LLM4Binary/decompile-bench-makefile huggingface dataset:
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: mul_add(unsigned char*, unsigned char const*, unsigned char const*, unsigned char const*)
static void mul_add(u8 r[32], const u8 a[32], const u8 b[32], const u8 c[32])
{
    u32 A[8];  load32_le_buf(A, a, 8);
    u32 B[8];  load32_le_buf(B, b, 8);
    u32 p[16]; load32_le_buf(p, c, 8);  ZERO(p + 8, 8);
    multiply(p, A, B);
    mod_l(r, p);
    WIPE_BUFFER(p);
    WIPE_BUFFER(A);
    WIPE_BUFFER(B);
}

// Assembly:
subq $0x88, %rsp
movups (%rsi), %xmm0
movups 0x10(%rsi), %xmm1
movaps %xmm1, 0x30(%rsp)
movaps %xmm0, 0x20(%rsp)
movups (%rdx), %xmm0
movups 0x10(%rdx), %xmm1
movaps %xmm1, 0x10(%rsp)
movaps %xmm0, (%rsp)
movups (%rcx), %xmm0
movups 0x10(%rcx), %xmm1
leaq 0x40(%rsp), %rax
movaps %xmm1, 0x10(%rax)
movaps %xmm0, (%rax)
xorps %xmm0, %xmm0
movaps %xmm0, 0x20(%rax)
movaps %xmm0, 0x30(%rax)
xorl %ecx, %ecx
movl 0x20(%rsp,%rcx,4), %edx
xorl %r8d, %r8d
xorl %esi, %esi
movl (%rax,%r8,4), %r9d
addq %rsi, %r9
movl (%rsp,%r8,4), %esi
imulq %rdx, %rsi
addq %r9, %rsi
movl %esi, (%rax,%r8,4)
shrq $0x20, %rsi
incq %r8
cmpq $0x8, %r8
jne 0x67a7
movl %esi, 0x60(%rsp,%rcx,4)
incq %rcx
addq $0x4, %rax
cmpq $0x8, %rcx
jne 0x679e
leaq 0x40(%rsp), %rsi
callq 0x91a1
xorl %eax, %eax
movb $0x0, 0x40(%rsp,%rax)
incq %rax
cmpq $0x40, %rax
jne 0x67e7
xorl %eax, %eax
movb $0x0, 0x20(%rsp,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x67f7
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x6807
addq $0x88, %rsp
retq
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: crypto_sign
void crypto_sign(u8        signature[64],
                 const u8  secret_key[32],
                 const u8  public_key[32],
                 const u8 *message, size_t message_size)
{
    crypto_sign_ctx ctx;
    crypto_sign_ctx_abstract *actx = (crypto_sign_ctx_abstract*)&ctx;
    crypto_sign_init_first_pass (actx, secret_key, public_key);
    crypto_sign_update          (actx, message, message_size);
    crypto_sign_init_second_pass(actx);
    crypto_sign_update          (actx, message, message_size);
    crypto_sign_final           (actx, signature);
}

// Assembly:
pushq %r15
pushq %r14
pushq %r12
pushq %rbx
subq $0x168, %rsp            # imm = 0x168
movq %r8, %rbx
movq %rcx, %r14
movq %rdi, %r15
leaq 0xb52e(%rip), %rcx      # 0x11d68
movq %rsp, %r12
movq %r12, %rdi
callq 0x654a
movq (%r12), %rax
movq %r12, %rdi
movq %r14, %rsi
movq %rbx, %rdx
callq *0x10(%rax)
movq %r12, %rdi
callq 0x65d7
movq (%r12), %rax
movq %r12, %rdi
movq %r14, %rsi
movq %rbx, %rdx
callq *0x10(%rax)
movq %r12, %rdi
movq %r15, %rsi
callq 0x6699
addq $0x168, %rsp            # imm = 0x168
popq %rbx
popq %r12
popq %r14
popq %r15
retq
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: crypto_check_init_custom_hash
void crypto_check_init_custom_hash(crypto_check_ctx_abstract *ctx,
                                   const u8 signature[64],
                                   const u8 public_key[32],
                                   const crypto_sign_vtable *hash)
{
    ctx->hash = hash; // set vtable
    COPY(ctx->buf, signature , 64);
    COPY(ctx->pk , public_key, 32);
    ctx->hash->init  (ctx);
    ctx->hash->update(ctx, signature , 32);
    ctx->hash->update(ctx, public_key, 32);
}

// Assembly:
pushq %r15
pushq %r14
pushq %rbx
movq %rdx, %rbx
movq %rsi, %r15
movq %rdi, %r14
movq %rcx, (%rdi)
movl $0x8, %eax
movb -0x8(%r15,%rax), %dl
movb %dl, (%r14,%rax)
incq %rax
cmpq $0x48, %rax
jne 0x689d
xorl %eax, %eax
movb (%rbx,%rax), %dl
movb %dl, 0x68(%r14,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x68b1
movq %r14, %rdi
callq *0x8(%rcx)
movq (%r14), %rax
movl $0x20, %edx
movq %r14, %rdi
movq %r15, %rsi
callq *0x10(%rax)
movq (%r14), %rax
movq 0x10(%rax), %rax
movl $0x20, %edx
movq %r14, %rdi
movq %rbx, %rsi
popq %rbx
popq %r14
popq %r15
jmpq *%rax
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: crypto_from_eddsa_private
void crypto_from_eddsa_private(u8 x25519[32], const u8 eddsa[32])
{
    u8 a[64];
    crypto_blake2b(a, eddsa, 32);
    COPY(x25519, a, 32);
    WIPE_BUFFER(a);
}

// Assembly:
pushq %r15
pushq %r14
pushq %rbx
subq $0x120, %rsp            # imm = 0x120
movq %rdi, %rbx
movaps 0x61e1(%rip), %xmm0     # 0xd0c0
leaq 0x40(%rsp), %r14
movaps %xmm0, (%r14)
movaps 0x6201(%rip), %xmm0     # 0xd0f0
movaps %xmm0, 0x30(%r14)
movaps 0x61e5(%rip), %xmm0     # 0xd0e0
movaps %xmm0, 0x20(%r14)
movaps 0x61c9(%rip), %xmm0     # 0xd0d0
movaps %xmm0, 0x10(%r14)
movabsq $0x6a09e667f2bdc948, %rax # imm = 0x6A09E667F2BDC948
movq %rax, (%r14)
xorps %xmm0, %xmm0
movaps %xmm0, 0x40(%r14)
movq $0x40, 0xd8(%r14)
movq $0x0, 0xd0(%r14)
movl $0x20, %edx
movq %r14, %rdi
callq 0x2f4e
movq %rsp, %r15
movq %r14, %rdi
movq %r15, %rsi
callq 0x47a9
movaps (%r15), %xmm0
movaps 0x10(%r15), %xmm1
movups %xmm1, 0x10(%rbx)
movups %xmm0, (%rbx)
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x40, %rax
jne 0x6f64
addq $0x120, %rsp            # imm = 0x120
popq %rbx
popq %r14
popq %r15
retq
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: crypto_from_eddsa_public
void crypto_from_eddsa_public(u8 x25519[32], const u8 eddsa[32])
{
    fe t1, t2;
    fe_frombytes(t2, eddsa);
    fe_add(t1, fe_one, t2);
    fe_sub(t2, fe_one, t2);
    fe_invert(t2, t2);
    fe_mul(t1, t1, t2);
    fe_tobytes(x25519, t1);
    WIPE_BUFFER(t1);
    WIPE_BUFFER(t2);
}

