LLM4Binary/decompile-bench-makefile huggingface dataset:
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: crypto_xchacha20_ctr
u64 crypto_xchacha20_ctr(u8 *cipher_text, const u8 *plain_text,
                         size_t text_size,
                         const u8 key[32], const u8 nonce[24], u64 ctr)
{
    u8 sub_key[32];
    crypto_hchacha20(sub_key, key, nonce);
    ctr = crypto_chacha20_ctr(cipher_text, plain_text, text_size,
                              sub_key, nonce+16, ctr);
    WIPE_BUFFER(sub_key);
    return ctr;
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x28, %rsp
movq %r9, %rbx
movq %r8, %r14
movq %rdx, %r15
movq %rsi, %r12
movq %rdi, %r13
movq %rsp, %rbp
movq %rbp, %rdi
movq %rcx, %rsi
movq %r8, %rdx
callq 0x2617
addq $0x10, %r14
movq %r13, %rdi
movq %r12, %rsi
movq %r15, %rdx
movq %rbp, %rcx
movq %r14, %r8
movq %rbx, %r9
callq 0x28c8
xorl %ecx, %ecx
movb $0x0, (%rsp,%rcx)
incq %rcx
cmpq $0x20, %rcx
jne 0x2ad3
addq $0x28, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: crypto_ietf_chacha20
static u32 load32_le(const u8 s[4])
{
    return (u32)s[0]
        | ((u32)s[1] <<  8)
        | ((u32)s[2] << 16)
        | ((u32)s[3] << 24);
}

// Assembly:
movzbl (%r8), %r9d
movzbl 0x1(%r8), %eax
movzbl 0x2(%r8), %r10d
movzbl 0x3(%r8), %r11d
shlq $0x38, %r11
shlq $0x30, %r10
shlq $0x28, %rax
shlq $0x20, %r9
orq %rax, %r9
orq %r10, %r9
orq %r11, %r9
addq $0x4, %r8
jmp 0x28c8
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: crypto_poly1305_init
void crypto_poly1305_init(crypto_poly1305_ctx *ctx, const u8 key[32])
{
    ZERO(ctx->h, 5); // Initial hash is zero
    ctx->c_idx = 0;
    // load r and pad (r has some of its bits cleared)
    load32_le_buf(ctx->r  , key   , 4);
    load32_le_buf(ctx->pad, key+16, 4);
    FOR (i, 0, 1) { ctx->r[i] &= 0x0fffffff; }
    FOR (i, 1, 4) { ctx->r[i] &= 0x0ffffffc; }
}

// Assembly:
xorps %xmm0, %xmm0
movups %xmm0, 0x10(%rdi)
movl $0x0, 0x20(%rdi)
movq $0x0, 0x48(%rdi)
xorl %eax, %eax
movl (%rsi,%rax,4), %ecx
movl %ecx, (%rdi,%rax,4)
incq %rax
cmpq $0x4, %rax
jne 0x2b4c
xorl %eax, %eax
movl 0x10(%rsi,%rax,4), %ecx
movl %ecx, 0x34(%rdi,%rax,4)
incq %rax
cmpq $0x4, %rax
jne 0x2b5d
andb $0xf, 0x3(%rdi)
movl $0x1, %eax
andl $0xffffffc, (%rdi,%rax,4) # imm = 0xFFFFFFC
incq %rax
cmpq $0x4, %rax
jne 0x2b77
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: crypto_poly1305_update
void crypto_poly1305_update(crypto_poly1305_ctx *ctx,
                            const u8 *message, size_t message_size)
{
    // Align ourselves with block boundaries
    size_t aligned = MIN(align(ctx->c_idx, 16), message_size);
    FOR (i, 0, aligned) {
        ctx->c[ctx->c_idx] = *message;
        ctx->c_idx++;
        message++;
        message_size--;
    }

    // If block is complete, process it
    if (ctx->c_idx == 16) {
        poly_block(ctx, ctx->c, 1);
        ctx->c_idx = 0;
    }

    // Process the message block by block
    size_t nb_blocks = message_size >> 4;
    FOR (i, 0, nb_blocks) {
        poly_block(ctx, message, 1);
        message += 16;
    }
    message_size &= 15;

    // remaining bytes (we never complete a block here)
    FOR (i, 0, message_size) {
        ctx->c[ctx->c_idx] = message[i];
        ctx->c_idx++;
    }
}

// Assembly:
pushq %r15
pushq %r14
pushq %r12
pushq %rbx
pushq %rax
movq %rdx, %rbx
movq %rsi, %r14
movq %rdi, %r15
xorl %eax, %eax
subl 0x48(%rdi), %eax
andl $0xf, %eax
cmpq %rdx, %rax
cmovaeq %rdx, %rax
testq %rax, %rax
je 0x2bcb
movq %rax, %rcx
movb (%r14), %dl
movq 0x48(%r15), %rsi
movb %dl, 0x24(%r15,%rsi)
incq 0x48(%r15)
incq %r14
decq %rcx
jne 0x2bb0
subq %rax, %rbx
cmpq $0x10, 0x48(%r15)
jne 0x2beb
leaq 0x24(%r15), %rsi
movq %r15, %rdi
movl $0x1, %edx
callq 0x2c3e
movq $0x0, 0x48(%r15)
cmpq $0x10, %rbx
jb 0x2c11
movq %rbx, %r12
shrq $0x4, %r12
movq %r15, %rdi
movq %r14, %rsi
movl $0x1, %edx
callq 0x2c3e
addq $0x10, %r14
decq %r12
jne 0x2bf8
andq $0xf, %rbx
je 0x2c32
xorl %eax, %eax
movb (%r14,%rax), %cl
movq 0x48(%r15), %rdx
movb %cl, 0x24(%r15,%rdx)
incq 0x48(%r15)
incq %rax
cmpq %rax, %rbx
jne 0x2c19
addq $0x8, %rsp
popq %rbx
popq %r12
popq %r14
popq %r15
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: crypto_poly1305_final
void crypto_poly1305_final(crypto_poly1305_ctx *ctx, u8 mac[16])
{
    // Process the last block (if any)
    // We move the final 1 according to remaining input length
    // (this will add less than 2^130 to the last input block)
    if (ctx->c_idx != 0) {
        ZERO(ctx->c + ctx->c_idx, 16 - ctx->c_idx);
        ctx->c[ctx->c_idx] = 1;
        poly_block(ctx, ctx->c, 0);
    }

    // check if we should subtract 2^130-5 by performing the
    // corresponding carry propagation.
    u64 c = 5;
    FOR (i, 0, 4) {
        c  += ctx->h[i];
        c >>= 32;
    }
    c += ctx->h[4];
    c  = (c >> 2) * 5; // shift the carry back to the beginning
    // c now indicates how many times we should subtract 2^130-5 (0 or 1)
    FOR (i, 0, 4) {
        c += (u64)ctx->h[i] + ctx->pad[i];
        store32_le(mac + i*4, (u32)c);
        c = c >> 32;
    }
    WIPE_CTX(ctx);
}

// Assembly:
pushq %r14
pushq %rbx
pushq %rax
movq %rsi, %r14
movq %rdi, %rbx
cmpq $0x0, 0x48(%rdi)
je 0x2e3e
movq 0x48(%rbx), %rax
cmpq $0x10, %rax
je 0x2e2b
leaq 0x24(%rbx), %rcx
xorl %edx, %edx
addq %rcx, %rax
movb $0x0, (%rdx,%rax)
incq %rdx
movq 0x48(%rbx), %rax
movl $0x10, %esi
subq %rax, %rsi
cmpq %rsi, %rdx
jb 0x2e10
leaq 0x24(%rbx), %rsi
movb $0x1, 0x24(%rbx,%rax)
movq %rbx, %rdi
xorl %edx, %edx
callq 0x2c3e
movl $0x5, %eax
xorl %ecx, %ecx
movl 0x10(%rbx,%rcx,4), %edx
addq %rdx, %rax
shrq $0x20, %rax
incq %rcx
cmpq $0x4, %rcx
jne 0x2e45
movl 0x20(%rbx), %ecx
addq %rcx, %rax
shrq $0x2, %rax
leaq (%rax,%rax,4), %rcx
xorl %eax, %eax
movl 0x10(%rbx,%rax,4), %edx
addq %rcx, %rdx
movl 0x34(%rbx,%rax,4), %ecx
addq %rdx, %rcx
movl %ecx, (%r14,%rax,4)
shrq $0x20, %rcx
incq %rax
cmpq $0x4, %rax
jne 0x2e69
xorl %eax, %eax
movb $0x0, (%rbx,%rax)
incq %rax
cmpq $0x50, %rax
jne 0x2e8a
addq $0x8, %rsp
popq %rbx
popq %r14
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: crypto_blake2b_general_init
void crypto_blake2b_general_init(crypto_blake2b_ctx *ctx, size_t hash_size,
                                 const u8           *key, size_t key_size)
{
    // initial hash
    COPY(ctx->hash, iv, 8);
    ctx->hash[0] ^= 0x01010000 ^ (key_size << 8) ^ hash_size;

    ctx->input_offset[0] = 0;         // beginning of the input, no offset
    ctx->input_offset[1] = 0;         // beginning of the input, no offset
    ctx->hash_size       = hash_size; // remember the hash size we want
    ctx->input_idx       = 0;

