; LLVM IR from sca-secure-library-sca25519/sca25519 :: cw/sca25519_cw_st/crypto/scalarmult (scalarmult_25519)

; Unoptimized IR (clang -disable-llvm-passes):
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

%struct._ST_curve25519ladderstepWorkingState = type { %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, i32, i8 }
%union.UN_256bitValue_ = type { [4 x %union.UN_64bitValue_] }
%union.UN_64bitValue_ = type { [1 x i64] }
%struct.point25519 = type { ptr, ptr, ptr }
%union.UN_512bitValue_ = type { [8 x i64] }

@Rx = external hidden global { [32 x i8] }, align 8
@Ry = external hidden global { [32 x i8] }, align 8
@Rz = external hidden global { <{ i8, [31 x i8] }> }, align 8
@Sx = external hidden global { [32 x i8] }, align 8
@Sy = external hidden global { [32 x i8] }, align 8
@Sz = external hidden global { <{ i8, [31 x i8] }> }, align 8
@static_key = external hidden global { [32 x i8] }, align 8
@blindingFactor = external hidden global { <{ [8 x i8], [24 x i8] }> }, align 8

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.start.p0(i64 immarg, ptr nocapture) #0

; Function Attrs: nounwind uwtable
declare dso_local void @update_static_key_curve25519() #1

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.end.p0(i64 immarg, ptr nocapture) #0

declare void @fe25519_cpy(ptr noundef, ptr noundef) #2

declare void @randombytes(ptr noundef, i64 noundef) #2

; Function Attrs: nounwind uwtable
declare hidden void @curve25519_doublePoint(ptr noundef, ptr noundef) #1

; Function Attrs: nounwind uwtable
declare hidden void @curve25519_addPoint(ptr noundef, ptr noundef, ptr noundef) #1

declare void @fe25519_setzero(ptr noundef) #2

declare void @fe25519_reduceTo256Bits_asm(ptr noundef, ptr noundef) #2

declare void @sc25519_mul(ptr noundef, ptr noundef, ptr noundef) #2

declare void @sc25519_inverse(ptr noundef, ptr noundef) #2

declare void @cpy_256bitvalue(ptr noundef, ptr noundef) #2

; Function Attrs: nounwind uwtable
define dso_local i32 @crypto_scalarmult_curve25519(ptr noundef %0, ptr noundef %1) #1 {
  %3 = alloca ptr, align 8
  %4 = alloca ptr, align 8
  %5 = alloca %struct._ST_curve25519ladderstepWorkingState, align 8
  %6 = alloca i8, align 1
  %7 = alloca i32, align 4
  %8 = alloca i32, align 4
  %9 = alloca %union.UN_256bitValue_, align 8
  %10 = alloca %union.UN_256bitValue_, align 8
  %11 = alloca %struct.point25519, align 8
  %12 = alloca %struct.point25519, align 8
  %13 = alloca %union.UN_512bitValue_, align 8
  %14 = alloca %union.UN_256bitValue_, align 8
  %15 = alloca %union.UN_256bitValue_, align 8
  %16 = alloca %union.UN_256bitValue_, align 8
  %17 = alloca i32, align 4
  %18 = alloca i32, align 4
  %19 = alloca i32, align 4
  %20 = alloca %union.UN_256bitValue_, align 8
  %21 = alloca %union.UN_256bitValue_, align 8
  %22 = alloca i32, align 4
  %23 = alloca i8, align 1
  %24 = alloca i8, align 1
  %25 = alloca i32, align 4
  %26 = alloca %union.UN_256bitValue_, align 8
  %27 = alloca %union.UN_256bitValue_, align 8
  %28 = alloca i32, align 4
  %29 = alloca i8, align 1
  %30 = alloca i8, align 1
  %31 = alloca %struct.point25519, align 8
  %32 = alloca %union.UN_256bitValue_, align 8
  store ptr %0, ptr %3, align 8, !tbaa !5
  store ptr %1, ptr %4, align 8, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 232, ptr %5) #3
  call void @llvm.lifetime.start.p0(i64 1, ptr %6) #3
  call void @llvm.lifetime.start.p0(i64 4, ptr %7) #3
  store volatile i32 -1, ptr %7, align 4, !tbaa !9
  call void @llvm.lifetime.start.p0(i64 4, ptr %8) #3
  store volatile i32 0, ptr %8, align 4, !tbaa !9
  %33 = load ptr, ptr %3, align 8, !tbaa !5
  call void @randombytes(ptr noundef %33, i64 noundef 32)
  store i8 0, ptr %6, align 1, !tbaa !11
  br label %34

34:                                               ; preds = %49, %2
  %35 = load i8, ptr %6, align 1, !tbaa !11
  %36 = zext i8 %35 to i32
  %37 = icmp slt i32 %36, 32
  br i1 %37, label %38, label %52

38:                                               ; preds = %34
  %39 = load i8, ptr %6, align 1, !tbaa !11
  %40 = zext i8 %39 to i64
  %41 = getelementptr inbounds [32 x i8], ptr @static_key, i64 0, i64 %40
  %42 = load i8, ptr %41, align 1, !tbaa !11
  %43 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 6
  %44 = load i8, ptr %6, align 1, !tbaa !11
  %45 = zext i8 %44 to i64
  %46 = getelementptr inbounds [32 x i8], ptr %43, i64 0, i64 %45
  store i8 %42, ptr %46, align 1, !tbaa !11
  %47 = load volatile i32, ptr %8, align 4, !tbaa !9
  %48 = add i32 %47, 9
  store volatile i32 %48, ptr %8, align 4, !tbaa !9
  br label %49

