Which build is which is not settled. There are several different builds of this cartridge, and what this site says about versions and regions may change. The listing and the numbers come from the binary either way, and make reproduces them.
What you see when the game is left alone isn't played by any kind of intelligence: it's 64 bytes at 0x584A carrying exactly the same bits the joystick returns, and the input reader picks up one of them every 32 frames. In between, the previous direction is held.
Even the length works out: the demo runs for 1852 steps, that is 58 of those 64 bytes, and the run ends exactly where the next routine's first instruction begins.
Between bringing the machine up and starting the game there's an ldir copying three bytes —C3 00 00, that is jp 0000h— straight over the dispatcher that runs the whole game.
On a cartridge that does nothing, because that half of the memory map is ROM and the write goes nowhere. But if the cartridge were running from a copy in RAM, the dispatcher would turn into a jump to zero and the machine would reset on the very first frame, since the game loop calls it immediately. That it does this is settled by reading the bytes; why it does it, make of it what you will.
The cartridge carries eight base names and the route has ten stops. Seven of the names cover those ten —three of them are the same one— and the eighth, NEW ZEALAND, is asked for by nobody.
This isn't an impression: it isn't among the table's ten entries, no instruction points at it, and not one of that string's twenty addresses appears as a word anywhere in the 16 KB. The other seven do show up pointed at.
Not a single graphic sits there in the raw. There's a 61-byte decompressor with four separate doors into it, and the format is one of those you can read at a glance: one byte says whether what follows is repeated so many times or is so many bytes taken as they come.
The nice part is the fourth door: it flips the bits of each byte on the way in, which on a bitmapped screen is a horizontal mirror. So the right-hand edge of the track costs not one byte more than the left: it's the same one, read backwards.
The routines that deal with the graphics chip come in pairs: one to write and its exact twin to read. Both writers are used constantly. Neither reader is called by anyone, and that can be said without hedging because one of their addresses never appears in the 16 KB at all, and the only appearance of the other is the call its own dead twin makes to it.
This game never reads the screen. It only writes.
Working out where a table ends is usually the awkward part of a disassembly, because the size isn't written down anywhere. Here nearly all of them say so: the table's last word ends exactly on the byte where its own first destination starts, so only one size is possible and there's nothing left to guess.
And there's a second house trick, this one to save instructions: three tables are pointed at one byte before they begin, because their index is never zero and that saves a dec a. The byte-zero of one of them is the last byte of a jp; of another, a stray ret.
None of this is a screen capture. It's drawn from the cartridge's own data, decompressed exactly the way the game does it and using the memory layout the game itself writes into the video chip's registers. Which makes it a check as much as an illustration: get the layout wrong and what comes out is noise, not penguins.
