Files
disasm/NROM/Pyramid (U) (Sachen)/routinemap.tsv
T
tmerritt 691b2bc23c Xevious (U): Pass 1 disassembly
The first _wip project to get a real disassembly.  4,165 instructions /
8,444 code bytes (25.8%), 24,324 data bytes, 0 unclassified -- every byte
of the 32 KB PRG is now classified as code or data.

The split needed three stages, all recorded in prg.s's header:

  * nesdis.py --undocumented --auto-seed at base $8000 gave 3,272
    instructions / 6,555 bytes.  The undocumented opcodes matter here: the
    trace stops dead at the first one it cannot decode.
  * Four hand-seeded entries ($C08B, $DC1E, $E0D5, $E134).  Each is a
    branch target from decoded code that sat inside an untraced data run,
    so the tracer never reached it.
  * A merged four-session Mesen Code Data Logger capture (kept as
    xevious_mesen.cdl) promoted 1,902 bytes from data to code and
    demoted 22 the trace had called code.

Two tool bugs fell out and are fixed here:

  * nesdis.py emitted the undocumented single-byte NOPs ($1A/$3A/$5A/
    $7A/$DA/$FA) as `nop`, which ca65 assembles as the *official* $EA --
    the rebuild stopped being byte-identical at $DF82.  The check now
    keys on the opcode byte, not just the addressing mode.  All three
    `make regen` pipelines (MUSCLE, Pyramid, Urban Champion) are
    unaffected and still reproduce prg.s byte for byte.

  * cdl_reclass.py left the original data-block header in place when the
    CDL split that block, so the file ended up with two region headers
    describing overlapping spans (20 of them here).  The header is now
    dropped with the block it describes; the promoted projects that use
    the tool are byte-for-byte unchanged.

The project README has the power-on flow analysis.  The most interesting
find is at $FC45: the reset path compares RAM $0100-$0107 against the
ASCII string "Kei Cros", and the copyright text at $FF1E reads
"MAIN: KEI CROSS.  SOUND: UHOHOY OHNOGI."  The OAM is at $0700, not
$0200 -- the NMI handler does LDA #$07 / STA $4014.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Add explicit `make wip` / `make wipclean` targets for the _wip tier

The root Makefile's all / clean / <MAPPER> targets deliberately name only
the promoted mapper folders, so nothing in them reaches into _wip/.  Give
the pre-promotion tier its own opt-in targets instead of the manual
`for d in _wip/*/*/; do make -C "$d"; done` loop:

  make wip          # build + verify every _wip/<MAPPER>/<Project>/
  make wipclean     # clean the build artifacts in that tier

Both the Makefile and the four documents that describe the tier (README,
TODO, WIP, AGENTS) are updated together, so the tree stays consistent.

The same commit records Xevious (U) reaching Pass 2 in those documents:
all 487 labels named, every branch and call symbolic, zero Label_XXXX and
zero raw $XXXX operands left.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Update the _wip/ tier documentation; fix the make wip target and the mirroring bug

The WIP tier's four documents (WIP.md, README.md, TODO.md, AGENTS.md) had
drifted away from the tree.  Every number in them was re-derived from the
ROMs and the folder layout rather than carried forward.

Counts and structure
  - The tier holds 854 projects across 29 mapper folders, not "856 across
    30".  Xevious (U) and Zanac (U) were promoted on 2026-10-20 and their
    _wip/ folders were left behind as residue -- "git mv" moves only the
    tracked files, so the old folder survived with its build artifacts and a
    stale README.  Both are removed now; the promotion procedure documents
    the step so it does not recur.
  - _wip/MAPPER8/ holds a copy of the already-promoted Mermaids of
    Atlantis (U) and is excluded from every count and table.
  - Pass 0 skeletons: 852 (was 855).  Xevious (U) left the tier, so the
    two projects with a real disassembly are Golf (JU) and Volleyball (U).
  - PRG sizes 2 / 150 / 42 / 522 / 127 / 10 / 1; 226 projects with no CHR;
    38 keep the CPU-address linker layout; 37 are mapper 0.
  - Every inventory row was re-checked against its ROM: PRG/CHR size,
    mirroring, all three vectors, and the battery / four-screen / footer
    notes.  854 of 854 rows now match.

Fixes
  - The root Makefile used $(WIP) but never defined it, so "make wip" and
    "make wipclean" expanded to "for m in /*/" -- they walked the
    filesystem root instead of the tier.  "WIP := _wip" is now defined, and
    "make wip" builds and verifies the whole tier: 855 of 855 passed, 0
    failures.
  - make_skeleton.py masked header byte 6 with 0x03, so the battery bit
    (bit 1) leaked into the mirroring value and 56 battery-backed ROMs'
    READMEs claimed "Four-screen" while their own "Four-screen VRAM" row
    said "no".  The mask is now 0x01 and the 56 READMEs are corrected.
  - Golf (JU)'s README still described the pre-flatten copilot/ folder and
    the old PRG-only compare; it now describes the whole-ROM build.
  - Pyramid (U)'s audit comments are canonical again, so Golf (JU) is the
    only project in the tree still on the pre-canonical spelling.

