// File: /workspace/github_c_makefile_star2_O0/oreparaz[P]dudect/examples/donna/curve25519-donna.c
// Function: fmonty
static void fmonty(limb *x2, limb *z2,  /* output 2Q */
                   limb *x3, limb *z3,  /* output Q + Q' */
                   limb *x, limb *z,    /* input Q */
                   limb *xprime, limb *zprime,  /* input Q' */
                   const limb *qmqp /* input Q - Q' */) {
  limb origx[10], origxprime[10], zzz[19], xx[19], zz[19], xxprime[19],
        zzprime[19], zzzprime[19], xxxprime[19];

  memcpy(origx, x, 10 * sizeof(limb));
  fsum(x, z);
  /* |x[i]| < 2^27 */
  fdifference(z, origx);  /* does x - z */
  /* |z[i]| < 2^27 */

  memcpy(origxprime, xprime, sizeof(limb) * 10);
  fsum(xprime, zprime);
  /* |xprime[i]| < 2^27 */
  fdifference(zprime, origxprime);
  /* |zprime[i]| < 2^27 */
  fproduct(xxprime, xprime, z);
  /* |xxprime[i]| < 14*2^54: the largest product of two limbs will be <
   * 2^(27+27) and fproduct adds together, at most, 14 of those products.
   * (Approximating that to 2^58 doesn't work out.) */
  fproduct(zzprime, x, zprime);
  /* |zzprime[i]| < 14*2^54 */
  freduce_degree(xxprime);
  freduce_coefficients(xxprime);
  /* |xxprime[i]| < 2^26 */
  freduce_degree(zzprime);
  freduce_coefficients(zzprime);
  /* |zzprime[i]| < 2^26 */
  memcpy(origxprime, xxprime, sizeof(limb) * 10);
  fsum(xxprime, zzprime);
  /* |xxprime[i]| < 2^27 */
  fdifference(zzprime, origxprime);
  /* |zzprime[i]| < 2^27 */
  fsquare(xxxprime, xxprime);
  /* |xxxprime[i]| < 2^26 */
  fsquare(zzzprime, zzprime);
  /* |zzzprime[i]| < 2^26 */
  fproduct(zzprime, zzzprime, qmqp);
  /* |zzprime[i]| < 14*2^52 */
  freduce_degree(zzprime);
  freduce_coefficients(zzprime);
  /* |zzprime[i]| < 2^26 */
  memcpy(x3, xxxprime, sizeof(limb) * 10);
  memcpy(z3, zzprime, sizeof(limb) * 10);

  fsquare(xx, x);
  /* |xx[i]| < 2^26 */
  fsquare(zz, z);
  /* |zz[i]| < 2^26 */
  fproduct(x2, xx, zz);
  /* |x2[i]| < 14*2^52 */
  freduce_degree(x2);
  freduce_coefficients(x2);
  /* |x2[i]| < 2^26 */
  fdifference(zz, xx);  // does zz = xx - zz
  /* |zz[i]| < 2^27 */
  memset(zzz + 10, 0, sizeof(limb) * 9);
  fscalar_product(zzz, zz, 121665);
  /* |zzz[i]| < 2^(27+17) */
  /* No need to call freduce_degree here:
     fscalar_product doesn't increase the degree of its input. */
  freduce_coefficients(zzz);
  /* |zzz[i]| < 2^26 */
  fsum(zzz, xx);
  /* |zzz[i]| < 2^27 */
  fproduct(z2, zz, zzz);
  /* |z2[i]| < 14*2^(26+27) */
  freduce_degree(z2);
  freduce_coefficients(z2);
  /* |z2|i| < 2^26 */
}

