root/platform/g7x2/sub/101a/capt_seq.c

/* [<][>][^][v][top][bottom][index][help] */

DEFINITIONS

This source file includes following definitions.
  1. captseq_get_raw_addr
  2. clear_current_raw_addr
  3. capt_seq_task
  4. sub_e00464ae_my
  5. sub_e004644a_my
  6. sub_e004626a_my
  7. sub_e005348c_my
  8. exp_drv_task
  9. sub_e02cd9ee_my
  10. sub_e0072240_my

   1 
   2 #include "lolevel.h"
   3 #include "platform.h"
   4 #include "core.h"
   5 
   6 // TODO:
   7 
   8 #define USE_STUBS_NRFLAG 1
   9 #define NR_AUTO (-1) // default value if NRTBL.SetDarkSubType not used is -1 (0 probably works the same), set to enable auto
  10 
  11 #include "../../../generic/capt_seq.c"
  12 
  13 char *current_raw_addr;
  14 char *current_raw_alt_addr;
  15 
  16 void captseq_get_raw_addr()
  17 {
  18     extern char* raw_buffer_table[];
  19     extern int raw_buffer_index;
  20     current_raw_addr = raw_buffer_table[raw_buffer_index];
  21     current_raw_alt_addr = raw_buffer_table[(raw_buffer_index+1)&0xF];   // 16 buffers, select next one as alt
  22 }
  23 
  24 void clear_current_raw_addr(void)
  25 {
  26     current_raw_addr = NULL;
  27 }
  28 
  29 // capt_seq_task 0xe0032f57
  30 void __attribute__((naked,noinline)) capt_seq_task() {
  31     asm volatile (
  32             //capdis -f=chdk -s=0xe0032f57 -c=31 -stubs PRIMARY.BIN 0xe0000000
  33             "    push    {r3, r4, r5, r6, r7, lr}\n"
  34             "    movs    r6, #0\n"
  35             "    ldr     r4, =0x00057d2c\n"
  36             "    ldr     r5, =0x0000c098\n"
  37             "loc_e0032f5e:\n"
  38             "    movs    r2, #0\n"
  39             "    mov     r1, sp\n"
  40             "    ldr     r0, [r5, #8]\n"
  41             "    bl      sub_dffc9de0\n"
  42             "    lsls    r0, r0, #0x1f\n"
  43             "    beq     loc_e0032f80\n"
  44             "    movw    r2, #0x435\n"
  45             "    ldr     r1, =0xe0032b9c\n" //  *"SsShootTask.c"
  46             "    movs    r0, #0\n"
  47             "    bl      sub_dffc96f4\n"
  48             "    bl      sub_dffc95ae\n"
  49             "    pop     {r3, r4, r5, r6, r7, pc}\n"
  50             "loc_e0032f80:\n"
  51             "    ldr     r0, [sp]\n"
  52             "    ldr     r0, [r0]\n"
  53             "    cmp     r0, #1\n"
  54             "    beq     loc_e0032f98\n"
  55             "    cmp     r0, #0x2b\n"
  56             "    beq     loc_e0032f98\n"
  57             "    cmp     r0, #0x1f\n"
  58             "    beq     loc_e0032f98\n"
  59             "    cmp     r0, #0x23\n"
  60             "    beq     loc_e0032f98\n"
  61             "    bl      sub_e005333c\n"
  62             "loc_e0032f98:\n"
  63             "    ldr     r0, [sp]\n"
  64             "    ldr     r1, [r0]\n"
  65             "    cmp     r1, #0x33\n"
  66             "    bhs     loc_e0033080\n"
  67 
  68             //capdis -f=chdk -s=0xe0032fa1 -c=147 -stubs PRIMARY.BIN 0xe0000000
  69             "    tbb     [pc, r1]\n" // (jumptable r1 51 elements)
  70             "branchtable_e0032fa4:\n"
  71             "    .byte((loc_e0032fd8 - branchtable_e0032fa4) / 2)\n" // (case 0)
  72             "    .byte((loc_e0032fee - branchtable_e0032fa4) / 2)\n" // (case 1)
  73             "    .byte((loc_e0033008 - branchtable_e0032fa4) / 2)\n" // (case 2)
  74             "    .byte((loc_e0033016 - branchtable_e0032fa4) / 2)\n" // (case 3)
  75             "    .byte((loc_e0033010 - branchtable_e0032fa4) / 2)\n" // (case 4)
  76             "    .byte((loc_e0033020 - branchtable_e0032fa4) / 2)\n" // (case 5)
  77             "    .byte((loc_e003313a - branchtable_e0032fa4) / 2)\n" // (case 6)
  78             "    .byte((loc_e003313a - branchtable_e0032fa4) / 2)\n" // (case 7)
  79             "    .byte((loc_e0033026 - branchtable_e0032fa4) / 2)\n" // (case 8)
  80             "    .byte((loc_e0033036 - branchtable_e0032fa4) / 2)\n" // (case 9)
  81             "    .byte((loc_e003303e - branchtable_e0032fa4) / 2)\n" // (case 10)
  82             "    .byte((loc_e0033044 - branchtable_e0032fa4) / 2)\n" // (case 11)
  83             "    .byte((loc_e003313a - branchtable_e0032fa4) / 2)\n" // (case 12)
  84             "    .byte((loc_e003304c - branchtable_e0032fa4) / 2)\n" // (case 13)
  85             "    .byte((loc_e0033052 - branchtable_e0032fa4) / 2)\n" // (case 14)
  86             "    .byte((loc_e0033058 - branchtable_e0032fa4) / 2)\n" // (case 15)
  87             "    .byte((loc_e003305e - branchtable_e0032fa4) / 2)\n" // (case 16)
  88             "    .byte((loc_e0033064 - branchtable_e0032fa4) / 2)\n" // (case 17)
  89             "    .byte((loc_e003313a - branchtable_e0032fa4) / 2)\n" // (case 18)
  90             "    .byte((loc_e003306a - branchtable_e0032fa4) / 2)\n" // (case 19)
  91             "    .byte((loc_e0033070 - branchtable_e0032fa4) / 2)\n" // (case 20)
  92             "    .byte((loc_e0033076 - branchtable_e0032fa4) / 2)\n" // (case 21)
  93             "    .byte((loc_e003307a - branchtable_e0032fa4) / 2)\n" // (case 22)
  94             "    .byte((loc_e0033082 - branchtable_e0032fa4) / 2)\n" // (case 23)
  95             "    .byte((loc_e0033088 - branchtable_e0032fa4) / 2)\n" // (case 24)
  96             "    .byte((loc_e003308e - branchtable_e0032fa4) / 2)\n" // (case 25)
  97             "    .byte((loc_e0033094 - branchtable_e0032fa4) / 2)\n" // (case 26)
  98             "    .byte((loc_e003309a - branchtable_e0032fa4) / 2)\n" // (case 27)
  99             "    .byte((loc_e00330a2 - branchtable_e0032fa4) / 2)\n" // (case 28)
 100             "    .byte((loc_e00330a8 - branchtable_e0032fa4) / 2)\n" // (case 29)
 101             "    .byte((loc_e00330ae - branchtable_e0032fa4) / 2)\n" // (case 30)
 102             "    .byte((loc_e00330b2 - branchtable_e0032fa4) / 2)\n" // (case 31)
 103             "    .byte((loc_e00330ba - branchtable_e0032fa4) / 2)\n" // (case 32)
 104             "    .byte((loc_e003313a - branchtable_e0032fa4) / 2)\n" // (case 33)
 105             "    .byte((loc_e00330c0 - branchtable_e0032fa4) / 2)\n" // (case 34)
 106             "    .byte((loc_e00330c6 - branchtable_e0032fa4) / 2)\n" // (case 35)
 107             "    .byte((loc_e00330cc - branchtable_e0032fa4) / 2)\n" // (case 36)
 108             "    .byte((loc_e00330d2 - branchtable_e0032fa4) / 2)\n" // (case 37)
 109             "    .byte((loc_e00330d8 - branchtable_e0032fa4) / 2)\n" // (case 38)
 110             "    .byte((loc_e00330e0 - branchtable_e0032fa4) / 2)\n" // (case 39)
 111             "    .byte((loc_e00330e6 - branchtable_e0032fa4) / 2)\n" // (case 40)
 112             "    .byte((loc_e003313a - branchtable_e0032fa4) / 2)\n" // (case 41)
 113             "    .byte((loc_e003311c - branchtable_e0032fa4) / 2)\n" // (case 42)
 114             "    .byte((loc_e0033122 - branchtable_e0032fa4) / 2)\n" // (case 43)
 115             "    .byte((loc_e0033106 - branchtable_e0032fa4) / 2)\n" // (case 44)
 116             "    .byte((loc_e0033148 - branchtable_e0032fa4) / 2)\n" // (case 45)
 117             "    .byte((loc_e003313a - branchtable_e0032fa4) / 2)\n" // (case 46)
 118             "    .byte((loc_e003313a - branchtable_e0032fa4) / 2)\n" // (case 47)
 119             "    .byte((loc_e003313a - branchtable_e0032fa4) / 2)\n" // (case 48)
 120             "    .byte((loc_e003312e - branchtable_e0032fa4) / 2)\n" // (case 49)
 121             "    .byte((loc_e0033134 - branchtable_e0032fa4) / 2)\n" // (case 50)
 122             ".align 1\n"
 123             "loc_e0032fd8:\n"
 124             "    ldr     r0, [r0, #0xc]\n"
 125             "    bl      sub_e0039274\n"
 126             "    BL      shooting_expo_param_override\n" // +
 127             "    bl      sub_e004f1e4\n"
 128             "    ldr     r0, [r4, #0x28]\n"
 129             "    cmp     r0, #0\n"
 130             "    beq     loc_e0032fec\n"
 131             "    bl      sub_e00464ae_my\n" // -> nr?, remote hook, raw hook (quick, no half press)
 132             "loc_e0032fec:\n"
 133             "    b       loc_e0033148\n"
 134             "loc_e0032fee:\n"
 135             "    ldr     r0, [r0, #0x10]\n"
 136             "    bl      sub_e004644a_my\n" // -> nr?, remote hook, raw hook
 137             "    b       loc_e0033148\n"
 138             "loc_e0033008:\n"
 139             "    movs    r0, #1\n"
 140             "    bl      sub_e00395a2\n"
 141             "    b       loc_e0033148\n"
 142             "loc_e0033010:\n"
 143             "    bl      sub_e0038f62\n"
 144             "    b       loc_e003301c\n"
 145             "loc_e0033016:\n"
 146             "    ldr     r0, [r0, #0xc]\n"
 147             "    bl      sub_e003925c\n"
 148             "loc_e003301c:\n"
 149             "    str     r6, [r4, #0x28]\n"
 150             "    b       loc_e0033148\n"
 151             "loc_e0033020:\n"
 152             "    bl      sub_e0039262\n"
 153             "    b       loc_e0033148\n"
 154             "loc_e0033026:\n"
 155             "    bl      sub_e0039532\n"
 156             "    bl      sub_e004f1e4\n"
 157             "    movs    r0, #0\n"
 158             "    bl      sub_e0297bcc\n"
 159             "    b       loc_e0033148\n"
 160             "loc_e0033036:\n"
 161             "    ldr     r0, [r4, #0x54]\n"
 162             "    bl      sub_e0039b92\n"
 163             "    b       loc_e0033148\n"
 164             "loc_e003303e:\n"
 165             "    bl      sub_e0039dfc\n"
 166             "    b       loc_e0033148\n"
 167             "loc_e0033044:\n"
 168             "    ldr     r0, [r0, #0xc]\n"
 169             "    bl      sub_e0039e48\n"
 170             "    b       loc_e0033148\n"
 171             "loc_e003304c:\n"
 172             "    bl      sub_e003a030\n"
 173             "    b       loc_e0033148\n"
 174             "loc_e0033052:\n"
 175             "    bl      sub_e003a41c\n"
 176             "    b       loc_e0033148\n"
 177             "loc_e0033058:\n"
 178             "    bl      sub_e003a4b0\n"
 179             "    b       loc_e0033148\n"
 180             "loc_e003305e:\n"
 181             "    bl      sub_e003bfc0\n"
