root/platform/g5x/sub/101b/capt_seq.c

/* [<][>][^][v][top][bottom][index][help] */

DEFINITIONS

This source file includes following definitions.
  1. captseq_raw_addr_init_my
  2. clear_current_raw_addr
  3. capt_seq_task
  4. sub_fc08ec20_my
  5. sub_fc08ebd4_my
  6. sub_fc08e9e6_my
  7. sub_fc0a009e_my
  8. developseq_task
  9. exp_drv_task
  10. sub_fc2f32fa_my
  11. sub_fc470d42_my

   1 #include "lolevel.h"
   2 #include "platform.h"
   3 #include "core.h"
   4 
   5 #define USE_STUBS_NRFLAG 1
   6 #define NR_AUTO (-1) // default value if NRTBL.SetDarkSubType not used is -1 (0 probalby works the same), set to enable auto
   7 
   8 #include "../../../generic/capt_seq.c"
   9 
  10 // first parameter matches active_raw_buffer
  11 // second is pointer to structure
  12 extern int _captseq_raw_addr_init (int raw_index, char **ptr);
  13 char *current_raw_addr;
  14 
  15 void
  16 captseq_raw_addr_init_my (int raw_index, char **ptr)
  17 {
  18     _captseq_raw_addr_init (raw_index, ptr);
  19     current_raw_addr = *(ptr + 0x5c / 4); // @0xfc09bf88, ptr+0x5c
  20 }
  21 
  22 void
  23 clear_current_raw_addr (void)
  24 {
  25     current_raw_addr = NULL;
  26 }
  27 
  28 // capt_seq_task 0xfc07498c
  29 
  30 void __attribute__((naked,noinline))
  31 capt_seq_task ()
  32 {
  33     asm volatile (
  34             //capdis -f=chdk -s=0xfc07498d -c=31 -stubs PRIMARY.BIN 0xfc000000
  35             "    push    {r3, r4, r5, r6, r7, lr}\n"
  36             "    ldr     r4, =0x00046ee4\n"
  37             "    movs    r6, #0\n"
  38             "    ldr     r5, =0x0000c368\n"
  39             "loc_fc074994:\n"
  40             "    movs    r2, #0\n"
  41             "    mov     r1, sp\n"
  42             "    ldr     r0, [r5, #8]\n"
  43             "    blx     sub_fc34d054\n"
  44             "    lsls    r0, r0, #0x1f\n"
  45             "    beq     loc_fc0749b6\n"
  46             "    movw    r2, #0x428\n"
  47             "    ldr     r1, =0xfc07459c\n" //  *"SsShootTask.c"
  48             "    movs    r0, #0\n"
  49             "    blx     sub_fc34d264\n"
  50             "    blx     sub_fc34d0f4\n"
  51             "    pop     {r3, r4, r5, r6, r7, pc}\n"
  52             "loc_fc0749b6:\n"
  53             "    ldr     r0, [sp]\n"
  54             "    ldr     r0, [r0]\n"
  55             "    cmp     r0, #1\n"
  56             "    beq     loc_fc0749ce\n"
  57             "    cmp     r0, #0x2b\n"
  58             "    beq     loc_fc0749ce\n"
  59             "    cmp     r0, #0x1f\n"
  60             "    beq     loc_fc0749ce\n"
  61             "    cmp     r0, #0x23\n"
  62             "    beq     loc_fc0749ce\n"
  63             "    bl      sub_fc09df5c\n"
  64             "loc_fc0749ce:\n"
  65             "    ldr     r0, [sp]\n"
  66             "    ldr     r1, [r0]\n"
  67             "    cmp     r1, #0x34\n"
  68             "    bhs     loc_fc074ab8\n"
  69 
  70             //capdis -f=chdk -s=0xfc0749e9 -c=157 -stubs PRIMARY.BIN 0xfc000000
  71             "    tbb     [pc, r1]\n" // (jumptable r1 52 elements)
  72             "branchtable_fc0749ec:\n"
  73             "    .byte((loc_fc074a20 - branchtable_fc0749ec) / 2)\n" // (case 0)
  74             "    .byte((loc_fc074a36 - branchtable_fc0749ec) / 2)\n" // (case 1)
  75             "    .byte((loc_fc074a3e - branchtable_fc0749ec) / 2)\n" // (case 2)
  76             "    .byte((loc_fc074a4c - branchtable_fc0749ec) / 2)\n" // (case 3)
  77             "    .byte((loc_fc074a46 - branchtable_fc0749ec) / 2)\n" // (case 4)
  78             "    .byte((loc_fc074a56 - branchtable_fc0749ec) / 2)\n" // (case 5)
  79             "    .byte((loc_fc074a5c - branchtable_fc0749ec) / 2)\n" // (case 6)
  80             "    .byte((loc_fc074a66 - branchtable_fc0749ec) / 2)\n" // (case 7)
  81             "    .byte((loc_fc074a6e - branchtable_fc0749ec) / 2)\n" // (case 8)
  82             "    .byte((loc_fc074a7e - branchtable_fc0749ec) / 2)\n" // (case 9)
  83             "    .byte((loc_fc074a86 - branchtable_fc0749ec) / 2)\n" // (case 10)
  84             "    .byte((loc_fc074a8c - branchtable_fc0749ec) / 2)\n" // (case 11)
  85             "    .byte((loc_fc074ba8 - branchtable_fc0749ec) / 2)\n" // (case 12)
  86             "    .byte((loc_fc074a94 - branchtable_fc0749ec) / 2)\n" // (case 13)
  87             "    .byte((loc_fc074a9a - branchtable_fc0749ec) / 2)\n" // (case 14)
  88             "    .byte((loc_fc074aa0 - branchtable_fc0749ec) / 2)\n" // (case 15)
  89             "    .byte((loc_fc074aa6 - branchtable_fc0749ec) / 2)\n" // (case 16)
  90             "    .byte((loc_fc074aac - branchtable_fc0749ec) / 2)\n" // (case 17)
  91             "    .byte((loc_fc074ba8 - branchtable_fc0749ec) / 2)\n" // (case 18)
  92             "    .byte((loc_fc074ab2 - branchtable_fc0749ec) / 2)\n" // (case 19)
  93             "    .byte((loc_fc074aba - branchtable_fc0749ec) / 2)\n" // (case 20)
  94             "    .byte((loc_fc074ac0 - branchtable_fc0749ec) / 2)\n" // (case 21)
  95             "    .byte((loc_fc074ac4 - branchtable_fc0749ec) / 2)\n" // (case 22)
  96             "    .byte((loc_fc074aca - branchtable_fc0749ec) / 2)\n" // (case 23)
  97             "    .byte((loc_fc074ad0 - branchtable_fc0749ec) / 2)\n" // (case 24)
  98             "    .byte((loc_fc074ad6 - branchtable_fc0749ec) / 2)\n" // (case 25)
  99             "    .byte((loc_fc074adc - branchtable_fc0749ec) / 2)\n" // (case 26)
 100             "    .byte((loc_fc074ae2 - branchtable_fc0749ec) / 2)\n" // (case 27)
 101             "    .byte((loc_fc074aea - branchtable_fc0749ec) / 2)\n" // (case 28)
 102             "    .byte((loc_fc074af0 - branchtable_fc0749ec) / 2)\n" // (case 29)
 103             "    .byte((loc_fc074af6 - branchtable_fc0749ec) / 2)\n" // (case 30)
 104             "    .byte((loc_fc074afa - branchtable_fc0749ec) / 2)\n" // (case 31)
 105             "    .byte((loc_fc074b02 - branchtable_fc0749ec) / 2)\n" // (case 32)
 106             "    .byte((loc_fc074b08 - branchtable_fc0749ec) / 2)\n" // (case 33)
 107             "    .byte((loc_fc074b32 - branchtable_fc0749ec) / 2)\n" // (case 34)
 108             "    .byte((loc_fc074b38 - branchtable_fc0749ec) / 2)\n" // (case 35)
 109             "    .byte((loc_fc074b3e - branchtable_fc0749ec) / 2)\n" // (case 36)
 110             "    .byte((loc_fc074b44 - branchtable_fc0749ec) / 2)\n" // (case 37)
 111             "    .byte((loc_fc074b4a - branchtable_fc0749ec) / 2)\n" // (case 38)
 112             "    .byte((loc_fc074b52 - branchtable_fc0749ec) / 2)\n" // (case 39)
 113             "    .byte((loc_fc074b58 - branchtable_fc0749ec) / 2)\n" // (case 40)
 114             "    .byte((loc_fc074ba8 - branchtable_fc0749ec) / 2)\n" // (case 41)
 115             "    .byte((loc_fc074b84 - branchtable_fc0749ec) / 2)\n" // (case 42)
 116             "    .byte((loc_fc074b8a - branchtable_fc0749ec) / 2)\n" // (case 43)
 117             "    .byte((loc_fc074b78 - branchtable_fc0749ec) / 2)\n" // (case 44)
 118             "    .byte((loc_fc074bb6 - branchtable_fc0749ec) / 2)\n" // (case 45)
 119             "    .byte((loc_fc074ba8 - branchtable_fc0749ec) / 2)\n" // (case 46)
 120             "    .byte((loc_fc074ba8 - branchtable_fc0749ec) / 2)\n" // (case 47)
 121             "    .byte((loc_fc074ba8 - branchtable_fc0749ec) / 2)\n" // (case 48)
 122             "    .byte((loc_fc074b9c - branchtable_fc0749ec) / 2)\n" // (case 49)
 123             "    .byte((loc_fc074ba2 - branchtable_fc0749ec) / 2)\n" // (case 50)
 124             "    .byte((loc_fc074b96 - branchtable_fc0749ec) / 2)\n" // (case 51)
 125             ".align 1\n"
 126             "loc_fc074a20:\n"
 127             "    ldr     r0, [r0, #0xc]\n"
 128             "    bl      sub_fc082d96\n"
 129             "    BL      clear_current_raw_addr\n" // +
 130             "    BL      shooting_expo_param_override\n" // +
 131             "    bl      sub_fc08fbe8\n"
 132             "    ldr     r0, [r4, #0x28]\n"
 133             "    cmp     r0, #0\n"
 134             "    beq     loc_fc074a34\n"
 135             "    bl      sub_fc08ec20_my\n" // -> nr?, remote hook, raw hook (quick, no half press)
 136             "loc_fc074a34:\n"
 137             "    b       loc_fc074bb6\n"
 138             "loc_fc074a36:\n"
 139             "    ldr     r0, [r0, #0x10]\n"
 140             "    bl      sub_fc08ebd4_my\n" // -> nr?, remote hook, raw hook
 141             "    b       loc_fc074bb6\n"
 142             "loc_fc074a3e:\n"
 143             "    movs    r0, #1\n"
 144             "    bl      sub_fc0830ca\n"
 145             "    b       loc_fc074bb6\n"
 146             "loc_fc074a46:\n"
 147             "    bl      sub_fc082aec\n"
 148             "    b       loc_fc074a52\n"
 149             "loc_fc074a4c:\n"
 150             "    ldr     r0, [r0, #0xc]\n"
 151             "    bl      sub_fc082d7e\n"
 152             "loc_fc074a52:\n"
 153             "    str     r6, [r4, #0x28]\n"
 154             "    b       loc_fc074bb6\n"
 155             "loc_fc074a56:\n"
 156             "    bl      sub_fc082d84\n"
 157             "    b       loc_fc074bb6\n"
 158             "loc_fc074a5c:\n"
 159             "    bl      sub_fc082fec\n"
 160             "    bl      sub_fc08fbe8\n"
 161             "    b       loc_fc074bb6\n"
 162             "loc_fc074a66:\n"
 163             "    ldr     r0, [r0, #0x10]\n"
 164             "    bl      sub_fc08ecce\n"
 165             "    b       loc_fc074bb6\n"
