Merged directly by the admin, bypassing peer review, because part of the
original function was overwritten by the client's protector and can never
match. Task 16009 is marked done on purpose; do not resubmit it.
- Jump table 0xAD29E4: modes 0/1 go to 0xAD1E58, now "jmp 0x027AB0FE" into
an empty protector stub. Bytes 0xAD1E58..0xAD237D are garbage.
- The rest of case 0/1 survives from 0xAD237E (g_serviceFlag07 = 29,
strstr(g_launchServerName, "QmSakray"), key/address pair, StringFormat
into g_serviceAddress, then the admin/monster-job tail); ported as is.
- Live WinDbg run (servertype=primary): 0xAD1C90 is never called; the
protector loader in .data6 (sub_3DE8027) replaces it at runtime.
- Based on attempt 57915 (batch 10359), with g_session.unknown_58FA replaced
by g_launchServerName (same address, 0x1737F32). Key/string decryption
verified against the binary. td check --includers: no errors.
c8cd69a8bf