 182             "    b       loc_e0033148\n"
 183             "loc_e0033064:\n"
 184             "    bl      sub_e003c15c\n"
 185             "    b       loc_e0033148\n"
 186             "loc_e003306a:\n"
 187             "    bl      sub_e003c1f8\n"
 188             "    b       loc_e0033148\n"
 189             "loc_e0033070:\n"
 190             "    bl      sub_e003c274\n"
 191             "    b       loc_e0033148\n"
 192             "loc_e0033076:\n"
 193             "    movs    r0, #0\n"
 194             "    b       loc_e003309c\n"
 195             "loc_e003307a:\n"
 196             "    bl      sub_e003c57a\n"
 197             "    b       loc_e0033148\n"
 198             "loc_e0033080:\n"
 199             "    b       loc_e003313a\n"
 200             "loc_e0033082:\n"
 201             "    bl      sub_e003c5da\n"
 202             "    b       loc_e0033148\n"
 203             "loc_e0033088:\n"
 204             "    bl      sub_e003c5de\n"
 205             "    b       loc_e0033148\n"
 206             "loc_e003308e:\n"
 207             "    bl      sub_e003c5f0\n"
 208             "    b       loc_e0033148\n"
 209             "loc_e0033094:\n"
 210             "    bl      sub_e003c674\n"
 211             "    b       loc_e0033148\n"
 212             "loc_e003309a:\n"
 213             "    movs    r0, #1\n"
 214             "loc_e003309c:\n"
 215             "    bl      sub_e003c458\n"
 216             "    b       loc_e0033148\n"
 217             "loc_e00330a2:\n"
 218             "    bl      sub_e003c720\n"
 219             "    b       loc_e0033148\n"
 220             "loc_e00330a8:\n"
 221             "    bl      sub_e0039672\n"
 222             "    b       loc_e0033148\n"
 223             "loc_e00330ae:\n"
 224             "    movs    r0, #0\n"
 225             "    b       loc_e00330b4\n"
 226             "loc_e00330b2:\n"
 227             "    ldr     r0, [r0, #0xc]\n"
 228             "loc_e00330b4:\n"
 229             "    bl      sub_e00396f2\n"
 230             "    b       loc_e0033148\n"
 231             "loc_e00330ba:\n"
 232             "    bl      sub_e003c37c\n"
 233             "    b       loc_e0033148\n"
 234             "loc_e00330c0:\n"
 235             "    bl      sub_e003c3e8\n"
 236             "    b       loc_e0033148\n"
 237             "loc_e00330c6:\n"
 238             "    bl      sub_e0046668\n"
 239             "    b       loc_e0033148\n"
 240             "loc_e00330cc:\n"
 241             "    bl      sub_e003afdc\n"
 242             "    b       loc_e0033148\n"
 243             "loc_e00330d2:\n"
 244             "    bl      sub_e003b096\n"
 245             "    b       loc_e0033148\n"
 246             "loc_e00330d8:\n"
 247             "    ldr     r0, [r0, #0xc]\n"
 248             "    bl      sub_e003c7d8\n"
 249             "    b       loc_e0033148\n"
 250             "loc_e00330e0:\n"
 251             "    bl      sub_e003c840\n"
 252             "    b       loc_e0033148\n"
 253             "loc_e00330e6:\n"
 254             "    bl      sub_e00361dc\n"
 255             "    ldrh.w  r0, [r4, #0x1a0]\n"
 256             "    cmp     r0, #4\n"
 257             "    beq     loc_e00330fc\n"
 258             "    ldrh    r0, [r4]\n"
 259             "    sub.w   r1, r0, #0x8200\n"
 260             "    subs    r1, #0x37\n"
 261             "    bne     loc_e0033148\n"
 262             "loc_e00330fc:\n"
 263             "    bl      sub_e003b096\n"
 264             "    bl      sub_e003b410\n"
 265             "    b       loc_e0033148\n"
 266             "loc_e0033106:\n"
 267             "    bl      sub_e003a6ba\n"
 268             "    movs    r0, #1\n"
 269             "    bl      sub_e0035df4\n"
 270             "    cbnz    r0, loc_e0033148\n"
 271             "    movs    r1, #0\n"
 272             "    movs    r0, #6\n"
 273             "    bl      sub_e003c978\n"
 274             "    b       loc_e0033148\n"
 275             "loc_e003311c:\n"
 276             "    movs    r2, #0\n"
 277             "    movs    r1, #0x11\n"
 278             "    b       loc_e0033126\n"
 279             "loc_e0033122:\n"
 280             "    movs    r2, #0\n"
 281             "    movs    r1, #0x10\n"
 282             "loc_e0033126:\n"
 283             "    movs    r0, #0\n"
 284             "    bl      sub_e004ff4a\n"
 285             "    b       loc_e0033148\n"
 286             "loc_e003312e:\n"
 287             "    bl      sub_e003d212\n"
 288             "    b       loc_e0033148\n"
 289             "loc_e0033134:\n"
 290             "    bl      sub_e003d214\n"
 291             "    b       loc_e0033148\n"
 292             "loc_e003313a:\n"
 293             "    movw    r2, #0x566\n"
 294             "    ldr     r1, =0xe0032b9c\n" //  *"SsShootTask.c"
 295             "    movs    r0, #0\n"
 296             "    bl      sub_dffc96f4\n"
 297             "loc_e0033148:\n"
 298             "    BL      capt_seq_hook_set_nr\n" //  dark frame control
 299             "    ldr     r0, [sp]\n"
 300             "    ldr     r1, [r0, #4]\n"
 301             "    ldr     r0, [r5, #4]\n"
 302             "    bl      sub_dffc9938\n"
 303             "    ldr     r7, [sp]\n"
 304             "    ldr     r0, [r7, #8]\n"
 305             "    cbnz    r0, loc_e0033164\n"
 306             "    movs    r2, #0xff\n"
 307             "    ldr     r1, =0xe0032bb8\n" //  *"SsShootTask.c"
 308             "    movs    r0, #0\n"
 309             "    bl      sub_dffc96f4\n"
 310             "loc_e0033164:\n"
 311             "    str     r6, [r7, #8]\n"
 312             "    b       loc_e0032f5e\n"
 313     );
 314 }
 315 
 316 //e00464ae
 317 void __attribute__((naked,noinline)) sub_e00464ae_my() {
 318     asm volatile (
 319             //capdis -f=chdk -s=0xe00464af -c=46 -stubs PRIMARY.BIN 0xe0000000
 320             "    push    {r3, r4, r5, r6, r7, lr}\n"
 321             "    bl      sub_e0050788\n"
 322             "    mov     r6, r0\n"
 323             "    movs    r0, #0xc\n"
 324             "    bl      sub_e02f079c\n"
 325             "    ldr     r5, =0x00012134\n"
 326             "    lsls    r0, r0, #0x1f\n"
 327             "    mov.w   r4, #1\n"
 328             "    bne     loc_e0046522\n"
 329             "    movs    r2, #2\n"
 330             "    mov     r1, sp\n"
 331             "    movw    r0, #0x113\n"
 332             "    bl      sub_e036af68\n"
 333             "    lsls    r0, r0, #0x1f\n"
 334             "    beq     loc_e00464e2\n"
 335             "    movs    r0, #0\n"
 336             "    mov.w   r2, #0x1b4\n"
 337             "    ldr     r1, =0xe00465a8\n" //  *"SsCaptureCtrl.c"
 338             "    bl      sub_dffc96f4\n"
 339             "loc_e00464e2:\n"
 340             "    ldrsh.w r0, [sp]\n"
 341             "    bl      sub_e049140e\n"
 342             "    bl      sub_e04911be\n"
 343             "    cmp     r0, #1\n"
 344             "    bls     loc_e0046526\n"
 345             "    movs    r0, #0\n"
 346             "    bl      sub_e04912dc\n"
 347             "    bl      sub_e03817dc\n"
 348             "    bl      sub_e0039268\n"
 349             "    mov     r0, r6\n"
 350             "    bl      sub_e0051f14\n"
 351             "    movs    r2, #4\n"
 352             "    movs    r0, #0x46\n"
 353             "    add.w   r1, r6, #8\n"
 354             "    bl      sub_e036ae24\n"
 355             "    mov     r0, r6\n"
 356             "    bl      sub_e004b410\n"
 357             "    mov     r0, r6\n"
 358             "    bl      sub_e005348c_my\n" // Patched
 359             "    lsls    r0, r0, #0x1f\n"
 360             "    beq     loc_e0046524\n" //  return
 361             "loc_e0046522:\n"
 362             "    str     r4, [r5]\n"
 363             "loc_e0046524:\n"
 364             "    pop     {r3, r4, r5, r6, r7, pc}\n"
 365             "loc_e0046526:\n"
 366             "    str     r4, [r5]\n"
 367             "    bl      sub_e004fc16\n"
 368             "    bl      sub_e02f07dc\n"
 369             "    pop     {r3, r4, r5, r6, r7, pc}\n"
 370     );
 371 }
 372 
 373 //e004644a
 374 void __attribute__((naked,noinline)) sub_e004644a_my() {
 375     asm volatile (
 376             //capdis -f=chdk -s=0xe004644b -c=41 -stubs PRIMARY.BIN 0xe0000000
 377             "    push    {r4, r5, r6, lr}\n"
 378             "    mov     r6, r0\n"
 379             "    ldr     r5, =0x00057d2c\n"
 380             "    movs    r4, #0\n"
 381             "    mov.w   r3, #0x120\n"
 382             "    ldr     r0, [r5, #0x28]\n"
 383             "    cbz     r0, loc_e0046482\n"
 384             "    ldr.w   r2, [r6, #0x138]\n"
 385             "    ldr     r1, =0xe00465c0\n" //  *"CaptCtrl:Quick(%d)"
 386             "    mov     r0, r3\n"
 387             "    bl      sub_e036b640\n"
 388             "    ldr     r0, =0x00012134\n"
 389             "    ldr     r0, [r0]\n"
 390             "    cbz     r0, loc_e004646e\n"
 391             "    movs    r4, #0x1d\n"
 392             "loc_e004646e:\n"
 393             "    movs    r1, #2\n"
 394             "    mov     r2, r6\n"
 395             "    mov     r0, r4\n"
 396             "    bl      sub_e004ff4a\n"
 397             "    mov     r1, r4\n"
 398             "    mov     r0, r6\n"
 399             "    bl      sub_e00531c8\n"
 400             "    b       loc_e00464a8\n"
 401             "loc_e0046482:\n"
 402             "    ldr     r1, =0xe00465d8\n" //  *"CaptCtrl:ExecCapt"
 403             "    mov     r0, r3\n"
 404             "    bl      sub_e036b640\n"
 405             "    mov     r0, r6\n"
 406             "    bl      sub_e004626a_my\n" // Patched
 407             "    mov     r4, r0\n"
 408             "    lsls    r0, r0, #0x1f\n"
 409             "    beq     loc_e00464a8\n"
 410             "    movs    r1, #2\n"
 411             "    mov     r2, r6\n"
 412             "    mov     r0, r4\n"
 413             "    bl      sub_e004ff4a\n"
 414             "    mov     r1, r4\n"
 415             "    mov     r0, r6\n"
 416             "    bl      sub_e00532fe\n"
 417             "loc_e00464a8:\n"
 418             "    movs    r0, #0\n"
