Back to legacygamers.net
WARPGATE

Game Core

CGameMode, CGameObject, CInputMgr, CStoveSDK, initialization, settings, hotkeys, timers, crash handling, services, utilities

Functions 4,924 to 6,480 of 8,042Code 2.5 MBAddresses 0x00A552A0 to 0x00C8BDF0Group Game Logic
1,557 functions
AddressSizeNameDescription
0x00A552A084UITextBoxE__dtor_00a552a0Destructor for UITextBoxE. Sets vtable chain PTR_FUN_01154100 then PTR_FUN_0114875c, calls base dtor FUN_00a79e90.
0x00A55300112UITextBoxA__scalar_deleting_dtor_00a55300Scalar deleting destructor for UITextBoxA. Calls dtor chain, then frees 0x8c bytes if param_2 & 1.
0x00A5537099UITextBoxB__scalar_deleting_dtor_00a55370Scalar deleting destructor for UITextBoxB. Calls dtor, then frees 0xf4 bytes if param_2 & 1.
0x00A553E099UITextBoxC__scalar_deleting_dtor_00a553e0Scalar deleting destructor for UITextBoxC. Calls dtor, then frees 0xf8 bytes if param_2 & 1.
0x00A55450112UITextBoxD__scalar_deleting_dtor_00a55450Scalar deleting destructor for UITextBoxD. Calls dtor chain, then frees 0xa4 bytes if param_2 & 1.
0x00A554C0112UITextBoxE__scalar_deleting_dtor_00a554c0Scalar deleting destructor for UITextBoxE. Calls dtor chain, then frees 0x98 bytes if param_2 & 1.
0x00A55530274UIQuestList__add_item_00a55530Adds an item to the quest list's linked list (at +0xd4). Allocates a 0x10-byte node, copies 8 bytes from param_2 (quest id + data). Increments count at +0xd8. If param_3 is true, recalculates scroll height and marks dirty. Throws Xlength_error if list at max (0xfffffff).
0x00A58640113UIQuestTabEntry__ctor_00a58640Constructor for UIQuestTabEntry. Calls base ctor FUN_00a79a90, sets vtable to PTR_FUN_01154380, initializes field +0x20 to zero. Object size 0x84.
0x00A586C0242UIQuestWindowChild__ctor_00a586c0Constructor for UIQuestWindowChild. Calls UIWindowBase__ctor, sets vtable to PTR_FUN_01154538. Initializes text color to 0xffffff, highlight color to 0xcecece, line spacing=3, and child fields 0x36-0x3a to zero. Object size 0xec.
0x00A5891084UIQuestTabEntry__dtorDestructor for UIQuestTabEntry. Sets vtable to UIQuestTabEntry then UIBase, then calls CEffect__dtor to destroy the base class.
0x00A5897071UIQuestWindowChild__dtor_00a58970Destructor for UIQuestWindowChild. Sets vtable to PTR_FUN_01154538, calls base window dtor FUN_009e69d0.
0x00A58A30112UIQuestTabEntry__scalar_deleting_dtor_00a58a30Scalar deleting destructor for UIQuestTabEntry. Sets vtable chain, calls base dtor, frees 0x84 bytes if param_2 & 1.
0x00A58AA099UIQuestWindowChild__scalar_deleting_dtor_00a58aa0Scalar deleting destructor for UIQuestWindowChild. Sets vtable, calls base window dtor, frees 0xec bytes if param_2 & 1.
0x00A59BB0201CListBoxDialogB__ctor_00a59bb0Constructor for CListBoxDialogB. Calls base UIBase ctor, sets vtable to PTR_CListBoxDialog. Initializes background color to 0xf7f7f7, alternate color to 0xc6c6c6, sets enabled flag and various zero fields.
0x00A5A3D040decrypt_xor_buffer_0x2fDecrypts a 0x2F-byte XOR-encrypted buffer in place. Checks flag at offset +0x2F; if set, calls xor_decrypt_buffer with keys 0x9b1f95d7/0x0b874551, then clears the flag. Returns pointer to the buffer.
0x00A5A40040decrypt_xor_buffer_0x30Decrypts a 0x30-byte XOR-encrypted buffer in place. Checks flag at offset +0x30; if set, calls xor_decrypt_buffer with keys 0x15d1dbcf/0x136f2f99, then clears the flag. Returns pointer to the buffer.
0x00A5A43040decrypt_xor_buffer_0x30_00a5a430Decrypts a 0x30-byte XOR-encrypted buffer in place. Checks flag at offset +0x30; if set, calls xor_decrypt_buffer with keys 0x75573d41/0x674d9f39, then clears the flag. Returns pointer to the buffer.
0x00A5A46040decrypt_xor_buffer_0x30_00a5a460Decrypts a 0x30-byte XOR-encrypted buffer in place. Checks flag at offset +0x30; if set, calls xor_decrypt_buffer with keys 0x2bfdad51/0x6bdf334f, then clears the flag. Returns pointer to the buffer.
0x00A5A49040decrypt_xor_buffer_0x31Decrypts a 0x31-byte XOR-encrypted buffer in place. Checks flag at offset +0x31; if set, calls xor_decrypt_buffer with keys 0x21557d3d/0x659975c1, then clears the flag. Returns pointer to the buffer.
0x00A5A4C040decrypt_xor_buffer_0x32Decrypts a 0x32-byte XOR-encrypted buffer in place. Checks flag at offset +0x32; if set, calls xor_decrypt_buffer with keys 0xa5755b7f/0x85e1f5a7, then clears the flag. Returns pointer to the buffer.
0x00A5A4F040decrypt_xor_buffer_0x33Decrypts a 0x33-byte XOR-encrypted buffer in place. Checks flag at offset +0x33; if set, calls xor_decrypt_buffer with keys 0x9f93a527/0xad615301, then clears the flag. Returns pointer to the buffer.
0x00A5A52040decrypt_xor_buffer_0x34Decrypts a 0x34-byte XOR-encrypted buffer in place. Checks flag at offset +0x34; if set, calls xor_decrypt_buffer with keys 0xa1a77f59/0xbff5c517, then clears the flag. Returns pointer to the buffer.
0x00A64A8068scalar_deleting_dtor_00a64a80Scalar deleting destructor. If param_2 is nonzero, frees 8-byte object via operator delete.
0x00A64AD068scalar_deleting_dtor_00a64ad0Scalar deleting destructor. If param_2 is nonzero, frees 8-byte object via operator delete.
0x00A64B2068scalar_deleting_dtor_00a64b20Scalar deleting destructor. If param_2 is nonzero, frees 8-byte object via operator delete.
0x00A64B7068scalar_deleting_dtor_00a64b70Scalar deleting destructor. If param_2 is nonzero, frees 8-byte object via operator delete.
0x00A64BC068scalar_deleting_dtor_00a64bc0Scalar deleting destructor. If param_2 is nonzero, frees 8-byte object via operator delete.
0x00A64C1068scalar_deleting_dtor_00a64c10Scalar deleting destructor. If param_2 is nonzero, frees 8-byte object via operator delete.
0x00A64C6068scalar_deleting_dtor_00a64c60Scalar deleting destructor. If param_2 is nonzero, frees 8-byte object via operator delete.
0x00A64CB068scalar_deleting_dtor_00a64cb0Scalar deleting destructor. If param_2 is nonzero, frees 8-byte object via operator delete.
0x00A64D0068scalar_deleting_dtor_00a64d00Scalar deleting destructor. If param_2 is nonzero, frees 8-byte object via operator delete.
0x00A64D5068scalar_deleting_dtor_00a64d50Scalar deleting destructor. If param_2 is nonzero, frees 8-byte object via operator delete.
0x00A64DA020wrapper_call_null_stub_00a64da0Wrapper that dereferences param_1 and calls null_stub_00a67fa0 with the value.
0x00A6524022init_delegate_00a65240Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A6526022init_delegate_00a65260Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A6528022init_delegate_00a65280Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A652A022init_delegate_00a652a0Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A652C022init_delegate_00a652c0Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A652E022init_delegate_00a652e0Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A6530022init_delegate_00a65300Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A6532022init_delegate_00a65320Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A6534022init_delegate_00a65340Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A6536022init_delegate_00a65360Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A6538022init_delegate_00a65380Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A653A022init_delegate_00a653a0Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A653C022init_delegate_00a653c0Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A653E022init_delegate_00a653e0Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A6540022init_delegate_00a65400Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A6542022init_delegate_00a65420Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A6544022init_delegate_00a65440Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A6546022init_delegate_00a65460Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A6548022init_delegate_00a65480Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A654A022init_delegate_00a654a0Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A654C022init_delegate_00a654c0Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A654E022init_delegate_00a654e0Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A6550022init_delegate_00a65500Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A6552022init_delegate_00a65520Initializes a delegate/functor: sets vtable pointer and captures context from this+4.
0x00A658C0155format_string_fixed_notation_00a658c0Formats a string using fixed-point notation. Extracts the string buffer (handles SSO), sets up format options (0xC0000000 flags), then calls charconv__format_fixed_notation.
0x00A6596075compute_log2_wrapper_00a65960Wrapper that calls log2() on an integer parameter. Sets up SEH frame around the call.
0x00A65AF0373UITextBox__ctor_00a65af0Constructor for a UITextBox control. Calls UIWindowBase__ctor, sets vtable, initializes text colors (0xFFFFFF foreground, 0xCECECE secondary), alignment=3, enabled=1, zero-initializes text buffer fields. Includes embedded SSO string at offset 0x44 (capacity 0xF).
0x00A65DB0144UITextBox__dtor_00a65db0Destructor for UITextBox. Sets vtable, destroys child windows (0x271A, 0x2719), destroys embedded string, cleans up text box state, and calls parent destructor.
0x00A65F20168UITextBox__scalar_deleting_dtor_00a65f20Scalar deleting destructor for UITextBox (size 0x128). Runs destructor logic (destroy child windows, string, state), then conditionally frees memory.
0x00A65FD0262UIQuestList__add_entry_00a65fd0Adds an entry to the quest list (doubly-linked list at offset 0xD4). Allocates a 12-byte node, inserts at end. If param_3 is true, recalculates scroll bounds and marks dirty. Returns new index. Throws std::length_error if list is full (0x15555555).
0x00A662D0160UIQuestList__clear_all_entries_00a662d0Clears all entries from the quest list. Walks doubly-linked list at offset 0xD4, frees each 12-byte node, resets head/tail pointers, sets count to 0 and selected index to -1. Recalculates scroll bounds and marks dirty.
0x00A66F4060UIQuestBtn__on_mouse_down_00a66f40Mouse down handler for quest button. Calls UIButton__on_click, sets pressed flag (+0x41=1), updates scroll position (offset+1), and calls virtual redraw at vtable+0x98.
0x00A66F8058UIQuestBtn__on_mouse_up_00a66f80Mouse up handler for quest button. Calls UIButton__on_release_check_focus, clears pressed flag (+0x41=0), restores scroll position, and calls virtual redraw at vtable+0x98.
0x00A66FC038UIQuestBtn__on_mouse_leave_00a66fc0Mouse leave handler for quest button. Clears pressed flag, restores scroll position, and calls virtual redraw.
0x00A67CE089UIQuestList__scroll_to_and_select_00a67ce0Scrolls the quest list to the given index and selects it. Calculates scroll position from entry height (offset 0xB8) times index, then searches child items for one with matching index at +0x94. If found, calls FUN_00a64160 to visually select it. Returns 1 if found, 0 otherwise.
0x00A6900099UIListView__scalar_deleting_dtorScalar deleting destructor for UIListView. Sets vtable, calls FUN_009f7f70 to destroy base, and conditionally frees the 0x1D8-byte object if param_2 bit 0 is set.
0x00A69070353UIListView__create_item_buttonCreates a button item for a UIListView. Allocates 0xF8-byte object via FUN_00a6f3f0, sets size from stored dimensions (+0xB4/+0xB8), hides it initially, applies state textures from the parent's normal/hover/pressed/disabled pointers (+0x80-0x8C). Sets up two delegate callbacks and adds the button as a child control.
0x00A694F085UITextBox__reset_layout_00a694f0Resets the text box layout. Clears flags at offset 0x2D, sets size to 387x283, position to 0,0, applies original size, invalidates, clears all skin colors, sets alignment mode to 3.
0x00A6E30022init_delegate_00a6e300Initializes a delegate functor by storing a vtable and callback pointer.
0x00A6E32022init_delegate_00a6e320Initializes a delegate functor by storing a vtable and callback pointer.
0x00A6E34022init_delegate_00a6e340Initializes a delegate functor by storing a vtable and callback pointer.
0x00A6E36022init_delegate_00a6e360Initializes a delegate functor by storing a vtable and callback pointer.
0x00A6E38022init_delegate_00a6e380Initializes a delegate functor by storing a vtable and callback pointer.
0x00A6E3A022init_delegate_00a6e3a0Initializes a delegate functor by storing a vtable and callback pointer.
0x00A6E3C022init_delegate_00a6e3c0Initializes a delegate functor by storing a vtable and callback pointer.
0x00A6E3E022init_delegate_00a6e3e0Initializes a delegate functor by storing a vtable and callback pointer.
0x00A6E40022init_delegate_00a6e400Initializes a delegate functor by storing a vtable and callback pointer.
0x00A6E42022init_delegate_00a6e420Initializes a delegate functor by storing a vtable and callback pointer.
0x00A6E44022init_delegate_00a6e440Initializes a delegate object: sets vtable pointer and copies the context pointer (offset +4) from source to destination.
0x00A6E46022init_delegate_00a6e460Initializes a delegate object: sets vtable pointer and copies the context pointer (offset +4) from source to destination.
0x00A6E48022init_delegate_00a6e480Initializes a delegate object: sets vtable pointer and copies the context pointer (offset +4) from source to destination.
0x00A6E4A022init_delegate_00a6e4a0Initializes a delegate object: sets vtable pointer and copies the context pointer (offset +4) from source to destination.
0x00A6E4C068scalar_deleting_dtor_00a6e4c0Scalar deleting destructor. If param_2 is nonzero, frees 8-byte object via operator delete.
0x00A6E51068scalar_deleting_dtor_00a6e510Scalar deleting destructor. If param_2 is nonzero, frees 8-byte object via operator delete.
0x00A6E56068scalar_deleting_dtor_00a6e560Scalar deleting destructor. If param_2 is nonzero, frees 8-byte object via operator delete.
0x00A6E5B068scalar_deleting_dtor_00a6e5b0Scalar deleting destructor. If param_2 is nonzero, frees 8-byte object via operator delete.
0x00A6E60068scalar_deleting_dtor_00a6e600Scalar deleting destructor. If param_2 is nonzero, frees 8-byte object via operator delete.
0x00A6E65068scalar_deleting_dtor_00a6e650Scalar deleting destructor. If param_2 is nonzero, frees 8-byte object via operator delete.
0x00A6E6A068UIListView__conditional_free_aConditional free for a UIListView callback object. If param_2 is nonzero, frees the 8-byte object.
0x00A6E6F068UIListView__conditional_free_bConditional free for a UIListView callback object. If param_2 is nonzero, frees the 8-byte object.
0x00A6E74068UIListView__conditional_free_cConditional free for a UIListView callback object. If param_2 is nonzero, frees the 8-byte object.
0x00A6E79068scalar_deleting_dtor_00a6e790Scalar deleting destructor. If param_2 is nonzero, frees 8-byte object via operator delete.
0x00A6E7E068scalar_deleting_dtor_00a6e7e0Scalar deleting destructor. If param_2 is nonzero, frees 8-byte object via operator delete.
0x00A6E83068scalar_deleting_dtor_00a6e830Scalar deleting destructor. If param_2 is nonzero, frees 8-byte object via operator delete.
0x00A6E88068scalar_deleting_dtor_00a6e880Scalar deleting destructor. If param_2 is nonzero, frees 8-byte object via operator delete.
0x00A6E8D068scalar_deleting_dtor_00a6e8d0Scalar deleting destructor. If param_2 is nonzero, frees 8-byte object via operator delete.
0x00A6E93023ShopUI__delegate_populate_shop_item_listDelegate wrapper: dereferences param_1 to get 'this' pointer, then calls ShopUI__populate_shop_item_list with it and param_2.
0x00A6E95023UIListView__delegate_set_text_from_item_dataDelegate wrapper: dereferences param_1 to get 'this' pointer, then calls UIListView__set_text_from_item_data with it and param_2.
0x00A6E97065notify_tabs_selected_00a6e970Iterates through all tab objects in a container (offsets 0xC8-0xCC), calling virtual method at vtable+0xDC with a boolean indicating whether each tab matches the selected one.
0x00A6E9C065notify_tabs_selected_00a6e9c0Iterates through all tab objects in a container (offsets 0xC8-0xCC), calling virtual method at vtable+0xDC with a boolean indicating whether each tab matches the selected one. Duplicate of 00a6e970.
0x00A6EA5023wrapper_forward_2arg_00a6ea50Delegate wrapper: dereferences param_1 and forwards with param_2 to null_stub_00a6fe10 (no-op).
0x00A6EA7023wrapper_forward_2arg_00a6ea70Delegate wrapper: dereferences param_1 and forwards with param_2 to UIListView__display_item_details.
0x00A6EA90216tab_select_handler_00a6ea90Tab selection handler for a UITabControl. When a tab is clicked (and control is not locked at offset 0xC4): deselects all other tabs via vtable+0xD8(0), selects the clicked tab via vtable+0xD8(1), performs RTDynamicCast to get tab index, stores selected index at offset 0xDC, and invokes a callback through a linked list at offset 0xD4.
0x00A6EB70216tab_select_handler_00a6eb70Tab selection handler for a UITabControl. Same logic as tab_select_handler_00a6ea90 but for a different tab control type (different RTTI cast target). Deselects other tabs, selects clicked tab, stores index, invokes callback.
0x00A6ED8022init_delegate_00a6ed80Initializes a delegate object: sets vtable pointer and copies the context pointer (offset +4) from source to destination.
0x00A6EDA022init_delegate_00a6eda0Initializes a delegate object: sets vtable pointer and copies the context pointer (offset +4) from source to destination.
0x00A6EDC022init_delegate_00a6edc0Initializes a delegate object: sets vtable pointer and copies the context pointer (offset +4) from source to destination.
0x00A6EDE022init_delegate_00a6ede0Initializes a delegate object: sets vtable pointer and copies the context pointer (offset +4) from source to destination.
0x00A6EE0022init_delegate_00a6ee00Initializes a delegate object: sets vtable pointer and copies the context pointer (offset +4) from source to destination.
0x00A6EE2022init_delegate_00a6ee20Initializes a delegate object: sets vtable pointer and copies the context pointer (offset +4) from source to destination.
0x00A6EE4022init_delegate_00a6ee40Initializes a delegate object: sets vtable pointer and copies the context pointer (offset +4) from source to destination.
0x00A6EE6022init_delegate_00a6ee60Initializes a delegate object: sets vtable pointer and copies the context pointer (offset +4) from source to destination.
0x00A6EE8022init_delegate_00a6ee80Initializes a delegate object: sets vtable pointer and copies the context pointer (offset +4) from source to destination.
0x00A6EEA022init_delegate_00a6eea0Initializes a delegate object: sets vtable pointer and copies the context pointer (offset +4) from source to destination.
0x00A6EEC022init_delegate_00a6eec0Initializes a delegate object: sets vtable pointer and copies the context pointer (offset +4) from source to destination.
0x00A6EEE022init_delegate_00a6eee0Initializes a delegate object: sets vtable pointer and copies the context pointer (offset +4) from source to destination.
0x00A6EF0022init_delegate_00a6ef00Initializes a delegate object: sets vtable pointer and copies the context pointer (offset +4) from source to destination.
0x00A6EF2022init_delegate_00a6ef20Initializes a delegate object: sets vtable pointer and copies the context pointer (offset +4) from source to destination.
0x00A6EF40341delegate__swap_polymorphicSwaps two polymorphic delegate objects. Handles 4 cases: both non-local (simple pointer swap), both local (full clone+swap), one local/one remote (clone local to temp, move remote, clone temp to target). Uses virtual clone (vtable+4) and destroy (vtable+0x10) methods. The delegate's storage is at offset [9] in the param arrays.
0x00A6F0A0341delegate__swap_polymorphic_altSame logic as delegate__swap_polymorphic. Swaps two polymorphic delegate objects handling local/remote storage cases with virtual clone and destroy. Duplicate at different address.
0x00A6F3F0114UIListViewItem__ctorConstructor for UIListViewItem. Calls UIButton__ctor as base class, sets custom vtable, zeroes three members at offsets +0x3A through +0x3C (label, icon, data pointers).
0x00A6F470262UIListViewWindow__ctorConstructor for UIListViewWindow. Calls UIWindowBase__ctor as base, sets CUIWindow vtable, initializes colors (white 0xFFFFFF, grey 0xCECECE), layout params (spacing 3, columns 1), flags. Then sets own vtable, zeroes 7 members at offsets +0x36 through +0x3C including selection index to -1.
0x00A6F58094UIListViewToggleButton__ctorConstructor for UIListViewToggleButton. Calls UIButton__ctor as base class, sets custom vtable, zeroes one member at offset +0x3A (toggle state).
0x00A6F70071UIListViewItem__dtorDestructor for UIListViewItem. Sets vtable pointer, then calls UIControlBase__dtor to destroy the base class.
0x00A6F75071UIListViewWindow__dtorDestructor for UIListViewWindow. Sets vtable pointer, then calls CUIWindow__dtor_save_position to destroy the base window class and save window position.
0x00A6F7A071UIListViewToggleButton__dtorDestructor for UIListViewToggleButton. Sets vtable, then calls UIControlBase__dtor.
0x00A6F7F099UIListViewItem__scalar_deleting_dtorScalar deleting destructor for UIListViewItem. Sets vtable, calls UIControlBase__dtor, and conditionally frees the 0xF8-byte object if param_2 bit 0 is set.
0x00A6F86099UIListViewWindow__scalar_deleting_dtorScalar deleting destructor for UIListViewWindow. Sets vtable, calls CUIWindow__dtor_save_position, and conditionally frees the 0xF4-byte object if param_2 bit 0 is set.
0x00A6F8D099UIListViewToggleButton__scalar_deleting_dtorScalar deleting destructor for UIListViewToggleButton. Sets vtable, calls UIControlBase__dtor, and conditionally frees the 0xF0-byte object if param_2 bit 0 is set.
0x00A6F940274UIListView__add_shop_itemAdds a shop item to the UIListView's data linked list. Allocates 0x100-byte node, copies item data via CShopItem__copy_construct. Increments count at +0xD8. If param_3 is true, updates scrollbar max/range/position and marks for redraw. Returns the new item's index (count - 1).
0x00A6FA60344UIListView__add_string_itemAdds a string-based item to the UIListView's data linked list. Allocates 0x28-byte node, copies int fields and a std::string (move semantics - zeroes source). Increments count. If param_3 is true, updates scrollbar max/range/position and marks for redraw. Returns the new item's index.
0x00A6FBE0276UIListView__confirm_purchase_dialogShows a purchase confirmation dialog for the selected list item. Gets the selected item by index from the linked list at +0xDC->0xDC, reads item name string, formats it with FUN_00b00f00 (msg 0xF87), and shows a confirmation dialog (FUN_00a901e0). If user confirms (return 0xBB), sends a purchase request packet (type 0x145) with item data from +0xEC and +0xF0.
0x00A6FD00123UIListView__clear_shop_item_listClears the shop item list. Destroys all entries via CHashTable__destroy_all_entries, resets the sentinel node pointers, zeroes count and selection index (-1). Updates scrollbar to reflect empty list and marks for redraw.
0x00A6FD80123UIListView__clear_string_item_listClears the string item list. Destroys all nodes (including std::string dtors) via linked_list__clear_with_string_dtor, resets sentinel pointers, zeroes count and selection index (-1). Updates scrollbar and marks for redraw.
0x00A6FE201400UIListView__display_item_detailsDisplays detailed information for a shop item. Decrypts obfuscated format strings using xor_decrypt_buffer for different item states: both buy/sell prices exist (keys 0xb311fd95/0x31956551), only buy price (keys 0x61bdc391/0x393d9165), or only sell price (keys 0xc1b39315/0xed5143e7). Sets up the item name/price label, populates the item slot visual (CUIItemSlot__populate_from_item_data), and builds the tooltip from CItemDB.
0x00A703D0517ShopUI__init_dialogInitializes the shop dialog UI. Centers the window on screen, marks two sub-lists as needing redraw. Sets the title label from msg ID 0xD38 and the buy button label from msg ID 0xBE5.
0x00A705F01004ShopUI__populate_items_for_categoryPopulates shop items for a given category. Clears the existing string item list and shop item list. Stores category ID at +0xEC, looks up item info by parsing an atoi-converted string from FUN_00ddd5a0. Sets the item name label. Searches the item database singleton for matching items, copies each matching CShopItem into the list's data linked list. Updates scrollbar and shows the item detail panel.
0x00A709E0420ShopUI__populate_shop_item_listPopulates the shop UI's item list from a data source. Clears the existing shop item list, creates the item DB singleton if needed, looks up items via helper_0061ef60 using param_3's two fields. Iterates the result array, copying each 0xF8-byte CShopItem into the list's linked list at +0xE0. Updates scrollbar after populating.
0x00A70B9041UIListView__set_text_from_item_dataSets a text label from item data at param_2. Reads the string at offset +8 (with SSO check at offset +0x1C), and assigns it via UITextLabel__assign_text_and_recalc.
0x00A70BC034copy_range_to_buffer_00a70bc0Copies a range [param_1, param_2) to destination param_3 using memcpy. Returns end of written data. Duplicate of copy_range_to_buffer.
0x00A70BF034copy_range_to_buffer_00a70bf0Copies a range [param_1, param_2) to destination param_3 using memcpy. Returns end of written data. Duplicate of copy_range_to_buffer.
0x00A7146033delegate__destroy_if_not_localDestroys a polymorphic delegate stored at offset [9] of param_1. If the delegate pointer is non-null, calls its virtual destroy (vtable+0x10) with flag indicating whether it's stored remotely (ptr != this). Zeroes the slot after destroying.
0x00A714A092delegate__destroy_if_not_local_with_sehSame as delegate__destroy_if_not_local but with SEH frame setup/teardown. Destroys a polymorphic delegate at offset [9], calling virtual destroy and zeroing the slot.
0x00A76BF0341delegate__swap_polymorphic_shopSwaps two polymorphic delegate objects for the shop system. Same logic as delegate__swap_polymorphic: handles local/remote storage cases with virtual clone and destroy. Used in ShopListCtrl context.
0x00A76F7098aligned_heap_freeFrees an aligned heap allocation. For allocations >= 0x1000 bytes, retrieves the original allocation pointer from -4 offset and validates alignment before freeing. For smaller allocations, frees directly.
0x00A77160148UIListMenuButton__ctorConstructor for UIListMenuButton. Calls UIButton__ctor, sets vtable to UIListMenu__scalar_deleting_dtor, zeroes 6 members at offsets +0x3A through +0x3F.
0x00A77200332UIListMenuWindow__ctorConstructor for UIListMenuWindow. Calls UIWindowBase__ctor, sets CUIWindow vtable, initializes colors/layout params (white, grey, spacing 3, 1 column). Then sets own vtable, zeroes 14 members at +0x36 through +0x43, with +0x43 = 7999 (z-order?).
0x00A77350113UIListMenuToggle__ctorConstructor for UIListMenuToggle. Calls CEffect__ctor, sets UIBase then own vtable, zeroes one member at +0x20.
0x00A7766081destroy_internal_map_at_offset_4Destroys a std::map tree stored at offset +4 of the given object. Wrapper with SEH frame around std__map_int__destroy_tree.
0x00A776C095UIListMenu__dtorUIListMenu destructor. Sets vtable pointer, calls cleanup function FUN_00a77510, then calls UIControlBase dtor.
0x00A7772071UIListMenu__base_dtorUIListMenu base class destructor. Sets vtable to CUIWindow vtable, then calls CUIWindow__dtor_save_position.
0x00A7777084UIListMenu__base2_dtorUIListMenu base2 destructor. Resets vtable to UIBase, then calls FUN_00a79e90 cleanup.
0x00A777D0119UIListMenu__scalar_deleting_dtorUIListMenu scalar deleting destructor. Runs dtor logic then conditionally frees memory (size 0x100) if bit 0 of param is set.
0x00A7785099UIListMenu__scalar_deleting_dtor2UIListMenu scalar deleting destructor for CUIWindow base. Calls CUIWindow__dtor_save_position then conditionally frees (size 0x110).
0x00A778C0112UIListMenu__scalar_deleting_dtor3UIListMenu scalar deleting destructor for UIBase. Resets vtable then conditionally frees (size 0x84).
0x00A77930271UIListMenu__add_itemAdds an item to UIListMenu's linked list at offset 0xD4. Allocates 0x14-byte node, increments count (0xD8). If param_3 is true, updates scrollbar max/visible/value. Max list size is 0xCCCCCCC. Returns new item index.
0x00A77A4035UIListMenu__check_msg_id_099dChecks if message ID equals 0x99D (2461). If so, calls FUN_00b00f00 with 0x10EF. Returns 0 for other IDs.
0x00A77A80123UIListMenu__clear_all_itemsClears all items from UIListMenu. Destroys all nodes via FUN_00a77050, resets head pointers, zeroes count (0xD8), sets selected to -1 (0xDC). Updates scrollbar accordingly.
0x00A77B20448UIListMenu__update_item_displayUpdates UIListMenu item display. Converts item number to string, sets text label via UITextLabel__assign_text. Iterates through 4 map entries calling FUN_00a78a10 for each column value.
0x00A77CE0239UIListMenu__draw_header_rowDraws the header row of UIListMenu. Gets skin colors (indices 0 and 6), draws background fill and column separator lines at fixed x-positions (0x2C, 0x72, 0xB8, 0xFE).
0x00A77DD0301UIListMenu__draw_background_and_gridDraws UIListMenu background and grid lines. Calls CUIWindow draw, gets skin colors, draws header area, content area, and column separator lines using fill_rect and draw_rect helpers.
0x00A77F1086UIListMenu__load_skin_colorsLoads skin colors for UIListMenu from CSkinManager. Stores background color (index 0) at offset 0xF8 and border color (index 6) at offset 0xFC.
0x00A77F70514UIListMenu__init_column_headersInitializes UIListMenu column headers using message strings (IDs 0x109E-0x10A2, 0x10CF-0x10D1). Sets progress bar text and multiple text labels for column headers. Shows scrollbar if needed.
0x00A7819045UIListMenu__on_button_clickHandles button click for UIListMenu. If button ID is 0x3C (60), calls populate_from_skill_data with stored value at offset 0x10C (unless it's 7999). Otherwise delegates to UIWindow__handle_button_click.
0x00A781C02122UIListMenu__populate_from_skill_dataPopulates UIListMenu from skill data. Clears existing items, builds string "GetSkillDescript", calls Lua to get skill descriptions. Iterates through results adding list items with tree nodes. Sets scrollbar, updates text panel with description for msg ID 0x99D. Adjusts window height based on content.
0x00A78A10210UIListMenu__format_and_set_column_valueFormats a numeric value as a float divided by a global constant, formats to 3 decimal places, prepends a localized string (msg 0x710), and sets the result as a text label.
0x00A78AF01stub_nop_00a78af0Single-byte stub function (size=1)
0x00A78B0086UISkillInfoWindow__ctorUISkillInfoWindow constructor. Calls UIWindowBase__ctor, sets vtable to PTR_FUN_01156894.
0x00A78B6071UISkillInfoWindow__dtorUISkillInfoWindow destructor. Sets vtable pointer, then calls UIWindowBase__dtor.
0x00A78BB099UISkillInfoWindow__scalar_deleting_dtorUISkillInfoWindow scalar deleting destructor. Runs dtor then conditionally frees memory (size 0xB4).
0x00A78C40413UISkillInfoWindow__draw_camera_infoDraws camera debug info (range, rotation, latitude) on UISkillInfoWindow. Gets entity data, formats float values as strings, and draws them at positions (10,10), (10,25), (10,40).
0x00A7B2B0313string_reverse_multibyteReverses a multibyte string character-by-character. Uses CharPrevExA with the system codepage (DAT_016d3a78) to walk backwards through the source string, appending each character to the result. Handles multi-byte characters correctly. Buffer limited to 256 chars.
0x00A7CA20105find_color_code_in_stringScans string for color codes (^XXXXXX format). Walks forward using CharNextExA with codepage. A color code starts with '^' and has 6 hex digits (validated via DAT_01311f60 lookup table). Returns pointer to first non-color-code character, or null if input is null.
0x00A7CA9028parse_text_with_default_color_codesParses text with default color code markers. Wrapper that calls parse_text_with_color_codes using global color code start/end markers at DAT_01345918/DAT_01345930.
0x00A7CAB03034parse_text_with_color_codesParses text containing color codes into segments. Splits text at color code markers (param_2) and link markers (param_3). Each segment stored as a 0x3C-byte element with: display text, color code prefix, and link text. Results appended to vector at param_4. Uses FUN_00a7ef40 for color code processing.
0x00A7D69028parse_text_with_link_color_codesParses text with link-style color codes. Wrapper calling parse_text_with_color_codes with link markers at DAT_01345ae0/DAT_01345af8.
0x00A7D6B028parse_text_with_chat_color_codesParses text with chat color codes. Wrapper calling parse_text_with_color_codes with chat markers at DAT_013458e8/DAT_01345900.
0x00A7D8F0322get_number_display_colorsReturns foreground and shadow color pair based on number magnitude. Colors scale from yellow (<10) through purple, yellow, cyan, pink, green, red, blue, tan, to purple (>=1B). Output: param_1[0]=foreground, param_1[1]=shadow.
0x00A7DA401755text_layout_word_wrapWord-wraps text into lines. Walks string character by character using CharNextExA, measures each character's pixel width, and breaks into new lines when accumulated width exceeds the max. Handles newline chars and \\n escape sequences. Stores lines in a linked list, and per-line word offsets in a secondary list. Returns the lists via param_1.
0x00A7E1203107text_layout_word_wrap_with_colorWord-wraps text with color code support. Similar to text_layout_word_wrap but additionally handles ^XXXXXX color codes, ^b (bold), ^/b (end bold) tags. Preserves color state across line breaks by re-emitting color codes. If max width <=0, auto-measures from string. Uses linked lists for line storage.
0x00A7EDC0375strip_color_codes_from_stringStrips color codes (^XXXXXX) from a string. Iterates through string finding color codes via find_color_code_in_string, appends text between codes to result. Skips 7 chars for each color code found.
0x00A7EF401478extract_and_remove_color_code_prefixExtracts and removes color code prefix from a string. Finds start/end markers (DAT_01345948/DAT_01345960), splits text into prefix before markers and remainder after markers. Concatenates prefix + remainder into result. Used by parse_text_with_color_codes.
0x00A7F51097strip_item_link_markersStrips item link markers from string. Wrapper calling strip_markers_from_string with item link start/end markers at DAT_01345978/DAT_01345990.
0x00A7F58097strip_default_color_markersStrips default color markers from string. Wrapper calling strip_markers_from_string with default markers at DAT_01345918/DAT_01345930.
0x00A7F5F097strip_url_link_markersStrips URL link markers from string. Wrapper calling strip_markers_from_string with URL markers at DAT_01345b10/DAT_01345b28.
0x00A7F6602027strip_markers_from_stringGeneric marker stripping. Finds start marker (param_3) in string, extracts text before it, then finds end marker (param_4) after it, extracts text after end marker, concatenates prefix + suffix. Repeats until no more markers found. Used by all strip_*_markers functions.
0x00A7FE5097strip_link_markers_variantStrips link markers (variant). Wrapper calling strip_markers_from_string with link markers at DAT_01345ae0/DAT_01345af8.
0x00A7FEC097strip_chat_markersStrips chat markers from string. Wrapper calling strip_markers_from_string with chat markers at DAT_013458e8/DAT_01345900.
0x00A81A70145string_has_any_markup_markersChecks if a string contains any markup markers (chat, item link, link variant, default color, map link, or URL). Returns true if any marker is found.
0x00A81BA0134parse_color_code_to_rgbParses a ^RRGGBB color code string into a packed RGB integer. Uses hex digit lookup table at DAT_013457e8 to convert each pair. Returns pointer past the 7-char code, or original pointer if not a color code. Stores RGB in *param_2.
0x00A81D1041rect_contains_pointTests if a point (param_5, param_6) is strictly inside a rectangle defined by (param_1, param_2, param_3, param_4). Returns 1 if inside, 0 otherwise.
0x00A81D6016CGameMode__reset_stateWrapper that calls CGameMode__set_state(0) to reset the game mode state to zero.
0x00A81E10447truncate_string_to_pixel_widthTruncates a string to fit within a pixel width. Uses multi-byte character iteration to count characters. Allocates new buffer, copies truncated portion. Caches result in global string DAT_01457264 (with thread-safe initialization).
0x00A87E0056_Fnv1a_append_value<>STL FNV-1a hash append. XORs a value into the running hash and multiplies by the FNV prime.
0x00A87E4058fnv1a_hash_4bytes_00a87e40FNV-1a hash of 4 bytes. Seed=0x811c9dc5, prime=0x1000193. Used as hash function for unordered containers with 4-byte keys.
0x00A87E80250merge_sort_linked_list_by_field_4cMerge sort for doubly-linked list. Sorts by comparing int field at node+0x4C (offset into node's data). Recursive split-and-merge with linked list pointer manipulation.
0x00A8847031fill_range_with_valueFill range with value
0x00A884901833CGameObject__ctorCGameObject constructor. Initializes vtable (PTR_FUN_01156dc8), allocates numerous STL containers (trees, lists, maps) for game data. Sets default values for rendering params (opacity=0xAA, scale=1.0), state flags, and indices. Very large object (~0x4F320+ bytes).
0x00A899B0201unordered_map_clear_and_destroyDestroys an unordered_map/hash_map. Decrements size to 0, frees all bucket entries (0x10 byte nodes), deallocates bucket array (with aligned alloc support), then frees the 8-byte head node.
0x00A89E8065unordered_map_dtor_wrapperSEH wrapper around unordered_map_clear_and_destroy. Used as cleanup handler in exception frames.
0x00A8A0C071CGameObject__dtorCGameObject destructor. Sets vtable to PTR_FUN_01156dd0, then delegates to UIWindowBase__dtor.
0x00A8A11084CGameObjectWindow__dtorCGameObjectWindow destructor. Sets vtable chain (01156c18 then CUIPlainWindow vtable), delegates to UIWindowBase__dtor.
0x00A8A17071CGameObjectExtWindow__dtorCGameObjectExtWindow destructor. Sets vtable to CUIExtendedWindow, delegates to UIWindow__dtor_8cbbc0.
0x00A8A1C01139CGameObject__destroy_all_containersCGameObject destructor body. Destroys CUIElement singleton, calls CUIWindowMgr__destroy_all_windows, frees tree node data at offset 0x13c64, then destroys all member containers in reverse order: lists, trees, vectors, unordered_maps, strings. Matches ctor at 00a88490.
0x00A8A64086CGameObject__rehash_or_clear_bucketsRehashes or clears hash table buckets. If bucket count < capacity/8, calls FUN_00ab0aa0 to rehash. Otherwise calls FUN_00a871b0 and fills bucket pointers.
0x00A8AB8093CGameObjectSmall__scalar_deleting_dtorScalar deleting destructor for small game object (0xE0 bytes). Calls UIWindow__dtor_8ca740, optionally frees this.
0x00A8ABE099CGameObject__scalar_deleting_dtorCGameObject scalar deleting destructor (0x10C bytes). Sets vtable to PTR_FUN_01156dd0, calls UIWindowBase__dtor, optionally frees this.
0x00A8AC50112CGameObjectWindow__scalar_deleting_dtorCGameObjectWindow scalar deleting destructor (0xB4 bytes). Sets vtable to CUIPlainWindow, calls UIWindowBase__dtor, optionally frees this.
0x00A8ACC0112CGameObjectExtWindow__scalar_deleting_dtorCGameObjectExtWindow scalar deleting destructor (0x168 bytes). Sets vtable to CUIExtendedWindow, calls UIWindow__dtor_8cbbc0, optionally frees this.
0x00A8AD3038CGameObject__full_scalar_deleting_dtorCGameObject full scalar deleting destructor (0x4F2B0 bytes). Calls CGameObject__destroy_all_containers, optionally frees this.
0x00A8AD6080CGameObject__register_window_with_timerRegisters a window at this+0x4F250. Unregisters previous window if set, sets new window with flag=0x80 and timestamp from timeGetTime(), inserts into list at this+0x17C.
0x00A8ADB099CGameObject__send_packet_0x202Builds and sends packet 0x0202. Copies 6 dwords from param into packet body, calls network send functions.
0x00A8AE20252CGameObject__tree_insert_int_pairInserts an int key-value pair into the std::_Tree at this+0x4F198. Traverses tree to find insertion point, allocates 0x18 node, stores key at node+0x10 and value at node+0x14.
0x00A8AF20306CGameObject__add_window_to_list_and_positionAdds a window to list at this+0x17C and another list at this+0x4F240. Creates CUIElement singleton if needed. For each list entry, calls CUIGrid__GetCellPosition and a virtual method (vtable+0x10) to set position.
0x00A8B06058CGameObject__add_unique_to_list_18cAdds a value to the list at this+0x18C if not already present. Walks the list checking for duplicates before inserting.
0x00A8B0A0407CGameObject__select_server_by_nameSelects a server by name string. Searches server list at (this+0x1C8)->0xC0->0x11C for matching server name using std::_Traits_equal. If not found, appends name. Sets server index at +0x128 and calls virtual method +0x94 with command 0x27.
0x00A8B240395CGameObject__ensure_server_name_in_listEnsures a server name exists in the server list at (this+0x1C8)->0xC0->0x11C. Searches for matching name; if already present, returns immediately. If not found, appends name to the list and clamps the current server index (at +0x128) to valid range.
0x00A8B3D01124CGameObject__handle_whisper_messageHandles incoming whisper/PM messages. Checks guild/friend status via FUN_00dfa030/FUN_00df9690/FUN_00df9560. Dispatches chat message (type 0xE). Plays new message sound. Manages whisper window focus and server list. Returns 1 if message was processed.
0x00A8B840390CGameObject__tree_insert_string_with_valueInserts a string key with an int value into std::_Tree at this+0x500. Allocates 0x2C node with copy-constructed string key. If key already exists, updates the value at node+0x28.
0x00A8B9D024CGameObject__insert_to_window_listInserts a window pointer to the back of the window list at this+0x17C.
0x00A8B9F026CGameObject__insert_to_window_list_frontInserts a window pointer to the front of the window list at this+0x17C.
