// File: /workspace/github_c_makefile_star2_O0/LoupVaillant[P]Monocypher-Utils/src/monocypher.c
// Function: ge_scalarmult_base
static void ge_scalarmult_base(ge *p, const u8 scalar[32])
{
    // 5-bits signed comb, from Mike Hamburg's
    // Fast and compact elliptic-curve cryptography (2012)
    static const u8 half_mod_L[32] = { // 1 / 2 modulo L
        0xf7, 0xe9, 0x7a, 0x2e, 0x8d, 0x31, 0x09, 0x2c,
        0x6b, 0xce, 0x7b, 0x51, 0xef, 0x7c, 0x6f, 0x0a,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08,
    };
    static const u8 half_ones[32] = { // (2^255 - 1) / 2 modulo L
        0x42, 0x9a, 0xa3, 0xba, 0x23, 0xa5, 0xbf, 0xcb,
        0x11, 0x5b, 0x9d, 0xc5, 0x74, 0x95, 0xf3, 0xb6,
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x07,
    };
    // All bits set form: 1 means 1, 0 means -1
    u8 s_scalar[32];
    mul_add(s_scalar, scalar, half_mod_L, half_ones);

    // Double and add ladder
    fe yp, ym, t2, n2, a, b; // temporaries for addition
    ge dbl;                  // temporary for doublings
    ge_zero(p);
    for (int i = 50; i >= 0; i--) {
        if (i < 50) {
            ge_double(p, p, &dbl);
        }
        fe_1(yp);
        fe_1(ym);
        fe_0(t2);
        u8 teeth =  scalar_bit(s_scalar, i)
            +      (scalar_bit(s_scalar, i +  51) << 1)
            +      (scalar_bit(s_scalar, i + 102) << 2)
            +      (scalar_bit(s_scalar, i + 153) << 3)
            +      (scalar_bit(s_scalar, i + 204) << 4);
        u8 high  = teeth >> 4;
        u8 index = (teeth ^ (high - 1)) & 15;
        FOR (j, 0, 16) {
            i32 select = 1 & (((j ^ index) - 1) >> 8);
            fe_ccopy(yp, comb_Yp[j], select);
            fe_ccopy(ym, comb_Ym[j], select);
            fe_ccopy(t2, comb_T2[j], select);
        }

        fe_neg(n2, t2);
        fe_cswap(t2, n2, high);
        fe_cswap(yp, ym, high);
        ge_madd(p, p, ym, yp, n2, a, b);
    }
    WIPE_CTX(&dbl);
    WIPE_BUFFER(a);  WIPE_BUFFER(yp);  WIPE_BUFFER(t2);
    WIPE_BUFFER(b);  WIPE_BUFFER(ym);  WIPE_BUFFER(n2);
    WIPE_BUFFER(s_scalar);
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x220, %rsp            # imm = 0x220
movq %rdi, -0x8(%rbp)
movq %rsi, -0x10(%rbp)
leaq -0x30(%rbp), %rdi
movq -0x10(%rbp), %rsi
leaq 0x796e(%rip), %rdx      # 0x126f0
leaq 0x7987(%rip), %rcx      # 0x12710
callq 0xb480
movq -0x8(%rbp), %rdi
callq 0xf980
movl $0x32, -0x1f4(%rbp)
cmpl $0x0, -0x1f4(%rbp)
jl 0xb00b
cmpl $0x32, -0x1f4(%rbp)
jge 0xadcb
movq -0x8(%rbp), %rdi
movq -0x8(%rbp), %rsi
leaq -0x1f0(%rbp), %rdx
callq 0xf9d0
leaq -0x60(%rbp), %rdi
callq 0x8f60
leaq -0x90(%rbp), %rdi
callq 0x8f60
leaq -0xc0(%rbp), %rdi
callq 0x8fa0
