// File: /workspace/github_c_makefile_star2_O3/Tarsnap[P]spiped/liball/../libcperciva/crypto/crypto_dh.c
// Function: blinded_modexp
static int
blinded_modexp(uint8_t r[CRYPTO_DH_PUBLEN], BIGNUM * a,
    const uint8_t priv[CRYPTO_DH_PRIVLEN])
{
	BIGNUM * two_exp_256_bn;
	BIGNUM * priv_bn;
	uint8_t blinding[CRYPTO_DH_PRIVLEN];
	BIGNUM * blinding_bn;
	BIGNUM * priv_blinded;
	BIGNUM * m_bn;
	BN_CTX * ctx;
	BIGNUM * r1;
	BIGNUM * r2;
	int rlen;

	/* Construct 2^256 in BN representation. */
	if ((two_exp_256_bn = BN_bin2bn(two_exp_256, 33, NULL)) == NULL) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err0;
	}

	/* Construct 2^258 + ${priv} in BN representation. */
	if ((priv_bn = BN_bin2bn(priv, CRYPTO_DH_PRIVLEN, NULL)) == NULL) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err1;
	}
	if ((!BN_add(priv_bn, priv_bn, two_exp_256_bn)) ||
	    (!BN_add(priv_bn, priv_bn, two_exp_256_bn)) ||
	    (!BN_add(priv_bn, priv_bn, two_exp_256_bn)) ||
	    (!BN_add(priv_bn, priv_bn, two_exp_256_bn))) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err2;
	}

	/* Generate blinding exponent. */
	if (crypto_entropy_read(blinding, CRYPTO_DH_PRIVLEN))
		goto err2;
	if ((blinding_bn = BN_bin2bn(blinding,
	    CRYPTO_DH_PRIVLEN, NULL)) == NULL) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err2;
	}
	if (!BN_add(blinding_bn, blinding_bn, two_exp_256_bn)) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err3;
	}

	/* Generate blinded exponent. */
	if ((priv_blinded = BN_new()) == NULL) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err3;
	}
	if (!BN_sub(priv_blinded, priv_bn, blinding_bn)) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err4;
	}

	/* Construct group #14 modulus in BN representation. */
	if ((m_bn = BN_bin2bn(crypto_dh_group14, 256, NULL)) == NULL) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err4;
	}

	/* Allocate BN context. */
	if ((ctx = BN_CTX_new()) == NULL) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err5;
	}

	/* Allocate space for storing results of exponentiations. */
	if ((r1 = BN_new()) == NULL) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err6;
	}
	if ((r2 = BN_new()) == NULL) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err7;
	}

	/* Perform modular exponentiations. */
	if (!BN_mod_exp(r1, a, blinding_bn, m_bn, ctx)) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err8;
	}
	if (!BN_mod_exp(r2, a, priv_blinded, m_bn, ctx)) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err8;
	}

	/* Compute final result and export to big-endian integer format. */
	if (!BN_mod_mul(r1, r1, r2, m_bn, ctx)) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err8;
	}
	rlen = BN_num_bytes(r1);
	if (rlen < 0) {
		warn0("Unexpected error in OpenSSL");
		goto err8;
	}
	if (rlen > CRYPTO_DH_PUBLEN) {
		warn0("Exponent result too large!");
		goto err8;
	}
	memset(r, 0, CRYPTO_DH_PUBLEN - (size_t)rlen);
	BN_bn2bin(r1, &r[CRYPTO_DH_PUBLEN - (size_t)rlen]);

	/* Free space allocated by BN_new. */
	BN_clear_free(r2);
	BN_clear_free(r1);

	/* Free context allocated by BN_CTX_new. */
	BN_CTX_free(ctx);

	/* Free space allocated by BN_bin2bn. */
	BN_free(m_bn);

	/* Free space allocated by BN_new. */
	BN_clear_free(priv_blinded);

	/* Free space allocated by BN_bin2bn. */
	BN_clear_free(blinding_bn);
	BN_clear_free(priv_bn);
	BN_free(two_exp_256_bn);

