changeset 393:6c31d8c54ae4

se_k200i: preliminary analysis
author Mychaela Falconia <falcon@freecalypso.org>
date Sun, 06 Nov 2022 01:13:43 +0000
parents 35009c936a4a
children 07000c2d21cd
files se_k200i/README se_k200i/boot-disasm se_k200i/chipset se_k200i/flash-notes se_k200i/tpudrv-notes
diffstat 5 files changed, 2470 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/se_k200i/README	Sun Nov 06 01:13:43 2022 +0000
@@ -0,0 +1,63 @@
+In 2022-10 Vadim Yanitskiy discovered the existence of a previously unknown
+family of Calypso phones: Sony Ericsson K200/K220, usually with 'i' suffix.
+The only diff between K200 and K220 appears to be the FM radio receiver
+(present on K220, unpopulated PCB footprints on K200), whereas the suffix letter
+indicates GSM frequency bands: 'i' for 900+1800 MHz, 'a' for 850+1900 MHz.
+
+As of this writing (early 2022-11) Vadim and steve-m appear to be working on
+adding support for this phone model to their beloved pet OsmocomBB.  In
+contrast, I (Mother Mychaela) currently have no plans to add support for this
+phone model to FreeCalypso fw: it is not an interesting target for the purpose
+of turning it into a liberated end user phone by way of FC fw (for one thing,
+K200a or K220a phones with North American frequency bands appear to be
+unobtainium), and we don't need yet another alien phone running voice
+pseudo-modem firmware.
+
+However, I am gathering some notes about K200/220 hw and original fw in this
+directory, for two reasons:
+
+1) To provide better guidance to Vadim in his quest to support this weird phone
+   model in his beloved pet project;
+
+2) To gather knowledge in case the situation changes and a use case does arise
+   for porting our FreeCalypso fw to this target.
+
+If anyone does fancy the idea of running FreeCalypso fw on these SE K200/220
+phones, even if only as an experiment, the primary pain points will be mostly
+the same as with any other alien phone:
+
+* Like with almost every other alien Calypso device (phone or modem), the FFS
+  maintained by the original fw is not directly suitable as-is for FreeCalypso,
+  i.e., sharing the same FFS between original fw and FC, freely going back and
+  forth in fw with the same FFS, would be a bad idea.  Therefore, we would have
+  to decide whether to put our own FFS (with different content) in the same
+  sectors as the original, perhaps even produced from the original with our FFS
+  editor tool, or to put our aftermarket fw FFS in some other sector location.
+
+* In the case of Pirelli DP-L10 we were lucky to find an area of flash which
+  the original fw leaves unused and untouched in the vast majority of use cases
+  (staging area for OTA fw updates, unused at all other times), thus we could
+  put our separate-from-original FFS instance there.  This separate FFS
+  arrangement is what allows our FC fw on the Pirelli to be run via fc-xram,
+  without flashing.  But we don't have the same luck on K200/220: looking at
+  flash dumps, there does not appear to be any area that is totally unused and
+  could be repurposed for aftermarket fw FFS without disturbing the original fw.
+  Therefore, we won't have the option of non-invasive run-from-RAM operation,
+  and we would have to flash our fw instead, like on Mot C1xx.
+
+* The requirement of having to flash our fw, as opposed to running from RAM,
+  combines badly with the lack of phone UI functionality in voice pseudo-modem
+  fw: a phone that appears completely dead to the user but speaks some special
+  binary protocol on the UART when you press the PWON button feels extremely
+  weird and unnatural.
+
+* Having to flash our fw also means that we would need to either implement
+  battery charging in our fw (requiring thorough reverse eng of charging
+  specifics on this model) or use another phone (running original fw) to charge
+  batteries, moving batteries back and forth between phones.
+
+All of the above factors, which apply to *any* alien (meaning not FC-made) phone
+model, should make it clear why running our fw on alien Calypso phones is no
+longer the direction of interest in FreeCalypso - instead we need to focus on
+our own FreeCalypso hardware with phone handset functionality, starting with
+FC Venus.
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/se_k200i/boot-disasm	Sun Nov 06 01:13:43 2022 +0000
@@ -0,0 +1,2310 @@
+; SE K200i firmware structure includes a very complicated bootloader stage
+; of their own, sitting at the beginning of the boot flash bank and executing
+; from ARM7TDMI reset vector after Calypso boot ROM has provided its
+; interrupt-boot window and moved itself out of the way per the control word
+; at 0x2000.  This custom bootloader stage appears to provide its own UART
+; interrupt-boot mechanism, possibly a replica of either our familiar Calypso
+; boot ROM protocol or perhaps the later Calypso+ secure boot one, and if no
+; serial entry happens, this bootloader stage transfers control to the main
+; fw image at 0x20000 - but not before doing some checks first!  See
+; flash-notes for the description of magic areas, including the IMEI, that are
+; checked before the main part of the fw is allowed to boot.
+
+       0:	ea000492	b	0x1250
+       4:	ea1ffffe	b	0x800004
+       8:	ea1ffffe	b	0x800008
+       c:	ea1ffffe	b	0x80000c
+      10:	ea1ffffe	b	0x800010
+      14:	ea1ffffe	b	0x800014
+      18:	ea1ffffe	b	0x800018
+      1c:	ea1ffffe	b	0x80001c
+
+      20:	eae00492	b	0xff801270
+      24:	e1a00000	mov	r0, r0
+      28:	e1a00000	mov	r0, r0
+      2c:	e1a00000	mov	r0, r0
+      30:	e1a00000	mov	r0, r0
+      34:	e1a00000	mov	r0, r0
+      38:	e1a00000	mov	r0, r0
+      3c:	e1a00000	mov	r0, r0
+
+      40:	b083		sub	sp, #12	; 0xc
+      42:	9101		str	r1, [sp, #4]
+      44:	9000		str	r0, [sp, #0]
+      46:	2000		mov	r0, #0
+      48:	9002		str	r0, [sp, #8]
+      4a:	9802		ldr	r0, [sp, #8]
+      4c:	2808		cmp	r0, #8
+      4e:	da09		bge	0x64
+      50:	9a02		ldr	r2, [sp, #8]
+      52:	9801		ldr	r0, [sp, #4]
+      54:	2100		mov	r1, #0
+      56:	5411		strb	r1, [r2, r0]
+      58:	9802		ldr	r0, [sp, #8]
+      5a:	3001		add	r0, #1
+      5c:	9002		str	r0, [sp, #8]
+      5e:	9802		ldr	r0, [sp, #8]
+      60:	2808		cmp	r0, #8
+      62:	dbf5		blt	0x50
+      64:	2000		mov	r0, #0
+      66:	9002		str	r0, [sp, #8]
+      68:	9802		ldr	r0, [sp, #8]
+      6a:	2810		cmp	r0, #16	; 0x10
+      6c:	db00		blt	0x70
+      6e:	e088		b	0x182
+      70:	9902		ldr	r1, [sp, #8]
+      72:	9800		ldr	r0, [sp, #0]
+      74:	5c08		ldrb	r0, [r1, r0]
+      76:	2830		cmp	r0, #48	; 0x30
+      78:	db26		blt	0xc8
+      7a:	9902		ldr	r1, [sp, #8]
+      7c:	9800		ldr	r0, [sp, #0]
+      7e:	5c08		ldrb	r0, [r1, r0]
+      80:	2839		cmp	r0, #57	; 0x39
+      82:	dc21		bgt	0xc8
+      84:	9802		ldr	r0, [sp, #8]
+      86:	0fc1		lsr	r1, r0, #31
+      88:	1809		add	r1, r1, r0
+      8a:	0849		lsr	r1, r1, #1
+      8c:	0049		lsl	r1, r1, #1
+      8e:	1a40		sub	r0, r0, r1
+      90:	2800		cmp	r0, #0
+      92:	d00d		beq	0xb0
+      94:	9802		ldr	r0, [sp, #8]
+      96:	1e40		sub	r0, r0, #1
+      98:	0fc1		lsr	r1, r0, #31
+      9a:	1808		add	r0, r1, r0
+      9c:	1041		asr	r1, r0, #1
+      9e:	9801		ldr	r0, [sp, #4]
+      a0:	1808		add	r0, r1, r0
+      a2:	9a02		ldr	r2, [sp, #8]
+      a4:	9900		ldr	r1, [sp, #0]
+      a6:	5c51		ldrb	r1, [r2, r1]
+      a8:	7802		ldrb	r2, [r0, #0]
+      aa:	1889		add	r1, r1, r2
+      ac:	3930		sub	r1, #48	; 0x30
+      ae:	e054		b	0x15a
+      b0:	9802		ldr	r0, [sp, #8]
+      b2:	0fc1		lsr	r1, r0, #31
+      b4:	1808		add	r0, r1, r0
+      b6:	1042		asr	r2, r0, #1
+      b8:	9b02		ldr	r3, [sp, #8]
+      ba:	9800		ldr	r0, [sp, #0]
+      bc:	5c18		ldrb	r0, [r3, r0]
+      be:	3830		sub	r0, #48	; 0x30
+      c0:	0100		lsl	r0, r0, #4
+      c2:	9901		ldr	r1, [sp, #4]
+      c4:	5450		strb	r0, [r2, r1]
+      c6:	e055		b	0x174
+      c8:	9902		ldr	r1, [sp, #8]
+      ca:	9800		ldr	r0, [sp, #0]
+      cc:	5c08		ldrb	r0, [r1, r0]
+      ce:	2861		cmp	r0, #97	; 0x61
+      d0:	db24		blt	0x11c
+      d2:	9902		ldr	r1, [sp, #8]
+      d4:	9800		ldr	r0, [sp, #0]
+      d6:	5c08		ldrb	r0, [r1, r0]
+      d8:	287a		cmp	r0, #122	; 0x7a
+      da:	dc1f		bgt	0x11c
+      dc:	9802		ldr	r0, [sp, #8]
+      de:	0fc1		lsr	r1, r0, #31
+      e0:	1809		add	r1, r1, r0
+      e2:	0849		lsr	r1, r1, #1
+      e4:	0049		lsl	r1, r1, #1
+      e6:	1a40		sub	r0, r0, r1
+      e8:	2800		cmp	r0, #0
+      ea:	d00e		beq	0x10a
+      ec:	9802		ldr	r0, [sp, #8]
+      ee:	1e40		sub	r0, r0, #1
+      f0:	0fc1		lsr	r1, r0, #31
+      f2:	1808		add	r0, r1, r0
+      f4:	1040		asr	r0, r0, #1
+      f6:	9901		ldr	r1, [sp, #4]
+      f8:	1841		add	r1, r0, r1
+      fa:	9a02		ldr	r2, [sp, #8]
+      fc:	9800		ldr	r0, [sp, #0]
+      fe:	5c12		ldrb	r2, [r2, r0]
+     100:	7808		ldrb	r0, [r1, #0]
+     102:	1810		add	r0, r2, r0
+     104:	3857		sub	r0, #87	; 0x57
+     106:	7008		strb	r0, [r1, #0]
+     108:	e034		b	0x174
+     10a:	9802		ldr	r0, [sp, #8]
+     10c:	0fc1		lsr	r1, r0, #31
+     10e:	1808		add	r0, r1, r0
+     110:	1042		asr	r2, r0, #1
+     112:	9802		ldr	r0, [sp, #8]
+     114:	9b00		ldr	r3, [sp, #0]
+     116:	5cc0		ldrb	r0, [r0, r3]
+     118:	3857		sub	r0, #87	; 0x57
+     11a:	e7d1		b	0xc0
+     11c:	9802		ldr	r0, [sp, #8]
+     11e:	9900		ldr	r1, [sp, #0]
+     120:	5c40		ldrb	r0, [r0, r1]
+     122:	2841		cmp	r0, #65	; 0x41
+     124:	db26		blt	0x174
+     126:	9802		ldr	r0, [sp, #8]
+     128:	9900		ldr	r1, [sp, #0]
+     12a:	5c40		ldrb	r0, [r0, r1]
+     12c:	285a		cmp	r0, #90	; 0x5a
+     12e:	dc21		bgt	0x174
+     130:	9802		ldr	r0, [sp, #8]
+     132:	0fc1		lsr	r1, r0, #31
+     134:	1809		add	r1, r1, r0
+     136:	0849		lsr	r1, r1, #1
+     138:	0049		lsl	r1, r1, #1
+     13a:	1a40		sub	r0, r0, r1
+     13c:	2800		cmp	r0, #0
+     13e:	d00e		beq	0x15e
+     140:	9802		ldr	r0, [sp, #8]
+     142:	1e40		sub	r0, r0, #1
+     144:	0fc1		lsr	r1, r0, #31
+     146:	1808		add	r0, r1, r0
+     148:	1041		asr	r1, r0, #1
+     14a:	9801		ldr	r0, [sp, #4]
+     14c:	1808		add	r0, r1, r0
+     14e:	9a02		ldr	r2, [sp, #8]
+     150:	9900		ldr	r1, [sp, #0]
+     152:	5c51		ldrb	r1, [r2, r1]
+     154:	7802		ldrb	r2, [r0, #0]
+     156:	1889		add	r1, r1, r2
+     158:	3937		sub	r1, #55	; 0x37
+     15a:	7001		strb	r1, [r0, #0]
+     15c:	e00a		b	0x174
+     15e:	9802		ldr	r0, [sp, #8]
+     160:	0fc1		lsr	r1, r0, #31
+     162:	1808		add	r0, r1, r0
+     164:	1043		asr	r3, r0, #1
+     166:	9a01		ldr	r2, [sp, #4]
+     168:	9902		ldr	r1, [sp, #8]
