// File: /workspace/github_c_makefile_star2_O0/Tarsnap[P]spiped/liball/../libcperciva/crypto/crypto_dh.c
// Function: blinded_modexp
static int
blinded_modexp(uint8_t r[CRYPTO_DH_PUBLEN], BIGNUM * a,
    const uint8_t priv[CRYPTO_DH_PRIVLEN])
{
	BIGNUM * two_exp_256_bn;
	BIGNUM * priv_bn;
	uint8_t blinding[CRYPTO_DH_PRIVLEN];
	BIGNUM * blinding_bn;
	BIGNUM * priv_blinded;
	BIGNUM * m_bn;
	BN_CTX * ctx;
	BIGNUM * r1;
	BIGNUM * r2;
	int rlen;

	/* Construct 2^256 in BN representation. */
	if ((two_exp_256_bn = BN_bin2bn(two_exp_256, 33, NULL)) == NULL) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err0;
	}

	/* Construct 2^258 + ${priv} in BN representation. */
	if ((priv_bn = BN_bin2bn(priv, CRYPTO_DH_PRIVLEN, NULL)) == NULL) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err1;
	}
	if ((!BN_add(priv_bn, priv_bn, two_exp_256_bn)) ||
	    (!BN_add(priv_bn, priv_bn, two_exp_256_bn)) ||
	    (!BN_add(priv_bn, priv_bn, two_exp_256_bn)) ||
	    (!BN_add(priv_bn, priv_bn, two_exp_256_bn))) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err2;
	}

	/* Generate blinding exponent. */
	if (crypto_entropy_read(blinding, CRYPTO_DH_PRIVLEN))
		goto err2;
	if ((blinding_bn = BN_bin2bn(blinding,
	    CRYPTO_DH_PRIVLEN, NULL)) == NULL) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err2;
	}
	if (!BN_add(blinding_bn, blinding_bn, two_exp_256_bn)) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err3;
	}

	/* Generate blinded exponent. */
	if ((priv_blinded = BN_new()) == NULL) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err3;
	}
	if (!BN_sub(priv_blinded, priv_bn, blinding_bn)) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err4;
	}

	/* Construct group #14 modulus in BN representation. */
	if ((m_bn = BN_bin2bn(crypto_dh_group14, 256, NULL)) == NULL) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err4;
	}

	/* Allocate BN context. */
	if ((ctx = BN_CTX_new()) == NULL) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err5;
	}

	/* Allocate space for storing results of exponentiations. */
	if ((r1 = BN_new()) == NULL) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err6;
	}
	if ((r2 = BN_new()) == NULL) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err7;
	}

	/* Perform modular exponentiations. */
	if (!BN_mod_exp(r1, a, blinding_bn, m_bn, ctx)) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err8;
	}
	if (!BN_mod_exp(r2, a, priv_blinded, m_bn, ctx)) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err8;
	}

	/* Compute final result and export to big-endian integer format. */
	if (!BN_mod_mul(r1, r1, r2, m_bn, ctx)) {
		warn0("%s", ERR_error_string(ERR_get_error(), NULL));
		goto err8;
	}
	rlen = BN_num_bytes(r1);
	if (rlen < 0) {
		warn0("Unexpected error in OpenSSL");
		goto err8;
	}
	if (rlen > CRYPTO_DH_PUBLEN) {
		warn0("Exponent result too large!");
		goto err8;
	}
	memset(r, 0, CRYPTO_DH_PUBLEN - (size_t)rlen);
	BN_bn2bin(r1, &r[CRYPTO_DH_PUBLEN - (size_t)rlen]);

	/* Free space allocated by BN_new. */
	BN_clear_free(r2);
	BN_clear_free(r1);

	/* Free context allocated by BN_CTX_new. */
	BN_CTX_free(ctx);

	/* Free space allocated by BN_bin2bn. */
	BN_free(m_bn);

	/* Free space allocated by BN_new. */
	BN_clear_free(priv_blinded);

	/* Free space allocated by BN_bin2bn. */
	BN_clear_free(blinding_bn);
	BN_clear_free(priv_bn);
	BN_free(two_exp_256_bn);

