field name conservative because no stronger user-facing semantic owner is grounded yet.","objdump + local disassembly + settings-window dispatcher correlation + persistence correlation"
0x004fff2d,37,shell_settings_window_toggle_display_runtime_byte_1146e9,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,3,"Toggle branch for display-runtime byte `[0x006d4024+0x1146e9]` beneath `SettingsWindow.win`. The helper flips the byte and immediately persists the display-runtime block through `0x0051eea0`. Current evidence keeps the label structural because the exact player-facing option name is still ungrounded.","objdump + local disassembly + settings-window dispatcher correlation + persistence correlation"
0x004fff59,41,shell_settings_window_toggle_display_runtime_byte_1146b8,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,3,"Toggle branch for display-runtime byte `[0x006d4024+0x1146b8]` beneath `SettingsWindow.win`. The helper flips the byte and persists the display-runtime block through `0x0051eea0`. Current adjacent disassembly keeps this on the graphics or model-detail side of the settings dispatcher, but the exact player-facing caption is still ungrounded.","objdump + local disassembly + settings-window dispatcher correlation + persistence correlation"
0x004fff85,86,shell_settings_window_toggle_display_runtime_scalar_1146af_between_0_and_0_5,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,4,"Small scalar toggle branch for display-runtime float `[0x006d4024+0x1146af]` beneath `SettingsWindow.win`. The helper compares the current scalar against `0.5`, stores `0.0` when the current value is already at or below that threshold, otherwise stores `0.5`, and then persists the display-runtime block through `0x0051eea0`. This is therefore the clearest current owner for a binary `0.0` vs `0.5` display scalar toggle inside the settings dispatcher.","objdump + local disassembly + settings-window dispatcher correlation + scalar-threshold correlation"
0x004fffde,46,shell_settings_window_toggle_display_runtime_byte_1146a8,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,3,"Toggle branch for display-runtime byte `[0x006d4024+0x1146a8]` beneath `SettingsWindow.win`. The helper flips the byte and persists the display-runtime block through `0x0051eea0`. Current evidence is still structural rather than caption-level.","objdump + local disassembly + settings-window dispatcher correlation + persistence correlation"
0x0050000a,46,shell_settings_window_toggle_display_runtime_byte_1146e3,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,3,"Toggle branch for display-runtime byte `[0x006d4024+0x1146e3]` beneath `SettingsWindow.win`. The helper flips the byte and persists the display-runtime block through `0x0051eea0`. This is the direct byte-toggle owner mentioned more broadly in the settings dispatcher note, but its exact user-facing caption is still open.","objdump + local disassembly + settings-window dispatcher correlation + persistence correlation"
0x00500036,51,shell_settings_window_apply_graphics_misc_option_family12_from_checkbox_state,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,4,"Settings-window callback leaf for the first `Miscellaneous` graphics page option family derived through `0x00484af0(0x0c)`, currently mirrored into control `0x7586` by `shell_settings_window_refresh_graphics_misc_page` `0x004fdd70`. The helper reads the incoming checkbox-state bit from `[msg+0x2c]+0xcc`, forwards that boolean into `shell_set_graphics_option_with_fanout` `0x00485060(option_family=0x0c)`, and then persists the display-runtime block through `0x0051eea0`. This is therefore the direct apply leaf for that graphics-misc option family rather than another anonymous message stub.","objdump + local disassembly + settings-window page correlation + graphics-option-family correlation + persistence correlation"
0x0050006c,46,shell_settings_window_toggle_shared_setup_config_flag_247,shell,cdecl,inferred,objdump + local disassembly + settings-window and setup correlation,3,"Toggle branch for shared shell config flag `[0x006cec74+0x247]`. The helper flips the dword and persists shell config through `0x00484910(1)`. This is one of the same three persisted booleans later mirrored by `Setup.win` controls `0x0e88/0x0e89/0x0e8a`, so the safest current read is the shared setup-config toggle rather than a page-local-only setting.","objdump + local disassembly + settings-window and setup correlation + config-save correlation"
0x0050009c,46,shell_settings_window_toggle_shared_setup_config_flag_24b,shell,cdecl,inferred,objdump + local disassembly + settings-window and setup correlation,3,"Toggle branch for shared shell config flag `[0x006cec74+0x24b]`. The helper flips the dword and persists shell config through `0x00484910(1)`. This is one of the three persisted booleans also mirrored by `Setup.win` controls `0x0e88/0x0e89/0x0e8a`.","objdump + local disassembly + settings-window and setup correlation + config-save correlation"
0x005000cc,46,shell_settings_window_toggle_shared_setup_config_flag_243,shell,cdecl,inferred,objdump + local disassembly + settings-window and setup correlation,3,"Toggle branch for shared shell config flag `[0x006cec74+0x243]`. The helper flips the dword and persists shell config through `0x00484910(1)`. This is the third member of the persisted setup-config toggle trio also mirrored by `Setup.win` controls `0x0e88/0x0e89/0x0e8a`.","objdump + local disassembly + settings-window and setup correlation + config-save correlation"
0x005000fc,45,shell_settings_window_toggle_scrolling_page_boolean_companion_flag_120,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,4,"Toggle branch for the `Scrolling` page boolean companion derived from shell field `[0x006cec74+0x120]`, mirrored into control `0x7585` by `shell_settings_window_refresh_scrolling_page` `0x004fdf20`. The helper maps the incoming control id to a zero-or-one dword, stores that at `[0x006cec74+0x120]`, and persists shell config through `0x00484910(1)`. This is therefore the direct owner for the scrolling-page boolean companion rather than a generic shell-field setter.","objdump + local disassembly + settings-window page correlation + config-save correlation"
0x00500410,528,shell_settings_window_refresh_selected_page_controls,shell,thiscall,inferred,objdump + local disassembly + settings-window correlation + RT3.lng page-label correlation,4,"Refreshes the visible category-strip state and the active page body for the shared `SettingsWindow.win` singleton. The helper raises the local in-refresh guard byte `0x006d135d`, normalizes caller page `0x0c` to `0x0b` and `0x0b` to `0x0d`, republishes the left category-strip control family `0x7533..0x753f` plus the trailing companion controls `0x7540` and `0x753f` through repeated `0x00540120` calls with mode `3` and style values `0x86/0xa6`, and then dispatches the selected page through the local table at `0x005005e0`. The category table rooted at `0x00622870` now grounds those page indices as `Gameplay`, `Sound`, `Graphics`, `Model Detail`, `Draw Distance`, `Textures`, `Miscellaneous`, `Hot Keys`, `Scrolling`, `Camera Controls`, `Dialogs`, `Miscellaneous`, and `Sandbox Options`; page `7` is directly confirmed as the hotkeys page because it dispatches into `shell_settings_window_rebuild_hotkeys_list_control_from_sorted_binding_report` `0x004fec60`. The currently grounded page-refresh callees are `0x004fda20`, `0x004fdb90`, `0x004fe770`, `0x004fe960`, `0x004feb20`, `0x004febd0`, `0x004fdd70`, `0x004fec60`, `0x004fdf20`, `0x004fdfd0`, `0x004fd940`, `0x004fd730`, and `0x004fd8d0`. The helper clears `0x006d135d` on every exit path, so the safest current read is the selected-page refresh owner rather than a generic settings redraw wrapper.","objdump + local disassembly + settings-window correlation + category-strip correlation + page-dispatch correlation + RT3.lng page-label correlation"
0x00500620,32,shell_refresh_settings_window_page_if_live_and_not_in_internal_refresh,shell,cdecl,inferred,objdump + local disassembly + settings-window correlation,4,"Small guarded wrapper above `shell_settings_window_refresh_selected_page_controls` `0x00500410`. The helper ignores page selector `-1`, ignores requests while the internal refresh guard byte `0x006d135d` is set, and otherwise re-enters the live settings singleton at `0x006d1350` when present. Current grounded callers are the surrounding settings-message and page-selection paths, where this acts as the nonreentrant page-refresh gate rather than a general shell-window service helper.","objdump + local disassembly + settings-window correlation + refresh-guard correlation"
0x00500640,487,shell_settings_window_construct,shell,thiscall,inferred,objdump + strings + RT3.lng page-label correlation,4,"Constructs the shared SettingsWindow.win object later stored at `0x006d1350`. The helper binds the `SettingsWindow.win` resource through `0x0053fa50`, allocates a page-selection helper at `0x006d1358`, walks the 13-entry category table rooted at `0x00622870`, and populates the resulting shell control tree with the ordered page labels `Gameplay`, `Sound`, `Graphics`, `Model Detail`, `Draw Distance`, `Textures`, `Miscellaneous`, `Hot Keys`, `Scrolling`, `Camera Controls`, `Dialogs`, `Miscellaneous`, and `Sandbox Options` before the window is shown. The second dword in that table is now only bounded as one small subgroup or style flag; it is set on `Model Detail`, `Draw Distance`, `Textures`, and the first `Miscellaneous` entry and clear on the rest. This is therefore the safest current read for the shared settings-window constructor rather than a generic page-list allocator.","objdump + strings + RT3.lng page-label correlation + category-table correlation"
0x00501e50,201,shell_open_settings_window,shell,cdecl,inferred,objdump + strings,4,Lazily allocates and shows the shared SettingsWindow.win shell object at 0x006d1350. When no settings window is live it allocates a 0x78-byte object constructs it through shell_settings_window_construct publishes it to the shell runtime through 0x00538f10 and then notifies the active shell owner at 0x0062be68. Current grounded callers are the direct shell command wrapper at 0x00482b00 the fileopt settings escape branch and one larger shell UI dispatcher branch near 0x0050366a.,objdump + strings + caller xrefs
0x00501f20,270,shell_query_registry_open_command_for_http_or_rtf_target,shell,cdecl,inferred,objdump + literal inspection,3,"Queries one shell-open command string from the registry and formats it into the shared command buffer at `0x006d14d8`. Selector `0` uses the literal `http\\shell\\open` and validates the returned command against the substrings `netsc` and the quoted percent-one placeholder; selector `1` uses `rtffile\\shell\\open`, truncates at the percent-one placeholder, and appends the literal `readme.rtf` through the format `%s %s`. The helper returns `0x006d14d8` on success or `0` on failure. Current grounded callers are the early `Setup.win` dispatcher buttons at `0x00503585/0x0050359f/0x005035c7/0x005035ce`, which then forward the formatted command through import `0x005c8088` instead of re-entering the normal setup launch-mode family.","objdump + literal inspection + caller correlation"
0x00468b00,10,multiplayer_toggle_preview_dataset_service_gate,shell,cdecl,inferred,objdump + local disassembly + global-state inspection,2,Tiny helper that flips the preview-dataset frame-service gate at `0x006cd910` by XORing it with `1` and then returns `0`. Current evidence only grounds the store itself so this row stays structural for now.,objdump + local disassembly + global-state inspection
0x00468b10,58,multiplayer_preview_dataset_register_selector_callback_if_absent,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-callback registration helper over the keyed descriptor owner at `[this+0x04]`. It first probes the keyed store through `0x0053daa0(selector)` and, when no existing entry is present, inserts the caller-supplied callback pointer through `0x0053d960(selector, callback)` before returning success. Current grounded caller is the broader preview-dataset callback seeding pass `0x00473280`, which uses this helper to populate selector handlers `1..0x83`, so this is the clean local registration primitive beneath that callback-registry owner rather than a generic keyed insert.","objdump + local disassembly + registration-pass correlation + keyed-store correlation"
0x00468b50,7,multiplayer_preview_dataset_set_default_callback_root,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,Tiny setter that stores one caller-supplied callback root into `[this+0x08]`. Current grounded caller is the broader preview-dataset callback registration pass `0x00473280`, which seeds this slot with `0x0046f4a0` before populating the keyed selector table.,objdump + local disassembly + caller inspection + callback-root correlation
0x00468d00,222,multiplayer_update_semicolon_name_list,shell,cdecl,inferred,ghidra-headless,4,Adds or removes one player-name token in the semicolon-delimited moderation list rooted at `[ecx+0x905c]`. With mode `1` it appends the supplied token only when not already present writing `;` as the delimiter; with mode `0` it removes the matched token collapses the remainder left and skips an adjacent delimiter when present.,ghidra + rizin + llvm-objdump + strings
0x00468de0,14,multiplayer_session_event_forward_action1_request,shell,unknown,inferred,ghidra-headless,2,Session-event callback wrapper that always forwards request id `1` through multiplayer_set_pending_session_substate with a zero auxiliary payload. The callback clears EDX before the shared setter call and currently lands on a request id that does not yet map to a visible pending substate so this row remains structural.,ghidra + rizin + llvm-objdump
0x00468e00,188,multiplayer_session_event_publish_pair_chat_template,shell,unknown,inferred,ghidra-headless,3,Session-event callback that formats one two-string chat/status line through multiplayer_route_chat_line when the callback status in EDX is zero and the current live session count is not positive. A selector near `[esp+0x214]` chooses the template `%s* %s` `%s %s` or `%s > %s`; the helper length-checks both inputs against the local 0x1f4-byte buffer before formatting and returns without publishing when either string is null or too long.,ghidra + rizin + llvm-objdump + strings
0x00468ec0,144,multiplayer_session_event_publish_action2_single_name,shell,unknown,inferred,ghidra-headless,3,Session-event callback wrapper for the one-name action-2 status path. When the callback status in EDX is zero and the current session count is positive it length-checks the supplied name formats localized text id `0xb73` routes the resulting line through multiplayer_route_chat_line and then forwards request id `2` through multiplayer_set_pending_session_substate with that same name payload. The currently grounded setter does not visibly store a pending substate for id `2` so this row stays partly structural.,ghidra + rizin + llvm-objdump
0x00468f50,192,multiplayer_session_event_publish_action2_pair,shell,unknown,inferred,ghidra-headless,3,Session-event callback wrapper for the two-string action-2 status path. When the callback status in EDX is zero and the supplied name lengths fit within the local buffer it formats localized text id `0xb74` or `0xe34` depending on whether the first string is present routes the resulting line through multiplayer_route_chat_line and then forwards request id `2` through multiplayer_set_pending_session_substate with the second string as the target payload and the first string as the auxiliary payload. The currently grounded setter does not visibly store a pending substate for id `2` so this row stays partly structural.,ghidra + rizin + llvm-objdump
0x00469010,30,multiplayer_session_event_forward_action4_request,shell,unknown,inferred,ghidra-headless,3,Session-event callback wrapper that forwards request id `4` only when both supplied payload pointers are non-null. It passes the second stack argument as the action payload and a zero auxiliary argument through multiplayer_set_pending_session_substate. The currently grounded setter does not visibly store a pending substate for id `4` so this row remains structural.,ghidra + rizin + llvm-objdump
0x00469030,30,multiplayer_session_event_forward_action7_request,shell,unknown,inferred,ghidra-headless,2,Session-event callback wrapper that forwards one payload pointer through multiplayer_set_pending_session_substate with request id `7` when the callback status in EDX is nonzero. The wrapper normalizes its incoming pointer into the second stack slot before tail-calling the shared setter but the currently grounded setter does not map request id `7` to a visible pending substate so this row remains structural.,ghidra + rizin + llvm-objdump
0x00469060,3,multiplayer_session_event_noop_12byte_stub,shell,unknown,inferred,ghidra-headless,4,Three-byte no-op callback stub in the Multiplayer.win session-event registration table. It returns immediately with `ret 0xc` and does not touch any state.,ghidra + rizin + llvm-objdump
0x00469070,87,multiplayer_session_event_publish_status_value,shell,unknown,inferred,ghidra-headless,3,Session-event callback that publishes one status value into the destination text builder passed in the third stack argument. It first compares the supplied index against the live session count from `0x006d40d0`; out-of-range entries publish the fixed fallback text at `0x005c87a8`; in-range entries publish integer `100` through 0x0058cd40 when event code EDX is `0x18`; publish the string at `0x00521d40+0x08` when EDX is `0x15`; and otherwise fall back to the same fixed text token.,ghidra + rizin + llvm-objdump + strings
0x004690d0,15,multiplayer_session_event_publish_fixed_status_text,shell,unknown,inferred,ghidra-headless,3,Session-event callback that appends the fixed status text token at `0x005c87a8` into the destination text builder passed in the second stack argument. This is the smallest text-publisher sibling in the same callback family and shares the same append helper 0x0058bce0 used by 0x00469070.,ghidra + rizin + llvm-objdump
0x004690f0,106,multiplayer_session_event_seed_control_id_list,shell,unknown,inferred,ghidra-headless,3,Session-event callback that seeds a byte-list builder with the fixed control-id set `3 1 8 10 11 19 4 5` when the callback status in EDX is zero. It appends each id through 0x0058bcb0 into the destination builder passed in the first stack argument and returns immediately when the callback status is nonzero.,ghidra + rizin + llvm-objdump
0x00469160,26,multiplayer_session_event_query_session_count,shell,unknown,inferred,ghidra-headless,4,Session-event callback helper that returns the live session count from `0x006d40d0` through 0x00521670 only when the callback mode in EDX equals `1`; all other modes return zero. This is the count-query slot in the same registration table.,ghidra + rizin + llvm-objdump
0x00469180,3,multiplayer_session_event_noop_8byte_stub,shell,unknown,inferred,ghidra-headless,4,Three-byte no-op callback stub in the Multiplayer.win session-event registration table. It returns immediately with `ret 8` and does not touch any state.,ghidra + rizin + llvm-objdump
0x00469190,8,multiplayer_session_event_latch_status_code,shell,unknown,inferred,ghidra-headless,4,Small session-event callback helper that stores the incoming status code from EDX into `0x006cd974` and returns. The registration branch later clears the same global before transport teardown or retry reset.,ghidra + rizin + llvm-objdump
0x004691a0,45,multiplayer_session_event_notify_owner_and_queue_action8,shell,unknown,inferred,ghidra-headless,3,Session-event callback wrapper that first notifies the current Multiplayer.win owner through multiplayer_notify_window_owner. When the callback status in EDX is zero it then queues request id `8` through multiplayer_set_pending_session_substate with the same payload pointer; otherwise it returns after the owner notification only.,ghidra + rizin + llvm-objdump
0x004691d0,39,multiplayer_find_session_event_capacity_entry,shell,unknown,inferred,ghidra-headless,4,Scans the fixed 0x80-entry session-event capacity array for a live record owned by the supplied key pointer in EDX. Each 0x11c-byte record is live when [entry+0x104] is nonzero and a match requires [entry+0x10c] to equal the incoming key. The helper returns the matched entry pointer or null.,ghidra + rizin + llvm-objdump
0x00469200,428,multiplayer_sync_session_event_capacity_entry,shell,unknown,inferred,ghidra-headless,3,Session-event cache-field callback that creates updates or clears one cached capacity record for the supplied owner key. Mode `0` creates the first free 0x11c-byte record when none exists mode `1` updates an existing record and mode `2` clears an existing record by zeroing [entry+0x104]. The create and update paths store the owner key at [entry+0x10c] seed [entry+0x104] with 0x2328 resolve `numplayers` and `maxplayers` handles through 0x0058d6d0 and copy the current display string into [entry+0x84].,ghidra + rizin + llvm-objdump + strings
0x004693b0,80,multiplayer_session_event_cache_line_callback,shell,unknown,inferred,ghidra-headless,4,Transport-side callback that appends one incoming status line into the cached session-event line store at `0x006ae4d8`. When the callback status in EDX is nonzero and the incoming line pointer is valid it copies the string from the third stack argument into slot `0x006cd97c << 8` subject to the `0x1f4` entry cap and a small flag filter on the fourth stack argument then increments `0x006cd97c` for later iteration.,ghidra + rizin + llvm-objdump
0x00469410,56,multiplayer_init_session_event_transport_state,shell,unknown,inferred,ghidra-headless,3,Initializes the Multiplayer.win session-event transport state rooted at `0x006cd970`. The helper latches the incoming mode or state into `0x006cd978`; when that value is nonzero it zeroes the large scratch block at `0x006ae4d8` resets `0x006cd97c` and registers the cached-line callback block rooted at `0x004693b0` through multiplayer_transport_register_selector_callback before returning.,ghidra + rizin + llvm-objdump
0x00469450,97,multiplayer_teardown_session_event_transport,shell,unknown,inferred,ghidra-headless,3,Tears down the active session-event transport object at `0x006cd970`. When the latched mode at `0x006cd978` is nonzero and the multiplayer session object at `0x006cd920` exists it first switches the transport back to status route `0` through multiplayer_transport_select_status_route clears the status pump through multiplayer_transport_clear_status_pump disconnects through multiplayer_transport_disconnect shuts the object down through multiplayer_transport_shutdown and finally clears `0x006cd970`.,ghidra + rizin + llvm-objdump
0x004694c0,57,multiplayer_publish_session_event_fixed_token,shell,unknown,inferred,ghidra-headless,3,Small session-event transport helper that publishes one fixed token through the active transport object when the latched mode and multiplayer session object are both present. It first switches the transport to status route `1` through multiplayer_transport_select_status_route and then sends the fixed token at `0x005c87a8` plus flag `1` through multiplayer_transport_publish_fixed_token_message. The current grounded caller is the Multiplayer.win branch at `0x0046c3c0`.,ghidra + rizin + llvm-objdump + strings
0x00469500,27,multiplayer_flush_session_event_transport,shell,unknown,inferred,ghidra-headless,3,"Lightweight session-event transport flush wrapper. When the active transport object at `0x006cd970` exists it first forces a status flush through multiplayer_transport_force_status_flush and then tail-calls multiplayer_transport_flush_and_maybe_shutdown on that same object. Current grounded callers include the top-level Multiplayer.win service loop and neighboring preview-reset or initializer branches, which makes this the shell-side cadence bridge into the deeper transport pump.",ghidra + rizin + llvm-objdump
0x00469520,94,multiplayer_register_session_event_cache_fields,shell,unknown,inferred,ghidra-headless,3,Registers the session-event cache-field subscription set for the active Multiplayer.win object. When no multiplayer session object is present it marks `[this+0x8f18]` armed and subscribes callback `0x00469200` through multiplayer_transport_subscribe_field_callback_set with the fixed field-id list `3 1 4 8 10 11 19 5` rooted at `[this+0x10]`.,ghidra + rizin + llvm-objdump
0x00469580,65,multiplayer_begin_session_event_line_iteration,shell,unknown,inferred,ghidra-headless,4,Primes iteration over the cached session-event line store at `0x006ae4d8`. When the multiplayer session object at `0x006cd920` is absent it sets `[this+0x9874]` armed clears the cached line slots and line index at `0x006cd97c` and re-registers the line callback `0x004693b0` through multiplayer_transport_register_selector_callback before returning.,ghidra + rizin + llvm-objdump
0x004695d0,66,multiplayer_next_session_event_cached_line,shell,unknown,inferred,ghidra-headless,4,Returns the next non-empty cached session-event line from the fixed store at `0x006ae4d8`. On first use after multiplayer_begin_session_event_line_iteration it resets `0x006cd97c` and clears `[this+0x9874]`; afterwards it returns the current 0x100-byte slot pointer when the first byte is nonzero and advances `0x006cd97c` or returns null when no further cached lines remain.,ghidra + rizin + llvm-objdump
0x00469620,52,multiplayer_submit_owner_notified_session_event_text,shell,unknown,inferred,ghidra-headless,3,Submits one caller-supplied text buffer through the active session-event transport using callback multiplayer_session_event_notify_owner_and_queue_action8. The helper first sanitizes the input string into a local 0x100-byte transport record through multiplayer_transport_sanitize_identifier and then forwards that record through multiplayer_transport_submit_text_record with fixed mode arguments `0` and `1`.,ghidra + rizin + llvm-objdump
0x00469660,27,multiplayer_send_session_event_text_selector0,shell,unknown,inferred,ghidra-headless,3,Thin session-event transport wrapper that sends one caller-supplied text pointer through multiplayer_transport_send_selector_text with selector `0` when the pointer is non-null. The current grounded caller is the Multiplayer.win control dispatcher around `0x00469d30`.,ghidra + rizin + llvm-objdump
0x00469680,14,multiplayer_pump_session_event_status,shell,unknown,inferred,ghidra-headless,3,Thin session-event transport wrapper that immediately requests a status pump through multiplayer_transport_request_status_pump on the active transport object at `0x006cd970` and discards one stack argument. Current grounded callers use it after updating Multiplayer.win status text ids `0xe60` and `0xe61`.,ghidra + rizin + llvm-objdump
0x00469690,52,multiplayer_intrusive_queue_append_node_and_maintain_head_tail_count,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Tiny intrusive queue append helper over the singly linked queue layout `[queue+0x00=head]`, `[queue+0x04=tail]`, and `[queue+0x08=count]`. When the caller supplies a predecessor node in the first stack argument it splices the new node after that predecessor and increments the queue count; otherwise it appends at the queue tail or seeds the head when the queue was empty. Current grounded callers include the `0x00469d30` sidecar-dispatch branch and later transport-side queue helpers at `0x00522c90` and `0x00523633`, so this is the common intrusive append primitive beneath the multiplayer preview-owner and session-event transport families rather than a one-off local list splice.","objdump + caller inspection + local disassembly + intrusive-queue-layout correlation"
0x00469700,27,multiplayer_preview_dataset_stage_selected_path,shell,thiscall,inferred,objdump + caller xrefs,3,Small Multiplayer preview-dataset helper that copies one caller-supplied selected path string into the dataset-local staging buffer at `[this+0x8f48]`. Current grounded callers feed it the active session-entry path from the live session list before later preview or launch-side dataset work.,objdump + caller xrefs
0x00469720,221,multiplayer_preview_dataset_service_frame,shell,thiscall,inferred,objdump + caller xrefs,3,"Recurring shell-frame service for the Multiplayer preview dataset rooted at `0x006cd8d8`. When the gating global at `0x006cd910` and the dataset render target at `[this+0x9884]` are live it walks the active session list under `0x006d40d0`, formats one roster or status line per entry through the template at `0x005ce1ac`, and then pushes the accumulated text through the render/update helper at `0x005519f0` with fixed presentation parameters. The current grounded caller is `shell_state_service_active_mode_frame`, which makes this a shell-owned per-frame refresh path for multiplayer preview text rather than a transport I/O loop.",objdump + caller xrefs + strings
0x00469800,144,multiplayer_preview_dataset_acquire_pooled_block_or_heap_fallback,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Preview-dataset allocation helper beneath the request and sidecar-record families. For sizes up to `0x300` it spin-locks the small pool guard at `0x006cd940`, tries to pop one cached block from the dataset-local free-list owner at `[this+0x8f3c]`, and falls back to `0x0053b070(size)` when the pool is empty; larger requests always take the heap path. The companion release branch at `0x00469890` returns owned-span pointers back into the same pool when they fall inside `[this+0x8f40 .. this+0x8f40+0x48000)`. Current grounded callers include the broader transport submitter `0x00469d30`, the named callback-descriptor builders `0x00469930` and `0x00469a50`, and later preview-dataset helpers around `0x0046a31f`, `0x0046a60c`, and `0x0046ae24`, which makes this the local pooled-block owner for the Multiplayer preview dataset rather than a generic allocator.","objdump + caller inspection + local disassembly + pooled-span correlation + preview-dataset free-list correlation"
0x00469930,176,multiplayer_preview_dataset_append_named_callback_descriptor,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Builds one fixed-size named callback descriptor and appends it to the preview-dataset intrusive list at `[this+0x8f28]`. The helper acquires one `0xa4`-byte node from the local pool at `[this+0x8f20]`, zeroes the full record, stores the caller-supplied selector id at `[node+0x14]`, stores the two callback or payload dwords at `[node+0x04/+0x08]`, copies the caller string into `[node+0x18]`, and then appends the node through the standard intrusive-list head, tail, and count layout. The current grounded owner is the fixed registration block `0x00473a60`, which repeatedly seeds selector ids `1..0xa` from fixed name and callback pairs, so this is now best read as the preview-dataset named callback-descriptor append helper rather than an anonymous list insert.","objdump + caller inspection + local disassembly + registration-block correlation + intrusive-list correlation"
0x004699e0,48,multiplayer_preview_dataset_find_named_callback_payload_by_selector,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small lookup helper over the named callback-descriptor list at `[this+0x8f28]`. It walks the intrusive list, matches the caller-supplied selector id against `[node+0x14]`, and returns the payload or callback dword at `[node+0x04]` or `0` when no match is present. Current grounded callers include the preview-dataset service lane at `0x0046b545`, so this is the paired selector lookup beneath the `0x00469930` descriptor-registration family rather than a generic keyed search.","objdump + caller inspection + local disassembly + descriptor-field correlation"
0x00469a50,160,multiplayer_preview_dataset_append_named_ui_request_record,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Builds one variable-size named UI-request record and appends it to the preview-dataset intrusive list at `[this+0x8f2c]`. The helper acquires `strlen(name)+0x21` bytes through `multiplayer_preview_dataset_acquire_pooled_block_or_heap_fallback` `0x00469800`, stores the caller-supplied request dwords at `[node+0x04/+0x08/+0x10/+0x14/+0x18]`, zeroes the transient field `[node+0x1c]`, copies the request label or text into `[node+0x20]`, and then appends the record to the dataset-local list. Current grounded callers package Multiplayer.win text and control updates such as the control-`0x69` mode publish path at `0x004ee4c0`, the selected-map and status branches around `0x0046f560..0x0046f837`, and several later preview-update branches, which keeps this bounded as the preview-dataset named UI-request append helper rather than a transport send.","objdump + caller inspection + local disassembly + UI-request-list correlation + Multiplayer.win control-update correlation"
0x00469d30,1268,multiplayer_preview_dataset_submit_transport_request,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,4,"Broad preview-owner request submitter used by the Multiplayer preview dataset at `0x006cd8d8` and several auxiliary shell-side async branches. The helper accepts an opcode or request id on the first stack slot, a 16-bit selector on the second, payload pointer and length on the next pair, flag dword on the fifth slot, and an optional auxiliary pointer on the sixth. On the selector-`1` fast path, when dataset state `[this+0x985c] == 1` and the live session gate `0x00521670` reports no active sessions, it bypasses the heavier transport packaging and forwards the supplied text directly through `multiplayer_send_session_event_text_selector0` `0x00469660`. Otherwise it spin-locks the global submit guard `0x006cd960`, optionally copies payload bytes into a local `0x1018` scratch block when flag bit `0x10` is set, optionally allocates one sidecar request object through `multiplayer_preview_dataset_acquire_pooled_block_or_heap_fallback` `0x00469800` when flag bit `0x04` is set, tags that sidecar with selector, size, flags, and payload bytes, and enqueues it through the callback queue rooted at `0x00521d40()->[+0x64]->[+0x04]` using `multiplayer_intrusive_queue_append_node_and_maintain_head_tail_count` `0x00469690`. The helper then updates the global payload counters `0x006cd930/0x006cd934` and dispatches either a direct small-payload request or the slower packed path through `0x00553000/0x00552ff0` into `0x00521dc0`, setting the extra high dispatch bit `0x80000000` on the packed branch. Current grounded callers include the `.gmt` save-side branch in `shell_map_file_world_bundle_coordinator` `0x00445de0`, `BuildingDetail.win` auxiliary sync at `0x004b9e10`, `Start New Company...` side-owner submission at `0x0047d120`, `CompanyDetail.win` async multiplayer actions, the multiplayer preview control publisher `0x004ee4c0`, and many preview-dataset-side update branches between `0x0046b431` and `0x00473bc9`, which makes this the shared preview-owner transport submitter rather than a window-local control helper.","objdump + caller xrefs + local disassembly + sidecar-dispatch correlation + transport-submit correlation + multiplayer-preview-owner correlation"
0x0046a030,224,multiplayer_preview_dataset_stage_profile_text_selected_path_and_sync_session_state,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Stages the local profile text and selected-path string into the preview dataset and then synchronizes that state into the session-side helper path when no live multiplayer session object is present at `0x006d40dc`. The helper clears or resolves the small arming latch at `[this+0x8f18]`, copies the caller profile text into `[this+0x8e10]`, copies the caller path into `[this+0x8f48]`, stores one boolean derived from the optional third pointer into global `0x006cd928`, and then forwards the staged strings plus the optional pointer into the lower session helper `0x005238e0`. When the session-event transport rooted at `0x006cd970` is live it also forces the paired status-pump and flush follow-ons through `0x0058d9d0` and `0x0058e1f0`. Current grounded caller is the action-`2` branch inside `multiplayer_dispatch_requested_action` `0x004ef960`, where it seeds the active preview dataset from the staged Multiplayer.win text buffers before the preview-mode refresh path.","objdump + caller inspection + local disassembly + staged-buffer correlation + action-2 correlation"
0x0046a110,131,multiplayer_preview_dataset_match_named_field_slot_copy_profile_text_and_probe_selection,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Action-`3` helper above the preview-dataset field-slot table. The function scans all `0x80` `0x11c`-byte rows rooted at `[this+0x10]`, comparing the caller-supplied key string against the per-row name field at `row+0x80`; on a match it copies the row's primary text field back into dataset buffer `[this+0x8e10]`. It then seeds dataset mode `[this+0x0c] = 1`, forwards the caller's strings into the lower session helper `0x00523af0`, and upgrades that mode to `2` when the helper reports a negative result. Current grounded caller is the action-`3` branch inside `multiplayer_dispatch_requested_action` `0x004ef960`, which uses this helper immediately after promoting the staged text buffers into the active preview dataset.","objdump + caller inspection + local disassembly + field-slot correlation + action-3 correlation"
0x0046a1a0,85,multiplayer_preview_dataset_ensure_field_slot_table_initialized,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Lazy initializer for the fixed `0x80 * 0x11c` field-slot table rooted at `[this+0x10]` inside the preview dataset. On first use it zeroes the full `0x2380`-byte table, clears `[this+0x8f10]`, marks `[this+0x8f18] = 1`, and then takes one of two follow-ons: when dataset state `[this+0x985c]` is zero it primes the session-side helper through `0x005223d0`; otherwise it re-enters `multiplayer_register_session_event_cache_fields` `0x00469520`. The helper always returns the base pointer `[this+0x10]`. Current grounded callers include the staged-text commit and roster-refresh paths at `0x004ee2b2` and `0x004ee765`, which then index `0x11c`-byte rows and copy the embedded strings at row offset `0x84`, so this is the clearest current owner for the preview-dataset field-slot table rather than another generic reset stub.","objdump + caller inspection + local disassembly + field-slot-table correlation + cache-field-registration correlation"
0x0046b6d0,163,multiplayer_preview_dataset_touch_current_session_year_bucket_and_return_staged_tuple,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Session-side helper over the staged tuple at `[this+0x9048]`. When the live world root `0x006cec78`, its companion pointer `[world+0x19]`, and the caller's stack flag are all present, the helper derives one key from the staged tuple through `0x0051d3c0`, resolves the current live session record through `0x005216c0/0x00521d60`, ensures one keyed bucket exists in that session record's hash owner at `[session+0x2580]` through `0x0053dae0` or the local create path `0x0046ab10`, increments that bucket, and then republishes the current-session selector through `0x005216d0`. On any failed precondition it skips the bucket touch and simply returns the staged tuple pointer `[this+0x9048]` or `0`. Current grounded callers include the broad selector-handler family registered by `0x00473280` and the launch-side branches around `0x0046f672/0x0046f7a0`, so this is the safest current structural read beneath the preview-dataset launch/service layer.","objdump + local disassembly + caller inspection + staged-tuple correlation + session-bucket correlation"
0x0046b910,219,multiplayer_preview_dataset_prune_session_buckets_below_current_year_key,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Threshold-prune helper over the keyed session bucket owner at `[arg+0x2580]`. It derives one current key either from the caller's optional second argument or from the active world tuple at `[0x006cec78+0x0d]` through `0x0051d3c0`, then repeatedly asks `0x0053db20` with comparator `0x00468ac0` for the next smaller keyed bucket, resolves that bucket through `0x0053d9e0`, drains every queued node in it, and frees those nodes through `multiplayer_preview_dataset_release_pooled_block_or_heap_span` `0x00469890`. The helper uses scratch global `0x006cd968` as the current selected key during the sweep. Current grounded callers are the broader current-session service body `0x0046b9f0` and the preview handlers around `0x0046f6b9/0x0046f708`, so this is the clearest current bucket-prune owner beneath the dataset launch/session maintenance family rather than a generic hash-table walk.","objdump + local disassembly + caller inspection + keyed-bucket-prune correlation"
0x0046b9f0,592,multiplayer_preview_dataset_service_current_session_buckets_and_publish_selector0x67,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Broader current-session service slice beneath the multiplayer preview dataset. It optionally timestamps its own service cost when `0x006cd900 == 1`, zeros the total-node counter `[this+0x9890]`, resolves the live session owner through `0x00521d40`, copies and normalizes the current world tuple into `[this+0x9048/+0x904c]` through `0x0051d5a0`, prunes older keyed buckets through `0x0046b910`, refreshes neighboring preview state through `0x0046a590` and `0x00473bf0`, and then looks up the current keyed bucket inside `[session+0x2580]`. For each queued node in that current bucket it increments `[this+0x9890]`, counts the subset not marked by byte `+0x09 == 0x67` and flag bit `+0x0b & 0x04`, routes the entry through `0x00522050` and `0x0046ac00`, and frees the node through `0x00469890`. After the loop it accumulates the unmarked subset into `[this+0x987c]`, restores the shared shell status/tool stack through `0x004423a0/0x004423d0`, and when the live session-event transport is active it packages one selector-`0x67` request through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` using the staged key at `[this+0x8f38]`. Current grounded callers include the simulation-side wrapper at `0x0040aa7a` and the broader launch/service family around `0x0046b780`, so this is the safest current owner for current-session bucket service rather than a generic preview refresh.","objdump + local disassembly + caller inspection + keyed-bucket correlation + selector-0x67 publish correlation"
0x0046bc40,563,multiplayer_preview_dataset_release_owned_lists_transients_and_session_side_state,shell,thiscall,inferred,objdump + local disassembly + caller inspection,4,"Primary release-side teardown body for the Multiplayer preview dataset rooted at `0x006cd8d8`. It first runs the narrower internal cleanup at `0x0046d240`, releases the dataset render target `[this+0x9884]` through `0x0053c000`, conditionally notifies the live session object through `0x005217b0/0x005216a0`, and re-enters the local transport-side sweep `0x0046b910` when the current session list is still live. After that it tears down the session-event transport-side helper path through `multiplayer_teardown_session_event_transport` `0x00469450` and `0x00523200`, walks and frees every node in the variable-size request list `[this+0x8f2c]`, releases the keyed callback owner `[this+0x8f20]`, request buffer `[this+0x8f24]`, semicolon-name owner `[this+0x9050]`, pooled free-list owner `[this+0x8f3c]`, backing pool span `[this+0x8f40]`, fixed descriptor list `[this+0x8f28]`, auxiliary keyed owner `[this+0x04]`, and finally the global helper at `0x006cd8e0`. It also clears the core dataset latches `[this+0x00]`, `[this+0x0c]`, `[this+0x8f18]`, `[this+0x8f30]`, and `[this+0x9054]`. Current grounded callers are the broader reset or constructor path `0x0046be80` and the full shutdown wrapper `0x0046c230`, which makes this the concrete dataset release body rather than a transport-only destructor.","objdump + local disassembly + caller inspection + teardown-correlation + owned-list-release correlation"
0x0046be80,938,multiplayer_preview_dataset_construct_reset_globals_and_seed_callback_owners,shell,thiscall,inferred,objdump + local disassembly + caller inspection,4,"Full constructor or reset owner for the Multiplayer preview dataset at `0x006cd8d8`. It begins by re-entering `multiplayer_preview_dataset_release_owned_lists_transients_and_session_side_state` `0x0046bc40`, then clears the surrounding launcher and preview globals (`0x006cd91c`, `0x006cd924..0x006cd92c`, `0x006cd8e4..0x006cd904`, `0x006ae4cc..0x006ae4d4`, and related `0x005f2b38/40` latches), allocates or reuses the small global helper at `0x00d973b4`, installs it into `[this+0x00]`, and requires the helper vtable state at `0x00557bc0 == 1` before proceeding. It then ensures the live session object at `0x006d40d0`, publishes one local version scalar through `0x00521910`, allocates the auxiliary keyed owner `[this+0x04]`, zeroes the fixed field-slot table `[this+0x10]`, allocates the variable request buffer `[this+0x8f24]`, the keyed callback owner `[this+0x8f20]`, the fixed descriptor list owner `[this+0x8f28]`, the UI-request list owner `[this+0x8f2c]`, the pooled backing span `[this+0x8f40]`, the pooled free-list owner `[this+0x8f3c]`, the semicolon-name helper `[this+0x9050]`, and the render target `[this+0x9884]`. Before returning it clears staged strings `[this+0x8f48]` and `[this+0x905c]`, seeds marker words `[this+0x9860]` and `[this+0x9864..+0x9870]` to `-1`, runs the callback seeding pass `0x00473280`, registers the fixed named descriptor block `0x00473a60`, and when the caller asks for the live branch it re-enters `multiplayer_register_session_event_callbacks` `0x0046a900`, storing the resulting mode in `[this+0x985c]`. Current grounded callers are the action-`2` and action-`3` reset branches inside `multiplayer_dispatch_requested_action` `0x004ef960`, so this is now the real preview-dataset constructor/reset owner above those action handlers rather than a loose helper cluster.","objdump + local disassembly + caller inspection + reset-global correlation + callback-owner correlation + action-dispatch correlation"
0x0046b780,368,multiplayer_preview_dataset_service_launch_state_and_warn_out_of_sync,shell,thiscall,inferred,objdump + caller xrefs + strings + callsite inspection,4,"Services one higher-level launch or preview transition slice on the Multiplayer preview dataset rooted at `0x006cd8d8`. At entry it checks global `0x006cd91c` and, when armed, formats localized id `3879` `Out of Sync` through `0x5193f0` and pushes it into the shell status presenter at `0x5386e0` with timeout `0xbb8`; this is the current grounded owner of that string and it is not part of the station-detail overlay. The same helper then gates on preview and launcher globals `0x006cd8dc`, `0x006ce9b8`, `0x006ce9c4`, and shell-state latches under `0x006cec78`, drives one modal shell branch through `0x482150`, timestamps `[this+0x9058]`, chains the internal dataset-side helpers at `0x46af70`, `0x46b0c0`, `0x46ad80`, `0x46aeb0`, `0x469b00`, and `0x46a590`, and now has a tighter launch-side tail: when `0x006ce9c4` is armed the inner branch at `0x0046b8bc` allocates or clears one active-mode object through `0x53b070/0x4336d0`, publishes it into `0x006cec78`, runs `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890` with stack args `(0, 0)`, then clears `[0x006cec74+0x6c]` and only after that re-enters `shell_map_file_entry_coordinator` `0x00445ac0` through staged buffer `0x006ce630` plus flag dword `0x006ce9c0`. Current grounded callers include the multiplayer-side service loop around `0x004373c5` and `0x00437435`, plus later shell-side branches at `0x00483638`, `0x00483d79`, and `0x00484054`.","objdump + caller xrefs + strings + callsite inspection + multiplayer-preview correlation + launch-tail disassembly"
0x0046a6c0,307,multiplayer_session_event_publish_registration_field,shell,unknown,inferred,ghidra-headless + objdump,3,"Switch-driven session-event callback that publishes one Multiplayer.win registration or status field into the destination builder passed on the stack. Depending on selector `EDX` it now clearly includes the local executable version string through `runtime_query_cached_local_exe_version_string` `0x00482d80` on runtime root `0x006cec74`, the profile text at `0x006cd8d8+0x8e10`, the constant `0x2328`, the live session count from `0x006d40d0`, the field at `[0x006d1270+0x3b6]`, the active profile string at `[0x006cec7c+0x44]`, or fixed strings such as `Initializing...`, `openstaging`, and `closedplaying`; unsupported selectors fall back to the fixed token at `0x005c87a8`.","ghidra + rizin + llvm-objdump + strings + registration-field correlation"
0x0046a830,194,multiplayer_session_event_retry_with_random_player_name,shell,unknown,inferred,ghidra-headless,3,Registration-side callback that increments the retry counter at `0x006cd984` and on early retries formats a randomized `RT3Player%d` name into `0x006ae0c0` sanitizes it into a local notification object notifies the current Multiplayer.win owner and forwards that object through multiplayer_transport_set_local_name. On the first retry it also routes request id `5` or `6` through multiplayer_set_pending_session_substate depending on the incoming status flag; after 25 retries it resets `0x006cd984` and `0x006cd974` and calls multiplayer_transport_reset_and_maybe_shutdown instead.,ghidra + rizin + llvm-objdump + strings
0x0046a900,522,multiplayer_register_session_event_callbacks,shell,thiscall,inferred,ghidra-headless,4,Builds and registers the Multiplayer.win session-event callback table rooted at the local block on `[esp+0x28]`. The function seeds slots with multiplayer_session_event_forward_action1_request multiplayer_session_event_publish_pair_chat_template multiplayer_session_event_publish_action2_single_name multiplayer_session_event_publish_action2_pair multiplayer_session_event_forward_action4_request multiplayer_session_event_forward_action7_request multiplayer_session_event_noop_12byte_stub multiplayer_session_event_publish_registration_field multiplayer_session_event_publish_status_value multiplayer_session_event_publish_fixed_status_text multiplayer_session_event_seed_control_id_list multiplayer_session_event_query_session_count multiplayer_session_event_noop_8byte_stub multiplayer_session_event_latch_status_code multiplayer_session_event_notify_owner_and_queue_action8 multiplayer_init_session_event_transport_state and multiplayer_session_event_retry_with_random_player_name. It allocates the transport callback object under `0x006cd970` stages the session name into the local descriptor block and then finishes registration through multiplayer_transport_register_callback_table which in turn routes through multiplayer_transport_attach_callback_table_descriptor multiplayer_transport_enqueue_descriptor_block_record and multiplayer_transport_dispatch_callback_table_binding.,ghidra + rizin + llvm-objdump + strings
0x0046c230,80,multiplayer_shutdown_preview_dataset_session_object_and_global_helper,shell,thiscall,inferred,objdump + local disassembly + caller xrefs,4,"Final multiplayer-side shutdown wrapper above the preview dataset release body. It first re-enters `multiplayer_preview_dataset_release_owned_lists_transients_and_session_side_state` `0x0046bc40`, then releases the live session object at `0x006d40d0` through `0x00521590`, clears that global, releases the small shared helper at `0x00d973b4` through `0x00557b70`, and clears that global too. Current grounded callers include the broader shell shutdown and mode-transition branches at `0x004364e4`, `0x0048364d`, `0x00483d8e`, `0x00484073`, `0x004843dc`, `0x00484556`, `0x004dcc96`, `0x004edc50`, `0x004ef2b1`, `0x004ef31b`, `0x004ef823`, and `0x004f0a62`, which makes this the full multiplayer preview/session shutdown wrapper rather than just another dataset reset.","objdump + local disassembly + caller xrefs + global-helper shutdown correlation"
0x0046c360,32,multiplayer_route_chat_line,shell,cdecl,inferred,ghidra-headless,3,Routes one multiplayer chat line through the active transport object at `0x006cec78` when present or falls back to the local Multiplayer.win chat publisher otherwise. The transport path forwards the supplied text into 0x4554e0 with fixed mode arguments `5 1 0`; the local fallback tail-calls multiplayer_publish_wrapped_chat_message.,ghidra + rizin + llvm-objdump
0x0046c390,42,multiplayer_preview_dataset_publish_control_0x109_from_payload_dword,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Small selector-handler callback beneath the preview-dataset registration table. When the live shell profile at `0x006cec7c` exists, the helper packages the payload dword from `[msg+0x08]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` using fixed request kind `1`, fixed control id `0x0109`, and selector `2`. This is therefore the direct control-`0x109` publish leaf rather than another generic transport wrapper.","objdump + local disassembly + caller inspection + selector-handler correlation + control-0x109 correlation"
0x0046c3c0,96,multiplayer_preview_dataset_arm_launch_latches_publish_fixed_session_token_and_optionally_clear_profile_ready_bit,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback in the preview-dataset table that arms several launch-side latches at once. The helper calls `0x004c8670`, sets globals `0x006cd90c = 1` and `0x006cd8e8 = 1`, publishes the fixed session-event token through `multiplayer_publish_session_event_fixed_token` `0x004694c0`, clears `0x006cd96c`, and when preview-valid latch `0x006ce9bc` is nonzero it also clears profile byte `[0x006cec7c+0x97]` and sets global `0x006ce9c4 = 1`. This is the clearest current owner for the fixed-token plus launch-latch arm path beneath the selector-handler family.","objdump + local disassembly + caller inspection + launch-latch correlation + fixed-token correlation"
0x0046c420,827,multiplayer_apply_session_payload_slab_into_shell_root_and_refresh_dependents,shell,cdecl,inferred,objdump + local disassembly + caller inspection,4,"Large selector-handler callback that copies one incoming payload slab from `[msg+0x08]` into the live shell root at `0x006cec74`. The body performs a long fixed-offset copy into shell fields spanning startup, selection, and session-related lanes, then forces one shell-state refresh through `0x00484910(0)` and, when companion root `0x006ada8c` exists, re-enters `0x00464170` to refresh dependent world-side state. This is therefore the clearest current session-payload apply owner beneath the multiplayer callback table rather than a smaller field toggle.","objdump + local disassembly + caller inspection + slab-copy correlation + shell-refresh correlation"
0x0046c760,3,multiplayer_selector_handler_return_true_stub,shell,cdecl,inferred,objdump + local disassembly,1,"Literal selector-handler stub that returns `1` immediately with no side effects. It currently appears in the preview-dataset callback table seeded by `0x00473280`.","objdump + local disassembly + selector-handler correlation"
0x0046c770,65,multiplayer_preview_dataset_publish_session_field_0x48_with_selector7,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that resolves the live session object at `0x006d40d0`, reads field `[session+0x48]`, and packages that value together with payload pointer `[msg+0x08]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` using selector `7` and request kind `8`. This is the current grounded publish leaf for session field `0x48` beneath the callback table.","objdump + local disassembly + caller inspection + selector-handler correlation + session-field correlation"
0x0046c7c0,71,multiplayer_session_entry_update_elapsed_pair_and_republish,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that resolves one live session entry by key `[msg+0x04]`, rewrites the paired elapsed or timestamp dwords at `[entry+0x54/+0x58]` from the incoming payload, and then republishes the session list through `0x005216d0`. This is the clearest current owner for the per-entry elapsed-pair update beneath the callback table.","objdump + local disassembly + caller inspection + session-entry correlation + elapsed-pair correlation"
0x0046c810,33,multiplayer_forward_payload_dword_into_shell_owner_refresh_pair,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Small selector-handler callback that forwards the payload dword at `[msg+0x08]` into shell-owner helpers `0x0043a070` and `0x0043ca20` when shell root `0x0062be68` is live. Current evidence only grounds the forwarding behavior, so the label stays structural.","objdump + local disassembly + caller inspection + shell-owner correlation"
0x0046c840,53,multiplayer_session_entry_set_flag_0x08_and_republish,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that resolves one live session entry by key `[msg+0x04]`, sets bit `0x08` in entry flags `[entry+0x5c]`, and republishes the session list through `0x005216d0`. This is the current grounded owner for the flag-`0x08` session-entry latch beneath the callback table.","objdump + local disassembly + caller inspection + session-entry-flag correlation"
0x0046c870,71,multiplayer_session_entry_toggle_flag_0x01_from_payload_byte_and_republish,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that resolves one live session entry by key `[msg+0x04]`, reads the first byte of payload `[msg+0x08]`, sets or clears bit `0x01` in `[entry+0x5c]` accordingly, and republishes the session list through `0x005216d0`. This is the current grounded owner for the flag-`0x01` entry-toggle path beneath the callback table.","objdump + local disassembly + caller inspection + session-entry-flag correlation"
0x0046c8c0,201,multiplayer_apply_one_or_many_embedded_session_field_updates_and_republish,shell,cdecl,inferred,objdump + local disassembly + caller inspection,4,"Broader selector-handler callback over the live session-entry table. Guarded by globals `0x006cd8ec` and `0x006cd918`, the helper either treats payload `[msg+0x08]` as one single embedded field-update record or, when the first payload byte is `0xff`, as a small count-prefixed table of such records. It applies each embedded record through local updater `0x00468c10` and then republishes the session list through `0x005216d0`. This is the clearest current owner for batched embedded session-field updates beneath the selector-handler family.","objdump + local disassembly + caller inspection + embedded-record correlation + session-entry correlation"
0x0046c990,63,multiplayer_decrement_session_field_0x74_and_publish_selector0x0f,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that resolves the live session object at `0x006d40d0`, decrements field `[session+0x74]`, and packages the decremented value together with payload `[msg+0x08]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` using selector `0x0f` and request kind `4`. This is the current grounded decrement-and-publish owner for that session-side countdown lane.","objdump + local disassembly + caller inspection + session-field correlation + selector-0x0f correlation"
0x0046c9d0,7,multiplayer_publish_payload_dword0_through_0x518c70,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler leaf that loads dword `[msg+0x08]` and forwards it directly into `0x00518c70`. Current evidence only grounds the forwarding edge, so the label stays structural.","objdump + local disassembly + selector-handler correlation"
0x0046c9e0,3,multiplayer_selector_handler_return_true_stub_2,shell,cdecl,inferred,objdump + local disassembly,1,"Second literal selector-handler stub that returns `1` immediately with no side effects.","objdump + local disassembly + selector-handler correlation"
0x0046c9f0,18,multiplayer_forward_payload_ptr_into_0x50c150_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x0050c150` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046ca10,18,multiplayer_forward_payload_ptr_into_0x50c1f0_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x0050c1f0` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046ca30,18,multiplayer_forward_payload_ptr_into_0x4c66f0_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x004c66f0` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046ca50,18,multiplayer_forward_payload_ptr_into_0x4c6760_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x004c6760` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046ca70,18,multiplayer_forward_payload_ptr_into_0x4c67d0_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x004c67d0` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046ca90,18,multiplayer_forward_payload_ptr_into_0x4c6840_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x004c6840` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046cab0,18,multiplayer_forward_payload_ptr_into_0x4c68a0_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x004c68a0` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046cad0,18,multiplayer_forward_payload_ptr_into_0x4c6910_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x004c6910` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046caf0,18,multiplayer_forward_payload_ptr_into_0x4c6990_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x004c6990` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046cb10,18,multiplayer_forward_payload_ptr_into_0x4c6a00_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x004c6a00` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046cb30,18,multiplayer_forward_payload_ptr_into_0x4b8320_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x004b8320` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046cb50,18,multiplayer_forward_payload_ptr_into_0x4b8380_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x004b8380` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046cb70,18,multiplayer_forward_payload_ptr_into_0x4b83e0_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x004b83e0` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046cb90,18,multiplayer_forward_payload_ptr_into_0x513050_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x00513050` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046cbb0,18,multiplayer_forward_payload_ptr_into_0x511490_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x00511490` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046cbd0,18,multiplayer_forward_payload_ptr_into_0x514620_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x00514620` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046cbf0,101,multiplayer_hash_12byte_payload_queue_selector0x48_request_and_record_match_key,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that copies a 12-byte payload from `[msg+0x08]`, hashes it through `0x0053d870`, inserts the result into local store `0x00468ca0`, and then submits the same payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x48`. This is the clearest current owner for the 12-byte selector-`0x48` hashed request path beneath the callback table.","objdump + local disassembly + caller inspection + selector-0x48 correlation + hashed-payload correlation"
0x0046cc60,97,multiplayer_hash_10byte_payload_queue_selector0x4c_request_and_record_match_key,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback parallel to `0x0046cbf0`. It copies a 10-byte payload from `[msg+0x08]`, hashes it through `0x0053d870`, inserts the result into local store `0x00468ca0`, and submits the payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x4c`. This is the current grounded owner for the 10-byte selector-`0x4c` hashed request path.","objdump + local disassembly + caller inspection + selector-0x4c correlation + hashed-payload correlation"
0x0046ccd0,3,multiplayer_selector_handler_return_true_stub_3,shell,cdecl,inferred,objdump + local disassembly,1,"Third literal selector-handler stub that returns `1` immediately with no side effects.","objdump + local disassembly + selector-handler correlation"
0x0046cce0,46,multiplayer_reset_world_runtime_small_branch_set_launch_warning_latch_and_snapshot_tick,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that, when live world root `0x006cec78` exists, re-enters `0x00434680(0,0,0)`, sets global `0x006cd91c = 1`, and snapshots the current tick from `0x0051d890` into globals `0x006ce990` and `0x006cd8e4`. This is the current grounded owner for one small launch-warning latch and timestamp path beneath the callback table.","objdump + local disassembly + caller inspection + launch-latch correlation + tick-snapshot correlation"
0x0046cd10,28,multiplayer_store_payload_dword0_into_pending_action_value_and_set_state3,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Small selector-handler callback that stores payload dword `[msg+0x08]` into global `0x006d1284` and sets pending state `0x006d1280 = 3`. Current evidence grounds this as one direct pending-action seed beneath the callback table.","objdump + local disassembly + caller inspection + pending-state correlation"
0x0046cd30,218,multiplayer_store_current_session_string_and_scalars_and_publish_selector0x54,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that resolves the current live session entry, copies a NUL string from payload `[msg+0x08]` into entry field `[+0x258c]`, stores one current world-derived scalar into `[+0x268c]`, stores constant `0x006226d0` into `[+0x2690]`, builds one local `0x2c`-byte record, and submits that record through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x54`. This is the current grounded owner for the selector-`0x54` session-string publish path.","objdump + local disassembly + caller inspection + session-entry correlation + selector-0x54 correlation"
0x0046ce10,117,multiplayer_apply_string_and_three_scalars_into_current_session_entry_and_optionally_set_ready_flag,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that copies one payload string plus three following dwords into the current live session entry fields `[+0x258c/+0x268c/+0x2690/+0x2694]`, optionally sets bit `0x01` in entry flags `[+0x5c]`, and republishes the session list through `0x005216d0`. This is the current grounded current-session update companion to the selector-`0x54` submitter at `0x0046cd30`.","objdump + local disassembly + caller inspection + session-entry correlation + current-session correlation"
0x0046ce90,119,multiplayer_advance_pending_action_state_machine_from_payload_byte,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that advances pending-action globals `0x006d127c`, `0x006d1280`, and `0x006d128c` based on the first payload byte at `[msg+0x08]`. The grounded branches switch `0x006d1280` among values `8`, `0xd`, and `9`, which makes this a real pending-state owner beneath the callback table rather than another passive notifier.","objdump + local disassembly + caller inspection + pending-state correlation + state-machine correlation"
0x0046cf10,49,multiplayer_session_entry_set_flag_0x04,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that resolves one live session entry by key `[msg+0x04]` and sets bit `0x04` in entry flags `[entry+0x5c]`. This is the current grounded owner for the flag-`0x04` session-entry latch beneath the callback table.","objdump + local disassembly + caller inspection + session-entry-flag correlation"
0x0046cf40,44,multiplayer_copy_payload_bytes_into_world_runtime_block_0x66be,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that bulk-copies payload bytes from `[msg+0x08]` with count `[msg+0x0c]` into live world root `0x006cec78+0x66be`. Current evidence grounds the destination block but not its exact semantic owner, so the label stays structural.","objdump + local disassembly + caller inspection + world-runtime-block correlation"
0x0046cf70,56,multiplayer_clear_flag_0x01_on_all_live_session_entries,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that walks the live session list from `0x00521680`, clears bit `0x01` in each entry flags word `[entry+0x5c]`, and then republishes the full list through `0x005216a0`. This is the current grounded global clear path for the entry flag toggled by `0x0046c870` and `0x0046ce10`.","objdump + local disassembly + caller inspection + session-entry-flag correlation"
0x0046cfa0,3,multiplayer_selector_handler_return_true_stub_4,shell,cdecl,inferred,objdump + local disassembly,1,"Fourth literal selector-handler stub that returns `1` immediately with no side effects.","objdump + local disassembly + selector-handler correlation"
0x0046cfb0,37,multiplayer_toggle_selector0x67_batch_build_guard_and_call_0x444dd0,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Small selector-handler callback that sets global guard `0x006ce9b8 = 1`, calls `0x00444dd0` with payload fields `[msg+0x08]+8` and `[msg+0x08]+4`, and then clears that same guard. Current evidence only grounds the guard and dispatch shape, so the label stays structural.","objdump + local disassembly + caller inspection + guard-toggle correlation"
0x0046cfe0,163,multiplayer_allocate_transfer_progress_slot_copy_0x5c_record_and_optionally_format_label,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback over the fixed ten-slot transfer-progress table rooted at `0x006ce2e8` with `0x5c`-byte records. It scans for the first free slot, copies one full `0x5c` record from payload `[msg+0x08]` into that slot, and when payload dword `[+0x4c]` is nonzero it formats one auxiliary string through `0x004839e0` and `0x00518de0`, storing the resulting pointer in the slot side field. This is the current grounded allocate-and-seed owner for the local transfer-progress table.","objdump + local disassembly + caller inspection + transfer-progress-table correlation"
0x0046d090,318,multiplayer_append_transfer_progress_payload_update_and_publish_percent_text,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback over the same ten-slot transfer-progress table. When the incoming count word is nonzero it finds the matching `0x5c` slot record in `0x006ce2e8`, appends the payload body through `0x005a276f`, updates slot counters near `[slot+0x54]`, and, when shell status owner `0x006d401c` is live, computes one percentage string through localized id `0x10f6` and publishes it through `0x005387a0`. This is the current grounded progress-update owner for the local transfer table.","objdump + local disassembly + caller inspection + transfer-progress-table correlation + percent-text correlation"
0x0046d1d0,97,multiplayer_clear_transfer_progress_slot_and_release_optional_label,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that finds the matching transfer-progress slot in the fixed ten-slot table rooted at `0x006ce290/0x006ce2e8`, frees the optional per-slot label string when present, and then zeroes the full `0x17`-dword slot record. This is the current grounded clear path for the local transfer-progress table.","objdump + local disassembly + caller inspection + transfer-progress-table correlation"
0x0046d230,10,multiplayer_set_global_transfer_completion_latch,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny selector-handler callback that sets global latch `0x006ce9c8 = 1` and returns. Current evidence only grounds the latch store itself.","objdump + local disassembly + caller inspection + latch-store correlation"
0x0046d240,29,multiplayer_release_selector0x71_batch_staging_blob,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Small cleanup helper that releases the optional staging blob at `0x006ce994` through `0x005a1740` and clears that global. Current local evidence ties it to the same selector-`0x71` batch-record family rooted at `0x006cd990/0x006ce9a0`, so this is the safest current structural read.","objdump + local disassembly + caller inspection + selector-0x71-batch correlation"
0x0046d260,72,multiplayer_append_selector0x71_accumulated_record,shell,fastcall,inferred,objdump + local disassembly + caller inspection,3,"Appends one fixed-width accumulated record to the selector-`0x71` staging band rooted at `0x006cd990`, bounded by count `0x006ce9a0`. The helper rejects new records once the count reaches `0x80`; otherwise it writes a 16-bit leading key from `ECX`, then four caller-supplied dwords into the `0x12`-byte record body, and increments the live record count. This is the direct local append primitive later packaged by `multiplayer_preview_dataset_publish_accumulated_selector0x71_record_batch` `0x00473bf0`.","objdump + local disassembly + caller inspection + selector-0x71-batch correlation + fixed-record correlation"
0x0046d2b0,70,multiplayer_compare_input_scalar_against_rounded_session_build_threshold,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Small predicate that consults the multiplayer preview dataset at `0x006cd8d8`, queries one session-build-derived threshold through `0x0046a4b0`, rounds the caller float argument through the same `+0.0001 * 100 -> round` pattern, and returns `1` when the caller scalar does not exceed that rounded threshold or when no dataset is live. Current evidence grounds the comparison shape but not the exact gameplay meaning, so the label stays structural.","objdump + local disassembly + caller inspection + rounded-threshold correlation"
0x0046d780,111,multiplayer_apply_train_record_fields_into_live_train_entry_by_id,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Applies one small payload record into the live train collection `0x006cfcbc` when the leading id dword resolves and the target train exposes a valid metrics owner through `0x004a77b0`. The helper copies payload dword `[+0x08]` into owner field `[+0x35a]`, forwards payload pair `[+0x0c/+0x10]` into `0x0041c700`, triggers one local refresh through `0x0041ce80(-1,0,0,0)`, and stores payload dword `[+0x04]` into train field `[+0xcc]`. Current local caller is the selector callback wrapper at `0x00472dc0`, so this is the clearest current train-apply leaf beneath that branch.","objdump + local disassembly + caller inspection + live-train-collection correlation + train-apply correlation"
0x0046d980,89,multiplayer_find_collection_0x6ceb9c_entry_index_by_name_string,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Scans indexed collection `0x006ceb9c` and returns the first entry index whose inline string at `[entry+0x08]` matches the caller string through `0x005a57cf`; when no entry matches it returns `0xff`. Current grounded caller is the first fixed named-descriptor callback family beneath `0x0046f4a0`, where the helper supplies one small collection index from a staged name string.","objdump + local disassembly + caller inspection + indexed-collection correlation + string-match correlation"
0x0046d9e0,135,multiplayer_find_collection_0x6ceb9c_entry_index_matching_live_session_string,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Resolves one live session object from `0x006d40d0` through `0x00521d60`, scans indexed collection `0x006ceb9c` for the first entry whose inline string at `[entry+0x08]` matches the session-side string at `[session+0x08]`, returns that entry index or `0xff` when none match, and then releases the same session object through `0x005216d0`. This is the heavier live-session-backed companion to `0x0046d980` and the direct matcher used by `0x0046f8f0`.","objdump + local disassembly + caller inspection + live-session correlation + indexed-collection correlation + string-match correlation"
0x0046d300,560,multiplayer_service_transfer_progress_slots_and_publish_selector0x80_or_0x81,shell,thiscall,inferred,objdump + local disassembly + caller inspection,4,"Services the fixed ten-slot transfer-progress table rooted at `0x006ce290` with `0x5c`-byte records. For every live slot belonging to the current session owner it probes transport progress through `0x00522990`, repeatedly extracts chunk sizes up to `0xf00`, and, when no payload body has been staged yet, submits those chunks through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` using selector `0x80`; when the slot already carries staged body state it instead submits the four-byte follow-on request through selector `0x81`, frees the slot-owned payload buffer, and clears the full slot. In parallel it publishes localized progress text `0x10f5` through shell status owner `0x006d401c` and caches the active dataset pointer in `0x006ce9cc`. This is therefore the concrete service owner above the local transfer-progress table, not just another selector callback.","objdump + local disassembly + caller inspection + transfer-progress-table correlation + selector-0x80-correlation + selector-0x81-correlation"
0x0046d530,117,multiplayer_count_live_transfer_progress_slots,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Counts the currently occupied slots in the fixed transfer-progress pointer strip rooted at `0x006ce2d8..0x006ce614`. The helper returns the number of non-null slot pointers across that ten-entry band. Current evidence grounds this as a local occupancy counter for the same transfer-progress family serviced by `0x0046d300`.","objdump + local disassembly + caller inspection + transfer-progress-table correlation"
0x0046d610,38,multiplayer_preview_dataset_stage_optional_selected_token_from_source_ptr,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small staging helper that writes one optional derived token into `[this+0x8f38]`. When the caller passes a non-null source pointer, the helper transforms it through `0x0051d3c0` and stores the result; otherwise it clears `[this+0x8f38]` to zero. Current grounded callers are the launch-side branches around `0x0046f67e` and `0x0046f7ac`, which use this immediately after `0x0046b6d0` updates the staged tuple path.","objdump + local disassembly + caller inspection + staging-buffer correlation"
0x0046db10,58,multiplayer_fixed_named_callback_root_build_tag0x0a_world_year_tuple,shell,cdecl,inferred,objdump + local disassembly + registration-block correlation,3,"First concrete root in the fixed named-callback block registered by `0x00473a60`. When live world roots `0x006cec78` and `0x0062c120` are present, the helper writes local tag byte `0x0a` plus zero payload into static block `0x006ce9dc`, derives one world-year key from `[world+0x0d]` through `0x0051d3c0`, stores that derived dword into the same block, and returns the block pointer. This is the safest current structural read for the first fixed named-callback root rather than a guessed descriptor caption.","objdump + local disassembly + registration-block correlation + world-year-key correlation"
0x0046db50,60,multiplayer_fixed_named_callback_root_build_tag0x09_from_global_6cd92c_and_world_year_tuple,shell,cdecl,inferred,objdump + local disassembly + registration-block correlation,3,"Second concrete root in the fixed named-callback block beneath `0x00473a60`. When the live world roots are present it writes tag byte `0x09` into static block `0x006ce9e8`, copies global dword `0x006cd92c` into that block, derives the world-year key from `[0x006cec78+0x0d]` through `0x0051d3c0`, stores it, and returns the block pointer. Current evidence grounds the tuple shape but not the higher semantic field name.","objdump + local disassembly + registration-block correlation + world-year-key correlation"
0x0046db90,61,multiplayer_fixed_named_callback_root_build_tag0x07_from_0x46da70_and_world_year_tuple,shell,cdecl,inferred,objdump + local disassembly + registration-block correlation,3,"Third concrete root in the fixed named-callback block beneath `0x00473a60`. When the live world roots are present it writes tag byte `0x07` into static block `0x006ce9f4`, derives one auxiliary dword through local helper `0x0046da70`, derives the world-year key from `[0x006cec78+0x0d]` through `0x0051d3c0`, stores both values into that block, and returns the block pointer.","objdump + local disassembly + registration-block correlation + world-year-key correlation"
0x0046dbd0,317,multiplayer_fixed_named_callback_root_build_tag0x06_from_collection_0x62be10,shell,cdecl,inferred,objdump + local disassembly + registration-block correlation,3,"Concrete root in the fixed named-callback block that builds static record `0x006cea00`. The helper writes tag byte `0x06`, stores the current world-year key from `[0x006cec78+0x0d]`, then walks indexed collection `0x0062be10` and accumulates a weighted total from several per-entry scalar fields together with world-side mode-dependent bonus terms before storing the result and returning the block pointer. This is the current grounded collection-backed fixed named-callback root above the same registration block `0x00473a60`.","objdump + local disassembly + registration-block correlation + indexed-collection correlation"
0x0046dd10,294,multiplayer_fixed_named_callback_root_build_tag0x05_from_collection_0x6ceb9c,shell,cdecl,inferred,objdump + local disassembly + registration-block correlation,3,"Concrete root in the fixed named-callback block that builds static record `0x006cea0c`. The helper writes tag byte `0x05`, stores the current world-year key from `[0x006cec78+0x0d]`, then walks indexed collection `0x006ceb9c`, hashes one inline string field through `0x0053d810`, adds several per-entry scalar fields and mode-dependent bonus terms, accumulates the total, and returns the finished record block. Current evidence keeps the field name structural, but the owner is now explicit.","objdump + local disassembly + registration-block correlation + indexed-collection correlation + hashed-string correlation"
0x0046de40,52,multiplayer_fixed_named_callback_root_build_tag0x04_and_cached_counter,shell,cdecl,inferred,objdump + local disassembly + registration-block correlation,3,"Small fixed named-callback root that writes tag byte `0x04` into static block `0x006cea18`, stores the current world-year key from `[0x006cec78+0x0d]`, queries one cached counter through `0x00518c60`, stores that dword into the same block, and returns the block pointer. Current grounded owner is the first fixed named-descriptor block registered by `0x00473a60`.","objdump + local disassembly + registration-block correlation + cached-counter correlation"
0x0046de80,425,multiplayer_fixed_named_callback_root_build_tag0x01_from_collection_0x62b26c_and_local_overlay_samples,shell,cdecl,inferred,objdump + local disassembly + registration-block correlation,3,"Broader fixed named-callback root that builds static record `0x006cea24`. After writing tag byte `0x01` and the current world-year key from `[0x006cec78+0x0d]`, the helper walks indexed collection `0x0062b26c`, filters entries through local predicate `0x0040c990`, accumulates several per-entry scalar bands including object fields `[+0x246/+0x29e/+0x3cc]`, queries one local bounds tuple through `0x0052e720`, projects that tuple through `0x004142e0`, samples the live world raster through `0x00448aa0`, and stores the final accumulated total into the static record before returning it. This is the clearest current collection-plus-overlay fixed named-callback root beneath `0x00473a60`, though the descriptor caption above it remains open.","objdump + local disassembly + registration-block correlation + indexed-collection correlation + world-raster-sample correlation"
0x0046e030,539,multiplayer_fixed_named_callback_root_build_tag0x02_from_route_entry_collection_and_overlay_geometry_samples,shell,cdecl,inferred,objdump + local disassembly + registration-block correlation,3,"Broader fixed named-callback root that builds static record `0x006cea30`. The helper writes tag byte `0x02`, stores the current world-year key from `[0x006cec78+0x0d]`, and then walks the live route-entry collection `0x006cfca8`, keeping only entries whose byte `[entry+0x216]` equals `2`. For each surviving entry it accumulates multiple local scalar bands, projected bounds from `0x0048a170`, auxiliary values from `0x0048a020`, and one geometry-derived magnitude from `0x005394b0` before storing the final total in the static record and returning it. This is the current grounded route-entry-backed member of the fixed named-callback family beneath `0x00473a60`.","objdump + local disassembly + registration-block correlation + route-entry-collection correlation + geometry-sample correlation"
0x0046e250,868,multiplayer_fixed_named_callback_root_build_tag0x03_from_collection_0x6cfcbc_and_object_metric_bands,shell,cdecl,inferred,objdump + local disassembly + registration-block correlation,3,"Broader fixed named-callback root that builds static record `0x006cea3c`. The helper writes tag byte `0x03`, stores the current world-year key from `[0x006cec78+0x0d]`, then walks collection `0x006cfcbc` and accumulates several per-entry metric bands through `0x004a77b0`, `0x0052e720`, `0x004a6e60`, and `0x004a8880`, followed by a long run of inline scalar-field adjustments and a final city-database-derived handle or float term through `0x0041ab80`. The exact descriptor caption remains open, but this is clearly another concrete collection-backed static-record root in the fixed named-callback family registered under `0x00473a60`.","objdump + local disassembly + registration-block correlation + collection-correlation + metric-band correlation"
0x0046e5c0,1754,multiplayer_build_or_apply_dual_collection_metric_blob_by_mode,shell,thiscall,inferred,objdump + local disassembly + registration-block correlation,3,"Broader multiplayer-side blob owner directly adjacent to the fixed named-callback strip. In mode `1` it serializes a dual-collection metric blob through the caller out-pointer: first it walks collection `0x0062be10`, capturing one `0x24`-byte metric row per entry from repeated `0x0042a5d0` probes plus entry field `[+0x47]`; then it walks collection `0x006ceb9c`, capturing one `0x2c`-byte metric row per entry from fields `[+0x154..+0x181]`; it stores the two row counts into local header bytes `[this+0x0d/+0x0e]`, allocates one contiguous blob of size `0x10 + count0*0x24 + count1*0x2c`, copies the local header plus both metric bands into that blob, and returns it through the caller out-slot. The non-`1` branch begins the reverse apply path by validating the stored per-entry metric rows against the live collections and writing back mismatched values into the live entries. This is therefore a real dual-collection metric snapshot/apply owner, not another tiny selector leaf.","objdump + local disassembly + dual-collection correlation + metric-blob correlation + apply-path correlation"
0x0046f4a0,928,multiplayer_preview_dataset_default_selector_callback_dispatch_first_named_descriptor_block,shell,thiscall,inferred,objdump + local disassembly + registration-root correlation,4,"Default callback root seeded into `[0x006cd8d8+0x08]` by `multiplayer_preview_dataset_reset_global_callback_state_and_register_selector_handlers` `0x00473280`. The helper switches on selector id `[this+0x10]` and, for the first fixed named-descriptor family, dispatches a concrete mix of mode writes, staged-path synchronization, chat/status publication, session-identity comparison, tuple staging, selector-`0x58` submission, and keyed-bucket pruning. The simple arms map selector values `1..7` into dataset mode dword `[0x006cd8d8+0x0c]` plus one auxiliary store at `[+0x8f1c]`, while the heavier arms stage the current session path through `multiplayer_preview_dataset_stage_selected_path` `0x00469700`, publish localized status text through either `0x004554e0` or `multiplayer_preview_dataset_append_named_ui_request_record` `0x00469a50`, refresh the staged tuple through `0x0046b6d0` and token lane `0x0046d610`, submit selector `0x58` through `0x00469d30`, and prune old keyed buckets through `0x0046b910`. This is therefore the real default selector-dispatch root for the first named-descriptor block, not just a passive callback pointer.","objdump + local disassembly + registration-root correlation + selector-dispatch correlation + named-descriptor correlation"
0x0046f870,124,multiplayer_apply_rounded_float_delta_to_company_entry_metric_pair_by_index_byte,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Helper beneath the first fixed named-descriptor callback family that treats the caller payload as one float plus one collection byte index. It resolves the indexed company-style entry from `0x0062be10`, validates it through `0x00425b90`, rounds the input float through `0x005a10d0`, then writes the positive rounded value into metric id `0x0f` and the negated rounded value into metric id `0x0d` through `0x0042a040`. Current direct callers build the temporary two-field payload on the stack before calling this leaf, which keeps the helper bounded as a small rounded-delta apply path rather than a broader callback owner.","objdump + local disassembly + caller inspection + indexed-company-entry correlation + rounded-delta correlation"
0x0046f8f0,97,multiplayer_resolve_company_entry_by_index_if_live_session_profile_index_matches,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Resolves one indexed entry from `0x0062be10`, validates it through `0x00425b90`, derives the current live-session-backed name index through `multiplayer_find_collection_0x6ceb9c_entry_index_matching_live_session_string` `0x0046d9e0`, and returns the company entry only when its profile-index field `[entry+0x3b]` matches that derived `0x006ceb9c` index. Otherwise it returns null. Current callers use this as the stricter collection-match gate beneath several first-block fixed descriptor callbacks.","objdump + local disassembly + caller inspection + live-session correlation + indexed-company-entry correlation + profile-index correlation"
0x0046f960,2209,multiplayer_dispatch_chat_command,shell,cdecl,inferred,ghidra-headless,4,Parses and dispatches one slash-prefixed Multiplayer.win chat command line from `[eax+0x08]`. The parser normalizes `/` to `\\` and handles the grounded command family `\\kick` `\\clear` `\\whois` `\\me` `\\unban` `\\ban` `\\snore` `\\sneeze` `\\hurry` `\\trackisfree` `\\loadgame` and `\\sendgame`. The strongest branches are now clear: `\\kick` resolves a typed peer name through the active session tables and forwards the resulting peer object through multiplayer_request_peer_session_control when the target is neither null nor the local player; `\\clear` clears the local chat pane through multiplayer_publish_wrapped_chat_message(null); `\\whois` finds a named peer and emits multi-line `%s Ip = %s` `Cpu` `Game` and `Build Time` diagnostics through multiplayer_route_chat_line; `\\ban` and `\\unban` resolve either a dotted player name or the selected peer name then update the semicolon-delimited moderation list through multiplayer_update_semicolon_name_list with add/remove modes while `\\unban` can also forward a live peer object through multiplayer_request_peer_session_control; `\\snore` `\\sneeze` and `\\hurry` build transient presentation objects then broadcast text ids `0xb79` `0xb7a` and `0xb7b`; `\\loadgame` copies the requested filename into `0x006ce630` and arms flag `0x006ce9bc`; `\\trackisfree` arms flag `0x006ce9b4`; and `\\sendgame` allocates one 0x5c-byte transfer record under `0x006ce290` for the chosen player slot. The parser returns `1` only when a command branch handled the line and otherwise leaves the caller to treat it as ordinary chat text.,ghidra + rizin + llvm-objdump + strings
0x00470290,352,multiplayer_selector0x02_compare_staged_profile_text_sync_shell_profile_block_and_maybe_queue_selector0x53,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that compares the caller string at `[payload+0x11]` against the current shell profile string at `[0x006cec7c+0x11]` through `0x005a57cf`, optionally validates that staged profile text through `0x0046d7f0`, and then branches on requested action id `0x006d127c`. In the action-`3` lane it either advances the requested-action state fields `0x006d1280/0x006d1284` or queues selector `0x53` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30`. On the common success path it syncs the larger shell profile block rooted at `[0x006cec7c+0x44]` from the incoming payload, optionally overrides that block from `0x006ce670`, re-enters `0x004f13e0(1)`, refreshes `[0x006cec7c+0x83]` through `0x00518c70`, and stores one filename-presence flag into `0x006ce9bc` from `0x005c9cf8`. This is the clearest current structural read for the early selector-`0x02` branch beneath the preview-dataset callback table.","objdump + local disassembly + registration-pass correlation + selector-0x02 correlation + staged-profile correlation + requested-action correlation"
0x004703f0,224,multiplayer_selector0x0a_reset_world_session_owner_sync_profile_bytes_and_refresh_local_status,shell,cdecl,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that clears `[world+0x19]`, re-enters `0x0046a390(1)`, seeds world field `[world+0x66ae] = 1`, and refreshes local multiplayer state through `0x0053f000(1,0,1)`. It then walks the live session peer list from `0x006d40d0`, derives each peer's named-profile index through `0x0046d980`, and mirrors peer byte `[peer+0x2690]` into named-profile byte `[entry+0x15c]` for the corresponding `0x006ceb9c` entry. Before returning it refreshes `0x006ce98c` through `0x0051d890`, optionally publishes localized status `0x005c87a8` through `0x00538c70`, and when the session object `0x006d40dc` is live re-enters `0x00434680(3,1,0)`. This is the clearest current structural read for selector `0x0a` beneath the preview-dataset callback table.","objdump + local disassembly + registration-pass correlation + selector-0x0a correlation + world-session correlation + named-profile-byte correlation"
0x004704d0,96,multiplayer_selector0x0b_stage_current_token_and_publish_selector0x0c_when_session_guard_is_set,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that checks session-side guard dword `[EDX+0x50]` and, when that guard is nonzero, stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x0c`. This is the clean local selector-`0x0b` wrapper immediately above the heavier selector-`0x0c` branch.","objdump + local disassembly + registration-pass correlation + selector-0x0b correlation + selector-0x0c correlation + staged-token correlation"
0x00470530,96,multiplayer_selector0x0c_apply_signed_byte_pair_through_0x434680_and_adjust_dataset_counter,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, rejects work when dataset gate `0x006cd91c` is set, and otherwise forwards the signed byte pair at `[payload+0x00/+0x01]` into `0x00434680(leader, 0, follower)`. On success it then adjusts dataset counter `0x006cd8e8` based on whether `[world+0x19]` is currently nonzero and stores scalar `0x3c` into `0x005f2b38`. This is the clearest current structural read for selector `0x0c` above that signed-pair apply lane.","objdump + local disassembly + registration-pass correlation + selector-0x0c correlation + world-helper-0x434680 correlation + dataset-counter correlation"
0x00470590,96,multiplayer_selector0x0f_pop_head_session_queue_node_publish_record_and_release_it,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that resolves the current live-session object through `0x00521d40`, pops the head node from its queue owner at `[session+0x64]`, and when a node is present submits that node's fields through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` using dataset string root `[0x006cd8d8+0x8f48]`, selector id from the leading node word, and the node's stacked scalar fields `[+0x08/+0x0c/+0x10/+0x14]`. It then releases the consumed node through `0x00469890`. This is the clearest current structural read for selector `0x0f` beneath the preview-dataset callback table.","objdump + local disassembly + registration-pass correlation + selector-0x0f correlation + session-queue correlation + record-publish correlation"
0x004705f0,64,multiplayer_selector0x10_lookup_current_session_key_in_store0x60_and_forward_string_root,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that resolves the current live-session object through `0x00521d40`, looks up payload dword `[payload+0x00]` in the session-side keyed owner at `[session+0x60]` through `0x0053dae0`, and when a match exists forwards that resolved entry plus dataset string root `[0x006cd8d8+0x8f48]` into live-session helper `0x00521790`. This is the clearest current structural read for selector `0x10` beneath the preview-dataset callback table.","objdump + local disassembly + registration-pass correlation + selector-0x10 correlation + session-store correlation + string-root forward correlation"
0x004706b0,517,multiplayer_selector0x13_match_company_entry_try_place_payload_and_publish_selector0x6e_hash_fallback,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes a structured payload from `[this+0x08]`, resolves the matching company-style entry through `multiplayer_resolve_company_entry_by_index_if_live_session_profile_index_matches` `0x0046f8f0`, and on the active branch tries to validate and materialize the payload into the placed-structure world through `placed_structure_validate_projected_candidate_placement` `0x004197e0`, `0x0046eec0`, `placed_structure_collection_allocate_and_construct_entry` `0x004134d0`, `0x0040eba0`, and the nearby runtime-object refresh leaves `0x0052eb90` and `0x0040ef10`. When no compatible company entry is live but the multiplayer session object exists, it instead stages the current year-derived token into `[0x006cd8d8+0x8f38]`, hashes the first `0x1c` payload bytes through `0x0053d870`, and submits the compact fallback through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x6e`. Empty-input failure falls back to localized status id `0x0b7c`. This is the safest current structural read for the selector-`0x13` owner above that hashed selector-`0x6e` fallback lane.","objdump + local disassembly + caller inspection + selector-0x13 correlation + selector-0x6e correlation + placed-structure correlation"
0x00470630,126,multiplayer_selector0x12_validate_payload_and_publish_selector0x13_or_error,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes payload pointer `[this+0x08]`, validates that payload through `0x0046ef40(1)`, and on success stages the current year-derived token into `[0x006cd8d8+0x8f38]` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x13` and fixed payload length `0x1c`. When validation fails it instead forwards the paired error-style selector-`0x13` payload through the `0x21` branch using the caller fallback buffer from `EDX+0x08`. This is the clean local selector-`0x12` wrapper immediately above the heavier selector-`0x13` placement or hash-fallback body.","objdump + local disassembly + caller inspection + selector-0x12 correlation + selector-0x13 correlation + validation-gate correlation"
0x004708c0,141,multiplayer_selector0x14_validate_payload_and_publish_selector0x15_or_error,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes payload pointer `[this+0x08]`, validates that payload against the caller-side session or company context through `0x0046f0a0`, and on success stages the current year-derived token into `[0x006cd8d8+0x8f38]` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x15`. When the validation path fails it instead forwards the paired error-style selector-`0x15` payload through the `0x21` branch using the caller fallback buffer from `EDX+0x08`. This is the safest current read for the selector-`0x14` owner above the narrower selector-`0x15` delta-apply body rather than another direct local mutation helper.","objdump + local disassembly + caller inspection + selector-0x14 correlation + selector-0x15 correlation + validation-gate correlation"
0x00470950,431,multiplayer_selector0x15_match_company_entry_publish_selector0x6b_metric_delta_and_apply_locally,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes a 5-byte payload `(float delta, company-index byte)` from `[this+0x08]`, resolves the matching company-style entry through `multiplayer_resolve_company_entry_by_index_if_live_session_profile_index_matches` `0x0046f8f0`, temporarily masks world latch `[0x006cec78+0x4aab]` while validating the local session/company relation through `0x0046f0a0`, and on the active branch stages the current year-derived token into `[0x006cd8d8+0x8f38]`, submits the same compact update through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x6b`, updates local counters `[0x006cd8d8+0x987c/+0x9880]`, and immediately re-enters `multiplayer_apply_rounded_float_delta_to_company_entry_metric_pair_by_index_byte` `0x0046f870`. When the required entry match fails it falls back to localized status id `0x0b86`. This is the tightest current read for the selector-`0x15` owner above the smaller selector-`0x6b` apply leaf.","objdump + local disassembly + caller inspection + selector-0x15 correlation + selector-0x6b correlation + company-entry correlation"
0x00470b20,136,multiplayer_selector0x16_validate_payload_and_publish_selector0x17_or_error,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes payload pointer `[this+0x08]`, validates that payload through `0x0046edb0`, and on success stages the current year-derived token into `[0x006cd8d8+0x8f38]` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x17` and fixed request kind `0x19`. When validation fails it instead forwards the paired error-style selector-`0x17` payload through the `0x21` branch using the caller fallback buffer from `EDX+0x08`. This is the clean local selector-`0x16` wrapper immediately above the heavier selector-`0x17` live-world apply body.","objdump + local disassembly + caller inspection + selector-0x16 correlation + selector-0x17 correlation + validation-gate correlation"
0x00470bb0,428,multiplayer_selector0x17_match_company_entry_apply_0x33_stride_records_and_publish_selector0x6e_fallback,shell,thiscall,inferred,objdump + local disassembly + caller inspection,4,"Heavier selector-handler body that consumes a structured payload from `[this+0x08]`, resolves the matching company-style entry through `multiplayer_resolve_company_entry_by_index_if_live_session_profile_index_matches` `0x0046f8f0` using payload dwords `[+0x0c/+0x10]`, and on the active branch first folds the count-prefixed `0x33`-stride adjunct records from `[payload+0x14]` through local helpers `0x004b2ba0` and `0x004b3160`, then allocates or resolves one live train-side entry through `0x004b2140` against collection `0x006cfcbc`, applies optional subtype field `[payload+0x08]` through `0x004abd70`, resolves the train metrics owner through `0x004a77b0`, and finally re-enters `0x0052e720` plus the nearby refresh leaves under `0x0040eba0`, `0x0052eb90`, and `0x0040ef10`. When that apply path does not land a live entry but the multiplayer session object exists, it stages the current year-derived token into `[0x006cd8d8+0x8f38]`, hashes the first `0x14` payload bytes through `0x0053d870`, and submits the compact fallback through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x6e`. Empty-input failure falls back to localized status id `0x0b7e`. This is the safest current structural read for selector `0x17` above that hashed selector-`0x6e` fallback lane.","objdump + local disassembly + caller inspection + selector-0x17 correlation + selector-0x6e correlation + live-train correlation"
0x00470da0,139,multiplayer_selector0x19_validate_payload_and_publish_selector0x1a_or_error,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes payload pointer `[this+0x08]`, validates that payload through `0x0046ed30`, and on success stages the current year-derived token into `[0x006cd8d8+0x8f38]` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x1a` and fixed request kind `0x19`. When validation fails it instead forwards the paired error-style selector-`0x1a` payload through the `0x21` branch using the caller fallback buffer from `EDX+0x08`. This is the clean local selector-`0x19` wrapper immediately above the selector-`0x1a` status or apply branch.","objdump + local disassembly + caller inspection + selector-0x19 correlation + selector-0x1a correlation + validation-gate correlation"
0x00470e30,156,multiplayer_selector0x1a_query_or_publish_session_name_match_status,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes payload from `[this+0x08]` and branches on payload length `[this+0x0c]`. When the payload is not exactly four bytes, the helper first queries a local status code through `0x0046ed30`; on zero it forwards the payload into `0x0047d320`, while on nonzero it resolves the named `0x006ceb9c` entry from payload dword `[+0x00]`, compares that entry string against the current live session string, and uses the resulting status code to publish one localized status text `0x0b7f` or `0x0b80` through `0x00469a50` after refreshing `0x0053f000`. When the payload length is exactly four bytes it instead treats payload dword `[+0x00]` as the direct status code. This is the safest current structural read for selector `0x1a` above that session-name-match status branch rather than a broader world mutation owner.","objdump + local disassembly + caller inspection + selector-0x1a correlation + live-session-string correlation + status-text correlation"
0x00470ed0,208,multiplayer_reset_named_profile_activation_and_apply_positive_company_metric0x0d_preset,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Global reset or normalize pass over the two live multiplayer collections that first walks `0x006ceb9c` and, for every entry whose guard dword `[entry+0x1e1]` is nonzero, forwards constant `0x004c4b40` into `0x00476050`; it then walks the live company collection `0x0062be10` and, for every entry accepted by `0x00425b90`, writes preset scalar `0x4a989680` into metric id `0x0d` through `0x0042a040`. Current registration pressure places this helper immediately beside the selector-`0x1c` callback band inside the multiplayer preview-dataset callback table.","objdump + local disassembly + caller inspection + 0x6ceb9c-correlation + company-metric correlation + selector-band adjacency"
0x00470fa0,208,multiplayer_reset_named_profile_activation_and_apply_negative_company_metric0x0d_preset,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Companion global reset or normalize pass parallel to `0x00470ed0`. It walks the same guarded `0x006ceb9c` entry family and forwards constant `0xfffe7960` into `0x00476050`, then walks `0x0062be10` and, for every entry accepted by `0x00425b90`, writes preset scalar `0xc7c35000` into metric id `0x0d` through `0x0042a040`. Current selector-table adjacency keeps this bounded as the alternate preset sibling of `0x00470ed0` beneath the same multiplayer callback band.","objdump + local disassembly + caller inspection + 0x6ceb9c-correlation + company-metric correlation + selector-band adjacency"
0x00471070,96,multiplayer_selector0x1d_stage_current_token_and_publish_selector0x1e,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x1e` and fixed request kind `0x19`. This is the clean local selector-`0x1d` wrapper immediately above the registered selector-`0x1e` branch.","objdump + local disassembly + registration-pass correlation + selector-0x1d correlation + selector-0x1e correlation + staged-token correlation"
0x004710d0,96,multiplayer_selector0x1f_stage_current_token_and_publish_selector0x20,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x20` and fixed request kind `0x19`. This is the clean local selector-`0x1f` wrapper immediately above the registered selector-`0x20` branch.","objdump + local disassembly + registration-pass correlation + selector-0x1f correlation + selector-0x20 correlation + staged-token correlation"
0x00471130,96,multiplayer_selector0x21_stage_current_token_and_publish_selector0x22,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x22` and fixed request kind `0x19`. This is the clean local selector-`0x21` wrapper immediately above the registered selector-`0x22` branch.","objdump + local disassembly + registration-pass correlation + selector-0x21 correlation + selector-0x22 correlation + staged-token correlation"
0x00471190,96,multiplayer_selector0x23_stage_current_token_and_publish_selector0x24,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x24` and fixed request kind `0x19`. This is the clean local selector-`0x23` wrapper immediately above the registered selector-`0x24` branch.","objdump + local disassembly + registration-pass correlation + selector-0x23 correlation + selector-0x24 correlation + staged-token correlation"
0x004711f0,96,multiplayer_selector0x25_stage_current_token_and_publish_selector0x26,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x26` and fixed request kind `0x19`. This is the clean local selector-`0x25` wrapper immediately above the registered selector-`0x26` branch.","objdump + local disassembly + registration-pass correlation + selector-0x25 correlation + selector-0x26 correlation + staged-token correlation"
0x00471250,96,multiplayer_selector0x27_stage_current_token_and_publish_selector0x28,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x28` and fixed request kind `0x19`. This is the clean local selector-`0x27` wrapper immediately above the registered selector-`0x28` branch.","objdump + local disassembly + registration-pass correlation + selector-0x27 correlation + selector-0x28 correlation + staged-token correlation"
0x004712b0,96,multiplayer_selector0x29_stage_current_token_and_publish_selector0x2a,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x2a` and fixed request kind `0x19`. This is the clean local selector-`0x29` wrapper immediately above the registered selector-`0x2a` branch.","objdump + local disassembly + registration-pass correlation + selector-0x29 correlation + selector-0x2a correlation + staged-token correlation"
0x00471310,96,multiplayer_selector0x2b_stage_current_token_and_publish_selector0x2c,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x2c` and fixed request kind `0x19`. This is the clean local selector-`0x2b` wrapper immediately above the registered selector-`0x2c` branch.","objdump + local disassembly + registration-pass correlation + selector-0x2b correlation + selector-0x2c correlation + staged-token correlation"
0x00471370,96,multiplayer_selector0x2d_stage_current_token_and_publish_selector0x2e,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x2e` and fixed request kind `0x19`. This is the clean local selector-`0x2d` wrapper immediately above the registered selector-`0x2e` branch.","objdump + local disassembly + registration-pass correlation + selector-0x2d correlation + selector-0x2e correlation + staged-token correlation"
0x004713d0,96,multiplayer_selector0x2f_stage_current_token_and_publish_selector0x30,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x30` and fixed request kind `0x19`. This is the clean local selector-`0x2f` wrapper immediately above the registered selector-`0x30` branch.","objdump + local disassembly + registration-pass correlation + selector-0x2f correlation + selector-0x30 correlation + staged-token correlation"
0x00471430,96,multiplayer_selector0x31_stage_current_token_and_publish_selector0x32,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x32` and fixed request kind `0x19`. This is the clean local selector-`0x31` wrapper immediately above the registered selector-`0x32` branch.","objdump + local disassembly + registration-pass correlation + selector-0x31 correlation + selector-0x32 correlation + staged-token correlation"
0x00471490,96,multiplayer_selector0x33_stage_current_token_and_publish_selector0x34,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x34` and fixed request kind `0x19`. This is the clean local selector-`0x33` wrapper immediately above the registered selector-`0x34` branch.","objdump + local disassembly + registration-pass correlation + selector-0x33 correlation + selector-0x34 correlation + staged-token correlation"
0x004714f0,96,multiplayer_selector0x35_stage_current_token_and_publish_selector0x36,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x36` and fixed request kind `0x19`. This is the clean local selector-`0x35` wrapper immediately above the registered selector-`0x36` branch.","objdump + local disassembly + registration-pass correlation + selector-0x35 correlation + selector-0x36 correlation + staged-token correlation"
0x00471550,96,multiplayer_selector0x37_stage_current_token_and_publish_selector0x38,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x38` and fixed request kind `0x19`. This is the clean local selector-`0x37` wrapper immediately above the registered selector-`0x38` branch.","objdump + local disassembly + registration-pass correlation + selector-0x37 correlation + selector-0x38 correlation + staged-token correlation"
0x004715b0,96,multiplayer_selector0x39_stage_current_token_and_publish_selector0x3a,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x3a` and fixed request kind `0x19`. This is the clean local selector-`0x39` wrapper immediately above the registered selector-`0x3a` branch.","objdump + local disassembly + registration-pass correlation + selector-0x39 correlation + selector-0x3a correlation + staged-token correlation"
0x00471610,112,multiplayer_selector0x3b_resolve_live_train_id_and_publish_selector0x3c,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, resolves train id `[payload+0x04]` inside live collection `0x006cfcbc`, and on success stages the current year-derived token into `[0x006cd8d8+0x8f38]` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x3c`. This is the clean local selector-`0x3b` wrapper immediately above the narrower selector-`0x3c` live-train apply branch.","objdump + local disassembly + registration-pass correlation + selector-0x3b correlation + selector-0x3c correlation + live-train correlation"
0x00471680,64,multiplayer_selector0x3c_resolve_live_train_and_dispatch_local_handler_0x4abd70,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, resolves train id `[payload+0x04]` inside `0x006cfcbc`, and on success forwards the resolved train entry plus payload dword `[+0x08]` into local handler `0x004abd70`. This is the clearest current structural read for selector `0x3c` above that narrow live-train dispatch lane.","objdump + local disassembly + registration-pass correlation + selector-0x3c correlation + live-train correlation + local-handler correlation"
0x004716c0,112,multiplayer_selector0x3d_resolve_live_train_id_and_publish_selector0x3e,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, resolves train id `[payload+0x04]` inside live collection `0x006cfcbc`, and on success stages the current year-derived token into `[0x006cd8d8+0x8f38]` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x3e`. This is the clean local selector-`0x3d` wrapper immediately above the narrower selector-`0x3e` live-train dispatch branch.","objdump + local disassembly + registration-pass correlation + selector-0x3d correlation + selector-0x3e correlation + live-train correlation"
0x00471730,80,multiplayer_selector0x3e_resolve_live_train_and_dispatch_local_handler_0x4b2f00,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, resolves train id `[payload+0x04]` inside `0x006cfcbc`, and on success forwards the resolved train entry plus payload dword `[+0x08]` and flag `1` into local handler `0x004b2f00`. This is the clearest current structural read for selector `0x3e` above that narrow live-train dispatch lane.","objdump + local disassembly + registration-pass correlation + selector-0x3e correlation + live-train correlation + local-handler correlation"
0x00471780,112,multiplayer_selector0x3f_resolve_live_train_id_and_publish_selector0x40,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, resolves train id `[payload+0x04]` inside live collection `0x006cfcbc`, and on success stages the current year-derived token into `[0x006cd8d8+0x8f38]` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x40`. This is the clean local selector-`0x3f` wrapper immediately above the narrower selector-`0x40` live-train dispatch branch.","objdump + local disassembly + registration-pass correlation + selector-0x3f correlation + selector-0x40 correlation + live-train correlation"
0x004717f0,64,multiplayer_selector0x40_resolve_live_train_and_dispatch_local_handler_0x4b3000,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, resolves train id `[payload+0x04]` inside `0x006cfcbc`, and on success forwards the resolved train entry plus payload dword `[+0x08]` into local handler `0x004b3000`. This is the clearest current structural read for selector `0x40` above that narrow live-train dispatch lane.","objdump + local disassembly + registration-pass correlation + selector-0x40 correlation + live-train correlation + local-handler correlation"
0x00471830,112,multiplayer_selector0x41_resolve_live_train_id_and_publish_selector0x42,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, resolves train id `[payload+0x04]` inside live collection `0x006cfcbc`, and on success stages the current year-derived token into `[0x006cd8d8+0x8f38]` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x42`. This is the clean local selector-`0x41` wrapper immediately above the heavier selector-`0x42` live-train interaction branch.","objdump + local disassembly + registration-pass correlation + selector-0x41 correlation + selector-0x42 correlation + live-train correlation"
0x004718a0,176,multiplayer_selector0x42_update_live_train_adjunct_and_dispatch_local_action_code,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, resolves train id `[payload+0x04]` inside `0x006cfcbc`, and on success re-enters the train-side adjunct family `0x004b2b70`, `0x004b3160`, and `0x004b2c10` using the caller record band at `[payload+0x08]`. When the first `0x004b2c10(-1,0,0,-1)` gate fails it then branches on `0x004a9460`: the positive lane retries `0x004b2c10(-1,1,0,-1)` and dispatches local action code `0x13` through `0x004ab980`, while the fallback lane dispatches local action code `0x0a`. This is the safest current structural read for selector `0x42` above that train-side adjunct and action-code branch.","objdump + local disassembly + registration-pass correlation + selector-0x42 correlation + live-train correlation + local-train-adjunct correlation"
0x00471950,112,multiplayer_selector0x43_resolve_live_train_id_and_publish_selector0x44,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, resolves train id `[payload+0x04]` inside live collection `0x006cfcbc`, and on success stages the current year-derived token into `[0x006cd8d8+0x8f38]` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x44`. This is the clean local selector-`0x43` wrapper immediately above the registered selector-`0x44` branch.","objdump + local disassembly + registration-pass correlation + selector-0x43 correlation + selector-0x44 correlation + live-train correlation"
0x004719c0,112,multiplayer_complete_selector0x48_prompt_result_and_publish_selector0x49,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Prompt-result callback used by the selector-`0x48` request family. The helper treats `[this+0x1c]` as one `0x0c`-byte staged record, derives one bit position from the current live session through `0x00521d40` and `0x0046d980`, sets that bit in record dword `[record+0x08]`, forces the same bit again when the prompt result code in `EDX` equals `0x3f2`, then republishes the updated `0x0c`-byte record through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x49` and dataset string root `[0x006cd8d8+0x8f48]`.","objdump + local disassembly + caller inspection + selector-0x48 correlation + selector-0x49 correlation + prompt-result correlation"
0x00471a30,352,multiplayer_selector0x48_match_or_prompt_12byte_record_and_publish_selector0x49,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body for the 12-byte hashed request family seeded by `0x0046cbf0`. It treats `[this+0x08]` as one `0x0c`-byte record, derives the current live-session bit position through `0x00521d40` and `0x0046d980`, and when payload dword `[+0x00]` matches the current live session id simply sets that bit in record dword `[+0x08]` before publishing selector `0x49`. Otherwise it resolves the `0x006ceb9c` and `0x0062be10` entries selected by payload bytes `[+0x05]` and `[+0x04]`, and either marks the same bit directly or formats localized status `0x0b81` into `0x006ce700` and opens a prompt through `0x00469a50` with follow-on callback `0x004719c0`. In both branches the final publish uses `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x49`.","objdump + local disassembly + registration-pass correlation + selector-0x48 correlation + selector-0x49 correlation + hashed-request correlation + prompt correlation"
0x00471b90,256,multiplayer_selector0x49_build_company_activity_bitmaps_and_publish_selector0x47,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that consumes one 12-byte record from `[this+0x08]`, hashes that record through `0x0053d870`, resolves the current keyed object through `0x00468cb0`, and merges the record's existing bitset dword `[record+0x08]` into the resolved object. It then walks `0x006ceb9c` and, for every currently active named-profile entry whose bit is not already present in that merged mask, copies the live-activity bit into the local object. After that sweep it stages the current year-derived token into `[0x006cd8d8+0x8f38]`, republishes the object through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x47`, and releases the temporary record. This is the tightest current structural read for selector `0x49` above the follow-on selector-`0x47` bitmap branch.","objdump + local disassembly + registration-pass correlation + selector-0x49 correlation + selector-0x47 correlation + keyed-object correlation"
0x00471c90,320,multiplayer_selector0x47_build_profile_masks_and_trigger_merger_vote_resolution,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that consumes one 10-byte bitmap-style payload from `[this+0x08]`, builds two ten-slot byte arrays on the stack from payload bytes `[+0x04]`, `[+0x05]`, and payload bitmask dword `[+0x08]`, and then walks `0x006ceb9c` to mark currently active entries into the second array when their bit is present or when their guard fields are already clear. It then forwards the resulting arrays into `0x004eb230` and immediately re-enters `shell_resolve_merger_vote_and_commit_outcome` `0x004ebd10(0)`. This is the clearest current structural read for selector `0x47` beneath the paired selector-`0x49` bitmap-builder branch.","objdump + local disassembly + registration-pass correlation + selector-0x47 correlation + 0x006ceb9c-correlation + merger-vote correlation"
0x00471d50,112,multiplayer_complete_selector0x4c_prompt_result_and_publish_selector0x4d,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Prompt-result callback used by the selector-`0x4c` request family. The helper treats `[this+0x1c]` as one `0x0a`-byte staged record, derives one bit position from the current live session through `0x00521d40` and `0x0046d980`, sets that bit in record dword `[record+0x06]`, forces the same bit again when the prompt result code in `EDX` equals `0x3f2`, then republishes the updated `0x0a`-byte record through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x4d` and dataset string root `[0x006cd8d8+0x8f48]`.","objdump + local disassembly + caller inspection + selector-0x4c correlation + selector-0x4d correlation + prompt-result correlation"
0x00471dc0,272,multiplayer_selector0x4c_match_or_prompt_10byte_record_and_publish_selector0x4d,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body for the 10-byte hashed request family seeded by `0x0046cc60`. It treats `[this+0x08]` as one `0x0a`-byte record, derives the current live-session bit position through `0x00521d40` and `0x0046d980`, and when payload dword `[+0x00]` matches the current live session id simply sets that bit in record dword `[+0x06]` before publishing selector `0x4d`. Otherwise it resolves the `0x006ceb9c` and `0x0062be10` entries selected by payload bytes `[+0x05]` and `[+0x04]`, and either marks the same bit directly or formats localized status `0x0b82` into `0x006ce700` and opens a prompt through `0x00469a50` with follow-on callback `0x00471d50`. In both branches the final publish uses `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x4d`.","objdump + local disassembly + registration-pass correlation + selector-0x4c correlation + selector-0x4d correlation + hashed-request correlation + prompt correlation"
0x00471ed0,256,multiplayer_selector0x4d_build_company_activity_bitmaps_and_publish_selector0x4b,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that consumes one 10-byte record from `[this+0x08]`, hashes that record through `0x0053d870`, resolves the current keyed object through `0x00468cb0`, and merges the record's existing bitset dword `[record+0x06]` into the resolved object. It then walks `0x006ceb9c` and, for every currently active named-profile entry whose bit is not already present in that merged mask, copies the live-activity bit into the local object. After that sweep it stages the current year-derived token into `[0x006cd8d8+0x8f38]`, republishes the object through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x4b`, and releases the temporary record. This is the tightest current structural read for selector `0x4d` above the follow-on selector-`0x4b` bitmap branch.","objdump + local disassembly + registration-pass correlation + selector-0x4d correlation + selector-0x4b correlation + keyed-object correlation"
0x00471fd0,176,multiplayer_selector0x4b_build_profile_masks_and_refresh_two_bitmap_helpers,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that consumes one 10-byte bitmap-style payload from `[this+0x08]`, builds two ten-slot byte arrays on the stack from payload bytes `[+0x04]`, `[+0x05]`, and payload bitmask dword `[+0x06]`, and then walks `0x006ceb9c` to mark currently active entries into the second array when their bit is present or when their guard fields are already clear. It then forwards the resulting arrays into `0x0050c4e0` and `0x0050c940`. This is the clearest current structural read for selector `0x4b` beneath the paired selector-`0x4d` bitmap-builder branch.","objdump + local disassembly + registration-pass correlation + selector-0x4b correlation + 0x006ceb9c-correlation + bitmap-helper correlation"
0x00472080,48,multiplayer_selector0x4f_republish_selector0x6f_when_session_live_and_dataset_gate_clear,shell,cdecl,inferred,objdump + local disassembly + registration-pass correlation,2,"Small selector-handler body that checks for a live session object at `0x006d40dc` and a clear dataset gate at `0x006cd91c`, then resubmits a tiny empty request through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x6f`. This is the current grounded owner for selector `0x4f`.","objdump + local disassembly + registration-pass correlation + selector-0x4f correlation"
0x004720b0,32,multiplayer_selector0x50_copy_dataset_dword_0x9058_to_0x9054_when_session_live,shell,cdecl,inferred,objdump + local disassembly + registration-pass correlation,2,"Small selector-handler body that, when the live session object `0x006d40dc` is present, copies dataset dword `[0x006cd8d8+0x9058]` into `[0x006cd8d8+0x9054]`. This is the current grounded owner for selector `0x50`.","objdump + local disassembly + registration-pass correlation + selector-0x50 correlation + dataset-field correlation"
0x004720d0,208,multiplayer_selector0x51_derive_session_status_and_publish_selector0x52_or_control0x109_fallback,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that consumes one structured payload from `[this+0x08]`, checks for a live session object at `0x006d40dc`, and then derives one small status code from `0x00468ce0`, `0x0046c280`, and `0x004eda30`. When all three routes still return `0xff`, it republishes shell control `0x109` from root `0x006cec7c` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30`; otherwise it forwards the caller buffer at `EDX+0x08` plus the derived code through the same transport with selector `0x52`. This is the clearest current structural read for selector `0x51` above that selector-`0x52` status branch.","objdump + local disassembly + registration-pass correlation + selector-0x51 correlation + selector-0x52 correlation + session-status correlation"
0x004721a0,32,multiplayer_selector0x55_store_payload_dword_into_dataset_field_0x9860,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,2,"Tiny selector-handler body that stores payload dword `[ [this+0x08] + 0x00 ]` directly into dataset field `[0x006cd8d8+0x9860]`. This is the current grounded owner for selector `0x55`.","objdump + local disassembly + registration-pass correlation + selector-0x55 correlation + dataset-field correlation"
0x004721c0,64,multiplayer_selector0x56_copy_payload_string_into_named_profile_entry,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,2,"Selector-handler body that resolves one `0x006ceb9c` entry from payload dword `[+0x04]` and copies the caller string at `[payload+0x08]` into that entry's inline name band `[entry+0x08]` until the terminating NUL. This is the current grounded owner for selector `0x56`.","objdump + local disassembly + registration-pass correlation + selector-0x56 correlation + 0x6ceb9c-entry correlation + string-copy correlation"
0x00472200,48,multiplayer_selector0x57_store_payload_dword_into_named_profile_guard_0x1e1,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,2,"Selector-handler body that resolves one `0x006ceb9c` entry from payload dword `[+0x00]` and stores payload dword `[+0x04]` into that entry's guard field `[entry+0x1e1]`. This is the current grounded owner for selector `0x57`.","objdump + local disassembly + registration-pass correlation + selector-0x57 correlation + 0x6ceb9c-entry correlation + guard-field correlation"
0x00472230,96,multiplayer_selector0x58_flush_deferred_named_profile_reset_queue,shell,cdecl,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that walks the 16-slot dataset byte queue `[0x006cd8d8+0x9864..+0x9873]`. For every slot whose byte is not `0xff`, it resolves the corresponding `0x006ceb9c` entry, clears guard dword `[entry+0x1e1]`, sets byte `[entry+0x293] = 1`, and then resets the queue slot back to `0xff`. This is the current grounded owner for selector `0x58`.","objdump + local disassembly + registration-pass correlation + selector-0x58 correlation + deferred-queue correlation + 0x6ceb9c-entry correlation"
0x00472290,208,multiplayer_selector0x59_derive_roster_capacity_status_and_publish_selector0x5a,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that validates one payload through `0x0046d7f0`, formats a temporary object through `0x005a19c4`, `0x005a125d`, and `0x00442400`, clamps object field `[obj+0x3b6]` to at most `4`, compares that result against shell field `[0x006cec7c+0x79]`, and conditionally re-enters `0x004ecc50` before setting the final status dword. It then forwards that four-byte result through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x5a`. This is the clearest current structural read for selector `0x59` above that derived selector-`0x5a` status lane.","objdump + local disassembly + registration-pass correlation + selector-0x59 correlation + selector-0x5a correlation + derived-status correlation"
0x00472360,96,multiplayer_selector0x5b_stage_current_token_and_publish_selector0x5c,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x5c`. This is the clean local selector-`0x5b` wrapper immediately above the selector-`0x5c` branch.","objdump + local disassembly + registration-pass correlation + selector-0x5b correlation + selector-0x5c correlation + staged-token correlation"
0x004723c0,144,multiplayer_selector0x5c_gate_company_entry_dispatch_0x493960_and_optional_local_metric_apply,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, resolves company id `[payload+0x00]` inside `0x0062be10`, and then branches on a float comparison from `0x0046a4b0` against threshold `0x005c8c28`. In the direct lane it dispatches the resolved company id into `0x00493960(0x006cfca8, id, 0, 0, 0)`. In the alternate lane it first performs the same dispatch and then builds a one-byte stack payload from the company id and forwards that temporary record into `multiplayer_apply_rounded_float_delta_to_company_entry_metric_pair_by_index_byte` `0x0046f870`. This is the clearest current structural read for selector `0x5c` above that dispatch-or-local-apply split.","objdump + local disassembly + registration-pass correlation + selector-0x5c correlation + company-entry correlation + local-apply correlation"
0x00472450,144,multiplayer_selector0x5d_validate_payload_string_and_publish_selector0x5e,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that validates the caller string at `[payload+0x08]` through `0x0046a440` and, when that validation passes, stages the current year-derived token into `[0x006cd8d8+0x8f38]` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x5e`. This is the clean local selector-`0x5d` wrapper immediately above the heavier selector-`0x5e` named-profile string-update branch.","objdump + local disassembly + registration-pass correlation + selector-0x5d correlation + selector-0x5e correlation + string-validation correlation"
