Work in progress, add some work on banks 1 and 2
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..82ce00a
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,3 @@
+*.rom
+*.disa
+.*.sw?
diff --git a/Makefile b/Makefile
index a3110cf..3a517eb 100644
--- a/Makefile
+++ b/Makefile
@@ -1,17 +1,26 @@
 
-all: interbank.disa bank0.disa
+all: interbank.disa bank0.disa bank1.disa bank2.disa
 
 interbank.rom: cqfd.rom
-	dd if=cqfd.rom of=interbank.rom bs=8192 skip=1 count=1
+	dd if=$< of=$@ bs=8192 skip=1 count=1
+
+bank1.rom: cqfd.rom
+	dd if=$< of=$@ bs=16384 skip=1 count=1
+
+bank2.rom: cqfd.rom
+	dd if=$< of=$@ bs=16384 skip=2 count=1
 
 interbank.disa: cqfd.control interbank.rom interbank.control
-	dasm05 $< > $@
+	dasm05 $< -o $@
 
 bank0.disa: bank0.control cqfd.rom interbank.control
-	dasm05 $< > $@
+	dasm05 $< -o $@
+
+%.disa: %.control %.rom interbank.control
+	dasm05 $< -o $@
 
 clean:
-	rm interbank.disa bank0.disa interbank.rom
+	rm *.disa interbank.rom bank?.rom
 
 # vim:ft=make
 #
diff --git a/bank0.control b/bank0.control
index e5e7696..b0b2774 100644
--- a/bank0.control
+++ b/bank0.control
@@ -126,10 +126,51 @@
 p5875
 
 p588c routinee
+l5907
+l590c
+l5923
+l592a
+l5933
+l5968
+l5977
+l59b4
+l59be
+l59e8
+l59f0
+l5a1e
+l5a42
+l5a66
+l5a6f
+l5a75
+p5a81
+p5b2d
+p5b3f
+p5b51
+p5b63
+n5b75
+Input: number in A
+Output: A/10 in X, A%10 in A
+.
+p5b75 divide_by_10
+p5b80
 p5b98 routine13
 b5bd0
+w5c1e p5b80_lookup
+
 p5c52 routine15
+l5c69
+l5c6c
+l5c7b
+l5ca1
+l5ce8
+
 p5cef routine14
+l5d01 r14_args_are_valid
+l5d1e
+l5d39 r14_loop1
+l5d4c r14_loop2
+l5d54
+l5d63 r14_return
 b5d64
 
