"Calculated RTS" or "Gotta JMP, Can't JSR&
using vim and searching for DEC R5.*\n.*ROL R4.*\n.*BNC.*\n.*XOR R5.*\n.*PSH R0.*\n.*TX0 R1.*\n.*XOR R5.*\n.*T0X R1.*\n.*POP R0.*\n.*UPP R0.*\n.*PSH R1.*\n.*PSH R0.*\n.*TX0 R7.*\n.*T0X R1.*\n.*TX0 R6.*\n.*POP R2.*\n.*POP R3.*\n.*ROL R4.*\n.*BNC.*\n.*XOR R5.*\n.*PSH R0.*\n.*TX0 R1.*\n.*XOR R5.*\n.*T0X R1.*\n.*POP R0.*\n.*UPP R0.*\n.*POP R7.*\n.*POP R6.*\n.*POP R5.*\n.*POP R4.*\n.*RTS you will find it both as part of the 16-bit division function as well as a function on it's own...or is it? When you JSR to the function it ends up that the POP R7 and POP R6 "eat up" the location to RTS to, so unless the calling code pushes a location to jump to, you end up RTSing out of the program or who knows where. Another possibility is that this code is executed when jumped to via a calculated jump, because I don't find any branching code that reaches it otherwise. For that matter, I haven't verified if this section of code is ever executed by the camera. If it is somehow jumped to then the code that jumps to it would have to push 4 values onto the stack to be eaten up by the 4 POPs (or sodas in Texas) that are right before the RTS.