diff --git a/AmiModulePkg/Flash/SmiFlash/README.md b/AmiModulePkg/Flash/SmiFlash/README.md
index 3aea209..3607030 100644
--- a/AmiModulePkg/Flash/SmiFlash/README.md
+++ b/AmiModulePkg/Flash/SmiFlash/README.md
@@ -14,9 +14,9 @@
 ## Key Functions
 
 - **ModuleEntryPoint**: Entry point that initializes the module, registers SMI flash handlers, and sets up communication channels for flash programming requests.
-- **sub_53C**: Early initialization and SMI handler registration.
-- **sub_968**: Core dispatch logic for processing flash programming commands.
-- **sub_2288**: Error handling and cleanup path for failed flash operations.
+- **SmiFlashInitialize**: Early initialization and SMI handler registration.
+- **SmiFlashDispatch**: Core dispatch logic for processing flash programming commands.
+- **SmiFlashCleanupOnError**: Error handling and cleanup path for failed flash operations.
 
 ## Dependencies
 
@@ -27,4 +27,4 @@
 
 ## Platform
 
-HR650X server platform, x64 architecture. Runs in SMM context with system-management privileges for direct flash hardware access.
\ No newline at end of file
+HR650X server platform, x64 architecture. Runs in SMM context with system-management privileges for direct flash hardware access.
diff --git a/AmiModulePkg/Flash/SmiFlash/SmiFlash.md b/AmiModulePkg/Flash/SmiFlash/SmiFlash.md
index 809c40b..cab65c6 100644
--- a/AmiModulePkg/Flash/SmiFlash/SmiFlash.md
+++ b/AmiModulePkg/Flash/SmiFlash/SmiFlash.md
@@ -5,7 +5,7 @@
 | Address | Name | Description |
 |---------|------|-------------|
 |  | **ModuleEntryPoint** |  |
-| rbx | **sub_53C(); v4 = sub_968(ImageHandle, SystemTable); if ( v4 < 0 ) sub_2288(); return v4; }** |  |
+| rbx | **SmiFlashInitialize(); v4 = SmiFlashDispatch(ImageHandle, SystemTable); if ( v4 < 0 ) SmiFlashCleanupOnError(); return v4; }** |  |
 
 ---
-*Generated by HR650X BIOS Decompilation Project*
\ No newline at end of file
+*Generated by HR650X BIOS Decompilation Project*
diff --git a/AmiModulePkg/GenericSio/SmmGenericSio/SmmGenericSio.md b/AmiModulePkg/GenericSio/SmmGenericSio/SmmGenericSio.md
index 00c7ff4..88e2286 100644
--- a/AmiModulePkg/GenericSio/SmmGenericSio/SmmGenericSio.md
+++ b/AmiModulePkg/GenericSio/SmmGenericSio/SmmGenericSio.md
@@ -9,17 +9,15 @@
 
 ### Recovered Placeholder Mapping
 
-| Decomp Symbol | Recovered Name |
-|---------------|----------------|
-| `SmmGenericSioAutoGenConstructor` | `SmmGenericSioAutoGenConstructor` |
-| `sub_310` | `SmmGenericSioInitHook` |
-| `sub_1570` | `SmmGenericSioInitialize` |
-| `sub_18BC` | `SmmGenericSioAutoGenDestructor` |
-| `sub_3B0` | `SmmGenericSioUnload` |
-| `sub_187C` | `SmmGenericSioDebugAssert` |
-| `sub_1A5C` | `SmmGenericSioHandleInitializeError` |
-| `qword_3DA8` | `mSmmGenericSioEntryStatus` |
-| `unk_3CB0` | `mSmmGenericSioAutoGenContext` |
+| Recovered Name | Alias / Placeholder |
+|----------------|---------------------|
+| `SmmGenericSioInitialize` | `sub_1570` |
+| `SmmGenericSioAutoGenDestructor` | `sub_18BC` |
+| `SmmGenericSioUnload` | `sub_3B0` |
+| `SmmGenericSioDebugAssert` | `sub_187C` |
+| `SmmGenericSioHandleInitializeError` | `sub_1A5C` |
+| `mSmmGenericSioEntryStatus` | `qword_3DA8` |
+| `mSmmGenericSioAutoGenContext` | `unk_3CB0` |
 
 ---
 *Generated by HR650X BIOS Decompilation Project*
diff --git a/AmiModulePkg/HiiInfoEmbedded/README.md b/AmiModulePkg/HiiInfoEmbedded/README.md
index 2f0ccd6..57faf50 100644
--- a/AmiModulePkg/HiiInfoEmbedded/README.md
+++ b/AmiModulePkg/HiiInfoEmbedded/README.md
@@ -4,16 +4,16 @@
 |-------|--------|------|-------|
 | 0252  | HiiInfoEmbedded | 54,208 bytes | DXE (UEFI Shell Application) |
 
-HiiInfoEmbedded extracts Human Interface Infrastructure (HII) embedded information from the BIOS image and serializes it into a compact compressed binary format suitable for embedding into the BIOS ROM hole space. It includes a complete DEFLATE (LZ77 + Huffman coding) compression implementation. The module interfaces with the HII Database Protocol and HII String Protocol to enumerate and export all HII package lists and formset data.
+HiiInfoEmbedded extracts Human Interface Infrastructure (HII) embedded information from the BIOS image and serializes it into a compact compressed binary format suitable for embedding into the BIOS ROM hole space. It includes a complete DEFLATE (LZ77 + Huffman coding) compression implementation. The module uses the HII Database Protocol and HII String Protocol to enumerate and export HII package lists and formset data.
 
 ## Key Functions
 
-- **_ModuleEntryPoint** -- UEFI application entry point; initializes HII protocol bindings
-- **ModuleDestructor** -- Cleanup and protocol uninstall on module unload
-- **sub_2FC0** -- DEFLATE compression engine (LZ77 matching + Huffman coding)
+- **_ModuleEntryPoint** -- UEFI application entry point; initializes the HII protocol bindings
+- **ModuleDestructor** -- module cleanup and protocol uninstall on unload
+- **sub_2FC0** -- DEFLATE compression
 - **sub_3A60** -- HII package list enumeration and extraction
-- **sub_2C60** -- Output buffer management and serialization
-- **UefiBootServicesTableLib_Constructor** -- Boot services table library initialization
+- **sub_2C60** -- output buffer assembly and serialization
+- **UefiBootServicesTableLib_Constructor** -- UEFI Boot Services table library initialization
 
 ## Dependencies
 
@@ -32,4 +32,4 @@
 - **Machine:** x86-64
 - **Subsystem:** EFI Application (0x0A)
 - **Sections:** .text, .rdata, .data, section_3, .xdata, .reloc
-- **Functions:** 99
\ No newline at end of file
+- **Functions:** 99
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDisableKeyboard.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDisableKeyboard.c
new file mode 100644
index 0000000..9a94099
--- /dev/null
+++ b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDisableKeyboard.c
@@ -0,0 +1,8 @@
+// Original function: KbcEmulDisableKeyboard
+// Address: 0x6D8
+// Signature: EFI_STATUS KbcEmulDisableKeyboard()
+
+EFI_STATUS KbcEmulDisableKeyboard()
+{
+  return KbcEmulEnableDisableKeys(0);
+}
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe.c
index 310c7e7..51bfbab 100644
--- a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe.c
+++ b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe.c
@@ -151,7 +151,7 @@
 
 __int64 KbcEmulDisableKeyboard()
 {
- return sub_6E8(0);
+ return KbcEmulEnableDisableKeys(0);
 }
 
 __int64 KbcEmulPollingStub()
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_390.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_390.c
index db63c17..d59be39 100644
--- a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_390.c
+++ b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_390.c
@@ -8,22 +8,22 @@
 
   ::ImageHandle = (__int64)ImageHandle; /*0x396*/
   if ( !ImageHandle ) /*0x3a3*/
-    sub_88C( /*0x3b6*/
+    DebugPrintAssert( /*0x3b6*/
       "e:\\hs\\MdePkg\\Library\\UefiBootServicesTableLib\\UefiBootServicesTableLib.c",
       51,
       "gImageHandle != ((void *) 0)");
   ::SystemTable = (__int64)SystemTable; /*0x3bb*/
   if ( !SystemTable ) /*0x3c5*/
-    sub_88C("e:\\hs\\MdePkg\\Library\\UefiBootServicesTableLib\\UefiBootServicesTableLib.c", 57, "gST != ((void *) 0)"); /*0x3d8*/
+    DebugPrintAssert("e:\\hs\\MdePkg\\Library\\UefiBootServicesTableLib\\UefiBootServicesTableLib.c", 57, "gST != ((void *) 0)"); /*0x3d8*/
   BootServices = (__int64)SystemTable->BootServices; /*0x3e1*/
   if ( !BootServices ) /*0x3eb*/
-    sub_88C("e:\\hs\\MdePkg\\Library\\UefiBootServicesTableLib\\UefiBootServicesTableLib.c", 63, "gBS != ((void *) 0)"); /*0x3fe*/
+    DebugPrintAssert("e:\\hs\\MdePkg\\Library\\UefiBootServicesTableLib\\UefiBootServicesTableLib.c", 63, "gBS != ((void *) 0)"); /*0x3fe*/
   RuntimeServices = (__int64)SystemTable->RuntimeServices; /*0x407*/
   if ( !RuntimeServices ) /*0x411*/
-    sub_88C( /*0x424*/
+    DebugPrintAssert( /*0x424*/
       "e:\\hs\\MdePkg\\Library\\UefiRuntimeServicesTableLib\\UefiRuntimeServicesTableLib.c",
       47,
       "gRT != ((void *) 0)");
-  sub_8CC(); /*0x429*/
-  return sub_43C(v3, SystemTable); /*0x436*/
+  GetHobListFromSystemTable((__int64)ImageHandle); /*0x429*/
+  return KbcEmulDriverEntry((__int64)ImageHandle, SystemTable); /*0x436*/
 }
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_43C.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_43C.c
index c1b358c..441a521 100644
--- a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_43C.c
+++ b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_43C.c
@@ -1,18 +1,18 @@
-// Original function: sub_43C
+// Recovered function: KbcEmulDriverEntry
 // Address: 0x43C
-// Signature: __int64 __fastcall sub_43C(__int64 n33_1, EFI_SYSTEM_TABLE *SystemTable)
+// Signature: __int64 EFIAPI KbcEmulDriverEntry(__int64 n33, EFI_SYSTEM_TABLE *SystemTable)
 
-__int64 __fastcall sub_43C(__int64 n33_1, EFI_SYSTEM_TABLE *SystemTable)
+__int64 EFIAPI KbcEmulDriverEntry(__int64 n33, EFI_SYSTEM_TABLE *SystemTable)
 {
   EFI_RUNTIME_SERVICES *RuntimeServices; // rax
-  __int64 v3; // rbx
-  __int64 v4; // rax
-  __int64 n162; // rdx
-  __int64 v6; // rax
+  __int64 Status; // rbx
+  __int64 EventStatus; // rax
+  __int64 AssertLine; // rdx
+  __int64 CreateEventStatus; // rax
   _BYTE v8[56]; // [rsp+30h] [rbp-38h] BYREF
-  __int64 n33; // [rsp+70h] [rbp+8h] BYREF
+  __int64 UsbSupportDataSize; // [rsp+70h] [rbp+8h] BYREF
 
-  n33 = n33_1; /*0x43c*/
+  UsbSupportDataSize = n33; /*0x43c*/
   if ( SystemTable_0 ) /*0x44e*/
   {
     RuntimeServices = (EFI_RUNTIME_SERVICES *)RuntimeServices_0; /*0x46f*/
@@ -24,51 +24,51 @@
     RuntimeServices = SystemTable->RuntimeServices; /*0x462*/
     RuntimeServices_0 = (__int64)RuntimeServices; /*0x466*/
   }
-  n33 = 33; /*0x47b*/
+  UsbSupportDataSize = 33; /*0x47b*/
   if ( ((__int64 (__fastcall *)(const __int16 *, void *, _QWORD, __int64 *, _BYTE *))RuntimeServices->GetVariable)( /*0x4b0*/
          L"UsbSupport",
          &unk_11B0,
          0,
-         &n33,
+         &UsbSupportDataSize,
          v8) < 0
     || !v8[7] )
   {
     return 0; /*0x5c6*/
   }
-  v3 = (*(__int64 (__fastcall **)(void *, _QWORD, __int64 *))(BootServices_0 + 320))(&unk_1190, 0, &qword_1258); /*0x4d3*/
-  if ( v3 >= 0 ) /*0x4d9*/
+  Status = (*(__int64 (__fastcall **)(void *, _QWORD, __int64 *))(BootServices_0 + 320))(&unk_1190, 0, &qword_1258); /*0x4d3*/
+  if ( Status >= 0 ) /*0x4d9*/
   {
     byte_11F9 = 0; /*0x4f0*/
-    v4 = (*(__int64 (__fastcall **)(void *, void *, _QWORD, __int64 (__fastcall **)()))(BootServices_0 + 128))( /*0x505*/
+    EventStatus = (*(__int64 (__fastcall **)(void *, void *, _QWORD, __int64 (__fastcall **)()))(BootServices_0 + 128))( /*0x505*/
            &unk_1200,
            &unk_1170,
            0,
            off_11C0);
-    v3 = v4; /*0x50b*/
-    if ( v4 >= 0 ) /*0x511*/
+    Status = EventStatus; /*0x50b*/
+    if ( EventStatus >= 0 ) /*0x511*/
     {
       if ( byte_11F9 ) /*0x54b*/
       {
         word_11E0 = -29952; /*0x552*/
         n43 = 43; /*0x55e*/
-        return v3; /*0x565*/
+        return Status; /*0x565*/
       }
-      v6 = (*(__int64 (__fastcall **)(__int64, __int64, __int64 (__fastcall *)()))(BootServices_0 + 368))( /*0x59a*/
+      CreateEventStatus = (*(__int64 (__fastcall **)(__int64, __int64, __int64 (__fastcall *)()))(BootServices_0 + 368))( /*0x59a*/
              512,
              8,
-             sub_5D4);
-      v3 = v6; /*0x5a0*/
-      if ( v6 >= 0 ) /*0x5a6*/
-        return v3; /*0x5a6*/
-      sub_844(0x80000000LL, "\nASSERT_EFI_ERROR (Status = %r)\n", v6); /*0x5b7*/
-      n162 = 162; /*0x5bc*/
+             KbcEmulTimerCallback);
+      Status = CreateEventStatus; /*0x5a0*/
+      if ( CreateEventStatus >= 0 ) /*0x5a6*/
+        return Status; /*0x5a6*/
+      DebugAssertError(0x80000000LL, "\nASSERT_EFI_ERROR (Status = %r)\n", CreateEventStatus); /*0x5b7*/
+      AssertLine = 162; /*0x5bc*/
     }
     else
     {
-      sub_844(0x80000000LL, "\nASSERT_EFI_ERROR (Status = %r)\n", v4); /*0x522*/
-      n162 = 143; /*0x527*/
+      DebugAssertError(0x80000000LL, "\nASSERT_EFI_ERROR (Status = %r)\n", EventStatus); /*0x522*/
+      AssertLine = 143; /*0x527*/
     }
-    sub_88C("e:\\hs\\AmiModulePkg\\KbcEmulation\\KbcEmulDxe.c", n162, "!EFI_ERROR (Status)"); /*0x53a*/
+    DebugPrintAssert("e:\\hs\\AmiModulePkg\\KbcEmulation\\KbcEmulDxe.c", AssertLine, "!EFI_ERROR (Status)"); /*0x53a*/
   }
-  return v3; /*0x5cb*/
+  return Status; /*0x5cb*/
 }
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_5D4.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_5D4.c
index eb7b6a8..4490df6 100644
--- a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_5D4.c
+++ b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_5D4.c
@@ -1,8 +1,8 @@
-// Original function: sub_5D4
+// Recovered function: KbcEmulTimerCallback
 // Address: 0x5D4
-// Signature: __int64 sub_5D4()
+// Signature: __int64 KbcEmulTimerCallback()
 
-__int64 sub_5D4()
+__int64 KbcEmulTimerCallback()
 {
   byte_11F8 = 1; /*0x5db*/
   return (*(__int64 (**)(void))(BootServices_0 + 112))();
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_5E8.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_5E8.c
index ed0548a..b16634a 100644
--- a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_5E8.c
+++ b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_5E8.c
@@ -1,8 +1,8 @@
-// Original function: sub_5E8
+// Original function: KbcEmulIsAnyKeyReady
 // Address: 0x5E8
-// Signature: bool sub_5E8()
+// Signature: bool KbcEmulIsAnyKeyReady()
 