0x00A8BA1058CGameObject__process_all_windows_recursiveIterates all windows in list at this+0x17C and calls CEffect__process_recursive on each with the given parameters.
0x00A8BA50200CGameObject__dispatch_command_to_active_windowDispatches command (vtable+0x94 with params 0,1,0,0,0,0) to the active window. Checks this+0x1A0 first, then deque at this+0x1A8, then walks window list at this+0x17C checking IsVisible (vtable+8).
0x00A8BB20222CGameObject__apply_window_positionsApplies saved window positions from CUIWindowPositionMgr singleton (DAT_01457098). For each window in list at this+0x17C, looks up position by window type ID (offset +0x2C) in the position map.
0x00A8BC001008CGameObject__process_key_inputProcesses keyboard input. Maps scancode+flag combos (0xXX0001) to virtual key codes for message 0xE5 (IME). Detects modifier keys (Alt=0x12, Shift=0x10, Ctrl=0x11, Tab=9) via GetAsyncKeyState. Returns key combo type: 0=escape, 1=blocked, 2=modifier only, 3=Tab combo, 4=regular key.
0x00A8BFF0117CGameObject__close_window_by_typeCloses/toggles a window by type ID. Finds window via CUIWindowMgr__find_window_by_type. For certain types (0x16-0x19, 0x29, 0x2c, 0xa1, 0xae, 0xb2) sends command 0xB9; for others (0x84, 0xb5, 0xb8, 0xcb, 0x119, 0x146, 0x2728) sends 0xC9.
0x00A8C150109CGameObject__toggle_navigation_windowsToggles navigation/minimap windows (type 0xBD). If param is 1, checks game option 0xFA state to show/hide. Otherwise hides. Calls virtual method at vtable+0x38 with show/hide flag.
0x00A8C1C062CGameObject__find_active_chat_roomSearches the chat room tree at this+0x9C4 for a room with a non-zero value at node+0x14. Returns 1 (with the value in the upper bytes) if an active room is found, 0 otherwise.
0x00A8C200176CGameObject__clear_window_referencesClears multiple window pointer fields (0x19C, 0x1A0, 0x1B8, 0xA30, 0x4F1D4) if they match param_2 or if FUN_00a81c90 returns true (parent window check).
0x00A8C2B037CGameObject__reset_all_window_alphaIterates all windows in list at this+0x17C and calls CEffect__reset_alpha_recursive on each to reset transparency.
0x00A8C2E033CGameObject__destroy_object_at_478Destroys the object at this+0x478 by calling its scalar deleting destructor (vtable[0] with flag 1), then nulls the pointer.
0x00A8C310404CGameObject__flush_deque_and_treeFlushes deque at this+0x1A8 and associated tree at this+0x170. For each deque entry, finds matching tree range, removes tree nodes, and destroys deque entries. Then destroys remaining tree entries. Complex cleanup routine.
0x00A8C4B0194CGameObject__add_to_deferred_listAdds param_2 to deferred list at this+0x4F248. Calls FUN_00dff1a0 before and FUN_00dff150 after insertion. Throws if list is at max size 0x15555555.
0x00A8C580261CGameObject__move_windows_to_destroy_listMoves all windows from list at this+0x4F240 to destroy list at this+0x184. Clears cached pointers (0x3D4, 0x3D8, 0x3DC, 0x1B8, 0x4F2AC) if they match moved windows. Frees and resets the source list.
0x00A8C690185CGameObject__clear_tree_at_4f190Clears tree at this+0x4F190. Frees 0x10-byte data at each node+0x14, then destroys tree nodes with cleanup callbacks. Resets tree state to empty.
0x00A8C75045CGameObject__hide_modal_windowHides the modal window at this+0xA30 if it exists and has flag at +0x28 set. Calls UICheckbox__unregister_and_refresh and hides via vtable+0x38. Returns 1 if hidden.
0x00A8C78011CGameObject__open_window_0x2728Opens window type 0x2728 by calling FUN_00a8cf20 (the large window creation dispatcher).
0x00A8C790167CGameObject__screen_to_tile_coordsConverts screen coordinates (float) to tile coordinates (int). Uses tile size at this+0x118 and map dimensions at this+0x110, this+0x114.
0x00A8C840264CGameObject__create_chat_roomCreates a new chat room object (0x40 bytes). Limits to 5 rooms (this+0x9C8). Calls FUN_00ab22b0 to initialize at position. On failure shows error message 0x62A. Returns room pointer or 0.
0x00A8C960188CGameObject__get_or_create_single_chat_roomGets or creates a singleton chat room at this+0x9D0. Only creates if null. Allocates 0x40 bytes, calls FUN_00ab1de0 constructor, FUN_00ab22b0 to init position. Returns room pointer.
0x00A8CA20753CGameObject__dispatch_escape_keyHandles ESC key press. Checks window priority chain: deque top -> ptr at 0x234 -> 0x314/0x318 (with map mode check) -> 0x1F8/0x1F0/0x1F4/0x214 -> 0x21C (sends 0x13) -> 0x20C/0x374/0x378/0x30C -> active window (0x1A0) -> focused (0x3D4) -> visible windows. Returns whether ESC was consumed.
0x00A8CD2066CGameObject__send_resize_to_visible_windowsSends resize command (0x21) to all visible windows in list at this+0x17C. Checks IsVisible via vtable+8 before sending.
0x00A8CD70112CGameObject__remove_effect_from_treeRemoves an effect entry from the tree at this+0x194 by key. Only acts if game option 0x8D is enabled. Finds node via _Find_lower_bound, extracts and frees the 0x44-byte node.
0x00A8CDE097CGameObject__unregister_window_by_idUnregisters a window by ID from tree at this+0x28. Finds node via FUN_00a87b90, calls CUIWindowMgr__unregister_window with the stored value, extracts and frees 0x18-byte node.
0x00A8CE50195CGameObject__remove_tree_entry_by_stringRemoves an entry from string-keyed tree at this+0x500 by string key. Finds node via FUN_00a87cd0 with string comparison, destroys embedded string, frees 0x2C-byte node.
0x00A8CF208943CGameObject__open_or_toggle_window_by_typeLarge window creation/toggle dispatcher. Takes a window type ID and opens, creates, or toggles the corresponding window. Called by CGameObject__open_window_0x2728 and likely many other entry points. (8943 bytes - too large to fully decompile in audit context.)
0x00A8F67051CGameObject__close_special_window_by_typeCloses special windows by type. For type 0x9C, unregisters this+0x404. For types 0x9D-0xBF, unregisters found window. For 0xB5, additionally calls FUN_00df3160.
0x00A8F72084CGameObject__remove_transient_window_from_listRemoves a window from the list at this+0x18, but only if it is not a persistent window type (checked via is_persistent_window_type). Persistent windows (certain UI types) are kept in the list. Unlinks and frees the 0xC-byte list node.
0x00A8F780191CGameObject__destroy_all_chat_roomsDestroys all chat rooms. Iterates tree at this+0x9C4, destroys each room's 0x40-byte data via FUN_00ab1f20, clears tree. Also destroys singleton room at this+0x9D0. Resets count at this+0x9C8.
0x00A8F84031CGameObject__destroy_object_at_478_00a8f840Destroys object at this+0x478 via scalar deleting destructor (vtable[0] with flag 1), nulls pointer. Duplicate of 00a8c2e0.
0x00A8F860194CGameObject__remove_chat_room_by_idRemoves a chat room by ID. Searches tree at this+0x9C4, if found destroys 0x40-byte room data (handles singleton at 0x9D0), extracts and frees 0x18-byte tree node. If not in tree, checks singleton by ID match.
0x00A8F930585CGameObject__push_modal_windowPushes a modal window onto the deque at this+0x1A8. If param is 0, returns 0xB9. Grows deque if needed. Waits in a loop checking for completion via this+4 and this+0x474 fields, or timer event 0x14. Unregisters windows on timeout.
0x00A8FB80168CGameObject__send_close_to_priority_windowSends close command (0x13) to the highest-priority visible window. Checks priority pointers: 0x1F8, 0x1F0, 0x1F4, 0x214, 0x21C, 0x20C, 0x374, 0x1A0. Falls back to walking window list sending 0x13 to visible ones.
0x00A8FC30108create_tooltip_window_at_positionCreates a temporary tooltip window at position. Allocates via stub_00569e90, calls vtable+0x10 to init, vtable+0x30 to position, then destroys with vtable[0].
0x00A8FCA0130CGameObject__attach_window_to_chainAttaches a window (param_4) to a chain found via FUN_00a91c70 at (param_2, param_3). Accumulates parent offsets, calls FUN_00a82f80 to set position. If not root parent, calls vtable+0x28.
0x00A8FD30128CGameObject__update_active_window_focusUpdates active window focus. Gets cursor target from (this+0x1C8)->0xBC. Calls vtable+0x60 (OnFocusChange) on current active window at 0x1A0. Updates 0x1A0 to new target via vtable+0x18, calls vtable+0x5C (OnFocusGained).
0x00A8FDB0872CGameObject__show_progress_dialogShows a progress/loading dialog. Creates CUIMinimalWindow (0xB8 bytes), sizes to 0x118x0x30, centers on screen. Pushes onto deque at this+0x1A8 and runs modal loop checking for completion/timeout. Calls FUN_00a91120 on exit.
0x00A90130172CGameObject__destroy_and_clear_hash_mapDestroys all entries in hash map at this+0x4F290. For each entry with non-null data, calls scalar deleting destructor. Then either uses erase_range or manual cleanup depending on load factor.
0x00A901E0998CGameObject__show_dialog_box_extendedShows an extended dialog box (UIWindowE, 0x120 bytes). Creates modal dialog with multiple params, pushes onto deque, runs modal loop. Returns 0xB9 on failure/block, 0xB8 on timeout, or result code on completion.
0x00A905D0888CGameObject__show_dialog_box_simpleShows a simple dialog box (0x100 bytes). Creates modal dialog, pushes onto deque, runs modal loop. Similar to extended version but with fewer layout params.
0x00A909501019CGameObject__dispatch_scancode_to_shortcutDispatches scancode+flag to shortcut window at this+0x1E8. Maps scancodes (0x10xxxx-0x34xxxx) to grid positions (col,row) and sends command 0x29. Only active when DAT_01737ab8 is set and DAT_01737ac0 is clear.
0x00A90D5078CGameObject__dispatch_vkey_to_shortcutDispatches virtual key code to shortcut window at this+0x1E8. Maps ASCII characters A-Z and punctuation to grid positions and sends command 0x29. Case-insensitive.
0x00A91120188CGameObject__find_and_focus_clickable_childSearches window list at this+0x17C for a clickable child element. For each window with flag at +0x28, iterates child list at +0x50 checking vtable+0x14 (IsClickable). On found: calls vtable+0x18 (GetOwner), updates focus at this+0x1A0.
0x00A911E018CGameObject__defocus_active_windowDefocuses the active window at this+0x1A0 by calling vtable+0x60 (OnFocusLost) with 0.
0x00A91200483CGameObject__get_hotkey_behaviorGets hotkey behavior by calling Lua function 'GetBehaviorOfHotKey2' via FUN_00afc9a0 with key+modifier info. If Lua returns -1 and Shift is held, scans macro slots (DAT_01732ae8) for matching key binding. Returns behavior ID or -1.
0x00A9140067CGameObject__get_first_nonempty_window_slotReturns the first non-null window pointer from slots at this+0x320 through this+0x338. Checks 7 consecutive pointers.
0x00A9145074CGameObject__peek_deque_topPeeks at the top element of the deque at this+0x1A8 without removing it. Returns 0 if deque is empty. Uses circular buffer indexing with front offset and mask.
0x00A914A0462CGameObject__compute_window_snap_offsetsComputes snap offsets for window positioning. Uses CCollisionRect to detect overlaps between the window bounds and screen bounds, then checks against other windows in the tree at this+0x194 to find snap positions. Handles dependency chains.
0x00A91670118CGameObject__ensure_ui_element_and_add_childCreates CUIElement singleton (DAT_0138d42c) if needed (0x34 bytes), then calls CUIElement__AddChild to add a child widget.
0x00A91730310CGameObject__find_window_by_session_idSearches window list at this+0x4F240 for a window matching param_2 by session ID (at window+0xB8). Copies string fields during search. Returns window pointer or 0.
0x00A9187050CGameObject__find_window_by_field_104Searches window list at this+0x4F240 for a window where field at offset +0x104 equals param_2. Returns window pointer or 0.
0x00A918B097CGameObject__get_visible_area_rectGets the visible area rectangle. param_2 gets {0, top, width, height-bottom_margin}. top comes from window type 0x133 if it exists, otherwise calculated from this+0x480. Uses DAT_0132913c for bottom margin.
0x00A9192075CGameObject__lookup_tree_4f190_by_keyLooks up a value in the tree at this+0x4F190 by integer key. Returns value at node+0x14 or 0 if not found.
0x00A9199075CGameObject__lookup_chat_room_by_idLooks up a chat room by ID in tree at this+0x9C4. Returns value at node+0x14 or 0 if not found.
0x00A919E0322CGameObject__lookup_tree_500_by_stringLooks up a value in the string-keyed tree at this+0x500. Creates temp string from param, searches tree via FUN_00a87cd0 with string comparison. Returns value at node+0x28 or 0.
0x00A91B3056CGameObject__find_window_by_uidFinds a window by unique ID (offset +0x74). Walks list at this+0x17C checking each window, also checks children via CEffect__find_child_by_id_recursive. Returns window pointer or 0.
0x00A91B7043accumulate_parent_offsetsAccumulates X and Y offsets from a chain of parent windows. Follows parent pointer at offset +0x10. Returns total offsets in param_2 (X) and param_3 (Y).
0x00A91BA0110compute_window_absolute_boundsComputes absolute screen bounds for a window. Accumulates parent offsets (+0x1C, +0x20) for top-left, adds window size (+0x14, +0x18) for bottom-right. Returns (left, top, right, bottom).
0x00A91C1064CGameObject__get_all_window_type_idsFills array with window type IDs (field +0x2C) from all windows in list at this+0x17C. Returns total window count.
0x00A91C5018CGameObject__hide_main_windowHides the main window at this+0x1C8 by calling vtable+0x38 with 0 (hide).
0x00A91C70277CGameObject__hit_test_windowsHit-tests screen coordinates against windows. First checks window list (this+0x17C backwards) calling vtable+0xC8 (HitTest). Then checks tree at this+0x4F198. Tracks hover state at this+0x4F1A0/A4 and calls vtable+0xBC/0xC0 for mouse enter/leave.
0x00A91D9022CGameObject__is_guild_window_activeChecks if the guild window at this+0x30C is active (non-null with field +4 set). Returns 1 if active.
0x00A91DB0201CGameObject__restore_saved_windowsRestores previously saved windows on login. Matches windows in list 0x17C against saved list at this+0x50C, shows matching ones. If player state is map mode (0x254==1), triggers equip window. Opens windows from tree at this+0x4F198 via FUN_00a8cf20.
0x00A91E8021CGameObject__refresh_window_visibility_twiceCalls CUIWindowMgr__manage_window_visibility_state(4) twice to refresh window visibility.
0x00A91EA0182CGameObject__check_is_behavior_of_windowChecks if current hotkey triggers a window behavior by calling Lua function 'IsBeHaviorOfWindow' after getting hotkey behavior.
0x00A91F60303CGameObject__create_equip_windows_from_dataCreates equipment display windows from data. Iterates DAT_01732d70 entries, creates UIEquipWnd (0x138 bytes) for each valid entry, sizes to 0xAEx0x34, positions via grid, sends command 0x17 with data.
0x00A92090736load_shortcut_items_from_registryLoads shortcut items from Windows registry. Reads 36 entries (SITEM_d_d_d and S_SKILL_USE_LEVEL_d_d_d) from HKLM under ShortcutItem path. Handles special '#' prefix for skill shortcuts.
0x00A92370696load_skill_use_levels_from_registryLoads skill use levels from Windows registry (SkillUseLevelInfo). Reads levels for skill IDs 1-7998, 8000-8060, and 8200-8457 from HKLM. Validates with CSkillManager__IsLevelUseSkill before setting level.
0x00A9263010650CGameObject__init_window_positions_from_registryInitializes default window positions from Windows registry. 10K bytes. Called by WinMain_game_entry. Reads saved window positions via RegQueryValueExA and registers window validators.
0x00A94FD01259CGameObject__init_window_type_tableInitializes the window type table. Clears 0x2739 entries of 32 bytes each starting at this+0xA34, setting default state (show_flag=1). Then sets specific default flags for ~100+ known window types at specific offsets.
0x00A954C0115CGameObject__register_chat_room_in_treeRegisters a chat room in tree at this+0x9C4. Looks up by ID, only inserts if not found or node value is 0, and param_3 is non-null. Returns 1 if inserted.
0x00A9554071CGameObject__reorder_window_in_list_18Reorders a window type in list at this+0x18. Removes it first, then inserts at back for type 0xCB or at front for others. Uses FUN_00a96a60 to check if window type should be skipped.
0x00A95590511format_int_to_stringFormats an integer to a std::string. If param_3==0, uses _itoa. Otherwise uses sprintf with '% 10d' format and trims to param_3 characters from the right.
0x00A957901070format_int_with_commasFormats a 32-bit integer as a string with comma separators every 3 digits. param_3=1 enables comma formatting, param_4=1 adds '+' prefix for positive values. Handles negative numbers by taking absolute value, inserting commas, then prepending '-'. Removes leading comma if present.
0x00A95BC01220format_int64_with_commasFormats a 64-bit integer (param_2:param_3) as a string with comma separators. Uses %I64d sprintf format. Same comma insertion logic as format_int_with_commas. Handles negative values and optional '+' prefix for positives.
0x00A960901606CGameObject__rebuild_window_listRebuilds the game window list from scratch. Clears the window list at 0x4f240, nulling tracked window pointers (0x3d4/3d8/3dc/1b8/4f2ac). Iterates equipment data to build a new list, creates UIEquipWnd instances for valid entries, and manages window z-ordering/focus state based on window type IDs (0xc=0xea, 0x52=0xfa).
0x00A966E037CGameObject__invalidate_all_windowsInvalidates all windows in list at this+0x17C by calling CEffect__invalidate_recursive on each.
0x00A9671031CGameObject__send_refresh_to_window_444Sends refresh command (0x3C) to the window at this+0x444 if non-null.
0x00A96730215CGameObject__send_refresh_to_all_status_windowsSends refresh command (0x3C) to all 7 status windows at this+0x320 through this+0x338 if non-null.
0x00A9681031CGameObject__send_refresh_to_window_464Sends refresh command (0x3C) to the window at this+0x464 if non-null.
0x00A9683018CGameObject__set_window_464_dirty_flagSets dirty flag (byte at +0xC8) to 1 on the window at this+0x464 if non-null.
0x00A96850381CGameObject__rebuild_effect_collision_treeRebuilds the effect/window collision tree at this+0x194. Clears existing 0x44-byte nodes, then for each visible window not in the destroy list (0x4F240), inserts into tree with collision rect bounds for snap/overlap detection.
0x00A969D070CGameObject__invalidate_visible_windows_onceInvalidates visible windows once. Sets flag at this+0x4FC to prevent re-entry, then walks window list calling vtable+0xC (IsActive?) and CEffect__invalidate_recursive on active ones.
0x00A96A4031CGameObject__check_modal_has_childChecks if the modal window at this+0xA30 has a visible child element. Returns result of UIControl__find_child_by_id if window exists and flag +0x28 is set.
0x00A96A60124is_persistent_window_typeReturns 1 if the window type ID is in the persistent/always-loaded set. Large switch covering ~130+ type IDs (0-0xFD, 0x102-0x258, 0x271B, 0x2730). These are windows that should not be dynamically destroyed.
0x00A96C60328CGameObject__find_window_by_map_idSearches the window list at 0x4f240 for a window matching the given map ID (param_2). Copies window strings at offsets 0xc0 and 0xd8 while iterating. Returns 1 if found, 0 otherwise.
0x00A96DB035is_first_visible_siblingReturns 1 if param_1 is the first visible sibling (no previous visible sibling found by CEffect__find_prev_visible_sibling).
0x00A96DE0123CGameObject__dispatch_drag_to_target_windowDispatches a drag item to the target window. Checks if drag source (this+0x72) and target (this+0x68) are valid, finds target in window list or tree at this+10, then calls vtable+0x94 with (iVar1, 0, 1, 0, 0, 0).
0x00A96E6037CGameObject__is_active_window_visible_popupReturns 1 if the active window (this+0x1A0) is a visible popup (has parent != main window at 0x1C8 and has flag +0x28 set).
0x00A96E9026is_player_name_validChecks if a player name is valid by calling FUN_00df9d30. Returns true if result is non-zero.
0x00A96EB040is_special_keyReturns 1 for special/modifier keys: Tab(9), Enter(0xD), Shift(0x10), Ctrl(0x11), Alt(0x12), CapsLock(0x14), Insert(0x2D), F1-F12(0x70-0x7B).
0x00A96F6035is_last_visible_siblingReturns 1 if param_1 is the last visible sibling (no next visible sibling found by CEffect__find_next_visible_sibling).
0x00A96F9084CGameObject__check_if_restricted_window_typeChecks if a window type is restricted when this+0x4F288 is set. Returns 1 for types: 8, 10, 0x12, 0x28, 0x9B, 0xCB, 0xFB, 0x107, 0x113.
0x00A9707042CGameObject__has_any_drag_activeReturns 1 if any of the 4 drag state slots at this+0x4F260-0x4F26C are non-zero.
0x00A970A057CGameObject__is_window_position_savedChecks if a window position is saved in the position manager. Looks up param_2 in the map at (this+4) via std__map_int__lower_bound. Returns true if found.
0x00A970E069CGameObject__get_window_type_flagGets a flag from the window type table. Index calculated as (param_2 + window_type * 8). param_2 range 0-7, window_type max 0x2738. Special case: type 3 returns 1 only when DAT_016f7144==0.
0x00A97130200is_window_type_enabledChecks if a given window type ID is enabled based on configuration flags. Types 0x8b-0x8d are always enabled. Types 0x71/0x6c/0x78/0x67/0x73 are always enabled. Other types check boolean flags at various offsets (0xb0-0xb8) of the config structure.
0x00A97200373CGameObject__check_window_overlap_at_map_posChecks if any window in the window list overlaps with a map position. Converts the target map position to tile coordinates, then iterates windows checking their positions. Uses RTTI to handle two different window types differently. Returns 1 if overlap found, 0 otherwise.
0x00A9738034CGameObject__is_registered_window_loadingReturns 1 if the registered window at this+0x4F250 exists, has flag +0xB4 set, and field +0x30 is 0 (loading state).
0x00A973E044should_filter_whisper_messageReturns 1 if whisper messages should be filtered. True when: DAT_01733590 is set and param is 0 (block incoming), or DAT_01733598 is set and param is non-zero (block outgoing).
0x00A97410123CGameObject__has_any_modal_windowReturns 1 if any modal/blocking window is active. Checks 14 different window pointer fields (0x284, 0x2cc-0x2ec, 0x3b4, 0x1f0, 0x1f4) for non-null values.
0x00A97490114CGameObject__send_close_to_focused_windowSends close message (msg 0x14) to the currently focused window. Checks 0x3dc and 0x3b0 first for specific focused windows, then falls back to iterating the window list at 0x17c and sending close to any window that passes the check at vtable+8.
0x00A97510112CGameObject__bring_window_to_frontMoves a window to the front of the z-order. Finds the window in the list at 0x17c by matching param_2, removes it from its current position, and re-inserts it at the front.
0x00A97580311CGameObject__get_or_create_windowGets or creates a window by type ID. Looks up in the map at offset 0x28. If not found, allocates and constructs a new UIWindow_915e00, sets its type ID to field 0x3d, sizes and positions it, inserts into the window list, and stores in the map. If size params are -1/-1, calculates default size from param_2. Shows the window via vtable+0x38.
0x00A976C0307CGameObject__focus_window_with_priorityFocuses a window with priority ordering. Checks that no blocking windows (types 0x116, 4, 199, 200) are active. Handles priority by window type (0xc->0xea, 0x52->0xfa) - finds and moves the priority-equivalent window before inserting the target window at the front of the list.
0x00A97800203CGameObject__bring_special_windows_to_frontBrings special windows to the front of the z-order. First moves the window at 0x4f258 to front, then finds any window with type ID 0x16b and moves it to the very front. Returns 1 if any window was moved.
0x00A978D038004CGameObject__create_window_by_typeCGameObject: create window by type
0x00AA20D022CGameObject__is_party_window_activeChecks if the party window at this+0x310 is active (non-null with field +4 set). Returns 1 if active.
0x00AA24D056CGameObject__update_registered_window_positionUpdates registered window position. Calls vtable+0x10 on the window at this+0x4F250 if it exists and has field +0xB4 set.
0x00AA25C036dispatch_shortcut_key_to_uiMaps keyboard shortcut keys (0x20=space, 0x23=#, 0x46=F, 0x48=H, 0x6d=m) to UI window type IDs (0xFDA-0xFDE), creates a window descriptor with yellow color (0xFFFF00) and dispatches via FUN_00aa9100.
0x00AA276075handle_open_navigation_windowHandles opening the navigation/warp window (type 0x271E). If not found, creates it via FUN_00a978d0. Checks a condition (FUN_00a40240) and either opens via FUN_00a8cf20 or calls FUN_00a41e10.
0x00AA55A022send_chat_message_if_connectedSends a chat message if the session pointer DAT_013495bc is non-null, delegating to FUN_00aa57e0 (chat message send handler).
0x00AA811026close_window_unless_type_fbCloses a window by type ID unless it is type 0xFB (251). For all other types, calls FUN_00a8cf20 to close.
0x00AA8440544build_window_state_save_packetBuilds a window state save packet. Constructs a byte vector with two TLV entries: header (type 26000/0x6590 with no payload) and terminator (type 0x6591 with no payload). Used for saving UI window positions/state to server.
0x00AA89F0149send_battleground_queue_packetSends a battleground queue network packet. Checks multiple conditions via FUN_00b875e0: field+0xc must be 2, and flags at +0xb2, +0xb0, +0xb8 must be set. Only sends for specific param values (0x13b, 0x141, 0x142). Constructs a 10-byte packet (header 0x039208AE) and sends via FUN_00b86880 with size 0x2a.
0x00AA8A90130send_battleground_action_packetSends a battleground action network packet. Same conditions as send_battleground_queue_packet but without the param value filter, and uses a different packet header (0x038D08AE). Sends via FUN_00b86880 with size 0x2a.
0x00AA8C30219parse_window_state_save_packetParses a window state save packet from a byte vector. Expects header type 26000 (0x6590). Iterates TLV entries until terminator type 0x6591 is found. Returns 0xFFFFFFFF on empty/invalid packets, otherwise returns byte offset consumed.
0x00AA9B0035send_close_dialog_to_sessionSends a close dialog command (0x124) to the game session object obtained via FUN_00ad6450.
0x00AAA05045dispatch_emote_flag_commandDispatches emote/country flag commands (0xD2-0xDA) to the server. Maps command IDs to flag name strings (ET_FLAG, ET_INDONESIA_FLAG, ET_PH_FLAG, ET_MY_FLAG, ET_SI_FLAG, ET_BR_FLAG, ET_INDIA_FLAG, etc.) based on current region setting DAT_016d3b10. Sends via session command 0x149.
0x00AAADF034scale_x_to_screen_widthScales an X coordinate from 640-pixel reference resolution to the current screen width. Returns (screen_width * param_1) / 640.
0x00AAAE2026center_x_offset_from_640Returns param_1 plus the horizontal centering offset for a 640-wide UI on the current screen. Calculates (screen_width - 640) / 2 + param_1.
0x00AAAE4026center_y_offset_from_480Returns param_1 plus the vertical centering offset for a 480-tall UI on the current screen. Calculates (screen_height - 480) / 2 + param_1.
0x00AAB07029sync_navigation_window_checkboxSyncs the navigation window (type 0x271E) checkbox state if the window exists. Calls SettingsUI__sync_checkbox_from_option on the found window.
0x00AAB09022refresh_navigation_window_optionsRefreshes all option states in the navigation window (type 0x271E) if it exists.
0x00AAB0B022update_navigation_window_labelsUpdates all tab option labels in the navigation window (type 0x271E) if it exists.
0x00AAB920543save_shortcut_items_to_registrySaves all 36 shortcut bar items to the Windows registry. Creates a registry key under HKLM with path built from the service name + ShortcutItem. For each slot (0-35), writes the item name (SITEM_%d_%d_%d) and skill use level (S_SKILL_USE_LEVEL_%d_%d_%d) keyed by slot index, region (DAT_016d3b10), and server (DAT_01733588).
0x00AABB407583save_window_positions_to_registrySaves all window positions to Windows registry. 7.5K bytes. Called by WinMain_game_entry during shutdown. Writes positions via RegCreateKeyExA/RegSetValueExA for each window type.
0x00AAF480418circular_buffer_growGrows a circular buffer to accommodate param_2 more elements. Doubles capacity repeatedly until sufficient. Allocates new buffer, copies data preserving circular order (wrapping at the read pointer), zeros new space, frees old buffer. Buffer fields: +4=data, +8=capacity, +0xc=read_pos.
0x00AB1040111ensure_game_settings_singletonCreates the GameSettings singleton (DAT_0145700c) if not yet initialized. Allocates 0x58 bytes and calls GameSettings__constructor.
0x00AB10B0111ensure_window_position_mgr_singletonCreates the CUIWindowPositionMgr singleton (DAT_01457098) if not yet initialized. Allocates 0x34 bytes and calls CUIWindowPositionMgr__ctor.
0x00AB16F021COM_stub_get_ids_of_namesIDispatch::GetIDsOfNames stub. Sets output to 0 and returns S_FALSE (1).
0x00AB172021COM_stub_get_type_infoIDispatch::GetTypeInfo stub. Sets output to null and returns E_NOINTERFACE (0x80004002).
0x00AB175021COM_stub_get_type_info_countIDispatch::GetTypeInfoCount stub. Sets count to 0 and returns S_FALSE (1).
0x00AB177032COM_connection_point_get_infoReturns connection point info: sets first DWORD to 0x14, second to 4, third to 0. Returns S_OK (0).
0x00AB17E023COM_sink_get_inner_targetReturns the target object from the inner sink. Gets *(this+8)->8 and stores in param_2. Returns S_OK.
0x00AB180023COM_sink_get_outer_targetReturns the target object from the outer sink wrapper. Gets *(this+0xc)->8 and stores in param_2. Returns S_OK.
0x00AB182062COM_sink_get_connection_infoFills connection info structure. Sets param_2 to this+8, param_3 to 0, and populates param_6 structure with outer target at +8, zeros at +4, +0xc, +0x10. Returns S_OK.
0x00AB1A8017COM_invoke_inner_vtable_0Invokes the first virtual method of the inner object at this+8. Indirect jump through the inner object's vtable[0].
0x00AB1AA017COM_invoke_inner_vtable_0_00ab1aa0COM thunk: invokes vtable[0] of inner object. Template variant.
0x00AB1AC017COM_invoke_inner_vtable_0_00ab1ac0COM thunk: invokes vtable[0] of inner object. Template variant.
0x00AB1AE017COM_invoke_inner_vtable_0_00ab1ae0COM thunk: invokes vtable[0] of inner object. Template variant.
0x00AB1B0017COM_invoke_inner_vtable_0_00ab1b00COM thunk: invokes vtable[0] of inner object. Template variant.
0x00AB1DB021COM_stub_invoke_return_1IDispatch::Invoke stub. Sets output param to 0 and returns S_FALSE (1).
0x00AB1EE057BSTR_free_wrapperFrees a BSTR string stored at *param_1 using SysFreeString.
0x00AB20F068BSTR_free_wrapper_00ab20f0Frees a BSTR string stored at *param_1 using SysFreeString. Duplicate of BSTR_free_wrapper.
0x00AB2140174BSTR_array_scalar_deleting_dtorScalar deleting destructor for BSTR array elements. If flag bit 2 set, iterates array calling SysFreeString on each element. If flag bit 1 set, frees the memory. For single elements, just calls SysFreeString and optionally frees.
0x00AB371066CWebEventReceiver__ctorConstructor for CWebEventReceiver. Sets vtable to PTR_FUN_01158d68, zeros all 6 fields, outputs debug string "CWebEventReceiver()".
0x00AB376072COM_release_inner_ref_00ab3760Releases an inner COM object reference. Calls Release (vtable+0x8) on the inner object at *param_1 if non-null.
0x00AB37B072COM_release_inner_ref_00ab37b0Releases an inner COM object reference. Identical to COM_release_inner_ref_00ab3760.
0x00AB380061COM_release_inner_ref_00ab3800Releases an inner COM object reference via vtable+0x8. Slightly different calling convention variant.
0x00AB385061COM_release_inner_ref_00ab3850Releases an inner COM object reference via vtable+0x8. Variant with different stack frame.
0x00AB38A066CWebEventReceiver__dtorDestructor for CWebEventReceiver. Resets vtable to PTR_FUN_01158d68, outputs debug string "~CWebEventReceiver()".
0x00AB38F021COM_interlocked_add_refThread-safe IUnknown::AddRef implementation. Atomically increments the reference count at this+4 using LOCK prefix. Returns the new count.
0x00AB3910207COM_find_and_advise_connection_pointFinds a connection point on a COM object by IID and advises (connects) a sink. Queries IConnectionPointContainer, finds the connection point by param_3 IID, then calls Advise with param_2 sink. Releases intermediaries.
0x00AB39E0204COM_find_and_unadvise_connection_pointFinds a connection point on a COM object by IID and unadvises (disconnects) by cookie. Queries IConnectionPointContainer, finds the connection point by param_2 IID, then calls Unadvise with param_3 cookie.
0x00AB3AE052CWebEventReceiver__connect_to_objectConnects the web event receiver to a COM object. Stores the object at +8, the window handle at +0x18, calls AddRef, then advises the IOleObject connection point. Returns true on success.
0x00AB3B20841CWebEventReceiver__handle_eventHandles OLE events from the embedded web browser control. Event 0xFD: closes the browser, disconnects event sinks, destroys the window. Event 0x103: handles new window navigation by connecting child objects. Event 0x3FF/0x8001000A: handles key events (filters F1/F11/Esc). Event 0xFFFFFDA6: handles accelerator keys.
0x00AB3F3099CWebEventReceiver__QueryInterfaceIUnknown::QueryInterface for CWebEventReceiver. Supports two IIDs (DAT_011af6e0 and DAT_011af750). Returns the this pointer and calls AddRef for matching IIDs, E_NOINTERFACE otherwise.
0x00AB3FA0116CWebEventReceiver__disconnect_allDisconnects all event sinks from the web event receiver. Unadvises child object at +0x10, then the main OLE object at +8. Releases both COM objects and removes the browser window.
0x00AB402061CWebEventReceiver__ReleaseIUnknown::Release for CWebEventReceiver. Atomically decrements refcount. When it reaches 0, resets vtable, logs destructor, and frees the 0x1c-byte object.
0x00AB49D0582CUIAchievementWnd__ctorConstructor for the CUIAchievementWnd (achievement window). 582 bytes.
0x00AB4C2071CUIAchievementWnd__dtor_baseBase destructor for CUIAchievementWnd. Sets vtable to CUIAchievementWnd vtable, then calls CEffect__dtor for base class cleanup.
0x00AB4C7099CUIAchievementWnd__scalar_deleting_dtorScalar deleting destructor for CUIAchievementWnd. Sets vtable, calls CEffect__dtor for base cleanup, and conditionally frees the 0x9C-byte object.
0x00AB4CE0156CUIAchievementWnd__on_createOnCreate handler for CUIAchievementWnd. Sets up initial window state. 156 bytes.
0x00AB4D90705CUIAchievementWnd__renderRender function for the achievement notification window. Clears background (0xffff00ff), loads and draws a background sprite from an XOR-encrypted resource path, then renders achievement detail entries as sprite quads using skill tree node data. Iterates up to 2 detail slots per entry. Not a message handler -- this is the draw/paint callback.
0x00AB5070278UIScrollList__update_animationUpdates scroll list animation. Checks timer at offset 0x26 to trigger callback via FUN_00a8c780. Otherwise, uses skill window float value to calculate animated index position with timeGetTime-based progression. Supports repeat count at offset 0x21 and increments step counter at 0x25.
0x00AB51D0186singleton_init_flag_objectSingleton initializer. Allocates 0x14-byte flag object if global DAT_014a69b0 is null. Sets first byte to 1 (active flag), rest zeroed. Returns 1 if flag is set, otherwise frees the object and returns 0.
0x00AB52E036CTimer__set_delaySets timer delay on object. Only acts if state (offset 0xc) < 2. Stores delay value at offset 0x8 and computes deadline (timeGetTime + delay) at offset 0x10.
0x00AB59A0517CRsmNode__ctorCRsmNode constructor. Initializes vtable (PTR_FUN_011590e0), zeroes all fields. Sets up scale factors (offsets 7-9) to 1.0f. Allocates 0xC-byte linked list header for child nodes at offset 0x57. Sets render mode to 2, color to 0xFF0000 (red) at offset 0x55. Large structure (~0x170 bytes).
0x00AB5BB0124CRsmNodeEx__ctorCRsmNodeEx constructor. Calls CRsmNode__ctor as base class, then overrides vtable to PTR_FUN_01159110. Adds 4 extra dword fields (0x5C-0x5F) initialized to zero.
0x00AB5C30162CRsmAnimNode__ctorCRsmAnimNode constructor. Calls CRsmNode__ctor base, overrides vtable to PTR_FUN_01159140. Allocates 0xC-byte linked list at offset 0x5C. Initializes tick count timestamp at offset 0x62 via GetTickCount(). Adds animation timing fields.
0x00AB5CE0256CRsmPart__ctorCRsmPart constructor. Sets vtable PTR_FUN_011590a4. Initializes embedded string (offsets 1-6, SSO with capacity 0xF). Allocates 0xC-byte tree header at offset 9. Sets transform data: scale 1.0 at offset 0x1B, position/rotation zeroed. Boolean at offset 0x22.
0x00AB5DE0181CRsmPartEx__ctorCRsmPartEx constructor. Calls CRsmPart__ctor as base class, overrides vtable to PTR_FUN_011590b8. Adds 9 extra dword fields (0x23-0x2B) initialized to zero.
0x00AB5EA0284CRsmPartWithMaps__ctorCRsmPartWithMaps constructor. Calls CRsmPart__ctor base, overrides vtable to PTR_FUN_011590cc. Adds extended fields (0x3B-0x47). Allocates two tree map headers: 0x1C-byte RB-tree at offset 0x44 and 0x28-byte RB-tree at offset 0x46.
0x00AB6420244CRsmNode__dtor_bodyCRsmNode destructor body. Sets vtable to CRsmNode. Iterates child list at offset 0x57, freeing 0xE8-byte child data at each node's [2]. Destroys the linked list nodes (0xC bytes each). Then clears and frees the list header.
0x00AB6520110CRsmNodeEx__dtor_bodyCRsmNodeEx destructor body. Sets vtable to CRsmNodeEx. Destroys object at offset 0x5C via virtual call if non-null. Then chains to CRsmNode__dtor_body for base class cleanup.
0x00AB6590258CRsmAnimNode__dtor_bodyCRsmAnimNode destructor body. Sets vtable to CRsmAnimNode. Iterates child list at offset 0x5C, calling virtual destructors on each child's data ([2]). Destroys linked list nodes, then chains to CRsmNode__dtor_body.
0x00AB66A0279CRsmPart__dtor_bodyCRsmPart destructor body. Sets vtable to CRsmPart. Destroys child parts via virtual dtors from linked list at offset 9. Clears list, resets position data. Calls json cleanup, frees 36-byte vector, stub cleanup, then destroys list header and embedded string.
0x00AB67C0148CRsmPartEx__dtor_bodyCRsmPartEx destructor body. Sets vtable to CRsmPartEx. Frees 0x10-byte and 0x14-byte vectors, then 32-byte vector buffer. Chains to CRsmPart__dtor_body for base cleanup.
0x00AB6860214CRsmPartWithMaps__dtor_bodyCRsmPartWithMaps destructor body. Sets vtable to CRsmPartWithMaps. Destroys tree at offset 0x46 (40-byte header), destroys map-with-maps tree at offset 0x44 (0x1C header), frees three 0x14-byte vectors. Chains to CRsmPart__dtor_body.
0x00AB699038CRsmNode__scalar_deleting_dtorCRsmNode scalar deleting destructor. Calls CRsmNode__dtor_body, then frees 0x170 bytes if bit 0 of param is set. Virtual destructor entry point.
0x00AB69C0134CRsmNodeEx__scalar_deleting_dtorCRsmNodeEx scalar deleting destructor. Sets vtable, destroys object at offset 0x5C via virtual call, chains to CRsmNode__dtor_body, then frees 0x180 bytes if bit 0 set.
0x00AB6A50282CRsmAnimNode__scalar_deleting_dtorCRsmAnimNode scalar deleting destructor. Sets vtable, destroys child list at offset 0x5C with virtual dtors, chains to CRsmNode__dtor_body, then frees 400 bytes if bit 0 set.
0x00AB6B7038CRsmPart__scalar_deleting_dtorCRsmPart scalar deleting destructor. Calls CRsmPart__dtor_body, then frees 0x8C bytes if bit 0 set.
0x00AB6BA0172CRsmPartEx__scalar_deleting_dtorCRsmPartEx scalar deleting destructor. Sets vtable, frees vectors, chains to CRsmPart__dtor_body, then frees 0xB0 bytes if bit 0 set.
0x00AB6C50238CRsmPartWithMaps__scalar_deleting_dtorCRsmPartWithMaps scalar deleting destructor. Destroys trees and vectors, chains to CRsmPart__dtor_body, then frees 0x120 bytes if bit 0 set.
0x00AB6D40312CRsmNode__transform_point_by_keyTransforms a 2D point (x,y in param_3/param_4) using a transform entry looked up by float key in the node's tree. Applies rotation (sin/cos at offset 0x24), scale (offsets 0x1C/0x20), and translation (offsets 0x14/0x18). Returns 1 if transform found, 0 if key not in tree.
0x00AB6E90185CRsmNodeEx__init_from_rsm_dataInitializes CRsmNodeEx from RSM file data. Copies animation speed (offset 0x14C) and frame count (0x15C). Allocates and constructs a CRsmPartEx child, links parent pointer, calls virtual load and update methods.
0x00AB6F50236CRsmAnimNode__init_from_rsm_dataInitializes CRsmAnimNode from RSM file data. Copies animation speed and frame count. Calculates frame duration as (frameCount * 1000) * (constant / fps). Uses CResourceManager__ForEachInList with a functor (vtable PTR_FUN_01159170). Calls virtual load and update.