// Assembly:
pushq %r15
pushq %r14
pushq %rbx
subq $0x60, %rsp
movq %rdi, %rbx
movq %rsp, %rdi
movl $0x1, %edx
callq 0x8084
xorl %ecx, %ecx
leaq 0x6e40(%rip), %rax      # 0xdde0
movl (%rsp,%rcx), %edx
addl (%rcx,%rax), %edx
movl %edx, 0x30(%rsp,%rcx)
addq $0x4, %rcx
cmpq $0x28, %rcx
jne 0x6fa0
xorl %ecx, %ecx
movl (%rcx,%rax), %edx
subl (%rsp,%rcx), %edx
movl %edx, (%rsp,%rcx)
addq $0x4, %rcx
cmpq $0x28, %rcx
jne 0x6fb6
movq %rsp, %r14
movq %r14, %rdi
movq %r14, %rsi
callq 0x701e
leaq 0x30(%rsp), %r15
movq %r15, %rdi
movq %r15, %rsi
movq %r14, %rdx
callq 0x7075
movq %rbx, %rdi
movq %r15, %rsi
callq 0x7887
xorl %eax, %eax
movb $0x0, 0x30(%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x6ff7
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x7007
addq $0x60, %rsp
popq %rbx
popq %r14
popq %r15
retq
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: fe_invert(int*, int const*)
static void fe_invert(fe out, const fe x)
{
    fe tmp;
    fe_sq(tmp, x);
    invsqrt(tmp, tmp);
    fe_sq(tmp, tmp);
    fe_mul(out, tmp, x);
    WIPE_BUFFER(tmp);
}

// Assembly:
pushq %r15
pushq %r14
pushq %rbx
subq $0x30, %rsp
movq %rsi, %rbx
movq %rdi, %r14
movq %rsp, %r15
movq %r15, %rdi
callq 0x82b2
movq %r15, %rdi
movq %r15, %rsi
callq 0x8793
movq %r15, %rdi
movq %r15, %rsi
callq 0x82b2
movq %r14, %rdi
movq %r15, %rsi
movq %rbx, %rdx
callq 0x7075
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x705e
addq $0x30, %rsp
popq %rbx
popq %r14
popq %r15
retq
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: crypto_x25519_dirty_small
void crypto_x25519_dirty_small(u8 public_key[32], const u8 secret_key[32])
{
    // Base point of order 8*L
    // Raw scalar multiplication with it does not clear the cofactor,
    // and the resulting public key will reveal 3 bits of the scalar.
    //
    // The low order component of this base point  has been chosen
    // to yield the same results as crypto_x25519_dirty_fast().
    static const u8 dirty_base_point[32] = {
        0xd8, 0x86, 0x1a, 0xa2, 0x78, 0x7a, 0xd9, 0x26, 0x8b, 0x74, 0x74, 0xb6,
        0x82, 0xe3, 0xbe, 0xc3, 0xce, 0x36, 0x9a, 0x1e, 0x5e, 0x31, 0x47, 0xa2,
        0x6d, 0x37, 0x7c, 0xfd, 0x20, 0xb5, 0xdf, 0x75,
    };
    // separate the main factor & the cofactor of the scalar
    u8 scalar[32];
    COPY(scalar, secret_key, 32);
    trim_scalar(scalar);

    // Separate the main factor and the cofactor
    //
    // The scalar is trimmed, so its cofactor is cleared.  The three
    // least significant bits however still have a main factor.  We must
    // remove it for X25519 compatibility.
    //
    //   cofactor = lsb * L            (modulo 8*L)
    //   combined = scalar + cofactor  (modulo 8*L)
    add_xl(scalar, secret_key[0]);
    scalarmult(public_key, scalar, dirty_base_point, 256);
    WIPE_BUFFER(scalar);
}

// Assembly:
pushq %r14
pushq %rbx
subq $0x28, %rsp
movq %rdi, %rbx
movups (%rsi), %xmm0
movups 0x10(%rsi), %xmm1
movq %rsp, %r14
movaps %xmm0, (%r14)
movaps %xmm1, 0x10(%r14)
andb $-0x8, (%r14)
movb 0x1f(%r14), %al
andb $0x3f, %al
orb $0x40, %al
movb %al, 0x1f(%r14)
movzbl (%rsi), %esi
movq %r14, %rdi
callq 0x7a93
leaq 0x56b4(%rip), %rdx      # 0xd120
movq %rbx, %rdi
movq %r14, %rsi
movl $0x100, %ecx            # imm = 0x100
callq 0x5e4e
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x7a7e
addq $0x28, %rsp
popq %rbx
popq %r14
retq
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: add_xl(unsigned char*, unsigned char)
static void add_xl(u8 s[32], u8 x)
{
    u64 mod8  = x & 7;
    u64 carry = 0;
    FOR (i , 0, 8) {
        carry = carry + load32_le(s + 4*i) + L[i] * mod8;
        store32_le(s + 4*i, (u32)carry);
        carry >>= 32;
    }
}

// Assembly:
andl $0x7, %esi
xorl %eax, %eax
leaq 0x6441(%rip), %rcx      # 0xdee0
xorl %edx, %edx
movl (%rdi,%rax), %r8d
addq %rdx, %r8
movl (%rax,%rcx), %edx
imulq %rsi, %rdx
addq %r8, %rdx
movl %edx, (%rdi,%rax)
shrq $0x20, %rdx
addq $0x4, %rax
cmpq $0x20, %rax
jne 0x7aa1
retq
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: ge_madd(ge*, ge const*, ge_precomp const*, int*, int*)
static void ge_madd(ge *s, const ge *p, const ge_precomp *q, fe a, fe b)
{
    fe_add(a   , p->Y, p->X );
    fe_sub(b   , p->Y, p->X );
    fe_mul(a   , a   , q->Yp);
    fe_mul(b   , b   , q->Ym);
    fe_add(s->Y, a   , b    );
    fe_sub(s->X, a   , b    );

    fe_add(s->Z, p->Z, p->Z );
    fe_mul(s->T, p->T, q->T2);
    fe_add(a   , s->Z, s->T );
    fe_sub(b   , s->Z, s->T );

    fe_mul(s->T, s->X, s->Y);
    fe_mul(s->X, s->X, b   );
    fe_mul(s->Y, s->Y, a   );
    fe_mul(s->Z, a   , b   );
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x18, %rsp
movq %r8, %rbx
movq %rcx, %r14
movq %rdx, %r12
movq %rsi, %rbp
movq %rdi, %r15
xorl %eax, %eax
movl (%rbp,%rax,4), %ecx
addl 0x28(%rbp,%rax,4), %ecx
movl %ecx, (%r14,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x7d48
xorl %eax, %eax
movl 0x28(%rbp,%rax,4), %ecx
subl (%rbp,%rax,4), %ecx
movl %ecx, (%rbx,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x7d5f
movq %r14, %rdi
movq %r14, %rsi
movq %r12, %rdx
callq 0x7075
leaq 0x28(%r12), %rdx
movq %rbx, %rdi
movq %rbx, %rsi
callq 0x7075
leaq 0x28(%r15), %rax
movq %rax, 0x10(%rsp)
xorl %eax, %eax
movl (%rbx,%rax,4), %ecx
addl (%r14,%rax,4), %ecx
movl %ecx, 0x28(%r15,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x7d9c
xorl %eax, %eax
movl (%r14,%rax,4), %ecx
subl (%rbx,%rax,4), %ecx
movl %ecx, (%r15,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x7db3
leaq 0x50(%r15), %rax
movq %rax, 0x8(%rsp)
movl $0x14, %eax
movl (%rbp,%rax,4), %ecx
addl %ecx, %ecx
movl %ecx, (%r15,%rax,4)
incq %rax
cmpq $0x1e, %rax
jne 0x7dd5
leaq 0x78(%r15), %r13
addq $0x78, %rbp
addq $0x50, %r12
movq %r13, %rdi
movq %rbp, %rsi
movq %r12, %rdx
callq 0x7075
movl $0x14, %eax
movl 0x28(%r15,%rax,4), %ecx
addl (%r15,%rax,4), %ecx
movl %ecx, -0x50(%r14,%rax,4)
incq %rax
cmpq $0x1e, %rax
jne 0x7e07
movl $0x14, %eax
movl (%r15,%rax,4), %ecx
subl 0x28(%r15,%rax,4), %ecx
movl %ecx, -0x50(%rbx,%rax,4)
incq %rax
cmpq $0x1e, %rax
jne 0x7e23
movq %r13, %rdi
movq %r15, %rsi
movq 0x10(%rsp), %r12
movq %r12, %rdx
callq 0x7075
movq %r15, %rdi
movq %r15, %rsi
movq %rbx, %rdx
callq 0x7075
movq %r12, %rdi
movq %r12, %rsi
movq %r14, %rdx
callq 0x7075
movq 0x8(%rsp), %rdi
movq %r14, %rsi
movq %rbx, %rdx
addq $0x18, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
jmp 0x7075
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: crypto_hidden_to_curve
void crypto_hidden_to_curve(uint8_t curve[32], const uint8_t hidden[32])
{
    fe r, u, t1, t2, t3;
    fe_frombytes_mask(r, hidden, 2); // r is encoded in 254 bits.
    fe_sq(r, r);
    fe_add(t1, r, r);
    fe_add(u, t1, fe_one);
    fe_sq (t2, u);
    fe_mul(t3, A2, t1);
    fe_sub(t3, t3, t2);
    fe_mul(t3, t3, A);
    fe_mul(t1, t2, u);
    fe_mul(t1, t3, t1);
    int is_square = invsqrt(t1, t1);
    fe_mul(u, r, ufactor);
    fe_ccopy(u, fe_one, is_square);
    fe_sq (t1, t1);
    fe_mul(u, u, A);
    fe_mul(u, u, t3);
    fe_mul(u, u, t2);
    fe_mul(u, u, t1);
    fe_neg(u, u);
    fe_tobytes(curve, u);