0x004724e0,254,multiplayer_selector0x5e_update_named_profile_entry_string_and_live_session_label,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes one variable-length payload from `[this+0x08]` and requires a positive payload length from `[this+0x0c]`. On the active branch it uses payload dword `[+0x04]` to resolve one `0x006ceb9c` entry, copies the caller string at `[payload+0x08]` into that entry's inline name band `[entry+0x08]`, resolves the live session object at `0x006d40d0` from payload dword `[+0x00]`, mirrors the same string into `[session+0x08]`, and when `[session+0x50]` is nonzero hashes that string through `0x0053d810`, stores the result in `[session+0x48]`, and mirrors the string into dataset field `[0x006cd8d8+0x8f48]`. If the updated session id matches the current live session id it also decrements `0x006d10a0` and may re-enter `0x0053f000`. Empty-input failure falls back to localized status id `0x0b83`. This is the safest current structural read for selector `0x5e` beneath the preview-dataset callback table rather than a generic string setter.","objdump + local disassembly + caller inspection + selector-0x5e correlation + 0x6ceb9c-entry correlation + live-session-string correlation"
0x004725e0,91,multiplayer_selector0x5f_stage_current_token_and_publish_selector0x60,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x60`. This is the clean local selector-`0x5f` wrapper immediately above the narrower selector-`0x60` apply branch.","objdump + local disassembly + caller inspection + selector-0x5f correlation + selector-0x60 correlation + staged-token correlation"
0x00472640,159,multiplayer_selector0x60_apply_profile_entry_byte_0x15c_by_named_index_or_publish_error,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that either applies one small byte field into a `0x006ceb9c` entry or routes an error-style fallback. On the active payload branch it optionally marks whether payload dword `[+0x00]` matches the current live session id, resolves the target `0x006ceb9c` entry from payload dword `[+0x04]`, and when that entry's guard dword `[entry+0x1e1]` is nonzero writes payload byte `[+0x08]` into `[entry+0x15c]`. On the empty-input branch it instead resolves one live world-side owner through `0x004348c0`, copies global byte `0x00622090` into `[owner+0x15c]`, and falls back to localized status id `0x0b84`. In either branch, when the local-session match or fallback path is active it decrements `0x006d10a0` and may re-enter `0x0053f000`. This is the clearest current structural read for selector `0x60` above that one-byte profile-entry apply lane.","objdump + local disassembly + caller inspection + selector-0x60 correlation + 0x6ceb9c-entry correlation + live-world-owner correlation"
0x00472700,216,multiplayer_selector0x61_match_company_name_and_publish_selector0x62_or_error,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes one payload record from `[this+0x08]`, linearly scans indexed collection `0x0062be10` for the first entry whose inline name at `[entry+0x04]` matches the caller string at `[payload+0x08]`, and on a match stages the current year-derived token into `[0x006cd8d8+0x8f38]` before submitting selector `0x62` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with the original payload pointer and length from `[this+0x0c]`. When no matching company name resolves it instead submits the paired error-style selector-`0x62` payload through the `0x21` branch using the caller fallback buffer from `EDX+0x08`. This is the clearest current structural read for the selector-`0x61` owner above that selector-`0x62` submit split.","objdump + local disassembly + caller inspection + selector-0x61 correlation + selector-0x62 correlation + indexed-company-name correlation"
0x004727e0,144,multiplayer_selector0x62_copy_0x32_byte_company_entry_band_if_live_session_matches,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, checks whether payload dword `[+0x00]` matches the current live session id, resolves one company-style entry through `multiplayer_resolve_company_entry_by_index_if_live_session_profile_index_matches` `0x0046f8f0` using payload dword `[+0x04]`, and on success copies `0x32` bytes from payload band `[+0x08]` into the resolved entry at `[entry+0x04]` through `0x0051d8a0`. When the caller's session id matches the live session id but the entry apply fails, the helper falls back to localized status id `0x0b85`; the same local-session path then decrements `0x006d10a0` and may re-enter `0x0053f000`. This is the clearest current structural read for selector `0x62` above that fixed-width company-entry copy band.","objdump + local disassembly + caller inspection + selector-0x62 correlation + live-session correlation + company-entry copy correlation"
0x00472870,198,multiplayer_selector0x63_reject_duplicate_company_field_0x37_and_publish_selector0x64_or_error,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes one payload from `[this+0x08]`, linearly scans `0x0062be10` for an existing company-style entry whose dword field `[entry+0x37]` matches payload dword `[+0x08]`, and on the no-duplicate branch stages the current year-derived token into `[0x006cd8d8+0x8f38]` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x64`. When a duplicate field-`0x37` value already exists it instead submits the paired error-style selector-`0x64` payload through the `0x21` branch using the caller fallback buffer from `EDX+0x08`. This is the safest current structural read for selector `0x63` above the narrower selector-`0x64` field-apply branch.","objdump + local disassembly + caller inspection + selector-0x63 correlation + selector-0x64 correlation + company-entry field-0x37 correlation"
0x00472940,176,multiplayer_selector0x64_apply_company_field_0x37_or_publish_error,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that either applies payload dword `[+0x08]` into company-entry field `[entry+0x37]` or publishes an error-style fallback. On the active payload branch it checks whether payload dword `[+0x00]` matches the current live session id, resolves the matching company-style entry through `multiplayer_resolve_company_entry_by_index_if_live_session_profile_index_matches` `0x0046f8f0` using payload dword `[+0x04]`, and on success stores payload dword `[+0x08]` into `[entry+0x37]`. On the failure path it resolves one live world-side owner through `0x00434870`, copies global dword `0x00622094` into that same field offset `[owner+0x37]`, and falls back to localized status id `0x0b86`. When the local-session path is active it then decrements `0x006d10a0` and may re-enter `0x0053f000`. This is the clearest current structural read for selector `0x64` above that one-field company-entry apply lane.","objdump + local disassembly + caller inspection + selector-0x64 correlation + company-entry field-0x37 correlation + live-world-owner correlation"
0x004729f0,57,multiplayer_selector0x73_stage_current_token_and_publish_selector0x74,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x74`. This is the clean local selector-`0x73` wrapper immediately above the narrower selector-`0x74` dispatch body.","objdump + local disassembly + caller inspection + selector-0x73 correlation + selector-0x74 correlation + staged-token correlation"
0x00472a50,75,multiplayer_selector0x74_resolve_company_entry_id_and_dispatch_collection_0x62b26c,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes payload dword `[this+0x08]`, checks whether that id resolves inside collection `0x0062b26c`, and on success first trips the small gate at `0x0046d2b0(1.02f)` to toggle global latch `0x006ce9a8` before calling the collection's vtable slot `+0x08` with that same id and then restoring the latch. This is the safest current structural read for selector `0x74` above that narrow collection-dispatch lane rather than a generic callback stub.","objdump + local disassembly + caller inspection + selector-0x74 correlation + 0x62b26c-collection correlation + latch-0x6ce9a8 correlation"
0x00472aa0,57,multiplayer_selector0x71_stage_current_token_and_publish_selector0x72,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x72`. This is the clean local selector-`0x71` wrapper immediately above the heavier selector-`0x72` counted-record apply body.","objdump + local disassembly + caller inspection + selector-0x71 correlation + selector-0x72 correlation + staged-token correlation"
0x00472b00,675,multiplayer_selector0x72_apply_counted_structure_records_into_live_collections,shell,thiscall,inferred,objdump + local disassembly + caller inspection,4,"Heavier selector-handler body that consumes a counted record set from `[this+0x08]` and applies it into the live world-side collections rooted at `0x0062b2fc`, `0x0062b26c`, and `0x0062bae0`. The handler first gates through `0x0046d2b0(1.02f)` and raises latch `0x006ce9a8`, then branches on the leading count word at `[payload+0x02]`. Its singleton fast path requires count `1` and a nonzero leading key word, seeds temporary sentinel fields under `0x0062b2fc`, bumps the scoped counter `[0x0062bae0+0x88]`, validates one record through `placed_structure_validate_projected_candidate_placement` `0x004197e0`, allocates or applies the live object through `placed_structure_collection_allocate_and_construct_entry` `0x004134d0`, and refreshes the region-side derived state through `world_region_refresh_cached_structure_class_mix_scalar_0x312_from_linked_chain` `0x00420560` when the keyed `0x0062bae0` entry exists. The general path walks `count` records of stride `0x12` from `[payload+0x04]`, applies the same `0x004197e0 -> 0x004134d0 -> 0x00420560` pattern per record, and finally restores the temporary `0x0062b2fc` sentinel fields and clears latch `0x006ce9a8`. This is the safest current structural read for selector `0x72` above that counted live-world apply family rather than a generic serializer inverse.","objdump + local disassembly + caller inspection + selector-0x72 correlation + counted-record correlation + live-world-collection correlation"
0x00472db0,8,multiplayer_selector_callback_apply_metric_delta_payload_into_company_entry,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Tiny selector-facing wrapper that loads payload pointer `[this+0x08]`, forwards it into `multiplayer_apply_rounded_float_delta_to_company_entry_metric_pair_by_index_byte` `0x0046f870`, and then returns success. Registration-site xrefs place it under selector `0x6b` in the broader multiplayer callback table, so this is the local selector-`0x6b` apply leaf rather than the train-record branch.","objdump + local disassembly + caller inspection + selector-0x6b correlation + company-metric apply correlation"
0x00472dc0,8,multiplayer_selector_callback_apply_train_record_payload_into_live_train_entry,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Tiny selector-facing wrapper that loads payload pointer `[this+0x08]`, forwards it into `multiplayer_apply_train_record_fields_into_live_train_entry_by_id` `0x0046d780`, and then returns success. Registration-site xrefs place it under selector `0x6c` in the broader multiplayer selector-handler table rather than as a standalone service owner.","objdump + local disassembly + caller inspection + selector-0x6c correlation + train-apply correlation"
0x00472dd0,205,multiplayer_selector0x6d_publish_winner_status_text_into_world_buffer,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes one payload from `[this+0x08]`, checks for an active world root at `0x006cec78`, and when the leading winner id dword differs from the current world winner id from `0x004337b0` resolves the matching `0x006ceb9c` name entry and formats localized status id `0x0f4e` into a local buffer through `0x005193f0` and `0x00518de0`. It then copies that formatted string into the world-side outcome-text buffer `[world+0x4b47]`, or clears the first byte of that buffer when the name lookup fails, and finally sets world latch `[world+0x4a73] = 1`. This is the clearest current static owner for selector `0x6d` above the already-grounded live outcome-status text band.","objdump + local disassembly + caller inspection + selector-0x6d correlation + world-outcome-buffer correlation + 0x6ceb9c-name correlation"
0x00472ea0,102,multiplayer_selector0x6e_mark_matching_current_bucket_record_flag_0x08_by_payload_hash,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes a payload blob from `[this+0x08]`, resolves the current keyed bucket under `[EDX+0x2580]` using dataset key `[0x006cd8d8+0x9888]`, and then walks that bucket's linked node chain. For each node it hashes the current selector payload through `0x0053d870` when `[this+0x0c] > 0` and compares that hash against the payload's leading dword `[payload+0x00]`; on the first match it sets flag bit `0x08` in the companion object byte `[ [this+0x04] + 0x0b ]`. This is the cleanest current structural read for selector `0x6e` beneath the earlier selector-`0x13` hashed publish fallback.","objdump + local disassembly + caller inspection + selector-0x6e correlation + keyed-bucket correlation + payload-hash correlation"
0x00472f10,81,multiplayer_selector0x75_stage_current_token_and_publish_selector0x76,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x76`. This is the clean local selector-`0x75` wrapper immediately above the narrower selector-`0x76` company-entry dispatch body.","objdump + local disassembly + caller inspection + selector-0x75 correlation + selector-0x76 correlation + staged-token correlation"
0x00472f70,60,multiplayer_selector0x76_resolve_company_entry_and_dispatch_local_handler_0x409830,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes payload dword `[this+0x08]`, checks whether that id resolves inside collection `0x0062be10`, and on success resolves the matching company-style entry and forwards that entry into local handler `0x00409830`. This is the cleanest current structural read for selector `0x76` above that narrow company-entry dispatch lane rather than a generic callback stub.","objdump + local disassembly + caller inspection + selector-0x76 correlation + company-entry correlation + local-handler correlation"
0x00472fb0,81,multiplayer_selector0x77_stage_current_token_and_publish_selector0x78,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x78`. This is the clean local selector-`0x77` wrapper immediately above the heavier selector-`0x78` world-dispatch body.","objdump + local disassembly + caller inspection + selector-0x77 correlation + selector-0x78 correlation + staged-token correlation"
0x00473010,175,multiplayer_selector0x78_resolve_company_entry_and_dispatch_projection_request,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes one structured payload from `[this+0x08]`, checks whether payload dword `[+0x04]` resolves inside `0x0062be10`, and on success forwards payload tuple `[+0x04/+0x08/+0x0c]` plus local stack outputs into the broader world-side helper `0x0044b160` using scale `1.0f`. When that helper succeeds it also notifies owner `0x006d401c` through `0x00538e00(0xba, 0x808, 0, 0, 0)`. Separately, when payload dword `[+0x00]` matches the current live session id it clears field `[0x006d1a8c+0x83]`, re-enters `0x0053f000(1,0,0x15)`, and calls `0x0045ea20(0x39, 1.0f)`. This is the safest current structural read for selector `0x78` above that world-side projection or notify branch rather than a narrow leaf helper.","objdump + local disassembly + caller inspection + selector-0x78 correlation + world-helper-0x44b160 correlation + local-session correlation"
0x004730c0,81,multiplayer_selector0x79_stage_current_token_and_publish_selector0x7a,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x7a`. This is the clean local selector-`0x79` wrapper immediately above the narrower selector-`0x7a` company-entry dispatch body.","objdump + local disassembly + caller inspection + selector-0x79 correlation + selector-0x7a correlation + staged-token correlation"
0x00473120,90,multiplayer_selector0x7a_resolve_company_entry_and_dispatch_local_handler_0x427e20,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes one structured payload from `[this+0x08]`, checks whether payload dword `[+0x04]` resolves inside `0x0062be10`, and on success resolves the matching company-style entry and forwards that entry plus payload dword `[+0x08]` and zero flag into local handler `0x00427e20`. When payload dword `[+0x00]` matches the current live session id it also re-enters `0x0053f000(1,0,0)`. This is the cleanest current structural read for selector `0x7a` above that narrow company-entry dispatch lane.","objdump + local disassembly + caller inspection + selector-0x7a correlation + company-entry correlation + local-handler correlation"
0x00473180,81,multiplayer_selector0x7b_stage_current_token_and_publish_selector0x7c,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x7c`. This is the clean local selector-`0x7b` wrapper immediately above the narrower selector-`0x7c` company-entry dispatch body.","objdump + local disassembly + caller inspection + selector-0x7b correlation + selector-0x7c correlation + staged-token correlation"
0x004731e0,52,multiplayer_selector0x7c_resolve_company_entry_and_dispatch_local_handler_0x426d60,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes payload dword `[this+0x08]`, checks whether payload dword `[+0x04]` resolves inside `0x0062be10`, and on success resolves the matching company-style entry and forwards that entry into local handler `0x00426d60`. This is the cleanest current structural read for selector `0x7c` above that narrow company-entry dispatch lane rather than a generic callback stub.","objdump + local disassembly + caller inspection + selector-0x7c correlation + company-entry correlation + local-handler correlation"
0x00473220,81,multiplayer_selector0x7d_stage_current_token_and_publish_selector0x7e,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x7e`. This is the clean local selector-`0x7d` wrapper immediately above the registered selector-`0x7e` branch.","objdump + local disassembly + caller inspection + selector-0x7d correlation + selector-0x7e correlation + staged-token correlation"
0x00473280,1502,multiplayer_preview_dataset_reset_global_callback_state_and_register_selector_handlers,shell,cdecl,inferred,objdump + local disassembly + caller inspection,4,"Broader callback-registry seeding pass beneath the Multiplayer preview dataset constructor. The helper zeroes the two large multiplayer-global scratch bands at `0x006ce808..0x006ce994` and `0x006ce290`, clears the staged launcher globals `0x006ce628`, `0x006ce630`, and `0x006ce9b4..0x006ce9c8`, seeds the dataset-local default callback root at `[0x006cd8d8+0x08]` with `0x0046f4a0` through `multiplayer_preview_dataset_set_default_callback_root` `0x00468b50`, and then registers the keyed selector-handler family by repeatedly calling `multiplayer_preview_dataset_register_selector_callback_if_absent` `0x00468b10` for selector ids `1..0x83` with the concrete callback roots spanning `0x0046c390..0x00473220`. Current grounded caller is the full dataset constructor/reset body `0x0046be80`, so this is the clearest current owner for the broad selector-handler registration phase above the smaller fixed-name descriptor block `0x00473a60` rather than another anonymous callback fan-out.","objdump + local disassembly + caller inspection + global-scratch reset correlation + selector-handler registration correlation"
0x00473a60,219,multiplayer_preview_dataset_register_fixed_named_callback_descriptors_1_to_10,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Registers the first fixed selector-name callback block for the preview dataset at `0x006cd8d8`. The helper repeatedly calls `multiplayer_preview_dataset_append_named_callback_descriptor` `0x00469930` with selector ids `1..0xa`, fixed internal names from the `0x005ce3ac..0x005ce40c` string band, and the paired callback roots `0x0046db10..0x0046de80`. Current direct caller is the broader preview-dataset registration pass at `0x0046c1fb`, so this is the clearest current owner for the initial fixed descriptor block beneath `[0x006cd8d8+0x8f28]` rather than another anonymous callback fan-out.","objdump + caller inspection + local disassembly + fixed-descriptor-block correlation"
0x00473bf0,257,multiplayer_preview_dataset_publish_accumulated_selector0x71_record_batch,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Packages and publishes the accumulated fixed-width record band rooted at `0x006cd990` when the live count at `0x006ce9a0` is positive. The helper allocates one `0x14 * count + 0x4` payload block, prefixes it with two 16-bit header words `(0, count)`, copies each `0x12`-byte source record into the payload, submits that payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x71`, then resets `0x006ce9a0` and frees the temporary block. Current grounded caller is the broader current-session bucket service body `0x0046b9f0`, so this is the clearest current owner for the selector-`0x71` batch publish beneath that service path rather than another generic serializer.","objdump + local disassembly + caller inspection + selector-0x71 publish correlation"
0x00473cc0,3,multiplayer_preview_fixed_record_identity_helper,shell,thiscall,inferred,objdump + local disassembly,1,"Tiny identity helper that simply returns `ECX` unchanged. Current grounded caller is the fixed-record collection builder `0x00473f80`, where it initializes one stack-local temporary record before the later constructor and destructor callbacks.","objdump + local disassembly + fixed-record temp-helper correlation"
0x00473cd0,1,multiplayer_preview_fixed_record_noop_destructor_stub,shell,thiscall,inferred,objdump + local disassembly,1,"Literal no-op stub beside the `0x005ce418` fixed-record family. Current grounded caller is `0x00473f80`, where it serves as the paired release callback for the same stack-local temporary initialized by `0x00473cc0`.","objdump + local disassembly + fixed-record temp-helper correlation"
0x00473ce0,134,multiplayer_preview_fixed_record_construct_from_payload_strings_shell_profile_bytes_and_sequence,shell,thiscall,inferred,objdump + local disassembly + field-layout correlation,2,"Constructor for the `0x005ce418` fixed-record family rooted at size `0x187`. The helper stores the caller-supplied record id at `[this+0x00]`, copies one `0x78`-byte string into `[this+0x19]`, copies one `0xf0`-byte string into `[this+0x92]`, stores one caller dword at `[this+0x183]`, mirrors the current shell-profile-derived year tuple through `0x0051d3c0` into `[this+0x08]`, copies shell bytes `[0x006cec78+0x0d/+0x0f/+0x11]` into `[this+0x0c/+0x0e/+0x10]`, clears flag byte `[this+0x18]`, stores the caller-supplied owner dword at `[this+0x04]`, and assigns a monotonically increasing sequence at `[this+0x14]` from `0x006cea48`. Current grounded caller is the collection-side allocator `0x00473f80`, so this is the clearest current owner for the fixed record constructor rather than a generic string copier.","objdump + local disassembly + field-layout correlation + shell-profile correlation + sequence-counter correlation"
0x00473d70,42,multiplayer_preview_fixed_record_collection_construct,shell,thiscall,inferred,objdump + local disassembly + collection-layout correlation,2,"Constructor for the collection object rooted at vtable `0x005ce418`. The helper resets collection state through `0x00517ce0`, installs vtable `0x005ce418`, and initializes the collection through `0x00518570` with the fixed tuple `(1, 0x187, 0x0a, 0x05, 0, 0, 0)`. Current grounded callers are the fixed-record family paths beginning at `0x00473f80`, so this is the safest current read for the collection constructor rather than a record-local leaf.","objdump + local disassembly + collection-layout correlation + fixed-record-family correlation"
0x00473da0,18,multiplayer_preview_fixed_record_collection_release_and_free,shell,thiscall,inferred,objdump + local disassembly + collection-layout correlation,1,"Destructor-side wrapper for the same `0x005ce418` collection family. The helper reinstalls vtable `0x005ce418`, re-enters `0x00518600`, and then tails into `0x00518bd0`.","objdump + local disassembly + collection-layout correlation + fixed-record-family correlation"
0x00473dc0,87,multiplayer_preview_fixed_record_collection_query_max_sequence_entry,shell,thiscall,inferred,objdump + local disassembly + collection-iteration correlation,2,"Scans the live `0x005ce418` fixed-record collection and returns the record whose sequence dword `[entry+0x14]` is greatest. When no live record exists the helper returns `0`.","objdump + local disassembly + collection-iteration correlation + sequence-field correlation"
0x00473e20,73,multiplayer_preview_fixed_record_collection_query_any_inactive_record_with_owner,shell,thiscall,inferred,objdump + local disassembly + collection-iteration correlation,2,"Returns `1` when the live `0x005ce418` collection contains at least one record whose active flag byte `[entry+0x18]` is zero and whose owner dword `[entry+0x04]` is nonzero; otherwise returns `0`. This is the cleanest current structural read for the boolean scan beneath the same fixed-record family.","objdump + local disassembly + collection-iteration correlation + fixed-record-family correlation"
0x00473e70,106,multiplayer_preview_fixed_record_collection_query_min_sequence_entry_with_optional_active_filter,shell,thiscall,inferred,objdump + local disassembly + collection-iteration correlation,2,"Scans the live `0x005ce418` fixed-record collection and returns the record whose sequence dword `[entry+0x14]` is smallest. When the caller-supplied stack flag is zero it skips records whose active byte `[entry+0x18]` is nonzero; otherwise it accepts all live records. On no match it returns `0`.","objdump + local disassembly + collection-iteration correlation + sequence-field correlation + active-flag correlation"
0x00473ee0,68,multiplayer_preview_fixed_record_collection_find_entry_by_previous_sequence,shell,thiscall,inferred,objdump + local disassembly + collection-iteration correlation,2,"Searches the live `0x005ce418` fixed-record collection for the entry whose sequence dword `[entry+0x14]` equals `arg - 1`. On success it returns the resolved entry; otherwise `0`.","objdump + local disassembly + collection-iteration correlation + sequence-field correlation"
0x00473f30,68,multiplayer_preview_fixed_record_collection_find_entry_by_next_sequence,shell,thiscall,inferred,objdump + local disassembly + collection-iteration correlation,2,"Searches the live `0x005ce418` fixed-record collection for the entry whose sequence dword `[entry+0x14]` equals `arg + 1`. On success it returns the resolved entry; otherwise `0`.","objdump + local disassembly + collection-iteration correlation + sequence-field correlation"
0x00473f80,170,multiplayer_preview_fixed_record_collection_allocate_and_construct_entry,shell,thiscall,inferred,objdump + local disassembly + caller inspection + collection-layout correlation,2,"Shared allocator and constructor beneath the `0x005ce418` fixed-record family. When the live collection size exceeds `0x19`, the helper repeatedly resolves the minimum-sequence entry through `0x00473e70(1)` and removes it through collection virtual slot `+0x08` until the size drops to `0x19` or below. It then initializes one stack-local temporary through `0x00473cc0/0x00473cd0`, allocates a new live record through `0x00518900`, resolves that record through `0x00518140`, constructs it through `0x00473ce0` with the caller-supplied payload tuple, and finally tears down the temporary helper. This is the clearest current owner for fixed-record allocation plus constructor dispatch in the preview-side family.","objdump + local disassembly + caller inspection + collection-layout correlation + fixed-record-family correlation"
0x00470210,119,multiplayer_submit_chat_or_command_line,shell,cdecl,inferred,ghidra-headless,4,Submits one Multiplayer.win chat-entry line. The wrapper first calls multiplayer_dispatch_chat_command on the raw line buffer; when the parser returns zero it formats a normal `%s > %s` named chat line from the sender object at `[edi+0x08]` and the message payload; then either publishes it locally through multiplayer_publish_wrapped_chat_message or routes it through the active transport object at `0x006cec78`. When the parser returns nonzero the wrapper skips normal chat formatting because the slash-command branch already consumed the line.,ghidra + rizin + llvm-objdump + strings
0x004ecc90,52,multiplayer_set_pending_session_substate,shell,unknown,inferred,ghidra-headless,2,Small pending-session-substate setter used by the multiplayer session-event callback family. The grounded stores are request id `5` to substate `5` request id `6` to substate `6` and request id `8` to substate `8` at `0x006d1288`. Other current callback-family callers still pass ids `1` `2` `4` and `7` without a visible store in this helper so this row stays structural for now.,ghidra + rizin + llvm-objdump
0x004edce0,19,multiplayer_notify_window_owner,shell,unknown,inferred,ghidra-headless,3,Thin Multiplayer.win owner-notification wrapper. It loads the current window owner singleton from `0x006d1268` and when present forwards the supplied payload pointer into 0x004eccd0 for owner-side handling; current grounded callers are the session-event callback family around 0x004691a0 and the related registration path near 0x0046a8b3.,ghidra + rizin + llvm-objdump
0x004ecb20,101,multiplayer_reset_local_session_slot_state,shell,cdecl,inferred,ghidra-headless,4,Resets the local Multiplayer.win session-slot state before window init or add-open-slot flows. The helper marks the local state at `0x006cec7c+0x97` initialized clears the local slot counters at `+0x79` and `+0x7b` zeroes the slot-marker bytes at `+0x87` clears the local summary block at `+0x44` and zero-fills the large session backing block at `0x006d1270` when present.,ghidra + rizin + llvm-objdump
0x004ecb90,191,multiplayer_probe_or_allocate_open_player_slot,shell,cdecl,inferred,ghidra-headless,3,Probes or allocates one open local player-slot marker against the active Multiplayer.win session block at 0x006d1270. In probe mode `ecx=1` the helper checks that the local open-slot count and slot-marker bytes at `0x006cec7c+0x87` still fit within the remote slot counts and occupancy bytes rooted at `session+0x31b` and `session+0x3a3` and returns nonzero only when one additional slot can be claimed. In allocate mode `ecx=0` it finds the first locally empty slot whose remote occupancy byte is nonzero writes marker `0x64+index` into the local slot array increments `0x006cec7c+0x7b` and returns `0xff` on success.,ghidra + rizin + llvm-objdump
0x004ed590,224,multiplayer_sync_staged_text_controls,shell,cdecl,inferred,ghidra-headless,3,Synchronizes the shared Multiplayer.win staged-text buffer into the two mirrored text controls at ids 0xe48 and 0xe5d and then copies the same string back into the active selection buffer at 0x006cec74+0x1ef when it changed. The helper reallocates each control-owned backing string as needed and is used from the larger window initializer pending-status service and one delayed service-loop recovery branch.,ghidra + rizin + llvm-objdump
0x004ed800,109,multiplayer_preview_dataset_construct,shell,thiscall,inferred,objdump + caller xrefs,3,"Constructor-style zero initializer for the large Multiplayer preview-dataset object later stored at `0x006cd8d8`. It clears the leading linkage and mode fields, resets the request and staging words around `0x8f18..0x8f44`, zeroes the shell-mode snapshot slots at `0x9050` and `0x9054`, clears the dataset state word at `0x985c`, seeds `0x9860` to `-1`, and leaves the object ready for the follow-on reset and dispatch paths.",objdump + caller xrefs
0x004ed890,164,multiplayer_schedule_requested_action,shell,cdecl,inferred,ghidra-headless,3,Initializes one requested Multiplayer.win action and resets the shared action globals before later dispatch. The helper writes the requested action id from EDI into 0x006d127c marks the action-active bit at 0x006d1274 clears the pending-step and substate fields at 0x006d1278 0x006d1280 and 0x006d1288 tears down the prior helper object at 0x006d1294 and allocates a fresh 0x10-byte helper. The currently named action writers above it queue action ids 1 and 4 from preview-dataset reset 2 from staged text-entry dialog setup 3 from staged text-entry commit and 5 or 6 from selected-preview follow-up branches.,ghidra + rizin + llvm-objdump
0x004ed940,235,multiplayer_rebuild_open_player_slot_markers,shell,cdecl,inferred,ghidra-headless,3,Rebuilds the local Multiplayer.win open-player slot markers from the active session slot table and republishes the resulting count. The helper clears any existing local slot bytes above `0x64` from `0x006cec7c+0x87` while decrementing `0x006cec7c+0x7b` then walks the remote slot records at `session+0x31b` with count `session+0x3ae`. For each remotely open record it uses multiplayer_probe_or_allocate_open_player_slot to claim the next local marker when capacity remains and then formats the updated open-slot count into shell control `0x6f` with resource id `0xe36`.,ghidra + rizin + llvm-objdump
0x004edc40,145,multiplayer_reset_preview_dataset_and_request_action,shell,cdecl,inferred,ghidra-headless,3,Resets the active Multiplayer.win preview dataset object at 0x006cd8d8 and immediately schedules the next requested action. The helper destroys any existing 0x9898-byte dataset object allocates and constructs a fresh one through 0x004ed800 clears the text control at id 0xe47 and the staged entry buffer at 0x006d11a8 and then queues action id 1 when the caller passes zero or action id 4 when the caller passes a nonzero dataset-related value.,ghidra + rizin + llvm-objdump
0x004ee0e0,225,multiplayer_open_staged_text_entry_dialog,shell,cdecl,inferred,ghidra-headless,3,Opens the small Multiplayer.win staged text-entry dialog and queues requested action 2. The helper chooses one of two prompt ids from the current preview mode copies the current profile text from 0x006cec74+0x1ef into the staging buffer at 0x006d1128 persists the profile state through 0x00484910 builds a formatted prompt string through 0x00518de0 and opens the modal shell dialog through 0x004c98a0 with the local callbacks at 0x004ed100 and 0x004ed4c0 before queuing action 2.,ghidra + rizin + llvm-objdump
0x004ee1d0,456,multiplayer_commit_staged_text_entry,shell,cdecl,inferred,ghidra-headless,3,Commits one staged Multiplayer.win text entry and queues requested action 3 when validation succeeds. The helper refreshes the mode-dependent prompt text saves the shared profile state through 0x00484910 copies either the caller-provided string or the text control 0xe47 into the staging buffer at 0x006d11a8 derives the companion buffer at 0x006d1228 from the current preview object or fallback globals and when the staged text exceeds five bytes schedules action 3 through multiplayer_schedule_requested_action; otherwise it clears the staged buffer and text control.,ghidra + rizin + llvm-objdump
0x004ee3a0,244,multiplayer_reset_tool_globals,shell,thiscall,inferred,ghidra-headless,3,Resets the smaller multiplayer-tool singleton state rooted around 0x006d1268 through 0x006d1270 for one shell mode created from 0x00482ec0. The helper seeds the shared vtable clears or rebinds the active singleton pointers and performs the same early shell-service notifications used by the larger Multiplayer.win initializer before later selection or preview code runs.,ghidra + rizin + llvm-objdump + strings
0x004ee430,141,multiplayer_update_preview_mode_labels,shell,cdecl,inferred,ghidra-headless,3,Updates the small mode-dependent label widget pair used by the Multiplayer.win preview branch. The helper chooses one of two label-id pairs anchored by string ids 0xe12 0xe18 and 0xe73 then writes them through 0x00540120 into shell controls such as ids 0x65 0x6d 0x86 and 0x87. It is called from multiplayer_load_selected_map_preview_surface the larger multiplayer initializer and the restore-from-globals callback.,ghidra + rizin + llvm-objdump + strings
0x004ee4c0,49,multiplayer_publish_control_0x69_mode,shell,cdecl,inferred,ghidra-headless,2,Publishes the current mode for Multiplayer.win control 0x69 from the presence of the session-related singleton at 0x006d40dc. The helper pushes mode 3 when that object exists or mode 1 otherwise through 0x00469d30 and is used after preview and count-setting branches to keep that control in sync with session state.,ghidra + rizin + llvm-objdump
0x004ee500,50,multiplayer_are_all_peer_ready,shell,cdecl,inferred,ghidra-headless,4,Returns true only when every element in the shell-owned multiplayer peer list exposed through 0x00521680 has ready flag bit 0x01 set at offset +0x5c. The service loop uses this gate before committing the larger multiplayer launch or transition branch.,ghidra + rizin + llvm-objdump
0x004ee540,352,multiplayer_refresh_peer_roster_list,shell,cdecl,inferred,ghidra-headless,3,Refreshes the Multiplayer.win peer-roster list for preview modes 0xe12 and 0xe13. The helper chooses one of two mode-dependent text ids updates control 0x8b when the current roster selection is valid enumerates either the direct peer list at 0x006d40d0 or the fallback dataset-backed names from 0x006cd8d8 into repeated control-0x88 entries and when no roster entries remain forces a preview-dataset reset through multiplayer_reset_preview_dataset_and_request_action. It also republishes one session-state byte into shell control 9 before returning.,ghidra + rizin + llvm-objdump
0x004ee6a0,359,multiplayer_refresh_map_entry_list,shell,cdecl,inferred,ghidra-headless,3,Refreshes the Multiplayer.win map-entry list for preview modes 0xe11 and 0xe13. The helper chooses one of two mode-dependent text ids writes the active selection header into control 0x8b walks up to 0x80 0x11c-byte records from the list object exposed by control 0xe47 publishes each entry into repeated control-0x88 rows and mirrors the currently selected matching row into control 0x66. The comparison path uses the current staged selection text copied into a local buffer before the list walk.,ghidra + rizin + llvm-objdump
0x004ee810,308,multiplayer_publish_wrapped_chat_message,shell,cdecl,inferred,ghidra-headless,4,Publishes one Multiplayer.win chat or status message into the mode-dependent chat pane. The helper chooses text resource `0xe32` or `0xe5c` from the current preview mode at `[window+0x7c]`; resolves the corresponding text list object through `0x0053f830`; word-wraps the supplied string to width `0x3e`; emits each wrapped row into control `0x88` through `0x00540120`; stores per-row metadata back into the list object; and finally updates the summary row in control `0x66` or clears the pane when the caller passes a null string. It is used by the local chat transport fallback; the named `%s > %s` message publisher; and the Multiplayer.win launch-side action wrappers.,ghidra + rizin + llvm-objdump + strings
0x004eed30,208,multiplayer_sync_selected_map_entry,shell,cdecl,inferred,ghidra-headless,3,Selection wrapper above 0x004ee950 for the multiplayer map-preview branch. It walks the current 0x25a-byte multiplayer entry table compares the selected record string against the shell selection buffer near 0x006cec7c and then calls 0x004ee950 with either the matching strings or null inputs to refresh the active preview state.,ghidra + rizin + llvm-objdump
0x004ee950,982,multiplayer_load_selected_map_preview_surface,shell,cdecl,inferred,ghidra-headless,4,Loads or refreshes the currently selected .gmt-backed preview surface for the multiplayer window family rooted at 0x006d1270. The routine validates the selected filename suffix copies selected strings into the active record updates preview or status values under offsets such as +0x3b2 and +0x3b6 formats several shell text fields through 0x00540120 and finishes by decoding a 256x256 image through 0x0053f830 and surface_init_rgba_pixel_buffer. The branch is anchored by the larger Multiplayer.win initializer at 0x004efe80.,ghidra + rizin + llvm-objdump + strings
0x004eee00,649,multiplayer_refresh_map_preview_panel,shell,cdecl,inferred,ghidra-headless,3,Refreshes the multiplayer map-preview panel for one requested preview state or sentinel value. The helper stores the requested state at [this+0x78] updates several shell text fields through 0x00540120 handles the special active state 0xe15 and the fallback -1 case copies the selected entry strings out of the multiplayer entry table at 0x006d126c into the shell selection buffer near 0x006cec7c and then routes through multiplayer_sync_selected_map_entry or multiplayer_load_selected_map_preview_surface before returning.,ghidra + rizin + llvm-objdump + strings
0x004ef090,365,multiplayer_select_preview_mode_and_refresh,shell,cdecl,inferred,ghidra-headless,3,Selects one of the top-level multiplayer preview modes identified by command ids 0xe10 through 0xe13 then refreshes the preview panel. The helper stores the requested mode at [this+0x7c] updates the four mode-button states through 0x00540120 handles the special 0xe12 branch with extra multiplayer refresh helpers and a direct multiplayer_refresh_map_preview_panel call for state 0xe15 emits a summary status field at 0xe55 falls back through multiplayer_refresh_map_preview_panel(-1) and finally refreshes the panel timestamp at [this+0x80] through 0x0051d890.,ghidra + rizin + llvm-objdump + strings
0x004ef200,1786,multiplayer_service_pending_status_state_machine,shell,cdecl,inferred,ghidra-headless,4,Services the pending Multiplayer.win status or transition state machine when the global flag at `0x006d1278` is set. The routine clears the pending flag switches over the queued step id at `0x006d1280` and now has several grounded branches: step `1` builds modal status `0xe4f` optionally appends owner text from `0x006d4118/0x006d411c` tears down the preview dataset at `0x006cd8d8` and refreshes control `0xcc`; step `2` clears `0x006cd920` destroys the preview dataset and opens status `0xe50`; step `3` gates on latch byte `0x006d1292` and warns with `0xe51`; step `4` requires `0x006cd920 != 0` and `0x006ae3c8 >= 3` or warns with `0xe52` otherwise it seeds a random `RT3Player%d` name into the staged-text controls through multiplayer_sync_staged_text_controls and sets `0x006ae3c4 = 2`; step `5` opens status `0xe54` then rebuilds the preview dataset through multiplayer_reset_preview_dataset_and_request_action. A second substate switch on `0x006d1284` formats statuses `0xe55..0xe5f` `0xe92` and `0xf53`; its `0x5` and `0x8` families either force preview mode `0xe13` or reseed the default player-name path before syncing the staged-text controls.,ghidra + rizin + llvm-objdump + strings
0x004ef960,1260,multiplayer_dispatch_requested_action,shell,cdecl,inferred,ghidra-headless,4,Dispatches the current requested Multiplayer.win action stored in `0x006d127c`. The switch drives six higher-level action cases that combine immediate mode changes through multiplayer_select_preview_mode_and_refresh with deferred pending-step writes into `0x006d1278` and `0x006d1280`. The grounded wrappers are now broader than before: action `1` either enters preview mode `0xe11` immediately or schedules pending step `1`; action `2` resets the local session-slot state through multiplayer_reset_local_session_slot_state copies the staged text buffers into the active dataset seeds one local open-slot marker refreshes the local player rows enters preview mode `0xe12` and rebuilds the open-slot markers; action `3` copies the staged text buffers back into the active multiplayer object and then uses the dataset mode at `[0x006cd8d8+0x0c]` to schedule pending steps `0xa` `0xb` `0xc` `0xe` or fallback `0x2` while its resolved-mode branch re-enters preview mode `0xe12` clears latches `0x006d1291/0x006d1292` and seeds the local player panel; action `4` promotes the committed staged text into preview mode `0xe13` or schedules pending step `5` or `6` from the launcher substate at `0x006d1288`; action `5` pumps the selected-map follow-up callback then either rebuilds the open-slot markers and refreshes status control `0x109` or schedules pending step `1` with control `0x11` updates depending on the current launch-side state; action `6` validates the staged text against the active dataset and schedules pending step `6` when the launcher substate remains armed.,ghidra + rizin + llvm-objdump
0x004efe80,1388,multiplayer_window_init_globals,shell,thiscall,inferred,ghidra-headless,4,Initializes the Multiplayer.win shell window family and its large backing state block. The constructor seeds the shared vtable at 0x005d12ac clears multiplayer globals under 0x006d1274 through 0x006d1288 allocates and zeroes a 0x100f2-byte data block stored at 0x006d1270 registers the active singleton at 0x006d1268 pushes the Multiplayer.win resource into the standard shell window setup helper and then continues with multiplayer-specific list and status initialization. `shell_transition_mode` now grounds this as its mode-`5` constructor branch at `0x483313`.,ghidra + rizin + llvm-objdump + strings + branch correlation
0x0053f830,39,shell_window_find_registered_child_control_by_id,shell,thiscall,inferred,objdump + constructor helper correlation,3,"Looks up one registered shell child control by its 16-bit control id in the intrusive child-control list rooted at `[this+0x70]`. The helper walks each child through link field `+0x8e`, compares the requested id against child field `+0x04`, and returns the matching child pointer or null. Current grounded callers include the `Setup.win` preview-surface publisher `0x00502220`, the `Setup.win` constructor `0x00504010`, and `GameUppermost.win` message handler `0x004e0ba0`, which makes this the generic shell child-control lookup helper rather than a setup-only path.","objdump + constructor helper correlation + caller xrefs + intrusive-list correlation"
0x0053f9c0,131,shell_window_register_child_control_sorted_by_priority_and_optional_tag,shell,thiscall,inferred,objdump + constructor helper correlation,3,"Registers one prepared child-control object on the owning shell window while maintaining the intrusive child-control list rooted at `[this+0x70]/[this+0x74]`. The helper first finalizes the child through `shell_child_control_set_owner_resolve_caption_and_refresh` `0x00558130(owner)`, then walks the existing child list by priority byte at child field `+0x08`, optionally using the caller-supplied u16 tag to stop on one equal-priority sibling, and finally splices the child into the doubly linked list through fields `+0x8a/+0x8e`. Current grounded callers include the `Setup.win` constructor-side optional child branch at `0x0050429b` and the dividend-modal control setup helper `0x004c4c70`, so this now reads as the generic ordered child-control registration helper beneath several shell window constructors.","objdump + constructor helper correlation + caller xrefs + intrusive-list correlation + priority-order correlation"
0x0053fa50,508,shell_window_bind_resource_and_initialize_child_control_links,shell,thiscall,inferred,objdump + constructor correlation + strings,4,"Base shell window setup helper reused by many shell-side constructors. It clears the owning window's child-control list heads at `[this+0x70]/[this+0x74]`, copies the caller-supplied resource name into the local buffer at `[this+0x35]`, seeds several base window fields such as `[this+0x21] = 0x14` and clears `[this+0x54]/[this+0x58]`, and then continues through the shared shell resource-bind path for the requested window resource. Current grounded callers include the constructors for `Setup.win`, `Multiplayer.win`, `LoadScreen.win`, `Game.win`, `Campaign.win`, `Credits.win`, `Trainbuy.win`, `TrainDetail.win`, `StationDetail.win`, and several editor or detail-side dialogs, which makes this the generic shell window resource-bind and child-list initialization helper rather than one mode-specific constructor.","objdump + constructor correlation + strings + caller xrefs + child-list initialization correlation"
0x00558130,70,shell_child_control_set_owner_resolve_caption_and_refresh,shell,thiscall,inferred,objdump + child-control correlation,3,"Initial child-control finalizer used just before intrusive registration on a shell window. The helper stores the owning window pointer at `[this+0x86]`, resolves one localized caption into the inline text buffer at `[this+0x43]` when control word `[this+0x40]` is nonzero through `0x5193f0 -> 0x51d820`, normalizes uninitialized field `[this+0x38]` to `-1`, and then re-enters the child vtable through slots `+0x14` and `+0x3c` to refresh derived control state. Current grounded caller is `shell_window_register_child_control_sorted_by_priority_and_optional_tag` `0x0053f9c0`, which makes this the generic child-control setup step rather than a setup-only helper.","objdump + child-control correlation + caller xrefs + localized-caption correlation"
0x00504010,686,shell_setup_window_construct,shell,thiscall,inferred,objdump + strings + caller xrefs,4,"Constructs the `Setup.win` shell window singleton rooted at `0x006d14c0`. The constructor seeds vtable `0x005d1664`, binds the `Setup.win` resource plus `Setup_Coast_To_Coast.imb` through the shared base helper `shell_window_bind_resource_and_initialize_child_control_links` `0x0053fa50`, seeds companion globals `0x006d14b0..0x006d14bc`, marks the runtime profile at `0x006cec7c+0x7d`, immediately refreshes the mode-dependent and summary lanes through `0x00502910` and `0x00502550`, and seeds initial submode `1` through `shell_setup_window_select_launch_mode_and_apply_shell_state` `0x00502c00(1)`. It then builds the setup-control bands rooted at ids `0x0ce8`, `0x0e86`, `0x0e87`, `0x0e88`, repeated ranges `0x0c80..0x0c86` and `0x0f6f..0x0f71`, and optional controls such as `0x0ddf`, `0x0d4c`, and `0x0bd0`. The constructor-side callback split is tighter now too: control `0x0ce8` installs the table-driven payload-category row callback `0x00502030`, while controls `0x0e86` and `0x0e87` install the persisted shell-state selector callbacks `0x00502160` and `0x005021c0`, so that trio belongs to the presentation/config-save side of `Setup.win` rather than the later startup-selector or submode-dispatch lanes. The broader constructor shape is tighter too: the repeated `0x0c80..0x0c86` and `0x0f6f..0x0f71` bands are installed homogeneously as one button-family layer, `0x0e88` is a separate special control whose returned shell object is looked up through `shell_window_find_registered_child_control_by_id` `0x0053f830` and then retuned through float fields `+0xbc/+0xc4`, and the grayscale-heightmap controls `0x0ddf` and `0x0d4c` are only installed when the small capability guard at `0x0051b6f0` says that lane is available. The remaining optional child at `0x0bd0` is tighter now too: it is not another launch root, but a constructor-only owned child control built from the template string block at `0x005d16b4`, one temporary descriptor assembled on the stack through `0x0051d820`, and one optional `0x111`-byte heap object initialized through `0x0053b070/0x0055a040` before registration through `shell_window_register_child_control_sorted_by_priority_and_optional_tag` `0x0053f9c0`. `shell_transition_mode` now grounds this as its mode-`2` constructor branch at `0x483289`.","objdump + strings + caller xrefs + branch correlation + constructor callback correlation + constructor seed-path correlation + conditional-control-install correlation + optional-child-control correlation + generic-shell-helper correlation"
0x00502030,301,shell_setup_window_draw_table_driven_payload_category_row,shell,stdcall,inferred,objdump + constructor callback correlation + data-table inspection,3,"Table-driven `Setup.win` draw callback installed on control `0x0ce8` by the constructor at `0x00504010`. The callback uses the current setup payload at `0x006d14bc` plus the caller row index to read one category byte at `+0x31a`, maps that byte through the record table rooted at `0x005f2d47` to one localized string id via `0x005193f0`, chooses one of the companion style slots `0x18/0x19` depending on whether the current row falls below the shell-state threshold `[0x006cec7c+0x79]`, and then renders the assembled label through the companion objects at `0x006d14b0` and `0x006d14b4` via `0x0053de00 -> 0x00552560`. Current evidence grounds the callback as a table-driven payload-category row renderer rather than another launch or submode selector, even though the exact player-facing category name behind byte `+0x31a` remains open.","objdump + constructor callback correlation + data-table inspection + setup-payload correlation"
0x005174e0,136,shell_video_window_construct,shell,thiscall,inferred,objdump + strings + caller xrefs,4,"Constructs the `Video.win` shell window family. The constructor seeds vtable `0x005d1a4c`, increments the live counter under `0x006d4024+0x11427a`, stores live state in globals `0x006d3b68`, `0x006d3b74`, and `0x006d3b78`, binds the `Video.win` resource through `0x0053fa50`, and seeds the primary callback control `0x0c096`. `shell_transition_mode` now grounds this as its mode-`3` constructor branch at `0x4832b7`. The nearby sibling `0x00517660` binds `WinLose.win`, which makes that helper a related child panel rather than the main transition-mode window.","objdump + strings + caller xrefs + sibling correlation"
0x00517570,101,shell_video_window_destroy,shell,thiscall,inferred,objdump + strings + caller xrefs,4,"Destructor for the `Video.win` shell window family rooted at vtable `0x005d1a4c`. It decrements the live counter under `0x006d4024+0x11427a`, restores display bounds through `0x005206b0`, notifies the shell runtime through `0x00538a40`, and when the one-shot latch at `0x006d3b68` is set it clears `[0x006cec74+0xa8]` and re-enters the shell-support path through `0x00484910(1)`. This is the destructor sibling of `shell_video_window_construct` `0x005174e0` and is the old-mode teardown branch used by `shell_transition_mode` when leaving mode `3`.","objdump + strings + caller xrefs + destructor correlation"
0x004b8dc0,149,shell_campaign_window_destroy,shell,thiscall,inferred,objdump + strings + caller xrefs,4,"Destructor for the `Campaign.win` shell mode family. It restores vtable `0x005d0570`, resets shell display bounds through `0x005206b0`, marks one runtime display flag under `[0x006cec74+0x14]+0x110`, clears globals `0x006cfd28` and `0x006cfd34`, and then tails into the common shell object destructor. This is the destructor sibling of `shell_campaign_window_construct` `0x004b8e60` and is the explicit old-mode teardown branch used by `shell_transition_mode` when leaving mode `7`.","objdump + strings + caller xrefs + destructor correlation"
0x004b8e60,610,shell_campaign_window_construct,shell,thiscall,inferred,objdump + strings + caller xrefs,4,"Constructs the `Campaign.win` shell mode family. The constructor seeds vtable `0x005d0570`, binds `Campaign.win`, clears singleton globals `0x006cfd20` and `0x006cfd28`, stores the active object at `0x006cfd1c`, creates control families rooted at `0x0c351`, `0x0c36c..0x0c371`, `0x0c397..0x0c39a`, and `0x0c39b`, seeds or refreshes the shared companion object `0x006cfd34`, and mirrors campaign selectors from `[0x006cec7c+0xc4/+0xc6]` into local state plus the control band starting at `0x0c352`. `shell_transition_mode` now grounds this as its mode-`7` constructor branch at `0x483367`.","objdump + strings + caller xrefs + branch correlation"
0x004c7bc0,181,shell_credits_window_destroy,shell,thiscall,inferred,objdump + strings + caller xrefs,4,"Destructor for the `Credits.win` shell window family rooted at `0x006cfe8c`. It restores vtable `0x005d099c`, releases the 31 loaded image handles stored from `[this+0x78]`, frees the companion globals `0x006cfe90..0x006cfe9c`, clears the singleton `0x006cfe8c`, and releases the optional shared companion object `0x006cfea0`. This is the destructor sibling of `shell_credits_window_construct` `0x004c7fc0` and is the old-mode teardown branch used by `shell_transition_mode` when leaving mode `6`.","objdump + strings + caller xrefs + destructor correlation"
0x004c7fc0,717,shell_credits_window_construct,shell,thiscall,inferred,objdump + strings + caller xrefs,4,"Constructs the `Credits.win` shell window singleton rooted at `0x006cfe8c`. The constructor seeds vtable `0x005d099c`, binds `Credits.win` through `0x0053fa50`, loads `data\\Language\\Credits.lng`, materializes up to 250 credit rows into the large local table at `[this+0x584]`, loads the `logos.imb` companion asset and three additional shell resources into globals `0x006cfe90..0x006cfe9c`, seeds control `0x0edb`, and optionally allocates the shared companion object at `0x006cfea0`. `shell_transition_mode` now grounds this as its mode-`6` constructor branch at `0x48333d`.","objdump + strings + caller xrefs + branch correlation"
0x004f03f0,3612,multiplayer_window_service_loop,shell,cdecl,inferred,ghidra-headless,3,Top-level Multiplayer.win service loop. The function performs an early startup countdown through `0x006cd90c` calls multiplayer_service_pending_status_state_machine processes the special pending-step-10 gate with latch byte `0x006d1292` clears one text field when pending step 2 completes and then continues into the broader multiplayer update loop with timed retries staged-text synchronization peer-roster and map-entry list refresh helpers object-state checks and several mode-specific update branches. It queues requested action 5 after rebuilding one selected-map preview follow-up path and requested action 6 after the validated staged-text follow-up dialog branch. The launch-side inline wrappers now separate into three behaviors: a peers-not-ready warning dialog on resource `0xf15`; an add-open-slot path that seeds `0x006cec7c+0x83` stores the callback owner in `0x006d4110` and refreshes status control `0x109`; and a missing-session or slot-capacity warning path that opens modal dialogs on resources `0x2cf` `0x2b8` or `0x2b9`.,ghidra + rizin + llvm-objdump
0x004f13e0,167,multiplayer_restore_preview_state_from_globals,shell,thiscall,inferred,ghidra-headless,3,Restores the Multiplayer.win preview UI from the current global mode and preview-state fields. The callback refreshes the mode-dependent labels through multiplayer_update_preview_mode_labels mirrors selection presence into the active shell object toggles the 0x006d1291 recursion guard replays multiplayer_select_preview_mode_and_refresh and multiplayer_refresh_map_preview_panel using the saved fields at [this+0x7c] and [this+0x78] and if the active preview resources are missing schedules pending status step 7 by writing 0x006d1278 and 0x006d1280 instead of forcing an immediate redraw.,ghidra + rizin + llvm-objdump + strings
0x00502220,813,shell_setup_window_publish_selected_profile_labels_and_preview_surface,shell,cdecl,inferred,objdump + local disassembly,3,"Publishes the currently selected `Setup.win` profile or scenario labels and optional preview surface into the live window object supplied in `ECX`. The helper synchronizes the staged path pair under `[0x006cec7c]+0x11` and `+0x44`, toggles the local presence byte `[0x006cec7c+0x10]`, formats the visible label fields `0xcf5`, `0xe7f`, `0xd4c`, and `0xd4e` through `0x00540120`, and when a live setup payload is present under `0x006d14bc` first re-enters `shell_setup_load_selected_profile_bundle_into_payload_record` `0x00442400`, then copies payload word fields `+0x14/+0x3b2/+0x3ba` plus byte `+0x20` into the staged runtime profile through `shell_setup_profile_copy_payload_scroll_count_and_campaign_byte_and_seed_row_categories` `0x0047be50`, and finally decodes the `0x100 x 0x100` preview surface through `0x0053f830 -> 0x00559520`. Current grounded callers are the list-refresh wrappers at `0x005028f6/0x00502906`, the `Setup.win` dispatcher branch at `0x0050341f`, and the early setup-mode branch at `0x00503083`. This keeps the helper on the selection-label and preview-surface side of `Setup.win` rather than the later launch-mode dispatcher rooted at `0x00502c00`.","objdump + local disassembly + caller xrefs + control-id correlation + setup-payload-load correlation"
0x00502160,85,shell_setup_window_set_first_persisted_selector_flag_or_index_and_save_config,shell,thiscall,inferred,objdump + constructor callback correlation,3,"Small `Setup.win` callback installed on control `0x0e86`. Callback value `0` clears the shell-state presence dword at `[0x006cec74+0x233]`; nonzero values set that presence dword to `1`, store the zero-based selected index at `[0x006cec74+0x237]`, and then persist the shell configuration through `shell_save_graphics_config` `0x00484910(1)`. The constructor at `0x00504010` installs this beside sibling callback `0x005021c0`, which keeps the control on the persisted shell-state selector side of `Setup.win` rather than on the startup-selector or submode-dispatch side.","objdump + constructor callback correlation + shell-state write correlation"
0x005021c0,85,shell_setup_window_set_second_persisted_selector_flag_or_index_and_save_config,shell,thiscall,inferred,objdump + constructor callback correlation,3,"Small `Setup.win` callback installed on control `0x0e87`. It is the sibling of `0x00502160`: callback value `0` clears the shell-state presence dword at `[0x006cec74+0x23b]`, nonzero values set that presence dword to `1`, store the zero-based selected index at `[0x006cec74+0x23f]`, and then persist the shell configuration through `shell_save_graphics_config` `0x00484910(1)`. Current grounded owner is the `Setup.win` constructor `0x00504010`, which makes this a persisted shell-state selector callback rather than another launch or submode control.","objdump + constructor callback correlation + shell-state write correlation"
0x00502550,456,shell_setup_window_refresh_selection_lists_and_summary_fields,shell,cdecl,inferred,objdump + local disassembly,3,"Refreshes the larger `Setup.win` list and summary panel family from the current setup payload at `0x006d14bc` and staged profile state under `0x006cec7c`. The helper publishes the staged profile-path tail into control `0xe7f`, formats the scalar summary in `0xe84` from `[0x006cec7c+0x77]`, rebuilds the two persisted selector lists rooted at controls `0xe86` and `0xe87` from the static label tables `0x00620dd8` and `0x00620e3c`, mirrors the current persisted selections from shell-state pairs `[0x006cec74+0x233/+0x237]` and `[+0x23b/+0x23f]` into the selected-row summary at control `0x66`, and republishes the config toggles `0xe88/0xe89/0xe8a` from shell-state flags `[+0x247/+0x24b/+0x243]`. It also toggles the local latch at `0x006d14a8`. Current grounded callers are the setup-dispatch branches at `0x0050373a`, `0x00503b0e`, and the constructor-side follow-up at `0x005040c1`, which keeps this bounded as the main list-and-summary refresh helper for `Setup.win` rather than another submode selector.","objdump + local disassembly + caller xrefs + control-id correlation + persisted-selector-list correlation"
0x00502720,144,paint_terrain_tool_init_globals,shell,thiscall,inferred,ghidra-headless,4,Initializes the PaintTerrain shell tool singleton rooted at 0x006d14bc. The constructor seeds the tool vtable and default fields registers the active instance globally and is selected directly from shell_transition_mode alongside the neighboring terrain-edit tool constructor at 0x004ee3a0.,ghidra + rizin + llvm-objdump + strings
0x005027b0,351,shell_setup_window_refresh_file_backed_selection_list_panel,shell,cdecl,inferred,objdump + local disassembly,3,"Refreshes the file-backed list pane used by the `Setup.win` submodes that depend on the staged dataset at `0x006d14b8`. The helper chooses one top header-control family from the current setup submode at `[window+0x7b]`, now bounded exactly as `4 -> 0xd4b`, `9 -> 0xde8`, `6/12/14 -> 0xdf2`, and `10 -> 0xe85`, rebuilds the repeated row controls rooted at `0x88` from each record's text at `+0x12d`, mirrors the selected record into the summary slot `0x66` when its secondary path matches `[0x006cec7c+0x44]`, paints the fixed status-color strip rooted at control `0xaf` from the constant table `0x00622a98`, and then re-enters `shell_setup_window_publish_selected_profile_labels_and_preview_surface` `0x00502220`. RT3.lng now also tightens one earlier misread here: those `0xd4b/0xde8/0xdf2/0xe85` values are local setup header-control or resource ids, not localized text ids. The setup-art bundle tightens that split one step further too: the only distinct file-backed setup art families under `rt3_2WIN.PK4` are the shared `Setup_Load(.imb/_Buttons.imb)` family and the separate `Setup_Sandbox(.imb/_Buttons.imb)` family, which matches the earlier selector evidence that mode `10` is the sandbox-backed `new` list while the neighboring mode `12` is its `load` sibling. The upstream dataset helpers now tighten the remaining family split too: this pane consumes rows staged by `shell_setup_file_list_construct_and_scan_dataset` `0x004336a0`, and the surrounding mode selector makes modes `4/6/10/12/14` default to the ordinary setup file root while mode `9` is the only file-backed sibling that also flips the shell-side root toward the map-family branch. Combined with the dataset normalization split in `0x004333f0`, that now shows only submodes `4` and `10` using the alternate localized-stem list-label path, while `6`, `9`, `12`, and `14` keep the direct filename-normalization lane. Current grounded callers are the mode-`4`, `9`, `6`, `10`, `12`, and `14` follow-up branches inside `shell_setup_window_select_launch_mode_and_apply_shell_state` `0x00502c00`.","objdump + local disassembly + caller xrefs + header-control correlation + dataset-list correlation + setup-file-root correlation + localized-file-list split + RT3.lng negative-result correlation + setup-art-family correlation"
0x00502910,744,shell_setup_window_refresh_mode_dependent_lists,shell,cdecl,inferred,objdump + local disassembly,3,"Refreshes the shared non-file-backed `Setup.win` payload panel family, using the current setup submode at `[window+0x7b]` only as a presence gate rather than a deep selector. The helper formats the current item-count summary into `0x0cf3`, publishes one fixed placeholder or stem into `0x0cf4`, republishes the staged-path tail into `0x0cf5`, formats the scalar field from `[0x006cec7c+0x77]` into `0x0d4f`, mirrors option-byte `[0x006cec7c+0x7d]` into the five compact controls `0x0ce9..0x0ced`, looks up the constructor-installed draw callback host at `0x0ce8`, and then rebuilds the repeated row controls under `0x88` from the current setup payload at `0x006d14bc`. That payload-side row family is tighter now too: row count comes from `[payload+0x3ae]`, the draw callback id is read from `[control+0x1d6]`, row availability is gated by bytes `[payload+0x31b]` and `[payload+0x31c]`, and the live row-selection marker bytes are mirrored into `[0x006cec7c+0x87]` as `1` for the first row, `0x64+index` for later live rows, and `0` for hidden ones. After the row rebuild it republishes the active summary row in control `0x66` when the caller-supplied index still falls inside the current visible band `[submode_base + current_scroll .. + current_scroll + live_rows)`. Current grounded callers are the direct submode follow-up at `0x00503243`, the decrement or increment and option-byte branches at `0x005037e9`, `0x00503828`, `0x0050385f`, `0x005038a8`, `0x005038df`, `0x00503904`, and the constructor-side follow-up at `0x005040ba`. This now bounds it as the shared payload-driven companion to `shell_setup_window_select_launch_mode_and_apply_shell_state` `0x00502c00`, distinct from the later file-backed pane rooted at `0x005027b0` and no longer safely reducible to a mode-`3`-only helper.","objdump + local disassembly + caller xrefs + control-id correlation + payload-row-availability correlation + shared-non-file-backed-panel correlation"
0x00502c00,472,shell_setup_window_select_launch_mode_and_apply_shell_state,shell,cdecl,inferred,objdump + local disassembly,4,"Central launch-mode selector for `Setup.win`. The helper clears or sets `[0x006cec74+0x6c]` according to the requested mode id, re-enters `0x00482e50` on the shell state, toggles `[0x006cec7c+0x97]` and `[0x006cec7c+0x10]`, stores the selected setup submode at `[window+0x7b]`, and republishes the controlling status widgets through `0x00540120`. The internal submode split is tighter now too: mode `1` publishes the cached local exe-version string from `runtime_query_cached_local_exe_version_string` `0x00482d80` into control `0x0c23` and is now the strongest current fit for the main landing panel; mode `2` explicitly clears the staged-profile presence byte at `[0x006cec7c+0x10]` and now most safely reads as the `Single Player` root from RT3.lng `1991/1992`; modes `4`, `9`, `6`, `10`, `12`, and `14` drive the file-backed selection pane through `shell_setup_window_refresh_file_backed_selection_list_panel` `0x005027b0`; modes `4` and `9` plus `6`, `10`, `12`, and `14` also route the `0x0d4d/0x0d4e` preview fields through `0x0053fe90`; modes `7`, `8`, and `9` are the only values that pass `1` into `0x00482e50`; and modes `6`, `9`, `12`, and `14` are the values that clear `[0x006cec7c+0x97]` while sibling file-backed modes set it. The file-backed submode-to-dataset mapping is now exact too: submode `4 -> dataset 5`, `9 -> 4`, `6 -> 8`, `10 -> 6`, `12 -> 10`, and `14 -> 9`. The top-level button-state family is tighter now too: the selector later restyles one persistent control band so that `0xbc5` tracks submode `15`, `0xbc6` tracks `16`, `0xbba` tracks `2`, `0xbbb` tracks `3`, `0xbc3` tracks `13`, `0xbbc` groups `3/4/5`, `0xbbd` tracks `4`, `0xbbe` tracks `5`, `0xbbf` groups `6/12/14`, `0xbc0` tracks `7`, `0xbc1` tracks `8`, `0xbc2` tracks `9`, `0xe75` tracks `10`, and `0xf6e` tracks `17`. The setup file-root helpers now tighten the family boundary further: `shell_setup_file_list_construct_and_scan_dataset` `0x004336a0` defaults the ordinary setup file lanes to `saved games\\*.smp`, while the shell-state branch chosen here only flips into the `maps\\*.gm*` family when the requested mode leaves `[shell+0x6c] == 1`; the separate `[shell+0x6c] == 2` branch remains the tutorial-root `data\\tutorial` family above `0x00438890`. That means the ordinary saved-game-backed family is broader than the narrower file-list-pane family: modes `3`, `4`, `5`, `6`, `10`, `12`, and `14` all stay on the ordinary `.smp` setup side, but only `4`, `6`, `9`, `10`, `12`, and `14` re-enter the dedicated file-list pane at `0x005027b0`, while mode `3` stays on the option-heavy companion at `0x00502910`. Current asset and RT3.lng evidence now tighten several of those names too: mode `3` is the strongest current fit for the shared single-player `New Game` or `Options` companion behind `Setup_Options(.imb)`; mode `5` is the strongest current fit for the `Sandbox` companion behind `Setup_Sandbox(.imb)` and the later launch byte `[0x006cec7c+0x82] = 1`; mode `10` is now the strongest current fit for the sandbox-backed template or profile list because it is the only file-backed submode with its own `0x0e85` header family and a neighboring validated launch control `0x0e81` that both routes into selector `5` and sets runtime-profile byte `[0x006cec7c+0x82] = 1`; mode `4` is therefore the strongest non-sandbox peer in the same alternate localized-stem template-list pair, which makes it the strongest current fit for the standalone `New Scenario`-style chooser still owned by `Setup.win`; and modes `6`, `12`, and `14` now tighten one step further as the three selector-`3` direct-filename load siblings, with mode `14` the strongest current landing panel for that family because `0x0c24` jumps to it directly while `0x0c82` and `0x0c84` only reach sibling modes `6` and `12` from inside the same load cluster. The same control pairing now makes one stronger semantic split defensible too: `0x0c83 -> 10` and `0x0c84 -> 12` look like the sandbox-side new or load pair inside that four-button family, so mode `12` is now the strongest current fit for the setup-local `Load Sandbox` lane. The remaining non-sandbox pair is closed now too: `shell_setup_filter_candidate_file_by_dataset_and_payload_flags` `0x00433260` shows dataset `9` taking the extra nonzero payload-flag lane while dataset `8` stays on the plain non-sandbox path, and the editor-side metadata path now grounds `[0x006cec78+0x66de]` as the direct `Campaign Scenario` checkbox bit because `editorDetail.win` ties control `0x5b6e` to localized ids `3160/3161`. That means the extra dataset-`9` lane is the campaign-designated load family, while dataset `8` is the ordinary scenario load family, so `14 = Load Campaign` and `6 = Load Scenario` now read as grounded rather than residual. Modes `7/8/9` are now the grounded `Editor` or `Choose Map` family from RT3.lng `1995`, `2022`, `2024`, `2026`, and `2028`, with mode `7` the editor root, mode `8` the `New Map` chooser, and mode `9` the file-backed `Load Map` list sibling. Submode `13` is tighter in a second way too: it now clearly joins neither the dedicated file-list pane nor the mode-`3` option pane, and current top-level RT3.lng elimination makes it the strongest residual fit for the `Multi Player` root. Submode `16` remains the other residual top-level `Setup.win` root and is now the strongest current fit for the `High Scores` lane, since `Credits` already lives in separate shell mode `6`. It is the shared callee for many larger dispatcher branches in the `0x005033d0..0x00503b7b` family, including the direct mode requests at `0x00503567`, `0x0050361b`, `0x00503652`, `0x005036c3`, `0x005036f6`, `0x00503707`, `0x0050371f`, `0x0050374b`, `0x00503769`, `0x005037a9`, `0x00503921`, `0x0050393f`, `0x00503982`, `0x00503991`, `0x00503a57`, and `0x00503b44`. Current mode-selection correlation now also grounds its ownership above the startup-profile selector in `0x00438890`: the surrounding dispatcher writes `[0x006cec7c+0x01]` values `2`, `3`, `4`, `5`, `1`, and `7` before later entering `0x00482150` with launch request `0xcc`.","objdump + local disassembly + caller xrefs + setup-dispatch correlation + shell-state correlation + submode-follow-up correlation + selector-table decode + setup-file-root correlation + map-editor-branch correlation + ordinary-smp-family split + top-level-button-state correlation + setup-submode-dataset mapping + grouped-launch-control correlation + RT3.lng top-level correlation + setup-asset correlation + setup-local-new-vs-load split + direct-launch-branch correlation + file-family correlation + load-cluster landing correlation + control-pairing inference + dataset-payload-flag correlation + campaign-scenario-warning correlation + editorDetail.win resource record"
0x005033d0,1963,shell_setup_window_handle_message,shell,thiscall,inferred,objdump + local disassembly,3,"Primary message or command dispatcher for the `Setup.win` family rooted at `0x00504010`. The handler switches over many control ids in the `0x0c80..0x0f71` band, routes direct mode changes through `shell_setup_window_select_launch_mode_and_apply_shell_state` `0x00502c00`, refreshes the visible list families through `shell_setup_window_refresh_mode_dependent_lists` `0x00502910` and `shell_setup_window_refresh_selection_lists_and_summary_fields` `0x00502550`, republishes the selected labels and preview surface through `shell_setup_window_publish_selected_profile_labels_and_preview_surface` `0x00502220`, and writes startup-profile selector values into `[0x006cec7c+0x01]` before later shell request `0x00482150(0xcc, ...)` transitions continue. The control-id split is tighter now too: `0x0d4b/0x0de8/0x0e85` reuse the current row index from `[msg+0x08]` to republish one selected setup record through `0x00502220`; `0x0e88/0x0e89/0x0e8a` toggle the persisted shell-state booleans at `[0x006cec74+0x247/+0x243/+0x24b]` and immediately save config through `0x00484910(1)`; `0x0c1f` is the settings-window escape through `shell_has_settings_window` `0x004fe120` and `shell_open_settings_window` `0x00501e50`; `0x0c1e`, `0x0c20`, and `0x0c22` are direct shell-request branches entering `0x00482150` with request ids `0x0cc` or `0x0cd`; `0x0bc2`, `0x0bc5`, `0x0bc6`, and `0x0bc7` are the separate shell-open or help-content quartet above `shell_query_registry_open_command_for_http_or_rtf_target` `0x00501f20`; `0x0bc1` and `0x0bc8` both select submode `15`, which now safely reads as the `Extras` family because RT3.lng `3118..3129` and the surrounding shell-open quartet align with `Readme`, `Weblinks`, and the return-to-extras sibling; `0x0bc3` selects submode `16`, which now most safely reads as the remaining `High Scores` top-level root because `Credits` already lives in separate shell mode `6` `Credits.win`; `0x0bc4` selects submode `1`, the current strongest main landing-panel fit; `0x0c80` selects submode `13`, now the strongest residual fit for the `Multi Player` root; `0x0c1c` selects submode `17`, which now safely reads as the tutorial chooser because mode `17` is the only family that later exposes startup selectors `1` and `7` through controls `0x0f6f` and `0x0f70`; `0x0c1d` selects submode `2`, the current strongest `Single Player` root from RT3.lng `1991/1992`; and `0x0c24` selects submode `14`; `0x0c81`, `0x0c82`, `0x0c83`, and `0x0c84` select submodes `14`, `6`, `10`, and `12`; `0x0c85` conditionally selects submode `4` or `3` from the entry flag at `[msg+0x2c]+0x6a`; `0x0ce4` writes selector `4` and then selects submode `8`, now the strongest `New Map` chooser fit from RT3.lng `2022/2026/2028`; `0x0ce5` writes selector `3` and then selects submode `9`, now the strongest `Load Map` list sibling; `0x0de0` and `0x0dea` both select submode `7`, now the strongest `Editor` root fit from RT3.lng `1995/1996`; `0x0df4` and `0x0e80` are the high-side slider refresh pair; `0x0e83` selects submode `1`; and `0x0f71` selects submode `1` after writing selector `7`. `0x0ce6/0x0ce7` and `0x0d49/0x0d4a` are bounded decrement or increment controls over `[0x006cec7c+0x7b]` and `[0x006cec7c+0x77]`; `0x0ce9..0x0ced` plus `0x0f3d..0x0f3f` store compact option bytes into `[0x006cec7c+0x7d]`; and `0x0e82/0x0e83` are the wider clamp-to-`0x834/0x70d` slider pair that feeds `0x00502550`. The later launch-side branches are tighter in a corrective way too: the validated staged-profile launch lane no longer includes `0x0ce5` or `0x0dcb`. `0x0cf6` and `0x0e81` are the selector-`5` siblings in that validated lane; current local disassembly also shows the neighboring selector-`3` validated lane is at least shared by the later `0x0de9` and `0x0df3` controls before shell request `0x0cc` continues; and `0x0e81` is now tighter still because it is the only one of those validated controls that also sets runtime-profile byte `[0x006cec7c+0x82] = 1`, the strongest current sandbox-side anchor beneath the later `.gmx` file family. `0x0dca` is now tighter as the grayscale-map picker branch above `shell_open_grayscale_map_tga_picker_and_stage_selection` `0x004eb0b0`, then writes selector `4`; `0x0dcb` conditionally selects submode `5` or `3` from the same entry flag family used by the earlier `0x0c85` branch, which reinforces mode `5` as the sandbox-style companion rather than another launch control; `0x0ddf` is the separate windowed-mode-gated grayscale-heightmap generation branch that reopens the `TGA Files (*.tga)` / `.\Data\GrayscaleMaps` picker through `shell_open_file_dialog_copy_selected_path_and_restore_cwd` `0x0042a970`, validates the chosen image through `shell_query_tga_header_is_supported_truecolor_image` `0x005411c0`, and only then writes selector `2`; `0x0f6f` writes selector `1`; and `0x0f70` writes selector `7` before shell request `0x0cc` continues.","objdump + local disassembly + selector-writer correlation + caller-family reconstruction + control-cluster correlation + jump-table decode + literal-correlation + submode-mapping decode + grayscale-map-picker correlation + extras/tutorial correlation + grayscale-generation correlation + RT3.lng top-level correlation + setup-asset correlation + sandbox-launch-flag correlation + load-map correction"
0x0047bc80,457,shell_setup_payload_seed_unique_row_category_bytes_and_marker_slots,shell,thiscall,inferred,objdump + local disassembly,3,"Normalizes the live `Setup.win` payload row metadata before the shared non-file-backed panel consumes it. Outside editor-map mode `[0x006cec74+0x68] == 0`, the helper clears the static category-used table rooted at `0x005f2d28`, marks every already-nonzero payload category byte from `[payload+0x31a + row*9]`, counts the existing marker bytes across the four 10-byte local bands rooted at `[payload+0x2ca]`, and fills any remaining empty marker slots at `[payload+0x2c9 + n]` until the payload row count at `+0x3ae` is covered. On the multiplayer-preview side it also forces runtime profile dword `[0x006cec7c+0x83] = 7`. It then walks the row records again and, for any zero category byte at `[payload+0x31a + row*9]`, chooses the next unused category id using runtime profile dword `[0x006cec7c+0x83]`, the local marker-slot bytes at `[payload+0x2c9 + n]`, and a bounded retry loop before writing the chosen category back and marking the static-used table. Current grounded callers are the setup payload-copy helper at `0x0047be50` and the post-load chairman-profile builder at `0x00437220`, which makes this the shared category-byte and marker-slot normalizer beneath the setup payload panel rather than one world-only helper.","objdump + local disassembly + setup-payload correlation + category-table correlation + marker-slot correlation + caller split"
0x0047be50,69,shell_setup_profile_copy_payload_scroll_count_and_campaign_byte_and_seed_row_categories,shell,thiscall,inferred,objdump + local disassembly,3,"Copies the small shared-panel runtime fields out of one live `Setup.win` payload record into the staged runtime profile at `0x006cec7c`, then normalizes the payload row metadata. When the caller-supplied payload pointer is non-null and its first byte is nonzero, the helper copies payload word `+0x14` into profile `+0x77`, payload word `+0x3b2` into profile `+0x79`, payload word `+0x3ba` into profile `+0x7b`, and payload byte `+0x20` into profile `+0xc5`, except that the three word copies are skipped while the multiplayer-preview owner at `0x006cd8d8` is live. It then tail-calls `shell_setup_payload_seed_unique_row_category_bytes_and_marker_slots` `0x0047bc80` on the same payload. Current grounded caller is `shell_setup_window_publish_selected_profile_labels_and_preview_surface` `0x00502220`, which uses this helper immediately after the heavier payload-materialization lane at `0x00422400`.","objdump + local disassembly + setup-payload correlation + runtime-profile-field correlation + caller correlation"
0x0040cb00,13,placed_structure_set_linked_site_chain_next_id_field_0x2a2,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Tiny direct setter over linked-site word `[this+0x2a2]`. The helper stores the caller-supplied site id and returns. Current grounded callers are the world-cell linked-site chain helpers `0x0042c9a0` and `0x0042c9f0`, where this field acts as the next-site link for the cell-local linked-site chain rooted at `[cell+0xd6]`.","objdump + caller xrefs + local disassembly + linked-site-chain correlation"
0x0047d810,182,placed_structure_remove_route_entry_key_and_compact,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Removes one matching `u16` route-entry key from the six-byte route-entry list rooted at `[this+0x462]/[this+0x466]`. The helper scans the current list, copies surviving six-byte entries into a newly allocated compacted buffer, frees the old buffer, stores the replacement pointer back into `[this+0x466]`, and decrements the route-entry count at `[this+0x462]`. Current grounded caller is the linked-site refresh or teardown branch at `0x0040e102`, so this is the keyed remove-and-compact companion to the linked site's route-entry list rather than another generic free helper.","objdump + caller xrefs + callsite inspection + route-entry-list compaction correlation"
0x0047d8e0,346,placed_structure_load_dynamic_side_buffers_from_stream,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Deserializes the variable-size side buffers on one placed-structure record from the caller-supplied persistence stream. The helper reads tagged blocks through `0x00531360` and `0x00531150`, repopulates the six-byte route-entry list at `[this+0x462]/[this+0x466]`, the three five-byte-per-site arrays rooted at `[this+0x24]` from count `[this+0x30]`, the five eight-byte proximity-bucket arrays counted at `[this+0x590..0x5a0]` and rooted at `[this+0x5a4..0x5b4]`, and the trailing twelve-byte scratch band at `[this+0x34]/[this+0x38]`, then clears `[this+0x5bd]` and re-enters `0x00407780`. Current direct caller is the collection-level load pass at `0x00481464`. The real body begins at `0x0047d8e0` even though current recovered calls target the preceding padding slot `0x0047d8d0`.","objdump + caller xrefs + callsite inspection + stream-layout correlation"
0x0047dcd0,64,placed_structure_clear_proximity_bucket_lists,map,thiscall,inferred,objdump + caller xrefs + data-layout inspection,3,"Clears the five proximity-bucket arrays rooted at `[this+0x5a4..0x5b4]`, zeroes the corresponding per-bucket counts at `[this+0x590..0x5a0]`, and resets the total proximity-entry count at `[this+0x5b8]`. Current grounded callers are the linked-site teardown pass at `0x00480590` and the sibling route-anchor refresh family at `0x00480719`, so this now reads as the common clear step for the nearby-site bucket family rather than a generic free helper.","objdump + caller xrefs + data-layout inspection + proximity-bucket correlation"
0x0047d6f0,10,placed_structure_set_linked_cell_owner_next_site_id_field_0x3c,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Tiny direct setter over linked-site word `[this+0x3c]`. The helper stores the caller-supplied site id and returns. Current grounded callers are the world-cell owner-chain helpers `0x0042bbb0` and `0x0042bbf0`, where this field acts as the next-site link for the cell-local owner chain rooted at `[cell+0xd4]`.","objdump + caller xrefs + local disassembly + cell-owner-chain correlation"
0x0047dd10,130,placed_structure_remove_site_id_from_proximity_bucket_lists,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Removes one matching site id from every proximity bucket rooted at `[this+0x590..0x5b8]`. The helper scans all five bucket arrays, matches the supplied site id against the first dword of each eight-byte entry, compacts the surviving tail when needed, decrements the per-bucket count, and decrements the total count at `[this+0x5b8]`. Current direct caller is the collection sweep at `0x004814e9`, which makes this the remove-one-site companion to the nearby-site bucket append path rather than a broader route helper.","objdump + caller xrefs + callsite inspection + proximity-bucket correlation"
0x0047fdb0,317,placed_structure_append_nearby_transit_site_distance_bucket_entry,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Appends one nearby station-or-transit site into the current record's five proximity buckets. The helper first requires the caller-supplied peer record to pass `0x0047fd50`, then measures the current-to-peer distance through `0x00455800`, `0x00455810`, and `math_measure_float_xy_pair_distance` `0x0051db80`, rejects peers outside the fixed distance threshold at `0x005c8738`, classifies the surviving peer through `0x0040d350`, and finally appends one `(peer site id, distance)` pair into the corresponding eight-byte bucket array at `[this+bucket*4+0x5a4]` while incrementing both the per-bucket count and total count `[this+0x5b8]`. Current direct caller is the collection sweep at `0x004814a9`.","objdump + caller xrefs + callsite inspection + distance-threshold correlation + proximity-bucket correlation"
0x0047fef0,619,placed_structure_rebuild_nearby_transit_site_distance_buckets_from_neighbor_cells,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Rebuilds the current linked site's five nearby-transit proximity buckets from the neighboring world cells around its current position. After requiring the current record to pass `placed_structure_is_station_or_transit_site_class` `0x0047fd50`, the helper quantizes current world coordinates through `0x00455800`, `0x00455810`, and the world scale constant at `0x005c859c`, scans the surrounding live cell window through `[0x0062c120+0x2129]`, follows each cell's linked placed-structure chain through word field `[cell+0x0d6]` and next-id `[peer+0x2a2]`, keeps only peers whose resolved candidate subtype byte `[candidate+0x32]` equals `4`, and appends the survivors into the same `(peer site id, distance)` bucket arrays rooted at `[this+0x590..+0x5a4]` using the current world-distance threshold and bucket classifier. Current grounded caller is the linked-site runtime refresh owner `0x00480710`, so this is the safest current read for the proximity-bucket rebuild pass rather than another one-peer append helper.","objdump + caller xrefs + callsite inspection + neighbor-cell sweep correlation + proximity-bucket correlation"
0x00482d10,110,runtime_query_cached_local_exe_version_float,simulation,thiscall,inferred,objdump + local disassembly,3,"Returns one cached local executable version as a float-like `major + minor/100` value. On first use the helper queries the version-info resource of the literal stem `RT3.EXE` at `0x005cec18` through `0x0055d9c0`, splits the returned packed dword into low and high 16-bit words, converts them into one float as `hi + lo/100.0`, caches the result at `0x006cec5c`, and returns that cached value on later calls. The sibling formatter `0x00482d80` and the rounded hundredths query `0x00482e00` both consume the same source, which now makes this the clearest current owner for the local `1.03/1.04/1.05/1.06`-style version float rather than a gameplay progress value.","objdump + local disassembly + version-resource correlation"
0x00482d80,128,runtime_query_cached_local_exe_version_string,simulation,thiscall,inferred,objdump + local disassembly + string inspection,3,"Returns one cached local executable version string formatted from the same `RT3.EXE` version-info source used by `0x00482d10`. On first use the helper queries the packed local version dword through `0x0055d9c0`, formats it with the literal pattern `%d.%02d` at `0x005ced5c`, allocates one small shell string object at `0x006cec24`, and returns that cached string on later calls. Current grounded callers include `multiplayer_session_event_publish_registration_field` `0x0046a6c0` and the later shell text path at `0x00503254`, which makes this the clearest current local version-string owner.","objdump + local disassembly + string inspection + caller xrefs + version-resource correlation"
0x00482e00,70,runtime_query_hundredths_scaled_build_version,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared rounded hundredths-scaled build-version query used by route, company, train, and world-side logic. In the ordinary local path the helper consults the cached local executable version float from `runtime_query_cached_local_exe_version_float` `0x00482d10`, adds the fixed offset `0.0001`, multiplies by `100.0`, and rounds the result through the CRT helper at `0x005a10d0`, which makes the local outputs line up with integer build values such as `0x67/0x68/0x69/0x6a == 1.03/1.04/1.05/1.06`. When the multiplayer-side runtime rooted at `0x006cd8d8` is active, or when the local scenario-state gate at `0x004349a0` reports a later mode, it instead delegates to the multiplayer companion path at `0x0046a4b0`, which can reuse a cached network-side integer at `0x006cd96c` or scan live session-peer version fields before falling back to the same local executable-version path. Current grounded callers include the city-connection route builder `0x00402cb0`, the auxiliary tracker pair-metric dispatcher `0x004a65b0`, and numerous neighboring world-side maintenance branches. This is no longer best-read as a gameplay progress or era index: the recovered threshold pattern is a shared executable or session build-version gate.","objdump + caller xrefs + local disassembly + multiplayer-fallback correlation + version-resource correlation + threshold-correlation"
0x00482e50,271,shell_set_editor_map_mode_and_refresh_detail_panel_world_and_graphics_side_effects,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shell-state owner beneath `shell_command_toggle_editor_map_mode_with_one_shot_warning_modals` `0x00441b50` and the setup-mode selector `0x00502c00`. The helper writes the caller-supplied boolean into editor-map mode field `[this+0x68]`, then splits its refresh side effects by that target mode. When the target mode is `0` it re-enters `0x004d44a0` and `0x004dfda0` when the detail-panel controller `0x006d0818` is live, refreshes the active world root through `world_compute_transport_and_pricing_grid` `0x0044fb70` when `0x0062c120` exists, and then re-enters `shell_apply_graphics_option_runtime_effects` `0x00484d70` with mask `0x0d` and stack flag `1`. When the target mode is nonzero it instead re-enters `shell_ensure_editor_panel_window` `0x004d4500` before the same `0x00484d70(0x0d, 1)` tail. Current evidence is strong enough to treat this as the real editor-map-mode setter plus dependent detail-panel, world, and graphics refresh owner.","objdump + local disassembly + caller inspection + editor-map-mode correlation + side-effect correlation"
0x00483680,17,shell_command_cycle_display_resolution_forward,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,2,"Small registered shell command beneath action id `0x78` and localized label id `0x0d52`. The helper fixes forward step `+1` in `ECX` and tail-calls `shell_cycle_display_resolution_and_publish_status` `0x00483780`. Current evidence is strong enough for the command-wrapper role and step direction, but not yet for a tighter player-facing label beyond the display-resolution cycle.","objdump + command-registration correlation + local disassembly + caller inspection + wrapper correlation"
0x00483780,527,shell_cycle_display_resolution_and_publish_status,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Broader display-resolution cycle owner reached from the small forward and backward wrappers at `0x00483680`, `0x00483990`, and `0x004839a0`. The helper requires live shell presenter root `0x006d4024`, reads the current display mode through the active mode table and the paired width-bucket tables at `0x00620e64` and `0x00620e7c`, derives one bounded six-step cycle from the caller-supplied signed step in `ECX`, selects the next supported resolution pair, and applies that requested size through `0x005206b0`. It then formats and publishes a status string through `0x0051b700`, `0x00518de0`, and `0x005386e0`, refreshes dependent presentation state through `0x004625b0`, persists the graphics config through `0x00484910(1)`, and re-enters the neighboring shell follow-on `0x004821d0`. Current evidence is strong enough to treat this as the shared display-resolution cycle-and-apply owner rather than a narrower presenter-only math helper.","objdump + local disassembly + caller inspection + display-mode-table correlation + status-publish correlation"
0x00483990,8,shell_cycle_display_resolution_forward_wrapper,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper over `shell_cycle_display_resolution_and_publish_status` `0x00483780`. The helper fixes step `+1` in `ECX` and tail-jumps into the shared display-resolution cycle owner. Current evidence grounds it as the plain forward wrapper rather than a separate settings owner.","objdump + local disassembly + caller inspection + wrapper correlation"
0x004839a0,8,shell_cycle_display_resolution_backward_wrapper,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper over `shell_cycle_display_resolution_and_publish_status` `0x00483780`. The helper fixes step `-1` in `ECX` and tail-jumps into the shared display-resolution cycle owner. Current evidence grounds it as the plain backward wrapper rather than a separate settings owner.","objdump + local disassembly + caller inspection + wrapper correlation"
0x004839b0,37,shell_setup_query_file_list_uses_map_extension_pattern,shell,thiscall,inferred,objdump + literal inspection + caller correlation,3,"Returns whether the current `Setup.win` file-list scan should enumerate the map-family extension pattern `*.gm*` instead of the saved-game pattern `*.smp`. The helper checks the live shell state rooted at `0x006cec74`: it requires the broad setup/file gate at `[shell+0x1bf]`, then returns true when either `[shell+0x68]` is nonzero or the current setup-side mode flag at `[this+0x6c]` equals `1`. Current grounded caller is `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0`, where the result chooses the search literal at `0x005c9d14` versus `0x005c9d1c`.","objdump + literal inspection + caller correlation + setup-file-root correlation"
0x004839e0,37,shell_setup_query_file_list_root_dir_name,shell,thiscall,inferred,objdump + literal inspection + caller correlation,3,"Returns the root directory name used by the current `Setup.win` file-list scan. When `[this+0x6c] == 2` it returns the literal `data\\tutorial` at `0x005ca338`; otherwise it returns `maps` at `0x005ced78` when `[this+0x68]` is nonzero or `[this+0x6c] == 1`, and falls back to `saved games` at `0x005ced80` for the ordinary setup-side load family. Current grounded caller is `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0`, which formats the returned root through the literal `%s\\` at `0x005c9d10`.","objdump + literal inspection + caller correlation + setup-file-root correlation"
0x00433260,400,shell_setup_filter_candidate_file_by_dataset_and_payload_flags,shell,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Filters one candidate `Setup.win` filename against the current dataset id and the small payload-flag family recovered from the staged bundle. Editor-map mode short-circuits to success immediately through `shell_setup_query_file_list_uses_map_extension_pattern` `0x004839b0`; otherwise the helper builds one rooted path from `shell_setup_query_file_list_root_dir_name` `0x004839e0`, opens the candidate bundle through `0x00530c80`, reads the small chunk family `0x2ee0/0x3c2` through `0x00531150/0x00531360`, and then applies dataset-specific acceptance rules to three recovered flag bytes. The current split is tighter now: dataset `10` requires the sandbox-side payload-flag family, dataset `9` requires a different nonzero payload-flag family, dataset `8` stays on the plain non-sandbox path, and dataset `12` adds one literal stem check through `0x005c9cf8` before the later payload-flag gate. Current grounded caller is `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0`, which uses this helper as the real extension-and-payload filter beneath the file-backed setup lists.","objdump + local disassembly + caller correlation + setup-dataset correlation + payload-flag gating correlation"
0x004333f0,674,shell_setup_build_file_list_records_from_current_root_and_pattern,shell,thiscall,inferred,objdump + literal inspection + caller correlation,3,"Builds one normalized `Setup.win` file-list record block under the small collection object passed in `ECX`. The helper queries the current root directory through `shell_setup_query_file_list_root_dir_name` `0x004839e0`, chooses either `*.gm*` or `*.smp` through `shell_setup_query_file_list_uses_map_extension_pattern` `0x004839b0`, enumerates the resulting search spec, filters out leading-dot names and extension mismatches through `0x00433260`, counts the surviving rows, allocates `count * 0x25a + 1` bytes, and then repopulates each row with the raw filename at offset `0` plus the normalized display label at `+0x12d`. Dataset ids `5`, `6`, and `7` take the alternate normalization path through `0x0051c920`; sibling dataset ids keep the direct `0x0051df90` text normalization lane. The surrounding selector now bounds the current file-backed mapping more tightly too: submode `4 -> dataset 5`, `9 -> 4`, `6 -> 8`, `10 -> 6`, `12 -> 10`, and `14 -> 9`. Current grounded wrapper is `shell_setup_file_list_construct_and_scan_dataset` `0x004336a0`.","objdump + literal inspection + caller correlation + record-layout reconstruction + dataset-normalization correlation + setup-submode-dataset mapping"
0x004336a0,33,shell_setup_file_list_construct_and_scan_dataset,shell,thiscall,inferred,objdump + caller correlation,3,"Small constructor wrapper above `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0`. The helper stores the caller-supplied dataset id at `[this+0x04]`, zeroes the row count `[this+0x00]` and payload pointer `[this+0x08]`, and then immediately enters the deeper scan-and-build body. Current grounded caller is `shell_setup_window_select_launch_mode_and_apply_shell_state` `0x00502c00`, whose exact file-backed setup mapping is now bounded as submode `4 -> dataset 5`, `9 -> 4`, `6 -> 8`, `10 -> 6`, `12 -> 10`, and `14 -> 9`.","objdump + caller correlation + setup-dataset reconstruction + setup-submode-dataset mapping"
0x0051dc60,242,support_insertion_sort_fixed_records_by_embedded_key_offset,support,fastcall,inferred,objdump + local disassembly + caller correlation,3,"Generic adjacent-swap insertion sort over fixed-width records. The helper takes a base pointer in `ECX`, record count in `EDX`, and caller-supplied `record_size` plus `key_offset` on the stack, allocates one temporary record buffer through `0x005a125d`, and then runs the classic nested insertion pass over adjacent records. Each comparison forwards the two embedded key pointers `record + key_offset` into `0x005a57cf`; when the left key sorts after the right key, the helper swaps the two full `record_size`-byte records through the scratch buffer with `rep movs`. It finally releases the scratch buffer through `0x005a1145`. Current grounded caller is `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0`, which passes `record_size = 0x25a` and `key_offset = 0x12d` to sort `Setup.win` file-list rows by their normalized display label rather than by the raw filename at offset `0`.","objdump + local disassembly + caller correlation + setup-file-list-sort correlation"
0x00420650,32,runtime_object_lazy_seed_field_0x317_from_shell_profile_word_0x0d_and_reenter_local_refresh,map,thiscall,inferred,objdump + local disassembly + shell-state correlation,2,"Small lazy-initialization helper in the sibling runtime-object family. When dword `[this+0x317]` is already nonzero it returns immediately. Otherwise it copies shell-profile word `[0x006cec78+0x0d]` into `[this+0x317]` and then jumps into the heavier local refresh body at `0x00420350`. Current grounded caller is the linked-site display-name refresh `0x00480bb0`, where it runs after the linked-site naming and anchor rebuild work.","objdump + local disassembly + shell-state correlation + lazy-init correlation"
0x00420670,56,runtime_object_release_dynamic_payload_clear_cached_link_chain_and_tail_base_cleanup,map,thiscall,inferred,objdump + caller xrefs + local disassembly + sibling-table correlation,2,"Release-side helper in the sibling runtime-object family that owns the cached `u16` chain fields around `[this+0x26e/+0x270/+0x383]`. The function frees optional dynamic payload pointer `[this+0x37f]` through `0x00518bd0` plus `0x0053b080`, clears that field, re-enters `placed_structure_clear_cached_u16_chain_from_head_field_0x383` `0x0041f8d0`, and then tails into base cleanup `0x00455d20`. Current grounded caller is the collection-side remove helper `0x00421700`, and local `.rdata` places the associated behavioral slots under the sibling table rooted at `0x005c9a60`.","objdump + caller xrefs + local disassembly + sibling-table correlation + link-chain correlation"
0x004206b0,274,world_region_upsert_or_remove_structure_profile_weight_by_name,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Editor-facing region-subcollection mutation helper over `[region+0x37f]`. The function linearly scans the current live subcollection for one exact profile-label match through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and `0x005a57cf`. On the not-found path it creates a new entry through collection virtual slot `+0x04` only when the caller-supplied weight is positive. On the found path it either removes the matching entry through collection virtual slot `+0x08` when the weight is non-positive or rewrites the existing entry weight at `[entry+0x1e]` when the weight stays positive. All three branches then re-enter `0x00420410` to refresh the region's derived profile cache. Current grounded caller is the `Cities/Regions` editor handler `0x004ce380`, where it reapplies per-candidate industry weighting state to the selected region.","objdump + local disassembly + caller correlation + region-subcollection correlation + editor-weighting correlation"
0x00420350,96,runtime_object_refresh_local_scalar_field_0x31b_from_seed_word_0x317_and_shell_profile_word_0x0d,map,thiscall,inferred,objdump + caller xrefs + local disassembly + shell-state correlation,2,"Small scalar-refresh helper in the sibling runtime-object family. It treats word or dword `[this+0x317]` as the seed year/profile lane, compares it against shell-profile word `[0x006cec78+0x0d]`, and writes the derived float result to `[this+0x31b]` through a bounded piecewise curve: zero seed produces `1.0f`, deltas `0..2` map upward from a larger base, deltas `3..0x14` keep the field at `1.0f`, and larger deltas taper back down through a scaled subtraction path. When object class dword `[this+0x23e]` is nonzero it applies one extra affine adjustment before returning. Current grounded entry points are the lazy seeder `0x00420650` and the second jump-in at `0x00420d39`, so the safest current read is the shared `[0x317] -> [0x31b]` local scalar refresh rather than a named UI-only slider.","objdump + caller xrefs + local disassembly + shell-state correlation + scalar-curve correlation"
0x00420d40,173,world_region_accumulate_linked_structure_balance_prepass_and_tail_growth_scalar_refresh,map,thiscall,inferred,objdump + caller xrefs + local disassembly + region-normalization correlation,3,"Per-region prepass beneath `world_region_normalize_cached_structure_balance_scalars` `0x00422320`. The helper clears cached float accumulators `[region+0x306/+0x30a/+0x30e]`, then walks the linked placed-structure chain rooted at `[region+0x383]` through the live registry `0x0062b26c`. For each linked record it accumulates two float-like local metrics through the neighboring placed-structure helpers `0x0040ca70` and `0x0040ca80`, and when the resolved candidate class byte `[candidate+0x32]` is zero it also resolves the backing source record through `0x0040cec0` and adds integer field `[source+0x141]` into the third accumulator. After the chain drains it tails into `0x00420560` for the follow-on refresh. Current grounded caller is the collection-wide normalization sweep `0x00422320`, where this helper is the explicit per-region prepass before the later cohort normalization and category-count writeback stages.","objdump + caller xrefs + local disassembly + region-normalization correlation + linked-structure-chain correlation"
0x00420560,235,world_region_refresh_cached_structure_class_mix_scalar_0x312_from_linked_chain,map,thiscall,inferred,objdump + caller xrefs + local disassembly + region-normalization correlation,3,"Per-region linked-structure refresh over cached float `[region+0x312]`. The helper runs only on class-0 regions with a nonempty linked placed-structure chain at `[region+0x383]`, walks that chain through the live registry `0x0062b26c`, resolves each record's candidate through vtable slot `+0x80`, and then folds class-specific contributions into `[region+0x312]`. The current grounded split is structural but real: candidate class `0` contributes a source-derived term from `[source+0x141]` through `0x0040cec0`, class `2` contributes one branch keyed by candidate field `[candidate+0x78c]` plus placed-structure field `[site+0x246]`, class `3` adds one fixed increment, and class `1` currently contributes nothing. Current grounded callers are the prepass tail `0x00420d40`, one broader region worker at `0x00423d17`, the late world-entry region sweep at `0x00444baa`, and the paired editor-side or scenario branches at `0x00472c16` and `0x00472d2c`, so the safest current read is the shared linked-structure class-mix refresh under the broader region normalization family rather than a one-off stats formatter.","objdump + caller xrefs + local disassembly + region-normalization correlation + linked-chain-class-split correlation"
0x00420e00,453,world_region_rebuild_profile_collection_from_source_region_and_seed_default_weights,map,thiscall,inferred,objdump + caller xrefs + local disassembly + editor-copy-flow correlation,3,"Region-side subcollection rebuild helper over `[region+0x37f]`. The function first frees and recreates the current `0x88`-byte indexed collection at `[region+0x37f]`, then when the caller supplies one source region it walks that source region's live subcollection, copies each entry label into a local stack buffer, and replays the copied weight at `[entry+0x1e]` through `world_region_upsert_or_remove_structure_profile_weight_by_name` `0x004206b0`. When no source region is supplied it instead seeds one default profile set directly through repeated `0x004206b0` calls with fixed label literals and weight `0.2f`, splitting later by region live byte `[region+0x23e]`. Current grounded caller is the `Cities/Regions` editor copy-industry branch at `0x004ce72c`, so this is the safest current read for the region profile-collection rebuild plus copy-or-default seeding path rather than a generic collection allocator.","objdump + caller xrefs + local disassembly + editor-copy-flow correlation + profile-subcollection rebuild correlation"
0x00420ed0,803,world_region_rebuild_profile_collection_and_seed_class_split_default_weights,map,thiscall,inferred,objdump + caller xrefs + local disassembly + region-profile correlation,3,"Companion region-side subcollection rebuild helper over `[region+0x37f]` for the no-source default path. Like `world_region_rebuild_profile_collection_from_source_region_and_seed_default_weights` `0x00420e00`, the function first frees and recreates the current `0x88`-byte indexed collection at `[region+0x37f]`. It then immediately seeds one fixed profile-label set through repeated `world_region_upsert_or_remove_structure_profile_weight_by_name` `0x004206b0`, but the exact label set splits by region class dword `[region+0x23e]`: nonzero-class regions take one all-`0.2f` default set, while class-0 regions take a different default family that starts with one `0.3f` entry and then continues with repeated `0.2f` entries. Current grounded caller is the neighboring default-region initialization path at `0x0042141c`, so this is the safest current read for the shared class-split default profile seeding companion beneath the broader region-profile collection family rather than another editor-only copy helper.","objdump + caller xrefs + local disassembly + region-profile correlation + class-split default-set correlation"
0x00420410,167,world_region_refresh_profile_availability_summary_bytes_0x2f6_0x2fa_0x2fe,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small derived-summary refresh over the current region subcollection `[region+0x37f]`. The helper clears the three dword summary lanes `[region+0x2f6/+0x2fa/+0x2fe]`, walks every live profile entry through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, resolves the backing structure candidate by name through `0x00412b70`, and then inspects candidate bytes `[candidate+0xba]` and `[candidate+0xbb]`. When either byte is nonzero it sets `[region+0x2f6] = 1`; a nonzero `[candidate+0xba]` sets `[region+0x2fa] = 1`, while the complementary branch sets `[region+0x2fe] = 1`. Current grounded caller is the editor-side mutation helper `0x004206b0`, which runs this refresh after every profile add, remove, or weight update.","objdump + local disassembly + caller correlation + region-subcollection correlation + summary-byte correlation"
0x00421d20,246,world_region_collection_count_regions_with_profile_label_matching_candidate_name,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Counts the live regions in the current region collection whose profile subcollection `[region+0x37f]` contains one label equal to the candidate-name string for the caller-supplied candidate id. The helper resolves that candidate name from the global candidate pool `0x0062b268`, lowercases its first byte through `0x0051d660` as a cheap prefilter, skips region records whose class dword `[region+0x23e]` is nonzero and whose companion availability count `[region+0x242]` is nonpositive, then walks each surviving region's profile entries through `0x0041f6a0` and `0x0041fac0` until a casefolded label match through `0x005a57cf` is found. It increments the region count once per matching region and returns that total. Grounded callers include the editor-side summary builders at `0x004cdd56` and `0x004d150e`.","objdump + local disassembly + caller correlation + region-profile correlation + editor-summary correlation"
0x00421e30,275,world_region_collection_resolve_nth_region_with_profile_label_matching_candidate_name,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Resolves the Nth live region in the current region collection whose profile subcollection `[region+0x37f]` contains one label equal to the candidate-name string for the caller-supplied candidate id. The helper uses the same first-byte lowercase prefilter and full casefolded compare as `0x00421d20`, skips nonzero-class regions whose `[region+0x242]` count is nonpositive, and increments one match counter once per region rather than once per profile row. When that counter reaches the caller-supplied 1-based ordinal, it returns the matching region record pointer; otherwise it returns null. Current grounded caller is the editor-side enumerator at `0x004cdeab`, which immediately formats the returned region name for display.","objdump + local disassembly + caller correlation + region-profile correlation + editor-summary correlation"
0x00422010,155,world_region_collection_resolve_nearest_class0_region_id_covering_normalized_rect,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Scans the live region collection for class-0 region records whose normalized primary and secondary coordinates fall inside the caller-supplied inclusive float bounds, refreshes a small region-local helper through `0x00455a70(0)` on each in-bounds candidate, and keeps the nearest matching region id `[region+0x23a]` by squared XY distance through `math_measure_float_xy_pair_distance` `0x0051db80`. The helper returns `0` when no class-0 region lies inside the supplied rectangle. Current grounded callers include the world-side selection branch at `0x00452658`, where integer world arguments are converted to floats before the query, and the small string wrapper `0x004220b0`.","objdump + local disassembly + caller correlation + region-distance correlation"
0x004220b0,73,world_region_collection_query_name_of_nearest_class0_region_covering_normalized_rect_or_default,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small wrapper above `world_region_collection_resolve_nearest_class0_region_id_covering_normalized_rect` `0x00422010`. When the inner query returns a live region id, the helper resolves that region and returns name pointer `[region+0x356]`; otherwise it copies the fallback localized string `0x00d0` into global scratch buffer `0x0062ba90` and returns that buffer instead. Grounded callers include the early world-status formatter `0x00401815`, the later world-side branch `0x00411c41`, and the terrain-side formatter at `0x004f2b97`.","objdump + local disassembly + caller correlation + region-name correlation"
0x00422100,543,world_region_collection_pick_periodic_candidate_region_and_queue_scaled_event_record,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Periodic region-side selector reached from `simulation_service_periodic_boundary_work` `0x0040a590`. The helper first requires several live world-state gates to be clear, derives one year-sensitive random threshold from selected-year fields `[world+0x05/+0x0d/+0x0f]` plus live world width `[world+0x2155]`, and returns immediately unless one bounded random test passes. On the active path it scans the live region collection twice. The first pass counts eligible class-0 regions whose transient dwords `[region+0x276]` and `[region+0x302]` are clear and which fail the city-connection peer probe `0x00420030(1,1,0,0)`. The second pass picks one random eligible region, derives one small severity bucket from cached scalar `[region+0x25e]`, stores the resulting scaled amount into `[region+0x276]`, and appends one 0x20-byte queued record through `0x004337c0` with literal kind `7`, the chosen region id `[region+0x23a]`, the scaled amount, sentinel dwords `-1/-1`, and fixed payload `0x005c87a8`. The exact gameplay label for that queued record is still open, so the current name stays structural around the periodic class-0 region pick plus queued scaled event record.","objdump + local disassembly + caller correlation + periodic-maintenance correlation + queued-record correlation"
0x00421f50,181,world_region_collection_refresh_position_triplet_for_class0_regions_inside_normalized_rect,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Scans the current live region collection for class-0 records whose normalized primary and secondary coordinates fall inside the caller-supplied inclusive float rectangle, then refreshes each qualifying region's current-position triplet through `runtime_object_publish_current_position_triplet_with_height_bias` `0x00455a70(0)`. The helper performs no further aggregation and simply walks the surviving records through the live region collection interfaces `0x00517cf0/0x00518380/0x00518140`. Current grounded caller is the rectangle-side height-support owner `0x0044d410`, where this acts as one dependent region refresh across the updated work window rather than a broader collection rebuild.","objdump + local disassembly + caller correlation + region-rectangle correlation"
0x00421700,32,runtime_object_collection_remove_entry_by_id_release_record_and_erase_id,map,thiscall,inferred,objdump + local disassembly + collection-layout correlation,2,"Small collection-side removal helper for the sibling runtime-object family tied to table `0x005c9a60`. The function resolves the caller-supplied entry id through `0x00518140`, releases the resulting record through `0x00420670`, and then removes that id from the current collection through `0x00518a30`. Current evidence grounds this as the collection-owned remove-and-release wrapper rather than a wider rebuild pass.","objdump + local disassembly + collection-layout correlation + sibling-table correlation"
0x00421730,560,world_region_collection_clear_cell_region_word_and_assign_nearest_region_ids,map,thiscall,inferred,objdump + local disassembly + caller inspection + region-correlation,3,"Region-side world-grid finalizer beneath the default region seeding path. The helper first clears the per-cell region word at `[world+0x212d] + cell*4 + 1` across the full live world raster using dimensions `[world+0x214d/+0x2151]`. It then seeds each live region entry with default bounds and helper fields `[region+0x242/+0x24e/+0x252] = 0` and `[region+0x246/+0x24a] = 0x270f`, and for every class-0 region computes one square neighborhood around the region center from `[region+0x256]`, `0x00455800`, and `0x00455810`. Within that bounded cell rectangle it evaluates one distance-like score through `0x0051dbb0` and writes the current region id `[region+0x23a]` into the per-cell word when the slot is empty or when the current region beats the previously assigned region on the same score. Current grounded callers are `world_region_collection_seed_default_regions` `0x00421b60` and the broader world-build path around `0x004476ec`, so this is the safest current read for clearing and repopulating the world-cell region-id raster rather than a generic collection sweep.","objdump + local disassembly + caller inspection + region-correlation + raster-assignment correlation"
0x0042b190,144,route_entry_list_append_six_byte_record,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Appends one six-byte `(u16 key, u32 payload)` record onto the compact route-entry list rooted at `[this+0xeb]/[this+0xef]`. The helper allocates a replacement buffer sized for one extra record, copies the existing six-byte rows, writes the caller-supplied key and payload into the new tail, frees the old buffer, stores the replacement pointer, and increments the count. Current grounded callers include the sampled-cell rebuild owner `0x0047f320` and the world-cell chain sweep `0x0042c530`, so this is the safest current read for the plain append companion beneath the broader route-entry list families.","objdump + caller xrefs + local disassembly + six-byte-record correlation"
0x0042b230,158,route_entry_list_remove_six_byte_record_by_key,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Removes one six-byte route-entry row from the compact list rooted at `[this+0xeb]/[this+0xef]` by matching the leading `u16` key. When the current count is greater than one the helper allocates a replacement buffer for `count-1` rows, copies every nonmatching six-byte row forward, frees the old buffer, stores the replacement pointer, and decrements the count; small or empty lists fall through to the same free-and-decrement tail. Current grounded caller is the sampled-cell rebuild owner `0x0047f320`, which uses it while maintaining the per-cell route-entry side list, so this is the safest current read for the keyed remove companion to `0x0042b190`.","objdump + caller xrefs + local disassembly + six-byte-record correlation"
0x0042b2d0,52,route_entry_list_contains_key,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Boolean membership test over the compact six-byte route-entry list rooted at `[this+0xeb]/[this+0xef]`. The helper linearly scans the current rows and returns true when any leading `u16` key matches the caller-supplied id; otherwise it returns false. Current grounded callers include the linked-site support strip at `0x0040d27f`, the region or profile-side query family at `0x0041f6e7`, `0x0042007c`, `0x0042011a`, `0x0042020c`, `0x004202ba`, `0x004208b6`, and the later placed-structure branch at `0x004adecf`, so this is the safest current read for the shared contains-key helper beneath the same six-byte route-entry list family.","objdump + caller xrefs + local disassembly + six-byte-record correlation"
0x0042bbb0,51,world_cell_prepend_site_id_into_owner_chain_field_0xd4,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Prepends one placed-structure site id into the world-cell owner chain rooted at word `[cell+0xd4]`. The helper resolves the caller-supplied site id through the live placed-structure collection `0x006cec20`, writes the previous head id from `[cell+0xd4]` into that site's next-site field `[site+0x3c]` through `placed_structure_set_linked_cell_owner_next_site_id_field_0x3c` `0x0047d6f0`, and then stores the new site id back into `[cell+0xd4]`. Current grounded callers are the linked-site runtime refresh strip at `0x004807d7` and the earlier world-coordinate mutation path at `0x00480673`, so this is the safest current read for the cell-owner-chain prepend helper rather than a generic word setter.","objdump + caller xrefs + local disassembly + cell-owner-chain correlation"
0x0042bbf0,124,world_cell_remove_site_id_from_owner_chain_field_0xd4,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Removes one placed-structure site id from the world-cell owner chain rooted at word `[cell+0xd4]`. The helper walks the current head id and the linked next-site field `[site+0x3c]` through the live placed-structure collection `0x006cec20` until it finds the requested site id; when the requested site is the head it replaces `[cell+0xd4]` with that site's successor, otherwise it patches the predecessor's `[site+0x3c]` through `placed_structure_set_linked_cell_owner_next_site_id_field_0x3c` `0x0047d6f0`. Current grounded callers are the linked-site teardown and refresh strip at `0x00480673` and `0x00480769`, so this is the safest current read for the cell-owner-chain remove helper rather than a broader collection sweep.","objdump + caller xrefs + local disassembly + cell-owner-chain correlation"
0x0042a970,188,shell_open_file_dialog_copy_selected_path_and_restore_cwd,shell,thiscall,inferred,objdump + literal correlation,3,"Small shell-side file-open dialog wrapper. The helper clears the caller output buffer, snapshots the current working directory through one import pair, builds a `0x4c`-byte open-file dialog record on the stack, calls the file-open import, restores the previous working directory, and returns true only when the caller buffer is left non-empty. Current grounded caller is the `Setup.win` branch at `0x005039cd`, which passes the `TGA Files (*.tga)` filter at `0x005d1674` and root `.\Data\GrayscaleMaps` at `0x005d1690`, so this is now the generic picker beneath the grayscale-heightmap generation lane rather than another multiplayer helper.","objdump + literal correlation + setup-branch reconstruction"
0x005411c0,79,shell_query_tga_header_is_supported_truecolor_image,shell,cdecl,inferred,objdump + error-string correlation,3,"Small image-header validator used by the `Setup.win` grayscale-heightmap lane. The helper opens the caller path, reads `0x12` bytes into a local buffer, closes the handle, and returns true only when the read succeeds, the error byte remains clear, and the header's image-type byte equals `2`. Current grounded caller is the `0x005039fe` branch beneath `0x005033d0`, where failure raises localized error `0x0e13` (`The selected image is not useable by the game... true-color ... Targa image.`).","objdump + caller correlation + error-string correlation + TGA-header inspection"
0x004801a0,105,placed_structure_is_linked_transit_site_reachable_from_company_route_anchor,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Boolean gate between one linked transit site and one company-side route anchor. The helper first requires the current placed structure to pass the station-or-transit gate `0x0047fd50`, then requires its linked-instance class test through `0x0040c990 == 1`. It resolves the caller-supplied company id through the live company collection `0x0062be10`, asks that company for one cached route-anchor entry id through `company_query_cached_linked_transit_route_anchor_entry_id` `0x00401860`, resolves the site's own route-entry anchor through collection `0x006cfca8`, and finally re-enters `0x0048e3c0` to test whether the two route-entry anchors lie in the same reachable route-side family. Current grounded caller is `company_rebuild_linked_transit_site_peer_cache` `0x004093d0`, where this helper gates whether a foreign linked transit site can still participate in the current company's peer cache.","objdump + caller xrefs + callsite inspection + linked-transit reachability correlation"
0x0042c530,74,world_cell_append_linked_site_chain_route_entries_into_route_list,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Walks the placed-structure linked-site chain for one world cell and appends each site's route-entry payload into the caller-owned six-byte list. The helper starts from word `[cell+0xd6]`, follows the linked-site chain through `[site+0x2a2]` in the live placed-structure collection `0x0062b26c`, and re-enters `route_entry_list_append_six_byte_record` `0x0042b190` with each visited site id plus the caller-supplied payload dword. Current grounded caller is the sampled-cell rebuild owner `0x0047f320`, so this is the safest current read for the cell-linked-site route-entry gather helper rather than a generic list walk.","objdump + caller xrefs + local disassembly + linked-site-chain correlation + route-entry-list correlation"
0x0042c580,265,world_cell_accumulate_directional_word_fan_toward_grid_target,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Accumulates one directional word fan from the current world-cell record toward a caller-supplied grid target. The helper reads the cell-local anchor pair `[cell+0xe7]` and `[cell+0xe9]`, derives the dominant-axis distance to the target, chooses one of eight direction slots from the sign pattern of the X/Y deltas, and then walks outward one step at a time through the live world-grid table rooted at `[0x0062c120+0x2129]` using the fixed offset tables at `0x00624b28` and `0x00624b48`. At each step it adds the selected directional word from `[cell+0xf3 + dir*2]` into the running float total and returns that accumulated value. Current grounded caller is the sampled-cell rebuild owner `0x0047f320`, where this helper supplies the floating score stored in each temporary `(grid x, grid y, sampled score)` row.","objdump + caller xrefs + local disassembly + directional-word-fan correlation + sampled-score correlation"
0x0042c9a0,65,world_cell_prepend_site_id_into_linked_site_chain_field_0xd6,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Prepends one placed-structure site id into the world-cell linked-site chain rooted at word `[cell+0xd6]`. The helper resolves the caller-supplied site id through the live placed-structure collection `0x0062b26c`, writes the previous head id from `[cell+0xd6]` into that site's next-site field `[site+0x2a2]` through `placed_structure_set_linked_site_chain_next_id_field_0x2a2` `0x0040cb00`, stores the new site id back into `[cell+0xd6]`, and then re-enters `0x0042c690` plus `0x0042c8f0` to refresh the same cell-local linked-site derived state. Current grounded callers are the linked-site add or reposition paths `0x0040ec58` and `0x0040f84a`, so this is the safest current read for the cell-linked-site-chain prepend helper rather than a generic word setter.","objdump + caller xrefs + local disassembly + linked-site-chain correlation"
0x0042c9f0,179,world_cell_remove_site_id_from_linked_site_chain_field_0xd6,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Removes one placed-structure site id from the world-cell linked-site chain rooted at word `[cell+0xd6]`. The helper walks the current head id and the linked next-site field `[site+0x2a2]` through the live placed-structure collection `0x0062b26c` until it finds the requested site id; when the requested site is the head it replaces `[cell+0xd6]` with that site's successor, otherwise it patches the predecessor's `[site+0x2a2]` through `placed_structure_set_linked_site_chain_next_id_field_0x2a2` `0x0040cb00`. It then re-enters `0x0042c690` and `0x0042c8f0` to rebuild the same cell-local linked-site derived state. Current grounded callers are the linked-site removal or reposition paths `0x0040e331` and `0x0040ebfe`, so this is the safest current read for the cell-linked-site-chain remove helper rather than a broader collection sweep.","objdump + caller xrefs + local disassembly + linked-site-chain correlation"
0x0042c960,51,placed_structure_query_issue_opinion_scaled_word_lane,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Queries one rounded integer metric by multiplying the current word lane `[this+index*2] << 4` against the issue-opinion scale returned by `0x00437d20(index)`. The helper forwards the caller index into the scenario-side issue-opinion scaler, converts the selected word lane into a float, multiplies the two factors, and rounds the result through `0x005a10d0`. Current grounded callers include the setup-side candidate local-metrics rebuild `0x0041e2b0`, the route-style helper `0x0042cab0`, the linked-site runtime refresh strip `0x0047e240/0x0047faff`, several later placed-structure and world-side callers around `0x0040faf5`, `0x00410d7a`, `0x0044a093`, `0x0045020d`, `0x00452a1c`, and shell-side branches at `0x004ba156` and `0x004def77`, so this is the safest current read for the shared issue-opinion-scaled word-lane query rather than a raw table fetch.","objdump + caller xrefs + local disassembly + issue-opinion scaling correlation"
