Splitscreen notes

[JayFoxRox]

(Patched US)

Using set *(uint8_t*)Memory(*(uint32_t*)Memory(0x50C454) + 112) = 2 will set "2 Player" as a title in the "Freeplay" menu.
When going ingame this will be changed back to 1 player by 0045B833 mov byte ptr [esi+70h], 1 (in sub_45B7D0)

sub_45B7D0 seems to create podracers. Interesting is this:

      *(v15 - 1) = v14; // Set podracer index?
      v16 = *(char *)(v4 + 112); // Get number of local players?
      *(_DWORD *)v35 = v14;

      // Check if our index is low enough that we still need local players.
      // Then select 'Locl' or 'AAII'
      *v15 = v14 >= v16 ? 1094797641 : 1282368364;

      // Force 'AAII' in some case
      if ( *(_DWORD *)(v4 + 100) )
        *v15 = 1094797641;

Also dword_50CA18 seems to be the player count when loading the HUD in sub_464630.
Setting this value before a race will have it reset sometime.
Setting this value during a race will turn on the pause menu and the HUD will be broken.
I believe this value is actually the count of local players, which is updated in sub_466BD0

---

Mostly unrelated: int __cdecl sub_45BD90(int a1) seems to set up a race:

//----- (0045BD90) --------------------------------------------------------
int __cdecl sub_45BD90(int a1) {
  int result; // eax
  signed int v2; // ecx

  result = a1;
  v2 = 0;
  *(_BYTE *)(a1 + 108) = 1;
  *(_BYTE *)(a1 + 112) = 1; // Number of local players
  *(_DWORD *)(a1 + 100) = 0;
  *(_DWORD *)(a1 + 104) = -1;
  *(_BYTE *)(a1 + 109) = 0;
  *(_BYTE *)(a1 + 110) = 0;
  *(_BYTE *)(a1 + 111) = 0;
  *(_BYTE *)(a1 + 114) = 12; // Number of pods
  *(_BYTE *)(a1 + 143) = 3; // Number of laps
  *(_BYTE *)(a1 + 144) = 2;
  *(_BYTE *)(a1 + 145) = 2;

  // Loop over all podracers and assign an index to them?
  do {
    *(_BYTE *)(v2 + a1 + 115) = v2;
    ++v2;
  }
  while ( v2 < 23 );
  return result;
}

[JayFoxRox]

(Patched US version)

sub_45B7D0 is highly interesting as it seems to also read the podracer handling data and what appears to be the upgrade strength. It should be documented. Related to #25

int v28; // [esp+8h] [ebp-60h]
__int16 v29; // [esp+Ch] [ebp-5Ch]
char v30; // [esp+Eh] [ebp-5Ah]
int v31; // [esp+10h] [ebp-58h]
__int16 v32; // [esp+14h] [ebp-54h]
char v33; // [esp+16h] [ebp-52h]

[...]
// Set all upgrades to 100% health, level 0
v28 = -1; // 0xFF, 0xFF, 0xFF, 0xFF
v31 = 0; // 0x00, 0x00, 0x00, 0x00
v29 = -1; // 0xFF, 0xFF
v32 = 0; // 0x00, 0x00
v30 = -1; // 0xFF
v33 = 0; // 0x00
[...]