0x00AB7050927CRsmPartEx__copy_from_rsm_partCopies RSM part data into CRsmPartEx. Copies name string, texture ID references, alpha value, position/rotation/scale keyframes. Creates CRsmPartEx children for each child part in source, linking parent/root pointers. Resizes index buffer based on face count.
0x00AB73F0942CRsmPartWithMaps__copy_from_rsm_partCopies RSM part data into CRsmPartWithMaps. Similar to CRsmPartEx version but copies 3x4 matrices (position, rotation, scale). If parent exists, computes inverse transform and multiplies. Copies face/vertex/texcoord vectors. Creates CRsmPartWithMaps children. Handles texture face indices.
0x00AB781049CRsmNode__test_ray_intersectionTests if a ray intersects this CRsmNode's bounding box (AABB at offset 0x98). Only active when flag at offset 0x154 is set. On intersection hit, sets dirty/selected flag at offset 0x155.
0x00AB786015CRsmNode__find_part_by_name_wrapperWrapper that calls CRsmPart__find_by_name_recursive on this node's root part. Thin forwarder.
0x00AB787049CRsmNode__find_child_by_nameSearches child list at offset 0x170 for a part matching the given name. Iterates through linked list, calling CRsmPart__find_by_name_recursive on each child. Returns matching part pointer or 0.
0x00AB78B0109CRsmPart__find_by_name_recursiveRecursively searches for an RSM part by name. Compares this part's embedded string (offset 4, SSO) against param_2 using std::char_traits compare. If match, returns this. Otherwise recursively searches children in linked list at offset 0x24.
0x00AB7930219CRsmNodeEx__update_frame_tickUpdates animation frame based on tick count. Mode 1 = play once (clamps at end), Mode 2 = loop (wraps to 0). Uses speed (0x5A) and DAT_01114b8c as delta multiplier. Calls virtual set_frame (vfunc 0x14) with new frame value. Stores last tick at offset 0x5F.
0x00AB7A10300CRsmAnimNode__update_frame_tickUpdates animation frame for CRsmAnimNode using GetTickCount-based timing. Mode 1 = play once (clamps via FUN_00e62680), Mode 2 = loop (resets timestamp at 0x62 on wrap). Uses double-precision frame duration at offset 0x60. Calls virtual set_frame.
0x00AB7B50227CRsmNodeEx__renderCRsmNodeEx render method. Calls virtual update (vfunc 8) if dirty flag (0x25) set. Computes face winding from scale signs (offsets 7-9). Multiplies local 3x4 matrix (offset 0xD) with parent. Calls child part's render (vfunc 0xC). Handles alpha fade-in/fade-out (offsets 0x155-0x156).
0x00AB7C40240CRsmAnimNode__renderCRsmAnimNode render method. Similar to CRsmNodeEx render but iterates through child list at offset 0x5C, rendering each child part. Handles alpha fade on parent node (offsets 0x155-0x156) per child.
0x00AB7D401889CRsmPartEx__render_trianglesCRsmPartEx triangle rendering. Multiplies transform matrix, projects vertices to screen via CRenderPipeline. Iterates face indices, performs backface culling and frustum clipping. Builds 32-byte vertex entries with position, depth, color, and UV. Applies vertex colors with ambient lighting. Enqueues mesh batches to render pipeline's circular buffer.
0x00AB84B02297CRsmPartWithMaps__render_trianglesCRsmPartWithMaps triangle rendering. Similar to CRsmPartEx version but additionally transforms each vertex's UV through the node's transform map (via STL_tree__lower_bound_by_int_key). Applies rotation, scale, and translation to texture coordinates per face. Handles ambient lighting, backface culling, and frustum clipping. Enqueues to render pipeline.
0x00AB8DB0605CRsmNode__render_bounding_boxRenders RSM node bounding box as 6 quads (12 triangles). Projects 8 corner vertices (offset 0xD4, 0xC bytes each) to screen space. Uses DAT_01347e80 index table for face winding. Enqueues each quad to the render pipeline's line/debug queue (offset 0x74). Calls stub_00571790 for texture binding.
0x00AB901048CRsmNode__set_animation_speedSets animation speed at offset 0x168. If non-zero, divides by DAT_010df4f0 (likely FPS normalization constant). Zero speed stored as-is.
0x00AB904020CRsmNode__set_animation_speed_rawSets animation speed at offset 0x168 directly without FPS normalization. Raw value setter.
0x00AB907042CRsmNode__set_frame_and_mark_dirtySets the current animation frame on the first child in the list at offset 0x170 via virtual call (vfunc 8). Sets dirty flag at offset 0x94 to 1 to trigger re-render.
0x00AB9120238CRsmPart__set_frame_with_interpolationSets frame on CRsmPart with keyframe interpolation. Copies identity matrix, then interpolates translation, rotation, and scale from keyframe arrays. Multiplies resulting matrices. Recursively sets frame on child parts through linked list at offset 0x24.
0x00AB9210644CRsmPartWithMaps__set_frame_with_morphSets frame on CRsmPartWithMaps with morph target support. Copies identity matrix, interpolates scale/rotation/position transforms. Clears and rebuilds transform map (offset 0x118) from template (0x110). For each map entry, interpolates morph keyframes at the current frame. Recursively applies to children.
0x00AB94A038CRsmPart__set_two_sided_recursiveRecursively sets two-sided rendering flag (offset 0x88 = 1) on this part and all children via linked list at offset 0x24.
0x00ABA5203551CRsmNode__compute_bounding_box_and_normalsComputes CRsmNode bounding box and normals. Similar to CRsmModel version but works on node's child list at 0x5C. Iterates parts via FUN_00abb300 to accumulate bounds. Transforms 8 AABB corners by node's local matrix. Computes normalized axis vectors. Sets ready flag at 0x25.
0x00ABB300333CRsmPart__compute_world_bounds_recursiveRecursively computes world-space bounds for an RSM part. Transforms each vertex by the part's local 3x4 matrix (offset 0x30). Updates min/max AABB in param_2 (6 floats: minX,minY,minZ,maxX,maxY,maxZ). Recurses into child parts.
0x00ABB4501074CRsmPart__compute_vertex_lightingComputes per-vertex lighting for RSM part faces. For each face's 3 vertices: transforms vertex to world space via param_3 matrix + node offset, calls FUN_00ac09b0 to compute lighting contribution. Adds base vertex color (from offset 0x70) to computed light, clamped to 255. Stores 3 RGB values per face (0x24 bytes per face at offset 0x7C).
0x00ABBA6055CRsmNodeEx__compute_lightingCRsmNodeEx compute lighting. Calls virtual update if dirty, then delegates to CRsmPart__compute_face_colors with the node's local matrix (offset 0xD) and animation speed (0x5B).
0x00ABBAA089CRsmAnimNode__compute_lightingCRsmAnimNode compute lighting. Calls virtual update if dirty. Iterates child list at offset 0x5C, calling CRsmPart__compute_face_colors for each child with the node's local matrix.
0x00ABBB001968CRsmPart__compute_face_colorsComputes per-face vertex colors for an RSM part. Mode 0: flat color from parent node color. Mode 1: per-face normal lighting with diffuse+ambient, accounts for texture atlas smoothing. Mode 2: per-vertex normal lighting. After color computation, assigns texture UV coordinates per face vertex. Recursively processes child parts. Finally computes vertex lighting via CRsmPart__compute_vertex_lighting.
0x00ABC4E032CRsmAnimNode__init_functorInitializes a functor object for CRsmAnimNode resource iteration. Sets vtable to PTR_FUN_01159170, copies 8-byte data and a dword from the source.
0x00ABC50068CRsmAnimNode__destroy_functorDestroys CRsmAnimNode functor. Frees 0x10 bytes if param_2 is non-zero (scalar delete).
0x00ABC550157CRsmAnimNode__load_part_by_nameLoads an RSM part by name for CRsmAnimNode. Looks up resource via CResourceManager__FindByName. Allocates 0x120-byte CRsmPartWithMaps, constructs it, links parent pointer (offset 7), calls virtual load (vfunc 4), then pushes to child list via FUN_00abcb70.
0x00ABC6001stub_nop_00abc600Single-byte stub function (size=1)
0x00ABC83032CRsmAnimNode__init_functor_00abc830Initializes functor for resource iteration. Same as CRsmAnimNode__init_functor - copies vtable, 8-byte data, and dword from source. Duplicate at different address.
0x00ABC86049memset_36byte_elementsZeroes param_2 elements of 0x24 bytes (36 decimal) each starting at param_1. Returns pointer past the last zeroed element. Used for vector initialization.
0x00ABC8A083init_vertex_buffer_32byte_elementsInit vertex buffer 32byte elements
0x00ABC90054copy_vertex_buffer_36byte_elementsCopies 36-byte (9 dwords) vertex elements from source range to destination. Copies in 3 groups: 4 dwords + 4 dwords + 1 dword per element. Used for vertex buffer relocation.
0x00ABC950468CVertexPool__allocate_32byte_verticesAllocates 32-byte vertices from a pool. Searches free list for a buffer with enough capacity. If found, resizes it. Otherwise allocates a new vector with the requested capacity. Tracks total allocated count. Returns pointer to the allocated vertex range.
0x00ABFB10569CLightmap__compute_lightmap_texelsComputes lightmap texels for a terrain surface. Iterates over grid cells (width*2 x height*2), checks if cell has valid height data. For cells above threshold, samples 5 neighbor directions via CWalkGrid__get_vertex_color_rgba to compute diffuse lighting. Normalizes RGB channels, stores to lightmap buffer (offset 0x1C, 12 bytes per texel).
0x00AC38B05thunk_to_virtual_method_offset_0x4c_00ac38b0Calls virtual method at offset 0x4c in vtable of param_1
0x00AC3A7039init_particle_arrayInit particle array, small utility function
0x00AC3AA042init_particle_vertex_arrayInit particle vertex array
0x00AC3AD055memset_56byte_elementsZeroes param_2 elements of 0x38 bytes (56 decimal) each. Returns pointer past last zeroed element.
0x00AC3B1044fill_12byte_elementsFill 12byte elements
0x00AC3B4081copy_84byte_elementsCopies 84-byte (0x54, 21 dwords) elements from source range to destination buffer. Copies in 5 groups of 16 bytes + 4 trailing bytes per element.
0x00AC3BA049copy_156byte_elementsCopies 156-byte (0x9C, 39 dwords) elements from source range to destination. Uses dword-by-dword copy loop.
0x00AC3D5060CRsmFileData__ctorCRsmFileData constructor. Zeroes first 5 dwords (pointers/counts) and memsets 0x118 bytes at offset 0x14 to zero. Simple data container initialization.
0x00AC4A2021CBitfield__test_bitTests a bit in a bitfield array. Indexes by param_2 (byte index into dword array at offset 4), tests against param_3 bitmask. Returns true if any matching bits set.
0x00AC4C0023hangul_is_jongseong_ieungChecks if a Hangul jamo code is jongseong ieung (0x0E in high byte). Returns 1 if (param_1 & 0xFF00) == 0x0E00.
0x00AC4D2018hangul_get_char_classGets character classification for a Hangul byte. Returns the dword value from DAT_01348528 table indexed by param_1.
0x00AC4E9015CBitfield__get_valueGets the full dword value from the bitfield array at index param_2. Returns *(param_1 + 4 + param_2 * 4).
0x00AC4EA0256hangul_should_break_wordDetermines if Korean word segmentation should break between two characters. Uses character class bitfield lookups. Handles special cases: 0xDD (always break), space characters, various jamo class combinations. param_4 bit 1 flags alternate break rules. Complex Korean morpheme boundary detection.
0x00AC56C0288insertion_sort_float_pair_array_00ac56c0Insertion sort on a contiguous array of float pairs (8 bytes per element: 2 floats). Sorts elements between param_1 and param_2 in ascending order by first float, using second float as tiebreaker. Not a map operation despite original name.
0x00AC66F0215struct_84byte_init_defaultsInitializes an 84-byte (0x54) struct to default values. Zeroes all 21 dword fields except offset 0x44 (field 0x11) which is set to 1. Returns pointer to initialized struct.
0x00AC67D0104release_vfunc_interface_ptr_00ac67d0Releases a COM-like interface pointer stored at this+0x24 (offset 9). Calls the Release virtual function (vtable+0x10) and sets the pointer to NULL. NOT a vector resize.
0x00AC693033CTextObject__release_fontReleases a COM-style interface at this->field_0x24 (offset 9) by calling its virtual Release method (vtable+0x10), then nulls the pointer.
0x00AC696033CTextObject__release_font_00ac6960Releases a COM-style interface at this->field_0x24 (offset 9) by calling its virtual Release method (vtable+0x10), then nulls the pointer. Duplicate instance at different address.
0x00AC6B5092CTextObject__release_font_with_sehReleases a font resource held by CTextObject. If the font pointer at offset 0x24 is non-null, calls its release method (vfunc at offset 0x10 in vtable) with SEH protection, then nulls the pointer.
0x00AC6BB092release_vtable_member_at_offset9Releases the object at this->field_0x24 (offset 9) by calling its virtual Release method (vtable+0x10), then nulls the pointer.
0x00AC6E4087avl_tree_clear_and_freeClears an AVL/BST tree by recursively freeing nodes via STL_tree__destroy_nodes_recursive_1c, then frees the root 28-byte block.
0x00AC71E0138quadtree_node_recursive_freeRecursively frees 4 child nodes (quadtree children), each 0x7c bytes. After freeing children, clears the vector at the base of the node.
0x00AC7270190hash_map_clearClears a hash map. If count < bucket_count/8, removes entries one by one via hash_map_erase_range. Otherwise bulk-frees all linked list nodes, resets count to 0, and fills the bucket array with the sentinel pointer.
0x00AC7460613adjust_position_to_cell_boundaryAdjusts a 3D position (param_2) to snap to cell boundaries. Gets cell size from object at offset 0x30, uses fmod to calculate offset from cell center, and adjusts X/Z. If the resulting cell type is unwalkable (==1, via C3dAttr__GetCellType), retries adjustment on the original position.
0x00AC76D0119quadtree_node__set_bounds_and_update_childrenSets bounding box (7 floats from param_2) into the node at offsets 0x08-0x20. Then iterates 4 child nodes -- if child exists and obb_ray_intersection_test returns true for its bounds, calls quadtree_node__insert_object to update it.
0x00AC7750120quadtree_node__set_bounds_with_default_heightSets bounding box from param_2 (6 floats) into node offsets 0x08-0x1C, sets max height (offset 0x20) to 0x497423f0 (large float). Then iterates 4 child nodes, if child exists and passes bounds check, updates it.
0x00AC77D0490quadtree_node__subdivideSubdivides a quadtree node by creating 4 child nodes (0x7c bytes each via struct_84byte_init_defaults). Each child gets a quarter of the parent's bounding box. Sets parent pointer, computes midpoints for X and Z. Recursively subdivides children if depth (param_2) is not 5. Children stored at offsets 0x04, 0x08, 0x0C, 0x10.
0x00AC7C3026quadtree_node__intersect_aabb_if_validNull-check wrapper: if param_1 is non-null, calls FUN_00ac7c50 (AABB ray intersection test).
0x00AC7C50646obb_ray_intersection_testPerforms an oriented bounding box (OBB) vs ray/AABB intersection test using slab method. param_2 is a 6-float AABB (min/max XYZ). Tests X, Y, Z axes separately, computing tmin/tmax overlap intervals. Returns 1 if intersection exists within the object's max distance (offset 0x20), 0 otherwise.
0x00AC7EE0141quadtree_node__copy_from_recursiveRecursively copies quadtree node data from param_3 into param_1. Copies bounds, vectors, and midpoints. Recurses into 4 children until depth reaches 5. Resets the counter at offset 0x44.
0x00AC7F70254quadtree_node__insert_objectInserts an object (param_2) into a quadtree node. At leaf level (depth==5), inserts into the node's linked list. At internal nodes, tests each child's OBB intersection and recurses into matching children. Uses max list size of 0x15555555.
0x00AC810077quadtree_node__find_leaf_at_positionquadtree_node: find leaf at position
0x00AC815086cell_index_to_world_coordsConverts cell grid indices (param_2, param_3) to world coordinates. Uses the map's cell count and cell size from the object at offset 0x30 to compute: world_x = (col - cols/2) * cellSize, world_y = (row - rows/2) * cellSize.
0x00AC81B0110world_coords_to_cell_floatConverts world coordinates (param_2, param_3) to floating-point cell indices. Uses map dimensions (cols at 0x110, rows at 0x114) and cell size (0x118) from the object at offset 0x30. Output is float cell coordinates (not integer).
0x00AC83E085world_coords_to_cell_indexConverts world coordinates (float param_2, param_3) to integer cell grid indices. Divides by cell size, then adds half the map dimensions to center. Uses map data from offset 0x30.
0x00AC84F0147quadtree_node__insert_object_by_boundsInserts an object (param_2) into the quadtree based on its bounding box (offset 0x98). At leaf level (depth==5), appends to the node's vector and marks all ancestors as dirty (offset 0x44=1). At internal levels, tests intersection with each child's bounds via obb_obb_intersection_test and recurses.
0x00AC8590141quadtree_node__init_cell_ranges_recursiveRecursively initializes cell coordinate ranges for each quadtree node. Sets dirty flag (offset 0x44=1), stores a reference value at offset 0x68, converts node bounds to cell coordinates via FUN_00a8c790 at offsets 0x6C-0x78. Recurses into 4 children until depth 5.
0x00AC8620141quadtree_node__init_cell_ranges2_recursiveRecursively initializes alternate cell coordinate ranges for quadtree nodes. Sets dirty flag, stores ref at offset 0x54, converts bounds via FUN_00ac0180 into offsets 0x58-0x64. Recurses into 4 children until depth 5.
0x00AC86B0147quadtree_node__insert_object_by_bounds2Identical to quadtree_node__insert_object_by_bounds, inserts an object into the quadtree by testing bounding box intersection (offset 0x98) against children. At leaf level (depth==5), appends to vector and marks ancestors dirty. Uses FUN_00acad10 for intersection and calls quadtree_node__insert_object_by_bounds for child insertion.
0x00AC8F60219quadtree_node__read_from_file_recursiveRecursively reads quadtree node data from a file stream. Reads 12 float values (bounds, extents, midpoints) via CFileStream__read_with_advance into offsets 0x14-0x40. Recurses into 4 children until depth 5.
0x00AC939041compute_cell_linear_indexComputes a linear cell index from 2D coordinates: result = param_2[0] + cols * param_2[1], where cols comes from offset 0x110 of the map data at offset 0x30.
0x00ACA5D0145quadtree_node__remove_object_recursiveRecursively removes an object (param_2) from the quadtree. At leaf level (depth==5), searches the node's vector for the matching pointer and removes it via memcpy shift. If found, marks all ancestor nodes as dirty (offset 0x44=1). At internal levels, recurses into all 4 non-null children.
0x00ACAD101762obb_obb_intersection_testPerforms an OBB-OBB (oriented bounding box) intersection test using the Separating Axis Theorem. Tests all 15 separating axes: 3 axes of each OBB and 9 cross products. param_1 is the first OBB (3 extents + 3x3 rotation matrix), param_2 is the second OBB (AABB-style min/max XYZ). Returns 1 if overlapping, 0 if separated.
0x00ACB400338quadtree_node__update_height_bounds_recursiveRecursively updates height bounds for dirty quadtree nodes. At leaf level (depth==5), gets height range from terrain and objects, updates min/max Y, computes center and extents for the OBB, propagates changes up to parent nodes. At internal levels, recurses into dirty children only.
0x00ACB560338quadtree_node__update_height_bounds_recursive2Nearly identical to quadtree_node__update_height_bounds_recursive. Updates height bounds for dirty quadtree nodes. At leaf level, gets terrain height range, iterates objects for min/max Y, updates OBB extents/center, propagates to ancestors. Minor differences: no null check on objects in loop.
0x00ACB76022npc_chat_predicate1__copy_ctorCopy constructor for NPC chat predicate type 1 (vtable PTR_FUN_01159370). Copies vtable and data field from this to param_2.
0x00ACB78022npc_chat_predicate2__copy_ctorCopy constructor for NPC chat predicate type 2 (vtable PTR_FUN_01159354). Copies vtable and data field from this to param_2.
0x00ACB7A022npc_chat_predicate3__copy_ctorCopy constructor for NPC chat predicate type 3 (vtable PTR_FUN_011593c4). Copies vtable and data field from this to param_2.
0x00ACB7C0130range_check_predicate__cloneClone method for the range check predicate (vtable PTR_FUN_0115938c). Allocates 0x18 bytes, copies vtable and 5 data fields (range, position coords, etc.) from the source object.
0x00ACB85038npc_chat_predicate4__copy_ctorCopy constructor for NPC chat predicate type 4 (vtable PTR_FUN_011593a8). Copies vtable and 3 data fields.
0x00ACB88068predicate_scalar_deleting_dtor_8byteScalar deleting destructor for an 8-byte predicate object. Frees the object if param_2 is non-zero.
0x00ACB8D068predicate_scalar_deleting_dtor_8byte_00acb8d0Scalar deleting destructor for an 8-byte predicate object. Frees the object if param_2 is non-zero.
0x00ACB92068predicate_scalar_deleting_dtor_8byte_00acb920Scalar deleting destructor for an 8-byte predicate object. Frees the object if param_2 is non-zero.
0x00ACB97068predicate_scalar_deleting_dtor_24byteScalar deleting destructor for a 24-byte (0x18) predicate object. Frees the object if param_2 is non-zero.
0x00ACB9C068predicate_scalar_deleting_dtor_16byteScalar deleting destructor for a 16-byte (0x10) predicate object. Frees the object if param_2 is non-zero.
0x00ACBA3072npc_chat_predicate__check_local_playerPredicate callback: checks if the float at param_2[0] matches any actor's offset 0x110 in the parent manager's actor list, and that actor's GID (vtable+0xA8) matches the local player GID (DAT_016d44d0). Returns 1 if found, 0 otherwise.
0x00ACBAE0652hash_map_rehashRehashes a hash map to a new bucket count. Rounds up to the next power-of-2, allocates new bucket array, frees old array if needed. Reinserts all existing entries using FNV-1a hash on the 4-byte key. Handles collisions by relinking nodes within the same bucket chain. Updates bucket count and mask.
0x00ACBDC01stub_nop_00acbdc0Single-byte stub function (size=1)
0x00ACBFE022npc_chat_predicate1__move_ctorMove/copy constructor for NPC chat predicate type 1. Sets vtable and copies data field.
0x00ACC00022npc_chat_predicate2__move_ctorMove/copy constructor for NPC chat predicate type 2. Sets vtable and copies data field.
0x00ACC02022npc_chat_predicate3__move_ctorMove/copy constructor for NPC chat predicate type 3. Sets vtable and copies data field.
0x00ACC05038npc_chat_predicate4__move_ctorMove/copy constructor for NPC chat predicate type 4. Sets vtable and copies 3 data fields.
0x00ACC1C044copy_8byte_pairs_00acc1c0Copy 8byte pairs 00acc1c0
0x00ACC1F045relocate_8byte_pairs_00acc1f0Relocates pairs of 4-byte values (8 bytes each) from [param_1, param_2) to an offset destination (param_3 as relative offset from param_1).
0x00ACC220485hash_map_erase_rangeErases a range of elements [param_2, param_3) from a hash map. Computes bucket index using FNV-1a hash on the 4-byte key. Unlinks and frees each 12-byte list node, updating bucket pointers and element count. Returns the iterator past the erased range.
0x00ACC43092aligned_vector_allocAllocates memory for a vector of param_1 elements (4 bytes each). For small allocations (<0x1000 bytes), returns a direct heap allocation. For large allocations, allocates extra 35 bytes, aligns to 32-byte boundary, and stores the original pointer at offset -4. Throws bad_array_new_length if count >= 0x40000000.
0x00ACC490126convert_cell_to_world_via_tileConverts cell coordinates to world coordinates via an intermediate tile step. Adds 0.5 to both cell coords, converts to tile coords via FUN_00cd5230, then converts tiles to world via FUN_00cd36e0. Uses FUN_00ad6450 for coordinate system setup.
0x00ACC640419snprintf_to_buffer_with_trackingFormats a string using CFmt__func_00582f60 (printf-like) into a buffer. Tracks position and remaining capacity. Returns a pair: (new buffer position, total bytes written including overflow).
0x00ACC7F01185CInputMgr__ctorConstructor for CInputMgr (input manager). Sets vtable to PTR_FUN_011593e4, initializes linked list, strings, and other fields. Gets current keyboard layout via GetKeyboardLayout(0), detects user language via GetUserDefaultLangID and sets locale string (german, english, italian, portuguese, turkish). If DAT_016d3b10 is 0xF, sets code page to 0x4EA (Korean).
0x00ACCCD091CInputMgrEx__ctor_baseConstructor for CInputMgrEx (base init). Calls CInputMgr__ctor then overrides vtable to PTR_FUN_01159468. Clears an additional byte flag at offset 0xB8.
0x00ACCD30450CInputMgrEx__ctor_with_keybindsConstructor for CInputMgrEx with keyboard binding initialization. Calls CInputMgr__ctor, overrides vtable to PTR_FUN_01159410, allocates a 12-byte doubly-linked list sentinel. Initializes a 256-entry key binding table (offset 0x30, 4 bytes per VK code) from a hardcoded mapping string "11441443331111111132331233111121..." that maps virtual key codes (0-9, A-Z, punctuation) to action categories. Sets special Korean key mappings at specific offsets.
0x00ACCF00100CInputMgrEx__ctor_with_flagConstructor for CInputMgrEx variant. Calls CInputMgr__ctor, sets vtable to PTR_FUN_0115943c, then queries FUN_00ac4a40 to set a boolean flag at offset 0xB8.
0x00ACD010102clear_singly_linked_list_from_offsetClears a singly-linked list stored at offsets 4/8/C. Nulls the tail pointers, then walks and frees each 12-byte node.
0x00ACD140144CInputMgr__dtorDestructor for CInputMgr. Sets vtable to base PTR_FUN_011593e4, then destroys 4 STL strings, an STL container, and the linked list (via SpriteAction__clear_list_a_and_free).
0x00ACD1D038CInputMgr__scalar_deleting_dtorScalar deleting destructor for CInputMgr. Calls CInputMgr__dtor, then optionally frees the 0xB8-byte object.
0x00ACD20093CInputMgrEx__scalar_deleting_dtorScalar deleting destructor for CInputMgrEx. Calls CInputMgr__dtor, then optionally frees the 0xBC-byte object.
0x00ACD260160CInputMgrEx__scalar_deleting_dtor_with_keybindsScalar deleting destructor for CInputMgrEx (with keybinds). Clears and frees the linked list at offset 0xB8, then calls CInputMgr__dtor. Optionally frees the 0x4C4-byte object.
0x00ACD30093CInputMgrEx__scalar_deleting_dtor_flagvarScalar deleting destructor for the CInputMgrEx variant with flag. Calls CInputMgr__dtor, then optionally frees the 0xBC-byte object.
0x00ACD360145CInputMgr__insert_textInserts text (param_2 C-string) into the input field. Deletes the current selection first via FUN_00acd700, then inserts the text at the cursor position, updates the cursor and selection offsets. If the active chat window matches, updates its display via CFmt__func_00599730.
0x00ACD400145CInputMgr__insert_text_00acd400Identical to CInputMgr__insert_text. Inserts a C-string into the input field, deleting selection first, then updates cursor and display.
0x00ACD4F079CInputMgrEx__process_pending_keyactionProcesses a pending key action from the keybind list (offset 0xB8). Reads the key code from the list tail, checks if the key's action type (from the binding table at offset 0xC0) is less than 4. If so, calls FUN_00acf6a0 to dispatch the action.
0x00ACD540126CInputMgr__paste_from_clipboardPastes text from the Windows clipboard into the input field. Checks that the active window is not a specific UI type (0x116 or 0x80). Opens clipboard, gets CF_TEXT data, locks the global memory, and calls CInputMgr__insert_text. Cleans up clipboard handles.
0x00ACD5C0210CInputMgr__copy_selection_to_clipboardCopies the current text selection to the Windows clipboard. Computes selection range from offsets 0x50 and 0x54. If password mode (offset 0x8C), copies asterisks instead. Opens clipboard, allocates global memory (GMEM_MOVEABLE), copies selected text, null-terminates, sets as CF_TEXT clipboard data.
0x00ACD6A016CInputMgr__cut_selectionCuts the current selection: copies it to clipboard via CInputMgr__copy_selection_to_clipboard, then deletes the selection via FUN_00acd700.
0x00ACD6B072CInputMgr__move_cursor_backMoves the cursor position (offset 0x50) back by one character. Uses CharPrevExA with the current code page (offset 0x90) to handle multi-byte characters correctly. Clamps at 0.
0x00ACD700192CInputMgr__delete_selectionDeletes the text between cursor (offset 0x50) and selection anchor (offset 0x54). Computes the selection range, shifts remaining text down via memcpy, updates the string length (offset 0x44), and resets both cursor positions to the start of the selection. Notifies the active chat window if applicable.
0x00ACD84099CInputMgr__get_string_entry_as_multibyteRetrieves a string entry by index (param_2) from a table and converts it from wide char to multi-byte using WideCharToMultiByte with the current code page (offset 0x90). Returns a pointer to a global 256-byte buffer. Returns empty string constant if index is out of bounds.
0x00ACD8B0142get_charset_from_lang_idMaps a language ID (LANGID, lower 10 bits) to a Windows charset value. Returns charset codes like 0xB2 (Arabic), 0xCC (Russian), 0xA1 (Greek), 0x80 (ShiftJIS), 0x81 (Hangul), 0xDE (Thai), 0xA2 (Turkish), 0xBA (Baltic), 0xA3 (Korean), 0xEE (EastEurope), etc. Handles special sub-language for Chinese (traditional vs simplified).
0x00ACD9B0126charset_to_codepageConverts a Windows charset value to a code page number. Maps: 0x80->932(ShiftJIS), 0x81->949(Korean), 0x86->936(GBK), 0x88->950(Big5), 0xA1->1253(Greek), 0xA2->1254(Turkish), 0xA3->1258(Vietnamese/Korean), 0xB1->1255(Hebrew), 0xB2->1256(Arabic), 0xBA->1257(Baltic), 0xCC->1251(Cyrillic), 0xDE->874(Thai), 0xEE->1250(CentralEurope). Default: 1252(Western).
0x00ACDAE0134lang_id_to_codepageConverts a language ID to a code page by first calling get_charset_from_lang_id, then charset_to_codepage. Combines both steps.
0x00ACDC10253CInputMgr__update_candidate_listUpdates the IME candidate list. Gets the IME context, queries ImmGetCandidateListW for the required buffer size, ensures the internal buffer is large enough, then retrieves the candidate list. Stores candidate count (capped at 9), page start, and selection index. Releases IME context.
0x00ACDD20727CInputMgr__update_composition_stringUpdates the IME composition string. Gets the composition string via ImmGetCompositionStringW (GCS_COMPSTR=8), converts from wide char to multi-byte, stores in the composition buffer (offset 0x70). Formats a display string combining the current text and composition using snprintf_to_buffer_with_tracking. Notifies the active chat window.
0x00ACE000134CInputMgr__update_composition_and_trim_suffixUpdates the composition string via FUN_00acdd20, then checks if the last 2 bytes of the composition match a specific suffix (DAT_010d96f4). If so, trims those 2 bytes off. This handles removing trailing IME markers.
0x00ACE0F0371CInputMgr__commit_composition_resultCommits the IME composition result into the text field. Gets the result string via ImmGetCompositionStringW (GCS_RESULTSTR=0x800), converts from wide char to multi-byte. Deletes the current selection, inserts the result text at the cursor position, updates cursor/selection offsets, and notifies the active chat window.
0x00ACE280146CInputMgrEx__build_keybind_stringBuilds a string representation of the current keybind state from the pending key list (offset 0xB8). Iterates all keys in the list, maps each to its category (from binding table at 0xC0), collects the 2-byte display codes for categories 0-3 into a 9-byte buffer. Returns the STL string at offset 0x58.
0x00ACE36084CInputMgr__get_charset_hex_stringReturns a hex string representation of the current charset. If DAT_016d3b08 is set, gets the charset from either the current keyboard layout (offset 0x8E) or alternate layout (offset 0xB4) depending on param_2, formats it as "%02x". Otherwise returns an empty string.
0x00ACE3C094CInputMgr__update_display_textUpdates the display text from the internal text buffer. If param_2 differs from the internal string pointer, re-assigns the STL string content. If composition text (offset 0x70) is non-empty, inserts it at the cursor position (offset 0x50).
0x00ACE42023CInputMgr__get_cursor_and_selectionGets cursor and selection positions. Writes selection anchor (offset 0x54) to param_2 and cursor position (offset 0x50) to param_3.
0x00ACE44047CInputMgr__get_selection_range_sortedGets the selection range sorted (start, end). Writes the smaller of cursor/anchor to param_2, the larger to param_3.
0x00ACE47026advance_char_with_codepageAdvances to the next character in a string using CharNextExA with the global code page (DAT_016d3a78).
0x00ACE49026advance_char_with_codepage_00ace490Advances to the next character in a string using CharNextExA with the global code page (DAT_016d3a78).
0x00ACE4B016CInputMgr__set_password_modeSets the password mode flag at offset 0x8C. When enabled, clipboard copy shows asterisks instead of actual text.
0x00ACE4C077CInputMgr__move_cursor_forwardMoves the cursor position (offset 0x50) forward by one character. Uses CharNextExA with the current code page (offset 0x90) to handle multi-byte characters. Clamps at the string length.
0x00ACE510208CInputMgr__resolve_localized_pathResolves a localized file path by prepending the locale prefix string (offset 0x9C). Skips localization for certain language codes (0, 2, 0x14). Checks if the localized file exists via CFileSystem or the resource manager, and returns the localized path if found, otherwise returns the original path.
0x00ACE5E061CInputMgr__move_cursor_forward_by_nMoves the cursor forward by param_2 bytes, clamped to the string length. If Shift is not held (GetKeyState(VK_SHIFT)), also moves the selection anchor to match.
0x00ACE62058CInputMgr__move_cursor_back_by_nMoves the cursor back by param_2 bytes, clamped to 0. If Shift is not held (GetKeyState(VK_SHIFT)), also moves the selection anchor to match.
0x00ACE660215CInputMgr__handle_char_inputHandles a character input (WM_CHAR). For backspace (8), deletes selection or moves cursor back and deletes. Ignores Tab(9), LF(10), Enter(13), Escape(27). For printable chars (>=0x20), deletes any selection, inserts the character at the cursor position, updates cursor offset, and notifies the chat window.
0x00ACE760210CInputMgr__handle_char_input_rtlHandles character input for right-to-left (RTL) text. Similar to CInputMgr__handle_char_input but with RTL-specific handling. For ASCII printable (0x20-0x7F), clears a flag at 0xB8 and uses CInputMgr__insert_text. For non-ASCII (>=0x80), sets the flag and inserts directly.
0x00ACE880697CInputMgr__handle_key_downHandles WM_KEYDOWN messages. Without modifiers: Home(0x24)->cursor start, End(0x23)->cursor end, Left(0x25)->move cursor back (with special notification for UI), Right(0x27)->move cursor forward, Delete(0x2E)->delete forward. With Ctrl: A->select all, C->copy, V->paste, X->cut. With Shift: extends selection for Home/End/Left/Right, Insert(0x2D)->paste, Delete(0x2E)->cut.
0x00ACEBC0143CInputMgr__handle_key_down_rtlHandles WM_KEYDOWN for RTL (right-to-left) mode. If the RTL flag (offset 0xB8) is clear, delegates to CInputMgr__handle_key_down. Otherwise handles keys with swapped Home/End behavior (Home->end of text, End->start) for RTL text direction. Same Ctrl/Shift modifier handling as LTR version.
0x00ACEEB074notify_active_chat_windowNotifies the active chat window to update its display if the conditions are met: param_1 is non-zero, DAT_014576a4 is set, DAT_01457848 has an active chat (offset 0xBC), and the window ID matches. Calls CFmt__func_00599730.
0x00ACEF00927CInputMgr__handle_ime_messageHandles IME-related Windows messages. WM_IME_STARTCOMPOSITION(0x10D): clears composition. WM_IME_ENDCOMPOSITION(0x10E): ends composition, clears string. WM_IME_COMPOSITION(0x10F): handles composition string changes (GCS_COMPATTR=0x80, GCS_RESULTSTR=0x800). WM_INPUTLANGCHANGE(0x51): updates keyboard layout and code page. WM_IME_NOTIFY(0x282): updates candidate list on open/change events. Sets param_6 to 1 if handled, 0 otherwise.
0x00ACF2A0136CInputMgr__clear_all_textClears all text in the input manager. Notifies IME to cancel composition (ImmNotifyIME NI_COMPOSITIONSTR=0x15, CPS_CANCEL=4). Clears the main text buffer (offset 0x34), display string (offset 0x58), composition buffer (offset 0x70), and resets cursor/selection positions and candidate list count.
0x00ACF340590CInputMgrEx__handle_keybind_inputHandles keyboard input for the keybind system. For backspace (8): adjusts the pending key list count. For other keys: finds and replaces any existing key in the same category (from the binding table at offset 0xC0), then dispatches via FUN_00acf6a0. Manages the doubly-linked key list at offset 0xB8.
0x00ACF59077CInputMgr__set_cursor_and_selectionSets the cursor position (offset 0x50) and selection anchor (offset 0x54) to the given values, clamping both to [0, string_length]. param_2 is the anchor, param_3 is the cursor.
0x00ACF5E0107doubly_linked_list_clearClears a doubly-linked list. Walks and frees all 12-byte nodes, resets sentinel to point to itself, sets count to 0.
0x00ACF6A0165keybind_list_push_back_byteAppends a single byte value (*param_2) to a doubly-linked list (param_1). Allocates a 12-byte node, stores the byte at offset 8 of the node. Used for the keybind pending key list.
0x00ACF770296_Guess_median_unchecked<unsigned_int*,struct_std::less<void>_>STL _Guess_median_unchecked for introsort. Selects median-of-three pivot from first, middle, and last elements.
0x00ACF8A0379_Partition_by_median_guess_unchecked<unsigned_int*,struct_std::less<void>_>STL _Partition_by_median_guess_unchecked. Partitions a range around a median-of-three pivot for introsort.
0x00ACFA20140_Pop_heap_hole_by_index<unsigned_int*,unsigned_int,struct_std::less<void>_>STL _Pop_heap_hole_by_index. Moves a value down the heap from a given position, restoring heap property.
0x00ACFCF0664get_or_init_clientinfo_key_stringThread-safe lazy initialization of a global string (DAT_016d4288). On first call, tries to read from a file (PTR_DAT_01348f58). If file open fails, decrypts a hardcoded XOR-encrypted key (0x21 bytes with key 0xC5A50B6B/0xBDADDD87). Returns a pointer to the resulting string. Used for clientinfo/service type identification.
0x00ACFF903656initialize_service_type_pathsInitializes service-type-specific file paths and configuration. Based on DAT_016d3b10 (service type), decrypts and assigns multiple XOR-encrypted path strings to global pointers (PTR_DAT_01348f58/70/74/78/7C/80/88). Handles different regions (type 0=KR, 1=JP, 2=US, 3=TW, default=other). Sets up key config paths, loads initial settings, and configures locale-specific flags. Gets system time for randomization seed.
0x00AD0E10280initialize_service_type_paths_altAlternative service type path initialization. For service type 0 (Korean), calls FUN_00ad1c90. For unknown service types, decrypts an XOR-encrypted error/path string. Then calls FUN_00ad1780 for further initialization.
0x00AD0F60742load_loading_screen_filenamesLoads loading screen filenames. Determines the number of screens based on service type (DAT_016d3b10): KR=7, JP/KR_alt=12, TW=4, CN/TH=8, PH=9, default=1. Decrypts a format string template, generates filenames like "loading%02d.jpg", checks if each file exists in the resource system, and adds valid filenames to the global vector (DAT_016d3b70).
0x00AD12701295load_loading_screen_config_fileLoads a loading screen configuration file using CSVParser. Clears existing loading screen entries (DAT_016d3b6c vector), parses the config file, and populates the vector. If no entries were loaded from the file, falls back to load_loading_screen_filenames.
0x00AD17801035initialize_input_managers_and_codepagesLazy-initializes four global singleton input managers: CInputMgr, CInputMgrEx (with keybinds), CInputMgrEx (with flag), CInputMgrEx (base). Then sets up code page and language-specific configuration based on service type (DAT_016d3b10): sets DAT_016d3a78 (codepage), DAT_016d3b07 (language mode), DAT_016d3b08 (charset flag), DAT_016d3b0c (input manager pointer). For unknown service types, shows an error messagebox with a decrypted string.
0x00AD1BE039is_value_in_vector_aSearches global vector A (DAT_016d3b54 to DAT_016d3b58) for param_1. Returns 1 if found, 0 if not found.
0x00AD1C2039is_value_in_vector_bSearches global vector B (DAT_016d3b60 to DAT_016d3b64) for param_1. Returns 1 if found, 0 if not found.
0x00AD1C5028stub_noop_with_security_checkNo-op function stub with security cookie check. Does nothing.
0x00AD1C7028stub_noop_with_security_check_00ad1c70No-op function stub with security cookie check. Does nothing.
0x00AD1C90484initialize_korean_service_pathsInitialize korean service paths
0x00AD2A0010371parse_xml_config_dataParses XML configuration data. 10K bytes. Processes XML nodes (find child/sibling by name, extract text content), compares strings, decrypts embedded data. No callers (likely registered as callback).
0x00AD529058set_fullscreen_flags_by_service_typeSets fullscreen-related flags (DAT_016d3b05 and DAT_016d3b06) from the given parameters, but only for specific service types (KR=0, PH=6, BR=10, US=12, Gravity=2). Other service types are ignored.
0x00AD632052show_error_messagebox_from_stringShows an error MessageBox from an STL string. Extracts the C-string pointer (handles SSO), initializes text rendering singleton, releases DirectDraw surface, then calls MessageBoxA with "Error" title.
0x00AD636036show_error_messageboxShows an error MessageBox with param_1 as C-string text and param_2 as the message box type flags. Initializes text rendering, releases DirectDraw, shows MessageBoxA with "Error" title.
0x00AD639082show_error_messagebox_intShows an error MessageBox with an integer value formatted as a string (using wsprintfA with format from DAT_011597b4). Shows MessageBoxA with "Error" title and type 0 (MB_OK).
0x00AD63F089sanitize_filename_charsSanitizes a filename string (STL string param_1) by replacing invalid characters (\\/:'*?"<>\|) with underscores ('_'). Operates in-place on the string buffer.
