ddial-analysis

Diversi-Dial Analysis

There have been some attempts to unearth the way Diversi-Dial works over the decades, from the wish of financial gain and glory by offering improvements (or mods) to just being curious and having interest in the internals. Where are the handles stored? How do those password tables work anyway, and of course the ddial holy grail - the elusive 'backdoor' - fact, or fantasy?

First time here?

"Diversi-Dial" is the name of a software package for the Apple II written by Bill Basham in the mid 1980s. By purchasing phone lines, 300 baud AppleCat or Hayes compatible modems (up to 7), a II+ or IIe, and this software, a person could set up their own online interactive chat. This sounds modest compared to today's standards, but was a fairly new idea back in its day, and is a precursor to the amazing online communications network we enjoy today. I've used ddial to chat for many years, and currently run one under emulation using software I designed. As such, I've always been curious about the software. This series is about finding out what makes ddial tick.

The Process

To facilitate the reverse engineering of the code, I've built a code execution parser using Ruby. It monitors the 6502 64k address space and is focused on following code and data flows. It's vaguely aware of the specifics of the II's internals, and labels some known addresses automatically. It works by taking a trace file, output by the a2 emulator, and analyzes the code execution under operation, which gives enormous flexibility in what can be monitored. It then outputs a source-code like listing, along with comments that describe the conditions of each line. A detailed look under the hood is generated without having to stare bleary-eyed at 100k's of lines of emulator trace output. As each nugget of information is revealed, a comment is manually inserted and the master source automatically updated.

Choosing a Code Sample

I wanted to start with the purest ddial code sample I could find and go from there. I searched and found what I believe to be an unmodified 'DIAL' binary in my collection. It contains /i1 through /i9 and does not respond to the usual mods commands like /cw, /s#, /r#k, etc.

>> ddial.dsk/DIAL
Loaded. Starting from 1800 (given) and ending at 9001 (calculated / read). Size is 7801. Saving to YAML file..

I setup a disk image with no modems active in any slots, and BLOAD the DIAL binary and start it by CALL 8192 (after instructing the emulator to start the trace).

Analysis

Work In Progress

This is a work in progress. So far, so good. I'm improving the parser's abilities and using the startup trace as the test subject. I apologize for the crudity of this text output, it's not to scale (though I have now painted it!). Indexing and indirects are now mapped as well as program flow. Analyze To-do: HTML output, GTK interactive interface. Ddial To-Do: Start commenting source and marking memory locations.

Overview

We wish to observe the following about ddial:

Structure

Eventually this document will be an informative insight into the workings of 6502 ddialness, in an educational structure with emphasis on where to begin and how each piece of information was used to uncover the next. But for now, as I work equally on programming mkanalyze to extract the necessary information for a successful decompile, I will post the latest output ;)

mkanalysis Notation

Line for reference. Code Flow to follow traced program flow. JMP in purple, JSR in green, RTS in yellow, branches in blue. Arrow on left means flow is coming -from- that address, arrow on right means control is leaving -to- that address. Seen the first time the code is seen executing by the processor. Called how many times the instruction was called during trace. (Temporarily removed!) Addr address in memory of program code (continually compared against working memory to scan for self-modifying instructions). Mem the bytes in memory.

Startup code trace

Here is the code trace for Diversi-Dial startup on an Apple II+, 64k, no modems. Startup begins at line 153 ($2000), which immediately jumps to line 4 ($1800) below, initializes the 6502 stack pointer to $FF and begins a startup routine _start2 at $189A (line 63).

