Show real addresses for out-of-range branch targets.

Upstream's loc() does `labels.get(off, "0x%x" % off)`, but pass 1 inserts every
branch target into `labels` with the placeholder value True, and pass 2 only
renames the ones that fall inside the disassembled range. A target outside the
image therefore prints as the literal string "True", which silently destroys the
single most useful signal for a blob whose load base is not 0.

With this patch, gc_11_0_0_rlc's RLC_G shows 915 branches into 0x2004..0x37ba,
which is exactly its own size shifted by 0x2000 -- i.e. it made the load base
discoverable instead of printing "True" 915 times.

--- a/f32dis.py
+++ b/f32dis.py
@@ -89,7 +89,8 @@
     return d - 0x10000 if d >= 0x8000 else d
 
 def loc(off):
-    return labels.get(off, "0x%x"%off)
+    _v = labels.get(off)
+    return _v if isinstance(_v, str) else "0x%x" % off
 
 lastadd = None