New in WIP.md
  - Byte 7's lower nybble is non-zero on 58 of the ROMs -- 55 carry the
    literal "DiskDude!" watermark, two "DisNi0330", one "byKH+KEN".  Only
    the upper nybble carries mapper bits, so the noise is harmless.
  - The twelve ROMs that set the four-screen bit, split by whether their
    board actually supports four-screen VRAM.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Promote Volleyball (U) from _wip/NROM/ to NROM/

Volleyball (U) reached Pass 3 before promotion, so this is a promotion of a
finished disassembly rather than a Pass 0 skeleton.

The disassembly
  - 11,395 instructions / 23,926 code bytes (73.0 % of the PRG image),
    8,842 data bytes, 0 unclassified.
  - The split needed the game-state dispatch table at $85E1 declared to the
    tracer (--table 85E1:11) -- without it only 66 % of the image traced --
    plus a Mesen Code Data Logger capture taken while a random-input bot
    played the attract demo, which promoted 1,757 bytes from data to code.
  - Pass 2 named all 1,989 labels: 730 read out of the code by hand, 1,221
    internal branch targets derived mechanically.  Zero Label_XXXX, zero raw
    $XXXX call or branch operands, zero SubC residue.
  - Pass 3 named the zero page, the $0500 ball structure and all 37 data
    blocks.  apply_symbols.py --report: 0 pending substitutions, 0
    multi-alias residue.  align_audit_comments.py: no column drift.
  - cdl_check.py cross-checks the finished prg.s against the capture: 0
    CDL-code bytes not covered by an instruction, 0 CDL-data bytes that
    start one.
  - 29 neutral ZpXX zero-page slots remain, each with its reason recorded
    in locals.inc, as the promotion rules allow.

The promotion
  - git mv "_wip/NROM/Volleyball (U)" "NROM/Volleyball (U)".  Mapper 0, so
    it lands in NROM/.  The whole-ROM build was already in place, so there
    was no build surgery; the project builds byte-identically at its new
    home and the old folder is gone (git mv moves the untracked build
    artifacts too, so no residue was left behind).
  - Root README.md: new inventory row 39 and a per-project detail section,
    plus the WIP-tier counts.  The detail sections for Xevious (U) and
    Zanac (U) were numbered one too high against the inventory rows and
    are now aligned; a leftover editing note in the same place is gone.
  - WIP.md: the Volleyball row leaves the inventory, and the tier is now
    853 projects across 29 mapper folders (36 in _wip/NROM/), 852 of them
    Pass 0 skeletons.  Golf (JU) is the only project left in the tier with
    a real disassembly.
  - TODO.md and AGENTS.md: the same counts, and the promoted tier is now
    40 projects (39 under NROM/).

Verified: make wip builds and verifies the whole tier (854 of 854 passed,
0 failures) and make builds the promoted tier (39 of 39 passed).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Rename NROM/Pyramid (U) to NROM/Pyramid (U) (Sachen)

The promoted inventory row had read "Pyramid (U) (Sachen)" since the
project was promoted on 2026-10-20, but the folder was named "Pyramid (U)" --
so the row pointed at a folder that did not exist.  The folder now matches
the row, and the project's own README title, its ROM file name
("Pyramid (U) (Sachen).nes") and the parenthetical convention the rest of
the promoted tier already uses (Popeye (JU) (PRG 0/1), Raid on Bungeling
Bay (U) [a2], Pac-Man (Tengen) (U)).

What changed inside the project
  - The Makefile's regen target passes --project "Pyramid (U) (Sachen)", so
    the tracer writes the matching header line.  prg.s and locals.inc were
    updated to that header line and nothing else -- the disassembly is
    byte-identical to before.
  - make regen still reproduces prg.s and locals.inc byte for byte.
  - The project's README's build-verification line now names the new folder.

References updated: the root README.md (inventory prose, the row-33 detail
section, the build-status table, and the notable-observations bullet),
TODO.md (the promoted-projects table and the Pyramid notes) and AGENTS.md
(the recently-promoted list and the unlicensed-titles quirk).

Verified: make builds the promoted tier (39 of 39 passed) and the project
rebuilds byte-identically at its new path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Rebuild Mermaids of Atlantis (U): bank-aware Pass 1, Pass 2/3 names

The promoted project did not build: a Pass 2 rename had been applied
half-way, leaving eight undefined symbols and two jumps that pointed at
the wrong routine, while the root README already claimed the project was
byte identical.  The _wip copy still built, because it held the un-renamed
Pass 1 source.