 419             "    str     r0, [r5, #0x28]\n"
 420             "    pop     {r4, r5, r6, pc}\n"
 421     );
 422 }
 423 
 424 //e004626a
 425 void __attribute__((naked,noinline)) sub_e004626a_my() {
 426     asm volatile (
 427             //capdis -f=chdk -s=0xe004626b -c=178 -stubs PRIMARY.BIN 0xe0000000
 428             "    push.w  {r2, r3, r4, r5, r6, r7, r8, lr}\n"
 429             "    mov     r4, r0\n"
 430             "    bl      sub_e0051f14\n"
 431             "    ldr     r6, =0x00057d2c\n"
 432             "    ldr.w   r0, [r6, #0x108]\n"
 433             "    cbz     r0, loc_e0046284\n"
 434             "    ldr     r0, [r4, #0xc]\n"
 435             "    cmp     r0, #1\n"
 436             "    beq     loc_e0046292\n"
 437             "    b       loc_e00462a2\n"
 438             "loc_e0046284:\n"
 439             "    ldrh.w  r0, [r6, #0x19e]\n"
 440             "    cmp     r0, #3\n"
 441             "    beq     loc_e0046292\n"
 442             "    ldr     r0, [r4, #8]\n"
 443             "    cmp     r0, #1\n"
 444             "    bhi     loc_e00462a2\n"
 445             "loc_e0046292:\n"
 446             "    movs    r0, #0xc\n"
 447             "    bl      sub_e02f079c\n"
 448             "    lsls    r0, r0, #0x1f\n"
 449             "    beq     loc_e00462a2\n"
 450             "loc_e004629c:\n"
 451             "    bl      sub_e004fc16\n"
 452             "    b       loc_e0046302\n" //  return 0x1
 453             "loc_e00462a2:\n"
 454             "    ldr.w   r0, [r6, #0xec]\n"
 455             "    cbz     r0, loc_e00462c2\n"
 456             "    ldrh.w  r0, [r6, #0x19e]\n"
 457             "    cmp     r0, #3\n"
 458             "    beq     loc_e00462b6\n"
 459             "    ldr     r0, [r4, #8]\n"
 460             "    cmp     r0, #1\n"
 461             "    bhi     loc_e00462f2\n"
 462             "loc_e00462b6:\n"
 463             "    ldr.w   r0, [r6, #0x108]\n"
 464             "    cbz     r0, loc_e00462c2\n"
 465             "    ldr     r0, [r4, #0xc]\n"
 466             "    cmp     r0, #1\n"
 467             "    bhi     loc_e00462f2\n"
 468             "loc_e00462c2:\n"
 469             "    movs    r2, #2\n"
 470             "    mov     r1, sp\n"
 471             "    movw    r0, #0x113\n"
 472             "    bl      sub_e036af68\n"
 473             "    lsls    r0, r0, #0x1f\n"
 474             "    beq     loc_e00462dc\n"
 475             "    movs    r2, #0xe5\n"
 476             "    movs    r0, #0\n"
 477             "    ldr     r1, =0xe00465a8\n" //  *"SsCaptureCtrl.c"
 478             "    bl      sub_dffc96f4\n"
 479             "loc_e00462dc:\n"
 480             "    ldrsh.w r0, [sp]\n"
 481             "    bl      sub_e049140e\n"
 482             "    bl      sub_e04911be\n"
 483             "    cmp     r0, #1\n"
 484             "    bls     loc_e00462fa\n"
 485             "    movs    r0, #0\n"
 486             "    bl      sub_e04912dc\n"
 487             "loc_e00462f2:\n"
 488             "    ldr.w   r0, [r6, #0x1cc]\n"
 489             "    cbnz    r0, loc_e004630e\n"
 490             "    b       loc_e0046308\n"
 491             "loc_e00462fa:\n"
 492             "    bl      sub_e004fc16\n"
 493             "    bl      sub_e02f07dc\n"
 494             "loc_e0046302:\n"
 495             "    movs    r0, #1\n"
 496             "loc_e0046304:\n"
 497             "    pop.w   {r2, r3, r4, r5, r6, r7, r8, pc}\n"
 498             "loc_e0046308:\n"
 499             "    ldr.w   r0, [r6, #0x1c8]\n"
 500             "    cbz     r0, loc_e0046326\n"
 501             "loc_e004630e:\n"
 502             "    ldr     r0, [r4, #8]\n"
 503             "    cmp     r0, #1\n"
 504             "    beq     loc_e0046320\n"
 505             "    movs    r0, #1\n"
 506             "    bl      sub_e0035df4\n"
 507             "    lsls    r0, r0, #0x1f\n"
 508             "    bne     loc_e004629c\n"
 509             "    b       loc_e0046326\n"
 510             "loc_e0046320:\n"
 511             "    movs    r0, #0x64\n"
 512             "    bl      sub_dffc9292\n"
 513             "loc_e0046326:\n"
 514             "    mov     r0, r4\n"
 515             "    bl      sub_e00396b8\n"
 516             "    lsls    r1, r0, #0x1f\n"
 517             "    bne     loc_e0046304\n" //  return
 518             "    ldr     r7, =0x00057f40\n"
 519             "    ldr     r0, [r7]\n"
 520             "    cbz     r0, loc_e004633c\n"
 521             "    mov     r0, r4\n"
 522             "    bl      sub_e005341c\n"
 523             "loc_e004633c:\n"
 524             "    mov     r0, r4\n"
 525             "    bl      sub_e004965e\n"
 526             "    mov     r5, r0\n"
 527             "    lsls    r0, r0, #0x1f\n"
 528             "    bne     loc_e0046446\n"
 529             "    bl      sub_e03817dc\n"
 530             "    bl      sub_e0039268\n"
 531             "    mov     r0, r4\n"
 532             "    bl      sub_e004b410\n"
 533             "    ldr.w   r0, [r6, #0x12c]\n"
 534             "    cbnz    r0, loc_e004636a\n"
 535             "    ldrh.w  r0, [r6, #0x19e]\n"
 536             "    cmp     r0, #3\n"
 537             "    beq     loc_e004636a\n"
 538             "    ldr     r0, [r4, #8]\n"
 539             "    cmp     r0, #1\n"
 540             "    bhi     loc_e0046370\n"
 541             "loc_e004636a:\n"
 542             "    movs    r0, #2\n"
 543             "    bl      sub_e003e64e\n"
 544             "loc_e0046370:\n"
 545             "    ldr.w   r0, [r6, #0x9c]\n"
 546             "    cbz     r0, loc_e00463d4\n"
 547             "    ldrh.w  r0, [r6, #0x19e]\n"
 548             "    mov.w   r8, #0x800\n"
 549             "    cmp     r0, #3\n"
 550             "    beq     loc_e004639e\n"
 551             "    ldr     r0, [r4, #8]\n"
 552             "    cmp     r0, #1\n"
 553             "    bls     loc_e004639e\n"
 554             "    bl      sub_e005157e\n"
 555             "    mov.w   r1, #0x13a\n"
 556             "    ldr     r3, =0xe00465a8\n" //  *"SsCaptureCtrl.c"
 557             "    str     r1, [sp]\n"
 558             "    movw    r2, #0x3a98\n"
 559             "    mov     r1, r8\n"
 560             "    bl      sub_e02f0954\n"
 561             "loc_e004639e:\n"
 562             "    movs    r2, #4\n"
 563             "    add     r1, sp, #4\n"
 564             "    movw    r0, #0x18b\n"
 565             "    bl      sub_e036af68\n"
 566             "    lsls    r0, r0, #0x1f\n"
 567             "    beq     loc_e00463ba\n"
 568             "    movs    r0, #0\n"
 569             "    mov.w   r2, #0x13e\n"
 570             "    ldr     r1, =0xe00465a8\n" //  *"SsCaptureCtrl.c"
 571             "    bl      sub_dffc96f4\n"
 572             "loc_e00463ba:\n"
 573             "    ldr     r0, [sp, #4]\n"
 574             "    cbz     r0, loc_e00463e2\n"
 575             "    bl      sub_e005157e\n"
 576             "    mov     r1, r8\n"
 577             "    bl      sub_dffc9966\n"
 578             "    ldr     r2, =0xe0046259\n"
 579             "    mov     r3, r8\n"
 580             "    ldr     r0, [sp, #4]\n"
 581             "    mov     r1, r2\n"
 582             "    bl      sub_e0370142\n"
 583             "loc_e00463d4:\n"
 584             "    ldr.w   r0, [r6, #0xa4]\n"
 585             "    cbz     r0, loc_e00463ee\n"
 586             "    mov     r0, r4\n"
 587             "    bl      sub_e0053cae\n"
 588             "    b       loc_e0046432\n"
 589             "loc_e00463e2:\n"
 590             "    bl      sub_e005157e\n"
 591             "    mov     r1, r8\n"
 592             "    bl      sub_dffc9938\n"
 593             "    b       loc_e00463d4\n"
 594             "loc_e00463ee:\n"
 595             "    ldr.w   r0, [r6, #0xa8]\n"
 596             "    cbz     r0, loc_e00463fc\n"
 597             "    mov     r0, r4\n"
 598             "    bl      sub_e0053940\n"
 599             "    b       loc_e0046432\n"
 600             "loc_e00463fc:\n"
 601             "    ldr.w   r0, [r6, #0xac]\n"
 602             "    cbz     r0, loc_e004640a\n"
 603             "    mov     r0, r4\n"
 604             "    bl      sub_e0053f92\n"
 605             "    b       loc_e0046432\n"
 606             "loc_e004640a:\n"
 607             "    ldr.w   r0, [r6, #0xb0]\n"
 608             "    cbz     r0, loc_e004641c\n"
 609             "    ldr     r0, [r7]\n"
 610             "    cbz     r0, loc_e004641c\n"
 611             "    mov     r0, r4\n"
 612             "    bl      sub_e005424e\n"
 613             "    b       loc_e0046432\n"
 614             "loc_e004641c:\n"
 615             "    ldr.w   r0, [r6, #0xb4]\n"
 616             "    cmp     r0, #0\n"
 617             "    mov     r0, r4\n"
 618             "    beq     loc_e004642e\n"
 619             "    bl      sub_e005452a\n"
 620             "    b       loc_e0046432\n"
 621             "    b       loc_e0046446\n"
 622             "loc_e004642e:\n"
 623             "    bl      sub_e005348c_my\n" // Patched
 624             "loc_e0046432:\n"
 625             "    ldr.w   r0, [r6, #0x1cc]\n"
 626             "    cbnz    r0, loc_e004643e\n"
 627             "    ldr.w   r0, [r6, #0x1c8]\n"
 628             "    cbz     r0, loc_e0046446\n"
 629             "loc_e004643e:\n"
 630             "    movs    r1, #0\n"
 631             "    movs    r0, #1\n"
 632             "    bl      sub_e0035e3c\n"
 633             "loc_e0046446:\n"
 634             "    mov     r0, r5\n"
 635             "    b       loc_e0046304\n" //  return
 636     );
 637 }
 638 
 639 //e005348c
 640 void __attribute__((naked,noinline)) sub_e005348c_my() {
 641     asm volatile (
 642             //capdis -f=chdk -s=0xe005348d -c=293 -stubs PRIMARY.BIN 0xe0000000
 643             "    push.w  {r0, r1, r2, r3, r4, r5, r6, r7, r8, sb, sl, lr}\n"
 644             "    mov     r4, r0\n"
 645             "    BL      captseq_get_raw_addr\n"  // +
 646             "    ldr     r7, =0x00057d2c\n"
 647             "    ldr.w   r0, [r7, #0x104]\n"
 648             "    cbz     r0, loc_e00534a8\n"
 649             "    ldrh.w  r0, [r7, #0x19e]\n"
 650             "    cmp     r0, #3\n"