0x00480590,371,placed_structure_teardown_linked_site_runtime_state_before_removal,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Tears down the mutable runtime side of one linked placed-structure record before collection removal. The helper clears the route-style scratch lane through `0x004077e0`, clears the proximity buckets through `placed_structure_clear_proximity_bucket_lists` `0x0047dcd0`, frees the trailing scratch buffer at `[this+0x34]`, clears the route-link list through `0x0047f320`, detaches or invalidates the current route-entry anchor at `[this+0x08]` through the route-entry collection `0x006cfca8`, recomputes the current grid-keyed owner lane through `0x0042bbf0`, frees the three per-site byte arrays at `[this+0x24..0x2c]`, clears this record's indexed byte in the corresponding arrays of every later placed-structure record in `0x006cec20`, and finally re-enters the scenario-side follow-on at `0x00436040` with the current site id. Current direct caller is `placed_structure_collection_remove_linked_site_record` `0x004813d0`, so this is the linked-site teardown pass rather than another route-anchor refresh helper.","objdump + caller xrefs + callsite inspection + linked-site teardown correlation"
0x00480710,1170,placed_structure_refresh_linked_site_runtime_side_buffers_and_route_entry_anchor,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Primary linked-site runtime-side refresh owner above the sampled-cell list and nearby-transit bucket helpers. The function first clears the current proximity buckets through `placed_structure_clear_proximity_bucket_lists` `0x0047dcd0`, runs `placed_structure_rebuild_local_service_sampled_cell_list_and_reset_route_link_scratch` `0x0047f320(1,arg1)` against the pre-update state, republishes the current site position into the world-grid owner mapping through `0x0042bbf0/0x0042bbb0`, reruns `0x0047f320(0,-1)` to materialize the current sampled-cell list, and then rebuilds the nearby-transit bucket arrays through `placed_structure_rebuild_nearby_transit_site_distance_buckets_from_neighbor_cells` `0x0047fef0`. After that it either reuses a still-valid route-entry anchor through `0x00417b40` and `placed_structure_rebind_route_entry_anchor_to_site_id` `0x0048abc0`, or synthesizes a replacement through `0x00493cf0` before rebinding it the same way; when an old anchor survives but now points at a different owner, the helper clears the prior `[entry+0x222]` back to `-1`. Current grounded callers are the world-coordinate mutation path `placed_structure_set_world_coords_and_refresh_local_runtime_side_state` `0x0040eba0` and the constructor or rebuild strip around `0x0040f6d0`, so this is the safest current read for the broader linked-site runtime-side refresh plus route-entry-anchor rebind owner rather than another narrow route selector.","objdump + caller xrefs + callsite inspection + linked-site-runtime correlation + route-entry-anchor rebind correlation + proximity-bucket correlation"
0x00480bb0,1535,placed_structure_refresh_linked_site_display_name_and_route_anchor,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,3,"Single-site post-create or post-edit refresh helper reached from `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10` when the current placed structure keeps one linked site id at `[this+0x2a8]`. The helper operates on that linked placed-structure record, optionally rebuilds one route-entry anchor at `[this+0x08]` through `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` with both optional endpoint-entry ids unset and literal policy byte `2`, then binds the chosen route entry back to the site through `0x0048abc0` and re-enters `aux_route_entry_tracker_collection_refresh_route_entry_group_membership` `0x004a45f0` so the auxiliary tracker family at `0x006cfcb4` can regroup around the refreshed anchor. Current caller correlation makes that byte the strongest current match for the broader linked-site route-anchor rebuild lane, as opposed to the narrower direct endpoint-anchor creation or replacement lane that neighboring repair branches drive through literal byte `1` into `0x00493cf0`. It also rebuilds the display-name buffer at `[this+0x46b]`: when the current site coordinates resolve a city or region entry through `0x0044a830` it copies that entry name from `[entry+0x356]`, optionally appends one civic suffix from RT3.lng ids `585..588` `Township`, `New`, `Modern`, and `Renaissance`, and on special linked-instance class branches appends `589` `Service Tower` or `590` `Maintenance Facility` with per-city counters instead. When no city entry resolves it falls back to `591` `Anytown`. The ordinary non-special branch also rotates through RT3.lng ids `578..584` `Junction`, `Crossing`, `Depot`, `Corners`, `Exchange`, `Point`, and `Center` via the static table at `0x005f2cf8`. After trimming trailing spaces it conditionally re-enters `placed_structure_route_link_collection_recompute_all_endpoint_pair_state` `0x004682c0` when the narrower station-or-transit gate `0x0047fd50` passes, clears or seeds adjacent city-side cached state through `0x004358d0` and `0x00420650`, and returns. Current direct caller is `0x0040f626`, so this now looks like the linked-site display-name and route-anchor refresh beneath placed-structure finalization rather than another city-connection owner.","objdump + caller xrefs + callsite inspection + RT3.lng strings + route-anchor correlation + linked-site refresh correlation + linked-site policy-byte split correlation + tracker-regrouping correlation"
0x00481390,55,placed_structure_collection_allocate_and_construct_linked_site_record,map,thiscall,inferred,objdump + caller xrefs + constructor inspection,3,"Small allocator wrapper over the live placed-structure collection at `0x006cec20`. The helper allocates one fresh collection entry id through `0x00518900`, resolves the new record through `0x00518140`, and then hands the new id plus the caller-supplied anchor site id and coordinate pair into `placed_structure_construct_linked_site_record_from_anchor_and_coords` `0x00480210`. Current direct caller is `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0`, where the returned id is published into `[site+0x2a8]` when the backing candidate subtype byte `[candidate+0x32]` is `1`. This is the allocator wrapper for the linked-site records used by the later policy-`1` and policy-`2` route-anchor refresh families rather than another anonymous collection helper.","objdump + caller xrefs + constructor inspection + linked-site correlation"
0x004813d0,91,placed_structure_collection_remove_linked_site_record,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Removes one linked-site record from the live placed-structure collection. The helper resolves the supplied site id through `0x006cec20`, derives one station-or-transit or linked-instance-class latch through `0x0047de00 -> 0x0040c990`, runs `placed_structure_teardown_linked_site_runtime_state_before_removal` `0x00480590`, and then removes the collection entry through `0x00518a30`. When scenario field `[0x006cec78+0x4c93]` is clear and the removed record passed the narrower latch, it also re-enters the company-wide follow-on at `0x00429c10`. Current direct caller is the subtype-`1` destruction path around `0x0040f626`.","objdump + caller xrefs + callsite inspection + linked-site removal correlation"
0x00481430,72,placed_structure_collection_load_dynamic_side_buffers_from_stream,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Collection-level load pass for the variable-size side buffers on placed-structure records. When the shell or world-side stream slot at `[0x006cec74+0x1c7]` is present, the helper walks the live placed-structure collection at `0x006cec20`, resolves each record by id, and re-enters `placed_structure_load_dynamic_side_buffers_from_stream` `0x0047d8e0` on it. Current direct caller is the wider post-load world-side refresh path at `0x00433b93`.","objdump + caller xrefs + callsite inspection + stream-load correlation"
0x00481480,64,placed_structure_collection_append_site_into_all_proximity_bucket_lists,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Walks the live placed-structure collection at `0x006cec20` and asks every record to consider one caller-supplied peer site for proximity-bucket insertion. The helper resolves each live record and re-enters `placed_structure_append_nearby_transit_site_distance_bucket_entry` `0x0047fdb0` with the supplied peer placed-structure pointer. Current direct callers are the subtype-`4` update paths at `0x0040ec73` and `0x0040fa11`, so this now reads as the add-peer sweep for the nearby-site bucket family rather than another generic collection iterator.","objdump + caller xrefs + callsite inspection + proximity-bucket correlation"
0x004814c0,64,placed_structure_collection_remove_site_id_from_all_proximity_bucket_lists,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Walks the live placed-structure collection at `0x006cec20` and asks every record to remove one caller-supplied site id from its proximity buckets. The helper resolves each live record and re-enters `placed_structure_remove_site_id_from_proximity_bucket_lists` `0x0047dd10` with the supplied site id. Current direct callers are the subtype-`4` pre-update or pre-destroy paths at `0x0040e0a2` and `0x0040ebc7`.","objdump + caller xrefs + callsite inspection + proximity-bucket correlation"
0x00429c10,88,company_collection_refresh_active_company_linked_transit_site_peer_caches,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Collection-wide company sweep above the linked-transit peer cache family. The helper first counts the active companies in the live company collection at `0x0062be10` by testing `[company+0x3f]`, then walks that active ordinal range through `company_collection_get_nth_active_company_id` `0x00429a90` and re-enters `company_rebuild_linked_transit_site_peer_cache` `0x004093d0` on each resolved company record. Current grounded callers are the linked-site removal follow-on at `0x00481421` and the wider world-side company refresh branch at `0x00444c9c`.","objdump + caller xrefs + callsite inspection + active-company sweep correlation"
0x00481d00,612,bootstrap_parse_command_line_flags,bootstrap,cdecl,inferred,ghidra-headless,4,Parses the startup command line from ECX handling slash and dash switches and writes multiple bootstrap globals and option buffers before shell service init.,ghidra + rizin
0x00481fd0,348,bootstrap_scan_autorun_media,bootstrap,cdecl,inferred,ghidra-headless,4,Scans drive letters for RT3 autorun marker files rt3d1.txt and rt3d2.txt using GetDriveTypeA and open or close helpers before deeper shell init.,ghidra + rizin
0x00482160,101,shell_state_service_active_mode_frame,shell,thiscall,inferred,objdump + analysis-context,4,Acts as the broader shell-state service pass around one active-mode update on the shell state rooted at 0x006cec74. The helper increments nested-service depth at [this+0x64] optionally notifies the active mode object at 0x006cec78 through 0x0051f940 and 0x00434050 primes the shell runtime at 0x006d401c through 0x00538b60 conditionally services the Multiplayer preview-dataset object at 0x006cd8d8 through 0x00469720 and then dispatches shell_service_frame_cycle on the global shell controller at 0x006d4024 before decrementing the depth counter.,objdump + analysis-context + caller xrefs
0x004821d0,1019,shell_recompute_layout_slots,bootstrap,thiscall,inferred,ghidra-headless,4,Recomputes the shell layout-slot table after resolution or related display selectors change; derives normalized coordinates from static float tables updates 144 slot entries through the shell bundle child at [0x006d4024+0x18] and then commits the refreshed state.,ghidra + rizin
0x00482ec0,1359,shell_transition_mode,bootstrap,thiscall,inferred,ghidra-headless + objdump,4,"Switches the shell state's active mode at `[this+0x08]`, tears down any prior mode object, selects one of seven mode-specific handlers, updates globals like `0x006cec78`, and then notifies the shell bundle through `0x00538e50`. The calling convention is tighter now too: the function is a `thiscall` with two stack arguments, confirmed both by the entry-side stack read from `[esp+0x0c]` and by the `ret 8` epilogue at `0x48340c`. The grounded world-entry load-screen call shape at `0x443adf..0x443ae3` is therefore `(mode=4, arg2=0)`, not a one-arg mode switch. The second stack argument is tighter now too: current local evidence reads it as an old-active-mode teardown flag rather than a second mode id. The branch at `0x482fc6..0x482fff` only runs when that second argument is nonzero, and in that case it releases the old global active-mode object through `world_runtime_release_global_services` `0x00434300`, `0x00433730`, the common free path `0x0053b080`, and then clears `0x006cec78`. The caller split matches that read: the world-entry load-screen transition uses `(4, 0)` as the plain `LoadScreen.win` arm, while the later world-entry reactivation branch at `0x444c3b..0x444c44` enters mode `1` as `(1, esi)` after `0x4834e0` and `0x44ce60`, making the nonzero second argument the strongest current fit for 'tear down the prior active gameplay world while switching modes'. The constructor jump table at `0x48342c` is now grounded as a real mode map rather than raw branch addresses: mode `1` enters the startup-dispatch arm at `0x483012`, mode `2` enters `Setup.win` through `shell_setup_window_construct` `0x00504010`, mode `3` enters `Video.win` through `shell_video_window_construct` `0x005174e0`, mode `4` enters the plain `LoadScreen.win` arm at `0x4832e5` through `shell_load_screen_window_construct` `0x004ea620`, mode `5` enters `Multiplayer.win` through `multiplayer_window_init_globals` `0x004efe80`, mode `6` enters `Credits.win` through `shell_credits_window_construct` `0x004c7fc0`, and mode `7` enters `Campaign.win` through `shell_campaign_window_construct` `0x004b8e60`. The startup side is correspondingly tighter now too: mode `1` first constructs and publishes one transient `LoadScreen.win` object through `0x004ea620` and `0x00538e50`, then sets `[load_screen+0x78]` through `0x004ea710`, allocates the separate startup-runtime object through `0x0053b070(0x46c40)`, clears its startup-owned bands through `world_runtime_reset_startup_dispatch_state_bands` `0x004336d0`, publishes that second object into `0x006cec78`, and only then calls `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890` with stack args `(1, 0)`. After that straight-line call it immediately unpublishes the shell-window object again through `0x005389c0([0x006d401c], [this+0x0c])` before later mode-specific destroy paths continue. Mode `4`, by contrast, only constructs and publishes `LoadScreen.win` and does not own the startup-runtime allocation or `0x00438890` callsite. The paired old-mode teardown side is now tighter too: mode `1` tears down through `shell_game_window_destroy` `0x004dfd70`, mode `3` through `shell_video_window_destroy` `0x00517570`, mode `4` through `shell_load_screen_window_destroy` `0x004ea730`, mode `6` through `shell_credits_window_destroy` `0x004c7bc0`, and mode `7` through `shell_campaign_window_destroy` `0x004b8dc0`. Current live hook probes now show the old hook-side crash is gone: on the hook-driven path `shell_transition_mode(4, 0)` returns cleanly, and the inner old-object unpublish, `0x005400c0 -> 0x0053fe00 -> 0x0053f860` removal sweep, mode-`2` teardown helper `0x00502720`, `LoadScreen.win` construct, and shell publish all return. The corrected jump-table decode now explains the remaining runtime gap too: the current plain-run logs still do not show a trusted `0x00438890` entry because the hook has been entering mode `4`, not the mode-`1` startup-dispatch arm that statically owns that callsite. Current grounded callers remain bootstrap shell bring-up at `0x004840e0` and the world-entry side at `0x00443a50`.","ghidra + rizin + objdump + branch-disassembly correlation + jump-table decode + constructor/destructor correlation + epilogue and call-shape verification + caller-behavior correlation + live-hook probe correlation + pre-dispatch-runtime-object split"
0x005a2d64,101,crt_init_exit_handlers,startup,cdecl,inferred,ghidra-headless,3,Initializes on-exit tables and registers atexit handling before control reaches application startup.,ghidra + rizin
0x005a30f2,34,__amsg_exit,startup,cdecl,inferred,ghidra-headless,4,CRT fatal-exit helper that forwards startup failures into __exit.,ghidra + rizin
0x005a3117,36,crt_fast_error_exit,startup,cdecl,inferred,ghidra-headless,4,Startup error path that optionally emits the CRT banner then formats the failure and terminates through ___crtExitProcess.,ghidra + rizin
0x005a313b,423,crt_startup_entrypoint,startup,cdecl,inferred,ghidra-headless,4,PE entrypoint for patch 1.06; performs CRT and environment setup then validates early state before handing off to application bootstrap.,sha256:01b0d2496cddefd80e7e8678930e00b13eb8607dd4960096f527564f02af36d4 + ghidra + rizin + llvm-objdump
0x0053b020,70,bootstrap_reset_locale_state,bootstrap,unknown,inferred,ghidra-headless,2,Calls the locale helper at 0x0053ae70 then frees and clears related global pointers before later shell setup continues.,ghidra + rizin
0x0053afd0,26,shared_release_owned_heap_ptr_field_0_and_clear_root,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny shared release wrapper over dword root `[this+0x00]`. When that root is non-null, the helper frees it through `0x005a1145` and clears `[this+0x00]` back to null. Current callers span the slot-table service family `0x00530a00`, the shell status and control owner `0x00538640/0x00538b60`, several world and bootstrap support strips, and multiple placed-structure or runtime-object payload owners, so this is the safest current read for a generic free-and-clear wrapper rather than a family-specific destructor.","objdump + caller inspection + local disassembly + shared-wrapper correlation"
0x0053aff0,26,shared_release_owned_heap_ptr_field_0_and_clear_root_sibling,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Sibling tiny free-and-clear wrapper over dword root `[this+0x00]`. Like `0x0053afd0`, the helper frees one non-null owned heap pointer through `0x005a1145` and clears the root back to null. Current grounded callers are narrower specialization and payload-owner families such as `0x00455d65`, `0x0045607b`, `0x0045b1f9`, `0x0045c280`, and `0x0045e516`, so this is the safest current read for a shared sibling wrapper rather than a unique subtype-specific release body.","objdump + caller inspection + local disassembly + shared-wrapper correlation"
0x0053b090,757,global_banked_13_byte_record_family_load_stream_bank_and_rebuild_bucket_tables,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Loader for one bank in the neighboring global support family rooted at `[this+0x204ac]` with active-bank count `[this+0x427b8]`. The helper acquires one stream or slot handle from the caller through `0x005a4c57(…,0x8000)`, validates two tagged `4`-byte reads through `0x005a48c5`, allocates one contiguous `13 * count` byte record slab, and then populates that slab either by copying raw `13`-byte records or by slicing the same stream into fixed `13`-byte rows. It records the active row count at `[this+bank*4+0x417ec]`, zeroes and fills one `32`-bucket histogram at `[this+bank*0x80+0x223ec]`, allocates per-bucket storage for each nonempty bucket, copies each row into the matching bucket-selected slab, frees the temporary contiguous slab, and finally increments active-bank count `[this+0x427b8]`. Current grounded caller is the static-table-driven load loop at `0x0053ce09`, so this is the safest current read for the banked fixed-record loader plus bucket-table rebuild owner rather than a generic file reader.","objdump + caller inspection + local disassembly + fixed-record correlation + bucket-table correlation"
0x0053b390,561,global_banked_13_byte_record_family_lookup_by_key_with_recent_query_cache,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Lookup core for the same banked `13`-byte-record support family. Given a caller-supplied key dword, the helper first searches a `10`-entry recent-query cache rooted at `[this+0x4290c]`, then scans the active per-bank bucket slabs selected by `key & 0x1f`, and on a hit returns the resolved bank index, bucket-local row index, and row offset to three caller output pointers. On a miss it optionally formats one diagnostic buffer from `[this+0x427c0]` and returns `0`; on a direct hit in the first bank scan it also rotates the recent-query cache fields `[this+0x4290c/+0x42934/+0x4295c/+0x42984/+0x429ac]`. Current grounded callers are the thin wrapper `0x0053b590` and a larger family of support-side query branches under `0x0053babd..0x0053ce09`, so this is the safest current read for the keyed bank-and-bucket lookup core rather than a generic map search.","objdump + caller inspection + local disassembly + keyed-lookup correlation + recent-cache correlation"
0x0053b590,35,global_banked_13_byte_record_lookup_wrapper_with_stack_locals,bootstrap,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Thin cdecl wrapper above `global_banked_13_byte_record_family_lookup_by_key_with_recent_query_cache` `0x0053b390`. The helper builds three stack-local output slots, forwards the caller key and output pointers into `0x0053b390`, and returns that same status code. This is the safest current read for the trivial lookup wrapper rather than a second independent search owner.","objdump + caller inspection + local disassembly + lookup-wrapper correlation"
0x0053b5c0,98,global_hash_string_and_copy_into_0x427c0_scratch,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small string helper in the same banked-record support family. The helper copies the caller-supplied NUL-terminated string into scratch buffer `[this+0x427c0]`, measures its length, then folds each byte through `0x0051d660` and one multiply-add recurrence seeded from `7`, returning the final signed hash-like accumulator. This is the safest current read for the support-family string-hash helper rather than a user-facing formatter.","objdump + caller inspection + local disassembly + string-hash correlation"
0x0053b630,94,global_banked_13_byte_record_family_resolve_nth_live_entry_and_cache_current,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Ordinal resolver over the same banked support family. Given one zero-based ordinal, the helper walks the `32` bucket-chain roots at `[this+0x203a4]`, advances through each linked list by link field `+0x14`, and returns the matching live entry root when found. On success it also caches the current ordinal at `[this+0x427b0]` and the current entry root at `[this+0x20424]`. This is the safest current read for the nth-live-entry resolver rather than a generic list walk.","objdump + caller inspection + local disassembly + ordinal-resolution correlation"
0x0053b690,82,global_banked_13_byte_record_family_close_current_stream_handle_if_open,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small close helper over the current entry selected through `[this+0x427bc]`. The helper resolves that current entry through `global_banked_13_byte_record_family_resolve_nth_live_entry_and_cache_current` `0x0053b630`, and when the selected entry carries a live stream or slot handle at `[entry+0x04]` it closes either the auxiliary object `[entry+0x08]` through `0x005a1740` or the raw handle itself through `0x005a440d`, then resets `[entry+0x04]` to `-1` and `[entry+0x08]` to `0`. This is the safest current read for the current-stream close helper rather than a generic free path.","objdump + caller inspection + local disassembly + current-stream correlation"
0x0053b6f0,199,global_banked_13_byte_record_family_open_current_entry_stream_from_path,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Open helper for the current selected support-family entry. The helper resolves the current entry through `0x0053b630`, copies the path string at `[entry+0x10]` into one stack buffer, opens a new stream or slot handle through `0x005a4c57(…,0x8000)`, stores that handle at `[entry+0x04]`, clears `[entry+0x08]`, and emits one diagnostics path when the open fails. This is the safest current read for opening the current entry's stream from its stored path rather than a generic file open wrapper.","objdump + caller inspection + local disassembly + current-stream correlation"
0x0053b7c0,105,global_banked_13_byte_record_family_read_bytes_from_selected_or_current_stream_and_accumulate_counters,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Shared read helper over the support family's active stream handle. When `[this+0x427bc] < 0` it resolves the current entry through `0x0053b630` and uses that entry's handle `[entry+0x04]`; otherwise it uses the active-bank handle from `[this+0x204ac + [this+0x427bc]*4]`. It then reads the caller-requested byte count through `0x005a48c5`, accumulates the total bytes-read and read-call counters into `[this+0x428ec/+0x428f0]`, and emits one diagnostics path when the short read does not match the requested size. Current grounded callers include `0x0053b830` and many support-side consumers under `0x0053cb1d..0x00566e7e`, so this is the safest current read for the family's shared byte-read helper.","objdump + caller inspection + local disassembly + stream-read correlation + counter-accumulation correlation"
0x0053b830,17,global_banked_13_byte_record_family_read_u32_wrapper,bootstrap,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Tiny wrapper above `global_banked_13_byte_record_family_read_bytes_from_selected_or_current_stream_and_accumulate_counters` `0x0053b7c0`. The helper requests exactly `4` bytes into one stack-local dword and returns that same dword to the caller. This is the safest current read for the fixed-width read wrapper rather than a second stream owner.","objdump + caller inspection + local disassembly + fixed-read-wrapper correlation"
0x0053b850,125,global_banked_13_byte_record_staging_table_grow_by_100_rows,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Growth helper over the local `13`-byte staging table rooted at `[this+0x1f400]` with current row capacity `[this+0x427b4]`. The helper allocates a new slab large enough for the current rows plus `100` more, zero-fills the extension, copies any existing rows into the new slab, frees the old slab, then stores the new root back into `[this+0x1f400]` and increments capacity `[this+0x427b4]` by `100`. This is the safest current read for the staging-table growth helper rather than a generic realloc wrapper.","objdump + caller inspection + local disassembly + staging-table correlation"
0x0053b8d0,66,global_banked_13_byte_record_staging_table_service_type7_payloads_through_0x5512f0,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Linear service pass over the same `13`-byte staging table. The helper walks all live rows in `[this+0x1f400]`, and for each row whose leading count dword is positive and whose type byte at `+0x08` equals `7`, it forwards payload dword `[row+0x09]` into `0x005512f0`. Current grounded callers include `0x0051ffba`, `0x0052b9e7`, and `0x00565164`, so this is the safest current read for one type-7 staging-table service pass rather than a broader table rebuild.","objdump + caller inspection + local disassembly + staging-table correlation + type7-service correlation"
0x0053b920,66,global_banked_13_byte_record_staging_table_service_type7_payloads_through_0x550420,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Sibling linear service pass over the same `13`-byte staging table. Like `0x0053b8d0`, the helper walks all live rows and filters on positive count plus type byte `7`, but it forwards payload dword `[row+0x09]` into `0x00550420` instead. Current grounded callers include `0x0051ffba`, `0x0052040a`, `0x0052b9c1`, and `0x0056513e`, so this is the safest current read for the second type-7 service pass rather than another generic table walk.","objdump + caller inspection + local disassembly + staging-table correlation + type7-service correlation"
0x0053b970,98,global_banked_13_byte_record_family_clear_bucket_chains_and_reset_current_selection,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Reset helper over the same banked-record support family. The helper first closes the current selected entry through `0x0053b690` when `[this+0x427bc]` is negative, then walks all `32` bucket-chain roots at `[this+0x203a4]`, frees each chained node's payload `[node+0x10]` and the node itself through `0x0053b080`, and finally clears current-entry cache `[this+0x20424]` and resets current ordinal `[this+0x427b0]` back to `-1`. Current grounded caller is the broader staging-table owner `0x0053b9f2`, so this is the safest current read for the bucket-chain reset helper rather than a full family destructor.","objdump + caller inspection + local disassembly + bucket-chain-reset correlation"
0x0053b9e0,848,global_banked_13_byte_record_family_emit_pack_system_leak_report_reset_owned_report_slots_and_close_all_bank_streams,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader report-and-reset owner over the same banked `13`-byte-record support family. The helper begins by calling `0x0053b970`, then releases four owned report-slot roots at `[this+0x429b0..+0x429bc]` plus sibling global root `0x00ccba50` through `0x0053ba46`. It next walks the local staging rows at `[this+0x1f400]`, repeatedly resolves keyed bank entries through `0x0053b390`, formats several numeric row fields through `0x0051b700`, packages the resulting line data through `0x00518de0/0x0051d680`, and publishes those lines through callback slot `0x005c8078`; the final footer uses static format string `Pack System Leak Count : %1`. After the report pass it frees the staging slab, clears active-bank count `[this+0x427b8]`, releases one `32`-entry owned-report strip through `0x0053afd0`, and closes every per-bank handle or auxiliary object rooted at `[this+0x204ac/+0x2144c]`. This is the safest current read for the pack-system leak-report and full support-family reset owner rather than a generic destructor.","objdump + caller inspection + local disassembly + leak-report-string correlation + bank-reset correlation"
0x0053ba1b,43,global_construct_0x88_pack_report_slot_through_0x518b90,bootstrap,stdcall,inferred,objdump + local disassembly,1,"Tiny owned-object constructor used in the same support-side report family. The helper allocates `0x88` bytes through `0x0053b070`, and on success forwards the new root plus caller payload into `0x00518b90(…,1,arg,10,5,0,0,0)`. This is the safest current read for a narrow `0x88`-byte report-slot constructor rather than a generic allocator wrapper.","objdump + local disassembly + ctor-shape correlation"
0x0053ba46,33,global_release_and_clear_owned_pack_report_slot_root,bootstrap,stdcall,inferred,objdump + caller inspection + local disassembly,1,"Tiny release helper over one caller-supplied dword root pointer. When the root is non-null, the helper clears it, releases the owned object through `0x00519bd0`, then frees the wrapper through `0x0053b080`. Current grounded callers are the broader report owner `0x0053b9e0` and nearby support-side cleanup strips, so this is the safest current read for a narrow owned-report-slot release helper rather than a family-wide destructor.","objdump + caller inspection + local disassembly + release-shape correlation"
0x0053bd40,197,global_banked_13_byte_record_family_seek_selected_or_current_payload_stream_by_key_and_return_handle,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Keyed stream-position helper over the same banked support family. The helper resolves the caller key through `0x0053b390`; when the lookup lands in one active bank, it increments query counter `[this+0x428f4]`, computes the bank-local byte offset from the row-size base `[this+0x1f404 + bank*4]`, row count `[this+0x417ec + bank*4]`, bucket row root, and row offset, then seeks the live bank handle `[this+0x204ac + bank*4]` through `0x005ac18d(…,offset+8,0)` and returns that handle. When the lookup resolves as a negative current-entry ordinal instead, it opens the selected entry stream through `0x0053b6f0`, optionally seeks that entry handle by the caller offset, and returns the same handle. Current grounded callers allocate one output buffer from the paired length helper `0x0053c9c0` and immediately feed the returned handle into `0x0053b7c0`, so this is the safest current read for the keyed seek-and-return-stream helper rather than a raw file-open wrapper.","objdump + caller inspection + local disassembly + stream-seek correlation + keyed-lookup correlation"
0x0053be10,325,global_banked_13_byte_record_family_resolve_or_lazy_open_typed_aux_object_by_key,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Keyed typed-object resolver over the same support family. The helper resolves the caller key through `0x0053b390`; on a positive bank hit it seeks the matching bank handle to the row payload through the same offset computation used by `0x0053bd40`, then returns the cached per-bank auxiliary object at `[this+0x2144c + bank*4]` or lazily creates it through `0x005c7905` with one of two static descriptors, including one rooted at `data\\\\Other\\\\AirplaneTypes.txt`. On a negative current-entry ordinal it opens the current entry stream through `0x0053b6f0` and returns the lazily-created current-entry auxiliary object at `[entry+0x08]`. A global gate from `0x005a3f5b` can suppress one branch when the caller's flag byte is clear. Current grounded callers immediately pass the returned object into higher typed readers, so this is the safest current read for the keyed auxiliary-object resolver rather than another raw stream helper.","objdump + caller inspection + local disassembly + typed-object correlation + descriptor-string correlation"
0x0053bf60,125,global_banked_13_byte_record_staging_table_release_row_payload_by_type_and_clear_row,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Typed release helper over one local `13`-byte staging-table row selected by ordinal. The helper reads the row type byte at `+0x08` and payload root at `+0x09`, dispatches non-null payloads through type-specific release or service helpers including `0x00567520`, `0x00542c90`, `0x0053ee60`, and `0x005512a0`, then frees the payload root through `0x0053b080` when that branch returns and clears the entire row back to zero. Current grounded caller is the refcount-drop helper `0x0053c000`, so this is the safest current read for the typed row-payload release owner rather than a generic table reset.","objdump + caller inspection + local disassembly + staging-row correlation + type-dispatch correlation"
0x0053c000,98,global_banked_13_byte_record_staging_table_drop_refcount_by_payload_id_and_release_row_when_last_user,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Reference-drop helper over the same local `13`-byte staging table. Given one caller payload id, the helper scans row field `[row+0x09]` for a match, decrements that row's lead refcount dword, and returns immediately while the count stays positive. When the count reaches zero it checks one per-type persistent slot strip at `[this+0x4278c + type*4]`; if that strip is null, it tail-calls `0x0053bf60` to release the row payload and clear the row. This is the safest current read for a refcount-drop helper over staging payload instances rather than a second generic free path.","objdump + caller inspection + local disassembly + refcount correlation + staging-row correlation"
0x0053c070,333,global_banked_13_byte_record_staging_table_acquire_or_create_refcounted_row_for_payload_and_type,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Typed acquire-or-create helper over the same local `13`-byte staging table. The helper first searches existing rows for matching field `[row+0x04] == caller_payload_id`; on a hit it increments the lead refcount dword and returns the existing payload root `[row+0x09]`. On a miss it scans backward for one empty row, grows the table through `0x0053b850` when needed, seeds a new row with refcount `1`, caller payload id at `+0x04`, caller type byte at `+0x08`, and then lazily constructs the typed payload root at `+0x09` for selected types including `1 -> 0x00567500`, `6 -> 0x0053ee70`, and `7 -> 0x00551970`. This is the safest current read for the refcounted staging-row acquire-or-create owner rather than a plain append helper.","objdump + caller inspection + local disassembly + refcount correlation + typed-payload correlation"
0x0053c900,35,global_banked_13_byte_record_family_reset_bucket_stream_and_recent_query_state,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Compact reset helper above the same support family. The helper clears bucket chains through `0x0053b970`, re-enters neighboring cleanup `0x0053c820`, and then fills the `10`-entry recent-query cache rooted at `[this+0x4290c]` with `-1`. This is the safest current read for the family's compact cache-and-stream reset owner rather than a full constructor.","objdump + caller inspection + local disassembly + recent-cache correlation"
0x0053c930,140,global_banked_13_byte_record_family_lookup_composite_string_key,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Composite-string lookup wrapper over the same banked support family. The helper copies one caller primary string into a local stack buffer, optionally appends a second caller suffix string, hashes the resulting composite key through `0x0053b5c0`, and then forwards that key plus caller output slots and mode flag into `0x0053b390`. Current grounded callers use this as the main string-keyed probe across many shell and bootstrap paths, so this is the safest current read for the composite-key lookup wrapper rather than a user-facing formatter.","objdump + caller inspection + local disassembly + string-key correlation + keyed-lookup correlation"
0x0053c9c0,93,global_banked_13_byte_record_family_lookup_key_and_return_payload_byte_len,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small size resolver over the same banked support family. The helper resolves the caller key through `0x0053b390`; on a positive bank hit it returns row field `[bucket_row + row_index*0x0d + 0x04]`, while on a negative current-entry ordinal it resolves that entry through `0x0053b630` and returns `[entry+0x0c]` instead. Current grounded callers immediately pair this byte length with `0x0053bd40` and `0x0053b7c0` to allocate and read one keyed payload, so this is the safest current read for the keyed payload-length resolver rather than a generic field getter.","objdump + caller inspection + local disassembly + payload-length correlation + keyed-lookup correlation"
0x0053ca20,100,global_banked_13_byte_record_family_push_current_stream_selection_frame,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Push helper over the same banked support family's current stream-selection state. The helper allocates one `0x0c`-byte frame, snapshots either the current-entry handle `[entry+0x04]` or the active-bank handle `[this+0x204ac + [this+0x427bc]*4]` through `0x005c7820`, stores the current selection lane `[this+0x427bc]`, chains the previous frame root from `[this+0x20428]` into `[frame+0x08]`, and then publishes the new frame root back to `[this+0x20428]` while incrementing push counter `[this+0x428f8]`. Current grounded callers pair it with `0x0053ca90`, so this is the safest current read for the current-selection push helper rather than a generic alloc wrapper.","objdump + caller inspection + local disassembly + selection-frame correlation"
0x0053ca90,127,global_banked_13_byte_record_family_pop_current_stream_selection_frame_and_restore_seek,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Pop-and-restore helper over the same current stream-selection frame stack rooted at `[this+0x20428]`. When one frame is live, the helper increments `[this+0x428f8]`, closes the current entry stream through `0x0053b690` when needed, restores selection lane `[this+0x427bc]` from `[frame+0x04]`, reopens the selected current-entry stream through `0x0053b6f0` when the restored lane is negative, otherwise resolves the live bank handle from `[this+0x204ac]`, seeks that handle back to saved cursor `[frame+0x00]` through `0x005ac18d`, pops the frame chain from `[frame+0x08]`, and frees the frame root. Current grounded callers bracket typed support-side reads and object-acquisition flows, so this is the safest current read for the current-selection restore helper rather than a generic stack pop.","objdump + caller inspection + local disassembly + selection-frame correlation + stream-seek correlation"
0x0053cb10,73,global_banked_13_byte_record_family_read_two_u32_header_and_optional_heap_blob,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small read helper over the same active stream. The helper reads two `u32` values through `0x0053b7c0`; when the second value is nonzero, it allocates a heap buffer of that length through `0x005a125d`, stores the new pointer to one caller output slot, and reads that many payload bytes into the buffer through `0x0053b7c0`. Current grounded callers sit in support-family object loaders under `0x0053fb88`, `0x005403c7`, `0x0055b9a4`, and `0x00563c8f`, so this is the safest current read for a small two-dword-plus-optional-blob reader rather than a generic stream wrapper.","objdump + caller inspection + local disassembly + header-read correlation + heap-blob correlation"
0x0053cb60,1408,global_banked_13_byte_record_family_construct_reset_load_static_root_table_and_seed_report_slots,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader constructor and bootstrap-load owner for the same banked `13`-byte-record support family. The helper zeroes the per-type persistent slot strip `[this+0x4278c]`, clears the bucket-chain roots and active bank roots under `[this+0x203a4/+0x20424/+0x204ac]`, resets all counters and recent-query cache fields `[this+0x427b0..+0x429ac]`, seeds four owned report-slot roots `[this+0x429b0..+0x429bc]` through `0x0053ba1b`, grows the local staging slab through `0x0053b850`, and then walks the static pointer table rooted at `0x00624e14` through `0x00624e48`. For each table entry it formats one `%%1*.pk4`-style probe, loads one bank through `0x0053b090`, and later re-enters the keyed lookup and typed-object strip `0x0053c930/0x0053be10` to route selected records into the owned report slots with category probes such as `companyLogo`, `portrait`, and `trainSkin`. This is the safest current read for the family's constructor-plus-static-root-table bootstrap loader rather than a narrow per-bank helper.","objdump + caller inspection + local disassembly + static-root-table correlation + support-family bootstrap correlation"
0x0053d0f0,24,global_banked_13_byte_record_staging_table_acquire_type1_payload_by_string_key,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny string-keyed wrapper above the same staging-table acquire path. The helper hashes the caller string through `0x0053b5c0`, then acquires or creates a staging-row payload of type `1` through `0x0053c070`. Current grounded callers sit in shared runtime-object and support-family bootstrap flows, so this is the safest current read for the type-`1` string-keyed staging wrapper rather than a generic hash helper.","objdump + caller inspection + local disassembly + string-key correlation + type1-wrapper correlation"
0x0053d110,25,global_banked_13_byte_record_staging_table_acquire_type6_payload_by_string_key,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Sibling tiny string-keyed wrapper above `0x0053c070`. Like `0x0053d0f0`, the helper hashes one caller string through `0x0053b5c0`, but it acquires or creates a staging-row payload of type `6` instead. Current grounded callers span runtime-object, shell, and support-family flows, which makes this the safest current read for the type-`6` string-keyed staging wrapper rather than a raw field setter.","objdump + caller inspection + local disassembly + string-key correlation + type6-wrapper correlation"
0x0053d130,143,global_banked_type7_record_refresh_from_openable_path_basename_and_stem,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly + string-template correlation,2,"Path-normalizing helper beside the string-keyed staging wrappers. The function scans one caller path for the final backslash, copies the basename into a local buffer, derives a second local stem through `0x0051d8a0`, probes the original path through `support_query_path_is_openable_for_read` `0x0051e430`, and only on success forwards the basename plus stem into `0x0053c710` with the refresh flag set before resetting owner dword `[this+0x427b0] = -1`. The current grounded caller is the selector-`2` setup branch inside `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890`, where it refreshes one support-family record from setup path buffer `0x006d1370` before the common world-init work continues, so this is the safest current read for the openable-path basename or stem refresh helper rather than a generic file parser.","objdump + caller inspection + local disassembly + string-template correlation + selector2-setup-path correlation"
0x0053d1d0,103,scored_heap_sift_up_node_by_field_0x04_and_refresh_slot_backpointers,support,thiscall,inferred,objdump + local disassembly,1,"Binary-heap sift-up helper over one owner whose array root is `[this+0x08]`. Starting from one caller index, the helper compares node score field `[node+0x04]` against the parent score, bubbles the higher-scoring node upward, and refreshes each moved node's backpointer at `[node+0x00]` to the new array slot address. This is the safest current read for a max-heap sift-up helper rather than a support-family-specific payload routine.","objdump + local disassembly + heap-shape correlation"
0x0053d240,143,scored_heap_sift_down_node_by_field_0x04_and_refresh_slot_backpointers,support,thiscall,inferred,objdump + local disassembly,1,"Binary-heap sift-down helper over the same owner. Given one caller index, the helper chooses the larger-scoring child by comparing child score field `[node+0x04]`, bubbles that child upward while its score stays above the current node's score, then writes the final node root back into the settled slot and refreshes its backpointer at `[node+0x00]`. This is the safest current read for the paired max-heap sift-down helper rather than a queue-family destructor.","objdump + local disassembly + heap-shape correlation"
0x0053d2e0,19,scored_heap_peek_top_score_field_0x04_or_zero,support,thiscall,inferred,objdump + local disassembly,1,"Tiny query helper over the same scored heap owner. When `[this+0x0c] > 0`, the helper returns score field `[heap[0]+0x04]`; otherwise it returns `0`. This is the safest current read for a top-score peek helper rather than a broader queue query.","objdump + local disassembly + heap-shape correlation"
0x0053d300,24,scored_heap_decrement_node_score_field_0x04_and_sift_down,support,thiscall,inferred,objdump + local disassembly,1,"Small heap-adjust helper over one caller node root. The helper decrements the node's score field `[node+0x04]`, derives the current array index from backpointer `[node+0x00]`, and tail-calls `0x0053d240` to restore heap order from that slot. This is the safest current read for a decrement-and-reheapify helper rather than a generic arithmetic wrapper.","objdump + local disassembly + heap-shape correlation"
0x0053d320,107,scored_node_queue_acquire_node_from_freelist_or_alloc_and_push,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small scored-node queue helper over one owner with queue root `[this+0x08]` and node-pool descriptor `[this+0x04]`. The helper first pops one reusable node from the pool freelist when available, otherwise allocates a fresh node of size `[pool+0x10]` through `0x0053b070`; it then pushes the node into the live queue rooted at `[this+0x08]`, increments that queue count, and seeds caller values into `[node+0x04]` and `[node+0x08]`. Current grounded callers pair it with `0x0053d390` and `0x0053d440`, so this is the safest current read for a scored-node queue acquire-and-push helper rather than a plain list append.","objdump + caller inspection + local disassembly + queue-shape correlation"
0x0053d390,176,scored_node_queue_pop_highest_score_payload_and_recycle_or_free_node,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Removal helper over the same scored-node queue. The helper scans the live queue rooted at `[this+0x08]` for the node with the highest score field `[node+0x04]`, unlinks that node, decrements the queue count, captures payload field `[node+0x08]`, and then either returns the node to the pool freelist described by `[this+0x04]` when it lies inside the managed pool span or frees it through `0x0053b080` otherwise. This is the safest current read for a pop-highest-score helper rather than a generic free path.","objdump + caller inspection + local disassembly + queue-shape correlation"
0x0053d440,36,scored_node_queue_contains_payload_value,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Linear membership query over the same scored-node queue. The helper walks the live queue rooted at `[this+0x08]` and returns `1` when any node carries caller payload value `[node+0x08] == arg`, or `0` on miss. Current grounded callers sit beside `0x0053d320/0x0053d390`, so this is the safest current read for a queue-membership predicate rather than a key hash helper.","objdump + caller inspection + local disassembly + queue-shape correlation"
0x0053d470,76,scored_node_queue_release_pool_and_owned_roots,support,thiscall,inferred,objdump + local disassembly,1,"Release helper over the same scored-node queue owner. The helper frees optional root `[this+0x08]` through `0x005a1145`, releases optional pool descriptor `[this+0x04]` through `0x0053dcb0` and `0x0053b080`, frees optional root `[this+0x00]`, and clears queue count `[this+0x0c]` back to zero. This is the safest current read for the queue-owner release helper rather than a family-wide support destructor.","objdump + local disassembly + queue-shape correlation"
0x0053d4c0,120,scored_heap_acquire_node_from_pool_or_alloc_insert_and_sift_up,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Pooled insert helper over the scored heap owner whose node-pool descriptor lives at `[this+0x04]`, slot array at `[this+0x08]`, and live count at `[this+0x0c]`. The helper first pops a reusable node from the pool freelist or allocates one fresh node of pool stride `[pool+0x10]`, then increments the live count, stores the new node into the next heap slot, seeds caller values into `[node+0x04]` and `[node+0x08]`, and finally re-enters `0x0053d1d0` to restore max-heap order. Current grounded callers pair it with `0x0053d540`, so this is the safest current read for the heap insert helper rather than a queue append.","objdump + caller inspection + local disassembly + heap-shape correlation"
0x0053d540,136,scored_heap_pop_top_payload_and_recycle_or_free_node,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Pop helper over the same scored heap owner. When the heap is non-empty, the helper captures the payload field `[top+0x08]`, recycles or frees the root node through the pool descriptor at `[this+0x04]`, replaces the top slot from the last live slot when more than one node remains, decrements live count `[this+0x0c]`, and re-enters `0x0053d240` to restore heap order from slot `1`. This is the safest current read for a pop-top-payload helper over the scored heap rather than a queue scan.","objdump + caller inspection + local disassembly + heap-shape correlation"
0x0053d5d0,81,scored_heap_release_pool_array_and_owned_roots,support,thiscall,inferred,objdump + local disassembly,1,"Release helper over the same scored heap owner. The helper frees optional slot-array root `[this+0x08]` through `0x0053b080`, releases optional pool descriptor `[this+0x04]` through `0x0053dcb0` and `0x0053b080`, and frees optional backing root `[this+0x00]` through `0x005a1145`. This is the safest current read for the heap-owner release helper rather than a broader family destructor.","objdump + local disassembly + heap-shape correlation"
0x0053d630,179,scored_heap_construct_with_capacity_and_pool_stride_0x0c,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Constructor for the same scored heap owner. Given one caller capacity, the helper first releases any existing owner through `0x0053d5d0`, allocates one zeroed backing slab of `capacity * 0x0c` bytes into `[this+0x00]`, allocates a `0x1c` pool descriptor into `[this+0x04]`, initializes that descriptor through `0x0053dcf0` with stride `0x0c`, and then allocates one zeroed `0x0c` slot-array header into `[this+0x08]`. Current grounded callers are the nearby owner paths at `0x00416aa4` and `0x0053d740`, so this is the safest current read for the scored-heap constructor rather than a generic vector alloc.","objdump + caller inspection + local disassembly + heap-shape correlation"
0x0053d6f0,76,extended_scored_heap_release_pool_array_and_owned_roots,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Release helper over the adjacent extended scored-heap owner. The helper frees optional slot-array root `[this+0x08]` through `0x005a1145`, releases optional pool descriptor `[this+0x04]` through `0x0053dcb0` and `0x0053b080`, frees optional backing slab `[this+0x00]`, and clears live count `[this+0x0c]` back to zero. Current grounded callers are the hotkey-report iterator teardown at `0x0045f343` and the sibling owner teardown at `0x00522f54`, so this is the safest current read for the extended heap-owner release helper rather than a generic destructor.","objdump + caller inspection + local disassembly + heap-shape correlation"
0x0053d740,178,extended_scored_heap_construct_with_capacity_and_sentinel_header,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Constructor for the adjacent extended scored-heap owner. Given one caller capacity, the helper first releases any existing owner through `0x0053d470`, allocates one zeroed backing slab of `capacity * 0x0c` bytes into `[this+0x00]`, allocates a `0x1c` pool descriptor into `[this+0x04]`, initializes that descriptor through `0x0053dcf0` with stride `0x0c`, allocates one zeroed pointer-slot array of `(capacity * 4) + 4` bytes into `[this+0x08]`, seeds sentinel header `[this+0x10]`, default best-score lane `[this+0x14] = 0x7fffffff`, and counter `[this+0x18] = 0`, and stores the sentinel header as the first slot-array entry. Current grounded callers are the temporary hotkey-report owner at `0x0045f292` and the sibling shell/runtime owner at `0x00522c67`, so this is the safest current read for the extended heap constructor rather than a second plain vector alloc.","objdump + caller inspection + local disassembly + heap-shape correlation + sentinel-header correlation"
0x0053d810,95,hash_cstring_crc32_like_with_optional_ascii_uppercase,support,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Small hashing helper over one NUL-terminated byte string. The helper folds each byte through the table rooted at `0x00624e48`, optionally uppercases ASCII letters first when mode arg1 equals `1`, and returns the final CRC32-like accumulator. Current grounded caller is `shell_input_binding_registry_resolve_entry_by_action_stem` `0x0045ede0`, which uses the uppercase-enabled path while resolving normalized action stems, so this is the safest current read for the support-side NUL-terminated hash helper rather than a generic checksum wrapper.","objdump + caller inspection + local disassembly + crc-table correlation"
0x0053d870,46,hash_fixed_length_byte_span_crc32_like,support,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Sibling hashing helper over one fixed-length byte span. The helper folds exactly `len` bytes from the caller pointer through the same table rooted at `0x00624e48` and returns the final CRC32-like accumulator. Current grounded callers hash fixed `0x0a`- and `0x1c`-byte record headers at `0x0046cc97` and `0x0047085a`, so this is the safest current read for the fixed-length support-side hash helper rather than a string normalizer.","objdump + caller inspection + local disassembly + crc-table correlation"
0x0053d8a0,186,u32_to_ptr_hash_table_release_optional_pooled_nodes_and_bucket_array,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Release helper over one intrusive `u32 -> ptr` hash-table owner. The helper walks every bucket-chain root in bucket array `[this+0x00]`, and for each node either returns that node to the optional pooled-node descriptor at `[this+0x08]` when the descriptor span and in-pool checks match, or frees it through `0x0053b080` otherwise; it then releases the optional pool descriptor, frees the optional node-backing root `[this+0x04]`, frees the bucket array root `[this+0x00]`, and clears live-node count `[this+0x0c]` plus bucket count `[this+0x10]`. Current grounded callers are the connected-component and local-bucket map owners around `0x00416170` and `0x00522ed1`, so this is the safest current read for the pooled hash-table release helper rather than a generic map clear.","objdump + caller inspection + local disassembly + intrusive-hash-table correlation"
0x0053d960,124,u32_to_ptr_hash_table_insert_or_replace_value_by_key,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Insert helper over the same intrusive `u32 -> ptr` hash-table owner. The helper acquires one pooled node from free list `[table+0x08]` or allocates a fresh node when needed, hashes the caller key through `(key ^ (key >> 15)) % [table+0x10]`, seeds node fields `[node+0x00] = key` and `[node+0x04] = value`, links the node to the head of the selected bucket chain, and leaves duplicate-key replacement to the caller's preceding remove path. Current grounded callers include the connected-component map writers at `0x00416170` and `0x00416298`, so this is the safest current read for hash-table insert-by-key rather than a generic queue push.","objdump + caller inspection + local disassembly + intrusive-hash-table correlation"
0x0053d9e0,185,u32_to_ptr_hash_table_remove_key_and_return_value,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Removal helper over the same intrusive `u32 -> ptr` hash-table owner. The helper hashes the caller key through `(key ^ (key >> 15)) % [table+0x10]`, walks the selected bucket chain, unlinks the matching node when found, returns stored value `[node+0x04]`, and then either recycles the node into the optional pool descriptor at `[table+0x08]` or frees it through `0x0053b080`. Current grounded callers are the connected-component and local-bucket refresh paths at `0x00416170`, `0x0041626c`, and `0x0041643e`, so this is the safest current read for remove-and-return-value rather than another membership predicate.","objdump + caller inspection + local disassembly + intrusive-hash-table correlation"
0x0053daa0,58,u32_to_ptr_hash_table_contains_key,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Membership predicate over the same intrusive `u32 -> ptr` hash-table owner. The helper hashes the caller key through `(key ^ (key >> 15)) % [table+0x10]`, walks the selected bucket chain by link field `+0x08`, and returns `1` on the first matching key or `0` on miss. Current grounded callers sit beside the sibling lookup and remove helpers, so this is the safest current read for a hash-table contains-key predicate rather than a value fetch.","objdump + caller inspection + local disassembly + intrusive-hash-table correlation"
0x0053dae0,54,u32_to_ptr_hash_table_lookup_value_by_key,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Lookup helper over the same intrusive `u32 -> ptr` hash-table owner. The helper hashes the caller key through `(key ^ (key >> 15)) % [table+0x10]`, walks the selected bucket chain, and returns stored value `[node+0x04]` on the first matching key or `0` on miss. Current grounded callers include `placed_structure_collection_refresh_local_runtime_side_state_in_rect_from_cell_bucket_map` `0x00419110`, the connected-component rectangle pass `0x00416170`, and `global_owner_family_lookup_key_in_selected_hash_root` `0x00531ef0`, so this is the safest current read for hash-table lookup-by-key rather than a membership-only helper.","objdump + caller inspection + local disassembly + intrusive-hash-table correlation"
0x0053db20,177,u32_to_ptr_hash_table_iterate_entries_with_optional_exact_key_filter_and_callback,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Callback iterator over the same intrusive `u32 -> ptr` hash-table owner. When key arg0 is zero, the helper walks every bucket chain in bucket array `[table+0x00]`; otherwise it hashes that key through `(key ^ (key >> 15)) % [table+0x10]` and only walks the selected bucket. For each visited node it calls the caller-supplied callback with `ecx = node`, `edx = user_arg`, and stops early on the first nonzero callback result, returning that value. Current grounded callers are the cleanup and release passes at `0x00522e85` and `0x00522ec0`, so this is the safest current read for the optional-key callback iterator rather than a value lookup helper.","objdump + caller inspection + local disassembly + intrusive-hash-table correlation + callback-iterator correlation"
0x0053dbe0,5,u32_to_ptr_hash_table_release_thunk,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tail-call thunk into `u32_to_ptr_hash_table_release_optional_pooled_nodes_and_bucket_array` `0x0053d8a0`. Current grounded callers use it as the direct release entry for hash-table owners at `0x00522e93` and `0x00522ed1`, so the safest current read is a narrow release thunk rather than an independent owner.","objdump + caller inspection + local disassembly + release-thunk correlation"
0x0053dbf0,185,u32_to_ptr_hash_table_construct_with_bucket_count_and_pooled_node_capacity,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Constructor for the same intrusive `u32 -> ptr` hash-table owner. Given caller bucket count and pooled-node capacity, the helper first releases any existing owner through `0x0053d8a0`, allocates one zeroed pooled-node backing slab of `capacity * 0x10` bytes into `[this+0x04]`, allocates a `0x1c` pool descriptor into `[this+0x08]`, initializes that descriptor through `0x0053dcf0` with stride `0x10`, allocates one zeroed bucket array of `bucket_count * 4` bytes into `[this+0x00]`, and stores pooled-node capacity `[this+0x0c]` plus bucket count `[this+0x10]`. Current grounded callers are the map-side owners under `0x00416170` and the sibling runtime owner at `0x00522e7e`, so this is the safest current read for the pooled hash-table constructor rather than a generic alloc wrapper.","objdump + caller inspection + local disassembly + intrusive-hash-table correlation"
0x0053dcb0,55,fixed_stride_pool_descriptor_release_optional_owned_block,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Release helper over one fixed-stride pool descriptor. The helper frees optional freelist or root pointer `[this+0x00]`, and when ownership flag `[this+0x18] == 1` it also frees optional owned backing block `[this+0x04]`, then leaves the descriptor itself for the caller to release. Current grounded callers are the scored-heap and hash-table owner destructors `0x0053d470`, `0x0053d5d0`, `0x0053d6f0`, and `0x0053d8a0`, so this is the safest current read for the pool-descriptor release helper rather than a family-wide destructor.","objdump + caller inspection + local disassembly + pool-descriptor correlation"
0x0053dcf0,216,fixed_stride_pool_descriptor_reset_with_optional_owned_block_and_freelist_seed,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Reset or constructor helper over one fixed-stride pool descriptor. The helper stores caller stride at `[this+0x14]`, releases prior freelist root `[this+0x00]` and any owned backing block `[this+0x04]` when ownership flag `[this+0x18]` was set, then either adopts one caller-supplied backing block and count directly or allocates an owned block of `count * stride` bytes, seeds freelist header `[this+0x00]`, block start `[this+0x04]`, block end `[this+0x08]`, count `[this+0x0c]`, stride `[this+0x10]`, and ownership flag `[this+0x18]`, and links every fixed-stride node into the freelist. Current grounded callers initialize scored-heap and hash-table pool descriptors from `0x0053d630`, `0x0053d740`, and `0x0053dbf0`, so this is the safest current read for the fixed-stride pool-descriptor reset helper rather than one pool-family-specific constructor.","objdump + caller inspection + local disassembly + pool-descriptor correlation + freelist-seed correlation"
0x0053dde0,8,world_anchor_scale_primary_extent_by_local_factor,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny world-anchor scaling helper. The function multiplies caller float arg0 by local factor `[this+0x2e]` and returns the resulting floating-point extent. Current grounded caller is `shell_queue_world_anchor_marker` `0x00552560`, which pairs it with `0x0053ddf0` while building screen-space marker extents, so this is the safest current read for the primary extent scaler rather than a generic multiply wrapper.","objdump + caller inspection + local disassembly + world-anchor correlation"
0x0053ddf0,8,world_anchor_scale_secondary_extent_by_local_factor,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Sibling world-anchor scaling helper. The function multiplies caller float arg0 by local factor `[this+0x32]` and returns the resulting floating-point extent. Current grounded caller is `shell_queue_world_anchor_marker` `0x00552560`, which uses it for the second screen-space marker extent lane, so this is the safest current read for the secondary extent scaler rather than a generic multiply wrapper.","objdump + caller inspection + local disassembly + world-anchor correlation"
0x0053de00,83,indexed_string_table_lookup_ptr_or_format_out_of_range_warning,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Indexed string-table getter over one owner with optional family label `[this+0x20]`, table root `[this+0x24]`, and entry count word `[this+0x28]`. When index arg0 is in range, the helper returns table entry pointer `[table + index*4]`; on overflow it formats one warning through the template at `0x005dd658` using the owner label or fallback `0x005c87a8`, then returns the first table entry. Current grounded callers are the setup payload-category row draw callback `0x00502030` and the selected-train route-and-state panel renderer `0x0050fc00`, so this is the safest current read for the indexed string-table lookup helper rather than a route-specific formatter.","objdump + caller inspection + local disassembly + indexed-string-table correlation"
0x0053de60,1137,shell_image_marker_payload_refresh_variant_table_from_screen_metrics_and_vram_policy,shell,thiscall,inferred,objdump + caller inspection + local disassembly + rdata string decode,2,"Heavy refresh pass over the typed type-`6` image-marker payload constructed by `0x0053ee70/0x0053e370`. The helper derives current screen-space scale from shell display state `[0x006d4024+0x11421e/+0x34/+0x11422f/+0x114243/+0x114247/+0x11424f/+0x1146dd]`, clears and rebuilds the local variant table rooted at `[this+0x24]`, resolves one selected TGA or DDS resource through `0x0053c1c0`, and then parses the payload's per-variant descriptors into one live table of `0x25`-byte marker variants via `0x005520a0`. The parsed keyword set is now grounded from `.rdata`: `Image`, `ImageWH`, `ImageWHForceScale`, `ImageWHWithRef`, `ImageScaled`, `ImageWHScaled`, `MaxPercentOfInterfaceVRAM`, `MaxPercentOfInterfaceVRAMToUse`, `Scaleable`, `TGATargetScreenHeight`, `TGATargetScreenWidth`, `TGAHeight`, `TGAWidth`, `TGAName`, `HorizontalScaleModifier`, and `VerticalScaleModifier`. Current direct callers are the constructor tail `0x0053ee15` and the rebuild wrapper `0x0053e2d0`, while downstream consumers include `shell_queue_world_anchor_marker` `0x00552560`, so this is the safest current read for the payload's variant-table refresh owner rather than a generic image loader.","objdump + caller inspection + local disassembly + rdata string decode + typed-payload correlation"
0x0053e2b0,32,shell_image_marker_payload_release_variant_resources_then_refresh,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small rebuild wrapper over the same type-`6` image-marker payload. The helper releases any current variant table entries rooted at `[this+0x24]`, releases optional loaded image handle `[this+0x2a]` through `0x0053c000`, clears that handle, and then tail-jumps back into `shell_image_marker_payload_refresh_variant_table_from_screen_metrics_and_vram_policy` `0x0053de60`. Current grounded caller is the shell helper-collection refresh sweep `0x00538ec0`, so this is the safest current read for the payload rebuild wrapper after shell selection or display changes rather than a pure destructor.","objdump + caller inspection + local disassembly + typed-payload correlation"
0x0053e2e0,144,shell_image_marker_payload_release_variant_table_image_handle_and_label,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Release helper over the same type-`6` image-marker payload. The helper walks every live variant pointer in `[this+0x24]`, releases each variant through `0x00552130` and `0x0053b080`, frees the variant-pointer array, releases optional loaded image handle `[this+0x2a]` through `0x0053c000`, frees optional label string `[this+0x20]`, and then notifies the shell helper collection rooted at `[0x006d401c+0xc69]` with token `[this+0x36]`. Current direct callers are the rebuild wrapper thunk `0x0053ee60` and the support-side row release paths that destroy typed type-`6` payloads, so this is the safest current read for the image-marker payload destructor rather than a generic array free.","objdump + caller inspection + local disassembly + typed-payload correlation"
0x0053e370,2744,shell_image_marker_payload_construct_from_banked_record_key,shell,thiscall,inferred,objdump + caller inspection + local disassembly + rdata string decode,2,"Constructor for the same typed type-`6` image-marker payload used by the banked-record staging family. The helper seeds default dimension and scaling fields, opens one selected support-family record stream through `0x0053bd40/0x0053c9c0/0x0053b7c0`, tokenizes the record text through `0x0051d9d0`, parses the grounded keyword set (`Image`, `ImageWH`, `ImageWHForceScale`, `ImageWHWithRef`, `ImageScaled`, `ImageWHScaled`, `MaxPercentOfInterfaceVRAM`, `MaxPercentOfInterfaceVRAMToUse`, `Scaleable`, `TGATargetScreenHeight`, `TGATargetScreenWidth`, `TGAHeight`, `TGAWidth`, `TGAName`, `HorizontalScaleModifier`, `VerticalScaleModifier`), registers one shell helper token through `[0x006d401c+0xc69]`, derives local extent ratios `[this+0x2e/+0x32]`, and finally enters `0x0053de60` to build the live variant table. Current grounded constructor wrapper is `0x0053ee70`, and the typed acquire-or-create owner `0x0053c070` already binds payload type `6` to that wrapper, so this is the safest current read for the type-`6` banked-record payload constructor rather than a generic text parser.","objdump + caller inspection + local disassembly + rdata string decode + typed-payload correlation"
0x0053ee60,5,shell_image_marker_payload_release_thunk,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tail-call thunk into `shell_image_marker_payload_release_variant_table_image_handle_and_label` `0x0053e2e0`. Current grounded caller is the typed-row release family beneath `0x0053c000/0x0053c070`, so the safest current read is a narrow type-`6` payload release thunk rather than an independent owner.","objdump + caller inspection + local disassembly + typed-payload correlation"
0x0053ee70,17,shell_image_marker_payload_construct_wrapper,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Thin wrapper above `shell_image_marker_payload_construct_from_banked_record_key` `0x0053e370`. The helper forwards the caller record key into the heavier constructor and then returns `this` unchanged. Current grounded callers are the typed type-`6` staging-row acquire path at `0x0053c070` and the broader banked-record family, so this is the safest current read for the type-`6` payload constructor wrapper rather than another parser owner.","objdump + caller inspection + local disassembly + typed-payload correlation"
0x0053ee90,104,shell_load_named_or_fallback_ui_image_handle_into_global_slot_table_ccba60,shell,cdecl,inferred,objdump + local disassembly + import-shape correlation,1,"Small shell image-handle loader over the global slot table rooted at `0x00ccba60`. The helper formats one resource name from the string table rooted at `0x00625258` plus a caller-selected index and one of two templates at `0x005dd7f0/0x005dd80c`, forwards that string into the USER32 image-load import at `0x005c829c`, and on failure falls back to the stock-image import at `0x005c82a0` with id `0x7f00`. The resolved handle is then stored into slot `0x00ccba60 + (arg0*0x17 + arg1)*4`. Current evidence is strong enough for a named-or-fallback UI image-handle loader, but not yet for the exact player-facing slot family.","objdump + local disassembly + import-shape correlation + global-slot-table correlation"
0x0053b010,11,bootstrap_mark_runtime_started,bootstrap,cdecl,inferred,ghidra-headless,2,Single-purpose bootstrap helper that flips a process-global started flag to one before branding and shell setup continue.,ghidra + rizin
0x0054e6d0,42,bootstrap_capture_keyboard_state,bootstrap,cdecl,inferred,ghidra-headless,4,Single-purpose bootstrap probe that snapshots the host keyboard state through GetKeyboardState.,ghidra + rizin
0x00540a47,75,shell_control_refresh_matching_dynamic_text_payload,shell,unknown,inferred,objdump + caller inspection,3,"Small shell-control helper used on one matching control descriptor during refresh or replacement. When the incoming control id matches `[control+0x4]`, the helper frees any prior heap-backed text payload at `[control+0xce]`, clears that field, optionally copies a replacement payload from the caller descriptor through `0x0051d820`, and then returns `0` when the incoming control type is `0x6f` or `1` otherwise. Current grounded importance is the `CompanyDetail.win` section-0 overview widget `0x947f`: together with the sibling helper at `0x005639d2`, this makes type `0x6f` look like a special heap-backed dynamic-text control rather than an ordinary callback widget.","objdump + caller inspection + type-0x6f control correlation"
0x005639d2,22,shell_control_release_dynamic_text_payload,shell,unknown,inferred,objdump + caller inspection,3,"Tiny shell-control release helper that clears one control's attached payload through `0x0051d820` and then returns `0` when the control type at `[this+0x0]` is `0x6f` or `1` otherwise. Current grounded importance is the same CompanyDetail section-0 overview lane around control `0x947f`, where this reinforces that type `0x6f` is treated as a special dynamic-text family with its own release path instead of a normal callback-style widget.","objdump + caller inspection + type-0x6f control correlation"
0x0055da40,424,bootstrap_probe_system_profile,bootstrap,cdecl,inferred,ghidra-headless,4,Collects GlobalMemoryStatus and CPUID feature bits then stores coarse machine capability flags used by later bootstrap decisions.,ghidra + rizin
0x00507980,59,station_place_selection_id_is_special_negative_tool_item,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,2,"Tiny StationPlace selection-id predicate. The helper returns `1` only for the negative sentinel ids `-11..-17` and `-20..-22`, and `0` for every other id. Current grounded callers are the later StationPlace preview and selection branches at `0x00508c24`, `0x00508e07`, and `0x005094a1`, where it distinguishes special tool-local pseudo-items from ordinary live placement ids before helper-handle or preview follow-ons run.","objdump + caller xrefs + local disassembly + StationPlace sentinel-id correlation"
0x005079c0,138,station_place_window_release_cached_selection_handles_and_world_followons,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small StationPlace.win cleanup helper over the live tool object at `0x006d1720`. The helper first re-enters `0x00453510` on the live world root `0x0062c120` and `0x00413620` on the placed-structure owner `0x0062b26c`, then releases up to four cached selection or helper handles stored at `[this+0x7c]`, `[+0x80]`, `[+0x88]`, and `[+0x84]` through the matching global owners `0x0062b26c`, `0x006ada80`, `0x006cea50`, and `0x0062bae0`, writing `-1` back into each slot after release. Current grounded callers are the thin wrapper `0x00507a50` plus direct StationPlace branches at `0x00507b59` and `0x00509289`, so this is the safest current read for the cached selection-handle release helper beneath the StationPlace tool family rather than a generic shell window destroy stub.","objdump + caller xrefs + local disassembly + handle-release correlation"
0x00507a50,5,station_place_window_release_cached_selection_handles_and_world_followons_thunk,shell,thiscall,inferred,objdump + caller xrefs + wrapper inspection,2,"Tiny tail-jump wrapper over `station_place_window_release_cached_selection_handles_and_world_followons` `0x005079c0`. Current grounded callers are the higher save-load wrapper `0x004423a0` and the direct StationPlace cleanup branch at `0x00444e4a`, which makes this the light entry used when the broader StationPlace family only needs the cached-handle release path.","objdump + caller xrefs + wrapper inspection + StationPlace-family correlation"
0x00507a90,187,station_place_rotation_circle_callback_publish_current_heading_widget,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"StationPlace callback for the dedicated rotation-circle control `0x6987`. The helper reads the current StationPlace angle at `0x006d172c`, subtracts the active world-view angle from `[0x0062be68+0x10]`, normalizes the result through `0x005a1390`, pushes one formatted heading value plus the fixed circle-widget tuning constants into the helper object at `0x006d1724`, and then dispatches through `0x00552900`. Current grounded caller is the StationPlace constructor branch at `0x00509df6`, where this callback is wired directly onto control `0x6987`, so this is the safest current read for the rotation-circle publish path rather than a generic angle formatter.","objdump + caller xrefs + local disassembly + StationPlace control-0x6987 correlation"
0x00507b50,49,station_place_window_destruct_release_helpers_and_clear_singleton,shell,thiscall,inferred,objdump + vtable scan + local disassembly,2,"Primary StationPlace.win destructor. The helper restores vtable `0x005d17c0`, re-enters `station_place_window_release_cached_selection_handles_and_world_followons` `0x005079c0`, releases the helper handle at `0x006d1724` through the shared owner `0x006d4020 -> 0x0053c000`, clears singleton `0x006d1720`, and then tail-jumps into the common shell-window teardown at `0x0053f7d0`. Current evidence comes from the StationPlace vtable and constructor pair, so this is the safest current read for the concrete window destructor rather than another cleanup wrapper.","objdump + vtable scan + local disassembly + StationPlace destructor correlation"
0x00507b90,346,station_place_refresh_category_controls,shell,cdecl,inferred,objdump + strings + RT3.lng,4,"Refreshes the StationPlace.win category and mode controls for the current placement mode stored at 0x00622af4. The helper now grounds the six top-level category buttons rooted at 0x697c through 0x6981 as `Place a small station` 2197, `Place a medium station` 2198, `Place a large station` 2199, `Place a service tower` 2200, `Place a maintenance facility` 2201, and `Place a non-station building` 2202. It also refreshes the dependent controls around 0x69c8 0x69c9 0x6985 0x6986 and 0x6983 through 0x00540120; current evidence now bounds 0x6985 and 0x6986 as a two-state station-rotation policy toggle keyed by 0x006d1728, where 0x6985 aligns with `When placing the building, it will rotate itself as needed to orient to track or avoid obstacles.` string 2207 and 0x6986 aligns with `When placing the building, it will strictly adhere to the rotation specified by the circle above.` string 2206. In non-station-building mode 5 it can also seed [this+0x8c] from the active StationPlace list control under 0x006d1720 before preview formatting continues.",objdump + strings + RT3.lng + caller xrefs + callsite inspection
0x00507cf0,135,station_place_set_rotation_and_refresh_live_selected_site_pose,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared StationPlace rotation setter over the live tool object. The helper writes the requested heading float into global `0x006d172c`, optionally mirrors that same heading into the auto-orientation seed `0x006d1730`, and then, when the current selected placed structure at `[this+0x7c]` is live, resolves its normalized anchor pair through `0x00455800/0x00455810`, applies the new heading through `0x00455750`, and republishes the refreshed pose through `placed_structure_set_world_coords_and_refresh_local_runtime_side_state` `0x0040eba0` plus the shared runtime-object cleanup tail `0x0052eb90`. Current grounded callers are the cursor-drag rotation helper `0x00507d80`, the discrete step helper `0x005086c0`, and the preview or commit follow-ons at `0x00508fff` and `0x00509050`, so this is the safest current owner for StationPlace heading writes plus live selected-site pose refresh.","objdump + caller xrefs + local disassembly + StationPlace rotation correlation + live-site refresh correlation"
0x00507d80,255,station_place_window_drag_rotate_selected_site_toward_world_cursor,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"StationPlace live drag-rotation helper for the current selected site. The function reads the current cursor or screen-derived pair from `0x006d4018+0xa94/+0xa98`, normalizes that pair through the local scale and wrap helpers `0x005a1270` and `0x005a1390`, derives one wrapped heading delta against the current world-view angle at `[0x0062be68+0x10]`, and then re-enters `station_place_set_rotation_and_refresh_live_selected_site_pose` `0x00507cf0` with mirror flag `1`. Current grounded callers are the direct StationPlace dispatcher branches at `0x005092f3` and `0x00509aa1`, which keeps this on the live station-rotation circle or drag-update side rather than a generic view-angle helper.","objdump + caller xrefs + local disassembly + StationPlace drag-rotation correlation"
0x00507e80,432,station_place_validate_current_selection_at_world_coords_and_optionally_format_status,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared StationPlace go-or-no-go validator beneath both preview and commit paths. The helper first rejects the empty-selection case `[this+0x7c] == -1`, then resolves the current placed structure and its candidate stem through `0x0040cec0`, collects the linked-site latch through vtable slot `+0x70` and `0x0040d1f0`, computes one projected placement record through `0x00455730` and `indexed_collection_resolve_live_entry_id_by_stem_string` `0x00416e20`, and validates that projected record at the caller-supplied world coordinates through `placed_structure_validate_projected_candidate_placement` `0x004197e0`. On failure it publishes red status through `0x0040cb10`; on partial or blocked follow-on conditions it can publish yellow status plus localized short strings `0x29b/0x29c`; and on success it publishes green status after checking linked-site or territory gating through `0x0040d360` and `0x00481500`. Current grounded callers are the StationPlace preview branch `0x0050906d` and the commit branch `0x00509648`, so this is the safest current read for the shared StationPlace validation-and-status gate rather than another placed-structure-private helper.","objdump + caller xrefs + local disassembly + StationPlace validation correlation + status-color correlation"
0x00508040,1116,station_place_window_try_auto_orient_candidate_to_covering_route_entry_and_validate_placement,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + StationPlace control correlation,3,"Searches for one auto-oriented StationPlace placement pose when the strict-rotation policy is off. The helper seeds the caller heading output from global angle `0x006d1730`, snapshots the staged world-space point, derives one candidate-class latch from the current selection record at `[this+0x8c]`, and then iterates up to three orientation-search modes. On each trial it computes one candidate heading and footprint-offset pose, re-enters `route_entry_collection_try_reuse_covering_entry_for_site_coords_and_heading` `0x00417b40` to see whether an already-covered route entry can support the staged point, and then validates the accepted candidate pose through `placed_structure_validate_projected_candidate_placement` `0x004197e0` before committing it to the caller outputs. The subtype-`1` station branch also probes the route-entry collection directly through `0x00494cb0`, while the later retry loop relaxes the angle and distance thresholds through the local trig and distance helpers before trying the next orientation mode. Current grounded callers are the StationPlace preview path `0x00508f81` and the commit path `0x00509635`, and the surrounding control semantics already tie those callers to the non-strict station-rotation options at controls `0x6985/0x6986`, so this is the safest current read for the StationPlace auto-orientation search owner rather than a generic route-entry chooser.","objdump + caller xrefs + local disassembly + StationPlace control correlation + route-entry reuse correlation + placement-validation correlation"
0x005084a0,174,station_place_quantize_preview_metric_scalar_by_profile_rule,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + caller correlation,2,"Small StationPlace preview-metric quantizer beneath control `0x6983`. The helper first checks the current build version through `0x00482e00`; when that version is below `0x67`, or when the linked profile dword `[profile+0x78c]` is zero, it returns literal `1.0`. Otherwise it scales the caller-supplied float, applies one of two piecewise rounded bands through `0x005a10d0`, and returns the quantized float in steps of either `0x186a0` or `0xc350` depending on the input range. Current grounded callers are `station_place_refresh_preview_metric_control_0x6983` `0x00508550` and the StationPlace commit-side preview or feedback branch `0x0050970c`, so this is the safest current read for the shared preview-metric quantizer rather than a generic math helper.","objdump + caller xrefs + local disassembly + caller correlation + StationPlace control-0x6983 correlation"
0x00508550,363,station_place_refresh_preview_metric_control_0x6983,shell,cdecl,inferred,objdump + strings + local disassembly + caller inspection,4,"Refreshes the remaining StationPlace preview metric field at control `0x6983` for the current selection. The helper validates `[this+0x8c]`, resolves the staged world-cell category through `world_query_float_coords_within_live_grid_bounds` `0x00414bd0` and `0x0044ad60`, reads the linked profile scalar at `[profile+0x22]` through `0x0062b268`, branches on candidate subtype byte `[candidate+0x32]` to choose issue slot `0x3b` or `0x3c`, folds the raw scalar through `scenario_state_compute_issue_opinion_multiplier` `0x00436590`, passes the scaled result through the version-gated quantizer `0x005084a0`, formats the localized metric string `0x29d`, and publishes the final text through `0x00540120` into control `0x6983`. Current grounded caller is the broader preview-panel owner `0x00508730`, so this is the safest current read for the StationPlace preview metric publisher rather than the selected-site summary formatter.","objdump + strings + local disassembly + caller inspection + StationPlace control-0x6983 correlation + issue-slot correlation"
0x005086c0,58,station_place_step_rotation_by_integer_notches,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,2,"Small StationPlace rotation-step helper. The function converts the caller-supplied integer notch count into a heading delta through the fixed scalar at `0x005d1810`, adds that delta to the current StationPlace angle at `0x006d172c`, and then re-enters `station_place_set_rotation_and_refresh_live_selected_site_pose` `0x00507cf0` with mirror flag `1`. Current grounded callers are the two neighboring shell-side StationPlace rotation-step branches at `0x00440c9f` and `0x00440d5f`, which keeps this on the discrete bracket-key or rotation-control side rather than a generic angle-scaling helper.","objdump + caller xrefs + local disassembly + StationPlace discrete-rotation correlation"
0x00508700,34,station_place_query_selected_site_linked_route_entry_id_or_minus1,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Tiny StationPlace helper that resolves the current selected placed structure at `[this+0x7c]` and returns its linked route-entry id from `[site+0x2a8]`, or `-1` when no live selected site exists or no linked route entry is attached. Current grounded caller is the later StationPlace post-create notification branch at `0x0050991e`, where that linked route-entry id is forwarded into the shared world-side notifier path.","objdump + caller xrefs + local disassembly + linked-route-entry correlation"
0x00508730,292,station_place_format_preview_panel,shell,cdecl,inferred,objdump + strings + local disassembly + caller inspection,4,"Refreshes the main StationPlace preview panel for the current selection id passed in `arg_4`. The helper stores that selection into `[this+0x8c]`, publishes one preview asset into control `0x6982`, refreshes the metric field at `0x6983` through `station_place_refresh_preview_metric_control_0x6983` `0x00508550`, and then publishes the paired description block into control `0x6984`. For negative synthetic selection ids it chooses one fallback preview asset and description token from the local `0x005d1818..0x005d1848` table; for live ids it resolves the placement record through `0x0062b2fc`, formats the asset name from the linked profile block at `0x0062b268+0x4f` through `0x005a19c4`, and formats the description through `0x00413bc0`. Current grounded callers are the category refresh owner `0x00508880` and the small singleton wrapper `0x00508860`, so this is the safest current owner for the StationPlace preview-art, metric, and description refresh strip.","objdump + strings + local disassembly + caller inspection + StationPlace preview-panel correlation"
0x00508860,21,station_place_format_preview_panel_if_live_singleton_and_valid_selection,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,2,"Tiny StationPlace singleton wrapper around `station_place_format_preview_panel` `0x00508730`. The helper ignores selection id `-1`, then checks singleton `0x006d1720` and forwards the caller-supplied selection id only when the StationPlace tool window is live. Current grounded callers are the two neighboring selection-refresh branches at `0x0050a44b` and `0x0050a462`, so this is the safest current read for the guarded preview-panel refresh entry rather than a standalone formatter.","objdump + caller xrefs + local disassembly + StationPlace singleton-wrapper correlation"
0x00508880,727,station_place_select_category_and_refresh,shell,cdecl,inferred,objdump + strings + RT3.lng,4,"Primary StationPlace.win category and selection refresh helper. It stores the requested placement mode at 0x00622af4, where current grounded evidence now maps 0..5 to small station, medium station, large station, service tower, maintenance facility, and non-station building. For the three station modes it also enables the secondary style strip rooted at 0x6988 0x6989 and 0x698c, where 0x6988 and 0x6989 cycle the current building style and 0x698c displays the active style token built from `StationSml` `StationMed` or `StationLrg` plus one of the six localized architecture styles `Victorian` 2672 `Tudor` 2671 `Southwest` 2670 `Persian` 2669 `Kyoto` 2668 and `Clapboard` 2667; the player-facing tooltip for that strip is `Scroll through building styles.` string 2203. The helper resolves the current selection through 0x00622af0 and 0x00622aec, repopulates the StationPlace list controls at 0x69df and 0x69e3, and then refreshes the preview and category panels through 0x00508730 and 0x00507b90.",objdump + strings + RT3.lng + caller xrefs + callsite inspection
0x00508bb0,510,station_place_world_surface_sync_and_dispatch,shell,thiscall,inferred,objdump + caller xrefs + strings,4,"Shared world-surface helper for the active StationPlace.win tool object. It accepts direct `0x07d6` control traffic from the window dispatcher or falls back to the same shell detail-panel surface looked up through `0x006d0818`, rechecks flag bit `0x4` on that control, performs world hit tests through `0x00448ac0`, stages world coordinates into `0x006d1738/0x006d173c`, refreshes the remaining preview metric field through `station_place_refresh_preview_metric_control_0x6983` `0x00508550`, and updates the live placement selection globals at `0x00622af0`, `0x00622aec`, and `0x006d1740` plus helper objects rooted at `[this+0x80]`, `[+0x84]`, and `[+0x88]`. This makes it the clearest StationPlace-side consumer of the shared main-world interaction surface rather than only a passive status refresh helper.","objdump + caller xrefs + strings + callsite inspection + StationPlace control-0x6983 correlation"
0x005091b0,967,station_place_window_handle_message,shell,thiscall,inferred,objdump + strings + RT3.lng,4,"Primary message dispatcher for the StationPlace.win tool object at 0x006d1720. It switches over the incoming shell message id then handles the StationPlace control family rooted at category ids 0x697c through 0x6981, now grounded as the player-facing small station, medium station, large station, service tower, maintenance facility, and non-station-building buttons from strings 2197 through 2202. It also handles the style-strip controls at 0x6988 and 0x6989, which cycle the current building-style override used by station categories, the dependent controls around 0x6985 and 0x6986, now bounded as the two station-rotation policy choices from strings 2207 and 2206, the dedicated station-rotation circle control 0x6987, the list controls 0x69df and 0x69e3, and the shared world-surface control 0x07d6. The handler routes category and selection changes through 0x00508880 and 0x00507b90, uses 0x00507d80 for the live station-rotation drag/update branch, and delegates the world-hit-test path through 0x00508bb0. That makes it the clearest grounded owner for StationPlace player-facing tool commands rather than only a constructor plus frame hook.",objdump + strings + RT3.lng + caller xrefs + callsite inspection
0x00509d80,1936,station_place_window_construct,shell,thiscall,inferred,objdump + strings + RT3.lng,4,"Constructs the StationPlace.win world-tool window object later published at 0x006d1720. The constructor seeds the vtable at 0x005d17c0 binds the StationPlace.imb helper asset and StationPlace.win resource through 0x0053d110 and 0x0053fa50 clears local selection and preview fields rooted at [this+0x7c] through [this+0x94], seeds the dedicated station-rotation circle control at 0x6987 through callback 0x00507a90, seeds the list controls 0x69df and 0x69e3, and stores the singleton plus helper handle globally at 0x006d1720 and 0x006d1724. Current evidence ties that 0x6987 branch to the player-facing `Click to rotate the building. You can also use bracket keys [ and ] to rotate buildings.` string 2208 rather than to the older `Building placement center` string 671; current recovered StationPlace code paths do not show a direct live lookup of string id 671 at all, which makes it look more like a stale or legacy label than a surviving control caption in the present window flow. The current grounded caller is the shell detail-panel constructor branch at 0x004dddc4.",objdump + strings + RT3.lng + caller xrefs + callsite inspection
0x004b81d0,336,shell_building_detail_window_construct_and_bind_core_rows,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `BuildingDetail.win` family rooted at singleton `0x006cfd04`. The constructor installs vtable `0x005d00dc`, binds the helper asset `StationIcons.imb` plus `BuildingDetail.win` through `0x0053d110` and `0x0053fa50`, seeds three shell presenter handles at `0x006cfcf8..0x006cfd00`, clears local bytes `0x006cfd08/0x006cfd09`, wires the paired core action controls `0xbd17` and `0xbd18`, binds the smaller summary callbacks `0xbd13` and `0xbd14`, conditionally binds the extra row trio `0xbd19..0xbd1b` when `[0x006d3c84] == 1`, and then refreshes the visible selection band through `0x004b71b0`. Current grounded caller is the detail-panel manager branch at `0x004dde67`, which keeps this on the shell building-detail side rather than the later standalone opener rooted at `0x004bc100`.","objdump + strings + detail-manager correlation + control-wiring correlation + singleton correlation"
0x004b84b0,55,shell_bulldoze_window_refresh_ordinal_strip,shell,thiscall,inferred,objdump + constructor correlation + message-owner inspection,4,"Small refresh helper for the shell-side `Bulldoze.win` family. The helper walks the seven ordinal controls `0xbf69..0xbf6f`, compares each row against the current selected ordinal stored at `[this+0x78]`, and republishes the row styling through `0x00540120` with the usual selected-vs-unselected style split `0x87/0x65`. Current grounded callers are the constructor `0x004b8720` and the message owner `0x004b84f0`, which keeps this on the shell bulldoze tool-window side rather than the deeper world bulldoze chooser.","objdump + constructor correlation + message-owner inspection + control-strip correlation"
0x004b84f0,560,shell_bulldoze_window_handle_message,shell,thiscall,inferred,objdump + constructor correlation + caller inspection,4,"Primary message dispatcher for the shell-side `Bulldoze.win` tool window. Under message `0xc8`, control ids `0xbf69..0xbf6f` update the current ordinal at `[this+0x78]` and global `0x00621cc4` through the local setter `0x004b8470`, then re-enter `shell_bulldoze_window_refresh_ordinal_strip` `0x004b84b0`. Control `0x07d6` arms or clears the world-surface latch `[this+0x7c]` after the standard hit-test gate `0x00448ac0`. While that latch is live, the helper re-samples world coordinates, tracks the last accepted pair in globals `0x00621ce4/0x00621ce8`, queries one local world score through `0x0044b160`, and then publishes one status line through `0x00538c70` on shell runtime `0x006d401c`. Current grounded callers or owners are the constructor `0x004b8720` and the live shell message loop, which keeps this on the bulldoze tool-window side of the shared `0x07d6` world-surface family rather than on a generic shell-detail row path.","objdump + constructor correlation + caller inspection + world-surface latch correlation + local-score query correlation"
0x004b8720,128,shell_bulldoze_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `Bulldoze.win` tool window. The constructor installs vtable `0x005d02b4`, seeds the current ordinal from `0x00621cc4`, formats the visible scalar caption from `0x00621cc8` through `0x0051f070` and `0x00527de0`, binds `Bulldoze.win` through `0x0053fa50`, clears local field `[this+0x7c]`, refreshes the visible selection rows through `0x004b84b0`, and then re-enters `0x00523e10` on the shell presenter. Current grounded caller is the detail-panel manager branch at `0x004ddef0`, which keeps this on the shell tool-window side above the broader world-side bulldoze chooser `0x0044b160`.","objdump + strings + detail-manager correlation + scalar-caption correlation + singleton correlation"
0x004bcb50,160,shell_change_height_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `ChangeHeight.win` tool window. The constructor installs vtable `0x005d0690`, seeds the current ordinal from `0x00621e20`, formats the visible scalar caption from `0x00621e24`, binds `ChangeHeight.win` through `0x0053fa50`, stores live singleton `0x006cfe18`, refreshes the visible selection and mode rows through `0x004bc290`, and then triggers one world-side follow-on through `0x00452ca0` with mode id `6`. Current grounded caller is the detail-panel manager branch at `0x004ddf13`, which keeps this on the shell terrain-edit tool side rather than the generic world-surface brush owner itself.","objdump + strings + detail-manager correlation + singleton correlation + control-refresh correlation"
0x0050a530,64,station_place_window_service_frame,shell,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Recurring StationPlace.win service pass for the live station-placement tool object at `0x006d1720`. The helper checks the local latch at `[this+0x94]` plus current shell or world selection state and then delegates one branch into `station_place_world_surface_sync_and_dispatch` `0x00508bb0` for follow-up station-placement synchronization on the same shared `0x07d6` main-world surface used by the dispatcher when the surrounding world tool remains active. Current grounded callers are the higher restore wrapper `0x004423d0` plus the direct save-load tails at `0x00444eda` and `0x00445a64`, which keeps this on the recurring StationPlace tool-service side rather than a one-off constructor epilogue.","objdump + caller xrefs + callsite inspection + world-surface correlation"
0x0050dab0,84,track_lay_window_refresh_active_route_entry_linked_peer_and_publish_runtime_followon,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Small TrackLay-side helper under the active route-owner path. When global route latch `[0x006cfca8+0x118]` is nonzero and route id `[+0x125]` still resolves, the helper resolves that live route entry through `0x00518140`, re-enters `0x0049afe0` on the route owner with the resolved entry, re-enters `0x0048b660` on the same entry, and then tail-jumps into `0x0049b070` on the route owner. Current grounded callers are the broader TrackLay helpers `0x0050dc80`, `0x0050dce0`, and `0x0050e070` plus several later TrackLay message branches, so this is the safest current read for the small active-route refresh and publish companion rather than a generic route-entry accessor.","objdump + caller xrefs + local disassembly + route-entry correlation + TrackLay-family correlation"
0x0050d1e0,237,track_lay_window_release_invalid_route_entries_reset_cached_selection_and_refresh_presenter,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared TrackLay.win cleanup tail over the live tool object at `0x006d1a8c`. The helper first re-enters `0x0049ad90` and `0x00495540` on the global route owner `0x006cfca8`, then branches on route latch `[route+0x118]`. When that latch is clear it validates the cached tool route id `[this+0x78]` through `0x00518140` and candidate byte `[entry+0x216]`, releasing the cached id from the route owner when the entry is no longer admitted. When the latch is set it instead walks every live route entry, removing entries whose byte `[entry+0x216]` is clear through `0x0049bbb0`. In either case it resets `[this+0x78]` to `-1`, refreshes the active shell presenter through `0x0051f070`, and conditionally tail-jumps into `0x00523e20` on presenter slot `[presenter+0x3741]`. Current grounded callers are the TrackLay entry-side helper `0x0050e070` plus direct TrackLay branches at `0x0050db19` and `0x0050ebab`, so this is the safest current read for the shared invalid-route cleanup and presenter-refresh tail rather than a generic route-store sweep.","objdump + caller xrefs + local disassembly + route-cleanup correlation + presenter-refresh correlation"
0x0050d2d0,1245,track_lay_window_refresh_controls,shell,thiscall,inferred,objdump + strings + RT3.lng,4,"Refreshes the visible TrackLay.win control state after mode or preference changes. The helper highlights the three mutually exclusive primary mode buttons rooted at control ids 0x985e 0x985f and 0x9860 from the shared track-lay mode field at 0x00622b0c; current primary evidence now strongly aligns those grounded values as 1=`Lay single track.` string id 2054 4=`Lay double track.` string id 2055 and 0x40=`Bulldoze` string id 1721. The same refresh pass also updates the bridge-type selector family rooted at 0x006cec74+0x138 through controls 0x9861 and above; formats the two wrapped frequency values at 0x006cec74+0x140 and 0x006cec74+0x13c into controls 0x9870 and 0x9871 using the localized `Never` through `Common` string ids 615 through 618; and updates the two boolean preference toggles rooted at 0x006cec74+0x144 and 0x006cec78+0x4c74 through controls 0x986e and 0x986d. Current evidence now strongly aligns that pairing as 0x986e or 0x006cec74+0x144 = `Auto-Hide Trees During Track Lay` strings 1838 and 1839 and 0x986d or 0x006cec78+0x4c74 = `Auto-Show Grade During Track Lay` strings 3904 and 3905: the first toggle lives in the compact track-lay preference block alongside bridge and frequency settings while the second lives in the broader display-runtime block and fits the grade-overlay behavior. The same refresh path also updates the electrify-all action control at 0x9873 and the surrounding status widgets, which makes it the clearest grounded owner for the TrackLay.win status panel rather than only a generic shell redraw.",objdump + strings + RT3.lng + callsite inspection
0x0050dc00,113,track_lay_window_refresh_version_gated_action_rows_then_reenter_main_refresh,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + strings,3,"Small TrackLay.win control helper over the live tool object at `0x006d1a8c`. The helper first uses the local executable-version gate from `[0x006cec78+0x0d]` to restyle the three action rows `0x986a..0x986c` through `0x00540120`, then applies the same version-gated style split to control `0x9872`, and finally tail-jumps back into `track_lay_window_refresh_controls` `0x0050d2d0`. Current grounded caller is the TrackLay constructor `0x0050e528`, so this is the safest current read for the small version-gated action-row refresh helper rather than another generic shell row styler.","objdump + caller xrefs + local disassembly + version-gate correlation + control-row correlation"
0x0050dc80,87,track_lay_window_refresh_or_clear_active_route_latch,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small TrackLay.win route-latch helper beneath the broader message owner. The helper checks whether the live route owner `0x006cfca8` still has active latch `[route+0x118]`. When that latch is set it refreshes tool-local state through `0x0050dab0`; if local byte `[this+0x82]` is clear it tail-jumps into `0x004a00b0`, otherwise it clears `[this+0x82]`, resets `[route+0x118]` to zero, and posts the fixed shell payload through `0x0053ef90`. Current grounded callers are the TrackLay message owner `0x0050e5c0` and one neighboring helper at `0x0050f4c4`, so this is the safest current read for the active route-latch refresh or clear branch rather than a generic route-entry query.","objdump + caller xrefs + local disassembly + route-latch correlation"
0x0050dce0,912,track_lay_window_sync_world_surface_hit_or_active_route_selection_into_route_owner,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + callsite-arg inspection,3,"Broad TrackLay.win world-surface and route-selection sync owner. The helper first validates the current world or route context through `0x004337a0` plus collection `0x0062be10`, releases any prior cached tool route id `[this+0x78]`, and then branches on the two caller-supplied flags. On the world-hit-test path it re-enters `0x00448ac0` to resolve current world coordinates, seeds or updates a route entry in the global route owner `0x006cfca8` through `0x00493600`, `0x0049ace0`, and several route-classification helpers, mirrors the chosen entry id back into `[this+0x78]` and class byte `[entry+0x216]` into `[this+0x7c]`, updates route-owner byte `[route+0x11c]`, and publishes the chosen entry through `0x0049b180`. On the active-route branch it can refresh or recreate route-owner field `[route+0x125]` through `0x004955b0` and `0x00493cf0`, then re-enter the later route-update helper `0x004a04c0`. On the cleanup side it posts the fixed shell payload through `0x0053ef90`, can clear route latch `[route+0x118]`, can delete route ids `[route+0x125]` and `[route+0x129]` through `0x0049bbb0`, and can set local byte `[this+0x82]` for a later clear pass. Current grounded callers are the recurring TrackLay service-frame path `0x0050e3ed` and the TrackLay message owner branch `0x0050e8a2`, so this is the safest current read for the shared TrackLay world-surface or active-route synchronization owner rather than a narrow hit-test helper.","objdump + caller xrefs + local disassembly + callsite-arg inspection + route-owner correlation + world-surface correlation"
0x0050e070,358,track_lay_window_push_reentry_guard_snapshot_world_route_state_and_refresh_tool_state,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + strings,3,"Entry-side TrackLay.win helper over the live tool object at `0x006d1a8c`. The helper increments the local nested-service guard at `[this+0x87]` and only runs the heavier body on the outermost entry. In bulldoze mode `0x40` it immediately tail-jumps into `0x004361d0`; otherwise it snapshots several live route-entry fields from the global route owner `0x006cfca8` into tool slots `[this+0x9b..+0xaf]`, clears or advances the matching world-side route-anchor fields at `[route+0x88/+0x90/+0x94/+0x98]`, re-enters `0x0050dab0` to refresh the tool-local state, mirrors later route fields `[route+0x118/+0x125/+0x11d/+0x121]` into `[this+0x8b..+0x97]`, and then tail-jumps into `0x0050d1e0`. Current grounded callers are the save-load wrapper `0x004423a0` and the direct save path at `0x00444e3b`, so this is the safest current read for the TrackLay entry-side nested-service snapshot and route-state handoff rather than the recurring per-frame service pass.","objdump + caller xrefs + local disassembly + route-owner correlation + nested-service correlation"
0x0050e1e0,534,track_lay_window_service_frame,shell,thiscall,inferred,objdump + caller xrefs + strings,4,"Recurring TrackLay.win service pass for the active track-lay tool object at `0x006d1a8c`. The helper decrements the local reentry guard at `[this+0x87]` and when the pass is active it either routes the current track-lay drag state through `0x0050d740` while the grounded `Bulldoze` mode value `0x40` is live in `0x00622b0c` or synchronizes the staged world-interaction state back into the live world owner through `0x006cfca8` and `0x0050dce0`. The same service family also special-cases control id `0x07d6` through the tool-owned current-control field `[this+0x7e]`, which now strongly suggests that `0x07d6` is the shared main-world interaction surface for TrackLay.win rather than a generic shell-detail button. Current grounded callers are the higher restore wrapper `0x004423d0` plus the direct save-load tails at `0x00444ee9` and `0x00445a73`; the paired entry-side helper is `track_lay_window_push_reentry_guard_snapshot_world_route_state_and_refresh_tool_state` `0x0050e070`.","objdump + caller xrefs + strings + callsite inspection + nested-service correlation"
0x0050db10,236,track_lay_window_destroy_release_routes_reset_singleton_and_tail_shell_teardown,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + teardown correlation,3,"Destructor-side TrackLay.win teardown helper. The function restores vtable `0x005d191c`, re-enters `track_lay_window_release_invalid_route_entries_reset_cached_selection_and_refresh_presenter` `0x0050d1e0`, runs the route-owner post-change sweep `0x004a3db0`, clears the global singleton `0x006d1a8c`, posts the fixed shell payload rooted at `0x005c87a8` through `0x0053ef90`, conditionally mirrors one world scalar from `[world+0x1689]` into `[world+0x168d]` when `[0x006cec74+0x263]` is set and `0x006d1a94` is still clear, replays `0x00453510` on live world mode `0x15` when the `0x006cec74+0x2cc` gate and `0x00450150` allow it, tail-jumps into `0x004361d0` on the startup object, clears `[this+0x83]`, conditionally re-enters `0x00491880` on the route owner, optionally posts shell status id `0xba` through `0x00538e00`, and finally tail-jumps into `0x0053f7d0`. Current grounded caller is the shell detail-panel transition manager `0x004ddbd0`, so this is the safest current read for the TrackLay.win destroy path rather than another internal route-store helper.","objdump + caller xrefs + local disassembly + teardown correlation + route-owner correlation + shell-status correlation"
0x0050e400,448,track_lay_window_construct,shell,thiscall,inferred,objdump + caller xrefs + strings,4,Constructs the TrackLay.win world-tool window object later published at 0x006d1a8c. The constructor seeds the vtable at 0x005d191c clears the tool-state fields rooted at [this+0x78] [this+0x7d] [this+0x82] and [this+0x87] binds the TrackLay.win resource through 0x0053fa50 refreshes the visible control set through 0x0050dc00 snapshots one world span from 0x0062c120 into 0x006d1a94 and stores the singleton globally before returning. The current grounded caller is the shell detail-panel constructor branch at 0x004ddecd.,objdump + caller xrefs + strings + callsite inspection
0x0050e5c0,3867,track_lay_window_handle_message,shell,thiscall,inferred,objdump + strings + RT3.lng,4,"Primary message dispatcher for the TrackLay.win tool object at 0x006d1a8c. It switches over the incoming shell message id then handles control ids in the TrackLay.win family such as 0x9858 through 0x9874 plus the special world-surface control 0x07d6. The handler uses world hit tests through 0x00448ac0 to arm and release the drag latch at [this+0x7d] on 0x07d6 transitions, routes the active mode through the shared track-lay state at 0x00622b0c including the now-bounded primary values 1=`Lay single track.` 4=`Lay double track.` and 0x40=`Bulldoze`, updates the selected world object path rooted at 0x006cfca8+0x118, and refreshes the tool UI through 0x0050d2d0 0x0050d740 and 0x0050dce0. The same dispatcher also owns the TrackLay.win preference and action controls: it toggles the two boolean track-lay options rooted at 0x006cec74+0x144 and 0x006cec78+0x4c74, where current evidence now strongly aligns the first control branch at 0x985a with `Auto-Hide Trees During Track Lay` and the later `0x006cec78+0x4c74` branch with `Auto-Show Grade During Track Lay`; it also cycles the bridge-type selector family at 0x006cec74+0x138, wraps the two frequency settings at 0x006cec74+0x140 and 0x006cec74+0x13c, and routes the electrify-all command through the localized confirmation and failure strings 3083 3084 3837 and 3900. This makes it the clearest grounded owner for player-facing TrackLay.win commands rather than only a passive status panel.",objdump + strings + RT3.lng + callsite inspection
0x0051d900,155,string_find_substring_ex,support,cdecl,inferred,ghidra-headless,3,Reusable substring finder that returns a pointer to the first matching window in the haystack or null. It precomputes both string lengths then slides across the haystack calling one of two compare helpers depending on the mode flag pushed on the stack; the graphics branch uses it to probe adapter strings for legacy GPU-profile tokens and bootstrap code uses it for startup media or compatibility string checks.,ghidra + rizin + llvm-objdump
0x0051d870,21,bootstrap_seed_tick_count,bootstrap,cdecl,inferred,ghidra-headless,4,Lazily snapshots GetTickCount into a bootstrap-global cache so later subsystems start from a nonzero host tick baseline.,ghidra + rizin
0x0051ea80,304,shell_controller_reset_core_state_fields_and_seed_small_defaults,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small shell-controller reset helper beneath global-controller install. The function clears the early controller pointer and scalar band at `[this+0x00..+0x1c]`, seeds several small mode and flag fields such as `[this+0x11421a] = 1`, `[this+0x11420e] = 0x5c`, `[this+0x114228] = 2`, `[this+0x114232] = 1`, `[this+0x114254] = 1`, and `[this+0x114227] = 0x11`, and resets a broader set of small controller bytes and dwords under `[this+0x11422c..+0x11427e]` plus `[this+0x1136a9/+0x1136ad]`. Current grounded caller is `shell_install_global_controller` `0x0051ff90`, so this is the safest current read for the controller's core small-field reset-plus-default seeding path rather than the larger display-runtime reset owner at `0x0051ebc0`.","objdump + caller inspection + local disassembly + field-reset correlation"
0x0051ebc0,731,shell_reset_display_runtime_defaults,shell,cdecl,inferred,ghidra-headless,3,Resets the global display runtime defaults rooted at 0x006d4024. It clears the large display-settings block under offsets 0x11468a and above seeds default resolution and capability flags from mode 0x006d4028 and reinitializes several shell display toggles before later preset application continues.,ghidra + rizin + llvm-objdump
0x0051eea0,128,shell_save_display_runtime_config,shell,cdecl,inferred,ghidra-headless,4,Writes the larger display-runtime blob to data\\configuration\\engine.cfg. It stores version key 0x41b serializes the 0x1e4-byte runtime block rooted at [this+0x11468a] and writes an additional 0x1ec-byte companion block before closing the file.,ghidra + rizin + llvm-objdump + strings
0x0051ef20,194,shell_load_display_runtime_config_or_init_defaults,shell,cdecl,inferred,ghidra-headless,4,Loads the larger display-runtime blob from data\\configuration\\engine.cfg. When the file is missing invalid or already superseded by mode state at 0x006d4028 it falls back to 0x0051ebc0 and 0x0051eea0; otherwise it validates key 0x41b restores the 0x1e4-byte and 0x1ec-byte blocks and clears one shell display flag when [this+0x11474a] is set.,ghidra + rizin + llvm-objdump + strings
0x0051eff0,8,shell_controller_store_pointer_field_0x0c,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Trivial field setter that stores the caller pointer argument into controller dword `[this+0x0c]` unchanged. Current grounded callers are the neighboring window-family branches at `0x0054bdf8` and `0x0054be8c`, which use it while installing or clearing one live controller-owned pointer during the `World` window setup path.","objdump + caller inspection + local disassembly + field-store correlation"
0x0051f000,101,shell_register_world_window_class_from_static_wndproc,shell,thiscall,inferred,objdump + local disassembly + string correlation + import-shape correlation,3,"Small shell-side window-class registration helper. The function builds one local `WNDCLASS`-style descriptor with style `3`, class name `World`, static window procedure `0x0054e3a0`, and one stock brush handle derived from argument `0x7f00`, then forwards the descriptor into the USER32 class-registration import and returns the resulting class atom as a zero-extended `u16`. The grounded class-name string `World` and the static wndproc make this the safest current read for the shared world-window class registration helper rather than a generic USER32 wrapper.","objdump + local disassembly + string correlation + import-shape correlation + wndproc correlation"
0x0051f070,4,shell_controller_get_primary_presentation_owner,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Returns controller dword `[this+0x18]` unchanged. Current grounded callers include `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`, several shell caption-formatting branches, and broader presentation helpers, so the safest current read is the controller's primary presentation-owner accessor rather than a raw anonymous field load.","objdump + caller inspection + local disassembly + presentation-owner correlation"
0x0051f080,8,shell_controller_set_primary_presentation_owner,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Stores one caller pointer into controller dword `[this+0x18]` unchanged. Current grounded caller is the shell-side initialization path at `0x0055e3c9`, which seeds the same presentation-owner lane later queried by `0x0051f070`.","objdump + caller inspection + local disassembly + presentation-owner correlation"
0x0051f090,4,shell_controller_get_world_basis_owner,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Returns controller dword `[this+0x1c]` unchanged. Current grounded callers immediately feed the result into world-basis or view-space helpers such as `0x00534490`, `0x00534c50`, `0x00534910`, and `0x00534930`, so the safest current read is the controller's world-basis owner accessor rather than a raw anonymous field load.","objdump + caller inspection + local disassembly + world-basis correlation"
0x0051f0a0,8,shell_controller_set_world_basis_owner,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Stores one caller pointer into controller dword `[this+0x1c]` unchanged. Current grounded callers include the world-view setup branches around `0x00537e56` and `0x00537eda`, which seed or clear the same owner later queried through `0x0051f090`.","objdump + caller inspection + local disassembly + world-basis correlation"
0x0051f0b0,4,shell_controller_get_cursor_service_active_flag,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Returns controller dword `[this+0x20]` unchanged. Current grounded caller is `shell_mouse_cursor_adjust_showcursor_refcount_and_sync_screen_position_if_live` `0x0051e810`, which uses this value as the gate for the live cursor-position sync branch.","objdump + caller inspection + local disassembly + mouse-cursor correlation"
0x0051f0c0,8,shell_controller_mark_input_subobject_index_present,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small shell-input helper that resolves controller subobject `[this+0x24]` and forwards one caller byte index into the byte-table writer at `0x00564180`, which stores value `1` at `[subobject + index]`. Current grounded caller is the main shell window-message dispatcher `0x0054e3a0` on the `WM_KEYDOWN` branch.","objdump + caller inspection + local disassembly + window-message correlation"
0x0051f0d0,8,shell_controller_mark_input_subobject_index_absent,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small shell-input helper that resolves controller subobject `[this+0x24]` and forwards one caller byte index into the byte-table writer at `0x00564190`, which stores value `0` at `[subobject + index]`. Current grounded caller is the main shell window-message dispatcher `0x0054e3a0` on the `WM_KEYUP` branch.","objdump + caller inspection + local disassembly + window-message correlation"
0x0051f0e0,8,shell_controller_query_input_subobject_index_flag,shell,thiscall,inferred,objdump + local disassembly + helper correlation,2,"Small shell-input helper that resolves controller subobject `[this+0x24]` and forwards one caller byte index into the byte-table reader at `0x005641a0`, returning the current byte flag at `[subobject + index]`. This is the query-side sibling of `0x0051f0c0` and `0x0051f0d0`.","objdump + local disassembly + helper correlation + byte-table correlation"
0x0051f0f0,3,shell_controller_get_window_handle,shell,thiscall,inferred,objdump + import-table,4,Returns the native shell window handle stored at [this+0x00]. Callers forward the returned handle into USER32 imports such as SetFocus SetMenu and SetCapture during shell startup and presentation interaction.,objdump + USER32 import table + callsite xrefs
0x0051f100,143,shell_controller_copy_active_display_mode_tuple,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Copies the active display-mode tuple from the controller mode table rooted at `[this+0x34]` using live selector `[this+0x11421e]`. The helper always writes the first two dwords from offsets `+0x00` and `+0x04`, optionally copies dword `+0x08`, conditionally returns either `0` or dword `+0x0c` depending on graphics-range scalar `[this+0x11470e]`, and optionally copies trailing byte `+0x14` as a zero-extended dword. Current grounded callers include the graphics-range predicates `0x0051fd00/0x00520fd0`, the mouse-cursor sync helper `0x0051e810`, and the window-class or view-side coordinate helpers, so this is the safest current read for the active display-mode tuple materializer rather than another opaque table accessor.","objdump + caller inspection + local disassembly + display-mode-table correlation + graphics-range correlation"
0x0051f1a0,7,shell_controller_get_graphics_mode_byte,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Returns graphics-mode byte `[this+0x114226]` as a zero-extended integer. Current grounded callers include the graphics settings page, the mouse-cursor family, the shell input window-message family, and several world-presentation gates, so this is the safest current read for the controller's current graphics-mode-byte accessor.","objdump + caller inspection + local disassembly + graphics-mode correlation"
0x0051f1b0,7,shell_controller_get_display_runtime_dword_1146f6,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Returns display-runtime dword `[this+0x1146f6]` unchanged. Current grounded caller is the shell-side initialization path at `0x0055e3ed`, which snapshots the field into a local runtime record.","objdump + caller inspection + local disassembly + field-correlation"
0x0051f1c0,8,shell_controller_set_display_runtime_dword_1146f6,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Stores one caller dword into display-runtime field `[this+0x1146f6]` unchanged. Current grounded callers include `0x00527cb4` and `0x0052c136`, which write new values back through the controller rather than touching the field directly.","objdump + caller inspection + local disassembly + field-correlation"
0x0051f1d0,90,shell_signal_deferred_work_item_shutdown,shell,thiscall,inferred,ghidra-headless,3,Walks the shell deferred-work item queue at [this+0x1136a5] and inspects each queued payload object's nested message queue at [item+0xe4]. When intrusive_queue_peek_tail_payload finds a nonnull tail payload it clears the outer queued-handle slot at [item+0xe8] and appends a null sentinel into the nested queue through intrusive_queue_push_back before continuing iteration.,ghidra + rizin + llvm-objdump
0x0051f230,128,shell_enqueue_deferred_work_message,shell,thiscall,inferred,ghidra-headless,4,Routes one deferred-work message through the shell queue system. When the global routing gate at 0x006d4034 and shell flag [this+0x11369c] are both set it feeds the special queue at [this+0x11369d]; otherwise a nonnull payload object is queued once in [this+0x1136a5] with the returned queue-node handle cached at [item+0xe8] and the message is appended to the payload-owned nested queue at [item+0xe4] while a null payload appends directly into the fallback queue at [this+0x1136a1].,ghidra + rizin + llvm-objdump
0x0051f2b0,104,shell_post_deferred_message_type5,shell,thiscall,inferred,ghidra-headless,4,Allocates one 0x5e-byte deferred-message record from the shell-owned slab rooted at [this+0x5c] using count [this+0x58] tags it as type 0x05 stores four caller dwords at offsets +0x01 +0x05 +0x09 and +0x0d and then posts the record directly into the shell deferred queue roots through [this+0x11369d] or [this+0x1136a1].,ghidra + rizin + llvm-objdump
0x0051f320,72,shell_post_deferred_message_type6,shell,thiscall,inferred,ghidra-headless,4,Allocates one 0x5e-byte deferred-message record from the same shell slab and tags it as type 0x06 before posting it directly into the shell deferred queue roots. This is the minimal direct-post sibling of the type-0x05 builder and uses the same count field at [this+0x58] and slab base at [this+0x5c].,ghidra + rizin + llvm-objdump
0x0051f370,229,shell_enqueue_deferred_message_type4,shell,thiscall,inferred,ghidra-headless,4,Allocates one 0x5e-byte deferred-message record from the shell-local slab at [this+0x5c] populates the larger multi-field payload tags it as type 0x04 mixes the shell byte [this+0x114227] into record byte +0x5d and routes the finished record through shell_enqueue_deferred_work_message.,ghidra + rizin + llvm-objdump
0x0051f460,173,shell_enqueue_deferred_message_type1,shell,thiscall,inferred,ghidra-headless,4,Allocates one 0x5e-byte deferred-message record from the same shell-local slab fills the smaller type-0x01 payload subset mixes the shell byte [this+0x114227] into record byte +0x5d and routes the finished record through shell_enqueue_deferred_work_message.,ghidra + rizin + llvm-objdump
0x0051f510,48,shell_set_gamma_ramp_scalar,shell,thiscall,inferred,ghidra-headless,4,Applies one shell gamma-ramp scalar to the active display runtime state. When the presentation service pointer at [this+0x0c] is live it forwards the scalar into 0x00547f20 for an immediate hardware upload; otherwise it only caches the requested value at [this+0x1146b9] until the service is ready.,ghidra + rizin + llvm-objdump
0x0051d890,13,shell_get_elapsed_tick_count_since_bootstrap_seed,shell,cdecl,inferred,objdump + timer-caller correlation,4,"Returns the current wall-clock tick count minus the bootstrap seed stored at `0x006d3d14`. The helper is a one-line elapsed-time primitive over the same USER32 tick import used by `bootstrap_seed_tick_count` `0x0051d870`. Current grounded callers include the timer-gated `SettingsWindow.win` graphics service strip around `0x004ffafb/0x004ffb64`, the world-view keyboard pan helper, and the frame-time history family.","objdump + timer-caller correlation + bootstrap-seed correlation"
0x0051fd00,64,shell_query_graphics_range_has_live_custom_payload,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Reports whether the graphics-range family currently has a live custom payload worth reapplying. The helper first rejects graphics mode byte `[this+0x114226] == 0`, then calls `0x0051f100` to materialize the current range tuple into five stack outputs and returns true only when the first returned dword is nonzero. Current grounded caller is `shell_settings_window_handle_graphics_range_custom_mode_toggle` `0x004ffd10`, which uses this predicate to decide whether the custom-mode toggle can proceed directly or must fall back to the warning path.","objdump + settings-window caller correlation + stack-output correlation"
0x0051fd40,29,shell_query_graphics_range_custom_mode_flag,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Returns one small custom-range mode flag for the graphics settings family. The helper reports true only when byte `[this+0x1146ae]` is set and dword `[this+0x11427a]` is still zero; otherwise it returns false. Current grounded caller is `shell_settings_window_refresh_graphics_page` `0x004fe770`, which uses this flag together with `shell_query_graphics_range_scalar` `0x0051fd60` to decide how controls `0x7555` and `0x7578` should be republished.","objdump + settings-window caller correlation + field-gate correlation"
0x0051fd60,7,shell_query_graphics_range_scalar,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Returns graphics-range scalar dword `[this+0x11470e]` unchanged. Current grounded caller is the graphics settings page refresh `0x004fe770`, which pairs this with `shell_query_graphics_range_custom_mode_flag` `0x0051fd40` when formatting controls `0x7555` and `0x7578`.","objdump + settings-window caller correlation"
0x0051fd70,516,shell_update_frame_time_history,shell,thiscall,inferred,ghidra-headless,4,Updates a 256-sample frame-time history from successive GetTickCount deltas. The helper advances the ring index in 0x006d403c stores each delta under [this+0x11428a] and derives a smoothed frame scalar at [this+0x114282] for later shell frame consumers such as 0x0051ff80 and the presentation-frame path.,ghidra + rizin + llvm-objdump
0x0051ff80,7,shell_get_smoothed_frame_scalar,shell,thiscall,inferred,objdump,4,Returns the smoothed frame scalar cached at [this+0x114282]. shell_update_frame_time_history refreshes that field each frame and shell_refresh_presentation_frame consumes it during the main presentation refresh path.,objdump + callsite xrefs
0x0051ff90,24,shell_install_global_controller,shell,thiscall,inferred,objdump + analysis-context,4,Installs one shell controller as the process-global singleton at 0x006d4024 clears controller flag [this+0x114201] reruns the local state reset helper at 0x0051ea80 and returns the same controller pointer. bootstrap_init_shell_window_services calls it immediately after allocating the 0x11486e-byte controller object.,objdump + analysis-context + startup xrefs