49:                                               ; preds = %38
  %50 = load i8, ptr %6, align 1, !tbaa !11
  %51 = add i8 %50, 1
  store i8 %51, ptr %6, align 1, !tbaa !11
  br label %34, !llvm.loop !12

52:                                               ; preds = %34
  %53 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 0
  %54 = load ptr, ptr %4, align 8, !tbaa !5
  call void @fe25519_unpack(ptr noundef %53, ptr noundef %54)
  %55 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 3
  call void @fe25519_setone(ptr noundef %55)
  %56 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 4
  call void @fe25519_setzero(ptr noundef %56)
  %57 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 1
  %58 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 0
  call void @fe25519_cpy(ptr noundef %57, ptr noundef %58)
  %59 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 2
  call void @fe25519_setone(ptr noundef %59)
  %60 = load volatile i32, ptr %8, align 4, !tbaa !9
  %61 = add i32 %60, 9
  store volatile i32 %61, ptr %8, align 4, !tbaa !9
  call void @llvm.lifetime.start.p0(i64 32, ptr %9) #3
  call void @llvm.lifetime.start.p0(i64 32, ptr %10) #3
  call void @llvm.lifetime.start.p0(i64 24, ptr %11) #3
  call void @llvm.lifetime.start.p0(i64 24, ptr %12) #3
  %62 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 1
  %63 = getelementptr inbounds %struct.point25519, ptr %11, i32 0, i32 0
  store ptr %62, ptr %63, align 8, !tbaa !14
  %64 = getelementptr inbounds %struct.point25519, ptr %11, i32 0, i32 1
  store ptr %9, ptr %64, align 8, !tbaa !16
  %65 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 2
  %66 = getelementptr inbounds %struct.point25519, ptr %11, i32 0, i32 2
  store ptr %65, ptr %66, align 8, !tbaa !17
  %67 = getelementptr inbounds %struct.point25519, ptr %12, i32 0, i32 0
  store ptr @Rx, ptr %67, align 8, !tbaa !14
  %68 = getelementptr inbounds %struct.point25519, ptr %12, i32 0, i32 1
  store ptr @Ry, ptr %68, align 8, !tbaa !16
  %69 = getelementptr inbounds %struct.point25519, ptr %12, i32 0, i32 2
  store ptr @Rz, ptr %69, align 8, !tbaa !17
  %70 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 0
  %71 = call i32 @computeY_curve25519_affine(ptr noundef %9, ptr noundef %70)
  %72 = icmp ne i32 %71, 0
  br i1 %72, label %73, label %74

73:                                               ; preds = %52
  br label %480

74:                                               ; preds = %52
  call void @curve25519_addPoint(ptr noundef %11, ptr noundef %11, ptr noundef %12)
  call void @curve25519_doublePoint(ptr noundef %11, ptr noundef %11)
  call void @curve25519_doublePoint(ptr noundef %11, ptr noundef %11)
  call void @curve25519_doublePoint(ptr noundef %11, ptr noundef %11)
  %75 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 5
  call void @fe25519_setzero(ptr noundef %75)
  br label %76

76:                                               ; preds = %79, %74
  %77 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 5
  %78 = getelementptr inbounds [32 x i8], ptr %77, i64 0, i64 0
  call void @randombytes(ptr noundef %78, i64 noundef 8)
  br label %79

79:                                               ; preds = %76
  %80 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 5
  %81 = getelementptr inbounds [4 x %union.UN_64bitValue_], ptr %80, i64 0, i64 0
  %82 = getelementptr inbounds [1 x i64], ptr %81, i64 0, i64 0
  %83 = load i64, ptr %82, align 8, !tbaa !11
  %84 = icmp ne i64 %83, 0
  %85 = xor i1 %84, true
  br i1 %85, label %76, label %86, !llvm.loop !18

