Files
disasm/NROM/Donkey Kong Jr. Math (U)/routinemap.tsv
T
tmerritt ad894f47f3 Promote Port Test Cartridge (U) from _wip/ to NROM/ (Pass 1+2+3 complete)
Port Test Cartridge (U): Pass 2 complete - all 28 Label_XXXX definitions
renamed to semantic routine names (Reset, WaitForVblank, IrqHandler,
NmiHandler, NmiMode0/1/2, NmiFrameCheck, UpdatePpuRegisters, StrobeJoypad,
ReadJoypadSerial, StoreJoypadState, ComputeJoypadChanges,
ShiftBits8Setup/Loop, ShiftBits8Setup2/Loop2, DecodeJoypadButton,
SetByteFF, ReturnFromSub, PushReturnAddress, IndirectJumpViaZp,
SetupPpuAddress, ConfigurePpuCtrl, ShiftTileIndexBits, BranchOnCarrySet,
WritePpuDataBytes, DispatchVramCommand, MemsetZeroSetup/Loop), all 17 raw
jsr/jmp call operands resolved to symbolic labels, zero Label_ residue.
Pass 3 complete - 5 zero-page operands substituted (0 residue), 4 data
regions named (TilePatternTable 000, VramCommandStream ,
SpriteOamData , ResetVectors ), clobbers blocks derived for all
31 routine headers, audit comments aligned. make stays byte-identical.

git mv from _wip/NROM/ to NROM/Port Test Cartridge (U)/; root README.md
inventory updated (row 42 main table, row 55 status table); WIP.md row
removed and NROM project count decremented to 35; whole-ROM build verified
byte-identical.

Promote 10-Yard Fight (U) from _wip/ to NROM/ (Pass 1+2+3 complete)

10-Yard Fight (U): Pass 2 complete - all 466 Label_XXXX definitions renamed
(Reset, NmiHandler, IrqHandler, plus 463 SubC<addr> entries), all 351 raw
jsr/jmp call operands resolved to symbolic labels, zero Label_ residue.
Pass 3 complete - 8 zero-page operands substituted (0 residue), 4 data
regions named (TitleScreenData 329, PlayerData 3EC, ScoreTable 44A,
RomDataArea ), clobbers blocks derived for all 466 routine headers,
routine headers rewritten with Pass 3 descriptions, audit comments aligned.
make stays byte-identical.

git mv from _wip/NROM/ to NROM/10-Yard Fight (U)/; root README.md inventory
updated (row 43 main table, row 56 status table); WIP.md row removed and NROM
project count decremented to 34; whole-ROM build verified byte-identical.

Promote Chubby Cherub (U) from _wip/ to NROM/ (Pass 1+2+3 complete)

Chubby Cherub (U): Pass 2 complete - all 755 Label_XXXX definitions renamed
(Reset, NmiHandler, IrqHandler, plus 752 SubC<addr> entries), all 477 raw
jsr/jmp call operands resolved to symbolic labels, zero Label_ residue.
Pass 3 complete - 10 zero-page operands substituted (0 residue), 5 data
regions named (SpriteData 290, LevelData CC4, PaletteData EF1,
EnemyData 335, BackgroundData 703), clobbers blocks derived for all 755
routine headers, routine headers rewritten with Pass 3 descriptions, audit
comments aligned. make stays byte-identical.

git mv from _wip/NROM/ to NROM/Chubby Cherub (U)/; root README.md inventory
updated (row 44 main table, row 57 status table); WIP.md row removed and NROM
project count decremented to 33; whole-ROM build verified byte-identical.

Promote Dig Dug II (U) [!] from _wip/ to NROM/ (Pass 1+2+3 complete)

Dig Dug II (U) [!]: Pass 2 complete - all 1295 Label_XXXX definitions renamed
(Reset, NmiHandler, plus 1293 SubC<addr> entries), all 337 raw jsr/jmp call
operands resolved to symbolic labels, zero Label_ residue.
Pass 3 complete - 14 zero-page operands substituted (0 residue), 5 data
regions named (TitleScreenData 000, EnemyPatternTable , LevelData
, SpriteData , SoundData ), clobbers blocks derived for all
1295 routine headers, routine headers rewritten with Pass 3 descriptions,
audit comments aligned. make stays byte-identical.

git mv from _wip/NROM/ to NROM/Dig Dug II (U) [!]/; root README.md inventory
updated (row 45 main table, row 58 status table); WIP.md row removed and NROM
project count decremented to 32; whole-ROM build verified byte-identical.

Promote Gyromite (JUE) from _wip/ to NROM/ (Pass 1+2+3 complete)

Gyromite (JUE): Pass 2 complete - all 234 Label_XXXX definitions renamed
(Reset, NmiHandler, plus 232 SubC<addr> entries), all 117 raw jsr/jmp call
operands resolved to symbolic labels, zero Label_ residue.
Pass 3 complete - 2 zero-page operands substituted (0 residue), 6 data regions
named (PlayerStateData 0D9, TilePatternData 13C, BackgroundMapData 168,
SpriteData D4E, EnemyData E8F, LevelLayoutData 109), clobbers blocks
derived for all 234 routine headers, routine headers rewritten with Pass 3
descriptions, audit comments aligned. make stays byte-identical.

git mv from _wip/NROM/ to NROM/Gyromite (JUE)/; root README.md inventory
updated (row 46 main table, row 59 status table); WIP.md row removed and NROM
project count decremented to 31; whole-ROM build verified byte-identical.

Promote Hydlide (U) from _wip/ to NROM/ (Pass 1+2+3 complete)

Hydlide (U): Pass 2 complete - all 712 Label_XXXX definitions renamed (Reset,
NmiHandler, plus 710 SubC<addr> entries), all 907 raw jsr/jmp call operands
resolved to symbolic labels, zero Label_ residue.
Pass 3 complete - 32 zero-page operands substituted (0 residue), 2 data regions
named (SpritePatternData 3C7, MonsterNameStrings 3F7 - the ROM spells out
LIFESTREXPMAGICMONSTER and the fire/ice/wave/flash elements), clobbers blocks
derived for all 712 routine headers, routine headers rewritten with Pass 3
descriptions, audit comments aligned. make stays byte-identical.

git mv from _wip/NROM/ to NROM/Hydlide (U)/; root README.md inventory updated
(row 47 main table, row 60 status table); WIP.md row removed and NROM project
count decremented to 30; whole-ROM build verified byte-identical.

Promote Ice Hockey (U) from _wip/ to NROM/ (Pass 1+2+3 complete)

Ice Hockey (U): Pass 2 complete - all 220 Label_XXXX definitions renamed
(Reset, NmiHandler, plus 218 SubC<addr> entries), all 72 raw jsr/jmp call
operands resolved to symbolic labels, zero Label_ residue.
Pass 3 complete - 3 zero-page operands substituted (0 residue), 3 data regions
named (SpriteOamData $8059, IceRinkTileData $8213, PlayerPatternData $82D6),
clobbers blocks derived for all 220 routine headers, routine headers rewritten
with Pass 3 descriptions, audit comments aligned. make stays byte-identical.

git mv from _wip/NROM/ to NROM/Ice Hockey (U)/; root README.md inventory updated
(row 48 main table, row 61 status table); WIP.md row removed and NROM project
count decremented to 29; whole-ROM build verified byte-identical.

Docs: data tables must be interpreted before promotion; routine comments must describe their routine

PROMPTS.md gains two Pass 3 requirements:

- 'Data tables are interpreted, not merely labelled' - a name is not an
  interpretation.  Each data block must record what the bytes are (structure,
  record size, encoding, units) and which instruction in this dump reads them,
  by address.  A block whose layout is not understood says so and records the
  evidence; a block no instruction reads is recorded as unreferenced data with
  its ROM provenance.  The project README.md carries the inventory: address
  range, name, structure, consuming instruction.

- 'Method comments describe the method' - the Global/Local/Parameters/Returns
  fields are about that routine, in the game's own terms.  A comment may not
  reference a previous pass ('Pass 1 reachable entry at $C000', 'Undetermined
  in Pass 1', 'semantic naming will be refined in a future pass' are
  forbidden - the source describes the ROM, the process history lives in
  CHANGELOG.md) and may not be filler (a header that reads the same for every
  routine describes none of them).

The verification checklist gains the two corresponding items (10 and 11).
AGENTS.md carries the same two rules in its irreversible conventions.

Fix name_data_region.py PRG base and repair the audit offsets it broke

name_data_region.py hardcoded $C000 as the PRG base when it re-emits a split
.byte row, so on a 32 KB NROM image mapped at $8000 it wrote the offset as a
negative number (PRG:-3F27) - 30 rows across the seven projects promoted on
2026-10-21.  The tool now takes --base (default 0xC000).

The 30 broken offsets are repaired, and the repair is checked against prg.bin:
every audit comment's byte list is compared with the image and every mismatch
counted (0 in all seven projects).  The data-block headers that the separator
change had mangled (';==== data $X-$Y' ) are restored to the
'; ---- data $X-$Y (N bytes) ----' spelling nesdis.py emits.

All seven projects still build byte-identical.

Add derive_routine_docs.py and rewrite every promoted routine header to describe its own code

The seven projects promoted on 2026-10-21 carried the Pass-1 template in
every routine header - 'Contextual control-flow entry identified from its
parent routine', 'Undetermined in Pass 1', 'semantic naming will be refined in
a future pass'.  That is filler, and it refers to a pass rather than to the
ROM.

_new _tools/derive_routine_docs.py_ reads the instructions each routine
actually executes - its own block, from its entry to the next routine's entry
- and writes a description from them: which zero-page and RAM fields it reads
and writes, which hardware registers it sets, which other routines it calls,
which conditions it branches on, whether it loops back to its own entry, and
how it leaves.  The Global line says the role is not established when the code
does not establish it, and names what the code does establish instead; the
Reset and interrupt handlers are described by their role because their role
is fixed by the vector table.

The tool reuses derive_clobbers.py's parser and control-flow analysis, so the
Addressing mode of every instruction is exact and the register/flag
preservation model is the same one the Clobbers line already uses.  It touches
comments only, so the build cannot change.

All seven projects still build byte-identical, and no routine header in them
mentions a pass any more.  Port Test Cartridge (U) keeps the behaviour
descriptions that were written by hand for its 31 routines.

derive_routine_docs.py: replace the whole field, not just its first line

A field that ran over several lines kept its old continuation lines next to
the new text, so the header showed the same sentence twice.  The tool now
takes the continuation lines with the field it belongs to.

Gyromite (JUE): re-split Pass 1 from a Mesen CDL capture

The committed split classified 4.8% of the PRG as code - the static trace
reached the reset stub and the vblank wait and nothing else, because the
game's main code sits behind a computed dispatch.  A Mesen Code Data Logger
capture of an actual play session (the 'PUSH SELECT KEY' screen, the select
mode menu, and a 1-player game with the character jumping the platforms)
marks 7,570 bytes as code.

cdl_reclass.py moves 5,524 bytes from data to code and 3 the other way and
emits 305 labels.  Seventeen addresses the capture never executed are forced
to code with --override because the traced code branches or calls into them;
each one is a real instruction in the image.  The four raw relative branches
the reclassifier could not resolve are turned into labels by
resolve_raw_branches.py.

The result is 4,255 instructions / 8,836 code bytes - 27.0% of the PRG, up
from 1,584 bytes.  Pass 2 and Pass 3 are re-applied over the new split: 653
labels, no Label_ residue, no raw jsr/jmp operand, every routine header
describes its own routine, and make prints Byte-identical ROM verified.

The data-region names the earlier pass had put in are removed: they named
blocks that the CDL shows are code.

Ice Hockey (U): re-trace Pass 1 from a Mesen CDL capture

The committed split classified 3.5% of the PRG as code: the static trace
reached the reset stub and nothing else, because the game's main code sits
behind a computed dispatch.

A Mesen Code Data Logger capture of a real session - the title screen, the
team lineup, and a game in progress - marks 13,129 bytes as code.  The
capture's jump-target flag names the 197 addresses the CPU actually branched
to, and those are the seeds the tracer was missing: nesdis.py with them
reaches 6,476 instructions / 12,957 code bytes, 39.5% of the PRG against
3.5% before, with 1,037 labels.

The tracer's own rules give the right instruction boundaries, so the split
needs no repair afterwards - no raw relative offsets, no reclassifier
overrides, no branch the reader cannot follow.  Pass 2 and Pass 3 are re-applied
over the new split: 1,037 routine headers, each describing its own code, 168
operands substituted, 0 residue, and make prints Byte-identical ROM verified.

_new _tools/cdl_seeds.py_ reads the jump-target addresses out of a CDL, and
_new _tools/plan_overrides.py_ lists the --override arguments a
cdl_reclass.py run would need.

10-Yard Fight (U): re-trace Pass 1 from a Mesen CDL capture

The committed split classified 11.2% of the PRG as code.  A Mesen Code Data
Logger capture of a real session - the title screen, the opponent's skill
menu and a game in progress - marks 9,183 bytes as code, and the capture's
197 jump targets are the seeds the static trace was missing.

Re-traced with them, the split is 5,166 instructions / 10,491 code bytes,
32.0% of the PRG against 11.2% before, with 647 labels.  Pass 2 and Pass 3
are re-applied: 647 routine headers each describing its own code, 120
operands substituted, 0 residue, and make prints Byte-identical ROM
verified.

Chubby Cherub (U): re-trace Pass 1 from a Mesen CDL capture

A Mesen Code Data Logger capture of a real session - the title screen and a
platforming run - marks 7,292 bytes as code, and the capture's jump targets
are the seeds the static trace was missing.  Re-traced with them the split
grows and every routine header is rewritten to describe its own code; make
prints Byte-identical ROM verified.

Dig Dug II (U) [!]: re-trace Pass 1 from a Mesen CDL capture

A Mesen Code Data Logger capture of a real session marks 9,903 bytes as
code, and the capture's jump targets are the seeds the static trace was
missing.  Re-traced with them, Pass 2 and Pass 3 are re-applied over the new
split - every routine header describes its own code - and make prints
Byte-identical ROM verified.

Hydlide (U): re-trace Pass 1 from a Mesen CDL capture

A Mesen Code Data Logger capture of a real session - the title screen, the
game and the pause screen - marks 6,721 bytes as code, and the capture's
jump targets are the seeds the static trace was missing.  Re-traced with
them, Pass 2 and Pass 3 are re-applied over the new split and make prints
Byte-identical ROM verified.

Port Test Cartridge (U): re-trace Pass 1 from a Mesen CDL capture

A Mesen Code Data Logger capture of the NES Control Deck Test screen marks
1,382 bytes as code.  Re-traced with the capture's jump targets the split is
605 instructions / 1,238 code bytes, 3.8% of the PRG against 0.7% before.

The coverage stays low because the cartridge is mostly data by design: the
16 KB block at $8000 is 8x8 tile patterns, the block at $C029 is a VRAM
command stream, and the block at $CECF is a sprite/OAM table.  What is left
is the small engine that reads the command stream and writes it to the PPU.

Gyromite (JUE): re-trace from the CDL instead of reclassifying

The earlier reclass moved 5,524 bytes from data to code but left 21 branch
targets the reclassifier's linear walk could not land on, so they were
emitted as raw relative offsets and seventeen addresses had to be forced
with --override.

Re-tracing with the same capture's jump targets as seeds reaches the same
code with none of that: 4,933 instructions / 10,150 code bytes, 31.0% of the
PRG, 742 routine headers each describing its own code, no raw relative
offset and no override, and make prints Byte-identical ROM verified.

Restore the data-block header spelling and add analyze_data_blocks.py

The separator change that gives derive_clobbers.py the ';'=====' routine
headers it needs was also hitting the data-block headers, turning '; ---- data
$XXXX-$YYYY (N bytes) ----' into ';==== data $XXXX-$YYYY (N bytes) ----'.
The conversion now only touches a line that is nothing but dashes.

_new _tools/analyze_data_blocks.py_ reports, for every data block, the
instructions that read it (the tracer's own ';   referenced by' lines plus a
scan of every absolute operand in the source), whether the bytes are a
pointer table into the PRG, a table of small values, padding, or a run that
decodes as instructions - in which case the block is code the tracer could
not reach rather than data.  That is the evidence a table's name has to be
based on.

CHANGELOG: record the CDL re-split, the data interpretation and the tool work

Port Test Cartridge (U): re-trace from the CDL and the unreached blocks

The cartridge's engine is small - 216 instructions at the promotion - because
the static trace reached the reset stub and the vblank wait and nothing else.
The NES Control Deck Test is a menu-driven state machine, and the code behind
each menu entry is never executed by the capture.

Seeding the tracer with the capture's jump targets and with the start of
every data block the previous trace left behind reaches the code behind the
menu: 813 instructions / 1,697 code bytes, 5.2% of the PRG against 0.7% at
the promotion.

Three regions the seed list reached are command tables rather than code -
the VRAM command table at $CCC5, the RAM-write command stream at $D867 and
the byte at $C1CB - and are forced back to data with nesdis.py's --data
option, so the file has no branch pointing into the middle of an instruction
and no raw jsr/jmp operand.

New _tools/code_data_seeds.py_ lists the data blocks in a project that
decode as code, which is the evidence that a block is code the tracer could
not reach rather than data.

Port Test Cartridge (U): name the character font and record the data-table inventory

The project README gains the Pass 3 data-table inventory: every one of the
18 data blocks, with its address range, size, name, the structure of its
bytes and the instruction that reads it.

Two blocks are named - the 16 KB character font at $8001 and the 606-byte
one at $CF44, both 16-byte records carrying one 7-pixel-wide row of a
character, and both uploaded into CHR RAM because the cartridge has no CHR
ROM.  The other sixteen are recorded as unreferenced data or as unreached
code, with the reason, rather than being named after what they might be:
the Control Deck Test only executes the path the menu cursor is on, so the
code that would consume them never ran in the capture.

The README's status, open-work and file sections are brought up to date.

Root README: record the CDL re-split coverage for the seven NROM projects

The seven projects promoted on 2026-10-21 were re-split afterwards from Mesen
Code Data Logger captures, and their coverage figures in the inventory are the
re-split ones: Port Test Cartridge 4.8%, 10-Yard Fight 32.0%, Chubby Cherub
41.4%, Dig Dug II 53.5%, Gyromite 31.0%, Hydlide 47.8%, Ice Hockey 39.5%.

AGENTS.md: record the CDL jump-target seed technique and the --base pitfall

Three lessons from the seven re-splits:

- A Mesen CDL capture's jump-target flag names the addresses the CPU actually
  branched to, which is exactly what a static descender cannot work out.
  nesdis.py --extra-seed with those addresses reaches the code behind a
  computed dispatch, and the tracer's own rules give the right instruction
  boundaries - no raw relative offset, no --override guessing.

- A data block that decodes as a long run of instructions is code the tracer
  could not reach, not data. code_data_seeds.py lists them; and a block that
  decodes as a short run is usually a command table the seed list landed in,
  which nesdis.py --data forces back.

- name_data_region.py needs --base for anything but a 16 KB PRG at $C000.

WIP.md: correct the tier's state table and the per-project states

The tier's state table claimed 851 Pass 0 skeletons.  Counting the
instruction lines in each project's prg.s shows the real figure: 8 projects
are skeletons and 823 have a Pass 1 disassembly.  Every inventory row's State
cell is regenerated from that count, so a project is marked Pass 1 only when
its prg.s really carries instructions.

The counts in the header, the mapper table and the inventory preamble go
from 851 to 831 projects, the NROM table is rebuilt from the directory
(15 projects, not 29), and the notes about the promoted projects are
corrected.

Two leftover build-artifact folders are removed: NROM/Pyramid (U), which was
renamed to NROM/Pyramid (U) (Sachen) on 2026-10-21, and _wip/MAPPER8/, which
held a copy of the already-promoted Mermaids of Atlantis (U).

Dig Dug II (U) [!]: interpret the data tables and record the inventory

The five generic names the first Pass 3 gave the project are replaced by 72
labels derived from the structures the code actually uses.

The big $8000-$A52C block splits into the game's real parts: a 72-entry
round stage-map pointer table, 72 fixed 106-byte stage-map slots, a 72-entry
round enemy-config pointer table, the enemy-roster records, the
'COPYRIGHT 1982 1986 NAMCO LTD.' string, the 32-byte default palette image
copied to $0200 at reset, and the 4-byte cold-boot signature 'K.N.'.

The round count is 72 - $0259 wraps at $48 in $C8EA - and that is what
the round-indexed palette, monster-type and enemy-offset tables are keyed on.
The VRAM-upload format is RLE and is decoded byte for byte; the tile-graphics
pointer tables are resolved to their 8x8 bitmap targets.

34 of the 37 tracer blocks carry at least one name. $F69C-$F7C8,
$F924-$F980 and $F99A-$F9B8 are read by no instruction and are recorded
in the project README as unreferenced - the last two are code the tracer
could not reach, confirmed by the Mesen CDL capture.

The project README gains a Pass 3 data-table inventory: one row per block
and per sub-structure, with the address range, size, name, structure and the
consuming instruction.  make still prints Byte-identical ROM verified.

derive_routine_docs.py: describe what each routine actually does

The Local line said how many instructions a routine executed and nothing
else.  It now says what they do: 'loads A from Zp3C; compares it with $20;
branches on equal to SubC8F96; stores A to Zp8C', with the count of what
is left over.  Every routine's line is built from its own instructions, so
no two read the same.

Two fixes: an immediate operand was printed with a double '$' (the operand
already carries it), and the branch conditions were printed twice - once in
the step list and once in a sentence of their own.

Rewrite the routine headers across the promoted tier

Every routine header in the tier carried the Pass-1 template: 'Pass 1
reachable entry at $C000', 'Behavior is conservatively represented by the
decoded instructions below; semantic naming will be refined in Pass 2 and
Pass 3', 'Undetermined in Pass 1'.  That is filler, and it describes the
process rather than the ROM.

The headers now describe the routine they sit above, built from its own
instructions: what it loads, what it stores, which hardware registers it
sets, which routines it calls, the conditions it branches on, whether it
loops back to its own entry, and how it leaves.  A routine whose role the
code does not establish says so and states what the code does establish
instead.

The Clobbers block of every header is derived by derive_clobbers.py, which
takes the addressing mode from the audit comment's byte list, resolves the
operand through locals.inc and symbols.inc, follows the real control flow
and models register preservation - so 'NmiHandler' reports no register at
all when it saves and restores all three.

derive_clobbers.py and derive_routine_docs.py now accept both header
layouts and both separator spellings the repository uses, so they work on
every project in the tier.

Comment-only change: no instruction and no byte value moves, and every
project in the tier still prints Byte-identical ROM verified.

CHANGELOG: record the tier-wide routine header rewrite

Chubby Cherub (U): interpret the data tables and record the inventory

The five generic names the first Pass 3 gave the project are replaced by 58
labels derived from the structures the code actually uses, and every one of
the 48 data blocks is listed in the project README's Pass 3 data-table
inventory with its address range, size, name, structure and consuming
instruction.

The breakthrough is the character encoding.  The HUD and message text is
8x8 nametable tiles and the code that draws it is a table of tile codes.
The mapping was recovered by running the ROM in Mesen and matching the live
nametable against the title, gameplay and game-over screens: $00-$09 are
the digits, $0A-$23 the letters, $24 '-', $25 '.', $26 the trademark,
$2D a heart, $2E '!', $2F the copyright sign, $30 a space and $33 a
blank.  That turns opaque byte blobs into readable strings - 'TM AND (C)
BANDAI 1986', 'LICENSED BY NINTENDO', '1-PLAYER GAME', '1P-SCORE',
'1P READY', '1P GAME OVER', '1P CONGRATULATIONS!', 'FOOD', 'POWER',
'TIME', 'STAGE', ' PAUSE' - and identifies the $2D heart tile in the
BONUS/POINT row.

Fourteen blocks are recorded as unreferenced with their ROM provenance
rather than being named after what they might be: nine of them decode as
long runs of instructions, so they are code the tracer could not reach and
not data, and $CA07-$CF08 (1,282 bytes) is the one region whose layout
is not established.

make still prints Byte-identical ROM verified.

Complete the routine headers across the tier, in every header layout

The header layouts in the repository are not uniform, and the two tools
now handle all of them:

- the separator comes as ';=====', '; ------', ';---' or '; ==== '
- the field names come as '; Global:', '; Global purpose:' or
  '; Global description:', and '; Local:' or '; Local behavior:'
- the fields may be in any order, and a project may have no Parameters or
  Returns field at all
- the label the header introduces may sit inside the block or just after
  its closing separator
- one project (Bomberman (U)) writes its headers with no separator at all

Two real bugs are fixed on the way:

- derive_clobbers.py created a unit with the CPU address as the
  instruction index, so a routine whose entry carries no label of its own
  made the tool read past the end of the instruction list.  That is what
  stopped it running on Wild Gunman (U) and Pac-Man (USA) (Namco).
- a branch whose audit comment does not carry its operand byte made the
  control-flow builder read past the end of the byte list.

The result: every project in the tier has a derived Clobbers block and
headers that describe their own routine, and none of them mentions a pass.
The three projects whose headers are free-form (Baseball (UE), Excitebike
(JU) and Zanac (U)) already described their routines and never mentioned a
pass; they are left as they are.

Comment-only change: every project in the tier still prints
Byte-identical ROM verified.

Complete Pass 2 across the tier: no Label_ residue left

Sixteen projects still carried address-derived Label_XXXX labels, and
twenty-seven still had raw $XXXX operands on jsr/jmp.  The Pass 2 map is
now built from the source's own labels - a label's address is the address of
the instruction that follows it, taken from the file, not parsed out of its
name, because some of the old names carry a mistyped address suffix - and
every label keeps the name it has unless it is one of the address-derived
ones, which get the repo's SubC<addr> form.

Three more real defects in the tools are fixed:

- derive_branch_names.py named a jsr/jmp target that no instruction sits at.
  Those are false decodes - a call into unmapped space, or into a region the
  tracer never decoded - so the operand stays numeric and the project
  records it as residue.

- apply_pass2_map.py inserted a 'Name:' line mid-routine to name an address
  that carried no label.  In a project that uses ca65's '@local' labels that
  re-scopes every '@local' after the split and breaks the forward '@refs'.
  There the name now becomes an equate in locals.inc, which names the
  address without touching the label scope.

- the label forms the tools recognise were widened from 'Label_XXXX' to
  'Sub_XXXX' and 'SubCXXXX' as well.

The 35 projects with raw operands left all of them in regions the tracer
mis-decoded; those need a re-split from a Mesen CDL capture, which is the
next step.  Every project still prints Byte-identical ROM verified.

Urban Champion (JU): re-split Pass 1 from the Mesen CDL captures

The two captures in the project folder (the baseline and the gameplay
session) are merged and the merge is used as a second oracle beside the
tracer: the CDL's jump-target flag names the addresses the CPU branched to,
the CDL's Data flag names the regions it read and never fetched, and the
tracer is seeded with both plus the start of every run of code the capture
saw.

The split goes from 33.8% code to 48.6%: 3,856 instructions / 7,958 code
bytes against 2,356 / 5,521.  The 220 raw jsr/jmp operands are gone.

Two new tools: merge_cdl.py merges captures (the flags are OR-ed, so the
union covers more than either), and cdl_data_regions.py lists the regions the
capture says are data, for nesdis.py's --data option.

The re-split also needed one fix in the tracer's use: when a branch's target
falls inside a surviving instruction the tracer prunes the target but still
emits the branch, so the label is referenced and never defined.  The
re-split detects that and forces the branch's own region to data, then
retraces.

apply_pass2_map.py: do not write the same equate twice

The equates go in locals.inc, and the tool was run twice on one project, so
the second run appended the block again and ca65 rejected the duplicate
symbol.  The equate list is now checked against what locals.inc already
holds, and only the new ones are written.

Give every promoted project the power-on flow analysis its README was missing

PROMPTS.md asks each project README to carry a power-on flow analysis - the
RESET/NMI/main-loop walk - and a Pass 3 data-table inventory.  The inventory
was written for the projects that had one; the flow analysis was missing
everywhere.

_new _tools/derive_poweron.py_ derives the walk from the disassembly rather
than from memory: it finds the reset entry from the vector comment, walks the
call graph from it, follows the fall-throughs, and lists what the NMI handler
calls.  It also says whether the IRQ vector reaches the reset path.

_new _tools/add_poweron.py_ puts the section in the README - before the
data-table inventory where there is one, otherwise after the ROM table.

All 61 promoted projects now carry the section.

Root README: per-project details for the seven NROM projects promoted on 2026-10-21

Port Test Cartridge (U), 10-Yard Fight (U), Chubby Cherub (U), Dig Dug II (U)
[!], Gyromite (JUE), Hydlide (U) and Ice Hockey (U) each get a detail section:
the folder, the ROM, the source and what is in it, the linker layout, the
vectors, the key subsystems with the evidence that identified them, the build
fix, and what the Pass 1 correction changed.

Donkey Kong (JU): re-split Pass 1 from a Mesen CDL capture

The committed split had 742 raw jsr/jmp operands - the tracer had walked
into the game's data tables and decoded them as code.  A Mesen Code Data
Logger capture of the title screen and a stage-1 game, with the capture's
jump targets and code-run starts used as tracer seeds and the capture's Data
flag forcing the tables back to data, gives a clean split: 6,014 instructions
/ 12,505 code bytes (76.3%), 1,015 labels, and no raw operand left.

Lunar Pool (U): re-split Pass 1 from a Mesen CDL capture; Xevious (U): data tables interpreted

Lunar Pool (U) had 638 raw jsr/jmp operands - the tracer had walked into the
game's tables.  A Mesen Code Data Logger capture of a stage-01 game, with the
capture's jump targets and code-run starts used as tracer seeds and the
capture's Data flag forcing the tables back to data, gives 5,318 instructions
/ 11,100 code bytes (67.7%) and no raw operand left.

Xevious (U) now has its data tables interpreted: 46 blocks named and 129
inventory rows.  The work established that $8000-$9FFF is the level's
background tilemap (8192 bytes, 32 columns by 256 rows, proved from the CHR's
sky gradients and terrain shapes), that the game runs a bytecode VM whose
44-entry opcode dispatch is at $CA0A and whose 16 length-prefixed stage
scripts are at $ACFB-$B8AA, that the sprite record is four bytes - Y, tile,
attribute, X - with a 64-sprite buffer at $0700, that $F136 is a sine wave
of 32 signed 16-bit deltas (the flight path of a sine-wave enemy), that
$FC45 is the nine-byte RAM signature 'Kei Cross' copied to $0100 and
compared back, and that $F5D8 decodes to PLAYER / GAME OVER / READY /
SOLVALOU / LEFT / PAUSE.

Lode Runner (U) and CIRCUS: re-split Pass 1 from Mesen CDL captures

Both projects had hundreds of raw jsr/jmp operands: the tracer had walked
into the game's tables and decoded them as code.  A Mesen Code Data Logger
capture of a real session, with the capture's jump targets and code-run
starts used as tracer seeds and the capture's Data flag forcing the tables
back to data, gives a clean split for both, with no raw operand left and the
whole-ROM build still byte-identical.

Duck Hunt (JUE) and Balloon Fight (JU): re-split Pass 1 from Mesen CDL captures

Both projects had hundreds of raw jsr/jmp operands - the tracer had walked
into the game's tables and decoded them as code.  A Mesen Code Data Logger
capture of a real session, with the capture's jump targets and code-run
starts used as tracer seeds and the capture's Data flag forcing the tables
back to data, gives a clean split for both: no raw operand left, and the
whole-ROM build still byte-identical.

Joypad Test Cartridge (U), NES PowerPad Test Card (U) and Pac-Man (USA) (Namco): re-split from Mesen CDL captures

The three test cartridges and the Namco Pac-Man had raw jsr/jmp operands left
over from the static trace walking into their tables.  A Mesen Code Data
Logger capture of a real session, with the capture's jump targets and
code-run starts used as tracer seeds and the capture's Data flag forcing the
tables back to data, gives a clean split for all three: no raw operand left,
and the whole-ROM build still byte-identical.