0x00520fd0,87,shell_set_graphics_range_custom_mode_flag_and_reapply_if_needed,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Applies a requested custom-mode flag for the graphics-range family. The helper compares the incoming boolean against `shell_query_graphics_range_custom_mode_flag` semantics over `[this+0x1146ae]` and `[this+0x11427a]`, stores the new byte at `[this+0x1146ae]` only when it changed, rejects the enabling path when `shell_query_graphics_range_has_live_custom_payload` `0x0051fd00` is false, and when reapplication is allowed forwards the current graphics mode byte `[this+0x114226]` plus the live selector dword `[this+0x11421e]` into `0x00520400`. Current grounded caller is `shell_settings_window_handle_graphics_range_custom_mode_toggle` `0x004ffd10`.","objdump + settings-window caller correlation + graphics-range-reapply correlation"
0x00521030,45,shell_set_graphics_range_scalar_and_reapply_if_needed,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Stores one replacement graphics-range scalar dword at `[this+0x11470e]` and, when graphics mode byte `[this+0x114226]` is nonzero, immediately re-enters `0x00520400` with the live selector dword `[this+0x11421e]` plus the current mode. Current grounded caller is `shell_settings_window_handle_graphics_range_scalar_zero_nonzero_toggle` `0x004ffe72`, which uses this helper to flip the scalar between zero and nonzero states.","objdump + settings-window caller correlation + graphics-range-reapply correlation"
0x00521d10,38,multiplayer_request_peer_session_control,shell,cdecl,inferred,ghidra-headless,3,Requests one direct session-control action for a resolved multiplayer peer object. When the live session transport at `0x006d40dc` is present it follows the transport-owned interface at `[ecx+0x18e]->+0x08` and invokes vtable slot `+0x68` with the target peer object and three zero trailing arguments; the current grounded callers are the `\\kick` branch and the online-peer `\\unban` follow-up path.,ghidra + rizin + llvm-objdump
0x0051fa00,56,shell_get_memory_budget_ceiling_bytes,shell,thiscall,inferred,ghidra-headless,3,Returns the current upper memory-budget bucket in bytes for the shell display runtime. When override field [this+0x1146ca] is set it maps that tier through the shared table at 0x00624c34 containing 0 1MB 2MB and 4MB entries; otherwise it starts from baseline field [this+0x1136ad] and adjusts it by the active lower-tier delta derived from [this+0x1146c6] and [this+0x1136a9] before clamping negative results to zero.,ghidra + rizin + llvm-objdump
0x0051fa40,25,shell_get_memory_budget_floor_bytes,shell,thiscall,inferred,ghidra-headless,3,Returns the current lower memory-budget bucket in bytes for the shell display runtime. When field [this+0x1146c6] is nonzero it maps that tier through the shared 0 1MB 2MB 4MB table at 0x00624c34; otherwise it falls back to baseline field [this+0x1136a9].,ghidra + rizin + llvm-objdump
0x0051fa60,63,shell_get_nonnegative_memory_budget_floor_bytes,shell,thiscall,inferred,ghidra-headless,3,Returns a nonnegative lower memory-budget value for float consumers in the shell and presentation paths. It prefers explicit tier field [this+0x1146ce] then the active floor bucket behind [this+0x1146c6] and finally baseline field [this+0x1136a9] using the shared 0 1MB 2MB 4MB table at 0x00624c34 and clamping negative results to zero.,ghidra + rizin + llvm-objdump
0x005204b0,128,shell_flush_deferred_work_queues,shell,thiscall,inferred,ghidra-headless,4,Flushes the shell controller's three deferred-work queue roots at [this+0x1136a1] [this+0x11369d] and [this+0x1136a5]. The helper clears the first two containers through intrusive_queue_clear_and_release then rewinds the deferred-item queue through intrusive_queue_rewind_iterator repeatedly pops each queued payload through intrusive_queue_next_iterator_node clears its outer queued-handle slot at [item+0xe8] and finally releases the remaining queue storage before returning. It is used at the end of shell_service_frame_cycle and from the broader shell-mode helper at 0x00443a50.,ghidra + rizin + llvm-objdump
0x00520620,141,shell_service_frame_cycle,shell,thiscall,inferred,ghidra-headless,4,Acts as the outer owner for one pending shell frame cycle on the active controller. When pending-frame state is armed through [this+0x56] and controller pointers [this+0x18] [this+0x1c] and [this+0x28] are live it runs shell_refresh_presentation_frame through 0x0052b990; otherwise it still updates frame timing through 0x0051fd70 runs the mouse-cursor frame updater 0x0053f4e0 requests the deeper layout-state rebuild path through 0x00565110 performs a one-time ShowWindow on the controller window handle at [this] drains deferred work through 0x005204b0 and clears the pending flags at [this+0x56] and [this+0x58].,ghidra + rizin + llvm-objdump
0x00521060,805,bootstrap_init_shell_service_bundle,bootstrap,cdecl,inferred,ghidra-headless,4,Builds the shell-facing singleton bundle stored through globals like 0x006d4024 0x006d402c and 0x006d4030 wiring startup width and height state an rt3_ prefixed service path and the separate shell input-state object rooted at 0x006d4018.,ghidra + rizin + objdump
0x00521390,486,bootstrap_destroy_shell_service_bundle,bootstrap,cdecl,inferred,ghidra-headless,4,Destroys the shell service bundle created by 0x00521060 releasing each global singleton and clearing 0x006d4024 0x006d402c 0x006d4030 0x006d4020 and 0x006d4018.,ghidra + rizin
0x00523d90,65,shell_commit_layout_updates,bootstrap,thiscall,inferred,ghidra-headless,3,Applies pending layout-slot changes from the shell controller into its subordinate layout-state object at [this+0x2d] by walking embedded service pointers and issuing the follow-on rebuild or refresh calls that make the updated slot table live.,ghidra + rizin
0x00523e40,51,shell_invalidate_layout_state,bootstrap,thiscall,inferred,ghidra-headless,4,Marks the shell controller's layout-state path dirty by setting flags [this+0x3747] [this+0x3748] and [this+0x3749] then forwarding two state parameters into the subordinate object at [this+0x2d].,ghidra + rizin
0x005270d0,8,shell_mark_layout_dirty,bootstrap,thiscall,inferred,ghidra-headless,2,Marks the shell layout child dirty by setting byte flag [this+0x3749] before later code forces a commit pass.,ghidra + rizin
0x00527650,1476,shell_publish_texture_budget_report,shell,thiscall,inferred,ghidra-headless,4,Builds and publishes a shell-side texture budget report through the current layout state at [this+0x2d]. The routine formats the current memory-budget floor and ceiling buckets from 0x0051fa40 and 0x0051fa00 converts them to kilobytes adds the current texture-change counter through 0x0055d390 appends labels like Texture changes per frame Texture SRAM and Texture VRAM and forwards the assembled text into 0x00566980.,ghidra + rizin + llvm-objdump + strings
0x00527de0,46,shell_presenter_publish_scaled_scalar_caption_and_store_aux_weight,bootstrap,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Shared shell-presenter scalar-caption helper. The routine scales the caller float argument by `0x005dd158`, forwards that value through `0x0052ea90` on nested presenter field `[this+0x364d]`, scales a second incoming float by `0x005c8568`, and stores the result into `[this+0x3728]` as an auxiliary weight or caption-side scalar. Current grounded callers are several shell tool-window constructors and setters including `Bulldoze.win` `0x004b8720`, `ChangeTrees.win` `0x004bcdd0/0x004bcc20`, the world-surface brush ordinal setter `0x004bc210`, `PaintRegion.win` `0x004f5080`, `PaintSound.win` `0x004f55b0/0x004f5670`, `PaintTerrain.win` `0x004f5cf0`, `PaintTerritory.win` `0x004fcaf0`, and the ungrouped caller strips at `0x0050a430` and `0x0050d5d0`, so this is the current safest read for the shared shell scalar-caption publisher rather than a window-specific caption formatter.","objdump + caller correlation + local disassembly + shell-presenter correlation"
0x00527e10,868,shell_update_layout_tracking_sample,bootstrap,thiscall,inferred,ghidra-headless,4,Samples a tracked shell target from the object argument computes distance heading and orientation deltas against cached values at [this+0x36b8..0x36cc] consults the dirty flags and index helper at 0x00526590 and returns whether the controller should drive a fresh layout-state apply; on success it updates the cached sample fields and the global tick at 0x00cc3b4c.,ghidra + rizin
0x0052b990,4993,shell_refresh_presentation_frame,shell,thiscall,inferred,ghidra-headless,3,Main shell frame-style refresh pass for the active controller and layout-state path. It handles mode-sensitive layout-state rebuilds and dirties updates tracked shell samples through 0x00527e10 runs the nearby geographic-label static-cell animated-quad ranked-overlay and ranked-billboard sweeps applies presentation-node properties and cached vertex spans optionally publishes the texture budget report through 0x00527650 may request a deeper rebuild through 0x00565110 and can recurse once for a follow-up presentation pass before downstream timing or present helpers run.,ghidra + rizin + llvm-objdump
0x0052da00,102,vehicle_visual_register_attachment_object,bootstrap,thiscall,inferred,ghidra-headless,3,Registers one prebuilt attachment object on the owning vehicle visual. The helper lazily allocates a small attachment list at [this+0x81] pushes the object through 0x00556e10 copies the owner tint triple from [this+0x1e2] [this+0x1e6] and [this+0x1ea] into the object through 0x005545d0 and links the owner back through 0x005540a0.,ghidra + rizin + llvm-objdump
0x00529840,400,shell_build_static_cell_triangle_sweep,bootstrap,thiscall,inferred,ghidra-headless,4,Builds the fixed-cell triangle sweep over the grid returned by 0x00533cd0. It samples shell brightness to derive one grayscale packed color binds the layout-state vertex24 table once and then expands each accepted 0x24-byte cell record into six vertex24 records by emitting the same three-point face twice before committing the span and restoring presentation state.,ghidra + rizin + llvm-objdump
0x00529b50,1149,shell_build_geographic_label_vertex24_sweep,bootstrap,thiscall,inferred,ghidra-headless,4,Builds the geographic-label vertex24 sweep over the grid returned by 0x00533db0. It gates on config byte [this+0x29+0x63] primes one vertex24 span and text presentation state samples shell brightness and the 0x006d9098 priority map to derive per-item alpha rejects items through virtual check +0x0c emits per-item geographic-label frame geometry through 0x00539fb0 optionally emits geographic-label text through 0x0053a960 and commits buffered spans through the layout-state presentation helpers. The naming matches the dedicated geographic-label asset family backed by gpdLabelDB and 2DLabel.imb.,ghidra + rizin + llvm-objdump
0x00528d90,1824,shell_process_nearby_presentation_item,bootstrap,thiscall,inferred,ghidra-headless,3,Processes one candidate item for the nearby-presentation sweep. It rejects disabled entries and mode-mismatched flags optionally gates by forward-range tests around the caller origin lazily assigns the item's segment-record window from the layout-state tables stores accepted nearest-candidate distances in the side buffer at [this+0xa9] and [this+0xad] and forwards the item plus eligible child collections into the active presentation lists.,ghidra + rizin + llvm-objdump
0x005294b0,912,shell_update_nearby_presentation_sweep,bootstrap,thiscall,inferred,ghidra-headless,3,Performs the higher-level nearby-presentation sweep for the current shell state. It scans candidate cells from the offset table at [this+0x374f] using the priority map at 0x006d9098 enumerates item lists for each accepted cell normalizes the first accepted direction vector binds the segment-record presentation table through 0x0054bab0 calls 0x00528d90 for each candidate and then selects the nearest buffered item into [this+0x366e] before refreshing presentation batches through 0x00548da0.,ghidra + rizin + llvm-objdump
0x00529fd0,793,shell_build_cell_vertex24_sweep,bootstrap,thiscall,inferred,ghidra-headless,4,Builds the animated-quad cell sweep over the grid returned by 0x00533e30 depending on the boolean mode argument. It gates on configuration bytes [this+0x29+0x5f] or [this+0x29+0x60] walks candidate-cell offsets from [this+0x374f] selects the primary list at [cell+0x1c] or alternate list at [cell+0x20] initializes the layout-state vertex24 table once through 0x0054bb70 streams each list through 0x00567c70 or 0x00567ce0 and then commits the accumulated span through 0x00545c50 before restoring presentation state.,ghidra + rizin + llvm-objdump
0x0052a2f0,736,shell_build_ranked_overlay_vertex24_sweep,bootstrap,thiscall,inferred,ghidra-headless,3,Builds a ranked secondary vertex24 overlay pass over the cell grid returned by 0x00533e50 and two object collections at [this+0x85] and [this+0x81]. It computes a per-frame packed tint from the current shell brightness gathers and sorts candidate items by priority field [item+0x1d9] binds the layout-state vertex24 table and emits accepted items through 0x00524780 and 0x00554e70 before committing the span.,ghidra + rizin + llvm-objdump
0x0052a5d0,1784,shell_build_ranked_object_billboard_sweep,bootstrap,thiscall,inferred,ghidra-headless,3,Builds the sibling ranked object-overlay pass gated by config byte [this+0x29+0x5e]. It merges candidates from the object collections at [this+0x85] and [this+0x81] sorts them by priority field [item+0x1d9] prepares billboard basis state through 0x00566670 and emits accepted entries through 0x00554e70 before committing the vertex24 span.,ghidra + rizin + llvm-objdump
0x0052dd00,864,runtime_object_emit_materialized_group_packet_rows_as_segment_record_window,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared segment-record emitter beneath `runtime_object_emit_selected_grouped_subrecords_into_global_packet_ring` `0x0052f500` in the broader `0x23a` runtime-object family. Starting from the currently selected group header `[this+0x14/+0x3a/+0x21]`, the helper resolves the active materialized row payload at `[row+0x35]`, the current packet source span from `[record+0x04/+0x08/+0x0c]`, and one shell-presenter-derived count through `0x0051f090`, then emits `count*3` transformed `0x20`-byte segment records into the caller-provided buffer while advancing the output-count accumulator. In the nonnegative `[this+0x69]` branch each output record carries two vec3 blocks at `+0x00` and `+0x0c` plus scalar slots at `+0x18` and `+0x1c`; in the negative branch it emits the same triplet family with the reduced scalar form. Current grounded caller is the layout-state presentation owner `0x005490b0`, so this is the safest current read for emitting materialized group packet rows as one segment-record window rather than a shell-only batch expander.","objdump + caller inspection + local disassembly + grouped-subrecord correlation + packet-row correlation + segment-record-window correlation"
0x0053f000,238,mouse_cursor_select_shape_id_load_handle_and_refresh_shell_presentation,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Core `MouseCursor.cpp` selector over one requested cursor-shape id. The helper normalizes negative ids to zero, optionally short-circuits when the requested id already matches `[this+0x04]`, refreshes the local elapsed-tick latch `[this+0x24]` through `0x0051d890`, toggles cursor visibility through `0x0051e810` on the special `0 -> nonzero` and `nonzero -> 0` transitions, lazily loads the corresponding native cursor handle into table `0x00ccba60` through `0x0053ee90`, publishes that handle through the USER32 cursor-set import, resolves one shell presentation payload through `0x0053d110` when the requested id is nonzero, releases the previous payload through `0x0053c000`, and then stores the new payload at `[this+0x00]` plus the selected id at `[this+0x04]`. Current grounded callers include shell modal setup `0x004c98a0`, several detail-panel mode publishers, and the rest of the mouse-cursor owner family, so this is the safest current read for the live cursor-shape selector plus presentation refresh owner.","objdump + caller inspection + local disassembly + source-string correlation + cursor-handle-table correlation"
0x0053f0f0,115,mouse_cursor_enter_hidden_or_captured_mode_and_clear_selection,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Mode-transition branch in the `MouseCursor.cpp` owner family. When local state `[this+0x18]` is still clear, the helper first pings shell work owner `[0x006d4024+0x28]` through vtable slot `+0x1c`, then calls one zero-argument USER32 import, marks `[this+0x18] = 1`, clears `[this+0x14]`, seeds `[this+0x08] = 1`, mirrors shell latch `[0x006d4024+0x11473e] = 1`, and, when a non-`-1` cursor id is active, forces cursor visibility down through `0x0051e810(0)` before re-entering `0x0053f000(-1, 0, 0)`. Current grounded callers are the graphics-backend service branches `0x004ffb64`, the coarse mouse-cursor service `0x0053f400`, and the local constructor sync at `0x0053f330`, so the safest current read is a hidden-or-captured mode entry branch rather than a generic state toggle.","objdump + caller inspection + local disassembly + source-string correlation + shell-latch correlation"
0x0053f170,159,mouse_cursor_begin_pending_release_from_hidden_mode,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Release-side mode-transition branch in the `MouseCursor.cpp` owner family. When `[this+0x14]` is still clear, the helper conditionally forwards the shell window handle through one one-argument USER32 import when graphics mode byte `[0x006d4024+0x114226]` is active, pings shell work owner `[0x006d4024+0x28]` through vtable slot `+0x1c`, re-enters `0x0053f000(0, 0, 0)` to clear the live cursor selection, clears `[this+0x18]`, sets `[this+0x14] = 1`, zeroes shell latches `[0x006d4024+0x11473a/+0x11473e]`, and, when local byte-flag dword `[this+0x08]` is nonzero, raises cursor visibility back through `0x0051e810(1)`. Current grounded callers are the graphics-backend service-and-repaint branch `0x004ffafb`, the coarse mouse-cursor service `0x0053f400`, and the local inside-view watcher `0x0053f450`, so this is the safest current read for the begin-release transition out of the hidden mode.","objdump + caller inspection + local disassembly + source-string correlation + shell-latch correlation"
0x0053f210,166,mouse_cursor_complete_release_and_raise_shell_visible_latch,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Second release-side mode-transition branch in the same `MouseCursor.cpp` family. When either `[this+0x14]` or `[this+0x18]` is still set, the helper reruns the same shell-window and shell-work-owner follow-ons as `0x0053f170`, clears the live cursor selection through `0x0053f000(0, 0, 0)`, clears both `[this+0x18]` and `[this+0x14]`, writes shell latch `[0x006d4024+0x11473a] = 1` while keeping `[+0x11473e] = 0`, restores the saved selected id into `[this+0x04]`, and when `[this+0x08]` is nonzero raises cursor visibility through `0x0051e810(1)`. Current grounded callers are the graphics-backend no-repaint service branch `0x004ffb64` and the local chooser `0x0053f2c0`, so this is the safest current read for the completed release-to-visible transition rather than another generic toggle.","objdump + caller inspection + local disassembly + source-string correlation + shell-latch correlation"
0x0053f2c0,32,mouse_cursor_service_pending_mode_choice_from_shell_latch,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small chooser over the two release-transition branches in the `MouseCursor.cpp` family. When local pending flag `[this+0x14]` is nonzero, it dispatches either to `0x0053f0f0` or `0x0053f210` according to shell latch `[0x006d4024+0x11473e]`; otherwise it returns immediately. Current grounded caller is the timer-gated graphics-page service branch `0x004ffafb`.","objdump + caller inspection + local disassembly + shell-latch correlation"
0x0053f2f0,32,mouse_cursor_push_selection_hold_and_optionally_switch_to_id6,shell,thiscall,inferred,objdump + local disassembly + family correlation,2,"Small hold-counter increment helper in the `MouseCursor.cpp` family. On the first nested hold when `[this+0x0c]` is still zero, it snapshots the current selected id from `[this+0x04]` into `[this+0x10]`, switches the live cursor through `0x0053f000(6, 0, 0)`, and then increments the hold count at `[this+0x0c]`.","objdump + local disassembly + family correlation + hold-counter correlation"
0x0053f310,28,mouse_cursor_pop_selection_hold_and_restore_saved_or_default_id,shell,thiscall,inferred,objdump + local disassembly + family correlation,2,"Hold-counter decrement helper paired with `0x0053f2f0`. The helper decrements `[this+0x0c]`, and when the count reaches zero it restores the saved id from `[this+0x10]` or fallback id `1` through `0x0053f000(saved_or_default, 0, 0)`.","objdump + local disassembly + family correlation + hold-counter correlation"
0x0053f330,146,mouse_cursor_reset_controller_state_and_sync_shell_mode_latches,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Constructor-side reset for the global `MouseCursor.cpp` controller at `0x00ccbb20`. The helper clears the local state band `[this+0x00..+0x28]`, seeds `[this+0x08] = 1`, `[this+0x10] = 1`, and `[this+0x04/+0x20] = -1`, re-enters `0x0053f000(0, 0, 0)`, frees any auxiliary handle at `[this+0x1c]`, and then syncs the local hidden or visible mode latches from shell dwords `[0x006d4024+0x11473e/+0x11473a]` by optionally entering `0x0053f0f0` or setting `[this+0x14]` directly. The tail also clears the shared cursor-handle table `0x00ccba60`. Current grounded caller is `shell_install_global_controller` follow-on startup beneath the mouse-cursor owner family.","objdump + caller inspection + local disassembly + source-string correlation + startup correlation"
0x0053f3d0,39,mouse_cursor_release_current_selection_and_aux_handle,shell,thiscall,inferred,objdump + local disassembly + family correlation,2,"Small cleanup helper in the `MouseCursor.cpp` family. The helper clears the current selection through `0x0053f000(0, 0, 0)`, frees the auxiliary handle at `[this+0x1c]` when present, and zeroes that slot. This is the direct release-side sibling of the constructor reset at `0x0053f330`.","objdump + local disassembly + family correlation + cleanup correlation"
0x0053f400,80,mouse_cursor_service_coarse_global_mode_latches,shell,cdecl,inferred,objdump + caller inspection + local disassembly + family correlation,3,"Coarse service branch over the global `MouseCursor.cpp` mode latches `0x00ccbb18/0x00ccbb1c/0x00ccbb24/0x00ccba58/0x00ccba5c`. The helper decrements countdown `0x00ccbb24`, and when that reaches zero it dispatches either into `0x0053f0f0` or `0x0053f170` from the pending global owners, then mirrors the surviving globals back into shell latches `[0x006d4024+0x11473e/+0x11473a]`. Current grounded caller is the frame updater `0x0053f4e0`.","objdump + caller inspection + local disassembly + family correlation + shell-latch correlation"
0x0053f450,134,mouse_cursor_refresh_inside_active_view_and_toggle_visibility_hint,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Small view-sensitive refresh in the `MouseCursor.cpp` family. The helper samples the current `cursor inside active view` predicate through `shell_input_cursor_inside_active_view` `0x0054f540`, compares that boolean against local state `[this+0x08]`, and on changes updates the same state plus toggles cursor visibility through `0x0051e810(0/1)` when hidden mode `[this+0x18]` is active. On the fallback path it also consults the global shell-side cursor owner at `0x00ccbb20` and, when the global `ShowCursor` refcount is positive, refreshes the coarse elapsed-tick latch `[this+0x24]` or re-enters `0x0053f000(1, 1, 0)`. Current grounded callers are `mouse_cursor_update_frame_state` `0x0053f4e0` and the shell camera action helper `0x004e0780`, so this is the safest current read for the inside-view watcher plus visibility hint owner.","objdump + caller inspection + local disassembly + source-string correlation + inside-view correlation"
0x0053f4e0,739,mouse_cursor_update_frame_state,shell,thiscall,inferred,ghidra-headless,4,Per-frame MouseCursor.cpp updater for the global cursor controller at 0x00ccbb20. It refreshes elapsed tick state through 0x0051d890 re-arms the active cursor selection through 0x0053f450 and 0x0053f000 when the 150 ms and 15 s idle thresholds trip resets per-frame cursor globals through 0x0054f6c0 and 0x0054f6d0 samples cursor placement and world-relative state through world_anchor_measure_projected_half_width world_anchor_measure_projected_half_height and shell_queue_world_anchor_marker and publishes the resulting cursor presentation state through shell_publish_text_callout_presentation before finalizing through 0x0054f6e0.,ghidra + rizin + llvm-objdump + strings
0x0052e060,537,runtime_object_emit_materialized_group_packet_rows_as_vertex24_window,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Vertex24-emission sibling to `0x0052dd00` beneath `runtime_object_emit_selected_grouped_subrecords_into_global_packet_ring` `0x0052f500` in the broader `0x23a` runtime-object family. The helper resolves the same selected group header, active materialized row payload at `[row+0x35]`, and packet source span from `[record+0x04/+0x08/+0x0c]`, then emits `count*3` transformed `0x18`-byte vertex24 records into the caller-provided buffer while advancing the output-count accumulator. Each emitted record stores one vec3 at `+0x00`, style dword `[this+0x43]` at `+0x0c`, and scalar lanes at `+0x10/+0x14`, with the same nonnegative-versus-negative `[this+0x69]` split used by `0x0052dd00`. Current grounded caller is the shell-side presentation branch `0x00528821`, so this is the safest current read for emitting materialized group packet rows as one vertex24 window rather than a shell-only triplet expander.","objdump + caller inspection + local disassembly + grouped-subrecord correlation + packet-row correlation + vertex24-window correlation"
0x0052cd20,21,embedded_view_controller_copy_eye_triplet_to_out_vec3,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny copy helper over the embedded world-view controller base. The function copies the current eye triplet `[this+0x1c/+0x20/+0x24]` into one caller-supplied contiguous `vec3` buffer. Current grounded caller is the world-view wrapper `0x00527e5e`, which uses it together with the focus-triplet sibling `0x0052cd40`, so this is the safest current read for the packed eye-triplet copy helper rather than a broader serializer.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052cd40,21,embedded_view_controller_copy_focus_triplet_to_out_vec3,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Packed focus-triplet sibling to `0x0052cd20` over the same embedded controller base. The helper copies the current focus triplet `[this+0x04/+0x08/+0x0c]` into one caller-supplied contiguous `vec3` buffer. Current grounded caller is the same world-view wrapper `0x00527e6a`, so this is the safest current read for the packed focus-triplet copy helper rather than another generic memcpy leaf.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052cd60,28,embedded_view_controller_copy_eye_triplet_to_three_out_dwords,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Split-out eye-triplet copy helper over the embedded world-view controller base. The function writes current eye lanes `[this+0x1c/+0x20/+0x24]` into three separate caller out-pointers. Current grounded callers include the world-view wrappers `0x00524089`, `0x00528226`, `0x00528384`, `0x00529508`, `0x00529c02`, `0x0052a79a`, the local helper strip around `0x0052bb01`, and sibling controller-bridge calls inside `0x00548382/0x005484de`, so this is the safest current read for the split eye-triplet export helper rather than a subtype-specific query.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052cd80,28,embedded_view_controller_copy_focus_triplet_to_three_out_dwords,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Split-out focus-triplet sibling to `0x0052cd60` over the same embedded controller base. The function writes current focus lanes `[this+0x04/+0x08/+0x0c]` into three separate caller out-pointers. Current grounded callers include world-side and setup-side branches `0x0042ac39`, `0x0042ad67`, `0x00487483`, `0x0052ad16`, `0x0052bad3`, and sibling controller-bridge calls inside `0x0054836c/0x005484c8`, so this is the safest current read for the split focus-triplet export helper rather than a generic outparam block.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052cda0,28,embedded_view_controller_copy_aux_triplet_0x2c_0x34_to_three_out_dwords,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small auxiliary-triplet export helper over the embedded controller base. The function writes lanes `[this+0x2c/+0x30/+0x34]` into three separate caller out-pointers. Current grounded caller is the neighboring layout-state bridge `0x00548398`, so this is the safest current read for exporting the auxiliary cached triplet at `+0x2c..+0x34` rather than a named world coordinate without broader owner evidence.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052cdc0,22,embedded_view_controller_store_aux_triplet_0x2c_0x34,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny setter companion to `0x0052cda0` over the same controller base. The helper stores three caller dwords into auxiliary triplet `[this+0x2c/+0x30/+0x34]`. Current grounded callers are the setup-side world-view branches `0x004592ef` and `0x00459b7b`, so this is the safest current read for the auxiliary-triplet store helper rather than a broader camera-mode owner.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052cde0,48,embedded_view_controller_set_dirty_latch_0x64_and_optionally_snapshot_focus_eye_heading_distance_band,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Dirty-latch helper over the embedded controller base. The function stores the caller boolean into byte `[this+0x64]`; when the boolean is zero it also snapshots the current heading and pitch lanes `[this+0x10/+0x14]`, focus triplet `[this+0x04/+0x08/+0x0c]`, and distance lane `[this+0x18]` into the cached companion band `[this+0x44/+0x48/+0x38/+0x3c/+0x40/+0x4c]`. Current grounded caller is `0x0052c2ef`, so this is the safest current read for the primary dirty-latch and cached focus-eye-orientation snapshot helper rather than a generic flag setter.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052ce20,54,embedded_view_controller_set_dirty_latch_0x65_and_optionally_snapshot_focus_heading_distance_band_0x72_0x86,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Secondary dirty-latch helper over the same controller base. The function stores the caller boolean into byte `[this+0x65]`; when that boolean is zero it snapshots heading and pitch lanes `[this+0x10/+0x14]`, focus triplet `[this+0x04/+0x08/+0x0c]`, and distance lane `[this+0x18]` into the secondary companion band `[this+0x72/+0x76/+0x7a/+0x7e/+0x82/+0x86]`. Current grounded caller is the later owner branch `0x0052cc5d`, so this is the safest current read for the secondary dirty-latch and cached snapshot helper rather than a generic mode toggle.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052ce60,5,embedded_view_controller_raise_dirty_latch_0x64,shell,thiscall,inferred,objdump + local disassembly,1,"Tiny leaf over the embedded controller base that only sets dirty byte `[this+0x64] = 1`. Current evidence grounds it as a direct dirty-latch raiser and does not yet justify a broader semantic name.","objdump + local disassembly + controller-base correlation"
0x0052ce70,43,embedded_view_controller_refresh_shell_presenter_scalar_0x6a_and_consume_dirty_latch_0x64,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small shell-state synchronization helper over the same controller base. The function compares cached scalar `[this+0x6a]` against current shell presenter dword `[0x006d4024+0x114222]`, raises dirty byte `[this+0x64]` and stores the new shell scalar when they differ, then returns the prior dirty state and clears `[this+0x64]` back to zero. Current grounded caller is `0x0052c29c`, so this is the safest current read for the shell-scalar refresh plus dirty-latch consume helper rather than a generic poll routine.","objdump + caller inspection + local disassembly + controller-base correlation + shell-scalar correlation"
0x0052cea0,19,embedded_view_controller_copy_heading_pitch_pair_to_two_out_dwords,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny heading/pitch export helper over the embedded controller base. The function copies lanes `[this+0x10/+0x14]` into two caller out-pointers. Current grounded caller is the later support branch `0x00566700`, so this is the safest current read for the heading-pitch pair copy helper rather than a broader serializer fragment.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052cec0,49,embedded_view_controller_sample_owner_height_at_current_eye_xz,shell,thiscall,inferred,objdump + local disassembly,1,"Small owner-height query helper beneath the same controller base. The function scales current eye X/Z lanes `[this+0x1c/+0x24]` through the recurring world-unit constants, then forwards the resulting pair into owner handle `[this+0x6e]` through `0x00534490`. Current evidence grounds it as the direct sampled-height query at the controller's current eye X/Z position.","objdump + local disassembly + controller-base correlation + sampled-height correlation"
0x0052cf00,436,embedded_view_controller_query_owner_height_peak_over_clamped_xy_extent_pair,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Broader owner-height extent query over the embedded controller base. The helper clamps the caller-supplied X and Y extent floats against lower bound `2.0` and against owner-derived width and height limits from `0x00533970/0x00533980`, samples an initial owner height through `0x00534490`, and then walks a rectangular neighborhood in repeated world-unit steps to keep the highest sampled height, returning that peak float. Current grounded callers are the current-eye wrapper `0x0052d0dc`, the world-view clamp owner `0x0045211f`, and the later support branch `0x0053037f`, so this is the safest current read for querying the peak sampled owner height across one clamped XY extent pair rather than a generic math loop.","objdump + caller inspection + local disassembly + controller-base correlation + sampled-height correlation"
0x0052d0c0,33,embedded_view_controller_query_owner_height_peak_over_current_eye_xz_extent_pair,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Current-eye wrapper over `0x0052cf00` in the embedded controller base. The helper scales current eye X/Z lanes `[this+0x1c/+0x24]` into owner-space extents and forwards them into the broader peak-height query `0x0052cf00`. Current grounded callers are the world-view clamp owners `0x00439942` and `0x0043ceec`, so this is the safest current read for the current-eye peak-height wrapper rather than a separate terrain query family.","objdump + caller inspection + local disassembly + controller-base correlation + sampled-height correlation"
0x0052d0f0,64,embedded_view_controller_query_normalized_scalar_band_contains_xy_pair,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small range predicate over normalized scalar band `[this+0x50/+0x54/+0x58/+0x5c]` in the embedded controller base. The helper returns `1` only when the caller-supplied XY pair lies inside that stored scalar rectangle and `0` otherwise. Current grounded callers are the world-side branch `0x0045211f` and the later support branch `0x0053037f`, so this is the safest current read for the normalized-band containment predicate rather than a generic compare helper.","objdump + caller inspection + local disassembly + controller-base correlation + normalized-rect correlation"
0x0052d140,29,embedded_view_controller_store_four_blend_scalars_0x50_0x5c,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny setter over the embedded world-view controller base. The helper copies four caller-supplied dwords into scalar lanes `[this+0x50/+0x54/+0x58/+0x5c]` unchanged. Current grounded callers are the mode-`0x19` variant seed owners `0x0043a0a0`, `0x0043ace3`, the setup-side world-view branches `0x00459139`, `0x00459982`, and the later world-side owner `0x005208ad`, so this is the safest current read for the four-scalar controller-blend setter rather than a higher-level mode owner.","objdump + caller inspection + local disassembly + controller-band correlation"
0x0052d180,91,embedded_view_controller_store_focus_triplet_and_mark_dirty_if_changed,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Core focus-triplet setter beneath the embedded world-view controller base. The helper compares the incoming focus XYZ against the current stored triplet `[this+0x04/+0x08/+0x0c]`; when any component moves beyond the small epsilon at `0x005dd1c0` it sets dirty byte `[this+0x64] = 1`. It then stores the new triplet into `[+0x04/+0x08/+0x0c]`. Current grounded callers are the shell-input controller path `0x0043a1c3`, the transient-offset service `0x0043a54b`, the local clamp helper `0x00439820`, setup-side world-view branches `0x004592b8/0x00459b61`, and the runtime-object support strip `0x0052d440/0x0052bf65`, so this is the safest current read for the focus-triplet setter plus dirty-latch update rather than a generic vec3 copy.","objdump + caller inspection + local disassembly + controller-base correlation + dirty-latch correlation"
0x0052d1e0,67,embedded_view_controller_store_eye_triplet_and_refresh_vertical_delta,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Eye-triplet setter beneath the same embedded controller base. The helper stores the caller eye XYZ into `[this+0x1c/+0x20/+0x24]`; when owner handle `[this+0x6e]` is live it also samples the owner's height through `0x00534490` at the new X/Z pair and writes the resulting vertical delta `eye_y - sampled_height` into `[this+0x66]`, otherwise it copies the eye Y lane directly into `[this+0x66]`. Current grounded callers are the local clearance-ring clamp `0x00439820`, the setup-side controller owners `0x00459139/0x004592b8/0x00459afe`, and the helper itself's paired rebuild path `0x0052d440`, so this is the safest current read for storing the eye triplet and refreshing the sampled vertical delta rather than a generic world-position setter.","objdump + caller inspection + local disassembly + controller-base correlation + vertical-delta correlation"
0x0052d230,115,embedded_view_controller_query_focus_to_eye_distance_heading_and_pitch,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Pure query helper over the same controller base. Starting from the current focus triplet `[this+0x04/+0x08/+0x0c]` and eye triplet `[this+0x1c/+0x20/+0x24]`, the function can write the straight-line distance, one heading-like angle, and one pitch-like angle into up to three caller out-pointers. Current grounded caller is the world-side wrapper `0x0052fa59`, which consumes these as a bundled camera-state query, so this is the safest current read for the focus-to-eye distance and angle extractor rather than a standalone math primitive.","objdump + caller inspection + local disassembly + controller-base correlation + polar-query correlation"
0x0052d2b0,178,embedded_view_controller_serialize_focus_eye_and_orientation_triplets,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared serializer for the embedded controller base. The helper writes the current focus triplet `[this+0x04/+0x08/+0x0c]`, distance or view-height lane `[this+0x18]`, heading and pitch lanes `[this+0x10/+0x14]`, and eye triplet `[this+0x1c/+0x20/+0x24]` into the caller stream through repeated `0x00531030` writes, followed by one fixed zeroed `0x14`-byte trailer. Current grounded caller is `world_view_store_camera_view_slot_snapshot` `0x00439ac0`, so this is the safest current read for the controller-base snapshot serializer rather than a generic stream writer.","objdump + caller inspection + local disassembly + camera-view correlation + controller-base correlation"
0x0052d3e0,21,embedded_view_controller_clear_presenter_owner_slot_if_self,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny presenter cleanup leaf beneath the embedded controller base. When the live shell presenter exists and its owner slot `[0x006d4024+0x28]` still points at `this`, the helper clears that slot to null. Current grounded callers are the controller release owners `0x0043a58d` and `0x0043ac5c`, so this is the safest current read for the conditional presenter-owner clear helper.","objdump + caller inspection + local disassembly + presenter-owner correlation"
0x0052d400,69,embedded_view_controller_rebuild_focus_triplet_from_eye_heading_pitch_and_distance,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Inverse rebuild helper for the same embedded controller base. Starting from the current eye triplet `[this+0x1c/+0x20/+0x24]`, heading and pitch lanes `[this+0x10/+0x14]`, and distance or view-height lane `[this+0x18]`, the function reconstructs the implied focus triplet on the stack and then stores that triplet through `0x0052d180`. Current grounded caller is the world-view camera-restore branch `0x0043c960`, which adjusts heading before re-entering this helper, so this is the safest current read for rebuilding focus from eye-orientation-distance rather than another trig primitive.","objdump + caller inspection + local disassembly + controller-base correlation + focus-triplet correlation"
0x0052d450,117,embedded_view_controller_rebuild_eye_triplet_from_focus_heading_pitch_and_distance,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Core rebuild helper for the embedded controller base. Using the stored focus triplet `[this+0x04/+0x08/+0x0c]`, heading and pitch lanes `[this+0x10/+0x14]`, and distance lane `[this+0x18]`, the function recomputes the eye triplet into `[this+0x1c/+0x20/+0x24]` by applying the usual trig decomposition. When owner handle `[this+0x6e]` is live it also samples the owner's height through `0x00534490` at the rebuilt X/Z pair and refreshes vertical delta `[this+0x66]`; otherwise it copies the rebuilt eye Y lane there directly. Current grounded callers are the controller reset or clamp helpers `0x0052d5bf`, `0x0052d646`, and the world-view side branch `0x0043e4ce`, so this is the safest current read for rebuilding the eye triplet from focus, orientation, and distance rather than a generic trig helper.","objdump + caller inspection + local disassembly + controller-base correlation + eye-triplet correlation"
0x0052d4d0,143,embedded_view_controller_materialize_active_display_rect_from_normalized_scalars_0x50_0x5c,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small display-rect materializer beneath the embedded world-view controller base. The helper samples the active shell display width and height pair from `[0x006d4024+0x34 + [0x006d4024+0x11421e]*0x15]`, multiplies those two display metrics by the stored normalized scalar band `[this+0x50/+0x54/+0x58/+0x5c]`, rounds the four products through `0x005a10d0`, and writes the resulting integer rectangle corners through the caller out-pointers. Current grounded caller is the layout-state bridge `0x005482e0`, so this is the safest current read for materializing one active-display rect from the controller's normalized scalar band rather than a generic scaling helper.","objdump + caller inspection + local disassembly + controller-base correlation + display-rect correlation"
0x0052d570,27,embedded_view_controller_rebind_base_vtable_and_clear_presenter_owner_slot,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny base-reset leaf for the embedded controller object. The helper restores the base vtable root `0x005dd1c8` at `[this]` and clears presenter owner slot `[0x006d4024+0x28]` when it still points at `this`. Current grounded callers are the world-view release path `0x0043a595`, the setup-side teardown path `0x00458258`, the world-side cleanup branches `0x00520d43` and `0x0052bfd3`, so this is the safest current read for the base-vtable rebind and presenter-owner clear leaf.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052d5a0,144,embedded_view_controller_reset_scalar_bands_defaults_and_dirty_latches,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader initializer for the embedded controller base. The helper clears owner handle `[this+0x6e]`, sampled vertical delta `[+0x66]`, heading `[+0x10]`, several transient scalar lanes `[+0x44/+0x48/+0x60]`, focus and eye triplets `[+0x04..+0x0c]` and `[+0x38..+0x40]`, re-enters `0x0052d450`, seeds default scalar lanes such as `[+0x14]=0.2`, `[+0x18]=100.0`, `[+0x28]=100`, `[+0x30/+0x58/+0x5c]=1.0`, `[+0x4c]=100.0`, dirty byte `[+0x64]=1`, and sentinel `[+0x6a]=-1`, then copies the rebuilt heading or pitch defaults into `[+0x72/+0x76]` and `[+0x86]`. Current grounded callers are the world-view reset owner `0x0043a5a3`, the local constructor `0x0052d6d9`, and the later rebuild paths `0x0052d6d9/0x0052d869`, so this is the safest current read for the embedded controller-base reset and default seeding owner rather than a generic constructor stub.","objdump + caller inspection + local disassembly + controller-base correlation + reset-owner correlation"
0x0052d640,131,embedded_view_controller_clamp_distance_against_sampled_eye_height_and_rebuild_eye_triplet,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Distance-clamp helper for the embedded controller base. The function first rebuilds the current eye triplet through `0x0052d450`, compares owner-derived metric `vtable[+0x0c]` against eye height `[this+0x20]`, and when the current distance or view-height lane `[this+0x18]` is too large it computes one reduced value from the current height gap, pitch sine, and the sampled vertical offset, stores the clamped result back into `[this+0x18]`, and rebuilds the eye triplet again through `0x0052d450`. Current grounded callers are the world-view heading and zoom-step paths `0x0043cb16/0x0043cc16`, the controller seed path `0x0043ce3a`, the motion wrapper `0x0043d09f`, and the local constructor `0x0052d744`, so this is the safest current read for the distance clamp and eye-triplet rebuild helper rather than a generic projection recompute.","objdump + caller inspection + local disassembly + controller-base correlation + distance-clamp correlation"
0x0052d6f0,90,embedded_view_controller_seed_focus_distance_owner_and_rebuild_eye_triplet,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Compact constructor-side seed helper for the embedded controller base. The function stores one caller-supplied owner handle into `[this+0x6e]`, seeds the focus triplet into `[this+0x04/+0x08/+0x0c]`, seeds distance or view-height lane `[this+0x18]` plus its copy `[this+0x4c]`, mirrors shell presenter scalar `[0x006d4024+0x114222]` into `[this+0x6a]`, derives one bucket-like value from `0x51f070(1)` into `[this+0x28]`, and then tail-calls `0x0052d640` to rebuild the eye triplet and apply any needed clamp. Current grounded callers are the world-view owner `0x0043ce0e` and the stream-load branches `0x0052d7da/0x0052d889`, so this is the safest current read for the seeded controller-base setup helper rather than a generic stream-load leaf.","objdump + caller inspection + local disassembly + controller-base correlation + seed-owner correlation"
0x0052d750,260,embedded_view_controller_load_focus_eye_and_orientation_snapshot_from_stream,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared stream-load companion to the camera-view snapshot serializer `0x0052d2b0`. The helper first clears presenter owner slot `[0x006d4024+0x28]` when it still points at `this`, then reads the stored focus triplet `[+0x04/+0x08/+0x0c]` and distance lane `[+0x18]` through repeated `0x00531150` calls, resolves one owner handle from that focus or distance tuple through shell presenter helper `0x0051f090`, and re-enters `0x0052d6f0` to seed the controller base. After that it loads heading and pitch lanes `[+0x10/+0x14]`, eye triplet `[+0x1c/+0x20/+0x24]`, and consumes the trailing zeroed `0x14`-byte trailer. Current grounded caller is the world-view stream-load owner `0x0043ac30`, so this is the safest current read for loading one embedded controller snapshot from a stream rather than a generic byte-reader block.","objdump + caller inspection + local disassembly + stream-load correlation + camera-view correlation + controller-base correlation"
0x0052d860,50,embedded_view_controller_construct_reset_and_seed_from_focus_distance_owner,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Compact constructor wrapper for the same embedded controller base. The helper rebinds base vtable `0x005dd1c8`, re-enters `0x0052d5a0` to reset and seed defaults, and then forwards one caller-supplied owner handle, focus triplet, and distance lane into `0x0052d6f0`. Current grounded callers are the placed-structure and world-side builders `0x004581ff` and `0x0052087e`, so this is the safest current read for the reset-plus-seed constructor wrapper rather than another raw allocator tail.","objdump + caller inspection + local disassembly + controller-base correlation + constructor-wrapper correlation"
0x0052d8a0,170,runtime_object_register_relative_child_in_owned_list_field_0x75,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared owned-list registration helper over list root `[this+0x75]` in the broader `0x23a` runtime-object family. The function lazily allocates that list root through `0x00556db0`, optionally rewrites the incoming child object's anchor triplet `[child+0x1e2/+0x1e6/+0x1ea]` into coordinates relative either to current group-anchor `[this+0x14]` or to this object's own anchor when state bit `0x10` is still clear, sets bit `0x10` in the child state byte `[child+0x20]`, and then pushes the child through `0x00556e10`. Current grounded callers include the placed-structure specialization builders `0x0045b6f0`, `0x0045b760`, `0x0045c310`, the vehicle-side branches `0x00485933..0x00485ddb`, and the effect-side builders `0x0045b96b`, `0x0045c39c`, and `0x0045da83..0x0045e305`, so this is the safest current read for registering one relative child object in owned list `[this+0x75]` rather than a subtype-specific builder.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + owned-list correlation + relative-anchor correlation"
0x0052d950,71,runtime_object_register_record_in_owned_list_field_0x79_with_group_anchor_copy,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared owned-list registration helper over list root `[this+0x79]` in the broader `0x23a` runtime-object family. The function lazily allocates that list root through `0x00556db0`, copies the current group-anchor triplet from `[this+0x14]` into record fields `[record+0x29/+0x2d/+0x31]`, and then pushes the record through `0x00556e10`. Current grounded callers include the specialization payload publishers `0x00474f3e`, `0x00485f30`, and `0x00486029`, so this is the safest current read for registering one record in owned list `[this+0x79]` with a copied group anchor rather than a bare list append.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + owned-list correlation + group-anchor correlation"
0x0052d9a0,79,runtime_object_register_record_in_owned_list_field_0x7d_with_group_anchor_copy,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Sibling owned-list registration helper over list root `[this+0x7d]` in the broader `0x23a` runtime-object family. The function lazily allocates that list root through `0x00556db0`, copies the current group-anchor triplet from `[this+0x14]` into record fields `[record+0x29/+0x2d/+0x31]`, and then pushes the record through `0x00556e10`. Current grounded callers include the placed-structure specialization publishers `0x00456ad4`, `0x00456b80`, `0x00456c5a`, `0x00457047`, `0x0045b141`, `0x0045b14f`, `0x0045e305`, and the vehicle-side helpers `0x0048597a`, so this is the safest current read for registering one record in owned list `[this+0x7d]` with a copied group anchor rather than a subtype-specific payload constructor.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + owned-list correlation + group-anchor correlation"
0x0052da70,32,runtime_object_refresh_dependent_handle_0x0c_if_flag_0x40_and_owner_live,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small dependent-handle refresh helper beneath the broader `0x23a` runtime-object family. When owner pointer `[this+0x04]` is live and state byte `[this+0x20]` still carries bit `0x40`, the helper clears that bit, rebuilds one dependent handle through `0x00533bc0`, and stores the result into `[this+0x0c]`. Current grounded callers are the nearby world-side support strips `0x00421415` and `0x00461300`, so this is the safest current read for the `0x40`-bit dependent-handle refresh leaf rather than a generic flag clear.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + dependent-handle correlation"
0x0052daa0,67,runtime_object_select_grouped_subrecord_by_clamped_index,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared grouped-subrecord selector over the broader `0x23a` runtime-object family. When grouped table root `[this+0x14]` is live, the helper clamps the caller-requested index against the current group count from the selected `0x45`-byte group header `[group+0x14]`, stores the resulting cursor into `[this+0x21]`, updates active subrecord pointer `[this+0x18]` to the corresponding `0x45`-byte payload row under `[group+0x0c]`, and returns whether the requested index was already in range. Current grounded callers are the world-side wrappers `0x0042aba0`, `0x00455c73`, `0x00528721`, and `0x0052941f`, so this is the safest current read for the explicit grouped-subrecord select helper rather than a generic array index setter.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + grouped-subrecord correlation"
0x0052db10,224,runtime_object_store_scalar_0x69_mark_transform_dirty_and_materialize_group_packet_rows,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader grouped-subrecord materialization helper beneath the same `0x23a` runtime-object family. The function stores one caller-supplied scalar into `[this+0x69]`, sets dirty bit `0x02` in state byte `[this+0x20]`, raises byte `[this+0x8d]`, resolves the currently selected group header from `[this+0x14]` and group index `[this+0x3a]`, and then walks every `0x45`-byte row in that group. For each row it caches the active row pointer in globals `0x00cc3b58/0x00cc3b6c`, lazily allocates row-local payload storage when `[row+0x35]` is still null, copies the row's packed source span there, zero-fills the trailing companion area, and advances to the next row. Current grounded callers are the vehicle-side visual builders `0x00485a1d` and `0x00485a68` plus the shell-side presentation branch `0x005287af`, so this is the safest current read for storing scalar lane `[+0x69]` and materializing the current group's packet rows rather than a pure allocator helper.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + grouped-subrecord correlation + packet-row correlation"
0x0052dc00,240,runtime_object_bucket_materialized_group_packet_rows_by_four_float_thresholds,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Companion grouped-row helper immediately above `0x0052db10` in the same `0x23a` runtime-object family. When byte latch `[this+0x8d]` is live and local bucket byte `[this+0x5b]` is still below `2`, the function increments that bucket, stores one caller float into threshold lane `[this+0x69 + bucket*4]`, resolves the currently selected `0x45`-byte group, and then walks every materialized row payload at `[row+0x35]`. For each copied entry it compares the entry's two stored floats against the four caller-supplied threshold bounds and, on success, writes the current bucket byte into the compact trailing byte band of the copied row payload. Current grounded callers are the vehicle-side visual builders `0x00485a8c`, `0x00485ab0`, `0x00485ad4`, and `0x00485af8`, so this is the safest current read for bucketing the materialized group packet rows by threshold windows rather than a generic float clamp.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + grouped-subrecord correlation + threshold-bucket correlation"
0x0052eb20,51,shell_read_optional_presentation_extents4,bootstrap,thiscall,inferred,ghidra-headless,4,Reads an optional four-float extent block from the active presentation-batch record when byte flag [this+0x25] is set; copies dwords at +0x26 +0x2a +0x2e and +0x32 into caller outparams for the presentation-extents helper at 0x547d10.,ghidra + rizin
0x0052eb60,6,runtime_object_constant_0x46_stub_vtable_5cfd00_slot0,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper returns literal `0x46` in `EAX` and exits immediately. Current evidence does not justify a stronger semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly"
0x0052eb70,6,runtime_object_constant_0x46_stub_vtable_5cfd00_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Second tiny constant-return virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper also returns literal `0x46` in `EAX` and exits immediately. Current evidence does not justify a stronger semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly"
0x0052eb80,7,runtime_object_constant_float_1_25_stub_vtable_5cfd00_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly + rdata inspection,1,"Tiny float-return virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper loads and returns the constant float at `0x005dd1e8`, which is `1.25f`. Current evidence grounds it only as a fixed float-return slot.","objdump + vtable scan + local disassembly + rdata inspection"
0x0052eb90,53,runtime_object_release_all_entries_in_list_field_0x79_via_0x554d50,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared cleanup helper over the broader `0x23a` runtime-object family. When list root `[this+0x79]` is nonnull, the helper walks that collection through `0x00556ef0/0x00556f00` and releases every entry through `0x00554d50` until no child remains. Current grounded callers include placed-structure rebuild or mutation branches `0x0046f055`, `0x004707e1`, `0x00507d70`, and `0x00509057`, where it acts as the release-side companion after local-runtime state mutations.","objdump + caller inspection + local disassembly + shared-runtime-object correlation"
0x0052ebd0,122,runtime_object_load_two_flag_bits_into_byte_0x20_and_optionally_refresh_handle_0x0c,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared stream-load helper beneath the broader `0x23a` runtime-object family. The function reads two one-byte flag lanes from the caller-supplied stream through `0x00531150`, folds those values into bits `0x20` and `0x40` of state byte `[this+0x20]`, and when the refreshed `0x40` bit ends up enabled with owner pointer `[this+0x04]` already live it clears that bit again, rebuilds one dependent handle through `0x00533bc0`, and stores the result into `[this+0x0c]`. Current grounded caller is the tagged payload loader `0x004560c0`, so the safest read is a two-bit load helper with an optional dependent-handle refresh rather than a generic byte reader.","objdump + caller inspection + local disassembly + stream-load correlation"
0x0052ec50,68,runtime_object_serialize_two_flag_bits_from_byte_0x20,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared stream-save companion to `0x0052ebd0` beneath the broader `0x23a` runtime-object family. The helper extracts bits `0x20` and `0x40` from state byte `[this+0x20]` as two one-byte values and writes both bytes into the caller-supplied stream through `0x00531030`. Current grounded caller is the shared tagged serializer `0x00455a22`, so this is the safest current read for the two-bit save helper rather than a broader payload writer.","objdump + caller inspection + local disassembly + stream-save correlation"
0x0052eca0,46,runtime_object_query_next_grouped_0x45_byte_subrecord_from_table_0x14,map,thiscall,inferred,objdump + local disassembly + field inspection,2,"Shared fixed-record cursor helper over the broader `0x23a` runtime-object family. When grouped table root `[this+0x14]` is live and current subrecord index `[this+0x21] + 1` remains below the current group count taken from the `0x45`-byte group header selected by `[this+0x3a]`, the helper returns the next subrecord pointer from that group's payload base `[group+0x0c]`; otherwise it returns null. Current evidence is strong enough for the grouped-table cursor shape but not yet for a stronger user-facing semantic name for the `0x45`-byte records.","objdump + local disassembly + field inspection + grouped-subrecord correlation"
0x0052ecd0,272,runtime_object_reset_local_state_and_seed_default_scalar_flag_bands,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared low-level reset helper beneath the broader `0x23a` runtime-object family. The function clears the local list and handle roots at `[this+0x04/+0x08/+0x0c/+0x10/+0x14/+0x1c/+0x75..+0x81]`, resets string or scalar side bands around `[this+0x4b..+0x65]`, clears cached words at `[this+0x8d]`, `[this+0x1be..+0x1da]`, and related spans, preserves only selected low bits of state byte `[this+0x20]` before forcing default mask `0x62`, writes `-1` sentinels into `[this+0x3e]`, `[this+0x1ee]`, and `[this+0x1fa]`, and seeds the recurring default `1.0f` lanes at `[this+0x36]`, `[this+0x18e]`, `[this+0x1a2]`, `[this+0x1b6]`, `[this+0x1ca]`, and `[this+0x1da]`. Current grounded callers are the shared payload loaders `0x00455b70`, `0x00455fc0`, and the deeper init branch `0x0052edf0`, so this is the safest current read for the common local-state reset and default seeding owner.","objdump + caller inspection + local disassembly + shared-runtime-object correlation"
0x0052edf0,178,runtime_object_seed_owner_handle_anchor_triplet_and_default_color,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared post-reset initializer beneath the broader `0x23a` runtime-object family. After re-entering `0x0052ecd0`, the helper stores one caller-supplied owner or parent pointer into `[this+0x04]`, optionally resolves a primary handle from the second caller argument through owner `0x006d4020` into `[this+0x10]`, optionally resolves a secondary handle from the third argument into `[this+0x1c]`, copies the first triplet from the resolved primary handle into `[this+0x1e2/+0x1e6/+0x1ea]`, sets bit `0x08` in state byte `[this+0x20]`, and seeds packed color lane `[this+0x43]` to `0x007f7f7f`. When the primary handle argument is null, it zeros `[this+0x10/+0x14/+0x18]` and the copied triplet instead. Current grounded callers are the shared initializers `0x00455b70`, `0x00485819`, and `0x0053065a`, so this is the safest current read for seeding the owner-handle and anchor-triplet band rather than a subtype-specific constructor.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + anchor-triplet correlation"
0x0052eeb0,93,runtime_object_release_owned_entry_list_field_0x79_and_clear_root,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared release helper over owned list root `[this+0x79]` in the broader `0x23a` runtime-object family. The function walks the current list through `0x00556ef0/0x00556f00`, releases each live entry through `0x00556460`, frees those entries through `0x0053b080`, then destroys and frees the root list object itself through `0x005571d0` plus `0x0053b080`, and finally clears `[this+0x79]` back to null. Current grounded callers are the deeper release body `0x0052ef70` and the specialization-side cleanup `0x0045b734`, so this is the safest current read for the owned-list `[this+0x79]` release path.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + owned-list-release correlation"
0x0052ef10,93,runtime_object_release_owned_entry_list_field_0x7d_and_clear_root,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Sibling release helper over owned list root `[this+0x7d]` in the broader `0x23a` runtime-object family. The function walks the current list through `0x00556ef0/0x00556f00`, releases each live entry through `0x00553a00`, frees those entries through `0x0053b080`, then destroys and frees the root list object itself through `0x005571d0` plus `0x0053b080`, and finally clears `[this+0x7d]` back to null. Current grounded callers are the deeper release body `0x0052ef70` and specialization-side cleanup `0x0045b701`, so this is the safest current read for the owned-list `[this+0x7d]` release path.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + owned-list-release correlation"
0x0052ef70,424,runtime_object_release_owned_lists_detach_world_binding_and_free_handles,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader release body over the shared `0x23a` runtime-object family. The helper first clears the live shell-side preview or helper owner through `0x0052d160` when the active presentation owner still references `this`, releases the dependent handle at `[this+0x0c]` through `0x00533bd0`, then re-enters the owned-list cleanup helpers for `[this+0x79]` and `[this+0x7d]`. It also recursively releases the nested object list at `[this+0x75]` by rebasing each entry to vtable `0x005dd1f0`, calling `0x0052ef70` on that child, and then freeing both each child and the root list, while the sibling list at `[this+0x81]` is walked through `0x005540b0` plus the same free-root pattern. After those releases it clears one shell-side owner slot at `[presentation+0x366e]` when it still points at `this`, detaches the world binding through `0x00533c20` when owner `[this+0x04]` and handle `[this+0x08]` are live, and finally frees the optional handles at `[this+0x10]` and `[this+0x1c]` through owner `0x006d4020`. Current grounded callers are the shared cleanup wrapper `0x00455d47` and the recursive child-release path inside this same helper, so this is the safest current read for the common owned-list, binding, and handle teardown body.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + recursive-release correlation + world-binding-teardown correlation"
0x0052f120,192,runtime_object_refresh_cached_4x4_transform_block_when_dirty_bit_0x02,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared dirty-bit refresh helper over the broader `0x23a` runtime-object family. When state byte `[this+0x20]` still has bit `0x02` set, the helper clears that bit, sets bit `0x04`, zeroes the cached 16-dword transform block at `[this+0x14e]`, seeds its scale and anchor lanes from `[this+0x36]` and `[this+0x1e2/+0x1e6/+0x1ea]`, writes default scalar `1.0f` at `[this+0x18a]`, and then rebuilds the remaining matrix-style contents through `0x0056d3cd`. When the sign bit of `[this+0x20]` is clear it first derives one temporary basis from local vector lanes `[this+0x4b/+0x4f/+0x53]` through `0x0056e1a8`; otherwise it uses the stored fallback block at `[this+0x18e]` directly. Current grounded callers include constructors or refresh paths `0x004aa9be`, `0x00524470`, `0x005287ee`, `0x0052893e`, `0x005289d4`, `0x00528b63`, `0x005306b7`, and `0x0055613a`, so this is the safest current read for cached transform-block refresh rather than a generic math helper.","objdump + caller inspection + local disassembly + dirty-bit correlation + transform-block correlation"
0x0052f1e0,391,geometry_query_five_vec3_separating_volume_overlap_predicate,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Pure boolean geometry helper that consumes five 3-float vector blocks and returns `1` only when a sequence of signed-volume or separating-plane style tests all pass. The routine builds local difference vectors from two of the input vec3s, forms intermediate cross-style terms against a third input vec3, rejects when the first signed volume is nonpositive, repeats the same pattern against a fourth input vec3, and then performs a final doubled-threshold comparison before returning. Current grounded callers are `0x0052f737` and `0x00530241`, where it acts as a geometric overlap or side-test predicate rather than as a stateful runtime-object helper. The exact higher-level shape semantics remain open, so this note stays structural.","objdump + caller inspection + local disassembly + geometric-predicate correlation"
0x0052f370,385,runtime_object_quantize_world_position_sample_group_metric_and_select_subrecord,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared quantized-selection helper over the broader `0x23a` runtime-object family. The function rounds the caller-supplied world coordinates, folds them through the quantized lookup table at `0x006d9098`, derives one odd metric seed from the final table index, queries a scaled scalar through owner handle `[this+0x04]` and `0x00533120`, applies one or two global scale adjustments from shell state, updates flag bit `0x02` in byte `[this+0x5c]` against threshold `0x005c8628`, and then chooses the active grouped `0x45`-byte subrecord by scanning the current group at `[this+0x14]` until the stored threshold field exceeds that sampled metric. The helper stores the selected subrecord index in `[this+0x21]` and the corresponding subrecord pointer in `[this+0x18]`. Current grounded caller is `0x00528f5b`, so this is the safest current read for a quantized metric-driven subrecord selector rather than a generic coordinate utility.","objdump + caller inspection + local disassembly + quantized-lookup correlation + grouped-subrecord correlation"
0x0052f500,1134,runtime_object_emit_selected_grouped_subrecords_into_global_packet_ring,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared packet-emission owner over the broader `0x23a` runtime-object family. The helper begins from the currently selected grouped subrecord at `[this+0x18]`, snapshots the active global packet write pointer and remaining count at `0x00cc3b64/0x00cc3b5c`, and rejects early when the selected group has no entries. When state bit `0x01` is active it also consumes caller-supplied world vectors, lazily refreshes the cached transform block when bit `0x04` is still set, transforms those vectors through the cached basis lanes `[this+0x8e..+0xb6]`, and runs the resulting geometry through `geometry_query_five_vec3_separating_volume_overlap_predicate` `0x0052f1e0` to decide whether one alternate emission branch should be used. In either branch it emits one run of `0x20`-byte output packets built from the current global packet source span and the selected grouped `0x45`-byte records, advancing the global packet pointer by `0x4c` per source packet while decrementing the shared remaining count. Current grounded callers are the world-side emission paths `0x005290d8`, `0x0052917f`, `0x0055dc3e`, `0x0055dc78`, `0x0055dcb4`, and `0x0055dd2a`, so this is the safest current read for grouped subrecord emission into the global packet ring rather than a local math helper.","objdump + caller inspection + local disassembly + packet-ring correlation + grouped-subrecord correlation + transform-refresh correlation"
0x0052fb70,480,runtime_object_set_packed_color_lane_and_optionally_propagate_child_brightness,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared packed-color helper over the broader `0x23a` runtime-object family. The function takes one caller-supplied byte and, when the shell-side gate at `[0x006d4024+0x114742]` is live, derives visible packed color `[this+0x43]` from stored high-byte lane `[this+0x47]` plus either dim RGB literal `0x003c3c3c` or full-bright literal `0x00ffffff` depending on whether the byte is below `0xff`. It also pushes the same dim-or-bright RGB triplet into every nested child reachable through list root `[this+0x75]` via `0x0052e680`, and when the recursive flag argument is nonzero it reapplies the same packed-color update to each child by re-entering itself. When the shell gate is absent, the helper instead stores the raw byte into high-byte lane `[this+0x47]` and only recurses that byte state to children. Current grounded callers are the specialization-side refresh and UI branches `0x004871b3`, `0x004a8277`, `0x004ad0a6`, `0x004af6b6`, `0x004b0e36`, and the local recursive calls inside this helper, so this is the safest current read for packed color or brightness propagation rather than a more specific UI event sink.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + child-color-propagation correlation"
0x0052fd60,93,runtime_object_publish_anchor_triplet_to_attached_entry_list_field_0x81,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared anchor-triplet publish helper over attached list root `[this+0x81]` in the broader `0x23a` runtime-object family. When that list exists and its root carries a nonnull payload at `[root+0x0c]`, the helper walks the entries through `0x00556ef0/0x00556f00` and forwards the current anchor triplet `[this+0x1e2/+0x1e6/+0x1ea]` into each live entry through `0x005545d0`. Current grounded callers are the relocation or republish paths `0x004acf51`, `0x0052fdc0`, `0x005307dc`, and `0x00530808`, so this is the safest current read for publishing the current anchor triplet to attached entries rather than a broader list-service helper.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + attached-entry-publish correlation"
0x0052fdc0,496,runtime_object_translate_anchor_triplet_rebind_world_cell_handle_and_refresh_attached_entries,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared relocation helper over the broader `0x23a` runtime-object family. The function first marks state byte `[this+0x20]` dirty with bit `0x02`, then adds the caller-supplied triplet delta to current anchor `[this+0x1e2/+0x1e6/+0x1ea]`. When owner `[this+0x04]` is live, it quantizes the old and new X/Z anchor lanes through `0x005a10d0` and the same world-scale constant used by `0x00530720`, checks the resulting cell indices against world-grid bounds from `0x00533970/0x00533980`, and if the quantized cell changed rebinds world handle `[this+0x08]` by detaching the old slot through `0x00533c20` and attaching the new slot through `0x00533bf0`. On success it republishes the current anchor triplet through `0x0052fd60`; on out-of-bounds failure it restores the prior anchor and returns `0`. Current grounded callers are the movement or placement-side branches `0x0045647b`, `0x00457d48`, `0x00458ec1`, and `0x00459945`, so this is the safest current read for anchor-triplet translation plus optional world-cell rebinding rather than a generic vector-add helper.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + world-binding-rebind correlation"
0x0052ffb0,115,runtime_object_scale_current_axis_angle_rotation_and_rebuild_orientation_block,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared rotation-scale helper over the broader `0x23a` runtime-object family. The function converts current local 4-dword orientation block `[this+0x1ce..+0x1da]` into one temporary axis-angle style representation through `0x0056e556`, scales the recovered angle by the caller-supplied float, rescales the axis lanes by constant `0x005c9b08`, and then rebuilds the stored orientation block by re-entering `0x0052e9f0`. Current grounded callers are the same specialization-side geometry and animation branches `0x00458b86`, `0x00458da5`, `0x00458e7f`, and `0x0045967c`, so this is the safest current read for scaling the current axis-angle rotation and rebuilding the cached orientation block rather than a generic scalar setter.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + axis-angle correlation"
0x00524780,1252,shell_emit_ranked_overlay_cell_items,bootstrap,thiscall,inferred,ghidra-headless,3,Processes one ranked-overlay cell list for 0x0052a2f0. It samples shell range thresholds through 0x00533180 and 0x00533160 filters cell items by distance and intensity derives an alpha-biased packed color from the caller input and emits accepted items into the current vertex24 span through layout helper 0x005468c0.,ghidra + rizin + llvm-objdump
0x00530030,591,runtime_object_query_selected_grouped_packet_overlap_against_input_segment,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared overlap-style query over the broader `0x23a` runtime-object family. The helper starts from the currently selected grouped `0x45`-byte subrecord and snapshots the same global packet source span used by `0x0052f500`, lazily refreshes the cached basis block at `[this+0x8e..+0xce]` when bit `0x04` is still set, transforms one caller-supplied input triplet through that basis, and then walks the remaining packet span at `0x00cc3b64/0x00cc3b5c`. For each candidate packet it assembles three packet-side vec3 triplets plus the transformed caller triplet and re-enters `geometry_query_five_vec3_separating_volume_overlap_predicate` `0x0052f1e0`, returning `1` on the first passing packet and `0` when the whole span fails. Current grounded caller is the world-side branch `0x005291ea`, so this is the safest current read for a selected-grouped-packet overlap query against one caller-provided segment or vector pair rather than a broad renderer.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + packet-overlap-query correlation"
0x005305c0,118,runtime_object_set_bit0_in_owned_entry_field_0xb0_across_list_0x79,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small list-bit propagation helper over owned entry list `[this+0x79]` in the broader `0x23a` runtime-object family. The function walks the list through `0x00556ef0/0x00556f00` and either sets or clears bit `0` in each live entry's dword `[entry+0xb0]` according to the caller's boolean. Current grounded callers are the specialization-side rebuild branches `0x0045cce7`, `0x0045cf90`, and one later sibling call at `0x00530857`, so this is the safest current read for propagating one mode bit across the owned-entry list rather than a generic iterator.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + owned-entry-flag propagation correlation"
0x00530640,35,runtime_object_construct_vtable_5dd1f0_and_seed_owner_handle_anchor,map,thiscall,inferred,objdump + caller inspection + local disassembly + rdata scan,2,"Tiny constructor wrapper for the sibling runtime-object table `0x005dd1f0`. The function installs vtable `0x005dd1f0`, forwards the caller's three setup arguments into `0x0052edf0`, and returns `this`. Current grounded callers are repeated descriptor or child-allocation branches including `0x0041ded0`, `0x0042ab05`, `0x00455148`, `0x00456e49`, `0x0045b95d`, `0x00474e61`, and `0x0055e71a`, so this is the safest current read for the shared seeded constructor wrapper rather than a subtype-specific allocator.","objdump + caller inspection + local disassembly + rdata scan + sibling-vtable correlation"
0x00530670,11,runtime_object_init_vtable_5dd1f0_and_reset_local_state,map,thiscall,inferred,objdump + caller inspection + local disassembly + rdata scan,1,"Tiny init wrapper for the sibling runtime-object table `0x005dd1f0`. The helper installs vtable `0x005dd1f0`, re-enters `0x0052ecd0`, and returns `this`. Current grounded callers are the local constructors `0x00455b24`, `0x00456104`, and `0x0048576c`, so the safest read is a minimal vtable-install plus shared-reset helper.","objdump + caller inspection + local disassembly + rdata scan + sibling-vtable correlation"
0x00530680,11,runtime_object_rebind_vtable_5dd1f0_and_tail_release_shared_lists,map,thiscall,inferred,objdump + caller inspection + local disassembly + rdata scan,1,"Tiny release-side wrapper for the sibling runtime-object table `0x005dd1f0`. The helper installs vtable `0x005dd1f0` and immediately tail-jumps into shared release body `0x0052ef70`. Current grounded callers are repeated cleanup paths including `0x0041df19`, `0x0045738b`, `0x0045c3fe`, `0x0045d729`, `0x004874f0`, and `0x0055e098`, so this is the safest current read for the sibling-table release thunk rather than a standalone destructor body.","objdump + caller inspection + local disassembly + rdata scan + sibling-vtable correlation"
0x00530690,133,runtime_object_copy_cached_blocks_from_source_object_and_recurse_children,map,thiscall,inferred,objdump + caller inspection + local disassembly + rdata scan,2,"Shared copy or refresh helper for the sibling runtime-object table `0x005dd1f0`. The function queries one 16-dword block from the caller-supplied source object through vtable slot `+0x44` and copies it into `[this+0x10e]`, triggers source slot `+0x10`, rebuilds local cached transform block `[this+0x14e]` through `0x0052f120` and source slot `+0x20`, copies the second 16-dword block from source slot `+0x44` into `[this+0xce]`, and then recursively applies the same copy to every child in list `[this+0x75]` before finally calling source slot `+0x0c`. Current grounded callers are the world-side branch `0x00528f18` and the local recursive descent inside this helper, so this is the safest current read for copying cached blocks from one source object into this object tree rather than a generic serializer.","objdump + caller inspection + local disassembly + rdata scan + sibling-vtable correlation + recursive-copy correlation"
0x00530720,242,runtime_object_publish_anchor_triplet_and_optionally_rebind_world_cell_handle,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared anchor-triplet publish helper over the broader `0x23a` runtime-object family. The function marks state byte `[this+0x20]` dirty with bit `0x02`, stores one caller-supplied absolute triplet into `[this+0x1e2/+0x1e6/+0x1ea]`, and when owner `[this+0x04]` is live quantizes the old and new X/Z anchor lanes through `0x005a10d0`, checks whether the world-cell binding changed, optionally detaches old handle `[this+0x08]` through `0x00533c20`, attaches the new slot through `0x00533bf0`, and then republishes the current anchor triplet through `0x0052fd60`. When owner `[this+0x04]` is null or the quantized cell does not change, it still writes the absolute triplet and republishes attached entries. Current grounded callers include `0x0040b4c7`, `0x004558ff`, `0x004871b3`, `0x0048dd50`, and the stream-load companion `0x00455870`, so this is the safest current read for publishing an absolute anchor triplet with optional world-cell rebinding rather than a generic vec3 setter.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + anchor-triplet correlation + world-binding correlation"
0x00530820,425,runtime_object_format_status_label_from_group_selection_and_shell_mode,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared fallback formatter beneath `0x00455860` over the broader `0x23a` runtime-object family. The helper only runs when shell gate `[0x006d4024+0x1146be]` is live, state bit `0x10` is clear, vtable slot `+0x14` returns zero, and the owned-entry bit propagator `0x005305c0` reports a live path. It then formats one caller-owned text buffer through `0x0051d8a0` using one of three structural branches: when grouped table `[this+0x14]` is null it emits a fixed fallback block via `0x5193f0/0x518de0`; when shell mode `[0x006d4024+0x1146be] == 1` it emits either literal `X` or the current grouped index `[this+0x21]`; otherwise it combines the current grouped float lane `[subrecord+0x10]`, the grouped index `[this+0x21]`, and one shell-mode-dependent wrapper block built through repeated `0x0051b700` calls before copying the final text. Current grounded callers are the shared thunk `0x00455860`, the placed-structure UI query wrapper `0x0040e9d0`, and the city-site status formatter `0x004207d0`, so this is the safest current read for a shared group-selection status-label formatter rather than a subtype-specific UI routine.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + fallback-formatter correlation"
0x005309d0,35,global_indexed_slot_table_initialize_once_0xccb880,map,cdecl,inferred,objdump + caller inspection + local disassembly,1,"One-shot initializer for the indexed global slot table rooted at `0x00ccb880`. When guard dword `0x00ccb9ec` is still zero, the helper clears `0x5a` dwords starting at `0x00ccb880`, then sets the guard to `1`; otherwise it returns immediately. Current grounded callers are the setup and shell branches `0x004820d3` and `0x00521084`, so this is the safest current read for lazy table initialization rather than a broader mode reset.","objdump + caller inspection + local disassembly + global-slot-table correlation"
0x00530a00,364,global_indexed_slot_table_service_or_release_one_slot_state,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Indexed service or release helper over the global slot table rooted at `0x00ccb880`. The function switches on slot state dword `[slot+0x00]`, using the per-slot handle, buffer, capacity, and length lanes at `[+0x08/+0x18/+0x14/+0x1c/+0x20/+0x24]`. The observed branches cover: releasing the primary handle when the state is `0/1`; a state-`2` growth path that reallocates and copies the payload buffer when `[slot+0x0c] < [slot+0x14]`; state `4` forwarding one handle plus a size pair through `0x005a4c57/0x005a464d`; state `5/6` releasing one or two payload buffers through `0x0053afd0` and `0x005a440d`; and a final cleanup step that clears active flag `[slot+0x01]` and drops the auxiliary buffer when needed. Current grounded callers include the live-world serializer paths `0x004424ee`, `0x00443cab`, `0x00445916`, the shell-side branches `0x0048496f`, `0x00489920`, `0x004e180a`, and the late global cleanup loop `0x00530bb1`, so this is the safest current read for servicing or releasing one indexed slot-table state rather than a file-family-specific bundle helper.","objdump + caller inspection + local disassembly + global-slot-table correlation + state-machine correlation"
0x00530b70,20,global_indexed_slot_table_query_slot_primary_handle_metric,map,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Tiny indexed query over the global slot table rooted at `0x00ccb880`. The helper resolves per-slot primary handle `[slot+0x08]` and forwards it into `0x005c7820`, returning the resulting metric unchanged. Current grounded callers are the serializer-side branch `0x00442676`, where the returned value is treated as a byte-count or size-like metric, so this is the safest current read for a primary-handle metric query rather than a direct pointer accessor.","objdump + caller inspection + local disassembly + global-slot-table correlation"
0x00530b90,11,global_indexed_slot_table_query_slot_primary_handle,map,cdecl,inferred,objdump + local disassembly,1,"Tiny pointer query over the global slot table rooted at `0x00ccb880`. The helper returns per-slot dword `[slot+0x08]` unchanged. Current evidence only grounds it as a direct primary-handle accessor.","objdump + local disassembly + global-slot-table correlation"
0x00530ba0,98,global_indexed_slot_table_release_slot_buffers_and_service_if_active,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Release-side companion over the global slot table rooted at `0x00ccb880`. When active flag `[slot+0x00]` is nonzero it first re-enters `0x00530a00`; when slot-owned payload flag `[slot+0x01]` is nonzero it frees the auxiliary payload and staging buffers at `[slot+0x18]` and `[slot+0x14]` through `0x005a1145`, then clears those pointers and the flag. Current grounded caller is the late cleanup path `0x00530bb1`, so this is the safest current read for releasing one slot's owned buffers and forcing a final service step when needed.","objdump + caller inspection + local disassembly + global-slot-table correlation + cleanup correlation"
0x00530c10,11,global_indexed_slot_table_query_slot_payload_length,map,cdecl,inferred,objdump + local disassembly,1,"Tiny indexed accessor over the global slot table rooted at `0x00ccb880`. The helper returns per-slot dword `[slot+0x14]` unchanged. Current evidence only grounds it as a payload-length or used-size accessor.","objdump + local disassembly + global-slot-table correlation"
0x00530c80,943,global_indexed_slot_table_open_or_reuse_named_stream_slot,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Primary open-or-reuse entry over the indexed slot table rooted at `0x00ccb880`. The helper first lazily initializes the table when needed, then for requested slot types `2` and `3` scans active entries whose type dword `[slot+0x0c]` is also `2/3`, comparing the caller-supplied name against stored pointer `[slot+0x20]` through `0x005a57cf`; type `2` also forces `0x00530ba0` cleanup before reusing the slot. Otherwise it locates a free slot, marks `[slot+0x00]` and `[slot+0x04]` active, stores the requested type into `[slot+0x0c]`, allocates and copies the caller name into `[slot+0x20]`, clears the size and cursor lanes, and then stages the backing resource according to type. Type `0` opens one direct handle through `0x005a4c57` with `(0x8301,0x80)`. Types `5` and `6` open through the same path with `(0x8000,0x100)` and then either stage the whole payload into owned buffer `[slot+0x1c]` or cap the staging window at `0x30d40`, sometimes collapsing type `6` back into type `5` when the payload is small. The recursive type-`3` branch allocates one scratch slot of length `0x30d40` plus one caller-sized owned buffer. Current callers span setup, shell, world, and serializer-loader paths including `0x00433260`, `0x00442463`, `0x00443a50`, `0x00444e83`, `0x00484939`, `0x0051c230`, and `0x0051eebe`, so this is the safest current read for opening or reusing one named bundle or stream slot rather than a file-family-specific loader.","objdump + caller inspection + local disassembly + global-slot-table correlation + bundle-slot correlation"
0x00531030,271,global_indexed_slot_table_write_bytes_into_slot,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Write-side byte pump over one indexed slot in the global table rooted at `0x00ccb880`. When slot type `[slot+0x0c]` is `0`, the helper forwards the caller buffer and requested length directly to handle `[slot+0x08]` through `0x005a464d`. When the type is `2` or `4`, it appends into owned buffer `[slot+0x1c]` at cursor `[slot+0x18]`, grows capacity `[slot+0x10]` in bounded chunks up to `0x186a0` through `0x005a125d/0x005a1145`, copies the caller bytes in place, advances the cursor, and raises used size `[slot+0x14]` when needed. Current callers are spread across the save and bundle serializer paths, including `0x004416af`, `0x0042ba7b`, `0x004462fa`, `0x004e1803`, `0x00517da4`, and the local tagged-header wrapper `0x00531340`, so this is the safest current read for the shared slot-table write primitive rather than a narrower world-only serializer.","objdump + caller inspection + local disassembly + global-slot-table correlation + shared-serializer correlation"
0x00531150,559,global_indexed_slot_table_read_bytes_from_slot,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Read-side byte pump over one indexed slot in the global table rooted at `0x00ccb880`. When slot type `[slot+0x0c]` is `1`, the helper reads directly from handle `[slot+0x08]` through `0x005a48c5`. When the type is `6`, it serves the caller from a rolling `0x30d40` staging buffer rooted at `[slot+0x1c]`, refilling that buffer from the same handle through `0x005a48c5` whenever cursor `[slot+0x18]` reaches the staged byte count and advancing the cursor after each copy. All remaining in-memory slot types read from owned buffer `[slot+0x1c]`, bounded by available count `[slot+0x14] - [slot+0x18]`, and then advance the cursor. Current callers are pervasive across setup, world, save, and runtime-object load paths, including `0x00412134`, `0x00413fa4`, `0x00443c39`, `0x00446ddb`, `0x00455888`, `0x00481a53`, `0x005186a6`, and the tagged-header and varlen readers `0x00531360/0x00531380`, so this is the safest current read for the shared slot-table read primitive rather than a file-family-specific chunk decoder.","objdump + caller inspection + local disassembly + global-slot-table correlation + shared-loader correlation"
0x00531340,20,global_indexed_slot_table_write_one_tagged_u32_header,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny write-side tagged-header wrapper over the same global slot table. The helper forwards the caller-supplied header dword in `EDX` into `0x00531030` with fixed length `4` and no auxiliary counter bump, using the current slot index in `ECX`. Current grounded callers are the many serializer-side tag brackets in world, scenario, and runtime-object save paths, including `0x0040b6b0`, `0x00413f3f`, `0x00441f40`, `0x00444f8a`, `0x004459df`, `0x0045b576`, and `0x005537f2`, so this is the safest current read for writing one tagged four-byte block header rather than a broader open-or-close primitive.","objdump + caller inspection + local disassembly + tagged-block correlation"
0x00531360,32,global_indexed_slot_table_read_one_tagged_u32_header_and_optionally_bump_counter,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny read-side tagged-header wrapper over the same global slot table. When the caller-supplied stack flag is nonzero it increments global dword `0x00ccb9e8`, then reads one four-byte header from the current slot through `0x00531150` into the caller-supplied `u32` destination. Current grounded callers are the many loader-side tag brackets in world, scenario, setup, and runtime-object paths, including `0x0040b5ee`, `0x00413f3f`, `0x0041e8f4`, `0x0042dbf9`, `0x00443c56`, `0x0045600c`, `0x0046fd87`, and `0x00553258`, so this is the safest current read for reading one tagged four-byte block header with an optional global counter bump rather than a broader chunk-open helper.","objdump + caller inspection + local disassembly + tagged-block correlation"
0x00531380,144,global_indexed_slot_table_read_varlen_heap_string,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared variable-length string reader built on top of `0x00531150`. The helper first frees the caller-owned destination pointer when nonnull, then reads a one-byte prefix. Prefix `0` leaves the destination null. Prefixes `1..0x7f` are treated as the byte length directly. Prefixes with bit `0x80` set read one extra byte and combine the low seven high bits with that second byte into a `u15` length. The helper then allocates that many bytes through `0x005a125d`, stores the new heap pointer to the caller slot, and reads the payload bytes through `0x00531150`. Current grounded callers include `runtime_object_load_tagged_string_triplet_and_reseed_scalar_bands` `0x00455fc0`, `placed_structure_specialization_load_payload_and_rebuild_transients` `0x0045c150`, and the later payload loader at `0x0045e594`, so this is the safest current read for the shared variable-length heap-string import helper rather than a narrower subtype loader.","objdump + caller inspection + local disassembly + varlen-string correlation"
0x00531410,128,global_indexed_slot_table_write_varlen_heap_string,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared variable-length string writer built on top of `0x00531030`. Null pointers emit a single zero byte. Nonnull pointers are measured as a NUL-terminated byte string plus terminator; lengths up to `0x7f` emit one prefix byte, while longer lengths emit two prefix bytes with the high seven bits flagged by `0x80`. The helper then writes the string payload bytes through `0x00531030`. Current grounded callers include `runtime_object_serialize_tagged_string_triplet_and_dispatch_slot_0x4c` `0x004559d0`, `placed_structure_specialization_serialize_payload_via_0x45b560` `0x0045b560`, and the city-entry-family serializer `0x0045c6f0`, so this is the safest current read for the shared variable-length heap-string save helper rather than a generic raw buffer writer.","objdump + caller inspection + local disassembly + varlen-string correlation"
0x00531490,27,global_indexed_slot_table_write_nul_terminated_string_without_length_prefix,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny raw string writer over the same slot-table byte pump. The helper computes the caller-supplied NUL-terminated string length plus terminator from `EDX` and forwards those bytes directly into `0x00531030` without any explicit prefix layer. Current grounded callers are the neighboring shell-side branches `0x00489396` and `0x004894ec`, so the safest current read is a direct NUL-terminated string write helper rather than a broader tagged serializer.","objdump + caller inspection + local disassembly + raw-string-write correlation"
0x005314b0,79,global_callback_0x5c8454_query_first_nonzero_result_up_to_index,map,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Small callback-driven selector over global dword `0x00ccba08`. The helper clears that global, then iterates indices `0..arg0`, repeatedly calling function pointer `0x005c8454` with one stack-local index slot plus the address of `0x00ccba08`, and stops when the callback returns zero; otherwise it increments the index and continues. On success it returns the value written to `0x00ccba08`, else `0`. Current grounded callers include `0x004fdb9b`, `0x0053166b`, `0x005321b4`, and `0x00532248`. The owning resource behind `0x005c8454` is still open, so the safest name stays structural.","objdump + caller inspection + local disassembly + callback-selector correlation"
0x00531500,25,global_query_requires_mode1_owner_and_nonnull_0xccb9f4,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny global gate. The helper returns `1` only when dword `[this+0x04]` equals `1` and global dword `0x00ccb9f4` is nonnull; otherwise it returns `0`. Current grounded callers include the neighboring UI or status-object branches `0x0046fd87`, `0x004b8f71`, `0x004c8243`, the setup-side branch `0x004e1a05`, and the runtime-object helper `0x00557e5c`. The exact owner of `0x00ccb9f4` remains open, so the safest read is still this structural gate rather than a named feature flag.","objdump + caller inspection + local disassembly + global-gate correlation"
0x00531520,59,global_mode1_gate_dispatch_0x557c90_0x557cb0_then_0x557cd0,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small mode-gated forwarding helper over global owner `0x00ccba00`. The helper only runs when `[this+0x04] == 1` and global `0x00ccb9f4` is still null. Under that gate it first queries `0x00557c90` on `0x00ccba00`; when that does not return `1` it queries `0x00557cb0`; and when either query returns `1` it tail-dispatches the same owner through `0x00557cd0`. Current grounded caller is the neighboring branch `0x004b8ea8`, so the safest current read is a small mode-1 gate plus two-stage dispatch wrapper rather than a fully named subsystem call.","objdump + caller inspection + local disassembly + mode-gated-forwarder correlation"
0x00531560,79,global_mode1_gate_dispatch_arg_selected_0x557d90_or_0x56a8e0_0x569ae0,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Mode-gated argument-selected forwarding helper spanning globals `0x00ccba00`, `0x00ccb9f8`, and `0x00ccb9fc`. The same gate applies: it only runs when `[this+0x04] == 1` and `0x00ccb9f4` is null. When selector arg1 is `0`, it forwards arg0 into owner `0x00ccba00` through `0x00557d90`. When selector arg1 is `2`, it forwards arg0 into `0x0056a8e0(0x00ccb9f8)` and then into `0x00569ae0(0x00ccb9fc)`. Current grounded callers span several shell and world-adjacent branches including `0x0043643b`, `0x00464b3b`, `0x004833c4`, `0x004feea4`, `0x00517a04`, and `0x005212ae`, so the safest current read is a small selector wrapper over three global owners rather than a named feature toggle.","objdump + caller inspection + local disassembly + mode-gated-forwarder correlation"
0x005315c0,91,affine_transform_three_float_outputs_by_matrix_3x4,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared affine transform helper over a 3x4 float matrix rooted at `ECX`. The helper reads three caller-supplied float slots from the output pointers at stack args `+0x04/+0x08/+0x0c`, multiplies them against matrix coefficients `[this+0x08..+0x30]`, adds translation lanes `[this+0x38/+0x3c/+0x40]`, and writes the transformed X, Y, and Z values back in place. Current grounded callers include `0x00569628`, `0x0056a1e2`, and `0x0056a5e5`, so this is the safest current read for the shared 3x4 affine point-transform helper rather than another mode gate.","objdump + caller inspection + local disassembly + affine-transform correlation"
0x00531620,32,global_mode1_gate_query_0x569720_or_return_fallback_0xccba0c,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small mode-gated query wrapper. When `[this+0x04] == 1` and global `0x00ccb9f4` is null, the helper dispatches owner `0x00ccb9fc` through `0x00569720`; otherwise it returns literal pointer `0x00ccba0c`. Current grounded caller is `0x004638f1`, so the safest current read is a gated query with one fixed fallback pointer rather than a named resource resolver.","objdump + caller inspection + local disassembly + mode-gated-query correlation"
0x00531640,129,global_mode1_gate_resolve_callback_string_match_index,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Mode-gated string-match index resolver built on top of `0x005314b0`. Under the same `[this+0x04] == 1 && 0x00ccb9f4 == 0` gate, the helper first queries one current string pointer from owner `0x00ccb9fc` through `0x00569720`, then enumerates callback-selected strings through `0x005314b0(index,1)` and compares them byte-for-byte until it finds an exact match. It returns the zero-based index of the first matching callback string, or the number of earlier nonmatching entries when the callback list is exhausted. Current grounded callers include `0x00464c80`, `0x004fdc10`, `0x004fe1db`, `0x004ff990`, and `0x00521276`, so the safest current read is a gated callback-string index resolver rather than a higher-level selector UI helper.","objdump + caller inspection + local disassembly + callback-selector correlation + string-match correlation"
0x005316d0,48,global_mode1_gate_forward_callback_selected_entry_to_0x569730,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Mode-gated forwarding helper above `0x005314b0`. Under the same `[this+0x04] == 1 && 0x00ccb9f4 == 0` gate, the helper resolves one callback-selected entry pointer through `0x005314b0(arg0,1)`, writes that pointer back to the stack-local argument slot, and then dispatches owner `0x00ccb9fc` through `0x00569730`. Current grounded callers include `0x004fdc38`, `0x004fe21c`, and `0x004ff99c`, so the safest current read is a small callback-entry forwarder rather than a standalone owner method.","objdump + caller inspection + local disassembly + callback-selector correlation + mode-gated-forwarder correlation"
0x00531710,26,global_mode1_gate_forward_three_arg_call_to_0x569660,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny mode-gated forwarding wrapper. When `[this+0x04] == 1` and `0x00ccb9f4` is null, it dispatches global owner `0x00ccb9fc` through `0x00569660`; otherwise it returns immediately. Current grounded callers are `0x0040b8e1` and `0x00464c21`. The current evidence only supports this structural gate-plus-forward description.","objdump + caller inspection + local disassembly + mode-gated-forwarder correlation"
0x00531730,26,global_mode1_gate_forward_six_arg_call_to_0x5696b0,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny mode-gated forwarding wrapper. When `[this+0x04] == 1` and `0x00ccb9f4` is null, it dispatches global owner `0x00ccb9fc` through `0x005696b0`; otherwise it returns immediately. Current grounded callers are `0x0040b8d0` and `0x0043ac4b`. The current evidence only supports this structural gate-plus-forward description.","objdump + caller inspection + local disassembly + mode-gated-forwarder correlation"
0x00531750,26,global_mode1_gate_forward_two_arg_call_to_0x569540,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny mode-gated forwarding wrapper. When `[this+0x04] == 1` and `0x00ccb9f4` is null, it dispatches global owner `0x00ccb9fc` through `0x00569540`; otherwise it returns immediately. Current grounded callers are `0x00464c21`, `0x0048434c`, `0x004fd1a5`, and `0x0055edee`. The current evidence only supports this structural gate-plus-forward description.","objdump + caller inspection + local disassembly + mode-gated-forwarder correlation"
0x00531770,32,global_mode1_gate_query_0x5695d0,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny mode-gated query wrapper. When `[this+0x04] == 1` and `0x00ccb9f4` is null, it dispatches global owner `0x00ccb9fc` through `0x005695d0` and returns that result; otherwise it returns `0`. Current grounded callers are `0x0046388e` and `0x004fdcb5`, so the safest current read is a small gated query rather than a named subsystem predicate.","objdump + caller inspection + local disassembly + mode-gated-query correlation"
0x00531790,27,global_mode1_gate_dispatch_0x56acd0_or_0x56ac50,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny mode-gated selector wrapper spanning global owner `0x00ccb9f8`. When `[this+0x04] == 1` and `0x00ccb9f4` is null, selector arg1 `0` dispatches `0x0056acd0(0x00ccb9f8)`, while selector arg1 `1` forwards arg0 into `0x0056ac50(0x00ccb9f8,arg0)`. Current grounded callers include `0x0043a342` and `0x0055412c`, so the safest current read is a two-way gated dispatch wrapper rather than a named settings setter.","objdump + caller inspection + local disassembly + mode-gated-forwarder correlation"
0x005317b0,63,global_mode1_gate_dispatch_0x569c40_or_0x56ac50,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny mode-gated selector wrapper spanning globals `0x00ccb9fc` and `0x00ccb9f8`. When `[this+0x04] == 1` and `0x00ccb9f4` is null, selector arg1 `0` forces stack arg0 to zero and dispatches owner `0x00ccb9fc` through `0x00569c40`; selector arg1 `1` forwards the original arg0 into `0x0056ac50(0x00ccb9f8,arg0)`. Current grounded callers are broad enough to prove reuse across shell and later world-adjacent paths, including `0x0040b7fc`, `0x0040c889`, `0x0043a50c`, `0x0045e3c2`, `0x004b87fc`, and `0x00554767`, so the safest current read is a gated two-way dispatch wrapper rather than a fully named subsystem method.","objdump + caller inspection + local disassembly + mode-gated-forwarder correlation"
0x00531800,52,global_null_0xccb9f4_guarded_call_0x56ae80_with_reentrancy_counter,map,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Tiny global-owner wrapper over `0x00ccb9f8`. When global `0x00ccb9f4` is null, the helper increments reentrancy counter `0x00ccb9f0`, forwards arg0 into `0x0056ae80(0x00ccb9f8,arg0)`, then decrements the same counter before returning. Current direct caller is `0x00531f69`, so the safest current read is a null-guarded call wrapper with a scoped reentrancy counter rather than a named subsystem service.","objdump + caller inspection + local disassembly + guarded-call correlation"
0x00531840,52,global_null_0xccb9f4_guarded_call_0x569cf0_with_reentrancy_counter,map,cdecl,inferred,objdump + local disassembly,1,"Tiny global-owner wrapper over `0x00ccb9fc`. When global `0x00ccb9f4` is null, the helper increments reentrancy counter `0x00ccb9f0`, forwards arg0 into `0x00569cf0(0x00ccb9fc,arg0)`, then decrements the same counter before returning. Current evidence grounds it structurally as the `0x00ccb9fc` sibling of `0x00531800`.","objdump + local disassembly + guarded-call correlation"
0x00531880,46,global_release_optional_handle_field_0x4c_when_0x624d58_is_1,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small release helper over one optional handle field at `[this+0x4c]`. When that field is not `-1` and global dword `0x00624d58` equals `1`, the helper first dispatches the handle through function pointer `0x005c83b8`, then through `0x005c8450`, and finally resets `[this+0x4c]` to `-1`. Current grounded callers are the local owner-family constructors or service branches `0x00531f69` and `0x00532294`, so the safest current read is an optional-handle release helper rather than a broader object teardown.","objdump + caller inspection + local disassembly + optional-handle correlation"
0x005318b0,10,spin_wait_until_global_reentrancy_counter_0xccb9f0_reaches_zero,map,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Tiny busy-wait helper over global reentrancy counter `0x00ccb9f0`. The function loops until that dword reaches zero, then returns. Current grounded callers are the neighboring owner-family methods in the `0x569a..0x56ae..` strip, so this is the safest current read for a spin-wait on the shared counter rather than a named scheduler primitive.","objdump + caller inspection + local disassembly + reentrancy-counter correlation"
0x005318c0,35,global_dispatch_0x56a970_or_0x569f30_based_on_0xccba04,map,cdecl,inferred,objdump + local disassembly,1,"Tiny global dispatch selector. When global dword `0x00ccba04` is zero, it dispatches owner `0x00ccb9f8` through `0x0056a970`; otherwise it dispatches owner `0x00ccb9fc` through `0x00569f30`. The current evidence grounds it only as a small owner-family selector between the two globals.","objdump + local disassembly + global-owner-selector correlation"
0x005318f0,280,global_owner_family_construct_0xccb9f8_0xccb9fc_and_0xccba00_then_arm_mode1_flag,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Primary constructor or bootstrap path for the neighboring global-owner family. The helper first registers fixed literal `0x005dd240` through the `0x005c847c/0x0056c840/0x005c83b4` strip, allocates `0x30` bytes and constructs owner `0x00ccb9f8` through `0x0056aee0`, then allocates `0x64` bytes and constructs owner `0x00ccb9fc` through `0x0056a6e0`, forwarding the caller-supplied arg0 into `0x005698a0`. It then allocates one `0x108`-byte object into global `0x00ccba00`, zeroes its leading dword, seeds `[obj+0x104] = 1.0f`, and when all three globals are live it sets mode flag `[this+0x04] = 1`. Failure paths release partially constructed owners through `0x0056a740/0x0056af20` and free the backing allocations through `0x0053b080`. Current grounded callers are the neighboring owner-family wrappers `0x00531c3d` and `0x005321be`, so the safest current read is a shared global-owner constructor plus mode-flag arming path rather than a file-specific loader.","objdump + caller inspection + local disassembly + global-owner-family correlation"
0x00531a10,496,global_owner_family_shutdown_with_optional_scalar_fade_and_full_teardown,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Primary shutdown or teardown owner for the same global-owner family. The helper first raises global override gate `0x00ccb9f4`, then, when mode flag `[this+0x04]` is live and caller arg0 is zero, runs a short fade loop over scalar lanes `[0x00ccba00+0x104]` and `[0x00ccb9fc+0x58]` by repeatedly re-entering `0x00557d90(0x00ccba00,...)`, `0x00569ae0(0x00ccb9fc,...)`, and `0x00569ca0(0x00ccb9fc)` with one `0x10`-tick sleep through function pointer `0x005c81f0`. It then spin-waits on `0x005318b0`, dispatches the three global owners through `0x00557cd0`, `0x0056a880`, `0x00569a80`, `0x00569d90`, and `0x0056aeb0`, releases optional handle `[this+0x4c]` through `0x00531880`, tears the globals down through `0x0053b080`, clears mode flag `[this+0x04]`, and finally drops override gate `0x00ccb9f4` back to `0`. Current grounded callers are the local rebuild and destructor side at `0x00531c26`, `0x00532213`, and `0x0053224b`, so this is the safest current read for the full owner-family shutdown with optional scalar fade rather than a one-shot stop helper.","objdump + caller inspection + local disassembly + global-owner-family correlation + fade-loop correlation"
0x00531c00,304,global_owner_family_rebuild_from_string_and_seed_default_scalars,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared rebuild owner for the same global-owner family. The helper first force-shuts the current family through `0x00531a10(this,1)`, copies the caller string into a local stack buffer, reconstructs the three global owners through `0x005318f0`, and when mode flag `[this+0x04]` is live seeds the default active state through `0x005696b0(0x00ccb9fc,...)`, `0x00569660(0x00ccb9fc,...)`, `0x00557d90(0x00ccba00, shell_scalar*0x005c9c80)`, `0x0056a8e0(0x00ccb9f8, shell_scalar)`, and `0x00569ae0(0x00ccb9fc, shell_scalar)`. Current grounded callers are controller-side rebuild helpers `0x0053224b`, `0x0053225b`, and the settings-window branch `0x004ffc80`, so this is the safest current read for the shared rebuild-from-string plus default-scalar seed path rather than another small wrapper.","objdump + caller inspection + local disassembly + global-owner-family correlation + rebuild correlation"
0x00531d30,144,global_owner_family_refresh_primary_scalar_and_dispatch_0x557e50,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Active-mode service wrapper over the same owner family. When mode flag `[this+0x04]` is live and override gate `0x00ccb9f4` is clear, the helper refreshes the primary scalar on owner `0x00ccba00` from one shell-side scalar, optionally toggles the neighboring `0x00557c90/0x00557cb0/0x00557cd0` branch when `[0x00ccba00+0x104]` stays positive, and then dispatches `0x00557e50(0x00ccba00,arg0,[0x00ccb9f8+0x2c])`. Current grounded caller is the local callback service strip under `0x00531fd0`, so the safest current read is a primary-scalar refresh plus dispatch wrapper rather than a named backend command.","objdump + caller inspection + local disassembly + scalar-refresh correlation"
0x00531dc0,80,global_owner_family_query_primary_scalars_idle_or_nonpositive,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small active-mode predicate over the same owner family. When mode flag `[this+0x04]` is live and override gate `0x00ccb9f4` is clear, the helper checks readiness-style scalar lanes `[0x00ccb9f8+0x20]` and `[0x00ccb9fc+0x58]` against the local zeroish threshold at `0x005c8598` and returns `1` only on the idle or nonpositive side of that split; otherwise it returns `0`. Current grounded caller is the local settings or service strip at `0x004ffcf0`, so the safest current read is a shared dual-scalar idle predicate rather than a named backend-health query.","objdump + caller inspection + local disassembly + scalar-idle correlation"
0x00531e50,64,shell_audio_service_dispatch_named_string_event_if_ready,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"String-driven sibling of `shell_audio_service_apply_indexed_feedback_event_if_ready` `0x00531e10`. The helper only dispatches when service mode dword `[this+0x04]` equals `1`, override gate `0x00ccb9f4` is clear, the secondary readiness scalar at `[0x00ccb9fc+0x58]` passes the local positive check, and the caller string is nonempty; on the ready path it tail-jumps into `0x0056a520`. Current grounded caller is `placed_structure_specialization_service_timed_anim_light_and_random_sound_variants` `0x0045baf0`, which uses this as the final named-event sink for the `rnd_%1_%2.wav` and anim or light family.","objdump + caller correlation + local disassembly + readiness-gate correlation + named-event correlation"
0x00531e90,64,global_owner_family_stage_16_dword_payload_block_and_mark_ccb9fc_mode2,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Active-mode staging helper over the same owner family. When mode flag `[this+0x04]` is live and override gate `0x00ccb9f4` is clear, the helper marks byte `[this+0x48] = 1`, copies one caller-supplied 16-dword block into local storage `[this+0x08..+0x44]`, and then forces mode dword `[0x00ccb9fc+0x60] = 2`. Current grounded caller is the local controller-side path around `0x005322c0`, so the safest current read is a staged payload-block copy plus mode-2 mark rather than a named decode routine.","objdump + caller inspection + local disassembly + staged-payload correlation"
0x00531ed0,32,global_owner_family_query_ccb9f8_field_0x2c_when_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny active-mode query wrapper. When mode flag `[this+0x04]` is live and override gate `0x00ccb9f4` is clear, the helper returns dword `[0x00ccb9f8+0x2c]`; otherwise it returns `0`. Current grounded caller is the neighboring controller family at `0x005322b2`, so the safest current read is the shared `0x00ccb9f8+0x2c` query wrapper rather than a named selector.","objdump + caller inspection + local disassembly + shared-field-query correlation"
0x00531ef0,80,global_owner_family_lookup_key_in_selected_hash_root,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Active-mode selected-hash lookup helper over the same owner family. When mode flag `[this+0x04]` is live and override gate `0x00ccb9f4` is clear, selector arg1 `0` probes key arg0 through `0x0053dae0` against hash root `[0x00ccb9f8+0x0c]`, while selector arg1 `1` probes the sibling hash root `[0x00ccb9fc+0x14]`. Current grounded callers include settings-window and neighboring shell branches at `0x004ffcdc`, `0x004ffe51`, and `0x004ffecb`, so the safest current read is a selected hash-root key lookup rather than a fully named registry query.","objdump + caller inspection + local disassembly + hash-root correlation"
0x00531f40,80,global_owner_family_service_ccb9f8_ccb9fc_and_clear_staged_flag,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Active-mode service helper over the same owner family. The helper optionally releases handle `[this+0x4c]` through `0x00531880`, dispatches owner `0x00ccb9f8` through `0x0056ae30`, dispatches owner `0x00ccb9fc` through `0x00569ca0`, and finally clears staged flag byte `[this+0x48]`. Current grounded caller is the timed transition path `0x005322ed`, so the safest current read is a small paired-owner service pass plus staged-flag clear rather than another constructor or query.","objdump + caller inspection + local disassembly + paired-owner-service correlation"
0x00531f90,64,global_owner_family_register_selected_guarded_callback_0x531800_or_0x531840,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small callback-registration selector over the same owner family. When mode flag `[this+0x04]` is live and override gate `0x00ccb9f4` is clear, selector arg1 `0` installs callback target `0x00531800` through function pointer `0x005c83a8`, while selector arg1 `1` installs sibling callback target `0x00531840` through `0x005c83a4`. Current grounded caller is the controller-side bind path `0x005322d8`, so the safest current read is a selected guarded-callback registration helper rather than a broader scheduler primitive.","objdump + caller inspection + local disassembly + callback-registration correlation"
0x00531fd0,384,global_owner_family_timed_primary_scalar_transition_service,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Timed transition service over the same owner family. When override gate `0x00ccb9f4` is clear, the helper increments reentrancy counter `0x00ccb9f0`, branches on selector arg0, and then updates the primary scalar owner `0x00ccba00` from shell-derived values through `0x00557d90`, `0x00557c90`, `0x00557cb0`, and `0x00557cd0`, coordinating the transition with globals `0x00624d58` and `0x00624d60`. One branch seeds `0x00624d60` from the current owner scalar and another forces `0x00624d58 = 1` plus `0x00624d60 = -1.0f` before returning. All exits decrement the same reentrancy counter. Current grounded caller is the controller-side bind helper `0x005322d8`, so the safest current read is a timed primary-scalar transition service rather than a narrow audio-only callback.","objdump + caller inspection + local disassembly + scalar-transition correlation + reentrancy-counter correlation"
0x00532150,176,global_owner_family_controller_construct_and_optionally_bootstrap_selected_entry,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Constructor for the local controller object that fronts the same global-owner family. The helper zeroes the controller block, seeds multiple default float lanes to `1.0f`, clears or presets local flags and handles, and when caller arg0 is not `-1` resolves one callback-selected entry through `0x005314b0` before forwarding it into `0x005318f0`. On successful bootstrap it also allocates one `0x44`-byte local payload into `[this+0x00]` and initializes that payload through `0x00564570`. Current grounded caller is the broader controller allocation path `0x00521254`, so the safest current read is a local controller constructor plus optional selected-entry bootstrap rather than the global owner constructor itself.","objdump + caller inspection + local disassembly + controller-constructor correlation"
0x00532200,48,global_owner_family_controller_shutdown_and_release_payload,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Destructor-side companion to `global_owner_family_controller_construct_and_optionally_bootstrap_selected_entry` `0x00532150`. When controller mode flag `[this+0x04]` is live, the helper first shuts the shared owner family down through `0x00531a10(this,0)`, then releases optional local payload `[this+0x00]` through `0x00564560` and `0x0053b080`. Current grounded caller is the local lifetime strip under `0x005212a6`, so the safest current read is controller shutdown plus payload release rather than a global-owner reset.","objdump + caller inspection + local disassembly + controller-destructor correlation"
0x00532230,48,global_owner_family_controller_rebuild_from_selected_callback_entry,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small controller-side rebuild wrapper over the same owner family. When global owner `0x00ccb9fc` exists, the helper resolves one callback-selected entry through `0x005314b0` and forwards that string into `0x00531c00(this,...)`. Current grounded callers are settings-window backend-selection branches at `0x004fefb0` and the neighboring controller strip, so the safest current read is a rebuild-from-selected-entry helper rather than another query.","objdump + caller inspection + local disassembly + controller-rebuild correlation"
0x00532260,176,global_owner_family_controller_rebind_primary_handle_and_register_transition_callback,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Controller-side bind or rebinding owner for the same global-owner family. When controller mode flag `[this+0x04]` is live and override gate `0x00ccb9f4` is clear, the helper optionally releases existing handle `[this+0x4c]` through `0x00531880`, registers transition callback `0x00531fd0` through function pointer `0x005c83f4`, stores the returned handle in `[this+0x4c]`, seeds selector `[this+0x50]`, resets global float `0x00624d60 = -1.0f`, and then drives one branch-specific initialization strip through `0x00557d90` plus function pointers `0x005c8400`, `0x005c83c8`, and `0x005c83a0` with mode selectors `1`, `2`, or `3`. Current grounded callers include shell-side branches at `0x0048314c`, `0x00483ffc`, `0x0048431f`, and `0x00517444`, so the safest current read is a primary-handle rebind plus transition-callback registration owner rather than a one-shot play command.","objdump + caller inspection + local disassembly + controller-bind correlation + transition-callback correlation"
0x00533ba0,39,shell_grid_get_nearby_presentation_cell,bootstrap,thiscall,inferred,ghidra-headless,4,Returns one tile-grid cell from the nearby-presentation layer rooted at [this+0x1671]. The helper converts world coordinates into 16x16 tile coordinates multiplies by the grid width stored at [this+0x15d9] and indexes the cell-pointer table at [this+0x1671].,ghidra + rizin + llvm-objdump
0x00533bc0,11,shell_nearby_presentation_queue_push_back_payload,bootstrap,thiscall,inferred,objdump + local disassembly + intrusive-queue correlation,2,"Tiny queue append helper over the shell nearby-presentation queue root `[this+0x166d]`. The helper forwards the caller payload into `intrusive_queue_push_back` `0x00556e10`.","objdump + local disassembly + intrusive-queue correlation"
0x00533bd0,11,shell_nearby_presentation_queue_remove_payload,bootstrap,thiscall,inferred,objdump + local disassembly + intrusive-queue correlation,2,"Tiny queue removal helper over the shell nearby-presentation queue root `[this+0x166d]`. The helper forwards the caller payload into `0x00556e80` on the same intrusive queue root.","objdump + local disassembly + intrusive-queue correlation"
0x00533be0,7,shell_query_nearby_presentation_queue_root,bootstrap,thiscall,inferred,objdump + local disassembly + field correlation,2,"Tiny getter for the shell nearby-presentation intrusive queue root `[this+0x166d]`.","objdump + local disassembly + field correlation"
0x00533bf0,37,shell_nearby_presentation_cell_queue_push_back_payload,bootstrap,thiscall,inferred,objdump + local disassembly + intrusive-queue correlation,2,"Cell-addressed append helper over the nearby-presentation cell table `[this+0x1671]`. The helper resolves one 16x16 tile cell from caller coordinates using width `[this+0x15d9]` and then pushes the payload into that cell's intrusive queue through `intrusive_queue_push_back` `0x00556e10`. Current grounded callers include the shared runtime-object world-binding paths `0x0052fdc0` and `0x00530720`.","objdump + local disassembly + intrusive-queue correlation + cell-table correlation"
0x00533c20,37,shell_nearby_presentation_cell_queue_remove_payload,bootstrap,thiscall,inferred,objdump + local disassembly + intrusive-queue correlation,2,"Cell-addressed removal helper over the nearby-presentation cell table `[this+0x1671]`. The helper resolves one 16x16 tile cell from caller coordinates using width `[this+0x15d9]` and removes the payload from that cell's intrusive queue through `0x00556e80`. Current grounded callers include the shared runtime-object world-binding paths `0x0052ef70`, `0x0052fdc0`, and `0x00530720`.","objdump + local disassembly + intrusive-queue correlation + cell-table correlation"
0x00533c50,30,world_region_border_overlay_get_chunk_queue_by_cell,bootstrap,thiscall,inferred,objdump + local disassembly + field correlation,2,"Tiny cell-addressed getter over the region-border overlay chunk table `[this+0x1679]`. The helper resolves one 16x16 chunk slot from caller coordinates using width `[this+0x15d9]` and returns that slot pointer.","objdump + local disassembly + field correlation + coarse-chunk correlation"
0x00533c70,37,world_region_border_overlay_chunk_queue_push_back_payload,bootstrap,thiscall,inferred,objdump + local disassembly + intrusive-queue correlation,2,"Cell-addressed append helper over the region-border overlay chunk table `[this+0x1679]`. The helper resolves one 16x16 chunk slot and forwards the caller payload into `intrusive_queue_push_back` `0x00556e10`.","objdump + local disassembly + intrusive-queue correlation + coarse-chunk correlation"
0x00533ca0,37,world_region_border_overlay_chunk_queue_remove_payload,bootstrap,thiscall,inferred,objdump + local disassembly + intrusive-queue correlation,2,"Cell-addressed removal helper over the region-border overlay chunk table `[this+0x1679]`. The helper resolves one 16x16 chunk slot and forwards the caller payload into `0x00556e80`.","objdump + local disassembly + intrusive-queue correlation + coarse-chunk correlation"
0x00533cd0,39,shell_grid_get_static_vertex24_cell,bootstrap,thiscall,inferred,ghidra-headless,4,Returns one tile-grid cell from the fixed-geometry vertex24 layer rooted at [this+0x167d]. The helper converts world coordinates into 16x16 tile coordinates multiplies by the grid width stored at [this+0x15d9] and indexes the cell-pointer table at [this+0x167d].,ghidra + rizin + llvm-objdump
0x00533db0,30,shell_grid_get_geographic_label_cell,bootstrap,thiscall,inferred,ghidra-headless,4,Returns one tile-grid cell from the geographic-label layer rooted at [this+0x1675]. The helper converts world coordinates into 16x16 tile coordinates multiplies by the grid width stored at [this+0x15d9] and indexes the cell-pointer table at [this+0x1675].,ghidra + rizin + llvm-objdump
0x00533dd0,37,shell_geographic_label_cell_queue_push_back_payload,bootstrap,thiscall,inferred,objdump + local disassembly + intrusive-queue correlation,2,"Cell-addressed append helper over the geographic-label cell table `[this+0x1675]`. The helper resolves one 16x16 tile cell from caller coordinates and forwards the payload into `intrusive_queue_push_back` `0x00556e10`.","objdump + local disassembly + intrusive-queue correlation + cell-table correlation"
0x00533e00,37,shell_geographic_label_cell_queue_remove_payload,bootstrap,thiscall,inferred,objdump + local disassembly + intrusive-queue correlation,2,"Cell-addressed removal helper over the geographic-label cell table `[this+0x1675]`. The helper resolves one 16x16 tile cell from caller coordinates and forwards the payload into `0x00556e80`.","objdump + local disassembly + intrusive-queue correlation + cell-table correlation"
0x00533e30,32,shell_grid_get_animated_quad_cell,bootstrap,thiscall,inferred,ghidra-headless,4,Returns one tile-grid cell from the animated-quad presentation layer rooted at [this+0x1681]. The helper converts world coordinates into 16x16 tile coordinates multiplies by the grid width stored at [this+0x15d9] and indexes the cell-pointer table at [this+0x1681].,ghidra + rizin + llvm-objdump
0x00533e50,32,shell_grid_get_ranked_overlay_cell,bootstrap,thiscall,inferred,ghidra-headless,4,Returns one tile-grid cell from the ranked secondary overlay layer rooted at [this+0x1685]. The helper uses the same 16x16 tile addressing and grid width field at [this+0x15d9] as the other shell cell-grid accessors and currently feeds 0x0052a2f0.,ghidra + rizin + llvm-objdump
0x00533e70,168,world_secondary_overlay_release_coarse_chunks_in_rect,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Rectangle-wide coarse-chunk release helper over the secondary overlay table rooted at `[this+0x1685]`. The helper clamps the caller-supplied world-grid rectangle to the live bundle dimensions `[this+0x15d9/+0x15d5]`, converts the surviving bounds to 16x16 chunk coordinates, walks every chunk slot in that coarse range, and when a chunk pointer is present releases or clears it through `0x0056b770(this)`. Current grounded callers include the late world-entry tail at `0x00444b48`, the secondary-grid overlay-cache service `world_service_secondary_grid_marked_cell_overlay_cache` `0x0044c670`, one neighboring world-side refresh branch at `0x0044d469`, and the shell-side world-mode branch at `0x00484f51`, so this is the safest current read for the shared coarse secondary-overlay rectangle reset helper rather than a one-shot startup scrub.","objdump + caller inspection + field correlation + coarse-chunk correlation + secondary-overlay correlation"
0x00533fe0,89,world_secondary_overlay_write_local_chunk_cell_value,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small write-side companion to the secondary overlay coarse-chunk family rooted at `[this+0x1685]`. The helper resolves the caller-supplied world-grid cell into one 16x16 chunk slot using width field `[this+0x15d9]`, keeps only the low local cell offsets inside that chunk, and when the chunk object exists delegates the local write or clear through `0x0056b000(chunk, world, x_local, y_local, arg2)`. Current grounded callers include the post-load `319` cleanup sweep through `world_run_post_load_generation_pipeline` `0x004384d0`, neighboring placed-structure or world-overlay branches at `0x00414f33`, `0x004158a6`, `0x0041ff3c`, and `0x00454ede`, and one later world-entry-side caller at `0x00444712`, so this is the safest current read for the shared local secondary-overlay chunk-cell write helper rather than a broad chunk reset or allocator.","objdump + caller inspection + field correlation + coarse-chunk correlation + write-side companion correlation"
0x00534160,259,world_secondary_overlay_ensure_coarse_chunk_and_seed_local_marks,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Shared coarse-chunk helper beneath the secondary overlay family rooted at `[this+0x1685]`. The helper converts the caller-supplied world-grid coordinates into one 16x16 chunk index using width field `[this+0x15d9]`, lazily allocates one `0x54`-byte chunk object into `[this+0x1685]` through `0x0053b070` when that slot is empty, initializes the new chunk from chunk-space coordinates through `0x0056af70`, and then re-enters `0x0056b580` up to the caller-supplied step count capped at `6` using the low-bit local offsets plus two extra caller parameters. Current grounded callers include the late secondary-grid overlay service `world_service_secondary_grid_marked_cell_overlay_cache` `0x0044c670`, the neighboring startup-side branch at `0x00447faf`, one earlier placed-structure overlay builder at `0x004157d2`, and one world-side surface branch at `0x004545b2`, so this is the safest current read for the shared coarse secondary-overlay chunk ensure-and-seed helper rather than a one-shot startup allocator.","objdump + caller inspection + field correlation + coarse-chunk correlation + secondary-overlay correlation"
