From f448929f739eca2ef30a9188088d5baf5bf3c252 Mon Sep 17 00:00:00 2001
From: Duncan Frost <duncans_pumpkin@hotmail.co.uk>
Date: Thu, 8 May 2014 20:13:58 +0100
Subject: [PATCH 1/8] First couple lines decoded

---
 src/gfx.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/src/gfx.c b/src/gfx.c
index 022b35e1a2..1e8dc86f84 100644
--- a/src/gfx.c
+++ b/src/gfx.c
@@ -154,6 +154,33 @@ void gfx_fill_rect_inset(rct_drawpixelinfo* dpi, short left, short top, short ri
 void gfx_draw_sprite(rct_drawpixelinfo *dpi, int image_id, int x, int y)
 {
 	RCT2_CALLPROC_X(0x0067A28E, 0, image_id, x, y, 0, dpi, 0);
+
+	int eax = 0, ebx = image_id, ecx = x, edx = y, esi = 0, edi = dpi, ebp = 0;
+	eax = image_id;
+	eax >>= 26;
+	RCT2_GLOBAL(0x00EDF81C, uint32) = ebx;
+	eax &= 0x7;
+	eax = RCT2_GLOBAL(0x009E3CE4 + 4 * eax, uint32);
+	RCT2_GLOBAL(0x009E3CDC, uint32) = eax;
+	if (!(RCT2_GLOBAL(0x00EDF81C, uint32) & 0xE0000000)){
+		if (!(ebx & 0x80000000))
+		{
+			if (!(ebx & 0x20000000)){
+				eax = ebx;
+				RCT2_GLOBAL(0x9E3CDC, uint32) = 0;
+				eax >>= 13;
+				eax &= 0x1f;
+				eax = RCT2_GLOBAL(eax * 4 + 0x91FCBC, uint32);
+				eax <<= 4;
+				eax = RCT2_GLOBAL(eax + 0x9EBD28, uint32);
+				ebp = *((uint32*)eax + 0xF3);
+				esi = *((uint32*)eax + 0xF7);
+				RCT2_GLOBAL(0x9ABEFF, uint32) = ebp;
+				RCT2_GLOBAL(0x9ABF03, uint32) = esi;
+				ebp = *((uint32*)eax + 0xFB);
+			}//0x67a361
+		}//0x67a445
+	}//0x67a46e
 }
 
 /**

From 2276c198fdf26533e5514d3d3ba711121e56a4b2 Mon Sep 17 00:00:00 2001
From: Duncan Frost <duncans_pumpkin@hotmail.co.uk>
Date: Thu, 8 May 2014 20:43:10 +0100
Subject: [PATCH 2/8] Removed a pointless call in palette tried to make draw
 sprite more understandable

---
 src/gfx.c         | 20 +++++++++++---------
 src/osinterface.c |  4 ++--
 src/osinterface.h |  1 +
 3 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/src/gfx.c b/src/gfx.c
index 1e8dc86f84..3c6c2ce010 100644
--- a/src/gfx.c
+++ b/src/gfx.c
@@ -26,6 +26,7 @@
 #include "rct2.h"
 #include "strings.h"
 #include "window.h"
+#include "osinterface.h"
 
 // HACK These were originally passed back through registers
 int gLastDrawStringX;
@@ -154,30 +155,32 @@ void gfx_fill_rect_inset(rct_drawpixelinfo* dpi, short left, short top, short ri
 void gfx_draw_sprite(rct_drawpixelinfo *dpi, int image_id, int x, int y)
 {
 	RCT2_CALLPROC_X(0x0067A28E, 0, image_id, x, y, 0, dpi, 0);
+	return;
 
 	int eax = 0, ebx = image_id, ecx = x, edx = y, esi = 0, edi = dpi, ebp = 0;
 	eax = image_id;
 	eax >>= 26;
-	RCT2_GLOBAL(0x00EDF81C, uint32) = ebx;
+	RCT2_GLOBAL(0x00EDF81C, uint32) = image_id & 0xE0000000;
 	eax &= 0x7;
 	eax = RCT2_GLOBAL(0x009E3CE4 + 4 * eax, uint32);
 	RCT2_GLOBAL(0x009E3CDC, uint32) = eax;
-	if (!(RCT2_GLOBAL(0x00EDF81C, uint32) & 0xE0000000)){
-		if (!(ebx & 0x80000000))
+	if (!(image_id & 0xE0000000)){
+		if (!(image_id & (1<<31)))
 		{
-			if (!(ebx & 0x20000000)){
-				eax = ebx;
+			if (!(image_id & (1<<29))){
+				eax = image_id;
 				RCT2_GLOBAL(0x9E3CDC, uint32) = 0;
 				eax >>= 13;
 				eax &= 0x1f;
 				eax = RCT2_GLOBAL(eax * 4 + 0x91FCBC, uint32);
 				eax <<= 4;
-				eax = RCT2_GLOBAL(eax + 0x9EBD28, uint32);
+				eax = RCT2_GLOBAL(eax + RCT2_ADDRESS_G1_ELEMENTS, uint32);
 				ebp = *((uint32*)eax + 0xF3);
 				esi = *((uint32*)eax + 0xF7);
 				RCT2_GLOBAL(0x9ABEFF, uint32) = ebp;
 				RCT2_GLOBAL(0x9ABF03, uint32) = esi;
 				ebp = *((uint32*)eax + 0xFB);
+				eax = ebx;//0x67a310
 			}//0x67a361
 		}//0x67a445
 	}//0x67a46e
@@ -195,7 +198,7 @@ void gfx_transpose_palette(int pal, unsigned char product)
 	uint8* esi, *edi;
 
 	ebx = pal * 16;
-	esi = (uint8*)(*((int*)(0x009EBD28 + ebx)));
+	esi = (uint8*)(*((int*)(RCT2_ADDRESS_G1_ELEMENTS + ebx)));
 	ebp = *((short*)(0x009EBD2C + ebx));
 	eax = *((short*)(0x009EBD30 + ebx)) * 4;
 	edi = (uint8*)0x01424680 + eax;
@@ -207,8 +210,7 @@ void gfx_transpose_palette(int pal, unsigned char product)
 		esi += 3;
 		edi += 4;
 	}
-
-	RCT2_CALLPROC_3(0x00405595, int, int, int, 0x01424680, 10, 236);
+	osinterface_update_palette((char*)0x01424680, 10, 236);
 }
 
 /**
diff --git a/src/osinterface.c b/src/osinterface.c
index 3e97491e5b..ad3d2c66aa 100644
--- a/src/osinterface.c
+++ b/src/osinterface.c
@@ -38,7 +38,7 @@ unsigned int gLastKeyPressed;
 static void osinterface_create_window();
 static void osinterface_close_window();
 static void osinterface_resize(int width, int height);
-static void osinterface_update_palette(char* colours, int start_index, int num_colours);
+
 
 static SDL_Window *_window;
 static SDL_Surface *_surface;
@@ -150,7 +150,7 @@ static void osinterface_resize(int width, int height)
 	gfx_invalidate_screen();
 }
 
-static void osinterface_update_palette(char* colours, int start_index, int num_colours)
+void osinterface_update_palette(char* colours, int start_index, int num_colours)
 {
 	SDL_Color base[256];
 	SDL_Surface *surface;
diff --git a/src/osinterface.h b/src/osinterface.h
index 9ec682fea2..6ddcc3d84e 100644
--- a/src/osinterface.h
+++ b/src/osinterface.h
@@ -45,6 +45,7 @@ void osinterface_init();
 void osinterface_process_messages();
 void osinterface_draw();
 void osinterface_free();
+void osinterface_update_palette(char* colours, int start_index, int num_colours);
 
 int osinterface_open_common_file_dialog(int type, char *title, char *filename, char *filterPattern, char *filterName);
 

From f3e7c6c23c8a49aac4f41176a6ca881bba9f56a5 Mon Sep 17 00:00:00 2001
From: Duncan Frost <duncans_pumpkin@hotmail.co.uk>
Date: Fri, 9 May 2014 09:18:49 +0100
Subject: [PATCH 3/8] Added more of draw_sprite still needs work. Function call
 does not work

---
 src/gfx.c | 237 +++++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 216 insertions(+), 21 deletions(-)

diff --git a/src/gfx.c b/src/gfx.c
index 3c6c2ce010..bcfce787f5 100644
--- a/src/gfx.c
+++ b/src/gfx.c
@@ -145,6 +145,69 @@ void gfx_fill_rect_inset(rct_drawpixelinfo* dpi, short left, short top, short ri
 	RCT2_CALLPROC_X(0x006E6F81, left, right, top, bottom, _si, dpi, colour);
 }
 