0x00AD645013get_field4_if_mode1Returns the value at offset 4 if offset 0x58 equals 1 (mode 1), otherwise returns 0.
0x00AD646013get_field4_if_mode0Returns the value at offset 4 if offset 0x58 equals 0 (mode 0), otherwise returns 0.
0x00AD67E062CGameMode__on_quitHandles game quit. Clears a flag on the sub-object at offset 1 (field 0x14=0). For India service type (0xB), opens the Ragnarok India website via ShellExecuteA. Clears the game mode object pointer.
0x00AD6820317CGameMode__load_and_play_videoLoads and plays a video/intro sequence. Sets mode type (offset 0x58/0x5C), copies filename strings. In a loop while *this is non-zero and app isn't closing: creates either a 0x6F7C-byte player (FUN_00d8c6a0, mode 0) or a 0x670-byte player (FUN_00ccd880, mode 1), calls open/play/close virtual methods, then destroys the player.
0x00AD6960223play_screen_fade_out_with_logoPlays a screen fade-out effect. Calls CAntiCheat__get_hwid_b, records start time. Over 255ms, renders increasing alpha black overlay. If param_1 is set, also renders the "rag_logo.bmp" at the bottom-right corner during the fade. Processes DirectDraw present/flip each frame.
0x00AD6A402745CGameMode__take_screenshotTakes a screenshot. Gets local time, draws date/time overlay text (with special Korean number encoding for service type 0), creates the screenshot directory if needed, builds a filename like "ScreenShot/charname/screenshot_NNNN.jpg", captures the screen via the render device's virtual method (vtable+0x4C), notifies the chat window about the saved screenshot. Auto-increments the global screenshot counter (DAT_016d42b4).
0x00AD7500214CGameMode__handle_messageHandles game mode messages. Message 2: saves hotkeys to registry, cleans up game state, opens India website for service type 0xB, clears the global flag. Message 0x44: sets a flag at offset 0x2C, stores the provided string (param_3) into an STL string. Returns 0.
0x00AD75E061CGameMode__set_stateSets the game mode state (offset 0x50) to param_2 if it changed. Clears sub-state (offset 0x54), timestamps the change via timeGetTime, and dispatches a message (type 0xF) with the new state via CUIWindowMgr__dispatch_chat_message.
0x00AD762047CGameMode__set_next_map_nameSets the next map name for a map change. Clears a flag on the sub-object at offset 4 (field 0x14=0), copies the map name string (param_3) to offset 0x30, and stores param_2 at offset 0x5C.
0x00AD78B0103rb_tree_free_nodes_recursiveRecursively frees red-black tree nodes (24 bytes each). Traverses left child (offset 8), then walks right siblings via offset 0, freeing each node. Stops when reaching a sentinel node (byte at offset 0xD is non-zero).
0x00AD7920128rb_tree_free_nodes_with_string_dataRecursively frees red-black tree nodes (44 bytes each) that contain STL string data. Destroys the string via STL_string_dtor before freeing each node. Same traversal pattern as rb_tree_free_nodes_recursive.
0x00AD79A075rb_tree_lower_bound_intPerforms a lower_bound search in a red-black tree keyed by integer (at node offset 0x10). Returns an iterator struct (param_2) with the found node, a flag indicating if key matched, and the closest node. Standard std::map::lower_bound implementation.
0x00AD79F0129rb_tree_lower_bound_stringPerforms a lower_bound search in a red-black tree keyed by STL string (at node offset 0x10). Compares keys using std::_Traits_compare (lexicographic). Returns an iterator struct (param_2) with the found node, match flag, and closest node.
0x00AD7A8075pathfind_heap_push_upHeap sift-up for pathfinding priority queue. Inserts element at param_2 position, bubbling up by comparing field at offset 0x10 (cost). Array at param_1 with element size 4 bytes (pointer array).
0x00AD8080111rbtree_18byte_destroy_nodesDestroys all nodes in a red-black tree with 0x18-byte nodes. Traverses linked list from root, calls cleanup function on each node's data (offset+8), then frees each 0x18-byte node.
0x00AD810076rbtree_2C_byte_destroy_allDestroys all nodes in a red-black tree with 0x2C-byte nodes. Calls recursive cleanup then frees the sentinel node.
0x00AD82D065rbtree_18byte_destroy_wrapperSEH-wrapped call to rbtree_18byte_destroy_nodes. Wrapper for destroying all nodes in the 0x18-byte red-black tree.
0x00AD832087rbtree_2C_byte_destroy_all_sehSEH-wrapped destruction of all nodes in 0x2C-byte red-black tree. Calls recursive cleanup then frees sentinel. Variant of rbtree_2C_byte_destroy_all.
0x00AD95F09get_byte_and_equality_check_00ad95f0Returns byte at offset 1 and equality comparison of param with itself
0x00AD960011thunk_C3dAttr__IsCellWalkableThunk/wrapper that directly calls C3dAttr__IsCellWalkable and returns.
0x00AD9B80704rbtree_erase_and_rebalanceRed-black tree node removal with rebalancing. Handles all cases: node with two children (swap with successor), node with one or zero children. Performs red-black tree fixup rotations and color flips after removal. Updates parent/child pointers and tree min/max. Decrements node count. Returns pointer to the removed node for deallocation.
0x00ADA28084rbtree_rotate_leftRed-black tree left rotation. Rotates param_2 node left by promoting its right child. Updates parent pointers and tree root if necessary.
0x00ADA2E088rbtree_rotate_rightRed-black tree right rotation. Rotates param_2 node right by promoting its left child. Updates parent pointers and tree root if necessary.
0x00ADA34055fill_16byte_elements_zeroFill 16byte elements zero
0x00ADA38055fill_28byte_elements_zeroFills param_2 consecutive 28-byte (0x1C) elements with zeroes via memset starting at param_1. Returns pointer past the last filled element.
0x00ADA3C036copy_16byte_elementsCopies 16-byte elements from [param_1, param_2) to destination at param_3 offset. Copies 4 DWORDs per element manually.
0x00ADABD032compute_quadrant_boundsComputes the bounding box for a specific quadrant (0-3) of a parent's bounds. Splits parent bounds at midpoints. Quadrant 0=top-left, 1=top-right, 2=bottom-right, 3=bottom-left. Stores result as (x1, y1, x2, y2) in param_1.
0x00ADCC1024memset_short_array_zeroZeroes out an array of param_2 16-bit (short) elements via memset. Total bytes = param_2 * 2.
0x00ADCC3030check_short_ptr_is_zeroChecks if the short value pointed to by param_1 is zero. Returns a packed value with the boolean (==0) in the low byte.
0x00ADCC5046CDllLoader__ctorCDllLoader constructor. Sets vtable to PTR_FUN_01159944, initializes handle field to 0, flag field to 0, and zeroes out a 256-byte (0x100) function pointer table at offset +0x10.
0x00ADCCA080CDllLoader__dtorCDllLoader destructor. Resets vtable, calls FreeLibrary on the DLL handle at field[1] if it's non-null, then zeroes the handle.
0x00ADCD00104CDllLoader__scalar_deleting_dtorCDllLoader scalar deleting destructor. Resets vtable, frees the DLL via FreeLibrary, then conditionally frees the 0x110-byte object if bit 0 of param_2 is set.
0x00ADCDA031CDllLoader__unload_libraryUnloads the DLL by calling FreeLibrary on the handle at offset+4. Zeroes the handle. Always returns 1.
0x00ADCDC058CDllLoader__call_TTDeleteEmbeddedFontCalls TTDeleteEmbeddedFont from t2embed.dll via GetProcAddress. Passes 3 params through. Returns 1 if the call succeeds with result 0, otherwise returns 0.
0x00ADCE0045CDllLoader__delete_embedded_fontDeletes an embedded font by calling TTDeleteEmbeddedFont(param_2, 1, 0) from the loaded t2embed.dll. No-op if DLL not loaded or param_2 is 0.
0x00ADCE3052global_delete_embedded_fontGlobal function that deletes an embedded font using the global CDllLoader instance at DAT_016d42ec. Calls TTDeleteEmbeddedFont(param_1, 1, 0) if the loader and handle are valid.
0x00ADCE7062global_destroy_t2embed_loaderDestroys the global t2embed.dll loader. Frees the library handle, calls the virtual destructor on the CDllLoader object, and sets the global pointer DAT_016d42ec to null.
0x00ADCEB0162global_init_t2embed_loaderInitializes the global t2embed.dll loader. Allocates a 0x110-byte CDllLoader, constructs it, stores in DAT_016d42ec, then loads t2embed.dll via LoadLibraryA if not already loaded. Rejects handles <= 0x20 (error codes).
0x00ADCF60292load_system_font_fileLoads a system font file. Constructs the path as current_directory + "\\System\\Font\\" + filename. Verifies the file exists via fopen. If the global t2embed loader is initialized, delegates to FUN_00add1b0 for actual font embedding. Exits the process if the file doesn't exist.
0x00ADD09039global_set_font_nameCopies a font name string to the global CDllLoader's name buffer at offset +0x10 (the 256-byte table). Only copies if the loader exists and param_1 is non-null.
0x00ADD0C039CDllLoader__load_t2embedLoads t2embed.dll via LoadLibraryA if not already loaded. Stores handle at offset+4. Returns 1 on success, 0 if already loaded or load failed (handle <= 0x20).
0x00ADD0F0181CDllLoader__call_TTLoadEmbeddedFontCalls TTLoadEmbeddedFont from t2embed.dll via GetProcAddress. Passes 10 params through. Returns error codes mapped from T2Embed HRESULT: 1=success, 2=read-only, negative values for various errors (license, invalid, not found).
0x00ADD1B01375CDllLoader__load_embedded_fontLoads an embedded font from a file using T2Embed API. Validates the font name against allowed vendors (ragnarok.co.kr, fontrix.co.kr, puccaracing.co.kr). Converts filename and font name to wide strings, opens the font file, calls TTLoadEmbeddedFont with a file read callback. Returns 1=success, 2=read-only, negative values for errors.
0x00ADD71025font_file_read_callbackFile read callback used by TTLoadEmbeddedFont. Reads param_3 bytes from FILE* param_1 into buffer param_2 via fread.
0x00ADD73033CDllLoader__set_name_bufferCopies a null-terminated string to the object's internal buffer at offset +0x10. Uses char-by-char copy. Offset of destination is (this - param_2 + 0x10).
0x00ADD76025font_file_write_callbackFile write callback for T2Embed API. Writes param_3 bytes from buffer param_2 to FILE* param_1 via fwrite.
0x00ADD810426convert_string_to_wstringConverts an STL string to an STL wstring using MultiByteToWideChar (code page 0, flags 1). First queries required buffer size, allocates a wide char vector, performs the conversion, assigns to the output wstring, then frees the temp buffer.
0x00ADD9C0150rbtree_destroy_nodes_recursiveRecursively destroys all nodes in a red-black tree. For each non-nil node, recurses into right child, sets vtable to PTR_FUN_01159a18, calls json cleanup function, frees the 0x28-byte node, and continues to the left child.
0x00ADDA6075rbtree_lower_boundRed-black tree lower_bound search. Traverses from root, comparing key (at node offset +0x10) against search key (*param_3). Returns iterator-like struct in param_2 with the found node, a flag indicating exact match or greater, and the parent node.
0x00ADDB9076rbtree_28byte_destroy_and_free_sentinelDestroys all nodes in a 0x28-byte red-black tree recursively, then frees the sentinel node.
0x00ADDCD087rbtree_28byte_destroy_and_free_sehSEH-wrapped destruction of 0x28-byte red-black tree. Recursively destroys all nodes and frees sentinel.
0x00ADE1B0229global_init_rsm_obj_mgrInitializes the global CRsmObjMgr singleton at DAT_016d42f0. Allocates a 0x10-byte CRsmObjMgr, constructs it with red-black tree. Returns 1 on success, 0 on failure. Destroys the object if construction fails.
0x00ADE2A027global_destroy_rsm_obj_mgrDestroys the global CRsmObjMgr singleton at DAT_016d42f0. Calls virtual destructor with delete flag, then sets global pointer to null.
0x00ADE2C0583ChampionMonsterMgr__load_lua_configLoads champion monster size/effect configuration from a Lua script (System/monster_size_effect_new_lua). Registers AddItem and AddEffect Lua callbacks, executes the script. On error, shows a MessageBox with the error details from Lua. Returns 1 on success, 0 on failure.
0x00ADE6D0230format_string_to_stlFormats a variable-argument string into an STL string. Allocates 0x800-byte temp buffer, calls vsprintf-like function to format, constructs the result STL string from the buffer. Returns the output STL string pointer.
0x00ADF090432global_init_map_resource_mgrInitializes the global CMapResourceMgr singleton at DAT_016d42f4. Allocates 0x68 bytes, constructs with strings and linked list. Returns 1 on success, 0 on failure. Destroys on construction failure.
0x00ADF24028global_destroy_map_resource_mgrDestroys the global CMapResourceMgr singleton at DAT_016d42f4. Calls scalar deleting destructor and nulls the pointer.
0x00ADF400134rbtree_A4_destroy_nodes_recursiveRecursively destroys all nodes in a red-black tree with 0xA4-byte nodes. For each non-nil node, recurses right, calls cleanup (FUN_00adf820), frees the 0xA4-byte node, then continues left.
0x00ADF49075rbtree_A4_lower_boundRed-black tree lower_bound search for 0xA4-byte node tree. Same algorithm as rbtree_lower_bound, comparing key at node offset +0x10.
0x00ADF5C079rbtree_A4_destroy_and_free_sentinelDestroys all nodes in an 0xA4-byte red-black tree recursively, then frees the sentinel.
0x00ADF70090rbtree_A4_destroy_and_free_sehSEH-wrapped destruction of 0xA4-byte red-black tree. Recursively destroys all nodes and frees sentinel.
0x00ADFA8036CMapObjBase__scalar_deleting_dtorCMapObjBase scalar deleting destructor. Sets vtable to PTR_FUN_01159c14, conditionally frees the 8-byte object.
0x00ADFDB0232global_init_map_resource_cacheInitializes the global CMapResourceCache singleton at DAT_016d4300. Allocates 0x10 bytes, constructs with 0xA4-byte red-black tree. Returns 1 on success, 0 on failure.
0x00ADFEA027global_destroy_map_resource_cacheDestroys the global CMapResourceCache singleton at DAT_016d4300. Calls virtual destructor and nulls the pointer.
0x00AE0270230format_string_to_stl_v2Formats a variable-argument string into an STL string. Identical to format_string_to_stl. Allocates 0x800-byte temp buffer, formats via vsprintf, constructs STL string from result.
0x00AE1500144rbtree_34byte_destroy_nodes_recursiveRecursively destroys all nodes in a red-black tree with 0x34-byte nodes. Each node contains a town info vector and an STL string that need cleanup. Frees each 0x34-byte node after cleanup.
0x00AE159098rbtree_string_findFinds a node in a string-keyed red-black tree. Calls rbtree_string_lower_bound then verifies the found node's key matches. Returns the node if found, or the sentinel if not found.
0x00AE1600129rbtree_string_lower_boundRed-black tree lower_bound with string key comparison. Traverses from root comparing STL string keys using std::_Traits_compare. Returns iterator struct with found node, match flag, and parent. String key stored at node offset +0x10.
0x00AE169072rbtree_string_key_matchesChecks if a tree node's string key matches the search string. Returns 1 if the node is non-nil and its key (at offset 0x10) compares >= the search param_2. Returns 0 if nil node or key is less.
0x00AE16E0137move_range_of_3C_elementsMoves a range of 0x3C-byte elements from [param_1, param_2) to destination starting at param_3. Constructs each new element via FUN_00ae1910 (move constructor), then destroys any remaining trailing elements at the destination.
0x00AE1770117construct_3C_element_from_sourceCopy-constructs a 0x3C-byte element. Copies the first field, copy-constructs embedded STL string at field+1, copies two int fields (7,8), copy-constructs second embedded STL string at field+9.
0x00AE17F0125CTownEntry__move_construct_with_vectorMove-constructs a town entry. Copy-constructs the STL string, then moves the vector data (offsets 0x18-0x20) by copying pointers and zeroing the source. Returns this pointer.
0x00AE1910204CTownEntry__move_ctorMove constructor for a 0x3C-byte town entry element. Copies all fields, moves two embedded STL strings (at offsets +0x14 and +0x24) by taking ownership of the buffer pointer and resetting the source to empty (SSO size=0xF, length=0).
0x00AE19E0120CTownEntry__copy_ctorCopy constructor for a 0x3C-byte town entry element. Copies the first field, deep-copies two embedded STL strings via STL_string_copy_construct, copies two int fields (7,8).
0x00AE1A60145CTownEntry__ctor_from_paramsConstructs a town entry from parameters. Sets ID field, copy-constructs two STL strings from stack args, copies two int fields, then destroys the temp source strings.
0x00AE1B00179CTownEntry__default_ctorDefault constructor for a town entry. Initializes ID to -1, two STL strings to empty (SSO mode), and coordinate fields to -1.
0x00AE1C2076rbtree_34byte_destroy_and_free_sentinelDestroys all nodes in a 0x34-byte red-black tree recursively, then frees the sentinel.
0x00AE1D8087rbtree_34byte_destroy_and_free_sehSEH-wrapped destruction of 0x34-byte red-black tree. Recursively destroys all nodes and frees sentinel.
0x00AE5B7095alloc_0xc_arrayAllocates an aligned array for 0xc-byte elements. Multiplies count by 12, handles aligned allocation for blocks >= 0x1000 bytes. Throws bad_array_new_length if count >= 0x15555556.
0x00AE7060107str_to_lowercase_inplaceConverts a string to lowercase in-place. Uses isupper + manual offset for ASCII, CharNextExA for multibyte character advancement (codepage from DAT_016d3a78). Returns the input pointer.
0x00AE70D036copy_dword_rangeCopy dword range, small utility function
0x00AE710036copy_dword_range_with_offsetCopies a range of dwords from [param_1, param_2) to param_3 using offset-based addressing. Forward copy loop.
0x00AE73A0170TownNpcInfo__ctorConstructor for TownNpcInfo struct (0x48 bytes). Initializes STL string at offset 0, fields at offsets +6 through +0x11. Sets default values: enabled flag at +0x24=1, ID at +0x3C=-1.
0x00AE7450178TownWarpInfo__ctorConstructor for TownWarpInfo struct (0x4C bytes). Initializes 4 scalar fields, STL string at offset +3, enabled flag at +0x24=1, and multiple zero fields.
0x00AE751065TownNpcInfo__dtorDestructor for TownNpcInfo. Destructs the STL string member.
0x00AE756087TownWarpInfo__dtorDestructor for TownWarpInfo. Frees the 16-byte vector buffer and destructs the STL string member.
0x00AE7C30226precision_sleep_microsecondsPrecision sleep using QueryPerformanceCounter. Accumulates microseconds, sleeps when > 1000us accumulated. Measures actual sleep time and compensates for drift. Uses global frequency (DAT_0134b4d0) and state (DAT_016d5678/567c/5680).
0x00AE8110110make_time32_from_componentsConverts date/time components (year, month, day, hour, min, sec, DST flag) to __time32_t via _mktime32. Adjusts year by -1900 and month by -1 for tm struct format.
0x00AE818014trivial_assign_dwordTrivial thiscall setter: assigns param_2 to *this and returns this pointer.
0x00AE81B0145CTime__decompose_to_shortsDecomposes a time32_t into an array of 8 shorts: [year, month, day, hour, minute, second, 0, 0]. Adds 1900 to year, adds 1 to month for 1-based format.
0x00AE825048CTime__add_offsetAdds an offset to the stored time. param_2=days, param_3=hours, param_4=minutes. Converts to local time, adds offsets, then recomputes via mktime32.
0x00AE828042CTime__is_beforeReturns true if this time is before param_2 (difftime < 0).
0x00AE82B054CTime__is_in_pastReturns true if this time is in the past (before current system time).
0x00AE82F014CTime__get_dayReturns the day of month (tm_mday) from the stored time.
0x00AE830014CTime__get_hourReturns the hour (tm_hour, 0-23) from the stored time.
0x00AE831014CTime__get_minuteReturns the minute (tm_min, 0-59) from the stored time.
0x00AE832015CTime__get_monthReturns the month (1-12) from the stored time. Adds 1 to tm_mon (which is 0-11).
0x00AE833027CTime__set_to_current_timeSets the stored time to the current system time via _time32.
0x00AE835013CTime__get_secondReturns the second (tm_sec, 0-59) from the stored time.
0x00AE836068CTime__get_year_month_day_hourDecomposes time into 4 separate short pointers: year (+1900), month (+1), day, hour.
0x00AE83B019CTime__get_yearReturns the year (tm_year + 1900) from the stored time.
0x00AE83D0114CTime__set_from_date_and_hourSets time from year/month/day/hour short components. Zeroes seconds and minutes. Adjusts year by -1900 and month by -1 for tm struct format. DST set to 0.
0x00AE845012CTime__set_rawSets the raw time32_t value directly from param_2.
0x00AE8E70420des_encrypt_blockDES block encryption. Performs initial permutation (FUN_00ae9260), then param_1 rounds of the Feistel network using subkeys from param_2 (in reverse order: 0xF-i). Each round: expansion, XOR with subkey, S-box substitution, P-box permutation. Final swap and inverse permutation (FUN_00ae91d0).
0x00AE9020419des_decrypt_blockDES block decryption. Same as encrypt but uses subkeys in forward order (i instead of 0xF-i). Performs initial permutation, Feistel rounds, final swap and inverse permutation.
0x00AE91D0138des_inverse_initial_permutationDES inverse initial permutation (IP^-1). Applies the 64-bit IP^-1 table (DAT_01159f08) to the 8-byte block in param_1. Bit-level permutation.
0x00AE9260138des_initial_permutationDES initial permutation (IP). Applies the 64-bit IP table (DAT_01159ec8) to the 8-byte block in param_1. Bit-level permutation.
0x00AE92F0575des_key_scheduleDES key schedule. Takes 8-byte key from param_2, applies PC-1 permutation (DAT_01159f58/f74), then generates 16 round subkeys by rotating left halves and applying PC-2 (DAT_01159f90). Stores 16x8-byte subkeys starting at param_1.
0x00AE95D0103destroy_0x10_linked_listDestroys a linked list of 0x10-byte nodes. Zeroes the count, then walks the list freeing each node. Finally frees the sentinel node.
0x00AE96E0225CTimerMgr__destroy_all_timersDestroys all timers in the manager. First iterates the 0x10-byte linked list calling virtual destructors on objects at offsets +2 and +3. Then destroys and frees all list nodes, resets sentinel. Finally destroys a second list the same way.
0x00AE97D0119CTimerMgr__dtorCTimerMgr destructor. Sets vtable, deletes critical section at offset +0xF, destroys internal collections, frees the 0x120-byte vector.
0x00AE9850100CSomeMgr__base_dtorBase destructor for a manager class. Sets vtable to PTR_FUN_0115a214, calls FUN_00aeca50 for cleanup, calls STL_lib_func_004f9590, then sets vtable to base class scalar_deleting_destructor.
0x00AE98C0143CTimerMgr__scalar_deleting_dtorCTimerMgr scalar deleting destructor. Destroys critical section, internal collections, frees 0x120 vector. If param_2 & 1, also frees the 0x148-byte object itself.
0x00AE9950121CSomeMgr__scalar_deleting_dtorScalar deleting destructor for 0x40-byte manager class. Calls FUN_00aeca50 cleanup, sets base vtable. If param_2 & 1, frees the 0x40-byte object.
0x00AE9EE0241load_file_from_diskLoads a file from disk. Opens with CreateFileA, gets size via GetFileSizeEx, allocates with VirtualAlloc, reads with ReadFile. Checks file extension against a specific pattern. Returns allocated buffer or NULL on failure.
0x00AEA19084file_exists_on_diskChecks if a file exists on disk using FindFirstFileA. Returns 1 if found, 0 if not.
0x00AEA40023virtual_free_bufferFrees a VirtualAlloc'd buffer using VirtualFree with MEM_RELEASE.
0x00AEA5C0416crypto_decrypt_with_md5_keyDecrypts data using Windows CryptoAPI with MD5 hash of key. Acquires context, creates MD5 hash (CALG_MD5=0x8003) from param_1/param_2, derives RC4 key (CALG_RC4=0x6801), decrypts param_3 into param_4. Throws on any API failure.
0x00AEA780147delete_hack_tool_filesDeletes known hack tool files: nconfig.ini, ffindhack.exe, gfindhack.exe, removenp.exe, cfindhack.exe. Checks access before unlinking.
0x00AEA820193set_debug_privilegeEnables or disables SeDebugPrivilege. Loads advapi32.dll, calls OpenProcessToken, LookupPrivilegeValue for SeDebugPrivilege, then AdjustTokenPrivileges. param_1: 1=enable, 0=disable. Returns true on success.
0x00AEACD095load_dll_and_get_procsGeneric DLL loader helper. Loads param_2 DLL, then resolves param_3 function pointers from varargs (pairs of: output_ptr, proc_name). Returns 1 if all resolved, 0 and frees library on failure.
0x00AEAE10575get_global_process_helperGets the global process helper singleton. Thread-safe initialization (once-flag). Loads kernel32/psapi DLLs, resolves API functions, sets debug privilege. Registers atexit cleanup. Returns pointer to global function table or NULL on failure.
0x00AEB050135is_win9x_platformChecks if running on Windows 9x (VER_PLATFORM_WIN32_WINDOWS = 1). Uses GetVersionExA. Returns true for Win95/98/ME, false for NT-class systems.
0x00AEB0E0157decrypt_and_execute_scriptDecrypts encrypted data using crypto_decrypt_with_md5_key with a formatted key string, then feeds each decrypted byte to CInputMgr__handle_char_input.
0x00AEB3A0325resolve_short_path_to_long_nameResolves a short 8.3 path to a long filename path. Handles UNC paths (\\\\server\\share), drive letters (C:), and relative paths. Uses FindFirstFileA to get the long filename for each path component. Returns param_2 on success, NULL on failure.
0x00AEB6F022swap_nibblesSwaps the high and low nibbles of a byte. (param_1 >> 4) \| (param_1 << 4). Used in GRF file processing.
0x00AEBC4076is_des_encrypted_extensionChecks if a filename has a DES-encrypted extension. Gets the extension via strrchr('.'), then compares case-insensitively against a list of known extensions (4 entries at DAT_0134b730). Returns 1 if matched.
0x00AEBC90135build_des_key_from_filenameBuilds an 8-byte DES key from a filename. Extracts the basename (after last \\ or /). Sets byte 0 = 0x6E ('n'), byte 7 = 0x6B ('k'). Copies up to 6 bytes of filename into bytes 1-6, wrapping if shorter than 6.
0x00AEBD2070swap_nibbles_buffer_strSwaps nibbles for each byte in a string. Processes strlen(param_2) bytes from param_2 into param_1. Each byte gets high/low nibble swap.
0x00AEBD7053swap_nibbles_buffer_lenSwaps nibbles for each byte in a buffer of known length. Processes param_3 bytes from offset param_2 into param_1.
0x00AEC9F027thunk_PacketCrypto_initThunk to PacketCrypto__init_thunk_00659b60. Passes all 4 parameters through.
0x00AECA1059init_0x120_elementsInit 0x120 elements, small utility function
0x00AED00045CRegistry__create_keyCreates a registry key via RegCreateKeyExA with KEY_ALL_ACCESS. Returns true on success.
0x00AED03032CRegistry__open_keyOpens a registry key via RegOpenKeyExA with KEY_ALL_ACCESS. Returns true on success.
0x00AED05055CRegistry__query_value_check_typeQueries a registry value and checks if its type matches param_3. Returns true only if query succeeds AND type matches.
0x00AED09044CRegistry__query_value_sizeQueries the size of a registry value without reading the data. Stores size in param_3. Returns 1 on success, 0 on failure.
0x00AED0C045CRegistry__set_valueSets a registry value via RegSetValueExA. Parameters: value name, type, data, size. Returns true on success.
0x00AED0F0133CTreeMap__scalar_deleting_dtorScalar deleting destructor for a tree map class (0x24 bytes). Sets vtable, destroys tree at offset +7, frees sentinel node. If param_2 & 1, frees the object itself.
0x00AEDA1033CTokenizer__ctorCTokenizer constructor. Sets vtable, zeroes member at +1, sets empty name via CGrfFileRecord__set_name.
0x00AEE1F064CScopedCriticalSection__dtorDestructor for CScopedCriticalSection (RAII lock guard). Sets vtable and calls LeaveCriticalSection on the stored LPCRITICAL_SECTION at field[1].
0x00AEE240108CTreeMap__dtorDestructor for CTreeMap. Sets vtable, recursively destroys all nodes in the tree at field+7 via stub_005edbd0, then frees the 0x28-byte sentinel node.
0x00AEE56089CScopedCriticalSection__scalar_deleting_dtorScalar deleting destructor for CScopedCriticalSection. Sets vtable, calls LeaveCriticalSection, optionally frees the 8-byte object if flag bit 0 is set.
0x00AEE5C031get_file_extensionReturns a pointer to the file extension (after the dot) from a filename string. Uses strrchr to find the last '.'. Returns extension+1 if found, 0 if no dot present.
0x00AEFAD08increment_field_offset_0x4_00aefad0Increments a 32-bit integer field at offset +4 from param_1
0x00AEFCF073show_resource_not_found_errorShows a 'ResourceError: Can't find file' error message box with the given filename via lua_util_sprintf and show_error_messagebox.
0x00AEFD4099show_resource_not_found_error_safeSafe version of show_resource_not_found_error. Uses memset+stub_00602b00 for buffer initialization instead of lua_util_sprintf. Shows same 'ResourceError: Can't find file' message.
0x00AF075044string_tolower_inplaceConverts a null-terminated string to lowercase in-place using a lookup table at PTR_DAT_0134b750 (likely tolower table). Returns the original string pointer.
0x00AF0BE021CResource__release_refDecrements the reference count (offset+4) and updates the last-access timestamp (offset+8) with timeGetTime(). Called when a resource is no longer being used by a consumer.
0x00AF0C0037CResource__initInitializes a resource entry. Sets the name/hash via CGrfFileRecord__set_name_and_hash, stores the resource type at offset 0x0C, and records the creation timestamp at offset 0x08 via timeGetTime().
0x00AF0C3014CResource__touch_timestampUpdates the resource's last-access timestamp (offset+8) to the current time via timeGetTime(). Used to keep a resource alive in the cache.
0x00AF0F601stub_nop_00af0f60Single-byte stub function (size=1)
0x00AF18A014trivial_assign_4byteTrivial 4-byte assignment: *param_1 = param_2. Returns param_1. Likely a compiler-generated copy helper.
0x00AF18B0288regex__match_chars_with_collationRegex character matching with locale collation support. Compares characters from two ranges [param_1,param_2) and [param_3,param_4), converting each character via STL collation (STL_lib_func_00505660) before comparing. Returns updated position in the first range if match succeeds, or the original param_1 on mismatch.
0x00AF19D071regex__match_chars_exactregex: match chars exact
0x00AF1A20125regex__match_chars_icaseregex: match chars icase
0x00AF1AA0440regex__match_chars_with_flagsGeneric regex character matching dispatcher based on flags (param_6). Flag 0x100: case-insensitive match via tolower. Flag 0x800: collation-based match via STL_lib_func_00505660. Default: exact byte comparison. Compares ranges [param_1,param_2) against [param_3,param_4).
0x00AF1DD0574regex__format_ecma_replacementECMAScript-style regex replacement formatter. Processes replacement string [param_4,param_5) with $-escapes: $$ = literal $, $` = prefix, $' = suffix, $& = full match, $N/$NN = capture group N. Outputs characters via STL_lib_func_00502be0. Stores result iterator in param_1.
0x00AF2010288regex__format_sed_replacementsed-style regex replacement formatter. Processes replacement string [param_4,param_5) with: & = full match, \\N = capture group N, \\ followed by non-digit = literal character. Outputs via STL_lib_func_00502be0.
0x00AF213079regex__throw_errorThrows a regex error. Sets up an error code via trivial_assign_4byte, then chains through several identity/passthrough functions before triggering a software interrupt (int 3 / swi(3)). Used as an error reporting path in regex operations.
0x00AF2180127thread_proc__close_window_by_titleThread procedure that closes a window by its title. Calls FUN_00af3150, then finds a window by title via FindWindowA (using param_1[1] as the window name) and sends WM_CLOSE (0x10) via SendMessageA. Calls _Cnd_do_broadcast_at_thread_exit and frees the 8-byte parameter block.
0x00AF2200102regex__skip_charset_matchregex: skip charset match
0x00AF2270411regex__execute_matchExecutes a regex match against the input. Sets up match state including capture group storage, iteration limits (10M max, 1K complexity), and flags. Calls regex_match_node to perform the actual NFA/DFA matching. If param_2 (match results) is provided, populates capture groups with matched ranges and flags. Returns 1 on match, 0 on no match.
0x00AF2410849regex__replace_allRegex replace operation (global). Repeatedly matches the regex against the input and applies the replacement format string. Supports both ECMAScript ($-escapes) and sed (\\-escapes, &) replacement formats based on flags. Flag 0x800 controls whether non-matched portions are copied. Flag 0x400 selects sed format. Flag 0x1000 = first match only. Handles zero-length matches by advancing one character.
0x00AF2770456regex__search_implCore regex search implementation. Sets up the NFA state machine from the compiled regex (param_4) and attempts to match starting from param_1 to param_2. If no match at the start position, uses regex_skip_to_match to find possible match positions and retries. Populates match result in param_3. Returns 1 on success, 0 on failure.
0x00AF2C60148chrono__get_time_with_durationGets high-resolution time and adds a duration. Queries the high-res timer in nanoseconds, then adds the duration from param_2 (seconds * 1e9). Clamps to INT64_MAX on overflow. Returns the result time in param_1 as a 64-bit value.
0x00AF2D00183chrono__steady_clock_to_timespecConverts a steady_clock time point to a timespec structure. Gets current ticks via _Xtime_get_ticks, multiplies by 100, adds the duration from param_2. Divides by 1e9 to get seconds, remainder is nanoseconds. Handles overflow by clamping. Returns whether the time was in the future.
0x00AF2E3034find_char_in_rangeSearches for a specific character value in the range [param_1, param_2). Compares each byte against the integer value at *param_3. Returns when found or when the range is exhausted.
0x00AF2F3011call_sleep_then_exitSimple wrapper that calls sleep_then_exit_process. Used as an indirect call target for the delayed exit path.
0x00AF2FD045regex__replace_all_wrapperThin wrapper around regex__replace_all. Forwards all parameters and copies the result iterator to param_1.
0x00AF3000334regex__replace_stringHigh-level regex replace on a std::string. Takes an input string (param_2), compiles the replacement pattern (param_4 as C-string), and calls regex__replace_all to produce the result string in param_1. Handles SSO (small string optimization) for the input. Cleans up the temporary pattern string.
0x00AF3150454chrono__sleep_until_nsSleeps until the specified absolute nanosecond timestamp. Adds a duration from param_1 to the current high-res timer, then enters a polling loop: queries the performance counter, converts to nanoseconds, and if the target time hasn't been reached, converts the remaining time to a timespec and calls _Thrd_sleep. Handles the 10MHz perf counter fast path (multiply by 100).
0x00AF3320338chrono__sleep_until_ns_absSleeps until an absolute nanosecond timestamp given directly in param_1. Polling loop: queries perf counter, converts to nanoseconds (fast path for 10MHz frequency), compares against target. If not yet reached, converts remaining duration to timespec and calls _Thrd_sleep. Similar to chrono__sleep_until_ns but takes the absolute target directly.
0x00AF3560408regex__init_match_stateInitializes the regex NFA match state structure. Zeros out all tracking fields (positions, counters, flags), stores the input string pointers, the compiled regex reference, and match flags. Sets up the capture group tracking vector sized to the regex's group count. Returns the initialized state object.
0x00AF3700203regex__match_state_copy_ctorCopy constructor for the regex match state. Copies the 4-byte vector (via STL_vector_4byte__copy_ctor), then copies the 8-byte capture group vector by allocating new aligned memory and memcpy'ing the data.
0x00AF3AA080regex__match_state_dtor_innerInner destructor for regex match state. Deallocates the 4-byte element vector at param_1+4 using STL_vector_dealloc_4byte_elements.
0x00AF3AF0167regex__match_state_dtorFull destructor for a regex match state. Deallocates multiple internal vectors: 8-byte element vectors (capture groups), 4-byte element vectors (flags/counters), in sequence. Called during regex match cleanup.
0x00AF3BA099regex__partial_state_dtorPartial destructor for regex state. Deallocates an 8-byte vector and a 4-byte vector. Simpler than regex__match_state_dtor, used for partial/intermediate states.
0x00AF3EB0106regex__match_state_copy_assignCopy assignment for regex match state. Copies the first vector via STL_vector_4byte__copy_assign, then copies the 8-byte capture group vector at offset 0x14, reallocating if the capacity is too small.
0x00AF3F3018sleep_then_exit_processSleeps for a duration specified by the first dword of param_1 (via chrono__sleep_until_ns), then calls ExitProcess(1) to terminate the process. Used as a delayed forced shutdown handler.
0x00AF4050379convert_string_via_widecharConverts a string through an intermediate wide character representation. First converts the input to wstring via multibyte_to_widechar_string, then converts back to multibyte using codepage 0xFDE9 (UTF-7) via widechar_to_multibyte_string. Returns the converted std::string in param_1, or an empty string if the intermediate wstring is null.
0x00AF41D0401replace_escape_sequences_in_stringReplaces escape sequences in an STL string: \r -> CR, \n -> LF, \" -> double-quote. Searches for backslash+char pairs and replaces with single characters.
0x00AF4370427format_bytes_as_hex_stringConverts a byte array (param_2) to a hex string using sprintf "0x%02x" format. Each subsequent byte is appended with " 0x%02x" separator. Returns std::string in param_1.
0x00AF4520177copy_string_to_clipboardCopies an STL string to the Windows clipboard. Allocates global memory with GMEM_MOVEABLE\|GMEM_ZEROINIT, copies string data, then opens clipboard, empties it, sets CF_TEXT data, and closes. Returns 1 on success, 0 on failure.
0x00AF45E02066recursive_delete_directoryRecursively deletes a directory. Uses FindFirstFile/FindNextFile to enumerate entries, skipping "." and "..". Files are chmod'd to writable then unlinked. Subdirectories are recursively processed. Finally calls _rmdir on the root directory. Uses linked lists to track files and subdirs.
0x00AF4E00331format_byte_size_human_readableFormats a byte count into human-readable string with units (Bytes, KB, MB, GB, TB). Divides by 1024 repeatedly until value fits, then formats with "%.f" notation.
0x00AF4F50296generate_diamond_grid_positionsGenerates a diamond/rhombus-shaped grid of 2D positions centered on param_2 with radius param_3. For each row y in [-radius, radius], generates columns from -cols to +cols where cols = radius - abs(y). Returns vector of (x,y) float pairs.
0x00AF50801158find_files_in_directoryFinds files in a directory matching a path+wildcard pattern. param_2 is the search path, param_3 is the wildcard. Builds an STL list (param_1) of matching filenames, skipping "." and ".." entries. Uses FindFirstFile/FindNextFile Win32 API.
0x00AF55101117find_files_in_directory_to_vectorLike find_files_in_directory but returns results in a std::vector instead of std::list. Uses FindFirstFile/FindNextFile, skips "." and "..". param_1 is vector output, param_2 is path, param_3 is wildcard.
0x00AF5970306read_line_and_processReads a line from istream into a 1024-char buffer using getline, converts to std::string, then passes to processing function at 00af7680.
0x00AF5AB01568parse_numeric_string_strip_non_digitsParses a numeric string by stripping non-digit characters (commas, dots, spaces). If input is shorter than 4 chars, uses atoi directly. Otherwise filters out non-digit/non-minus chars and converts the cleaned numeric string to int via atoi. Handles up to 9 digits.
0x00AF60E086format_int64_to_bufferFormats a 64-bit integer using "%I64d" format string into a temporary buffer, then copies to output buffer (param_3) up to param_4 bytes. Returns param_3.
0x00AF614083format_int32_to_bufferFormats a 32-bit integer using a format string into a temporary buffer, then copies to output buffer (param_2) up to param_3 bytes. Returns param_2.
0x00AF61A0293generate_square_grid_positionsGenerates a square grid of 2D positions centered on param_2 with radius param_3. Creates (2*radius+1)^2 positions in a full square pattern. Returns vector of (x,y) float pairs in param_1.
0x00AF62D0213format_string_vsnprintfPrintf-style string formatter. Uses vsnprintf with a 4096-byte stack buffer to format the string, then constructs an std::string from the result. Returns the formatted string in param_1.
0x00AF63B0239format_guid_to_stringFormats a GUID structure to string. Uses format "{08X-04hX-04hX-02hhX02hhX-...}" with or without braces based on param_3 flag. param_2 points to the 16-byte GUID structure.
0x00AF64A047check_rect_overlapTests if two axis-aligned rectangles overlap. Checks all 4 boundary conditions: rect1.right > rect2.left, rect1.left < rect2.right, rect1.bottom > rect2.top, rect1.top < rect2.bottom. Returns 1 if overlapping, 0 otherwise.
0x00AF64D0171check_string_contains_korean_utf8Checks if an STL string contains Korean characters encoded in UTF-8. Scans for 3-byte UTF-8 sequences where the decoded codepoint falls in range 0xAC00-0xD7A3 (Korean Hangul syllables). Returns 1 if found, 0 otherwise.
0x00AF6580977load_lua_script_from_fileLoads and parses a Lua script file. Opens the file via CFileStream, loads with luaL_loadbuffer. If initial open fails and param_3 is true, tries replacing extension with ".lua" via regex and retries. Returns 1 on success, 0 on failure.
0x00AF69601124create_directory_recursiveCreates directories recursively for a given path. Splits the path by backslash separator, creates each intermediate directory using _mkdir if it doesn't exist (checked via _access). Returns 1 on success, 0 if any mkdir fails.
0x00AF6DD0208string_vector_to_lowercaseConverts all strings in a vector of std::strings to lowercase. Iterates each string in the vector (stride 0x18 per element), converting uppercase ASCII chars to lowercase by adding 0x20.
0x00AF6EA0616create_unique_file_pathCreates a unique file path by splitting the input path into drive/dir/name/ext components, then checking if the path exists. If it does, appends incrementing numbers until a non-existing path is found. Creates the directory structure and writes the file via ofstream.
0x00AF711091string_to_lowercaseConverts a single STL string to lowercase in-place. Iterates each character, using isupper() to check and adding 0x20 to convert uppercase ASCII to lowercase. Skips null/control characters.