 651             "    beq     loc_e00534a8\n"
 652             "    ldr     r0, [r4, #8]\n"
 653             "    cmp     r0, #1\n"
 654             "    bhi     loc_e00534ae\n"
 655             "loc_e00534a8:\n"
 656             "    mov     r0, r4\n"
 657             "    bl      sub_e0051e2a\n"
 658             "loc_e00534ae:\n"
 659             "    mov     r0, r4\n"
 660             "    bl      sub_e0051fdc\n"
 661             "    ldr.w   r0, [r7, #0x168]\n"
 662             "    cbz     r0, loc_e00534c8\n"
 663             "    ldrh.w  r0, [r7, #0x19e]\n"
 664             "    cmp     r0, #3\n"
 665             "    beq     loc_e00534c8\n"
 666             "    ldr     r0, [r4, #8]\n"
 667             "    cmp     r0, #1\n"
 668             "    bhi     loc_e00534d2\n"
 669             "loc_e00534c8:\n"
 670             "    mov     r0, r4\n"
 671             "    bl      sub_e004b35c\n"
 672             "    bl      sub_e003ccf0\n"
 673             "loc_e00534d2:\n"
 674             "    ldr.w   r0, [r7, #0x98]\n"
 675             "    cbnz    r0, loc_e00534f0\n"
 676             "    ldrh.w  r0, [r7, #0x19e]\n"
 677             "    cmp     r0, #3\n"
 678             "    beq     loc_e00534e6\n"
 679             "    ldr     r0, [r4, #8]\n"
 680             "    cmp     r0, #1\n"
 681             "    bhi     loc_e00534f0\n"
 682             "loc_e00534e6:\n"
 683             "    movs    r0, #1\n"
 684             "    bl      sub_e0039694\n"
 685             "    bl      sub_e003c8ca\n"
 686             "loc_e00534f0:\n"
 687             "    movs    r2, #4\n"
 688             "    add     r1, sp, #8\n"
 689             "    mov.w   r0, #0x13a\n"
 690             "    bl      sub_e036af68\n"
 691             "    lsls    r0, r0, #0x1f\n"
 692             "    beq     loc_e005350c\n"
 693             "    movs    r0, #0\n"
 694             "    movw    r2, #0x191\n"
 695             "    ldr     r1, =0xe005381c\n" //  *"SsStandardCaptureSeq.c"
 696             "    bl      sub_dffc96f4\n"
 697             "loc_e005350c:\n"
 698             "    ldr     r0, [sp, #8]\n"
 699             "    ubfx    r0, r0, #8, #8\n"
 700             "    cmp     r0, #6\n"
 701             "    beq     loc_e0053586\n"
 702             "    mov     r1, r4\n"
 703             "    ldr     r0, =0xe004b013\n"
 704             "loc_e005351a:\n"
 705             "    bl      sub_e0066cf0\n"
 706             "    movs    r2, #2\n"
 707             "    add     r1, sp, #0xc\n"
 708             "    movw    r0, #0x115\n"
 709             "    bl      sub_e036af68\n"
 710             "    lsls    r0, r0, #0x1f\n"
 711             "    beq     loc_e005353a\n"
 712             "    movs    r0, #0\n"
 713             "    mov.w   r2, #0x19a\n"
 714             "    ldr     r1, =0xe005381c\n" //  *"SsStandardCaptureSeq.c"
 715             "    bl      sub_dffc96f4\n"
 716             "loc_e005353a:\n"
 717             "    ldr.w   r0, [r7, #0x104]\n"
 718             "    cbz     r0, loc_e005356e\n"
 719             "    ldrh.w  r0, [r7, #0x19e]\n"
 720             "    cmp     r0, #3\n"
 721             "    beq     loc_e005354e\n"
 722             "    ldr     r0, [r4, #8]\n"
 723             "    cmp     r0, #1\n"
 724             "    bhi     loc_e005356e\n"
 725             "loc_e005354e:\n"
 726             "    movs    r0, #1\n"
 727             "    movw    r5, #0x169\n"
 728             "    strh.w  r0, [sp]\n"
 729             "    movs    r2, #2\n"
 730             "    mov     r1, sp\n"
 731             "    mov     r0, r5\n"
 732             "    bl      sub_e036ae24\n"
 733             "    ldr     r0, [r4, #0x1c]\n"
 734             "    movs    r3, #2\n"
 735             "    mov     r2, sp\n"
 736             "    mov     r1, r5\n"
 737             "    bl      sub_e036b28a\n"
 738             "loc_e005356e:\n"
 739             "    ldr.w   r0, [r7, #0x188]\n"
 740             "    cbz     r0, loc_e0053578\n"
 741             "    bl      sub_e004b294\n"
 742             "loc_e0053578:\n"
 743             "    movs    r0, #0\n"
 744             "    bl      sub_e0035dec\n" //  return
 745             "    ldr     r0, =0x00057f40\n"
 746             "    ldr     r0, [r0]\n"
 747             "    cbz     r0, loc_e005358c\n"
 748             "    b       loc_e0053592\n"
 749             "loc_e0053586:\n"
 750             "    ldr     r0, =0xe0053409\n"
 751             "    movs    r1, #0\n"
 752             "    b       loc_e005351a\n"
 753             "loc_e005358c:\n"
 754             "    mov     r0, r4\n"
 755             "    bl      sub_e005341c\n"
 756             "loc_e0053592:\n"
 757             "    mov     r0, r4\n"
 758             "    bl      sub_e004b4e0\n"
 759             "    movs    r2, #4\n"
 760             "    movs    r0, #0x92\n"
 761             "    add     r1, sp, #4\n"
 762             "    bl      sub_e036af68\n"
 763             "    lsls    r0, r0, #0x1f\n"
 764             "    beq     loc_e00535b2\n"
 765             "    movs    r0, #0\n"
 766             "    movw    r2, #0x1c3\n"
 767             "    ldr     r1, =0xe005381c\n" //  *"SsStandardCaptureSeq.c"
 768             "    bl      sub_dffc96f4\n"
 769             "loc_e00535b2:\n"
 770             "    ldr     r1, =0x00037e84\n"
 771             "    ldr     r0, [sp, #4]\n"
 772             "    str     r0, [r1]\n"
 773             "    ldr.w   r0, [r7, #0xc0]\n"
 774             "    cbnz    r0, loc_e00535c2\n"
 775             "    bl      sub_e0035ea8\n"
 776             "loc_e00535c2:\n"
 777             "    bl      sub_e004b572\n"
 778             "    movs    r1, #0\n"
 779             "    mov     r0, r4\n"
 780             "    bl      sub_e00538fa\n"
 781             "    mov     r5, r0\n"
 782             "    BL      wait_until_remote_button_is_released\n"    // + remote hook
 783             "    ldr     r0, [sp, #8]\n"
 784             "    ubfx    r0, r0, #8, #8\n"
 785             "    cmp     r0, #6\n"
 786             "    beq     loc_e0053622\n"
 787             "    ldr     r6, =0xe004b275\n"
 788             "loc_e00535dc:\n"
 789             "    ldrh    r0, [r4, #0x18]\n"
 790             "    ldr.w   r8, =0xfffff3a0\n"
 791             "    cbz     r0, loc_e0053626\n"
 792             "    cmp     r0, #1\n"
 793             "    beq     loc_e005363c\n"
 794             "    cmp     r0, #4\n"
 795             "    beq     loc_e0053626\n"
 796             "    movs    r0, #0\n"
 797             "    mov.w   r2, #0x210\n"
 798             "    ldr     r1, =0xe005381c\n" //  *"SsStandardCaptureSeq.c"
 799             "    bl      sub_dffc96f4\n"
 800             "    movs    r6, #0x1d\n"
 801             "loc_e00535fa:\n"
 802             "    ldrsh.w r0, [sp, #0xc]\n"
 803             "    cmp     r0, r8\n"
 804             "    beq     loc_e0053614\n"
 805             "    bl      sub_e0066cbe\n"
 806             "    cbz     r0, loc_e0053614\n"
 807             "    movs    r2, #1\n"
 808             "    movs    r1, #0\n"
 809             "    movs    r0, #0x46\n"
 810             "    bl      sub_e0299940\n"
 811             "    movs    r6, #1\n"
 812             "loc_e0053614:\n"
 813             "    bl      sub_e004b576\n"
 814             "    ldr.w   r8, =0xe0053409\n"
 815             "    lsls    r0, r6, #0x1f\n"
 816             "    beq     loc_e00536bc\n"
 817             "    b       loc_e0053730\n"
 818             "loc_e0053622:\n"
 819             "    ldr     r6, =0xe004b25f\n"
 820             "    b       loc_e00535dc\n"
 821             "loc_e0053626:\n"
 822             "    str     r5, [sp]\n"
 823             "    mov     r3, r6\n"
 824             "    ldr     r1, [r4, #0x64]\n"
 825             "    mov     r0, r4\n"
 826             "    ldr     r2, [sp, #4]\n"
 827             "    bl      sub_e004ae3e\n"
 828             "    mov     r6, r0\n"
 829             "    bl      sub_e043e5e2\n"
 830             "    b       loc_e00535fa\n"
 831             "loc_e005363c:\n"
 832             "    ldr.w   r0, [r7, #0xc0]\n"
 833             "    cbz     r0, loc_e005364e\n"
 834             "    movs    r0, #0\n"
 835             "    movw    r2, #0x1e7\n"
 836             "    ldr     r1, =0xe005381c\n" //  *"SsStandardCaptureSeq.c"
 837             "    bl      sub_dffc96f4\n"
 838             "loc_e005364e:\n"
 839             "    str     r5, [sp]\n"
 840             "    mov     r3, r6\n"
 841             "    ldr     r1, [r4, #0x64]\n"
 842             "    mov     r0, r4\n"
 843             "    ldr     r2, [sp, #4]\n"
 844             "    bl      sub_e004aeba\n"
 845             "    mov     r6, r0\n"
 846             "    ldrsh.w r0, [sp, #0xc]\n"
 847             "    cmp     r0, r8\n"
 848             "    beq     loc_e005366c\n"
 849             "    bl      sub_e0066cbe\n"
 850             "    cbnz    r0, loc_e0053676\n"
 851             "loc_e005366c:\n"
 852             "    movs    r2, #1\n"
 853             "    movs    r1, #0\n"
 854             "    movs    r0, #0x45\n"
 855             "    bl      sub_e0299940\n"
 856             "loc_e0053676:\n"
 857             "    lsls    r0, r6, #0x1f\n"
 858             "    bne     loc_e00535fa\n"
 859             "    ldr.w   r0, [r7, #0xfc]\n"
 860             "    cbz     r0, loc_e0053690\n"
 861             "    ldr     r1, [r4, #8]\n"
 862             "    ldr     r2, =0x00229618\n"
 863             "    ldr     r0, [r4, #0x64]\n"
 864             "    add.w   r1, r2, r1, lsl #2\n"
 865             "    str     r0, [r1, #-0x4]\n"
 866             "    b       loc_e00536b6\n"
 867             "loc_e0053690:\n"
 868             "    ldr     r0, =0xe0053409\n"
 869             "    movs    r1, #0\n"
 870             "    bl      sub_e0066cf0\n"
 871             "    movs    r1, #1\n"
 872             "    mov     r0, r4\n"
 873             "    bl      sub_e00538fa\n"
 874             "    mov     r5, r0\n"
 875             "    ldr     r0, [sp, #4]\n"
 876             "    bl      sub_e004b2fe\n"
 877             "    ldr     r1, [r4, #0x64]\n"
 878             "    mov     r3, r5\n"
 879             "    ldr     r2, [sp, #4]\n"
