tmerritt/disasm
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
8f718c0b9b14a866d282ce7be877f21ca87ac647
disasm/_wip/Pyramid (U)/copilot/reconstructed.lbl
T
tmerritt 837007843d MUSCLE (U): decode the bytecode VM layer (Pass 3b) 
The 42 token programs were the last undecoded part of MUSCLE. Each now carries a
token-by-token listing above its unchanged .byte data, generated by
_tools/bytecode_dis.py and wired into the build as 'make pass3'.

Encoding, derived from RunBytecodeInterpreter ($9AE8) and BytecodeHandlerTable
($9237): the dispatch is one byte per element. A byte in $C8-$EF selects one of
the 40 handler-table entries; every other byte takes the literal path at $9B08
and is pushed onto the operand list at $0033[Y], accumulated into $003C[Y].

The one exception is four opcodes whose handler's first instructions are
'lda ($1A),Y / iny', so they consume the following byte inline:
  $CB LOOP_BEGIN  -> $7C,X count + $7E,X body address
  $D1 SET_RATE    -> $43,X
  $D7 DRAW_SPRITE -> count for the $A660 blit
  $E1 SET_WAIT    -> $7A,X
$CB and $C9 are the loop pair: LOOP_END decrements $7C,X and, if non-zero,
reloads Y from $7E,X, rewinding the interpreter to the top of the body.

Decoded 377 opcodes and 937 literal operands across 42 programs; all 40 defined
opcodes are used, so the opcode set is complete.

Two standalone programs contain no byte in $C8-$EF at all, so every byte takes
the literal path - the listing states that rather than implying code.

Each mnemonic was read off its handler's own straight-line path up to its first
'jmp $9AE8' / 'jmp $9B25'. Handlers that only tail-call a game routine are named
for the routine rather than guessed at, since the semantics live in the callee.

bytecode_dis.py inserts comment lines only; .byte data is copied through
verbatim. Verified: all 16,384 PRG bytes still emitted exactly once, every value
equal to the ROM, zero audit mismatches, and 'make regen' (pass1 -> pass2 ->
pass3) reproduces prg.s byte-for-byte. Byte-identical ROM verified.

MUSCLE (U): trace the stage payload with py65 (Pass 3c)

The stage payload at $B0FB-$BEBF could not be decoded statically, and the
trace confirms why: across all 16 KB of code there is exactly ONE operand in
that range - $BD28, the literal pointer table itself. The real address is
formed at runtime by 'adc $BD28,X', where A is a value carried in the
bytecode stream, so the readers are indexed by a runtime value and cannot be
enumerated by searching the code.

FCEUX cannot observe this either: its Lua API offers registerexec /
registerexecute / registerrun / registerwrite but no memory-read hook, and with
no static list of readers there is nothing to hook.

_tools/trace_stage_payload.py therefore uses py65's
ObservableMemory.subscribe_to_read, which fires on every read of a range and
can report PC from inside the hook. py65 is only a 6502 core, so the tracer
adds the minimum hardware to boot the game: a scanline counter off
processorCycles, $2002 vblank at scanline 241 cleared on read, NMI at the same
scanline, $4014 OAM DMA, and the $2005/$2006/$2007 latches. Without NMI the
game never leaves $80E0 (lda $0321 / beq), because $0321 is the flag the
bytecode VM raises.

Results over 300 frames (26.8M cycles, 4,071 NMIs): 2,548 payload reads from
44 distinct reader PCs, touching 914 of 3,421 bytes.

Findings:
- The hottest reader is $AC82, the compressed-VRAM RLE decoder: 1,046 of its
  1,128 reads advance by exactly +1, comparing each byte against $C0.
- $9B50 is a backward copy (lda ($12),Y / sta ($10),Y / dey), stepping -1.
- 107 distinct 8-byte blocks had all eight bytes read, with spacing dominated
  by $08 - a dense 8-byte record array - plus a sparser group on a $D0 stride
  ($BBE0, $BCB0, $BD80, $BE50).
- Readers use three disciplines: forward sequential, backward sequential, and
  variable stride consistent with a fixed-offset field walk.

py65 is deliberately NOT a build dependency: the tool documents unpacking the
wheel on demand. 'make regen' is unaffected. Byte-identical ROM verified.

MUSCLE (U): fix the NMI/controller bugs in the payload tracer; correct the Pass 3c model

The Pass 3c tracer had two bugs that were suppressing all progress, both now
fixed in _tools/trace_stage_payload.py (previously scratch, now durable):

* NMI re-armed by $2002 reads. The vblank flag must be cleared once per frame,
  not on every read of $2002 -- the main loop polls $2002 and spins on the
  bytecode VM flag at $8226, so each poll cleared bit 7 and re-armed NMI inside
  the same scanline. That gave 40,900 NMIs across 3,000 frames and corrupted all
  game state. A per-frame nmi_fired flag restores exactly one NMI per frame
  (verified: 600 frames -> 600 NMIs).