-bool sub_5E8()
+bool KbcEmulIsAnyKeyReady()
 {
   unsigned __int16 v0; // bx
   __int64 v1; // r14
@@ -14,7 +14,7 @@
   v1 = 0; /*0x60a*/
   v2 = (char *)&unk_11E8; /*0x60d*/
   n0xC = 0; /*0x610*/
-  while ( !(unsigned __int8)sub_9A4(v2) ) /*0x61c*/
+  while ( !(unsigned __int8)KbcEmulEntryIsValid(v2) ) /*0x61c*/
   {
     ++v1; /*0x61e*/
     n0xC += 6LL; /*0x621*/
@@ -23,6 +23,6 @@
       return (v0 & (unsigned __int16)n43) != 0; /*0x62d*/
   }
   LOBYTE(v4) = *((_BYTE *)&unk_11E8 + 6 * v1 + 5); /*0x635*/
-  v0 = sub_A74(*((unsigned __int16 *)&unk_11E8 + 3 * v1), v4); /*0x644*/
+  v0 = SioProtocolRead(*((unsigned __int16 *)&unk_11E8 + 3 * v1), v4); /*0x644*/
   return (v0 & (unsigned __int16)n43) != 0; /*0x665*/
 }
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_66C.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_66C.c
index 8bfc3c4..30f4f54 100644
--- a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_66C.c
+++ b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_66C.c
@@ -1,8 +1,8 @@
-// Original function: sub_66C
+// Original function: KbcEmulRead8042Data
 // Address: 0x66C
-// Signature: char __fastcall sub_66C(__int64 a1)
+// Signature: char __fastcall KbcEmulRead8042Data(__int64 a1)
 
-char __fastcall sub_66C(__int64 a1)
+char __fastcall KbcEmulRead8042Data(__int64 a1)
 {
   unsigned __int8 n0xA; // bl
   char v2; // di
@@ -11,7 +11,7 @@
 
   LOBYTE(a1) = 1; /*0x676*/
   n0xA = 0; /*0x67d*/
-  v2 = sub_6E8(a1); /*0x67f*/
+  v2 = KbcEmulEnableDisableKeys(a1); /*0x67f*/
   if ( v2 && !byte_11F9 && byte_11F8 ) /*0x694*/
   {
     do /*0x6c7*/
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_6D8.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_6D8.c
deleted file mode 100644
index f851f4c..0000000
--- a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_6D8.c
+++ /dev/null
@@ -1,8 +0,0 @@
-// Original function: sub_6D8
-// Address: 0x6D8
-// Signature: __int64 sub_6D8()
-
-__int64 sub_6D8()
-{
-  return sub_6E8(0);
-}
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_6E0.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_6E0.c
deleted file mode 100644
index e362901..0000000
--- a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_6E0.c
+++ /dev/null
@@ -1,8 +0,0 @@
-// Original function: sub_6E0
-// Address: 0x6E0
-// Signature: __int64 sub_6E0()
-
-__int64 sub_6E0()
-{
-  return 1; /*0x6e5*/
-}
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_6E8.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_6E8.c
index 3c7cb4a..2254d45 100644
--- a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_6E8.c
+++ b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_6E8.c
@@ -1,8 +1,8 @@
-// Original function: sub_6E8
+// Original function: KbcEmulEnableDisableKeys
 // Address: 0x6E8
-// Signature: char __fastcall sub_6E8(char a1)
+// Signature: char __fastcall KbcEmulEnableDisableKeys(char a1)
 
-char __fastcall sub_6E8(char a1)
+char __fastcall KbcEmulEnableDisableKeys(char a1)
 {
   unsigned __int16 *v2; // rdi
   __int64 n2; // rsi
@@ -15,20 +15,20 @@
   n2 = 2; /*0x70b*/
   do /*0x79e*/
   {
-    if ( (unsigned __int8)sub_9A4(v2) ) /*0x713*/
+    if ( (unsigned __int8)KbcEmulEntryIsValid(v2) ) /*0x713*/
     {
       LOBYTE(v4) = *((_BYTE *)v2 + 5); /*0x71c*/
-      v5 = sub_A74(*v2, v4); /*0x72e*/
+      v5 = SioProtocolRead(*v2, v4); /*0x72e*/
       if ( (v5 & (unsigned __int16)n43) == n43 && (v5 & (unsigned __int16)word_11E0) != 0 ) /*0x743*/
         word_1250 |= v5; /*0x745*/
       v6 = (*(__int64 (__fastcall **)(__int64))(BootServices_0 + 24))(31); /*0x762*/
-      sub_9EC((unsigned __int16)(v5 | word_11E0)); /*0x768*/
+      KbcEmulWriteAllEntries((unsigned __int16)(v5 | word_11E0)); /*0x768*/
       n43 = (unsigned __int16)n43; /*0x76d*/
       if ( a1 ) /*0x777*/
         LOWORD(n43) = v5 | n43; /*0x779*/
       else
         LOWORD(n43) = v5 & ~n43; /*0x781*/
-      sub_9EC(n43); /*0x784*/
+      KbcEmulWriteAllEntries(n43); /*0x784*/
       (*(void (__fastcall **)(__int64))(BootServices_0 + 32))(v6); /*0x793*/
     }
     v2 += 3; /*0x796*/
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_7C4.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_7C4.c
deleted file mode 100644
index f575a05..0000000
--- a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_7C4.c
+++ /dev/null
@@ -1,32 +0,0 @@
-// Original function: sub_7C4
-// Address: 0x7C4
-// Signature: __int64 sub_7C4()
-
-__int64 sub_7C4()
-{
-  __int64 result; // rax
-  unsigned __int64 n0x10; // rbx
-  __int64 v2; // rax
-  __int64 v3; // rcx
-
-  result = qword_1228; /*0x7ce*/
-  if ( !qword_1228 ) /*0x7da*/
-  {
-    n0x10 = (*(__int64 (__fastcall **)(__int64))(BootServices + 24))(31); /*0x7f3*/
-    (*(void (__fastcall **)(unsigned __int64))(BootServices + 32))(n0x10); /*0x7f6*/
-    if ( n0x10 <= 0x10 ) /*0x7fd*/
-    {
-      v2 = (*(__int64 (__fastcall **)(void *, _QWORD, __int64 *))(BootServices + 320))(&unk_1160, 0, &qword_1228); /*0x81a*/
-      v3 = qword_1228; /*0x820*/
-      if ( v2 < 0 ) /*0x82a*/
-        v3 = 0; /*0x82a*/
-      qword_1228 = v3; /*0x82e*/
-      return v3; /*0x835*/
-    }
-    else
-    {
-      return 0; /*0x7ff*/
-    }
-  }
-  return result; /*0x83d*/
-}
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_844.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_844.c
index 74217fd..c659807 100644
--- a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_844.c
+++ b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_844.c
@@ -1,18 +1,18 @@
-// Original function: sub_844
+// Original function: DebugAssertError
 // Address: 0x844
-// Signature: __int64 sub_844(__int64 a1, const char *_nASSERT_EFI_ERROR_(Status___%r)_n, ...)
+// Signature: __int64 DebugAssertError(__int64 a1, const char *_nASSERT_EFI_ERROR_(Status___%r)_n, ...)
 
-__int64 sub_844(__int64 a1, const char *_nASSERT_EFI_ERROR_(Status___%r)_n, ...)
+__int64 DebugAssertError(__int64 a1, const char *_nASSERT_EFI_ERROR_(Status___%r)_n, ...)
 {
   __int64 result; // rax
   __int64 (__fastcall **v4)(__int64, const char *, __int64 *); // r10
   va_list va; // [rsp+40h] [rbp+18h] BYREF
 
   va_start(va, _nASSERT_EFI_ERROR_(Status___%r)_n);
-  result = sub_7C4(); /*0x85b*/
+  result = GetDebugLibProtocol(); /*0x85b*/
   if ( result ) /*0x866*/
   {
-    result = sub_B38(); /*0x868*/
+    result = CmosReadComPortType(); /*0x868*/
     if ( ((unsigned int)result & (unsigned int)a1) != 0 ) /*0x873*/
       return (*v4)(a1, _nASSERT_EFI_ERROR_(Status___%r)_n, (__int64 *)va); /*0x882*/
   }
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_88C.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_88C.c
index 8bc47d7..7ac323a 100644
--- a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_88C.c
+++ b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_88C.c
@@ -1,12 +1,12 @@
-// Original function: sub_88C
+// Original function: DebugPrintAssert
 // Address: 0x88C
-// Signature: __int64 __fastcall sub_88C(__int64 a1, __int64 a2, __int64 a3)
+// Signature: __int64 __fastcall DebugPrintAssert(__int64 a1, __int64 a2, __int64 a3)
 
-__int64 __fastcall sub_88C(__int64 a1, __int64 a2, __int64 a3)
+__int64 __fastcall DebugPrintAssert(__int64 a1, __int64 a2, __int64 a3)
 {
   __int64 result; // rax
 
-  result = sub_7C4(); /*0x8a4*/
+  result = GetDebugLibProtocol(); /*0x8a4*/
   if ( result ) /*0x8ac*/
     return (*(__int64 (__fastcall **)(__int64, __int64, __int64))(result + 8))(a1, a2, a3); /*0x8b7*/
   return result; /*0x8c4*/
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_8CC.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_8CC.c
index c768df9..a6a68d6 100644
--- a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_8CC.c
+++ b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_8CC.c
@@ -1,43 +1,43 @@
-// Original function: sub_8CC
+// Original function: GetHobListFromSystemTable
 // Address: 0x8CC
-// Signature: __int64 __fastcall sub_8CC(__int64 a1)
+// Signature: __int64 __fastcall GetHobListFromSystemTable(__int64 ImageHandle)
 
-__int64 __fastcall sub_8CC(__int64 a1)
+__int64 __fastcall GetHobListFromSystemTable(__int64 ImageHandle)
 {
   __int64 result; // rax
   __int64 SystemTable; // rdi
-  unsigned __int64 v3; // rbx
-  __int64 v4; // rsi
+  unsigned __int64 Index; // rbx
+  __int64 Protocol; // rsi
 
   result = qword_1230; /*0x8db*/
   if ( !qword_1230 ) /*0x8e5*/
   {
     SystemTable = SystemTable; /*0x8eb*/
-    v3 = 0; /*0x8f2*/
+    Index = 0; /*0x8f2*/
     qword_1230 = 0; /*0x8f4*/
     if ( *(_QWORD *)(SystemTable + 104) ) /*0x8fb*/
     {
-      v4 = 0; /*0x901*/
-      while ( !(unsigned __int8)sub_B88(a1, v4 + *(_QWORD *)(SystemTable + 112)) ) /*0x911*/
+      Protocol = 0; /*0x901*/
+      while ( !(unsigned __int8)GuidCompare(ImageHandle, Protocol + *(_QWORD *)(SystemTable + 112)) ) /*0x911*/
       {
-        ++v3; /*0x913*/
-        v4 += 24; /*0x916*/
-        if ( v3 >= *(_QWORD *)(SystemTable + 104) ) /*0x91e*/
+        ++Index; /*0x913*/
+        Protocol += 24; /*0x916*/
+        if ( Index >= *(_QWORD *)(SystemTable + 104) ) /*0x91e*/
           goto LABEL_6; /*0x91e*/
       }
-      result = *(_QWORD *)(*(_QWORD *)(SystemTable + 112) + 24 * v3 + 16); /*0x994*/
+      result = *(_QWORD *)(*(_QWORD *)(SystemTable + 112) + 24 * Index + 16); /*0x994*/
       qword_1230 = result; /*0x999*/
     }
     else
     {
 LABEL_6:
-      sub_844(0x80000000LL, "\nASSERT_EFI_ERROR (Status = %r)\n", 0x800000000000000EuLL); /*0x920*/
-      sub_88C((__int64)"e:\\hs\\MdePkg\\Library\\DxeHobLib\\HobLib.c", 54, (__int64)"!EFI_ERROR (Status)"); /*0x94e*/
+      DebugAssertError(0x80000000LL, "\nASSERT_EFI_ERROR (Status = %r)\n", 0x800000000000000EuLL); /*0x920*/
+      DebugPrintAssert((__int64)"e:\\hs\\MdePkg\\Library\\DxeHobLib\\HobLib.c", 54, (__int64)"!EFI_ERROR (Status)"); /*0x94e*/
       result = qword_1230; /*0x953*/
     }
     if ( !result ) /*0x95d*/
     {
-      sub_88C((__int64)"e:\\hs\\MdePkg\\Library\\DxeHobLib\\HobLib.c", 55, (__int64)"mHobList != ((void *) 0)"); /*0x970*/
+      DebugPrintAssert((__int64)"e:\\hs\\MdePkg\\Library\\DxeHobLib\\HobLib.c", 55, (__int64)"mHobList != ((void *) 0)"); /*0x970*/
       return qword_1230; /*0x975*/
     }
   }
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_9A4.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_9A4.c
index 08a2587..1105f1c 100644
--- a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_9A4.c
+++ b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_9A4.c
@@ -1,13 +1,13 @@
-// Original function: sub_9A4
+// Recovered function: KbcEmulEntryIsValid
 // Address: 0x9A4
-// Signature: bool __fastcall sub_9A4(unsigned __int16 *a1)
+// Signature: bool KbcEmulEntryIsValid(unsigned __int16 *a1)
 
-bool __fastcall sub_9A4(unsigned __int16 *a1)
+bool KbcEmulEntryIsValid(unsigned __int16 *a1)
 {
   __int64 v3; // rdx
 
-  if ( *a1 == 0xFFFF || (unsigned int)sub_A74(*a1, 0) == -1 ) /*0x9c8*/
+  if ( *a1 == 0xFFFF || (unsigned int)SioProtocolRead(*a1, 0) == -1 ) /*0x9c8*/
     return 0; /*0x9b7*/
   LOBYTE(v3) = 8; /*0x9cd*/
-  return (unsigned int)sub_A74(*a1, v3) >> 8 == (*(_DWORD *)(a1 + 1) & 0xFFFFFF); /*0x9e5*/
+  return (unsigned int)SioProtocolRead(*a1, v3) >> 8 == (*(_DWORD *)(a1 + 1) & 0xFFFFFF); /*0x9e5*/
 }
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_9EC.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_9EC.c
index 48fbfdd..51d4d4f 100644
--- a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_9EC.c
+++ b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_9EC.c
@@ -1,8 +1,8 @@
-// Original function: sub_9EC
+// Recovered function: KbcEmulWriteAllEntries
 // Address: 0x9EC
-// Signature: char __fastcall sub_9EC(__int64 n43)
+// Signature: char __fastcall KbcEmulWriteAllEntries(__int64 n43)
 
-char __fastcall sub_9EC(__int64 n43)
+char __fastcall KbcEmulWriteAllEntries(__int64 n43)
 {
   unsigned __int16 n43_1; // si
   unsigned __int16 *v2; // rbx
@@ -15,11 +15,11 @@
   n2 = 2; /*0xa05*/
   do /*0xa2d*/
   {
-    result = sub_9A4(v2); /*0xa0d*/
+    result = KbcEmulEntryIsValid(v2); /*0xa0d*/
     if ( result ) /*0xa14*/
     {
       LOBYTE(v5) = *((_BYTE *)v2 + 5); /*0xa16*/
-      result = sub_AD0(*v2, v5, n43_1); /*0xa20*/
+      result = SioProtocolWriteData(*v2, v5, n43_1); /*0xa20*/
     }
     v2 += 3; /*0xa25*/
     --n2; /*0xa29*/
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_A40.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_A40.c
index 2a410c6..3f725f1 100644
--- a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_A40.c
+++ b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_A40.c
@@ -1,8 +1,8 @@
-// Original function: sub_A40
+// Original function: SioProtocolWrite
 // Address: 0xA40
-// Signature: __int64 __fastcall sub_A40(__int64 a1, int a2)
+// Signature: __int64 __fastcall SioProtocolWrite(__int64 a1, int a2)
 
-__int64 __fastcall sub_A40(__int64 a1, int a2)
+__int64 __fastcall SioProtocolWrite(__int64 a1, int a2)
 {
   int v3; // [rsp+48h] [rbp+10h] BYREF
 
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_A74.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_A74.c
index 0524a25..8c37b45 100644
--- a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_A74.c
+++ b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_A74.c
@@ -1,12 +1,12 @@
-// Original function: sub_A74
+// Recovered helper: SioProtocolRead
 // Address: 0xA74
-// Signature: __int64 __fastcall sub_A74(__int64 a1, char a2)
+// Signature: __int64 __fastcall SioProtocolRead(__int64 a1, char a2)
 