86:                                               ; preds = %79
  %87 = getelementptr inbounds [64 x i8], ptr %13, i64 0, i64 0
  call void @randombytes(ptr noundef %87, i64 noundef 64)
  call void @fe25519_reduceTo256Bits_asm(ptr noundef %16, ptr noundef %13)
  %88 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 5
  call void @sc25519_mul(ptr noundef %14, ptr noundef %88, ptr noundef %16)
  call void @sc25519_inverse(ptr noundef %14, ptr noundef %14)
  call void @sc25519_mul(ptr noundef %15, ptr noundef %14, ptr noundef %16)
  %89 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 6
  %90 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 6
  call void @sc25519_mul(ptr noundef %89, ptr noundef %90, ptr noundef %15)
  %91 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 6
  %92 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 6
  call void @sc25519_mul(ptr noundef %91, ptr noundef %92, ptr noundef @blindingFactor)
  %93 = load volatile i32, ptr %8, align 4, !tbaa !9
  %94 = add i32 %93, 163
  store volatile i32 %94, ptr %8, align 4, !tbaa !9
  %95 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 2
  %96 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 2
  %97 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 3
  %98 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 4
  %99 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 0
  call void @fe25519_invert_useProvidedScratchBuffers(ptr noundef %95, ptr noundef %96, ptr noundef %97, ptr noundef %98, ptr noundef %99)
  %100 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 1
  %101 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 1
  %102 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 2
  call void @fe25519_mul_asm(ptr noundef %100, ptr noundef %101, ptr noundef %102)
  %103 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 1
  call void @fe25519_reduceCompletely(ptr noundef %103)
  %104 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 2
  call void @fe25519_mul_asm(ptr noundef %9, ptr noundef %9, ptr noundef %104)
  %105 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 0
  %106 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 1
  call void @fe25519_cpy(ptr noundef %105, ptr noundef %106)
  %107 = getelementptr inbounds [64 x i8], ptr %13, i64 0, i64 0
  call void @randombytes(ptr noundef %107, i64 noundef 64)
  %108 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 4
  call void @fe25519_reduceTo256Bits_asm(ptr noundef %108, ptr noundef %13)
  %109 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 4
  call void @fe25519_reduceCompletely(ptr noundef %109)
  %110 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 4
  %111 = getelementptr inbounds [32 x i8], ptr %110, i64 0, i64 31
  %112 = load i8, ptr %111, align 1, !tbaa !11
  %113 = zext i8 %112 to i32
  %114 = or i32 %113, 128
  %115 = trunc i32 %114 to i8
  store i8 %115, ptr %111, align 1, !tbaa !11
  %116 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 3
  %117 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 4
  %118 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 0
  call void @fe25519_mul_asm(ptr noundef %116, ptr noundef %117, ptr noundef %118)
  %119 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 1
  call void @fe25519_setone(ptr noundef %119)
  %120 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 2
  call void @fe25519_setzero(ptr noundef %120)
  %121 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 7
  store i32 253, ptr %121, align 8, !tbaa !19
  store i8 7, ptr %6, align 1, !tbaa !11
  br label %122

122:                                              ; preds = %171, %86
  %123 = load i8, ptr %6, align 1, !tbaa !11
  %124 = zext i8 %123 to i32
  %125 = icmp sge i32 %124, 1
  br i1 %125, label %126, label %174

126:                                              ; preds = %122
  call void @llvm.lifetime.start.p0(i64 4, ptr %17) #3
  %127 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 6
  %128 = load i8, ptr %6, align 1, !tbaa !11
  %129 = zext i8 %128 to i64
  %130 = getelementptr inbounds [8 x i32], ptr %127, i64 0, i64 %129
  %131 = load i32, ptr %130, align 4, !tbaa !11
  store i32 %131, ptr %17, align 4, !tbaa !9
  call void @llvm.lifetime.start.p0(i64 4, ptr %18) #3
  %132 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 6
  %133 = load i8, ptr %6, align 1, !tbaa !11
  %134 = zext i8 %133 to i32
  %135 = sub nsw i32 %134, 1
  %136 = sext i32 %135 to i64
  %137 = getelementptr inbounds [8 x i32], ptr %132, i64 0, i64 %136
  %138 = load i32, ptr %137, align 4, !tbaa !11
  store i32 %138, ptr %18, align 4, !tbaa !9
  call void @llvm.lifetime.start.p0(i64 4, ptr %19) #3
  %139 = load i32, ptr %17, align 4, !tbaa !9
  %140 = shl i32 %139, 1
  %141 = load i32, ptr %17, align 4, !tbaa !9
  %142 = xor i32 %140, %141
  store i32 %142, ptr %19, align 4, !tbaa !9
  %143 = load i32, ptr %19, align 4, !tbaa !9
  %144 = lshr i32 %143, 16
  %145 = trunc i32 %144 to i16
  %146 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 6
  %147 = load i8, ptr %6, align 1, !tbaa !11
  %148 = zext i8 %147 to i32
  %149 = mul nsw i32 2, %148
  %150 = add nsw i32 %149, 1
  %151 = sext i32 %150 to i64
  %152 = getelementptr inbounds [16 x i16], ptr %146, i64 0, i64 %151
  store i16 %145, ptr %152, align 2, !tbaa !11
  %153 = load i32, ptr %17, align 4, !tbaa !9
  %154 = shl i32 %153, 16
  %155 = load i32, ptr %18, align 4, !tbaa !9
  %156 = lshr i32 %155, 16
  %157 = or i32 %154, %156
  store i32 %157, ptr %17, align 4, !tbaa !9
  %158 = load i32, ptr %17, align 4, !tbaa !9
  %159 = shl i32 %158, 1
  %160 = load i32, ptr %17, align 4, !tbaa !9
  %161 = xor i32 %160, %159
  store i32 %161, ptr %17, align 4, !tbaa !9
  %162 = load i32, ptr %17, align 4, !tbaa !9
  %163 = lshr i32 %162, 16
  %164 = trunc i32 %163 to i16
  %165 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 6
  %166 = load i8, ptr %6, align 1, !tbaa !11
  %167 = zext i8 %166 to i32
  %168 = mul nsw i32 2, %167
  %169 = sext i32 %168 to i64
  %170 = getelementptr inbounds [16 x i16], ptr %165, i64 0, i64 %169
  store i16 %164, ptr %170, align 2, !tbaa !11
  call void @llvm.lifetime.end.p0(i64 4, ptr %19) #3
  call void @llvm.lifetime.end.p0(i64 4, ptr %18) #3
  call void @llvm.lifetime.end.p0(i64 4, ptr %17) #3
  br label %171

171:                                              ; preds = %126
  %172 = load i8, ptr %6, align 1, !tbaa !11
  %173 = add i8 %172, -1
  store i8 %173, ptr %6, align 1, !tbaa !11
  br label %122, !llvm.loop !21