+     16a:	9800		ldr	r0, [sp, #0]
+     16c:	5c08		ldrb	r0, [r1, r0]
+     16e:	3837		sub	r0, #55	; 0x37
+     170:	0100		lsl	r0, r0, #4
+     172:	5498		strb	r0, [r3, r2]
+     174:	9802		ldr	r0, [sp, #8]
+     176:	3001		add	r0, #1
+     178:	9002		str	r0, [sp, #8]
+     17a:	9802		ldr	r0, [sp, #8]
+     17c:	2810		cmp	r0, #16	; 0x10
+     17e:	da00		bge	0x182
+     180:	e776		b	0x70
+     182:	b003		add	sp, #12	; 0xc
+     184:	4770		bx	lr
+
+     186:	b500		push	{lr}
+     188:	b084		sub	sp, #16	; 0x10
+     18a:	2000		mov	r0, #0
+     18c:	9000		str	r0, [sp, #0]
+     18e:	a0d8		add	r0, pc, #864	; 0x360
+     190:	2101		mov	r1, #1
+     192:	4aea		ldr	r2, =0x1000010	; via 0x53c
+     194:	7812		ldrb	r2, [r2, #0]
+     196:	f000 fef8	bl	0xf8a
+     19a:	9800		ldr	r0, [sp, #0]
+     19c:	2832		cmp	r0, #50	; 0x32
+     19e:	da1a		bge	0x1d6
+     1a0:	a801		add	r0, sp, #4
+     1a2:	49e6		ldr	r1, =0x1000010	; via 0x53c
+     1a4:	7809		ldrb	r1, [r1, #0]
+     1a6:	f000 ff71	bl	0x108c
+     1aa:	4668		mov	r0, sp
+     1ac:	7900		ldrb	r0, [r0, #4]
+     1ae:	2843		cmp	r0, #67	; 0x43
+     1b0:	d10b		bne	0x1ca
+     1b2:	a0d0		add	r0, pc, #832	; 0x340
+     1b4:	a902		add	r1, sp, #8
+     1b6:	f7ff ff43	bl	0x40
+     1ba:	a802		add	r0, sp, #8
+     1bc:	2108		mov	r1, #8
+     1be:	4adf		ldr	r2, =0x1000010	; via 0x53c
+     1c0:	7812		ldrb	r2, [r2, #0]
+     1c2:	f000 fee2	bl	0xf8a
+     1c6:	2001		mov	r0, #1
+     1c8:	e006		b	0x1d8
+     1ca:	9800		ldr	r0, [sp, #0]
+     1cc:	3001		add	r0, #1
+     1ce:	9000		str	r0, [sp, #0]
+     1d0:	9800		ldr	r0, [sp, #0]
+     1d2:	2832		cmp	r0, #50	; 0x32
+     1d4:	dbe4		blt	0x1a0
+     1d6:	2000		mov	r0, #0
+     1d8:	b004		add	sp, #16	; 0x10
+     1da:	bd00		pop	{pc}
+
+     1dc:	49ca		ldr	r1, =0xfffff804	; via 0x508
+     1de:	2001		mov	r0, #1
+     1e0:	03c0		lsl	r0, r0, #15
+     1e2:	8008		strh	r0, [r1, #0]
+     1e4:	49c9		ldr	r1, =0xfffff800	; via 0x50c
+     1e6:	2080		mov	r0, #128	; 0x80
+     1e8:	8008		strh	r0, [r1, #0]
+     1ea:	48c9		ldr	r0, =0xfffff802	; via 0x510
+     1ec:	8800		ldrh	r0, [r0, #0]
+     1ee:	48c8		ldr	r0, =0xfffff802	; via 0x510
+     1f0:	2101		mov	r1, #1
+     1f2:	8001		strh	r1, [r0, #0]
+     1f4:	8800		ldrh	r0, [r0, #0]
+     1f6:	e7fe		b	0x1f6
+
+     1f8:	b081		sub	sp, #4
+     1fa:	4669		mov	r1, sp
+     1fc:	7008		strb	r0, [r1, #0]
+     1fe:	4668		mov	r0, sp
+     200:	7809		ldrb	r1, [r1, #0]
+     202:	0709		lsl	r1, r1, #28
+     204:	0f09		lsr	r1, r1, #28
+     206:	0049		lsl	r1, r1, #1
+     208:	7041		strb	r1, [r0, #1]
+     20a:	7840		ldrb	r0, [r0, #1]
+     20c:	280a		cmp	r0, #10	; 0xa
+     20e:	da01		bge	0x214
+     210:	2000		mov	r0, #0
+     212:	e000		b	0x216
+     214:	2009		mov	r0, #9
+     216:	4669		mov	r1, sp
+     218:	7849		ldrb	r1, [r1, #1]
+     21a:	1a09		sub	r1, r1, r0
+     21c:	4668		mov	r0, sp
+     21e:	7041		strb	r1, [r0, #1]
+     220:	7800		ldrb	r0, [r0, #0]
+     222:	0900		lsr	r0, r0, #4
+     224:	0700		lsl	r0, r0, #28
+     226:	0f01		lsr	r1, r0, #28
+     228:	4668		mov	r0, sp
+     22a:	7840		ldrb	r0, [r0, #1]
+     22c:	1808		add	r0, r1, r0
+     22e:	0600		lsl	r0, r0, #24
+     230:	0e00		lsr	r0, r0, #24
+     232:	b001		add	sp, #4
+     234:	4770		bx	lr
+
+     236:	b500		push	{lr}
+     238:	b081		sub	sp, #4
+     23a:	4669		mov	r1, sp
+     23c:	2000		mov	r0, #0
+     23e:	7008		strb	r0, [r1, #0]
+     240:	2001		mov	r0, #1
+     242:	0400		lsl	r0, r0, #16
+     244:	7800		ldrb	r0, [r0, #0]
+     246:	f7ff ffd7	bl	0x1f8
+     24a:	4669		mov	r1, sp
+     24c:	7809		ldrb	r1, [r1, #0]
+     24e:	1841		add	r1, r0, r1
+     250:	4668		mov	r0, sp
+     252:	7001		strb	r1, [r0, #0]
+     254:	48dd		ldr	r0, =0x10001	; via 0x5cc
+     256:	7800		ldrb	r0, [r0, #0]
+     258:	f7ff ffce	bl	0x1f8
+     25c:	4669		mov	r1, sp
+     25e:	7809		ldrb	r1, [r1, #0]
+     260:	1841		add	r1, r0, r1
+     262:	4668		mov	r0, sp
+     264:	7001		strb	r1, [r0, #0]
+     266:	48da		ldr	r0, =0x10002	; via 0x5d0
+     268:	7800		ldrb	r0, [r0, #0]
+     26a:	f7ff ffc5	bl	0x1f8
+     26e:	4669		mov	r1, sp
+     270:	7809		ldrb	r1, [r1, #0]
+     272:	1841		add	r1, r0, r1
+     274:	4668		mov	r0, sp
+     276:	7001		strb	r1, [r0, #0]
+     278:	48d6		ldr	r0, =0x10003	; via 0x5d4
+     27a:	7800		ldrb	r0, [r0, #0]
+     27c:	f7ff ffbc	bl	0x1f8
+     280:	4669		mov	r1, sp
+     282:	7809		ldrb	r1, [r1, #0]
+     284:	1840		add	r0, r0, r1
+     286:	4669		mov	r1, sp
+     288:	7008		strb	r0, [r1, #0]
+     28a:	48d3		ldr	r0, =0x10004	; via 0x5d8
+     28c:	7800		ldrb	r0, [r0, #0]
+     28e:	f7ff ffb3	bl	0x1f8
+     292:	4669		mov	r1, sp
+     294:	7809		ldrb	r1, [r1, #0]
+     296:	1841		add	r1, r0, r1
+     298:	4668		mov	r0, sp
+     29a:	7001		strb	r1, [r0, #0]
+     29c:	48cf		ldr	r0, =0x10005	; via 0x5dc
+     29e:	7800		ldrb	r0, [r0, #0]
+     2a0:	f7ff ffaa	bl	0x1f8
+     2a4:	4669		mov	r1, sp
+     2a6:	7809		ldrb	r1, [r1, #0]
+     2a8:	1841		add	r1, r0, r1
+     2aa:	4668		mov	r0, sp
+     2ac:	7001		strb	r1, [r0, #0]
+     2ae:	48cc		ldr	r0, =0x10006	; via 0x5e0
+     2b0:	7800		ldrb	r0, [r0, #0]
+     2b2:	f7ff ffa1	bl	0x1f8
+     2b6:	4669		mov	r1, sp
+     2b8:	7809		ldrb	r1, [r1, #0]
+     2ba:	1841		add	r1, r0, r1
+     2bc:	4668		mov	r0, sp
+     2be:	7001		strb	r1, [r0, #0]
+     2c0:	7800		ldrb	r0, [r0, #0]
+     2c2:	210a		mov	r1, #10	; 0xa
+     2c4:	f000 ff1a	bl	0x10fc
+     2c8:	210a		mov	r1, #10	; 0xa
+     2ca:	1a08		sub	r0, r1, r0
+     2cc:	4669		mov	r1, sp
+     2ce:	7048		strb	r0, [r1, #1]
+     2d0:	4668		mov	r0, sp
+     2d2:	7840		ldrb	r0, [r0, #1]
+     2d4:	280a		cmp	r0, #10	; 0xa
+     2d6:	d101		bne	0x2dc
+     2d8:	2000		mov	r0, #0
+     2da:	e001		b	0x2e0
+     2dc:	4668		mov	r0, sp
+     2de:	7840		ldrb	r0, [r0, #1]
+     2e0:	4669		mov	r1, sp
+     2e2:	7048		strb	r0, [r1, #1]
+     2e4:	4668		mov	r0, sp
+     2e6:	7840		ldrb	r0, [r0, #1]
+     2e8:	b001		add	sp, #4
+     2ea:	bd00		pop	{pc}
+
+     2ec:	b500		push	{lr}
+     2ee:	b082		sub	sp, #8
+     2f0:	9000		str	r0, [sp, #0]
+     2f2:	2000		mov	r0, #0
+     2f4:	9001		str	r0, [sp, #4]
+     2f6:	9801		ldr	r0, [sp, #4]
+     2f8:	280e		cmp	r0, #14	; 0xe
+     2fa:	da1f		bge	0x33c
+     2fc:	9801		ldr	r0, [sp, #4]
+     2fe:	0fc1		lsr	r1, r0, #31
+     300:	1808		add	r0, r1, r0
+     302:	1041		asr	r1, r0, #1
+     304:	2001		mov	r0, #1
+     306:	0400		lsl	r0, r0, #16
+     308:	5c40		ldrb	r0, [r0, r1]
+     30a:	0900		lsr	r0, r0, #4
+     30c:	3030		add	r0, #48	; 0x30
+     30e:	9a01		ldr	r2, [sp, #4]
+     310:	9900		ldr	r1, [sp, #0]
+     312:	5450		strb	r0, [r2, r1]
+     314:	9801		ldr	r0, [sp, #4]
+     316:	0fc1		lsr	r1, r0, #31
+     318:	1808		add	r0, r1, r0
+     31a:	1040		asr	r0, r0, #1
+     31c:	2101		mov	r1, #1
+     31e:	0409		lsl	r1, r1, #16
+     320:	5c08		ldrb	r0, [r1, r0]
+     322:	0700		lsl	r0, r0, #28
+     324:	0f00		lsr	r0, r0, #28
+     326:	3030		add	r0, #48	; 0x30
+     328:	9a01		ldr	r2, [sp, #4]
+     32a:	9900		ldr	r1, [sp, #0]
+     32c:	1851		add	r1, r2, r1
+     32e:	7048		strb	r0, [r1, #1]
+     330:	9801		ldr	r0, [sp, #4]
+     332:	3002		add	r0, #2
+     334:	9001		str	r0, [sp, #4]
+     336:	9801		ldr	r0, [sp, #4]
+     338:	280e		cmp	r0, #14	; 0xe
+     33a:	dbdf		blt	0x2fc
+     33c:	f7ff ff7b	bl	0x236
+     340:	3030		add	r0, #48	; 0x30
+     342:	9900		ldr	r1, [sp, #0]
+     344:	7388		strb	r0, [r1, #14]	; 0xe
+     346:	b002		add	sp, #8
+     348:	bd00		pop	{pc}
+
+     34a:	b500		push	{lr}
+     34c:	b08c		sub	sp, #48	; 0x30
+     34e:	4668		mov	r0, sp
+     350:	497a		ldr	r1, =0x1000010	; via 0x53c
+     352:	7809		ldrb	r1, [r1, #0]
+     354:	f000 fe4a	bl	0xfec
+     358:	e0a7		b	0x4aa
+     35a:	a066		add	r0, pc, #408	; 0x198
+     35c:	a901		add	r1, sp, #4
+     35e:	f7ff fe6f	bl	0x40
+     362:	2108		mov	r1, #8
+     364:	e08e		b	0x484
+     366:	a091		add	r0, pc, #580	; 0x244
+     368:	211e		mov	r1, #30	; 0x1e
+     36a:	e099		b	0x4a0
+     36c:	a801		add	r0, sp, #4
+     36e:	f7ff ffbd	bl	0x2ec
+     372:	210f		mov	r1, #15	; 0xf
+     374:	e086		b	0x484
+     376:	489b		ldr	r0, =0x422024	; via 0x5e4
+     378:	9009		str	r0, [sp, #36]	; 0x24
+     37a:	2000		mov	r0, #0
+     37c:	e007		b	0x38e
+     37e:	990a		ldr	r1, [sp, #40]	; 0x28
+     380:	9809		ldr	r0, [sp, #36]	; 0x24
+     382:	5c08		ldrb	r0, [r1, r0]
+     384:	990a		ldr	r1, [sp, #40]	; 0x28
+     386:	aa01		add	r2, sp, #4
+     388:	5450		strb	r0, [r2, r1]
+     38a:	980a		ldr	r0, [sp, #40]	; 0x28
+     38c:	3001		add	r0, #1
+     38e:	900a		str	r0, [sp, #40]	; 0x28
+     390:	990a		ldr	r1, [sp, #40]	; 0x28
+     392:	9809		ldr	r0, [sp, #36]	; 0x24
+     394:	5c08		ldrb	r0, [r1, r0]
+     396:	2800		cmp	r0, #0
+     398:	d002		beq	0x3a0
+     39a:	980a		ldr	r0, [sp, #40]	; 0x28
+     39c:	281a		cmp	r0, #26	; 0x1a
+     39e:	dbee		blt	0x37e
+     3a0:	9a0a		ldr	r2, [sp, #40]	; 0x28
+     3a2:	2020		mov	r0, #32	; 0x20
+     3a4:	a901		add	r1, sp, #4
+     3a6:	5488		strb	r0, [r1, r2]
+     3a8:	488f		ldr	r0, =0x422004	; via 0x5e8
+     3aa:	9009		str	r0, [sp, #36]	; 0x24
+     3ac:	980a		ldr	r0, [sp, #40]	; 0x28
+     3ae:	3001		add	r0, #1
+     3b0:	900b		str	r0, [sp, #44]	; 0x2c
+     3b2:	2000		mov	r0, #0
+     3b4:	900a		str	r0, [sp, #40]	; 0x28
+     3b6:	e00b		b	0x3d0
+     3b8:	990a		ldr	r1, [sp, #40]	; 0x28
+     3ba:	9809		ldr	r0, [sp, #36]	; 0x24
+     3bc:	5c09		ldrb	r1, [r1, r0]
+     3be:	9a0b		ldr	r2, [sp, #44]	; 0x2c
+     3c0:	a801		add	r0, sp, #4
+     3c2:	5481		strb	r1, [r0, r2]
+     3c4:	980a		ldr	r0, [sp, #40]	; 0x28
+     3c6:	3001		add	r0, #1
+     3c8:	900a		str	r0, [sp, #40]	; 0x28
+     3ca:	980b		ldr	r0, [sp, #44]	; 0x2c
+     3cc:	3001		add	r0, #1
+     3ce:	900b		str	r0, [sp, #44]	; 0x2c
+     3d0:	990a		ldr	r1, [sp, #40]	; 0x28
+     3d2:	9809		ldr	r0, [sp, #36]	; 0x24
+     3d4:	5c08		ldrb	r0, [r1, r0]
+     3d6:	2800		cmp	r0, #0
+     3d8:	d002		beq	0x3e0
+     3da:	980b		ldr	r0, [sp, #44]	; 0x2c
+     3dc:	281e		cmp	r0, #30	; 0x1e
+     3de:	dbeb		blt	0x3b8
+     3e0:	980b		ldr	r0, [sp, #44]	; 0x2c
+     3e2:	281e		cmp	r0, #30	; 0x1e
+     3e4:	da4d		bge	0x482
+     3e6:	980b		ldr	r0, [sp, #44]	; 0x2c
+     3e8:	2120		mov	r1, #32	; 0x20
+     3ea:	aa01		add	r2, sp, #4
+     3ec:	5411		strb	r1, [r2, r0]
+     3ee:	980b		ldr	r0, [sp, #44]	; 0x2c
+     3f0:	3001		add	r0, #1
+     3f2:	900b		str	r0, [sp, #44]	; 0x2c
+     3f4:	980b		ldr	r0, [sp, #44]	; 0x2c
+     3f6:	281e		cmp	r0, #30	; 0x1e
+     3f8:	dbf5		blt	0x3e6
+     3fa:	e042		b	0x482
+     3fc:	203b		mov	r0, #59	; 0x3b
