BITBUFFER_ReadHuffmanValue takes a signed word-array pointer
Ghidra v1797 · 3bccb89
Stack[8] pHuffmanTree is the base of a signed 32-bit entry array, not an integer. The complete body loads it into ESI at 0041110e, tests dword [ESI+index*4] against zero with signed JGE at 00411114/00411118, and returns dword [ESI+index*4] at 00411122. Negative entries continue to the next implicit binary-tree pair; nonnegative entries are returned. Retype only that existing slot to int32_t*. Preserve its name, return, two stack slots, stdcall and RET 8. No new node structure or array extent is inferred. There are no reported incoming code/data refs, so this is API-only body proof without a runtime tree producer. Original bytes and the existing bit-buffer field widths were checked.
Changes 1, applied together
Retype variable
win 0x004110d0 Stack[0x8]typeint32_t→int32_t *