0x005339a0,144,math_build_plane_from_three_xyz_points_store_abc_and_negd,bootstrap,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Reusable three-point plane-construction helper. The routine treats the first nine float arguments as three XYZ points, computes the cross product of the two edge vectors rooted at the first point, stores the resulting plane coefficients `A`, `B`, and `C` through the caller pointers in `ECX`, `EDX`, and the fourth stack pointer, and then stores `-(A*x0 + B*y0 + C*z0)` through the final out-pointer. Current grounded callers are the neighboring world-presentation geometry owners at `0x005346b8` and `0x005346ff`, which immediately package the four outputs as one local plane record, so the safest current read is a shared plane-equation builder rather than a presentation-only scoring helper.","objdump + caller inspection + local disassembly + plane-equation correlation"
0x00533a30,176,math_solve_plane_y_from_three_xyz_points_and_xz,bootstrap,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Reusable plane-sampling helper over the same three-point XYZ input family as `0x005339a0`. The routine rebuilds the plane coefficients from the first three points, derives the plane constant, substitutes the caller-supplied query `x` and `z` arguments, divides by coefficient `B`, and returns the solved height on the x87 stack. Current grounded callers are the neighboring world-presentation geometry owners at `0x0053458b` and `0x005345af`, which use it as the direct height interpolation step over one local three-sample patch, so the safest current read is a shared plane-height solver rather than a broader world-score helper.","objdump + caller inspection + local disassembly + plane-height correlation"
0x00534910,8,shell_world_presentation_query_staging_flag,bootstrap,thiscall,inferred,objdump + caller inspection + field correlation,2,"Tiny flag getter over the shared shell-side world-presentation bundle. The helper returns staging byte `[this+0x1588]` unchanged. Current grounded caller is the broad derived-surface rebuild owner `world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940`, which uses it only as the fast staging-presence test before sampling the live staging buffer or rebuilding the rectangle.","objdump + caller inspection + field correlation + staged-surface correlation"
0x00534920,8,shell_world_presentation_query_staging_buffer_root,bootstrap,thiscall,inferred,objdump + caller inspection + field correlation,2,"Tiny pointer getter over the shared shell-side world-presentation bundle. The helper returns the live staging dword buffer root `[this+0x1584]` unchanged. Current grounded caller is `world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940`, which samples that root only after the neighboring staging-flag getter `0x00534910` succeeds.","objdump + caller inspection + field correlation + staged-surface correlation"
0x00534930,448,shell_world_presentation_stage_overlay_rect_from_normalized_bounds,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly + field correlation,3,"Shared rect-staging owner over the shell-side world-presentation bundle. When staging flag `[this+0x1588]` is clear, the helper quantizes the caller-supplied normalized bounds into scaled surface coordinates using width or height fields `[this+0x157c/+0x1580]`, stores the surviving rectangle into `[this+0x1589..+0x1595]`, allocates one dword staging buffer at `[this+0x1584]`, marks staging byte `[this+0x1588] = 1`, and copies the current per-strip surface rows through lazily materialized strip objects from `[this+0x08..]` into that buffer. It optionally returns the staged rect origin through two out-pointers. Current grounded callers include earlier overlay builders at `0x00418032`, startup or world-entry siblings at `0x0044664c` and `0x00447428`, the late secondary-grid overlay path at `0x0044c9e6`, the broad derived-surface rebuild owner at `0x0044ea0a`, the transport or pricing preview builder at `0x0044f861`, the shell-side world branch at `0x0047a184`, and one terrain-preview caller at `0x004f7ee4`, so this is the safest current read for the shared staged-overlay rect capture helper rather than a generic allocator or the later publish step.","objdump + caller inspection + local disassembly + field correlation + staged-surface correlation + normalized-bounds quantization"
0x00534af0,350,shell_world_presentation_publish_staged_overlay_surfaces_and_release_buffer,bootstrap,thiscall,inferred,objdump + caller inspection + field correlation,3,"Shared publish-or-teardown helper over the shell-side world-presentation bundle. The helper first requires staging flag byte `[this+0x1588]`. In normal publish mode `arg0=0` it walks the staged dword buffer at `[this+0x1584]` across the rectangle `[this+0x1589..+0x1591] x [this+0x158d..+0x1595]`, lazily materializes up to `0xff` temporary strip or surface objects through `0x00541970` using the per-slot roots at `[this+0x08..]`, copies staged row dwords into those objects, and then finalizes each populated slot through `0x005438d0`. In teardown-only mode `arg0!=0` it skips the publish sweep and goes straight to cleanup. Both paths then clear `[this+0x1588]`, free the staging buffer at `[this+0x1584]`, and null that pointer. Current grounded callers include the late secondary-grid overlay path at `0x0044cdff`, startup-side and neighboring world branches at `0x00446691`, `0x00447754`, `0x0044f63b`, and `0x0044fada`, earlier overlay builders at `0x004180a8`, `0x004184bf`, and `0x00418584`, plus shell-side callers at `0x0047b061` and `0x004f5f74`, so this is the safest current read for the shared staged-overlay surface publish-and-release helper rather than a world-only renderer or a pure destructor.","objdump + caller inspection + field correlation + staged-surface correlation + publish-vs-teardown correlation"
0x00534c50,32,shell_world_presentation_query_scaled_surface_dimensions,bootstrap,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny dimension query over the shared shell-side world-presentation bundle. The helper reads dwords `[this+0x157c]` and `[this+0x1580]`, shifts both left by two, and writes the results to the caller-supplied out-pointers as one scaled width-height pair. Current grounded callers first resolve the live presentation object through the shell owner at `0x006d4024` or the neighboring bundle resolver and then use these scaled dimensions in overlay, bounds, or allocation setup, including the late secondary-grid overlay path at `0x0044ca3e`, neighboring world-side branches at `0x0044ea34` and `0x0044f876`, earlier placed-structure overlay builders at `0x0041538a` and `0x00417fad`, and one shell-side allocator at `0x004f7f0a`, so this is the safest current read for the shared scaled surface-dimension query rather than a world-only or startup-only helper.","objdump + caller inspection + field correlation + shell-world-bundle correlation"
0x00534e10,64,world_secondary_raster_query_cell_class_in_set_1_3_4_5,map,thiscall,inferred,objdump + caller inspection + raster-cell correlation,3,"Tiny reusable predicate over one 3-byte cell record in the secondary raster family rooted at `[this+0x165d]` with row stride `[this+0x15dd]`. The helper resolves the requested cell from caller-supplied world-grid coordinates, masks the low three class bits from the first byte, and returns `1` when that class is `1`, `3`, `4`, or `5`, else `0`. Current grounded callers span many world-side placement, overlay, and scan branches including `placed_structure_validate_projected_candidate_placement` `0x004197e0`, `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0`, the late world-entry tail around `0x004481a6`, and one secondary-grid sibling under `0x0044c450`, so this is the safest current read for the shared secondary-raster class-set predicate rather than a startup-only helper.","objdump + caller inspection + raster-cell correlation + late-world-tail correlation"
0x00534f60,28,world_presentation_base_init_and_clear_surface_owner_field_0x154c,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small base initializer for the world-presentation owner family. The helper installs vtable `0x005dd25c`, clears dword `[this+0x154c]`, and then re-enters the lower shared initializer `0x00532590` before returning `this`. Current grounded callers are `world_construct_root_and_load_bundle_payload_thunk` `0x0044e910` and the neighboring load-side branch at `0x0044cf73`, so this is the safest current read for the immediate presentation-owner base init rather than a broader world-root constructor.","objdump + caller inspection + local disassembly + world-presentation-family correlation"
0x00534f80,50,world_presentation_release_transient_surface_handle_0x478_and_clear_flag_0x159b,map,thiscall,inferred,objdump + caller inspection + field correlation,2,"Small release helper over one transient surface-handle field in the world-presentation owner family. When pointer `[this+0x478]` is non-null the helper finalizes it through `0x00542c90`, frees it through `0x0053b080`, clears `[this+0x478]`, and then clears byte `[this+0x159b]`. Current grounded callers include the world-side status or action strip around `0x00452fa5`, `0x0045339d`, `0x004535f8`, and `0x00453617`, plus one neighboring world branch at `0x0045074f`, so the safest current read is a focused transient-surface release helper rather than a full presentation teardown.","objdump + caller inspection + field correlation + transient-surface correlation"
0x00534e50,50,world_secondary_raster_query_cell_class_in_set_1_4,map,thiscall,inferred,objdump + caller inspection + raster-cell correlation,3,"Tiny reusable companion predicate over the same 3-byte secondary-raster cell family rooted at `[this+0x165d]` with row stride `[this+0x15dd]`. The helper resolves one caller-selected world-grid cell, masks the low three class bits from the first byte, and returns `1` only when that class is `1` or `4`, else `0`. Current grounded callers include the transportation or pricing grid pass `world_compute_transport_and_pricing_grid` `0x0044fb70`, the live-world `.smp` serializer `world_runtime_serialize_smp_bundle` `0x00446240`, and several neighboring world-side scan or presentation branches at `0x00448c2f`, `0x00449d46`, `0x0044ec29`, `0x00451016`, and `0x0047a551`, which makes this the safest current read for the shared secondary-raster class-subset predicate rather than a transport-only helper.","objdump + caller inspection + raster-cell correlation + transport-grid correlation + serializer correlation"
0x00534e90,48,world_secondary_raster_query_cell_marked_bit,map,thiscall,inferred,objdump + caller inspection + raster-cell correlation,3,"Tiny reusable bit query over the same 3-byte secondary-raster cell family rooted at `[this+0x165d]` with row stride `[this+0x15dd]`. The helper resolves one cell from caller-supplied world-grid coordinates, reads the 16-bit companion word from that cell record, and returns bit `9` as a boolean marked-state flag. Current grounded callers include the secondary-grid overlay-cache service `world_service_secondary_grid_marked_cell_overlay_cache` `0x0044c670`, neighboring world scan or mutation branches at `0x004499a6`, `0x00449bdf`, and `0x00450f69`, plus one shell-side or editor-adjacent caller at `0x004a0e72`, which makes this the safest current name for the shared secondary-raster marked-bit predicate.","objdump + caller inspection + raster-cell correlation + secondary-grid overlay correlation"
0x00534ec0,56,world_secondary_raster_query_cell_class_in_set_2_4_5,map,thiscall,inferred,objdump + caller inspection + raster-cell correlation,3,"Tiny reusable class-subset predicate over the same 3-byte secondary-raster family rooted at `[this+0x165d]` with row stride `[this+0x15dd]`. The helper resolves one caller-selected world-grid cell, masks the low three class bits from the first byte, and returns `1` only when that class is `2`, `4`, or `5`, else `0`. Current grounded callers include neighboring world-side setup, scan, and presentation branches around `0x00446418`, `0x00449c88`, `0x0044bdfc`, `0x0044dd78`, `0x0044ec51`, `0x0044f30e`, `0x0044f445`, `0x00450f7a`, and `0x004fa86c`, plus serializer-adjacent paths under `0x00446240`, so this is the safest current read for the shared secondary-raster class-subset predicate rather than a more player-facing terrain label.","objdump + caller inspection + raster-cell correlation + serializer correlation"
0x00534f00,52,world_secondary_raster_query_cell_class_in_set_3_5,map,thiscall,inferred,objdump + caller inspection + raster-cell correlation,3,"Tiny reusable class-subset predicate over the same 3-byte secondary-raster family rooted at `[this+0x165d]` with row stride `[this+0x15dd]`. The helper resolves one caller-selected world-grid cell, masks the low three class bits from the first byte, and returns `1` only when that class is `3` or `5`, else `0`. Current grounded callers include neighboring world-side setup, serializer, and presentation branches around `0x00446240`, `0x00448cbf`, `0x0044dbcd`, `0x0044ec3d`, `0x0044ede9`, `0x0044ee0a`, `0x0044ef7a`, `0x0044f131`, `0x0044f1b5`, `0x0045105e`, `0x0047a569`, and `0x004df627`, so this is the safest current read for the shared secondary-raster class-subset predicate rather than a more player-facing terrain label.","objdump + caller inspection + raster-cell correlation + serializer correlation"
0x0053fda0,96,shell_service_one_object_child_queue_and_deferred_state,shell,thiscall,inferred,objdump + analysis-context,4,Services one shell object beneath shell_runtime_prime. The helper optionally notifies the global shell controller at 0x006d4024 through 0x0051f950 when [this+0x5c] is nonnull then walks the child or service-node list rooted at [this+0x70]. For each child it conditionally signals deferred work through shell_signal_deferred_work_item_shutdown 0x0051f1d0 and dispatches the child through vtable slot +0x18. If byte [this+0x1d] is set the tail path also jumps through 0x0051f930 on the same shell controller. Current static context places it under shell_runtime_prime 0x00538b60 on the null-0x006cec78 mode-4 service path.,objdump + analysis-context + caller context
0x00539fb0,924,shell_emit_geographic_label_frame_vertex24_records,bootstrap,thiscall,inferred,ghidra-headless,4,Expands the current geographic-label item into cached frame vertex24 records inside the caller buffer. The helper patches packed alpha into up to sixteen prebuilt 0x18-byte records copies additional 24-byte frame blocks from fixed item offsets and returns the emitted vertex count for the label border or backing geometry.,ghidra + rizin + llvm-objdump
0x0053a440,14,shell_set_geographic_label_item_alpha,bootstrap,thiscall,inferred,ghidra-headless,4,Stores an 8-bit alpha input into the high-byte color field at [this+0x5b] for the current geographic-label item before frame or text emission.,ghidra + rizin + llvm-objdump
0x0053a960,723,shell_emit_geographic_label_text_span,bootstrap,thiscall,inferred,ghidra-headless,4,Builds and emits one geographic-label text span for the current cell item. The helper calls the item vtable at +0x10 to materialize a null-terminated display string up to 0x12c bytes computes placement from item float fields and shell service state checks visibility through the shell bundle and forwards the resolved text payload into the presentation path through 0x005519f0. The item family aligns with gpdLabelDB and 2DLabel.imb rather than the parallel city assets.,ghidra + rizin + llvm-objdump
0x00543f10,853,layout_state_bind_presentation_asset_bundle,bootstrap,thiscall,inferred,ghidra-headless,4,Initial bind-time asset loader for the layout state's presentation node at [this+0x25df]; pulls a fixed presentation bundle through the node vtable at +0x5c and +0x60 including standalone assets stored around 0x2643 0x2647 0x264b 0x264f 0x2653 0x265b 0x265f and 0x2663 plus a 64-entry asset bank at 0x31ab while advancing an internal asset-offset cursor at [this+0x2543].,ghidra + rizin
0x00544290,195,layout_state_publish_local_descriptor_0x352f_from_integer_span_pair,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Local descriptor-publish helper in the layout-state family. The helper derives one normalized span scalar from the caller's two integer inputs, combines that value with local scalar lanes `[this+0x25eb/+0x25ef/+0x25f3]`, builds one `0x100`-byte descriptor rooted at `[this+0x352f]` through `0x0056e41a`, stores one derived shell-scaled scalar into `[this+0x36f9]`, and publishes that descriptor through node slot `+0x94` on the bound presentation node `[this+0x25df]` for selector `3`. Current grounded callers are the neighboring rect and span owners `0x00548120`, `0x00548180`, and `0x005482e0`, so this is the safest current read for publishing local descriptor `[+0x352f]` from an integer span pair rather than a generic math helper.","objdump + caller inspection + local disassembly + layout-state correlation + local-descriptor correlation"
0x00544360,208,layout_state_reset_local_descriptor_0x34ef_to_identity_and_publish,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Identity-reset companion to `0x00544290` in the same layout-state family. The helper zeroes the local `0x100`-byte descriptor block rooted at `[this+0x34ef]`, seeds the four diagonal scalar lanes `[+0x34ef/+0x3503/+0x3517/+0x352b]` to `1.0f`, and publishes that block through node slot `+0x94` on the bound presentation node `[this+0x25df]`. Current grounded callers include the neighboring rect and span owners `0x00548120` and a wider set of shell presentation rebuild paths such as `0x00524d05`, `0x00528805`, `0x00529dab`, and `0x0054d93a`, so this is the safest current read for resetting local descriptor `[+0x34ef]` to identity and publishing it rather than a standalone memset wrapper.","objdump + caller inspection + local disassembly + layout-state correlation + local-descriptor correlation"
0x00544cb0,64,layout_state_publish_property_pair_0x0d_0x0e_for_selector3,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small property-pair publisher in the same layout-state family. The helper forwards one caller-supplied byte value into bound-node property groups `0x0d` and `0x0e`, both for selector `3`, through vtable slot `+0xfc` on `[this+0x25df]`. Current evidence only supports this structural property-pair publish description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00544cf0,48,layout_state_clear_property_pair_0x0d_0x0e_for_selector2,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny clear sibling to `0x00544cb0` in the layout-state family. The helper writes `0` into bound-node property groups `0x0d` and `0x0e` for selector `2` through vtable slot `+0xfc` on `[this+0x25df]`. Current evidence only supports this structural clear helper description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00544d20,96,layout_state_set_property_pair_0x0d_0x0e_for_selector1_to_1,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small arming helper over the same layout-state property strip. The helper first clears bound-node property groups `0x0d` and `0x0e` for selector `1`, then republishes both groups with literal value `1` through vtable slot `+0xfc` on `[this+0x25df]`. Current evidence only supports this structural selector-`1` property-pair arm description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00544d80,32,layout_state_publish_property_0x3c_packed_dword,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny packed-property setter over the bound presentation node `[this+0x25df]`. The helper forwards one caller-supplied dword into property `0x3c` through node vtable slot `+0xc8`. Current evidence only supports this structural packed-dword publish description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00544da0,48,layout_state_publish_property_0x3c_with_cached_rgb_and_alpha_byte,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small color-pack sibling to `0x00544d80` in the layout-state family. The helper reads cached RGB lanes from `[this+0x25a3]`, masks them down to `0x00ffffff`, combines that value with one caller-supplied alpha byte in the high lane, and publishes the packed result into property `0x3c` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural cached-RGB-plus-alpha publisher description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00544dd0,32,layout_state_publish_property_group_0x0b_for_selector_with_value,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny grouped-property publisher over the same bound node. The helper forwards its two caller-supplied dwords as selector and value into property group `0x0b` through node vtable slot `+0xfc` on `[this+0x25df]`. Current evidence only supports this structural grouped-property publish description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00544df0,320,layout_state_apply_capability_and_mode_gated_property_strip_0x1d_0x13_0x14_0x12,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader property-strip owner in the layout-state family. The helper first checks shell capability byte `[0x006d4024+0x11422e]` and publishes property `0x1d` on the bound node `[this+0x25df]`, then conditionally seeds fixed property pair `0x13 = 5` and `0x14 = 6` when state byte `[this+0x83c+0x21]` is live. After that it derives one per-slot mode value from state dword `[this+0x83c+0x29]` and local slot count `[this+0x258f]`, publishes property `0x13` across every active slot, and finally publishes property `0x12` across the same slot span with the derived mode selector. Current grounded caller is the neighboring layout-state owner branch `0x0052bc18`, so this is the safest current read for the capability and mode-gated `0x1d/0x13/0x14/0x12` property-strip owner rather than a named UI action.","objdump + caller inspection + local disassembly + layout-state correlation + property-strip correlation"
0x00544f30,208,layout_state_apply_slot_range_property_strip_0x15_0x1a_0x11_0x10,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Broader slot-range property-strip owner adjacent to `0x00544df0` in the same layout-state family. The helper derives one active slot range from the caller's signed start byte and the current slot count `[this+0x258f]`, optionally clears property `0x15` down to zero and raises property `0x1a = 1` when the caller's boolean flag is set, then walks the active slot range publishing property groups `0x11` and `0x10` with one derived mode value. That derived mode depends on both the caller flag and state byte `[this+0x83c+0x1e]`. Current evidence only supports this structural slot-range property-strip description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00545000,32,layout_state_clear_property_0x89,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny bound-node property clear in the layout-state family. The helper writes literal `0` into property `0x89` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural property clear description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00545020,32,layout_state_publish_property_0x89_from_state_byte_0x22,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small sibling publisher to `0x00545000`. The helper reads byte `[this+0x83c+0x22]` and forwards that value into bound-node property `0x89` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural cached-byte property publish description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00545040,64,layout_state_publish_property_0x89_from_state_byte_0x22_and_notify_slot_0,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Notify-style sibling over the same cached state byte `[this+0x83c+0x22]`. The helper first publishes that byte into property `0x89` through node slot `+0xc8`, then forwards the same value into node slot `+0xb8` with selector `0`. Current evidence only supports this structural publish-plus-notify description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00545080,32,layout_state_clear_property_0x0e,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny bound-node property clear in the same layout-state strip. The helper writes `0` into property `0x0e` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural property clear description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x005450a0,32,layout_state_set_property_0x0e_to_1,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny sibling setter to `0x00545080`. The helper writes literal `1` into property `0x0e` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural property-set description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x005450c0,32,layout_state_copy_cached_local_block_0x24f0_to_out_buffer,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small cached-block exporter in the layout-state family. The helper copies the fixed `0x33`-byte local block rooted at `[this+0x24f0]` into one caller-supplied output buffer through a straight `rep movs` copy. Current evidence only supports this structural cached-block export description.","objdump + local disassembly + layout-state correlation + cached-block correlation"
0x005450e0,80,layout_state_export_negated_local_scalar_triplet_0x2517_0x251b_0x251f_with_mid_clamp,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Three-outparam local scalar exporter in the layout-state family. The helper reads float lanes `[this+0x2517]`, `[this+0x251b]`, and `[this+0x251f]`, negates all three, scales the third lane through the same constant used by neighboring layout-state math, and writes them to three separate outparams. The middle exported scalar is then clamped up to `0.5f` when the negated source would fall below that floor. Current evidence only supports this structural negated-triplet export description.","objdump + local disassembly + layout-state correlation + local-scalar correlation"
0x00545130,80,layout_state_export_negated_local_scalar_triplet_0x2517_0x251b_0x251f_to_vec3_with_mid_clamp,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Packed-output sibling to `0x005450e0` in the same layout-state family. The helper writes the same negated local scalar triplet derived from `[this+0x2517/+0x251b/+0x251f]` into one caller-supplied contiguous three-float buffer, again scaling the third lane and clamping the middle lane up to `0.5f`. Current grounded caller is the neighboring layout-state owner branch `0x0052bbb7`, so this is the safest current read for the packed vec3 export sibling rather than another generic copy helper.","objdump + caller inspection + local disassembly + layout-state correlation + local-scalar correlation"
0x00545180,640,layout_state_build_default_preset_table_0x840_from_angular_sweep,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Default preset-table builder in the same layout-state family. The helper walks `0x90` fixed records of size `0x33` rooted at `[this+0x840]`, deriving one normalized vector pair, several companion float lanes, and three byte-scaled threshold lanes from an angular sweep that starts at `-0xa8c0` and advances by `0x258` per row. Current grounded caller is the default-cache bootstrap path `0x0054be29`, which only invokes this builder when global dirty byte `0x00ccd820` is still clear; otherwise that owner copies preset rows from global cache `0x00ccbb68`. So the safest current read is a generated default preset-table builder rather than a generic trig helper.","objdump + caller inspection + local disassembly + layout-state correlation + preset-table correlation + default-cache correlation"
0x00545400,32,layout_state_store_preset_row_float_0x23_in_table_0x840,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny indexed preset-row setter in the layout-state family. The helper stores one caller-supplied float into offset `0x23` of the selected `0x33`-byte row under preset table `[this+0x840]`. Current evidence only supports this structural preset-row float-store description.","objdump + local disassembly + layout-state correlation + preset-table correlation"
0x00545420,32,layout_state_store_scalar_pair_arrays_0x25f7_0x25ff_by_index,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small paired scalar-array setter adjacent to the preset-table strip. The helper stores two caller-supplied floats into indexed arrays `[this+0x25f7 + index*4]` and `[this+0x25ff + index*4]`. Current evidence only supports this structural paired-array store description.","objdump + local disassembly + layout-state correlation + paired-array correlation"
0x00545440,48,layout_state_query_scalar_pair_arrays_0x25f7_0x25ff_by_index,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small paired scalar-array query sibling to `0x00545420`. The helper conditionally writes indexed floats from `[this+0x25f7 + index*4]` and `[this+0x25ff + index*4]` into up to two caller-supplied outparams. Current evidence only supports this structural paired-array query description.","objdump + local disassembly + layout-state correlation + paired-array correlation"
0x00545470,48,layout_state_store_two_floats_into_preset_row_column_pair,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small indexed preset-row setter adjacent to `0x00545400`. The helper resolves one selected `0x33`-byte row under `[this+0x840]`, then stores two caller-supplied floats into the first and second column bands using the caller's subindex as a `4`-byte lane selector. Current evidence only supports this structural two-float row-store description.","objdump + local disassembly + layout-state correlation + preset-table correlation"
0x005454a0,32,layout_state_query_float_from_preset_row_column_band_0x840,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny indexed preset-row query helper over the same table `[this+0x840]`. The helper resolves one selected `0x33`-byte row and returns the float stored in the first column band at the requested `4`-byte subindex. Current evidence only supports this structural preset-row float-query description.","objdump + local disassembly + layout-state correlation + preset-table correlation"
0x005457c0,224,layout_state_publish_property_0x8b_with_stack_descriptor_and_optional_capability_scaled_scalar,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Stack-descriptor publisher in the layout-state family. The helper zeroes one local descriptor block, optionally seeds one capability-gated scaled scalar from `[this+0x25fb] * [this+0x24f4]` when both the caller flag and shell capability byte `[0x006d4024+0x11422e]` are live, pushes packed color `0xffafafaf` into property `0x8b` on the bound node `[this+0x25df]`, and then forwards the prepared stack descriptor through node slot `+0xa8`. Current grounded callers include nearby layout-state refresh owners `0x00524cd3`, `0x00524e28`, `0x0052a641`, `0x0052ac7a`, `0x0052ae3d`, `0x0052b42f`, `0x0052bbc1`, `0x0054d944`, and later support branches `0x00564c38`, so the safest current read is a property-`0x8b` stack-descriptor publish helper rather than a named UI action.","objdump + caller inspection + local disassembly + layout-state correlation + stack-descriptor correlation"
0x005458a0,48,layout_state_borrow_current_segment_record_window_handle_0x265b_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over current segment-record handle `[this+0x265b]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x2800`-byte window through handle vtable slot `+0x2c`, and returns the borrowed scratch pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + segment-record correlation"
0x005458d0,32,layout_state_release_current_segment_record_window_handle_0x265b_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to `0x005458a0`. The helper decrements global counter `0x00ccd824` and forwards current segment-record handle `[this+0x265b]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + segment-record correlation"
0x005459f0,48,layout_state_release_segment_record_window_handle_0x2643_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to the `0x2643` segment-record window readers. When gate byte `[this+0x254e]` is live, the helper clears that gate, decrements global counter `0x00ccd824`, and forwards handle `[this+0x2643]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + segment-record correlation"
0x00545a20,32,layout_state_release_handle_0x264f_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny release-side wrapper over handle `[this+0x264f]` in the layout-state family. The helper decrements global counter `0x00ccd824` and forwards that handle through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545a40,48,layout_state_borrow_handle_0x264f_window_0x7800_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over handle `[this+0x264f]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x7800`-byte window through handle vtable slot `+0x2c`, writes the borrowed pointer to local scratch `[this+0x2657]`, and returns that pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545a70,48,layout_state_borrow_handle_0x2653_window_0x3e80_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over handle `[this+0x2653]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x3e80`-byte window through handle vtable slot `+0x2c`, and returns the borrowed pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545aa0,32,layout_state_release_handle_0x2653_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to `0x00545a70`. The helper decrements global counter `0x00ccd824` and forwards handle `[this+0x2653]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545ac0,48,layout_state_borrow_handle_0x264b_window_0x3e80_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over handle `[this+0x264b]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x3e80`-byte window through handle vtable slot `+0x2c`, and returns the borrowed pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545af0,32,layout_state_release_handle_0x264b_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to `0x00545ac0`. The helper decrements global counter `0x00ccd824` and forwards handle `[this+0x264b]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545b90,32,layout_state_release_vertex24_window_handle_0x2647_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to the vertex24 window readers over handle `[this+0x2647]`. The helper decrements global counter `0x00ccd824` and forwards that handle through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + vertex24 correlation"
0x00545bb0,48,layout_state_borrow_handle_0x263f_window_0x2ee00_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over handle `[this+0x263f]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x2ee00`-byte window through handle vtable slot `+0x2c`, and returns the borrowed pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545be0,32,layout_state_release_handle_0x263f_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to `0x00545bb0`. The helper decrements global counter `0x00ccd824` and forwards handle `[this+0x263f]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545ca0,176,layout_state_clear_first_optional_binding_publish_property_0x9e_and_commit_span_type1,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small commit-side owner in the layout-state family. When gate byte `[this+0x254d]` is still clear and slot count `[this+0x258f]` is positive, the helper clears the first optional slot binding `[this+0x2593][0]` through node slot `+0xf4` when that binding is nonnull, then publishes property `0x9e = 1.0f` on the bound node `[this+0x25df]`, accumulates one derived span count into `[this+0x3711]`, and commits the caller-supplied range through node slot `+0x118` with primitive-type argument `1`. Current evidence only supports this structural clear-plus-commit description.","objdump + local disassembly + layout-state correlation + span-commit correlation"
0x00545d50,16,layout_state_query_accumulated_span_counter_0x3711,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny accessor in the same layout-state family. The helper returns accumulated span counter `[this+0x3711]` unchanged. Current evidence only supports this structural counter-query description.","objdump + local disassembly + layout-state correlation + counter correlation"
0x00545d60,80,layout_state_reset_counters_0x370d_0x3711_and_optionally_reseed_bound_node_mode2,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Reset-side helper adjacent to the span-commit strip. The function zeroes local counters `[this+0x370d]` and `[this+0x3711]`, optionally dispatches the bound node `[this+0x25df]` through vtable slot `+0x90` with selector `2` and one `1.0f` scalar when the caller requests it, and then unconditionally forwards the node through slot `+0x88`. Current evidence only supports this structural reset-and-optional-reseed description.","objdump + local disassembly + layout-state correlation + counter correlation"
0x00545db0,64,layout_state_finalize_bound_node_and_optionally_clear_zero_mode_through_slot_0x3c,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small finalize-side helper over the bound node `[this+0x25df]`. The helper first dispatches node slot `+0x8c`, then, when the caller's boolean is still zero, clears one four-zero argument lane through node slot `+0x3c`. Current evidence only supports this structural finalize-and-optional-clear description.","objdump + local disassembly + layout-state correlation + bound-node correlation"
0x00545e00,48,layout_state_classify_bound_node_signature_0x88760868_0x88760869_or_other,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny classifier over the bound node `[this+0x25df]`. The helper queries node slot `+0x0c` and returns `1` for signature `0x88760868`, `2` for `0x88760869`, `0` for a null signature, and `3` for any other nonzero result. Current evidence only supports this structural node-signature classifier description.","objdump + local disassembly + layout-state correlation + node-signature correlation"
0x00554830,142,attachment_object_init_named_asset,bootstrap,thiscall,inferred,ghidra-headless,3,Initializes one named attachment object from a caller-supplied asset string and placement parameters. The helper copies the asset name into the local object buffer at [this+0x10] stores attachment selectors at [this+0x130] and [this+0x138] optionally derives a cached scale pair at [this+0x120] and [this+0x124] and then finalizes object state through 0x005545d0.,ghidra + rizin + llvm-objdump
0x00531640,129,shell_audio_service_query_selected_backend_index_by_name,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Queries the currently selected audio backend index from the shell audio service. When service mode dword `[this+0x04]` is `1` and the override gate at `0x00ccb9f4` is clear, the helper pulls the current backend-name stem through `0x569720` on service object `0x00ccb9fc`, iterates candidate names through `0x005314b0`, and returns the first matching backend index. Otherwise it falls back to `0`. Current grounded callers are the `Sound` page refresh and callback paths, which use it to mirror the live backend selector into control `0x7551`.","objdump + settings-window caller correlation + backend-name-match correlation"
0x005316d0,47,shell_audio_service_query_backend_available_flag_by_index,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Returns one availability flag for the requested audio backend index. When service mode dword `[this+0x04]` is `1` and the override gate at `0x00ccb9f4` is clear, the helper resolves the backend-name pointer through `0x005314b0(index)` and forwards it into `0x569730` on service object `0x00ccb9fc`; otherwise it returns `0`. Current grounded callers are the `Sound` page refresh and callback paths, which use the returned flag to republish control `0x7550`.","objdump + settings-window caller correlation + backend-availability correlation"
0x00531e10,48,shell_audio_service_apply_indexed_feedback_event_if_ready,shell,thiscall,inferred,objdump + caller correlation + local disassembly,4,"Small shell-audio-service sink beneath the indexed feedback-nudge helper `0x0045ea20`. The helper only dispatches when service mode dword `[this+0x04]` equals `1`, override gate `0x00ccb9f4` is clear, and the service-side readiness scalar at `[0x00ccb9f8+0x20]` passes the local positive check; on the ready path it tail-jumps into `0x0056ad20` with the caller's table-driven event pair and scalar, otherwise it returns `0`. Current grounded direct caller is `shell_emit_indexed_audio_feedback_nudge_if_live` `0x0045ea20`, which keeps this safely on the shell-audio feedback side rather than the broader backend-selection family.","objdump + caller correlation + local disassembly + readiness-gate correlation"
0x0053ef60,4,graphics_backend_query_primary_status_dword_18,shell,thiscall,inferred,objdump + settings-window caller correlation,3,"Returns graphics-backend dword `[this+0x18]` unchanged. Current grounded callers are the `Graphics` page refresh and graphics-selector callback strip, which pair this value with `graphics_backend_query_both_status_slots_clear` `0x0053ef70` when deciding how controls `0x757c` and `0x759a` should be republished.","objdump + settings-window caller correlation"
0x0053ef70,23,graphics_backend_query_both_status_slots_clear,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Returns `1` only when both graphics-backend dword `[this+0x18]` and dword `[this+0x14]` are zero; otherwise returns `0`. Current grounded callers are the `Graphics` page refresh and the graphics-selector callback strip, which use this test as the fallback branch when republishing controls `0x757c` and `0x759a`.","objdump + settings-window caller correlation + status-slot correlation"
0x00540e30,283,surface_owner_base_init_and_register_on_global_list,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Base initializer for the `0xec`-byte RGBA surface-owner family. The helper copies one fixed owner label into `[this+0x13]`, seeds capability and mode bytes from the live shell presenter into `[this+0x96/+0x97]`, clears the cached byte-count and pointer bands `[this+0xc0..+0xe8]`, allocates two small companion helper objects through `0x0053b070 -> 0x00556d80`, clears the eight-entry row bands `[this+0x98..+0x9f]` and `[this+0xa0..+0xbc]`, resets selector dword `[this+0x07]`, and finally links the owner into the global intrusive list rooted at `0x00ccbb2c`, incrementing `0x00ccbb30`. Current grounded caller is `surface_owner_init_or_ensure_rgba_surface_from_pixels_dims_and_mode` `0x00543980`, so this is the safest current read for base-init plus global registration rather than a generic shell allocator.","objdump + caller inspection + local disassembly + surface-family correlation + global-list correlation"
0x00540fc0,304,surface_owner_refresh_cached_byte_totals_and_release_all_row_buffers,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Two-part maintenance owner in the same surface-owner family. Its first half clears cached byte totals `[this+0xcc/+0xd0]` and then walks the eight row slots `[this+0xa0..+0xbc]`, accumulating active row byte sizes `[row+0x04]` into total bytes when backing pointer `[row+0x22]` is live and into selected bytes when companion byte `[this+0x98 + slot]` is set and selector dword `[this+0x07]` matches the shell mode token `[0x006d4024+0x114222]`. Its second half walks the same slots again and frees row buffers `[row+0x2a/+0x26/+0x2e]`, clears `[row+0x22]`, and resets owner selector `[this+0x07]`. Current grounded callers are the surface constructor `0x00543980` and the cached-surface commit helper `0x005438d0`, so this is the safest current read for the cached-byte refresh plus full row-buffer release owner rather than a narrow query helper.","objdump + caller inspection + local disassembly + surface-family correlation + byte-total correlation + row-release correlation"
0x00541160,88,surface_owner_query_dimension_cap_from_mode_and_quality_band,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Small dimension-cap query in the same surface-owner family. When owner byte `[this+0x05]` is clear it returns the broad fallback cap `0x800`. Otherwise it derives a tighter power-of-two limit from the shell editor or capability gate `[0x006d4024+0x11422f]` and then clamps that base cap against quality-style selector dword `[this+0xd8]`, yielding at most `0x100`, `0x200`, or `0x400`. Current grounded caller is the type-`2` import branch at `0x00542e15`, so this is the safest current read for the shared surface-dimension cap helper rather than a generic scalar accessor.","objdump + caller inspection + local disassembly + surface-family correlation + dimension-cap correlation"
0x005411c0,79,surface_owner_probe_named_file_for_type2_header_signature,shell,cdecl,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Small file-header probe adjacent to the same import seam. The helper opens one caller-supplied path with mode `0x8000`, reads the leading `0x12` bytes, closes the file, and returns `1` only when the checked header byte stays clear and the small type byte at local offset `+0x06` equals `2`; otherwise it returns `0`. Current grounded caller is the shell-side path at `0x005039fb`, so this is the safest current read for probing a named file for the type-`2` header signature rather than a generic file-exists test.","objdump + caller inspection + local disassembly + surface-family correlation + file-header correlation"
0x00541210,709,surface_row_repack_rgba_or_rgb32_into_active_16bit_buffer_with_palette_mode_gate,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Row-side repack owner beneath the same RGBA surface family. When shell capability byte `[0x006d4024+0x114255]` is live and editor-map gate `[0x006d4024+0x11422f]` is clear, the helper requires row backing buffer `[row+0x26]`, ensures one active output buffer at `[row+0x2a]`, seeds row state `[row+0x04/+0x10/+0x1c/+0x22]`, and then repacks the caller pixels into a 16-bit destination. The current split is structural but real: when owner byte `[this+0x96]` is nonzero it computes a palette-like packed color from accumulated channel maxima; otherwise it uses direct nibble-packed conversion from the source dwords. When owner byte `[this+0x97]` is clear it also frees the source backing pointer `[row+0x26]` on exit. Current grounded callers are `surface_owner_commit_backing_rgba_buffer_recompute_size_and_republish` `0x005438d0` and the broader row-type import body at `0x00541c30`, so this is the safest current read for the active 16-bit repack owner rather than a generic blit.","objdump + caller inspection + local disassembly + surface-family correlation + repack correlation + capability-gate correlation"
0x00541970,292,surface_owner_query_or_materialize_rgba_buffer_from_active_16bit_row,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Shared query-or-materialize helper in the same `0xec`-byte surface-owner family. For non-type-`2` rows it optionally returns width and height from `[row+0x08/+0x0c]`, then returns active RGBA backing pointer `[row+0x26]` when already live. If that RGBA buffer is still null, the helper allocates `width * height * 4` bytes, expands the current 16-bit source buffer `[row+0x2a]` into nibble-doubled RGBA dwords, stores the result into `[row+0x26]`, and returns that pointer. Current grounded callers include the cached world-presentation strip `0x005323f0/0x00532460`, the staged overlay publisher `0x00534af0`, the secondary-overlay loaders `0x00535430/0x00538060`, and the save/setup preview seam below `0x00542550`, so this is the safest current read for querying or materializing the RGBA backing buffer from the active 16-bit row rather than a generic width or height helper.","objdump + caller inspection + local disassembly + surface-family correlation + RGBA-materialization correlation"
0x00541aa0,48,surface_owner_query_first_row_width_or_one,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Tiny first-row width query in the same surface-owner family. When active-count byte `[this+0x04]`, companion byte `[this+0x98]`, and first row pointer `[this+0xa0]` are all live, the helper returns width dword `[row+0x08]`; otherwise it falls back to `1`. Current grounded callers include the world-presentation math strips at `0x0055238a/0x005523b6` and the later projection-side branch `0x0055f5d0`, so this is the safest current read for the first-row width-or-one helper rather than a generic scalar accessor.","objdump + caller inspection + local disassembly + surface-family correlation + width-query correlation"
0x00541ad0,48,surface_owner_query_first_row_height_or_one,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Height-side sibling to `surface_owner_query_first_row_width_or_one` in the same surface-owner family. When active-count byte `[this+0x04]`, companion byte `[this+0x98]`, and first row pointer `[this+0xa0]` are all live, the helper returns height dword `[row+0x0c]`; otherwise it falls back to `1`. Current grounded callers include the same world-presentation and projection-side strips at `0x0055250e/0x0055253a` and `0x0055f5ed`, so this is the safest current read for the first-row height-or-one helper rather than a generic scalar accessor.","objdump + caller inspection + local disassembly + surface-family correlation + height-query correlation"
0x00541bf0,32,surface_owner_refresh_cached_shell_scalar_0xd4_and_return_bound_handle_0xc0,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Small state-refresh helper in the same surface-owner family. The helper reads the live shell presenter through `0x0051f070`, copies presenter dword `[presenter+0x05]` into cached owner field `[this+0xd4]`, and returns bound handle `[this+0xc0]`. Current grounded caller is the layout-state binding strip at `0x00545566`, so this is the safest current read for refreshing cached shell scalar `0xd4` and returning handle `[+0xc0]` rather than a broader semantic owner.","objdump + caller inspection + local disassembly + surface-family correlation + cached-shell-scalar correlation"
0x00541c10,32,surface_owner_release_selector_handle_0x07_if_present,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Tiny selector-handle release helper in the same surface-owner family. When owner field `[this+0x07]` is nonzero, the helper re-enters `0x00541780` on that handle and then clears `[this+0x07]` back to zero. Current grounded callers include the broader release body `0x00542c90`, the local maintenance strip at `0x0053293c`, and the cache-refresh owner around `0x00543521/0x00543593`, so this is the safest current read for releasing selector handle `+0x07` rather than a generic destructor fragment.","objdump + caller inspection + local disassembly + surface-family correlation + selector-handle correlation"
0x00541b10,132,surface_owner_allocate_first_free_row_slot_0xa0_and_seed_dimensions_and_type,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Slot allocator in the `0xec`-byte RGBA surface-owner family. The helper scans the eight-entry row-pointer band `[this+0xa0 .. +0xbc]` for the first null slot, increments active-count byte `[this+0x04]`, marks companion byte `[this+0x98 + slot] = 1`, allocates one `0x32`-byte row, zeroes it, seeds row fields `[row+0x08]` and `[row+0x0c]` from the caller width and height, mirrors the third caller dword into `[row+0x14/+0x18]`, stores the row into `[this+0xa0 + slot*4]`, and returns the slot index or `-1` when no slot is free. Current grounded caller is `surface_owner_init_or_ensure_rgba_surface_from_pixels_dims_and_mode` `0x00543980`, which invokes it as `(..., width, height, 3)`, so this is the safest current read for allocating the first free surface-row slot rather than a generic small object allocator.","objdump + caller inspection + local disassembly + surface-family correlation + row-slot correlation"
0x00541ba0,66,surface_owner_release_row_slot_0xa0_by_index,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Release-side companion to `0x00541b10` in the same surface-owner family. When the caller-supplied slot index is in range and row pointer `[this+0xa0 + slot*4]` is live, the helper decrements active-count byte `[this+0x04]`, releases the row through `0x00540f60`, clears companion byte `[this+0x98 + slot]`, and nulls the stored row pointer. Current evidence grounds it as the indexed row-slot releaser beneath the same temporary-surface and cached-surface owner family.","objdump + caller inspection + local disassembly + surface-family correlation + row-slot correlation"
0x00541c30,1024,surface_row_import_tagged_baba_babb_babe_payload_to_rgba_buffer,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Broader type-`4` row-import owner beneath `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50`. After the usual early fast path through `0x00541210`, the helper reads one tagged payload stream, validates the fixed tag sequence rooted at `0xbabe` and the following `0xbaba/0xbabb` alternatives, allocates temporary buffers for the recovered bands, and then reconstructs one RGBA destination buffer from those tagged payload pieces before storing it back into the active row. The current grounded split is structural but real: one branch routes the recovered tagged bands through `0x00553120`, another copies one direct recovered band, and the mismatch branch falls back to an all-`0xff` fill. On success it seeds row fields `[row+0x08/+0x0c/+0x10/+0x14/+0x18/+0x1c/+0x26]` for the type-`4` family and then re-enters `0x00541210` to materialize the live 16-bit buffer. This is the safest current read for the tagged `0xbabe/0xbaba/0xbabb` payload importer rather than a generic stream helper.","objdump + caller inspection + local disassembly + surface-family correlation + tagged-payload correlation"
0x00542030,905,surface_row_import_headered_rgb_or_paletted_payload_to_rgba_buffer,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Broader type-`3` row-import owner beneath `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50`. After the same early repack fast path through `0x00541210`, the helper resolves one headered payload through the local stream service, validates recovered width and height against the live shell caps, rejects unsupported header combinations, allocates a full RGBA destination plus one temporary `0x40000` staging buffer, and then decodes the payload into RGBA rows. The current grounded split is structural but real: it accepts direct `0x20`-byte-per-pixel and `0x18`-byte-per-pixel source bands, can reseed an auxiliary table lookup through `0x0053b7c0`, and treats one large-value branch as a staged scanline reader rather than a raw memcpy. On success it seeds row fields `[row+0x08/+0x0c/+0x10/+0x14/+0x18/+0x1c/+0x26]` for the type-`3` family and re-enters `0x00541210` with row flag byte `[row+0x20]` selected from the dimension threshold branch. This is the safest current read for the headered RGB or paletted payload importer rather than another generic buffer copy.","objdump + caller inspection + local disassembly + surface-family correlation + headered-payload correlation"
0x005423d0,380,surface_row_materialize_dxt3_payload_into_active_16bit_buffer,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"DXT3 materializer beneath the same type-`2` row family. When the active output buffer `[row+0x2a]` is still null and compressed payload `[row+0x2e]` is live, the helper builds two temporary codec-side objects through `0x00570691`, forwards the row payload and format tag `0x33545844` (`DXT3`) into the adjacent decode path `0x0057025d`, runs the follow-on materialization step `0x005706f7`, and then allocates the live output buffer `[row+0x2a]`, copies the decoded bytes into it, seeds row state `[row+0x04/+0x10/+0x14/+0x1c/+0x22]`, and releases the temporary codec objects. Current grounded caller is the non-editor tail of `surface_row_import_dds_dxt3_payload_and_optionally_materialize_buffer` `0x00542d50`, so this is the safest current read for materializing the compressed DXT3 row payload into the active output buffer rather than another generic codec wrapper.","objdump + caller inspection + local disassembly + surface-family correlation + DXT3-correlation + decode-materialization correlation"
0x00542550,786,surface_owner_capability_gated_postprocess_non_type2_rows_into_live_16bit_buffers,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Capability-gated row postprocess owner in the same surface family. When shell capability byte `[0x006d4024+0x11422d]` is live and owner byte `[this+0x95]` has not already latched, the helper walks the active row slots, skips type-`2` rows and rows whose processed byte `[row+0x21]` is already set, forces RGBA materialization through `surface_owner_query_or_materialize_rgba_buffer_from_active_16bit_row` `0x00541970`, marks the row processed, seeds row state `[row+0x1c] = 0x3c`, discards the previous live 16-bit buffer `[row+0x2a]`, allocates a replacement destination, and then rebuilds `[row+0x22/+0x2a]` from a float-heavy neighbor-difference transform over the RGBA source. For rows whose pixel-size tag `[row+0x10]` equals `0x20`, it halves the stored byte count `[row+0x04]` after the rebuild. Current grounded caller is the world-presentation template seeder `0x005356e0`, which revisits the earlier overlay slot series and runs this helper after clearing byte `[slot+0x05]`, so this is the safest current read for the capability-gated postprocess over non-type-`2` rows rather than a generic buffer conversion.","objdump + caller inspection + local disassembly + surface-family correlation + processed-row correlation + neighbor-difference correlation"
0x00542870,69,surface_owner_release_all_row_slots_0xa0,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Compact full-slot release helper in the same surface-owner family. The function walks all eight row slots `[this+0xa0..+0xbc]`, and for each live slot decrements active-count byte `[this+0x04]`, releases the row through `0x00540f60`, clears companion byte `[this+0x98 + slot]`, and nulls the stored row pointer. Current grounded caller is the broader release owner `surface_owner_release_helpers_unlink_global_entry_and_drop_row_slots` `0x00542c90`, which uses this after unlinking the global owner entry, so this is the safest current read for releasing all row slots rather than a generic loop body.","objdump + caller inspection + local disassembly + surface-family correlation + full-slot-release correlation"
0x005428c0,607,surface_row_encode_active_pixels_and_write_tagged_records_to_open_stream,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Broader file-write owner in the same import/export surface seam. The helper allocates one alpha-sized plane and one `3 * width * height` RGB plane from the active row dimensions, splits current backing pixels `[row+0x26]` into those temporary buffers, seeds a stack image/codec object, and then writes several tagged records into the already-open stream passed by the caller. The current grounded split is structural: when the caller requests the transformed path it forwards the temporary planes through `0x00553000` before writing the tagged records `0xbaba`, `0xbabb`, and `0xbabe`; otherwise it writes the raw split buffers and the same trailing tag family directly. It frees the temporary planes before returning. Current grounded caller is `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50`, which opens the destination path in `a+b` mode and forwards the resulting stream here, so this is the safest current read for encoding the active surface row and writing tagged records to the open stream rather than a generic image copy helper.","objdump + caller inspection + local disassembly + surface-family correlation + tagged-record correlation + open-stream correlation"
0x00542b30,208,surface_owner_write_first_row_rgba_payload_with_0x12_byte_header_to_named_file,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Direct file-write sibling to `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50` in the same preview-surface seam. The helper opens one caller-supplied path in `wb` mode, builds a compact `0x12`-byte header on the stack with row type `2`, the first-row width and height, fixed pixel-size byte `0x20`, and one optional flag bit `0x20` when the second caller argument is nonzero, then optionally forces RGBA materialization through `surface_owner_query_or_materialize_rgba_buffer_from_active_16bit_row` `0x00541970` and writes the first-row RGBA payload `[row+0x26]` plus the header to the open stream. Current grounded callers are the paired export-side branches at `0x00520cda`, `0x00520f61`, and `0x00534dd6`, each of which uses this as the direct-file alternative to `0x00542f50` before releasing the temporary surface owner through `0x00542c90 + 0x0053b080`, so this is the safest current read for writing the first row plus its `0x12`-byte header to a named file rather than a generic save helper.","objdump + caller inspection + local disassembly + surface-family correlation + direct-file-write correlation"
0x00542c10,114,shell_release_active_global_layout_cache_entries,shell,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Global cache-release sweep in the shell layout-state family. The helper walks the linked list rooted at `0x00ccbb2c`, and for every active entry `[entry+0x07]` releases optional handles `[entry+0xc0]` and `[entry+0xc8]` through vtable slot `+0x08`, refreshes controller-side cached field `[0x006d4024+0x1136ad]` through `0x0051f990`, clears sibling bookkeeping dwords `[entry+0xcc/+0xd0/+0xd4]`, decrements active-count global `0x00ccbb34`, and resets `[entry+0x07]` back to `0`. Current grounded callers are the small and broad layout-state release bodies `0x0055dd80` and `0x0055e060`, so this is the safest current read for releasing the active global layout-cache entries rather than a generic list walk.","objdump + caller inspection + local disassembly + layout-state correlation + global-cache correlation"
0x00542c90,177,surface_owner_release_helpers_unlink_global_entry_and_drop_row_slots,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Primary release body for the same global surface-owner family. The helper releases optional companion helpers `[this+0xdc]` and `[this+0xe4]` through `0x005571d0 + 0x0053b080`, clears sibling field `[this+0xe0]`, unlinks the owner from the intrusive global list rooted at `0x00ccbb2c`, conditionally refreshes the live shell presenter through `0x005271a0` when owner byte `[this+0x93]` is set, re-enters `0x00541780` to drop any active selector-side handle, re-enters `surface_owner_release_all_row_slots_0xa0` `0x00542870`, and finally clears `[this+0x07]` plus `[this+0xc0]`. Current grounded callers include the save-side temporary preview helper `0x00442740`, the world-presentation slot-release strips `0x00532760/0x00532b30/0x00534f80`, and the shell overlay release path `0x0047b320`, so this is the safest current read for releasing helper objects, unlinking the global surface-owner entry, and dropping the row slots rather than a generic destructor stub.","objdump + caller inspection + local disassembly + surface-family correlation + global-list correlation + row-slot-release correlation"
0x00542f50,95,surface_owner_open_named_resource_and_dispatch_row_type_import,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Named-resource import dispatcher in the same temporary-surface and cached-surface family used by the setup/save preview helpers. The function takes one caller path seed, opens or resolves the matching resource file through the neighboring file-open strip, forwards the result into `0x005428c0`, and then dispatches the imported row by embedded type dword `[row+0x18]`: current grounded branches are type `2 -> 0x00542d50`, type `3 -> 0x00542030`, and type `4 -> 0x00541c30`, with the fallback returning `2`. Current grounded caller is `shell_build_temp_surface_from_payload_preview_pixels_and_query_named_resource_field_0x46` `0x00442740`, which uses the returned dword as payload field `[record+0x18]`, so this is the safest current read for the named-resource open-and-import dispatcher rather than a generic file helper.","objdump + caller inspection + local disassembly + surface-family correlation + row-type-dispatch correlation"
0x00542fb0,64,surface_owner_dispatch_row_import_by_embedded_type,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Small row-type selector beneath the same import seam. The helper reads embedded row type dword `[row+0x18]` and dispatches type `2` to `surface_row_import_dds_dxt3_payload_and_optionally_materialize_buffer` `0x00542d50`, type `3` to `surface_row_import_headered_rgb_or_paletted_payload_to_rgba_buffer` `0x00542030`, and type `4` to `surface_row_import_tagged_baba_babb_babe_payload_to_rgba_buffer` `0x00541c30`, returning `2` on the unsupported fallback path. Current grounded caller is the temporary-slot wrapper `0x00543000`, so this is the safest current read for the embedded row-type import selector rather than another file-open helper.","objdump + caller inspection + local disassembly + surface-family correlation + row-type-dispatch correlation"
0x00543000,128,surface_owner_allocate_temp_row_slot_dispatch_import_and_release_on_failure,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Temporary-slot import wrapper in the same surface-owner family. The helper clears selector field `[this+0x07]`, allocates one fresh slot through `surface_owner_allocate_first_free_row_slot_0xa0_and_seed_dimensions_and_type` `0x00541b10`, dispatches the newly allocated row through `surface_owner_dispatch_row_import_by_embedded_type` `0x00542fb0`, releases the slot again through `0x00541ba0` when the import result is `1` or `2`, and then refreshes cached byte totals and row state through `0x00540fc0` before returning the import status. Current grounded callers are the higher surface-owner service strip immediately above `0x00543080`, so this is the safest current read for allocating a temporary row slot, dispatching the type-specific import, and releasing it on failure rather than a broader constructor.","objdump + caller inspection + local disassembly + surface-family correlation + temp-slot-import correlation"
0x005438d0,173,surface_owner_commit_backing_rgba_buffer_recompute_size_and_republish,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Commit-side publish helper in the same `0xec`-byte RGBA surface-owner family used by `0x00543980`. When the caller supplies a nonnull backing buffer, the helper replaces existing row buffer `[row+0x26]`, freeing the old buffer when it differs. It then resets state byte `[row+0x20]` to `0`, restores state dword `[row+0x1c] = 0x15`, mirrors active backing pointer into `[row+0x22]`, recomputes byte size `[row+0x04] = width * height * 4` from `[row+0x08/+0x0c]`, re-enters `0x00541210`, publishes through `0x005435d0`, and finally clears owner dwords `[this+0xcc/+0xd0]`. Current grounded callers are the surface constructor `0x00543980`, the cached world-presentation surface strip at `0x00532460/0x00534af0`, and the shell overlay raster wrappers `0x0047b3d0/0x0047b470`, so this is the safest current read for committing the active RGBA backing buffer and republishing the live surface row rather than a generic free helper.","objdump + caller inspection + local disassembly + surface-family correlation + republish correlation"
0x00543980,131,surface_owner_init_or_ensure_rgba_surface_from_pixels_dims_and_mode,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Constructor or ensure helper for the `0xec`-byte RGBA surface-owner family. The function takes an optional caller pixel buffer, width, height, and one extra mode or flag argument. When the pixel buffer is null it allocates `width * height * 4` bytes itself, then re-enters `0x00540e30`, copies the fixed owner label at `0x005dd924` into `[this+0x13]`, and on first use seeds local bytes `[this+0x94] = 1` and `[this+0x96] = 0`, allocates one slot row through `0x00541b10(width, height, 3)`, and commits the active backing pixels through `0x005438d0`. It finishes by re-entering `0x00540fc0`, clears byte `[this+0x05]`, and returns `this`. Current grounded callers include the save-side temporary preview helper `0x00442740`, the world-presentation cached-surface owners `0x005323f0/0x00535100/0x00535430`, and the shell overlay ensure-surface owner `0x0047b470`, so this is the safest current read for initializing or ensuring one RGBA surface owner from caller pixels and dimensions rather than a world-only allocator.","objdump + caller inspection + local disassembly + surface-family correlation + first-use-slot-allocation correlation"
0x005454c0,82,layout_state_snapshot_current_slot_triplet_table_into_history_list_0x259f,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared slot-table snapshot helper in the broader layout-state presentation family. The function allocates one temporary copy of the current `0x18`-byte-per-slot triplet table `[this+0x2597]`, copies the whole live slot table into that buffer, and then appends the copied buffer into the history-style list rooted at `[this+0x259f]` through `0x00556e10`. Current grounded callers are the tightly clustered probe-side branches `0x0055de10..0x0055df9f`, so this is the safest current read for snapshotting the current slot-triplet table into history list `[+0x259f]` rather than a generic allocator wrapper.","objdump + caller inspection + local disassembly + layout-state correlation + slot-triplet correlation + history-list correlation"
0x00545520,179,layout_state_set_optional_item_binding_in_slot_table_0x2593,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared optional-binding setter over slot table `[this+0x2593]` in the broader layout-state presentation family. When the requested slot index is in range, the helper compares the incoming item pointer against the current slot binding. For nonnull items it first checks item dword `[item+0x07]` against the current shell-side mode token `[0x006d4024+0x114222]`; mismatches are normalized through `0x005435d0(item, [this+0x25df], 0)` before the final bind. Effective changes then publish node property slot `+0xf4` on `[this+0x25df]`, using the derived item-side dword returned from `0x00541bf0` for nonnull bindings or `0` for clears, incrementing local change counter `[this+0x370d]` and mirroring the final pointer back into `[this+0x2593 + slot*4]`. Current grounded callers include the nearby-presentation and layout-state refresh strips `0x005243eb`, `0x0052876a`, `0x00548a24`, and many sibling presentation owners, so this is the safest current read for the optional per-slot item-binding publisher rather than a generic list write.","objdump + caller inspection + local disassembly + layout-state correlation + slot-binding correlation"
0x005455e0,224,layout_state_set_slot_triplet_lo,bootstrap,thiscall,inferred,ghidra-headless,4,Updates the first three cached per-slot presentation scalars in the 24-byte slot table at [this+0x2597+slot*24]. In notify mode it compares against the cached values and forwards only changed fields into the bound presentation node through vtable slot +0xfc with subproperty ids 1 through 3.,ghidra + rizin + llvm-objdump
0x005456d0,240,layout_state_set_slot_triplet_hi,bootstrap,thiscall,inferred,ghidra-headless,4,Updates the second three cached per-slot presentation scalars in the same 24-byte slot table at [this+0x2597+slot*24]. In notify mode it compares against the cached values and forwards only changed fields into the bound presentation node through vtable slot +0xfc with subproperty ids 4 through 6.,ghidra + rizin + llvm-objdump
0x005458f0,169,layout_state_read_segment_record_window,bootstrap,thiscall,inferred,ghidra-headless,4,Gates the 32-byte segment-record table at [this+0x2643]; queries record bounds then copies a start-to-end or wrapped window into scratch storage at [this+0x2657] through vtable slot +0x2c while toggling byte flag [this+0x254e]. The downstream shell path treats each 0x20-byte record as two vec3 blocks plus two trailing scalars.,ghidra + rizin
0x005459a0,69,layout_state_read_segment_record_block,bootstrap,thiscall,inferred,ghidra-headless,4,Reads one 32-byte-indexed segment-record block from the same [this+0x2643] table into scratch storage at [this+0x2657] through vtable slot +0x2c using a fixed 0x2800-byte transfer span.,ghidra + rizin
0x00545b10,57,layout_state_read_vertex24_block,bootstrap,thiscall,inferred,ghidra-headless,4,Reads one 24-byte-indexed vertex block from the presentation table at [this+0x2647] through vtable slot +0x2c using index*24 addressing and returns the copied pointer through a stack outparam. The downstream shell emitter treats each record as vec3 plus a style dword plus two trailing scalars.,ghidra + rizin
0x00545b50,59,layout_state_read_vertex24_window,bootstrap,thiscall,inferred,ghidra-headless,4,Copies a window between two 24-byte vertex indices from [this+0x2647] into scratch storage at [this+0x2657] through vtable slot +0x2c using index*24 addressing and a fixed 0x1800-byte transfer span. The downstream shell emitter treats each record as vec3 plus a style dword plus two trailing scalars.,ghidra + rizin
0x00545c50,67,layout_state_commit_vertex24_span,bootstrap,thiscall,inferred,ghidra-headless,4,Converts a start and end vertex index range into a triplet count by dividing the delta by three accumulates that count at [this+0x3711] and notifies the bound presentation node at [this+0x25df] through vtable slot +0x118 with primitive-type argument 4.,ghidra + rizin
0x00545e30,1657,layout_state_query_external_report_and_build_summary_text_0x43c,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader report-summary owner in the layout-state family beneath the release and capability-gated property strip. The helper first queries one external/provider object through `0x0058bc36`; when that lookup fails it formats localized id `0x73` directly into summary buffer `[this+0x43c]` and returns success. On the live path it fetches one capability-style report through vtable slot `+0x10`, clears summary buffer `[this+0x43c]`, and then appends a sequence of localized fragments `0x74..0x7d`, fixed format strings such as `%1(16-bit HW) ` and `%1(8-bit HW) `, and several numeric fields from the returned report before returning. Current grounded caller is the broader setup-side layout-state owner branch `0x0054a12b`, so this is the safest current read for querying the external report and building summary text buffer `0x43c` rather than a generic string formatter.","objdump + caller inspection + local disassembly + layout-state correlation + summary-buffer correlation + external-report correlation"
0x005464d0,105,layout_state_run_four_pass_bound_node_reset_strip,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small four-pass bound-node reset strip in the layout-state family. The helper re-enters node slot `+0x88`, then publishes fixed selector/value pairs through node slot `+0x90` and finally clears slot `+0x3c`, repeating that sequence four times against bound presentation node `[this+0x25df]`. Current grounded caller is the same broader owner strip that invokes `0x00545e30` and then selects shell mode `4` or `5`, so this is the safest current read for the repeated bound-node reset strip rather than a generic loop body.","objdump + caller inspection + local disassembly + layout-state correlation + bound-node correlation"
0x00546540,19,layout_state_set_property_0x17_to_7,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny fixed property setter over the bound presentation node `[this+0x25df]`. The helper simply publishes value `7` into property `0x17`. Current grounded caller is `0x0052cb68`, so this is the safest current read for setting property `0x17` to `7` rather than a broader mode switch.","objdump + caller inspection + local disassembly + layout-state correlation + property-strip correlation"
0x00546560,19,layout_state_set_property_0x17_to_4,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small sibling to `0x00546540` in the same layout-state family. The helper simply publishes value `4` into property `0x17` on bound node `[this+0x25df]`.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00546580,19,layout_state_clear_property_0xa8,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny property-clear helper over bound presentation node `[this+0x25df]`. The function publishes `0` into property `0xa8`.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x005465a0,19,layout_state_set_property_0xa8_to_0x0f,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small fixed property setter beside `0x00546580` in the same layout-state family. The helper publishes value `0x0f` into property `0xa8` on bound node `[this+0x25df]`.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00546a30,333,layout_state_rebuild_variant_asset_cache,bootstrap,thiscall,inferred,ghidra-headless,3,Releases any loaded entries in the 64-slot presentation asset bank rooted at 0x31ab then rebuilds the paired-key metadata table at 0x266b tracking active entries count at [this+0x2667] and sibling or reuse links for later keyed lookups.,ghidra + rizin
0x005467a0,50,layout_state_enable_presentation_gate,bootstrap,thiscall,inferred,ghidra-headless,4,Ensures the presentation node gate property 0x1c is enabled once for the layout state when the template flag at [[this+0x83c]+0x2e] permits it by setting [this+0x2549] and forwarding the toggle into the node at [this+0x25df].,ghidra + rizin
0x005467e0,41,layout_state_disable_presentation_gate,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Clear-side sibling to `0x005467a0` in the same layout-state family. When local gate byte `[this+0x2549]` is live, the helper clears that byte and publishes `0` into property `0x1c` on bound node `[this+0x25df]`.","objdump + local disassembly + layout-state correlation + presentation-gate correlation"
0x00546810,67,layout_state_raise_property_0x16_to_3_when_template_flag_0x1c_permits,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Template-gated property raiser in the layout-state family. When local mode byte `[this+0x254a]` is not already `2` and template byte `[[this+0x83c]+0x1c]` is nonzero, the helper publishes value `3` into property `0x16` on bound node `[this+0x25df]` and stores mode byte `[this+0x254a] = 2`.","objdump + local disassembly + layout-state correlation + template-gate correlation + property-strip correlation"
0x00546850,30,layout_state_set_property_0x16_to_2_and_store_mode1,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small sibling to `0x00546810` in the same layout-state family. The helper publishes value `2` into property `0x16` on bound node `[this+0x25df]` and stores mode byte `[this+0x254a] = 1`.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00546890,41,layout_state_clear_property_0x16_and_reset_mode_byte_0x254a,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Clear-side sibling to `0x00546810/0x00546850` in the same layout-state family. When local mode byte `[this+0x254a]` is nonzero, the helper publishes value `1` into property `0x16` on bound node `[this+0x25df]` and resets `[this+0x254a]` back to `0`.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x005463e0,149,layout_state_release_midband_bound_handles_with_notice_0x9b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Midband handle-release strip in the layout-state family. The helper walks a five-handle band rooted at `[this+0x260f]`, `[this+0x2617]`, `[this+0x261f]`, `[this+0x2627]`, and `[this+0x262f]`, releasing each live entry through vtable slot `+0x08`, clearing the corresponding field back to `0`, and emitting localized notice `0x9b` when the release reports success. Current grounded callers are the repeated layout-state owner branches `0x00549f1c..0x0054a1c2`, including the broader bound-presentation release body `0x0054a190`, so this is the safest current read for the midband bound-handle cleanup strip rather than a generic field reset.","objdump + caller inspection + local disassembly + layout-state correlation + handle-band correlation"
0x005465c0,284,layout_state_release_variant_bank_and_late_bound_handles_with_notice_0x9b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Late cleanup strip in the layout-state family beneath the broader bound-presentation release path. The helper first walks the 64-entry variant-bank table rooted at `[this+0x31ab]`, releasing every live entry through vtable slot `+0x08` with localized notice `0x9b` on successful release, then performs the same release-and-clear pattern on the later bound-handle band `[this+0x263f/+0x2643/+0x264f/+0x265b/+0x265f/+0x2663]`. Current grounded caller is the broader bound-presentation release body `0x0054a190`, so this is the safest current read for releasing the variant bank and late bound handles rather than a generic array clear.","objdump + caller inspection + local disassembly + layout-state correlation + variant-bank correlation + handle-band correlation"
0x00546d40,712,layout_state_publish_transform_descriptor_from_local_scalars_and_seeded_handle_0x36fd,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader descriptor-publish helper in the layout-state family. The helper builds one large stack descriptor from local scalar bands `[this+0x2517/+0x251b/+0x251f/+0x25f7/+0x25ff]`, scale factors `[this+0x24f0/+0x24f8]`, the seeded handle `[this+0x36fd]`, and a local side buffer at `[this+0x35af]`, then forwards that descriptor into the bound presentation node `[this+0x25df]`. Current grounded caller is the three-slot batch owner `0x0054ab20`, so this is the safest current read for publishing one transform-style descriptor from local scalars and seeded handle `0x36fd` rather than a generic math helper.","objdump + caller inspection + local disassembly + layout-state correlation + descriptor-publish correlation"
0x005471f0,176,layout_state_bind_table_0x112_or_0x142_and_optionally_publish_property_0x154,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Generalized table-bind helper in the layout-state family beneath the local `0x2643/0x2647/0x264f` wrapper strip. When the caller-supplied table pointer differs from cached field `[this+0x2637]`, the helper binds that table onto the bound presentation node `[this+0x25df]`, choosing property `0x112` for `0x20`-byte records or property `0x142` for `0x18`-byte records through node slots `+0x130/+0x14c`, then caches the new table pointer. It also optionally forwards one caller dword through node slot `+0x154` and mirrors that value into `[this+0x263b]`. Current grounded callers are the small wrappers `0x0054bbd0` and `0x0054bbf0`, so this is the safest current read for the shared table-bind plus optional property-`0x154` publish helper rather than a single table-specific owner.","objdump + caller inspection + local disassembly + layout-state correlation + table-bind correlation + bound-node correlation"
0x005472a0,20,layout_state_clear_property_0x1b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny property-clear helper over the bound presentation node `[this+0x25df]`. The function simply publishes `0` into property group `0x1b` through node slot `+0xc8`. Current grounded callers include layout-state owner branches `0x0052888d`, `0x0052b93b`, `0x0052bebc`, `0x0052caf4`, `0x00564d58`, and `0x0056507e`, so this is the safest current read for clearing property `0x1b` rather than a broader state reset.","objdump + caller inspection + local disassembly + layout-state correlation + property-strip correlation"
0x00547300,31,layout_state_publish_property_0x1b_from_template_flag_bit0,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small property publisher beside `0x005472a0` in the same layout-state family. The helper reads template byte bit `0` from `[[this+0x83c]+0x21]` and forwards that one-bit value into property group `0x1b` on the bound presentation node `[this+0x25df]` through node slot `+0xc8`. Current grounded callers include layout-state owners `0x00524c3c`, `0x0052889d`, `0x005289a0`, `0x0052ae55`, `0x0052b89c`, `0x0052cb4e`, and later shell-side presentation branches, so this is the safest current read for publishing property `0x1b` from the template bit rather than a generic flag copy.","objdump + caller inspection + local disassembly + layout-state correlation + template-flag correlation + property-strip correlation"
0x00547320,96,layout_state_apply_capability_gated_property_0x0f_0x18_0x19_strip,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Capability-gated three-property strip in the layout-state family. When shell capability byte `[0x006d4024+0x114252]` is live, the helper publishes `1` into property `0x0f`, forwards the caller dword into property `0x18`, and then publishes fixed value `7` into property `0x19` on the bound node `[this+0x25df]`. Current grounded callers include layout-state owners `0x005243c1`, `0x00524cc9`, `0x0052873c`, `0x00529995`, `0x0052a1c9`, `0x0052a50c`, `0x0052ae5f`, `0x0052b8a6`, `0x0052c824`, and later shell-side branches, so this is the safest current read for the capability-gated `0x0f/0x18/0x19` property strip rather than an isolated scalar setter.","objdump + caller inspection + local disassembly + layout-state correlation + capability-gate correlation + property-strip correlation"
0x00547380,64,layout_state_clear_capability_gated_property_0x0f_0x18_strip,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small clear-side sibling to `0x00547320` in the same layout-state family. When capability byte `[0x006d4024+0x114252]` is live, the helper clears property `0x0f` and property `0x18` on the bound node `[this+0x25df]` by publishing zero into both groups. Current grounded callers include layout-state owner branches `0x00528895` and `0x0052b940`, so this is the safest current read for clearing the capability-gated `0x0f/0x18` strip rather than a generic branch reset.","objdump + caller inspection + local disassembly + layout-state correlation + capability-gate correlation + property-strip correlation"
0x00547610,48,layout_state_publish_bound_node_pair_0x2607_0x260b_once,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small one-shot publisher over the bound presentation node `[this+0x25df]` in the layout-state family. When local gate byte `[this+0x254c]` is still clear, the helper forwards dwords `[this+0x2607]` and `[this+0x260b]` into node vtable slot `+0x7c`, then marks the gate byte live. Current grounded callers are the setup-side owner `0x0052c032`, the small and broad release bodies `0x0055dd57/0x0055dd87/0x0055e07b`, and sibling rebuild paths such as `0x0052cc7d` and `0x0055e978`, so this is the safest current read for publishing the cached bound-node pair once rather than a generic setter.","objdump + caller inspection + local disassembly + layout-state correlation + bound-node correlation"
0x00547640,7,layout_state_clear_bound_node_pair_0x2607_0x260b_publish_gate,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny gate-clear sibling to `0x00547610` in the same layout-state family. The helper only resets byte `[this+0x254c]` back to `0`, allowing the next `0x00547610` call to republish dwords `[this+0x2607/+0x260b]` into the bound node. Current grounded callers are nearby presentation owners such as `0x0052bc20` and `0x0052bdd3`, so this is the safest current read for clearing the one-shot publish gate rather than a broader state reset.","objdump + caller inspection + local disassembly + layout-state correlation + publish-gate correlation"
0x00547650,578,layout_state_apply_capability_gated_presentation_property_strip_and_bind_aux_handles,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Capability-gated presentation property owner over the bound node `[this+0x25df]` in the layout-state family. When shell capability byte `[0x006d4024+0x11422d]` is live, the helper seeds one fixed property strip through repeated node slot `+0xfc` writes over property groups `0x0b`, `0x18`, `0x0d`, and `0x0e`, then binds auxiliary handles `[this+0x2623]` and `[this+0x2633]` through node slots `+0x130` and `+0x160`. When the first gate is clear but capability byte `[0x006d4024+0x114250]` is live, it instead builds one stack descriptor rooted at local handle `[this+0x36fd]`, publishes that block through node slot `+0x94` on property `0x11`, and then applies the reduced `0x0d/0x0e` property pair. Both branches finish by clearing the `0x0d/0x0e` property lane for selector `3`. Current grounded callers are the neighboring layout-state owner paths `0x0054abd1`, `0x0054b0e1`, and `0x0054b5de`, so this is the safest current read for the capability-gated presentation property strip and auxiliary-handle bind rather than a small scalar setter.","objdump + caller inspection + local disassembly + layout-state correlation + capability-gate correlation + bound-node correlation"
0x005478a0,680,layout_state_apply_trig_derived_presentation_property_strip_and_bind_aux_handles_0x261b_0x262b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Alternate property-strip sibling to `0x00547650` in the same layout-state family. After one external timing or state query, the helper applies the same initial `0x0b/0x18` property band on the bound node `[this+0x25df]`, then publishes trig-derived scalar pairs into property groups `0x07..0x0a` for selectors `2` and `3`, sets both `0x0d/0x0e` groups for selector `2`, clears those groups for selector `3`, and finally binds auxiliary handles `[this+0x261b]` and `[this+0x262b]` through node slots `+0x130` and `+0x160`. Current grounded callers are the batch owners `0x0054abca` and `0x0054b0da`, so this is the safest current read for the trig-derived alternate property strip rather than a generic sine-cosine helper.","objdump + caller inspection + local disassembly + layout-state correlation + trig-strip correlation + bound-node correlation"
0x00547c30,224,layout_state_store_four_local_scalars_0x36df_0x36eb_and_publish_property_0x07_block,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared four-scalar publisher beneath the trig-derived layout-state strip. The helper stores four caller dwords into local scalar fields `[this+0x36df/+0x36e3/+0x36e7/+0x36eb]`, validates them against the zero-threshold path, and then publishes either one identity-like `(0,0,1,1)` block or one block using the negated first pair plus the unmodified second pair into property group `0x07` on the bound presentation node `[this+0x25df]` through node slot `+0x13c` with notify flag `1`. Current grounded callers are the neighboring owner branches `0x0052c701` and `0x0052c77e`, so this is the safest current read for storing the local four-scalar band and publishing the derived property-`0x07` block rather than a generic math helper.","objdump + caller inspection + local disassembly + layout-state correlation + four-scalar correlation + property-strip correlation"
0x00547d10,288,layout_state_apply_presentation_extents4,bootstrap,thiscall,inferred,ghidra-headless,4,Applies a four-float extent or quad block onto presentation property 0x18 for the bound node at [this+0x25df]. If all four inputs are nonpositive it clears the property through vtable slot +0xfc; otherwise it builds a 0x10-field stack block with the four caller values and a unit scalar then commits it through node slots +0xfc and +0x94.,ghidra + rizin + llvm-objdump
0x00547f20,177,layout_state_apply_gamma_ramp_scalar,bootstrap,thiscall,inferred,ghidra-headless,4,Builds a 256-entry three-channel gamma-ramp buffer from the caller scalar and uploads it through vtable slot +0x48 on the bound presentation node at [this+0x25df]. The helper clamps each 16-bit ramp entry stores the accepted scalar in the subordinate state block at [[this+0x83c]+0x2f] and respects shell capability guards under 0x006d4024 before touching the display device.,ghidra + rizin + llvm-objdump
0x00548030,43,layout_state_publish_property_pair_0x13_0x14_as_1_6,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny property-pair setter in the layout-state family. The helper publishes value `1` into property `0x13` and value `6` into property `0x14` on the bound presentation node `[this+0x25df]`. Current grounded caller is the neighboring owner branch `0x0052b8ae`, so this is the safest current read for the fixed `0x13/0x14 = 1/6` publish pair rather than a broader mode switch.","objdump + caller inspection + local disassembly + layout-state correlation + property-pair correlation"
0x00548060,43,layout_state_publish_property_pair_0x13_0x14_as_5_6,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small sibling to `0x00548030` in the same layout-state family. The helper publishes value `5` into property `0x13` and value `6` into property `0x14` on the bound presentation node `[this+0x25df]`. Current grounded caller is the neighboring owner branch `0x0052b91c`, so this is the safest current read for the fixed `0x13/0x14 = 5/6` publish pair rather than a generic wrapper.","objdump + caller inspection + local disassembly + layout-state correlation + property-pair correlation"
0x00548120,92,layout_state_reset_local_descriptor_identity_ensure_fallback_block_0x25e3_and_refresh_current_span,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small rect-strip owner in the layout-state family. The helper resets local descriptor `[this+0x34ef]` to identity through `0x00544360`, lazily allocates fallback block `[this+0x25e3]` and registers it on the bound node `[this+0x25df]` through slot `+0xa4`, then refreshes the sibling local descriptor `[this+0x352f]` from the current integer span pair `[this+0x25c7/+0x25cb]` by tail-calling `0x00544290`. Current grounded caller is `shell_commit_layout_updates` `0x00523d90`, so this is the safest current read for the identity-reset plus fallback-block ensure path rather than a generic constructor fragment.","objdump + caller inspection + local disassembly + layout-state correlation + rect-strip correlation"
0x00548180,350,layout_state_store_normalized_local_rect_0x2523_0x252f_publish_dynamic_or_fallback_block_and_refresh_span,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader rect update owner immediately above `0x00548120` in the same layout-state family. The helper lazily allocates fallback block `[this+0x25e3]`, stores four normalized local rect scalars into `[this+0x2523/+0x2527/+0x252b/+0x252f]` from the caller's integer rectangle corners and current span pair `[this+0x25c7/+0x25cb]`, publishes either that derived dynamic block through node slot `+0xa0` or the fallback block when the rectangle is too small, and then refreshes sibling descriptor `[this+0x352f]` by re-entering `0x00544290` with the resulting width and height deltas. Current grounded caller is the neighboring bridge `0x005482e0`, so this is the safest current read for storing the normalized local rect, publishing the dynamic-or-fallback block, and refreshing the current span rather than a generic rectangle math helper.","objdump + caller inspection + local disassembly + layout-state correlation + rect-strip correlation + fallback-block correlation"
0x005482e0,109,layout_state_apply_display_rect_or_delta_span_from_controller_normalized_scalars,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Bridge between the embedded view-controller scalar band and the layout-state rect-strip owners. The helper first materializes one active-display rectangle from controller scalar band `[controller+0x50..+0x5c]` through `embedded_view_controller_materialize_active_display_rect_from_normalized_scalars_0x50_0x5c` `0x0052d4d0`; when that resolved rectangle is nondegenerate it forwards the four corners into `0x00548180`, and otherwise it computes simple width and height deltas and refreshes descriptor `[this+0x352f]` directly through `0x00544290`. Current grounded callers are shell presentation branches `0x0052c108` and `0x0052ccd8`, so this is the safest current read for applying a controller-derived display rect or fallback delta span into the layout-state family rather than a generic clamp helper.","objdump + caller inspection + local disassembly + layout-state correlation + controller-bridge correlation + rect-strip correlation"
0x00548820,116,layout_state_seed_all_slot_triplets_to_1_2_1_pattern,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small slot-table seed helper in the broader layout-state presentation family. The function walks every live slot in `[this+0x2597]` and writes the same six-scalar pattern into both triplet halves of each `0x18`-byte slot record: `(1, 2, 1)` at `+0x00/+0x04/+0x08` and again at `+0x0c/+0x10/+0x14`. Current grounded caller is the capability-side `TextureForTests` probe strip at `0x0055dfaa`, so this is the safest current read for seeding all slot triplets to the fixed `1,2,1` pattern rather than a general reset helper.","objdump + caller inspection + local disassembly + layout-state correlation + slot-triplet correlation"
0x005488a0,157,layout_state_snapshot_current_slot_triplet_table_into_seeded_list_and_optionally_apply,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared slot-table snapshot helper in the broader layout-state presentation family. The function allocates one temporary copy of the current `0x18`-byte-per-slot triplet table `[this+0x2597]`, pushes that copied table into the seeded-record list rooted at `[this+0x259b]` through `0x00557150`, and, when the caller requests it, immediately re-applies the copied low and high triplet halves to every live destination slot through `0x005455e0` and `0x005456d0` with notify flag `1`. Current grounded callers include several nearby-presentation builders `0x00524393`, `0x00524cca`, `0x005288ec`, `0x00528a20`, the broader probe path `0x00548a3b`, and later sibling presentation owners, so this is the safest current read for snapshotting the current slot-triplet table into the seeded list with an optional immediate re-apply rather than a generic memcpy helper.","objdump + caller inspection + local disassembly + layout-state correlation + seeded-list correlation + slot-triplet correlation"
0x005489f0,237,layout_state_run_texture_for_tests_binding_probe,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly + rdata string decode,2,"Capability-style probe owner in the broader layout-state presentation family. The helper allocates one temporary payload from literal `TextureForTests` through `0x0053c1c0(0, 0, 0x7f)`, binds that payload across every live optional item slot through `0x00545520`, snapshots or reapplies the current slot-triplet state through `0x005488a0`, queries the bound presentation node at `[this+0x25df]` through vtable slot `+0x100`, re-applies the first seeded slot-triplet pair through `0x00548940(1)`, clears the live optional slot bindings back to null through `0x00545520`, releases the temporary payload through `0x0053c000`, and returns the resulting boolean-like probe outcome. Current grounded callers are the later capability-setting branch `0x0055dfc1/0x0055dfe0/0x0055e004/0x0055e047`, which mirror that result into shell capability bytes `[0x006d4024+0x114250/+0x114251]`, so this is the safest current read for the `TextureForTests` binding probe rather than a generic presentation refresh owner.","objdump + caller inspection + local disassembly + rdata string decode + layout-state correlation + capability-probe correlation"
0x00548940,167,layout_state_apply_first_n_seeded_slot_triplet_pairs_from_list_0x259b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared slot-triplet apply helper over the seeded record list rooted at `[this+0x259b]` in the broader layout-state presentation family. The function clamps the caller-requested record count against list count `[[this+0x259b]+0x0c]`, iterates that many seeded `0x18`-byte records through `0x00556e50`, and for each destination slot index writes the first and second triplet blocks into the cached slot table `[this+0x2597]` through `0x005455e0` and `0x005456d0` with notify flag `1`. After the pass it releases the temporary seeded-list cursor through `0x005a1145`. Current grounded callers include the nearby-presentation sweeps `0x00524521`, `0x00524e32`, `0x00529998`, the broader layout-state owner `0x00548a71`, and several sibling presentation rebuild paths, so this is the safest current read for applying the first N seeded slot-triplet pairs from list `[+0x259b]` rather than a generic list walk.","objdump + caller inspection + local disassembly + layout-state correlation + slot-triplet correlation"
0x00548c50,342,layout_state_release_history_seeded_lists_and_clear_optional_slot_bindings,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Pre-release cleanup owner in the layout-state presentation family. When live slot count `[this+0x258f]` is positive, the helper drains and frees every record in the history list `[this+0x259f]` and the seeded-record list `[this+0x259b]`, releases the two list owners themselves, clears both fields back to `0`, and then walks the optional slot-binding table `[this+0x2593]` to publish null bindings through bound-node slot `+0xf4` before zeroing each slot entry. Current grounded caller is the broader bound-presentation release body `0x0054a190`, so this is the safest current read for releasing the history and seeded lists plus clearing optional slot bindings rather than a narrow list helper.","objdump + caller inspection + local disassembly + layout-state correlation + seeded-list correlation + optional-binding correlation"
0x00548da0,1328,layout_state_refresh_presentation_batches,bootstrap,thiscall,inferred,ghidra-headless,4,Walks the active presentation-batch list and refreshes the bound node state for each selected item. The routine applies batch extents through 0x00547d10 pushes style and gate properties including packed color property 0x3c updates per-slot triplets through 0x005455e0 and 0x005456d0 and emits segment-record or vertex24 spans from the current batch family before advancing to the next record.,ghidra + rizin + llvm-objdump
0x005492d0,3747,layout_state_probe_d3d8_capabilities,bootstrap,thiscall,inferred,ghidra-headless,4,Creates a Direct3D8 probe object and walks adapter or device capability queries for the layout-state presentation path. The routine caches probed texture-memory style fields into shell globals under 0x006d4024 including the values later reported as Texture SRAM and Texture VRAM consults the shell memory-budget helpers 0x0051fa40 and 0x0051fa60 refreshes the gamma ramp through 0x00547f20 when needed and assigns a local renderer capability tier at [this+0x04].,ghidra + rizin + llvm-objdump + strings
0x0054a0c0,176,layout_state_bind_external_source_rebuild_summary_reset_bound_node_and_select_mode_4_or_5,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader setup-side owner in the layout-state family above the newly grounded summary and reset strips. The helper binds one caller-supplied external source onto the bound presentation node `[this+0x25df]` through node slot `+0x12c`, falls back to the midband-handle cleanup strip `0x005463e0` when that bind reports failure, conditionally reapplies the cached gamma-ramp scalar from template field `[[this+0x83c]+0x2f]` through `0x00547f20`, seeds optional handle `[this+0x33ab]` through `0x00570fbd`, rebuilds summary buffer `[this+0x43c]` through `0x00545e30`, runs the repeated bound-node reset strip `0x005464d0`, clears local byte `[this+0x254d]`, and finally selects layout-state mode dword `[this+0x04]` as `4` or `5` from shell dimensions `[0x006d4024+0x11423b/+0x11423f]`. Current grounded caller is the surrounding setup-side branch that prepares the subordinate layout state before later property application, so this is the safest current read for binding the external source, rebuilding the summary/reset strip, and selecting mode `4` or `5` rather than a generic constructor fragment.","objdump + caller inspection + local disassembly + layout-state correlation + bound-node correlation + summary-buffer correlation + resolution-tier correlation"
0x0054a190,228,layout_state_release_bound_presentation_handles_and_clear_controller_slot_0x08,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broad bound-presentation release body in the layout-state family. The helper first re-enters `0x00548c50`, then releases optional handles `[this+0x33ab]`, `[this+0x25e3]`, `[this+0x25e7]`, `[this+0x25df]`, and `[this+0x25db]`, emitting shell notices through localized ids `0x9b` or `0x9c` when the bound-node release paths report success. It also re-enters the two adjacent cleanup helpers `0x005463e0` and `0x005465c0`, clears local presentation pointers `[this+0x2643/+0x25df/+0x25db]`, and finally clears shell controller dword `[0x006d4024+0x08]` back to `0`. Current grounded callers are the direct layout-state branches `0x0054bd64` and `0x0054be7f`, so this is the safest current read for releasing the bound presentation handles and controller slot rather than a generic object destructor.","objdump + caller inspection + local disassembly + layout-state correlation + presentation-release correlation"
0x0054a280,626,layout_state_apply_presentation_properties,bootstrap,thiscall,inferred,ghidra-headless,4,Pushes visibility color and mode-dependent scalar properties from the layout state into the bound presentation node at [this+0x25df]; toggles gate property 0x1c writes packed color property 0x22 from bytes 0x2510..0x2512 updates mode properties 0x23 through 0x26 from template flags and caller-supplied scalars and caches the leading scalar at [this+0x25b3].,ghidra + rizin
0x0054a500,1568,layout_state_refresh_variant_bank_batches_from_handle_0x2663_or_local_descriptor_set,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader batch owner in the layout-state family above the newly grounded `0x00547c30` strip. The helper requires active batch count `[this+0x2667]`, clears the local visited-byte strip `[this+0x254f..]`, pulses property groups `0x89` and `0x0e`, derives two normalized shell-scalars from the current shell presentation size through `0x0051f090 -> 0x00533970/0x00533980`, and then branches on midband handle `[this+0x260f]`. On the null-handle path it snapshots the current slot-triplet state through `0x005488a0`, seeds one fixed triplet pair, binds handle `[this+0x2663]` as one `0x18`-byte table on property `0x142`, reads that table through vtable slot `+0x2c`, rescales the resulting rows by local scalar band `[this+0x36df/+0x36e3/+0x36e7/+0x36eb]`, and commits the resulting batch ranges through variant-bank entries `[this+0x31ab + batch*4]` into node slot `+0x11c`. On the live-handle path it instead binds current segment-record handle `[this+0x265b]`, publishes the local descriptor rooted at `[this+0x35af]`, pushes two fixed property blocks `5` and `6`, and then commits the same visited batch ranges. Current grounded caller is the neighboring owner branch `0x0052c73d`, so this is the safest current read for refreshing the variant-bank batches from handle `0x2663` or the local descriptor set rather than a generic layout rebuild body.","objdump + caller inspection + local disassembly + layout-state correlation + batch-refresh correlation + variant-bank correlation"
0x0054ab20,1262,layout_state_refresh_presentation_batches_with_three_slot_binding_candidates,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader batch-refresh owner in the layout-state family with three optional slot-binding candidates. The helper clears the visited-byte strip `[this+0x254f..]`, rebinds current segment-record handle `[this+0x265b]` onto node property `0x112` when needed, chooses between the capability-gated property strips `0x00547650` and `0x005478a0`, applies one descriptor publish through `0x00546d40`, and then walks the active `0x2d`-stride batch records rooted at `[this+0x266f]`. During that walk it compares previous/current/next candidate values, updates optional slot bindings through `0x00545520` for slots `0`, `1`, and `2`, emits batch ranges through variant-bank entry `[this+0x31ab + batch*4]` into node slot `+0x11c`, marks visited batch bytes under `[this+0x254f]`, and follows the per-batch next-link selectors at `+0x267b/+0x2683/+0x2687`. Current grounded callers are the setup-side layout-state owner branches `0x0052c4d6`, `0x0052c50c`, and `0x0052c53d`, so this is the safest current read for the three-slot candidate batch-refresh owner rather than a generic batch loop.","objdump + caller inspection + local disassembly + layout-state correlation + batch-refresh correlation + slot-binding correlation"
0x0054b030,1159,layout_state_refresh_presentation_batches_with_two_slot_binding_candidates,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Two-slot sibling to `0x0054ab20` in the same layout-state batch family. The owner clears the visited-byte strip `[this+0x254f..]`, rebinds current segment-record handle `[this+0x265b]` when needed, chooses between `0x00547650` and `0x005478a0`, and then walks the same `0x2d`-stride batch records rooted at `[this+0x266f]`. Its candidate-comparison and rebinding phase only manages slots `0` and `1` through `0x00545520`, then commits the selected ranges through variant-bank entry `[this+0x31ab + batch*4]` into node slot `+0x11c`, marks visited bytes, and follows the same per-batch next-link selectors. Current grounded callers are the setup-side owner branches `0x0052c578`, `0x0052c5e5`, `0x0052c63c`, and `0x0052cb2f`, so this is the safest current read for the two-slot candidate batch-refresh owner rather than another generic batch loop.","objdump + caller inspection + local disassembly + layout-state correlation + batch-refresh correlation + slot-binding correlation"
0x0054b4e0,1465,layout_state_refresh_handle_0x265f_backed_batches_with_capability_variant_switch,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Capability-switched batch-refresh owner in the same layout-state family. The helper clears the visited-byte strip `[this+0x254f..]`, ensures current segment-record handle `[this+0x265b]` is rebound, applies a capability-gated pre-strip over properties `0x0f`, `0x18`, and `0x1b`, calls `0x00547650`, and then branches on node slot `+0x128` plus capability byte `[0x006d4024+0x114250]` to choose one of two handle-backed descriptor publishes rooted at `[this+0x265f]`. After that it walks the same `0x2d`-stride batch records and commits them through variant-bank entry `[this+0x31ab + batch*4]`, but the candidate-rebinding phase is narrower and only refreshes slot `0` plus the optional slot-`1` clear path. Current grounded callers are the setup-side layout-state owner branches `0x0052c46c` and `0x0052c49a`, so this is the safest current read for the `0x265f`-backed capability-variant batch owner rather than a generic descriptor upload body.","objdump + caller inspection + local disassembly + layout-state correlation + batch-refresh correlation + capability-variant correlation"
0x0054bab0,89,layout_state_bind_segment_record_table,bootstrap,thiscall,inferred,ghidra-headless,4,Binds the current 32-byte segment-record table at [this+0x2643] onto the presentation node if it changed since the last bind. The helper drives node property 0x112 through vtable slots +0x130 and +0x14c with record size 0x20 and clears the local dirty byte at [this+0x263b].,ghidra + rizin + llvm-objdump
0x0054bb10,90,layout_state_bind_alternate_segment_record_table_0x263f,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small sibling to `0x0054bab0` in the same layout-state family. The helper binds alternate `0x20`-byte segment-record table `[this+0x263f]` onto property `0x112` of the bound presentation node `[this+0x25df]` when that table differs from cached field `[this+0x2637]`, then clears local dirty dword `[this+0x263b]`. Current grounded caller is the nearby owner branch `0x00528885`, so this is the safest current read for the alternate segment-record table bind rather than a broader batch owner.","objdump + caller inspection + local disassembly + layout-state correlation + segment-record correlation"
0x0054bb70,90,layout_state_bind_vertex24_table,bootstrap,thiscall,inferred,ghidra-headless,4,Binds the current 24-byte vertex24 table at [this+0x2647] onto the presentation node if it changed since the last bind. The helper drives node property 0x142 through vtable slots +0x130 and +0x14c with record size 0x18 and clears the local dirty byte at [this+0x263b].,ghidra + rizin + llvm-objdump
0x0054bbd0,22,layout_state_bind_vertex24_table_0x264f_and_publish_property_0x154_from_0x2653,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny wrapper into `0x005471f0` in the layout-state family. The helper binds the `0x18`-byte table `[this+0x264f]` onto the bound presentation node and forwards companion dword `[this+0x2653]` through property `0x154`. Current grounded callers are the neighboring owner branches `0x0052b8be` and `0x0052b94b`, so this is the safest current read for the `0x264f/0x2653` bind-and-publish wrapper rather than a generic thunk.","objdump + caller inspection + local disassembly + layout-state correlation + table-bind correlation"
0x0054bbf0,22,layout_state_bind_vertex24_table_0x2647_and_publish_property_0x154_from_0x264b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny sibling wrapper into `0x005471f0` in the same layout-state family. The helper binds the `0x18`-byte table `[this+0x2647]` onto the bound presentation node and forwards companion dword `[this+0x264b]` through property `0x154`. Current grounded callers are the nearby owner branches `0x0052ae2b` and `0x0054e30b`, so this is the safest current read for the `0x2647/0x264b` bind-and-publish wrapper rather than a generic thunk.","objdump + caller inspection + local disassembly + layout-state correlation + table-bind correlation"
0x0054bc10,592,shell_init_layout_state_defaults,bootstrap,thiscall,inferred,ghidra-headless,4,Initializes the large subordinate layout-state object allocated by 0x0055e2b0; seeds default float and flag fields points [this+0x83c] at a shell-bundle template block near 0x006d4024+0x11468a optionally copies a 0x72c-byte preset table and notifies the shell bundle service at [0x006d4024+0x28].,ghidra + rizin
0x0054be60,52,layout_state_export_preset_table_0x840_to_global_defaults_and_refresh,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small export-and-refresh helper in the shell layout-state family. The function copies the full `0x72c`-byte preset table from `[this+0x840]` into global default cache `0x00ccbb68`, raises global dirty byte `0x00ccd820`, refreshes the surrounding layout-state side through `0x0054a190`, and clears shell controller pointer field `[0x006d4024+0x0c]` through `shell_controller_store_pointer_field_0x0c` `0x0051eff0(0)`. Current grounded callers are the small and broad layout-state release bodies `0x0055dd9a` and `0x0055e29d`, so this is the safest current read for exporting preset table `0x840` into the global defaults and refreshing the shell-side cache rather than a generic memcpy helper.","objdump + caller inspection + local disassembly + layout-state correlation + default-cache correlation"
0x0054bea0,1399,layout_state_apply_interpolated_pose,bootstrap,thiscall,inferred,ghidra-headless,4,Applies an interpolated pose and palette sample on the subordinate layout-state object using the controller counters passed by callers; clamps the time window blends preset tables at offsets 0x840 through 0x86f updates color bytes at 0x2510 through 0x2512 invokes the bound presentation node at [this+0x25df] and finishes through 0x0054a280.,ghidra + rizin
0x0055ddc0,664,shell_seed_layout_state_probe_snapshot_handles_by_resolution_tier,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Setup-side probe owner for the shell layout-state family. The helper first chooses a small resolution tier, `4` or `5`, from shell dimensions `[0x006d4024+0x11423b/+0x11423f]`, then programs a sequence of fixed slot-triplet patterns into subordinate layout state `[this+0x2d]` through `0x005455e0/0x005456d0`, snapshotting each resulting slot table through `0x005454c0` and storing the returned handles into local probe fields `[this+0x35/+0x39/+0x3d/+0x41/+0x45/+0x49/+0x4d/+0x51/+0x55/+0x59]`. After that it seeds all live slots to the fixed `(1,2,1)` pattern through `0x00548820`, clears shell capability byte `[0x006d4024+0x114251]`, probes several of the stored snapshot handles through `layout_state_run_texture_for_tests_binding_probe` `0x005489f0`, mutates one fallback probe record at `[this+0x4d]` when the first pass fails, and finally mirrors the resulting booleans into shell capability bytes `[0x006d4024+0x114250/+0x114251]`. Current grounded caller is the layout-state constructor `shell_create_layout_state` `0x0055e2b0`, so this is the safest current read for seeding the layout-state probe snapshots by resolution tier rather than a generic table initializer.","objdump + caller inspection + local disassembly + layout-state correlation + capability-probe correlation + resolution-tier correlation"
0x0055dd80,50,shell_release_layout_state_field_0x2d_if_present,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small layout-state teardown sibling over owner field `[this+0x2d]`. The helper first refreshes and drops the live layout-state side through `0x00547610` and `0x00542c10`, then, when `[this+0x2d]` is nonnull, releases that subordinate layout-state object through `0x0054be60` and `0x0053b080` before clearing the field back to null. Current grounded callers are the broader layout-state rebuild owner `0x00565110` and the local branch at `0x00520008`, so this is the safest current read for the direct layout-state field release helper rather than a generic object free.","objdump + caller inspection + local disassembly + layout-state correlation + teardown correlation"
0x0055e060,587,shell_release_layout_state_owner_resources_and_subordinate_handles,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader release body in the same shell layout-state owner family. When activation dword `[this+0x01]` is live, the helper first shuts down subordinate payload `[this+0x5d]`, refreshes and drops layout-state side `[this+0x2d]` through `0x00547610` and `0x00542c10`, and then walks a long owned-handle strip rooted at `[this+0x65]`, `[this+0x79..+0x8d]`, `[this+0x95..+0xa5]`, `[this+0x364d]`, and `[this+0x3651..+0x3665]`, releasing each live entry through the corresponding local family helper plus `0x0053b080` or `0x0053c000`. The tail also clears several cached layout-owned pointers and finally releases the subordinate layout-state object at `[this+0x2d]` through `0x0054be60`. Current grounded caller is the shell-side owner branch at `0x0051ffee`, which frees `[owner+0x18]` through this helper when the higher-level teardown flag is set, so this is the safest current read for the full layout-state owner release body rather than a small field reset.","objdump + caller inspection + local disassembly + layout-state correlation + owner-release correlation"
0x0054e3a0,528,shell_controller_window_message_dispatch,shell,stdcall,inferred,objdump,4,Primary window-message ingress for the active shell controller window. The dispatcher branches over low window lifecycle messages handles `WM_KEYDOWN` and `WM_KEYUP` by first updating the shell controller through 0x0051f0c0 or 0x0051f0d0 and then forwarding the transition into shell_input_apply_window_key_transition at 0x0054f290 on the shell input object rooted at 0x006d4018 routes `WM_COMMAND` through 0x0054eb10 routes mouse messages in the `0x0200..0x0208` family through 0x0054ee50 and falls back to `DefWindowProcA` for unhandled cases. This is the first grounded shell-side input ingest path rather than only a generic message drain.,objdump + import table + callsite inspection
0x0054e5d0,88,shell_drain_pending_window_messages,shell,cdecl,inferred,objdump + analysis-context,4,Shared pending-message drain that loops on `PeekMessageA` with remove mode 1 and feeds each dequeued record through `TranslateMessage` and `DispatchMessageA` until the queue is empty. Shell modal waits layout rebuild paths mouse-cursor frame work and the keyboard-toggle helpers all reuse this routine so it sits below the real input handlers rather than serving as the input dispatcher itself.,objdump + analysis-context + import table
0x0054e710,110,shell_input_state_init,shell,thiscall,inferred,objdump + analysis-context,3,Initializes the standalone shell input-state object later stored at 0x006d4018. It zeroes the 0xaa8-byte state block resets counters and flags under +0xa88 through +0xa9c caches host metrics through `GetSystemMetrics` and `GetDoubleClickTime` and clears the per-key state storage that later window-message handlers update.,objdump + analysis-context + import table
0x0054e880,305,shell_input_service_pointer_proximity_event_record_and_queue_followon,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Processes one queued 12-dword shell-input event record from the ring rooted at `[this+0x128]` as a pointer-proximity or timeout update. The helper classifies input record types `6`, `8`, and `10` into one of three local slot bands under `[this+0x104]`, `[this+0x110]`, and `[this+0x11c]`, measures the absolute pointer delta against the controller-selected view size from `[0x006d4024+0x34 + selector*0x15]`, compares that against the shared radius threshold, and either snapshots the current pointer coordinates plus deadline tick into the chosen slot or clones the record into a follow-on event with rewritten type `0x1e`, `0x20`, or `0x22` before requeueing it through `0x0054e9c0`. Current grounded callers are the queue wrappers `0x0054e9c0`, `0x0054f5b0`, and `0x0054eb10`, so this is the safest current read for the pointer-proximity event service owner rather than another generic ring-buffer helper.","objdump + caller inspection + local disassembly + event-ring correlation + pointer-proximity correlation"
0x0054e9c0,79,shell_input_enqueue_event_record_and_run_pointer_followon,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small queue wrapper over the shell-input event ring at `[this+0x128]`. The helper appends one caller-supplied 12-dword record into the ring, rewrites ring index `[this+0xa88]` from `0x32` back to `0x31` when needed, increments that index, and immediately tails into `0x0054e880` on the same record. Current grounded callers are `shell_input_apply_window_key_transition` `0x0054f290`, `shell_input_enqueue_window_event_record_and_signal_dispatch` `0x0054f5b0`, and `shell_input_handle_window_command_and_toggle_messages` `0x0054eb10`.","objdump + caller inspection + local disassembly + event-ring correlation"
0x0054ea20,229,shell_input_pop_next_event_record_with_type2_coalescing,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Dequeues the next 12-dword shell-input event record from the same ring at `[this+0x128]` into one caller output buffer. When more than one event is pending and nested dispatch latch `[this+0xa90]` is clear, the helper compacts the ring forward, decrements the event count, and performs one special coalescing pass for adjacent type-`2` records when no key-state byte at `[this+0x100]` is active. Current grounded caller is `shell_input_snapshot_dispatch_state` `0x0054f4d0`, which uses this helper to pull one filtered dispatch record at a time.","objdump + caller inspection + local disassembly + event-ring correlation + coalescing correlation"
0x005708c0,11,refcounted_object_vtable_0x5deba0_query_current_matrix_pointer,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny current-entry pointer helper for the `0x5deba0` object family. The function resolves and returns the current `0x40`-byte matrix entry at `[this+0x08 + [this+0x0c]*0x40]`.","objdump + local disassembly + object-family correlation + matrix-row correlation"
0x005708ce,36,aligned_alloc_with_trailing_pad_byte,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small aligned-allocation helper reused by the `0x5deba0` object family. The function allocates `requested_size + 0x10` bytes through `0x0053b070`, rounds the returned pointer up to the next 16-byte boundary, stores the applied back-offset in byte `[aligned_ptr-1]`, and returns that aligned pointer. Current grounded caller is `0x0057091d`, which uses this helper for `0x40`-byte matrix-row blocks.","objdump + local disassembly + allocation correlation + alignment correlation"
0x005708f2,22,aligned_free_with_trailing_pad_byte,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Free-side sibling to `0x005708ce`. When the incoming aligned pointer is nonnull, the helper reads the stored back-offset byte at `[ptr-1]`, reconstructs the original allocation base, and frees it through `0x0053b080`. Current grounded callers are destructor `0x00570908` and the `0x5deba0` growth path.","objdump + local disassembly + allocation correlation + alignment correlation"
0x00570908,21,refcounted_object_vtable_0x5deba0_destruct_and_release_row_block,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small destructor-side helper for the `0x5deba0` object family. The function reinstalls vtable `0x005deba0`, releases optional row-block pointer `[this+0x08]` through `0x005708f2`, and returns. Current grounded caller is the release wrapper `0x005709da`, so this is the safest current read for destructing the object and dropping its row block rather than a broader owner teardown.","objdump + local disassembly + object-family correlation + row-block correlation"
0x0057091d,108,refcounted_object_vtable_0x5deba0_reserve_0x40_byte_row_capacity,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Reserve owner for the same `0x5deba0` object family. The helper allocates one aligned row block sized as `requested_count << 6`, fills it from fixed `0x40`-byte template `0x0056cd2c`, stores the resulting pointer into `[this+0x08]`, stores requested row capacity into `[this+0x04]`, clears live row count `[this+0x0c]`, and then dispatches one object-specific follow-on through vtable slot `+0x14`. Current grounded caller is the create-and-reserve wrapper `0x00570fbd(0x10)`, so this is the safest current read for reserving `0x40`-byte row capacity rather than a generic allocator.","objdump + caller inspection + local disassembly + object-family correlation + row-capacity correlation"
0x0057098b,77,refcounted_object_vtable_0x5deba0_query_interface_iunknown_or_custom_iid,bootstrap,stdcall,inferred,objdump + local disassembly + rdata decode,2,"Small `QueryInterface`-style gate for the `0x5deba0` object family. The helper accepts exactly two interface ids: `IUnknown` `{00000000-0000-0000-C000-000000000046}` from `0x005eaaec` and one custom IID rooted at `0x005c8520`; on either match it returns the original object pointer through the caller outparam and increments the refcount through vtable slot `+0x04`, otherwise it returns `0x80004002`.","objdump + local disassembly + rdata decode + object-family correlation + COM-correlation"
0x005709da,26,refcounted_object_vtable_0x5deba0_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for the `0x5deba0` object family. The helper re-enters destructor `0x00570908`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`. Current grounded caller is refcount helper `0x00570fa1`, which invokes this path when refcount `[this+0x10]` reaches zero.","objdump + local disassembly + object-family correlation + refcount correlation"
0x005709f6,180,refcounted_object_vtable_0x5deba0_grow_row_capacity_and_append_duplicate_last_row,bootstrap,thiscall,inferred,objdump + local disassembly,2,"First growth owner above `0x0057091d` in the same `0x5deba0` object family. The helper increments live row count `[this+0x0c]`, doubles row capacity `[this+0x04]` and reallocates the `0x40`-byte row block when the new count would exceed capacity, then duplicates the previous `0x40`-byte row into the new last slot. This is the safest current read for growing row capacity and appending a duplicate of the last row rather than a generic vector push.","objdump + local disassembly + object-family correlation + row-capacity correlation + row-block correlation"
0x00570aac,95,refcounted_object_vtable_0x5deba0_set_current_matrix_to_identity,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small current-entry seed helper for the `0x5deba0` object family. The function resolves the current `0x40`-byte entry at `[this+0x08 + [this+0x0c]*0x40]`, zeroes all sixteen float lanes, and then writes `1.0` into offsets `0x00`, `0x14`, `0x28`, and `0x3c`, producing an identity 4x4 matrix. This is the safest current read for seeding the current matrix to identity rather than a generic clear helper.","objdump + local disassembly + object-family correlation + matrix-row correlation"
0x00570b0d,29,refcounted_object_vtable_0x5deba0_store_current_matrix_from_caller_block,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Direct current-entry store helper for the `0x5deba0` object family. The function copies one caller-supplied `0x40`-byte block into the current entry at `[this+0x08 + [this+0x0c]*0x40]`. This is the safest current read for storing the current matrix from a caller block rather than a generic memcpy wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation"
0x00570b2c,72,refcounted_object_vtable_0x5deba0_compose_current_matrix_with_caller_matrix_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Current-entry composition helper for the `0x5deba0` object family. The function materializes one composed `0x40`-byte matrix through `0x0056d3cd(temp, current, caller)` and writes the resulting block back into the current entry at `[this+0x08 + [this+0x0c]*0x40]`. This is the safest current read for composing the current matrix with one caller matrix on the right-hand side rather than a generic temp-buffer wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + composition correlation"
0x00570b76,72,refcounted_object_vtable_0x5deba0_compose_caller_matrix_with_current_matrix_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling composition helper to `0x00570b2c` in the same `0x5deba0` object family. The function materializes one composed `0x40`-byte matrix through `0x0056d3cd(temp, caller, current)` and writes the result back into the current entry. This is the safest current read for composing the caller matrix with the current matrix on the right-hand side rather than another generic temp-buffer wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + composition correlation"
