// File: occivink[P]pyct/monocypher.cpp
// Function: fe_tobytes(unsigned char*, int const*)
static void fe_tobytes(u8 s[32], const fe h)
{
    i32 t[10];
    COPY(t, h, 10);
    i32 q = (19 * t[9] + (((i32) 1) << 24)) >> 25;
    //                 |t9|                    < 1.1 * 2^24
    //  -1.1 * 2^24  <  t9                     < 1.1 * 2^24
    //  -21  * 2^24  <  19 * t9                < 21  * 2^24
    //  -2^29        <  19 * t9 + 2^24         < 2^29
    //  -2^29 / 2^25 < (19 * t9 + 2^24) / 2^25 < 2^29 / 2^25
    //  -16          < (19 * t9 + 2^24) / 2^25 < 16
    FOR (i, 0, 5) {
        q += t[2*i  ]; q >>= 26; // q = 0 or -1
        q += t[2*i+1]; q >>= 25; // q = 0 or -1
    }
    // q =  0 iff h >= 0
    // q = -1 iff h <  0
    // Adding q * 19 to h reduces h to its proper range.
    q *= 19;  // Shift carry back to the beginning
    FOR (i, 0, 5) {
        t[i*2  ] += q;  q = t[i*2  ] >> 26;  t[i*2  ] -= q * ((i32)1 << 26);
        t[i*2+1] += q;  q = t[i*2+1] >> 25;  t[i*2+1] -= q * ((i32)1 << 25);
    }
    // h is now fully reduced, and q represents the excess bit.

    store32_le(s +  0, ((u32)t[0] >>  0) | ((u32)t[1] << 26));
    store32_le(s +  4, ((u32)t[1] >>  6) | ((u32)t[2] << 19));
    store32_le(s +  8, ((u32)t[2] >> 13) | ((u32)t[3] << 13));
    store32_le(s + 12, ((u32)t[3] >> 19) | ((u32)t[4] <<  6));
    store32_le(s + 16, ((u32)t[5] >>  0) | ((u32)t[6] << 25));
    store32_le(s + 20, ((u32)t[6] >>  7) | ((u32)t[7] << 19));
    store32_le(s + 24, ((u32)t[7] >> 13) | ((u32)t[8] << 12));
    store32_le(s + 28, ((u32)t[8] >> 20) | ((u32)t[9] <<  6));

    WIPE_BUFFER(t);
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x60, %rsp
movq %rdi, -0x8(%rbp)
movq %rsi, -0x10(%rbp)
movq $0x0, -0x48(%rbp)
cmpq $0xa, -0x48(%rbp)
jae 0xf840
movq -0x10(%rbp), %rax
movq -0x48(%rbp), %rcx
movl (%rax,%rcx,4), %ecx
movq -0x48(%rbp), %rax
movl %ecx, -0x40(%rbp,%rax,4)
movq -0x48(%rbp), %rax
addq $0x1, %rax
movq %rax, -0x48(%rbp)
jmp 0xf818
imull $0x13, -0x1c(%rbp), %eax
addl $0x1000000, %eax        # imm = 0x1000000
sarl $0x19, %eax
movl %eax, -0x4c(%rbp)
movq $0x0, -0x58(%rbp)
cmpq $0x5, -0x58(%rbp)
jae 0xf8a0
movq -0x58(%rbp), %rax
shlq %rax
movl -0x40(%rbp,%rax,4), %eax
addl -0x4c(%rbp), %eax
movl %eax, -0x4c(%rbp)
movl -0x4c(%rbp), %eax
sarl $0x1a, %eax
movl %eax, -0x4c(%rbp)
movq -0x58(%rbp), %rax
shlq %rax
