SStrTokenize maximum token length is an unsigned count
Ghidra v1797 · 3bccb89
Windows Stack[0xc] nMaxLen is an unsigned output capacity, not char*. At 00413c39/00413c91 the code forms writePointer-outputBase+1, compares that count with the parameter at 00413c93, and uses unsigned carry to bound byte writes. It also compares writtenCount with the same capacity before NUL termination at 00413cb8. All three callers pass literal capacities 0 or 256, with a separate NULL or stack-buffer destination. Retype only the capacity to uint32_t; preserve its name, other parameters, stdcall, five stack slots and RET 0x14. The complete 350-byte body and all three call setups match the original Windows PE. No API-documentation or Mac-pairing assumption is required. Return and quoted-output flag remain unchanged.
Changes 1, applied together
Retype variable
win 0x00413b80 Stack[0xc]typechar *→uint32_t