; LLVM IR from cryspen/libcrux :: sys/hacl/c/src (Hacl_HPKE_Curve51_CP128_SHA256)

; Unoptimized IR (clang -disable-llvm-passes):
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

%struct.Hacl_Impl_HPKE_context_s_s = type { ptr, ptr, ptr, ptr }

@.str = external hidden unnamed_addr constant [70 x i8], align 1
@.str.1 = external hidden unnamed_addr constant [97 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_eae_prk = external hidden unnamed_addr constant [7 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_shared_secret = external hidden unnamed_addr constant [13 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_psk_id_hash = external hidden unnamed_addr constant [11 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_info_hash = external hidden unnamed_addr constant [9 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_secret = external hidden unnamed_addr constant [6 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_exp = external hidden unnamed_addr constant [3 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_key = external hidden unnamed_addr constant [3 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_base_nonce = external hidden unnamed_addr constant [10 x i8], align 1

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.start.p0(i64 immarg, ptr nocapture) #0

; Function Attrs: nocallback nofree nounwind willreturn memory(argmem: write)
declare void @llvm.memset.p0.i64(ptr nocapture writeonly, i8, i64, i1 immarg) #1

declare void @Hacl_Curve25519_51_secret_to_public(ptr noundef, ptr noundef) #2

declare void @Hacl_Curve25519_51_scalarmult(ptr noundef, ptr noundef, ptr noundef) #2

; Function Attrs: noinline nounwind uwtable
declare hidden zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext, i8 noundef zeroext) #3

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.end.p0(i64 immarg, ptr nocapture) #0

; Function Attrs: nocallback nofree nounwind willreturn memory(argmem: readwrite)
declare void @llvm.memcpy.p0.p0.i64(ptr noalias nocapture writeonly, ptr noalias nocapture readonly, i64, i1 immarg) #4

declare i32 @printf(ptr noundef, ...) #2

; Function Attrs: noreturn nounwind
declare void @exit(i32 noundef) #5

; Function Attrs: nocallback nofree nosync nounwind willreturn
declare ptr @llvm.stacksave.p0() #6

declare void @Hacl_HKDF_extract_sha2_256(ptr noundef, ptr noundef, i32 noundef, ptr noundef, i32 noundef) #2

; Function Attrs: inlinehint nounwind uwtable
declare hidden void @store16(ptr noundef, i16 noundef zeroext) #7

; Function Attrs: inlinehint nounwind uwtable
declare hidden zeroext i16 @__bswap_16(i16 noundef zeroext) #7

declare void @Hacl_HKDF_expand_sha2_256(ptr noundef, ptr noundef, i32 noundef, ptr noundef, i32 noundef, i32 noundef) #2

; Function Attrs: nocallback nofree nosync nounwind willreturn
declare void @llvm.stackrestore.p0(ptr) #6

; Function Attrs: nounwind uwtable
define dso_local i32 @Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR(ptr noundef byval(%struct.Hacl_Impl_HPKE_context_s_s) align 8 %0, ptr noundef %1, ptr noundef %2, i32 noundef %3, ptr noundef %4) #8 {
  %6 = alloca i32, align 4
  %7 = alloca ptr, align 8
  %8 = alloca ptr, align 8
  %9 = alloca i32, align 4
  %10 = alloca ptr, align 8
  %11 = alloca [32 x i8], align 16
  %12 = alloca i32, align 4
  %13 = alloca [32 x i8], align 16
  %14 = alloca ptr, align 8
  %15 = alloca [32 x i8], align 16
  %16 = alloca [32 x i8], align 16
  %17 = alloca i8, align 1
  %18 = alloca i32, align 4
  %19 = alloca i8, align 1
  %20 = alloca i8, align 1
  %21 = alloca i32, align 4
  %22 = alloca i32, align 4
  %23 = alloca i32, align 4
  %24 = alloca [64 x i8], align 16
  %25 = alloca ptr, align 8
  %26 = alloca ptr, align 8
  %27 = alloca i32, align 4
  %28 = alloca ptr, align 8
  %29 = alloca [32 x i8], align 16
  %30 = alloca [5 x i8], align 1
  %31 = alloca ptr, align 8
  %32 = alloca ptr, align 8
  %33 = alloca ptr, align 8
  %34 = alloca [7 x i8], align 1
  %35 = alloca i32, align 4
  %36 = alloca ptr, align 8
  %37 = alloca i64, align 8
  %38 = alloca ptr, align 8
  %39 = alloca [13 x i8], align 1
  %40 = alloca i32, align 4
  %41 = alloca i64, align 8
  %42 = alloca ptr, align 8
  %43 = alloca [65 x i8], align 16
  %44 = alloca [32 x i8], align 16
  %45 = alloca [10 x i8], align 1
  %46 = alloca ptr, align 8
  %47 = alloca ptr, align 8
  %48 = alloca ptr, align 8
  %49 = alloca ptr, align 8
  %50 = alloca [11 x i8], align 1
  %51 = alloca [32 x i8], align 16
  %52 = alloca ptr, align 8
  %53 = alloca i32, align 4
  %54 = alloca ptr, align 8
  %55 = alloca i64, align 8
  %56 = alloca ptr, align 8
  %57 = alloca [9 x i8], align 1
  %58 = alloca [32 x i8], align 16
  %59 = alloca i32, align 4
  %60 = alloca i64, align 8
  %61 = alloca ptr, align 8
  %62 = alloca [6 x i8], align 1
  %63 = alloca i32, align 4
  %64 = alloca i64, align 8
  %65 = alloca ptr, align 8
  %66 = alloca [3 x i8], align 1
  %67 = alloca i32, align 4
  %68 = alloca i64, align 8
  %69 = alloca ptr, align 8
  %70 = alloca [3 x i8], align 1
  %71 = alloca i32, align 4
  %72 = alloca i64, align 8
  %73 = alloca ptr, align 8
  %74 = alloca [10 x i8], align 1
  %75 = alloca i32, align 4
  %76 = alloca i64, align 8
  %77 = alloca ptr, align 8
  %78 = alloca i32, align 4
  store ptr %1, ptr %7, align 8, !tbaa !5
  store ptr %2, ptr %8, align 8, !tbaa !5
  store i32 %3, ptr %9, align 4, !tbaa !9
  store ptr %4, ptr %10, align 8, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 32, ptr %11) #9
  call void @llvm.memset.p0.i64(ptr align 16 %11, i8 0, i64 32, i1 false)
  %79 = getelementptr inbounds [32 x i8], ptr %11, i64 0, i64 0
  %80 = load ptr, ptr %8, align 8, !tbaa !5
  call void @Hacl_Curve25519_51_secret_to_public(ptr noundef %79, ptr noundef %80)
  call void @llvm.lifetime.start.p0(i64 4, ptr %12) #9
  store i32 0, ptr %12, align 4, !tbaa !9
  call void @llvm.lifetime.start.p0(i64 32, ptr %13) #9
  call void @llvm.memset.p0.i64(ptr align 16 %13, i8 0, i64 32, i1 false)
  %81 = load i32, ptr %12, align 4, !tbaa !9
  %82 = icmp eq i32 %81, 0
  br i1 %82, label %83, label %519

83:                                               ; preds = %5
  call void @llvm.lifetime.start.p0(i64 8, ptr %14) #9
  %84 = load ptr, ptr %7, align 8, !tbaa !5
  store ptr %84, ptr %14, align 8, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 32, ptr %15) #9
  call void @llvm.memset.p0.i64(ptr align 16 %15, i8 0, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 32, ptr %16) #9
  call void @llvm.memset.p0.i64(ptr align 16 %16, i8 0, i64 32, i1 false)
  %85 = getelementptr inbounds [32 x i8], ptr %15, i64 0, i64 0
  %86 = load ptr, ptr %8, align 8, !tbaa !5
  %87 = load ptr, ptr %14, align 8, !tbaa !5
  call void @Hacl_Curve25519_51_scalarmult(ptr noundef %85, ptr noundef %86, ptr noundef %87)
  call void @llvm.lifetime.start.p0(i64 1, ptr %17) #9
  store i8 -1, ptr %17, align 1, !tbaa !11
  call void @llvm.lifetime.start.p0(i64 4, ptr %18) #9
  store i32 0, ptr %18, align 4, !tbaa !9
  br label %88

88:                                               ; preds = %108, %83
  %89 = load i32, ptr %18, align 4, !tbaa !9
  %90 = icmp ult i32 %89, 32
  br i1 %90, label %92, label %91

91:                                               ; preds = %88
  call void @llvm.lifetime.end.p0(i64 4, ptr %18) #9
  br label %111

92:                                               ; preds = %88
  call void @llvm.lifetime.start.p0(i64 1, ptr %19) #9
  %93 = load i32, ptr %18, align 4, !tbaa !9
  %94 = zext i32 %93 to i64
  %95 = getelementptr inbounds [32 x i8], ptr %15, i64 0, i64 %94
  %96 = load i8, ptr %95, align 1, !tbaa !11
  %97 = load i32, ptr %18, align 4, !tbaa !9
  %98 = zext i32 %97 to i64
  %99 = getelementptr inbounds [32 x i8], ptr %16, i64 0, i64 %98
  %100 = load i8, ptr %99, align 1, !tbaa !11
  %101 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %96, i8 noundef zeroext %100)
  store i8 %101, ptr %19, align 1, !tbaa !11
  %102 = load i8, ptr %19, align 1, !tbaa !11
  %103 = zext i8 %102 to i32
  %104 = load i8, ptr %17, align 1, !tbaa !11
  %105 = zext i8 %104 to i32
  %106 = and i32 %103, %105
  %107 = trunc i32 %106 to i8
  store i8 %107, ptr %17, align 1, !tbaa !11
  call void @llvm.lifetime.end.p0(i64 1, ptr %19) #9
  br label %108

108:                                              ; preds = %92
  %109 = load i32, ptr %18, align 4, !tbaa !9
  %110 = add i32 %109, 1
  store i32 %110, ptr %18, align 4, !tbaa !9
  br label %88, !llvm.loop !12

111:                                              ; preds = %91
  call void @llvm.lifetime.start.p0(i64 1, ptr %20) #9
  %112 = load i8, ptr %17, align 1, !tbaa !11
  store i8 %112, ptr %20, align 1, !tbaa !11
  call void @llvm.lifetime.start.p0(i64 4, ptr %21) #9
  %113 = load i8, ptr %20, align 1, !tbaa !11
  %114 = zext i8 %113 to i32
  %115 = icmp eq i32 %114, 255
  br i1 %115, label %116, label %117

116:                                              ; preds = %111
  store i32 1, ptr %21, align 4, !tbaa !9
  br label %118

117:                                              ; preds = %111
  store i32 0, ptr %21, align 4, !tbaa !9
  br label %118

118:                                              ; preds = %117, %116
  call void @llvm.lifetime.start.p0(i64 4, ptr %22) #9
  %119 = load i32, ptr %21, align 4, !tbaa !9
  store i32 %119, ptr %22, align 4, !tbaa !9
  call void @llvm.lifetime.start.p0(i64 4, ptr %23) #9
  call void @llvm.lifetime.start.p0(i64 64, ptr %24) #9
  call void @llvm.memset.p0.i64(ptr align 16 %24, i8 0, i64 64, i1 false)
  %120 = load i32, ptr %22, align 4, !tbaa !9
  %121 = icmp eq i32 %120, 0
  br i1 %121, label %122, label %230