    // if there is a key, the first block is that key (padded with zeroes)
    if (key_size > 0) {
        u8 key_block[128] = {0};
        COPY(key_block, key, key_size);
        // same as calling crypto_blake2b_update(ctx, key_block , 128)
        load64_le_buf(ctx->input, key_block, 16);
        ctx->input_idx = 128;
    }
}

// Assembly:
movaps 0xa1b1(%rip), %xmm0     # 0xd0a0
movups %xmm0, (%rdi)
movaps 0xa1d7(%rip), %xmm0     # 0xd0d0
movups %xmm0, 0x30(%rdi)
movaps 0xa1bc(%rip), %xmm0     # 0xd0c0
movups %xmm0, 0x20(%rdi)
movaps 0xa1a1(%rip), %xmm0     # 0xd0b0
movups %xmm0, 0x10(%rdi)
movq %rcx, %rax
shlq $0x8, %rax
xorq (%rdi), %rax
xorq %rsi, %rax
xorq $0x1010000, %rax        # imm = 0x1010000
movq %rax, (%rdi)
xorps %xmm0, %xmm0
movups %xmm0, 0x40(%rdi)
movq %rsi, 0xd8(%rdi)
movq $0x0, 0xd0(%rdi)
testq %rcx, %rcx
je 0x2fbe
pushq %r15
pushq %r14
pushq %r12
pushq %rbx
subq $0x88, %rsp
movq %rcx, %r14
movq %rdx, %r15
movq %rdi, %rbx
movl $0x80, %edx
subq %rcx, %rdx
xorl %r12d, %r12d
cmpq $0x7f, %rcx
cmovaq %r12, %rdx
leaq (%rsp,%rcx), %rdi
xorl %esi, %esi
callq 0x2120
movq %rsp, %rdi
movq %r15, %rsi
movq %r14, %rdx
callq 0x2170
leaq (%rsp,%r12), %rdi
callq 0x9550
movq %rax, 0x50(%rbx,%r12)
addq $0x8, %r12
cmpq $0x80, %r12
jne 0x2f8a
movq $0x80, 0xd0(%rbx)
addq $0x88, %rsp
popq %rbx
popq %r12
popq %r14
popq %r15
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: crypto_blake2b_update
void crypto_blake2b_update(crypto_blake2b_ctx *ctx,
                           const u8 *message, size_t message_size)
{
    // Align ourselves with block boundaries
    // The block that may result is not compressed yet
    size_t aligned = MIN(align(ctx->input_idx, 128), message_size);
    FOR (i, 0, aligned) {
        blake2b_set_input(ctx, *message, ctx->input_idx);
        ctx->input_idx++;
        message++;
        message_size--;
    }

    // Process the message block by block
    // The last block is not compressed yet.
    size_t nb_blocks = message_size >> 7;
    FOR (i, 0, nb_blocks) {
        if (ctx->input_idx == 128) {
            blake2b_compress(ctx, 0);
        }
        load64_le_buf(ctx->input, message, 16);
        message += 128;
        ctx->input_idx = 128;
    }
    message_size &= 127;

    // Fill remaining bytes (not the whole buffer)
    // The last block is never fully filled
    FOR (i, 0, message_size) {
        if (ctx->input_idx == 128) {
            blake2b_compress(ctx, 0);
            ctx->input_idx = 0;
        }
        blake2b_set_input(ctx, message[i], ctx->input_idx);
        ctx->input_idx++;
    }
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
pushq %rax
movq %rdx, %r12
movq %rsi, %r14
movq %rdi, %r15
xorl %eax, %eax
subl 0xd0(%rdi), %eax
andl $0x7f, %eax
cmpq %rdx, %rax
cmovaeq %rdx, %rax
testq %rax, %rax
je 0x3098
leaq 0x50(%r15), %rdx
xorps %xmm0, %xmm0
movq %rax, %rsi
movzbl (%r14), %edi
movq 0xd0(%r15), %r8
testq %r8, %r8
jne 0x3072
movups %xmm0, 0x70(%rdx)
movups %xmm0, 0x60(%rdx)
movups %xmm0, 0x50(%rdx)
movups %xmm0, 0x40(%rdx)
movups %xmm0, 0x30(%rdx)
movups %xmm0, 0x20(%rdx)
movups %xmm0, 0x10(%rdx)
movups %xmm0, (%rdx)
leal (,%r8,8), %ecx
shlq %cl, %rdi
andq $-0x8, %r8
orq %rdi, 0x50(%r15,%r8)
incq 0xd0(%r15)
incq %r14
decq %rsi
jne 0x3043
subq %rax, %r12
cmpq $0x80, %r12
movq %r12, (%rsp)
jb 0x30f7
shrq $0x7, %r12
xorl %r13d, %r13d
movl $0x80, %ebp
cmpq $0x80, 0xd0(%r15)
jne 0x30c8
movq %r15, %rdi
xorl %esi, %esi
callq 0x31a6
xorl %ebx, %ebx
leaq (%r14,%rbx), %rdi
callq 0x9550
movq %rax, 0x50(%r15,%rbx)
addq $0x8, %rbx
cmpq $0x80, %rbx
jne 0x30ca
addq %rbp, %r14
movq %rbp, 0xd0(%r15)
incq %r13
cmpq %r12, %r13
jne 0x30b1
movq (%rsp), %rbx
andq $0x7f, %rbx
je 0x3197
leaq 0x50(%r15), %r12
xorl %r13d, %r13d
cmpq $0x80, 0xd0(%r15)
jne 0x312e
movq %r15, %rdi
xorl %esi, %esi
callq 0x31a6
movq $0x0, 0xd0(%r15)
movzbl (%r14,%r13), %eax
movq 0xd0(%r15), %rdx
testq %rdx, %rdx
jne 0x3171
xorps %xmm0, %xmm0
movups %xmm0, 0x70(%r12)
movups %xmm0, 0x60(%r12)
movups %xmm0, 0x50(%r12)
movups %xmm0, 0x40(%r12)
movups %xmm0, 0x30(%r12)
movups %xmm0, 0x20(%r12)
movups %xmm0, 0x10(%r12)
movups %xmm0, (%r12)
leal (,%rdx,8), %ecx
shlq %cl, %rax
andq $-0x8, %rdx
orq %rax, 0x50(%r15,%rdx)
incq 0xd0(%r15)
incq %r13
cmpq %r13, %rbx
jne 0x310c
addq $0x8, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: crypto_blake2b_final
void crypto_blake2b_final(crypto_blake2b_ctx *ctx, u8 *hash)
{
    // Pad the end of the block with zeroes
    FOR (i, ctx->input_idx, 128) {
        blake2b_set_input(ctx, 0, i);
    }
    blake2b_compress(ctx, 1); // compress the last block
    size_t nb_words = ctx->hash_size >> 3;
    store64_le_buf(hash, ctx->hash, nb_words);
    FOR (i, nb_words << 3, ctx->hash_size) {
        hash[i] = (ctx->hash[i >> 3] >> (8 * (i & 7))) & 0xff;
    }
    WIPE_CTX(ctx);
}