0x00570bc0,108,refcounted_object_vtable_0x5deba0_build_helper_matrix_56df7d_and_compose_current_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Helper-generated composition owner in the `0x5deba0` object family. The function first builds one temporary `0x40`-byte matrix through `0x0056df7d` from the caller pointer plus one float scalar, then composes that helper matrix with the current matrix through `0x0056d3cd(temp, current, helper)` and writes the result back into the current entry. This is the safest current read for the `0x56df7d`-generated right-side composition path rather than a generic stack-buffer owner.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570c2f,108,refcounted_object_vtable_0x5deba0_build_helper_matrix_56df7d_and_compose_current_lhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling helper-generated composition owner to `0x00570bc0` in the same `0x5deba0` object family. The function builds the same temporary `0x40`-byte helper matrix through `0x0056df7d`, then composes it on the left through `0x0056d3cd(temp, helper, current)` and stores the result back into the current entry. This is the safest current read for the left-side `0x56df7d` composition path rather than another generic stack-buffer owner.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570c9e,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56e1a8_and_compose_current_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Three-scalar helper-generated composition owner in the `0x5deba0` object family. The function first builds one temporary `0x40`-byte matrix through `0x0056e1a8` from three caller float scalars, then composes that helper matrix with the current matrix through `0x0056d3cd(temp, current, helper)` and writes the result back into the current entry. This is the safest current read for the `0x56e1a8`-generated right-side composition path rather than a generic float wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570d1a,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56e1a8_and_compose_current_lhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling helper-generated composition owner to `0x00570c9e` in the same `0x5deba0` object family. The function builds the same temporary `0x40`-byte matrix through `0x0056e1a8` from three caller float scalars, composes it on the left through `0x0056d3cd(temp, helper, current)`, and stores the result back into the current entry. This is the safest current read for the left-side `0x56e1a8` composition path rather than another generic float wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570d96,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56dc9a_and_compose_current_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Three-scalar helper-generated composition owner in the same `0x5deba0` family, but using helper `0x0056dc9a`. The function materializes one temporary `0x40`-byte matrix from three caller float scalars, then composes it with the current matrix through `0x0056d3cd(temp, current, helper)` and writes the result back into the current entry. This is the safest current read for the `0x56dc9a`-generated right-side composition path rather than a generic math wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570e12,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56dc9a_and_compose_current_lhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling helper-generated composition owner to `0x00570d96` in the same `0x5deba0` object family. The function builds the same temporary `0x40`-byte matrix through `0x0056dc9a`, composes it on the left through `0x0056d3cd(temp, helper, current)`, and writes the result back into the current entry. This is the safest current read for the left-side `0x56dc9a` composition path rather than another generic math wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570e8e,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56dd2a_and_compose_current_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Three-scalar helper-generated composition owner in the same `0x5deba0` family, but using helper `0x0056dd2a`. The function materializes one temporary `0x40`-byte matrix from three caller float scalars, then composes it with the current matrix through `0x0056d3cd(temp, current, helper)` and writes the result back into the current entry. This is the safest current read for the `0x56dd2a`-generated right-side composition path rather than a generic math wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570f0a,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56dd2a_and_compose_current_lhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling helper-generated composition owner to `0x00570e8e` in the same `0x5deba0` object family. The function builds the same temporary `0x40`-byte matrix through `0x0056dd2a`, composes it on the left through `0x0056d3cd(temp, helper, current)`, and writes the result back into the current entry. This is the safest current read for the left-side `0x56dd2a` composition path rather than another generic math wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570f86,27,refcounted_object_vtable_0x5deba0_init,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny constructor-style initializer for one 0x14-byte refcounted object family. The helper installs vtable `0x005deba0`, clears dwords `[this+0x04/+0x08/+0x0c]`, and seeds refcount `[this+0x10] = 1`. Current grounded direct caller is the create-and-reserve wrapper `0x00570fbd`, so this is the safest current read for initializing the `0x5deba0` object family rather than a wider bootstrap owner.","objdump + local disassembly + object-family correlation"
0x00570fa1,26,refcounted_object_vtable_0x5deba0_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small refcount-drop helper for the `0x5deba0` object family. The function decrements refcount `[this+0x10]`, returns the remaining count when it stays positive, and otherwise tail-calls release wrapper `0x005709da(1)` to destroy and free the object. This is the safest current read for the direct refcount decrement path rather than a generic counter helper.","objdump + local disassembly + object-family correlation + refcount correlation"
0x00570fbd,86,create_refcounted_object_vtable_0x5deba0_and_reserve_block_0x10,bootstrap,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Small create-and-reserve wrapper for the same `0x5deba0` object family. The helper validates the caller out-pointer, allocates one `0x14`-byte object through `0x0053b070`, initializes it through `0x00570f86`, asks the new object to reserve or materialize one `0x10`-byte block through `0x0057091d(0x10)`, releases the object through vtable slot `+0x08` on failure, and stores the live pointer through the caller outparam on success. Current grounded caller is the setup-side layout-state owner `0x0054a0c0`, which uses this helper to seed optional handle `[layout+0x33ab]`, so this is the safest current read for creating the refcounted `0x5deba0` object and reserving its first `0x10`-byte block rather than a generic allocator.","objdump + caller inspection + local disassembly + object-family correlation + allocation correlation"
0x0057ad20,58,refcounted_object_vtable_0x5def30_destruct_release_resource_fields_and_attached_object,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Destructor-side owner for sibling object family `0x005def30`. The helper reinstalls vtable `0x005def30`, conditionally tears down resource field `[this+0x48]` through `0x00580bb9/0x00580bdc`, frees optional heap block `[this+0x08]` through import thunk `0x005c8058`, and releases attached object `[this+0x4c]` through its vtable slot `+0x08`. This is the safest current read for destructing the `0x5def30` object family and releasing its owned fields rather than a generic cleanup body.","objdump + local disassembly + object-family correlation + resource-field correlation"
0x0057ad5a,11,refcounted_object_vtable_0x5def30_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny addref helper for object family `0x005def30`. The function increments refcount `[this+0x04]` and returns the new count.","objdump + local disassembly + object-family correlation + refcount correlation"
0x0057ad67,91,refcounted_object_vtable_0x5def30_bind_resource_field_attach_object_and_copy_15_dword_payload,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Primary setup owner for object family `0x005def30`. When both caller inputs are nonnull, the helper initializes resource field `[this+0x48]` through `0x0058123c`, allocates payload block `[this+0x08]` through import thunk `0x005c8054`, stores attached object `[this+0x4c]` with an addref, and copies one `0x0f`-dword payload block into `[this+0x0c]`. Otherwise it returns `0x8876086c`. This is the safest current read for binding the resource field, attaching the sibling object, and copying the fixed payload block rather than a generic constructor fragment.","objdump + local disassembly + object-family correlation + payload-copy correlation"
0x0057add4,21,refcounted_object_vtable_0x5def30_get_attached_object_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small getter for object family `0x005def30`. The helper writes attached object `[this+0x4c]` through the caller outparam and addrefs it through vtable slot `+0x04`, returning `0x8876086c` only when the caller outparam is null.","objdump + local disassembly + object-family correlation + attached-object correlation"
0x0057adfb,18,refcounted_object_vtable_0x5def30_copy_15_dword_payload_out,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small payload-copy helper for object family `0x005def30`. The function copies the fixed `0x0f`-dword payload block from `[this+0x0c]` into the caller destination and returns `0x8876086c` only when the destination pointer is null.","objdump + local disassembly + object-family correlation + payload-copy correlation"
0x0057ae0f,11,refcounted_object_vtable_0x5def30_forward_resource_field_0x48_query_5809c7,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny pass-through wrapper over resource field `[this+0x48]` in object family `0x005def30`. The helper forwards directly into `0x005809c7`.","objdump + local disassembly + object-family correlation + resource-field correlation"
0x0057ae1e,11,refcounted_object_vtable_0x5def30_forward_resource_field_0x48_query_580a54,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny sibling wrapper to `0x0057ae0f` in the same `0x5def30` family. The helper forwards resource field `[this+0x48]` directly into `0x00580a54`.","objdump + local disassembly + object-family correlation + resource-field correlation"
0x0057ae2d,35,refcounted_object_vtable_0x5def30_dispatch_resource_and_payload_call_580d29_mode0,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Broader pass-through owner for object family `0x005def30`. The helper forwards resource field `[this+0x48]`, payload block `[this+0x08]`, five caller arguments, and fixed mode flag `0` into `0x00580d29`.","objdump + local disassembly + object-family correlation + resource-field correlation + payload-block correlation"
0x0057ae53,35,refcounted_object_vtable_0x5def30_dispatch_resource_and_payload_call_580d29_mode1,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Mode-`1` sibling to `0x0057ae2d` in the same `0x5def30` family. The helper forwards resource field `[this+0x48]`, payload block `[this+0x08]`, five caller arguments, and fixed mode flag `1` into `0x00580d29`.","objdump + local disassembly + object-family correlation + resource-field correlation + payload-block correlation"
0x0057ae79,11,refcounted_object_vtable_0x5def30_forward_resource_field_0x48_query_580a84,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny pass-through wrapper over resource field `[this+0x48]` in object family `0x005def30`. The helper forwards directly into `0x00580a84`.","objdump + local disassembly + object-family correlation + resource-field correlation"
0x0057ae88,11,refcounted_object_vtable_0x5def30_forward_resource_field_0x48_query_580aff,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny sibling wrapper to `0x0057ae79` in the same `0x5def30` family. The helper forwards resource field `[this+0x48]` directly into `0x00580aff`.","objdump + local disassembly + object-family correlation + resource-field correlation"
0x0057ae97,66,refcounted_object_vtable_0x5def30_query_interface_iunknown_or_custom_iid,bootstrap,stdcall,inferred,objdump + local disassembly + rdata decode,2,"Small `QueryInterface`-style gate for object family `0x005def30`. The helper accepts exactly `IUnknown` from `0x005eaaec` plus one custom IID rooted at `0x005c8500`; on either match it returns the original object pointer through the caller outparam and increments the refcount through vtable slot `+0x04`, otherwise it returns `0x80004002`.","objdump + local disassembly + rdata decode + object-family correlation + COM-correlation"
0x0057aedb,22,refcounted_object_vtable_0x5def30_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small refcount-drop helper for object family `0x005def30`. The function decrements refcount `[this+0x04]`, returns the remaining count when it stays positive, and otherwise tail-calls release wrapper `0x00571016(1)` to destroy and free the object.","objdump + local disassembly + object-family correlation + refcount correlation"
0x0057aef3,27,refcounted_object_vtable_0x5def30_init,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny constructor-style initializer for object family `0x005def30`. The helper installs vtable `0x005def30`, seeds refcount `[this+0x04] = 1`, and clears optional fields `[this+0x08]`, `[this+0x48]`, and `[this+0x4c]`.","objdump + local disassembly + object-family correlation"
0x0057af0e,64,refcounted_object_vtable_0x5def5c_destruct_release_optional_target_and_two_handles,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Destructor-side owner for sibling object family `0x005def5c`. The helper reinstalls vtable `0x005def5c`, and when target field `[this+0x08]` is live it conditionally releases optional handles `[this+0x14]` and `[this+0x10]` through target vtable slot `+0xe0` before releasing the target itself through slot `+0x08`. This is the safest current read for destructing the `0x5def5c` object family and releasing its optional target-side handles rather than a generic cleanup body.","objdump + local disassembly + object-family correlation + target-handle correlation"
0x0057af4e,11,refcounted_object_vtable_0x5def5c_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny addref helper for sibling object family `0x005def5c`. The function increments refcount `[this+0x04]` and returns the new count.","objdump + local disassembly + object-family correlation + refcount correlation"
0x0057af5b,115,refcounted_object_vtable_0x5def5c_attach_target_and_derive_cached_flag_pair,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Primary setup owner for sibling object family `0x005def5c`. The helper stores one caller target object into `[this+0x08]` with addref, queries two target-side flag blocks through vtable slots `+0x1c` and `+0x24`, and derives cached booleans `[this+0x1c]` and `[this+0x18]` from the observed flag bits before returning success. When the incoming target pointer is null it returns `0x8876086c`. This is the safest current read for attaching the target and deriving the cached flag pair rather than a generic constructor fragment.","objdump + local disassembly + object-family correlation + target-flag correlation"
0x0057afd0,36,refcounted_object_vtable_0x5def5c_get_target_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small getter for sibling object family `0x5def5c`. The helper writes target field `[this+0x08]` through the caller outparam and addrefs it through vtable slot `+0x04`, returning `0x8876086c` only when the caller outparam is null.","objdump + local disassembly + object-family correlation + target-object correlation"
0x0057aff6,40,refcounted_object_vtable_0x5def5c_release_handle_0x10_once,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small one-shot release helper for sibling object family `0x5def5c`. When live flag `[this+0x0c]` is nonzero, the function asks target `[this+0x08]` to release handle `[this+0x10]` through vtable slot `+0xd8`, then clears `[this+0x0c]` back to `0`; otherwise it returns `0x80004005`. This is the safest current read for releasing handle `0x10` once rather than a generic boolean guard.","objdump + local disassembly + object-family correlation + target-handle correlation"
0x0057b021,61,refcounted_object_vtable_0x5def5c_clear_optional_handles_0x14_and_0x10,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small clear-side sibling to `0x0057aff6` in the `0x5def5c` family. When target field `[this+0x08]` is live, the helper conditionally releases optional handles `[this+0x14]` and `[this+0x10]` through target vtable slot `+0xe0`, then clears both fields back to `0`.","objdump + local disassembly + object-family correlation + target-handle correlation"
0x0057b060,3,refcounted_object_vtable_0x5def5c_return_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Literal zero-return stub in the `0x5def5c` helper strip.","objdump + local disassembly + object-family correlation"
0x0057b065,66,refcounted_object_vtable_0x5def5c_query_interface_iunknown_or_custom_iid,bootstrap,stdcall,inferred,objdump + local disassembly + rdata decode,2,"Small `QueryInterface`-style gate for object family `0x5def5c`. The helper accepts exactly `IUnknown` from `0x005eaaec` plus one custom IID rooted at `0x005c84f0`; on either match it returns the original object pointer through the caller outparam and increments the refcount through vtable slot `+0x04`, otherwise it returns `0x80004002`.","objdump + local disassembly + rdata decode + object-family correlation + COM-correlation"
0x0057b0a9,22,refcounted_object_vtable_0x5def5c_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small refcount-drop helper for sibling object family `0x5def5c`. The function decrements refcount `[this+0x04]`, returns the remaining count when it stays positive, and otherwise tail-calls release wrapper `0x00571032(1)` to destroy and free the object.","objdump + local disassembly + object-family correlation + refcount correlation"
0x0057b0c1,1074,refcounted_object_vtable_0x5def5c_seed_target_handles_publish_property_strip_and_latch_ready,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Broader service owner for sibling object family `0x5def5c`. The helper rejects re-entry when ready latch `[this+0x0c]` is already set, then, when optional handle `[this+0x10]` is still null, queries the target at `[this+0x08]` through slots `+0xd0`, `+0x130`, `+0x94`, `+0xc8`, `+0xfc`, and `+0xd4` to seed the two handle lanes `[this+0x10/+0x14]`, publish one fixed property strip, and optionally build one target-derived matrix when cached flag `[this+0x1c]` is clear. The tail always replays target slot `+0xdc` for `[this+0x10]`, target slot `+0xd8` for `[this+0x14]`, conditionally emits one more target-derived matrix through slot `+0x94`, and finally marks ready latch `[this+0x0c] = 1`. This is the safest current read for seeding target handles, publishing the fixed property strip, and latching the object ready rather than a generic virtual wrapper.","objdump + local disassembly + object-family correlation + target-handle correlation + property-strip correlation"
0x0057b4fd,213,target_object_build_local_transform_block_from_optional_anchor_pairs_angle_and_scale_and_dispatch_slot_0x18,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Broader target-side geometry owner immediately above the `0x5def5c` service strip. The helper conditionally lifts up to three optional caller anchor pairs into local vec2-plus-scalar records, derives one temporary transform block through `0x0056e1bf` from those optional anchors plus caller angle and scale inputs, and then forwards that finished block into the target object through vtable slot `+0x18` with the caller's dispatch pair. This is the safest current read for building one local transform block from optional anchor pairs, angle, and scale before dispatching slot `+0x18`, rather than a generic float wrapper.","objdump + local disassembly + target-object correlation + transform-block correlation"
0x00580867,75,target_service_init_clear_entry_bands_and_aux_fields,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny constructor-style initializer for the target-service object family wrapped by `0x005def30`. The helper seeds refcount `[this] = 1`, clears the target, attached-object, embedded entry-band roots, ready byte, service handles, auxiliary handle roots, and list link at `[this+0xac]`, and leaves the object ready for the later constructor-side owner `0x00580be8`.","objdump + local disassembly + target-service-family correlation + constructor correlation"
0x005808b2,249,target_service_destruct_release_handles_entry_bands_and_unlink_global_cache,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Destructor-side owner for the same target-service family. The helper releases the two target-bound service handles `[this+0x64/+0x68]` through target slot `+0xe0`, walks and releases the two embedded eight-entry bands rooted at `[this+0x10]` and `[this+0x30]`, drops attached object `[this+0x0c]` and target `[this+0x04]`, tears down the auxiliary handle family rooted at `[this+0x6c]`, `[this+0x98]`, `[this+0x9c]`, and `[this+0xa8]` through the imported `0x005c8030/0x005c803c/0x005c8058` helpers, and finally unlinks the object from the global cache chain rooted at `0x00db89e4`. This is the safest current read for the full target-service destructor rather than a generic cleanup body.","objdump + local disassembly + target-service-family correlation + destructor correlation + global-cache correlation"
0x005809ab,28,target_service_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for the target-service family. The helper re-enters destructor `0x005808b2`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`. Current grounded caller is refcount helper `0x00580bdc`.","objdump + local disassembly + target-service-family correlation + refcount correlation"
0x005809c7,141,target_service_seed_handles_0x64_0x68_and_latch_ready_0x60,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Activation-side owner for the next target-service family beneath the `0x5def30` wrappers. When ready byte `[this+0x60]` is still clear, the helper ensures service handles `[this+0x64]` and `[this+0x68]` through target `[this+0x04]` vtable slots `+0xd0` and `+0xd4`, invokes attached object `[this+0x0c]` through slot `+0x10`, republishes those two handles back into the target through slots `+0xdc` and `+0xd8`, and finally marks `[this+0x60] = 1`. This is the safest current read for seeding the two service handles and latching the service live rather than a generic query helper.","objdump + local disassembly + target-service-family correlation + handle-seed correlation"
0x00580a54,48,target_service_release_handle_0x64_and_clear_ready_0x60,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Clear-side sibling to `0x005809c7` in the same target-service family. When ready byte `[this+0x60]` is nonzero, the helper asks target `[this+0x04]` to release handle `[this+0x64]` through vtable slot `+0xd8`, notifies attached object `[this+0x0c]` through slot `+0x1c`, and clears `[this+0x60]` back to `0`.","objdump + local disassembly + target-service-family correlation + handle-release correlation"
0x00580a84,123,target_service_release_handles_and_reset_embedded_entry_bands,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Broader release owner for the same target-service family. The helper tears down target-side handle state through target `[this+0x04]`, attached object `[this+0x0c]`, and the optional handles rooted at `[this+0x64]` and `[this+0x68]`, then iterates the two embedded eight-entry bands under `[this+0x10]` and `[this+0x30]` to clear their per-entry pointers and counters. This is the safest current read for releasing the bound handles and resetting the embedded entry bands rather than a generic cleanup fragment.","objdump + local disassembly + target-service-family correlation + embedded-entry-band correlation"
0x00580aff,186,target_service_build_embedded_entry_bands_from_mode_variant_and_dispatch_slot_0x3c,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Setup-side owner immediately above the clear strip in the same target-service family. When entry root `[this+0x10]` is still null, the helper branches on local mode byte `[this+0x50]` to choose one of two fixed parameter triples, seeds control scalars `[this+0x54]`, `[this+0x58]`, and `[this+0x5c]` through `0x00570669` and `0x00570691`, iterates the embedded entry bands rooted at `[this+0x10]` and dispatches each live per-entry object through slot `+0x3c`. This is the safest current read for building the embedded entry bands from the mode variant and dispatching their setup slot rather than a generic initializer.","objdump + local disassembly + target-service-family correlation + embedded-entry-band correlation"
0x00580bb9,35,target_service_release_aux_handle_band_if_live,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small auxiliary release helper for the same target-service family. When optional band flag `[this+0x6c]` is live, the helper walks the pointer band rooted at `[this+0xa8]`, releases it through import thunk `0x005c803c`, and clears the associated slots back to `0`.","objdump + local disassembly + target-service-family correlation + auxiliary-handle correlation"
0x00580bdc,12,target_service_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny refcount-drop helper for the same target-service family. The function decrements refcount `[this]` and when it reaches zero tail-calls release wrapper `0x005809ab(1)`.","objdump + local disassembly + target-service-family correlation + refcount correlation"
0x00580be8,321,target_service_init_seed_mode_scalars_build_entry_bands_and_bind_aux_handles,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Constructor-side owner for the target-service family wrapped by the `0x5def30` object. The helper stores caller target `[this+0x04]`, derives mode byte `[this+0x50]` from target-side flags, seeds the fixed scalar triple `[this+0x54] = 0x15`, `[this+0x58] = 0x40`, `[this+0x5c] = 0x10`, invokes embedded-band builder `0x00580aff`, initializes the later service roots under `[this+0x70..]`, and allocates or binds the auxiliary handle family rooted at `[this+0x6c]`, `[this+0x98]`, and `[this+0x9c]`. This is the safest current read for initializing the target-service object, seeding its mode scalars, building the entry bands, and binding the auxiliary handles rather than a generic constructor fragment.","objdump + local disassembly + target-service-family correlation + constructor correlation"
0x00580d29,1299,target_service_dispatch_payload_block_with_mode_variant_and_target_callbacks,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Primary target-service owner beneath the `0x0057ae2d/0x0057ae53` wrappers. The helper accepts the target-service object, the caller payload block, five caller arguments, and a fixed mode variant flag from the wrapper, then branches across local bounds, anchor, and callback conditions while using service handle `[this+0x6c]` plus external callbacks rooted at `0x005c81e4`, `0x005c8248`, and `0x005c824c`. Current static evidence is strong enough to ground this as the main payload-dispatch and layout-style service body for the target-service family, while the exact user-facing meaning of every branch remains open.","objdump + local disassembly + target-service-family correlation + payload-block correlation + callback correlation"
0x0058123c,117,target_service_cache_or_create_for_target_and_return_via_outparam,bootstrap,cdecl,inferred,objdump + local disassembly,2,"Factory-side helper above the target-service family. The function walks the global cache chain rooted at `0x00db89e4` looking for an existing target-service object whose target field `[entry+0x04]` matches the caller target. On a hit it increments the service refcount and returns the cached object through the caller outparam. Otherwise it allocates one `0xb0`-byte object through `0x0053b070`, initializes it through `0x00580867`, runs constructor owner `0x00580be8`, and on failure releases it through `0x005809ab(1)`. This is the safest current read for the cache-or-create factory for the target-service family rather than a generic resource wrapper constructor.","objdump + local disassembly + target-service-family correlation + global-cache correlation + factory correlation"
0x005812b1,16,dword_pointer_vector_reset_4dwords,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny reset helper for one four-dword vector-style record. The function clears fields `[this+0x00]`, `[this+0x04]`, `[this+0x08]`, and `[this+0x0c]` back to zero.","objdump + local disassembly + container-helper correlation"
0x005812c1,14,dword_pointer_vector_release_storage_if_nonnull,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small release helper for the same four-dword vector record. When storage pointer `[this+0x00]` is nonnull, the helper frees it through `0x0053b080`.","objdump + local disassembly + container-helper correlation"
0x005812cf,110,dword_pointer_vector_push_value_grow_by_0x10,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Growable dword-pointer vector append helper. The function checks count `[this+0x04]` against capacity `[this+0x08]`, grows the backing dword array at `[this+0x00]` by `0x10` entries through `0x0053b070` when full, preserves existing contents, writes the caller dword into the next slot, increments the count, and stores allocation failure `0x8007000e` in `[this+0x0c]`.","objdump + local disassembly + container-helper correlation + dynamic-array correlation"
0x0058133d,52,dword_pointer_vector_pop_last_optional_outparam,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small pop helper for the same dword-pointer vector. When count `[this+0x04]` is nonzero it decrements the count and optionally writes the removed last dword through the caller outparam; when empty it zeros the outparam if present and stores `0x80004005` in `[this+0x0c]`.","objdump + local disassembly + container-helper correlation + dynamic-array correlation"
0x00581371,8,dword_pointer_vector_take_and_clear_status,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny status helper for the same dword-pointer vector. The function returns status dword `[this+0x0c]` and then clears that field back to zero.","objdump + local disassembly + container-helper correlation"
0x00581379,19,string_pointer_vector_reset_5dwords,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny reset helper for one five-dword string-pointer vector record. The function clears storage pointer, count, capacity, status, and accumulated-byte counter fields `[this+0x00..+0x10]`.","objdump + local disassembly + container-helper correlation + string-vector correlation"
0x0058138c,49,string_pointer_vector_release_storage_and_owned_strings,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release helper for the string-pointer vector record. When storage `[this+0x00]` is live, the helper walks all counted string pointers, frees each owned string through `0x0053b080`, then frees the pointer array itself through the same allocator shim.","objdump + local disassembly + container-helper correlation + string-vector correlation"
0x005813bd,179,string_pointer_vector_push_copy_or_null_grow_by_0x10,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Growable string-pointer vector append helper. The function grows the pointer array at `[this+0x00]` by `0x10` entries when count reaches capacity, then either stores a null pointer for a null caller string or allocates and copies a private NUL-terminated copy of the caller string, updates accumulated-byte counter `[this+0x10]`, stores the resulting pointer in the next slot, increments the count, and records allocation failure `0x8007000e` in `[this+0x0c]`.","objdump + local disassembly + container-helper correlation + string-vector correlation"
0x00581470,52,string_pointer_vector_pop_last_optional_outparam,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small pop helper for the same string-pointer vector. When count `[this+0x04]` is nonzero it decrements the count and optionally writes the removed last string pointer through the caller outparam; when empty it zeros the outparam if present and stores `0x80004005` in `[this+0x0c]`.","objdump + local disassembly + container-helper correlation + string-vector correlation"
0x005814a4,8,string_pointer_vector_take_and_clear_status,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny status helper for the same string-pointer vector. The function returns status dword `[this+0x0c]` and then clears that field back to zero.","objdump + local disassembly + container-helper correlation + string-vector correlation"
0x005814ac,232,string_pointer_vector_build_newline_joined_text_object,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Primary owner above the string-pointer vector helper strip. When accumulated-byte count `[this+0x10]` is nonzero, the helper allocates one `0x10`-byte text object through `0x0053b070`, initializes it through `0x00581673`, asks that object to allocate a text buffer sized for total string bytes plus one newline per stored string plus the trailing NUL through vtable slot `+0x18`, and then copies each stored string from the vector into the owned buffer separated by literal `0x0a` bytes before returning the object through the caller outparam. This is the safest current read for building one newline-joined text object from the stored string vector rather than a generic vector wrapper.","objdump + local disassembly + string-vector correlation + text-object correlation"
0x00581594,21,text_object_vtable_0x5e0bd8_destruct_release_owned_buffer,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Destructor-side helper for the small text object family rooted at vtable `0x005e0bd8`. The helper reinstalls that vtable and frees owned text buffer `[this+0x0c]` through `0x0053b080` when it is live.","objdump + local disassembly + text-object correlation"
0x005815a9,38,text_object_vtable_0x5e0bd8_allocate_owned_buffer,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Allocation helper for the same text object family. The function stores the requested byte length in `[this+0x08]`, allocates that many bytes through `0x0053b070`, writes the result to `[this+0x0c]`, and returns either `0` or allocation failure `0x8007000e`.","objdump + local disassembly + text-object correlation"
0x005815cf,11,text_object_vtable_0x5e0bd8_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny addref helper for the same text object family. The function increments refcount `[this+0x04]` and returns the new count.","objdump + local disassembly + text-object correlation + refcount correlation"
0x005815dc,30,text_object_vtable_0x5e0bd8_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small refcount-drop helper for the same text object family. The function decrements refcount `[this+0x04]`, and when it reaches zero tail-calls release wrapper `0x00581610(1)`.","objdump + local disassembly + text-object correlation + refcount correlation"
0x005815fc,18,text_object_vtable_0x5e0bd8_get_owned_buffer,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small getter for the same text object family. The function returns owned text buffer pointer `[this+0x0c]`.","objdump + local disassembly + text-object correlation"
0x00581606,8,text_object_vtable_0x5e0bd8_get_buffer_length,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small getter for the same text object family. The function returns stored buffer length `[this+0x08]`.","objdump + local disassembly + text-object correlation"
0x00581610,26,text_object_vtable_0x5e0bd8_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for the same text object family. The helper re-enters destructor `0x00581594`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + text-object correlation + refcount correlation"
0x0058162c,71,text_object_vtable_0x5e0bd8_query_interface_iunknown_or_custom_iid,bootstrap,stdcall,inferred,objdump + local disassembly + rdata decode,2,"Small `QueryInterface`-style gate for the same text object family. The helper accepts exactly `IUnknown` from `0x005eaaec` plus one custom IID rooted at `0x005c8510`; on either match it returns the original object pointer through the caller outparam and increments the refcount through vtable slot `+0x04`, otherwise it returns `0x80004002`.","objdump + local disassembly + rdata decode + text-object correlation + COM-correlation"
0x00581673,24,text_object_vtable_0x5e0bd8_init,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny constructor-style initializer for the same text object family. The helper installs vtable `0x005e0bd8`, seeds refcount `[this+0x04] = 1`, and clears buffer-length `[this+0x08]` plus owned-buffer pointer `[this+0x0c]`.","objdump + local disassembly + text-object correlation"
0x00581690,64,math_apply_2d_basis_rows_and_translation_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small SSE helper over one caller output buffer, one XY input pair, and one basis or translation block. The function multiplies the input X and Y scalars by the first two 16-byte rows at `[basis+0x00]` and `[basis+0x10]`, adds translation row `[basis+0x30]`, and stores the full 16-byte vector result to the caller output. This is the safest current read for the shared 2D-basis-plus-translation vec4 builder rather than a gameplay-specific transform.","objdump + local disassembly + SSE arithmetic inspection"
0x005816d0,96,math_apply_2d_basis_rows_translation_and_project_xy_by_reciprocal_lane3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Projective sibling to `0x00581690`. The helper builds the same intermediate 4-lane vector from the caller XY pair and basis or translation rows, then derives a reciprocal from lane 3 and uses it to scale the vector before storing only the low 64 bits through the caller output. Current evidence is strongest for a shared transform-plus-project helper that returns projected XY rather than a gameplay-specific projection owner.","objdump + local disassembly + SSE arithmetic inspection"
0x00581730,57,math_apply_2d_basis_rows_to_vec2_without_translation,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small translation-free sibling to `0x00581690`. The helper multiplies the caller XY pair by the first two 16-byte basis rows at `[basis+0x00]` and `[basis+0x10]`, sums the lanes, and stores only the low 64 bits to the caller output. This is the safest current read for the shared 2D basis-to-vec2 helper rather than another owner-specific math body.","objdump + local disassembly + SSE arithmetic inspection"
0x00581770,192,math_apply_3d_basis_rows_to_vec3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small 3D SSE transform helper over one caller output buffer, one XYZ input triple, and one basis block. The function multiplies the input X, Y, and Z scalars by the first three 16-byte rows at `[basis+0x00]`, `[basis+0x10]`, and `[basis+0x20]`, sums the lanes, and stores the resulting XYZ triple through the caller output. It uses a separate fast path when the basis pointer is 16-byte aligned, but both legs preserve the same semantics.","objdump + local disassembly + SSE arithmetic inspection"
0x00581830,192,math_apply_3d_basis_rows_and_translation_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Translation-bearing sibling to `0x00581770`. The helper multiplies the caller XYZ triple by the first three 16-byte basis rows, adds translation row `[basis+0x30]`, and stores the full 16-byte vector result to the caller output. As with the sibling, the body has aligned and unaligned load paths but the same observable transform semantics.","objdump + local disassembly + SSE arithmetic inspection"
0x005818f0,256,math_apply_3d_basis_rows_translation_and_project_vec3_by_reciprocal_lane3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Projective 3D sibling to `0x00581830`. The helper builds the same 4-lane transformed vector from the caller XYZ triple and basis or translation rows, derives a reciprocal from lane 3, scales the vector by that reciprocal, and stores the resulting XYZ triple through the caller output. Both the aligned and unaligned legs preserve the same transform-plus-project semantics.","objdump + local disassembly + SSE arithmetic inspection"
0x005819f0,192,math_apply_4d_basis_rows_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small 4D SSE transform helper over one caller output buffer, one XYZW input vector, and one 4x4 basis block. The function multiplies each input lane by the corresponding 16-byte row at `[basis+0x00]`, `[basis+0x10]`, `[basis+0x20]`, and `[basis+0x30]`, sums the lanes, and stores the full vec4 result through the caller output. The body preserves the same semantics across aligned and unaligned basis-pointer paths.","objdump + local disassembly + SSE arithmetic inspection"
0x00581ab0,336,math_apply_4d_basis_rows_to_four_vec4_rows,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Batch sibling to `0x005819f0`. The helper takes one 4x4 source row block, applies the same 4-row basis block to each of its four input vec4 rows, and writes the four transformed vec4 rows to the caller output block at offsets `+0x00`, `+0x10`, `+0x20`, and `+0x30`. This is the safest current read for the shared four-row 4D basis application helper rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection"
0x00581c00,208,math_normalize_vec3_or_zero_below_epsilon,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small vec3 normalization helper. The function computes squared length from the caller XYZ triple, compares it against a tiny epsilon table under `0x00dbc000`, returns a zero vector when the length is too small, and otherwise applies one Newton-refined reciprocal-square-root scale before writing the normalized XYZ result. This is the safest current read for the shared normalize-or-zero vec3 helper rather than a gameplay-specific metric.","objdump + local disassembly + SSE arithmetic inspection"
0x00581cd0,216,math_normalize_vec4_or_zero_below_epsilon,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec4 sibling to `0x00581c00`. The helper computes squared length from the caller XYZW tuple, compares it against a nearby epsilon table under `0x00dbc00c`, returns a zero vec4 when the length is too small, and otherwise applies the same Newton-refined reciprocal-square-root scale before writing the normalized XYZW result. This is the safest current read for the shared normalize-or-zero vec4 helper rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection"
0x00581db0,1008,math_invert_4x4_matrix_and_optionally_store_determinant,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Primary 4x4 matrix inversion helper. The function derives the cofactor bands for the caller source matrix, accumulates the determinant, optionally stores that determinant through the caller outparam, returns failure when the determinant is zero, and otherwise scales the cofactor matrix by the reciprocal determinant before writing the inverse to the caller output. This is the safest current read for the shared invert-4x4 helper rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection"
0x00582070,352,math_apply_4d_basis_rows_to_four_vec4_rows_transposed_output,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-output sibling to `0x00581ab0`. The helper applies one 4-row basis block to each row of a caller 4x4 source block, then repacks the four transformed vec4 rows into a transposed or column-packed output layout before storing them to the caller destination. This is the safest current read for the shared four-row 4D basis application helper with packed transposed output.","objdump + local disassembly + SSE arithmetic inspection"
0x005821d0,164,math_compute_4d_cross_product_from_three_vec4_inputs,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Standalone 4D vector helper over three caller vec4 inputs. The function computes the alternating-sign generalized cross-product style combination of those three vectors and writes the resulting vec4 through the caller output. The final sign flip through mask `0x00627ce0` is part of the same determinant-style construction, so this is the safest current read for the shared 4D cross-product helper rather than a subsystem-specific owner.","objdump + local disassembly + SSE arithmetic inspection"
0x00582280,160,math_normalize_vec4_unchecked,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Unchecked vec4 normalization helper. The function computes squared length from the caller XYZW tuple, derives one reciprocal-square-root scale with Newton refinement, and writes the normalized vec4 without the small-epsilon zeroing guard used by `0x00581cd0`.","objdump + local disassembly + SSE arithmetic inspection"
0x00582320,176,math_sample_cubic_basis_vec3_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Cubic-basis interpolation helper over one scalar parameter and four caller vec3 control points. The function builds four basis weights from the scalar through the constant tables at `0x00627d10..0x00627d40`, multiplies each control point by its corresponding weight, and writes the blended vec3 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
0x005823e0,136,math_sample_cubic_basis_vec2_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec2 sibling to `0x00582320`. The helper derives the same four cubic-basis weights from the caller scalar parameter, applies them to four caller vec2 control points, and writes the blended vec2 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
0x00582470,165,math_sample_cubic_basis_vec4_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec4 sibling to `0x00582320`. The helper derives the same four cubic-basis weights from the caller scalar parameter, applies them to four caller vec4 control points, and writes the blended vec4 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
0x00582520,181,math_sample_alternate_cubic_basis_vec3_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Alternate-basis vec3 interpolation sibling. The helper again derives four weights from the caller scalar parameter, but uses the alternate constant tables at `0x00627d50..0x00627d80` before applying those weights to four caller vec3 control points and writing the blended vec3 result. This is the safest current read for the alternate cubic-basis vec3 sampler rather than a subsystem-specific curve owner.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
0x005825e0,153,math_sample_alternate_cubic_basis_vec4_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec4 sibling to `0x00582520`. The helper derives the same alternate cubic-basis weights from the caller scalar parameter, applies them to four caller vec4 control points, and writes the blended vec4 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
0x00582680,133,math_sample_alternate_cubic_basis_vec2_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec2 sibling to `0x00582520`. The helper derives the same alternate cubic-basis weights from the caller scalar parameter, applies them to four caller vec2 control points, and writes the blended vec2 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
0x00582710,89,math_blend_vec3_from_origin_and_two_targets_by_two_scalars,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Two-scalar affine blend helper over three caller vec3 points. The function computes `p0 + s*(p1-p0) + t*(p2-p0)` from the caller origin point, two target points, and scalar weights `s` and `t`, then writes the blended vec3 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + affine-blend correlation"
0x00582770,70,math_blend_vec4_from_origin_and_two_targets_by_two_scalars,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec4 sibling to `0x00582710`. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec4 points and two scalar weights, then writes the blended vec4 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + affine-blend correlation"
0x005827c0,79,math_blend_vec2_from_origin_and_two_targets_by_two_scalars,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec2 sibling to `0x00582710`. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec2 points and two scalar weights, then writes the blended vec2 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + affine-blend correlation"
0x00582820,188,math_intersect_plane_vec4_with_vec3_segment,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Geometric intersection helper over one plane vec4 and two caller vec3 endpoints. The function evaluates the plane against both endpoints, derives the affine parameter along the segment between them, returns null when the denominator collapses to zero, and otherwise writes the intersection point `p0 + t*(p1-p0)` through the caller output. This is the safest current read for the shared plane-versus-segment intersection helper rather than a subsystem-specific query.","objdump + local disassembly + SSE arithmetic inspection + geometry correlation"
0x005828e0,203,math_measure_4x4_matrix_determinant,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Standalone 4x4 determinant helper. The function forms the required cofactor combinations from the caller matrix rows, contracts them against the first row, and returns the resulting determinant scalar through the x87 return path. Current evidence is strongest for a shared determinant helper paired with the nearby inversion body `0x00581db0`.","objdump + local disassembly + SSE arithmetic inspection + matrix-correlation"
0x005829b0,226,math_build_plane_vec4_from_three_vec3_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Three-point plane builder over caller vec3 inputs. The function forms two edge vectors from the three points, computes their cross product, normalizes that resulting normal, stores the plane normal through output `[+0x00..+0x08]`, and writes the signed plane constant `-dot(normal, p0)` to `[out+0x0c]`. This is the safest current read for the shared plane-from-three-points helper rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection + geometry correlation"
0x00582aa0,392,math_build_4x4_projective_matrix_from_plane_vec4_and_vec4_input,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Shared plane-driven 4x4 matrix builder over one caller plane vec4 and one second vec4 input. The function normalizes the plane against the XYZ-length of its first three lanes, computes one diagonal dot term against the second vec4, combines that term with per-plane outer-product bands, and writes the resulting 4x4 matrix to the caller output. The current formula is tight enough to bound this as a projective plane-and-vec4 matrix helper, but not yet tight enough to overname it as one specific API variant.","objdump + local disassembly + SSE arithmetic inspection + geometry correlation + projective-matrix correlation"
0x00582c30,209,math_build_4x4_rotation_matrix_from_quaternion,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Quaternion-to-matrix helper. The function normalizes the caller quaternion-like vec4, applies the standard doubled-product combinations through the constant tables at `0x00627e10..0x00627e80`, and writes a 4x4 rotation matrix to the caller output. This is the safest current read for the shared quaternion-to-4x4 rotation-matrix builder rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation"
0x00582d10,130,math_multiply_quaternions,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Quaternion product helper over two caller vec4 inputs. The function applies the expected sign-mask and shuffle pattern for Hamilton-product-style quaternion composition and writes the resulting vec4 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation"
0x00582da0,128,math_normalize_quaternion_unchecked,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Unchecked quaternion normalization helper. The function computes the caller quaternion length, derives one reciprocal-square-root scale with Newton refinement, and writes the normalized vec4 without the small-epsilon guard used by the nearby zero-safe normalizers.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation"
0x00582e40,109,math_invert_quaternion_by_conjugate_over_squared_length,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Quaternion inverse helper over one caller vec4. The function flips the sign of the spatial XYZ lanes, preserves the scalar W lane, divides that conjugate by the squared quaternion length, and writes the resulting vec4 through the caller output. This is the safest current read for the shared quaternion-inverse helper rather than a subsystem-specific owner.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation"
0x00582eb0,274,math_build_quaternion_from_3x3_rotation_matrix,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Rotation-matrix-to-quaternion helper over one caller 3x3 row block. The function checks the matrix trace, takes the usual positive-trace fast path when possible, otherwise selects the dominant diagonal lane and rebuilds the remaining quaternion components from the expected off-diagonal differences and sums before writing the resulting vec4 to the caller output. This is the safest current read for the shared 3x3-rotation-matrix-to-quaternion builder.","objdump + local disassembly + x87 arithmetic inspection + quaternion correlation"
0x00582fd0,191,math_build_quaternion_from_three_euler_angles_via_half_angle_trig,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Three-angle quaternion builder over caller scalar inputs. The function packs the three caller angles with one zero lane, scales them by `0.5`, routes that half-angle tuple through packed trig helper `0x0058aa70`, and combines the resulting sine and cosine lanes into one quaternion vec4 before storing it through the caller output. The current evidence is strong enough for a shared Euler-angle-to-quaternion helper, but not yet for a tighter axis-order claim.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation + packed-trig correlation"
0x005830a0,176,math_apply_packed_3x3_basis_to_vec3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row 3D basis helper over one caller vec3 input and one compact 3x3 basis block. The function multiplies the input X, Y, and Z scalars by three packed matrix rows and stores the resulting XYZ triple through the caller output, with aligned and unaligned load paths that preserve the same semantics.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation"
0x00583160,175,math_apply_packed_3x3_basis_and_translation_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row translation-bearing sibling to `0x005830a0`. The helper multiplies one caller vec3 input by three packed basis rows, adds one packed translation row, and stores the resulting full vec4 through the caller output. Both aligned and unaligned load paths preserve the same transform semantics.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation"
0x00583220,243,math_apply_packed_3x3_basis_translation_and_project_vec3_by_reciprocal_lane3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Projective packed-row sibling to `0x00583160`. The helper builds the same transformed 4-lane vector from one caller vec3 input plus packed basis and translation rows, derives a reciprocal from lane 3, scales the vector by that reciprocal, and stores the projected XYZ triple through the caller output. The aligned and unaligned legs preserve the same transform-plus-project behavior.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + projection correlation"
0x00583320,184,math_apply_packed_4x4_basis_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row 4D basis helper over one caller vec4 input and one packed 4x4 row block. The function multiplies each input lane by its corresponding packed row, sums the four products, and stores the resulting vec4 through the caller output, again preserving the same behavior across aligned and unaligned load paths.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation"
0x005833e0,324,math_apply_packed_4x4_basis_to_four_vec4_rows,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Batch packed-row sibling to `0x00583320`. The helper applies one packed 4x4 basis block to each of four caller vec4 rows from a source block and writes the four transformed rows back to the caller output block at offsets `+0x00`, `+0x10`, `+0x20`, and `+0x30`.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation"
0x00583530,196,math_normalize_packed_vec3_or_zero_below_epsilon,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row vec3 normalization sibling to `0x00581c00`. The helper computes squared length from the caller XYZ triple, compares it against the nearby epsilon table under `0x00dbc180`, returns a zero vector when the length is too small, and otherwise applies one Newton-refined reciprocal-square-root scale before writing the normalized XYZ result.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + normalization correlation"
0x00583600,216,math_normalize_packed_vec4_or_zero_below_epsilon,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row vec4 normalization sibling to `0x00581cd0`. The helper computes squared length from the caller XYZW tuple, compares it against the nearby epsilon table under `0x00dbc18c`, returns a zero vec4 when the length is too small, and otherwise applies one Newton-refined reciprocal-square-root scale before writing the normalized XYZW result.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + normalization correlation"
0x005836e0,695,math_invert_packed_4x4_matrix_and_optionally_store_determinant,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row 4x4 inversion sibling to `0x00581db0`. The helper expands the packed 4x4 source rows, derives the required cofactor bands and determinant scalar, optionally stores that determinant through the caller outparam, returns failure when the determinant collapses to zero, and otherwise scales the cofactor matrix by the reciprocal determinant before writing the packed inverse to the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + matrix-inversion correlation"
0x005839a0,342,math_apply_packed_4x4_basis_to_four_vec4_rows_transposed_output,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-output batch sibling to `0x005833e0`. The helper applies one packed 4x4 basis block to each of four caller vec4 rows from a source block, then repacks the transformed lanes into a transposed or column-packed output layout before storing the four result rows.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + transposed-output correlation"
0x00583b00,164,math_compute_packed_4d_cross_product_from_three_vec4_inputs,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row sibling to `0x005821d0`. The helper takes three caller vec4 inputs, forms the same alternating-sign generalized 4D cross-product style combination through shuffle, multiply, and subtract bands, applies the final sign-mask adjustment under `0x00627ee0`, and writes the resulting vec4 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + 4d-cross-product correlation"
0x00583cc0,201,math_measure_packed_4x4_matrix_determinant,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row determinant sibling to `0x005828e0`. The helper expands the packed 4x4 row block, forms the same cofactor combinations as the wider determinant strip, contracts them against the first packed row, and returns the resulting determinant scalar through the x87 return path.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + matrix-determinant correlation"
0x00583bb0,121,math_build_single_angle_packed_4x4_axial_rotation_matrix_variant_a,support,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Single-angle packed 4x4 rotation-matrix helper above interleaved trig worker `0x0058ac60`. The function broadcasts one caller angle, derives one interleaved sine/cosine tuple through `0x0058ac60`, combines that tuple with fixed identity-row constants, and writes one packed 4x4 axial rotation-matrix variant to the caller output. The current evidence is strong enough for a fixed-axis rotation-matrix constructor, but not yet for a tighter axis label.","objdump + local disassembly + caller correlation + packed-matrix correlation + trig correlation"
0x00583c30,128,math_build_single_angle_packed_4x4_axial_rotation_matrix_variant_b,support,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Sibling single-angle packed 4x4 rotation-matrix helper above `0x0058ac60`. Like `0x00583bb0`, it broadcasts one caller angle, derives one interleaved sine/cosine tuple through the shared trig worker, combines that tuple with fixed identity-row constants in a different lane arrangement, and writes one second packed 4x4 axial rotation-matrix variant to the caller output. The safest current read is a second fixed-axis rotation-matrix constructor rather than a tighter axis-specific label.","objdump + local disassembly + caller correlation + packed-matrix correlation + trig correlation"
0x00583d90,226,math_build_plane_vec4_from_three_packed_vec3_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row three-point plane builder sibling to `0x005829b0`. The helper forms two edge vectors from three caller vec3 points, computes their cross product, normalizes that resulting normal, stores the plane normal through the caller output, and writes the signed plane constant to `[out+0x0c]`.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + geometry correlation"
0x00583e80,392,math_build_packed_4x4_projective_matrix_from_plane_vec4_and_vec4_input,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row sibling to `0x00582aa0`. The helper normalizes the caller plane vec4 against the XYZ length of its first three lanes, computes one diagonal dot term against the second vec4 input, combines that term with per-plane outer-product bands, and writes the resulting packed 4x4 matrix to the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + geometry correlation + projective-matrix correlation"
0x00584010,209,math_build_packed_4x4_rotation_matrix_from_quaternion,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row quaternion-to-matrix sibling to `0x00582c30`. The helper normalizes the caller quaternion-like vec4, applies the same doubled-product combinations through the packed constant tables at `0x00627f70..0x00627fe0`, and writes a packed 4x4 rotation matrix to the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + quaternion correlation"
0x005840f0,274,math_build_quaternion_from_packed_3x3_rotation_matrix,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Packed-row rotation-matrix-to-quaternion sibling to `0x00582eb0`. The helper checks the packed 3x3 trace, takes the positive-trace fast path when possible, otherwise selects the dominant diagonal lane and rebuilds the remaining quaternion components from the expected packed off-diagonal differences and sums before writing the resulting vec4 to the caller output.","objdump + local disassembly + x87 arithmetic inspection + packed-matrix correlation + quaternion correlation"
0x00584210,191,math_build_quaternion_from_three_euler_angles_via_packed_half_angle_trig,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row sibling to `0x00582fd0`. The helper packs three caller angles with one zero lane, scales them by `0.5`, routes that tuple through packed trig helper `0x0058ad50`, and combines the resulting sine and cosine lanes into one quaternion vec4 before storing it through the caller output. Current evidence is strong enough for a shared Euler-angle-to-quaternion helper, but not yet for a tighter axis-order claim.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + quaternion correlation + packed-trig correlation"
0x005842e0,151,math_multiply_quaternions_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582d10`. The helper loads two caller quaternion-like vec4 inputs, applies the same sign-mask and pairwise multiply-add or subtract pattern used by the SSE quaternion-product strip, and writes the resulting vec4 through the caller output before `femms`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation"
0x00584379,90,math_normalize_vec4_or_zero_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec4 normalize-or-zero helper. The function computes squared length from the caller vec4, compares it against the nearby epsilon constant at `0x005df610`, and when the length is large enough scales the full vec4 by one reciprocal-square-root refinement before writing it to the caller output; smaller inputs collapse to zero through the same mask path.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation"
0x005843d6,179,math_normalize_vec3_with_optional_length_outparam_and_default_axis_fallback_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec3 normalization helper with two optional outparams. The function computes the squared XYZ length from the caller source block, optionally writes the normalized vec3 through one caller outparam, optionally writes a derived scalar magnitude through another, and when the input collapses below the epsilon threshold falls back to a fixed default-axis vector plus zero magnitude. This is the safest current read for the shared vec3 normalize-with-length helper without overclaiming the exact downstream semantic of the scalar outparam.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation"
0x00584489,1073,math_build_quaternion_from_3x3_rotation_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582eb0`. The helper inspects the same 3x3 rotation-matrix trace and dominant diagonal cases, chooses one of the expected reconstruction branches, and writes the resulting quaternion vec4 through the caller output before `femms`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + matrix-correlation"
0x005848ba,195,math_build_quaternion_from_three_euler_angles_via_half_angle_trig_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582fd0`. The helper halves the three caller Euler angles, routes those half angles through scalar trig worker `0x0058b660`, and combines the resulting sine and cosine values into one quaternion vec4 before storing it through the caller output. Current evidence is strong enough for a shared Euler-angle-to-quaternion helper, but not yet for a tighter axis-order claim.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + trig correlation"
0x0058497f,106,math_build_quaternion_from_axis_vec3_and_angle_via_half_angle_trig_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow axis-angle-to-quaternion helper. The function first normalizes one caller axis vec3 through `0x005896d2`, halves the caller angle, routes that half-angle through trig worker `0x0058b660`, scales the normalized axis by the sine-like lane, and writes the resulting quaternion vec4 with the cosine-like scalar lane in `W`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + axis-angle correlation + trig correlation"
0x005849eb,309,math_interpolate_quaternion_slerp_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow quaternion slerp helper over two caller quaternion-like vec4 inputs and one scalar interpolation factor. The function measures the 4D dot product, takes the expected small-angle fast path, otherwise derives one angular term through `0x0058af80` and two sine-weight terms through `0x0058b780`, then writes the weighted combination through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + slerp correlation"
0x00584b22,139,math_blend_three_quaternion_controls_by_two_parameter_nested_slerp_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Two-parameter nested quaternion-slerp helper. The function first forms `u+v`, performs two intermediate slerps from one shared control quaternion to two neighboring controls through `0x005849eb`, derives relative blend weight `v/(u+v)`, and then slerps between those intermediates into the caller output. The safest current read is a barycentric or triangular nested-slerp helper rather than a tighter named spline family.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + nested-slerp correlation"
0x00584baf,144,math_blend_three_quaternion_controls_by_quadratic_nested_slerp_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Quadratic nested quaternion-slerp helper. The function first builds two intermediate slerps at the same parameter `t` through `0x005849eb`, derives the classic quadratic blend scalar `2*t*(1-t)`, and then slerps between those intermediates into the caller output. This is the safest current read for a three-control quaternion curve helper without overclaiming the exact higher-level spline family.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + nested-slerp correlation"
0x00584c41,98,math_invert_quaternion_by_conjugate_over_squared_length_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582e40`. The helper conjugates the caller quaternion by negating `XYZ` while preserving `W`, divides that conjugate by the squared quaternion length, and writes the resulting inverse quaternion through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation"
0x00584ca5,165,math_build_axis_angle_vec4_from_quaternion_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow quaternion-to-axis-angle extractor. The function reads the scalar `W` lane, derives one angular term through `0x0058b080` and `0x0058b780`, conditionally rescales the `XYZ` lanes by the reciprocal sine factor when that angle is not degenerate, and writes the resulting axis-angle-style vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + axis-angle correlation"
0x00584d4c,163,math_build_quaternion_from_scaled_axis_vec3_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow scaled-axis-to-quaternion helper. The function measures the length of the caller vec3, routes that magnitude through trig worker `0x0058b660`, conditionally rescales the `XYZ` lanes by the reciprocal magnitude, and writes a quaternion-style vec4 whose `XYZ` lanes hold the scaled axis contribution and whose `W` lane receives the cosine-like scalar result. This is the safest current read for a shared scaled-axis-to-quaternion helper without overclaiming the exact upstream representation.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + axis-angle correlation + trig correlation"
0x00584df1,396,math_build_two_inner_quaternion_spline_controls_from_four_keys_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow quaternion spline-control builder over four caller key quaternions. The helper first aligns neighboring keys onto the same hemisphere by comparing sum-vs-difference norms, then around each interior key converts the two neighboring relative quaternions through the already-grounded inverse, axis-angle, and scaled-axis helpers, averages those tangent-like terms, exponentiates back into a quaternion, and multiplies by the interior key to write two inner control quaternions through the caller output buffer. The safest current read is a four-key inner-control builder for quaternion spline interpolation rather than a tighter spline-family label.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + spline-control correlation"
0x0058584a,559,math_multiply_4x4_matrices_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow 4x4 matrix-multiply owner. The helper first repacks one caller matrix from the split qword row layout used by the neighboring constructors into temporary contiguous rows on the stack, then multiplies a second caller 4x4 matrix by those repacked rows and writes the product through the caller output buffer. The safest current read is a non-alias-staging sibling of the later packed 4x4 multiply family rather than a subsystem-specific API.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + matrix-multiply correlation"
0x00585a7c,207,math_compute_determinant_of_upper_3x3_basis_from_split_4x4_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow scalar determinant helper over one split-layout 4x4 matrix. The function forms the expected 3x3 cofactor bands from the upper basis rows, completes the final cofactor expansion against the remaining basis row, accumulates the result to one scalar lane, and returns that determinant through `st0`. The safest current read is a determinant-of-basis helper rather than a tighter affine-class predicate.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + determinant correlation"
0x00585b4b,80,math_build_4x4_translation_matrix_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow row-major translation-matrix constructor. The helper seeds the three identity rows from `0x005df668` and `0x005df660`, writes the three caller translation scalars into the trailing homogeneous row, and returns the finished 4x4 matrix through the caller output buffer.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation"
0x00585b9b,235,math_build_4x4_projective_matrix_from_plane_vec4_and_vec4_input_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582aa0`. The helper normalizes the caller plane vec4 against the XYZ length of its first three lanes through `0x0058a988`, computes one diagonal dot term against the second vec4 input, combines that dot term with the expected negated outer-product bands, and writes the resulting 4x4 matrix to the caller output. The current formula is tight enough to bound this as the MMX plane-driven projective matrix helper without overclaiming one specific API variant.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + geometry correlation + projective-matrix correlation"
0x00585c86,220,math_build_4x4_reflection_matrix_from_plane_vec4_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow plane-reflection matrix helper. The function normalizes the caller plane vec4 through `0x0058a988`, forms the expected `1 - 2*n*n^T` diagonal terms plus the paired `-2*n_i*n_j` off-diagonal bands, and writes the resulting homogeneous 4x4 reflection-style matrix to the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + plane-reflection correlation"
0x00585d62,97,math_build_single_angle_4x4_axial_rotation_matrix_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow single-angle 4x4 axial rotation-matrix helper. The function routes one caller angle through scalar trig worker `0x0058b660`, seeds the fixed identity rows from constants `0x005df668` and `0x005df660`, and writes one axial rotation-matrix variant to the caller output. The current evidence is strong enough for a fixed-axis rotation-matrix constructor, but not yet for a tighter axis label.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + trig correlation"
0x00585dc5,94,math_build_single_angle_4x4_axial_rotation_matrix_mmx_3dnow_variant_b,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Sibling MMX or 3DNow single-angle 4x4 axial rotation-matrix helper. Like `0x00585d62`, it routes one caller angle through `0x0058b660`, combines the resulting sine or cosine lanes with the same identity-row constants in a different layout, and writes one second axial rotation-matrix variant to the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + trig correlation"
0x00585e23,87,math_build_single_angle_4x4_axial_rotation_matrix_mmx_3dnow_variant_c,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Third MMX or 3DNow single-angle 4x4 axial rotation-matrix helper. The function routes one caller angle through `0x0058b660`, seeds the remaining fixed identity rows, and writes one third axial rotation-matrix variant to the caller output. The safest current read is a third fixed-axis rotation-matrix constructor rather than a tighter axis-specific label.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + trig correlation"
0x00585e7c,67,math_build_4x4_scale_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow diagonal scale-matrix constructor. The helper writes the three caller scalar scale lanes onto the homogeneous 4x4 diagonal, clears the off-diagonal lanes, and seeds the trailing homogeneous `1.0f` row or column from `0x005df660`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + scale correlation"
0x00585ec3,110,math_transpose_or_repack_4x4_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Small MMX or 3DNow 4x4 matrix repack helper. It reads the caller matrix in one split qword layout, unpacks the low and high dword pairs across the four rows, and writes the reordered 4x4 matrix to the caller output. The safest current read is a transpose or row-column repack helper rather than a higher-level owner.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + repack correlation"
0x00585f32,57,math_build_identity_4x4_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly,2,"MMX or 3DNow identity-matrix constructor. The helper seeds the diagonal with `1.0f` from `0x005df590`, clears the off-diagonal lanes, and writes the resulting homogeneous 4x4 identity matrix to the caller output.","objdump + local disassembly + matrix correlation + identity correlation"
0x00585f6b,199,math_build_4x4_rotation_matrix_from_quaternion_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow quaternion-to-4x4 rotation-matrix helper. The function doubles the caller quaternion lanes, forms the expected pairwise product bands, combines them with the fixed `1 - 2*...` diagonal terms from `0x005df5a0`, and writes one 4x4 rotation-matrix layout to the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + matrix correlation"
0x0058603d,181,math_build_4x4_rotation_matrix_from_quaternion_mmx_3dnow_variant_b,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Sibling MMX or 3DNow quaternion-to-4x4 rotation-matrix helper. It uses the same doubled-lane and pairwise-product construction as `0x00585f6b`, but writes the resulting rotation terms in a second lane layout to the caller output. The safest current read is a second quaternion-to-matrix variant rather than a tighter row- or column-major claim.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + matrix correlation"
0x005860f2,1655,math_build_4x4_transform_from_optional_translation_base_rotation_pivoted_post_rotation_and_translation_delta_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow transform-matrix owner over one output matrix, one optional base rotation quaternion, one optional base translation vec3, one optional pivot vec3, one optional post-rotation quaternion, and one optional trailing translation delta vec3. The helper builds identity when no base translation is present, otherwise seeds a pure translation matrix or translation-plus-base-rotation matrix, then optionally applies a second quaternion rotation about the caller pivot by subtracting the pivot from the translation row, multiplying through the post-rotation matrix, and adding the pivot back, and finally adds one trailing translation delta when that last pointer is non-null. The safest current read is a shared affine-transform builder rather than a subsystem-specific pose API.","objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation + quaternion correlation + pivot-rotation correlation"
0x0058728a,421,math_build_4x4_rotation_matrix_from_three_angles_via_half_angle_trig_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection + constant inspection,2,"MMX or 3DNow three-angle 4x4 rotation-matrix builder. The helper halves the three caller angle scalars through the `0.5f` pair at `0x005df630`, routes those half-angles through trig worker `0x0058b660`, combines the resulting sine or cosine lanes through the same doubled-product and `1 - 2*...` bands used by the nearby quaternion-to-matrix helpers, and writes one 4x4 rotation-matrix layout to the caller output. The safest current read is a three-angle rotation constructor via half-angle trig rather than a tighter Euler-order claim.","objdump + local disassembly + MMX-3DNow arithmetic inspection + constant inspection + trig correlation + quaternion-formula correlation + matrix correlation"
0x0058742f,308,math_build_4x4_transform_from_uniform_scale_optional_pivoted_rotation_quaternion_and_translation_delta_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection + constant inspection,2,"Broader MMX or 3DNow transform-matrix owner over one output matrix, one uniform scalar scale, one optional pivot vec3, one optional rotation quaternion, and one optional trailing translation delta vec3. The helper first seeds a diagonal scale matrix from the caller scalar plus the fixed homogeneous `1.0f` lane at `0x005df580`, then optionally applies one quaternion rotation about the caller pivot by subtracting the pivot from the translation row, multiplying through the rotation matrix, and adding the pivot back, and finally adds one trailing translation delta when that last pointer is non-null.","objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection + constant inspection + matrix correlation + scale correlation + quaternion correlation + pivot-rotation correlation"
0x00587963,281,math_build_4x4_rotation_matrix_from_axis_vec3_and_angle_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + caller-shape inspection + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow axis-angle 4x4 rotation-matrix helper. The function first normalizes one caller axis vec3 through `0x005896d2`, routes the caller angle through trig worker `0x0058b660`, forms the expected Rodrigues-style `axis*axis*(1-c)`, `axis*s`, and diagonal `c + axis*axis*(1-c)` bands, and writes the resulting 4x4 rotation matrix through the caller output buffer.","objdump + local disassembly + caller-shape inspection + MMX-3DNow arithmetic inspection + axis-angle correlation + trig correlation + matrix correlation"
0x00587a7c,4436,math_build_4x4_transform_from_optional_translation_two_optional_pivoted_rotation_quaternions_and_translation_delta_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow transform-matrix owner over one output matrix, one optional first pivot vec3, one optional first rotation quaternion, one optional base translation vec3, one optional second pivot vec3, one optional second rotation quaternion, and one optional trailing translation delta vec3. The helper builds identity when the base translation is absent, otherwise seeds a pure translation matrix or translation-plus-first-rotation matrix, optionally applies that first rotation about the first caller pivot, then optionally applies a second quaternion rotation about the second caller pivot, and finally adds one trailing translation delta when that last pointer is non-null. The safest current read is a broader shared affine-transform builder with up to two pivoted quaternion stages rather than a subsystem-specific pose API.","objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation + quaternion correlation + pivot-rotation correlation"
0x00588eb2,1013,math_multiply_4x4_matrices_with_alias_safe_rhs_staging_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow 4x4 matrix-multiply owner. The helper first repacks one caller source matrix into a temporary contiguous row layout, multiplies those four rows by the second caller 4x4 matrix, and writes the product through the caller output buffer. When the destination aliases the right-hand input matrix it stages the product in temporary storage and copies it back afterward, so the safest current read is an alias-safe packed 4x4 multiply helper rather than a narrower subsystem API.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + matrix-multiply correlation + alias-staging correlation"
0x00588bd0,738,math_invert_4x4_matrix_variant_b_and_optionally_write_determinant_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Alternate MMX or 3DNow 4x4 matrix inverse helper. Like `0x005892aa`, the function expands the caller matrix into cofactor-like bands, optionally writes one determinant scalar through a caller out-parameter when that pointer is non-null, returns early when that determinant collapses to zero, and otherwise writes the reciprocal-determinant-scaled inverse matrix through the caller output buffer. The safest current read is a second inverse helper variant rather than a tighter matrix-class claim.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + inverse correlation + determinant correlation"
0x005892aa,820,math_invert_4x4_matrix_and_optionally_write_determinant_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow 4x4 matrix inverse helper. The function expands the caller matrix into the expected cofactor bands, accumulates the determinant into one optional caller scalar out-parameter when that pointer is non-null, returns early when that determinant collapses to zero, and otherwise writes the adjugate scaled by the reciprocal determinant through the caller output buffer.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + inverse correlation + determinant correlation"
0x005895de,28,math_invert_4x4_matrix_and_optionally_write_determinant_mmx_3dnow_wrapper,support,cdecl,inferred,objdump + local disassembly,2,"Tiny FEMMS wrapper around `0x005892aa`. It forwards the three caller parameters unchanged to the broader MMX 4x4 inverse helper and then returns the caller output pointer.","objdump + local disassembly + wrapper correlation"
0x005895fa,112,math_apply_3d_basis_rows_and_translation_to_vec4_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581830`. The helper broadcasts the caller XYZ triple, multiplies those broadcasts by the first three rows of one caller 4x4 basis block, adds the translation row at `[basis+0x30]` and `[basis+0x38]`, and stores the resulting full vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation"
0x0058966b,103,math_apply_3d_basis_rows_to_vec3_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581770`. The helper broadcasts the caller XYZ triple, multiplies those broadcasts by the first three rows of one caller basis block, sums the three product bands, and stores the resulting XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation"
0x005896d2,95,math_normalize_vec3_or_zero_below_epsilon_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec3 normalization sibling to `0x00581c00`. The function computes squared length from the caller XYZ triple, compares it against the nearby epsilon constant at `0x005df610`, returns a zero vector when the length is too small, and otherwise applies one reciprocal-square-root refinement before writing the normalized XYZ result.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation + caller correlation"
0x00589731,113,math_blend_vec3_by_two_affine_scalars_from_three_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582710`. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec3 control points and two caller scalar weights, then writes the blended XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + affine-blend correlation"
0x005897a2,213,math_sample_cubic_basis_vec3_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582320`. The helper derives four cubic-basis weights from the caller scalar parameter through the same local constant strip, applies those weights to four caller vec3 control points, and writes the blended XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + cubic-basis correlation"
0x00589876,234,math_sample_alternate_cubic_basis_vec3_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582520`. The helper derives the alternate cubic-basis weight family from the caller scalar parameter through the nearby MMX constant strip, applies those weights to four caller vec3 control points, and writes the blended XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + alternate-basis correlation"
0x00589960,140,math_apply_3d_basis_rows_translation_and_project_vec3_by_reciprocal_lane3_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005818f0`. The helper builds the same translated four-lane transform result from one caller XYZ triple and one 4x4 basis block, derives a reciprocal from lane `3`, scales the transformed vector by that reciprocal, and stores the resulting XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + projective correlation"
0x005899eb,456,math_apply_4d_basis_rows_to_four_vec4_rows_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581ab0`. The helper applies one caller 4x4 basis block to each of four caller vec4 rows from a source block and writes the four transformed vec4 rows back to the caller output block at offsets `+0x00`, `+0x10`, `+0x20`, and `+0x30`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation"
0x00589bb2,5,math_apply_3d_basis_rows_translation_and_project_vec3_by_reciprocal_lane3_mmx_3dnow_thunk,support,cdecl,inferred,objdump + local disassembly,2,"Jump thunk into `0x00589960`, the MMX or 3DNow projective vec3 transform helper.","objdump + local disassembly + wrapper correlation"
0x00589bb7,392,math_apply_vec3_through_optional_4x4_chain_and_optional_viewport_map_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + caller-shape inspection,2,"Broader MMX or 3DNow projective transform owner over one caller vec3, up to three optional 4x4 matrix inputs, and one optional integer viewport-style range block. The helper selects identity, one matrix, or the ordered composition of two or three matrices through `0x005899eb`, applies the resulting chain through `0x00589960`, and when the optional range block is present remaps the projected normalized result into that caller integer range before returning.","objdump + local disassembly + matrix correlation + projective correlation + viewport-range correlation"
0x00589d3f,518,math_apply_vec3_through_optional_inverse_4x4_chain_and_optional_inverse_viewport_map_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + caller-shape inspection,2,"Inverse-side sibling to `0x00589bb7`. The helper selects identity or the ordered composition of up to three optional 4x4 matrices through `0x005899eb`, inverts the chosen chain through `0x005892aa`, optionally maps one caller integer viewport-style coordinate triple back into the normalized projective range, and then applies the inverse chain through `0x00589960`. The safest current read is an MMX unproject or inverse-projective helper without overclaiming one subsystem-specific API.","objdump + local disassembly + matrix correlation + inverse correlation + projective correlation + viewport-range correlation"
0x00589f67,303,math_apply_vec3_through_optional_inverse_4x4_chain_variant_b_and_optional_inverse_viewport_map_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + caller-shape inspection,2,"Adjacent inverse-side sibling to `0x00589d3f`. The helper selects identity or the ordered composition of up to three optional 4x4 matrices through `0x005899eb`, routes the chosen chain through inverse helper variant `0x00588bd0`, optionally maps one caller integer viewport-style coordinate triple back into the normalized projective range, and then applies the resulting inverse chain through `0x00589960`. The safest current read is a second MMX unproject or inverse-projective helper variant rather than a tighter API claim.","objdump + local disassembly + matrix correlation + inverse correlation + projective correlation + viewport-range correlation"
0x0058a0b8,79,math_apply_2d_basis_rows_and_translation_to_vec4_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581690`. The helper broadcasts the caller XY pair, multiplies those broadcasts by the first two rows of one caller 4x4 basis block, adds the translation row at `[basis+0x30]` and `[basis+0x38]`, and stores the resulting full vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation"
0x0058a10d,55,math_apply_2d_basis_rows_to_vec2_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581730`. The helper broadcasts the caller XY pair, multiplies those broadcasts by the first two rows of one caller basis block, sums the two product bands, and stores the resulting vec2 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation"
0x0058a146,100,math_apply_2d_basis_rows_translation_and_project_vec2_by_reciprocal_lane3_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005816d0`. The helper builds the same translated four-lane transform result from one caller XY pair and one 4x4 basis block, derives a reciprocal from lane `3`, scales the transformed vector by that reciprocal, and stores the resulting vec2 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + projective correlation"
0x0058a1aa,153,math_sample_cubic_basis_vec2_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec2 sibling to `0x005823e0`. The helper derives the same four cubic-basis weights from the caller scalar parameter, applies those weights to four caller vec2 control points, and writes the blended vec2 result through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + cubic-basis correlation"
0x0058a242,71,math_blend_vec2_by_two_affine_scalars_from_three_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec2 sibling to `0x005827c0`. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec2 control points and two caller scalar weights, then writes the blended vec2 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + affine-blend correlation"
0x0058a28b,65,math_normalize_vec2_or_zero_below_epsilon_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec2 normalization sibling to `0x00582320`'s lower-dimensional normalize helpers. The function computes squared length from the caller XY pair, compares it against the nearby epsilon constant at `0x005df610`, returns a zero vec2 when the length is too small, and otherwise applies one reciprocal-square-root refinement before writing the normalized XY result.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation + caller correlation"
0x0058a2ce,172,math_sample_alternate_cubic_basis_vec2_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582680`. The helper derives the alternate cubic-basis weight family from the caller scalar parameter through the nearby MMX constant strip, applies those weights to four caller vec2 control points, and writes the blended vec2 result through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + alternate-basis correlation"
0x0058a379,130,math_apply_4d_basis_rows_to_vec4_mmx_3dnow_variant_b,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow duplicate-layout sibling to `0x0058a9ec`. The helper broadcasts the caller XYZW lanes, multiplies those broadcasts by the four rows of one caller 4x4 basis block, sums the four product bands, and writes the resulting vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation"
0x0058a3fb,95,math_normalize_vec4_or_zero_below_epsilon_mmx_3dnow_variant_b,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow four-lane normalization sibling to `0x00584379`. The function computes squared length across all four caller lanes, compares that magnitude against the nearby epsilon constant at `0x005df610`, returns a zero vec4 when the length is too small, and otherwise applies one reciprocal-square-root refinement before writing the normalized vec4 result.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation + caller correlation"
0x0058a45a,306,math_compute_4d_cross_product_from_three_vec4_inputs_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005821d0`. The helper takes three caller vec4 inputs, forms the same alternating-sign generalized 4D cross-product-style combination through paired multiply-subtract bands, and writes the resulting vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + 4d-cross-product correlation + caller correlation"
0x0058a58c,113,math_blend_vec4_by_two_affine_scalars_from_three_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec4 sibling to the earlier affine blend strip. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec4 control points and two caller scalar weights, then writes the blended vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + affine-blend correlation"
0x0058a5fd,200,math_sample_cubic_basis_vec4_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec4 sibling to `0x00582470`. The helper derives the same four cubic-basis weights from the caller scalar parameter, applies those weights to four caller vec4 control points, and writes the blended vec4 result through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + cubic-basis correlation"
0x0058a6c5,223,math_sample_alternate_cubic_basis_vec4_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec4 sibling to `0x005825e0`. The helper derives the alternate cubic-basis weight family from the caller scalar parameter through the nearby MMX constant strip, applies those weights to four caller vec4 control points, and writes the blended vec4 result through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + alternate-basis correlation"
0x0058a7a3,65,math_build_plane_vec4_from_normal_vec3_and_point_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow plane builder over one caller normal vec3 and one point on that plane. The helper copies the incoming normal into the output `XYZ` lanes, computes the signed plane constant as the negated dot product of that normal with the caller point, and writes the resulting plane vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + geometry correlation + plane-correlation"
0x0058a7e6,229,math_build_plane_vec4_from_three_vec3_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005829b0`. The helper forms two edge vectors from three caller vec3 points, computes their cross-product-style normal, normalizes that resulting plane normal, derives the signed plane constant from one source point, and writes the resulting plane vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + geometry correlation + plane-correlation"
0x0058a8ca,190,math_intersect_origin_plane_normal_vec3_with_vec3_segment_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow geometric intersection helper over one plane-normal vec3 and two caller segment endpoints. The function derives the numerator and denominator for the plane-through-origin affine parameter, returns null when the denominator collapses to zero, and otherwise writes the intersection point `p0 + t*(p1-p0)` through the caller output. This is the safest current read for the MMX origin-plane-versus-segment sibling rather than a subsystem-specific query.","objdump + local disassembly + MMX-3DNow arithmetic inspection + geometry correlation + segment-intersection correlation"
0x0058a988,98,math_normalize_vec4_by_xyz_length_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow normalization helper over one caller vec4-like input. The function measures length from the first three lanes only, compares that squared XYZ length against the nearby epsilon constant at `0x005df610`, and when large enough scales the full four-lane payload by one reciprocal-square-root refinement before writing it through the caller output; smaller inputs collapse to zero through the same mask path. Current grounded callers are the broader matrix builders `0x00585b9b` and `0x00585c86`, so this is the safest current read for the shared normalize-by-XYZ-length helper rather than a full XYZW normalizer.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation + caller correlation"
0x0058a9ec,124,math_apply_4d_basis_rows_to_vec4_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005819f0`. The helper broadcasts each input XYZW lane, multiplies those broadcasts by the corresponding four rows of one caller 4x4 basis block, sums the four product bands, and stores the resulting vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation"
0x0058ac60,229,math_compute_interleaved_packed_sine_cosine_lanes_from_angles,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared packed trig helper over one caller vec4 of angles. The function performs sign extraction, range reduction, quadrant selection, and polynomial evaluation through the constant tables at `0x00628320..0x006283f0`, then returns one interleaved sine/cosine-style lane tuple in `xmm0`. Current grounded callers are the single-angle packed axial rotation-matrix builders `0x00583bb0` and `0x00583c30`, so the safest current read is an interleaved packed sine/cosine helper rather than a generic scalar polynomial.","objdump + local disassembly + polynomial-approximation inspection + trig correlation"
0x0058ad50,329,math_compute_packed_sine_and_cosine_vectors_from_angles,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared packed trig helper over one caller vec4 of angles and two caller output buffers. The function performs sign extraction, range reduction, quadrant selection, and dual polynomial evaluation through the constant tables at `0x00628400..0x00628520`, then writes one packed pair of sine/cosine result vectors through the two caller outputs. Current grounded caller is `0x00584210`, the packed Euler-angle-to-quaternion helper, so the safest current read is a packed sin/cos vector generator rather than a subsystem-specific math body.","objdump + local disassembly + polynomial-approximation inspection + trig correlation"
0x0058af80,244,math_compute_scalar_atan2_style_angle_from_y_and_x_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar angle helper over two caller float lanes. The function compares magnitudes, forms one min-over-max style ratio, evaluates a polynomial over that ratio, and then restores quadrant and sign through the constant strip at `0x006285d8..0x00628638`. Current grounded caller is quaternion slerp helper `0x005849eb`, so the safest current read is a scalar `atan2`-style angle worker rather than a narrower subsystem label.","objdump + local disassembly + polynomial-approximation inspection + trig correlation + caller correlation"
0x0058b080,247,math_compute_scalar_arccos_style_angle_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar inverse-cosine-style helper over one caller float lane. The function clamps or folds the incoming magnitude against the nearby constant strip at `0x006285d8..0x00628638`, evaluates a reciprocal-square-root-assisted polynomial, and restores the correct signed or reflected branch before returning one angle-like scalar in `mm0`. Current grounded caller is quaternion-to-axis-angle helper `0x00584ca5`, so the safest current read is a scalar arccos-style angle worker rather than a tighter half-angle claim.","objdump + local disassembly + polynomial-approximation inspection + trig correlation + caller correlation"
0x0058b180,226,math_compute_scalar_arccos_style_angle_variant_b_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Adjacent MMX or 3DNow scalar inverse-cosine-style helper over one caller float lane. The body shares the same reciprocal-square-root-assisted polynomial strip as `0x0058b080`, but finishes through a different reflected or complemented angle reconstruction path before returning one scalar in `mm0`. The safest current read is a second arccos-style angle variant rather than a tighter named inverse-trig identity.","objdump + local disassembly + polynomial-approximation inspection + trig correlation"
0x0058b280,233,math_compute_scalar_natural_logarithm_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar logarithm helper over one caller float lane. The function decomposes the input into exponent and mantissa bands, evaluates a polynomial over the reduced mantissa through the constant strip at `0x00628648..0x0062866c`, folds back the exponent contribution, and returns one natural-log-style scalar in `mm0`. The nearby wrapper `0x0058b380` scales this result by `0.434294...`, which is the strongest current evidence for the natural-log interpretation.","objdump + local disassembly + polynomial-approximation inspection + logarithm correlation"
0x0058b380,17,math_compute_scalar_base10_logarithm_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Tiny wrapper over `0x0058b280`. The helper calls the natural-log worker and then scales the result by the float constant at `0x0062868c`, `0.434294...`, before returning; the safest current read is a shared base-10 logarithm helper.","objdump + local disassembly + constant inspection + logarithm correlation"
0x0058b3a0,224,math_compute_scalar_exponential_e_to_x_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection + constant inspection,2,"Shared MMX or 3DNow scalar exponential helper over one caller float lane. The function range-reduces the input through the nearby `log2(e)` and split-`ln(2)` constants at `0x0062863c..0x0062864c`, evaluates the reduced polynomial strip, reconstructs the exponent field by shifting the derived integer part into float-exponent position, and returns one `e^x`-style scalar in `mm0` with the expected overflow and underflow clamps. The safest current read is a scalar natural-exponential worker rather than a subsystem-specific transform helper.","objdump + local disassembly + polynomial-approximation inspection + constant inspection + exponential correlation"
0x0058b480,24,math_compute_scalar_square_root_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Tiny MMX or 3DNow square-root helper over one caller scalar lane. The body seeds one reciprocal-square-root estimate through `pfrsqrt`, refines it with `pfrsqit1` and `pfrcpit2`, multiplies that reciprocal-square-root by the original input, and returns the resulting square-root-style scalar in `mm0`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + square-root correlation"
0x0058b4a0,8,math_clear_scalar_float_sign_bit_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly,2,"Tiny MMX or 3DNow scalar absolute-value helper. The function clears the sign bit of the caller float lane with the mask at `0x00628578` and returns the resulting non-negative scalar in `mm0`.","objdump + local disassembly + constant inspection + absolute-value correlation"
0x0058b4c0,50,math_round_scalar_upward_to_integral_float_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Tiny MMX or 3DNow scalar rounding helper over one caller float lane. The body truncates the input toward zero through `pf2id` and `pi2fd`, detects whether a positive fractional remainder is still present, and adds one low-lane unit from the mixed constant pair at `0x00628558` before returning. The safest current read is a scalar `ceil`-style helper rather than a stricter IEEE-mode claim.","objdump + local disassembly + constant inspection + rounding correlation"
0x0058b500,37,math_round_scalar_downward_to_integral_float_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Tiny MMX or 3DNow scalar rounding helper over one caller float lane. The body truncates the input toward zero through `pf2id` and `pi2fd`, detects whether a negative fractional remainder is still present, and subtracts one low-lane unit from the mixed constant pair at `0x00628558` before returning. The safest current read is a scalar `floor`-style helper rather than a stricter IEEE-mode claim.","objdump + local disassembly + constant inspection + rounding correlation"
0x0058b540,64,math_split_scalar_float_into_normalized_mantissa_and_exponent_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Shared MMX or 3DNow scalar decomposition helper over one caller float lane. The function masks off sign and exponent bits, rebuilds a normalized mantissa lane with fixed exponent bits through the constants at `0x00628540..0x00628588`, derives the unbiased exponent as an integer-float lane, and returns the pair packed in `mm0`. The safest current read is a `frexp`-style mantissa or exponent splitter rather than a tighter ABI claim.","objdump + local disassembly + constant inspection + exponent-mantissa correlation"
0x0058b580,94,math_scale_scalar_float_by_integral_power_of_two_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Shared MMX or 3DNow scalar scaling helper over one caller float lane and one caller integer-like exponent lane. The function extracts the current exponent field, adds the requested exponent delta, reconstructs the float when the result stays in range, and otherwise returns the expected underflow or signed-overflow infinities through the mask strip at `0x00628568..0x00628580`. The safest current read is an `ldexp`-style scalar multiply-by-`2^n` helper.","objdump + local disassembly + constant inspection + exponent-mantissa correlation + scaling correlation"
0x0058b5de,18,math_split_scalar_float_into_fractional_and_integral_float_lanes_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly,2,"Tiny MMX or 3DNow scalar split helper over one caller float lane. The body truncates the input to integer with `pf2id` or `pi2fd`, subtracts that integral part from the original value, and returns the fractional and integral float lanes packed together in `mm0`. The safest current read is a compact `modf`-style split helper rather than a dedicated subsystem formatter.","objdump + local disassembly + split correlation"
0x0058b600,72,math_compute_scalar_fmod_style_remainder_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + arithmetic inspection,2,"Shared MMX or 3DNow scalar remainder helper over one caller dividend lane and one caller divisor lane. When the divisor is non-zero it multiplies the dividend by the reciprocal divisor, truncates that quotient toward zero, keeps only the fractional remainder, rescales by the divisor, and returns the resulting same-sign remainder in `mm0`; a zero divisor falls back to the constant at `0x00628578`. The safest current read is an `fmod`-style remainder helper rather than a tighter IEEE remainder claim.","objdump + local disassembly + arithmetic inspection + remainder correlation"
0x0058b660,280,math_compute_scalar_cosine_and_sine_pair_from_angle_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar trig helper over one caller angle. The function performs sign extraction, range reduction, quadrant handling, and polynomial evaluation through the constant strip at `0x00628558..0x00628694`, then returns one packed cosine/sine-style lane pair in `mm0`. Current grounded callers are the MMX Euler-angle, axis-angle, scaled-axis, and single-angle rotation-matrix helpers, so the safest current read is a scalar cos/sin pair worker rather than a subsystem-specific helper.","objdump + local disassembly + polynomial-approximation inspection + trig correlation + caller correlation"
0x0058b780,280,math_compute_scalar_sine_lane_from_angle_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar trig helper over one caller angle. The body matches `0x0058b660` through the same range-reduction and polynomial path, but duplicates the sine-like result lane before returning. Current grounded callers are quaternion slerp helper `0x005849eb` and quaternion-to-axis-angle helper `0x00584ca5`, so the safest current read is a scalar sine worker with duplicated output lane.","objdump + local disassembly + polynomial-approximation inspection + trig correlation + caller correlation"
0x0058b9e0,408,math_compute_scalar_power_x_to_y_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection + constant inspection,2,"Broader MMX or 3DNow scalar power helper over one caller base lane and one caller exponent lane. The function preserves the sign of negative bases only when the exponent truncates to an integer with odd parity, derives the logarithm-like core from the absolute base through the same exponent or mantissa constants used by the adjacent scalar log worker, multiplies that core by the exponent, and then rebuilds the final result through the same exponential-style polynomial and exponent-field reconstruction family used by `0x0058b3a0`. The safest current read is a shared `pow(x, y)`-style helper rather than a narrower transform-specific claim.","objdump + local disassembly + polynomial-approximation inspection + constant inspection + power correlation"
0x00571016,26,refcounted_object_vtable_0x5def30_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for object family `0x005def30`. The helper re-enters destructor `0x0057ad20`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`. Current grounded caller is refcount helper `0x0057aedb`.","objdump + local disassembly + object-family correlation + refcount correlation"
0x00571032,26,refcounted_object_vtable_0x5def5c_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for sibling object family `0x005def5c`. The helper re-enters destructor `0x0057af0e`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + object-family correlation + refcount correlation"
0x0054eb10,376,shell_input_handle_window_command_and_toggle_messages,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Processes one shell window-command or toggle-style input message into the shell-input ring. The helper tracks the last packed command or coordinate tuple under `[this+0xa94/+0xa98/+0xa9c]`, iterates eight local branch families, toggles selected state bits in `[this+0xa8c]`, synthesizes 12-dword records with types such as `1`, `2`, `5`, `6`, `7`, `8`, `9`, `10`, and `11`, and enqueues those records through `0x0054e880`. Current grounded caller is the `WM_COMMAND` branch in `shell_controller_window_message_dispatch` `0x0054e3a0`, so this is the safest current read for the shell-input command or toggle message owner rather than a generic control callback.","objdump + caller inspection + local disassembly + event-ring correlation + command-message correlation"
0x0054ee50,544,shell_input_handle_window_mouse_message_and_enqueue_events,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Primary shell mouse-message handler for the `0x0200..0x0208` window-message family. The helper first deduplicates repeated `WM_MOUSEMOVE` coordinates against globals `0x0062545c/0x00625460`, then routes the live message through the shared shell-input command or toggle worker `0x0054eb10` and the surrounding pointer-state branches. Current evidence grounds this as the mouse-message ingress owner beneath `shell_controller_window_message_dispatch` `0x0054e3a0`, with local state updates flowing into the event-ring helpers `0x0054e880`, `0x0054e9c0`, and `0x0054ea20`.","objdump + caller inspection + local disassembly + mouse-message correlation + event-ring correlation"
0x0054f290,480,shell_input_apply_window_key_transition,shell,thiscall,inferred,objdump + analysis-context,4,Normalizes one `WM_KEYDOWN` or `WM_KEYUP` transition for the shell input object at 0x006d4018. The helper samples `GetKeyboardState` optionally derives an ASCII byte through `ToAscii` updates the 256-byte per-key table starting at [this+0x100] and maps selected keyboard scan codes into packed modifier flags at [this+0xa8c]: 0x1d sets or clears bit 0x4 Control 0x2a sets or clears bit 0x2 Left Shift 0x36 sets or clears bit 0x1 Right Shift and 0x38 sets or clears bit 0x20 Alt. It then forwards the synthesized event record through 0x0054e9c0 for later shell consumers. The shell controller window dispatcher at 0x0054e3a0 is the grounded caller.,objdump + analysis-context + import table + callsite inspection
0x0054f4d0,109,shell_input_snapshot_dispatch_state,shell,thiscall,inferred,objdump + analysis-context,3,Captures one filtered snapshot of the current shell input object state into a 0x30-byte caller buffer while temporarily zeroing the nested-dispatch counter at [this+0xa90]. Several shell and cursor consumers use this as the read-side companion to shell_input_apply_window_key_transition optionally passing the snapshot through the callback hook stored at 0x006d4008 before consuming it.,objdump + analysis-context + caller xrefs
0x0054f5b0,140,shell_input_enqueue_window_event_record_and_signal_dispatch,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Queues one 12-dword shell-input event record into the rotating ring rooted at `[this+0x128]`. The helper copies six caller-supplied dwords into one local 12-dword scratch record, rewrites ring index `[this+0xa88]` from `0x32` back to `0x31` when needed, writes the record into slot `[this+0x128 + index*0x30]`, increments the ring index, and then signals the downstream dispatch path through `0x0054e880`. Current grounded caller is the shell window-message dispatcher `0x0054e3a0` on the low-message branch that synthesizes event id `0xcd`, so this is the safest current read for the shell-input event enqueue-plus-signal helper rather than another keyboard-state primitive.","objdump + caller inspection + local disassembly + ring-buffer correlation"
0x0054f540,111,shell_input_cursor_inside_active_view,shell,cdecl,inferred,objdump + analysis-context,3,Returns whether the current cursor position should count as being inside the active shell controller view. When controller byte [0x006d4024+0x114226] is already set it returns true immediately; otherwise it samples the host cursor through `GetCursorPos` converts it into client coordinates for the active controller window through `ScreenToClient` and checks that point against the current view bounds selected from the shell controller table at [0x006d4024+0x34] and [0x006d4024+0x11421e]. Current grounded callers are the mouse-cursor mode helper at 0x0053f450 and the shell camera action helper at 0x004e0780 which suggests later world-relative cursor work still reuses the same shell controller path rather than a separate gameplay-only input object.,objdump + analysis-context + import table + caller xrefs
0x0054f640,83,shell_step_global_presentation_phase_scalar,shell,cdecl,inferred,ghidra-headless,2,Steps the shared presentation-phase scalar stored at 0x00d93850 downward by a small constant then clamps the returned value against fixed lower-bound constants. Callout-marker world-anchor and other presentation helpers use this as a common time-varying scalar after one of the nearby setters has seeded the global phase.,ghidra + rizin + llvm-objdump
0x0054f6a0,11,shell_set_global_presentation_phase_scalar_constant_0x3b30f27c,shell,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Tiny fixed-value setter for the shared presentation-phase scalar at `0x00d93850`. The helper stores literal float bit-pattern `0x3b30f27c` and returns immediately. Current grounded caller is shell-side branch `0x00538b72`, so this is the safest current read as one alternate fixed phase seed in the same strip as `0x0054f640` and `0x0054f700`.","objdump + caller inspection + local disassembly + presentation-phase correlation"
0x0054f6b0,11,shell_set_global_presentation_phase_scalar_constant_0x3baa64c3,shell,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Second tiny fixed-value setter for the shared presentation-phase scalar at `0x00d93850`. The helper stores literal float bit-pattern `0x3baa64c3` and returns immediately. Current grounded callers are shell-side branches `0x0052819d` and `0x0052b9f8`, so this is the safest current read as another alternate fixed phase seed beside `0x0054f6a0`, `0x0054f6c0`, and `0x0054f700`.","objdump + caller inspection + local disassembly + presentation-phase correlation"
0x0054f6c0,11,mouse_cursor_set_primary_motion_scalar_default,shell,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Tiny `MouseCursor.cpp` helper that seeds global float `0x00d93850` with the fixed default scalar `0x3951b717`. Current grounded caller is the per-frame mouse-cursor updater `0x0053f4e0`, which uses this as one of its reset-side scalar leaves before the later cursor-presentation pass.","objdump + caller inspection + local disassembly + mouse-cursor correlation"
0x0054f6d0,11,mouse_cursor_snapshot_primary_motion_scalar_into_saved_slot,shell,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Tiny `MouseCursor.cpp` helper that copies the current primary motion scalar from `0x00d93850` into saved slot `0x00625464`. Current grounded caller is the per-frame mouse-cursor updater `0x0053f4e0`.","objdump + caller inspection + local disassembly + mouse-cursor correlation"
0x0054f6e0,21,mouse_cursor_restore_primary_motion_scalar_from_saved_slot_and_clear_saved_slot,shell,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Tiny `MouseCursor.cpp` helper that restores global motion scalar `0x00d93850` from saved slot `0x00625464` and then clears the saved slot back to `-1.0f`. Current grounded caller is the per-frame mouse-cursor updater `0x0053f4e0`, where it acts as the tail-side restore companion to `0x0054f6d0`.","objdump + caller inspection + local disassembly + mouse-cursor correlation"
0x0054f700,12,shell_set_global_presentation_phase_scalar,shell,cdecl,inferred,ghidra-headless,3,Stores one caller-supplied float into the shared presentation-phase scalar at 0x00d93850. Mouse-cursor geographic-label and other presentation helpers seed this global before later batch or marker helpers consume it through 0x0054f640.,ghidra + rizin + llvm-objdump
0x0054f710,729,shell_queue_callout_segment_marker,shell,cdecl,inferred,ghidra-headless,2,Queues one short world-space callout segment or marker packet using the shell zoom table rooted at [0x006d4024+0x11421e] and [0x006d4024+0x34]. The helper derives scaled endpoint deltas from the caller inputs applies flag-controlled clamps from arg_14h and emits three type-0x01 deferred messages through shell_enqueue_deferred_message_type1.,ghidra + rizin + llvm-objdump
0x0054f9f0,281,shell_queue_callout_frame_segments,shell,cdecl,inferred,ghidra-headless,4,Builds a four-segment callout frame around one projected extent box. The helper samples the same shell zoom and reciprocal scale tables under 0x006d4024 computes the four box legs from the caller extent inputs and emits each side through shell_queue_callout_segment_marker.,ghidra + rizin + llvm-objdump
0x0054fb10,699,shell_queue_callout_leader_path,shell,cdecl,inferred,ghidra-headless,3,Builds one longer world-space callout leader path between two points. It derives slope and angle terms from the caller inputs recursively reuses itself or 0x0054f710 for shorter segments chooses style branches from distance and flag tests and enqueues the resulting type-0x01 deferred messages. shell_publish_text_callout_presentation uses this helper for text-associated leader geometry.,ghidra + rizin + llvm-objdump
0x0054fdd0,256,shell_queue_presentation_batch_pair,shell,cdecl,inferred,ghidra-headless,2,Queues a two-record presentation batch through the shell deferred-message path. One branch emits a single trailing type-0x04 record while the other brackets two type-0x04 payload posts with direct type-0x05 and type-0x06 begin-end records; both legs seed their animated scalar through shell_step_global_presentation_phase_scalar before routing through the shell bundle at 0x006d4024.,ghidra + rizin + llvm-objdump
0x0054fed0,440,shell_queue_presentation_batch_quad,shell,cdecl,inferred,ghidra-headless,2,Queues a four-record presentation batch through the same deferred-message family. It posts a type-0x05 begin record emits four type-0x04 payload records with refreshed phase scalars from shell_step_global_presentation_phase_scalar and finally closes the batch with a type-0x06 end record. The current high-level callers build this from four related point or extent tuples.,ghidra + rizin + llvm-objdump
0x005519f0,902,shell_publish_text_callout_presentation,shell,cdecl,inferred,ghidra-headless,3,Publishes one styled text or callout presentation payload through the active shell bundle at 0x006d4024. It accepts text placement and style inputs conditionally emits a leader path through 0x0054fb10 allocates backing text resources through 0x0051f0b0 and 0x00543c10 sets presentation flags from the mode arguments and finalizes the payload through 0x0051fc20. Geographic-label text and mouse-cursor presentation both feed this helper.,ghidra + rizin + llvm-objdump + strings
0x00552160,56,world_anchor_measure_projected_half_width,shell,cdecl,inferred,ghidra-headless,3,Measures one absolute projected half-width-like extent from the caller world-anchor object. It chooses the X or Z span depending on orientation byte [this+0x24] scales by the owner coefficients at +0x2e or +0x32 multiplies by local width scalar [this+0x1c] and returns the absolute result for later cursor or marker placement code.,ghidra + rizin + llvm-objdump
0x005521a0,56,world_anchor_measure_projected_half_height,shell,cdecl,inferred,ghidra-headless,3,Measures one absolute projected half-height-like extent from the caller world-anchor object. It chooses the complementary axis span using the same orientation byte [this+0x24] scales by owner coefficients at +0x2e or +0x32 multiplies by local height scalar [this+0x20] and returns the absolute result for later cursor or marker placement code.,ghidra + rizin + llvm-objdump
0x005521e0,894,world_anchor_project_screen_extent_pair,shell,cdecl,inferred,ghidra-headless,3,Projects one world-anchor object into a paired screen-space extent result. The helper samples the shell zoom table under 0x006d4024 computes integer-scaled axis spans from the anchor geometry converts them through multiple clamp or reciprocal stages and writes two output integers through the caller pointers before later marker builders use the results for anchor presentation sizing.,ghidra + rizin + llvm-objdump
0x00552560,916,shell_queue_world_anchor_marker,shell,cdecl,inferred,ghidra-headless,3,Builds one world-anchor marker packet from the caller point object and optional scale or style inputs. It samples anchor extents from the object fields converts them through 0x0053dde0 0x0053ddf0 and world_anchor_project_screen_extent_pair consults the shell zoom table rooted at [0x006d4024+0x11421e] and [0x006d4024+0x34] and finally enqueues one type-0x01 deferred message through shell_enqueue_deferred_message_type1. mouse_cursor_update_frame_state uses it for one branch of cursor world-relative presentation.,ghidra + rizin + llvm-objdump
0x00552900,1304,shell_queue_projected_world_anchor_quad,shell,cdecl,inferred,ghidra-headless,3,Builds one oriented projected quad around the caller world-anchor object. It derives four projected corner points from the anchor extents and orientation computes edge and diagonal lengths through 0x0051db80 samples the shared presentation phase through shell_step_global_presentation_phase_scalar refines screen-space bounds through world_anchor_project_screen_extent_pair and finally emits two type-0x04 deferred-message posts through shell_enqueue_deferred_message_type4.,ghidra + rizin + llvm-objdump
0x0051db80,32,math_measure_float_xy_pair_distance,support,cdecl,inferred,objdump + caller xrefs + callsite inspection,4,"Tiny shared float distance helper. It subtracts one caller-supplied X or Y point pair from the other, squares both deltas, sums them, and returns the Euclidean distance `sqrt(dx*dx + dy*dy)`. Current grounded callers include the city-connection chooser at `0x00402cb0`, the route-entry search family at `0x0049bd40` and `0x0049d380`, several company and world-side scoring branches, and shell presentation helpers such as `shell_queue_projected_world_anchor_quad` `0x00552900`. This now grounds `0x0051db80` as a generic float XY distance primitive rather than another opaque quality helper.","objdump + caller xrefs + callsite inspection + arithmetic inspection"
0x0051dbb0,32,math_measure_float_xy_pair_distance_squared,support,cdecl,inferred,objdump + caller xrefs + arithmetic inspection,4,"Tiny squared-distance sibling of `math_measure_float_xy_pair_distance` `0x0051db80`. It subtracts one caller-supplied float X or Y pair from the other, squares both deltas, sums them, and returns that raw squared Euclidean distance without the final `sqrt`. Current grounded callers include the region-cell nearest-assignment pass `world_region_collection_clear_cell_region_word_and_assign_nearest_region_ids` `0x00421730` and the weighted auxiliary route-entry tracker metric family around `0x004a5280`, where the unsquared ordering is enough and the exact root would be wasted work. This now grounds `0x0051dbb0` as the generic float XY squared-distance primitive rather than another opaque scoring helper.","objdump + caller xrefs + arithmetic inspection + squared-distance correlation"
0x0051dbe0,32,math_measure_int_xy_pair_distance_squared,support,fastcall,inferred,objdump + caller xrefs + arithmetic inspection,4,"Small integer squared-distance helper. It takes one integer XY pair in `ECX/EDX`, subtracts the caller-supplied comparison pair from the stack, squares both integer deltas, sums them, and returns that raw squared distance without `sqrt`. Current grounded callers include `company_query_min_linked_site_distance_to_xy` `0x00405920`, where it ranks linked sites before the winning integer distance is later converted back to `float`, so the safest current read is a compact integer XY squared-distance primitive rather than another gameplay-specific metric.","objdump + caller xrefs + arithmetic inspection + company-distance correlation"
0x0051dc00,96,math_lookup_precomputed_abs_xy_distance_or_exact_euclidean_u16,support,fastcall,inferred,objdump + caller xrefs + arithmetic inspection,4,"Small radial-distance helper. It first converts the caller's two coordinate pairs into absolute X and Y deltas. When both deltas are below `0x418`, it indexes the precomputed `u16` distance table at `0x006d9098` using row stride `0x418` and returns that cached value. Otherwise it falls back to the exact Euclidean distance path by squaring both deltas, summing them, taking `sqrt`, rounding through `0x005a10d0`, and returning that integer result. Current grounded callers include the composed world-scalar query `0x0044afa0`, several world-side sample or scan branches around `0x0044d5b0..0x0044db34`, multiple placed-structure or specialization branches at `0x00452290`, `0x004524bf`, `0x0045bb97`, and `0x0045bbe2`, and later route-side callers around `0x00494a48` and `0x004a8a7f`, so this now reads as a shared precomputed-or-exact XY radial distance primitive rather than a one-off lookup table wrapper.","objdump + caller xrefs + arithmetic inspection + precomputed-distance-table correlation"
0x0051dd60,114,support_trim_ascii_spaces_and_optional_newlines_in_place,support,fastcall,inferred,objdump + caller xrefs + local disassembly,3,"In-place ASCII trimming helper over one mutable NUL-terminated string. Starting from the end, the helper removes trailing spaces unconditionally and also strips trailing CR or LF when caller flag `EDX` is nonzero; it then removes leading spaces by shifting the remaining payload left through `0x005a20b0`. Current grounded callers include shell-side status, profile, and filename formatting branches around `0x004317d7`, `0x00444cfa`, `0x0048923d`, `0x004acc13`, `0x004dcf85`, and the lower text helper at `0x005176d3`, so this is the safest current read for the shared ASCII trim-in-place helper rather than a file-family-specific normalizer.","objdump + caller xrefs + local disassembly + string-trim correlation"
0x0051dde0,46,support_copy_string_stem_before_first_dot,support,fastcall,inferred,objdump + caller xrefs + local disassembly,3,"Small string-stem copier. The helper copies bytes from source `ECX` into destination `EDX` until it reaches either NUL or the first literal `'.'`, then writes one terminating NUL and returns. Current grounded callers include save/load and runtime-bundle text branches around `0x00441fac`, `0x00442076`, `0x0044211f`, and `0x00443cf4`, where it is used to derive extensionless stems before appending localized suffixes or looking up sibling resources. This now reads as the shared copy-until-dot stem helper rather than a gameplay-specific formatter.","objdump + caller xrefs + local disassembly + stem-copy correlation"
0x0051de10,303,support_blend_packed_rgba_dwords_by_float_weight,support,thiscall,inferred,objdump + caller xrefs + local disassembly + color-packing correlation,3,"Packed-color blend helper over two caller-supplied 32-bit RGBA-like dwords in `ECX` and `EDX`. The function derives the complementary blend weight `1.0 - weight`, unpacks all four byte lanes from both colors, blends each lane independently through the caller float weight, rounds each blended lane through `0x005a10d0`, and repacks the result into one 32-bit return value. Current grounded caller is `world_build_transport_pricing_preview_surface_from_secondary_raster` `0x0044f840`, where it blends the fixed fallback colors `0x5f040566` and `0x96586131` into the five seeded palette entries rather than manipulating a general-purpose image buffer directly.","objdump + caller xrefs + local disassembly + color-packing correlation + preview-palette correlation"
0x0051df50,55,support_query_or_round_down_to_power_of_two,support,fastcall,inferred,objdump + caller xrefs + local disassembly,3,"Small power-of-two helper. Given one positive integer in `ECX`, it first finds the least power of two greater than or equal to that value. If the input is already an exact power of two it returns the input unchanged; if it is not exact and caller flag `EDX` is zero, it returns the next lower power of two; otherwise it returns `0`. Current grounded caller is the resource-side sizing branch at `0x005327eb/0x005327fa`, which passes `EDX = 0` to clamp two dimensions down to usable power-of-two texture sizes before later minimum-size enforcement. This now reads as a generic exact-or-round-down power-of-two helper rather than a texture-only magic-constant block.","objdump + caller xrefs + local disassembly + power-of-two correlation + resource-sizing correlation"
0x0051df90,39,support_strip_extension_in_place_from_last_dot,support,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small in-place extension stripper. The helper walks to the end of the caller-owned NUL-terminated string, scans backward for the last literal `'.'`, and when found overwrites that dot with NUL; strings without any dot are left unchanged. Current grounded callers include `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0` and several save/load or scenario-text formatting branches around `0x004427df`, `0x00445d53`, `0x00461847`, `0x004f0b78`, and `0x00553784`, where it is used to normalize display labels from extension-bearing resource names. This now reads as the shared strip-extension-in-place helper rather than another file-family-specific normalizer.","objdump + caller xrefs + local disassembly + extension-strip correlation"
0x0051dfc0,522,support_remap_clamped_unit_scalar_into_piecewise_packed_preview_color,support,cdecl,inferred,objdump + caller xrefs + local disassembly + color-ramp correlation,3,"Piecewise scalar-to-color helper over one caller float. The function first clamps the input into the unit interval `[0,1]`, then derives one remapped scalar and its complement through a piecewise curve with explicit breakpoints around `0.25`, `0.5`, and `0.75`. It finally packs those remapped values into one `0xcf`-alpha 32-bit preview color, with a small mode switch keyed by `[0x006d4024+0x11474e]` deciding whether the packed result duplicates one grayscale lane or preserves a two-lane split. Current grounded callers include world-side preview and overlay branches around `0x0045092e`, `0x00450b0f`, `0x00450cc9`, and `0x00450ddd`, plus several route-style and runtime-object presentation branches at `0x0048a860`, `0x0048e033`, `0x00493048`, `0x004b2a24`, and `0x004bd379`, so the safest current read is a shared clamped scalar-to-packed-preview-color ramp rather than a single-family palette helper.","objdump + caller xrefs + local disassembly + color-ramp correlation + preview-color correlation"