movl -0x3c(%rbp,%rax,4), %eax
addl -0x4c(%rbp), %eax
movl %eax, -0x4c(%rbp)
movl -0x4c(%rbp), %eax
sarl $0x19, %eax
movl %eax, -0x4c(%rbp)
movq -0x58(%rbp), %rax
addq $0x1, %rax
movq %rax, -0x58(%rbp)
jmp 0xf857
imull $0x13, -0x4c(%rbp), %eax
movl %eax, -0x4c(%rbp)
movq $0x0, -0x60(%rbp)
cmpq $0x5, -0x60(%rbp)
jae 0xf93f
movl -0x4c(%rbp), %ecx
movq -0x60(%rbp), %rax
shlq %rax
addl -0x40(%rbp,%rax,4), %ecx
movl %ecx, -0x40(%rbp,%rax,4)
movq -0x60(%rbp), %rax
shlq %rax
movl -0x40(%rbp,%rax,4), %eax
sarl $0x1a, %eax
movl %eax, -0x4c(%rbp)
movl -0x4c(%rbp), %edx
shll $0x1a, %edx
movq -0x60(%rbp), %rax
shlq %rax
movl -0x40(%rbp,%rax,4), %ecx
subl %edx, %ecx
movl %ecx, -0x40(%rbp,%rax,4)
movl -0x4c(%rbp), %ecx
movq -0x60(%rbp), %rax
shlq %rax
addl -0x3c(%rbp,%rax,4), %ecx
movl %ecx, -0x3c(%rbp,%rax,4)
movq -0x60(%rbp), %rax
shlq %rax
movl -0x3c(%rbp,%rax,4), %eax
sarl $0x19, %eax
movl %eax, -0x4c(%rbp)
movl -0x4c(%rbp), %edx
shll $0x19, %edx
movq -0x60(%rbp), %rax
shlq %rax
movl -0x3c(%rbp,%rax,4), %ecx
subl %edx, %ecx
movl %ecx, -0x3c(%rbp,%rax,4)
movq -0x60(%rbp), %rax
addq $0x1, %rax
movq %rax, -0x60(%rbp)
jmp 0xf8af
movq -0x8(%rbp), %rdi
movl -0x40(%rbp), %esi
shrl $0x0, %esi
movl -0x3c(%rbp), %eax
shll $0x1a, %eax
orl %eax, %esi
callq 0x42a0
movq -0x8(%rbp), %rdi
addq $0x4, %rdi
movl -0x3c(%rbp), %esi
shrl $0x6, %esi
movl -0x38(%rbp), %eax
shll $0x13, %eax
orl %eax, %esi
callq 0x42a0
movq -0x8(%rbp), %rdi
addq $0x8, %rdi
movl -0x38(%rbp), %esi
shrl $0xd, %esi
movl -0x34(%rbp), %eax
shll $0xd, %eax
orl %eax, %esi
callq 0x42a0
movq -0x8(%rbp), %rdi
addq $0xc, %rdi
movl -0x34(%rbp), %esi
shrl $0x13, %esi
movl -0x30(%rbp), %eax
shll $0x6, %eax
orl %eax, %esi
callq 0x42a0
movq -0x8(%rbp), %rdi
addq $0x10, %rdi
movl -0x2c(%rbp), %esi
shrl $0x0, %esi
movl -0x28(%rbp), %eax
shll $0x19, %eax
orl %eax, %esi
callq 0x42a0
movq -0x8(%rbp), %rdi
addq $0x14, %rdi
movl -0x28(%rbp), %esi
shrl $0x7, %esi
movl -0x24(%rbp), %eax
shll $0x13, %eax
orl %eax, %esi
callq 0x42a0
movq -0x8(%rbp), %rdi
addq $0x18, %rdi
movl -0x24(%rbp), %esi
shrl $0xd, %esi
movl -0x20(%rbp), %eax
shll $0xc, %eax
orl %eax, %esi
callq 0x42a0
movq -0x8(%rbp), %rdi
addq $0x1c, %rdi
movl -0x20(%rbp), %esi
shrl $0x14, %esi
movl -0x1c(%rbp), %eax
shll $0x6, %eax
orl %eax, %esi
callq 0x42a0
leaq -0x40(%rbp), %rdi
movl $0x28, %esi
callq 0x3890
addq $0x60, %rsp
popq %rbp
retq
nopw (%rax,%rax)