// Assembly:
pushq %r15
pushq %r14
pushq %rbx
movq %rsi, %r14
movq %rdi, %rbx
movq 0xd0(%rdi), %rax
cmpq $0x7f, %rax
ja 0x494d
leaq 0x50(%rbx), %rcx
xorps %xmm0, %xmm0
testq %rax, %rax
jne 0x4942
movups %xmm0, 0x70(%rcx)
movups %xmm0, 0x60(%rcx)
movups %xmm0, 0x50(%rcx)
movups %xmm0, 0x40(%rcx)
movups %xmm0, 0x30(%rcx)
movups %xmm0, 0x20(%rcx)
movups %xmm0, 0x10(%rcx)
movups %xmm0, (%rcx)
incq %rax
cmpq $0x80, %rax
jne 0x491e
movq %rbx, %rdi
movl $0x1, %esi
callq 0x31a6
movq 0xd8(%rbx), %r15
movq %r15, %rdx
shrq $0x3, %rdx
movq %r14, %rdi
movq %rbx, %rsi
callq 0x49ca
movq %r15, %rax
andq $-0x8, %rax
cmpq 0xd8(%rbx), %rax
jae 0x49b3
shlq $0x3, %r15
andq $-0x40, %r15
movq %rax, %rcx
andq $-0x8, %rcx
movq (%rbx,%rcx), %rdx
movl %r15d, %ecx
andb $0x38, %cl
shrq %cl, %rdx
movb %dl, (%r14,%rax)
incq %rax
addq $0x8, %r15
cmpq 0xd8(%rbx), %rax
jb 0x498b
xorl %eax, %eax
movb $0x0, (%rbx,%rax)
incq %rax
cmpq $0xe0, %rax
jne 0x49b5
popq %rbx
popq %r14
popq %r15
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: extended_hash(unsigned char*, unsigned int, unsigned char const*, unsigned int)
static void extended_hash(u8       *digest, u32 digest_size,
                          const u8 *input , u32 input_size)
{
    crypto_blake2b_ctx ctx;
    crypto_blake2b_general_init(&ctx, MIN(digest_size, 64), 0, 0);
    blake_update_32            (&ctx, digest_size);
    crypto_blake2b_update      (&ctx, input, input_size);
    crypto_blake2b_final       (&ctx, digest);

    if (digest_size > 64) {
        // the conversion to u64 avoids integer overflow on
        // ludicrously big hash sizes.
        u32 r   = (u32)(((u64)digest_size + 31) >> 5) - 2;
        u32 i   =  1;
        u32 in  =  0;
        u32 out = 32;
        while (i < r) {
            // Input and output overlap. This is intentional
            crypto_blake2b(digest + out, digest + in, 64);
            i   +=  1;
            in  += 32;
            out += 32;
        }
        crypto_blake2b_general(digest + out, digest_size - (32 * r),
                               0, 0, // no key
                               digest + in , 64);
    }
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r12
pushq %rbx
subq $0xe0, %rsp
movl %ecx, %ebp
movq %rdx, %r15
movl %esi, %ebx
movq %rdi, %r14
cmpl $0x40, %esi
movl $0x40, %eax
cmovbl %esi, %eax
movaps 0x7fd7(%rip), %xmm0     # 0xd0a0
movq %rsp, %r12
movaps %xmm0, (%r12)
movaps 0x7ff8(%rip), %xmm0     # 0xd0d0
movaps %xmm0, 0x30(%r12)
movaps 0x7fdb(%rip), %xmm0     # 0xd0c0
movaps %xmm0, 0x20(%r12)
movaps 0x7fbe(%rip), %xmm0     # 0xd0b0
movaps %xmm0, 0x10(%r12)
movq %rax, %rcx
orq $0x1010000, %rcx        # imm = 0x1010000
xorq %rcx, (%r12)
xorps %xmm0, %xmm0
movaps %xmm0, 0x40(%r12)
movq %rax, 0xd8(%r12)
movq $0x0, 0xd0(%r12)
movq %r12, %rdi
callq 0x5077
movl %ebp, %edx
movq %r12, %rdi
movq %r15, %rsi
callq 0x300e
movq %r12, %rdi
movq %r14, %rsi
callq 0x48ff
cmpl $0x41, %ebx
jb 0x51c2
movl %ebx, %r12d
addq $0x1f, %r12
shrq $0x5, %r12
leal -0x2(%r12), %ebp
cmpl $0x2, %ebp
jb 0x519a
addl $-0x3, %r12d
movl $0x20, %r15d
leal -0x20(%r15), %r8d
movl %r15d, %edi
addq %r14, %rdi
addq %r14, %r8
movl $0x40, %esi
movl $0x40, %r9d
xorl %edx, %edx
xorl %ecx, %ecx
callq 0x49e2
addl $0x20, %r15d
decl %r12d
jne 0x5167
movl %r15d, %edi
addl $-0x20, %r15d
jmp 0x51a2
movl $0x20, %edi
xorl %r15d, %r15d
addq %r14, %rdi
shll $0x5, %ebp
subl %ebp, %ebx
addq %r14, %r15
movl $0x40, %r9d
movq %rbx, %rsi
xorl %edx, %edx
xorl %ecx, %ecx
movq %r15, %r8
callq 0x49e2
addq $0xe0, %rsp
popq %rbx
popq %r12
popq %r14
popq %r15
popq %rbp
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: crypto_x25519
void crypto_x25519(u8       raw_shared_secret[32],
                   const u8 your_secret_key  [32],
                   const u8 their_public_key [32])
{
    // restrict the possible scalar values
    u8 e[32];
    COPY(e, your_secret_key, 32);
    trim_scalar(e);
    scalarmult(raw_shared_secret, e, their_public_key, 255);
    WIPE_BUFFER(e);
}

// Assembly:
subq $0x28, %rsp
movups (%rsi), %xmm0
movups 0x10(%rsi), %xmm1
movq %rsp, %rsi
movaps %xmm0, (%rsi)
movaps %xmm1, 0x10(%rsi)
andb $-0x8, (%rsi)
movb 0x1f(%rsi), %al
andb $0x3f, %al
orb $0x40, %al
movb %al, 0x1f(%rsi)
movl $0xff, %ecx
callq 0x5d67
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x5d55
addq $0x28, %rsp
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: crypto_sign_public_key_custom_hash
void crypto_sign_public_key_custom_hash(u8       public_key[32],
                                        const u8 secret_key[32],
                                        const crypto_sign_vtable *hash)
{
    u8 a[64];
    hash->hash(a, secret_key, 32);
    trim_scalar(a);
    ge A;
    ge_scalarmult_base(&A, a);
    ge_tobytes(public_key, &A);
    WIPE_BUFFER(a);
    WIPE_CTX(&A);
}

// Assembly:
pushq %r15
pushq %r14
pushq %rbx
subq $0xe0, %rsp
movq %rdx, %rax
movq %rdi, %rbx
movq %rsp, %r14
movl $0x20, %edx
movq %r14, %rdi
callq *(%rax)
andb $-0x8, (%r14)
movb 0x1f(%r14), %al
andb $0x3f, %al
orb $0x40, %al
movb %al, 0x1f(%r14)
leaq 0x40(%rsp), %r15
movq %r15, %rdi
movq %r14, %rsi
callq 0x61c7
movq %rbx, %rdi
movq %r15, %rsi
callq 0x638e
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x40, %rax
jne 0x619b
xorl %eax, %eax
movb $0x0, 0x40(%rsp,%rax)
incq %rax
cmpq $0xa0, %rax
jne 0x61aa
addq $0xe0, %rsp
popq %rbx
popq %r14
popq %r15
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: ge_tobytes(unsigned char*, ge const*)
static void ge_tobytes(u8 s[32], const ge *h)
{
    fe recip, x, y;
    fe_invert(recip, h->Z);
    fe_mul(x, h->X, recip);
    fe_mul(y, h->Y, recip);
    fe_tobytes(s, y);
    s[31] ^= fe_isodd(x) << 7;