0x00AF7170208string_vector_to_uppercaseConverts all strings in a vector of std::strings to uppercase. Iterates each string (stride 0x18), converting lowercase ASCII chars to uppercase by subtracting 0x20.
0x00AF7240252show_messagebox_with_background_taskShows a MessageBox while running a background task. Allocates a 4-byte context, spawns a thread via _beginthreadex, displays MessageBox(param_1=text, param_2=title), then detaches the thread. Used for non-blocking operations with user notification.
0x00AF7340262show_messagebox_with_background_task_exExtended version of show_messagebox_with_background_task. Allocates 8-byte context with two parameters, spawns thread via _beginthreadex, shows MessageBox, detaches thread. param_3 provides additional context data.
0x00AF7450346multibyte_to_widechar_stringConverts a multibyte std::string to a wide std::wstring using Win32 MultiByteToWideChar. param_2 is the code page (e.g. CP_ACP). Uses SysAllocStringLen for temporary BSTR buffer. Returns empty wstring on failure.
0x00AF75B094format_guid_to_bufferFormats a GUID structure to a char buffer (param_1) with size param_2. Uses same format as format_guid_to_string. param_4 controls whether braces are included. Calls snprintf_wrapper directly.
0x00AF7610104parse_guid_from_stringParses a GUID from a string into a 16-byte GUID structure. Uses sscanf-style parsing with format "%8X-%4hX-%4hX-%2hhX%2hhX-%2hhX%2hhX%2hhX%2hhX%2hhX%2hhX". param_4 controls whether braces are expected. Returns 1 if all 11 fields parsed, 0 otherwise.
0x00AF76801051split_string_by_whitespaceSplits an STL string by whitespace into a vector of strings. Uses iswspace() to detect separators. Handles "//" as a comment marker (stops processing). Accumulates chars into a 1024-byte buffer, pushes completed tokens to the output vector. State machine: 1=reading token, 2=skipping whitespace.
0x00AF7AA0244get_encrypted_string_by_indexReturns an encrypted/obfuscated string by index. Uses XOR decryption (xor_decrypt_buffer) with per-case keys stored in TLS. Supports indices 0-5, 7-9, 11 for predefined encrypted strings. Default case converts the index to a decimal string. Strings are lazily decrypted on first access and cached in TLS.
0x00AF82D051strrchr_implCustom strrchr implementation. Finds the last occurrence of param_2 in string param_1 by scanning forward to find the end, then scanning backward. Returns pointer to last match or NULL if not found.
0x00AF8310157parse_guid_from_std_stringParses a GUID from an STL string. Wraps parse_guid_from_string, passing the string buffer and length. param_3 controls brace expectation. On failure, returns a default GUID from a global constant.
0x00AF83B0886bytes_to_hex_stringConverts a byte buffer (param_2, length param_3) to a hex string. Uses lookup table "0123456789ABCDEF" or "0123456789abcdef" based on param_4 (uppercase flag). Each byte becomes 2 hex chars. Pre-allocates string capacity for param_3*2 chars.
0x00AF8730118format_number_with_commasFormats a number string with comma separators every 3 digits. Copies digits from param_1 to param_3, inserting commas at appropriate positions. Handles negative numbers (preserves leading minus). param_4 is the output buffer size limit.
0x00AF87B0379convert_codepage_stringConverts a string between code pages. First converts param_2 from source codepage 0xFDE9 (UTF-8) to wide string via multibyte_to_widechar_string, then converts the wide string to param_3 target code page via widechar_to_multibyte. Returns empty string on failure.
0x00AF8930447widechar_to_multibyte_stringConverts a wide string (std::wstring) to a multibyte string using Win32 WideCharToMultiByte. param_2 is the target code page. Allocates temporary buffer, converts, constructs std::string result. Returns empty string on failure.
0x00AF8C90226regex_match_single_charRegex engine: matches a single character against a character class/set. Handles case-insensitive matching, collation elements, and bitmap-based character sets. Returns 1 if matched, advances position pointer.
0x00AF8D80602regex_match_repeatRegex engine: handles repetition/quantifier matching (*, +, {n,m}). Iterates through alternatives, trying to match the repeated sub-expression. Manages backtracking state with position vectors. Handles greedy vs non-greedy modes.
0x00AF8FE0607regex_match_bounded_repeatRegex engine: handles bounded repetition matching ({n,m} quantifiers). Manages minimum count (param_2+0x14) and maximum count (param_2+0x18). param_3 controls greedy/lazy behavior. Handles group capture state for backreferences.
0x00AF9240414regex_match_alternativeRegex engine: handles alternation (\| operator) and recursive sub-expression matching. Manages capture group state, backtracking, and the regex match stack. Delegates to regex_match_bounded_repeat for counted repetition.
0x00AF93F01stub_nop_00af93f0Single-byte stub function (size=1)
0x00AF94001stub_nop_00af9400Single-byte stub function (size=1)
0x00AF94901478regex_match_nodeCore regex NFA matching engine. Processes regex nodes by type: anchors (^/$), word boundaries, character classes, any-char (.), string literals, lookahead/lookbehind, capture groups, backreferences, alternation, repetition. Walks the NFA node chain recursively. Implements complexity limits (max_calls, max_complexity).
0x00AF9BD0543regex_skip_to_matchRegex engine: scans forward through input to find positions where a regex node can potentially match. Used for optimization before full NFA match. Handles different node types: newline anchors, character classes, any-char, string sequences, alternation, repetition.
0x00AF9EC051zero_fill_8byte_elementsFills param_2 count of 8-byte elements with zeros starting at param_1. Returns pointer past the filled region. No-op if param_2 is 0.
0x00AF9F0045default_construct_12byte_elementsDefault construct 12byte elements
0x00AF9F3047move_12byte_elementsMoves/copies 12-byte elements from [param_1, param_2) to destination at param_3. Copies 8 bytes + 4 bytes per element.
0x00AF9F80100parse_hex_color_string_00af9f80Parses a hex color string (e.g. "0xFF0000") to integer. Skips "0x" prefix, then converts hex chars right-to-left. Supports 0-9, A-F, a-f. Returns the parsed integer value.
0x00AFA170717unescape_backslash_stringProcesses an STL string removing backslash escape sequences. Double backslash (\\) becomes single backslash. Other characters are copied as-is. Returns new unescaped string in param_1.
0x00AFA44043sscanf_wrapperWrapper around __stdio_common_vsscanf. Calls with the common mode flags and passes variadic args. Used for sscanf-style parsing (e.g. GUID parsing).
0x00AFA470129xml_node_ctorConstructs an XML node (0x2C bytes). Initializes type field, zeroes child/sibling/next pointers, initializes embedded SSO string (capacity 0xF), and two counter fields.
0x00AFA50084xml_node_cleanupCleans up an XML node by freeing children via xml_node_free_children, then destroying the embedded string via STL_string_dtor.
0x00AFA56043xml_node_set_childSets a child node on an XML node. If child slot (offset 0x28) is null, sets it directly. Otherwise sets the sibling (offset 0x24) of the existing child. If both occupied, calls xml_node_append_sibling to walk the chain.
0x00AFA59035xml_node_append_siblingAppends a sibling node to an XML node. Walks the sibling chain (offset 0x24) until finding the end, then links param_2 as the new last sibling.
0x00AFA5C033xml_node_destroyDestroys an XML node. Frees child nodes recursively via xml_node_free_children, then frees the node's buffer at offset 0x2C if allocated.
0x00AFA5F0184xml_node_free_childrenRecursively frees XML node children and siblings. Recursively processes sibling at offset 0x24 and child at offset 0x28, destroying string data and freeing each 0x2C-byte node.
0x00AFA6B086xml_node_find_child_by_nameFinds a child XML node by tag name. First checks the child at offset 0x28 against param_2 using strcmp. If no match, delegates to xml_node_find_sibling_by_name to search siblings.
0x00AFA71084xml_node_find_sibling_by_nameSearches sibling XML nodes (linked via offset 0x24) for one matching the given tag name. Walks the sibling chain comparing names via strcmp. Returns matching node or NULL.
0x00AFA770448xml_node_extract_text_contentExtracts text content from an XML node. Walks through the content between open and close tags, handling child element substitution, HTML entity decoding (& entities), and skipping CR/LF. Builds the text into the node's string at offset 0xC. Returns pointer to node+3 (the string field).
0x00AFA940258html_decode_entityDecodes HTML entities: &lt; -> '<', &gt; -> '>', &amp; -> '&'. Returns the decoded character as a single-char string. Returns empty string for unknown entities.
0x00AFAA5049xml_extract_tag_nameExtracts the tag name from an XML element. Scans from param_1 until whitespace, '>', '/', or end of buffer (param_2). Null-terminates at the found position and returns param_1.
0x00AFAA90610xml_parse_elementRecursive XML parser. Parses XML elements from a byte buffer. Handles opening tags (creates child nodes), closing tags (matches against current node name), processing instructions (<?), comments (<!), HTML entities (&), and self-closing tags (/). Builds an XML tree structure.
0x00AFAD00114xml_parse_documentTop-level XML document parser. Cleans up existing parse tree, allocates a copy of the input buffer (param_2 to param_3), null-terminates it, sets up parse range, then calls xml_parse_element to build the DOM. Returns true if root has a child node.
0x00AFAD80376xml_parse_single_elementParses a single XML element from buffer. Handles processing instructions (<?), comments (<!), regular elements (creates node, extracts tag name, adds to parent's child list). For non-self-closing tags, recursively calls xml_parse_element for content.
0x00AFC8B0238CTextLog__add_lineAdds a text line to CTextLog. Constructs a CTextLineObj (0x30 bytes) from two strings and pushes it to the vector at offset 0x7C. If vector is full, calls emplace_grow.
0x00AFD1D098show_formatted_messageboxShows a formatted MessageBox. Formats the message using vsnprintf into a 500-byte buffer, then calls MessageBoxA with param_2 as the title and the formatted string as text.
0x00AFE4B0800CLua__register_global_functionsRegisters global Lua callback functions with the Lua state. Registers handlers for: TraceValue, SetSubChatWndList, SetSubChatWndOption, c_SetCmdOnOffList, c_GetCmdOnOffValue, c_AddSkillList, c_AddNeedSkillList, c_ChangeDirectoryOfDatas, SetEmitterInfo, SetMagicFloorInfo, SetEvilsPawInfo, SetOtherEffectInfo, SetAnimatedEmitterInfo, SetEZ2STRInfo, SetWindEffectInfo, AddEntryQueue, add_ingredient, add_ingredient_lapine_upgrade_box, add_cashshop_banner/banner2, add_checkAttendance_banner, plus skill flags SKFLAG_NOREDUCT and SKFLAG_DISABLE_FIXEDCASTING_REDU.
0x00AFEC5044copy_8byte_elements_forwardCopy 8byte elements forward
0x00AFEC8045move_8byte_elements_by_offsetMoves 8-byte elements from [param_1, param_2) to destination at param_3 using an offset calculation. Each element is 2x4 bytes. Computes the offset between source start and destination, then copies element-by-element using that offset.
0x00B00130540unordered_map__insert_or_assignInserts a key-value pair into an unordered_map (hash map). First tries to find the key via _Find_last. If found, returns the existing iterator. Otherwise allocates a new 0x24-byte node, copies the key and value string, inserts into the hash bucket chain. Handles rehashing if the load factor exceeds the threshold. Returns the iterator and a bool indicating insertion.
0x00B0035015CMessageStringTable__get_string_by_idReturns a message string pointer by ID from the global string table array PTR_s_MSI_DO_YOU_AGREE_0115aa88. Simple array index lookup. IDs start at MSI_DO_YOU_AGREE.
0x00B003D097CMessageStringTable__find_id_by_nameLooks up a message string ID by its name string. Iterates through the global string table (up to 0x125A entries), doing strcmp on each entry. Returns the matching index, or 0x125A if not found.
0x00B0044031fill_4byte_rangeFill 4byte range, small utility function
0x00B004B0102unordered_map__dtorDestructor for an unordered_map. Deallocates the bucket array via FUN_00b00520, then clears the linked list of nodes via linked_list_0x24__clear_all and frees the sentinel node.
0x00B005B0116hash_node_0x24__dtorDestructor for a single 0x24-byte hash node. If the node at param_1+4 is not null, destroys its string member via STL_string_dtor, then frees the 0x24-byte node.
0x00B0068068hash_node_string__dtor_wrapperWrapper that destroys a string member in a hash node. Simply calls STL_string_dtor on the param.
0x00B006D075unordered_map__clearClears an unordered_map. If the map is not empty (element count != 0), clears all linked list nodes, resets the sentinel to point to itself, sets count to 0, and fills all bucket pointers with the sentinel address.
0x00B0072090global_message_string_map__clearClears the global message string hash map at DAT_016d5784. If element count (DAT_016d5788) is not 0, clears all nodes, resets sentinel, sets count to 0, and fills bucket array with sentinel pointer.
0x00B00780133CMessageStringTable__find_id_by_std_stringSame as CMessageStringTable__find_id_by_name but takes a std::string (handles SSO: if capacity > 0xF, dereferences the heap pointer). Returns 0x125A if the string is empty or null. Otherwise does linear search through the global string table.
0x00B00810117CMessageStringTable__find_id_by_cstrSame as CMessageStringTable__find_id_by_name but with null/empty string checks. Returns 0x125A if param_1 is null or empty string. Otherwise linear search through the table.
0x00B00890114CMessageStringTable__decode_stringDecodes/decrypts a message string in-place. If DAT_016d3b10 is set, returns immediately (already decoded). For each character: applies a transformation involving subtraction from 0xDB (-0x25), special handling for certain ranges (letters get shifted, hex digits get shifted). This is a simple substitution cipher for the message string table.
0x00B00910181CMessageStringTable__register_custom_entryRegisters a custom message string entry into the hash map. Takes a vector of strings (at least 2 elements): element[0] is the message ID name (looked up in the global string table), and the last element is the replacement text. If the ID is found (< 0x125A), inserts the (id, text) pair into the unordered_map.
0x00B009D01126CMessageStringTable__process_csv_rowsProcesses CSV rows for message string table loading. For each 0x18-byte row entry in param_2, copies the string and applies character replacements (replacing specific escape sequences like tab, newline, backslash etc. via CFmt__func_0058ac60). If the string is empty, inserts "NO MSG" as placeholder. Appends processed strings to the output vector param_1.
0x00B00E40115CMessageStringTable__reloadReloads the message string table. Clears the global hash map (DAT_016d5784), then parses msgstringtable.csv using CSVParser with CMessageStringTable__process_csv_rows as the row processor and CMessageStringTable__register_custom_entry as the entry callback.
0x00B00EC047CMessageStringTable__is_restricted_msg_idChecks if a message ID is restricted/special. When DAT_016d3b10 is 0 (undecoded state), returns 1 for specific IDs: 0x2C8C7D through 0x2C8C82 (with gap at 0x2C8C81). These are likely protected/system message IDs that should not be modified.
0x00B00F00682CMessageStringTable__get_message_textGets the display text for a message ID. If ID > 0x1259, returns "NO_MSG %d". Looks up the ID in the hash map. If found and starting with '/', returns the raw string. Otherwise, if DAT_016d3b08 is set, applies charset encoding (prefixing with hex charset ID) and caches in a global 0x125A-element string array (lazily initialized via atexit). Returns the processed string pointer.
0x00B011B066CMessageStringTable__get_raw_textGets the raw (unprocessed) text for a message ID from the hash map. Looks up the ID, returns the string at offset 0xC in the node. Returns "empty" string if not found or if the node equals the sentinel.
0x00B012002383CMessageStringTable__load_and_processComplex message string table loading function. Loads message strings from the CSV, processes them with charset encoding and replacement rules, and populates the global string table arrays and hash map.
0x00B01C40362unordered_map__rehashRehashes an unordered_map to the specified bucket count. Rounds up to the next power of 2. Resizes the bucket array, then reinserts all elements by walking the linked list and re-computing bucket indices. Handles node relinking when elements move between or within buckets.
0x00B0226048CJobNameTable__init_from_static_dataInitializes a job name lookup table from static data at DAT_00b02294. Inserts 0x6D0 (1744) entries into a 0x20-byte RB-tree, each with a 4-field structure (key + 8-byte value + 4-byte value). This maps job IDs to their properties.
0x00B033B51stub_nop_00b033b5Single-byte stub function (size=1)
0x00B034361stub_nop_00b03436Single-byte stub function (size=1)
0x00B0595C1stub_nop_00b0595cSingle-byte stub function (size=1)
0x00B07CDF1stub_nop_00b07cdfSingle-byte stub function (size=1)
0x00B0846C1stub_nop_00b0846cSingle-byte stub function (size=1)
0x00B08AD01stub_nop_00b08ad0Single-byte stub function (size=1)
0x00B09E50119CJobNameTable__lookup_job_infoLooks up job info from the 0x20-byte RB-tree by job ID. Returns a result pair: if found and value at offset 0x14 is -1, returns (0, value_at_0x18). If value >= 0, returns (1, value). If not found, returns (-1, 4).
0x00B0BE20134crypto__galois_field_mix_columnPerforms a Galois field column mixing operation for block cipher (likely AES MixColumns or similar). Applies GF(2^8) addition and multiplication operations on 4-byte column data. Uses crypto_gf_add and crypto_gf_add_one helper functions.
0x00B0BEB0742crypto_sbox_cipher_roundCustom S-box based block cipher round function. Operates on 16-uint state (param_2), applying S-box lookups from DAT_0134d4b0, XOR operations, and bit rotations controlled by values at DAT_01353a58. Result XORed with original data written to param_1 (4 uints).
0x00B0C1A0245crypto_sbox_cipher_variantVariant S-box cipher. Copies 16 uints from param_2 to local state, applies nested S-box lookups from DAT_0134d0b0 with rotation schedule from DAT_01353a48. Iterates 8 rounds. Final output XORed with original input into param_1.
0x00B0C2A0248crypto_hash_finalizeHash finalization/padding function. Packs remaining bytes into 16-uint block, adds padding bit, appends 64-bit message length, then calls FUN_00b0de90 (RIPEMD-160 compress) for final processing. Standard Merkle-Damgard padding.
0x00B0C3A035crypto_hash_init_ivInitializes hash state with IV constants: 0x66452a01, 0xebcdab79, 0x98badafe, 0x10365476. These are modified MD5-like initial values used by the custom hash algorithm.
0x00B0C3D044crypto_get_uint32Simple getter that reads and returns a uint32 value from the pointer param_1.
0x00B0C40052crypto_byte_swap_64bitByte-swap/endian conversion for a 64-bit value stored as 2 uints. Interleaves bytes from param_1[0] and param_1[1] to produce a big-endian uint result.
0x00B0C44083crypto_gf_lookup_initInitializes Galois field lookup table at DAT_016f6f08 (256 entries). Table maps byte values using GF(256) arithmetic with stride 4. Lazy initialization (DAT_01353a68 flag). Returns table lookup for input byte.
0x00B0C4A023crypto_gf_addGF(256) addition helper. Adds two bytes and performs lookup via crypto_gf_lookup_init.
0x00B0C4C025crypto_gf_add_oneGF(256) addition with offset. Adds 1 to param_1, adds param_2, then performs GF lookup via crypto_gf_lookup_init.
0x00B0C4E0438crypto_block_decrypt_8byte8-byte block cipher decryption. Uses S-box tables at DAT_016f6d08 and DAT_016f6e08 for substitution and XOR operations. Iterates through key schedule rounds in reverse (param_2 contains round count and subkeys). Output to param_3.
0x00B0C6A0420crypto_block_encrypt_8byte8-byte block cipher encryption. Forward direction of the block cipher. Uses S-box tables at DAT_016f6d08 and DAT_016f6e08. Iterates through key schedule rounds forward. Output bytes mixed via add/xor operations.
0x00B0C8501276crypto_block_key_scheduleGenerates key schedule for the 8-byte block cipher. Takes 8-byte key (param_1), 8-byte IV (param_2), round count (param_3), mode flag (param_4). Rotates key/IV bytes by 3/2 bits per round, mixes with S-box table DAT_016f6d08. Output schedule to param_5.
0x00B0DE903041ripemd160_compressRIPEMD-160 compression function. Processes 16-word message block (param_2) into 4-word state (param_1). Uses constants 0x5a827999, 0x6ed9eba1, 0x8f1bbcdc, 0x50a28be6, 0x5c4dd124, 0x6d703ef3. Five rounds of 16 operations each with different boolean functions.
0x00B12FC01235crypto_feistel_network_recursiveRecursive Feistel network implementation. Base case (param_3==2) applies 4 S-box lookups. Recursive case splits data in half, applies XOR mixing with S-box output at each level. Uses SIMD-style 64-byte block XOR for large inputs. Part of a larger stream cipher.
0x00B149E01109crypto_format_preserving_decryptFormat-preserving decryption using recursive Feistel network. Splits data in half, applies 4 rounds of crypto_feistel_network_recursive with different subkey indices (from param_2). XOR mixing between halves in each round. Returns 0 on success, -1 on null input.
0x00B14E401013crypto_format_preserving_encryptFormat-preserving encryption using recursive Feistel network. Splits data in half, applies 4 rounds of crypto_feistel_network_recursive with subkey indices (0, param_2[2], param_2[3], param_2[4]). XOR mixing between halves. Returns 0 on success, -1 on null input.
0x00B15240627crypto_permutation_table_initInitializes permutation table for format-preserving cipher. Creates param_4^2 permutation tables (256 bytes each) at param_3+0x14. Uses RC4-variant key schedule for initial permutation, then shuffles using PRNG bytes. Stores dimensions and subkey indices in param_3 header.
0x00B15510177crypto_singleton_initSingleton initialization for crypto module. Allocates 16-byte control block at DAT_016f7114 with first byte = 1 (enabled). Thread-safe with SEH. Returns 1 if crypto available, 0 otherwise.
0x00B155D031crypto_singleton_destroyDestroys crypto singleton. Frees 16-byte control block at DAT_016f7114 and sets pointer to null.
0x00B1567022crypto_check_availableChecks if crypto module is available. Sets *param_1 to 1 if crypto_singleton_init succeeds, 0 otherwise. Returns param_1.
0x00B1569054crypto_shutdown_wrapperSEH-wrapped crypto shutdown. Calls crypto_singleton_destroy with structured exception handling.
0x00B156E0179crypto_singleton_init_secondarySecondary crypto singleton initialization at DAT_016f7118. Allocates 1-byte flag, calls crypto_singleton_init to verify availability. If available, sets flag=1. On failure, destroys primary singleton and frees secondary. Returns 1 on success, 0 on failure.
0x00B157B039crypto_singleton_destroy_secondaryDestroys secondary crypto singleton. Calls crypto_singleton_destroy, frees 1-byte flag at DAT_016f7118, sets pointer to null.
0x00B16270704rbtree_erase_and_rebalance_00b16270Red-black tree node erasure with rebalancing. Handles node removal, successor substitution, and red-black tree property restoration via rotations and recoloring. Standard RB-tree delete fixup algorithm. Updates min/max pointers. Decrements count.
0x00B1674084rbtree_rotate_left_00b16740Red-black tree left rotation around param_2 node. Standard left rotation: right child becomes parent, adjusts pointers and parent links.
0x00B167A088rbtree_rotate_right_00b167a0Red-black tree right rotation around param_2 node. Standard right rotation: left child becomes parent, adjusts pointers and parent links.
0x00B175B0617CPartyAlarmMgr__process_party_member_updateProcesses a party member update for the party alarm system. Takes 12 parameters describing the party member state. If warp select window (0xA9) exists, checks map filter and either directly processes the alarm or adds a crypto service entry. If no warp window, checks filter criteria (base level range, job class, specific skill). On match, plays party_alarm.wav and displays a yellow chat message (MSI 0x6D9).
0x00B17820886CPartyAlarmMgr__notify_party_alarmProcesses party alarm notifications for multiple party members. Iterates param_3 members from param_2 array (each 12 ints = 48 bytes). For each member: builds service entry via CryptoManager__add_service_entry, inserts into CryptoMap at +0x1C. Stores last member ID at +0x30. If param_4 is 0, calls CryptoManager__process_pending_entries after each. If param_4 is 1, adds a sentinel entry (member ID + 1, flag=1) at the end to mark completion.
0x00B17CA01381CPartyAlarmMgr__load_map_filter_from_luaLoads party alarm map filter data from Lua. Calls lua_check_global_is_table("map_list"), then iterates regions via queryRegionInfo (collecting region names into vectors). For each region, queries queryMapInfo to get individual map entries (name + coordinates). Builds a vector of map entries and inserts into the party alarm manager's sorted tree at offset +0x14. Used to populate the map-based filtering for party alarm notifications.
0x00B18230503CPartyAlarmMgr__process_pending_alarmsProcesses pending party alarm entries from the queue, applying filters and dispatching notifications.
0x00B18460452CPartyAlarmMgr__vector_insertstd::vector insert/push_back for CPartyAlarmMgr. Grows the vector buffer (1.5x strategy), copies elements before and after the insertion point, places the new element. SEH-protected with old buffer cleanup.
0x00B18630103tree_0x18_delete_subtreeRecursively deletes a subtree of 0x18-byte tree nodes. Walks linked list, recursively deletes right children, frees each node. Stops at sentinel (byte 0xD=1). SEH-wrapped.
0x00B187F075tree_0x18_lower_boundPerforms lower_bound search on 0x18-byte node tree. Traverses comparing keys at node+0x10. Returns iterator (node, found flag, parent) in param_2. Same algorithm as CryptoMap__lower_bound.
0x00B1ACA0272CEffMgr__ctorCEffMgr (Effect Manager) constructor. Sets vtable to CEffMgr vtable (011829d0). Allocates 4 std::map/set sentinel nodes (sizes 0x18, 0x1C, 0x0C, 0x20) for effect tracking containers. Calls EffectManager__main_dispatch_handler to check availability and sets enabled flag at offset +4.
0x00B1D68095CEffGroundGrow__dtor_chainCEffGroundGrow destructor chain. Sets vtable PTR_LAB_011829d8, calls CEffGroundGrow__dtor, then FUN_00b4dd10 for base cleanup.
0x00B1DAD0120create_CEffectMachineFactory function: allocates 0xd8 bytes via operator_new(nothrow), calls CEffectMachine__ctor to construct. Returns new object or 0 on allocation failure.
0x00B1DB50120create_CEffectAcidifiedZoneFactory function: allocates 0xf0 bytes, calls CEffectAcidifiedZone__ctor. Returns new object or 0.
0x00B1DBD0120create_CEffectParticleFactory function: allocates 0x1a4 bytes, calls CEffectParticle__update (likely misnamed ctor). Returns new object or 0.
0x00B1DC50120create_CEffectAstralStrikeFactory function: allocates 0xe4 bytes, calls CEffectAstralStrike__ctor. Returns new object or 0.
0x00B1DCD0120create_CEffectProjectileFactory function: allocates 0xf4 bytes, calls CEffectProjectile__ctor. Returns new object or 0.
0x00B1DD50120create_CEffectAuraFactory function: allocates 0xd8 bytes, calls CEffectAura__ctor. Returns new object or 0.
0x00B1DDD0120create_CEffectTimedSpriteFactory function: allocates 0xe8 bytes, calls CEffectTimedSprite__ctor. Returns new object or 0.
0x00B1DE50120create_CEffectGroundFactory function: allocates 0xe8 bytes, calls CEffectGround__ctor. Returns new object or 0.
0x00B1DED0120create_CEffectBeamFactory function: allocates 0x100 bytes, calls CEffectBeam__scalar_dtor (likely misnamed ctor). Returns new object or 0.
0x00B1DF50120create_CEffectAuraFieldFactory function: allocates 0xdc bytes, calls CEffectAuraField__ctor. Returns new object or 0 on allocation failure.
0x00B1DFD0120create_CEffDragonKnightFactory function: allocates 0xcc bytes, calls CEffDragonKnight__ctor. Returns new object or 0.
0x00B1E050120create_CEffDragonKnightChargeFactory function: allocates 0x194 bytes, calls CEffDragonKnightCharge__ctor. Returns new object or 0 on allocation failure.
0x00B1E0D0120create_CEffDragonKnightHitFactory function: allocates 0xd4 bytes, calls CEffDragonKnightHit__ctor. Returns new object or 0 on allocation failure.
0x00B1E150120create_CEffectAuraCherryBlossomFactory function: allocates 0x198 bytes, calls CEffectAuraCherryBlossom__ctor. Returns new object or 0 on allocation failure.
0x00B1E1D0177create_CUIWorldMapFactory function: allocates 0xf8 bytes, memsets to 0, calls CUIWorldMap__ctor, sets vtable PTR_LAB_01182c08, and zeroes fields at offsets 0x3a and 0x3b. Returns new object or 0.
0x00B1E290120create_CEffHyperNovice_spellFactory function: allocates 0xd4 bytes, calls CEffHyperNovice__dtor_spell (likely misnamed ctor). Returns new object or 0.
0x00B1E310120create_CEffectOrbitFactory function: allocates 300 (0x12c) bytes, calls CEffectOrbit__ctor_006fb9a0 to construct a CEffectOrbit object. Returns new object or 0 on allocation failure.
0x00B1E390120create_CEffectCameraFactory function: allocates 0xe8 bytes, calls CEffectCamera__dtor (likely misnamed ctor). Returns new object or 0.
0x00B1E410120create_CEffectParticle_smallFactory function: allocates 0xd8 bytes, calls CEffectParticle__ctor_006fd760 to construct a smaller CEffectParticle variant (0xd8 vs 0x1a4). Returns new object or 0 on allocation failure.
0x00B1E490120create_CEffCompetentiaFactory function: allocates 0xd8 bytes, calls CEffCompetentia__ctor. Returns new object or 0.
0x00B1E510120create_CEffectPocketFactory function: allocates 0xd0 bytes, calls CEffectPocket__ctor. Returns new object or 0.
0x00B1E590120create_CEffectArrowProjectileFactory function: allocates 0xd0 bytes, calls CEffectArrowProjectile__ctor. Returns new object or 0.
0x00B1E610120create_CEffectCurseCubeFactory function: allocates 0xe8 bytes, calls CEffectCurseCube__ctor. Returns new object or 0.
0x00B1E690120create_CEffectNipelheimFactory function: allocates 0xdc bytes, calls CEffectNipelheim__render_particle (likely misnamed ctor). Returns new object or 0.
0x00B1E710120create_CEffectDancingKnifeFactory function: allocates 0xe8 bytes, calls CEffectDancingKnife__scalar_deleting_dtor (likely misnamed ctor). Returns new object or 0.
0x00B1E790120create_CEffectNameplateFactory function: allocates 0x108 bytes, calls CEffectNameplate__ctor. Returns new object or 0 on allocation failure.
0x00B1E810120create_CEffNavMapEffFactory function: allocates 0xdc bytes, calls CEffNavMapEff__ctor. Returns new object or 0 on allocation failure.
0x00B1E890120create_CEffectParticleEmitterFactory function: allocates 0x18c bytes, calls CEffectParticleEmitter__ctor. Returns new object or 0 on allocation failure.
0x00B1E910120create_CEffectOrbit_variantFactory function: allocates 0xe0 bytes, calls CEffectOrbit__ctor_00b50d10 (smaller variant, 0xe0 vs 0x12c). Returns new object or 0 on allocation failure.
0x00B1E990120create_CEffectEternalSlashFactory function: allocates 0xd8 bytes, calls CEffectEternalSlash__clear_particles (likely misnamed ctor). Returns new object or 0.
0x00B1EA10120create_CEffectEternalSlashCountFactory function: allocates 0xd0 bytes, calls CEffectEternalSlashCount__ctor. Returns new object or 0.
0x00B1EA90120create_CEffEvilLandFactory function: allocates 0xd8 bytes, calls CEffEvilLand__ctor. Returns new object or 0.
0x00B1EB10120create_CEffEZ2StrDataFactory function: allocates 0x100 bytes, calls CEffEZ2StrData__ctor. Returns new object or 0.
0x00B1EB90120create_CEffectEternalSlashCount_variantFactory function: allocates 0xdc bytes, calls CEffectEternalSlashCount__check_and_clear_render (likely misnamed ctor). Returns new object or 0.
0x00B1EC10120create_CEffectFloralFlareroadFactory function: allocates 0xdc bytes, calls CEffectFloralFlareroad__check_and_clear_render (likely misnamed ctor). Returns new object or 0.
0x00B1EC90120create_CFootprintPngFactory function: allocates 0x128 bytes, calls CFootprintPng__ctor. Returns new object or 0 on allocation failure.
0x00B1ED10120create_CFootprintStrFactory function: allocates 0x178 bytes, calls CFootprintStr__ctor. Returns new object or 0.
0x00B1ED90120create_CEffRingBlueFactory function: allocates 0xf0 bytes, calls CEffRingBlue__ctor. Returns new object or 0.
0x00B1EE10120create_CFootprintMgrFactory function: allocates 0xf0 bytes, calls CFootprintMgr__ctor. Returns new object or 0.
0x00B1EE90120create_CShadowDecalFactory function: allocates 0xdc bytes, calls CShadowDecal__ctor. Returns new object or 0.
0x00B1EF10120create_CEffShinkiroFactory function: allocates 0xe4 bytes, calls CEffShinkiro__dtor (likely misnamed ctor). Returns new object or 0.
0x00B1EF90120create_CGaleStormFactory function: allocates 0xe0 bytes, calls CGaleStorm__ctor. Returns new object or 0.
0x00B1F010173create_CEffectAura_negativeFactory function: allocates 0xd8 bytes, calls CEffectAura__ctor_00b4dae0 with id=-1, sets own vtable PTR_LAB_01182a64, initializes fields (offset 0x35 = -20.0f). Returns new CEffectAura subclass or 0.
0x00B1F0C0120create_CProjectileFactory function: allocates 0x138 bytes, calls CProjectile__ctor. Returns new object or 0.
0x00B1F140120create_CEffectBeamRingFactory function: allocates 0x12c bytes, calls CEffectBeamRing__ctor. Returns new object or 0 on allocation failure.
0x00B1F1C0120create_CWavEffectFactory function: allocates 0x11c bytes, calls CWavEffect__ctor. Returns new object or 0.
0x00B1F240120create_CEffectThunderPlasmaFactory function: allocates 0xf0 bytes, calls CEffectThunderPlasma__ctor. Returns new object or 0.
0x00B1F2C0120create_CEffHyperNovice_extendedFactory function: allocates 0xec bytes, calls CEffHyperNovice__ctor_extended. Returns new object or 0.
0x00B1F340120create_CEffectAuraBeamFactory function: allocates 0xfc bytes, calls CEffectAuraBeam__ctor. Returns new object or 0 on allocation failure.
0x00B1F3C0120create_CEffectAuraRingFactory function: allocates 0xd8 bytes, calls CEffectAuraRing__ctor. Returns new object or 0 on allocation failure.
0x00B1F440120create_CEffectSparkleFactory function: allocates 0xfc bytes, calls CEffectSparkle__ctor. Returns new object or 0 on allocation failure.
0x00B1F4C0120create_CEffectBeamRing2Factory function: allocates 0x198 bytes, calls CEffectBeamRing2__ctor. Returns new object or 0 on allocation failure.
0x00B1F540120create_CEffectBeamRing3Factory function: allocates 0x198 bytes, calls CEffectBeamRing3__ctor. Returns new object or 0 on allocation failure.
0x00B1F5C0120create_CEffectThunderFactory function: allocates 0xe4 bytes, calls CEffectThunder__ctor. Returns new object or 0 on allocation failure.
0x00B1F640120create_CEffectAuraTrailFactory function: allocates 0x114 bytes, calls CEffectAuraTrail__ctor. Returns new object or 0 on allocation failure.
0x00B1F6C0120create_CEffectAura_variantFactory function: allocates 0x104 bytes, calls CEffectAura__variant_ctor. Returns new object or 0 on allocation failure.
0x00B1F740197create_CEffectAura_grid_variantFactory function: allocates 0xe0 bytes, calls CEffectAura__ctor_00b4dae0 with id=-1, sets vtable PTR_LAB_011829d8, initializes fields (offset 0x36 = 12 for grid height). Returns new CEffectAura subclass or 0.
0x00B1F810120create_CEffectCloudKillFactory function: allocates 0xfc bytes, calls CEffectCloudKill__clear_particles (likely misnamed ctor). Returns new object or 0.
0x00B1F890120create_CEffNyangGrassFactory function: allocates 0xdc bytes, calls CEffNyangGrass__ctor_with_grid. Returns new object or 0.
0x00B1F910120create_CEffectPetitioFactory function: allocates 0xd8 bytes, calls CEffectPetitio__check_and_clear_render (likely misnamed ctor). Returns new object or 0.
0x00B1F990120create_CEffectPneumaticusProcellaFactory function: allocates 0xdc bytes, calls CEffectPneumaticusProcella__ctor. Returns new object or 0.
0x00B1FA10120create_CEffGroundGrowFactory function: allocates 0xe8 bytes, calls CEffGroundGrow__ctor. Returns new object or 0.
0x00B1FA90120create_CEffectSecondFalthFactory function: allocates 0xd4 bytes, calls CEffectSecondFalth__ctor. Returns new object or 0.
0x00B1FB10120create_CEffectSpiralStrikeFactory function: allocates 0xf0 bytes, calls CEffectSpiralStrike__ctor. Returns new object or 0.
0x00B1FB90120create_CEffectCresciveBoltFactory function: allocates 0xf4 bytes, calls CEffectCresciveBolt__ctor. Returns new object or 0.
0x00B1FC10120create_CEffectRichsCoinFactory function: allocates 0xe8 bytes, calls CEffectRichsCoin__ctor. Returns new object or 0.
0x00B1FC90120create_CEffectMobProjectileFactory function: allocates 0xd8 bytes, calls CEffectMobProjectile__ctor. Returns new object or 0.
0x00B1FD10120create_CEffectSpiralOrbFactory function: allocates 0xe0 bytes, calls CEffectSpiralOrb__ctor. Returns new object or 0.
0x00B1FD90120create_CEffectTornadoFactory function: allocates 0x104 bytes, calls CEffectTornado__ctor. Returns new object or 0.
0x00B1FE10120create_CEffectSavageImpactFactory function: allocates 0xdc bytes, calls CEffectSavageImpact__ctor. Returns new object or 0.
0x00B1FE90120create_CEffectNyangGrassFactory function: allocates 0xd8 bytes, calls CEffectNyangGrass__ctor. Returns new object or 0.
0x00B1FF10120create_CEffectServantWeaponFactory function: allocates 0x144 bytes, calls CEffectServantWeapon ctor (misnamed as __dtor in callee) to construct the large CEffectServantWeapon variant. Returns new object or 0 on allocation failure.
0x00B1FF90120create_CEffectServantWeapon_smallFactory function: allocates 0xdc bytes, calls CEffectServantWeapon__ctor to construct the small CEffectServantWeapon variant (0xdc vs 0x144 for the large variant). Returns new object or 0 on allocation failure.
0x00B20010120create_CEffectGroundSkillFactory function: allocates 0xd8 bytes, calls CEffectGroundSkill__render (likely misnamed ctor). Returns new object or 0.
0x00B20090120create_CEffectShadowExceedFactory function: allocates 0xdc bytes, calls CEffectShadowExceed__render (likely misnamed ctor). Returns new object or 0.
0x00B20110240create_CEffectAuraDualListFactory function: allocates 0xe0 bytes, calls CEffectAura base ctor with type 0x9a3, sets vtable 01182af0, initializes two linked list sentinels at offsets 0x34 and 0x36. Returns new object or 0.
0x00B20200120create_CEffectSoulCollectFactory function: allocates 0xD4 bytes, calls CEffectSoulCollect__ctor_00729400 to construct a CEffectSoulCollect object. Returns new object or 0 on allocation failure.
0x00B20280120create_CEffectGroundHitFactory function: allocates 0xDC bytes, calls CEffectGroundHit__ctor. Returns new object or 0.
0x00B20300120create_CEffectSoulCollect_linked_listFactory function: allocates 0xD4 bytes, calls CEffectSoulCollect__ctor_linked_list to construct a CEffectSoulCollect variant with linked list initialization. Returns new object or 0 on allocation failure.
0x00B20380120create_CEffectStarEmperorBoomFactory function: allocates 0xD4 bytes, calls CEffectStarEmperorBoom__ctor to construct a CEffectStarEmperorBoom object. Returns new object or 0 on allocation failure.
0x00B20400279create_CEffectAuraScaledFactory function: allocates 0x100 bytes, calls CEffectAura base ctor with type 0x964, sets vtable 01182b7c, initializes 14 fields including scale=1.0f at offset 0x3b and mode=0x100 at offset 0x3f. Returns new object or 0.
0x00B20520120create_CEffectSoulStrikeFactory function: allocates 0xD8 bytes, calls CEffectSoulStrike__ctor. Returns new object or 0.
0x00B205A0120create_CEffectSkillAuraFactory function: allocates 0xD8 bytes, calls CEffectSkillAura__ctor to construct a CEffectSkillAura object. Returns new object or 0 on allocation failure.
0x00B20620120create_CEffectRingBlueSmallFactory function: allocates 0xE0 bytes, calls CEffectRingBlueSmall__ctor. Returns new object or 0.
0x00B206A0120create_CEffectStarEmperorBookFactory function: allocates 0xE4 bytes, calls CEffectStarEmperorBook__ctor to construct a CEffectStarEmperorBook object (note: Book, not Boom). Returns new object or 0 on allocation failure.
0x00B20720120create_CEffectDirectionalProjectileFactory function: allocates 0xD8 bytes, calls CEffectDirectionalProjectile__ctor to construct a CEffectDirectionalProjectile object. Returns new object or 0 on allocation failure.
0x00B207A0120create_CEffectStormCannonFactory function: allocates 0x100 bytes, calls CEffectStormCannon__ctor_0072cdc0 to construct a CEffectStormCannon object. Returns new object or 0 on allocation failure.
0x00B20820120create_CEffectSkillAuraLargeFactory function: allocates 0xFC bytes, calls CEffectSkillAura__ctor_00b7b340 (larger variant). Returns new object or 0.
0x00B208A0120create_CEffectTetraVortexFactory function: allocates 0xD4 bytes, calls CEffectTetraVortex__ctor to construct a CEffectTetraVortex object (first/base variant). Returns new object or 0 on allocation failure.
0x00B20920120create_CEffectSingleProjectileFactory function: allocates 0xD0 bytes, calls CEffectSingleProjectile__ctor to construct a CEffectSingleProjectile object. Returns new object or 0 on allocation failure.
0x00B209A0120create_CEffectTetraVortexBFactory function: allocates 0xD8 bytes, calls CEffectTetraVortexB__ctor to construct a CEffectTetraVortexB object (second variant). Returns new object or 0 on allocation failure.