174:                                              ; preds = %122
  %175 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 6
  %176 = getelementptr inbounds [8 x i32], ptr %175, i64 0, i64 0
  %177 = load i32, ptr %176, align 8, !tbaa !11
  %178 = shl i32 %177, 1
  %179 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 6
  %180 = getelementptr inbounds [8 x i32], ptr %179, i64 0, i64 0
  %181 = load i32, ptr %180, align 8, !tbaa !11
  %182 = xor i32 %181, %178
  store i32 %182, ptr %180, align 8, !tbaa !11
  %183 = getelementptr inbounds [32 x i8], ptr %20, i64 0, i64 0
  call void @randombytes(ptr noundef %183, i64 noundef 32)
  %184 = getelementptr inbounds [32 x i8], ptr %20, i64 0, i64 31
  %185 = load i8, ptr %184, align 1, !tbaa !11
  %186 = zext i8 %185 to i32
  %187 = and i32 %186, 63
  %188 = trunc i32 %187 to i8
  store i8 %188, ptr %184, align 1, !tbaa !11
  call void @cpy_256bitvalue(ptr noundef %21, ptr noundef %20)
  %189 = getelementptr inbounds [8 x i32], ptr %21, i64 0, i64 7
  %190 = load i32, ptr %189, align 4, !tbaa !11
  %191 = shl i32 %190, 1
  store i32 %191, ptr %189, align 4, !tbaa !11
  store i8 7, ptr %6, align 1, !tbaa !11
  br label %192

192:                                              ; preds = %228, %174
  %193 = load i8, ptr %6, align 1, !tbaa !11
  %194 = zext i8 %193 to i32
  %195 = icmp sge i32 %194, 1
  br i1 %195, label %196, label %231

196:                                              ; preds = %192
  call void @llvm.lifetime.start.p0(i64 4, ptr %22) #3
  %197 = load i8, ptr %6, align 1, !tbaa !11
  %198 = zext i8 %197 to i32
  %199 = sub nsw i32 %198, 1
  %200 = sext i32 %199 to i64
  %201 = getelementptr inbounds [8 x i32], ptr %21, i64 0, i64 %200
  %202 = load i32, ptr %201, align 4, !tbaa !11
  %203 = and i32 %202, -2147483648
  %204 = lshr i32 %203, 31
  store i32 %204, ptr %22, align 4, !tbaa !9
  %205 = load i32, ptr %22, align 4, !tbaa !9
  %206 = load i8, ptr %6, align 1, !tbaa !11
  %207 = zext i8 %206 to i64
  %208 = getelementptr inbounds [8 x i32], ptr %21, i64 0, i64 %207
  %209 = load i32, ptr %208, align 4, !tbaa !11
  %210 = or i32 %209, %205
  store i32 %210, ptr %208, align 4, !tbaa !11
  %211 = load i8, ptr %6, align 1, !tbaa !11
  %212 = zext i8 %211 to i32
  %213 = sub nsw i32 %212, 1
  %214 = sext i32 %213 to i64
  %215 = getelementptr inbounds [8 x i32], ptr %21, i64 0, i64 %214
  %216 = load i32, ptr %215, align 4, !tbaa !11
  %217 = shl i32 %216, 1
  store i32 %217, ptr %215, align 4, !tbaa !11
  %218 = load i8, ptr %6, align 1, !tbaa !11
  %219 = zext i8 %218 to i64
  %220 = getelementptr inbounds [8 x i32], ptr %20, i64 0, i64 %219
  %221 = load i32, ptr %220, align 4, !tbaa !11
  %222 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 6
  %223 = load i8, ptr %6, align 1, !tbaa !11
  %224 = zext i8 %223 to i64
  %225 = getelementptr inbounds [8 x i32], ptr %222, i64 0, i64 %224
  %226 = load i32, ptr %225, align 4, !tbaa !11
  %227 = xor i32 %226, %221
  store i32 %227, ptr %225, align 4, !tbaa !11
  call void @llvm.lifetime.end.p0(i64 4, ptr %22) #3
  br label %228

228:                                              ; preds = %196
  %229 = load i8, ptr %6, align 1, !tbaa !11
  %230 = add i8 %229, -1
  store i8 %230, ptr %6, align 1, !tbaa !11
  br label %192, !llvm.loop !22

231:                                              ; preds = %192
  %232 = getelementptr inbounds [8 x i32], ptr %20, i64 0, i64 0
  %233 = load i32, ptr %232, align 8, !tbaa !11
  %234 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 6
  %235 = getelementptr inbounds [8 x i32], ptr %234, i64 0, i64 0
  %236 = load i32, ptr %235, align 8, !tbaa !11
  %237 = xor i32 %236, %233
  store i32 %237, ptr %235, align 8, !tbaa !11
  %238 = load volatile i32, ptr %8, align 4, !tbaa !9
  %239 = add i32 %238, 163
  store volatile i32 %239, ptr %8, align 4, !tbaa !9
  %240 = getelementptr inbounds [8 x i32], ptr %21, i64 0, i64 7
  %241 = load i32, ptr %240, align 4, !tbaa !11
  call void @maskScalarBitsWithRandomAndCswap(ptr noundef %5, i32 noundef %241, i32 noundef 30)
  br label %242

242:                                              ; preds = %274, %231
  %243 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 7
  %244 = load i32, ptr %243, align 8, !tbaa !19
  %245 = icmp sge i32 %244, 0
  br i1 %245, label %246, label %278