* Input went to $4017. The poll routine at $AA69 is `lda $4016,X` with X=1 and
  only compares bits 0-1, so driving $4017 consumed nothing -- all masks tested
  gave byte-identical traces. The game consumes joy1 on $4016 and needs a real
  latch/shift register. With it, START matters: 47.7% coverage vs 39.0%.
  Match entry is two discrete START presses (title -> char select -> match).

Coverage 26.3% -> 40.9%. Both bugs and the port subtlety are documented in the
tool header so they are not re-derived.

Corrects the Pass 3c conclusion. $B0FB-$BEBF is NOT per-stage level data:

* $BD28 is an 8-entry per-ACTOR entry-offset table, not a stage table.
  $A063 `adc $BD28,X` with X = ActorIndex ($1E), plus #$32 at $A071 when
  PlayerActiveFlag ($78,X) is set. Observed actors are $00-$04.
  Forcing all 8 actor indices adds zero new bytes.

* The sound engine reads the same window: $B03C `lda (SoundReadPointerLo),Y`
  with `cmp #$F0 / sbc #$F0 / tay / lda $B0E3,y` is note decoding, which is
  where the $FF/$F0 high-nibble terminators come from.

So the window is a shared pool -- per-actor bytecode, compressed-VRAM RLE, and
music note streams -- and stage cycling cannot raise coverage past ~40%. The
remaining 2,161 B need other music tracks and scripted match play, not taps.

Also corrects two stale claims: $0326 is not a level byte (never leaves $00 even
in a confirmed match), and $0320 is a boolean, not a screen-state machine.

Build unaffected: byte-identical, and `make regen` still reproduces prg.s
byte-for-byte.

MUSCLE (U): promote to the top-level inventory as #16

git mv _wip/MUSCLE (U) -> MUSCLE (U). The relative symlink
copilot/rom.nes -> ../M.U.S.C.L.E. (U).nes survives the move untouched.

* copilot/Makefile: tool paths ../../../_tools/ -> ../../_tools/ for NESDIS,
  PASS2 and BYTECODE. `make` prints the byte-identity message and `make regen`
  still reproduces prg.s byte-for-byte, both verified after the move.
* MUSCLE (U)/OVERVIEW.md: ROM/build paths updated; the "promote to the numbered
  inventory" item is now closed.
* Root OVERVIEW.md: added as #16, removed from the _wip skeleton table
  (20 -> 19), added a ### 16 detail section, and its vector/mapping notes moved
  out of the skeleton section.

All 16 top-level projects verified byte-identical.

Add Pass 1 verification tool; teach nesdis.py the undocumented opcodes

_tools/verify_pass1.py verifies Pass 1 across every top-level project in two
independent directions:

  * Faithful  - does the source still rebuild its ROM byte-identical?
  * Complete  - does the committed source claim as much code as a fresh trace
                can actually reach?

The second is the one that catches real problems. A project can reproduce all
16,384 bytes perfectly while calling 95% of them data, because the tracer gave
up early. Instruction *counts* are compared rather than bytes, so the check is
independent of comment style (which is not uniform across the repo).

Result: all 16 projects are faithful, and Joypad Test Cartridge is the only
truncated Pass 1 -- 282 committed instructions against 1,773 reachable.

nesdis.py gains three fixes needed to make that verdict trustworthy:

* --undocumented (default OFF) decodes the 105 undocumented NMOS opcodes.
  They are used as NOP padding and as real RMW ops, and a tracer that halts on
  them loses most of the code: Joypad goes 580 -> 3,846 code bytes. Default off
  so MUSCLE's `make regen` still reproduces prg.s byte-for-byte.

* Undocumented opcodes are emitted as explicit `.byte` with the disassembly in
  the comment. ca65 V2.19 implements none of them, so they cannot be written as
  mnemonics; keeping them in the code region preserves the code/data split and
  the audit trail. Official 0xEA NOP still encodes normally.

* Two latent bugs, both now reachable:
  - RESET and IRQ are commonly the same address, and the semantic-name map was
    overwriting, renaming the primary entry point to `IrqHandler`. Now
    setdefault, in RESET/NMI/IRQ priority order.
  - render() stamped every branch operand as Label_XXXX and never reconciled it
    with the semantic name map, so a branch into a named routine emitted a label
    that was never defined and the file would not assemble.

Joypad Test Cartridge (U): redo Pass 1, complete Pass 2; merge _wip into the inventory

Pass 1 (redone). The committed split claimed 282 instructions / 580 bytes (3.5%).
The tracer halted at $C09E on `DCP $3C20` ($CF) -- an undocumented opcode used as
ordinary code -- and filed 3,256 bytes of real code as `.byte` data.