    WIPE_BUFFER(t1);  WIPE_BUFFER(r);
    WIPE_BUFFER(t2);  WIPE_BUFFER(u);
    WIPE_BUFFER(t3);
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0xe8, %rsp
movq %rdi, %rbx
leaq 0xc0(%rsp), %r14
movq %r14, %rdi
movl $0x2, %edx
callq 0x8084
movq %r14, %rdi
movq %r14, %rsi
callq 0x82b2
xorl %eax, %eax
movl 0xc0(%rsp,%rax,4), %ecx
addl %ecx, %ecx
movl %ecx, 0x30(%rsp,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x7ebc
xorl %eax, %eax
leaq 0x5f05(%rip), %r13      # 0xdde0
movl (%rax,%r13), %ecx
addl 0x30(%rsp,%rax), %ecx
movl %ecx, (%rsp,%rax)
addq $0x4, %rax
cmpq $0x28, %rax
jne 0x7edb
leaq 0x90(%rsp), %rdi
movq %rsp, %rsi
callq 0x82b2
leaq 0x5f09(%rip), %rsi      # 0xde10
leaq 0x60(%rsp), %rdi
leaq 0x30(%rsp), %rdx
callq 0x7075
xorl %eax, %eax
movl 0x90(%rsp,%rax,4), %ecx
subl %ecx, 0x60(%rsp,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x7f18
leaq 0x5f0d(%rip), %rdx      # 0xde40
leaq 0x60(%rsp), %r14
movq %r14, %rdi
movq %r14, %rsi
callq 0x7075
leaq 0x30(%rsp), %r15
leaq 0x90(%rsp), %rsi
movq %rsp, %r12
movq %r15, %rdi
movq %r12, %rdx
callq 0x7075
movq %r15, %rdi
movq %r14, %rsi
movq %r15, %rdx
callq 0x7075
movq %r15, %rdi
movq %r15, %rsi
callq 0x8793
movl %eax, %ebp
leaq 0x5280(%rip), %rdx      # 0xd200
leaq 0xc0(%rsp), %rsi
movq %r12, %rdi
callq 0x7075
negl %ebp
xorl %eax, %eax
movl (%rsp,%rax), %ecx
movl (%rax,%r13), %edx
xorl %ecx, %edx
andl %ebp, %edx
xorl %ecx, %edx
movl %edx, (%rsp,%rax)
addq $0x4, %rax
cmpq $0x28, %rax
jne 0x7f94
leaq 0x30(%rsp), %r14
movq %r14, %rdi
movq %r14, %rsi
callq 0x82b2
leaq 0x5e7b(%rip), %rdx      # 0xde40
movq %rsp, %r15
movq %r15, %rdi
movq %r15, %rsi
callq 0x7075
leaq 0x60(%rsp), %rdx
movq %r15, %rdi
movq %r15, %rsi
callq 0x7075
leaq 0x90(%rsp), %rdx
movq %r15, %rdi
movq %r15, %rsi
callq 0x7075
movq %r15, %rdi
movq %r15, %rsi
movq %r14, %rdx
callq 0x7075
xorl %eax, %eax
negl (%rsp,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x8006
movq %rsp, %rsi
movq %rbx, %rdi
callq 0x7887
xorl %eax, %eax
movb $0x0, 0x30(%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x801f
xorl %eax, %eax
movb $0x0, 0xc0(%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x802f
xorl %eax, %eax
movb $0x0, 0x90(%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x8042
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x8055
xorl %eax, %eax
movb $0x0, 0x60(%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x8064
addq $0xe8, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: crypto_curve_to_hidden
int crypto_curve_to_hidden(u8 hidden[32], const u8 public_key[32], u8 tweak)
{
    fe t1, t2, t3;
    fe_frombytes(t1, public_key);    // t1 = u

    fe_add(t2, t1, A);               // t2 = u + A
    fe_mul(t3, t1, t2);
    fe_mul_small(t3, t3, -2);
    int is_square = invsqrt(t3, t3); // t3 = sqrt(-1 / non_square * u * (u+A))
    if (is_square) {
        // The only variable time bit.  This ultimately reveals how many
        // tries it took us to find a representable key.
        // This does not affect security as long as we try keys at random.

        fe_ccopy    (t1, t2, tweak & 1); // multiply by u if v is positive,
        fe_mul      (t3, t1, t3);        // multiply by u+A otherwise
        fe_mul_small(t1, t3, 2);
        fe_neg      (t2, t3);
        fe_ccopy    (t3, t2, fe_isodd(t1));
        fe_tobytes(hidden, t3);

        // Pad with two random bits
        hidden[31] |= tweak & 0xc0;
    }

    WIPE_BUFFER(t1);
    WIPE_BUFFER(t2);
    WIPE_BUFFER(t3);
    return is_square - 1;
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r12
pushq %rbx
subq $0xb0, %rsp
movl %edx, %ebx
movq %rdi, %r14
movq %rsp, %rdi
movl $0x1, %edx
callq 0x8084
xorl %eax, %eax
leaq 0x5337(%rip), %rcx      # 0xde40
movl (%rax,%rcx), %edx
addl (%rsp,%rax), %edx
movl %edx, 0x60(%rsp,%rax)
addq $0x4, %rax
cmpq $0x28, %rax
jne 0x8b09
leaq 0x30(%rsp), %r15
movq %rsp, %rsi
leaq 0x60(%rsp), %rdx
movq %r15, %rdi
callq 0x7075
movq %r15, %rdi
movq %r15, %rsi
movl $0xfffffffe, %edx       # imm = 0xFFFFFFFE
callq 0x8c59
movq %r15, %rdi
movq %r15, %rsi
callq 0x8793
movl %eax, %ebp
testl %eax, %eax
je 0x8c16
movl %ebx, %eax
andb $0x1, %al
movzbl %al, %eax
negl %eax
xorl %ecx, %ecx
movl (%rsp,%rcx,4), %edx
movl 0x60(%rsp,%rcx,4), %esi
xorl %edx, %esi
andl %eax, %esi
xorl %edx, %esi
movl %esi, (%rsp,%rcx,4)
incq %rcx
cmpq $0xa, %rcx
jne 0x8b62
movq %rsp, %r15
leaq 0x30(%rsp), %r12
movq %r12, %rdi
movq %r15, %rsi
movq %r12, %rdx
callq 0x7075
movq %r15, %rdi
movq %r12, %rsi
movl $0x2, %edx
callq 0x8c59
xorl %eax, %eax
xorl %ecx, %ecx
subl 0x30(%rsp,%rax,4), %ecx
movl %ecx, 0x60(%rsp,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x8ba3
leaq 0x90(%rsp), %r15
movq %rsp, %rsi
movq %r15, %rdi
callq 0x7887
movzbl (%r15), %eax
xorl %ecx, %ecx
movb $0x0, 0x90(%rsp,%rcx)
incq %rcx
cmpq $0x20, %rcx
jne 0x8bcf
andl $0x1, %eax
negl %eax
xorl %ecx, %ecx
movl 0x30(%rsp,%rcx,4), %edx
movl 0x60(%rsp,%rcx,4), %esi
xorl %edx, %esi
andl %eax, %esi
xorl %edx, %esi
movl %esi, 0x30(%rsp,%rcx,4)
incq %rcx
cmpq $0xa, %rcx
jne 0x8be7
leaq 0x30(%rsp), %rsi
movq %r14, %rdi
callq 0x7887
andb $-0x40, %bl
orb %bl, 0x1f(%r14)
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x8c18
xorl %eax, %eax
movb $0x0, 0x60(%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x8c27
xorl %eax, %eax
movb $0x0, 0x30(%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x8c37
decl %ebp
movl %ebp, %eax
addq $0xb0, %rsp
popq %rbx
popq %r12
popq %r14
popq %r15
popq %rbp
retq
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: crypto_hidden_key_pair
void crypto_hidden_key_pair(u8 hidden[32], u8 secret_key[32], u8 seed[32])
{
    u8 pk [32]; // public key
    u8 buf[64]; // seed + representative
    COPY(buf + 32, seed, 32);
    do {
        crypto_chacha20(buf, 0, 64, buf+32, zero);
        crypto_x25519_dirty_fast(pk, buf); // or the "small" version
    } while(crypto_curve_to_hidden(buf+32, pk, buf[32]));
    // Note that the return value of crypto_curve_to_hidden() is
    // independent from its tweak parameter.
    // Therefore, buf[32] is not actually reused.  Either we loop one
    // more time and buf[32] is used for the new seed, or we succeeded,
    // and buf[32] becomes the tweak parameter.