 166             "loc_fc074a6e:\n"
 167             "    bl      sub_fc08306a\n"
 168             "    bl      sub_fc08fbe8\n"
 169             "    movs    r0, #0\n"
 170             "    bl      sub_fc2d27d8\n"
 171             "    b       loc_fc074bb6\n"
 172             "loc_fc074a7e:\n"
 173             "    ldr     r0, [r4, #0x54]\n"
 174             "    bl      sub_fc083732\n"
 175             "    b       loc_fc074bb6\n"
 176             "loc_fc074a86:\n"
 177             "    bl      sub_fc0839ce\n"
 178             "    b       loc_fc074bb6\n"
 179             "loc_fc074a8c:\n"
 180             "    ldr     r0, [r0, #0xc]\n"
 181             "    bl      sub_fc083a1a\n"
 182             "    b       loc_fc074bb6\n"
 183             "loc_fc074a94:\n"
 184             "    bl      sub_fc083bfc\n"
 185             "    b       loc_fc074bb6\n"
 186             "loc_fc074a9a:\n"
 187             "    bl      sub_fc083fe4\n"
 188             "    b       loc_fc074bb6\n"
 189             "loc_fc074aa0:\n"
 190             "    bl      sub_fc08407a\n"
 191             "    b       loc_fc074bb6\n"
 192             "loc_fc074aa6:\n"
 193             "    bl      sub_fc086d00\n"
 194             "    b       loc_fc074bb6\n"
 195             "loc_fc074aac:\n"
 196             "    bl      sub_fc086ede\n"
 197             "    b       loc_fc074bb6\n"
 198             "loc_fc074ab2:\n"
 199             "    bl      sub_fc086f7c\n"
 200             "    b       loc_fc074bb6\n"
 201             "loc_fc074ab8:\n"
 202             "    b       loc_fc074ba8\n"
 203             "loc_fc074aba:\n"
 204             "    bl      sub_fc086ff8\n"
 205             "    b       loc_fc074bb6\n"
 206             "loc_fc074ac0:\n"
 207             "    movs    r0, #0\n"
 208             "    b       loc_fc074ae4\n"
 209             "loc_fc074ac4:\n"
 210             "    bl      sub_fc08719c\n"
 211             "    b       loc_fc074bb6\n"
 212             "loc_fc074aca:\n"
 213             "    bl      sub_fc0871fc\n"
 214             "    b       loc_fc074bb6\n"
 215             "loc_fc074ad0:\n"
 216             "    bl      sub_fc087200\n"
 217             "    b       loc_fc074bb6\n"
 218             "loc_fc074ad6:\n"
 219             "    bl      sub_fc087210\n"
 220             "    b       loc_fc074bb6\n"
 221             "loc_fc074adc:\n"
 222             "    bl      sub_fc08729a\n"
 223             "    b       loc_fc074bb6\n"
 224             "loc_fc074ae2:\n"
 225             "    movs    r0, #1\n"
 226             "loc_fc074ae4:\n"
 227             "    bl      sub_fc08707c\n"
 228             "    b       loc_fc074bb6\n"
 229             "loc_fc074aea:\n"
 230             "    bl      sub_fc087344\n"
 231             "    b       loc_fc074bb6\n"
 232             "loc_fc074af0:\n"
 233             "    bl      sub_fc0831ba\n"
 234             "    b       loc_fc074bb6\n"
 235             "loc_fc074af6:\n"
 236             "    movs    r0, #0\n"
 237             "    b       loc_fc074afc\n"
 238             "loc_fc074afa:\n"
 239             "    ldr     r0, [r0, #0xc]\n"
 240             "loc_fc074afc:\n"
 241             "    bl      sub_fc0831ee\n"
 242             "    b       loc_fc074bb6\n"
 243             "loc_fc074b02:\n"
 244             "    bl      sub_fc08b514\n"
 245             "    b       loc_fc074bb6\n"
 246             "loc_fc074b08:\n"
 247             "    ldr     r1, =0x00046f46\n"
 248             "    movs    r2, #2\n"
 249             "    movs    r0, #0x77\n"
 250             "    bl      sub_fc3b835e\n"
 251             "    lsls    r0, r0, #0x1f\n"
 252             "    beq     loc_fc074b24\n"
 253             "    movw    r2, #0x4ee\n"
 254             "    ldr     r1, =0xfc07459c\n" //  *"SsShootTask.c"
 255             "    movs    r0, #0\n"
 256             "    blx     sub_fc34d264\n"
 257             "loc_fc074b24:\n"
 258             "    ldrh.w  r0, [r4, #0x62]\n"
 259             "    cmp     r0, #1\n"
 260             "    bne     loc_fc074bb6\n"
 261             "    bl      sub_fc08b50e\n"
 262             "    b       loc_fc074bb6\n"
 263             "loc_fc074b32:\n"
 264             "    bl      sub_fc08b598\n"
 265             "    b       loc_fc074bb6\n"
 266             "loc_fc074b38:\n"
 267             "    bl      sub_fc091c38\n"
 268             "    b       loc_fc074bb6\n"
 269             "loc_fc074b3e:\n"
 270             "    bl      sub_fc084504\n"
 271             "    b       loc_fc074bb6\n"
 272             "loc_fc074b44:\n"
 273             "    bl      sub_fc0845be\n"
 274             "    b       loc_fc074bb6\n"
 275             "loc_fc074b4a:\n"
 276             "    ldr     r0, [r0, #0xc]\n"
 277             "    bl      sub_fc0873f8\n"
 278             "    b       loc_fc074bb6\n"
 279             "loc_fc074b52:\n"
 280             "    bl      sub_fc08744a\n"
 281             "    b       loc_fc074bb6\n"
 282             "loc_fc074b58:\n"
 283             "    bl      sub_fc07d1ea\n"
 284             "    ldrh.w  r0, [r4, #0x19c]\n"
 285             "    cmp     r0, #4\n"
 286             "    beq     loc_fc074b6e\n"
 287             "    ldrh    r0, [r4]\n"
 288             "    sub.w   r1, r0, #0x8200\n"
 289             "    subs    r1, #0x36\n"
 290             "    bne     loc_fc074bb6\n"
 291             "loc_fc074b6e:\n"
 292             "    bl      sub_fc0845be\n"
 293             "    bl      sub_fc084a2e\n"
 294             "    b       loc_fc074bb6\n"
 295             "loc_fc074b78:\n"
 296             "    bl      sub_fc08427e\n"
 297             "    movs    r0, #1\n"
 298             "    bl      sub_fc07ce46\n"
 299             "    b       loc_fc074bb6\n"
 300             "loc_fc074b84:\n"
 301             "    movs    r2, #0\n"
 302             "    movs    r1, #0x11\n"
 303             "    b       loc_fc074b8e\n"
 304             "loc_fc074b8a:\n"
 305             "    movs    r2, #0\n"
 306             "    movs    r1, #0x10\n"
 307             "loc_fc074b8e:\n"
 308             "    movs    r0, #0\n"
 309             "    bl      sub_fc090918\n"
 310             "    b       loc_fc074bb6\n"
 311             "loc_fc074b96:\n"
 312             "    bl      sub_fc08367e\n"
 313             "    b       loc_fc074bb6\n"
 314             "loc_fc074b9c:\n"
 315             "    bl      sub_fc087cf0\n"
 316             "    b       loc_fc074bb6\n"
 317             "loc_fc074ba2:\n"
 318             "    bl      sub_fc087cf2\n"
 319             "    b       loc_fc074bb6\n"
 320             "loc_fc074ba8:\n"
 321             "    movw    r2, #0x557\n"
 322             "    ldr     r1, =0xfc07459c\n" //  *"SsShootTask.c"
 323             "    movs    r0, #0\n"
 324             "    blx     sub_fc34d264\n"
 325             "loc_fc074bb6:\n"
 326             "    BL      capt_seq_hook_set_nr\n" //  dark frame control
 327             "    ldr     r0, [sp]\n"
 328             "    ldr     r1, [r0, #4]\n"
 329             "    ldr     r0, [r5, #4]\n"
 330             "    blx     sub_fc34d10c\n"
 331             "    ldr     r7, [sp]\n"
 332             "    ldr     r0, [r7, #8]\n"
 333             "    cbnz    r0, loc_fc074bd2\n"
 334             "    movs    r2, #0xff\n"
 335             "    ldr     r1, =0xfc07459c\n" //  *"SsShootTask.c"
 336             "    movs    r0, #0\n"
 337             "    blx     sub_fc34d264\n"
 338             "loc_fc074bd2:\n"
 339             "    str     r6, [r7, #8]\n"
 340             "    b       loc_fc074994\n"
 341     );
 342 }
 343 
 344 //fc08ec20
 345 void __attribute__((naked,noinline))
 346 sub_fc08ec20_my ()
 347 {
 348     asm volatile (
 349             //capdis -f=chdk -s=0xfc08ec21 -c=58 -stubs PRIMARY.BIN 0xfc000000
 350             "    push    {r3, r4, r5, r6, r7, lr}\n"
 351             "    bl      sub_fc0932c2\n"
 352             "    mov     r4, r0\n"
 353             "    movs    r0, #0xc\n"
 354             "    bl      sub_fc318e68\n"
 355             "    ldr     r6, =0x000156a4\n"
 356             "    lsls    r0, r0, #0x1f\n"
 357             "    mov.w   r5, #1\n"
 358             "    bne     loc_fc08ecbe\n"
 359             "    movs    r2, #2\n"
 360             "    mov     r1, sp\n"
 361             "    movw    r0, #0x112\n"
 362             "    bl      sub_fc3b835e\n"
 363             "    lsls    r0, r0, #0x1f\n"
 364             "    beq     loc_fc08ec54\n"
 365             "    movs    r0, #0\n"
 366             "    movw    r2, #0x189\n"
 367             "    ldr     r1, =0xfc08eda4\n" //  *"SsCaptureCtrl.c"
 368             "    blx     sub_fc34d264\n"
 369             "loc_fc08ec54:\n"
 370             "    ldrsh.w r0, [sp]\n"
 371             "    bl      sub_fc0c296a\n"
 372             "    bl      sub_fc0c2702\n"
 373             "    cmp     r0, #1\n"
 374             "    bls     loc_fc08ecc2\n"
 375             "    movs    r0, #0\n"
 376             "    bl      sub_fc0c283a\n"
 377             "    bl      sub_fc0b9ef8\n"
 378             "    bl      sub_fc082d8a\n"
 379             "    bl      sub_fc09bef4\n"
 380             "    mov     r1, r4\n"
 381             //"    bl      sub_fc09bf48\n" // -
 382             "    bl      captseq_raw_addr_init_my\n" // Replace above call
 383             "    movs    r2, #4\n"
 384             "    movw    r0, #0x118\n"
 385             "    add.w   r1, r4, #0x58\n"
 386             "    bl      sub_fc3b822a\n"
 387             "    movs    r2, #4\n"