0x0051e1d0,591,support_remap_clamped_unit_scalar_into_alternate_piecewise_preview_color_when_mode0,support,cdecl,inferred,objdump + caller xrefs + local disassembly + color-ramp correlation,3,"Alternate sibling of `0x0051dfc0` over one caller float. When display-runtime mode dword `[0x006d4024+0x11474e]` is nonzero the helper jumps back into the ordinary packed preview-color ramp at `0x0051dfc0`; otherwise it applies a different piecewise remap with extra breakpoints around `0.2`, `0.4`, `0.6`, and `0.8`, then packs one `0xcf`-alpha preview color with several grayscale or two-lane output modes. Current grounded caller is the presentation branch at `0x0048dc3f`, so the safest current read is a mode-`0` alternate scalar-to-preview-color ramp rather than a generic palette helper.","objdump + caller xrefs + local disassembly + color-ramp correlation + preview-color correlation"
0x0051e430,79,support_query_path_is_openable_for_read,support,thiscall,inferred,objdump + caller xrefs + local disassembly + import correlation,3,"Small file-openability probe over one caller path string. The helper copies the incoming path into a stack buffer, opens it through the local file-open wrapper `0x005a4c57`, and when that succeeds immediately closes the handle through `CloseHandle` before returning `1`; failures return `0`. Current grounded callers include branches at `0x00446064`, `0x004b8af1`, `0x004dd305`, `0x004dd33a`, and `0x0053d18b`, so this is the safest current read for the shared `can this path be opened for read` probe rather than another family-specific file test.","objdump + caller xrefs + local disassembly + import correlation + file-open correlation"
0x0051e480,95,support_query_file_size_by_path_or_zero,support,thiscall,inferred,objdump + caller xrefs + local disassembly + import correlation,3,"Small file-size probe over one caller path string. The helper copies the incoming path into a stack buffer, opens it through the same local file-open wrapper used by `0x0051e430`, seeks to end through `SetFilePointer(handle, 0, 0, FILE_END)`, closes the handle, and returns the resulting size; open failures return `0`. Current grounded caller is the resource-side branch at `0x0053c758`, where it supplies a missing file-size value when the incoming cached size is `-1`.","objdump + caller xrefs + local disassembly + import correlation + file-size correlation"
0x0051e4e0,113,support_publish_ascii_text_to_clipboard_if_available,support,cdecl,inferred,objdump + caller xrefs + local disassembly + import correlation,3,"Shared ASCII clipboard-export helper. The function opens the clipboard, empties it, allocates a movable global block, copies the caller text into that block through `lstrcpyA`, unlocks it, and publishes the handle through `SetClipboardData(CF_TEXT)` before closing the clipboard. Current grounded callers are neighboring text-edit or widget branches at `0x0055c2b0` and `0x0055c772`, so this is the safest current read for the bounded clipboard publish helper.","objdump + caller xrefs + local disassembly + import correlation + clipboard correlation"
0x0051e560,98,support_copy_clipboard_text_into_buffer_bounded,support,cdecl,inferred,objdump + caller xrefs + local disassembly + import correlation,3,"Shared ASCII clipboard-import helper. The function opens the clipboard, queries `CF_TEXT` through `GetClipboardData`, locks the returned handle, bounded-copies the clipboard contents into the caller buffer through `lstrcpynA`, forces a trailing NUL, unlocks the block, and closes the clipboard. Current grounded caller is the neighboring text-edit branch at `0x0055be56`, so this is the safest current read for the bounded clipboard pull helper.","objdump + caller xrefs + local disassembly + import correlation + clipboard correlation"
0x0051e6e0,62,support_query_string_is_nonempty_ascii_digits_only,support,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small string predicate over one caller-owned NUL-terminated buffer. The helper rejects null pointers and empty strings, then scans every byte and succeeds only when each character is ASCII `'0'..'9'`. Current grounded callers are text-entry validation branches at `0x004acd01` and `0x004ae817`, so this is the safest current read for the nonempty digits-only predicate rather than a broader parser.","objdump + caller xrefs + local disassembly + text-validation correlation"
0x0051e720,29,support_set_active_debug_log_filename_and_clear_init_flags,support,thiscall,inferred,objdump + caller xrefs + local disassembly + string correlation,3,"Small debug-log filename setter over one caller string. The helper copies up to `0x64` bytes into global buffer `0x006d3ca8`, clears byte `0x006d3d0c`, and clears dword `0x006d3d10`. Current grounded callers are the neighboring bootstrap leaves at `0x0051cff5` and `0x0051d02b`, which seed the default names `rt3_debug.txt` and `language_debug.txt`, so this is the safest current read for the active debug-log filename setter plus init-flag clear.","objdump + caller xrefs + local disassembly + string correlation + debug-log correlation"
0x0051e740,197,support_open_or_create_active_debug_log_and_append_separator_once,support,cdecl,inferred,objdump + caller xrefs + local disassembly + string correlation,3,"Debug-log bootstrap helper over the active global filename at `0x006d3ca8`. The function gates on byte `0x006d3ca0`, uses dword `0x006d3d10` as an in-progress latch, seeds the default filename when needed, formats the path `.\\data\\log\\%s`, opens or creates the target stream through the local file wrapper, appends the fixed separator line `------------------\\n`, closes the stream, and clears the in-progress latch. Current grounded callers are `0x0051cffa` and `0x00521089`, so this is the safest current read for the active debug-log open-or-create plus one-time separator writer.","objdump + caller xrefs + local disassembly + string correlation + debug-log correlation"
0x0051e810,363,shell_mouse_cursor_adjust_showcursor_refcount_and_sync_screen_position_if_live,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + import correlation + source-string correlation,3,"Shared mouse-cursor visibility and position helper beneath the live shell family. The function adjusts global refcount `0x00624b20` up or down from one caller boolean, repeatedly calls `ShowCursor` until the OS cursor visibility count crosses the desired state, and when the live shell bundle exists plus `0x0051f0b0` says the cursor service is active, it derives current screen coordinates from the display tuple via `0x0051f100` and `0x00543c10` and may call `SetCursorPos` when `0x0051f1a0` passes. The grounded source string `\\RT3\\exe\\Src\\Engine\\MouseCursor.cpp` and callers around `0x0053f075`, `0x0053f146`, `0x0053f208`, `0x0053f2af`, `0x0053f480`, `0x0053f492`, and `0x0051e9b7` make this the safest current read for the mouse-cursor ShowCursor-refcount and live-position sync helper.","objdump + caller xrefs + local disassembly + import correlation + source-string correlation + mouse-cursor correlation"
0x0051e980,246,shell_publish_warning_modal_once_and_force_cursor_visible,shell,cdecl,inferred,objdump + caller xrefs + local disassembly + import correlation + string correlation,3,"Guarded warning-modal publisher. The helper uses dword `0x006d3d18` as a reentrancy latch, flips shell byte `[0x006d4024+0x57]` when the live shell bundle exists, forces cursor visibility through `0x0051e810(1, \"\\\\RT3\\\\exe\\\\Src\\\\Engine\\\\Misc.cpp\", 0x110)`, formats the warning body through `0x0051d680`, and shows the shared `MessageBoxA` warning box with localized text and caption ids `0x44/0x45`. Current grounded callers include `0x0040cd70` and many neighboring shell, runtime-object, and setup-warning branches, so this is the safest current read for the shared guarded warning-modal publisher rather than a one-off formatter.","objdump + caller xrefs + local disassembly + import correlation + string correlation + warning-modal correlation"
0x0044bd10,152,world_query_region_category_byte_at_world_coords,map,thiscall,inferred,objdump + caller xrefs + local disassembly + region-raster correlation,3,"Small world-grid lookup helper over the per-cell region word family rooted at `[world+0x212d]`. The function converts caller float coordinates into rounded cell indices through the world-cell scale at `0x005c8568`, clamps those indices to live dimensions `[world+0x214d/+0x2151]`, resolves the current cell record from `[world+0x212d] + cell*4`, and treats the record as a mixed byte-or-word id: when the trailing `u16` lane at `+1` is nonzero it uses that wider id, otherwise it falls back to the first byte. It then resolves the resulting region or city entry through collection `0x0062bae0` and returns entry dword `[entry+0x272]`, with fixed fallback `5` when no entry resolves. Current grounded callers include the structure-side formatter at `0x00403ba7` and the StationPlace world-surface branches at `0x00508b80`, `0x00508d59`, and `0x0050a4e6`, where this helper feeds the current selected-site category latch `0x00622af0`.","objdump + caller xrefs + local disassembly + region-raster correlation + StationPlace category correlation"
0x0044b160,936,world_try_bulldoze_near_coords_and_format_failure_message,map,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng strings,3,"Shared bulldoze-side chooser and commit helper beneath the TrackLay and sibling world-surface bulldoze lanes. The function first clears the caller-owned failure-text buffer and one output slot, validates the supplied company id through the live company collection `0x0062be10`, and on the ordinary non-editor path formats RT3.lng `419` `You can't bulldoze without a company.` when no valid company is available. It then performs two grounded passes over nearby runtime collections around the caller's world coordinates and radius: the early pass estimates or selects the best current bulldoze target while tracking the strongest nearby route-entry distance split, and the later pass performs the actual delete-or-commit branches. The target-family split is now real too. It scans the live route-entry collection `0x006cfca8`, the city-or-region collection `0x0062bae0`, the broader structure collection `0x006cea50`, linked placed structures in `0x0062b26c`, the route-side blocker collection `0x0062ba84`, and the live placed-structure collection `0x006cec20`, repeatedly sampling coordinates through `0x00455800/0x00455810`, `0x0048a1a0/0x0048a1c0`, `0x0047ded0/0x0047df00`, and the radial helper `0x0051db80`. The rejection ladder is now grounded by string ids: mismatched building ownership formats `421` `You can't bulldoze this building - it's owned by another railroad!`, mismatched track ownership formats `422`, nearby rolling-stock blockage formats `423`, and the placed-structure blocker lane localizes the two colliding structure stems through `0x0051c920` before formatting `424` `You can't bulldoze that track - it's too close to a %1. Try bulldozing the %2 first.`. The cost gate is grounded too: on the ordinary company path it reads the company treasury through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0` on stat family `0x2329` mode `0x0d`, formats `420` when the chosen bulldoze cost exceeds available cash, and otherwise commits the cost through `company_apply_bulldoze_or_local_action_cost_scalar` `0x0042a080`. On success the helper dispatches the actual bulldoze branch through the selected owner family: route-entry and route-anchor targets commit through `0x004937f0`, `0x004941a0`, and `0x0048abf0`, while building or linked-site targets commit through the surrounding placed-structure virtual slot `+0x58` and neighboring collection erases. Current grounded direct callers are the TrackLay bulldoze branches at `0x0050d83e` and `0x0050d8fc` plus the neighboring world-surface branches at `0x00473050` and `0x004b8685`, so this is the safest current read for the shared bulldoze chooser-plus-failure-message helper rather than a generic proximity scan.","objdump + caller xrefs + local disassembly + RT3.lng strings + TrackLay bulldoze correlation + rejection-ladder correlation"
0x0044bdb0,107,world_count_neighbor_cells_in_secondary_raster_class_set_2_4_5,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Eight-neighbor count helper over the secondary-raster class subset owned by `world_secondary_raster_query_cell_class_in_set_2_4_5` `0x00534ec0`. Starting from one caller cell coordinate pair, the helper walks the shared `0x00624b28/0x00624b48` offset tables across the eight immediate neighbors, bounds-checks each neighbor against world dimensions `[world+0x2155/+0x2159]`, and increments the result only when `0x00534ec0` reports that the neighbor cell belongs to class set `2/4/5`. Current grounded callers are the neighboring secondary-raster service branches at `0x0044bf9d`, `0x0044bfc8`, `0x0044c0d5`, `0x0044c348`, and `0x0044c37b`, so this is the safest current read for the local class-subset neighbor counter rather than another generic lattice scan.","objdump + caller xrefs + local disassembly + secondary-raster correlation + 8-neighbor offset-table correlation"
0x0044be20,992,world_secondary_raster_walk_connected_class_2_4_5_component_and_refresh_edge_flags,map,thiscall,inferred,objdump + local disassembly + internal caller correlation,3,"Recursive connected-component walker beneath the late secondary-raster neighborhood service band. The helper first widens dirty min/max bounds `[this+0x21ad..+0x21b9]` to include the current cell, marks the temporary visit bitmap at `0x0062c128`, resolves the current 3-byte raster cell through `world_secondary_raster_resolve_cell_record_ptr` `0x00534f40`, and writes one 3-bit orientation lane into the companion word using the lookup table at `0x005ee5cc` plus the caller-supplied direction index and polarity. It then walks all eight bounded neighbors through the shared offset tables `0x00624b28/0x00624b48`, keeps only neighbors in secondary-raster class set `2/4/5` through `0x00534ec0`, tracks local degree and visitation in two caller-local byte rings, and on admissible neighbors recurses back into itself while setting the same temporary visit bitmap. The admissibility split is tighter too: when world mode gate `[this+0x21bd]` is clear and the current or neighbor cell carries byte-2 flag `0x20`, it re-enters `world_count_neighbor_cells_in_secondary_raster_class_set_2_4_5` `0x0044bdb0` and rejects neighbors with degree `>= 3`. After the recursive walk it clears edge bits `0x04/0x08` in the current cell byte-1 lane, conditionally restores one of those bits for sparse interior cells, and on the byte-2 `0x20` family may rewrite the companion-word orientation lane again from the surviving neighbor pattern. Current grounded direct callers are the internal owner paths at `0x0044c029`, `0x0044c3ea`, and `0x0044c422`, all inside the same connected-component owner `0x0044c200`, so this is the safest current read for the recursive class-`2/4/5` component walker rather than a generic flood fill.","objdump + local disassembly + internal caller correlation + secondary-raster component correlation + edge-flag update correlation"
0x0044c200,592,world_seed_secondary_raster_class_2_4_5_component_walk_from_cell,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Connected-component owner beneath the late secondary-raster neighborhood service band. The helper first validates the caller seed cell through `world_secondary_raster_query_cell_class_in_set_2_4_5` `0x00534ec0`; when that test fails it returns immediately. On success it snapshots shell input flag bit `0x4` from `[0x006d4018+0xa8c]` into world dword `[this+0x21bd]`, seeds dirty min/max bounds `[this+0x21ad..+0x21b9]` from the starting cell, allocates a temporary visited-cell bitmap of `width*height` bytes through `0x005a125d`, clears it, and marks the seed cell. It then resolves the seed raster cell through `0x00534f40`, derives one starting direction index from the seed cell header byte via the remap table at `0x005ee5d4`, and walks the eight immediate neighbors through `0x00624b28/0x00624b48`. Every bounded neighbor that remains in class set `2/4/5`, passes the same byte-2 `0x20` plus degree filter used by `0x0044be20`, and survives the local turn-distance test is forwarded into `world_secondary_raster_walk_connected_class_2_4_5_component_and_refresh_edge_flags` `0x0044be20` with the derived direction index and one branch-polarity flag. After the first fan-out it re-enters that same recursive walker once more on the seed cell itself with the final surviving direction and polarity, then releases the temporary visit bitmap through `0x005a1145`. Current grounded caller is the later mutation branch at `0x0044e796`, so this is the safest current read for the seed-and-own wrapper of the connected class-`2/4/5` walk rather than another one-shot scan.","objdump + caller xrefs + local disassembly + secondary-raster correlation + connected-component owner correlation"
0x00554d70,248,billboard_item_build_anchor_point_cache,bootstrap,thiscall,inferred,ghidra-headless,3,Builds or refreshes the cached point list for one billboard item at [this+0x1dd]. When source points exist at [this+0x10] it transforms them through the owner object matrix near [this+0x0c]+0xce; otherwise it seeds a one-point fallback from the baked vector at [this+0xfe..0x106].,ghidra + rizin + llvm-objdump
0x00554e70,680,shell_emit_ranked_sprite_billboard_item,bootstrap,thiscall,inferred,ghidra-headless,4,Emits one ranked sprite-billboard item into the current vertex24 span. The helper computes a distance-weighted fade against shell and world state stores the derived scalar at [item+0xdc] and then walks either the item's linked child list at [item+0x4] or the cached anchor list at [item+0x1dd] to write textured quad geometry through 0x005662a0.,ghidra + rizin + llvm-objdump
0x00555740,49,billboard_item_refresh_child_sprite_colors,bootstrap,thiscall,inferred,ghidra-headless,3,Refreshes packed child-sprite colors for one billboard item by iterating the linked child list at [this+0x4] recomputing each child color through 0x005554f0 and storing the 24-bit result at [child+0x70].,ghidra + rizin + llvm-objdump
0x00555780,1739,sprite_billboard_spawn_particle_instance,bootstrap,thiscall,inferred,ghidra-headless,4,Builds one emitted sprite-billboard instance from the template item. It randomizes local offsets through fields [this+0x7c..0x90] optionally samples anchor points from the owner matrix or cached path data chooses atlas uv bounds from [this+0x110..0x124] applies scale and fade terms from [this+0x94..0x108] recomputes packed colors through 0x005554f0 and finalizes the instance through 0x00565e80 and 0x00565f40.,ghidra + rizin + llvm-objdump
0x00555e50,1808,sprite_billboard_update_particle_emitter,bootstrap,thiscall,inferred,ghidra-headless,4,Advances one sprite-billboard emitter template and spawns new instances through 0x00555780. The routine updates emitter clocks and travel bounds in [this+0x68..0xc8] applies burst or repeat controls through [this+0x1ed..0x1f9] walks up to [this+0x34] spawn lanes resolves anchor positions from cached or owner-derived points and refreshes the active emitter origin at [this+0xc0] and [this+0xc4].,ghidra + rizin + llvm-objdump
0x0055d430,6,system_get_total_physical_memory_bytes,support,cdecl,inferred,ghidra-headless,4,Returns the cached total physical-memory byte count from the shared MEMORYSTATUS block at 0x00d9754c. The graphics preset bundle uses this value as one of its coarse runtime capability probes after the cache has been refreshed through GlobalMemoryStatus nearby.,ghidra + rizin + llvm-objdump
0x0055d440,17,system_refresh_available_physical_memory_bytes,support,cdecl,inferred,ghidra-headless,4,Refreshes the shared MEMORYSTATUS block at 0x00d97548 through GlobalMemoryStatus and returns the resulting available physical-memory byte count from dwAvailPhys. This is the active memory-availability probe companion to 0x0055d430.,ghidra + rizin + llvm-objdump + strings
0x0055d460,81,os_is_non_nt_platform,support,cdecl,inferred,ghidra-headless,4,Calls GetVersionExA and returns true only when the platform id is not VER_PLATFORM_WIN32_NT. The graphics preset bundle inverts this result into an NT-family capability flag before finalizing several display-runtime bytes under 0x006d4024.,ghidra + rizin + llvm-objdump + strings
0x0055d8d0,138,display_get_primary_adapter_descriptor,support,cdecl,inferred,ghidra-headless,4,Enumerates display devices through USER32.EnumDisplayDevicesA until it finds the primary adapter flag then copies the adapter DeviceString field into the global buffer at 0x00d97448 and returns that buffer. When enumeration fails it leaves the descriptor empty and still returns the same shared buffer pointer. The graphics preset matcher at 0x00484a60 consumes this descriptor text directly.,ghidra + rizin + llvm-objdump + strings
0x005a0f70,209,stream_cipher_xor_in_place,support,cdecl,inferred,rizin,4,Applies one stateful stream-cipher pass in place over the caller buffer in ECX for the caller byte count in EDX using the 0x102-byte cipher state block passed on the stack. The helper mutates the two state bytes at offsets `+0x100` and `+0x101` and uses the 0x100-byte permutation table at the start of the state block to XOR every byte in the buffer. Current grounded callers are the multiplayer transport text-stream receive and send paths.,rizin + llvm-objdump
0x005a18a0,292,string_copy_bounded_zerofill,support,cdecl,inferred,ghidra-headless,4,Shared bounded string-copy helper that copies up to count bytes from source to destination stops after the first NUL byte and zero-fills the remaining span before returning the destination pointer. The graphics preset matcher uses it to stage the primary adapter descriptor into a local probe buffer before substring token scans,ghidra + rizin + llvm-objdump
0x00556620,305,sprite_billboard_manager_reset,bootstrap,thiscall,inferred,ghidra-headless,3,Releases the shared sprite-billboard manager state including emitter slots at [this+0x10] queued templates at [this+0x18] and owned resource handles or containers before zeroing the manager pointers again.,ghidra + rizin + llvm-objdump
0x00556770,420,sprite_billboard_manager_init_pools,bootstrap,thiscall,inferred,ghidra-headless,4,Initializes the shared sprite-billboard manager when the shell first needs emitter templates. It allocates the long-lived emitter arrays and container objects at [this+0x10] [this+0x18] [this+0x8] [this+0x4] and [this+0x0] with a default capacity of 0xc350 slots unless the caller overrides it.,ghidra + rizin + llvm-objdump
0x00556920,814,sprite_billboard_init_emitter_template,bootstrap,thiscall,inferred,ghidra-headless,4,Initializes one sprite-billboard emitter template from optional source geometry color flags and atlas bounds. It copies source points or seeds a fallback anchor path stores owner position seeds default fade and timing fields across [this+0x94..0xd8] computes atlas uv steps from [this+0xe0..0xec] into [this+0x110..0x124] and optionally prewarms the spawn list through 0x00554ce0 when the caller flags request it.,ghidra + rizin + llvm-objdump
0x00556c50,143,sprite_billboard_manager_create_template_node,bootstrap,thiscall,inferred,ghidra-headless,4,Allocates or reuses one manager node then creates a fresh sprite-billboard template through 0x00556920 with flag 0x400 forced on. The helper stores the new template at [node+0x4] and queues the node into the manager container at [this+0x8].,ghidra + rizin + llvm-objdump
0x00556ce0,160,sprite_billboard_manager_clone_template_node,bootstrap,thiscall,inferred,ghidra-headless,4,Looks up one existing manager node and either returns its current template or clones a new sprite-billboard template from it through 0x00556920. On the first clone path it prewarms the source template through 0x00554ce0 and then queues the new node into the manager container at [this+0x4].,ghidra + rizin + llvm-objdump
0x00556e10,54,intrusive_queue_push_back,support,cdecl,inferred,ghidra-headless,4,Allocates one intrusive-queue node then appends the caller payload pointer to the tail of the container. The helper writes the payload at [node+0x00] links the previous tail through [node+0x04] and [tail+0x08] updates the head and tail slots when needed and increments the queued-node count at [this+0x0c].,ghidra + rizin + llvm-objdump
0x00556ef0,6,intrusive_queue_rewind_iterator,support,cdecl,inferred,ghidra-headless,4,Resets one intrusive-queue iterator by copying the container head pointer at [this+0x00] into the current-iterator slot at [this+0x04]. The helper is reused broadly across shell presentation and gameplay container walkers before repeated next-node calls.,ghidra + rizin + llvm-objdump
0x00556f00,19,intrusive_queue_next_iterator_node,support,cdecl,inferred,ghidra-headless,4,Returns the current intrusive-queue iterator node from [this+0x04] then advances the iterator to the linked next pointer at [node+0x08]. When the iterator is exhausted it returns null without mutating any payload state.,ghidra + rizin + llvm-objdump
0x00556f90,13,intrusive_queue_peek_tail_payload,support,cdecl,inferred,ghidra-headless,4,Returns the payload pointer stored in the current tail node at [this+0x08]. When the container is empty it returns null without mutating the queue state.,ghidra + rizin + llvm-objdump
0x00557010,159,intrusive_queue_clear_owned_nodes,support,cdecl,inferred,ghidra-headless,3,Specialized intrusive-queue clear path for containers with an auxiliary owner or context pointer at [this+0x14]. It iterates the owned node chain through the queue iterator helpers releases nested payload state unlinks each node and decrements the queue count before returning to the outer container clear helper.,ghidra + rizin + llvm-objdump
0x005570b0,80,intrusive_queue_clear_and_release,support,cdecl,inferred,ghidra-headless,4,Clears and releases every node in one intrusive queue container. When [this+0x14] is present it routes through intrusive_queue_clear_owned_nodes; otherwise it walks the linked nodes directly releases them zeroes the head iterator and tail slots and resets the queued-node count at [this+0x0c].,ghidra + rizin + llvm-objdump
0x00559520,166,surface_init_rgba_pixel_buffer,support,thiscall,inferred,ghidra-headless,3,Initializes or refreshes a small 0xec-byte RGBA pixel-buffer object from caller-supplied image data and dimensions. On first use it allocates the backing object through 0x0053b070 stores width and height at [this+0xa2] and [this+0xa6] seeds the inner surface through 0x00543980 and 0x00541970 then copies width*height*4 bytes from the source buffer before finalizing through 0x005438d0. Current callers use it from the PaintTerrain preview path and the Multiplayer.win map-preview branch.,ghidra + rizin + llvm-objdump + strings
0x005595d0,1632,shell_child_control_service_presentation_and_overlay_pass,shell,thiscall,inferred,objdump + runtime probe correlation,4,"Services one registered shell child-control beneath the object walker `shell_service_one_object_child_queue_and_deferred_state` `0x0053fda0`. The helper is first gated by `0x00558670`, which checks child flags `[this+0x68/+0x6a]`, parent pointer `[this+0x86]`, and shell controller byte `[0x006d4024+0x57]`. Once admitted, the body fans out by style field `[this+0xb0]` and spends most of its work in presentation helpers including `0x54f710`, `0x54f9f0`, `0x54fdd0`, `0x53de00`, and `0x552560`, using child-local geometry floats and the owning window pointer at `[this+0x86]` to emit overlay or control visuals. Current live hook probes on the frozen mode-4 auto-load path show the early `LoadScreen.win` children all point back to the same parent through `[child+0x86]`, typically carry `flag_68 = 0x03` and `flag_6a = 0x03`, and return `4`, while later siblings with `flag_68 = 0x00` return `0`; in all traced cases `0x006cec78` stays `0`, so this now reads as a presentation-side child service owner rather than the missing startup-runtime promotion lane.","objdump + runtime probe correlation + child-service gating correlation"
0x00565110,600,shell_rebuild_layout_state_and_optional_texture_report,shell,thiscall,inferred,ghidra-headless,3,Rebuilds the active shell layout-state branch when the current mode requires a deeper reset and optionally publishes the texture budget report through 0x00527650. The routine checks the current layout mode through 0x00545e00 tears down and recreates layout-state services through 0x0055dd80 and 0x0055e2b0 optionally notifies global shell services and when the caller flag is set emits the report then commits one layout refresh step through 0x00545d60.,ghidra + rizin + llvm-objdump + strings
0x0058bc90,23,multiplayer_gamespy_route_set_extended_payload_callback,shell,thiscall,inferred,objdump,3,"Tiny callback-slot helper for one GameSpy-style route object. It stores the caller callback pointer in `[route+0xa0]`, or in the default route singleton at `0x00629948` when `ecx` is null. The current grounded transport-side caller is multiplayer_transport_try_connect_status_route, which patches the status route's validated extended-payload callback slot to `0x597330` after route construction.",objdump
0x0058c9b0,404,multiplayer_gamespy_route_construct_and_seed_callback_vector,shell,thiscall,inferred,objdump,3,"Constructs or replaces one 0x108-byte GameSpy-style route object and seeds its callback vector. The helper allocates the route object when the caller owner slot is non-null, copies two caller strings into the local route buffers at `+0x04` and `+0x44`, stores the supplied callback table across `[route+0x88]` through `[route+0x9c]`, records the owner context at `[route+0x104]`, initializes the route cookie state and recent-cookie ring, and explicitly zeroes the secondary callback slots `[route+0xa0]`, `[route+0xa4]`, and `[route+0xd4]` before any later patch-up. Current grounded callers are multiplayer_transport_try_connect_status_route and multiplayer_transport_try_connect_live_route through the wrapper at `0x58cc40` or the constructor directly.","objdump"
0x0058d170,40,multiplayer_gamespy_server_descriptor_query_string_property_or_fallback,shell,cdecl,inferred,objdump,3,"Looks up one string property on a compact GameSpy-style server or route descriptor and falls back to the caller default string when the property is missing. It probes the descriptor-owned key store at `[this+0x18]` through `0x58f9c0`; on success it returns the matched value pointer at `[entry+0x04]`, and on failure it returns the fallback string from the stack. Current grounded callers use keys such as `hostname` and `gamever` when formatting route and selector status text.","objdump + caller inspection + strings"
0x0058d5b0,112,multiplayer_gamespy_server_descriptor_alloc_primary_endpoint_record,shell,cdecl,inferred,objdump,3,"Allocates one 0x24-byte compact server-descriptor record and seeds its primary endpoint fields from the caller tuple. It allocates the descriptor body through `tracked_heap_alloc_with_header`, allocates the owned property-store block at `[entry+0x18]` through `0x58f840`, writes the primary IPv4 dword to `[entry+0x00]`, writes the raw primary port word to `[entry+0x04]`, and zero-initializes state byte `[entry+0x14]`, flag byte `[entry+0x15]`, both endpoint-extension fields, and the age or timestamp lanes at `[entry+0x1c]` and `[entry+0x20]`. Current grounded caller is the primary-endpoint table seed path around `0x590dc0`.","objdump + caller inspection + descriptor-allocation correlation"
0x0058d1f0,3,multiplayer_gamespy_server_descriptor_query_primary_ipv4_raw,shell,cdecl,inferred,objdump,3,"Returns the descriptor's primary endpoint IPv4 dword from `[this+0x00]` without byte-order conversion. Current grounded consumers pair it with the raw primary port getter `0x58d210` as the compact identity key in `0x5903a0`, and pair it with the host-order port getter `0x58d200` when building route-binding payloads and compatibility checks.","objdump + caller inspection + WSOCK32 byte-order correlation"
0x0058d200,13,multiplayer_gamespy_server_descriptor_query_primary_port_host_order,shell,cdecl,inferred,objdump,3,"Returns the descriptor's primary endpoint port from `[this+0x04]` after converting the stored raw word through the imported `ntohs` shim at `0x5b31fe`. Current grounded callers use this host-order port in route-binding payload formatting and compatibility checks when no secondary endpoint flag is present.","objdump + caller inspection + WSOCK32 ntohs correlation"
0x0058d210,5,multiplayer_gamespy_server_descriptor_query_primary_port_raw,shell,cdecl,inferred,objdump,3,"Returns the descriptor's primary endpoint port word from `[this+0x04]` without byte-order conversion. Current grounded consumer `0x5903a0` pairs it with raw primary IPv4 `0x58d1f0` as the compact lookup key in the descriptor collection.","objdump + caller inspection + raw-key correlation"
0x0058d1c0,9,multiplayer_gamespy_server_descriptor_query_state_flag_bit0,shell,cdecl,inferred,objdump,3,"Returns state bit `0x1` from descriptor byte `[this+0x14]`. Current evidence now bounds this bit against two owners rather than one: queue service can promote pending field-cache state `0x4` into ready bit `0x1`, and the compact descriptor decode helper `0x58ff60` also ORs in bit `0x1` after the inline keyed-property vector path gated by source header bit `0x40` completes. Current grounded caller `0x595a6d` uses it to skip reinsertion into the field-cache family.","objdump + caller inspection + queue-state correlation + compact-decode correlation"
0x0058d1d0,9,multiplayer_gamespy_server_descriptor_query_state_flag_bit1,shell,cdecl,inferred,objdump,3,"Returns state bit `0x2` from descriptor byte `[this+0x14]`. Current evidence now bounds this bit against two owners too: queue service can promote pending `gsi_am_rating` descriptor state `0x8` into ready bit `0x2`, and the compact descriptor decode helper `0x58ff60` also ORs in bit `0x2` after the signed trailing string-pair tail runs to completion. Current grounded callers in the `gsi_am_rating` route branch use bit `0x2` as the split between immediate transition handling and reinsertion into the queued-descriptor family.","objdump + caller inspection + am-rating-branch correlation + queue-state correlation + compact-decode correlation"
0x0058d220,9,multiplayer_gamespy_server_descriptor_has_secondary_endpoint_flag,shell,cdecl,inferred,objdump,3,"Returns bit `0x2` from descriptor flag byte `[this+0x15]`. Current grounded callers use it to decide whether the descriptor exposes a secondary endpoint tuple at `[this+0x08]/[this+0x0c]` and therefore whether route-binding payload and compatibility checks should use the secondary port getter `0x58d250` instead of the primary port getter `0x58d200`.","objdump + caller inspection + secondary-endpoint correlation"
0x0058d230,9,multiplayer_gamespy_server_descriptor_query_flag_byte15_bit0,shell,cdecl,inferred,objdump,3,"Returns source-side header bit `0x1` from descriptor flag byte `[this+0x15]`. Current evidence now bounds this bit more tightly than before: it is not generated by queue service, is explicitly set during the raw primary-endpoint seed refresh around `0x590dc0` together with bit `0x10` before insertion into `[transport+0x18bc]`, and is also preserved by the compact descriptor decode path at `0x58ff60`. The strongest current read is therefore one primary-endpoint-seed or endpoint-only source marker: grounded transport callers still only use it in the `gsi_am_rating` branch, where clear routes a richer descriptor through direct primary-endpoint handling at `[transport+0x18bc]` via `0x00591330`, while set routes the descriptor through the queued-descriptor family at `[transport+0x1e7c]` via `0x005a09a0` and later suppresses the direct `0x595dc0` transition even after ready bit `0x2` is present. Current evidence is strong enough to reject a queue-generated meaning and to treat this as the source-side marker for descriptors that still need later queue-backed enrichment before direct transition.","objdump + caller inspection + am-rating-branch correlation + endpoint-table correlation + queue-state correlation + compact-decode correlation + transition-suppression correlation + raw-endpoint-seed correlation"
0x0058d240,4,multiplayer_gamespy_server_descriptor_query_secondary_ipv4_raw,shell,cdecl,inferred,objdump,3,"Returns the descriptor's secondary endpoint IPv4 dword from `[this+0x08]` without byte-order conversion. Current grounded callers only use it when `multiplayer_gamespy_server_descriptor_has_secondary_endpoint_flag` reports bit `0x2` set in `[this+0x15]`, which makes this the current strongest match for an optional secondary address tuple rather than another scalar field.","objdump + caller inspection + secondary-endpoint correlation"
0x0058d250,13,multiplayer_gamespy_server_descriptor_query_secondary_port_host_order,shell,cdecl,inferred,objdump,3,"Returns the descriptor's secondary endpoint port from `[this+0x0c]` after converting the stored raw word through the imported `ntohs` shim at `0x5b31fe`. Current grounded callers only use it when flag bit `0x2` in descriptor byte `[this+0x15]` is set, and then compare it against bound-route word `[binding->route+0x30]` in the route-binding compatibility gate.","objdump + caller inspection + WSOCK32 ntohs correlation + secondary-endpoint correlation"
0x0058d260,3,multiplayer_gamespy_server_descriptor_store_intrusive_next_link,shell,cdecl,inferred,objdump,2,"Stores one intrusive next-descriptor link into field `[this+0x20]`. Current grounded caller `0x590410` uses it to prepend one descriptor onto the transport-owned primary-endpoint list headed at `[table+0x5bc]`.","objdump + caller inspection + descriptor-list correlation"
0x0058d270,3,multiplayer_gamespy_server_descriptor_query_intrusive_next_link,shell,cdecl,inferred,objdump,2,"Returns intrusive next-descriptor link field `[this+0x20]`. Current grounded caller `0x590490` uses it to walk and release the transport-owned primary-endpoint list headed at `[table+0x5bc]`.","objdump + caller inspection + descriptor-list correlation"
0x0058d630,3,multiplayer_gamespy_server_descriptor_store_flag_byte15,shell,cdecl,inferred,objdump,2,"Stores one source-side compact header flag byte into descriptor field `[this+0x15]`. Current grounded callers are the compact descriptor decode helper `0x58ff60`, which copies the source header byte verbatim through this setter, and the raw primary-endpoint seed path `0x590dc0`, which stamps literal `0x11` into the same field for seeded descriptors.","objdump + caller inspection + compact-header correlation"
0x0058d640,13,multiplayer_gamespy_server_descriptor_store_secondary_endpoint_tuple,shell,cdecl,inferred,objdump,3,"Stores one secondary endpoint tuple into descriptor fields `[this+0x08]/[this+0x0c]`. The caller supplies the secondary IPv4 dword in `edx` and the secondary port word on the stack. Current grounded caller is the compact descriptor decode helper `0x58ff60`, which reaches this setter after header bit `0x02` selects an inline secondary IPv4 dword and header bit `0x20` either supplies the paired secondary port word or falls back to the owner default port at `[caller+0x498]`.","objdump + caller inspection + compact-header correlation"
0x0058d650,4,multiplayer_gamespy_server_descriptor_store_auxiliary_inline_dword10,shell,cdecl,inferred,objdump,2,"Stores one inline auxiliary dword into descriptor field `[this+0x10]`. Current grounded caller is the compact descriptor decode helper `0x58ff60`, which reaches this setter only when source header bit `0x08` is present. A local xref scan across the multiplayer descriptor family now makes the negative result tighter too: no dedicated semantic reader has been recovered yet. Current evidence only shows the field being preserved by later descriptor-record copy or callback marshaling helpers around `0x591410`, `0x591480`, and `0x591510`, not branched on or formatted through a dedicated accessor. So the field ownership and header-bit gate are explicit, while the higher-level meaning remains open.","objdump + caller inspection + compact-header correlation + local-xref scan + descriptor-copy correlation"
0x0058d660,3,multiplayer_gamespy_server_descriptor_store_state_byte14,shell,cdecl,inferred,objdump,2,"Stores one state byte into descriptor field `[this+0x14]`. Current grounded callers include queue-service paths that promote pending descriptor tags into ready bits and the compact decode helper `0x58ff60`, which ORs in bit `0x1` after the inline keyed-property vector path and bit `0x2` after the signed trailing string-pair tail.","objdump + caller inspection + queue-state correlation + compact-decode correlation"
0x0058d670,3,multiplayer_gamespy_server_descriptor_query_state_byte14,shell,cdecl,inferred,objdump,2,"Returns descriptor state byte `[this+0x14]` unchanged. Current grounded caller is the compact decode helper `0x58ff60`, which reads the existing state before OR-ing in bits `0x1` or `0x2` and writing the result back through `0x58d660`.","objdump + caller inspection + compact-decode correlation"
0x0058d5a0,3,multiplayer_gamespy_server_descriptor_query_special_numeric_scalar_dword1c,shell,cdecl,inferred,objdump,2,"Returns special numeric scalar field `[this+0x1c]` unchanged. Current grounded callers are the special-key fallback path inside `multiplayer_gamespy_server_descriptor_query_numeric_property_or_special_ping_yid_fallback` `0x58d6d0`, where both `queryid` and `ping` currently collapse onto this field, and the multiplayer session-event capacity-entry updater around `0x469251`, which copies the same scalar into entry field `[entry+0x118]` alongside `numplayers`, `maxplayers`, and the primary-endpoint text.","objdump + caller inspection + strings"
0x0058d6d0,66,multiplayer_gamespy_server_descriptor_query_numeric_property_or_special_ping_yid_fallback,shell,cdecl,inferred,objdump,3,"Looks up one numeric property on a compact GameSpy-style server or route descriptor and falls back to the caller default integer when the property is missing. For ordinary keys it probes the descriptor string-key store through `multiplayer_gamespy_server_descriptor_query_string_property_or_fallback` and parses the resulting decimal text through `0x5a1ea5`. It also has two fixed-key special cases for `queryid` and `ping`, both currently routed through `multiplayer_gamespy_server_descriptor_query_special_numeric_scalar_dword1c` `0x58d5a0` instead of the generic property store. Current grounded callers use it for fields such as `numplayers`, `maxplayers`, `maxwaiting`, `numservers`, `numwaiting`, and `gsi_am_rating`.","objdump + caller inspection + strings + rdata-key correlation"
0x0058d7a0,55,multiplayer_transport_set_local_name,shell,thiscall,inferred,ghidra-headless,3,Updates the local identity string stored in the session-event transport object. When the transport is already configured through [this+0x44] and the incoming name pointer is non-null and non-empty it copies up to 0x40 bytes into [this+0x04] clears byte [this+0x43] and then forwards the same name into the lower transport update path through 0x0058f330.,ghidra + rizin + llvm-objdump
0x0058d830,40,multiplayer_transport_disconnect,shell,thiscall,inferred,ghidra-headless,3,Disconnects the session-event transport object from its current live route. The helper flips the internal active state through 0x005965d0 and 0x005961b0 calls the shared teardown block at 0x0058d810 and finally clears byte [this+0x60] and the copied local name at [this+0xaf4].,ghidra + rizin + llvm-objdump
0x0058d860,59,multiplayer_transport_release_worker_and_reset_runtime_state,shell,cdecl,inferred,rizin,3,Small runtime-reset wrapper for the outer session-event transport object. When the owned worker pointer at [this] is present it first tears that worker down through multiplayer_transport_worker_shutdown_gracefully then clears the worker pointer the configured flag byte at [this+0x04] the text-stream owner slots at [this+0x44] and [this+0x48] reruns 0x00593370 and the shared reset block at 0x0058d810 and finally clears the live route and deferred-runtime fields at [this+0x180c] [this+0x1810] and [this+0x1edc].,rizin + llvm-objdump
0x0058d8d0,143,multiplayer_transport_service_frame,shell,cdecl,inferred,objdump + caller xrefs,3,"Recurring service pump for the outer session-event transport object. When the transport is configured through `[this+0x44]` or `[this+0x48]` it first services one worker step through multiplayer_transport_service_worker_once on the owned worker at `[this]`; if deferred reset is armed at `[this+0x1edc]` and the outstanding-work count has reached zero it falls straight into the common reset path at `0x0058de50`. Otherwise it conditionally emits the keepalive text at `0x005e1c24` after roughly `0x493e0` ms of inactivity, services the deeper selector or route helpers through `0x00596210` and `0x00597380`, finalizes deferred reset when the work count at `[this+0x1808]` reaches zero, and finishes by forwarding the caller selector through `0x00592800`. Current grounded callers reach it through multiplayer_transport_flush_and_maybe_shutdown and the immediate-drain submission paths, which places it at the center of the shell-owned multiplayer transport cadence.","objdump + caller xrefs + strings"
0x005a152e,176,math_abs_double_with_crt_special_case_handling,support,cdecl,inferred,objdump + arithmetic inspection + caller xrefs,4,"Returns the absolute value of one caller-supplied `double`. On ordinary finite inputs the helper simply clears the sign bit of the high dword before returning; on NaN or infinity it re-enters the surrounding CRT status machinery before returning either the preserved or sign-flipped value. Current grounded callers include the route-entry search family at `0x0049d380` and `0x0049c900`, where it is used as the absolute-value side of the span and angle quality gates.","objdump + arithmetic inspection + caller xrefs + CRT special-case correlation"
0x0058c340,144,multiplayer_gamespy_decode_triplet_control_payload,shell,cdecl,inferred,objdump,3,"Decodes one length-coded three-part GameSpy control payload and re-emits it through the shared packet-field builder at `0x58c0c0`. The helper reads up to three bounded variable-length slices from the caller payload, then packages them as field classes `0`, `1`, and `2`. The current grounded caller is subtype `0` of multiplayer_gamespy_route_dispatch_inbound_packet's `0xfe 0xfd` switch.",objdump
0x0058c5c0,60,multiplayer_gamespy_build_backslash_query_response,shell,cdecl,inferred,objdump + strings,3,"Builds one backslash-delimited GameSpy query reply into the caller buffer. It seeds the leading `\\`, emits three callback-driven field groups through `0x58c3e0` for selectors `0`, `1`, and `2`, appends the fixed terminator token at `0x005e1b6c`, and leaves the result ready for immediate send. The current grounded caller is the backslash-packet branch inside multiplayer_gamespy_route_dispatch_inbound_packet.",objdump + strings
0x0058c600,142,multiplayer_gamespy_dispatch_natneg_or_raw_callback,shell,cdecl,inferred,objdump + strings,3,"Dispatches one validated extended GameSpy payload into route-owner callbacks. When the payload begins with the six-byte magic `fd fc 1e 66 6a b2` it treats bytes `[payload+6..+9]` as a little-endian value, materializes a small wrapper object through `0x5b31f8`, and forwards it through the route callback at `[route+0xa0]`; otherwise it falls back to the raw payload callback at `[route+0xa4]`. Both slots are optional: the helper tests them for null and returns without dispatch when the selected callback is absent. The current grounded caller is subtype `6` of multiplayer_gamespy_route_dispatch_inbound_packet.",objdump + strings
0x0058c690,58,multiplayer_gamespy_route_dedupe_recent_cookie,shell,cdecl,inferred,objdump,3,Maintains a small ring of the last ten 32-bit route cookies or packet ids under `[route+0xd8]` and `[route+0x100]`. It returns `1` when the caller id is already present and otherwise inserts it into the rotating slot table and returns `0`. The current grounded caller is subtype `6` of multiplayer_gamespy_route_dispatch_inbound_packet before dispatching the validated extended payload.,objdump
0x0058c6d0,606,multiplayer_gamespy_route_dispatch_inbound_packet,shell,cdecl,inferred,objdump + strings,3,"Main inbound packet parser for one GameSpy-style route object. It sends semicolon-prefixed lines through the route callback at `[route+0xd4]`, but only when that slot is non-null; otherwise the semicolon branch returns without additional work. It treats backslash-prefixed packets as query requests and answers them by building a reply through multiplayer_gamespy_build_backslash_query_response, and otherwise requires at least seven bytes plus the `0xfe 0xfd` header before entering a subtype switch on byte `2`. The grounded subtype branches are now tighter: subtype `0` decodes a three-slice control payload through multiplayer_gamespy_decode_triplet_control_payload; subtype `1` copies one bounded NUL-terminated string through `0x58c030`; subtype `2` copies up to `0x20` raw bytes into the local packet builder as field class `5`; subtype `4` validates the four-byte route cookie at `[route+0x84]`, clears `[route+0xb0]`, and dispatches the remaining payload through the validated route callback at `[route+0x9c]`, which the transport-owned status and live routes seed to `0x5972c0`; subtype `6` validates the same cookie, emits a field-class `7` record with the next dword, dedupes that dword through multiplayer_gamespy_route_dedupe_recent_cookie, and then dispatches the trailing payload through multiplayer_gamespy_dispatch_natneg_or_raw_callback. In the currently grounded transport-owned status route, that extended callback layer is patched after construction so `[route+0xa0]` points at `0x597330`; the raw fallback slot `[route+0xa4]` remains unresolved and currently no-ops when null. Subtypes `3` and `5` currently fall through without additional work. The current grounded caller is multiplayer_gamespy_route_drain_inbound_packets.","objdump + strings"
0x0058cfd0,107,multiplayer_gamespy_route_release_and_free,shell,thiscall,inferred,objdump,3,"Common teardown helper for one GameSpy-style route object. When the route still looks live through `[route+0xb4]` it first sends the mode-`2` control frame through `0x58cd70`, closes the current route handle at `[route]` when needed through `0x58bc4e`, resets the handle and last-send timestamp fields, and finally frees the route object through `0x58f3c0` when it is not the default singleton at `0x00629840`. Current grounded callers are multiplayer_transport_release_status_route, multiplayer_transport_release_live_route, and the status-route reconnect path.","objdump"
0x0058ccd0,107,multiplayer_gamespy_route_drain_inbound_packets,shell,cdecl,inferred,objdump + strings,3,"Inbound packet drain for one GameSpy-style route object. While the route receive queue remains non-empty it pulls one datagram through `0x58bc7e`, routes the payload into `multiplayer_gamespy_route_dispatch_inbound_packet`, and then repeats. The parser accepts semicolon-prefixed lines through the route callback at `[route+0xd4]`, backslash-delimited key bundles, and `0xfe 0xfd` GameSpy control packets. The current grounded caller is the lower route-service helper at `0x58d040`.","objdump + strings"
0x0058cee0,164,multiplayer_gamespy_route_service_retry_and_keepalive_timers,shell,cdecl,inferred,objdump + strings,3,"Timer and retry side of one GameSpy-style route object. It checks the active route handle and challenge or retry fields around `[route+0xa8]`, `[route+0xac]`, and `[route+0xb0]`, emits outbound control traffic through the local send helper when the `master.gamespy.com` challenge or state flow stalls, raises the `No challenge value was received from the master server.` callback through `[route+0x9c]` after repeated failures, and periodically refreshes the auxiliary timestamp through `0x58c950`. The current grounded caller is the lower route-service helper at `0x58d040`, which makes this the timer or retry half of the recurring GameSpy route cadence.","objdump + strings"
0x0058d040,37,multiplayer_gamespy_route_service_frame,shell,cdecl,inferred,objdump + strings,3,"Low-level recurring service step for one GameSpy-style route object. When the route handle state at `[route+0xb4]` is live it first services retry and keepalive timers through `multiplayer_gamespy_route_service_retry_and_keepalive_timers` and then drains inbound packets through `multiplayer_gamespy_route_drain_inbound_packets`. Current grounded callers are `multiplayer_transport_service_status_and_live_routes`, which uses the same helper for both the auxiliary status route at `[transport+0xaf0]` and the current live route at `[transport+0x1ecc]`.","objdump + strings"
0x0058d960,7,multiplayer_transport_select_status_route,shell,thiscall,inferred,ghidra-headless,3,Thin route-selector wrapper for the session-event transport. It forwards the requested small route id in EDX into multiplayer_transport_set_mode_q_flag which updates [this+0x560] formats the underlying `MODE %s -q` or `MODE %s +q` command text and reconfigures the transport-side callback plumbing.,ghidra + rizin + llvm-objdump
0x0058d970,89,multiplayer_transport_subscribe_field_callback_set,shell,thiscall,inferred,ghidra-headless,3,"Registers one field-subscription callback set on the session-event transport. When active byte `[this+0x60]` is set it stores the caller callback pair into `[this+0x176c]` and `[this+0x1770]`, then forwards the field-id list string plus callback and context into `multiplayer_transport_open_field_subscription_route_callback_table` `0x5962e0`; on failure it falls back through `multiplayer_transport_enqueue_field_snapshot_record` `0x592b50`. Current evidence now makes this the closest explicit lifecycle owner for the replay-band fields immediately below the still-unrecovered sidecar pointer at `[this+0x1778]`.","ghidra + rizin + llvm-objdump + local disassembly + field-subscription correlation"
0x0058d9e0,55,multiplayer_transport_send_selector_text,shell,thiscall,inferred,ghidra-headless,3,Sends one caller-supplied text pointer through a selector-specific transport slot. The helper looks up the selector entry from the handler table rooted at [this+0x390] and when both the text pointer and slot are valid forwards the string plus caller flag into the lower send helper at 0x0058e7e0 using the descriptor block at [this+0x80+selector*0x101].,ghidra + rizin + llvm-objdump
0x0058da60,75,multiplayer_transport_register_selector_callback,shell,thiscall,inferred,ghidra-headless,3,Registers or dispatches one selector callback against the transport slot table rooted at [this+0x390]. When the selected slot is absent it directly invokes the supplied callback with mode -1 and null payloads; otherwise it packages the caller context on the stack and walks the registered slot through 0x00594ac0 using helper 0x0058da20.,ghidra + rizin + llvm-objdump
0x0058db00,23,multiplayer_transport_request_status_pump,shell,thiscall,inferred,ghidra-headless,3,Marks the session-event transport status path dirty by setting [this+0xb44] to 1 and then calling multiplayer_transport_service_status_pump when the transport is active.,ghidra + rizin + llvm-objdump
0x0058db20,53,multiplayer_transport_clear_status_pump,shell,thiscall,inferred,ghidra-headless,3,Clears the session-event transport status-pump flag at [this+0xb44] then reruns multiplayer_transport_service_status_pump. When the transport still owns the auxiliary object at [this+0xaf0] it follows up with either 0x00597370 or 0x00597350 depending on whether selector slot [this+0x398] is present.,ghidra + rizin + llvm-objdump
0x0058db60,5,multiplayer_transport_force_status_flush,shell,thiscall,inferred,ghidra-headless,3,Tail-call wrapper into 0x00597370 for the active session-event transport object. The shell flush path uses it immediately before multiplayer_transport_flush_and_maybe_shutdown.,ghidra + rizin + llvm-objdump
0x0058dc30,22,multiplayer_transport_is_route_mode_active_nonterminal,shell,cdecl,inferred,ghidra-headless,3,Tiny predicate over the route-mode field at [this+0x18b8]. It returns false when the mode is zero or terminal mode `5` and true for the other active route modes. Current grounded callers use it to decide whether route callbacks can run inline or whether route work must be re-enqueued.,ghidra + rizin + llvm-objdump
0x0058dc50,576,multiplayer_transport_construct_and_zero_runtime_fields,shell,thiscall,inferred,objdump + local disassembly,3,"Constructor or bring-up owner for the session-event transport object. It allocates or adopts the `0x1ee4`-byte transport body, bulk-zeroes the full runtime field band through `rep stosd` with count `0x7b9`, and then seeds the neighboring replay-band and transport-runtime families through their dedicated helpers and inline stores. Current evidence now makes this row important to the unresolved capacity-sidecar edge too: the constructor explicitly zero-initializes `[this+0x1778]`, later seeds neighbors such as `[this+0x177c]`, `[this+0x17fc]`, and the surrounding route-callback-table fields, and still never writes a nonzero value into `[this+0x1778]`. That proves the sidecar is not seeded by ordinary local construction inside `RT3.exe`.","objdump + local disassembly + constructor-layout correlation + replay-band negative-writer correlation"
0x0058de90,95,multiplayer_transport_shutdown,shell,thiscall,inferred,ghidra-headless,3,Shuts down the session-event transport object and either marks deferred-close state or tears the object down immediately. It preserves [this+0x178c] across the common shutdown helper at 0x0058de50 disconnects active routes through multiplayer_transport_disconnect and when no outstanding work remains drops into the reset path at 0x0058d8a0; otherwise it latches deferred-close flag [this+0x1ee0].,ghidra + rizin + llvm-objdump
0x0058def0,40,multiplayer_transport_flush_and_maybe_shutdown,shell,thiscall,inferred,ghidra-headless,3,Flushes the transport state through 0x0058d8d0 with selector -1 and when deferred-close flag [this+0x1ee0] is set and the outstanding-work count at [this+0x1808] has reached zero immediately falls into multiplayer_transport_shutdown.,ghidra + rizin + llvm-objdump
0x0058d720,35,multiplayer_transport_context_id_is_absent_from_queued_and_active_collections,shell,cdecl,inferred,objdump + caller inspection,2,"Small immediate-drain quiescence gate for one transport context id carried in `ESI`. It first checks the transient work-record collection at `[transport+0x1780]` through `multiplayer_transport_queued_work_collection_lacks_context_id` `0x593400`, then checks the active opcode-record collection at `[transport+0x17fc]` through `multiplayer_transport_active_opcode_record_collection_lacks_context_id` `0x592970`, and returns success only when both collections lack that same id. Current grounded callers are the immediate-drain tails in `multiplayer_transport_submit_text_record` `0x58df20`, the neighboring formatted selector-text publish root at `0x58dfb0`, and `multiplayer_transport_register_callback_table` `0x58e200`.","objdump + caller inspection + immediate-drain correlation + collection-quiescence correlation"
0x0058df20,131,multiplayer_transport_submit_text_record,shell,thiscall,inferred,ghidra-headless,3,"Submits one prepared text record through the session-event transport using a caller-supplied callback wrapper. The helper first seeds one shared immediate-drain context id through `multiplayer_transport_next_work_sequence` `0x5934c0`, then tries the text fastpath through `multiplayer_transport_try_submit_text_record_fastpath` `0x593d60`; when that fast path declines it packages the caller callback mode and payload into `0x593170` together with the same context id. When the caller requested immediate draining it services the transport queue through `0x58d8d0` and waits in `0x58d720` until that same id disappears from both queued work field `+0x0c` and active opcode-record field `+0x14`, then may fall into `multiplayer_transport_shutdown` when deferred close is armed.","ghidra + rizin + llvm-objdump"
0x0058e100,230,multiplayer_transport_publish_fixed_token_message,shell,thiscall,inferred,ghidra-headless,3,Publishes one fixed-token status message through selector `2` on the session-event transport. The helper requires the transport to be active and fully configured builds a formatted status line from the caller token plus internal fields such as [this+0x282] and [this+0x54] sends that line through multiplayer_transport_send_selector_text sets [this+0xb44] to 1 reruns the status pump and when appropriate nudges the downstream mode helper at 0x00595650 or the auxiliary object paths 0x00597350 and 0x00597370.,ghidra + rizin + llvm-objdump + strings
0x0058e200,211,multiplayer_transport_register_callback_table,shell,thiscall,inferred,objdump + caller inspection,3,"Registers or refreshes the session-event transport callback table and descriptor block. The helper first seeds one shared immediate-drain context id through `multiplayer_transport_next_work_sequence` `0x5934c0`. When the transport is not yet fully configured it copies the local name into `[this+0x04]`, stores two caller-supplied follow-on callback fields at `[this+0x4c]` and `[this+0x5c]`, sets `[this+0x44]` active, and forwards the descriptor block plus caller metadata into `multiplayer_transport_attach_callback_table_descriptor` `0x593650` with that same context id. It then routes the resolved table through `multiplayer_transport_dispatch_callback_table_binding` `0x592a40`, and when immediate draining is requested it pumps `0x58d8d0` until `0x58d720` confirms that same id has disappeared from both the queued work and active opcode collections before honoring deferred-close state.","objdump + caller inspection + callback-binding correlation"
0x0058e2e0,38,multiplayer_transport_reset_and_maybe_shutdown,shell,thiscall,inferred,ghidra-headless,3,Resets the common transport state through 0x0058de50 and when deferred-close flag [this+0x1ee0] is armed and the outstanding-work count at [this+0x1808] has reached zero immediately falls into multiplayer_transport_shutdown.,ghidra + rizin + llvm-objdump
0x0058e370,33,multiplayer_transport_is_request_pending,shell,cdecl,inferred,ghidra-headless,3,Returns true while the caller transport request still appears in either the queued request collection at [this+0x550] or the secondary active-work collection checked through 0x0059c540. Immediate-drain callers use it as the loop predicate after pumping queued text and sleeping for 10 ms.,ghidra + rizin + llvm-objdump
0x0058e3f0,137,multiplayer_transport_drain_request_text_queue,shell,cdecl,inferred,ghidra-headless,3,Immediate-drain helper for one transport request. When request kind [req+0x20] is `1` it walks queued transport text lines under [this+0x1c] republishes them through 0x0059b790 and notifies the small observer table through 0x0058e310 until the queue is empty. When request kind `2` drains it also publishes `Disconnected`. Both paths refresh timeout state through 0x00598030 and finish by forwarding the request into 0x0059c470.,ghidra + rizin + llvm-objdump + strings
0x0058e480,105,multiplayer_transport_worker_shutdown_gracefully,shell,cdecl,inferred,rizin,3,"Graceful shutdown wrapper for one multiplayer transport worker. If the callback object at `[this+0x538]` and its owner slot `[this+0x544]` are present it first emits a final owner notification through the callback vtable using fallback text at `0x005c87a8`. When the owned text-stream socket at `[this+0x1c]` is still live it appends `QUIT :Later!` through multiplayer_transport_text_stream_append_crlf_line and services one I/O step through multiplayer_transport_text_stream_service_io before destroying the registered-name store at `[this+0x548]`, the pending-template dispatch store at `[this+0x54c]`, the text-stream object at `[this+0x1c]`, and finally the worker backing block itself.","rizin + llvm-objdump + strings"
0x0058e4f0,12,multiplayer_transport_service_worker_once,shell,cdecl,inferred,objdump,3,"Very small bridge from the outer session-event transport object into its owned worker. It forwards the worker pointer in `[this]` into multiplayer_transport_drain_request_text_queue with a null request pointer, making it the one-step worker service helper used by the recurring transport pump.",objdump
0x0058e650,80,multiplayer_transport_sanitize_identifier,shell,cdecl,inferred,ghidra-headless,4,Normalizes a caller-supplied identifier string into the destination buffer by replacing leading punctuation and any later disallowed characters with underscores while preserving acceptable bytes from the source. Current grounded callers use it for the randomized `RT3Player%d` retry name and for locally submitted session-event text records.,ghidra + rizin + llvm-objdump + strings
0x0058e6b0,98,multiplayer_transport_set_mode_q_flag,shell,thiscall,inferred,ghidra-headless,4,Updates the transport mode-q flag tracked at [this+0x560]. When the requested value changes it formats either `MODE %s -q` or `MODE %s +q` against the active name buffer at [this+0x36c] stores the new flag and for mode `0` refreshes the downstream callback plumbing through 0x0059e070 and 0x0059de00 using helper 0x0058e6a0.,ghidra + rizin + llvm-objdump + strings
0x0058e8c0,37,multiplayer_transport_publish_topic_status_line,shell,thiscall,inferred,ghidra-headless,3,Formats and publishes one `TOPIC %s :%s` status line through the active transport text buffer at [this+0x1c]. When the caller text is null it falls back to the shared empty sample at 0x005c87a8. Current grounded caller is multiplayer_transport_handle_names_query_response.,ghidra + rizin + llvm-objdump + strings
0x0058e8f0,56,multiplayer_transport_publish_mode_key_status_line,shell,thiscall,inferred,ghidra-headless,3,Formats and publishes one mode-key status line through the active transport text buffer at [this+0x1c]. Depending on the caller flag it emits either `MODE %s +k %s` or `MODE %s -k %s`. Current grounded caller is multiplayer_transport_handle_bound_route_request.,ghidra + rizin + llvm-objdump + strings
0x0058e930,53,multiplayer_transport_publish_mode_level_status_line,shell,thiscall,inferred,ghidra-headless,3,Formats and publishes one mode-level status line through the active transport text buffer at [this+0x1c]. Depending on whether the caller level value is nonzero it emits either `MODE %s +l %d` or `MODE %s -l`. Current grounded caller is multiplayer_transport_handle_names_query_response.,ghidra + rizin + llvm-objdump + strings
0x0058e970,36,multiplayer_transport_invoke_registered_name_query_callback,shell,cdecl,inferred,ghidra-headless,3,Small callback shim used by the registered-name fast path. It loads the caller callback object from the dispatch frame and invokes its entry method with success flag `1`; the queried sample string; and the collected callback-entry arrays produced by multiplayer_transport_collect_registered_name_callback_entries.,ghidra + rizin + llvm-objdump
0x0058e9a0,177,multiplayer_transport_submit_names_query_with_callback,shell,thiscall,inferred,ghidra-headless,3,Builds and submits one `NAMES %s` query against the active transport text buffer at [this+0x1c]. When the caller sample is already present it bypasses transport submission through multiplayer_transport_dispatch_registered_name_query_fastpath. Otherwise it validates the sample through multiplayer_transport_has_registered_name packages the request through multiplayer_transport_enqueue_names_query_record and when immediate draining is requested loops through multiplayer_transport_drain_request_text_queue system_sleep_milliseconds and multiplayer_transport_is_request_pending. Current grounded callers are multiplayer_transport_handle_bound_route_request and multiplayer_transport_handle_selector_text_route_request.,ghidra + rizin + llvm-objdump + strings
0x0058eb70,212,multiplayer_transport_append_getkey_command,shell,cdecl,inferred,rizin,3,Formats one `GETKEY %s %s 0 :` command into a temporary 0x200-byte stack buffer and appends it to the owned transport text stream through multiplayer_transport_text_stream_append_crlf_line. After the fixed header it walks the caller string-vector argument and appends each additional item separated by backslashes. Current grounded caller is the synchronous submit wrapper at 0x0058ec50.,rizin + llvm-objdump + strings
0x0058ec50,140,multiplayer_transport_submit_getkey_command_and_wait,shell,cdecl,inferred,rizin,3,Synchronous `GETKEY` submit wrapper for the multiplayer transport worker. It resolves the query name from the caller string or falls back to [this+0x36c] primes one transient request through 0x0058eb30 emits the command text through multiplayer_transport_append_getkey_command and then loops through multiplayer_transport_drain_request_text_queue system_sleep_milliseconds and multiplayer_transport_is_request_pending until the request completes.,rizin + llvm-objdump + strings
0x0058ece0,197,multiplayer_transport_append_setchankey_or_setckey_command,shell,cdecl,inferred,rizin,3,Formats either `SETCHANKEY %s :` or `SETCKEY %s %s :` into a temporary 0x200-byte stack buffer and appends the resulting line to the owned transport text stream through multiplayer_transport_text_stream_append_crlf_line. The two-token `SETCKEY` form is selected when the optional caller key string at arg_210h is present and non-empty; otherwise the helper emits the simpler channel-key form.,rizin + llvm-objdump + strings
0x0058edb0,367,multiplayer_transport_append_setchankey_pair_list_command,shell,cdecl,inferred,rizin,2,Builds one larger backslash-delimited channel-key payload and appends it to the owned transport text stream through multiplayer_transport_text_stream_append_crlf_line. The helper formats normalized `\\%s\\%s` pair fragments in a 0x200-byte stack buffer converts backslashes to forward slashes in one staging path handles wildcard samples through the `*` token at 0x005e1e1c and is the main text builder beneath the synchronous submit wrapper at 0x0058ef20.,rizin + llvm-objdump + strings
0x0058ef20,199,multiplayer_transport_submit_setchankey_pair_list_command_and_wait,shell,cdecl,inferred,rizin,2,Synchronous channel-key submit wrapper for the multiplayer transport worker. It primes one transient request through 0x0058eb30 emits the larger backslash-delimited key payload through multiplayer_transport_append_setchankey_pair_list_command dispatches the caller result path through 0x005983b0 or 0x005984c0 depending on the staged optional arguments and then loops through multiplayer_transport_drain_request_text_queue system_sleep_milliseconds and multiplayer_transport_is_request_pending until the request completes.,rizin + llvm-objdump + strings
0x0058eff0,78,multiplayer_transport_is_valid_nick_string,shell,cdecl,inferred,rizin,4,Validates one transport nick string. It rejects null or empty strings rejects a leading digit or `-` through 0x005a53f2 and then scans every remaining byte against the allowed nick-character table at 0x005e1c70. It returns 1 when the full string is acceptable and 0 otherwise.,rizin + llvm-objdump + strings
0x0058f040,90,multiplayer_transport_dispatch_or_release_callback_binding,shell,cdecl,inferred,rizin,3,Generic dispatcher for one optional transport callback-binding structure. When binding field [this+0x0c] is present it packages the caller mode from EDX together with binding fields [this+0x18] and [this+0x36c] into opcode 0x1a through 0x0059b790. Otherwise it clears [this+0x04] and if callback pointer [this+0x14] is installed invokes it directly with the owner cookie at [this+0x18] and a zero status value.,rizin + llvm-objdump + strings
0x0058f380,64,tracked_heap_alloc_with_header,support,cdecl,inferred,ghidra-headless,4,Allocates one caller-sized heap block through the shared allocator at 0x005a125d stores the payload size in a 4-byte header immediately before the returned pointer and updates the global allocation counters at 0x00dba4c8 through 0x00dba4d0. Callers treat the returned value as a payload pointer just past the size header.,rizin + llvm-objdump
0x0058f3c0,43,tracked_heap_free_with_header,support,cdecl,inferred,ghidra-headless,4,Releases one heap block previously returned by tracked_heap_alloc_with_header. It reads the stored payload size from the 4-byte header decrements the shared allocation counters at 0x00dba4c8 and 0x00dba4cc and frees the underlying base pointer through 0x005a1145.,rizin + llvm-objdump
0x0058f3f0,94,tracked_heap_resize_with_header,support,cdecl,inferred,ghidra-headless,4,Resizes one header-tracked heap block to a new payload size. Null plus nonzero size falls through to tracked_heap_alloc_with_header; nonnull plus zero size frees through tracked_heap_free_with_header; and the main path reallocates through 0x005a5922 while preserving and re-accounting the payload size tracked in the 4-byte header.,rizin + llvm-objdump
0x0058f460,8,system_sleep_milliseconds,support,cdecl,inferred,ghidra-headless,4,Tiny wrapper over `Sleep` that forwards the caller millisecond delay in `ecx`. Current grounded callers use it as the 10 ms backoff inside immediate transport-drain loops.,rizin + llvm-objdump
0x0058fb10,24,memory_query_bounded_nul_terminated_byte_span_length,support,cdecl,inferred,objdump,3,"Scans one caller-supplied byte span for the first NUL terminator and returns the terminating length in bytes. The helper walks forward from the caller base pointer in `ecx` until it either finds a zero byte and returns the consumed count, or exhausts the caller byte budget in `edx` and returns `-1`. Current grounded callers use it as the bounded string-length primitive under compact descriptor tail validation and decode helpers such as `0x58fe50`, `0x58fe90`, and `0x58ff60`.","objdump + caller inspection + bounded-string correlation"
0x0058fe20,44,multiplayer_gamespy_server_descriptor_query_minimum_fixed_compact_header_byte_count,shell,cdecl,inferred,objdump,3,"Computes the minimum fixed byte count required by one compact descriptor header before any variable-length property or string tails are considered. The helper starts from `5` bytes for the source header byte plus the always-present primary IPv4 dword, then adds `4` when header bit `0x02` carries a secondary IPv4 dword, adds `4` when bit `0x08` carries the auxiliary inline dword stored at `[descriptor+0x10]`, adds `2` when bit `0x10` carries an inline primary port word, and adds `2` when bit `0x20` carries an inline secondary port word. Current grounded caller `0x5907d0` uses this as the first fixed-shape precheck above the heavier compact payload validators `0x58fe90` and `0x58fe50`.","objdump + caller inspection + compact-header correlation"
0x0058fe50,56,multiplayer_gamespy_server_descriptor_validate_signed_string_pair_tail_shape,shell,cdecl,inferred,objdump,3,"Validates the variable-length trailing tail used when the compact descriptor source header carries signed bit `0x80`. The helper repeatedly scans one bounded NUL-terminated string through `memory_query_bounded_nul_terminated_byte_span_length` `0x58fb10`, advances twice per loop to cover an alternating string pair, and only succeeds when the remaining byte budget ends on one final empty-string terminator. Current grounded caller `0x5907d0` uses this as the signed-tail shape precheck above the heavier decode path `0x58ff60`.","objdump + caller inspection + compact-header correlation + bounded-string correlation"
0x0058fe90,135,multiplayer_gamespy_server_descriptor_validate_inline_keyed_property_vector_shape,shell,cdecl,inferred,objdump,3,"Validates the variable-length inline keyed-property vector used when compact descriptor source header bit `0x40` is present. It walks the owner descriptor schema at `[owner+0x08]` through `0x59e110/0x59e120` and checks that the caller payload can supply each declared property item in sequence: one-byte entries for descriptor type `1`, two-byte entries for descriptor type `2`, and either one-byte dictionary selectors or bounded inline strings prefixed by `0xff` for descriptor type `0`, with the inline string lengths verified through `memory_query_bounded_nul_terminated_byte_span_length` `0x58fb10`. Current grounded caller `0x5907d0` uses this as the `0x40`-vector shape precheck before `0x58ff60` decodes the same property vector into the descriptor store.","objdump + caller inspection + compact-header correlation + bounded-string correlation"
0x0058ff20,52,multiplayer_gamespy_server_descriptor_preparse_compact_primary_endpoint_tuple,shell,cdecl,inferred,objdump,3,"Pre-parses the compact descriptor payload just far enough to recover the primary endpoint key used by the keyed-upsert decode lane. When the payload is at least `5` bytes long it reads the header byte at offset `0`, always copies the primary IPv4 dword from payload offset `+1` into one caller out slot, and then either copies the inline primary port word from payload offset `+5` when header bit `0x10` is present or falls back to the owner-side default port at `[caller+0x498]` when that bit is clear. Current grounded callers are the larger compact decode owners `0x5907d0` and `0x590d00`. This is the strongest current proof that compact descriptors always carry the primary IPv4 dword and that header bit `0x10` only gates the inline primary port word.","objdump + caller inspection + compact-header correlation"
0x00590140,78,multiplayer_gamespy_server_descriptor_compare_numeric_property_or_special_scalar,shell,cdecl,inferred,objdump,3,"Comparator helper for descriptor-collection property sorting. It resolves the caller-selected property key from global scratch slot `0x00db8c6c+0x488`, queries that key on both candidate descriptors through `multiplayer_gamespy_server_descriptor_query_numeric_property_or_special_ping_yid_fallback` `0x58d6d0` with zero fallback, subtracts the two integer-like results, and optionally negates the sign according to the reverse-sort latch at `0x00db8c6c+0x48c`. Current grounded caller is the collection sorter `0x590310` in comparator mode `0`.","objdump + caller inspection + descriptor-sort correlation"
0x00590190,138,multiplayer_gamespy_server_descriptor_compare_double_parsed_property,shell,cdecl,inferred,objdump,3,"Comparator helper for descriptor-collection property sorting on double-parsed property values. It resolves the caller-selected property key from global scratch slot `0x00db8c6c+0x488`, queries both candidate descriptors through `0x58d1a0` with `0.0` fallback, compares the resulting doubles against zero, and returns `-1/0/1` with optional sign inversion driven by the reverse-sort latch at `0x00db8c6c+0x48c`. Current grounded caller is the collection sorter `0x590310` in comparator mode `1`.","objdump + caller inspection + descriptor-sort correlation"
0x00590220,130,multiplayer_gamespy_server_descriptor_compare_string_property_lexicographically_inline,shell,cdecl,inferred,objdump,3,"Comparator helper for descriptor-collection property sorting on string properties. It resolves the caller-selected property key from global scratch slot `0x00db8c6c+0x488`, queries both candidate descriptors through `multiplayer_gamespy_server_descriptor_query_string_property_or_fallback` `0x58d170` with empty-string fallback, compares the two strings bytewise inlined, and optionally flips the result through the reverse-sort latch at `0x00db8c6c+0x48c`. Current grounded caller is the collection sorter `0x590310` in comparator mode `2`.","objdump + caller inspection + descriptor-sort correlation"
0x005902b0,88,multiplayer_gamespy_server_descriptor_compare_string_property_via_crt_compare,shell,cdecl,inferred,objdump,3,"Alternate string-property comparator for descriptor-collection sorting. It resolves the caller-selected property key from global scratch slot `0x00db8c6c+0x488`, queries both candidate descriptors through `multiplayer_gamespy_server_descriptor_query_string_property_or_fallback` `0x58d170` with empty-string fallback, compares them through the CRT string-compare helper at `0x5a57cf`, and optionally negates the sign according to the reverse-sort latch at `0x00db8c6c+0x48c`. Current grounded caller is the collection sorter `0x590310` in comparator modes above `2`.","objdump + caller inspection + descriptor-sort correlation"
0x00590310,76,multiplayer_gamespy_server_descriptor_collection_sort_by_property_mode,shell,cdecl,inferred,objdump,3,"Sorts one compact-descriptor collection by a caller-selected property comparator mode. The helper stores the chosen property-key pointer into global scratch slot `0x00db8c6c+0x488`, stores the reverse-sort latch into `0x00db8c6c+0x48c`, picks one comparator callback from `0x590140`, `0x590190`, `0x590220`, or `0x5902b0` according to the caller mode, and then sorts the backing vector at `[this+0x04]` through `generic_vector_sort` `0x59e170`. Current grounded caller `0x595f70` uses mode `1` with key `gsi_am_rating` before selecting the head descriptor from the primary-endpoint table.","objdump + caller inspection + descriptor-sort correlation + caller correlation"
0x00590370,45,multiplayer_gamespy_server_descriptor_collection_append_and_notify_owner,shell,cdecl,inferred,objdump,3,"Appends one descriptor pointer into the caller collection and immediately notifies the route-callback-table owner. It inserts the descriptor into the backing vector at `[this+0x04]` through `0x59e4d0`, then invokes the owner callback at `[this+0x480]` with mode `0`, passing the appended descriptor plus cookie `[this+0x484]`. Current grounded callers are the compact append paths `0x5907d0`, `0x590d00`, and the raw primary-endpoint seed path `0x590dc0`. This is now the clearest generic append-notify owner-callback lane for route-callback tables, and the capacity-descriptor owner `0x595bc0` uses that same mode-`0` branch for its populated live publish path.","objdump + caller inspection + descriptor-collection correlation + owner-callback correlation + capacity-owner-mode correlation"
0x005903a0,97,multiplayer_gamespy_server_descriptor_collection_find_by_primary_ipv4_and_port,shell,cdecl,inferred,objdump,3,"Searches one descriptor collection for an entry whose compact primary endpoint key matches the caller tuple. It walks the backing collection at `[this+0x04]`, compares each candidate descriptor's raw primary IPv4 dword through `0x58d1f0`, and then compares its raw primary port word through `0x58d210`. It returns the matching collection index or `-1` when no descriptor carries that same primary endpoint pair. This is the current strongest proof that descriptor fields `[0x00]` and `[0x04]` form the compact identity key for the server or route descriptor family.","objdump + caller inspection + descriptor-key correlation"
0x00590410,24,multiplayer_transport_route_callback_table_stage_descriptor_on_intrusive_list,shell,cdecl,inferred,objdump,2,"Prepends one descriptor pointer onto the route-callback table's staged intrusive list headed at `[this+0x5bc]`. It writes the prior head into descriptor field `+0x20` through `multiplayer_gamespy_server_descriptor_store_intrusive_next_link` `0x58d260`, then replaces `[this+0x5bc]` with the staged descriptor. Current grounded callers are the generic remove-notify lane `0x590430` and the active-collection release pass `0x5904d0`.","objdump + caller inspection + intrusive-list correlation"
0x00590430,57,multiplayer_gamespy_server_descriptor_collection_remove_index_notify_owner_and_stage_intrusive_link,shell,cdecl,inferred,objdump,3,"Removes one descriptor pointer from the caller collection by index, notifies the route-callback-table owner, and stages the removed descriptor onto the intrusive list head at `[this+0x5bc]`. It resolves the indexed descriptor through `0x59e120`, publishes owner callback mode `2` with that descriptor plus cookie `[this+0x484]`, erases the vector slot through `0x59e3d0`, and then prepends the removed descriptor onto the intrusive list through `0x590410`. Current grounded caller is the `gsi_am_rating` maintenance lane `0x595f70` when a descriptor fails the openstaging capacity gate. This is now the clearest generic remove-notify-and-stage owner-callback lane for route-callback tables, distinct from the append-notify mode-`0` path at `0x590370`.","objdump + caller inspection + descriptor-collection correlation + owner-callback correlation + generic-mode-split correlation"
0x00590470,8,multiplayer_gamespy_server_descriptor_collection_count,shell,cdecl,inferred,objdump,2,"Returns the live descriptor count in the caller collection by forwarding `[this+0x04]` into `generic_vector_count` `0x59e110`. Current grounded callers include the `gsi_am_rating` maintenance lane `0x595f70`.","objdump + caller inspection + descriptor-collection correlation"
0x00590480,11,multiplayer_gamespy_server_descriptor_collection_get_nth,shell,cdecl,inferred,objdump,2,"Returns the descriptor pointer stored at one zero-based collection index by forwarding the caller index into `generic_vector_get_nth` `0x59e120` on `[this+0x04]`. Current grounded callers include the keyed upsert path `0x590d00` and the `gsi_am_rating` maintenance lane `0x595f70`.","objdump + caller inspection + descriptor-collection correlation"
0x00590490,55,multiplayer_transport_route_callback_table_release_staged_intrusive_descriptor_list,shell,cdecl,inferred,objdump,3,"Releases the staged intrusive descriptor list headed at `[this+0x5bc]` for one route-callback table. It repeatedly reads the next-link through `multiplayer_gamespy_server_descriptor_query_intrusive_next_link` `0x58d270`, destroys the current staged descriptor through `0x58d0d0`, and advances the head until the intrusive list is empty. Current grounded callers are the broader active-collection teardown `0x5904d0` and the recurring table service helper `0x591290`, which now uses this to clear staged removals before the next state-driven service pass.","objdump + caller inspection + intrusive-list correlation + descriptor-destroy correlation"
0x005904d0,59,multiplayer_transport_route_callback_table_release_active_descriptor_collection,shell,cdecl,inferred,objdump,3,"Releases the active descriptor vector rooted at `[this+0x04]` for one route-callback table. It walks every live descriptor, stages each one onto the intrusive head at `[this+0x5bc]` through `0x590410`, clears the backing vector through `0x59e4b0`, and then destroys the staged intrusive list through `multiplayer_transport_route_callback_table_release_staged_intrusive_descriptor_list` `0x590490`. Current grounded callers are the broader runtime destroy helper `0x5907a0` and `multiplayer_transport_open_field_subscription_route_callback_table` `0x5962e0`, which uses it to drop prior active descriptors before rebuilding the field-subscription table.","objdump + caller inspection + descriptor-collection correlation + intrusive-list correlation + field-subscription correlation"
0x0058d680,14,multiplayer_gamespy_server_descriptor_matches_special_global_record,shell,cdecl,inferred,objdump,2,Returns 1 only when the caller descriptor pointer is exactly the special global descriptor stored at `0x00db8b4c`. Current grounded compact-descriptor owners use this as a hard reject before insertion so the shared global record does not get appended into normal descriptor collections.,objdump + caller inspection
0x005907d0,222,multiplayer_gamespy_server_descriptor_collection_append_decoded_compact_payload_if_new,shell,cdecl,inferred,objdump,3,"Decodes and appends one compact descriptor payload into the caller collection when the payload is self-consistent and not one special global descriptor. It first validates the payload length against the compact-header precheck helpers at `0x58fe20`, `0x58fe90`, and `0x58fe50`, then parses the header shape through `0x58ff20`, allocates one fresh descriptor through `multiplayer_gamespy_server_descriptor_alloc_primary_endpoint_record` `0x58d5b0`, rejects the special global record through `multiplayer_gamespy_server_descriptor_matches_special_global_record` `0x58d680`, decodes the header and property payload through `multiplayer_gamespy_server_descriptor_decode_compact_header_and_property_payload` `0x58ff60` with decode mode `1`, and finally inserts the surviving descriptor through `0x590370`. Unlike the keyed upsert lane at `0x590d00`, this path always allocates a fresh descriptor after the precheck succeeds.","objdump + caller inspection + compact-descriptor correlation"
0x00590540,95,multiplayer_route_callback_runtime_acquire_shared_string_copy,shell,cdecl,inferred,objdump,3,"Acquires one refcounted shared string copy for the route-callback-table runtime. It lazily initializes the global shared-string pool through `0x58d6a0`, probes that pool by exact string through `0x58f9c0`, increments the stored refcount and returns the pooled string pointer on hit, and otherwise duplicates the caller string through `0x58f4a0` and inserts a new `{string, refcount=1}` pair through `0x58f920`. Current grounded callers are the route-callback receive/decode state machine `0x5908c0`, which uses this helper while materializing schema-owned dictionary strings.","objdump + caller inspection + shared-string-pool correlation"
0x005905a0,58,multiplayer_route_callback_runtime_release_shared_string_copy,shell,cdecl,inferred,objdump,3,"Releases one refcounted shared string copy from the route-callback-table runtime. It probes the global shared-string pool through `0x58d6a0/0x58f9c0`, decrements the stored refcount on hit, and removes the backing entry through `0x58f970` once the refcount reaches zero. Current grounded callers are the runtime teardown helpers `0x5906f0` and `0x5906c1` beneath the route-callback-table family.","objdump + caller inspection + shared-string-pool correlation"
0x005905e0,194,multiplayer_transport_route_callback_table_construct,shell,cdecl,inferred,objdump,3,"Constructs one transport-owned route callback table runtime. The helper seeds table state to `1`, clears the intrusive-head slot at `[this+0x5bc]`, copies three caller strings into local buffers `[this+0x0c]`, `[this+0x2c]`, and `[this+0x4c]`, stores the owner callback and cookie at `[this+0x480]/[this+0x484]`, seeds default strings at `[this+0x488]` and `[this+0x49c]`, zeroes staged companion fields `[this+0x490]/[this+0x494]`, resets live socket and receive-buffer state at `[this+0x4a0]`, `[this+0x74]`, and `[this+0x78]`, stores the caller schema or descriptor owner pointer at `[this+0x4a8]`, and initializes the decoded schema dictionary lanes rooted at `[this+0x08]` and `[this+0x478/0x47c]`. The owner callback lane is now tighter too: current grounded later users invoke `[this+0x480]` with mode `0` from append-notify `0x590370`, mode `1` from compact upsert `0x590d00`, mode `2` from remove-notify `0x590430`, and modes `6/5/3` from the live receive/decode state machine `0x5908c0`. Current grounded callers are the callback-table initialization paths under `0x590ed0` and the larger transport table bring-up family.","objdump + caller inspection + route-callback-table correlation + owner-mode correlation"
0x005906b0,53,multiplayer_transport_route_callback_table_release_schema_shared_string_slots,shell,cdecl,inferred,objdump,3,"Releases the table-local shared schema-string slot array rooted at `[this+0x7c]` with live count `[this+0x478]`. It walks each stored shared-string pointer through `multiplayer_route_callback_runtime_release_shared_string_copy` `0x5905a0` and then clears the live count back to zero. Current grounded callers are the broader live-route reset helper `0x590740` and the decode-side teardown paths that abandon schema materialization midstream.","objdump + local disassembly + caller inspection + shared-string-slot correlation"
0x005906f0,68,multiplayer_transport_route_callback_table_release_decoded_schema_dictionary,shell,cdecl,inferred,objdump,3,"Releases the decoded schema-dictionary runtime rooted at `[this+0x08]` for one route callback table. It walks every stored shared-string pointer through the collection at `[this+0x08]`, releases each one through `multiplayer_route_callback_runtime_release_shared_string_copy` `0x5905a0`, destroys the backing collection through `0x59e330`, and clears the owner slot afterward. Current grounded callers are the larger route-callback receive/decode and teardown paths.","objdump + caller inspection + route-callback-table correlation"
0x00590740,84,multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime,shell,cdecl,inferred,objdump,3,"Resets the live route and decode-side runtime for one route-callback table without destroying the outer table object. It frees the staged receive buffer at `[this+0x74]`, closes the live route handle at `[this+0x4a0]` when present, restores table state to sentinel `1`, releases the decoded schema dictionary through `multiplayer_transport_route_callback_table_release_decoded_schema_dictionary` `0x5906f0`, resets schema companion field `[this+0x47c]` to `-1`, and releases the table-local shared schema-string slots through `multiplayer_transport_route_callback_table_release_schema_shared_string_slots` `0x5906b0`. Current grounded callers are the disconnect-publication helper `0x590ea0`, the one-shot resend wrapper `0x5912c0`, and the broader destroy path `0x5907a0`.","objdump + local disassembly + caller inspection + route-callback-table correlation"
0x005907a0,43,multiplayer_transport_route_callback_table_destroy_runtime_and_release_descriptor_collection,shell,cdecl,inferred,objdump,3,"Destroys the full route-callback-table runtime. It first resets the live route and decode-side state through `multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime` `0x590740`, then releases the active descriptor collection through `0x5904d0`, performs one remaining shared multiplayer cleanup call through `0x58d0a0`, destroys the backing descriptor vector at `[this+0x04]` through `0x59e330` when present, and clears that owner slot afterward. Current grounded callers are the larger transport teardown lanes and the auxiliary capacity-descriptor cache cleanup family.","objdump + local disassembly + caller inspection + route-callback-table correlation + descriptor-collection correlation"
0x005908c0,804,multiplayer_transport_route_callback_table_service_receive_decode_state_machine,shell,cdecl,inferred,objdump,3,"Services the live receive/decode state machine for one transport-owned route callback table using staged buffer `[this+0x74]/[this+0x78]` and state dword `[this+0x5b8]`. The current bounded model is: state `0` validates the leading route companion header, stores the first dword into `[this+0x490]`, stores the first word or sentinel into `[this+0x498]`, publishes owner callback mode `6` with the special global descriptor `0x00db8b4c` plus cookie `[this+0x484]`, and when the trailing token path succeeds also publishes owner callback mode `5` with that same special global descriptor before either entering a terminal route-mode branch or continuing into schema decode; states `1..3` build the table-owned descriptor schema and shared-string dictionaries under `[this+0x08]` and `[this+0x7c..]` through `0x59e0b0`, `0x590540`, and `0x59e4d0`; and state `4` repeatedly hands the remaining compact payload stream to `multiplayer_gamespy_server_descriptor_collection_append_decoded_compact_payload_if_new` `0x5907d0` until the staged receive buffer is exhausted. Decode failures return `5`, while the explicit compact-payload failure tail publishes owner callback mode `3` with that same special global descriptor before advancing the staged-buffer pointers and leaving the remaining byte count back in `[this+0x78]`. Current grounded caller is `multiplayer_transport_service_route_callback_table_once` `0x591290` in table states `2/3`.","objdump + caller inspection + route-callback-table correlation + compact-descriptor correlation + owner-mode correlation"
0x00590ea0,34,multiplayer_transport_route_callback_table_publish_disconnect_and_reset,shell,cdecl,inferred,objdump,3,"Publishes one route-callback-table disconnect event and then tears the live route side down. It invokes the owner callback at `[this+0x480]` in mode `4`, passing the special global descriptor at `0x00db8b4c` plus cookie `[this+0x484]`, and then tails into the broader table reset helper `0x590740`. Current grounded callers are the state-`2/3` receive-service helper `0x5911e0`, the connect-or-send wrapper `0x5912c0`, and failure paths beneath the route-table open helper `0x590ed0`.","objdump + caller inspection + route-callback-table correlation + owner-callback correlation"
0x00590ed0,531,multiplayer_transport_route_callback_table_open_live_route_and_seed_receive_state,shell,cdecl,inferred,objdump,3,"Opens or reopens the live route side for one transport-owned callback table. The helper validates the caller-supplied route-name strings, resets temporary builder state, seeds a small descriptor schema block in stack scratch, copies the chosen route labels into the table-local buffers `[this+0x0c]` and `[this+0x2c]`, stages one outbound request payload into the local send buffer rooted at `[this+0x6c]`, opens the live route handle into `[this+0x4a0]` through `0x5b3216`, and on success sets table state to `3`, clears decode-substate `[this+0x5b8]`, allocates the initial receive buffer at `[this+0x74]` when needed, and zeroes the staged receive count `[this+0x78]`. Failure paths return `3`, `5`, or `6` and can tear the live route side back down through `multiplayer_transport_route_callback_table_publish_disconnect_and_reset` `0x590ea0`. Current grounded callers are the reconnect wrapper `0x5912c0`, the direct `gsi_am_rating` upsert path `0x591330`, and the larger transport-owned route bring-up paths around `0x5964e1` and `0x59655f`.","objdump + caller inspection + route-callback-table correlation + live-route-handle correlation + caller correlation"
0x005911e0,332,multiplayer_transport_route_callback_table_service_live_socket_and_feed_decode_machine,shell,cdecl,inferred,objdump,3,"Services one open route-callback-table socket in states `2/3`. It polls the live route handle at `[this+0x4a0]`, reads newly available bytes into the staged receive buffer `[this+0x74]/[this+0x78]` through `0x5b321c`, grows that backing buffer through `0x59e750` when the staged byte count would overflow the current capacity, enters the heavier decode state machine `0x5908c0` once the table is in state `3`, compacts any unconsumed tail back to the start of the buffer, and tears the route side down through `multiplayer_transport_route_callback_table_publish_disconnect_and_reset` `0x590ea0` on closure or decode failure. Current grounded caller is `multiplayer_transport_service_route_callback_table_once` `0x591290` for table states `2/3`.","objdump + caller inspection + route-callback-table correlation + staged-buffer correlation"
0x00590dc0,155,multiplayer_transport_primary_endpoint_table_seed_from_raw_endpoint_list,shell,cdecl,inferred,objdump,3,"Rebuilds the transport-owned primary-endpoint table from the raw endpoint list exposed by the live route handle at `[this+0x4a0]`. It first probes list availability through `0x58f4e0`, then repeatedly reads one endpoint tuple through `0x58bc7e` record type `0x1f3`, skips tuples already present in the table through `multiplayer_gamespy_server_descriptor_collection_find_by_primary_ipv4_and_port` `0x5903a0`, allocates fresh descriptor records through `multiplayer_gamespy_server_descriptor_alloc_primary_endpoint_record` `0x58d5b0`, rejects one special global descriptor through `0x58d680`, then stamps descriptor flag byte `[entry+0x15]` with `0x11` and inserts the surviving record into the table through `0x590370`. That makes this the strongest current source-side writer for header bit `0x1`, and it also ties bit `0x10` to the same source-header family later decoded as the inline primary-port-present branch in `0x58ff20/0x58ff60`. Current grounded caller is the recurring table service helper `0x591290` when the table sits in state `0`.","objdump + local disassembly + caller inspection + endpoint-table correlation + header-flag correlation + compact-header correlation"
0x0058ff60,432,multiplayer_gamespy_server_descriptor_decode_compact_header_and_property_payload,shell,cdecl,inferred,objdump,3,"Decodes one compact server-descriptor header and trailing property payload into the caller descriptor record. The helper copies the source header byte into descriptor flag byte `[entry+0x15]` through `0x58d630`, then conditionally consumes endpoint and scalar fields according to header bits `0x02`, `0x08`, `0x10`, `0x20`, `0x40`, and signed bit `0x80`. Current grounded split is tighter now: the primary IPv4 dword is always present immediately after the header byte; bit `0x10` only marks the inline primary port word branch, otherwise the helper falls back to the owner default port at `[caller+0x498]`; bit `0x02` supplies the secondary IPv4 dword; bit `0x20` supplies the paired secondary port word, otherwise the helper again falls back to the owner default port; bit `0x08` supplies one still-unresolved auxiliary dword through `[entry+0x10]`; bit `0x40` enables one inline keyed-property vector decoded through `0x59e110/0x59e120` plus the property-store writers rooted at `0x58d0f0` and `0x58d130`, after which the helper ORs descriptor state byte `[entry+0x14]` with bit `0x1`; and signed bit `0x80` enables one trailing NUL-terminated string-pair tail decoded through repeated `0x58d0f0` stores, after which the helper ORs state byte `[entry+0x14]` with bit `0x2`. Current grounded callers are the larger compact decode paths at `0x5907d0` and `0x590d00`. This remains the strongest proof that byte-`0x15` bit `0x1` is a source-side descriptor header bit rather than a queue-generated flag.","objdump + caller inspection + compact-decode correlation + header-flag correlation + secondary-endpoint correlation + state-byte correlation"
0x00590d00,184,multiplayer_transport_decode_compact_descriptor_payload_upsert_by_primary_endpoint_and_notify_owner,shell,cdecl,inferred,objdump,3,"Decodes one compact descriptor payload into the transport-owned primary-endpoint family while reusing an existing descriptor when the compact primary endpoint key already exists. After one short header-shape precheck through `0x58ff20`, it looks up the descriptor by primary IPv4 and port through `multiplayer_gamespy_server_descriptor_collection_find_by_primary_ipv4_and_port` `0x5903a0`. If no match exists it allocates a fresh record through `multiplayer_gamespy_server_descriptor_alloc_primary_endpoint_record` `0x58d5b0`, rejects the special global record through `multiplayer_gamespy_server_descriptor_matches_special_global_record` `0x58d680`, and later inserts the new descriptor through `0x590370`; otherwise it reuses the existing record through `0x590480`. It then decodes the compact header and property payload through `multiplayer_gamespy_server_descriptor_decode_compact_header_and_property_payload` `0x58ff60` with decode mode `0`, and finally notifies the owner callback at `[this+0x480]` in mode `1` with the updated descriptor plus cookie `[this+0x484]`. The current capacity-descriptor owner `0x595bc0` now makes this mode split tighter too: mode `1` is a no-op for that owner, so this lane updates the live callback-table descriptor family without emitting one opcode-`2` capacity record directly.","objdump + caller inspection + compact-descriptor correlation + owner-callback correlation + capacity-owner-mode correlation"
0x00591290,43,multiplayer_transport_service_route_callback_table_once,shell,cdecl,inferred,objdump,3,"Shared recurring service helper for one transport-owned route callback or descriptor table. It first clears the staged intrusive descriptor list at `[this+0x5bc]` through `multiplayer_transport_route_callback_table_release_staged_intrusive_descriptor_list` `0x590490`, then switches on table state dword `[this+0x00]`: state `0` seeds the primary-endpoint side through `multiplayer_transport_primary_endpoint_table_seed_from_raw_endpoint_list` `0x590dc0`; states `2` and `3` service the live receive path rooted at socket `[this+0x4a0]` by appending new bytes into the staging buffer at `[this+0x74]/[this+0x78]`, growing the backing buffer through `0x59e750` when needed, and invoking the heavier decode state machine `0x5908c0` once buffered data is available in state `3`; other states return immediately. Receive failure or closure tears the live route side down through `0x590ea0` and returns status `3`. Current grounded caller is `multiplayer_transport_service_route_callback_tables` `0x596210`, which uses this helper on the route tables at `[transport+0xba4]`, `[transport+0x1164]`, and `[transport+0x18bc]`.","objdump + caller inspection + route-table-service correlation + intrusive-list correlation"
0x005912c0,108,multiplayer_transport_route_callback_table_send_payload_with_one_reopen_retry,shell,cdecl,inferred,objdump,3,"Attempts one outbound send on the live route handle at `[this+0x4a0]` and performs at most one full reopen retry on failure. It forwards the caller payload pointer and byte count into `0x5b3216`; if that first send fails it resets the live route side through `multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime` `0x590740`, reopens the route through `multiplayer_transport_route_callback_table_open_live_route_and_seed_receive_state` `0x590ed0` in mode `2`, retries the same send once, and on persistent failure publishes disconnect plus reset through `multiplayer_transport_route_callback_table_publish_disconnect_and_reset` `0x590ea0`. Current grounded callers are the keyed primary-endpoint upsert lane `0x591330` and the direct route-send family under the callback-table transport block.","objdump + local disassembly + caller inspection + route-send correlation"
0x00591330,96,multiplayer_transport_primary_endpoint_table_upsert_descriptor_by_primary_ipv4_and_port,shell,cdecl,inferred,objdump,3,"Upserts one compact descriptor record into the `gsi_am_rating` primary-endpoint table rooted at `[transport+0x18bc]`. When the table is still in sentinel state `1` it first reinitializes it through `0x590ed0` mode `2`; afterward it converts the caller host-order port through `0x58bc5a`, builds a 9-byte stack record with tag byte `1`, primary IPv4 dword, and primary port word, and forwards that record into `0x5912c0` for keyed insertion or replacement. Current grounded caller is `multiplayer_transport_dispatch_am_rating_route_event_mode` when descriptor flag byte `0x15` bit `0x1` is clear.","objdump + caller inspection + endpoint-table correlation"
0x005913f0,25,generic_callback_invoke_record2_and_trailing_context,support,cdecl,inferred,objdump,2,"Small callback-marshaling helper over one outer wrapper whose field `[record+0x10]` points at a two-dword inner payload and whose field `[record+0x0c]` carries one trailing context scalar. It pushes `(inner[0], inner[1], outer[0x0c])` into the callback at `[record+0x08]` with callback context `[record+0x04]`. Current evidence only bounds the record shape, not a more specific subsystem owner.","objdump + local disassembly"
0x00591410,85,generic_record_0x1c_deep_copy_with_owned_string_at_0x08,support,cdecl,inferred,objdump,2,"Deep-copies one `0x1c`-byte record whose fields are `u32` at `+0x00/+0x04/+0x0c/+0x10/+0x14/+0x18` plus one owned string pointer at `+0x08`. It copies the scalar fields verbatim, duplicates the optional string through `0x58f4a0`, and returns failure only when the source string is nonnull and duplication fails. Current evidence now makes this one of the generic preservation helpers that can carry descriptor-adjacent payload fields such as a copied `+0x10` scalar without interpreting them.","objdump + local disassembly + preservation-path correlation"
0x00591480,45,generic_callback_invoke_record7_and_trailing_context,support,cdecl,inferred,objdump,2,"Small callback-marshaling helper over one outer wrapper whose field `[record+0x10]` points at a seven-dword inner payload and whose field `[record+0x0c]` carries one trailing context scalar. It pushes `(inner[0..6], outer[0x0c])` into the callback at `[record+0x08]` with callback context `[record+0x04]`. Current evidence only bounds the record shape, not a more specific subsystem owner.","objdump + local disassembly"
0x005914b0,69,generic_record_0x14_deep_copy_with_owned_string_at_0x00,support,cdecl,inferred,objdump,2,"Deep-copies one `0x14`-byte record whose leading field `+0x00` is an owned string pointer and whose remaining fields at `+0x04/+0x08/+0x0c/+0x10` are copied verbatim. It duplicates the optional leading string through `0x58f4a0` and fails only when that duplication is required but returns null.","objdump + local disassembly"
0x00591510,37,generic_callback_invoke_record5_and_trailing_context,support,cdecl,inferred,objdump,2,"Small callback-marshaling helper over one outer wrapper whose field `[record+0x10]` points at a five-dword inner payload and whose field `[record+0x0c]` carries one trailing context scalar. It pushes `(inner[0..4], outer[0x0c])` into the callback at `[record+0x08]` with callback context `[record+0x04]`. Current evidence only bounds the record shape, not a more specific subsystem owner.","objdump + local disassembly"
0x005927b0,77,multiplayer_transport_service_and_retire_nth_active_opcode_record,shell,cdecl,inferred,objdump,3,"Services one active opcode record by ordinal from the collection rooted at `[this+0x17fc]`. It marks the selected record busy at `+0x18`, increments in-flight counter `[this+0x1808]`, dispatches through the opcode-specific service callback table rooted at `0x005e200c`, then clears the busy flag, decrements `[this+0x1808]`, increments completed count `[this+0x1804]`, and removes the serviced record from the active collection through `0x59e3d0`.","objdump + local disassembly + opcode-table correlation + active-collection correlation"
0x00592800,147,multiplayer_transport_remove_active_opcode_records_by_context_or_idle,shell,cdecl,inferred,objdump,3,"Removes records from the active opcode-record collection rooted at `[this+0x17fc]`. With `EDX != -1` it scans for records whose dword field `+0x14` matches the requested context id or whose opcode type dword at `+0x00` is `0x17`, then retires them through `multiplayer_transport_service_and_retire_nth_active_opcode_record` `0x5927b0`. With `EDX == -1` it instead retires every non-busy record whose in-flight flag at `+0x18` is clear.","objdump + local disassembly + active-collection correlation + immediate-drain correlation"
0x005928a0,189,multiplayer_transport_enqueue_opcode_record,shell,cdecl,inferred,ghidra-headless,3,Common allocator and queue-submit helper for session-event transport opcode records. It allocates a zeroed caller-sized record through tracked_heap_alloc_with_header invokes the opcode-specific initializer from the handler table at 0x005e2004 plus opcode times 0x10 packages the resulting payload together with caller metadata into 0x0059e4d0 and increments [this+0x1800] on success. Allocation or initializer failure releases the temporary record through tracked_heap_free_with_header and returns -1.,ghidra + rizin + llvm-objdump
0x005929a0,69,multiplayer_transport_remove_active_opcode_records_by_type,shell,cdecl,inferred,objdump,3,"Removes active opcode records of one requested type from the collection rooted at `[this+0x17fc]`. It walks the live records in reverse ordinal order, compares opcode dword `+0x00` against the requested type in `EBX`, and removes each match through `0x59e3d0`. Current grounded caller `multiplayer_transport_clear_progress_field_cache` `0x595b80` uses it with opcode type `3`, which corrects that helper as an active field-snapshot cleanup rather than a queued-work sweep.","objdump + local disassembly + caller inspection + active-collection correlation"
0x005929f0,78,multiplayer_transport_remove_active_field_snapshot_records_by_callback_pair,shell,cdecl,inferred,objdump,3,"Removes active field-snapshot opcode records keyed by one subscribed callback pair. It walks the active opcode-record collection at `[this+0x17fc]` in reverse ordinal order, filters for opcode type `3`, resolves the opcode payload pointer at record `+0x10`, and removes records whose payload dword `+0x04` matches the requested callback or context dword in `EBX`. Current grounded caller `multiplayer_transport_enqueue_field_snapshot_record` `0x592b50` uses it before building a fresh opcode-`3` snapshot entry.","objdump + local disassembly + caller inspection + opcode-3 correlation + active-collection correlation"
0x00592970,41,multiplayer_transport_active_opcode_record_collection_lacks_context_id,shell,thiscall,inferred,objdump + caller inspection,2,"Predicate over the active opcode-record collection rooted at `[this+0x17fc]`. It performs a comparator-driven collection search through `0x59e420` using comparator `0x592960`, which orders records by dword field `+0x14`, and returns `1` only when no active opcode record carries the requested context id. Current grounded caller is the immediate-drain completion gate `0x58d720`, so current evidence now bounds active field `+0x14` specifically as the active-side mirror of the shared drain context id seeded by `0x5934c0`.","objdump + caller inspection + collection-search correlation + immediate-drain correlation"
0x00592a40,40,multiplayer_transport_dispatch_callback_table_binding,shell,cdecl,inferred,objdump + local disassembly,2,"Small deferred callback-trigger wrapper over `multiplayer_transport_enqueue_opcode_record` using explicit opcode `1` (table slot `0`) and payload size `0x04`. The opcode-`1` constructor at `0x5913a0` is a no-op, so this wrapper is not the real 0x08-byte binding-record builder; it instead stages one tiny callback trigger record whose active-side service lands in `0x5913c0`. Current grounded callback-table callers still show the replay-side triplet feeding this lane as `(first staged metadata dword duplicated in work `+0x0c/+0x10`, second staged metadata dword in `+0x18`)`, with the incoming `EDX` mode or status carried separately into the queued record.","objdump + local disassembly + opcode-table correction + callback-triplet correlation"
0x00592a70,109,multiplayer_transport_probe_or_enqueue_route_record,shell,cdecl,inferred,ghidra-headless,2,"Small route-probe or deferred route-record wrapper over `multiplayer_transport_enqueue_opcode_record`. It first calls `multiplayer_transport_is_route_mode_active_nonterminal` and when that succeeds with caller mode `2` directly invokes the supplied callback; otherwise it falls back to an 0x08-byte opcode-`1` record built from the caller callback and payload fields. Current grounded callers now show the staged work-record triplet more concretely as `(callback fn @ +0x10, callback companion @ +0x18, drain context id @ +0x0c)` with extra route-mode control bytes layered on top, and the final dword again aligned to the shared `0x5934c0`-seeded drain context used by the deferred path.","ghidra + rizin + llvm-objdump + local disassembly + callback-triplet correlation"
0x00592ae0,111,multiplayer_transport_enqueue_descriptor_block_record,shell,cdecl,inferred,objdump + local disassembly,3,"Copies one caller-supplied seven-dword descriptor-block payload into a local `0x1c` buffer and enqueues it through `multiplayer_transport_enqueue_opcode_record` `0x5928a0` as opcode `2`. The deeper opcode-`2` initializer family rooted at `0x591410/0x591470/0x591480` now bounds that payload more tightly: it stores dwords `+0x00/+0x04/+0x0c/+0x10/+0x14/+0x18` verbatim and duplicates the optional string pointer at `+0x08` into owned heap storage. Current grounded callers are now broader than the earlier callback-registration-only note: the helper is also the enqueue tail beneath `multiplayer_transport_enqueue_capacity_descriptor_record` `0x595bc0`, where live mode supplies a populated descriptor payload but replay modes `3/5` intentionally pass an all-zero seven-dword payload while reusing separate sidecar metadata slots from the cached work record.","objdump + local disassembly + opcode-record table correlation + descriptor-block initializer correlation + capacity-descriptor correlation"
0x00592b50,226,multiplayer_transport_enqueue_field_snapshot_record,shell,cdecl,inferred,ghidra-headless,3,"Builds and enqueues one field-snapshot transport record through `multiplayer_transport_enqueue_opcode_record` using opcode `3` and a `0x14`-byte payload. Depending on the caller mode it can first remove prior matching entries through `0x5929f0`, then normalizes the `hostname` field against `(No Name)`, samples the `gamemode` field and compares it against `openstaging`, computes one 0-to-100 progress percentage from cached progress slot `[this+0x1774]` plus counters `[this+0x1734]` and `[this+0x1740]` and the current active descriptor count under `[this+0xba4]`, and packages the subscribed callback pointers from `[this+0x176c]` and `[this+0x1770]`. Current grounded caller `0x596500` seeds `[this+0x1774]` to `1` immediately before the first mode-`3` snapshot under `multiplayer_transport_open_field_subscription_route_callback_table` `0x5962e0`.","ghidra + rizin + llvm-objdump + strings + local disassembly + caller inspection"
0x00593330,57,multiplayer_transport_construct_transient_work_record_collection,shell,thiscall,inferred,objdump + local disassembly,3,"Constructs the transient transport work-record collection at `[this+0x1780]`. It clears counters `[this+0x1784]` and `[this+0x1788]`, allocates one vector-like owner through `0x59e0b0` using cleanup shim `0x5932f0`, stores the resulting collection root at `[this+0x1780]`, and returns success when that root is nonnull.","objdump + local disassembly + work-queue correlation"
0x00593370,16,multiplayer_transport_clear_transient_work_record_collection,shell,thiscall,inferred,objdump + local disassembly,2,"Thin clearer for the transient transport work-record collection rooted at `[this+0x1780]`. When that collection exists it tailcalls the generic clear helper `0x59e4b0`; otherwise it returns immediately.","objdump + local disassembly + work-queue correlation"
0x00593380,30,multiplayer_transport_destroy_transient_work_record_collection,shell,thiscall,inferred,objdump + local disassembly,2,"Destructor-side helper for the transient transport work-record collection rooted at `[this+0x1780]`. When the collection exists it destroys that vector owner through `0x59e330`, then clears `[this+0x1780]` to null.","objdump + local disassembly + work-queue correlation"
0x005933a0,83,multiplayer_transport_remove_queued_work_record_by_pointer,shell,thiscall,inferred,objdump + local disassembly,3,"Scans the transient transport work-record collection at `[this+0x1780]` for one exact record-pointer match and removes that vector slot through `generic_vector_remove_index` `0x59e3d0`. Successful removal also increments the released-or-completed work counter at `[this+0x1788]`. Current grounded callers include the callback-table binding result helper `0x593570`, route-binding release `0x595620`, and the names or bound-route or selector-text completion lanes when they drop stale or finished work records.","objdump + local disassembly + caller inspection + work-queue correlation"
0x00593400,90,multiplayer_transport_queued_work_collection_lacks_context_id,shell,thiscall,inferred,objdump + local disassembly,2,"Predicate over the same transient work-record collection at `[this+0x1780]`. It returns `1` when no queued work record carries the requested dword context id in field `+0x0c`, and returns `0` on the first match. Current grounded caller is the small transport gate at `0x58d720`, which uses this uniqueness test immediately before `0x592970`; that now bounds queued field `+0x0c` specifically as the queued-side mirror of the shared drain context id seeded by `0x5934c0`.","objdump + local disassembly + caller inspection + work-queue correlation + immediate-drain correlation"
0x00592c40,54,multiplayer_transport_enqueue_callback_binding_record,shell,cdecl,inferred,objdump + local disassembly,2,"Builds and enqueues one `0x08`-byte explicit opcode-`5` callback-binding record through `multiplayer_transport_enqueue_opcode_record` `0x5928a0`. The helper stages a local two-dword payload from `(incoming EDX, first stack dword)`, uses that local payload as the deep-copy source for the opcode-`5` family `0x591540/0x591570/0x591580`, and carries the transport follow-on callback field `[this+0x4c]` plus the remaining caller metadata in the queued outer record. It is the real lower binding leaf beneath the worker callback shim at `0x593610`, not the earlier direct role previously attributed to `0x592a40`.","objdump + local disassembly + opcode-table correction + callback-binding correlation"
0x00592c80,80,multiplayer_transport_enqueue_callback_slot9_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x10-byte opcode `9` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x1790] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592cd0,85,multiplayer_transport_enqueue_callback_slot10_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x14-byte opcode `10` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x1794] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592d30,62,multiplayer_transport_enqueue_callback_slot11_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x04-byte opcode `11` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x1798] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592d70,77,multiplayer_transport_enqueue_callback_slot12_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that copies a caller-supplied seven-dword block and enqueues it as a 0x20-byte opcode `12` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x179c] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592dc0,72,multiplayer_transport_enqueue_callback_slot13_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `13` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a0] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592e10,72,multiplayer_transport_enqueue_callback_slot14_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x10-byte opcode `14` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a4] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592ee0,62,multiplayer_transport_enqueue_callback_slot17_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x08-byte opcode `17` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17b0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is the current-selector profile-key callback root at `0x59f8b0`, which submits one profile-key bundle and then forwards the same selector context through this owner-callback lane.","objdump + caller xrefs"
0x00592f20,69,multiplayer_transport_enqueue_callback_slot18_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `18` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17b4]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`.","objdump"
0x00592f70,72,multiplayer_transport_enqueue_callback_slot19_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `19` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17b8]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is one selector-view callback-table branch at `0x59f850`, which resets selector-side state and then forwards the same selector-name pair through this owner-callback lane.","objdump + caller xrefs"
0x00592fc0,50,multiplayer_transport_enqueue_callback_slot20_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x04-byte opcode `20` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17bc]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`.","objdump"
0x00593000,69,multiplayer_transport_enqueue_callback_slot21_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `21` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17c0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`.","objdump"
0x00593050,77,multiplayer_transport_enqueue_callback_slot22_record,shell,cdecl,inferred,objdump,3,"Gated callback-slot wrapper that enqueues one 0x10-byte opcode `22` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17c4]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. Current grounded callers are the per-key profile callback helper at `0x596970`, which forwards one selector name plus the parsed `X...X|%d` probe tuple `(request id, displayed version/build integer)` or a zeroed `(END)` sentinel payload, and the same helper's sibling path at `0x596a45`, which republishes the currently armed selector-view probe tuple.","objdump + caller xrefs"
0x005930a0,50,multiplayer_transport_enqueue_callback_slot23_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x04-byte opcode `23` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x178c]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is the callback root at `0x59f5c0`, which first arms deferred-close state at `[this+0x1edc]`.","objdump + caller xrefs"
0x005930e0,62,multiplayer_transport_enqueue_callback_slot24_record,shell,cdecl,inferred,objdump,3,"Gated callback-slot wrapper that enqueues one 0x08-byte opcode `24` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17cc]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is multiplayer_transport_commit_selector_view_refresh_probe_success, which forwards the selector-view entry pointer together with the current averaged probe sample through this owner-callback lane.","objdump + caller xrefs"
0x00593120,72,multiplayer_transport_enqueue_callback_slot25_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `25` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17d0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is one selector-view callback-table branch at `0x59f560`, which first updates selector-view runtime state through `0x5948f0` and then forwards the same selector-name pair through this owner-callback lane.","objdump + caller xrefs"
0x00593200,78,multiplayer_transport_enqueue_callback_slot28_record,shell,cdecl,inferred,objdump + local disassembly,2,"Gated callback-slot wrapper that enqueues one `0x10`-byte opcode `28` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17d8]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. Current grounded callers are `multiplayer_transport_callback_query_slot_built_in_profile_key_and_publish_slot28` `0x59fbd0` and its helper `0x596b90`.","objdump + local disassembly + caller inspection"
0x00592e60,64,multiplayer_transport_enqueue_callback_slot15_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x08-byte opcode `15` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a8] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592ea0,64,multiplayer_transport_enqueue_callback_slot16_record,shell,cdecl,inferred,ghidra-headless,2,"Gated callback-slot wrapper that enqueues one `0x08`-byte opcode `16` record through `multiplayer_transport_enqueue_opcode_record` when byte `[this+0x17ac]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. Current grounded caller `0x59f440` forwards the staged route-callback payload handle from `[this+0xb50]` together with fixed text at `0x00db9dd8` through this lane just before `multiplayer_transport_set_route_mode` forces mode `5`, so slot `16` is no longer just an abstract callback-slot wrapper.","ghidra + rizin + llvm-objdump + caller inspection"
0x0059f2e0,64,multiplayer_transport_is_selector_control_line,shell,cdecl,inferred,objdump,2,"Small selector-text classifier used in the second callback descriptor lane. It returns true only when the caller string is at least four bytes long and begins with `@@@` but not `@@@ `, which makes it the current gate between control-line handling and the ordinary selector-name callback lanes.","objdump + caller xrefs + strings"
0x0059f320,131,multiplayer_transport_split_selector_payload_token_and_tail,shell,cdecl,inferred,objdump,2,"Splits one selector payload string at the first space into the two shared scratch buffers `0x00db9dd0` and `0x00db9dd8`. Current grounded callers are the mode-`3/4` selector callback helpers at `0x59f650` and `0x59f720`, which use that token-plus-tail pair as the payload for callback slots `14` and `10`.","objdump + caller xrefs + strings"
0x0059f5e0,111,multiplayer_transport_sync_selector_view_nfo_r_flag,shell,cdecl,inferred,objdump,3,"Local `@@@NFO` helper shared by the selector callback lanes at `0x59f650` and `0x59f720`. It only accepts control lines ending in the literal tail `X\\`, searches the same line for the field marker `\\$flags$\\`, and then sets or clears bit `0x2` in the selector-view entry flag word at `[entry+0x64]` depending on whether the following flag segment contains the letter `r` before the next backslash. The current grounded entry gate is `[entry+0x48]`, so this path is specific to selector entries that participate in the third selector slot.","objdump + caller xrefs + strings"
0x00593460,87,multiplayer_transport_mark_selector_slot_records_stale,shell,cdecl,inferred,ghidra-headless,3,Scans the queued transport request collection at [this+0x1780] for records of type `1` or `2` whose selector-slot field at +0x1c matches the requested slot id. Matching records are marked stale by setting byte or dword field +0x38 to one. Current grounded caller is multiplayer_transport_reset_selector_slot.,ghidra + rizin + llvm-objdump
0x005934e0,130,multiplayer_transport_allocate_and_enqueue_work_record,shell,cdecl,inferred,objdump + local disassembly,3,"Allocates one zeroed `0x3c` transient transport work record and appends it into the work collection at `[this+0x1780]`. The helper stores the owner transport pointer at `+0x00`, caller-supplied type and metadata dwords at `+0x04`, `+0x08`, `+0x0c`, `+0x10`, and `+0x18`, clears bookkeeping field `+0x20` and stale latch `+0x38`, inserts the finished pointer through `generic_vector_push_back` `0x59e4d0`, and increments `[this+0x1784]` on success. Current grounded callers include callback-table descriptor attach, bound-route request submission, selector-text route request submission, and the type-`9` text fastpath. The wider caller set now proves one stronger boundary on the metadata triplet itself: these three dwords are shared transport wrapper metadata reused across type `0/1/2/9` work records, not one capacity-only or route-only cache tuple. Current direct consumers now bound that triplet more concretely as `drain context id @ +0x0c`, deferred callback function pointer @ `+0x10`, and callback companion or context @ `+0x18`; the callback-table lane still gives the cleanest concrete subcase because it intentionally duplicates the same caller metadata dword into both `+0x0c` and `+0x18` while preserving the callback pointer in `+0x10`.","objdump + local disassembly + caller inspection + work-queue correlation + metadata-triplet correlation + cross-type work-record correlation + callback-dispatch correlation"
0x00593570,160,multiplayer_transport_publish_callback_table_binding_result_and_release_work_record,shell,cdecl,inferred,objdump + local disassembly,3,"Consumes one transient callback-table attach work record. It resolves the owner transport from work field `+0x00`, conditionally downgrades a nominal success when the current live transport probe through `0x58d7e0/0x58d810` fails, stores the final boolean result into `[transport+0x48]`, and on the success branch also stamps tick field `[transport+0x50]` plus copies one callback-table label string into the local transport name buffer at `[transport+0x04]`. Both the success and failure tails then publish opcode-`4` callback-binding state through `multiplayer_transport_dispatch_callback_table_binding` `0x592a40` using work fields `(callback fn +0x10, callback companion +0x18, drain context id +0x0c)`; the failure tail additionally arms deferred reset latch `[transport+0x1edc]`. The helper always finishes by unlinking the consumed work record through `multiplayer_transport_remove_queued_work_record_by_pointer` `0x5933a0`.","objdump + local disassembly + caller inspection + callback-binding correlation + work-queue correlation + callback-triplet correlation"
0x00593790,351,multiplayer_transport_handle_names_query_response,shell,cdecl,inferred,ghidra-headless,3,Completion callback for multiplayer_transport_submit_names_query_with_callback. If the request is already stale at +0x38 it just unlinks through 0x5933a0. On nonzero result it can update route-binding state through multiplayer_transport_is_route_mode_active_nonterminal and multiplayer_transport_try_connect_status_route_once seeds selector slot `2` through multiplayer_transport_init_selector_slot upserts returned name records through multiplayer_transport_upsert_selector_name_entry publishes `TOPIC` and `MODE` lines through multiplayer_transport_publish_topic_status_line and multiplayer_transport_publish_mode_level_status_line and may promote one deferred route binding into [this+0x1ec8]. On zero result it resets selector slot `2` and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request.,ghidra + rizin + llvm-objdump + strings