246:                                              ; preds = %242
  call void @llvm.lifetime.start.p0(i64 1, ptr %23) #3
  store i8 0, ptr %23, align 1, !tbaa !11
  call void @llvm.lifetime.start.p0(i64 1, ptr %24) #3
  store i8 0, ptr %24, align 1, !tbaa !11
  %247 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 7
  %248 = load i32, ptr %247, align 8, !tbaa !19
  %249 = ashr i32 %248, 5
  %250 = trunc i32 %249 to i8
  store i8 %250, ptr %23, align 1, !tbaa !11
  %251 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 7
  %252 = load i32, ptr %251, align 8, !tbaa !19
  %253 = and i32 %252, 31
  %254 = trunc i32 %253 to i8
  store i8 %254, ptr %24, align 1, !tbaa !11
  %255 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 6
  %256 = load i8, ptr %23, align 1, !tbaa !11
  %257 = zext i8 %256 to i64
  %258 = getelementptr inbounds [8 x i32], ptr %255, i64 0, i64 %257
  %259 = load i32, ptr %258, align 4, !tbaa !11
  %260 = load i8, ptr %24, align 1, !tbaa !11
  %261 = zext i8 %260 to i32
  call void @maskScalarBitsWithRandomAndCswap(ptr noundef %5, i32 noundef %259, i32 noundef %261)
  %262 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 7
  %263 = load i32, ptr %262, align 8, !tbaa !19
  %264 = icmp sge i32 %263, 1
  br i1 %264, label %265, label %274

265:                                              ; preds = %246
  call void @curve25519_ladderstep(ptr noundef %5)
  %266 = load volatile i32, ptr %8, align 4, !tbaa !9
  %267 = add i32 %266, 9
  store volatile i32 %267, ptr %8, align 4, !tbaa !9
  %268 = load i8, ptr %23, align 1, !tbaa !11
  %269 = zext i8 %268 to i64
  %270 = getelementptr inbounds [8 x i32], ptr %21, i64 0, i64 %269
  %271 = load i32, ptr %270, align 4, !tbaa !11
  %272 = load i8, ptr %24, align 1, !tbaa !11
  %273 = zext i8 %272 to i32
  call void @maskScalarBitsWithRandomAndCswap(ptr noundef %5, i32 noundef %271, i32 noundef %273)
  br label %274

274:                                              ; preds = %265, %246
  %275 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 7
  %276 = load i32, ptr %275, align 8, !tbaa !19
  %277 = add nsw i32 %276, -1
  store i32 %277, ptr %275, align 8, !tbaa !19
  call void @llvm.lifetime.end.p0(i64 1, ptr %24) #3
  call void @llvm.lifetime.end.p0(i64 1, ptr %23) #3
  br label %242, !llvm.loop !23

278:                                              ; preds = %242
  %279 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 1
  %280 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 2
  %281 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 3
  %282 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 4
  %283 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 0
  call void @computeY_curve25519_projective(ptr noundef %10, ptr noundef %279, ptr noundef %280, ptr noundef %281, ptr noundef %282, ptr noundef %283, ptr noundef %9)
  %284 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 2
  %285 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 2
  %286 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 3
  %287 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 4
  %288 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 0
  call void @fe25519_invert_useProvidedScratchBuffers(ptr noundef %284, ptr noundef %285, ptr noundef %286, ptr noundef %287, ptr noundef %288)
  %289 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 1
  %290 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 1
  %291 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 2
  call void @fe25519_mul_asm(ptr noundef %289, ptr noundef %290, ptr noundef %291)
  %292 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 1
  call void @fe25519_reduceCompletely(ptr noundef %292)
  %293 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 2
  call void @fe25519_mul_asm(ptr noundef %10, ptr noundef %10, ptr noundef %293)
  %294 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 0
  %295 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 1
  call void @fe25519_cpy(ptr noundef %294, ptr noundef %295)
  %296 = getelementptr inbounds [64 x i8], ptr %13, i64 0, i64 0
  call void @randombytes(ptr noundef %296, i64 noundef 64)
  %297 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 4
  call void @fe25519_reduceTo256Bits_asm(ptr noundef %297, ptr noundef %13)
  %298 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 4
  call void @fe25519_reduceCompletely(ptr noundef %298)
  %299 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 4
  %300 = getelementptr inbounds [32 x i8], ptr %299, i64 0, i64 31
  %301 = load i8, ptr %300, align 1, !tbaa !11
  %302 = zext i8 %301 to i32
  %303 = or i32 %302, 128
  %304 = trunc i32 %303 to i8
  store i8 %304, ptr %300, align 1, !tbaa !11
  %305 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 3
  %306 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 4
  %307 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 0
  call void @fe25519_mul_asm(ptr noundef %305, ptr noundef %306, ptr noundef %307)
  %308 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 1
  call void @fe25519_setone(ptr noundef %308)
  %309 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 2
  call void @fe25519_setzero(ptr noundef %309)
  %310 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 7
  store i32 64, ptr %310, align 8, !tbaa !19
  store i8 2, ptr %6, align 1, !tbaa !11
  br label %311

311:                                              ; preds = %339, %278
  %312 = load i8, ptr %6, align 1, !tbaa !11
  %313 = zext i8 %312 to i32
  %314 = icmp sge i32 %313, 1
  br i1 %314, label %315, label %342