 Line  From    -code flow-       To  Addr  Instruction                     Seen Execd Comments
^^^^^  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^  ^^^^  ^^^^^^^^^^^                     ^^^^ ^^^^^ ^^^^^^^^
    1                              *
    2                              * ddial really starts here
    3                              _setup1
    4  ,-2000                        1800  LDX #$FF                           2     1 ; set stack pointer 
    5                                1802  TXS                                3     1            
    6                        189A,-  1803  JSR _setup2                        4     1            
    7  ,-195B                        1806  LDX #$02                         281     1            
    8  ,-1813                        1808  LDA $5EFD,X                      282     3            ; idx=0-2
    9                                180B  AND #$0F                         283     3            
   10                                180D  ORA #$30                         284     3            
   11                                180F  STA $223E,X                      285     3            ; idx=0-2
   12                                1812  DEX                              286     3            
   13                        1808'-  1813  BPL $1808                        287     3            ; branch 2/3 (66%) times
   14                                1815  LDA $603D                        288     1            
   15                                1818  STA $00                          289     1            
   16                                181A  LDA $603E                        290     1            
   17                                181D  STA $01                          291     1            
   18                                181F  LDY #$00                         292     1            
   19  ,-182B ,-182F                 1821  LDA ($00),Y                      293   520            ; idx=0 (indirect 79e5-7bec)
   20                        1831,-  1823  BMI $1831                        294   520            ; branch never
   21                                1825  CMP #$5E                         295   520            
   22                        1831,-  1827  BEQ $1831                        296   520            ; branch 1/520 (0%) time
   23                                1829  INC $00                          297   519            
   24                        1821'-  182B  BNE $1821                        298   519            ; branch 517/519 (99%) times
   25                                182D  INC $01                          299     2            
   26                        1821'-  182F  BNE $1821                        300     2            ; branch 2/2 (100%) times
   27  '-1827 '-1823                 1831  LDA $00                          301     1            
   28                                1833  STA $609B                        302     1            
   29                                1836  LDA $01                          303     1            
   30                                1838  STA $609C                        304     1            
   31                                183B  LDY #$00                         305     1            
   32  ,-184E ,-1846                 183D  LDA $1A00,Y                      306  1517            ; idx=0-ff
   33                        1850,-  1840  BEQ $1850                        307  1517            ; branch 1/1517 (0%) time
   34                                1842  STA $E400,Y                      308  1516            ; idx=0-ff
   35                                1845  INY                              309  1516            
   36                        183D'-  1846  BNE $183D                        310  1516            ; branch 1511/1516 (99%) times
   37                                1848  INC $183F                        311     5            
   38                                184B  INC $1844                        312     5            
   39                        183D'-  184E  BNE $183D                        313     5            ; branch 5/5 (100%) times
   40  '-1840                28B1,-  1850  JMP $28B1                        314     1            
   41                              *
   42                              * -- mkanalyze detects subroutine here -- called from 50DC 
   43  ,-50DC                        1853  LSR $F2                          559   159            
   44                                1855  BIT $D0                          560   159            
   45                        185E,-  1857  BMI $185E                        561   159            ; branch 2/159 (1%) times
   46                        185D,-  1859  BVS $185D                        562   157            ; branch 157/157 (100%) times
   47  ,-1860                        185B  LDY #$8D                         644     1            
   48  '-1859                50DF,-  185D  RTS                              563   158            
   49  '-1857                        185E  BIT $48                          642     2            
   50                        185B'-  1860  BVS $185B                        643     2            ; branch 1/2 (50%) time
   51                                1862  LDA $9001                        788     1            
   52                        1877,-  1865  BEQ $1877                        789     1            ; branch 1/1 (100%) time
   53  '-1865                        1877  LDY #$03                         790     1            
   54  ,-1880                        1879  LDA $1896,Y                      791     3            ; idx=1-3
   55                                187C  STA $50DB,Y                      792     3            ; idx=1-3
   56                                187F  DEY                              793     3            
   57                        1879'-  1880  BNE $1879                        794     3            ; branch 2/3 (66%) times
   58                                1882  DEY                              795     1            
   59                                1883  STY $FEFF                        796     1            
   60                        50DF,-  1886  RTS                              797     1            
   61                              *
   62                              * -- mkanalyze detects subroutine here -- called from 1803 
   63                              *
   64                              * some setup here?
   65                              _setup2
   66  '-1803                        189A  SEI                                5     1            
   67                                189B  LDX #$27                           6     1 ; clear console status area  (top 2 lines) 
   68                                189D  LDA #$A0                           7     1            
   69                              _setup2_clear_loop
   70  ,-18A6                        189F  STA cons_line1/cutofftime,X        8    40            ; idx=0-27
   71                                18A2  STA cons_line2/line0channel,X      9    40            ; idx=0-27
   72                                18A5  DEX                               10    40            
   73                        189F'-  18A6  BPL _setup2_clear_loop            11    40            ; branch 39/40 (97%) times
   74                                18A8  LDA #$0F                          12     1            
   75                                18AA  CMP $08                           13     1            
   76                                18AC  STA $08                           14     1            
   77                        18B5,-  18AE  BNE $18B5                         15     1            ; branch 1/1 (100%) time
   78  '-18AE                        18B5  INC $03F4                         16     1            
   79                        8000,-  18B8  JSR _setup3                       17     1 ; -- various memory checks and copies 
   80  ,-8095                        18BB  LDA _and_rts                     123     1 ; load debugging jsr code byte 
   81                                18BE  CMP #$60                         124     1 ; compare against RTS 
   82                        18C7,-  18C0  BEQ _setup_4                     125     1 ; always branch this version (that should be interesting code) ; branch 1/1 (100%) time
   83                              _setup_4
   84  '-18C0                        18C7  LDX #$07                         126     1 ; loop 7-0 and initialize modems (guess) 
   85  ,-18CD                6008,-  18C9  JSR _setup_5                     127     8            
   86  ,-6154                        18CC  DEX                              216     8            
   87                        18C9'-  18CD  BPL $18C9                        217     8            ; branch 7/8 (87%) times
   88                                18CF  LDX #$07                         218     1            
   89                        18DB,-  18D1  BNE $18DB                        219     1            ; branch 1/1 (100%) time
   90  ,-18E1 '-18D1                 18DB  LDA $18D3,X                      220     8            ; idx=0-7
   91                                18DE  STA $C0,X                        221     8            ; idx=0-7
   92                                18E0  DEX                              222     8            
   93                        18DB'-  18E1  BPL $18DB                        223     8            ; branch 7/8 (87%) times
   94                                18E3  LDA #$B1                         224     1            
   95                                18E5  STA $FD                          225     1            
   96                                18E7  STA cons_line2/line0channel      226     1            
   97                                18EA  LDX #$06                         227     1            
   98                                18EC  STX $E4                          228     1            
   99                                18EE  LDA #$00                         229     1            
  100                                18F0  STA $E6                          230     1            
  101                                18F2  STA $E3                          231     1            
  102                                18F4  STA $E7                          232     1            
  103                                18F6  STA cons_x_save                  233     1            
  104                                18F8  STA $F1                          234     1            
  105                                18FA  LDY $9001                        235     1            
  106                                18FD  CPY #$0D                         236     1            
  107                        1904,-  18FF  BEQ $1904                        237     1            ; branch never
  108                                1901  STA $9001                        238     1            
  109  ,-1908 '-18FF                 1904  STA ($C0,X)                      239     4            ; idx=0 2 4 6 (indirect 8000 9000 a000 b000)
  110                                1906  DEX                              240     4            
  111                                1907  DEX                              241     4            
  112                        1904'-  1908  BPL $1904                        242     4            ; branch 3/4 (75%) times
  113                                190A  LDX #$02                         243     1            
  114                                190C  LDA #$B0                         244     1            
  115  ,-1912                        190E  STA cons_callstoday1,X           245     3            ; idx=0-2
  116                                1911  DEX                              246     3            
  117                        190E'-  1912  BPL $190E                        247     3            ; branch 2/3 (66%) times
  118                                1914  LDA #$33                         248     1            
  119                                1916  STA cons_line1/cutofftime        249     1            
  120                                1919  LDY #$13                         250     1            
  121  ,-1924                        191B  LDA $23B5,Y                      251    20            ; idx=0-13
  122                                191E  ORA #$80                         252    20            
  123                                1920  STA cons_line2col21,Y            253    20            ; idx=0-13
  124                                1923  DEY                              254    20            
  125                        191B'-  1924  BPL $191B                        255    20            ; branch 19/20 (95%) times