-__int64 __fastcall sub_A74(__int64 a1, char a2)
+__int64 __fastcall SioProtocolRead(__int64 a1, char a2)
 {
   unsigned int v4; // [rsp+48h] [rbp+10h] BYREF
 
-  sub_A40(a1, a2 & 0xFC | ((unsigned __int16)a1 << 8) | 0x80000000); /*0xa90*/
+  SioProtocolWrite(a1, a2 & 0xFC | ((unsigned __int16)a1 << 8) | 0x80000000); /*0xa90*/
   (*(void (__fastcall **)(__int64, __int64, __int64, __int64, unsigned int *))(qword_1258 + 16))( /*0xab8*/
     qword_1258,
     2,
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_AD0.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_AD0.c
deleted file mode 100644
index e15023d..0000000
--- a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_AD0.c
+++ /dev/null
@@ -1,17 +0,0 @@
-// Original function: sub_AD0
-// Address: 0xAD0
-// Signature: __int64 __fastcall sub_AD0(__int64 a1, char a2, unsigned __int16 n43)
-
-__int64 __fastcall sub_AD0(__int64 a1, char a2, unsigned __int16 n43)
-{
-  unsigned __int16 n43_1; // [rsp+48h] [rbp+10h] BYREF
-
-  sub_A40(a1, a2 & 0xFC | ((unsigned __int16)a1 << 8) | 0x80000000); /*0xaf4*/
-  n43_1 = n43; /*0xafe*/
-  return (*(__int64 (__fastcall **)(__int64, __int64, __int64, __int64, unsigned __int16 *))(qword_1258 + 24))( /*0xb32*/
-           qword_1258,
-           1,
-           (a2 & 3) + 3324LL,
-           1,
-           &n43_1);
-}
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_B38.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_B38.c
index 83b2c45..836b482 100644
--- a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_B38.c
+++ b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_B38.c
@@ -1,8 +1,8 @@
-// Original function: sub_B38
+// Original function: CmosReadComPortType
 // Address: 0xB38
-// Signature: __int64 sub_B38()
+// Signature: __int64 CmosReadComPortType()
 
-__int64 sub_B38()
+__int64 CmosReadComPortType()
 {
   unsigned __int8 v0; // al
   char n3; // al
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_B88.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_B88.c
index 9b6e6d6..0400906 100644
--- a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_B88.c
+++ b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_B88.c
@@ -1,17 +1,17 @@
-// Original function: sub_B88
+// Original function: GuidCompare
 // Address: 0xB88
-// Signature: bool __fastcall sub_B88(__int64 a1, __int64 a2)
+// Signature: bool __fastcall GuidCompare(__int64 ImageHandle, const UINT64 *Buffer)
 
-bool __fastcall sub_B88(__int64 a1, __int64 a2)
+bool __fastcall GuidCompare(__int64 ImageHandle, const UINT64 *Buffer)
 {
   __int64 v3; // rdi
   __int64 v4; // rbx
   __int64 v5; // rbp
   __int64 v6; // rax
 
-  v3 = sub_BF8((__int64)&unk_1180); /*0xbae*/
-  v4 = sub_BF8(a2); /*0xbbd*/
-  v5 = sub_BF8((__int64)&unk_1188); /*0xbc9*/
-  v6 = sub_BF8(a2 + 8); /*0xbcc*/
+  v3 = ReadUnaligned64((const UINT64 *)&unk_1180); /*0xbae*/
+  v4 = ReadUnaligned64(Buffer); /*0xbbd*/
+  v5 = ReadUnaligned64((const UINT64 *)&unk_1188); /*0xbc9*/
+  v6 = ReadUnaligned64(Buffer + 1); /*0xbcc*/
   return v3 == v4 && v5 == v6; /*0xbf0*/
 }
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_BF8.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_BF8.c
index dc604dc..7d2101d 100644
--- a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_BF8.c
+++ b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_BF8.c
@@ -1,10 +1,10 @@
-// Original function: sub_BF8
+// Original function: ReadUnaligned64
 // Address: 0xBF8
-// Signature: __int64 __fastcall sub_BF8(__int64 a1)
+// Signature: UINT64 __fastcall ReadUnaligned64(const UINT64 *Buffer)
 
-__int64 __fastcall sub_BF8(__int64 a1)
+UINT64 __fastcall ReadUnaligned64(const UINT64 *Buffer)
 {
-  if ( !a1 ) /*0xc04*/
-    sub_88C((__int64)"e:\\hs\\MdePkg\\Library\\BaseLib\\Unaligned.c", 192, (__int64)"Buffer != ((void *) 0)"); /*0xc19*/
-  return *(_QWORD *)a1; /*0xc21*/
+  if ( !Buffer ) /*0xc04*/
+    DebugPrintAssert((__int64)"e:\\hs\\MdePkg\\Library\\BaseLib\\Unaligned.c", 192, (__int64)"Buffer != ((void *) 0)"); /*0xc19*/
+  return *Buffer; /*0xc21*/
 }
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_GetDebugLibProtocol.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_GetDebugLibProtocol.c
new file mode 100644
index 0000000..afc9bc1
--- /dev/null
+++ b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_GetDebugLibProtocol.c
@@ -0,0 +1,32 @@
+// Recovered helper: GetDebugLibProtocol
+// Address: 0x7C4
+// Signature: __int64 GetDebugLibProtocol()
+
+__int64 GetDebugLibProtocol()
+{
+  __int64 result; // rax
+  unsigned __int64 n0x10; // rbx
+  __int64 v2; // rax
+  __int64 v3; // rcx
+
+  result = qword_1228; /*0x7ce*/
+  if ( !qword_1228 ) /*0x7da*/
+  {
+    n0x10 = (*(__int64 (__fastcall **)(__int64))(BootServices + 24))(31); /*0x7f3*/
+    (*(void (__fastcall **)(unsigned __int64))(BootServices + 32))(n0x10); /*0x7f6*/
+    if ( n0x10 <= 0x10 ) /*0x7fd*/
+    {
+      v2 = (*(__int64 (__fastcall **)(void *, _QWORD, __int64 *))(BootServices + 320))(&unk_1160, 0, &qword_1228); /*0x81a*/
+      v3 = qword_1228; /*0x820*/
+      if ( v2 < 0 ) /*0x82a*/
+        v3 = 0; /*0x82a*/
+      qword_1228 = v3; /*0x82e*/
+      return v3; /*0x835*/
+    }
+    else
+    {
+      return 0; /*0x7ff*/
+    }
+  }
+  return result; /*0x83d*/
+}
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_PollingStub.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_PollingStub.c
new file mode 100644
index 0000000..6eacafa
--- /dev/null
+++ b/AmiModulePkg/KbcEmulation/KbcEmulDxe/KbcEmulDxe_PollingStub.c
@@ -0,0 +1,6 @@
+// Function: KbcEmulPollingStub @ 0x6E0
+
+__int64 KbcEmulPollingStub()
+{
+  return 1; /*0x6e5*/
+}
diff --git a/AmiModulePkg/KbcEmulation/KbcEmulDxe/SioProtocolWriteData.c b/AmiModulePkg/KbcEmulation/KbcEmulDxe/SioProtocolWriteData.c
new file mode 100644
index 0000000..85d6fbb
--- /dev/null
+++ b/AmiModulePkg/KbcEmulation/KbcEmulDxe/SioProtocolWriteData.c
@@ -0,0 +1,17 @@
+// Original function: SioProtocolWriteData
+// Address: 0xAD0
+// Signature: __int64 __fastcall SioProtocolWriteData(__int64 a1, char a2, unsigned __int16 n43)
+
+__int64 __fastcall SioProtocolWriteData(__int64 a1, char a2, unsigned __int16 n43)
+{
+  unsigned __int16 n43_1; // [rsp+48h] [rbp+10h] BYREF
+
+  SioProtocolWrite(a1, a2 & 0xFC | ((unsigned __int16)a1 << 8) | 0x80000000); /*0xaf4*/
+  n43_1 = n43; /*0xafe*/
+  return (*(__int64 (__fastcall **)(__int64, __int64, __int64, __int64, unsigned __int16 *))(qword_1258 + 24))( /*0xb32*/
+           qword_1258,
+           1,
+           (a2 & 3) + 3324LL,
+           1,
+           &n43_1);
+}
diff --git a/AmiModulePkg/Recovery/ReFlash/ReFlashSmm/README.md b/AmiModulePkg/Recovery/ReFlash/ReFlashSmm/README.md
index 8c2c3c4..eb34427 100644
--- a/AmiModulePkg/Recovery/ReFlash/ReFlashSmm/README.md
+++ b/AmiModulePkg/Recovery/ReFlash/ReFlashSmm/README.md
@@ -11,10 +11,10 @@
 
 ## Key Functions
 
-- **ModuleEntryPoint** -- Standard SMM driver entry; library init and reflash setup
-- **sub_494** -- AutoGen library constructor
-- **sub_744** -- Core reflash SMM logic (flash detection, write enable, erase/program sequences)
-- **sub_10F0** -- Error handler / cleanup for reflash failures
+- **ModuleEntryPoint** -- Standard SMM driver entry and initialization
+- **ReFlashSmmConstructor** -- AutoGen library constructor
+- **ReFlashSmmCore** -- Core reflash SMM logic for flash detection, write-enable sequencing, and erase/program operations
+- **ReFlashSmmCleanup** -- Cleanup path for reflash failures
 
 ## Protocols
 
@@ -27,4 +27,4 @@
 
 - **Build:** HR6N0XMLK DEBUG_VS2015 X64
 - **Source:** AmiModulePkg/ReFlashSmm
-- **Part of:** HR650X BIOS SMM infrastructure (indices 0195-0199, 0201-0203)
\ No newline at end of file
+- **Part of:** HR650X BIOS SMM infrastructure (indices 0195-0199, 0201-0203)
diff --git a/AmiModulePkg/Recovery/ReFlash/ReFlashSmm/ReFlashSmm.md b/AmiModulePkg/Recovery/ReFlash/ReFlashSmm/ReFlashSmm.md
index 356573b..3e64262 100644
--- a/AmiModulePkg/Recovery/ReFlash/ReFlashSmm/ReFlashSmm.md
+++ b/AmiModulePkg/Recovery/ReFlash/ReFlashSmm/ReFlashSmm.md
@@ -4,8 +4,10 @@
 
 | Address | Name | Description |
 |---------|------|-------------|
-|  | **ModuleEntryPoint** |  |
-| rbx | **sub_494(ImageHandle, SystemTable); v2 = sub_744(); if ( v2 < 0 ) sub_10F0(qword_26A8); return v2; }** |  |
+|  | **ModuleEntryPoint** | Entry point and initialization |
+| rbx | **sub_494(ImageHandle, SystemTable)** | Initialization helper |
+| rbx | **sub_744()** | Core reflash logic |
+| rbx | **sub_10F0(qword_26A8)** | Cleanup path on failure |
 
 ---
-*Generated by HR650X BIOS Decompilation Project*
\ No newline at end of file
+*Generated by HR650X BIOS Decompilation Project*
diff --git a/AmiModulePkg/TCG2/Common/AmiTcgPlatformDxe/AmiTcgPlatformDxe/AmiTcgPlatformDxe.c b/AmiModulePkg/TCG2/Common/AmiTcgPlatformDxe/AmiTcgPlatformDxe/AmiTcgPlatformDxe.c
index 605630f..c22a114 100644
--- a/AmiModulePkg/TCG2/Common/AmiTcgPlatformDxe/AmiTcgPlatformDxe/AmiTcgPlatformDxe.c
+++ b/AmiModulePkg/TCG2/Common/AmiTcgPlatformDxe/AmiTcgPlatformDxe/AmiTcgPlatformDxe.c
@@ -328,7 +328,7 @@
   //
   // Save the image handle for protocol lookups.
   //
-  qword_8D68 = sub_4BC4 ();
+  qword_8D68 = (UINT64)ImageHandle;
 
   //
   // Detect TPM type (enable TPM 2.0 path if applicable).
@@ -410,17 +410,17 @@
   )
 {
   EFI_STATUS                   Status;
-  EFI_HANDLE                   Handle;
+  EFI_HANDLE                   ImageHandleHandle;
   EFI_HII_DATABASE_PROTOCOL    *HiiDatabase;
   EFI_HII_HANDLE               HiiHandle;
 
-  Handle = ImageHandle;
+  ImageHandleHandle = ImageHandle;
 
   //
   // Install the HII Package List protocol on our image handle.
   //
   BootServices->InstallMultipleProtocolInterfaces (
-                  &Handle,
+                  &ImageHandleHandle,
                   &unk_8A20,
                   off_8CB0,
                   NULL
@@ -429,17 +429,17 @@
   //
   // Locate the HII Database protocol and register the package list.
   //
-  Status = sub_5E18 ();
+  Status = RegisterAndMeasure (ImageHandle);
   if (EFI_ERROR (Status)) {
     DEBUG ((EFI_D_ERROR, "ASSERT_EFI_ERROR (Status = %r)\n", Status));
     ASSERT_EFI_ERROR (Status);
   }
 
   Status = BootServices->OpenProtocol (
-                           Handle,
+                           ImageHandleHandle,
                            &unk_8AE0,
                            &HiiHandle,
-                           Handle,
+                           ImageHandleHandle,
                            0,
                            EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL
                            );
@@ -619,7 +619,7 @@
 
   Locates the TCG2 protocol (EFI_TCG2_PROTOCOL) and performs a
   HashLogExtendEvent with larger event descriptor (44 byte header
-  vs 32 for TPM 1.2).  Used when sub_60B0() returns TRUE.
+  vs 32 for TPM 1.2).  Used when IsTpm2Present() returns TRUE.
 
   @param[in] a1  Event type.
   @param[in] a2  PCR index / event metadata.
@@ -778,7 +778,7 @@
   //
   BootServices->LocateProtocol (&unk_8C50, NULL, &TcgProtocol);
 
-  IsTpm20 = sub_60B0 ();
+  IsTpm20 = IsTpm2Present ();
 
   //
   // Locate TCG1.2 protocol for measuring during boot.
@@ -833,7 +833,7 @@
     //
     // Measure boot variables.
     //
-    if (EFI_ERROR (sub_1BCC ())) {
+    if (EFI_ERROR (MeasureSecureBootVariables ())) {
       DEBUG ((EFI_D_INFO, "Boot Variables not Measured. Error!\n"));
     }
 
@@ -857,7 +857,7 @@
                             NULL,
                             &PpiProtocol
                             ))) {
-        TpmStatus = sub_60B0 ();
+        TpmStatus = IsTpm2Present ();
         if (!TpmStatus) {
           //
           // No PPI protocol: issue TPM reset command directly.
@@ -1079,7 +1079,7 @@
       return Status;
     }
 
-    IsTpm20Local = sub_60B0 ();
+    IsTpm20Local = IsTpm2Present ();
     if (IsTpm20Local) {
       //
       // TPM 2.0 path
@@ -1092,7 +1092,7 @@
         Tpm20Response = (UINT16)((CommandResult >> 8) |
                           HIWORD (CommandResult) & 0xFF00);
         sub_61C0 (TcgProtocol, Tpm20Response);
-        if (!sub_60B0 ()) {
+        if (!IsTpm2Present ()) {
           TcgProtocolInstance->ExitBootServices (TcgProtocolInstance);
         }
         PpiFlags = 0;
@@ -1105,7 +1105,7 @@
         // TPM Disable + Deactivate
         //
         TpmSubmitCommand (TcgProtocol, 93, 0, NULL);
-        if (!sub_60B0 ()) {
+        if (!IsTpm2Present ()) {
           TcgProtocolInstance->ExitBootServices (TcgProtocolInstance);
         }
         PpiFlags = 0;
@@ -1135,7 +1135,7 @@
         Tpm20Response = (UINT16)((CommandResult >> 8) |
                           HIWORD (CommandResult) & 0xFF00);
         sub_61C0 (TcgProtocol, Tpm20Response);
-        if (!sub_60B0 ()) {
+        if (!IsTpm2Present ()) {
           TcgProtocolInstance->ExitBootServices (TcgProtocolInstance);
         }
         PpiFlags = 0;
@@ -1156,7 +1156,7 @@
         Tpm20Response = (UINT16)((CommandResult >> 8) |
                           HIWORD (CommandResult) & 0xFF00);
         sub_61C0 (TcgProtocol, Tpm20Response);
-        if (!sub_60B0 ()) {
+        if (!IsTpm2Present ()) {
           TcgProtocolInstance->ExitBootServices (TcgProtocolInstance);
         }
         PpiFlags = 0;
@@ -1169,7 +1169,7 @@
         // TPM Disable + Deactivate
         //
         TpmSubmitCommand (TcgProtocol, 93, 0, NULL);
-        if (!sub_60B0 ()) {
+        if (!IsTpm2Present ()) {
           TcgProtocolInstance->ExitBootServices (TcgProtocolInstance);
         }
         PpiFlags = 0;
@@ -1626,7 +1626,7 @@
   *(UINT32 *)((UINT8 *)&TcgCapCmd + 10) = 134283264;
   *(UINT32 *)((UINT8 *)&TcgCapCmd + 14) = 1702887424;
 