	/* Success! */
	return (0);

err8:
	BN_clear_free(r2);
err7:
	BN_clear_free(r1);
err6:
	BN_CTX_free(ctx);
err5:
	BN_free(m_bn);
err4:
	BN_clear_free(priv_blinded);
err3:
	BN_clear_free(blinding_bn);
err2:
	BN_clear_free(priv_bn);
err1:
	BN_free(two_exp_256_bn);
err0:
	/* Failure! */
	return (-1);
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x90, %rsp
movq %rdi, -0x10(%rbp)
movq %rsi, -0x18(%rbp)
movq %rdx, -0x20(%rbp)
leaq 0x85f2(%rip), %rdi      # 0x18c80
movl $0x21, %esi
xorl %eax, %eax
movl %eax, %edx
callq 0x2100
movq %rax, -0x28(%rbp)
cmpq $0x0, %rax
jne 0x106da
jmp 0x106a8
callq 0x2490
movq %rax, %rdi
xorl %eax, %eax
movl %eax, %esi
callq 0x22b0
movq %rax, %rsi
leaq 0x7da7(%rip), %rdi      # 0x1846a
movb $0x0, %al
callq 0x145e0
callq 0x2340
movl $0x0, (%rax)
jmp 0x10c48
movq -0x20(%rbp), %rdi
movl $0x20, %esi
xorl %eax, %eax
movl %eax, %edx
callq 0x2100
movq %rax, -0x30(%rbp)
cmpq $0x0, %rax
jne 0x1072a
jmp 0x106f8
callq 0x2490
movq %rax, %rdi
xorl %eax, %eax
movl %eax, %esi
callq 0x22b0
movq %rax, %rsi
leaq 0x7d57(%rip), %rdi      # 0x1846a
movb $0x0, %al
callq 0x145e0
callq 0x2340
movl $0x0, (%rax)
jmp 0x10c3f
movq -0x30(%rbp), %rdi
movq -0x30(%rbp), %rsi
movq -0x28(%rbp), %rdx
callq 0x2210
cmpl $0x0, %eax
je 0x10782
movq -0x30(%rbp), %rdi
movq -0x30(%rbp), %rsi
movq -0x28(%rbp), %rdx
callq 0x2210
cmpl $0x0, %eax
je 0x10782
movq -0x30(%rbp), %rdi
movq -0x30(%rbp), %rsi
movq -0x28(%rbp), %rdx
callq 0x2210
cmpl $0x0, %eax
je 0x10782
movq -0x30(%rbp), %rdi
movq -0x30(%rbp), %rsi
movq -0x28(%rbp), %rdx
callq 0x2210
cmpl $0x0, %eax
jne 0x107b6
jmp 0x10784
callq 0x2490
movq %rax, %rdi
xorl %eax, %eax
movl %eax, %esi
callq 0x22b0
movq %rax, %rsi
leaq 0x7ccb(%rip), %rdi      # 0x1846a
movb $0x0, %al
callq 0x145e0
callq 0x2340
movl $0x0, (%rax)
jmp 0x10c36
leaq -0x50(%rbp), %rdi
movl $0x20, %esi
callq 0x10df0
cmpl $0x0, %eax
je 0x107ce
jmp 0x10c36
leaq -0x50(%rbp), %rdi
movl $0x20, %esi
xorl %eax, %eax
movl %eax, %edx
callq 0x2100
movq %rax, -0x58(%rbp)
cmpq $0x0, %rax
jne 0x1081e
jmp 0x107ec
callq 0x2490
movq %rax, %rdi
xorl %eax, %eax
movl %eax, %esi
callq 0x22b0
movq %rax, %rsi
leaq 0x7c63(%rip), %rdi      # 0x1846a
movb $0x0, %al
callq 0x145e0
callq 0x2340
movl $0x0, (%rax)
jmp 0x10c36
movq -0x58(%rbp), %rdi
movq -0x58(%rbp), %rsi
movq -0x28(%rbp), %rdx
callq 0x2210