122:                                              ; preds = %118
  call void @llvm.lifetime.start.p0(i64 8, ptr %25) #9
  %123 = getelementptr inbounds [64 x i8], ptr %24, i64 0, i64 0
  %124 = getelementptr inbounds i8, ptr %123, i64 32
  store ptr %124, ptr %25, align 8, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 8, ptr %26) #9
  %125 = load ptr, ptr %25, align 8, !tbaa !5
  store ptr %125, ptr %26, align 8, !tbaa !5
  %126 = load ptr, ptr %26, align 8, !tbaa !5
  %127 = load ptr, ptr %8, align 8, !tbaa !5
  call void @Hacl_Curve25519_51_secret_to_public(ptr noundef %126, ptr noundef %127)
  call void @llvm.lifetime.start.p0(i64 4, ptr %27) #9
  store i32 0, ptr %27, align 4, !tbaa !9
  %128 = load i32, ptr %27, align 4, !tbaa !9
  %129 = icmp eq i32 %128, 0
  br i1 %129, label %130, label %228

130:                                              ; preds = %122
  %131 = getelementptr inbounds [64 x i8], ptr %24, i64 0, i64 0
  %132 = load ptr, ptr %7, align 8, !tbaa !5
  call void @llvm.memcpy.p0.p0.i64(ptr align 16 %131, ptr align 1 %132, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 8, ptr %28) #9
  %133 = getelementptr inbounds [32 x i8], ptr %15, i64 0, i64 0
  store ptr %133, ptr %28, align 8, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 32, ptr %29) #9
  call void @llvm.memset.p0.i64(ptr align 16 %29, i8 0, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 5, ptr %30) #9
  call void @llvm.memset.p0.i64(ptr align 1 %30, i8 0, i64 5, i1 false)
  call void @llvm.lifetime.start.p0(i64 8, ptr %31) #9
  %134 = getelementptr inbounds [5 x i8], ptr %30, i64 0, i64 0
  store ptr %134, ptr %31, align 8, !tbaa !5
  %135 = load ptr, ptr %31, align 8, !tbaa !5
  %136 = getelementptr inbounds i8, ptr %135, i64 0
  store i8 75, ptr %136, align 1, !tbaa !11
  %137 = load ptr, ptr %31, align 8, !tbaa !5
  %138 = getelementptr inbounds i8, ptr %137, i64 1
  store i8 69, ptr %138, align 1, !tbaa !11
  %139 = load ptr, ptr %31, align 8, !tbaa !5
  %140 = getelementptr inbounds i8, ptr %139, i64 2
  store i8 77, ptr %140, align 1, !tbaa !11
  call void @llvm.lifetime.start.p0(i64 8, ptr %32) #9
  %141 = getelementptr inbounds [5 x i8], ptr %30, i64 0, i64 0
  %142 = getelementptr inbounds i8, ptr %141, i64 3
  store ptr %142, ptr %32, align 8, !tbaa !5
  %143 = load ptr, ptr %32, align 8, !tbaa !5
  %144 = getelementptr inbounds i8, ptr %143, i64 0
  store i8 0, ptr %144, align 1, !tbaa !11
  %145 = load ptr, ptr %32, align 8, !tbaa !5
  %146 = getelementptr inbounds i8, ptr %145, i64 1
  store i8 32, ptr %146, align 1, !tbaa !11
  call void @llvm.lifetime.start.p0(i64 8, ptr %33) #9
  %147 = getelementptr inbounds [5 x i8], ptr %30, i64 0, i64 0
  store ptr %147, ptr %33, align 8, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 7, ptr %34) #9
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %34, ptr align 1 @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_eae_prk, i64 7, i1 false)
  call void @llvm.lifetime.start.p0(i64 4, ptr %35) #9
  store i32 51, ptr %35, align 4, !tbaa !9
  br label %148

148:                                              ; preds = %130
  %149 = load i32, ptr %35, align 4, !tbaa !9
  %150 = zext i32 %149 to i64
  %151 = icmp ugt i64 %150, -1
  br i1 %151, label %152, label %154

152:                                              ; preds = %148
  %153 = call i32 (ptr, ...) @printf(ptr noundef @.str, ptr noundef @.str.1, i32 noundef 336)
  call void @exit(i32 noundef 253) #10
  unreachable

154:                                              ; preds = %148
  br label %155

155:                                              ; preds = %154
  br label %156

156:                                              ; preds = %155
  %157 = load i32, ptr %35, align 4, !tbaa !9
  %158 = zext i32 %157 to i64
  %159 = call ptr @llvm.stacksave.p0()
  store ptr %159, ptr %36, align 8
  %160 = alloca i8, i64 %158, align 16
  store i64 %158, ptr %37, align 8
  %161 = load i32, ptr %35, align 4, !tbaa !9
  %162 = zext i32 %161 to i64
  %163 = mul i64 %162, 1
  call void @llvm.memset.p0.i64(ptr align 16 %160, i8 0, i64 %163, i1 false)
  call void @llvm.lifetime.start.p0(i64 8, ptr %38) #9
  store ptr %160, ptr %38, align 8, !tbaa !5
  %164 = load ptr, ptr %38, align 8, !tbaa !5
  %165 = getelementptr inbounds i8, ptr %164, i64 0
  store i8 72, ptr %165, align 1, !tbaa !11
  %166 = load ptr, ptr %38, align 8, !tbaa !5
  %167 = getelementptr inbounds i8, ptr %166, i64 1
  store i8 80, ptr %167, align 1, !tbaa !11
  %168 = load ptr, ptr %38, align 8, !tbaa !5
  %169 = getelementptr inbounds i8, ptr %168, i64 2
  store i8 75, ptr %169, align 1, !tbaa !11
  %170 = load ptr, ptr %38, align 8, !tbaa !5
  %171 = getelementptr inbounds i8, ptr %170, i64 3
  store i8 69, ptr %171, align 1, !tbaa !11
  %172 = load ptr, ptr %38, align 8, !tbaa !5
  %173 = getelementptr inbounds i8, ptr %172, i64 4
  store i8 45, ptr %173, align 1, !tbaa !11
  %174 = load ptr, ptr %38, align 8, !tbaa !5
  %175 = getelementptr inbounds i8, ptr %174, i64 5
  store i8 118, ptr %175, align 1, !tbaa !11
  %176 = load ptr, ptr %38, align 8, !tbaa !5
  %177 = getelementptr inbounds i8, ptr %176, i64 6
  store i8 49, ptr %177, align 1, !tbaa !11
  %178 = getelementptr inbounds i8, ptr %160, i64 7
  %179 = getelementptr inbounds [5 x i8], ptr %30, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %178, ptr align 1 %179, i64 5, i1 false)
  %180 = getelementptr inbounds i8, ptr %160, i64 12
  %181 = getelementptr inbounds [7 x i8], ptr %34, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %180, ptr align 1 %181, i64 7, i1 false)
  %182 = getelementptr inbounds i8, ptr %160, i64 19
  %183 = load ptr, ptr %28, align 8, !tbaa !5
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %182, ptr align 1 %183, i64 32, i1 false)
  %184 = getelementptr inbounds [32 x i8], ptr %29, i64 0, i64 0
  %185 = load ptr, ptr %33, align 8, !tbaa !5
  %186 = load i32, ptr %35, align 4, !tbaa !9
  call void @Hacl_HKDF_extract_sha2_256(ptr noundef %184, ptr noundef %185, i32 noundef 0, ptr noundef %160, i32 noundef %186)
  call void @llvm.lifetime.start.p0(i64 13, ptr %39) #9
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %39, ptr align 1 @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_shared_secret, i64 13, i1 false)
  call void @llvm.lifetime.start.p0(i64 4, ptr %40) #9
  store i32 91, ptr %40, align 4, !tbaa !9
  br label %187

187:                                              ; preds = %156
  %188 = load i32, ptr %40, align 4, !tbaa !9
  %189 = zext i32 %188 to i64
  %190 = icmp ugt i64 %189, -1
  br i1 %190, label %191, label %193

191:                                              ; preds = %187
  %192 = call i32 (ptr, ...) @printf(ptr noundef @.str, ptr noundef @.str.1, i32 noundef 358)
  call void @exit(i32 noundef 253) #10
  unreachable

193:                                              ; preds = %187
  br label %194

194:                                              ; preds = %193
  br label %195

195:                                              ; preds = %194
  %196 = load i32, ptr %40, align 4, !tbaa !9
  %197 = zext i32 %196 to i64
  %198 = alloca i8, i64 %197, align 16
  store i64 %197, ptr %41, align 8
  %199 = load i32, ptr %40, align 4, !tbaa !9
  %200 = zext i32 %199 to i64
  %201 = mul i64 %200, 1
  call void @llvm.memset.p0.i64(ptr align 16 %198, i8 0, i64 %201, i1 false)
  %202 = call zeroext i16 @__bswap_16(i16 noundef zeroext 32)
  call void @store16(ptr noundef %198, i16 noundef zeroext %202)
  call void @llvm.lifetime.start.p0(i64 8, ptr %42) #9
  %203 = getelementptr inbounds i8, ptr %198, i64 2
  store ptr %203, ptr %42, align 8, !tbaa !5
  %204 = load ptr, ptr %42, align 8, !tbaa !5
  %205 = getelementptr inbounds i8, ptr %204, i64 0
  store i8 72, ptr %205, align 1, !tbaa !11
  %206 = load ptr, ptr %42, align 8, !tbaa !5
  %207 = getelementptr inbounds i8, ptr %206, i64 1
  store i8 80, ptr %207, align 1, !tbaa !11
  %208 = load ptr, ptr %42, align 8, !tbaa !5
  %209 = getelementptr inbounds i8, ptr %208, i64 2
  store i8 75, ptr %209, align 1, !tbaa !11
  %210 = load ptr, ptr %42, align 8, !tbaa !5
  %211 = getelementptr inbounds i8, ptr %210, i64 3
  store i8 69, ptr %211, align 1, !tbaa !11
  %212 = load ptr, ptr %42, align 8, !tbaa !5
  %213 = getelementptr inbounds i8, ptr %212, i64 4
  store i8 45, ptr %213, align 1, !tbaa !11
  %214 = load ptr, ptr %42, align 8, !tbaa !5
  %215 = getelementptr inbounds i8, ptr %214, i64 5
  store i8 118, ptr %215, align 1, !tbaa !11
  %216 = load ptr, ptr %42, align 8, !tbaa !5
  %217 = getelementptr inbounds i8, ptr %216, i64 6
  store i8 49, ptr %217, align 1, !tbaa !11
  %218 = getelementptr inbounds i8, ptr %198, i64 9
  %219 = getelementptr inbounds [5 x i8], ptr %30, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %218, ptr align 1 %219, i64 5, i1 false)
  %220 = getelementptr inbounds i8, ptr %198, i64 14
  %221 = getelementptr inbounds [13 x i8], ptr %39, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %220, ptr align 1 %221, i64 13, i1 false)
  %222 = getelementptr inbounds i8, ptr %198, i64 27
  %223 = getelementptr inbounds [64 x i8], ptr %24, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %222, ptr align 16 %223, i64 64, i1 false)
  %224 = getelementptr inbounds [32 x i8], ptr %13, i64 0, i64 0
  %225 = getelementptr inbounds [32 x i8], ptr %29, i64 0, i64 0
  %226 = load i32, ptr %40, align 4, !tbaa !9
  call void @Hacl_HKDF_expand_sha2_256(ptr noundef %224, ptr noundef %225, i32 noundef 32, ptr noundef %198, i32 noundef %226, i32 noundef 32)
  store i32 0, ptr %23, align 4, !tbaa !9
  call void @llvm.lifetime.end.p0(i64 8, ptr %42) #9
  call void @llvm.lifetime.end.p0(i64 4, ptr %40) #9
  call void @llvm.lifetime.end.p0(i64 13, ptr %39) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %38) #9
  %227 = load ptr, ptr %36, align 8
  call void @llvm.stackrestore.p0(ptr %227)
  call void @llvm.lifetime.end.p0(i64 4, ptr %35) #9
  call void @llvm.lifetime.end.p0(i64 7, ptr %34) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %33) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %32) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %31) #9
  call void @llvm.lifetime.end.p0(i64 5, ptr %30) #9
  call void @llvm.lifetime.end.p0(i64 32, ptr %29) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %28) #9
  br label %229

