; LLVM IR from cryspen/libcrux :: sys/hacl/c/src (Hacl_HPKE_Curve51_CP128_SHA256)

; Unoptimized IR (clang -disable-llvm-passes):
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

%struct.Hacl_Impl_HPKE_context_s_s = type { ptr, ptr, ptr, ptr }

@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_eae_prk = external hidden unnamed_addr constant [7 x i8], align 1
@.str = external hidden unnamed_addr constant [70 x i8], align 1
@.str.1 = external hidden unnamed_addr constant [97 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_shared_secret = external hidden unnamed_addr constant [13 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_psk_id_hash = external hidden unnamed_addr constant [11 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_info_hash = external hidden unnamed_addr constant [9 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_secret = external hidden unnamed_addr constant [6 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_exp = external hidden unnamed_addr constant [3 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_key = external hidden unnamed_addr constant [3 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_base_nonce = external hidden unnamed_addr constant [10 x i8], align 1

; Function Attrs: nounwind uwtable
define dso_local i32 @Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS(ptr noundef %0, ptr noundef byval(%struct.Hacl_Impl_HPKE_context_s_s) align 8 %1, ptr noundef %2, ptr noundef %3, i32 noundef %4, ptr noundef %5) #0 {
  %7 = alloca i32, align 4
  %8 = alloca ptr, align 8
  %9 = alloca ptr, align 8
  %10 = alloca ptr, align 8
  %11 = alloca i32, align 4
  %12 = alloca ptr, align 8
  %13 = alloca [32 x i8], align 16
  %14 = alloca ptr, align 8
  %15 = alloca i32, align 4
  %16 = alloca i32, align 4
  %17 = alloca [32 x i8], align 16
  %18 = alloca [32 x i8], align 16
  %19 = alloca i8, align 1
  %20 = alloca i32, align 4
  %21 = alloca i8, align 1
  %22 = alloca i8, align 1
  %23 = alloca i32, align 4
  %24 = alloca i32, align 4
  %25 = alloca [64 x i8], align 16
  %26 = alloca ptr, align 8
  %27 = alloca ptr, align 8
  %28 = alloca ptr, align 8
  %29 = alloca [32 x i8], align 16
  %30 = alloca [5 x i8], align 1
  %31 = alloca ptr, align 8
  %32 = alloca ptr, align 8
  %33 = alloca ptr, align 8
  %34 = alloca [7 x i8], align 1
  %35 = alloca i32, align 4
  %36 = alloca ptr, align 8
  %37 = alloca i64, align 8
  %38 = alloca ptr, align 8
  %39 = alloca [13 x i8], align 1
  %40 = alloca i32, align 4
  %41 = alloca i64, align 8
  %42 = alloca ptr, align 8
  %43 = alloca [65 x i8], align 16
  %44 = alloca [32 x i8], align 16
  %45 = alloca [10 x i8], align 1
  %46 = alloca ptr, align 8
  %47 = alloca ptr, align 8
  %48 = alloca ptr, align 8
  %49 = alloca ptr, align 8
  %50 = alloca [11 x i8], align 1
  %51 = alloca [32 x i8], align 16
  %52 = alloca ptr, align 8
  %53 = alloca i32, align 4
  %54 = alloca ptr, align 8
  %55 = alloca i64, align 8
  %56 = alloca ptr, align 8
  %57 = alloca [9 x i8], align 1
  %58 = alloca [32 x i8], align 16
  %59 = alloca i32, align 4
  %60 = alloca i64, align 8
  %61 = alloca ptr, align 8
  %62 = alloca [6 x i8], align 1
  %63 = alloca i32, align 4
  %64 = alloca i64, align 8
  %65 = alloca ptr, align 8
  %66 = alloca [3 x i8], align 1
  %67 = alloca i32, align 4
  %68 = alloca i64, align 8
  %69 = alloca ptr, align 8
  %70 = alloca [3 x i8], align 1
  %71 = alloca i32, align 4
  %72 = alloca i64, align 8
  %73 = alloca ptr, align 8
  %74 = alloca [10 x i8], align 1
  %75 = alloca i32, align 4
  %76 = alloca i64, align 8
  %77 = alloca ptr, align 8
  %78 = alloca i32, align 4
  store ptr %0, ptr %8, align 8, !tbaa !5
  store ptr %2, ptr %9, align 8, !tbaa !5
  store ptr %3, ptr %10, align 8, !tbaa !5
  store i32 %4, ptr %11, align 4, !tbaa !9
  store ptr %5, ptr %12, align 8, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 32, ptr %13) #9
  call void @llvm.memset.p0.i64(ptr align 16 %13, i8 0, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 8, ptr %14) #9
  %79 = load ptr, ptr %8, align 8, !tbaa !5
  store ptr %79, ptr %14, align 8, !tbaa !5
  %80 = load ptr, ptr %14, align 8, !tbaa !5
  %81 = load ptr, ptr %9, align 8, !tbaa !5
  call void @Hacl_Curve25519_51_secret_to_public(ptr noundef %80, ptr noundef %81)
  call void @llvm.lifetime.start.p0(i64 4, ptr %15) #9
  store i32 0, ptr %15, align 4, !tbaa !9
  call void @llvm.lifetime.start.p0(i64 4, ptr %16) #9
  %82 = load i32, ptr %15, align 4, !tbaa !9
  %83 = icmp eq i32 %82, 0
  br i1 %83, label %84, label %227

84:                                               ; preds = %6
  call void @llvm.lifetime.start.p0(i64 32, ptr %17) #9
  call void @llvm.memset.p0.i64(ptr align 16 %17, i8 0, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 32, ptr %18) #9
  call void @llvm.memset.p0.i64(ptr align 16 %18, i8 0, i64 32, i1 false)
  %85 = getelementptr inbounds [32 x i8], ptr %17, i64 0, i64 0
  %86 = load ptr, ptr %9, align 8, !tbaa !5
  %87 = load ptr, ptr %10, align 8, !tbaa !5
  call void @Hacl_Curve25519_51_scalarmult(ptr noundef %85, ptr noundef %86, ptr noundef %87)
  call void @llvm.lifetime.start.p0(i64 1, ptr %19) #9
  store i8 -1, ptr %19, align 1, !tbaa !11
  call void @llvm.lifetime.start.p0(i64 4, ptr %20) #9
  store i32 0, ptr %20, align 4, !tbaa !9
  br label %88

88:                                               ; preds = %108, %84
  %89 = load i32, ptr %20, align 4, !tbaa !9
  %90 = icmp ult i32 %89, 32
  br i1 %90, label %92, label %91

91:                                               ; preds = %88
  call void @llvm.lifetime.end.p0(i64 4, ptr %20) #9
  br label %111

92:                                               ; preds = %88
  call void @llvm.lifetime.start.p0(i64 1, ptr %21) #9
  %93 = load i32, ptr %20, align 4, !tbaa !9
  %94 = zext i32 %93 to i64
  %95 = getelementptr inbounds [32 x i8], ptr %17, i64 0, i64 %94
  %96 = load i8, ptr %95, align 1, !tbaa !11
  %97 = load i32, ptr %20, align 4, !tbaa !9
  %98 = zext i32 %97 to i64
  %99 = getelementptr inbounds [32 x i8], ptr %18, i64 0, i64 %98
  %100 = load i8, ptr %99, align 1, !tbaa !11
  %101 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %96, i8 noundef zeroext %100)
  store i8 %101, ptr %21, align 1, !tbaa !11
  %102 = load i8, ptr %21, align 1, !tbaa !11
  %103 = zext i8 %102 to i32
  %104 = load i8, ptr %19, align 1, !tbaa !11
  %105 = zext i8 %104 to i32
  %106 = and i32 %103, %105
  %107 = trunc i32 %106 to i8
  store i8 %107, ptr %19, align 1, !tbaa !11
  call void @llvm.lifetime.end.p0(i64 1, ptr %21) #9
  br label %108

108:                                              ; preds = %92
  %109 = load i32, ptr %20, align 4, !tbaa !9
  %110 = add i32 %109, 1
  store i32 %110, ptr %20, align 4, !tbaa !9
  br label %88, !llvm.loop !12

111:                                              ; preds = %91
  call void @llvm.lifetime.start.p0(i64 1, ptr %22) #9
  %112 = load i8, ptr %19, align 1, !tbaa !11
  store i8 %112, ptr %22, align 1, !tbaa !11
  call void @llvm.lifetime.start.p0(i64 4, ptr %23) #9
  %113 = load i8, ptr %22, align 1, !tbaa !11
  %114 = zext i8 %113 to i32
  %115 = icmp eq i32 %114, 255
  br i1 %115, label %116, label %117

116:                                              ; preds = %111
  store i32 1, ptr %23, align 4, !tbaa !9
  br label %118

117:                                              ; preds = %111
  store i32 0, ptr %23, align 4, !tbaa !9
  br label %118

118:                                              ; preds = %117, %116
  call void @llvm.lifetime.start.p0(i64 4, ptr %24) #9
  %119 = load i32, ptr %23, align 4, !tbaa !9
  store i32 %119, ptr %24, align 4, !tbaa !9
  call void @llvm.lifetime.start.p0(i64 64, ptr %25) #9
  call void @llvm.memset.p0.i64(ptr align 16 %25, i8 0, i64 64, i1 false)
  %120 = load i32, ptr %24, align 4, !tbaa !9
  %121 = icmp eq i32 %120, 0
  br i1 %121, label %122, label %225

122:                                              ; preds = %118
  %123 = getelementptr inbounds [64 x i8], ptr %25, i64 0, i64 0
  %124 = load ptr, ptr %8, align 8, !tbaa !5
  call void @llvm.memcpy.p0.p0.i64(ptr align 16 %123, ptr align 1 %124, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 8, ptr %26) #9
  %125 = getelementptr inbounds [64 x i8], ptr %25, i64 0, i64 0
  %126 = getelementptr inbounds i8, ptr %125, i64 32
  store ptr %126, ptr %26, align 8, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 8, ptr %27) #9
  %127 = load ptr, ptr %26, align 8, !tbaa !5
  store ptr %127, ptr %27, align 8, !tbaa !5
  %128 = load ptr, ptr %27, align 8, !tbaa !5
  %129 = load ptr, ptr %10, align 8, !tbaa !5
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %128, ptr align 1 %129, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 8, ptr %28) #9
  %130 = getelementptr inbounds [32 x i8], ptr %17, i64 0, i64 0
  store ptr %130, ptr %28, align 8, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 32, ptr %29) #9
  call void @llvm.memset.p0.i64(ptr align 16 %29, i8 0, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 5, ptr %30) #9
  call void @llvm.memset.p0.i64(ptr align 1 %30, i8 0, i64 5, i1 false)
  call void @llvm.lifetime.start.p0(i64 8, ptr %31) #9
  %131 = getelementptr inbounds [5 x i8], ptr %30, i64 0, i64 0
  store ptr %131, ptr %31, align 8, !tbaa !5
  %132 = load ptr, ptr %31, align 8, !tbaa !5
  %133 = getelementptr inbounds i8, ptr %132, i64 0
  store i8 75, ptr %133, align 1, !tbaa !11
  %134 = load ptr, ptr %31, align 8, !tbaa !5
  %135 = getelementptr inbounds i8, ptr %134, i64 1
  store i8 69, ptr %135, align 1, !tbaa !11
  %136 = load ptr, ptr %31, align 8, !tbaa !5
  %137 = getelementptr inbounds i8, ptr %136, i64 2
  store i8 77, ptr %137, align 1, !tbaa !11
  call void @llvm.lifetime.start.p0(i64 8, ptr %32) #9
  %138 = getelementptr inbounds [5 x i8], ptr %30, i64 0, i64 0
  %139 = getelementptr inbounds i8, ptr %138, i64 3
  store ptr %139, ptr %32, align 8, !tbaa !5
  %140 = load ptr, ptr %32, align 8, !tbaa !5
  %141 = getelementptr inbounds i8, ptr %140, i64 0
  store i8 0, ptr %141, align 1, !tbaa !11
  %142 = load ptr, ptr %32, align 8, !tbaa !5
  %143 = getelementptr inbounds i8, ptr %142, i64 1
  store i8 32, ptr %143, align 1, !tbaa !11
  call void @llvm.lifetime.start.p0(i64 8, ptr %33) #9
  %144 = getelementptr inbounds [5 x i8], ptr %30, i64 0, i64 0
  store ptr %144, ptr %33, align 8, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 7, ptr %34) #9
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %34, ptr align 1 @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_eae_prk, i64 7, i1 false)
  call void @llvm.lifetime.start.p0(i64 4, ptr %35) #9
  store i32 51, ptr %35, align 4, !tbaa !9
  br label %145

145:                                              ; preds = %122
  %146 = load i32, ptr %35, align 4, !tbaa !9
  %147 = zext i32 %146 to i64
  %148 = icmp ugt i64 %147, -1
  br i1 %148, label %149, label %151

149:                                              ; preds = %145
  %150 = call i32 (ptr, ...) @printf(ptr noundef @.str, ptr noundef @.str.1, i32 noundef 87)
  call void @exit(i32 noundef 253) #10
  unreachable

151:                                              ; preds = %145
  br label %152

152:                                              ; preds = %151
  br label %153

153:                                              ; preds = %152
  %154 = load i32, ptr %35, align 4, !tbaa !9
  %155 = zext i32 %154 to i64
  %156 = call ptr @llvm.stacksave.p0()
  store ptr %156, ptr %36, align 8
  %157 = alloca i8, i64 %155, align 16
  store i64 %155, ptr %37, align 8
  %158 = load i32, ptr %35, align 4, !tbaa !9
  %159 = zext i32 %158 to i64
  %160 = mul i64 %159, 1
  call void @llvm.memset.p0.i64(ptr align 16 %157, i8 0, i64 %160, i1 false)
  call void @llvm.lifetime.start.p0(i64 8, ptr %38) #9
  store ptr %157, ptr %38, align 8, !tbaa !5
  %161 = load ptr, ptr %38, align 8, !tbaa !5
  %162 = getelementptr inbounds i8, ptr %161, i64 0
  store i8 72, ptr %162, align 1, !tbaa !11
  %163 = load ptr, ptr %38, align 8, !tbaa !5
  %164 = getelementptr inbounds i8, ptr %163, i64 1
  store i8 80, ptr %164, align 1, !tbaa !11
  %165 = load ptr, ptr %38, align 8, !tbaa !5
  %166 = getelementptr inbounds i8, ptr %165, i64 2
  store i8 75, ptr %166, align 1, !tbaa !11
  %167 = load ptr, ptr %38, align 8, !tbaa !5
  %168 = getelementptr inbounds i8, ptr %167, i64 3
  store i8 69, ptr %168, align 1, !tbaa !11
  %169 = load ptr, ptr %38, align 8, !tbaa !5
  %170 = getelementptr inbounds i8, ptr %169, i64 4
  store i8 45, ptr %170, align 1, !tbaa !11
  %171 = load ptr, ptr %38, align 8, !tbaa !5
  %172 = getelementptr inbounds i8, ptr %171, i64 5
  store i8 118, ptr %172, align 1, !tbaa !11
  %173 = load ptr, ptr %38, align 8, !tbaa !5
  %174 = getelementptr inbounds i8, ptr %173, i64 6
  store i8 49, ptr %174, align 1, !tbaa !11
  %175 = getelementptr inbounds i8, ptr %157, i64 7
  %176 = getelementptr inbounds [5 x i8], ptr %30, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %175, ptr align 1 %176, i64 5, i1 false)
  %177 = getelementptr inbounds i8, ptr %157, i64 12
  %178 = getelementptr inbounds [7 x i8], ptr %34, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %177, ptr align 1 %178, i64 7, i1 false)
  %179 = getelementptr inbounds i8, ptr %157, i64 19
  %180 = load ptr, ptr %28, align 8, !tbaa !5
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %179, ptr align 1 %180, i64 32, i1 false)
  %181 = getelementptr inbounds [32 x i8], ptr %29, i64 0, i64 0
  %182 = load ptr, ptr %33, align 8, !tbaa !5
  %183 = load i32, ptr %35, align 4, !tbaa !9
  call void @Hacl_HKDF_extract_sha2_256(ptr noundef %181, ptr noundef %182, i32 noundef 0, ptr noundef %157, i32 noundef %183)
  call void @llvm.lifetime.start.p0(i64 13, ptr %39) #9
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %39, ptr align 1 @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_shared_secret, i64 13, i1 false)
  call void @llvm.lifetime.start.p0(i64 4, ptr %40) #9
  store i32 91, ptr %40, align 4, !tbaa !9
  br label %184

184:                                              ; preds = %153
  %185 = load i32, ptr %40, align 4, !tbaa !9
  %186 = zext i32 %185 to i64
  %187 = icmp ugt i64 %186, -1
  br i1 %187, label %188, label %190

188:                                              ; preds = %184
  %189 = call i32 (ptr, ...) @printf(ptr noundef @.str, ptr noundef @.str.1, i32 noundef 108)
  call void @exit(i32 noundef 253) #10
  unreachable

190:                                              ; preds = %184
  br label %191

191:                                              ; preds = %190
  br label %192

192:                                              ; preds = %191
  %193 = load i32, ptr %40, align 4, !tbaa !9
  %194 = zext i32 %193 to i64
  %195 = alloca i8, i64 %194, align 16
  store i64 %194, ptr %41, align 8
  %196 = load i32, ptr %40, align 4, !tbaa !9
  %197 = zext i32 %196 to i64
  %198 = mul i64 %197, 1
  call void @llvm.memset.p0.i64(ptr align 16 %195, i8 0, i64 %198, i1 false)
  %199 = call zeroext i16 @__bswap_16(i16 noundef zeroext 32)
  call void @store16(ptr noundef %195, i16 noundef zeroext %199)
  call void @llvm.lifetime.start.p0(i64 8, ptr %42) #9
  %200 = getelementptr inbounds i8, ptr %195, i64 2
  store ptr %200, ptr %42, align 8, !tbaa !5
  %201 = load ptr, ptr %42, align 8, !tbaa !5
  %202 = getelementptr inbounds i8, ptr %201, i64 0
  store i8 72, ptr %202, align 1, !tbaa !11
  %203 = load ptr, ptr %42, align 8, !tbaa !5
  %204 = getelementptr inbounds i8, ptr %203, i64 1
  store i8 80, ptr %204, align 1, !tbaa !11
  %205 = load ptr, ptr %42, align 8, !tbaa !5
  %206 = getelementptr inbounds i8, ptr %205, i64 2
  store i8 75, ptr %206, align 1, !tbaa !11
  %207 = load ptr, ptr %42, align 8, !tbaa !5
  %208 = getelementptr inbounds i8, ptr %207, i64 3
  store i8 69, ptr %208, align 1, !tbaa !11
  %209 = load ptr, ptr %42, align 8, !tbaa !5
  %210 = getelementptr inbounds i8, ptr %209, i64 4
  store i8 45, ptr %210, align 1, !tbaa !11
  %211 = load ptr, ptr %42, align 8, !tbaa !5
  %212 = getelementptr inbounds i8, ptr %211, i64 5
  store i8 118, ptr %212, align 1, !tbaa !11
  %213 = load ptr, ptr %42, align 8, !tbaa !5
  %214 = getelementptr inbounds i8, ptr %213, i64 6
  store i8 49, ptr %214, align 1, !tbaa !11
  %215 = getelementptr inbounds i8, ptr %195, i64 9
  %216 = getelementptr inbounds [5 x i8], ptr %30, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %215, ptr align 1 %216, i64 5, i1 false)
  %217 = getelementptr inbounds i8, ptr %195, i64 14
  %218 = getelementptr inbounds [13 x i8], ptr %39, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %217, ptr align 1 %218, i64 13, i1 false)
  %219 = getelementptr inbounds i8, ptr %195, i64 27
  %220 = getelementptr inbounds [64 x i8], ptr %25, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %219, ptr align 16 %220, i64 64, i1 false)
  %221 = getelementptr inbounds [32 x i8], ptr %13, i64 0, i64 0
  %222 = getelementptr inbounds [32 x i8], ptr %29, i64 0, i64 0
  %223 = load i32, ptr %40, align 4, !tbaa !9
  call void @Hacl_HKDF_expand_sha2_256(ptr noundef %221, ptr noundef %222, i32 noundef 32, ptr noundef %195, i32 noundef %223, i32 noundef 32)
  store i32 0, ptr %16, align 4, !tbaa !9
  call void @llvm.lifetime.end.p0(i64 8, ptr %42) #9
  call void @llvm.lifetime.end.p0(i64 4, ptr %40) #9
  call void @llvm.lifetime.end.p0(i64 13, ptr %39) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %38) #9
  %224 = load ptr, ptr %36, align 8
  call void @llvm.stackrestore.p0(ptr %224)
  call void @llvm.lifetime.end.p0(i64 4, ptr %35) #9
  call void @llvm.lifetime.end.p0(i64 7, ptr %34) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %33) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %32) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %31) #9
  call void @llvm.lifetime.end.p0(i64 5, ptr %30) #9
  call void @llvm.lifetime.end.p0(i64 32, ptr %29) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %28) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %27) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %26) #9
  br label %226

225:                                              ; preds = %118
  store i32 1, ptr %16, align 4, !tbaa !9
  br label %226

226:                                              ; preds = %225, %192
  call void @llvm.lifetime.end.p0(i64 64, ptr %25) #9
  call void @llvm.lifetime.end.p0(i64 4, ptr %24) #9
  call void @llvm.lifetime.end.p0(i64 4, ptr %23) #9
  call void @llvm.lifetime.end.p0(i64 1, ptr %22) #9
  call void @llvm.lifetime.end.p0(i64 1, ptr %19) #9
  call void @llvm.lifetime.end.p0(i64 32, ptr %18) #9
  call void @llvm.lifetime.end.p0(i64 32, ptr %17) #9
  br label %228

227:                                              ; preds = %6
  store i32 1, ptr %16, align 4, !tbaa !9
  br label %228

228:                                              ; preds = %227, %226
  %229 = load i32, ptr %16, align 4, !tbaa !9
  %230 = icmp eq i32 %229, 0
  br i1 %230, label %231, label %515

231:                                              ; preds = %228
  call void @llvm.lifetime.start.p0(i64 65, ptr %43) #9
  call void @llvm.memset.p0.i64(ptr align 16 %43, i8 0, i64 65, i1 false)
  call void @llvm.lifetime.start.p0(i64 32, ptr %44) #9
  call void @llvm.memset.p0.i64(ptr align 16 %44, i8 0, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 10, ptr %45) #9
  call void @llvm.memset.p0.i64(ptr align 1 %45, i8 0, i64 10, i1 false)
  call void @llvm.lifetime.start.p0(i64 8, ptr %46) #9
  %232 = getelementptr inbounds [10 x i8], ptr %45, i64 0, i64 0
  store ptr %232, ptr %46, align 8, !tbaa !5
  %233 = load ptr, ptr %46, align 8, !tbaa !5
  %234 = getelementptr inbounds i8, ptr %233, i64 0
  store i8 72, ptr %234, align 1, !tbaa !11
  %235 = load ptr, ptr %46, align 8, !tbaa !5
  %236 = getelementptr inbounds i8, ptr %235, i64 1
  store i8 80, ptr %236, align 1, !tbaa !11
  %237 = load ptr, ptr %46, align 8, !tbaa !5
  %238 = getelementptr inbounds i8, ptr %237, i64 2
  store i8 75, ptr %238, align 1, !tbaa !11
  %239 = load ptr, ptr %46, align 8, !tbaa !5
  %240 = getelementptr inbounds i8, ptr %239, i64 3
  store i8 69, ptr %240, align 1, !tbaa !11
  call void @llvm.lifetime.start.p0(i64 8, ptr %47) #9
  %241 = getelementptr inbounds [10 x i8], ptr %45, i64 0, i64 0
  %242 = getelementptr inbounds i8, ptr %241, i64 4
  store ptr %242, ptr %47, align 8, !tbaa !5
  %243 = load ptr, ptr %47, align 8, !tbaa !5
  %244 = getelementptr inbounds i8, ptr %243, i64 0
  store i8 0, ptr %244, align 1, !tbaa !11
  %245 = load ptr, ptr %47, align 8, !tbaa !5
  %246 = getelementptr inbounds i8, ptr %245, i64 1
  store i8 32, ptr %246, align 1, !tbaa !11
  call void @llvm.lifetime.start.p0(i64 8, ptr %48) #9
  %247 = getelementptr inbounds [10 x i8], ptr %45, i64 0, i64 0
  %248 = getelementptr inbounds i8, ptr %247, i64 6
  store ptr %248, ptr %48, align 8, !tbaa !5
  %249 = load ptr, ptr %48, align 8, !tbaa !5
  %250 = getelementptr inbounds i8, ptr %249, i64 0
  store i8 0, ptr %250, align 1, !tbaa !11
  %251 = load ptr, ptr %48, align 8, !tbaa !5
  %252 = getelementptr inbounds i8, ptr %251, i64 1
  store i8 1, ptr %252, align 1, !tbaa !11
  call void @llvm.lifetime.start.p0(i64 8, ptr %49) #9
  %253 = getelementptr inbounds [10 x i8], ptr %45, i64 0, i64 0
  %254 = getelementptr inbounds i8, ptr %253, i64 8
  store ptr %254, ptr %49, align 8, !tbaa !5
  %255 = load ptr, ptr %49, align 8, !tbaa !5
  %256 = getelementptr inbounds i8, ptr %255, i64 0
  store i8 0, ptr %256, align 1, !tbaa !11
  %257 = load ptr, ptr %49, align 8, !tbaa !5
  %258 = getelementptr inbounds i8, ptr %257, i64 1
  store i8 3, ptr %258, align 1, !tbaa !11
  call void @llvm.lifetime.start.p0(i64 11, ptr %50) #9
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %50, ptr align 1 @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_psk_id_hash, i64 11, i1 false)
  call void @llvm.lifetime.start.p0(i64 32, ptr %51) #9
  call void @llvm.memset.p0.i64(ptr align 16 %51, i8 0, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 8, ptr %52) #9
  %259 = getelementptr inbounds [10 x i8], ptr %45, i64 0, i64 0
  store ptr %259, ptr %52, align 8, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 4, ptr %53) #9
  store i32 28, ptr %53, align 4, !tbaa !9
  br label %260

260:                                              ; preds = %231
  %261 = load i32, ptr %53, align 4, !tbaa !9
  %262 = zext i32 %261 to i64
  %263 = icmp ugt i64 %262, -1
  br i1 %263, label %264, label %266

264:                                              ; preds = %260
  %265 = call i32 (ptr, ...) @printf(ptr noundef @.str, ptr noundef @.str.1, i32 noundef 160)
  call void @exit(i32 noundef 253) #10
  unreachable

266:                                              ; preds = %260
  br label %267

267:                                              ; preds = %266
  br label %268

268:                                              ; preds = %267
  %269 = load i32, ptr %53, align 4, !tbaa !9
  %270 = zext i32 %269 to i64
  %271 = call ptr @llvm.stacksave.p0()
  store ptr %271, ptr %54, align 8
  %272 = alloca i8, i64 %270, align 16
  store i64 %270, ptr %55, align 8
  %273 = load i32, ptr %53, align 4, !tbaa !9
  %274 = zext i32 %273 to i64
  %275 = mul i64 %274, 1
  call void @llvm.memset.p0.i64(ptr align 16 %272, i8 0, i64 %275, i1 false)
  call void @llvm.lifetime.start.p0(i64 8, ptr %56) #9
  store ptr %272, ptr %56, align 8, !tbaa !5
  %276 = load ptr, ptr %56, align 8, !tbaa !5
  %277 = getelementptr inbounds i8, ptr %276, i64 0
  store i8 72, ptr %277, align 1, !tbaa !11
  %278 = load ptr, ptr %56, align 8, !tbaa !5
  %279 = getelementptr inbounds i8, ptr %278, i64 1
  store i8 80, ptr %279, align 1, !tbaa !11
  %280 = load ptr, ptr %56, align 8, !tbaa !5
  %281 = getelementptr inbounds i8, ptr %280, i64 2
  store i8 75, ptr %281, align 1, !tbaa !11
  %282 = load ptr, ptr %56, align 8, !tbaa !5
  %283 = getelementptr inbounds i8, ptr %282, i64 3
  store i8 69, ptr %283, align 1, !tbaa !11
  %284 = load ptr, ptr %56, align 8, !tbaa !5
  %285 = getelementptr inbounds i8, ptr %284, i64 4
  store i8 45, ptr %285, align 1, !tbaa !11
  %286 = load ptr, ptr %56, align 8, !tbaa !5
  %287 = getelementptr inbounds i8, ptr %286, i64 5
  store i8 118, ptr %287, align 1, !tbaa !11
  %288 = load ptr, ptr %56, align 8, !tbaa !5
  %289 = getelementptr inbounds i8, ptr %288, i64 6
  store i8 49, ptr %289, align 1, !tbaa !11
  %290 = getelementptr inbounds i8, ptr %272, i64 7
  %291 = getelementptr inbounds [10 x i8], ptr %45, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %290, ptr align 1 %291, i64 10, i1 false)
  %292 = getelementptr inbounds i8, ptr %272, i64 17
  %293 = getelementptr inbounds [11 x i8], ptr %50, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %292, ptr align 1 %293, i64 11, i1 false)
  %294 = getelementptr inbounds i8, ptr %272, i64 28
  %295 = load ptr, ptr %52, align 8, !tbaa !5
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %294, ptr align 1 %295, i64 0, i1 false)
  %296 = getelementptr inbounds [32 x i8], ptr %51, i64 0, i64 0
  %297 = load ptr, ptr %52, align 8, !tbaa !5
  %298 = load i32, ptr %53, align 4, !tbaa !9
  call void @Hacl_HKDF_extract_sha2_256(ptr noundef %296, ptr noundef %297, i32 noundef 0, ptr noundef %272, i32 noundef %298)
  call void @llvm.lifetime.start.p0(i64 9, ptr %57) #9
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %57, ptr align 1 @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_info_hash, i64 9, i1 false)
  call void @llvm.lifetime.start.p0(i64 32, ptr %58) #9
  call void @llvm.memset.p0.i64(ptr align 16 %58, i8 0, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 4, ptr %59) #9
  %299 = load i32, ptr %11, align 4, !tbaa !9
  %300 = add i32 26, %299
  store i32 %300, ptr %59, align 4, !tbaa !9
  br label %301

301:                                              ; preds = %268
  %302 = load i32, ptr %59, align 4, !tbaa !9
  %303 = zext i32 %302 to i64
  %304 = icmp ugt i64 %303, -1
  br i1 %304, label %305, label %307

305:                                              ; preds = %301
  %306 = call i32 (ptr, ...) @printf(ptr noundef @.str, ptr noundef @.str.1, i32 noundef 179)
  call void @exit(i32 noundef 253) #10
  unreachable

307:                                              ; preds = %301
  br label %308

308:                                              ; preds = %307
  br label %309

309:                                              ; preds = %308
  %310 = load i32, ptr %59, align 4, !tbaa !9
  %311 = zext i32 %310 to i64
  %312 = alloca i8, i64 %311, align 16
  store i64 %311, ptr %60, align 8
  %313 = load i32, ptr %59, align 4, !tbaa !9
  %314 = zext i32 %313 to i64
  %315 = mul i64 %314, 1
  call void @llvm.memset.p0.i64(ptr align 16 %312, i8 0, i64 %315, i1 false)
  call void @llvm.lifetime.start.p0(i64 8, ptr %61) #9
  store ptr %312, ptr %61, align 8, !tbaa !5
  %316 = load ptr, ptr %61, align 8, !tbaa !5
  %317 = getelementptr inbounds i8, ptr %316, i64 0
  store i8 72, ptr %317, align 1, !tbaa !11
  %318 = load ptr, ptr %61, align 8, !tbaa !5
  %319 = getelementptr inbounds i8, ptr %318, i64 1
  store i8 80, ptr %319, align 1, !tbaa !11
  %320 = load ptr, ptr %61, align 8, !tbaa !5
  %321 = getelementptr inbounds i8, ptr %320, i64 2
  store i8 75, ptr %321, align 1, !tbaa !11
  %322 = load ptr, ptr %61, align 8, !tbaa !5
  %323 = getelementptr inbounds i8, ptr %322, i64 3
  store i8 69, ptr %323, align 1, !tbaa !11
  %324 = load ptr, ptr %61, align 8, !tbaa !5
  %325 = getelementptr inbounds i8, ptr %324, i64 4
  store i8 45, ptr %325, align 1, !tbaa !11
  %326 = load ptr, ptr %61, align 8, !tbaa !5
  %327 = getelementptr inbounds i8, ptr %326, i64 5
  store i8 118, ptr %327, align 1, !tbaa !11
  %328 = load ptr, ptr %61, align 8, !tbaa !5
  %329 = getelementptr inbounds i8, ptr %328, i64 6
  store i8 49, ptr %329, align 1, !tbaa !11
  %330 = getelementptr inbounds i8, ptr %312, i64 7
  %331 = getelementptr inbounds [10 x i8], ptr %45, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %330, ptr align 1 %331, i64 10, i1 false)
  %332 = getelementptr inbounds i8, ptr %312, i64 17
  %333 = getelementptr inbounds [9 x i8], ptr %57, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %332, ptr align 1 %333, i64 9, i1 false)
  %334 = getelementptr inbounds i8, ptr %312, i64 26
  %335 = load ptr, ptr %12, align 8, !tbaa !5
  %336 = load i32, ptr %11, align 4, !tbaa !9
  %337 = zext i32 %336 to i64
  %338 = mul i64 %337, 1
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %334, ptr align 1 %335, i64 %338, i1 false)
  %339 = getelementptr inbounds [32 x i8], ptr %58, i64 0, i64 0
  %340 = load ptr, ptr %52, align 8, !tbaa !5
  %341 = load i32, ptr %59, align 4, !tbaa !9
  call void @Hacl_HKDF_extract_sha2_256(ptr noundef %339, ptr noundef %340, i32 noundef 0, ptr noundef %312, i32 noundef %341)
  %342 = getelementptr inbounds [65 x i8], ptr %43, i64 0, i64 0
  store i8 0, ptr %342, align 16, !tbaa !11
  %343 = getelementptr inbounds [65 x i8], ptr %43, i64 0, i64 0
  %344 = getelementptr inbounds i8, ptr %343, i64 1
  %345 = getelementptr inbounds [32 x i8], ptr %51, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %344, ptr align 16 %345, i64 32, i1 false)
  %346 = getelementptr inbounds [65 x i8], ptr %43, i64 0, i64 0
  %347 = getelementptr inbounds i8, ptr %346, i64 33
  %348 = getelementptr inbounds [32 x i8], ptr %58, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %347, ptr align 16 %348, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 6, ptr %62) #9
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %62, ptr align 1 @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_secret, i64 6, i1 false)
  call void @llvm.lifetime.start.p0(i64 4, ptr %63) #9
  store i32 23, ptr %63, align 4, !tbaa !9
  br label %349

349:                                              ; preds = %309
  %350 = load i32, ptr %63, align 4, !tbaa !9
  %351 = zext i32 %350 to i64
  %352 = icmp ugt i64 %351, -1
  br i1 %352, label %353, label %355

353:                                              ; preds = %349
  %354 = call i32 (ptr, ...) @printf(ptr noundef @.str, ptr noundef @.str.1, i32 noundef 199)
  call void @exit(i32 noundef 253) #10
  unreachable

355:                                              ; preds = %349
  br label %356

356:                                              ; preds = %355
  br label %357

357:                                              ; preds = %356
  %358 = load i32, ptr %63, align 4, !tbaa !9
  %359 = zext i32 %358 to i64
  %360 = alloca i8, i64 %359, align 16
  store i64 %359, ptr %64, align 8
  %361 = load i32, ptr %63, align 4, !tbaa !9
  %362 = zext i32 %361 to i64
  %363 = mul i64 %362, 1
  call void @llvm.memset.p0.i64(ptr align 16 %360, i8 0, i64 %363, i1 false)
  call void @llvm.lifetime.start.p0(i64 8, ptr %65) #9
  store ptr %360, ptr %65, align 8, !tbaa !5
  %364 = load ptr, ptr %65, align 8, !tbaa !5
  %365 = getelementptr inbounds i8, ptr %364, i64 0
  store i8 72, ptr %365, align 1, !tbaa !11
  %366 = load ptr, ptr %65, align 8, !tbaa !5
  %367 = getelementptr inbounds i8, ptr %366, i64 1
  store i8 80, ptr %367, align 1, !tbaa !11
  %368 = load ptr, ptr %65, align 8, !tbaa !5
  %369 = getelementptr inbounds i8, ptr %368, i64 2
  store i8 75, ptr %369, align 1, !tbaa !11
  %370 = load ptr, ptr %65, align 8, !tbaa !5
  %371 = getelementptr inbounds i8, ptr %370, i64 3
  store i8 69, ptr %371, align 1, !tbaa !11
  %372 = load ptr, ptr %65, align 8, !tbaa !5
  %373 = getelementptr inbounds i8, ptr %372, i64 4
  store i8 45, ptr %373, align 1, !tbaa !11
  %374 = load ptr, ptr %65, align 8, !tbaa !5
  %375 = getelementptr inbounds i8, ptr %374, i64 5
  store i8 118, ptr %375, align 1, !tbaa !11
  %376 = load ptr, ptr %65, align 8, !tbaa !5
  %377 = getelementptr inbounds i8, ptr %376, i64 6
  store i8 49, ptr %377, align 1, !tbaa !11
  %378 = getelementptr inbounds i8, ptr %360, i64 7
  %379 = getelementptr inbounds [10 x i8], ptr %45, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %378, ptr align 1 %379, i64 10, i1 false)
  %380 = getelementptr inbounds i8, ptr %360, i64 17
  %381 = getelementptr inbounds [6 x i8], ptr %62, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %380, ptr align 1 %381, i64 6, i1 false)
  %382 = getelementptr inbounds i8, ptr %360, i64 23
  %383 = load ptr, ptr %52, align 8, !tbaa !5
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %382, ptr align 1 %383, i64 0, i1 false)
  %384 = getelementptr inbounds [32 x i8], ptr %44, i64 0, i64 0
  %385 = getelementptr inbounds [32 x i8], ptr %13, i64 0, i64 0
  %386 = load i32, ptr %63, align 4, !tbaa !9
  call void @Hacl_HKDF_extract_sha2_256(ptr noundef %384, ptr noundef %385, i32 noundef 32, ptr noundef %360, i32 noundef %386)
  call void @llvm.lifetime.start.p0(i64 3, ptr %66) #9
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %66, ptr align 1 @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_exp, i64 3, i1 false)
  call void @llvm.lifetime.start.p0(i64 4, ptr %67) #9
  store i32 87, ptr %67, align 4, !tbaa !9
  br label %387

387:                                              ; preds = %357
  %388 = load i32, ptr %67, align 4, !tbaa !9
  %389 = zext i32 %388 to i64
  %390 = icmp ugt i64 %389, -1
  br i1 %390, label %391, label %393

391:                                              ; preds = %387
  %392 = call i32 (ptr, ...) @printf(ptr noundef @.str, ptr noundef @.str.1, i32 noundef 216)
  call void @exit(i32 noundef 253) #10
  unreachable

393:                                              ; preds = %387
  br label %394

394:                                              ; preds = %393
  br label %395

395:                                              ; preds = %394
  %396 = load i32, ptr %67, align 4, !tbaa !9
  %397 = zext i32 %396 to i64
  %398 = alloca i8, i64 %397, align 16
  store i64 %397, ptr %68, align 8
  %399 = load i32, ptr %67, align 4, !tbaa !9
  %400 = zext i32 %399 to i64
  %401 = mul i64 %400, 1
  call void @llvm.memset.p0.i64(ptr align 16 %398, i8 0, i64 %401, i1 false)
  %402 = call zeroext i16 @__bswap_16(i16 noundef zeroext 32)
  call void @store16(ptr noundef %398, i16 noundef zeroext %402)
  call void @llvm.lifetime.start.p0(i64 8, ptr %69) #9
  %403 = getelementptr inbounds i8, ptr %398, i64 2
  store ptr %403, ptr %69, align 8, !tbaa !5
  %404 = load ptr, ptr %69, align 8, !tbaa !5
  %405 = getelementptr inbounds i8, ptr %404, i64 0
  store i8 72, ptr %405, align 1, !tbaa !11
  %406 = load ptr, ptr %69, align 8, !tbaa !5
  %407 = getelementptr inbounds i8, ptr %406, i64 1
  store i8 80, ptr %407, align 1, !tbaa !11
  %408 = load ptr, ptr %69, align 8, !tbaa !5
  %409 = getelementptr inbounds i8, ptr %408, i64 2
  store i8 75, ptr %409, align 1, !tbaa !11
  %410 = load ptr, ptr %69, align 8, !tbaa !5
  %411 = getelementptr inbounds i8, ptr %410, i64 3
  store i8 69, ptr %411, align 1, !tbaa !11
  %412 = load ptr, ptr %69, align 8, !tbaa !5
  %413 = getelementptr inbounds i8, ptr %412, i64 4
  store i8 45, ptr %413, align 1, !tbaa !11
  %414 = load ptr, ptr %69, align 8, !tbaa !5
  %415 = getelementptr inbounds i8, ptr %414, i64 5
  store i8 118, ptr %415, align 1, !tbaa !11
  %416 = load ptr, ptr %69, align 8, !tbaa !5
  %417 = getelementptr inbounds i8, ptr %416, i64 6
  store i8 49, ptr %417, align 1, !tbaa !11
  %418 = getelementptr inbounds i8, ptr %398, i64 9
  %419 = getelementptr inbounds [10 x i8], ptr %45, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %418, ptr align 1 %419, i64 10, i1 false)
  %420 = getelementptr inbounds i8, ptr %398, i64 19
  %421 = getelementptr inbounds [3 x i8], ptr %66, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %420, ptr align 1 %421, i64 3, i1 false)
  %422 = getelementptr inbounds i8, ptr %398, i64 22
  %423 = getelementptr inbounds [65 x i8], ptr %43, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %422, ptr align 16 %423, i64 65, i1 false)
  %424 = getelementptr inbounds %struct.Hacl_Impl_HPKE_context_s_s, ptr %1, i32 0, i32 3
  %425 = load ptr, ptr %424, align 8, !tbaa !14
  %426 = getelementptr inbounds [32 x i8], ptr %44, i64 0, i64 0
  %427 = load i32, ptr %67, align 4, !tbaa !9
  call void @Hacl_HKDF_expand_sha2_256(ptr noundef %425, ptr noundef %426, i32 noundef 32, ptr noundef %398, i32 noundef %427, i32 noundef 32)
  call void @llvm.lifetime.start.p0(i64 3, ptr %70) #9
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %70, ptr align 1 @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_key, i64 3, i1 false)
  call void @llvm.lifetime.start.p0(i64 4, ptr %71) #9
  store i32 87, ptr %71, align 4, !tbaa !9
  br label %428

428:                                              ; preds = %395
  %429 = load i32, ptr %71, align 4, !tbaa !9
  %430 = zext i32 %429 to i64
  %431 = icmp ugt i64 %430, -1
  br i1 %431, label %432, label %434

432:                                              ; preds = %428
  %433 = call i32 (ptr, ...) @printf(ptr noundef @.str, ptr noundef @.str.1, i32 noundef 234)
  call void @exit(i32 noundef 253) #10
  unreachable

434:                                              ; preds = %428
  br label %435

435:                                              ; preds = %434
  br label %436

436:                                              ; preds = %435
  %437 = load i32, ptr %71, align 4, !tbaa !9
  %438 = zext i32 %437 to i64
  %439 = alloca i8, i64 %438, align 16
  store i64 %438, ptr %72, align 8
  %440 = load i32, ptr %71, align 4, !tbaa !9
  %441 = zext i32 %440 to i64
  %442 = mul i64 %441, 1
  call void @llvm.memset.p0.i64(ptr align 16 %439, i8 0, i64 %442, i1 false)
  %443 = call zeroext i16 @__bswap_16(i16 noundef zeroext 32)
  call void @store16(ptr noundef %439, i16 noundef zeroext %443)
  call void @llvm.lifetime.start.p0(i64 8, ptr %73) #9
  %444 = getelementptr inbounds i8, ptr %439, i64 2
  store ptr %444, ptr %73, align 8, !tbaa !5
  %445 = load ptr, ptr %73, align 8, !tbaa !5
  %446 = getelementptr inbounds i8, ptr %445, i64 0
  store i8 72, ptr %446, align 1, !tbaa !11
  %447 = load ptr, ptr %73, align 8, !tbaa !5
  %448 = getelementptr inbounds i8, ptr %447, i64 1
  store i8 80, ptr %448, align 1, !tbaa !11
  %449 = load ptr, ptr %73, align 8, !tbaa !5
  %450 = getelementptr inbounds i8, ptr %449, i64 2
  store i8 75, ptr %450, align 1, !tbaa !11
  %451 = load ptr, ptr %73, align 8, !tbaa !5
  %452 = getelementptr inbounds i8, ptr %451, i64 3
  store i8 69, ptr %452, align 1, !tbaa !11
  %453 = load ptr, ptr %73, align 8, !tbaa !5
  %454 = getelementptr inbounds i8, ptr %453, i64 4
  store i8 45, ptr %454, align 1, !tbaa !11
  %455 = load ptr, ptr %73, align 8, !tbaa !5
  %456 = getelementptr inbounds i8, ptr %455, i64 5
  store i8 118, ptr %456, align 1, !tbaa !11
  %457 = load ptr, ptr %73, align 8, !tbaa !5
  %458 = getelementptr inbounds i8, ptr %457, i64 6
  store i8 49, ptr %458, align 1, !tbaa !11
  %459 = getelementptr inbounds i8, ptr %439, i64 9
  %460 = getelementptr inbounds [10 x i8], ptr %45, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %459, ptr align 1 %460, i64 10, i1 false)
  %461 = getelementptr inbounds i8, ptr %439, i64 19
  %462 = getelementptr inbounds [3 x i8], ptr %70, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %461, ptr align 1 %462, i64 3, i1 false)
  %463 = getelementptr inbounds i8, ptr %439, i64 22
  %464 = getelementptr inbounds [65 x i8], ptr %43, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %463, ptr align 16 %464, i64 65, i1 false)
  %465 = getelementptr inbounds %struct.Hacl_Impl_HPKE_context_s_s, ptr %1, i32 0, i32 0
  %466 = load ptr, ptr %465, align 8, !tbaa !16
  %467 = getelementptr inbounds [32 x i8], ptr %44, i64 0, i64 0
  %468 = load i32, ptr %71, align 4, !tbaa !9
  call void @Hacl_HKDF_expand_sha2_256(ptr noundef %466, ptr noundef %467, i32 noundef 32, ptr noundef %439, i32 noundef %468, i32 noundef 32)
  call void @llvm.lifetime.start.p0(i64 10, ptr %74) #9
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %74, ptr align 1 @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_base_nonce, i64 10, i1 false)
  call void @llvm.lifetime.start.p0(i64 4, ptr %75) #9
  store i32 94, ptr %75, align 4, !tbaa !9
  br label %469

469:                                              ; preds = %436
  %470 = load i32, ptr %75, align 4, !tbaa !9
  %471 = zext i32 %470 to i64
  %472 = icmp ugt i64 %471, -1
  br i1 %472, label %473, label %475

473:                                              ; preds = %469
  %474 = call i32 (ptr, ...) @printf(ptr noundef @.str, ptr noundef @.str.1, i32 noundef 254)
  call void @exit(i32 noundef 253) #10
  unreachable

475:                                              ; preds = %469
  br label %476

476:                                              ; preds = %475
  br label %477

477:                                              ; preds = %476
  %478 = load i32, ptr %75, align 4, !tbaa !9
  %479 = zext i32 %478 to i64
  %480 = alloca i8, i64 %479, align 16
  store i64 %479, ptr %76, align 8
  %481 = load i32, ptr %75, align 4, !tbaa !9
  %482 = zext i32 %481 to i64
  %483 = mul i64 %482, 1
  call void @llvm.memset.p0.i64(ptr align 16 %480, i8 0, i64 %483, i1 false)
  %484 = call zeroext i16 @__bswap_16(i16 noundef zeroext 12)
  call void @store16(ptr noundef %480, i16 noundef zeroext %484)
  call void @llvm.lifetime.start.p0(i64 8, ptr %77) #9
  %485 = getelementptr inbounds i8, ptr %480, i64 2
  store ptr %485, ptr %77, align 8, !tbaa !5
  %486 = load ptr, ptr %77, align 8, !tbaa !5
  %487 = getelementptr inbounds i8, ptr %486, i64 0
  store i8 72, ptr %487, align 1, !tbaa !11
  %488 = load ptr, ptr %77, align 8, !tbaa !5
  %489 = getelementptr inbounds i8, ptr %488, i64 1
  store i8 80, ptr %489, align 1, !tbaa !11
  %490 = load ptr, ptr %77, align 8, !tbaa !5
  %491 = getelementptr inbounds i8, ptr %490, i64 2
  store i8 75, ptr %491, align 1, !tbaa !11
  %492 = load ptr, ptr %77, align 8, !tbaa !5
  %493 = getelementptr inbounds i8, ptr %492, i64 3
  store i8 69, ptr %493, align 1, !tbaa !11
  %494 = load ptr, ptr %77, align 8, !tbaa !5
  %495 = getelementptr inbounds i8, ptr %494, i64 4
  store i8 45, ptr %495, align 1, !tbaa !11
  %496 = load ptr, ptr %77, align 8, !tbaa !5
  %497 = getelementptr inbounds i8, ptr %496, i64 5
  store i8 118, ptr %497, align 1, !tbaa !11
  %498 = load ptr, ptr %77, align 8, !tbaa !5
  %499 = getelementptr inbounds i8, ptr %498, i64 6
  store i8 49, ptr %499, align 1, !tbaa !11
  %500 = getelementptr inbounds i8, ptr %480, i64 9
  %501 = getelementptr inbounds [10 x i8], ptr %45, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %500, ptr align 1 %501, i64 10, i1 false)
  %502 = getelementptr inbounds i8, ptr %480, i64 19
  %503 = getelementptr inbounds [10 x i8], ptr %74, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %502, ptr align 1 %503, i64 10, i1 false)
  %504 = getelementptr inbounds i8, ptr %480, i64 29
  %505 = getelementptr inbounds [65 x i8], ptr %43, i64 0, i64 0
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %504, ptr align 16 %505, i64 65, i1 false)
  %506 = getelementptr inbounds %struct.Hacl_Impl_HPKE_context_s_s, ptr %1, i32 0, i32 1
  %507 = load ptr, ptr %506, align 8, !tbaa !17
  %508 = getelementptr inbounds [32 x i8], ptr %44, i64 0, i64 0
  %509 = load i32, ptr %75, align 4, !tbaa !9
  call void @Hacl_HKDF_expand_sha2_256(ptr noundef %507, ptr noundef %508, i32 noundef 32, ptr noundef %480, i32 noundef %509, i32 noundef 12)
  %510 = getelementptr inbounds %struct.Hacl_Impl_HPKE_context_s_s, ptr %1, i32 0, i32 2
  %511 = load ptr, ptr %510, align 8, !tbaa !18
  %512 = getelementptr inbounds i64, ptr %511, i64 0
  store i64 0, ptr %512, align 8, !tbaa !19
  %513 = load i32, ptr %16, align 4, !tbaa !9
  store i32 %513, ptr %7, align 4
  store i32 1, ptr %78, align 4
  call void @llvm.lifetime.end.p0(i64 8, ptr %77) #9
  call void @llvm.lifetime.end.p0(i64 4, ptr %75) #9
  call void @llvm.lifetime.end.p0(i64 10, ptr %74) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %73) #9
  call void @llvm.lifetime.end.p0(i64 4, ptr %71) #9
  call void @llvm.lifetime.end.p0(i64 3, ptr %70) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %69) #9
  call void @llvm.lifetime.end.p0(i64 4, ptr %67) #9
  call void @llvm.lifetime.end.p0(i64 3, ptr %66) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %65) #9
  call void @llvm.lifetime.end.p0(i64 4, ptr %63) #9
  call void @llvm.lifetime.end.p0(i64 6, ptr %62) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %61) #9
  call void @llvm.lifetime.end.p0(i64 4, ptr %59) #9
  call void @llvm.lifetime.end.p0(i64 32, ptr %58) #9
  call void @llvm.lifetime.end.p0(i64 9, ptr %57) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %56) #9
  %514 = load ptr, ptr %54, align 8
  call void @llvm.stackrestore.p0(ptr %514)
  call void @llvm.lifetime.end.p0(i64 4, ptr %53) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %52) #9
  call void @llvm.lifetime.end.p0(i64 32, ptr %51) #9
  call void @llvm.lifetime.end.p0(i64 11, ptr %50) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %49) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %48) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %47) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %46) #9
  call void @llvm.lifetime.end.p0(i64 10, ptr %45) #9
  call void @llvm.lifetime.end.p0(i64 32, ptr %44) #9
  call void @llvm.lifetime.end.p0(i64 65, ptr %43) #9
  br label %517

515:                                              ; preds = %228
  %516 = load i32, ptr %16, align 4, !tbaa !9
  store i32 %516, ptr %7, align 4
  store i32 1, ptr %78, align 4
  br label %517

517:                                              ; preds = %515, %477
  call void @llvm.lifetime.end.p0(i64 4, ptr %16) #9
  call void @llvm.lifetime.end.p0(i64 4, ptr %15) #9
  call void @llvm.lifetime.end.p0(i64 8, ptr %14) #9
  call void @llvm.lifetime.end.p0(i64 32, ptr %13) #9
  %518 = load i32, ptr %7, align 4
  ret i32 %518
}

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.start.p0(i64 immarg, ptr nocapture) #1

; Function Attrs: nocallback nofree nounwind willreturn memory(argmem: write)
declare void @llvm.memset.p0.i64(ptr nocapture writeonly, i8, i64, i1 immarg) #2

declare void @Hacl_Curve25519_51_secret_to_public(ptr noundef, ptr noundef) #3

declare void @Hacl_Curve25519_51_scalarmult(ptr noundef, ptr noundef, ptr noundef) #3

; Function Attrs: noinline nounwind uwtable
declare hidden zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext, i8 noundef zeroext) #4

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.end.p0(i64 immarg, ptr nocapture) #1

; Function Attrs: nocallback nofree nounwind willreturn memory(argmem: readwrite)
declare void @llvm.memcpy.p0.p0.i64(ptr noalias nocapture writeonly, ptr noalias nocapture readonly, i64, i1 immarg) #5

declare i32 @printf(ptr noundef, ...) #3

; Function Attrs: noreturn nounwind
declare void @exit(i32 noundef) #6

; Function Attrs: nocallback nofree nosync nounwind willreturn
declare ptr @llvm.stacksave.p0() #7

declare void @Hacl_HKDF_extract_sha2_256(ptr noundef, ptr noundef, i32 noundef, ptr noundef, i32 noundef) #3

; Function Attrs: inlinehint nounwind uwtable
declare hidden void @store16(ptr noundef, i16 noundef zeroext) #8

; Function Attrs: inlinehint nounwind uwtable
declare hidden zeroext i16 @__bswap_16(i16 noundef zeroext) #8

declare void @Hacl_HKDF_expand_sha2_256(ptr noundef, ptr noundef, i32 noundef, ptr noundef, i32 noundef, i32 noundef) #3

; Function Attrs: nocallback nofree nosync nounwind willreturn
declare void @llvm.stackrestore.p0(ptr) #7

attributes #0 = { nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #1 = { nocallback nofree nosync nounwind willreturn memory(argmem: readwrite) }
attributes #2 = { nocallback nofree nounwind willreturn memory(argmem: write) }
attributes #3 = { "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #4 = { noinline nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #5 = { nocallback nofree nounwind willreturn memory(argmem: readwrite) }
attributes #6 = { noreturn nounwind "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #7 = { nocallback nofree nosync nounwind willreturn }
attributes #8 = { inlinehint nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #9 = { nounwind }
attributes #10 = { noreturn nounwind }

!llvm.module.flags = !{!0, !1, !2, !3}
!llvm.ident = !{!4}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{i32 8, !"PIC Level", i32 2}
!2 = !{i32 7, !"PIE Level", i32 2}
!3 = !{i32 7, !"uwtable", i32 2}
!4 = !{!"clang version 19.1.0 (git@github.com:llvm/llvm-project.git a4bf6cd7cfb1a1421ba92bca9d017b49936c55e4)"}
!5 = !{!6, !6, i64 0}
!6 = !{!"any pointer", !7, i64 0}
!7 = !{!"omnipotent char", !8, i64 0}
!8 = !{!"Simple C/C++ TBAA"}
!9 = !{!10, !10, i64 0}
!10 = !{!"int", !7, i64 0}
!11 = !{!7, !7, i64 0}
!12 = distinct !{!12, !13}
!13 = !{!"llvm.loop.mustprogress"}
!14 = !{!15, !6, i64 24}
!15 = !{!"Hacl_Impl_HPKE_context_s_s", !6, i64 0, !6, i64 8, !6, i64 16, !6, i64 24}
!16 = !{!15, !6, i64 0}
!17 = !{!15, !6, i64 8}
!18 = !{!15, !6, i64 16}
!19 = !{!20, !20, i64 0}
!20 = !{!"long", !7, i64 0}


; Optimized IR (opt -passes='default<O3>'):
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

%struct.Hacl_Impl_HPKE_context_s_s = type { ptr, ptr, ptr, ptr }

@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_eae_prk = external hidden unnamed_addr constant [7 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_shared_secret = external hidden unnamed_addr constant [13 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_psk_id_hash = external hidden unnamed_addr constant [11 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_info_hash = external hidden unnamed_addr constant [9 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_secret = external hidden unnamed_addr constant [6 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_exp = external hidden unnamed_addr constant [3 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_key = external hidden unnamed_addr constant [3 x i8], align 1
@__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_base_nonce = external hidden unnamed_addr constant [10 x i8], align 1

; Function Attrs: nounwind uwtable
define dso_local range(i32 0, 2) i32 @Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS(ptr noundef %0, ptr nocapture noundef readonly byval(%struct.Hacl_Impl_HPKE_context_s_s) align 8 %1, ptr noundef %2, ptr noundef %3, i32 noundef %4, ptr nocapture noundef readonly %5) local_unnamed_addr #0 {
  %7 = alloca [32 x i8], align 16
  %8 = alloca [32 x i8], align 16
  %9 = alloca [64 x i8], align 16
  %10 = alloca [32 x i8], align 16
  %11 = alloca [5 x i8], align 4
  %.sroa.7 = alloca [32 x i8], align 1
  %.sroa.8 = alloca [32 x i8], align 1
  %12 = alloca [32 x i8], align 16
  %13 = alloca [10 x i8], align 8
  %14 = alloca [32 x i8], align 16
  %15 = alloca [32 x i8], align 16
  call void @llvm.lifetime.start.p0(i64 32, ptr nonnull %7) #8
  call void @llvm.memset.p0.i64(ptr noundef nonnull align 16 dereferenceable(32) %7, i8 0, i64 32, i1 false)
  tail call void @Hacl_Curve25519_51_secret_to_public(ptr noundef %0, ptr noundef %2) #8
  call void @llvm.lifetime.start.p0(i64 32, ptr nonnull %8) #8
  call void @llvm.memset.p0.i64(ptr noundef nonnull align 16 dereferenceable(32) %8, i8 0, i64 32, i1 false)
  call void @Hacl_Curve25519_51_scalarmult(ptr noundef nonnull %8, ptr noundef %2, ptr noundef %3) #8
  %16 = load i8, ptr %8, align 16, !tbaa !5
  %17 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %16, i8 noundef zeroext 0)
  %18 = getelementptr inbounds i8, ptr %8, i64 1
  %19 = load i8, ptr %18, align 1, !tbaa !5
  %20 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %19, i8 noundef zeroext 0)
  %21 = and i8 %20, %17
  %22 = getelementptr inbounds i8, ptr %8, i64 2
  %23 = load i8, ptr %22, align 2, !tbaa !5
  %24 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %23, i8 noundef zeroext 0)
  %25 = and i8 %24, %21
  %26 = getelementptr inbounds i8, ptr %8, i64 3
  %27 = load i8, ptr %26, align 1, !tbaa !5
  %28 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %27, i8 noundef zeroext 0)
  %29 = and i8 %28, %25
  %30 = getelementptr inbounds i8, ptr %8, i64 4
  %31 = load i8, ptr %30, align 4, !tbaa !5
  %32 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %31, i8 noundef zeroext 0)
  %33 = and i8 %32, %29
  %34 = getelementptr inbounds i8, ptr %8, i64 5
  %35 = load i8, ptr %34, align 1, !tbaa !5
  %36 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %35, i8 noundef zeroext 0)
  %37 = and i8 %36, %33
  %38 = getelementptr inbounds i8, ptr %8, i64 6
  %39 = load i8, ptr %38, align 2, !tbaa !5
  %40 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %39, i8 noundef zeroext 0)
  %41 = and i8 %40, %37
  %42 = getelementptr inbounds i8, ptr %8, i64 7
  %43 = load i8, ptr %42, align 1, !tbaa !5
  %44 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %43, i8 noundef zeroext 0)
  %45 = and i8 %44, %41
  %46 = getelementptr inbounds i8, ptr %8, i64 8
  %47 = load i8, ptr %46, align 8, !tbaa !5
  %48 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %47, i8 noundef zeroext 0)
  %49 = and i8 %48, %45
  %50 = getelementptr inbounds i8, ptr %8, i64 9
  %51 = load i8, ptr %50, align 1, !tbaa !5
  %52 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %51, i8 noundef zeroext 0)
  %53 = and i8 %52, %49
  %54 = getelementptr inbounds i8, ptr %8, i64 10
  %55 = load i8, ptr %54, align 2, !tbaa !5
  %56 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %55, i8 noundef zeroext 0)
  %57 = and i8 %56, %53
  %58 = getelementptr inbounds i8, ptr %8, i64 11
  %59 = load i8, ptr %58, align 1, !tbaa !5
  %60 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %59, i8 noundef zeroext 0)
  %61 = and i8 %60, %57
  %62 = getelementptr inbounds i8, ptr %8, i64 12
  %63 = load i8, ptr %62, align 4, !tbaa !5
  %64 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %63, i8 noundef zeroext 0)
  %65 = and i8 %64, %61
  %66 = getelementptr inbounds i8, ptr %8, i64 13
  %67 = load i8, ptr %66, align 1, !tbaa !5
  %68 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %67, i8 noundef zeroext 0)
  %69 = and i8 %68, %65
  %70 = getelementptr inbounds i8, ptr %8, i64 14
  %71 = load i8, ptr %70, align 2, !tbaa !5
  %72 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %71, i8 noundef zeroext 0)
  %73 = and i8 %72, %69
  %74 = getelementptr inbounds i8, ptr %8, i64 15
  %75 = load i8, ptr %74, align 1, !tbaa !5
  %76 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %75, i8 noundef zeroext 0)
  %77 = and i8 %76, %73
  %78 = getelementptr inbounds i8, ptr %8, i64 16
  %79 = load i8, ptr %78, align 16, !tbaa !5
  %80 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %79, i8 noundef zeroext 0)
  %81 = and i8 %80, %77
  %82 = getelementptr inbounds i8, ptr %8, i64 17
  %83 = load i8, ptr %82, align 1, !tbaa !5
  %84 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %83, i8 noundef zeroext 0)
  %85 = and i8 %84, %81
  %86 = getelementptr inbounds i8, ptr %8, i64 18
  %87 = load i8, ptr %86, align 2, !tbaa !5
  %88 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %87, i8 noundef zeroext 0)
  %89 = and i8 %88, %85
  %90 = getelementptr inbounds i8, ptr %8, i64 19
  %91 = load i8, ptr %90, align 1, !tbaa !5
  %92 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %91, i8 noundef zeroext 0)
  %93 = and i8 %92, %89
  %94 = getelementptr inbounds i8, ptr %8, i64 20
  %95 = load i8, ptr %94, align 4, !tbaa !5
  %96 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %95, i8 noundef zeroext 0)
  %97 = and i8 %96, %93
  %98 = getelementptr inbounds i8, ptr %8, i64 21
  %99 = load i8, ptr %98, align 1, !tbaa !5
  %100 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %99, i8 noundef zeroext 0)
  %101 = and i8 %100, %97
  %102 = getelementptr inbounds i8, ptr %8, i64 22
  %103 = load i8, ptr %102, align 2, !tbaa !5
  %104 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %103, i8 noundef zeroext 0)
  %105 = and i8 %104, %101
  %106 = getelementptr inbounds i8, ptr %8, i64 23
  %107 = load i8, ptr %106, align 1, !tbaa !5
  %108 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %107, i8 noundef zeroext 0)
  %109 = and i8 %108, %105
  %110 = getelementptr inbounds i8, ptr %8, i64 24
  %111 = load i8, ptr %110, align 8, !tbaa !5
  %112 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %111, i8 noundef zeroext 0)
  %113 = and i8 %112, %109
  %114 = getelementptr inbounds i8, ptr %8, i64 25
  %115 = load i8, ptr %114, align 1, !tbaa !5
  %116 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %115, i8 noundef zeroext 0)
  %117 = and i8 %116, %113
  %118 = getelementptr inbounds i8, ptr %8, i64 26
  %119 = load i8, ptr %118, align 2, !tbaa !5
  %120 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %119, i8 noundef zeroext 0)
  %121 = and i8 %120, %117
  %122 = getelementptr inbounds i8, ptr %8, i64 27
  %123 = load i8, ptr %122, align 1, !tbaa !5
  %124 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %123, i8 noundef zeroext 0)
  %125 = and i8 %124, %121
  %126 = getelementptr inbounds i8, ptr %8, i64 28
  %127 = load i8, ptr %126, align 4, !tbaa !5
  %128 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %127, i8 noundef zeroext 0)
  %129 = and i8 %128, %125
  %130 = getelementptr inbounds i8, ptr %8, i64 29
  %131 = load i8, ptr %130, align 1, !tbaa !5
  %132 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %131, i8 noundef zeroext 0)
  %133 = and i8 %132, %129
  %134 = getelementptr inbounds i8, ptr %8, i64 30
  %135 = load i8, ptr %134, align 2, !tbaa !5
  %136 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %135, i8 noundef zeroext 0)
  %137 = and i8 %136, %133
  %138 = getelementptr inbounds i8, ptr %8, i64 31
  %139 = load i8, ptr %138, align 1, !tbaa !5
  %140 = call zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext %139, i8 noundef zeroext 0)
  %141 = and i8 %140, %137
  %.not.not = icmp eq i8 %141, -1
  call void @llvm.lifetime.start.p0(i64 64, ptr nonnull %9)
  br i1 %.not.not, label %.thread, label %142

.thread:                                          ; preds = %6
  call void @llvm.lifetime.end.p0(i64 64, ptr nonnull %9)
  call void @llvm.lifetime.end.p0(i64 32, ptr nonnull %8) #8
  br label %221

142:                                              ; preds = %6
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 16 dereferenceable(32) %9, ptr noundef nonnull align 1 dereferenceable(32) %0, i64 32, i1 false)
  %143 = getelementptr inbounds i8, ptr %9, i64 32
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 16 dereferenceable(32) %143, ptr noundef nonnull align 1 dereferenceable(32) %3, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 32, ptr nonnull %10) #8
  call void @llvm.memset.p0.i64(ptr noundef nonnull align 16 dereferenceable(32) %10, i8 0, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 5, ptr nonnull %11) #8
  store <4 x i8> <i8 75, i8 69, i8 77, i8 0>, ptr %11, align 4, !tbaa !5
  %144 = getelementptr inbounds i8, ptr %11, i64 4
  store i8 32, ptr %144, align 4, !tbaa !5
  %145 = call ptr @llvm.stacksave.p0()
  %146 = alloca [51 x i8], align 16
  store <4 x i8> <i8 72, i8 80, i8 75, i8 69>, ptr %146, align 16, !tbaa !5
  %147 = getelementptr inbounds i8, ptr %146, i64 4
  store i8 45, ptr %147, align 4, !tbaa !5
  %148 = getelementptr inbounds i8, ptr %146, i64 5
  store i8 118, ptr %148, align 1, !tbaa !5
  %149 = getelementptr inbounds i8, ptr %146, i64 6
  store i8 49, ptr %149, align 2, !tbaa !5
  %150 = getelementptr inbounds i8, ptr %146, i64 7
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(5) %150, ptr noundef nonnull align 4 dereferenceable(5) %11, i64 5, i1 false)
  %151 = getelementptr inbounds i8, ptr %146, i64 12
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 4 dereferenceable(7) %151, ptr noundef nonnull align 1 dereferenceable(7) @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_eae_prk, i64 7, i1 false)
  %152 = getelementptr inbounds i8, ptr %146, i64 19
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(32) %152, ptr noundef nonnull align 16 dereferenceable(32) %8, i64 32, i1 false)
  call void @Hacl_HKDF_extract_sha2_256(ptr noundef nonnull %10, ptr noundef nonnull %11, i32 noundef 0, ptr noundef nonnull %146, i32 noundef 51) #8
  %153 = alloca [91 x i8], align 16
  call void @llvm.memset.p0.i64(ptr noundef nonnull align 16 dereferenceable(91) %153, i8 0, i64 91, i1 false)
  %154 = call zeroext i16 @__bswap_16(i16 noundef zeroext 32)
  call void @store16(ptr noundef nonnull %153, i16 noundef zeroext %154)
  %155 = getelementptr inbounds i8, ptr %153, i64 2
  store <4 x i8> <i8 72, i8 80, i8 75, i8 69>, ptr %155, align 2, !tbaa !5
  %156 = getelementptr inbounds i8, ptr %153, i64 6
  store i8 45, ptr %156, align 2, !tbaa !5
  %157 = getelementptr inbounds i8, ptr %153, i64 7
  store i8 118, ptr %157, align 1, !tbaa !5
  %158 = getelementptr inbounds i8, ptr %153, i64 8
  store i8 49, ptr %158, align 8, !tbaa !5
  %159 = getelementptr inbounds i8, ptr %153, i64 9
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(5) %159, ptr noundef nonnull align 4 dereferenceable(5) %11, i64 5, i1 false)
  %160 = getelementptr inbounds i8, ptr %153, i64 14
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 2 dereferenceable(13) %160, ptr noundef nonnull align 1 dereferenceable(13) @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_shared_secret, i64 13, i1 false)
  %161 = getelementptr inbounds i8, ptr %153, i64 27
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(64) %161, ptr noundef nonnull align 16 dereferenceable(64) %9, i64 64, i1 false)
  call void @Hacl_HKDF_expand_sha2_256(ptr noundef nonnull %7, ptr noundef nonnull %10, i32 noundef 32, ptr noundef nonnull %153, i32 noundef 91, i32 noundef 32) #8
  call void @llvm.stackrestore.p0(ptr %145)
  call void @llvm.lifetime.end.p0(i64 5, ptr nonnull %11) #8
  call void @llvm.lifetime.end.p0(i64 32, ptr nonnull %10) #8
  call void @llvm.lifetime.end.p0(i64 64, ptr nonnull %9)
  call void @llvm.lifetime.end.p0(i64 32, ptr nonnull %8) #8
  call void @llvm.lifetime.start.p0(i64 32, ptr nonnull %.sroa.7)
  call void @llvm.lifetime.start.p0(i64 32, ptr nonnull %.sroa.8)
  call void @llvm.lifetime.start.p0(i64 32, ptr nonnull %12) #8
  call void @llvm.memset.p0.i64(ptr noundef nonnull align 16 dereferenceable(32) %12, i8 0, i64 32, i1 false)
  call void @llvm.lifetime.start.p0(i64 10, ptr nonnull %13) #8
  store <8 x i8> <i8 72, i8 80, i8 75, i8 69, i8 0, i8 32, i8 0, i8 1>, ptr %13, align 8, !tbaa !5
  %162 = getelementptr inbounds i8, ptr %13, i64 8
  store i8 0, ptr %162, align 8, !tbaa !5
  %163 = getelementptr inbounds i8, ptr %13, i64 9
  store i8 3, ptr %163, align 1, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 32, ptr nonnull %14) #8
  call void @llvm.memset.p0.i64(ptr noundef nonnull align 16 dereferenceable(32) %14, i8 0, i64 32, i1 false)
  %164 = call ptr @llvm.stacksave.p0()
  %165 = alloca [28 x i8], align 16
  store <4 x i8> <i8 72, i8 80, i8 75, i8 69>, ptr %165, align 16, !tbaa !5
  %166 = getelementptr inbounds i8, ptr %165, i64 4
  store i8 45, ptr %166, align 4, !tbaa !5
  %167 = getelementptr inbounds i8, ptr %165, i64 5
  store i8 118, ptr %167, align 1, !tbaa !5
  %168 = getelementptr inbounds i8, ptr %165, i64 6
  store i8 49, ptr %168, align 2, !tbaa !5
  %169 = getelementptr inbounds i8, ptr %165, i64 7
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(10) %169, ptr noundef nonnull align 8 dereferenceable(10) %13, i64 10, i1 false)
  %170 = getelementptr inbounds i8, ptr %165, i64 17
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(11) %170, ptr noundef nonnull align 1 dereferenceable(11) @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_psk_id_hash, i64 11, i1 false)
  call void @Hacl_HKDF_extract_sha2_256(ptr noundef nonnull %14, ptr noundef nonnull %13, i32 noundef 0, ptr noundef nonnull %165, i32 noundef 28) #8
  call void @llvm.lifetime.start.p0(i64 32, ptr nonnull %15) #8
  call void @llvm.memset.p0.i64(ptr noundef nonnull align 16 dereferenceable(32) %15, i8 0, i64 32, i1 false)
  %171 = add i32 %4, 26
  %172 = zext i32 %171 to i64
  %173 = alloca i8, i64 %172, align 16
  call void @llvm.memset.p0.i64(ptr nonnull align 16 %173, i8 0, i64 %172, i1 false)
  store <4 x i8> <i8 72, i8 80, i8 75, i8 69>, ptr %173, align 16, !tbaa !5
  %174 = getelementptr inbounds i8, ptr %173, i64 4
  store i8 45, ptr %174, align 4, !tbaa !5
  %175 = getelementptr inbounds i8, ptr %173, i64 5
  store i8 118, ptr %175, align 1, !tbaa !5
  %176 = getelementptr inbounds i8, ptr %173, i64 6
  store i8 49, ptr %176, align 2, !tbaa !5
  %177 = getelementptr inbounds i8, ptr %173, i64 7
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(10) %177, ptr noundef nonnull align 8 dereferenceable(10) %13, i64 10, i1 false)
  %178 = getelementptr inbounds i8, ptr %173, i64 17
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(9) %178, ptr noundef nonnull align 1 dereferenceable(9) @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_info_hash, i64 9, i1 false)
  %179 = getelementptr inbounds i8, ptr %173, i64 26
  %180 = zext i32 %4 to i64
  call void @llvm.memcpy.p0.p0.i64(ptr nonnull align 2 %179, ptr align 1 %5, i64 %180, i1 false)
  call void @Hacl_HKDF_extract_sha2_256(ptr noundef nonnull %15, ptr noundef nonnull %13, i32 noundef 0, ptr noundef nonnull %173, i32 noundef %171) #8
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(32) %.sroa.7, ptr noundef nonnull align 16 dereferenceable(32) %14, i64 32, i1 false)
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(32) %.sroa.8, ptr noundef nonnull align 16 dereferenceable(32) %15, i64 32, i1 false)
  %181 = alloca [23 x i8], align 16
  store <4 x i8> <i8 72, i8 80, i8 75, i8 69>, ptr %181, align 16, !tbaa !5
  %182 = getelementptr inbounds i8, ptr %181, i64 4
  store i8 45, ptr %182, align 4, !tbaa !5
  %183 = getelementptr inbounds i8, ptr %181, i64 5
  store i8 118, ptr %183, align 1, !tbaa !5
  %184 = getelementptr inbounds i8, ptr %181, i64 6
  store i8 49, ptr %184, align 2, !tbaa !5
  %185 = getelementptr inbounds i8, ptr %181, i64 7
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(10) %185, ptr noundef nonnull align 8 dereferenceable(10) %13, i64 10, i1 false)
  %186 = getelementptr inbounds i8, ptr %181, i64 17
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(6) %186, ptr noundef nonnull align 1 dereferenceable(6) @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_secret, i64 6, i1 false)
  call void @Hacl_HKDF_extract_sha2_256(ptr noundef nonnull %12, ptr noundef nonnull %7, i32 noundef 32, ptr noundef nonnull %181, i32 noundef 23) #8
  %187 = alloca [87 x i8], align 16
  call void @llvm.memset.p0.i64(ptr noundef nonnull align 16 dereferenceable(87) %187, i8 0, i64 87, i1 false)
  %188 = call zeroext i16 @__bswap_16(i16 noundef zeroext 32)
  call void @store16(ptr noundef nonnull %187, i16 noundef zeroext %188)
  %189 = getelementptr inbounds i8, ptr %187, i64 2
  store <4 x i8> <i8 72, i8 80, i8 75, i8 69>, ptr %189, align 2, !tbaa !5
  %190 = getelementptr inbounds i8, ptr %187, i64 6
  store i8 45, ptr %190, align 2, !tbaa !5
  %191 = getelementptr inbounds i8, ptr %187, i64 7
  store i8 118, ptr %191, align 1, !tbaa !5
  %192 = getelementptr inbounds i8, ptr %187, i64 8
  store i8 49, ptr %192, align 8, !tbaa !5
  %193 = getelementptr inbounds i8, ptr %187, i64 9
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(10) %193, ptr noundef nonnull align 8 dereferenceable(10) %13, i64 10, i1 false)
  %194 = getelementptr inbounds i8, ptr %187, i64 19
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(3) %194, ptr noundef nonnull align 1 dereferenceable(3) @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_exp, i64 3, i1 false)
  %195 = getelementptr inbounds i8, ptr %187, i64 22
  store i8 0, ptr %195, align 2
  %.sroa.7.0..sroa_idx = getelementptr inbounds i8, ptr %187, i64 23
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(32) %.sroa.7.0..sroa_idx, ptr noundef nonnull align 1 dereferenceable(32) %.sroa.7, i64 32, i1 false)
  %.sroa.8.0..sroa_idx = getelementptr inbounds i8, ptr %187, i64 55
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(32) %.sroa.8.0..sroa_idx, ptr noundef nonnull align 1 dereferenceable(32) %.sroa.8, i64 32, i1 false)
  %196 = getelementptr inbounds i8, ptr %1, i64 24
  %197 = load ptr, ptr %196, align 8, !tbaa !8
  call void @Hacl_HKDF_expand_sha2_256(ptr noundef %197, ptr noundef nonnull %12, i32 noundef 32, ptr noundef nonnull %187, i32 noundef 87, i32 noundef 32) #8
  %198 = alloca [87 x i8], align 16
  call void @llvm.memset.p0.i64(ptr noundef nonnull align 16 dereferenceable(87) %198, i8 0, i64 87, i1 false)
  %199 = call zeroext i16 @__bswap_16(i16 noundef zeroext 32)
  call void @store16(ptr noundef nonnull %198, i16 noundef zeroext %199)
  %200 = getelementptr inbounds i8, ptr %198, i64 2
  store <4 x i8> <i8 72, i8 80, i8 75, i8 69>, ptr %200, align 2, !tbaa !5
  %201 = getelementptr inbounds i8, ptr %198, i64 6
  store i8 45, ptr %201, align 2, !tbaa !5
  %202 = getelementptr inbounds i8, ptr %198, i64 7
  store i8 118, ptr %202, align 1, !tbaa !5
  %203 = getelementptr inbounds i8, ptr %198, i64 8
  store i8 49, ptr %203, align 8, !tbaa !5
  %204 = getelementptr inbounds i8, ptr %198, i64 9
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(10) %204, ptr noundef nonnull align 8 dereferenceable(10) %13, i64 10, i1 false)
  %205 = getelementptr inbounds i8, ptr %198, i64 19
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(3) %205, ptr noundef nonnull align 1 dereferenceable(3) @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_key, i64 3, i1 false)
  %206 = getelementptr inbounds i8, ptr %198, i64 22
  store i8 0, ptr %206, align 2
  %.sroa.7.0..sroa_idx82 = getelementptr inbounds i8, ptr %198, i64 23
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(32) %.sroa.7.0..sroa_idx82, ptr noundef nonnull align 1 dereferenceable(32) %.sroa.7, i64 32, i1 false)
  %.sroa.8.0..sroa_idx84 = getelementptr inbounds i8, ptr %198, i64 55
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(32) %.sroa.8.0..sroa_idx84, ptr noundef nonnull align 1 dereferenceable(32) %.sroa.8, i64 32, i1 false)
  %207 = load ptr, ptr %1, align 8, !tbaa !11
  call void @Hacl_HKDF_expand_sha2_256(ptr noundef %207, ptr noundef nonnull %12, i32 noundef 32, ptr noundef nonnull %198, i32 noundef 87, i32 noundef 32) #8
  %208 = alloca [94 x i8], align 16
  call void @llvm.memset.p0.i64(ptr noundef nonnull align 16 dereferenceable(94) %208, i8 0, i64 94, i1 false)
  %209 = call zeroext i16 @__bswap_16(i16 noundef zeroext 12)
  call void @store16(ptr noundef nonnull %208, i16 noundef zeroext %209)
  %210 = getelementptr inbounds i8, ptr %208, i64 2
  store <4 x i8> <i8 72, i8 80, i8 75, i8 69>, ptr %210, align 2, !tbaa !5
  %211 = getelementptr inbounds i8, ptr %208, i64 6
  store i8 45, ptr %211, align 2, !tbaa !5
  %212 = getelementptr inbounds i8, ptr %208, i64 7
  store i8 118, ptr %212, align 1, !tbaa !5
  %213 = getelementptr inbounds i8, ptr %208, i64 8
  store i8 49, ptr %213, align 8, !tbaa !5
  %214 = getelementptr inbounds i8, ptr %208, i64 9
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(10) %214, ptr noundef nonnull align 8 dereferenceable(10) %13, i64 10, i1 false)
  %215 = getelementptr inbounds i8, ptr %208, i64 19
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 1 dereferenceable(10) %215, ptr noundef nonnull align 1 dereferenceable(10) @__const.Hacl_HPKE_Curve51_CP128_SHA256_setupBaseS.label_base_nonce, i64 10, i1 false)
  %216 = getelementptr inbounds i8, ptr %208, i64 29
  store i8 0, ptr %216, align 1
  %.sroa.7.0..sroa_idx83 = getelementptr inbounds i8, ptr %208, i64 30
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 2 dereferenceable(32) %.sroa.7.0..sroa_idx83, ptr noundef nonnull align 1 dereferenceable(32) %.sroa.7, i64 32, i1 false)
  %.sroa.8.0..sroa_idx85 = getelementptr inbounds i8, ptr %208, i64 62
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 2 dereferenceable(32) %.sroa.8.0..sroa_idx85, ptr noundef nonnull align 1 dereferenceable(32) %.sroa.8, i64 32, i1 false)
  %217 = getelementptr inbounds i8, ptr %1, i64 8
  %218 = load ptr, ptr %217, align 8, !tbaa !12
  call void @Hacl_HKDF_expand_sha2_256(ptr noundef %218, ptr noundef nonnull %12, i32 noundef 32, ptr noundef nonnull %208, i32 noundef 94, i32 noundef 12) #8
  %219 = getelementptr inbounds i8, ptr %1, i64 16
  %220 = load ptr, ptr %219, align 8, !tbaa !13
  store i64 0, ptr %220, align 8, !tbaa !14
  call void @llvm.lifetime.end.p0(i64 32, ptr nonnull %15) #8
  call void @llvm.stackrestore.p0(ptr %164)
  call void @llvm.lifetime.end.p0(i64 32, ptr nonnull %14) #8
  call void @llvm.lifetime.end.p0(i64 10, ptr nonnull %13) #8
  call void @llvm.lifetime.end.p0(i64 32, ptr nonnull %12) #8
  call void @llvm.lifetime.end.p0(i64 32, ptr nonnull %.sroa.7)
  call void @llvm.lifetime.end.p0(i64 32, ptr nonnull %.sroa.8)
  br label %221

221:                                              ; preds = %.thread, %142
  %.0145150 = phi i32 [ 1, %.thread ], [ 0, %142 ]
  call void @llvm.lifetime.end.p0(i64 32, ptr nonnull %7) #8
  ret i32 %.0145150
}

; Function Attrs: mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.start.p0(i64 immarg, ptr nocapture) #1

; Function Attrs: mustprogress nocallback nofree nounwind willreturn memory(argmem: write)
declare void @llvm.memset.p0.i64(ptr nocapture writeonly, i8, i64, i1 immarg) #2

declare void @Hacl_Curve25519_51_secret_to_public(ptr noundef, ptr noundef) local_unnamed_addr #3

declare void @Hacl_Curve25519_51_scalarmult(ptr noundef, ptr noundef, ptr noundef) local_unnamed_addr #3

; Function Attrs: noinline nounwind uwtable
declare hidden zeroext i8 @FStar_UInt8_eq_mask(i8 noundef zeroext, i8 noundef zeroext) local_unnamed_addr #4

; Function Attrs: mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.end.p0(i64 immarg, ptr nocapture) #1

; Function Attrs: mustprogress nocallback nofree nounwind willreturn memory(argmem: readwrite)
declare void @llvm.memcpy.p0.p0.i64(ptr noalias nocapture writeonly, ptr noalias nocapture readonly, i64, i1 immarg) #5

; Function Attrs: mustprogress nocallback nofree nosync nounwind willreturn
declare ptr @llvm.stacksave.p0() #6

declare void @Hacl_HKDF_extract_sha2_256(ptr noundef, ptr noundef, i32 noundef, ptr noundef, i32 noundef) local_unnamed_addr #3

; Function Attrs: inlinehint nounwind uwtable
declare hidden void @store16(ptr noundef, i16 noundef zeroext) local_unnamed_addr #7

; Function Attrs: inlinehint nounwind uwtable
declare hidden zeroext i16 @__bswap_16(i16 noundef zeroext) local_unnamed_addr #7

declare void @Hacl_HKDF_expand_sha2_256(ptr noundef, ptr noundef, i32 noundef, ptr noundef, i32 noundef, i32 noundef) local_unnamed_addr #3

; Function Attrs: mustprogress nocallback nofree nosync nounwind willreturn
declare void @llvm.stackrestore.p0(ptr) #6

attributes #0 = { nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #1 = { mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite) }
attributes #2 = { mustprogress nocallback nofree nounwind willreturn memory(argmem: write) }
attributes #3 = { "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #4 = { noinline nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #5 = { mustprogress nocallback nofree nounwind willreturn memory(argmem: readwrite) }
attributes #6 = { mustprogress nocallback nofree nosync nounwind willreturn }
attributes #7 = { inlinehint nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #8 = { nounwind }

!llvm.module.flags = !{!0, !1, !2, !3}
!llvm.ident = !{!4}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{i32 8, !"PIC Level", i32 2}
!2 = !{i32 7, !"PIE Level", i32 2}
!3 = !{i32 7, !"uwtable", i32 2}
!4 = !{!"clang version 19.1.0 (git@github.com:llvm/llvm-project.git a4bf6cd7cfb1a1421ba92bca9d017b49936c55e4)"}
!5 = !{!6, !6, i64 0}
!6 = !{!"omnipotent char", !7, i64 0}
!7 = !{!"Simple C/C++ TBAA"}
!8 = !{!9, !10, i64 24}
!9 = !{!"Hacl_Impl_HPKE_context_s_s", !10, i64 0, !10, i64 8, !10, i64 16, !10, i64 24}
!10 = !{!"any pointer", !6, i64 0}
!11 = !{!9, !10, i64 0}
!12 = !{!9, !10, i64 8}
!13 = !{!9, !10, i64 16}
!14 = !{!15, !15, i64 0}
!15 = !{!"long", !6, i64 0}


; Effective O3 passes: CorrelatedValuePropagationPass,DSEPass,EarlyCSEPass,GVNPass,GlobalOptPass,IPSCCPPass,IndVarSimplifyPass,InferAlignmentPass,InferFunctionAttrsPass,InstCombinePass,JumpThreadingPass,LCSSAPass,LoopRotatePass,MemCpyOptPass,PostOrderFunctionAttrsPass,SLPVectorizerPass,SROAPass,SimplifyCFGPass,TailCallElimPass