    WIPE_BUFFER(recip);
    WIPE_BUFFER(x);
    WIPE_BUFFER(y);
}

// Assembly:
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0xb0, %rsp
movq %rsi, %r14
movq %rdi, %rbx
addq $0x50, %rsi
leaq 0x80(%rsp), %r15
movq %r15, %rdi
callq 0x6e4c
leaq 0x50(%rsp), %r12
movq %r12, %rdi
movq %r14, %rsi
movq %r15, %rdx
callq 0x6ea3
addq $0x28, %r14
leaq 0x20(%rsp), %r13
movq %r13, %rdi
movq %r14, %rsi
movq %r15, %rdx
callq 0x6ea3
movq %rbx, %rdi
movq %r13, %rsi
callq 0x76b5
movq %rsp, %r14
movq %r14, %rdi
movq %r12, %rsi
callq 0x76b5
xorl %ecx, %ecx
movb (%r14), %al
movb $0x0, (%rsp,%rcx)
incq %rcx
cmpq $0x20, %rcx
jne 0x6400
shlb $0x7, %al
xorb %al, 0x1f(%rbx)
xorl %eax, %eax
movb $0x0, 0x80(%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x6415
xorl %eax, %eax
movb $0x0, 0x50(%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x6428
xorl %eax, %eax
movb $0x0, 0x20(%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x6438
addq $0xb0, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: crypto_sign_init_first_pass_custom_hash
void crypto_sign_init_first_pass_custom_hash(crypto_sign_ctx_abstract *ctx,
                                             const u8 secret_key[32],
                                             const u8 public_key[32],
                                             const crypto_sign_vtable *hash)
{
    ctx->hash  = hash; // set vtable
    u8 *a      = ctx->buf;
    u8 *prefix = ctx->buf + 32;
    ctx->hash->hash(a, secret_key, 32);
    trim_scalar(a);

    if (public_key == 0) {
        crypto_sign_public_key_custom_hash(ctx->pk, secret_key, ctx->hash);
    } else {
        COPY(ctx->pk, public_key, 32);
    }

    // Deterministic part of EdDSA: Construct a nonce by hashing the message
    // instead of generating a random number.
    // An actual random number would work just fine, and would save us
    // the trouble of hashing the message twice.  If we did that
    // however, the user could fuck it up and reuse the nonce.
    ctx->hash->init  (ctx);
    ctx->hash->update(ctx, prefix , 32);
}

// Assembly:
pushq %r15
pushq %r14
pushq %rbx
movq %rdx, %r14
movq %rsi, %r15
movq %rdi, %rbx
movq %rcx, (%rdi)
addq $0x8, %rdi
movl $0x20, %edx
callq *(%rcx)
andb $-0x8, 0x8(%rbx)
movb 0x27(%rbx), %al
andb $0x3f, %al
orb $0x40, %al
movb %al, 0x27(%rbx)
leaq 0x68(%rbx), %rdi
testq %r14, %r14
je 0x64aa
xorl %eax, %eax
movb (%r14,%rax), %cl
movb %cl, (%rdi,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x6498
jmp 0x64b5
movq (%rbx), %rdx
movq %r15, %rsi
callq 0x614f
leaq 0x28(%rbx), %r14
movq (%rbx), %rax
movq %rbx, %rdi
callq *0x8(%rax)
movq (%rbx), %rax
movq 0x10(%rax), %rax
movl $0x20, %edx
movq %rbx, %rdi
movq %r14, %rsi
popq %rbx
popq %r14
popq %r15
jmpq *%rax
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: crypto_sign_init_second_pass
void crypto_sign_init_second_pass(crypto_sign_ctx_abstract *ctx)
{
    u8 *r        = ctx->buf + 32;
    u8 *half_sig = ctx->buf + 64;
    ctx->hash->final(ctx, r);
    reduce(r);

    // first half of the signature = "random" nonce times the base point
    ge R;
    ge_scalarmult_base(&R, r);
    ge_tobytes(half_sig, &R);
    WIPE_CTX(&R);

    // Hash R, the public key, and the message together.
    // It cannot be done in parallel with the first hash.
    ctx->hash->init  (ctx);
    ctx->hash->update(ctx, half_sig, 32);
    ctx->hash->update(ctx, ctx->pk , 32);
}

// Assembly:
pushq %r15
pushq %r14
pushq %r12
pushq %rbx
subq $0xa8, %rsp
movq %rdi, %rbx
leaq 0x28(%rdi), %r15
leaq 0x48(%rdi), %r14
movq (%rdi), %rax
movq %r15, %rsi
callq *0x18(%rax)
movq %r15, %rdi
callq 0x6584
leaq 0x8(%rsp), %r12
movq %r12, %rdi
movq %r15, %rsi
callq 0x61c7
movq %r14, %rdi
movq %r12, %rsi
callq 0x638e
xorl %eax, %eax
movb $0x0, 0x8(%rsp,%rax)
incq %rax
cmpq $0xa0, %rax
jne 0x6537
movq (%rbx), %rax
movq %rbx, %rdi
callq *0x8(%rax)
movq (%rbx), %rax
movl $0x20, %edx
movq %rbx, %rdi
movq %r14, %rsi
callq *0x10(%rax)
movq (%rbx), %rax
movq 0x10(%rax), %rax
leaq 0x68(%rbx), %rsi
movl $0x20, %edx
movq %rbx, %rdi
addq $0xa8, %rsp
popq %rbx
popq %r12
popq %r14
popq %r15
jmpq *%rax
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: reduce(unsigned char*)
static void reduce(u8 r[64])
{
    u32 x[16];
    load32_le_buf(x, r, 16);
    mod_l(r, x);
    WIPE_BUFFER(x);
}

// Assembly:
subq $0x48, %rsp
xorl %eax, %eax
movl (%rdi,%rax,4), %ecx
movl %ecx, (%rsp,%rax,4)
incq %rax
cmpq $0x10, %rax
jne 0x658a
movq %rsp, %rsi
callq 0x8fcd
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x40, %rax
jne 0x65a3
addq $0x48, %rsp
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: crypto_sign_final
void crypto_sign_final(crypto_sign_ctx_abstract *ctx, u8 signature[64])
{
    u8 *a        = ctx->buf;
    u8 *r        = ctx->buf + 32;
    u8 *half_sig = ctx->buf + 64;
    u8  h_ram[64];
    ctx->hash->final(ctx, h_ram);
    reduce(h_ram);
    COPY(signature, half_sig, 32);
    mul_add(signature + 32, h_ram, a, r); // s = h_ram * a + r
    WIPE_BUFFER(h_ram);
    crypto_wipe(ctx, ctx->hash->ctx_size);
}

// Assembly:
pushq %r15
pushq %r14
pushq %rbx
subq $0x40, %rsp
movq %rsi, %r14
movq %rdi, %rbx
movq (%rdi), %rax
movq %rsp, %r15
movq %r15, %rsi
callq *0x18(%rax)
movq %r15, %rdi
callq 0x6584
xorl %eax, %eax
movb 0x48(%rbx,%rax), %cl
movb %cl, (%r14,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x65da
leaq 0x8(%rbx), %rdx
leaq 0x28(%rbx), %rcx
addq $0x20, %r14
movq %rsp, %rsi
movq %r14, %rdi
callq 0x6635
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x40, %rax
jne 0x6604
movq (%rbx), %rax
movq 0x20(%rax), %rax
testq %rax, %rax
je 0x662b
xorl %ecx, %ecx
movb $0x0, (%rbx,%rcx)
incq %rcx
cmpq %rcx, %rax
jne 0x661f
addq $0x40, %rsp
popq %rbx
popq %r14
popq %r15
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: mul_add(unsigned char*, unsigned char const*, unsigned char const*, unsigned char const*)
static void mul_add(u8 r[32], const u8 a[32], const u8 b[32], const u8 c[32])
{
    u32 A[8];  load32_le_buf(A, a, 8);
    u32 B[8];  load32_le_buf(B, b, 8);
    u32 p[16]; load32_le_buf(p, c, 8);  ZERO(p + 8, 8);
    multiply(p, A, B);
    mod_l(r, p);
    WIPE_BUFFER(p);
    WIPE_BUFFER(A);
    WIPE_BUFFER(B);
}