The disassembly is now derived from the ROM itself, with the Mesen Code
Data Logger as the oracle for the code/data split:

* _tools/banked_dis.py traces every MMC3 bank separately, each with the CPU
  window it is visible at, seeded from a CDL capture so the code a static
  trace cannot reach is disassembled too.  The CDL is the authority: a
  decode the CPU never fetched is dropped, and so is the fall-through
  behind a call whose target never returns (the game's dispatchers have
  their jump table right behind the call).
* One segment per bank (PRG0..PRG7) with its own .org, so the assembler
  knows the CPU address of every label while the linker still writes the
  bytes to the bank's file offset.  A flat segment cannot do both: a call
  would encode the file offset instead of the CPU address.
* Pass 2 names every label - 494 routines, no Label_XXXX and no raw
  $XXXX branch or jump operand left.  Pass 3 applies 13 semantic zero-page
  aliases and writes the routine headers.
* 8,075 bytes of code (12.3% of the 64 KB PRG), up from 200 bytes.

The banking turned out to be unusual and is documented: the fixed bank is
the fourth 8 KB bank (file $6000-$7FFF), not the last one, and the image
carries the reset stub and the vector table twice.  The live NMI vector
is $808F - the frame handler - while the copy at the end of the image
names $8189, which is a BRK in the first half.  The game's text table
lives at CPU $F1D6, which is the fixed window, and that is what settles
the question.

Also: the leftover _wip/MAPPER8 folder is removed, as it is for every
other promotion.

The project builds byte identical:

    Byte-identical ROM verified.

Add CHANGELOG.md: the pass history of every project

A project goes through four milestones - Pass 1 (the code/data split),
Pass 2 (the labels replaced by names), Pass 3 (the semantic naming) and
Promotion (the move into the top-level mapper folder) - and the history
of those milestones was scattered over the commit log, the project
READMEs and the root README.

CHANGELOG.md gathers it: one section per project with a row for each
milestone, the date, and a sentence saying what the milestone produced.
The numbers are the ones the project README and the root README already
carry - instruction count, code coverage, named labels, semantic
zero-page aliases, named data tables - so a reader can see at a glance
which projects are done and which are not.  Golf (JU), the only project
still in _wip/ with a real disassembly, is listed with its open
milestones, and the other 852 _wip/ projects are covered as a tier.

The requirement is now part of the workflow contract: PROMPTS.md gains a
"Pass 3: Changelog entry" section and a ninth checklist item, and
AGENTS.md points at the file.  A milestone and its changelog row go in
the same commit, so the changelog and the source never disagree.

Balloon Fight (JU): repair the audit trail and complete the routine headers

The per-instruction audit trail was stale by two bytes from
ResetInitializationData ($C085) onward.  5,944 of the 6,007 comments named
the wrong CPU address and PRG offset, because the three-byte .byte "HAL"
signature at $C082-$C084 had been counted as one byte when the trail was
first generated - the routine headers and the linker labels were right all
along, so the source and its own headers disagreed with each other.  The
trail was rebuilt from the ca65 -l listing with
_tools/repair_audit_comments.py, and every rewritten comment was re-checked
against prg.bin.  The comments were also moved into the canonical column-35
field: they had sat two spaces after the mnemonic, with no column discipline
at all, unlike every other promoted project.

All 63 routine headers now carry a ; Clobbers: block, so the headers carry
the full template AGENTS.md describes.  The blocks are derived, not written by
hand.  The new _tools/derive_clobbers.py takes the opcode from the audit
comment's byte list, so the addressing mode is exact and a data directive is
never mistaken for an instruction; it resolves the operand through
locals.inc and symbols.inc to name what is written; it follows the real
control flow, so a jsr to another named entry is a call (the callee's
clobbers count) while a branch or a fall-through is not; and it models
register preservation, so NmiHandler reports *no register* - it saves and
restores A, X and Y around the frame - and FlushPpuCommandPreserved reports
only A, because X and Y come back unchanged.

Two tools changed.  derive_clobbers.py is new.  align_audit_comments.py had
an off-by-one: it tested the indented code length against 31 instead of
against 35, so code texts of 28-31 characters were never padded into the
column.

The change is comments only.  The code text of all 8,538 lines is unchanged,
make still prints "Byte-identical ROM verified.", the 6,007 audit comments
still re-check against prg.bin, all 63 routine headers agree with the
instructions they describe, and every label agrees with reconstructed.lbl.
ReflectObjectYVelocity and UpdateSpecialObjectSystem moved out of locals.inc
and became labels in prg.s at their real addresses.

CHANGELOG.md becomes the repository's running log: a Pending list of the
changes to be put in the next commit, a History of the commits already made,
and the per-project milestone index at the end.  The next commit's message is
written from the Pending entries, so the two cannot drift apart.  PROMPTS.md
and AGENTS.md describe the new shape.  WIP.md drops the _wip/MAPPER8/ note:
the folder held a copy of Mermaids of Atlantis (U) that had already been
promoted.

World Class Track Meet (U): Pass 1, the code/data split

Pass 1 is done.  The split is 8,400 instructions / 18,028 code bytes (55.0 %)
of the 32 KB PRG, with 884 routine entries, 55 data blocks and 102 zero-page
aliases.  The PRG is CNROM (mapper 3) and maps whole at $8000-$FFFF, so the
linker moved the PRG segment from a .nes file offset to $8000 and the build
still compares byte identical.

