iBSS, reversed by roxfan

-00000084 crypt_buf2 DCB 64 dup(?)
-00000044 iv2       DCB 16 dup(?)
-00000034 crypt_buf1 DCB 16 dup(?)

ROM:22016C7C crypt_2   DCB 0xAD, 0x2E, 0xE3, 0x8D, 0x2D, 0x9B, 0xE4, 0x35, 0x99, 4
ROM:22016C7C           DCB 0x44, 0x33, 0x65, 0x3D, 0xF0, 0x74, 0x98, 0xD8, 0x56, 0x3B
ROM:22016C7C           DCB 0x4F, 0xF9, 0x6A, 0x55, 0x45, 0xCE, 0x82, 0xF2, 0x9A, 0x5A
ROM:22016C7C           DCB 0xC2, 0xBC, 0x47, 0x61, 0x6D, 0x65, 0x4F, 0x76, 0x65, 0x72
ROM:22016C7C           DCB 0xA6, 0xA0, 0x99, 0x13
ROM:22016CA8 iv1       DCD 0x115D7041, 0x824B986F, 0xBB996C9C, 0x6978F1A5
ROM:22016CB8 crypt_1   DCD 0xB345F3CD, 0x8548E712, 0x4721BE8B, 0x8880E5F0


ROM:2200865A loc_2200865A
ROM:2200865A           LDR   R1, =crypt_1
ROM:2200865C           MOVS  R2, #0x10
ROM:2200865E           ADD   R0, SP, #0x94+crypt_buf1
ROM:22008660           BLX   _memmove
ROM:22008664           LDR   R3, =iv1
ROM:22008666           MOVS  R1, #0x10
ROM:22008668           STR   R3, [SP]
ROM:2200866A           MOVS  R2, #2
ROM:2200866C           MOVS  R3, #0
ROM:2200866E           ADD   R0, SP, #0x94+crypt_buf1
ROM:22008670           BL    aes_crypt?               ; r0=data,r1=size,r2=type,r3=key,arg0=iv
ROM:22008674           LDR   R1, [SP,#0x94+_size2]
ROM:22008676           ADD   R2, SP, #0x94+crypt_buf2
ROM:22008678           LDR   R0, [SP,#0x94+unwrapped_ptr]
ROM:2200867A           BL    sha1_hash?               ; r0=data,r1=size,r2=hashbuf
ROM:2200867E           LDR   R1, =crypt_2
ROM:22008680           MOVS  R2, #0x2C
ROM:22008682           ADD   R0, SP, #0x94+crypt_buf2+0x14
ROM:22008684           BLX   _memmove
ROM:22008688           MOVS  R1, #0
ROM:2200868A           MOVS  R2, #0x10
ROM:2200868C           ADD   R0, SP, #0x94+iv2
ROM:2200868E           BLX   _memset
ROM:22008692           ADD   _iv2, SP, #0x94+iv2
ROM:22008694           MOVS  R1, #0x40
ROM:22008696           MOVS  R2, #0
ROM:22008698           ADD   R0, SP, #0x94+crypt_buf2
ROM:2200869A           ADD   R3, SP, #0x94+crypt_buf1
ROM:2200869C           STR   _iv2, [SP]
ROM:2200869E           BL    aes_crypt?               ; r0=data,r1=size,r2=type,r3=key,arg0=iv
ROM:220086A2           ADDS  R0, R5, #0
ROM:220086A4           ADDS  R0, #0x20
ROM:220086A6           ADD   R1, SP, #0x94+crypt_buf2
ROM:220086A8           MOVS  R2, #0x40
ROM:220086AA           BL    memcmp_0
ROM:220086AE           CMP   R0, #0
ROM:220086B0           BNE   loc_220086B6
ROM:220086B2           MOVS  R4, #0
ROM:220086B4           B     loc_220086BA
ROM:220086B6 ; ---------------------------------------------------------------------------
ROM:220086B6
ROM:220086B6 loc_220086B6                            ; CODE XREF: do_load_image+144j
ROM:220086B6           MOVS  R4, #1
ROM:220086B8           NEGS  R4, R4
ROM:220086BA
ROM:220086BA loc_220086BA                            ; CODE XREF: do_load_image+148j
ROM:220086BA           ADD   R0, SP, #0x94+iv2
ROM:220086BC           MOVS  R1, #0
ROM:220086BE           MOVS  R2, #0x10
ROM:220086C0           BLX   _memset
ROM:220086C4           CMP   R4, #0
ROM:220086C6           BNE   loc_220086DC
ROM:220086C8           LDR   R0, [R5,#Image2.miscflags] ; bit30=encrypted?
ROM:220086CA           LSLS  R3, R0, #0x16
ROM:220086CC           BPL   loc_220086DC
ROM:220086CE           LDR   R0, [SP,#0x94+unwrapped_ptr]
ROM:220086D0           LDR   R1, [SP,#0x94+_size2]
ROM:220086D2           MOVS  R2, #0
ROM:220086D4           ADD   R3, SP, #0x94+crypt_buf1
ROM:220086D6           STR   _iv2, [SP]
ROM:220086D8           BL    aes_decrypt?             ; r0=data,r1=size,r2=type,r3=key,arg0=iv
ROM:220086DC
ROM:220086DC loc_220086DC                            ; CODE XREF: do_load_image+ECj
ROM:220086DC                                         ; do_load_image+15Aj ...
ROM:220086DC           ADD   R0, SP, #0x94+crypt_buf1
ROM:220086DE           MOVS  R1, #0
ROM:220086E0           MOVS  R2, #0x10
ROM:220086E2           BLX   _memset
ROM:220086E6           CMP   R4, #0