-  if (!sub_60B0 ()) {
+  if (!IsTpm2Present ()) {
     *(UINT32 *)((UINT8 *)&TcgCapCmd + 14) = 1694498816;
   }
 
@@ -1912,7 +1912,7 @@
       if (byte_8D18 != 1) {
         BOOLEAN  IsTpm20;
 
-        IsTpm20 = sub_60B0 ();
+        IsTpm20 = IsTpm2Present ();
         if (IsTpm20) {
           Status = Tcg2HashLogExtendEvent (
                      7,
@@ -1983,7 +1983,7 @@
     "Measuring image @ %x, image len = %x, pfa = %x  \n",
     ImageBase, ImageSize, Pfa));
 
-  IsTpm20 = sub_60B0 ();
+  IsTpm20 = IsTpm2Present ();
 
   if (IsTpm20) {
     //
@@ -2580,4 +2580,4 @@
   )
 {
   return;
-}
\ No newline at end of file
+}
diff --git a/AmiModulePkg/TCG2/Common/AmiTcgPlatformDxe/AmiTcgPlatformDxe/AmiTcgPlatformDxe.md b/AmiModulePkg/TCG2/Common/AmiTcgPlatformDxe/AmiTcgPlatformDxe/AmiTcgPlatformDxe.md
index 479f87d..0ad0a95 100644
--- a/AmiModulePkg/TCG2/Common/AmiTcgPlatformDxe/AmiTcgPlatformDxe/AmiTcgPlatformDxe.md
+++ b/AmiModulePkg/TCG2/Common/AmiTcgPlatformDxe/AmiTcgPlatformDxe/AmiTcgPlatformDxe.md
@@ -9,7 +9,6 @@
 |  | **sub_4860** |  |
 |  | **sub_4A10** |  |
 |  | **ModuleEntryPoint** |  |
-|  | **sub_430** |  |
 |  | **sub_69C** |  |
 |  | **sub_810** |  |
 |  | **sub_A28** |  |
@@ -251,4 +250,4 @@
 | return | **((UINT32 (*)(VOID *, UINT32, UINT32, UINT32, UINT32))(** |  |
 
 ---
-*Generated by HR650X BIOS Decompilation Project*
\ No newline at end of file
+*Generated by HR650X BIOS Decompilation Project*
diff --git a/AmiModulePkg/TCG2/Common/TcgSmm/README.md b/AmiModulePkg/TCG2/Common/TcgSmm/README.md
index df93b9e..3a731e2 100644
--- a/AmiModulePkg/TCG2/Common/TcgSmm/README.md
+++ b/AmiModulePkg/TCG2/Common/TcgSmm/README.md
@@ -14,9 +14,9 @@
 ## Key Functions
 
 - **ModuleEntryPoint**: Entry point that initializes the module and dispatches TCG SMM services.
-- **sub_4CC**: SMI handler registration and TCG protocol installation.
-- **sub_778**: Core TPM command processing and TCG event management.
-- **sub_1988**: Error handling and cleanup for failed TCG operations.
+- **SmiHandlerRegistrationAndProtocolInstall**: SMI handler registration and TCG protocol installation.
+- **TpmCommandAndEventProcessing**: Core TPM command processing and TCG event management.
+- **TcgErrorCleanup**: Error handling and cleanup for failed TCG operations.
 
 ## Dependencies
 
@@ -28,4 +28,4 @@
 
 ## Platform
 
-HR650X server platform, x64 architecture. Runs in SMM context with system-management privilege for trusted computing operations.
\ No newline at end of file
+HR650X server platform, x64 architecture. Runs in SMM context with system-management privilege for trusted computing operations.
diff --git a/AmiModulePkg/TCG2/Common/TcgSmm/TcgSmm.md b/AmiModulePkg/TCG2/Common/TcgSmm/TcgSmm.md
index d6f5eb4..f8e7924 100644
--- a/AmiModulePkg/TCG2/Common/TcgSmm/TcgSmm.md
+++ b/AmiModulePkg/TCG2/Common/TcgSmm/TcgSmm.md
@@ -4,10 +4,10 @@
 
 | Address | Name | Description |
 |---------|------|-------------|
-| Entry | **ModuleEntryPoint** | Calls `sub_4CC`, then dispatches to `sub_778(ImageHandle, SystemTable)`, invokes `sub_1988` on failure, and returns status. |
-| 0x4CC | **sub_4CC** | SMI handler registration and TCG protocol installation (documented intent). |
-| 0x778 | **sub_778** | Core TPM command processing and TCG event management (documented intent). |
-| 0x1988 | **sub_1988** | Error handling and cleanup for failed TCG operations (documented intent). |
+| Entry | **ModuleEntryPoint** | Calls `SmiHandlerRegistrationAndProtocolInstall`, then dispatches to `TpmCommandAndEventProcessing(ImageHandle, SystemTable)`, invokes `TcgErrorCleanup` on failure, and returns status. |
+| 0x4CC | **SmiHandlerRegistrationAndProtocolInstall** | SMI handler registration and TCG protocol installation. |
+| 0x778 | **TpmCommandAndEventProcessing** | Core TPM command processing and TCG event management. |
+| 0x1988 | **TcgErrorCleanup** | Error handling and cleanup for failed TCG operations. |
 
 Recovered control flow (from decompiled body):
 
@@ -18,10 +18,10 @@
   EFI_SYSTEM_TABLE  *SystemTable
 )
 {
-  sub_4CC();
-  Status = sub_778(ImageHandle, SystemTable);
+  SmiHandlerRegistrationAndProtocolInstall();
+  Status = TpmCommandAndEventProcessing(ImageHandle, SystemTable);
   if (EFI_ERROR(Status)) {
-    sub_1988();
+    TcgErrorCleanup();
   }
   return Status;
 }
diff --git a/AmiModulePkg/TCG2/Common/Tpm20PlatformDxe/Tpm20PlatformDxe/Tpm20PlatformDxe.c b/AmiModulePkg/TCG2/Common/Tpm20PlatformDxe/Tpm20PlatformDxe/Tpm20PlatformDxe.c
index 507fe57..9949d50 100644
--- a/AmiModulePkg/TCG2/Common/Tpm20PlatformDxe/Tpm20PlatformDxe/Tpm20PlatformDxe.c
+++ b/AmiModulePkg/TCG2/Common/Tpm20PlatformDxe/Tpm20PlatformDxe/Tpm20PlatformDxe.c
@@ -3,7 +3,7 @@
 
  Source: AmiModulePkg/TCG2/Common/Tpm20PlatformDxe/Tpm20PlatformDxe.c Module: Tpm20PlatformDxe.efi (Index 0072)
  Image: ~84KB, code section .text 0xF7E0 bytes, 139 functions DISCLAIMER: This is an IDA Pro decompilation of the original UEFI driver.
- Function names are derived from address offsets until semantic analysis is complete. Debug logging (sub_8E54/sub_8D8C) and ASSERT (sub_8E14)
+ Function names are derived from address offsets until semantic analysis is complete. Debug logging (DebugEnabled/DebugPrint) and ASSERT (AssertHandler)
  are inlined from MdePkg libraries.
 
 Copyright (C) 2025 American Megatrends Inc. (AMI)
@@ -58,10 +58,10 @@
  IN EFI_SYSTEM_TABLE *SystemTable
  )
 {
- UINT64 Status;
- UINT64 Status2;
- UINT64 Status3;
- UINT64 Status4;
+ UINT64 PlatformProtocolStatus;
+ UINT64 HiiDatabaseStatus;
+ UINT64 VariableLockStatus;
+ UINT64 Tcg2ProtocolStatus;
  UINT16 ProcessorFlags;
  BOOLEAN LocalApicEnabled;
  UINT64 TscDelta;
@@ -103,12 +103,13 @@
 
  // Initialize global data structures InitializeAmiTcgPpiVar ();
 
- // Locate and initialize TCG platform protocol Status = LocateTcgPlatformProtocol ();
- gTpm20PpiContext = ((UINT64 (**)(UINT64))Status)(5);
+ // Locate and initialize TCG platform protocol
+ PlatformProtocolStatus = LocateTcgPlatformProtocol ();
+ gTpm20PpiContext = ((UINT64 (**)(UINT64))PlatformProtocolStatus)(5);
 
  // Enable write protection if not already enabled if (*(INT8 *)GetMemoryConfig (1024068) >= 0) {
- Status2 = GetMemoryConfig (1024064);
- EnableWriteProtection (Status2);
+ HiiDatabaseStatus = GetMemoryConfig (1024064);
+ EnableWriteProtection (HiiDatabaseStatus);
  *((UINT8 *)GetMemoryConfig (1024068)) |= 0x80;
  }
 
@@ -127,10 +128,11 @@
  ClearInterruptFlag ();
  }
 
- // Locate HII Database protocol Status = (*(UINT64 ( **)(VOID *, UINT64, UINT64 *))(gBS + 320))(
+ // Locate HII Database protocol
+ PlatformProtocolStatus = (*(UINT64 ( **)(VOID *, UINT64, UINT64 *))(gBS + 320))(
  &gEfiHiiDatabaseProtocolGuid, 0, &gTcg2Protocol);
- if (Status < 0) {
- DebugPrint (0x80000000, "\nASSERT_EFI_ERROR (Status = %r)\n", Status);
+ if (PlatformProtocolStatus < 0) {
+ DebugPrint (0x80000000, "\nASSERT_EFI_ERROR (Status = %r)\n", PlatformProtocolStatus);
  AssertHandler (
  "e:\\hs\\MdeModulePkg\\Library\\UefiHiiServicesLib\\UefiHiiServicesLib.c",
  88,
@@ -138,10 +140,10 @@
  );
  }
 
- Status2 = (*(UINT64 ( **)(VOID *, UINT64, VOID *))(gBS + 320))(
+ HiiDatabaseStatus = (*(UINT64 ( **)(VOID *, UINT64, VOID *))(gBS + 320))(
  &gEfiHiiPackageListProtocolGuid, 0, &gEfiHiiDatabaseProtocolGuid);
- if (Status2 < 0) {
- DebugPrint (0x80000000, "\nASSERT_EFI_ERROR (Status = %r)\n", Status2);
+ if (HiiDatabaseStatus < 0) {
+ DebugPrint (0x80000000, "\nASSERT_EFI_ERROR (Status = %r)\n", HiiDatabaseStatus);
  AssertHandler (
  "e:\\hs\\MdeModulePkg\\Library\\UefiHiiServicesLib\\UefiHiiServicesLib.c",
  94,
@@ -149,10 +151,10 @@
  );
  }
 
- Status3 = (*(UINT64 ( **)(VOID *, UINT64, VOID *))(gBS + 320))(
+ VariableLockStatus = (*(UINT64 ( **)(VOID *, UINT64, VOID *))(gBS + 320))(
  &gEfiVariableLockProtocolGuid, 0, &gEfiTpm20PlatformProtocolGuid);
- if (Status3 < 0) {
- DebugPrint (0x80000000, "\nASSERT_EFI_ERROR (Status = %r)\n", Status3);
+ if (VariableLockStatus < 0) {
+ DebugPrint (0x80000000, "\nASSERT_EFI_ERROR (Status = %r)\n", VariableLockStatus);
  AssertHandler (
  "e:\\hs\\MdeModulePkg\\Library\\UefiHiiServicesLib\\UefiHiiServicesLib.c",
  100,
@@ -162,7 +164,7 @@
 
  (*(VOID ( **)(VOID *, UINT64, VOID *))(gBS + 320))(
  &gEfiTcg2ProtocolGuid, 0, &gHiiDatabaseProtocol);
- Status4 = (*(UINT64 ( **)(VOID *, UINT64, VOID *))(gBS + 320))(
+ Tcg2ProtocolStatus = (*(UINT64 ( **)(VOID *, UINT64, VOID *))(gBS + 320))(
  &gEfiHiiDatabaseProtocolGuid, 0, &gTcg2Protocol);
 }
 
@@ -1266,24 +1268,24 @@
 // ====================================================================
 
 //
-// Note: sub_B90C (0xB90C, ~9.6KB) is the SHA-256 hash compression function
+// Note: Sha256CompressionCore (0xB90C, ~9.6KB) is the SHA-256 hash compression function
 // It implements the SHA-256 message schedule and compression loop
 // (FIPS 180-4 Section 6.2).
 //
-// Note: sub_A554 (0xA554, ~4.5KB) is the SHA-512 hash compression function
+// Note: Sha512CompressionCore (0xA554, ~4.5KB) is the SHA-512 hash compression function
 // It implements the SHA-512 message schedule and compression loop
 // (FIPS 180-4 Section 6.4).
 //
-// Note: sub_4FEC (0x4FEC, ~8KB) is the HandleTpm20Ppi function.
+// Note: HandleTpm20Ppi (0x4FEC, ~8KB) is the HandleTpm20Ppi function.
 // It processes TPM PPI requests (enable/disable/clear).
 //
-// Note: sub_8FB8 (0x8FB8, ~3.6KB) is the Unicode SPrint library function
+// Note: UnicodeSPrint (0x8FB8, ~3.6KB) is the Unicode SPrint library function
 // (BasePrintLib Unicode Sprint wrapper with bounds checking).
 //
-// Note: sub_E220 (0xE220, ~1.4KB) is the SHA-512 message expansion function.
+// Note: Sha512MessageSchedule (0xE220, ~1.4KB) is the SHA-512 message expansion function.
 // It prepares the 80 64-bit words for the SHA-512 compression loop.
 //
-// Note: sub_4128 (0x4128, ~3.8KB) is the HandleSIDPpi function.
+// Note: HandleSidPpi (0x4128, ~3.8KB) is the HandleSIDPpi function.
 // It handles SID (Storage ID) PPI UI interactions.
 //
 
@@ -1301,7 +1303,7 @@
  // H0 = 0x6a09e667, H1 = 0xbb67ae85, H2 = 0x3c6ef372, H3 = 0xa54ff53a
  // H4 = 0x510e527f, H5 = 0x9b05688c, H6 = 0x1f83d9ab, H7 = 0x5be0cd19
  //
- sub_B6EC (Context);
+ Sha256InitCore (Context);
 }
 
 //
@@ -1315,7 +1317,7 @@
  IN UINTN DataLen
  )
 {
- sub_B718 (Context, Data, DataLen);
+ Sha256UpdateCore (Context, Data, DataLen);
 }
 
 //
@@ -1331,7 +1333,7 @@
  UINT16 AlgId;
 
  AlgId = 11; /*TPM2_ALG_SHA256 = 0x000B */
- sub_B7E4 (&HashData, Context);
+ Sha256FinalCore (&HashData, Context);
 }
 
 //
@@ -1345,11 +1347,11 @@
  OUT UINT8 *HashData
  )
 {
- VOID *Context;
+ VOID *Sm3Context;
 
- sub_DEB8 (Context);
- sub_DEFC (Context, Data, DataLen);
- sub_DFCC (Context, &HashData);
+ Sm3Init (Sm3Context);
+ Sm3Update (Sm3Context, Data, DataLen);
+ Sm3Final (Sm3Context, &HashData);
 }
 
 //
@@ -1361,7 +1363,7 @@
  OUT VOID *Context
  )
 {
- sub_E154 (Context);
+ Sha512InitCore (Context);
 }
 
 //
@@ -1375,7 +1377,7 @@
  IN UINTN DataLen
  )
 {
- sub_E7F8 (Context, Data, DataLen);
+ Sha512Sm3Update (Context, Data, DataLen);
 }
 
 //
@@ -1391,7 +1393,7 @@
  UINT16 AlgId;
 
  AlgId = 12; /*TPM2_ALG_SHA384 = 0x000C */
- sub_E1D8 (Context, HashData);
+ Sha384FinalCore (Context, HashData);
 }
 
 //
@@ -1407,7 +1409,7 @@
  UINT16 AlgId;
 
