// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: crypto_x25519_dirty_fast
void crypto_x25519_dirty_fast(u8 public_key[32], const u8 secret_key[32])
{
    // Compute clean scalar multiplication
    u8 scalar[32];
    ge pk;
    COPY(scalar, secret_key, 32);
    trim_scalar(scalar);
    ge_scalarmult_base(&pk, scalar);

    // Compute low order point
    fe t1, t2;
    select_lop(t1, lop_x, sqrtm1, secret_key[0]);
    select_lop(t2, lop_y, fe_one, secret_key[0] + 2);
    ge_precomp low_order_point;
    fe_add(low_order_point.Yp, t2, t1);
    fe_sub(low_order_point.Ym, t2, t1);
    fe_mul(low_order_point.T2, t2, t1);
    fe_mul(low_order_point.T2, low_order_point.T2, D2);

    // Add low order point to the public key
    ge_madd(&pk, &pk, &low_order_point, t1, t2);

    // Convert to Montgomery u coordinate (we ignore the sign)
    fe_add(t1, pk.Z, pk.Y);
    fe_sub(t2, pk.Z, pk.Y);
    fe_invert(t2, t2);
    fe_mul(t1, t1, t2);

    fe_tobytes(public_key, t1);

    WIPE_BUFFER(t1);    WIPE_CTX(&pk);
    WIPE_BUFFER(t2);    WIPE_CTX(&low_order_point);
    WIPE_BUFFER(scalar);
}

// Assembly:
pushq %r15
pushq %r14
pushq %r12
pushq %rbx
subq $0x198, %rsp            # imm = 0x198
movq %rsi, %r14
movq %rdi, %rbx
movups (%rsi), %xmm0
movups 0x10(%rsi), %xmm1
leaq 0x60(%rsp), %rsi
movaps %xmm0, (%rsi)
movaps %xmm1, 0x10(%rsi)
andb $-0x8, (%rsi)
movb 0x1f(%rsi), %al
andb $0x3f, %al
orb $0x40, %al
movb %al, 0x1f(%rsi)
leaq 0x80(%rsp), %rdi
callq 0x61c7
movzbl (%r14), %r14d
leaq 0x57e2(%rip), %rsi      # 0xd120
leaq 0x580b(%rip), %rdx      # 0xd150
leaq 0x30(%rsp), %rdi
movl %r14d, %ecx
callq 0x7ac1
leal 0x2(%r14), %eax
movzbl %al, %ecx
leaq 0x5820(%rip), %rsi      # 0xd180
leaq 0x6459(%rip), %rdx      # 0xddc0
movq %rsp, %rdi
callq 0x7ac1
xorl %eax, %eax
movl 0x30(%rsp,%rax,4), %ecx
addl (%rsp,%rax,4), %ecx
movl %ecx, 0x120(%rsp,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x7971
xorl %eax, %eax
movl (%rsp,%rax,4), %ecx
subl 0x30(%rsp,%rax,4), %ecx
movl %ecx, 0x148(%rsp,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x798a
leaq 0x170(%rsp), %r14
movq %rsp, %r15
leaq 0x30(%rsp), %r12
movq %r14, %rdi
movq %r15, %rsi
movq %r12, %rdx
callq 0x6ea3
leaq 0x57ea(%rip), %rdx      # 0xd1b0
movq %r14, %rdi
movq %r14, %rsi
callq 0x6ea3
leaq 0x80(%rsp), %rdi
leaq 0x120(%rsp), %rdx
movq %rdi, %rsi
movq %r12, %rcx
movq %r15, %r8
callq 0x7b57
movl $0xa, %eax
movl 0x80(%rsp,%rax,4), %ecx
addl 0xa8(%rsp,%rax,4), %ecx
movl %ecx, 0x8(%rsp,%rax,4)
incq %rax
cmpq $0x14, %rax
jne 0x79f4
movl $0xa, %eax
movl 0xa8(%rsp,%rax,4), %ecx
subl 0x80(%rsp,%rax,4), %ecx
movl %ecx, -0x28(%rsp,%rax,4)
incq %rax
cmpq $0x14, %rax
jne 0x7a14
movq %rsp, %r14
movq %r14, %rdi
movq %r14, %rsi
callq 0x6e4c
leaq 0x30(%rsp), %r15
movq %r15, %rdi
movq %r15, %rsi
movq %r14, %rdx
callq 0x6ea3
movq %rbx, %rdi
movq %r15, %rsi
callq 0x76b5
xorl %eax, %eax
movb $0x0, 0x30(%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x7a5d
xorl %eax, %eax
movb $0x0, 0x80(%rsp,%rax)
incq %rax
cmpq $0xa0, %rax
jne 0x7a6d
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x28, %rax
jne 0x7a82
xorl %eax, %eax
movb $0x0, 0x120(%rsp,%rax)
incq %rax
cmpq $0x78, %rax
jne 0x7a91
xorl %eax, %eax
movb $0x0, 0x60(%rsp,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x7aa4
addq $0x198, %rsp            # imm = 0x198
popq %rbx
popq %r12
popq %r14
popq %r15
retq