  126                                1926  LDY #$3F                         256     1            
  127                                1928  LDA #$00                         257     1            
  128  ,-192E                        192A  STA $0100,Y                      258    64            ; idx=0-3f
  129                                192D  DEY                              259    64            
  130                        192A'-  192E  BPL $192A                        260    64            ; branch 63/64 (98%) times
  131                                1930  LDA #$D0                         261     1            
  132                                1932  STA $04                          262     1            
  133  ,-1948                        1934  LDY #$00                         263    35            
  134                                1936  STY $03                          264    35            
  135  ,-1940                        1938  LDA $24DB,Y                      265   420            ; idx=0-b
  136                                193B  STA ($03),Y                      266   420            ; idx=0-b (indirect d000-d00b d100-d10b d200-d20b d300-d30b d400-d40b d500-d50b d600-d60b d700-d70b d800-d80b d900-d90b da00-da0b db00-db0b dc00-dc0b dd00-dd0b de00-de0b df00-df0b e000-e00b e100-e10b e200-e20b e300-e30b e400-e40b e500-e50b e600-e60b e700-e70b e800-e80b e900-e90b ea00-ea0b eb00-eb0b ec00-ec0b ed00-ed0b ee00-ee0b ef00-ef0b f000-f00b f100-f10b f200-f20b)
  137                        1942,-  193D  BMI $1942                        267   420            ; branch 35/420 (8%) times
  138                                193F  INY                              268   385            
  139                        1938'-  1940  BNE $1938                        269   385            ; branch 385/385 (100%) times
  140  '-193D                        1942  INC $04                          270    35            
  141                                1944  LDA $04                          271    35            
  142                                1946  CMP #$F3                         272    35            
  143                        1934'-  1948  BCC $1934                        273    35            ; branch 34/35 (97%) times
  144                                194A  LDA $580C                        274     1            
  145                                194D  STA $6051                        275     1            
  146                                1950  LDA $580D                        276     1            
  147                                1953  STA $6052                        277     1            
  148                                1956  LDA #$34                         278     1            
  149                                1958  STA cons_moecutoff               279     1            
  150                        1806'-  195B  RTS                              280     1            
  151                              *
  152                              * start of ddial!! woo hoo!!
  153                              start
  154                        1800'-  2000  JMP _setup1                        1     1            
  155                              *
  156                              * -- mkanalyze detects subroutine here -- called from 38EF 
  157  ,-38EF                        263C  LDA #$FE                         486    35            
  158                                263E  STA $30                          487    35            
  159                                2640  LDX $7EDC                        488    35            
  160                        267A,-  2643  BEQ $267A                        489    35            ; branch 35/35 (100%) times
  161  '-2643                38F2,-  267A  RTS                              490    35            
  162  ,-39A6 '-1850         7FD3,-  28B1  JSR $7FD3                        315   665            
  163  ,-64A6                        28B4  LDA $F2                          332   665            
  164                        28BB,-  28B6  BEQ $28BB                        333   665            ; branch 186/665 (27%) times
  165                        2A1D,-  28B8  JMP $2A1D                        810   479            
  166  '-28B6                        28BB  INC $F2                          334   186            
  167                                28BD  LDA $A0                          335   186            
  168                        290B,-  28BF  BEQ $290B                        336   186            ; branch 186/186 (100%) times
  169  ,-2912                2A1D,-  2908  JMP $2A1D                        787    28            
  170  ,-298E '-28BF                 290B  LDY $2005                        337   187            
  171                        291D,-  290E  BNE $291D                        338   187            ; branch 159/187 (85%) times
  172                                2910  LDA $80                          785    28            
  173                        2908'-  2912  BEQ $2908                        786    28            ; branch 28/28 (100%) times
  174  '-290E                2922,-  291D  BMI $2922                        339   159            ; branch 2/159 (1%) times
  175                        299A,-  291F  JMP $299A                        340   157            
  176  '-291D                        2922  CPY #$8D                         620     2            
  177                        291A'-  2924  BEQ $291A                        621     2            ; branch never
  178                                2926  LDA $10                          622     2            
  179                        2968,-  2928  BNE $2968                        623     2            ; branch never
  180                                292A  ASL $58                          624     2            
  181                                292C  LDA $7F38                        625     2            
  182                                292F  STA $7F70                        626     2            
  183                                2932  CPY #$88                         627     2            
  184                        2940,-  2934  BEQ $2940                        628     2            ; branch never
  185                        2949,-  2936  BCS $2949                        629     2            ; branch 2/2 (100%) times
  186  '-2936                        2949  CPY #$89                         630     2            
  187                        2972,-  294B  BNE $2972                        631     2            ; branch 1/2 (50%) time
  188                                294D  LDY #$00                         632     1            
  189                                294F  STY $88                          633     1            
  190                                2951  STY $D8                          634     1            
  191                                2953  LDA $7F88                        635     1            
  192                        295D,-  2956  BEQ $295D                        636     1            ; branch 1/1 (100%) time
  193  '-2956                        295D  STY $80                          637     1            
  194                                295F  LDA #$EC                         638     1            
  195                                2961  STA $38                          639     1            
  196                                2963  STA $D0                          640     1            
  197                        2A02,-  2965  JMP $2A02                        641     1            
  198  '-294B                        2972  CPY #$A0                         774     1            
  199                        293C'-  2974  BEQ $293C                        775     1            ; branch never
  200                                2976  CPY #$A9                         776     1            
  201                        2940'-  2978  BCC $2940                        777     1            ; branch never
  202                                297A  STY $D0                          778     1            
  203                                297C  LDA $70                          779     1            
  204                                297E  LDY $78                          780     1            
  205                        2988,-  2980  BNE $2988                        781     1            ; branch 1/1 (100%) time
  206  '-2980                        2988  STA $290C                        782     1            
  207                                298B  STY $290D                        783     1            
  208                        290B'-  298E  JMP $290B                        784     1            
  209  '-291F                        299A  BIT $58                          341   157            
  210                        2A02,-  299C  BMI $2A02                        342   157            ; branch never
  211                                299E  LDA #$20                         343   157            
  212                                29A0  CMP #$20                         344   157            
  213                                29A2  STA $29A1                        345   157            
  214                        29F2,-  29A5  BNE $29F2                        346   157            ; branch never
  215                                29A7  LDA $F300,Y                      347   157            ; idx=7 d 10 20 23 28-29 2d 2f-30 34 3a 3c 3e 41 43-46 49 4c 4f-50 52-54 57 61 63-66 69 6c-70 72-76 79
  216                        2A02,-  29AA  BMI $2A02                        348   157            ; branch 2/157 (1%) times
  217                                29AC  CMP #$7D                         349   155            
  218                        29BB,-  29AE  BCC $29BB                        350   155            ; branch 155/155 (100%) times
  219  '-29AE                        29BB  CMP $7F58                        351   155            
  220                        29D0,-  29BE  BEQ $29D0                        352   155            ; branch never
  221                                29C0  CMP #$20                         353   155            
  222                        29DE,-  29C2  BEQ $29DE                        354   155            ; branch 17/155 (10%) times
  223                        29FA,-  29C4  BCS $29FA                        355   138            ; branch 123/138 (89%) times
  224                                29C6  CMP #$0D                         356    15            
  225                        29D5,-  29C8  BEQ $29D5                        357    15            ; branch 14/15 (93%) times
  226                                29CA  BIT $E8                          617     1            
  227                        29FE,-  29CC  BPL $29FE                        618     1            ; branch never
  228                        2A02,-  29CE  BMI $2A02                        619     1            ; branch 1/1 (100%) time
  229  '-29C8                        29D5  LDY $B8                          358    14            
  230                                29D7  STY $A8                          359    14            
  231                                29D9  STA $60                          360    14            
  232                        29FE,-  29DB  JMP $29FE                        361    14            
  233  '-29C2                        29DE  LDA $A8                          605    17            
  234                                29E0  SBC #$0A                         606    17            
  235                        29F8,-  29E2  BCS $29F8                        607    17            ; branch 17/17 (100%) times
  236  '-29E2                        29F8  LDA #$20                         608    17            
  237  '-29C4                        29FA  DEC $A8                          585   140            
  238                        29E8'-  29FC  BEQ $29E8                        586   140            ; branch never
  239  '-29DB '-29CC         6002,-  29FE  JSR $6002                        362   154            
  240  ,-7D87                        2A01  BIT $F246                        437   154            
  241  '-2965 '-29AA '-299C '-29CE   2A02  LSR $F2                          616     4            
  242                                2A04  INC $290C                        438   158            
  243                        2A1D,-  2A07  BNE $2A1D                        439   158            ; branch 157/158 (99%) times
  244                                2A09  INC $290D                        770     1            
  245                                2A0C  LDA $290D                        771     1            
  246                                2A0F  BIT $08                          772     1            