+/*
+* rct2: 0x67A934
+*/
+void sub_0x67A934(int eax, int ebp, int ebx, int esi, rct_drawpixelinfo *dpi, int x, int y){
+	int ecx = x, edx = y, edi = dpi;
+	ebp = dpi;
+	esi = RCT2_GLOBAL(0x9E3D08, uint32);
+	edi = *((uint32*)dpi);
+	edx += RCT2_GLOBAL(0x9E3D12, uint16);
+	eax = RCT2_GLOBAL(0x9E3D0E, uint16);
+	RCT2_GLOBAL(0xEDF808, uint32) = 0;
+	RCT2_GLOBAL(0x9ABDAC, uint16) = eax;
+	if (edx > dpi->y)
+	{
+		edx -= dpi->y;
+		RCT2_GLOBAL(0x9ABDAC, uint16) += edx;
+		if (RCT2_GLOBAL(0x9ABDAC, uint16) <= 0)return;
+		RCT2_GLOBAL(0xEDF808, uint16) -= edx;
+		edx = 0;
+	}
+	else{
+		edx -= dpi->y;
+		eax = dpi->width;
+		ebx = edx;
+		eax += dpi->pitch;
+		eax *= edx;
+		edx = ebx;
+		edi += eax;
+	}
+	edx += RCT2_GLOBAL(0x9ABDAC, uint16);
+	edx -= dpi->height;
+	if (edx > 0){
+		RCT2_GLOBAL(0x9ABDAC, uint16) -= edx;
+		if (RCT2_GLOBAL(0x9ABDAC, uint16) <= 0)return;
+	}
+	eax = RCT2_GLOBAL(0x9E3D0C, uint16);
+	RCT2_GLOBAL(0xEDF80C, uint32) = 0;
+	ecx += RCT2_GLOBAL(0x9E3D10, uint16);
+
+	RCT2_GLOBAL(0x9ABDA8, uint16) = eax;
+	ecx -= dpi->x;
+	if (ecx < 0){
+		RCT2_GLOBAL(0x9ABDA8, uint16) += ecx;
+		if (RCT2_GLOBAL(0x9ABDA8, uint16) <= 0)return;
+		RCT2_GLOBAL(0xEDF80C, uint16) -= ecx;
+		ecx = 0;
+	}
+	else{
+		edi += ecx;
+	}
+	ecx += RCT2_GLOBAL(0x9ABDA8, uint16);
+	ecx -= dpi->width;
+	if (ecx > 0){
+		RCT2_GLOBAL(0x9ABDA8, uint16) -= ecx;
+		if (RCT2_GLOBAL(0x9ABDA8, uint16) <= 0)return;
+	}
+	eax = dpi->width;
+	eax += dpi->pitch;
+	RCT2_GLOBAL(0x9ABDB0, uint16) = eax;
+	//ebx esi edi
+	RCT2_CALLPROC_X(0x67A690, eax, ebx, ecx, edx, esi, edi, ebp);
+}
+
 /**
  *
  *  rct2: 0x0067A28E
@@ -154,8 +217,8 @@ void gfx_fill_rect_inset(rct_drawpixelinfo* dpi, short left, short top, short ri
  */
 void gfx_draw_sprite(rct_drawpixelinfo *dpi, int image_id, int x, int y)
 {
-	RCT2_CALLPROC_X(0x0067A28E, 0, image_id, x, y, 0, dpi, 0);
-	return;
+	//RCT2_CALLPROC_X(0x0067A28E, 0, image_id, x, y, 0, dpi, 0);
+	//return;
 
 	int eax = 0, ebx = image_id, ecx = x, edx = y, esi = 0, edi = dpi, ebp = 0;
 	eax = image_id;
@@ -164,26 +227,158 @@ void gfx_draw_sprite(rct_drawpixelinfo *dpi, int image_id, int x, int y)
 	eax &= 0x7;
 	eax = RCT2_GLOBAL(0x009E3CE4 + 4 * eax, uint32);
 	RCT2_GLOBAL(0x009E3CDC, uint32) = eax;
-	if (!(image_id & 0xE0000000)){
-		if (!(image_id & (1<<31)))
+
+	if ((image_id & (1 << 31)) && (image_id & (1 << 29))){
+		eax = image_id;
+		RCT2_GLOBAL(0x9E3CDC, uint32) = 0;
+		eax >>= 19;
+		eax &= 0x1f;
+		eax = RCT2_GLOBAL(eax * 4 + 0x97FCBC, uint32);
+		eax <<= 4;
+		eax = RCT2_GLOBAL(eax + RCT2_ADDRESS_G1_ELEMENTS, uint32);
+		ebp = *((uint32*)eax + 0xF3);
+		esi = *((uint32*)eax + 0xF7);
+		RCT2_GLOBAL(0x9ABEFF, uint32) = ebp;
+		RCT2_GLOBAL(0x9ABF03, uint32) = esi;
+		ebp = *((uint32*)eax + 0xFB);
+		eax = ebx;//0x67a310
+
+		RCT2_GLOBAL(0x9ABF07, uint32) = ebp;
+		eax >>= 24;
+		eax &= 0x1f;
+		eax = RCT2_GLOBAL(eax * 4 + 0x97FCBC, uint32);
+		eax <<= 4;
+		eax = RCT2_GLOBAL(eax + RCT2_ADDRESS_G1_ELEMENTS, uint32);
+		ebp = *((uint32*)eax + 0xF3);
+		esi = *((uint32*)eax + 0xF7);
+		RCT2_GLOBAL(0x9ABED6, uint32) = ebp;
+		RCT2_GLOBAL(0x9ABEDA, uint32) = esi;
+		ebp = *((uint32*)eax + 0xFB);
+
+		RCT2_GLOBAL(0x9ABDA4, uint32) = 0x009ABE0C;
+		RCT2_GLOBAL(0x9ABEDE, uint32) = ebp;
+	} else if ((image_id & (1 << 31))){
+		//0x67a361
+	} else if ((image_id & (1 << 30))){
+		//0x67a445
+	}
+	//0x67A46E
+	ebx &= 0x7FFFF;
+	ebx <<= 4;
+	ebx += RCT2_ADDRESS_G1_ELEMENTS;
+	if (dpi->pad_0E >= 1){
+		if (dpi->pad_0E == 1){
+			//long jump into 0x67bd81
+		}
+		if (dpi->pad_0E >= 3){
+			//long jump into 0x67DADA
+		}
+		//long jump into 0x67FAAE
+		return;
+	}
+	eax = *((uint32*)ebx + 8);
+	ebp = *((uint32*)ebx + 12);
+	RCT2_GLOBAL(0x9E3D08, uint32) = *((uint32*)ebx);
+	RCT2_GLOBAL(0x9E3D0C, uint32) = *((uint32*)ebx + 4);
+	RCT2_GLOBAL(0x9E3D10, uint32) = *((uint32*)ebx + 8);
+	RCT2_GLOBAL(0x9E3D14, uint32) = *((uint32*)ebx + 12);
+	if (RCT2_GLOBAL(0x9E3D14, uint32) & (1 << 2)){
+		sub_0x67A934(eax, ebp, ebx, esi, dpi, x, y);
+		//long jump into 0x67A934
+		return;
+	}
+	ebp = dpi;
+	esi = RCT2_GLOBAL(0x9E3D08, uint32);
+	RCT2_GLOBAL(0x9E3CE0, uint32) = 0;
+	edi = *((uint32*)dpi);
+	edx = edx & 0xFFFF + RCT2_GLOBAL(0x9E3D12, uint16);
+	eax = eax & 0xFFFF + RCT2_GLOBAL(0x9E3D0E, uint16);
+	RCT2_GLOBAL(0x9ABDAC, uint16) = eax;
+	edx -= dpi->y;
+	if (edx < 0){
+		RCT2_GLOBAL(0x9ABDAC, uint16)+= edx;
+		if (RCT2_GLOBAL(0x9ABDAC, uint16) <= 0){
+			//jump 0x67A607
+			return;
+		}
+		edx = -edx;
+		eax = RCT2_GLOBAL(0x9E3D0C, uint16);
+		eax *= edx;
+		edx = 0;
+		esi += eax;
+		RCT2_GLOBAL(0x9E3CE0, uint32) += eax;
+	} else {
+		ebx = edx;
+		eax = dpi->width;
+		
+		eax += dpi->pitch;
+		eax *= edx;
+		edx = ebx;
+		edi += eax;
+	}
+	edx += RCT2_GLOBAL(0x9ABDAC, uint16);
+	if (edx > dpi->height){
+		edx -= dpi->height;
+		if (RCT2_GLOBAL(0x9ABDAC, uint32) > edx)
 		{
-			if (!(image_id & (1<<29))){
-				eax = image_id;
-				RCT2_GLOBAL(0x9E3CDC, uint32) = 0;
-				eax >>= 13;
-				eax &= 0x1f;
-				eax = RCT2_GLOBAL(eax * 4 + 0x91FCBC, uint32);
-				eax <<= 4;
-				eax = RCT2_GLOBAL(eax + RCT2_ADDRESS_G1_ELEMENTS, uint32);
-				ebp = *((uint32*)eax + 0xF3);
-				esi = *((uint32*)eax + 0xF7);
-				RCT2_GLOBAL(0x9ABEFF, uint32) = ebp;
-				RCT2_GLOBAL(0x9ABF03, uint32) = esi;
-				ebp = *((uint32*)eax + 0xFB);
-				eax = ebx;//0x67a310
-			}//0x67a361
-		}//0x67a445
-	}//0x67a46e
+			RCT2_GLOBAL(0x9ABDAC, uint32) -= edx;
+			return;//jump to 0x67A607
+		}
+		RCT2_GLOBAL(0x9ABDAC, uint32) -= edx;
+	}
+	else{
+		edx -= dpi->height;
+	}
+	eax = RCT2_GLOBAL(0x9E3D0C, uint16);
+	RCT2_GLOBAL(0x9ABDA8, uint16) = eax;
+	ebx = dpi->width;
+	eax = -eax;
+	eax += ebx;
+	eax += dpi->pitch;
+	RCT2_GLOBAL(0x9ABDAE, uint16) = 0;
+	RCT2_GLOBAL(0x9ABDB0, uint16) = eax;
+	ecx += RCT2_GLOBAL(0x9E3D10, uint16);
+	if (ecx > dpi->x){
+		ecx -= dpi->x;
+		if (RCT2_GLOBAL(0x9ABDA8, uint16) > ecx ){//missing jz 0x67a596
+			RCT2_GLOBAL(0x9ABDA8, uint16) += ecx;
+			return;
+		}
+		RCT2_GLOBAL(0x9ABDA8, uint16) += ecx;
+		ecx -= RCT2_GLOBAL(0x9ABDAE, uint16);
+		esi -= ecx;
+		RCT2_GLOBAL(0x9E3CE0, uint32) -= ecx;
+		RCT2_GLOBAL(0x9ABDB0, uint16) -= ecx;
+		ecx = 0;
+	}
+	else{
+		ecx -= dpi->x;
+	}
+	edi += ecx;
+	ecx += RCT2_GLOBAL(0x9ABDA8, uint16);
+	if (ecx > dpi->width){
+		ecx -= dpi->width;
+		if (RCT2_GLOBAL(0x9ABDA8, uint16) > ecx){
+			RCT2_GLOBAL(0x9ABDA8, uint16) -= ecx;
+			return;
+		}
+		RCT2_GLOBAL(0x9ABDA8, uint16) -= ecx;
+		RCT2_GLOBAL(0x9ABDAE, uint16) += ecx;
+		RCT2_GLOBAL(0x9ABDB0, uint16) += ecx;
+	}
+	else{
+		ecx -= dpi->width;
+	}
+	if (!(RCT2_GLOBAL(0x9E3D14, uint16) & 0x02)){
+		eax = RCT2_GLOBAL(0x9ABDAC, uint8);
+		edx = RCT2_GLOBAL(0x9ABDAE, uint16);
+		ebp = RCT2_GLOBAL(0x9ABDB0, uint16);
+		ebx = RCT2_GLOBAL(0xEDF81C, uint32);
+		RCT2_CALLPROC_X(0x67A690, eax, ebx, ecx, edx, esi, edi, ebp);
+		return;
+	}
+	//0x67A60A
+
 }
 