Four dispatch tables had to be seeded by hand.  The event table at $F796 (5
entries) is read at $F780 and jumped to through `jmp ($001F)`.  The three
push-pointer tables - $BFC4 (16 entries), $BFE4 (2) and $E5F2 (7) - push a
handler address and `rts` into it, and the 6502's `rts` adds one to the
address it pops, so each table stores the entry address minus one; the seeds
are the table values plus one.  The tracer runs with --undocumented: the code
uses undocumented NMOS opcodes as ordinary code (ANC $37 at $BFF8, and the
RRA/RLA/SLO and NOP forms elsewhere).  Seeding the tables takes the coverage
from 27.8 % to 55.0 %.

$C0BE-$C0C5 is forced back to data: the IRQ vector $C0C0 points into the
middle of the `jmp $C047` at $C0BE, and the game never executes CLI, so the
vector is dead.  `make pass1` regenerates prg.s and locals.inc from prg.bin
and reproduces the committed prg.s byte for byte.

The project README records the split, the four dispatch tables, the dead IRQ
vector, the wrong CHR size field in the header, and what is still data.  The
milestone index in CHANGELOG.md gains the project; WIP.md, README.md and
AGENTS.md follow the tier counts and the layout.

nesdis.py gains a --mapping-note option, so the header's "PRG mapped at" line
can describe a board that is not NROM - CNROM's whole 32 KB at $8000-$FFFF is
not "mirrored to the upper half".

Replaces runs of $00 and $FF with .res <run>, <byte>

Golf (JU) and World Class Track Meet (U): Pass 2/3 complete, promoted from _wip/

- World Class Track Meet (U) - Pass 2 complete: all 884 Label_<addr>
  definitions replaced (651 semantic routine names + 233 Sub_<addr>), all 731
  raw $XXXX jsr/jmp call operands resolved to symbolic labels, all branch
  targets given role-based names; routinemap.tsv added; make stays
  byte-identical.
- World Class Track Meet (U) - Pass 3 complete: 24 semantic zero-page
  aliases applied via apply_symbols.py (0 residue), 78 neutral ZpXX slots
  documented with reasons in locals.inc, all hardware-register operands use
  symbols.inc names, project README rewritten with Pass 2/Pass 3 sections and
  data-table inventory; promoted out of _wip/CNROM/.
- World Class Track Meet (U) - project README documents the five event-table
  entries at $F796 and marks the olympics mode as not yet proven.
- Golf (JU) - audit comments converted from pre-canonical (; C000: A9 00)
  to the canonical ; CPU:$C000 PRG:0000  A9 00 form at column 35; 4,156
  comments re-aligned, comment/whitespace only, whole-ROM build stays
  byte-identical.
- Golf (JU) - 339 internal branch-target Label_ labels given role-based names
  via _tools/derive_branch_names.py; 0 raw $XXXX branch/jump operands remain.
- Golf (JU) - 275 zero-page operands substituted with locals.inc aliases via
  apply_symbols.py; 0 residue; promoted out of _wip/NROM/.
- Xevious (U) - runs of $FF padding replaced with .res <count>, $FF in prg.s;
  whole-ROM build stays byte-identical.
- Both projects promoted via git mv; leftover _wip/ folders removed; root
  README.md inventory rows added; WIP.md rows removed.

World Class Track Meet (U): apply zero-page symbol substitutions

Run apply_symbols.py to substitute ZpXX zero-page operands with
semantic locals.inc aliases (SlotState, GameMode, etc.) at proven
sites; 0 residue, whole-ROM build stays byte-identical.

Xevious (U): re-split Pass 1 from the Mesen CDL and decode the data tables

- Xevious (U) - Pass 1 re-split from the Mesen CDL (xevious_mesen.cdl) with
  _tools/cdl_reclass.py: 1,158 bytes data->code, 48 code->data, 42 labels
  emitted and 3 branch targets labelled; code 11,321->12,455 bytes
  (34.5%->38.0%), instructions 5,513->6,002. The 45 recovered entry points
  are named Sub_XXXX, so no Label_XXXX remains; six CDL-silent raw call
  operands are documented as residue.
- Xevious (U) - the 4,448-byte block at $A74B-$B8AA is split into six proven
  tables: VramWritePtrTable (15 pointers), VramWriteData, DataStreamPtrTable
  (16), ObjTilePtrTable (99), ObjTileData and DataStreamData. The $D833
  pointer table is corrected to base $D833 (4 entries; the old ObjCodePtrTable
  at $D834 was one byte late). $F957-$FAF5 is split into ObjSpeedTable,
  ObjSpeedTable2, SpriteLayoutPtrTable (19) and SpriteLayoutData;
  $FEE6-$FF1C into PaletteData and OamAttrTable. $F5D8 is decoded as
  TextTileData (font tile indices: PLAYER, GAME OVER, READY, SOLVALOU, LEFT,
  PAUSE); $F53C becomes AttrAddrTable, $F89E HandlerPtrTable and $EF3B
  SpriteLayoutData2. Project README rewritten with the corrected stats, a
  32-entry table inventory and the Pass 1 residue.
- _tools/cdl_reclass.py - preserve the data label(s) between a data-block
  header and its first .byte row when the block stays data; the $DF78 split
  dropped Data_DF78 and the rebuild failed with an undefined symbol.
- _tools/resolve_raw_branches.py - handle negative relative offsets
  (beq *-$0B); the pattern only matched *+$NN and *$NN.