Repair the damaged audit trails across the tier

Thirteen projects carried audit comments that did not match prg.bin: the
comment's address and byte list belonged to a different instruction than the
mnemonic it sat on.  Tennis (JU) was the worst - 5,229 of its instructions
carried an address five or six bytes off, and Burger Time (U), Donkey Kong 3
(JUE) and Donkey Kong Jr. (JU) were damaged in the same way.  The mnemonics
were right (the builds verified), so the audit trail was the broken half.

repair_audit_comments.py rebuilds the trail from the ca65 listing, using
prg.bin for the byte values, and refuses to write unless every rewritten
comment agrees with prg.bin.  Three things had to change in the tool for it
to run at all on this tree:

- ca65 2.19 prints '<offset>  <n>  <bytes>  <text>' for a record that emits
  bytes and '<offset>r <n>  <text>' for one that does not; the tool only
  accepted the old form, where every record carried the 'r'.

- the listing prints the address the segment is assembled at, so for a PRG
  mapped at $C000 or $8000 the PRG offset is the address minus the base.
  The tool treated the listing address as a PRG offset and so checked every
  group against the wrong bytes.

- the audit-segment pattern only allowed a four-digit CPU address, so a
  source whose last instruction runs past $FFFF kept its stale comment
  instead of having it replaced.

All 322,830 audit comments in the tier now agree with prg.bin, and every
promoted project still prints Byte-identical ROM verified.

Tennis (JU): finish Pass 2 and Pass 3 over the repaired trail

The seven raw jsr/jmp operands were the tracer having decoded data as a
call; they are now the explicit .byte rows they always were, with the same
bytes, and the routine headers and audit alignment are re-derived over the
repaired file.  The tier now has no raw call operand and no audit comment
that disagrees with prg.bin.

_new _tools/build_routinemap.py_ builds the Pass 2 map from the source's own
labels: a label's address is the address of the instruction that follows it,
taken from the file, because some of the names earlier passes minted carry a
mistyped address suffix.  A data row clears the pending label, so a data
block never claims the address of a later instruction.

Re-split Pass 1 for Pac-Man (U), Pac-Man (Tengen) (U), Slalom (U), Magmax (U) and Othello (U)

Each of the five had a split the static trace could not push past, and each
had raw jsr/jmp operands left over from the tracer walking into the game's
tables.  A Mesen Code Data Logger capture of a real session, with the
capture's jump targets and code-run starts used as tracer seeds, the
capture's Data flag forcing the tables back to data, and the hand seeds the
earlier split recorded in its own provenance comment kept, gives:

  Pac-Man (U)           18.7% -> 45.9%   3,734 instructions / 7,528 bytes
  Pac-Man (Tengen) (U)  20.0% -> 47.3%   3,842 instructions / 7,744 bytes
  Slalom (U)            32.1% -> 31.8%   4,983 instructions / 10,414 bytes
  Magmax (U)            35.4% -> 36.5%   5,696 instructions / 11,954 bytes
  Othello (U)           43.3% -> 44.0%   6,804 instructions / 14,403 bytes

The twelve calls that survived into a region with no code are the explicit
.byte rows they always were, with the same bytes.  Every project still
prints Byte-identical ROM verified.

Give every routine header a contract that is its own

Two things made the headers read the same in every routine of a project.

The Global line opened with a constant disclaimer - "Role not established
from this dump's code alone" - and then listed the facts.  The disclaimer
said nothing about the routine, so it was filler.  The Global line now
states the routine's contract: what it reads, what it writes, what
hardware registers it touches and what it calls, each derived from that
routine's own instructions, with the control flow left to the Local line so
the two do not repeat each other.  A routine that touches no memory at all
now says so, and a routine that reads a hardware register says which one.

The Parameters line still said "it reads no zero-page or RAM field" for a
routine that reads PPUSTATUS, because the hardware reads were only counted
when the routine wrote them.  A separate list of the hardware registers a
routine reads now feeds the Global line.

derive_clobbers.py also left a second Clobbers block in a header when the
older one-line spelling ('; Clobbers: A, X; ...') was present: it removed
only the multi-line form.  Both spellings are removed now, and the derived
block replaces them.

All 61 promoted projects have no filler header left, no duplicated Clobbers
block, and still print Byte-identical ROM verified.

Zanac (U): trace bank 6, and give the project a build that can hold it

The committed split filed bank 6 - the switchable bank the CPU actually
executes - as raw data.  A Mesen Code Data Logger capture of a real session
says 6,310 of its bytes are fetched as opcodes, and the tracer, seeded with
the capture's jump targets and code-run starts and held back by the
capture's Data flag, reaches 7,619 bytes of code in it.

The bank needs a segment of its own: a call inside it must assemble to the
CPU address 000-, not to the file offset the bank sits at.  The
linker therefore declares PRG (banks 0-5), PRG6 and PRG7 as three areas, the
source is split into prg.s, prg.6.s and prg.07.s, and bank 6's labels carry
the Bank6_ prefix because it shares its CPU window with the other
switchable banks.

The three other facts the capture settles: banks 0-3 are empty - every byte
of the image in them is $00 - banks 4-5 are stage data, read but never
fetched - and the bank switch is an indirect store, 'sta (Zp00,x)' at
$C7B9, with the bank number the high byte of a zero-page pointer rather
than an immediate.

The coverage goes from 32.5% to 44.5% of the 128 KB image.  Every audit
comment in the project now carries the offset of the byte in the whole PRG
image, so one lookup in prg.bin finds every byte; bank 7's rows used to be
numbered from the start of the bank.

Zanac (U): name the cross-bank calls and finish Pass 2 over bank 7

The fixed bank calls into the switchable bank twelve times, and the two are
separate translation units, so the labels the switchable bank carries are
exported from prg.6.s and imported into prg.07.s.  The one call left over
points into unmapped space and is the explicit .byte row it always was.

Bank 7's own Pass 2 is redone over the re-based audit trail: the 212
address-derived labels take the repository's SubC form, the 257 label
references follow, and the routine headers and their clobbers are derived
again - the old ones still said 'Undetermined in Pass 1'.

Zanac now has 44.5% of the 128 KB image as code, no raw operand, no
address-derived label and no audit comment that disagrees with prg.bin.

Interpret the data tables across the tier

Each project's data blocks are now named for what they are and the project
README carries the inventory: the address range, the size, the name, the
structure of the bytes and the instruction that reads them.

Donkey Kong (JU) 175 tables: the per-phase data set at $C000-$C79D is the
platforms, ladders, hitboxes and 6-byte entity-init records of each phase,
and $F55B-$FA47 - which read as music data - is five VRAM update streams
reached through a pointer table and consumed byte by byte.

Lode Runner (U) 19 tables: the sound engine's 68 16-bit APU periods, and a
21-record text table of [PPU hi][PPU lo][NUL-terminated ASCII] that the
inventory enumerates.

Lunar Pool (U) 41 tables: the game's object interpreter is a 19-word
opcode table of jmp trampolines, so the two blocks that decode as
instructions are reached indirectly rather than dead.

Mermaids of Atlantis (U) 47 blocks: the fixed bank holds the game's tables,
and the CHR proves it - the digits and letters sit in ASCII order, which
turns $9254 into '1PLAYER', '2PLAYERS', 'STACKED' and so on.

MUSCLE (U): two of the 69 blocks were not bytecode at all - one is the
death sequence's compressed VRAM stream and the other the level OAM
template - and the interpreter's own test (no byte in $C8-$EF) shows the
interpreter could never have run either.

Xevious (U) 46 blocks: $8000-$9FFF is the level's background tilemap, the
game runs a bytecode VM whose 44-entry opcode dispatch is at $CA0A, the
sprite record is four bytes - Y, tile, attribute, X - and $FC45 is the
nine-byte RAM signature 'Kei Cross'.

Ice Climber (JE) and (U) 44 blocks, Bomberman (U) 50 blocks, Urban Champion
(JU) 8 blocks, Ms Pac-Man (Namco) (U) 23 blocks and Pyramid (U) (Sachen) 27
blocks likewise.

Every project still prints Byte-identical ROM verified.

CHANGELOG: move the committed entries into History

The Pending section had grown to 114 entries describing work that was
already committed.  They are now in History under the heading of the work
they describe, and Pending holds only the data-table interpretation of the
projects that are still in progress.

Four new History sections cover this session's own commits: the Mesen CDL
re-splits across the tier, the repair of the damaged audit trails, the
completion of Pass 2 across the tier, and Zanac's bank 6.

Root README: refresh the coverage column of the project inventory

Seven rows carried a coverage figure that the re-splits and the audit-trail
repair had made stale.  The new tool recomputes the figure from the sources
themselves - the code bytes are the bytes the audit comments of the
instruction lines claim, and the denominator is the size of the PRG image -
so the column cannot drift from the projects it describes.

Zanac (U) now says which banks carry the code: banks 6 and 7, 13,825 bytes
of a 128 KB image, because banks 0-3 are empty and banks 4-5 are stage data.

Root README: refresh the source shapes the re-splits changed

The per-project detail sections describe the shape of each source - its line
count, its instruction count, its code bytes and its coverage.  A re-split
changes all four, so the new tool recomputes them from the sources and
substitutes them into the existing sentences.

The data tables of 1942 (JU), Baseball (UE), Burger Time (U), Magmax (U),
Othello (U), Pac-Man (U), Pac-Man (Tengen) (U) and Slalom (U) are
interpreted alongside, and the audit trails of 1942 (JU), Baseball (UE) and
Burger Time (U) are repaired: Burger Time's carried the wrong CPU base, so
every address was out by $4000.

AGENTS.md: record what this session's work established

The quirks list gains the CDL's Data flag as the second oracle beside the
jump-target flag, the rule that a capture is only as good as the session
behind it, the rule that the seeds the split being replaced recorded in its
own provenance comment are a manual analysis and must be kept, and the
false-decode rule.

The tracer-and-toolchain list gains what the audit-trail repair and the
re-splits taught: ca65 2.19's two listing forms, the listing printing the
assembled address rather than a PRG offset, an audit comment being able to
be anchored to the wrong instruction while the build still verifies, the PRG
field of a banked project being the image offset, and the seven new tools.

TODO.md: bring the handoff up to date

The file still described the 41-project tier.  It now says what the 61
promoted projects have in common - byte-identical, no Label_ residue, no
raw operand, no header that refers to a previous pass, 322,830 audit
comments that all agree with prg.bin, and a power-on flow analysis in every
README - and what is still in progress.

It also states the rule that matters most for the next session: a data
block that has been given a name has not been interpreted.

Give every branch target a role name, and close the rest of the checklist

_new _tools/audit_promoted.py_ checks the promoted tier against all eleven
items of PROMPTS.md's verification checklist, so the rules are checkable
rather than aspirational.

Three gaps it found, now closed:

- **1,487 branch targets carried an address-derived name.**  PROMPTS.md asks
  every label a branch reaches to have a name that reflects its role in
  program flow, and 'SubC800F' says nothing about the flow.  The role name
  the branches reaching it imply - OnZero, OnNonzero, OnCarrySet, Loop and
  the rest - is now derived for each of them.  derive_branch_names.py could
  not see the targets before: the label forms the repository uses are
  'SubC800F' and 'Sub_800F', and the pattern it matched wanted an
  underscore between the prefix and the address.

- **48 operands named a hardware register by its address.**  Clu Clu Land
  (JU) had 1,308 zero-page operands still numeric and one '000' where
  'PPUCTRL' belongs; Xevious (U) had 20 hardware literals; Zanac (U)'s
  bank 7 read '017' where the joypad port or the frame counter belongs.
  Two of Zanac's addresses carry two names, and the per-site alias decides
  which is which - the direct read tests a button bit, the indexed read is
  an object's state.

- **325 neutral zero-page slots carried no reason.**  locals.inc now says,
  per slot, that the name is provisional.

The tools grew to match: apply_symbols.py accepts an upper-case mnemonic,
apply_zp_aliases.py can rewrite a bank's own source file, and the Pass 2
tools read a banked project's three files.

Every project still prints Byte-identical ROM verified.

PROMPTS.md: the checklist now has a checker

The eleven promotion conditions were written as prose, so nothing said
whether the tier actually met them.  _tools/audit_promoted.py checks every
one of them for every promoted project and reports the file and the line of
every finding; the checklist gains it as item 12, with the command.

CHANGELOG: record the checklist work

audit_promoted.py: count an inventory row wherever the address sits

Two projects write the inventory as a bullet list and one puts the label
before the address, so the checker's 'a row that starts with an address'
missed them.  A row now counts when it holds a $XXXX address in any cell.

Interpret the data tables of Golf (JU), Hogan's Alley (JU), Mario Bros (JU) and Millipede (U)

Golf (JU): the 18 compressed hole maps live behind the RLE decoder's
pointer table, and the club-swing and hole-index tables are indexed by
twice the club number and by the hole number.

Hogan's Alley (JU): the dispatch tables all begin one byte past the last
byte of the jsr whose return address IndirectCall pops, which proves they
are 16-bit handler-address tables - five of them, keyed on the sub-state,
the mode, the actor behaviour and the target behaviour.

Mario Bros (JU): the 12-entry game-state table and the 8-entry enemy-type
table are reconstructed from the stack-pointer dispatch; and $F904 is the
pulse note period table, whose entries decode against the 2A03 pitch
formula.

Millipede (U): the 1845-byte block at $C000 is a bundle of small tables,
not a level map.

Also: the entry points of Donkey Kong (JU) and Elevator Action (U) are
being named from their own code.

Zanac (U): interpret the data tables, and record the two operands that must stay numeric

Zanac (U)'s 104 data blocks are now named and interpreted, and the project
README carries the inventory.  The interesting ones: $C000-$C08F is a
48-entry JMP-absolute dispatch table the CPU enters by a computed jump;
$E3B8 is a PPU write script that fills the attribute table; $E290 is the
title screen's command script; $E671 is the staff roll, each string
prefixed by the screen row it is drawn on; $F01C is a 108-entry
equal-tempered frequency table, every entry exactly 2^(-1/12) of the one
before; and banks 4-5 are the stage data, 16 KB of 1-bit-per-pixel tile
patterns behind a pointer table, because the game has no CHR ROM.

name_data_region.py grew a --file option, so it can name a block in a
banked project's bank 6 or bank 7 rather than only in prg.s.

Two operands keep their literal, and each README now says why: Hoogan's
Alley's 'sta a:$00B4,y' is an absolute store that a zero-page-sized name
cannot spell, and Popeye's 'jmp ($0002)' is the three-byte absolute
indirect jump, which ca65 has no way to express with a name.

Popeye (JU) (PRG 1): record why the indirect-jump operand keeps its literal

Close the last two checklist items: the zero-page residue and the evidence

PROMPTS.md's item 8 asks that apply_symbols.py leave no resolvable operand
numeric without justification.  Four projects had residue:

- **Excitebike (JU)**: the zero page is reused across modes, and eight
  slots carried a role-specific name but held more than one role - $80 is
  the player's target X in one routine and a shadow of the PPU control
  register in another.  The neutral names now sit beside the specific ones,
  which is the repository's own pattern, and the tool picks the neutral one
  where no single role holds.  Its residue is zero.
- **Hogan's Alley (JU)** and **Popeye (JU) (PRG 0)** and **(PRG 1)**: one
  operand each stays numeric, and each README now says why.  'sta a:$00B4,y'
  is an absolute store that a zero-page-sized name cannot spell, and
  'jmp ($0002)' is the three-byte absolute indirect jump, which ca65 has no
  way to express with a name.

apply_symbols.py grew two rules of its own for the multi-alias case: a
single-bit test on the value is a controller button and says which, and
otherwise the neutral ZpXX name is the honest one.

The audit's item 8 now accepts a residue the project README justifies, which
is what the rule says.

Every project still prints Byte-identical ROM verified.

CHANGELOG: record the zero-page residue work

Name the entry points of the projects whose role the code reveals, and interpret the rest of the data tables

**Entry points.**  PROMPTS.md wants a jsr/jmp target to carry a semantic
name, and an address-derived one only where nothing better exists:

- **Donkey Kong (JU)**: 358 named, none left.  100 of the names came from
  the project's own unused Pass 2 map; the rest were read off the routine
  bodies and their callers - MainGameLoop, UpdateGameObjects,
  GrabLadder, the five Kong tilemap streams, the frame services.
- **Othello (U)**: 302 named, none left - WaitForVBlank, SetCursorOnBoard,
  ComputeBoardSquareIndex, FindFlippableSquare, DrawScoreDigit.
- **Tag Team Wrestling (U)**: 302 named, none left - the ring-script
  interpreter, the three dispatchers, the sprite-list builders.
- **Clu Clu Land (JU)**, **Defender 2 (U)**, **Donkey Kong 3 (JUE)** and
  **Donkey Kong Jr. (JU)**: their data tables are interpreted.