  247                        2A1D,-  2A11  BNE $2A1D                        773     1            ; branch 1/1 (100%) time
  248                                2A1D  JSR _and_rts                     440   665            
  249  F822,-
  250  ,-F822                        2A20  LDA $7FE1                        441   665            
  251                                2A23  BIT $91                          442   665            
  252                        2A58,-  2A25  BMI $2A58                        443   665            ; branch never
  253                        2A4F,-  2A27  BVS $2A4F                        444   665            ; branch 665/665 (100%) times
  254  '-2A27                2C3A,-  2A4F  JMP $2C3A                        445   665            
  255  '-2A4F                F822,-  2C3A  JSR _and_rts                     446   665            
  256  ,-F822                        2C3D  LDA $7FE2                        447   665            
  257                                2C40  BIT $92                          448   665            
  258                        2C75,-  2C42  BMI $2C75                        449   665            ; branch never
  259                        2C6C,-  2C44  BVS $2C6C                        450   665            ; branch 665/665 (100%) times
  260  '-2C44                2E57,-  2C6C  JMP $2E57                        451   665            
  261  '-2C6C                F822,-  2E57  JSR _and_rts                     452   665            
  262  ,-F822                        2E5A  LDA $7FE3                        453   665            
  263                                2E5D  BIT $93                          454   665            
  264                        2E92,-  2E5F  BMI $2E92                        455   665            ; branch never
  265                        2E89,-  2E61  BVS $2E89                        456   665            ; branch 665/665 (100%) times
  266  '-2E61                3074,-  2E89  JMP $3074                        457   665            
  267  '-2E89                F822,-  3074  JSR _and_rts                     458   665            
  268  ,-F822                        3077  LDA $7FE4                        459   665            
  269                                307A  BIT $94                          460   665            
  270                        30AF,-  307C  BMI $30AF                        461   665            ; branch never
  271                        30A6,-  307E  BVS $30A6                        462   665            ; branch 665/665 (100%) times
  272  '-307E                3291,-  30A6  JMP $3291                        463   665            
  273  '-30A6                F822,-  3291  JSR _and_rts                     464   665            
  274  ,-F822                        3294  LDA $7FE5                        465   665            
  275                                3297  BIT $95                          466   665            
  276                        32CC,-  3299  BMI $32CC                        467   665            ; branch never
  277                        32C3,-  329B  BVS $32C3                        468   665            ; branch 665/665 (100%) times
  278  '-329B                34AE,-  32C3  JMP $34AE                        469   665            
  279  '-32C3                F822,-  34AE  JSR _and_rts                     470   665            
  280  ,-F822                        34B1  LDA $7FE6                        471   665            
  281                                34B4  BIT $96                          472   665            
  282                        34E9,-  34B6  BMI $34E9                        473   665            ; branch never
  283                        34E0,-  34B8  BVS $34E0                        474   665            ; branch 665/665 (100%) times
  284  '-34B8                36CB,-  34E0  JMP $36CB                        475   665            
  285  '-34E0                F822,-  36CB  JSR _and_rts                     476   665            
  286  ,-F822                        36CE  LDA $7FE7                        477   665            
  287                                36D1  BIT $97                          478   665            
  288                        3706,-  36D3  BMI $3706                        479   665            ; branch never
  289                        36FD,-  36D5  BVS $36FD                        480   665            ; branch 665/665 (100%) times
  290  '-36D5                38E8,-  36FD  JMP $38E8                        481   665            
  291  '-36FD                F822,-  38E8  JSR _and_rts                     482   665            
  292  ,-F822                        38EB  LDA $30                          483   665            
  293                        38F2,-  38ED  BMI $38F2                        484   665            ; branch 630/665 (94%) times
  294                        263C'-  38EF  JSR $263C                        485    35            
  295  '-267A '-38ED                 38F2  LDA $28                          491   665            
  296                        3906,-  38F4  BMI $3906                        492   665            ; branch 663/665 (99%) times
  297                                38F6  LDA $F4                          493     2            
  298                        38FF,-  38F8  BNE $38FF                        494     2            ; branch never
  299                                38FA  LDA #$A0                         495     2            
  300                                38FC  STA $04A5                        496     2            
  301  '-38F8                        38FF  LDA #$84                         497     2            
  302                                3901  STA $28                          498     2            
  303                        520C,-  3903  JSR $520C                        499     2            
  304  ,-5311 '-38F4         7FD3,-  3906  JSR $7FD3                        533   665            
  305  ,-64A6                475A,-  3909  JSR $475A                        534   665            
  306  ,-520B                F822,-  390C  JSR _and_rts                     567   664            
  307  ,-F822                        390F  LDA #$FF                         568   664            
  308                        3916,-  3911  BMI $3916                        569   664            ; branch 664/664 (100%) times
  309  '-3911                        3916  LDA $FD                          570   664            
  310                                3918  STA $3910                        571   664            
  311                        3920,-  391B  BMI $3920                        572   664            ; branch 664/664 (100%) times
  312  '-391B                        3920  LDX $E2                          573   664            
  313                                3922  STA $E2                          574   664            
  314                        3929,-  3924  BPL $3929                        575   664            ; branch 16/664 (2%) times
  315                        F803,-  3926  JSR $F803                        599   648            
  316  ,-FABF '-3924                 3929  LDX $05                          576   664            
  317                        3966,-  392B  BMI $3966                        577   664            ; branch 664/664 (100%) times
  318  '-392B                        3966  LDA $F4                          578   664            
  319                                3968  CMP #$01                         579   664            
  320                        3980,-  396A  BCC $3980                        580   664            ; branch 664/664 (100%) times
  321  '-396A                        3980  BIT $28B1                        581   664            
  322                                3983  DEC $39AA                        582   664            
  323                        39A6,-  3986  BNE $39A6                        583   664            ; branch 630/664 (94%) times
  324                                3988  LDA #$00                         609    34            
  325                                398A  STA $F2                          610    34            
  326                                398C  STA $30                          611    34            
  327                                398E  LDA $5312                        612    34            
  328                                3991  STA $39AA                        613    34            
  329                                3994  DEC $39A9                        614    34            
  330                        39A6,-  3997  BNE $39A6                        615    34            ; branch 33/34 (97%) times
  331                                3999  LDA #$1E                         811     1            
  332                                399B  STA $39A9                        812     1            
  333                        39A4,-  399E  BCC $39A4                        813     1            ; branch 1/1 (100%) time
  334  '-399E                        39A4  STA $28                          814     1            
  335  '-3986 '-3997         28B1'-  39A6  JMP $28B1                        584   664            
  336                              *
  337                              * -- mkanalyze detects subroutine here -- called from 3909 
  338  '-3909                        475A  LDY $7FF9                        535   665            
  339                        4765,-  475D  BMI $4765                        536   665            ; branch never
  340                        48B5,-  475F  JMP $48B5                        537   665            
  341  '-475F                        48B5  LDY $7FFA                        538   665            
  342                        48C0,-  48B8  BMI $48C0                        539   665            ; branch never
  343                        4A10,-  48BA  JMP $4A10                        540   665            
  344  '-48BA                        4A10  LDY $7FFB                        541   665            
  345                        4A1B,-  4A13  BMI $4A1B                        542   665            ; branch never
  346                        4B6B,-  4A15  JMP $4B6B                        543   665            
  347  '-4A15                        4B6B  LDY $7FFC                        544   665            
  348                        4B76,-  4B6E  BMI $4B76                        545   665            ; branch never
  349                        4CC6,-  4B70  JMP $4CC6                        546   665            
  350  '-4B70                        4CC6  LDY $7FFD                        547   665            
  351                        4CD1,-  4CC9  BMI $4CD1                        548   665            ; branch never
  352                        4E21,-  4CCB  JMP $4E21                        549   665            
  353  '-4CCB                        4E21  LDY $7FFE                        550   665            
  354                        4E2C,-  4E24  BMI $4E2C                        551   665            ; branch never
  355                        4F7C,-  4E26  JMP $4F7C                        552   665            
  356  '-4E26                        4F7C  LDY $7FFF                        553   665            
  357                        4F87,-  4F7F  BMI $4F87                        554   665            ; branch never
  358                        50D7,-  4F81  JMP $50D7                        555   665            
  359  '-4F81                        50D7  LDA #$00                         556   664            
  360                                50D9  STA $57FF                        557   664            
  361                        1853'-  50DC  LDY $7FF8                        558   664            
  362  '-185D '-1886         50E7,-  50DF  BMI $50E7                        564   664            ; branch 2/664 (0%) times
  363                        520B,-  50E1  JMP $520B                        565   662            
  364  '-50DF                        50E7  LSR $7FF8                        645     2            
  365                                50EA  LSR $E2                          646     2            
  366                        F822,-  50EC  JSR _and_rts                     647     2            
  367  ,-F822                        50EF  BIT $D0                          648     2            
  368                        5110,-  50F1  BMI $5110                        649     2            ; branch 2/2 (100%) times
  369  '-50F1                        5110  LDA $F300,Y                      650     2            ; idx=8d ff
  370                        5163,-  5113  BMI $5163                        651     2            ; branch never
  371                                5115  LDY $80                          652     2            