228:                                              ; preds = %122
  store i32 1, ptr %23, align 4, !tbaa !9
  br label %229

229:                                              ; preds = %228, %195
  call void @llvm.lifetime.end.p0(i64 4, ptr %27) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %26) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %25) #9
  br label %231

230:                                              ; preds = %118
  store i32 1, ptr %23, align 4, !tbaa !9
  br label %231

231:                                              ; preds = %230, %229
  %232 = load i32, ptr %23, align 4, !tbaa !9
  %233 = icmp eq i32 %232, 0
  br i1 %233, label %234, label %517

234:                                              ; preds = %231
  call void @llvm.lifetime.start.p0(i64 65, ptr %43) #9
  call void @llvm.memset.p0.i64(ptr align 16 %43, i8 0, i64 65, i1 false)
  call void @llvm.lifetime.start.p0(i64 32, ptr %44) #9
  call void @llvm.memset.p0.i64(ptr align 16 %44, i8 0, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 10, ptr %45) #9
  call void @llvm.memset.p0.i64(ptr align 1 %45, i8 0, i64 10, i1 false)
  call void @llvm.lifetime.start.p0(i64 8, ptr %46) #9
  %235 = getelementptr inbounds [10 x i8], ptr %45, i64 0, i64 0
  store ptr %235, ptr %46, align 8, !tbaa !5
  %236 = load ptr, ptr %46, align 8, !tbaa !5
  %237 = getelementptr inbounds i8, ptr %236, i64 0
  store i8 72, ptr %237, align 1, !tbaa !11
  %238 = load ptr, ptr %46, align 8, !tbaa !5
  %239 = getelementptr inbounds i8, ptr %238, i64 1
  store i8 80, ptr %239, align 1, !tbaa !11
  %240 = load ptr, ptr %46, align 8, !tbaa !5
  %241 = getelementptr inbounds i8, ptr %240, i64 2
  store i8 75, ptr %241, align 1, !tbaa !11
  %242 = load ptr, ptr %46, align 8, !tbaa !5
  %243 = getelementptr inbounds i8, ptr %242, i64 3
  store i8 69, ptr %243, align 1, !tbaa !11
  call void @llvm.lifetime.start.p0(i64 8, ptr %47) #9
  %244 = getelementptr inbounds [10 x i8], ptr %45, i64 0, i64 0
  %245 = getelementptr inbounds i8, ptr %244, i64 4
  store ptr %245, ptr %47, align 8, !tbaa !5
  %246 = load ptr, ptr %47, align 8, !tbaa !5
  %247 = getelementptr inbounds i8, ptr %246, i64 0
  store i8 0, ptr %247, align 1, !tbaa !11
  %248 = load ptr, ptr %47, align 8, !tbaa !5
  %249 = getelementptr inbounds i8, ptr %248, i64 1
  store i8 32, ptr %249, align 1, !tbaa !11
  call void @llvm.lifetime.start.p0(i64 8, ptr %48) #9
  %250 = getelementptr inbounds [10 x i8], ptr %45, i64 0, i64 0
  %251 = getelementptr inbounds i8, ptr %250, i64 6
  store ptr %251, ptr %48, align 8, !tbaa !5
  %252 = load ptr, ptr %48, align 8, !tbaa !5
  %253 = getelementptr inbounds i8, ptr %252, i64 0
  store i8 0, ptr %253, align 1, !tbaa !11
  %254 = load ptr, ptr %48, align 8, !tbaa !5
  %255 = getelementptr inbounds i8, ptr %254, i64 1
  store i8 1, ptr %255, align 1, !tbaa !11
  call void @llvm.lifetime.start.p0(i64 8, ptr %49) #9
  %256 = getelementptr inbounds [10 x i8], ptr %45, i64 0, i64 0
  %257 = getelementptr inbounds i8, ptr %256, i64 8
  store ptr %257, ptr %49, align 8, !tbaa !5
  %258 = load ptr, ptr %49, align 8, !tbaa !5
  %259 = getelementptr inbounds i8, ptr %258, i64 0
  store i8 0, ptr %259, align 1, !tbaa !11
  %260 = load ptr, ptr %49, align 8, !tbaa !5
  %261 = getelementptr inbounds i8, ptr %260, i64 1
  store i8 3, ptr %261, align 1, !tbaa !11
  call void @llvm.lifetime.start.p0(i64 11, ptr %50) #9
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %50, ptr align 1 @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_psk_id_hash, i64 11, i1 false)
  call void @llvm.lifetime.start.p0(i64 32, ptr %51) #9
  call void @llvm.memset.p0.i64(ptr align 16 %51, i8 0, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 8, ptr %52) #9
  %262 = getelementptr inbounds [10 x i8], ptr %45, i64 0, i64 0
  store ptr %262, ptr %52, align 8, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 4, ptr %53) #9
  store i32 28, ptr %53, align 4, !tbaa !9
  br label %263

263:                                              ; preds = %234
  %264 = load i32, ptr %53, align 4, !tbaa !9
  %265 = zext i32 %264 to i64
  %266 = icmp ugt i64 %265, -1
  br i1 %266, label %267, label %269

267:                                              ; preds = %263
  %268 = call i32 (ptr, ...) @printf(ptr noundef @.str, ptr noundef @.str.1, i32 noundef 410)
  call void @exit(i32 noundef 253) #10
  unreachable

269:                                              ; preds = %263
  br label %270

270:                                              ; preds = %269
  br label %271

271:                                              ; preds = %270
  %272 = load i32, ptr %53, align 4, !tbaa !9
  %273 = zext i32 %272 to i64
  %274 = call ptr @llvm.stacksave.p0()
  store ptr %274, ptr %54, align 8
  %275 = alloca i8, i64 %273, align 16
  store i64 %273, ptr %55, align 8
  %276 = load i32, ptr %53, align 4, !tbaa !9
  %277 = zext i32 %276 to i64
  %278 = mul i64 %277, 1
  call void @llvm.memset.p0.i64(ptr align 16 %275, i8 0, i64 %278, i1 false)
  call void @llvm.lifetime.start.p0(i64 8, ptr %56) #9
  store ptr %275, ptr %56, align 8, !tbaa !5
  %279 = load ptr, ptr %56, align 8, !tbaa !5
  %280 = getelementptr inbounds i8, ptr %279, i64 0
  store i8 72, ptr %280, align 1, !tbaa !11
  %281 = load ptr, ptr %56, align 8, !tbaa !5
  %282 = getelementptr inbounds i8, ptr %281, i64 1
  store i8 80, ptr %282, align 1, !tbaa !11
  %283 = load ptr, ptr %56, align 8, !tbaa !5
  %284 = getelementptr inbounds i8, ptr %283, i64 2
  store i8 75, ptr %284, align 1, !tbaa !11
  %285 = load ptr, ptr %56, align 8, !tbaa !5
  %286 = getelementptr inbounds i8, ptr %285, i64 3
  store i8 69, ptr %286, align 1, !tbaa !11
  %287 = load ptr, ptr %56, align 8, !tbaa !5
  %288 = getelementptr inbounds i8, ptr %287, i64 4
  store i8 45, ptr %288, align 1, !tbaa !11
  %289 = load ptr, ptr %56, align 8, !tbaa !5
  %290 = getelementptr inbounds i8, ptr %289, i64 5
  store i8 118, ptr %290, align 1, !tbaa !11
  %291 = load ptr, ptr %56, align 8, !tbaa !5
  %292 = getelementptr inbounds i8, ptr %291, i64 6
  store i8 49, ptr %292, align 1, !tbaa !11
  %293 = getelementptr inbounds i8, ptr %275, i64 7
  %294 = getelementptr inbounds [10 x i8], ptr %45, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %293, ptr align 1 %294, i64 10, i1 false)
  %295 = getelementptr inbounds i8, ptr %275, i64 17
  %296 = getelementptr inbounds [11 x i8], ptr %50, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %295, ptr align 1 %296, i64 11, i1 false)
  %297 = getelementptr inbounds i8, ptr %275, i64 28
  %298 = load ptr, ptr %52, align 8, !tbaa !5
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %297, ptr align 1 %298, i64 0, i1 false)
  %299 = getelementptr inbounds [32 x i8], ptr %51, i64 0, i64 0
  %300 = load ptr, ptr %52, align 8, !tbaa !5
  %301 = load i32, ptr %53, align 4, !tbaa !9
  call void @Hacl_HKDF_extract_sha2_256(ptr noundef %299, ptr noundef %300, i32 noundef 0, ptr noundef %275, i32 noundef %301)
  call void @llvm.lifetime.start.p0(i64 9, ptr %57) #9
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %57, ptr align 1 @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_info_hash, i64 9, i1 false)
  call void @llvm.lifetime.start.p0(i64 32, ptr %58) #9
  call void @llvm.memset.p0.i64(ptr align 16 %58, i8 0, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 4, ptr %59) #9
  %302 = load i32, ptr %9, align 4, !tbaa !9
  %303 = add i32 26, %302
  store i32 %303, ptr %59, align 4, !tbaa !9
  br label %304

304:                                              ; preds = %271
  %305 = load i32, ptr %59, align 4, !tbaa !9
  %306 = zext i32 %305 to i64
  %307 = icmp ugt i64 %306, -1
  br i1 %307, label %308, label %310

308:                                              ; preds = %304
  %309 = call i32 (ptr, ...) @printf(ptr noundef @.str, ptr noundef @.str.1, i32 noundef 429)
  call void @exit(i32 noundef 253) #10
  unreachable

