one of the challenges in disassembling stuff is handling "indirect references". i don't mean indirect addressing, which is basically Pointer Math, but stuff like this:
LDA #$04 LDX #$20 ... STX $00B STA $00C ... LDA ($00B), Y
the further apart these various segments are, the harder it becomes to see; but what looks like two random values is actually being used as a pointer. with so few registers — only A, X, and Y — they're basically being used as temporary values. when both are written to $00B and $00C, later code will use the address stored there to read other things.
this makes it hard to find references, since the full address isn't encoded anywhere; it's split in half (and other code can manipulate it further).
here's what that code looks like with some cleaning up:
LDA #HIGH8(SomeCounter) ; $420 LDX #LOW8(SomeCounter) ... STX word_00B STA word_00B+1 ... LDA (word_00B), Y
naturally, a handful of things that had no references turned out to have a few sprinkled around.