// Assembly:
subq $0x88, %rsp
xorl %eax, %eax
movl (%rsi,%rax,4), %r8d
movl %r8d, 0x20(%rsp,%rax,4)
incq %rax
cmpq $0x8, %rax
jne 0x663e
xorl %eax, %eax
movl (%rdx,%rax,4), %esi
movl %esi, (%rsp,%rax,4)
incq %rax
cmpq $0x8, %rax
jne 0x6652
xorl %eax, %eax
movl (%rcx,%rax,4), %edx
movl %edx, 0x40(%rsp,%rax,4)
incq %rax
cmpq $0x8, %rax
jne 0x6663
xorps %xmm0, %xmm0
leaq 0x40(%rsp), %rax
movaps %xmm0, 0x30(%rax)
movaps %xmm0, 0x20(%rax)
xorl %ecx, %ecx
movl 0x20(%rsp,%rcx,4), %edx
xorl %r8d, %r8d
xorl %esi, %esi
movl (%rax,%r8,4), %r9d
addq %rsi, %r9
movl (%rsp,%r8,4), %esi
imulq %rdx, %rsi
addq %r9, %rsi
movl %esi, (%rax,%r8,4)
shrq $0x20, %rsi
incq %r8
cmpq $0x8, %r8
jne 0x668e
movl %esi, 0x60(%rsp,%rcx,4)
incq %rcx
addq $0x4, %rax
cmpq $0x8, %rcx
jne 0x6685
leaq 0x40(%rsp), %rsi
callq 0x8fcd
xorl %eax, %eax
movb $0x0, 0x40(%rsp,%rax)
incq %rax
cmpq $0x40, %rax
jne 0x66ce
xorl %eax, %eax
movb $0x0, 0x20(%rsp,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x66de
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x66ee
addq $0x88, %rsp
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: crypto_sign
void crypto_sign(u8        signature[64],
                 const u8  secret_key[32],
                 const u8  public_key[32],
                 const u8 *message, size_t message_size)
{
    crypto_sign_ctx ctx;
    crypto_sign_ctx_abstract *actx = (crypto_sign_ctx_abstract*)&ctx;
    crypto_sign_init_first_pass (actx, secret_key, public_key);
    crypto_sign_update          (actx, message, message_size);
    crypto_sign_init_second_pass(actx);
    crypto_sign_update          (actx, message, message_size);
    crypto_sign_final           (actx, signature);
}

// Assembly:
pushq %r15
pushq %r14
pushq %r12
pushq %rbx
subq $0x168, %rsp            # imm = 0x168
movq %r8, %rbx
movq %rcx, %r14
movq %rdi, %r15
leaq 0xb647(%rip), %rcx      # 0x11d68
movq %rsp, %r12
movq %r12, %rdi
callq 0x6463
movq (%r12), %rax
movq %r12, %rdi
movq %r14, %rsi
movq %rbx, %rdx
callq *0x10(%rax)
movq %r12, %rdi
callq 0x64f0
movq (%r12), %rax
movq %r12, %rdi
movq %r14, %rsi
movq %rbx, %rdx
callq *0x10(%rax)
movq %r12, %rdi
movq %r15, %rsi
callq 0x65b5
addq $0x168, %rsp            # imm = 0x168
popq %rbx
popq %r12
popq %r14
popq %r15
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: crypto_check_init_custom_hash
void crypto_check_init_custom_hash(crypto_check_ctx_abstract *ctx,
                                   const u8 signature[64],
                                   const u8 public_key[32],
                                   const crypto_sign_vtable *hash)
{
    ctx->hash = hash; // set vtable
    COPY(ctx->buf, signature , 64);
    COPY(ctx->pk , public_key, 32);
    ctx->hash->init  (ctx);
    ctx->hash->update(ctx, signature , 32);
    ctx->hash->update(ctx, public_key, 32);
}

// Assembly:
pushq %r15
pushq %r14
pushq %rbx
movq %rdx, %rbx
movq %rsi, %r15
movq %rdi, %r14
movq %rcx, (%rdi)
movl $0x8, %eax
movb -0x8(%r15,%rax), %dl
movb %dl, (%r14,%rax)
incq %rax
cmpq $0x48, %rax
jne 0x6784
xorl %eax, %eax
movb (%rbx,%rax), %dl
movb %dl, 0x68(%r14,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x6798
movq %r14, %rdi
callq *0x8(%rcx)
movq (%r14), %rax
movl $0x20, %edx
movq %r14, %rdi
movq %r15, %rsi
callq *0x10(%rax)
movq (%r14), %rax
movq 0x10(%rax), %rax
movl $0x20, %edx
movq %r14, %rdi
movq %rbx, %rsi
popq %rbx
popq %r14
popq %r15
jmpq *%rax
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: crypto_from_eddsa_public
void crypto_from_eddsa_public(u8 x25519[32], const u8 eddsa[32])
{
    fe t1, t2;
    fe_frombytes(t2, eddsa);
    fe_add(t1, fe_one, t2);
    fe_sub(t2, fe_one, t2);
    fe_invert(t2, t2);
    fe_mul(t1, t1, t2);
    fe_tobytes(x25519, t1);
    WIPE_BUFFER(t1);
    WIPE_BUFFER(t2);
}

// Assembly:
pushq %r15
pushq %r14
pushq %rbx
subq $0x60, %rsp
movq %rdi, %rbx
movq %rsp, %rdi
movl $0x1, %edx
callq 0x7eb2
xorl %ecx, %ecx
leaq 0x6ff2(%rip), %rax      # 0xddc0
movl (%rsp,%rcx), %edx
addl (%rcx,%rax), %edx
movl %edx, 0x30(%rsp,%rcx)
addq $0x4, %rcx
cmpq $0x28, %rcx
jne 0x6dce
xorl %ecx, %ecx
movl (%rcx,%rax), %edx
subl (%rsp,%rcx), %edx
movl %edx, (%rsp,%rcx)
addq $0x4, %rcx
cmpq $0x28, %rcx
jne 0x6de4
movq %rsp, %r14
movq %r14, %rdi
movq %r14, %rsi
callq 0x6e4c
leaq 0x30(%rsp), %r15
movq %r15, %rdi
movq %r15, %rsi
movq %r14, %rdx
callq 0x6ea3
movq %rbx, %rdi
movq %r15, %rsi
callq 0x76b5
xorl %eax, %eax
movb $0x0, 0x30(%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x6e25
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x6e35
addq $0x60, %rsp
popq %rbx
popq %r14
popq %r15
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: fe_invert(int*, int const*)
static void fe_invert(fe out, const fe x)
{
    fe tmp;
    fe_sq(tmp, x);
    invsqrt(tmp, tmp);
    fe_sq(tmp, tmp);
    fe_mul(out, tmp, x);
    WIPE_BUFFER(tmp);
}

// Assembly:
pushq %r15
pushq %r14
pushq %rbx
subq $0x30, %rsp
movq %rsi, %rbx
movq %rdi, %r14
movq %rsp, %r15
movq %r15, %rdi
callq 0x810e
movq %r15, %rdi
movq %r15, %rsi
callq 0x85ef
movq %r15, %rdi
movq %r15, %rsi
callq 0x810e
movq %r14, %rdi
movq %r15, %rsi
movq %rbx, %rdx
callq 0x6ea3
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x6e8c
addq $0x30, %rsp
popq %rbx
popq %r14
popq %r15
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: crypto_x25519_dirty_small
void crypto_x25519_dirty_small(u8 public_key[32], const u8 secret_key[32])
{
    // Base point of order 8*L
    // Raw scalar multiplication with it does not clear the cofactor,
    // and the resulting public key will reveal 3 bits of the scalar.
    //
    // The low order component of this base point  has been chosen
    // to yield the same results as crypto_x25519_dirty_fast().
    static const u8 dirty_base_point[32] = {
        0xd8, 0x86, 0x1a, 0xa2, 0x78, 0x7a, 0xd9, 0x26, 0x8b, 0x74, 0x74, 0xb6,
        0x82, 0xe3, 0xbe, 0xc3, 0xce, 0x36, 0x9a, 0x1e, 0x5e, 0x31, 0x47, 0xa2,
        0x6d, 0x37, 0x7c, 0xfd, 0x20, 0xb5, 0xdf, 0x75,
    };
    // separate the main factor & the cofactor of the scalar
    u8 scalar[32];
    COPY(scalar, secret_key, 32);
    trim_scalar(scalar);

    // Separate the main factor and the cofactor
    //
    // The scalar is trimmed, so its cofactor is cleared.  The three
    // least significant bits however still have a main factor.  We must
    // remove it for X25519 compatibility.
    //
    //   cofactor = lsb * L            (modulo 8*L)
    //   combined = scalar + cofactor  (modulo 8*L)
    add_xl(scalar, secret_key[0]);
    scalarmult(public_key, scalar, dirty_base_point, 256);
    WIPE_BUFFER(scalar);
}

