// File: occivink[P]pyct/monocypher.cpp
// Function: crypto_x25519_inverse
void crypto_x25519_inverse(u8 blind_salt [32], const u8 private_key[32],
                           const u8 curve_point[32])
{
    static const  u8 Lm2[32] = { // L - 2
        0xeb, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7, 0xa2,
        0xde, 0xf9, 0xde, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, };
    // 1 in Montgomery form
    u32 m_inv [8] = {0x8d98951d, 0xd6ec3174, 0x737dcf70, 0xc6ef5bf4,
                     0xfffffffe, 0xffffffff, 0xffffffff, 0x0fffffff,};

    u8 scalar[32];
    COPY(scalar, private_key, 32);
    trim_scalar(scalar);

    // Convert the scalar in Montgomery form
    // m_scl = scalar * 2^256 (modulo L)
    u32 m_scl[8];
    {
        u32 tmp[16];
        ZERO(tmp, 8);
        load32_le_buf(tmp+8, scalar, 8);
        mod_l(scalar, tmp);
        load32_le_buf(m_scl, scalar, 8);
        WIPE_BUFFER(tmp); // Wipe ASAP to save stack space
    }

    // Compute the inverse
    u32 product[16];
    for (int i = 252; i >= 0; i--) {
        ZERO(product, 16);
        multiply(product, m_inv, m_inv);
        redc(m_inv, product);
        if (scalar_bit(Lm2, i)) {
            ZERO(product, 16);
            multiply(product, m_inv, m_scl);
            redc(m_inv, product);
        }
    }
    // Convert the inverse *out* of Montgomery form
    // scalar = m_inv / 2^256 (modulo L)
    COPY(product, m_inv, 8);
    ZERO(product + 8, 8);
    redc(m_inv, product);
    store32_le_buf(scalar, m_inv, 8); // the *inverse* of the scalar

    // Clear the cofactor of scalar:
    //   cleared = scalar * (3*L + 1)      (modulo 8*L)
    //   cleared = scalar + scalar * 3 * L (modulo 8*L)
    // Note that (scalar * 3) is reduced modulo 8, so we only need the
    // first byte.
    add_xl(scalar, scalar[0] * 3);

    // Recall that 8*L < 2^256. However it is also very close to
    // 2^255. If we spanned the ladder over 255 bits, random tests
    // wouldn't catch the off-by-one error.
    scalarmult(blind_salt, scalar, curve_point, 256);