 388             "    movs    r0, #0x32\n"
 389             "    add.w   r1, r4, #0x5c\n"
 390             "    bl      sub_fc3b822a\n"
 391             "    movs    r2, #4\n"
 392             "    movs    r0, #0x46\n"
 393             "    add.w   r1, r4, #8\n"
 394             "    bl      sub_fc3b822a\n"
 395             "    bl      sub_fc0991aa\n"
 396             "    mvn     r1, #0x1000\n"
 397             "    blx     sub_fc34d1e4\n"
 398             "    mov     r0, r4\n"
 399             "    bl      sub_fc091984\n"
 400             "    mov     r0, r4\n"
 401             "    bl      sub_fc0a009e_my\n" // -> remote hook, raw hook
 402             "    lsls    r0, r0, #0x1f\n"
 403             "    beq     loc_fc08ecc0\n"
 404             "loc_fc08ecbe:\n"
 405             "    str     r5, [r6]\n"
 406             "loc_fc08ecc0:\n"
 407             "    pop     {r3, r4, r5, r6, r7, pc}\n"
 408             "loc_fc08ecc2:\n"
 409             "    str     r5, [r6]\n"
 410             "    bl      sub_fc090634\n"
 411             "    bl      sub_fc318ea8\n"
 412             "    pop     {r3, r4, r5, r6, r7, pc}\n"
 413     );
 414 }
 415 
 416 //fc08ebd4
 417 void __attribute__((naked,noinline))
 418 sub_fc08ebd4_my ()
 419 {
 420     asm volatile (
 421             //capdis -f=chdk -s=0xfc08ebd5 -c=33 -stubs PRIMARY.BIN 0xfc000000
 422             "    push    {r4, r5, r6, lr}\n"
 423             "    ldr     r5, =0x00046ee4\n"
 424             "    mov     r6, r0\n"
 425             "    movs    r4, #0\n"
 426             "    ldr     r0, [r5, #0x28]\n"
 427             "    cbz     r0, loc_fc08ebfc\n"
 428             "    ldr     r0, =0x000156a4\n"
 429             "    ldr     r0, [r0]\n"
 430             "    cbz     r0, loc_fc08ebe8\n"
 431             "    movs    r4, #0x1d\n"
 432             "loc_fc08ebe8:\n"
 433             "    mov     r2, r6\n"
 434             "    movs    r1, #2\n"
 435             "    mov     r0, r4\n"
 436             "    bl      sub_fc090918\n"
 437             "    mov     r1, r4\n"
 438             "    mov     r0, r6\n"
 439             "    bl      sub_fc09ddb8\n"
 440             "    b       loc_fc08ec1a\n"
 441             "loc_fc08ebfc:\n"
 442             "    mov     r0, r6\n"
 443             "    bl      sub_fc08e9e6_my\n" // Patched
 444             "    mov     r4, r0\n"
 445             "    lsls    r0, r0, #0x1f\n"
 446             "    beq     loc_fc08ec1a\n"
 447             "    movs    r1, #2\n"
 448             "    mov     r2, r6\n"
 449             "    mov     r0, r4\n"
 450             "    bl      sub_fc090918\n"
 451             "    mov     r1, r4\n"
 452             "    mov     r0, r6\n"
 453             "    bl      sub_fc09deee\n"
 454             "loc_fc08ec1a:\n"
 455             "    movs    r0, #0\n"
 456             "    str     r0, [r5, #0x28]\n"
 457             "    pop     {r4, r5, r6, pc}\n"
 458     );
 459 }
 460 
 461 //fc08e9e6
 462 void __attribute__((naked,noinline))
 463 sub_fc08e9e6_my ()
 464 {
 465     asm volatile (
 466             //capdis -f=chdk -s=0xfc08e9e7 -c=180 -stubs PRIMARY.BIN 0xfc000000
 467             "    push.w  {r2, r3, r4, r5, r6, r7, r8, lr}\n"
 468             "    mov     r4, r0\n"
 469             "    bl      sub_fc09bef4\n"
 470             "    mov     r1, r4\n"
 471             //"    bl      sub_fc09bf48\n" // -
 472             "    bl      captseq_raw_addr_init_my\n" // Replace above call
 473             "    movs    r2, #4\n"
 474             "    movw    r0, #0x118\n"
 475             "    add.w   r1, r4, #0x58\n"
 476             "    bl      sub_fc3b822a\n"
 477             "    movs    r2, #4\n"
 478             "    movs    r0, #0x32\n"
 479             "    add.w   r1, r4, #0x5c\n"
 480             "    bl      sub_fc3b822a\n"
 481             "    ldr     r6, =0x00046ee4\n"
 482             "    ldr.w   r0, [r6, #0x104]\n"
 483             "    cbnz    r0, loc_fc08ea28\n"
 484             "    ldrh.w  r0, [r6, #0x19a]\n"
 485             "    cmp     r0, #3\n"
 486             "    beq     loc_fc08ea2e\n"
 487             "    ldr     r0, [r4, #8]\n"
 488             "    cmp     r0, #1\n"
 489             "    bhi     loc_fc08ea3e\n"
 490             "    b       loc_fc08ea2e\n"
 491             "loc_fc08ea28:\n"
 492             "    ldr     r0, [r4, #0xc]\n"
 493             "    cmp     r0, #1\n"
 494             "    bne     loc_fc08ea3e\n"
 495             "loc_fc08ea2e:\n"
 496             "    movs    r0, #0xc\n"
 497             "    bl      sub_fc318e68\n"
 498             "    lsls    r0, r0, #0x1f\n"
 499             "    beq     loc_fc08ea3e\n"
 500             "loc_fc08ea38:\n"
 501             "    bl      sub_fc090634\n"
 502             "    b       loc_fc08eb52\n"
 503             "loc_fc08ea3e:\n"
 504             "    ldr.w   r0, [r6, #0xe4]\n"
 505             "    cbz     r0, loc_fc08ea5e\n"
 506             "    ldrh.w  r0, [r6, #0x19a]\n"
 507             "    cmp     r0, #3\n"
 508             "    beq     loc_fc08ea52\n"
 509             "    ldr     r0, [r4, #8]\n"
 510             "    cmp     r0, #1\n"
 511             "    bhi     loc_fc08ea8e\n"
 512             "loc_fc08ea52:\n"
 513             "    ldr.w   r0, [r6, #0x104]\n"
 514             "    cbz     r0, loc_fc08ea5e\n"
 515             "    ldr     r0, [r4, #0xc]\n"
 516             "    cmp     r0, #1\n"
 517             "    bhi     loc_fc08ea8e\n"
 518             "loc_fc08ea5e:\n"
 519             "    movs    r2, #2\n"
 520             "    movw    r0, #0x112\n"
 521             "    add     r1, sp, #4\n"
 522             "    bl      sub_fc3b835e\n"
 523             "    lsls    r0, r0, #0x1f\n"
 524             "    beq     loc_fc08ea78\n"
 525             "    movs    r2, #0xc1\n"
 526             "    movs    r0, #0\n"
 527             "    ldr     r1, =0xfc08eda4\n" //  *"SsCaptureCtrl.c"
 528             "    blx     sub_fc34d264\n"
 529             "loc_fc08ea78:\n"
 530             "    ldrsh.w r0, [sp, #4]\n"
 531             "    bl      sub_fc0c296a\n"
 532             "    bl      sub_fc0c2702\n"
 533             "    cmp     r0, #1\n"
 534             "    bls     loc_fc08eb4a\n"
 535             "    movs    r0, #0\n"
 536             "    bl      sub_fc0c283a\n"
 537             "loc_fc08ea8e:\n"
 538             "    ldr.w   r0, [r6, #0x1c4]\n"
 539             "    cbz     r0, loc_fc08eaa4\n"
 540             "    ldr     r0, [r4, #8]\n"
 541             "    cmp     r0, #1\n"
 542             "    beq     loc_fc08eaa4\n"
 543             "    movs    r0, #1\n"
 544             "    bl      sub_fc07ce46\n"
 545             "    lsls    r0, r0, #0x1f\n"
 546             "    bne     loc_fc08ea38\n"
 547             "loc_fc08eaa4:\n"
 548             "    mov     r0, r4\n"
 549             "    bl      sub_fc091c78\n"
 550             "    lsls    r1, r0, #0x1f\n"
 551             "    bne     loc_fc08eb54\n"
 552             "    bl      sub_fc0991aa\n"
 553             "    mvn     r1, #0x1000\n"
 554             "    blx     sub_fc34d1e4\n"
 555             "    mov     r0, r4\n"
 556             "    bl      sub_fc08f226\n"
 557             "    mov     r5, r0\n"
 558             "    lsls    r0, r0, #0x1f\n"
 559             "    bne     loc_fc08ebac\n"
 560             "    bl      sub_fc0b9ef8\n"
 561             "    bl      sub_fc082d8a\n"
 562             "    mov     r0, r4\n"
 563             "    bl      sub_fc091984\n"
 564             "    ldr.w   r0, [r6, #0x128]\n"
 565             "    cbnz    r0, loc_fc08eae8\n"
 566             "    ldrh.w  r0, [r6, #0x19a]\n"
 567             "    cmp     r0, #3\n"
 568             "    beq     loc_fc08eae8\n"
 569             "    ldr     r0, [r4, #8]\n"
 570             "    cmp     r0, #1\n"
 571             "    bhi     loc_fc08eaee\n"
 572             "loc_fc08eae8:\n"
 573             "    movs    r0, #2\n"
 574             "    bl      sub_fc089502\n"
 575             "loc_fc08eaee:\n"
 576             "    ldr.w   r0, [r6, #0xa0]\n"
 577             "    cmp     r0, #0\n"
 578             "    beq     loc_fc08eb6e\n"
 579             "    ldrh.w  r0, [r6, #0x19a]\n"
 580             "    movw    r7, #0x1000\n"
 581             "    cmp     r0, #3\n"
 582             "    beq     loc_fc08eb1e\n"
 583             "    ldr     r0, [r4, #8]\n"
 584             "    cmp     r0, #1\n"
 585             "    bls     loc_fc08eb1e\n"
 586             "    bl      sub_fc0991aa\n"
 587             "    movw    r3, #0x111\n"
 588             "    movw    r2, #0x3a98\n"
 589             "    mov     r1, r7\n"
 590             "    str     r3, [sp]\n"
 591             "    ldr     r3, =0xfc08eda4\n" //  *"SsCaptureCtrl.c"
 592             "    bl      sub_fc319020\n"
 593             "loc_fc08eb1e:\n"
 594             "    movs    r2, #4\n"
 595             "    movw    r0, #0x18a\n"
 596             "    add     r1, sp, #4\n"
 597             "    bl      sub_fc3b835e\n"
 598             "    lsls    r0, r0, #0x1f\n"
 599             "    beq     loc_fc08eb3a\n"
 600             "    movs    r0, #0\n"
 601             "    movw    r2, #0x115\n"
 602             "    ldr     r1, =0xfc08eda4\n" //  *"SsCaptureCtrl.c"
 603             "    blx     sub_fc34d264\n"
 604             "loc_fc08eb3a:\n"
 605             "    ldr     r0, [sp, #4]\n"
 606             "    cbnz    r0, loc_fc08eb58\n"
 607             "    bl      sub_fc0991aa\n"
 608             "    mov     r1, r7\n"