// Assembly:
pushq %r14
pushq %rbx
subq $0x28, %rsp
movq %rdi, %rbx
movups (%rsi), %xmm0
movups 0x10(%rsi), %xmm1
movq %rsp, %r14
movaps %xmm0, (%r14)
movaps %xmm1, 0x10(%r14)
andb $-0x8, (%r14)
movb 0x1f(%r14), %al
andb $0x3f, %al
orb $0x40, %al
movb %al, 0x1f(%r14)
movzbl (%rsi), %esi
movq %r14, %rdi
callq 0x78c1
leaq 0x5866(%rip), %rdx      # 0xd100
movq %rbx, %rdi
movq %r14, %rsi
movl $0x100, %ecx            # imm = 0x100
callq 0x5d67
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x78ac
addq $0x28, %rsp
popq %rbx
popq %r14
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: add_xl(unsigned char*, unsigned char)
static void add_xl(u8 s[32], u8 x)
{
    u64 mod8  = x & 7;
    u64 carry = 0;
    FOR (i , 0, 8) {
        carry = carry + load32_le(s + 4*i) + L[i] * mod8;
        store32_le(s + 4*i, (u32)carry);
        carry >>= 32;
    }
}

// Assembly:
andl $0x7, %esi
xorl %eax, %eax
leaq 0x65f3(%rip), %rcx      # 0xdec0
xorl %edx, %edx
movl (%rdi,%rax), %r8d
addq %rdx, %r8
movl (%rax,%rcx), %edx
imulq %rsi, %rdx
addq %r8, %rdx
movl %edx, (%rdi,%rax)
shrq $0x20, %rdx
addq $0x4, %rax
cmpq $0x20, %rax
jne 0x78cf
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: ge_madd(ge*, ge const*, ge_precomp const*, int*, int*)
static void ge_madd(ge *s, const ge *p, const ge_precomp *q, fe a, fe b)
{
    fe_add(a   , p->Y, p->X );
    fe_sub(b   , p->Y, p->X );
    fe_mul(a   , a   , q->Yp);
    fe_mul(b   , b   , q->Ym);
    fe_add(s->Y, a   , b    );
    fe_sub(s->X, a   , b    );

    fe_add(s->Z, p->Z, p->Z );
    fe_mul(s->T, p->T, q->T2);
    fe_add(a   , s->Z, s->T );
    fe_sub(b   , s->Z, s->T );

    fe_mul(s->T, s->X, s->Y);
    fe_mul(s->X, s->X, b   );
    fe_mul(s->Y, s->Y, a   );
    fe_mul(s->Z, a   , b   );
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x18, %rsp
movq %r8, %rbx
movq %rcx, %r14
movq %rdx, %r12
movq %rsi, %rbp
movq %rdi, %r15
xorl %eax, %eax
movl (%rbp,%rax,4), %ecx
addl 0x28(%rbp,%rax,4), %ecx
movl %ecx, (%r14,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x7b76
xorl %eax, %eax
movl 0x28(%rbp,%rax,4), %ecx
subl (%rbp,%rax,4), %ecx
movl %ecx, (%rbx,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x7b8d
movq %r14, %rdi
movq %r14, %rsi
movq %r12, %rdx
callq 0x6ea3
leaq 0x28(%r12), %rdx
movq %rbx, %rdi
movq %rbx, %rsi
callq 0x6ea3
leaq 0x28(%r15), %rax
movq %rax, 0x10(%rsp)
xorl %eax, %eax
movl (%rbx,%rax,4), %ecx
addl (%r14,%rax,4), %ecx
movl %ecx, 0x28(%r15,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x7bca
xorl %eax, %eax
movl (%r14,%rax,4), %ecx
subl (%rbx,%rax,4), %ecx
movl %ecx, (%r15,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x7be1
leaq 0x50(%r15), %rax
movq %rax, 0x8(%rsp)
movl $0x14, %eax
movl (%rbp,%rax,4), %ecx
addl %ecx, %ecx
movl %ecx, (%r15,%rax,4)
incq %rax
cmpq $0x1e, %rax
jne 0x7c03
leaq 0x78(%r15), %r13
addq $0x78, %rbp
addq $0x50, %r12
movq %r13, %rdi
movq %rbp, %rsi
movq %r12, %rdx
callq 0x6ea3
movl $0x14, %eax
movl 0x28(%r15,%rax,4), %ecx
addl (%r15,%rax,4), %ecx
movl %ecx, -0x50(%r14,%rax,4)
incq %rax
cmpq $0x1e, %rax
jne 0x7c35
movl $0x14, %eax
movl (%r15,%rax,4), %ecx
subl 0x28(%r15,%rax,4), %ecx
movl %ecx, -0x50(%rbx,%rax,4)
incq %rax
cmpq $0x1e, %rax
jne 0x7c51
movq %r13, %rdi
movq %r15, %rsi
movq 0x10(%rsp), %r12
movq %r12, %rdx
callq 0x6ea3
movq %r15, %rdi
movq %r15, %rsi
movq %rbx, %rdx
callq 0x6ea3
movq %r12, %rdi
movq %r12, %rsi
movq %r14, %rdx
callq 0x6ea3
movq 0x8(%rsp), %rdi
movq %r14, %rsi
movq %rbx, %rdx
addq $0x18, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
jmp 0x6ea3
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: crypto_hidden_to_curve
void crypto_hidden_to_curve(uint8_t curve[32], const uint8_t hidden[32])
{
    fe r, u, t1, t2, t3;
    fe_frombytes_mask(r, hidden, 2); // r is encoded in 254 bits.
    fe_sq(r, r);
    fe_add(t1, r, r);
    fe_add(u, t1, fe_one);
    fe_sq (t2, u);
    fe_mul(t3, A2, t1);
    fe_sub(t3, t3, t2);
    fe_mul(t3, t3, A);
    fe_mul(t1, t2, u);
    fe_mul(t1, t3, t1);
    int is_square = invsqrt(t1, t1);
    fe_mul(u, r, ufactor);
    fe_ccopy(u, fe_one, is_square);
    fe_sq (t1, t1);
    fe_mul(u, u, A);
    fe_mul(u, u, t3);
    fe_mul(u, u, t2);
    fe_mul(u, u, t1);
    fe_neg(u, u);
    fe_tobytes(curve, u);

    WIPE_BUFFER(t1);  WIPE_BUFFER(r);
    WIPE_BUFFER(t2);  WIPE_BUFFER(u);
    WIPE_BUFFER(t3);
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0xe8, %rsp
movq %rdi, %rbx
leaq 0xc0(%rsp), %r14
movq %r14, %rdi
movl $0x2, %edx
callq 0x7eb2
movq %r14, %rdi
movq %r14, %rsi
callq 0x810e
xorl %eax, %eax
movl 0xc0(%rsp,%rax,4), %ecx
addl %ecx, %ecx
movl %ecx, 0x30(%rsp,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x7cea
xorl %eax, %eax
leaq 0x60b7(%rip), %r13      # 0xddc0
movl (%rax,%r13), %ecx
addl 0x30(%rsp,%rax), %ecx
movl %ecx, (%rsp,%rax)
addq $0x4, %rax
cmpq $0x28, %rax
jne 0x7d09
leaq 0x90(%rsp), %rdi
movq %rsp, %rsi
callq 0x810e
leaq 0x60bb(%rip), %rsi      # 0xddf0
leaq 0x60(%rsp), %rdi
leaq 0x30(%rsp), %rdx
callq 0x6ea3
xorl %eax, %eax
movl 0x90(%rsp,%rax,4), %ecx
subl %ecx, 0x60(%rsp,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x7d46
leaq 0x60bf(%rip), %rdx      # 0xde20
leaq 0x60(%rsp), %r14
movq %r14, %rdi
movq %r14, %rsi
callq 0x6ea3
leaq 0x30(%rsp), %r15
leaq 0x90(%rsp), %rsi
movq %rsp, %r12
movq %r15, %rdi
movq %r12, %rdx
callq 0x6ea3
movq %r15, %rdi
movq %r14, %rsi
movq %r15, %rdx
callq 0x6ea3
movq %r15, %rdi
movq %r15, %rsi
callq 0x85ef
movl %eax, %ebp
leaq 0x5432(%rip), %rdx      # 0xd1e0
leaq 0xc0(%rsp), %rsi
movq %r12, %rdi
callq 0x6ea3
negl %ebp
xorl %eax, %eax
movl (%rsp,%rax), %ecx
movl (%rax,%r13), %edx
xorl %ecx, %edx
andl %ebp, %edx
xorl %ecx, %edx
movl %edx, (%rsp,%rax)
addq $0x4, %rax
cmpq $0x28, %rax
jne 0x7dc2
leaq 0x30(%rsp), %r14
movq %r14, %rdi
movq %r14, %rsi
callq 0x810e
leaq 0x602d(%rip), %rdx      # 0xde20
movq %rsp, %r15
movq %r15, %rdi
movq %r15, %rsi
callq 0x6ea3
leaq 0x60(%rsp), %rdx
movq %r15, %rdi
movq %r15, %rsi
callq 0x6ea3
leaq 0x90(%rsp), %rdx
movq %r15, %rdi
movq %r15, %rsi
callq 0x6ea3
movq %r15, %rdi
movq %r15, %rsi
movq %r14, %rdx
callq 0x6ea3
xorl %eax, %eax
negl (%rsp,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x7e34
movq %rsp, %rsi
movq %rbx, %rdi
callq 0x76b5
xorl %eax, %eax
movb $0x0, 0x30(%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x7e4d
xorl %eax, %eax
movb $0x0, 0xc0(%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x7e5d
xorl %eax, %eax
movb $0x0, 0x90(%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x7e70
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x7e83
xorl %eax, %eax
movb $0x0, 0x60(%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x7e92
addq $0xe8, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: crypto_curve_to_hidden
int crypto_curve_to_hidden(u8 hidden[32], const u8 public_key[32], u8 tweak)
{
    fe t1, t2, t3;
    fe_frombytes(t1, public_key);    // t1 = u