+     3fe:	04c0		lsl	r0, r0, #19
+     400:	9009		str	r0, [sp, #36]	; 0x24
+     402:	2000		mov	r0, #0
+     404:	e007		b	0x416
+     406:	990a		ldr	r1, [sp, #40]	; 0x28
+     408:	9809		ldr	r0, [sp, #36]	; 0x24
+     40a:	5c09		ldrb	r1, [r1, r0]
+     40c:	9a0a		ldr	r2, [sp, #40]	; 0x28
+     40e:	a801		add	r0, sp, #4
+     410:	5481		strb	r1, [r0, r2]
+     412:	980a		ldr	r0, [sp, #40]	; 0x28
+     414:	3001		add	r0, #1
+     416:	900a		str	r0, [sp, #40]	; 0x28
+     418:	990a		ldr	r1, [sp, #40]	; 0x28
+     41a:	9809		ldr	r0, [sp, #36]	; 0x24
+     41c:	5c08		ldrb	r0, [r1, r0]
+     41e:	2800		cmp	r0, #0
+     420:	d002		beq	0x428
+     422:	980a		ldr	r0, [sp, #40]	; 0x28
+     424:	281a		cmp	r0, #26	; 0x1a
+     426:	dbee		blt	0x406
+     428:	9a0a		ldr	r2, [sp, #40]	; 0x28
+     42a:	2020		mov	r0, #32	; 0x20
+     42c:	a901		add	r1, sp, #4
+     42e:	5488		strb	r0, [r1, r2]
+     430:	48e2		ldr	r0, =0x1d80020	; via 0x7bc
+     432:	9009		str	r0, [sp, #36]	; 0x24
+     434:	980a		ldr	r0, [sp, #40]	; 0x28
+     436:	3001		add	r0, #1
+     438:	900b		str	r0, [sp, #44]	; 0x2c
+     43a:	2000		mov	r0, #0
+     43c:	900a		str	r0, [sp, #40]	; 0x28
+     43e:	e00b		b	0x458
+     440:	990a		ldr	r1, [sp, #40]	; 0x28
+     442:	9809		ldr	r0, [sp, #36]	; 0x24
+     444:	5c08		ldrb	r0, [r1, r0]
+     446:	990b		ldr	r1, [sp, #44]	; 0x2c
+     448:	aa01		add	r2, sp, #4
+     44a:	5450		strb	r0, [r2, r1]
+     44c:	980a		ldr	r0, [sp, #40]	; 0x28
+     44e:	3001		add	r0, #1
+     450:	900a		str	r0, [sp, #40]	; 0x28
+     452:	980b		ldr	r0, [sp, #44]	; 0x2c
+     454:	3001		add	r0, #1
+     456:	900b		str	r0, [sp, #44]	; 0x2c
+     458:	980a		ldr	r0, [sp, #40]	; 0x28
+     45a:	9909		ldr	r1, [sp, #36]	; 0x24
+     45c:	5c40		ldrb	r0, [r0, r1]
+     45e:	2800		cmp	r0, #0
+     460:	d002		beq	0x468
+     462:	980b		ldr	r0, [sp, #44]	; 0x2c
+     464:	281e		cmp	r0, #30	; 0x1e
+     466:	dbeb		blt	0x440
+     468:	980b		ldr	r0, [sp, #44]	; 0x2c
+     46a:	281e		cmp	r0, #30	; 0x1e
+     46c:	da09		bge	0x482
+     46e:	990b		ldr	r1, [sp, #44]	; 0x2c
+     470:	2020		mov	r0, #32	; 0x20
+     472:	aa01		add	r2, sp, #4
+     474:	5450		strb	r0, [r2, r1]
+     476:	980b		ldr	r0, [sp, #44]	; 0x2c
+     478:	3001		add	r0, #1
+     47a:	900b		str	r0, [sp, #44]	; 0x2c
+     47c:	980b		ldr	r0, [sp, #44]	; 0x2c
+     47e:	281e		cmp	r0, #30	; 0x1e
+     480:	dbf5		blt	0x46e
+     482:	211e		mov	r1, #30	; 0x1e
+     484:	a801		add	r0, sp, #4
+     486:	e00b		b	0x4a0
+     488:	f7ff fea8	bl	0x1dc
+     48c:	e75f		b	0x34e
+     48e:	a0ef		add	r0, pc, #956	; 0x3bc
+     490:	2102		mov	r1, #2
+     492:	4a2a		ldr	r2, =0x1000010	; via 0x53c
+     494:	7812		ldrb	r2, [r2, #0]
+     496:	f000 fd78	bl	0xf8a
+     49a:	e026		b	0x4ea
+     49c:	a0ec		add	r0, pc, #944	; 0x3b0
+     49e:	2102		mov	r1, #2
+     4a0:	4a26		ldr	r2, =0x1000010	; via 0x53c
+     4a2:	7812		ldrb	r2, [r2, #0]
+     4a4:	f000 fd71	bl	0xf8a
+     4a8:	e751		b	0x34e
+     4aa:	4668		mov	r0, sp
+     4ac:	7800		ldrb	r0, [r0, #0]
+     4ae:	2143		mov	r1, #67	; 0x43
+     4b0:	1a40		sub	r0, r0, r1
+     4b2:	2800		cmp	r0, #0
+     4b4:	d100		bne	0x4b8
+     4b6:	e750		b	0x35a
+     4b8:	3801		sub	r0, #1
+     4ba:	2800		cmp	r0, #0
+     4bc:	d09e		beq	0x3fc
+     4be:	3801		sub	r0, #1
+     4c0:	2800		cmp	r0, #0
+     4c2:	d0eb		beq	0x49c
+     4c4:	3802		sub	r0, #2
+     4c6:	2800		cmp	r0, #0
+     4c8:	d0e1		beq	0x48e
+     4ca:	3802		sub	r0, #2
+     4cc:	2800		cmp	r0, #0
+     4ce:	d100		bne	0x4d2
+     4d0:	e74c		b	0x36c
+     4d2:	3804		sub	r0, #4
+     4d4:	2800		cmp	r0, #0
+     4d6:	d100		bne	0x4da
+     4d8:	e745		b	0x366
+     4da:	3804		sub	r0, #4
+     4dc:	2800		cmp	r0, #0
+     4de:	d0d3		beq	0x488
+     4e0:	3807		sub	r0, #7
+     4e2:	2800		cmp	r0, #0
+     4e4:	d100		bne	0x4e8
+     4e6:	e746		b	0x376
+     4e8:	e731		b	0x34e
+     4ea:	b00c		add	sp, #48	; 0x30
+     4ec:	bd00		pop	{pc}
+     4ee:	46c0		nop			(mov r8, r8)
+
+     4f0:	46c00054
+     4f4:	30303239	; ASCIZ "92000101FFFFFFFF"
+     4f8:	31303130
+     4fc:	46464646
+     500:	46464646
+     504:	c046c000
+     508:	fffff804
+     50c:	fffff800
+     510:	fffff802
+
+     514:	b500		push	{lr}
+     516:	b084		sub	sp, #16	; 0x10
+     518:	4668		mov	r0, sp
+     51a:	2109		mov	r1, #9
+     51c:	4a07		ldr	r2, =0x1000010	; via 0x53c
+     51e:	7812		ldrb	r2, [r2, #0]
+     520:	f000 fd7f	bl	0x1022
+     524:	4668		mov	r0, sp
+     526:	7800		ldrb	r0, [r0, #0]
+     528:	2804		cmp	r0, #4
+     52a:	dd09		ble	0x540
+     52c:	a0ea		add	r0, pc, #936	; 0x3a8
+     52e:	2102		mov	r1, #2
+     530:	4a02		ldr	r2, =0x1000010	; via 0x53c
+     532:	7812		ldrb	r2, [r2, #0]
+     534:	f000 fd29	bl	0xf8a
+     538:	e035		b	0x5a6
+     53a:	46c0		nop			(mov r8, r8)
+     53c:	01000010
+     540:	4669		mov	r1, sp
+     542:	2000		mov	r0, #0
+     544:	7308		strb	r0, [r1, #12]	; 0xc
+     546:	4668		mov	r0, sp
+     548:	2104		mov	r1, #4
+     54a:	7341		strb	r1, [r0, #13]	; 0xd
+     54c:	a0e3		add	r0, pc, #908	; 0x38c
+     54e:	2102		mov	r1, #2
+     550:	4af7		ldr	r2, =0x1000010	; via 0x930
+     552:	7812		ldrb	r2, [r2, #0]
+     554:	f000 fd19	bl	0xf8a
+     558:	a803		add	r0, sp, #12	; 0xc
+     55a:	2102		mov	r1, #2
+     55c:	4af4		ldr	r2, =0x1000010	; via 0x930
+     55e:	7812		ldrb	r2, [r2, #0]
+     560:	f000 fd13	bl	0xf8a
+     564:	48f2		ldr	r0, =0x1000010	; via 0x930
+     566:	7800		ldrb	r0, [r0, #0]
+     568:	f000 fcf3	bl	0xf52
+     56c:	49dd		ldr	r1, =0x1304	; via 0x8e4
+     56e:	4668		mov	r0, sp
+     570:	7800		ldrb	r0, [r0, #0]
+     572:	5c09		ldrb	r1, [r1, r0]
+     574:	48da		ldr	r0, =0x1000011	; via 0x8e0
+     576:	7800		ldrb	r0, [r0, #0]
+     578:	4288		cmp	r0, r1
+     57a:	d009		beq	0x590
+     57c:	49d9		ldr	r1, =0x1304	; via 0x8e4
+     57e:	4668		mov	r0, sp
+     580:	7800		ldrb	r0, [r0, #0]
+     582:	5c08		ldrb	r0, [r1, r0]
+     584:	49d6		ldr	r1, =0x1000011	; via 0x8e0
+     586:	7008		strb	r0, [r1, #0]
+     588:	48e9		ldr	r0, =0x1000010	; via 0x930
+     58a:	7800		ldrb	r0, [r0, #0]
+     58c:	f000 fca9	bl	0xee2
+     590:	48f5		ldr	r0, =0x1000000	; via 0x968
+     592:	2100		mov	r1, #0
+     594:	6001		str	r1, [r0, #0]
+     596:	48f5		ldr	r0, =0x100000c	; via 0x96c
+     598:	7001		strb	r1, [r0, #0]
+     59a:	49f5		ldr	r1, =0x1000004	; via 0x970
+     59c:	2000		mov	r0, #0
+     59e:	7008		strb	r0, [r1, #0]
+     5a0:	48f4		ldr	r0, =0x1000008	; via 0x974
+     5a2:	2100		mov	r1, #0
+     5a4:	6001		str	r1, [r0, #0]
+     5a6:	b004		add	sp, #16	; 0x10
+     5a8:	bd00		pop	{pc}
+     5aa:	46c0		nop			(mov r8, r8)
+
+     5ac:	7263694d	; ASCIZ "MicroEROM v1.0                "
+     5b0:	4f52456f
+     5b4:	3176204d
+     5b8:	2020302e
+     5bc:	20202020
+     5c0:	20202020
+     5c4:	20202020
+     5c8:	c0002020
+     5cc:	00010001
+     5d0:	00010002
+     5d4:	00010003
+     5d8:	00010004
+     5dc:	00010005
+     5e0:	00010006
+     5e4:	00422024
+     5e8:	00422004
+
+     5ec:	b500		push	{lr}
+     5ee:	48e4		ldr	r0, =0xfffffbf4	; via 0x980
+     5f0:	4485		add	sp, r0
+     5f2:	4668		mov	r0, sp
+     5f4:	2108		mov	r1, #8
+     5f6:	4ace		ldr	r2, =0x1000010	; via 0x930
+     5f8:	7812		ldrb	r2, [r2, #0]
+     5fa:	f000 fd12	bl	0x1022
+     5fe:	4ade		ldr	r2, =0x402	; via 0x978
+     600:	4669		mov	r1, sp
+     602:	4668		mov	r0, sp
+     604:	78c3		ldrb	r3, [r0, #3]
+     606:	7880		ldrb	r0, [r0, #2]
+     608:	0200		lsl	r0, r0, #8
+     60a:	1818		add	r0, r3, r0
+     60c:	5250		strh	r0, [r2, r1]
+     60e:	2081		mov	r0, #129	; 0x81
+     610:	00c2		lsl	r2, r0, #3
+     612:	4668		mov	r0, sp
+     614:	7940		ldrb	r0, [r0, #5]
+     616:	0403		lsl	r3, r0, #16
+     618:	4668		mov	r0, sp
+     61a:	7900		ldrb	r0, [r0, #4]
+     61c:	0600		lsl	r0, r0, #24
+     61e:	181b		add	r3, r3, r0
+     620:	4668		mov	r0, sp
+     622:	7980		ldrb	r0, [r0, #6]
+     624:	0200		lsl	r0, r0, #8
+     626:	18c3		add	r3, r0, r3
+     628:	4668		mov	r0, sp
+     62a:	79c0		ldrb	r0, [r0, #7]
+     62c:	18c0		add	r0, r0, r3
+     62e:	5050		str	r0, [r2, r1]
+     630:	48cd		ldr	r0, =0x1000000	; via 0x968
+     632:	6800		ldr	r0, [r0, #0]
+     634:	2800		cmp	r0, #0
+     636:	d105		bne	0x644
+     638:	2081		mov	r0, #129	; 0x81
+     63a:	00c1		lsl	r1, r0, #3
+     63c:	4668		mov	r0, sp
+     63e:	5808		ldr	r0, [r1, r0]
+     640:	49c9		ldr	r1, =0x1000000	; via 0x968
+     642:	6008		str	r0, [r1, #0]
+     644:	4668		mov	r0, sp
+     646:	4acc		ldr	r2, =0x402	; via 0x978
+     648:	4669		mov	r1, sp
+     64a:	5a51		ldrh	r1, [r2, r1]
+     64c:	4ab8		ldr	r2, =0x1000010	; via 0x930
+     64e:	7812		ldrb	r2, [r2, #0]
+     650:	f000 fce7	bl	0x1022
+     654:	4ac9		ldr	r2, =0x404	; via 0x97c
+     656:	4669		mov	r1, sp
+     658:	2000		mov	r0, #0
+     65a:	5250		strh	r0, [r2, r1]
+     65c:	49c7		ldr	r1, =0x404	; via 0x97c
+     65e:	4668		mov	r0, sp
+     660:	5a0a		ldrh	r2, [r1, r0]
+     662:	49c5		ldr	r1, =0x402	; via 0x978
+     664:	5a08		ldrh	r0, [r1, r0]
+     666:	4282		cmp	r2, r0
+     668:	da1a		bge	0x6a0
+     66a:	49c4		ldr	r1, =0x404	; via 0x97c
+     66c:	4668		mov	r0, sp
+     66e:	5a0b		ldrh	r3, [r1, r0]
+     670:	2081		mov	r0, #129	; 0x81
+     672:	00c0		lsl	r0, r0, #3
+     674:	4669		mov	r1, sp
+     676:	5841		ldr	r1, [r0, r1]
+     678:	4ac0		ldr	r2, =0x404	; via 0x97c
+     67a:	4668		mov	r0, sp
+     67c:	5a10		ldrh	r0, [r2, r0]
+     67e:	466a		mov	r2, sp
+     680:	5c80		ldrb	r0, [r0, r2]
+     682:	5458		strb	r0, [r3, r1]
+     684:	49bd		ldr	r1, =0x404	; via 0x97c
+     686:	466b		mov	r3, sp
+     688:	4abc		ldr	r2, =0x404	; via 0x97c
+     68a:	4668		mov	r0, sp
+     68c:	5a10		ldrh	r0, [r2, r0]
+     68e:	3001		add	r0, #1
+     690:	52c8		strh	r0, [r1, r3]
+     692:	4668		mov	r0, sp
+     694:	5a08		ldrh	r0, [r1, r0]
+     696:	49b8		ldr	r1, =0x402	; via 0x978
+     698:	466a		mov	r2, sp
+     69a:	5a89		ldrh	r1, [r1, r2]
+     69c:	4288		cmp	r0, r1
+     69e:	dbe4		blt	0x66a
+     6a0:	2001		mov	r0, #1
+     6a2:	0282		lsl	r2, r0, #10
+     6a4:	4669		mov	r1, sp
+     6a6:	2005		mov	r0, #5
+     6a8:	5450		strb	r0, [r2, r1]
+     6aa:	49b3		ldr	r1, =0x402	; via 0x978
+     6ac:	4668		mov	r0, sp
+     6ae:	5a08		ldrh	r0, [r1, r0]
+     6b0:	0600		lsl	r0, r0, #24
+     6b2:	0e02		lsr	r2, r0, #24
+     6b4:	2001		mov	r0, #1
+     6b6:	0280		lsl	r0, r0, #10
+     6b8:	4669		mov	r1, sp
+     6ba:	5c40		ldrb	r0, [r0, r1]
+     6bc:	1810		add	r0, r2, r0
+     6be:	2101		mov	r1, #1
+     6c0:	028a		lsl	r2, r1, #10
+     6c2:	4669		mov	r1, sp
+     6c4:	5450		strb	r0, [r2, r1]