0x00B20A20120create_CEffectTetraVortexCFactory function: allocates 0xE0 bytes, calls CEffectTetraVortexC__ctor to construct a CEffectTetraVortexC object (third variant). Returns new object or 0 on allocation failure.
0x00B20AA0120create_CEffectOrbit_00b20aa0Factory function: allocates 0x104 bytes, calls CEffectOrbit__ctor. Returns new object or 0.
0x00B20B20334create_CEffectWithXorDecryptedNameFactory function: allocates 0xFC bytes, XOR-decrypts a string (key 0x118d157f/0x2f8b0f37, 0x44 bytes) from effect factory table, builds std::string, then constructs CDerivedExceptionA with that name. Returns new object or 0.
0x00B20C70120create_CTriangleShotEffectFactory function: allocates 0x100 bytes, calls CTriangleShotEffect__ctor. Returns new object or 0.
0x00B20CF0120create_CEffectGroundAuraFactory function: allocates 0xD8 bytes, calls CEffectGroundAura__ctor to construct a CEffectGroundAura object. Returns new object or 0 on allocation failure.
0x00B20D70120CProjectileEffect__createFactory function: allocates 0xD8 bytes, calls CProjectileEffect__constructor to construct a projectile effect. Returns new object or 0 on allocation failure.
0x00B20DF0120create_CEffectWarningPlaneFactory function: allocates 0xE0 bytes, calls CEffectWarningPlane__ctor to construct a CEffectWarningPlane object. Returns new object or 0 on allocation failure.
0x00B20E70504CDerivedExceptionB__create_with_tls_xor_decryptFactory: allocates 0xFC bytes. Uses TLS to access thread-local encrypted data (0x3B bytes at TLS offset 0xb2b4). On first access, copies encrypted data from global DAT_01183300/01183320/01183330 and registers atexit cleanup. Decrypts with XOR keys 0xdeb998f/0x39ff7fb5, builds std::string, constructs CDerivedExceptionB.
0x00B210F0120CUINavigator__createFactory function: allocates 0x110 bytes, calls CUINavigator__ctor to construct a UI navigator. Returns new object or 0 on allocation failure.
0x00B23DD093CUIWorldMap__scalar_deleting_dtorScalar deleting destructor for CUIWorldMap. Calls CUIWorldMap__dtor, then conditionally frees 0xF8 bytes. param_2 bit 0 = free memory.
0x00B23E30262CEffMgr__scalar_deleting_dtorScalar deleting destructor for CEffMgr. Sets vtable PTR_011829d0, calls CEffectMgr__destroy_and_clear_all for cleanup, then destroys two RB-trees (0x20-byte and 0x1C-byte nodes) at offsets +0x18 and +0x20, traverses and frees linked lists at offsets +0x24/+0x30 (0xC-byte nodes each), calls CEffectManager__clear_rb_tree_and_free_nodes for base cleanup. Conditionally frees 0x28 bytes if param_2 bit 0 is set.
0x00B23F4099CEffBase__scalar_deleting_dtorScalar deleting destructor for an effect base class. Sets vtable PTR_LAB_01182a64, calls FUN_00b4dd10 for base cleanup. Conditionally frees 0xD8 bytes. param_2 bit 0 = free memory.
0x00B23FB0119CEffGroundGrow__scalar_deleting_dtorScalar deleting destructor for CEffGroundGrow. Sets vtable PTR_LAB_011829d8, calls CEffGroundGrow__dtor and FUN_00b4dd10 for base cleanup. Conditionally frees 0xE0 bytes.
0x00B24030234CEffListContainer__scalar_deleting_dtorScalar deleting destructor for an effect class with two linked lists. Sets vtable PTR_LAB_01182af0, traverses and frees linked lists at offsets +0xD8 and +0xD0 (0xC byte nodes each). Calls FUN_00b4dd10 for base cleanup. Conditionally frees 0xE0 bytes.
0x00B2412099CEffExtended__scalar_deleting_dtorScalar deleting destructor for extended effect class. Sets vtable PTR_LAB_01182b7c, calls FUN_00b4dd10 for base cleanup. Conditionally frees 0x100 bytes.
0x00B2589084891EffectManager__main_dispatch_handlerEffectManager: main dispatch handler
0x00B3A560163is_ground_effect_with_state_checkChecks if an effect ID is a ground-type effect. Returns 1 for known ground effect IDs (0x23, 0x24, 0x3c, 0x72, 0x89, 0x8a, 0x9a-0xa4, 0x127-0x128, 0x14e, 0x152, etc.) and for IDs in the 60000+ range. Also checks a state condition for IDs 0x3d2/0x3d3 via lookup function.
0x00B3A7A0125is_ground_effect_idReturns 1 if the given effect ID belongs to the set of known ground effect IDs. Pure lookup with no state checks - uses same ID table as is_ground_effect_with_state_check but without the conditional logic.
0x00B3A9C0543EffectTool__check_lua_files_existChecks if Lua effect tool data files exist by calling lua IsExistValue on "effect_version" and "emitterInfo" keys. Returns true if either data source is available for the effect tool system.
0x00B3AC30758EffectTool__load_from_luaLoads effect tool data from Lua files. Reads "Lua Files/EffectTool/" path, constructs packet stream, checks if lua files exist. Gets effect_version via lua GetValue. Dispatches to v1 loader (version 0 or 1) or v2 loader (version 2). Only runs if this+0x24 is set.
0x00B3AF30262EffectManager__remove_expired_effectsIterates all effect entries in the tree map. For each entry, checks each linked effect node via CEffectAura__check_and_remove_expired (expiry check). Expired effects are unlinked from the list and freed. Remaining effects are processed via CEffectAura__update_and_render.
0x00B3B04084EffectManager__update_all_effectsIterates all effect entries in the tree map and calls CEffectAura__try_render on each linked effect node. Only runs if ret_one_00e3d090 check passes (likely a global enable flag).
0x00B3B0A0402EffectTool__load_v1_from_luaLoads effect tool v1 data from Lua. Calls "ReadEmitterInfoz ver 1.0" and "ReadEffectInfoz" Lua functions to populate emitter and effect data from Lua files.
0x00B3B2401237EffectTool__load_v2_from_luaLoads effect tool v2 data from Lua. Calls multiple Lua functions: ReadEmitterInfoz, ReadMagicFloorInfoz, ReadEvilsPawInfoz, and additional info loaders for the v2 effect system format.
0x00B3BE50123calc_angle_from_2d_vectorCalculates angle from a 2D direction vector (param_2, param_3). Computes magnitude via sqrt, then uses acos to get angle. Returns angle in degrees, adjusted for negative y (reflected).
0x00B3BED0252calc_screen_angle_between_entitiesCalculates the screen-space angle between two entity positions. Projects both world positions to 2D screen coords via CRenderPipeline, then computes the angle of the vector between them using acos.
0x00B3BFD0492EffectTool__get_clean_filenameGets and cleans the effect filename. Calls virtual function to get raw name, strips the portion after '@' character (removing up to 4 chars), then finds and truncates at extension separator. Returns cleaned filename string.
0x00B3C1C0384EffectTool__build_lua_effect_pathBuilds the Lua effect file path from packet stream data. Constructs path, appends "_Effect" suffix, and removes extension marker character. Used to locate Lua effect definition files.
0x00B3C35063get_entity_object_by_idGets an entity object pointer by its ID. If ID matches the current entity (DAT_01733c3c), returns the object directly from the current entity's data. Otherwise searches via map lookup and item lookup as fallback.
0x00B3C390161get_current_player_world_positionGets the current player's 3D world position (x, y, z). If the entity object exists, copies position from offsets 0x10/0x14/0x18. Otherwise calculates from tile coords and interpolated terrain height.
0x00B3C440110random_value_in_rangeGenerates a random value in a scaled range. If param_1 == param_2, returns comparison flags. Otherwise scales both params, computes absolute range, and returns rand() % range.
0x00B3C4B0570EffectTool__build_lua_emitter_pathBuilds the Lua emitter file path from packet stream data. Processes directory separator, appends suffix, and strips extension marker. Used to construct paths for emitter data Lua files.
0x00B3C6F0384EffectTool__build_emitter_info_pathBuilds emitter info path from packet stream data. Appends "_emitterInfo" suffix to the path and strips extension marker. Returns the constructed path string.
0x00B3C880235generate_random_point_around_centerGenerates a random 2D point around a center position (param_2, param_3). Uses polar coordinates: random angle [0, 2*PI] and random sqrt(radius) for uniform disk distribution. Returns (x, y) offset from center.
0x00B40230103tree_destroy_nodes_recursiveRecursively destroys all nodes in a binary tree. For each non-sentinel node, recurses into left child (node[2]), then follows right pointer (node[0]), freeing each 0x18-byte node.
0x00B402F0163EffectTree__initInitializes an effect tree structure. Allocates 0x18-byte sentinel node (self-referential head), clears all child flag bytes (offset 0x14), sets count to 0.
0x00B403A067EffectTree__free_sentinelFrees the tree sentinel node stored at field+4 (0x18 bytes). Null-checks before freeing.
0x00B403F0111EffectTree__destroy_allDestroys all nodes in the effect tree structure. Iterates from sentinel's prev pointer, recursively destroys children, frees each node (0x18 bytes), then frees the sentinel itself.
0x00B4047078EffectTree__free_sentinel_00b40470Frees the tree sentinel node at field+4 (0x18 bytes). Null-checks before freeing. Duplicate of EffectTree__free_sentinel.
0x00B404C078EffectTree__free_sentinel_00b404c0Frees the tree sentinel node at field+4 (0x18 bytes). Null-checks before freeing. Duplicate of EffectTree__free_sentinel.
0x00B4051065EffectTree__destroy_wrapperSimple wrapper that calls EffectTree__destroy_all to destroy the entire tree structure.
0x00B40560160EffectTree__clear_and_destroyClears all nodes from the tree, resets sentinel to self-referential state, zeroes count and processed count, then calls destroy to free sentinel.
0x00B40600220EffectIdSet__find_or_insertFinds or inserts an effect ID in the tree set. Uses lower_bound to check existence, inserts new 0x18-byte node if not found. Returns pointer to the processed flag byte (offset 0x14 of the node). Aborts at max capacity 0xAAAAAAA.
0x00B4074088EffectIdSet__get_next_unprocessedGets the next unprocessed effect ID from the tree. Iterates nodes until finding one with flag==0 (at node offset 0x14). Marks it as processed (flag=1), increments processed count. Returns 0 if all processed or count exceeded.
0x00B407A074EffectTree__clear_nodesClears all nodes from the effect tree. Iterates and frees all non-sentinel nodes, resets sentinel to self-referential, zeroes node count and processed count.
0x00B407F083EffectIdSet__unmark_processedUnmarks a specific effect ID as processed. Finds the ID via lower_bound, if its flag is 1 (processed), sets to 0 and decrements processed count.
0x00B4085049EffectIdSet__reset_all_flagsResets all processed flags in the tree to 0. Iterates every node and clears the flag byte at offset 0x14. Resets processed count to 0.
0x00B4089072EffectIdSet__get_processed_flagGets the processed flag for a specific effect ID. Looks up the ID via lower_bound, returns the flag byte if found, 0 if not in the set.
0x00B408E048EffectIdSet__mark_all_processedMarks all effect IDs in the tree set as processed. Iterates every node and sets flag byte (offset 0x14) to 1. Sets processed count equal to total count.
0x00B40B2064EffectIdSet__insert_unprocessedInserts an effect ID into the set with flag=0 (unprocessed). Only inserts if the ID is not already present in the tree.
0x00B48A00842compute_circular_spray_verticesComputes 4 vertex positions in a circular pattern around a center point for a spray/fountain effect. Uses sine/cosine lookup tables (DAT_01388af0/DAT_01387fa8) with angular offsets of 0x5a (90 degrees). Applies decay factor from field 0x20 iteratively across all segments. Stores resulting XYZ positions at offsets 0x1f8-0x260 in the effect object.
0x00B4EDF0143compute_facing_angle_from_deltaComputes facing angle (0-360 degrees as short) from 2D delta (dx, dz). Uses atan2-like approach with sin LUT comparison. Normalizes delta by magnitude, searches cos table for match, adjusts for quadrant. Stores result at output pointer.
0x00B528D01stub_nop_00b528d0Single-byte stub function (size=1)
0x00B6F6C040set_random_meteor_colorSets a random color from 5 meteor color palettes: red(FF,46,46), blue(46,46,FF), green(46,FF,46), yellow(5A,FF,FF), magenta(FF,46,FF). Used for meteor storm particle coloring.
0x00B70540613apply_camera_rotation_to_quadApplies camera rotation to a 4-vertex quad. First rotates around X axis (based on camera pitch), then around Y axis (based on camera yaw). Uses sin/cos lookup tables at DAT_01387fa8/DAT_01388af0.
0x00B82ED060alloc_effect_layer_from_poolAllocates an effect layer (pool index 2) from the memory manager. Sets pool type=2 at +0x2b0, copies position from param_1 (3 floats at +0x24/0x28/0x2c), sets effect type at +0x1c.
0x00B82F1060alloc_effect_type_D_from_poolAllocates an effect type D (pool index 3) from the memory manager. Sets pool type=3 at +0x2b0, copies position and effect type.
0x00B82F5060alloc_CEffect_from_poolAllocates a CEffect (pool index 0) from the memory manager. Sets pool type=0 at +0x2b0, copies position and effect type.
0x00B82F9060alloc_CEffNyangGrass_from_poolAllocates a CEffNyangGrass (pool index 1) from the memory manager. Sets pool type=1 at +0x2b0, copies position and effect type.
0x00B82FD039recycle_effect_to_poolRecycles an effect back to its pool. Calls the effect's cleanup virtual function (vfunc[1]), then returns it to the appropriate pool based on pool type stored at offset +0x2b0 (0xac * 4).
0x00B8478069check_filename_ends_with_rrfChecks if a filename string ends with ".rrf" extension. Returns 1 if it does, 0 otherwise. Walks to end of string then checks last 4 chars.
0x00B86B501400CReplayManager__open_replay_fileOpens a replay (.rrf) file for either reading (mode 0x20) or writing (mode 0x1f). For reading: opens file, seeks to offset 100, reads 12-byte header, validates magic (0x52414705 or 0x51404605), reads up to 27 sub-entry descriptors (10 bytes each), then calls EffectMap__read_sub_entry_data. For writing: generates auto-numbered filename (Replay_RagnarokReplay_%04d.rrf) or uses user-specified name, opens for write with stride 0x174. Returns 1 on success, 0 on failure.
0x00B875E0153get_global_EffectMap_instanceGets the global EffectMap singleton at DAT_016f7150. Thread-safe lazy initialization with DAT_016f734c guard. Creates EffectMap and registers atexit cleanup on first call.
0x00B87680336get_global_EffectMap_secondaryGets a secondary global EffectMap singleton at DAT_016f7350. Thread-safe lazy init with DAT_016fb2f8 guard. Simpler initialization than primary: directly sets fields, zeros 16000-byte lookup, registers atexit cleanup.
0x00B88000135copy_12byte_entries_rangeCopies a range of 12-byte (0xC) entries from source to destination. Each entry is 8 bytes + 4 bytes. Returns pointer past last destination entry.
0x00B8809026init_3field_structInitializes a 3-field structure. Sets fields [0], [1], [2] to the 3 parameters. Returns param_1.
0x00B880D0231CReplayManager__ctorConstructor for CReplayManager. Zeros out all 19 fields, sets field[9] to 50000 (max replay entries).
0x00B88530323CReplayManager__dtorDestructor for CReplayManager. Resets counters, clears 12-byte entries, destroys child objects, resets map nodes (freeing 0x68 objects), then frees all vector buffers (8-byte, 8-byte, 12-byte, 4-byte, 4-byte).
0x00B8868028copy_3field_structCopies a 3-field (12-byte) structure from source to destination. Returns destination pointer.
0x00B886A055CReplayManager__add_to_vector_AAdds an element to vector A (at +0x4/+0x8). Returns 0 if element is null. Grows vector if needed via FUN_00b87970.
0x00B886E058CReplayManager__add_to_vector_BAdds an element to vector B (at +0x10/+0x14). Returns 0 if element is null. Grows via std__vector_int__insert_and_grow_00b87830.
0x00B88720132CReplayManager__find_entity_in_nodesSearches for an entity by ID across map nodes. Only searches for IDs > 9999. Iterates through node list, checking by object (bit 0), entry (bit 4), or child (bit 8) based on param_3 flags. Returns pointer to found entity or 0.
0x00B887D037CReplayManager__get_from_vector_by_indexGets an element from the first vector by index. Returns 0 if empty or index out of bounds.
0x00B8880056CReplayManager__find_by_string_cstrSearches for a map entry by comparing string via CMapEntry__compare_string_cstr. Returns the entry pointer or 0 if not found.
0x00B88840108CReplayManager__get_entry_by_id_or_indexGets an entry from vector at +0xc. If param_3 is nonzero, searches by ID via CMapEntry__compare_id. Otherwise treats param_2 as direct array index. Returns 0 if not found/out of bounds.
0x00B888B057CReplayManager__find_entry_by_nameSearches for an entry by name in the vector at +0xc. Uses CMapEntry__compare_name. Returns entry pointer or 0 if not found.
0x00B888F021CReplayManager__get_boundsCopies the 2D bounds from +0x1c and +0x20 into the output param_2 array (2 values).
0x00B88930205CReplayManager__resetResets the CReplayManager to initial state. Resets counters, clears 12-byte entry list to (-1,0,0), destroys all child objects via virtual destructors, resets map nodes (freeing 0x68 byte objects), resets all vector end pointers to start.
0x00B88A0084CReplayManager__reset_partialPartial reset of CReplayManager. Resets counters at +0x18-0x24, max entries to 50000, clears 12-byte entry list, resets some vector pointers. Does not destroy child objects.
0x00B890E0214CReplayManager__collect_children_by_typeCollects child entries matching a given type (param_2) into an output vector (param_3). Iterates all nodes, checking each node's children and also the extra entry list at +0x3/+0x4. Compares type via get_field_0x7c. Returns true if any matches found.
0x00B8A640162destroy_40byte_entry_rangeDestroys a range of 40-byte (0x28) entries. Each entry has: ID=-1, 2 fields zeroed, SSO string at +4 (dtor'd), fields reset. Handles STL small string optimization (SSO) buffer.
0x00B8A6F047reset_12byte_entry_rangeReset 12byte entry range
0x00B8A720100CReplayManager__reset_all_children_field88Iterates all nodes and their children, setting field 0x88 to -1 on each child entry via CMapEntry__set_field_88.
0x00B8A790123pathfind_check_cell_passabilityChecks if a cell is passable for pathfinding. Gets cell type via vtable call (offset 8). For types 0xCC/0xCD, checks param flags. For 0xCA/0xCB, checks direction (param_4==2 for CA, param_4==1 for CB). Falls through to field checks for other types.
0x00B8A810114pathfind_evaluate_node_costEvaluates cost of a pathfinding node. Compares field 0x18 with a value from get_field_0x7c. If param_4 set, uses direct cost from offset+8. Otherwise iterates through a vector (0x40..0x44) looking for matching nodes and accumulates costs. Updates minimum cost at field 0x24 and stores best index in param_3.
0x00B8A890203pathfind_build_open_listBuilds the open list for pathfinding. Iterates through elements at offset 0x0C..0x10, creates 12-byte entries (cost=-1, node_id, flag=1) and appends them to vector at offset 0x2C..0x30. Returns total count of open list entries.
0x00B8ACC0144pathfind_reset_node_arrayResets an array of 40-byte pathfinding nodes. For each node, sets fields 0-3 to -1/0/-1/-1, clears the embedded string (at offset 0x10), resets field 0x20 to 0, then calls STL string destructor. Iterates from param_1 to param_2 in 40-byte steps.
0x00B8B500296_Guess_median_unchecked<unsigned_int*,struct_std::less<void>_>STL _Guess_median_unchecked for introsort. Selects median-of-three pivot from first, middle, and last elements.
0x00B8B630296_Guess_median_unchecked<unsigned_int*,struct_std::less<void>_>STL _Guess_median_unchecked for introsort. Selects median-of-three pivot from first, middle, and last elements.
0x00B8B760379_Partition_by_median_guess_unchecked<unsigned_int*,struct_std::less<void>_>STL _Partition_by_median_guess_unchecked. Partitions a range around a median-of-three pivot for introsort.
0x00B8B8E0379_Partition_by_median_guess_unchecked<unsigned_int*,struct_std::less<void>_>STL _Partition_by_median_guess_unchecked. Partitions a range around a median-of-three pivot for introsort.
0x00B8BA60140_Pop_heap_hole_by_index<unsigned_int*,unsigned_int,struct_std::less<void>_>STL _Pop_heap_hole_by_index. Moves a value down the heap from a given position, restoring heap property.
0x00B8BAF0140_Pop_heap_hole_by_index<unsigned_int*,unsigned_int,struct_std::less<void>_>STL _Pop_heap_hole_by_index. Moves a value down the heap from a given position, restoring heap property.
0x00B8BFF0102pathfind_copy_node_40byteCopies a 40-byte pathfinding node from param_3 to param_2. Copies 4 DWORD fields directly, then uses STL string copy construct for the embedded string at offset 0x10.
0x00B8C0B0325find_element_by_string_nameSearches a vector of pointers for an element whose embedded string (at offset 0x10) matches the given C string param_1. Constructs a temporary STL string for comparison using std::_Traits_equal. Returns the matching element pointer, or 0 if not found.
0x00B8C2B0275CMapObject__ctor_with_paramsConstructor for a map object with full parameters. Sets vtable at PTR_FUN_01198390, calls base init (FUN_00b8c870), stores param strings via STL string assign, sets numeric fields for position/type/flags. Initializes counter field at 0x22 to 0.
0x00B8C3D0322CMapObject__ctor_from_interfaceConstructor for a map object from an interface pointer (param_3). Calls vtable methods on the interface to get type, strings, position data. Uses same base init as CMapObject__ctor_with_params. Stores additional params (param_4..param_6) at offsets 0x1F-0x21.
0x00B8C520182CMapObject__ctor_defaultDefault constructor for CMapObject. Calls base init, sets vtable, initializes type field to 200 (0xC8), zeroes position/flag fields 0x1F-0x21, sets field 0x22 to -1.
0x00B8CB90123CMapObject__resetResets a CMapObject to default state. Restores vtable, sets type to 200, clears field 0x1F, trims vector if needed, calls cleanup helpers FUN_00b90600 and FUN_00b8cd60.
0x00B8CF0099CMapObject__copy_assignCopy assignment for CMapObject. Copies numeric fields at 0x08/0x0C, embedded string at 0x10 via STL assign, position fields (0x44/0x48), type at 0x40, and an 8-byte-pair vector at 0x4C.
0x00B8D2C018CMapObject__compare_idCompares the object's ID field (offset 0x04) against the value pointed to by param_2. Returns true if they match.
0x00B8D2E033CMapObject__compare_positionCompares the object's position (offsets 0x44 and 0x48) against a 2D coordinate pair pointed to by param_2. Returns true if both X and Y match.
0x00B8D310113CMapObject__compare_position_and_nameCompares position (0x44/0x48) and embedded string via object pointer at 0x40 between two CMapObject instances. Returns true only if positions match AND string comparison succeeds.
0x00B8D390283CMapObject__compare_nameCompares the object's embedded string at offset 0x10 against a C string param_2. Creates temp STL string, uses std::_Traits_equal. Returns true if names match, or stack address if param_2 is null. Identical pattern to CMapEntry__compare_name.
0x00B8D57044CMapObject__contains_substr_stlstrChecks if the object's name string at offset 0x10 contains the substring from an STL string param_2. Uses strstr. Returns true if substring found.
0x00B8D5A035CMapObject__contains_substr_cstrChecks if the object's name string at offset 0x10 contains the C string param_2 as a substring. Uses strstr. Returns true if found.
0x00B8D69081CMapObject__sort_compare_name_lessSort comparator: returns true if this object's name (offset 0x10) is lexicographically less than param_2's name (offset 0x10). Used for sorting CMapObject arrays.
0x00B8D87081CMapObject__sort_compare_name_less_00b8d870Sort comparator duplicate: returns true if this object's name (offset 0x10) is lexicographically less than param_2's. Identical to CMapObject__sort_compare_name_less.
0x00B8D8D0150CMapObject__scalar_deleting_dtorScalar deleting destructor for CMapObject. Resets vtable, clears type to 200, trims vectors, resets the base CMapEntry, then frees the 0x98-byte object if bit 0 of param_2 is set.
0x00B8DAE053CMapObject__push_back_pair_vector50Pushes an 8-byte pair element onto the CMapObject's vector at offset 0x50. If capacity available, copies directly; otherwise inserts with reallocation.
0x00B8DB5015CMapObject__get_field_4cGetter: copies the value at offset 0x4C into the output pointer param_2.
0x00B8DC0074CMapObject__find_by_vtable_position_4cSearches the pair vector at offset 0x4C for an object whose vtable method at offset 0x1C returns a position matching (param_2, param_3). Returns the found object pointer or 0. Same pattern as CMapEntry version.
0x00B8DC9062CMapObject__find_by_flags_in_vector4cSearches the pair vector at offset 0x4C for an object whose fields at 0x80 and 0x84 match param_2 and param_3. Returns the found object pointer or 0.
0x00B8DE2059CMapObject__erase_pair_from_vector50Erases an 8-byte pair element from the CMapObject's vector at offset 0x4C by shifting subsequent elements forward. Decrements end pointer (0x50) by 8.
0x00B8DE9015CMapObject__get_field_50Getter: copies the value at offset 0x50 (end pointer of pair vector at 0x4C) into the output pointer param_2.
0x00B8E7F021CMapObject__get_positionGets the object's 2D position. Copies X (offset 0x44) and Y (offset 0x48) into the output pair at param_2.
0x00B8E8604CMapObject__get_secondary_object_ptrReturns the secondary object pointer from offset 0x7C. This is the same object referenced by CMapEntry__get_secondary_name_ptr to retrieve a secondary name string.
0x00B8F50089check_name_is_searchableChecks if a name string is searchable. Compares against a reference string at DAT_011983dc. Returns 0 if name matches the reference OR contains a specific substring (DAT_011983e4). Returns 1 otherwise (name is valid for search).
0x00B904C027CMapObject__try_set_idAttempts to set the object's ID at offset 0x04. Only succeeds if the current ID is -1 (uninitialized). Returns 1 on success, 0 if already assigned.
0x00B906C0183copy_range_40byte_nodesCopies a range of 40-byte nodes from [param_2..param_3) to param_4. Each node has 4 DWORDs + embedded string (via STL_string_copy_construct). Resets remaining destination nodes. Returns pointer past last copied element.
0x00B907B0181copy_range_40byte_nodes_00b907b0Copies 40-byte nodes from [param_2..param_3) to param_4. Identical to copy_range_40byte_nodes at a different address. Each node has 4 DWORDs + string copy. Resets remaining destination nodes.
0x00B90AF0117reset_range_44byte_elementsResets a range of 44-byte (0x2C) elements. For each element, clears the embedded string at offset 0x0C (sets length to 0, null-terminates), then calls STL_string_dtor. Iterates from param_1 to param_2 in 0x2C steps.
0x00B90B70327CNavigator__vector_insert_single_44byteInserts a single 44-byte element into a CNavigator vector at a given position. Handles capacity growth (1.5x), memmove of existing elements, and copy construction.
0x00B90E20327CNavigator__vector_insert_single_44byte_00b90e20Inserts a single 44-byte element into a CNavigator vector at a given position. Duplicate of 00b90b70 (second instance for a different vector member).
0x00B91170465sort_median_of_three_40byteMedian-of-three pivot selection for sorting 40-byte elements. For small ranges (<41 elements), uses 3 samples. For larger ranges, uses 9 samples (ninther). Compares via CMapEntry__strcmp_name_forward and swaps via FUN_00b92470.
0x00B91350519insertion_sort_40byte_by_nameInsertion sort for an array of 40-byte elements sorted by name string. Uses CMapEntry__strcmp_name_forward for comparison. Copies temporary 40-byte entries including embedded strings (STL_string_copy_construct). Used as fallback for small partitions in introsort.
0x00B915602400partition_40byte_by_namePartition step for quicksorting 40-byte elements by name. Selects median pivot, partitions array into elements less than and greater than pivot. Uses CMapEntry__strcmp_name_forward for comparison and swaps 40-byte elements including embedded strings. Returns partition boundaries via param_1.
0x00B91EC0394heapsort_siftdown_40byteHeap sift-down operation for 40-byte elements sorted by name. Sifts element at index param_2 down within a heap of param_3 elements. Uses CMapEntry__strcmp_name_forward for comparison. Copies 40-byte elements including embedded strings. Used for heapsort fallback in introsort.
0x00B92050731introsort_40byte_by_nameIntrosort (std::sort) implementation for 40-byte elements sorted by name string. Uses quicksort with median-of-three partitioning, falls back to heapsort when recursion depth exceeded, and insertion sort for small ranges (<= 0x528 bytes / ~33 elements). Recursive with 3/4 depth reduction per level.
0x00B92330117CNavigator__copy_label_entry_44byteCopies a 44-byte label entry from source to destination. Performs deep copy of embedded STL strings within the entry.
0x00B923B0117CNavigator__copy_label_entry_44byte_00b923b0Copies a 44-byte label entry from source to destination. Second instance for a different vector member.
0x00B92470272swap_40byte_elementsSwaps two 40-byte elements including embedded strings. Creates a temporary copy of param_1, copies param_2 to param_1 (with string assign), then copies temp to param_2. Used by sorting algorithms for 40-byte map entries.
0x00B92580964CNavigator__ctorCNavigator constructor. Initializes base class via CReplayManager__ctor and CPathFinder__init_tree_containers. Zeroes many navigation fields, creates embedded STL strings, initializes 8 path strings via sprintf loop. Object is ~0x1348 bytes.
0x00B92950170CNavigatorLabel__ctorCNavigatorLabel constructor. Initializes all label fields: embedded STL strings for display text, coordinates (x,y), type, flags. Allocates string buffers.
0x00B92A00107copy_40byte_search_resultCopy constructor for a 40-byte search result entry. Copies 4 DWORDs + embedded string at offset 0x10 via STL_string_copy_construct.
0x00B92A70135CNavigatorLabel__ctor_defaultCNavigatorLabel default constructor. Initializes all fields to zero/empty defaults. Simpler than the parameterized ctor.
0x00B92BD0192CTokenizer__dtorDestructor for CTokenizer. Frees the 20-byte element vector at offset 0x11C (fields 0x47-0x49), then restores the vtable to PTR_CTokenizer__scalar_deleting_dtor_0111aabc.
0x00B92CA0466CNavigator__dtorCNavigator destructor. Destroys all embedded vectors and STL strings via _eh_vector_destructor_iterator_. Cleans up navigation state, label arrays, and path data.
0x00B92F1095CNavigatorLabel__reset_and_dtorResets a CNavigatorLabel then destroys it. Clears string contents and frees allocations before running the destructor.
0x00B92F7072close_registry_keyCloses a Windows registry key handle stored in the object. If the handle is non-null, calls RegCloseKey, then zeroes the handle field.
0x00B92FC071CNavigatorWindow__dtorCNavigatorWindow destructor. Resets vtable pointer. Minimal cleanup as this is a simple wrapper.
0x00B9305066assign_40byte_search_resultAssigns a 40-byte search result entry from param_2 to param_1. Copies 4 DWORDs directly, then assigns the embedded string at offset 0x10 via STL_lib_func_004fa8f0.
0x00B930A099CNavigatorWindow__scalar_deleting_dtorCNavigatorWindow scalar deleting destructor. Calls CNavigatorWindow__dtor then optionally frees the object.
0x00B931101366CNavigator__parse_coordinate_linkParses a coordinate link from a navigation data buffer. Extracts map name, x/y coordinates, and link type. Builds internal route node representation. Large function (1366 bytes) with multiple string operations.
0x00B93670639parse_three_boolean_flagsParses a string containing 3 boolean values separated by delimiters. Splits string at DAT_010dd840 separators, extracts 3 segments, converts each via atoi. Each must be 0 or 1. Stores results as bools in param_2/3/4. Returns 1 on success, 0 on invalid format.
0x00B938F0682parse_coordinate_pairParses a coordinate pair string "X#Y" into two integers. Splits at delimiter DAT_010dd840, converts via atoi, validates each < 501. Stores X in param_1[0], Y in param_1[1]. Sets both to -1 on failure.
0x00B93BA0566CNavigator__parse_packet_entryParses a single navigation packet entry. Extracts entry type, map ID, coordinates, and NPC reference data from the packet buffer.
0x00B93DE0900CNavigator__deserialize_map_objectDeserializes a map object from a navigation data buffer. Reconstructs the map node with name, position, connections, and child objects.
0x00B94170719CNavigator__lookup_entry_from_packetLooks up a navigation entry from packet data. Searches the existing entry table and returns a match, or creates a new entry if not found.
0x00B944401092CNavigator__serialize_map_entrySerializes a map entry to a buffer for network transmission or file storage. Writes map ID, coordinates, type, and connection data.
0x00B94890698CNavigator__serialize_search_entrySerializes a search result entry to a buffer. Includes the result type, map name, coordinates, and distance information.
0x00B94B50829CNavigator__serialize_map_objectSerializes a map object (node) to a buffer. Writes the object's name, position, type, and all child/connection references.
0x00B94E90102CNavigator__check_position_arrivalChecks if the player has arrived at the navigation position. Compares current x/y with target coordinates using a threshold.
0x00B94F00422CNavigator__check_if_at_destinationChecks if the player is at the final navigation destination. More comprehensive than check_position_arrival - also validates map ID and state flags.
0x00B950B0418CNavigator__reset_navigation_stateResets the navigation state machine. Clears destination, waypoints, current route index, and all navigation flags. Resets 9+ fields to defaults.
0x00B952801870CNavigator__start_navigationStarts navigation to a target. Sets up the route, calculates waypoints, initializes the state machine, and begins the first navigation step. Large function (1870 bytes).
0x00B959D076CNavigator__clear_label_resultsClears label result arrays. Resets the label vector size to 0 and frees associated string data.
0x00B95A20164CNavigator__rebuild_route_indicesRebuilds route indices after route changes. Recalculates the index mapping between waypoints and the flat route array.
0x00B95AD028CNavigator__clear_search_resultsClears search results vector. Resets size to 0 without freeing underlying buffer.
0x00B95B00703CNavigator__resolve_npc_display_infoResolves NPC display information for the navigation UI. Looks up NPC name, sprite, and position from the map data tables.
0x00B95DC0495CNavigator__find_route_segment_matchFinds a matching route segment in the current route. Searches by name/coordinates and returns the segment index or -1 if not found.
0x00B95FB0495CNavigator__reorder_route_by_nameReorders route entries by name. Sorts the route array alphabetically for display in the navigation list.
0x00B961A049CNavigator__get_or_find_current_mapGets the current map ID, looking it up if not cached. Returns the map entry for the player's current location.
0x00B961E042get_player_cell_positionGets the player's current cell position. Checks if mode1 field4 is available, calls FUN_00cd5510 to get X,Y. Returns 1 on success, 0 if player data unavailable.
0x00B962107CNavigator__get_path_distanceReturns the path distance value at offset 0x114c. This field stores the Manhattan distance from current position to destination, set during navigation state reset and route calculation.
0x00B96220273CNavigator__get_search_result_atGets a search result at a given index. Validates bounds then returns the result entry from the search results vector.
0x00B96340480CNavigator__get_search_result_detailsGets detailed information for a search result. Returns extended data including map name, coordinates, NPC info, and route distance.
0x00B965207CNavigator__is_navigation_activeReturns the navigation active flag at offset 0x115c. Set to 1 when navigation is started and active, 0 when reset or cleared. Checked by check_position_arrival before processing arrival.
0x00B9653074get_map_dimensions_by_idGets map dimensions for a given map ID. Returns (-1,-1) if param_2 is null. Otherwise looks up the map, gets fields 0x3C and 0x38 as width/height.
0x00B9658060CNavigator__resolve_result_map_idResolves the map ID for a given search result. Maps the result's internal reference to an actual map identifier.
0x00B965C042CNavigator__get_result_type_costGets the type/cost for a search result entry. Returns the transport cost or route weight for routing calculations.
0x00B969107CNavigator__get_active_npc_indexReturns the active NPC index at offset 0x1160. Set during navigation start to indicate which NPC in the route list is currently being navigated to. Value of -1 (0xFFFFFFFF) means no active NPC.
0x00B9692044CNavigator__get_npc_at_indexGets the NPC data at a given index in the current NPC list. Returns pointer to the NPC entry or null.
0x00B96980132CNavigator__get_destination_infoGets destination info including map ID, coordinates, and NPC reference for the current navigation target.
0x00B96A10199CNavigator__get_destination_map_nameGets the display name for the destination map. Looks up the map name string from the map data tables.
0x00B96AE0132CNavigator__get_active_target_infoGets active navigation target info. Returns current destination map/coordinates/NPC for the active navigation.
0x00B96B8018CNavigator__get_bounds_wrapperWrapper that returns navigation bounds by delegating to the internal bounds getter.
0x00B96BA0865CNavigator__full_resetPerforms a full reset of the CNavigator. Clears all navigation state, search results, labels, route data, NPC lists, and UI state. Resets 25+ fields.
0x00B96F1012CNavigator__reset_replay_stateResets replay state. Clears the replay flag field to 0.
0x00B96F20347CNavigator__reset_stateResets navigation state fields to defaults. Partial reset that preserves some configuration while clearing active navigation data.
0x00B97090308CNavigator__is_current_mapChecks if a given map name matches the current map. Compares the input string against the stored current map name.
0x00B971D07CNavigator__get_destination_typeReturns the destination type at offset 0x10fc. Values: -1 = none, 0 = coordinate, 1 = map, 2 = NPC location, 3 = NPC reference, 6 = NPC alternate. Set during navigation setup and cleared on reset.
0x00B97200503CNavigator__try_navigate_to_targetAttempts to navigate to a target location. Validates the target, calculates a route, and starts navigation if a valid path exists.
0x00B9740041is_point_inside_rectChecks if point (param_5, param_6) is inside rectangle defined by (param_1, param_4) to (param_3, param_2). Returns 1 if inside, 0 otherwise.
0x00B97430153CNavigator__calc_distances_to_npcsCalculates distances from the current position to all NPCs in the NPC list. Stores results in the distance pair array.
0x00B974D0629CNavigator__parse_npc_list_from_bufferParses an NPC list from a data buffer. Extracts NPC entries with name, position, and type information.
0x00B97750557CNavigator__find_path_and_build_screen_coordsFinds a navigation path and converts waypoints to screen coordinates for minimap/UI display.
0x00B97980514CNavigator__show_npc_item_dialogShows an NPC item dialog for the selected navigation NPC. Displays available items or services at the NPC location.
0x00B97B90575CNavigator__navigate_or_warpNavigates to a destination or warps if direct walking is not possible. Chooses between walking and kafra/teleport based on distance and available routes.
0x00B97DD0177CNavigator__map_to_screen_coordsConverts map coordinates to screen pixel coordinates for the navigation overlay. Applies the current zoom/scroll transform.
0x00B97E90303CNavigator__map_to_screen_with_resource_lookupConverts map coordinates to screen coordinates and looks up the associated map resource texture for icon rendering.
0x00B97FC0465CNavigator__get_current_waypoint_labelGets the display label for the current waypoint. Formats the waypoint name and distance for the navigation HUD.
0x00B981A0289CNavigator__get_arrival_labelGets the arrival label text. Formats a message shown when the player reaches a waypoint or destination.
0x00B982D0481CNavigator__get_destination_labelGets the destination label text. Formats the final destination name and distance for display.
0x00B984C0355CNavigator__get_map_display_nameGets the display name for a given map. Looks up the localized/friendly map name from the map data tables.
0x00B98630327CNavigator__get_tooltip_labelGets the tooltip label for a navigation element. Returns formatted hover text for map markers or route nodes.
0x00B987801510CNavigator__show_navigation_result_messageShows a navigation result message to the player. Displays success/failure/progress messages in the game chat or UI panel. Large function (1510 bytes) with many message format cases.
0x00B98E40492CNavigator__get_location_stringGets a formatted location string for a map position. Combines map name and coordinates into a display string.
0x00B990301435CNavigator__process_navigation_requestProcesses a navigation request from the UI. Parses user input, validates the target, calculates routes, and initiates navigation. Main entry point for user-triggered navigation.
0x00B995D0246CNavigator__set_navigation_targetSets the navigation target (destination map and coordinates). Updates internal state without starting navigation.
0x00B996D0351CNavigator__load_view_icon_from_registryLoads the view icon preference from the Windows registry. Reads the saved icon state from HKCU\Software path.
0x00B9983093CNavigator__get_route_node_at_indexGets the route node at a given index in the current route array. Returns the node data or null if out of bounds.
0x00B99890841CNavigator__render_navigation_pathRenders the navigation path on the minimap/world map. Draws lines between waypoints and highlights the current segment.
0x00B99BE0248CNavigator__render_destination_markerRenders the destination marker on the minimap/world map. Draws an icon or pin at the navigation target location.
0x00B99CE05011CNavigator__build_search_resultsBuilds navigation search results. 5K bytes. Serializes map entries into search result format, copies/inserts vector data, processes map flags and names. No callers (likely callback registered with navigation system).
0x00B9B0802819CNavigator__deserialize_state_from_packetDeserializes full navigation state from a network packet. Rebuilds route, NPC list, labels, and UI state from packet data. Large function (2819 bytes).
0x00B9BBE0985CNavigator__try_navigate_to_npcAttempts to navigate to a specific NPC. Finds the NPC in the map data, calculates a route, and starts navigation.
0x00B9BFC082CNavigator__handle_navigation_completeHandles navigation completion event. Called when the player reaches the final destination. Updates state flags and may trigger arrival UI.
0x00B9C020166calc_tile_scale_and_offsetCalculates tile scale factor and offset for map-to-screen coordinate conversion. Compares param_3 (width) vs param_4 (height): if height > width, scale = param_5/width and computes Y offset; if width > height, scale = param_5/height and computes X offset. Returns scale factor as float10.
0x00B9C0D0541CNavigator__serialize_npc_list_to_bufferSerializes the NPC list to a buffer for network transmission. Writes each NPC entry's data in packet format.
0x00B9C2F0398CNavigator__send_navigation_packetSends a navigation packet to the server. Builds and transmits the packet containing current navigation state.
0x00B9C480308CNavigator__send_map_change_packetSends a map change packet to the server. Notifies the server that the player is changing maps during navigation.
0x00B9C5C0233CNavigator__setup_map_dataSets up map data for a new map. Loads map-specific navigation info, NPC positions, and warp point data.