 880             "    mov     r0, r4\n"
 881             "    bl      sub_e004af2c\n"
 882             "    mov     r6, r0\n"
 883             "loc_e00536b6:\n"
 884             "    bl      sub_e004ade6\n"
 885             "    b       loc_e00535fa\n"
 886             "loc_e00536bc:\n"
 887             "    ldr.w   r0, [r7, #0x104]\n"
 888             "    cbnz    r0, loc_e00536fc\n"
 889             "    ldr.w   r0, [r7, #0x1cc]\n"
 890             "    cbnz    r0, loc_e00536ce\n"
 891             "    ldr.w   r0, [r7, #0x1c8]\n"
 892             "    cbz     r0, loc_e00536e6\n"
 893             "loc_e00536ce:\n"
 894             "    ldrh.w  r0, [r7, #0x1ec]\n"
 895             "    cmp     r0, #1\n"
 896             "    bne     loc_e00536fc\n"
 897             "    mov     r0, r4\n"
 898             "    bl      sub_e004baf4\n"
 899             "    lsls    r0, r0, #0x1f\n"
 900             "    beq     loc_e00536fc\n"
 901             "    movw    r2, #0x227\n"
 902             "    b       loc_e00536f4\n"
 903             "loc_e00536e6:\n"
 904             "    mov     r0, r4\n"
 905             "    bl      sub_e004baf4\n"
 906             "    lsls    r0, r0, #0x1f\n"
 907             "    beq     loc_e00536fc\n"
 908             "    movw    r2, #0x22a\n"
 909             "loc_e00536f4:\n"
 910             "    movs    r0, #0\n"
 911             "    ldr     r1, =0xe005381c\n" //  *"SsStandardCaptureSeq.c"
 912             "    bl      sub_dffc96f4\n"
 913             "loc_e00536fc:\n"
 914             "    mov     r0, r4\n"
 915             "    bl      sub_e004b562\n"
 916             "    mov     r0, r4\n"
 917             "    bl      sub_e004b536\n"
 918             "    cmp     r5, r8\n"
 919             "    beq     loc_e0053730\n"
 920             "    bl      sub_e005157e\n"
 921             "    movw    sb, #0x23a\n"
 922             "    movs    r1, #4\n"
 923             "    ldr     r3, =0xe005381c\n" //  *"SsStandardCaptureSeq.c"
 924             "    movw    r2, #0x3a98\n"
 925             "    str.w   sb, [sp]\n"
 926             "    bl      sub_e02f0954\n"
 927             "    cbz     r0, loc_e0053730\n"
 928             "    movs    r0, #0\n"
 929             "    mov     r2, sb\n"
 930             "    ldr     r1, =0xe005381c\n" //  *"SsStandardCaptureSeq.c"
 931             "    bl      sub_dffc96f4\n"
 932             "loc_e0053730:\n"
 933             "    BL      capt_seq_hook_raw_here\n"  // +
 934             "    ldrh    r0, [r7]\n"
 935             "    sub.w   r1, r0, #0x4000\n"
 936             "    subs    r1, #0x45\n"
 937             "    bne     loc_e0053744\n"
 938             "    movs    r0, #0\n"
 939             "    bl      sub_e0299fb0\n"
 940             "    bl      sub_e0299fa6\n"
 941             "loc_e0053744:\n"
 942             "    ldr.w   r0, [r7, #0x188]\n"
 943             "    cbz     r0, loc_e0053754\n"
 944             "    movs    r2, #1\n"
 945             "    movs    r1, #0\n"
 946             "    movs    r0, #0x46\n"
 947             "    bl      sub_e0299940\n"
 948             "loc_e0053754:\n"
 949             "    movs    r1, #2\n"
 950             "    mov     r2, r4\n"
 951             "    mov     r0, r6\n"
 952             "    bl      sub_e004ff4a\n"
 953             "    ldr     r0, [r7, #0x28]\n"
 954             "    cbz     r0, loc_e0053776\n"
 955             "    cmp     r5, r8\n"
 956             "    beq     loc_e005376a\n"
 957             "    movs    r1, #1\n"
 958             "    b       loc_e005376c\n"
 959             "loc_e005376a:\n"
 960             "    movs    r1, #0\n"
 961             "loc_e005376c:\n"
 962             "    mov     r2, r6\n"
 963             "    mov     r0, r4\n"
 964             "    bl      sub_e0053184\n"
 965             "    b       loc_e0053788\n"
 966             "loc_e0053776:\n"
 967             "    cmp     r5, r8\n"
 968             "    beq     loc_e005377e\n"
 969             "    movs    r1, #1\n"
 970             "    b       loc_e0053780\n"
 971             "loc_e005377e:\n"
 972             "    movs    r1, #0\n"
 973             "loc_e0053780:\n"
 974             "    mov     r2, r6\n"
 975             "    mov     r0, r4\n"
 976             "    bl      sub_e005313e\n"
 977             "loc_e0053788:\n"
 978             "    add     sp, #0x10\n"
 979             "    mov     r0, r6\n"
 980             "    pop.w   {r4, r5, r6, r7, r8, sb, sl, pc}\n"
 981     );
 982 }
 983 
 984 // exp_drv_task 0xe02d0ad8
 985 void __attribute__((naked,noinline))
 986 exp_drv_task ()
 987 {
 988     // e02d0ad9 -> e02d0e52 -> e02cd9ee -> e02cda5a -> e0072240 -> e0072276 -> apex2us
 989     asm volatile (
 990             //capdis -f=chdk -s=0xe02d0ad9 -c=259 -stubs PRIMARY.BIN 0xe0000000
 991             "    push.w  {r4, r5, r6, r7, r8, sb, sl, fp, lr}\n"
 992             "    mov.w   fp, #0\n"
 993             "    ldr.w   sl, =0x0000e1a8\n"
 994             "    sub     sp, #0x34\n"
 995             "    ldr.w   sb, =0xfffff400\n"
 996             "    movs    r7, #0x3e\n"
 997             "    ldr     r5, =0x00064788\n"
 998             "    mov.w   r8, #1\n"
 999             "    str.w   fp, [sp, #0x24]\n"
1000             "loc_e02d0af6:\n"
1001             "    movs    r2, #0\n"
1002             "    ldr.w   r0, [sl, #0x20]\n"
1003             "    add     r1, sp, #0x14\n"
1004             "    mov     r4, sl\n"
1005             "    bl      sub_dffc9de0\n"
1006             "    ldr     r0, [sp, #0x14]\n"
1007             "    cmp     r7, #0x15\n"
1008             "    ldr     r0, [r0]\n"
1009             "    beq     loc_e02d0b20\n"
1010             "    cmp     r7, #0x16\n"
1011             "    beq     loc_e02d0b20\n"
1012             "    cmp     r7, #0x17\n"
1013             "    beq     loc_e02d0b20\n"
1014             "    cmp     r7, #0x18\n"
1015             "    beq     loc_e02d0b20\n"
1016             "    cmp     r7, #0x19\n"
1017             "    beq     loc_e02d0b20\n"
1018             "    cmp     r7, #0x1a\n"
1019             "    bne     loc_e02d0b48\n"
1020             "loc_e02d0b20:\n"
1021             "    cmp     r0, #0x15\n"
1022             "    beq     loc_e02d0b50\n"
1023             "    cmp     r0, #0x16\n"
1024             "    beq     loc_e02d0b50\n"
1025             "    cmp     r0, #0x17\n"
1026             "    beq     loc_e02d0b50\n"
1027             "    cmp     r0, #0x18\n"
1028             "    beq     loc_e02d0b50\n"
1029             "    cmp     r0, #0x19\n"
1030             "    beq     loc_e02d0b50\n"
1031             "    cmp     r0, #0x1a\n"
1032             "    beq     loc_e02d0b50\n"
1033             "    cmp     r0, #0x3b\n"
1034             "    beq     loc_e02d0c26\n"
1035             "    cmp     r0, #0x36\n"
1036             "    beq     loc_e02d0b50\n"
1037             "    movs    r0, #0\n"
1038             "    add     r1, sp, #0x24\n"
1039             "    bl      sub_e02d0a94\n"
1040             "loc_e02d0b48:\n"
1041             "    ldr     r0, [sp, #0x14]\n"
1042             "    ldr     r0, [r0]\n"
1043             "    cmp     r0, #0x3b\n"
1044             "    beq     loc_e02d0c26\n"
1045             "loc_e02d0b50:\n"
1046             "    ldr     r0, [sp, #0x14]\n"
1047             "    ldr     r7, [r0]\n"
1048             "    cmp     r7, #0x3e\n"
1049             "    beq     loc_e02d0be2\n"
1050             "    cmp     r7, #0x3d\n"
1051             "    beq     loc_e02d0bf8\n"
1052             "    cmp     r7, #0x34\n"
1053             "    beq     loc_e02d0c00\n"
1054             "    cmp     r7, #0x35\n"
1055             "    beq     loc_e02d0c2c\n"
1056             "    cmp     r7, #0x36\n"
1057             "    beq     loc_e02d0c5c\n"
1058             "    cmp     r7, #0x3b\n"
1059             "    beq     loc_e02d0c26\n"
1060             "    cmp     r7, #0x3c\n"
1061             "    beq     loc_e02d0c5e\n"
1062             "    movs    r6, #1\n"
1063             "    cmp     r7, #0x13\n"
1064             "    beq     loc_e02d0c60\n"
1065             "    cmp     r7, #0x14\n"
1066             "    beq     loc_e02d0c60\n"
1067             "    cmp     r7, #0x15\n"
1068             "    beq     loc_e02d0c62\n"
1069             "    cmp     r7, #0x16\n"
1070             "    beq     loc_e02d0c62\n"
1071             "    cmp     r7, #0x17\n"
1072             "    beq     loc_e02d0c62\n"
1073             "    cmp     r7, #0x18\n"
1074             "    beq     loc_e02d0c62\n"
1075             "    cmp     r7, #0x19\n"
1076             "    beq     loc_e02d0c62\n"
1077             "    cmp     r7, #0x1a\n"
1078             "    beq     loc_e02d0c62\n"
1079             "    cmp     r7, #0x2d\n"
1080             "    beq     loc_e02d0c64\n"
1081             "    cmp     r7, #0x2e\n"
1082             "    beq     loc_e02d0c64\n"
1083             "    adds    r1, r0, #4\n"
1084             "    add     r4, sp, #8\n"
1085             "    ldm     r1, {r1, r2, r3}\n"
1086             "    stm.w   r4, {r1, r2, r3}\n"
1087             "    ldr     r1, [r0]\n"
1088             "    cmp     r1, #0x34\n"
1089             "    bhs     loc_e02d0ca6\n"
1090             "    tbb     [pc, r1]\n" // (jumptable r1 52 elements)
1091             "branchtable_e02d0bae:\n"
1092             "    .byte((loc_e02d0d8a - branchtable_e02d0bae) / 2)\n" // (case 0)
1093             "    .byte((loc_e02d0d8a - branchtable_e02d0bae) / 2)\n" // (case 1)
1094             "    .byte((loc_e02d0d88 - branchtable_e02d0bae) / 2)\n" // (case 2)
1095             "    .byte((loc_e02d0d86 - branchtable_e02d0bae) / 2)\n" // (case 3)
1096             "    .byte((loc_e02d0d86 - branchtable_e02d0bae) / 2)\n" // (case 4)
1097             "    .byte((loc_e02d0d86 - branchtable_e02d0bae) / 2)\n" // (case 5)
1098             "    .byte((loc_e02d0d8a - branchtable_e02d0bae) / 2)\n" // (case 6)
1099             "    .byte((loc_e02d0d88 - branchtable_e02d0bae) / 2)\n" // (case 7)
1100             "    .byte((loc_e02d0d86 - branchtable_e02d0bae) / 2)\n" // (case 8)
1101             "    .byte((loc_e02d0d86 - branchtable_e02d0bae) / 2)\n" // (case 9)