Now 1,773 instructions / 3,836 bytes (23.4%), a 6.6x increase. Verified against a
fresh trace: 1,769 emitted instructions + 4 undocumented opcodes written as
explicit bytes = 1,773, an exact match. Byte accounting stays exact at
3,836 + 12,548 = 16,384.

ca65 V2.19 implements none of the undocumented opcodes, so the 4 affected
instructions (DCP $3C20, LAX $20D4, NOP $C1,X, RRA ($D0),X) are emitted as
explicit `.byte` with the disassembly in the comment. They stay in the code
region, so the split and the audit trail are both preserved.

Pass 2 (complete). All 202 labels renamed; zero `Label_Cxxxx` remaining. Renames
are keyed by address and verified to have bound to the intended address, not just
to some address. 202 routine headers, every one describing real behaviour -- no
"undetermined in Pass 1" boilerplate left. `locals.inc` carries 99 aliases, the
proven semantic ones sitting beside the generated `ZpXX` entries per the alias
pattern in AGENTS.md.

Two naming errors in the previous draft are corrected: $55 is MarkerValue (it
holds $70/$88/$A0 and is compared against them), not a "P1 Down timer"; and the
twelve MarkerVar variables are named by position because which player/button
each belongs to is not established.

Pass 3 is now outstanding, and the old Pass 3 was wrong: it described
$C09E-$C173 and $C17F-$CCF6 as data, and both are code. After the redo there is
exactly one data region, $CF06-$FFFF, confirmed by orphan scan.

Documentation.

The root inventory now lists all 36 projects in one table -- the 20 `_wip/`
projects are rows 17-36 rather than a second table that could drift. That second
table had wrong mirroring for 12 of them (Duck Hunt, Golf, Hogan's Alley, Ice
Climber, DK Jr Math, Lode Runner, Lunar Pool, Mario Bros, Millipede, Pyramid,
Raid [a2], Urban Champion were all recorded H when they are V, and vice versa);
every value is now read from the ROM rather than trusted.

Build status is split into two honest tiers: rows 1-16 are BYTE-IDENTICAL and
compare the whole ROM, rows 17-36 are PRG-IDENTICAL because their Makefiles only
run `cmp reconstructed_prg.bin prg.bin`. Header and CHR are not proven for those.
All 36 build cleanly; the WIP count was also corrected from 19 to 20.

`_tools/verify_pass1.py` checks all 36 and reports none truncated.

Mario Bros (JU): Pass 1 disassembly, 14.6% -> 72.2% code

The skeleton prg.s was a 12-line .incbin of the whole PRG. It is now a real
disassembly: 5,735 instructions, 11,829 code bytes (72.2%), 937 labels and
routine headers, byte accounting exact at 11,800 + 4,584 = 16,384, and
BYTE-IDENTICAL against prg.bin.

Coverage came from four steps, not one:

  vectors + direct jsr/jmp/branch, official opcodes   1,185 instr   14.6%
  --undocumented (105 extra NMOS opcodes)            1,210 instr   14.9%
  --auto-seed (61 table-referenced entries)          4,187 instr   51.1%
  --extra-seed 0xC0B6,0xC5A3                         5,735 instr   72.2%

Almost everything sits behind computed dispatch. Three mechanisms are now
documented in the project OVERVIEW:

* $CD9E is a stack-based indirect call: it pops the table address with `pla`,
  indexes it by A*2 with `lda ($14),y`, then `jmp ($0014)`. Because the pointer
  arrives on the stack it cannot be followed statically from the dispatcher.
* $C5A3 is a 20-entry table of `JSR` thunks ending in `rts`. Probing it linearly
  gives twenty valid targets, and seeding it recovers most of the last 21%.
* $C0B6 is the NMI phase dispatcher, reachable only by computed dispatch.

Two overlapping-decode bugs in _tools/nesdis.py had to be fixed first:

* Control-flow targets must win over fall-through. `bne` at $C4BA targets $C528,
  but the fall-through path had decoded $C527 as a 2-byte `NOP #$A5` whose
  operand swallowed $C528. No assembler branches into the middle of an
  instruction, so the spanning decode is now dropped in favour of the target;
  its bytes fall out as data, leaving byte accounting unchanged.
* Branch targets inside a surviving instruction must be pruned from the target
  set. Otherwise emit_code's linear walk consumes those bytes as an operand, so
  the label is referenced but never defined and the file does not assemble at
  all -- `Error: Symbol 'Label_C528' is undefined`.

Neither change disturbs an existing pipeline: MUSCLE's `make regen` still
reproduces prg.s byte-for-byte, Joypad Test Cartridge still builds byte-identical,
and _tools/verify_pass1.py reports all 16 top-level projects faithful with none
truncated.

Mario Bros (JU): Pass 2, partial -- make the call graph readable

Two mechanical wins, in order of value:

* **477 jsr/jmp operands rewritten from raw $XXXX to labels.** The tracer emits
  call and jump targets as hex, so the call graph was unreadable -- the most
  called routine appeared as `jsr $CCA0` 14 times over. Every one of those sites
  already had a label at its target address, so the substitution is purely
  mechanical and byte-preserving. Zero raw hex call operands remain.

