{"handlerVaHex":"0x0040c513","modeDispatchVaHex":"0x0040c69d","finalAdvanceVaHex":"0x0040c6c0","globals":{"runtimeEnabledFlag":"0x0059e34d","currentObjectIndex":"0x0059e33e","runtimeObjectTable":"0x0059db30","mode1SourceByte":"0x0059e348","mode2SourceByte":"0x0059e347"},"currentBoundary":{"source":"map1_01a","target":"map2_02d","opcodeVaHex":"0x005428e4","opcodeValueHex":"0x0c000124","streamPlus1":1,"streamPlus1Hex":"0x01","streamPlus2":0,"streamPlus3":12},"currentMode":{"mode":1,"targetVaHex":"0x0040c673","meaning":"Write byte(0x0059e348)+3 to current object+0x61, then advance stream +4."},"modes":[{"mode":0,"targetVaHex":"0x0040c55c","meaning":"Call 0x0043329f for the current runtime object, then branch on object+0x58/object+0x67. This can set context+0x58 to 0/1/2/3 or update object+0x61."},{"mode":1,"targetVaHex":"0x0040c673","meaning":"Write byte(0x0059e348)+3 to current object+0x61, then advance stream +4."},{"mode":2,"targetVaHex":"0x0040c688","meaning":"Write byte(0x0059e347) to current object+0x61, then advance stream +4."}],"objectStateSwitch":{"selectorTableVaHex":"0x0040c664","targetTableVaHex":"0x0040c64c","rows":[{"objectState":1,"selector":0,"targetVaHex":"0x0040c598","meaning":"write current object index 0x0059e33e to object+0x61 and set context+0x58=0"},{"objectState":2,"selector":5,"targetVaHex":"0x0040c66e","meaning":"no object/context update before final +4 advance"},{"objectState":3,"selector":5,"targetVaHex":"0x0040c66e","meaning":"no object/context update before final +4 advance"},{"objectState":4,"selector":5,"targetVaHex":"0x0040c66e","meaning":"no object/context update before final +4 advance"},{"objectState":5,"selector":1,"targetVaHex":"0x0040c598","meaning":"write current object index 0x0059e33e to object+0x61 and set context+0x58=0"},{"objectState":6,"selector":2,"targetVaHex":"0x0040c5b2","meaning":"scan runtime object table 0x0059db3c and write the first available slot+3 to object+0x61; set context+0x58=0"},{"objectState":7,"selector":5,"targetVaHex":"0x0040c66e","meaning":"no object/context update before final +4 advance"},{"objectState":8,"selector":5,"targetVaHex":"0x0040c66e","meaning":"no object/context update before final +4 advance"},{"objectState":9,"selector":3,"targetVaHex":"0x0040c619","meaning":"set context+0x58=2"},{"objectState":10,"selector":4,"targetVaHex":"0x0040c60a","meaning":"set context+0x58=1"}]},"conclusion":"The current map1_01a->map2_02d boundary uses opcode 0x24 mode 1. That mode updates the current runtime object's +0x61 field from global 0x0059e348 and then advances by +4; it does not by itself prove that the following pointer/table payload selects save-selector leaf 0x00542ae8. The next reverse-engineering step is to identify the producer/meaning of 0x0059e348 and the consumer of object+0x61/context+0x58."}