 /**

From 1086c4e5247a376ee8b9f10cad816c2e58f9ac80 Mon Sep 17 00:00:00 2001
From: Duncan Frost <duncans_pumpkin@hotmail.co.uk>
Date: Sat, 10 May 2014 07:14:12 +0100
Subject: [PATCH 4/8] added notes to help find bug

---
 src/gfx.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/gfx.c b/src/gfx.c
index bcfce787f5..de6bd2f664 100644
--- a/src/gfx.c
+++ b/src/gfx.c
@@ -149,6 +149,7 @@ void gfx_fill_rect_inset(rct_drawpixelinfo* dpi, short left, short top, short ri
 * rct2: 0x67A934
 */
 void sub_0x67A934(int eax, int ebp, int ebx, int esi, rct_drawpixelinfo *dpi, int x, int y){
+	//eax = 3000A, ecx = 9C, edx = 152, ebx = A46798, esp = CFCC8, ebp = DC10005, esi = 0, edi = 9DEA74
 	int ecx = x, edx = y, edi = dpi;
 	ebp = dpi;
 	esi = RCT2_GLOBAL(0x9E3D08, uint32);
@@ -205,6 +206,8 @@ void sub_0x67A934(int eax, int ebp, int ebx, int esi, rct_drawpixelinfo *dpi, in
 	eax += dpi->pitch;
 	RCT2_GLOBAL(0x9ABDB0, uint16) = eax;
 	//ebx esi edi
+	char* FindThis = "FINDTHISSTRING";
+	//eax 280,ecx FEFC,edx FFFF,ebx A40003,esp CFCC4,ebp 9DEA74,esi 3E1DF13,edi 322076
 	RCT2_CALLPROC_X(0x67A690, eax, ebx, ecx, edx, esi, edi, ebp);
 }
 
@@ -217,6 +220,7 @@ void sub_0x67A934(int eax, int ebp, int ebx, int esi, rct_drawpixelinfo *dpi, in
  */
 void gfx_draw_sprite(rct_drawpixelinfo *dpi, int image_id, int x, int y)
 {
+	char* FindMe = "FINDTHISOTHERSTRING";
 	//RCT2_CALLPROC_X(0x0067A28E, 0, image_id, x, y, 0, dpi, 0);
 	//return;
 

From 601305a4e3651d84b78620daefe6c87be9ee0dda Mon Sep 17 00:00:00 2001
From: Duncan Frost <duncans_pumpkin@hotmail.co.uk>
Date: Sat, 10 May 2014 10:12:48 +0100
Subject: [PATCH 5/8] Still searching for bug. Must be some external memory not
 set

---
 src/gfx.c | 141 ++++++++++++++++++++++++++++++++++--------------------
 1 file changed, 90 insertions(+), 51 deletions(-)