 609             "    blx     sub_fc34d10c\n"
 610             "    b       loc_fc08eb6e\n"
 611             "loc_fc08eb4a:\n"
 612             "    bl      sub_fc090634\n"
 613             "    bl      sub_fc318ea8\n"
 614             "loc_fc08eb52:\n"
 615             "    movs    r0, #1\n"
 616             "loc_fc08eb54:\n"
 617             "    pop.w   {r2, r3, r4, r5, r6, r7, r8, pc}\n"
 618             "loc_fc08eb58:\n"
 619             "    bl      sub_fc0991aa\n"
 620             "    mov     r1, r7\n"
 621             "    blx     sub_fc34d1e4\n"
 622             "    ldr     r2, =0xfc08e9d5\n"
 623             "    mov     r3, r7\n"
 624             "    ldr     r0, [sp, #4]\n"
 625             "    mov     r1, r2\n"
 626             "    bl      sub_fc3ba99a\n"
 627             "loc_fc08eb6e:\n"
 628             "    ldr.w   r0, [r6, #0xa8]\n"
 629             "    cbz     r0, loc_fc08eb7c\n"
 630             "    mov     r0, r4\n"
 631             "    bl      sub_fc0a093c\n"
 632             "    b       loc_fc08ebc2\n"
 633             "loc_fc08eb7c:\n"
 634             "    ldr.w   r0, [r6, #0xac]\n"
 635             "    cbz     r0, loc_fc08eb8a\n"
 636             "    mov     r0, r4\n"
 637             "    bl      sub_fc0a05b2\n"
 638             "    b       loc_fc08ebc2\n"
 639             "loc_fc08eb8a:\n"
 640             "    ldr.w   r0, [r6, #0xb0]\n"
 641             "    cbz     r0, loc_fc08eb98\n"
 642             "    mov     r0, r4\n"
 643             "    bl      sub_fc0a0c40\n"
 644             "    b       loc_fc08ebc2\n"
 645             "loc_fc08eb98:\n"
 646             "    ldr.w   r0, [r6, #0xb4]\n"
 647             "    cbz     r0, loc_fc08ebae\n"
 648             "    ldr     r0, =0x000470e8\n"
 649             "    ldr     r0, [r0]\n"
 650             "    cbz     r0, loc_fc08ebae\n"
 651             "    mov     r0, r4\n"
 652             "    bl      sub_fc0a0f3a\n"
 653             "    b       loc_fc08ebc2\n"
 654             "loc_fc08ebac:\n"
 655             "    b       loc_fc08ebd0\n"
 656             "loc_fc08ebae:\n"
 657             "    ldr.w   r0, [r6, #0xb8]\n"
 658             "    cmp     r0, #0\n"
 659             "    mov     r0, r4\n"
 660             "    beq     loc_fc08ebbe\n"
 661             "    bl      sub_fc0a122e\n"
 662             "    b       loc_fc08ebc2\n"
 663             "loc_fc08ebbe:\n"
 664             "    bl      sub_fc0a009e_my\n" // -> remote hook, raw hook
 665             "loc_fc08ebc2:\n"
 666             "    ldr.w   r0, [r6, #0x1c4]\n"
 667             "    cbz     r0, loc_fc08ebd0\n"
 668             "    movs    r1, #0\n"
 669             "    movs    r0, #1\n"
 670             "    bl      sub_fc07ce8c\n"
 671             "loc_fc08ebd0:\n"
 672             "    mov     r0, r5\n"
 673             "    b       loc_fc08eb54\n"
 674     );
 675 }
 676 
 677 //fc0a009e
 678 void __attribute__((naked,noinline))
 679 sub_fc0a009e_my ()
 680 {
 681     asm volatile (
 682             //capdis -f=chdk -s=0xfc0a009f -c=249 -stubs PRIMARY.BIN 0xfc000000
 683             "    push.w  {r0, r1, r2, r3, r4, r5, r6, r7, r8, sb, sl, lr}\n"
 684             "    ldr     r7, =0x00046ee4\n"
 685             "    mov     r4, r0\n"
 686             "    ldr.w   r0, [r7, #0x164]\n"
 687             "    cbz     r0, loc_fc0a00ba\n"
 688             "    ldrh.w  r0, [r7, #0x19a]\n"
 689             "    cmp     r0, #3\n"
 690             "    beq     loc_fc0a00ba\n"
 691             "    ldr     r0, [r4, #8]\n"
 692             "    cmp     r0, #1\n"
 693             "    bhi     loc_fc0a00c4\n"
 694             "loc_fc0a00ba:\n"
 695             "    mov     r0, r4\n"
 696             "    bl      sub_fc09191a\n"
 697             "    bl      sub_fc087912\n"
 698             "loc_fc0a00c4:\n"
 699             "    ldr.w   r0, [r7, #0x9c]\n"
 700             "    cbnz    r0, loc_fc0a00e0\n"
 701             "    ldrh.w  r0, [r7, #0x19a]\n"
 702             "    cmp     r0, #3\n"
 703             "    beq     loc_fc0a00d8\n"
 704             "    ldr     r0, [r4, #8]\n"
 705             "    cmp     r0, #1\n"
 706             "    bhi     loc_fc0a00e0\n"
 707             "loc_fc0a00d8:\n"
 708             "    bl      sub_fc0831dc\n"
 709             "    bl      sub_fc0874de\n"
 710             "loc_fc0a00e0:\n"
 711             "    movs    r2, #4\n"
 712             "    movw    r0, #0x139\n"
 713             "    add     r1, sp, #0xc\n"
 714             "    bl      sub_fc3b835e\n"
 715             "    lsls    r0, r0, #0x1f\n"
 716             "    beq     loc_fc0a00fc\n"
 717             "    movs    r0, #0\n"
 718             "    movw    r2, #0x153\n"
 719             "    ldr     r1, =0xfc0a0474\n" //  *"SsStandardCaptureSeq.c"
 720             "    blx     sub_fc34d264\n"
 721             "loc_fc0a00fc:\n"
 722             "    ldr     r0, [sp, #0xc]\n"
 723             "    ubfx    r0, r0, #8, #8\n"
 724             "    cmp     r0, #6\n"
 725             "    bne     loc_fc0a010c\n"
 726             "    ldr     r0, =0xfc0a0055\n"
 727             "    movs    r1, #0\n"
 728             "    b       loc_fc0a0110\n"
 729             "loc_fc0a010c:\n"
 730             "    ldr     r0, =0xfc09159d\n"
 731             "    mov     r1, r4\n"
 732             "loc_fc0a0110:\n"
 733             "    bl      sub_fc0ace52\n"
 734             "    movs    r2, #2\n"
 735             "    movw    r0, #0x114\n"
 736             "    add     r1, sp, #8\n"
 737             "    bl      sub_fc3b835e\n"
 738             "    lsls    r0, r0, #0x1f\n"
 739             "    beq     loc_fc0a0130\n"
 740             "    movs    r0, #0\n"
 741             "    movw    r2, #0x15c\n"
 742             "    ldr     r1, =0xfc0a0474\n" //  *"SsStandardCaptureSeq.c"
 743             "    blx     sub_fc34d264\n"
 744             "loc_fc0a0130:\n"
 745             "    ldr.w   r0, [r7, #0x184]\n"
 746             "    cbz     r0, loc_fc0a013a\n"
 747             "    bl      sub_fc091852\n"
 748             "loc_fc0a013a:\n"
 749             "    movs    r0, #0\n"
 750             "    bl      sub_fc07ce3e\n"
 751             "    mov     r0, r4\n"
 752             "    bl      sub_fc091a4a\n"
 753             "    movs    r2, #4\n"
 754             "    movs    r0, #0x92\n"
 755             "    add     r1, sp, #4\n"
 756             "    bl      sub_fc3b835e\n"
 757             "    lsls    r0, r0, #0x1f\n"
 758             "    beq     loc_fc0a0160\n"
 759             "    movs    r0, #0\n"
 760             "    movw    r2, #0x171\n"
 761             "    ldr     r1, =0xfc0a0474\n" //  *"SsStandardCaptureSeq.c"
 762             "    blx     sub_fc34d264\n"
 763             "loc_fc0a0160:\n"
 764             "    ldr     r1, =0x00027fe0\n"
 765             "    ldr     r0, [sp, #4]\n"
 766             "    str     r0, [r1]\n"
 767             "    bl      sub_fc07cef8\n"
 768             "    bl      sub_fc091adc\n"
 769             "    movs    r1, #0\n"
 770             "    mov     r0, r4\n"
 771             "    bl      sub_fc0a0056\n"
 772             "    mov     r6, r0\n"
 773             "    BL      wait_until_remote_button_is_released\n" // + remote hook
 774             "    ldr     r0, [sp, #0xc]\n"
 775             "    ubfx    r0, r0, #8, #8\n"
 776             "    cmp     r0, #6\n"
 777             "    bne     loc_fc0a0186\n"
 778             "    ldr     r2, =0xfc09181d\n"
 779             "    b       loc_fc0a0188\n"
 780             "loc_fc0a0186:\n"
 781             "    ldr     r2, =0xfc091833\n"
 782             "loc_fc0a0188:\n"
 783             "    ldrh    r0, [r4, #0x18]\n"
 784             "    ldr.w   r8, =0xfffff3a0\n"
 785             "    cbz     r0, loc_fc0a0198\n"
 786             "    cmp     r0, #1\n"
 787             "    beq     loc_fc0a01ae\n"
 788             "    cmp     r0, #4\n"
 789             "    bne     loc_fc0a021c\n"
 790             "loc_fc0a0198:\n"
 791             "    str     r6, [sp]\n"
 792             "    mov     r3, r2\n"
 793             "    ldr     r1, [r4, #0x5c]\n"
 794             "    mov     r0, r4\n"
 795             "    ldr     r2, [sp, #4]\n"
 796             "    bl      sub_fc0913c4\n"
 797             "    mov     r5, r0\n"
 798             "    bl      sub_fc0feba4\n"
 799             "    b       loc_fc0a022a\n"
 800             "loc_fc0a01ae:\n"
 801             "    str     r6, [sp]\n"
 802             "    mov     r3, r2\n"
 803             "    ldr     r1, [r4, #0x5c]\n"
 804             "    mov     r0, r4\n"
 805             "    ldr     r2, [sp, #4]\n"
 806             "    bl      sub_fc091432\n"
 807             "    mov     r5, r0\n"
 808             "    ldrsh.w r0, [sp, #8]\n"
 809             "    cmp     r0, r8\n"
 810             "    beq     loc_fc0a01cc\n"
 811             "    bl      sub_fc0ace20\n"
 812             "    cbnz    r0, loc_fc0a01d6\n"
 813             "loc_fc0a01cc:\n"
 814             "    movs    r2, #1\n"
 815             "    movs    r1, #0\n"
 816             "    movs    r0, #0x45\n"
 817             "    bl      sub_fc2d4488\n"
 818             "loc_fc0a01d6:\n"
 819             "    lsls    r0, r5, #0x1f\n"
 820             "    bne     loc_fc0a022a\n"
 821             "    ldr.w   r0, [r7, #0xf8]\n"
 822             "    cbz     r0, loc_fc0a01f0\n"
 823             "    ldr     r1, [r4, #8]\n"
 824             "    ldr     r2, =0x001e3538\n"
 825             "    ldr     r0, [r4, #0x5c]\n"