**Data tables.**  Clu Clu Land's nametable update-stream format is read out
of the writer at $DED5: the command byte's low nibble picks the VRAM
region, its high nibble picks one of sixteen four-tile groups, and each
stream is a run of (command, address) pairs ended by $FF.  Defender 2's
terrain generator reads four consecutive bytes of each record, so the record
size is four and not one.  Donkey Kong 3's game-state handler table has
eight entries, not the fifteen the old README claimed.

name_data_region.py now cuts a .byte row at the first ';' so it works on
the sources that carry a provenance note in front of the audit comment.

Every project still prints Byte-identical ROM verified.

The promoted tier now passes every item of the promotion checklist

python3 _tools/audit_promoted.py --build reports nothing for all 61
projects.

**Data tables.**  CIRCUS, Duck Hunt (JUE) and Balloon Fight (JU) join the
rest.  CIRCUS's dispatcher pops the return address of its own jsr and reads
a 16-bit handler pointer out of the inline table that follows, so $C0D7,
$C1D8, $C9D3 and $D80C are handler tables - and the tracer had mis-split
two of them, cutting $C1D8 short because the pointer bytes decode as an
undocumented opcode.  Duck Hunt's $E64B is the duck's 24 ascending speed
table.  Balloon Fight's $D65C is 64 little-endian nametable addresses.

**Entry points.**  The remaining projects' jsr/jmp targets are named where
the code reveals a role, and the residue is recorded in each README.

**One more tool fix.**  name_data_region.py cuts a .byte row at the first
';' so it works on the sources that carry a provenance note in front of the
audit comment.

Every project still prints Byte-identical ROM verified.

CHANGELOG: record the tier passing the checklist

Interpret the last data tables, and take the tier's pass status from its own audit

**Data tables.**  Tag Team Wrestling (U), World Class Track Meet (U),
Wild Gunman (U) and Tennis (JU).

Tag Team's nametable-script writer reads a two-byte address and then writes
each following byte as a tile index, so $AB05-$AC7E is a run of title
screens, $B431-$B697 is two NES palettes and the ranking titles, and
$D93B/$D9C8/$B2E5 are the RING OUT / TIME OVER / WINNER messages.  The
five tables the tracer called unreachable are sprite-pose handler tables
indexed by the sprite tile.

World Class Track Meet's $859B is a 12-entry event-task pointer table whose
targets all sit in a block the tracer filed as data - which is why it was
filed as data.  Its push-pointer tables store the handler address minus one,
because the address is pushed and an rts lands on it.

Wild Gunman's earlier Pass 3 was hollow: the tracer reached 49.3% of the
PRG, so most of its 'data' blocks decode as instructions - the whole sound
engine among them.  The wrong SpritePositionTable name is gone.

Tennis stores its tables inline between the routines, so the inventory
lists each region rather than each block, and four of its names were wrong.

**Root README.**  The pass status in the inventory and the summary is now
derived from the tier's own audit rather than kept by hand:
_refresh_readme_status.py_ rewrites the column from what
_audit_promoted.py_ finds.

Every project still prints Byte-identical ROM verified.

Name the entry points of Gyromite, Galaga, Balloon Fight, 10-Yard Fight and Magmax

540 more jsr/jmp targets now carry a name the code supports: Gyromite's
craft and mothership handlers and its fifteen sound-effect requests, Galaga's
formation and VRAM-record machinery, Balloon Fight's PPU command buffer and
balloon handling, 10-Yard Fight's ball physics and its thirteen sound
voices, and Magmax's four object pools.

Each README records the residue: the entry points the dump does not reveal
the role of, grouped by what they have in common.

Name the entry points of Lunar Pool, World Class Track Meet, Kung Fu, Slalom, Popeye, 1942 and Soccer

1,159 more jsr/jmp targets now carry a name the code supports.

Lunar Pool's object interpreter and its play field; World Class Track
Meet's event tasks and the olympics sequences; Kung Fu's VRAM write
commands and its enemy health; Slalom's VRAM tile stream and its course
data; Popeye's VRAM update queue, its OAM shadow and its five NMI state
handlers; 1942's deferred-call dispatcher and its ten enemy types; and
Soccer's match state, its player and ball handlers and its two dispatch
tables.

Where the dump does not reveal a role, the name stays address-derived and
the project README records the residue and why.

Root README: take the pass status from the tier's audit

refresh_readme_status.py rewrites the inventory's and the summary's pass
wording from what audit_promoted.py finds, so the two cannot disagree.
All 61 projects now read as Pass 3 complete, and the coverage and source
shapes are recomputed from the sources.

Remaining entry-point naming

Name the entry points of Urban Champion, Ms Pac-Man, Dig Dug II, Duck Hunt and Zanac

665 more jsr/jmp targets now carry a name the code supports.

Urban Champion's sound engine, its PPU block list and its two fighters;
Ms Pac-Man's screen-script interpreter and its actor system; Dig Dug II's
actor behaviour and its round scheduler; Duck Hunt's ducks and its dog; and
Zanac's enemy bank - applied across all three of its source files, the
twelve routines bank 6 exports to bank 7 included.

Ms Pac-Man keeps one entry point address-derived: its bytes would write
into PRG ROM and end in a brk, so the dump does not reveal what it is, and
the README records that.

CHANGELOG: record the entry-point naming

Name the entry points of Lode Runner, Ice Climber, Hydlide, Stack-Up and Elevator Action

Re-align the audit comments to the canonical column

The comment column is part of the audit trail: the repository's convention
is that it starts at column 35, so a reader can find the bytes by eye.
Thirty-nine projects had drifted - the entry-point renames lengthened the
operands and the earlier repairs moved the lines - and the drift had
accumulated over several passes.

align_audit_comments.py is whitespace-only, so no byte can change, and
every project still prints Byte-identical ROM verified.

Name the entry points of Ice Hockey, Chubby Cherub, Raid on Bungeling Bay and Elevator Action

1,127 more jsr/jmp targets now carry a name the code supports.

Ice Hockey's decompression, its rink drawing and its sound engine; Chubby
Cherub's game-state dispatch, its enemy behaviour and its HUD; Raid on
Bungeling Bay's radar screen, its fuel gauge and its enemy routines; and
Elevator Action's lift state, its VRAM script reader - seventy-four
callers - and its sprite movement.

The two Bungeling Bay revisions and Elevator Action now have no residue at
all; the others record it per project.

CHANGELOG: record the audit-comment re-alignment

Remaining entry-point naming

Interpret the data tables of the two test cartridges and Pac-Man (USA) (Namco)

**Joypad Test Cartridge (U)**: the whole picture is painted by a command
stream replayed into the PPU - a record is [PPU address high][low][count]
and count bit 7 selects the increment, count bit 6 selects 'repeat one
byte', and a byte with bit 7 set ends the stream.  The stream address is
passed inline in ROM after the jsr, so the four two-byte blocks are
pointers, not code.

**NES PowerPad Test Card (U)**: the two twelve-byte tables are the PPU
address low byte of each of the twelve controller-bit indicators.  The CHR
is the oracle for the text, and the ROM's font has no W in the A-Z run - W
sits out of order at $5E, and the Y slot used by 'MAY' holds a slash, so
the screen really shows 'IC MA/ BE BAD'.

**Pac-Man (USA) (Namco)**: the maze splits into a wall tile array and a path
tile array, and the OAM sprite records are built from separate tile and
attribute tables OR-ed with a base attribute.  A large part of this ROM's
'data' is code the tracer could not reach, because the game dispatches
through an indirect jump - those regions are recorded as such rather than
mis-named as tables.

CHANGELOG: record the tier reaching completion

Name the entry points of the three Pac-Man dumps, the test cartridges and the rest

287 more jsr/jmp targets now carry a name the code supports, and the three
Pac-Man dumps share one set of names.

Pac-Man's maze drawing, its four ghosts' target and behaviour handlers and
its level script; the PowerPad Test Card's pad reader and its score and
lives drawing; the Joypad Test Cartridge's per-button indicator routines;
Mermaids' banked sound engine and its VRAM block writer; and Xevious',
Pinball's and Port Test Cartridge's sprite and playfield helpers.

Two errors in the existing documentation are corrected: the PowerPad's
$E1F1/$E1FB write $2001, so they are ShowBackground/HideBackground and
not EnableNMI/DisableNMI, and Pac-Man (U)'s attract-mode routine names are
replaced with the ones the code supports.

Every project still prints Byte-identical ROM verified.