  AlgId = 13; /*TPM2_ALG_SHA512 = 0x000D */
- sub_E8D0 (Context, HashData);
+ Sha512FinalCore (Context, HashData);
 }
 
 //
@@ -1686,7 +1688,7 @@
  )
 {
  //
- // IDA pseudocode reference: sub_8FB8
+ // IDA pseudocode reference: UnicodeSPrint
  // Implements assertion checks for Buffer, Format, and BufferSize limits.
  // Wraps the internal BasePrintLib SPrint function.
  //
@@ -1718,7 +1720,7 @@
  )
 {
  //
- // IDA pseudocode reference: sub_E220
+ // IDA pseudocode reference: Sha512MessageSchedule
  //
  // This function:
  // 1. Loads the 1024-bit (128-byte) input block as 16 UINT64 words
@@ -1786,44 +1788,44 @@
 // Stub Forward Declarations (to be resolved with renamed functions)
 // ====================================================================
 
-// sub_17F8 -> PrepareSecureBootMeasurement
-// sub_6AC -> MeasureSidPpi
-// sub_7A80 -> InitializeTpmPlatformHardware
-// sub_7C84 -> FinalizeTpm20PlatformInit
-// sub_1EA4 -> SendEnableBlockSidCommand
-// sub_2210 -> SidPpiCallback2 (SID callback variant)
-// sub_2544 -> Tpm2BdsCallback
-// sub_6F14 -> TpmPlatformHardwareInit
-// sub_70E8 -> Tpm20PlatformReadyBoot
-// sub_7D0C -> HandleTpm20PpiRequest
-// sub_8C64 -> LocateTcgPlatformProtocol
-// sub_8D8C -> DebugPrint
-// sub_8E14 -> AssertHandler
-// sub_8E54 -> DebugEnabled
-// sub_8E58 -> DebugLevelEnabled
-// sub_8A5C -> CompareMemory
-// sub_A24C -> RegisterTpmPlatformReadyBoot
-// sub_A3EC -> InitializeAmiTcgPpiVar
-// sub_A470 -> GetMemoryConfig
-// sub_B4C -> Tpm2MeasureVariable
-// sub_B6EC -> Sha256InitCore
-// sub_B718 -> Sha256UpdateCore
-// sub_B7E4 -> Sha256FinalCore
-// sub_CCC -> MeasureGpt
-// sub_DEB8 -> Sm3Init
-// sub_DEFC -> Sm3Update
-// sub_DFCC -> Sm3Final
-// sub_E154 -> Sha512InitCore
-// sub_E1D8 -> Sha384FinalCore
-// sub_E774 -> Sha512Sm3Init
-// sub_E7F8 -> Sha512Sm3Update
-// sub_E8D0 -> Sha512FinalCore
-// sub_EEE8 -> AmiSetVariable
-// sub_EEC4 -> Tpm2PcrExtend
-// sub_F900 -> EnableWriteProtection
-// sub_F934 -> ReadTimeStampCounter
-// sub_3D0 -> CpuPause
-// sub_3E0 -> EnableInterruptFlag
-// sub_3F0 -> SetInterruptFlag
-// sub_400 -> ClearInterruptFlag
-// sub_410 -> ReadControlRegister
\ No newline at end of file
+// PrepareSecureBootMeasurement -> PrepareSecureBootMeasurement
+// MeasureSidPpi -> MeasureSidPpi
+// InitializeTpmPlatformHardware -> InitializeTpmPlatformHardware
+// FinalizeTpm20PlatformInit -> FinalizeTpm20PlatformInit
+// SendEnableBlockSidCommand -> SendEnableBlockSidCommand
+// SidPpiCallback2 (SID callback variant) -> SidPpiCallback2
+// Tpm2BdsCallback -> Tpm2BdsCallback
+// TpmPlatformHardwareInit -> TpmPlatformHardwareInit
+// Tpm20PlatformReadyBoot -> Tpm20PlatformReadyBoot
+// HandleTpm20PpiRequest -> HandleTpm20PpiRequest
+// LocateTcgPlatformProtocol -> LocateTcgPlatformProtocol
+// DebugPrint -> DebugPrint
+// AssertHandler -> AssertHandler
+// DebugEnabled -> DebugEnabled
+// DebugLevelEnabled -> DebugLevelEnabled
+// CompareMemory -> CompareMemory
+// RegisterTpmPlatformReadyBoot -> RegisterTpmPlatformReadyBoot
+// InitializeAmiTcgPpiVar -> InitializeAmiTcgPpiVar
+// GetMemoryConfig -> GetMemoryConfig
+// Tpm2MeasureVariable -> Tpm2MeasureVariable
+// Sha256InitCore -> Sha256InitCore
+// Sha256UpdateCore -> Sha256UpdateCore
+// Sha256FinalCore -> Sha256FinalCore
+// MeasureGpt -> MeasureGpt
+// Sm3Init -> Sm3Init
+// Sm3Update -> Sm3Update
+// Sm3Final -> Sm3Final
+// Sha512InitCore -> Sha512InitCore
+// Sha384FinalCore -> Sha384FinalCore
+// Sha512Sm3Init -> Sha512Sm3Init
+// Sha512Sm3Update -> Sha512Sm3Update
+// Sha512FinalCore -> Sha512FinalCore
+// AmiSetVariable -> AmiSetVariable
+// Tpm2PcrExtend -> Tpm2PcrExtend
+// EnableWriteProtection -> EnableWriteProtection
+// ReadTimeStampCounter -> ReadTimeStampCounter
+// CpuPause -> CpuPause
+// EnableInterruptFlag -> EnableInterruptFlag
+// SetInterruptFlag -> SetInterruptFlag
+// ClearInterruptFlag -> ClearInterruptFlag
+// ReadControlRegister -> ReadControlRegister
diff --git a/AmiModulePkg/TCG2/Common/Tpm20PlatformDxe/Tpm20PlatformDxe/Tpm20PlatformDxe.h b/AmiModulePkg/TCG2/Common/Tpm20PlatformDxe/Tpm20PlatformDxe/Tpm20PlatformDxe.h
index aaeb042..7ea5312 100644
--- a/AmiModulePkg/TCG2/Common/Tpm20PlatformDxe/Tpm20PlatformDxe/Tpm20PlatformDxe.h
+++ b/AmiModulePkg/TCG2/Common/Tpm20PlatformDxe/Tpm20PlatformDxe/Tpm20PlatformDxe.h
@@ -1077,7 +1077,7 @@
 
 EFI_STATUS
 EFIAPI
-pseudocode reference: sub_8FB8(
+  pseudocode reference: UnicodeSPrint(
   VOID
 );
 
@@ -1113,7 +1113,7 @@
 
 EFI_STATUS
 EFIAPI
-pseudocode reference: sub_E220(
+  pseudocode reference: Sha512MessageSchedule(
   VOID
 );
 
@@ -1387,4 +1387,4 @@
   VOID
 );
 
-#endif /* __TPM20PLATFORMDXE_H__ */
\ No newline at end of file
+#endif /* __TPM20PLATFORMDXE_H__ */
diff --git a/AmiModulePkg/TCG2/Common/Tpm20PlatformDxe/Tpm20PlatformDxe/Tpm20PlatformDxe.md b/AmiModulePkg/TCG2/Common/Tpm20PlatformDxe/Tpm20PlatformDxe/Tpm20PlatformDxe.md
index 9eae536..f89c666 100644
--- a/AmiModulePkg/TCG2/Common/Tpm20PlatformDxe/Tpm20PlatformDxe/Tpm20PlatformDxe.md
+++ b/AmiModulePkg/TCG2/Common/Tpm20PlatformDxe/Tpm20PlatformDxe/Tpm20PlatformDxe.md
@@ -191,48 +191,48 @@
 | This | **function:** |  |
 | AMI | **TCG PPI Variable Initialization** |  |
 | AMI | **Set Variable (wrapper for gRT->SetVariable)** |  |
-| Stub | **Forward Declarations (to be resolved with renamed functions)** |  |
-| sub_17F8 | **-> PrepareSecureBootMeasurement** |  |
-| sub_6AC | **-> MeasureSidPpi** |  |
-| sub_7A80 | **-> InitializeTpmPlatformHardware** |  |
-| sub_7C84 | **-> FinalizeTpm20PlatformInit** |  |
-| sub_1EA4 | **-> SendEnableBlockSidCommand** |  |
-| sub_2210 | **-> SidPpiCallback2 (SID callback variant)** |  |
-| sub_2544 | **-> Tpm2BdsCallback** |  |
-| sub_6F14 | **-> TpmPlatformHardwareInit** |  |
-| sub_70E8 | **-> Tpm20PlatformReadyBoot** |  |
-| sub_7D0C | **-> HandleTpm20PpiRequest** |  |
-| sub_8C64 | **-> LocateTcgPlatformProtocol** |  |
-| sub_8D8C | **-> DebugPrint** |  |
-| sub_8E14 | **-> AssertHandler** |  |
-| sub_8E54 | **-> DebugEnabled** |  |
-| sub_8E58 | **-> DebugLevelEnabled** |  |
-| sub_8A5C | **-> CompareMemory** |  |
-| sub_A24C | **-> RegisterTpmPlatformReadyBoot** |  |
-| sub_A3EC | **-> InitializeAmiTcgPpiVar** |  |
-| sub_A470 | **-> GetMemoryConfig** |  |
-| sub_B4C | **-> Tpm2MeasureVariable** |  |
-| sub_B6EC | **-> Sha256InitCore** |  |
-| sub_B718 | **-> Sha256UpdateCore** |  |
-| sub_B7E4 | **-> Sha256FinalCore** |  |
-| sub_CCC | **-> MeasureGpt** |  |
-| sub_DEB8 | **-> Sm3Init** |  |
-| sub_DEFC | **-> Sm3Update** |  |
-| sub_DFCC | **-> Sm3Final** |  |
-| sub_E154 | **-> Sha512InitCore** |  |
-| sub_E1D8 | **-> Sha384FinalCore** |  |
-| sub_E774 | **-> Sha512Sm3Init** |  |
-| sub_E7F8 | **-> Sha512Sm3Update** |  |
-| sub_E8D0 | **-> Sha512FinalCore** |  |
-| sub_EEE8 | **-> AmiSetVariable** |  |
-| sub_EEC4 | **-> Tpm2PcrExtend** |  |
-| sub_F900 | **-> EnableWriteProtection** |  |
-| sub_F934 | **-> ReadTimeStampCounter** |  |
-| sub_3D0 | **-> CpuPause** |  |
-| sub_3E0 | **-> EnableInterruptFlag** |  |
-| sub_3F0 | **-> SetInterruptFlag** |  |
-| sub_400 | **-> ClearInterruptFlag** |  |
-| sub_410 | **-> ReadControlRegister** |  |
+| Recovered | **Name Mapping** |  |
+| PrepareSecureBootMeasurement | **from sub_17F8** |  |
+| MeasureSidPpi | **from sub_6AC** |  |
+| InitializeTpmPlatformHardware | **from sub_7A80** |  |
+| FinalizeTpm20PlatformInit | **from sub_7C84** |  |
+| SendEnableBlockSidCommand | **from sub_1EA4** |  |
+| SidPpiCallback2 | **from sub_2210** |  |
+| Tpm2BdsCallback | **from sub_2544** |  |
+| TpmPlatformHardwareInit | **from sub_6F14** |  |
+| Tpm20PlatformReadyBoot | **from sub_70E8** |  |
+| HandleTpm20PpiRequest | **from sub_7D0C** |  |
+| LocateTcgPlatformProtocol | **from sub_8C64** |  |
+| DebugPrint | **from sub_8D8C** |  |
+| AssertHandler | **from sub_8E14** |  |
+| DebugEnabled | **from sub_8E54** |  |
+| DebugLevelEnabled | **from sub_8E58** |  |
+| CompareMemory | **from sub_8A5C** |  |
+| RegisterTpmPlatformReadyBoot | **from sub_A24C** |  |
+| InitializeAmiTcgPpiVar | **from sub_A3EC** |  |
+| GetMemoryConfig | **from sub_A470** |  |
+| Tpm2MeasureVariable | **from sub_B4C** |  |
+| Sha256Init | **from sub_B6EC** |  |
+| Sha256Update | **from sub_B718** |  |
+| Sha256Final | **from sub_B7E4** |  |
+| MeasureGpt | **from sub_CCC** |  |
+| Sm3Init | **from sub_DEB8** |  |
+| Sm3Update | **from sub_DEFC** |  |
+| Sm3Final | **from sub_DFCC** |  |
+| Sha512Init | **from sub_E154** |  |
+| Sha384Final | **from sub_E1D8** |  |
+| Sha512Sm3Init | **from sub_E774** |  |
+| Sha512Sm3Update | **from sub_E7F8** |  |
+| Sha512Final | **from sub_E8D0** |  |
+| AmiSetVariable | **from sub_EEE8** |  |
+| Tpm2PcrExtend | **from sub_EEC4** |  |
+| EnableWriteProtection | **from sub_F900** |  |
+| ReadTimeStampCounter | **from sub_F934** |  |
+| CpuPause | **from sub_3D0** |  |
+| EnableInterruptFlag | **from sub_3E0** |  |
+| SetInterruptFlag | **from sub_3F0** |  |
+| ClearInterruptFlag | **from sub_400** |  |
+| ReadControlRegister | **from sub_410** |  |
 
 ---
-*Generated by HR650X BIOS Decompilation Project*
\ No newline at end of file
+*Generated by HR650X BIOS Decompilation Project*
diff --git a/AmiModulePkg/TCG2/Common/TpmClearOnRollbackSmm/README.md b/AmiModulePkg/TCG2/Common/TpmClearOnRollbackSmm/README.md
index fb97650..d5e3fa3 100644
--- a/AmiModulePkg/TCG2/Common/TpmClearOnRollbackSmm/README.md
+++ b/AmiModulePkg/TCG2/Common/TpmClearOnRollbackSmm/README.md
@@ -14,9 +14,9 @@
 ## Key Functions
 
 - **ModuleEntryPoint**: Entry point that initializes the module and registers rollback detection handlers.
-- **sub_51C**: Rollback detection setup and SMI handler registration.
-- **sub_808**: Core rollback policy evaluation and TPM clear orchestration.
-- **sub_B10**: Cleanup and notification path for rollback events.
+- **SetupRollbackDetection**: Rollback detection setup and SMI handler registration.
+- **EvaluateRollbackPolicy**: Core rollback policy evaluation and TPM clear orchestration.
+- **CleanupRollbackNotification**: Cleanup and notification path for rollback events.
 
