Hello, it is me, literally the entire SNES SMT hacking community.
Here's the RNG routine from my disassembly:
GetRandomInt:
#_009643: PHP
#_009644: SEP #$20
#_009646: CLC
#_009647: LDA.w $0ED7
#_00964A: AND.b #$03
#_00964C: BEQ .zero
#_00964E: CMP.b #$03
#_009650: BNE .not3
.zero
#_009652: SEC
.not3
#_009653: ROL.w $0ED9
#_009656: ROL.w $0ED7
#_009659: LDA.w $0ED7
#_00965C: ADC.b #$22
#_00965E: ADC.w $0ED9
#_009661: EOR.b #$5A
#_009663: ADC.w $0ED8
#_009666: STA.w $0ED8
#_009669: EOR.w $0ED5
#_00966C: STA.w $0ED5
#_00966F: PLP
#_009670: RTL
The RNG routine can be called multiple times when asking for a random encounter. There's a frame counter at $7E:0451 that is incremented at the end of the NMI routine every frame it is called. Its only use appears to be this here:
#_01B17F: LDA.w $0451
#_01B182: AND.b #$03
#_01B184: TAX
.branch01B185
#_01B185: JSL GetRandomInt
#_01B189: DEX
#_01B18A: BNE .branch01B185
That code takes the frame counter and gets the remainder mod 4. Then calls the RNG routine that many times.
RNG seems to always initialize to 0xFF for $0ED5 and 0x00 for the other values. I count 69 distinct calls of the RNG routine, though some appear to be part of unused routines.
I planned to look into this glitched route both RTA and TAS eventually, but I'm currently busy with other projects. If you think you'd like more info from my disassembly, I'd be happy to look and figure out what I can.