 e6000
diff --git a/bank1.control b/bank1.control
new file mode 100644
index 0000000..d206c1f
--- /dev/null
+++ b/bank1.control
@@ -0,0 +1,97 @@
+fbank1.rom
+tff
+c4000
+iinterbank.control
+
+b404e
+
+p4a00 routine2
+p4a2e routine3
+p4a5c routine4
+p4a8a routine5
+p4ab8 routine6
+p4ae6 routine7
+p4b14 routine8
+p4b42 routine9
+p4b70 routineA
+p4b9e routineB
+p4d28 routine19
+p4d58 routine18
+p4eca routine1B
+p5074 routineC
+p512d routineD
+p524f
+p525a
+p5265 routineE_alias_routineB
+p5269 routineF_alias_routineB
+p526b routine10_alias_routineC
+
+p526f routine11
+l527e
+l5289
+l5294
+l529f
+
+p52a0
+p52b0
+p52c2
+p52d2
+
+p52e4 routine12
+l52f8
+l52f9
+l5307
+l5315
+
+p531f
+p5331
+p5343
+p5355
+p5367
+p5379
+p538b
+
+p53f2 routine13
+
+p53fc routine14
+l544b
+
+p548e routine15
+
+p5520 routine17
+l5547
+l5553
+l555e
+l556d
+
+p5574 routine16
+l5589 r16_loop1
+l5591 r16_loop2
+
+p55a0 routine1
+l55a7 r1_param_is_16_or_less_than_12
+l55ae
+l55b8
+l55d5
+l55db
+l55dc hw_ptr_is_clear
+l55f8
+l5606
+l5619
+l562a
+
+b5631
+
+p5b55 routine1A
+
+b5ba3
+v564a
+v564c
+v564e
+b5650
+b5680
+b5860
+b5aa9
+
+
+e7fff
diff --git a/bank2.control b/bank2.control
new file mode 100644
index 0000000..ac2ca89
--- /dev/null
+++ b/bank2.control
@@ -0,0 +1,166 @@
+fbank2.rom
+tff
+c4000
+iinterbank.control
+
+p4042 routine9_call_b212_bank3_8000
+p4049 routine3
+p4059 routine0
+p5ca3 routine8
+p5ddc routine1
+
+b5f07
+b5f2f
+p5f35
+p5fc1
+
+p6138
+p61d5
+
+n630d
+Add two 16-bit numbers together
+.
+p630d add16
+
+n632a
+Subtract a 16bit number from another (signed?)
+.
+p632a sub16
+
+n6356
+Multiplies two 16-bit numbers to get a 32bit result (plus a 5th byte with carry).
+.
+p6356 mul16
+
+p63ab
+l63b0 loop
+
+p63f7
+l640c
+l640e p63f7_loop
+l643a
+l6453 p63f7_continue
+l6473 p63f7_return
+
+p6474
+p64da
+p65c1
+p6640
+p66c0
+p6787
+p67f1
+p681a
+p6b34
+p6b5f
+p6b77
+b6c35
+
+p6c82 push_aa_in_01ea
+p6c92 push_ab_in_01ea
+p6ca2 push_ac_in_01ea
+p6cb2 push_ad_in_01ea
+p6cc2 routineE_push_ae_in_01ea
+p6cd2 routine10_push_af_in_01ea
+p6ce2 routine12_push_b0_in_01ea
+p6cf2 routune14_push_b1_in_01ea
+p6d02 routineC_push_b2_in_01ea
+p6d12 routineA_push_b3_in_01ea
+p6d22 pop_aa_from_01ea
+p6d32 pop_ab_from_01ea
+p6d42 pop_ac_from_01ea
+p6d52 pop_ad_from_01ea
+p6d62 routineF_pop_ae_from_01ea
+p6d72 routine11_pop_af_from_01ea
+p6d82 routine13_pop_b0_from_01ea
+p6d92 routine15_pop_b1_from_01ea
+p6da2 routineD_pop_b2_from_01ea
+p6db2 routineB_pop_b3_from_01ea
+
+p6dc2
+l6dcc
+l6ddd
+l6de0
+
+p6de4
+p6e09
+
+p6f0d
+
+b6f63
+
+p6ff0 routine4
+p709d
+p70d5
+b70e2
+
+c70ed
+
+p7271 routine5
+p72a5 routine7
+
+b77c0
+
+p78f0 call_r8b0(?, ?, 6, 5, 14)
+p7903 call_r8b0(15, 0, 6, 5, 14)
+p790f call_r8b0(16, 0, 6, 5, 14)
+p791b call_r8b0(17, 0, 6, 5, 14)
+p7927 call_r11b0(5f00)
+l7931 do_call_r11b0
+p7935 call_r11b0(4d00)
+p7941 call_r11b0(5b00)
+p794d call_r11b0(5500)
+p7959 call_r11b0(4f00)
+p79b8 routine6
+p79c3 routine2_get_string_from_table
+
+v79d5 stringtable
+s7a31 select_app
+l7a47 select_level
+l7a5a score
+l7a76 player_a
+l7a81 player_b
+l7a8c continue
+l7a9a no_cartridge
+l7abf answer
+l7ad2 answer2
+l7ae5 fail1
+l7aef fail2
+l7af9 fail3
+l7b02 success1
+l7b0e success2
+l7b1a typeword
+l7b2b pickword
+l7b3f synoanto1
+l7b69 synoanto2
+l7b93 memorize
+l7bab typewords
+l7bc8 guessword
+l7bd7 typemissingword
+l7bed completesentence
+l7c01 pickanswer1
+l7c1a pickanswer2
+l7c33 findduplicatecard
+l7c52 closeboxes
+l7c64 pickinstrument
+l7c7b playmusic
+l7c93 pickmusic
+l7cac pickinstrument2
+l7cc0 freeblock
+l7cd0 toolate
+l7ce3 space
+l7ce5 nextlevel
+l7d10 getaward
+l7d28 getawarda
+l7d4a getawardb
+l7d6c selectmode
+l7d7b playmode
+l7d86 followmode
+l7d93 rememberwords
+l7dab retypewords2
+l7dc8 calculator
+l7dd3 selectprinter
+l7def printererror
+
+b7e03
+
+e7fff
diff --git a/cqfd.control b/cqfd.control
index 010da30..423e997 100644
--- a/cqfd.control
+++ b/cqfd.control
@@ -3,45 +3,6 @@
 