315:                                              ; preds = %311
  call void @llvm.lifetime.start.p0(i64 4, ptr %25) #3
  %316 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 5
  %317 = load i8, ptr %6, align 1, !tbaa !11
  %318 = zext i8 %317 to i64
  %319 = getelementptr inbounds [8 x i32], ptr %316, i64 0, i64 %318
  %320 = load i32, ptr %319, align 4, !tbaa !11
  %321 = shl i32 %320, 1
  store i32 %321, ptr %25, align 4, !tbaa !9
  %322 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 5
  %323 = load i8, ptr %6, align 1, !tbaa !11
  %324 = zext i8 %323 to i32
  %325 = sub nsw i32 %324, 1
  %326 = sext i32 %325 to i64
  %327 = getelementptr inbounds [8 x i32], ptr %322, i64 0, i64 %326
  %328 = load i32, ptr %327, align 4, !tbaa !11
  %329 = lshr i32 %328, 31
  %330 = load i32, ptr %25, align 4, !tbaa !9
  %331 = or i32 %330, %329
  store i32 %331, ptr %25, align 4, !tbaa !9
  %332 = load i32, ptr %25, align 4, !tbaa !9
  %333 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 5
  %334 = load i8, ptr %6, align 1, !tbaa !11
  %335 = zext i8 %334 to i64
  %336 = getelementptr inbounds [8 x i32], ptr %333, i64 0, i64 %335
  %337 = load i32, ptr %336, align 4, !tbaa !11
  %338 = xor i32 %337, %332
  store i32 %338, ptr %336, align 4, !tbaa !11
  call void @llvm.lifetime.end.p0(i64 4, ptr %25) #3
  br label %339

339:                                              ; preds = %315
  %340 = load i8, ptr %6, align 1, !tbaa !11
  %341 = add i8 %340, -1
  store i8 %341, ptr %6, align 1, !tbaa !11
  br label %311, !llvm.loop !24

342:                                              ; preds = %311
  %343 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 5
  %344 = getelementptr inbounds [8 x i32], ptr %343, i64 0, i64 0
  %345 = load i32, ptr %344, align 8, !tbaa !11
  %346 = shl i32 %345, 1
  %347 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 5
  %348 = getelementptr inbounds [8 x i32], ptr %347, i64 0, i64 0
  %349 = load i32, ptr %348, align 8, !tbaa !11
  %350 = xor i32 %349, %346
  store i32 %350, ptr %348, align 8, !tbaa !11
  call void @fe25519_setzero(ptr noundef %26)
  %351 = getelementptr inbounds [32 x i8], ptr %26, i64 0, i64 0
  call void @randombytes(ptr noundef %351, i64 noundef 12)
  %352 = getelementptr inbounds [32 x i8], ptr %26, i64 0, i64 2
  %353 = load i8, ptr %352, align 2, !tbaa !11
  %354 = zext i8 %353 to i32
  %355 = and i32 %354, 1
  %356 = trunc i32 %355 to i8
  store i8 %356, ptr %352, align 2, !tbaa !11
  call void @cpy_256bitvalue(ptr noundef %27, ptr noundef %26)
  %357 = getelementptr inbounds [8 x i32], ptr %27, i64 0, i64 2
  %358 = load i32, ptr %357, align 8, !tbaa !11
  %359 = shl i32 %358, 1
  store i32 %359, ptr %357, align 8, !tbaa !11
  store i8 2, ptr %6, align 1, !tbaa !11
  br label %360

360:                                              ; preds = %396, %342
  %361 = load i8, ptr %6, align 1, !tbaa !11
  %362 = zext i8 %361 to i32
  %363 = icmp sge i32 %362, 1
  br i1 %363, label %364, label %399

364:                                              ; preds = %360
  call void @llvm.lifetime.start.p0(i64 4, ptr %28) #3
  %365 = load i8, ptr %6, align 1, !tbaa !11
  %366 = zext i8 %365 to i32
  %367 = sub nsw i32 %366, 1
  %368 = sext i32 %367 to i64
  %369 = getelementptr inbounds [8 x i32], ptr %27, i64 0, i64 %368
  %370 = load i32, ptr %369, align 4, !tbaa !11
  %371 = and i32 %370, -2147483648
  %372 = lshr i32 %371, 31
  store i32 %372, ptr %28, align 4, !tbaa !9
  %373 = load i32, ptr %28, align 4, !tbaa !9
  %374 = load i8, ptr %6, align 1, !tbaa !11
  %375 = zext i8 %374 to i64
  %376 = getelementptr inbounds [8 x i32], ptr %27, i64 0, i64 %375
  %377 = load i32, ptr %376, align 4, !tbaa !11
  %378 = or i32 %377, %373
  store i32 %378, ptr %376, align 4, !tbaa !11
  %379 = load i8, ptr %6, align 1, !tbaa !11
  %380 = zext i8 %379 to i32
  %381 = sub nsw i32 %380, 1
  %382 = sext i32 %381 to i64
  %383 = getelementptr inbounds [8 x i32], ptr %27, i64 0, i64 %382
  %384 = load i32, ptr %383, align 4, !tbaa !11
  %385 = shl i32 %384, 1
  store i32 %385, ptr %383, align 4, !tbaa !11
  %386 = load i8, ptr %6, align 1, !tbaa !11
  %387 = zext i8 %386 to i64
  %388 = getelementptr inbounds [8 x i32], ptr %26, i64 0, i64 %387
  %389 = load i32, ptr %388, align 4, !tbaa !11
  %390 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 5
  %391 = load i8, ptr %6, align 1, !tbaa !11
  %392 = zext i8 %391 to i64
  %393 = getelementptr inbounds [8 x i32], ptr %390, i64 0, i64 %392
  %394 = load i32, ptr %393, align 4, !tbaa !11
  %395 = xor i32 %394, %389
  store i32 %395, ptr %393, align 4, !tbaa !11
  call void @llvm.lifetime.end.p0(i64 4, ptr %28) #3
  br label %396