    crypto_wipe(seed, 32);
    COPY(hidden    , buf + 32, 32);
    COPY(secret_key, buf     , 32);
    WIPE_BUFFER(buf);
    WIPE_BUFFER(pk);
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x78, %rsp
movq %rdx, %r15
movq %rsi, 0x8(%rsp)
movq %rdi, %r14
leaq 0x30(%rsp), %r12
movups (%rdx), %xmm0
movups 0x10(%rdx), %xmm1
movaps %xmm1, 0x10(%r12)
movaps %xmm0, (%r12)
leaq 0x41e2(%rip), %r13      # 0xd040
leaq 0x10(%rsp), %rbp
leaq 0x50(%rsp), %rbx
movl $0x40, %edx
movq %rbp, %rdi
xorl %esi, %esi
movq %r12, %rcx
movq %r13, %r8
xorl %r9d, %r9d
callq 0x2865
movq %rbx, %rdi
movq %rbp, %rsi
callq 0x7ac4
movzbl 0x30(%rsp), %edx
movq %r12, %rdi
movq %rbx, %rsi
callq 0x8adf
testl %eax, %eax
jne 0x8e68
xorl %eax, %eax
movb $0x0, (%r15,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x8ea1
movups (%r12), %xmm0
movups 0x10(%r12), %xmm1
movups %xmm1, 0x10(%r14)
movups %xmm0, (%r14)
movaps 0x10(%rsp), %xmm0
movaps 0x20(%rsp), %xmm1
movq 0x8(%rsp), %rax
movups %xmm1, 0x10(%rax)
movups %xmm0, (%rax)
xorl %eax, %eax
movb $0x0, 0x10(%rsp,%rax)
incq %rax
cmpq $0x40, %rax
jne 0x8edb
xorl %eax, %eax
movb $0x0, 0x50(%rsp,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x8eeb
addq $0x78, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: mod_l(unsigned char*, unsigned int const*)
static void mod_l(u8 reduced[32], const u32 x[16])
{
    static const u32 r[9] = {0x0a2c131b,0xed9ce5a3,0x086329a7,0x2106215d,
                             0xffffffeb,0xffffffff,0xffffffff,0xffffffff,0xf,};
    // xr = x * r
    u32 xr[25] = {0};
    FOR (i, 0, 9) {
        u64 carry = 0;
        FOR (j, 0, 16) {
            carry  += xr[i+j] + (u64)r[i] * x[j];
            xr[i+j] = (u32)carry;
            carry >>= 32;
        }
        xr[i+16] = (u32)carry;
    }
    // xr = floor(xr / 2^512) * L
    // Since the result is guaranteed to be below 2*L,
    // it is enough to only compute the first 256 bits.
    // The division is performed by saying xr[i+16]. (16 * 32 = 512)
    ZERO(xr, 8);
    FOR (i, 0, 8) {
        u64 carry = 0;
        FOR (j, 0, 8-i) {
            carry   += xr[i+j] + (u64)xr[i+16] * L[j];
            xr[i+j] = (u32)carry;
            carry >>= 32;
        }
    }
    // xr = x - xr
    u64 carry = 1;
    FOR (i, 0, 8) {
        carry  += (u64)x[i] + (~xr[i] & 0xffffffff);
        xr[i]   = (u32)carry;
        carry >>= 32;
    }
    // Final reduction modulo L (conditional subtraction)
    remove_l(xr, xr);
    store32_le_buf(reduced, xr, 8);

    WIPE_BUFFER(xr);
}

// Assembly:
pushq %r15
pushq %r14
pushq %rbx
subq $0x70, %rsp
movq %rdi, %rbx
xorps %xmm0, %xmm0
movq %rsp, %rax
movaps %xmm0, 0x50(%rax)
movaps %xmm0, 0x40(%rax)
movaps %xmm0, 0x30(%rax)
movaps %xmm0, 0x20(%rax)
movaps %xmm0, 0x10(%rax)
movaps %xmm0, (%rax)
movl $0x0, 0x60(%rax)
xorl %ecx, %ecx
leaq 0x4c96(%rip), %rdx      # 0xde70
movl (%rdx,%rcx,4), %edi
xorl %r9d, %r9d
xorl %r8d, %r8d
movl (%rax,%r9,4), %r10d
addq %r8, %r10
movl (%rsi,%r9,4), %r8d
imulq %rdi, %r8
addq %r10, %r8
movl %r8d, (%rax,%r9,4)
shrq $0x20, %r8
incq %r9
cmpq $0x10, %r9
jne 0x91e3
movl %r8d, 0x40(%rsp,%rcx,4)
incq %rcx
addq $0x4, %rax
cmpq $0x9, %rcx
jne 0x91da
xorps %xmm0, %xmm0
movq %rsp, %rax
movaps %xmm0, 0x10(%rax)
movaps %xmm0, (%rax)
xorl %ecx, %ecx
leaq 0x4cb2(%rip), %rdx      # 0xdee0
movl $0x8, %edi
subq %rcx, %rdi
movq %rcx, %r8
orq $0x10, %r8
movq %rdx, %r9
xorl %r10d, %r10d
xorl %r11d, %r11d
movl (%rax,%r10,4), %r14d
addq %r11, %r14
movl (%rsp,%r8,4), %r15d
movl (%r9), %r11d
imulq %r15, %r11
addq %r14, %r11
movl %r11d, (%rax,%r10,4)
shrq $0x20, %r11
incq %r10
addq $0x4, %r9
cmpq %rdi, %r10
jb 0x9246
incq %rcx
addq $0x4, %rax
cmpq $0x8, %rcx
jne 0x922e
movl $0x1, %eax
xorl %ecx, %ecx
movl (%rsi,%rcx,4), %edx
addq %rax, %rdx
movl (%rsp,%rcx,4), %eax
notl %eax
addq %rdx, %rax
movl %eax, (%rsp,%rcx,4)
shrq $0x20, %rax
incq %rcx
cmpq $0x8, %rcx
jne 0x9283
movq %rsp, %rdi
movq %rdi, %rsi
callq 0x9e55
xorl %eax, %eax
movl (%rsp,%rax,4), %ecx
movl %ecx, (%rbx,%rax,4)
incq %rax
cmpq $0x8, %rax
jne 0x92ae
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x64, %rax
jne 0x92bf
addq $0x70, %rsp
popq %rbx
popq %r14
popq %r15
retq
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: redc(unsigned int*, unsigned int*)
static void redc(u32 u[8], u32 x[16])
{
    static const u32 k[8] = { 0x12547e1b, 0xd2b51da3, 0xfdba84ff, 0xb1a206f2,
                              0xffa36bea, 0x14e75438, 0x6fe91836, 0x9db6c6f2, };

    // s = x * k (modulo 2^256)
    // This is cheaper than the full multiplication.
    u32 s[8] = {0};
    FOR (i, 0, 8) {
        u64 carry = 0;
        FOR (j, 0, 8-i) {
            carry  += s[i+j] + (u64)x[i] * k[j];
            s[i+j]  = (u32)carry;
            carry >>= 32;
        }
    }
    u32 t[16] = {0};
    multiply(t, s, L);