* **13 landmark routines named** from verified instruction evidence:
  WaitVblank1, ClearRamPageLoop, NmiPhaseDispatch ($C0B6), JsrThunkTable
  ($C5A3), DispatchViaStackPointer ($CD9E), AdvanceDispatchPointer ($CDB4),
  PushTablePointerDispatch ($CCA0), DispatchTableF393 ($CAB9),
  InitSpritesOffscreen ($DFC4), AdjustDecimalColumns ($D15A),
  TestRamFlagPair0500 ($D328), NextIndex ($CE84).

**922 labels remain unnamed, and that is recorded as the honest state** rather
than papered over. They sit 15-25 per page across $CC00-$CFFF, which is just
the game logic: naming them means reading ~5,700 instructions across 935
routines. Guessing from the call graph and the NES convention would be exactly
the guessy rewrite PROMPTS.md rules out.

The productive next step is more reach, not more naming. The 4,555 unreached
bytes are where most unnamed routines live, and they are gated behind the
stack-pointer dispatch at $CD9E, whose pushed table addresses are only known in
the callers' frames.

Still BYTE-IDENTICAL; all 16 top-level projects remain faithful.

Record audit-comment work for Excitebike and Pac-Man as a TODO

Both projects are hand-written sources with semantic labels but no
byte-identity audit comment, so a source line cannot be mapped back to exact
ROM bytes without re-assembling. Every other project in the repo carries one.

Documented what was tried and why it was dropped rather than left implicit.
Addresses from 'ca65 -l' work fine -- the listing offset indexes prg.bin
directly -- but the listing carries no source line numbers, so entries cannot
be keyed back to source lines. Byte values also have to come from prg.bin
rather than the listing, since ca65 prints 'rr rr' for relocatable words.

No tool was committed, because the one written does not work. Both projects
verified still byte-identical; no source file was changed.

Add TODO.md handoff; bring AGENTS.md back in line with the repo

AGENTS.md had drifted on facts that are now wrong, not just incomplete:

* "Eleven disassemblies" -> 36 (16 top-level, 20 in _wip). The index it points
  at had the same stale count.
* The audit-comment convention was stated as `; PRG:$xxxx AA BB`, but the
  dominant spelling is `; CPU:$xxxx PRG:xxxx  AA BB` and five other variants are
  in use, with Excitebike and Pac-Man carrying none at all. Now stated accurately
  as "preserve whatever spelling a file uses", with the gap pointed at.
* `_tools/` was described as holding splitnes.py and chr2gif.py. It holds six
  tools now, including the Pass 1 tracer and the verifier.
* ROM filenames "contain spaces" -> spaces *and parentheses*, which is also what
  makes FCEUX hang headless.

Added, because each one costs real time if rediscovered:

* The two build tiers. The 20 _wip projects only `cmp reconstructed_prg.bin
  prg.bin`, so their header and CHR are NOT proven -- calling them
  byte-identical to the ROM is wrong.
* A promotion procedure, since that has now been done twice.
* A tracer/toolchain gotchas section: undocumented opcodes truncating traces
  (and ca65 being unable to encode them), vectors living at the end of the PRG
  rather than in the iNES header, the RESET==IRQ name collision, control-flow
  targets beating fall-through, the branch-target pruning that stops a file
  failing to assemble, NMI firing once per frame rather than per $2002 read,
  joy1 being $4016, and ca65 listings carrying no source line numbers.

TODO.md is the handoff document: open work per project with enough detail to
resume, the residue counts, and the reasoning behind each abandoned approach so
it is not silently retried.

Nothing rebuilt or changed; all projects still verify.

Joypad Test Cartridge (U): Pass 3 complete — data region named and VRAM command stream decoded

The monolithic `.byte $CF06-$FFFF` block (12,538 bytes) has been broken into 20 named sub-blocks:

VRAM command streams ($CF06-$D4AD): three command streams separated by $FF terminators, read by VramWriteLoop via RetAddrUpdate. Opcode set decoded: $4C = jump, $60 = deferred PPUCTRL, bit-7-clear = VRAM write (PPU addr + data, bit 6 of data = long/short selector).

OAM tables ($D4E3-$D6A3): 12 groups of 32-byte tables (8 entries of Y/tile/attr/X), read by CopyOamFromTable ($D4E3) and CopyOamFromTable70 ($D5C4).

Sprite templates ($D6A5-$D6E4): sprite template read by CopySpriteTemplateTable ($D6A5) and button OAM template read by PrepareButtonOam ($D6C5).

Padding: $FF ROM padding ($D6E5-$FFF9) and vectors ($FFFA-$FFFF).

OVERVIEW.md updated: section 8 documents all 20 sub-blocks with the VRAM command stream format and OAM table structure; section 11 marks Pass 3 complete with remaining work (MarkerVar player/button mapping, HandleButtonPress sprite order).