  372                                5117  CMP #$7D                         653     2            
  373                        510D'-  5119  BCS $510D                        654     2            ; branch never
  374                                511B  CPY #$00                         655     2            
  375                        512B,-  511D  BNE $512B                        656     2            ; branch never
  376                                511F  CMP #$2F                         657     2            
  377                        5126,-  5121  BNE $5126                        658     2            ; branch 2/2 (100%) times
  378  '-5121                        5126  LDY $7F90                        659     2            
  379                                5129  STY $80                          660     2            
  380  '-511D                        512B  STA $0800,Y                      661     2            ; idx=0
  381                                512E  CMP #$0D                         662     2            
  382                        516C,-  5130  BEQ $516C                        663     2            ; branch 1/2 (50%) time
  383                                5132  CPY $7EE8                        798     1            
  384                        513D,-  5135  BCC $513D                        799     1            ; branch 1/1 (100%) time
  385  '-5135                        513D  INC $80                          800     1            
  386                                513F  CMP #$08                         801     1            
  387                        510D'-  5141  BNE $510D                        802     1            ; branch never
  388                                5143  TYA                              803     1            
  389                        514B,-  5144  BNE $514B                        804     1            ; branch never
  390                                5146  LDA $38                          805     1            
  391                        516C,-  5148  BPL $516C                        806     1            ; branch 1/1 (100%) time
  392  '-5130 '-5148                 516C  LDA $88                          664     2            
  393                        517D,-  516E  BEQ $517D                        665     2            ; branch 2/2 (100%) times
  394  '-516E                        517D  LDA #$00                         666     2            
  395                                517F  INY                              667     2            
  396                                5180  STA $0800,Y                      668     2            ; idx=1
  397                                5183  STA $A0                          669     2            
  398                                5185  STA $80                          670     2            
  399                                5187  STA $88                          671     2            
  400                                5189  STA $D8                          672     2            
  401                                518B  BIT $38                          673     2            
  402                        51AA,-  518D  BPL $51AA                        674     2            ; branch 1/2 (50%) time
  403                                518F  LDA #$00                         675     1            
  404                        5800,-  5191  JSR $5800                        676     1            
  405  ,-5E30                        5194  STA $290C                        718     1            
  406                                5197  STX $290D                        719     1            
  407                                519A  LDY #$00                         720     1            
  408                        5506,-  519C  JSR $5506                        721     1            
  409  ,-55D1                        519F  STX $0100                        768     1            
  410                        520B,-  51A2  JMP $520B                        769     1            
  411  '-518D                        51AA  DEY                              807     1            
  412                        5208,-  51AB  BEQ $5208                        808     1            ; branch 1/1 (100%) time
  413  '-51AB                        5208  STA $51AE                        809     1            
  414  '-50E1 '-51A2         390C'-  520B  RTS                              566   664            
  415                              *
  416                              * -- mkanalyze detects subroutine here -- called from 3903 
  417  '-3903                        520C  LDX $FF                          500     2            
  418                        5227,-  520E  BEQ $5227                        501     2            ; branch 2/2 (100%) times
  419  '-520E                        5227  LDA $E6                          502     2            
  420                                5229  AND #$07                         503     2            
  421                        5244,-  522B  BEQ $5244                        504     2            ; branch 2/2 (100%) times
  422  '-522B                        5244  LDX #$07                         505     2            
  423  ,-5291                        5246  LDA $A0,X                        506    16            ; idx=0-7
  424                        5256,-  5248  BEQ $5256                        507    16            ; branch 16/16 (100%) times
  425  '-5248                        5256  STA $FF35,X                      508    16            ; idx=0-7
  426                                5259  TXA                              509    16            
  427                        5293,-  525A  BEQ clock_secondtick             510    16            ; branch 2/16 (12%) times
  428                                525C  LDA $B8,X                        511    14            ; idx=1-7
  429                                525E  ORA $38,X                        512    14            ; idx=1-7
  430                        526A,-  5260  BMI $526A                        513    14            ; branch never
  431                                5262  LDA $7F30,X                      514    14            ; idx=1-7
  432                                5265  ORA $7F28,X                      515    14            ; idx=1-7
  433                        528C,-  5268  BMI $528C                        516    14            ; branch never
  434  '-5260                        526A  LDY $B0,X                        517    14            ; idx=1-7
  435                                526C  LDA $7EF8,Y                      518    14            ; idx=0
  436                                526F  STA $7F28,X                      519    14            ; idx=1-7
  437                                5272  LDA $7EF9,Y                      520    14            ; idx=0
  438                                5275  STA $7F30,X                      521    14            ; idx=1-7
  439                                5278  ASL $C8,X                        522    14            ; idx=1-7
  440                        528C,-  527A  BCS $528C                        523    14            ; branch never
  441                                527C  LDA $38,X                        524    14            ; idx=1-7
  442                        5290,-  527E  BEQ $5290                        525    14            ; branch 14/14 (100%) times
  443  '-527E                        5290  DEX                              526    14            
  444                        5246'-  5291  BPL $5246                        527    14            ; branch 14/14 (100%) times
  445                              *
  446                              * --- second clock tick
  447                              clock_secondtick
  448  '-525A                        5293  INC cons_seconds2                528     2 ; increment 2nd seconds digit 
  449                                5296  LDA cons_seconds2                529     2            
  450                                5299  CMP #$BA                         530     2 ; 2nd seconds digit > 9? 
  451                        5311,-  529B  BNE clock_done                   531     2 ; branch if not ; branch 2/2 (100%) times
  452                              clock_done
  453  '-529B                3906'-  5311  RTS                              532     2            
  454                              *
  455                              * -- mkanalyze detects subroutine here -- called from 519C 
  456  '-519C                        5506  LDA $0038,Y                      722     1            ; idx=0
  457                        5510,-  5509  BEQ $5510                        723     1            ; branch 1/1 (100%) time
  458  '-5509                        5510  STA $7FB8,Y                      724     1            ; idx=0
  459                                5513  LDA #$FF                         725     1            
  460                                5515  STA $FF3D,Y                      726     1            ; idx=0
  461                                5518  STA $0018,Y                      727     1            ; idx=0
  462                                551B  TYA                              728     1            
  463                        5565,-  551C  BEQ $5565                        729     1            ; branch 1/1 (100%) time
  464  '-551C                        5565  TYA                              730     1            
  465                        5572,-  5566  BEQ $5572                        731     1            ; branch 1/1 (100%) time
  466  '-5566                        5572  TAX                              732     1            
  467                                5573  BIT $F7DC                        733     1            
  468                        5589,-  5576  BMI $5589                        734     1            ; branch never
  469                        558E,-  5578  BVC $558E                        735     1            ; branch 1/1 (100%) time
  470  '-5578                        558E  LDA $F7E6                        736     1            
  471                                5591  STA $00                          737     1            
  472                                5593  LDA $7FA0,X                      738     1            ; idx=0
  473                                5596  CMP $7FA1,X                      739     1            ; idx=0
  474                        559D,-  5599  BCC $559D                        740     1            ; branch 1/1 (100%) time
  475  '-5599                        559D  LDA $C0,X                        741     1            ; idx=0
  476                                559F  STA $0070,Y                      742     1            ; idx=0
  477                                55A2  LDA $C1,X                        743     1            ; idx=0
  478                                55A4  STA $0078,Y                      744     1            ; idx=0
  479                                55A7  INC $7FA0,X                      745     1            ; idx=0
  480                                55AA  TXA                              746     1            
  481                                55AB  STA $00B0,Y                      747     1            ; idx=0
  482                                55AE  LSR A                            748     1            
  483                                55AF  ADC #$B1                         749     1            
  484                                55B1  STA cons_line2/line0channel,Y    750     1            ; idx=0
  485                                55B4  AND #$7F                         751     1            
  486                                55B6  PHA                              752     1            
  487                                55B7  LDA $7F80,Y                      753     1            ; idx=0
  488                                55BA  ASL A                            754     1            
  489                                55BB  TAX                              755     1            
  490                                55BC  PLA                              756     1            
  491                                55BD  STA $0205,X                      757     1            ; idx=0
  492                                55C0  LDA $0050,Y                      758     1            ; idx=0
  493                        55CA,-  55C3  BEQ $55CA                        759     1            ; branch 1/1 (100%) time
  494  '-55C3                        55CA  TAX                              760     1            
  495                                55CB  SEC                              761     1            
  496                        55D2,-  55CC  JSR $55D2                        762     1            
  497  ,-55D1                        55CF  LDX $00                          767     1            