    fe_add(t2, t1, A);               // t2 = u + A
    fe_mul(t3, t1, t2);
    fe_mul_small(t3, t3, -2);
    int is_square = invsqrt(t3, t3); // t3 = sqrt(-1 / non_square * u * (u+A))
    if (is_square) {
        // The only variable time bit.  This ultimately reveals how many
        // tries it took us to find a representable key.
        // This does not affect security as long as we try keys at random.

        fe_ccopy    (t1, t2, tweak & 1); // multiply by u if v is positive,
        fe_mul      (t3, t1, t3);        // multiply by u+A otherwise
        fe_mul_small(t1, t3, 2);
        fe_neg      (t2, t3);
        fe_ccopy    (t3, t2, fe_isodd(t1));
        fe_tobytes(hidden, t3);

        // Pad with two random bits
        hidden[31] |= tweak & 0xc0;
    }

    WIPE_BUFFER(t1);
    WIPE_BUFFER(t2);
    WIPE_BUFFER(t3);
    return is_square - 1;
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r12
pushq %rbx
subq $0xb0, %rsp
movl %edx, %ebx
movq %rdi, %r14
movq %rsp, %rdi
movl $0x1, %edx
callq 0x7eb2
xorl %eax, %eax
leaq 0x54bb(%rip), %rcx      # 0xde20
movl (%rax,%rcx), %edx
addl (%rsp,%rax), %edx
movl %edx, 0x60(%rsp,%rax)
addq $0x4, %rax
cmpq $0x28, %rax
jne 0x8965
leaq 0x30(%rsp), %r15
movq %rsp, %rsi
leaq 0x60(%rsp), %rdx
movq %r15, %rdi
callq 0x6ea3
movq %r15, %rdi
movq %r15, %rsi
movl $0xfffffffe, %edx       # imm = 0xFFFFFFFE
callq 0x8ab5
movq %r15, %rdi
movq %r15, %rsi
callq 0x85ef
movl %eax, %ebp
testl %eax, %eax
je 0x8a72
movl %ebx, %eax
andb $0x1, %al
movzbl %al, %eax
negl %eax
xorl %ecx, %ecx
movl (%rsp,%rcx,4), %edx
movl 0x60(%rsp,%rcx,4), %esi
xorl %edx, %esi
andl %eax, %esi
xorl %edx, %esi
movl %esi, (%rsp,%rcx,4)
incq %rcx
cmpq $0xa, %rcx
jne 0x89be
movq %rsp, %r15
leaq 0x30(%rsp), %r12
movq %r12, %rdi
movq %r15, %rsi
movq %r12, %rdx
callq 0x6ea3
movq %r15, %rdi
movq %r12, %rsi
movl $0x2, %edx
callq 0x8ab5
xorl %eax, %eax
xorl %ecx, %ecx
subl 0x30(%rsp,%rax,4), %ecx
movl %ecx, 0x60(%rsp,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x89ff
leaq 0x90(%rsp), %r15
movq %rsp, %rsi
movq %r15, %rdi
callq 0x76b5
movzbl (%r15), %eax
xorl %ecx, %ecx
movb $0x0, 0x90(%rsp,%rcx)
incq %rcx
cmpq $0x20, %rcx
jne 0x8a2b
andl $0x1, %eax
negl %eax
xorl %ecx, %ecx
movl 0x30(%rsp,%rcx,4), %edx
movl 0x60(%rsp,%rcx,4), %esi
xorl %edx, %esi
andl %eax, %esi
xorl %edx, %esi
movl %esi, 0x30(%rsp,%rcx,4)
incq %rcx
cmpq $0xa, %rcx
jne 0x8a43
leaq 0x30(%rsp), %rsi
movq %r14, %rdi
callq 0x76b5
andb $-0x40, %bl
orb %bl, 0x1f(%r14)
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x8a74
xorl %eax, %eax
movb $0x0, 0x60(%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x8a83
xorl %eax, %eax
movb $0x0, 0x30(%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x8a93
decl %ebp
movl %ebp, %eax
addq $0xb0, %rsp
popq %rbx
popq %r12
popq %r14
popq %r15
popq %rbp
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: crypto_hidden_key_pair
void crypto_hidden_key_pair(u8 hidden[32], u8 secret_key[32], u8 seed[32])
{
    u8 pk [32]; // public key
    u8 buf[64]; // seed + representative
    COPY(buf + 32, seed, 32);
    do {
        crypto_chacha20(buf, 0, 64, buf+32, zero);
        crypto_x25519_dirty_fast(pk, buf); // or the "small" version
    } while(crypto_curve_to_hidden(buf+32, pk, buf[32]));
    // Note that the return value of crypto_curve_to_hidden() is
    // independent from its tweak parameter.
    // Therefore, buf[32] is not actually reused.  Either we loop one
    // more time and buf[32] is used for the new seed, or we succeeded,
    // and buf[32] becomes the tweak parameter.

    crypto_wipe(seed, 32);
    COPY(hidden    , buf + 32, 32);
    COPY(secret_key, buf     , 32);
    WIPE_BUFFER(buf);
    WIPE_BUFFER(pk);
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x78, %rsp
movq %rdx, %r15
movq %rsi, 0x8(%rsp)
movq %rdi, %r14
leaq 0x30(%rsp), %r12
movups (%rdx), %xmm0
movups 0x10(%rdx), %xmm1
movaps %xmm1, 0x10(%r12)
movaps %xmm0, (%r12)
leaq 0x4366(%rip), %r13      # 0xd020
leaq 0x10(%rsp), %rbp
leaq 0x50(%rsp), %rbx
movl $0x40, %edx
movq %rbp, %rdi
xorl %esi, %esi
movq %r12, %rcx
movq %r13, %r8
xorl %r9d, %r9d
callq 0x28c8
movq %rbx, %rdi
movq %rbp, %rsi
callq 0x78f2
movzbl 0x30(%rsp), %edx
movq %r12, %rdi
movq %rbx, %rsi
callq 0x893b
testl %eax, %eax
jne 0x8cc4
xorl %eax, %eax
movb $0x0, (%r15,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x8cfd
movups (%r12), %xmm0
movups 0x10(%r12), %xmm1
movups %xmm1, 0x10(%r14)
movups %xmm0, (%r14)
movaps 0x10(%rsp), %xmm0
movaps 0x20(%rsp), %xmm1
movq 0x8(%rsp), %rax
movups %xmm1, 0x10(%rax)
movups %xmm0, (%rax)
xorl %eax, %eax
movb $0x0, 0x10(%rsp,%rax)
incq %rax
cmpq $0x40, %rax
jne 0x8d37
xorl %eax, %eax
movb $0x0, 0x50(%rsp,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x8d47
addq $0x78, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: mod_l(unsigned char*, unsigned int const*)
static void mod_l(u8 reduced[32], const u32 x[16])
{
    static const u32 r[9] = {0x0a2c131b,0xed9ce5a3,0x086329a7,0x2106215d,
                             0xffffffeb,0xffffffff,0xffffffff,0xffffffff,0xf,};
    // xr = x * r
    u32 xr[25] = {0};
    FOR (i, 0, 9) {
        u64 carry = 0;
        FOR (j, 0, 16) {
            carry  += xr[i+j] + (u64)r[i] * x[j];
            xr[i+j] = (u32)carry;
            carry >>= 32;
        }
        xr[i+16] = (u32)carry;
    }
    // xr = floor(xr / 2^512) * L
    // Since the result is guaranteed to be below 2*L,
    // it is enough to only compute the first 256 bits.
    // The division is performed by saying xr[i+16]. (16 * 32 = 512)
    ZERO(xr, 8);
    FOR (i, 0, 8) {
        u64 carry = 0;
        FOR (j, 0, 8-i) {
            carry   += xr[i+j] + (u64)xr[i+16] * L[j];
            xr[i+j] = (u32)carry;
            carry >>= 32;
        }
    }
    // xr = x - xr
    u64 carry = 1;
    FOR (i, 0, 8) {
        carry  += (u64)x[i] + (~xr[i] & 0xffffffff);
        xr[i]   = (u32)carry;
        carry >>= 32;
    }
    // Final reduction modulo L (conditional subtraction)
    remove_l(xr, xr);
    store32_le_buf(reduced, xr, 8);

