My guess, based on the sx280.
I think you can just remove the call to sub_FF82D94C, continue at loc_FF8285FC to avoid the infinite loop. You of course need to set the right bit(s?) on (0x2A04 + 4).loc_ff86b8c4: ; 4 refs
ff86b8c4: b loc_ff8693a4
loc_ff8693a4: ; 8 refs
ff8693a4: ldr r1, =0xffbc0738 ; 'GPIO + bit' table
ff8693a8: ldr r2, [r1, r0, lsl #3]
ff8693ac: ldr r2, [r2] ; read GPIO
ff8693b0: add r0, r1, r0, lsl #3
ff8693b4: ldr r0, [r0, #4] ; read bitmask
ff8693b8: ands r0, r0, r2 ; return bit's state
ff8693bc: movne r0, #1
ff8693c0: bx lr
loc_ff838500: ; 3 refs
ff838500: mov r0, #0x80000000
ff838504: ldr r0, [r0, #0xffc] ; read last word of data TCM
ff838508: ldr r1, =0x12345678
ff83850c: cmp r0, r1 ; is it 0x12345678?, return the result
ff838510: movne r0, #0
ff838514: moveq r0, #1
ff838518: bx lr
ff82d94c: push {r2, r3, r4, r5, r6, r7, r8, lr}
ff82d950: mov r7, r0
ff82d954: mov r5, #0
ff82d958: bl loc_ff86b2e0 ; nullsub
ff82d95c: mov r0, #5 ; read GPIO bit (5), ON/OFF button?
ff82d960: bl loc_ff86b8c4
ff82d964: mov r4, #1
ff82d968: bic r6, r4, r0
ff82d96c: mov r0, #6 ; read GPIO bit (6)
ff82d970: bl loc_ff86b8c4
ff82d974: cmp r7, #0
ff82d978: bic r4, r4, r0
ff82d97c: beq loc_ff82d988
ff82d980: orrs r0, r6, r4 ; one of the above 2 buttons has to be pressed, otherwise shutdown
ff82d984: beq loc_ff82d9b0
loc_ff82d988:
ff82d988: bl loc_ff838500 ; data TCM check
ff82d98c: mov r2, r0
ff82d990: mov r3, r5 ; unused argument
ff82d994: mov r1, r4 ; GPIO bit (6) (PLAYBACK button?)
ff82d998: mov r0, r6 ; ON/OFF button?
ff82d99c: str r5, [sp] ; unused argument
ff82d9a0: str r5, [sp, #4] ; unused argument
ff82d9a4: bl loc_ff86b2e8 ; set startup bits
ff82d9a8: bl loc_ff86b2e4 ; nullsub
ff82d9ac: mov r0, #1
loc_ff82d9b0:
ff82d9b0: pop {r2, r3, r4, r5, r6, r7, r8, pc}
ff86b2e8: ldr r3, =0x2a04
ff86b2ec: cmp r2, #0
ff86b2f0: mov ip, #0
ff86b2f4: movne r2, #0x800000 ; depends on data TCM check
ff86b2f8: str ip, [r3, #4]
ff86b2fc: strne r2, [r3, #4]
ff86b300: cmp r0, #0
ff86b304: ldrne r0, [r3, #4]
ff86b308: orrne r0, r0, #0x200000 ; set this bit if ON/OFF pressed
ff86b30c: strne r0, [r3, #4]
ff86b310: cmp r1, #0
ff86b314: ldrne r0, [r3, #4]
ff86b318: orrne r0, r0, #0x400000 ; set this bit if PLAYBACK? pressed
ff86b31c: strne r0, [r3, #4]
ff86b320: bx lr
'GPIO + bit' table
ffbc0738: c022f484 (0)
ffbc073c: 00001000
ffbc0740: c022f484 (1)
ffbc0744: 00002000
ffbc0748: c022f484 (2)
ffbc074c: 00004000
ffbc0750: c022f484 (3)
ffbc0754: 00008000
ffbc0758: c022f484 (4)
ffbc075c: 00010000
ffbc0760: c022f484 (5)
ffbc0764: 00020000
ffbc0768: c022f484 (6)
ffbc076c: 00040000