  498  ,-55D6         55CF'- 519F'-  55D1  RTS                              766     2            
  499                              *
  500                              * -- mkanalyze detects subroutine here -- called from 55CC 
  501  '-55CC                        55D2  TYA                              763     1            
  502                                55D3  AND $FEFF                        764     1            
  503                        55D1'-  55D6  BEQ $55D1                        765     1            ; branch 1/1 (100%) time
  504                              *
  505                              * -- mkanalyze detects subroutine here -- called from 5191 
  506  '-5191                5C34,-  5800  JMP $5C34                        677     1            
  507  '-5800                        5C34  PHA                              678     1            
  508                                5C35  TAX                              679     1            
  509                        5CA1,-  5C36  BEQ $5CA1                        680     1            ; branch 1/1 (100%) time
  510  '-5C36                        5CA1  LDA #$04                         681     1            
  511                                5CA3  STA $5DEB                        682     1            
  512                        5DC9,-  5CA6  JMP $5DC9                        683     1            
  513  '-5CA6                        5DC9  PLA                              684     1            
  514                                5DCA  TAX                              685     1            
  515                                5DCB  LDA #$00                         686     1            
  516                                5DCD  STA $FF03,X                      687     1            ; idx=0
  517                                5DD0  LDA cons_moecutoff               688     1            
  518                                5DD3  CMP #$A0                         689     1            
  519                        5DDD,-  5DD5  BNE $5DDD                        690     1            ; branch 1/1 (100%) time
  520  '-5DD5                        5DDD  LDA #$00                         691     1            
  521                                5DDF  BIT $F7E0                        692     1            
  522                        5DE8,-  5DE2  BMI $5DE8                        693     1            ; branch never
  523                                5DE4  CMP #$70                         694     1            
  524                                5DE6  ADC #$00                         695     1            
  525  '-5DE2                        5DE8  STA $50,X                        696     1            ; idx=0
  526                                5DEA  LDY #$04                         697     1            
  527                                5DEC  CMP #$00                         698     1            
  528                        5DF2,-  5DEE  BEQ $5DF2                        699     1            ; branch 1/1 (100%) time
  529  '-5DEE                        5DF2  LDA #$40                         700     1            
  530                                5DF4  STA $D0,X                        701     1            ; idx=0
  531                                5DF6  STA $98,X                        702     1            ; idx=0
  532                                5DF8  LDA #$FF                         703     1            
  533                                5DFA  ORA $7F88,X                      704     1            ; idx=0
  534                                5DFD  ORA #$00                         705     1            
  535                        5E18,-  5DFF  BNE $5E18                        706     1            ; branch 1/1 (100%) time
  536  '-5DFF                        5E18  LDA #$00                         707     1            
  537                                5E1A  CMP $7F88,X                      708     1            ; idx=0
  538                        5E20,-  5E1D  BEQ $5E20                        709     1            ; branch 1/1 (100%) time
  539  '-5E1D                        5E20  STA $38,X                        710     1            ; idx=0
  540                                5E22  STA $48,X                        711     1            ; idx=0
  541                                5E24  LDA #$FF                         712     1            
  542                                5E26  STA $98,X                        713     1            ; idx=0
  543                                5E28  LDA $5A00,Y                      714     1            ; idx=4
  544                                5E2B  LDX $5A01,Y                      715     1            ; idx=4
  545                                5E2E  LDY #$00                         716     1            
  546                        5194'-  5E30  RTS                              717     1            
  547                              *
  548                              * -- mkanalyze detects subroutine here -- called from 29FE 
  549  '-29FE                7D55,-  6002  JMP $7D55                        363   154            
  550                              *
  551                              * -- mkanalyze detects subroutine here -- called from 18C9 
  552                              _setup_5
  553  '-18C9                60AA,-  6008  JMP _setup_5_2                   128     8            
  554                              _setup_5_2
  555  '-6008                        60AA  LDA #$40                         129     8            
  556                                60AC  STA $90,X                        130     8            ; idx=0-7
  557                                60AE  STA $D0,X                        131     8            ; idx=0-7
  558                                60B0  STA $48,X                        132     8            ; idx=0-7
  559                                60B2  TXA                              133     8            
  560                                60B3  ORA #$30                         134     8            
  561                                60B5  STA $61A0                        135     8            
  562                                60B8  STA $61BB                        136     8            
  563                                60BB  ORA #$B0                         137     8            
  564                                60BD  STA cons_line1/cutofftime,X      138     8            ; idx=0-7
  565                                60C0  TXA                              139     8            
  566                                60C1  ASL A                            140     8            
  567                                60C2  ASL A                            141     8            
  568                                60C3  ASL A                            142     8            
  569                                60C4  ASL A                            143     8            
  570                                60C5  ASL A                            144     8            
  571                                60C6  STA $60CF                        145     8            
  572                                60C9  LDY #$1F                         146     8            
  573  ,-60D2                        60CB  LDA $619E,Y                      147   256            ; idx=0-1f
  574                                60CE  STA $0200,Y                      148   256            ; idx=0-1f
  575                                60D1  DEY                              149   256            
  576                        60CB'-  60D2  BPL $60CB                        150   256            ; branch 248/256 (96%) times
  577                                60D4  LDA #$AA                         151     8            
  578                                60D6  STA cons_line2/line0channel,X    152     8            ; idx=0-7
  579                                60D9  LDA #$3C                         153     8            
  580                                60DB  STA $FC                          154     8            
  581                                60DD  LDA #$00                         155     8            
  582                                60DF  STA $00                          156     8            
  583                                60E1  STA $FA                          157     8            
  584                                60E3  STA $50,X                        158     8            ; idx=0-7
  585                                60E5  STA $18,X                        159     8            ; idx=0-7
  586                                60E7  STA $10,X                        160     8            ; idx=0-7
  587                                60E9  STA $40,X                        161     8            ; idx=0-7
  588                                60EB  STA $38,X                        162     8            ; idx=0-7
  589                                60ED  STA $28,X                        163     8            ; idx=0-7
  590                                60EF  STA $88,X                        164     8            ; idx=0-7
  591                                60F1  STA $80,X                        165     8            ; idx=0-7
  592                                60F3  STA $A0,X                        166     8            ; idx=0-7
  593                                60F5  STA $C8,X                        167     8            ; idx=0-7
  594                                60F7  STA $B0,X                        168     8            ; idx=0-7
  595                                60F9  STA $D8,X                        169     8            ; idx=0-7
  596                                60FB  STA $78,X                        170     8            ; idx=0-7
  597                                60FD  STA $E8,X                        171     8            ; idx=0-7
  598                                60FF  STA $58,X                        172     8            ; idx=0-7
  599                                6101  LDA #$0A                         173     8            
  600                                6103  STA $68,X                        174     8            ; idx=0-7
  601                                6105  LDA #$FF                         175     8            
  602                                6107  STA $E8                          176     8            
  603                                6109  STA $60,X                        177     8            ; idx=0-7
  604                                610B  STA $20,X                        178     8            ; idx=0-7
  605                                610D  LDA #$28                         179     8            
  606                                610F  STA $B8,X                        180     8            ; idx=0-7
  607                                6111  STA $A8,X                        181     8            ; idx=0-7
  608                                6113  LDY #$00                         182     8            
  609                                6115  STY $20                          183     8            
  610  ,-614D                        6117  TYA                              184  2048            
  611                                6118  AND #$7F                         185  2048            
  612                                611A  CMP #$7F                         186  2048            
  613                        6120,-  611C  BNE $6120                        187  2048            ; branch 2032/2048 (99%) times
  614                                611E  LDA #$08                         212    16            
  615  '-611C                        6120  CMP #$20                         188  2048            
  616                        6149,-  6122  BCS $6149                        189  2048            ; branch 1520/2048 (74%) times
  617                                6124  CMP #$08                         190   528            
  618                        6149,-  6126  BEQ $6149                        191   528            ; branch 32/528 (6%) times
  619                                6128  CMP #$0D                         192   496            
  620                        6149,-  612A  BEQ $6149                        193   496            ; branch 16/496 (3%) times
  621                                612C  CMP #$07                         194   480            
  622                        6149,-  612E  BEQ $6149                        195   480            ; branch 16/480 (3%) times
  623                                6130  CMP #$1B                         196   464            
  624                        6144,-  6132  BEQ $6144                        197   464            ; branch 16/464 (3%) times
  625                                6134  CMP #$09                         198   448            
