Insanity kept me going back.
Trying to find the correct jump/branch from where to find the beginning of Sonnet extension INIT was a nightmare. I did however use the old HWPriv location debugger trap to dump the memory from A0 to a file (using log filename; dm a0 8000; log) before the subroutine to Patch 128 and behold I now have the decrypt code.
While it still is in text form, I can see the code makes sense and equals the code that is being executed.
Ptch 128 as shown by MacNosy (only couple of lines):
0: 'SNNT..[T.|Ip.s.d' data1 DC.W $534E,$4E54,$914,$5B54,$C7C,$4970,$773,$8A64
10: '.+.......Y..3...' DC.W $E2B,$A9B0,$DEB,$A9C0,$E559,$A9B3,$33F7,$1E17
20: 'q...G.t..s...<..' DC.W $71C4,$B6A0,$478A,$74A0,$9873,$D592,$123C,$B5AD
30: '.#..7[...s...9..' DC.W $223,$880B,$375B,$B806,$9873,$D592,$1239,$B5AD
Ptch 128 from a memory dump (the same lines):
0039F030 4E56 FFBC 48E7 1F38 426E FFD0 42AE FFD8 NVˇºHÁ•8Bnˇ–BÆˇÿ
0039F040 42AE FFC0 3C3C FFFF 7E00 486E FFDC A976 BÆˇ¿<<ˇˇ~•Hnˇ‹©v
0039F050 554F 486E FFE3 4878 0007 A85D 101F 6610 UOHnˇ„Hx••®]••f•
0039F060 554F 486E FFE3 4878 0004 A85D 101F 6708 UOHnˇ„Hx••®]••g•
Do you guys use / know another disassembler than MacNosy? One which I could use the text file as an input and on a modern Mac?