Docs: refresh the tier counts to 41 promoted / 851 _wip, add the WCTM row

- Docs - tier counts refreshed to the post-promotion state across AGENTS.md,
  root README.md, WIP.md, TODO.md and CHANGELOG.md: 41 promoted projects
  (38 under NROM/, plus CNROM/World Class Track Meet (U), UNROM/Zanac (U) and
  MAPPER8/Mermaids of Atlantis (U)) and 851 _wip/ projects, every one of them
  a Pass 0 skeleton. The stale "39/40 promoted", "853 _wip", "Golf (JU) is
  still in _wip/" and "Golf is the last pre-canonical project" statements are
  corrected.
- Root README.md - the promoted inventory gained the missing World Class Track
  Meet (U) row (row 41, mapper 3, 32 KB PRG / 32 KB CHR), and the "All 38 are
  mapper 0 / 16 KB PRG" sentence is replaced with the actual split (36 of the
  41 rows are mapper 0 / 16 KB; Xevious and Volleyball are 32 KB, World Class
  Track Meet is mapper 3, Zanac mapper 2 and Mermaids mapper 8).
2026-10-21 11:36:32 -04:00

460 lines
12 KiB
Plaintext

# Pyramid (U) (Sachen) — Pass 2 name map
#
# Derived from this dump's own committed split. Every name below was read
# out of the code; nothing is generic where the ROM gives a better basis.
#
# Format: <CPU address><TAB><name>
#
# The routine entries (the task table, the engine routines and the boot
# chain) are named by hand; the internal branch targets are derived from the
# branch that reaches them by _tools/derive_branch_names.py:
# beq -> OnZero bne -> OnNonzero
# bcc -> OnCarryClear bcs -> OnCarrySet
# bmi -> OnNegative bpl -> OnNonnegative
# bvc -> OnOverflowClear bvs -> OnOverflowSet
# a backwards branch (the target is below the branch) -> Loop
#
# The game dispatches through `jmp` trampoline tables that live inside the
# data regions ($C000-$C01B and the data blocks at $C01E, $C02A, $C042 and
# $C054). Those table entries are the game's *task* entries and are named
# Task_<name>; the routines they jump to carry the plain name.
#
# Two vocabularies are used for the zero-page and RAM state:
# * $02/$03 the 16-bit script pointer
# * $00/$01 the high/low bytes of a VRAM address
# * $04 the command-list sync flag
# * $05/$06 the VRAM write position
# * $0700/$0701 the VRAM command buffer (16-bit pointer)
C000 Task_PlayVramScript
C003 Task_CopyBlockToCommandBuffer
C006 Task_UploadPalette1
C009 Task_UploadPalette2
C00C Task_FinishCommandList
C00F Task_StrobeControllers
C012 Task_EmitVramAddressMarker
C015 Task_DrawSpriteAtPosition
C018 Task_ClearOamShadow
C01B Task_AddToCounter
C027 Task_FlushVramCommandList
C03C Task_Multiply16
C03F Task_BuildVramCommandList
C048 Task_ShiftRight8
C04B Task_ShiftLeft8
C04E Task_SetPalette16
C051 Task_SetPaletteBlock16
C063 PlayVramScript
C090 PlayVramScript_CopyRun
C0A0 PlayVramScript_WriteData
C0A8 PlayVramScript_StoreCount
C0AD PlayVramScript_NextCommand
C0B3 PlayVramScript_End
C0B9 CopyBlockToCommandBuffer
C0CD CopyBlockToCommandBuffer_Loop
C0DB UploadPalette1
C0ED UploadPalette1_Loop
C0FB UploadPalette2
C10D UploadPalette2_Loop
C11B FinishCommandList
C122 FinishCommandList_Wait
C127 FlushVramCommandList
C139 FlushVramCommandList_Loop
C155 FlushVramCommandList_WriteData
C15B FlushVramCommandList_End
C160 StrobeControllers
C16A ReadControllers
C188 DrawSpriteAtPosition