310:                                              ; preds = %304
  br label %311

311:                                              ; preds = %310
  br label %312

312:                                              ; preds = %311
  %313 = load i32, ptr %59, align 4, !tbaa !9
  %314 = zext i32 %313 to i64
  %315 = alloca i8, i64 %314, align 16
  store i64 %314, ptr %60, align 8
  %316 = load i32, ptr %59, align 4, !tbaa !9
  %317 = zext i32 %316 to i64
  %318 = mul i64 %317, 1
  call void @llvm.memset.p0.i64(ptr align 16 %315, i8 0, i64 %318, i1 false)
  call void @llvm.lifetime.start.p0(i64 8, ptr %61) #9
  store ptr %315, ptr %61, align 8, !tbaa !5
  %319 = load ptr, ptr %61, align 8, !tbaa !5
  %320 = getelementptr inbounds i8, ptr %319, i64 0
  store i8 72, ptr %320, align 1, !tbaa !11
  %321 = load ptr, ptr %61, align 8, !tbaa !5
  %322 = getelementptr inbounds i8, ptr %321, i64 1
  store i8 80, ptr %322, align 1, !tbaa !11
  %323 = load ptr, ptr %61, align 8, !tbaa !5
  %324 = getelementptr inbounds i8, ptr %323, i64 2
  store i8 75, ptr %324, align 1, !tbaa !11
  %325 = load ptr, ptr %61, align 8, !tbaa !5
  %326 = getelementptr inbounds i8, ptr %325, i64 3
  store i8 69, ptr %326, align 1, !tbaa !11
  %327 = load ptr, ptr %61, align 8, !tbaa !5
  %328 = getelementptr inbounds i8, ptr %327, i64 4
  store i8 45, ptr %328, align 1, !tbaa !11
  %329 = load ptr, ptr %61, align 8, !tbaa !5
  %330 = getelementptr inbounds i8, ptr %329, i64 5
  store i8 118, ptr %330, align 1, !tbaa !11
  %331 = load ptr, ptr %61, align 8, !tbaa !5
  %332 = getelementptr inbounds i8, ptr %331, i64 6
  store i8 49, ptr %332, align 1, !tbaa !11
  %333 = getelementptr inbounds i8, ptr %315, i64 7
  %334 = getelementptr inbounds [10 x i8], ptr %45, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %333, ptr align 1 %334, i64 10, i1 false)
  %335 = getelementptr inbounds i8, ptr %315, i64 17
  %336 = getelementptr inbounds [9 x i8], ptr %57, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %335, ptr align 1 %336, i64 9, i1 false)
  %337 = getelementptr inbounds i8, ptr %315, i64 26
  %338 = load ptr, ptr %10, align 8, !tbaa !5
  %339 = load i32, ptr %9, align 4, !tbaa !9
  %340 = zext i32 %339 to i64
  %341 = mul i64 %340, 1
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %337, ptr align 1 %338, i64 %341, i1 false)
  %342 = getelementptr inbounds [32 x i8], ptr %58, i64 0, i64 0
  %343 = load ptr, ptr %52, align 8, !tbaa !5
  %344 = load i32, ptr %59, align 4, !tbaa !9
  call void @Hacl_HKDF_extract_sha2_256(ptr noundef %342, ptr noundef %343, i32 noundef 0, ptr noundef %315, i32 noundef %344)
  %345 = getelementptr inbounds [65 x i8], ptr %43, i64 0, i64 0
  store i8 0, ptr %345, align 16, !tbaa !11
  %346 = getelementptr inbounds [65 x i8], ptr %43, i64 0, i64 0
  %347 = getelementptr inbounds i8, ptr %346, i64 1
  %348 = getelementptr inbounds [32 x i8], ptr %51, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %347, ptr align 16 %348, i64 32, i1 false)
  %349 = getelementptr inbounds [65 x i8], ptr %43, i64 0, i64 0
  %350 = getelementptr inbounds i8, ptr %349, i64 33
  %351 = getelementptr inbounds [32 x i8], ptr %58, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %350, ptr align 16 %351, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 6, ptr %62) #9
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %62, ptr align 1 @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_secret, i64 6, i1 false)
  call void @llvm.lifetime.start.p0(i64 4, ptr %63) #9
  store i32 23, ptr %63, align 4, !tbaa !9
  br label %352

352:                                              ; preds = %312
  %353 = load i32, ptr %63, align 4, !tbaa !9
  %354 = zext i32 %353 to i64
  %355 = icmp ugt i64 %354, -1
  br i1 %355, label %356, label %358

356:                                              ; preds = %352
  %357 = call i32 (ptr, ...) @printf(ptr noundef @.str, ptr noundef @.str.1, i32 noundef 449)
  call void @exit(i32 noundef 253) #10
  unreachable

358:                                              ; preds = %352
  br label %359

359:                                              ; preds = %358
  br label %360

360:                                              ; preds = %359
  %361 = load i32, ptr %63, align 4, !tbaa !9
  %362 = zext i32 %361 to i64
  %363 = alloca i8, i64 %362, align 16
  store i64 %362, ptr %64, align 8
  %364 = load i32, ptr %63, align 4, !tbaa !9
  %365 = zext i32 %364 to i64
  %366 = mul i64 %365, 1
  call void @llvm.memset.p0.i64(ptr align 16 %363, i8 0, i64 %366, i1 false)
  call void @llvm.lifetime.start.p0(i64 8, ptr %65) #9
  store ptr %363, ptr %65, align 8, !tbaa !5
  %367 = load ptr, ptr %65, align 8, !tbaa !5
  %368 = getelementptr inbounds i8, ptr %367, i64 0
  store i8 72, ptr %368, align 1, !tbaa !11
  %369 = load ptr, ptr %65, align 8, !tbaa !5
  %370 = getelementptr inbounds i8, ptr %369, i64 1
  store i8 80, ptr %370, align 1, !tbaa !11
  %371 = load ptr, ptr %65, align 8, !tbaa !5
  %372 = getelementptr inbounds i8, ptr %371, i64 2
  store i8 75, ptr %372, align 1, !tbaa !11
  %373 = load ptr, ptr %65, align 8, !tbaa !5
  %374 = getelementptr inbounds i8, ptr %373, i64 3
  store i8 69, ptr %374, align 1, !tbaa !11
  %375 = load ptr, ptr %65, align 8, !tbaa !5
  %376 = getelementptr inbounds i8, ptr %375, i64 4
  store i8 45, ptr %376, align 1, !tbaa !11
  %377 = load ptr, ptr %65, align 8, !tbaa !5
  %378 = getelementptr inbounds i8, ptr %377, i64 5
  store i8 118, ptr %378, align 1, !tbaa !11
  %379 = load ptr, ptr %65, align 8, !tbaa !5
  %380 = getelementptr inbounds i8, ptr %379, i64 6
  store i8 49, ptr %380, align 1, !tbaa !11
  %381 = getelementptr inbounds i8, ptr %363, i64 7
  %382 = getelementptr inbounds [10 x i8], ptr %45, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %381, ptr align 1 %382, i64 10, i1 false)
  %383 = getelementptr inbounds i8, ptr %363, i64 17
  %384 = getelementptr inbounds [6 x i8], ptr %62, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %383, ptr align 1 %384, i64 6, i1 false)
  %385 = getelementptr inbounds i8, ptr %363, i64 23
  %386 = load ptr, ptr %52, align 8, !tbaa !5
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %385, ptr align 1 %386, i64 0, i1 false)
  %387 = getelementptr inbounds [32 x i8], ptr %44, i64 0, i64 0
  %388 = getelementptr inbounds [32 x i8], ptr %13, i64 0, i64 0
  %389 = load i32, ptr %63, align 4, !tbaa !9
  call void @Hacl_HKDF_extract_sha2_256(ptr noundef %387, ptr noundef %388, i32 noundef 32, ptr noundef %363, i32 noundef %389)
  call void @llvm.lifetime.start.p0(i64 3, ptr %66) #9
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %66, ptr align 1 @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_exp, i64 3, i1 false)
  call void @llvm.lifetime.start.p0(i64 4, ptr %67) #9
  store i32 87, ptr %67, align 4, !tbaa !9
  br label %390

390:                                              ; preds = %360
  %391 = load i32, ptr %67, align 4, !tbaa !9
  %392 = zext i32 %391 to i64
  %393 = icmp ugt i64 %392, -1
  br i1 %393, label %394, label %396

394:                                              ; preds = %390
  %395 = call i32 (ptr, ...) @printf(ptr noundef @.str, ptr noundef @.str.1, i32 noundef 466)
  call void @exit(i32 noundef 253) #10
  unreachable

396:                                              ; preds = %390
  br label %397

397:                                              ; preds = %396
  br label %398

398:                                              ; preds = %397
  %399 = load i32, ptr %67, align 4, !tbaa !9
  %400 = zext i32 %399 to i64
  %401 = alloca i8, i64 %400, align 16
  store i64 %400, ptr %68, align 8
  %402 = load i32, ptr %67, align 4, !tbaa !9
  %403 = zext i32 %402 to i64
  %404 = mul i64 %403, 1
  call void @llvm.memset.p0.i64(ptr align 16 %401, i8 0, i64 %404, i1 false)
  %405 = call zeroext i16 @__bswap_16(i16 noundef zeroext 32)
  call void @store16(ptr noundef %401, i16 noundef zeroext %405)
  call void @llvm.lifetime.start.p0(i64 8, ptr %69) #9
  %406 = getelementptr inbounds i8, ptr %401, i64 2
  store ptr %406, ptr %69, align 8, !tbaa !5
  %407 = load ptr, ptr %69, align 8, !tbaa !5
  %408 = getelementptr inbounds i8, ptr %407, i64 0
  store i8 72, ptr %408, align 1, !tbaa !11
  %409 = load ptr, ptr %69, align 8, !tbaa !5
  %410 = getelementptr inbounds i8, ptr %409, i64 1
  store i8 80, ptr %410, align 1, !tbaa !11
  %411 = load ptr, ptr %69, align 8, !tbaa !5
  %412 = getelementptr inbounds i8, ptr %411, i64 2
  store i8 75, ptr %412, align 1, !tbaa !11
  %413 = load ptr, ptr %69, align 8, !tbaa !5
  %414 = getelementptr inbounds i8, ptr %413, i64 3
  store i8 69, ptr %414, align 1, !tbaa !11
  %415 = load ptr, ptr %69, align 8, !tbaa !5
  %416 = getelementptr inbounds i8, ptr %415, i64 4
  store i8 45, ptr %416, align 1, !tbaa !11
  %417 = load ptr, ptr %69, align 8, !tbaa !5
  %418 = getelementptr inbounds i8, ptr %417, i64 5
  store i8 118, ptr %418, align 1, !tbaa !11
  %419 = load ptr, ptr %69, align 8, !tbaa !5
  %420 = getelementptr inbounds i8, ptr %419, i64 6
  store i8 49, ptr %420, align 1, !tbaa !11
  %421 = getelementptr inbounds i8, ptr %401, i64 9
  %422 = getelementptr inbounds [10 x i8], ptr %45, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %421, ptr align 1 %422, i64 10, i1 false)
  %423 = getelementptr inbounds i8, ptr %401, i64 19
  %424 = getelementptr inbounds [3 x i8], ptr %66, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %423, ptr align 1 %424, i64 3, i1 false)
  %425 = getelementptr inbounds i8, ptr %401, i64 22
  %426 = getelementptr inbounds [65 x i8], ptr %43, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %425, ptr align 16 %426, i64 65, i1 false)
  %427 = getelementptr inbounds %struct.Hacl_Impl_HPKE_context_s_s, ptr %0, i32 0, i32 3
  %428 = load ptr, ptr %427, align 8, !tbaa !14
  %429 = getelementptr inbounds [32 x i8], ptr %44, i64 0, i64 0
  %430 = load i32, ptr %67, align 4, !tbaa !9
  call void @Hacl_HKDF_expand_sha2_256(ptr noundef %428, ptr noundef %429, i32 noundef 32, ptr noundef %401, i32 noundef %430, i32 noundef 32)
  call void @llvm.lifetime.start.p0(i64 3, ptr %70) #9
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %70, ptr align 1 @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_key, i64 3, i1 false)
  call void @llvm.lifetime.start.p0(i64 4, ptr %71) #9
  store i32 87, ptr %71, align 4, !tbaa !9
  br label %431