Build verified byte-identical.

Root OVERVIEW.md: mark Joypad Pass 3 complete

Update summary table (row 14: Pass Pass 2 → Pass 3 complete), detail section
(section 14: Pass 2/3 → Pass 3 complete with VRAM command stream decoded),
methodology note table (Pass 2 complete → Pass 3 complete), and notable
observations (Joypad at Pass 2/3 → Pass 3 complete).

Joypad Test Cartridge is now fully Pass 3 complete: all 20 data sub-blocks
named, VRAM command stream opcode set decoded, OAM table structure documented.

TODO.md: mark Joycad Test Cartridge Pass 3 complete

Mario Bros (JU): Pass 2 substantial — 252 subroutine entry points named

All 252 jsr/jmp targets resolved from raw $XXXX to labels:
- 90 semantic names: audio/sound routines ($F8xx-$F9xx: AudioPulse1CtrlSetup,
  WritePulse2Freq, ProcessTriangleChannel, SetupAudioChannel, etc.), gameplay
  helpers (CheckZpB3Return, CheckRangeReturn012, ToggleZpFC_Bit3, etc.)
- 165 address-based names (SubCxxxx) for the remainder
- Zero raw $XXXX call operands remain

667 Label_Cxxxx internal branch targets remain — these are local control-flow
destinations within routines, not subroutine entry points, and do not need
semantic names for the call graph to be readable.

Build verified BYTE-IDENTICAL. Root OVERVIEW.md updated (row 26: Pass 0 skeleton
→ Pass 1 complete, Pass 2 substantial). TODO.md updated.

Lunar Pool (U): Pass 1 complete, 57.8% code; nesdis.py opcode/emitter fixes

The skeleton prg.s was a 12-line .incbin of the whole PRG. It is now a real
disassembly: 4,586 instructions, 9,475 code bytes (57.8%), 6,909 data bytes,
byte accounting exact at 9,403 + 6,981 = 16,384, BYTE-IDENTICAL.

Coverage: vectors + direct jsr/jmp/branch reached 1,259 instructions (15.6%).
--undocumented took it to 4,572 (57.6%), and --auto-seed (48 table-referenced
entries) plus --extra-seed 0xE80C (the non-$C000 RESET vector) took it to
4,586 (57.8%).

Three undocumented opcodes were missing from nesdis.py and are added:
* $72 RRA abs (the RRA family was missing the $72 absolute form)
* $42 NOP #imm (the NOP-immediate family was missing $42)
* $FA NOP abs,X (the NOP-abs,X family was missing $FA)

One emitter fix: ca65 silently rewrites an operand whose high byte is $00 in
the shorter zero-page form -- `sta $00FF,x` assembles as `sta $FF,x` ($95
instead of $9D). render() now emits the `a:` prefix for ABS/ABSX/ABSY/IND
operands with a high byte of $00, forcing the absolute form so the emitted
bytes match the ROM. operand_value() strips the prefix when parsing.

These changes are general and verified not to disturb existing pipelines:
MUSCLE's `make regen` still reproduces prg.s byte-for-byte.

Remaining gaps: 6,909 bytes (42.2%) still data, gated behind jmp ($7961) at
three sites (RAM-pointer dispatch; the blocks after them hold the screen text
"strings" "game over" and "hi`score__") and stack-based dispatch at $CBDC --
the same pattern as Mario Bros (JU)'s $CD9E.

TODO.md: add Lunar Pool as an open item

Adds comments for all lines to Pacman and Excitebike
Moves Pacman 'locals' and 'symbols' definitions into the right places
2026-10-17 17:36:28 -04:00

