I'd use Geiger's Snes9x Debugger:
http://geigercount.net/crypt/
It supports read/write/exec breakpoint and op advance, and that is very useful.
About commands, I know of these (I might have made some mistakes, though):
LD(A,X,Y) - load to register, either #$ (fixed number), $ (memory address), or $,X (offset from memory address, only with LDA)
ST(A,X,Y) - store from register, $ (memory address), or $,X (offset from memory address, only with STA)
STZ - store 0, $ (memory address), or $,X (offset from memory address)
ADC - add to register with carry flag, either #$ (fixed number), $ (memory address), or $,X (offset from memory address). If carry flag is 1, ADC adds one more, otherwise, no. Carry flag is set to 1 if there is overflow, set to 0 otherwise.
CLC - clear carry flag (set to 0); almost always ADC follows it.
SBC - subtract from register with carry flag, either #$ (fixed number), $ (memory address), or $,X (offset from memory address). If carry flag is 0, SBC subtracts one more, otherwise, no. Carry flag is set to 0 if there is underflow, set to 1 otherwise.
SEC - set carry flag (set to 1); almost always SBC follows it.
CMP, CP(X,Y) - compare register with number (CMP is register A), either #$ (fixed number), $ (memory address), or $,X (offset from memory address). It does so by temporarily subtracting the number from the register, but unlike SBC, this doesn't change the value of the register, but only sets the special flags. If register is less than the number, carry flag is set to 0; otherwise it is set to 1. If A is equal to the number, zero flag is set to 1; otherwise it is set to 0.
BCC - branch if carry flag is 0, either relative (1 byte offset) or absolute (2 byte address)
BCS - branch if carry flag is 1, either relative (1 byte offset) or absolute (2 byte address)
(note if it does not follow CMP, the zero flag is 1 if the last operation results in a value of 0, and 0 otherwise)
BEQ - branch to address if zero flag is 1, either relative (1 byte offset) or absolute (2 byte address)
BNE - branch to address if zero flag is 0, either relative (1 byte offset) or absolute (2 byte address)
JMP - unconditional branch, absolute (2 byte address)
JSR - execute subroutine, absolute (2 byte address)
RTS - return from subroutine
IN(X,Y) - increment register
DE(X,Y) - decrement register
TA(X,Y) - transfer from A to X/Y, set X/Y to the value of A
T(X,Y)A - transfer from X/Y to A, set A to the value of X/Y
PH(A,X,Y) - push value of register into stack
PL(A,X,Y) - pull value from stack and set register to that value
ASL A - shift the bits of A to the left (multiply by 2)
LSR A - shift the bits of A to the right (unsigned divide by 2)
ASR A - shift the bits of A to the right with respect to signed bit (signed divide by 2)
ROL A - rotate the bits of A to the left, through the carry bit
ROR A - rotate the bits of A to the right, through the carry bit
NOP - do nothing
I think there are other functions like REP and SEP (which set the 8-bit or 16-bit modes) and XBA (swap high and low bytes).
Rockman is watching you.
In fact, the moon screenshot and the princess screenshot were used for the Nicovideo video thumbnails for the bad and good ending runs, respectively. May not be exact, though.