; Bomberman NES - Phase 3 semantic refinement ; Based on the user-validated Phase 2 recursive trace from NMI, RESET, and IRQ/BRK. ; Reachable official 6502 opcodes are emitted as instructions. ; Unreachable bytes are classified as explicit data regions. .setcpu "6502" .include "symbols.inc" .include "locals.inc" .segment "PRG" .org $C000 ; Routine: Reset ; Global: Reachable code entry at CPU $C000 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Reset: sei ; ROM $000010: 78 lda #$00 ; ROM $000011: A9 00 sta PPUMASK ; ROM $000013: 8D 01 20 sta PPUCTRL ; ROM $000016: 8D 00 20 cld ; ROM $000019: D8 ldx #$FF ; ROM $00001A: A2 FF txs ; ROM $00001C: 9A ; Routine: WaitForFirstStartupVBlank ; Global: Reachable code entry at CPU $C00D traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. WaitForFirstStartupVBlank: lda PPUSTATUS ; ROM $00001D: AD 02 20 bpl WaitForFirstStartupVBlank ; ROM $000020: 10 FB ; Routine: WaitForSecondStartupVBlank ; Global: Reachable code entry at CPU $C012 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. WaitForSecondStartupVBlank: lda PPUSTATUS ; ROM $000022: AD 02 20 bpl WaitForSecondStartupVBlank ; ROM $000025: 10 FB jmp InitializeSystemAndRunMainLoop ; ROM $000027: 4C 0C C3 ; Routine: NmiHandler ; Global: Reachable code entry at CPU $C01A traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. NmiHandler: pha ; ROM $00002A: 48 txa ; ROM $00002B: 8A pha ; ROM $00002C: 48 tya ; ROM $00002D: 98 pha ; ROM $00002E: 48 ldx #$00 ; ROM $00002F: A2 00 stx FrameSyncFlag ; ROM $000031: 86 0B stx OAMADDR ; ROM $000033: 8E 03 20 lda $60 ; ROM $000036: A5 60 beq Nmi_TransferSpriteDmaPath_C03E ; ROM $000038: F0 14 lda #$19 ; ROM $00003A: A9 19 sta $0700 ; ROM $00003C: 8D 00 07 lda #$EC ; ROM $00003F: A9 EC sta $0701 ; ROM $000041: 8D 01 07 lda #$00 ; ROM $000044: A9 00 sta $0702 ; ROM $000046: 8D 02 07 lda #$F8 ; ROM $000049: A9 F8 sta $0703 ; ROM $00004B: 8D 03 07 ; Routine: Nmi_TransferSpriteDmaPath_C03E ; Global: Reachable code entry at CPU $C03E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Nmi_TransferSpriteDmaPath_C03E: lda #$07 ; ROM $00004E: A9 07 sta OAMDMA ; ROM $000050: 8D 14 40 ldx #$09 ; ROM $000053: A2 09 stx $16 ; ROM $000055: 86 16 bne Nmi_ReadZp14_C0B3 ; ROM $000057: D0 6A ; Routine: Nmi_TransferVramDataPath_C049 ; Global: Reachable code entry at CPU $C049 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Nmi_TransferVramDataPath_C049: lda $0602,y ; ROM $000059: B9 02 06 ora $0600,y ; ROM $00005C: 19 00 06 pha ; ROM $00005F: 48 sta PPUADDR ; ROM $000060: 8D 06 20 ldx $0601,y ; ROM $000063: BE 01 06 stx PPUADDR ; ROM $000066: 8E 06 20 ldx $0603,y ; ROM $000069: BE 03 06 lda $D9C6,x ; ROM $00006C: BD C6 D9 sta PPUDATA ; ROM $00006F: 8D 07 20 lda $D9C7,x ; ROM $000072: BD C7 D9 sta PPUDATA ; ROM $000075: 8D 07 20 pla ; ROM $000078: 68 sta PPUADDR ; ROM $000079: 8D 06 20 lda $0601,y ; ROM $00007C: B9 01 06 clc ; ROM $00007F: 18 adc #$20 ; ROM $000080: 69 20 sta PPUADDR ; ROM $000082: 8D 06 20 lda $D9C8,x ; ROM $000085: BD C8 D9 sta PPUDATA ; ROM $000088: 8D 07 20 lda $D9C9,x ; ROM $00008B: BD C9 D9 sta PPUDATA ; ROM $00008E: 8D 07 20 lda #$23 ; ROM $000091: A9 23 ora $0600,y ; ROM $000093: 19 00 06 pha ; ROM $000096: 48 sta PPUADDR ; ROM $000097: 8D 06 20 lda $0604,y ; ROM $00009A: B9 04 06 sta PPUADDR ; ROM $00009D: 8D 06 20 tax ; ROM $0000A0: AA lda PPUDATA ; ROM $0000A1: AD 07 20 lda PPUDATA ; ROM $0000A4: AD 07 20 and $0606,y ; ROM $0000A7: 39 06 06 ora $0607,y ; ROM $0000AA: 19 07 06 tay ; ROM $0000AD: A8 pla ; ROM $0000AE: 68 sta PPUADDR ; ROM $0000AF: 8D 06 20 stx PPUADDR ; ROM $0000B2: 8E 06 20 sty PPUDATA ; ROM $0000B5: 8C 07 20 lda #$08 ; ROM $0000B8: A9 08 clc ; ROM $0000BA: 18 adc $14 ; ROM $0000BB: 65 14 sta $14 ; ROM $0000BD: 85 14 dec $16 ; ROM $0000BF: C6 16 beq Nmi_ReadScreenState_C0B9 ; ROM $0000C1: F0 06 ; Routine: Nmi_ReadZp14_C0B3 ; Global: Reachable code entry at CPU $C0B3 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Nmi_ReadZp14_C0B3: ldy $14 ; ROM $0000C3: A4 14 cpy $15 ; ROM $0000C5: C4 15 bne Nmi_TransferVramDataPath_C049 ; ROM $0000C7: D0 90 ; Routine: Nmi_ReadScreenState_C0B9 ; Global: Reachable code entry at CPU $C0B9 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Nmi_ReadScreenState_C0B9: lda $72 ; ROM $0000C9: A5 72 beq Nmi_ReadNmiWorkPending_C0E4 ; ROM $0000CB: F0 27 lda #$22 ; ROM $0000CD: A9 22 ldx #$68 ; ROM $0000CF: A2 68 jsr SetPpuAddress ; ROM $0000D1: 20 96 C1 ldy #$B0 ; ROM $0000D4: A0 B0 lda $5F ; ROM $0000D6: A5 5F bne Nmi_TransferVramDataPath_C0CC ; ROM $0000D8: D0 02 ldy #$40 ; ROM $0000DA: A0 40 ; Routine: Nmi_TransferVramDataPath_C0CC ; Global: Reachable code entry at CPU $C0CC traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Nmi_TransferVramDataPath_C0CC: sty PPUDATA ; ROM $0000DC: 8C 07 20 lda #$22 ; ROM $0000DF: A9 22 ldx #$70 ; ROM $0000E1: A2 70 jsr SetPpuAddress ; ROM $0000E3: 20 96 C1 ldy #$B0 ; ROM $0000E6: A0 B0 lda $5F ; ROM $0000E8: A5 5F beq Nmi_TransferVramDataPath_C0DE ; ROM $0000EA: F0 02 ldy #$40 ; ROM $0000EC: A0 40 ; Routine: Nmi_TransferVramDataPath_C0DE ; Global: Reachable code entry at CPU $C0DE traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Nmi_TransferVramDataPath_C0DE: sty PPUDATA ; ROM $0000EE: 8C 07 20 jmp Nmi_ReadPpuStatusPath_C126 ; ROM $0000F1: 4C 26 C1 ; Routine: Nmi_ReadNmiWorkPending_C0E4 ; Global: Reachable code entry at CPU $C0E4 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Nmi_ReadNmiWorkPending_C0E4: lda $60 ; ROM $0000F4: A5 60 beq Nmi_ReadPpuStatusPath_C126 ; ROM $0000F6: F0 3E lda $16 ; ROM $0000F8: A5 16 cmp #$04 ; ROM $0000FA: C9 04 bcc Nmi_ReadPpuStatusPath_C126 ; ROM $0000FC: 90 38 lda #$20 ; ROM $0000FE: A9 20 ldx #$4B ; ROM $000100: A2 4B jsr SetPpuAddress ; ROM $000102: 20 96 C1 ldx #$00 ; ROM $000105: A2 00 ; Routine: Nmi_TransferVramDataPath_C0F7 ; Global: Reachable code entry at CPU $C0F7 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Nmi_TransferVramDataPath_C0F7: lda $61,x ; ROM $000107: B5 61 bne Nmi_TransferVramDataPath_C107 ; ROM $000109: D0 0C lda #$3A ; ROM $00010B: A9 3A sta PPUDATA ; ROM $00010D: 8D 07 20 inx ; ROM $000110: E8 cpx #$07 ; ROM $000111: E0 07 bne Nmi_TransferVramDataPath_C0F7 ; ROM $000113: D0 F2 beq Nmi_ReadZp93_C114 ; ROM $000115: F0 0D ; Routine: Nmi_TransferVramDataPath_C107 ; Global: Reachable code entry at CPU $C107 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Nmi_TransferVramDataPath_C107: lda $61,x ; ROM $000117: B5 61 clc ; ROM $000119: 18 adc #$30 ; ROM $00011A: 69 30 sta PPUDATA ; ROM $00011C: 8D 07 20 inx ; ROM $00011F: E8 cpx #$07 ; ROM $000120: E0 07 bne Nmi_TransferVramDataPath_C107 ; ROM $000122: D0 F3 ; Routine: Nmi_ReadZp93_C114 ; Global: Reachable code entry at CPU $C114 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Nmi_ReadZp93_C114: lda #$20 ; ROM $000124: A9 20 ldx #$46 ; ROM $000126: A2 46 jsr SetPpuAddress ; ROM $000128: 20 96 C1 lda $93 ; ROM $00012B: A5 93 cmp #$FF ; ROM $00012D: C9 FF bne Nmi_CallHelper_C123 ; ROM $00012F: D0 02 lda #$00 ; ROM $000131: A9 00 ; Routine: Nmi_CallHelper_C123 ; Global: Reachable code entry at CPU $C123 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Nmi_CallHelper_C123: jsr Menu_HandleControl_DF48 ; ROM $000133: 20 48 DF ; Routine: Nmi_ReadPpuStatusPath_C126 ; Global: Reachable code entry at CPU $C126 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Nmi_ReadPpuStatusPath_C126: lda PPUSTATUS ; ROM $000136: AD 02 20 jsr CommitPpuStateAndScroll ; ROM $000139: 20 96 C2 inc $33 ; ROM $00013C: E6 33 lda $6A ; ROM $00013E: A5 6A beq Nmi_UpdateAudioChannelPath_C13E ; ROM $000140: F0 0C inc $69 ; ROM $000142: E6 69 lda $69 ; ROM $000144: A5 69 cmp #$3C ; ROM $000146: C9 3C bcc Nmi_UpdateAudioChannelPath_C13E ; ROM $000148: 90 04 lda #$00 ; ROM $00014A: A9 00 sta $6A ; ROM $00014C: 85 6A ; Routine: Nmi_UpdateAudioChannelPath_C13E ; Global: Reachable code entry at CPU $C13E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Nmi_UpdateAudioChannelPath_C13E: sta $69 ; ROM $00014E: 85 69 jsr Ppu_WriteZp10_C19D ; ROM $000150: 20 9D C1 jsr Gameplay_ReadZpB2_E4C7 ; ROM $000153: 20 C7 E4 jsr SoundUpdate ; ROM $000156: 20 5F E6 lda $38 ; ROM $000159: A5 38 beq Nmi_ReadNmiWorkPending_C16E ; ROM $00015B: F0 21 lda $59 ; ROM $00015D: A5 59 bne Nmi_ReadNmiWorkPending_C16E ; ROM $00015F: D0 1D lda #$0E ; ROM $000161: A9 0E sta APUDMCCTRL ; ROM $000163: 8D 10 40 lda #$00 ; ROM $000166: A9 00 sta $38 ; ROM $000168: 85 38 lda #$C0 ; ROM $00016A: A9 C0 sta APUDMCADDR ; ROM $00016C: 8D 12 40 lda #$FF ; ROM $00016F: A9 FF sta APUDMCLENGTH ; ROM $000171: 8D 13 40 lda #$0F ; ROM $000174: A9 0F sta APUSTATUS ; ROM $000176: 8D 15 40 lda #$1F ; ROM $000179: A9 1F sta APUSTATUS ; ROM $00017B: 8D 15 40 ; Routine: Nmi_ReadNmiWorkPending_C16E ; Global: Reachable code entry at CPU $C16E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Nmi_ReadNmiWorkPending_C16E: lda $60 ; ROM $00017E: A5 60 beq Nmi_ToggleZpDB_C18A ; ROM $000180: F0 18 ; Routine: Nmi_ReadPpuStatusPath_C172 ; Global: Reachable code entry at CPU $C172 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Nmi_ReadPpuStatusPath_C172: lda PPUSTATUS ; ROM $000182: AD 02 20 and #$40 ; ROM $000185: 29 40 bne Nmi_ReadPpuStatusPath_C172 ; ROM $000187: D0 F9 ; Routine: Nmi_ReadPpuStatusPath_C179 ; Global: Reachable code entry at CPU $C179 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Nmi_ReadPpuStatusPath_C179: lda PPUSTATUS ; ROM $000189: AD 02 20 and #$40 ; ROM $00018C: 29 40 beq Nmi_ReadPpuStatusPath_C179 ; ROM $00018E: F0 F9 lda $0E ; ROM $000190: A5 0E sta PPUSCROLL ; ROM $000192: 8D 05 20 lda $0F ; ROM $000195: A5 0F sta PPUSCROLL ; ROM $000197: 8D 05 20 ; Routine: Nmi_ToggleZpDB_C18A ; Global: Reachable code entry at CPU $C18A traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Nmi_ToggleZpDB_C18A: lda #$05 ; ROM $00019A: A9 05 eor $DB ; ROM $00019C: 45 DB sta $DB ; ROM $00019E: 85 DB pla ; ROM $0001A0: 68 tay ; ROM $0001A1: A8 pla ; ROM $0001A2: 68 tax ; ROM $0001A3: AA pla ; ROM $0001A4: 68 rti ; ROM $0001A5: 40 ; Routine: SetPpuAddress ; Global: Reachable code entry at CPU $C196 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. SetPpuAddress: sta PPUADDR ; ROM $0001A6: 8D 06 20 stx PPUADDR ; ROM $0001A9: 8E 06 20 rts ; ROM $0001AC: 60 ; Routine: Ppu_WriteZp10_C19D ; Global: Reachable code entry at CPU $C19D traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Ppu_WriteZp10_C19D: jsr Ppu_ReadControllerAndReturnA_C1BF ; ROM $0001AD: 20 BF C1 lda ControllerState1 ; ROM $0001B0: A5 12 sta $10 ; ROM $0001B2: 85 10 lda $13 ; ROM $0001B4: A5 13 sta $11 ; ROM $0001B6: 85 11 jsr Ppu_ReadControllerAndReturnA_C1BF ; ROM $0001B8: 20 BF C1 lda ControllerState1 ; ROM $0001BB: A5 12 cmp $10 ; ROM $0001BD: C5 10 bne Ppu_WriteZp13_C1B8 ; ROM $0001BF: D0 07 lda $13 ; ROM $0001C1: A5 13 cmp $11 ; ROM $0001C3: C5 11 bne Ppu_WriteZp13_C1B8 ; ROM $0001C5: D0 01 rts ; ROM $0001C7: 60 ; Routine: Ppu_WriteZp13_C1B8 ; Global: Reachable code entry at CPU $C1B8 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Ppu_WriteZp13_C1B8: lda #$00 ; ROM $0001C8: A9 00 sta ControllerState1 ; ROM $0001CA: 85 12 sta $13 ; ROM $0001CC: 85 13 rts ; ROM $0001CE: 60 ; Routine: Ppu_ReadControllerAndReturnA_C1BF ; Global: Reachable code entry at CPU $C1BF traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Ppu_ReadControllerAndReturnA_C1BF: lda #$01 ; ROM $0001CF: A9 01 sta JOY1 ; ROM $0001D1: 8D 16 40 lda #$00 ; ROM $0001D4: A9 00 sta JOY1 ; ROM $0001D6: 8D 16 40 tax ; ROM $0001D9: AA ldy #$08 ; ROM $0001DA: A0 08 ; Routine: Ppu_ReadControllerPath_C1CC ; Global: Reachable code entry at CPU $C1CC traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Ppu_ReadControllerPath_C1CC: txa ; ROM $0001DC: 8A asl a ; ROM $0001DD: 0A tax ; ROM $0001DE: AA lda JOY1 ; ROM $0001DF: AD 16 40 jsr Ppu_HandleControl_C1EB ; ROM $0001E2: 20 EB C1 bne Ppu_ReadControllerPath_C1CC ; ROM $0001E5: D0 F5 stx ControllerState1 ; ROM $0001E7: 86 12 ldx #$00 ; ROM $0001E9: A2 00 ldy #$08 ; ROM $0001EB: A0 08 ; Routine: Ppu_ReadControllerPath_C1DD ; Global: Reachable code entry at CPU $C1DD traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Ppu_ReadControllerPath_C1DD: txa ; ROM $0001ED: 8A asl a ; ROM $0001EE: 0A tax ; ROM $0001EF: AA lda JOY2 ; ROM $0001F0: AD 17 40 jsr Ppu_HandleControl_C1EB ; ROM $0001F3: 20 EB C1 bne Ppu_ReadControllerPath_C1DD ; ROM $0001F6: D0 F5 stx $13 ; ROM $0001F8: 86 13 rts ; ROM $0001FA: 60 ; Routine: Ppu_HandleControl_C1EB ; Global: Reachable code entry at CPU $C1EB traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Ppu_HandleControl_C1EB: and #$03 ; ROM $0001FB: 29 03 beq Ppu_RetreatIndexY_C1F0 ; ROM $0001FD: F0 01 inx ; ROM $0001FF: E8 ; Routine: Ppu_RetreatIndexY_C1F0 ; Global: Reachable code entry at CPU $C1F0 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Ppu_RetreatIndexY_C1F0: dey ; ROM $000200: 88 rts ; ROM $000201: 60 ; Routine: InitializeVideoSystem ; Global: Reachable code entry at CPU $C1F2 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. InitializeVideoSystem: jsr DisableRendering ; ROM $000202: 20 57 C2 jsr Ppu_HandleControl_C2B9 ; ROM $000205: 20 B9 C2 lda #$10 ; ROM $000208: A9 10 sta PpuCtrlShadow ; ROM $00020A: 85 0C sta PPUCTRL ; ROM $00020C: 8D 00 20 lda #$00 ; ROM $00020F: A9 00 sta $0E ; ROM $000211: 85 0E sta $14 ; ROM $000213: 85 14 sta $15 ; ROM $000215: 85 15 sta $0F ; ROM $000217: 85 0F jsr HideAllSprites ; ROM $000219: 20 68 C2 jsr DisableRendering ; ROM $00021C: 20 57 C2 jsr WaitForVBlankTransition ; ROM $00021F: 20 8B C2 jsr UploadSystemPalette ; ROM $000222: 20 C3 C2 ; Routine: Ppu_HandleControl_C215 ; Global: Reachable code entry at CPU $C215 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Ppu_HandleControl_C215: lda #$20 ; ROM $000225: A9 20 ldx #$00 ; ROM $000227: A2 00 jsr SetPpuAddress ; ROM $000229: 20 96 C1 ldy #$08 ; ROM $00022C: A0 08 lda #$B0 ; ROM $00022E: A9 B0 ; Routine: Ppu_TransferVramDataPath_C220 ; Global: Reachable code entry at CPU $C220 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Ppu_TransferVramDataPath_C220: sta PPUDATA ; ROM $000230: 8D 07 20 dex ; ROM $000233: CA bne Ppu_TransferVramDataPath_C220 ; ROM $000234: D0 FA dey ; ROM $000236: 88 bne Ppu_TransferVramDataPath_C220 ; ROM $000237: D0 F7 lda #$23 ; ROM $000239: A9 23 ldx #$C0 ; ROM $00023B: A2 C0 jsr SetPpuAddress ; ROM $00023D: 20 96 C1 ldx #$40 ; ROM $000240: A2 40 lda #$00 ; ROM $000242: A9 00 ; Routine: Ppu_TransferVramDataPath_C234 ; Global: Reachable code entry at CPU $C234 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Ppu_TransferVramDataPath_C234: sta PPUDATA ; ROM $000244: 8D 07 20 dex ; ROM $000247: CA bne Ppu_TransferVramDataPath_C234 ; ROM $000248: D0 FA rts ; ROM $00024A: 60 ; Routine: Ppu_CallHelper_C23B ; Global: Reachable code entry at CPU $C23B traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Ppu_CallHelper_C23B: jsr Ppu_HandleControl_C2B9 ; ROM $00024B: 20 B9 C2 jsr WaitForVBlankTransition ; ROM $00024E: 20 8B C2 lda #$0E ; ROM $000251: A9 0E jsr Ppu_UpdatePpuState_C25C ; ROM $000253: 20 5C C2 jsr Ppu_TransferSpriteDmaAndReturnA_C24C ; ROM $000256: 20 4C C2 jmp EnableNmiInPpuControl ; ROM $000259: 4C B0 C2 ; Routine: Ppu_TransferSpriteDmaAndReturnA_C24C ; Global: Reachable code entry at CPU $C24C traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Ppu_TransferSpriteDmaAndReturnA_C24C: lda #$00 ; ROM $00025C: A9 00 sta OAMADDR ; ROM $00025E: 8D 03 20 lda #$07 ; ROM $000261: A9 07 sta OAMDMA ; ROM $000263: 8D 14 40 rts ; ROM $000266: 60 ; Routine: DisableRendering ; Global: Reachable code entry at CPU $C257 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. DisableRendering: jsr WaitForVBlankTransition ; ROM $000267: 20 8B C2 lda #$00 ; ROM $00026A: A9 00 ; Routine: Ppu_UpdatePpuState_C25C ; Global: Reachable code entry at CPU $C25C traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Ppu_UpdatePpuState_C25C: sta PPUMASK ; ROM $00026C: 8D 01 20 ; Routine: Ppu_HandleControl_C25F ; Global: Reachable code entry at CPU $C25F traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Ppu_HandleControl_C25F: sta PpuMaskShadow ; ROM $00026F: 85 0D rts ; ROM $000271: 60 ; Routine: Ppu_HandleControl_C262 ; Global: Reachable code entry at CPU $C262 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Ppu_HandleControl_C262: lda PpuMaskShadow ; ROM $000272: A5 0D ora #$10 ; ROM $000274: 09 10 bne Ppu_HandleControl_C25F ; ROM $000276: D0 F7 ; Routine: HideAllSprites ; Global: Reachable code entry at CPU $C268 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. HideAllSprites: ldy #$1C ; ROM $000278: A0 1C lda #$F8 ; ROM $00027A: A9 F8 ; Routine: Ppu_WriteRam0700_C26C ; Global: Reachable code entry at CPU $C26C traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Ppu_WriteRam0700_C26C: sta $0700,y ; ROM $00027C: 99 00 07 sta $0720,y ; ROM $00027F: 99 20 07 sta $0740,y ; ROM $000282: 99 40 07 sta $0760,y ; ROM $000285: 99 60 07 sta $0780,y ; ROM $000288: 99 80 07 sta $07A0,y ; ROM $00028B: 99 A0 07 sta $07C0,y ; ROM $00028E: 99 C0 07 sta $07E0,y ; ROM $000291: 99 E0 07 dey ; ROM $000294: 88 dey ; ROM $000295: 88 dey ; ROM $000296: 88 dey ; ROM $000297: 88 bpl Ppu_WriteRam0700_C26C ; ROM $000298: 10 E2 rts ; ROM $00029A: 60 ; Routine: WaitForVBlankTransition ; Global: Reachable code entry at CPU $C28B traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. WaitForVBlankTransition: lda PPUSTATUS ; ROM $00029B: AD 02 20 bmi WaitForVBlankTransition ; ROM $00029E: 30 FB ; Routine: Ppu_WaitPpuStatusPath_C290 ; Global: Reachable code entry at CPU $C290 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Ppu_WaitPpuStatusPath_C290: lda PPUSTATUS ; ROM $0002A0: AD 02 20 bpl Ppu_WaitPpuStatusPath_C290 ; ROM $0002A3: 10 FB rts ; ROM $0002A5: 60 ; Routine: CommitPpuStateAndScroll ; Global: Reachable code entry at CPU $C296 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. CommitPpuStateAndScroll: lda PpuMaskShadow ; ROM $0002A6: A5 0D sta PPUMASK ; ROM $0002A8: 8D 01 20 lda #$00 ; ROM $0002AB: A9 00 ldx #$00 ; ROM $0002AD: A2 00 jsr SetPpuAddress ; ROM $0002AF: 20 96 C1 lda #$00 ; ROM $0002B2: A9 00 sta PPUSCROLL ; ROM $0002B4: 8D 05 20 sta PPUSCROLL ; ROM $0002B7: 8D 05 20 lda PpuCtrlShadow ; ROM $0002BA: A5 0C sta PPUCTRL ; ROM $0002BC: 8D 00 20 rts ; ROM $0002BF: 60 ; Routine: EnableNmiInPpuControl ; Global: Reachable code entry at CPU $C2B0 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. EnableNmiInPpuControl: jsr WaitForVBlankTransition ; ROM $0002C0: 20 8B C2 lda PpuCtrlShadow ; ROM $0002C3: A5 0C ora #$80 ; ROM $0002C5: 09 80 bne Ppu_UpdatePpuStatePath_C2BD ; ROM $0002C7: D0 04 ; Routine: Ppu_HandleControl_C2B9 ; Global: Reachable code entry at CPU $C2B9 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Ppu_HandleControl_C2B9: lda PpuCtrlShadow ; ROM $0002C9: A5 0C and #$7F ; ROM $0002CB: 29 7F ; Routine: Ppu_UpdatePpuStatePath_C2BD ; Global: Reachable code entry at CPU $C2BD traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Ppu_UpdatePpuStatePath_C2BD: sta PpuCtrlShadow ; ROM $0002CD: 85 0C sta PPUCTRL ; ROM $0002CF: 8D 00 20 rts ; ROM $0002D2: 60 ; Routine: UploadSystemPalette ; Global: Reachable code entry at CPU $C2C3 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. UploadSystemPalette: lda #$3F ; ROM $0002D3: A9 3F ldx #$00 ; ROM $0002D5: A2 00 jsr SetPpuAddress ; ROM $0002D7: 20 96 C1 ldy #$20 ; ROM $0002DA: A0 20 ; Routine: Ppu_TransferVramDataPath_C2CC ; Global: Reachable code entry at CPU $C2CC traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Ppu_TransferVramDataPath_C2CC: lda $C2E7,x ; ROM $0002DC: BD E7 C2 sta PPUDATA ; ROM $0002DF: 8D 07 20 inx ; ROM $0002E2: E8 dey ; ROM $0002E3: 88 bne Ppu_TransferVramDataPath_C2CC ; ROM $0002E4: D0 F6 ; Routine: Ppu_SetVramAddress_C2D6 ; Global: Reachable code entry at CPU $C2D6 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Ppu_SetVramAddress_C2D6: lda #$3F ; ROM $0002E6: A9 3F sta PPUADDR ; ROM $0002E8: 8D 06 20 lda #$00 ; ROM $0002EB: A9 00 sta PPUADDR ; ROM $0002ED: 8D 06 20 sta PPUADDR ; ROM $0002F0: 8D 06 20 sta PPUADDR ; ROM $0002F3: 8D 06 20 rts ; ROM $0002F6: 60 ; Data region: CPU $C2E7-$C306; unreachable by direct recursive trace. SystemPaletteData: .byte $19, $0F, $10, $30, $19, $16, $26, $36, $19, $0F, $18, $28, $19, $0F, $17, $07 ; ROM $0002F7: 19 0F 10 30 19 16 26 36 19 0F 18 28 19 0F 17 07 .byte $19, $30, $21, $26, $19, $0F, $26, $30, $19, $0F, $15, $30, $19, $0F, $21, $30 ; ROM $000307: 19 30 21 26 19 0F 26 30 19 0F 15 30 19 0F 21 30 ; Routine: WaitForFrameBoundary ; Global: Reachable code entry at CPU $C307 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. WaitForFrameBoundary: lda ControllerState1 ; ROM $000317: A5 12 bne WaitForFrameBoundary ; ROM $000319: D0 FC rts ; ROM $00031B: 60 ; Routine: InitializeSystemAndRunMainLoop ; Global: Reachable code entry at CPU $C30C traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. InitializeSystemAndRunMainLoop: ldy #$00 ; ROM $00031C: A0 00 sty $E0 ; ROM $00031E: 84 E0 iny ; ROM $000320: C8 sty $E1 ; ROM $000321: 84 E1 dey ; ROM $000323: 88 tya ; ROM $000324: 98 ldx #$07 ; ROM $000325: A2 07 ; Routine: Main_WriteSoundDispatchIndex_C317 ; Global: Reachable code entry at CPU $C317 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteSoundDispatchIndex_C317: sta ($E0),y ; ROM $000327: 91 E0 iny ; ROM $000329: C8 bne Main_WriteSoundDispatchIndex_C317 ; ROM $00032A: D0 FB inc $E1 ; ROM $00032C: E6 E1 dex ; ROM $00032E: CA bne Main_WriteSoundDispatchIndex_C317 ; ROM $00032F: D0 F6 ldx #$00 ; ROM $000331: A2 00 ldy $08 ; ROM $000333: A4 08 cpy #$93 ; ROM $000335: C0 93 bne Main_WriteZp00_C333 ; ROM $000337: D0 0A ldy $09 ; ROM $000339: A4 09 bne Main_WriteZp00_C333 ; ROM $00033B: D0 06 ldy $0A ; ROM $00033D: A4 0A bne Main_WriteZp00_C333 ; ROM $00033F: D0 02 ldx #$08 ; ROM $000341: A2 08 ; Routine: Main_WriteZp00_C333 ; Global: Reachable code entry at CPU $C333 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteZp00_C333: sta $00,x ; ROM $000343: 95 00 inx ; ROM $000345: E8 bne Main_WriteZp00_C333 ; ROM $000346: D0 FB lda #$93 ; ROM $000348: A9 93 sta $08 ; ROM $00034A: 85 08 ; Routine: Main_WriteZpDB_C33C ; Global: Reachable code entry at CPU $C33C traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteZpDB_C33C: jsr InitializeVideoSystem ; ROM $00034C: 20 F2 C1 lda #$00 ; ROM $00034F: A9 00 sta $DB ; ROM $000351: 85 DB jsr InitializeApu ; ROM $000353: 20 42 E6 lda #$01 ; ROM $000356: A9 01 sta $B5 ; ROM $000358: 85 B5 ; Routine: Main_UpdateAudioChannelPath_C34A ; Global: Reachable code entry at CPU $C34A traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_UpdateAudioChannelPath_C34A: ldx #$FF ; ROM $00035A: A2 FF txs ; ROM $00035C: 9A lda #$0F ; ROM $00035D: A9 0F sta APUSTATUS ; ROM $00035F: 8D 15 40 lda #$00 ; ROM $000362: A9 00 sta $38 ; ROM $000364: 85 38 sta $59 ; ROM $000366: 85 59 sta $B2 ; ROM $000368: 85 B2 sta $60 ; ROM $00036A: 85 60 sta $70 ; ROM $00036C: 85 70 jsr ComposeStatusScreen ; ROM $00036E: 20 83 DE jsr EnableNmiInPpuControl ; ROM $000371: 20 B0 C2 lda #$01 ; ROM $000374: A9 01 sta $72 ; ROM $000376: 85 72 ; Routine: MainGameLoop ; Global: Reachable code entry at CPU $C368 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. MainGameLoop: lda ControllerState1 ; ROM $000378: A5 12 bne MainGameLoop ; ROM $00037A: D0 FC ; Routine: Main_WriteMainDelay_C36C ; Global: Reachable code entry at CPU $C36C traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteMainDelay_C36C: lda #$08 ; ROM $00037C: A9 08 sta $70 ; ROM $00037E: 85 70 ; Routine: Main_ReadOptionState_C370 ; Global: Reachable code entry at CPU $C370 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_ReadOptionState_C370: jsr WaitForNmiFrameHandoff ; ROM $000380: 20 FB CB lda ControllerState1 ; ROM $000383: A5 12 and #$10 ; ROM $000385: 29 10 bne Main_ReadGameState_C398 ; ROM $000387: D0 1F lda ControllerState1 ; ROM $000389: A5 12 and #$20 ; ROM $00038B: 29 20 beq Main_DecrementSubDelay_C38B ; ROM $00038D: F0 0C lda $5F ; ROM $00038F: A5 5F eor #$01 ; ROM $000391: 49 01 sta $5F ; ROM $000393: 85 5F jsr WaitForFrameBoundary ; ROM $000395: 20 07 C3 jmp Main_WriteMainDelay_C36C ; ROM $000398: 4C 6C C3 ; Routine: Main_DecrementSubDelay_C38B ; Global: Reachable code entry at CPU $C38B traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_DecrementSubDelay_C38B: jsr AdvanceRandomState ; ROM $00039B: 20 70 D6 dec $71 ; ROM $00039E: C6 71 bne Main_ReadOptionState_C370 ; ROM $0003A0: D0 DE dec $70 ; ROM $0003A2: C6 70 bne Main_ReadOptionState_C370 ; ROM $0003A4: D0 DA inc $59 ; ROM $0003A6: E6 59 ; Routine: Main_ReadGameState_C398 ; Global: Reachable code entry at CPU $C398 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_ReadGameState_C398: lda $59 ; ROM $0003A8: A5 59 bne Main_WriteScreenState_C3A3 ; ROM $0003AA: D0 07 lda $5F ; ROM $0003AC: A5 5F beq Main_WriteScreenState_C3A3 ; ROM $0003AE: F0 03 jsr RunMenuSelectionScreen ; ROM $0003B0: 20 8E DA ; Routine: Main_WriteScreenState_C3A3 ; Global: Reachable code entry at CPU $C3A3 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteScreenState_C3A3: lda #$00 ; ROM $0003B3: A9 00 sta $72 ; ROM $0003B5: 85 72 jsr WaitForFrameBoundary ; ROM $0003B7: 20 07 C3 lda #$02 ; ROM $0003BA: A9 02 sta $68 ; ROM $0003BC: 85 68 lda $59 ; ROM $0003BE: A5 59 bne Main_WriteZp58_C3B6 ; ROM $0003C0: D0 04 lda $5F ; ROM $0003C2: A5 5F bne Main_WriteObjectDirection_C40A ; ROM $0003C4: D0 54 ; Routine: Main_WriteZp58_C3B6 ; Global: Reachable code entry at CPU $C3B6 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteZp58_C3B6: lda #$01 ; ROM $0003C6: A9 01 sta $58 ; ROM $0003C8: 85 58 lda $59 ; ROM $0003CA: A5 59 bne Main_UpdateAudioChannelPath_C3C7 ; ROM $0003CC: D0 09 ldx #$06 ; ROM $0003CE: A2 06 lda #$00 ; ROM $0003D0: A9 00 ; Routine: Main_WriteZp61_C3C2 ; Global: Reachable code entry at CPU $C3C2 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteZp61_C3C2: sta $61,x ; ROM $0003D2: 95 61 dex ; ROM $0003D4: CA bpl Main_WriteZp61_C3C2 ; ROM $0003D5: 10 FB ; Routine: Main_UpdateAudioChannelPath_C3C7 ; Global: Reachable code entry at CPU $C3C7 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_UpdateAudioChannelPath_C3C7: lda #$10 ; ROM $0003D7: A9 10 sta $73 ; ROM $0003D9: 85 73 lda #$00 ; ROM $0003DB: A9 00 sta $74 ; ROM $0003DD: 85 74 sta $77 ; ROM $0003DF: 85 77 sta $75 ; ROM $0003E1: 85 75 sta $76 ; ROM $0003E3: 85 76 sta $79 ; ROM $0003E5: 85 79 sta $94 ; ROM $0003E7: 85 94 lda $59 ; ROM $0003E9: A5 59 beq Main_WriteObjectDirection_C40A ; ROM $0003EB: F0 2D lda #$09 ; ROM $0003ED: A9 09 sta $74 ; ROM $0003EF: 85 74 lda #$40 ; ROM $0003F1: A9 40 sta $73 ; ROM $0003F3: 85 73 lda #$01 ; ROM $0003F5: A9 01 sta $77 ; ROM $0003F7: 85 77 lda #$00 ; ROM $0003F9: A9 00 sta APUSTATUS ; ROM $0003FB: 8D 15 40 sta RandomState0 ; ROM $0003FE: 85 54 sta RandomState1 ; ROM $000400: 85 55 sta RandomState2 ; ROM $000402: 85 56 sta RandomState3 ; ROM $000404: 85 57 sta $33 ; ROM $000406: 85 33 lda #$F4 ; ROM $000408: A9 F4 sta $AC ; ROM $00040A: 85 AC lda #$ED ; ROM $00040C: A9 ED sta $AD ; ROM $00040E: 85 AD lda $EDF2 ; ROM $000410: AD F2 ED sta $AE ; ROM $000413: 85 AE lda $EDF3 ; ROM $000415: AD F3 ED sta $AF ; ROM $000418: 85 AF ; Routine: Main_WriteObjectDirection_C40A ; Global: Reachable code entry at CPU $C40A traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteObjectDirection_C40A: lda #$00 ; ROM $00041A: A9 00 sta $78 ; ROM $00041C: 85 78 sta $7A ; ROM $00041E: 85 7A ; Routine: Main_WriteZpB1_C410 ; Global: Reachable code entry at CPU $C410 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteZpB1_C410: lda #$00 ; ROM $000420: A9 00 sta $B1 ; ROM $000422: 85 B1 sta $A8 ; ROM $000424: 85 A8 sta $60 ; ROM $000426: 85 60 sta $9E ; ROM $000428: 85 9E sta $9F ; ROM $00042A: 85 9F sta $9C ; ROM $00042C: 85 9C sta $A0 ; ROM $00042E: 85 A0 sta $A1 ; ROM $000430: 85 A1 sta $A2 ; ROM $000432: 85 A2 sta $A3 ; ROM $000434: 85 A3 sta $A4 ; ROM $000436: 85 A4 sta $A5 ; ROM $000438: 85 A5 sta $A6 ; ROM $00043A: 85 A6 sta $A7 ; ROM $00043C: 85 A7 jsr Menu_WriteZp0E_DE1D ; ROM $00043E: 20 1D DE lda #$02 ; ROM $000441: A9 02 sta $B5 ; ROM $000443: 85 B5 jsr Main_ReadGameMode_C60B ; ROM $000445: 20 0B C6 lda #$03 ; ROM $000448: A9 03 sta $B5 ; ROM $00044A: 85 B5 jsr Ppu_HandleControl_C2B9 ; ROM $00044C: 20 B9 C2 jsr Gameplay_WriteTransferPointer_CA4B ; ROM $00044F: 20 4B CA jsr Main_WriteObjectType_C5CE ; ROM $000452: 20 CE C5 jsr Gameplay_ReadZp58_E4AF ; ROM $000455: 20 AF E4 jsr Main_CallHelper_C5FF ; ROM $000458: 20 FF C5 lda #$C8 ; ROM $00045B: A9 C8 sta $93 ; ROM $00045D: 85 93 ; Routine: Main_ReadZp5D_C44F ; Global: Reachable code entry at CPU $C44F traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_ReadZp5D_C44F: jsr Main_WriteStageCounter_C613 ; ROM $00045F: 20 13 C6 jsr HideAllSprites ; ROM $000462: 20 68 C2 jsr Frame_ReadZp7D_CC36 ; ROM $000465: 20 36 CC jsr Gameplay_HandleControl_C96A ; ROM $000468: 20 6A C9 jsr Frame_ReadObjectIndex_CE5B ; ROM $00046B: 20 5B CE jsr Object_WriteStageProgress_CFB0 ; ROM $00046E: 20 B0 CF jsr Gameplay_HandleControl_CA1B ; ROM $000471: 20 1B CA jsr Main_ReadZp33_C644 ; ROM $000474: 20 44 C6 jsr Gameplay_ReadStageProgress_E399 ; ROM $000477: 20 99 E3 lda $5D ; ROM $00047A: A5 5D bne Main_ReadGameState_C481 ; ROM $00047C: D0 13 lda $5E ; ROM $00047E: A5 5E bne Main_ReadGameState_C4BF ; ROM $000480: D0 4D lda $33 ; ROM $000482: A5 33 and #$03 ; ROM $000484: 29 03 bne Main_ReadZp5D_C44F ; ROM $000486: D0 D7 jsr GameplayUpdate ; ROM $000488: 20 9D C7 jsr Main_HandleControl_C66C ; ROM $00048B: 20 6C C6 jmp Main_ReadZp5D_C44F ; ROM $00048E: 4C 4F C4 ; Routine: Main_ReadGameState_C481 ; Global: Reachable code entry at CPU $C481 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_ReadGameState_C481: lda $59 ; ROM $000491: A5 59 bne Main_WriteGameMode_C4C3 ; ROM $000493: D0 3E lda #$00 ; ROM $000495: A9 00 sta $76 ; ROM $000497: 85 76 sta $78 ; ROM $000499: 85 78 sta $77 ; ROM $00049B: 85 77 sta $79 ; ROM $00049D: 85 79 sta $7A ; ROM $00049F: 85 7A lda #$08 ; ROM $0004A1: A9 08 sta $B5 ; ROM $0004A3: 85 B5 jsr Main_ReadGameMode_C60B ; ROM $0004A5: 20 0B C6 dec $68 ; ROM $0004A8: C6 68 bmi Main_WriteNmiWorkPending_C49F ; ROM $0004AA: 30 03 jmp Main_WriteZpB1_C410 ; ROM $0004AC: 4C 10 C4 ; Routine: Main_WriteNmiWorkPending_C49F ; Global: Reachable code entry at CPU $C49F traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteNmiWorkPending_C49F: lda #$00 ; ROM $0004AF: A9 00 sta $60 ; ROM $0004B1: 85 60 jsr Menu_CallHelper_DD3E ; ROM $0004B3: 20 3E DD lda #$09 ; ROM $0004B6: A9 09 sta $B5 ; ROM $0004B8: 85 B5 ; Routine: Main_ReadGameMode_C4AA ; Global: Reachable code entry at CPU $C4AA traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_ReadGameMode_C4AA: lda ControllerState1 ; ROM $0004BA: A5 12 and #$10 ; ROM $0004BC: 29 10 bne Main_WriteGameMode_C4B4 ; ROM $0004BE: D0 04 lda $B5 ; ROM $0004C0: A5 B5 bne Main_ReadGameMode_C4AA ; ROM $0004C2: D0 F6 ; Routine: Main_WriteGameMode_C4B4 ; Global: Reachable code entry at CPU $C4B4 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteGameMode_C4B4: lda #$00 ; ROM $0004C4: A9 00 sta $B5 ; ROM $0004C6: 85 B5 ; Routine: Main_HandleControl_C4B8 ; Global: Reachable code entry at CPU $C4B8 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_HandleControl_C4B8: lda ControllerState1 ; ROM $0004C8: A5 12 beq Main_HandleControl_C4B8 ; ROM $0004CA: F0 FC jmp Main_UpdateAudioChannelPath_C34A ; ROM $0004CC: 4C 4A C3 ; Routine: Main_ReadGameState_C4BF ; Global: Reachable code entry at CPU $C4BF traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_ReadGameState_C4BF: lda $59 ; ROM $0004CF: A5 59 beq Main_WriteGameMode_C4D5 ; ROM $0004D1: F0 12 ; Routine: Main_WriteGameMode_C4C3 ; Global: Reachable code entry at CPU $C4C3 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteGameMode_C4C3: lda #$00 ; ROM $0004D3: A9 00 sta $B5 ; ROM $0004D5: 85 B5 inc $B0 ; ROM $0004D7: E6 B0 lda $B0 ; ROM $0004D9: A5 B0 and #$03 ; ROM $0004DB: 29 03 beq Main_Dispatch_C4D2 ; ROM $0004DD: F0 03 jmp Main_UpdateAudioChannelPath_C34A ; ROM $0004DF: 4C 4A C3 ; Routine: Main_Dispatch_C4D2 ; Global: Reachable code entry at CPU $C4D2 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_Dispatch_C4D2: jmp Main_WriteZpDB_C33C ; ROM $0004E2: 4C 3C C3 ; Routine: Main_WriteGameMode_C4D5 ; Global: Reachable code entry at CPU $C4D5 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteGameMode_C4D5: lda #$0A ; ROM $0004E5: A9 0A sta $B5 ; ROM $0004E7: 85 B5 jsr Main_ReadGameMode_C60B ; ROM $0004E9: 20 0B C6 inc $68 ; ROM $0004EC: E6 68 inc $58 ; ROM $0004EE: E6 58 ldy #$00 ; ROM $0004F0: A0 00 lda $58 ; ROM $0004F2: A5 58 cmp #$33 ; ROM $0004F4: C9 33 bne Main_AdvanceIndexY_C4EB ; ROM $0004F6: D0 03 jmp Main_WriteObjectX_C56C ; ROM $0004F8: 4C 6C C5 ; Routine: Main_AdvanceIndexY_C4EB ; Global: Reachable code entry at CPU $C4EB traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_AdvanceIndexY_C4EB: iny ; ROM $0004FB: C8 sec ; ROM $0004FC: 38 sbc #$05 ; ROM $0004FD: E9 05 bcs Main_AdvanceIndexY_C4EB ; ROM $0004FF: B0 FA dey ; ROM $000501: 88 cpy #$08 ; ROM $000502: C0 08 bcc Main_WriteZp7E_C4F8 ; ROM $000504: 90 02 ldy #$08 ; ROM $000506: A0 08 ; Routine: Main_WriteZp7E_C4F8 ; Global: Reachable code entry at CPU $C4F8 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteZp7E_C4F8: sty $7E ; ROM $000508: 84 7E adc #$05 ; ROM $00050A: 69 05 cmp #$01 ; ROM $00050C: C9 01 beq Main_WriteNmiWorkPending_C503 ; ROM $00050E: F0 03 jmp Main_WriteZpB1_C410 ; ROM $000510: 4C 10 C4 ; Routine: Main_WriteNmiWorkPending_C503 ; Global: Reachable code entry at CPU $C503 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteNmiWorkPending_C503: lda #$00 ; ROM $000513: A9 00 sta $60 ; ROM $000515: 85 60 jsr Menu_WriteZp0E_DE53 ; ROM $000517: 20 53 DE lda #$02 ; ROM $00051A: A9 02 sta $B5 ; ROM $00051C: 85 B5 jsr Main_ReadGameMode_C60B ; ROM $00051E: 20 0B C6 jsr Ppu_HandleControl_C2B9 ; ROM $000521: 20 B9 C2 jsr Gameplay_WriteTransferPointer_CA72 ; ROM $000524: 20 72 CA jsr Main_WriteObjectType_C5CE ; ROM $000527: 20 CE C5 jsr Main_CallHelper_C5FF ; ROM $00052A: 20 FF C5 jsr Gameplay_HandleControl_CBC5 ; ROM $00052D: 20 C5 CB lda #$06 ; ROM $000530: A9 06 sta $B5 ; ROM $000532: 85 B5 lda #$01 ; ROM $000534: A9 01 sta $7A ; ROM $000536: 85 7A sta $7D ; ROM $000538: 85 7D lda #$1E ; ROM $00053A: A9 1E sta $93 ; ROM $00053C: 85 93 ; Routine: Main_ReadZp93_C52E ; Global: Reachable code entry at CPU $C52E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_ReadZp93_C52E: jsr Main_WriteStageCounter_C613 ; ROM $00053E: 20 13 C6 lda $93 ; ROM $000541: A5 93 beq Main_WriteGameMode_C55C ; ROM $000543: F0 27 jsr HideAllSprites ; ROM $000545: 20 68 C2 jsr Gameplay_HandleControl_C8ED ; ROM $000548: 20 ED C8 jsr Frame_ReadZp7D_CC36 ; ROM $00054B: 20 36 CC jsr Gameplay_HandleControl_C96A ; ROM $00054E: 20 6A C9 jsr Frame_ReadObjectIndex_CE5B ; ROM $000551: 20 5B CE jsr Object_WriteStageProgress_CFB0 ; ROM $000554: 20 B0 CF jsr Gameplay_HandleControl_CA1B ; ROM $000557: 20 1B CA jsr Main_ReadZp33_C65F ; ROM $00055A: 20 5F C6 lda $33 ; ROM $00055D: A5 33 and #$01 ; ROM $00055F: 29 01 bne Main_ReadZp93_C52E ; ROM $000561: D0 DB jsr GameplayUpdate ; ROM $000563: 20 9D C7 jsr Main_HandleControl_C66C ; ROM $000566: 20 6C C6 jmp Main_ReadZp93_C52E ; ROM $000569: 4C 2E C5 ; Routine: Main_WriteGameMode_C55C ; Global: Reachable code entry at CPU $C55C traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteGameMode_C55C: lda #$0A ; ROM $00056C: A9 0A sta $B5 ; ROM $00056E: 85 B5 jsr Main_ReadGameMode_C60B ; ROM $000570: 20 0B C6 lda #$00 ; ROM $000573: A9 00 sta $7D ; ROM $000575: 85 7D sta $7A ; ROM $000577: 85 7A jmp Main_WriteZpB1_C410 ; ROM $000579: 4C 10 C4 ; Routine: Main_WriteObjectX_C56C ; Global: Reachable code entry at CPU $C56C traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteObjectX_C56C: jsr InitializeVideoSystem ; ROM $00057C: 20 F2 C1 jsr Menu_WriteWorkValue_DBF9 ; ROM $00057F: 20 F9 DB jsr Gameplay_WriteTransferPointer_CA72 ; ROM $000582: 20 72 CA lda #$08 ; ROM $000585: A9 08 sta $29 ; ROM $000587: 85 29 sta $2B ; ROM $000589: 85 2B lda #$00 ; ROM $00058B: A9 00 sta $60 ; ROM $00058D: 85 60 sta $28 ; ROM $00058F: 85 28 lda #$09 ; ROM $000591: A9 09 sta $2A ; ROM $000593: 85 2A lda #$07 ; ROM $000595: A9 07 sta $B5 ; ROM $000597: 85 B5 jsr Ppu_HandleControl_C262 ; ROM $000599: 20 62 C2 jsr EnableNmiInPpuControl ; ROM $00059C: 20 B0 C2 ; Routine: Main_WriteStageCounter_C58F ; Global: Reachable code entry at CPU $C58F traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteStageCounter_C58F: jsr WaitForNmiFrameHandoff ; ROM $00059F: 20 FB CB lda #$01 ; ROM $0005A2: A9 01 sta $39 ; ROM $0005A4: 85 39 jsr HideAllSprites ; ROM $0005A6: 20 68 C2 jsr Frame_ReadObjectIndex_CE5B ; ROM $0005A9: 20 5B CE lda $33 ; ROM $0005AC: A5 33 ror a ; ROM $0005AE: 6A bcs Main_ReadObjectType_C5A4 ; ROM $0005AF: B0 03 jsr Frame_ReadObjectX_CDD4 ; ROM $0005B1: 20 D4 CD ; Routine: Main_ReadObjectType_C5A4 ; Global: Reachable code entry at CPU $C5A4 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_ReadObjectType_C5A4: lda $28 ; ROM $0005B4: A5 28 cmp #$08 ; ROM $0005B6: C9 08 bne Main_WriteStageCounter_C58F ; ROM $0005B8: D0 E5 ; Routine: Main_WriteStageCounter_C5AA ; Global: Reachable code entry at CPU $C5AA traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteStageCounter_C5AA: jsr WaitForNmiFrameHandoff ; ROM $0005BA: 20 FB CB lda #$01 ; ROM $0005BD: A9 01 sta $39 ; ROM $0005BF: 85 39 jsr HideAllSprites ; ROM $0005C1: 20 68 C2 jsr Frame_ReadZp2D_CEA7 ; ROM $0005C4: 20 A7 CE lda $33 ; ROM $0005C7: A5 33 ror a ; ROM $0005C9: 6A bcs Main_ReadGameMode_C5BF ; ROM $0005CA: B0 03 jsr Frame_ReadObjectX_CDD4 ; ROM $0005CC: 20 D4 CD ; Routine: Main_ReadGameMode_C5BF ; Global: Reachable code entry at CPU $C5BF traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_ReadGameMode_C5BF: lda $B5 ; ROM $0005CF: A5 B5 bne Main_WriteStageCounter_C5AA ; ROM $0005D1: D0 E7 ; Routine: Main_WriteZp58_C5C3 ; Global: Reachable code entry at CPU $C5C3 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteZp58_C5C3: lda ControllerState1 ; ROM $0005D3: A5 12 beq Main_WriteZp58_C5C3 ; ROM $0005D5: F0 FC lda #$01 ; ROM $0005D7: A9 01 sta $58 ; ROM $0005D9: 85 58 jmp Main_WriteZpB1_C410 ; ROM $0005DB: 4C 10 C4 ; Routine: Main_WriteObjectType_C5CE ; Global: Reachable code entry at CPU $C5CE traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteObjectType_C5CE: lda #$01 ; ROM $0005DE: A9 01 sta $28 ; ROM $0005E0: 85 28 sta $2A ; ROM $0005E2: 85 2A lda #$08 ; ROM $0005E4: A9 08 sta $29 ; ROM $0005E6: 85 29 sta $2B ; ROM $0005E8: 85 2B lda #$00 ; ROM $0005EA: A9 00 sta $2C ; ROM $0005EC: 85 2C sta $5D ; ROM $0005EE: 85 5D sta $5C ; ROM $0005F0: 85 5C sta $5E ; ROM $0005F2: 85 5E jsr Gameplay_HandleControl_CBC5 ; ROM $0005F4: 20 C5 CB jsr Stage_ReadZp58_D69A ; ROM $0005F7: 20 9A D6 jsr Gameplay_WriteWorkValue_CB06 ; ROM $0005FA: 20 06 CB jsr WaitForVBlankTransition ; ROM $0005FD: 20 8B C2 jsr UploadSystemPalette ; ROM $000600: 20 C3 C2 ldx $58 ; ROM $000603: A6 58 lda $CC03,x ; ROM $000605: BD 03 CC sta $5B ; ROM $000608: 85 5B lda #$01 ; ROM $00060A: A9 01 sta $60 ; ROM $00060C: 85 60 rts ; ROM $00060E: 60 ; Routine: Main_CallHelper_C5FF ; Global: Reachable code entry at CPU $C5FF traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_CallHelper_C5FF: jsr HideAllSprites ; ROM $00060F: 20 68 C2 jsr EnableNmiInPpuControl ; ROM $000612: 20 B0 C2 jsr Ppu_CallHelper_C23B ; ROM $000615: 20 3B C2 jmp Ppu_HandleControl_C262 ; ROM $000618: 4C 62 C2 ; Routine: Main_ReadGameMode_C60B ; Global: Reachable code entry at CPU $C60B traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_ReadGameMode_C60B: lda $B5 ; ROM $00061B: A5 B5 bne Main_ReadGameMode_C60B ; ROM $00061D: D0 FC rts ; ROM $00061F: 60 ; Routine: Main_Dispatch_C610 ; Global: Reachable code entry at CPU $C610 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_Dispatch_C610: jmp Main_WriteGameMode_C4C3 ; ROM $000620: 4C C3 C4 ; Routine: Main_WriteStageCounter_C613 ; Global: Reachable code entry at CPU $C613 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteStageCounter_C613: jsr WaitForNmiFrameHandoff ; ROM $000623: 20 FB CB lda #$01 ; ROM $000626: A9 01 sta $39 ; ROM $000628: 85 39 lda ControllerState1 ; ROM $00062A: A5 12 and #$10 ; ROM $00062C: 29 10 beq Main_ReturnToCaller_C643 ; ROM $00062E: F0 23 lda $59 ; ROM $000630: A5 59 bne Main_Dispatch_C610 ; ROM $000632: D0 EC lda #$01 ; ROM $000634: A9 01 sta $B2 ; ROM $000636: 85 B2 lda #$06 ; ROM $000638: A9 06 sta $DF ; ROM $00063A: 85 DF jsr WaitForFrameBoundary ; ROM $00063C: 20 07 C3 ; Routine: Main_WriteSoundCommandState_C62F ; Global: Reachable code entry at CPU $C62F traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteSoundCommandState_C62F: lda ControllerState1 ; ROM $00063F: A5 12 and #$10 ; ROM $000641: 29 10 beq Main_WriteSoundCommandState_C62F ; ROM $000643: F0 FA lda #$06 ; ROM $000645: A9 06 sta $DF ; ROM $000647: 85 DF lda #$00 ; ROM $000649: A9 00 sta $B2 ; ROM $00064B: 85 B2 jsr WaitForFrameBoundary ; ROM $00064D: 20 07 C3 jmp WaitForNmiFrameHandoff ; ROM $000650: 4C FB CB ; Routine: Main_ReturnToCaller_C643 ; Global: Reachable code entry at CPU $C643 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_ReturnToCaller_C643: rts ; ROM $000653: 60 ; Routine: Main_ReadZp33_C644 ; Global: Reachable code entry at CPU $C644 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_ReadZp33_C644: lda $33 ; ROM $000654: A5 33 and #$3F ; ROM $000656: 29 3F bne Main_ReturnToCaller_C65E ; ROM $000658: D0 14 lda $93 ; ROM $00065A: A5 93 cmp #$FF ; ROM $00065C: C9 FF beq Main_ReturnToCaller_C65E ; ROM $00065E: F0 0E dec $93 ; ROM $000660: C6 93 bne Main_ReturnToCaller_C65E ; ROM $000662: D0 0A jsr Gameplay_HandleControl_CBD7 ; ROM $000664: 20 D7 CB lda #$08 ; ROM $000667: A9 08 sta $7E ; ROM $000669: 85 7E jmp Gameplay_HandleControl_C8ED ; ROM $00066B: 4C ED C8 ; Routine: Main_ReturnToCaller_C65E ; Global: Reachable code entry at CPU $C65E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_ReturnToCaller_C65E: rts ; ROM $00066E: 60 ; Routine: Main_ReadZp33_C65F ; Global: Reachable code entry at CPU $C65F traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_ReadZp33_C65F: lda $33 ; ROM $00066F: A5 33 and #$3F ; ROM $000671: 29 3F bne Main_ReturnToCaller_C65E ; ROM $000673: D0 F9 lda $93 ; ROM $000675: A5 93 beq Main_ReturnToCaller_C65E ; ROM $000677: F0 F5 dec $93 ; ROM $000679: C6 93 rts ; ROM $00067B: 60 ; Routine: Main_HandleControl_C66C ; Global: Reachable code entry at CPU $C66C traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_HandleControl_C66C: ldx #$4F ; ROM $00067C: A2 4F ; Routine: Main_ReadRam03E6_C66E ; Global: Reachable code entry at CPU $C66E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_ReadRam03E6_C66E: lda $03E6,x ; ROM $00067E: BD E6 03 beq Main_Dispatch_C6CD ; ROM $000681: F0 5A bpl Main_ReadRam0436_C688 ; ROM $000683: 10 13 and #$7F ; ROM $000685: 29 7F tay ; ROM $000687: A8 lda $0436,x ; ROM $000688: BD 36 04 sta $1F ; ROM $00068B: 85 1F lda $0486,x ; ROM $00068D: BD 86 04 sta $20 ; ROM $000690: 85 20 lda $C75D,y ; ROM $000692: B9 5D C7 jmp Main_ReadZp5C_C6DA ; ROM $000695: 4C DA C6 ; Routine: Main_ReadRam0436_C688 ; Global: Reachable code entry at CPU $C688 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_ReadRam0436_C688: lda $0436,x ; ROM $000698: BD 36 04 sta $1F ; ROM $00069B: 85 1F lda $0486,x ; ROM $00069D: BD 86 04 sta $20 ; ROM $0006A0: 85 20 lda $0526,x ; ROM $0006A2: BD 26 05 and #$78 ; ROM $0006A5: 29 78 beq Main_Dispatch_C6CD ; ROM $0006A7: F0 34 lda $0526,x ; ROM $0006A9: BD 26 05 bpl Main_WriteZp32_C6B2 ; ROM $0006AC: 10 14 and #$07 ; ROM $0006AE: 29 07 sta $32 ; ROM $0006B0: 85 32 lda $0526,x ; ROM $0006B2: BD 26 05 lsr a ; ROM $0006B5: 4A and #$3C ; ROM $0006B6: 29 3C clc ; ROM $0006B8: 18 adc $32 ; ROM $0006B9: 65 32 tay ; ROM $0006BB: A8 lda $C778,y ; ROM $0006BC: B9 78 C7 jmp Main_ReadZp5C_C6DA ; ROM $0006BF: 4C DA C6 ; Routine: Main_WriteZp32_C6B2 ; Global: Reachable code entry at CPU $C6B2 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_WriteZp32_C6B2: and #$07 ; ROM $0006C2: 29 07 beq Main_ReadRam0526_C6D0 ; ROM $0006C4: F0 1A and #$01 ; ROM $0006C6: 29 01 eor #$01 ; ROM $0006C8: 49 01 sta $32 ; ROM $0006CA: 85 32 lda $0526,x ; ROM $0006CC: BD 26 05 lsr a ; ROM $0006CF: 4A lsr a ; ROM $0006D0: 4A and #$1E ; ROM $0006D1: 29 1E clc ; ROM $0006D3: 18 adc $32 ; ROM $0006D4: 65 32 clc ; ROM $0006D6: 18 adc #$07 ; ROM $0006D7: 69 07 tay ; ROM $0006D9: A8 jmp Main_ReadRamC764_C6D6 ; ROM $0006DA: 4C D6 C6 ; Routine: Main_Dispatch_C6CD ; Global: Reachable code entry at CPU $C6CD traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_Dispatch_C6CD: jmp Main_RetreatIndexX_C756 ; ROM $0006DD: 4C 56 C7 ; Routine: Main_ReadRam0526_C6D0 ; Global: Reachable code entry at CPU $C6D0 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_ReadRam0526_C6D0: lda $0526,x ; ROM $0006E0: BD 26 05 lsr a ; ROM $0006E3: 4A lsr a ; ROM $0006E4: 4A lsr a ; ROM $0006E5: 4A ; Routine: Main_ReadRamC764_C6D6 ; Global: Reachable code entry at CPU $C6D6 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_ReadRamC764_C6D6: tay ; ROM $0006E6: A8 lda $C764,y ; ROM $0006E7: B9 64 C7 ; Routine: Main_ReadZp5C_C6DA ; Global: Reachable code entry at CPU $C6DA traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_ReadZp5C_C6DA: and #$FF ; ROM $0006EA: 29 FF beq Main_CallHelper_C753 ; ROM $0006EC: F0 75 jsr Stage_WriteObjectWorkX_D8FC ; ROM $0006EE: 20 FC D8 lda $5C ; ROM $0006F1: A5 5C bne Main_HandleControl_C705 ; ROM $0006F3: D0 20 lda $79 ; ROM $0006F5: A5 79 bne Main_HandleControl_C705 ; ROM $0006F7: D0 1C lda $7A ; ROM $0006F9: A5 7A bne Main_HandleControl_C705 ; ROM $0006FB: D0 18 lda $28 ; ROM $0006FD: A5 28 cmp $1F ; ROM $0006FF: C5 1F bne Main_HandleControl_C705 ; ROM $000701: D0 12 lda $2A ; ROM $000703: A5 2A cmp $20 ; ROM $000705: C5 20 bne Main_HandleControl_C705 ; ROM $000707: D0 0C lda #$05 ; ROM $000709: A9 05 sta $DF ; ROM $00070B: 85 DF lda #$01 ; ROM $00070D: A9 01 sta $5C ; ROM $00070F: 85 5C lda #$0C ; ROM $000711: A9 0C sta $2C ; ROM $000713: 85 2C ; Routine: Main_HandleControl_C705 ; Global: Reachable code entry at CPU $C705 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_HandleControl_C705: ldy #$09 ; ROM $000715: A0 09 ; Routine: Main_ReadRam0576_C707 ; Global: Reachable code entry at CPU $C707 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_ReadRam0576_C707: lda $0576,y ; ROM $000717: B9 76 05 beq Main_RetreatIndexY_C74E ; ROM $00071A: F0 42 cmp #$09 ; ROM $00071C: C9 09 bcs Main_RetreatIndexY_C74E ; ROM $00071E: B0 3E lda $0580,y ; ROM $000720: B9 80 05 cmp $1F ; ROM $000723: C5 1F bne Main_RetreatIndexY_C74E ; ROM $000725: D0 37 lda $0594,y ; ROM $000727: B9 94 05 cmp $20 ; ROM $00072A: C5 20 bne Main_RetreatIndexY_C74E ; ROM $00072C: D0 30 inc $9E ; ROM $00072E: E6 9E lda #$00 ; ROM $000730: A9 00 sta $A0 ; ROM $000732: 85 A0 sta $A1 ; ROM $000734: 85 A1 sta $A2 ; ROM $000736: 85 A2 sta $A3 ; ROM $000738: 85 A3 lda #$64 ; ROM $00073A: A9 64 sta $05C6,y ; ROM $00073C: 99 C6 05 lda $0576,y ; ROM $00073F: B9 76 05 sta $05D0,y ; ROM $000742: 99 D0 05 lda $6A ; ROM $000745: A5 6A sta $05DA,y ; ROM $000747: 99 DA 05 inc $6A ; ROM $00074A: E6 6A lda #$09 ; ROM $00074C: A9 09 sta $0576,y ; ROM $00074E: 99 76 05 lda $05A8,y ; ROM $000751: B9 A8 05 lsr a ; ROM $000754: 4A lsr a ; ROM $000755: 4A and #$07 ; ROM $000756: 29 07 clc ; ROM $000758: 18 adc #$20 ; ROM $000759: 69 20 sta $05A8,y ; ROM $00075B: 99 A8 05 ; Routine: Main_RetreatIndexY_C74E ; Global: Reachable code entry at CPU $C74E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_RetreatIndexY_C74E: dey ; ROM $00075E: 88 bpl Main_ReadRam0576_C707 ; ROM $00075F: 10 B6 bmi Main_RetreatIndexX_C756 ; ROM $000761: 30 03 ; Routine: Main_CallHelper_C753 ; Global: Reachable code entry at CPU $C753 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_CallHelper_C753: jsr Stage_WriteObjectWorkX_D8FC ; ROM $000763: 20 FC D8 ; Routine: Main_RetreatIndexX_C756 ; Global: Reachable code entry at CPU $C756 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_RetreatIndexX_C756: dex ; ROM $000766: CA bmi Main_ReturnToCaller_C75C ; ROM $000767: 30 03 jmp Main_ReadRam03E6_C66E ; ROM $000769: 4C 6E C6 ; Routine: Main_ReturnToCaller_C75C ; Global: Reachable code entry at CPU $C75C traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Main_ReturnToCaller_C75C: rts ; ROM $00076C: 60 ; Data region: CPU $C75D-$C79C; unreachable by direct recursive trace. MainStateDispatchTable: .byte $27, $03, $04, $05, $06, $07, $00, $00, $0B, $0C, $0D, $0E, $0D, $0C, $0B, $00 ; ROM $00076D: 27 03 04 05 06 07 00 00 0B 0C 0D 0E 0D 0C 0B 00 .byte $0F, $10, $11, $12, $13, $14, $15, $16, $13, $14, $11, $12, $0F, $10, $00, $00 ; ROM $00077D: 0F 10 11 12 13 14 15 16 13 14 11 12 0F 10 00 00 .byte $17, $18, $19, $1A, $1B, $1C, $1D, $1E, $1F, $20, $21, $22, $23, $24, $25, $26 ; ROM $00078D: 17 18 19 1A 1B 1C 1D 1E 1F 20 21 22 23 24 25 26 .byte $1F, $20, $21, $22, $1B, $1C, $1D, $1E, $17, $18, $19, $1A, $00, $00, $00, $00 ; ROM $00079D: 1F 20 21 22 1B 1C 1D 1E 17 18 19 1A 00 00 00 00 ; Routine: GameplayUpdate ; Global: Reachable code entry at CPU $C79D traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. GameplayUpdate: ldx #$4F ; ROM $0007AD: A2 4F ; Routine: Gameplay_ReadRam03E6_C79F ; Global: Reachable code entry at CPU $C79F traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadRam03E6_C79F: lda $03E6,x ; ROM $0007AF: BD E6 03 bne Gameplay_ReadRam0486_C7A7 ; ROM $0007B2: D0 03 ; Routine: Gameplay_Dispatch_C7A4 ; Global: Reachable code entry at CPU $C7A4 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_Dispatch_C7A4: jmp Gameplay_RetreatIndexX_C8A6 ; ROM $0007B4: 4C A6 C8 ; Routine: Gameplay_ReadRam0486_C7A7 ; Global: Reachable code entry at CPU $C7A7 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadRam0486_C7A7: pha ; ROM $0007B7: 48 ldy $0486,x ; ROM $0007B8: BC 86 04 sty $20 ; ROM $0007BB: 84 20 jsr Gameplay_ReadRamE2A3_CBEB ; ROM $0007BD: 20 EB CB ldy $0436,x ; ROM $0007C0: BC 36 04 sty $1F ; ROM $0007C3: 84 1F pla ; ROM $0007C5: 68 bpl Gameplay_ReadTransferPointer_C7CB ; ROM $0007C6: 10 13 inc $03E6,x ; ROM $0007C8: FE E6 03 lda $03E6,x ; ROM $0007CB: BD E6 03 cmp #$87 ; ROM $0007CE: C9 87 bne Gameplay_Dispatch_C7A4 ; ROM $0007D0: D0 E2 lda #$00 ; ROM $0007D2: A9 00 sta $03E6,x ; ROM $0007D4: 9D E6 03 sta ($34),y ; ROM $0007D7: 91 34 beq Gameplay_Dispatch_C7A4 ; ROM $0007D9: F0 D9 ; Routine: Gameplay_ReadTransferPointer_C7CB ; Global: Reachable code entry at CPU $C7CB traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadTransferPointer_C7CB: lda ($34),y ; ROM $0007DB: B1 34 tay ; ROM $0007DD: A8 beq Gameplay_ReadRam0526_C838 ; ROM $0007DE: F0 68 cpy #$02 ; ROM $0007E0: C0 02 bne Gameplay_ReadRam04D6_C7DE ; ROM $0007E2: D0 0A inc $A4 ; ROM $0007E4: E6 A4 lda #$80 ; ROM $0007E6: A9 80 sta $03E6,x ; ROM $0007E8: 9D E6 03 jmp Gameplay_RetreatIndexX_C8A6 ; ROM $0007EB: 4C A6 C8 ; Routine: Gameplay_ReadRam04D6_C7DE ; Global: Reachable code entry at CPU $C7DE traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadRam04D6_C7DE: cpy #$03 ; ROM $0007EE: C0 03 bne Gameplay_ReadWorkIndex_C7EE ; ROM $0007F0: D0 0C lda $04D6,x ; ROM $0007F2: BD D6 04 ora #$10 ; ROM $0007F5: 09 10 ldy $1F ; ROM $0007F7: A4 1F sta ($34),y ; ROM $0007F9: 91 34 jmp Gameplay_WriteRam03E6_C830 ; ROM $0007FB: 4C 30 C8 ; Routine: Gameplay_ReadWorkIndex_C7EE ; Global: Reachable code entry at CPU $C7EE traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadWorkIndex_C7EE: cpy #$04 ; ROM $0007FE: C0 04 bne Gameplay_ReadWorkIndex_C800 ; ROM $000800: D0 0E ldy $1F ; ROM $000802: A4 1F lda #$08 ; ROM $000804: A9 08 sta ($34),y ; ROM $000806: 91 34 lda #$28 ; ROM $000808: A9 28 jsr Stage_WriteObjectWorkX_D8FC ; ROM $00080A: 20 FC D8 jmp Gameplay_WriteRam03E6_C830 ; ROM $00080D: 4C 30 C8 ; Routine: Gameplay_ReadWorkIndex_C800 ; Global: Reachable code entry at CPU $C800 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadWorkIndex_C800: cpy #$05 ; ROM $000810: C0 05 bne Gameplay_ReadWorkIndex_C815 ; ROM $000812: D0 11 ldy $1F ; ROM $000814: A4 1F lda #$06 ; ROM $000816: A9 06 sta ($34),y ; ROM $000818: 91 34 lda #$28 ; ROM $00081A: A9 28 clc ; ROM $00081C: 18 adc $5B ; ROM $00081D: 65 5B jsr Stage_WriteObjectWorkX_D8FC ; ROM $00081F: 20 FC D8 jmp Gameplay_WriteRam03E6_C830 ; ROM $000822: 4C 30 C8 ; Routine: Gameplay_ReadWorkIndex_C815 ; Global: Reachable code entry at CPU $C815 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadWorkIndex_C815: cpy #$08 ; ROM $000825: C0 08 beq Gameplay_IncrementBonusTimer_C828 ; ROM $000827: F0 0F cpy #$06 ; ROM $000829: C0 06 bne Gameplay_WriteRam03E6_C830 ; ROM $00082B: D0 13 ldy $1F ; ROM $00082D: A4 1F lda #$00 ; ROM $00082F: A9 00 sta ($34),y ; ROM $000831: 91 34 jsr Stage_WriteObjectWorkX_D8FC ; ROM $000833: 20 FC D8 dec $A7 ; ROM $000836: C6 A7 ; Routine: Gameplay_IncrementBonusTimer_C828 ; Global: Reachable code entry at CPU $C828 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_IncrementBonusTimer_C828: inc $A7 ; ROM $000838: E6 A7 jsr Gameplay_HandleControl_C8AD ; ROM $00083A: 20 AD C8 jmp Gameplay_WriteRam03E6_C830 ; ROM $00083D: 4C 30 C8 ; Routine: Gameplay_WriteRam03E6_C830 ; Global: Reachable code entry at CPU $C830 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteRam03E6_C830: lda #$00 ; ROM $000840: A9 00 sta $03E6,x ; ROM $000842: 9D E6 03 ; Routine: Gameplay_Dispatch_C835 ; Global: Reachable code entry at CPU $C835 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_Dispatch_C835: jmp Gameplay_RetreatIndexX_C8A6 ; ROM $000845: 4C A6 C8 ; Routine: Gameplay_ReadRam0526_C838 ; Global: Reachable code entry at CPU $C838 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadRam0526_C838: lda $0526,x ; ROM $000848: BD 26 05 clc ; ROM $00084B: 18 adc #$08 ; ROM $00084C: 69 08 sta $0526,x ; ROM $00084E: 9D 26 05 and #$7F ; ROM $000851: 29 7F cmp #$48 ; ROM $000853: C9 48 bcs Gameplay_ReadWorkIndex_C7EE ; ROM $000855: B0 A7 lda $04D6,x ; ROM $000857: BD D6 04 sta $36 ; ROM $00085A: 85 36 and #$07 ; ROM $00085C: 29 07 beq Gameplay_Dispatch_C835 ; ROM $00085E: F0 E5 tay ; ROM $000860: A8 lda #$00 ; ROM $000861: A9 00 sta $04D6,x ; ROM $000863: 9D D6 04 lda $0436,x ; ROM $000866: BD 36 04 clc ; ROM $000869: 18 adc $CA16,y ; ROM $00086A: 79 16 CA sta $1F ; ROM $00086D: 85 1F lda $0486,x ; ROM $00086F: BD 86 04 clc ; ROM $000872: 18 adc $CA11,y ; ROM $000873: 79 11 CA sta $20 ; ROM $000876: 85 20 ldy #$4F ; ROM $000878: A0 4F jsr Gameplay_ReadRam03E6_CBE5 ; ROM $00087A: 20 E5 CB bne Gameplay_RetreatIndexX_C8A6 ; ROM $00087D: D0 37 lda $1F ; ROM $00087F: A5 1F sta $0436,y ; ROM $000881: 99 36 04 lda $20 ; ROM $000884: A5 20 sta $0486,y ; ROM $000886: 99 86 04 lda #$01 ; ROM $000889: A9 01 sta $03E6,y ; ROM $00088B: 99 E6 03 lda $36 ; ROM $00088E: A5 36 and #$07 ; ROM $000890: 29 07 sta $0526,y ; ROM $000892: 99 26 05 lda $36 ; ROM $000895: A5 36 clc ; ROM $000897: 18 adc #$10 ; ROM $000898: 69 10 cmp $73 ; ROM $00089A: C5 73 bcc Gameplay_WriteRam04D6_C89E ; ROM $00089C: 90 10 lda #$00 ; ROM $00089E: A9 00 sta $03E6,y ; ROM $0008A0: 99 E6 03 lda $0526,x ; ROM $0008A3: BD 26 05 ora #$80 ; ROM $0008A6: 09 80 sta $0526,x ; ROM $0008A8: 9D 26 05 jmp Gameplay_WriteRam04D6_C8A1 ; ROM $0008AB: 4C A1 C8 ; Routine: Gameplay_WriteRam04D6_C89E ; Global: Reachable code entry at CPU $C89E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteRam04D6_C89E: sta $04D6,y ; ROM $0008AE: 99 D6 04 ; Routine: Gameplay_WriteRam04D6_C8A1 ; Global: Reachable code entry at CPU $C8A1 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteRam04D6_C8A1: lda #$00 ; ROM $0008B1: A9 00 sta $04D6,x ; ROM $0008B3: 9D D6 04 ; Routine: Gameplay_RetreatIndexX_C8A6 ; Global: Reachable code entry at CPU $C8A6 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_RetreatIndexX_C8A6: dex ; ROM $0008B6: CA bmi Gameplay_ReturnToCaller_C8AC ; ROM $0008B7: 30 03 jmp Gameplay_ReadRam03E6_C79F ; ROM $0008B9: 4C 9F C7 ; Routine: Gameplay_ReturnToCaller_C8AC ; Global: Reachable code entry at CPU $C8AC traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReturnToCaller_C8AC: rts ; ROM $0008BC: 60 ; Routine: Gameplay_HandleControl_C8AD ; Global: Reachable code entry at CPU $C8AD traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_HandleControl_C8AD: ldy #$09 ; ROM $0008BD: A0 09 ; Routine: Gameplay_ReadRam0576_C8AF ; Global: Reachable code entry at CPU $C8AF traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadRam0576_C8AF: lda $0576,y ; ROM $0008BF: B9 76 05 bne Gameplay_RetreatIndexY_C8E9 ; ROM $0008C2: D0 35 lda $5B ; ROM $0008C4: A5 5B sta $0576,y ; ROM $0008C6: 99 76 05 sta $05A8,y ; ROM $0008C9: 99 A8 05 lda #$08 ; ROM $0008CC: A9 08 sta $058A,y ; ROM $0008CE: 99 8A 05 sta $059E,y ; ROM $0008D1: 99 9E 05 jsr AdvanceRandomState ; ROM $0008D4: 20 70 D6 and #$03 ; ROM $0008D7: 29 03 clc ; ROM $0008D9: 18 adc #$01 ; ROM $0008DA: 69 01 sta $05D0,y ; ROM $0008DC: 99 D0 05 lda $1F ; ROM $0008DF: A5 1F sta $0580,y ; ROM $0008E1: 99 80 05 lda $20 ; ROM $0008E4: A5 20 sta $0594,y ; ROM $0008E6: 99 94 05 lda #$00 ; ROM $0008E9: A9 00 sta $05DA,y ; ROM $0008EB: 99 DA 05 sta $05C6,y ; ROM $0008EE: 99 C6 05 sta $05E4,y ; ROM $0008F1: 99 E4 05 lda #$1E ; ROM $0008F4: A9 1E sta $05B2,y ; ROM $0008F6: 99 B2 05 ; Routine: Gameplay_RetreatIndexY_C8E9 ; Global: Reachable code entry at CPU $C8E9 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_RetreatIndexY_C8E9: dey ; ROM $0008F9: 88 bpl Gameplay_ReadRam0576_C8AF ; ROM $0008FA: 10 C3 rts ; ROM $0008FC: 60 ; Routine: Gameplay_HandleControl_C8ED ; Global: Reachable code entry at CPU $C8ED traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_HandleControl_C8ED: ldy #$09 ; ROM $0008FD: A0 09 ; Routine: Gameplay_ReadRam0576_C8EF ; Global: Reachable code entry at CPU $C8EF traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadRam0576_C8EF: lda $0576,y ; ROM $0008FF: B9 76 05 bne Gameplay_RetreatIndexY_C935 ; ROM $000902: D0 41 lda $7E ; ROM $000904: A5 7E sta $0576,y ; ROM $000906: 99 76 05 sec ; ROM $000909: 38 sbc #$01 ; ROM $00090A: E9 01 asl a ; ROM $00090C: 0A asl a ; ROM $00090D: 0A sta $05A8,y ; ROM $00090E: 99 A8 05 lda #$08 ; ROM $000911: A9 08 sta $058A,y ; ROM $000913: 99 8A 05 sta $059E,y ; ROM $000916: 99 9E 05 jsr AdvanceRandomState ; ROM $000919: 20 70 D6 and #$03 ; ROM $00091C: 29 03 clc ; ROM $00091E: 18 adc #$01 ; ROM $00091F: 69 01 sta $05D0,y ; ROM $000921: 99 D0 05 sty $5A ; ROM $000924: 84 5A jsr Gameplay_WriteObjectWorkX_CACF ; ROM $000926: 20 CF CA ldy $5A ; ROM $000929: A4 5A lda $24 ; ROM $00092B: A5 24 sta $0580,y ; ROM $00092D: 99 80 05 lda $25 ; ROM $000930: A5 25 sta $0594,y ; ROM $000932: 99 94 05 lda #$00 ; ROM $000935: A9 00 sta $05DA,y ; ROM $000937: 99 DA 05 sta $05C6,y ; ROM $00093A: 99 C6 05 sta $05E4,y ; ROM $00093D: 99 E4 05 lda #$1E ; ROM $000940: A9 1E sta $05B2,y ; ROM $000942: 99 B2 05 ; Routine: Gameplay_RetreatIndexY_C935 ; Global: Reachable code entry at CPU $C935 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_RetreatIndexY_C935: dey ; ROM $000945: 88 bpl Gameplay_ReadRam0576_C8EF ; ROM $000946: 10 B7 rts ; ROM $000948: 60 ; Routine: Gameplay_HandleControl_C939 ; Global: Reachable code entry at CPU $C939 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_HandleControl_C939: ldx #$09 ; ROM $000949: A2 09 ; Routine: Gameplay_ReadRam03A0_C93B ; Global: Reachable code entry at CPU $C93B traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadRam03A0_C93B: lda $03A0,x ; ROM $00094B: BD A0 03 beq Gameplay_RetreatIndexX_C966 ; ROM $00094E: F0 26 ldy $03B4,x ; ROM $000950: BC B4 03 lda $E2A3,y ; ROM $000953: B9 A3 E2 sta $34 ; ROM $000956: 85 34 lda $E2B0,y ; ROM $000958: B9 B0 E2 sta $35 ; ROM $00095B: 85 35 sty $20 ; ROM $00095D: 84 20 ldy $03AA,x ; ROM $00095F: BC AA 03 sty $1F ; ROM $000962: 84 1F lda #$00 ; ROM $000964: A9 00 jsr Gameplay_WriteZp2F_C9B6 ; ROM $000966: 20 B6 C9 jsr Gameplay_WriteDisplayMode_CBF6 ; ROM $000969: 20 F6 CB lda #$00 ; ROM $00096C: A9 00 sta ($34),y ; ROM $00096E: 91 34 lda #$00 ; ROM $000970: A9 00 sta $03A0,x ; ROM $000972: 9D A0 03 rts ; ROM $000975: 60 ; Routine: Gameplay_RetreatIndexX_C966 ; Global: Reachable code entry at CPU $C966 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_RetreatIndexX_C966: dex ; ROM $000976: CA bpl Gameplay_ReadRam03A0_C93B ; ROM $000977: 10 D2 rts ; ROM $000979: 60 ; Routine: Gameplay_HandleControl_C96A ; Global: Reachable code entry at CPU $C96A traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_HandleControl_C96A: ldx #$09 ; ROM $00097A: A2 09 ; Routine: Gameplay_ReadRam03A0_C96C ; Global: Reachable code entry at CPU $C96C traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadRam03A0_C96C: lda $03A0,x ; ROM $00097C: BD A0 03 beq Gameplay_RetreatIndexX_C9B2 ; ROM $00097F: F0 41 ldy $03B4,x ; ROM $000981: BC B4 03 lda $E2A3,y ; ROM $000984: B9 A3 E2 sta $34 ; ROM $000987: 85 34 lda $E2B0,y ; ROM $000989: B9 B0 E2 sta $35 ; ROM $00098C: 85 35 sty $20 ; ROM $00098E: 84 20 ldy $03AA,x ; ROM $000990: BC AA 03 sty $1F ; ROM $000993: 84 1F lda ($34),y ; ROM $000995: B1 34 cmp #$03 ; ROM $000997: C9 03 bne Gameplay_ReadFlamePass_C999 ; ROM $000999: D0 0E inc $03D2,x ; ROM $00099B: FE D2 03 lda $77 ; ROM $00099E: A5 77 bne Gameplay_RetreatIndexX_C9B2 ; ROM $0009A0: D0 20 dec $03BE,x ; ROM $0009A2: DE BE 03 bne Gameplay_RetreatIndexX_C9B2 ; ROM $0009A5: D0 1B lda #$00 ; ROM $0009A7: A9 00 ; Routine: Gameplay_ReadFlamePass_C999 ; Global: Reachable code entry at CPU $C999 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadFlamePass_C999: and #$07 ; ROM $0009A9: 29 07 jsr Gameplay_WriteZp2F_C9B6 ; ROM $0009AB: 20 B6 C9 lda $A5 ; ROM $0009AE: A5 A5 cmp #$FF ; ROM $0009B0: C9 FF beq Gameplay_WriteTransferPointer_C9A6 ; ROM $0009B2: F0 02 inc $A5 ; ROM $0009B4: E6 A5 ; Routine: Gameplay_WriteTransferPointer_C9A6 ; Global: Reachable code entry at CPU $C9A6 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteTransferPointer_C9A6: jsr Gameplay_WriteDisplayMode_CBF6 ; ROM $0009B6: 20 F6 CB lda #$00 ; ROM $0009B9: A9 00 sta ($34),y ; ROM $0009BB: 91 34 lda #$00 ; ROM $0009BD: A9 00 sta $03A0,x ; ROM $0009BF: 9D A0 03 ; Routine: Gameplay_RetreatIndexX_C9B2 ; Global: Reachable code entry at CPU $C9B2 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_RetreatIndexX_C9B2: dex ; ROM $0009C2: CA bpl Gameplay_ReadRam03A0_C96C ; ROM $0009C3: 10 B7 ; Routine: Gameplay_ReturnToCaller_C9B5 ; Global: Reachable code entry at CPU $C9B5 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReturnToCaller_C9B5: rts ; ROM $0009C5: 60 ; Routine: Gameplay_WriteZp2F_C9B6 ; Global: Reachable code entry at CPU $C9B6 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteZp2F_C9B6: stx $2F ; ROM $0009C6: 86 2F sty $30 ; ROM $0009C8: 84 30 tay ; ROM $0009CA: A8 lda $C9DE,y ; ROM $0009CB: B9 DE C9 sta $2E ; ROM $0009CE: 85 2E lda #$01 ; ROM $0009D0: A9 01 jsr Gameplay_TestZp2E_C9E3 ; ROM $0009D2: 20 E3 C9 lda #$02 ; ROM $0009D5: A9 02 jsr Gameplay_TestZp2E_C9E3 ; ROM $0009D7: 20 E3 C9 lda #$03 ; ROM $0009DA: A9 03 jsr Gameplay_TestZp2E_C9E3 ; ROM $0009DC: 20 E3 C9 lda #$04 ; ROM $0009DF: A9 04 jsr Gameplay_TestZp2E_C9E3 ; ROM $0009E1: 20 E3 C9 lda #$00 ; ROM $0009E4: A9 00 jsr Gameplay_TestZp2E_C9E3 ; ROM $0009E6: 20 E3 C9 ldx $2F ; ROM $0009E9: A6 2F ldy $30 ; ROM $0009EB: A4 30 rts ; ROM $0009ED: 60 ; Data region: CPU $C9DE-$C9E2; unreachable by direct recursive trace. GameplayDirectionDeltaTable: .byte $FF, $03, $04, $01, $02 ; ROM $0009EE: FF 03 04 01 02 ; Routine: Gameplay_TestZp2E_C9E3 ; Global: Reachable code entry at CPU $C9E3 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_TestZp2E_C9E3: cmp $2E ; ROM $0009F3: C5 2E beq Gameplay_ReturnToCaller_C9B5 ; ROM $0009F5: F0 CE sta $31 ; ROM $0009F7: 85 31 tax ; ROM $0009F9: AA ldy #$4F ; ROM $0009FA: A0 4F jsr Gameplay_ReadRam03E6_CBE5 ; ROM $0009FC: 20 E5 CB bmi Gameplay_ReturnToCaller_CA10 ; ROM $0009FF: 30 1F lda $20 ; ROM $000A01: A5 20 clc ; ROM $000A03: 18 adc $CA11,x ; ROM $000A04: 7D 11 CA sta $0486,y ; ROM $000A07: 99 86 04 lda $1F ; ROM $000A0A: A5 1F clc ; ROM $000A0C: 18 adc $CA16,x ; ROM $000A0D: 7D 16 CA sta $0436,y ; ROM $000A10: 99 36 04 lda $31 ; ROM $000A13: A5 31 sta $04D6,y ; ROM $000A15: 99 D6 04 sta $0526,y ; ROM $000A18: 99 26 05 lda #$01 ; ROM $000A1B: A9 01 sta $03E6,y ; ROM $000A1D: 99 E6 03 ; Routine: Gameplay_ReturnToCaller_CA10 ; Global: Reachable code entry at CPU $CA10 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReturnToCaller_CA10: rts ; ROM $000A20: 60 ; Data region: CPU $CA11-$CA1A; unreachable by direct recursive trace. GameplayObjectClassTable: .byte $00, $00, $FF, $00, $01, $00, $01, $00, $FF, $00 ; ROM $000A21: 00 00 FF 00 01 00 01 00 FF 00 ; Routine: Gameplay_HandleControl_CA1B ; Global: Reachable code entry at CPU $CA1B traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_HandleControl_CA1B: ldx #$09 ; ROM $000A2B: A2 09 ; Routine: Gameplay_ReadRam03A0_CA1D ; Global: Reachable code entry at CPU $CA1D traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadRam03A0_CA1D: lda $03A0,x ; ROM $000A2D: BD A0 03 beq Gameplay_RetreatIndexX_CA43 ; ROM $000A30: F0 21 lda $03AA,x ; ROM $000A32: BD AA 03 sta $1F ; ROM $000A35: 85 1F lda $03B4,x ; ROM $000A37: BD B4 03 sta $20 ; ROM $000A3A: 85 20 lda $03D2,x ; ROM $000A3C: BD D2 03 and #$0F ; ROM $000A3F: 29 0F bne Gameplay_RetreatIndexX_CA43 ; ROM $000A41: D0 10 lda $03D2,x ; ROM $000A43: BD D2 03 lsr a ; ROM $000A46: 4A lsr a ; ROM $000A47: 4A lsr a ; ROM $000A48: 4A lsr a ; ROM $000A49: 4A and #$03 ; ROM $000A4A: 29 03 tay ; ROM $000A4C: A8 lda $CA47,y ; ROM $000A4D: B9 47 CA jsr Stage_WriteObjectWorkX_D8FC ; ROM $000A50: 20 FC D8 ; Routine: Gameplay_RetreatIndexX_CA43 ; Global: Reachable code entry at CPU $CA43 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_RetreatIndexX_CA43: dex ; ROM $000A53: CA bpl Gameplay_ReadRam03A0_CA1D ; ROM $000A54: 10 D7 rts ; ROM $000A56: 60 ; Data region: CPU $CA47-$CA4A; unreachable by direct recursive trace. GameplayObjectAttributeTable: .byte $09, $0A, $09, $08 ; ROM $000A57: 09 0A 09 08 ; Routine: Gameplay_WriteTransferPointer_CA4B ; Global: Reachable code entry at CPU $CA4B traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteTransferPointer_CA4B: jsr Gameplay_WriteTransferPointer_CA72 ; ROM $000A5B: 20 72 CA jsr Gameplay_WriteObjectWorkX_CACF ; ROM $000A5E: 20 CF CA lda #$04 ; ROM $000A61: A9 04 sta ($34),y ; ROM $000A63: 91 34 jsr Gameplay_WriteObjectWorkX_CACF ; ROM $000A65: 20 CF CA lda #$05 ; ROM $000A68: A9 05 sta ($34),y ; ROM $000A6A: 91 34 lda #$32 ; ROM $000A6C: A9 32 clc ; ROM $000A6E: 18 adc $58 ; ROM $000A6F: 65 58 clc ; ROM $000A71: 18 adc $58 ; ROM $000A72: 65 58 sta $1F ; ROM $000A74: 85 1F ; Routine: Gameplay_WriteTransferPointer_CA66 ; Global: Reachable code entry at CPU $CA66 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteTransferPointer_CA66: jsr Gameplay_WriteObjectWorkX_CACF ; ROM $000A76: 20 CF CA lda #$02 ; ROM $000A79: A9 02 sta ($34),y ; ROM $000A7B: 91 34 dec $1F ; ROM $000A7D: C6 1F bne Gameplay_WriteTransferPointer_CA66 ; ROM $000A7F: D0 F5 rts ; ROM $000A81: 60 ; Routine: Gameplay_WriteTransferPointer_CA72 ; Global: Reachable code entry at CPU $CA72 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteTransferPointer_CA72: lda #$00 ; ROM $000A82: A9 00 sta $34 ; ROM $000A84: 85 34 lda #$02 ; ROM $000A86: A9 02 sta $35 ; ROM $000A88: 85 35 ldy #$00 ; ROM $000A8A: A0 00 ldx #$00 ; ROM $000A8C: A2 00 jsr Gameplay_WriteObjectWorkX_CABA ; ROM $000A8E: 20 BA CA ldx #$20 ; ROM $000A91: A2 20 jsr Gameplay_WriteObjectWorkX_CABA ; ROM $000A93: 20 BA CA ldx #$40 ; ROM $000A96: A2 40 jsr Gameplay_WriteObjectWorkX_CABA ; ROM $000A98: 20 BA CA ldx #$20 ; ROM $000A9B: A2 20 jsr Gameplay_WriteObjectWorkX_CABA ; ROM $000A9D: 20 BA CA ldx #$40 ; ROM $000AA0: A2 40 jsr Gameplay_WriteObjectWorkX_CABA ; ROM $000AA2: 20 BA CA ldx #$20 ; ROM $000AA5: A2 20 jsr Gameplay_WriteObjectWorkX_CABA ; ROM $000AA7: 20 BA CA ldx #$40 ; ROM $000AAA: A2 40 jsr Gameplay_WriteObjectWorkX_CABA ; ROM $000AAC: 20 BA CA ldx #$20 ; ROM $000AAF: A2 20 jsr Gameplay_WriteObjectWorkX_CABA ; ROM $000AB1: 20 BA CA ldx #$40 ; ROM $000AB4: A2 40 jsr Gameplay_WriteObjectWorkX_CABA ; ROM $000AB6: 20 BA CA ldx #$20 ; ROM $000AB9: A2 20 jsr Gameplay_WriteObjectWorkX_CABA ; ROM $000ABB: 20 BA CA ldx #$40 ; ROM $000ABE: A2 40 jsr Gameplay_WriteObjectWorkX_CABA ; ROM $000AC0: 20 BA CA ldx #$20 ; ROM $000AC3: A2 20 jsr Gameplay_WriteObjectWorkX_CABA ; ROM $000AC5: 20 BA CA ldx #$00 ; ROM $000AC8: A2 00 ; Routine: Gameplay_WriteObjectWorkX_CABA ; Global: Reachable code entry at CPU $CABA traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteObjectWorkX_CABA: lda #$20 ; ROM $000ACA: A9 20 sta $24 ; ROM $000ACC: 85 24 ; Routine: Gameplay_ReadRamE243_CABE ; Global: Reachable code entry at CPU $CABE traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadRamE243_CABE: lda $E243,x ; ROM $000ACE: BD 43 E2 sta ($34),y ; ROM $000AD1: 91 34 inc $34 ; ROM $000AD3: E6 34 bne Gameplay_DecrementObjectWorkX_CAC9 ; ROM $000AD5: D0 02 inc $35 ; ROM $000AD7: E6 35 ; Routine: Gameplay_DecrementObjectWorkX_CAC9 ; Global: Reachable code entry at CPU $CAC9 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_DecrementObjectWorkX_CAC9: inx ; ROM $000AD9: E8 dec $24 ; ROM $000ADA: C6 24 bne Gameplay_ReadRamE243_CABE ; ROM $000ADC: D0 F0 rts ; ROM $000ADE: 60 ; Routine: Gameplay_WriteObjectWorkX_CACF ; Global: Reachable code entry at CPU $CACF traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteObjectWorkX_CACF: jsr AdvanceRandomState ; ROM $000ADF: 20 70 D6 ror a ; ROM $000AE2: 6A ror a ; ROM $000AE3: 6A and #$1F ; ROM $000AE4: 29 1F beq Gameplay_WriteObjectWorkX_CACF ; ROM $000AE6: F0 F7 sta $24 ; ROM $000AE8: 85 24 ; Routine: Gameplay_WriteObjectWorkY_CADA ; Global: Reachable code entry at CPU $CADA traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteObjectWorkY_CADA: jsr AdvanceRandomState ; ROM $000AEA: 20 70 D6 ror a ; ROM $000AED: 6A ror a ; ROM $000AEE: 6A ror a ; ROM $000AEF: 6A and #$0F ; ROM $000AF0: 29 0F beq Gameplay_WriteObjectWorkY_CADA ; ROM $000AF2: F0 F6 cmp #$0C ; ROM $000AF4: C9 0C bcs Gameplay_WriteObjectWorkY_CADA ; ROM $000AF6: B0 F2 sta $25 ; ROM $000AF8: 85 25 tay ; ROM $000AFA: A8 lda $E2A3,y ; ROM $000AFB: B9 A3 E2 sta $34 ; ROM $000AFE: 85 34 lda $E2B0,y ; ROM $000B00: B9 B0 E2 sta $35 ; ROM $000B03: 85 35 ldy $24 ; ROM $000B05: A4 24 lda ($34),y ; ROM $000B07: B1 34 bne Gameplay_WriteObjectWorkX_CACF ; ROM $000B09: D0 D4 cpy #$03 ; ROM $000B0B: C0 03 bcs Gameplay_ReturnToCaller_CB05 ; ROM $000B0D: B0 06 lda $25 ; ROM $000B0F: A5 25 cmp #$03 ; ROM $000B11: C9 03 bcc Gameplay_WriteObjectWorkX_CACF ; ROM $000B13: 90 CA ; Routine: Gameplay_ReturnToCaller_CB05 ; Global: Reachable code entry at CPU $CB05 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReturnToCaller_CB05: rts ; ROM $000B15: 60 ; Routine: Gameplay_WriteWorkValue_CB06 ; Global: Reachable code entry at CPU $CB06 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteWorkValue_CB06: jsr DisableRendering ; ROM $000B16: 20 57 C2 lda #$00 ; ROM $000B19: A9 00 sta $20 ; ROM $000B1B: 85 20 lda #$00 ; ROM $000B1D: A9 00 sta $26 ; ROM $000B1F: 85 26 lda #$02 ; ROM $000B21: A9 02 sta $27 ; ROM $000B23: 85 27 ldy #$00 ; ROM $000B25: A0 00 ; Routine: Gameplay_WriteWorkIndex_CB17 ; Global: Reachable code entry at CPU $CB17 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteWorkIndex_CB17: lda #$00 ; ROM $000B27: A9 00 sta $1F ; ROM $000B29: 85 1F ; Routine: Gameplay_ReadZp94_CB1B ; Global: Reachable code entry at CPU $CB1B traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadZp94_CB1B: lda $94 ; ROM $000B2B: A5 94 beq Gameplay_ReadDataPointer_CB24 ; ROM $000B2D: F0 05 lda ($26),y ; ROM $000B2F: B1 26 jmp Gameplay_IncrementZp27_CB30 ; ROM $000B31: 4C 30 CB ; Routine: Gameplay_ReadDataPointer_CB24 ; Global: Reachable code entry at CPU $CB24 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadDataPointer_CB24: lda ($26),y ; ROM $000B34: B1 26 cmp #$04 ; ROM $000B36: C9 04 beq Gameplay_HandleControl_CB2E ; ROM $000B38: F0 04 cmp #$05 ; ROM $000B3A: C9 05 bne Gameplay_IncrementZp27_CB30 ; ROM $000B3C: D0 02 ; Routine: Gameplay_HandleControl_CB2E ; Global: Reachable code entry at CPU $CB2E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_HandleControl_CB2E: lda #$02 ; ROM $000B3E: A9 02 ; Routine: Gameplay_IncrementZp27_CB30 ; Global: Reachable code entry at CPU $CB30 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_IncrementZp27_CB30: jsr Gameplay_WriteObjectWorkY_CB4E ; ROM $000B40: 20 4E CB iny ; ROM $000B43: C8 bne Gameplay_IncrementWorkIndex_CB38 ; ROM $000B44: D0 02 inc $27 ; ROM $000B46: E6 27 ; Routine: Gameplay_IncrementWorkIndex_CB38 ; Global: Reachable code entry at CPU $CB38 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_IncrementWorkIndex_CB38: inc $1F ; ROM $000B48: E6 1F lda $1F ; ROM $000B4A: A5 1F and #$20 ; ROM $000B4C: 29 20 beq Gameplay_ReadZp94_CB1B ; ROM $000B4E: F0 DB inc $20 ; ROM $000B50: E6 20 lda $20 ; ROM $000B52: A5 20 cmp #$0D ; ROM $000B54: C9 0D bne Gameplay_WriteWorkIndex_CB17 ; ROM $000B56: D0 CF jsr Menu_HandleControl_DDC7 ; ROM $000B58: 20 C7 DD jmp CommitPpuStateAndScroll ; ROM $000B5B: 4C 96 C2 ; Routine: Gameplay_WriteObjectWorkY_CB4E ; Global: Reachable code entry at CPU $CB4E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteObjectWorkY_CB4E: sty $25 ; ROM $000B5E: 84 25 jsr Stage_WriteZp1A_D924 ; ROM $000B60: 20 24 D9 ldx #$00 ; ROM $000B63: A2 00 ; Routine: Gameplay_ReadZp17_CB55 ; Global: Reachable code entry at CPU $CB55 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadZp17_CB55: lda $17,x ; ROM $000B65: B5 17 sta $0600,x ; ROM $000B67: 9D 00 06 inx ; ROM $000B6A: E8 cpx #$08 ; ROM $000B6B: E0 08 bne Gameplay_ReadZp17_CB55 ; ROM $000B6D: D0 F6 jsr Gameplay_TransferVramData_CB65 ; ROM $000B6F: 20 65 CB ldy $25 ; ROM $000B72: A4 25 rts ; ROM $000B74: 60 ; Routine: Gameplay_TransferVramData_CB65 ; Global: Reachable code entry at CPU $CB65 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_TransferVramData_CB65: lda $0602 ; ROM $000B75: AD 02 06 ora $0600 ; ROM $000B78: 0D 00 06 pha ; ROM $000B7B: 48 sta PPUADDR ; ROM $000B7C: 8D 06 20 ldx $0601 ; ROM $000B7F: AE 01 06 stx PPUADDR ; ROM $000B82: 8E 06 20 ldx $0603 ; ROM $000B85: AE 03 06 lda $D9C6,x ; ROM $000B88: BD C6 D9 sta PPUDATA ; ROM $000B8B: 8D 07 20 lda $D9C7,x ; ROM $000B8E: BD C7 D9 sta PPUDATA ; ROM $000B91: 8D 07 20 pla ; ROM $000B94: 68 sta PPUADDR ; ROM $000B95: 8D 06 20 lda $0601 ; ROM $000B98: AD 01 06 clc ; ROM $000B9B: 18 adc #$20 ; ROM $000B9C: 69 20 sta PPUADDR ; ROM $000B9E: 8D 06 20 lda $D9C8,x ; ROM $000BA1: BD C8 D9 sta PPUDATA ; ROM $000BA4: 8D 07 20 lda $D9C9,x ; ROM $000BA7: BD C9 D9 sta PPUDATA ; ROM $000BAA: 8D 07 20 lda #$23 ; ROM $000BAD: A9 23 ora $0600 ; ROM $000BAF: 0D 00 06 pha ; ROM $000BB2: 48 sta PPUADDR ; ROM $000BB3: 8D 06 20 lda $0604 ; ROM $000BB6: AD 04 06 sta PPUADDR ; ROM $000BB9: 8D 06 20 tax ; ROM $000BBC: AA lda PPUDATA ; ROM $000BBD: AD 07 20 lda PPUDATA ; ROM $000BC0: AD 07 20 and $0606 ; ROM $000BC3: 2D 06 06 ora $0607 ; ROM $000BC6: 0D 07 06 tay ; ROM $000BC9: A8 pla ; ROM $000BCA: 68 sta PPUADDR ; ROM $000BCB: 8D 06 20 stx PPUADDR ; ROM $000BCE: 8E 06 20 sty PPUDATA ; ROM $000BD1: 8C 07 20 rts ; ROM $000BD4: 60 ; Routine: Gameplay_HandleControl_CBC5 ; Global: Reachable code entry at CPU $CBC5 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_HandleControl_CBC5: ldx #$09 ; ROM $000BD5: A2 09 lda #$00 ; ROM $000BD7: A9 00 ; Routine: Gameplay_WriteRam03A0_CBC9 ; Global: Reachable code entry at CPU $CBC9 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteRam03A0_CBC9: sta $03A0,x ; ROM $000BD9: 9D A0 03 dex ; ROM $000BDC: CA bpl Gameplay_WriteRam03A0_CBC9 ; ROM $000BDD: 10 FA ldx #$4F ; ROM $000BDF: A2 4F ; Routine: Gameplay_WriteRam03E6_CBD1 ; Global: Reachable code entry at CPU $CBD1 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteRam03E6_CBD1: sta $03E6,x ; ROM $000BE1: 9D E6 03 dex ; ROM $000BE4: CA bpl Gameplay_WriteRam03E6_CBD1 ; ROM $000BE5: 10 FA ; Routine: Gameplay_HandleControl_CBD7 ; Global: Reachable code entry at CPU $CBD7 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_HandleControl_CBD7: lda #$00 ; ROM $000BE7: A9 00 ldx #$09 ; ROM $000BE9: A2 09 ; Routine: Gameplay_WriteRam0576_CBDB ; Global: Reachable code entry at CPU $CBDB traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteRam0576_CBDB: sta $0576,x ; ROM $000BEB: 9D 76 05 dex ; ROM $000BEE: CA bpl Gameplay_WriteRam0576_CBDB ; ROM $000BEF: 10 FA rts ; ROM $000BF1: 60 ; Routine: Gameplay_RetreatIndexY_CBE2 ; Global: Reachable code entry at CPU $CBE2 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_RetreatIndexY_CBE2: dey ; ROM $000BF2: 88 bmi Gameplay_ReturnToCaller_CBEA ; ROM $000BF3: 30 05 ; Routine: Gameplay_ReadRam03E6_CBE5 ; Global: Reachable code entry at CPU $CBE5 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadRam03E6_CBE5: lda $03E6,y ; ROM $000BF5: B9 E6 03 bne Gameplay_RetreatIndexY_CBE2 ; ROM $000BF8: D0 F8 ; Routine: Gameplay_ReturnToCaller_CBEA ; Global: Reachable code entry at CPU $CBEA traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReturnToCaller_CBEA: rts ; ROM $000BFA: 60 ; Routine: Gameplay_ReadRamE2A3_CBEB ; Global: Reachable code entry at CPU $CBEB traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadRamE2A3_CBEB: lda $E2A3,y ; ROM $000BFB: B9 A3 E2 sta $34 ; ROM $000BFE: 85 34 lda $E2B0,y ; ROM $000C00: B9 B0 E2 sta $35 ; ROM $000C03: 85 35 rts ; ROM $000C05: 60 ; Routine: Gameplay_WriteDisplayMode_CBF6 ; Global: Reachable code entry at CPU $CBF6 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteDisplayMode_CBF6: lda #$01 ; ROM $000C06: A9 01 sta $38 ; ROM $000C08: 85 38 rts ; ROM $000C0A: 60 ; Routine: WaitForNmiFrameHandoff ; Global: Reachable code entry at CPU $CBFB traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. WaitForNmiFrameHandoff: lda FrameSyncFlag ; ROM $000C0B: A5 0B bne WaitForNmiFrameHandoff ; ROM $000C0D: D0 FC lda #$01 ; ROM $000C0F: A9 01 sta FrameSyncFlag ; ROM $000C11: 85 0B rts ; ROM $000C13: 60 ; Data region: CPU $CC04-$CC35; unreachable by direct recursive trace. FrameAnimationSequenceTable: .byte $02, $01, $05, $03, $01, $01, $02, $05, $06, $04, $01, $01, $05, $06, $02, $04 ; ROM $000C14: 02 01 05 03 01 01 02 05 06 04 01 01 05 06 02 04 .byte $01, $06, $01, $05, $06, $05, $01, $05, $06, $08, $02, $01, $05, $07, $04, $01 ; ROM $000C24: 01 06 01 05 06 05 01 05 06 08 02 01 05 07 04 01 .byte $05, $08, $06, $07, $05, $02, $04, $08, $05, $04, $06, $05, $08, $04, $06, $05 ; ROM $000C34: 05 08 06 07 05 02 04 08 05 04 06 05 08 04 06 05 .byte $07, $08 ; ROM $000C44: 07 08 ; Routine: Frame_ReadZp7D_CC36 ; Global: Reachable code entry at CPU $CC36 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReadZp7D_CC36: lda $7D ; ROM $000C46: A5 7D bne Frame_ReadZp5C_CC4C ; ROM $000C48: D0 12 lda $7A ; ROM $000C4A: A5 7A beq Frame_ReadZp5C_CC4C ; ROM $000C4C: F0 0E lda $33 ; ROM $000C4E: A5 33 and #$07 ; ROM $000C50: 29 07 bne Frame_ReadZp5C_CC4C ; ROM $000C52: D0 08 dec $7A ; ROM $000C54: C6 7A bne Frame_ReadZp5C_CC4C ; ROM $000C56: D0 04 lda #$03 ; ROM $000C58: A9 03 sta $B5 ; ROM $000C5A: 85 B5 ; Routine: Frame_ReadZp5C_CC4C ; Global: Reachable code entry at CPU $CC4C traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReadZp5C_CC4C: lda $5C ; ROM $000C5C: A5 5C beq Frame_ReadObjectX_CC63 ; ROM $000C5E: F0 13 lda $33 ; ROM $000C60: A5 33 and #$0F ; ROM $000C62: 29 0F bne Frame_ReturnToCaller_CC62 ; ROM $000C64: D0 0C inc $2C ; ROM $000C66: E6 2C lda $2C ; ROM $000C68: A5 2C cmp #$14 ; ROM $000C6A: C9 14 bne Frame_ReturnToCaller_CC62 ; ROM $000C6C: D0 04 lda #$01 ; ROM $000C6E: A9 01 sta $5D ; ROM $000C70: 85 5D ; Routine: Frame_ReturnToCaller_CC62 ; Global: Reachable code entry at CPU $CC62 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReturnToCaller_CC62: rts ; ROM $000C72: 60 ; Routine: Frame_ReadObjectX_CC63 ; Global: Reachable code entry at CPU $CC63 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReadObjectX_CC63: lda $29 ; ROM $000C73: A5 29 cmp #$08 ; ROM $000C75: C9 08 bne Frame_ReadObjectFlags_CCA4 ; ROM $000C77: D0 3B lda $2B ; ROM $000C79: A5 2B cmp #$08 ; ROM $000C7B: C9 08 bne Frame_ReadObjectFlags_CCA4 ; ROM $000C7D: D0 35 ldy $2A ; ROM $000C7F: A4 2A sty $20 ; ROM $000C81: 84 20 lda $E2A3,y ; ROM $000C83: B9 A3 E2 sta $34 ; ROM $000C86: 85 34 lda $E2B0,y ; ROM $000C88: B9 B0 E2 sta $35 ; ROM $000C8B: 85 35 ldy $28 ; ROM $000C8D: A4 28 sty $1F ; ROM $000C8F: 84 1F lda ($34),y ; ROM $000C91: B1 34 cmp #$08 ; ROM $000C93: C9 08 beq Frame_IncrementBombCapacity_CC95 ; ROM $000C95: F0 0E cmp #$06 ; ROM $000C97: C9 06 bne Frame_ReadObjectFlags_CCA4 ; ROM $000C99: D0 19 lda #$00 ; ROM $000C9B: A9 00 sta ($34),y ; ROM $000C9D: 91 34 jsr Stage_WriteObjectWorkX_D8FC ; ROM $000C9F: 20 FC D8 jmp Frame_WriteSoundCommandState_CEE9 ; ROM $000CA2: 4C E9 CE ; Routine: Frame_IncrementBombCapacity_CC95 ; Global: Reachable code entry at CPU $CC95 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_IncrementBombCapacity_CC95: inc $9F ; ROM $000CA5: E6 9F lda #$00 ; ROM $000CA7: A9 00 sta $A6 ; ROM $000CA9: 85 A6 lda $9C ; ROM $000CAB: A5 9C bne Frame_ReadObjectFlags_CCA4 ; ROM $000CAD: D0 05 lda #$01 ; ROM $000CAF: A9 01 sta $5E ; ROM $000CB1: 85 5E ; Routine: Frame_ReturnToCaller_CCA3 ; Global: Reachable code entry at CPU $CCA3 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReturnToCaller_CCA3: rts ; ROM $000CB3: 60 ; Routine: Frame_ReadObjectFlags_CCA4 ; Global: Reachable code entry at CPU $CCA4 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReadObjectFlags_CCA4: lda $75 ; ROM $000CB4: A5 75 bne Frame_WriteInvincibilityTimer_CCAE ; ROM $000CB6: D0 06 lda $33 ; ROM $000CB8: A5 33 and #$03 ; ROM $000CBA: 29 03 beq Frame_ReturnToCaller_CCA3 ; ROM $000CBC: F0 F5 ; Routine: Frame_WriteInvincibilityTimer_CCAE ; Global: Reachable code entry at CPU $CCAE traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_WriteInvincibilityTimer_CCAE: jsr Object_ReadGameState_CF87 ; ROM $000CBE: 20 87 CF bne Frame_CopyAToX_CCB7 ; ROM $000CC1: D0 04 sta $A6 ; ROM $000CC3: 85 A6 sta $7B ; ROM $000CC5: 85 7B ; Routine: Frame_CopyAToX_CCB7 ; Global: Reachable code entry at CPU $CCB7 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_CopyAToX_CCB7: tax ; ROM $000CC7: AA and #$01 ; ROM $000CC8: 29 01 beq Frame_CopyXToA_CCBF ; ROM $000CCA: F0 03 jsr Frame_ReadObjectX_CDD4 ; ROM $000CCC: 20 D4 CD ; Routine: Frame_CopyXToA_CCBF ; Global: Reachable code entry at CPU $CCBF traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_CopyXToA_CCBF: txa ; ROM $000CCF: 8A and #$02 ; ROM $000CD0: 29 02 beq Frame_CopyXToA_CCC7 ; ROM $000CD2: F0 03 jsr Frame_ReadObjectX_CDA3 ; ROM $000CD4: 20 A3 CD ; Routine: Frame_CopyXToA_CCC7 ; Global: Reachable code entry at CPU $CCC7 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_CopyXToA_CCC7: txa ; ROM $000CD7: 8A and #$08 ; ROM $000CD8: 29 08 beq Frame_CopyXToA_CCCF ; ROM $000CDA: F0 03 jsr Frame_ReadObjectY_CD70 ; ROM $000CDC: 20 70 CD ; Routine: Frame_CopyXToA_CCCF ; Global: Reachable code entry at CPU $CCCF traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_CopyXToA_CCCF: txa ; ROM $000CDF: 8A and #$04 ; ROM $000CE0: 29 04 beq Frame_ReadObjectSubtype_CCD7 ; ROM $000CE2: F0 03 jsr Frame_ReadObjectY_CD39 ; ROM $000CE4: 20 39 CD ; Routine: Frame_ReadObjectSubtype_CCD7 ; Global: Reachable code entry at CPU $CCD7 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReadObjectSubtype_CCD7: txa ; ROM $000CE7: 8A and #$80 ; ROM $000CE8: 29 80 bne Frame_ReadObjectState_CCEF ; ROM $000CEA: D0 13 lda $77 ; ROM $000CEC: A5 77 beq Frame_ReturnToCaller_CCEE ; ROM $000CEE: F0 0E lda $7B ; ROM $000CF0: A5 7B bne Frame_ReturnToCaller_CCEE ; ROM $000CF2: D0 0A txa ; ROM $000CF4: 8A and #$40 ; ROM $000CF5: 29 40 beq Frame_ReturnToCaller_CCEE ; ROM $000CF7: F0 05 sta $7B ; ROM $000CF9: 85 7B jsr Gameplay_HandleControl_C939 ; ROM $000CFB: 20 39 C9 ; Routine: Frame_ReturnToCaller_CCEE ; Global: Reachable code entry at CPU $CCEE traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReturnToCaller_CCEE: rts ; ROM $000CFE: 60 ; Routine: Frame_ReadObjectState_CCEF ; Global: Reachable code entry at CPU $CCEF traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReadObjectState_CCEF: ldy $2A ; ROM $000CFF: A4 2A lda $E2A3,y ; ROM $000D01: B9 A3 E2 sta $34 ; ROM $000D04: 85 34 lda $E2B0,y ; ROM $000D06: B9 B0 E2 sta $35 ; ROM $000D09: 85 35 ldy $28 ; ROM $000D0B: A4 28 lda ($34),y ; ROM $000D0D: B1 34 bne Frame_ReturnToCaller_CCEE ; ROM $000D0F: D0 ED jsr Frame_ReadObjectX_CE10 ; ROM $000D11: 20 10 CE jsr Frame_ReadObjectY_CE1F ; ROM $000D14: 20 1F CE ldx $74 ; ROM $000D17: A6 74 ; Routine: Frame_ReadRam03A0_CD09 ; Global: Reachable code entry at CPU $CD09 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReadRam03A0_CD09: lda $03A0,x ; ROM $000D19: BD A0 03 beq Frame_WriteTransferPointer_CD12 ; ROM $000D1C: F0 04 dex ; ROM $000D1E: CA bpl Frame_ReadRam03A0_CD09 ; ROM $000D1F: 10 F8 rts ; ROM $000D21: 60 ; Routine: Frame_WriteTransferPointer_CD12 ; Global: Reachable code entry at CPU $CD12 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_WriteTransferPointer_CD12: lda #$03 ; ROM $000D22: A9 03 sta ($34),y ; ROM $000D24: 91 34 lda $28 ; ROM $000D26: A5 28 sta $03AA,x ; ROM $000D28: 9D AA 03 lda $2A ; ROM $000D2B: A5 2A sta $03B4,x ; ROM $000D2D: 9D B4 03 lda #$00 ; ROM $000D30: A9 00 sta $03D2,x ; ROM $000D32: 9D D2 03 lda #$00 ; ROM $000D35: A9 00 sta $03C8,x ; ROM $000D37: 9D C8 03 lda #$A0 ; ROM $000D3A: A9 A0 sta $03BE,x ; ROM $000D3C: 9D BE 03 lda #$01 ; ROM $000D3F: A9 01 sta $03A0,x ; ROM $000D41: 9D A0 03 lda #$03 ; ROM $000D44: A9 03 sta $DF ; ROM $000D46: 85 DF rts ; ROM $000D48: 60 ; Routine: Frame_ReadObjectY_CD39 ; Global: Reachable code entry at CPU $CD39 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReadObjectY_CD39: lda $2B ; ROM $000D49: A5 2B cmp #$08 ; ROM $000D4B: C9 08 bcs Frame_ReadObjectState_CD44 ; ROM $000D4D: B0 05 inc $2B ; ROM $000D4F: E6 2B jmp Frame_HandleControl_CD69 ; ROM $000D51: 4C 69 CD ; Routine: Frame_ReadObjectState_CD44 ; Global: Reachable code entry at CPU $CD44 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReadObjectState_CD44: ldy $2A ; ROM $000D54: A4 2A iny ; ROM $000D56: C8 lda $E2A3,y ; ROM $000D57: B9 A3 E2 sta $34 ; ROM $000D5A: 85 34 lda $E2B0,y ; ROM $000D5C: B9 B0 E2 sta $35 ; ROM $000D5F: 85 35 ldy $28 ; ROM $000D61: A4 28 jsr Object_ReadTransferPointer_CF60 ; ROM $000D63: 20 60 CF bne Frame_HandleControl_CD69 ; ROM $000D66: D0 11 jsr Frame_ReadObjectX_CE10 ; ROM $000D68: 20 10 CE inc $2B ; ROM $000D6B: E6 2B lda $2B ; ROM $000D6D: A5 2B cmp #$10 ; ROM $000D6F: C9 10 bne Frame_HandleControl_CD69 ; ROM $000D71: D0 06 lda #$00 ; ROM $000D73: A9 00 sta $2B ; ROM $000D75: 85 2B inc $2A ; ROM $000D77: E6 2A ; Routine: Frame_HandleControl_CD69 ; Global: Reachable code entry at CPU $CD69 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_HandleControl_CD69: lda #$04 ; ROM $000D79: A9 04 ldy #$07 ; ROM $000D7B: A0 07 jmp Frame_ReadZp33_CE2E ; ROM $000D7D: 4C 2E CE ; Routine: Frame_ReadObjectY_CD70 ; Global: Reachable code entry at CPU $CD70 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReadObjectY_CD70: lda $2B ; ROM $000D80: A5 2B cmp #$09 ; ROM $000D82: C9 09 bcc Frame_ReadObjectState_CD7B ; ROM $000D84: 90 05 dec $2B ; ROM $000D86: C6 2B jmp Frame_HandleControl_CD9C ; ROM $000D88: 4C 9C CD ; Routine: Frame_ReadObjectState_CD7B ; Global: Reachable code entry at CPU $CD7B traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReadObjectState_CD7B: ldy $2A ; ROM $000D8B: A4 2A dey ; ROM $000D8D: 88 lda $E2A3,y ; ROM $000D8E: B9 A3 E2 sta $34 ; ROM $000D91: 85 34 lda $E2B0,y ; ROM $000D93: B9 B0 E2 sta $35 ; ROM $000D96: 85 35 ldy $28 ; ROM $000D98: A4 28 jsr Object_ReadTransferPointer_CF60 ; ROM $000D9A: 20 60 CF bne Frame_HandleControl_CD9C ; ROM $000D9D: D0 0D jsr Frame_ReadObjectX_CE10 ; ROM $000D9F: 20 10 CE dec $2B ; ROM $000DA2: C6 2B bpl Frame_HandleControl_CD9C ; ROM $000DA4: 10 06 lda #$0F ; ROM $000DA6: A9 0F sta $2B ; ROM $000DA8: 85 2B dec $2A ; ROM $000DAA: C6 2A ; Routine: Frame_HandleControl_CD9C ; Global: Reachable code entry at CPU $CD9C traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_HandleControl_CD9C: lda #$08 ; ROM $000DAC: A9 08 ldy #$0B ; ROM $000DAE: A0 0B jmp Frame_ReadZp33_CE2E ; ROM $000DB0: 4C 2E CE ; Routine: Frame_ReadObjectX_CDA3 ; Global: Reachable code entry at CPU $CDA3 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReadObjectX_CDA3: lda $29 ; ROM $000DB3: A5 29 cmp #$09 ; ROM $000DB5: C9 09 bcc Frame_ReadObjectState_CDAE ; ROM $000DB7: 90 05 dec $29 ; ROM $000DB9: C6 29 jmp Frame_HandleControl_CDCF ; ROM $000DBB: 4C CF CD ; Routine: Frame_ReadObjectState_CDAE ; Global: Reachable code entry at CPU $CDAE traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReadObjectState_CDAE: ldy $2A ; ROM $000DBE: A4 2A lda $E2A3,y ; ROM $000DC0: B9 A3 E2 sta $34 ; ROM $000DC3: 85 34 lda $E2B0,y ; ROM $000DC5: B9 B0 E2 sta $35 ; ROM $000DC8: 85 35 ldy $28 ; ROM $000DCA: A4 28 dey ; ROM $000DCC: 88 jsr Object_ReadTransferPointer_CF60 ; ROM $000DCD: 20 60 CF bne Frame_HandleControl_CDCF ; ROM $000DD0: D0 0D jsr Frame_ReadObjectY_CE1F ; ROM $000DD2: 20 1F CE dec $29 ; ROM $000DD5: C6 29 bpl Frame_HandleControl_CDCF ; ROM $000DD7: 10 06 lda #$0F ; ROM $000DD9: A9 0F sta $29 ; ROM $000DDB: 85 29 dec $28 ; ROM $000DDD: C6 28 ; Routine: Frame_HandleControl_CDCF ; Global: Reachable code entry at CPU $CDCF traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_HandleControl_CDCF: lda #$00 ; ROM $000DDF: A9 00 jmp Frame_WriteZp2D_CE06 ; ROM $000DE1: 4C 06 CE ; Routine: Frame_ReadObjectX_CDD4 ; Global: Reachable code entry at CPU $CDD4 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReadObjectX_CDD4: lda $29 ; ROM $000DE4: A5 29 cmp #$08 ; ROM $000DE6: C9 08 bcs Frame_ReadObjectState_CDDF ; ROM $000DE8: B0 05 inc $29 ; ROM $000DEA: E6 29 jmp Frame_HandleControl_CE04 ; ROM $000DEC: 4C 04 CE ; Routine: Frame_ReadObjectState_CDDF ; Global: Reachable code entry at CPU $CDDF traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReadObjectState_CDDF: ldy $2A ; ROM $000DEF: A4 2A lda $E2A3,y ; ROM $000DF1: B9 A3 E2 sta $34 ; ROM $000DF4: 85 34 lda $E2B0,y ; ROM $000DF6: B9 B0 E2 sta $35 ; ROM $000DF9: 85 35 ldy $28 ; ROM $000DFB: A4 28 iny ; ROM $000DFD: C8 jsr Object_ReadTransferPointer_CF60 ; ROM $000DFE: 20 60 CF bne Frame_HandleControl_CE04 ; ROM $000E01: D0 11 jsr Frame_ReadObjectY_CE1F ; ROM $000E03: 20 1F CE inc $29 ; ROM $000E06: E6 29 lda $29 ; ROM $000E08: A5 29 cmp #$10 ; ROM $000E0A: C9 10 bne Frame_HandleControl_CE04 ; ROM $000E0C: D0 06 lda #$00 ; ROM $000E0E: A9 00 sta $29 ; ROM $000E10: 85 29 inc $28 ; ROM $000E12: E6 28 ; Routine: Frame_HandleControl_CE04 ; Global: Reachable code entry at CPU $CE04 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_HandleControl_CE04: lda #$40 ; ROM $000E14: A9 40 ; Routine: Frame_WriteZp2D_CE06 ; Global: Reachable code entry at CPU $CE06 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_WriteZp2D_CE06: sta $2D ; ROM $000E16: 85 2D lda #$00 ; ROM $000E18: A9 00 ldy #$03 ; ROM $000E1A: A0 03 jmp Frame_ReadZp33_CE2E ; ROM $000E1C: 4C 2E CE ; Data region: CPU $CE0F-$CE0F; unreachable by direct recursive trace. FrameSingleByteConstant: .byte $60 ; ROM $000E1F: 60 ; Routine: Frame_ReadObjectX_CE10 ; Global: Reachable code entry at CPU $CE10 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReadObjectX_CE10: lda $29 ; ROM $000E20: A5 29 cmp #$08 ; ROM $000E22: C9 08 bcc Frame_IncrementObjectX_CE1B ; ROM $000E24: 90 05 beq Frame_ReturnToCaller_CE1E ; ROM $000E26: F0 06 dec $29 ; ROM $000E28: C6 29 rts ; ROM $000E2A: 60 ; Routine: Frame_IncrementObjectX_CE1B ; Global: Reachable code entry at CPU $CE1B traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_IncrementObjectX_CE1B: inc $29 ; ROM $000E2B: E6 29 rts ; ROM $000E2D: 60 ; Routine: Frame_ReturnToCaller_CE1E ; Global: Reachable code entry at CPU $CE1E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReturnToCaller_CE1E: rts ; ROM $000E2E: 60 ; Routine: Frame_ReadObjectY_CE1F ; Global: Reachable code entry at CPU $CE1F traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReadObjectY_CE1F: lda $2B ; ROM $000E2F: A5 2B cmp #$08 ; ROM $000E31: C9 08 bcc Frame_IncrementObjectY_CE2A ; ROM $000E33: 90 05 beq Frame_ReturnToCaller_CE2D ; ROM $000E35: F0 06 dec $2B ; ROM $000E37: C6 2B rts ; ROM $000E39: 60 ; Routine: Frame_IncrementObjectY_CE2A ; Global: Reachable code entry at CPU $CE2A traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_IncrementObjectY_CE2A: inc $2B ; ROM $000E3A: E6 2B rts ; ROM $000E3C: 60 ; Routine: Frame_ReturnToCaller_CE2D ; Global: Reachable code entry at CPU $CE2D traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReturnToCaller_CE2D: rts ; ROM $000E3D: 60 ; Routine: Frame_ReadZp33_CE2E ; Global: Reachable code entry at CPU $CE2E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReadZp33_CE2E: pha ; ROM $000E3E: 48 lda $33 ; ROM $000E3F: A5 33 and #$03 ; ROM $000E41: 29 03 cmp #$02 ; ROM $000E43: C9 02 bne Frame_RestoreAccumulator_CE59 ; ROM $000E45: D0 22 lda $33 ; ROM $000E47: A5 33 pla ; ROM $000E49: 68 inc $A6 ; ROM $000E4A: E6 A6 inc $2C ; ROM $000E4C: E6 2C cmp $2C ; ROM $000E4E: C5 2C bcc Frame_TestObjectIndex_CE45 ; ROM $000E50: 90 03 sta $2C ; ROM $000E52: 85 2C rts ; ROM $000E54: 60 ; Routine: Frame_TestObjectIndex_CE45 ; Global: Reachable code entry at CPU $CE45 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_TestObjectIndex_CE45: cpy $2C ; ROM $000E55: C4 2C bcc Frame_WriteObjectIndex_CE4A ; ROM $000E57: 90 01 rts ; ROM $000E59: 60 ; Routine: Frame_WriteObjectIndex_CE4A ; Global: Reachable code entry at CPU $CE4A traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_WriteObjectIndex_CE4A: sta $2C ; ROM $000E5A: 85 2C cmp #$04 ; ROM $000E5C: C9 04 bcc Frame_HandleControl_CE54 ; ROM $000E5E: 90 04 lda #$02 ; ROM $000E60: A9 02 bne Frame_WriteSoundCommandState_CE56 ; ROM $000E62: D0 02 ; Routine: Frame_HandleControl_CE54 ; Global: Reachable code entry at CPU $CE54 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_HandleControl_CE54: lda #$01 ; ROM $000E64: A9 01 ; Routine: Frame_WriteSoundCommandState_CE56 ; Global: Reachable code entry at CPU $CE56 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_WriteSoundCommandState_CE56: sta $DF ; ROM $000E66: 85 DF rts ; ROM $000E68: 60 ; Routine: Frame_RestoreAccumulator_CE59 ; Global: Reachable code entry at CPU $CE59 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_RestoreAccumulator_CE59: pla ; ROM $000E69: 68 ; Routine: Frame_ReturnToCaller_CE5A ; Global: Reachable code entry at CPU $CE5A traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReturnToCaller_CE5A: rts ; ROM $000E6A: 60 ; Routine: Frame_ReadObjectIndex_CE5B ; Global: Reachable code entry at CPU $CE5B traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReadObjectIndex_CE5B: lda $2C ; ROM $000E6B: A5 2C cmp #$13 ; ROM $000E6D: C9 13 bcs Frame_ReturnToCaller_CE5A ; ROM $000E6F: B0 F9 lda $2D ; ROM $000E71: A5 2D sta $3D ; ROM $000E73: 85 3D ldy #$00 ; ROM $000E75: A0 00 sty $3C ; ROM $000E77: 84 3C lda $28 ; ROM $000E79: A5 28 cmp #$08 ; ROM $000E7B: C9 08 bcc Frame_WriteZp0E_CE80 ; ROM $000E7D: 90 11 ldy #$F0 ; ROM $000E7F: A0 F0 cmp #$17 ; ROM $000E81: C9 17 bcs Frame_WriteZp0E_CE80 ; ROM $000E83: B0 0B asl a ; ROM $000E85: 0A asl a ; ROM $000E86: 0A asl a ; ROM $000E87: 0A asl a ; ROM $000E88: 0A clc ; ROM $000E89: 18 adc $29 ; ROM $000E8A: 65 29 sec ; ROM $000E8C: 38 sbc #$80 ; ROM $000E8D: E9 80 tay ; ROM $000E8F: A8 ; Routine: Frame_WriteZp0E_CE80 ; Global: Reachable code entry at CPU $CE80 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_WriteZp0E_CE80: sty $0E ; ROM $000E90: 84 0E lda $28 ; ROM $000E92: A5 28 asl a ; ROM $000E94: 0A asl a ; ROM $000E95: 0A asl a ; ROM $000E96: 0A asl a ; ROM $000E97: 0A clc ; ROM $000E98: 18 adc $29 ; ROM $000E99: 65 29 sec ; ROM $000E9B: 38 sbc #$08 ; ROM $000E9C: E9 08 sbc $0E ; ROM $000E9E: E5 0E sta $3A ; ROM $000EA0: 85 3A lda $2A ; ROM $000EA2: A5 2A asl a ; ROM $000EA4: 0A asl a ; ROM $000EA5: 0A asl a ; ROM $000EA6: 0A asl a ; ROM $000EA7: 0A clc ; ROM $000EA8: 18 adc $2B ; ROM $000EA9: 65 2B adc #$17 ; ROM $000EAB: 69 17 sta $3B ; ROM $000EAD: 85 3B ldx $2C ; ROM $000EAF: A6 2C lda $CED6,x ; ROM $000EB1: BD D6 CE jmp Stage_WriteZp3F_D5F2 ; ROM $000EB4: 4C F2 D5 ; Routine: Frame_ReadZp2D_CEA7 ; Global: Reachable code entry at CPU $CEA7 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_ReadZp2D_CEA7: lda $2D ; ROM $000EB7: A5 2D sta $3D ; ROM $000EB9: 85 3D ldy #$03 ; ROM $000EBB: A0 03 sty $3C ; ROM $000EBD: 84 3C lda $28 ; ROM $000EBF: A5 28 asl a ; ROM $000EC1: 0A asl a ; ROM $000EC2: 0A asl a ; ROM $000EC3: 0A asl a ; ROM $000EC4: 0A clc ; ROM $000EC5: 18 adc $29 ; ROM $000EC6: 65 29 sec ; ROM $000EC8: 38 sbc #$08 ; ROM $000EC9: E9 08 sta $3A ; ROM $000ECB: 85 3A lda $2A ; ROM $000ECD: A5 2A asl a ; ROM $000ECF: 0A asl a ; ROM $000ED0: 0A asl a ; ROM $000ED1: 0A asl a ; ROM $000ED2: 0A clc ; ROM $000ED3: 18 adc $2B ; ROM $000ED4: 65 2B adc #$17 ; ROM $000ED6: 69 17 sta $3B ; ROM $000ED8: 85 3B ldx $2C ; ROM $000EDA: A6 2C lda $CED2,x ; ROM $000EDC: BD D2 CE jmp Stage_WriteZp3F_D5F2 ; ROM $000EDF: 4C F2 D5 ; Data region: CPU $CED2-$CEE8; unreachable by direct recursive trace. FrameObjectOffsetTable: .byte $10, $11, $12, $11, $00, $01, $02, $01, $03, $04, $05, $04, $06, $07, $08, $07 ; ROM $000EE2: 10 11 12 11 00 01 02 01 03 04 05 04 06 07 08 07 .byte $09, $0A, $0B, $0C, $0D, $0E, $0F ; ROM $000EF2: 09 0A 0B 0C 0D 0E 0F ; Routine: Frame_WriteSoundCommandState_CEE9 ; Global: Reachable code entry at CPU $CEE9 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Frame_WriteSoundCommandState_CEE9: lda #$04 ; ROM $000EF9: A9 04 sta $DF ; ROM $000EFB: 85 DF lda #$0A ; ROM $000EFD: A9 0A jsr Menu_WriteObjectWorkX_DD83 ; ROM $000EFF: 20 83 DD ldx $5B ; ROM $000F02: A6 5B dex ; ROM $000F04: CA beq Object_ReadObjectTimer_CF0D ; ROM $000F05: F0 16 dex ; ROM $000F07: CA beq Object_ReadObjectMode_CF1A ; ROM $000F08: F0 20 dex ; ROM $000F0A: CA beq Object_WriteObjectFlags_CF2A ; ROM $000F0B: F0 2D dex ; ROM $000F0D: CA beq Object_WriteObjectPhase_CF33 ; ROM $000F0E: F0 33 dex ; ROM $000F10: CA beq Object_WriteObjectSubtype_CF3C ; ROM $000F11: F0 39 dex ; ROM $000F13: CA beq Object_WriteObjectDirection_CF45 ; ROM $000F14: F0 3F dex ; ROM $000F16: CA beq Object_WriteObjectSpeed_CF4E ; ROM $000F17: F0 45 dex ; ROM $000F19: CA beq Object_WriteObjectCounter_CF57 ; ROM $000F1A: F0 4B rts ; ROM $000F1C: 60 ; Routine: Object_ReadObjectTimer_CF0D ; Global: Reachable code entry at CPU $CF0D traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_ReadObjectTimer_CF0D: lda $74 ; ROM $000F1D: A5 74 cmp #$09 ; ROM $000F1F: C9 09 beq Object_WriteGameMode_CF15 ; ROM $000F21: F0 02 inc $74 ; ROM $000F23: E6 74 ; Routine: Object_WriteGameMode_CF15 ; Global: Reachable code entry at CPU $CF15 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_WriteGameMode_CF15: lda #$04 ; ROM $000F25: A9 04 sta $B5 ; ROM $000F27: 85 B5 rts ; ROM $000F29: 60 ; Routine: Object_ReadObjectMode_CF1A ; Global: Reachable code entry at CPU $CF1A traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_ReadObjectMode_CF1A: lda $73 ; ROM $000F2A: A5 73 cmp #$50 ; ROM $000F2C: C9 50 beq Object_WriteGameMode_CF25 ; ROM $000F2E: F0 05 clc ; ROM $000F30: 18 adc #$10 ; ROM $000F31: 69 10 sta $73 ; ROM $000F33: 85 73 ; Routine: Object_WriteGameMode_CF25 ; Global: Reachable code entry at CPU $CF25 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_WriteGameMode_CF25: lda #$04 ; ROM $000F35: A9 04 sta $B5 ; ROM $000F37: 85 B5 rts ; ROM $000F39: 60 ; Routine: Object_WriteObjectFlags_CF2A ; Global: Reachable code entry at CPU $CF2A traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_WriteObjectFlags_CF2A: lda #$01 ; ROM $000F3A: A9 01 sta $75 ; ROM $000F3C: 85 75 lda #$04 ; ROM $000F3E: A9 04 sta $B5 ; ROM $000F40: 85 B5 rts ; ROM $000F42: 60 ; Routine: Object_WriteObjectPhase_CF33 ; Global: Reachable code entry at CPU $CF33 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_WriteObjectPhase_CF33: lda #$01 ; ROM $000F43: A9 01 sta $76 ; ROM $000F45: 85 76 lda #$04 ; ROM $000F47: A9 04 sta $B5 ; ROM $000F49: 85 B5 rts ; ROM $000F4B: 60 ; Routine: Object_WriteObjectSubtype_CF3C ; Global: Reachable code entry at CPU $CF3C traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_WriteObjectSubtype_CF3C: lda #$01 ; ROM $000F4C: A9 01 sta $77 ; ROM $000F4E: 85 77 lda #$04 ; ROM $000F50: A9 04 sta $B5 ; ROM $000F52: 85 B5 rts ; ROM $000F54: 60 ; Routine: Object_WriteObjectDirection_CF45 ; Global: Reachable code entry at CPU $CF45 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_WriteObjectDirection_CF45: lda #$01 ; ROM $000F55: A9 01 sta $78 ; ROM $000F57: 85 78 lda #$04 ; ROM $000F59: A9 04 sta $B5 ; ROM $000F5B: 85 B5 rts ; ROM $000F5D: 60 ; Routine: Object_WriteObjectSpeed_CF4E ; Global: Reachable code entry at CPU $CF4E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_WriteObjectSpeed_CF4E: lda #$01 ; ROM $000F5E: A9 01 sta $79 ; ROM $000F60: 85 79 lda #$05 ; ROM $000F62: A9 05 sta $B5 ; ROM $000F64: 85 B5 rts ; ROM $000F66: 60 ; Routine: Object_WriteObjectCounter_CF57 ; Global: Reachable code entry at CPU $CF57 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_WriteObjectCounter_CF57: lda #$FF ; ROM $000F67: A9 FF sta $7A ; ROM $000F69: 85 7A lda #$05 ; ROM $000F6B: A9 05 sta $B5 ; ROM $000F6D: 85 B5 rts ; ROM $000F6F: 60 ; Routine: Object_ReadTransferPointer_CF60 ; Global: Reachable code entry at CPU $CF60 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_ReadTransferPointer_CF60: lda ($34),y ; ROM $000F70: B1 34 beq Object_ReturnToCaller_CF7C ; ROM $000F72: F0 18 cmp #$08 ; ROM $000F74: C9 08 beq Object_ReturnToCaller_CF7C ; ROM $000F76: F0 14 cmp #$06 ; ROM $000F78: C9 06 beq Object_ReturnToCaller_CF7C ; ROM $000F7A: F0 10 cmp #$02 ; ROM $000F7C: C9 02 beq Object_ReadObjectPhase_CF7D ; ROM $000F7E: F0 0D cmp #$04 ; ROM $000F80: C9 04 beq Object_ReadObjectPhase_CF7D ; ROM $000F82: F0 09 cmp #$05 ; ROM $000F84: C9 05 beq Object_ReadObjectPhase_CF7D ; ROM $000F86: F0 05 cmp #$03 ; ROM $000F88: C9 03 beq Object_ReadObjectDirection_CF82 ; ROM $000F8A: F0 06 ; Routine: Object_ReturnToCaller_CF7C ; Global: Reachable code entry at CPU $CF7C traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_ReturnToCaller_CF7C: rts ; ROM $000F8C: 60 ; Routine: Object_ReadObjectPhase_CF7D ; Global: Reachable code entry at CPU $CF7D traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_ReadObjectPhase_CF7D: lda $76 ; ROM $000F8D: A5 76 eor #$01 ; ROM $000F8F: 49 01 rts ; ROM $000F91: 60 ; Routine: Object_ReadObjectDirection_CF82 ; Global: Reachable code entry at CPU $CF82 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_ReadObjectDirection_CF82: lda $78 ; ROM $000F92: A5 78 eor #$01 ; ROM $000F94: 49 01 rts ; ROM $000F96: 60 ; Routine: Object_ReadGameState_CF87 ; Global: Reachable code entry at CPU $CF87 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_ReadGameState_CF87: lda $59 ; ROM $000F97: A5 59 beq Object_MergeZp13_CFA4 ; ROM $000F99: F0 19 lda $AF ; ROM $000F9B: A5 AF dec $AE ; ROM $000F9D: C6 AE bne Object_ReturnToCaller_CFA3 ; ROM $000F9F: D0 12 pha ; ROM $000FA1: 48 ldy #$00 ; ROM $000FA2: A0 00 lda ($AC),y ; ROM $000FA4: B1 AC sta $AE ; ROM $000FA6: 85 AE jsr Object_IncrementZpAC_CFA9 ; ROM $000FA8: 20 A9 CF lda ($AC),y ; ROM $000FAB: B1 AC sta $AF ; ROM $000FAD: 85 AF jsr Object_IncrementZpAC_CFA9 ; ROM $000FAF: 20 A9 CF pla ; ROM $000FB2: 68 ; Routine: Object_ReturnToCaller_CFA3 ; Global: Reachable code entry at CPU $CFA3 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_ReturnToCaller_CFA3: rts ; ROM $000FB3: 60 ; Routine: Object_MergeZp13_CFA4 ; Global: Reachable code entry at CPU $CFA4 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_MergeZp13_CFA4: lda ControllerState1 ; ROM $000FB4: A5 12 ora $13 ; ROM $000FB6: 05 13 rts ; ROM $000FB8: 60 ; Routine: Object_IncrementZpAC_CFA9 ; Global: Reachable code entry at CPU $CFA9 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_IncrementZpAC_CFA9: inc $AC ; ROM $000FB9: E6 AC bne Object_ReturnToCaller_CFAF ; ROM $000FBB: D0 02 inc $AD ; ROM $000FBD: E6 AD ; Routine: Object_ReturnToCaller_CFAF ; Global: Reachable code entry at CPU $CFAF traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_ReturnToCaller_CFAF: rts ; ROM $000FBF: 60 ; Routine: Object_WriteStageProgress_CFB0 ; Global: Reachable code entry at CPU $CFB0 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_WriteStageProgress_CFB0: lda #$00 ; ROM $000FC0: A9 00 sta $9C ; ROM $000FC2: 85 9C lda #$C0 ; ROM $000FC4: A9 C0 sta $6B ; ROM $000FC6: 85 6B ldx #$09 ; ROM $000FC8: A2 09 ; Routine: Object_ReadRam0576_CFBA ; Global: Reachable code entry at CPU $CFBA traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_ReadRam0576_CFBA: lda $0576,x ; ROM $000FCA: BD 76 05 beq Object_RetreatIndexX_CFE9 ; ROM $000FCD: F0 2A cmp #$09 ; ROM $000FCF: C9 09 bcs Object_ReadRam05B2_CFC5 ; ROM $000FD1: B0 02 inc $9C ; ROM $000FD3: E6 9C ; Routine: Object_ReadRam05B2_CFC5 ; Global: Reachable code entry at CPU $CFC5 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_ReadRam05B2_CFC5: ldy $05B2,x ; ROM $000FD5: BC B2 05 beq Object_ReadRamD245_CFCF ; ROM $000FD8: F0 05 dec $05B2,x ; ROM $000FDA: DE B2 05 bne Object_RetreatIndexX_CFE9 ; ROM $000FDD: D0 1A ; Routine: Object_ReadRamD245_CFCF ; Global: Reachable code entry at CPU $CFCF traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_ReadRamD245_CFCF: asl a ; ROM $000FDF: 0A tay ; ROM $000FE0: A8 jsr Object_WriteZp4D_D1C8 ; ROM $000FE1: 20 C8 D1 lda #$CF ; ROM $000FE4: A9 CF pha ; ROM $000FE6: 48 lda #$E2 ; ROM $000FE7: A9 E2 pha ; ROM $000FE9: 48 lda $D245,y ; ROM $000FEA: B9 45 D2 pha ; ROM $000FED: 48 lda $D244,y ; ROM $000FEE: B9 44 D2 pha ; ROM $000FF1: 48 rts ; ROM $000FF2: 60 ; Data region: CPU $CFE3-$CFE8; unreachable by direct recursive trace. ObjectPositionLimitTable: .byte $20, $07, $D2, $20, $06, $D0 ; ROM $000FF3: 20 07 D2 20 06 D0 ; Routine: Object_RetreatIndexX_CFE9 ; Global: Reachable code entry at CPU $CFE9 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_RetreatIndexX_CFE9: dex ; ROM $000FF9: CA bpl Object_ReadRam0576_CFBA ; ROM $000FFA: 10 CE ; Routine: Object_ReturnToCaller_CFEC ; Global: Reachable code entry at CPU $CFEC traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_ReturnToCaller_CFEC: rts ; ROM $000FFC: 60 ; Routine: Object_ReadStageIndex_CFED ; Global: Reachable code entry at CPU $CFED traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_ReadStageIndex_CFED: lda $9D ; ROM $000FFD: A5 9D clc ; ROM $000FFF: 18 adc #$2C ; ROM $001000: 69 2C sta $46 ; ROM $001002: 85 46 lda $AA ; ROM $001004: A5 AA sta $42 ; ROM $001006: 85 42 lda $AB ; ROM $001008: A5 AB sta $44 ; ROM $00100A: 85 44 lda #$08 ; ROM $00100C: A9 08 sta $43 ; ROM $00100E: 85 43 sta $45 ; ROM $001010: 85 45 lda #$00 ; ROM $001012: A9 00 beq Object_WriteZp3D_D010 ; ROM $001014: F0 0A lda $41 ; ROM $001016: A5 41 beq Object_ReturnToCaller_CFEC ; ROM $001018: F0 E2 cmp #$0B ; ROM $00101A: C9 0B beq Object_WriteZp3D_D08C ; ROM $00101C: F0 7E lda $48 ; ROM $00101E: A5 48 ; Routine: Object_WriteZp3D_D010 ; Global: Reachable code entry at CPU $D010 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_WriteZp3D_D010: sta $3D ; ROM $001020: 85 3D ldy #$00 ; ROM $001022: A0 00 sty $50 ; ROM $001024: 84 50 lda $42 ; ROM $001026: A5 42 asl a ; ROM $001028: 0A asl a ; ROM $001029: 0A asl a ; ROM $00102A: 0A asl a ; ROM $00102B: 0A rol $50 ; ROM $00102C: 26 50 clc ; ROM $00102E: 18 adc $43 ; ROM $00102F: 65 43 sta $4F ; ROM $001031: 85 4F lda $50 ; ROM $001033: A5 50 adc #$00 ; ROM $001035: 69 00 sta $50 ; ROM $001037: 85 50 lda $4F ; ROM $001039: A5 4F sec ; ROM $00103B: 38 sbc #$08 ; ROM $00103C: E9 08 sta $4F ; ROM $00103E: 85 4F lda $50 ; ROM $001040: A5 50 sbc #$00 ; ROM $001042: E9 00 sta $50 ; ROM $001044: 85 50 lda $4F ; ROM $001046: A5 4F sec ; ROM $001048: 38 sbc $0E ; ROM $001049: E5 0E sta $4F ; ROM $00104B: 85 4F lda $50 ; ROM $00104D: A5 50 sbc #$00 ; ROM $00104F: E9 00 bne Object_ReturnToCaller_D08B ; ROM $001051: D0 48 lda $4F ; ROM $001053: A5 4F cmp #$F8 ; ROM $001055: C9 F8 bcs Object_ReturnToCaller_D08B ; ROM $001057: B0 42 sta $3A ; ROM $001059: 85 3A lda $44 ; ROM $00105B: A5 44 asl a ; ROM $00105D: 0A asl a ; ROM $00105E: 0A asl a ; ROM $00105F: 0A asl a ; ROM $001060: 0A clc ; ROM $001061: 18 adc $45 ; ROM $001062: 65 45 adc #$17 ; ROM $001064: 69 17 sta $3B ; ROM $001066: 85 3B ldy $46 ; ROM $001068: A4 46 lda $D186,y ; ROM $00106A: B9 86 D1 sta $3C ; ROM $00106D: 85 3C lda $D154,y ; ROM $00106F: B9 54 D1 jsr Stage_WriteZp3F_D5F2 ; ROM $001072: 20 F2 D5 lda $46 ; ROM $001075: A5 46 cmp #$20 ; ROM $001077: C9 20 bcs Object_ReturnToCaller_D08B ; ROM $001079: B0 20 lda $5C ; ROM $00107B: A5 5C bne Object_ReturnToCaller_D08B ; ROM $00107D: D0 1C lda $7A ; ROM $00107F: A5 7A bne Object_ReturnToCaller_D08B ; ROM $001081: D0 18 lda $42 ; ROM $001083: A5 42 cmp $28 ; ROM $001085: C5 28 bne Object_ReturnToCaller_D08B ; ROM $001087: D0 12 lda $44 ; ROM $001089: A5 44 cmp $2A ; ROM $00108B: C5 2A bne Object_ReturnToCaller_D08B ; ROM $00108D: D0 0C lda #$05 ; ROM $00108F: A9 05 sta $DF ; ROM $001091: 85 DF lda #$01 ; ROM $001093: A9 01 sta $5C ; ROM $001095: 85 5C lda #$0C ; ROM $001097: A9 0C sta $2C ; ROM $001099: 85 2C ; Routine: Object_ReturnToCaller_D08B ; Global: Reachable code entry at CPU $D08B traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_ReturnToCaller_D08B: rts ; ROM $00109B: 60 ; Routine: Object_WriteZp3D_D08C ; Global: Reachable code entry at CPU $D08C traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_WriteZp3D_D08C: txa ; ROM $00109C: 8A pha ; ROM $00109D: 48 lda #$00 ; ROM $00109E: A9 00 sta $3D ; ROM $0010A0: 85 3D ldy #$00 ; ROM $0010A2: A0 00 sty $50 ; ROM $0010A4: 84 50 lda $42 ; ROM $0010A6: A5 42 asl a ; ROM $0010A8: 0A asl a ; ROM $0010A9: 0A asl a ; ROM $0010AA: 0A asl a ; ROM $0010AB: 0A rol $50 ; ROM $0010AC: 26 50 clc ; ROM $0010AE: 18 adc $43 ; ROM $0010AF: 65 43 sta $4F ; ROM $0010B1: 85 4F lda $50 ; ROM $0010B3: A5 50 adc #$00 ; ROM $0010B5: 69 00 sta $50 ; ROM $0010B7: 85 50 lda $4F ; ROM $0010B9: A5 4F sec ; ROM $0010BB: 38 sbc #$08 ; ROM $0010BC: E9 08 sta $4F ; ROM $0010BE: 85 4F lda $50 ; ROM $0010C0: A5 50 sbc #$00 ; ROM $0010C2: E9 00 sta $50 ; ROM $0010C4: 85 50 lda $4F ; ROM $0010C6: A5 4F sec ; ROM $0010C8: 38 sbc $0E ; ROM $0010C9: E5 0E sta $4F ; ROM $0010CB: 85 4F lda $50 ; ROM $0010CD: A5 50 sbc #$00 ; ROM $0010CF: E9 00 bne Object_RestoreAccumulator_D0F7 ; ROM $0010D1: D0 34 lda $4F ; ROM $0010D3: A5 4F cmp #$F8 ; ROM $0010D5: C9 F8 bcs Object_RestoreAccumulator_D0F7 ; ROM $0010D7: B0 2E sta $3A ; ROM $0010D9: 85 3A lda $44 ; ROM $0010DB: A5 44 asl a ; ROM $0010DD: 0A asl a ; ROM $0010DE: 0A asl a ; ROM $0010DF: 0A asl a ; ROM $0010E0: 0A clc ; ROM $0010E1: 18 adc $45 ; ROM $0010E2: 65 45 adc #$1B ; ROM $0010E4: 69 1B sta $3B ; ROM $0010E6: 85 3B lda $4B ; ROM $0010E8: A5 4B clc ; ROM $0010EA: 18 adc $4A ; ROM $0010EB: 65 4A cmp #$10 ; ROM $0010ED: C9 10 bcc Object_WriteObjectWorkX_D0E3 ; ROM $0010EF: 90 02 lda #$10 ; ROM $0010F1: A9 10 ; Routine: Object_WriteObjectWorkX_D0E3 ; Global: Reachable code entry at CPU $D0E3 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_WriteObjectWorkX_D0E3: sta $24 ; ROM $0010F3: 85 24 asl a ; ROM $0010F5: 0A clc ; ROM $0010F6: 18 adc $24 ; ROM $0010F7: 65 24 tax ; ROM $0010F9: AA ldy $6B ; ROM $0010FA: A4 6B jsr Object_ReadRamD121_D0FA ; ROM $0010FC: 20 FA D0 jsr Object_ReadRamD121_D0FA ; ROM $0010FF: 20 FA D0 jsr Object_ReadRamD121_D0FA ; ROM $001102: 20 FA D0 sty $6B ; ROM $001105: 84 6B ; Routine: Object_RestoreAccumulator_D0F7 ; Global: Reachable code entry at CPU $D0F7 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_RestoreAccumulator_D0F7: pla ; ROM $001107: 68 tax ; ROM $001108: AA rts ; ROM $001109: 60 ; Routine: Object_ReadRamD121_D0FA ; Global: Reachable code entry at CPU $D0FA traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_ReadRamD121_D0FA: lda $D121,x ; ROM $00110A: BD 21 D1 beq Object_AdvanceIndexX_D11C ; ROM $00110D: F0 1D pha ; ROM $00110F: 48 lda $3B ; ROM $001110: A5 3B sta $0700,y ; ROM $001112: 99 00 07 iny ; ROM $001115: C8 pla ; ROM $001116: 68 sta $0700,y ; ROM $001117: 99 00 07 iny ; ROM $00111A: C8 lda #$01 ; ROM $00111B: A9 01 sta $0700,y ; ROM $00111D: 99 00 07 iny ; ROM $001120: C8 lda $3A ; ROM $001121: A5 3A sta $0700,y ; ROM $001123: 99 00 07 iny ; ROM $001126: C8 clc ; ROM $001127: 18 adc #$08 ; ROM $001128: 69 08 sta $3A ; ROM $00112A: 85 3A ; Routine: Object_AdvanceIndexX_D11C ; Global: Reachable code entry at CPU $D11C traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_AdvanceIndexX_D11C: inx ; ROM $00112C: E8 iny ; ROM $00112D: C8 dey ; ROM $00112E: 88 bne Object_ReturnToCaller_D123 ; ROM $00112F: D0 02 ldy #$FC ; ROM $001131: A0 FC ; Routine: Object_ReturnToCaller_D123 ; Global: Reachable code entry at CPU $D123 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_ReturnToCaller_D123: rts ; ROM $001133: 60 ; Data region: CPU $D124-$D1C7; unreachable by direct recursive trace. ObjectMovementParameterTable: .byte $EC, $46, $00, $ED, $46, $00, $EE, $46, $00, $EF, $46, $00, $FC, $46, $00, $FD ; ROM $001134: EC 46 00 ED 46 00 EE 46 00 EF 46 00 FC 46 00 FD .byte $46, $00, $FE, $46, $00, $FF, $46, $00, $EC, $46, $46, $ED, $46, $46, $EE, $46 ; ROM $001144: 46 00 FE 46 00 FF 46 00 EC 46 46 ED 46 46 EE 46 .byte $46, $EF, $46, $46, $FC, $46, $46, $FD, $46, $46, $FE, $46, $46, $FF, $46, $46 ; ROM $001154: 46 EF 46 46 FC 46 46 FD 46 46 FE 46 46 FF 46 46 .byte $18, $19, $1A, $19, $1C, $1D, $1E, $1D, $20, $21, $22, $21, $24, $25, $26, $25 ; ROM $001164: 18 19 1A 19 1C 1D 1E 1D 20 21 22 21 24 25 26 25 .byte $28, $29, $2A, $29, $2C, $2D, $2E, $2D, $30, $31, $32, $31, $34, $35, $36, $35 ; ROM $001174: 28 29 2A 29 2C 2D 2E 2D 30 31 32 31 34 35 36 35 .byte $1B, $1F, $23, $27, $2B, $2F, $33, $37, $14, $15, $16, $17, $38, $39, $3A, $3B ; ROM $001184: 1B 1F 23 27 2B 2F 33 37 14 15 16 17 38 39 3A 3B .byte $3C, $3D, $01, $01, $01, $01, $03, $03, $03, $03, $02, $02, $02, $02, $01, $01 ; ROM $001194: 3C 3D 01 01 01 01 03 03 03 03 02 02 02 02 01 01 .byte $01, $01, $03, $03, $03, $03, $02, $02, $02, $02, $01, $01, $01, $01, $01, $02 ; ROM $0011A4: 01 01 03 03 03 03 02 02 02 02 01 01 01 01 01 02 .byte $01, $02, $01, $03, $02, $01, $03, $02, $01, $01, $01, $01, $01, $01, $01, $00 ; ROM $0011B4: 01 02 01 03 02 01 03 02 01 01 01 01 01 01 01 00 .byte $01, $02, $03, $01, $01, $02, $04, $08, $0A, $14, $28, $50, $64, $C8, $02, $04 ; ROM $0011C4: 01 02 03 01 01 02 04 08 0A 14 28 50 64 C8 02 04 .byte $05, $0A, $14, $28 ; ROM $0011D4: 05 0A 14 28 ; Routine: Object_WriteZp4D_D1C8 ; Global: Reachable code entry at CPU $D1C8 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Object_WriteZp4D_D1C8: stx $4D ; ROM $0011D8: 86 4D lda $0576,x ; ROM $0011DA: BD 76 05 sta $41 ; ROM $0011DD: 85 41 lda $0580,x ; ROM $0011DF: BD 80 05 sta $42 ; ROM $0011E2: 85 42 lda $058A,x ; ROM $0011E4: BD 8A 05 sta $43 ; ROM $0011E7: 85 43 lda $0594,x ; ROM $0011E9: BD 94 05 sta $44 ; ROM $0011EC: 85 44 lda $059E,x ; ROM $0011EE: BD 9E 05 sta $45 ; ROM $0011F1: 85 45 lda $05A8,x ; ROM $0011F3: BD A8 05 sta $46 ; ROM $0011F6: 85 46 lda $05B2,x ; ROM $0011F8: BD B2 05 sta $47 ; ROM $0011FB: 85 47 lda $05BC,x ; ROM $0011FD: BD BC 05 sta $48 ; ROM $001200: 85 48 lda $05C6,x ; ROM $001202: BD C6 05 sta $49 ; ROM $001205: 85 49 lda $05D0,x ; ROM $001207: BD D0 05 sta $4A ; ROM $00120A: 85 4A lda $05DA,x ; ROM $00120C: BD DA 05 sta $4B ; ROM $00120F: 85 4B lda $05E4,x ; ROM $001211: BD E4 05 sta $4C ; ROM $001214: 85 4C rts ; ROM $001216: 60 ; Data region: CPU $D207-$D5F1; unreachable by direct recursive trace. ObjectAndStageLookupTables: .byte $A6, $4D, $A5, $41, $9D, $76, $05, $A5, $42, $9D, $80, $05, $A5, $43, $9D, $8A ; ROM $001217: A6 4D A5 41 9D 76 05 A5 42 9D 80 05 A5 43 9D 8A .byte $05, $A5, $44, $9D, $94, $05, $A5, $45, $9D, $9E, $05, $A5, $46, $9D, $A8, $05 ; ROM $001227: 05 A5 44 9D 94 05 A5 45 9D 9E 05 A5 46 9D A8 05 .byte $A5, $47, $9D, $B2, $05, $A5, $48, $9D, $BC, $05, $A5, $49, $9D, $C6, $05, $A5 ; ROM $001237: A5 47 9D B2 05 A5 48 9D BC 05 A5 49 9D C6 05 A5 .byte $4A, $9D, $D0, $05, $A5, $4B, $9D, $DA, $05, $A5, $4C, $9D, $E4, $05, $60, $20 ; ROM $001247: 4A 9D D0 05 A5 4B 9D DA 05 A5 4C 9D E4 05 60 20 .byte $D3, $E7, $D2, $C8, $D2, $05, $D3, $B4, $D2, $19, $D3, $A0, $D3, $8A, $D3, $A2 ; ROM $001257: D3 E7 D2 C8 D2 05 D3 B4 D2 19 D3 A0 D3 8A D3 A2 .byte $D2, $64, $D2, $5B, $D2, $C6, $49, $D0, $42, $A9, $00, $85, $41, $60, $C6, $49 ; ROM $001267: D2 64 D2 5B D2 C6 49 D0 42 A9 00 85 41 60 C6 49 .byte $D0, $39, $A9, $0A, $85, $49, $E6, $46, $A5, $46, $C9, $2C, $D0, $2D, $A5, $4B ; ROM $001277: D0 39 A9 0A 85 49 E6 46 A5 46 C9 2C D0 2D A5 4B .byte $18, $65, $4A, $A8, $C0, $0B, $90, $15, $C0, $10, $90, $02, $A0, $10, $B9, $B7 ; ROM $001287: 18 65 4A A8 C0 0B 90 15 C0 10 90 02 A0 10 B9 B7 .byte $D1, $AA, $A9, $C8, $20, $83, $DD, $CA, $D0, $F8, $4C, $9A, $D2, $B9, $B7, $D1 ; ROM $001297: D1 AA A9 C8 20 83 DD CA D0 F8 4C 9A D2 B9 B7 D1 .byte $20, $83, $DD, $A9, $0B, $85, $41, $A9, $64, $85, $49, $60, $C6, $49, $D0, $0C ; ROM $0012A7: 20 83 DD A9 0B 85 41 A9 64 85 49 60 C6 49 D0 0C .byte $A9, $0A, $85, $41, $A9, $28, $85, $46, $A9, $14, $85, $49, $60, $60, $A9, $10 ; ROM $0012B7: A9 0A 85 41 A9 28 85 46 A9 14 85 49 60 60 A9 10 .byte $A0, $13, $20, $DA, $D5, $20, $7E, $D3, $A5, $33, $29, $03, $D0, $EF, $4C, $10 ; ROM $0012C7: A0 13 20 DA D5 20 7E D3 A5 33 29 03 D0 EF 4C 10 .byte $D3, $60, $A9, $08, $A0, $0B, $20, $DA, $D5, $20, $7E, $D3, $A5, $33, $29, $03 ; ROM $0012D7: D3 60 A9 08 A0 0B 20 DA D5 20 7E D3 A5 33 29 03 .byte $F0, $EF, $C6, $4C, $A5, $4C, $C9, $96, $B0, $03, $20, $26, $D4, $4C, $3F, $D3 ; ROM $0012E7: F0 EF C6 4C A5 4C C9 96 B0 03 20 26 D4 4C 3F D3 .byte $60, $A9, $04, $A0, $07, $20, $DA, $D5, $20, $7E, $D3, $A5, $33, $29, $03, $F0 ; ROM $0012F7: 60 A9 04 A0 07 20 DA D5 20 7E D3 A5 33 29 03 F0 .byte $EF, $C6, $4C, $A5, $4C, $C9, $96, $B0, $03, $20, $3D, $D4, $4C, $3F, $D3, $A9 ; ROM $001307: EF C6 4C A5 4C C9 96 B0 03 20 3D D4 4C 3F D3 A9 .byte $0C, $A0, $0F, $20, $DA, $D5, $20, $7E, $D3, $C6, $4C, $A5, $4C, $C9, $C8, $4C ; ROM $001317: 0C A0 0F 20 DA D5 20 7E D3 C6 4C A5 4C C9 C8 4C .byte $37, $D3, $60, $A9, $14, $A0, $17, $4C, $25, $D3, $A9, $00, $A0, $03, $20, $DA ; ROM $001327: 37 D3 60 A9 14 A0 17 4C 25 D3 A9 00 A0 03 20 DA .byte $D5, $20, $7E, $D3, $A5, $33, $29, $01, $F0, $E8, $C6, $4C, $A5, $4C, $C9, $14 ; ROM $001337: D5 20 7E D3 A5 33 29 01 F0 E8 C6 4C A5 4C C9 14 .byte $B0, $06, $20, $3D, $D4, $20, $26, $D4, $A5, $49, $F0, $22, $C6, $49, $A5, $4A ; ROM $001347: B0 06 20 3D D4 20 26 D4 A5 49 F0 22 C6 49 A5 4A .byte $20, $DE, $D4, $F0, $18, $C9, $03, $90, $10, $A4, $4A, $B9, $12, $D4, $85, $4A ; ROM $001357: 20 DE D4 F0 18 C9 03 90 10 A4 4A B9 12 D4 85 4A .byte $A9, $00, $85, $4C, $A9, $60, $85, $49, $60, $A9, $00, $85, $49, $60, $20, $70 ; ROM $001367: A9 00 85 4C A9 60 85 49 60 A9 00 85 49 60 20 70 .byte $D6, $48, $29, $18, $0A, $0A, $18, $69, $20, $85, $49, $68, $2A, $2A, $2A, $29 ; ROM $001377: D6 48 29 18 0A 0A 18 69 20 85 49 68 2A 2A 2A 29 .byte $03, $18, $69, $01, $85, $4A, $60, $A0, $00, $A5, $4A, $C9, $03, $90, $02, $A0 ; ROM $001387: 03 18 69 01 85 4A 60 A0 00 A5 4A C9 03 90 02 A0 .byte $40, $84, $48, $60, $A9, $1C, $A0, $1F, $20, $DA, $D5, $A0, $00, $A5, $46, $C9 ; ROM $001397: 40 84 48 60 A9 1C A0 1F 20 DA D5 A0 00 A5 46 C9 .byte $1D, $D0, $02, $A0, $40, $84, $48, $4C, $AB, $D3, $A9, $18, $A0, $1B, $20, $DA ; ROM $0013A7: 1D D0 02 A0 40 84 48 4C AB D3 A9 18 A0 1B 20 DA .byte $D5, $20, $7E, $D3, $A5, $4C, $F0, $05, $C6, $4C, $D0, $07, $60, $20, $3D, $D4 ; ROM $0013B7: D5 20 7E D3 A5 4C F0 05 C6 4C D0 07 60 20 3D D4 .byte $20, $26, $D4, $A5, $4A, $0A, $05, $4B, $A8, $B9, $17, $D4, $85, $53, $A8, $B9 ; ROM $0013C7: 20 26 D4 A5 4A 0A 05 4B A8 B9 17 D4 85 53 A8 B9 .byte $21, $D4, $85, $52, $20, $54, $D4, $25, $52, $F0, $0E, $A5, $53, $85, $4A, $A9 ; ROM $0013D7: 21 D4 85 52 20 54 D4 25 52 F0 0E A5 53 85 4A A9 .byte $01, $45, $4B, $85, $4B, $A9, $00, $85, $49, $E6, $49, $A5, $49, $C9, $1F, $90 ; ROM $0013E7: 01 45 4B 85 4B A9 00 85 49 E6 49 A5 49 C9 1F 90 .byte $06, $A9, $01, $45, $4B, $85, $4B, $A5, $4A, $20, $DE, $D4, $F0, $10, $C9, $03 ; ROM $0013F7: 06 A9 01 45 4B 85 4B A5 4A 20 DE D4 F0 10 C9 03 .byte $B0, $0D, $E6, $4A, $A5, $4A, $C9, $05, $D0, $04, $A9, $01, $85, $4A, $60, $A9 ; ROM $001407: B0 0D E6 4A A5 4A C9 05 D0 04 A9 01 85 4A 60 A9 .byte $60, $85, $4C, $A4, $4A, $B9, $12, $D4, $85, $4A, $60, $00, $03, $04, $01, $02 ; ROM $001417: 60 85 4C A4 4A B9 12 D4 85 4A 60 00 03 04 01 02 .byte $01, $04, $04, $02, $01, $03, $02, $04, $03, $01, $00, $01, $02, $04, $08, $A5 ; ROM $001427: 01 04 04 02 01 03 02 04 03 01 00 01 02 04 08 A5 .byte $5C, $D0, $12, $A5, $44, $C5, $2A, $D0, $0C, $A5, $42, $C5, $28, $A9, $01, $90 ; ROM $001437: 5C D0 12 A5 44 C5 2A D0 0C A5 42 C5 28 A9 01 90 .byte $02, $A9, $03, $85, $4A, $60, $A5, $5C, $D0, $FB, $A5, $42, $C5, $28, $D0, $0C ; ROM $001447: 02 A9 03 85 4A 60 A5 5C D0 FB A5 42 C5 28 D0 0C .byte $A5, $44, $C5, $2A, $A9, $04, $90, $02, $A9, $02, $85, $4A, $60, $A9, $00, $85 ; ROM $001457: A5 44 C5 2A A9 04 90 02 A9 02 85 4A 60 A9 00 85 .byte $51, $A5, $43, $C9, $08, $D0, $04, $A5, $45, $C9, $08, $D0, $59, $A4, $44, $B9 ; ROM $001467: 51 A5 43 C9 08 D0 04 A5 45 C9 08 D0 59 A4 44 B9 .byte $A3, $E2, $85, $34, $B9, $B0, $E2, $85, $35, $A4, $42, $C8, $20, $C0, $D4, $D0 ; ROM $001477: A3 E2 85 34 B9 B0 E2 85 35 A4 42 C8 20 C0 D4 D0 .byte $04, $A9, $01, $85, $51, $88, $88, $20, $C0, $D4, $D0, $06, $A9, $04, $05, $51 ; ROM $001487: 04 A9 01 85 51 88 88 20 C0 D4 D0 06 A9 04 05 51 .byte $85, $51, $A4, $44, $88, $B9, $A3, $E2, $85, $34, $B9, $B0, $E2, $85, $35, $A4 ; ROM $001497: 85 51 A4 44 88 B9 A3 E2 85 34 B9 B0 E2 85 35 A4 .byte $42, $20, $C0, $D4, $D0, $06, $A9, $02, $05, $51, $85, $51, $A4, $44, $C8, $B9 ; ROM $0014A7: 42 20 C0 D4 D0 06 A9 02 05 51 85 51 A4 44 C8 B9 .byte $A3, $E2, $85, $34, $B9, $B0, $E2, $85, $35, $A4, $42, $20, $C0, $D4, $D0, $06 ; ROM $0014B7: A3 E2 85 34 B9 B0 E2 85 35 A4 42 20 C0 D4 D0 06 .byte $A9, $08, $05, $51, $85, $51, $A5, $51, $60, $B1, $34, $F0, $FB, $C9, $08, $F0 ; ROM $0014C7: A9 08 05 51 85 51 A5 51 60 B1 34 F0 FB C9 08 F0 .byte $F7, $C9, $06, $F0, $F3, $C9, $02, $F0, $01, $60, $A5, $41, $C9, $05, $F0, $E8 ; ROM $0014D7: F7 C9 06 F0 F3 C9 02 F0 01 60 A5 41 C9 05 F0 E8 .byte $C9, $06, $F0, $E4, $C9, $08, $60, $A2, $00, $86, $4E, $AA, $C9, $01, $D0, $03 ; ROM $0014E7: C9 06 F0 E4 C9 08 60 A2 00 86 4E AA C9 01 D0 03 .byte $20, $8D, $D5, $8A, $C9, $03, $D0, $03, $20, $62, $D5, $8A, $C9, $02, $D0, $03 ; ROM $0014F7: 20 8D D5 8A C9 03 D0 03 20 62 D5 8A C9 02 D0 03 .byte $20, $37, $D5, $8A, $C9, $04, $D0, $03, $20, $05, $D5, $A5, $4E, $60, $A5, $45 ; ROM $001507: 20 37 D5 8A C9 04 D0 03 20 05 D5 A5 4E 60 A5 45 .byte $C9, $08, $B0, $03, $E6, $45, $60, $A4, $44, $C8, $B9, $A3, $E2, $85, $34, $B9 ; ROM $001517: C9 08 B0 03 E6 45 60 A4 44 C8 B9 A3 E2 85 34 B9 .byte $B0, $E2, $85, $35, $A4, $42, $20, $C0, $D4, $D0, $12, $20, $BC, $D5, $E6, $45 ; ROM $001527: B0 E2 85 35 A4 42 20 C0 D4 D0 12 20 BC D5 E6 45 .byte $A5, $45, $C9, $10, $D0, $06, $A9, $00, $85, $45, $E6, $44, $60, $85, $4E, $60 ; ROM $001537: A5 45 C9 10 D0 06 A9 00 85 45 E6 44 60 85 4E 60 .byte $A5, $45, $C9, $09, $90, $03, $C6, $45, $60, $A4, $44, $88, $B9, $A3, $E2, $85 ; ROM $001547: A5 45 C9 09 90 03 C6 45 60 A4 44 88 B9 A3 E2 85 .byte $34, $B9, $B0, $E2, $85, $35, $A4, $42, $20, $C0, $D4, $D0, $E0, $20, $BC, $D5 ; ROM $001557: 34 B9 B0 E2 85 35 A4 42 20 C0 D4 D0 E0 20 BC D5 .byte $C6, $45, $10, $06, $A9, $0F, $85, $45, $C6, $44, $60, $A5, $43, $C9, $09, $90 ; ROM $001567: C6 45 10 06 A9 0F 85 45 C6 44 60 A5 43 C9 09 90 .byte $03, $C6, $43, $60, $A4, $44, $B9, $A3, $E2, $85, $34, $B9, $B0, $E2, $85, $35 ; ROM $001577: 03 C6 43 60 A4 44 B9 A3 E2 85 34 B9 B0 E2 85 35 .byte $A4, $42, $88, $20, $C0, $D4, $D0, $B5, $20, $CB, $D5, $C6, $43, $10, $06, $A9 ; ROM $001587: A4 42 88 20 C0 D4 D0 B5 20 CB D5 C6 43 10 06 A9 .byte $0F, $85, $43, $C6, $42, $60, $A5, $43, $C9, $08, $B0, $03, $E6, $43, $60, $A4 ; ROM $001597: 0F 85 43 C6 42 60 A5 43 C9 08 B0 03 E6 43 60 A4 .byte $44, $B9, $A3, $E2, $85, $34, $B9, $B0, $E2, $85, $35, $A4, $42, $C8, $20, $C0 ; ROM $0015A7: 44 B9 A3 E2 85 34 B9 B0 E2 85 35 A4 42 C8 20 C0 .byte $D4, $D0, $8A, $20, $CB, $D5, $E6, $43, $A5, $43, $C9, $10, $D0, $06, $A9, $00 ; ROM $0015B7: D4 D0 8A 20 CB D5 E6 43 A5 43 C9 10 D0 06 A9 00 .byte $85, $43, $E6, $42, $60, $A5, $43, $C9, $08, $90, $05, $F0, $06, $C6, $43, $60 ; ROM $0015C7: 85 43 E6 42 60 A5 43 C9 08 90 05 F0 06 C6 43 60 .byte $E6, $43, $60, $60, $A5, $45, $C9, $08, $90, $05, $F0, $06, $C6, $45, $60, $E6 ; ROM $0015D7: E6 43 60 60 A5 45 C9 08 90 05 F0 06 C6 45 60 E6 .byte $45, $60, $60, $48, $A5, $33, $29, $07, $D0, $0F, $68, $E6, $46, $C5, $46, $90 ; ROM $0015E7: 45 60 60 48 A5 33 29 07 D0 0F 68 E6 46 C5 46 90 .byte $03, $85, $46, $60, $C4, $46, $90, $F9, $60, $68, $60 ; ROM $0015F7: 03 85 46 60 C4 46 90 F9 60 68 60 ; Routine: Stage_WriteZp3F_D5F2 ; Global: Reachable code entry at CPU $D5F2 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Stage_WriteZp3F_D5F2: stx $3F ; ROM $001602: 86 3F sty $40 ; ROM $001604: 84 40 asl a ; ROM $001606: 0A pha ; ROM $001607: 48 and #$0E ; ROM $001608: 29 0E sta $3E ; ROM $00160A: 85 3E pla ; ROM $00160C: 68 asl a ; ROM $00160D: 0A and #$E0 ; ROM $00160E: 29 E0 ora $3E ; ROM $001610: 05 3E sta $3E ; ROM $001612: 85 3E lda $39 ; ROM $001614: A5 39 inc $39 ; ROM $001616: E6 39 clc ; ROM $001618: 18 adc $DB ; ROM $001619: 65 DB cmp #$0C ; ROM $00161B: C9 0C bcc Stage_ReadZp3D_D611 ; ROM $00161D: 90 02 sbc #$0A ; ROM $00161F: E9 0A ; Routine: Stage_ReadZp3D_D611 ; Global: Reachable code entry at CPU $D611 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Stage_ReadZp3D_D611: asl a ; ROM $001621: 0A asl a ; ROM $001622: 0A asl a ; ROM $001623: 0A asl a ; ROM $001624: 0A tay ; ROM $001625: A8 lda $3D ; ROM $001626: A5 3D bne Stage_IncrementZp3E_D622 ; ROM $001628: D0 08 jsr Stage_ReadPositionHi_D631 ; ROM $00162A: 20 31 D6 inc $3E ; ROM $00162D: E6 3E jmp Stage_ReadZp3F_D629 ; ROM $00162F: 4C 29 D6 ; Routine: Stage_IncrementZp3E_D622 ; Global: Reachable code entry at CPU $D622 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Stage_IncrementZp3E_D622: inc $3E ; ROM $001632: E6 3E jsr Stage_ReadPositionHi_D631 ; ROM $001634: 20 31 D6 dec $3E ; ROM $001637: C6 3E ; Routine: Stage_ReadZp3F_D629 ; Global: Reachable code entry at CPU $D629 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Stage_ReadZp3F_D629: jsr Stage_ReadPositionHi_D631 ; ROM $001639: 20 31 D6 ldx $3F ; ROM $00163C: A6 3F ldy $40 ; ROM $00163E: A4 40 rts ; ROM $001640: 60 ; Routine: Stage_ReadPositionHi_D631 ; Global: Reachable code entry at CPU $D631 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Stage_ReadPositionHi_D631: lda $3B ; ROM $001641: A5 3B sta $0700,y ; ROM $001643: 99 00 07 lda $3E ; ROM $001646: A5 3E pha ; ROM $001648: 48 sta $0701,y ; ROM $001649: 99 01 07 lda $3C ; ROM $00164C: A5 3C ora $3D ; ROM $00164E: 05 3D sta $0702,y ; ROM $001650: 99 02 07 lda $3A ; ROM $001653: A5 3A sta $0703,y ; ROM $001655: 99 03 07 lda $3B ; ROM $001658: A5 3B clc ; ROM $00165A: 18 adc #$08 ; ROM $00165B: 69 08 sta $0704,y ; ROM $00165D: 99 04 07 pla ; ROM $001660: 68 clc ; ROM $001661: 18 adc #$10 ; ROM $001662: 69 10 sta $0705,y ; ROM $001664: 99 05 07 lda $3C ; ROM $001667: A5 3C ora $3D ; ROM $001669: 05 3D sta $0706,y ; ROM $00166B: 99 06 07 lda $3A ; ROM $00166E: A5 3A sta $0707,y ; ROM $001670: 99 07 07 tya ; ROM $001673: 98 clc ; ROM $001674: 18 adc #$08 ; ROM $001675: 69 08 tay ; ROM $001677: A8 lda $3A ; ROM $001678: A5 3A clc ; ROM $00167A: 18 adc #$08 ; ROM $00167B: 69 08 sta $3A ; ROM $00167D: 85 3A rts ; ROM $00167F: 60 ; Routine: AdvanceRandomState ; Global: Reachable code entry at CPU $D670 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. AdvanceRandomState: lda RandomState0 ; ROM $001680: A5 54 rol a ; ROM $001682: 2A rol a ; ROM $001683: 2A eor #$41 ; ROM $001684: 49 41 rol a ; ROM $001686: 2A rol a ; ROM $001687: 2A eor #$93 ; ROM $001688: 49 93 adc RandomState1 ; ROM $00168A: 65 55 sta RandomState0 ; ROM $00168C: 85 54 rol a ; ROM $00168E: 2A rol a ; ROM $00168F: 2A eor #$12 ; ROM $001690: 49 12 rol a ; ROM $001692: 2A rol a ; ROM $001693: 2A adc RandomState2 ; ROM $001694: 65 56 sta RandomState1 ; ROM $001696: 85 55 adc RandomState0 ; ROM $001698: 65 54 inc RandomState2 ; ROM $00169A: E6 56 bne Stage_ToggleRandomState3_D697 ; ROM $00169C: D0 09 pha ; ROM $00169E: 48 lda RandomState3 ; ROM $00169F: A5 57 clc ; ROM $0016A1: 18 adc #$1D ; ROM $0016A2: 69 1D sta RandomState3 ; ROM $0016A4: 85 57 pla ; ROM $0016A6: 68 ; Routine: Stage_ToggleRandomState3_D697 ; Global: Reachable code entry at CPU $D697 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Stage_ToggleRandomState3_D697: eor $57 ; ROM $0016A7: 45 57 rts ; ROM $0016A9: 60 ; Routine: Stage_ReadZp58_D69A ; Global: Reachable code entry at CPU $D69A traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Stage_ReadZp58_D69A: lda $58 ; ROM $0016AA: A5 58 cmp #$1A ; ROM $0016AC: C9 1A bcc Stage_HandleControl_D6A8 ; ROM $0016AE: 90 08 sbc #$19 ; ROM $0016B0: E9 19 ldx #$02 ; ROM $0016B2: A2 02 ldy #$D8 ; ROM $0016B4: A0 D8 bne Stage_WriteZp97_D6AC ; ROM $0016B6: D0 04 ; Routine: Stage_HandleControl_D6A8 ; Global: Reachable code entry at CPU $D6A8 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Stage_HandleControl_D6A8: ldx #$08 ; ROM $0016B8: A2 08 ldy #$D7 ; ROM $0016BA: A0 D7 ; Routine: Stage_WriteZp97_D6AC ; Global: Reachable code entry at CPU $D6AC traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Stage_WriteZp97_D6AC: stx $97 ; ROM $0016BC: 86 97 sty $98 ; ROM $0016BE: 84 98 sec ; ROM $0016C0: 38 sbc #$01 ; ROM $0016C1: E9 01 asl a ; ROM $0016C3: 0A sta $24 ; ROM $0016C4: 85 24 asl a ; ROM $0016C6: 0A asl a ; ROM $0016C7: 0A clc ; ROM $0016C8: 18 adc $24 ; ROM $0016C9: 65 24 tay ; ROM $0016CB: A8 ldx #$09 ; ROM $0016CC: A2 09 ; Routine: Stage_ReadZp97_D6BE ; Global: Reachable code entry at CPU $D6BE traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Stage_ReadZp97_D6BE: lda ($97),y ; ROM $0016CE: B1 97 sta $0576,x ; ROM $0016D0: 9D 76 05 beq Stage_AdvanceIndexY_D703 ; ROM $0016D3: F0 3E sec ; ROM $0016D5: 38 sbc #$01 ; ROM $0016D6: E9 01 asl a ; ROM $0016D8: 0A asl a ; ROM $0016D9: 0A sta $05A8,x ; ROM $0016DA: 9D A8 05 lda #$08 ; ROM $0016DD: A9 08 sta $058A,x ; ROM $0016DF: 9D 8A 05 sta $059E,x ; ROM $0016E2: 9D 9E 05 jsr AdvanceRandomState ; ROM $0016E5: 20 70 D6 and #$03 ; ROM $0016E8: 29 03 clc ; ROM $0016EA: 18 adc #$01 ; ROM $0016EB: 69 01 sta $05D0,x ; ROM $0016ED: 9D D0 05 sty $5A ; ROM $0016F0: 84 5A ; Routine: Stage_ReadObjectWorkX_D6E2 ; Global: Reachable code entry at CPU $D6E2 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Stage_ReadObjectWorkX_D6E2: jsr Gameplay_WriteObjectWorkX_CACF ; ROM $0016F2: 20 CF CA lda $24 ; ROM $0016F5: A5 24 cmp #$05 ; ROM $0016F7: C9 05 bcc Stage_ReadObjectWorkX_D6E2 ; ROM $0016F9: 90 F7 sta $0580,x ; ROM $0016FB: 9D 80 05 lda $25 ; ROM $0016FE: A5 25 sta $0594,x ; ROM $001700: 9D 94 05 lda #$00 ; ROM $001703: A9 00 sta $05B2,x ; ROM $001705: 9D B2 05 sta $05DA,x ; ROM $001708: 9D DA 05 sta $05C6,x ; ROM $00170B: 9D C6 05 sta $05E4,x ; ROM $00170E: 9D E4 05 ldy $5A ; ROM $001711: A4 5A ; Routine: Stage_AdvanceIndexY_D703 ; Global: Reachable code entry at CPU $D703 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Stage_AdvanceIndexY_D703: iny ; ROM $001713: C8 dex ; ROM $001714: CA bpl Stage_ReadZp97_D6BE ; ROM $001715: 10 B7 rts ; ROM $001717: 60 ; Data region: CPU $D708-$D8FB; unreachable by direct recursive trace. GameplayParameterTables: .byte $01, $01, $01, $01, $01, $01, $00, $00, $00, $00, $01, $01, $01, $02, $02, $02 ; ROM $001718: 01 01 01 01 01 01 00 00 00 00 01 01 01 02 02 02 .byte $00, $00, $00, $00, $01, $01, $02, $02, $03, $03, $00, $00, $00, $00, $01, $02 ; ROM $001728: 00 00 00 00 01 01 02 02 03 03 00 00 00 00 01 02 .byte $03, $03, $04, $04, $00, $00, $00, $00, $02, $02, $02, $02, $03, $03, $03, $00 ; ROM $001738: 03 03 04 04 00 00 00 00 02 02 02 02 03 03 03 00 .byte $00, $00, $02, $02, $03, $03, $03, $04, $04, $00, $00, $00, $02, $02, $03, $03 ; ROM $001748: 00 00 02 02 03 03 03 04 04 00 00 00 02 02 03 03 .byte $03, $05, $05, $00, $00, $00, $02, $03, $03, $04, $04, $04, $04, $00, $00, $00 ; ROM $001758: 03 05 05 00 00 00 02 03 03 04 04 04 04 00 00 00 .byte $02, $03, $04, $04, $04, $04, $06, $00, $00, $00, $02, $03, $04, $05, $06, $06 ; ROM $001768: 02 03 04 04 04 04 06 00 00 00 02 03 04 05 06 06 .byte $06, $00, $00, $00, $02, $03, $03, $04, $04, $04, $05, $06, $00, $00, $02, $03 ; ROM $001778: 06 00 00 00 02 03 03 04 04 04 05 06 00 00 02 03 .byte $04, $05, $06, $06, $06, $06, $00, $00, $03, $03, $03, $04, $04, $04, $06, $06 ; ROM $001788: 04 05 06 06 06 06 00 00 03 03 03 04 04 04 06 06 .byte $00, $00, $05, $05, $05, $05, $05, $05, $05, $07, $00, $00, $03, $04, $04, $04 ; ROM $001798: 00 00 05 05 05 05 05 05 05 07 00 00 03 04 04 04 .byte $06, $06, $06, $07, $00, $00, $04, $04, $04, $06, $06, $06, $06, $07, $00, $00 ; ROM $0017A8: 06 06 06 07 00 00 04 04 04 06 06 06 06 07 00 00 .byte $03, $03, $03, $03, $03, $06, $06, $07, $00, $00, $01, $01, $01, $02, $02, $02 ; ROM $0017B8: 03 03 03 03 03 06 06 07 00 00 01 01 01 02 02 02 .byte $07, $07, $00, $00, $01, $02, $03, $03, $03, $05, $07, $07, $00, $00, $02, $03 ; ROM $0017C8: 07 07 00 00 01 02 03 03 03 05 07 07 00 00 02 03 .byte $04, $05, $06, $06, $07, $07, $00, $00, $05, $05, $05, $06, $06, $06, $06, $07 ; ROM $0017D8: 04 05 06 06 07 07 00 00 05 05 05 06 06 06 06 07 .byte $07, $00, $03, $03, $03, $03, $04, $04, $04, $06, $07, $00, $03, $03, $04, $04 ; ROM $0017E8: 07 00 03 03 03 03 04 04 04 06 07 00 03 03 04 04 .byte $05, $05, $06, $06, $07, $00, $03, $04, $05, $06, $06, $05, $06, $06, $07, $00 ; ROM $0017F8: 05 05 06 06 07 00 03 04 05 06 06 05 06 06 07 00 .byte $02, $02, $03, $04, $05, $05, $06, $06, $07, $00, $01, $02, $03, $04, $05, $05 ; ROM $001808: 02 02 03 04 05 05 06 06 07 00 01 02 03 04 05 05 .byte $06, $06, $07, $00, $01, $02, $06, $06, $06, $05, $06, $06, $07, $00, $02, $03 ; ROM $001818: 06 06 07 00 01 02 06 06 06 05 06 06 07 00 02 03 .byte $03, $03, $04, $04, $04, $06, $07, $00, $05, $05, $05, $05, $05, $06, $07, $06 ; ROM $001828: 03 03 04 04 04 06 07 00 05 05 05 05 05 06 07 06 .byte $07, $00, $03, $03, $03, $04, $04, $05, $05, $06, $07, $00, $02, $02, $03, $03 ; ROM $001838: 07 00 03 03 03 04 04 05 05 06 07 00 02 02 03 03 .byte $04, $04, $05, $05, $06, $06, $02, $03, $04, $04, $04, $06, $06, $06, $06, $07 ; ROM $001848: 04 04 05 05 06 06 02 03 04 04 04 06 06 06 06 07 .byte $03, $03, $04, $04, $05, $06, $06, $07, $06, $07, $03, $03, $04, $04, $04, $06 ; ROM $001858: 03 03 04 04 05 06 06 07 06 07 03 03 04 04 04 06 .byte $06, $07, $06, $07, $03, $03, $04, $05, $00, $06, $06, $07, $06, $07, $03, $03 ; ROM $001868: 06 07 06 07 03 03 04 05 00 06 06 07 06 07 03 03 .byte $04, $04, $06, $06, $07, $06, $07, $07, $03, $03, $04, $05, $06, $06, $07, $06 ; ROM $001878: 04 04 06 06 07 06 07 07 03 03 04 05 06 06 07 06 .byte $07, $07, $03, $03, $04, $04, $06, $06, $07, $06, $07, $07, $03, $04, $05, $05 ; ROM $001888: 07 07 03 03 04 04 06 06 07 06 07 07 03 04 05 05 .byte $06, $07, $06, $07, $07, $07, $03, $04, $04, $06, $06, $07, $06, $07, $07, $07 ; ROM $001898: 06 07 06 07 07 07 03 04 04 06 06 07 06 07 07 07 .byte $03, $04, $05, $06, $06, $06, $07, $07, $07, $07, $04, $05, $06, $06, $07, $06 ; ROM $0018A8: 03 04 05 06 06 06 07 07 07 07 04 05 06 06 07 06 .byte $07, $07, $07, $07, $04, $05, $06, $07, $06, $07, $07, $07, $07, $07, $04, $05 ; ROM $0018B8: 07 07 07 07 04 05 06 07 06 07 07 07 07 07 04 05 .byte $06, $07, $06, $07, $07, $07, $07, $07, $05, $06, $05, $06, $07, $07, $07, $07 ; ROM $0018C8: 06 07 06 07 07 07 07 07 05 06 05 06 07 07 07 07 .byte $07, $07, $05, $06, $05, $06, $07, $07, $07, $07, $07, $07, $06, $05, $05, $06 ; ROM $0018D8: 07 07 05 06 05 06 07 07 07 07 07 07 06 05 05 06 .byte $07, $07, $07, $07, $07, $07, $06, $05, $06, $07, $07, $07, $07, $07, $07, $08 ; ROM $0018E8: 07 07 07 07 07 07 06 05 06 07 07 07 07 07 07 08 .byte $05, $05, $06, $07, $07, $07, $07, $07, $07, $08, $05, $05, $06, $07, $07, $07 ; ROM $0018F8: 05 05 06 07 07 07 07 07 07 08 05 05 06 07 07 07 .byte $07, $07, $08, $08 ; ROM $001908: 07 07 08 08 ; Routine: Stage_WriteObjectWorkX_D8FC ; Global: Reachable code entry at CPU $D8FC traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Stage_WriteObjectWorkX_D8FC: stx $24 ; ROM $00190C: 86 24 sty $25 ; ROM $00190E: 84 25 pha ; ROM $001910: 48 ; Routine: Stage_ReadZp14_D901 ; Global: Reachable code entry at CPU $D901 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Stage_ReadZp14_D901: lda $14 ; ROM $001911: A5 14 sec ; ROM $001913: 38 sbc $15 ; ROM $001914: E5 15 cmp #$08 ; ROM $001916: C9 08 beq Stage_ReadZp14_D901 ; ROM $001918: F0 F7 pla ; ROM $00191A: 68 jsr Stage_WriteZp1A_D924 ; ROM $00191B: 20 24 D9 ldy $15 ; ROM $00191E: A4 15 ldx #$00 ; ROM $001920: A2 00 ; Routine: Stage_ReadZp17_D912 ; Global: Reachable code entry at CPU $D912 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Stage_ReadZp17_D912: lda $17,x ; ROM $001922: B5 17 sta $0600,y ; ROM $001924: 99 00 06 iny ; ROM $001927: C8 inx ; ROM $001928: E8 cpx #$08 ; ROM $001929: E0 08 bne Stage_ReadZp17_D912 ; ROM $00192B: D0 F5 sty $15 ; ROM $00192D: 84 15 ldx $24 ; ROM $00192F: A6 24 ldy $25 ; ROM $001931: A4 25 rts ; ROM $001933: 60 ; Routine: Stage_WriteZp1A_D924 ; Global: Reachable code entry at CPU $D924 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Stage_WriteZp1A_D924: tay ; ROM $001934: A8 asl a ; ROM $001935: 0A asl a ; ROM $001936: 0A sta $1A ; ROM $001937: 85 1A lda $D994,y ; ROM $001939: B9 94 D9 sta $1E ; ROM $00193C: 85 1E ldy #$00 ; ROM $00193E: A0 00 lda $1F ; ROM $001940: A5 1F cmp #$10 ; ROM $001942: C9 10 bcc Stage_WriteZp17_D93A ; ROM $001944: 90 04 ldy #$04 ; ROM $001946: A0 04 sbc #$10 ; ROM $001948: E9 10 ; Routine: Stage_WriteZp17_D93A ; Global: Reachable code entry at CPU $D93A traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Stage_WriteZp17_D93A: sty $17 ; ROM $00194A: 84 17 asl a ; ROM $00194C: 0A sta $21 ; ROM $00194D: 85 21 lda $20 ; ROM $00194F: A5 20 clc ; ROM $001951: 18 adc #$02 ; ROM $001952: 69 02 asl a ; ROM $001954: 0A sta $22 ; ROM $001955: 85 22 and #$FC ; ROM $001957: 29 FC asl a ; ROM $001959: 0A sta $1B ; ROM $00195A: 85 1B lda $21 ; ROM $00195C: A5 21 lsr a ; ROM $00195E: 4A lsr a ; ROM $00195F: 4A clc ; ROM $001960: 18 adc $1B ; ROM $001961: 65 1B clc ; ROM $001963: 18 adc #$C0 ; ROM $001964: 69 C0 sta $1B ; ROM $001966: 85 1B lda #$23 ; ROM $001968: A9 23 sta $1C ; ROM $00196A: 85 1C lda #$02 ; ROM $00196C: A9 02 and $22 ; ROM $00196E: 25 22 sta $23 ; ROM $001970: 85 23 lda $21 ; ROM $001972: A5 21 and #$03 ; ROM $001974: 29 03 lsr a ; ROM $001976: 4A clc ; ROM $001977: 18 adc $23 ; ROM $001978: 65 23 asl a ; ROM $00197A: 0A pha ; ROM $00197B: 48 lda #$FC ; ROM $00197C: A9 FC sta $1D ; ROM $00197E: 85 1D pla ; ROM $001980: 68 tax ; ROM $001981: AA beq Stage_WriteZp19_D97C ; ROM $001982: F0 08 ; Routine: Stage_ShiftLeftZp1E_D974 ; Global: Reachable code entry at CPU $D974 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Stage_ShiftLeftZp1E_D974: asl $1E ; ROM $001984: 06 1E sec ; ROM $001986: 38 rol $1D ; ROM $001987: 26 1D dex ; ROM $001989: CA bne Stage_ShiftLeftZp1E_D974 ; ROM $00198A: D0 F8 ; Routine: Stage_WriteZp19_D97C ; Global: Reachable code entry at CPU $D97C traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Stage_WriteZp19_D97C: lda #$01 ; ROM $00198C: A9 01 sta $19 ; ROM $00198E: 85 19 lda $22 ; ROM $001990: A5 22 ldx #$05 ; ROM $001992: A2 05 ; Routine: Stage_RotateLeftZp19_D984 ; Global: Reachable code entry at CPU $D984 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Stage_RotateLeftZp19_D984: asl a ; ROM $001994: 0A rol $19 ; ROM $001995: 26 19 dex ; ROM $001997: CA bne Stage_RotateLeftZp19_D984 ; ROM $001998: D0 FA clc ; ROM $00199A: 18 adc $21 ; ROM $00199B: 65 21 sta $18 ; ROM $00199D: 85 18 bcc Stage_ReturnToCaller_D993 ; ROM $00199F: 90 02 inc $19 ; ROM $0019A1: E6 19 ; Routine: Stage_ReturnToCaller_D993 ; Global: Reachable code entry at CPU $D993 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Stage_ReturnToCaller_D993: rts ; ROM $0019A3: 60 ; Data region: CPU $D994-$DA8D; unreachable by direct recursive trace. StageLayoutPointerData: .byte $00, $00, $00, $01, $01, $01, $01, $01, $00, $00, $00, $01, $01, $01, $01, $01 ; ROM $0019A4: 00 00 00 01 01 01 01 01 00 00 00 01 01 01 01 01 .byte $01, $01, $01, $01, $01, $01, $01, $01, $01, $01, $01, $01, $01, $01, $01, $01 ; ROM $0019B4: 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 .byte $01, $01, $01, $01, $01, $01, $01, $01, $03, $02, $02, $02, $02, $02, $02, $02 ; ROM $0019C4: 01 01 01 01 01 01 01 01 03 02 02 02 02 02 02 02 .byte $02, $03, $5F, $5F, $5F, $5F, $64, $65, $66, $67, $68, $69, $6A, $6B, $6C, $6D ; ROM $0019D4: 02 03 5F 5F 5F 5F 64 65 66 67 68 69 6A 6B 6C 6D .byte $6E, $6F, $70, $71, $72, $73, $74, $75, $76, $77, $78, $79, $7A, $7B, $7C, $7D ; ROM $0019E4: 6E 6F 70 71 72 73 74 75 76 77 78 79 7A 7B 7C 7D .byte $7E, $7F, $80, $81, $82, $83, $84, $85, $86, $87, $88, $89, $8A, $8B, $8C, $8D ; ROM $0019F4: 7E 7F 80 81 82 83 84 85 86 87 88 89 8A 8B 8C 8D .byte $8E, $8F, $90, $91, $92, $93, $94, $95, $96, $97, $98, $99, $9A, $9B, $20, $20 ; ROM $001A04: 8E 8F 90 91 92 93 94 95 96 97 98 99 9A 9B 20 20 .byte $21, $21, $22, $23, $22, $23, $24, $24, $25, $25, $26, $27, $26, $27, $28, $28 ; ROM $001A14: 21 21 22 23 22 23 24 24 25 25 26 27 26 27 28 28 .byte $29, $29, $2A, $2B, $2A, $2B, $2C, $2C, $2D, $2D, $2E, $2F, $2E, $2F, $20, $9D ; ROM $001A24: 29 29 2A 2B 2A 2B 2C 2C 2D 2D 2E 2F 2E 2F 20 9D .byte $21, $9F, $9C, $9D, $22, $23, $9C, $20, $9E, $21, $22, $23, $9E, $9F, $24, $A1 ; ROM $001A34: 21 9F 9C 9D 22 23 9C 20 9E 21 22 23 9E 9F 24 A1 .byte $25, $A3, $A0, $A1, $26, $27, $A0, $24, $A2, $25, $26, $27, $A2, $A3, $28, $A5 ; ROM $001A44: 25 A3 A0 A1 26 27 A0 24 A2 25 26 27 A2 A3 28 A5 .byte $29, $A7, $A4, $A5, $2A, $2B, $A4, $28, $A6, $29, $2A, $2B, $A6, $A7, $2C, $A9 ; ROM $001A54: 29 A7 A4 A5 2A 2B A4 28 A6 29 2A 2B A6 A7 2C A9 .byte $2D, $AB, $A8, $A9, $2E, $2F, $A8, $2C, $AA, $2D, $2E, $2F, $AA, $AB, $68, $69 ; ROM $001A64: 2D AB A8 A9 2E 2F A8 2C AA 2D 2E 2F AA AB 68 69 .byte $6A, $6B, $3C, $3D, $3E, $3F, $00, $01, $10, $11, $02, $03, $12, $13, $04, $05 ; ROM $001A74: 6A 6B 3C 3D 3E 3F 00 01 10 11 02 03 12 13 04 05 .byte $14, $15, $06, $07, $16, $17, $08, $09, $18, $19, $0A, $0B, $1A, $1B, $0C, $0D ; ROM $001A84: 14 15 06 07 16 17 08 09 18 19 0A 0B 1A 1B 0C 0D .byte $1C, $1D, $0E, $0F, $1E, $1F, $68, $69, $6A, $6B ; ROM $001A94: 1C 1D 0E 0F 1E 1F 68 69 6A 6B ; Routine: RunMenuSelectionScreen ; Global: Reachable code entry at CPU $DA8E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. RunMenuSelectionScreen: jsr DisableRendering ; ROM $001A9E: 20 57 C2 jsr Ppu_HandleControl_C2B9 ; ROM $001AA1: 20 B9 C2 jsr UploadMenuPalette ; ROM $001AA4: 20 27 DF lda #$00 ; ROM $001AA7: A9 00 sta $60 ; ROM $001AA9: 85 60 sta $72 ; ROM $001AAB: 85 72 sta $B5 ; ROM $001AAD: 85 B5 ldy #$9F ; ROM $001AAF: A0 9F lda #$20 ; ROM $001AB1: A9 20 ldx #$E7 ; ROM $001AB3: A2 E7 jsr Menu_CallHelper_DC41 ; ROM $001AB5: 20 41 DC jsr Ppu_CallHelper_C23B ; ROM $001AB8: 20 3B C2 lda #$06 ; ROM $001ABB: A9 06 sta $1F ; ROM $001ABD: 85 1F lda #$3A ; ROM $001ABF: A9 3A sta $20 ; ROM $001AC1: 85 20 ldy #$00 ; ROM $001AC3: A0 00 ; Routine: Menu_TransferVramDataPath_DAB5 ; Global: Reachable code entry at CPU $DAB5 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DAB5: jsr WaitForVBlankTransition ; ROM $001AC5: 20 8B C2 lda #$22 ; ROM $001AC8: A9 22 ldx $1F ; ROM $001ACA: A6 1F jsr SetPpuAddress ; ROM $001ACC: 20 96 C1 lda $20 ; ROM $001ACF: A5 20 sta PPUDATA ; ROM $001AD1: 8D 07 20 jsr CommitPpuStateAndScroll ; ROM $001AD4: 20 96 C2 ldx #$0A ; ROM $001AD7: A2 0A ; Routine: Menu_TransferVramDataPath_DAC9 ; Global: Reachable code entry at CPU $DAC9 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DAC9: jsr WaitForVBlankTransition ; ROM $001AD9: 20 8B C2 lda ControllerState1 ; ROM $001ADC: A5 12 and #$8F ; ROM $001ADE: 29 8F bne Menu_UpdateAudioChannelPath_DAF8 ; ROM $001AE0: D0 26 dex ; ROM $001AE2: CA bne Menu_TransferVramDataPath_DAC9 ; ROM $001AE3: D0 F4 jsr WaitForVBlankTransition ; ROM $001AE5: 20 8B C2 lda #$22 ; ROM $001AE8: A9 22 ldx $1F ; ROM $001AEA: A6 1F jsr SetPpuAddress ; ROM $001AEC: 20 96 C1 lda #$3B ; ROM $001AEF: A9 3B sta PPUDATA ; ROM $001AF1: 8D 07 20 jsr CommitPpuStateAndScroll ; ROM $001AF4: 20 96 C2 ldx #$0A ; ROM $001AF7: A2 0A ; Routine: Menu_CallHelper_DAE9 ; Global: Reachable code entry at CPU $DAE9 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_CallHelper_DAE9: jsr WaitForVBlankTransition ; ROM $001AF9: 20 8B C2 lda ControllerState1 ; ROM $001AFC: A5 12 and #$8F ; ROM $001AFE: 29 8F bne Menu_UpdateAudioChannelPath_DAF8 ; ROM $001B00: D0 06 dex ; ROM $001B02: CA bne Menu_CallHelper_DAE9 ; ROM $001B03: D0 F4 jmp Menu_TransferVramDataPath_DAB5 ; ROM $001B05: 4C B5 DA ; Routine: Menu_UpdateAudioChannelPath_DAF8 ; Global: Reachable code entry at CPU $DAF8 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_UpdateAudioChannelPath_DAF8: bmi Menu_TransferVramDataPath_DB43 ; ROM $001B08: 30 49 pha ; ROM $001B0A: 48 lda #$12 ; ROM $001B0B: A9 12 sta APUPULSE1TIMERHI ; ROM $001B0D: 8D 03 40 pla ; ROM $001B10: 68 cmp #$01 ; ROM $001B11: C9 01 beq Menu_ReadWorkValue_DB24 ; ROM $001B13: F0 1F lda $20 ; ROM $001B15: A5 20 cmp #$3A ; ROM $001B17: C9 3A bne Menu_ReadWorkValue_DB0F ; ROM $001B19: D0 04 lda #$51 ; ROM $001B1B: A9 51 sta $20 ; ROM $001B1D: 85 20 ; Routine: Menu_ReadWorkValue_DB0F ; Global: Reachable code entry at CPU $DB0F traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_ReadWorkValue_DB0F: lda $20 ; ROM $001B1F: A5 20 cmp #$41 ; ROM $001B21: C9 41 beq Menu_WriteWorkValue_DB1A ; ROM $001B23: F0 05 dec $20 ; ROM $001B25: C6 20 jmp Menu_CallHelper_DB1E ; ROM $001B27: 4C 1E DB ; Routine: Menu_WriteWorkValue_DB1A ; Global: Reachable code entry at CPU $DB1A traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_WriteWorkValue_DB1A: lda #$50 ; ROM $001B2A: A9 50 sta $20 ; ROM $001B2C: 85 20 ; Routine: Menu_CallHelper_DB1E ; Global: Reachable code entry at CPU $DB1E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_CallHelper_DB1E: jsr WaitForFrameBoundary ; ROM $001B2E: 20 07 C3 jmp Menu_TransferVramDataPath_DAB5 ; ROM $001B31: 4C B5 DA ; Routine: Menu_ReadWorkValue_DB24 ; Global: Reachable code entry at CPU $DB24 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_ReadWorkValue_DB24: lda $20 ; ROM $001B34: A5 20 cmp #$3A ; ROM $001B36: C9 3A bne Menu_ReadWorkValue_DB2E ; ROM $001B38: D0 04 lda #$40 ; ROM $001B3A: A9 40 sta $20 ; ROM $001B3C: 85 20 ; Routine: Menu_ReadWorkValue_DB2E ; Global: Reachable code entry at CPU $DB2E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_ReadWorkValue_DB2E: lda $20 ; ROM $001B3E: A5 20 cmp #$50 ; ROM $001B40: C9 50 beq Menu_WriteWorkValue_DB39 ; ROM $001B42: F0 05 inc $20 ; ROM $001B44: E6 20 jmp Menu_CallHelper_DB3D ; ROM $001B46: 4C 3D DB ; Routine: Menu_WriteWorkValue_DB39 ; Global: Reachable code entry at CPU $DB39 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_WriteWorkValue_DB39: lda #$41 ; ROM $001B49: A9 41 sta $20 ; ROM $001B4B: 85 20 ; Routine: Menu_CallHelper_DB3D ; Global: Reachable code entry at CPU $DB3D traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_CallHelper_DB3D: jsr WaitForFrameBoundary ; ROM $001B4D: 20 07 C3 ; Routine: Menu_Dispatch_DB40 ; Global: Reachable code entry at CPU $DB40 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_Dispatch_DB40: jmp Menu_TransferVramDataPath_DAB5 ; ROM $001B50: 4C B5 DA ; Routine: Menu_TransferVramDataPath_DB43 ; Global: Reachable code entry at CPU $DB43 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DB43: lda #$11 ; ROM $001B53: A9 11 sta APUPULSE1TIMERHI ; ROM $001B55: 8D 03 40 lda $20 ; ROM $001B58: A5 20 cmp #$3A ; ROM $001B5A: C9 3A beq Menu_Dispatch_DB40 ; ROM $001B5C: F0 F2 and #$0F ; ROM $001B5E: 29 0F tax ; ROM $001B60: AA lda $DFA0,x ; ROM $001B61: BD A0 DF sta $007F,y ; ROM $001B64: 99 7F 00 jsr WaitForVBlankTransition ; ROM $001B67: 20 8B C2 lda #$22 ; ROM $001B6A: A9 22 ldx $1F ; ROM $001B6C: A6 1F jsr SetPpuAddress ; ROM $001B6E: 20 96 C1 lda $20 ; ROM $001B71: A5 20 sta PPUDATA ; ROM $001B73: 8D 07 20 jsr CommitPpuStateAndScroll ; ROM $001B76: 20 96 C2 lda #$3A ; ROM $001B79: A9 3A sta $20 ; ROM $001B7B: 85 20 inc $1F ; ROM $001B7D: E6 1F iny ; ROM $001B7F: C8 cpy #$14 ; ROM $001B80: C0 14 beq Menu_HandleControl_DB7A ; ROM $001B82: F0 06 jsr WaitForFrameBoundary ; ROM $001B84: 20 07 C3 jmp Menu_TransferVramDataPath_DAB5 ; ROM $001B87: 4C B5 DA ; Routine: Menu_HandleControl_DB7A ; Global: Reachable code entry at CPU $DB7A traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_HandleControl_DB7A: ldx #$00 ; ROM $001B8A: A2 00 stx RandomState0 ; ROM $001B8C: 86 54 ; Routine: Menu_ReadZp7F_DB7E ; Global: Reachable code entry at CPU $DB7E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_ReadZp7F_DB7E: lda $7F,x ; ROM $001B8E: B5 7F pha ; ROM $001B90: 48 clc ; ROM $001B91: 18 adc #$07 ; ROM $001B92: 69 07 clc ; ROM $001B94: 18 adc RandomState0 ; ROM $001B95: 65 54 and #$0F ; ROM $001B97: 29 0F sta $7F,x ; ROM $001B99: 95 7F pla ; ROM $001B9B: 68 sta RandomState0 ; ROM $001B9C: 85 54 inx ; ROM $001B9E: E8 cpx #$14 ; ROM $001B9F: E0 14 bne Menu_ReadZp7F_DB7E ; ROM $001BA1: D0 EB ldx #$00 ; ROM $001BA3: A2 00 ; Routine: Menu_HandleControl_DB95 ; Global: Reachable code entry at CPU $DB95 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_HandleControl_DB95: ldy #$04 ; ROM $001BA5: A0 04 lda #$00 ; ROM $001BA7: A9 00 ; Routine: Menu_AddToZp7F_DB99 ; Global: Reachable code entry at CPU $DB99 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_AddToZp7F_DB99: clc ; ROM $001BA9: 18 adc $7F,x ; ROM $001BAA: 75 7F inx ; ROM $001BAC: E8 dey ; ROM $001BAD: 88 bne Menu_AddToZp7F_DB99 ; ROM $001BAE: D0 F9 and #$0F ; ROM $001BB0: 29 0F cmp $7F,x ; ROM $001BB2: D5 7F bne Menu_Dispatch_DBCC ; ROM $001BB4: D0 26 inx ; ROM $001BB6: E8 cpx #$0F ; ROM $001BB7: E0 0F bne Menu_HandleControl_DB95 ; ROM $001BB9: D0 EA lda $83 ; ROM $001BBB: A5 83 asl a ; ROM $001BBD: 0A sta $1F ; ROM $001BBE: 85 1F lda $88 ; ROM $001BC0: A5 88 asl a ; ROM $001BC2: 0A clc ; ROM $001BC3: 18 adc $1F ; ROM $001BC4: 65 1F sta $1F ; ROM $001BC6: 85 1F lda $8D ; ROM $001BC8: A5 8D asl a ; ROM $001BCA: 0A clc ; ROM $001BCB: 18 adc $1F ; ROM $001BCC: 65 1F ldx #$04 ; ROM $001BCE: A2 04 ; Routine: Menu_AddToZp8D_DBC0 ; Global: Reachable code entry at CPU $DBC0 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_AddToZp8D_DBC0: clc ; ROM $001BD0: 18 adc $8D,x ; ROM $001BD1: 75 8D dex ; ROM $001BD3: CA bne Menu_AddToZp8D_DBC0 ; ROM $001BD4: D0 FA and #$0F ; ROM $001BD6: 29 0F cmp $92 ; ROM $001BD8: C5 92 beq Menu_HandleControl_DBCF ; ROM $001BDA: F0 03 ; Routine: Menu_Dispatch_DBCC ; Global: Reachable code entry at CPU $DBCC traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_Dispatch_DBCC: jmp RunMenuSelectionScreen ; ROM $001BDC: 4C 8E DA ; Routine: Menu_HandleControl_DBCF ; Global: Reachable code entry at CPU $DBCF traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_HandleControl_DBCF: ldx #$00 ; ROM $001BDF: A2 00 ldy #$00 ; ROM $001BE1: A0 00 ; Routine: Menu_ReadRam007F_DBD3 ; Global: Reachable code entry at CPU $DBD3 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_ReadRam007F_DBD3: jsr Gameplay_ReadRamE360_E353 ; ROM $001BE3: 20 53 E3 lda $007F,y ; ROM $001BE6: B9 7F 00 sty $25 ; ROM $001BE9: 84 25 ldy #$00 ; ROM $001BEB: A0 00 sta ($34),y ; ROM $001BED: 91 34 ldy $25 ; ROM $001BEF: A4 25 iny ; ROM $001BF1: C8 cpy #$14 ; ROM $001BF2: C0 14 bne Menu_ReadRam007F_DBD3 ; ROM $001BF4: D0 ED lda $DC ; ROM $001BF6: A5 DC asl a ; ROM $001BF8: 0A asl a ; ROM $001BF9: 0A asl a ; ROM $001BFA: 0A asl a ; ROM $001BFB: 0A sta $73 ; ROM $001BFC: 85 73 lda $DE ; ROM $001BFE: A5 DE asl a ; ROM $001C00: 0A asl a ; ROM $001C01: 0A asl a ; ROM $001C02: 0A asl a ; ROM $001C03: 0A ora $DD ; ROM $001C04: 05 DD sta $58 ; ROM $001C06: 85 58 rts ; ROM $001C08: 60 ; Routine: Menu_WriteWorkValue_DBF9 ; Global: Reachable code entry at CPU $DBF9 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_WriteWorkValue_DBF9: jsr DisableRendering ; ROM $001C09: 20 57 C2 jsr Ppu_HandleControl_C2B9 ; ROM $001C0C: 20 B9 C2 jsr UploadMenuPalette ; ROM $001C0F: 20 27 DF lda #$06 ; ROM $001C12: A9 06 jsr Menu_SaveAccumulator_DD04 ; ROM $001C14: 20 04 DD ldy #$00 ; ROM $001C17: A0 00 jsr Menu_ReadRamDC53_DC39 ; ROM $001C19: 20 39 DC jsr Menu_ReadRamDC53_DC39 ; ROM $001C1C: 20 39 DC jsr Menu_ReadRamDC53_DC39 ; ROM $001C1F: 20 39 DC jsr Menu_ReadRamDC53_DC39 ; ROM $001C22: 20 39 DC jsr Menu_ReadRamDC53_DC39 ; ROM $001C25: 20 39 DC jsr Menu_ReadRamDC53_DC39 ; ROM $001C28: 20 39 DC jsr Menu_ReadRamDC53_DC39 ; ROM $001C2B: 20 39 DC lda #$0A ; ROM $001C2E: A9 0A sta $20 ; ROM $001C30: 85 20 lda #$00 ; ROM $001C32: A9 00 sta $1F ; ROM $001C34: 85 1F ; Routine: Menu_IncrementWorkIndex_DC26 ; Global: Reachable code entry at CPU $DC26 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_IncrementWorkIndex_DC26: lda #$31 ; ROM $001C36: A9 31 jsr Gameplay_WriteObjectWorkY_CB4E ; ROM $001C38: 20 4E CB inc $1F ; ROM $001C3B: E6 1F lda $1F ; ROM $001C3D: A5 1F cmp #$10 ; ROM $001C3F: C9 10 bne Menu_IncrementWorkIndex_DC26 ; ROM $001C41: D0 F3 jsr EnableNmiInPpuControl ; ROM $001C43: 20 B0 C2 jmp Ppu_CallHelper_C23B ; ROM $001C46: 4C 3B C2 ; Routine: Menu_ReadRamDC53_DC39 ; Global: Reachable code entry at CPU $DC39 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_ReadRamDC53_DC39: lda $DC53,y ; ROM $001C49: B9 53 DC iny ; ROM $001C4C: C8 ldx $DC53,y ; ROM $001C4D: BE 53 DC iny ; ROM $001C50: C8 ; Routine: Menu_CallHelper_DC41 ; Global: Reachable code entry at CPU $DC41 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_CallHelper_DC41: jsr SetPpuAddress ; ROM $001C51: 20 96 C1 ; Routine: Menu_TransferVramDataPath_DC44 ; Global: Reachable code entry at CPU $DC44 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DC44: lda $DC53,y ; ROM $001C54: B9 53 DC iny ; ROM $001C57: C8 cmp #$00 ; ROM $001C58: C9 00 beq Menu_ReturnToCaller_DC52 ; ROM $001C5A: F0 06 sta PPUDATA ; ROM $001C5C: 8D 07 20 jmp Menu_TransferVramDataPath_DC44 ; ROM $001C5F: 4C 44 DC ; Routine: Menu_ReturnToCaller_DC52 ; Global: Reachable code entry at CPU $DC52 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_ReturnToCaller_DC52: rts ; ROM $001C62: 60 ; Data region: CPU $DC53-$DD03; unreachable by direct recursive trace. MenuScreenConstructionData: .byte $20, $88, $43, $4F, $4E, $47, $52, $41, $54, $55, $4C, $41, $54, $49, $4F, $4E ; ROM $001C63: 20 88 43 4F 4E 47 52 41 54 55 4C 41 54 49 4F 4E .byte $53, $00, $20, $E4, $59, $4F, $55, $3A, $48, $41, $56, $45, $3A, $53, $55, $43 ; ROM $001C73: 53 00 20 E4 59 4F 55 3A 48 41 56 45 3A 53 55 43 .byte $43, $45, $45, $44, $45, $44, $3A, $49, $4E, $00, $21, $22, $48, $45, $4C, $50 ; ROM $001C83: 43 45 45 44 45 44 3A 49 4E 00 21 22 48 45 4C 50 .byte $49, $4E, $47, $3A, $42, $4F, $4D, $42, $45, $52, $4D, $41, $4E, $3A, $54, $4F ; ROM $001C93: 49 4E 47 3A 42 4F 4D 42 45 52 4D 41 4E 3A 54 4F .byte $3A, $42, $45, $43, $4F, $4D, $45, $00, $21, $62, $41, $3A, $48, $55, $4D, $41 ; ROM $001CA3: 3A 42 45 43 4F 4D 45 00 21 62 41 3A 48 55 4D 41 .byte $4E, $3A, $42, $45, $49, $4E, $47, $00, $21, $A4, $4D, $41, $59, $42, $45, $3A ; ROM $001CB3: 4E 3A 42 45 49 4E 47 00 21 A4 4D 41 59 42 45 3A .byte $59, $4F, $55, $3A, $43, $41, $4E, $3A, $52, $45, $43, $4F, $47, $4E, $49, $5A ; ROM $001CC3: 59 4F 55 3A 43 41 4E 3A 52 45 43 4F 47 4E 49 5A .byte $45, $3A, $48, $49, $4D, $00, $21, $E2, $49, $4E, $3A, $41, $4E, $4F, $54, $48 ; ROM $001CD3: 45 3A 48 49 4D 00 21 E2 49 4E 3A 41 4E 4F 54 48 .byte $45, $52, $3A, $48, $55, $44, $53, $4F, $4E, $3A, $53, $4F, $46, $54, $3A, $47 ; ROM $001CE3: 45 52 3A 48 55 44 53 4F 4E 3A 53 4F 46 54 3A 47 .byte $41, $4D, $45, $00, $22, $4B, $47, $4F, $4F, $44, $3A, $42, $59, $45, $00, $45 ; ROM $001CF3: 41 4D 45 00 22 4B 47 4F 4F 44 3A 42 59 45 00 45 .byte $4E, $54, $45, $52, $3A, $53, $45, $43, $52, $45, $54, $3A, $43, $4F, $44, $45 ; ROM $001D03: 4E 54 45 52 3A 53 45 43 52 45 54 3A 43 4F 44 45 .byte $00 ; ROM $001D13: 00 ; Routine: Menu_SaveAccumulator_DD04 ; Global: Reachable code entry at CPU $DD04 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_SaveAccumulator_DD04: pha ; ROM $001D14: 48 jsr WaitForVBlankTransition ; ROM $001D15: 20 8B C2 lda #$3F ; ROM $001D18: A9 3F ldx #$1C ; ROM $001D1A: A2 1C jsr SetPpuAddress ; ROM $001D1C: 20 96 C1 pla ; ROM $001D1F: 68 asl a ; ROM $001D20: 0A asl a ; ROM $001D21: 0A tax ; ROM $001D22: AA ldy #$04 ; ROM $001D23: A0 04 ; Routine: Menu_TransferVramDataPath_DD15 ; Global: Reachable code entry at CPU $DD15 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DD15: lda $DD22,x ; ROM $001D25: BD 22 DD sta PPUDATA ; ROM $001D28: 8D 07 20 inx ; ROM $001D2B: E8 dey ; ROM $001D2C: 88 bne Menu_TransferVramDataPath_DD15 ; ROM $001D2D: D0 F6 jmp Ppu_SetVramAddress_C2D6 ; ROM $001D2F: 4C D6 C2 ; Data region: CPU $DD22-$DD3D; unreachable by direct recursive trace. StatusScreenAddressTable: .byte $0F, $00, $00, $00, $0F, $00, $00, $00, $0F, $00, $00, $00, $0F, $00, $00, $00 ; ROM $001D32: 0F 00 00 00 0F 00 00 00 0F 00 00 00 0F 00 00 00 .byte $0F, $00, $00, $00, $0F, $00, $00, $00, $0F, $15, $36, $21 ; ROM $001D42: 0F 00 00 00 0F 00 00 00 0F 15 36 21 ; Routine: Menu_CallHelper_DD3E ; Global: Reachable code entry at CPU $DD3E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_CallHelper_DD3E: jsr DisableRendering ; ROM $001D4E: 20 57 C2 jsr Ppu_HandleControl_C2B9 ; ROM $001D51: 20 B9 C2 jsr UploadMenuPalette ; ROM $001D54: 20 27 DF lda #$21 ; ROM $001D57: A9 21 ldx #$EA ; ROM $001D59: A2 EA jsr SetPpuAddress ; ROM $001D5B: 20 96 C1 ldx #$08 ; ROM $001D5E: A2 08 ; Routine: Menu_TransferVramDataPath_DD50 ; Global: Reachable code entry at CPU $DD50 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DD50: lda $DD62,x ; ROM $001D60: BD 62 DD sta PPUDATA ; ROM $001D63: 8D 07 20 dex ; ROM $001D66: CA bpl Menu_TransferVramDataPath_DD50 ; ROM $001D67: 10 F7 jsr Gameplay_ReadObjectMode_E2BD ; ROM $001D69: 20 BD E2 jsr EnableNmiInPpuControl ; ROM $001D6C: 20 B0 C2 jmp Ppu_CallHelper_C23B ; ROM $001D6F: 4C 3B C2 ; Data region: CPU $DD62-$DD6A; unreachable by direct recursive trace. StatusDigitTileTable: .byte $52, $45, $56, $4F, $3A, $45, $4D, $41, $47 ; ROM $001D72: 52 45 56 4F 3A 45 4D 41 47 ; Routine: Menu_WriteObjectWorkX_DD6B ; Global: Reachable code entry at CPU $DD6B traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_WriteObjectWorkX_DD6B: stx $24 ; ROM $001D7B: 86 24 sty $25 ; ROM $001D7D: 84 25 ldx $59 ; ROM $001D7F: A6 59 bne Menu_ReadObjectWorkX_DDC2 ; ROM $001D81: D0 4F ldx #$03 ; ROM $001D83: A2 03 bne Menu_AddToZp61_DD8D ; ROM $001D85: D0 16 ; Routine: Menu_WriteObjectWorkX_DD77 ; Global: Reachable code entry at CPU $DD77 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_WriteObjectWorkX_DD77: stx $24 ; ROM $001D87: 86 24 sty $25 ; ROM $001D89: 84 25 ldx $59 ; ROM $001D8B: A6 59 bne Menu_ReadObjectWorkX_DDC2 ; ROM $001D8D: D0 43 ldx #$04 ; ROM $001D8F: A2 04 bne Menu_AddToZp61_DD8D ; ROM $001D91: D0 0A ; Routine: Menu_WriteObjectWorkX_DD83 ; Global: Reachable code entry at CPU $DD83 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_WriteObjectWorkX_DD83: stx $24 ; ROM $001D93: 86 24 sty $25 ; ROM $001D95: 84 25 ldx $59 ; ROM $001D97: A6 59 bne Menu_ReadObjectWorkX_DDC2 ; ROM $001D99: D0 37 ldx #$06 ; ROM $001D9B: A2 06 ; Routine: Menu_AddToZp61_DD8D ; Global: Reachable code entry at CPU $DD8D traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_AddToZp61_DD8D: ldy #$00 ; ROM $001D9D: A0 00 clc ; ROM $001D9F: 18 adc $61,x ; ROM $001DA0: 75 61 ; Routine: Menu_WriteZp61_DD92 ; Global: Reachable code entry at CPU $DD92 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_WriteZp61_DD92: sta $61,x ; ROM $001DA2: 95 61 lda $61,x ; ROM $001DA4: B5 61 sec ; ROM $001DA6: 38 sbc #$0A ; ROM $001DA7: E9 0A bcc Menu_WriteZp61_DD9E ; ROM $001DA9: 90 03 iny ; ROM $001DAB: C8 bne Menu_WriteZp61_DD92 ; ROM $001DAC: D0 F4 ; Routine: Menu_WriteZp61_DD9E ; Global: Reachable code entry at CPU $DD9E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_WriteZp61_DD9E: cpy #$00 ; ROM $001DAE: C0 00 beq Menu_HandleControl_DDAA ; ROM $001DB0: F0 08 tya ; ROM $001DB2: 98 dex ; ROM $001DB3: CA bpl Menu_AddToZp61_DD8D ; ROM $001DB4: 10 E7 lda #$09 ; ROM $001DB6: A9 09 sta $61 ; ROM $001DB8: 85 61 ; Routine: Menu_HandleControl_DDAA ; Global: Reachable code entry at CPU $DDAA traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_HandleControl_DDAA: ldx #$00 ; ROM $001DBA: A2 00 ; Routine: Menu_ReadZp61_DDAC ; Global: Reachable code entry at CPU $DDAC traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_ReadZp61_DDAC: lda $61,x ; ROM $001DBC: B5 61 cmp $01,x ; ROM $001DBE: D5 01 bcc Menu_ReadObjectWorkX_DDC2 ; ROM $001DC0: 90 10 bne Menu_HandleControl_DDB9 ; ROM $001DC2: D0 05 inx ; ROM $001DC4: E8 cpx #$08 ; ROM $001DC5: E0 08 bne Menu_ReadZp61_DDAC ; ROM $001DC7: D0 F3 ; Routine: Menu_HandleControl_DDB9 ; Global: Reachable code entry at CPU $DDB9 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_HandleControl_DDB9: ldx #$06 ; ROM $001DC9: A2 06 ; Routine: Menu_ReadZp61_DDBB ; Global: Reachable code entry at CPU $DDBB traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_ReadZp61_DDBB: lda $61,x ; ROM $001DCB: B5 61 sta $01,x ; ROM $001DCD: 95 01 dex ; ROM $001DCF: CA bpl Menu_ReadZp61_DDBB ; ROM $001DD0: 10 F9 ; Routine: Menu_ReadObjectWorkX_DDC2 ; Global: Reachable code entry at CPU $DDC2 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_ReadObjectWorkX_DDC2: ldx $24 ; ROM $001DD2: A6 24 ldy $25 ; ROM $001DD4: A4 25 rts ; ROM $001DD6: 60 ; Routine: Menu_HandleControl_DDC7 ; Global: Reachable code entry at CPU $DDC7 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_HandleControl_DDC7: lda #$20 ; ROM $001DD7: A9 20 ldx #$00 ; ROM $001DD9: A2 00 jsr SetPpuAddress ; ROM $001DDB: 20 96 C1 ldx #$80 ; ROM $001DDE: A2 80 lda #$3A ; ROM $001DE0: A9 3A ; Routine: Menu_TransferVramDataPath_DDD2 ; Global: Reachable code entry at CPU $DDD2 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DDD2: sta PPUDATA ; ROM $001DE2: 8D 07 20 dex ; ROM $001DE5: CA bne Menu_TransferVramDataPath_DDD2 ; ROM $001DE6: D0 FA lda #$20 ; ROM $001DE8: A9 20 ldx #$41 ; ROM $001DEA: A2 41 jsr SetPpuAddress ; ROM $001DEC: 20 96 C1 ldx #$03 ; ROM $001DEF: A2 03 ; Routine: Menu_TransferVramDataPath_DDE1 ; Global: Reachable code entry at CPU $DDE1 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DDE1: lda $DE15,x ; ROM $001DF1: BD 15 DE sta PPUDATA ; ROM $001DF4: 8D 07 20 dex ; ROM $001DF7: CA bpl Menu_TransferVramDataPath_DDE1 ; ROM $001DF8: 10 F7 lda #$3A ; ROM $001DFA: A9 3A sta PPUDATA ; ROM $001DFC: 8D 07 20 lda #$20 ; ROM $001DFF: A9 20 ldx #$52 ; ROM $001E01: A2 52 jsr SetPpuAddress ; ROM $001E03: 20 96 C1 lda #$30 ; ROM $001E06: A9 30 sta PPUDATA ; ROM $001E08: 8D 07 20 sta PPUDATA ; ROM $001E0B: 8D 07 20 lda #$20 ; ROM $001E0E: A9 20 ldx #$58 ; ROM $001E10: A2 58 jsr SetPpuAddress ; ROM $001E12: 20 96 C1 ldx #$03 ; ROM $001E15: A2 03 ; Routine: Menu_TransferVramDataPath_DE07 ; Global: Reachable code entry at CPU $DE07 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DE07: lda $DE19,x ; ROM $001E17: BD 19 DE sta PPUDATA ; ROM $001E1A: 8D 07 20 dex ; ROM $001E1D: CA bpl Menu_TransferVramDataPath_DE07 ; ROM $001E1E: 10 F7 lda $68 ; ROM $001E20: A5 68 jmp Menu_HandleControl_DF5D ; ROM $001E22: 4C 5D DF ; Data region: CPU $DE15-$DE1C; unreachable by direct recursive trace. StatusScreenTextPointerTable: .byte $45, $4D, $49, $54, $54, $46, $45, $4C ; ROM $001E25: 45 4D 49 54 54 46 45 4C ; Routine: Menu_WriteZp0E_DE1D ; Global: Reachable code entry at CPU $DE1D traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_WriteZp0E_DE1D: jsr DisableRendering ; ROM $001E2D: 20 57 C2 jsr Ppu_HandleControl_C2B9 ; ROM $001E30: 20 B9 C2 lda #$00 ; ROM $001E33: A9 00 sta $0E ; ROM $001E35: 85 0E jsr UploadMenuPalette ; ROM $001E37: 20 27 DF lda #$21 ; ROM $001E3A: A9 21 ldx #$EA ; ROM $001E3C: A2 EA jsr SetPpuAddress ; ROM $001E3E: 20 96 C1 ldx #$04 ; ROM $001E41: A2 04 ; Routine: Menu_TransferVramDataPath_DE33 ; Global: Reachable code entry at CPU $DE33 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DE33: lda $DE4E,x ; ROM $001E43: BD 4E DE sta PPUDATA ; ROM $001E46: 8D 07 20 dex ; ROM $001E49: CA bpl Menu_TransferVramDataPath_DE33 ; ROM $001E4A: 10 F7 lda #$21 ; ROM $001E4C: A9 21 ldx #$F0 ; ROM $001E4E: A2 F0 jsr SetPpuAddress ; ROM $001E50: 20 96 C1 lda $58 ; ROM $001E53: A5 58 jsr Menu_HandleControl_DF5D ; ROM $001E55: 20 5D DF jsr EnableNmiInPpuControl ; ROM $001E58: 20 B0 C2 jmp Ppu_CallHelper_C23B ; ROM $001E5B: 4C 3B C2 ; Data region: CPU $DE4E-$DE52; unreachable by direct recursive trace. StatusScreenValueAddressTable: .byte $45, $47, $41, $54, $53 ; ROM $001E5E: 45 47 41 54 53 ; Routine: Menu_WriteZp0E_DE53 ; Global: Reachable code entry at CPU $DE53 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_WriteZp0E_DE53: jsr DisableRendering ; ROM $001E63: 20 57 C2 jsr Ppu_HandleControl_C2B9 ; ROM $001E66: 20 B9 C2 lda #$00 ; ROM $001E69: A9 00 sta $0E ; ROM $001E6B: 85 0E jsr UploadMenuPalette ; ROM $001E6D: 20 27 DF lda #$21 ; ROM $001E70: A9 21 ldx #$EA ; ROM $001E72: A2 EA jsr SetPpuAddress ; ROM $001E74: 20 96 C1 ldx #$0A ; ROM $001E77: A2 0A ; Routine: Menu_TransferVramDataPath_DE69 ; Global: Reachable code entry at CPU $DE69 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DE69: lda $DE78,x ; ROM $001E79: BD 78 DE sta PPUDATA ; ROM $001E7C: 8D 07 20 dex ; ROM $001E7F: CA bpl Menu_TransferVramDataPath_DE69 ; ROM $001E80: 10 F7 jsr EnableNmiInPpuControl ; ROM $001E82: 20 B0 C2 jmp Ppu_CallHelper_C23B ; ROM $001E85: 4C 3B C2 ; Data region: CPU $DE78-$DE82; unreachable by direct recursive trace. StatusScreenPaletteAddressTable: .byte $45, $47, $41, $54, $53, $3A, $53, $55, $4E, $4F, $42 ; ROM $001E88: 45 47 41 54 53 3A 53 55 4E 4F 42 ; Routine: ComposeStatusScreen ; Global: Reachable code entry at CPU $DE83 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. ComposeStatusScreen: jsr DisableRendering ; ROM $001E93: 20 57 C2 jsr Ppu_HandleControl_C215 ; ROM $001E96: 20 15 C2 jsr WaitForVBlankTransition ; ROM $001E99: 20 8B C2 lda #$3F ; ROM $001E9C: A9 3F ldx #$00 ; ROM $001E9E: A2 00 jsr SetPpuAddress ; ROM $001EA0: 20 96 C1 ldx #$00 ; ROM $001EA3: A2 00 ; Routine: Menu_TransferVramDataPath_DE95 ; Global: Reachable code entry at CPU $DE95 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DE95: lda $DF90,x ; ROM $001EA5: BD 90 DF sta PPUDATA ; ROM $001EA8: 8D 07 20 inx ; ROM $001EAB: E8 cpx #$10 ; ROM $001EAC: E0 10 bne Menu_TransferVramDataPath_DE95 ; ROM $001EAE: D0 F5 jsr Ppu_SetVramAddress_C2D6 ; ROM $001EB0: 20 D6 C2 jsr RenderEncodedTextRecords ; ROM $001EB3: 20 C0 E1 lda #$20 ; ROM $001EB6: A9 20 ldx #$00 ; ROM $001EB8: A2 00 jsr SetPpuAddress ; ROM $001EBA: 20 96 C1 ldx #$40 ; ROM $001EBD: A2 40 lda #$B0 ; ROM $001EBF: A9 B0 ; Routine: Menu_TransferVramDataPath_DEB1 ; Global: Reachable code entry at CPU $DEB1 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DEB1: sta PPUDATA ; ROM $001EC1: 8D 07 20 dex ; ROM $001EC4: CA bne Menu_TransferVramDataPath_DEB1 ; ROM $001EC5: D0 FA ldx #$00 ; ROM $001EC7: A2 00 ; Routine: Menu_TransferVramDataPath_DEB9 ; Global: Reachable code entry at CPU $DEB9 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DEB9: lda $DFB0,x ; ROM $001EC9: BD B0 DF sta PPUDATA ; ROM $001ECC: 8D 07 20 inx ; ROM $001ECF: E8 bne Menu_TransferVramDataPath_DEB9 ; ROM $001ED0: D0 F7 ; Routine: Menu_TransferVramDataPath_DEC2 ; Global: Reachable code entry at CPU $DEC2 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DEC2: lda $E0B0,x ; ROM $001ED2: BD B0 E0 sta PPUDATA ; ROM $001ED5: 8D 07 20 inx ; ROM $001ED8: E8 bne Menu_TransferVramDataPath_DEC2 ; ROM $001ED9: D0 F7 lda #$22 ; ROM $001EDB: A9 22 ldx #$AE ; ROM $001EDD: A2 AE jsr SetPpuAddress ; ROM $001EDF: 20 96 C1 ldx #$00 ; ROM $001EE2: A2 00 ; Routine: Menu_TransferVramDataPath_DED4 ; Global: Reachable code entry at CPU $DED4 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DED4: lda $01,x ; ROM $001EE4: B5 01 bne Menu_TransferVramDataPath_DEE4 ; ROM $001EE6: D0 0C lda #$3A ; ROM $001EE8: A9 3A sta PPUDATA ; ROM $001EEA: 8D 07 20 inx ; ROM $001EED: E8 cpx #$07 ; ROM $001EEE: E0 07 bne Menu_TransferVramDataPath_DED4 ; ROM $001EF0: D0 F2 beq Menu_TransferVramDataPath_DEF1 ; ROM $001EF2: F0 0D ; Routine: Menu_TransferVramDataPath_DEE4 ; Global: Reachable code entry at CPU $DEE4 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DEE4: lda $01,x ; ROM $001EF4: B5 01 clc ; ROM $001EF6: 18 adc #$30 ; ROM $001EF7: 69 30 sta PPUDATA ; ROM $001EF9: 8D 07 20 inx ; ROM $001EFC: E8 cpx #$07 ; ROM $001EFD: E0 07 bne Menu_TransferVramDataPath_DEE4 ; ROM $001EFF: D0 F3 ; Routine: Menu_TransferVramDataPath_DEF1 ; Global: Reachable code entry at CPU $DEF1 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DEF1: lda #$30 ; ROM $001F01: A9 30 sta PPUDATA ; ROM $001F03: 8D 07 20 sta PPUDATA ; ROM $001F06: 8D 07 20 lda #$23 ; ROM $001F09: A9 23 ldx #$C0 ; ROM $001F0B: A2 C0 jsr SetPpuAddress ; ROM $001F0D: 20 96 C1 ldx #$20 ; ROM $001F10: A2 20 lda #$00 ; ROM $001F12: A9 00 ; Routine: Menu_TransferVramDataPath_DF04 ; Global: Reachable code entry at CPU $DF04 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DF04: sta PPUDATA ; ROM $001F14: 8D 07 20 dex ; ROM $001F17: CA bne Menu_TransferVramDataPath_DF04 ; ROM $001F18: D0 FA ldx #$08 ; ROM $001F1A: A2 08 lda #$50 ; ROM $001F1C: A9 50 ; Routine: Menu_TransferVramDataPath_DF0E ; Global: Reachable code entry at CPU $DF0E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DF0E: sta PPUDATA ; ROM $001F1E: 8D 07 20 dex ; ROM $001F21: CA bne Menu_TransferVramDataPath_DF0E ; ROM $001F22: D0 FA ldx #$18 ; ROM $001F24: A2 18 lda #$55 ; ROM $001F26: A9 55 ; Routine: Menu_TransferVramDataPath_DF18 ; Global: Reachable code entry at CPU $DF18 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DF18: sta PPUDATA ; ROM $001F28: 8D 07 20 dex ; ROM $001F2B: CA bne Menu_TransferVramDataPath_DF18 ; ROM $001F2C: D0 FA jsr CommitPpuStateAndScroll ; ROM $001F2E: 20 96 C2 jsr EnableNmiInPpuControl ; ROM $001F31: 20 B0 C2 jmp Ppu_CallHelper_C23B ; ROM $001F34: 4C 3B C2 ; Routine: UploadMenuPalette ; Global: Reachable code entry at CPU $DF27 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. UploadMenuPalette: lda #$00 ; ROM $001F37: A9 00 sta $0E ; ROM $001F39: 85 0E jsr WaitForVBlankTransition ; ROM $001F3B: 20 8B C2 lda #$3F ; ROM $001F3E: A9 3F ldx #$00 ; ROM $001F40: A2 00 jsr SetPpuAddress ; ROM $001F42: 20 96 C1 ldx #$00 ; ROM $001F45: A2 00 ; Routine: Menu_TransferVramDataPath_DF37 ; Global: Reachable code entry at CPU $DF37 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DF37: lda $DF8C,x ; ROM $001F47: BD 8C DF sta PPUDATA ; ROM $001F4A: 8D 07 20 inx ; ROM $001F4D: E8 cpx #$10 ; ROM $001F4E: E0 10 bne Menu_TransferVramDataPath_DF37 ; ROM $001F50: D0 F5 jsr Ppu_SetVramAddress_C2D6 ; ROM $001F52: 20 D6 C2 jmp Ppu_HandleControl_C215 ; ROM $001F55: 4C 15 C2 ; Routine: Menu_HandleControl_DF48 ; Global: Reachable code entry at CPU $DF48 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_HandleControl_DF48: ldy #$30 ; ROM $001F58: A0 30 sec ; ROM $001F5A: 38 ; Routine: Menu_HandleControl_DF4B ; Global: Reachable code entry at CPU $DF4B traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_HandleControl_DF4B: sbc #$64 ; ROM $001F5B: E9 64 bcc Menu_TransferVramDataPath_DF52 ; ROM $001F5D: 90 03 iny ; ROM $001F5F: C8 bne Menu_HandleControl_DF4B ; ROM $001F60: D0 F9 ; Routine: Menu_TransferVramDataPath_DF52 ; Global: Reachable code entry at CPU $DF52 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DF52: adc #$64 ; ROM $001F62: 69 64 cpy #$30 ; ROM $001F64: C0 30 bne Menu_TransferVramDataPath_DF76 ; ROM $001F66: D0 1E ldy #$3A ; ROM $001F68: A0 3A sty PPUDATA ; ROM $001F6A: 8C 07 20 ; Routine: Menu_HandleControl_DF5D ; Global: Reachable code entry at CPU $DF5D traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_HandleControl_DF5D: ldy #$30 ; ROM $001F6D: A0 30 sec ; ROM $001F6F: 38 ; Routine: Menu_HandleControl_DF60 ; Global: Reachable code entry at CPU $DF60 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_HandleControl_DF60: sbc #$0A ; ROM $001F70: E9 0A bcc Menu_HandleControl_DF67 ; ROM $001F72: 90 03 iny ; ROM $001F74: C8 bne Menu_HandleControl_DF60 ; ROM $001F75: D0 F9 ; Routine: Menu_HandleControl_DF67 ; Global: Reachable code entry at CPU $DF67 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_HandleControl_DF67: adc #$3A ; ROM $001F77: 69 3A cpy #$30 ; ROM $001F79: C0 30 bne Menu_TransferVramDataPath_DF6F ; ROM $001F7B: D0 02 ldy #$3A ; ROM $001F7D: A0 3A ; Routine: Menu_TransferVramDataPath_DF6F ; Global: Reachable code entry at CPU $DF6F traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DF6F: sty PPUDATA ; ROM $001F7F: 8C 07 20 sta PPUDATA ; ROM $001F82: 8D 07 20 rts ; ROM $001F85: 60 ; Routine: Menu_TransferVramDataPath_DF76 ; Global: Reachable code entry at CPU $DF76 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DF76: sty PPUDATA ; ROM $001F86: 8C 07 20 ldy #$30 ; ROM $001F89: A0 30 sec ; ROM $001F8B: 38 ; Routine: Menu_HandleControl_DF7C ; Global: Reachable code entry at CPU $DF7C traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_HandleControl_DF7C: sbc #$0A ; ROM $001F8C: E9 0A bcc Menu_TransferVramDataPath_DF83 ; ROM $001F8E: 90 03 iny ; ROM $001F90: C8 bne Menu_HandleControl_DF7C ; ROM $001F91: D0 F9 ; Routine: Menu_TransferVramDataPath_DF83 ; Global: Reachable code entry at CPU $DF83 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Menu_TransferVramDataPath_DF83: adc #$3A ; ROM $001F93: 69 3A sty PPUDATA ; ROM $001F95: 8C 07 20 sta PPUDATA ; ROM $001F98: 8D 07 20 rts ; ROM $001F9B: 60 ; Data region: CPU $DF8C-$E1BF; unreachable by direct recursive trace. MenuPaletteAndScreenData: .byte $0F, $00, $0F, $30, $0F, $05, $30, $28, $0F, $00, $0F, $30, $0F, $06, $26, $37 ; ROM $001F9C: 0F 00 0F 30 0F 05 30 28 0F 00 0F 30 0F 06 26 37 .byte $0F, $0F, $0F, $0F, $05, $00, $09, $04, $0D, $07, $02, $06, $0A, $0F, $0C, $03 ; ROM $001FAC: 0F 0F 0F 0F 05 00 09 04 0D 07 02 06 0A 0F 0C 03 .byte $08, $0B, $0E, $01, $B0, $B0, $DF, $C0, $C1, $C1, $C2, $C0, $C1, $C1, $C1, $C2 ; ROM $001FBC: 08 0B 0E 01 B0 B0 DF C0 C1 C1 C2 C0 C1 C1 C1 C2 .byte $C0, $B6, $E9, $B8, $C2, $C0, $C1, $C1, $C2, $C0, $C1, $C1, $C2, $C0, $C1, $C1 ; ROM $001FCC: C0 B6 E9 B8 C2 C0 C1 C1 C2 C0 C1 C1 C2 C0 C1 C1 .byte $C2, $E9, $F8, $B0, $B0, $B0, $DF, $C1, $D9, $D3, $B3, $C1, $D9, $CB, $D3, $B3 ; ROM $001FDC: C2 E9 F8 B0 B0 B0 DF C1 D9 D3 B3 C1 D9 CB D3 B3 .byte $C1, $C5, $C6, $C1, $B3, $C1, $D9, $D3, $B3, $C1, $D9, $CB, $CB, $C1, $D9, $D3 ; ROM $001FEC: C1 C5 C6 C1 B3 C1 D9 D3 B3 C1 D9 CB CB C1 D9 D3 .byte $B3, $EE, $F8, $B0, $B0, $B0, $DF, $C1, $D0, $D1, $D2, $C1, $CF, $E9, $C4, $B3 ; ROM $001FFC: B3 EE F8 B0 B0 B0 DF C1 D0 D1 D2 C1 CF E9 C4 B3 .byte $C1, $D5, $D6, $D7, $B3, $C1, $D0, $D1, $D2, $C1, $D0, $DC, $E9, $C1, $D0, $D1 ; ROM $00200C: C1 D5 D6 D7 B3 C1 D0 D1 D2 C1 D0 DC E9 C1 D0 D1 .byte $D2, $EB, $F8, $B0, $B0, $B0, $DF, $C1, $E0, $E1, $E2, $C1, $CF, $E9, $C4, $B3 ; ROM $00201C: D2 EB F8 B0 B0 B0 DF C1 E0 E1 E2 C1 CF E9 C4 B3 .byte $C1, $B7, $E6, $E7, $B3, $C1, $E0, $E1, $E2, $C1, $E0, $F5, $EC, $C1, $E0, $E1 ; ROM $00202C: C1 B7 E6 E7 B3 C1 E0 E1 E2 C1 E0 F5 EC C1 E0 E1 .byte $E2, $EF, $F8, $B0, $B0, $B0, $DF, $C1, $E8, $DA, $B3, $C1, $CF, $E9, $C4, $B3 ; ROM $00203C: E2 EF F8 B0 B0 B0 DF C1 E8 DA B3 C1 CF E9 C4 B3 .byte $C1, $CF, $E5, $F0, $B3, $C1, $E8, $DA, $B3, $C1, $E8, $DB, $ED, $C1, $E8, $DA ; ROM $00204C: C1 CF E5 F0 B3 C1 E8 DA B3 C1 E8 DB ED C1 E8 DA .byte $B3, $EB, $F8, $B0, $B0, $B0, $DF, $C1, $B5, $E3, $B3, $C1, $B5, $E9, $E3, $B3 ; ROM $00205C: B3 EB F8 B0 B0 B0 DF C1 B5 E3 B3 C1 B5 E9 E3 B3 .byte $C1, $CF, $E9, $C4, $B3, $C1, $B5, $E3, $B3, $C1, $B5, $E9, $E9, $C1, $CF, $C4 ; ROM $00206C: C1 CF E9 C4 B3 C1 B5 E3 B3 C1 B5 E9 E9 C1 CF C4 .byte $B3, $EB, $F8, $B0, $B0, $B0, $DF, $B1, $C1, $F1, $C3, $C7, $C1, $C1, $F1, $C3 ; ROM $00207C: B3 EB F8 B0 B0 B0 DF B1 C1 F1 C3 C7 C1 C1 F1 C3 .byte $B4, $CF, $E9, $B2, $C3, $C7, $C1, $F1, $C3, $C7, $C1, $C1, $C3, $B4, $CF, $B2 ; ROM $00208C: B4 CF E9 B2 C3 C7 C1 F1 C3 C7 C1 C1 C3 B4 CF B2 .byte $C3, $EB, $F8, $B0, $B0, $B0, $DF, $CA, $CB, $CB, $CB, $CE, $CB, $CB, $CB, $CB ; ROM $00209C: C3 EB F8 B0 B0 B0 DF CA CB CB CB CE CB CB CB CB .byte $CE, $D8, $E9, $E9, $EA, $CE, $CB, $CB, $CB, $CE, $CB, $CB, $CB, $CE, $D8, $E9 ; ROM $0020AC: CE D8 E9 E9 EA CE CB CB CB CE CB CB CB CE D8 E9 .byte $EA, $CD, $F8, $B0, $B0, $B0, $DF, $E9, $E9, $E9, $E9, $E9, $E9, $E9, $C0, $B6 ; ROM $0020BC: EA CD F8 B0 B0 B0 DF E9 E9 E9 E9 E9 E9 E9 C0 B6 .byte $E9, $B8, $C2, $C0, $C1, $C1, $C2, $C0, $BC, $E4, $C2, $E9, $E9, $E9, $E9, $E9 ; ROM $0020CC: E9 B8 C2 C0 C1 C1 C2 C0 BC E4 C2 E9 E9 E9 E9 E9 .byte $E9, $E9, $F8, $B0, $B0, $B0, $DF, $E9, $E9, $E9, $E9, $E9, $E9, $E9, $C1, $C5 ; ROM $0020DC: E9 E9 F8 B0 B0 B0 DF E9 E9 E9 E9 E9 E9 E9 C1 C5 .byte $C6, $C1, $B3, $C1, $D9, $D3, $B3, $C1, $BD, $C4, $B3, $EE, $FB, $FC, $E9, $E9 ; ROM $0020EC: C6 C1 B3 C1 D9 D3 B3 C1 BD C4 B3 EE FB FC E9 E9 .byte $E9, $E9, $F8, $B0, $B0, $B0, $DF, $E9, $E9, $E9, $E9, $E9, $E9, $E9, $C1, $D5 ; ROM $0020FC: E9 E9 F8 B0 B0 B0 DF E9 E9 E9 E9 E9 E9 E9 C1 D5 .byte $D6, $D7, $B3, $C1, $D0, $D1, $B3, $C1, $BE, $F2, $B3, $EB, $E9, $E9, $E9, $E9 ; ROM $00210C: D6 D7 B3 C1 D0 D1 B3 C1 BE F2 B3 EB E9 E9 E9 E9 .byte $E9, $E9, $F8, $B0, $B0, $B0, $DF, $E9, $E9, $E9, $E9, $E9, $E9, $E9, $C1, $B7 ; ROM $00211C: E9 E9 F8 B0 B0 B0 DF E9 E9 E9 E9 E9 E9 E9 C1 B7 .byte $E6, $E7, $B3, $C1, $E0, $E1, $B3, $C1, $B9, $BF, $B3, $EB, $E9, $E9, $E9, $E9 ; ROM $00212C: E6 E7 B3 C1 E0 E1 B3 C1 B9 BF B3 EB E9 E9 E9 E9 .byte $E9, $E9, $F8, $B0, $B0, $B0, $DF, $E9, $E9, $E9, $E9, $E9, $E9, $E9, $C1, $CF ; ROM $00213C: E9 E9 F8 B0 B0 B0 DF E9 E9 E9 E9 E9 E9 E9 C1 CF .byte $E5, $F0, $B3, $C1, $E8, $DA, $B3, $C1, $BB, $C8, $B3, $EB, $E9, $E9, $E9, $E9 ; ROM $00214C: E5 F0 B3 C1 E8 DA B3 C1 BB C8 B3 EB E9 E9 E9 E9 .byte $E9, $E9, $F8, $B0, $B0, $B0, $DF, $E9, $E9, $E9, $E9, $E9, $E9, $E9, $C1, $CF ; ROM $00215C: E9 E9 F8 B0 B0 B0 DF E9 E9 E9 E9 E9 E9 E9 C1 CF .byte $E9, $C4, $B3, $C1, $CF, $C4, $B3, $C1, $C9, $C1, $B3, $EB, $E9, $E9, $E9, $E9 ; ROM $00216C: E9 C4 B3 C1 CF C4 B3 C1 C9 C1 B3 EB E9 E9 E9 E9 .byte $E9, $E9, $F8, $B0, $B0, $B0, $DF, $E9, $E9, $E9, $E9, $E9, $E9, $E9, $D4, $CF ; ROM $00217C: E9 E9 F8 B0 B0 B0 DF E9 E9 E9 E9 E9 E9 E9 D4 CF .byte $E9, $B2, $C3, $B4, $CF, $B2, $C3, $B4, $CF, $BA, $C3, $EB, $E9, $E9, $E9, $E9 ; ROM $00218C: E9 B2 C3 B4 CF B2 C3 B4 CF BA C3 EB E9 E9 E9 E9 .byte $E9, $E9, $F8, $B0, $B0, $B0, $DF, $E9, $E9, $E9, $E9, $E9, $E9, $E9, $CA, $D8 ; ROM $00219C: E9 E9 F8 B0 B0 B0 DF E9 E9 E9 E9 E9 E9 E9 CA D8 .byte $E9, $E9, $EA, $CE, $D8, $E9, $EA, $CE, $D8, $F3, $CB, $CD, $E9, $E9, $E9, $E9 ; ROM $0021AC: E9 E9 EA CE D8 E9 EA CE D8 F3 CB CD E9 E9 E9 E9 .byte $E9, $E9, $F8, $B0, $B0, $B0, $F4, $F9, $F9, $F9, $F9, $F9, $F9, $F9, $F9, $F9 ; ROM $0021BC: E9 E9 F8 B0 B0 B0 F4 F9 F9 F9 F9 F9 F9 F9 F9 F9 .byte $F9, $F9, $F9, $F9 ; ROM $0021CC: F9 F9 F9 F9 ; Routine: RenderEncodedTextRecords ; Global: Reachable code entry at CPU $E1C0 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. RenderEncodedTextRecords: ldy #$00 ; ROM $0021D0: A0 00 ldx #$05 ; ROM $0021D2: A2 05 ; Routine: Gameplay_SetVramAddressPath_E1C4 ; Global: Reachable code entry at CPU $E1C4 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_SetVramAddressPath_E1C4: jsr Gameplay_ReadRamE1E5_E1E0 ; ROM $0021D4: 20 E0 E1 sta PPUADDR ; ROM $0021D7: 8D 06 20 jsr Gameplay_ReadRamE1E5_E1E0 ; ROM $0021DA: 20 E0 E1 sta PPUADDR ; ROM $0021DD: 8D 06 20 ; Routine: Gameplay_TransferVramDataPath_E1D0 ; Global: Reachable code entry at CPU $E1D0 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_TransferVramDataPath_E1D0: jsr Gameplay_ReadRamE1E5_E1E0 ; ROM $0021E0: 20 E0 E1 cmp #$FF ; ROM $0021E3: C9 FF beq Gameplay_RetreatIndexX_E1DC ; ROM $0021E5: F0 05 sta PPUDATA ; ROM $0021E7: 8D 07 20 bne Gameplay_TransferVramDataPath_E1D0 ; ROM $0021EA: D0 F4 ; Routine: Gameplay_RetreatIndexX_E1DC ; Global: Reachable code entry at CPU $E1DC traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_RetreatIndexX_E1DC: dex ; ROM $0021EC: CA bne Gameplay_SetVramAddressPath_E1C4 ; ROM $0021ED: D0 E5 rts ; ROM $0021EF: 60 ; Routine: Gameplay_ReadRamE1E5_E1E0 ; Global: Reachable code entry at CPU $E1E0 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadRamE1E5_E1E0: lda $E1E5,y ; ROM $0021F0: B9 E5 E1 iny ; ROM $0021F3: C8 rts ; ROM $0021F4: 60 ; Data region: CPU $E1E5-$E2BC; unreachable by direct recursive trace. TitleAndCopyrightText: .byte $22, $69, $53, $54, $41, $52, $54, $B0, $B0, $B0, $43, $4F, $4E, $54, $49, $4E ; ROM $0021F5: 22 69 53 54 41 52 54 B0 B0 B0 43 4F 4E 54 49 4E .byte $55, $45, $FF, $22, $AA, $54, $4F, $50, $FF, $22, $E3, $54, $4D, $B0, $41, $4E ; ROM $002205: 55 45 FF 22 AA 54 4F 50 FF 22 E3 54 4D B0 41 4E .byte $44, $B0, $FE, $B0, $31, $39, $38, $37, $B0, $48, $55, $44, $53, $4F, $4E, $B0 ; ROM $002215: 44 B0 FE B0 31 39 38 37 B0 48 55 44 53 4F 4E B0 .byte $53, $4F, $46, $54, $FF, $23, $2A, $4C, $49, $43, $45, $4E, $53, $45, $44, $B0 ; ROM $002225: 53 4F 46 54 FF 23 2A 4C 49 43 45 4E 53 45 44 B0 .byte $42, $59, $FF, $23, $64, $4E, $49, $4E, $54, $45, $4E, $44, $4F, $B0, $4F, $46 ; ROM $002235: 42 59 FF 23 64 4E 49 4E 54 45 4E 44 4F B0 4F 46 .byte $B0, $41, $4D, $45, $52, $49, $43, $41, $B0, $49, $4E, $43, $FD, $FF, $01, $01 ; ROM $002245: B0 41 4D 45 52 49 43 41 B0 49 4E 43 FD FF 01 01 .byte $01, $01, $01, $01, $01, $01, $01, $01, $01, $01, $01, $01, $01, $01, $01, $01 ; ROM $002255: 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 .byte $01, $01, $01, $01, $01, $01, $01, $01, $01, $01, $01, $01, $01, $01, $01, $00 ; ROM $002265: 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 00 .byte $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00 ; ROM $002275: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .byte $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $01, $01, $01, $00 ; ROM $002285: 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 00 .byte $01, $00, $01, $00, $01, $00, $01, $00, $01, $00, $01, $00, $01, $00, $01, $00 ; ROM $002295: 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 .byte $01, $00, $01, $00, $01, $00, $01, $00, $01, $00, $01, $00, $01, $01, $00, $20 ; ROM $0022A5: 01 00 01 00 01 00 01 00 01 00 01 00 01 01 00 20 .byte $40, $60, $80, $A0, $C0, $E0, $00, $20, $40, $60, $80, $02, $02, $02, $02, $02 ; ROM $0022B5: 40 60 80 A0 C0 E0 00 20 40 60 80 02 02 02 02 02 .byte $02, $02, $02, $03, $03, $03, $03, $03 ; ROM $0022C5: 02 02 02 03 03 03 03 03 ; Routine: Gameplay_ReadObjectMode_E2BD ; Global: Reachable code entry at CPU $E2BD traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadObjectMode_E2BD: lda $73 ; ROM $0022CD: A5 73 lsr a ; ROM $0022CF: 4A lsr a ; ROM $0022D0: 4A lsr a ; ROM $0022D1: 4A lsr a ; ROM $0022D2: 4A sta $DC ; ROM $0022D3: 85 DC lda $58 ; ROM $0022D5: A5 58 and #$0F ; ROM $0022D7: 29 0F sta $DD ; ROM $0022D9: 85 DD lda $58 ; ROM $0022DB: A5 58 lsr a ; ROM $0022DD: 4A lsr a ; ROM $0022DE: 4A lsr a ; ROM $0022DF: 4A lsr a ; ROM $0022E0: 4A sta $DE ; ROM $0022E1: 85 DE ldy #$00 ; ROM $0022E3: A0 00 ldx #$00 ; ROM $0022E5: A2 00 lda #$03 ; ROM $0022E7: A9 03 sta $1F ; ROM $0022E9: 85 1F ; Routine: Gameplay_ReadObjectWorkX_E2DB ; Global: Reachable code entry at CPU $E2DB traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadObjectWorkX_E2DB: jsr Gameplay_WriteWorkValue_E33C ; ROM $0022EB: 20 3C E3 jsr Gameplay_ReadRamE360_E353 ; ROM $0022EE: 20 53 E3 lda $24 ; ROM $0022F1: A5 24 sta ($34),y ; ROM $0022F3: 91 34 dec $1F ; ROM $0022F5: C6 1F bne Gameplay_ReadObjectWorkX_E2DB ; ROM $0022F7: D0 F2 jsr Gameplay_WriteWorkValue_E33C ; ROM $0022F9: 20 3C E3 lda $99 ; ROM $0022FC: A5 99 asl a ; ROM $0022FE: 0A clc ; ROM $0022FF: 18 adc $24 ; ROM $002300: 65 24 sta $24 ; ROM $002302: 85 24 lda $9A ; ROM $002304: A5 9A asl a ; ROM $002306: 0A clc ; ROM $002307: 18 adc $24 ; ROM $002308: 65 24 sta $24 ; ROM $00230A: 85 24 lda $9B ; ROM $00230C: A5 9B asl a ; ROM $00230E: 0A clc ; ROM $00230F: 18 adc $24 ; ROM $002310: 65 24 sta $95 ; ROM $002312: 85 95 ldy #$00 ; ROM $002314: A0 00 sty RandomState0 ; ROM $002316: 84 54 ldx #$00 ; ROM $002318: A2 00 ; Routine: Gameplay_ReadTransferPointer_E30A ; Global: Reachable code entry at CPU $E30A traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadTransferPointer_E30A: jsr Gameplay_ReadRamE360_E353 ; ROM $00231A: 20 53 E3 lda ($34),y ; ROM $00231D: B1 34 and #$0F ; ROM $00231F: 29 0F sec ; ROM $002321: 38 sbc RandomState0 ; ROM $002322: E5 54 sec ; ROM $002324: 38 sbc #$07 ; ROM $002325: E9 07 and #$0F ; ROM $002327: 29 0F sta $0180,x ; ROM $002329: 9D 80 01 sta RandomState0 ; ROM $00232C: 85 54 cpx #$28 ; ROM $00232E: E0 28 bne Gameplay_ReadTransferPointer_E30A ; ROM $002330: D0 E8 lda #$23 ; ROM $002332: A9 23 ldx #$06 ; ROM $002334: A2 06 jsr SetPpuAddress ; ROM $002336: 20 96 C1 ldx #$02 ; ROM $002339: A2 02 ; Routine: Gameplay_TransferVramDataPath_E32B ; Global: Reachable code entry at CPU $E32B traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_TransferVramDataPath_E32B: lda $0180,x ; ROM $00233B: BD 80 01 tay ; ROM $00233E: A8 lda $E388,y ; ROM $00233F: B9 88 E3 sta PPUDATA ; ROM $002342: 8D 07 20 inx ; ROM $002345: E8 inx ; ROM $002346: E8 cpx #$2A ; ROM $002347: E0 2A bne Gameplay_TransferVramDataPath_E32B ; ROM $002349: D0 F0 rts ; ROM $00234B: 60 ; Routine: Gameplay_WriteWorkValue_E33C ; Global: Reachable code entry at CPU $E33C traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteWorkValue_E33C: lda #$04 ; ROM $00234C: A9 04 sta $20 ; ROM $00234E: 85 20 lda #$00 ; ROM $002350: A9 00 sta $24 ; ROM $002352: 85 24 ; Routine: Gameplay_ReadTransferPointer_E344 ; Global: Reachable code entry at CPU $E344 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadTransferPointer_E344: jsr Gameplay_ReadRamE360_E353 ; ROM $002354: 20 53 E3 lda ($34),y ; ROM $002357: B1 34 clc ; ROM $002359: 18 adc $24 ; ROM $00235A: 65 24 sta $24 ; ROM $00235C: 85 24 dec $20 ; ROM $00235E: C6 20 bne Gameplay_ReadTransferPointer_E344 ; ROM $002360: D0 F2 rts ; ROM $002362: 60 ; Routine: Gameplay_ReadRamE360_E353 ; Global: Reachable code entry at CPU $E353 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadRamE360_E353: lda $E360,x ; ROM $002363: BD 60 E3 sta $34 ; ROM $002366: 85 34 inx ; ROM $002368: E8 lda $E360,x ; ROM $002369: BD 60 E3 sta $35 ; ROM $00236C: 85 35 inx ; ROM $00236E: E8 rts ; ROM $00236F: 60 ; Data region: CPU $E360-$E397; unreachable by direct recursive trace. GameplayScoreThresholdTable: .byte $67, $00, $77, $00, $DD, $00, $61, $00, $99, $00, $66, $00, $DC, $00, $64, $00 ; ROM $002370: 67 00 77 00 DD 00 61 00 99 00 66 00 DC 00 64 00 .byte $79, $00, $9A, $00, $74, $00, $63, $00, $75, $00, $62, $00, $9B, $00, $65, $00 ; ROM $002380: 79 00 9A 00 74 00 63 00 75 00 62 00 9B 00 65 00 .byte $94, $00, $DE, $00, $76, $00, $95, $00, $41, $4F, $46, $4B, $43, $50, $47, $45 ; ROM $002390: 94 00 DE 00 76 00 95 00 41 4F 46 4B 43 50 47 45 .byte $4C, $42, $48, $4D, $4A, $44, $4E, $49 ; ROM $0023A0: 4C 42 48 4D 4A 44 4E 49 ; Routine: Gameplay_ReturnToCaller_E398 ; Global: Reachable code entry at CPU $E398 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReturnToCaller_E398: rts ; ROM $0023A8: 60 ; Routine: Gameplay_ReadStageProgress_E399 ; Global: Reachable code entry at CPU $E399 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadStageProgress_E399: lda $9C ; ROM $0023A9: A5 9C bne Gameplay_ReadPlayerState_E3A7 ; ROM $0023AB: D0 0A lda $B1 ; ROM $0023AD: A5 B1 bne Gameplay_ReadPlayerState_E3A7 ; ROM $0023AF: D0 06 inc $B1 ; ROM $0023B1: E6 B1 lda #$06 ; ROM $0023B3: A9 06 sta $DF ; ROM $0023B5: 85 DF ; Routine: Gameplay_ReadPlayerState_E3A7 ; Global: Reachable code entry at CPU $E3A7 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadPlayerState_E3A7: lda $A8 ; ROM $0023B7: A5 A8 beq Gameplay_ReadObjectType_E3E7 ; ROM $0023B9: F0 3C cmp #$02 ; ROM $0023BB: C9 02 beq Gameplay_ReturnToCaller_E398 ; ROM $0023BD: F0 E9 lda $33 ; ROM $0023BF: A5 33 and #$01 ; ROM $0023C1: 29 01 bne Gameplay_ReadZpAA_E3BD ; ROM $0023C3: D0 08 dec $A9 ; ROM $0023C5: C6 A9 bne Gameplay_ReadZpAA_E3BD ; ROM $0023C7: D0 04 lda #$02 ; ROM $0023C9: A9 02 sta $A8 ; ROM $0023CB: 85 A8 ; Routine: Gameplay_ReadZpAA_E3BD ; Global: Reachable code entry at CPU $E3BD traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadZpAA_E3BD: jsr Object_ReadStageIndex_CFED ; ROM $0023CD: 20 ED CF lda $AA ; ROM $0023D0: A5 AA cmp $28 ; ROM $0023D2: C5 28 bne Gameplay_ReturnToCaller_E3E6 ; ROM $0023D4: D0 20 lda $2A ; ROM $0023D6: A5 2A cmp $AB ; ROM $0023D8: C5 AB bne Gameplay_ReturnToCaller_E3E6 ; ROM $0023DA: D0 1A lda #$04 ; ROM $0023DC: A9 04 sta $DF ; ROM $0023DE: 85 DF ldx $9D ; ROM $0023E0: A6 9D lda $E4BC,x ; ROM $0023E2: BD BC E4 cmp #$64 ; ROM $0023E5: C9 64 bcc Gameplay_CallHelper_E3DF ; ROM $0023E7: 90 06 jsr Menu_WriteObjectWorkX_DD6B ; ROM $0023E9: 20 6B DD jmp Gameplay_WritePlayerState_E3E2 ; ROM $0023EC: 4C E2 E3 ; Routine: Gameplay_CallHelper_E3DF ; Global: Reachable code entry at CPU $E3DF traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_CallHelper_E3DF: jsr Menu_WriteObjectWorkX_DD77 ; ROM $0023EF: 20 77 DD ; Routine: Gameplay_WritePlayerState_E3E2 ; Global: Reachable code entry at CPU $E3E2 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WritePlayerState_E3E2: lda #$02 ; ROM $0023F2: A9 02 sta $A8 ; ROM $0023F4: 85 A8 ; Routine: Gameplay_ReturnToCaller_E3E6 ; Global: Reachable code entry at CPU $E3E6 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReturnToCaller_E3E6: rts ; ROM $0023F6: 60 ; Routine: Gameplay_ReadObjectType_E3E7 ; Global: Reachable code entry at CPU $E3E7 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadObjectType_E3E7: lda $28 ; ROM $0023F7: A5 28 cmp #$01 ; ROM $0023F9: C9 01 bne Gameplay_ReadObjectState_E401 ; ROM $0023FB: D0 14 lda $2A ; ROM $0023FD: A5 2A cmp #$01 ; ROM $0023FF: C9 01 bne Gameplay_IncrementRemoteControl_E3F8 ; ROM $002401: D0 05 inc $A0 ; ROM $002403: E6 A0 jmp Gameplay_ReadObjectType_E416 ; ROM $002405: 4C 16 E4 ; Routine: Gameplay_IncrementRemoteControl_E3F8 ; Global: Reachable code entry at CPU $E3F8 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_IncrementRemoteControl_E3F8: cmp #$0B ; ROM $002408: C9 0B bne Gameplay_ReadObjectState_E401 ; ROM $00240A: D0 05 inc $A2 ; ROM $00240C: E6 A2 jmp Gameplay_ReadObjectType_E416 ; ROM $00240E: 4C 16 E4 ; Routine: Gameplay_ReadObjectState_E401 ; Global: Reachable code entry at CPU $E401 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadObjectState_E401: cmp #$1D ; ROM $002411: C9 1D bne Gameplay_ReadObjectType_E416 ; ROM $002413: D0 11 lda $2A ; ROM $002415: A5 2A cmp #$01 ; ROM $002417: C9 01 bne Gameplay_IncrementWallPass_E410 ; ROM $002419: D0 05 inc $A1 ; ROM $00241B: E6 A1 jmp Gameplay_ReadObjectType_E416 ; ROM $00241D: 4C 16 E4 ; Routine: Gameplay_IncrementWallPass_E410 ; Global: Reachable code entry at CPU $E410 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_IncrementWallPass_E410: cmp #$0B ; ROM $002420: C9 0B bne Gameplay_ReadObjectType_E416 ; ROM $002422: D0 02 inc $A3 ; ROM $002424: E6 A3 ; Routine: Gameplay_ReadObjectType_E416 ; Global: Reachable code entry at CPU $E416 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadObjectType_E416: lda $28 ; ROM $002426: A5 28 cmp #$01 ; ROM $002428: C9 01 beq Gameplay_ReadStageIndex_E434 ; ROM $00242A: F0 18 cmp #$1D ; ROM $00242C: C9 1D beq Gameplay_ReadStageIndex_E434 ; ROM $00242E: F0 14 lda $2A ; ROM $002430: A5 2A cmp #$01 ; ROM $002432: C9 01 beq Gameplay_ReadStageIndex_E434 ; ROM $002434: F0 0E cmp #$0B ; ROM $002436: C9 0B beq Gameplay_ReadStageIndex_E434 ; ROM $002438: F0 0A lda #$00 ; ROM $00243A: A9 00 sta $A0 ; ROM $00243C: 85 A0 sta $A1 ; ROM $00243E: 85 A1 sta $A2 ; ROM $002440: 85 A2 sta $A3 ; ROM $002442: 85 A3 ; Routine: Gameplay_ReadStageIndex_E434 ; Global: Reachable code entry at CPU $E434 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadStageIndex_E434: ldx $9D ; ROM $002444: A6 9D beq Gameplay_ReadPlayerLives_E448 ; ROM $002446: F0 10 dex ; ROM $002448: CA beq Gameplay_ReadStageProgress_E468 ; ROM $002449: F0 2D dex ; ROM $00244B: CA beq Gameplay_ReadStageProgress_E47D ; ROM $00244C: F0 3F dex ; ROM $00244E: CA beq Gameplay_ReadFlamePass_E486 ; ROM $00244F: F0 45 dex ; ROM $002451: CA beq Gameplay_ReadBombCapacity_E48D ; ROM $002452: F0 49 dex ; ROM $002454: CA beq Gameplay_ReadPlayerLives_E498 ; ROM $002455: F0 51 rts ; ROM $002457: 60 ; Routine: Gameplay_ReadPlayerLives_E448 ; Global: Reachable code entry at CPU $E448 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadPlayerLives_E448: lda $9E ; ROM $002458: A5 9E bne Gameplay_ReturnToCaller_E467 ; ROM $00245A: D0 1B lda $9F ; ROM $00245C: A5 9F beq Gameplay_ReturnToCaller_E467 ; ROM $00245E: F0 17 ; Routine: Gameplay_ReadPlayerState_E450 ; Global: Reachable code entry at CPU $E450 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadPlayerState_E450: lda $A8 ; ROM $002460: A5 A8 bne Gameplay_ReturnToCaller_E467 ; ROM $002462: D0 13 lda #$01 ; ROM $002464: A9 01 sta $A8 ; ROM $002466: 85 A8 lda #$00 ; ROM $002468: A9 00 sta $A9 ; ROM $00246A: 85 A9 jsr Gameplay_WriteObjectWorkX_CACF ; ROM $00246C: 20 CF CA lda $24 ; ROM $00246F: A5 24 sta $AA ; ROM $002471: 85 AA lda $25 ; ROM $002473: A5 25 sta $AB ; ROM $002475: 85 AB ; Routine: Gameplay_ReturnToCaller_E467 ; Global: Reachable code entry at CPU $E467 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReturnToCaller_E467: rts ; ROM $002477: 60 ; Routine: Gameplay_ReadStageProgress_E468 ; Global: Reachable code entry at CPU $E468 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadStageProgress_E468: lda $9C ; ROM $002478: A5 9C bne Gameplay_ReturnToCaller_E467 ; ROM $00247A: D0 FB lda $A0 ; ROM $00247C: A5 A0 beq Gameplay_ReturnToCaller_E467 ; ROM $00247E: F0 F7 lda $A1 ; ROM $002480: A5 A1 beq Gameplay_ReturnToCaller_E467 ; ROM $002482: F0 F3 lda $A2 ; ROM $002484: A5 A2 beq Gameplay_ReturnToCaller_E467 ; ROM $002486: F0 EF lda $A3 ; ROM $002488: A5 A3 bne Gameplay_ReadPlayerState_E450 ; ROM $00248A: D0 D4 rts ; ROM $00248C: 60 ; Routine: Gameplay_ReadStageProgress_E47D ; Global: Reachable code entry at CPU $E47D traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadStageProgress_E47D: lda $9C ; ROM $00248D: A5 9C bne Gameplay_ReturnToCaller_E467 ; ROM $00248F: D0 E6 lda $A4 ; ROM $002491: A5 A4 beq Gameplay_ReadPlayerState_E450 ; ROM $002493: F0 CB rts ; ROM $002495: 60 ; Routine: Gameplay_ReadFlamePass_E486 ; Global: Reachable code entry at CPU $E486 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadFlamePass_E486: lda $A5 ; ROM $002496: A5 A5 cmp #$F8 ; ROM $002498: C9 F8 bcs Gameplay_ReadPlayerState_E450 ; ROM $00249A: B0 C4 rts ; ROM $00249C: 60 ; Routine: Gameplay_ReadBombCapacity_E48D ; Global: Reachable code entry at CPU $E48D traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadBombCapacity_E48D: lda $9F ; ROM $00249D: A5 9F beq Gameplay_ReturnToCaller_E467 ; ROM $00249F: F0 D6 lda $A6 ; ROM $0024A1: A5 A6 cmp #$F8 ; ROM $0024A3: C9 F8 bcs Gameplay_ReadPlayerState_E450 ; ROM $0024A5: B0 B9 rts ; ROM $0024A7: 60 ; Routine: Gameplay_ReadPlayerLives_E498 ; Global: Reachable code entry at CPU $E498 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadPlayerLives_E498: lda $9E ; ROM $0024A8: A5 9E bne Gameplay_ReturnToCaller_E467 ; ROM $0024AA: D0 CB lda $58 ; ROM $0024AC: A5 58 asl a ; ROM $0024AE: 0A clc ; ROM $0024AF: 18 adc #$32 ; ROM $0024B0: 69 32 cmp $A4 ; ROM $0024B2: C5 A4 beq Gameplay_ReadBonusTimer_E4A8 ; ROM $0024B4: F0 02 bcs Gameplay_ReturnToCaller_E467 ; ROM $0024B6: B0 BF ; Routine: Gameplay_ReadBonusTimer_E4A8 ; Global: Reachable code entry at CPU $E4A8 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadBonusTimer_E4A8: lda $A7 ; ROM $0024B8: A5 A7 cmp #$03 ; ROM $0024BA: C9 03 beq Gameplay_ReadPlayerState_E450 ; ROM $0024BC: F0 A2 rts ; ROM $0024BE: 60 ; Routine: Gameplay_ReadZp58_E4AF ; Global: Reachable code entry at CPU $E4AF traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadZp58_E4AF: lda $58 ; ROM $0024BF: A5 58 and #$07 ; ROM $0024C1: 29 07 cmp #$06 ; ROM $0024C3: C9 06 bcc Gameplay_WriteStageIndex_E4B9 ; ROM $0024C5: 90 02 and #$01 ; ROM $0024C7: 29 01 ; Routine: Gameplay_WriteStageIndex_E4B9 ; Global: Reachable code entry at CPU $E4B9 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteStageIndex_E4B9: sta $9D ; ROM $0024C9: 85 9D rts ; ROM $0024CB: 60 ; Data region: CPU $E4BC-$E4C1; unreachable by direct recursive trace. GameplayPowerupMaskTable: .byte $01, $02, $64, $32, $03, $C8 ; ROM $0024CC: 01 02 64 32 03 C8 ; Routine: Gameplay_WriteGameMode_E4C2 ; Global: Reachable code entry at CPU $E4C2 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteGameMode_E4C2: lda #$00 ; ROM $0024D2: A9 00 sta $B5 ; ROM $0024D4: 85 B5 ; Routine: Gameplay_ReturnToCaller_E4C6 ; Global: Reachable code entry at CPU $E4C6 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReturnToCaller_E4C6: rts ; ROM $0024D6: 60 ; Routine: Gameplay_ReadZpB2_E4C7 ; Global: Reachable code entry at CPU $E4C7 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadZpB2_E4C7: lda $B2 ; ROM $0024D7: A5 B2 bne Gameplay_ReturnToCaller_E4C6 ; ROM $0024D9: D0 FB lda $B5 ; ROM $0024DB: A5 B5 beq Gameplay_ReturnToCaller_E4C6 ; ROM $0024DD: F0 F7 bmi Gameplay_WriteSoundChannelIndex_E52A ; ROM $0024DF: 30 59 cmp #$0B ; ROM $0024E1: C9 0B bcs Gameplay_WriteGameMode_E4C2 ; ROM $0024E3: B0 ED sta $B4 ; ROM $0024E5: 85 B4 ora #$80 ; ROM $0024E7: 09 80 sta $B5 ; ROM $0024E9: 85 B5 dec $B4 ; ROM $0024EB: C6 B4 lda $B4 ; ROM $0024ED: A5 B4 asl a ; ROM $0024EF: 0A asl a ; ROM $0024F0: 0A asl a ; ROM $0024F1: 0A tay ; ROM $0024F2: A8 ldx #$00 ; ROM $0024F3: A2 00 ; Routine: Gameplay_ReadRamE87C_E4E5 ; Global: Reachable code entry at CPU $E4E5 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadRamE87C_E4E5: lda $E87C,y ; ROM $0024F5: B9 7C E8 sta $BC,x ; ROM $0024F8: 95 BC iny ; ROM $0024FA: C8 inx ; ROM $0024FB: E8 cpx #$06 ; ROM $0024FC: E0 06 bne Gameplay_ReadRamE87C_E4E5 ; ROM $0024FE: D0 F5 lda $E87C,y ; ROM $002500: B9 7C E8 sta $D3 ; ROM $002503: 85 D3 lda $E87D,y ; ROM $002505: B9 7D E8 sta $D4 ; ROM $002508: 85 D4 lda #$00 ; ROM $00250A: A9 00 sta $C4 ; ROM $00250C: 85 C4 sta $C5 ; ROM $00250E: 85 C5 sta $C6 ; ROM $002510: 85 C6 sta $D5 ; ROM $002512: 85 D5 sta $CD ; ROM $002514: 85 CD sta $CE ; ROM $002516: 85 CE sta $CF ; ROM $002518: 85 CF sta $D0 ; ROM $00251A: 85 D0 sta $D1 ; ROM $00251C: 85 D1 sta $D2 ; ROM $00251E: 85 D2 lda #$01 ; ROM $002520: A9 01 sta $B6 ; ROM $002522: 85 B6 sta $B7 ; ROM $002524: 85 B7 sta $B8 ; ROM $002526: 85 B8 sta $B9 ; ROM $002528: 85 B9 sta $BA ; ROM $00252A: 85 BA sta $BB ; ROM $00252C: 85 BB sta $D6 ; ROM $00252E: 85 D6 sta $D7 ; ROM $002530: 85 D7 sta $D8 ; ROM $002532: 85 D8 lda #$08 ; ROM $002534: A9 08 sta $D9 ; ROM $002536: 85 D9 sta $DA ; ROM $002538: 85 DA ; Routine: Gameplay_WriteSoundChannelIndex_E52A ; Global: Reachable code entry at CPU $E52A traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteSoundChannelIndex_E52A: lda #$02 ; ROM $00253A: A9 02 sta $B3 ; ROM $00253C: 85 B3 ; Routine: Gameplay_ReadSoundChannelIndex_E52E ; Global: Reachable code entry at CPU $E52E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadSoundChannelIndex_E52E: ldx $B3 ; ROM $00253E: A6 B3 dec $B6,x ; ROM $002540: D6 B6 beq Gameplay_ReadZpBC_E539 ; ROM $002542: F0 05 ; Routine: Gameplay_DecrementSoundChannelIndex_E534 ; Global: Reachable code entry at CPU $E534 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_DecrementSoundChannelIndex_E534: dec $B3 ; ROM $002544: C6 B3 bpl Gameplay_ReadSoundChannelIndex_E52E ; ROM $002546: 10 F6 rts ; ROM $002548: 60 ; Routine: Gameplay_ReadZpBC_E539 ; Global: Reachable code entry at CPU $E539 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadZpBC_E539: txa ; ROM $002549: 8A asl a ; ROM $00254A: 0A tax ; ROM $00254B: AA lda $BC,x ; ROM $00254C: B5 BC sta $C2 ; ROM $00254E: 85 C2 lda $BD,x ; ROM $002550: B5 BD sta $C3 ; ROM $002552: 85 C3 ora $C2 ; ROM $002554: 05 C2 beq Gameplay_DecrementSoundChannelIndex_E534 ; ROM $002556: F0 EC jsr Gameplay_ReadSoundChannelIndex_E54E ; ROM $002558: 20 4E E5 jmp Gameplay_DecrementSoundChannelIndex_E534 ; ROM $00255B: 4C 34 E5 ; Routine: Gameplay_ReadSoundChannelIndex_E54E ; Global: Reachable code entry at CPU $E54E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadSoundChannelIndex_E54E: ldx $B3 ; ROM $00255E: A6 B3 ldy $C4,x ; ROM $002560: B4 C4 lda ($C2),y ; ROM $002562: B1 C2 sta $B4 ; ROM $002564: 85 B4 inc $C4,x ; ROM $002566: F6 C4 lda $B4 ; ROM $002568: A5 B4 bmi Gameplay_ReadSoundTempo_E5C7 ; ROM $00256A: 30 6B lda $B9,x ; ROM $00256C: B5 B9 sta $B6,x ; ROM $00256E: 95 B6 cpx #$02 ; ROM $002570: E0 02 beq Gameplay_HandleControl_E56E ; ROM $002572: F0 0A lsr a ; ROM $002574: 4A lsr a ; ROM $002575: 4A cmp #$10 ; ROM $002576: C9 10 bcc Gameplay_WriteZpD6_E573 ; ROM $002578: 90 09 lda #$0F ; ROM $00257A: A9 0F bne Gameplay_WriteZpD6_E573 ; ROM $00257C: D0 05 ; Routine: Gameplay_HandleControl_E56E ; Global: Reachable code entry at CPU $E56E traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_HandleControl_E56E: asl a ; ROM $00257E: 0A bpl Gameplay_WriteZpD6_E573 ; ROM $00257F: 10 02 lda #$7F ; ROM $002581: A9 7F ; Routine: Gameplay_WriteZpD6_E573 ; Global: Reachable code entry at CPU $E573 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_WriteZpD6_E573: sta $D6,x ; ROM $002583: 95 D6 lda $D0,x ; ROM $002585: B5 D0 beq Gameplay_ReadSoundDelay0_E57B ; ROM $002587: F0 02 lsr $D6,x ; ROM $002589: 56 D6 ; Routine: Gameplay_ReadSoundDelay0_E57B ; Global: Reachable code entry at CPU $E57B traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadSoundDelay0_E57B: ldy $E1,x ; ROM $00258B: B4 E1 bne Gameplay_ReturnToCaller_E5C6 ; ROM $00258D: D0 47 lda $B4 ; ROM $00258F: A5 B4 cmp #$00 ; ROM $002591: C9 00 beq Gameplay_ReturnToCaller_E5C6 ; ROM $002593: F0 41 txa ; ROM $002595: 8A asl a ; ROM $002596: 0A asl a ; ROM $002597: 0A tay ; ROM $002598: A8 lda $CD,x ; ROM $002599: B5 CD beq Gameplay_ReadZpD6_E59D ; ROM $00259B: F0 10 bpl Gameplay_HandleControl_E593 ; ROM $00259D: 10 04 inc $CD,x ; ROM $00259F: F6 CD beq Gameplay_ReadZpD6_E59D ; ROM $0025A1: F0 0A ; Routine: Gameplay_HandleControl_E593 ; Global: Reachable code entry at CPU $E593 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_HandleControl_E593: lda #$9F ; ROM $0025A3: A9 9F cpx #$02 ; ROM $0025A5: E0 02 bne Gameplay_UpdateAudioChannelPath_E5A1 ; ROM $0025A7: D0 08 lda #$7F ; ROM $0025A9: A9 7F bne Gameplay_UpdateAudioChannelPath_E5A1 ; ROM $0025AB: D0 04 ; Routine: Gameplay_ReadZpD6_E59D ; Global: Reachable code entry at CPU $E59D traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadZpD6_E59D: lda $D6,x ; ROM $0025AD: B5 D6 ora $D3,x ; ROM $0025AF: 15 D3 ; Routine: Gameplay_UpdateAudioChannelPath_E5A1 ; Global: Reachable code entry at CPU $E5A1 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_UpdateAudioChannelPath_E5A1: sta APUPULSE1CTRL,y ; ROM $0025B1: 99 00 40 lda $CD,x ; ROM $0025B4: B5 CD cmp #$02 ; ROM $0025B6: C9 02 bne Gameplay_UpdateAudioChannelPath_E5AB ; ROM $0025B8: D0 01 rts ; ROM $0025BA: 60 ; Routine: Gameplay_UpdateAudioChannelPath_E5AB ; Global: Reachable code entry at CPU $E5AB traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_UpdateAudioChannelPath_E5AB: cpx #$02 ; ROM $0025BB: E0 02 bcs Gameplay_UpdateAudioChannelPath_E5B4 ; ROM $0025BD: B0 05 lda $D9,x ; ROM $0025BF: B5 D9 sta APUPULSE1SWEEP,y ; ROM $0025C1: 99 01 40 ; Routine: Gameplay_UpdateAudioChannelPath_E5B4 ; Global: Reachable code entry at CPU $E5B4 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_UpdateAudioChannelPath_E5B4: lda $B4 ; ROM $0025C4: A5 B4 asl a ; ROM $0025C6: 0A tax ; ROM $0025C7: AA lda $E7E2,x ; ROM $0025C8: BD E2 E7 sta APUPULSE1TIMERLO,y ; ROM $0025CB: 99 02 40 lda $E7E3,x ; ROM $0025CE: BD E3 E7 ora #$08 ; ROM $0025D1: 09 08 sta APUPULSE1TIMERHI,y ; ROM $0025D3: 99 03 40 ; Routine: Gameplay_ReturnToCaller_E5C6 ; Global: Reachable code entry at CPU $E5C6 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReturnToCaller_E5C6: rts ; ROM $0025D6: 60 ; Routine: Gameplay_ReadSoundTempo_E5C7 ; Global: Reachable code entry at CPU $E5C7 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_ReadSoundTempo_E5C7: and #$F0 ; ROM $0025D7: 29 F0 cmp #$F0 ; ROM $0025D9: C9 F0 beq Gameplay_SubtractFromSoundTempo_E5D6 ; ROM $0025DB: F0 09 lda $B4 ; ROM $0025DD: A5 B4 and #$7F ; ROM $0025DF: 29 7F sta $B9,x ; ROM $0025E1: 95 B9 jmp Gameplay_ReadSoundChannelIndex_E54E ; ROM $0025E3: 4C 4E E5 ; Routine: Gameplay_SubtractFromSoundTempo_E5D6 ; Global: Reachable code entry at CPU $E5D6 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Gameplay_SubtractFromSoundTempo_E5D6: sec ; ROM $0025E6: 38 lda #$FF ; ROM $0025E7: A9 FF sbc $B4 ; ROM $0025E9: E5 B4 asl a ; ROM $0025EB: 0A tay ; ROM $0025EC: A8 lda $E5E7,y ; ROM $0025ED: B9 E7 E5 pha ; ROM $0025F0: 48 lda $E5E6,y ; ROM $0025F1: B9 E6 E5 pha ; ROM $0025F4: 48 rts ; ROM $0025F5: 60 ; Data region: CPU $E5E6-$E641; unreachable by direct recursive trace. GameplayAndSoundDataTables: .byte $F5, $E5, $FA, $E5, $01, $E6, $0F, $E6, $1A, $E6, $2C, $E6, $33, $E6, $3A, $E6 ; ROM $0025F6: F5 E5 FA E5 01 E6 0F E6 1A E6 2C E6 33 E6 3A E6 .byte $A9, $00, $85, $B5, $60, $A9, $00, $95, $C4, $4C, $4E, $E5, $B4, $C4, $B1, $C2 ; ROM $002606: A9 00 85 B5 60 A9 00 95 C4 4C 4E E5 B4 C4 B1 C2 .byte $95, $CA, $C8, $94, $C4, $94, $C7, $4C, $4E, $E5, $D6, $CA, $F0, $04, $B5, $C7 ; ROM $002616: 95 CA C8 94 C4 94 C7 4C 4E E5 D6 CA F0 04 B5 C7 .byte $95, $C4, $4C, $4E, $E5, $B5, $CD, $F0, $07, $A9, $02, $95, $CD, $4C, $4E, $E5 ; ROM $002626: 95 C4 4C 4E E5 B5 CD F0 07 A9 02 95 CD 4C 4E E5 .byte $A9, $01, $95, $CD, $4C, $4E, $E5, $A9, $FF, $95, $CD, $4C, $4E, $E5, $A9, $FF ; ROM $002636: A9 01 95 CD 4C 4E E5 A9 FF 95 CD 4C 4E E5 A9 FF .byte $95, $D0, $4C, $4E, $E5, $A9, $00, $95, $D0, $4C, $4E, $E5 ; ROM $002646: 95 D0 4C 4E E5 A9 00 95 D0 4C 4E E5 ; Routine: InitializeApu ; Global: Reachable code entry at CPU $E642 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. InitializeApu: lda #$00 ; ROM $002652: A9 00 sta APUDMCDIRECT ; ROM $002654: 8D 11 40 sta $E1 ; ROM $002657: 85 E1 sta $E2 ; ROM $002659: 85 E2 sta $E3 ; ROM $00265B: 85 E3 sta APUPULSE1CTRL ; ROM $00265D: 8D 00 40 sta APUPULSE2CTRL ; ROM $002660: 8D 04 40 sta APUTRIANGLECTRL ; ROM $002663: 8D 08 40 sta APUNOISECTRL ; ROM $002666: 8D 0C 40 lda #$0F ; ROM $002669: A9 0F sta APUSTATUS ; ROM $00266B: 8D 15 40 rts ; ROM $00266E: 60 ; Routine: SoundUpdate ; Global: Reachable code entry at CPU $E65F traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. SoundUpdate: ldx #$02 ; ROM $00266F: A2 02 ; Routine: Sound_ReadSoundDelay0_E661 ; Global: Reachable code entry at CPU $E661 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Sound_ReadSoundDelay0_E661: lda $E1,x ; ROM $002671: B5 E1 beq Sound_ReadSoundCommandState_E667 ; ROM $002673: F0 02 dec $E1,x ; ROM $002675: D6 E1 ; Routine: Sound_ReadSoundCommandState_E667 ; Global: Reachable code entry at CPU $E667 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Sound_ReadSoundCommandState_E667: dex ; ROM $002677: CA bpl Sound_ReadSoundDelay0_E661 ; ROM $002678: 10 F7 lda $DF ; ROM $00267A: A5 DF bmi Sound_ReadRamE6BC_E69C ; ROM $00267C: 30 2E cmp #$07 ; ROM $00267E: C9 07 bcs Sound_ReturnToCaller_E6AC ; ROM $002680: B0 3A cmp #$03 ; ROM $002682: C9 03 bcs Sound_WriteSoundCommandState_E681 ; ROM $002684: B0 0B ldx IndirectPtrLo ; ROM $002686: A6 E0 beq Sound_WriteSoundCommandState_E681 ; ROM $002688: F0 07 txa ; ROM $00268A: 8A ora #$80 ; ROM $00268B: 09 80 sta $DF ; ROM $00268D: 85 DF bne Sound_ReadRamE6BC_E69C ; ROM $00268F: D0 1B ; Routine: Sound_WriteSoundCommandState_E681 ; Global: Reachable code entry at CPU $E681 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Sound_WriteSoundCommandState_E681: sta IndirectPtrLo ; ROM $002691: 85 E0 ora #$80 ; ROM $002693: 09 80 sta $DF ; ROM $002695: 85 DF lda #$00 ; ROM $002697: A9 00 sta IndirectPtrHi ; ROM $002699: 85 E1 sta $E2 ; ROM $00269B: 85 E2 sta $E3 ; ROM $00269D: 85 E3 lda IndirectPtrLo ; ROM $00269F: A5 E0 asl a ; ROM $0026A1: 0A tax ; ROM $0026A2: AA lda $E6AE,x ; ROM $0026A3: BD AE E6 pha ; ROM $0026A6: 48 lda $E6AD,x ; ROM $0026A7: BD AD E6 pha ; ROM $0026AA: 48 rts ; ROM $0026AB: 60 ; Routine: Sound_ReadRamE6BC_E69C ; Global: Reachable code entry at CPU $E69C traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Sound_ReadRamE6BC_E69C: lda IndirectPtrLo ; ROM $0026AC: A5 E0 cmp #$07 ; ROM $0026AE: C9 07 bcs Sound_ReturnToCaller_E6AC ; ROM $0026B0: B0 0A asl a ; ROM $0026B2: 0A tax ; ROM $0026B3: AA lda $E6BC,x ; ROM $0026B4: BD BC E6 pha ; ROM $0026B7: 48 lda $E6BB,x ; ROM $0026B8: BD BB E6 pha ; ROM $0026BB: 48 ; Routine: Sound_ReturnToCaller_E6AC ; Global: Reachable code entry at CPU $E6AC traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Sound_ReturnToCaller_E6AC: rts ; ROM $0026BC: 60 ; Data region: CPU $E6AD-$E6C8; unreachable by direct recursive trace. SoundDispatchAddressTable: .byte $41, $E6, $C8, $E6, $CC, $E6, $DE, $E6, $27, $E7, $66, $E7, $92, $E7, $AB, $E6 ; ROM $0026BD: 41 E6 C8 E6 CC E6 DE E6 27 E7 66 E7 92 E7 AB E6 .byte $AB, $E6, $AB, $E6, $0A, $E7, $33, $E7, $AB, $E6, $9E, $E7 ; ROM $0026CD: AB E6 AB E6 0A E7 33 E7 AB E6 9E E7 ; Routine: ConfigureNoiseEffect ; Global: Reachable code entry at CPU $E6C9 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. ConfigureNoiseEffect: lda #$04 ; ROM $0026D9: A9 04 bne Sound_UpdateAudioChannelPath_E6CF ; ROM $0026DB: D0 02 ; Routine: Sound_HandleControl_E6CD ; Global: Reachable code entry at CPU $E6CD traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Sound_HandleControl_E6CD: lda #$0C ; ROM $0026DD: A9 0C ; Routine: Sound_UpdateAudioChannelPath_E6CF ; Global: Reachable code entry at CPU $E6CF traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Sound_UpdateAudioChannelPath_E6CF: sta APUNOISEPERIOD ; ROM $0026DF: 8D 0E 40 lda #$00 ; ROM $0026E2: A9 00 sta IndirectPtrLo ; ROM $0026E4: 85 E0 sta APUNOISECTRL ; ROM $0026E6: 8D 0C 40 lda #$10 ; ROM $0026E9: A9 10 sta APUNOISELENGTH ; ROM $0026EB: 8D 0F 40 rts ; ROM $0026EE: 60 ; Routine: Sound_UpdateAudioChannelPath_E6DF ; Global: Reachable code entry at CPU $E6DF traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Sound_UpdateAudioChannelPath_E6DF: lda #$10 ; ROM $0026EF: A9 10 sta $E2 ; ROM $0026F1: 85 E2 lda #$01 ; ROM $0026F3: A9 01 sta APUNOISECTRL ; ROM $0026F5: 8D 0C 40 lda #$0F ; ROM $0026F8: A9 0F sta APUNOISEPERIOD ; ROM $0026FA: 8D 0E 40 lda #$10 ; ROM $0026FD: A9 10 sta APUNOISELENGTH ; ROM $0026FF: 8D 0F 40 lda #$FF ; ROM $002702: A9 FF sta APUPULSE2CTRL ; ROM $002704: 8D 04 40 lda #$84 ; ROM $002707: A9 84 sta APUPULSE2SWEEP ; ROM $002709: 8D 05 40 lda #$00 ; ROM $00270C: A9 00 sta APUPULSE2TIMERLO ; ROM $00270E: 8D 06 40 lda #$02 ; ROM $002711: A9 02 sta APUPULSE2TIMERHI ; ROM $002713: 8D 07 40 lda #$04 ; ROM $002716: A9 04 sta $E4 ; ROM $002718: 85 E4 rts ; ROM $00271A: 60 ; Routine: Sound_UpdateAudioChannelPath_E70B ; Global: Reachable code entry at CPU $E70B traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Sound_UpdateAudioChannelPath_E70B: dec RandomStateAlt ; ROM $00271B: C6 E4 bne Sound_ReturnToCaller_E727 ; ROM $00271D: D0 18 lda #$DF ; ROM $00271F: A9 DF sta APUPULSE2CTRL ; ROM $002721: 8D 04 40 lda #$84 ; ROM $002724: A9 84 sta APUPULSE2SWEEP ; ROM $002726: 8D 05 40 lda #$00 ; ROM $002729: A9 00 sta APUPULSE2TIMERLO ; ROM $00272B: 8D 06 40 lda #$81 ; ROM $00272E: A9 81 sta APUPULSE2TIMERHI ; ROM $002730: 8D 07 40 lda #$00 ; ROM $002733: A9 00 sta IndirectPtrLo ; ROM $002735: 85 E0 ; Routine: Sound_ReturnToCaller_E727 ; Global: Reachable code entry at CPU $E727 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Sound_ReturnToCaller_E727: rts ; ROM $002737: 60 ; Routine: Sound_WriteSoundDelay1_E728 ; Global: Reachable code entry at CPU $E728 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Sound_WriteSoundDelay1_E728: lda #$FF ; ROM $002738: A9 FF sta $E2 ; ROM $00273A: 85 E2 lda #$00 ; ROM $00273C: A9 00 sta $E4 ; ROM $00273E: 85 E4 lda #$04 ; ROM $002740: A9 04 sta $E5 ; ROM $002742: 85 E5 ; Routine: Sound_ReadSoundEnvelopeCounter_E734 ; Global: Reachable code entry at CPU $E734 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Sound_ReadSoundEnvelopeCounter_E734: lda $E4 ; ROM $002744: A5 E4 bne Sound_DecrementSoundEnvelopeCounter_E760 ; ROM $002746: D0 28 lda $E5 ; ROM $002748: A5 E5 bne Sound_UpdateAudioChannelPath_E743 ; ROM $00274A: D0 07 lda #$00 ; ROM $00274C: A9 00 sta IndirectPtrLo ; ROM $00274E: 85 E0 sta $E2 ; ROM $002750: 85 E2 rts ; ROM $002752: 60 ; Routine: Sound_UpdateAudioChannelPath_E743 ; Global: Reachable code entry at CPU $E743 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Sound_UpdateAudioChannelPath_E743: dec $E5 ; ROM $002753: C6 E5 lda #$84 ; ROM $002755: A9 84 sta APUPULSE2CTRL ; ROM $002757: 8D 04 40 lda #$8B ; ROM $00275A: A9 8B sta APUPULSE2SWEEP ; ROM $00275C: 8D 05 40 ldx $E5 ; ROM $00275F: A6 E5 lda SoundHandlerData,x ; ROM $002761: BD 63 E7 sta APUPULSE2TIMERLO ; ROM $002764: 8D 06 40 lda #$10 ; ROM $002767: A9 10 sta APUPULSE2TIMERHI ; ROM $002769: 8D 07 40 lda #$04 ; ROM $00276C: A9 04 sta $E4 ; ROM $00276E: 85 E4 ; Routine: Sound_DecrementSoundEnvelopeCounter_E760 ; Global: Reachable code entry at CPU $E760 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Sound_DecrementSoundEnvelopeCounter_E760: dec $E4 ; ROM $002770: C6 E4 rts ; ROM $002772: 60 ; Data region: CPU $E763-$E766; unreachable by direct recursive trace. SoundHandlerData: .byte $65, $87, $B4, $F0 ; ROM $002773: 65 87 B4 F0 ; Routine: Sound_UpdateAudioChannelPath_E767 ; Global: Reachable code entry at CPU $E767 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Sound_UpdateAudioChannelPath_E767: lda #$30 ; ROM $002777: A9 30 sta $E2 ; ROM $002779: 85 E2 lda #$09 ; ROM $00277B: A9 09 sta APUNOISECTRL ; ROM $00277D: 8D 0C 40 lda #$07 ; ROM $002780: A9 07 sta APUNOISEPERIOD ; ROM $002782: 8D 0E 40 lda #$30 ; ROM $002785: A9 30 sta APUNOISELENGTH ; ROM $002787: 8D 0F 40 lda #$1F ; ROM $00278A: A9 1F sta APUPULSE2CTRL ; ROM $00278C: 8D 04 40 lda #$8F ; ROM $00278F: A9 8F sta APUPULSE2SWEEP ; ROM $002791: 8D 05 40 lda #$00 ; ROM $002794: A9 00 sta APUPULSE2TIMERLO ; ROM $002796: 8D 06 40 lda #$33 ; ROM $002799: A9 33 sta APUPULSE2TIMERHI ; ROM $00279B: 8D 07 40 lda #$00 ; ROM $00279E: A9 00 sta IndirectPtrLo ; ROM $0027A0: 85 E0 rts ; ROM $0027A2: 60 ; Routine: Sound_WriteSoundEnvelopeCounter_E793 ; Global: Reachable code entry at CPU $E793 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Sound_WriteSoundEnvelopeCounter_E793: lda #$1D ; ROM $0027A3: A9 1D sta $E4 ; ROM $0027A5: 85 E4 lda #$FF ; ROM $0027A7: A9 FF sta IndirectPtrHi ; ROM $0027A9: 85 E1 sta $E2 ; ROM $0027AB: 85 E2 sta $E3 ; ROM $0027AD: 85 E3 ; Routine: Sound_UpdateAudioChannelPath_E79F ; Global: Reachable code entry at CPU $E79F traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Sound_UpdateAudioChannelPath_E79F: dec $E4 ; ROM $0027AF: C6 E4 beq Sound_HandleControl_E7D1 ; ROM $0027B1: F0 2E lda $E4 ; ROM $0027B3: A5 E4 and #$03 ; ROM $0027B5: 29 03 bne Sound_ReturnToCaller_E7D0 ; ROM $0027B7: D0 27 lda $E4 ; ROM $0027B9: A5 E4 lsr a ; ROM $0027BB: 4A lsr a ; ROM $0027BC: 4A and #$01 ; ROM $0027BD: 29 01 tax ; ROM $0027BF: AA lda $E7DE,x ; ROM $0027C0: BD DE E7 sta APUPULSE1TIMERLO ; ROM $0027C3: 8D 02 40 lda $E7E0,x ; ROM $0027C6: BD E0 E7 sta APUPULSE2TIMERLO ; ROM $0027C9: 8D 06 40 lda #$08 ; ROM $0027CC: A9 08 sta APUPULSE1CTRL ; ROM $0027CE: 8D 00 40 sta APUPULSE2CTRL ; ROM $0027D1: 8D 04 40 sta APUPULSE1SWEEP ; ROM $0027D4: 8D 01 40 sta APUPULSE2SWEEP ; ROM $0027D7: 8D 05 40 sta APUPULSE1TIMERHI ; ROM $0027DA: 8D 03 40 sta APUPULSE2TIMERHI ; ROM $0027DD: 8D 07 40 ; Routine: Sound_ReturnToCaller_E7D0 ; Global: Reachable code entry at CPU $E7D0 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Sound_ReturnToCaller_E7D0: rts ; ROM $0027E0: 60 ; Routine: Sound_HandleControl_E7D1 ; Global: Reachable code entry at CPU $E7D1 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. Sound_HandleControl_E7D1: lda #$20 ; ROM $0027E1: A9 20 sta SoundDelay0 ; ROM $0027E3: 85 E1 sta SoundDelay1 ; ROM $0027E5: 85 E2 sta SoundDelay2 ; ROM $0027E7: 85 E3 lda #$00 ; ROM $0027E9: A9 00 sta SoundDispatchIndex ; ROM $0027EB: 85 E0 rts ; ROM $0027ED: 60 ; Data region: CPU $E7DE-$FFF8; unreachable by direct recursive trace. SoundSequenceAndPaddingData: .byte $A9, $A0, $6A, $64, $00, $00, $F0, $07, $7E, $07, $12, $07, $AE, $06, $4E, $06 ; ROM $0027EE: A9 A0 6A 64 00 00 F0 07 7E 07 12 07 AE 06 4E 06 .byte $F3, $05, $9F, $05, $4D, $05, $01, $05, $B9, $04, $75, $04, $35, $04, $F8, $03 ; ROM $0027FE: F3 05 9F 05 4D 05 01 05 B9 04 75 04 35 04 F8 03 .byte $BF, $03, $89, $03, $57, $03, $27, $03, $F9, $02, $CF, $02, $A6, $02, $80, $02 ; ROM $00280E: BF 03 89 03 57 03 27 03 F9 02 CF 02 A6 02 80 02 .byte $5C, $02, $3A, $02, $1A, $02, $FC, $01, $DF, $01, $C4, $01, $AB, $01, $93, $01 ; ROM $00281E: 5C 02 3A 02 1A 02 FC 01 DF 01 C4 01 AB 01 93 01 .byte $7C, $01, $67, $01, $52, $01, $3F, $01, $2D, $01, $1C, $01, $0C, $01, $FD, $00 ; ROM $00282E: 7C 01 67 01 52 01 3F 01 2D 01 1C 01 0C 01 FD 00 .byte $EE, $00, $E1, $00, $D4, $00, $C8, $00, $BD, $00, $B2, $00, $A8, $00, $9F, $00 ; ROM $00283E: EE 00 E1 00 D4 00 C8 00 BD 00 B2 00 A8 00 9F 00 .byte $96, $00, $8D, $00, $85, $00, $7E, $00, $76, $00, $70, $00, $69, $00, $63, $00 ; ROM $00284E: 96 00 8D 00 85 00 7E 00 76 00 70 00 69 00 63 00 .byte $5E, $00, $58, $00, $53, $00, $4F, $00, $4A, $00, $46, $00, $42, $00, $3E, $00 ; ROM $00285E: 5E 00 58 00 53 00 4F 00 4A 00 46 00 42 00 3E 00 .byte $3A, $00, $37, $00, $34, $00, $31, $00, $2E, $00, $2B, $00, $29, $00, $27, $00 ; ROM $00286E: 3A 00 37 00 34 00 31 00 2E 00 2B 00 29 00 27 00 .byte $24, $00, $22, $00, $20, $00, $1E, $00, $1C, $00, $1B, $00, $1A, $00, $17, $EB ; ROM $00287E: 24 00 22 00 20 00 1E 00 1C 00 1B 00 1A 00 17 EB .byte $85, $EB, $EA, $EB, $80, $80, $BC, $EC, $DC, $EC, $FC, $EC, $40, $40, $00, $00 ; ROM $00288E: 85 EB EA EB 80 80 BC EC DC EC FC EC 40 40 00 00 .byte $00, $00, $9C, $ED, $80, $80, $4D, $ED, $7B, $ED, $18, $ED, $80, $80, $50, $EC ; ROM $00289E: 00 00 9C ED 80 80 4D ED 7B ED 18 ED 80 80 50 EC .byte $7E, $EC, $AC, $EC, $80, $80, $27, $EA, $63, $EA, $9F, $EA, $80, $80, $CC, $E8 ; ROM $0028AE: 7E EC AC EC 80 80 27 EA 63 EA 9F EA 80 80 CC E8 .byte $1C, $E9, $70, $E9, $40, $00, $E1, $EA, $FF, $EA, $00, $00, $80, $80, $A2, $E9 ; ROM $0028BE: 1C E9 70 E9 40 00 E1 EA FF EA 00 00 80 80 A2 E9 .byte $D5, $E9, $FF, $E9, $80, $80, $03, $E9, $57, $E9, $88, $E9, $40, $00, $B0, $29 ; ROM $0028CE: D5 E9 FF E9 80 80 03 E9 57 E9 88 E9 40 00 B0 29 .byte $AA, $29, $86, $29, $A4, $30, $86, $30, $35, $F9, $8C, $2E, $F8, $98, $2D, $86 ; ROM $0028DE: AA 29 86 29 A4 30 86 30 35 F9 8C 2E F8 98 2D 86 .byte $2D, $2E, $8C, $2D, $C8, $2B, $86, $32, $33, $8C, $32, $B0, $30, $8C, $00, $26 ; ROM $0028EE: 2D 2E 8C 2D C8 2B 86 32 33 8C 32 B0 30 8C 00 26 .byte $28, $B0, $29, $AA, $29, $86, $29, $A4, $30, $86, $30, $35, $F9, $8C, $2E, $F8 ; ROM $0028FE: 28 B0 29 AA 29 86 29 A4 30 86 30 35 F9 8C 2E F8 .byte $98, $2D, $86, $2D, $2E, $8C, $2D, $2B, $32, $33, $30, $00, $92, $30, $83, $32 ; ROM $00290E: 98 2D 86 2D 2E 8C 2D 2B 32 33 30 00 92 30 83 32 .byte $34, $8C, $35, $00, $1D, $86, $1D, $1D, $8C, $1D, $00, $98, $00, $FF, $B0, $21 ; ROM $00291E: 34 8C 35 00 1D 86 1D 1D 8C 1D 00 98 00 FF B0 21 .byte $AA, $21, $86, $21, $A4, $2D, $86, $2D, $30, $F9, $8C, $29, $F8, $98, $29, $86 ; ROM $00292E: AA 21 86 21 A4 2D 86 2D 30 F9 8C 29 F8 98 29 86 .byte $24, $29, $8C, $24, $C8, $27, $86, $2E, $2B, $8C, $2E, $28, $92, $24, $86, $24 ; ROM $00293E: 24 29 8C 24 C8 27 86 2E 2B 8C 2E 28 92 24 86 24 .byte $8C, $24, $24, $24, $24, $B0, $21, $AA, $21, $86, $21, $A4, $2D, $86, $2D, $30 ; ROM $00294E: 8C 24 24 24 24 B0 21 AA 21 86 21 A4 2D 86 2D 30 .byte $F9, $8C, $29, $F8, $98, $29, $86, $24, $29, $8C, $29, $26, $2B, $2E, $28, $00 ; ROM $00295E: F9 8C 29 F8 98 29 86 24 29 8C 29 26 2B 2E 28 00 .byte $92, $28, $83, $29, $2B, $8C, $2D, $00, $11, $86, $11, $11, $8C, $11, $00, $98 ; ROM $00296E: 92 28 83 29 2B 8C 2D 00 11 86 11 11 8C 11 00 98 .byte $00, $FF, $F9, $FD, $02, $98, $1D, $1C, $1A, $18, $FC, $1B, $1A, $18, $16, $18 ; ROM $00297E: 00 FF F9 FD 02 98 1D 1C 1A 18 FC 1B 1A 18 16 18 .byte $18, $1A, $1C, $FD, $02, $1D, $1C, $1A, $18, $FC, $F8, $8C, $1F, $1D, $1B, $2B ; ROM $00298E: 18 1A 1C FD 02 1D 1C 1A 18 FC F8 8C 1F 1D 1B 2B .byte $18, $00, $92, $18, $83, $18, $18, $8C, $29, $00, $11, $86, $11, $11, $8C, $11 ; ROM $00299E: 18 00 92 18 83 18 18 8C 29 00 11 86 11 11 8C 11 .byte $00, $98, $00, $FF, $98, $28, $92, $24, $86, $24, $98, $27, $92, $24, $86, $24 ; ROM $0029AE: 00 98 00 FF 98 28 92 24 86 24 98 27 92 24 86 24 .byte $28, $29, $2A, $2B, $F9, $8C, $28, $24, $F8, $98, $22, $29, $28, $92, $24, $86 ; ROM $0029BE: 28 29 2A 2B F9 8C 28 24 F8 98 22 29 28 92 24 86 .byte $24, $98, $27, $92, $24, $86, $24, $8C, $22, $84, $21, $20, $1F, $F9, $8C, $22 ; ROM $0029CE: 24 98 27 92 24 86 24 8C 22 84 21 20 1F F9 8C 22 .byte $23, $F8, $24, $00, $98, $00, $FF, $E0, $00, $86, $1F, $21, $22, $23, $F9, $8C ; ROM $0029DE: 23 F8 24 00 98 00 FF E0 00 86 1F 21 22 23 F9 8C .byte $1F, $1C, $F8, $98, $1D, $22, $1F, $92, $1C, $86, $1C, $98, $1E, $92, $1B, $86 ; ROM $0029EE: 1F 1C F8 98 1D 22 1F 92 1C 86 1C 98 1E 92 1B 86 .byte $1E, $8C, $16, $84, $15, $14, $13, $F9, $8C, $16, $17, $F8, $18, $00, $0C, $00 ; ROM $0029FE: 1E 8C 16 84 15 14 13 F9 8C 16 17 F8 18 00 0C 00 .byte $FF, $8C, $18, $1F, $00, $1F, $18, $1F, $00, $1F, $18, $1F, $00, $1F, $14, $1B ; ROM $002A0E: FF 8C 18 1F 00 1F 18 1F 00 1F 18 1F 00 1F 14 1B .byte $00, $1B, $18, $1F, $00, $1F, $14, $1B, $00, $1B, $16, $84, $15, $14, $13, $F9 ; ROM $002A1E: 00 1B 18 1F 00 1F 14 1B 00 1B 16 84 15 14 13 F9 .byte $8C, $16, $17, $F8, $18, $00, $0C, $00, $FF, $94, $00, $85, $2C, $2C, $33, $33 ; ROM $002A2E: 8C 16 17 F8 18 00 0C 00 FF 94 00 85 2C 2C 33 33 .byte $8A, $33, $00, $85, $2C, $2C, $33, $33, $32, $32, $30, $30, $2E, $2E, $29, $29 ; ROM $002A3E: 8A 33 00 85 2C 2C 33 33 32 32 30 30 2E 2E 29 29 .byte $26, $26, $24, $24, $94, $22, $00, $85, $31, $31, $36, $36, $8A, $36, $00, $85 ; ROM $002A4E: 26 26 24 24 94 22 00 85 31 31 36 36 8A 36 00 85 .byte $31, $31, $3A, $3A, $37, $37, $35, $35, $33, $33, $31, $31, $30, $30, $2E, $2E ; ROM $002A5E: 31 31 3A 3A 37 37 35 35 33 33 31 31 30 30 2E 2E .byte $2C, $2C, $2B, $2B, $FE, $94, $00, $85, $24, $24, $30, $30, $8A, $30, $00, $85 ; ROM $002A6E: 2C 2C 2B 2B FE 94 00 85 24 24 30 30 8A 30 00 85 .byte $24, $24, $30, $30, $2E, $2E, $2D, $2D, $29, $29, $26, $26, $22, $22, $1D, $1D ; ROM $002A7E: 24 24 30 30 2E 2E 2D 2D 29 29 26 26 22 22 1D 1D .byte $94, $1A, $00, $85, $2E, $2E, $31, $31, $8A, $31, $00, $85, $2E, $2E, $31, $31 ; ROM $002A8E: 94 1A 00 85 2E 2E 31 31 8A 31 00 85 2E 2E 31 31 .byte $33, $33, $31, $31, $30, $30, $2E, $2E, $2C, $2C, $2B, $2B, $24, $24, $22, $22 ; ROM $002A9E: 33 33 31 31 30 30 2E 2E 2C 2C 2B 2B 24 24 22 22 .byte $FE, $85, $14, $14, $20, $20, $2C, $2C, $20, $20, $14, $14, $20, $20, $2C, $2C ; ROM $002AAE: FE 85 14 14 20 20 2C 2C 20 20 14 14 20 20 2C 2C .byte $20, $20, $16, $16, $22, $22, $2E, $2E, $22, $22, $16, $16, $22, $22, $16, $16 ; ROM $002ABE: 20 20 16 16 22 22 2E 2E 22 22 16 16 22 22 16 16 .byte $22, $22, $12, $12, $1E, $1E, $2A, $2A, $1E, $1E, $12, $12, $1E, $1E, $2A, $2A ; ROM $002ACE: 22 22 12 12 1E 1E 2A 2A 1E 1E 12 12 1E 1E 2A 2A .byte $1E, $1E, $0F, $0F, $1B, $1B, $27, $27, $1B, $1B, $0F, $0F, $1B, $1B, $27, $27 ; ROM $002ADE: 1E 1E 0F 0F 1B 1B 27 27 1B 1B 0F 0F 1B 1B 27 27 .byte $25, $25, $FE, $83, $30, $2B, $24, $1F, $18, $13, $0C, $07, $18, $17, $16, $15 ; ROM $002AEE: 25 25 FE 83 30 2B 24 1F 18 13 0C 07 18 17 16 15 .byte $14, $15, $16, $17, $92, $18, $86, $18, $F9, $8C, $1B, $1B, $F8, $98, $18, $00 ; ROM $002AFE: 14 15 16 17 92 18 86 18 F9 8C 1B 1B F8 98 18 00 .byte $FF, $98, $00, $83, $0C, $0B, $0A, $09, $08, $09, $0A, $0B, $92, $0C, $86, $0C ; ROM $002B0E: FF 98 00 83 0C 0B 0A 09 08 09 0A 0B 92 0C 86 0C .byte $F9, $8C, $0F, $0F, $F8, $98, $0C, $00, $FF, $87, $27, $33, $3F, $33, $36, $37 ; ROM $002B1E: F9 8C 0F 0F F8 98 0C 00 FF 87 27 33 3F 33 36 37 .byte $33, $31, $27, $33, $3F, $33, $36, $37, $33, $31, $16, $16, $F9, $8E, $16, $F8 ; ROM $002B2E: 33 31 27 33 3F 33 36 37 33 31 16 16 F9 8E 16 F8 .byte $87, $22, $22, $F9, $8E, $2E, $0D, $0F, $F8, $87, $38, $2E, $33, $38, $FD, $03 ; ROM $002B3E: 87 22 22 F9 8E 2E 0D 0F F8 87 38 2E 33 38 FD 03 .byte $F9, $8E, $37, $33, $32, $33, $F8, $9C, $2E, $87, $2C, $2E, $2A, $2B, $8E, $00 ; ROM $002B4E: F9 8E 37 33 32 33 F8 9C 2E 87 2C 2E 2A 2B 8E 00 .byte $3A, $00, $3A, $87, $33, $33, $F9, $8E, $33, $F8, $87, $38, $2E, $33, $38, $FC ; ROM $002B5E: 3A 00 3A 87 33 33 F9 8E 33 F8 87 38 2E 33 38 FC .byte $F9, $8E, $37, $F8, $87, $32, $33, $2C, $2E, $F9, $8E, $2B, $F8, $87, $2C, $2C ; ROM $002B6E: F9 8E 37 F8 87 32 33 2C 2E F9 8E 2B F8 87 2C 2C .byte $F9, $8E, $2C, $F8, $87, $2B, $2B, $F9, $8E, $2B, $27, $27, $00, $F8, $87, $25 ; ROM $002B7E: F9 8E 2C F8 87 2B 2B F9 8E 2B 27 27 00 F8 87 25 .byte $26, $8E, $27, $00, $9C, $00, $FF, $87, $1B, $27, $33, $27, $2A, $2B, $27, $25 ; ROM $002B8E: 26 8E 27 00 9C 00 FF 87 1B 27 33 27 2A 2B 27 25 .byte $1B, $27, $33, $27, $2A, $2B, $27, $25, $13, $13, $F9, $8E, $13, $F8, $87, $1F ; ROM $002B9E: 1B 27 33 27 2A 2B 27 25 13 13 F9 8E 13 F8 87 1F .byte $1F, $F9, $8E, $2B, $01, $02, $F8, $87, $2C, $22, $27, $2C, $FD, $03, $F9, $8E ; ROM $002BAE: 1F F9 8E 2B 01 02 F8 87 2C 22 27 2C FD 03 F9 8E .byte $31, $2E, $2A, $2B, $F8, $9C, $25, $00, $8E, $27, $22, $25, $2C, $9C, $2B, $87 ; ROM $002BBE: 31 2E 2A 2B F8 9C 25 00 8E 27 22 25 2C 9C 2B 87 .byte $35, $22, $30, $33, $FC, $F9, $8E, $33, $F8, $87, $2A, $2B, $26, $27, $F9, $8E ; ROM $002BCE: 35 22 30 33 FC F9 8E 33 F8 87 2A 2B 26 27 F9 8E .byte $22, $F8, $87, $27, $27, $F9, $8E, $27, $F8, $87, $27, $27, $F9, $8E, $27, $1F ; ROM $002BDE: 22 F8 87 27 27 F9 8E 27 F8 87 27 27 F9 8E 27 1F .byte $1F, $00, $F8, $87, $19, $1A, $8E, $1B, $00, $9C, $00, $FF, $87, $1B, $1B, $1B ; ROM $002BEE: 1F 00 F8 87 19 1A 8E 1B 00 9C 00 FF 87 1B 1B 1B .byte $1B, $9C, $00, $87, $1B, $1B, $1B, $1B, $9C, $00, $87, $19, $19, $F9, $8E, $19 ; ROM $002BFE: 1B 9C 00 87 1B 1B 1B 1B 9C 00 87 19 19 F9 8E 19 .byte $F8, $87, $25, $25, $F9, $8E, $32, $F8, $B8, $00, $FD, $03, $87, $1B, $1B, $F9 ; ROM $002C0E: F8 87 25 25 F9 8E 32 F8 B8 00 FD 03 87 1B 1B F9 .byte $8E, $1B, $1E, $F8, $87, $1F, $22, $27, $1B, $1B, $1B, $1E, $F9, $8E, $1F, $F8 ; ROM $002C1E: 8E 1B 1E F8 87 1F 22 27 1B 1B 1B 1E F9 8E 1F F8 .byte $87, $18, $19, $19, $19, $25, $18, $1A, $8E, $16, $87, $25, $19, $19, $19, $9C ; ROM $002C2E: 87 18 19 19 19 25 18 1A 8E 16 87 25 19 19 19 9C .byte $00, $FC, $F9, $8E, $2E, $F8, $87, $2D, $2E, $2A, $2B, $27, $22, $9C, $00, $87 ; ROM $002C3E: 00 FC F9 8E 2E F8 87 2D 2E 2A 2B 27 22 9C 00 87 .byte $23, $23, $F9, $8E, $23, $22, $22, $F8, $00, $87, $19, $1A, $8E, $1B, $00, $9C ; ROM $002C4E: 23 23 F9 8E 23 22 22 F8 00 87 19 1A 8E 1B 00 9C .byte $00, $FF, $FD, $02, $90, $25, $88, $27, $29, $00, $29, $2B, $00, $FC, $C0, $00 ; ROM $002C5E: 00 FF FD 02 90 25 88 27 29 00 29 2B 00 FC C0 00 .byte $88, $22, $19, $22, $20, $1F, $19, $1F, $20, $FD, $02, $27, $29, $27, $2A, $00 ; ROM $002C6E: 88 22 19 22 20 1F 19 1F 20 FD 02 27 29 27 2A 00 .byte $29, $27, $00, $FC, $C0, $00, $88, $20, $17, $20, $1E, $1D, $17, $1D, $1F, $FE ; ROM $002C7E: 29 27 00 FC C0 00 88 20 17 20 1E 1D 17 1D 1F FE .byte $FD, $02, $90, $22, $88, $24, $26, $00, $26, $27, $00, $FC, $FD, $02, $1B, $13 ; ROM $002C8E: FD 02 90 22 88 24 26 00 26 27 00 FC FD 02 1B 13 .byte $1B, $19, $18, $13, $18, $19, $FC, $FD, $02, $23, $25, $23, $27, $00, $25, $23 ; ROM $002C9E: 1B 19 18 13 18 19 FC FD 02 23 25 23 27 00 25 23 .byte $00, $FC, $FD, $02, $19, $11, $19, $17, $16, $11, $16, $19, $FC, $FE, $FD, $04 ; ROM $002CAE: 00 FC FD 02 19 11 19 17 16 11 16 19 FC FE FD 04 .byte $90, $1B, $1B, $1B, $1B, $FC, $FD, $04, $19, $19, $19, $19, $FC, $FE, $85, $33 ; ROM $002CBE: 90 1B 1B 1B 1B FC FD 04 19 19 19 19 FC FE 85 33 .byte $00, $32, $33, $32, $33, $32, $33, $2E, $00, $2D, $2E, $2D, $2E, $2D, $2E, $2B ; ROM $002CCE: 00 32 33 32 33 32 33 2E 00 2D 2E 2D 2E 2D 2E 2B .byte $2C, $2D, $2E, $2B, $2C, $2D, $2E, $2B, $00, $27, $00, $94, $25, $FF, $85, $2B ; ROM $002CDE: 2C 2D 2E 2B 2C 2D 2E 2B 00 27 00 94 25 FF 85 2B .byte $00, $2A, $2B, $2A, $2B, $2A, $2B, $27, $00, $26, $27, $26, $27, $26, $27, $27 ; ROM $002CEE: 00 2A 2B 2A 2B 2A 2B 27 00 26 27 26 27 26 27 27 .byte $29, $2A, $2B, $27, $29, $2A, $2B, $27, $00, $1F, $00, $94, $22, $FF, $F9, $8A ; ROM $002CFE: 29 2A 2B 27 29 2A 2B 27 00 1F 00 94 22 FF F9 8A .byte $1B, $1B, $1F, $22, $1B, $1B, $1F, $22, $F8, $85, $22, $24, $26, $27, $22, $24 ; ROM $002D0E: 1B 1B 1F 22 1B 1B 1F 22 F8 85 22 24 26 27 22 24 .byte $26, $27, $F9, $8A, $22, $1B, $F8, $94, $16, $FF, $FD, $02, $87, $27, $27, $F9 ; ROM $002D1E: 26 27 F9 8A 22 1B F8 94 16 FF FD 02 87 27 27 F9 .byte $8E, $30, $31, $F8, $87, $22, $22, $F9, $8E, $2E, $30, $F8, $87, $31, $30, $F9 ; ROM $002D2E: 8E 30 31 F8 87 22 22 F9 8E 2E 30 F8 87 31 30 F9 .byte $8E, $2E, $F8, $FC, $FD, $02, $87, $25, $25, $F9, $8E, $2E, $2F, $F8, $87, $20 ; ROM $002D3E: 8E 2E F8 FC FD 02 87 25 25 F9 8E 2E 2F F8 87 20 .byte $20, $F9, $8E, $2C, $2E, $F8, $87, $2F, $2E, $F9, $8E, $2C, $F8, $FC, $FE, $9C ; ROM $002D4E: 20 F9 8E 2C 2E F8 87 2F 2E F9 8E 2C F8 FC FE 9C .byte $00, $87, $25, $95, $00, $B8, $00, $9C, $00, $95, $27, $87, $27, $F9, $8E, $2C ; ROM $002D5E: 00 87 25 95 00 B8 00 9C 00 95 27 87 27 F9 8E 2C .byte $2B, $F8, $27, $00, $9C, $00, $87, $23, $95, $00, $B8, $00, $9C, $00, $95, $25 ; ROM $002D6E: 2B F8 27 00 9C 00 87 23 95 00 B8 00 9C 00 95 25 .byte $87, $25, $F9, $8E, $2A, $F8, $87, $29, $2A, $8E, $25, $00, $FE, $9C, $00, $87 ; ROM $002D7E: 87 25 F9 8E 2A F8 87 29 2A 8E 25 00 FE 9C 00 87 .byte $1D, $95, $00, $B8, $00, $9C, $00, $87, $1D, $95, $00, $B8, $00, $9C, $00, $87 ; ROM $002D8E: 1D 95 00 B8 00 9C 00 87 1D 95 00 B8 00 9C 00 87 .byte $1B, $95, $00, $B8, $00, $9C, $00, $87, $1B, $95, $00, $B8, $00, $FE, $87, $27 ; ROM $002D9E: 1B 95 00 B8 00 9C 00 87 1B 95 00 B8 00 FE 87 27 .byte $27, $33, $27, $F9, $8E, $2A, $F8, $87, $2E, $30, $F9, $8E, $31, $31, $F8, $30 ; ROM $002DAE: 27 33 27 F9 8E 2A F8 87 2E 30 F9 8E 31 31 F8 30 .byte $00, $87, $25, $25, $31, $25, $F9, $8E, $29, $F8, $87, $2C, $2E, $F9, $8E, $2F ; ROM $002DBE: 00 87 25 25 31 25 F9 8E 29 F8 87 2C 2E F9 8E 2F .byte $F8, $87, $2E, $2F, $25, $24, $F9, $8E, $25, $F8, $87, $22, $22, $2E, $22, $F9 ; ROM $002DCE: F8 87 2E 2F 25 24 F9 8E 25 F8 87 22 22 2E 22 F9 .byte $8E, $2C, $F8, $87, $2B, $2C, $F9, $8E, $22, $2E, $F8, $22, $00, $87, $22, $22 ; ROM $002DDE: 8E 2C F8 87 2B 2C F9 8E 22 2E F8 22 00 87 22 22 .byte $2E, $22, $F9, $8E, $2C, $F8, $87, $2B, $2C, $F9, $8E, $22, $2E, $F8, $87, $22 ; ROM $002DEE: 2E 22 F9 8E 2C F8 87 2B 2C F9 8E 22 2E F8 87 22 .byte $22, $24, $26, $FE, $3D, $01, $03, $81, $03, $80, $1B, $04, $06, $84, $1B, $04 ; ROM $002DFE: 22 24 26 FE 3D 01 03 81 03 80 1B 04 06 84 1B 04 .byte $02, $05, $34, $01, $08, $41, $13, $01, $01, $00, $06, $01, $01, $00, $0F, $01 ; ROM $002E0E: 02 05 34 01 08 41 13 01 01 00 06 01 01 00 0F 01 .byte $01, $00, $03, $01, $01, $00, $11, $01, $06, $81, $1B, $01, $03, $81, $0E, $01 ; ROM $002E1E: 01 00 03 01 01 00 11 01 06 81 1B 01 03 81 0E 01 .byte $1A, $00, $11, $01, $05, $81, $16, $01, $02, $00, $01, $01, $11, $04, $10, $00 ; ROM $002E2E: 1A 00 11 01 05 81 16 01 02 00 01 01 11 04 10 00 .byte $10, $40, $10, $00, $02, $04, $01, $00, $01, $04, $01, $00, $0E, $04, $01, $00 ; ROM $002E3E: 10 40 10 00 02 04 01 00 01 04 01 00 0E 04 01 00 .byte $02, $04, $01, $00, $01, $04, $38, $00, $1A, $04, $03, $00, $04, $02, $01, $00 ; ROM $002E4E: 02 04 01 00 01 04 38 00 1A 04 03 00 04 02 01 00 .byte $04, $80, $09, $00, $16, $02, $02, $00, $02, $04, $05, $02, $01, $00, $15, $04 ; ROM $002E5E: 04 80 09 00 16 02 02 00 02 04 05 02 01 00 15 04 .byte $3A, $00, $0A, $40, $17, $00, $0D, $04, $02, $00, $06, $80, $06, $00, $1D, $08 ; ROM $002E6E: 3A 00 0A 40 17 00 0D 04 02 00 06 80 06 00 1D 08 .byte $01, $00, $0C, $01, $02, $00, $09, $40, $0A, $00, $28, $02, $01, $00, $20, $02 ; ROM $002E7E: 01 00 0C 01 02 00 09 40 0A 00 28 02 01 00 20 02 .byte $1E, $04, $02, $84, $05, $80, $5D, $01, $06, $00, $1D, $02, $21, $08, $04, $00 ; ROM $002E8E: 1E 04 02 84 05 80 5D 01 06 00 1D 02 21 08 04 00 .byte $06, $80, $03, $00, $1A, $02, $02, $00, $0F, $08, $02, $00, $09, $40, $08, $00 ; ROM $002E9E: 06 80 03 00 1A 02 02 00 0F 08 02 00 09 40 08 00 .byte $08, $40, $14, $00, $0F, $08, $01, $00, $0D, $08, $01, $00, $01, $08, $01, $00 ; ROM $002EAE: 08 40 14 00 0F 08 01 00 0D 08 01 00 01 08 01 00 .byte $11, $08, $02, $00, $1E, $01, $06, $81, $15, $01, $05, $81, $19, $01, $06, $81 ; ROM $002EBE: 11 08 02 00 1E 01 06 81 15 01 05 81 19 01 06 81 .byte $06, $00, $1C, $04, $06, $84, $01, $81, $01, $01, $03, $00, $1B, $01, $01, $00 ; ROM $002ECE: 06 00 1C 04 06 84 01 81 01 01 03 00 1B 01 01 00 .byte $0E, $08, $01, $48, $08, $40, $17, $00, $0D, $04, $01, $84, $06, $80, $02, $00 ; ROM $002EDE: 0E 08 01 48 08 40 17 00 0D 04 01 84 06 80 02 00 .byte $1E, $02, $04, $82, $01, $80, $01, $00, $1F, $04, $05, $84, $1E, $04, $04, $84 ; ROM $002EEE: 1E 02 04 82 01 80 01 00 1F 04 05 84 1E 04 04 84 .byte $02, $80, $1C, $02, $02, $00, $0F, $08, $01, $00, $09, $40, $11, $00, $0F, $04 ; ROM $002EFE: 02 80 1C 02 02 00 0F 08 01 00 09 40 11 00 0F 04 .byte $01, $05, $01, $00, $04, $01, $09, $81, $14, $01, $06, $81, $19, $01, $01, $00 ; ROM $002F0E: 01 05 01 00 04 01 09 81 14 01 06 81 19 01 01 00 .byte $0E, $08, $03, $48, $01, $00, $06, $40, $14, $00, $06, $80, $02, $88, $04, $08 ; ROM $002F1E: 0E 08 03 48 01 00 06 40 14 00 06 80 02 88 04 08 .byte $01, $00, $08, $08, $01, $00, $03, $08, $02, $88, $01, $00, $02, $88, $01, $00 ; ROM $002F2E: 01 00 08 08 01 00 03 08 02 88 01 00 02 88 01 00 .byte $14, $08, $05, $88, $04, $08, $02, $00, $1B, $01, $07, $81, $18, $01, $06, $81 ; ROM $002F3E: 14 08 05 88 04 08 02 00 1B 01 07 81 18 01 06 81 .byte $15, $01, $02, $09, $10, $08, $0A, $40, $1A, $00, $0A, $04, $01, $00, $06, $04 ; ROM $002F4E: 15 01 02 09 10 08 0A 40 1A 00 0A 04 01 00 06 04 .byte $01, $00, $1E, $02, $06, $00, $10, $08, $03, $84, $FF, $FF, $FF, $FF, $FF, $FF ; ROM $002F5E: 01 00 1E 02 06 00 10 08 03 84 FF FF FF FF FF FF .byte $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF ; ROM $002F6E: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF .byte $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF ; ROM $002F7E: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF .byte $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF ; ROM $002F8E: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF .byte $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF ; ROM $002F9E: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF .byte $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF ; ROM $002FAE: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF .byte $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF ; ROM $002FBE: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF .byte $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF ; ROM $002FCE: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF .byte $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF ; ROM $002FDE: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF .byte $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF ; ROM $002FEE: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF .byte $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF ; ROM $002FFE: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF .byte $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FC, $00, $00, $1F, $F0 ; ROM $00300E: FF FF FF FF FF FF FF FF FF FF FF FC 00 00 1F F0 .byte $00, $1F, $FE, $00, $00, $07, $FF, $FF, $FF, $30, $00, $00, $3F, $FF, $E0, $07 ; ROM $00301E: 00 1F FE 00 00 07 FF FF FF 30 00 00 3F FF E0 07 .byte $F0, $3F, $F8, $1F, $F0, $1F, $FF, $FF, $C0, $00, $03, $FF, $C0, $FF, $FF, $C0 ; ROM $00302E: F0 3F F8 1F F0 1F FF FF C0 00 03 FF C0 FF FF C0 .byte $7F, $C7, $FF, $00, $00, $00, $FF, $F0, $00, $1F, $FF, $FE, $00, $00, $00, $00 ; ROM $00303E: 7F C7 FF 00 00 00 FF F0 00 1F FF FE 00 00 00 00 .byte $00, $00, $00, $7F, $F0, $00, $07, $FF, $FF, $C0, $01, $80, $FF, $00, $02, $80 ; ROM $00304E: 00 00 00 7F F0 00 07 FF FF C0 01 80 FF 00 02 80 .byte $3F, $FF, $F8, $00, $03, $FF, $FF, $FF, $FE, $00, $00, $1F, $FF, $FF, $F0, $01 ; ROM $00305E: 3F FF F8 00 03 FF FF FF FE 00 00 1F FF FF F0 01 .byte $FF, $FF, $F0, $00, $0F, $FF, $FF, $FF, $00, $07, $FF, $F0, $00, $FB, $FF, $F8 ; ROM $00306E: FF FF F0 00 0F FF FF FF 00 07 FF F0 00 FB FF F8 .byte $FF, $FF, $00, $00, $00, $01, $FF, $FF, $FF, $C0, $3F, $F8, $00, $00, $00, $00 ; ROM $00307E: FF FF 00 00 00 01 FF FF FF C0 3F F8 00 00 00 00 .byte $7F, $FF, $FF, $FF, $FF, $FF, $FE, $00, $00, $00, $00, $0F, $FF, $F0, $00, $03 ; ROM $00308E: 7F FF FF FF FF FF FE 00 00 00 00 0F FF F0 00 03 .byte $FF, $FF, $FF, $E0, $00, $00, $03, $FF, $FF, $F8, $00, $00, $00, $FF, $FF, $FF ; ROM $00309E: FF FF FF E0 00 00 03 FF FF F8 00 00 00 FF FF FF .byte $00, $00, $00, $00, $1F, $E0, $00, $00, $07, $FF, $FF, $FE, $00, $00, $01, $FF ; ROM $0030AE: 00 00 00 00 1F E0 00 00 07 FF FF FE 00 00 01 FF .byte $FE, $00, $00, $07, $FF, $FF, $FF, $F8, $00, $00, $00, $1F, $FF, $FF, $E0, $00 ; ROM $0030BE: FE 00 00 07 FF FF FF F8 00 00 00 1F FF FF E0 00 .byte $00, $01, $FF, $FF, $FF, $FF, $FF, $C0, $00, $00, $00, $00, $0F, $FF, $FF, $FF ; ROM $0030CE: 00 01 FF FF FF FF FF C0 00 00 00 00 0F FF FF FF .byte $FE, $00, $00, $07, $E0, $00, $00, $00, $00, $7F, $FF, $EF, $FF, $FF, $FF, $FF ; ROM $0030DE: FE 00 00 07 E0 00 00 00 00 7F FF EF FF FF FF FF .byte $FF, $80, $00, $00, $3F, $FF, $C0, $00, $00, $00, $0F, $FF, $FF, $FC, $00, $FF ; ROM $0030EE: FF 80 00 00 3F FF C0 00 00 00 0F FF FF FC 00 FF .byte $FF, $FE, $00, $00, $00, $7F, $FF, $FF, $FF, $C0, $00, $00, $00, $03, $FF, $FF ; ROM $0030FE: FF FE 00 00 00 7F FF FF FF C0 00 00 00 03 FF FF .byte $FF, $C0, $00, $00, $00, $1F, $FF, $FF, $FF, $FF, $FE, $00, $07, $FF, $00, $00 ; ROM $00310E: FF C0 00 00 00 1F FF FF FF FF FE 00 07 FF 00 00 .byte $0F, $FF, $FF, $FC, $00, $00, $00, $00, $3F, $FF, $FF, $F0, $00, $00, $00, $0F ; ROM $00311E: 0F FF FF FC 00 00 00 00 3F FF FF F0 00 00 00 0F .byte $FE, $00, $00, $03, $FF, $FF, $C0, $00, $00, $00, $00, $FF, $FF, $FF, $FF, $FF ; ROM $00312E: FE 00 00 03 FF FF C0 00 00 00 00 FF FF FF FF FF .byte $80, $00, $01, $FF, $FF, $FF, $F0, $00, $00, $00, $00, $7F, $FF, $FF, $DA, $2E ; ROM $00313E: 80 00 01 FF FF FF F0 00 00 00 00 7F FF FF DA 2E .byte $00, $00, $00, $7F, $FF, $FF, $FF, $FE, $00, $00, $FF, $80, $FF, $FC, $00, $00 ; ROM $00314E: 00 00 00 7F FF FF FF FE 00 00 FF 80 FF FC 00 00 .byte $00, $00, $03, $FF, $FF, $FF, $FF, $FF, $80, $00, $00, $0F, $FF, $FF, $F8, $00 ; ROM $00315E: 00 00 03 FF FF FF FF FF 80 00 00 0F FF FF F8 00 .byte $00, $00, $03, $FF, $FF, $FF, $C0, $00, $00, $00, $07, $FF, $FF, $FF, $FF, $80 ; ROM $00316E: 00 00 03 FF FF FF C0 00 00 00 07 FF FF FF FF 80 .byte $00, $00, $01, $FF, $FF, $00, $00, $00, $01, $FF, $FF, $FF, $FF, $FF, $FF, $00 ; ROM $00317E: 00 00 01 FF FF 00 00 00 01 FF FF FF FF FF FF 00 .byte $3F, $FF, $F0, $00, $00, $00, $07, $FF, $FF, $FF, $FE, $00, $03, $FF, $FE, $00 ; ROM $00318E: 3F FF F0 00 00 00 07 FF FF FF FE 00 03 FF FE 00 .byte $00, $07, $FF, $FF, $FF, $C0, $00, $00, $00, $00, $7F, $FF, $E0, $00, $00, $00 ; ROM $00319E: 00 07 FF FF FF C0 00 00 00 00 7F FF E0 00 00 00 .byte $03, $FF, $FF, $FF, $FF, $FF, $00, $00, $7C, $00, $00, $00, $0F, $FF, $FF, $FF ; ROM $0031AE: 03 FF FF FF FF FF 00 00 7C 00 00 00 0F FF FF FF .byte $FF, $FF, $F8, $00, $00, $00, $3F, $FF, $FF, $FF, $C0, $00, $00, $07, $FF, $F0 ; ROM $0031BE: FF FF F8 00 00 00 3F FF FF FF C0 00 00 07 FF F0 .byte $00, $00, $7F, $FF, $80, $00, $07, $FC, $00, $FF, $FF, $FF, $FF, $00, $00, $00 ; ROM $0031CE: 00 00 7F FF 80 00 07 FC 00 FF FF FF FF 00 00 00 .byte $0F, $FF, $FF, $FF, $FE, $00, $00, $00, $3F, $FF, $FF, $F8, $00, $00, $00, $00 ; ROM $0031DE: 0F FF FF FF FE 00 00 00 3F FF FF F8 00 00 00 00 .byte $3F, $FF, $C0, $00, $00, $FF, $FF, $FF, $E0, $00, $00, $00, $1F, $FF, $FF, $FF ; ROM $0031EE: 3F FF C0 00 00 FF FF FF E0 00 00 00 1F FF FF FF .byte $FC, $00, $00, $7F, $FF, $FF, $F8, $00, $00, $00, $3F, $FF, $FF, $FF, $00, $00 ; ROM $0031FE: FC 00 00 7F FF FF F8 00 00 00 3F FF FF FF 00 00 .byte $00, $00, $00, $FF, $FF, $FE, $11, $B0, $3F, $FF, $E0, $00, $00, $00, $00, $07 ; ROM $00320E: 00 00 00 FF FF FE 11 B0 3F FF E0 00 00 00 00 07 .byte $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $F8, $00, $00, $00, $00, $00, $00, $00 ; ROM $00321E: FF FF FF FF FF FF FF FF F8 00 00 00 00 00 00 00 .byte $0F, $FF, $FF, $FF, $FF, $FF, $80, $00, $00, $00, $03, $FF, $FE, $00, $0F, $FF ; ROM $00322E: 0F FF FF FF FF FF 80 00 00 00 03 FF FE 00 0F FF .byte $FF, $80, $00, $00, $00, $FF, $FF, $FF, $FC, $00, $00, $00, $00, $FF, $FF, $FE ; ROM $00323E: FF 80 00 00 00 FF FF FF FC 00 00 00 00 FF FF FE .byte $00, $07, $FF, $FF, $FF, $FF, $E0, $00, $00, $00, $00, $0F, $FF, $A0, $BF, $FF ; ROM $00324E: 00 07 FF FF FF FF E0 00 00 00 00 0F FF A0 BF FF .byte $FF, $FE, $00, $00, $7F, $FC, $00, $00, $00, $7F, $FF, $FF, $E0, $00, $00, $00 ; ROM $00325E: FF FE 00 00 7F FC 00 00 00 7F FF FF E0 00 00 00 .byte $3F, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $80, $00, $00, $00, $07, $F8, $00, $00 ; ROM $00326E: 3F FF FF FF FF FF FF FF 80 00 00 00 07 F8 00 00 .byte $00, $00, $03, $FF, $FF, $FF, $FF, $FF, $00, $00, $00, $00, $00, $01, $FF, $FF ; ROM $00327E: 00 00 03 FF FF FF FF FF 00 00 00 00 00 01 FF FF .byte $FF, $F0, $00, $07, $FF, $FF, $FC, $00, $00, $00, $00, $3F, $FF, $FF, $FF, $FF ; ROM $00328E: FF F0 00 07 FF FF FC 00 00 00 00 3F FF FF FF FF .byte $0F, $FF, $FF, $FE, $00, $00, $00, $00, $00, $FF, $FF, $FF, $FF, $F8, $00, $01 ; ROM $00329E: 0F FF FF FE 00 00 00 00 00 FF FF FF FF F8 00 01 .byte $FF, $FC, $00, $00, $00, $00, $FF, $FF, $FF, $FF, $C0, $00, $00, $00, $00, $03 ; ROM $0032AE: FF FC 00 00 00 00 FF FF FF FF C0 00 00 00 00 03 .byte $FF, $FF, $80, $00, $00, $00, $00, $3F, $FF, $FF, $FF, $FF, $FF, $C0, $00, $3F ; ROM $0032BE: FF FF 80 00 00 00 00 3F FF FF FF FF FF C0 00 3F .byte $FF, $FF, $FF, $F8, $00, $00, $02, $00, $00, $00, $00, $00, $07, $FF, $FF, $FF ; ROM $0032CE: FF FF FF F8 00 00 02 00 00 00 00 00 07 FF FF FF .byte $FF, $FF, $FF, $FF, $E0, $B8, $00, $00, $00, $00, $00, $00, $3F, $FF, $FF, $FF ; ROM $0032DE: FF FF FF FF E0 B8 00 00 00 00 00 00 3F FF FF FF .byte $FF, $FF, $F8, $00, $00, $00, $00, $1F, $FF, $FF, $FF, $FF, $80, $00, $00, $00 ; ROM $0032EE: FF FF F8 00 00 00 00 1F FF FF FF FF 80 00 00 00 .byte $00, $0F, $FF, $FF, $FF, $DF, $FF, $00, $00, $0F, $FF, $FF, $80, $00, $00, $00 ; ROM $0032FE: 00 0F FF FF FF DF FF 00 00 0F FF FF 80 00 00 00 .byte $03, $FF, $FF, $FF, $FF, $FF, $FF, $C0, $00, $00, $00, $01, $FF, $FF, $FF, $00 ; ROM $00330E: 03 FF FF FF FF FF FF C0 00 00 00 01 FF FF FF 00 .byte $00, $00, $00, $1F, $FF, $FF, $FF, $FF, $FF, $FF, $E0, $00, $FF, $00, $00, $00 ; ROM $00331E: 00 00 00 1F FF FF FF FF FF FF E0 00 FF 00 00 00 .byte $00, $00, $00, $01, $FF, $FF, $FF, $C0, $00, $00, $03, $FF, $FF, $FF, $FF, $FF ; ROM $00332E: 00 00 00 01 FF FF FF C0 00 00 03 FF FF FF FF FF .byte $F0, $00, $00, $00, $00, $00, $07, $FF, $FF, $FF, $FF, $FF, $80, $00, $00, $00 ; ROM $00333E: F0 00 00 00 00 00 07 FF FF FF FF FF 80 00 00 00 .byte $00, $0F, $FF, $FF, $FF, $F0, $00, $3F, $FF, $FF, $00, $00, $17, $FB, $C8, $84 ; ROM $00334E: 00 0F FF FF FF F0 00 3F FF FF 00 00 17 FB C8 84 .byte $E5, $3F, $FF, $20, $00, $14, $19, $D9, $9F, $F6, $00, $00, $17, $FF, $FF, $FF ; ROM $00335E: E5 3F FF 20 00 14 19 D9 9F F6 00 00 17 FF FF FF .byte $FF, $FE, $00, $00, $00, $00, $00, $03, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FE ; ROM $00336E: FF FE 00 00 00 00 00 03 FF FF FF FF FF FF FF FE .byte $00, $00, $00, $00, $00, $00, $00, $00, $FF, $FF, $FF, $DC, $80, $00, $26, $FE ; ROM $00337E: 00 00 00 00 00 00 00 00 FF FF FF DC 80 00 26 FE .byte $57, $FF, $FF, $80, $00, $00, $07, $FC, $C0, $3F, $FF, $FF, $7F, $BD, $C4, $61 ; ROM $00338E: 57 FF FF 80 00 00 07 FC C0 3F FF FF 7F BD C4 61 .byte $4E, $EE, $67, $20, $46, $64, $EF, $E6, $00, $00, $FD, $A0, $00, $00, $00, $00 ; ROM $00339E: 4E EE 67 20 46 64 EF E6 00 00 FD A0 00 00 00 00 .byte $07, $FF, $FF, $FF, $FF, $FF, $F0, $00, $00, $00, $00, $00, $7F, $FF, $FF, $FF ; ROM $0033AE: 07 FF FF FF FF FF F0 00 00 00 00 00 7F FF FF FF .byte $FF, $C0, $00, $00, $00, $00, $0F, $7F, $F8, $DF, $FF, $FF, $C0, $03, $FB, $9F ; ROM $0033BE: FF C0 00 00 00 00 0F 7F F8 DF FF FF C0 03 FB 9F .byte $AF, $FF, $FF, $80, $00, $00, $02, $F6, $A5, $6F, $FF, $FF, $FC, $00, $3F, $FF ; ROM $0033CE: AF FF FF 80 00 00 02 F6 A5 6F FF FF FC 00 3F FF .byte $C0, $00, $00, $00, $00, $00, $1F, $FF, $FF, $FF, $FF, $FF, $82, $00, $00, $00 ; ROM $0033DE: C0 00 00 00 00 00 1F FF FF FF FF FF 82 00 00 00 .byte $00, $00, $00, $03, $FF, $FF, $FF, $FF, $C0, $00, $00, $00, $00, $7F, $FF, $FF ; ROM $0033EE: 00 00 00 03 FF FF FF FF C0 00 00 00 00 7F FF FF .byte $FF, $FE, $00, $00, $00, $00, $1E, $7B, $FF, $FF, $FF, $FF, $FF, $F8, $00, $BF ; ROM $0033FE: FF FE 00 00 00 00 1E 7B FF FF FF FF FF F8 00 BF .byte $FF, $FF, $C0, $00, $00, $00, $00, $07, $FF, $FF, $FF, $FF, $FF, $FE, $00, $00 ; ROM $00340E: FF FF C0 00 00 00 00 07 FF FF FF FF FF FE 00 00 .byte $00, $00, $00, $00, $01, $FF, $FF, $FF, $88, $20, $0D, $FF, $F0, $00, $00, $00 ; ROM $00341E: 00 00 00 00 01 FF FF FF 88 20 0D FF F0 00 00 00 .byte $03, $FF, $FF, $FF, $FF, $FF, $FF, $F8, $00, $00, $00, $00, $00, $00, $FF, $FF ; ROM $00342E: 03 FF FF FF FF FF FF F8 00 00 00 00 00 00 FF FF .byte $FF, $FF, $FF, $F8, $00, $00, $3F, $FF, $FF, $80, $00, $00, $00, $00, $00, $01 ; ROM $00343E: FF FF FF F8 00 00 3F FF FF 80 00 00 00 00 00 01 .byte $FF, $FF, $FF, $FF, $FF, $FE, $00, $00, $00, $07, $FF, $FF, $FF, $FF, $FF, $00 ; ROM $00344E: FF FF FF FF FF FE 00 00 00 07 FF FF FF FF FF 00 .byte $00, $00, $00, $00, $00, $01, $FF, $FF, $FF, $FF, $FF, $FF, $00, $00, $00, $00 ; ROM $00345E: 00 00 00 00 00 01 FF FF FF FF FF FF 00 00 00 00 .byte $00, $00, $07, $FF, $FF, $FF, $FF, $F6, $6F, $FF, $E0, $00, $00, $00, $00, $7F ; ROM $00346E: 00 00 07 FF FF FF FF F6 6F FF E0 00 00 00 00 7F .byte $FF, $FF, $FE, $00, $00, $00, $00, $1F, $FF, $FF, $FF, $FF, $FE, $00, $00, $00 ; ROM $00347E: FF FF FE 00 00 00 00 1F FF FF FF FF FE 00 00 00 .byte $00, $00, $06, $69, $43, $1A, $ED, $BF, $FF, $FF, $F0, $00, $00, $00, $00, $00 ; ROM $00348E: 00 00 06 69 43 1A ED BF FF FF F0 00 00 00 00 00 .byte $FF, $FF, $FF, $FF, $FF, $FF, $FF, $F0, $00, $00, $00, $00, $1F, $FF, $FF, $FF ; ROM $00349E: FF FF FF FF FF FF FF F0 00 00 00 00 1F FF FF FF .byte $FF, $C0, $00, $00, $00, $00, $00, $00, $17, $FF, $FF, $FF, $FF, $02, $29, $99 ; ROM $0034AE: FF C0 00 00 00 00 00 00 17 FF FF FF FF 02 29 99 .byte $DF, $FE, $A4, $26, $75, $AC, $61, $AF, $6D, $84, $44, $50, $9F, $BB, $79, $D9 ; ROM $0034BE: DF FE A4 26 75 AC 61 AF 6D 84 44 50 9F BB 79 D9 .byte $9B, $EC, $DB, $27, $FE, $00, $00, $00, $00, $07, $FF, $FF, $FF, $FC, $00, $00 ; ROM $0034CE: 9B EC DB 27 FE 00 00 00 00 07 FF FF FF FC 00 00 .byte $00, $00, $1F, $FF, $FF, $FF, $80, $00, $0F, $FF, $FF, $FF, $00, $00, $00, $00 ; ROM $0034DE: 00 00 1F FF FF FF 80 00 0F FF FF FF 00 00 00 00 .byte $1F, $FF, $FF, $80, $00, $00, $03, $DC, $DA, $FF, $FF, $FF, $FF, $00, $00, $00 ; ROM $0034EE: 1F FF FF 80 00 00 03 DC DA FF FF FF FF 00 00 00 .byte $00, $00, $00, $3F, $FF, $FF, $FF, $FF, $FF, $F0, $00, $00, $00, $1F, $FF, $FF ; ROM $0034FE: 00 00 00 3F FF FF FF FF FF F0 00 00 00 1F FF FF .byte $FF, $FF, $F8, $00, $00, $00, $00, $00, $00, $5E, $FB, $EB, $AC, $C7, $EF, $BB ; ROM $00350E: FF FF F8 00 00 00 00 00 00 5E FB EB AC C7 EF BB .byte $79, $BF, $FF, $E0, $00, $0F, $F8, $00, $00, $00, $FF, $FF, $FF, $FF, $FF, $FF ; ROM $00351E: 79 BF FF E0 00 0F F8 00 00 00 FF FF FF FF FF FF .byte $FC, $00, $00, $00, $00, $00, $00, $3F, $FF, $FF, $F7, $FF, $FF, $FF, $FA, $10 ; ROM $00352E: FC 00 00 00 00 00 00 3F FF FF F7 FF FF FF FA 10 .byte $00, $00, $00, $00, $00, $00, $00, $00, $0F, $FC, $FB, $EE, $FF, $EA, $D9, $DF ; ROM $00353E: 00 00 00 00 00 00 00 00 0F FC FB EE FF EA D9 DF .byte $CE, $7F, $FF, $FF, $80, $00, $00, $00, $00, $00, $1F, $FF, $FF, $FF, $FF, $FF ; ROM $00354E: CE 7F FF FF 80 00 00 00 00 00 1F FF FF FF FF FF .byte $FF, $E0, $00, $00, $00, $00, $00, $7F, $FF, $FF, $FF, $F8, $00, $00, $00, $00 ; ROM $00355E: FF E0 00 00 00 00 00 7F FF FF FF F8 00 00 00 00 .byte $00, $00, $0F, $FF, $FF, $FF, $FF, $FF, $FF, $FC, $00, $00, $00, $00, $00, $00 ; ROM $00356E: 00 00 0F FF FF FF FF FF FF FC 00 00 00 00 00 00 .byte $00, $3F, $FF, $FF, $FF, $FF, $D3, $24, $25, $33, $CC, $C9, $20, $7F, $FF, $F0 ; ROM $00357E: 00 3F FF FF FF FF D3 24 25 33 CC C9 20 7F FF F0 .byte $00, $00, $00, $07, $FF, $FF, $FF, $FF, $00, $00, $00, $00, $0F, $FF, $FF, $FF ; ROM $00358E: 00 00 00 07 FF FF FF FF 00 00 00 00 0F FF FF FF .byte $FF, $FF, $C6, $30, $40, $04, $20, $08, $61, $00, $00, $00, $07, $FF, $FF, $FF ; ROM $00359E: FF FF C6 30 40 04 20 08 61 00 00 00 07 FF FF FF .byte $FF, $FF, $FC, $00, $00, $00, $00, $00, $00, $00, $00, $01, $FF, $FF, $FF, $FF ; ROM $0035AE: FF FF FC 00 00 00 00 00 00 00 00 01 FF FF FF FF .byte $FF, $FF, $FF, $FF, $FF, $FF, $62, $01, $00, $00, $80, $00, $00, $77, $5F, $FF ; ROM $0035BE: FF FF FF FF FF FF 62 01 00 00 80 00 00 77 5F FF .byte $FD, $76, $EB, $5B, $7F, $FF, $FC, $00, $00, $00, $00, $00, $00, $3F, $FF, $FF ; ROM $0035CE: FD 76 EB 5B 7F FF FC 00 00 00 00 00 00 3F FF FF .byte $FF, $FF, $FF, $FF, $FF, $FF, $FF, $00, $00, $00, $00, $00, $00, $00, $00, $FF ; ROM $0035DE: FF FF FF FF FF FF FF 00 00 00 00 00 00 00 00 FF .byte $FF, $FF, $FF, $FF, $FF, $80, $00, $00, $00, $00, $00, $00, $1F, $FF, $FF, $FF ; ROM $0035EE: FF FF FF FF FF 80 00 00 00 00 00 00 1F FF FF FF .byte $FF, $00, $80, $00, $85, $11, $9E, $CC, $CD, $DB, $DF, $F6, $DF, $FF, $FF, $C0 ; ROM $0035FE: FF 00 80 00 85 11 9E CC CD DB DF F6 DF FF FF C0 .byte $00, $00, $00, $00, $00, $0F, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $80, $00 ; ROM $00360E: 00 00 00 00 00 0F FF FF FF FF FF FF FF FF 80 00 .byte $00, $00, $00, $00, $00, $00, $07, $FF, $FF, $FF, $FF, $FF, $FF, $F0, $00, $00 ; ROM $00361E: 00 00 00 00 00 00 07 FF FF FF FF FF FF F0 00 00 .byte $00, $00, $00, $00, $00, $00, $1F, $FF, $FF, $C0, $00, $07, $FF, $FF, $FF, $FF ; ROM $00362E: 00 00 00 00 00 00 1F FF FF C0 00 07 FF FF FF FF .byte $F0, $06, $31, $66, $6B, $FD, $FE, $D9, $40, $00, $03, $FF, $FF, $FF, $FF, $FF ; ROM $00363E: F0 06 31 66 6B FD FE D9 40 00 03 FF FF FF FF FF .byte $80, $00, $00, $00, $00, $00, $00, $00, $07, $FF, $FF, $FF, $FD, $F9, $88, $44 ; ROM $00364E: 80 00 00 00 00 00 00 00 07 FF FF FF FD F9 88 44 .byte $4A, $61, $4C, $CF, $6C, $E6, $7E, $EE, $69, $98, $4A, $CE, $B2, $61, $04, $66 ; ROM $00365E: 4A 61 4C CF 6C E6 7E EE 69 98 4A CE B2 61 04 66 .byte $64, $CE, $6D, $FF, $FF, $FE, $00, $00, $00, $00, $00, $01, $FF, $FF, $FF, $FF ; ROM $00366E: 64 CE 6D FF FF FE 00 00 00 00 00 01 FF FF FF FF .byte $FE, $EF, $FF, $FF, $E6, $20, $80, $00, $00, $00, $00, $00, $00, $00, $01, $DB ; ROM $00367E: FE EF FF FF E6 20 80 00 00 00 00 00 00 00 01 DB .byte $EF, $FF, $FF, $FF, $FF, $F9, $8A, $99, $8A, $4C, $99, $9B, $39, $BF, $FF, $C0 ; ROM $00368E: EF FF FF FF FF F9 8A 99 8A 4C 99 9B 39 BF FF C0 .byte $00, $00, $00, $00, $00, $03, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FC, $00, $00 ; ROM $00369E: 00 00 00 00 00 03 FF FF FF FF FF FF FF FC 00 00 .byte $00, $00, $00, $00, $00, $2F, $FF, $DF, $FF, $FF, $FF, $F0, $00, $00, $00, $00 ; ROM $0036AE: 00 00 00 00 00 2F FF DF FF FF FF F0 00 00 00 00 .byte $00, $7F, $FF, $FF, $FF, $FF, $FF, $FF, $00, $00, $00, $00, $00, $3C, $A0, $00 ; ROM $0036BE: 00 7F FF FF FF FF FF FF 00 00 00 00 00 3C A0 00 .byte $00, $00, $1B, $7F, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FC, $A0, $00, $00, $00 ; ROM $0036CE: 00 00 1B 7F FF FF FF FF FF FF FF FC A0 00 00 00 .byte $FF, $FF, $FE, $61, $00, $00, $00, $00, $00, $00, $00, $3F, $FF, $FF, $FF, $FF ; ROM $0036DE: FF FF FE 61 00 00 00 00 00 00 00 3F FF FF FF FF .byte $FB, $DF, $FF, $FF, $FF, $CC, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00 ; ROM $0036EE: FB DF FF FF FF CC 00 00 00 00 00 00 00 00 00 00 .byte $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $F8, $00, $00, $00, $00, $00, $00 ; ROM $0036FE: FF FF FF FF FF FF FF FF FF F8 00 00 00 00 00 00 .byte $41, $AD, $26, $EF, $FF, $FF, $FF, $FF, $FF, $E0, $00, $00, $00, $00, $00, $00 ; ROM $00370E: 41 AD 26 EF FF FF FF FF FF E0 00 00 00 00 00 00 .byte $01, $5A, $FF, $FF, $6F, $FF, $FF, $FF, $00, $00, $00, $05, $FF, $FF, $FF, $FF ; ROM $00371E: 01 5A FF FF 6F FF FF FF 00 00 00 05 FF FF FF FF .byte $FF, $FA, $28, $88, $10, $40, $00, $02, $10, $94, $66, $73, $36, $F7, $FF, $FF ; ROM $00372E: FF FA 28 88 10 40 00 02 10 94 66 73 36 F7 FF FF .byte $FC, $00, $00, $00, $00, $FF, $FF, $FF, $FF, $FF, $F8, $00, $00, $00, $0F, $B1 ; ROM $00373E: FC 00 00 00 00 FF FF FF FF FF F8 00 00 00 0F B1 .byte $44, $10, $00, $00, $65, $33, $DF, $FF, $FF, $F9, $9E, $FF, $FF, $FF, $FF, $FA ; ROM $00374E: 44 10 00 00 65 33 DF FF FF F9 9E FF FF FF FF FA .byte $E4, $00, $00, $00, $00, $00, $00, $00, $00, $01, $FF, $FF, $FF, $FF, $FF, $FF ; ROM $00375E: E4 00 00 00 00 00 00 00 00 01 FF FF FF FF FF FF .byte $FF, $80, $00, $00, $00, $02, $FB, $DD, $B6, $B7, $77, $DA, $28, $99, $4A, $BF ; ROM $00376E: FF 80 00 00 00 02 FB DD B6 B7 77 DA 28 99 4A BF .byte $FF, $C8, $00, $00, $00, $00, $00, $1F, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $00 ; ROM $00377E: FF C8 00 00 00 00 00 1F FF FF FF FF FF FF FF 00 .byte $00, $00, $00, $00, $00, $00, $0F, $FF, $FF, $FF, $FF, $FF, $FF, $C0, $00, $00 ; ROM $00378E: 00 00 00 00 00 00 0F FF FF FF FF FF FF C0 00 00 .byte $00, $00, $00, $00, $00, $20, $45, $6D, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF ; ROM $00379E: 00 00 00 00 00 20 45 6D FF FF FF FF FF FF FF FF .byte $F4, $00, $00, $07, $BD, $FF, $BC, $C4, $80, $40, $00, $00, $00, $00, $06, $32 ; ROM $0037AE: F4 00 00 07 BD FF BC C4 80 40 00 00 00 00 06 32 .byte $EE, $CE, $B6, $DF, $7B, $BF, $BF, $F7, $DC, $EF, $FF, $F2, $00, $00, $00, $00 ; ROM $0037BE: EE CE B6 DF 7B BF BF F7 DC EF FF F2 00 00 00 00 .byte $00, $00, $0B, $FF, $FF, $FF, $FF, $FF, $FC, $00, $8F, $7F, $76, $CE, $52, $90 ; ROM $0037CE: 00 00 0B FF FF FF FF FF FC 00 8F 7F 76 CE 52 90 .byte $00, $00, $00, $7B, $62, $00, $00, $00, $00, $32, $23, $7F, $FF, $FF, $FF, $FF ; ROM $0037DE: 00 00 00 7B 62 00 00 00 00 32 23 7F FF FF FF FF .byte $FF, $FF, $FF, $FF, $00, $00, $00, $00, $00, $00, $02, $6F, $FF, $FE, $EF, $32 ; ROM $0037EE: FF FF FF FF 00 00 00 00 00 00 02 6F FF FE EF 32 .byte $98, $8C, $25, $33, $5E, $F7, $BF, $F5, $99, $DF, $FF, $FE, $06, $6C, $48, $C4 ; ROM $0037FE: 98 8C 25 33 5E F7 BF F5 99 DF FF FE 06 6C 48 C4 .byte $89, $11, $04, $45, $14, $33, $BC, $88, $00, $00, $00, $00, $26, $6B, $5D, $FF ; ROM $00380E: 89 11 04 45 14 33 BC 88 00 00 00 00 26 6B 5D FF .byte $FF, $FF, $FF, $FF, $FF, $FF, $F0, $04, $00, $00, $00, $08, $88, $C6, $66, $D6 ; ROM $00381E: FF FF FF FF FF FF F0 04 00 00 00 08 88 C6 66 D6 .byte $DD, $BB, $33, $67, $3B, $BB, $FF, $FD, $0A, $64, $90, $01, $00, $00, $8C, $AB ; ROM $00382E: DD BB 33 67 3B BB FF FD 0A 64 90 01 00 00 8C AB .byte $BB, $FF, $FF, $FB, $FF, $5D, $CC, $CA, $53, $33, $14, $21, $08, $84, $11, $09 ; ROM $00383E: BB FF FF FB FF 5D CC CA 53 33 14 21 08 84 11 09 .byte $14, $45, $22, $4C, $66, $6B, $32, $10, $93, $BF, $FF, $FF, $FF, $FF, $FF, $C0 ; ROM $00384E: 14 45 22 4C 66 6B 32 10 93 BF FF FF FF FF FF C0 .byte $00, $00, $00, $00, $00, $BF, $FB, $F7, $77, $FF, $E4, $20, $42, $4C, $CD, $67 ; ROM $00385E: 00 00 00 00 00 BF FB F7 77 FF E4 20 42 4C CD 67 .byte $75, $EE, $CE, $7A, $D9, $9D, $B3, $31, $84, $82, $44, $8A, $65, $55, $9D, $B3 ; ROM $00386E: 75 EE CE 7A D9 9D B3 31 84 82 44 8A 65 55 9D B3 .byte $33, $5F, $B6, $DC, $A0, $00, $00, $00, $00, $03, $FF, $FF, $FF, $FF, $FF, $FF ; ROM $00387E: 33 5F B6 DC A0 00 00 00 00 03 FF FF FF FF FF FF .byte $F9, $02, $00, $00, $00, $32, $88, $00, $12, $99, $9C, $EE, $F7, $FF, $FF, $FF ; ROM $00388E: F9 02 00 00 00 32 88 00 12 99 9C EE F7 FF FF FF .byte $84, $00, $00, $04, $50, $8A, $FF, $FF, $FF, $FF, $FC, $00, $86, $7F, $FF, $FF ; ROM $00389E: 84 00 00 04 50 8A FF FF FF FF FC 00 86 7F FF FF .byte $E0, $00, $00, $00, $00, $3F, $BF, $FB, $AE, $D9, $99, $D7, $28, $00, $00, $00 ; ROM $0038AE: E0 00 00 00 00 3F BF FB AE D9 99 D7 28 00 00 00 .byte $00, $00, $00, $7D, $FF, $FF, $FF, $FF, $FF, $FF, $E8, $48, $A4, $C6, $4D, $62 ; ROM $0038BE: 00 00 00 7D FF FF FF FF FF FF E8 48 A4 C6 4D 62 .byte $88, $45, $5F, $6C, $80, $00, $00, $01, $19, $9A, $DB, $BF, $FF, $FE, $FB, $33 ; ROM $0038CE: 88 45 5F 6C 80 00 00 01 19 9A DB BF FF FE FB 33 .byte $5E, $FF, $BF, $76, $DA, $E6, $64, $D6, $00, $00, $00, $00, $00, $00, $DB, $33 ; ROM $0038DE: 5E FF BF 76 DA E6 64 D6 00 00 00 00 00 00 DB 33 .byte $14, $22, $8C, $44, $18, $EF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $F0, $00, $00 ; ROM $0038EE: 14 22 8C 44 18 EF FF FF FF FF FF FF FF F0 00 00 .byte $00, $00, $00, $CE, $75, $9D, $9C, $E7, $99, $99, $9A, $6A, $64, $CC, $CC, $CC ; ROM $0038FE: 00 00 00 CE 75 9D 9C E7 99 99 9A 6A 64 CC CC CC .byte $CD, $6B, $2A, $67, $35, $9B, $33, $19, $8C, $CC, $CC, $CA, $67, $7F, $F2, $00 ; ROM $00390E: CD 6B 2A 67 35 9B 33 19 8C CC CC CA 67 7F F2 00 .byte $02, $19, $DB, $B7, $5D, $FF, $FF, $FC, $20, $00, $00, $00, $00, $17, $F6, $33 ; ROM $00391E: 02 19 DB B7 5D FF FF FC 20 00 00 00 00 17 F6 33 .byte $3E, $FF, $FF, $FF, $FE, $F5, $8D, $9F, $4C, $00, $00, $00, $00, $00, $00, $00 ; ROM $00392E: 3E FF FF FF FE F5 8D 9F 4C 00 00 00 00 00 00 00 .byte $3F, $FF, $FF, $FF, $FF, $FF, $FF, $F4, $80, $00, $00, $00, $00, $7F, $FF, $E6 ; ROM $00393E: 3F FF FF FF FF FF FF F4 80 00 00 00 00 7F FF E6 .byte $50, $80, $00, $19, $FF, $FF, $FF, $FF, $FF, $EB, $33, $12, $00, $00, $81, $10 ; ROM $00394E: 50 80 00 19 FF FF FF FF FF EB 33 12 00 00 81 10 .byte $22, $33, $B5, $22, $12, $53, $5B, $5D, $7B, $F7, $EE, $BA, $CC, $CC, $CD, $99 ; ROM $00395E: 22 33 B5 22 12 53 5B 5D 7B F7 EE BA CC CC CD 99 .byte $98, $C6, $66, $71, $98, $88, $91, $8C, $4C, $FB, $52, $42, $52, $99, $DD, $D9 ; ROM $00396E: 98 C6 66 71 98 88 91 8C 4C FB 52 42 52 99 DD D9 .byte $9D, $BF, $BF, $CC, $44, $01, $01, $00, $00, $14, $EE, $FF, $FF, $FF, $FF, $FD ; ROM $00397E: 9D BF BF CC 44 01 01 00 00 14 EE FF FF FF FF FD .byte $77, $7E, $42, $00, $40, $00, $00, $00, $00, $0A, $33, $3D, $FF, $FF, $FF, $FF ; ROM $00398E: 77 7E 42 00 40 00 00 00 00 0A 33 3D FF FF FF FF .byte $FF, $FE, $66, $62, $22, $08, $41, $02, $13, $31, $84, $10, $09, $AF, $7B, $5C ; ROM $00399E: FF FE 66 62 22 08 41 02 13 31 84 10 09 AF 7B 5C .byte $CC, $D6, $73, $39, $94, $B3, $BF, $FF, $FF, $FF, $EE, $D6, $66, $28, $A2, $08 ; ROM $0039AE: CC D6 73 39 94 B3 BF FF FF FF EE D6 66 28 A2 08 .byte $40, $10, $CA, $40, $00, $00, $10, $50, $CC, $CD, $BB, $F7, $F7, $FD, $FF, $7E ; ROM $0039BE: 40 10 CA 40 00 00 10 50 CC CD BB F7 F7 FD FF 7E .byte $FA, $D5, $98, $C5, $33, $67, $AE, $75, $99, $4A, $10, $40, $81, $01, $00, $90 ; ROM $0039CE: FA D5 98 C5 33 67 AE 75 99 4A 10 40 81 01 00 90 .byte $51, $8C, $CD, $EF, $F5, $A9, $45, $12, $94, $CC, $C9, $9E, $F7, $FF, $FF, $FF ; ROM $0039DE: 51 8C CD EF F5 A9 45 12 94 CC C9 9E F7 FF FF FF .byte $FF, $79, $D9, $CC, $E5, $48, $88, $84, $04, $08, $21, $11, $14, $E3, $1C, $D3 ; ROM $0039EE: FF 79 D9 CC E5 48 88 84 04 08 21 11 14 E3 1C D3 .byte $35, $99, $91, $00, $09, $36, $FF, $FF, $FF, $FD, $6B, $32, $28, $00, $81, $29 ; ROM $0039FE: 35 99 91 00 09 36 FF FF FF FD 6B 32 28 00 81 29 .byte $B7, $7B, $F7, $EB, $B5, $9B, $19, $4A, $24, $44, $42, $25, $59, $98, $81, $20 ; ROM $003A0E: B7 7B F7 EB B5 9B 19 4A 24 44 42 25 59 98 81 20 .byte $24, $46, $33, $33, $9E, $EE, $FB, $F7, $FF, $BE, $D9, $9C, $EF, $75, $ED, $EE ; ROM $003A1E: 24 46 33 33 9E EE FB F7 FF BE D9 9C EF 75 ED EE .byte $D9, $84, $41, $04, $00, $81, $01, $09, $11, $14, $4C, $6A, $6B, $39, $CF, $BA ; ROM $003A2E: D9 84 41 04 00 81 01 09 11 14 4C 6A 6B 39 CF BA .byte $E6, $B7, $7F, $DF, $66, $22, $00, $04, $65, $D7, $BF, $BE, $FF, $BD, $CE, $66 ; ROM $003A3E: E6 B7 7F DF 66 22 00 04 65 D7 BF BE FF BD CE 66 .byte $62, $94, $91, $42, $93, $AC, $C4, $00, $40, $20, $04, $08, $CD, $7F, $FF, $FF ; ROM $003A4E: 62 94 91 42 93 AC C4 00 40 20 04 08 CD 7F FF FF .byte $F7, $FB, $EF, $76, $A4, $88, $84, $11, $23, $18, $C6, $62, $45, $18, $A4, $CC ; ROM $003A5E: F7 FB EF 76 A4 88 84 11 23 18 C6 62 45 18 A4 CC .byte $D6, $77, $BE, $D9, $89, $21, $08, $A2, $98, $DA, $EB, $DB, $BB, $EF, $DE, $ED ; ROM $003A6E: D6 77 BE D9 89 21 08 A2 98 DA EB DB BB EF DE ED .byte $99, $8A, $6B, $5B, $5D, $D6, $CC, $CC, $E7, $28, $00, $00, $00, $00, $00, $99 ; ROM $003A7E: 99 8A 6B 5B 5D D6 CC CC E7 28 00 00 00 00 00 99 .byte $33, $1C, $DB, $DE, $F7, $7F, $BF, $CE, $75, $9A, $CD, $93, $08, $A6, $67, $36 ; ROM $003A8E: 33 1C DB DE F7 7F BF CE 75 9A CD 93 08 A6 67 36 .byte $B6, $B6, $B3, $9C, $D9, $9B, $24, $10, $21, $02, $11, $46, $4C, $CD, $9C, $D9 ; ROM $003A9E: B6 B6 B3 9C D9 9B 24 10 21 02 11 46 4C CD 9C D9 .byte $D9, $CE, $BD, $FB, $B9, $94, $24, $22, $46, $32, $66, $6D, $75, $ED, $F7, $76 ; ROM $003AAE: D9 CE BD FB B9 94 24 22 46 32 66 6D 75 ED F7 76 .byte $CD, $B3, $33, $9A, $DB, $5A, $CD, $67, $30, $84, $21, $11, $04, $22, $10, $A3 ; ROM $003ABE: CD B3 33 9A DB 5A CD 67 30 84 21 11 04 22 10 A3 .byte $18, $CC, $DA, $D9, $92, $26, $67, $66, $67, $39, $D6, $EB, $D7, $BB, $BB, $9D ; ROM $003ACE: 18 CC DA D9 92 26 67 66 67 39 D6 EB D7 BB BB 9D .byte $99, $99, $99, $9B, $32, $61, $49, $9D, $B3, $8C, $21, $11, $10, $51, $43, $1B ; ROM $003ADE: 99 99 99 9B 32 61 49 9D B3 8C 21 11 10 51 43 1B .byte $3D, $FB, $FE, $FD, $EE, $E7, $66, $66, $29, $46, $22, $89, $14, $28, $4A, $14 ; ROM $003AEE: 3D FB FE FD EE E7 66 66 29 46 22 89 14 28 4A 14 .byte $A6, $53, $3B, $6C, $CC, $44, $08, $46, $67, $5F, $BF, $DF, $77, $BE, $FE, $E6 ; ROM $003AFE: A6 53 3B 6C CC 44 08 46 67 5F BF DF 77 BE FE E6 .byte $62, $28, $11, $08, $84, $82, $26, $6B, $AF, $7D, $FE, $DD, $66, $66, $33, $18 ; ROM $003B0E: 62 28 11 08 84 82 26 6B AF 7D FE DD 66 66 33 18 .byte $C5, $28, $C5, $31, $4C, $65, $25, $32, $A9, $99, $32, $66, $66, $66, $B3, $D6 ; ROM $003B1E: C5 28 C5 31 4C 65 25 32 A9 99 32 66 66 66 B3 D6 .byte $CC, $E7, $6E, $51, $22, $53, $67, $77, $7D, $73, $4A, $22, $96, $6C, $CC, $CA ; ROM $003B2E: CC E7 6E 51 22 53 67 77 7D 73 4A 22 96 6C CC CA .byte $66, $33, $2C, $CC, $CC, $E6, $6B, $35, $99, $9A, $CB, $33, $32, $51, $24, $CB ; ROM $003B3E: 66 33 2C CC CC E6 6B 35 99 9A CB 33 32 51 24 CB .byte $39, $D7, $39, $CC, $CC, $C6, $63, $0A, $48, $88, $93, $18, $93, $18, $CC, $CE ; ROM $003B4E: 39 D7 39 CC CC C6 63 0A 48 88 93 18 93 18 CC CE .byte $73, $9B, $59, $CD, $75, $DD, $EE, $B3, $19, $66, $73, $6B, $67, $59, $CE, $66 ; ROM $003B5E: 73 9B 59 CD 75 DD EE B3 19 66 73 6B 67 59 CE 66 .byte $66, $E7, $9A, $62, $10, $01, $04, $67, $6D, $99, $33, $33, $9D, $AE, $76, $B6 ; ROM $003B6E: 66 E7 9A 62 10 01 04 67 6D 99 33 33 9D AE 76 B6 .byte $AC, $CC, $CE, $6C, $CA, $22, $08, $10, $44, $49, $12, $93, $3A, $FF, $7F, $AD ; ROM $003B7E: AC CC CE 6C CA 22 08 10 44 49 12 93 3A FF 7F AD .byte $5A, $DA, $EB, $6B, $39, $CC, $D9, $99, $93, $26, $29, $29, $31, $46, $31, $94 ; ROM $003B8E: 5A DA EB 6B 39 CC D9 99 93 26 29 29 31 46 31 94 .byte $CC, $CC, $C6, $53, $99, $99, $AB, $35, $6C, $CE, $66, $CD, $9A, $E6, $CD, $99 ; ROM $003B9E: CC CC C6 53 99 99 AB 35 6C CE 66 CD 9A E6 CD 99 .byte $CD, $99, $B2, $B2, $99, $4C, $66, $31, $98, $CC, $CC, $CD, $99, $98, $D3, $58 ; ROM $003BAE: CD 99 B2 B2 99 4C 66 31 98 CC CC CD 99 98 D3 58 .byte $CA, $99, $9A, $DB, $29, $49, $14, $45, $26, $33, $35, $9B, $39, $B5, $DA, $DA ; ROM $003BBE: CA 99 9A DB 29 49 14 45 26 33 35 9B 39 B5 DA DA .byte $EC, $E6, $CD, $66, $CC, $CC, $C9, $99, $8C, $99, $93, $18, $C9, $8A, $22, $94 ; ROM $003BCE: EC E6 CD 66 CC CC C9 99 8C 99 93 18 C9 8A 22 94 .byte $CD, $75, $EF, $75, $9A, $51, $14, $44, $89, $25, $29, $AC, $D9, $CC, $E6, $D6 ; ROM $003BDE: CD 75 EF 75 9A 51 14 44 89 25 29 AC D9 CC E6 D6 .byte $B9, $DB, $5C, $EB, $33, $33, $39, $D7, $6B, $9D, $9C, $E6, $66, $31, $8A, $46 ; ROM $003BEE: B9 DB 5C EB 33 33 39 D7 6B 9D 9C E6 66 31 8A 46 .byte $14, $48, $A2, $8C, $62, $63, $26, $66, $66, $D7, $66, $32, $64, $CC, $CF, $39 ; ROM $003BFE: 14 48 A2 8C 62 63 26 66 66 D7 66 32 64 CC CF 39 .byte $CE, $76, $73, $AD, $6B, $39, $B3, $33, $32, $66, $4C, $C9, $98, $CA, $63, $18 ; ROM $003C0E: CE 76 73 AD 6B 39 B3 33 32 66 4C C9 98 CA 63 18 .byte $CA, $66, $53, $33, $31, $99, $8C, $CC, $CC, $D6, $66, $B3, $33, $33, $39, $B3 ; ROM $003C1E: CA 66 53 33 31 99 8C CC CC D6 66 B3 33 33 39 B3 .byte $99, $B3, $94, $99, $32, $66, $29, $8C, $67, $5B, $5C, $CC, $CC, $DA, $E7, $5A ; ROM $003C2E: 99 B3 94 99 32 66 29 8C 67 5B 5C CC CC DA E7 5A .byte $CC, $D6, $66, $63, $26, $31, $26, $56, $67, $3A, $DA, $CE, $66, $66, $4C, $63 ; ROM $003C3E: CC D6 66 63 26 31 26 56 67 3A DA CE 66 66 4C 63 .byte $18, $C6, $29, $46, $66, $33, $31, $99, $99, $CE, $73, $31, $85, $14, $CC, $D6 ; ROM $003C4E: 18 C6 29 46 66 33 31 99 99 CE 73 31 85 14 CC D6 .byte $EB, $AE, $EB, $D7, $6D, $6B, $36, $6B, $59, $89, $44, $93, $18, $CA, $52, $91 ; ROM $003C5E: EB AE EB D7 6D 6B 36 6B 59 89 44 93 18 CA 52 91 .byte $93, $32, $C6, $69, $9A, $CC, $D9, $9A, $CC, $D9, $99, $66, $73, $AD, $6E, $B9 ; ROM $003C6E: 93 32 C6 69 9A CC D9 9A CC D9 99 66 73 AD 6E B9 .byte $CC, $C6, $24, $44, $44, $89, $28, $A3, $13, $33, $5B, $AE, $EE, $B5, $CE, $75 ; ROM $003C7E: CC C6 24 44 44 89 28 A3 13 33 5B AE EE B5 CE 75 .byte $9B, $33, $8C, $CC, $B1, $8C, $CC, $66, $4C, $CA, $99, $99, $96, $66, $66, $66 ; ROM $003C8E: 9B 33 8C CC B1 8C CC 66 4C CA 99 99 96 66 66 66 .byte $6C, $9C, $CC, $CC, $E6, $CE, $73, $32, $52, $63, $4E, $66, $B3, $B7, $5C, $CC ; ROM $003C9E: 6C 9C CC CC E6 CE 73 32 52 63 4E 66 B3 B7 5C CC .byte $C6, $18, $A2, $52, $99, $CD, $5A, $E7, $6D, $98, $C9, $93, $26, $6B, $36, $63 ; ROM $003CAE: C6 18 A2 52 99 CD 5A E7 6D 98 C9 93 26 6B 36 63 .byte $18, $92, $28, $8A, $66, $4C, $CA, $73, $39, $D7, $3D, $75, $B6, $73, $33, $36 ; ROM $003CBE: 18 92 28 8A 66 4C CA 73 39 D7 3D 75 B6 73 33 36 .byte $32, $98, $CC, $66, $66, $65, $33, $32, $99, $33, $33, $33, $33, $99, $9C, $CC ; ROM $003CCE: 32 98 CC 66 66 65 33 32 99 33 33 33 33 99 9C CC .byte $D9, $66, $D6, $CC, $C9, $8C, $A6, $66, $6B, $35, $9B, $35, $9D, $63, $32, $95 ; ROM $003CDE: D9 66 D6 CC C9 8C A6 66 6B 35 9B 35 9D 63 32 95 .byte $33, $33, $33, $33, $32, $66, $53, $4C, $A9, $99, $99, $99, $8C, $4A, $63, $35 ; ROM $003CEE: 33 33 33 33 32 66 53 4C A9 99 99 99 8C 4A 63 35 .byte $9B, $39, $CC, $C6, $63, $32, $66, $66, $59, $99, $9A, $73, $9D, $66, $67, $39 ; ROM $003CFE: 9B 39 CC C6 63 32 66 66 59 99 9A 73 9D 66 67 39 .byte $CE, $73, $32, $63, $19, $99, $9B, $35, $9A, $D9, $CC, $C6, $14, $8A, $28, $C5 ; ROM $003D0E: CE 73 32 63 19 99 9B 35 9A D9 CC C6 14 8A 28 C5 .byte $26, $33, $19, $99, $9B, $33, $59, $B3, $AC, $E6, $CE, $67, $33, $99, $B3, $39 ; ROM $003D1E: 26 33 19 99 9B 33 59 B3 AC E6 CE 67 33 99 B3 39 .byte $99, $99, $99, $99, $94, $C5, $31, $AC, $CE, $6C, $CE, $66, $33, $19, $94, $C9 ; ROM $003D2E: 99 99 99 99 94 C5 31 AC CE 6C CE 66 33 19 94 C9 .byte $8C, $65, $29, $8C, $C6, $66, $73, $66, $65, $25, $33, $33, $39, $AD, $D6, $D6 ; ROM $003D3E: 8C 65 29 8C C6 66 73 66 65 25 33 33 39 AD D6 D6 .byte $B3, $59, $99, $99, $9B, $33, $33, $39, $9C, $E6, $C9, $9A, $66, $66, $26, $32 ; ROM $003D4E: B3 59 99 99 9B 33 33 39 9C E6 C9 9A 66 66 26 32 .byte $B2, $66, $9C, $CC, $CC, $CC, $C9, $93, $29, $8C, $A6, $66, $62, $51, $84, $94 ; ROM $003D5E: B2 66 9C CC CC CC C9 93 29 8C A6 66 62 51 84 94 .byte $A6, $66, $CE, $75, $B3, $9E, $73, $9C, $E7, $33, $99, $AC, $CB, $33, $33, $33 ; ROM $003D6E: A6 66 CE 75 B3 9E 73 9C E7 33 99 AC CB 33 33 33 .byte $33, $33, $33, $26, $66, $59, $99, $8C, $CC, $C9, $99, $99, $99, $99, $99, $99 ; ROM $003D7E: 33 33 33 26 66 59 99 8C CC C9 99 99 99 99 99 99 .byte $9A, $B3, $33, $33, $33, $33, $33, $66, $66, $64, $A6, $33, $33, $33, $26, $55 ; ROM $003D8E: 9A B3 33 33 33 33 33 66 66 64 A6 33 33 33 26 55 .byte $33, $33, $9C, $E6, $B3, $9A, $AC, $CC, $C6, $66, $66, $69, $99, $99, $99, $98 ; ROM $003D9E: 33 33 9C E6 B3 9A AC CC C6 66 66 69 99 99 99 98 .byte $CC, $C6, $63, $19, $99, $99, $4C, $CC, $CA, $99, $99, $9C, $CD, $54, $CC, $CC ; ROM $003DAE: CC C6 63 19 99 99 4C CC CA 99 99 9C CD 54 CC CC .byte $CC, $E6, $73, $39, $AC, $E6, $66, $66, $53, $29, $99, $4C, $CC, $CC, $CE, $66 ; ROM $003DBE: CC E6 73 39 AC E6 66 66 53 29 99 4C CC CC CE 66 .byte $73, $35, $99, $CC, $CC, $CE, $67, $33, $19, $92, $A4, $CC, $6C, $CE, $73, $59 ; ROM $003DCE: 73 35 99 CC CC CE 67 33 19 92 A4 CC 6C CE 73 59 .byte $31, $88, $A4, $65, $33, $35, $9B, $33, $32, $6B, $33, $31, $93, $26, $B3, $36 ; ROM $003DDE: 31 88 A4 65 33 35 9B 33 32 6B 33 31 93 26 B3 36 .byte $67, $3B, $35, $99, $98, $CC, $A6, $55, $99, $CD, $6B, $59, $CC, $CD, $4E, $66 ; ROM $003DEE: 67 3B 35 99 98 CC A6 55 99 CD 6B 59 CC CD 4E 66 .byte $63, $31, $99, $AC, $CC, $E6, $66, $73, $33, $31, $99, $4C, $A6, $32, $99, $4C ; ROM $003DFE: 63 31 99 AC CC E6 66 73 33 31 99 4C A6 32 99 4C .byte $99, $8C, $E5, $4C, $C9, $8C, $CC, $CD, $59, $99, $99, $99, $CC, $E6, $73, $39 ; ROM $003E0E: 99 8C E5 4C C9 8C CC CD 59 99 99 99 CC E6 73 39 .byte $9C, $E7, $33, $99, $4C, $99, $98, $CC, $99, $33, $33, $56, $67, $33, $59, $9B ; ROM $003E1E: 9C E7 33 99 4C 99 98 CC 99 33 33 56 67 33 59 9B .byte $31, $A9, $99, $94, $CC, $CC, $66, $66, $53, $2A, $66, $4D, $33, $35, $59, $4C ; ROM $003E2E: 31 A9 99 94 CC CC 66 66 53 2A 66 4D 33 35 59 4C .byte $CC, $CC, $D9, $99, $9A, $67, $36, $6C, $CC, $CC, $CA, $65, $4C, $CC, $CC, $CC ; ROM $003E3E: CC CC D9 99 9A 67 36 6C CC CC CA 65 4C CC CC CC .byte $CD, $99, $AC, $D9, $9B, $33, $39, $99, $9B, $2A, $66, $54, $CC, $C6, $67, $33 ; ROM $003E4E: CD 99 AC D9 9B 33 39 99 9B 2A 66 54 CC C6 67 33 .byte $33, $33, $33, $19, $4C, $99, $4C, $94, $C6, $64, $CC, $66, $66, $55, $66, $35 ; ROM $003E5E: 33 33 33 19 4C 99 4C 94 C6 64 CC 66 66 55 66 35 .byte $99, $9A, $CC, $E7, $36, $67, $35, $66, $6B, $33, $66, $73, $5A, $72, $66, $59 ; ROM $003E6E: 99 9A CC E7 36 67 35 66 6B 33 66 73 5A 72 66 59 .byte $99, $9C, $E6, $63, $31, $8C, $C6, $33, $29, $99, $99, $54, $CC, $CC, $D9, $99 ; ROM $003E7E: 99 9C E6 63 31 8C C6 33 29 99 99 54 CC CC D9 99 .byte $99, $99, $99, $9A, $72, $CC, $CC, $CC, $A9, $9B, $26, $63, $14, $C6, $63, $33 ; ROM $003E8E: 99 99 99 9A 72 CC CC CC A9 9B 26 63 14 C6 63 33 .byte $33, $33, $33, $99, $9C, $D3, $33, $19, $93, $9A, $B3, $59, $99, $99, $9C, $CE ; ROM $003E9E: 33 33 33 99 9C D3 33 19 93 9A B3 59 99 99 9C CE .byte $66, $67, $33, $59, $9C, $CC, $CE, $66, $66, $6B, $33, $29, $94, $CC, $CC, $D6 ; ROM $003EAE: 66 67 33 59 9C CC CE 66 66 6B 33 29 94 CC CC D6 .byte $66, $66, $66, $63, $33, $19, $32, $99, $4C, $66, $32, $99, $99, $8C, $CC, $CC ; ROM $003EBE: 66 66 66 63 33 19 32 99 4C 66 32 99 99 8C CC CC .byte $CC, $CC, $CD, $99, $AC, $E6, $CC, $CC, $AA, $CC, $E6, $6C, $CE, $67, $34, $E5 ; ROM $003ECE: CC CC CD 99 AC E6 CC CC AA CC E6 6C CE 67 34 E5 .byte $99, $99, $99, $99, $99, $99, $93, $33, $33, $33, $26, $31, $8C, $C6, $66, $66 ; ROM $003EDE: 99 99 99 99 99 99 93 33 33 33 26 31 8C C6 66 66 .byte $73, $33, $33, $29, $99, $99, $99, $CB, $33, $33, $33, $66, $66, $65, $29, $96 ; ROM $003EEE: 73 33 33 29 99 99 99 CB 33 33 33 66 66 65 29 96 .byte $33, $99, $99, $9C, $CC, $E6, $66, $66, $66, $66, $66, $CC, $CC, $CC, $66, $4C ; ROM $003EFE: 33 99 99 9C CC E6 66 66 66 66 66 CC CC CC 66 4C .byte $C9, $99, $99, $66, $66, $67, $33, $66, $66, $CC, $CC, $E6, $66, $71, $AA, $66 ; ROM $003F0E: C9 99 99 66 66 67 33 66 66 CC CC E6 66 71 AA 66 .byte $65, $8E, $67, $33, $94, $CC, $66, $65, $99, $4C, $CC, $A6, $65, $4C, $CC, $CC ; ROM $003F1E: 65 8E 67 33 94 CC 66 65 99 4C CC A6 65 4C CC CC .byte $CC, $98, $C6, $4C, $D3, $95, $99, $99, $9C, $CD, $59, $AC, $CD, $99, $99, $B3 ; ROM $003F2E: CC 98 C6 4C D3 95 99 99 9C CD 59 AC CD 99 99 B3 .byte $39, $AB, $32, $66, $33, $19, $A6, $73, $2C, $CC, $CE, $66, $66, $67, $33, $33 ; ROM $003F3E: 39 AB 32 66 33 19 A6 73 2C CC CE 66 66 67 33 33 .byte $33, $26, $53, $18, $C9, $99, $99, $B3, $33, $33, $33, $33, $33, $33, $2A, $CC ; ROM $003F4E: 33 26 53 18 C9 99 99 B3 33 33 33 33 33 33 2A CC .byte $CC, $CC, $CC, $D9, $99, $99, $65, $35, $99, $AC, $CC, $E6, $66, $99, $99, $99 ; ROM $003F5E: CC CC CC D9 99 99 65 35 99 AC CC E6 66 99 99 99 .byte $98, $C9, $98, $CA, $66, $66, $53, $53, $36, $55, $99, $99, $B3, $33, $33, $1A ; ROM $003F6E: 98 C9 98 CA 66 66 53 53 36 55 99 99 B3 33 33 1A .byte $66, $66, $66, $66, $66, $6B, $35, $9B, $33, $39, $99, $B3, $59, $99, $9A, $CC ; ROM $003F7E: 66 66 66 66 66 6B 35 9B 33 39 99 B3 59 99 9A CC .byte $A9, $CC, $66, $64, $CC, $A6, $65, $33, $26, $66, $4C, $C6, $66, $64, $CC, $CC ; ROM $003F8E: A9 CC 66 64 CC A6 65 33 26 66 4C C6 66 64 CC CC .byte $CC, $CC, $CC, $CC, $CC, $CD, $99, $99, $99, $B3, $33, $33, $39, $99, $99, $B3 ; ROM $003F9E: CC CC CC CC CC CD 99 99 99 B3 33 33 39 99 99 B3 .byte $33, $33, $39, $99, $9A, $66, $53, $31, $99, $99, $39, $98, $CC, $CC, $CC, $CC ; ROM $003FAE: 33 33 39 99 9A 66 53 31 99 99 39 98 CC CC CC CC .byte $CE, $66, $67, $35, $99, $93, $32, $99, $99, $99, $9A, $CC, $CC, $CC, $CC, $CC ; ROM $003FBE: CE 66 67 35 99 93 32 99 99 99 9A CC CC CC CC CC .byte $CC, $B1, $98, $CC, $CC, $66, $66, $66, $66, $66, $66, $66, $66, $66, $69, $A7 ; ROM $003FCE: CC B1 98 CC CC 66 66 66 66 66 66 66 66 66 69 A7 .byte $33, $33, $33, $39, $99, $99, $CC, $CC, $D3, $54, $CC, $CB, $19, $99, $99, $99 ; ROM $003FDE: 33 33 33 39 99 99 CC CC D3 54 CC CB 19 99 99 99 .byte $99, $99, $AB, $33, $33, $33, $33, $33, $39, $99, $00, $00, $00, $00, $00, $00 ; ROM $003FEE: 99 99 AB 33 33 33 33 33 39 99 00 00 00 00 00 00 .byte $00, $00, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF, $FF ; ROM $003FFE: 00 00 FF FF FF FF FF FF FF FF FF ; Routine: IrqHandler ; Global: Reachable code entry at CPU $FFF9 traced from the interrupt-root control-flow graph. ; Local: Performs the instruction sequence below; semantic purpose remains provisional. ; Parameters: Register and memory inputs are caller-dependent. ; Returns: Determined by the terminating RTS, RTI, jump, or branch path. ; Side effects: Registers, flags, memory, and hardware registers written below. ; Confidence: High for reachability and encoding; semantic role provisional. IrqHandler: rti ; ROM $004009: 40 ; Interrupt vectors at CPU $FFFA-$FFFF. Vectors: .word NmiHandler ; ROM $00400A: 1A C0 .word Reset ; ROM $00400C: 00 C0 .word IrqHandler ; ROM $00400E: F9 FF