    WIPE_BUFFER(scalar);   WIPE_BUFFER(m_scl);
    WIPE_BUFFER(product);  WIPE_BUFFER(m_inv);
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x150, %rsp            # imm = 0x150
movq %rdi, -0x8(%rbp)
movq %rsi, -0x10(%rbp)
movq %rdx, -0x18(%rbp)
movq 0xb592(%rip), %rax      # 0x1cfa0
movq %rax, -0x40(%rbp)
movq 0xb58f(%rip), %rax      # 0x1cfa8
movq %rax, -0x38(%rbp)
movq 0xb58c(%rip), %rax      # 0x1cfb0
movq %rax, -0x30(%rbp)
movq 0xb589(%rip), %rax      # 0x1cfb8
movq %rax, -0x28(%rbp)
movq $0x0, -0x68(%rbp)
cmpq $0x20, -0x68(%rbp)
jae 0x11a63
movq -0x10(%rbp), %rax
movq -0x68(%rbp), %rcx
movb (%rax,%rcx), %cl
movq -0x68(%rbp), %rax
movb %cl, -0x60(%rbp,%rax)
movq -0x68(%rbp), %rax
addq $0x1, %rax
movq %rax, -0x68(%rbp)
jmp 0x11a3b
leaq -0x60(%rbp), %rdi
callq 0xd6e0
movq $0x0, -0xd8(%rbp)
cmpq $0x8, -0xd8(%rbp)
jae 0x11aa7
movq -0xd8(%rbp), %rax
movl $0x0, -0xd0(%rbp,%rax,4)
movq -0xd8(%rbp), %rax
addq $0x1, %rax
movq %rax, -0xd8(%rbp)
jmp 0x11a77
leaq -0xd0(%rbp), %rdi
addq $0x20, %rdi
leaq -0x60(%rbp), %rsi
movl $0x8, %edx
callq 0x3990
leaq -0x60(%rbp), %rdi
leaq -0xd0(%rbp), %rsi
callq 0x11d10
leaq -0x90(%rbp), %rdi
leaq -0x60(%rbp), %rsi
movl $0x8, %edx
callq 0x3990
leaq -0xd0(%rbp), %rdi
movl $0x40, %esi
callq 0x3890
movl $0xfc, -0x124(%rbp)
cmpl $0x0, -0x124(%rbp)
jl 0x11bfb
movq $0x0, -0x130(%rbp)
cmpq $0x10, -0x130(%rbp)
jae 0x11b48
movq -0x130(%rbp), %rax
movl $0x0, -0x120(%rbp,%rax,4)
movq -0x130(%rbp), %rax
addq $0x1, %rax
movq %rax, -0x130(%rbp)
jmp 0x11b18
leaq -0x120(%rbp), %rdi
leaq -0x40(%rbp), %rsi
leaq -0x40(%rbp), %rdx
callq 0x12010
leaq -0x40(%rbp), %rdi
leaq -0x120(%rbp), %rsi
callq 0x120e0
movl -0x124(%rbp), %esi
leaq 0xa697(%rip), %rdi      # 0x1c210
callq 0x122a0
cmpl $0x0, %eax
je 0x11be5
movq $0x0, -0x138(%rbp)
cmpq $0x10, -0x138(%rbp)
jae 0x11bbe
movq -0x138(%rbp), %rax
movl $0x0, -0x120(%rbp,%rax,4)
movq -0x138(%rbp), %rax
addq $0x1, %rax
movq %rax, -0x138(%rbp)
jmp 0x11b8e
leaq -0x120(%rbp), %rdi
leaq -0x40(%rbp), %rsi
leaq -0x90(%rbp), %rdx
callq 0x12010
leaq -0x40(%rbp), %rdi
leaq -0x120(%rbp), %rsi
callq 0x120e0
jmp 0x11be7
movl -0x124(%rbp), %eax
addl $-0x1, %eax
movl %eax, -0x124(%rbp)
jmp 0x11b00
movq $0x0, -0x140(%rbp)
cmpq $0x8, -0x140(%rbp)
jae 0x11c3d
movq -0x140(%rbp), %rax
movl -0x40(%rbp,%rax,4), %ecx
movq -0x140(%rbp), %rax
movl %ecx, -0x120(%rbp,%rax,4)
movq -0x140(%rbp), %rax
addq $0x1, %rax
movq %rax, -0x140(%rbp)
jmp 0x11c06
movq $0x0, -0x148(%rbp)
cmpq $0x8, -0x148(%rbp)
jae 0x11c78
movq -0x148(%rbp), %rax
movl $0x0, -0x100(%rbp,%rax,4)
movq -0x148(%rbp), %rax
addq $0x1, %rax
movq %rax, -0x148(%rbp)
jmp 0x11c48
leaq -0x40(%rbp), %rdi
leaq -0x120(%rbp), %rsi
callq 0x120e0
leaq -0x60(%rbp), %rdi
leaq -0x40(%rbp), %rsi
movl $0x8, %edx
callq 0x3ef0
leaq -0x60(%rbp), %rdi
movzbl -0x60(%rbp), %eax
imull $0x3, %eax, %eax
movzbl %al, %esi
callq 0xfac0
movq -0x8(%rbp), %rdi
leaq -0x60(%rbp), %rsi
movq -0x18(%rbp), %rdx
movl $0x100, %ecx            # imm = 0x100
callq 0xd720
leaq -0x60(%rbp), %rdi
movl $0x20, %esi
callq 0x3890
leaq -0x90(%rbp), %rdi
movl $0x20, %esi
callq 0x3890
leaq -0x120(%rbp), %rdi
movl $0x40, %esi
callq 0x3890
leaq -0x40(%rbp), %rdi
movl $0x20, %esi
callq 0x3890
addq $0x150, %rsp            # imm = 0x150
popq %rbp
retq
nopw (%rax,%rax)