 826             "    add.w   r1, r2, r1, lsl #2\n"
 827             "    str     r0, [r1, #-0x4]\n"
 828             "    b       loc_fc0a0216\n"
 829             "loc_fc0a01f0:\n"
 830             "    ldr     r0, =0xfc0a0055\n"
 831             "    movs    r1, #0\n"
 832             "    bl      sub_fc0ace52\n"
 833             "    movs    r1, #1\n"
 834             "    mov     r0, r4\n"
 835             "    bl      sub_fc0a0056\n"
 836             "    mov     r6, r0\n"
 837             "    ldr     r0, [sp, #4]\n"
 838             "    bl      sub_fc0918bc\n"
 839             "    ldr     r1, [r4, #0x5c]\n"
 840             "    mov     r3, r6\n"
 841             "    ldr     r2, [sp, #4]\n"
 842             "    mov     r0, r4\n"
 843             "    bl      sub_fc0914aa\n"
 844             "    mov     r5, r0\n"
 845             "loc_fc0a0216:\n"
 846             "    bl      sub_fc09136c\n"
 847             "    b       loc_fc0a022a\n"
 848             "loc_fc0a021c:\n"
 849             "    movs    r0, #0\n"
 850             "    movw    r2, #0x1ad\n"
 851             "    ldr     r1, =0xfc0a0474\n" //  *"SsStandardCaptureSeq.c"
 852             "    blx     sub_fc34d264\n"
 853             "    movs    r5, #0x1d\n"
 854             "loc_fc0a022a:\n"
 855             "    ldrsh.w r0, [sp, #8]\n"
 856             "    cmp     r0, r8\n"
 857             "    beq     loc_fc0a0244\n"
 858             "    bl      sub_fc0ace20\n"
 859             "    cbz     r0, loc_fc0a0244\n"
 860             "    movs    r2, #1\n"
 861             "    movs    r1, #0\n"
 862             "    movs    r0, #0x46\n"
 863             "    bl      sub_fc2d4488\n"
 864             "    movs    r5, #1\n"
 865             "loc_fc0a0244:\n"
 866             "    bl      sub_fc091ae0\n"
 867             "    ldr.w   r8, =0xfc0a0055\n"
 868             "    lsls    r0, r5, #0x1f\n"
 869             "    bne     loc_fc0a02be\n"
 870             "    ldr.w   r0, [r7, #0x100]\n"
 871             "    cbnz    r0, loc_fc0a028a\n"
 872             "    ldr.w   r0, [r7, #0x1c4]\n"
 873             "    cbz     r0, loc_fc0a0274\n"
 874             "    ldrh.w  r0, [r7, #0x1e4]\n"
 875             "    cmp     r0, #1\n"
 876             "    bne     loc_fc0a028a\n"
 877             "    mov     r0, r4\n"
 878             "    bl      sub_fc0922ba\n"
 879             "    lsls    r0, r0, #0x1f\n"
 880             "    beq     loc_fc0a028a\n"
 881             "    movw    r2, #0x1c9\n"
 882             "    b       loc_fc0a0282\n"
 883             "loc_fc0a0274:\n"
 884             "    mov     r0, r4\n"
 885             "    bl      sub_fc0922ba\n"
 886             "    lsls    r0, r0, #0x1f\n"
 887             "    beq     loc_fc0a028a\n"
 888             "    movw    r2, #0x1cc\n"
 889             "loc_fc0a0282:\n"
 890             "    movs    r0, #0\n"
 891             "    ldr     r1, =0xfc0a0474\n" //  *"SsStandardCaptureSeq.c"
 892             "    blx     sub_fc34d264\n"
 893             "loc_fc0a028a:\n"
 894             "    BL      capt_seq_hook_raw_here\n" // +
 895             "    BL      clear_current_raw_addr\n" // +
 896             "    mov     r0, r4\n"
 897             "    bl      sub_fc091acc\n"
 898             "    mov     r0, r4\n"
 899             "    bl      sub_fc091aa0\n"
 900             "    cmp     r6, r8\n"
 901             "    beq     loc_fc0a02be\n"
 902             "    bl      sub_fc0991aa\n"
 903             "    movs    r1, #4\n"
 904             "    movw    sb, #0x1dc\n"
 905             "    ldr     r3, =0xfc0a0474\n" //  *"SsStandardCaptureSeq.c"
 906             "    movw    r2, #0x3a98\n"
 907             "    str.w   sb, [sp]\n"
 908             "    bl      sub_fc319020\n"
 909             "    cbz     r0, loc_fc0a02be\n"
 910             "    movs    r0, #0\n"
 911             "    mov     r2, sb\n"
 912             "    ldr     r1, =0xfc0a0474\n" //  *"SsStandardCaptureSeq.c"
 913             "    blx     sub_fc34d264\n"
 914             "loc_fc0a02be:\n"
 915             "    ldrh    r0, [r7]\n"
 916             "    sub.w   r1, r0, #0x4000\n"
 917             "    subs    r1, #0x44\n"
 918             "    bne     loc_fc0a02e0\n"
 919             "    bl      sub_fc0991aa\n"
 920             "    movw    r1, #0x8000\n"
 921             "    blx     sub_fc34d1e4\n"
 922             "    ldr     r0, =0xfc0a008d\n"
 923             "    movs    r1, #0\n"
 924             "    bl      sub_fc2d4b54\n"
 925             "    bl      sub_fc2d4b46\n"
 926             "loc_fc0a02e0:\n"
 927             "    ldr.w   r0, [r7, #0x184]\n"
 928             "    cbz     r0, loc_fc0a02f0\n"
 929             "    movs    r2, #1\n"
 930             "    movs    r1, #0\n"
 931             "    movs    r0, #0x46\n"
 932             "    bl      sub_fc2d4488\n"
 933             "loc_fc0a02f0:\n"
 934             "    movs    r1, #2\n"
 935             "    mov     r2, r4\n"
 936             "    mov     r0, r5\n"
 937             "    bl      sub_fc090918\n"
 938             "    ldr     r0, [r7, #0x28]\n"
 939             "    cmp     r0, #0\n"
 940             "    mov     r0, r8\n"
 941             "    beq     loc_fc0a0316\n"
 942             "    cmp     r6, r0\n"
 943             "    beq     loc_fc0a030a\n"
 944             "    movs    r1, #1\n"
 945             "    b       loc_fc0a030c\n"
 946             "loc_fc0a030a:\n"
 947             "    movs    r1, #0\n"
 948             "loc_fc0a030c:\n"
 949             "    mov     r2, r5\n"
 950             "    mov     r0, r4\n"
 951             "    bl      sub_fc09dd76\n"
 952             "    b       loc_fc0a0328\n"
 953             "loc_fc0a0316:\n"
 954             "    cmp     r6, r0\n"
 955             "    beq     loc_fc0a031e\n"
 956             "    movs    r1, #1\n"
 957             "    b       loc_fc0a0320\n"
 958             "loc_fc0a031e:\n"
 959             "    movs    r1, #0\n"
 960             "loc_fc0a0320:\n"
 961             "    mov     r2, r5\n"
 962             "    mov     r0, r4\n"
 963             "    bl      sub_fc09dd30\n"
 964             "loc_fc0a0328:\n"
 965             "    add     sp, #0x10\n"
 966             "    mov     r0, r5\n"
 967             "    pop.w   {r4, r5, r6, r7, r8, sb, sl, pc}\n"
 968     );
 969 }
 970 
 971 // TODO:
 972 // task_DvlpSeq 0xfc091e67
 973 void __attribute__((naked,noinline))
 974 developseq_task ()
 975 {
 976     asm volatile (
 977             "    nop\n"
 978     );
 979 }
 980 
 981 // exp_drv_task 0xfc2f63ef
 982 void __attribute__((naked,noinline))
 983 exp_drv_task ()
 984 {
 985     asm volatile (
 986             //capdis -f=chdk -s=0xfc2f63ef -c=258 -stubs PRIMARY.BIN 0xfc000000
 987             "    push.w  {r4, r5, r6, r7, r8, sb, sl, fp, lr}\n"
 988             "    sub     sp, #0x2c\n"
 989             "    ldr.w   sl, =0x0000e89c\n"
 990             "    ldr.w   fp, =0xfffff400\n"
 991             "    movs    r0, #0\n"
 992             "    ldr.w   r8, =0x0006ee40\n"
 993             "    movs    r4, #0x3e\n"
 994             "    add.w   sb, sp, #0x1c\n"
 995             "    str     r0, [sp, #0xc]\n"
 996             "loc_fc2f640a:\n"
 997             "    ldr.w   r0, [sl, #0x20]\n"
 998             "    movs    r2, #0\n"
 999             "    add     r1, sp, #0x28\n"
1000             "    mov     r5, sl\n"
1001             "    blx     sub_fc34d054\n"
1002             "    ldr     r0, [sp, #0x28]\n"
1003             "    movs    r1, #0\n"
1004             "    cmp     r4, #0x15\n"
1005             "    ldr     r0, [r0]\n"
1006             "    beq     loc_fc2f6436\n"
1007             "    cmp     r4, #0x16\n"
1008             "    beq     loc_fc2f6436\n"
1009             "    cmp     r4, #0x17\n"
1010             "    beq     loc_fc2f6436\n"
1011             "    cmp     r4, #0x18\n"
1012             "    beq     loc_fc2f6436\n"
1013             "    cmp     r4, #0x19\n"
1014             "    beq     loc_fc2f6436\n"
1015             "    cmp     r4, #0x1a\n"
1016             "    bne     loc_fc2f6458\n"
1017             "loc_fc2f6436:\n"
1018             "    cmp     r0, #0x15\n"
1019             "    beq     loc_fc2f6458\n"
1020             "    cmp     r0, #0x16\n"
1021             "    beq     loc_fc2f6458\n"
1022             "    cmp     r0, #0x17\n"
1023             "    beq     loc_fc2f6458\n"
1024             "    cmp     r0, #0x18\n"
1025             "    beq     loc_fc2f6458\n"
1026             "    cmp     r0, #0x19\n"
1027             "    beq     loc_fc2f6458\n"
1028             "    cmp     r0, #0x1a\n"
1029             "    beq     loc_fc2f6458\n"
1030             "    cmp     r0, #0x3b\n"
1031             "    beq     loc_fc2f6458\n"
1032             "    cmp     r0, #0x36\n"
1033             "    beq     loc_fc2f6458\n"
1034             "    movs    r1, #1\n"
1035             "loc_fc2f6458:\n"
1036             "    cmp     r1, #1\n"
1037             "    bne     loc_fc2f6464\n"
1038             "    movs    r0, #0\n"
1039             "    add     r1, sp, #0xc\n"
1040             "    bl      sub_fc2f63aa\n"
1041             "loc_fc2f6464:\n"
1042             "    ldr     r0, [sp, #0x28]\n"
1043             "    ldr     r1, [r0]\n"
1044             "    cmp     r1, #0x3b\n"
1045             "    beq     loc_fc2f6516\n"
1046             "    cmp     r1, #0x3e\n"
1047             "    mov     r4, r1\n"
1048             "    bne     loc_fc2f6488\n"
1049             "    bl      sub_fc2f74dc\n"