CHANGELOG: the final entry-point numbers
2026-10-22 00:33:54 -04:00

2044 lines
40 KiB
Plaintext

C41E Reset
C428 WaitVBlank_1
C439 ClearZeropage_1
C460 Reset_Block
C475 MainGameLoop
C47B InitPPU_1
C48C InitSprites_1
C495 ClearSpriteRAM
C4A9 NmiHandler
C4DE NmiHandler_Block
C507 NmiHandler_Block_5
C52F NmiHandler_Block_4
C535 NmiHandler_Block_2
C53E NmiHandler_Block_3
C541 InitAPU
C553 InitPPU_3
C559 SubCC559
C561 SubCC559_Block
C574 SubCC559_Block_2
C5A3 SubCC559_Block_3
C5C2 SubCC559_Block_5
C5C3 SubCC559_Block_4
C5D7 SubCC559_Block_7
C5E3 SubCC559_Block_6
C5E4 UpdateSprites
C5EB UpdateSprites_Block
C609 UpdateSprites2_1
C632 UpdateSprites2_1_Block
C634 UpdateSprites2_1_Block_2
C64C UpdateSprites2_1_Block_3
C656 UpdateSprites3_1
C66B UpdateSprites3_1_Block_3
C67E UpdateSprites3_1_Block_4
C67F UpdateSprites3_1_Block
C689 UpdateSprites3_1_Block_2
C6A8 UpdateSprites3_1_Block_10
C6AA UpdateSprites3_1_Block_9
C6AB UpdateSprites3_1_Block_5
C6B7 UpdateSprites3_1_Block_11
C6B8 UpdateSprites3_1_Block_6
C6C8 UpdateSprites3_1_Block_12
C6C9 UpdateSprites3_1_Block_7
C6CE UpdateSprites3_1_Block_8
C6D7 UpdateSprites4
C6DD UpdateSprites4_Block_2
C6E1 UpdateSprites4_Block
C6E2 UpdateSprites3_1_Block_13
C6EC ClearZeropage_3
C6F9 InitSpriteData
C707 UpdateSprites2_3
C71F UpdateSprites2_4
C723 UpdatePPUMask
C729 InitSprites_3
C72D InitSprites_3_Block
C794 InitSprites_3_Block_2
C797 InitLevel
C79B InitLevel2
C7B5 InitLevel2_Block
C7C3 UpdateGameState
C7CF UpdateGameState_Block
C7DC UpdateGameState_Block_2
C7F1 CheckLevelComplete
C7F3 CheckLevelComplete2
C80F CheckLevelComplete2_Block
C814 UpdatePlayerPosition_1
C833 UpdatePlayerPosition_1_Block_2
C83F UpdateSpritePosition
C85C UpdateSpritePosition_Block_2
C861 UpdatePlayerPosition_1_Block_4
C866 CheckController
C872 CheckController_Block_2
C87B CheckController_Block_3
C888 CheckController_Block_5
C889 CheckController_Block_4
C8A3 CheckController_Block_9
C8B5 CheckController_Block_11
C8B8 CheckController_Block_8
C8BB UpdateGameState2_1
C8C7 CheckController_Block_10
C8D8 CheckController_Block_6
C8DB UpdateGameState3_1
C8E1 CheckGameState2_Block
C8E2 CheckGameState2
C911 CheckButtonPress
C926 CheckButtonPress_Block
C931 CheckButtonPress_Block_3
C95A CheckButtonPress_Block_7
C976 CheckButtonPress_Block_6
C97F SubCC963_Block
C98F CheckButtonPress_Block_2
C992 CheckButtonPress_Block_4
C995 SubCC995
C9A8 SubCC995_Block_2
C9D9 SubCC995_Block_6
C9EB SubCC995_Block_5
C9EC SubCC995_Block_4
C9F8 SubCC9F8
CA01 SubCC995_Block
CA04 SubCC995_Block_3
CA0B SubCC9F8_Block
CA10 SubCC9F8_Block_2
CA36 SubCC9F8_Block_3
CA37 CheckAnswer
CA41 CheckAnswer_Block
CA43 CheckAnswer2
CA58 CheckAnswer2_Block_4
CA59 CheckAnswer2_Block_3
CA5A CheckAnswer2_Block_2
CA5B CheckAnswer2_Block_5
CA6D CheckAnswer2_Block_7
CA7B CheckAnswer2_Block_9
CA7D CheckAnswer3_1
CA85 CheckAnswer3_1_Block
CA86 UpdateScore_3
CA98 UpdateScore_3_Block
CA99 UpdateScore2_1
CABA UpdateScore2_1_Block_4
CAC6 UpdateScore2_1_Block_6
CAC7 UpdateScore2_1_Block
CAD3 UpdateScore2_1_Block_7
CAEE UpdateScore2_1_Block_8
CAF7 UpdateScore3
CB09 UpdateScore3_Block_2
CB11 UpdateScore3_Block_3
CB14 UpdateScore3_Block
CB17 UpdateGameState2_3
CB21 UpdateGameState2_3_Block
CB26 CheckAnswer3_3
CB3E CheckAnswer3_3_Block
CB44 UpdateGameState3_3
CB60 UpdateGameState3_3_Block
CB6D CheckAnswer3_3_Block_2
CB73 UpdatePlayerScore
CB89 CheckAnswer4
CB94 UpdateGameState4_3
CB9F UpdateGameState4_3_Block
CBC3 UpdateGameState4_3_Block_2
CBCA UpdateGameState4_3_Block_4
CBCC UpdateGameState5
CBCE UpdateGameState4_3_Block_3
CBD7 UpdatePlayerPosition_3
CBDE UpdatePlayerPosition_3_Block
CC02 UpdatePlayerPosition_3_Block_2
CC10 UpdatePlayerPosition_3_Block_3
CC23 UpdatePlayerPosition_3_Block_6
CC26 UpdatePlayerPosition_3_Block_4
CC2C UpdatePlayerPosition_3_Block_5
CC3E UpdateGameState6
CC42 UpdateGameState7
CC47 InitGame_3
CC5C UpdateGameState8
CC68 UpdateGameState8_Block
CC75 SubCCC75
CC80 SubCCC75_Block
CC8C SubCCC75_Block_2
CC94 SubCCC75_Block_3
CC9E SubCCC9E
CCB7 UpdateGameState10
CCBD SubCCC9E_Block
CCC3 SubCCC9E_Block_2
CCC6 SubCCCC6
CCC7 SubCCCC7
CCD6 UpdateGameState12
CCD9 SubCCCC7_Block
CCE2 SubCCCE2
CCF9 SubCCCE2_Block
CD09 SubCCCE2_Block_2
CD1B SubCCCE2_Block_4
CD25 SubCCCE2_Block_5
CD31 SubCCCE2_Block_6
CD46 SubCCCE2_Block_12
CD4F SubCCCE2_Block_13
CD56 SubCCCE2_Block_14
CD63 SubCCCE2_Block_16
CD75 SubCCCE2_Block_18
CD99 SubCCCE2_Block_21
CDA3 SubCCCE2_Block_23
CDA5 SubCCCE2_Block_24
CDAA SubCCCE2_Block_22
CDBD SubCCCE2_Block_20
CDBE SubCCCE2_Block_17
CDC1 SubCCDC1
CDC6 SubCCDC6
CDD0 SubCCDC6_Block
CDD8 SubCCDC6_Block_3
CDE7 SubCCDC6_Block_4
CDF9 SubCCDC6_Block_2
CE10 SubCCDC6_Block_9
CE11 SubCCDC6_Block_5
CE14 SubCCDC6_Block_6
CE19 SubCCDC6_Block_7
CE1E SubCCE1E
CE38 SubCCE1E_Block
CE3C SubCCE1E_Block_2
CE3D SubCCE3D
CE4A SubCCE3D_Block
CE5D SubCCE3D_Block_2
CE7F SubCCE3D_Block_3
CE80 SubCCE80
CE85 SubCCE85
CE9D SubCCE85_Block
CEA0 SubCCEA0
CEAC SubCCEA0_Block
CEBB SubCCE85_Block_2
CEBC SubCCEBC
CED3 SubCCEBC_Block
CEDA SubCCEDA
CEF1 SubCCEDA_Block
CEF8 SubCCEF8
CF06 SubCCEF8_Block_2
CF0D SubCCEF8_Block_3
CF12 SubCCEF8_Block_4
CF21 SubCCF21
CF34 SubCCF21_Block
CF3A SubCCF3A
CF46 SubCCF3A_Block
CF62 SubCCF3A_Block_4
CF65 SubCCF65
CF6F SubCCF65_Block
CF71 SubCCF65_Block_2
CF80 SubCCF80
CF8A SubCCF80_Block
CF97 SubCCF97
CFA4 SubCCF97_Block
CFB5 SubCCFB5
CFBB SubCCFB5_Block
CFC3 SubCCFB5_Block_2
CFD1 SubCCFB5_Block_3
CFD5 SubCCFB5_Block_4
CFD8 SubCCFB5_Block_6
CFDA SubCCFB5_Block_5
CFE2 SubCCFE2
CFFC SubCCFE2_Block_4
CFFE SubCCFE2_Block_5
D00B SubCCFE2_Block_2
D01B SubCCFE2_Block_6
D02D SubCCFE2_Block_7
D037 SubCCFE2_Block_9
D03C SubCCFE2_Block_3
D03D SubCD03D
D053 SubCD03D_Block
D056 SubCD056
D06C SubCD056_Block_2
D07B SubCD07B
D090 SubCD07B_Block
D093 SubCD093
D0AC SubCD093_Block
D0AF SubCD0AF
D0B4 SubCD0AF_Block
D0C5 SubCD0C5
D0C9 SubCD0AF_Block_2
D0CA SubCD0CA
D0E1 SubCD0CA_Block
D0FC SubCD0CA_Block_2
D102 SubCD102
D10B SubCD10B
D114 SubCD10B_Block
D117 SubCD117
D123 SubCD117_Block
D125 SubCD117_Block_2
D128 SubCD128
D139 SubCD128_Block
D13C SubCD128_Block_2
D13F SubCD13F
D151 SubCD13F_Block
D153 SubCD153
D158 SubCD158
D164 SubCD164
D175 UpdateSpritePosition26
D17A SubCD17A
D189 SubCD17A_Block_2
D1A8 SubCD17A_Block_4
D1AB SubCD1AB
D1B8 SubCD17A_Block_3
D1F6 SubCD1AB_Block_5
D201 SubCD1AB_Block_4
D22C SubCD1AB_Block_6
D22F SubCD1AB_Block_3
D231 SubCD231
D23F SubCD23F
D242 SubCD242
D268 SubCD242_Block
D273 SubCD273
D292 SubCD292
D2B5 SubCD292_Block
D2BC SubCD2BC
D2EF SubCD2BC_Block_4
D2F7 SubCD2BC_Block_3
D311 SubCD2BC_Block_6
D312 SubCD2BC_Block_2
D31C SubCD2BC_Block_7
D333 SubCD2BC_Block_8
D34A SubCD2BC_Block_9
D34C SubCD2BC_Block_10
D34F SubCD34F
D356 SubCD34F_Block
D35E SubCD35E
D38D SubCD35E_Block_5
D39F SubCD35E_Block_7
D3A2 SubCD3A2
D3AC SubCD3A2_Block_2
D3AE SubCD3A2_Block
D3C1 SubCD3C1
D3F3 SubCD3C1_Block_4
D3F9 SubCD3C1_Block
D420 SubCD3C1_Block_2
D42A SubCD3C1_Block_6
D438 SubCD3C1_Block_7
D43E SubCD3C1_Block_8
D44A SubCD44A
D459 SubCD44A_Block
D45A SubCD44A_Block_3
D466 SubCD44A_Block_6
D48A SubCD44A_Block_4
D495 SubCD44A_Block_7
D496 SubCD44A_Block_5
D4E0 SubCD44A_Block_8
D4F4 SubCD4F4
D4F9 SubCD4F4_Block_3
D4FA SubCD4F4_Block
D511 SubCD4F4_Block_4
D517 SubCD4F4_Block_5
D51A SubCD51A
D52C SubCD51A_Block_3
D54E SubCD51A_Block_4
D556 SubCD556
D55A SubCD55A
D55E SubCD55E
D562 SubCD562
D564 SubCD55E_Block
D587 SubCD562_Block_3
D58E SubCD562_Block_4
D59A SubCD59A
D5AC SubCD562_Block
D5D9 SubCD59A_Block
D5E3 SubCD562_Block_2
D5F8 SubCD5F8
D615 SubCD615
D62A SubCD62A
D63C SubCD63C
D653 SubCD63C_Block_2
D65C SubCD63C_Block_3
D65F SubCD65F
D674 SubCD65F_Block
D680 SubCD65F_Block_2
D69F SubCD69F
D6A3 SubCD6A3
D6B4 SubCD6A7_Block
D6BA SubCD6BA
D6CC SubCD6CC
D6D0 SubCD6D0
D70A SubCD6D2_Block_2
D71B SubCD6D2_Block_3
D725 SubCD6D2_Block_4
D728 SubCD728
D72E SubCD6D2_Block
D731 SubCD731
D74C SubCD74C
D752 SubCD74C_Block
D75C SubCD75C
D762 SubCD75C_Block
D777 SubCD777
D779 SubCD777_Block_2
D77F SubCD777_Block
D79D SubCD79D
D7A6 SubCD79D_Block_2
D7AB SubCD79D_Block
D7D1 SubCD7D1
D7D3 SubCD7D1_Block_2
D7DB SubCD7D1_Block
D7F0 SubCD7F0
D7F6 SubCD7F0_Block_4
D7FA SubCD7F0_Block_3
D814 SubCD7F0_Block
D828 SubCD7F0_Block_2
D82F SubCD82F
D84C SubCD82F_Block_2
D84D SubCD82F_Block_3
D879 SubCD82F_Block_7
D87A SubCD82F_Block_5
D89E SubCD82F_Block_11
D8A3 SubCD82F_Block_9
D8A4 SubCD82F_Block_4
D8BF SubCD82F_Block_13
D8C4 SubCD82F_Block_12
D8EE SubCD908_Block_2
D906 SubCD8C5_Block_6
D908 SubCD908
D915 SubCD908_Block
D916 SubCD8C5_Block_3
D91B SubCD908_Block_4
D922 SubCD8C5_Block
D94C SubCD908_Block_5
D95B SubCD95B
D96C SubCD95B_Block
D971 SubCD971
D979 SubCD971_Block_2
D980 SubCD980
D98F SubCD980_Block_2
D992 SubCD980_Block_3
D995 SubCD995
D9A7 SubCD9A7
D9AF SubCD9AF
D9B3 SubCD9B3
D9B5 SubCD9B5
D9B7 SubCD9AF_Block
D9D2 SubCD9B5_Block_2
D9DB SubCD9B5_Block_4
D9FE SubCD9B5_Block_3
DA03 SubCDA03
DA05 SubCDA05
DA0C SubCDA0C
DA14 SubCDA0C_Block
DA17 SubCDA17
DA2A SubCDA2A
DA3B SubCDA2A_Block
DA41 SubCDA2A_Block_4
DA52 SubCDA2A_Block_6
DA58 SubCDA2A_Block_9
DA5B SubCDA2A_Block_10
DA5E SubCDA5E
DA65 SubCDA5E_Block
DA66 SubCDA66
DA6C SubCDA66_Block_3
DA8D SubCDA66_Block_2
DA90 SubCDA90
DAA0 SubCDA90_Block_3
DABF SubCDA90_Block_2
DAC2 SubCDAC2
DAC9 SubCDAC2_Block_2
DADE SubCDAC2_Block
DADF SubCDADF
DAF3 SubCDADF_Block
DB12 SubCDADF_Block_2
DB15 SubCDB15
DB27 SubCDB15_Block
DB29 SubCDB15_Block_2
DB2D SubCDB2D
DB34 SubCDB2D_Block
DB5D SubCDB42_Block
DB6A SubCDB42_Block_2
DB6B SubCDB6B
DB96 SubCDB85_Block_4
DBAC SubCDB85_Block_2
DBB2 SubCDB85_Block
DBB5 SubCDB85_Block_3
DBBF SubCDBBF
DBC2 SubCDBC2
DBDA SubCDBC2_Block_7
DBEF SubCDBC2_Block_3
DBF5 SubCDBC2_Block_2
DC0C SubCDBC2_Block_6
DC0D UpdateSpritePosition61
DC1F SubCDC1F
DC25 SubCDC1F_Block
DC4A SubCDC1F_Block_7
DC7C SubCDC1F_Block_12
DC95 SubCDC1F_Block_16
DC9F SubCDC1F_Block_13
DCAC SubCDC1F_Block_15
DCC6 SubCDC1F_Block_8
DCCB SubCDCCB
DCD1 SubCDCCB_Block
DCE3 UpdateSpritePosition66
DCE4 SubCDCCB_Block_2
DCEA SubCDCCB_Block_4
DCFE SubCDCCB_Block_3
DD09 SubCDCCB_Block_5
DD0A SubCDD0A
DD0C SubCDD16_Block_2
DD15 SubCDD0A_Block
DD25 SubCDD16_Block
DD48 SubCDD16_Block_4
DD4D SubCDD16_Block_3
DD4E SubCDD4E
DD5B SubCDD4E_Block
DD9A SubCDD4E_Block_2
DD9D SubCDD9D
DDA7 SubCDDA7
DDC6 SubCDDA7_Block
DDD6 SubCDDA7_Block_2
DDED SubCDDA7_Block_3
DDEF SubCDDEF
DE24 SubCDE10_Block_2
DE2A SubCDE2A
DE2C SubCDE10_Block_3
DE33 SubCDE10_Block