1102             "    .byte((loc_e02d0d84 - branchtable_e02d0bae) / 2)\n" // (case 10)
1103             "    .byte((loc_e02d0d84 - branchtable_e02d0bae) / 2)\n" // (case 11)
1104             "    .byte((loc_e02d0d84 - branchtable_e02d0bae) / 2)\n" // (case 12)
1105             "    .byte((loc_e02d0d82 - branchtable_e02d0bae) / 2)\n" // (case 13)
1106             "    .byte((loc_e02d0d80 - branchtable_e02d0bae) / 2)\n" // (case 14)
1107             "    .byte((loc_e02d0d80 - branchtable_e02d0bae) / 2)\n" // (case 15)
1108             "    .byte((loc_e02d0d80 - branchtable_e02d0bae) / 2)\n" // (case 16)
1109             "    .byte((loc_e02d0d80 - branchtable_e02d0bae) / 2)\n" // (case 17)
1110             "    .byte((loc_e02d0d7e - branchtable_e02d0bae) / 2)\n" // (case 18)
1111             "    .byte((loc_e02d0ca6 - branchtable_e02d0bae) / 2)\n" // (case 19)
1112             "    .byte((loc_e02d0ca6 - branchtable_e02d0bae) / 2)\n" // (case 20)
1113             "    .byte((loc_e02d0ca6 - branchtable_e02d0bae) / 2)\n" // (case 21)
1114             "    .byte((loc_e02d0ca6 - branchtable_e02d0bae) / 2)\n" // (case 22)
1115             "    .byte((loc_e02d0ca6 - branchtable_e02d0bae) / 2)\n" // (case 23)
1116             "    .byte((loc_e02d0ca6 - branchtable_e02d0bae) / 2)\n" // (case 24)
1117             "    .byte((loc_e02d0ca6 - branchtable_e02d0bae) / 2)\n" // (case 25)
1118             "    .byte((loc_e02d0ca6 - branchtable_e02d0bae) / 2)\n" // (case 26)
1119             "    .byte((loc_e02d0d7c - branchtable_e02d0bae) / 2)\n" // (case 27)
1120             "    .byte((loc_e02d0d7a - branchtable_e02d0bae) / 2)\n" // (case 28)
1121             "    .byte((loc_e02d0d7a - branchtable_e02d0bae) / 2)\n" // (case 29)
1122             "    .byte((loc_e02d0d7a - branchtable_e02d0bae) / 2)\n" // (case 30)
1123             "    .byte((loc_e02d0d78 - branchtable_e02d0bae) / 2)\n" // (case 31)
1124             "    .byte((loc_e02d0d78 - branchtable_e02d0bae) / 2)\n" // (case 32)
1125             "    .byte((loc_e02d0d78 - branchtable_e02d0bae) / 2)\n" // (case 33)
1126             "    .byte((loc_e02d0d78 - branchtable_e02d0bae) / 2)\n" // (case 34)
1127             "    .byte((loc_e02d0d78 - branchtable_e02d0bae) / 2)\n" // (case 35)
1128             "    .byte((loc_e02d0d78 - branchtable_e02d0bae) / 2)\n" // (case 36)
1129             "    .byte((loc_e02d0d76 - branchtable_e02d0bae) / 2)\n" // (case 37)
1130             "    .byte((loc_e02d0d74 - branchtable_e02d0bae) / 2)\n" // (case 38)
1131             "    .byte((loc_e02d0ca6 - branchtable_e02d0bae) / 2)\n" // (case 39)
1132             "    .byte((loc_e02d0ca6 - branchtable_e02d0bae) / 2)\n" // (case 40)
1133             "    .byte((loc_e02d0d72 - branchtable_e02d0bae) / 2)\n" // (case 41)
1134             "    .byte((loc_e02d0d70 - branchtable_e02d0bae) / 2)\n" // (case 42)
1135             "    .byte((loc_e02d0d6e - branchtable_e02d0bae) / 2)\n" // (case 43)
1136             "    .byte((loc_e02d0d6e - branchtable_e02d0bae) / 2)\n" // (case 44)
1137             "    .byte((loc_e02d0ca6 - branchtable_e02d0bae) / 2)\n" // (case 45)
1138             "    .byte((loc_e02d0ca6 - branchtable_e02d0bae) / 2)\n" // (case 46)
1139             "    .byte((loc_e02d0d6c - branchtable_e02d0bae) / 2)\n" // (case 47)
1140             "    .byte((loc_e02d0d6c - branchtable_e02d0bae) / 2)\n" // (case 48)
1141             "    .byte((loc_e02d0d6c - branchtable_e02d0bae) / 2)\n" // (case 49)
1142             "    .byte((loc_e02d0d6a - branchtable_e02d0bae) / 2)\n" // (case 50)
1143             "    .byte((loc_e02d0d6a - branchtable_e02d0bae) / 2)\n" // (case 51)
1144             ".align 1\n"
1145             "loc_e02d0be2:\n"
1146             "    bl      sub_e02d1bdc\n"
1147             "    ldr.w   r0, [sl, #0x1c]\n"
1148             "    movs    r1, #1\n"
1149             "    bl      sub_dffc9938\n"
1150             "    bl      sub_dffc95ae\n"
1151             "    add     sp, #0x34\n"
1152             "    b       sub_e02d0814\n" //  return
1153             "loc_e02d0bf8:\n"
1154             "    ldrd    r1, r2, [r0, #0xac]\n"
1155             "    mov     r0, r2\n"
1156             "    b       loc_e02d0c28\n"
1157             "loc_e02d0c00:\n"
1158             "    ldr     r0, [r4, #0x1c]\n"
1159             "    movs    r1, #0x80\n"
1160             "    bl      sub_dffc9966\n"
1161             "    ldr     r0, =0xe02cc4b9\n"
1162             "    movs    r1, #0x80\n"
1163             "    bl      sub_e0061dd6\n"
1164             "    ldr     r0, [r4, #0x1c]\n"
1165             "    movs    r1, #0x80\n"
1166             "    movw    r2, #0xbb8\n"
1167             "    bl      sub_dffc98b6\n"
1168             "    lsls    r0, r0, #0x1f\n"
1169             "    beq     loc_e02d0cc2\n"
1170             "    movw    r2, #0x19e7\n"
1171             "    b       loc_e02d0c5a\n"
1172             "loc_e02d0c26:\n"
1173             "    b       loc_e02d0c78\n"
1174             "loc_e02d0c28:\n"
1175             "    blx     r1\n"
1176             "    b       loc_e02d1008\n"
1177             "loc_e02d0c2c:\n"
1178             "    add     r1, sp, #0x24\n"
1179             "    bl      sub_e02d0a94\n"
1180             "    ldr     r0, [r4, #0x1c]\n"
1181             "    mov.w   r6, #0x100\n"
1182             "    mov     r1, r6\n"
1183             "    bl      sub_dffc9966\n"
1184             "    ldr     r0, =0xe02cc4c3\n"
1185             "    mov     r1, r6\n"
1186             "    bl      sub_e006279c\n"
1187             "    ldr     r0, [r4, #0x1c]\n"
1188             "    movw    r2, #0xbb8\n"
1189             "    mov     r1, r6\n"
1190             "    bl      sub_dffc98b6\n"
1191             "    lsls    r0, r0, #0x1f\n"
1192             "    beq     loc_e02d0cc2\n"
1193             "    movw    r2, #0x19f1\n"
1194             "loc_e02d0c5a:\n"
1195             "    b       loc_e02d0c66\n"
1196             "loc_e02d0c5c:\n"
1197             "    b       loc_e02d0c70\n"
1198             "loc_e02d0c5e:\n"
1199             "    b       loc_e02d0c86\n"
1200             "loc_e02d0c60:\n"
1201             "    b       loc_e02d0cca\n"
1202             "loc_e02d0c62:\n"
1203             "    b       loc_e02d0d04\n"
1204             "loc_e02d0c64:\n"
1205             "    b       loc_e02d0dc0\n"
1206             "loc_e02d0c66:\n"
1207             "    movs    r0, #0\n"
1208             "    ldr     r1, =0xe02d0db0\n" //  *"ExpDrv.c"
1209             "    bl      sub_dffc96f4\n"
1210             "    b       loc_e02d0cc2\n"
1211             "loc_e02d0c70:\n"
1212             "    add     r1, sp, #0x24\n"
1213             "    bl      sub_e02d0a94\n"
1214             "    b       loc_e02d0cc2\n"
1215             "loc_e02d0c78:\n"
1216             "    bl      sub_e00724de\n"
1217             "    bl      sub_e047005c\n"
1218             "    bl      sub_e043aff4\n"
1219             "    b       loc_e02d0cc2\n"
1220             "loc_e02d0c86:\n"
1221             "    bl      sub_e035bbe4\n"
1222             "    mov     r6, r0\n"
1223             "    ldr     r0, [r4, #0x1c]\n"
1224             "    movs    r1, #4\n"
1225             "    bl      sub_dffc9966\n"
1226             "    ldr     r2, =0xe02cc4d7\n"
1227             "    movs    r3, #4\n"
1228             "    mov     r1, r6\n"
1229             "    mov     r0, sb\n"
1230             "    str.w   r8, [sp]\n"
1231             "    bl      sub_e02d1c2e\n"
1232             "    b       loc_e02d0ca8\n"
1233             "loc_e02d0ca6:\n"
1234             "    b       loc_e02d0f2a\n"
1235             "loc_e02d0ca8:\n"
1236             "    bl      sub_e00721e6\n"
1237             "    ldr     r0, [r4, #0x1c]\n"
1238             "    movs    r1, #4\n"
1239             "    movw    r2, #0xbb8\n"
1240             "    bl      sub_dffc9830\n"
1241             "    lsls    r0, r0, #0x1f\n"
1242             "    beq     loc_e02d0cc2\n"
1243             "    movw    r2, #0x1ae3\n"
1244             "    b       loc_e02d0c5a\n"
1245             "loc_e02d0cc2:\n"
1246             "    ldr     r1, [sp, #0x14]\n"
1247             "    ldrd    r1, r0, [r1, #0xac]\n"
1248             "    b       loc_e02d0c28\n"
1249             "loc_e02d0cca:\n"
1250             "    ldr.w   r1, [r0, #0x94]\n"
1251             "    add     r4, sp, #8\n"
1252             "    add.w   r1, r1, r1, lsl #1\n"
1253             "    add.w   r1, r0, r1, lsl #2\n"
1254             "    subs    r1, #8\n"
1255             "    ldm     r1, {r1, r2, r3}\n"
1256             "    stm.w   r4, {r1, r2, r3}\n"
1257             "    bl      sub_e02cf23a\n"
1258             "    ldr     r0, [sp, #0x14]\n"
1259             "    ldrd    r3, r2, [r0, #0xac]\n"
1260             "    ldr.w   r1, [r0, #0x94]\n"
1261             "    adds    r0, r0, #4\n"
1262             "    blx     r3\n"
1263             "    ldr     r0, [sp, #0x14]\n"
1264             "    bl      sub_e02d1df0\n"
1265             "    ldr     r0, [sp, #0x14]\n"
1266             "    ldrd    r3, r2, [r0, #0xb4]\n"
1267             "    ldr.w   r1, [r0, #0x94]\n"
1268             "    b       loc_e02d0f34\n"
1269             "loc_e02d0d04:\n"
1270             "    add     r3, sp, #0x24\n"
1271             "    add     r2, sp, #0x28\n"
1272             "    add     r1, sp, #8\n"
1273             "    bl      sub_e02cf446\n"
1274             "    cmp     r0, #1\n"
1275             "    mov     r4, r0\n"
1276             "    beq     loc_e02d0d32\n"
1277             "    cmp     r4, #5\n"
1278             "    beq     loc_e02d0d32\n"
1279             "    cmp     r4, #2\n"
1280             "    beq     loc_e02d0d44\n"
1281             "    cmp     r4, #6\n"
1282             "    beq     loc_e02d0d44\n"
1283             "    ldr     r0, [sp, #0x14]\n"
1284             "    mov     r2, r4\n"
1285             "    ldrd    ip, r3, [r0, #0xac]\n"
1286             "    ldr.w   r1, [r0, #0x94]\n"
1287             "    adds    r0, r0, #4\n"
1288             "    blx     ip\n"
1289             "    b       loc_e02d0f38\n"
1290             "loc_e02d0d32:\n"
1291             "    ldr     r0, [sp, #0x14]\n"
1292             "    mov     r2, r4\n"