1050             "    ldr.w   r0, [sl, #0x1c]\n"
1051             "    movs    r1, #1\n"
1052             "    blx     sub_fc34d10c\n"
1053             "    blx     sub_fc34d0f4\n"
1054             "    add     sp, #0x2c\n"
1055             "    b       sub_fc2f612e\n" // continue in firmware
1056             "loc_fc2f6488:\n"
1057             "    cmp     r1, #0x3d\n"
1058             "    bne     loc_fc2f649a\n"
1059             "    add.w   r0, r0, #0xac\n"
1060             "    ldrd    r2, r1, [r0]\n"
1061             "    mov     r0, r1\n"
1062             "    blx     r2\n"
1063             "    b       loc_fc2f68e8\n"
1064             "loc_fc2f649a:\n"
1065             "    cmp     r1, #0x34\n"
1066             "    bne     loc_fc2f64d2\n"
1067             "    ldr     r0, [r5, #0x1c]\n"
1068             "    movs    r1, #0x80\n"
1069             "    blx     sub_fc34d1e4\n"
1070             "    ldr     r0, =0xfc2f1e7d\n"
1071             "    movs    r1, #0x80\n"
1072             "    bl      sub_fc163e1a\n"
1073             "    ldr     r0, [r5, #0x1c]\n"
1074             "    movs    r1, #0x80\n"
1075             "    movw    r2, #0xbb8\n"
1076             "    blx     sub_fc34d0cc\n"
1077             "    lsls    r0, r0, #0x1f\n"
1078             "    beq     loc_fc2f64c4\n"
1079             "    movw    r2, #0x1934\n"
1080             "    b       loc_fc2f6558\n"
1081             "loc_fc2f64c4:\n"
1082             "    ldr     r1, [sp, #0x28]\n"
1083             "    add.w   r1, r1, #0xac\n"
1084             "    ldrd    r1, r0, [r1]\n"
1085             "    blx     r1\n"
1086             "    b       loc_fc2f68e8\n"
1087             "loc_fc2f64d2:\n"
1088             "    cmp     r1, #0x35\n"
1089             "    bne     loc_fc2f6506\n"
1090             "    add     r1, sp, #0xc\n"
1091             "    bl      sub_fc2f63aa\n"
1092             "    movw    r6, #0x100\n"
1093             "    ldr     r0, [r5, #0x1c]\n"
1094             "    mov     r1, r6\n"
1095             "    blx     sub_fc34d1e4\n"
1096             "    ldr     r0, =0xfc2f1e87\n"
1097             "    mov     r1, r6\n"
1098             "    bl      sub_fc1647b8\n"
1099             "    ldr     r0, [r5, #0x1c]\n"
1100             "    movw    r2, #0xbb8\n"
1101             "    mov     r1, r6\n"
1102             "    blx     sub_fc34d0cc\n"
1103             "    lsls    r0, r0, #0x1f\n"
1104             "    beq     loc_fc2f64c4\n"
1105             "    movw    r2, #0x193e\n"
1106             "    b       loc_fc2f6558\n"
1107             "loc_fc2f6506:\n"
1108             "    cmp     r1, #0x36\n"
1109             "    bne     loc_fc2f6512\n"
1110             "    add     r1, sp, #0xc\n"
1111             "    bl      sub_fc2f63aa\n"
1112             "    b       loc_fc2f64c4\n"
1113             "loc_fc2f6512:\n"
1114             "    cmp     r1, #0x3b\n"
1115             "    bne     loc_fc2f6524\n"
1116             "loc_fc2f6516:\n"
1117             "    bl      sub_fc470fc8\n"
1118             "    bl      sub_fc198d24\n"
1119             "    bl      sub_fc469df6\n"
1120             "    b       loc_fc2f64c4\n"
1121             "loc_fc2f6524:\n"
1122             "    cmp     r1, #0x3c\n"
1123             "    bne     loc_fc2f6562\n"
1124             "    ldr     r0, [r5, #0x1c]\n"
1125             "    movs    r1, #4\n"
1126             "    blx     sub_fc34d1e4\n"
1127             "    movs    r3, #1\n"
1128             "    ldr     r2, =0xfc2f1e9b\n"
1129             "    movs    r1, #0\n"
1130             "    mov     r0, fp\n"
1131             "    str     r3, [sp]\n"
1132             "    movs    r3, #4\n"
1133             "    bl      sub_fc2f752c\n"
1134             "    bl      sub_fc470ce8\n"
1135             "    ldr     r0, [r5, #0x1c]\n"
1136             "    movs    r1, #4\n"
1137             "    movw    r2, #0xbb8\n"
1138             "    blx     sub_fc34d22c\n"
1139             "    lsls    r0, r0, #0x1f\n"
1140             "    beq     loc_fc2f64c4\n"
1141             "    movw    r2, #0x1a2d\n"
1142             "loc_fc2f6558:\n"
1143             "    ldr     r1, =0xfc2f26f8\n" //  **"ExpDrv.c"
1144             "    movs    r0, #0\n"
1145             "    blx     sub_fc34d264\n"
1146             "    b       loc_fc2f64c4\n"
1147             "loc_fc2f6562:\n"
1148             "    movs    r6, #1\n"
1149             "    cmp     r1, #0x13\n"
1150             "    beq     loc_fc2f656c\n"
1151             "    cmp     r1, #0x14\n"
1152             "    bne     loc_fc2f65aa\n"
1153             "loc_fc2f656c:\n"
1154             "    ldr.w   r1, [r0, #0x94]\n"
1155             "    mov     r5, sb\n"
1156             "    add.w   r1, r1, r1, lsl #1\n"
1157             "    add.w   r1, r0, r1, lsl #2\n"
1158             "    subs    r1, #8\n"
1159             "    ldm     r1!, {r2, r3, r7}\n"
1160             "    stm     r5!, {r2, r3, r7}\n"
1161             "    bl      sub_fc2f4bba\n"
1162             "    ldr     r0, [sp, #0x28]\n"
1163             "    add.w   r0, r0, #0x94\n"
1164             "    ldrd    r3, r2, [r0, #0x18]\n"
1165             "    ldr     r1, [r0]\n"
1166             "    sub.w   r0, r0, #0x90\n"
1167             "    blx     r3\n"
1168             "    ldr     r0, [sp, #0x28]\n"
1169             "    bl      sub_fc2f76ea\n"
1170             "    ldr     r0, [sp, #0x28]\n"
1171             "    add.w   r0, r0, #0x94\n"
1172             "    ldr     r1, [r0]\n"
1173             "    ldrd    r3, r2, [r0, #0x20]\n"
1174             "    b       loc_fc2f6808\n"
1175             "loc_fc2f65aa:\n"
1176             "    cmp     r1, #0x15\n"
1177             "    beq     loc_fc2f65c2\n"
1178             "    cmp     r1, #0x16\n"
1179             "    beq     loc_fc2f65c2\n"
1180             "    cmp     r1, #0x17\n"
1181             "    beq     loc_fc2f65c2\n"
1182             "    cmp     r1, #0x18\n"
1183             "    beq     loc_fc2f65c2\n"
1184             "    cmp     r1, #0x19\n"
1185             "    beq     loc_fc2f65c2\n"
1186             "    cmp     r1, #0x1a\n"
1187             "    bne     loc_fc2f6634\n"
1188             "loc_fc2f65c2:\n"
1189             "    add     r3, sp, #0xc\n"
1190             "    mov     r2, sp\n"
1191             "    add     r1, sp, #0x1c\n"
1192             "    bl      sub_fc2f4da2\n"
1193             "    cmp     r0, #1\n"
1194             "    mov     r5, r0\n"
1195             "    beq     loc_fc2f65d6\n"
1196             "    cmp     r5, #5\n"
1197             "    bne     loc_fc2f65ec\n"
1198             "loc_fc2f65d6:\n"
1199             "    ldr     r0, [sp, #0x28]\n"
1200             "    mov     r2, r5\n"
1201             "    add.w   r0, r0, #0x94\n"
1202             "    ldrd    r7, r3, [r0, #0x18]\n"
1203             "    ldr     r1, [r0]\n"
1204             "    sub.w   r0, r0, #0x90\n"
1205             "    blx     r7\n"
1206             "    b       loc_fc2f6612\n"
1207             "loc_fc2f65ec:\n"
1208             "    cmp     r5, #2\n"
1209             "    beq     loc_fc2f65f4\n"
1210             "    cmp     r5, #6\n"
1211             "    bne     loc_fc2f661e\n"
1212             "loc_fc2f65f4:\n"
1213             "    ldr     r0, [sp, #0x28]\n"
1214             "    mov     r2, r5\n"
1215             "    add.w   r0, r0, #0x94\n"
1216             "    ldrd    r7, r3, [r0, #0x18]\n"
1217             "    ldr     r1, [r0]\n"
1218             "    sub.w   r0, r0, #0x90\n"
1219             "    blx     r7\n"
1220             "    ldr     r0, [sp, #0x28]\n"
1221             "    add     r1, sp, #0x1c\n"
1222             "    mov     r2, sp\n"
1223             "    bl      sub_fc2f6132\n"
1224             "loc_fc2f6612:\n"
1225             "    ldr     r2, [sp, #0xc]\n"
1226             "    mov     r1, r5\n"
1227             "    ldr     r0, [sp, #0x28]\n"
1228             "    bl      sub_fc2f635a\n"
1229             "    b       loc_fc2f680e\n"
1230             "loc_fc2f661e:\n"
1231             "    ldr     r0, [sp, #0x28]\n"
1232             "    mov     r2, r5\n"
1233             "    add.w   r0, r0, #0x94\n"
1234             "    ldrd    r7, r3, [r0, #0x18]\n"
1235             "    ldr     r1, [r0]\n"
1236             "    sub.w   r0, r0, #0x90\n"
1237             "    blx     r7\n"
1238             "    b       loc_fc2f680e\n"
1239             "loc_fc2f6634:\n"
1240             "    cmp     r1, #0x2d\n"
1241             "    beq     loc_fc2f663c\n"
1242             "    cmp     r1, #0x2e\n"
1243             "    bne     loc_fc2f666e\n"
1244             "loc_fc2f663c:\n"
1245             "    ldr.w   r1, [r0, #0x94]\n"
1246             "    mov     r5, sb\n"
1247             "    add.w   r1, r1, r1, lsl #1\n"
1248             "    add.w   r1, r0, r1, lsl #2\n"
1249             "    subs    r1, #8\n"
1250             "    ldm     r1!, {r2, r3, r7}\n"
1251             "    stm     r5!, {r2, r3, r7}\n"
1252             "    bl      sub_fc2f3c68\n"
1253             "    ldr     r0, [sp, #0x28]\n"
1254             "    add.w   r0, r0, #0x94\n"
1255             "    ldrd    r3, r2, [r0, #0x18]\n"
1256             "    ldr     r1, [r0]\n"
1257             "    sub.w   r0, r0, #0x90\n"
1258             "    blx     r3\n"
1259             "    ldr     r0, [sp, #0x28]\n"
1260             "    bl      sub_fc2f406c\n"
1261             "    b       loc_fc2f680e\n"
1262             "loc_fc2f666e:\n"
1263             "    adds    r1, r0, #4\n"
1264             "    mov     r5, sb\n"