// Assembly:
subq $0x538, %rsp            # imm = 0x538
movq 0x550(%rsp), %rax
movq 0x548(%rsp), %rax
movq 0x540(%rsp), %rax
movq %rdi, 0x530(%rsp)
movq %rsi, 0x528(%rsp)
movq %rdx, 0x520(%rsp)
movq %rcx, 0x518(%rsp)
movq %r8, 0x510(%rsp)
movq %r9, 0x508(%rsp)
leaq 0x4b0(%rsp), %rdi
movq 0x510(%rsp), %rsi
movl $0x50, %edx
callq 0x10b0
movq 0x510(%rsp), %rdi
movq 0x508(%rsp), %rsi
callq 0x39a0
movq 0x508(%rsp), %rdi
leaq 0x4b0(%rsp), %rsi
callq 0x3a40
leaq 0x460(%rsp), %rdi
movq 0x540(%rsp), %rsi
movl $0x50, %edx
callq 0x10b0
movq 0x540(%rsp), %rdi
movq 0x548(%rsp), %rsi
callq 0x39a0
movq 0x548(%rsp), %rdi
leaq 0x460(%rsp), %rsi
callq 0x3a40
leaq 0x1e0(%rsp), %rdi
movq 0x540(%rsp), %rsi
movq 0x508(%rsp), %rdx
callq 0x3a90
leaq 0x140(%rsp), %rdi
movq 0x510(%rsp), %rsi
movq 0x548(%rsp), %rdx
callq 0x3a90
leaq 0x1e0(%rsp), %rdi
callq 0x46f0
leaq 0x1e0(%rsp), %rdi
callq 0x49a0
leaq 0x140(%rsp), %rdi
callq 0x46f0
leaq 0x140(%rsp), %rdi
callq 0x49a0
leaq 0x460(%rsp), %rdi
leaq 0x1e0(%rsp), %rsi
movl $0x50, %edx
callq 0x10b0
leaq 0x1e0(%rsp), %rdi
leaq 0x140(%rsp), %rsi
callq 0x39a0
leaq 0x140(%rsp), %rdi
leaq 0x460(%rsp), %rsi
callq 0x3a40
movq %rsp, %rdi
leaq 0x1e0(%rsp), %rsi
callq 0x4b20
leaq 0xa0(%rsp), %rdi
leaq 0x140(%rsp), %rsi
callq 0x4b20
leaq 0x140(%rsp), %rdi
leaq 0xa0(%rsp), %rsi
movq 0x550(%rsp), %rdx
callq 0x3a90
leaq 0x140(%rsp), %rdi
callq 0x46f0
leaq 0x140(%rsp), %rdi
callq 0x49a0
movq 0x520(%rsp), %rdi
movq %rsp, %rsi
movl $0x50, %edx
callq 0x10b0
movq 0x518(%rsp), %rdi
leaq 0x140(%rsp), %rsi
movl $0x50, %edx
callq 0x10b0
leaq 0x320(%rsp), %rdi
movq 0x510(%rsp), %rsi
callq 0x4b20
leaq 0x280(%rsp), %rdi
movq 0x508(%rsp), %rsi
callq 0x4b20
movq 0x530(%rsp), %rdi
leaq 0x320(%rsp), %rsi
leaq 0x280(%rsp), %rdx
callq 0x3a90
movq 0x530(%rsp), %rdi
callq 0x46f0
movq 0x530(%rsp), %rdi
callq 0x49a0
leaq 0x280(%rsp), %rdi
leaq 0x320(%rsp), %rsi
callq 0x3a40
leaq 0x3c0(%rsp), %rdi
addq $0x50, %rdi
xorl %esi, %esi
movl $0x48, %edx
callq 0x1080
leaq 0x3c0(%rsp), %rdi
leaq 0x280(%rsp), %rsi
movl $0x1db41, %edx          # imm = 0x1DB41
callq 0x4b80
leaq 0x3c0(%rsp), %rdi
callq 0x49a0
leaq 0x3c0(%rsp), %rdi
leaq 0x320(%rsp), %rsi
callq 0x39a0
movq 0x528(%rsp), %rdi
leaq 0x280(%rsp), %rsi
leaq 0x3c0(%rsp), %rdx
callq 0x3a90
movq 0x528(%rsp), %rdi
callq 0x46f0
movq 0x528(%rsp), %rdi
callq 0x49a0
addq $0x538, %rsp            # imm = 0x538
retq
nopl (%rax)