cmpl $0x0, %eax
jne 0x10868
jmp 0x10836
callq 0x2490
movq %rax, %rdi
xorl %eax, %eax
movl %eax, %esi
callq 0x22b0
movq %rax, %rsi
leaq 0x7c19(%rip), %rdi      # 0x1846a
movb $0x0, %al
callq 0x145e0
callq 0x2340
movl $0x0, (%rax)
jmp 0x10c2d
callq 0x21a0
movq %rax, -0x60(%rbp)
cmpq $0x0, %rax
jne 0x108ab
jmp 0x10879
callq 0x2490
movq %rax, %rdi
xorl %eax, %eax
movl %eax, %esi
callq 0x22b0
movq %rax, %rsi
leaq 0x7bd6(%rip), %rdi      # 0x1846a
movb $0x0, %al
callq 0x145e0
callq 0x2340
movl $0x0, (%rax)
jmp 0x10c2d
movq -0x60(%rbp), %rdi
movq -0x30(%rbp), %rsi
movq -0x58(%rbp), %rdx
callq 0x22c0
cmpl $0x0, %eax
jne 0x108f5
jmp 0x108c3
callq 0x2490
movq %rax, %rdi
xorl %eax, %eax
movl %eax, %esi
callq 0x22b0
movq %rax, %rsi
leaq 0x7b8c(%rip), %rdi      # 0x1846a
movb $0x0, %al
callq 0x145e0
callq 0x2340
movl $0x0, (%rax)
jmp 0x10c24
leaq 0x83b4(%rip), %rdi      # 0x18cb0
movl $0x100, %esi            # imm = 0x100
xorl %eax, %eax
movl %eax, %edx
callq 0x2100
movq %rax, -0x68(%rbp)
cmpq $0x0, %rax
jne 0x10948
jmp 0x10916
callq 0x2490
movq %rax, %rdi
xorl %eax, %eax
movl %eax, %esi
callq 0x22b0
movq %rax, %rsi
leaq 0x7b39(%rip), %rdi      # 0x1846a
movb $0x0, %al
callq 0x145e0
callq 0x2340
movl $0x0, (%rax)
jmp 0x10c24
callq 0x21d0
movq %rax, -0x70(%rbp)
cmpq $0x0, %rax
jne 0x1098b
jmp 0x10959
callq 0x2490
movq %rax, %rdi
xorl %eax, %eax
movl %eax, %esi
callq 0x22b0
movq %rax, %rsi
leaq 0x7af6(%rip), %rdi      # 0x1846a
movb $0x0, %al
callq 0x145e0
callq 0x2340
movl $0x0, (%rax)
jmp 0x10c1b
callq 0x21a0
movq %rax, -0x78(%rbp)
cmpq $0x0, %rax
jne 0x109ce
jmp 0x1099c
callq 0x2490
movq %rax, %rdi
xorl %eax, %eax
movl %eax, %esi
callq 0x22b0
movq %rax, %rsi
leaq 0x7ab3(%rip), %rdi      # 0x1846a
movb $0x0, %al
callq 0x145e0
callq 0x2340
movl $0x0, (%rax)
jmp 0x10c12
callq 0x21a0
movq %rax, -0x80(%rbp)
cmpq $0x0, %rax
jne 0x10a11
jmp 0x109df
callq 0x2490
movq %rax, %rdi
xorl %eax, %eax
movl %eax, %esi
callq 0x22b0
movq %rax, %rsi
leaq 0x7a70(%rip), %rdi      # 0x1846a
movb $0x0, %al
callq 0x145e0
callq 0x2340
movl $0x0, (%rax)
jmp 0x10c09
movq -0x78(%rbp), %rdi
movq -0x18(%rbp), %rsi
movq -0x58(%rbp), %rdx
movq -0x68(%rbp), %rcx
movq -0x70(%rbp), %r8
callq 0x22e0
cmpl $0x0, %eax
jne 0x10a63
jmp 0x10a31
callq 0x2490
movq %rax, %rdi
xorl %eax, %eax
movl %eax, %esi
callq 0x22b0
movq %rax, %rsi