+     6c6:	2081		mov	r0, #129	; 0x81
+     6c8:	00c1		lsl	r1, r0, #3
+     6ca:	4668		mov	r0, sp
+     6cc:	5808		ldr	r0, [r1, r0]
+     6ce:	0e00		lsr	r0, r0, #24
+     6d0:	0600		lsl	r0, r0, #24
+     6d2:	0e02		lsr	r2, r0, #24
+     6d4:	2001		mov	r0, #1
+     6d6:	0281		lsl	r1, r0, #10
+     6d8:	4668		mov	r0, sp
+     6da:	5c08		ldrb	r0, [r1, r0]
+     6dc:	1812		add	r2, r2, r0
+     6de:	2001		mov	r0, #1
+     6e0:	0281		lsl	r1, r0, #10
+     6e2:	4668		mov	r0, sp
+     6e4:	540a		strb	r2, [r1, r0]
+     6e6:	2081		mov	r0, #129	; 0x81
+     6e8:	00c1		lsl	r1, r0, #3
+     6ea:	4668		mov	r0, sp
+     6ec:	5808		ldr	r0, [r1, r0]
+     6ee:	0200		lsl	r0, r0, #8
+     6f0:	0e00		lsr	r0, r0, #24
+     6f2:	0400		lsl	r0, r0, #16
+     6f4:	0c02		lsr	r2, r0, #16
+     6f6:	2001		mov	r0, #1
+     6f8:	0281		lsl	r1, r0, #10
+     6fa:	4668		mov	r0, sp
+     6fc:	5c08		ldrb	r0, [r1, r0]
+     6fe:	1811		add	r1, r2, r0
+     700:	2001		mov	r0, #1
+     702:	0280		lsl	r0, r0, #10
+     704:	466a		mov	r2, sp
+     706:	5481		strb	r1, [r0, r2]
+     708:	2081		mov	r0, #129	; 0x81
+     70a:	00c1		lsl	r1, r0, #3
+     70c:	4668		mov	r0, sp
+     70e:	5808		ldr	r0, [r1, r0]
+     710:	0400		lsl	r0, r0, #16
+     712:	0e00		lsr	r0, r0, #24
+     714:	0200		lsl	r0, r0, #8
+     716:	0a02		lsr	r2, r0, #8
+     718:	2001		mov	r0, #1
+     71a:	0281		lsl	r1, r0, #10
+     71c:	4668		mov	r0, sp
+     71e:	5c08		ldrb	r0, [r1, r0]
+     720:	1812		add	r2, r2, r0
+     722:	2001		mov	r0, #1
+     724:	0281		lsl	r1, r0, #10
+     726:	4668		mov	r0, sp
+     728:	540a		strb	r2, [r1, r0]
+     72a:	2081		mov	r0, #129	; 0x81
+     72c:	00c0		lsl	r0, r0, #3
+     72e:	4669		mov	r1, sp
+     730:	5840		ldr	r0, [r0, r1]
+     732:	0600		lsl	r0, r0, #24
+     734:	0e02		lsr	r2, r0, #24
+     736:	2001		mov	r0, #1
+     738:	0280		lsl	r0, r0, #10
+     73a:	5c40		ldrb	r0, [r0, r1]
+     73c:	1811		add	r1, r2, r0
+     73e:	2001		mov	r0, #1
+     740:	0282		lsl	r2, r0, #10
+     742:	4668		mov	r0, sp
+     744:	5411		strb	r1, [r2, r0]
+     746:	4a8d		ldr	r2, =0x404	; via 0x97c
+     748:	2100		mov	r1, #0
+     74a:	5211		strh	r1, [r2, r0]
+     74c:	488b		ldr	r0, =0x404	; via 0x97c
+     74e:	4669		mov	r1, sp
+     750:	5a40		ldrh	r0, [r0, r1]
+     752:	4a89		ldr	r2, =0x402	; via 0x978
+     754:	5a51		ldrh	r1, [r2, r1]
+     756:	4288		cmp	r0, r1
+     758:	da19		bge	0x78e
+     75a:	4988		ldr	r1, =0x404	; via 0x97c
+     75c:	4668		mov	r0, sp
+     75e:	5a09		ldrh	r1, [r1, r0]
+     760:	5c09		ldrb	r1, [r1, r0]
+     762:	2001		mov	r0, #1
+     764:	0282		lsl	r2, r0, #10
+     766:	4668		mov	r0, sp
+     768:	5c10		ldrb	r0, [r2, r0]
+     76a:	1809		add	r1, r1, r0
+     76c:	2001		mov	r0, #1
+     76e:	0282		lsl	r2, r0, #10
+     770:	4668		mov	r0, sp
+     772:	5411		strb	r1, [r2, r0]
+     774:	4a81		ldr	r2, =0x404	; via 0x97c
+     776:	4669		mov	r1, sp
+     778:	4b80		ldr	r3, =0x404	; via 0x97c
+     77a:	5a18		ldrh	r0, [r3, r0]
+     77c:	3001		add	r0, #1
+     77e:	5250		strh	r0, [r2, r1]
+     780:	487e		ldr	r0, =0x404	; via 0x97c
+     782:	5a40		ldrh	r0, [r0, r1]
+     784:	497c		ldr	r1, =0x402	; via 0x978
+     786:	466a		mov	r2, sp
+     788:	5a89		ldrh	r1, [r1, r2]
+     78a:	4288		cmp	r0, r1
+     78c:	dbe5		blt	0x75a
+     78e:	4878		ldr	r0, =0x1000004	; via 0x970
+     790:	2101		mov	r1, #1
+     792:	028a		lsl	r2, r1, #10
+     794:	4669		mov	r1, sp
+     796:	5c51		ldrb	r1, [r2, r1]
+     798:	43c9		mvn	r1, r1
+     79a:	7802		ldrb	r2, [r0, #0]
+     79c:	1889		add	r1, r1, r2
+     79e:	7001		strb	r1, [r0, #0]
+     7a0:	a09e		add	r0, pc, #632	; 0x278
+     7a2:	2102		mov	r1, #2
+     7a4:	4a62		ldr	r2, =0x1000010	; via 0x930
+     7a6:	7812		ldrb	r2, [r2, #0]
+     7a8:	f000 fbef	bl	0xf8a
+     7ac:	486f		ldr	r0, =0x100000c	; via 0x96c
+     7ae:	2101		mov	r1, #1
+     7b0:	7001		strb	r1, [r0, #0]
+     7b2:	4873		ldr	r0, =0xfffffbf4	; via 0x980
+     7b4:	4240		neg	r0, r0
+     7b6:	4485		add	sp, r0
+     7b8:	bd00		pop	{pc}
+     7ba:	46c0		nop			(mov r8, r8)
+
+     7bc:	01d80020
+
+     7c0:	b500		push	{lr}
+     7c2:	b082		sub	sp, #8
+     7c4:	4869		ldr	r0, =0x100000c	; via 0x96c
+     7c6:	7800		ldrb	r0, [r0, #0]
+     7c8:	2801		cmp	r0, #1
+     7ca:	d00f		beq	0x7ec
+     7cc:	a094		add	r0, pc, #592	; 0x250
+     7ce:	2102		mov	r1, #2
+     7d0:	4a57		ldr	r2, =0x1000010	; via 0x930
+     7d2:	7812		ldrb	r2, [r2, #0]
+     7d4:	f000 fbd9	bl	0xf8a
+     7d8:	4865		ldr	r0, =0x1000004	; via 0x970
+     7da:	2101		mov	r1, #1
+     7dc:	4a54		ldr	r2, =0x1000010	; via 0x930
+     7de:	7812		ldrb	r2, [r2, #0]
+     7e0:	f000 fbd3	bl	0xf8a
+     7e4:	4961		ldr	r1, =0x100000c	; via 0x96c
+     7e6:	2000		mov	r0, #0
+     7e8:	7008		strb	r0, [r1, #0]
+     7ea:	e02d		b	0x848
+     7ec:	4669		mov	r1, sp
+     7ee:	4860		ldr	r0, =0x1000004	; via 0x970
+     7f0:	7800		ldrb	r0, [r0, #0]
+     7f2:	43c0		mvn	r0, r0
+     7f4:	7108		strb	r0, [r1, #4]
+     7f6:	4668		mov	r0, sp
+     7f8:	2101		mov	r1, #1
+     7fa:	4a4d		ldr	r2, =0x1000010	; via 0x930
+     7fc:	7812		ldrb	r2, [r2, #0]
+     7fe:	f000 fc10	bl	0x1022
+     802:	4668		mov	r0, sp
+     804:	7900		ldrb	r0, [r0, #4]
+     806:	4669		mov	r1, sp
+     808:	7809		ldrb	r1, [r1, #0]
+     80a:	4288		cmp	r0, r1
+     80c:	d00d		beq	0x82a
+     80e:	a084		add	r0, pc, #528	; 0x210
+     810:	2102		mov	r1, #2
+     812:	4a47		ldr	r2, =0x1000010	; via 0x930
+     814:	7812		ldrb	r2, [r2, #0]
+     816:	f000 fbb8	bl	0xf8a
+     81a:	4855		ldr	r0, =0x1000004	; via 0x970
+     81c:	2101		mov	r1, #1
+     81e:	4a44		ldr	r2, =0x1000010	; via 0x930
+     820:	7812		ldrb	r2, [r2, #0]
+     822:	f000 fbb2	bl	0xf8a
+     826:	2100		mov	r1, #0
+     828:	e00c		b	0x844
+     82a:	a07e		add	r0, pc, #504	; 0x1f8
+     82c:	2102		mov	r1, #2
+     82e:	4a40		ldr	r2, =0x1000010	; via 0x930
+     830:	7812		ldrb	r2, [r2, #0]
+     832:	f000 fbaa	bl	0xf8a
+     836:	484e		ldr	r0, =0x1000004	; via 0x970
+     838:	2101		mov	r1, #1
+     83a:	4a3d		ldr	r2, =0x1000010	; via 0x930
+     83c:	7812		ldrb	r2, [r2, #0]
+     83e:	f000 fba4	bl	0xf8a
+     842:	2102		mov	r1, #2
+     844:	4849		ldr	r0, =0x100000c	; via 0x96c
+     846:	7001		strb	r1, [r0, #0]
+     848:	b002		add	sp, #8
+     84a:	bd00		pop	{pc}
+
+     84c:	c000473e
+     850:	00003030
+
+     854:	b510		push	{r4, lr}
+     856:	b082		sub	sp, #8
+     858:	4844		ldr	r0, =0x100000c	; via 0x96c
+     85a:	7800		ldrb	r0, [r0, #0]
+     85c:	2802		cmp	r0, #2
+     85e:	d009		beq	0x874
+     860:	a071		add	r0, pc, #452	; 0x1c4
+     862:	2102		mov	r1, #2
+     864:	4a32		ldr	r2, =0x1000010	; via 0x930
+     866:	7812		ldrb	r2, [r2, #0]
+     868:	f000 fb8f	bl	0xf8a
+     86c:	493f		ldr	r1, =0x100000c	; via 0x96c
+     86e:	2000		mov	r0, #0
+     870:	7008		strb	r0, [r1, #0]
+     872:	e02e		b	0x8d2
+     874:	4668		mov	r0, sp
+     876:	2104		mov	r1, #4
+     878:	4a2d		ldr	r2, =0x1000010	; via 0x930
+     87a:	7812		ldrb	r2, [r2, #0]
+     87c:	f000 fbd1	bl	0x1022
+     880:	4668		mov	r0, sp
+     882:	7840		ldrb	r0, [r0, #1]
+     884:	0401		lsl	r1, r0, #16
+     886:	4668		mov	r0, sp
+     888:	7800		ldrb	r0, [r0, #0]
+     88a:	0600		lsl	r0, r0, #24
+     88c:	1808		add	r0, r1, r0
+     88e:	4669		mov	r1, sp
+     890:	7889		ldrb	r1, [r1, #2]
+     892:	0209		lsl	r1, r1, #8
+     894:	1809		add	r1, r1, r0
+     896:	4668		mov	r0, sp
+     898:	78c0		ldrb	r0, [r0, #3]
+     89a:	1841		add	r1, r0, r1
+     89c:	4835		ldr	r0, =0x1000008	; via 0x974
+     89e:	6001		str	r1, [r0, #0]
+     8a0:	4834		ldr	r0, =0x1000008	; via 0x974
+     8a2:	6801		ldr	r1, [r0, #0]
+     8a4:	4830		ldr	r0, =0x1000000	; via 0x968
+     8a6:	6800		ldr	r0, [r0, #0]
+     8a8:	4281		cmp	r1, r0
+     8aa:	d006		beq	0x8ba
+     8ac:	a05f		add	r0, pc, #380	; 0x17c
+     8ae:	2102		mov	r1, #2
+     8b0:	4a1f		ldr	r2, =0x1000010	; via 0x930
+     8b2:	7812		ldrb	r2, [r2, #0]
+     8b4:	f000 fb69	bl	0xf8a
+     8b8:	e00b		b	0x8d2
+     8ba:	a05b		add	r0, pc, #364	; 0x16c
+     8bc:	2102		mov	r1, #2
+     8be:	4a1c		ldr	r2, =0x1000010	; via 0x930
+     8c0:	7812		ldrb	r2, [r2, #0]
+     8c2:	f000 fb62	bl	0xf8a
+     8c6:	482b		ldr	r0, =0x1000008	; via 0x974
+     8c8:	6800		ldr	r0, [r0, #0]
+     8ca:	9001		str	r0, [sp, #4]
+     8cc:	9c01		ldr	r4, [sp, #4]
+     8ce:	f000 fd0b	bl	0x12e8
+     8d2:	b002		add	sp, #8
+     8d4:	bd10		pop	{r4, pc}
+     8d6:	46c0		nop			(mov r8, r8)
+
+     8d8:	c000503e
+     8dc:	c000703e
+     8e0:	01000011
+     8e4:	00001304
+
+     8e8:	b500		push	{lr}
+     8ea:	b081		sub	sp, #4
+     8ec:	491e		ldr	r1, =0x1000000	; via 0x968
+     8ee:	2000		mov	r0, #0
+     8f0:	6008		str	r0, [r1, #0]
+     8f2:	2100		mov	r1, #0
+     8f4:	481d		ldr	r0, =0x100000c	; via 0x96c
+     8f6:	7001		strb	r1, [r0, #0]
+     8f8:	481d		ldr	r0, =0x1000004	; via 0x970
+     8fa:	7001		strb	r1, [r0, #0]
+     8fc:	481d		ldr	r0, =0x1000008	; via 0x974
+     8fe:	6001		str	r1, [r0, #0]
+     900:	4668		mov	r0, sp
+     902:	490b		ldr	r1, =0x1000010	; via 0x930
+     904:	7809		ldrb	r1, [r1, #0]
+     906:	f000 fb71	bl	0xfec
+     90a:	4668		mov	r0, sp
+     90c:	7800		ldrb	r0, [r0, #0]
+     90e:	283c		cmp	r0, #60	; 0x3c
+     910:	d1f6		bne	0x900
+     912:	4668		mov	r0, sp
+     914:	4946		ldr	r1, =0x1000010	; via 0xa30
+     916:	7809		ldrb	r1, [r1, #0]
+     918:	f000 fb68	bl	0xfec
+     91c:	e011		b	0x942
+     91e:	f7ff fdf9	bl	0x514
+     922:	e7ed		b	0x900
+     924:	f7ff fe62	bl	0x5ec
+     928:	e7ea		b	0x900
+     92a:	f7ff ff49	bl	0x7c0
+     92e:	e7e7		b	0x900
+     930:	01000010
+     934:	f7ff ff8e	bl	0x854
+     938:	e7e2		b	0x900
+     93a:	480b		ldr	r0, =0x1000000	; via 0x968
+     93c:	2100		mov	r1, #0
+     93e:	6001		str	r1, [r0, #0]
+     940:	e7d8		b	0x8f4
+     942:	4668		mov	r0, sp
+     944:	7801		ldrb	r1, [r0, #0]
+     946:	2061		mov	r0, #97	; 0x61
+     948:	1a08		sub	r0, r1, r0
+     94a:	2800		cmp	r0, #0
+     94c:	d0f5		beq	0x93a
+     94e:	3801		sub	r0, #1
+     950:	2800		cmp	r0, #0
+     952:	d0ef		beq	0x934
+     954:	3801		sub	r0, #1
+     956:	2800		cmp	r0, #0
+     958:	d0e7		beq	0x92a
+     95a:	380d		sub	r0, #13	; 0xd
+     95c:	2800		cmp	r0, #0
+     95e:	d0de		beq	0x91e
+     960:	3807		sub	r0, #7
+     962:	2800		cmp	r0, #0
+     964:	d0de		beq	0x924
+     966:	e7e8		b	0x93a
+
+     968:	01000000
+     96c:	0100000c
+     970:	01000004
+     974:	01000008
+     978:	00000402
+     97c:	00000404
+     980:	fffffbf4
+
+     984:	b510		push	{r4, lr}
+     986:	b086		sub	sp, #24	; 0x18
+     988:	482a		ldr	r0, =0x1ff02c8	; via 0xa34