  626                        613C,-  6136  BEQ $613C                        199   448            ; branch 16/448 (3%) times
  627                                6138  CMP #$16                         200   432            
  628                        6140,-  613A  BNE $6140                        201   432            ; branch 416/432 (96%) times
  629  '-6136                        613C  LDA #$A0                         208    32            
  630                        6149,-  613E  BNE $6149                        209    32            ; branch 32/32 (100%) times
  631  '-613A                        6140  CMP #$15                         202   416            
  632                        6147,-  6142  BNE $6147                        203   416            ; branch 400/416 (96%) times
  633  '-6132                        6144  LDA #$80                         210    32            
  634                                6146  BIT $FFA9                        211    32            
  635  '-6142                        6147  LDA #$FF                         204   400            
  636  '-6122 '-613E '-612E '-612A '-6126
  637                                6149  STA $F300,Y                      205  2048            ; idx=0-ff
  638                                614C  INY                              206  2048            
  639                        6117'-  614D  BNE $6117                        207  2048            ; branch 2040/2048 (99%) times
  640                                614F  LDA modem_exists,X               213     8            ; idx=0-7
  641                        6155,-  6152  BNE modem_initialization         214     8            ; branch never
  642                        18CC'-  6154  RTS                              215     8            
  643  ,-7FD3                        63CE  LDA $FA                          317  1330            
  644                        63D7,-  63D0  BEQ $63D7                        318  1330            ; branch 1330/1330 (100%) times
  645  '-63D0                        63D7  LDA $7FF8                        319  1330            
  646                        63EF,-  63DA  BMI $63EF                        320  1330            ; branch never
  647                                63DC  LDA $C000                        321  1330            
  648                        63EF,-  63DF  BPL $63EF                        322  1330            ; branch 1330/1330 (100%) times
  649  '-63DF '-63DA                 63EF  LDY $7FD7                        323  1330            
  650                        63F7,-  63F2  BPL $63F7                        324  1330            ; branch never
  651                        649C,-  63F4  JMP $649C                        325  1330            
  652  '-63F4                        649C  LDX #$07                         326  1330            
  653  ,-64A4                        649E  LDA modem_exists,X               327  9310            ; idx=1-7
  654                        64A7,-  64A1  BNE modem_configure              328  9310            ; branch never
  655                                64A3  DEX                              329  9310            
  656                        649E'-  64A4  BNE $649E                        330  9310            ; branch 7980/9310 (85%) times
  657                 28B4'- 3909'-  64A6  RTS                              331  1330            
  658  '-6002                        7D55  STY $F9                          364   154            
  659                                7D57  STA $F8                          365   154            
  660                                7D59  LDY cons_x_save                  366   154            
  661                                7D5B  CMP #$20                         367   154            
  662                        7D88,-  7D5D  BCC $7D88                        368   154            ; branch 14/154 (9%) times
  663                                7D5F  ORA #$80                         587   140            
  664                                7D61  BIT $7FCB                        588   140            
  665                        7D74,-  7D64  BPL cons_out                     589   140            ; branch never
  666                                7D66  CMP #$C1                         590   140            
  667                        7D74,-  7D68  BCC cons_out                     591   140            ; branch 35/140 (25%) times
  668                                7D6A  CMP #$DB                         592   105            
  669                                7D6C  AND #$DF                         593   105            
  670                        7D74,-  7D6E  BVC cons_out                     594   105            ; branch 105/105 (100%) times
  671                              *
  672                              * -- write out to console
  673                              cons_out
  674  '-7D68 '-7D6E '-7D64          7D74  STA cons_line24,Y                595   140 ; actual character write out, y indexed ; idx=0-1f
  675                                7D77  INY                              596   140            
  676                                7D78  CPY #$28                         597   140 ; gone past 40 columns? 
  677                        7DB7,-  7D7A  BCS $7DB7                        598   140 ; yes, branch ; branch never
  678  ,-7E49                        7D7C  STY cons_x_save                  431   154            
  679                                7D7E  LDA #$20                         432   154 ; load inverse space (cursor) 
  680                                7D80  STA cons_line24,Y                433   154            ; idx=0-20
  681                                7D83  LDY $F9                          434   154            
  682                                7D85  LDA $F8                          435   154            
  683                        2A01'-  7D87  RTS                              436   154            
  684  '-7D5D                        7D88  CMP #$0D                         369    14            
  685                        7DA5,-  7D8A  BEQ $7DA5                        370    14            ; branch 14/14 (100%) times
  686  '-7D8A                        7DA5  LDA #$A0                         371    14            
  687                                7DA7  STA cons_line24,Y                372    14            ; idx=0 2 a f 17 1b 1f-20
  688                                7DAA  LDA $F7E0                        373    14            
  689                        7DB1,-  7DAD  BMI $7DB1                        374    14            ; branch never
  690                                7DAF  LDA #$01                         375    14            
  691  '-7DAD                        7DB1  STA $797B                        376    14            
  692                                7DB4  STA $7131                        377    14            
  693  '-7D7A                        7DB7  LSR $E2                          378    14            
  694                                7DB9  LDY #$27                         379    14            
  695                              _cons_scroll
  696  ,-7E44                        7DBB  LDA cons_line4,Y                 380   560 ; scroll console ; idx=0-27
  697                                7DBE  STA cons_line3,Y                 381   560            ; idx=0-27
  698                                7DC1  LDA cons_line5,Y                 382   560            ; idx=0-27
  699                                7DC4  STA cons_line4,Y                 383   560            ; idx=0-27
  700                                7DC7  LDA cons_line6,Y                 384   560            ; idx=0-27
  701                                7DCA  STA cons_line5,Y                 385   560            ; idx=0-27
  702                                7DCD  LDA cons_line7,Y                 386   560            ; idx=0-27
  703                                7DD0  STA cons_line6,Y                 387   560            ; idx=0-27
  704                                7DD3  LDA cons_line8,Y                 388   560            ; idx=0-27
  705                                7DD6  STA cons_line7,Y                 389   560            ; idx=0-27
  706                                7DD9  LDA cons_line9,Y                 390   560            ; idx=0-27
  707                                7DDC  STA cons_line8,Y                 391   560            ; idx=0-27
  708                                7DDF  LDA cons_line10,Y                392   560            ; idx=0-27
  709                                7DE2  STA cons_line9,Y                 393   560            ; idx=0-27
  710                                7DE5  LDA cons_line11,Y                394   560            ; idx=0-27
  711                                7DE8  STA cons_line10,Y                395   560            ; idx=0-27
  712                                7DEB  LDA cons_line12,Y                396   560            ; idx=0-27
  713                                7DEE  STA cons_line11,Y                397   560            ; idx=0-27
  714                                7DF1  LDA cons_line13,Y                398   560            ; idx=0-27
  715                                7DF4  STA cons_line12,Y                399   560            ; idx=0-27
  716                                7DF7  LDA cons_line14,Y                400   560            ; idx=0-27
  717                                7DFA  STA cons_line13,Y                401   560            ; idx=0-27
  718                                7DFD  LDA cons_line15,Y                402   560            ; idx=0-27
  719                                7E00  STA cons_line14,Y                403   560            ; idx=0-27
  720                                7E03  LDA cons_line16,Y                404   560            ; idx=0-27
  721                                7E06  STA cons_line15,Y                405   560            ; idx=0-27
  722                                7E09  LDA cons_line17,Y                406   560            ; idx=0-27
  723                                7E0C  STA cons_line16,Y                407   560            ; idx=0-27
  724                                7E0F  LDA cons_line18,Y                408   560            ; idx=0-27
  725                                7E12  STA cons_line17,Y                409   560            ; idx=0-27
  726                                7E15  LDA cons_line19,Y                410   560            ; idx=0-27
  727                                7E18  STA cons_line18,Y                411   560            ; idx=0-27
  728                                7E1B  LDA cons_line20,Y                412   560            ; idx=0-27
  729                                7E1E  STA cons_line19,Y                413   560            ; idx=0-27
  730                                7E21  LDA cons_line21,Y                414   560            ; idx=0-27
  731                                7E24  STA cons_line20,Y                415   560            ; idx=0-27
  732                                7E27  LDA cons_line22,Y                416   560            ; idx=0-27
  733                                7E2A  STA cons_line21,Y                417   560            ; idx=0-27
  734                                7E2D  LDA cons_line23,Y                418   560            ; idx=0-27
  735                                7E30  STA cons_line22,Y                419   560            ; idx=0-27
  736                                7E33  LDA cons_line24,Y                420   560            ; idx=0-27
  737                                7E36  STA cons_line23,Y                421   560            ; idx=0-27
  738                        F822,-  7E39  JSR _and_rts                     422   560            
  739  ,-F822                        7E3C  LDA #$A0                         424   560            
  740                                7E3E  STA cons_line24,Y                425   560            ; idx=0-27
  741                                7E41  DEY                              426   560            
  742                        7E47,-  7E42  BMI _cons_scroll_end             427   560            ; branch 14/560 (2%) times
  743                        7DBB'-  7E44  JMP _cons_scroll                 428   546            
  744                              _cons_scroll_end
  745  '-7E42                        7E47  LDY #$00                         429    14            
  746                        7D7C'-  7E49  JMP $7D7C                        430    14            
  747                              *
  748                              * -- mkanalyze detects subroutine here -- called from 28B1 3906 
  749  '-28B1 '-3906         63CE'-  7FD3  JMP $63CE                        316  1330            
  750                              *