 c2000
 
-l0005 mistery_reg_5
-l001e mistery_reg_1e
-
-l0029 rombank_select_4000
-l002a bank_select_8000
-l002b rambank_select_d000
-l002d rombank_select_c000
-
-l0044 mistery_reg_44
-
-l004e idx8
-
-l0051 mistery_reg_51
-l0052 mistery_reg_52
-l0054 mistery_reg_54
-l0055 mistery_reg_55
-l0058 mistery_reg_58
-
-l0072 mistery_var_72_hi
-l0073 mistery_var_72_low
-l0074 mistery_bitfield_74
-
-
-
-l01e9 bank2_savea
-l023a idx16_hi_save_bank1
-l023b idx16_lo_save_bank1
-l0240 some_array_indexed_by_0282
-l0270 idx16_savehi
-l0271 idx16_savelo
-l0272 p2xxx_interrupt_status_save
-l0278 r4e_save
-l0282 index_for_0240
-l0283 p3xxx_interrupt_status_save
-l0284 r72_save2_hi
-l0285 r72_save2_lo
-l0286 r72_save_hi
-l0287 r72_save_lo
-
 n2000
 Start of resident ROM area
 This area is always mapped at address 2000, and contains generic code,
@@ -85,16 +46,6 @@
 These are used often or implement quite low level things to make the CPU usable.
 They are always mapped in and can be easily called this way.
 .
-l283c goto_3883
-l2845 goto_28a5
-l2848 goto_2c7c
-l284b goto_2a05
-l2869 do_call_routine15_bank0_with_265eq0_and_264eq6
-l286f goto_3ab6
-l2872 goto_3ac2
-l288d goto_38e3
-l2896 setbit7_7f_and_call_2845
-l289e clear_7f_and_call_2845
 
 p28a5
 l28c0 p28a5_restore_interrupts_and_continue
@@ -109,10 +60,16 @@
 
 p29f7 call_routine15_bank0_with_265eq0_and_264eq6
 
-p2a05
+p2a05 reassemble_9xx_bits_in_7d
 l2a0f p2a05_interrupts_are_off
 l2a14 p2a05_endif_interrupts
 l2a2a r78_is_zero
+l2a31 process_46
+l2a71 process_48
+l2aaf process_49
+l2aed process_4a
+l2b2b process_4b_or_more
+l2b65
 l2b6b r78_is_not_0
 l2b86 p2a05_return_0
 l2b8d r78_is_not_1
@@ -126,25 +83,35 @@
 l2c27 x_is_not_49
 l2c34 x_is_not_4a
 
-p2c7c
+p2c7c explode_7d_bits_in_9xx
 l2c86 p2c7c_interrupts_are_off
 l2ca1 r78_is_0
-l2ca8 r267_higher_than_46
-l2d23 r267_is_not_47
-l2d9e r267_is_not_48
-l2e19 r267_is_not_49
-l2e94 r267_is_not_4a
-l2f0b r267_lower_than_46
+l2ca8 r26f_higher_than_46
+l2d23 r26f_is_not_47
+l2d9e r26f_is_not_48
+l2e19 r26f_is_not_49
+l2e94 r26f_is_not_4a
+l2f0b r26f_lower_than_46
 l2f10 r78_is_not_0
 l2f19 r78_is_not_1
 l2f22 r78_is_not_2
-l2f33 r267_more_than_3f
-l2f57 r267_more_than_3c_or_r78_is_3
-l2f78 r267_less_than_31
+l2f25 r78_endif
+l2f33 r26f_more_than_3f
+l2f35 end_all_if
+l2f57 r26f_more_than_3c_or_r78_is_3
+l2f78 r26f_less_than_31
 