 ## Dependencies
 
@@ -28,4 +28,4 @@
 
 ## Platform
 
-HR650X server platform, x64 architecture. Runs in SMM context as a security-critical component protecting TPM integrity across firmware version changes.
\ No newline at end of file
+HR650X server platform, x64 architecture. Runs in SMM context as a security-critical component protecting TPM integrity across firmware version changes.
diff --git a/AmiModulePkg/TCG2/Common/TpmClearOnRollbackSmm/TpmClearOnRollbackSmm.md b/AmiModulePkg/TCG2/Common/TpmClearOnRollbackSmm/TpmClearOnRollbackSmm.md
index 47fd7b3..4318983 100644
--- a/AmiModulePkg/TCG2/Common/TpmClearOnRollbackSmm/TpmClearOnRollbackSmm.md
+++ b/AmiModulePkg/TCG2/Common/TpmClearOnRollbackSmm/TpmClearOnRollbackSmm.md
@@ -5,9 +5,9 @@
 | Address | Name | Description |
 |---------|------|-------------|
 | Entry (Module) | **ModuleEntryPoint** | UEFI SMM entry point |
-| 0x51C | **sub_51C** | Rollback detection setup and SMI handler registration |
-| 0x808 | **sub_808** | Core rollback policy evaluation and TPM clear orchestration |
-| 0xB10 | **sub_B10** | Cleanup and notification path for rollback events |
+| 0x51C | **SetupRollbackDetection** | Rollback detection setup and SMI handler registration |
+| 0x808 | **EvaluateRollbackPolicy** | Core rollback policy evaluation and TPM clear orchestration |
+| 0xB10 | **CleanupRollbackNotification** | Cleanup and notification path for rollback events |
 
 ---
 *Generated by HR650X BIOS Decompilation Project*
diff --git a/AmiModulePkg/UsbRtSmm/UsbRtSmm/README.md b/AmiModulePkg/UsbRtSmm/UsbRtSmm/README.md
index 0c3114b..0b122db 100644
--- a/AmiModulePkg/UsbRtSmm/UsbRtSmm/README.md
+++ b/AmiModulePkg/UsbRtSmm/UsbRtSmm/README.md
@@ -12,9 +12,8 @@
 ## Key Functions
 
 - **ModuleEntryPoint** -- Standard SMM entry; library init and USB SMM runtime setup
-- **sub_55C** -- Early initialization
-- **sub_928** -- Core USB SMM runtime initialization (controller detection, driver binding)
-- **sub_1B81C** -- Error handler / cleanup for USB initialization failures
+- **USB runtime initialization** -- Core USB SMM runtime initialization (controller detection, driver binding)
+- **USB init error cleanup** -- Error handler / cleanup for USB initialization failures
 
 ## Protocols
 
@@ -28,4 +27,4 @@
 
 - **Build:** HR6N0XMLK DEBUG_VS2015 X64
 - **Source:** AmiModulePkg/UsbRtSmm
-- **Part of:** HR650X BIOS SMM infrastructure (indices 0195-0199, 0201-0203)
\ No newline at end of file
+- **Part of:** HR650X BIOS SMM infrastructure (indices 0195-0199, 0201-0203)
diff --git a/AmiModulePkg/UsbRtSmm/UsbRtSmm/UsbRtSmm.md b/AmiModulePkg/UsbRtSmm/UsbRtSmm/UsbRtSmm.md
index a579c72..d03896d 100644
--- a/AmiModulePkg/UsbRtSmm/UsbRtSmm/UsbRtSmm.md
+++ b/AmiModulePkg/UsbRtSmm/UsbRtSmm/UsbRtSmm.md
@@ -4,8 +4,8 @@
 
 | Address | Name | Description |
 |---------|------|-------------|
-|  | **ModuleEntryPoint** |  |
-| rbx | **sub_55C(); v4 = sub_928(ImageHandle, SystemTable); if ( v4 < 0 ) sub_1B81C(); return v4; }** |  |
+|  | **ModuleEntryPoint** | Standard SMM entry; library init and USB SMM runtime setup |
+| rbx | **USB runtime initialization** | Core USB SMM runtime initialization path; invokes USB init error cleanup on failure |
 
 ---
-*Generated by HR650X BIOS Decompilation Project*
\ No newline at end of file
+*Generated by HR650X BIOS Decompilation Project*
diff --git a/PurleyPlatPkg/Platform/RuntimeDxe/PlatformReset/PlatformReset.c b/PurleyPlatPkg/Platform/RuntimeDxe/PlatformReset/PlatformReset.c
index c93849e..b8a9712 100644
--- a/PurleyPlatPkg/Platform/RuntimeDxe/PlatformReset/PlatformReset.c
+++ b/PurleyPlatPkg/Platform/RuntimeDxe/PlatformReset/PlatformReset.c
@@ -23,7 +23,7 @@
 // ZeroMem() - ZeroMem wrapper from BaseMemoryLibRepStr
 // Address: 0x1000
 //
-VOID *EFIAPI sub_1000 (
+VOID *EFIAPI ZeroMemWrapper (
  IN VOID *Buffer,
  IN UINTN Length
  )
@@ -36,7 +36,7 @@
 // CpuPause() - Yield CPU (pause instruction)
 // Address: 0x10D0
 //
-VOID sub_10D0 (VOID)
+VOID CpuPauseWrapper (VOID)
 {
  CpuPause ();
 }
@@ -45,7 +45,7 @@
 // AsmReadTsc() - Read Time-Stamp Counter
 // Address: 0x10E0
 //
-UINT64 sub_10E0 (VOID)
+UINT64 AsmReadTscWrapper (VOID)
 {
  return AsmReadTsc ();
 }
@@ -54,7 +54,7 @@
 // EnableInterrupts()
 // Address: 0x10F0
 //
-VOID sub_10F0 (VOID)
+VOID EnableInterruptsWrapper (VOID)
 {
  EnableInterrupts ();
 }
@@ -63,16 +63,16 @@
 // DisableInterrupts()
 // Address: 0x1100
 //
-VOID sub_1100 (VOID)
+VOID DisableInterruptsWrapper (VOID)
 {
  DisableInterrupts ();
 }
 
 //
-// sub_1110() - Read EFLAGS (caller's interrupt state)
+// AsmReadEflags() - Read EFLAGS (caller's interrupt state)
 // Address: 0x1110
 //
-UINTN sub_1110 (VOID)
+UINTN AsmReadEflagsWrapper (VOID)
 {
  return AsmReadEflags ();
 }
@@ -133,11 +133,11 @@
  v3 = *(_QWORD *)(a2 + 96); /*0x11f2*/
  qword_40D8 = *(_QWORD *)(a2 + 88); /*0x11f9*/
  qword_40F0 = v3; /*0x120c*/
- (*(void ( **)(__int64, __int64, __int64 ( *)()))(v3 + 80))(513, 8, sub_1BF4); /*0x121e*/
+ (*(void ( **)(__int64, __int64, __int64 ( *)()))(v3 + 80))(513, 8, ClearBootServicesPointerNotify); /*0x121e*/
  (*(void ( **)(__int64, __int64, __int64 ( *)(), _QWORD, __int64 *))(qword_40F0 + 80))( /*0x1246*/
  1610613250,
  8,
- sub_1C00,
+ ExitBootServicesNotify,
  0,
  &qword_40E8);
  v4 = EfiGetSystemConfigurationTable(&unk_40A0, &qword_4100); /*0x1257*/
@@ -168,7 +168,7 @@
  if ( !qword_4108 ) /*0x1337*/
  DebugAssert("e:\\hs\\CpRcPkg\\Library\\DxeMmPciBaseLib\\DxeMmPciBaseLib.c", 53, "mPciUsra != ((void *) 0)"); /*0x134c*/
  }
- GetHobList(); /*0x1351*/
+ GetHobListPointer(); /*0x1351*/
  if ( !qword_40D0 ) /*0x135e*/
  DebugAssert("e:\\hs\\MdePkg\\Library\\UefiRuntimeLib\\RuntimeLib.c", 95, "gRT != ((void *) 0)"); /*0x1373*/
  v7 = qword_40C0; /*0x1378*/
@@ -178,7 +178,7 @@
  v7 = qword_40C0; /*0x139b*/
  }
  qword_4160 = qword_40D0; /*0x13b0*/
- v8 = (*(__int64 ( **)(__int64, __int64, __int64 ( *)()))(v7 + 368))(512, 16, sub_1D78); /*0x13de*/
+ v8 = (*(__int64 ( **)(__int64, __int64, __int64 ( *)()))(v7 + 368))(512, 16, ConvertRuntimePointersNotify); /*0x13de*/
  if ( v8 < 0 ) /*0x13e8*/
  {
  DebugPrint(0x80000000LL, "\nASSERT_EFI_ERROR (Status = %r)\n", v8); /*0x13f3*/
@@ -187,7 +187,7 @@
  v9 = (*(__int64 ( **)(__int64, __int64, __int64 ( *)(), _QWORD, void *, __int64 *))(qword_40C0 + 368))( /*0x143d*/
  512,
  16,
- sub_1D70,
+ SetVirtualAddressMapNotify,
  0,
  &unk_4080,
  &qword_4168);
@@ -202,12 +202,12 @@
  436,
  "!EFI_ERROR (Status)");
  }
- v11 = GetPcdProtocol(); /*0x148f*/
+ v11 = GetPcdProtocolPointer(); /*0x148f*/
  qword_4130 = (*(__int64 ( **)(__int64))(v11 + 32))(5); /*0x149c*/
  v12 = (*(__int64 ( **)(__int64, __int64, __int64 ( *)(), _QWORD, void *, __int64 *))(qword_40C0 + 368))( /*0x14d4*/
  512,
  16,
- sub_1D9C,
+ RuntimePciExpressCleanupNotify,
  0,
  &unk_4090,
  &qword_4140);
@@ -222,24 +222,24 @@
  439,
  "!EFI_ERROR (Status)");
  }
- if ( *(char *)PciExpressGetConfigAddress(1024068) >= 0 ) /*0x1536*/
+ if ( *(char *)GetPciExpressMmioConfigSpaceAddress(1024068) >= 0 ) /*0x1536*/
  {
- v14 = PciExpressGetConfigAddress(1024064); /*0x153b*/
- IoWrite16(v14); /*0x1543*/
- v15 = (_BYTE *)PciExpressGetConfigAddress(1024068); /*0x154a*/
+ v14 = GetPciExpressMmioConfigSpaceAddress(1024064); /*0x153b*/
+ IoWrite16Wrapper(v14); /*0x1543*/
+ v15 = (_BYTE *)GetPciExpressMmioConfigSpaceAddress(1024068); /*0x154a*/
  *v15 |= 0x80u; /*0x1554*/
  }
- v16 = sub_1110(); /*0x155b*/
- sub_1100(); /*0x155e*/
+ v16 = AsmReadEflagsWrapper(); /*0x155b*/
+ DisableInterruptsWrapper(); /*0x155e*/
  v17 = (v16 & 0x200) != 0; /*0x156d*/
- v18 = IoRead32(1288) & 0xFFFFFF; /*0x1577*/
- sub_10E0(); /*0x157d*/
- for ( i = IoRead32(1288); (((_DWORD)v18 + 357 - i) & 0x800000) == 0; i = IoRead32(1288) ) /*0x1584*/
- sub_10D0(); /*0x1591*/
- sub_10E0(); /*0x15ab*/
+ v18 = IoRead32Wrapper(1288) & 0xFFFFFF; /*0x1577*/
+ AsmReadTscWrapper(); /*0x157d*/
+ for ( i = IoRead32Wrapper(1288); (((_DWORD)v18 + 357 - i) & 0x800000) == 0; i = IoRead32Wrapper(1288) ) /*0x1584*/
+ CpuPauseWrapper(); /*0x1591*/
+ AsmReadTscWrapper(); /*0x15ab*/
  if ( v17 ) /*0x15b2*/
- return sub_10F0(); /*0x15b4*/
- else return sub_1100(); /*0x15bb*/
+ return EnableInterruptsWrapper(); /*0x15b4*/
+ else return DisableInterruptsWrapper(); /*0x15bb*/
 }
 
 //
@@ -250,7 +250,7 @@
 __int64 PlatformResetUnload()
 {
  __int64 v0; // rax __int64 v1; // rbx __int64 v2; // rax __int64 v3; // rax __int64 v4; // rax __int64 v5; // rbx if ( qword_4120 ) /*0x15f9*/
- sub_2058(); /*0x15fb*/
+ FreeRuntimePciExpressMap(); /*0x15fb*/
  v0 = (*(__int64 ( **)(__int64))(qword_40C0 + 112))(qword_4140); /*0x160e*/
  v1 = v0; /*0x1624*/
  if ( v0 < 0 ) /*0x162a*/
@@ -313,7 +313,7 @@
  "e:\\hs\\PurleyPlatPkg\\Platform\\RuntimeDxe\\PlatformReset\\PlatformReset.c",
  174,
  "&gEfiResetArchProtocolGuid already installed in database");
- SystemTable->RuntimeServices->ResetSystem = (EFI_RESET_SYSTEM)sub_1908; /*0x1812*/
+ SystemTable->RuntimeServices->ResetSystem = (EFI_RESET_SYSTEM)PlatformResetSystem; /*0x1812*/
  v7 = 0; /*0x1822*/
  v4 = (*(__int64 ( **)(__int64 *, void *, _QWORD, _QWORD))(qword_40C0 + 328))(&v7, &unk_4010, 0, 0); /*0x1828*/
  if ( v4 < 0 ) /*0x1831*/
@@ -321,13 +321,13 @@
  DebugPrint(0x80000000LL, "\nASSERT_EFI_ERROR (Status = %r)\n", v4); /*0x1840*/
  DebugAssert("e:\\hs\\PurleyPlatPkg\\Platform\\RuntimeDxe\\PlatformReset\\PlatformReset.c", 191, "!EFI_ERROR (Status)"); /*0x1858*/
  }
- v5 = (*(__int64 ( **)(__int64, __int64, __int64 ( *)()))(qword_40C0 + 368))(512, 16, sub_1A30); /*0x188f*/
+ v5 = (*(__int64 ( **)(__int64, __int64, __int64 ( *)()))(qword_40C0 + 368))(512, 16, SaveOriginalResetSystemNotify); /*0x188f*/
  if ( v5 < 0 ) /*0x1898*/
  {
  DebugPrint(0x80000000LL, "\nASSERT_EFI_ERROR (Status = %r)\n", v5); /*0x18a7*/
  DebugAssert("e:\\hs\\PurleyPlatPkg\\Platform\\RuntimeDxe\\PlatformReset\\PlatformReset.c", 206, "!EFI_ERROR (Status)"); /*0x18bf*/
  }
- return (*(__int64 ( **)(__int64, __int64, __int64 ( *)()))(qword_40C0 + 368))(512, 8, nullsub_1); /*0x18fe*/
+ return (*(__int64 ( **)(__int64, __int64, __int64 ( *)()))(qword_40C0 + 368))(512, 8, NullNotification); /*0x18fe*/
 }
 
 //
@@ -358,7 +358,7 @@
  }
  (*(void ( **)(__int64))(qword_40C0 + 112))(qword_40B0); /*0x1988*/
  }
- sub_1A48(&v6, 1); /*0x1995*/
+ ZeroMemValidated(&v6, 1); /*0x1995*/
  if ( !byte_4118 /*0x19c6*/
  && n3_1 <= 1
  && (*(__int64 ( **)(void *, _QWORD, void ( ***)(char *)))(qword_40C0 + 320))(&unk_4000, 0, &v5) >= 0 )
@@ -381,27 +381,27 @@
 }
 
 //
-// nullsub_1 - Null notification function
+// NullNotification - Null notification function
 // Address: 0x1904
 //
-VOID nullsub_1 (VOID)
+VOID NullNotification (VOID)
 {
 }
 
 //
-// sub_1A30 - Save the original ResetSystem pointer to mOriginalResetSystem
+// SaveOriginalResetSystemNotify - Save the original ResetSystem pointer to mOriginalResetSystem
 // Address: 0x1A30
 //
-__int64 sub_1A30()
+__int64 SaveOriginalResetSystemNotify()
 {
  return (*(__int64 ( **)(__int64, __int64 *))(qword_40D0 + 64))(4, &qword_4170);
 }
 
 //
-// sub_1A48 - ZeroMem with validation (BaseMemoryLib wrapper)
+// ZeroMemValidated - ZeroMem with validation (BaseMemoryLib wrapper)
 // Address: 0x1A48
 //
-__int64 sub_1A48(__int64 a1, unsigned __int64 a2)
+__int64 ZeroMemValidated(__int64 a1, unsigned __int64 a2)
 {
  if ( !a1 ) /*0x1a5b*/
  DebugAssert("e:\\hs\\MdePkg\\Library\\BaseMemoryLibRepStr\\ZeroMemWrapper.c", 53, "Buffer != ((void *) 0)"); /*0x1a6e*/
@@ -410,14 +410,14 @@
  "e:\\hs\\MdePkg\\Library\\BaseMemoryLibRepStr\\ZeroMemWrapper.c",
  54,
  "Length <= (0xFFFFFFFFFFFFFFFFULL - (UINTN)Buffer + 1)");
- return sub_1000(a1, a2); /*0x1aa1*/
+ return ZeroMemWrapper(a1, a2); /*0x1aa1*/
 }
 
 //
-// sub_1AAC - Get the Debug Output protocol for ASSERT/DEBUG output
+// GetDebugOutputProtocol - Get the Debug Output protocol for ASSERT/DEBUG output
 // Address: 0x1AAC
 //
-__int64 sub_1AAC()
+__int64 GetDebugOutputProtocol()
 {
  __int64 result; // rax unsigned __int64 n0x10; // rbx __int64 v2; // rax __int64 v3; // rcx result = qword_40F8; /*0x1ab6*/
  if ( !qword_40F8 ) /*0x1ac2*/
@@ -443,13 +443,13 @@
 }
 
 //
-// sub_1B34 - Debug print wrapper (supports NMI lock via CMOS 0x4B)
+// DebugPrintWrapper - Debug print wrapper (supports NMI lock via CMOS 0x4B)
 // Address: 0x1B34
 //
-__int64 sub_1B34(__int64 a1, const char *a2, ...)
+__int64 DebugPrintWrapper(__int64 a1, const char *a2, ...)
 {
  __int64 result; // rax __int64 v4; // r8 __int64 ( **v5)(__int64, const char *, __int64 *); // r9 unsigned __int8 v6; // al unsigned __int8 n3; // al int n113; // edx va_list va; // [rsp+40h] [rbp+18h] BYREF va_start(va, a2);
- result = sub_1AAC(); /*0x1b4b*/
+ result = GetDebugOutputProtocol(); /*0x1b4b*/
  v4 = 0; /*0x1b50*/
  v5 = (__int64 ( **)(__int64, const char *, __int64 *))result; /*0x1b53*/
  if ( result ) /*0x1b59*/
@@ -480,31 +480,31 @@
 }
 