C192 EmitVramAddressMarker
C198 BuildVramAddress
C1B6 ClearOamShadow
C1BA ClearOamShadow_Loop
C1C1 AddToCounter
C1C4 AddToCounter_Wait
C1C9 IncrementCounter16
C1CF IncrementCounter16_End
C1D0 AdvanceScriptPointer
C1D6 AdvanceScriptPointer_Loop
C1D7 ConvertNibbleToBcd
C1E2 ConvertNibbleToBcd_Digit
C1EA ConvertNibbleToBcd_Store
C1EF SetPpuCtrl
C1F6 WaitForVblankClear
C1FB WaitForVblankSet
C201 SetPpuCtrlAndMask
C205 SetPpuCtrlAndMask_Alt
C207 SetPpuCtrlAndMask_Store
C225 StoreOamEntry
C23A DrawTwoDigitNumber
C256 DrawTwoDigitNumber_Loop
C25F DrawTwoDigitNumber_High
C277 EmitDigit
C28A EmitDigit_SetFlag
C28F EmitDigit_Store
C294 AddDeltaToPosition
C2A0 AddDeltaToPosition_Loop
C2B6 AddDeltaToPosition_Carry
C2BE AddDeltaToPosition_Store
C2E2 AddDeltaToPosition_Carry2
C2EA AddDeltaToPosition_Store2
C2F9 AddDeltaToPosition_End
C300 Multiply16
C317 BuildVramCommandList
C31B BuildVramCommandList_SetAddress
C32C BuildVramCommandList_Data
C341 BuildVramCommandList_Store
C347 BuildVramCommandList_End
C34A CopyBlockToCommandBufferTail
C354 CopyBlockToCommandBufferTail_Loop
C35F SetPaletteBlock
C36D SetPaletteBlock_Loop
C384 ScanForButtonPress
C386 ScanForButtonPress_Loop
C392 DispatchTask1
C3B6 MoveSpriteRight
C3C7 MoveSpriteLeft
C3D8 ComputeOamSlotAddress
C3E3 MoveSpriteDown
C3E7 MoveSpriteUp
C3EB MoveSpriteLeft2
C3EF MoveSpriteRight2
C3F0 ClampSpriteToGrid
C3FA ClampSpriteToGrid_Redraw
C3FD Task_ReturnStub
C3FE BuildVramPositionWrite
C43E Subtract16
C460 Subtract16_Loop
C477 Subtract16_Loop2
C47A Subtract16_Loop3
C49A Subtract16_Loop4
C4B1 Subtract16_Loop5
C4B4 Subtract16_Loop6
C4B8 ShiftRight8
C4C0 ShiftRight8_OnNonzero
C4C7 ShiftRight8_Loop
C4D1 ShiftLeft8
C4D9 ShiftLeft8_OnNonzero
C4E4 ShiftLeft8_Loop
C4EB SetPalette16
C4FD SetPalette16_Loop
C50A SetPalette16_Entry
C536 SetPaletteBlock16
C548 SetPaletteBlock16_Loop
C56D SetPaletteBlock16_Entry
C585 WriteDigitString
C58F WriteDigitString_Loop
C59D WriteDigitString_Loop_Loop
C5A1 WriteDigitString_Loop_Loop2
C5AB AddDelta24
C5B8 AddDelta24_Copy
C5C0 AddDelta24_Loop
C5E1 AddDelta24_Borrow
C614 AddDelta24B
C620 AddDelta24B_Save
C662 SetPaletteEntry
C676 SetPaletteEntry_OnCarryClear
C683 SetPaletteEntry_OnCarryClear2
C6A3 SetPaletteEntry2
C6BA SetPaletteEntry2_OnNonnegative
C6DB SetPaletteEntry2_OnCarryClear
C800 BootColdStart
C805 BootWaitForVblank
C80A BootWaitForVblank2
C815 BootClearRam
C835 BootInitState
C897 BootFirstFrame
C8A4 BootDecCounters
C8B8 BootDecTimer
C8D0 BootCopySpriteData
C8F2 BootUploadPalette
C90D BootCopyTableToBuffer
C932 BootCopyTableStart
C934 BootCopyTableLoop
C9A7 BootInitLevel
CA1D BootCheckController
CA32 BootFrameCounter
CA41 BootDrawSprite
CA61 BootSetFlag
CA68 BootSelectTable
CA80 BootCopyTable
CA97 BootSetPaletteBlock
CAF3 BootInitPpu
CB68 ActorGridClear
CB6C ActorGridClear_Loop
CB82 ActorGridLookup
CB99 ActorGridRead
CBAD ActorGridStart
CBDC ActorGridClamp
CBE5 ActorGridInit
CBF9 ActorGridFill
CC11 TaskScheduler
CC3D TaskScheduler_Tick
CC56 TaskScheduler_Count
CC5C TaskScheduler_Step
CC71 TaskScheduler_Scan
CC73 TaskScheduler_ScanLoop
CC8B TaskScheduler_Button
CC90 TaskScheduler_Next
CCA5 TaskScheduler_Restart
CCA8 TaskScheduler_Accept
CCB1 DispatchTask2
CCB8 DispatchTask2_Build
CCE5 TaskScheduler_Return
CCEE TaskScheduler_Select