1265             "    ldm     r1!, {r2, r3, r7}\n"
1266             "    stm     r5!, {r2, r3, r7}\n"
1267             "    ldr     r1, [r0]\n"
1268             "    cmp     r1, #0x34\n"
1269             "    bhs     loc_fc2f66e4\n"
1270 
1271             //capdis -f=chdk -s=0xfc2f66a9 -c=179 -stubs PRIMARY.BIN 0xfc000000
1272             "    tbb     [pc, r1]\n" // (jumptable r1 52 elements)
1273             "branchtable_fc2f66ac:\n"
1274             "    .byte((loc_fc2f66e0 - branchtable_fc2f66ac) / 2)\n" // (case 0)
1275             "    .byte((loc_fc2f66e0 - branchtable_fc2f66ac) / 2)\n" // (case 1)
1276             "    .byte((loc_fc2f66e6 - branchtable_fc2f66ac) / 2)\n" // (case 2)
1277             "    .byte((loc_fc2f66ec - branchtable_fc2f66ac) / 2)\n" // (case 3)
1278             "    .byte((loc_fc2f66ec - branchtable_fc2f66ac) / 2)\n" // (case 4)
1279             "    .byte((loc_fc2f66ec - branchtable_fc2f66ac) / 2)\n" // (case 5)
1280             "    .byte((loc_fc2f66e0 - branchtable_fc2f66ac) / 2)\n" // (case 6)
1281             "    .byte((loc_fc2f66e6 - branchtable_fc2f66ac) / 2)\n" // (case 7)
1282             "    .byte((loc_fc2f66ec - branchtable_fc2f66ac) / 2)\n" // (case 8)
1283             "    .byte((loc_fc2f66ec - branchtable_fc2f66ac) / 2)\n" // (case 9)
1284             "    .byte((loc_fc2f66fe - branchtable_fc2f66ac) / 2)\n" // (case 10)
1285             "    .byte((loc_fc2f66fe - branchtable_fc2f66ac) / 2)\n" // (case 11)
1286             "    .byte((loc_fc2f66fe - branchtable_fc2f66ac) / 2)\n" // (case 12)
1287             "    .byte((loc_fc2f67ec - branchtable_fc2f66ac) / 2)\n" // (case 13)
1288             "    .byte((loc_fc2f67f2 - branchtable_fc2f66ac) / 2)\n" // (case 14)
1289             "    .byte((loc_fc2f67f2 - branchtable_fc2f66ac) / 2)\n" // (case 15)
1290             "    .byte((loc_fc2f67f2 - branchtable_fc2f66ac) / 2)\n" // (case 16)
1291             "    .byte((loc_fc2f67f2 - branchtable_fc2f66ac) / 2)\n" // (case 17)
1292             "    .byte((loc_fc2f67f8 - branchtable_fc2f66ac) / 2)\n" // (case 18)
1293             "    .byte((loc_fc2f67fc - branchtable_fc2f66ac) / 2)\n" // (case 19)
1294             "    .byte((loc_fc2f67fc - branchtable_fc2f66ac) / 2)\n" // (case 20)
1295             "    .byte((loc_fc2f67fc - branchtable_fc2f66ac) / 2)\n" // (case 21)
1296             "    .byte((loc_fc2f67fc - branchtable_fc2f66ac) / 2)\n" // (case 22)
1297             "    .byte((loc_fc2f67fc - branchtable_fc2f66ac) / 2)\n" // (case 23)
1298             "    .byte((loc_fc2f67fc - branchtable_fc2f66ac) / 2)\n" // (case 24)
1299             "    .byte((loc_fc2f67fc - branchtable_fc2f66ac) / 2)\n" // (case 25)
1300             "    .byte((loc_fc2f67fc - branchtable_fc2f66ac) / 2)\n" // (case 26)
1301             "    .byte((loc_fc2f66f2 - branchtable_fc2f66ac) / 2)\n" // (case 27)
1302             "    .byte((loc_fc2f66f8 - branchtable_fc2f66ac) / 2)\n" // (case 28)
1303             "    .byte((loc_fc2f66f8 - branchtable_fc2f66ac) / 2)\n" // (case 29)
1304             "    .byte((loc_fc2f66f8 - branchtable_fc2f66ac) / 2)\n" // (case 30)
1305             "    .byte((loc_fc2f6706 - branchtable_fc2f66ac) / 2)\n" // (case 31)
1306             "    .byte((loc_fc2f6706 - branchtable_fc2f66ac) / 2)\n" // (case 32)
1307             "    .byte((loc_fc2f6706 - branchtable_fc2f66ac) / 2)\n" // (case 33)
1308             "    .byte((loc_fc2f6706 - branchtable_fc2f66ac) / 2)\n" // (case 34)
1309             "    .byte((loc_fc2f6706 - branchtable_fc2f66ac) / 2)\n" // (case 35)
1310             "    .byte((loc_fc2f6706 - branchtable_fc2f66ac) / 2)\n" // (case 36)
1311             "    .byte((loc_fc2f670c - branchtable_fc2f66ac) / 2)\n" // (case 37)
1312             "    .byte((loc_fc2f673e - branchtable_fc2f66ac) / 2)\n" // (case 38)
1313             "    .byte((loc_fc2f67fc - branchtable_fc2f66ac) / 2)\n" // (case 39)
1314             "    .byte((loc_fc2f67fc - branchtable_fc2f66ac) / 2)\n" // (case 40)
1315             "    .byte((loc_fc2f6772 - branchtable_fc2f66ac) / 2)\n" // (case 41)
1316             "    .byte((loc_fc2f67a6 - branchtable_fc2f66ac) / 2)\n" // (case 42)
1317             "    .byte((loc_fc2f67da - branchtable_fc2f66ac) / 2)\n" // (case 43)
1318             "    .byte((loc_fc2f67da - branchtable_fc2f66ac) / 2)\n" // (case 44)
1319             "    .byte((loc_fc2f67fc - branchtable_fc2f66ac) / 2)\n" // (case 45)
1320             "    .byte((loc_fc2f67fc - branchtable_fc2f66ac) / 2)\n" // (case 46)
1321             "    .byte((loc_fc2f67e0 - branchtable_fc2f66ac) / 2)\n" // (case 47)
1322             "    .byte((loc_fc2f67e0 - branchtable_fc2f66ac) / 2)\n" // (case 48)
1323             "    .byte((loc_fc2f67e0 - branchtable_fc2f66ac) / 2)\n" // (case 49)
1324             "    .byte((loc_fc2f67e6 - branchtable_fc2f66ac) / 2)\n" // (case 50)
1325             "    .byte((loc_fc2f67e6 - branchtable_fc2f66ac) / 2)\n" // (case 51)
1326             ".align 1\n"
1327             "loc_fc2f66e0:\n"
1328             "    bl      sub_fc2f255a\n"
1329             "loc_fc2f66e4:\n"
1330             "    b       loc_fc2f67fc\n"
1331             "loc_fc2f66e6:\n"
1332             "    bl      sub_fc2f280a\n"
1333             "    b       loc_fc2f67fc\n"
1334             "loc_fc2f66ec:\n"
1335             "    bl      sub_fc2f2a1e\n"
1336             "    b       loc_fc2f67fc\n"
1337             "loc_fc2f66f2:\n"
1338             "    bl      sub_fc2f2ce0\n"
1339             "    b       loc_fc2f67fc\n"
1340             "loc_fc2f66f8:\n"
1341             "    bl      sub_fc2f2ea4\n"
1342             "    b       loc_fc2f67fc\n"
1343             "loc_fc2f66fe:\n"
1344             "    bl      sub_fc2f32fa_my\n" // Patched
1345             "    movs    r6, #0\n"
1346             "    b       loc_fc2f67fc\n"
1347             "loc_fc2f6706:\n"
1348             "    bl      sub_fc2f33f4\n"
1349             "    b       loc_fc2f67fc\n"
1350             "loc_fc2f670c:\n"
1351             "    ldrh    r1, [r0, #4]\n"
1352             "    strh.w  r1, [sp, #0x1c]\n"
1353             "    ldrh.w  r2, [r8, #2]\n"
1354             "    strh.w  r2, [sp, #0x1e]\n"
1355             "    ldrh.w  r2, [r8, #4]\n"
1356             "    strh.w  r2, [sp, #0x20]\n"
1357             "    ldrh.w  r2, [r8, #6]\n"
1358             "    strh.w  r2, [sp, #0x22]\n"
1359             "    ldrh    r2, [r0, #0xc]\n"
1360             "    strh.w  r2, [sp, #0x24]\n"
1361             "    ldrh.w  r1, [r8, #0xa]\n"
1362             "    strh.w  r1, [sp, #0x26]\n"
1363             "    bl      sub_fc2f39b6\n"
1364             "    b       loc_fc2f67fc\n"
1365             "loc_fc2f673e:\n"
1366             "    ldrh    r1, [r0, #4]\n"
1367             "    strh.w  r1, [sp, #0x1c]\n"
1368             "    ldrh.w  r2, [r8, #2]\n"
1369             "    strh.w  r2, [sp, #0x1e]\n"
1370             "    ldrh.w  r2, [r8, #4]\n"
1371             "    strh.w  r2, [sp, #0x20]\n"
1372             "    ldrh.w  r2, [r8, #6]\n"
1373             "    strh.w  r2, [sp, #0x22]\n"
1374             "    ldrh.w  r2, [r8, #8]\n"
1375             "    strh.w  r2, [sp, #0x24]\n"
1376             "    ldrh.w  r1, [r8, #0xa]\n"
1377             "    strh.w  r1, [sp, #0x26]\n"
1378             "    bl      sub_fc2f7576\n"
1379             "    b       loc_fc2f67fc\n"
1380             "loc_fc2f6772:\n"
1381             "    ldrh.w  r2, [r8]\n"
1382             "    strh.w  r2, [sp, #0x1c]\n"
1383             "    ldrh    r2, [r0, #6]\n"
1384             "    strh.w  r2, [sp, #0x1e]\n"
1385             "    ldrh.w  r2, [r8, #4]\n"
1386             "    strh.w  r2, [sp, #0x20]\n"
1387             "    ldrh.w  r2, [r8, #6]\n"
1388             "    strh.w  r2, [sp, #0x22]\n"
1389             "    ldrh.w  r2, [r8, #8]\n"
1390             "    strh.w  r2, [sp, #0x24]\n"
1391             "    ldrh.w  r1, [r8, #0xa]\n"
1392             "    strh.w  r1, [sp, #0x26]\n"
1393             "    bl      sub_fc2f75fc\n"
1394             "    b       loc_fc2f67fc\n"
1395             "loc_fc2f67a6:\n"
1396             "    ldrh.w  r2, [r8]\n"
1397             "    strh.w  r2, [sp, #0x1c]\n"
1398             "    ldrh.w  r2, [r8, #2]\n"
1399             "    strh.w  r2, [sp, #0x1e]\n"
1400             "    ldrh.w  r2, [r8, #4]\n"
1401             "    strh.w  r2, [sp, #0x20]\n"
1402             "    ldrh.w  r2, [r8, #6]\n"
1403             "    strh.w  r2, [sp, #0x22]\n"
1404             "    ldrh    r2, [r0, #0xc]\n"
1405             "    strh.w  r2, [sp, #0x24]\n"
1406             "    ldrh.w  r1, [r8, #0xa]\n"
1407             "    strh.w  r1, [sp, #0x26]\n"
1408             "    bl      sub_fc2f767a\n"
1409             "    b       loc_fc2f67fc\n"
1410             "loc_fc2f67da:\n"
1411             "    bl      sub_fc2f3a70\n"
1412             "    b       loc_fc2f67fc\n"
1413             "loc_fc2f67e0:\n"
1414             "    bl      sub_fc2f4134\n"
1415             "    b       loc_fc2f67fc\n"
1416             "loc_fc2f67e6:\n"
1417             "    bl      sub_fc2f4528\n"
1418             "    b       loc_fc2f67fc\n"
1419             "loc_fc2f67ec:\n"
1420             "    bl      sub_fc2f476e\n"
1421             "    b       loc_fc2f67fc\n"
1422             "loc_fc2f67f2:\n"
1423             "    bl      sub_fc2f48d4\n"
1424             "    b       loc_fc2f67fc\n"
1425             "loc_fc2f67f8:\n"
1426             "    bl      sub_fc2f49ee\n"
1427             "loc_fc2f67fc:\n"
1428             "    ldr     r0, [sp, #0x28]\n"