+     98a:	9005		str	r0, [sp, #20]	; 0x14
+     98c:	2001		mov	r0, #1
+     98e:	0400		lsl	r0, r0, #16
+     990:	4929		ldr	r1, =0x1ff0000	; via 0xa38
+     992:	aa01		add	r2, sp, #4
+     994:	2359		mov	r3, #89	; 0x59
+     996:	00db		lsl	r3, r3, #3
+     998:	f000 f9ca	bl	0xd30
+     99c:	a801		add	r0, sp, #4
+     99e:	4927		ldr	r1, =0x10008	; via 0xa3c
+     9a0:	aa03		add	r2, sp, #12	; 0xc
+     9a2:	2340		mov	r3, #64	; 0x40
+     9a4:	f000 f9c4	bl	0xd30
+     9a8:	4668		mov	r0, sp
+     9aa:	7b01		ldrb	r1, [r0, #12]	; 0xc
+     9ac:	9805		ldr	r0, [sp, #20]	; 0x14
+     9ae:	7800		ldrb	r0, [r0, #0]
+     9b0:	4281		cmp	r1, r0
+     9b2:	d130		bne	0xa16
+     9b4:	4668		mov	r0, sp
+     9b6:	7b41		ldrb	r1, [r0, #13]	; 0xd
+     9b8:	9805		ldr	r0, [sp, #20]	; 0x14
+     9ba:	7840		ldrb	r0, [r0, #1]
+     9bc:	4281		cmp	r1, r0
+     9be:	d12a		bne	0xa16
+     9c0:	4668		mov	r0, sp
+     9c2:	7b81		ldrb	r1, [r0, #14]	; 0xe
+     9c4:	9805		ldr	r0, [sp, #20]	; 0x14
+     9c6:	7880		ldrb	r0, [r0, #2]
+     9c8:	4281		cmp	r1, r0
+     9ca:	d124		bne	0xa16
+     9cc:	4668		mov	r0, sp
+     9ce:	7bc1		ldrb	r1, [r0, #15]	; 0xf
+     9d0:	9805		ldr	r0, [sp, #20]	; 0x14
+     9d2:	78c0		ldrb	r0, [r0, #3]
+     9d4:	4281		cmp	r1, r0
+     9d6:	d11e		bne	0xa16
+     9d8:	4668		mov	r0, sp
+     9da:	7c00		ldrb	r0, [r0, #16]	; 0x10
+     9dc:	9905		ldr	r1, [sp, #20]	; 0x14
+     9de:	7909		ldrb	r1, [r1, #4]
+     9e0:	4288		cmp	r0, r1
+     9e2:	d118		bne	0xa16
+     9e4:	4668		mov	r0, sp
+     9e6:	7c41		ldrb	r1, [r0, #17]	; 0x11
+     9e8:	9805		ldr	r0, [sp, #20]	; 0x14
+     9ea:	7940		ldrb	r0, [r0, #5]
+     9ec:	4281		cmp	r1, r0
+     9ee:	d112		bne	0xa16
+     9f0:	4668		mov	r0, sp
+     9f2:	7c81		ldrb	r1, [r0, #18]	; 0x12
+     9f4:	9805		ldr	r0, [sp, #20]	; 0x14
+     9f6:	7980		ldrb	r0, [r0, #6]
+     9f8:	4281		cmp	r1, r0
+     9fa:	d10c		bne	0xa16
+     9fc:	4668		mov	r0, sp
+     9fe:	7cc0		ldrb	r0, [r0, #19]	; 0x13
+     a00:	9905		ldr	r1, [sp, #20]	; 0x14
+     a02:	79c9		ldrb	r1, [r1, #7]
+     a04:	4288		cmp	r0, r1
+     a06:	d106		bne	0xa16
+     a08:	2001		mov	r0, #1
+     a0a:	0440		lsl	r0, r0, #17
+     a0c:	9000		str	r0, [sp, #0]
+     a0e:	9c00		ldr	r4, [sp, #0]
+     a10:	f000 fc6a	bl	0x12e8
+     a14:	e000		b	0xa18
+     a16:	e7fe		b	0xa16
+     a18:	b006		add	sp, #24	; 0x18
+     a1a:	bd10		pop	{r4, pc}
+
+     a1c:	c000773e
+     a20:	c000433e
+     a24:	c000633e
+     a28:	c000623e
+     a2c:	c000423e
+     a30:	01000010
+     a34:	01ff02c8
+     a38:	01ff0000
+     a3c:	00010008
+
+     a40:	b082		sub	sp, #8
+     a42:	9101		str	r1, [sp, #4]
+     a44:	9000		str	r0, [sp, #0]
+     a46:	9901		ldr	r1, [sp, #4]
+     a48:	10c8		asr	r0, r1, #3
+     a4a:	0f00		lsr	r0, r0, #28
+     a4c:	1840		add	r0, r0, r1
+     a4e:	220f		mov	r2, #15	; 0xf
+     a50:	4390		bic	r0, r2
+     a52:	1a08		sub	r0, r1, r0
+     a54:	9001		str	r0, [sp, #4]
+     a56:	2110		mov	r1, #16	; 0x10
+     a58:	9801		ldr	r0, [sp, #4]
+     a5a:	1a08		sub	r0, r1, r0
+     a5c:	2100		mov	r1, #0
+     a5e:	43c9		mvn	r1, r1
+     a60:	4081		lsl	r1, r0
+     a62:	9800		ldr	r0, [sp, #0]
+     a64:	2200		mov	r2, #0
+     a66:	5e80		ldrsh	r0, [r0, r2]
+     a68:	4008		and	r0, r1
+     a6a:	0400		lsl	r0, r0, #16
+     a6c:	0c00		lsr	r0, r0, #16
+     a6e:	2110		mov	r1, #16	; 0x10
+     a70:	9a01		ldr	r2, [sp, #4]
+     a72:	1a89		sub	r1, r1, r2
+     a74:	40c8		lsr	r0, r1
+     a76:	9900		ldr	r1, [sp, #0]
+     a78:	2200		mov	r2, #0
+     a7a:	5e89		ldrsh	r1, [r1, r2]
+     a7c:	9a01		ldr	r2, [sp, #4]
+     a7e:	4091		lsl	r1, r2
+     a80:	4308		orr	r0, r1
+     a82:	9900		ldr	r1, [sp, #0]
+     a84:	8008		strh	r0, [r1, #0]
+     a86:	b002		add	sp, #8
+     a88:	4770		bx	lr
+
+     a8a:	b500		push	{lr}
+     a8c:	b08e		sub	sp, #56	; 0x38
+     a8e:	9000		str	r0, [sp, #0]
+     a90:	48d7		ldr	r0, =0x72d42a70	; via 0xdf0
+     a92:	9001		str	r0, [sp, #4]
+     a94:	48d7		ldr	r0, =0x9836f25a	; via 0xdf4
+     a96:	9002		str	r0, [sp, #8]
+     a98:	9800		ldr	r0, [sp, #0]
+     a9a:	7840		ldrb	r0, [r0, #1]
+     a9c:	0400		lsl	r0, r0, #16
+     a9e:	0200		lsl	r0, r0, #8
+     aa0:	0e00		lsr	r0, r0, #24
+     aa2:	0402		lsl	r2, r0, #16
+     aa4:	9800		ldr	r0, [sp, #0]
+     aa6:	7800		ldrb	r0, [r0, #0]
+     aa8:	0600		lsl	r0, r0, #24
+     aaa:	0e00		lsr	r0, r0, #24
+     aac:	0600		lsl	r0, r0, #24
+     aae:	4302		orr	r2, r0
+     ab0:	9800		ldr	r0, [sp, #0]
+     ab2:	7880		ldrb	r0, [r0, #2]
+     ab4:	0200		lsl	r0, r0, #8
+     ab6:	0400		lsl	r0, r0, #16
+     ab8:	0e00		lsr	r0, r0, #24
+     aba:	0201		lsl	r1, r0, #8
+     abc:	4311		orr	r1, r2
+     abe:	9800		ldr	r0, [sp, #0]
+     ac0:	78c0		ldrb	r0, [r0, #3]
+     ac2:	0600		lsl	r0, r0, #24
+     ac4:	0e00		lsr	r0, r0, #24
+     ac6:	4308		orr	r0, r1
+     ac8:	9003		str	r0, [sp, #12]	; 0xc
+     aca:	9800		ldr	r0, [sp, #0]
+     acc:	7940		ldrb	r0, [r0, #5]
+     ace:	0400		lsl	r0, r0, #16
+     ad0:	0200		lsl	r0, r0, #8
+     ad2:	0e00		lsr	r0, r0, #24
+     ad4:	0402		lsl	r2, r0, #16
+     ad6:	9800		ldr	r0, [sp, #0]
+     ad8:	7900		ldrb	r0, [r0, #4]
+     ada:	0600		lsl	r0, r0, #24
+     adc:	0e00		lsr	r0, r0, #24
+     ade:	0600		lsl	r0, r0, #24
+     ae0:	4302		orr	r2, r0
+     ae2:	9800		ldr	r0, [sp, #0]
+     ae4:	7980		ldrb	r0, [r0, #6]
+     ae6:	0200		lsl	r0, r0, #8
+     ae8:	0400		lsl	r0, r0, #16
+     aea:	0e00		lsr	r0, r0, #24
+     aec:	0201		lsl	r1, r0, #8
+     aee:	4311		orr	r1, r2
+     af0:	9800		ldr	r0, [sp, #0]
+     af2:	79c0		ldrb	r0, [r0, #7]
+     af4:	0600		lsl	r0, r0, #24
+     af6:	0e00		lsr	r0, r0, #24
+     af8:	4308		orr	r0, r1
+     afa:	9004		str	r0, [sp, #16]	; 0x10
+     afc:	9801		ldr	r0, [sp, #4]
+     afe:	9903		ldr	r1, [sp, #12]	; 0xc
+     b00:	4048		eor	r0, r1
+     b02:	9003		str	r0, [sp, #12]	; 0xc
+     b04:	9802		ldr	r0, [sp, #8]
+     b06:	9904		ldr	r1, [sp, #16]	; 0x10
+     b08:	4048		eor	r0, r1
+     b0a:	9004		str	r0, [sp, #16]	; 0x10
+     b0c:	9803		ldr	r0, [sp, #12]	; 0xc
+     b0e:	1700		asr	r0, r0, #28
+     b10:	0700		lsl	r0, r0, #28
+     b12:	0f00		lsr	r0, r0, #28
+     b14:	3004		add	r0, #4
+     b16:	9005		str	r0, [sp, #20]	; 0x14
+     b18:	2000		mov	r0, #0
+     b1a:	9007		str	r0, [sp, #28]	; 0x1c
+     b1c:	9907		ldr	r1, [sp, #28]	; 0x1c
+     b1e:	9805		ldr	r0, [sp, #20]	; 0x14
+     b20:	4281		cmp	r1, r0
+     b22:	db00		blt	0xb26
+     b24:	e086		b	0xc34
+     b26:	4669		mov	r1, sp
+     b28:	9803		ldr	r0, [sp, #12]	; 0xc
+     b2a:	0400		lsl	r0, r0, #16
+     b2c:	0c00		lsr	r0, r0, #16
+     b2e:	8608		strh	r0, [r1, #48]	; 0x30
+     b30:	4668		mov	r0, sp
+     b32:	9904		ldr	r1, [sp, #16]	; 0x10
+     b34:	1409		asr	r1, r1, #16
+     b36:	0409		lsl	r1, r1, #16
+     b38:	0c09		lsr	r1, r1, #16
+     b3a:	8641		strh	r1, [r0, #50]	; 0x32
+     b3c:	4669		mov	r1, sp
+     b3e:	9804		ldr	r0, [sp, #16]	; 0x10
+     b40:	0400		lsl	r0, r0, #16
+     b42:	0c00		lsr	r0, r0, #16
+     b44:	8688		strh	r0, [r1, #52]	; 0x34
+     b46:	9803		ldr	r0, [sp, #12]	; 0xc
+     b48:	1400		asr	r0, r0, #16
+     b4a:	0400		lsl	r0, r0, #16
+     b4c:	0c00		lsr	r0, r0, #16
+     b4e:	9008		str	r0, [sp, #32]	; 0x20
+     b50:	9803		ldr	r0, [sp, #12]	; 0xc
+     b52:	0600		lsl	r0, r0, #24
+     b54:	0e00		lsr	r0, r0, #24
+     b56:	9009		str	r0, [sp, #36]	; 0x24
+     b58:	9804		ldr	r0, [sp, #16]	; 0x10
+     b5a:	1400		asr	r0, r0, #16
+     b5c:	0600		lsl	r0, r0, #24
+     b5e:	0e00		lsr	r0, r0, #24
+     b60:	900a		str	r0, [sp, #40]	; 0x28
+     b62:	9804		ldr	r0, [sp, #16]	; 0x10
+     b64:	0600		lsl	r0, r0, #24
+     b66:	0e00		lsr	r0, r0, #24
+     b68:	900b		str	r0, [sp, #44]	; 0x2c
+     b6a:	9809		ldr	r0, [sp, #36]	; 0x24
+     b6c:	2800		cmp	r0, #0
+     b6e:	d004		beq	0xb7a
+     b70:	9808		ldr	r0, [sp, #32]	; 0x20
+     b72:	9909		ldr	r1, [sp, #36]	; 0x24
+     b74:	f000 fac2	bl	0x10fc
+     b78:	e000		b	0xb7c
+     b7a:	2000		mov	r0, #0
+     b7c:	9009		str	r0, [sp, #36]	; 0x24
+     b7e:	980a		ldr	r0, [sp, #40]	; 0x28
+     b80:	2800		cmp	r0, #0
+     b82:	d004		beq	0xb8e
+     b84:	9808		ldr	r0, [sp, #32]	; 0x20
+     b86:	990a		ldr	r1, [sp, #40]	; 0x28
+     b88:	f000 fab8	bl	0x10fc
+     b8c:	e000		b	0xb90
+     b8e:	2000		mov	r0, #0
+     b90:	900a		str	r0, [sp, #40]	; 0x28
+     b92:	980b		ldr	r0, [sp, #44]	; 0x2c
+     b94:	2800		cmp	r0, #0
+     b96:	d004		beq	0xba2
+     b98:	9808		ldr	r0, [sp, #32]	; 0x20
+     b9a:	990b		ldr	r1, [sp, #44]	; 0x2c
+     b9c:	f000 faae	bl	0x10fc
+     ba0:	e000		b	0xba4
+     ba2:	2000		mov	r0, #0
+     ba4:	900b		str	r0, [sp, #44]	; 0x2c
+     ba6:	a80c		add	r0, sp, #48	; 0x30
+     ba8:	9909		ldr	r1, [sp, #36]	; 0x24
+     baa:	f7ff ff49	bl	0xa40
+     bae:	2032		mov	r0, #50	; 0x32
+     bb0:	4468		add	r0, sp
+     bb2:	990a		ldr	r1, [sp, #40]	; 0x28
+     bb4:	f7ff ff44	bl	0xa40
+     bb8:	a80d		add	r0, sp, #52	; 0x34
+     bba:	990b		ldr	r1, [sp, #44]	; 0x2c
+     bbc:	f7ff ff40	bl	0xa40
+     bc0:	980c		ldr	r0, [sp, #48]	; 0x30
+     bc2:	1400		asr	r0, r0, #16
+     bc4:	0400		lsl	r0, r0, #16
+     bc6:	1400		asr	r0, r0, #16
+     bc8:	990c		ldr	r1, [sp, #48]	; 0x30
+     bca:	0409		lsl	r1, r1, #16
+     bcc:	1409		asr	r1, r1, #16
+     bce:	0409		lsl	r1, r1, #16
+     bd0:	1409		asr	r1, r1, #16
+     bd2:	4048		eor	r0, r1
+     bd4:	4669		mov	r1, sp
+     bd6:	8608		strh	r0, [r1, #48]	; 0x30
+     bd8:	980d		ldr	r0, [sp, #52]	; 0x34
+     bda:	0400		lsl	r0, r0, #16
+     bdc:	1400		asr	r0, r0, #16
+     bde:	0400		lsl	r0, r0, #16
+     be0:	1400		asr	r0, r0, #16
+     be2:	990c		ldr	r1, [sp, #48]	; 0x30
+     be4:	0409		lsl	r1, r1, #16
+     be6:	1409		asr	r1, r1, #16
+     be8:	0409		lsl	r1, r1, #16
+     bea:	1409		asr	r1, r1, #16
+     bec:	4048		eor	r0, r1
+     bee:	4669		mov	r1, sp
+     bf0:	8608		strh	r0, [r1, #48]	; 0x30
+     bf2:	9803		ldr	r0, [sp, #12]	; 0xc
+     bf4:	9006		str	r0, [sp, #24]	; 0x18
+     bf6:	980c		ldr	r0, [sp, #48]	; 0x30
+     bf8:	0400		lsl	r0, r0, #16
+     bfa:	1400		asr	r0, r0, #16
+     bfc:	0400		lsl	r0, r0, #16
+     bfe:	1400		asr	r0, r0, #16
+     c00:	0400		lsl	r0, r0, #16
+     c02:	0c00		lsr	r0, r0, #16
+     c04:	9904		ldr	r1, [sp, #16]	; 0x10
+     c06:	0409		lsl	r1, r1, #16
+     c08:	0c09		lsr	r1, r1, #16
+     c0a:	0409		lsl	r1, r1, #16
+     c0c:	4308		orr	r0, r1
+     c0e:	9003		str	r0, [sp, #12]	; 0xc
+     c10:	9804		ldr	r0, [sp, #16]	; 0x10
+     c12:	0c00		lsr	r0, r0, #16
+     c14:	0400		lsl	r0, r0, #16
+     c16:	0c00		lsr	r0, r0, #16
+     c18:	9906		ldr	r1, [sp, #24]	; 0x18
+     c1a:	0409		lsl	r1, r1, #16