leaq 0x7a1e(%rip), %rdi      # 0x1846a
movb $0x0, %al
callq 0x145e0
callq 0x2340
movl $0x0, (%rax)
jmp 0x10c00
movq -0x80(%rbp), %rdi
movq -0x18(%rbp), %rsi
movq -0x60(%rbp), %rdx
movq -0x68(%rbp), %rcx
movq -0x70(%rbp), %r8
callq 0x22e0
cmpl $0x0, %eax
jne 0x10ab5
jmp 0x10a83
callq 0x2490
movq %rax, %rdi
xorl %eax, %eax
movl %eax, %esi
callq 0x22b0
movq %rax, %rsi
leaq 0x79cc(%rip), %rdi      # 0x1846a
movb $0x0, %al
callq 0x145e0
callq 0x2340
movl $0x0, (%rax)
jmp 0x10c00
movq -0x78(%rbp), %rdi
movq -0x78(%rbp), %rsi
movq -0x80(%rbp), %rdx
movq -0x68(%rbp), %rcx
movq -0x70(%rbp), %r8
callq 0x2070
cmpl $0x0, %eax
jne 0x10b07
jmp 0x10ad5
callq 0x2490
movq %rax, %rdi
xorl %eax, %eax
movl %eax, %esi
callq 0x22b0
movq %rax, %rsi
leaq 0x797a(%rip), %rdi      # 0x1846a
movb $0x0, %al
callq 0x145e0
callq 0x2340
movl $0x0, (%rax)
jmp 0x10c00
movq -0x78(%rbp), %rdi
callq 0x2250
addl $0x7, %eax
movl $0x8, %ecx
cltd
idivl %ecx
movl %eax, -0x84(%rbp)
cmpl $0x0, -0x84(%rbp)
jge 0x10b4a
jmp 0x10b2c
leaq 0x8116(%rip), %rdi      # 0x18c49
movb $0x0, %al
callq 0x145e0
callq 0x2340
movl $0x0, (%rax)
jmp 0x10c00
cmpl $0x100, -0x84(%rbp)     # imm = 0x100
jle 0x10b76
jmp 0x10b58
leaq 0x8106(%rip), %rdi      # 0x18c65
movb $0x0, %al
callq 0x145e0
callq 0x2340
movl $0x0, (%rax)
jmp 0x10c00
movq -0x10(%rbp), %rdi
movslq -0x84(%rbp), %rax
movl $0x100, %edx            # imm = 0x100
subq %rax, %rdx
xorl %esi, %esi
callq 0x2080
movq -0x78(%rbp), %rdi
movq -0x10(%rbp), %rsi
movslq -0x84(%rbp), %rcx
movl $0x100, %eax            # imm = 0x100
subq %rcx, %rax
addq %rax, %rsi
callq 0x2130
movq -0x80(%rbp), %rdi
callq 0x2270
movq -0x78(%rbp), %rdi
callq 0x2270
movq -0x70(%rbp), %rdi
callq 0x2360
movq -0x68(%rbp), %rdi
callq 0x20b0
movq -0x60(%rbp), %rdi
callq 0x2270
movq -0x58(%rbp), %rdi
callq 0x2270
movq -0x30(%rbp), %rdi
callq 0x2270
movq -0x28(%rbp), %rdi
callq 0x20b0
movl $0x0, -0x4(%rbp)
jmp 0x10c4f
movq -0x80(%rbp), %rdi
callq 0x2270
movq -0x78(%rbp), %rdi
callq 0x2270
movq -0x70(%rbp), %rdi
callq 0x2360
movq -0x68(%rbp), %rdi
callq 0x20b0
movq -0x60(%rbp), %rdi
callq 0x2270
movq -0x58(%rbp), %rdi
callq 0x2270
movq -0x30(%rbp), %rdi
callq 0x2270
movq -0x28(%rbp), %rdi
callq 0x20b0
movl $0xffffffff, -0x4(%rbp) # imm = 0xFFFFFFFF
movl -0x4(%rbp), %eax
addq $0x90, %rsp
popq %rbp
retq
nopl (%rax,%rax)