diff --git a/src/gfx.c b/src/gfx.c
index de6bd2f664..2199fb6fe1 100644
--- a/src/gfx.c
+++ b/src/gfx.c
@@ -148,67 +148,105 @@ void gfx_fill_rect_inset(rct_drawpixelinfo* dpi, short left, short top, short ri
 /*
 * rct2: 0x67A934
 */
-void sub_0x67A934(int eax, int ebp, int ebx, int esi, rct_drawpixelinfo *dpi, int x, int y){
-	//eax = 3000A, ecx = 9C, edx = 152, ebx = A46798, esp = CFCC8, ebp = DC10005, esi = 0, edi = 9DEA74
-	int ecx = x, edx = y, edi = dpi;
-	ebp = dpi;
-	esi = RCT2_GLOBAL(0x9E3D08, uint32);
-	edi = *((uint32*)dpi);
-	edx += RCT2_GLOBAL(0x9E3D12, uint16);
-	eax = RCT2_GLOBAL(0x9E3D0E, uint16);
+void sub_0x67A934(int _eax, int _ebp, int _ebx, int _esi, rct_drawpixelinfo *dpi, int x, int y){
+	//_eax = 3000A, _ecx = 9C, _edx = 152, _ebx = A46798, esp = CFCC8, ebp = DC10005, _esi = 0, _edi = 9DEA74
+	int _ecx = x, _edx = y, _edi = dpi;
+	sint16 dx = y, ax = 0, bx = 0, cx = x;
+	_ebp = dpi;
+	_esi = RCT2_GLOBAL(0x9E3D08, uint32);
+	_edi = *((uint32*)dpi);//2A18EC
+	dx += RCT2_GLOBAL(0x9E3D12, uint16);
+	ax = RCT2_GLOBAL(0x9E3D0E, uint16);
 	RCT2_GLOBAL(0xEDF808, uint32) = 0;
-	RCT2_GLOBAL(0x9ABDAC, uint16) = eax;
-	if (edx > dpi->y)
+	RCT2_GLOBAL(0x9ABDAC, uint16) = ax;
+	dx -= dpi->y;
+	if (dx < 0)
 	{
-		edx -= dpi->y;
-		RCT2_GLOBAL(0x9ABDAC, uint16) += edx;
+		RCT2_GLOBAL(0x9ABDAC, uint16) += dx;
 		if (RCT2_GLOBAL(0x9ABDAC, uint16) <= 0)return;
-		RCT2_GLOBAL(0xEDF808, uint16) -= edx;
-		edx = 0;
+		RCT2_GLOBAL(0xEDF808, uint16) -= dx;
+		_edx = 0;
+		dx = 0;
 	}
 	else{
-		edx -= dpi->y;
-		eax = dpi->width;
-		ebx = edx;
-		eax += dpi->pitch;
-		eax *= edx;
-		edx = ebx;
-		edi += eax;
+		ax = dpi->width;
+		bx = dx;
+		ax += dpi->pitch;
+		_edx = dx;
+		_eax = ax;
+		_eax *= _edx;
+		_edx = 0;
+		ax = _eax;
+		dx = bx;
+		_edi += _eax;
 	}
-	edx += RCT2_GLOBAL(0x9ABDAC, uint16);
-	edx -= dpi->height;
-	if (edx > 0){
-		RCT2_GLOBAL(0x9ABDAC, uint16) -= edx;
+	dx += RCT2_GLOBAL(0x9ABDAC, uint16);
+	dx -= dpi->height;
+	if (dx > 0){
+		RCT2_GLOBAL(0x9ABDAC, uint16) -= dx;
 		if (RCT2_GLOBAL(0x9ABDAC, uint16) <= 0)return;
 	}
-	eax = RCT2_GLOBAL(0x9E3D0C, uint16);
+	ax = RCT2_GLOBAL(0x9E3D0C, uint16);
 	RCT2_GLOBAL(0xEDF80C, uint32) = 0;
-	ecx += RCT2_GLOBAL(0x9E3D10, uint16);
+	cx += RCT2_GLOBAL(0x9E3D10, uint16);
 
-	RCT2_GLOBAL(0x9ABDA8, uint16) = eax;
-	ecx -= dpi->x;
-	if (ecx < 0){
-		RCT2_GLOBAL(0x9ABDA8, uint16) += ecx;
+	RCT2_GLOBAL(0x9ABDA8, uint16) = ax;
+	cx -= dpi->x;
+	if (cx < 0){
+		RCT2_GLOBAL(0x9ABDA8, uint16) += cx;
 		if (RCT2_GLOBAL(0x9ABDA8, uint16) <= 0)return;
-		RCT2_GLOBAL(0xEDF80C, uint16) -= ecx;
-		ecx = 0;
+		RCT2_GLOBAL(0xEDF80C, uint16) -= cx;
+		_ecx = 0;
+		cx = 0;
 	}
 	else{
-		edi += ecx;
+		_ecx = cx;
+		_edi += _ecx;
 	}
-	ecx += RCT2_GLOBAL(0x9ABDA8, uint16);
-	ecx -= dpi->width;
-	if (ecx > 0){
-		RCT2_GLOBAL(0x9ABDA8, uint16) -= ecx;
+	cx += RCT2_GLOBAL(0x9ABDA8, uint16);
+	cx -= dpi->width;
+	if (cx > 0){
+		RCT2_GLOBAL(0x9ABDA8, uint16) -= cx;
 		if (RCT2_GLOBAL(0x9ABDA8, uint16) <= 0)return;
 	}
-	eax = dpi->width;
-	eax += dpi->pitch;
-	RCT2_GLOBAL(0x9ABDB0, uint16) = eax;
-	//ebx esi edi
+	ax = dpi->width;
+	ax += dpi->pitch;
+	RCT2_GLOBAL(0x9ABDB0, uint16) = ax;
+	_eax = (_eax & 0xFFFF0000) + ax;
+	_ebx = (_ebx & 0xFFFF0000) + bx;
+	_ecx = (_ecx & 0xFFFF0000) + cx;
+	_edx = (_edx & 0xFFFF0000) + dx;
+
+	//_ebx _esi _edi
 	char* FindThis = "FINDTHISSTRING";
-	//eax 280,ecx FEFC,edx FFFF,ebx A40003,esp CFCC4,ebp 9DEA74,esi 3E1DF13,edi 322076
-	RCT2_CALLPROC_X(0x67A690, eax, ebx, ecx, edx, esi, edi, ebp);
+	//_eax 280,_ecx FEFC,_edx FFFF,_ebx A40003,esp CFCC4,ebp 9DEA74,_esi 3E1DF13,_edi 322076
+	_asm{
+		push eax
+		push ebx
+		push ecx
+		push edx
+		push edi
+		push esi
+		push ebp
+		push 0x67AA18
+		push dpi
+		mov eax, _eax
+		mov ebx, _ebx
+		mov ecx, _ecx
+		mov edx, _edx
+		mov esi, _esi
+		mov edi, _edi 
+		mov ebp, _ebp
+		call [esp+4] 
+		add esp,8    
+		pop ebp
+		pop esi
+		pop edi
+		pop edx
+		pop ecx
+		pop ebx
+		pop eax
+	}
 }
 
 /**
@@ -229,7 +267,8 @@ void gfx_draw_sprite(rct_drawpixelinfo *dpi, int image_id, int x, int y)
 	eax >>= 26;
 	RCT2_GLOBAL(0x00EDF81C, uint32) = image_id & 0xE0000000;
 	eax &= 0x7;
-	eax = RCT2_GLOBAL(0x009E3CE4 + 4 * eax, uint32);
+	
+	eax = RCT2_GLOBAL(0x009E3CE4 + eax*4, uint32);//3D91F13 3F71F13 * 2
 	RCT2_GLOBAL(0x009E3CDC, uint32) = eax;
 
 	if ((image_id & (1 << 31)) && (image_id & (1 << 29))){
@@ -280,12 +319,12 @@ void gfx_draw_sprite(rct_drawpixelinfo *dpi, int image_id, int x, int y)
 		//long jump into 0x67FAAE
 		return;
 	}
-	eax = *((uint32*)ebx + 8);
-	ebp = *((uint32*)ebx + 12);
-	RCT2_GLOBAL(0x9E3D08, uint32) = *((uint32*)ebx);
-	RCT2_GLOBAL(0x9E3D0C, uint32) = *((uint32*)ebx + 4);
-	RCT2_GLOBAL(0x9E3D10, uint32) = *((uint32*)ebx + 8);
-	RCT2_GLOBAL(0x9E3D14, uint32) = *((uint32*)ebx + 12);
+	eax = *((uint32*)ebx + 2);
+	ebp = *((uint32*)ebx + 3);
+	RCT2_GLOBAL(0x9E3D08, uint32) = *((uint32*)ebx);//3F8DF13 3D8DF13
+	RCT2_GLOBAL(0x9E3D0C, uint32) = *((uint32*)ebx + 1);//4E003A 4E003A
+	RCT2_GLOBAL(0x9E3D10, uint32) = *((uint32*)ebx + 2);//3000A * 2
+	RCT2_GLOBAL(0x9E3D14, uint32) = *((uint32*)ebx + 3);//DC10005 *2
 	if (RCT2_GLOBAL(0x9E3D14, uint32) & (1 << 2)){
 		sub_0x67A934(eax, ebp, ebx, esi, dpi, x, y);
 		//long jump into 0x67A934

From 16ed98348a1ee20c7e0728b9e2f158b9ba5cbe90 Mon Sep 17 00:00:00 2001
From: Duncan Frost <duncans_pumpkin@hotmail.co.uk>
Date: Sat, 10 May 2014 10:16:23 +0100
Subject: [PATCH 6/8] Found bug due to signness on global var