431:                                              ; preds = %398
  %432 = load i32, ptr %71, align 4, !tbaa !9
  %433 = zext i32 %432 to i64
  %434 = icmp ugt i64 %433, -1
  br i1 %434, label %435, label %437

435:                                              ; preds = %431
  %436 = call i32 (ptr, ...) @printf(ptr noundef @.str, ptr noundef @.str.1, i32 noundef 484)
  call void @exit(i32 noundef 253) #10
  unreachable

437:                                              ; preds = %431
  br label %438

438:                                              ; preds = %437
  br label %439

439:                                              ; preds = %438
  %440 = load i32, ptr %71, align 4, !tbaa !9
  %441 = zext i32 %440 to i64
  %442 = alloca i8, i64 %441, align 16
  store i64 %441, ptr %72, align 8
  %443 = load i32, ptr %71, align 4, !tbaa !9
  %444 = zext i32 %443 to i64
  %445 = mul i64 %444, 1
  call void @llvm.memset.p0.i64(ptr align 16 %442, i8 0, i64 %445, i1 false)
  %446 = call zeroext i16 @__bswap_16(i16 noundef zeroext 32)
  call void @store16(ptr noundef %442, i16 noundef zeroext %446)
  call void @llvm.lifetime.start.p0(i64 8, ptr %73) #9
  %447 = getelementptr inbounds i8, ptr %442, i64 2
  store ptr %447, ptr %73, align 8, !tbaa !5
  %448 = load ptr, ptr %73, align 8, !tbaa !5
  %449 = getelementptr inbounds i8, ptr %448, i64 0
  store i8 72, ptr %449, align 1, !tbaa !11
  %450 = load ptr, ptr %73, align 8, !tbaa !5
  %451 = getelementptr inbounds i8, ptr %450, i64 1
  store i8 80, ptr %451, align 1, !tbaa !11
  %452 = load ptr, ptr %73, align 8, !tbaa !5
  %453 = getelementptr inbounds i8, ptr %452, i64 2
  store i8 75, ptr %453, align 1, !tbaa !11
  %454 = load ptr, ptr %73, align 8, !tbaa !5
  %455 = getelementptr inbounds i8, ptr %454, i64 3
  store i8 69, ptr %455, align 1, !tbaa !11
  %456 = load ptr, ptr %73, align 8, !tbaa !5
  %457 = getelementptr inbounds i8, ptr %456, i64 4
  store i8 45, ptr %457, align 1, !tbaa !11
  %458 = load ptr, ptr %73, align 8, !tbaa !5
  %459 = getelementptr inbounds i8, ptr %458, i64 5
  store i8 118, ptr %459, align 1, !tbaa !11
  %460 = load ptr, ptr %73, align 8, !tbaa !5
  %461 = getelementptr inbounds i8, ptr %460, i64 6
  store i8 49, ptr %461, align 1, !tbaa !11
  %462 = getelementptr inbounds i8, ptr %442, i64 9
  %463 = getelementptr inbounds [10 x i8], ptr %45, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %462, ptr align 1 %463, i64 10, i1 false)
  %464 = getelementptr inbounds i8, ptr %442, i64 19
  %465 = getelementptr inbounds [3 x i8], ptr %70, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %464, ptr align 1 %465, i64 3, i1 false)
  %466 = getelementptr inbounds i8, ptr %442, i64 22
  %467 = getelementptr inbounds [65 x i8], ptr %43, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %466, ptr align 16 %467, i64 65, i1 false)
  %468 = getelementptr inbounds %struct.Hacl_Impl_HPKE_context_s_s, ptr %0, i32 0, i32 0
  %469 = load ptr, ptr %468, align 8, !tbaa !16
  %470 = getelementptr inbounds [32 x i8], ptr %44, i64 0, i64 0
  %471 = load i32, ptr %71, align 4, !tbaa !9
  call void @Hacl_HKDF_expand_sha2_256(ptr noundef %469, ptr noundef %470, i32 noundef 32, ptr noundef %442, i32 noundef %471, i32 noundef 32)
  call void @llvm.lifetime.start.p0(i64 10, ptr %74) #9
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %74, ptr align 1 @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_base_nonce, i64 10, i1 false)
  call void @llvm.lifetime.start.p0(i64 4, ptr %75) #9
  store i32 94, ptr %75, align 4, !tbaa !9
  br label %472

472:                                              ; preds = %439
  %473 = load i32, ptr %75, align 4, !tbaa !9
  %474 = zext i32 %473 to i64
  %475 = icmp ugt i64 %474, -1
  br i1 %475, label %476, label %478

476:                                              ; preds = %472
  %477 = call i32 (ptr, ...) @printf(ptr noundef @.str, ptr noundef @.str.1, i32 noundef 504)
  call void @exit(i32 noundef 253) #10
  unreachable

478:                                              ; preds = %472
  br label %479

479:                                              ; preds = %478
  br label %480

480:                                              ; preds = %479
  %481 = load i32, ptr %75, align 4, !tbaa !9
  %482 = zext i32 %481 to i64
  %483 = alloca i8, i64 %482, align 16
  store i64 %482, ptr %76, align 8
  %484 = load i32, ptr %75, align 4, !tbaa !9
  %485 = zext i32 %484 to i64
  %486 = mul i64 %485, 1
  call void @llvm.memset.p0.i64(ptr align 16 %483, i8 0, i64 %486, i1 false)
  %487 = call zeroext i16 @__bswap_16(i16 noundef zeroext 12)
  call void @store16(ptr noundef %483, i16 noundef zeroext %487)
  call void @llvm.lifetime.start.p0(i64 8, ptr %77) #9
  %488 = getelementptr inbounds i8, ptr %483, i64 2
  store ptr %488, ptr %77, align 8, !tbaa !5
  %489 = load ptr, ptr %77, align 8, !tbaa !5
  %490 = getelementptr inbounds i8, ptr %489, i64 0
  store i8 72, ptr %490, align 1, !tbaa !11
  %491 = load ptr, ptr %77, align 8, !tbaa !5
  %492 = getelementptr inbounds i8, ptr %491, i64 1
  store i8 80, ptr %492, align 1, !tbaa !11
  %493 = load ptr, ptr %77, align 8, !tbaa !5
  %494 = getelementptr inbounds i8, ptr %493, i64 2
  store i8 75, ptr %494, align 1, !tbaa !11
  %495 = load ptr, ptr %77, align 8, !tbaa !5
  %496 = getelementptr inbounds i8, ptr %495, i64 3
  store i8 69, ptr %496, align 1, !tbaa !11
  %497 = load ptr, ptr %77, align 8, !tbaa !5
  %498 = getelementptr inbounds i8, ptr %497, i64 4
  store i8 45, ptr %498, align 1, !tbaa !11
  %499 = load ptr, ptr %77, align 8, !tbaa !5
  %500 = getelementptr inbounds i8, ptr %499, i64 5
  store i8 118, ptr %500, align 1, !tbaa !11
  %501 = load ptr, ptr %77, align 8, !tbaa !5
  %502 = getelementptr inbounds i8, ptr %501, i64 6
  store i8 49, ptr %502, align 1, !tbaa !11
  %503 = getelementptr inbounds i8, ptr %483, i64 9
  %504 = getelementptr inbounds [10 x i8], ptr %45, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %503, ptr align 1 %504, i64 10, i1 false)
  %505 = getelementptr inbounds i8, ptr %483, i64 19
  %506 = getelementptr inbounds [10 x i8], ptr %74, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %505, ptr align 1 %506, i64 10, i1 false)
  %507 = getelementptr inbounds i8, ptr %483, i64 29
  %508 = getelementptr inbounds [65 x i8], ptr %43, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %507, ptr align 16 %508, i64 65, i1 false)
  %509 = getelementptr inbounds %struct.Hacl_Impl_HPKE_context_s_s, ptr %0, i32 0, i32 1
  %510 = load ptr, ptr %509, align 8, !tbaa !17
  %511 = getelementptr inbounds [32 x i8], ptr %44, i64 0, i64 0
  %512 = load i32, ptr %75, align 4, !tbaa !9
  call void @Hacl_HKDF_expand_sha2_256(ptr noundef %510, ptr noundef %511, i32 noundef 32, ptr noundef %483, i32 noundef %512, i32 noundef 12)
  %513 = getelementptr inbounds %struct.Hacl_Impl_HPKE_context_s_s, ptr %0, i32 0, i32 2
  %514 = load ptr, ptr %513, align 8, !tbaa !18
  %515 = getelementptr inbounds i64, ptr %514, i64 0
  store i64 0, ptr %515, align 8, !tbaa !19
  store i32 0, ptr %6, align 4
  store i32 1, ptr %78, align 4
  call void @llvm.lifetime.end.p0(i64 8, ptr %77) #9
  call void @llvm.lifetime.end.p0(i64 4, ptr %75) #9
  call void @llvm.lifetime.end.p0(i64 10, ptr %74) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %73) #9
  call void @llvm.lifetime.end.p0(i64 4, ptr %71) #9
  call void @llvm.lifetime.end.p0(i64 3, ptr %70) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %69) #9
  call void @llvm.lifetime.end.p0(i64 4, ptr %67) #9
  call void @llvm.lifetime.end.p0(i64 3, ptr %66) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %65) #9
  call void @llvm.lifetime.end.p0(i64 4, ptr %63) #9
  call void @llvm.lifetime.end.p0(i64 6, ptr %62) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %61) #9
  call void @llvm.lifetime.end.p0(i64 4, ptr %59) #9
  call void @llvm.lifetime.end.p0(i64 32, ptr %58) #9
  call void @llvm.lifetime.end.p0(i64 9, ptr %57) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %56) #9
  %516 = load ptr, ptr %54, align 8
  call void @llvm.stackrestore.p0(ptr %516)
  call void @llvm.lifetime.end.p0(i64 4, ptr %53) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %52) #9
  call void @llvm.lifetime.end.p0(i64 32, ptr %51) #9
  call void @llvm.lifetime.end.p0(i64 11, ptr %50) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %49) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %48) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %47) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %46) #9
  call void @llvm.lifetime.end.p0(i64 10, ptr %45) #9
  call void @llvm.lifetime.end.p0(i64 32, ptr %44) #9
  call void @llvm.lifetime.end.p0(i64 65, ptr %43) #9
  br label %518

517:                                              ; preds = %231
  store i32 1, ptr %6, align 4
  store i32 1, ptr %78, align 4
  br label %518

518:                                              ; preds = %517, %480
  call void @llvm.lifetime.end.p0(i64 64, ptr %24) #9
  call void @llvm.lifetime.end.p0(i64 4, ptr %23) #9
  call void @llvm.lifetime.end.p0(i64 4, ptr %22) #9
  call void @llvm.lifetime.end.p0(i64 4, ptr %21) #9
  call void @llvm.lifetime.end.p0(i64 1, ptr %20) #9
  call void @llvm.lifetime.end.p0(i64 1, ptr %17) #9
  call void @llvm.lifetime.end.p0(i64 32, ptr %16) #9
  call void @llvm.lifetime.end.p0(i64 32, ptr %15) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %14) #9
  br label %520