CD07 TaskScheduler_Compare
CD18 TaskScheduler_Compare_Loop
CD23 TaskScheduler_Compare_Loop2
CD24 TaskScheduler_Return2
CD27 TaskScheduler_Check
CD43 TaskScheduler_Check2
CD72 TaskScheduler_Return3
CD75 TaskScheduler_SetPointer
CD80 TaskScheduler_Wait
CD85 TaskScheduler_Wait2
CD8A TaskScheduler_Wait3
CDA4 TaskScheduler_Finish
CDAC TaskScheduler_Advance
CDBD TaskScheduler_Return4
CDC0 TaskScheduler_Start
CDDC TaskScheduler_Place
CE14 TaskScheduler_CursorNext
CE17 TaskScheduler_Return5
CE1A TaskScheduler_Move
CE22 TaskScheduler_MoveStep
CE32 TaskScheduler_Return6
CE35 TaskScheduler_Turn
CE54 TaskScheduler_TurnStep
CE5B TaskScheduler_Return7
CE5E TaskScheduler_Move2
CE66 TaskScheduler_Move2Step
CE78 TaskScheduler_Return8
CE7B TaskScheduler_Turn2
CE96 TaskScheduler_Turn2Step
CE9D TaskScheduler_Return9
CEA0 ActorPositionLookup
CEA8 ActorPositionLookup_Entry
CED3 TaskScheduler_Return10
CED6 ActorGridRebuild
CEE0 ActorGridRebuild_Row
CEEB ActorGridRebuild_Cell
CEF6 ActorGridRebuild_Next
CF02 ActorGridRebuild_NextRow
CF0E ActorGridRebuild_Column
CF10 ActorGridRebuild_ColumnStart
CF14 ActorGridRebuild_Slot
CF29 ActorGridRebuild_Copy
CF35 ActorGridRebuild_SlotEnd
CF55 ActorGridRebuild_Column2
CF67 ActorGridRebuild_Column2Loop
CF74 ActorGridRebuild_Copy2
CF90 ActorGridRebuild_Copy2End
CF98 ActorGridRebuild_Column2End
CFC4 ActorGridRebuild_End
CFC7 ActorGridNext
CFFA ActorGridNext_Reset
CFFF ActorGridNext_Start
D020 ActorGridNext_Start_Loop
D02A ActorSearch
D036 ActorSearch_Row
D03D ActorSearch_Slot
D04A ActorSearch_Match
D074 ActorSearch_Check
D085 ActorSearch_NotFound
D087 ActorSearch_Restore
D0A0 ActorSearch_Restore2
D0AC ActorSearch_Restore3
D0AD ActorSearch_Empty
D0B6 ActorSearch_Restore4
D0B8 ActorSearch_Next
D0C3 ActorSearch_Done
D0D3 ActorPositionTest
D0DF ActorPositionTest_Loop
D0F5 ActorPositionTest_Loop_Loop
D0F8 ActorPositionTest_Step
D105 ActorPositionTest_End
D10D ActorPositionTest_Match
D134 ActorPositionTest_Blocked
D13C ActorPositionTest_Taken
D146 ActorPositionTest_Compare
D15B ActorPositionTest_Blocked2
D15E ActorPositionTest_Compare2
D16A ActorPositionTest_Compare3
D185 ActorPositionTest_Next
D190 ActorPositionTest_Done
D193 RandomByte
D1B2 DrawActorRow
D1BB DrawActorRow_Setup
D1D7 DrawActorRow_Copy
D1EC DrawScore
D1FD DrawLifeCount
D20E DrawLevelNumber
D21C DrawTileRow
D227 DrawTileRow_Loop
D237 DrawTileRow_Digit
D23A DrawTileRow_Store
D248 DecimalSplit
D24A DecimalSplit_Hundreds
D253 DecimalSplit_Tens
D257 DecimalSplit_Units
D260 DecimalSplit_Done
D265 DrawActorSprite
D27F DrawActorSprite_Setup
D2A0 OamShadowClear
D2A4 OamShadowClear_Loop
D2BF ActorGridOffset
D2ED ActorGridOffset_Copy
D3A1 RandomWithinRange
D3B5 RandomWithinRange_Out
D3B7 ActorSpriteSetup
D3BB ActorSpriteSetup_Offset
D41D ActorSpriteSetup_State
D424 ActorSpriteSetup_Pos
D42E ActorSpriteSetup_Next
D43E ActorSpriteSetup_Draw
D45A OamShadowClear2
D45E OamShadowClear2_Loop
D476 OamShadowClear3
D47F OamShadowClear3_Loop
D488 ActorSpriteSetup_Offset2
D4B7 OamShadowClear4
D4BB OamShadowClear4_Loop
D4C5 ActorInitFromTable
D50A ActorUpdate
D510 ActorUpdate_Loop
D512 ActorUpdate_Slot
D520 ActorUpdate_Timer
D530 ActorUpdate_Move
D54A ActorUpdate_Next
D555 ActorUpdate_Done
D56B ActorUpdate_Anim