---
 src/gfx.c | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/src/gfx.c b/src/gfx.c
index 2199fb6fe1..994536e0a5 100644
--- a/src/gfx.c
+++ b/src/gfx.c
@@ -162,9 +162,9 @@ void sub_0x67A934(int _eax, int _ebp, int _ebx, int _esi, rct_drawpixelinfo *dpi
 	dx -= dpi->y;
 	if (dx < 0)
 	{
-		RCT2_GLOBAL(0x9ABDAC, uint16) += dx;
-		if (RCT2_GLOBAL(0x9ABDAC, uint16) <= 0)return;
-		RCT2_GLOBAL(0xEDF808, uint16) -= dx;
+		RCT2_GLOBAL(0x9ABDAC, sint16) += dx;
+		if (RCT2_GLOBAL(0x9ABDAC, sint16) <= 0)return;
+		RCT2_GLOBAL(0xEDF808, sint16) -= dx;
 		_edx = 0;
 		dx = 0;
 	}
@@ -180,22 +180,22 @@ void sub_0x67A934(int _eax, int _ebp, int _ebx, int _esi, rct_drawpixelinfo *dpi
 		dx = bx;
 		_edi += _eax;
 	}
-	dx += RCT2_GLOBAL(0x9ABDAC, uint16);
+	dx += RCT2_GLOBAL(0x9ABDAC, sint16);
 	dx -= dpi->height;
 	if (dx > 0){
-		RCT2_GLOBAL(0x9ABDAC, uint16) -= dx;
-		if (RCT2_GLOBAL(0x9ABDAC, uint16) <= 0)return;
+		RCT2_GLOBAL(0x9ABDAC, sint16) -= dx;
+		if (RCT2_GLOBAL(0x9ABDAC, sint16) <= 0)return;
 	}
 	ax = RCT2_GLOBAL(0x9E3D0C, uint16);
 	RCT2_GLOBAL(0xEDF80C, uint32) = 0;
 	cx += RCT2_GLOBAL(0x9E3D10, uint16);
 
-	RCT2_GLOBAL(0x9ABDA8, uint16) = ax;
+	RCT2_GLOBAL(0x9ABDA8, sint16) = ax;
 	cx -= dpi->x;
 	if (cx < 0){
-		RCT2_GLOBAL(0x9ABDA8, uint16) += cx;
-		if (RCT2_GLOBAL(0x9ABDA8, uint16) <= 0)return;
-		RCT2_GLOBAL(0xEDF80C, uint16) -= cx;
+		RCT2_GLOBAL(0x9ABDA8, sint16) += cx;
+		if (RCT2_GLOBAL(0x9ABDA8, sint16) <= 0)return;
+		RCT2_GLOBAL(0xEDF80C, sint16) -= cx;
 		_ecx = 0;
 		cx = 0;
 	}
@@ -203,11 +203,11 @@ void sub_0x67A934(int _eax, int _ebp, int _ebx, int _esi, rct_drawpixelinfo *dpi
 		_ecx = cx;
 		_edi += _ecx;
 	}
-	cx += RCT2_GLOBAL(0x9ABDA8, uint16);
+	cx += RCT2_GLOBAL(0x9ABDA8, sint16);
 	cx -= dpi->width;
 	if (cx > 0){
-		RCT2_GLOBAL(0x9ABDA8, uint16) -= cx;
-		if (RCT2_GLOBAL(0x9ABDA8, uint16) <= 0)return;
+		RCT2_GLOBAL(0x9ABDA8, sint16) -= cx;
+		if (RCT2_GLOBAL(0x9ABDA8, sint16) <= 0)return;
 	}
 	ax = dpi->width;
 	ax += dpi->pitch;

From 26f4b35e613d8fb2f211a0165a9b4208088e29a9 Mon Sep 17 00:00:00 2001
From: Duncan Frost <duncans_pumpkin@hotmail.co.uk>
Date: Sat, 10 May 2014 12:26:19 +0100
Subject: [PATCH 7/8] Cleaned up code so that it makes more sense.

---
 src/addresses.h |  18 ++++++
 src/gfx.c       | 164 +++++++++++++++++++-----------------------------
 2 files changed, 81 insertions(+), 101 deletions(-)

diff --git a/src/addresses.h b/src/addresses.h
index 2ec02b5edd..961bb4e1a1 100644
--- a/src/addresses.h
+++ b/src/addresses.h
@@ -277,6 +277,24 @@ static void RCT2_CALLPROC_X(int address, int _eax, int _ebx, int _ecx, int _edx,
 	}
 }
 
+static void RCT2_CALLPROC_X_EBPSAFE(int address, int _eax, int _ebx, int _ecx, int _edx, int _esi, int _edi, int _ebp)
+{
+	__asm {
+		push ebp
+		push address
+		mov eax, _eax
+		mov ebx, _ebx
+		mov ecx, _ecx
+		mov edx, _edx
+		mov esi, _esi
+		mov edi, _edi
+		mov ebp, _ebp
+		call[esp]
+		add esp, 4
+		pop ebp
+	}
+}
+
 static void RCT2_CALLFUNC_X(int address, int *_eax, int *_ebx, int *_ecx, int *_edx, int *_esi, int *_edi, int *_ebp)
 {
 	__asm {
diff --git a/src/gfx.c b/src/gfx.c
index 994536e0a5..c114018af6 100644
--- a/src/gfx.c
+++ b/src/gfx.c
@@ -145,108 +145,69 @@ void gfx_fill_rect_inset(rct_drawpixelinfo* dpi, short left, short top, short ri
 	RCT2_CALLPROC_X(0x006E6F81, left, right, top, bottom, _si, dpi, colour);
 }
 
+#define RCT2_Y_RELATED_GLOBAL_1 0x9E3D12 //uint16
+#define RCT2_Y_RELATED_GLOBAL_2 0x9ABDAC //sint16
+
 /*
-* rct2: 0x67A934
+* rct2: 0x67A934 title screen bitmaps on buttons
+* This function readies all the global vars for copying the sprite data onto the screen
+* I think its only used for bitmaps onto buttons but i am not sure.
 */
-void sub_0x67A934(int _eax, int _ebp, int _ebx, int _esi, rct_drawpixelinfo *dpi, int x, int y){
+void sub_0x67A934(rct_drawpixelinfo *dpi, int x, int y){
 	//_eax = 3000A, _ecx = 9C, _edx = 152, _ebx = A46798, esp = CFCC8, ebp = DC10005, _esi = 0, _edi = 9DEA74
-	int _ecx = x, _edx = y, _edi = dpi;
-	sint16 dx = y, ax = 0, bx = 0, cx = x;
-	_ebp = dpi;
-	_esi = RCT2_GLOBAL(0x9E3D08, uint32);
-	_edi = *((uint32*)dpi);//2A18EC
-	dx += RCT2_GLOBAL(0x9E3D12, uint16);
-	ax = RCT2_GLOBAL(0x9E3D0E, uint16);
+	int _edi = dpi, _esi;
+	sint16 translated_x = x, translated_y = y;
+	char* bits_pointer;
+	bits_pointer = dpi->bits;
+
+	translated_y += RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_1, uint16);
 	RCT2_GLOBAL(0xEDF808, uint32) = 0;
-	RCT2_GLOBAL(0x9ABDAC, uint16) = ax;
-	dx -= dpi->y;
-	if (dx < 0)
+	RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, uint16) = RCT2_GLOBAL(0x9E3D0E, uint16);
+	translated_y -= dpi->y;
+	if (translated_y < 0)
 	{
-		RCT2_GLOBAL(0x9ABDAC, sint16) += dx;
-		if (RCT2_GLOBAL(0x9ABDAC, sint16) <= 0)return;
-		RCT2_GLOBAL(0xEDF808, sint16) -= dx;
-		_edx = 0;
-		dx = 0;
+		RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16) += translated_y;
+		if (RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16) <= 0)return;
+		RCT2_GLOBAL(0xEDF808, sint16) -= translated_y;
+		translated_y = 0;
 	}
 	else{
-		ax = dpi->width;
-		bx = dx;
-		ax += dpi->pitch;
-		_edx = dx;
-		_eax = ax;
-		_eax *= _edx;
-		_edx = 0;
-		ax = _eax;
-		dx = bx;
-		_edi += _eax;
+		bits_pointer += (dpi->width + dpi->pitch)*translated_y;
 	}
-	dx += RCT2_GLOBAL(0x9ABDAC, sint16);
-	dx -= dpi->height;
-	if (dx > 0){
-		RCT2_GLOBAL(0x9ABDAC, sint16) -= dx;
-		if (RCT2_GLOBAL(0x9ABDAC, sint16) <= 0)return;
+
+	translated_y += RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16);
+	translated_y -= dpi->height;
+	if (translated_y > 0){
+		RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16) -= translated_y;
+		if (RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16) <= 0)return;
 	}
-	ax = RCT2_GLOBAL(0x9E3D0C, uint16);
+
 	RCT2_GLOBAL(0xEDF80C, uint32) = 0;
-	cx += RCT2_GLOBAL(0x9E3D10, uint16);
+	translated_x += RCT2_GLOBAL(0x9E3D10, uint16);
 
-	RCT2_GLOBAL(0x9ABDA8, sint16) = ax;
-	cx -= dpi->x;
-	if (cx < 0){
-		RCT2_GLOBAL(0x9ABDA8, sint16) += cx;
+	RCT2_GLOBAL(0x9ABDA8, sint16) = RCT2_GLOBAL(0x9E3D0C, uint16);
+	translated_x -= dpi->x;
+	if (translated_x < 0){
+		RCT2_GLOBAL(0x9ABDA8, sint16) += translated_x;
 		if (RCT2_GLOBAL(0x9ABDA8, sint16) <= 0)return;
-		RCT2_GLOBAL(0xEDF80C, sint16) -= cx;
-		_ecx = 0;
-		cx = 0;
+		RCT2_GLOBAL(0xEDF80C, sint16) -= translated_x;
+		translated_x = 0;
 	}
 	else{
-		_ecx = cx;
-		_edi += _ecx;
+		bits_pointer += translated_x;
 	}
-	cx += RCT2_GLOBAL(0x9ABDA8, sint16);
-	cx -= dpi->width;
-	if (cx > 0){
-		RCT2_GLOBAL(0x9ABDA8, sint16) -= cx;
+	translated_x += RCT2_GLOBAL(0x9ABDA8, sint16);
+	translated_x -= dpi->width;
+	if (translated_x > 0){
+		RCT2_GLOBAL(0x9ABDA8, sint16) -= translated_x;
 		if (RCT2_GLOBAL(0x9ABDA8, sint16) <= 0)return;
 	}
-	ax = dpi->width;
-	ax += dpi->pitch;
-	RCT2_GLOBAL(0x9ABDB0, uint16) = ax;
-	_eax = (_eax & 0xFFFF0000) + ax;
-	_ebx = (_ebx & 0xFFFF0000) + bx;
-	_ecx = (_ecx & 0xFFFF0000) + cx;
-	_edx = (_edx & 0xFFFF0000) + dx;
 
-	//_ebx _esi _edi
-	char* FindThis = "FINDTHISSTRING";
-	//_eax 280,_ecx FEFC,_edx FFFF,_ebx A40003,esp CFCC4,ebp 9DEA74,_esi 3E1DF13,_edi 322076
-	_asm{
-		push eax
-		push ebx
-		push ecx
-		push edx
-		push edi
-		push esi
-		push ebp
-		push 0x67AA18
-		push dpi
-		mov eax, _eax
-		mov ebx, _ebx
-		mov ecx, _ecx
-		mov edx, _edx
-		mov esi, _esi
-		mov edi, _edi 
-		mov ebp, _ebp
-		call [esp+4] 
-		add esp,8    
-		pop ebp
-		pop esi
-		pop edi
-		pop edx
-		pop ecx
-		pop ebx
-		pop eax
-	}
+	RCT2_GLOBAL(0x9ABDB0, uint16) = dpi->width + dpi->pitch;
+	
+	// I dont think it uses ecx, edx but just in case
+	//This is a G1 Loaded sprite address 0x9E3D08
+	RCT2_CALLPROC_X_EBPSAFE(0x67AA18, 0, 0, translated_x, translated_y, RCT2_GLOBAL(0x9E3D08, uint32), bits_pointer, dpi);
 }
 
 /**
@@ -258,7 +219,6 @@ void sub_0x67A934(int _eax, int _ebp, int _ebx, int _esi, rct_drawpixelinfo *dpi
  */
 void gfx_draw_sprite(rct_drawpixelinfo *dpi, int image_id, int x, int y)
 {
-	char* FindMe = "FINDTHISOTHERSTRING";
 	//RCT2_CALLPROC_X(0x0067A28E, 0, image_id, x, y, 0, dpi, 0);
 	//return;
 
@@ -284,7 +244,7 @@ void gfx_draw_sprite(rct_drawpixelinfo *dpi, int image_id, int x, int y)
 		RCT2_GLOBAL(0x9ABEFF, uint32) = ebp;
 		RCT2_GLOBAL(0x9ABF03, uint32) = esi;
 		ebp = *((uint32*)eax + 0xFB);
-		eax = ebx;//0x67a310
+		eax = ebx;
 
 		RCT2_GLOBAL(0x9ABF07, uint32) = ebp;
 		eax >>= 24;
@@ -321,26 +281,26 @@ void gfx_draw_sprite(rct_drawpixelinfo *dpi, int image_id, int x, int y)
 	}
 	eax = *((uint32*)ebx + 2);
 	ebp = *((uint32*)ebx + 3);
-	RCT2_GLOBAL(0x9E3D08, uint32) = *((uint32*)ebx);//3F8DF13 3D8DF13
-	RCT2_GLOBAL(0x9E3D0C, uint32) = *((uint32*)ebx + 1);//4E003A 4E003A
-	RCT2_GLOBAL(0x9E3D10, uint32) = *((uint32*)ebx + 2);//3000A * 2
-	RCT2_GLOBAL(0x9E3D14, uint32) = *((uint32*)ebx + 3);//DC10005 *2
+	RCT2_GLOBAL(0x9E3D08, uint32) = *((uint32*)ebx);
+	RCT2_GLOBAL(0x9E3D0C, uint32) = *((uint32*)ebx + 1);
+	RCT2_GLOBAL(0x9E3D10, uint32) = *((uint32*)ebx + 2); //Y related
+	RCT2_GLOBAL(0x9E3D14, uint32) = *((uint32*)ebx + 3);
 	if (RCT2_GLOBAL(0x9E3D14, uint32) & (1 << 2)){
-		sub_0x67A934(eax, ebp, ebx, esi, dpi, x, y);
-		//long jump into 0x67A934
+		//Title screen bitmaps
+		sub_0x67A934(dpi, x, y);
 		return;
 	}
 	ebp = dpi;
 	esi = RCT2_GLOBAL(0x9E3D08, uint32);
 	RCT2_GLOBAL(0x9E3CE0, uint32) = 0;
 	edi = *((uint32*)dpi);
-	edx = edx & 0xFFFF + RCT2_GLOBAL(0x9E3D12, uint16);
+	edx = edx & 0xFFFF + RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_1, uint16);
 	eax = eax & 0xFFFF + RCT2_GLOBAL(0x9E3D0E, uint16);
-	RCT2_GLOBAL(0x9ABDAC, uint16) = eax;
+	RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16) = eax;
 	edx -= dpi->y;
 	if (edx < 0){
-		RCT2_GLOBAL(0x9ABDAC, uint16)+= edx;
-		if (RCT2_GLOBAL(0x9ABDAC, uint16) <= 0){
+		RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16) += edx;
+		if (RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16) <= 0){
 			//jump 0x67A607
 			return;
 		}
@@ -359,15 +319,16 @@ void gfx_draw_sprite(rct_drawpixelinfo *dpi, int image_id, int x, int y)
 		edx = ebx;
 		edi += eax;
 	}
-	edx += RCT2_GLOBAL(0x9ABDAC, uint16);
+	edx += RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16);
 	if (edx > dpi->height){
 		edx -= dpi->height;
-		if (RCT2_GLOBAL(0x9ABDAC, uint32) > edx)
+		//RCT2_Y_RELATED_GLOBAL_2 is normaly 16 bit signed???
+		if (RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint32) > edx)
 		{
-			RCT2_GLOBAL(0x9ABDAC, uint32) -= edx;
+			RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, uint32) -= edx;
 			return;//jump to 0x67A607
 		}
-		RCT2_GLOBAL(0x9ABDAC, uint32) -= edx;
+		RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, uint32) -= edx;
 	}
 	else{
 		edx -= dpi->height;
@@ -413,7 +374,8 @@ void gfx_draw_sprite(rct_drawpixelinfo *dpi, int image_id, int x, int y)
 		ecx -= dpi->width;
 	}
 	if (!(RCT2_GLOBAL(0x9E3D14, uint16) & 0x02)){
-		eax = RCT2_GLOBAL(0x9ABDAC, uint8);
+		//RCT2_Y_RELATED_GLOBAL_2 is normally 16 bit signed???
+		eax = RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, uint8);
 		edx = RCT2_GLOBAL(0x9ABDAE, uint16);
 		ebp = RCT2_GLOBAL(0x9ABDB0, uint16);
 		ebx = RCT2_GLOBAL(0xEDF81C, uint32);

