They're encrypted? I just figured they were memory dumps instead of Intel Hex.
Code:
000800 00 EC 1C F0 D9 EC 04 F0 EB EC 04 F0 F4 EC 04 F0
000810 3B EC 1C F0 04 00 10 EC 04 F0 0A EF 04 F0 FF 00
000820 F2 B2 19 EC 04 F0 9E B6 24 EC 04 F0 F2 B0 F2 90
000830 12 00 F2 92 82 82 20 0E 45 6E 20 0E D9 6E 00 0E
I spent some time attempting to disassemble it and figure it out. I've attached a PHP file I used to translate from this "dump" format to hex. (Note that it includes a bug in calculating checksums which I never solved.) It acts as a "filter"; it translates from STDIN to STDOUT.
After that, I used a modified version of picdis18 (removed checksum checks) to convert it to assembly. I didn't get much farther than this, because I don't know ASM18.
If you were to spy as IFI Loader downloaded the "firmware", I think what would actually be downloaded is to the user proc that loads the firmware proper onto the master proc.
If anyone gets farther on this, I'd love to know.