 p2f92
 p300d
+l3056
+l3060
+l306c
+l3095
+
 b30c6
+b310d
+b3154
+b319b
 
 p31e2 pusha
 l31f2 pusha_int_already_disabled
@@ -213,7 +180,7 @@
 p34ef far_call
 l3514 p34ef_interrupts_are_disabled
 
-p3535 io_wait_something
+p3535 wait_timer_counter1
 p3553
 l356e p3553_interrupts_are_disabled
 
@@ -305,6 +272,7 @@
 p3b58
 l3b62 p3b58_interrupts_are_disabled
 l3b67 p3b58_interrupts_endif
+l3b6f p3b58_loop
 
 p3b9d
 l3ba7 p3b9d_interrupts_are_clear
diff --git a/interbank.control b/interbank.control
index b299317..e7e289b 100644
--- a/interbank.control
+++ b/interbank.control
@@ -1,3 +1,45 @@
+l0000 reg_PORTA_DATA
+l0001 reg_PORTB_DATA
+l0002 reg_PORTC_DATA
+l0003 reg_PORTD_DATA
+l0004 reg_PORTA_DIR
+l0005 reg_PORTB_DIR
+l0006 reg_PORTC_DIR
+l0007 reg_EEPROM_CTRL
+l0008 reg_ADC_DATA
+l0009 reg_ADC_CTRL
+l000a reg_PWM_A
+l000b reg_PWM_B
+l000c reg_MISC
+l000d reg_SCI_BAUDRATE
+l000e reg_SCI_CTRL1
+l000f reg_SCI_CTRL2
+l0010 reg_SCI_STAT
+l0011 reg_SCI_DATA
+l0012 reg_TIMER_CTRL
+l0013 reg_TIMER_STAT
+l0014 reg_TIMER_CAPTURE1_HIGH
+l0015 reg_TIMER_CAPTURE1_LOW
+l0016 reg_TIMER_COMPARE1_HIGH
+l0017 reg_TIMER_COMPARE1_LOW
+l0018 reg_TIMER_COUNTER1_HIGH
+l0019 reg_TIMER_COUNTER1_LOW
+l001A reg_TIMER_COUNTER2_HIGH
+l001B reg_TIMER_COUNTER2_LOW
+l001C reg_TIMER_CAPTURE2_HIGH
+l001D reg_TIMER_CAPTURE2_LOW
+l001E reg_TIMER_COMPARE2_HIGH
+l001F reg_TIMER_COMPARE2_LOW
+
+l0029 rombank_select_4000
+l002a bank_select_8000
+l002b rambank_select_c000
+l002d rombank_select_c000
+
+l0043 mistery_var_43
+l0044 mistery_var_44
+l0046
+
 n0047
 Keyboard flags are stored here.
 Bit 0 switches between QWERTY and AZERTY
@@ -9,10 +51,19 @@
 Bit 7 ???
 .
 l0047 keyboard_config_bits
+l004a hw_ptr_something_hi
+l004b hw_ptr_something_lo
 l004d save_x_kbd
+l004e idx8
 l004f idx16_hi
 l0050 idx16_lo
 
+l0051 mistery_var_51
+l0052 mistery_var_52
+l0054 mistery_var_54
+l0055 mistery_var_55
+l0058 mistery_var_58
+
 n005f
 A 4-byte zone in RAM where several routines will poke two instructions
 and then execute them, to implement missing features of the CPU such
@@ -20,6 +71,41 @@
 .
 l005f scratch_area
 
+n0069
+Store a pointer to the next area (??? to 90) which is used as a stack
+to save the A and X registers. In 6805 there are no instructions to
+push or pop these registers on the call stack, which has a very
+limited size anyway.
+.
+l0069 var_stackptr
+
+l0072 mistery_var_72_hi
+l0073 mistery_var_72_low
+l0074 mistery_bitfield_74
+l007e interbank_unknown1_param1
+
+l0090 var_stackbase
+
+l00b4 stackptr_for_01ea
+
+l0102 someptr_hi
+l0103 someptr_lo
+
+l0113 math_arg1_hi
+l0114 math_arg1_lo
+l0115 math_arg2_hi
+l0116 math_arg2_lo
+l0117 math_arg3_hi
+l0118 math_arg3_lo
+l0119 math_carry
+l011a math_result1_hi
+l011b math_result1_lo
+l011c math_result2_hi
+l011d math_result2_lo
+
+l01e9 bank2_savea
+l01ea stack_indexed_by_00b4
+l022f save_bankselect_d000
 l0228 save_x
 
 k0235 Memory used for passing arguments to functions
@@ -28,15 +114,35 @@
 l0237 arg_2
 l0238 arg_1
 l0239 arg_0
+l023a idx16_hi_save_bank1
+l023b idx16_lo_save_bank1
+l0240 some_array_indexed_by_0282
 
-n0069
-Store a pointer to the next area (??? to 90) which is used as a stack
-to save the A and X registers. In 6805 there are no instructions to
-push or pop these registers on the call stack, which has a very
-limited size anyway.
-.
-l0069 reg_stackptr
-l0090 reg_stackbase
+l0262 interbank_unknown1_param2_hi
+l0263 interbank_unknown1_param2_lo
+l0264 b0r15_arg1
+l0265 b0r15_arg0
+l0266 b0r15_var1
+l0267 b0r15_var2
+l0268 b0r15_var3
+l0269 b0r15_var4
+l026a b0r15_var5
+
+l026b b0r14_arg0
+l026c b0r14_arg1
+
+l0270 idx16_savehi
+l0271 idx16_savelo
+l0272 p2xxx_interrupt_status_save
+l0278 r4e_save
+l0280
+l0282 index_for_0240
+l0283 p3xxx_interrupt_status_save
+l0284 r72_save2_hi
+l0285 r72_save2_lo
+l0286 r72_save_hi
+l0287 r72_save_lo
+l028e bank1_routine1_arg
 
 l2000 call_routine0_bank0
 l2005 call_routine1_bank0
@@ -48,6 +154,7 @@
 l2046 call_routinee_bank0
 l2055 call_routine11_bank0
 l205f call_routine13_bank0
+l2064 call_routine14_bank0
 l2069 call_routine15_bank0
 l209d call_bank0_routine
 
@@ -56,6 +163,8 @@
 l20e3 call_routine7_bank1
 l20e8 call_routine8_bank1
 l20ed call_routine9_bank1
+l20f7 call_routineb_bank1
+l20fc call_routinec_bank1
 l2129 call_routine15_bank1
 l2133 call_routine17_bank1
 l2138 call_routine18_bank1
@@ -106,8 +215,23 @@
 l281B DELAYLOOP_AAX
 l281e DELAYLOOP_AX_TIMEOUT
 l2821 DELAYLOOP_AAX_TIMEOUT
+l2824 DELAYLOOP_TIMER
 l282a INIT_MEMORYBANKS
 l2830 ISUPPER
 l2833 ISLOWER
 l2836 TOUPPER
 l2839 TOLOWER
+l283c goto_3883
+l2845 goto_28a5
+l2848 goto_2c7c
+l284b goto_2a05
+l2863 interbank_unknown1
+l2866 interbank_unknown2
+l2869 do_call_routine15_bank0_with_265eq0_and_264eq6
+l286f goto_3ab6
+l2872 goto_3ac2
+l288d goto_38e3
+l2896 setbit7_7f_and_call_2845
+l289e clear_7f_and_call_2845
+
+l3537 io_wait_loop