"""HYPOTHESIS: the settings applier FUN_18011dc50 ALREADY RAN this session. Evidence:
live model+0x1fd28=0x3c, +0x1fd49=0x96, +0x1fd54=0x1e0 and a mixed 0/1 pattern across
+0x1fd2c..+0x1fd48, none of which a zero-memset could produce, and the disp32 scan
found NO constructor writer for any of those displacements.
FALSIFIER: the model constructor (FUN_180111100 / FUN_18010cdc0, the only two functions
referencing vtable 0x18021c2a0) writes the block through a REBASED pointer (small disp),
which my disp32 scan would miss. Decompile both and look.
CONTROL: FUN_18011dbf0 is a known writer (+0x1fd1c) reached the same way.
"""
import traceback
try:
    for a, tag in [(0x180111100, "vtable-ref-1 (ctor?)"),
                   (0x18010cdc0, "vtable-ref-2 (ctor?)"),
                   (0x18011dc50, "GATE APPLIER"),
                   (0x18011dbf0, "TRADE_PILE_SIZE APPLIER"),
                   (0x180173e00, "settings completion callback")]:
        s = dec(a)
        print("\n" + "="*78)
        print("### %#x  %s   len=%d" % (a, tag, len(s)))
        print("="*78)
        print(s)
except Exception:
    traceback.print_exc()