From 6d97593093f0e8a2ee6f32a5db0506ba8046052e Mon Sep 17 00:00:00 2001
From: Duncan Frost <duncans_pumpkin@hotmail.co.uk>
Date: Sun, 11 May 2014 10:14:38 +0100
Subject: [PATCH 8/8] Bug in main draw_sprite func for now skipping code

---
 src/gfx.c | 196 +++++++++++++++++++++++++++---------------------------
 src/gfx.h |   2 +-
 2 files changed, 100 insertions(+), 98 deletions(-)

diff --git a/src/gfx.c b/src/gfx.c
index c114018af6..8f663827f5 100644
--- a/src/gfx.c
+++ b/src/gfx.c
@@ -147,23 +147,24 @@ void gfx_fill_rect_inset(rct_drawpixelinfo* dpi, short left, short top, short ri
 
 #define RCT2_Y_RELATED_GLOBAL_1 0x9E3D12 //uint16
 #define RCT2_Y_RELATED_GLOBAL_2 0x9ABDAC //sint16
-
+#define RCT2_X_RELATED_GLOBAL_1 0x9E3D10 //uint16
+#define RCT2_X_RELATED_GLOBAL_2 0x9ABDA8 //sint16
 /*
 * rct2: 0x67A934 title screen bitmaps on buttons
 * This function readies all the global vars for copying the sprite data onto the screen
 * I think its only used for bitmaps onto buttons but i am not sure.
 */
 void sub_0x67A934(rct_drawpixelinfo *dpi, int x, int y){
-	//_eax = 3000A, _ecx = 9C, _edx = 152, _ebx = A46798, esp = CFCC8, ebp = DC10005, _esi = 0, _edi = 9DEA74
+
 	int _edi = dpi, _esi;
 	sint16 translated_x = x, translated_y = y;
 	char* bits_pointer;
 	bits_pointer = dpi->bits;
 
-	translated_y += RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_1, uint16);
+	translated_y += RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_1, uint16) - dpi->y;
 	RCT2_GLOBAL(0xEDF808, uint32) = 0;
-	RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, uint16) = RCT2_GLOBAL(0x9E3D0E, uint16);
-	translated_y -= dpi->y;
+	RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16) = RCT2_GLOBAL(0x9E3D0E, sint16);
+
 	if (translated_y < 0)
 	{
 		RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16) += translated_y;
@@ -175,38 +176,35 @@ void sub_0x67A934(rct_drawpixelinfo *dpi, int x, int y){
 		bits_pointer += (dpi->width + dpi->pitch)*translated_y;
 	}
 
-	translated_y += RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16);
-	translated_y -= dpi->height;
+	translated_y += RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16) - dpi->height;
 	if (translated_y > 0){
 		RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16) -= translated_y;
 		if (RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16) <= 0)return;
 	}
 
 	RCT2_GLOBAL(0xEDF80C, uint32) = 0;
-	translated_x += RCT2_GLOBAL(0x9E3D10, uint16);
+	translated_x += RCT2_GLOBAL(RCT2_X_RELATED_GLOBAL_1, uint16) - dpi->x;
 
-	RCT2_GLOBAL(0x9ABDA8, sint16) = RCT2_GLOBAL(0x9E3D0C, uint16);
-	translated_x -= dpi->x;
+	RCT2_GLOBAL(RCT2_X_RELATED_GLOBAL_2, sint16) = RCT2_GLOBAL(0x9E3D0C, sint16);
 	if (translated_x < 0){
-		RCT2_GLOBAL(0x9ABDA8, sint16) += translated_x;
-		if (RCT2_GLOBAL(0x9ABDA8, sint16) <= 0)return;
+		RCT2_GLOBAL(RCT2_X_RELATED_GLOBAL_2, sint16) += translated_x;
+		if (RCT2_GLOBAL(RCT2_X_RELATED_GLOBAL_2, sint16) <= 0)return;
 		RCT2_GLOBAL(0xEDF80C, sint16) -= translated_x;
 		translated_x = 0;
 	}
 	else{
 		bits_pointer += translated_x;
 	}
-	translated_x += RCT2_GLOBAL(0x9ABDA8, sint16);
+	translated_x += RCT2_GLOBAL(RCT2_X_RELATED_GLOBAL_2, sint16);
 	translated_x -= dpi->width;
 	if (translated_x > 0){
-		RCT2_GLOBAL(0x9ABDA8, sint16) -= translated_x;
-		if (RCT2_GLOBAL(0x9ABDA8, sint16) <= 0)return;
+		RCT2_GLOBAL(RCT2_X_RELATED_GLOBAL_2, sint16) -= translated_x;
+		if (RCT2_GLOBAL(RCT2_X_RELATED_GLOBAL_2, sint16) <= 0)return;
 	}
 
 	RCT2_GLOBAL(0x9ABDB0, uint16) = dpi->width + dpi->pitch;
 	
 	// I dont think it uses ecx, edx but just in case
-	//This is a G1 Loaded sprite address 0x9E3D08
 	RCT2_CALLPROC_X_EBPSAFE(0x67AA18, 0, 0, translated_x, translated_y, RCT2_GLOBAL(0x9E3D08, uint32), bits_pointer, dpi);
 }
 
@@ -227,11 +225,11 @@ void gfx_draw_sprite(rct_drawpixelinfo *dpi, int image_id, int x, int y)
 	eax >>= 26;
 	RCT2_GLOBAL(0x00EDF81C, uint32) = image_id & 0xE0000000;
 	eax &= 0x7;
-	
-	eax = RCT2_GLOBAL(0x009E3CE4 + eax*4, uint32);//3D91F13 3F71F13 * 2
+	eax = RCT2_GLOBAL(0x009E3CE4 + eax*4, uint32);
 	RCT2_GLOBAL(0x009E3CDC, uint32) = eax;
 
 	if ((image_id & (1 << 31)) && (image_id & (1 << 29))){
+		/*
 		eax = image_id;
 		RCT2_GLOBAL(0x9E3CDC, uint32) = 0;
 		eax >>= 19;
@@ -259,130 +257,134 @@ void gfx_draw_sprite(rct_drawpixelinfo *dpi, int image_id, int x, int y)
 		ebp = *((uint32*)eax + 0xFB);
 
 		RCT2_GLOBAL(0x9ABDA4, uint32) = 0x009ABE0C;
-		RCT2_GLOBAL(0x9ABEDE, uint32) = ebp;
+		RCT2_GLOBAL(0x9ABEDE, uint32) = ebp;*/
+		return;
 	} else if ((image_id & (1 << 31))){
-		//0x67a361
+		return;
+		//jump into 0x67a361
 	} else if ((image_id & (1 << 30))){
-		//0x67a445
+		return;
+		//jump into 0x67a445
 	}
-	//0x67A46E
+
 	ebx &= 0x7FFFF;
 	ebx <<= 4;
 	ebx += RCT2_ADDRESS_G1_ELEMENTS;
 	if (dpi->pad_0E >= 1){
 		if (dpi->pad_0E == 1){
-			//long jump into 0x67bd81
+			return;
+			//jump into 0x67bd81
 		}
 		if (dpi->pad_0E >= 3){
-			//long jump into 0x67DADA
+			return;//jump into 0x67FAAE
 		}
-		//long jump into 0x67FAAE
+		//jump into 0x67DADA
 		return;
 	}
 	eax = *((uint32*)ebx + 2);
 	ebp = *((uint32*)ebx + 3);
-	RCT2_GLOBAL(0x9E3D08, uint32) = *((uint32*)ebx);
+	RCT2_GLOBAL(0x9E3D08, uint32) = *((uint32*)ebx); //offset to g1 bits?
 	RCT2_GLOBAL(0x9E3D0C, uint32) = *((uint32*)ebx + 1);
-	RCT2_GLOBAL(0x9E3D10, uint32) = *((uint32*)ebx + 2); //Y related
+	RCT2_GLOBAL(0x9E3D10, uint32) = *((uint32*)ebx + 2); //X-Y related unsigned? sets RCT2_X_RELATED_GLOBAL_1 and Y
 	RCT2_GLOBAL(0x9E3D14, uint32) = *((uint32*)ebx + 3);
 	if (RCT2_GLOBAL(0x9E3D14, uint32) & (1 << 2)){
 		//Title screen bitmaps
 		sub_0x67A934(dpi, x, y);
 		return;
 	}
+	
+	
+	RCT2_CALLPROC_X(0x0067A28E, 0, image_id, x, y, 0, dpi, 0);
+	return;
+	//There is a mistake in the code below this point calling the above to skip it.
+
+	//dpi on stack
+	int translated_x, translated_y;
+	char* bits_pointer;
+
 	ebp = dpi;
 	esi = RCT2_GLOBAL(0x9E3D08, uint32);
 	RCT2_GLOBAL(0x9E3CE0, uint32) = 0;
-	edi = *((uint32*)dpi);
-	edx = edx & 0xFFFF + RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_1, uint16);
-	eax = eax & 0xFFFF + RCT2_GLOBAL(0x9E3D0E, uint16);
-	RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16) = eax;
-	edx -= dpi->y;
-	if (edx < 0){
-		RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16) += edx;
+	bits_pointer = dpi->bits;	
+
+	RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16) = RCT2_GLOBAL(0x9E3D0E, sint16);
+
+	translated_y = y + RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_1, uint16) - dpi->y;
+
+
+	if (translated_y < 0){
+		RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16) += translated_y;
 		if (RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16) <= 0){
-			//jump 0x67A607
 			return;
 		}
-		edx = -edx;
-		eax = RCT2_GLOBAL(0x9E3D0C, uint16);
-		eax *= edx;
-		edx = 0;
-		esi += eax;
-		RCT2_GLOBAL(0x9E3CE0, uint32) += eax;
+		translated_y = -translated_y;
+		esi += translated_y * RCT2_GLOBAL(0x9E3D0C, sint16);
+		RCT2_GLOBAL(0x9E3CE0, sint32) += translated_y * RCT2_GLOBAL(0x9E3D0C, sint16);
+		translated_y = 0;
 	} else {
-		ebx = edx;
-		eax = dpi->width;
-		
-		eax += dpi->pitch;
-		eax *= edx;
-		edx = ebx;
-		edi += eax;
+		eax = (dpi->width + dpi->pitch) * translated_y;
+		bits_pointer += eax;
 	}
-	edx += RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16);
-	if (edx > dpi->height){
-		edx -= dpi->height;
-		//RCT2_Y_RELATED_GLOBAL_2 is normaly 16 bit signed???
-		if (RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint32) > edx)
+
+	translated_y += RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16) - dpi->height;;
+
+	if (translated_y > 0){
+		RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16) -= translated_y;
+		if (RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16) <=0)
 		{
-			RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, uint32) -= edx;
-			return;//jump to 0x67A607
+			return;
 		}
-		RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, uint32) -= edx;
 	}
-	else{
-		edx -= dpi->height;
-	}
-	eax = RCT2_GLOBAL(0x9E3D0C, uint16);
-	RCT2_GLOBAL(0x9ABDA8, uint16) = eax;
-	ebx = dpi->width;
-	eax = -eax;
-	eax += ebx;
-	eax += dpi->pitch;
+
+	RCT2_GLOBAL(RCT2_X_RELATED_GLOBAL_2, sint16) = RCT2_GLOBAL(0x9E3D0C, sint16);
+	eax = dpi->width + dpi->pitch - RCT2_GLOBAL(0x9E3D0C, sint16);
+
 	RCT2_GLOBAL(0x9ABDAE, uint16) = 0;
-	RCT2_GLOBAL(0x9ABDB0, uint16) = eax;
-	ecx += RCT2_GLOBAL(0x9E3D10, uint16);
-	if (ecx > dpi->x){
-		ecx -= dpi->x;
-		if (RCT2_GLOBAL(0x9ABDA8, uint16) > ecx ){//missing jz 0x67a596
-			RCT2_GLOBAL(0x9ABDA8, uint16) += ecx;
+	RCT2_GLOBAL(0x9ABDB0, sint16) = dpi->width + dpi->pitch - RCT2_GLOBAL(0x9E3D0C, sint16);
+	translated_x = x + RCT2_GLOBAL(RCT2_X_RELATED_GLOBAL_1, uint16) - dpi->x;
+
+	if (translated_x < 0){
+
+		RCT2_GLOBAL(RCT2_X_RELATED_GLOBAL_2, sint16) += translated_x;
+		if (RCT2_GLOBAL(RCT2_X_RELATED_GLOBAL_2, sint16) <= 0){
 			return;
 		}
-		RCT2_GLOBAL(0x9ABDA8, uint16) += ecx;
-		ecx -= RCT2_GLOBAL(0x9ABDAE, uint16);
-		esi -= ecx;
-		RCT2_GLOBAL(0x9E3CE0, uint32) -= ecx;
-		RCT2_GLOBAL(0x9ABDB0, uint16) -= ecx;
-		ecx = 0;
+
+		translated_x -= RCT2_GLOBAL(0x9ABDAE, sint16);
+		esi -= translated_x;
+		RCT2_GLOBAL(0x9E3CE0, sint32) -= translated_x;
+		RCT2_GLOBAL(0x9ABDB0, sint16) -= translated_x;
+		translated_x = 0;
 	}
-	else{
-		ecx -= dpi->x;
-	}
-	edi += ecx;
-	ecx += RCT2_GLOBAL(0x9ABDA8, uint16);
-	if (ecx > dpi->width){
-		ecx -= dpi->width;
-		if (RCT2_GLOBAL(0x9ABDA8, uint16) > ecx){
-			RCT2_GLOBAL(0x9ABDA8, uint16) -= ecx;
+
+	bits_pointer += translated_x;
+	translated_x += RCT2_GLOBAL(RCT2_X_RELATED_GLOBAL_2, sint16) - dpi->width;
+
+	if (translated_x > 0){
+		RCT2_GLOBAL(RCT2_X_RELATED_GLOBAL_2, sint16) -= translated_x;
+		if (RCT2_GLOBAL(RCT2_X_RELATED_GLOBAL_2, sint16) <= 0){
 			return;
 		}
-		RCT2_GLOBAL(0x9ABDA8, uint16) -= ecx;
-		RCT2_GLOBAL(0x9ABDAE, uint16) += ecx;
-		RCT2_GLOBAL(0x9ABDB0, uint16) += ecx;
-	}
-	else{
-		ecx -= dpi->width;
+		RCT2_GLOBAL(0x9ABDAE, sint16) += translated_x;
+		RCT2_GLOBAL(0x9ABDB0, sint16) += translated_x;
 	}
+
 	if (!(RCT2_GLOBAL(0x9E3D14, uint16) & 0x02)){
-		//RCT2_Y_RELATED_GLOBAL_2 is normally 16 bit signed???
-		eax = RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, uint8);
-		edx = RCT2_GLOBAL(0x9ABDAE, uint16);
-		ebp = RCT2_GLOBAL(0x9ABDB0, uint16);
+		eax = (RCT2_GLOBAL(RCT2_Y_RELATED_GLOBAL_2, sint16) & 0xFF) << 8;
+		edx = RCT2_GLOBAL(0x9ABDAE, sint16);
+		ebp = RCT2_GLOBAL(0x9ABDB0, sint16);
 		ebx = RCT2_GLOBAL(0xEDF81C, uint32);
-		RCT2_CALLPROC_X(0x67A690, eax, ebx, ecx, edx, esi, edi, ebp);
+		ecx = 0xFFFF&translated_x;
+		//ebx, esi, edi, ah used in 0x67a690
+		//Calling is wrong
+		//esi or bits is most likely wrong
+		RCT2_CALLPROC_X(0x67A690, eax, ebx, ecx, edx, esi, bits_pointer, ebp);
 		return;
 	}
 	//0x67A60A
+	esi -= RCT2_GLOBAL(0x9E3D08, sint32);
+	return;
+	
 
 }
 
diff --git a/src/gfx.h b/src/gfx.h
index 9af771d4f8..de0411b258 100644
--- a/src/gfx.h
+++ b/src/gfx.h
@@ -31,7 +31,7 @@ typedef struct {
 	short width;		// 0x08
 	short height;		// 0x0A
 	short pitch;		// 0x0C			note: this is actually (pitch - width)
-	char pad_0E;		// 0x0E
+	uint16 pad_0E;		// 0x0E
 	char var_0F;		// 0x0F
 } rct_drawpixelinfo;