519:                                              ; preds = %5
  store i32 1, ptr %6, align 4
  store i32 1, ptr %78, align 4
  br label %520

520:                                              ; preds = %519, %518
  call void @llvm.lifetime.end.p0(i64 32, ptr %13) #9
  call void @llvm.lifetime.end.p0(i64 4, ptr %12) #9
  call void @llvm.lifetime.end.p0(i64 32, ptr %11) #9
  %521 = load i32, ptr %6, align 4
  ret i32 %521
}

attributes #0 = { nocallback nofree nosync nounwind willreturn memory(argmem: readwrite) }
attributes #1 = { nocallback nofree nounwind willreturn memory(argmem: write) }
attributes #2 = { "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #3 = { noinline nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #4 = { nocallback nofree nounwind willreturn memory(argmem: readwrite) }
attributes #5 = { noreturn nounwind "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #6 = { nocallback nofree nosync nounwind willreturn }
attributes #7 = { inlinehint nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #8 = { nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #9 = { nounwind }
attributes #10 = { noreturn nounwind }

!llvm.module.flags = !{!0, !1, !2, !3}
!llvm.ident = !{!4}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{i32 8, !"PIC Level", i32 2}
!2 = !{i32 7, !"PIE Level", i32 2}
!3 = !{i32 7, !"uwtable", i32 2}
!4 = !{!"clang version 19.1.0 (git@github.com:llvm/llvm-project.git a4bf6cd7cfb1a1421ba92bca9d017b49936c55e4)"}
!5 = !{!6, !6, i64 0}
!6 = !{!"any pointer", !7, i64 0}
!7 = !{!"omnipotent char", !8, i64 0}
!8 = !{!"Simple C/C++ TBAA"}
!9 = !{!10, !10, i64 0}
!10 = !{!"int", !7, i64 0}
!11 = !{!7, !7, i64 0}
!12 = distinct !{!12, !13}
!13 = !{!"llvm.loop.mustprogress"}
!14 = !{!15, !6, i64 24}
!15 = !{!"Hacl_Impl_HPKE_context_s_s", !6, i64 0, !6, i64 8, !6, i64 16, !6, i64 24}
!16 = !{!15, !6, i64 0}
!17 = !{!15, !6, i64 8}
!18 = !{!15, !6, i64 16}
!19 = !{!20, !20, i64 0}
!20 = !{!"long", !7, i64 0}


; Optimized IR (opt -passes='default<O3>'):
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

%struct.Hacl_Impl_HPKE_context_s_s = type { ptr, ptr, ptr, ptr }

@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_eae_prk = external hidden unnamed_addr constant [7 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_shared_secret = external hidden unnamed_addr constant [13 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_psk_id_hash = external hidden unnamed_addr constant [11 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_info_hash = external hidden unnamed_addr constant [9 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_secret = external hidden unnamed_addr constant [6 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_exp = external hidden unnamed_addr constant [3 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_key = external hidden unnamed_addr constant [3 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_base_nonce = external hidden unnamed_addr constant [10 x i8], align 1

; Function Attrs: mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.start.p0(i64 immarg, ptr nocapture) #0

; Function Attrs: mustprogress nocallback nofree nounwind willreturn memory(argmem: write)
declare void @llvm.memset.p0.i64(ptr nocapture writeonly, i8, i64, i1 immarg) #1

declare void @Hacl_Curve25519_51_secret_to_public(ptr noundef, ptr noundef) local_unnamed_addr #2

declare void @Hacl_Curve25519_51_scalarmult(ptr noundef, ptr noundef, ptr noundef) local_unnamed_addr #2

; Function Attrs: noinline nounwind uwtable
declare hidden zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext, i8 noundef zeroext) local_unnamed_addr #3

; Function Attrs: mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.end.p0(i64 immarg, ptr nocapture) #0

; Function Attrs: mustprogress nocallback nofree nounwind willreturn memory(argmem: readwrite)
declare void @llvm.memcpy.p0.p0.i64(ptr noalias nocapture writeonly, ptr noalias nocapture readonly, i64, i1 immarg) #4

; Function Attrs: mustprogress nocallback nofree nosync nounwind willreturn
declare ptr @llvm.stacksave.p0() #5

declare void @Hacl_HKDF_extract_sha2_256(ptr noundef, ptr noundef, i32 noundef, ptr noundef, i32 noundef) local_unnamed_addr #2

; Function Attrs: inlinehint nounwind uwtable
declare hidden void @store16(ptr noundef, i16 noundef zeroext) local_unnamed_addr #6

; Function Attrs: inlinehint nounwind uwtable
declare hidden zeroext i16 @__bswap_16(i16 noundef zeroext) local_unnamed_addr #6

declare void @Hacl_HKDF_expand_sha2_256(ptr noundef, ptr noundef, i32 noundef, ptr noundef, i32 noundef, i32 noundef) local_unnamed_addr #2

; Function Attrs: mustprogress nocallback nofree nosync nounwind willreturn
declare void @llvm.stackrestore.p0(ptr) #5

; Function Attrs: nounwind uwtable
define dso_local range(i32 0, 2) i32 @Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR(ptr nocapture noundef readonly byval(%struct.Hacl_Impl_HPKE_context_s_s) align 8 %0, ptr noundef %1, ptr noundef %2, i32 noundef %3, ptr nocapture noundef readonly %4) local_unnamed_addr #7 {
  %6 = alloca [32 x i8], align 16
  %7 = alloca [32 x i8], align 16
  %8 = alloca [32 x i8], align 16
  %9 = alloca [64 x i8], align 16
  %10 = alloca [32 x i8], align 16
  %11 = alloca [5 x i8], align 4
  %.sroa.7 = alloca [32 x i8], align 1
  %.sroa.8 = alloca [32 x i8], align 1
  %12 = alloca [32 x i8], align 16
  %13 = alloca [10 x i8], align 8
  %14 = alloca [32 x i8], align 16
  %15 = alloca [32 x i8], align 16
  call void @llvm.lifetime.start.p0(i64 32, ptr nonnull %6) #8
  call void @llvm.memset.p0.i64(ptr noundef nonnull align 16 dereferenceable(32) %6, i8 0, i64 32, i1 false)
  call void @Hacl_Curve25519_51_secret_to_public(ptr noundef nonnull %6, ptr noundef %2) #8
  call void @llvm.lifetime.start.p0(i64 32, ptr nonnull %7) #8
  call void @llvm.memset.p0.i64(ptr noundef nonnull align 16 dereferenceable(32) %7, i8 0, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 32, ptr nonnull %8) #8
  call void @llvm.memset.p0.i64(ptr noundef nonnull align 16 dereferenceable(32) %8, i8 0, i64 32, i1 false)
  call void @Hacl_Curve25519_51_scalarmult(ptr noundef nonnull %8, ptr noundef %2, ptr noundef %1) #8
  %16 = load i8, ptr %8, align 16, !tbaa !5
  %17 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %16, i8 noundef zeroext 0)
  %18 = getelementptr inbounds i8, ptr %8, i64 1
  %19 = load i8, ptr %18, align 1, !tbaa !5
  %20 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %19, i8 noundef zeroext 0)
  %21 = and i8 %20, %17
  %22 = getelementptr inbounds i8, ptr %8, i64 2
  %23 = load i8, ptr %22, align 2, !tbaa !5
  %24 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %23, i8 noundef zeroext 0)
  %25 = and i8 %24, %21
  %26 = getelementptr inbounds i8, ptr %8, i64 3
  %27 = load i8, ptr %26, align 1, !tbaa !5
  %28 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %27, i8 noundef zeroext 0)
  %29 = and i8 %28, %25
  %30 = getelementptr inbounds i8, ptr %8, i64 4
  %31 = load i8, ptr %30, align 4, !tbaa !5
  %32 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %31, i8 noundef zeroext 0)
  %33 = and i8 %32, %29
  %34 = getelementptr inbounds i8, ptr %8, i64 5
  %35 = load i8, ptr %34, align 1, !tbaa !5
  %36 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %35, i8 noundef zeroext 0)
  %37 = and i8 %36, %33
  %38 = getelementptr inbounds i8, ptr %8, i64 6
  %39 = load i8, ptr %38, align 2, !tbaa !5
  %40 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %39, i8 noundef zeroext 0)
  %41 = and i8 %40, %37
  %42 = getelementptr inbounds i8, ptr %8, i64 7
  %43 = load i8, ptr %42, align 1, !tbaa !5
  %44 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %43, i8 noundef zeroext 0)
  %45 = and i8 %44, %41
  %46 = getelementptr inbounds i8, ptr %8, i64 8
  %47 = load i8, ptr %46, align 8, !tbaa !5
  %48 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %47, i8 noundef zeroext 0)
  %49 = and i8 %48, %45
  %50 = getelementptr inbounds i8, ptr %8, i64 9
  %51 = load i8, ptr %50, align 1, !tbaa !5
  %52 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %51, i8 noundef zeroext 0)
  %53 = and i8 %52, %49
  %54 = getelementptr inbounds i8, ptr %8, i64 10
  %55 = load i8, ptr %54, align 2, !tbaa !5
  %56 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %55, i8 noundef zeroext 0)
  %57 = and i8 %56, %53
  %58 = getelementptr inbounds i8, ptr %8, i64 11
  %59 = load i8, ptr %58, align 1, !tbaa !5
  %60 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %59, i8 noundef zeroext 0)
  %61 = and i8 %60, %57
  %62 = getelementptr inbounds i8, ptr %8, i64 12
  %63 = load i8, ptr %62, align 4, !tbaa !5
  %64 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %63, i8 noundef zeroext 0)
  %65 = and i8 %64, %61
  %66 = getelementptr inbounds i8, ptr %8, i64 13
  %67 = load i8, ptr %66, align 1, !tbaa !5
  %68 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %67, i8 noundef zeroext 0)
  %69 = and i8 %68, %65
  %70 = getelementptr inbounds i8, ptr %8, i64 14
  %71 = load i8, ptr %70, align 2, !tbaa !5
  %72 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %71, i8 noundef zeroext 0)
  %73 = and i8 %72, %69
  %74 = getelementptr inbounds i8, ptr %8, i64 15
  %75 = load i8, ptr %74, align 1, !tbaa !5
  %76 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %75, i8 noundef zeroext 0)
  %77 = and i8 %76, %73
  %78 = getelementptr inbounds i8, ptr %8, i64 16
  %79 = load i8, ptr %78, align 16, !tbaa !5
  %80 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %79, i8 noundef zeroext 0)
  %81 = and i8 %80, %77
  %82 = getelementptr inbounds i8, ptr %8, i64 17
  %83 = load i8, ptr %82, align 1, !tbaa !5
  %84 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %83, i8 noundef zeroext 0)
  %85 = and i8 %84, %81
  %86 = getelementptr inbounds i8, ptr %8, i64 18
  %87 = load i8, ptr %86, align 2, !tbaa !5
  %88 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %87, i8 noundef zeroext 0)
  %89 = and i8 %88, %85
  %90 = getelementptr inbounds i8, ptr %8, i64 19
  %91 = load i8, ptr %90, align 1, !tbaa !5
  %92 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %91, i8 noundef zeroext 0)
  %93 = and i8 %92, %89
  %94 = getelementptr inbounds i8, ptr %8, i64 20
  %95 = load i8, ptr %94, align 4, !tbaa !5
  %96 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %95, i8 noundef zeroext 0)
  %97 = and i8 %96, %93
  %98 = getelementptr inbounds i8, ptr %8, i64 21
  %99 = load i8, ptr %98, align 1, !tbaa !5
  %100 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %99, i8 noundef zeroext 0)
  %101 = and i8 %100, %97
  %102 = getelementptr inbounds i8, ptr %8, i64 22
  %103 = load i8, ptr %102, align 2, !tbaa !5
  %104 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %103, i8 noundef zeroext 0)
  %105 = and i8 %104, %101
  %106 = getelementptr inbounds i8, ptr %8, i64 23
  %107 = load i8, ptr %106, align 1, !tbaa !5
  %108 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %107, i8 noundef zeroext 0)
  %109 = and i8 %108, %105
  %110 = getelementptr inbounds i8, ptr %8, i64 24
  %111 = load i8, ptr %110, align 8, !tbaa !5
  %112 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %111, i8 noundef zeroext 0)
  %113 = and i8 %112, %109
  %114 = getelementptr inbounds i8, ptr %8, i64 25
  %115 = load i8, ptr %114, align 1, !tbaa !5
  %116 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %115, i8 noundef zeroext 0)
  %117 = and i8 %116, %113
  %118 = getelementptr inbounds i8, ptr %8, i64 26
  %119 = load i8, ptr %118, align 2, !tbaa !5
  %120 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %119, i8 noundef zeroext 0)
  %121 = and i8 %120, %117
  %122 = getelementptr inbounds i8, ptr %8, i64 27
  %123 = load i8, ptr %122, align 1, !tbaa !5
  %124 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %123, i8 noundef zeroext 0)
  %125 = and i8 %124, %121
  %126 = getelementptr inbounds i8, ptr %8, i64 28
  %127 = load i8, ptr %126, align 4, !tbaa !5
  %128 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %127, i8 noundef zeroext 0)
  %129 = and i8 %128, %125
  %130 = getelementptr inbounds i8, ptr %8, i64 29
  %131 = load i8, ptr %130, align 1, !tbaa !5
  %132 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %131, i8 noundef zeroext 0)
  %133 = and i8 %132, %129
  %134 = getelementptr inbounds i8, ptr %8, i64 30
  %135 = load i8, ptr %134, align 2, !tbaa !5
  %136 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %135, i8 noundef zeroext 0)
  %137 = and i8 %136, %133
  %138 = getelementptr inbounds i8, ptr %8, i64 31
  %139 = load i8, ptr %138, align 1, !tbaa !5
  %140 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %139, i8 noundef zeroext 0)
  %141 = and i8 %140, %137
  %.not.not = icmp eq i8 %141, -1
  call void @llvm.lifetime.start.p0(i64 64, ptr nonnull %9) #8
  call void @llvm.memset.p0.i64(ptr noundef nonnull align 16 dereferenceable(64) %9, i8 0, i64 64, i1 false)
  br i1 %.not.not, label %.critedge, label %142