0x00B9C6B0127CNavigator__refresh_map_and_notifyRefreshes the map display and notifies dependent UI elements. Called after map data changes to update the minimap.
0x00B9C73016CNavigator__set_view_iconSets the navigation view icon ID. Stores the icon index for the current navigation display mode.
0x00B9C7401283CNavigator__add_multiline_text_labelsAdds multi-line text labels to the navigation display. Formats and positions text for route descriptions and NPC info panels.
0x00B9CC503074CNavigator__build_npc_info_displayBuilds the NPC info display panel. Constructs the UI layout with NPC name, services, items, and navigation options. Large function (3074 bytes).
0x00B9D860750CNavigator__find_reachable_npcs_on_mapFinds all reachable NPCs on a given map. Filters the NPC database by map ID and accessibility from the current position.
0x00B9DB50121CNavigator__select_npc_by_indexSelects an NPC by index from the current NPC list. Updates the active NPC selection and refreshes the info panel.
0x00B9DBD0642CNavigator__advance_route_nodeAdvances to the next route node in the navigation sequence. Updates the current waypoint index and recalculates the path display.
0x00B9DE60730CNavigator__build_route_groupsBuilds route groups from the flat route array. Groups consecutive waypoints by map for the route overview display.
0x00B9E140331CNavigator__build_flat_route_groupsBuilds a flat (ungrouped) route listing from the route data. Alternative to grouped display for simple route viewing.
0x00B9E290747CNavigator__set_destination_from_map_coordsSets the navigation destination from map coordinates. Converts raw x/y + map to a full navigation target.
0x00B9E5805146CNavigator__build_map_tree_from_luaBuilds navigation map tree from Lua data files. 5.1K bytes. Called by load_navigation_lua_data_files. Creates CMapNode/CMapEntry/CMapObject hierarchy, manages replay data, processes map positions and child nodes.
0x00B9F9B038CNavigator__set_navigation_modeSets the navigation mode (walking, kafra, teleport, etc.). Updates the transport preference for route calculation.
0x00B9F9E0137CNavigator__load_icon_spritesLoads navigation icon sprites from resource files. Initializes the sprite data for map markers and route indicators.
0x00B9FA7044CNavigator__set_transport_flagsSets transport flags for route calculation. Controls which transport methods (walk, kafra, airship) are considered.
0x00B9FAA0261CNavigator__get_npc_info_for_waypointGets NPC info for a specific waypoint. Returns the NPC data associated with a route waypoint for display.
0x00B9FBB01845CNavigator__rebuild_minimap_displayRebuilds the minimap navigation display. Redraws all navigation elements including path, markers, and labels on the minimap.
0x00BA02F01406CNavigator__build_info_panel_labelsBuilds info panel labels for the navigation window. Creates formatted text entries for route details and destination info.
0x00BA0870613CNavigator__find_reachable_npcs_on_current_mapFinds all reachable NPCs on the player's current map. Convenience wrapper that passes the current map ID.
0x00BA0AE0125CNavigator__copy_current_to_savedCopies current navigation position to saved state. Stores the current location for later comparison or restoration.
0x00BA0B60199CNavigator__update_saved_npc_positionUpdates the saved NPC position. Refreshes the stored NPC coordinates after the NPC has moved or the map has changed.
0x00BA0C901063CNavigator__find_route_to_targetFinds a complete route to the navigation target. Runs the pathfinding algorithm and builds the waypoint sequence.
0x00BA10C0411CNavigator__set_active_npc_and_refreshSets the active NPC and refreshes the display. Updates selection, recalculates distances, and refreshes the info panel.
0x00BA126060CNavigator__init_pathfinder_from_gameInitializes the CNavigator's embedded pathfinder from the game's map connectivity graph. Copies map warp/connection data into the pathfinder.
0x00BA12A030CNavigator__get_npc_countGets the number of NPCs in the current NPC list. Returns the vector size.
0x00BA12C016CNavigator__get_waypoint_countGets the number of waypoints in the current route. Returns the route node count.
0x00BA12D093CNavigator__on_arrival_at_destinationHandles arrival at the navigation destination. Triggers arrival effects, clears navigation state, and notifies the UI.
0x00BA1330340CNavigator__save_view_icon_to_registrySaves the view icon preference to the Windows registry. Writes the current icon state to HKCU\Software path.
0x00BA14F0124CNavigator__replace_label_vectorReplaces the label vector contents. Swaps the existing labels with a new set, properly cleaning up old data.
0x00BA157022CNavigator__destroy_label_rangeDestroys a range of label entries. Calls destructors on labels in the specified index range.
0x00BA1590191CNavigator__copy_label_entriesCopies label entries from source to destination array. Performs deep copy including embedded STL strings.
0x00BA165036copy_16byte_elements_00ba1650Copy 16byte elements 00ba1650
0x00BA1680189CNavigator__copy_label_entries_voidCopies label entries (void* variant). Same as copy_label_entries but with void pointer parameters for generic use.
0x00BA175092alloc_label_bufferAllocates buffer for label entries. Each entry is 0x2c (44) bytes. Validates count < 0x5d1745e to prevent overflow. Uses aligned allocation for buffers >= 0x1000 bytes.
0x00BA17F048CNavigator__push_back_distance_pairPushes a distance/NPC pair onto the distance results vector. Used during distance calculation to store NPC distances.
0x00BA1820161CNavigator__push_back_label_entryPushes a new label entry onto the label vector. Allocates space if needed and copy-constructs the entry.
0x00BA18D098byte_vector__resizeResizes a byte vector to param_2 bytes, filling new elements with *param_3. If shrinking, just moves end pointer. If growing within capacity, memsets new region. If growing beyond capacity, calls SpriteAction__grow_buffer_and_fill for reallocation.
0x00BA1A20103rb_tree__destroy_nodesRecursively destroys red-black tree nodes. Checks sentinel flag at byte offset 0xd. Recursively destroys right child (param_2[2]), then frees current node (0x18 bytes) and moves to left child (param_2[0]). Standard STL map/set tree destructor pattern.
0x00BA1A90202CNavDataMgr__ctorConstructor for CNavDataMgr. Sets vtable, initializes 12 DWORDs to 0, allocates "ReadEntryQueueList" string buffer (0x20 bytes), and calls lua_call_function to register with Lua system.
0x00BA1B6067rb_tree__free_header_nodeFrees the header/sentinel node of an RB-tree. Frees 0x18 byte node at offset +4 if non-null.
0x00BA1BB0111rb_tree__destroy_allDestroys entire RB-tree. Iterates from root (*param_1 + 4), recursively destroys subtrees via rb_tree__destroy_nodes, then frees the sentinel node. Each node is 0x18 bytes.
0x00BA1C3078rb_tree__free_header_node_00ba1c30Frees the header/sentinel node of an RB-tree. Identical to rb_tree__free_header_node but with different stack cookie setup. Frees 0x18 byte node at offset +4.
0x00BA1C8078rb_tree__free_header_node_00ba1c80Frees the header/sentinel node of an RB-tree. Same pattern as other variants. Frees 0x18 byte node at offset +4.
0x00BA1D50153CNavDataMgr__dtorDestructor for CNavDataMgr. Sets vtable, iterates all entries in the global tree (DAT_016fc660), frees 0x738-byte data blocks at offset +5 of each node. Traverses tree using in-order walk. Optionally frees self (0x3c bytes) if param_2 bit 0 set.
0x00BA1DF0284CNavDataMgr__get_or_create_instanceGets or creates the singleton CNavDataMgr instance. If DAT_016fc65c is null, allocates 0x3c bytes, constructs with CNavDataMgr__ctor (sets vtable, inits Lua "ReadEntryQueueList"). Returns 1 if instance exists/created, 0 on allocation failure.
0x00BA1F10104send_navigation_teleport_packetSends navigation teleport network packet (type 0x8dd). Copies map name from param_1 (max 0x18 chars), sets param_2 flag. Calls packet send chain FUN_00c7d7d0 twice then FUN_00c7c970/FUN_00c7ce30.
0x00BA1F80164CNavNpc__send_npc_interaction_packetSends NPC interaction packet (type 0x8e0) for navigation. Copies NPC name from offset +4 of object at field 0x34, and map name from field 0x1c. Sets interaction mode from param_2. If mode is 2, clears flag at offset 0x38. Uses FUN_00c7d7d0/FUN_00c7c970/FUN_00c7ce30 for packet send.
0x00BA2030108send_navigation_warp_request_packetSends navigation warp request packet (type 0x8d7). Copies mode (param_1) and map name (param_2, max 0x17 chars). Uses FUN_00c7d7d0/FUN_00c7c970/FUN_00c7ce30 for packet send.
0x00BA20A0103CNavNpc__send_buy_ticket_packetSends buy ticket packet (type 0x8da) for navigation NPC. Copies NPC name from field 0x34+4. Only sends if NPC object pointer is non-null.
0x00BA2110103CNavNpc__send_cancel_packetSends cancel packet (type 0x90a) for navigation NPC. Copies NPC name from field 0x34+4. Only sends if NPC object pointer is non-null.
0x00BA218027CNavDataMgr__destroy_instanceDestroys the CNavDataMgr singleton. Calls destructor via vtable (param 1 = delete self), then sets DAT_016fc65c to null.
0x00BA21A0163CNavDataMgr__reload_lua_entriesReloads navigation data entries from Lua. Allocates "ReadEntryQueueList" string (0x20 bytes) and calls lua_call_function with DAT_01738010 to re-read the navigation entry list.
0x00BA225027CNavNpc__set_source_dataSets source/origin data for navigation NPC. Copies 6 fields (24 bytes: 4 ints + 8 byte pair) from param_2 to offsets 0x04-0x18 of the object.
0x00BA227027CNavNpc__set_destination_dataSets destination data for navigation NPC. Copies 6 fields (24 bytes) from param_2 to offsets 0x1c-0x30 of the object.
0x00BA231068CNavNpc__handle_request_responseHandles NPC request response packets. Case 1: NPC accepted request - opens booking window (0xd1), copies NPC name, plays sound "se_btg_request_wav", shows chat message with NPC name + string 0x833. Cases 2-10,15: Error/status responses - shows dialog box with corresponding message string IDs (0x834-0x83d).
0x00BA23D2270CMercenary__display_mercenary_name_in_chatCMercenary: display mercenary name in chat
0x00BA2660541CNavNpc__handle_booking_responseHandles NPC booking confirmation response. Case 1: booking confirmed (0x83e); Case 3: booking error (0x83f); Case 11: another error (0x840); Case 14: booking cancelled (0x841) - clears booking flag. After handling, builds chat message with NPC name + string 0x842 (white 0xff), clears NPC pointer (0x34=0). Closes related windows (0xd1, 0x9d).
0x00BA28B01stub_nop_00ba28b0Single-byte stub function (size=1)
0x00BA28C01stub_nop_00ba28c0Single-byte stub function (size=1)
0x00BA28D0915CNavNpc__handle_npc_info_responseHandles NPC info response packet. Sets booking flag (0x38=1). Finds or creates booking window (0xd1). If no NPC is currently selected (0x34=0), searches the global navigation tree (DAT_016fc660) for an NPC matching the packet name (param_2+2). Compares strings to find the matching data entry. Once found, calls FUN_00ba5ef0 with NPC data and opens window 0x9d.
0x00BA2C70471CNavNpc__handle_boarding_readyHandles boarding ready notification. Copies NPC name and map from packet. Opens boarding window (0xd2), plays sound "se_btg_ready_wav". Shows chat message with NPC display name + string 0x843 in blue (0x4763ff).
0x00BA2E5096handle_nav_npc_error_dialogShows error dialog for navigation NPC. Code 3 -> string 0x83f, code 11 -> string 0x840. Other codes ignored.
0x00BA2EB065handle_nav_npc_forward_soundPlays forward navigation sound. If packet code is 1, plays "se_btg_forward_wav" sound effect.
0x00BA2F002052CNavDataMgr__add_entry_from_luaAdds a navigation data entry from Lua table. Reads 17 fields: ID (int), 2 names (strings), 5 coords/flags (ints), 4 bytes (transport flags), 2 ints, 5 strings (map names, sprite paths). Allocates 0x738-byte data block, fills all fields. Inserts into global RB-tree (DAT_016fc660) keyed by ID. Skips duplicates.
0x00BA3920106UINavBookingWnd__ctorConstructor for UINavBookingWnd (navigation booking window). Calls UIWindowBase__ctor, sets vtable to PTR_FUN_01198974. Initializes fields 0x2d and 0x2e to 0 (scroll list and dialog).
0x00BA399071UINavBookingWnd__dtor_inplaceIn-place destructor for UINavBookingWnd. Sets vtable, calls UIWindowBase__dtor. Does not free self.
0x00BA39E099UINavBookingWnd__scalar_deleting_dtorScalar deleting destructor for UINavBookingWnd. Calls in-place dtor, then optionally frees 0xbc bytes if bit 0 of param_2 is set.
0x00BA3A502054UINavBookingWnd__init_uiInitializes UI for the navigation booking window. Creates UIColoredScrollListBase (0xec bytes) with scroll area, sets background color from pixel. Adds 9 list items from string IDs 0x844-0x84c. Creates close button dialog (CDialogWnd, 0x120 bytes) with btn_close textures (normal, hover, pressed). Sets up sizes and adds children to the window hierarchy.
0x00BA42B036UINavBookingWnd__on_button_clickHandles button click in booking window. If button ID 6, subtype 0 (close button), opens window 0xd3. Returns 0.
0x00BA42E0136UINavInfoScrollList__ctorConstructor for UINavInfoScrollList. Calls UIScrollListBase__ctor, sets vtable to PTR_FUN_01198a4c. Initializes fields 0x35, 0x36 to 0. Allocates and initializes a 0x2c-byte sentinel node for the linked list (self-referencing next/prev, flags 0x101).
0x00BA4370126UINavInfoScrollList__dtor_inplaceIn-place destructor for UINavInfoScrollList. Sets vtable, clears linked list via STL_lib_func_00512380, frees sentinel node (0x2c bytes), calls UIFormattedWidgetBase__dtor.
0x00BA43F0150UINavInfoScrollList__scalar_deleting_dtorScalar deleting destructor for UINavInfoScrollList. Calls in-place dtor, optionally frees 0xdc bytes if param_2 bit 0 set.
0x00BA4490512UINavInfoScrollList__add_or_update_entryAdds or updates an entry in the scroll list's RB-tree (field 0x35). Key is param_2 string, value is param_3. Does lower_bound lookup - if key exists, skips insert. Otherwise allocates new 0x2c-byte node, copies string, inserts into tree. If newly inserted, calls vtable 0xd8 to refresh display.
0x00BA46A0208UINavInfoScrollList__get_entry_value_by_indexGets the value associated with a scroll list entry by index. Copies string from item array (offset 0x88 + param_2 * 0x18), looks up in RB-tree. Returns the stored value (offset 0x28 of tree node) or -1 if not found.
0x00BA47A0126UINavTimerWnd__ctorConstructor for UINavTimerWnd (navigation timer window). Calls UIWindowBase__ctor, sets vtable to PTR_FUN_01198b3c. Initializes timer duration (0x30=1000ms), elapsed (0x31=0), scroll list (0x32=0), and start time (0x33=0).
0x00BA482071UINavTimerWnd__dtor_inplaceIn-place destructor for UINavTimerWnd. Sets vtable, calls UIWindowBase__dtor.
0x00BA487099UINavTimerWnd__scalar_deleting_dtorScalar deleting destructor for UINavTimerWnd. Calls in-place dtor, optionally frees 0xd4 bytes.
0x00BA48E02719UINavTimerWnd__init_uiInitializes UI for the navigation timer window (300x250 px). Creates scroll list (UIColoredScrollListBase), adds NPC name header (string 0x84e), instruction items (strings 0x84f-0x853), close button, cancel button with btn_cancel textures, and editable text widget for search input. Centers window on screen.
0x00BA5390195UINavTimerWnd__renderRenders the timer window. Draws title bar (string 0x855), border. Calculates remaining seconds (20 - elapsed_seconds). If time <= 0, triggers button click via vtable. Formats countdown text using string 0x856 and displays it.
0x00BA546058UINavTimerWnd__tickTimer tick handler. Uses GetTickCount to measure elapsed time since start (field 0x33). If elapsed exceeds interval (field 0x30), accumulates into total elapsed (field 0x31), resets start time, and triggers refresh via vtable 0x98.
0x00BA54A0183UINavBoardingWnd__on_button_clickHandles button click in boarding confirmation window. Button 6, sub 0: sends NPC interaction mode 1 (accept), closes booking/boarding windows, shows confirmation chat message (string 0x854 in cyan 0x64ffff). Button 6, sub 1: sends interaction mode 2 (decline), closes windows.
0x00BA5560179UINavWaitingWnd__ctorConstructor for UINavWaitingWnd (waiting/status window). Calls UIWindowBase__ctor, sets vtable to PTR_FUN_01198c14. Initializes string field, scroll list pointers (0x33-0x35), and clears 0x30c bytes of display data at offset 0x38.
0x00BA562095UINavWaitingWnd__dtor_inplaceIn-place destructor for UINavWaitingWnd. Sets vtable, destroys string, calls UIWindowBase__dtor.
0x00BA5680119UINavWaitingWnd__scalar_deleting_dtorScalar deleting destructor for UINavWaitingWnd. Calls in-place dtor, optionally frees 0x3ec bytes.
0x00BA57001860UINavWaitingWnd__init_uiInitializes UI for the navigation waiting/status window (280x120 px). Creates scroll list (UIColoredScrollListBase), cancel button with "cancel_waiting" textures, close button with btn_close textures. Centers on screen. Sets up two dialog buttons at fields 0x36 and 0x37.
0x00BA5EA078UINavWaitingWnd__on_button_clickHandles button clicks in waiting window. Button 6, sub 0: sends buy ticket packet. Button 6, sub 1: closes booking window (0xd1). Returns 0.
0x00BA5EF0269UINavWaitingWnd__set_display_dataSets display data for the waiting window. Copies NPC name string, stores two values at 0xcc and 0xd0. Formats three display strings using message templates 0x858, 0x859, 0x85a (NPC name, departure count, arrival count). Updates the scroll list with these strings if it exists.
0x00BA6000187UINavScheduleWnd__ctorConstructor for UINavScheduleWnd (schedule display window). Calls UIWindowBase__ctor, sets vtable to PTR_FUN_01198d24. Initializes 20 fields to 0 (UI element pointers, state fields).
0x00BA60C071UINavScheduleWnd__dtor_inplaceIn-place destructor for UINavScheduleWnd. Sets vtable, calls UIWindowBase__dtor.
0x00BA611099UINavScheduleWnd__scalar_deleting_dtorScalar deleting destructor for UINavScheduleWnd. Calls in-place dtor, optionally frees 0x104 bytes.
0x00BA641013CUIBattleFieldWnd__get_queue_idReturns the queue/battle ID (offset 0x94) from the sub-object at offset 0xFC of this UI window. Simple getter used to retrieve the current battlefield queue identifier.
0x00BA64203624CUIBattleFieldWnd__init_ui_controlsInitializes all UI controls for the Battleground settings window. Creates: navigation scroll list (offset 0x3F) sized 0x82x0x10E with RGB color 0xF0, iterates DAT_016fc660 tree to populate entries. Creates 7 label widgets (offsets 0x31-0x37) using message strings 0x85B-0x861, and 7 editable text input widgets (offsets 0x38-0x3E). Creates 3 dialog buttons for apply modes (individual/party/guild) with _a/_b texture variants from battlefield sprite path. Creates a 4th summary dialog button (offset 0x30). All buttons use UIButtonWidget__set_texture_resolved with indices 0-2.
0x00BA7250491CUIBattleFieldWnd__draw_headerDraws the header area of the Battleground window. Renders slot background row, border/texture at 0x11, tiled bottom border. If a battlefield entry is selected (DAT_016fc65c+0x34), constructs sprite path from battlefield name and draws it at position (0x9D, 0x19). Finally draws message text 0x865 in gray (0xC0C0C0) with shadow at position (10, 0x17) with font size 0xC.
0x00BA7450275CUIBattleFieldWnd__on_commandHandles UI commands for the Battleground window. Command 0x22: opens/positions the window from a source param. Command 0x87: handles scroll list item selection, looks up battlefield entry in the DAT_016fc660 tree by index and updates display. Command 6 (button clicks): case 0=individual apply (checks 0x29C cooldown, shows msg 0x862 confirm, sends warp type 1), case 1=party apply (checks party lead 0x17E0, party member count, sends type 2), case 2=guild apply (checks guild level/members, sends type 4), case 3=opens map dialog 0xD3, case 4/0xC9=sends network packet. Shows error messages 0x86B-0x872 for various failure conditions.
0x00BA78A0544CUIBattleFieldWnd__update_detail_fieldsUpdates the 7 detail text fields for the currently selected battlefield entry. Sets DAT_016fc65c+0x34 to the selected entry. Iterates fields 0-6: field 0=map name (offset 0x108), field 1=description (offset 0x530), field 2=player count formatted via msg 0x866, field 3=reward type (msg 0x867/0x868/0x869/0x86A depending on type 1/2/3/other at offset 0x218), field 4-6=additional strings (offsets 0x224/0x328/0x42C). For each field, measures text width, resizes the widget, sets text, positions it right-aligned to the label, and refreshes display.
0x00BA7AE0173CUIBattleFieldWnd__show_apply_confirmationShows a confirmation dialog for applying to a battlefield. Formats the message as "{map_name} {param_text}" using the map name from offset 0x108 of the selected entry. Displays a Yes/No dialog box (type 2) with size 0x118x0x78. Returns true if user clicked Yes (result == 0xBB), false otherwise or if no entry is selected.
0x00BA7B9056CUIBattleFieldWnd__copy_rect_to_parentCopies this widget's rectangle (fields at offsets 0x1C, 0x20, 0x14, 0x18) to the parent object at offset 0x100. Stores as (left, top, width, height) in the parent's 16-byte RECT structure. No-op if parent pointer is null.
0x00BA7BD020CUIBattleFieldEntry__set_pairSimple setter that stores two values into the first two fields of a BattleField entry structure. Used to initialize a key-value pair (e.g., ID and pointer).
0x00BA7C0017is_digit_charReturns true if the character is an ASCII digit (0x30-0x39, '0'-'9'). Single character test utility.
0x00BA7C2032is_alpha_charReturns 1 if the byte is an ASCII letter (A-Z: 0x41-0x5A, a-z: 0x61-0x7A), 0 otherwise. Single character alphabetic test.
0x00BA7C4030is_korean_lead_byteReturns 1 if the byte is a Korean (EUC-KR/CP949) lead byte: >= 0xC0, == 0xA8, or == 0xB8. Returns 0 otherwise. Used to detect the start of a multi-byte Korean character sequence.
0x00BA7C6014is_space_charReturns true if the character is a space (0x20). Simple single-character test.
0x00BA7C70148validate_alphanumeric_stringValidates that an STL string contains only alphanumeric characters (A-Z, a-z, 0-9). Iterates each byte, checking ranges: 0x41-0x5A (uppercase), 0x61-0x7A (lowercase via bVar1+0x9f < 0x1A), 0x30-0x39 (digits). Returns 1 if all characters valid, 0 if any invalid character found. Destroys the input string after checking.
0x00BA7D10143validate_korean_or_digit_stringValidates that an STL string contains only Korean characters or digits. Accepts bytes >= 0xC0 (Korean lead bytes), 0xA8, 0xB8 (specific Korean byte values), and 0x30-0x39 (digits). Returns 1 if all characters valid, 0 if any invalid character found. Used for validating Korean text input in battleground UI fields. Destroys the input string after checking.
0x00BA7DA0128string_contains_spaceChecks if an STL string contains any space character (0x20). Iterates through each byte of the string. Returns 1 (true) if a space is found, 0 (false) if no spaces exist. Destroys the input string after checking.
0x00BA7E20433validate_battleground_name_inputValidates a battleground name input string. Returns error codes: 0xFFFFFFFE if empty, 0xFFFFFFF8 if too long (>= field+4 length), 0xFFFFFFC0 if first segment contains a space (name portion must not have spaces). If first segment passes, checks if remaining chars are all alphanumeric (A-Z,a-z,0-9) -> returns 2. If not alphanumeric, checks if they're Korean characters (>=0xC0, 0xA8, 0xB8) or digits -> returns 4. Returns 0xFFFFFFE0 if Korean validation also fails. Three-phase validation: empty/length, space check, charset detection.
0x00BA7FE0109CUIScheduledEvent__ctorConstructor for a scheduled event UI object. Increments global counter DAT_0135d0a4, initializes base via FUN_00ba8930 with type=4, sets vtable to PTR_FUN_01198eb8. Takes 3 constructor params passed to base init.
0x00BA805072CUIScheduledEvent__dtorDestructor for CUIScheduledEvent. Sets vtable to PTR_FUN_01198eb8 then to base class PTR_FUN_0110c494. Standard two-phase C++ destructor pattern with SEH frame setup.
0x00BA80A097CUIScheduledEvent__scalar_deleting_dtorScalar deleting destructor for CUIScheduledEvent. Sets vtable to PTR_FUN_01198eb8 then to base PTR_FUN_0110c494. If param_2 bit 0 is set, frees the 0x30-byte object via FUN_00e6227f. Standard MSVC scalar deleting destructor pattern.
0x00BA8380116CUITimerEvent__ctorConstructor for a timer event UI object. Increments global counter DAT_0135d0a4, initializes base via FUN_00ba8930 with type=0, sets vtable to PTR_FUN_01198edc, and zeroes field 0xF (timer-specific flag). Takes 3 constructor params passed to base init.
0x00BA8400135CUITimerEvent__dtorDestructor for CUITimerEvent. Sets vtable to PTR_FUN_01198edc, frees two optional 4-byte allocations at fields 0xC and 0xD (timer data pointers) via null_stub then FUN_00e6227f. Finally sets vtable to base class PTR_FUN_0110c494.
0x00BA8490156CUITimerEvent__scalar_deleting_dtorScalar deleting destructor for CUITimerEvent. Runs full destructor (frees timer data at fields 0xC/0xD), then if param_2 bit 0 is set, frees the 0x40-byte object. Standard MSVC pattern.
0x00BA853078CUITimerEvent__advance_to_next_milestoneAdvances the timer event to the next notification milestone. Uses a lookup table DAT_0135d070 (6 double entries, likely time thresholds in seconds). Compares remaining time (field 0x38) against each milestone. When a milestone with positive remaining time is found, converts to milliseconds (*1000) and stores as the next wakeup time at offset 0x18. Field 0x3C tracks current milestone index (0-5).
0x00BA8580350CUITimerEvent__init_timerInitializes the timer event with start and end times. Allocates two 4-byte time_t values: field 0x30 stores start time (param_3), field 0x34 stores end time (param_2). Calculates remaining duration via difftime(end, start). If remaining < 3600 seconds (1 hour), calls advance_to_next_milestone for fine-grained notifications. If remaining is between 3600-7200 seconds, sets wakeup at (remaining-3600+600)*1000 ms to trigger near the 1-hour mark.
0x00BA86E043CUITimerEvent__is_expiredChecks if the timer event has expired. Computes difftime(end_time, start_time). Returns 1 (true) if the difference is less than 1 second (expired), 0 otherwise. The result byte is in bit 0 of the return value.
0x00BA8710495CUITimerEvent__on_tickTimer event tick handler. Recalculates remaining time from current tick divided by 10M (Windows FILETIME ticks to seconds). If remaining > 3599 seconds (>1 hour), formats hours/minutes message (msg 0x92D) and shows in chat. If remaining <= 3599 and milestone index < 6, formats full date/time notification (msg 0x92C with year/month/day/hour/minute/second via CTime) and shows in chat, then advances to next milestone. If all 6 milestones consumed, disables the event (field 0x24=0).
0x00BA890036CUIEventNotice__scalar_deleting_dtorScalar deleting destructor for CUIEventNotice. Sets vtable to PTR_FUN_01198ee8. If param_2 bit 0 set, frees the 8-byte object. Minimal object with no owned resources to clean up.
0x00BA893078CUIEventBase__initBase initializer for UI event objects. Sets vtable to PTR_FUN_0110c494. Stores: type (field 2=param_5), start time (fields 4-5 from param_2), end time (fields 6-7 from param_3), event ID (field 8=param_4), sub-type (field 0xB=param_6). Initializes active flag (field 9=1) and counter (field 10=0).
0x00BA8990140CUIEventBase__check_trigger_timeChecks if the current time has reached the event's trigger time. Computes trigger_time = base_time + delay*10000 (converting ms to FILETIME 100ns ticks). Compares the 64-bit trigger timestamp against the current time param_2. Returns 1 if current_time >= trigger_time (event should fire), 0 if delay is zero/negative or trigger not yet reached.
0x00BA8A20263CUIEventBase__update_base_timeUpdates the event's base time reference. If event type is 0, disables the event (field 0x24=0). If type is 2 (random interval), generates a random delay within the range [DAT_0135d0a8, DAT_0135d0ac] using a rejection sampling method, converts to milliseconds, and stores as the next trigger delay. Always updates the base time (fields 0x10-0x14) from param_2.
0x00BA8B30128CUICountdownEvent__ctorConstructor for CUICountdownEvent. Increments global event counter DAT_0135d0a4, initializes base via CUIEventBase__init with type=0, sets vtable to PTR_FUN_01198ef0, calls ret_zero_00ae8190 for resource initialization, and zeroes field 0xF.
0x00BA8BB0122CUICountdownEvent__dtorDestructor for CUICountdownEvent. Sets vtable to PTR_FUN_01198ef0, frees optional 4-byte timer data at field 0xC via null_stub+FUN_00e6227f, calls null_stub for secondary cleanup, then sets vtable to base PTR_FUN_0110c494.
0x00BA8C30143CUICountdownEvent__scalar_deleting_dtorScalar deleting destructor for CUICountdownEvent. Runs full destructor sequence (frees timer data, cleanup), then if param_2 bit 0 set, frees the 0x40-byte object.
0x00BA8CC078CUICountdownEvent__advance_to_next_milestoneAdvances the countdown event to the next notification milestone. Uses lookup table DAT_0135d308 (6 double entries for time thresholds). Same pattern as CUITimerEvent__advance_to_next_milestone but uses a different threshold table. Converts remaining time to milliseconds for the wakeup interval.
0x00BA8D10212CUICountdownEvent__init_countdownInitializes the countdown event with a target time. Allocates a 4-byte time_t at field 0x30 for the current time reference. If the current hour > 5 (after 5 AM), computes countdown to midnight (next day at 0:00) using CTime__set_from_components_no_time with day+1. Calculates remaining seconds via difftime and calls advance_to_next_milestone to set up the first notification.
0x00BA8E0082CUICountdownEvent__on_tickCountdown event tick handler. If milestone index < 6 and game mode is active, shows message 0x7E4 (likely "Server maintenance countdown") in chat with yellow color (0xFFFF), increments milestone index, and advances to next milestone. If all 6 milestones consumed, disables the event (field 0x24=0).
0x00BA8E60117CUIEventManager__ctorConstructor for the UI event manager. Sets vtable to PTR_FUN_01198efc, initializes event count to 0, allocates a 12-byte linked list sentinel node (self-referential next/prev pointers), and sets active flag to 1 (field 0xC, stored as short).
0x00BA8EE067CUIEventManager__dtorDestructor for the UI event manager. Frees the 12-byte linked list sentinel node at field offset 4 if it's non-null.
0x00BA8F3078CUIEventManager__dtor_cleanupDestructor cleanup for CUIEventManager. Frees the 12-byte linked list sentinel node at field 4 if non-null. Note: this is NOT the scalar deleting destructor (no delete-self logic). The true scalar deleting dtor is CUIEventManager__destroy_and_delete at 00ba90e0.
0x00BA8F80103CUIEventManager__free_linked_listFrees all nodes in the event manager's linked list. Nullifies the tail pointer, walks the list from head freeing each 12-byte node, then frees the sentinel node itself. Does not invoke destructors on the contained event objects (just frees the list nodes).
0x00BA8FF0227CUIEventManager__destroy_all_eventsIn-place destructor for CUIEventManager. Sets vtable, iterates the event linked list and deletes each event via its virtual destructor. Clears and resets the list to empty (sentinel self-referential), zeros event count and active flag. Then frees remaining list nodes and the sentinel. Does NOT delete the manager object itself (that's the scalar deleting dtor's job).
0x00BA90E0248CUIEventManager__scalar_deleting_dtorScalar deleting destructor for CUIEventManager. Destroys all contained events by calling each event's virtual dtor (vtable[1] with delete=1), frees all linked list nodes, resets list to empty sentinel, zeroes event count and active flag, frees sentinel node. If param_2 bit 0 set, frees the 0x10-byte manager object. Standard MSVC scalar deleting destructor pattern.
0x00BA91F0213CUIEventManager__get_or_create_instanceSingleton getter for the global CUIEventManager. If DAT_016fda3c is null, allocates a new 0x10-byte CUIEventManager, initializes it (vtable, linked list sentinel, active flag). If initialization succeeds (active flag set), stores in global and returns 1. If init fails, destroys the object, nullifies global, returns 0. If already exists, returns 0 (already initialized).
0x00BA92D0108CUIEventManager__clear_all_eventsClears all events from the manager without destroying the manager itself. Iterates the linked list, calling each event's virtual destructor (vtable+4, param=1 to delete). Frees all list nodes, resets sentinel to self-referential, zeros event count and active flag byte at offset 0xD.
0x00BA934027CUIEventManager__destroy_singletonDestroys the singleton CUIEventManager instance. Calls the virtual destructor (with delete flag=1) on DAT_016fda3c and sets the global pointer to null.
0x00BA936044CUIEventManager__find_event_by_idSearches the event linked list for an event matching the given ID (field at offset 8 of the event object). Returns pointer to the event object if found, 0 if not found. Linear search through 12-byte list nodes where field 2 holds the event pointer.
0x00BA939044CUIEventManager__find_event_by_counterSearches the event linked list for an event matching the given counter value (field at offset 0x2C of the event object). Returns pointer to the event object if found, 0 if not found. Linear search through list nodes.
0x00BA93C0108CUIEventManager__remove_all_eventsRemoves and destroys all events from the manager. Same logic as clear_all_events: iterates list, calls each event's virtual destructor with delete, frees list nodes, resets sentinel to empty, zeros count and active flag. Standalone function (not thiscall on this).
0x00BA9430165CUIEventManager__create_and_add_eventCreates a new base event (0x30 bytes), initializes it with the current tick time (via _Xtime_get_ticks), the provided parameters, and a globally incrementing ID from DAT_0135d0a4. Adds the event to the manager's linked list via FUN_00ba9620. Returns the event pointer, or 0 if allocation failed.
0x00BA94E054CUIEventManager__reactivate_eventReactivates an existing event by updating its base time to the current tick (via _Xtime_get_ticks at offset 0x10) and re-adding it to the manager's list. Returns the event pointer, or 0 if input is null.
0x00BA952044CUIEventManager__has_event_with_counterChecks if any event in the linked list has a counter value (offset 0x2C) matching param_2. Returns 1 if found, 0 if not. Boolean version of find_event_by_counter.
0x00BA9550149CUIEventManager__process_eventsMain event processing loop. Skips if paused (offset 0xD != 0). Iterates all events in the linked list. For each active event (field 9 != 0): gets current ticks, checks if trigger time reached via check_trigger_time. If triggered and not paused (offset 0x25 == 0), calls the event's virtual handler (vtable[0]). For inactive events (field 9 == 0), unlinks from list, frees the 12-byte node, and calls the event's virtual destructor to delete it.
0x00BA95F039CUIEventManager__deactivate_events_by_counterDeactivates all events matching a given counter value (offset 0x2C). Sets the active flag (offset 0x24) to 0 for each matching event. The events will be cleaned up on the next process_events pass.
0x00BA9620165CUIEventManager__add_event_to_listAdds an event to the manager's linked list. Allocates a 12-byte list node, stores the event pointer at field 2, inserts at the front of the doubly-linked list (before the sentinel). Increments the event count (field 1). Throws std::length_error if count would exceed 0x15555555.
0x00BA96D0150CUINavigationHistory__ctorConstructor for UI navigation history object. Sets vtable to PTR_FUN_01198f04, initializes 3 groups of fields (fields 2-10) to zero, and sets enabled flag (offset 4, byte) to 1. The 3 groups likely correspond to 3 vectors of 24-byte string entries (history lists).
0x00BA9770214CUINavigationHistory__dtorDestructor for CUINavigationHistory. Sets vtable, then destroys 3 vectors of 24-byte string entries (at fields 2-3, 5-6, 8-9) by iterating each and calling STL_string_dtor on each 0x18-byte element. Finally calls CFmt__func_0058c230 three times to free the vector backing storage.
0x00BA9850244CUINavigationHistory__scalar_deleting_dtorScalar deleting destructor for CUINavigationHistory. Runs full destructor (destroys 3 vectors of string entries, frees backing storage). If param_2 bit 0 set, frees the 0x2C-byte object.
0x00BA9960245CUINavigationHistory__get_or_create_instanceSingleton getter for the global CUINavigationHistory instance (DAT_016fda40). If null, allocates 0x2C bytes, constructs the object inline (vtable, 3 empty vectors, enabled=1). Returns 1 if successfully created, 0 otherwise or if already exists. Destroys on initialization failure.
0x00BA9A60111CUINavigationHistory__clear_all_entriesClears all entries from the 3 navigation history vectors. Iterates each vector (at offsets 8/C, 14/18, 20/24), calling STL_string_dtor on each 0x18-byte entry. Resets each vector's end pointer to its begin pointer (empty).
0x00BA9AD027CUINavigationHistory__destroy_singletonDestroys the singleton CUINavigationHistory instance. Calls the virtual destructor (with delete flag=1) on DAT_016fda40 and nullifies the global pointer.
0x00BA9AF01560build_sprite_resource_pathBuilds a sprite resource file path string. Looks up sprite name from global tables (DAT_017335a4/DAT_017335b0) based on param_4 (gender: 0=female, 1=male) and param_5 index. Converts job class and palette index to strings, then formats the path. Checks if resource exists via CResourceMgr and falls back to alternate format string if needed. Handles MEISTER_MADOGEAR sprite name replacement.
0x00BAA110456build_sprite_path_with_extensionBuilds a sprite resource path string with a specific extension. Takes job class param_3, converts it to a string, then uses format_string_vsnprintf with a format string and extension from param_4 to produce the final path. Returns the result as an STL string in param_1.
0x00BAA2E0907build_body_sprite_pathBuilds a body sprite resource path. Uses job class and palette parameters to construct sprite paths like "%s_body_costume_%d_%s_%s_%d_%d.pal" or "%s_body_%s_%s_%d.pal". Handles costume vs non-costume sprites based on FUN_00e3d300 boolean check. Computes palette index from FUN_00e2ee70 with offset 0xf6e. Handles MEISTER_MADOGEAR1/2 replacement for class 2 (param_6==2).
0x00BAA6701176build_head_sprite_pathBuilds a head/headgear sprite resource path. Converts job class (param_5) and gender (param_4) parameters, gets head palette index via FUN_00e2ee70, and formats the path string. Handles costume variants (FUN_00e3d300 check) with different format strings. Uses CPacketStream__construct and get_boolean_status_string for path assembly. Falls back to standard format when no costume detected.
0x00BAAB101528build_shield_sprite_pathBuilds a shield sprite resource path. Validates shield ID (param_2, clamps to 10 for costume classes or 0xd/45 for normal). Looks up sprite name from global tables (DAT_017387c4 for male, DAT_017387d0 for female, or DAT_017335a4/DAT_017335b0). Checks resource existence via CResourceMgr and falls back to format_string_vsnprintf with alternate path. Uses get_boolean_status_string and CPacketStream__construct for final path.
0x00BAB1101112build_weapon_sprite_pathBuilds a weapon sprite resource path. Validates weapon class ID (param_3) with range checks (0-30, 1000-3999, or 20021-31999 excluded, defaults to 0). Looks up sprite name based on costume class (FUN_00e3cff0) from DAT_017387c4/d0 or DAT_017335a4/b0 tables. Formats path string with gender suffix and weapon type via format_string_vsnprintf, get_boolean_status_string, and CPacketStream__construct.
0x00BAB5D0637build_imf_resource_pathBuilds an IMF (animation frame) resource path. Gets animation index via FUN_00e2ee70, converts job class (param_3) and gender (param_4) to strings, then formats with "%s_%s.imf" pattern via format_string_vsnprintf. Uses FUN_00ddd100 to convert the index to a string component.
0x00BAB8501302build_head_palette_pathBuilds a head palette resource path. Checks costume status (FUN_00e3d300), gets palette index (FUN_00e2ee70 + 0xf6e offset), converts gender (param_4) to string. Formats path using format_string_vsnprintf with costume/normal format strings, get_boolean_status_string, and CPacketStream__construct. Handles MEISTER_MADOGEAR1/2 replacement for class 2 (param_6==2).
0x00BABEF0167get_boolean_status_stringConstructs a 6-character STL string representing a boolean status. Calls FUN_00e3cff0 to check a condition. If true, copies DAT_0119913c (likely "true" or "ON" equivalent). If false, copies DAT_01199144 (likely "false" or "OFF" equivalent). Returns the constructed string in param_1.
0x00BABFA0167get_race_string_doram_or_humanReturns a 5-character STL string: "Doram" if is_special_equip_location returns true, "Human" otherwise. Used for race-based sprite path construction.
0x00BAC0501811build_robe_sprite_pathBuilds a robe/garment sprite resource path. Returns empty string if param_5 (robe ID) < 1. Optionally transforms job class via FUN_00e130a0 if param_6 is true. Gets palette index via FUN_00e2ee70, converts gender and job class to strings, gets robe sprite name via lua_get_robe_sprite_name. Checks resource existence via CResourceMgr and formats path with alternate components if not found.
0x00BAE1461stub_nop_00bae146Single-byte stub function (size=1)
0x00BAE4B0143compute_angle_from_2d_vectorComputes an angle (in degrees, 0-360) from a 2D direction vector using a cosine lookup table at DAT_01388af0. Iterates through 0-180 degree entries, handles Y-axis reflection for 180-360 range. Stores result in param_3.
0x00BAE540129compute_rotated_3d_positionComputes a 3D position by applying rotation (sin/cos with param_5/param_6) and scaling (param_2) to input params, then adds base offset from param_8. Stores result XYZ in param_7.
0x00BC4E3A1stub_nop_00bc4e3aSingle-byte stub function (size=1)
0x00BE3B871stub_nop_00be3b87WARNING (jumptable): Unable to track spacebase fully for stack
0x00BE7270171rotate_quad_y_by_angleRotates 4 quad vertex Y-coordinates by a given angle. For each of the 4 vertex pointers (param_1 through param_4), computes new Y = sin(angle)*Y + cos(angle)*Z using the sin/cos lookup tables at DAT_01388af0/DAT_01387fa8. Only modifies the Y component (offset +4).