    // t = t + x
    u64 carry = 0;
    FOR (i, 0, 16) {
        carry  += (u64)t[i] + x[i];
        t[i]    = (u32)carry;
        carry >>= 32;
    }

    // u = (t / 2^256) % L
    // Note that t / 2^256 is always below 2*L,
    // So a constant time conditional subtraction is enough
    remove_l(u, t+8);

    WIPE_BUFFER(s);
    WIPE_BUFFER(t);
}

// Assembly:
pushq %r14
pushq %rbx
subq $0x68, %rsp
xorps %xmm0, %xmm0
leaq 0x40(%rsp), %rax
movaps %xmm0, 0x10(%rax)
movaps %xmm0, (%rax)
xorl %ecx, %ecx
leaq 0x4c0b(%rip), %rdx      # 0xdf00
movl $0x8, %r8d
subq %rcx, %r8
movl (%rsi,%rcx,4), %r9d
movq %rdx, %r10
xorl %r11d, %r11d
xorl %ebx, %ebx
movl (%rax,%r11,4), %r14d
addq %rbx, %r14
movl (%r10), %ebx
imulq %r9, %rbx
addq %r14, %rbx
movl %ebx, (%rax,%r11,4)
shrq $0x20, %rbx
incq %r11
addq $0x4, %r10
cmpq %r8, %r11
jb 0x930a
incq %rcx
addq $0x4, %rax
cmpq $0x8, %rcx
jne 0x92f5
xorps %xmm0, %xmm0
movq %rsp, %rax
movaps %xmm0, 0x30(%rax)
movaps %xmm0, 0x20(%rax)
movaps %xmm0, 0x10(%rax)
movaps %xmm0, (%rax)
xorl %ecx, %ecx
leaq 0x4b86(%rip), %rdx      # 0xdee0
movl 0x40(%rsp,%rcx,4), %r8d
xorl %r10d, %r10d
xorl %r9d, %r9d
movl (%rax,%r10), %r11d
addq %r9, %r11
movl (%r10,%rdx), %r9d
imulq %r8, %r9
addq %r11, %r9
movl %r9d, (%rax,%r10)
shrq $0x20, %r9
addq $0x4, %r10
cmpq $0x20, %r10
jne 0x9365
movl %r9d, 0x20(%rsp,%rcx,4)
incq %rcx
addq $0x4, %rax
cmpq $0x8, %rcx
jne 0x935a
xorl %eax, %eax
xorl %ecx, %ecx
movl (%rsp,%rax,4), %edx
addq %rcx, %rdx
movl (%rsi,%rax,4), %ecx
addq %rdx, %rcx
movl %ecx, (%rsp,%rax,4)
shrq $0x20, %rcx
incq %rax
cmpq $0x10, %rax
jne 0x939f
leaq 0x20(%rsp), %rsi
callq 0x9e55
xorl %eax, %eax
movb $0x0, 0x40(%rsp,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x93c7
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x40, %rax
jne 0x93d7
addq $0x68, %rsp
popq %rbx
popq %r14
retq
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: crypto_lock_aead
void crypto_lock_aead(u8 mac[16], u8 *cipher_text,
                      const u8  key[32], const u8  nonce[24],
                      const u8 *ad        , size_t ad_size,
                      const u8 *plain_text, size_t text_size)
{
    u8 sub_key[32];
    u8 auth_key[64]; // "Wasting" the whole Chacha block is faster
    crypto_hchacha20(sub_key, key, nonce);
    crypto_chacha20(auth_key, 0, 64, sub_key, nonce + 16);
    crypto_chacha20_ctr(cipher_text, plain_text, text_size,
                        sub_key, nonce + 16, 1);
    lock_auth(mac, auth_key, ad, ad_size, cipher_text, text_size);
    WIPE_BUFFER(sub_key);
    WIPE_BUFFER(auth_key);
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x78, %rsp
movq %r9, 0x8(%rsp)
movq %r8, (%rsp)
movq %rcx, %rbp
movq %rsi, %r15
movq %rdi, %r13
leaq 0x10(%rsp), %r12
movq %r12, %rdi
movq %rdx, %rsi
movq %rcx, %rdx
callq 0x25c2
addq $0x10, %rbp
xorl %r14d, %r14d
leaq 0x30(%rsp), %rbx
movl $0x40, %edx
movq %rbx, %rdi
xorl %esi, %esi
movq %r12, %rcx
movq %rbp, %r8
xorl %r9d, %r9d
callq 0x2865
movl $0x1, %r9d
movq %r15, %rdi
movq 0xb0(%rsp), %rsi
movq 0xb8(%rsp), %rdx
movq %r12, %rcx
movq %rbp, %r8
callq 0x2865
movq %r13, %rdi
movq %rbx, %rsi
movq (%rsp), %rdx
movq 0x8(%rsp), %rcx
movq %r15, %r8
movq 0xb8(%rsp), %r9
callq 0x94b4
movb $0x0, 0x10(%rsp,%r14)
incq %r14
cmpq $0x20, %r14
jne 0x9486
xorl %eax, %eax
movb $0x0, 0x30(%rsp,%rax)
incq %rax
cmpq $0x40, %rax
jne 0x9497
addq $0x78, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: lock_auth(unsigned char*, unsigned char const*, unsigned char const*, unsigned long, unsigned char const*, unsigned long)
static void lock_auth(u8 mac[16], const u8  auth_key[32],
                      const u8 *ad         , size_t ad_size,
                      const u8 *cipher_text, size_t text_size)
{
    u8 sizes[16]; // Not secret, not wiped
    store64_le(sizes + 0, ad_size);
    store64_le(sizes + 8, text_size);
    crypto_poly1305_ctx poly_ctx;           // auto wiped...
    crypto_poly1305_init  (&poly_ctx, auth_key);
    crypto_poly1305_update(&poly_ctx, ad         , ad_size);
    crypto_poly1305_update(&poly_ctx, zero       , align(ad_size, 16));
    crypto_poly1305_update(&poly_ctx, cipher_text, text_size);
    crypto_poly1305_update(&poly_ctx, zero       , align(text_size, 16));
    crypto_poly1305_update(&poly_ctx, sizes      , 16);
    crypto_poly1305_final (&poly_ctx, mac); // ...here
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x78, %rsp
movq %rdx, %r13
movq %r8, %r12
movq %rcx, %rbx
movq %rdi, 0x8(%rsp)
leaq 0x10(%rsp), %r14
movb %bl, (%r14)
movb %bh, 0x11(%rsp)
movl %ebx, %eax
shrl $0x10, %eax
movb %al, 0x2(%r14)
movl %ebx, %eax
shrl $0x18, %eax
movb %al, 0x3(%r14)
movq %rcx, %rax
shrq $0x20, %rax
movb %al, 0x4(%r14)
movq %rcx, %rax
shrq $0x28, %rax
movb %al, 0x5(%r14)
movq %rcx, %rax
shrq $0x30, %rax
movb %al, 0x6(%r14)
movq %rcx, %rax
shrq $0x38, %rax
movb %al, 0x7(%r14)
movq %r9, %rcx
movb %cl, 0x8(%r14)
movb %ch, 0x19(%rsp)
movl %ecx, %eax
shrl $0x10, %eax
movb %al, 0xa(%r14)
movl %ecx, %eax
shrl $0x18, %eax
movb %al, 0xb(%r14)
movq %r9, %rax
shrq $0x20, %rax
movb %al, 0xc(%r14)
movq %r9, %rax
shrq $0x28, %rax
movb %al, 0xd(%r14)
movq %r9, %rax
shrq $0x30, %rax
movb %al, 0xe(%r14)
movq %r9, %rax
movq %r9, %r15
shrq $0x38, %rax
movb %al, 0xf(%r14)
leaq 0x28(%rsp), %rbp
movq %rbp, %rdi
callq 0x2a78
movq %rbp, %rdi
movq %r13, %rsi
movq %rbx, %rdx
callq 0x2acc
negl %ebx
andl $0xf, %ebx
leaq 0x3ab3(%rip), %r13      # 0xd040
movq %rbp, %rdi
movq %r13, %rsi
movq %rbx, %rdx
callq 0x2acc
movq %rbp, %rdi
movq %r12, %rsi
movq %r15, %rdx
callq 0x2acc
negl %r15d
andl $0xf, %r15d
movq %rbp, %rdi
movq %r13, %rsi
movq %r15, %rdx
callq 0x2acc
movl $0x10, %edx
movq %rbp, %rdi
movq %r14, %rsi
callq 0x2acc
movq %rbp, %rdi
movq 0x8(%rsp), %rsi
callq 0x2d2a
addq $0x78, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: crypto_unlock_aead
int crypto_unlock_aead(u8 *plain_text, const u8 key[32], const u8 nonce[24],
                       const u8  mac[16],
                       const u8 *ad         , size_t ad_size,
                       const u8 *cipher_text, size_t text_size)
{
    u8 sub_key[32];
    u8 auth_key[64]; // "Wasting" the whole Chacha block is faster
    crypto_hchacha20(sub_key, key, nonce);
    crypto_chacha20(auth_key, 0, 64, sub_key, nonce + 16);
    u8 real_mac[16];
    lock_auth(real_mac, auth_key, ad, ad_size, cipher_text, text_size);
    WIPE_BUFFER(auth_key);
    int mismatch = crypto_verify16(mac, real_mac);
    if (!mismatch) {
        crypto_chacha20_ctr(plain_text, cipher_text, text_size,
                            sub_key, nonce + 16, 1);
    }
    WIPE_BUFFER(sub_key);
    WIPE_BUFFER(real_mac);
    return mismatch;
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x88, %rsp
movq %r9, 0x18(%rsp)
movq %r8, %r14
movq %rcx, %r13
movq %rdx, %rbx
movq %rdi, 0x10(%rsp)
leaq 0x20(%rsp), %r12
movq %r12, %rdi
callq 0x25c2
addq $0x10, %rbx
xorl %ebp, %ebp
leaq 0x40(%rsp), %r15
movl $0x40, %edx
movq %r15, %rdi
xorl %esi, %esi
movq %r12, %rcx
movq %rbx, %r8
xorl %r9d, %r9d
callq 0x2865
movq %rsp, %rdi
movq %r15, %rsi
movq 0xc0(%rsp), %r15
movq %r14, %rdx
movq 0xc8(%rsp), %r14
movq 0x18(%rsp), %rcx
movq %r15, %r8
movq %r14, %r9
callq 0x94b4
movb $0x0, 0x40(%rsp,%rbp)
incq %rbp
cmpq $0x40, %rbp
jne 0x9667
movq (%rsp), %rax
movq 0x8(%rsp), %rcx
xorq (%r13), %rax
xorq 0x8(%r13), %rcx
orq %rax, %rcx
movl %ecx, %eax
shrq $0x20, %rcx
orq %rcx, %rax
decq %rax
xorl %ebp, %ebp
btq $0x20, %rax
adcl $-0x1, %ebp
jne 0x96bf
leaq 0x20(%rsp), %rcx
movl $0x1, %r9d
movq 0x10(%rsp), %rdi
movq %r15, %rsi
movq %r14, %rdx
movq %rbx, %r8
callq 0x2865
xorl %eax, %eax
movb $0x0, 0x20(%rsp,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x96c1
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x10, %rax
jne 0x96d1
movl %ebp, %eax
addq $0x88, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: gidx_refresh(gidx_ctx*)
static void gidx_refresh(gidx_ctx *ctx)
{
    // seed the beginning of the block...
    ctx->b.a[0] = ctx->pass_number;
    ctx->b.a[1] = 0;  // lane number (we have only one)
    ctx->b.a[2] = ctx->slice_number;
    ctx->b.a[3] = ctx->nb_blocks;
    ctx->b.a[4] = ctx->nb_iterations;
    ctx->b.a[5] = 1;  // type: Argon2i
    ctx->b.a[6] = ctx->ctr;
    ZERO(ctx->b.a + 7, 121); // ...then zero the rest out