1293             "    ldrd    ip, r3, [r0, #0xac]\n"
1294             "    ldr.w   r1, [r0, #0x94]\n"
1295             "    adds    r0, r0, #4\n"
1296             "    blx     ip\n"
1297             "    b       loc_e02d0d5e\n"
1298             "loc_e02d0d44:\n"
1299             "    ldr     r0, [sp, #0x14]\n"
1300             "    mov     r2, r4\n"
1301             "    ldrd    ip, r3, [r0, #0xac]\n"
1302             "    ldr.w   r1, [r0, #0x94]\n"
1303             "    adds    r0, r0, #4\n"
1304             "    blx     ip\n"
1305             "    ldr     r0, [sp, #0x14]\n"
1306             "    add     r2, sp, #0x28\n"
1307             "    add     r1, sp, #8\n"
1308             "    bl      sub_e02d0818\n"
1309             "loc_e02d0d5e:\n"
1310             "    ldr     r2, [sp, #0x24]\n"
1311             "    mov     r1, r4\n"
1312             "    ldr     r0, [sp, #0x14]\n"
1313             "    bl      sub_e02d0a44\n"
1314             "    b       loc_e02d0f38\n"
1315             "loc_e02d0d6a:\n"
1316             "    b       loc_e02d0f14\n"
1317             "loc_e02d0d6c:\n"
1318             "    b       loc_e02d0f0e\n"
1319             "loc_e02d0d6e:\n"
1320             "    b       loc_e02d0f08\n"
1321             "loc_e02d0d70:\n"
1322             "    b       loc_e02d0ede\n"
1323             "loc_e02d0d72:\n"
1324             "    b       loc_e02d0eb4\n"
1325             "loc_e02d0d74:\n"
1326             "    b       loc_e02d0e8a\n"
1327             "loc_e02d0d76:\n"
1328             "    b       loc_e02d0e60\n"
1329             "loc_e02d0d78:\n"
1330             "    b       loc_e02d0e5a\n"
1331             "loc_e02d0d7a:\n"
1332             "    b       loc_e02d0e4c\n"
1333             "loc_e02d0d7c:\n"
1334             "    b       loc_e02d0e46\n"
1335             "loc_e02d0d7e:\n"
1336             "    b       loc_e02d0f26\n"
1337             "loc_e02d0d80:\n"
1338             "    b       loc_e02d0f20\n"
1339             "loc_e02d0d82:\n"
1340             "    b       loc_e02d0f1a\n"
1341             "loc_e02d0d84:\n"
1342             "    b       loc_e02d0e52\n"
1343             "loc_e02d0d86:\n"
1344             "    b       loc_e02d0e40\n"
1345             "loc_e02d0d88:\n"
1346             "    b       loc_e02d0e3a\n"
1347             "loc_e02d0d8a:\n"
1348             "    b       loc_e02d0e34\n"
1349 
1350             //capdis -f=chdk -s=0xe02d0dc1 -c=226 -stubs PRIMARY.BIN 0xe0000000
1351             "loc_e02d0dc0:\n"
1352             "    ldr.w   r1, [r0, #0x94]\n"
1353             "    add.w   ip, sp, #8\n"
1354             "    add.w   r1, r1, r1, lsl #1\n"
1355             "    add.w   r1, r0, r1, lsl #2\n"
1356             "    subs    r1, #8\n"
1357             "    ldm     r1, {r1, r2, r3}\n"
1358             "    stm.w   ip, {r1, r2, r3}\n"
1359             "    bl      sub_e02ce3b0\n"
1360             "    ldr     r0, [sp, #0x14]\n"
1361             "    ldrd    r3, r2, [r0, #0xac]\n"
1362             "    ldr.w   r1, [r0, #0x94]\n"
1363             "    adds    r0, r0, #4\n"
1364             "    blx     r3\n"
1365             "    bl      sub_e00724de\n"
1366             "    bl      sub_e047005c\n"
1367             "    bl      sub_e043aff4\n"
1368             "    ldr     r0, [r4, #0x1c]\n"
1369             "    movs    r1, #2\n"
1370             "    movw    r2, #0xbb8\n"
1371             "    bl      sub_dffc98b6\n"
1372             "    lsls    r0, r0, #0x1f\n"
1373             "    beq     loc_e02d0e14\n"
1374             "    movw    r2, #0xe6d\n"
1375             "    ldr     r1, =0xe02d0db0\n" //  *"ExpDrv.c"
1376             "    movs    r0, #0\n"
1377             "    bl      sub_dffc96f4\n"
1378             "loc_e02d0e14:\n"
1379             "    ldr     r0, [r4, #0x1c]\n"
1380             "    movs    r1, #0x20\n"
1381             "    movw    r2, #0xbb8\n"
1382             "    bl      sub_dffc98b6\n"
1383             "    lsls    r0, r0, #0x1f\n"
1384             "    beq     loc_e02d0e32\n"
1385             "    movw    r2, #0xe71\n"
1386             "    ldr     r1, =0xe02d0db0\n" //  *"ExpDrv.c"
1387             "    movs    r0, #0\n"
1388             "    bl      sub_dffc96f4\n"
1389             "loc_e02d0e32:\n"
1390             "    b       loc_e02d0f38\n"
1391             "loc_e02d0e34:\n"
1392             "    bl      sub_e02ccc2e\n"
1393             "    b       loc_e02d0f2a\n"
1394             "loc_e02d0e3a:\n"
1395             "    bl      sub_e02ccecc\n"
1396             "    b       loc_e02d0f2a\n"
1397             "loc_e02d0e40:\n"
1398             "    bl      sub_e02cd0e4\n"
1399             "    b       loc_e02d0f2a\n"
1400             "loc_e02d0e46:\n"
1401             "    bl      sub_e02cd3a0\n"
1402             "    b       loc_e02d0f2a\n"
1403             "loc_e02d0e4c:\n"
1404             "    bl      sub_e02cd566\n"
1405             "    b       loc_e02d0f2a\n"
1406             "loc_e02d0e52:\n"
1407             "    bl      sub_e02cd9ee_my\n" // Patched
1408             "    movs    r6, #0\n"
1409             "    b       loc_e02d0f2a\n"
1410             "loc_e02d0e5a:\n"
1411             "    bl      sub_e02cdb0c\n"
1412             "    b       loc_e02d0f2a\n"
1413             "loc_e02d0e60:\n"
1414             "    ldrh    r1, [r0, #4]\n"
1415             "    strh.w  r1, [sp, #8]\n"
1416             "    ldrh    r1, [r5, #2]\n"
1417             "    strh.w  r1, [sp, #0xa]\n"
1418             "    ldrh    r1, [r5, #4]\n"
1419             "    strh.w  r1, [sp, #0xc]\n"
1420             "    ldrh    r1, [r5, #6]\n"
1421             "    strh.w  r1, [sp, #0xe]\n"
1422             "    ldrh    r1, [r0, #0xc]\n"
1423             "    strh.w  r1, [sp, #0x10]\n"
1424             "    ldrh    r1, [r5, #0xa]\n"
1425             "    strh.w  r1, [sp, #0x12]\n"
1426             "    bl      sub_e02ce0da\n"
1427             "    b       loc_e02d0f2a\n"
1428             "loc_e02d0e8a:\n"
1429             "    ldrh    r1, [r0, #4]\n"
1430             "    strh.w  r1, [sp, #8]\n"
1431             "    ldrh    r1, [r5, #2]\n"
1432             "    strh.w  r1, [sp, #0xa]\n"
1433             "    ldrh    r1, [r5, #4]\n"
1434             "    strh.w  r1, [sp, #0xc]\n"
1435             "    ldrh    r1, [r5, #6]\n"
1436             "    strh.w  r1, [sp, #0xe]\n"
1437             "    ldrh    r1, [r5, #8]\n"
1438             "    strh.w  r1, [sp, #0x10]\n"
1439             "    ldrh    r1, [r5, #0xa]\n"
1440             "    strh.w  r1, [sp, #0x12]\n"
1441             "    bl      sub_e02d1c78\n"
1442             "    b       loc_e02d0f2a\n"
1443             "loc_e02d0eb4:\n"
1444             "    ldrh    r1, [r5]\n"
1445             "    strh.w  r1, [sp, #8]\n"
1446             "    ldrh    r1, [r0, #6]\n"
1447             "    strh.w  r1, [sp, #0xa]\n"
1448             "    ldrh    r1, [r5, #4]\n"
1449             "    strh.w  r1, [sp, #0xc]\n"
1450             "    ldrh    r1, [r5, #6]\n"
1451             "    strh.w  r1, [sp, #0xe]\n"
1452             "    ldrh    r1, [r5, #8]\n"
1453             "    strh.w  r1, [sp, #0x10]\n"
1454             "    ldrh    r1, [r5, #0xa]\n"
1455             "    strh.w  r1, [sp, #0x12]\n"
1456             "    bl      sub_e02d1d00\n"
1457             "    b       loc_e02d0f2a\n"
1458             "loc_e02d0ede:\n"
1459             "    ldrh    r1, [r5]\n"
1460             "    strh.w  r1, [sp, #8]\n"
1461             "    ldrh    r1, [r5, #2]\n"
1462             "    strh.w  r1, [sp, #0xa]\n"
1463             "    ldrh    r1, [r5, #4]\n"
1464             "    strh.w  r1, [sp, #0xc]\n"
1465             "    ldrh    r1, [r5, #6]\n"
1466             "    strh.w  r1, [sp, #0xe]\n"
1467             "    ldrh    r1, [r0, #0xc]\n"
1468             "    strh.w  r1, [sp, #0x10]\n"
1469             "    ldrh    r1, [r5, #0xa]\n"
1470             "    strh.w  r1, [sp, #0x12]\n"
1471             "    bl      sub_e02d1d80\n"
1472             "    b       loc_e02d0f2a\n"
1473             "loc_e02d0f08:\n"
1474             "    bl      sub_e02ce196\n"
1475             "    b       loc_e02d0f2a\n"
1476             "loc_e02d0f0e:\n"
1477             "    bl      sub_e02ce7bc\n"
1478             "    b       loc_e02d0f2a\n"
1479             "loc_e02d0f14:\n"
1480             "    bl      sub_e02cebda\n"
1481             "    b       loc_e02d0f2a\n"
1482             "loc_e02d0f1a:\n"
1483             "    bl      sub_e02cedfc\n"
1484             "    b       loc_e02d0f2a\n"
1485             "loc_e02d0f20:\n"
1486             "    bl      sub_e02cef88\n"
1487             "    b       loc_e02d0f2a\n"
1488             "loc_e02d0f26:\n"
1489             "    bl      sub_e02cf092\n"
1490             "loc_e02d0f2a:\n"
1491             "    ldr     r0, [sp, #0x14]\n"
1492             "    ldrd    r3, r2, [r0, #0xac]\n"
1493             "    ldr.w   r1, [r0, #0x94]\n"
1494             "loc_e02d0f34:\n"
1495             "    adds    r0, r0, #4\n"
1496             "    blx     r3\n"
1497             "loc_e02d0f38:\n"
1498             "    ldr     r0, [sp, #0x14]\n"
1499             "    ldr     r0, [r0]\n"
1500             "    cmp     r0, #0x10\n"
1501             "    beq     loc_e02d0f8e\n"
1502             "    bgt     loc_e02d0f54\n"
1503             "    cmp     r0, #1\n"
1504             "    beq     loc_e02d0f64\n"
1505             "    cmp     r0, #4\n"
1506             "    beq     loc_e02d0f64\n"
1507             "    cmp     r0, #0xe\n"
1508             "    beq     loc_e02d0f8e\n"
1509             "    cmp     r0, #0xf\n"
1510             "    bne     loc_e02d0fa4\n"
1511             "    b       loc_e02d0f64\n"
1512             "loc_e02d0f54:\n"
1513             "    cmp     r0, #0x11\n"
1514             "    beq     loc_e02d0f64\n"
1515             "    cmp     r0, #0x14\n"
1516             "    beq     loc_e02d0f64\n"
1517             "    cmp     r0, #0x1a\n"
1518             "    beq     loc_e02d0f64\n"
1519             "    cmp     r0, #0x1d\n"
1520             "    bne     loc_e02d0fa4\n"
1521             "loc_e02d0f64:\n"
1522             "    ldrsh.w r0, [r5]\n"
1523             "    cmp     r0, sb\n"
1524             "    beq     loc_e02d0f74\n"