DE3A SubCDE2A_Block
DE3D SubCDE3D
DE63 UpdateSpritePosition82
DE77 SubCDE68_Block
DE9B SubCDE68_Block_2
DE9F SubCDE68_Block_3
DECB SubCDECB
DEDB SubCDECB_Block
DEED SubCDECB_Block_2
DF05 SubCDECB_Block_6
DF0C SubCDECB_Block_3
DF31 SubCDECB_Block_8
DF44 SubCDECB_Block_9
DF47 SubCDF47
DF6A SubCDF47_Block
DF6E SubCDF6E
DF76 SubCDF6E_Block
DF7E SubCDF7E
DF84 SubCDF6E_Block_3
DF9B SubCDF7E_Block_2
DF9F SubCDF7E_Block_4
DFAA SubCDF7E_Block_5
DFC4 SubCDF7E_Block_7
DFD8 SubCDF7E_Block_8
DFE0 SubCDFE0
DFEE SubCDFEE
DFF3 SubCDFEE_Block
E003 SubCDFEE_Block_2
E007 SubCDFEE_Block_4
E00A SubCDFEE_Block_3
E015 SubCDFEE_Block_5
E01F SubCDFEE_Block_6
E02A SubCDFEE_Block_7
E057 SubCDFEE_Block_8
E070 SubCDFEE_Block_9
E091 SubCDFEE_Block_10
E09E SubCE09E
E0A9 SubCE09E_Block
E0D7 SubCE0D7
E0E4 SubCE0E4
E0F4 SubCE0E4_Block
E0FD InitGame_4
E137 SubCE0E4_Block_2
E15F SubCE0E4_Block_3
E163 SubCE0E4_Block_4
E170 SubCE170
E174 SubCE170_Block
E17B SubCE17B
E182 SubCE17B_Block
E199 SubCE199
E19B SubCE199_Block
E1BC SubCE199_Block_2
E1C1 SubCE1C1
E1C5 SubCE1C1_Block_2
E1D3 SubCE1C1_Block
E1D7 SubCE1D7
E1DC SubCE1D7_Block
E1E2 SubCE1D7_Block_2
E1EB SubCE1D7_Block_3
E1F9 SubCE1D7_Block_4
E1FF SubCE1D7_Block_5
E20D SubCE1D7_Block_6
E23A SubCE1D7_Block_7
E242 SubCE242
E254 SubCE242_Block
E259 SubCE259
E26B SubCE26B
E27E SubCE26B_Block
E28F SubCE26B_Block_3
E291 SubCE291
E296 SubCE26B_Block_2
E2A3 SubCE291_Block
E2AF SubCE291_Block_2
E2B3 SubCE2B3
E2B4 SubCE2B4
E2BC SubCE2B4_Block
E2CC SubCE2CC
E2DE SubCE2DE
E2E2 SubCE2DE_Block_2
E2E3 SubCE2DE_Block
E2F5 SubCE2F5
E308 SubCE2F5_Block
E314 SubCE314
E322 SubCE314_Block_2
E324 SubCE324
E328 SubCE314_Block
E32D SubCE32D
E338 SubCE338
E344 SubCE338_Block
E352 SubCE32D_Block
E353 SubCE353
E359 SubCE353_Block
E36F SubCE353_Block_3
E386 SubCE353_Block_2
E387 SubCE387
E3A5 SubCE3A5
E3CC SubCE3A5_Block_3
E3D1 SubCE3A5_Block_5
E3DF SubCE3A5_Block_7
E3FE SubCE3FE
E405 SubCE3FE_Block_17
E406 SubCE3F0_Block
E40B SubCE3A5_Block_6
E418 SubCE3FE_Block
E421 SubCE3FE_Block_3
E42A SubCE3FE_Block_5
E433 SubCE3FE_Block_7
E43C SubCE3FE_Block_9
E443 SubCE3FE_Block_10
E44B SubCE3FE_Block_12
E44E SubCE3FE_Block_11
E456 SubCE3FE_Block_14
E459 UpdateDisplay2
E45F SubCE3FE_Block_15
E476 SubCE3FE_Block_16
E481 SubCE481
E496 SubCE481_Block_4
E49F SubCE481_Block_3
E4A2 SubCE481_Block_2
E4A6 SubCE4A6
E4B1 SubCE4B1
E4B4 SubCE4A6_Block
E4BC SubCE4A6_Block_2
E4BF SubCE4BF
E4C5 SubCE4C5
E4D8 SubCE4C5_Block_2
E4DF SubCE4C5_Block_3
E4E6 SubCE4C5_Block_4
E4F1 SubCE4C5_Block
E4F4 SubCE502_Block
E50F SubCE502_Block_2
E523 SubCE502_Block_4
E529 SubCE502_Block_7
E52C SubCE502_Block_5
E531 SubCE502_Block_6
E53F SubCE502_Block_8
E542 SubCE502_Block_3
E54A PlayMusic
E568 SubCE502_Block_9
E56B SubCE56B
E57A SubCE5AB_Block_2
E57C SubCE57C
E57E SubCE5AB_Block
E585 SubCE585
E596 SubCE596
E5A8 SubCE596_Block_2
E5AB SubCE5AB
E5B9 SubCE5B9
E5C0 SubCE5C0
E5CA SubCE5C0_Block
E5D4 SubCE5C0_Block_2
E5DE SubCE5C0_Block_3
E5E8 SubCE5C0_Block_4
E5F2 SubCE5C0_Block_5
E5F8 SubCE5F8
E5FD SubCE5F8_Block
E610 SubCE63D_Block_3
E613 SubCE5F8_Block_2
E61E SubCE5F8_Block_3
E627 SubCE5F8_Block_4
E639 SubCE5F8_Block_6
E654 SubCE63D_Block_2
E65E SubCE65E
E665 SubCE65E_Block_2
E674 SubCE674
E67E SubCE674_Block
E684 SubCE674_Block_2
E695 SubCE674_Block_5
E69C SubCE674_Block_6
E6A1 SubCE674_Block_7
E6BA SubCE6BA
E6C9 SubCE6C9
E6D3 SubCE6D3
E6DE SubCE6DE
E6F1 SubCE6F1
E6F5 SubCE6F1_Block
E715 SubCE715
E71A SubCE715_Block
E722 SubCE715_Block_2
E729 SubCE715_Block_3
E72C SubCE72C
E72E SubCE72C_Block
E73F SubCE73F
E741 SubCE73F_Block
E74A SubCE74A
E754 SubCE74A_Block_5
E755 SubCE74A_Block_2
E75B SubCE74A_Block_3
E795 SubCE74A_Block_7
E79C SubCE74A_Block_6
E7A0 SubCE7A0
E7B1 SubCE7A0_Block_3
E7B8 SubCE7A0_Block_4
E7C3 SubCE7A0_Block_6
E7CA SubCE7A0_Block_7
E7F5 SubCE7F5
E7FC SubCE7FC
E803 SubCE7FC_Block
E80B SubCE7FC_Block_2
E825 SubCE825
E848 SubCE825_Block_2
E84C SubCE825_Block_3
E870 SubCE825_Block
E876 SubCE876
E87C SubCE876_Block
E88B SubCE876_Block_2
E89A SubCE876_Block_4
E8AE SubCE876_Block_6
E8B5 SubCE876_Block_7
E8C9 SubCE876_Block_5
E8DE SubCE8AD_Block
E8E0 SubCE8E0
E8EC SubCE8E0_Block_2
E8FD SubCE876_Block_3
E912 SubCE912
E91A SubCE912_Block
E923 SubCE912_Block_3
E928 SubCE928
E966 SubCE949_Block
E96E SubCE928_Block
E96F SubCE928_Block_2
E981 SubCE949_Block_2
E984 SubCE984
E98B SubCE984_Block
E9A7 SubCE984_Block_4
E9B0 SubCE984_Block_3
E9B1 SubCE984_Block_2
E9C0 SubCE9C0
E9C7 SubCE9C0_Block
E9DA SubCE9C0_Block_3
E9DE SubCE9C0_Block_2
E9E1 SubCE9C0_Block_4
E9E7 SubCE9E7
E9EE SubCE9E7_Block
EA05 SubCE9E7_Block_3
EA0D SubCEA0D
EA29 SubCEA0D_Block_2
EA2C SubCEA0D_Block
EA35 SubCEA0D_Block_3
EA39 SubCEA39
EA48 SubCEA39_Block_3
EA5A SubCEA39_Block_5
EA5B SubCEA5B
EA5D SubCEA5D
EA71 SubCEA5D_Block_2
EA79 SubCEA5D_Block
EA7C SubCEA7C
EA81 SubCEA7C_Block
EA89 SubCEA7C_Block_2
EAAD SubCEA7C_Block_6
EAAF SubCEA7C_Block_7
EAB2 SubCEA7C_Block_3
EAC7 SubCEA7C_Block_9
EADB SubCEA7C_Block_10
EAEB SubCEA7C_Block_8
EAFE SubCEAFE
EB0D UpdateSoundChannel6
EB15 SubCEB15
EB41 SubCEB41
EB4D SubCEB41_Block
EB56 SubCEB56
EB62 SubCEB15_Block_2
EB66 SubCEB66
EB75 SubCEB66_Block
EB7B SubCEB7B
EB8A SubCEB7B_Block
EBAF SubCEB95_Block
EBBD SubCEB95_Block_3
EBC0 SubCEB95_Block_6
EBC1 SubCEB7B_Block_2
EBC8 SubCEB95_Block_4
EBE5 SubCEBE5
EBF6 SubCEBE5_Block
EBF7 SubCEBF7
EC09 SubCEBF7_Block
EC0F SubCEC0F
EC12 SubCEC0F_Block
EC1B SubCEC1B
EC34 SubCEC53_Block
EC4F SubCEC2F_Block
EC53 SubCEC53
EC5B SubCEC1B_Block
EC5D SubCEC77_Block
EC75 SubCEC53_Block_3
EC77 SubCEC77
EC8B SubCEC1B_Block_2
ECB9 SubCEC77_Block_2
ECD9 SubCEC77_Block_3
ECDA SubCECDA
ECE0 SubCECDA_Block_4
ECE2 SubCECDA_Block_2
ECEF SubCECDA_Block
ED08 SubCECDA_Block_3
ED0F SubCED0F
ED12 SubCED12
ED2D SubCED12_Block
ED3C SubCED12_Block_4
ED44 SubCED12_Block_2
ED4B SubCED12_Block_3
ED50 SubCED50
ED6B SubCED50_Block_2
ED75 SubCED12_Block_5
ED79 SubCED50_Block
ED8E SubCED50_Block_4
ED8F SubCED50_Block_3
ED9E SubCED50_Block_6
EDA1 SubCED9F_Block_3
EDAE SubCED9F_Block_4
EDBD SubCED9F_Block_2
EDCD SubCED9F_Block
EDD7 SubCEDD7
EDF6 SubCEDD7_Block
EE04 SubCEDD7_Block_2
EE06 SubCEE06
EE0B SubCEDD7_Block_3
EE10 SubCEE10
EE23 SubCEE10_Block
EE25 SubCEE25
EE2A SubCEE25_Block_2
EE38 SubCEE25_Block_3
EE39 SubCEE25_Block
EE44 SubCEE44
EE4D UpdateMusicChannel16
EE5E SubCEE5E
EE6F SubCEE6F
EE75 SubCEE6F_Block
EE97 SubCEE97
EEA5 SubCEE97_Block
EEE1 SubCEEE1
EEED SubCEEED
EF08 SubCEEED_Block_2
EF18 SubCEF18
EF1B SubCEF1B
EF21 SubCEF21
EF5A SubCEF21_Block_2
EF7A SubCEF21_Block_3
EF80 SubCEF21_Block
EFAC SubCEF21_Block_4
EFC8 SubCEFC8
EFD6 SubCEFC8_Block
EFE9 SubCEFC8_Block_2
EFEA SubCEFEA
EFF7 SubCEFF7
F005 SubCF04B_Block
F006 SubCF006
F00C SubCEFF7_Block
F01C SubCF006_Block_2
F024 SubCF006_Block_3
F030 SubCF030
F042 SubCF030_Block
F04B SubCF04B
F051 SubCF051
F06F UpdateMusicChannel22
F07B SubCF051_Block
F08B SubCF006_Block_5
F0A9 SubCF051_Block_4
F0AE SubCF0AE
F0BC SubCF0AE_Block_2
F0BD SubCF051_Block_3
F0D3 SubCF0AE_Block_4
F0D8 SubCF0D8
F0E8 SubCF0D8_Block_2
F0E9 SubCF0AE_Block_3
F0F1 SubCF051_Block_2
F117 SubCF0D8_Block_3
F11C SubCF11C
F12A SubCF11C_Block
F12B SubCF12B
F135 SubCF135
F16E SubCF135_Block_3
F179 SubCF135_Block_2
F17A SubCF17A
F193 SubCF17A_Block_2
F196 SubCF17A_Block
F197 SubCF197
F1A6 SubCF197_Block
F1BC SubCF197_Block_3
F1D5 SubCF197_Block_4
F1DC SubCF218_Block
F1F2 SubCF197_Block_5
F1FE SubCF197_Block_6
F201 SubCF197_Block_8
F204 SubCF197_Block_7
F218 SubCF218
F221 SubCF221
F22A SubCF22A
F22E SubCF22A_Block_2
F237 SubCF22A_Block
F23D SubCF23D
F279 SubCF23D_Block_2
F298 SubCF23D_Block
F2A9 SubCF23D_Block_3
F2AA SubCF2AA
F2AC SubCF2AC
F2C3 SubCF2AC_Block_2
F2DC SubCF2AC_Block
F305 SubCF305
F30A SubCF30A
F30C SubCF30C
F31D SubCF30C_Block
F31E SubCF31E
F322 SubCF322
F324 SubCF31E_Block
F335 SubCF322_Block
F33F SubCF33F
F34C SubCF33F_Block_3
F36F SubCF33F_Block
F373 SubCF33F_Block_2
F3A1 SubCF33F_Block_5
F3A7 SubCF33F_Block_6
F3C3 SubCF33F_Block_7
F3C4 SubCF3C4
F3CF SubCF3C4_Block
F3DC SubCF3C4_Block_3
F3E0 SubCF3C4_Block_2
F3E5 SubCF3E5
F3F8 SubCF3E5_Block
F404 SubCF3E5_Block_2
F407 SubCF407
F48D SubCF48D
F499 SubCF48D_Block_3
F49F SubCF48D_Block_2
F4D2 SubCF4D2
F4E2 SubCF4D2_Block
F4F3 SubCF4F3
F50B SubCF50B
F50D SubCF50B_Block
F532 SubCF50B_Block_3
F543 SubCF50B_Block_4
FA5C SubCFA5C
FA75 SubCFA5C_Block
FA7C SubCFA5C_Block_2
FA8F SubCFA5C_Block_3
FA92 SubCFA5C_Block_4
FA95 SubCFA95
FAA7 SubCFAA7
FAA9 SubCFAA9
FAB1 SubCFAB1
FAC2 SubCFAC2
FAC4 SubCFAC4
FAC5 SubCFAC5
FACD SubCFACD
FAD3 SubCFAD3
FAD5 SubCFAD5
FADA SubCFAF0_Block
FAEB SubCFAD8_Block
FAEC SubCFAEC
FAF0 SubCFAF0
FAF7 SubCFAF7
FAF9 SubCFAF9
FB62 SubCFB62
FB64 SubCFB62_Block_2
FB6A SubCFB62_Block
FB6B SubCFB62_Block_4
FB74 SubCFBDC_Block_3
FB83 SubCFBDC_Block_2
FB8C SubCFBDC_Block_5
FB99 SubCFBDC_Block_4
FBA6 SubCFB62_Block_5
FBB4 SubCFBDC_Block_7
FBC6 SubCFBDC_Block_6
FBDA SubCFB62_Block_3
FBDC SubCFBDC
FC1C SubCFC31_Block_10
FC1F SubCFBDC_Block_8
FC2B UpdateAPU10
FC2F SubCFC31_Block_2
FC31 SubCFC31
FC3A SubCFBDC_Block_10
FC41 SubCFBDC_Block_9
FC47 SubCFC31_Block_11
FC4B SubCFBDC_Block_12
FC52 SubCFBDC_Block_11
FC64 SubCFBDC_Block_14
FC6B SubCFBDC_Block_13
FC79 SubCFC31_Block_8
FC7F SubCFC31_Block_12
FC82 SubCFC31_Block_3
FC87 SubCFBDC_Block_16
FC8D SubCFBDC_Block_15
FCA5 SubCFD10_Block
FCAC SubCFD10_Block_2
FCC3 SubCFC31_Block_14
FCC8 SubCFC31_Block_16
FCD2 SubCFD10_Block_4
FCD9 SubCFD10_Block_3
FCEA SubCFC31_Block_19
FCF2 SubCFC31_Block_20
FCF7 SubCFC31_Block_17
FD06 SubCFC31_Block_21
FD07 SubCFD10_Block_7
FD10 SubCFD10
FD2B SubCFD10_Block_5
FD3F SubCFD10_Block_6
FD4F SubCFD10_Block_8
FD59 SubCFD10_Block_10
FD62 SubCFD10_Block_9
FD65 SubCFD10_Block_12
FD67 SubCFD10_Block_13
FD6B SubCFD6B
FD79 SubCFD6B_Block
FD7E SubCFD6B_Block_4
FD8E SubCFD6B_Block_2
FD93 SubCFD6B_Block_3
FDC3 SubCFDB7_Block
FE07 SubCFDB7_Block_2
FE0B SubCFDB7_Block_3
FE28 SubCFDB7_Block_7
FE37 SubCFDB7_Block_10
FE3A SubCFDB7_Block_5
FE4E SubCFDB7_Block_6
FE51 SubCFE51
FE5E SubCFDB7_Block_13
FE7B SubCFE51_Block_2
FE7E SubCFDB7_Block_12
FE9C SubCFE51_Block_5
FEA3 SubCFE51_Block_6
FEA9 SubCFE51_Block_4
FFF0 IrqHandler
# ---- derived internal branch-target names ----
C41E Reset
C428 WaitVBlank_1
C439 ClearZeropage_1
C460 Reset_Block
C475 MainGameLoop
C47B InitPPU_1
C48C InitSprites_1
C495 ClearSpriteRAM
C4A9 NmiHandler
C4DE NmiHandler_Block
C507 NmiHandler_Block_5
C52F NmiHandler_Block_4
