I recently made a tool to make the early stuff in 8051 reverse engineering easier, called at51 and will shamelessly use this answer as a showcase.
First off, you want the image to be properly aligned.
Rarely is 8051 firmware aligned, and for this file this is also true.
By using the base subcommand, you get the offsets most likely to be the offset the file is loaded at:
$ at51 base rtl8188efw.bin
Index by likeliness:
1: 0x3fe0 with 139
2: 0x2526 with 63
3: 0x6a5 with 58
Note that the score of the first match is more than double that of the second match, so it is probably loaded at 0x3fe0 (actually at 0x4000 because of the 32 byte header).
You could use now ghidra or radare2, which both have 8051 support.
To help with this, since this firmware seems to be compiled with C51 as most 8051 firmware is, you can also use the libfind subcommand to find standard library functions in the image.
For that you use the C51 library files of the form C51*.LIB (you can obtain them by downloading the trial version of C51, because no one would ever leave a file named C51L.LIB anywhere open on the internet).
Anyway, using the aligned image (for example by using
dd if=rtl8188efw.bin of=fw_aligned bs=$((0x3fe0)) seek=1) and the library files, one gets
$ at51 libfind fw_aligned /path/to/lib/C51*.LIB
Address | Name | Description
0x44bf ?C?LAND long (32-bit) bitwise and
0x44cc ?C?LOR long (32-bit) bitwise or
0x44d9 ?C?LLDXDATA long (32-bit) load from xdata
0x44e5 ?C?LLDXDATA0 long (32-bit) load from xdata into r3-r0
0x44fd ?C?PLDXDATA general pointer load from xdata
0x4506 ?C?PSTXDATA general pointer store to xdata
Now you have some offsets where some functions start and a description for some of them, which should help.
Note that MAIN is in parenthesis because it is found not in the library itself, but referenced by it.
One last thing is that firmware generated by C51 often contains a structure where values of memory locations to be initialized on startup are stored.
One can use the kinit subcommand to read that structure.
You can find the offset of that structure easily because it is loaded at the start of ?C_START with
mov dptr, #0x45b8.
But it seems that for this firmware image, this is actually disabled (by inserting a 0 at that location)?
Or maybe the linker messed up and inserted the 0 before the structure and not after it?
Anyway, if they didn't zero it out (the structure actually exists one byte behind it), you would get
$ at51 kinit -o $((0x45b9)) fw_aligned
xdata[0x8197] = 0x00
xdata[0x8198] = 0x00
xdata[0x81a4] = 0x00
xdata[0x3457..0x3468] = [0x4a, 0x57, 0x36, 0x58, 0x29, 0xc0, 0xe0, 0xc0, 0xf0, 0xc0, 0x83, 0xc0, 0x82, 0xc0, 0xd0, 0x75, 0xd0]
That last one seems to be garbage since it contains 8051 code, so maybe the terminating 0 did accidentally land at the beginning.