    // Shuffle the block thus: ctx->b = G((G(ctx->b, zero)), zero)
    // (G "square" function), to get cheap pseudo-random numbers.
    block tmp;
    copy_block(&tmp, &ctx->b);
    g_rounds  (&ctx->b);
    xor_block (&ctx->b, &tmp);
    copy_block(&tmp, &ctx->b);
    g_rounds  (&ctx->b);
    xor_block (&ctx->b, &tmp);
    wipe_block(&tmp);
}

// Assembly:
pushq %r14
pushq %rbx
subq $0x408, %rsp            # imm = 0x408
movq %rdi, %rbx
movl 0x400(%rdi), %eax
movl 0x40c(%rdi), %ecx
movq %rax, (%rdi)
movq $0x0, 0x8(%rdi)
movsd 0x404(%rdi), %xmm0
xorps %xmm1, %xmm1
unpcklps %xmm1, %xmm0            # xmm0 = xmm0[0],xmm1[0],xmm0[1],xmm1[1]
movups %xmm0, 0x10(%rdi)
movq %rcx, 0x20(%rdi)
movq $0x1, 0x28(%rdi)
movl 0x410(%rdi), %eax
movq %rax, 0x30(%rdi)
addq $0x38, %rdi
xorl %r14d, %r14d
movl $0x3c8, %edx            # imm = 0x3C8
xorl %esi, %esi
callq 0x2120
leaq 0x8(%rsp), %rdi
movl $0x400, %edx            # imm = 0x400
movq %rbx, %rsi
callq 0x2170
movq %rbx, %rdi
callq 0x52a4
movups 0x8(%rsp,%r14,8), %xmm0
movups (%rbx,%r14,8), %xmm1
xorps %xmm0, %xmm1
movups %xmm1, (%rbx,%r14,8)
addq $0x2, %r14
cmpq $0x80, %r14
jne 0x97a1
leaq 0x8(%rsp), %rdi
movl $0x400, %edx            # imm = 0x400
movq %rbx, %rsi
callq 0x2170
movq %rbx, %rdi
callq 0x52a4
xorl %eax, %eax
movups 0x8(%rsp,%rax,8), %xmm0
movups (%rbx,%rax,8), %xmm1
xorps %xmm0, %xmm1
movups %xmm1, (%rbx,%rax,8)
addq $0x2, %rax
cmpq $0x80, %rax
jne 0x97dd
xorl %eax, %eax
movq $0x0, 0x8(%rsp,%rax,8)
incq %rax
cmpq $0x80, %rax
jne 0x97fb
addq $0x408, %rsp            # imm = 0x408
popq %rbx
popq %r14
retq
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: ge_double(ge*, ge const*, ge*)
static void ge_double(ge *s, const ge *p, ge *q)
{
    fe_sq (q->X, p->X);
    fe_sq (q->Y, p->Y);
    fe_sq (q->Z, p->Z);          // qZ = pZ^2
    fe_mul_small(q->Z, q->Z, 2); // qZ = pZ^2 * 2
    fe_add(q->T, p->X, p->Y);
    fe_sq (s->T, q->T);
    fe_add(q->T, q->Y, q->X);
    fe_sub(q->Y, q->Y, q->X);
    fe_sub(q->X, s->T, q->T);
    fe_sub(q->Z, q->Z, q->Y);