426 lines
9.1 KiB
Plaintext
Raw Blame History

al 00FFFA .Label_FFFA
al 00FF74 .Label_FF74
al 00FF69 .Label_FF69
al 00FF67 .Label_FF67
al 00FF57 .Label_FF57
al 00FF50 .Label_FF50
al 00FF4E .Label_FF4E
al 00FF4C .Label_FF4C
al 00FF49 .Label_FF49
al 00FF3E .Label_FF3E
al 00FF2F .Label_FF2F
al 00FF00 .Label_FF00
al 00F942 .Label_F942
al 00F941 .Label_F941
al 00F93C .Label_F93C
al 00F929 .Label_F929
al 00F922 .Label_F922
al 00F914 .Label_F914
al 00F908 .Label_F908
al 00F8EF .Label_F8EF
al 00F8D8 .Label_F8D8
al 00F8C5 .Label_F8C5
al 00F8BC .Label_F8BC
al 00F8C0 .Label_F8C0
al 00F8B2 .Label_F8B2
al 00F8AD .Label_F8AD
al 00F8A2 .Label_F8A2
al 00F8C4 .Label_F8C4
al 00F8DD .Label_F8DD
al 00F89A .Label_F89A
al 00F897 .Label_F897
al 00F894 .Label_F894
al 00F891 .Label_F891
al 00EDBF .Label_EDBF
al 00EDB7 .Label_EDB7
al 00ED6E .Label_ED6E
al 00E276 .Label_E276
al 00E275 .Label_E275
al 00E26F .Label_E26F
al 00E26E .Label_E26E
al 00E268 .Label_E268
al 00E267 .Label_E267
al 00E261 .Label_E261
al 00E260 .Label_E260
al 00E25A .Label_E25A
al 00E24F .Label_E24F
al 00E259 .Label_E259
al 00E249 .Label_E249
al 00E236 .Label_E236
al 00E240 .Label_E240
al 00E226 .Label_E226
al 00E230 .Label_E230
al 00E220 .Label_E220
al 00E20B .Label_E20B
al 00E215 .Label_E215
al 00E1FB .Label_E1FB
al 00E1E9 .Label_E1E9
al 00E1D4 .Label_E1D4
al 00E1B7 .Label_E1B7
al 00E1A8 .Label_E1A8
al 00E1A1 .Label_E1A1
al 00E195 .Label_E195
al 00E161 .Label_E161
al 00E173 .Label_E173
al 00E156 .Label_E156
al 00E13E .Label_E13E
al 00E121 .Label_E121
al 00E117 .Label_E117
al 00E10E .Label_E10E
al 00E103 .Label_E103
al 00E0FC .Label_E0FC
al 00E0F0 .Label_E0F0
al 00E0BC .Label_E0BC
al 00E0CE .Label_E0CE
al 00E0B1 .Label_E0B1
al 00E099 .Label_E099
al 00E07C .Label_E07C
al 00E072 .Label_E072
al 00E069 .Label_E069
al 00E05E .Label_E05E
al 00E057 .Label_E057
al 00E04B .Label_E04B
al 00E017 .Label_E017
al 00E029 .Label_E029
al 00E00C .Label_E00C
al 00DFD5 .Label_DFD5
al 00DFF4 .Label_DFF4
al 00DFBF .Label_DFBF
al 00DFB5 .Label_DFB5
al 00DFAC .Label_DFAC
al 00DFA1 .Label_DFA1
al 00DF9A .Label_DF9A
al 00DF89 .Label_DF89
al 00DF8E .Label_DF8E
al 00DF80 .Label_DF80
al 00DF3E .Label_DF3E
al 00DF30 .Label_DF30
al 00DF29 .Label_DF29
al 00DF14 .Label_DF14
al 00DEFF .Label_DEFF
al 00DF0E .Label_DF0E
al 00DECB .Label_DECB
al 00DEBB .Label_DEBB
al 00DEA9 .Label_DEA9
al 00DE9A .Label_DE9A
al 00D7F3 .Label_D7F3
al 00D7EB .Label_D7EB
al 00D7E3 .Label_D7E3
al 00D7D7 .Label_D7D7
al 00D7C5 .Label_D7C5
al 00D7B6 .Label_D7B6
al 00D79D .Label_D79D
al 00D793 .Label_D793
al 00D78A .Label_D78A
al 00D72E .Label_D72E
al 00D72D .Label_D72D
al 00D72C .Label_D72C
al 00D6FD .Label_D6FD
al 00D6F6 .Label_D6F6
al 00D6E7 .Label_D6E7
al 00D6D6 .Label_D6D6
al 00D720 .Label_D720
al 00D6C9 .Label_D6C9
al 00D6BB .Label_D6BB
al 00D6B2 .Label_D6B2
al 00D6AC .Label_D6AC
al 00D69C .Label_D69C
al 00D679 .Label_D679
al 00D66D .Label_D66D
al 00D655 .Label_D655
al 00D63B .Label_D63B
al 00D632 .Label_D632
al 00D5D5 .Label_D5D5
al 00D5CA .Label_D5CA
al 00D5AD .Label_D5AD
al 00D59A .Label_D59A
al 00D57A .Label_D57A
al 00D56B .Label_D56B
al 00D556 .Label_D556
al 00D555 .Label_D555
al 00D54A .Label_D54A