C535 NmiHandler_Block_2
C53E NmiHandler_Block_3
C541 InitAPU
C553 InitPPU_3
C559 SubCC559
C561 SubCC559_Block
C574 SubCC559_Block_2
C5A3 SubCC559_Block_3
C5C2 SubCC559_Block_5
C5C3 SubCC559_Block_4
C5D7 SubCC559_Block_7
C5E3 SubCC559_Block_6
C5E4 UpdateSprites
C5EB UpdateSprites_Block
C609 UpdateSprites2_1
C632 UpdateSprites2_1_Block
C634 UpdateSprites2_1_Block_2
C64C UpdateSprites2_1_Block_3
C656 UpdateSprites3_1
C66B UpdateSprites3_1_Block_3
C67E UpdateSprites3_1_Block_4
C67F UpdateSprites3_1_Block
C689 UpdateSprites3_1_Block_2
C6A8 UpdateSprites3_1_Block_10
C6AA UpdateSprites3_1_Block_9
C6AB UpdateSprites3_1_Block_5
C6B7 UpdateSprites3_1_Block_11
C6B8 UpdateSprites3_1_Block_6
C6C8 UpdateSprites3_1_Block_12
C6C9 UpdateSprites3_1_Block_7
C6CE UpdateSprites3_1_Block_8
C6D7 UpdateSprites4
C6DD UpdateSprites4_Block_2
C6E1 UpdateSprites4_Block
C6E2 UpdateSprites3_1_Block_13
C6EC ClearZeropage_3
C6F9 InitSpriteData
C707 UpdateSprites2_3
C71F UpdateSprites2_4
C723 UpdatePPUMask
C729 InitSprites_3
C72D InitSprites_3_Block
C794 InitSprites_3_Block_2
C797 InitLevel
C79B InitLevel2
C7B5 InitLevel2_Block
C7C3 UpdateGameState
C7CF UpdateGameState_Block
C7DC UpdateGameState_Block_2
C7F1 CheckLevelComplete
C7F3 CheckLevelComplete2
C80F CheckLevelComplete2_Block
C814 UpdatePlayerPosition_1
C833 UpdatePlayerPosition_1_Block_2
C83F UpdateSpritePosition
C85C UpdateSpritePosition_Block_2
C861 UpdatePlayerPosition_1_Block_4
C866 CheckController
C872 CheckController_Block_2
C87B CheckController_Block_3
C888 CheckController_Block_5
C889 CheckController_Block_4
C8A3 CheckController_Block_9
C8B5 CheckController_Block_11
C8B8 CheckController_Block_8
C8BB UpdateGameState2_1
C8C7 CheckController_Block_10
C8D8 CheckController_Block_6
C8DB UpdateGameState3_1
C8E1 CheckGameState2_Block
C8E2 CheckGameState2
C911 CheckButtonPress
C926 CheckButtonPress_Block
C931 CheckButtonPress_Block_3
C95A CheckButtonPress_Block_7
C963 SubCC963_Loop
C976 CheckButtonPress_Block_6
C97F SubCC963_Block
C98C SubCC98C_Loop
C98F CheckButtonPress_Block_2
C992 CheckButtonPress_Block_4
C995 SubCC995
C9A8 SubCC995_Block_2
C9D9 SubCC995_Block_6
C9EB SubCC995_Block_5
C9EC SubCC995_Block_4
C9F8 SubCC9F8
CA01 SubCC995_Block
CA04 SubCC995_Block_3
CA0B SubCC9F8_Block
CA10 SubCC9F8_Block_2
CA36 SubCC9F8_Block_3
CA37 CheckAnswer
CA41 CheckAnswer_Block
CA43 CheckAnswer2
CA58 CheckAnswer2_Block_4
CA59 CheckAnswer2_Block_3
CA5A CheckAnswer2_Block_2
CA5B CheckAnswer2_Block_5
CA6D CheckAnswer2_Block_7
CA7B CheckAnswer2_Block_9
CA7D CheckAnswer3_1
CA85 CheckAnswer3_1_Block
CA86 UpdateScore_3
CA98 UpdateScore_3_Block
CA99 UpdateScore2_1
CABA UpdateScore2_1_Block_4
CAC6 UpdateScore2_1_Block_6
CAC7 UpdateScore2_1_Block
CAD3 UpdateScore2_1_Block_7
CAEE UpdateScore2_1_Block_8
CAF7 UpdateScore3
CB09 UpdateScore3_Block_2
CB11 UpdateScore3_Block_3
CB14 UpdateScore3_Block
CB17 UpdateGameState2_3
CB21 UpdateGameState2_3_Block
CB26 CheckAnswer3_3
CB3E CheckAnswer3_3_Block
CB44 UpdateGameState3_3
CB60 UpdateGameState3_3_Block
CB6D CheckAnswer3_3_Block_2
CB73 UpdatePlayerScore
CB89 CheckAnswer4
CB94 UpdateGameState4_3
CB9F UpdateGameState4_3_Block
CBC3 UpdateGameState4_3_Block_2
CBCA UpdateGameState4_3_Block_4
CBCC UpdateGameState5
CBCE UpdateGameState4_3_Block_3
CBD7 UpdatePlayerPosition_3
CBDE UpdatePlayerPosition_3_Block
CC02 UpdatePlayerPosition_3_Block_2
CC10 UpdatePlayerPosition_3_Block_3
CC23 UpdatePlayerPosition_3_Block_6
CC26 UpdatePlayerPosition_3_Block_4
CC2C UpdatePlayerPosition_3_Block_5
CC3E UpdateGameState6
CC42 UpdateGameState7
CC47 InitGame_3
CC5C UpdateGameState8
CC68 UpdateGameState8_Block
CC75 SubCCC75
CC80 SubCCC75_Block
CC8C SubCCC75_Block_2
CC94 SubCCC75_Block_3
CC9E SubCCC9E
CCB7 UpdateGameState10
CCBD SubCCC9E_Block
CCC3 SubCCC9E_Block_2
CCC6 SubCCCC6
CCC7 SubCCCC7
CCD6 UpdateGameState12
CCD9 SubCCCC7_Block
CCE2 SubCCCE2
CCF9 SubCCCE2_Block
CD09 SubCCCE2_Block_2
CD1B SubCCCE2_Block_4
CD25 SubCCCE2_Block_5
CD31 SubCCCE2_Block_6
CD46 SubCCCE2_Block_12
CD4F SubCCCE2_Block_13
CD56 SubCCCE2_Block_14
CD63 SubCCCE2_Block_16
CD75 SubCCCE2_Block_18
CD99 SubCCCE2_Block_21
CDA3 SubCCCE2_Block_23
CDA5 SubCCCE2_Block_24
CDAA SubCCCE2_Block_22
CDB7 SubCCDB7_Loop
CDBA SubCCDBA_Loop
CDBD SubCCCE2_Block_20
CDBE SubCCCE2_Block_17
CDC1 SubCCDC1
CDC6 SubCCDC6
CDD0 SubCCDC6_Block
CDD8 SubCCDC6_Block_3
CDE7 SubCCDC6_Block_4
CDF9 SubCCDC6_Block_2
CE10 SubCCDC6_Block_9
CE11 SubCCDC6_Block_5
CE14 SubCCDC6_Block_6
CE19 SubCCDC6_Block_7
CE1E SubCCE1E
CE38 SubCCE1E_Block
CE3C SubCCE1E_Block_2
CE3D SubCCE3D
CE4A SubCCE3D_Block
CE5D SubCCE3D_Block_2
CE7F SubCCE3D_Block_3
CE80 SubCCE80
CE85 SubCCE85
CE9D SubCCE85_Block
CEA0 SubCCEA0
CEAC SubCCEA0_Block
CEBB SubCCE85_Block_2
CEBC SubCCEBC
CED3 SubCCEBC_Block
CEDA SubCCEDA
CEF1 SubCCEDA_Block
CEF8 SubCCEF8
CF06 SubCCEF8_Block_2
CF0D SubCCEF8_Block_3
CF12 SubCCEF8_Block_4
CF21 SubCCF21
CF34 SubCCF21_Block
CF37 SubCCF37_Loop
CF3A SubCCF3A
CF46 SubCCF3A_Block
CF62 SubCCF3A_Block_4
CF65 SubCCF65
CF6F SubCCF65_Block
CF71 SubCCF65_Block_2
CF80 SubCCF80
CF8A SubCCF80_Block
CF97 SubCCF97
CFA4 SubCCF97_Block
CFB5 SubCCFB5
CFBB SubCCFB5_Block
CFC3 SubCCFB5_Block_2
CFD1 SubCCFB5_Block_3
CFD5 SubCCFB5_Block_4
CFD8 SubCCFB5_Block_6
CFDA SubCCFB5_Block_5
CFE2 SubCCFE2
CFFC SubCCFE2_Block_4
CFFE SubCCFE2_Block_5
D00B SubCCFE2_Block_2
D01B SubCCFE2_Block_6
D02D SubCCFE2_Block_7
D037 SubCCFE2_Block_9
D03C SubCCFE2_Block_3
D03D SubCD03D
D053 SubCD03D_Block
D056 SubCD056
D06C SubCD056_Block_2
D07B SubCD07B
D090 SubCD07B_Block
D093 SubCD093
D0AC SubCD093_Block
D0AF SubCD0AF
D0B4 SubCD0AF_Block
D0C5 SubCD0C5
D0C9 SubCD0AF_Block_2
D0CA SubCD0CA
D0E1 SubCD0CA_Block
D0FC SubCD0CA_Block_2
D102 SubCD102
D10B SubCD10B
D114 SubCD10B_Block
D117 SubCD117
D123 SubCD117_Block
D125 SubCD117_Block_2
D128 SubCD128
D139 SubCD128_Block
D13C SubCD128_Block_2
D13F SubCD13F
D151 SubCD13F_Block
D153 SubCD153
D156 SubCD156_Loop
D158 SubCD158
D164 SubCD164
D175 UpdateSpritePosition26
D17A SubCD17A
D189 SubCD17A_Block_2
D1A8 SubCD17A_Block_4
D1AB SubCD1AB
D1B8 SubCD17A_Block_3
D1F6 SubCD1AB_Block_5
D201 SubCD1AB_Block_4
D20E SubCD20E_Loop
D22C SubCD1AB_Block_6
D22F SubCD1AB_Block_3
D231 SubCD231
D23F SubCD23F
D242 SubCD242
D268 SubCD242_Block
D273 SubCD273
D292 SubCD292
D2B5 SubCD292_Block
D2BC SubCD2BC
D2EF SubCD2BC_Block_4
D2F7 SubCD2BC_Block_3
D311 SubCD2BC_Block_6
D312 SubCD2BC_Block_2
D31C SubCD2BC_Block_7
D333 SubCD2BC_Block_8
D34A SubCD2BC_Block_9
D34C SubCD2BC_Block_10
D34F SubCD34F
D356 SubCD34F_Block
D35E SubCD35E
D38D SubCD35E_Block_5
D39F SubCD35E_Block_7
D3A2 SubCD3A2
D3AC SubCD3A2_Block_2
D3AE SubCD3A2_Block
D3C1 SubCD3C1
D3F3 SubCD3C1_Block_4
D3F9 SubCD3C1_Block
D420 SubCD3C1_Block_2
D42A SubCD3C1_Block_6
D438 SubCD3C1_Block_7
D43E SubCD3C1_Block_8
D44A SubCD44A
D459 SubCD44A_Block
D45A SubCD44A_Block_3
D466 SubCD44A_Block_6
D48A SubCD44A_Block_4
D495 SubCD44A_Block_7
D496 SubCD44A_Block_5
D4E0 SubCD44A_Block_8
D4F4 SubCD4F4
D4F9 SubCD4F4_Block_3
D4FA SubCD4F4_Block
D511 SubCD4F4_Block_4
D517 SubCD4F4_Block_5
D51A SubCD51A
D52C SubCD51A_Block_3
D54E SubCD51A_Block_4
D556 SubCD556
D55A SubCD55A
D55E SubCD55E
D562 SubCD562
D564 SubCD55E_Block
D587 SubCD562_Block_3
D58E SubCD562_Block_4
D59A SubCD59A
D5AC SubCD562_Block
D5D9 SubCD59A_Block
D5E3 SubCD562_Block_2
D5F8 SubCD5F8
D615 SubCD615
D62A SubCD62A
D63C SubCD63C
D653 SubCD63C_Block_2
D65C SubCD63C_Block_3
D65F SubCD65F
D674 SubCD65F_Block
D680 SubCD65F_Block_2
D69F SubCD69F
D6A3 SubCD6A3
D6A7 SubCD6A7_Loop
D6B4 SubCD6A7_Block
D6BA SubCD6BA
D6CC SubCD6CC
D6D0 SubCD6D0
D6D2 SubCD6D2_Loop
D70A SubCD6D2_Block_2
D71B SubCD6D2_Block_3
D725 SubCD6D2_Block_4
D728 SubCD728
D72E SubCD6D2_Block
D731 SubCD731
D74C SubCD74C
D752 SubCD74C_Block
D75C SubCD75C
D762 SubCD75C_Block
D777 SubCD777
D779 SubCD777_Block_2
D77F SubCD777_Block
D79D SubCD79D
D7A6 SubCD79D_Block_2
D7AB SubCD79D_Block
D7D1 SubCD7D1
D7D3 SubCD7D1_Block_2
D7DB SubCD7D1_Block
D7F0 SubCD7F0
D7F6 SubCD7F0_Block_4
D7FA SubCD7F0_Block_3
D814 SubCD7F0_Block
D828 SubCD7F0_Block_2
D82F SubCD82F
D84C SubCD82F_Block_2
D84D SubCD82F_Block_3
D879 SubCD82F_Block_7
D87A SubCD82F_Block_5
D89E SubCD82F_Block_11
D8A3 SubCD82F_Block_9
D8A4 SubCD82F_Block_4
D8BF SubCD82F_Block_13
D8C4 SubCD82F_Block_12
D8C5 SubCD8C5_Loop
D8EE SubCD908_Block_2
D906 SubCD8C5_Block_6
D908 SubCD908
D915 SubCD908_Block
D916 SubCD8C5_Block_3
D91B SubCD908_Block_4
D922 SubCD8C5_Block
D94C SubCD908_Block_5
D952 SubCD952_Loop
D95B SubCD95B
D96C SubCD95B_Block
D971 SubCD971
D979 SubCD971_Block_2
D980 SubCD980
D98F SubCD980_Block_2
D992 SubCD980_Block_3
D995 SubCD995
D9A7 SubCD9A7
D9AF SubCD9AF
D9B3 SubCD9B3
D9B5 SubCD9B5
D9B7 SubCD9AF_Block
D9D2 SubCD9B5_Block_2
D9DB SubCD9B5_Block_4
D9FE SubCD9B5_Block_3
DA03 SubCDA03
DA05 SubCDA05
DA0C SubCDA0C
DA14 SubCDA0C_Block
DA17 SubCDA17
DA2A SubCDA2A
DA3B SubCDA2A_Block
DA41 SubCDA2A_Block_4
DA52 SubCDA2A_Block_6
DA58 SubCDA2A_Block_9
DA5B SubCDA2A_Block_10
DA5E SubCDA5E
DA65 SubCDA5E_Block
DA66 SubCDA66
DA6C SubCDA66_Block_3
DA8D SubCDA66_Block_2
DA90 SubCDA90
DAA0 SubCDA90_Block_3
DABF SubCDA90_Block_2
DAC2 SubCDAC2
DAC9 SubCDAC2_Block_2
DADE SubCDAC2_Block
DADF SubCDADF
DAF3 SubCDADF_Block
DB12 SubCDADF_Block_2
DB15 SubCDB15
DB27 SubCDB15_Block
DB29 SubCDB15_Block_2
DB2D SubCDB2D
DB34 SubCDB2D_Block
DB42 SubCDB42_Loop
DB5D SubCDB42_Block
DB6A SubCDB42_Block_2
DB6B SubCDB6B
DB85 SubCDB85_OnNegative
DB96 SubCDB85_Block_4
DBAC SubCDB85_Block_2
DBB2 SubCDB85_Block
DBB5 SubCDB85_Block_3
DBBF SubCDBBF
DBC2 SubCDBC2
DBDA SubCDBC2_Block_7
DBEF SubCDBC2_Block_3
DBF5 SubCDBC2_Block_2
DC0C SubCDBC2_Block_6
DC0D UpdateSpritePosition61
DC1F SubCDC1F
DC25 SubCDC1F_Block
DC4A SubCDC1F_Block_7
DC7C SubCDC1F_Block_12
DC95 SubCDC1F_Block_16
DC9F SubCDC1F_Block_13
DCAC SubCDC1F_Block_15
DCC6 SubCDC1F_Block_8
DCCB SubCDCCB
DCD1 SubCDCCB_Block
DCE3 UpdateSpritePosition66
DCE4 SubCDCCB_Block_2
DCEA SubCDCCB_Block_4
DCFE SubCDCCB_Block_3
DD09 SubCDCCB_Block_5
DD0A SubCDD0A
DD0C SubCDD16_Block_2
DD15 SubCDD0A_Block
DD16 SubCDD16_OnNegative
DD25 SubCDD16_Block
DD48 SubCDD16_Block_4
DD4D SubCDD16_Block_3
DD4E SubCDD4E
DD5B SubCDD4E_Block
DD9A SubCDD4E_Block_2
DD9D SubCDD9D
DDA7 SubCDDA7
DDC6 SubCDDA7_Block
DDD6 SubCDDA7_Block_2
DDED SubCDDA7_Block_3
DDEF SubCDDEF
DE10 SubCDE10_Loop
DE24 SubCDE10_Block_2
DE2A SubCDE2A
DE2C SubCDE10_Block_3
DE33 SubCDE10_Block
DE3A SubCDE2A_Block