0x005938f0,145,multiplayer_transport_handle_bound_route_request,shell,cdecl,inferred,ghidra-headless,3,"Completion callback for `multiplayer_transport_submit_bound_route_request`. If the request is already stale at `+0x38` it just unlinks through `0x5933a0`. On nonzero result it can publish `[req+0x24]` through `multiplayer_transport_publish_mode_key_status_line` and then schedules `multiplayer_transport_handle_names_query_response` through `multiplayer_transport_submit_names_query_with_callback`. On zero result it resets selector slot `2` and falls back to `multiplayer_transport_probe_or_enqueue_route_record` using the staged work fields `(callback fn +0x10, callback companion +0x18, drain context id +0x0c)` plus the request-specific route-mode pair before unlinking the request.","ghidra + rizin + llvm-objdump + local disassembly + callback-triplet correlation"
0x00594620,106,multiplayer_transport_reset_selector_view_entry_runtime_state,shell,cdecl,inferred,objdump,2,"Clears the extended runtime fields of one selector-view entry. When the transport-side selector-view layer is present through `[this+0xac8]` it zeroes the entry block from `+0x68` through `+0xa8`, including the dirty or refresh flags at `+0xa0`, `+0xa4`, and `+0xa8`, then returns success. Current grounded caller is the selector-view snapshot export path at `0x594ee0`.","objdump"
0x00594690,76,multiplayer_transport_mark_selector_slot_views_dirty,shell,cdecl,inferred,ghidra-headless,2,"Marks one selector slot dirty in the transport-side selector-view layer rooted at `[this+0xab4]` with backing arrays around `[this+0xad0]..[this+0xae4]`. It sets slot-specific dirty bits at `+0xa0` and `+0xa4` when the matching backing arrays are populated and also sets `+0xa8` for selector slot `2`. Current grounded callers are multiplayer_transport_set_selector_slot_flags and multiplayer_transport_upsert_selector_name_entry.","ghidra + rizin + llvm-objdump"
0x005949a0,80,multiplayer_transport_ensure_selector_view_store,shell,thiscall,inferred,objdump,3,"Ensures the keyed selector-view store used by the multiplayer transport. When the gate at `[this+0xab0]` is clear it allocates a `0xac`-byte keyed container through `0x58faf0`, stores the resulting root at `[this+0xab4]`, and resets the three per-slot generation counters at `[this+0xab8]`, `[this+0xabc]`, and `[this+0xac0]`. Current grounded callers are the transport setup and reset path around `0x58d7ee`.","objdump + caller xrefs"
0x005949f0,56,multiplayer_transport_release_selector_view_store,shell,thiscall,inferred,objdump,3,"Releases the keyed selector-view store used by the multiplayer transport. When the gate at `[this+0xab0]` is clear it frees the root at `[this+0xab4]` through `0x58f8b0`, clears that root, and resets the three per-slot generation counters at `[this+0xab8]`, `[this+0xabc]`, and `[this+0xac0]`. Current grounded callers are the transport teardown path around `0x58d81a`.","objdump + caller xrefs"
0x00594a30,11,multiplayer_transport_remove_selector_view_entry_from_store,shell,cdecl,inferred,objdump + local disassembly,3,"Tiny selector-view store remover. It tailcalls the keyed-container erase helper `0x58f970` against the selector-view store rooted at `[this+0xab4]` using the caller entry pointer in `edx`. Current grounded callers are `multiplayer_transport_clear_selector_view_entry_slot_and_remove_if_empty` `0x594fb0` and `multiplayer_transport_rekey_selector_view_entry_preserving_slot_runtime` `0x595010`.","objdump + local disassembly + caller inspection"
0x00594a40,80,multiplayer_transport_find_selector_view_entry_by_name,shell,cdecl,inferred,objdump,3,"Looks up one selector-view entry by its bounded name string. It copies up to `0x40` bytes of the caller key into a local buffer, then probes the keyed selector-view store rooted at `[this+0xab4]` through `0x58f9c0` and returns the matching entry pointer or null. Current grounded callers include multiplayer_transport_set_selector_slot_flags, multiplayer_transport_merge_selector_mode_mask, multiplayer_transport_upsert_selector_name_entry, and several later selector-view formatting helpers.","objdump + caller xrefs"
0x00594e30,52,multiplayer_transport_count_selector_view_entries_with_slot_flag20_and_optional_name_match,shell,cdecl,inferred,objdump + local disassembly,3,"Counts selector-view entries in the keyed store rooted at `[this+0xab4]` whose per-slot flag dword at `[entry+0x5c+slot*4]` carries bit `0x20`. When the optional caller string is nonnull it first requires that string to match the entry's leading name field through `0x5a57cf`; otherwise it counts every entry that passes the same flag test. Current grounded callers are the staged route-callback submit-result handler `0x595860` and the later selector-view decision helper at `0x59f9c0`, where both use slot `2` and the current transport name buffer at `[this+0x04]`.","objdump + local disassembly + caller inspection + selector-view-store correlation"
0x00594d50,28,multiplayer_transport_selector_view_entry_slot_has_presence_mask,shell,cdecl,inferred,objdump,3,"Small selector-view predicate over one slot-local flag dword. When the requested slot has a live pointer at `[entry+0x40+slot*4]`, it returns whether the paired slot flag word at `[entry+0x5c+slot*4]` carries either presence bit `0x20` or `0x40`. Current grounded caller is multiplayer_transport_filter_insert_refreshable_selector_view_entry, which uses slot `2` to bias entry ordering and dedupe inside the periodic refreshable-entry collector.","objdump + caller xrefs"
0x00594d70,21,multiplayer_transport_selector_view_entry_has_gml_disconnect_gate,shell,cdecl,inferred,objdump,3,"Tiny selector-view predicate used only in the current grounded `GML` control path. It returns nonzero only when the selector-view entry participates in the third selector slot through `[entry+0x48]` and bit `0x20` is set in the entry flag word at `[entry+0x64]`. The current grounded caller is multiplayer_transport_handle_gml_or_png_selector_control, where it gates the `GML Disconnected` branch before the transport forces one status-pump pass, emits callback slot `16`, and re-enters route mode `5`.","objdump + caller xrefs + strings"
0x0059f5c0,20,multiplayer_transport_callback_arm_deferred_close_and_enqueue_slot23,shell,cdecl,inferred,objdump,2,"Small callback-root helper installed through the transport-side callback descriptor table at `0x59f5c0`. It takes the owner transport pointer from the first stack argument, sets deferred-close latch `[this+0x1edc]` to one, and then forwards into multiplayer_transport_enqueue_callback_slot23.","objdump + caller xrefs"
0x00594150,65,multiplayer_transport_schedule_selector_view_entry_refresh_probe,shell,cdecl,inferred,objdump,3,"Arms one deferred refresh probe for a selector-view entry when no probe is already pending at `[entry+0x74]`. It schedules callback `0x594110` after `0x1388` ms, latches the pending flag at `[entry+0x74]`, stores the current tick count at `[entry+0x68]`, and clears the entry-local transient field at `[entry+0xa8]`. The current grounded caller is the periodic selector-view service path at `0x594540`.","objdump + caller xrefs"
0x005941a0,376,multiplayer_transport_filter_insert_refreshable_selector_view_entry,shell,cdecl,inferred,objdump,3,"Store-walk callback used by the periodic selector-view service path. It filters one selector-view entry before insertion into a temporary refresh list: the entry must have local backing at `[entry+0xa0]`, live state at `[entry+0x58]`, no pending probe at `[entry+0x74]`, and no blocker at `[entry+0x4c]`; if slot pointers `[entry+0x40]`, `[entry+0x44]`, or `[entry+0x48]` are present, the corresponding slot flag words `[entry+0x5c]`, `[entry+0x60]`, and `[entry+0x64]` must not carry mask `0x0c`, which matches the `g`/`a` bits produced by multiplayer_transport_parse_selector_mode_letters. Eligible entries then pass slot-aware retry timing based on `[entry+0x68]`, `[entry+0x6c]`, `[entry+0x78]`, and `[entry+0x7c]`, after which the helper inserts the entry into the caller list while biasing third-slot entries through multiplayer_transport_selector_view_entry_slot_has_presence_mask and name comparisons.","objdump + caller xrefs + existing slot-flag map"
0x00594320,115,multiplayer_transport_collect_refreshable_selector_view_entries,shell,cdecl,inferred,objdump,3,"Collects a bounded list of refreshable selector-view entries from the keyed selector-view store rooted at `[this+0xab4]`. It clears the caller count to at most `0x0c` entries, walks the store through callback `0x5941a0`, and returns the finished temporary entry pointer list. The current grounded caller is the periodic selector-view service path at `0x594540`, which then schedules deferred refresh probes for the collected entries.","objdump + caller xrefs"
0x005940d0,61,multiplayer_transport_finish_selector_view_refresh_probe_if_matching,shell,cdecl,inferred,objdump,3,"Probe-completion callback used by the deferred selector-view refresh path. When the entry still has a pending probe at `[entry+0x74]`, live selector-view state at `[entry+0x58]`, and the callback request id matches `[entry+0x50]`, it clears the pending latch. Result `-1` increments the consecutive-failure counter at `[entry+0x7c]`; any other result forwards the returned payload pointer into multiplayer_transport_commit_selector_view_refresh_probe_success.","objdump + caller xrefs"
0x00594110,48,multiplayer_transport_dispatch_selector_view_refresh_probe_result,shell,cdecl,inferred,objdump,3,"Deferred callback shim for selector-view refresh probes. It walks the keyed selector-view store at `[transport+0xab4]` and runs multiplayer_transport_finish_selector_view_refresh_probe_if_matching against each entry using the completed request descriptor on the stack. Current grounded caller is multiplayer_transport_schedule_selector_view_entry_refresh_probe.","objdump + caller xrefs"
0x00593f00,171,multiplayer_transport_commit_selector_view_refresh_probe_success,shell,cdecl,inferred,objdump,3,"Success path for one selector-view refresh probe. It increments the probe-success generation at `[entry+0x78]`, clears the consecutive-failure counter at `[entry+0x7c]`, stamps the last-success tick at `[entry+0x6c]`, writes the returned probe sample into the rolling history at `[entry+0x84..]`, grows the bounded sample-count at `[entry+0x94]` up to four, computes the current averaged millisecond sample into `[entry+0x80]`, increments total-success count `[entry+0x98]`, and publishes that averaged `ms` value through multiplayer_transport_enqueue_callback_slot24_record.","objdump + caller xrefs"
0x00594b60,104,multiplayer_transport_arm_selector_view_probe_tracking,shell,cdecl,inferred,objdump,3,"Resolves one selector-view entry by name and arms its fast probe-tracking fields. It stores the parsed probe request id at `[entry+0x50]`, stores the parsed displayed version/build companion integer at `[entry+0x54]`, sets the live probe gate at `[entry+0x58]`, and refreshes the per-slot dirty gates at `+0xa0/+0xa4/+0xa8` for any active selector slots through multiplayer_transport_mark_selector_slot_views_dirty. Current grounded callers are the profile-key callback-table lanes around `0x596a18` and `0x59f929`, both after parsing one `X...X|%d` marker through `0x5977b0`.","objdump + caller xrefs"
0x005943a0,231,multiplayer_transport_stage_selector_view_progress_snapshot,shell,cdecl,inferred,objdump,3,"Slow selector-view sidecar helper reached from multiplayer_transport_service_selector_view_refresh_cycle after multiplayer_transport_select_stale_selector_view_progress_entry picks one candidate. It requires the entry-local progress gate at `[entry+0xa4]`, rebuilds the local core `X%sX` probe marker from request id `[entry+0x50]` through multiplayer_transport_format_selector_view_probe_marker_core, formats one `PNG %s %d` line around that marker and the averaged millisecond sample at `[entry+0x80]`, appends up to three selector-slot-specific `PNG` fragments when the corresponding slot pointers and generation counters are live, then marks the entry progress snapshot in-flight at `[entry+0x9c]` and stamps both `[entry+0x70]` and the transport-wide throttle tick `[transport+0xaec]`. Current evidence still does not show the wider `|%d` companion suffix being emitted on this path.","objdump + caller xrefs + strings + marker-format correlation"
0x00594490,83,multiplayer_transport_pick_stale_selector_view_progress_entry,shell,cdecl,inferred,objdump,3,"Store-walk callback used by multiplayer_transport_select_stale_selector_view_progress_entry. It only considers selector-view entries whose slow progress gate `[entry+0xa4]` is set, blocker `[entry+0x4c]` is clear, total-success count `[entry+0x98]` is nonzero, and in-flight progress latch `[entry+0x9c]` is clear; among those, it requires at least `0x1388` ms since the last progress tick `[entry+0x70]` and keeps the stalest candidate in the caller scratch slot.","objdump + caller xrefs"
0x005944f0,69,multiplayer_transport_select_stale_selector_view_progress_entry,shell,cdecl,inferred,objdump,3,"Walks the keyed selector-view store at `[transport+0xab4]` through callback `0x594490` and returns the stalest eligible selector-view entry for the slow progress-snapshot lane, or null when none qualify. Current grounded caller is multiplayer_transport_service_selector_view_refresh_cycle.","objdump + caller xrefs"
0x00594540,214,multiplayer_transport_service_selector_view_refresh_cycle,shell,thiscall,inferred,objdump,3,"Recurring selector-view maintenance pass beneath the multiplayer transport frame owner. When the selector-view layer is enabled and not blocked by the `g`/`a` route gates at `[this+0xb44]` and `[this+0x180c]`, it first rate-limits and runs the fast probe lane by collecting refreshable entries through multiplayer_transport_collect_refreshable_selector_view_entries and scheduling deferred probes through multiplayer_transport_schedule_selector_view_entry_refresh_probe. It then runs a slower sidecar lane every `0x7d0` ms by selecting one stale progress entry through multiplayer_transport_select_stale_selector_view_progress_entry and staging a progress snapshot through multiplayer_transport_stage_selector_view_progress_snapshot before falling into the shared timer service at `0x5a05d0`.","objdump + caller xrefs"
0x0059f3c0,498,multiplayer_transport_handle_gml_or_png_selector_control,shell,cdecl,inferred,objdump,3,"Small control-token handler reached from the slot-`25` selector-view callback lane after multiplayer_transport_split_selector_payload_token_and_tail. When the token is `GML` and the tail is `Disconnected`, it requires the current selector-view entry to pass multiplayer_transport_selector_view_entry_has_gml_disconnect_gate, then forces one status-pump pass, emits callback slot `16` with the tail text, and re-enters route mode `5`. Its sibling `PNG` branch resolves a named selector-view entry from the tail text and, when that entry overlaps the active selector-slot ownership, refreshes selector-view runtime state through `0x5948f0` and republishes callback slot `25`.","objdump + caller xrefs + strings"
0x0059f650,193,multiplayer_transport_callback_dispatch_selector_name_payload_lane,shell,cdecl,inferred,objdump,3,"Main selector-name branch in the second transport-side callback descriptor lane. It first classifies the incoming payload through multiplayer_transport_is_selector_control_line. `@@@NFO` control lines resolve one selector-view entry through multiplayer_transport_find_selector_view_entry_by_name and forward into multiplayer_transport_sync_selector_view_nfo_r_flag; non-control mode-`3/4` payloads split through multiplayer_transport_split_selector_payload_token_and_tail and publish callback slot `14`; and the remaining non-control payloads publish callback slot `13`.","objdump + caller xrefs + strings"
0x0059f720,289,multiplayer_transport_callback_dispatch_current_selector_payload_lane,shell,cdecl,inferred,objdump,3,"Sibling callback root that first resolves the current selector through `0x5951a0` and then dispatches one payload against that active selector context. It reuses multiplayer_transport_is_selector_control_line, the `@@@GML` and `@@@NFO` control tokens, and the shared token-tail splitter at `0x59f320`: `@@@NFO` lines flow into multiplayer_transport_sync_selector_view_nfo_r_flag, `@@@GML` lines plus mode-`3/4` payloads feed callback slot `10`, and the remaining non-control payloads feed callback slot `9`.","objdump + caller xrefs + strings"
0x0059f850,87,multiplayer_transport_callback_reset_selector_and_enqueue_slot19,shell,cdecl,inferred,objdump,2,"Callback-root helper from the second transport-side descriptor lane. It resolves the current selector slot through `0x5951a0`, resets that selector text path through `0x5954b0`, forwards the supplied selector-name pair through multiplayer_transport_enqueue_callback_slot19, and when the resolved selector is `2` plus route mode is still active it re-enters multiplayer_transport_set_route_mode with mode `1`.","objdump + caller xrefs"
0x00594bd0,97,multiplayer_transport_set_selector_slot_flags,shell,cdecl,inferred,ghidra-headless,3,Updates one selector-slot flag dword at [entry+0x5c] after resolving the current selector entry through 0x00594a40. When selector index `2` flips bit `1` it forwards the new bit value through multiplayer_transport_enqueue_callback_slot15_record and then notifies the shared selector-change callback path through 0x00593250 with selector id old flags and new flags.,ghidra + rizin + llvm-objdump
0x00594c40,103,multiplayer_transport_parse_selector_mode_letters,shell,cdecl,inferred,ghidra-headless,3,Parses one selector-mode letter string into a small bitmask by probing for the letters `s` `r` `g` `a` and `h`. Current grounded callers merge this mask into the selector-slot flags that live at [entry+0x5c].,ghidra + rizin + llvm-objdump + strings
0x00594cb0,65,multiplayer_transport_merge_selector_mode_mask,shell,cdecl,inferred,ghidra-headless,3,Resolves one selector entry through 0x00594a40 parses the caller mode-letter string through multiplayer_transport_parse_selector_mode_letters preserves the current presence bits 0x20 and 0x40 from [entry+0x5c] and commits the merged result through multiplayer_transport_set_selector_slot_flags.,ghidra + rizin + llvm-objdump + strings
0x00594d00,72,multiplayer_transport_set_selector_presence_mask,shell,cdecl,inferred,ghidra-headless,3,Overwrites the selector presence bits 0x20 and 0x40 in [entry+0x5c] from one caller byte mask while preserving the rest of the selector-slot flags. The helper then commits the new value through multiplayer_transport_set_selector_slot_flags.,ghidra + rizin + llvm-objdump
0x00594f20,142,multiplayer_transport_upsert_selector_name_entry,shell,cdecl,inferred,ghidra-headless,3,Looks up or creates one selector-name entry for the requested selector slot. It resolves the current slot entry through 0x594a40 allocates a new entry through 0x594e70 when no match exists marks the selector index active at [entry+0x40+slot*4] increments the per-slot generation counter at [this+0xab8+slot*4] applies the caller flag bits 0x20 and 0x40 into [entry+0x5c+slot*4] and then marks the slot views dirty through multiplayer_transport_mark_selector_slot_views_dirty. Current grounded callers come from multiplayer_transport_handle_names_query_response and multiplayer_transport_handle_selector_update_response.,ghidra + rizin + llvm-objdump
0x00594fb0,93,multiplayer_transport_clear_selector_view_entry_slot_and_remove_if_empty,shell,cdecl,inferred,objdump + local disassembly,3,"Resolves one selector-view entry by name, clears the requested selector-slot ownership pointer at `[entry+0x40+slot*4]`, decrements the paired generation counter at `[this+0xab8+slot*4]`, clears the corresponding slot-flag dword at `[entry+0x5c+slot*4]`, and refreshes selector-view side effects through `0x594790`. When all three slot ownership pointers at `[entry+0x40]`, `[entry+0x44]`, and `[entry+0x48]` are then null it removes the whole keyed entry through `multiplayer_transport_remove_selector_view_entry_from_store` `0x594a30` before notifying `0x596900`. Current grounded callers are the later selector-view callback root at `0x59f9c0` and the keyed store-walk helper at `0x5950a0`.","objdump + local disassembly + caller inspection"
0x00595010,102,multiplayer_transport_rekey_selector_view_entry_preserving_slot_runtime,shell,cdecl,inferred,objdump + local disassembly,3,"Rekeys one selector-view entry under a new bounded name while preserving its slot-local runtime block. It resolves the old entry by name, copies the `0x1b`-dword runtime band rooted at `[entry+0x40]` into stack scratch, removes the old keyed entry through `multiplayer_transport_remove_selector_view_entry_from_store` `0x594a30`, allocates or resolves the replacement entry through `0x594e70`, restores the copied runtime band into `[new_entry+0x40]`, and then refreshes the surrounding selector-name side through `0x596c10`. Current grounded caller is the adjacent selector callback root at `0x59fab0`.","objdump + local disassembly + caller inspection"
0x005950a0,36,multiplayer_transport_clear_selector_view_slot_from_all_entries,shell,cdecl,inferred,objdump + local disassembly,3,"Walks the keyed selector-view store at `[this+0xab4]` and clears one selector slot from every entry that still owns it. The local store-walk callback `0x595080` checks `[entry+0x40+slot*4]` and, when present, forwards into `multiplayer_transport_clear_selector_view_entry_slot_and_remove_if_empty` `0x594fb0`. Current grounded callers are `multiplayer_transport_reset_selector_slot` `0x5954b0` and the later callback root `0x59fb60`.","objdump + local disassembly + caller inspection"
0x005950d0,101,multiplayer_transport_reset_selector_tables,shell,cdecl,inferred,ghidra-headless,4,Resets the three selector registration tables rooted at [this+0x80] [this+0x390] and [this+0x39c] together with state at [this+0x9a8] and [this+0x9ac]. When [this+0xab0] is set it preserves selector slot `0`; otherwise it clears all three selector slots.,ghidra + rizin + llvm-objdump
0x00595140,89,multiplayer_transport_set_selector_name,shell,cdecl,inferred,ghidra-headless,4,Copies one selector name into the fixed 0x101-byte selector-name slot at [this+0x80+index*0x101] when the caller string fits. It then marks the selector present at [this+0x384+index*4] and clears the paired transient pointer at [this+0x99c+index*4].,ghidra + rizin + llvm-objdump
0x005951a0,67,multiplayer_transport_find_selector_name,shell,cdecl,inferred,ghidra-headless,4,Scans the three selector-name slots rooted at [this+0x80] for an exact string match and returns the matching selector index through the caller pointer. The callback-slot wrapper family uses this helper before enqueueing several selector-bound opcode records.,ghidra + rizin + llvm-objdump
0x005951f0,579,multiplayer_transport_service_status_pump,shell,cdecl,inferred,ghidra-headless,3,Central session-event transport status-pump and route-service loop. It inspects selector presence under [this+0x384] and [this+0x390] builds temporary selector-mode masks through multiplayer_transport_parse_selector_mode_letters emits status text and field updates through multiplayer_transport_append_setchankey_or_setckey_command multiplayer_transport_dispatch_field_snapshot_mode and related helpers and drives the deeper route-state machine through multiplayer_transport_init_selector_slot multiplayer_transport_reset_selector_slot 0x005965d0 0x0059f3c0 and related helpers.,ghidra + rizin + llvm-objdump + strings
0x00595440,98,multiplayer_transport_init_selector_slot,shell,cdecl,inferred,ghidra-headless,3,Initializes one selector slot under [this+0x384] and [this+0x390]. It copies caller text or the default sample at 0x005c87a8 into the fixed selector buffer at [slot+0x39c] clears byte [slot+0x59b] reruns multiplayer_transport_service_status_pump and then notifies multiplayer_transport_submit_profile_key_query_bundle_default for the refreshed selector slot.,ghidra + rizin + llvm-objdump + strings
0x005954b0,238,multiplayer_transport_reset_selector_slot,shell,cdecl,inferred,ghidra-headless,3,Resets one selector slot under [this+0x384] and [this+0x390]. When the slot is active it tears the current selector object down through 0x593460 optionally republishes caller text through 0x58e7a0 refreshes selector bookkeeping through 0x5950a0 and clears the active and present flags before returning.,ghidra + rizin + llvm-objdump
0x00595620,35,multiplayer_transport_release_route_binding,shell,cdecl,inferred,ghidra-headless,3,Releases the current route binding stored at [this+0x1ec8]. It detaches the binding from the descriptor object at [this+0x1ed0] through 0x58f3c0 unlinks it through 0x5933a0 and clears [this+0x1ec8].,ghidra + rizin + llvm-objdump
0x00595650,688,multiplayer_transport_set_route_mode,shell,cdecl,inferred,ghidra-headless,3,"Main route-mode state machine for the session-event transport. It latches the requested small mode at [this+0x18b8] and now has a clearer branch split: mode `0` enters the gsi_am_rating direct-versus-queued descriptor lane, mode `1` applies the ready-bit gate plus queued fallback, mode `2` performs pending-descriptor cleanup, mode `3` forces the empty-table fallback, mode `4` handles the deferred route-status recovery branch, and mode `5` mirrors the staged route companion dword into the local cache family. The stable transitions still converge by tearing live routes down through multiplayer_transport_release_live_route and rebuilding them through multiplayer_transport_try_connect_live_route rather than mutating the live route object's callback slots in place. The branch uses multiplayer_transport_release_live_route multiplayer_transport_try_seed_am_rating_route_table multiplayer_transport_try_connect_live_route and multiplayer_transport_release_route_binding to converge on the next stable mode.","ghidra + rizin + llvm-objdump + strings"
0x00595860,125,multiplayer_transport_handle_staged_route_callback_submit_result,shell,cdecl,inferred,objdump + local disassembly,3,"Completion callback used by `multiplayer_transport_try_stage_route_callback_payload` `0x5958e0`. On a nonzero submit result it first checks whether the third selector-generation counter at `[this+0xac0]` exceeds `1`; when it does, the helper counts matching selector-view entries for slot `2` through `0x594e30` using the current transport name buffer at `[this+0x04]`. A positive count advances the route-mode state machine through mode `3`, and when the transport remains in route mode `3` and the same third selector-generation counter has reached the target at `[this+0xb48]` it advances once more through mode `4`. Otherwise, and on the zero-result path too, it resets selector slot `2` to the default sample through `multiplayer_transport_reset_selector_slot` `0x5954b0`; when the current route mode is still `2` it then re-enters `multiplayer_transport_set_route_mode` `0x595650` with mode `2`. This now bounds the callback as a real staged-route-capacity submit result handler rather than a generic route-mode nudge.","objdump + local disassembly + caller correlation + selector-generation correlation"
0x005958e0,156,multiplayer_transport_try_stage_route_callback_payload,shell,cdecl,inferred,ghidra-headless,3,"Builds one staged route-callback payload from the caller route object and transport-local text buffer at `[this+0x60]`. It extracts a small compact descriptor tuple from the caller route object through `0x58d1f0`, `0x58d220`, `0x58d240`, and `0x58d250` or `0x58d200`, packs that tuple through multiplayer_transport_format_route_binding_gsp_payload, submits the staged text through `multiplayer_transport_submit_selector_text_route_request` `0x593c40` using callback `multiplayer_transport_handle_staged_route_callback_submit_result` `0x595860`, and on success stores the cloned callback payload returned by multiplayer_transport_clone_staged_callback_payload at `[this+0xb50]`. The same descriptor family later reappears in the route-binding compatibility gate at `0x595d00`, so this payload lane is now bounded as a real route-binding descriptor publisher rather than a pure presentation helper. Current evidence does not yet prove this tuple is the same field family as the selector-view probe marker companion integer at `[entry+0x54]`.","ghidra + rizin + llvm-objdump + strings + later compatibility correlation + descriptor-layout correlation + callback correlation"
0x00595d00,83,multiplayer_transport_route_binding_matches_route_callback_descriptor_tuple,shell,cdecl,inferred,objdump,3,"Small compatibility gate over one staged route-callback payload versus the current bound route object. It compares the caller payload's primary descriptor dword through `0x58d1f0` against bound-route field `[binding+0x54]`; when payload byte-flag getter `0x58d220` carries bit `0x2`, it also requires getter `0x58d240` to match `[binding+0x58]` and getter `0x58d250` to match word `[binding->route+0x30]`; otherwise it falls back to getter `0x58d200` against that same route word. Current grounded caller is multiplayer_transport_check_openstaging_capacity_gate at `0x595d60`, where this tuple check can short-circuit the broader capacity path. This row is now intentionally scoped to the route-binding descriptor family, not the selector-view `X...X|%d` marker tuple.","objdump + caller inspection + descriptor-getter correlation + route-binding-layout correlation"
0x00595980,84,multiplayer_transport_handle_route_status_result,shell,cdecl,inferred,ghidra-headless,2,Completion callback used by multiplayer_transport_submit_route_status_request. When the callback result is nonzero it compares the third selector-generation counter at [this+0xac0] against the current route-status target at [this+0xb48] and advances the route-mode state machine through mode `2` or modes `3` or `4`. When the callback result is zero it sets [this+0x1ed8] and re-enters multiplayer_transport_set_route_mode using the current am-rating route state at [this+0x1ed4].,ghidra + rizin + llvm-objdump + selector-generation correlation
0x005959e0,81,multiplayer_transport_submit_route_status_request,shell,cdecl,inferred,ghidra-headless,3,Submits one route-status request for the current binding at [this+0x1ec8]. It gathers the binding fields at +0x2c and +0x30 together with the local counter at [this+0xb48] and default sample text at 0x005c87a8 then sends that request through 0x593980 using multiplayer_transport_handle_route_status_result as the completion callback. Failure sets [this+0x1ed8] so the route-mode setter can fall back immediately.,ghidra + rizin + llvm-objdump
0x00596270,70,multiplayer_transport_clone_staged_callback_payload,shell,cdecl,inferred,ghidra-headless,3,Clones one staged route-callback payload block by allocating a same-sized object through 0x58d5b0 copying the first nine dwords and then registering a cleanup callback through 0x58fa00 with shim 0x596260. Current grounded caller is multiplayer_transport_try_stage_route_callback_payload.,ghidra + rizin + llvm-objdump
0x00597720,96,multiplayer_transport_format_route_binding_gsp_payload,shell,cdecl,inferred,ghidra-headless,3,"Formats one route-binding or callback payload with the `#GSP!%s!%c%s%c` template at `0x005e2358`. It takes the caller text payload in `esi`, then wraps one encoded descriptor fragment with either `X...X` or `M...M` depending on whether the global formatter state at `0x00dba4c4` is present. On the simpler branch it encodes the primary descriptor dword through `0x597590` and chooses wrapper char `0x58` (`X`); on the mixed branch it folds two dwords plus one normalized word through `0x5976c0` and chooses wrapper char `0x4d` (`M`). It then emits the final `#GSP!` line through `0x5a19c4`. Current grounded callers are multiplayer_transport_submit_bound_route_request and multiplayer_transport_try_stage_route_callback_payload.","ghidra + rizin + llvm-objdump + strings + route-binding-payload correlation"
0x005977b0,127,multiplayer_transport_parse_selector_view_probe_marker,shell,cdecl,inferred,objdump,3,"Parses one selector-view probe marker in the local `X%sX|%d` family. It requires a length of at least `0x0c`, accepts the marker only when byte `0` or byte `9` is `X`, decodes the wrapped request-id fragment through `0x597630`, parses the decimal tail after the `|` through `0x5a1ea5`, and returns those two values through caller output pointers as `(probe request id, displayed version/build integer)`. Current grounded callers are the profile-key callback lanes at `0x596a01` and `0x59f912`, which forward that tuple into multiplayer_transport_arm_selector_view_probe_tracking.","objdump + caller xrefs + format string"
0x00597840,30,multiplayer_transport_format_selector_view_probe_marker_core,shell,cdecl,inferred,objdump,3,"Formats the core `X%sX` wrapper used inside the selector-view probe marker family. It encodes the caller request id through `0x597590`, wraps the result with sentinel `X` bytes, and terminates the destination buffer at byte `0x0a`. Current grounded caller is multiplayer_transport_stage_selector_view_progress_snapshot, which uses `[entry+0x50]` as the marker id when building `PNG %s %d` progress lines. The trailing `|%d` companion integer from the wider `X%sX|%d` family is parsed by `0x5977b0`, but current evidence does not show it being emitted here.","objdump + caller xrefs + format string + staged-progress correlation"
0x00593980,382,multiplayer_transport_submit_bound_route_request,shell,cdecl,inferred,ghidra-headless,3,"Builds and submits one bound-route request using the current transport text buffers and a caller-supplied binding id or fallback route id. It formats the request payload through multiplayer_transport_format_route_binding_gsp_payload allocates a type `1` transient request record through 0x5934e0 and stages the same three transport wrapper metadata dwords later consumed from work fields `+0x0c/+0x10/+0x18` on the completion side publishes selector `2` text through multiplayer_transport_set_selector_name and finally submits the request through 0x58e720 using multiplayer_transport_handle_bound_route_request. A nonempty caller text sample sets [this+0xb4c].","ghidra + rizin + llvm-objdump + strings + work-record-triplet correlation"
0x00593b00,161,multiplayer_transport_handle_selector_update_response,shell,cdecl,inferred,ghidra-headless,3,"Follow-up callback used by `multiplayer_transport_handle_selector_text_route_request`. When the callback succeeds it initializes or repopulates selector slot `[req+0x1c]` through `multiplayer_transport_init_selector_slot` and `multiplayer_transport_upsert_selector_name_entry`. When it fails it resets that selector slot. Both paths finish by enqueueing a route record through `multiplayer_transport_probe_or_enqueue_route_record` using the staged work fields `(callback fn +0x10, callback companion +0x18, drain context id +0x0c)` plus the request-local selector slot id at `+0x1c`, then unlinking the request through `0x5933a0`.","ghidra + rizin + llvm-objdump + local disassembly + callback-triplet correlation"
0x00593bb0,144,multiplayer_transport_handle_selector_text_route_request,shell,cdecl,inferred,ghidra-headless,3,Completion callback for multiplayer_transport_submit_selector_text_route_request. If the request is already stale at +0x38 it clears the transient state through 0x5962c0 and unlinks the request. On nonzero result it schedules multiplayer_transport_handle_selector_update_response through multiplayer_transport_submit_names_query_with_callback. On zero result it resets selector slot [req+0x1c] and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request.,ghidra + rizin + llvm-objdump
0x00593c40,177,multiplayer_transport_submit_selector_text_route_request,shell,cdecl,inferred,ghidra-headless,3,"Builds and submits one selector-text route request. It validates the caller text defaults the sample text to 0x005c87a8 allocates a type `2` transient request record through 0x5934e0 stores the selector id at +0x1c stages the same three transport wrapper metadata dwords later consumed from work fields `+0x0c/+0x10/+0x18` refreshes selector naming through 0x59fc80 and multiplayer_transport_set_selector_name and then submits the request through 0x58e720 using multiplayer_transport_handle_selector_text_route_request.","ghidra + rizin + llvm-objdump + strings + work-record-triplet correlation"
0x00595a40,245,multiplayer_transport_dispatch_field_snapshot_mode,shell,cdecl,inferred,ghidra-headless,3,"Dispatches several session-field snapshot update modes into multiplayer_transport_enqueue_field_snapshot_record. Current grounded cases are tighter now: mode `0` enqueues one descriptor-backed snapshot and, when descriptor ready bit `0x1` is still clear, also inserts that descriptor into the local field-cache family `[this+0x1724]` with pending tag `0x4`; mode `1` enqueues the same snapshot without cache insertion; mode `2` removes descriptors carrying pending state bits `0x04/0x08` from that local field-cache family before enqueueing; mode `3` clears progress scalar `[this+0x1774]` and resets the callback payload to zero; mode `4` enqueues one empty selector snapshot through mode `0`; and mode `5` copies the transport-staged route companion dword from `[this+0x490]` into `[this+0x54]` while mirroring that same value into the field-cache subslot `[this+0x1724+0x24]` through `multiplayer_gamespy_server_descriptor_queue_set_companion_dword_filter` `0x005a0940`, not into `[this+0x1778]`. Queue service later promotes pending tag `0x4` into ready bit `0x1`.","ghidra + rizin + llvm-objdump + strings + queue-state correlation + caller inspection + local disassembly + companion-dword-slot correlation"
0x00595b60,25,multiplayer_transport_enqueue_field_snapshot_mode1_if_enabled,shell,cdecl,inferred,ghidra-headless,2,Tiny field-snapshot wrapper that enqueues one mode-1 field snapshot only when the caller enable flag is zero. The helper is a thin front end over multiplayer_transport_enqueue_field_snapshot_record.,ghidra + rizin + llvm-objdump
0x00595b80,50,multiplayer_transport_clear_progress_field_cache,shell,cdecl,inferred,ghidra-headless,3,Clears the progress-related field cache rooted at [this+0xba0] and then clears the local field cache at [this+0x1724]. It finishes by forwarding opcode type `3` into 0x005929a0 to remove matching active field-snapshot records from the active opcode collection at [this+0x17fc].,ghidra + rizin + llvm-objdump + strings + local disassembly
0x00595bc0,272,multiplayer_transport_enqueue_capacity_descriptor_record,shell,cdecl,inferred,objdump,3,"Builds and enqueues one opcode-`2` descriptor-block record tied to the local capacity or occupancy sidecar at `[this+0x1778]`. Current evidence now bounds that sidecar more tightly: it behaves as one cached pointer into the transient transport work-record family rooted at `[this+0x1780]`, because every meaningful branch in this helper first reads that pointer and then consumes the familiar work-record metadata triplet at `+0x0c/+0x10/+0x18`. Mode `0` is the live append-notify branch, lining up directly with the generic descriptor owner callback at `0x590370`: it samples the current descriptor's primary IPv4, `hostname`, `numwaiting`, `maxwaiting`, `numservers`, and `numplayers` properties through `0x58d1f0`, `0x58d170`, and `0x58d6d0`, then packs a populated seven-dword descriptor payload through `multiplayer_transport_enqueue_descriptor_block_record` `0x592ae0` while also carrying the same outer callback-wrapper triplet as `(drain context id [cache+0x0c], callback fn [cache+0x10], callback companion [cache+0x18])`. Modes `3` and `5` are the live receive-state callbacks sourced by `multiplayer_transport_route_callback_table_service_live_socket_and_feed_decode_machine` `0x5911e0` and its inner decode state machine `0x5908c0`: they deliberately enqueue an all-zero seven-dword descriptor payload, forward only that same stored callback-wrapper triplet in the outer slots, and then unlink the cached work record through `0x5933a0`, using `EDX=1` for mode `3` and `EDX=0` for mode `5`. Modes `1`, `2`, and `6` are now explicitly bounded too: compact-descriptor upsert notifies mode `1` through `0x590d00`, generic removal notifies mode `2` through `0x590430`, and the receive-header gate notifies mode `6` through `0x5908c0`, but this capacity owner falls through without staging any descriptor block for those modes. The negative result is stronger now too: direct local field-xref scans hit neighboring lifecycle fields `[this+0x176c]`, `[this+0x1770]`, `[this+0x1774]`, `[this+0x177c]`, `[this+0x1780]`, and `[this+0x1784]`, while the owned transient-work lifecycle at `0x593330/0x593370/0x593380/0x5934e0/0x5933a0` and the neighboring active-opcode reset path at `0x5929a0` still never touch `[this+0x1778]`; constructor, recurring service, reset, teardown, and route-callback-table setup scans around `0x58dc50/0x596090/0x596210/0x596060/0x5961b0/0x5962e0/0x596530` likewise seed or clear the surrounding route tables and replay-band neighbors without ever seeding `[this+0x1778]`. The constructor proof is now explicit too: `0x58dc50` bulk-zeroes the full `0x1ee4`-byte transport body and still never writes a nonzero value into `[this+0x1778]`. Broader local text scans also fail to show any `lea`-based replay-band writer or a block-copy owner spanning the whole `0x176c..0x1784` band. A full-binary literal offset sweep now tightens that further: the only direct `0x1778` hit in `RT3.exe` is this read at `0x595bce`. The callback-binding family now sharpens that boundary too: `0x5934e0` stages the shared work-record metadata triplet, `0x593650` binds it into the callback-table worker path, and `0x593570` later consumes and republishes it, while `[this+0x1778]` still appears only as the borrowed sidecar read in this helper. So the sidecar producer remains upstream of the mapped binary and is now best treated as an external callback or worker handoff rather than one missing ordinary direct, derived-address, literal-offset, constructor-side, or higher callback-owner lifecycle store. Current evidence therefore bounds this as a real capacity or occupancy descriptor publisher over one cached borrowed work record, not a vague route-progress helper or a custom replay-scalar blob.","objdump + local disassembly + strings + capacity-cache correlation + work-record correlation + descriptor-block correlation + mode split correlation + opcode2-payload correlation + generic-owner-mode correlation + negative-xref correlation + callback-triplet correlation + neighboring-field-lifecycle correlation + live-receive-owner correlation + negative-derived-address-scan + constructor-teardown-band scan + full-binary literal-offset scan + request-collection-lifecycle correlation + constructor-zero-init correlation + explicit-owner-mode-noop correlation + higher-owner-lifecycle correlation + callback-binding-boundary correlation"
0x00595ce0,22,multiplayer_transport_clear_capacity_descriptor_route_callback_table,shell,cdecl,inferred,objdump + local disassembly,3,"Clears the auxiliary capacity-descriptor route callback table when `[this+0xba0]` is present by forwarding the embedded runtime at `[this+0x1164]` into `multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime` `0x590740`. Current grounded callers use this before disconnect or larger route-state cleanup. The helper does not target the field-subscription table at `[this+0xba4]`; current evidence ties it specifically to the callback table whose owner handler is `multiplayer_transport_enqueue_capacity_descriptor_record` `0x595bc0`.","objdump + local disassembly + caller inspection + route-callback-table correlation"
0x00595d60,84,multiplayer_transport_check_openstaging_capacity_gate,shell,cdecl,inferred,ghidra-headless,2,Checks whether the current transport object still matches the cached openstaging-like descriptor and whether numplayers remains below maxplayers. When the cached route object at [this+0x1ecc] already matches the current transport identifiers it returns success immediately; otherwise it compares the current maxplayers and numplayers fields and on success falls into 0x00592710 for the caller's route transition path.,ghidra + rizin + llvm-objdump + strings
0x00595dc0,79,multiplayer_transport_try_transition_after_capacity_gate,shell,cdecl,inferred,ghidra-headless,2,"Rejects when `[this+0x1e8c]` or selector slot `[this+0x38c]` is busy, then runs `multiplayer_transport_check_openstaging_capacity_gate` `0x595d60`, refreshes route-side selector state through `0x5973b0` and `multiplayer_transport_reset_selector_slot` `0x5954b0` on slot `2`, forwards the caller descriptor into `multiplayer_transport_try_stage_route_callback_payload` `0x5958e0`, and on success transitions through `multiplayer_transport_set_route_mode` `0x595650` mode `0`. Current grounded callers are the ready-descriptor branch in `0x595e10` mode `1` and the mode-`0` fastpath in `0x595f70`.","ghidra + rizin + llvm-objdump + caller inspection"
0x00595e10,321,multiplayer_transport_dispatch_am_rating_route_event_mode,shell,cdecl,inferred,ghidra-headless,3,"Dispatches route-event modes for the `gsi_am_rating` callback branch rooted at the primary-endpoint table `[this+0x18bc]` and the queued descriptor family `[this+0x1e7c]`. Current grounded cases are tighter now: mode `0` uses descriptor flag-byte-`0x15` bit `0x1` to choose between direct primary-endpoint handling through `multiplayer_transport_primary_endpoint_table_upsert_descriptor_by_primary_ipv4_and_port` `0x00591330` and queued insertion through `multiplayer_gamespy_server_descriptor_queue_insert_with_pending_state_tag` `0x005a09a0`; mode `1` uses descriptor state-byte ready bit `0x2` to choose between immediate transition handling through `multiplayer_transport_try_transition_after_capacity_gate` `0x595dc0` and reinsertion into that same queue family, but then applies one second guard through flag bit `0x1`, which suppresses the direct transition path even when ready bit `0x2` is already present; mode `2` removes descriptors still carrying pending state bits `0x04/0x08` from the queued family through `0x005a0cd0`; mode `3` forces route mode `2` when the primary-endpoint table at `[this+0x18bc]` is empty; mode `4` updates `[this+0x1ed4]` and can switch transport mode based on the callback-table sentinel at `[this+0x18b8]` plus deferred descriptor pointer `[this+0x1ed8]`; and mode `5` copies the transport-staged route companion dword from `[this+0x490]` into `[this+0x54]` while mirroring that same value into the field-cache subslot `[this+0x1724+0x24]` through `multiplayer_gamespy_server_descriptor_queue_set_companion_dword_filter` `0x005a0940`, not into `[this+0x1778]`. The strongest current read is that flag byte `0x15` bit `0x1` marks primary-endpoint-seed or endpoint-only descriptors: those descriptors can be staged and enriched through the queue family, but they do not take the richer direct transition path used by clear-bit descriptors.","ghidra + rizin + llvm-objdump + am-rating-owner correlation + endpoint-table correlation + queued-descriptor correlation + queue-state correlation + caller inspection + transition-suppression correlation + raw-endpoint-seed correlation + companion-dword-slot correlation"
0x00595f70,237,multiplayer_transport_dispatch_am_rating_route_callback,shell,cdecl,inferred,ghidra-headless,3,"Callback handler for the `gsi_am_rating` route branch rooted at the primary-endpoint table `[this+0x18bc]`. Mode `0` forwards directly into multiplayer_transport_try_transition_after_capacity_gate. Mode `2` now has a cleaner ownership split: it walks the primary-endpoint table through `0x590470/0x590480`, prunes stale entries against multiplayer_transport_check_openstaging_capacity_gate, updates surviving entries through `0x58d130` using the `gsi_am_rating` key, and then either forces transport mode `2` when the table empties or forwards the surviving head descriptor into `0x5958e0` before transitioning through `0x595650` mode `0`.","ghidra + rizin + llvm-objdump + strings + endpoint-table correlation"
0x00596060,48,multiplayer_transport_reset_am_rating_route_state,shell,cdecl,inferred,ghidra-headless,3,"Small reset helper for the active `gsi_am_rating` route state. When `[this+0xba0]` is set it clears the primary-endpoint callback table at `[this+0x18bc]` through `0x590740`, resets `[this+0x1ec4]` to zero, and clears the queued descriptor family at `[this+0x1e7c]` through `0x5a0950`.",ghidra + rizin + llvm-objdump + strings
0x00596090,272,multiplayer_transport_init_route_callback_tables,shell,cdecl,inferred,ghidra-headless,3,"Initializes the transport-owned route callback tables at `[this+0xba4]`, `[this+0x1164]`, and `[this+0x18bc]` together with the descriptor caches at `[this+0x1724]` and `[this+0x1e7c]`. Current evidence now bounds the constructor lanes more tightly than the earlier handler-table note: it constructs `[this+0xba4]` through `multiplayer_transport_route_callback_table_construct` `0x5905e0` with owner callback `0x595a40`, shared owner cookie `this`, route-label buffers rooted at `[this+0xb58]` and `[this+0xb78]`, and schema or descriptor-owner pointer `[this+0xb98]`; it seeds the local field-cache family `[this+0x1724]` through `0x5a08f0` with helper `0x595b60`; it constructs `[this+0x1164]` through the same `0x5905e0` path but with owner callback `0x595bc0`; and it constructs `[this+0x18bc]` through `0x5905e0` with owner callback `0x595e10` before seeding `[this+0x1e7c]` through `0x5a08f0` with helper `0x595f70`. On success it also clears the staged route-callback payload slot `[this+0xb50]` and sets callback-table enable latch `[this+0xba0]` to `1`. This stronger lifecycle decode now makes the negative result around `[this+0x1778]` explicit too: the higher callback-owner bring-up seeds the surrounding route tables and replay-band caches without ever seeding that sidecar slot.","ghidra + rizin + llvm-objdump + handler-table correlation + local disassembly + constructor-argument correlation + latch-state correlation + higher-owner-lifecycle correlation"
0x005961b0,92,multiplayer_transport_teardown_route_callback_tables,shell,cdecl,inferred,ghidra-headless,4,"Full teardown for the transport-owned route callback tables. It first clears progress and local field-cache state through `0x595b80`, resets the capacity-descriptor route callback table at `[this+0x1164]` through `0x595ce0`, and then, when callback-table plumbing latch `[this+0xba0]` is set, destroys the callback tables at `[this+0xba4]`, `[this+0x1164]`, and `[this+0x18bc]` through `0x5907a0`, clears the related caches at `[this+0x1724]` and `[this+0x1e7c]` through `0x5a0970`, and resets `[this+0x1ec4]` to zero. Current grounded caller is `multiplayer_transport_disconnect` `0x58d830`.","ghidra + rizin + llvm-objdump + caller inspection + route-callback-table correlation"
0x00596210,71,multiplayer_transport_service_route_callback_tables,shell,cdecl,inferred,objdump,3,"Recurring service sweep for the transport-owned callback tables and descriptor caches. When route callback plumbing is enabled at `[this+0xba0]` it services the callback tables at `[this+0xba4]`, `[this+0x1164]`, and the `gsi_am_rating` primary-endpoint table `[this+0x18bc]` through the shared table-service helper `0x591290`, services the cache blocks at `[this+0x1724]` and the companion queued descriptor family `[this+0x1e7c]` through `multiplayer_gamespy_server_descriptor_queue_service_and_publish_empty_transition` `0x005a0c80`, and otherwise returns immediately. Current evidence now bounds those queue families more tightly too: service promotes pending descriptor state tags `0x4/0x8` into ready bits `0x1/0x2` before the higher transport-owned branches consume them. The current grounded caller is multiplayer_transport_service_frame, which makes this the callback-table side of the recurring multiplayer transport cadence. The same recurring sweep now also strengthens the negative replay-band result: it services all local owner tables surrounding `[this+0x1778]` without ever writing that sidecar slot.",objdump + am-rating-owner correlation + queue-state correlation + higher-owner-lifecycle correlation
0x005962c0,32,multiplayer_transport_clear_staged_route_callback_payload,shell,cdecl,inferred,objdump + local disassembly,3,"Clears the cloned staged route-callback payload handle at `[this+0xb50]`. When that slot is non-null the helper forwards the embedded owned object slot through `0x58d0d0`, then zeroes `[this+0xb50]`. Current grounded callers are the stale-request branch in `multiplayer_transport_handle_selector_text_route_request` `0x593bb0` and the selector-slot-`2` reset path around `0x595561`.","objdump + local disassembly + caller inspection + payload-slot correlation"
0x005962e0,583,multiplayer_transport_open_field_subscription_route_callback_table,shell,cdecl,inferred,objdump,3,"Builds and opens the field-subscription route callback table rooted at `[this+0xba4]`. After clearing the progress field cache through `0x595b80` and releasing any prior active descriptors through `0x5904d0`, it builds one route-label string from the optional suffix text plus the static route stem family at `0x005e22a0..0x005e22d0`, seeds the local field-cache family `[this+0x1724]` with the initial callback keys through `0x5a0cc0`, appends per-field selector names from the caller field-id list through the string table at `0x00629958`, and then opens the live route through `multiplayer_transport_route_callback_table_open_live_route_and_seed_receive_state` `0x590ed0` in mode `4`. On success it seeds cached progress percentage `[this+0x1774]` to `1` and immediately enqueues one mode-`3` field snapshot through `multiplayer_transport_enqueue_field_snapshot_record` `0x592b50`; on failure it falls back through the same progress-cache clear path. This is the strongest current upstream owner above the `[transport+0xba4]` route-callback table.","objdump + local disassembly + caller inspection + field-cache correlation + route-callback-table correlation"
0x00596530,101,multiplayer_transport_try_open_am_rating_route_callback_table_from_stored_route_label,shell,cdecl,inferred,objdump,3,"Tries to reopen the `gsi_am_rating` route callback table rooted at `[this+0x18bc]` from the stored route label at `[this+0x1ed0]`. It first resets the am-rating route state through `multiplayer_transport_reset_am_rating_route_state` `0x596060`, releases any prior active descriptors through `0x5904d0`, and then opens one mode-`4` live route through `multiplayer_transport_route_callback_table_open_live_route_and_seed_receive_state` `0x590ed0` with a null companion route string. Success clears `[this+0x1ed4]`, sets `[this+0x1ec4]` to `1`, and leaves the primary-endpoint table ready for later raw-endpoint seeding through `0x590dc0`; failure reverts through the same reset path and sets `[this+0x1ed4]`. Current grounded caller is the larger route-mode setter around `0x595650`. This higher reopen path also tightens the negative result for `[this+0x1778]`: even the am-rating reset and reopen lifecycle clears and reseeds the surrounding live tables and queued descriptor family without ever staging that sidecar slot.","objdump + local disassembly + caller inspection + am-rating-owner correlation + route-callback-table correlation + higher-owner-lifecycle correlation"
0x005965a0,44,multiplayer_transport_try_connect_status_route_once,shell,cdecl,inferred,ghidra-headless,3,Single-shot wrapper for the auxiliary status-route object at [this+0xaf0]. When the in-flight latch at [this+0xb40] is already set it returns false immediately. Otherwise it sets that latch and forwards the caller route id into multiplayer_transport_try_connect_status_route then booleanizes the result. Current grounded caller is multiplayer_transport_handle_names_query_response.,ghidra + rizin + llvm-objdump
0x00596970,404,multiplayer_transport_handle_profile_key_query_result,shell,cdecl,inferred,objdump,3,"Per-key callback helper for the profile-key query bundle family. It ignores empty selector names, treats a null fallback text as `0x005c87a8`, special-cases the `username` key by parsing one `X...X|%d` marker through multiplayer_transport_parse_selector_view_probe_marker, arming selector-view probe tracking through multiplayer_transport_arm_selector_view_probe_tracking, and optionally publishing callback slot `22` with the selector name plus the parsed probe tuple `(request id, displayed version/build integer)` or a zeroed `(END)` sentinel payload. It also special-cases `b_flags` by forwarding the returned mode-letter string into multiplayer_transport_merge_selector_mode_mask, then hashes the selector name, key name, and resolved value text through `0x58f4a0` and upserts that triplet into the caller table through hashed_entry_table_upsert.","objdump + strings + caller context"
0x00596b90,72,multiplayer_transport_query_slot_built_in_profile_key_and_publish_slot28_on_success,shell,cdecl,inferred,objdump + local disassembly,3,"Small helper above the generic per-key profile query path. Using the caller selector slot in `edx`, it indexes one per-slot built-in string pair from `[this+0x189c+slot*4]` and `[this+0x18ac+slot*4]`, forwards that pair plus the caller selector name and fallback text into `multiplayer_transport_handle_profile_key_query_result` `0x596970` with its publication flag enabled, and, when that lower helper returns success, also publishes callback slot `28` through `multiplayer_transport_enqueue_callback_slot28_record` `0x593200`. Current grounded callers are the selector callback root `0x59fbd0` and the later multi-entry sweep around `0x596d33`.","objdump + local disassembly + caller inspection"
0x00596da0,497,multiplayer_transport_submit_profile_key_query_bundle,shell,cdecl,inferred,rizin,2,Wrapper above the transport key-command builders that stages a small named-key query bundle around the strings `username` and `b_flags`. It allocates temporary key-name arrays and callback-entry tables submits the first request through multiplayer_transport_submit_getkey_command_and_wait folds returned key results into transport-owned callback state through 0x0058f8f0 and 0x0058fa00 and then follows with the larger channel-key submission path through multiplayer_transport_submit_setchankey_pair_list_command_and_wait when the staged key set is nonempty.,rizin + llvm-objdump + strings
0x00596fa0,19,multiplayer_transport_submit_profile_key_query_bundle_with_context,shell,cdecl,inferred,rizin,2,Thin wrapper over multiplayer_transport_submit_profile_key_query_bundle that preserves the caller selector or route context in `edx` and forwards the stack-supplied context pointer as the extra bundle argument. Current grounded use is through the local callback table rooted at 0x0059f8b0.,rizin + llvm-objdump
0x00596fc0,14,multiplayer_transport_submit_profile_key_query_bundle_default,shell,cdecl,inferred,rizin,3,Thin wrapper over multiplayer_transport_submit_profile_key_query_bundle that preserves the caller selector slot in `edx` and forces a null extra-context argument. Current grounded caller is multiplayer_transport_init_selector_slot and the same wrapper is also installed through the local callback table rooted at 0x0059fb60.,rizin + llvm-objdump
0x0059f8b0,260,multiplayer_transport_callback_upsert_current_selector_and_request_profile_keys,shell,cdecl,inferred,objdump,3,"Callback-root helper adjacent to the second transport-side descriptor lane. It resolves the current selector through multiplayer_transport_find_selector_name, upserts that selector name into the selector-view store through multiplayer_transport_upsert_selector_name_entry, optionally reuses a cached `username` marker from `0x58eb10` to arm selector-view probe tracking through multiplayer_transport_parse_selector_view_probe_marker and multiplayer_transport_arm_selector_view_probe_tracking, then submits one profile-key query bundle through multiplayer_transport_submit_profile_key_query_bundle_with_context and publishes callback slot `17`. When selector `2` is active, the same helper can also force the route-mode transitions `2 -> 3 -> 4` through multiplayer_transport_set_route_mode after checking the status-route latch at `[this+0xb54]`, route activity, and the generation gate `[this+0xac0] >= [this+0xb48]`.","objdump + caller xrefs + strings"
0x0059f9c0,239,multiplayer_transport_callback_clear_named_selector_view_slot_publish_slot18_and_maybe_set_route_mode,shell,cdecl,inferred,objdump + local disassembly,3,"Callback-root helper installed in the second transport-side selector descriptor lane at `0x59fc80`. It resolves the current selector through `0x5951a0`; when selector `2` is active and the route is live, it derives one follow-on route-mode request from the current selector-view state by combining the route-status latch at `[this+0xb40]`, the slot-`2` flag-`0x20` count from `multiplayer_transport_count_selector_view_entries_with_slot_flag20_and_optional_name_match` `0x594e30`, and the third selector-generation gate `[this+0xac0]` versus target `[this+0xb48]`. It then clears the named selector-view slot membership through `multiplayer_transport_clear_selector_view_entry_slot_and_remove_if_empty` `0x594fb0`, publishes callback slot `18` through `0x592f20` using the selector name plus either the default sample `0x005c87a8`, the alternate token `0x005e24e0` for selectors `2/3`, or the caller text when present, and finally re-enters `multiplayer_transport_set_route_mode` `0x595650` when the earlier route-mode decision armed a transition. This now bounds the helper as the named selector-view slot-clear and callback-slot-`18` publication lane rather than an anonymous route-mode side effect.","objdump + local disassembly + callback-table install correlation + caller inspection"
0x0059fab0,58,multiplayer_transport_callback_rekey_named_selector_view_entry_and_publish_slot21,shell,cdecl,inferred,objdump + local disassembly,3,"Callback-root helper installed in the same selector descriptor lane at `0x59fc80`. It resolves the current selector through `0x5951a0`, rekeys the named selector-view entry through `multiplayer_transport_rekey_selector_view_entry_preserving_slot_runtime` `0x595010`, and then publishes callback slot `21` through `0x593000` using the old and new selector names plus the caller context in `edx`. Current grounded role is the rename or relabel sibling next to the slot-clear lane, not a generic selector-text setter.","objdump + local disassembly + callback-table install correlation"
0x0059faf0,98,multiplayer_transport_callback_set_selector_slot_sample_text_and_refresh_active_object,shell,cdecl,inferred,objdump + local disassembly,2,"Callback-root helper adjacent to `0x59fab0`. After resolving the caller selector name into one slot index through `0x5951a0`, it copies up to `0x200` bytes of caller text into the fixed selector sample buffer at `[this+0x39c+slot*0x200]`, clears the trailing byte at `[this+0x59b+slot*0x200]`, and, when an active selector object is still present at `[this+0x390+slot*4]`, refreshes that object through `0x592d30`. This currently bounds the helper as the selector-sample-text update lane rather than a broader selector-table mutator.","objdump + local disassembly + selector-buffer correlation"
0x0059fb60,104,multiplayer_transport_callback_replace_selector_slot_name_set_request_default_profile_keys_and_publish_slot20,shell,cdecl,inferred,objdump + local disassembly,3,"Callback-root helper installed at offset `0x24` in the selector descriptor lane seeded by `0x59fc80`. It resolves the caller selector name into one slot index through `0x5951a0`, clears that selector slot from every selector-view entry through `multiplayer_transport_clear_selector_view_slot_from_all_entries` `0x5950a0`, then iterates one caller-supplied name list and re-upserts each name into that slot through `multiplayer_transport_upsert_selector_name_entry` `0x594f20` using the paired caller-side flag words. After the replacement sweep it requests the default profile-key bundle for that selector slot through `0x596fc0` and publishes callback slot `20` through `0x592fc0`.","objdump + local disassembly + callback-table install correlation + caller inspection"
0x0059fbd0,69,multiplayer_transport_callback_query_slot_built_in_profile_key_and_publish_slot28,shell,cdecl,inferred,objdump + local disassembly,3,"Callback-root helper installed at offset `0x28` in the selector descriptor lane seeded by `0x59fc80`. It resolves the caller selector name into one slot index through `0x5951a0`, forwards the caller trio into `multiplayer_transport_query_slot_built_in_profile_key_and_publish_slot28_on_success` `0x596b90`, and then publishes the same trio through `multiplayer_transport_enqueue_callback_slot28_record` `0x593200`. This currently bounds the helper as the built-in per-slot profile-key query sibling next to the selector-set replacement lane, rather than another generic selector-text path.","objdump + local disassembly + callback-table install correlation + helper correlation"
0x005a0940,4,multiplayer_gamespy_server_descriptor_queue_set_companion_dword_filter,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Tiny setter for one queue-family-side companion dword at `[this+0x24]`. Current grounded callers are the field-snapshot mode dispatcher `0x595a40` and the `gsi_am_rating` route-event dispatcher `0x595e10`, where mode `5` copies the transport-staged route companion dword from `[transport+0x490]` into transport field `[transport+0x54]` and then mirrors the same value into this queue-side slot. The heavier queue service path `0x5a0b40` later uses `[this+0x24]` as the alternate endpoint companion filter when matching descriptors that carry secondary-endpoint state bit `0x2`, so this is now the safest current read for the shared queue companion-dword setter rather than an opaque local store.","objdump + local disassembly + caller inspection + queue-service correlation + companion-dword-slot correlation"
0x005a0950,18,multiplayer_gamespy_server_descriptor_queue_clear_active_and_pending_lists,shell,cdecl,inferred,objdump,3,"Clears both linked lists in one compact server-descriptor queue family by forwarding the active list at `[this+0x08]` and pending list at `[this+0x14]` into the shared list-clear helper `0x5a07b0`. Current grounded caller is `multiplayer_transport_reset_am_rating_route_state`, which uses it to clear the queued-descriptor family at `[transport+0x1e7c]`.","objdump + caller inspection + queue-family correlation"
0x005a0970,48,multiplayer_gamespy_server_descriptor_queue_destroy_and_release_owned_buffer,shell,cdecl,inferred,objdump,2,"Destructor-side helper for one compact server-descriptor queue family. It releases the owned scratch buffer or stream handle at `[this+0x20]` through `0x58bc4e`, resets that slot to `-1`, and then clears the active and pending lists through the same lower list-clear helper used by `0x005a0950`. Current grounded caller is the queued-descriptor family teardown path beneath the multiplayer transport callback-table shutdown.","objdump + caller inspection + queue-family correlation"
0x005a09a0,84,multiplayer_gamespy_server_descriptor_queue_insert_with_pending_state_tag,shell,cdecl,inferred,objdump,3,"Inserts one compact server descriptor into a queue family while stamping a pending state tag into descriptor byte `[entry+0x14]`. The helper first clears transient state bits `0x4/0x8/0x10`; then its second stack argument chooses pending bit `0x4` or `0x8`, which later service code promotes into ready bits `0x1` or `0x2`. The first stack argument chooses whether insertion goes through the pending-list path at `[this+0x14]` or the active-list path at `[this+0x08]`. If the family is full it grows storage through `0x5a07c0`. Current grounded callers use pending tag `0x4` for the local field-cache family at `[transport+0x1724]` and pending tag `0x8` for the `gsi_am_rating` queued-descriptor family at `[transport+0x1e7c]`.","objdump + caller inspection + queue-state correlation"
0x005a0c80,79,multiplayer_gamespy_server_descriptor_queue_service_and_publish_empty_transition,shell,cdecl,inferred,objdump,3,"Recurring service helper for one compact server-descriptor queue family. When the family still owns descriptors it runs the heavier refresh pass at `0x5a0b40`, the age or expiry sweep at `0x5a0c00`, and the compaction pass at `0x5a0c50`; if the family becomes empty afterward it notifies the owner callback at `[this+0x40]` with mode `2` and null entry. Current grounded callers are `multiplayer_transport_service_route_callback_tables`, which services the transport-owned field-cache family at `[transport+0x1724]` and the companion `gsi_am_rating` queued-descriptor family at `[transport+0x1e7c]`.","objdump + caller inspection + queue-family correlation"
0x005a0cd0,35,multiplayer_gamespy_server_descriptor_queue_remove_matching_entry,shell,cdecl,inferred,objdump,3,"Removes one matching compact descriptor from a queue family by probing the active list at `[this+0x08]` first and falling back to the pending list at `[this+0x14]` when no active match is found. Current grounded caller is `multiplayer_transport_dispatch_am_rating_route_event_mode`, which removes descriptors carrying pending state bits `0x4/0x8` from the `gsi_am_rating` queued family at `[transport+0x1e7c]`.","objdump + caller inspection + queue-family correlation"
0x00596fd0,441,multiplayer_transport_dispatch_status_route_event,shell,cdecl,inferred,rizin,3,Main local callback dispatcher for the auxiliary status-route object. It gates on [this+0x398] [this+0xb44] and flag bits in [this+0xb38] then maps route event ids through the local table at 0x005970c4 into selector text publication openstaging publication boolean status publication and callback forwarding paths. The dispatcher publishes through multiplayer_transport_send_selector_text and multiplayer_transport_publish_fixed_token_message and can also invoke the owner callback at [this+0x17dc] with payload [this+0x17f8].,rizin + llvm-objdump + strings
0x005970e0,156,multiplayer_transport_status_route_publish_selector_name_or_probe_average_or_forward_owner,shell,cdecl,inferred,objdump + caller correlation + strings,3,"Status-route callback helper from the six-entry route vector seeded by `multiplayer_transport_try_connect_status_route`. When the transport is active and the status-route gate around `[this+0x398]`, `[this+0xb44]`, and bit `0x4` in `[this+0xb38]` permits it, event id `0x15` resolves the active selector-view entry through `0x594dc0` mode `2` and appends the returned selector text through `0x58bce0`, while event id `0x18` resolves that same entry and publishes the averaged probe sample from `[entry+0x80]` through `0x58cd40`. When no active entry is available it falls back to the fixed text token at `0x005c87a8`. Outside those bounded cases it forwards the same `(event id, payload)` pair into the owner callback at `[this+0x17e0]` with context `[this+0x17f8]`. This is currently the strongest safe role for one status-route callback-vector lane, while the exact user-facing label of the averaged sample remains open.","objdump + caller correlation + strings + selector-view correlation"
0x00597180,40,multiplayer_transport_status_route_forward_owner_event_payload,shell,cdecl,inferred,objdump + caller correlation,3,"Thin owner-forwarding lane in the status-route callback vector. It forwards the caller event id in `ecx` and payload pointer in `edx` into the owner callback at `[this+0x17e4]` with context `[this+0x17f8]` when that callback is present, and otherwise returns immediately. Current grounded caller is the status-route callback table seeded by `multiplayer_transport_try_connect_status_route`.","objdump + caller correlation"
0x005971b0,192,multiplayer_transport_status_route_seed_control_id_list_and_notify_owner,shell,cdecl,inferred,objdump + caller correlation + strings,3,"Status-route callback-vector lane that seeds one control-id list into the caller byte builder through `0x58bcb0`. In its first grounded mode it appends the currently available local status-control ids, including the always-on `8` lane plus conditional ids `1`, `0x0b`, `0x13`, `0x14`, and `0x0a` according to the current status-route state at `[this+0x1ecc]`, `[this+0xb4c]`, `[this+0xb3c]`, and `[this+0xb48]`; in its second grounded mode it emits the smaller pair `0x15` and `0x18`. After seeding that local list it optionally forwards the same mode plus builder into the owner callback at `[this+0x17e8]` with context `[this+0x17f8]`. Current grounded caller is the status-route callback table seeded by `multiplayer_transport_try_connect_status_route`.","objdump + caller correlation + control-id-list correlation"
0x00597270,80,multiplayer_transport_status_route_query_third_selector_generation_or_forward_owner_scalar,shell,cdecl,inferred,objdump + caller correlation,2,"Small scalar-query lane in the status-route callback vector. When the caller event id is `1` and the transport-side status gate around `[this+0x398]`, `[this+0xb44]`, and bit `0x4` in `[this+0xb38]` permits it, the helper returns the third selector-slot generation counter at `[this+0xac0]`. Otherwise it forwards the same selector or scalar query into the owner callback at `[this+0x17ec]` with context `[this+0x17f8]`, returning zero when that callback is absent. Current grounded caller is the status-route callback table seeded by `multiplayer_transport_try_connect_status_route`.","objdump + caller correlation + selector-generation correlation"
0x005972c0,97,multiplayer_transport_handle_validated_route_cookie_event,shell,cdecl,inferred,objdump,3,"Validated subtype-`4` callback for the transport-owned GameSpy route family. The route constructor seeds this helper into `[route+0x9c]`; after multiplayer_gamespy_route_dispatch_inbound_packet validates the current route cookie it forwards the event id in `ecx`, the remaining payload pointer in `edx`, and the owner transport context from `[route+0x104]`. When multiplayer_transport_is_route_mode_active_nonterminal succeeds it marks `[this+0x1ed8]` and re-enters multiplayer_transport_set_route_mode with a mode-selection bit derived from `[this+0x1ed4]` and `[this+0x18b8]`; otherwise it falls back to the owner callback at `[this+0x17f0]` using context `[this+0x17f8]`.","objdump"
0x00597330,28,multiplayer_transport_forward_validated_extended_route_payload,shell,cdecl,inferred,objdump,3,"Small forwarding callback used for the transport-owned status route's validated extended-payload slot. It treats `edx` as the owner transport object, checks the owner callback pointer at `[this+0x17f4]`, and when present forwards the validated payload wrapper in `ecx` together with owner context `[this+0x17f8]`. Current grounded caller is the status-route connect helper through multiplayer_gamespy_route_set_extended_payload_callback.","objdump"
0x00597350,30,multiplayer_transport_release_status_route,shell,cdecl,inferred,ghidra-headless,3,Releases the auxiliary status-route object stored at [this+0xaf0] through 0x58cfd0 and clears the owner slot afterward. Status-pump cleanup fixed-token publishing and the auxiliary route connect helper use this before rebuilding status-route state.,ghidra + rizin + llvm-objdump
0x00597380,34,multiplayer_transport_service_status_and_live_routes,shell,cdecl,inferred,objdump,3,"Recurring route-object sweep for the session-event transport. It services the auxiliary status-route object at `[this+0xaf0]` through the shared low-level route tick helper `0x58d040` when present and then services the current live route at `[this+0x1ecc]` through that same helper. The current grounded caller is multiplayer_transport_service_frame, which makes this the route-object side of the recurring multiplayer transport cadence.",objdump
0x005973d0,170,multiplayer_transport_try_connect_status_route,shell,cdecl,inferred,ghidra-headless,3,"Attempts to connect or rebuild the auxiliary status-route object at [this+0xaf0]. It first tears any existing status route down through multiplayer_transport_release_status_route then builds a callback table from the local handler set rooted at multiplayer_transport_dispatch_status_route_event through multiplayer_transport_handle_validated_route_cookie_event chooses either the default route id `0x1964` or the caller route id and connects through `0x58cc40` or multiplayer_gamespy_route_construct_and_seed_callback_vector. On success it copies [this+0x9a8] into [this+0xb3c] patches the created route object's extended-payload callback slot through multiplayer_gamespy_route_set_extended_payload_callback using callback `0x597330` and clears [this+0xb38].","ghidra + rizin + llvm-objdump + strings"
0x005973b0,30,multiplayer_transport_release_live_route,shell,cdecl,inferred,ghidra-headless,4,Releases the current live route object stored at [this+0x1ecc] through 0x58cfd0 and clears the owner slot afterward. The route-mode setter and connect helper use it before rebuilding or switching live route state.,ghidra + rizin + llvm-objdump
0x00597480,261,multiplayer_transport_try_connect_live_route,shell,cdecl,inferred,ghidra-headless,3,"Attempts to connect or rebuild the current live route object at [this+0x1ecc]. It first clears any existing live route through multiplayer_transport_release_live_route then formats a local identifier from [this+0x60] and 0x005dccfc chooses either the default route id `0x1964` or the binding-specific id and connects through 0x58cc40 or multiplayer_gamespy_route_construct_and_seed_callback_vector. In the currently grounded connect path it does not patch `[route+0xa0]`, `[route+0xa4]`, or `[route+0xd4]` after construction the way the status-route helper patches `[route+0xa0]`; on success it only updates [this+0x1ed8] and preserves the new live route state for the route-mode setter.","ghidra + rizin + llvm-objdump + strings"
0x00598230,67,multiplayer_transport_enqueue_names_query_record,shell,cdecl,inferred,ghidra-headless,3,Allocates one 0x10-byte transient names-query work item zeroes its four dword fields and submits it through 0x5980f0 as request kind `3` using the caller-provided sample or callback context pointer. The helper returns the allocated work item on success and null on allocation or submit failure. Current grounded caller is multiplayer_transport_submit_names_query_with_callback.,ghidra + rizin + llvm-objdump
0x0058f0a0,99,multiplayer_transport_append_user_and_optional_nick_commands,shell,cdecl,inferred,rizin,3,Builds the initial identity command bundle for one multiplayer transport worker. It appends `USER %s %s %s :%s` to the owned text stream using worker text fields at [this+0x3ac] [this+0x42c] and [this+0x4b0] together with the fallback host `127.0.0.1` then checks the current nick through multiplayer_transport_is_valid_nick_string and either falls through multiplayer_transport_dispatch_or_release_callback_binding with mode `1` or appends `NICK %s` directly through the same text-stream path.,rizin + llvm-objdump + strings
0x0058f920,72,hashed_entry_table_upsert,support,cdecl,inferred,rizin,4,Generic hashed-entry-table upsert over a bucket array of contiguous vectors. It computes the bucket index through the table hash callback at [this+0x0c] looks for an existing matching entry through hashed_entry_table_lookup and when found overwrites that slot through generic_vector_overwrite_with_callback; otherwise it appends the caller record into the selected bucket vector through 0x0059e4d0.,rizin + llvm-objdump
0x0058f970,69,hashed_entry_table_remove,support,cdecl,inferred,rizin,4,Generic hashed-entry-table remove over a bucket array of contiguous vectors. It hashes the caller key into one bucket and erases the matching slot through generic_vector_erase_with_callback when present; otherwise it returns false.,rizin + llvm-objdump
0x0058f9c0,63,hashed_entry_table_lookup,support,cdecl,inferred,rizin,4,Generic hashed-entry-table lookup over a bucket array of contiguous vectors. It hashes the caller key into one bucket resolves the matching index through generic_vector_find_index and returns the matched entry pointer or null.,rizin + llvm-objdump
0x0058f110,465,multiplayer_transport_worker_init,shell,cdecl,inferred,rizin,3,"Initializes one heap-backed multiplayer transport worker and its owned text-stream and store state. It zeroes the `0x5e4`-byte worker copies caller identifier strings into the fixed buffers at `[this+0x00]`, `[this+0x36c]`, `[this+0x3ac]`, `[this+0x42c]`, and `[this+0x4b0]`, copies one 5-dword descriptor block into `[this+0x534]`, seeds the state fields at `[this+0x04]` and `[this+0x558]`, initializes the registered-name store at `[this+0x548]`, the pending-template dispatch store at `[this+0x54c]`, and the owned text-stream object at `[this+0x1c]`, and tears partial state back down on failure.","rizin + llvm-objdump"
0x0058f2f0,60,multiplayer_transport_worker_create,shell,cdecl,inferred,rizin,3,"Thin allocation wrapper for multiplayer_transport_worker_init. It allocates one `0x5e4`-byte worker block through tracked_heap_alloc_with_header and then forwards the descriptor pointer already staged in `EDX` plus the caller argument bundle into multiplayer_transport_worker_init.","rizin + llvm-objdump"
0x0059d430,47,string_hash_sum_mod,support,cdecl,inferred,rizin,3,Small string-hash helper that accumulates one normalized integer value per input byte through 0x005a5900 and returns the running sum modulo the caller divisor. Current grounded callers use it as the bucket-selector callback for registered-name entry tables.,rizin + llvm-objdump
0x0059d470,57,multiplayer_transport_lookup_registered_name,shell,cdecl,inferred,ghidra-headless,3,Copies one caller string into a stack-local buffer and looks it up against the registered-name store rooted at [this+0x548] through hashed_entry_table_lookup. It returns the matched entry pointer or null. Current grounded callers are multiplayer_transport_has_registered_name and the deeper names-query payload helper family.,ghidra + rizin + llvm-objdump
0x0059d520,91,multiplayer_transport_init_registered_name_store,shell,thiscall,inferred,rizin,4,Initializes the transport-side registered-name store by allocating the hashed bucket table at [this+0x548] with 7 buckets and a 0x1e0-byte entry shape through 0x0058f840 and then allocating the companion flat entry vector at [this+0x54c] through 0x0059e0b0. On allocation failure it tears any partial state back down.,rizin + llvm-objdump
0x0059d580,35,multiplayer_transport_destroy_registered_name_store,shell,thiscall,inferred,rizin,4,Destroys the transport-side registered-name store by releasing the hashed bucket table at [this+0x548] through 0x0058f8b0 and the companion flat entry vector at [this+0x54c] through generic_vector_destroy when present.,rizin + llvm-objdump
0x0059d610,81,multiplayer_transport_contains_registered_name_entry,shell,cdecl,inferred,rizin,3,Linear membership check over the flat registered-name entry vector at [this+0x54c]. It compares each live entry against the caller key through 0x005a57cf and returns true on the first exact match.,rizin + llvm-objdump
0x0059d670,240,multiplayer_transport_upsert_registered_name_entry,shell,cdecl,inferred,rizin,3,Builds one temporary 0x1e0-byte registered-name entry on the stack from the caller descriptor and name string; allocates the entry-owned callback table through 0x0058f840; removes any older flat-vector entry with the same key from [this+0x54c]; and then inserts or replaces the canonical entry in the hashed registered-name store at [this+0x548] through hashed_entry_table_upsert.,rizin + llvm-objdump
0x0059d760,103,multiplayer_transport_remove_registered_name_entry,shell,cdecl,inferred,rizin,4,Copies the caller name into a stack-local temporary key; removes any matching entry from the flat registered-name vector at [this+0x54c]; and then removes the canonical hashed-store entry from [this+0x548] through hashed_entry_table_remove.,rizin + llvm-objdump
0x0058fa00,49,generic_callback_list_for_each,support,cdecl,inferred,ghidra-headless,4,Generic callback-list walker over one `[items count]` style callback collection. It uses generic_vector_for_each to visit every entry pointer and forwards the caller context through the supplied callback shim unchanged. Transport registration and the registered-name fast path reuse it to fan out one callback over all registered entries.,rizin + llvm-objdump
0x0059e110,3,generic_vector_count,support,cdecl,inferred,rizin,4,Returns the current element count from dword [this+0x00] for one contiguous vector-style container.,rizin + llvm-objdump
0x0059e120,10,generic_vector_index_ptr,support,cdecl,inferred,rizin,4,Computes one element pointer as base [this+0x14] plus index times stride [this+0x08]. Most higher-level vector helpers funnel slot access through this helper.,rizin + llvm-objdump
0x0059e130,58,generic_vector_erase,support,cdecl,inferred,rizin,4,Removes one indexed element from a contiguous vector. When the erased slot is not already the tail it memmoves the trailing span down and then decrements the element count at [this+0x00].,rizin + llvm-objdump
0x0059e170,21,generic_vector_sort,support,cdecl,inferred,rizin,4,Sorts the backing element range at [this+0x14] through the shared qsort-style helper using the current count and stride from the vector header.,rizin + llvm-objdump
0x0059e190,49,generic_vector_for_each,support,cdecl,inferred,rizin,4,Forward iterator for one contiguous vector. It walks indices `0..count-1` resolves each slot through generic_vector_index_ptr and invokes the caller callback with the shared context argument.,rizin + llvm-objdump
0x0059e1d0,42,generic_vector_for_each_reverse,support,cdecl,inferred,rizin,4,Reverse iterator for one contiguous vector. It walks indices `count-1..0` and invokes the caller callback on each resolved slot pointer.,rizin + llvm-objdump
0x0059e200,61,generic_vector_find_first,support,cdecl,inferred,rizin,4,Scans the vector from the front and returns the first element pointer whose caller predicate returns zero. When no match is found it returns null.,rizin + llvm-objdump
0x0059e2f0,19,generic_vector_invoke_element_callback,support,cdecl,inferred,rizin,4,Invokes the optional per-element callback stored at [this+0x10] for one indexed slot when that callback pointer is nonnull. Erase overwrite and destroy helpers reuse it before mutating storage.,rizin + llvm-objdump
0x0059e310,31,generic_vector_store_at,support,cdecl,inferred,rizin,4,Copies one caller-supplied element record into the indexed slot resolved through generic_vector_index_ptr using the current element stride from the vector header.,rizin + llvm-objdump
0x0059e330,49,generic_vector_destroy,support,cdecl,inferred,rizin,4,Walks all live elements through generic_vector_invoke_element_callback then frees the backing storage at [this+0x14] and finally releases the vector object itself through tracked_heap_free_with_header.,rizin + llvm-objdump
0x0059e370,87,generic_vector_insert_copy_at,support,cdecl,inferred,rizin,4,Ensures capacity grows through 0x0059e090 when full increments the count shifts the tail upward when inserting before the end and copies the caller element record into the requested slot through generic_vector_store_at.,rizin + llvm-objdump
0x0059e3d0,22,generic_vector_erase_with_callback,support,cdecl,inferred,rizin,4,Calls generic_vector_invoke_element_callback for the indexed slot and then removes that slot through generic_vector_erase. Current grounded callers use it for registered-name and callback-entry teardown paths.,rizin + llvm-objdump
0x0059e3f0,33,generic_vector_overwrite_with_callback,support,cdecl,inferred,rizin,4,Invokes generic_vector_invoke_element_callback for one indexed slot and then copies the caller replacement record back into that same slot through generic_vector_store_at. Hashed entry-table upsert uses it when replacing an existing matching record.,rizin + llvm-objdump
0x0059e420,137,generic_vector_find_index,support,cdecl,inferred,rizin,4,Returns the index of one matching element within the contiguous vector or `-1` when none is found. Depending on the caller flag it uses either the linear comparator scan at 0x0059e240 or the ordered search helper at 0x0059e290 and derives the final index from the matched element pointer and stride.,rizin + llvm-objdump
0x0059d7f0,86,multiplayer_transport_collect_registered_name_callback_entries,shell,cdecl,inferred,ghidra-headless,3,Callback collector used by the registered-name fast path. For each callback entry in the name entry's callback list it grows two parallel pointer arrays in the caller scratch frame through tracked_heap_resize_with_header and appends the callback entry pointer plus its `[entry+0xdc]` payload pointer. Current grounded caller is multiplayer_transport_dispatch_registered_name_query_fastpath through generic_callback_list_for_each.,ghidra + rizin + llvm-objdump
0x0059d850,114,multiplayer_transport_dispatch_registered_name_query_fastpath,shell,cdecl,inferred,ghidra-headless,3,Fast path for multiplayer_transport_submit_names_query_with_callback when the queried sample already exists in the registered-name table. It resolves the name entry through multiplayer_transport_lookup_registered_name collects entry-owned callback state through multiplayer_transport_collect_registered_name_callback_entries and invokes the caller callback through multiplayer_transport_invoke_registered_name_query_callback without enqueueing a transport names-query record. Temporary callback arrays are released through tracked_heap_free_with_header on exit.,ghidra + rizin + llvm-objdump
0x0059d8d0,15,multiplayer_transport_has_registered_name,shell,cdecl,inferred,ghidra-headless,3,Boolean wrapper over multiplayer_transport_lookup_registered_name. It returns true when the caller string resolves to one registered-name entry in the transport-side table and false otherwise. Current grounded caller is multiplayer_transport_submit_names_query_with_callback.,ghidra + rizin + llvm-objdump
0x0059d8e0,64,multiplayer_transport_try_read_registered_name_header_block,shell,cdecl,inferred,rizin,4,Looks up one registered-name entry and when the header-valid flag at `[entry+0x154]` is set copies the 7-dword header block at `[entry+0x138]` into the caller buffer and returns true. Otherwise it returns false without mutating the destination.,rizin + llvm-objdump
0x0059d920,48,multiplayer_transport_set_registered_name_header_block,shell,cdecl,inferred,rizin,4,Looks up one registered-name entry copies 7 caller-supplied dwords into the header block at `[entry+0x138]` and sets the paired valid flag at `[entry+0x154]` to one.,rizin + llvm-objdump
0x0059d950,112,multiplayer_transport_set_registered_name_status_text,shell,cdecl,inferred,rizin,3,Looks up one registered-name entry frees the prior heap string at `[entry+0x158]` and replaces it with a heap copy of the caller text or the shared empty string when the caller passes null. This is the main per-name status or topic text setter for the registered-name store.,rizin + llvm-objdump
0x0059d9c0,32,multiplayer_transport_mark_registered_name_dirty,shell,cdecl,inferred,rizin,3,Looks up one registered-name entry and sets the dword dirty or active flag at `[entry+0x15c]` to one.,rizin + llvm-objdump
0x0059d9e0,32,multiplayer_transport_get_registered_name_dirty,shell,cdecl,inferred,rizin,3,Looks up one registered-name entry and returns the current dword dirty or active flag stored at `[entry+0x15c]` or zero when the entry is absent.,rizin + llvm-objdump
0x0059da00,64,multiplayer_transport_set_registered_name_display_text,shell,cdecl,inferred,rizin,3,Looks up one registered-name entry copies up to 0x80 bytes of caller text into the embedded buffer at `[entry+0x160]` through string_copy_bounded_zerofill and clears the trailing byte flag at `[entry+0x1df]`. This is a second inline text field distinct from the heap string at `[entry+0x158]`.,rizin + llvm-objdump
0x0059da40,208,multiplayer_transport_upsert_registered_name_callback_entry,shell,cdecl,inferred,rizin,4,Looks up one registered-name entry zeroes a temporary 0xe0-byte nested callback-entry record copies the secondary key string into the local record and when both payload blocks are provided copies 0x18 bytes into `[record+0x80]` and 0x40 bytes into `[record+0x98]` sets the local active flag at `[record+0xd8]` and stores one caller dword at `[record+0xdc]` before upserting the record into the entry-owned callback table at `[entry+0x134]` through hashed_entry_table_upsert.,rizin + llvm-objdump
0x0059db10,80,multiplayer_transport_remove_registered_name_callback_entry,shell,cdecl,inferred,rizin,4,Looks up one registered-name entry copies the caller secondary key into a stack-local temporary and removes the matching nested callback-entry record from the entry-owned callback table at `[entry+0x134]` through hashed_entry_table_remove.,rizin + llvm-objdump
0x0059db90,96,multiplayer_transport_dispatch_registered_name_callback_entry,shell,cdecl,inferred,rizin,3,Fans one callback descriptor over the transport-side registered-name store. It copies the primary name into a stack-local key builds a small dispatch frame and visits all registered-name entries through generic_callback_list_for_each where helper 0x0059db60 resolves the matching nested callback-entry record and invokes the descriptor function pointer at `[desc+0x08]` with the descriptor owner context plus the secondary key plus the payload cookie plus the owning registered-name entry.,rizin + llvm-objdump
0x0059dcb0,48,multiplayer_transport_update_registered_name_callback_key,shell,cdecl,inferred,rizin,3,Visits every registered-name entry through generic_callback_list_for_each and runs helper 0x0059dbf0 to rewrite one nested callback-entry key. The helper removes the existing nested record from `[entry+0x134]` copies the replacement key into the local record reinserts it through hashed_entry_table_upsert and conditionally emits transport opcode 8 through 0x0059b790 when the name entry is marked dirty and has owner callbacks installed.,rizin + llvm-objdump
0x0059dce0,256,multiplayer_transport_update_registered_name_callback_flags,shell,cdecl,inferred,rizin,4,Looks up one registered-name entry then resolves one nested callback-entry record by secondary key from the entry-owned callback table at `[entry+0x134]`. Depending on the caller mode flag it ORs or clears the caller bitmask against `[subentry+0xdc]` and when the parent entry has transport callbacks installed publishes an opcode-11 update through 0x0059b790 carrying the primary name plus the secondary key plus the new flag mask.,rizin + llvm-objdump
0x0059de00,64,multiplayer_transport_dispatch_registered_name_callbacks,shell,cdecl,inferred,rizin,3,If the owning transport is active at `[*this]` it walks the full registered-name store through generic_callback_list_for_each and helper 0x0059dde0 increments a dispatch count and invokes the caller-provided callback function for each live registered-name entry.,rizin + llvm-objdump
0x0059de40,96,multiplayer_transport_stage_registered_name_callback_payload,shell,cdecl,inferred,rizin,3,Resolves one nested callback-entry record by secondary key from the caller registered-name entry then copies a 0x18-byte payload block into `[subentry+0x80]` and a 0x40-byte payload block into `[subentry+0x98]` null-terminates both copied regions and sets the active flag at `[subentry+0xd8]` to one.,rizin + llvm-objdump
0x0059dea0,96,multiplayer_transport_stage_registered_name_callback_payload_for_name,shell,cdecl,inferred,rizin,3,Looks up one primary registered-name entry then fans helper multiplayer_transport_stage_registered_name_callback_payload across the registered-name store through generic_callback_list_for_each using the caller secondary key plus the two payload buffers. Current grounded role is a primary-name keyed payload staging wrapper for nested callback-entry records.,rizin + llvm-objdump
0x0059df00,96,multiplayer_transport_try_resolve_registered_name_callback_payload,shell,cdecl,inferred,rizin,4,Fast resolver for one nested callback-entry payload. When the descriptor either has no selector string or matches the shared two-byte default token at 0x005e1e1c it looks up the nested callback-entry record by key from `[entry+0x134]` and if the entry is active at `[subentry+0xd8]` marks the descriptor successful and returns pointers to the staged payload blocks at `[subentry+0x80]` and `[subentry+0x98]`.,rizin + llvm-objdump
0x005934c0,30,multiplayer_transport_next_work_sequence,shell,thiscall,inferred,ghidra-headless,3,"Returns the next monotonically increasing transport work-sequence value by incrementing dword `[this+0x177c]` and clamping negative wraparound back to zero. Current grounded callers now bound this more tightly than a generic work-sequence source: the returned dword is also the shared immediate-drain context id later copied into queued work field `+0x0c`, mirrored into active opcode-record field `+0x14`, and waited on through `0x58d720` by the text-submission and callback-table registration roots.","ghidra + rizin + llvm-objdump"
0x00593650,229,multiplayer_transport_attach_callback_table_descriptor,shell,cdecl,inferred,objdump + local disassembly,3,"Builds one transport-side callback-table descriptor from caller metadata and then links it through `multiplayer_transport_worker_create` `0x58f2f0`. The helper first allocates one transient work record through `multiplayer_transport_allocate_and_enqueue_work_record` `0x5934e0`; this lane is now tighter: it uses work-record type `0`, leaves field `+0x08` zero, duplicates the first caller metadata dword into both fields `+0x0c` and `+0x10`, and carries the second caller metadata dword in field `+0x18` for the later replay path through `multiplayer_transport_publish_callback_table_binding_result_and_release_work_record` `0x593570`. It then installs callback vectors from `0x59f5c0` and `0x59f650`, copies the caller transport pointer into the local descriptor frame, and chooses the follow-on worker callback pair `0x593610/0x593630` from transport field `[this+0x4c]`. Failure unlinks the staged work record through `multiplayer_transport_remove_queued_work_record_by_pointer` `0x5933a0`. The current grounded caller is `multiplayer_transport_register_callback_table`.","objdump + local disassembly + work-queue correlation + callback-binding-triplet correction"
0x00593d60,66,multiplayer_transport_try_submit_text_record_fastpath,shell,cdecl,inferred,ghidra-headless,3,"Attempts the fast submission path for one prepared transport text record. It allocates a type-`9` transient record through `0x005934e0`, again staging the shared transport wrapper triplet as `(drain context id +0x0c, callback fn +0x10, callback companion +0x18)`, and when that succeeds forwards the caller callback and payload through `0x0058e510` with callback shim `0x00593d00`. That shim copies the returned text into `[transport+0x04]` and, when work field `+0x10` is nonnull, re-emits one follow-on callback record through `0x00593170` using the staged callback pointer and companion plus the same drain context id. The current grounded caller is `multiplayer_transport_submit_text_record`.","ghidra + rizin + llvm-objdump + work-record-triplet correlation + local disassembly"
0x00598d50,496,multiplayer_transport_handle_registered_name_callback_bind_record_mode1,shell,cdecl,inferred,rizin,3,Owner-side wrapper for record mode 1 in the registered-name branch. It parses the mode prefix from the secondary key string at record field `+0x08` checks whether the primary name matches the local transport name at `[this+0x36c]` and either seeds one local registered-name entry through multiplayer_transport_upsert_registered_name_entry plus multiplayer_transport_set_registered_name_status_text or upserts one nested callback-entry record through multiplayer_transport_upsert_registered_name_callback_entry and emits follow-up opcode 6 or opcode 12 notifications when the target name entry is already marked dirty.,rizin + llvm-objdump
0x00598f40,255,multiplayer_transport_handle_registered_name_callback_remove_record_mode1,shell,cdecl,inferred,rizin,3,Owner-side removal wrapper for registered-name record mode 1. It resolves the primary and secondary key strings from the caller record removes the matching nested callback-entry through multiplayer_transport_remove_registered_name_callback_entry and then emits opcode 7 or opcode 12 notifications from the current registered-name owner callbacks when the target entry is dirty.,rizin + llvm-objdump
0x00599040,308,multiplayer_transport_handle_registered_name_callback_remove_record_mode23,shell,cdecl,inferred,rizin,3,Owner-side removal wrapper for registered-name record modes 2 and 3. It removes one nested callback-entry record by secondary key and then branches on whether the primary name matches the local transport name. The local-owner branch can emit opcode 5 and remove the whole registered-name entry through multiplayer_transport_remove_registered_name_entry while the remote branch emits opcode 7 subtype notifications through the installed owner callbacks.,rizin + llvm-objdump
0x00599180,160,multiplayer_transport_publish_registered_name_callback_remove_mode1,shell,cdecl,inferred,rizin,3,Small publish helper for registered-name callback-removal mode 1. It removes the named nested callback-entry and then emits the same owner callback notifications as the wider mode-1 removal path through opcode 7 and opcode 12 when the target entry is dirty and callback-enabled.,rizin + llvm-objdump
0x00599230,25,multiplayer_transport_dispatch_registered_name_callback_remove_mode1,shell,cdecl,inferred,rizin,3,Dispatch shim for registered-name callback-removal mode 1. When the input record kind equals 1 it forwards the primary name and one mode-1 removal helper descriptor into multiplayer_transport_dispatch_registered_name_callback_entry so the removal helper runs against each matching registered-name entry.,rizin + llvm-objdump
0x00599250,160,multiplayer_transport_publish_registered_name_callback_remove_mode3,shell,cdecl,inferred,rizin,3,Small publish helper for registered-name callback-removal mode 3. It removes the named nested callback-entry and emits the mode-3 owner callback notifications through opcode 7 and opcode 12 when the target registered-name entry is dirty and callback-enabled.,rizin + llvm-objdump
0x00599300,25,multiplayer_transport_dispatch_registered_name_callback_remove_mode3,shell,cdecl,inferred,rizin,3,Dispatch shim for registered-name callback-removal mode 3. When the input record kind equals 2 it forwards the primary name and one mode-3 removal helper descriptor into multiplayer_transport_dispatch_registered_name_callback_entry.,rizin + llvm-objdump
0x00599320,93,multiplayer_transport_handle_registered_name_display_text_record_mode2,shell,cdecl,inferred,rizin,4,Owner-side wrapper for registered-name display-text record mode 2. It copies the record string into the inline display buffer through multiplayer_transport_set_registered_name_display_text and when the target registered-name entry has an installed owner callback emits opcode 9 carrying the primary name and copied display text.,rizin + llvm-objdump
0x00599380,253,multiplayer_transport_apply_registered_name_update_bundle,shell,cdecl,inferred,rizin,4,Applies one parsed update bundle to an existing registered-name entry. It walks the decoded element list from 0x00598630 and uses the element tags to route updates into multiplayer_transport_update_registered_name_callback_flags multiplayer_transport_set_registered_name_status_text and the header read or write pair multiplayer_transport_try_read_registered_name_header_block plus multiplayer_transport_set_registered_name_header_block before releasing the decoded bundle object.,rizin + llvm-objdump
0x005997f0,177,multiplayer_transport_handle_registered_name_display_text_record_mode3,shell,cdecl,inferred,rizin,3,Owner-side wrapper for registered-name display-text record mode 3. It stores the supplied display text into the inline registered-name buffer and either resolves one pending template node through multiplayer_transport_find_pending_template_node plus multiplayer_transport_dispatch_pending_template_node or falls back to emitting opcode 9 through the installed owner callback for the target registered-name entry.,rizin + llvm-objdump
0x005998b0,171,multiplayer_transport_handle_registered_name_display_text_clear_record,shell,cdecl,inferred,rizin,3,Owner-side wrapper for clearing registered-name display text. It builds a small mode-2 template with the shared empty string and either satisfies that request through multiplayer_transport_find_pending_template_node plus multiplayer_transport_dispatch_pending_template_node or emits opcode 9 with the empty display text through the installed owner callback for the target registered-name entry.,rizin + llvm-objdump
0x00599960,144,multiplayer_transport_handle_pending_template_pair_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Structural mode-3 wrapper over the pending-template path. It builds one single-entry pending-template query from the pair of caller strings then resolves a matching node through multiplayer_transport_find_pending_template_node and dispatches it through multiplayer_transport_dispatch_pending_template_node. When no pending node exists it falls back to the transport-side callback at `[this+0x04]` through multiplayer_transport_dispatch_or_release_callback_binding.,llvm-objdump
0x005999f0,412,multiplayer_transport_handle_registered_name_callback_payload_record_mode8,shell,cdecl,inferred,rizin,3,Owner-side wrapper for registered-name record mode 8. It stages the supplied nested callback-entry payload blocks through multiplayer_transport_stage_registered_name_callback_payload_for_name and then walks the returned template nodes to emit higher-level follow-up notifications including opcode 0x16 and opcode 0x17 based on the decoded template kinds and the marker characters found in the staged payload text through multiplayer_transport_find_pending_template_node plus multiplayer_transport_dispatch_pending_template_node.,rizin + llvm-objdump
0x00599c40,96,multiplayer_transport_copy_backslash_segment,shell,cdecl,inferred,llvm-objdump,4,Copies one backslash-delimited segment from the caller text into a freshly allocated heap string and writes the consumed byte count back through the out-parameter. Higher-level pending-template handlers reuse it to split multi-segment payloads before dispatch or callback fallback.,llvm-objdump
0x00599ca0,320,multiplayer_transport_handle_segment_list_template_record_mode4,shell,cdecl,inferred,llvm-objdump,3,Mode-4 pending-template wrapper for template kind 0x0c. It resolves one pending node through multiplayer_transport_find_pending_template_node splits the caller payload into a temporary heap string list with multiplayer_transport_copy_backslash_segment and then either dispatches that list through multiplayer_transport_dispatch_pending_template_node or falls back to emitting opcode 0x1e through the node-owned callback path before freeing the temporary segments.,llvm-objdump
0x00599de0,128,multiplayer_transport_handle_pair_template_record_mode4,shell,cdecl,inferred,llvm-objdump,3,Compact mode-4 pending-template wrapper for template kind 0x0c. After multiplayer_transport_find_pending_template_node succeeds it forwards two dword values from the matched node-owned payload block into one simple dispatch descriptor and completes the request through multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x00599e60,768,multiplayer_transport_handle_segment_broadcast_template_record_mode5,shell,cdecl,inferred,llvm-objdump,3,Structural mode-5 pending-template wrapper over split payload broadcasting. One branch matches a fixed token and walks the registered-name owner callback list to emit opcode 0x1d once per backslash-delimited segment. The other branch resolves one template-kind 0x0d pending node builds a temporary split-string array with multiplayer_transport_copy_backslash_segment optionally appends node-owned paired strings and then either dispatches the finished descriptor through multiplayer_transport_dispatch_pending_template_node or falls back to opcode 0x1f through the node callback path.,llvm-objdump
0x0059a160,128,multiplayer_transport_handle_triplet_template_record_mode4,shell,cdecl,inferred,llvm-objdump,3,Compact mode-4 pending-template wrapper for template kind 0x0d. After multiplayer_transport_find_pending_template_node succeeds it forwards the caller primary string plus two dword fields from the matched node payload block through multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x0059a1e0,1024,multiplayer_transport_handle_segment_pair_template_record_mode4,shell,cdecl,inferred,llvm-objdump,3,Structural mode-4 sibling of the split-payload template path for template kind 0x0e. One branch matches the fixed auxiliary token and emits opcode 0x1d once per backslash-delimited segment through the installed registered-name owner callbacks. The other branch resolves one pending node builds a temporary split-string array with multiplayer_transport_copy_backslash_segment appends paired node-owned strings and completes the request through multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x0059a650,64,multiplayer_transport_mark_pending_template_kind1_ready,shell,cdecl,inferred,llvm-objdump,3,Small pending-template helper that looks up one kind-1 node through multiplayer_transport_find_pending_template_node and sets the first dword in its payload block to one when present.,llvm-objdump
0x0059a690,448,multiplayer_transport_stage_pending_template_triplet_record_mode4,shell,cdecl,inferred,llvm-objdump,3,Mode-4 helper for pending-template kind 1. It resolves one kind-1 node through multiplayer_transport_find_pending_template_node duplicates the caller strings plus one normalized helper string into heap storage emits opcode 0x0e through 0x0059b790 using the node-owned callback metadata and appends the three staged values into the node payload's parallel pointer arrays for later dispatch.,llvm-objdump
0x0059a850,112,multiplayer_transport_dispatch_pending_template_quintuple_helper,shell,cdecl,inferred,llvm-objdump,3,Small helper that resolves one kind-5 pending-template node through multiplayer_transport_find_pending_template_node and forwards the four dword payload fields stored at `[node+0x1c+0x04..0x10]` through multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x0059a8c0,272,multiplayer_transport_handle_registered_name_update_bundle_record_mode3plus,shell,cdecl,inferred,llvm-objdump,3,Owner-side registered-name update handler for record kinds 3 and above. It decodes one update bundle through 0x00598630 and 0x00598860 tries the registered-name header read or write path through multiplayer_transport_try_read_registered_name_header_block plus multiplayer_transport_set_registered_name_header_block publishes opcode 0x0a when the target entry already has owner callbacks and then completes any waiting kind-5 pending-template node through multiplayer_transport_find_pending_template_node plus multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x0059a9d0,320,multiplayer_transport_handle_pending_template_triplet_record_mode6,shell,cdecl,inferred,llvm-objdump,3,Mode-6 pending-template wrapper that looks up either a kind-4 or kind-7 node through multiplayer_transport_find_pending_template_node. The kind-4 branch copies three caller strings into the node-owned payload slots while the kind-7 branch formats a derived string through 0x0059cbd0 and completes the request through multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x0059ab10,256,multiplayer_transport_handle_token_list_template_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Mode-3 pending-template helper for kind 4. It parses the caller text into a token list with 0x005a3db9 trims leading `-` `@` and `+` markers duplicates each token into heap storage and appends the cleaned strings into the node-owned dynamic vector after multiplayer_transport_find_pending_template_node succeeds.,llvm-objdump
0x0059ac10,144,multiplayer_transport_dispatch_extended_template_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Mode-3 helper for kind-4 pending-template nodes. After multiplayer_transport_find_pending_template_node succeeds it builds one extended dispatch descriptor from the caller string a boolean derived from the first payload dword and the remaining four dwords stored in the node payload block then completes the request through multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x0059aca0,176,multiplayer_transport_append_string_template_record_mode8,shell,cdecl,inferred,llvm-objdump,3,Helper for pending-template kind 8. It resolves one node through multiplayer_transport_find_pending_template_node grows the node-owned pointer vector through tracked_heap_resize_with_header duplicates the caller string and appends that heap string to the vector.,llvm-objdump
0x0059ad50,112,multiplayer_transport_dispatch_string_vector_template_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Mode-3 dispatch helper for pending-template kind 8. It resolves one node through multiplayer_transport_find_pending_template_node then forwards the caller key together with the node-owned string-count and string-vector pointers through multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x0059adc0,96,multiplayer_transport_handle_local_name_record_mode2,shell,cdecl,inferred,llvm-objdump,4,Mode-2 transport-state setter for the local name buffer at `[this+0x36c]`. It copies the caller string into that fixed buffer clears state dword `[this+0x04]` sets active flag `[this+0x00]` and when the transport owner callback at `[this+0x14]` is installed invokes it with mode `1` and the owner cookie at `[this+0x18]`.,llvm-objdump
0x0059ae20,176,multiplayer_transport_handle_transport_text_pair_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Mode-3 transport-state setter for a pair of fixed text buffers. It copies the caller strings into the fixed buffers at `[this+0x564]` and `[this+0x140]` updates the associated length or dirty fields through helpers 0x005a1050 and 0x005a0d00 marks `[this+0x13c]` active and refreshes the transport-side status line rooted at `[this+0x1c]` through 0x0059caf0.,llvm-objdump
0x0059aed0,112,multiplayer_transport_handle_normalized_pair_template_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Mode-3 wrapper that normalizes the secondary caller string through 0x005a1ea5 then resolves one kind-0x10 pending-template node through multiplayer_transport_find_pending_template_node and completes it through multiplayer_transport_dispatch_pending_template_node with the normalized value plus the original secondary string.,llvm-objdump
0x00597920,56,multiplayer_transport_find_pending_template_kind0c_by_key,shell,cdecl,inferred,llvm-objdump,4,Searches the linked pending-template list rooted at `[this+0x550]` for the first kind-0x0c node whose payload string at `[node+0x1c+0x08]` exactly matches the caller key. It returns the matched node or null.,llvm-objdump
0x0059af40,186,multiplayer_transport_dispatch_fallback_template_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Mode-3 fallback wrapper over the pending-template path. It first queries for either a kind-1 or kind-5 node keyed by the caller string through multiplayer_transport_find_pending_template_node and dispatches the matching node through multiplayer_transport_dispatch_pending_template_node with a minimal descriptor. When neither node exists it falls back to multiplayer_transport_find_pending_template_kind0c_by_key and completes that node with an empty descriptor instead.,llvm-objdump
0x0059b000,103,multiplayer_transport_dispatch_kind1_string_template_record_mode6,shell,cdecl,inferred,llvm-objdump,3,Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `6` and the original string payload.,llvm-objdump
0x0059b070,103,multiplayer_transport_dispatch_kind1_string_template_record_mode2,shell,cdecl,inferred,llvm-objdump,3,Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `2` and the original string payload.,llvm-objdump
0x0059b0e0,103,multiplayer_transport_dispatch_kind1_string_template_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `3` and the original string payload.,llvm-objdump
0x0059b150,103,multiplayer_transport_dispatch_kind1_string_template_record_mode4,shell,cdecl,inferred,llvm-objdump,3,Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `4` and the original string payload.,llvm-objdump
0x0059b1c0,103,multiplayer_transport_dispatch_kind1_string_template_record_mode5,shell,cdecl,inferred,llvm-objdump,3,Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `5` and the original string payload.,llvm-objdump
0x0059b230,103,multiplayer_transport_dispatch_kind1_string_template_record_mode8,shell,cdecl,inferred,llvm-objdump,3,Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `8` and the original string payload.,llvm-objdump
0x0059b2a0,1,multiplayer_transport_noop_cleanup_callback,shell,cdecl,inferred,llvm-objdump,2,Trivial no-op cleanup callback that returns immediately. Current grounded role is as a placeholder callback target in the transport cleanup layer.,llvm-objdump
0x0059b2b0,17,multiplayer_transport_release_optional_callback_binding,shell,cdecl,inferred,llvm-objdump,2,Small cleanup helper that checks the optional callback binding stored at `[this+0x04]` and when present forwards it into multiplayer_transport_dispatch_or_release_callback_binding with mode `1`.,llvm-objdump
0x0059b2d0,8,multiplayer_transport_free_template_entry_owner_string,shell,cdecl,inferred,llvm-objdump,3,Small element cleanup helper that releases the owner string pointer stored at `[entry+0x14]` through tracked_heap_free_with_header. The companion pending-template container uses it as the per-element cleanup callback when destroying its flat vector.,llvm-objdump
0x0059b2e0,1239,multiplayer_transport_destroy_pending_template_dispatch_record,shell,cdecl,inferred,llvm-objdump,3,Type-switched destructor for one pending-template dispatch record. It reads the record kind at `[record+0x00]` and frees the owned payload graph under `[record+0x08]` through tracked_heap_free_with_header including nested string arrays and paired pointer vectors for the more complex template kinds before finally releasing the top-level payload block itself.,llvm-objdump
0x0059b710,40,multiplayer_transport_init_pending_template_dispatch_store,shell,thiscall,inferred,llvm-objdump,3,Initializes the companion flat pending-template dispatch store at `[this+0x55c]` by allocating a stride-0x18 contiguous vector through 0x0059e0b0 and installing multiplayer_transport_free_template_entry_owner_string as the per-element cleanup callback. Returns true on success.,llvm-objdump
0x0059b740,74,multiplayer_transport_destroy_pending_template_dispatch_store,shell,thiscall,inferred,llvm-objdump,3,Destroys the companion flat pending-template dispatch store at `[this+0x55c]`. It walks every live element through multiplayer_transport_destroy_pending_template_dispatch_record and then releases the backing vector through generic_vector_destroy.,llvm-objdump
0x0059c220,458,multiplayer_transport_dispatch_pending_template_dispatch_record,shell,unknown,inferred,rizin,3,Switch-driven dispatcher for one flat pending-template dispatch-store record after the store manager has removed it from the vector. It reads the record kind at `[record+0x00]` invokes the record-owned callback at `[record+0x04]` with a payload tuple rooted at `[record+0x08]` and the owner string or selector at `[record+0x0c]` and then destroys the record through multiplayer_transport_destroy_pending_template_dispatch_record. Case `16` also resolves the registered-name dirty flag through 0x0059d9c0 before invoking the callback.,rizin + llvm-objdump
0x0059c470,203,multiplayer_transport_service_pending_template_dispatch_store,shell,unknown,inferred,rizin,3,"Services the flat pending-template dispatch store at `[this+0x55c]`. It walks every live 0x18-byte entry; entries whose owner string at `[entry+0x14]` no longer resolves through multiplayer_transport_has_registered_name are destroyed and erased immediately, while surviving entries are dispatched only when their registered-name dirty flag is nonzero and the optional filter value in EDX is zero or matches `[entry+0x10]`. Dispatching copies the 0x18-byte record to stack storage, erases the vector slot, and forwards the copied record into multiplayer_transport_dispatch_pending_template_dispatch_record.",rizin + llvm-objdump
0x0059c540,70,multiplayer_transport_find_pending_template_dispatch_record_index,shell,unknown,inferred,rizin,4,Searches the flat pending-template dispatch store at `[this+0x55c]` for the first record whose selector or request field at `[entry+0x10]` matches the caller key. It returns the zero-based vector index on success or `-1` when no record matches.,rizin + llvm-objdump
0x0059c590,21,multiplayer_transport_has_pending_template_dispatch_record,shell,unknown,inferred,rizin,4,Boolean wrapper over multiplayer_transport_find_pending_template_dispatch_record_index. It returns true when the flat pending-template dispatch store currently contains one record for the caller key and false otherwise.,rizin + llvm-objdump
0x0059c5b0,40,growable_text_buffer_init,support,unknown,inferred,rizin,3,"Initializes one heap-backed growable text buffer structure. It clears the used-length field at `[buf+0x04]`, seeds the initial capacity at `[buf+0x08]` to `0x2000`, allocates a `0x2001`-byte NUL-terminated backing block through tracked_heap_alloc_with_header, stores that pointer at `[buf+0x00]`, and returns true on success.",rizin + llvm-objdump
0x0059c5e0,3,growable_text_buffer_free,support,unknown,inferred,rizin,4,Small wrapper that frees the heap-backed buffer pointer stored at `[buf+0x00]` through tracked_heap_free_with_header.,rizin + llvm-objdump
0x0059c5f0,65,growable_text_buffer_reserve_append,support,unknown,inferred,rizin,4,Ensures that one growable text buffer has room to append the requested byte count in ECX while preserving a trailing NUL terminator. When `[buf+0x04] + requested` would exceed capacity `[buf+0x08]` it rounds the new capacity up in 0x2000-byte chunks resizes the backing block through tracked_heap_resize_with_header stores the new pointer at `[buf+0x00]` and updates `[buf+0x08]` before returning success or failure.,rizin + llvm-objdump
0x0059c670,76,multiplayer_transport_text_stream_init,shell,thiscall,inferred,rizin,3,Initializes one multiplayer transport text-stream object. It zeroes the 0x350-byte state block seeds socket `[this+0x00]` to `-1` and allocates two growable text buffers at `[this+0x108]` and `[this+0x114]` through growable_text_buffer_init. Failure to allocate the second buffer frees the first and returns false.,rizin + llvm-objdump
0x0059c790,194,multiplayer_transport_text_stream_destroy,shell,thiscall,inferred,rizin,4,"Destroys one multiplayer transport text-stream object. If socket `[this+0x00]` is live it shuts it down with `shutdown(..., 2)` and `closesocket`, marks state `[this+0x04]` as closed, frees the two growable text buffers at `[this+0x108]` and `[this+0x114]`, releases the fixed pointer fields at `[this+0x328]` through `[this+0x344]`, then walks and frees the pointer vector rooted at `[this+0x348]` before freeing that vector itself.",rizin + llvm-objdump
0x0059c860,300,multiplayer_transport_select_socket_ready_flags,shell,cdecl,inferred,rizin,4,"Small `select` wrapper for one transport socket. It takes the socket on the stack plus up to three optional out-pointers for read write and exception readiness, builds the requested `fd_set` structures on the stack, calls `select(0x40, ...)` with a null timeout, and stores `1` or `0` into each requested out-slot depending on whether `__WSAFDIsSet` reports that socket as ready.",rizin + llvm-objdump
0x0059c990,113,multiplayer_transport_text_stream_send_pump,shell,thiscall,inferred,rizin,4,"Attempts to flush queued bytes from the transport text-stream send buffer at `[this+0x114]`. While buffered length `[this+0x118]` remains nonzero it probes writability through multiplayer_transport_select_socket_ready_flags, sends up to `min(len, 0x400)` bytes with `send`, slides any remaining buffered bytes down through `0x0059c640`, and continues until the socket is no longer writable or the buffer is empty.",rizin + llvm-objdump
0x0059ca10,190,multiplayer_transport_text_stream_recv_pump,shell,thiscall,inferred,rizin,3,Receives available socket text into the transport text-stream receive buffer at `[this+0x108]`. It first probes readability through multiplayer_transport_select_socket_ready_flags then repeatedly reserves 0x1000 bytes through growable_text_buffer_reserve_append calls `recv` into the free tail of the buffer optionally applies the stream-cipher helper at 0x005a0f70 when `[this+0x120]` is armed advances the used-length field at `[this+0x10c]` NUL-terminates the buffer and loops while readability remains set. Socket errors store closed-state value `2` into `[this+0x04]`.,rizin + llvm-objdump
0x0059cad0,25,multiplayer_transport_text_stream_service_io,shell,thiscall,inferred,rizin,4,Services one multiplayer transport text-stream I/O step unless state `[this+0x04]` is already closed. It first flushes queued outbound bytes through multiplayer_transport_text_stream_send_pump and then pumps inbound socket text through multiplayer_transport_text_stream_recv_pump.,rizin + llvm-objdump
0x0059caf0,216,multiplayer_transport_text_stream_append_crlf_line,shell,thiscall,inferred,rizin,4,"Appends one caller text line plus `\\r\\n` to the transport text-stream send buffer at `[this+0x114]`. It ignores requests when state `[this+0x04]` is already closed, reserves `strlen(text) + 2` bytes through growable_text_buffer_reserve_append, copies the bytes into the current tail tracked by `[this+0x118]`, appends CRLF, and updates the used-length field. When the stream-cipher gate at `[this+0x120]` is armed it post-processes the newly appended span through 0x005a0f70 using the send-side cipher state rooted at `[this+0x226]`.",rizin + llvm-objdump
0x00597880,159,multiplayer_transport_find_pending_template_node,shell,cdecl,inferred,rizin,4,Searches the linked pending-template list rooted at `[this+0x550]` for the first node whose caller-provided query tuple array matches the node kind and its primary and secondary string selectors. When it finds a match it refreshes the node timeout field at `[node+0x04]` from GetTickCount plus 0xea60 and returns that node pointer otherwise it returns null.,rizin + llvm-objdump
0x005979d0,1164,multiplayer_transport_dispatch_pending_template_node,shell,cdecl,inferred,rizin,3,Consumes one pending-template node and one caller dispatch descriptor. Depending on the node kind it emits one or more transport notifications through 0x0059b790 using the node-owned strings arrays and callback state then releases the node-owned heap strings arrays and child lists before unlinking the node from the pending-template list. Higher-level registered-name wrappers reuse it as the common completion path after multiplayer_transport_find_pending_template_node succeeds.,rizin + llvm-objdump
0x005996c0,304,multiplayer_transport_handle_pending_template_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Structural mode-3 wrapper over the pending-template path for registered-name updates. It normalizes the caller selector string against the shared default token at 0x005e1e1c builds a four-way pending-template query and dispatches the matched node through multiplayer_transport_dispatch_pending_template_node. Depending on the matched node kind it can mark the registered-name entry dirty through multiplayer_transport_mark_registered_name_dirty or forward the node-owned payload fields into the dispatch descriptor.,llvm-objdump
0x00565c90,208,shell_queue_indexed_world_anchor_marker,shell,cdecl,inferred,ghidra-headless,3,Variant world-anchor marker emitter that selects one indexed entry from the owner table at +0x24 using byte [this+0xd8] derives scale and packed color from the entry fields and enqueues the resulting type-0x01 deferred message through shell_enqueue_deferred_message_type1.,ghidra + rizin + llvm-objdump
0x005662a0,964,shell_emit_sprite_billboard_quad_vertex24,bootstrap,thiscall,inferred,ghidra-headless,4,Expands one sprite billboard into six vertex24 records forming two textured triangles. It derives an alpha byte from item timing flags at [this+0x48] [this+0x4c] and [this+0x5c] combines that alpha with packed color [this+0x70] scales a prepared four-corner basis by [this+0x44] and writes six 24-byte vertices using atlas uv pairs from [this+0x2c..0x38].,ghidra + rizin + llvm-objdump
0x00566670,84,shell_prepare_sprite_billboard_basis,bootstrap,thiscall,inferred,ghidra-headless,3,Builds the temporary four-corner sprite-billboard basis used by 0x005662a0 from the current shell transform state and writes the result into global scratch vectors around 0x00d97ae0 and 0x00d97b98.,ghidra + rizin + llvm-objdump
0x0055e2b0,179,shell_create_layout_state,bootstrap,thiscall,inferred,ghidra-headless,4,Allocates a 0x3715-byte layout-state object for the shell controller stores it at [this+0x2d] seeds the dirty flags invokes 0x0054bc10 with owner state and a template byte from the shell bundle then binds the first presentation asset bundle through 0x00543f10 before later update hooks run.,ghidra + rizin
0x005679b0,569,shell_emit_animated_quad_vertex24,bootstrap,thiscall,inferred,ghidra-headless,4,Expands one cell-list item into four `vertex24` corner records with a time-varying color phase. The helper derives an 8-step brightness cycle from GetTickCount plus item field [this+0x3a] combines that phase with per-corner bytes at +0x35 through +0x38 and mask bytes at +0x31 through +0x34 and writes four 24-byte vertices from the quad corner positions stored across +0x00..+0x2c.,ghidra + rizin + llvm-objdump
0x00567c70,103,shell_stream_primary_cell_quad_list,bootstrap,thiscall,inferred,ghidra-headless,4,Streams the primary quad-item list rooted at [this+0x1c] into the caller's `vertex24` buffer. It seeds the shared color input through 0x00d97bbc iterates each list entry through 0x005679b0 and advances the destination pointer by count*0x90 for four vertices per item.,ghidra + rizin + llvm-objdump
0x00567ce0,105,shell_stream_alternate_cell_quad_list,bootstrap,thiscall,inferred,ghidra-headless,4,Streams the alternate quad-item list rooted at [this+0x20] into the caller's `vertex24` buffer using the same quad writer at 0x005679b0. Unlike the primary path it forwards an extra caller-supplied selector value into each emitted quad before advancing the destination pointer by count*0x90.,ghidra + rizin + llvm-objdump
0x005a644d,81,__heap_init,startup,cdecl,inferred,ghidra-headless,4,Initializes the CRT heap path via ___heap_select and ___sbh_heap_init before later allocations occur.,ghidra + rizin
0x005abd49,111,startup_init_tls_state,startup,unknown,inferred,ghidra-headless,3,Initializes per-thread startup state: mt locks plus TLS slot allocation and current-thread bookkeeping.,ghidra + rizin
0x005abf1b,510,startup_init_file_handle_table,startup,cdecl,inferred,ghidra-headless,4,Allocates and seeds the CRT file descriptor table then consumes STARTUPINFO handles and classifies inherited std handles.,ghidra + rizin
0x005aca5d,61,startup_run_init_callback_table,startup,unknown,inferred,ghidra-headless,3,Walks a startup callback table and invokes non-null entries before continuing the CRT path.,ghidra + rizin
0x005ad12d,199,__setenvp,startup,cdecl,inferred,ghidra-headless,4,Builds the process envp array by counting environment strings and splitting name/value entries around '='.,ghidra + rizin
0x005ad360,162,startup_build_argv,startup,cdecl,inferred,ghidra-headless,3,Initializes the multibyte table and uses a two-pass helper to count and copy argv entries from the process command line.,ghidra + rizin
0x005ad402,290,___crtGetEnvironmentStringsA,startup,cdecl,inferred,ghidra-headless,4,Copies the Windows environment block into CRT-owned storage before envp construction.,ghidra + rizin