Type UI message handlers' integer parameter as the message struct their tables pass
Seven handlers registered in message tables take their one argument as int32_t pMsg, so the source reads *(uint32_t*)(pMsg + 0x18). Their tables call through D2WinWndHandlerFn and fnD2InitUIFlagFunction, both void __stdcall(D2UIMouseMsgStrc *), and their typed siblings (INPUT_FormActivate and the others in D2WinMain) already take D2UIMouseMsgStrc *. Every offset the bodies touch is a field of it: nWParam (0x8, the SC_ code in HandleSystemCommand and the activation flag in HandleActivation), the high word of uLParam (0xe, the mouse Y in CHAT_CheckChatboxBounds), bHandled (0x18) and dwResult (0x1c), each written as a dword.
Changes 7, applied together
Retype variable
win 0x004f9f20 Stack[0x4]typeint32_t→D2UIMouseMsgStrc *Retype variable
win 0x004fa4f0 Stack[0x4]typeint32_t→D2UIMouseMsgStrc *Retype variable
win 0x004f9cc0 Stack[0x4]typeint32_t→D2UIMouseMsgStrc *Retype variable
win 0x004fa840 Stack[0x4]typeint32_t→D2UIMouseMsgStrc *Retype variable
win 0x004fa160 Stack[0x4]typeint32_t→D2UIMouseMsgStrc *Retype variable
win 0x0047bc70 Stack[0x4]typeint32_t→D2UIMouseMsgStrc *Retype variable
win 0x0047b070 Stack[0x4]typeint32_t→D2UIMouseMsgStrc *