+     c1c:	0c09		lsr	r1, r1, #16
+     c1e:	0409		lsl	r1, r1, #16
+     c20:	4308		orr	r0, r1
+     c22:	9004		str	r0, [sp, #16]	; 0x10
+     c24:	9807		ldr	r0, [sp, #28]	; 0x1c
+     c26:	3001		add	r0, #1
+     c28:	9007		str	r0, [sp, #28]	; 0x1c
+     c2a:	9807		ldr	r0, [sp, #28]	; 0x1c
+     c2c:	9905		ldr	r1, [sp, #20]	; 0x14
+     c2e:	4288		cmp	r0, r1
+     c30:	da00		bge	0xc34
+     c32:	e778		b	0xb26
+     c34:	2000		mov	r0, #0
+     c36:	9007		str	r0, [sp, #28]	; 0x1c
+     c38:	9807		ldr	r0, [sp, #28]	; 0x1c
+     c3a:	2804		cmp	r0, #4
+     c3c:	da10		bge	0xc60
+     c3e:	9b07		ldr	r3, [sp, #28]	; 0x1c
+     c40:	9a00		ldr	r2, [sp, #0]
+     c42:	2103		mov	r1, #3
+     c44:	9807		ldr	r0, [sp, #28]	; 0x1c
+     c46:	1a08		sub	r0, r1, r0
+     c48:	00c1		lsl	r1, r0, #3
+     c4a:	9803		ldr	r0, [sp, #12]	; 0xc
+     c4c:	4108		asr	r0, r1
+     c4e:	0600		lsl	r0, r0, #24
+     c50:	0e00		lsr	r0, r0, #24
+     c52:	5498		strb	r0, [r3, r2]
+     c54:	9807		ldr	r0, [sp, #28]	; 0x1c
+     c56:	3001		add	r0, #1
+     c58:	9007		str	r0, [sp, #28]	; 0x1c
+     c5a:	9807		ldr	r0, [sp, #28]	; 0x1c
+     c5c:	2804		cmp	r0, #4
+     c5e:	dbee		blt	0xc3e
+     c60:	2004		mov	r0, #4
+     c62:	9007		str	r0, [sp, #28]	; 0x1c
+     c64:	9807		ldr	r0, [sp, #28]	; 0x1c
+     c66:	2808		cmp	r0, #8
+     c68:	da10		bge	0xc8c
+     c6a:	9907		ldr	r1, [sp, #28]	; 0x1c
+     c6c:	9b00		ldr	r3, [sp, #0]
+     c6e:	2207		mov	r2, #7
+     c70:	9807		ldr	r0, [sp, #28]	; 0x1c
+     c72:	1a10		sub	r0, r2, r0
+     c74:	00c0		lsl	r0, r0, #3
+     c76:	9a04		ldr	r2, [sp, #16]	; 0x10
+     c78:	4102		asr	r2, r0
+     c7a:	0610		lsl	r0, r2, #24
+     c7c:	0e00		lsr	r0, r0, #24
+     c7e:	54c8		strb	r0, [r1, r3]
+     c80:	9807		ldr	r0, [sp, #28]	; 0x1c
+     c82:	3001		add	r0, #1
+     c84:	9007		str	r0, [sp, #28]	; 0x1c
+     c86:	9807		ldr	r0, [sp, #28]	; 0x1c
+     c88:	2808		cmp	r0, #8
+     c8a:	dbee		blt	0xc6a
+     c8c:	b00e		add	sp, #56	; 0x38
+     c8e:	bd00		pop	{pc}
+
+     c90:	b500		push	{lr}
+     c92:	b083		sub	sp, #12	; 0xc
+     c94:	9101		str	r1, [sp, #4]
+     c96:	9000		str	r0, [sp, #0]
+     c98:	4669		mov	r1, sp
+     c9a:	2000		mov	r0, #0
+     c9c:	7208		strb	r0, [r1, #8]
+     c9e:	4668		mov	r0, sp
+     ca0:	7a00		ldrb	r0, [r0, #8]
+     ca2:	2810		cmp	r0, #16	; 0x10
+     ca4:	da3f		bge	0xd26
+     ca6:	4668		mov	r0, sp
+     ca8:	7a00		ldrb	r0, [r0, #8]
+     caa:	0fc1		lsr	r1, r0, #31
+     cac:	1808		add	r0, r1, r0
+     cae:	1042		asr	r2, r0, #1
+     cb0:	9901		ldr	r1, [sp, #4]
+     cb2:	4668		mov	r0, sp
+     cb4:	7a03		ldrb	r3, [r0, #8]
+     cb6:	9800		ldr	r0, [sp, #0]
+     cb8:	5c18		ldrb	r0, [r3, r0]
+     cba:	2839		cmp	r0, #57	; 0x39
+     cbc:	dd05		ble	0xcca
+     cbe:	4668		mov	r0, sp
+     cc0:	7a00		ldrb	r0, [r0, #8]
+     cc2:	9b00		ldr	r3, [sp, #0]
+     cc4:	5cc0		ldrb	r0, [r0, r3]
+     cc6:	3837		sub	r0, #55	; 0x37
+     cc8:	e004		b	0xcd4
+     cca:	4668		mov	r0, sp
+     ccc:	7a00		ldrb	r0, [r0, #8]
+     cce:	9b00		ldr	r3, [sp, #0]
+     cd0:	5cc0		ldrb	r0, [r0, r3]
+     cd2:	3830		sub	r0, #48	; 0x30
+     cd4:	0100		lsl	r0, r0, #4
+     cd6:	5450		strb	r0, [r2, r1]
+     cd8:	4668		mov	r0, sp
+     cda:	7a00		ldrb	r0, [r0, #8]
+     cdc:	0fc1		lsr	r1, r0, #31
+     cde:	1808		add	r0, r1, r0
+     ce0:	1041		asr	r1, r0, #1
+     ce2:	9801		ldr	r0, [sp, #4]
+     ce4:	180a		add	r2, r1, r0
+     ce6:	4668		mov	r0, sp
+     ce8:	7a01		ldrb	r1, [r0, #8]
+     cea:	9800		ldr	r0, [sp, #0]
+     cec:	1808		add	r0, r1, r0
+     cee:	7840		ldrb	r0, [r0, #1]
+     cf0:	2839		cmp	r0, #57	; 0x39
+     cf2:	dd06		ble	0xd02
+     cf4:	4668		mov	r0, sp
+     cf6:	7a00		ldrb	r0, [r0, #8]
+     cf8:	9900		ldr	r1, [sp, #0]
+     cfa:	1840		add	r0, r0, r1
+     cfc:	7840		ldrb	r0, [r0, #1]
+     cfe:	3837		sub	r0, #55	; 0x37
+     d00:	e005		b	0xd0e
+     d02:	4668		mov	r0, sp
+     d04:	7a01		ldrb	r1, [r0, #8]
+     d06:	9800		ldr	r0, [sp, #0]
+     d08:	1808		add	r0, r1, r0
+     d0a:	7840		ldrb	r0, [r0, #1]
+     d0c:	3830		sub	r0, #48	; 0x30
+     d0e:	7811		ldrb	r1, [r2, #0]
+     d10:	1840		add	r0, r0, r1
+     d12:	7010		strb	r0, [r2, #0]
+     d14:	4669		mov	r1, sp
+     d16:	4668		mov	r0, sp
+     d18:	7a00		ldrb	r0, [r0, #8]
+     d1a:	3002		add	r0, #2
+     d1c:	7208		strb	r0, [r1, #8]
+     d1e:	4668		mov	r0, sp
+     d20:	7a00		ldrb	r0, [r0, #8]
+     d22:	2810		cmp	r0, #16	; 0x10
+     d24:	dbbf		blt	0xca6
+     d26:	9801		ldr	r0, [sp, #4]
+     d28:	f7ff feaf	bl	0xa8a
+     d2c:	b003		add	sp, #12	; 0xc
+     d2e:	bd00		pop	{pc}
+
+     d30:	b500		push	{lr}
+     d32:	b089		sub	sp, #36	; 0x24
+     d34:	9303		str	r3, [sp, #12]	; 0xc
+     d36:	9202		str	r2, [sp, #8]
+     d38:	9101		str	r1, [sp, #4]
+     d3a:	9000		str	r0, [sp, #0]
+     d3c:	9803		ldr	r0, [sp, #12]	; 0xc
+     d3e:	2800		cmp	r0, #0
+     d40:	dd53		ble	0xdea
+     d42:	9803		ldr	r0, [sp, #12]	; 0xc
+     d44:	9006		str	r0, [sp, #24]	; 0x18
+     d46:	2000		mov	r0, #0
+     d48:	9004		str	r0, [sp, #16]	; 0x10
+     d4a:	9804		ldr	r0, [sp, #16]	; 0x10
+     d4c:	2808		cmp	r0, #8
+     d4e:	da0b		bge	0xd68
+     d50:	9904		ldr	r1, [sp, #16]	; 0x10
+     d52:	9800		ldr	r0, [sp, #0]
+     d54:	5c09		ldrb	r1, [r1, r0]
+     d56:	9804		ldr	r0, [sp, #16]	; 0x10
+     d58:	aa07		add	r2, sp, #28	; 0x1c
+     d5a:	5411		strb	r1, [r2, r0]
+     d5c:	9804		ldr	r0, [sp, #16]	; 0x10
+     d5e:	3001		add	r0, #1
+     d60:	9004		str	r0, [sp, #16]	; 0x10
+     d62:	9804		ldr	r0, [sp, #16]	; 0x10
+     d64:	2808		cmp	r0, #8
+     d66:	dbf3		blt	0xd50
+     d68:	9806		ldr	r0, [sp, #24]	; 0x18
+     d6a:	2800		cmp	r0, #0
+     d6c:	dd2c		ble	0xdc8
+     d6e:	9806		ldr	r0, [sp, #24]	; 0x18
+     d70:	2808		cmp	r0, #8
+     d72:	da01		bge	0xd78
+     d74:	9806		ldr	r0, [sp, #24]	; 0x18
+     d76:	e000		b	0xd7a
+     d78:	2008		mov	r0, #8
+     d7a:	9005		str	r0, [sp, #20]	; 0x14
+     d7c:	2000		mov	r0, #0
+     d7e:	9004		str	r0, [sp, #16]	; 0x10
+     d80:	9804		ldr	r0, [sp, #16]	; 0x10
+     d82:	2808		cmp	r0, #8
+     d84:	da17		bge	0xdb6
+     d86:	9904		ldr	r1, [sp, #16]	; 0x10
+     d88:	9805		ldr	r0, [sp, #20]	; 0x14
+     d8a:	4281		cmp	r1, r0
+     d8c:	da0d		bge	0xdaa
+     d8e:	9803		ldr	r0, [sp, #12]	; 0xc
+     d90:	9901		ldr	r1, [sp, #4]
+     d92:	1840		add	r0, r0, r1
+     d94:	9906		ldr	r1, [sp, #24]	; 0x18
+     d96:	1a40		sub	r0, r0, r1
+     d98:	9904		ldr	r1, [sp, #16]	; 0x10
+     d9a:	5c09		ldrb	r1, [r1, r0]
+     d9c:	9804		ldr	r0, [sp, #16]	; 0x10
+     d9e:	aa07		add	r2, sp, #28	; 0x1c
+     da0:	5c10		ldrb	r0, [r2, r0]
+     da2:	4048		eor	r0, r1
+     da4:	9904		ldr	r1, [sp, #16]	; 0x10
+     da6:	aa07		add	r2, sp, #28	; 0x1c
+     da8:	5450		strb	r0, [r2, r1]
+     daa:	9804		ldr	r0, [sp, #16]	; 0x10
+     dac:	3001		add	r0, #1
+     dae:	9004		str	r0, [sp, #16]	; 0x10
+     db0:	9804		ldr	r0, [sp, #16]	; 0x10
+     db2:	2808		cmp	r0, #8
+     db4:	dbe7		blt	0xd86
+     db6:	a807		add	r0, sp, #28	; 0x1c
+     db8:	f7ff fe67	bl	0xa8a
+     dbc:	9806		ldr	r0, [sp, #24]	; 0x18
+     dbe:	3808		sub	r0, #8
+     dc0:	9006		str	r0, [sp, #24]	; 0x18
+     dc2:	9806		ldr	r0, [sp, #24]	; 0x18
+     dc4:	2800		cmp	r0, #0
+     dc6:	dcd2		bgt	0xd6e
+     dc8:	2000		mov	r0, #0
+     dca:	9004		str	r0, [sp, #16]	; 0x10
+     dcc:	9804		ldr	r0, [sp, #16]	; 0x10
+     dce:	2808		cmp	r0, #8
+     dd0:	da0b		bge	0xdea
+     dd2:	9804		ldr	r0, [sp, #16]	; 0x10
+     dd4:	9a02		ldr	r2, [sp, #8]
+     dd6:	9b04		ldr	r3, [sp, #16]	; 0x10
+     dd8:	a907		add	r1, sp, #28	; 0x1c
+     dda:	5cc9		ldrb	r1, [r1, r3]
+     ddc:	5481		strb	r1, [r0, r2]
+     dde:	9804		ldr	r0, [sp, #16]	; 0x10
+     de0:	3001		add	r0, #1
+     de2:	9004		str	r0, [sp, #16]	; 0x10
+     de4:	9804		ldr	r0, [sp, #16]	; 0x10
+     de6:	2808		cmp	r0, #8
+     de8:	dbf3		blt	0xdd2
+     dea:	b009		add	sp, #36	; 0x24
+     dec:	bd00		pop	{pc}
+     dee:	46c0		nop			(mov r8, r8)
+
+     df0:	72d42a70
+     df4:	9836f25a
+
+     df8:	b082		sub	sp, #8
+     dfa:	4669		mov	r1, sp
+     dfc:	7008		strb	r0, [r1, #0]
+     dfe:	2000		mov	r0, #0
+     e00:	8088		strh	r0, [r1, #4]
+     e02:	4668		mov	r0, sp
+     e04:	8881		ldrh	r1, [r0, #4]
+     e06:	20ff		mov	r0, #255	; 0xff
+     e08:	30f5		add	r0, #245	; 0xf5
+     e0a:	4281		cmp	r1, r0
+     e0c:	da21		bge	0xe52
+     e0e:	4669		mov	r1, sp
+     e10:	4668		mov	r0, sp
+     e12:	8880		ldrh	r0, [r0, #4]
+     e14:	3001		add	r0, #1
+     e16:	8088		strh	r0, [r1, #4]
+     e18:	48b4		ldr	r0, =0x12fc	; via 0x10ec
+     e1a:	7809		ldrb	r1, [r1, #0]
+     e1c:	0089		lsl	r1, r1, #2
+     e1e:	5840		ldr	r0, [r0, r1]
+     e20:	7940		ldrb	r0, [r0, #5]
+     e22:	4669		mov	r1, sp
+     e24:	7048		strb	r0, [r1, #1]
+     e26:	4668		mov	r0, sp
+     e28:	7840		ldrb	r0, [r0, #1]
+     e2a:	0840		lsr	r0, r0, #1
+     e2c:	d30b		bcc	0xe46
+     e2e:	49af		ldr	r1, =0x12fc	; via 0x10ec
+     e30:	4668		mov	r0, sp
+     e32:	7800		ldrb	r0, [r0, #0]
+     e34:	0080		lsl	r0, r0, #2
+     e36:	5808		ldr	r0, [r1, r0]
+     e38:	7800		ldrb	r0, [r0, #0]
+     e3a:	0600		lsl	r0, r0, #24
+     e3c:	0e00		lsr	r0, r0, #24
+     e3e:	4669		mov	r1, sp
+     e40:	7088		strb	r0, [r1, #2]
+     e42:	2000		mov	r0, #0
+     e44:	8088		strh	r0, [r1, #4]
+     e46:	4668		mov	r0, sp
+     e48:	8881		ldrh	r1, [r0, #4]
+     e4a:	20ff		mov	r0, #255	; 0xff
+     e4c:	30f5		add	r0, #245	; 0xf5
+     e4e:	4281		cmp	r1, r0
+     e50:	dbdd		blt	0xe0e
+     e52:	b002		add	sp, #8
+     e54:	4770		bx	lr
+
+     e56:	b081		sub	sp, #4
+     e58:	49a5		ldr	r1, =0x1000010	; via 0x10f0
+     e5a:	2000		mov	r0, #0
+     e5c:	7008		strb	r0, [r1, #0]
+     e5e:	49a3		ldr	r1, =0x12fc	; via 0x10ec
+     e60:	48a3		ldr	r0, =0x1000010	; via 0x10f0
+     e62:	7800		ldrb	r0, [r0, #0]
+     e64:	0080		lsl	r0, r0, #2
+     e66:	5808		ldr	r0, [r1, r0]
+     e68:	9000		str	r0, [sp, #0]
+     e6a:	49a2		ldr	r1, =0x1000011	; via 0x10f4
+     e6c:	2054		mov	r0, #84	; 0x54
+     e6e:	7008		strb	r0, [r1, #0]
+     e70:	49a1		ldr	r1, =0xffff6000	; via 0x10f8
+     e72:	2002		mov	r0, #2
+     e74:	880a		ldrh	r2, [r1, #0]
+     e76:	4310		orr	r0, r2
+     e78:	8008		strh	r0, [r1, #0]
+     e7a:	489f		ldr	r0, =0xffff6000	; via 0x10f8
+     e7c:	8801		ldrh	r1, [r0, #0]
+     e7e:	0849		lsr	r1, r1, #1
+     e80:	0049		lsl	r1, r1, #1
+     e82:	8001		strh	r1, [r0, #0]
+     e84:	499c		ldr	r1, =0xffff6000	; via 0x10f8
+     e86:	8808		ldrh	r0, [r1, #0]
+     e88:	2202		mov	r2, #2
+     e8a:	4390		bic	r0, r2
+     e8c:	8008		strh	r0, [r1, #0]
+     e8e:	9800		ldr	r0, [sp, #0]
+     e90:	2107		mov	r1, #7
