Try one of the following locations (and check how reliably they are reached):
"loc_FFAD7E4C:\n"
" BL sub_FF99A620 \n"
" LDR R8, =0xFFAD7C10 \n"
" TST R5, #1 \n"
" BNE loc_FFAD7ECC \n"
/* first one */
" LDR R0, [R7, #0x100] \n"
" CMP R0, #0 \n"
" BNE loc_FFAD7E84 \n"
/* second one */
" MOV R0, R4 \n"
" BL sub_FF99C0E4 \n"
" TST R0, #1 \n"
" LDRNE R2, =0x1FD \n"
" LDRNE R1, =0xFFAD7F40 \n"
" MOVNE R0, #0 \n"
" BLNE sub_FF824DDC \n"
sub_FF99C0E4 is a function in SsCreateJpeg.c, I suspect it might be related to JPEG compression. sub_FF99A620 (aka sub_FF87F7B4) frees up a semaphore which might be called "CaptAndFileSem" from the source file it is related to.
The sx170 firmware sends a message to dvlpseqtask at the point where this fw calls sub_FF99C0E4.