I'm reverse engineering the Final Fantasy XIV 1.0 protocol to bring back the now dead game (not ARR). I'm trying to find where an error message handler is called (specifically "This character name is already in use"), and work backwards to send the correct packet. Using the timeout error message, I found the routine that causes this message to load, but the routine is never called as a constant, rather loaded into EDX and then called. A error code is passed in which defines what message to show, as well as what action to take (for example, putting in the "Bad chara name" code will actually cause the UI to switch to the "enter name" screen).
I'm using ollydbg and normally I'd just use the "find references to command" option, but since this routine is loaded then called, that won't work. Any ideas how to find where this routine is called? Then I can work backwards to find what is read from the packet to go to that code.