142:                                              ; preds = %5
  %143 = getelementptr inbounds i8, ptr %9, i64 32
  call void @Hacl_Curve25519_51_secret_to_public(ptr noundef nonnull %143, ptr noundef %2) #8
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 16 dereferenceable(32) %9, ptr noundef nonnull align 1 dereferenceable(32) %1, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 32, ptr nonnull %10) #8
  call void @llvm.memset.p0.i64(ptr noundef nonnull align 16 dereferenceable(32) %10, i8 0, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 5, ptr nonnull %11) #8
  store <4 x i8> <i8 75, i8 69, i8 77, i8 0>, ptr %11, align 4, !tbaa !5
  %144 = getelementptr inbounds i8, ptr %11, i64 4
  store i8 32, ptr %144, align 4, !tbaa !5
  %145 = call ptr @llvm.stacksave.p0()
  %146 = alloca [51 x i8], align 16
  store <4 x i8> <i8 72, i8 80, i8 75, i8 69>, ptr %146, align 16, !tbaa !5
  %147 = getelementptr inbounds i8, ptr %146, i64 4
  store i8 45, ptr %147, align 4, !tbaa !5
  %148 = getelementptr inbounds i8, ptr %146, i64 5
  store i8 118, ptr %148, align 1, !tbaa !5
  %149 = getelementptr inbounds i8, ptr %146, i64 6
  store i8 49, ptr %149, align 2, !tbaa !5
  %150 = getelementptr inbounds i8, ptr %146, i64 7
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(5) %150, ptr noundef nonnull align 4 dereferenceable(5) %11, i64 5, i1 false)
  %151 = getelementptr inbounds i8, ptr %146, i64 12
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 4 dereferenceable(7) %151, ptr noundef nonnull align 1 dereferenceable(7) @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_eae_prk, i64 7, i1 false)
  %152 = getelementptr inbounds i8, ptr %146, i64 19
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(32) %152, ptr noundef nonnull align 16 dereferenceable(32) %8, i64 32, i1 false)
  call void @Hacl_HKDF_extract_sha2_256(ptr noundef nonnull %10, ptr noundef nonnull %11, i32 noundef 0, ptr noundef nonnull %146, i32 noundef 51) #8
  %153 = alloca [91 x i8], align 16
  call void @llvm.memset.p0.i64(ptr noundef nonnull align 16 dereferenceable(91) %153, i8 0, i64 91, i1 false)
  %154 = call zeroext i16 @__bswap_16(i16 noundef zeroext 32)
  call void @store16(ptr noundef nonnull %153, i16 noundef zeroext %154)
  %155 = getelementptr inbounds i8, ptr %153, i64 2
  store <4 x i8> <i8 72, i8 80, i8 75, i8 69>, ptr %155, align 2, !tbaa !5
  %156 = getelementptr inbounds i8, ptr %153, i64 6
  store i8 45, ptr %156, align 2, !tbaa !5
  %157 = getelementptr inbounds i8, ptr %153, i64 7
  store i8 118, ptr %157, align 1, !tbaa !5
  %158 = getelementptr inbounds i8, ptr %153, i64 8
  store i8 49, ptr %158, align 8, !tbaa !5
  %159 = getelementptr inbounds i8, ptr %153, i64 9
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(5) %159, ptr noundef nonnull align 4 dereferenceable(5) %11, i64 5, i1 false)
  %160 = getelementptr inbounds i8, ptr %153, i64 14
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 2 dereferenceable(13) %160, ptr noundef nonnull align 1 dereferenceable(13) @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_shared_secret, i64 13, i1 false)
  %161 = getelementptr inbounds i8, ptr %153, i64 27
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(64) %161, ptr noundef nonnull align 16 dereferenceable(64) %9, i64 64, i1 false)
  call void @Hacl_HKDF_expand_sha2_256(ptr noundef nonnull %7, ptr noundef nonnull %10, i32 noundef 32, ptr noundef nonnull %153, i32 noundef 91, i32 noundef 32) #8
  call void @llvm.stackrestore.p0(ptr %145)
  call void @llvm.lifetime.end.p0(i64 5, ptr nonnull %11) #8
  call void @llvm.lifetime.end.p0(i64 32, ptr nonnull %10) #8
  call void @llvm.lifetime.start.p0(i64 32, ptr nonnull %.sroa.7)
  call void @llvm.lifetime.start.p0(i64 32, ptr nonnull %.sroa.8)
  call void @llvm.lifetime.start.p0(i64 32, ptr nonnull %12) #8
  call void @llvm.memset.p0.i64(ptr noundef nonnull align 16 dereferenceable(32) %12, i8 0, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 10, ptr nonnull %13) #8
  store <8 x i8> <i8 72, i8 80, i8 75, i8 69, i8 0, i8 32, i8 0, i8 1>, ptr %13, align 8, !tbaa !5
  %162 = getelementptr inbounds i8, ptr %13, i64 8
  store i8 0, ptr %162, align 8, !tbaa !5
  %163 = getelementptr inbounds i8, ptr %13, i64 9
  store i8 3, ptr %163, align 1, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 32, ptr nonnull %14) #8
  call void @llvm.memset.p0.i64(ptr noundef nonnull align 16 dereferenceable(32) %14, i8 0, i64 32, i1 false)
  %164 = call ptr @llvm.stacksave.p0()
  %165 = alloca [28 x i8], align 16
  store <4 x i8> <i8 72, i8 80, i8 75, i8 69>, ptr %165, align 16, !tbaa !5
  %166 = getelementptr inbounds i8, ptr %165, i64 4
  store i8 45, ptr %166, align 4, !tbaa !5
  %167 = getelementptr inbounds i8, ptr %165, i64 5
  store i8 118, ptr %167, align 1, !tbaa !5
  %168 = getelementptr inbounds i8, ptr %165, i64 6
  store i8 49, ptr %168, align 2, !tbaa !5
  %169 = getelementptr inbounds i8, ptr %165, i64 7
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(10) %169, ptr noundef nonnull align 8 dereferenceable(10) %13, i64 10, i1 false)
  %170 = getelementptr inbounds i8, ptr %165, i64 17
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(11) %170, ptr noundef nonnull align 1 dereferenceable(11) @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_psk_id_hash, i64 11, i1 false)
  call void @Hacl_HKDF_extract_sha2_256(ptr noundef nonnull %14, ptr noundef nonnull %13, i32 noundef 0, ptr noundef nonnull %165, i32 noundef 28) #8
  call void @llvm.lifetime.start.p0(i64 32, ptr nonnull %15) #8
  call void @llvm.memset.p0.i64(ptr noundef nonnull align 16 dereferenceable(32) %15, i8 0, i64 32, i1 false)
  %171 = add i32 %3, 26
  %172 = zext i32 %171 to i64
  %173 = alloca i8, i64 %172, align 16
  call void @llvm.memset.p0.i64(ptr nonnull align 16 %173, i8 0, i64 %172, i1 false)
  store <4 x i8> <i8 72, i8 80, i8 75, i8 69>, ptr %173, align 16, !tbaa !5
  %174 = getelementptr inbounds i8, ptr %173, i64 4
  store i8 45, ptr %174, align 4, !tbaa !5
  %175 = getelementptr inbounds i8, ptr %173, i64 5
  store i8 118, ptr %175, align 1, !tbaa !5
  %176 = getelementptr inbounds i8, ptr %173, i64 6
  store i8 49, ptr %176, align 2, !tbaa !5
  %177 = getelementptr inbounds i8, ptr %173, i64 7
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(10) %177, ptr noundef nonnull align 8 dereferenceable(10) %13, i64 10, i1 false)
  %178 = getelementptr inbounds i8, ptr %173, i64 17
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(9) %178, ptr noundef nonnull align 1 dereferenceable(9) @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_info_hash, i64 9, i1 false)
  %179 = getelementptr inbounds i8, ptr %173, i64 26
  %180 = zext i32 %3 to i64
  call void @llvm.memcpy.p0.p0.i64(ptr nonnull align 2 %179, ptr align 1 %4, i64 %180, i1 false)
  call void @Hacl_HKDF_extract_sha2_256(ptr noundef nonnull %15, ptr noundef nonnull %13, i32 noundef 0, ptr noundef nonnull %173, i32 noundef %171) #8
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(32) %.sroa.7, ptr noundef nonnull align 16 dereferenceable(32) %14, i64 32, i1 false)
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(32) %.sroa.8, ptr noundef nonnull align 16 dereferenceable(32) %15, i64 32, i1 false)
  %181 = alloca [23 x i8], align 16
  store <4 x i8> <i8 72, i8 80, i8 75, i8 69>, ptr %181, align 16, !tbaa !5
  %182 = getelementptr inbounds i8, ptr %181, i64 4
  store i8 45, ptr %182, align 4, !tbaa !5
  %183 = getelementptr inbounds i8, ptr %181, i64 5
  store i8 118, ptr %183, align 1, !tbaa !5
  %184 = getelementptr inbounds i8, ptr %181, i64 6
  store i8 49, ptr %184, align 2, !tbaa !5
  %185 = getelementptr inbounds i8, ptr %181, i64 7
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(10) %185, ptr noundef nonnull align 8 dereferenceable(10) %13, i64 10, i1 false)
  %186 = getelementptr inbounds i8, ptr %181, i64 17
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(6) %186, ptr noundef nonnull align 1 dereferenceable(6) @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_secret, i64 6, i1 false)
  call void @Hacl_HKDF_extract_sha2_256(ptr noundef nonnull %12, ptr noundef nonnull %7, i32 noundef 32, ptr noundef nonnull %181, i32 noundef 23) #8
  %187 = alloca [87 x i8], align 16
  call void @llvm.memset.p0.i64(ptr noundef nonnull align 16 dereferenceable(87) %187, i8 0, i64 87, i1 false)
  %188 = call zeroext i16 @__bswap_16(i16 noundef zeroext 32)
  call void @store16(ptr noundef nonnull %187, i16 noundef zeroext %188)
  %189 = getelementptr inbounds i8, ptr %187, i64 2
  store <4 x i8> <i8 72, i8 80, i8 75, i8 69>, ptr %189, align 2, !tbaa !5
  %190 = getelementptr inbounds i8, ptr %187, i64 6
  store i8 45, ptr %190, align 2, !tbaa !5
  %191 = getelementptr inbounds i8, ptr %187, i64 7
  store i8 118, ptr %191, align 1, !tbaa !5
  %192 = getelementptr inbounds i8, ptr %187, i64 8
  store i8 49, ptr %192, align 8, !tbaa !5
  %193 = getelementptr inbounds i8, ptr %187, i64 9
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(10) %193, ptr noundef nonnull align 8 dereferenceable(10) %13, i64 10, i1 false)
  %194 = getelementptr inbounds i8, ptr %187, i64 19
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(3) %194, ptr noundef nonnull align 1 dereferenceable(3) @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_exp, i64 3, i1 false)
  %195 = getelementptr inbounds i8, ptr %187, i64 22
  store i8 0, ptr %195, align 2
  %.sroa.7.0..sroa_idx = getelementptr inbounds i8, ptr %187, i64 23
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(32) %.sroa.7.0..sroa_idx, ptr noundef nonnull align 1 dereferenceable(32) %.sroa.7, i64 32, i1 false)
  %.sroa.8.0..sroa_idx = getelementptr inbounds i8, ptr %187, i64 55
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(32) %.sroa.8.0..sroa_idx, ptr noundef nonnull align 1 dereferenceable(32) %.sroa.8, i64 32, i1 false)
  %196 = getelementptr inbounds i8, ptr %0, i64 24
  %197 = load ptr, ptr %196, align 8, !tbaa !8
  call void @Hacl_HKDF_expand_sha2_256(ptr noundef %197, ptr noundef nonnull %12, i32 noundef 32, ptr noundef nonnull %187, i32 noundef 87, i32 noundef 32) #8
  %198 = alloca [87 x i8], align 16
  call void @llvm.memset.p0.i64(ptr noundef nonnull align 16 dereferenceable(87) %198, i8 0, i64 87, i1 false)
  %199 = call zeroext i16 @__bswap_16(i16 noundef zeroext 32)
  call void @store16(ptr noundef nonnull %198, i16 noundef zeroext %199)
  %200 = getelementptr inbounds i8, ptr %198, i64 2
  store <4 x i8> <i8 72, i8 80, i8 75, i8 69>, ptr %200, align 2, !tbaa !5
  %201 = getelementptr inbounds i8, ptr %198, i64 6
  store i8 45, ptr %201, align 2, !tbaa !5
  %202 = getelementptr inbounds i8, ptr %198, i64 7
  store i8 118, ptr %202, align 1, !tbaa !5
  %203 = getelementptr inbounds i8, ptr %198, i64 8
  store i8 49, ptr %203, align 8, !tbaa !5
  %204 = getelementptr inbounds i8, ptr %198, i64 9
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(10) %204, ptr noundef nonnull align 8 dereferenceable(10) %13, i64 10, i1 false)
  %205 = getelementptr inbounds i8, ptr %198, i64 19
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(3) %205, ptr noundef nonnull align 1 dereferenceable(3) @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_key, i64 3, i1 false)
  %206 = getelementptr inbounds i8, ptr %198, i64 22
  store i8 0, ptr %206, align 2
  %.sroa.7.0..sroa_idx82 = getelementptr inbounds i8, ptr %198, i64 23
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(32) %.sroa.7.0..sroa_idx82, ptr noundef nonnull align 1 dereferenceable(32) %.sroa.7, i64 32, i1 false)
  %.sroa.8.0..sroa_idx84 = getelementptr inbounds i8, ptr %198, i64 55
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(32) %.sroa.8.0..sroa_idx84, ptr noundef nonnull align 1 dereferenceable(32) %.sroa.8, i64 32, i1 false)
  %207 = load ptr, ptr %0, align 8, !tbaa !11
  call void @Hacl_HKDF_expand_sha2_256(ptr noundef %207, ptr noundef nonnull %12, i32 noundef 32, ptr noundef nonnull %198, i32 noundef 87, i32 noundef 32) #8
  %208 = alloca [94 x i8], align 16
  call void @llvm.memset.p0.i64(ptr noundef nonnull align 16 dereferenceable(94) %208, i8 0, i64 94, i1 false)
  %209 = call zeroext i16 @__bswap_16(i16 noundef zeroext 12)
  call void @store16(ptr noundef nonnull %208, i16 noundef zeroext %209)
  %210 = getelementptr inbounds i8, ptr %208, i64 2
  store <4 x i8> <i8 72, i8 80, i8 75, i8 69>, ptr %210, align 2, !tbaa !5
  %211 = getelementptr inbounds i8, ptr %208, i64 6
  store i8 45, ptr %211, align 2, !tbaa !5
  %212 = getelementptr inbounds i8, ptr %208, i64 7
  store i8 118, ptr %212, align 1, !tbaa !5
  %213 = getelementptr inbounds i8, ptr %208, i64 8
  store i8 49, ptr %213, align 8, !tbaa !5
  %214 = getelementptr inbounds i8, ptr %208, i64 9
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(10) %214, ptr noundef nonnull align 8 dereferenceable(10) %13, i64 10, i1 false)
  %215 = getelementptr inbounds i8, ptr %208, i64 19
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(10) %215, ptr noundef nonnull align 1 dereferenceable(10) @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseR.label_base_nonce, i64 10, i1 false)
  %216 = getelementptr inbounds i8, ptr %208, i64 29
  store i8 0, ptr %216, align 1
  %.sroa.7.0..sroa_idx83 = getelementptr inbounds i8, ptr %208, i64 30
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 2 dereferenceable(32) %.sroa.7.0..sroa_idx83, ptr noundef nonnull align 1 dereferenceable(32) %.sroa.7, i64 32, i1 false)
  %.sroa.8.0..sroa_idx85 = getelementptr inbounds i8, ptr %208, i64 62
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 2 dereferenceable(32) %.sroa.8.0..sroa_idx85, ptr noundef nonnull align 1 dereferenceable(32) %.sroa.8, i64 32, i1 false)
  %217 = getelementptr inbounds i8, ptr %0, i64 8
  %218 = load ptr, ptr %217, align 8, !tbaa !12
  call void @Hacl_HKDF_expand_sha2_256(ptr noundef %218, ptr noundef nonnull %12, i32 noundef 32, ptr noundef nonnull %208, i32 noundef 94, i32 noundef 12) #8
  %219 = getelementptr inbounds i8, ptr %0, i64 16
  %220 = load ptr, ptr %219, align 8, !tbaa !13
  store i64 0, ptr %220, align 8, !tbaa !14
  call void @llvm.lifetime.end.p0(i64 32, ptr nonnull %15) #8
  call void @llvm.stackrestore.p0(ptr %164)
  call void @llvm.lifetime.end.p0(i64 32, ptr nonnull %14) #8
  call void @llvm.lifetime.end.p0(i64 10, ptr nonnull %13) #8
  call void @llvm.lifetime.end.p0(i64 32, ptr nonnull %12) #8
  call void @llvm.lifetime.end.p0(i64 32, ptr nonnull %.sroa.7)
  call void @llvm.lifetime.end.p0(i64 32, ptr nonnull %.sroa.8)
  br label %.critedge