    WIPE_BUFFER(xr);
}

// Assembly:
pushq %r15
pushq %r14
pushq %rbx
subq $0x70, %rsp
movq %rdi, %rbx
xorps %xmm0, %xmm0
movq %rsp, %rax
movaps %xmm0, 0x50(%rax)
movaps %xmm0, 0x40(%rax)
movaps %xmm0, 0x30(%rax)
movaps %xmm0, 0x20(%rax)
movaps %xmm0, 0x10(%rax)
movaps %xmm0, (%rax)
movl $0x0, 0x60(%rax)
xorl %ecx, %ecx
leaq 0x4e4a(%rip), %rdx      # 0xde50
movl (%rdx,%rcx,4), %edi
xorl %r9d, %r9d
xorl %r8d, %r8d
movl (%rax,%r9,4), %r10d
addq %r8, %r10
movl (%rsi,%r9,4), %r8d
imulq %rdi, %r8
addq %r10, %r8
movl %r8d, (%rax,%r9,4)
shrq $0x20, %r8
incq %r9
cmpq $0x10, %r9
jne 0x900f
movl %r8d, 0x40(%rsp,%rcx,4)
incq %rcx
addq $0x4, %rax
cmpq $0x9, %rcx
jne 0x9006
xorps %xmm0, %xmm0
movq %rsp, %rax
movaps %xmm0, 0x10(%rax)
movaps %xmm0, (%rax)
xorl %ecx, %ecx
leaq 0x4e66(%rip), %rdx      # 0xdec0
movl $0x8, %edi
subq %rcx, %rdi
movq %rcx, %r8
orq $0x10, %r8
movq %rdx, %r9
xorl %r10d, %r10d
xorl %r11d, %r11d
movl (%rax,%r10,4), %r14d
addq %r11, %r14
movl (%rsp,%r8,4), %r15d
movl (%r9), %r11d
imulq %r15, %r11
addq %r14, %r11
movl %r11d, (%rax,%r10,4)
shrq $0x20, %r11
incq %r10
addq $0x4, %r9
cmpq %rdi, %r10
jb 0x9072
incq %rcx
addq $0x4, %rax
cmpq $0x8, %rcx
jne 0x905a
movl $0x1, %eax
xorl %ecx, %ecx
movl (%rsi,%rcx,4), %edx
addq %rax, %rdx
movl (%rsp,%rcx,4), %eax
notl %eax
addq %rdx, %rax
movl %eax, (%rsp,%rcx,4)
shrq $0x20, %rax
incq %rcx
cmpq $0x8, %rcx
jne 0x90af
movq %rsp, %rdi
movq %rdi, %rsi
callq 0x9c6a
xorl %eax, %eax
movl (%rsp,%rax,4), %ecx
movl %ecx, (%rbx,%rax,4)
incq %rax
cmpq $0x8, %rax
jne 0x90da
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x64, %rax
jne 0x90eb
addq $0x70, %rsp
popq %rbx
popq %r14
popq %r15
retq
// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: redc(unsigned int*, unsigned int*)
static void redc(u32 u[8], u32 x[16])
{
    static const u32 k[8] = { 0x12547e1b, 0xd2b51da3, 0xfdba84ff, 0xb1a206f2,
                              0xffa36bea, 0x14e75438, 0x6fe91836, 0x9db6c6f2, };

    // s = x * k (modulo 2^256)
    // This is cheaper than the full multiplication.
    u32 s[8] = {0};
    FOR (i, 0, 8) {
        u64 carry = 0;
        FOR (j, 0, 8-i) {
            carry  += s[i+j] + (u64)x[i] * k[j];
            s[i+j]  = (u32)carry;
            carry >>= 32;
        }
    }
    u32 t[16] = {0};
    multiply(t, s, L);

    // t = t + x
    u64 carry = 0;
    FOR (i, 0, 16) {
        carry  += (u64)t[i] + x[i];
        t[i]    = (u32)carry;
        carry >>= 32;
    }

    // u = (t / 2^256) % L
    // Note that t / 2^256 is always below 2*L,
    // So a constant time conditional subtraction is enough
    remove_l(u, t+8);

    WIPE_BUFFER(s);
    WIPE_BUFFER(t);
}

// Assembly:
pushq %r14
pushq %rbx
subq $0x68, %rsp
xorps %xmm0, %xmm0
leaq 0x40(%rsp), %rax
movaps %xmm0, 0x10(%rax)
movaps %xmm0, (%rax)
xorl %ecx, %ecx
leaq 0x4dbf(%rip), %rdx      # 0xdee0
movl $0x8, %r8d
subq %rcx, %r8
movl (%rsi,%rcx,4), %r9d
movq %rdx, %r10
xorl %r11d, %r11d
xorl %ebx, %ebx
movl (%rax,%r11,4), %r14d
addq %rbx, %r14
movl (%r10), %ebx
imulq %r9, %rbx
addq %r14, %rbx
movl %ebx, (%rax,%r11,4)
shrq $0x20, %rbx
incq %r11
addq $0x4, %r10
cmpq %r8, %r11
jb 0x9136
incq %rcx
addq $0x4, %rax
cmpq $0x8, %rcx
jne 0x9121
xorps %xmm0, %xmm0
movq %rsp, %rax
movaps %xmm0, 0x30(%rax)
movaps %xmm0, 0x20(%rax)
movaps %xmm0, 0x10(%rax)
movaps %xmm0, (%rax)
xorl %ecx, %ecx
leaq 0x4d3a(%rip), %rdx      # 0xdec0
movl 0x40(%rsp,%rcx,4), %r8d
xorl %r10d, %r10d
xorl %r9d, %r9d
movl (%rax,%r10), %r11d
addq %r9, %r11
movl (%r10,%rdx), %r9d
imulq %r8, %r9
addq %r11, %r9
movl %r9d, (%rax,%r10)
shrq $0x20, %r9
addq $0x4, %r10
cmpq $0x20, %r10
jne 0x9191
movl %r9d, 0x20(%rsp,%rcx,4)
incq %rcx
addq $0x4, %rax
cmpq $0x8, %rcx
jne 0x9186
xorl %eax, %eax
xorl %ecx, %ecx
movl (%rsp,%rax,4), %edx
addq %rcx, %rdx
movl (%rsi,%rax,4), %ecx
addq %rdx, %rcx
movl %ecx, (%rsp,%rax,4)
shrq $0x20, %rcx
incq %rax
cmpq $0x10, %rax
jne 0x91cb
leaq 0x20(%rsp), %rsi
callq 0x9c6a
xorl %eax, %eax
movb $0x0, 0x40(%rsp,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x91f3
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x40, %rax
jne 0x9203
addq $0x68, %rsp
popq %rbx
popq %r14
retq