396:                                              ; preds = %364
  %397 = load i8, ptr %6, align 1, !tbaa !11
  %398 = add i8 %397, -1
  store i8 %398, ptr %6, align 1, !tbaa !11
  br label %360, !llvm.loop !25

399:                                              ; preds = %360
  %400 = getelementptr inbounds [8 x i32], ptr %26, i64 0, i64 0
  %401 = load i32, ptr %400, align 8, !tbaa !11
  %402 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 5
  %403 = getelementptr inbounds [8 x i32], ptr %402, i64 0, i64 0
  %404 = load i32, ptr %403, align 8, !tbaa !11
  %405 = xor i32 %404, %401
  store i32 %405, ptr %403, align 8, !tbaa !11
  %406 = load volatile i32, ptr %8, align 4, !tbaa !9
  %407 = add i32 %406, 163
  store volatile i32 %407, ptr %8, align 4, !tbaa !9
  %408 = getelementptr inbounds [8 x i32], ptr %27, i64 0, i64 2
  %409 = load i32, ptr %408, align 8, !tbaa !11
  call void @maskScalarBitsWithRandomAndCswap(ptr noundef %5, i32 noundef %409, i32 noundef 1)
  br label %410

410:                                              ; preds = %442, %399
  %411 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 7
  %412 = load i32, ptr %411, align 8, !tbaa !19
  %413 = icmp sge i32 %412, 0
  br i1 %413, label %414, label %446

414:                                              ; preds = %410
  call void @llvm.lifetime.start.p0(i64 1, ptr %29) #3
  store i8 0, ptr %29, align 1, !tbaa !11
  call void @llvm.lifetime.start.p0(i64 1, ptr %30) #3
  store i8 0, ptr %30, align 1, !tbaa !11
  %415 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 7
  %416 = load i32, ptr %415, align 8, !tbaa !19
  %417 = ashr i32 %416, 5
  %418 = trunc i32 %417 to i8
  store i8 %418, ptr %29, align 1, !tbaa !11
  %419 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 7
  %420 = load i32, ptr %419, align 8, !tbaa !19
  %421 = and i32 %420, 31
  %422 = trunc i32 %421 to i8
  store i8 %422, ptr %30, align 1, !tbaa !11
  %423 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 5
  %424 = load i8, ptr %29, align 1, !tbaa !11
  %425 = zext i8 %424 to i64
  %426 = getelementptr inbounds [8 x i32], ptr %423, i64 0, i64 %425
  %427 = load i32, ptr %426, align 4, !tbaa !11
  %428 = load i8, ptr %30, align 1, !tbaa !11
  %429 = zext i8 %428 to i32
  call void @maskScalarBitsWithRandomAndCswap(ptr noundef %5, i32 noundef %427, i32 noundef %429)
  %430 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 7
  %431 = load i32, ptr %430, align 8, !tbaa !19
  %432 = icmp sge i32 %431, 1
  br i1 %432, label %433, label %442

433:                                              ; preds = %414
  call void @curve25519_ladderstep(ptr noundef %5)
  %434 = load volatile i32, ptr %8, align 4, !tbaa !9
  %435 = add i32 %434, 9
  store volatile i32 %435, ptr %8, align 4, !tbaa !9
  %436 = load i8, ptr %29, align 1, !tbaa !11
  %437 = zext i8 %436 to i64
  %438 = getelementptr inbounds [8 x i32], ptr %27, i64 0, i64 %437
  %439 = load i32, ptr %438, align 4, !tbaa !11
  %440 = load i8, ptr %30, align 1, !tbaa !11
  %441 = zext i8 %440 to i32
  call void @maskScalarBitsWithRandomAndCswap(ptr noundef %5, i32 noundef %439, i32 noundef %441)
  br label %442

442:                                              ; preds = %433, %414
  %443 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 7
  %444 = load i32, ptr %443, align 8, !tbaa !19
  %445 = add nsw i32 %444, -1
  store i32 %445, ptr %443, align 8, !tbaa !19
  call void @llvm.lifetime.end.p0(i64 1, ptr %30) #3
  call void @llvm.lifetime.end.p0(i64 1, ptr %29) #3
  br label %410, !llvm.loop !26