.critedge:                                        ; preds = %5, %142
  %.0 = phi i32 [ 0, %142 ], [ 1, %5 ]
  call void @llvm.lifetime.end.p0(i64 64, ptr nonnull %9) #8
  call void @llvm.lifetime.end.p0(i64 32, ptr nonnull %8) #8
  call void @llvm.lifetime.end.p0(i64 32, ptr nonnull %7) #8
  call void @llvm.lifetime.end.p0(i64 32, ptr nonnull %6) #8
  ret i32 %.0
}

attributes #0 = { mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite) }
attributes #1 = { mustprogress nocallback nofree nounwind willreturn memory(argmem: write) }
attributes #2 = { "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #3 = { noinline nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #4 = { mustprogress nocallback nofree nounwind willreturn memory(argmem: readwrite) }
attributes #5 = { mustprogress nocallback nofree nosync nounwind willreturn }
attributes #6 = { inlinehint nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #7 = { nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #8 = { nounwind }

!llvm.module.flags = !{!0, !1, !2, !3}
!llvm.ident = !{!4}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{i32 8, !"PIC Level", i32 2}
!2 = !{i32 7, !"PIE Level", i32 2}
!3 = !{i32 7, !"uwtable", i32 2}
!4 = !{!"clang version 19.1.0 (git@github.com:llvm/llvm-project.git a4bf6cd7cfb1a1421ba92bca9d017b49936c55e4)"}
!5 = !{!6, !6, i64 0}
!6 = !{!"omnipotent char", !7, i64 0}
!7 = !{!"Simple C/C++ TBAA"}
!8 = !{!9, !10, i64 24}
!9 = !{!"Hacl_Impl_HPKE_context_s_s", !10, i64 0, !10, i64 8, !10, i64 16, !10, i64 24}
!10 = !{!"any pointer", !6, i64 0}
!11 = !{!9, !10, i64 0}
!12 = !{!9, !10, i64 8}
!13 = !{!9, !10, i64 16}
!14 = !{!15, !15, i64 0}
!15 = !{!"long", !6, i64 0}


; Effective O3 passes: CorrelatedValuePropagationPass,DSEPass,EarlyCSEPass,GVNPass,GlobalOptPass,IPSCCPPass,IndVarSimplifyPass,InferAlignmentPass,InferFunctionAttrsPass,InstCombinePass,LCSSAPass,LoopRotatePass,MemCpyOptPass,PostOrderFunctionAttrsPass,SLPVectorizerPass,SROAPass,SimplifyCFGPass