leaq -0x30(%rbp), %rdi
movl -0x1f4(%rbp), %esi
callq 0x9030
movl %eax, -0x214(%rbp)
leaq -0x30(%rbp), %rdi
movl -0x1f4(%rbp), %esi
addl $0x33, %esi
callq 0x9030
movl %eax, %ecx
movl -0x214(%rbp), %eax
shll %ecx
addl %ecx, %eax
movl %eax, -0x210(%rbp)
leaq -0x30(%rbp), %rdi
movl -0x1f4(%rbp), %esi
addl $0x66, %esi
callq 0x9030
movl %eax, %ecx
movl -0x210(%rbp), %eax
shll $0x2, %ecx
addl %ecx, %eax
movl %eax, -0x20c(%rbp)
leaq -0x30(%rbp), %rdi
movl -0x1f4(%rbp), %esi
addl $0x99, %esi
callq 0x9030
movl %eax, %ecx
movl -0x20c(%rbp), %eax
shll $0x3, %ecx
addl %ecx, %eax
movl %eax, -0x208(%rbp)
leaq -0x30(%rbp), %rdi
movl -0x1f4(%rbp), %esi
addl $0xcc, %esi
callq 0x9030
movl %eax, %ecx
movl -0x208(%rbp), %eax
shll $0x4, %ecx
addl %ecx, %eax
movb %al, -0x1f5(%rbp)
movzbl -0x1f5(%rbp), %eax
sarl $0x4, %eax
movb %al, -0x1f6(%rbp)
movzbl -0x1f5(%rbp), %eax
movzbl -0x1f6(%rbp), %ecx
subl $0x1, %ecx
xorl %ecx, %eax
andl $0xf, %eax
movb %al, -0x1f7(%rbp)
movq $0x0, -0x200(%rbp)
cmpq $0x10, -0x200(%rbp)
jae 0xaf82
movq -0x200(%rbp), %rax
movzbl -0x1f7(%rbp), %ecx
xorq %rcx, %rax
subq $0x1, %rax
shrq $0x8, %rax
andq $0x1, %rax
movl %eax, -0x204(%rbp)
leaq -0x60(%rbp), %rdi
leaq 0x7823(%rip), %rsi      # 0x12730
imulq $0x28, -0x200(%rbp), %rax
addq %rax, %rsi
movl -0x204(%rbp), %edx
callq 0xfb20
leaq -0x90(%rbp), %rdi
leaq 0x7a7f(%rip), %rsi      # 0x129b0
imulq $0x28, -0x200(%rbp), %rax
addq %rax, %rsi
movl -0x204(%rbp), %edx
callq 0xfb20
leaq -0xc0(%rbp), %rdi
leaq 0x7cdb(%rip), %rsi      # 0x12c30
imulq $0x28, -0x200(%rbp), %rax
addq %rax, %rsi
movl -0x204(%rbp), %edx
callq 0xfb20
movq -0x200(%rbp), %rax
addq $0x1, %rax
movq %rax, -0x200(%rbp)
jmp 0xaed1
leaq -0xf0(%rbp), %rdi
leaq -0xc0(%rbp), %rsi
callq 0xfb90
leaq -0xc0(%rbp), %rdi
leaq -0xf0(%rbp), %rsi
movzbl -0x1f6(%rbp), %edx
callq 0x9060
leaq -0x60(%rbp), %rdi
leaq -0x90(%rbp), %rsi
movzbl -0x1f6(%rbp), %edx
callq 0x9060
movq -0x8(%rbp), %rdi
movq -0x8(%rbp), %rsi
leaq -0x90(%rbp), %rdx
leaq -0x60(%rbp), %rcx
leaq -0xf0(%rbp), %r8
leaq -0x120(%rbp), %r9
leaq -0x150(%rbp), %rax
movq %rax, (%rsp)
callq 0xfbe0
movl -0x1f4(%rbp), %eax
addl $-0x1, %eax
movl %eax, -0x1f4(%rbp)
jmp 0xada1
leaq -0x1f0(%rbp), %rdi
movl $0xa0, %esi
callq 0x1b40
leaq -0x120(%rbp), %rdi
movl $0x28, %esi
callq 0x1b40
leaq -0x60(%rbp), %rdi
movl $0x28, %esi
callq 0x1b40
leaq -0xc0(%rbp), %rdi
movl $0x28, %esi
callq 0x1b40
leaq -0x150(%rbp), %rdi
movl $0x28, %esi
callq 0x1b40
leaq -0x90(%rbp), %rdi
movl $0x28, %esi
callq 0x1b40
leaq -0xf0(%rbp), %rdi
movl $0x28, %esi
callq 0x1b40
leaq -0x30(%rbp), %rdi
movl $0x20, %esi
callq 0x1b40
addq $0x220, %rsp            # imm = 0x220
popq %rbp
retq
nopw %cs:(%rax,%rax)