// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: crypto_x25519_inverse
void crypto_x25519_inverse(u8 blind_salt [32], const u8 private_key[32],
                           const u8 curve_point[32])
{
    static const  u8 Lm2[32] = { // L - 2
        0xeb, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7, 0xa2,
        0xde, 0xf9, 0xde, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, };
    // 1 in Montgomery form
    u32 m_inv [8] = {0x8d98951d, 0xd6ec3174, 0x737dcf70, 0xc6ef5bf4,
                     0xfffffffe, 0xffffffff, 0xffffffff, 0x0fffffff,};

    u8 scalar[32];
    COPY(scalar, private_key, 32);
    trim_scalar(scalar);

    // Convert the scalar in Montgomery form
    // m_scl = scalar * 2^256 (modulo L)
    u32 m_scl[8];
    {
        u32 tmp[16];
        ZERO(tmp, 8);
        load32_le_buf(tmp+8, scalar, 8);
        mod_l(scalar, tmp);
        load32_le_buf(m_scl, scalar, 8);
        WIPE_BUFFER(tmp); // Wipe ASAP to save stack space
    }

    // Compute the inverse
    u32 product[16];
    for (int i = 252; i >= 0; i--) {
        ZERO(product, 16);
        multiply(product, m_inv, m_inv);
        redc(m_inv, product);
        if (scalar_bit(Lm2, i)) {
            ZERO(product, 16);
            multiply(product, m_inv, m_scl);
            redc(m_inv, product);
        }
    }
    // Convert the inverse *out* of Montgomery form
    // scalar = m_inv / 2^256 (modulo L)
    COPY(product, m_inv, 8);
    ZERO(product + 8, 8);
    redc(m_inv, product);
    store32_le_buf(scalar, m_inv, 8); // the *inverse* of the scalar

    // Clear the cofactor of scalar:
    //   cleared = scalar * (3*L + 1)      (modulo 8*L)
    //   cleared = scalar + scalar * 3 * L (modulo 8*L)
    // Note that (scalar * 3) is reduced modulo 8, so we only need the
    // first byte.
    add_xl(scalar, scalar[0] * 3);

    // Recall that 8*L < 2^256. However it is also very close to
    // 2^255. If we spanned the ladder over 255 bits, random tests
    // wouldn't catch the off-by-one error.
    scalarmult(blind_salt, scalar, curve_point, 256);