	/* Success! */
	return (0);

err8:
	BN_clear_free(r2);
err7:
	BN_clear_free(r1);
err6:
	BN_CTX_free(ctx);
err5:
	BN_free(m_bn);
err4:
	BN_clear_free(priv_blinded);
err3:
	BN_clear_free(blinding_bn);
err2:
	BN_clear_free(priv_bn);
err1:
	BN_free(two_exp_256_bn);
err0:
	/* Failure! */
	return (-1);
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x58, %rsp
movq %rdx, %r14
movq %rsi, %r13
movq %rdi, %rbp
leaq 0x6680(%rip), %rdi      # 0xfd80
movl $0x21, %esi
xorl %edx, %edx
callq 0x2110
testq %rax, %rax
je 0x98f0
movq %rax, %rbx
movq %r14, %rdi
movl $0x20, %esi
xorl %edx, %edx
callq 0x2110
testq %rax, %rax
je 0x9952
movq %rax, %r14
movq %rax, %rdi
movq %rax, %rsi
movq %rbx, %rdx
callq 0x2230
testl %eax, %eax
je 0x991d
movq %r14, %rdi
movq %r14, %rsi
movq %rbx, %rdx
callq 0x2230
testl %eax, %eax
je 0x991d
movq %r14, %rdi
movq %r14, %rsi
movq %rbx, %rdx
callq 0x2230
testl %eax, %eax
je 0x991d
movq %r14, %rdi
movq %r14, %rsi
movq %rbx, %rdx
callq 0x2230
testl %eax, %eax
je 0x991d
leaq 0x30(%rsp), %rdi
movl $0x20, %esi
callq 0x9c88
testl %eax, %eax
jne 0x9948
leaq 0x30(%rsp), %rdi
movl $0x20, %esi
xorl %edx, %edx
callq 0x2110
testq %rax, %rax
je 0x991d
movq %rax, %r15
movq %rax, %rdi
movq %rax, %rsi
movq %rbx, %rdx
callq 0x2230
testl %eax, %eax
je 0x999d
callq 0x21b0
testq %rax, %rax
je 0x999d
movq %rax, %r12
movq %rax, %rdi
movq %r14, %rsi
movq %r15, %rdx
callq 0x22f0
testl %eax, %eax
je 0x99cd
leaq 0x65ad(%rip), %rdi      # 0xfdb0
movl $0x100, %esi            # imm = 0x100
xorl %edx, %edx
callq 0x2110
testq %rax, %rax
je 0x99cd
movq %rax, 0x18(%rsp)
callq 0x21e0
movq %rax, 0x8(%rsp)
testq %rax, %rax
je 0x99fd
callq 0x21b0
testq %rax, %rax
je 0x9a2d
movq %rax, 0x10(%rsp)
callq 0x21b0
testq %rax, %rax
je 0x9a62
movq %rax, 0x20(%rsp)
movq 0x10(%rsp), %rdi
movq %r13, %rsi
movq %r15, %rdx
movq 0x18(%rsp), %rcx
movq 0x8(%rsp), %r8
callq 0x2310
testl %eax, %eax
je 0x9ab6
movq 0x20(%rsp), %rdi
movq %r13, %rsi
movq %r12, %rdx
movq 0x18(%rsp), %rcx
movq 0x8(%rsp), %r13
movq %r13, %r8
callq 0x2310
testl %eax, %eax
je 0x9a94
movq 0x10(%rsp), %rdi
movq %rdi, %rsi
movq 0x20(%rsp), %rdx
movq 0x18(%rsp), %rcx
movq %r13, %r8
callq 0x2070
testl %eax, %eax
je 0x9a94
movq 0x10(%rsp), %rdi
callq 0x2270
leal 0x7(%rax), %edx
leal 0xe(%rax), %ecx
testl %edx, %edx
cmovnsl %edx, %ecx
cmpl $-0xf, %eax
jg 0x9b21
leaq 0x6465(%rip), %rdi      # 0xfd49
xorl %eax, %eax
callq 0xc1db
jmp 0x9adb
callq 0x24d0
movq %rax, %rdi
xorl %esi, %esi
callq 0x22e0
leaq 0x5ba5(%rip), %rdi      # 0xf4ab
movq %rax, %rsi
xorl %eax, %eax
callq 0xc1db
callq 0x2370
movl $0x0, (%rax)
jmp 0x9985
callq 0x24d0
movq %rax, %rdi
xorl %esi, %esi
callq 0x22e0
leaq 0x5b78(%rip), %rdi      # 0xf4ab
movq %rax, %rsi
xorl %eax, %eax
callq 0xc1db
callq 0x2370
movl $0x0, (%rax)
movq %r14, %rdi
callq 0x2290
jmp 0x997d
callq 0x24d0
movq %rax, %rdi
xorl %esi, %esi
callq 0x22e0
leaq 0x5b43(%rip), %rdi      # 0xf4ab
movq %rax, %rsi
xorl %eax, %eax
callq 0xc1db
callq 0x2370
movl $0x0, (%rax)
movq %rbx, %rdi
callq 0x20b0
movl $0xffffffff, %r13d      # imm = 0xFFFFFFFF
movl %r13d, %eax
addq $0x58, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
callq 0x24d0
movq %rax, %rdi
xorl %esi, %esi
callq 0x22e0
leaq 0x5af8(%rip), %rdi      # 0xf4ab
movq %rax, %rsi
xorl %eax, %eax
callq 0xc1db
callq 0x2370
movl $0x0, (%rax)
jmp 0x9b14
callq 0x24d0
movq %rax, %rdi
xorl %esi, %esi
callq 0x22e0
leaq 0x5ac8(%rip), %rdi      # 0xf4ab
movq %rax, %rsi
xorl %eax, %eax
callq 0xc1db
callq 0x2370
movl $0x0, (%rax)
jmp 0x9b0c
callq 0x24d0
movq %rax, %rdi
xorl %esi, %esi
callq 0x22e0
leaq 0x5a98(%rip), %rdi      # 0xf4ab
movq %rax, %rsi
xorl %eax, %eax
callq 0xc1db
callq 0x2370
movl $0x0, (%rax)
jmp 0x9b02
callq 0x24d0
movq %rax, %rdi
xorl %esi, %esi
callq 0x22e0
leaq 0x5a68(%rip), %rdi      # 0xf4ab
movq %rax, %rsi
xorl %eax, %eax
callq 0xc1db
callq 0x2370
movl $0x0, (%rax)
movq 0x8(%rsp), %r13
jmp 0x9afa
callq 0x24d0
movq %rax, %rdi
xorl %esi, %esi
callq 0x22e0
leaq 0x5a33(%rip), %rdi      # 0xf4ab
movq %rax, %rsi
xorl %eax, %eax
callq 0xc1db
callq 0x2370
movl $0x0, (%rax)
movq 0x8(%rsp), %r13
jmp 0x9af0
callq 0x24d0
movq %rax, %rdi
xorl %esi, %esi
callq 0x22e0
leaq 0x5a01(%rip), %rdi      # 0xf4ab
movq %rax, %rsi
xorl %eax, %eax
callq 0xc1db
jmp 0x9adb
callq 0x24d0
movq %rax, %rdi
xorl %esi, %esi
callq 0x22e0
leaq 0x59df(%rip), %rdi      # 0xf4ab
movq %rax, %rsi
xorl %eax, %eax
callq 0xc1db
movq 0x8(%rsp), %r13
callq 0x2370
movl $0x0, (%rax)
movq 0x20(%rsp), %rdi
callq 0x2290
movq 0x10(%rsp), %rdi
callq 0x2290
movq %r13, %rdi
callq 0x2390
movq 0x18(%rsp), %rdi
callq 0x20b0
movq %r12, %rdi
callq 0x2290
movq %r15, %rdi
callq 0x2290
jmp 0x9948
cmpl $0x801, %eax            # imm = 0x801
jl 0x9b38
leaq 0x6236(%rip), %rdi      # 0xfd65
xorl %eax, %eax
callq 0xc1db
jmp 0x9ad6
sarl $0x3, %ecx
movl %ecx, %eax
movl $0x100, %edx            # imm = 0x100
subq %rax, %rdx
movq %rdx, 0x28(%rsp)
xorl %r13d, %r13d
movq %rbp, %rdi
xorl %esi, %esi
callq 0x2080
movq 0x28(%rsp), %rsi
addq %rbp, %rsi
movq 0x10(%rsp), %rbp
movq %rbp, %rdi
callq 0x2140
movq 0x20(%rsp), %rdi
callq 0x2290
movq %rbp, %rdi
callq 0x2290
movq 0x8(%rsp), %rdi
callq 0x2390
movq 0x18(%rsp), %rdi
callq 0x20b0
movq %r12, %rdi
callq 0x2290
movq %r15, %rdi
callq 0x2290
movq %r14, %rdi
callq 0x2290
movq %rbx, %rdi
callq 0x20b0
jmp 0x998b