D57A ActorUpdate_AnimIndex
D59A ActorUpdate_Sprite
D5AD ActorUpdate_SpritePos
D5CA ActorUpdate_NextSprite
D632 ActorSpawn
D63B ActorSpawn_Setup
D655 ActorSpawn_Start
D66D ActorSpawn_Copy
D679 ActorSpawn_CopyLoop
D6AC ActorGridShift
D6B2 ActorGridShift_Row
D6BB ActorGridShift_Scan
D6C9 ActorGridShift_Next
D6D6 ActorGridShift_Dst
D6E7 ActorGridShift_Copy
D6F6 ActorGridShift_Copy_Loop
D6FD ActorGridShift_Copy2
D720 ActorGridShift_End
D72C ActorGridShift_Done
D72E NmiHandler
D78A NmiHandler_Body
D793 NmiHandler_Epilogue
D79D NmiHandler_Number
D79F NmiHandler_NumberLoop
D7A8 NmiHandler_NumberDigit
D7B6 WriteSoundRegister
D7C5 WriteSoundRegister_Loop
D7D7 SoundTableEntry
D7E3 IrqHandler
D7EB ColdStartAlternate
DE9A SoundInit
DEA9 SoundInit_Copy
DECB SoundPlayEffect
DEFF SoundClearVoices
DF0E SoundStopAll
DF14 SoundStopAll_Loop
DF29 SoundClearVoices_Loop
DF80 SoundTick
DF89 PlaySoundEffectFromSlot
DF8E SoundTick_Voice
DF9A SoundTick_Next
DFA1 SoundTick_Command
DFAC SoundTick_Command2
DFB5 SoundTick_Command3
DFBF SoundTick_Command4
DFD5 SoundTick_Sample
DFF4 SoundTick_Volume
E00C SoundTick_Volume2
E017 SoundTick_VolumeLoop
E029 SoundTick_Envelope
E04B SoundPlayer
E057 SoundPlayer_Reset
E05E SoundPlayer_Command
E069 SoundPlayer_Command2
E072 SoundPlayer_Command3
E07C SoundPlayer_Command4
E099 SoundPlayer_Volume
E0B1 SoundPlayer_Volume2
E0BC SoundPlayer_VolumeLoop
E0CE SoundPlayer_Envelope
E0F0 SoundPlayer2
E0FC SoundPlayer2_Reset
E103 SoundPlayer2_Command
E10E SoundPlayer2_Command2
E117 SoundPlayer2_Command3
E121 SoundPlayer2_Command4
E13E SoundPlayer2_Volume
E156 SoundPlayer2_Volume2
E161 SoundPlayer2_VolumeLoop
E173 SoundPlayer2_Envelope
E195 SoundPlayer3
E1A1 SoundPlayer3_Reset
E1A8 SoundPlayer3_Command
E1B7 SoundPlayer3_Command2
E1D4 SoundPlayer3_Sample
E1E9 SoundPlayer3_Envelope
E1FB SoundPlayer3_Write
E20B SoundPlayer3_WriteLoop
E215 SoundPlayer3_Voice
E220 SoundPlayer3_VoiceLoop
E226 SoundPlayer3_VoiceLoop_OnCarryClear
E230 SoundPlayer3_Voice2
E236 SoundPlayer3_Voice2Loop
E240 SoundPlayer3_Decay
E249 SoundPlayer3_Decay2
E24F SoundPlayer3_Decay2Loop
E259 SoundPlayer3_Done
E25A SoundVoiceIndexAdvance
E260 SoundVoiceIndexAdvance_End
E261 SoundVoiceIndexAdvance2
E267 SoundVoiceIndexAdvance2_End
E268 SoundVoiceIndexAdvance3
E26E SoundVoiceIndexAdvance3_End
E26F SoundVoiceIndexAdvance4
E275 SoundVoiceIndexAdvance4_End
ED6E SampleTableLookup
EDB7 SampleTableLookup_OnNonzero
F891 SampleTableRead
F894 SampleTableRead2
F897 SampleTableRead3
F89A SampleTableNext
F8A2 SampleTableNext_OnNonzero
F8AD SampleTableNext_Loop
F8B2 SampleTableNext_Loop2
F8BC SampleTableNext_Loop3
F8C0 SampleTableNext_Loop4
F8C4 SampleTableNext_OnZero
F8C5 SampleTableNext_Loop5
F8D8 SampleTableNext_Loop6
F8DD SampleTableNext_OnNegative
F8EF SampleTableEnd
F908 SampleTableEnd_OnNonzero
F914 SampleTableEnd_Loop
F922 SampleTableEnd_Loop2
F929 SampleTableEnd_Loop3
F93C SampleTableEnd_Loop4
F941 SampleTableCopy
F942 SampleDecode
F951 SampleTableCopy2
F959 SampleTableCopy2_Loop
FF00 Reset
FF2F Reset_Loop
FF3E BootChainEntry
FF49 BootPokeMapperUnlock
FF4C BootUnlockDelay
FF4E BootUnlockDelay_OnNonzero
FF50 BootUnlockDelay_OnNonzero2
FF57 BootCheckStackBytes
FF67 BootCheckStackBytes_Fail
FF69 BootSeedStackBytes
FF74 ClearCheckerBytes