 //
-// sub_1BB4 - Debug assert (via Debug Output protocol)
+// DebugAssertWrapper - Debug assert (via Debug Output protocol)
 // Address: 0x1BB4
 //
-__int64 sub_1BB4(__int64 a1, __int64 a2, __int64 a3)
+__int64 DebugAssertWrapper(__int64 a1, __int64 a2, __int64 a3)
 {
- __int64 result; // rax result = sub_1AAC(); /*0x1bcc*/
+ __int64 result; // rax result = GetDebugOutputProtocol(); /*0x1bcc*/
  if ( result ) /*0x1bd4*/
  return (*(__int64 ( **)(__int64, __int64, __int64))(result + 8))(a1, a2, a3); /*0x1bdf*/
  return result; /*0x1bec*/
 }
 
 //
-// sub_1BF4 - BS event notification: clear gBS pointer
+// ClearBootServicesPointerNotify - BS event notification: clear gBS pointer
 // Address: 0x1BF4
 //
-VOID sub_1BF4 (VOID)
+VOID ClearBootServicesPointerNotify (VOID)
 {
  gBS = NULL;
 }
 
 //
-// sub_1C00 - ExitBootServices notification handler
+// ExitBootServicesNotify - ExitBootServices notification handler
 // Address: 0x1C00
 //
-VOID sub_1C00 (VOID)
+VOID ExitBootServicesNotify (VOID)
 {
  if (mDebugOutputProtocol != NULL) {
  gRT->FreePool (mDebugOutputProtocol);
@@ -514,10 +514,10 @@
 STATIC VOID *mDebugOutputProtocol = NULL; // 0x40F8
 
 //
-// sub_1C28 - Get system configuration table by GUID (UefiLib wrapper)
+// GetSystemConfigurationTableByGuid - Get system configuration table by GUID (UefiLib wrapper)
 // Address: 0x1C28
 //
-unsigned __int64 sub_1C28(__int64 a1, _QWORD *a2)
+unsigned __int64 GetSystemConfigurationTableByGuid(__int64 a1, _QWORD *a2)
 {
  __int64 v4; // rdi __int64 v5; // rbx __int64 i; // r14 if ( !a1 ) /*0x1c4a*/
  DebugAssert((__int64)"e:\\hs\\MdePkg\\Library\\UefiLib\\UefiLib.c", 97, (__int64)"TableGuid != ((void *) 0)"); /*0x1c5d*/
@@ -528,7 +528,7 @@
  *a2 = 0; /*0x1c86*/
  if ( !*(_QWORD *)(v4 + 104) ) /*0x1c8a*/
  return 0x800000000000000EuLL; /*0x1cb3*/
- for ( i = 0; !(unsigned __int8)sub_1ED0(a1, i + *(_QWORD *)(v4 + 112)); i += 24 ) /*0x1c90*/
+ for ( i = 0; !(unsigned __int8)CompareGuid64(a1, i + *(_QWORD *)(v4 + 112)); i += 24 ) /*0x1c90*/
  {
  if ( (unsigned __int64)++v5 >= *(_QWORD *)(v4 + 104) ) /*0x1cb1*/
  return 0x800000000000000EuLL; /*0x1cb1*/
@@ -538,15 +538,15 @@
 }
 
 //
-// sub_1CEC - Get HOB list pointer (HobLib wrapper)
+// GetHobListPointer - Get HOB list pointer (HobLib wrapper)
 // Address: 0x1CEC
 //
-__int64 sub_1CEC()
+__int64 GetHobListPointer()
 {
  __int64 result; // rax signed __int64 v1; // rax result = qword_4110; /*0x1cf0*/
  if ( !qword_4110 ) /*0x1cfa*/
  {
- v1 = sub_1C28((__int64)&unk_4060, &qword_4110); /*0x1d0a*/
+ v1 = GetSystemConfigurationTableByGuid((__int64)&unk_4060, &qword_4110); /*0x1d0a*/
  if ( v1 < 0 ) /*0x1d12*/
  {
  DebugPrint(0x80000000LL, "\nASSERT_EFI_ERROR (Status = %r)\n", v1); /*0x1d23*/
@@ -563,29 +563,29 @@
 }
 
 //
-// sub_1D70 - SetVirtualAddressMap notification: mark VA map done
+// SetVirtualAddressMapNotify - SetVirtualAddressMap notification: mark VA map done
 // Address: 0x1D70
 //
-VOID sub_1D70 (VOID)
+VOID SetVirtualAddressMapNotify (VOID)
 {
  mRuntimeVirtualAddrMapDone = TRUE;
 }
 
 //
-// sub_1D78 - Runtime event: convert RT pointers for virtual address mode
+// ConvertRuntimePointersNotify - Runtime event: convert RT pointers for virtual address mode
 // Address: 0x1D78
 //
-VOID sub_1D78 (VOID)
+VOID ConvertRuntimePointersNotify (VOID)
 {
  EfiConvertPointer (0, &mRuntimeServices);
  mRuntimePciExpressInitialized = TRUE;
 }
 
 //
-// sub_1D9C - Runtime PCI Express address map cleanup
+// RuntimePciExpressCleanupNotify - Runtime PCI Express address map cleanup
 // Address: 0x1D9C
 //
-__int64 sub_1D9C()
+__int64 RuntimePciExpressCleanupNotify()
 {
  __int64 result; // rax unsigned __int64 v1; // rbx __int64 v2; // rdi result = qword_4120; /*0x1da6*/
  v1 = 0; /*0x1dad*/
@@ -610,11 +610,11 @@
 }
 
 //
-// sub_1E0C - Get PCI Express MMIO config space address
+// GetPciExpressMmioConfigSpaceAddress - Get PCI Express MMIO config space address
 // Resolves a PCI Express address to its MMIO base + offset.
 // Address: 0x1E0C
 //
-__int64 sub_1E0C(__int64 n1024064)
+__int64 GetPciExpressMmioConfigSpaceAddress(__int64 n1024064)
 {
  __int64 v2; // rbx unsigned __int64 v3; // rax _QWORD *v4; // rcx if ( (n1024064 & 0xFFFFFFFFF0000000uLL) != 0 ) /*0x1e1c*/
  DebugAssert( /*0x1e31*/
@@ -656,23 +656,23 @@
 }
 
 //
-// sub_1ED0 - Compare two GUIDs for equality (ReadUnaligned64 wrapper)
+// CompareGuid64 - Compare two GUIDs for equality (ReadUnaligned64 wrapper)
 // Address: 0x1ED0
 //
-bool sub_1ED0(__int64 a1, __int64 a2)
+bool CompareGuid64(__int64 a1, __int64 a2)
 {
- __int64 v4; // rsi __int64 v5; // rbx __int64 v6; // rdi __int64 v7; // rax v4 = ((__int64 (*)(void))sub_1F38)(); /*0x1ef2*/
- v5 = sub_1F38(a2); /*0x1efe*/
- v6 = sub_1F38(a1 + 8); /*0x1f0a*/
- v7 = sub_1F38(a2 + 8); /*0x1f0d*/
+ __int64 v4; // rsi __int64 v5; // rbx __int64 v6; // rdi __int64 v7; // rax v4 = ((__int64 (*)(void))ReadUnaligned64)(); /*0x1ef2*/
+ v5 = ReadUnaligned64(a2); /*0x1efe*/
+ v6 = ReadUnaligned64(a1 + 8); /*0x1f0a*/
+ v7 = ReadUnaligned64(a2 + 8); /*0x1f0d*/
  return v4 == v5 && v6 == v7; /*0x1f31*/
 }
 
 //
-// sub_1F38 - Read unaligned 64-bit value (BaseLib wrapper)
+// ReadUnaligned64 - Read unaligned 64-bit value (BaseLib wrapper)
 // Address: 0x1F38
 //
-__int64 sub_1F38(__int64 a1)
+__int64 ReadUnaligned64(__int64 a1)
 {
  if ( !a1 ) /*0x1f44*/
  DebugAssert((__int64)"e:\\hs\\MdePkg\\Library\\BaseLib\\Unaligned.c", 192, (__int64)"Buffer != ((void *) 0)"); /*0x1f59*/
@@ -680,10 +680,10 @@
 }
 
 //
-// sub_1F68 - Get the PCD protocol pointer
+// GetPcdProtocolPointer - Get the PCD protocol pointer
 // Address: 0x1F68
 //
-__int64 sub_1F68()
+__int64 GetPcdProtocolPointer()
 {
  __int64 result; // rax __int64 v1; // rax result = qword_4148; /*0x1f6c*/
  if ( !qword_4148 ) /*0x1f76*/
@@ -705,10 +705,10 @@
 }
 
 //
-// sub_1FF4 - Write 16-bit I/O port (IoLib wrapper)
+// IoWrite16Wrapper - Write 16-bit I/O port (IoLib wrapper)
 // Address: 0x1FF4
 //
-__int64 sub_1FF4(_WORD *a1)
+__int64 IoWrite16Wrapper(_WORD *a1)
 {
  if ( ((unsigned __int8)a1 & 1) != 0 ) /*0x2000*/
  DebugAssert((__int64)"e:\\hs\\MdePkg\\Library\\BaseIoLibIntrinsic\\IoLib.c", 183, (__int64)"(Address & 1) == 0"); /*0x2015*/
@@ -717,10 +717,10 @@
 }
 
 //
-// sub_2028 - Read 32-bit I/O port (IoLib wrapper)
+// IoRead32Wrapper - Read 32-bit I/O port (IoLib wrapper)
 // Address: 0x2028
 //
-unsigned __int32 sub_2028(unsigned __int16 n1288)
+unsigned __int32 IoRead32Wrapper(unsigned __int16 n1288)
 {
  if ( (n1288 & 3) != 0 ) /*0x2034*/
  DebugAssert((__int64)"e:\\hs\\MdePkg\\Library\\BaseIoLibIntrinsic\\IoLibMsc.c", 193, (__int64)"(Port & 3) == 0"); /*0x2049*/
@@ -728,10 +728,10 @@
 }
 
 //
-// sub_2058 - Free pool memory (MemoryAllocationLib wrapper)
+// FreeRuntimePciExpressMap - Free pool memory (MemoryAllocationLib wrapper)
 // Address: 0x2058
 //
-__int64 sub_2058()
+__int64 FreeRuntimePciExpressMap()
 {
  __int64 result; // rax result = (*(__int64 ( **)(__int64))(qword_40C0 + 72))(qword_4120); /*0x206a*/
  if ( result < 0 ) /*0x2070*/
diff --git a/PurleyPlatPkg/Ras/Memory/MemRas/MemRas.c b/PurleyPlatPkg/Ras/Memory/MemRas/MemRas.c
index 4129c1f..b596ff2 100644
--- a/PurleyPlatPkg/Ras/Memory/MemRas/MemRas.c
+++ b/PurleyPlatPkg/Ras/Memory/MemRas/MemRas.c
@@ -12,21 +12,21 @@
  *
  * ModuleEntryPoint() [0x5CC]
  *   |
- *   +-> MemRasInitGlobals() [sub_AF90, 0xAF90]
+ *   +-> MemRasInitGlobals() [MemRasInitGlobals, 0xAF90]
  *   |     Allocates global context, calls ~23 sub-initializers in sequence
  *   |
- *   +-> MemRasDriverEntry() [sub_B724, 0xB724]
+ *   +-> MemRasDriverEntry() [MemRasDriverEntry, 0xB724]
  *   |     Allocates protocol structures, populates function table,
  *   |     reads platform config, installs protocol, registers events
- *   |     Calls: sub_10E20() (S3 save events) + sub_17BCC() (VLS init)
+ *   |     Calls: MemRasS3SaveRegister() (S3 save events) + InitializeVLSInfo() (VLS init)
  *   |
- *   +-> MemRasSecondaryInit() [sub_B6AC, 0xB6AC]
- *         Calls sub_B724() if context not already initialized
+ *   +-> MemRasSecondaryInit() [MemRasSecondaryInit, 0xB6AC]
+ *         Calls MemRasDriverEntry() if context not already initialized
  *         Sets global status to 0x8000000000000001 if failed
  *
  *   On failure (entry point):
  *     +-> MemRasFallbackInit() [0xB56C]
- *           Calls sub_39BC() + sub_2290() + sub_1220()
+ *           Calls PlatformRasInit() + RegisterMemoryErrorEvents() + S3BootScriptSaveInit()
  *
  * ============================================================================
  * Memory Layout
@@ -45,62 +45,62 @@
  *
  * Offset  Function     Description
  * ------  -----------  -----------------------------------------------
- *  0x0A0  sub_DB54     Init - per-socket initialization
- *  0x0A8  sub_1430     Init2 - stub (returns success)
- *  0x0B0  sub_1A4CC    SpareRank - start sparing on rank
- *  0x0B8  sub_19DA4    Alternate spare rank path
- *  0x0C0  sub_1A610    SpareCopy - handle spare copy done
- *  0x0E0  sub_CCC4     GetFailedDimmErrorInfo
- *  0x108  sub_1B1D0    CheckAndHandleNewRankSparingEvent
- *  0x110  sub_F800     HandlePatrolCompleteEventForNode
- *  0x118  sub_F694     HandleSpareRankUCEvent
- *  0x120  sub_1BB28    SpareCopyDone handler
- *  0x130  sub_E730     S3BootScriptSave
- *  0x138  sub_1AB5C    Compare GUID / HOB lookup
- *  0x140  sub_1B6AC    Check rank state
- *  0x148  sub_C47C     ForEachChannel - iterate channels
- *  0x150  sub_CA34     Check rank state per MC
- *  0x158  sub_CA28     Check rank state per channel (stub)
- *  0x160  sub_DAA4     GetSystemAddress (channel addr -> sys addr)
- *  0x168  sub_C39C     GetChannelAddress (rank addr -> channel addr)
- *  0x170  sub_D6C0     Address translation
- *  0x178  sub_DC34     GetRankAddress
- *  0x180  sub_DE7C     ReverseAddressTranslate
- *  0x0F0  sub_15010    DisableMemoryMigration
- *  0x0F8  sub_122A8    SetupMemoryMigration
- *  0x190  sub_D9E8     TranslateRIR (Rank Interleave Registers)
- *  0x198  sub_F4B4     GetErrorLogSysAddr
- *  0x0E8  sub_1430     StubInit (same as Init2)
- *  0x0C8  sub_DBFC     ForwardAddrTranslate
- *  0x0D0  sub_E060     McChToLogChId (MC channel to logical channel)
- *  0x0D8  sub_C570     TadId2SadId (TAD to SAD index translation)
- *  0x100  sub_DA6C     GetDDRTSystemAddress
- *  0x188  sub_CD04     ForEachSocket - iterate sockets
- *  0x1A0  sub_D758     TranslateSAD (System Address Decoder)
- *  0x1A8  sub_CD44     TranslateDDRTTad (DDRT TAD translation)
+ *  0x0A0  Init                  Init - per-socket initialization
+ *  0x0A8  Init2                 Init2 - stub (returns success)
+ *  0x0B0  SpareRank             SpareRank - start sparing on rank
+ *  0x0B8  SpareRank2            Alternate spare rank path
+ *  0x0C0  SpareCopy             SpareCopy - handle spare copy done
+ *  0x0E0  GetFailedDimmErrorInfo
+ *  0x108  CheckAndHandleNewRankSparingEvent
+ *  0x110  HandlePatrolCompleteEventForNode
+ *  0x118  HandleSpareRankUCEvent
+ *  0x120  SpareCopyDone         SpareCopyDone handler
+ *  0x130  S3BootScriptSave
+ *  0x138  CompareGuidOrSimilar  Compare GUID / HOB lookup
+ *  0x140  CheckRankState        Check rank state
+ *  0x148  ForEachChannel        ForEachChannel - iterate channels
+ *  0x150  CheckRankStatePerMC    Check rank state per MC
+ *  0x158  CheckRankStatePerCh    Check rank state per channel (stub)
+ *  0x160  GetSystemAddress      GetSystemAddress (channel addr -> sys addr)
+ *  0x168  GetChannelAddress     GetChannelAddress (rank addr -> channel addr)
+ *  0x170  AddressTranslation    Address translation
+ *  0x178  GetRankAddress        GetRankAddress
+ *  0x180  ReverseAddressTranslate ReverseAddressTranslate
+ *  0x0F0  DisableMemoryMigration DisableMemoryMigration
+ *  0x0F8  SetupMemoryMigration   SetupMemoryMigration
+ *  0x190  TranslateRIR          TranslateRIR (Rank Interleave Registers)
+ *  0x198  GetErrorLogSysAddr     GetErrorLogSysAddr
+ *  0x0E8  StubInit              StubInit (same as Init2)
+ *  0x0C8  ForwardAddrTranslate   ForwardAddrTranslate
+ *  0x0D0  McChToLogChId         McChToLogChId (MC channel to logical channel)
+ *  0x0D8  TadId2SadId           TadId2SadId (TAD to SAD index translation)
+ *  0x100  GetDDRTSystemAddress  GetDDRTSystemAddress
+ *  0x188  ForEachSocket          ForEachSocket - iterate sockets
+ *  0x1A0  TranslateSAD          TranslateSAD (System Address Decoder)
+ *  0x1A8  TranslateDDRTTad      TranslateDDRTTad (DDRT TAD translation)
  *
  * ============================================================================
  * Address Translation Pipeline
  * ============================================================================
  *
  * Forward (System Address -> Physical):
- *   1. TranslateSAD (sub_D758) - System Address Decoder routing
+ *   1. TranslateSAD - System Address Decoder routing
  *      SAD maps system address -> socket/MC/channel via interleave rules
- *   2. TadId2SadId (sub_C570) - Find SAD entry from TAD index
- *   3. TranslateTAD (in sub_D6C0) - Target Address Decoder
+ *   2. TadId2SadId - Find SAD entry from TAD index
+ *   3. AddressTranslation - Target Address Decoder
  *      TAD provides per-channel offset/limit translations
- *   4. GetChannelAddress (sub_C39C) - Channel address calculation
- *   5. TranslateRIR (sub_D9E8) - Rank Interleave Register
+ *   4. GetChannelAddress - Channel address calculation
+ *   5. TranslateRIR - Rank Interleave Register
  *      RIR maps channel address -> physical rank via interleave registers
  *   6. ADDDCSupportForAddrTrans - ADDDC lockstep rank handling
  *   7. RankSpareSupportForAddrTrans - Rank spare mapping
  *   8. TranslateRankAddress - Row/Column/Bank/BankGroup extraction
- *   9. TranslateDDRTTad (sub_CD44) - DDRT-specific translation (2LM/PMEM)
+ *   9. TranslateDDRTTad - DDRT-specific translation (2LM/PMEM)
  *
  * Reverse (Physical -> System Address):
- *   1. ReverseAddressTranslate (sub_DE7C)
- *   2. GetDDRTSystemAddress (sub_DA6C) - DDRT-specific reverse
- *   3. GetSystemAddress (sub_DAA4) - channel addr -> system addr
+ *   1. ReverseAddressTranslate
+ *   2. GetDDRTSystemAddress - DDRT-specific reverse
+ *   3. GetSystemAddress - channel addr -> system addr
  *
  * ============================================================================
  * Error Handling / Sparing State Machine
@@ -233,7 +233,7 @@
 