0x00BE7320583rotate_quad_vertices_by_anglesRotates 4 3D vertices (quad corners) by two angles using precomputed sin/cos tables. param_5 is X-axis rotation angle index, param_6 is Y-axis rotation angle index. Uses 360-entry lookup tables at DAT_01387fa8 (sin) and DAT_01388af0 (cos).
0x00BE757085init_and_project_billboard_vertexInitializes a billboard vertex structure (8 dwords: position, color=0xFF000000, UV) then calls CRenderPipeline__project_world_to_screen_with_depth to project from world to screen space.
0x00BF8E7073812static_init_hashset_and_vector_dataStatic init hashset and vector data
0x00C153911stub_nop_00c15391Single-byte stub function (size=1)
0x00C40B80132_Rehash_for_1STL hash table _Rehash_for_1. Ensures at least one bucket, reallocating and rehashing if necessary.
0x00C6530037check_effect_enabledChecks if an effect is enabled by calling FUN_00c36fc0 with (0,0,0). Returns true if result is non-zero.
0x00C7348037check_skill_sprite_animationChecks skill sprite animation state by calling CSkillEffect__advance_sprite_animation with (0, -80.0, 0). Returns true if animation is still playing.
0x00C79C9056dispatch_effect_type_0x38fDispatches effect type 0x38f (911) via FUN_00cadd60 with params (0x38f, 0, 0, 0). Does not return.
0x00C7B9E04set_byte_to_oneSets the byte at the given pointer to 1. Used as a flag/boolean setter.
0x00C7C110172CNetSocket__ctorConstructor for CNetSocket. Sets vtable, initializes socket FD to -1 (INVALID_SOCKET), field_18 (async flag) to 0, field_1c (send deadline) to 0. Initializes 3 CNetworkBuffer objects (recv, send, staging) and allocates 0xA000 bytes for each. Object size: 0x6c bytes.
0x00C7C280105CNetSocket__base_dtorBase destructor for CNetSocket. Resets vtable to CNetSocket, then destroys 3 CNetworkBuffer objects in reverse order via CNetworkBuffer__dtor_safe. Called by both CNetSocket and CNetworkSession scalar deleting dtors.
0x00C7C2F0126CNetSocket__scalar_deleting_dtorScalar deleting destructor for CNetSocket. Resets vtable, destroys 3 CNetworkBuffer objects in reverse order. If param_2 bit 0 is set, frees the 0x6c-byte object allocation. Used as virtual dtor.
0x00C7C400161verify_winsock_integrityAnti-tamper check verifying Winsock function addresses haven't been hooked. Loads ws2_32.dll and compares GetProcAddress results for connect, closesocket, send(?), and select against the already-loaded module's addresses. Returns 1 if all match (no hooks detected), 0 if any function has been redirected. Used as part of anti-cheat/anti-bot detection.
0x00C7C4B019winsock_cleanupCleans up Winsock: calls WSACleanup() and FreeLibrary on the loaded Winsock DLL handle stored in global DAT_016fdc88.
0x00C7C4D0854CNetSocket__connect_to_serverEstablishes a TCP connection to a game server. Drains any pending receive buffer, resets send/receive buffers (0xA000 each), creates a non-blocking socket (AF_INET/SOCK_STREAM), resolves IP via inet_addr, sets port via htons, and calls connect(). Returns 1 on success or WSAEWOULDBLOCK (0x2733), 0 on failure. Stores server address info at this+8.
0x00C7C830318CNetSocket__disconnectDisconnects the network socket. Calls closesocket() if socket is valid, resets socket handle to INVALID_SOCKET (-1), resets send/receive buffers (0xA000), clears connection state at +0x20. Inserts/updates a tree node with key=5 to track disconnect state in the UI navigation map.
0x00C7C97079get_job_sprite_countReturns the number of sprites for a given job class ID. Special cases: job 0x2BF returns 12, job 0x2C0 returns 4. For other jobs, looks up the job info table and returns the sprite count (minimum 2).
0x00C7C9C013get_socket_portReturns the port value (2 bytes) from the structure pointed to by param_1.
0x00C7C9E035CNetSocket__is_fixed_size_packetChecks if a given packet ID is a fixed-size packet by looking up the packet table. Returns true if the packet type field equals 1 (fixed-size), false otherwise (variable-size). Used by CNetSocket__read_packet to determine how to read packet length.
0x00C7CA40238CNetSocket__recv_all_pendingReads all pending data from the network socket into the receive buffer. Uses select() with zero timeout to poll for available data, then recv() into a 2048-byte temp buffer. Loops until no more data is available. On WSA errors other than WOULDBLOCK/INPROGRESS, disconnects. Returns 1 on success, 0 on disconnect.
0x00C7CB30252CNetSocket__flush_send_bufferFlushes pending send buffer data to the socket. Checks if current time exceeds the send deadline at +0x1C, then uses select() to check socket writability, and send() to transmit data from the send buffer. Advances the buffer read position on successful send. Handles WSAEWOULDBLOCK/INPROGRESS gracefully. Returns 1 on success/would-block, 0 on fatal error (disconnects).
0x00C7CCE0198CNetSocket__read_packetReads a complete packet from the receive buffer. Peeks the first 2 bytes to get the packet ID, then looks up the job/packet info. For fixed-size packets (type==1), uses get_job_sprite_count logic for size. For variable-size packets, reads bytes 2-3 as the length field (shifted right 16). Reads the full packet data and optionally outputs the packet size. Returns 1 on success, 0 if insufficient data.
0x00C7CED0322CNetSocket__set_batch_mode_and_flushSets the async/batch mode flag at +0x18 to param_2. If turning off batch mode (param_2=false), flushes all pending send buffer data by iterating: copies queued data to the socket send buffer, advances read position, and sends via select+send. Handles WSAEWOULDBLOCK/INPROGRESS gracefully. Disconnects on fatal send errors.
0x00C7D020250CNetSocket__init_winsockInitializes Winsock (WSAStartup v1.1), loads ws2_32.dll, and resolves send/recv function pointers via GetProcAddress. Also performs an integrity check by loading ws2_32.dll a second time and comparing function addresses for connect, closesocket, send, and select to detect API hooking. Stores function pointers in globals.
0x00C7D930110CNetSocket__free_send_buffer_chainFrees a linked list of aligned send buffer blocks. Resets the count at param_2[1], then iterates the linked list starting at *param_2, freeing each block via operator_delete using the stored original allocation pointer at block[-1]. Validates alignment offset before freeing.
0x00C7D9B089CNetSocket__free_aligned_bufferFrees a single 32-byte-aligned buffer block. Reads the original allocation pointer at block[-4], validates the alignment offset is <= 31, then calls operator_delete with the original pointer. The buffer at this+4 was allocated with extra 0x23 bytes for alignment.
0x00C7DA10100CNetSocket__free_recv_bufferFrees the receive buffer at this+4. Reads original allocation pointer from block[-4], validates alignment offset is <= 31, then calls operator_delete. Nearly identical to free_aligned_buffer but with different SEH handler.
0x00C7DA80593CNetSocket__encrypt_and_queue_packetXOR-encrypts a packet and adds it to the send queue. Encryption key is derived from param_2 (2 ushorts XORed for length, second ushort used as XOR byte). Optimized: for data >= 64 bytes, does 64-byte blocks using 4-byte XOR; remainder done byte-by-byte. Pads remaining space (up to 0x1000 bytes) with random data. Allocates a 0x41000-byte aligned buffer, copies encrypted data, and inserts into a linked list. Max queue length is 0x3F03.
0x00C7DCE0580CNetSocket__encrypt_and_queue_packet_altAlternative XOR-encrypt and queue function, nearly identical to encrypt_and_queue_packet but uses a different list head (this+8/0xC instead of this+0/4). Same encryption: XOR with key byte from param_2[1], 64-byte optimized blocks, random padding to 0x1000, then allocates a 0x41000-byte aligned buffer and inserts into a linked list. Max queue 0x3F03.
0x00C7DF30105passthrough_copy_bufferNo-op encryption stub. Copies data from param_1 to a 1024-byte stack buffer, then copies it back unchanged. Sets *param_3 = param_2 (output size = input size). Always returns 0. Likely a placeholder/disabled encryption function.
0x00C7E030116find_code_signature_patternSearches for a specific code signature pattern starting from param_1. Compares against global pattern at DAT_0135e600 (4+2 bytes). If the start matches, returns immediately. Otherwise scans forward byte-by-byte looking for the 6-byte pattern. Returns pointer to the match location + 1.
0x00C7E1B026write_relative_call_instructionWrites a relative CALL instruction (opcode 0xE8) at param_1 targeting param_2. Computes the relative offset as (target - (source + 5)) for standard x86 near call encoding.
0x00C7E1D020write_relative_offsetWrites a 4-byte relative offset at param_1, computed as (target - source - 4). Used for patching relative jumps/calls where the opcode byte has already been written.
0x00C7E1F026write_relative_jmp_instructionWrites a relative JMP instruction (opcode 0xE9) at param_1 targeting param_2. Computes relative offset as (target - (source + 5)) for standard x86 near JMP encoding.
0x00C7EE90206CNetworkBuffer__init_with_sizeInitializes a network buffer with a specified capacity. Zeros out the header fields (6 dwords), then resizes the underlying vector to the requested size, zero-filling if needed. Sets the data pointer to the start of the buffer (or null if empty). Used for send/receive buffers.
0x00C7EF6096CNetworkBuffer__init_emptyInitializes a network buffer to an empty state. Zeros the vector fields (base, end, capacity at offsets +0xC/+0x10/+0x14) and the data pointer at offset 0. No allocation is performed.
0x00C7EFC068CNetworkBuffer__dtor_safeSEH-safe destructor wrapper for network buffer. Calls STL_lib_func_004f9500 to free the buffer. Used by CNetworkSession cleanup.
0x00C7F01058CNetworkBuffer__read_bytesReads param_2 bytes from the network buffer into param_3. Buffer structure: [0]=data ptr, [4]=read offset, [8]=data size. Returns 0 if not enough data available. Advances read offset on success. Returns 1 on success.
0x00C7F0507CNetworkBuffer__get_available_bytesReturns the number of available (unread) bytes in the network buffer. Computed as field[8] (write offset / data size) minus field[4] (read offset).
0x00C7F060120CNetworkBuffer__reset_with_sizeResets a network buffer and resizes to the specified capacity. Clears read/write offsets at +4/+8, resizes the internal vector to param_2 bytes (zero-filling new space), and sets the data pointer. Used to reset send/receive buffers to 0xA000 bytes.
0x00C7F0E0122CNetworkBuffer__append_dataAppends data to the network buffer. If the buffer doesn't have enough space, first tries to compact by moving unread data to the front (discarding already-read bytes). If still not enough, resizes to 2x the needed size. Copies param_2 bytes from param_3 to the write position and advances the write offset.
0x00C7F160329CNetworkBuffer__prepend_dataPrepends data to the front of the network buffer. Allocates a new buffer if needed, copies the new data first, then copies existing unread data after it. Resets the read offset to 0 and adjusts the write offset. Swaps the old and new buffer vectors and frees the old one.
0x00C7F2B047CNetworkBuffer__peek_bytesPeeks param_2 bytes from the network buffer into param_3 without advancing the read offset. Same as read_bytes but does not update field [4]. Returns 0 if not enough data, 1 on success.
0x00C7F2E039CNetworkBuffer__skip_bytesSkips param_2 bytes in the network buffer by advancing the read offset. Returns 0 (with high bytes cleared) if not enough data available. Returns 1 and advances offset on success.
0x00C7F31094CNetworkBuffer__resizeResizes the network buffer to param_2 bytes. If shrinking, just moves the write pointer back. If growing within capacity, zero-fills the new space. If growing beyond capacity, calls std__vector_reallocate_and_fill to reallocate.
0x00C7F370147decrypt_packet_data_ariaDecrypts packet data using ARIA cipher. On first call, initializes ARIA key expansion with a hardcoded 32-byte key. Then decrypts param_1 into param_2 using aria_decrypt_block. The 16-byte input block is zero-padded for alignment.
0x00C7F45036CNetworkBuffer__scalar_deleting_dtorScalar deleting destructor for CNetworkBuffer (size 0x2c). Sets vtable to PTR_FUN_0119fa94. If bit 0 of param_2 is set, frees memory via FUN_00e6227f.
0x00C7F480135CPacketObfuscation__init_keysInitializes packet obfuscation keys. Extracts nibbles from param_2 to compute key1 (stored at +4). Computes key2 (+8) as 0x343fd. Computes key3 (+0xc) by XOR-ing shuffled nibbles with param_3. The nibble extraction creates a deterministic key from the seed values.
0x00C7F53055get_frame_tick_countComputes the number of frame ticks elapsed since the last call. Uses timeGetTime() divided by the frame interval (DAT_0171dd14). Returns 1 if frame tracking is disabled (DAT_01361654==0), otherwise returns actual elapsed ticks.
0x00C7F57031set_target_framerateSets the target framerate. Stores current time as baseline (DAT_0171dd10) and computes frame interval as 1000/param_1 milliseconds per frame (DAT_0171dd14). E.g., param_1=60 gives ~16ms per frame.
0x00C7F59012reset_frame_timerResets the frame timer baseline to the current time via timeGetTime(). Stored in global DAT_0171dd10.
0x00C7F5B051copy_bytes_with_offsetCopies param_4 bytes from (param_1 + param_3) to param_2. Clears each destination byte to 0 before writing. Simple byte-by-byte copy with source offset.
0x00C8104016memset_wrapperSimple wrapper around memset. Fills param_1 buffer with param_2 byte value for param_3 bytes.
0x00C811A0296sort_median_of_nine_uintMedian-of-nine pivot selection for introsort of uint arrays. For small ranges (<0x29 elements), uses median-of-three. For larger ranges, samples 9 evenly-spaced elements and sorts them to find a good pivot.
0x00C815C0379sort_partition_uintThree-way partition for introsort of uint arrays. Uses median-of-nine pivot. Partitions elements into [less, equal, greater] groups. Returns partition bounds via param_1 output pair.
0x00C82960472introsort_uintIntrosort implementation for uint arrays. Uses three-way partitioning with median-of-nine pivot selection. Falls back to heap sort when recursion depth exceeds threshold, and insertion sort for small partitions (<=32 elements).
0x00C83AB0191CStreamFile__ctorCStreamFile constructor. Sets up vtable (initially base, then derived), initializes file stream fields to defaults. Mode 0x221 (read\|text), stream positions at 0xC and 0x10.
0x00C83B70167CIOStreamFile__ctorCIOStreamFile constructor (read/write stream). Sets up vtable, initializes mode to 0x809, stream positions at 0x10 and 0x14. Derived from base stream class.
0x00C83F20176CTextStreamFile__ctorCTextStreamFile constructor. Initializes base stream, sets vtable for text stream file, mode 0x201, stream positions at 6 and 10. Extra fields for text-specific state.
0x00C83FD0292CMemStreamBuf__ctorCMemStreamBuf constructor. Initializes a memory-based stream buffer wrapping std::basic_iostream. Creates a basic_streambuf with custom vtable, initializes internal buffer state. Used for in-memory I/O.
0x00C84100175CBinaryStreamFile__ctorCBinaryStreamFile constructor. Initializes base stream, sets vtable for binary stream file, mode 0x205, stream positions at 8 and 12.
0x00C841B0175CBaseStreamNode__copy_ctorCBaseStreamNode copy constructor. Copies vtable, mode field, two sub-vectors (via copy ctors), scalar fields, and calls sub-object copy at offset 0x30.
0x00C84260175CBaseStreamNode__copy_ctor_00c84260CBaseStreamNode copy constructor (duplicate at different address). Same logic as CBaseStreamNode__copy_ctor - copies all fields and sub-objects from source.
0x00C84310281CBaseStreamNode__ctor_defaultCBaseStreamNode default constructor. Sets vtable, zeroes all sub-vectors and scalar fields. Allocates and copies a 7-byte default string at offset 0xD. Mode set to 0x85.
0x00C844301135CResourceEntry__copy_ctorCResourceEntry copy constructor for a large 0x2F8-byte resource entry. Contains 8+ sub-nodes each with their own vtables, sub-vectors, and scalar fields. Deep copies all sub-objects including vectors, strings, and an 8-byte pair vector.
0x00C848A0975CResourceEntry__ctor_defaultCResourceEntry default constructor for a 0x2F8-byte resource entry. Initializes 8 sub-nodes with different vtables and modes. Each sub-node is a stream node with vectors and scalar fields. Sets various default modes (0x201, 0x205, 0xFD, 0xBE, 0xBD, 0x203, 0x27E).
0x00C84C70549CResourceManager__ctorCResourceManager constructor. Allocates a 0x200-byte buffer (zero-filled), initializes std::iostream with custom streambuf for memory-based I/O, initializes internal state fields at the end of the object. Large object (~0x330 bytes).
0x00C84EA0199CStreamNodeTypeD7__ctorCStreamNodeTypeD7 default constructor. Initializes base stream node, sets derived vtable, mode 0xD7. Has 4 extra dwords at offsets 0x28-0x34 beyond base stream node fields.
0x00C84F70190CStreamNodeType200__ctorCStreamNodeType200 default constructor. Initializes base stream node, sets derived vtable, mode 0x200. Has extra fields (dword, short) and stream positions at 0xE and 0x12.
0x00C85030212CStreamNodeTypeFF__ctorCStreamNodeTypeFF default constructor. Initializes base stream node, sets derived vtable, mode 0xFF. Has many extra zero-initialized dwords. Stream positions at 2 and 6.
0x00C85110223CStreamNodeWithFont__copy_ctorCStreamNodeWithFont copy constructor. Copies base stream node fields plus font-specific fields: short pairs, byte flags, and a sub-object at offset 0x38 via FUN_00c86c80.
0x00C851F0223CStreamNodeWithFont__copy_ctor_00c851f0CStreamNodeWithFont copy constructor (duplicate at different address). Same logic as CStreamNodeWithFont__copy_ctor.
0x00C852D0301CStreamNodeWithFont__ctor_defaultCStreamNodeWithFont default constructor. Initializes base stream node, sets derived vtable, mode 0x31. Default font size 200/0x1907FFF, default font name 'Arial' (wchar_t). Flag at offset 0x10 set to 1.
0x00C85400966CResourceSubEntry__copy_ctorCResourceSubEntry copy constructor. Very large sub-entry with 6+ sub-nodes, each containing its own vtable, vectors, and scalar fields. Deep copies all sub-objects including vectors and a ushort vector at the end.
0x00C857D0867CResourceSubEntry__ctor_defaultCResourceSubEntry default constructor. Initializes 6 sub-nodes with different vtables and modes. Modes include 0x221, 0xBC, 0x4BC, 0x36, 0x207. Stream positions configured per sub-node. Total size ~0x170 bytes.
0x00C85B40296OLECompoundHeader__initInitializes an OLE Compound Document header (magic 0xE11AB1A1E011CFD0). Sets version 3.003B, sector size 0x1000, FAT/DIFAT entries to 0xFFFFFFFE. Fills directory sector IDs with 0xFFFFFFFF. Generates two random values at end.
0x00C85C70320CStreamNodeType20B__ctorCStreamNodeType20B default constructor. Initializes base stream node, mode 0x20B. Has extra uint vector and dword fields. Ensures vector has at least 1 element (resizes if needed). Stream positions at 0x10 and 0x14.
0x00C85DB0179CStreamNodeTypeFD__ctorCStreamNodeTypeFD default constructor. Initializes base stream node, sets derived vtable for type 0xFD. Extra fields: dword at 0x28, short at 0x2C, dword at 0x30. Stream positions at 10 and 14.
0x00C85E70122CStreamElement__copy_ctorCStreamElement copy constructor. Copies a ushort vector (at offset 0), a sub-vector (at offset 0xC), a byte flag (0x18), a short (0x1A), and a dword (0x1C).
0x00C85EF0127CStreamElement__ctor_defaultCStreamElement default constructor. Zeroes 8 dwords, sets byte at offset 0x18 to 0xFF, zeroes remaining fields. Total size 0x20 bytes.
0x00C85F70189CStreamNodeTypeBE__ctorCStreamNodeTypeBE default constructor. Initializes base stream node, mode 0xBE. Extra fields: 4 dwords and a short, all zeroed. Stream positions at 10 and 14.
0x00C86030189CStreamNodeTypeBD__ctorCStreamNodeTypeBD default constructor. Initializes base stream node, mode 0xBD. Extra fields: 4 dwords and a short, all zeroed. Stream positions at 10 and 14.
0x00C860F0184CStreamNodeType203__ctorCStreamNodeType203 default constructor. Initializes base stream node, mode 0x203. Extra fields: dword, short, and 8-byte value, all zeroed. Stream positions at 14 and 18.
0x00C861B0155OLEDirectoryEntry__initInitializes an OLE Compound Document directory entry (0x7C bytes). Zeroes first 0x40 bytes (name), sets type to 0x101, sibling/child IDs to 0xFFFFFFFF, start sector to 0xFFFFFFFE.
0x00C862B0179CStreamNodeType27E__ctorCStreamNodeType27E default constructor. Initializes base stream node, mode 0x27E. Extra fields: dword, short, dword. Stream positions at 10 and 14.
0x00C86370131CBaseStreamNode__base_ctorCBaseStreamNode bare base constructor. Only initializes the vtable and base stream fields (10 dwords). No derived fields are set.
0x00C86400197CStreamNodeType208__copy_ctorCStreamNodeType208 copy constructor. Copies base stream node fields, then copies extra short pairs and a dword at offset 0x34. Sets derived vtable.
0x00C864D0197CStreamNodeType208__copy_ctor_00c864d0CStreamNodeType208 copy constructor (duplicate at different address). Identical logic to CStreamNodeType208__copy_ctor.
0x00C865A0185CStreamNodeType208__ctor_defaultCStreamNodeType208 default constructor. Initializes base stream node, mode 0x208. Extra fields zeroed except color at offset 0x2C (0xFF0000 = blue in ABGR). Stream positions at 0x10 and 0x14.
0x00C86660276CStreamNodeD7Container__move_ctorCStreamNodeD7Container move constructor. Moves two vector members (0x38 and 0x2F8 element sizes) by stealing pointers, then copies a stream sub-node and moves a ushort vector.
0x00C86780428CStreamNodeD7Container__copy_ctorCStreamNodeD7Container copy constructor. Deep copies two vectors (0x38 and 0x2F8 element sizes) via uninitialized_copy, then copies a stream sub-node (type D7) and a ushort vector.
0x00C86930253CStreamNodeD7Container__ctor_defaultCStreamNodeD7Container default constructor. Initializes two empty vectors, a stream sub-node (mode 0xD7), and a ushort vector. Sets vtable for the sub-node.
0x00C86A30206CStreamNodeTypeFC__ctorCStreamNodeTypeFC default constructor. Initializes base stream node, mode 0xFC. Extra fields: 5 dwords zeroed. Stream positions at 8 and 12.
0x00C86B00188CStreamNodeType4BC__ctorCStreamNodeType4BC default constructor. Initializes base stream node, mode 0x4BC. Extra fields: 5 dwords zeroed. Stream positions at 8 and 12.
0x00C86BC0188CStreamNodeTypeBC__ctorCStreamNodeTypeBC default constructor. Mode 0xBC. Extra fields: 5 dwords zeroed. Stream positions at 8 and 12.
0x00C86C80169CStringPair__copy_ctorCStringPair copy constructor. Copies a wchar_t* string (offset 0) and a char* string (offset 4) by deep-copying via strlen+alloc+strcpy. Also copies a byte at offset 8.
0x00C86D40192CStreamNodeType207__ctorCStreamNodeType207 default constructor. Mode 0x207. Extra fields: 3 dwords zeroed. Stream positions at 0 and 4.
0x00C86E00225CStreamNodeType293__copy_ctorCStreamNodeType293 copy constructor. Copies base stream node, then extra short, byte, ushort vector, sub-vector, byte, short, and dword fields.
0x00C86EF0225CStreamNodeType293__copy_ctor_00c86ef0CStreamNodeType293 copy constructor (duplicate). Identical to CStreamNodeType293__copy_ctor.
0x00C86FE0248CStreamNodeType293__ctor_defaultCStreamNodeType293 default constructor. Mode 0x293. Default color 0xFF008000 (green with alpha). Extra ushort and sub-vectors, byte fields. Stream positions at 2 and 6.
0x00C870E0181CStreamNodeType36__ctorCStreamNodeType36 default constructor. Mode 0x36. Extra fields: 4 dwords zeroed. Stream positions at 0x10 and 0x14.
0x00C871A0204CStreamNodeType3D__ctorCStreamNodeType3D default constructor. Mode 0x3D. Pixel format 120x120, color 0x24543B1F, size 0x38, flags 0x10000, DPI 600. Stream positions at 0x12 and 0x16.
0x00C87270193CStreamNodeType23E__ctorCStreamNodeType23E default constructor. Mode 0x23E. Default ID 0x6B6, flags 0x400000. Stream positions at 0x12 and 0x16.
0x00C87340704CDocumentStream__ctorCDocumentStream constructor. Initializes CIOStreamFile base, then constructs stream node type 3D, FC, FF sub-objects. Sets magic values (0x50600, 0x7CD19A0, 0xC0C9, 0x306) for document identification. Initializes hash/index sub-structure.
0x00C87600813CIOStreamNode__copy_ctorCIOStreamNode copy constructor. Large compound node (0x124 bytes) with 4 sub-nodes (types 20B, 200, 23E, 0A), multiple vectors, and scalar fields. Deep copies all sub-objects. Moves two ushort vectors (steal pointers).
0x00C87930856CIOStreamNode__copy_ctor_00c87930CIOStreamNode copy constructor (variant). Same structure as CIOStreamNode__copy_ctor but copies a 0x50-element vector instead of moving ushort vectors at offset 0xB4.
0x00C87C90682CDocumentStream__ctor_variantCDocumentStream constructor variant. Initializes CIOStreamFile, then constructs sub-nodes: type 20B, type 200, type 23E, type FF. Sets document magic values. Similar to CDocumentStream__ctor but with different sub-node type 200 instead of 3D.
0x00C87F40215CStreamNodeTypeE0__copy_ctorCStreamNodeTypeE0 copy constructor. Copies base stream node, then short pairs, byte pairs, two dwords, and a short at offset 0x3C.
0x00C88020215CStreamNodeTypeE0__copy_ctor_00c88020CStreamNodeTypeE0 copy constructor (duplicate). Identical to CStreamNodeTypeE0__copy_ctor.
0x00C88100198CStreamNodeTypeE0__ctor_defaultCStreamNodeTypeE0 default constructor. Mode 0xE0. Default color 0x20FFF5, short 0x20C0. Stream positions at 0x14 and 0x18.
0x00C881E0167CStreamNodeType0A__ctorCStreamNodeType0A default constructor. Mode 0x0A. Minimal base node with stream positions at 0 and 4.
0x00C888E0190CMemStreamBuf__dtorCMemStreamBuf destructor. Resets iostream vtables, flushes/frees internal buffer if allocated, destroys streambuf and iostream base classes.
0x00C88DE0115CBaseStreamNode__dtor_baseCBaseStreamNode base destructor. Destroys string data, resets vtable, deallocates int vector, destroys remaining string.
0x00C88E60100CBaseStreamNode__dtor_simpleCBaseStreamNode simple destructor. Resets vtable, deallocates int vector, destroys string.
0x00C88ED0137CDocumentStream__dtor_compoundCDocumentStream compound destructor. Destroys hash table (if allocated), 0x1C-element vector, 0x124-element vector (CIOStreamNode elements), CIOStreamNode sub-object, and CDocumentStream sub-object in order.
0x00C88FB0100CBaseStreamNode__dtor_simple_00c88fb0CBaseStreamNode simple destructor (duplicate). Resets vtable, deallocates int vector, destroys string.
0x00C8902086CStreamNodeD7Container__dtor_subCStreamNodeD7Container sub-destructor. Destroys sub-object and string data.
0x00C89080100CStreamNodeType203__dtorCStreamNodeType203 destructor. Resets vtable, deallocates int vector, destroys string.
0x00C890F0153CBaseStreamNode__dtor_with_stringsCBaseStreamNode destructor with string cleanup. Frees char* at offset 0x34 and wchar_t* at offset 0x30, then destroys base stream node (vtable, int vector, string).
0x00C89190435CResourceEntry__dtorCResourceEntry destructor for the 0x2F8-byte resource entry. Destroys all 8+ sub-nodes in reverse order, each with their own vtable resets, vector deallocations, and string cleanups.
0x00C893A0180CDocumentStream__dtor_subCDocumentStream sub-destructor. Destroys hash table, uint vector, sub-containers, and string data in order.
0x00C89460115CStreamNodeType20B__dtorCStreamNodeType20B destructor. Destroys uint vector, resets vtable, deallocates int vector, destroys string.
0x00C894E0100CStreamNodeTypeD7__dtorCStreamNodeTypeD7 destructor. Resets vtable, deallocates int vector, destroys string.
0x00C89550139CStreamNodeType200__dtorCStreamNodeType200 destructor. Destroys two sub-containers, JSON data, resets vtable, deallocates int vector, destroys string.
0x00C895E0153CStreamNodeWithFont__dtorCStreamNodeWithFont destructor. Frees char* and wchar_t* font strings at offsets 0x3C and 0x38, resets vtable, deallocates int vector, destroys string.
0x00C89680399CResourceSubEntry__dtorCResourceSubEntry destructor. Destroys all 6 sub-nodes in reverse order, each resetting vtables and freeing vectors/strings.
0x00C89810115CStreamNodeType293__dtorCStreamNodeType293 destructor. Destroys ushort vector, resets vtable, deallocates int vector, destroys string.
0x00C89890100CStreamNodeType208__dtorCStreamNodeType208 destructor. Resets vtable, deallocates int vector, destroys string.
0x00C8990086CStreamElement__dtorCStreamElement destructor. Destroys string data and wstring (2-byte) data.
0x00C89960115CStreamNodeType20B__dtor_fullCStreamNodeType20B full destructor. Destroys uint vector sub-data, resets vtable, deallocates int vector, destroys string.
0x00C899E0115CStreamNodeTypeFD__dtorCStreamNodeTypeFD destructor. Destroys sub-data, resets vtable, deallocates int vector, destroys string.
0x00C89A60100CStreamNodeType4BC__dtorCStreamNodeType4BC destructor. Resets vtable, deallocates int vector, destroys string.
0x00C89AD0207tree_node_recursive_destroyRecursively destroys a tree of 0x18-byte nodes. For each node in the pointer vector at offset 0xC, recursively destroys children then frees the 0x18-byte node. Finally deallocates the pointer vector.
0x00C89BA0100CStreamNodeTypeBC__dtorCStreamNodeTypeBC destructor. Resets vtable, deallocates int vector, destroys string.
0x00C89C1093CStreamNodeType0A__dtorCStreamNodeType0A destructor. Resets vtable, deallocates int vector, destroys string.
0x00C89C70100CStreamNodeType27E__dtorCStreamNodeType27E destructor. Resets vtable, deallocates int vector, destroys string.
0x00C89CE0146CStreamNodeTypeFF__dtorCStreamNodeTypeFF destructor. Destroys sub-container, resets vtable, deallocates int vector, destroys string, destroys two additional sub-objects.
0x00C89D80115CStreamNodeTypeBD__dtorCStreamNodeTypeBD destructor. Destroys sub-data, resets vtable, deallocates int vector, destroys string.
0x00C89E00115CStreamNodeTypeBE__dtorCStreamNodeTypeBE destructor. Destroys string, resets vtable, deallocates int vector, destroys string.
0x00C89E80115CStreamNodeType36__dtorCStreamNodeType36 destructor. Destroys string, resets vtable, deallocates int vector, destroys string.
0x00C89F0049CStringPair__dtorCStringPair destructor. Frees the char* string at offset 4 and the wchar_t* string at offset 0.
0x00C89F40115CStreamNodeType207__dtorCStreamNodeType207 destructor. Destroys wstring, resets vtable, deallocates int vector, destroys string.
0x00C89FC0140CStreamNodeTypeE0__dtorCStreamNodeTypeE0 destructor. Destroys string, wstring data, resets vtable, deallocates int vector, destroys remaining string.
0x00C8A050100CStreamNodeType23E__dtorCStreamNodeType23E destructor. Resets vtable, deallocates int vector, destroys string.
0x00C8A0C0100CStreamNodeType3D__dtorCStreamNodeType3D destructor. Resets vtable, deallocates int vector, destroys string.
0x00C8A130100CStreamNodeTypeFC__dtorCStreamNodeTypeFC destructor. Resets vtable, deallocates int vector, destroys string.
0x00C8A1A0339CIOStreamNode__dtorCIOStreamNode destructor. Destroys 4 sub-nodes (types BE, 200, 20B, base) in reverse order, each resetting vtables and freeing vectors/strings.
0x00C8A300333CIOStreamNode__dtor_variantCIOStreamNode destructor variant. Destroys sub-nodes 0A, 23E, 200, 20B, and base in reverse order with int vector deallocations.
0x00C8A450100CStreamNodeTypeFD__dtor_simpleCStreamNodeTypeFD simple destructor. Resets vtable, deallocates int vector, destroys string.
0x00C8A4C0100CStreamNodeType27E__dtor_simpleCStreamNodeType27E simple destructor. Resets vtable, deallocates int vector, destroys string.
0x00C8A590234CBaseStreamNode__assignCBaseStreamNode assignment operator. Copies stream data via memcpy helper, copies scalar fields, frees existing char
0x00C8A680187CStreamElement__assignCStreamElement assignment operator. Copies byte, short, dword fields, then copies byte vector (with realloc if needed) and ushort vector.
0x00C8A740142CStreamElement__set_from_char_stringCStreamElement set from char* string. Resets element, clears ushort vector, resizes byte vector to match string length, copies string bytes.
0x00C8A7D089CStreamElement__set_from_wchar_stringCStreamElement set from wchar_t* string. Resets element, clears byte vector, sets wchar mode flag, resizes ushort vector to match wstring length, copies wchar data.
0x00C8A830195CBaseStreamNode__copy_dataCBaseStreamNode copy data helper. Copies mode field, byte vector (with realloc), scalar fields, and int vector (with realloc) from source to this.
0x00C8A900201CStringPair__assignCStringPair assignment operator. Frees existing strings, then deep-copies char* and wchar_t* strings from source. Copies byte flag at offset 8.
0x00C8A9D0110CStringPair__set_char_stringCStringPair set from char* string. Clears flag, frees existing strings, allocates and copies the char* string to offset 4.
0x00C8AA40137CStringPair__set_wchar_stringCStringPair set from wchar_t* string. Sets flag to 1, frees existing strings, allocates and copies the wchar_t* string to offset 0.
0x00C8AAD0749CIOStreamNode__move_assignCIOStreamNode move assignment. Copies base stream data, short pairs, and dwords. Moves multiple internal vectors by stealing pointers (zeroing source). Handles sub-nodes at multiple offsets throughout the 0x124-byte structure.
0x00C8ADC0394CResourceSubEntry__assignCResourceSubEntry assignment operator. Copies stream data for multiple sub-nodes, moves internal vectors, copies short/dword scalar fields. Handles the full ~0x170 byte sub-entry structure.
0x00C8AF5029json_value_write_to_streamWrites a JSON value to an ostream. Handles 4 types: 0=char, 1=int, 2=double, 3=string. Dispatches based on type tag at *param_2.
0x00C8B040199CMemStreamBuf__dtor_baseCMemStreamBuf base destructor. Resets iostream vtables, flushes/frees internal buffer if allocated, destroys streambuf, iostream, and basic_ios base classes.
0x00C8B11041CMemStreamBuf__scalar_deleting_dtorCMemStreamBuf scalar deleting destructor. Calls base destructor, then optionally frees the 0xC0-byte object if flag bit 0 is set.
0x00C8B140136CBaseStreamNode__scalar_deleting_dtorCBaseStreamNode scalar deleting destructor. Calls base dtor, optionally frees 0x40-byte object.
0x00C8B1D0121CStreamNodeType208__scalar_deleting_dtorCStreamNodeType208 scalar deleting destructor. Calls dtor, optionally frees 0x38-byte object.
0x00C8B250121CStreamNodeTypeFD__scalar_deleting_dtorCStreamNodeTypeFD scalar deleting destructor. Calls dtor, optionally frees 0x30-byte object.
0x00C8B2D0121CStreamNodeType27E__scalar_deleting_dtorCStreamNodeType27E scalar deleting destructor. Calls dtor, optionally frees 0x30-byte object.
0x00C8B35035CStreamNodeType3C__scalar_deleting_dtorCStreamNodeType3C scalar deleting destructor. Calls string-cleanup dtor, optionally frees 0x3C-byte object.
0x00C8B380136CStreamNodeType20B__scalar_deleting_dtorCStreamNodeType20B scalar deleting destructor. Calls uint vector dtor, optionally frees 0x38-byte object.
0x00C8B410121CStreamNodeTypeD7__scalar_deleting_dtorCStreamNodeTypeD7 scalar deleting destructor. Calls dtor, optionally frees 0x38-byte object.
0x00C8B49035CStreamNodeType200__scalar_deleting_dtorCStreamNodeType200 scalar deleting destructor. Calls full dtor, optionally frees 0x50-byte object.
0x00C8B4C035CStreamNodeWithFont__scalar_deleting_dtorCStreamNodeWithFont scalar deleting destructor. Calls CStreamNodeWithFont__dtor, optionally frees 0x44-byte object.
0x00C8B4F038CResourceSubEntry__scalar_deleting_dtorCResourceSubEntry scalar deleting destructor. Calls full dtor, optionally frees 0x170-byte object.
0x00C8B520136CStreamNodeType293__scalar_deleting_dtorCStreamNodeType293 scalar deleting destructor. Destroys ushort vector, resets vtable, deallocates int vector, destroys string. Optionally frees 0x44-byte object.
0x00C8B5B0121CUIWidget__scalar_deleting_dtorScalar deleting destructor for a CUIWidget-derived class (vtable at 0x0119fac8, size 0x34). Sets vtable, destroys child vector (4-byte elements), calls base destructor, then optionally frees the object if param_2 bit 0 is set.
0x00C8B630136CUIWidget_0x3C__scalar_deleting_dtorScalar deleting destructor for a CUIWidget subclass (vtable at 0x0119fac8, size 0x3C). Destroys 0x44-byte vector reserve, sets vtable, destroys child vector (4-byte elements), calls base destructor. Optionally frees object if param_2 bit 0 is set.
0x00C8B6C0136CUIWidget_0x3C__scalar_deleting_dtor_v2Scalar deleting destructor for a CUIWidget subclass (vtable at 0x0119fac8, size 0x3C). Destroys 8-byte element vector, sets vtable, destroys child vector (4-byte elements), calls base destructor. Optionally frees object if param_2 bit 0 is set.
0x00C8B750121CUIWidget_0x40__scalar_deleting_dtorScalar deleting destructor for a CUIWidget subclass (vtable at 0x0119fac8, size 0x40). Sets vtable, destroys child vector, calls base destructor. Optionally frees if param_2 bit 0 set.
0x00C8B7D0167CUITreeNode__recursive_dtorRecursive destructor for a tree node (size 0x18). Iterates child pointer vector at +0xC, recursively destroys each non-null child, then frees the vector and optionally the node itself. Used for UI tree hierarchies.
0x00C8B880121CUIWidget_0x34__scalar_deleting_dtor_v2Scalar deleting destructor for a CUIWidget subclass (vtable at 0x0119fac8, size 0x34). Sets vtable, destroys child vector, calls base destructor. Optionally frees if param_2 bit 0 set.
0x00C8B900114CUIWidget_0x28__scalar_deleting_dtorScalar deleting destructor for a CUIWidget subclass (vtable at 0x0119fac8, size 0x28). Sets vtable, destroys child vector, calls base destructor. Optionally frees if param_2 bit 0 set.
0x00C8B980121CUIWidget_0x38__scalar_deleting_dtorScalar deleting destructor for a CUIWidget subclass (vtable at 0x0119fac8, size 0x38). Sets vtable, destroys child vector, calls base destructor. Optionally frees if param_2 bit 0 set.
0x00C8BA00136CUIWidget_0x3C__scalar_deleting_dtor_v3Scalar deleting destructor for a CUIWidget subclass (vtable at 0x0119fac8, size 0x3C). Destroys 0x20-element vector, sets vtable, destroys child vector, calls base destructor. Optionally frees if param_2 bit 0 set.
0x00C8BA90136CUIWidget_0x3C__scalar_deleting_dtor_v4Scalar deleting destructor for a CUIWidget subclass (vtable at 0x0119fac8, size 0x3C). Calls base cleanup, sets vtable, destroys child vector, calls base destructor. Optionally frees if param_2 bit 0 set.
0x00C8BB20136CUIWidget_0x3C__scalar_deleting_dtor_v5Scalar deleting destructor for a CUIWidget subclass (vtable at 0x0119fac8, size 0x3C). Calls base cleanup, sets vtable, destroys child vector, calls base destructor. Optionally frees if param_2 bit 0 set.
0x00C8BBB0136CUIWidget_0x34__scalar_deleting_dtor_v3Scalar deleting destructor for a CUIWidget subclass (size 0x34). Destroys 2-byte element vector, sets vtable, destroys child vector, calls base destructor. Optionally frees if param_2 bit 0 set.
0x00C8BC40161CUIWidget_0x4C__scalar_deleting_dtorScalar deleting destructor for a CUIWidget subclass (size 0x4C). Destroys base, 2-byte vector, sets vtable, destroys child vector, calls base destructor. Optionally frees if param_2 bit 0 set.
0x00C8BCF0121CUIWidget_0x38__scalar_deleting_dtor_v2Scalar deleting destructor for a CUIWidget subclass (size 0x38). Sets vtable, destroys child vector, calls base destructor. Optionally frees if param_2 bit 0 set.
0x00C8BD70121CUIWidget_0x3C__scalar_deleting_dtor_v6Scalar deleting destructor for a CUIWidget subclass (size 0x3C). Sets vtable, destroys child vector, calls base destructor. Optionally frees if param_2 bit 0 set.
0x00C8BDF0121CUIWidget_0x3C__scalar_deleting_dtor_v7Scalar deleting destructor for a CUIWidget subclass (size 0x3C). Sets vtable, destroys child vector, calls base destructor. Optionally frees if param_2 bit 0 set.

Part 5 of Game Core: functions 6,481 to 8,042, 0x00C8BE70 to 0x03DE8040