al 00D530 .Label_D530
al 00D520 .Label_D520
al 00D512 .Label_D512
al 00D510 .Label_D510
al 00D50A .Label_D50A
al 00D4EE .Label_D4EE
al 00D4C5 .Label_D4C5
al 00D4BB .Label_D4BB
al 00D4B7 .Label_D4B7
al 00D47F .Label_D47F
al 00D488 .Label_D488
al 00D476 .Label_D476
al 00D467 .Label_D467
al 00D45E .Label_D45E
al 00D45A .Label_D45A
al 00D43E .Label_D43E
al 00D42E .Label_D42E
al 00D424 .Label_D424
al 00D41D .Label_D41D
al 00D3BB .Label_D3BB
al 00D3B7 .Label_D3B7
al 00D3B5 .Label_D3B5
al 00D3A1 .Label_D3A1
al 00D320 .Label_D320
al 00D2ED .Label_D2ED
al 00D2BF .Label_D2BF
al 00D2AB .Label_D2AB
al 00D2A4 .Label_D2A4
al 00D2A0 .Label_D2A0
al 00D27F .Label_D27F
al 00D265 .Label_D265
al 00D260 .Label_D260
al 00D257 .Label_D257
al 00D253 .Label_D253
al 00D24A .Label_D24A
al 00D248 .Label_D248
al 00D23A .Label_D23A
al 00D237 .Label_D237
al 00D227 .Label_D227
al 00D21C .Label_D21C
al 00D20E .Label_D20E
al 00D1FD .Label_D1FD
al 00D1EC .Label_D1EC
al 00D1D7 .Label_D1D7
al 00D1BB .Label_D1BB
al 00D1B2 .Label_D1B2
al 00D1AA .Label_D1AA
al 00D193 .Label_D193
al 00D190 .Label_D190
al 00D185 .Label_D185
al 00D16A .Label_D16A
al 00D15E .Label_D15E
al 00D15B .Label_D15B
al 00D146 .Label_D146
al 00D134 .Label_D134
al 00D13C .Label_D13C
al 00D10D .Label_D10D
al 00D105 .Label_D105
al 00D0F5 .Label_D0F5
al 00D0F8 .Label_D0F8
al 00D0DF .Label_D0DF
al 00D0D3 .Label_D0D3
al 00D0C5 .Label_D0C5
al 00D0C3 .Label_D0C3
al 00D0B0 .Label_D0B0
al 00D0AD .Label_D0AD
al 00D0AC .Label_D0AC
al 00D0A0 .Label_D0A0
al 00D0B6 .Label_D0B6
al 00D087 .Label_D087
al 00D0B8 .Label_D0B8
al 00D080 .Label_D080
al 00D085 .Label_D085
al 00D074 .Label_D074
al 00D050 .Label_D050
al 00D04A .Label_D04A
al 00D040 .Label_D040
al 00D03D .Label_D03D
al 00D036 .Label_D036
al 00D02A .Label_D02A
al 00D021 .Label_D021
al 00CFFF .Label_CFFF
al 00CFFA .Label_CFFA
al 00D020 .Label_D020
al 00CFC7 .Label_CFC7
al 00CFC4 .Label_CFC4
al 00CF90 .Label_CF90
al 00CF74 .Label_CF74
al 00CF67 .Label_CF67
al 00CF98 .Label_CF98
al 00CF55 .Label_CF55
al 00CF29 .Label_CF29
al 00CF35 .Label_CF35
al 00CF14 .Label_CF14
al 00CF10 .Label_CF10
al 00CF0E .Label_CF0E
al 00CF02 .Label_CF02
al 00CEF6 .Label_CEF6
al 00CEEB .Label_CEEB
al 00CEE0 .Label_CEE0
al 00CED6 .Label_CED6
al 00CED3 .Label_CED3
al 00CEA8 .Label_CEA8
al 00CEA0 .Label_CEA0
al 00CE96 .Label_CE96
al 00CE9D .Label_CE9D
al 00CE7B .Label_CE7B
al 00CE78 .Label_CE78
al 00CE66 .Label_CE66
al 00CE5E .Label_CE5E
al 00CE54 .Label_CE54
al 00CE5B .Label_CE5B
al 00CE35 .Label_CE35
al 00CE32 .Label_CE32
al 00CE22 .Label_CE22
al 00CE1A .Label_CE1A
al 00CE17 .Label_CE17
al 00CE14 .Label_CE14
al 00CDDC .Label_CDDC
al 00CDC0 .Label_CDC0
al 00CDBD .Label_CDBD
al 00CDAC .Label_CDAC
al 00CDA4 .Label_CDA4
al 00CD97 .Label_CD97
al 00CD8A .Label_CD8A
al 00CD85 .Label_CD85
al 00CD80 .Label_CD80
al 00CD75 .Label_CD75
al 00CD72 .Label_CD72
al 00CD43 .Label_CD43
al 00CD27 .Label_CD27
al 00CD24 .Label_CD24
al 00CD23 .Label_CD23
al 00CD18 .Label_CD18
al 00CD07 .Label_CD07
al 00CCEE .Label_CCEE
al 00CCE5 .Label_CCE5
al 00CCCD .Label_CCCD
al 00CCB8 .Label_CCB8
al 00CCB1 .Label_CCB1
al 00CCA5 .Label_CCA5
al 00CCA8 .Label_CCA8
al 00CC90 .Label_CC90