  751                              * -- mkanalyze detects subroutine here -- called from 18B8 
  752                              *
  753                              * -- some sort of setup routine to determine memory capabilities
  754                              _setup3
  755  '-18B8                        8000  SEI                               18     1            
  756                                8001  STA $C000                         19     1            
  757                                8004  STA $C002                         20     1            
  758                                8007  STA $C004                         21     1            
  759                                800A  STA $C008                         22     1            
  760                                800D  LDA $C051                         23     1            
  761                                8010  LDA $C054                         24     1            
  762                                8013  STA $C00C                         25     1            
  763                                8016  BIT $C081                         26     1            
  764                                8019  LDA $FFFA                         27     1            
  765                                801C  ORA $FFFB                         28     1            
  766                        8032,-  801F  BEQ _setup3_memchk1               29     1            ; branch never
  767                                8021  LDA $FBB3                         30     1 ; capability found (or not) 
  768                                8024  CMP #$06                          31     1            
  769                        8032,-  8026  BEQ _setup3_memchk1               32     1            ; branch never
  770                                8028  LDA #$80                          33     1            
  771                                802A  STA $7FCB                         34     1            
  772                                802D  LDA #$60                          35     1            
  773                                802F  STA $8822                         36     1            
  774                              *
  775                              * -- another memory check
  776                              _setup3_memchk1
  777  '-801F '-8026                 8032  LDA #$00                          37     1            
  778                                8034  STA $C073                         38     1            
  779                                8037  BIT $C083                         39     1            
  780                                803A  BIT $C083                         40     1            
  781                                803D  STA $EFFF                         41     1            
  782                                8040  LDY #$7F                          42     1            
  783                                8042  STA $8FFC                         43     1            
  784                                8045  STY $8FFD                         44     1            
  785                                8048  STA $8FFE                         45     1            
  786                                804B  STY $8FFF                         46     1            
  787                                804E  CLC                               47     1            
  788                        80AB,-  804F  JSR $80AB                         48     1            
  789  ,-8112                        8052  LDA #$00                          95     1            
  790                                8054  TAY                               96     1            
  791  ,-8062                        8055  STA $F400,Y                       97   256            ; idx=0-ff
  792                                8058  STA $F500,Y                       98   256            ; idx=0-ff
  793                                805B  STA $F600,Y                       99   256            ; idx=0-ff
  794                                805E  STA $F700,Y                      100   256            ; idx=0-ff
  795                                8061  INY                              101   256            
  796                        8055'-  8062  BNE $8055                        102   256            ; branch 255/256 (99%) times
  797                                8064  STA $C009                        103     1            
  798                                8067  LDY #$7F                         104     1            
  799                                8069  STY $EFFF                        105     1            
  800                                806C  INC $EFFF                        106     1            
  801                                806F  INY                              107     1            
  802                                8070  CPY $EFFF                        108     1            
  803                        8085,-  8073  BNE $8085                        109     1            ; branch never
  804                                8075  LDA #$01                         110     1            
  805                                8077  STA $EFFF                        111     1            
  806                                807A  STA $C008                        112     1            
  807                                807D  LDA $EFFF                        113     1            
  808                                8080  STA $C009                        114     1            
  809                        8096,-  8083  BEQ $8096                        115     1            ; branch never
  810  '-8073                        8085  STA $C008                        116     1            
  811                                8088  LDA #$38                         117     1            
  812                                808A  STA $FCBC                        118     1            
  813                                808D  LDA #$60                         119     1            
  814                                808F  STA $FABF                        120     1            
  815                                8092  STA $F80C                        121     1            
  816                        18BB'-  8095  RTS                              122     1            
  817                              *
  818                              * -- mkanalyze detects subroutine here -- called from 804F 
  819  '-804F                        80AB  LDY #$00                          49     1            
  820                                80AD  LDA #$80                          50     1            
  821                                80AF  STA $80D3                         51     1            
  822                                80B2  LDA #$F0                          52     1            
  823                                80B4  STA $80D6                         53     1            
  824                                80B7  LDA #$10                          54     1            
  825                                80B9  STA $00                           55     1            
  826                        80D1,-  80BB  BCC _setup_copy_f0                56     1            ; branch 1/1 (100%) time
  827                              *
  828                              * --- copy setup3 ($8000) to $F000
  829                              _setup_copy_f0
  830  ,-80E2 ,-80D8 '-80BB          80D1  LDA _setup3,Y                     57  4096            ; idx=0-ff
  831                                80D4  STA $F000,Y                       58  4096            ; idx=0-ff
  832                                80D7  INY                               59  4096            
  833                        80D1'-  80D8  BNE _setup_copy_f0                60  4096            ; branch 4080/4096 (99%) times
  834                                80DA  INC $80D3                         61    16            
  835                                80DD  INC $80D6                         62    16            
  836                                80E0  DEC $00                           63    16            
  837                        80D1'-  80E2  BNE _setup_copy_f0                64    16            ; branch 15/16 (93%) times
  838                                80E4  BIT $C08B                         65     1            
  839                                80E7  BIT $C08B                         66     1            
  840                                80EA  LDA #$D0                          67     1            
  841                                80EC  STA $01                           68     1            
  842  ,-8102                        80EE  LDA cons_status                   69    32            
  843                                80F1  EOR #$A0                          70    32            
  844                        8104,-  80F3  BNE $8104                         71    32            ; branch never
  845                                80F5  STA $00                           72    32            
  846                              *
  847                              * --- copy $D000 to $EFFF
  848                              _setup_copy_d0-ef
  849  ,-80FA                        80F7  STA ($00),Y                       73  8192            ; idx=0-ff (indirect d000-efff)
  850                                80F9  INY                               74  8192            
  851                        80F7'-  80FA  BNE _setup_copy_d0-ef             75  8192            ; branch 8160/8192 (99%) times
  852                                80FC  INC $01                           76    32            
  853                                80FE  LDA $01                           77    32            
  854                                8100  CMP #$F0                          78    32            
  855                        80EE'-  8102  BCC $80EE                         79    32            ; branch 31/32 (96%) times
  856  '-80F3                        8104  BIT $C083                         80     1            
  857                                8107  BIT $C083                         81     1            
  858                                810A  LDY #$07                          82     1            
  859  ,-8110                8879,-  810C  JSR $8879                         83     8            
  860  ,-888C                        810F  DEY                               92     8            
  861                        810C'-  8110  BPL $810C                         93     8            ; branch 7/8 (87%) times
  862                        8052'-  8112  RTS                               94     1            
  863                              *
  864                              * -- mkanalyze detects subroutine here -- called from 810C 
  865  '-810C                        8879  LDA #$00                          84     8            
  866                                887B  STA $FF65,Y                       85     8            ; idx=0-7
  867                                887E  STA $FF6D,Y                       86     8            ; idx=0-7
  868                                8881  STA $FF75,Y                       87     8            ; idx=0-7
  869                                8884  STA $FF55,Y                       88     8            ; idx=0-7
  870                                8887  LDA #$D0                          89     8            
  871                                8889  STA $FF5D,Y                       90     8            ; idx=0-7
  872                        810F'-  888C  RTS                               91     8            
  873                              *
  874                              * -- mkanalyze detects subroutine here -- called from 3926 
  875  '-3926                FAB7,-  F803  JMP $FAB7                        600   648            
  876                              *
  877                              * -- mkanalyze detects subroutine here -- called from 2E57 34AE 7E39 2A1D 3074 390C 36CB 2C3A 50EC 3291 38E8 
  878                              _and_rts
  879  '-2E57 '-34AE '-7E39 '-2A1D '-3074 '-390C '-36CB '-2C3A '-50EC '-3291 '-38E8
  880                                F822  RTS                              423  6546            
  881  36CE'- 2C3D'- 50EF'- 3294'- 38EB'- 2E5A'- 34B1'- 7E3C'- 2A20'- 3077'- 390F'-
  882  '-F803                        FAB7  LDA $0495                        601   648            
  883                                FABA  CMP $FF02                        602   648            
  884                        FA6B'-  FABD  BNE $FA6B                        603   648            ; branch never
  885                        3929'-  FABF  RTS                              604   648            

Final

Check out the final binary dump!