1429             "    add.w   r0, r0, #0x94\n"
1430             "    ldrd    r3, r2, [r0, #0x18]\n"
1431             "    ldr     r1, [r0]\n"
1432             "loc_fc2f6808:\n"
1433             "    sub.w   r0, r0, #0x90\n"
1434             "    blx     r3\n"
1435             "loc_fc2f680e:\n"
1436             "    ldr     r0, [sp, #0x28]\n"
1437             "    ldr     r0, [r0]\n"
1438             "    cmp     r0, #0x11\n"
1439             "    beq     loc_fc2f6832\n"
1440             "    bgt     loc_fc2f6826\n"
1441             "    cmp     r0, #1\n"
1442             "    beq     loc_fc2f6832\n"
1443             "    cmp     r0, #4\n"
1444             "    beq     loc_fc2f6832\n"
1445             "    cmp     r0, #0xf\n"
1446             "    bne     loc_fc2f6866\n"
1447             "    b       loc_fc2f6832\n"
1448             "loc_fc2f6826:\n"
1449             "    cmp     r0, #0x14\n"
1450             "    beq     loc_fc2f6832\n"
1451             "    cmp     r0, #0x1a\n"
1452             "    beq     loc_fc2f6832\n"
1453             "    cmp     r0, #0x1d\n"
1454             "    bne     loc_fc2f6866\n"
1455             "loc_fc2f6832:\n"
1456             "    ldrsh.w r0, [r8]\n"
1457             "    mov     r1, r8\n"
1458             "    mov     r2, fp\n"
1459             "    cmp     r0, fp\n"
1460             "    beq     loc_fc2f6846\n"
1461             "    ldrsh.w r1, [r1, #8]\n"
1462             "    cmp     r1, r2\n"
1463             "    bne     loc_fc2f685e\n"
1464             "loc_fc2f6846:\n"
1465             "    add     r0, sp, #0x10\n"
1466             "    bl      sub_fc3af9ee\n"
1467             "    ldrh.w  r0, [sp, #0x10]\n"
1468             "    strh.w  r0, [sp, #0x1c]\n"
1469             "    ldrh.w  r0, [sp, #0x18]\n"
1470             "    strh.w  r0, [sp, #0x24]\n"
1471             "    b       loc_fc2f6866\n"
1472             "loc_fc2f685e:\n"
1473             "    strh.w  r0, [sp, #0x1c]\n"
1474             "    strh.w  r1, [sp, #0x24]\n"
1475             "loc_fc2f6866:\n"
1476             "    cmp     r6, #1\n"
1477             "    ldr     r0, [sp, #0x28]\n"
1478             "    bne     loc_fc2f689e\n"
1479             "    movs    r2, #0xc\n"
1480             "    ldr.w   r1, [r0, #0x94]\n"
1481             "    add.w   r1, r1, r1, lsl #1\n"
1482             "    add.w   r5, r0, r1, lsl #2\n"
1483             "    ldr     r0, =0x0006ee40\n"
1484             "    subs    r5, #8\n"
1485             "    add     r1, sp, #0x1c\n"
1486             "    blx     sub_fc34d21c\n"
1487             "    ldr     r0, =0x0006ee40\n"
1488             "    movs    r2, #0xc\n"
1489             "    add     r1, sp, #0x1c\n"
1490             "    adds    r0, #0xc\n"
1491             "    blx     sub_fc34d21c\n"
1492             "    ldr     r0, =0x0006ee40\n"
1493             "    movs    r2, #0xc\n"
1494             "    mov     r1, r5\n"
1495             "    adds    r0, #0x18\n"
1496             "    blx     sub_fc34d21c\n"
1497             "    b       loc_fc2f68e8\n"
1498             "loc_fc2f689e:\n"
1499             "    ldr     r0, [r0]\n"
1500             "    mov.w   r3, #1\n"
1501             "    cmp     r0, #0xc\n"
1502             "    bne     loc_fc2f68c8\n"
1503             "    movs    r2, #0\n"
1504             "    mov     r1, r3\n"
1505             "    strd    r2, r3, [sp]\n"
1506             "    movs    r0, #0\n"
1507             "    mov     r2, r3\n"
1508             "    bl      sub_fc2f23b2\n"
1509             "    movs    r3, #1\n"
1510             "    movs    r2, #0\n"
1511             "    mov     r1, r3\n"
1512             "    movs    r0, #0\n"
1513             "    strd    r2, r3, [sp]\n"
1514             "    mov     r2, r3\n"
1515             "    b       loc_fc2f68e4\n"
1516             "loc_fc2f68c8:\n"
1517             "    movs    r2, #1\n"
1518             "    strd    r2, r3, [sp]\n"
1519             "    mov     r3, r2\n"
1520             "    mov     r1, r2\n"
1521             "    mov     r0, r2\n"
1522             "    bl      sub_fc2f23b2\n"
1523             "    movs    r3, #1\n"
1524             "    str     r3, [sp]\n"
1525             "    mov     r2, r3\n"
1526             "    mov     r1, r3\n"
1527             "    mov     r0, r3\n"
1528             "    str     r3, [sp, #4]\n"
1529             "loc_fc2f68e4:\n"
1530             "    bl      sub_fc2f24d8\n"
1531             "loc_fc2f68e8:\n"
1532             "    ldr     r0, [sp, #0x28]\n"
1533             "    bl      sub_fc2f74dc\n"
1534             "    b       loc_fc2f640a\n"
1535     );
1536 }
1537 
1538 //fc2f32fa
1539 void __attribute__((naked,noinline))
1540 sub_fc2f32fa_my ()
1541 {
1542     asm volatile (
1543             //capdis -f=chdk -s=0xfc2f32fb -c=52 -jfw -stubs PRIMARY.BIN 0xfc000000
1544             "    push.w  {r4, r5, r6, r7, r8, lr}\n"
1545             "    ldr     r7, =0x0000e89c\n"
1546             "    movs    r1, #0x3e\n"
1547             "    mov     r4, r0\n"
1548             "    ldr     r0, [r7, #0x1c]\n"
1549             "    blx     sub_fc34d1e4\n"
1550             "    movs    r2, #0\n"
1551             "    ldrsh.w r0, [r4, #4]\n"
1552             "    movs    r3, #1\n"
1553             "    mov     r1, r2\n"
1554             "    bl      sub_fc2f1edc\n"
1555             "    mov     r6, r0\n"
1556             "    ldrsh.w r0, [r4, #6]\n"
1557             "    bl      sub_fc2f2076\n"
1558             "    ldrsh.w r0, [r4, #8]\n"
1559             "    bl      sub_fc2f20bc\n"
1560             "    ldrsh.w r0, [r4, #0xa]\n"
1561             "    bl      sub_fc2f2102\n"
1562             "    ldrsh.w r0, [r4, #0xc]\n"
1563             "    movs    r1, #0\n"
1564             "    bl      sub_fc2f2148\n"
1565             "    mov     r5, r0\n"
1566             "    ldr     r0, [r4]\n"
1567             "    ldr.w   r8, =0x0006ee58\n"
1568             "    cmp     r0, #0xc\n"
1569             "    bne     loc_fc2f334e\n"
1570             "    movs    r6, #0\n"
1571             "    mov     r5, r6\n"
1572             "    b       loc_fc2f3366\n"
1573             "loc_fc2f334e:\n"
1574             "    cmp     r6, #1\n"
1575             "    bne     loc_fc2f3366\n"
1576             "    ldrsh.w r0, [r4, #4]\n"
1577             "    movs    r2, #2\n"
1578             "    ldr     r1, =0xfc2f1e73\n"
1579             "    bl      sub_fc16402a\n"
1580             "    strh    r0, [r4, #4]\n"
1581             "    movs    r0, #0\n"
1582             "    str     r0, [r7, #0x28]\n"
1583             "    b       loc_fc2f336c\n"
1584             "loc_fc2f3366:\n"
1585             "    ldrh.w  r0, [r8]\n"
1586             "    strh    r0, [r4, #4]\n"
1587             "loc_fc2f336c:\n"
1588             "    cmp     r5, #1\n"
1589             "    bne     loc_fc2f337e\n"
1590             "    ldrsh.w r0, [r4, #0xc]\n"
1591             "    movs    r2, #0x20\n"
1592             "    ldr     r1, =0xfc2f1ec7\n"
1593             "    bl      sub_fc2f754c\n"
1594             "    b       loc_fc2f3382\n"
1595             "loc_fc2f337e:\n"
1596             "    ldrh.w  r0, [r8, #8]\n"
1597             "loc_fc2f3382:\n"
1598             "    strh    r0, [r4, #0xc]\n"
1599             "    ldrsh.w r0, [r4, #6]\n"
1600             "    bl      sub_fc470d42_my\n" // Patched
1601             "    ldr     pc, =0xfc2f338d\n" // Continue in firmware
1602     );
1603 }
1604 
1605 //fc470d42
1606 void __attribute__((naked,noinline))
1607 sub_fc470d42_my ()
1608 {
1609     asm volatile (
1610             //capdis -f=chdk -s=0xfc470d43 -c=35 -stubs PRIMARY.BIN 0xfc000000
1611             "    push    {r4, r5, r6, lr}\n"
1612             "    ldr     r5, =0x0000fd5c\n"
1613             "    mov     r4, r0\n"
1614             "    ldr     r0, [r5, #4]\n"
1615             "    cmp     r0, #1\n"
1616             "    beq     loc_fc470d5a\n"
1617             "    movs    r0, #0\n"
1618             "    movw    r2, #0x16b\n"
1619             "    ldr     r1, =0xfc470da4\n" //  *"Shutter.c"
1620             "    blx     sub_fc34d264\n"
1621             "loc_fc470d5a:\n"
1622             "    ldr     r0, =0xfffff400\n"
1623             "    cmp     r4, r0\n"
1624             "    bne     loc_fc470d64\n"
1625             "    ldrsh.w r4, [r5, #2]\n"
1626             "loc_fc470d64:\n"
1627             "    strh    r4, [r5, #2]\n"
1628             "    cmp     r4, r0\n"
1629             "    bne     loc_fc470d76\n"
1630             "    movs    r0, #0\n"
1631             "    movw    r2, #0x171\n"
1632             "    ldr     r1, =0xfc470da4\n" //  *"Shutter.c"
1633             "    blx     sub_fc34d264\n"
1634             "loc_fc470d76:\n"
1635             "    mov     r0, r4\n"
1636             //"    bl      sub_fc25f5ca\n"      // -
1637             "    bl      apex2us\n" // +
1638             "    mov     r4, r0\n"
1639             "    bl      sub_fc198752\n"
1640             "    mov     r0, r4\n"
1641             "    bl      sub_fc19a8f6\n"
1642             "    lsls    r0, r0, #0x1f\n"
1643             "    beq     loc_fc470d9c\n"
1644             "    pop.w   {r4, r5, r6, lr}\n"
1645             "    movs    r0, #0\n"
1646             "    movw    r2, #0x176\n"
1647             "    ldr     r1, =0xfc470da4\n" //  *"Shutter.c"
1648             "    b.w     sub_fc34c718\n" // continue in firmware
1649             "loc_fc470d9c:\n"
1650             "    pop     {r4, r5, r6, pc}\n"
1651     );
1652 }
1653 

/* [<][>][^][v][top][bottom][index][help] */