DE3D SubCDE3D
DE63 UpdateSpritePosition82
DE68 SubCDE68_OnNegative
DE77 SubCDE68_Block
DE9B SubCDE68_Block_2
DE9F SubCDE68_Block_3
DECB SubCDECB
DEDB SubCDECB_Block
DEED SubCDECB_Block_2
DF05 SubCDECB_Block_6
DF0C SubCDECB_Block_3
DF31 SubCDECB_Block_8
DF44 SubCDECB_Block_9
DF47 SubCDF47
DF6A SubCDF47_Block
DF6E SubCDF6E
DF76 SubCDF6E_Block
DF7E SubCDF7E
DF84 SubCDF6E_Block_3
DF9B SubCDF7E_Block_2
DF9F SubCDF7E_Block_4
DFAA SubCDF7E_Block_5
DFC4 SubCDF7E_Block_7
DFD8 SubCDF7E_Block_8
DFE0 SubCDFE0
DFEE SubCDFEE
DFF3 SubCDFEE_Block
E003 SubCDFEE_Block_2
E007 SubCDFEE_Block_4
E00A SubCDFEE_Block_3
E015 SubCDFEE_Block_5
E01F SubCDFEE_Block_6
E02A SubCDFEE_Block_7
E057 SubCDFEE_Block_8
E070 SubCDFEE_Block_9
E091 SubCDFEE_Block_10
E09E SubCE09E
E0A9 SubCE09E_Block
E0D7 SubCE0D7
E0E4 SubCE0E4
E0F4 SubCE0E4_Block
E0FD InitGame_4
E137 SubCE0E4_Block_2
E15F SubCE0E4_Block_3
E163 SubCE0E4_Block_4
E170 SubCE170
E174 SubCE170_Block
E17B SubCE17B
E182 SubCE17B_Block
E199 SubCE199
E19B SubCE199_Block
E1BC SubCE199_Block_2
E1C1 SubCE1C1
E1C5 SubCE1C1_Block_2
E1D3 SubCE1C1_Block
E1D7 SubCE1D7
E1DC SubCE1D7_Block
E1E2 SubCE1D7_Block_2
E1EB SubCE1D7_Block_3
E1F9 SubCE1D7_Block_4
E1FF SubCE1D7_Block_5
E20D SubCE1D7_Block_6
E23A SubCE1D7_Block_7
E242 SubCE242
E254 SubCE242_Block
E259 SubCE259
E26B SubCE26B
E27E SubCE26B_Block
E28F SubCE26B_Block_3
E291 SubCE291
E296 SubCE26B_Block_2
E2A3 SubCE291_Block
E2AF SubCE291_Block_2
E2B3 SubCE2B3
E2B4 SubCE2B4
E2BC SubCE2B4_Block
E2CC SubCE2CC
E2DE SubCE2DE
E2E2 SubCE2DE_Block_2
E2E3 SubCE2DE_Block
E2F5 SubCE2F5
E308 SubCE2F5_Block
E314 SubCE314
E322 SubCE314_Block_2
E324 SubCE324
E328 SubCE314_Block
E32D SubCE32D
E338 SubCE338
E344 SubCE338_Block
E352 SubCE32D_Block
E353 SubCE353
E359 SubCE353_Block
E36F SubCE353_Block_3
E386 SubCE353_Block_2
E387 SubCE387
E3A5 SubCE3A5
E3CC SubCE3A5_Block_3
E3D1 SubCE3A5_Block_5
E3DF SubCE3A5_Block_7
E3F0 SubCE3F0_Loop
E3FE SubCE3FE
E405 SubCE3FE_Block_17
E406 SubCE3F0_Block
E40B SubCE3A5_Block_6
E418 SubCE3FE_Block
E421 SubCE3FE_Block_3
E42A SubCE3FE_Block_5
E433 SubCE3FE_Block_7
E43C SubCE3FE_Block_9
E443 SubCE3FE_Block_10
E44B SubCE3FE_Block_12
E44E SubCE3FE_Block_11
E456 SubCE3FE_Block_14
E459 UpdateDisplay2
E45F SubCE3FE_Block_15
E476 SubCE3FE_Block_16
E481 SubCE481
E496 SubCE481_Block_4
E49F SubCE481_Block_3
E4A2 SubCE481_Block_2
E4A6 SubCE4A6
E4B1 SubCE4B1
E4B4 SubCE4A6_Block
E4BC SubCE4A6_Block_2
E4BF SubCE4BF
E4C5 SubCE4C5
E4D8 SubCE4C5_Block_2
E4DF SubCE4C5_Block_3
E4E6 SubCE4C5_Block_4
E4F1 SubCE4C5_Block
E4F4 SubCE502_Block
E502 SubCE502_Loop
E50F SubCE502_Block_2
E523 SubCE502_Block_4
E529 SubCE502_Block_7
E52C SubCE502_Block_5
E531 SubCE502_Block_6
E53F SubCE502_Block_8
E542 SubCE502_Block_3
E54A PlayMusic
E568 SubCE502_Block_9
E56B SubCE56B
E57A SubCE5AB_Block_2
E57C SubCE57C
E57E SubCE5AB_Block
E585 SubCE585
E596 SubCE596
E5A8 SubCE596_Block_2
E5AB SubCE5AB
E5B9 SubCE5B9
E5BD SubCE5BD_Loop
E5C0 SubCE5C0
E5CA SubCE5C0_Block
E5D4 SubCE5C0_Block_2
E5DE SubCE5C0_Block_3
E5E8 SubCE5C0_Block_4
E5F2 SubCE5C0_Block_5
E5F8 SubCE5F8
E5FD SubCE5F8_Block
E610 SubCE63D_Block_3
E613 SubCE5F8_Block_2
E61E SubCE5F8_Block_3
E627 SubCE5F8_Block_4
E639 SubCE5F8_Block_6
E63D SubCE63D_Loop
E654 SubCE63D_Block_2
E65E SubCE65E
E665 SubCE65E_Block_2
E674 SubCE674
E67E SubCE674_Block
E684 SubCE674_Block_2
E695 SubCE674_Block_5
E69C SubCE674_Block_6
E6A1 SubCE674_Block_7
E6BA SubCE6BA
E6C9 SubCE6C9
E6D3 SubCE6D3
E6DE SubCE6DE
E6F1 SubCE6F1
E6F5 SubCE6F1_Block
E715 SubCE715
E71A SubCE715_Block
E722 SubCE715_Block_2
E729 SubCE715_Block_3
E72C SubCE72C
E72E SubCE72C_Block
E73F SubCE73F
E741 SubCE73F_Block
E74A SubCE74A
E754 SubCE74A_Block_5
E755 SubCE74A_Block_2
E75B SubCE74A_Block_3
E795 SubCE74A_Block_7
E79C SubCE74A_Block_6
E7A0 SubCE7A0
E7B1 SubCE7A0_Block_3
E7B8 SubCE7A0_Block_4
E7C3 SubCE7A0_Block_6
E7CA SubCE7A0_Block_7
E7F5 SubCE7F5
E7FC SubCE7FC
E803 SubCE7FC_Block
E80B SubCE7FC_Block_2
E825 SubCE825
E848 SubCE825_Block_2
E84C SubCE825_Block_3
E870 SubCE825_Block
E876 SubCE876
E87C SubCE876_Block
E88B SubCE876_Block_2
E89A SubCE876_Block_4
E8AD SubCE8AD_OnNonzero
E8AE SubCE876_Block_6
E8B5 SubCE876_Block_7
E8C9 SubCE876_Block_5
E8DE SubCE8AD_Block
E8E0 SubCE8E0
E8EC SubCE8E0_Block_2
E8FD SubCE876_Block_3
E912 SubCE912
E91A SubCE912_Block
E923 SubCE912_Block_3
E928 SubCE928
E949 SubCE949_Loop
E966 SubCE949_Block
E96E SubCE928_Block
E96F SubCE928_Block_2
E981 SubCE949_Block_2
E984 SubCE984
E98B SubCE984_Block
E9A7 SubCE984_Block_4
E9B0 SubCE984_Block_3
E9B1 SubCE984_Block_2
E9C0 SubCE9C0
E9C7 SubCE9C0_Block
E9DA SubCE9C0_Block_3
E9DE SubCE9C0_Block_2
E9E1 SubCE9C0_Block_4
E9E7 SubCE9E7
E9EE SubCE9E7_Block
EA05 SubCE9E7_Block_3
EA0D SubCEA0D
EA29 SubCEA0D_Block_2
EA2C SubCEA0D_Block
EA35 SubCEA0D_Block_3
EA39 SubCEA39
EA48 SubCEA39_Block_3
EA5A SubCEA39_Block_5
EA5B SubCEA5B
EA5D SubCEA5D
EA71 SubCEA5D_Block_2
EA79 SubCEA5D_Block
EA7C SubCEA7C
EA81 SubCEA7C_Block
EA89 SubCEA7C_Block_2
EAAD SubCEA7C_Block_6
EAAF SubCEA7C_Block_7
EAB2 SubCEA7C_Block_3
EAC7 SubCEA7C_Block_9
EADB SubCEA7C_Block_10
EAEB SubCEA7C_Block_8
EAFE SubCEAFE
EB0D UpdateSoundChannel6
EB15 SubCEB15
EB41 SubCEB41
EB4D SubCEB41_Block
EB56 SubCEB56
EB62 SubCEB15_Block_2
EB66 SubCEB66
EB75 SubCEB66_Block
EB7B SubCEB7B
EB8A SubCEB7B_Block
EB95 SubCEB95_OnNonnegative
EBAF SubCEB95_Block
EBBD SubCEB95_Block_3
EBC0 SubCEB95_Block_6
EBC1 SubCEB7B_Block_2
EBC8 SubCEB95_Block_4
EBE5 SubCEBE5
EBF6 SubCEBE5_Block
EBF7 SubCEBF7
EC01 SubCEC01_Loop
EC09 SubCEBF7_Block
EC0F SubCEC0F
EC12 SubCEC0F_Block
EC1B SubCEC1B
EC2F SubCEC2F_Loop
EC34 SubCEC53_Block
EC4F SubCEC2F_Block
EC53 SubCEC53
EC5B SubCEC1B_Block
EC5D SubCEC77_Block
EC75 SubCEC53_Block_3
EC77 SubCEC77
EC8B SubCEC1B_Block_2
ECB9 SubCEC77_Block_2
ECD9 SubCEC77_Block_3
ECDA SubCECDA
ECE0 SubCECDA_Block_4
ECE2 SubCECDA_Block_2
ECEF SubCECDA_Block
ED08 SubCECDA_Block_3
ED0F SubCED0F
ED12 SubCED12
ED2D SubCED12_Block
ED3C SubCED12_Block_4
ED44 SubCED12_Block_2
ED4B SubCED12_Block_3
ED50 SubCED50
ED6B SubCED50_Block_2
ED75 SubCED12_Block_5
ED79 SubCED50_Block
ED8E SubCED50_Block_4
ED8F SubCED50_Block_3
ED9E SubCED50_Block_6
ED9F SubCED9F_OnNonzero
EDA1 SubCED9F_Block_3
EDAE SubCED9F_Block_4
EDBD SubCED9F_Block_2
EDCD SubCED9F_Block
EDD7 SubCEDD7
EDF6 SubCEDD7_Block
EE04 SubCEDD7_Block_2
EE06 SubCEE06
EE0B SubCEDD7_Block_3
EE10 SubCEE10
EE23 SubCEE10_Block
EE25 SubCEE25
EE2A SubCEE25_Block_2
EE38 SubCEE25_Block_3
EE39 SubCEE25_Block
EE44 SubCEE44
EE4D UpdateMusicChannel16
EE5E SubCEE5E
EE6F SubCEE6F
EE75 SubCEE6F_Block
EE82 SubCEE82_OnNonzero
EE97 SubCEE97
EEA5 SubCEE97_Block
EEE1 SubCEEE1
EEED SubCEEED
EF08 SubCEEED_Block_2
EF18 SubCEF18
EF1B SubCEF1B
EF21 SubCEF21
EF5A SubCEF21_Block_2
EF7A SubCEF21_Block_3
EF80 SubCEF21_Block
EFAC SubCEF21_Block_4
EFC8 SubCEFC8
EFD6 SubCEFC8_Block
EFE9 SubCEFC8_Block_2
EFEA SubCEFEA
EFF7 SubCEFF7
F005 SubCF04B_Block
F006 SubCF006
F00C SubCEFF7_Block
F01C SubCF006_Block_2
F024 SubCF006_Block_3
F030 SubCF030
F042 SubCF030_Block
F04B SubCF04B
F051 SubCF051
F06F UpdateMusicChannel22
F07B SubCF051_Block
F08B SubCF006_Block_5
F0A9 SubCF051_Block_4
F0AE SubCF0AE
F0BC SubCF0AE_Block_2
F0BD SubCF051_Block_3
F0D3 SubCF0AE_Block_4
F0D8 SubCF0D8
F0E8 SubCF0D8_Block_2
F0E9 SubCF0AE_Block_3
F0F1 SubCF051_Block_2
F117 SubCF0D8_Block_3
F11C SubCF11C
F12A SubCF11C_Block
F12B SubCF12B
F135 SubCF135
F16E SubCF135_Block_3
F179 SubCF135_Block_2
F17A SubCF17A
F193 SubCF17A_Block_2
F196 SubCF17A_Block
F197 SubCF197
F1A6 SubCF197_Block
F1BC SubCF197_Block_3
F1D5 SubCF197_Block_4
F1DC SubCF218_Block
F1F2 SubCF197_Block_5
F1FE SubCF197_Block_6
F201 SubCF197_Block_8
F204 SubCF197_Block_7
F218 SubCF218
F221 SubCF221
F22A SubCF22A
F22E SubCF22A_Block_2
F237 SubCF22A_Block
F23D SubCF23D
F279 SubCF23D_Block_2
F298 SubCF23D_Block
F2A9 SubCF23D_Block_3
F2AA SubCF2AA
F2AC SubCF2AC
F2C3 SubCF2AC_Block_2
F2DC SubCF2AC_Block
F305 SubCF305
F30A SubCF30A
F30C SubCF30C
F31D SubCF30C_Block
F31E SubCF31E
F322 SubCF322
F324 SubCF31E_Block
F335 SubCF322_Block
F33F SubCF33F
F34C SubCF33F_Block_3
F36F SubCF33F_Block
F373 SubCF33F_Block_2
F3A1 SubCF33F_Block_5
F3A7 SubCF33F_Block_6
F3C3 SubCF33F_Block_7
F3C4 SubCF3C4
F3CF SubCF3C4_Block
F3DC SubCF3C4_Block_3
F3E0 SubCF3C4_Block_2
F3E5 SubCF3E5
F3F8 SubCF3E5_Block
F404 SubCF3E5_Block_2
F407 SubCF407
F48D SubCF48D
F499 SubCF48D_Block_3
F49F SubCF48D_Block_2
F4D2 SubCF4D2
F4E2 SubCF4D2_Block
F4F3 SubCF4F3
F50B SubCF50B
F50D SubCF50B_Block
F532 SubCF50B_Block_3
F543 SubCF50B_Block_4
FA5C SubCFA5C
FA75 SubCFA5C_Block
FA7C SubCFA5C_Block_2
FA8F SubCFA5C_Block_3
FA92 SubCFA5C_Block_4
FA95 SubCFA95
FAA7 SubCFAA7
FAA9 SubCFAA9
FAB1 SubCFAB1
FAC2 SubCFAC2
FAC4 SubCFAC4
FAC5 SubCFAC5
FACD SubCFACD
FAD3 SubCFAD3
FAD5 SubCFAD5
FAD8 SubCFAD8_Loop
FADA SubCFAF0_Block
FAEB SubCFAD8_Block
FAEC SubCFAEC
FAF0 SubCFAF0
FAF7 SubCFAF7
FAF9 SubCFAF9
FB62 SubCFB62
FB64 SubCFB62_Block_2
FB6A SubCFB62_Block
FB6B SubCFB62_Block_4
FB74 SubCFBDC_Block_3
FB83 SubCFBDC_Block_2
FB8C SubCFBDC_Block_5
FB99 SubCFBDC_Block_4
FBA6 SubCFB62_Block_5
FBB4 SubCFBDC_Block_7
FBC6 SubCFBDC_Block_6
FBDA SubCFB62_Block_3
FBDC SubCFBDC
FC1C SubCFC31_Block_10
FC1F SubCFBDC_Block_8
FC2B UpdateAPU10
FC2F SubCFC31_Block_2
FC31 SubCFC31
FC3A SubCFBDC_Block_10
FC41 SubCFBDC_Block_9
FC47 SubCFC31_Block_11
FC4B SubCFBDC_Block_12
FC52 SubCFBDC_Block_11
FC64 SubCFBDC_Block_14
FC6B SubCFBDC_Block_13
FC79 SubCFC31_Block_8
FC7F SubCFC31_Block_12
FC82 SubCFC31_Block_3
FC87 SubCFBDC_Block_16
FC8D SubCFBDC_Block_15
FCA5 SubCFD10_Block
FCAC SubCFD10_Block_2
FCC3 SubCFC31_Block_14
FCC8 SubCFC31_Block_16
FCD2 SubCFD10_Block_4
FCD9 SubCFD10_Block_3
FCEA SubCFC31_Block_19
FCF2 SubCFC31_Block_20
FCF7 SubCFC31_Block_17
FD06 SubCFC31_Block_21
FD07 SubCFD10_Block_7
FD10 SubCFD10
FD2B SubCFD10_Block_5
FD3F SubCFD10_Block_6
FD4F SubCFD10_Block_8
FD59 SubCFD10_Block_10
FD62 SubCFD10_Block_9
FD65 SubCFD10_Block_12
FD67 SubCFD10_Block_13
FD6B SubCFD6B
FD79 SubCFD6B_Block
FD7E SubCFD6B_Block_4
FD8E SubCFD6B_Block_2
FD93 SubCFD6B_Block_3
FDB7 SubCFDB7_Loop
FDC3 SubCFDB7_Block
FE07 SubCFDB7_Block_2
FE0B SubCFDB7_Block_3
FE28 SubCFDB7_Block_7
FE37 SubCFDB7_Block_10
FE3A SubCFDB7_Block_5
FE4E SubCFDB7_Block_6
FE51 SubCFE51
FE5E SubCFDB7_Block_13
FE7B SubCFE51_Block_2
FE7E SubCFDB7_Block_12
FE9C SubCFE51_Block_5
FEA3 SubCFE51_Block_6
FEA9 SubCFE51_Block_4
FFF0 IrqHandler