    fe_mul(s->X, q->X , q->Z);
    fe_mul(s->Y, q->T , q->Y);
    fe_mul(s->Z, q->Y , q->Z);
    fe_mul(s->T, q->X , q->T);
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
pushq %rax
movq %rdx, %rbx
movq %rsi, %r13
movq %rdi, %r14
movq %rdx, %rdi
callq 0x82b2
leaq 0x28(%rbx), %r15
leaq 0x28(%r13), %rbp
movq %r15, %rdi
movq %rbp, %rsi
callq 0x82b2
leaq 0x50(%rbx), %r12
addq $0x50, %r13
movq %r12, %rdi
movq %r13, %rsi
callq 0x82b2
movq %r12, %rdi
movq %r12, %rsi
movl $0x2, %edx
callq 0x8c59
leaq 0x78(%rbx), %r13
movq $-0x28, %rax
movl 0x28(%rbp,%rax), %ecx
addl (%rbp,%rax), %ecx
movl %ecx, 0xa0(%rbx,%rax)
addq $0x4, %rax
jne 0x9a20
leaq 0x78(%r14), %rbp
movq %rbp, %rdi
movq %r13, %rsi
callq 0x82b2
xorl %eax, %eax
movl (%rbx,%rax,4), %ecx
addl 0x28(%rbx,%rax,4), %ecx
movl %ecx, 0x78(%rbx,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x9a46
movl $0xa, %eax
movl -0x28(%rbx,%rax,4), %ecx
subl %ecx, (%rbx,%rax,4)
incq %rax
cmpq $0x14, %rax
jne 0x9a5f
movl $0x1e, %eax
movl (%r14,%rax,4), %ecx
subl (%rbx,%rax,4), %ecx
movl %ecx, -0x78(%rbx,%rax,4)
incq %rax
cmpq $0x28, %rax
jne 0x9a74
movl $0x14, %eax
movl -0x28(%rbx,%rax,4), %ecx
subl %ecx, (%rbx,%rax,4)
incq %rax
cmpq $0x1e, %rax
jne 0x9a8d
movq %r14, %rdi
movq %rbx, %rsi
movq %r12, %rdx
callq 0x7075
leaq 0x28(%r14), %rdi
movq %r13, %rsi
movq %r15, %rdx
callq 0x7075
addq $0x50, %r14
movq %r14, %rdi
movq %r15, %rsi
movq %r12, %rdx
callq 0x7075
movq %rbp, %rdi
movq %rbx, %rsi
movq %r13, %rdx
addq $0x8, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
jmp 0x7075
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: ge_cache(ge_cached*, ge const*)
static void ge_cache(ge_cached *c, const ge *p)
{
    fe_add (c->Yp, p->Y, p->X);
    fe_sub (c->Ym, p->Y, p->X);
    fe_copy(c->Z , p->Z      );
    fe_mul (c->T2, p->T, D2  );
}

// Assembly:
xorl %eax, %eax
movl (%rsi,%rax,4), %ecx
addl 0x28(%rsi,%rax,4), %ecx
movl %ecx, (%rdi,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x9aea
xorl %eax, %eax
movl 0x28(%rsi,%rax,4), %ecx
subl (%rsi,%rax,4), %ecx
movl %ecx, 0x28(%rdi,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x9aff
xorl %eax, %eax
movl 0x50(%rsi,%rax,4), %ecx
movl %ecx, 0x50(%rdi,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x9b15
addq $0x78, %rdi
addq $0x78, %rsi
leaq 0x369b(%rip), %rdx      # 0xd1d0
jmp 0x7075
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: ge_add(ge*, ge const*, ge_cached const*)
static void ge_add(ge *s, const ge *p, const ge_cached *q)
{
    fe a, b;
    fe_add(a   , p->Y, p->X );
    fe_sub(b   , p->Y, p->X );
    fe_mul(a   , a   , q->Yp);
    fe_mul(b   , b   , q->Ym);
    fe_add(s->Y, a   , b    );
    fe_sub(s->X, a   , b    );

    fe_add(s->Z, p->Z, p->Z );
    fe_mul(s->Z, s->Z, q->Z );
    fe_mul(s->T, p->T, q->T2);
    fe_add(a   , s->Z, s->T );
    fe_sub(b   , s->Z, s->T );

    fe_mul(s->T, s->X, s->Y);
    fe_mul(s->X, s->X, b   );
    fe_mul(s->Y, s->Y, a   );
    fe_mul(s->Z, a   , b   );
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x58, %rsp
movq %rdx, %r14
movq %rsi, %r12
movq %rdi, %rbx
xorl %eax, %eax
movl (%r12,%rax,4), %ecx
addl 0x28(%r12,%rax,4), %ecx
movl %ecx, 0x30(%rsp,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x9b53
xorl %eax, %eax
movl 0x28(%r12,%rax,4), %ecx
subl (%r12,%rax,4), %ecx
movl %ecx, (%rsp,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x9b6b
leaq 0x30(%rsp), %rdi
movq %rdi, %rsi
movq %r14, %rdx
callq 0x7075
leaq 0x28(%r14), %rdx
movq %rsp, %rdi
movq %rdi, %rsi
callq 0x7075
leaq 0x28(%rbx), %r15
xorl %eax, %eax
movl (%rsp,%rax,4), %ecx
addl 0x30(%rsp,%rax,4), %ecx
movl %ecx, 0x28(%rbx,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x9ba5
xorl %eax, %eax
movl 0x30(%rsp,%rax,4), %ecx
subl (%rsp,%rax,4), %ecx
movl %ecx, (%rbx,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x9bbb
leaq 0x50(%rbx), %r13
movl $0x14, %eax
movl (%r12,%rax,4), %ecx
addl %ecx, %ecx
movl %ecx, (%rbx,%rax,4)
incq %rax
cmpq $0x1e, %rax
jne 0x9bd7
leaq 0x50(%r14), %rdx
movq %r13, %rdi
movq %r13, %rsi
callq 0x7075
leaq 0x78(%rbx), %rbp
addq $0x78, %r12
addq $0x78, %r14
movq %rbp, %rdi
movq %r12, %rsi
movq %r14, %rdx
callq 0x7075
movl $0x14, %eax
movl 0x28(%rbx,%rax,4), %ecx
addl (%rbx,%rax,4), %ecx
movl %ecx, -0x20(%rsp,%rax,4)
incq %rax
cmpq $0x1e, %rax
jne 0x9c17
movl $0x14, %eax
movl (%rbx,%rax,4), %ecx
subl 0x28(%rbx,%rax,4), %ecx
movl %ecx, -0x50(%rsp,%rax,4)
incq %rax
cmpq $0x1e, %rax
jne 0x9c30
movq %rbp, %rdi
movq %rbx, %rsi
movq %r15, %rdx
callq 0x7075
movq %rsp, %r14
movq %rbx, %rdi
movq %rbx, %rsi
movq %r14, %rdx
callq 0x7075
leaq 0x30(%rsp), %rbx
movq %r15, %rdi
movq %r15, %rsi
movq %rbx, %rdx
callq 0x7075
movq %r13, %rdi
movq %rbx, %rsi
movq %r14, %rdx
callq 0x7075
addq $0x58, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: slide_step(slide_ctx*, int, int, unsigned char const*)
static int slide_step(slide_ctx *ctx, int width, int i, const u8 scalar[32])
{
    if (i == ctx->next_check) {
        if (scalar_bit(scalar, i) == scalar_bit(scalar, i - 1)) {
            ctx->next_check--;
        } else {
            // compute digit of next window
            int w = MIN(width, i + 1);
            int v = -(scalar_bit(scalar, i) << (w-1));
            FOR_T (int, j, 0, w-1) {
                v += scalar_bit(scalar, i-(w-1)+j) << j;
            }
            v += scalar_bit(scalar, i-w);
            int lsb = v & (~v + 1);            // smallest bit of v
            int s   = (   ((lsb & 0xAA) != 0)  // log2(lsb)
                       | (((lsb & 0xCC) != 0) << 1)
                       | (((lsb & 0xF0) != 0) << 2));
            ctx->next_index  = (i16)(i-(w-1)+s);
            ctx->next_digit  = (i8) (v >> s   );
            ctx->next_check -= (u8) w;
        }
    }
    return i == ctx->next_index ? ctx->next_digit: 0;
}

