RTTI-based vtable/instance resolution.

Inline BST walk: manager+76=rootIndex, manager+96=nodes (24-byte stride). node+16=appId, node+20=appInfo. Returns null if appId not in cache.

Pattern match with '?' as wildcard byte. Pattern is a string like "55 57 56 53 E8 ? ? ? ? 81 C3 ? ? ? ? 83 EC 1C". Returns absolute address of first m

Shutdown entry points: ExitProcess IAT hook (production) and DllMain DLL_PROCESS_DETACH with reserved==NULL. once_flag makes it idempotent.

Thread-safe copy under the lock for read handlers.

Capture a per-app root token seen on an upload. Serializes against concurrent persist operations; unions memory + disk before save.

Returns true if the gate is clear and the caller may proceed, false if shutdown started or the 30s cap fired.

Write to tmp, FlushFileBuffers, then atomic rename over the target. FlushFileBuffers is required: a same-volume rename is metadata-only and MOVEFILE_W

AES-256-CBC decrypt with PKCS7 padding. Returns None on bad padding/length.

Apply patches to a clone of `data`. Returns (patched, applied, skipped, errors).

True if any process named "steam.exe" is running. Uses `tasklist` to avoid pulling in a process-enumeration dependency.

level may actually range from [0,10] (10 is a "hidden" max level, where we want a bit more compression and it's fine if throughput to fall off a cliff

Validate a candidate cache file: AES-CBC decrypt -> skip 4-byte prefix -> zlib inflate -> must start with an MZ header.

Account-scope filename for an app's playtime blob.

<summary>Core DLL patches + P1/P2/P3 + CloudRedirect cave (namespace mode).</summary>

Fold legacy playtime (shortfall above existing buckets). No g_mutex.

Copies sourcePath to destPath atomically: writes a sibling .tmp first with FlushFileBuffers before close, then File.Move(overwrite:true) which is rena

File I/O

Serialize the stats document (everything except the raw schema blob) to JSON.

Build LastPlayedTimes notification body for live UI injection.

Cloud notification namespace check: appId is in body field 1; returns real appId, or 0 if not namespace.

<summary> Move specified files out of an app's remote/ dir into a backup dir (batch dir if BeginBatch is active). Returns count moved. </summary>

Return the cached cloud JSON for one app (from the last account-blob pull). Caller holds g_mutex. Empty string if the app has no cloud stats.

SHA-256 of a file on disk, lowercase hex.

Safe wrapper: true only if the coroutine engine is resolved AND reports the current thread's coroutine is active (yieldable). SEH-isolated so a bad ca

Check compat.vdf to detect Proton (matches CCompatManager::LoadPlatformOverrideCache).

Drain inject queue on network thread.

Drain a small batch of queued schema requests on the calling network thread. Called from the recv/send hooks (which already run on the net thread).

Ensure the per-account disk directory exists. Called under g_mutex.

Import native stats if absent. Retries until accountId is ready. Caller holds mutex.