al 00CC8B .Label_CC8B
al 00CC73 .Label_CC73
al 00CC56 .Label_CC56
al 00CC5C .Label_CC5C
al 00CC71 .Label_CC71
al 00CC3D .Label_CC3D
al 00CC11 .Label_CC11
al 00CBF9 .Label_CBF9
al 00CBE5 .Label_CBE5
al 00CBC1 .Label_CBC1
al 00CBDC .Label_CBDC
al 00CBAD .Label_CBAD
al 00CB99 .Label_CB99
al 00CB82 .Label_CB82
al 00CB6C .Label_CB6C
al 00CB68 .Label_CB68
al 00CAF3 .Label_CAF3
al 00CAAA .Label_CAAA
al 00CA80 .Label_CA80
al 00CA41 .Label_CA41
al 00CA97 .Label_CA97
al 00CA68 .Label_CA68
al 00CA32 .Label_CA32
al 00CA61 .Label_CA61
al 00CA1D .Label_CA1D
al 00C9A7 .Label_C9A7
al 00C95A .Label_C95A
al 00C934 .Label_C934
al 00C932 .Label_C932
al 00C90D .Label_C90D
al 00C8D0 .Label_C8D0
al 00C8F2 .Label_C8F2
al 00C8A4 .Label_C8A4
al 00C8B8 .Label_C8B8
al 00C897 .Label_C897
al 00C835 .Label_C835
al 00C815 .Label_C815
al 00C80A .Label_C80A
al 00C805 .Label_C805
al 00C800 .Label_C800
al 00C714 .Label_C714
al 00C614 .Label_C614
al 00C609 .Label_C609
al 00C585 .Label_C585
al 00C56D .Label_C56D
al 00C548 .Label_C548
al 00C536 .Label_C536
al 00C52E .Label_C52E
al 00C52A .Label_C52A
al 00C50A .Label_C50A
al 00C4FD .Label_C4FD
al 00C4EB .Label_C4EB
al 00C4E4 .Label_C4E4
al 00C4D9 .Label_C4D9
al 00C4D1 .Label_C4D1
al 00C4C7 .Label_C4C7
al 00C4C0 .Label_C4C0
al 00C4B8 .Label_C4B8
al 00C43E .Label_C43E
al 00C3FE .Label_C3FE
al 00C3FD .Label_C3FD
al 00C3FA .Label_C3FA
al 00C3F0 .Label_C3F0
al 00C3EF .Label_C3EF
al 00C3EB .Label_C3EB
al 00C3E7 .Label_C3E7
al 00C3E3 .Label_C3E3
al 00C3D8 .Label_C3D8
al 00C3C7 .Label_C3C7
al 00C3B8 .Label_C3B8
al 00C3A6 .Label_C3A6
al 00C392 .Label_C392
al 00C386 .Label_C386
al 00C384 .Label_C384
al 00C36D .Label_C36D
al 00C35F .Label_C35F
al 00C34A .Label_C34A
al 00C341 .Label_C341
al 00C347 .Label_C347
al 00C32C .Label_C32C
al 00C31B .Label_C31B
al 00C317 .Label_C317
al 00C300 .Label_C300
al 00C201 .Label_C201
al 00C1FB .Label_C1FB
al 00C1F6 .Label_C1F6
al 00C1EF .Label_C1EF
al 00C1EA .Label_C1EA
al 00C1E2 .Label_C1E2
al 00C1D7 .Label_C1D7
al 00C1D6 .Label_C1D6
al 00C1D0 .Label_C1D0
al 00C1C9 .Label_C1C9
al 00C1C4 .Label_C1C4
al 00C1C1 .Label_C1C1
al 00C1BA .Label_C1BA
al 00C1B6 .Label_C1B6
al 00C198 .Label_C198
al 00C192 .Label_C192
al 00C188 .Label_C188
al 00C16A .Label_C16A
al 00C160 .Label_C160
al 00C155 .Label_C155
al 00C139 .Label_C139
al 00C15B .Label_C15B
al 00C127 .Label_C127
al 00C122 .Label_C122
al 00C11B .Label_C11B
al 00C10D .Label_C10D
al 00C0FB .Label_C0FB
al 00C0ED .Label_C0ED
al 00C0DB .Label_C0DB
al 00C0CD .Label_C0CD
al 00C0B9 .Label_C0B9
al 00C0AD .Label_C0AD
al 00C0A0 .Label_C0A0
al 00C0B3 .Label_C0B3
al 00C0A8 .Label_C0A8
al 00C090 .Label_C090
al 00C063 .Label_C063
al 00C054 .Label_C054
al 00C051 .Label_C051
al 00C04E .Label_C04E
al 00C04B .Label_C04B
al 00C048 .Label_C048
al 00C042 .Label_C042
al 00C03F .Label_C03F
al 00C03C .Label_C03C
al 00C02A .Label_C02A
al 00C027 .Label_C027
al 00C01E .Label_C01E
al 00C01B .Label_C01B
al 00C018 .Label_C018
al 00C015 .Label_C015
al 00C012 .Label_C012
al 00C00F .Label_C00F
al 00C00C .Label_C00C
al 00C009 .Label_C009
al 00C006 .Label_C006
al 00C003 .Label_C003
al 00C000 .Label_C000
Reference in new issue View Git Blame Copy Permalink