1525             "    ldrsh.w r1, [r5, #8]\n"
1526             "    cmp     r1, sb\n"
1527             "    bne     loc_e02d0f84\n"
1528             "loc_e02d0f74:\n"
1529             "    add     r0, sp, #0x18\n"
1530             "    bl      sub_e0368074\n"
1531             "    ldrh.w  r0, [sp, #0x18]\n"
1532             "    strh.w  r0, [sp, #8]\n"
1533             "    b       loc_e02d0f9c\n"
1534             "loc_e02d0f84:\n"
1535             "    strh.w  r0, [sp, #8]\n"
1536             "    strh.w  r1, [sp, #0x10]\n"
1537             "    b       loc_e02d0fa4\n"
1538             "loc_e02d0f8e:\n"
1539             "    ldrsh.w r0, [r5, #8]\n"
1540             "    cmp     r0, sb\n"
1541             "    bne     loc_e02d0fa0\n"
1542             "    add     r0, sp, #0x18\n"
1543             "    bl      sub_e0368074\n"
1544             "loc_e02d0f9c:\n"
1545             "    ldrh.w  r0, [sp, #0x20]\n"
1546             "loc_e02d0fa0:\n"
1547             "    strh.w  r0, [sp, #0x10]\n"
1548             "loc_e02d0fa4:\n"
1549             "    ldr     r0, [sp, #0x14]\n"
1550             "    cbz     r6, loc_e02d0fe0\n"
1551             "    ldr.w   r1, [r0, #0x94]\n"
1552             "    ldr     r2, [sp, #8]\n"
1553             "    add.w   r1, r1, r1, lsl #1\n"
1554             "    add.w   r0, r0, r1, lsl #2\n"
1555             "    ldr     r1, =0x0006475c\n"
1556             "    str     r2, [r1, #0x2c]\n"
1557             "    ldr     r2, [sp, #0xc]\n"
1558             "    str     r2, [r1, #0x30]\n"
1559             "    ldr     r2, [sp, #0x10]\n"
1560             "    str     r2, [r1, #0x34]\n"
1561             "    ldr     r2, [sp, #8]\n"
1562             "    str     r2, [r1, #0x38]\n"
1563             "    ldr     r2, [sp, #0xc]\n"
1564             "    str     r2, [r1, #0x3c]\n"
1565             "    ldr     r2, [sp, #0x10]\n"
1566             "    str     r2, [r1, #0x40]\n"
1567             "    ldr     r2, [r0, #-0x8]\n"
1568             "    str     r2, [r1, #0x44]\n"
1569             "    ldr     r2, [r0, #-0x4]\n"
1570             "    str     r2, [r1, #0x48]\n"
1571             "    ldr     r0, [r0]\n"
1572             "    str     r0, [r1, #0x4c]\n"
1573             "    b       loc_e02d1008\n"
1574             "loc_e02d0fe0:\n"
1575             "    ldr     r0, [r0]\n"
1576             "    mov     r4, r8\n"
1577             "    cmp     r0, #0xc\n"
1578             "    beq     loc_e02d1010\n"
1579             "    movs    r3, #1\n"
1580             "    mov     r2, r3\n"
1581             "    mov     r1, r3\n"
1582             "    mov     r0, r3\n"
1583             "    str     r4, [sp]\n"
1584             "    str     r4, [sp, #4]\n"
1585             "    bl      sub_e02cca7a\n"
1586             "    movs    r3, #1\n"
1587             "    str     r4, [sp]\n"
1588             "    mov     r2, r3\n"
1589             "    mov     r1, r3\n"
1590             "    mov     r0, r3\n"
1591             "    str     r4, [sp, #4]\n"
1592             "loc_e02d1004:\n"
1593             "    bl      sub_e02ccbac\n"
1594             "loc_e02d1008:\n"
1595             "    ldr     r0, [sp, #0x14]\n"
1596             "    bl      sub_e02d1bdc\n"
1597             "    b       loc_e02d0af6\n"
1598             "loc_e02d1010:\n"
1599             "    movs    r3, #1\n"
1600             "    movs    r0, #0\n"
1601             "    strd    fp, r4, [sp]\n"
1602             "    mov     r6, fp\n"
1603             "    mov     r2, r3\n"
1604             "    mov     r1, r3\n"
1605             "    bl      sub_e02cca7a\n"
1606             "    movs    r3, #1\n"
1607             "    movs    r0, #0\n"
1608             "    strd    r6, r4, [sp]\n"
1609             "    mov     r2, r3\n"
1610             "    mov     r1, r3\n"
1611             "    b       loc_e02d1004\n"
1612     );
1613 }
1614 
1615 //e02cd9ee
1616 void __attribute__((naked,noinline)) sub_e02cd9ee_my() {
1617     asm volatile (
1618             //capdis -f=chdk -s=0xe02cd9ef -c=45 -stubs PRIMARY.BIN 0xe0000000
1619             "    push.w  {r4, r5, r6, r7, r8, lr}\n"
1620             "    mov     r4, r0\n"
1621             "    ldr     r7, =0x0000e1a8\n"
1622             "    movs    r1, #0x3e\n"
1623             "    ldr     r0, [r7, #0x1c]\n"
1624             "    bl      sub_dffc9966\n"
1625             "    ldrsh.w r0, [r4, #4]\n"
1626             "    movs    r2, #0\n"
1627             "    movs    r3, #1\n"
1628             "    mov     r1, r2\n"
1629             "    bl      sub_e02cc518\n"
1630             "    mov     r6, r0\n"
1631             "    ldrsh.w r0, [r4, #6]\n"
1632             "    bl      sub_e02cc6b0\n"
1633             "    ldrsh.w r0, [r4, #8]\n"
1634             "    bl      sub_e02cc6f6\n"
1635             "    ldrsh.w r0, [r4, #0xa]\n"
1636             "    bl      sub_e02cc73c\n"
1637             "    ldrsh.w r0, [r4, #0xc]\n"
1638             "    movs    r1, #0\n"
1639             "    bl      sub_e02cc782\n"
1640             "    mov     r5, r0\n"
1641             "    ldr     r0, [r4]\n"
1642             "    ldr.w   r8, =0x000647a0\n"
1643             "    cmp     r0, #0xc\n"
1644             "    beq     loc_e02cda42\n"
1645             "    cmp     r6, #1\n"
1646             "    beq     loc_e02cdaa6\n"
1647             "    b       loc_e02cda46\n"
1648             "loc_e02cda42:\n"
1649             "    movs    r6, #0\n"
1650             "    mov     r5, r6\n"
1651             "loc_e02cda46:\n"
1652             "    ldrh.w  r0, [r8]\n"
1653             "    strh    r0, [r4, #4]\n"
1654             "loc_e02cda4c:\n"
1655             "    cmp     r5, #1\n"
1656             "    beq     loc_e02cdaba\n"
1657             "    ldrh.w  r0, [r8, #8]\n"
1658             "loc_e02cda54:\n"
1659             "    strh    r0, [r4, #0xc]\n"
1660             "    ldrsh.w r0, [r4, #6]\n"
1661             "    bl      sub_e0072240_my\n" // Patched
1662             "    ldrsh.w r0, [r4, #8]\n"
1663             "    movs    r1, #1\n"
1664             "    bl      sub_e043ad64\n"
1665             "    movs    r1, #0\n"
1666             "    add.w   r0, r4, #8\n"
1667 //             "    b       loc_e02cda90\n" // -
1668 
1669             //capdis -f=chdk -s=0xe02cda91 -c=44 -stubs PRIMARY.BIN 0xe0000000
1670             "loc_e02cda90:\n"
1671             "    bl      sub_e043add0\n"
1672             "    ldrsh.w r0, [r4, #0xe]\n"
1673             "    bl      sub_e007e50e\n"
1674             "    cmp     r6, #1\n"
1675             "    movw    r4, #0xbb8\n"
1676             "    beq     loc_e02cdac8\n"
1677             "    b       loc_e02cdae4\n"
1678             "loc_e02cdaa6:\n"
1679             "    ldrsh.w r0, [r4, #4]\n"
1680             "    movs    r2, #2\n"
1681             "    ldr     r1, =0xe02cc4af\n"
1682             "    bl      sub_e0061fe6\n"
1683             "    strh    r0, [r4, #4]\n"
1684             "    movs    r0, #0\n"
1685             "    str     r0, [r7, #0x28]\n"
1686             "    b       loc_e02cda4c\n"
1687             "loc_e02cdaba:\n"
1688             "    ldrsh.w r0, [r4, #0xc]\n"
1689             "    movs    r2, #0x20\n"
1690             "    ldr     r1, =0xe02cc503\n"
1691             "    bl      sub_e02d1c4e\n"
1692             "    b       loc_e02cda54\n"
1693             "loc_e02cdac8:\n"
1694             "    ldr     r0, [r7, #0x1c]\n"
1695             "    movs    r1, #2\n"
1696             "    mov     r2, r4\n"
1697             "    bl      sub_dffc98b6\n"
1698             "    lsls    r0, r0, #0x1f\n"
1699             "    beq     loc_e02cdae4\n"
1700             "    movw    r2, #0x99e\n"
1701             "    ldr     r1, =0xe02ccd3c\n" //  *"ExpDrv.c"
1702             "    movs    r0, #0\n"
1703             "    bl      sub_dffc96f4\n"
1704             "loc_e02cdae4:\n"
1705             "    cmp     r5, #1\n"
1706             "    bne     loc_e02cdb08\n" //  return
1707             "    ldr     r0, [r7, #0x1c]\n"
1708             "    movs    r1, #0x20\n"
1709             "    mov     r2, r4\n"
1710             "    bl      sub_dffc98b6\n"
1711             "    lsls    r0, r0, #0x1f\n"
1712             "    beq     loc_e02cdb08\n" //  return
1713             "    movw    r2, #0x9a4\n"
1714             "    ldr     r1, =0xe02ccd3c\n" //  *"ExpDrv.c"
1715             "    pop.w   {r4, r5, r6, r7, r8, lr}\n"
1716             "    movs    r0, #0\n"
1717             "    b.w     sub_dffc96f4\n"    // jump to FW
1718             "loc_e02cdb08:\n"
1719             "    pop.w   {r4, r5, r6, r7, r8, pc}\n"
1720     );
1721 }
1722 
1723 //e0072240
1724 void __attribute__((naked,noinline)) sub_e0072240_my() {
1725     asm volatile (
1726             //capdis -f=chdk -s=0xe0072241 -c=23 -jfw -stubs PRIMARY.BIN 0xe0000000
1727             "    push    {r4, r5, r6, lr}\n"
1728             "    mov     r4, r0\n"
1729             "    ldr     r5, =0x0000f728\n"
1730             "    ldr     r0, [r5, #4]\n"
1731             "    cmp     r0, #1\n"
1732             "    beq     loc_e0072258\n"
1733             "    movs    r0, #0\n"
1734             "    mov.w   r2, #0x172\n"
1735             "    ldr     r1, =0xe007228c\n" //  *"Shutter.c"
1736             "    bl      sub_dffc96f4\n"
1737             "loc_e0072258:\n"
1738             "    ldr     r0, =0xfffff400\n"
1739             "    cmp     r4, r0\n"
1740             "    bne     loc_e0072262\n"
1741             "    ldrsh.w r4, [r5, #2]\n"
1742             "loc_e0072262:\n"
1743             "    cmp     r4, r0\n"
1744             "    strh    r4, [r5, #2]\n"
1745             "    bne     loc_e0072274\n"
1746             "    movs    r0, #0\n"
1747             "    mov.w   r2, #0x178\n"
1748             "    ldr     r1, =0xe007228c\n" //  *"Shutter.c"
1749             "    bl      sub_dffc96f4\n"
1750             "loc_e0072274:\n"
1751             "    mov     r0, r4\n"
1752 //             "    bl      sub_e0067ab2\n"
1753             "    bl      apex2us\n" // Patched (replace above call)
1754             "    ldr     pc, =0xe007227b\n" // Continue in firmware
1755     );
1756 }

/* [<][>][^][v][top][bottom][index][help] */