    WIPE_BUFFER(scalar);   WIPE_BUFFER(m_scl);
    WIPE_BUFFER(product);  WIPE_BUFFER(m_inv);
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0xa8, %rsp
movq %rdx, %rbx
movq %rdi, %r14
movaps 0x4f8e(%rip), %xmm0     # 0xded0
movaps %xmm0, 0x10(%rsp)
movaps 0x4f72(%rip), %xmm0     # 0xdec0
movaps %xmm0, (%rsp)
movups (%rsi), %xmm0
movups 0x10(%rsi), %xmm1
leaq 0x80(%rsp), %r12
movaps %xmm0, (%r12)
movaps %xmm1, 0x10(%r12)
andb $-0x8, (%r12)
movb 0x1f(%r12), %al
andb $0x3f, %al
orb $0x40, %al
movb %al, 0x1f(%r12)
xorps %xmm0, %xmm0
leaq 0x20(%rsp), %r15
movaps %xmm0, 0x10(%r15)
movaps %xmm0, (%r15)
movaps (%r12), %xmm0
movaps %xmm0, 0x20(%r15)
movq 0x10(%r12), %rax
movq %rax, 0x30(%r15)
movl 0x18(%r12), %eax
movl %eax, 0x38(%r15)
movzwl 0x1c(%r12), %eax
movw %ax, 0x3c(%r15)
movb 0x1e(%r12), %al
movb %al, 0x3e(%r15)
movb 0x1f(%r12), %al
movb %al, 0x3f(%r15)
movq %r12, %rdi
movq %r15, %rsi
callq 0x91a1
movaps (%r12), %xmm0
movaps 0x10(%r12), %xmm1
movaps %xmm1, 0x70(%rsp)
movaps %xmm0, 0x60(%rsp)
xorl %eax, %eax
movb $0x0, 0x20(%rsp,%rax)
incq %rax
cmpq $0x40, %rax
jne 0x8feb
movl $0xfc, %ebp
movq %rsp, %r12
leaq 0x4e98(%rip), %r13      # 0xdea0
xorps %xmm0, %xmm0
movaps %xmm0, 0x50(%rsp)
movaps %xmm0, 0x40(%rsp)
movaps %xmm0, 0x30(%rsp)
movaps %xmm0, 0x20(%rsp)
movq %r15, %rax
xorl %ecx, %ecx
movl (%rsp,%rcx,4), %edx
xorl %edi, %edi
xorl %esi, %esi
movl (%rax,%rdi,4), %r8d
addq %rsi, %r8
movl (%rsp,%rdi,4), %esi
imulq %rdx, %rsi
addq %r8, %rsi
movl %esi, (%rax,%rdi,4)
shrq $0x20, %rsi
incq %rdi
cmpq $0x8, %rdi
jne 0x902b
movl %esi, 0x40(%rsp,%rcx,4)
incq %rcx
addq $0x4, %rax
cmpq $0x8, %rcx
jne 0x9024
movq %r12, %rdi
movq %r15, %rsi
callq 0x92d6
movl %ebp, %eax
shrl $0x3, %eax
movzbl (%rax,%r13), %eax
movl %ebp, %ecx
andl $0x7, %ecx
btl %ecx, %eax
jae 0x90dd
xorps %xmm0, %xmm0
movaps %xmm0, 0x50(%rsp)
movaps %xmm0, 0x40(%rsp)
movaps %xmm0, 0x30(%rsp)
movaps %xmm0, 0x20(%rsp)
movq %r15, %rax
xorl %ecx, %ecx
movl (%rsp,%rcx,4), %edx
xorl %edi, %edi
xorl %esi, %esi
movl (%rax,%rdi,4), %r8d
addq %rsi, %r8
movl 0x60(%rsp,%rdi,4), %esi
imulq %rdx, %rsi
addq %r8, %rsi
movl %esi, (%rax,%rdi,4)
shrq $0x20, %rsi
incq %rdi
cmpq $0x8, %rdi
jne 0x909f
movl %esi, 0x40(%rsp,%rcx,4)
incq %rcx
addq $0x4, %rax
cmpq $0x8, %rcx
jne 0x9098
movq %r12, %rdi
movq %r15, %rsi
callq 0x92d6
subl $0x1, %ebp
jae 0x9008
movq %rsp, %rdi
movaps (%rdi), %xmm0
movaps 0x10(%rdi), %xmm1
leaq 0x20(%rsp), %rsi
movaps %xmm1, 0x10(%rsi)
movaps %xmm0, (%rsi)
xorps %xmm0, %xmm0
movaps %xmm0, 0x20(%rsi)
movaps %xmm0, 0x30(%rsi)
callq 0x92d6
xorl %eax, %eax
movl (%rsp,%rax,4), %ecx
movl %ecx, 0x80(%rsp,%rax,4)
incq %rax
cmpq $0x8, %rax
jne 0x910e
leaq 0x80(%rsp), %r15
movl (%r15), %eax
leal (%rax,%rax,2), %eax
movzbl %al, %esi
movq %r15, %rdi
callq 0x7a93
movq %r14, %rdi
movq %r15, %rsi
movq %rbx, %rdx
movl $0x100, %ecx            # imm = 0x100
callq 0x5e4e
xorl %eax, %eax
movb $0x0, 0x80(%rsp,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x914f
xorl %eax, %eax
movb $0x0, 0x60(%rsp,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x9162
xorl %eax, %eax
movb $0x0, 0x20(%rsp,%rax)
incq %rax
cmpq $0x40, %rax
jne 0x9172
xorl %eax, %eax
movb $0x0, (%rsp,%rax)
incq %rax
cmpq $0x20, %rax
jne 0x9182
addq $0xa8, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq