While I find Doppelganger's SMB disassembly documentation to be an excellent body of work, he failed to mention some of the ROM addresses in it:
$90e7-$90ec (0x10f7-0x10fc)
$90e7:02 - undefined
$90e8:01 04 - ora ($04, x) @ $0000 = #$1A (address 0x10f8 can change the area music in the ground levels)
$90ea:08 - php
$90eb:10 20 - bpl $910d
$9116-$9130 (0x1126-0x1140)
$9116:28 - plp
$9117:18 - clc
$9118:38 - sec
$9119:28 - plp
$911a:08 - php
$911b:00 - brk
$911c:00 - brk
$911d:20 b0 50 - jsr $50b0
$9120:00 - brk
$9121:00 - brk
$9122:b0 b0 - bcs $90d4
$9124:f0 00 - beq $9126
$9126:20 00 00 - jsr $0000
$9129:00 - brk
$912a:00 - brk
$912b:00 - brk
$912c:00 - brk
$912d:20 04 03 - jsr $0304
$9130:02 - undefined
Thank you,
Ben (SMB2J-2Q)