Type four integer parameters that carry a string or byte pointer: the 26-char key, a buffer end, wall tile pixels
Four int32_t parameters hold pointers. NET_SID_CLIENT_TransformCdKeyToken's ECX is the 26-character CD key string: all four callers pass szCDKey cast to int32_t, and it is handed on as NET_SID_CLIENT_ExpandCdKeyToBase5's ECX (named pCdKeyString), which keeps it at [EBP-4] and reads the characters through it. Live in d2-re, calling 00522ae0 with a key string in ECX decodes 500 of 500 made-up 26-character keys the same way as a port of the decoder. PLRSAVE_LoadItemsFromBuffer's Stack[0x8] (named nItemMode) is the end of the item buffer: it subtracts the start from it (0056a7ee MOV EAX,[EBP+0xc]; 0056a7f3 SUB EAX,ESI) to get the size, and one caller passes pBufEnd. DRAW_DrawWallTileWithLighting passes its first parameter as the uint8_t * pixel data of D2GFX_DrawWallTileBasic and D2GFX_DrawGroundTileBasic. The names nCdKeyValue and nItemMode are wrong too; the tool won't change chosen names.
Changes 4, applied together
Retype variable
win 0x00522ae0 ECXtypeint32_t→char *Retype variable
win 0x00522650 ECXtypeint32_t→char *Retype variable
win 0x0056a7e0 Stack[0x8]typeint32_t→uint8_t *Retype variable
win 0x004f8050 ECXtypeint32_t→uint8_t *