+     e92:	7201		strb	r1, [r0, #8]
+     e94:	9800		ldr	r0, [sp, #0]
+     e96:	7a00		ldrb	r0, [r0, #8]
+     e98:	2807		cmp	r0, #7
+     e9a:	d1fb		bne	0xe94
+     e9c:	9900		ldr	r1, [sp, #0]
+     e9e:	20bf		mov	r0, #191	; 0xbf
+     ea0:	70c8		strb	r0, [r1, #3]
+     ea2:	9800		ldr	r0, [sp, #0]
+     ea4:	2110		mov	r1, #16	; 0x10
+     ea6:	7081		strb	r1, [r0, #2]
+     ea8:	9800		ldr	r0, [sp, #0]
+     eaa:	2140		mov	r1, #64	; 0x40
+     eac:	7101		strb	r1, [r0, #4]
+     eae:	9800		ldr	r0, [sp, #0]
+     eb0:	2100		mov	r1, #0
+     eb2:	71c1		strb	r1, [r0, #7]
+     eb4:	9800		ldr	r0, [sp, #0]
+     eb6:	70c1		strb	r1, [r0, #3]
+     eb8:	9800		ldr	r0, [sp, #0]
+     eba:	2187		mov	r1, #135	; 0x87
+     ebc:	7081		strb	r1, [r0, #2]
+     ebe:	9800		ldr	r0, [sp, #0]
+     ec0:	2180		mov	r1, #128	; 0x80
+     ec2:	70c1		strb	r1, [r0, #3]
+     ec4:	9800		ldr	r0, [sp, #0]
+     ec6:	498b		ldr	r1, =0x1000011	; via 0x10f4
+     ec8:	7809		ldrb	r1, [r1, #0]
+     eca:	7001		strb	r1, [r0, #0]
+     ecc:	9900		ldr	r1, [sp, #0]
+     ece:	2000		mov	r0, #0
+     ed0:	7048		strb	r0, [r1, #1]
+     ed2:	9900		ldr	r1, [sp, #0]
+     ed4:	2003		mov	r0, #3
+     ed6:	70c8		strb	r0, [r1, #3]
+     ed8:	9900		ldr	r1, [sp, #0]
+     eda:	2000		mov	r0, #0
+     edc:	7208		strb	r0, [r1, #8]
+     ede:	b001		add	sp, #4
+     ee0:	4770		bx	lr
+
+     ee2:	b081		sub	sp, #4
+     ee4:	4669		mov	r1, sp
+     ee6:	7008		strb	r0, [r1, #0]
+     ee8:	4980		ldr	r1, =0x12fc	; via 0x10ec
+     eea:	4668		mov	r0, sp
+     eec:	7800		ldrb	r0, [r0, #0]
+     eee:	0080		lsl	r0, r0, #2
+     ef0:	5808		ldr	r0, [r1, r0]
+     ef2:	2107		mov	r1, #7
+     ef4:	7201		strb	r1, [r0, #8]
+     ef6:	487d		ldr	r0, =0x12fc	; via 0x10ec
+     ef8:	4669		mov	r1, sp
+     efa:	7809		ldrb	r1, [r1, #0]
+     efc:	0089		lsl	r1, r1, #2
+     efe:	5840		ldr	r0, [r0, r1]
+     f00:	7a00		ldrb	r0, [r0, #8]
+     f02:	2807		cmp	r0, #7
+     f04:	d1f7		bne	0xef6
+     f06:	4979		ldr	r1, =0x12fc	; via 0x10ec
+     f08:	4668		mov	r0, sp
+     f0a:	7800		ldrb	r0, [r0, #0]
+     f0c:	0080		lsl	r0, r0, #2
+     f0e:	5808		ldr	r0, [r1, r0]
+     f10:	2180		mov	r1, #128	; 0x80
+     f12:	70c1		strb	r1, [r0, #3]
+     f14:	4875		ldr	r0, =0x12fc	; via 0x10ec
+     f16:	4669		mov	r1, sp
+     f18:	7809		ldrb	r1, [r1, #0]
+     f1a:	0089		lsl	r1, r1, #2
+     f1c:	5840		ldr	r0, [r0, r1]
+     f1e:	4975		ldr	r1, =0x1000011	; via 0x10f4
+     f20:	7809		ldrb	r1, [r1, #0]
+     f22:	7001		strb	r1, [r0, #0]
+     f24:	4871		ldr	r0, =0x12fc	; via 0x10ec
+     f26:	4669		mov	r1, sp
+     f28:	7809		ldrb	r1, [r1, #0]
+     f2a:	0089		lsl	r1, r1, #2
+     f2c:	5840		ldr	r0, [r0, r1]
+     f2e:	2100		mov	r1, #0
+     f30:	7041		strb	r1, [r0, #1]
+     f32:	486e		ldr	r0, =0x12fc	; via 0x10ec
+     f34:	4669		mov	r1, sp
+     f36:	7809		ldrb	r1, [r1, #0]
+     f38:	0089		lsl	r1, r1, #2
+     f3a:	5840		ldr	r0, [r0, r1]
+     f3c:	2103		mov	r1, #3
+     f3e:	70c1		strb	r1, [r0, #3]
+     f40:	486a		ldr	r0, =0x12fc	; via 0x10ec
+     f42:	4669		mov	r1, sp
+     f44:	7809		ldrb	r1, [r1, #0]
+     f46:	0089		lsl	r1, r1, #2
+     f48:	5840		ldr	r0, [r0, r1]
+     f4a:	2100		mov	r1, #0
+     f4c:	7201		strb	r1, [r0, #8]
+     f4e:	b001		add	sp, #4
+     f50:	4770		bx	lr
+
+     f52:	b081		sub	sp, #4
+     f54:	4669		mov	r1, sp
+     f56:	7008		strb	r0, [r1, #0]
+     f58:	4964		ldr	r1, =0x12fc	; via 0x10ec
+     f5a:	4668		mov	r0, sp
+     f5c:	7800		ldrb	r0, [r0, #0]
+     f5e:	0080		lsl	r0, r0, #2
+     f60:	5808		ldr	r0, [r1, r0]
+     f62:	7941		ldrb	r1, [r0, #5]
+     f64:	4668		mov	r0, sp
+     f66:	7041		strb	r1, [r0, #1]
+     f68:	7840		ldrb	r0, [r0, #1]
+     f6a:	09c0		lsr	r0, r0, #7
+     f6c:	d20b		bcs	0xf86
+     f6e:	485f		ldr	r0, =0x12fc	; via 0x10ec
+     f70:	4669		mov	r1, sp
+     f72:	7809		ldrb	r1, [r1, #0]
+     f74:	0089		lsl	r1, r1, #2
+     f76:	5840		ldr	r0, [r0, r1]
+     f78:	7940		ldrb	r0, [r0, #5]
+     f7a:	4669		mov	r1, sp
+     f7c:	7048		strb	r0, [r1, #1]
+     f7e:	4668		mov	r0, sp
+     f80:	7840		ldrb	r0, [r0, #1]
+     f82:	09c0		lsr	r0, r0, #7
+     f84:	d3f3		bcc	0xf6e
+     f86:	b001		add	sp, #4
+     f88:	4770		bx	lr
+
+     f8a:	b085		sub	sp, #20	; 0x14
+     f8c:	466b		mov	r3, sp
+     f8e:	719a		strb	r2, [r3, #6]
+     f90:	466a		mov	r2, sp
+     f92:	8091		strh	r1, [r2, #4]
+     f94:	9000		str	r0, [sp, #0]
+     f96:	9800		ldr	r0, [sp, #0]
+     f98:	9002		str	r0, [sp, #8]
+     f9a:	4669		mov	r1, sp
+     f9c:	4668		mov	r0, sp
+     f9e:	8880		ldrh	r0, [r0, #4]
+     fa0:	8208		strh	r0, [r1, #16]	; 0x10
+     fa2:	4668		mov	r0, sp
+     fa4:	8a00		ldrh	r0, [r0, #16]	; 0x10
+     fa6:	2800		cmp	r0, #0
+     fa8:	d01e		beq	0xfe8
+     faa:	4950		ldr	r1, =0x12fc	; via 0x10ec
+     fac:	4668		mov	r0, sp
+     fae:	7980		ldrb	r0, [r0, #6]
+     fb0:	0080		lsl	r0, r0, #2
+     fb2:	5808		ldr	r0, [r1, r0]
+     fb4:	7941		ldrb	r1, [r0, #5]
+     fb6:	4668		mov	r0, sp
+     fb8:	7301		strb	r1, [r0, #12]	; 0xc
+     fba:	7b00		ldrb	r0, [r0, #12]	; 0xc
+     fbc:	0980		lsr	r0, r0, #6
+     fbe:	d3f4		bcc	0xfaa
+     fc0:	494a		ldr	r1, =0x12fc	; via 0x10ec
+     fc2:	4668		mov	r0, sp
+     fc4:	7980		ldrb	r0, [r0, #6]
+     fc6:	0080		lsl	r0, r0, #2
+     fc8:	5809		ldr	r1, [r1, r0]
+     fca:	9802		ldr	r0, [sp, #8]
+     fcc:	7800		ldrb	r0, [r0, #0]
+     fce:	7008		strb	r0, [r1, #0]
+     fd0:	9802		ldr	r0, [sp, #8]
+     fd2:	3001		add	r0, #1
+     fd4:	9002		str	r0, [sp, #8]
+     fd6:	4669		mov	r1, sp
+     fd8:	4668		mov	r0, sp
+     fda:	8a00		ldrh	r0, [r0, #16]	; 0x10
+     fdc:	3801		sub	r0, #1
+     fde:	8208		strh	r0, [r1, #16]	; 0x10
+     fe0:	4668		mov	r0, sp
+     fe2:	8a00		ldrh	r0, [r0, #16]	; 0x10
+     fe4:	2800		cmp	r0, #0
+     fe6:	d1e0		bne	0xfaa
+     fe8:	b005		add	sp, #20	; 0x14
+     fea:	4770		bx	lr
+
+     fec:	b082		sub	sp, #8
+     fee:	466a		mov	r2, sp
+     ff0:	7111		strb	r1, [r2, #4]
+     ff2:	9000		str	r0, [sp, #0]
+     ff4:	483d		ldr	r0, =0x12fc	; via 0x10ec
+     ff6:	4669		mov	r1, sp
+     ff8:	7909		ldrb	r1, [r1, #4]
+     ffa:	0089		lsl	r1, r1, #2
+     ffc:	5840		ldr	r0, [r0, r1]
+     ffe:	7940		ldrb	r0, [r0, #5]
+    1000:	4669		mov	r1, sp
+    1002:	7148		strb	r0, [r1, #5]
+    1004:	4668		mov	r0, sp
+    1006:	7940		ldrb	r0, [r0, #5]
+    1008:	0840		lsr	r0, r0, #1
+    100a:	d3f3		bcc	0xff4
+    100c:	4837		ldr	r0, =0x12fc	; via 0x10ec
+    100e:	7909		ldrb	r1, [r1, #4]
+    1010:	0089		lsl	r1, r1, #2
+    1012:	5840		ldr	r0, [r0, r1]
+    1014:	7800		ldrb	r0, [r0, #0]
+    1016:	0600		lsl	r0, r0, #24
+    1018:	0e00		lsr	r0, r0, #24
+    101a:	9900		ldr	r1, [sp, #0]
+    101c:	7008		strb	r0, [r1, #0]
+    101e:	b002		add	sp, #8
+    1020:	4770		bx	lr
+
+    1022:	b083		sub	sp, #12	; 0xc
+    1024:	466b		mov	r3, sp
+    1026:	719a		strb	r2, [r3, #6]
+    1028:	466a		mov	r2, sp
+    102a:	8091		strh	r1, [r2, #4]
+    102c:	9000		str	r0, [sp, #0]
+    102e:	4669		mov	r1, sp
+    1030:	4668		mov	r0, sp
+    1032:	8880		ldrh	r0, [r0, #4]
+    1034:	8108		strh	r0, [r1, #8]
+    1036:	4668		mov	r0, sp
+    1038:	8900		ldrh	r0, [r0, #8]
+    103a:	2800		cmp	r0, #0
+    103c:	dd24		ble	0x1088
+    103e:	482b		ldr	r0, =0x12fc	; via 0x10ec
+    1040:	4669		mov	r1, sp
+    1042:	7989		ldrb	r1, [r1, #6]
+    1044:	0089		lsl	r1, r1, #2
+    1046:	5840		ldr	r0, [r0, r1]
+    1048:	7940		ldrb	r0, [r0, #5]
+    104a:	4669		mov	r1, sp
+    104c:	71c8		strb	r0, [r1, #7]
+    104e:	4668		mov	r0, sp
+    1050:	79c0		ldrb	r0, [r0, #7]
+    1052:	0840		lsr	r0, r0, #1
+    1054:	d3f3		bcc	0x103e
+    1056:	4668		mov	r0, sp
+    1058:	8881		ldrh	r1, [r0, #4]
+    105a:	9800		ldr	r0, [sp, #0]
+    105c:	1809		add	r1, r1, r0
+    105e:	4668		mov	r0, sp
+    1060:	8900		ldrh	r0, [r0, #8]
+    1062:	1a0a		sub	r2, r1, r0
+    1064:	4821		ldr	r0, =0x12fc	; via 0x10ec
+    1066:	4669		mov	r1, sp
+    1068:	7989		ldrb	r1, [r1, #6]
+    106a:	0089		lsl	r1, r1, #2
+    106c:	5840		ldr	r0, [r0, r1]
+    106e:	7800		ldrb	r0, [r0, #0]
+    1070:	0600		lsl	r0, r0, #24
+    1072:	0e00		lsr	r0, r0, #24
+    1074:	7010		strb	r0, [r2, #0]
+    1076:	4669		mov	r1, sp
+    1078:	4668		mov	r0, sp
+    107a:	8900		ldrh	r0, [r0, #8]
+    107c:	3801		sub	r0, #1
+    107e:	8108		strh	r0, [r1, #8]
+    1080:	4668		mov	r0, sp
+    1082:	8900		ldrh	r0, [r0, #8]
+    1084:	2800		cmp	r0, #0
+    1086:	dcda		bgt	0x103e
+    1088:	b003		add	sp, #12	; 0xc
+    108a:	4770		bx	lr
+
+    108c:	b082		sub	sp, #8
+    108e:	466a		mov	r2, sp
+    1090:	7111		strb	r1, [r2, #4]
+    1092:	9000		str	r0, [sp, #0]
+    1094:	4669		mov	r1, sp
+    1096:	2000		mov	r0, #0
+    1098:	80c8		strh	r0, [r1, #6]
+    109a:	4668		mov	r0, sp
+    109c:	88c1		ldrh	r1, [r0, #6]
+    109e:	20ff		mov	r0, #255	; 0xff
+    10a0:	30f5		add	r0, #245	; 0xf5
+    10a2:	4281		cmp	r1, r0
+    10a4:	da1f		bge	0x10e6
+    10a6:	4669		mov	r1, sp
+    10a8:	4668		mov	r0, sp
+    10aa:	88c0		ldrh	r0, [r0, #6]
+    10ac:	3001		add	r0, #1
+    10ae:	80c8		strh	r0, [r1, #6]
+    10b0:	490e		ldr	r1, =0x12fc	; via 0x10ec
+    10b2:	4668		mov	r0, sp
+    10b4:	7900		ldrb	r0, [r0, #4]
+    10b6:	0080		lsl	r0, r0, #2
+    10b8:	5808		ldr	r0, [r1, r0]
+    10ba:	7941		ldrb	r1, [r0, #5]
+    10bc:	4668		mov	r0, sp
+    10be:	7141		strb	r1, [r0, #5]
+    10c0:	7940		ldrb	r0, [r0, #5]
+    10c2:	0840		lsr	r0, r0, #1
+    10c4:	d309		bcc	0x10da
+    10c6:	4809		ldr	r0, =0x12fc	; via 0x10ec
+    10c8:	4669		mov	r1, sp
+    10ca:	7909		ldrb	r1, [r1, #4]
+    10cc:	0089		lsl	r1, r1, #2
+    10ce:	5840		ldr	r0, [r0, r1]
+    10d0:	7800		ldrb	r0, [r0, #0]
+    10d2:	0600		lsl	r0, r0, #24
+    10d4:	0e01		lsr	r1, r0, #24
+    10d6:	9800		ldr	r0, [sp, #0]
+    10d8:	7001		strb	r1, [r0, #0]
+    10da:	4668		mov	r0, sp
+    10dc:	88c1		ldrh	r1, [r0, #6]
+    10de:	20ff		mov	r0, #255	; 0xff
+    10e0:	30f5		add	r0, #245	; 0xf5
+    10e2:	4281		cmp	r1, r0
+    10e4:	dbdf		blt	0x10a6
+    10e6:	b002		add	sp, #8
+    10e8:	4770		bx	lr
+    10ea:	46c0		nop			(mov r8, r8)
+
+    10ec:	000012fc
+    10f0:	01000010
+    10f4:	01000011
+    10f8:	ffff6000
+
+    10fc:	b43c		push	{r2, r3, r4, r5}
+    10fe:	17cc		asr	r4, r1, #31
+    1100:	4061		eor	r1, r4
+    1102:	1b09		sub	r1, r1, r4
+    1104:	d050		beq	0x11a8
+    1106:	17c2		asr	r2, r0, #31
+    1108:	4050		eor	r0, r2
+    110a:	1a80		sub	r0, r0, r2
+    110c:	0864		lsr	r4, r4, #1
+    110e:	4054		eor	r4, r2
+    1110:	1c0a		add	r2, r1, #0
+    1112:	0c05		lsr	r5, r0, #16
+    1114:	42aa		cmp	r2, r5
+    1116:	d800		bhi	0x111a
+    1118:	0412		lsl	r2, r2, #16
+    111a:	0a05		lsr	r5, r0, #8