// Assembly:
movzbl 0x3(%rdi), %r9d
cmpl %edx, %r9d
jne 0x9db1
movq %rcx, %rax
movl %edx, %ecx
shrl $0x3, %ecx
movzbl (%rax,%rcx), %ecx
movl %edx, %r8d
andl $0x7, %r8d
xorl %r10d, %r10d
btl %r8d, %ecx
setb %r10b
testl %edx, %edx
je 0x9ce1
leal -0x1(%rdx), %r8d
movl %r8d, %ecx
shrl $0x3, %ecx
movzbl (%rax,%rcx), %r11d
andl $0x7, %r8d
xorl %ecx, %ecx
btl %r8d, %r11d
setb %cl
jmp 0x9ce3
xorl %ecx, %ecx
cmpl %ecx, %r10d
jne 0x9cf0
decb %r9b
jmp 0x9dad
leal 0x1(%rdx), %ecx
cmpl %esi, %ecx
cmovll %ecx, %esi
leal -0x1(%rsi), %r8d
movl %r8d, %ecx
shll %cl, %r10d
negl %r10d
cmpl $0x2, %esi
jl 0x9d48
pushq %rbp
pushq %r14
pushq %rbx
movl %edx, %r11d
subl %r8d, %r11d
xorl %ecx, %ecx
movl %r11d, %ebp
addl %ecx, %ebp
movl $0x0, %ebx
js 0x9d38
movl %ebp, %ebx
shrl $0x3, %ebx
movzbl (%rax,%rbx), %r14d
andl $0x7, %ebp
xorl %ebx, %ebx
btl %ebp, %r14d
setb %bl
shll %cl, %ebx
addl %ebx, %r10d
incl %ecx
cmpl %ecx, %r8d
jne 0x9d16
popq %rbx
popq %r14
popq %rbp
movl %edx, %r8d
subl %esi, %r8d
js 0x9d6c
movl %r8d, %ecx
shrl $0x3, %ecx
movzbl (%rax,%rcx), %ecx
movl %r8d, %r11d
andl $0x7, %r11d
xorl %eax, %eax
btl %r11d, %ecx
setb %al
jmp 0x9d6e
xorl %eax, %eax
addl %r10d, %eax
movl %eax, %ecx
negl %ecx
andl %eax, %ecx
xorl %r10d, %r10d
testb $-0x56, %cl
setne %r10b
xorl %r11d, %r11d
testb $-0x34, %cl
setne %r11b
leal (%r10,%r11,2), %r10d
xorl %r11d, %r11d
testb $-0x10, %cl
setne %r11b
leal (%r10,%r11,4), %ecx
sarl %cl, %eax
addl %r8d, %ecx
incl %ecx
movw %cx, (%rdi)
movb %al, 0x2(%rdi)
subb %sil, %r9b
movb %r9b, 0x3(%rdi)
movswl (%rdi), %ecx
xorl %eax, %eax
cmpl %edx, %ecx
jne 0x9dbe
movsbl 0x2(%rdi), %eax
retq
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: fe_isequal(int const*, int const*)
static int fe_isequal(const fe f, const fe g)
{
    u8 fs[32];
    u8 gs[32];
    fe_tobytes(fs, f);
    fe_tobytes(gs, g);
    int isdifferent = crypto_verify32(fs, gs);
    WIPE_BUFFER(fs);
    WIPE_BUFFER(gs);
    return 1 + isdifferent;
}

// Assembly:
pushq %r15
pushq %r14
pushq %rbx
subq $0x40, %rsp
movq %rsi, %rbx
movq %rdi, %rsi
leaq 0x20(%rsp), %r14
movq %r14, %rdi
callq 0x7887
movq %rsp, %r15
movq %r15, %rdi
movq %rbx, %rsi
callq 0x7887
movdqa (%r14), %xmm2
movdqa 0x10(%r14), %xmm1
xorl %eax, %eax
movdqa (%r15), %xmm3
movdqa 0x10(%r15), %xmm0
movb $0x0, 0x20(%rsp,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x9e01
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x9e11
pxor %xmm2, %xmm3
pxor %xmm1, %xmm0
por %xmm3, %xmm0
pshufd $0xee, %xmm0, %xmm1     # xmm1 = xmm0[2,3,2,3]
por %xmm0, %xmm1
movq %xmm1, %rcx
movl %ecx, %eax
shrq $0x20, %rcx
orq %rcx, %rax
decq %rax
shrq $0x20, %rax
andl $0x1, %eax
addq $0x40, %rsp
popq %rbx
popq %r14
popq %r15
retq
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: remove_l(unsigned int*, unsigned int const*)
static void remove_l(u32 r[8], const u32 x[8])
{
    u64 carry = is_above_l(x);
    u32 mask  = ~(u32)carry + 1; // carry == 0 or 1
    FOR (i, 0, 8) {
        carry += (u64)x[i] + (~L[i] & mask);
        r[i]   = (u32)carry;
        carry >>= 32;
    }
}

// Assembly:
movl $0x1, %eax
xorl %edx, %edx
leaq 0x407d(%rip), %rcx      # 0xdee0
movl (%rsi,%rdx), %r8d
addq %rax, %r8
movl (%rdx,%rcx), %eax
notl %eax
addq %r8, %rax
shrq $0x20, %rax
addq $0x4, %rdx
cmpq $0x20, %rdx
jne 0x9e63
movl %eax, %edx
negl %edx
xorl %r8d, %r8d
movl (%rsi,%r8), %r9d
addq %rax, %r9
movl (%r8,%rcx), %eax
notl %eax
andl %edx, %eax
addq %r9, %rax
movl %eax, (%rdi,%r8)
shrq $0x20, %rax
addq $0x4, %r8
cmpq $0x20, %r8
jne 0x9e87
retq
// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/pyct.cpp
// Function: hash_password(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, unsigned long, unsigned long)
Hash hash_password(string& password, const string& salt, u64 iterations, u64 work_area_size) {
    if (salt.size() < 8)
        throw invalid_argument{"Salt too small"};
    if (work_area_size < 8*1024)
        throw invalid_argument{"Work area is too small"};
    if (iterations == 0)
        throw invalid_argument{"Need at least one iteration"};

    auto rem = work_area_size % 1024;
    if (rem > 0)
        work_area_size = work_area_size - rem + 1024;
    u64 nb_blocks = work_area_size / 1024;

    vector<u8> work_area(work_area_size);

    Hash hash;
    crypto_argon2i(hash.data(), hash.size(),
                   work_area.data(), nb_blocks,
                   iterations,
                   reinterpret_cast<const u8*>(&password[0]), password.size(),
                   reinterpret_cast<const u8*>(&salt[0]), salt.size());

    crypto_wipe(&password[0], password.size());
    password = {};
    return hash;
}

// Assembly:
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x20, %rsp
cmpq $0x7, 0x8(%rdx)
jbe 0xa9c4
movq %r8, %r13
cmpq $0x1fff, %r8            # imm = 0x1FFF
jbe 0xa9e2
movq %rcx, %r12
testq %rcx, %rcx
je 0xaa00
movq %rdx, %r15
movq %rsi, %r14
movq %rdi, %rbx
addq $0x3ff, %r13            # imm = 0x3FF
movq %r13, %rsi
andq $-0x400, %rsi           # imm = 0xFC00
leaq 0x8(%rsp), %rdi
leaq 0x7(%rsp), %rdx
callq 0xc1d8
shrq $0xa, %r13
movq 0x8(%rsp), %rdx
movq (%r14), %r9
movl 0x8(%r14), %eax
movl 0x8(%r15), %r10d
subq $0x8, %rsp
movq %rbx, %rdi
movl $0x20, %esi
movl %r13d, %ecx
movl %r12d, %r8d
pushq %r10
pushq (%r15)
pushq %rax
callq 0x5de3
addq $0x20, %rsp
movq (%r14), %rdi
movq 0x8(%r14), %rsi
callq 0x25ae
movq 0x8(%r14), %rdx
movq %r14, %rdi
xorl %esi, %esi
xorl %ecx, %ecx
xorl %r8d, %r8d
callq 0x2300
movq 0x8(%rsp), %rdi
testq %rdi, %rdi
je 0xa9b3
movq 0x18(%rsp), %rsi
subq %rdi, %rsi
callq 0x21f0
movq %rbx, %rax
addq $0x20, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
retq
movl $0x10, %edi
callq 0x20f0
movq %rax, %r14
leaq 0x3703(%rip), %rsi      # 0xe0db
movq %rax, %rdi
callq 0x23a0
jmp 0xaa1c
movl $0x10, %edi
callq 0x20f0
movq %rax, %r14
leaq 0x36f4(%rip), %rsi      # 0xe0ea
movq %rax, %rdi
callq 0x23a0
jmp 0xaa1c
movl $0x10, %edi
callq 0x20f0
movq %rax, %r14
leaq 0x36ed(%rip), %rsi      # 0xe101
movq %rax, %rdi
callq 0x23a0
movq 0x75ad(%rip), %rsi      # 0x11fd0
movq 0x7596(%rip), %rdx      # 0x11fc0
movq %r14, %rdi
callq 0x2360
jmp 0xaa36
jmp 0xaa36
movq %rax, %rbx
movq %r14, %rdi
callq 0x2160
jmp 0xaa62
movq %rax, %rbx
jmp 0xaa62
movq %rax, %rbx
movq 0x8(%rsp), %rdi
testq %rdi, %rdi
je 0xaa62
movq 0x18(%rsp), %rsi
subq %rdi, %rsi
callq 0x21f0
movq %rbx, %rdi
callq 0x2380