PC = current Instruction pointer + instruction length
PC = IP + 4
PC = 0x176E4 + 4 == 176E8
destination = 0x1768C
offset is encoded as a signed number of ((destination - PC)>>1)
:\>python -c "print(hex((0x1768c-0x176e8)>>1))
unconditional jump B can be encoded from E0 00 to E7 FF
==> E + (0x0 to 0x7ff ) == 0b1110 + (...
This is an unconditional branch (thumb)
It is encoded as 11100|signed 11-bit immediate offset
E 7 D 2
1110 0111 1101 0010
so your 11-bit offset is 0b11111010010. This is sign extended to -46
The operation is:
PC = PC + (SignExtend(signed_immed_11) << 1)
where the first PC contains the address of the branch plus 4.
0x176E4 + 4 + (-46 * 2) ==...
The thing that is unclear to me is what happens in the code block from 00088868 to 00088898. In a plausible scenario, the flow should continue from 000888BE. In that case, this is a TEA encryption function, as can be seen from the 0x9E3779B9 signature, characteristic of the TEA cipher and its modifications like XTEA, and the code at 000888E0, which is ...