+    111c:	42aa		cmp	r2, r5
+    111e:	d800		bhi	0x1122
+    1120:	0212		lsl	r2, r2, #8
+    1122:	1c03		add	r3, r0, #0
+    1124:	a51b		add	r5, pc, #108	; 0x6c
+    1126:	085b		lsr	r3, r3, #1
+    1128:	3d0c		sub	r5, #12	; 0xc
+    112a:	429a		cmp	r2, r3
+    112c:	d9fb		bls	0x1126
+    112e:	2300		mov	r3, #0
+    1130:	46af		mov	pc, r5
+    1132:	0a12		lsr	r2, r2, #8
+    1134:	01d5		lsl	r5, r2, #7
+    1136:	42a8		cmp	r0, r5
+    1138:	415b		adc	r3, r3
+    113a:	42a8		cmp	r0, r5
+    113c:	d300		bcc	0x1140
+    113e:	1b40		sub	r0, r0, r5
+    1140:	0195		lsl	r5, r2, #6
+    1142:	42a8		cmp	r0, r5
+    1144:	415b		adc	r3, r3
+    1146:	42a8		cmp	r0, r5
+    1148:	d300		bcc	0x114c
+    114a:	1b40		sub	r0, r0, r5
+    114c:	0155		lsl	r5, r2, #5
+    114e:	42a8		cmp	r0, r5
+    1150:	415b		adc	r3, r3
+    1152:	42a8		cmp	r0, r5
+    1154:	d300		bcc	0x1158
+    1156:	1b40		sub	r0, r0, r5
+    1158:	0115		lsl	r5, r2, #4
+    115a:	42a8		cmp	r0, r5
+    115c:	415b		adc	r3, r3
+    115e:	42a8		cmp	r0, r5
+    1160:	d300		bcc	0x1164
+    1162:	1b40		sub	r0, r0, r5
+    1164:	00d5		lsl	r5, r2, #3
+    1166:	42a8		cmp	r0, r5
+    1168:	415b		adc	r3, r3
+    116a:	42a8		cmp	r0, r5
+    116c:	d300		bcc	0x1170
+    116e:	1b40		sub	r0, r0, r5
+    1170:	0095		lsl	r5, r2, #2
+    1172:	42a8		cmp	r0, r5
+    1174:	415b		adc	r3, r3
+    1176:	42a8		cmp	r0, r5
+    1178:	d300		bcc	0x117c
+    117a:	1b40		sub	r0, r0, r5
+    117c:	0055		lsl	r5, r2, #1
+    117e:	42a8		cmp	r0, r5
+    1180:	415b		adc	r3, r3
+    1182:	42a8		cmp	r0, r5
+    1184:	d300		bcc	0x1188
+    1186:	1b40		sub	r0, r0, r5
+    1188:	4290		cmp	r0, r2
+    118a:	415b		adc	r3, r3
+    118c:	4290		cmp	r0, r2
+    118e:	d300		bcc	0x1192
+    1190:	1a80		sub	r0, r0, r2
+    1192:	4291		cmp	r1, r2
+    1194:	d3cd		bcc	0x1132
+    1196:	17e5		asr	r5, r4, #31
+    1198:	4068		eor	r0, r5
+    119a:	1b40		sub	r0, r0, r5
+    119c:	0064		lsl	r4, r4, #1
+    119e:	17e4		asr	r4, r4, #31
+    11a0:	4063		eor	r3, r4
+    11a2:	1b19		sub	r1, r3, r4
+    11a4:	bc3c		pop	{r2, r3, r4, r5}
+    11a6:	46f7		mov	pc, lr
+    11a8:	2000		mov	r0, #0
+    11aa:	bc3c		pop	{r2, r3, r4, r5}
+    11ac:	46f7		mov	pc, lr
+
+    11ae:	0000		lsl	r0, r0, #0
+    11b0:	4918		ldr	r1, =0xfffffa08	; via 0x1214
+    11b2:	4819		ldr	r0, =0xffff	; via 0x1218
+    11b4:	8008		strh	r0, [r1, #0]
+    11b6:	4819		ldr	r0, =0xfffffa0a	; via 0x121c
+    11b8:	211f		mov	r1, #31	; 0x1f
+    11ba:	8001		strh	r1, [r0, #0]
+    11bc:	4818		ldr	r0, =0xfffff804	; via 0x1220
+    11be:	21f5		mov	r1, #245	; 0xf5
+    11c0:	8001		strh	r1, [r0, #0]
+    11c2:	21a0		mov	r1, #160	; 0xa0
+    11c4:	8001		strh	r1, [r0, #0]
+    11c6:	4817		ldr	r0, =0xffff9800	; via 0x1224
+    11c8:	4917		ldr	r1, =0x2002	; via 0x1228
+    11ca:	8001		strh	r1, [r0, #0]
+    11cc:	4815		ldr	r0, =0xffff9800	; via 0x1224
+    11ce:	8800		ldrh	r0, [r0, #0]
+    11d0:	0840		lsr	r0, r0, #1
+    11d2:	d2fb		bcs	0x11cc
+    11d4:	4915		ldr	r1, =0xfffffd00	; via 0x122c
+    11d6:	4816		ldr	r0, =0x1001	; via 0x1230
+    11d8:	8008		strh	r0, [r1, #0]
+    11da:	4916		ldr	r1, =0xfffffd02	; via 0x1234
+    11dc:	2080		mov	r0, #128	; 0x80
+    11de:	8008		strh	r0, [r1, #0]
+    11e0:	4915		ldr	r1, =0xfffef006	; via 0x1238
+    11e2:	2008		mov	r0, #8
+    11e4:	880a		ldrh	r2, [r1, #0]
+    11e6:	4310		orr	r0, r2
+    11e8:	8008		strh	r0, [r1, #0]
+    11ea:	46f7		mov	pc, lr
+
+    11ec:	b500		push	{lr}
+    11ee:	f7ff ffdf	bl	0x11b0
+    11f2:	f7ff fe30	bl	0xe56
+    11f6:	bd00		pop	{pc}
+
+    11f8:	b500		push	{lr}
+    11fa:	f7fe ffc4	bl	0x186
+    11fe:	2801		cmp	r0, #1
+    1200:	d104		bne	0x120c
+    1202:	f7ff f8a2	bl	0x34a
+    1206:	f7ff fb6f	bl	0x8e8
+    120a:	bd00		pop	{pc}
+    120c:	f7ff fbba	bl	0x984
+    1210:	bd00		pop	{pc}
+    1212:	46c0		nop			(mov r8, r8)
+
+    1214:	fffffa08
+    1218:	0000ffff
+    121c:	fffffa0a
+    1220:	fffff804
+    1224:	ffff9800
+    1228:	00002002
+    122c:	fffffd00
+    1230:	00001001
+    1234:	fffffd02
+    1238:	fffef006
+    123c:	fffffb00
+    1240:	02a1
+    1242:	02a1
+    1244:	02a1
+    1246:	0283
+    1248:	0281
+    124a:	00c0
+    124c:	0040
+    124e:	002a
+
+    1250:	e51f101c	ldr	r1, =0xfffffb00	; via 0x123c
+    1254:	e15f21bc	ldrh	r2, =0x2a1	; via 0x1240
+    1258:	e1c120b0	strh	r2, [r1]
+    125c:	e15f22b2	ldrh	r2, =0x2a1	; via 0x1242
+    1260:	e1c120b2	strh	r2, [r1, #2]
+    1264:	e15f22b8	ldrh	r2, =0x2a1	; via 0x1244
+    1268:	e1c120b4	strh	r2, [r1, #4]
+    126c:	e15f22be	ldrh	r2, =0x283	; via 0x1246
+    1270:	e1c120b6	strh	r2, [r1, #6]
+    1274:	e15f23b4	ldrh	r2, =0x281	; via 0x1248
+    1278:	e1c120ba	strh	r2, [r1, #10]	; 0xa
+    127c:	e15f23ba	ldrh	r2, =0xc0	; via 0x124a
+    1280:	e1c120bc	strh	r2, [r1, #12]	; 0xc
+    1284:	e15f24b0	ldrh	r2, =0x40	; via 0x124c
+    1288:	e1c120b8	strh	r2, [r1, #8]
+    128c:	e15f24b6	ldrh	r2, =0x2a	; via 0x124e
+    1290:	e1c120be	strh	r2, [r1, #14]	; 0xe
+    1294:	e59f0018	ldr	r0, =0x1001000	; via 0x12b4
+    1298:	e3a01b01	mov	r1, #1024	; 0x400
+    129c:	e2411004	sub	r1, r1, #4
+    12a0:	e0802001	add	r2, r0, r1
+    12a4:	e3c22003	bic	r2, r2, #3
+    12a8:	e1a0d002	mov	sp, r2
+    12ac:	eb000007	bl	0x12d0
+    12b0:	ea000000	b	0x12b8
+    12b4:	01001000
+
+    12b8:	e92d4000	stmdb	sp!, {lr}
+    12bc:	e28fe001	add	lr, pc, #1
+    12c0:	e12fff1e	bx	lr
+    12c4:	f7ff ff98	bl	0x11f8
+    12c8:	4778		bx	pc
+    12ca:	46c0		nop			(mov r8, r8)
+    12cc:	e8bd8000	ldmia	sp!, {pc}
+
+    12d0:	e92d4000	stmdb	sp!, {lr}
+    12d4:	e28fe001	add	lr, pc, #1
+    12d8:	e12fff1e	bx	lr
+    12dc:	f7ff ff86	bl	0x11ec
+    12e0:	4778		bx	pc
+    12e2:	46c0		nop			(mov r8, r8)
+    12e4:	e8bd8000	ldmia	sp!, {pc}
+
+    12e8:	46a4		mov	r12, r4
+    12ea:	0864		lsr	r4, r4, #1
+    12ec:	d301		bcc	0x12f2
+    12ee:	4760		bx	r12
+    12f0:	46c0		nop			(mov r8, r8)
+    12f2:	4674		mov	r4, lr
+    12f4:	46fe		mov	lr, pc
+    12f6:	4760		bx	r12
+    12f8:	e12fff14	bx	r4
+
+    12fc:	ffff5800
+    1300:	ffff5000
+    1304:	2a150e07
+    1308:	00000054
+
+    2000:	00000001
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/se_k200i/chipset	Sun Nov 06 01:13:43 2022 +0000
@@ -0,0 +1,19 @@
+The core baseband chipset found inside SE K200/220 phones consists of:
+
+* Calypso variant 751992A (C035, final DSP ROM version 3606, full 512 KiB IRAM)
+* ABB: TWL3025BZ, familiar Iota
+* Flash+XRAM: Spansion S71PL129NB0HFW4B (16 MiB flash, 4 MiB RAM)
+
+Calypso MEMIF chip selects:
+
+nCS0: flash main bank (boot)
+nCS1: XRAM
+nCS2: flash second bank
+nCS3: currently unknown
+nCS4: ditto
+
+RF components:
+
+* Transceiver: TRF6151CJ, familiar Rita
+* PA: SKY77318
+* Antenna switch: Murata LMSP43AA-191
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/se_k200i/flash-notes	Sun Nov 06 01:13:43 2022 +0000
@@ -0,0 +1,62 @@
+SE K200 family phones have 16 MiB of flash total, physically presented to the
+Calypso chip as two banks of 8 MiB each.  Their official fw architecture uses
+the following flash organization:
+
+Flash bank 1, first 64 KiB sector:
+
+This part of the flash naturally contains the boot entry point.  The word at
+0x2000 equals 1, telling Calypso boot ROM to move itself out of the way and
+perform a watchdog reset, and then the reset entry point is at 0.  The code
+implemented by SE or their ODM in this flash sector is a boot stage of their
+own invention, eventually passing control to the main fw entry point at
+0x200000.
+
+Flash bank 1, 64 KiB sector at 0x10000:
+
+This sector holds two items of factory-programmed data, apparently intended to
+remain immutable for the lifetime of each hw unit:
+
+ 7 bytes at 0x10000: the phone's IMEI, format obvious, no obfuscation
+ 1 byte  at 0x10007: 0xFF filler
+64 bytes at 0x10008: appear to be cryptographically random filler
+
+Flash bank 1 starting at 0x20000:
+
+The main firmware image resides here, entry point right at 0x200000.
+
+Flash bank 2, first 13 sectors of 256 KiB each:
+
+The firmware on this phone model uses classic TIFFS.  Their TIFFS organization
+is 256x13 (a little smaller than Pirelli's 256x18), sitting at the beginning of
+flash bank 2, mapped into Calypso address space at 0x01800000.  FFS design
+appears to be self-regenerating: if the fw is booted with all FFS sectors
+erased, it will not only format a new FFS like Pirelli's fw, but also fill it
+with all necessary data.  In contrast with Pirelli's fw architecture, the FFS
+in these SE K200 phones appears to NOT contain any static asset files that must
+be loaded externally.
+
+Flash bank 2, area starting at 0x01B40000, right after TIFFS:
+
+This area appears to be an extension of the firmware.  Without a lot more
+reverse eng work, it is not obvious if this area contains any executable code,
+or if it is only data bits like UI pixel images, MIDI ringtones, language
+strings etc.
+
+Flash bank 2, 64 KiB sector at 0x01FD0000:
+
+This sector holds factory calibration data, including RF, AFC (VCXO) and MADC
+calibrations.  When the firmware reinitializes a freshly formatted FFS, it must
+be copying calibration bits from this sector.
+
+Flash bank 2, 64 KiB sector at 0x01FF0000 (end of flash):
+
+First 0x2C8 bytes: purpose unknown, but they are fed into the hash function
+that determines whether or not the firmware is allowed to boot.
+
+8 bytes at 0x01FF02C8: output of some kind of cryptographic hash function
+
+There is a hash function implemented in the custom bootloader in sector 0 (not
+studied in detail) whose inputs are the IMEI record at 0x10000, the block of
+0x2C8 bytes at 0x01FF0000 and the block of 64 bytes at 0x10008 in this order.
+The output must match the 8 bytes at 0x01FF02C8, or the code refuses to boot
+and goes into a dead hang instead.
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/se_k200i/tpudrv-notes	Sun Nov 06 01:13:43 2022 +0000
@@ -0,0 +1,16 @@
+Notes from OsmocomBB tinkerer steve-m, relayed to me (Mother Mychaela) through
+Vadim, indicate that:
+
+* Calypso TSP signals going to Rita xcvr are wired per canon: TSPEN2 for strobe,
+  TSPACT0 for reset.
+
+* TSP controls to the PA are also TI-canonical: TSPACT9 for enable, TSPACT3 for
+  band select.
+
+* The two antenna switch controls (Tx low band, Tx high band) exactly match TI
+  Leonardo, specifically the cheapened 2-band version of that canonical
+  platform: TSPACT1 is Tx high band switch, TSPACT2 is Tx low band switch, both
+  inverted per canon.
+
+But here is the part that deviates from canon: Iota TEN is apparently wired to
+Calypso TSPEN1 instead of canonical TSPEN0!