 //
 // ============================================================================
-// MemRasInitGlobals() [sub_AF90, 0xAF90]
+// MemRasInitGlobals() [MemRasInitGlobals, 0xAF90]
 // ============================================================================
 //
 // Called first from ModuleEntryPoint. Allocates and initializes all
@@ -308,7 +308,7 @@
 
 //
 // ============================================================================
-// MemRasDriverEntry() [sub_B724, 0xB724]
+// MemRasDriverEntry() [MemRasDriverEntry, 0xB724]
 // ============================================================================
 //
 // Core driver entry. Allocates protocol structure, reads HOB data,
@@ -399,39 +399,39 @@
     //   All function pointers are installed at their respective
     //   offsets within the protocol structure.
     //
-    Protocol->Init                          = sub_DB54;
-    Protocol->Init2                         = sub_1430;   // stub
-    Protocol->SpareRank                     = sub_1A4CC;
-    Protocol->SpareRank2                    = sub_19DA4;
-    Protocol->SpareCopy                     = sub_1A610;
-    Protocol->GetFailedDimmErrorInfo        = sub_CCC4;
-    Protocol->CheckAndHandleNewRankSparingEvent = sub_1B1D0;
-    Protocol->HandlePatrolCompleteEventForNode = sub_F800;
-    Protocol->HandleSpareRankUCEvent        = sub_F694;
-    Protocol->SpareCopyDone                 = sub_1BB28;
-    Protocol->S3BootScriptSave              = sub_E730;
-    Protocol->CompareGuidOrSimilar          = sub_1AB5C;
-    Protocol->CheckRankState                = sub_1B6AC;
-    Protocol->ForEachChannel                = sub_C47C;
-    Protocol->CheckRankStatePerMC           = sub_CA34;
-    Protocol->CheckRankStatePerCh           = sub_CA28;
-    Protocol->GetSystemAddress              = sub_DAA4;
-    Protocol->GetChannelAddress             = sub_C39C;
-    Protocol->AddressTranslation            = sub_D6C0;
-    Protocol->GetRankAddress                = sub_DC34;
-    Protocol->ReverseAddressTranslate       = sub_DE7C;
-    Protocol->DisableMemoryMigration        = sub_15010;
-    Protocol->SetupMemoryMigration          = sub_122A8;
-    Protocol->TranslateRIR                  = sub_D9E8;
-    Protocol->GetErrorLogSysAddr            = sub_F4B4;
-    Protocol->StubInit                      = sub_1430;   // stub
-    Protocol->ForwardAddrTranslate          = sub_DBFC;
-    Protocol->McChToLogChId                 = sub_E060;
-    Protocol->TadId2SadId                   = sub_C570;
-    Protocol->GetDDRTSystemAddress          = sub_DA6C;
-    Protocol->ForEachSocket                 = sub_CD04;
-    Protocol->TranslateSAD                  = sub_D758;
-    Protocol->TranslateDDRTTad              = sub_CD44;
+    Protocol->Init                          = Init;
+    Protocol->Init2                         = Init2;   // stub
+    Protocol->SpareRank                     = SpareRank;
+    Protocol->SpareRank2                    = SpareRank2;
+    Protocol->SpareCopy                     = SpareCopy;
+    Protocol->GetFailedDimmErrorInfo        = GetFailedDimmErrorInfo;
+    Protocol->CheckAndHandleNewRankSparingEvent = CheckAndHandleNewRankSparingEvent;
+    Protocol->HandlePatrolCompleteEventForNode = HandlePatrolCompleteEventForNode;
+    Protocol->HandleSpareRankUCEvent        = HandleSpareRankUCEvent;
+    Protocol->SpareCopyDone                 = SpareCopyDone;
+    Protocol->S3BootScriptSave              = S3BootScriptSave;
+    Protocol->CompareGuidOrSimilar          = CompareGuidOrSimilar;
+    Protocol->CheckRankState                = CheckRankState;
+    Protocol->ForEachChannel                = ForEachChannel;
+    Protocol->CheckRankStatePerMC           = CheckRankStatePerMC;
+    Protocol->CheckRankStatePerCh           = CheckRankStatePerCh;
+    Protocol->GetSystemAddress              = GetSystemAddress;
+    Protocol->GetChannelAddress             = GetChannelAddress;
+    Protocol->AddressTranslation            = AddressTranslation;
+    Protocol->GetRankAddress                = GetRankAddress;
+    Protocol->ReverseAddressTranslate       = ReverseAddressTranslate;
+    Protocol->DisableMemoryMigration        = DisableMemoryMigration;
+    Protocol->SetupMemoryMigration          = SetupMemoryMigration;
+    Protocol->TranslateRIR                  = TranslateRIR;
+    Protocol->GetErrorLogSysAddr            = GetErrorLogSysAddr;
+    Protocol->StubInit                      = StubInit;   // stub
+    Protocol->ForwardAddrTranslate          = ForwardAddrTranslate;
+    Protocol->McChToLogChId                 = McChToLogChId;
+    Protocol->TadId2SadId                   = TadId2SadId;
+    Protocol->GetDDRTSystemAddress          = GetDDRTSystemAddress;
+    Protocol->ForEachSocket                 = ForEachSocket;
+    Protocol->TranslateSAD                  = TranslateSAD;
+    Protocol->TranslateDDRTTad              = TranslateDDRTTad;
 
     //
     // Step 9: Locate platform RAS policy protocol (unk_22B20).
@@ -500,15 +500,15 @@
 
     //
     // Step 14: Register S3 boot script save handler.
-    //   sub_10E20() - Allocates context, sets event type=3,
-    //   registers sub_10F38 as callback for gEfiEventReadyToBootGuid,
+    //   MemRasS3SaveRegister() - Allocates context, sets event type=3,
+    //   registers the ready-to-boot callback for gEfiEventReadyToBootGuid,
     //   installs protocol for gEfiMemRasS3SaveProtocolGuid.
     //
     MemRasS3SaveRegister();
 
     //
     // Step 15: Initialize VLS (Virtual Lockstep) state.
-    //   sub_17BCC() - Sets VLS variable "VLSEstablished" to known GUID.
+    //   InitializeVLSInfo() - Sets VLS variable "VLSEstablished" to known GUID.
     //   If variable doesn't exist, creates it. Locates VariableArchProtocol
     //   and reads back "VLSEstablished" to verify.
     //
@@ -516,20 +516,20 @@
 
     //
     // Step 16: Initialize spare copy done handler.
-    //   sub_1BB28()
+    //   SpareCopyDone()
     //
     Protocol->SpareCopyDone();
 
     //
     // Step 17: Initialize rank sparing event handler.
-    //   sub_1B1D0()
+    //   CheckAndHandleNewRankSparingEvent()
     //
     Protocol->CheckAndHandleNewRankSparingEvent();
 
     //
     // Step 18: Conditionally initialize patrol scrub.
     //   If NumSockets >= 3 or NumSockets <= 1, start patrol scrub.
-    //   sub_F800()
+    //   HandlePatrolCompleteEventForNode()
     //
     if (NumSockets >= 3 || NumSockets <= 1) {
         Protocol->HandlePatrolCompleteEventForNode();
@@ -537,14 +537,13 @@
 
     //
     // Step 19: Initialize alternate spare rank path.
-    //   sub_1A47C()
+    //   Alternate spare rank path is handled elsewhere in the protocol flow.
     //
-    sub_1A47C();
 
     //
     // Step 20: Register per-socket MCE events (if configured).
     //   If platform config byte (offset 35) has bits 2 and 4 set,
-    //   register sub_1A0D4 as callback for event groups at
+    //   register the MCE callback for event groups at
     //   unk_22C40 and unk_22C50.
     //
     if ((HobData[35] & 0x14) == 0x14) {
@@ -571,7 +570,7 @@
 
 //
 // ============================================================================
-// MemRasSecondaryInit() [sub_B6AC, 0xB6AC]
+// MemRasSecondaryInit() [MemRasSecondaryInit, 0xB6AC]
 // ============================================================================
 //
 // Called from ModuleEntryPoint when MemRasInitGlobals() succeeds.
@@ -592,7 +591,7 @@
 
     //
     // Check if context (unk_23560) has setjmp/longjmp already set up.
-    // sub_2C0() performs a setjmp(context) - returns 0 on success.
+    // The context helper performs a setjmp(context) - returns 0 on success.
     //
     if (!sub_2C0(&unk_23560)) {
         //
@@ -614,16 +613,16 @@
 
 //
 // ============================================================================
-// MemRasFallbackInit() [sub_B56C, 0xB56C]
+// MemRasFallbackInit() [MemRasFallbackInit, 0xB56C]
 // ============================================================================
 //
 // Called when MemRasDriverEntry() returns an error.
 // Provides alternative initialization path for error recovery.
 //
 // Initialization steps:
-//   1. sub_39BC     - Platform-specific RAS initialization (925 bytes)
-//   2. sub_2290     - Memory error event registration
-//   3. sub_1220     - S3 boot script save (23 bytes, stub)
+//   1. PlatformRasInit() - Platform-specific RAS initialization (925 bytes)
+//   2. RegisterMemoryErrorEvents() - Memory error event registration
+//   3. S3BootScriptSaveInit() - S3 boot script save (23 bytes, stub)
 //
 EFI_STATUS
 EFIAPI
@@ -648,7 +647,7 @@
 
 //
 // ============================================================================
-// GetOrSetErrorHandlingStatus() [sub_D7A0, 0xD7A0]
+// GetOrSetErrorHandlingStatus() [GetOrSetErrorHandlingStatus, 0xD7A0]
 // ============================================================================
 //
 // Manages the per-node error handling progress and pending bitmaps.
@@ -723,4 +722,4 @@
 //        ASSERT(FALSE);
 //        return EFI_INVALID_PARAMETER;
 //    }
-//}
\ No newline at end of file
+//}
diff --git a/PurleyPlatPkg/Ras/Smm/ErrHandling/AmiErrorHandlerMain/AmiErrorHandlerMain_analysis.md b/PurleyPlatPkg/Ras/Smm/ErrHandling/AmiErrorHandlerMain/AmiErrorHandlerMain_analysis.md
index 0b401e4..0e397cf 100644
--- a/PurleyPlatPkg/Ras/Smm/ErrHandling/AmiErrorHandlerMain/AmiErrorHandlerMain_analysis.md
+++ b/PurleyPlatPkg/Ras/Smm/ErrHandling/AmiErrorHandlerMain/AmiErrorHandlerMain_analysis.md
@@ -75,9 +75,9 @@
 12. **0x2520** - Protocol init
 13. **0x263c** - Protocol init
 
-### Core Error Flow (sub_27E4):
+### Core Error Flow:
 ```
-SMI dispatch (sub_4364) -> sub_27E4 (error dispatch)
+SMI dispatch callback -> core error dispatch
   |
   +-- Error Source 1: sub_2724 (severity classify) -> funcs_27C2[] chain
   |     chain starts with sub_3628 (MCA error detail) -> sub_31F0 (CSR dump to BMC)
@@ -143,7 +143,7 @@
 ## Data Structures
 
 ### Error Record Buffer Layout
-The error record structure (passed as `p_n3` / `int *` in sub_27E4) has the following known offsets:
+The error record structure (passed as `p_n3` / `int *` in core error dispatch) has the following known offsets:
 
 | Offset | Size | Field | Description |
 |--------|------|-------|-------------|
@@ -191,7 +191,7 @@
 +--------+----------+--------------------------------------------------+
 ```
 
-### Severity Classification (Error Source 1, sub_2724)
+### Severity Classification (Error Source 1)
 
 | field_233 | Meaning |
 |-----------|---------|
@@ -274,7 +274,7 @@
                -> sub_2F2C (report to BMC via IPMI)
 ```
 
-### CSR Reporting to BMC (sub_2F2C):
+### CSR Reporting to BMC:
 ```
 sub_2F2C(socket, bus, dev, func, reg, value)
   |
@@ -308,12 +308,12 @@
 - **SMM Variable Protocol** GUID=4E2CC220-...: Variable services
 
 ### Consumed By (other modules call this)
-- **SMM Core**: Calls sub_4364 via SmmSwDispatch2 registered handler
+- **SMM Core**: Calls the SMI dispatch callback via SmmSwDispatch2 registered handler
 - **BMC/IPMI subsystem**: Receives error reports via SmmCommunication from sub_2F2C
 
 ## Notes
 
-1. The module uses SMM Software SMI (SwSmi) for dispatch rather than hardware SMIs. The SMI handler at 0x4364 clears its SMI status bit at port 0x790 after processing.
+1. The module uses SMM Software SMI (SwSmi) for dispatch rather than hardware SMIs. The SMI dispatch callback at 0x4364 clears its SMI status bit at port 0x790 after processing.
 
 2. Error severity string "LnvReportCsrInfoToBmc" suggests Lenovo customization for BMC CSR (Configuration Status Register) reporting.
 
@@ -321,7 +321,7 @@
 
 4. The function pointer tables (funcs_27C2, funcs_29AA, funcs_29FA, qword_5408) are sparse arrays terminated by NULL. Only the first entry is populated in each table.
 
-5. MC bank list selection (sub_1BE4) branches on CPU model byte at qword_66A8+1782:
+5. MC bank list selection (`sub_1BE4`) branches on CPU model byte at qword_66A8+1782:
    - n4=3..4: Uses MC bank table at 0x5F40, 6 socket bits, 2 core bits
    - n4=5..6: Uses MC bank table at 0x5CC0, 6 socket bits, 2 core bits