446:                                              ; preds = %410
  %447 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 1
  %448 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 2
  %449 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 3
  %450 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 4
  %451 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 0
  call void @computeY_curve25519_projective(ptr noundef %9, ptr noundef %447, ptr noundef %448, ptr noundef %449, ptr noundef %450, ptr noundef %451, ptr noundef %10)
  %452 = getelementptr inbounds %struct.point25519, ptr %31, i32 0, i32 0
  store ptr @Sx, ptr %452, align 8, !tbaa !14
  %453 = getelementptr inbounds %struct.point25519, ptr %31, i32 0, i32 1
  store ptr %32, ptr %453, align 8, !tbaa !16
  %454 = getelementptr inbounds %struct.point25519, ptr %31, i32 0, i32 2
  store ptr @Sz, ptr %454, align 8, !tbaa !17
  %455 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 1
  %456 = getelementptr inbounds %struct.point25519, ptr %11, i32 0, i32 0
  store ptr %455, ptr %456, align 8, !tbaa !14
  %457 = getelementptr inbounds %struct.point25519, ptr %11, i32 0, i32 1
  store ptr %9, ptr %457, align 8, !tbaa !16
  %458 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 2
  %459 = getelementptr inbounds %struct.point25519, ptr %11, i32 0, i32 2
  store ptr %458, ptr %459, align 8, !tbaa !17
  %460 = getelementptr inbounds %struct.point25519, ptr %31, i32 0, i32 1
  %461 = load ptr, ptr %460, align 8, !tbaa !16
  call void @fe25519_cpy(ptr noundef %461, ptr noundef @Sy)
  %462 = getelementptr inbounds %struct.point25519, ptr %31, i32 0, i32 1
  %463 = load ptr, ptr %462, align 8, !tbaa !16
  %464 = getelementptr inbounds %struct.point25519, ptr %31, i32 0, i32 1
  %465 = load ptr, ptr %464, align 8, !tbaa !16
  call void @fe25519_neg(ptr noundef %463, ptr noundef %465)
  call void @curve25519_addPoint(ptr noundef %11, ptr noundef %11, ptr noundef %31)
  %466 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 2
  %467 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 2
  %468 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 3
  %469 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 4
  %470 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 0
  call void @fe25519_invert_useProvidedScratchBuffers(ptr noundef %466, ptr noundef %467, ptr noundef %468, ptr noundef %469, ptr noundef %470)
  %471 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 1
  %472 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 1
  %473 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 2
  call void @fe25519_mul_asm(ptr noundef %471, ptr noundef %472, ptr noundef %473)
  %474 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 1
  call void @fe25519_reduceCompletely(ptr noundef %474)
  %475 = load volatile i32, ptr %8, align 4, !tbaa !9
  %476 = add i32 %475, 163
  store volatile i32 %476, ptr %8, align 4, !tbaa !9
  %477 = load volatile i32, ptr %8, align 4, !tbaa !9
  %478 = icmp ne i32 %477, 3802
  br i1 %478, label %479, label %483

479:                                              ; preds = %446
  br label %480

480:                                              ; preds = %479, %73
  store volatile i32 -1, ptr %7, align 4, !tbaa !9
  %481 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 1
  %482 = getelementptr inbounds [32 x i8], ptr %481, i64 0, i64 0
  call void @randombytes(ptr noundef %482, i64 noundef 32)
  br label %484

483:                                              ; preds = %446
  store volatile i32 0, ptr %7, align 4, !tbaa !9
  br label %484

484:                                              ; preds = %483, %480
  %485 = load ptr, ptr %3, align 8, !tbaa !5
  %486 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %5, i32 0, i32 1
  call void @fe25519_pack(ptr noundef %485, ptr noundef %486)
  call void @update_static_key_curve25519()
  %487 = load volatile i32, ptr %7, align 4, !tbaa !9
  call void @llvm.lifetime.end.p0(i64 24, ptr %12) #3
  call void @llvm.lifetime.end.p0(i64 24, ptr %11) #3
  call void @llvm.lifetime.end.p0(i64 32, ptr %10) #3
  call void @llvm.lifetime.end.p0(i64 32, ptr %9) #3
  call void @llvm.lifetime.end.p0(i64 4, ptr %8) #3
  call void @llvm.lifetime.end.p0(i64 4, ptr %7) #3
  call void @llvm.lifetime.end.p0(i64 1, ptr %6) #3
  call void @llvm.lifetime.end.p0(i64 232, ptr %5) #3
  ret i32 %487
}

declare void @fe25519_unpack(ptr noundef, ptr noundef) #2

declare void @fe25519_setone(ptr noundef) #2

; Function Attrs: nounwind uwtable
declare hidden i32 @computeY_curve25519_affine(ptr noundef, ptr noundef) #1

declare void @fe25519_invert_useProvidedScratchBuffers(ptr noundef, ptr noundef, ptr noundef, ptr noundef, ptr noundef) #2

declare void @fe25519_mul_asm(ptr noundef, ptr noundef, ptr noundef) #2

declare void @fe25519_reduceCompletely(ptr noundef) #2

; Function Attrs: nounwind uwtable
declare hidden void @maskScalarBitsWithRandomAndCswap(ptr noundef, i32 noundef, i32 noundef) #1

; Function Attrs: nounwind uwtable
declare hidden void @curve25519_ladderstep(ptr noundef) #1

; Function Attrs: nounwind uwtable
declare hidden void @computeY_curve25519_projective(ptr noundef, ptr noundef, ptr noundef, ptr noundef, ptr noundef, ptr noundef, ptr noundef) #1

declare void @fe25519_neg(ptr noundef, ptr noundef) #2

declare void @fe25519_pack(ptr noundef, ptr noundef) #2

attributes #0 = { nocallback nofree nosync nounwind willreturn memory(argmem: readwrite) }
attributes #1 = { nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #2 = { "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #3 = { nounwind }

!llvm.module.flags = !{!0, !1, !2, !3}
!llvm.ident = !{!4}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{i32 8, !"PIC Level", i32 2}
!2 = !{i32 7, !"PIE Level", i32 2}
!3 = !{i32 7, !"uwtable", i32 2}
!4 = !{!"clang version 19.1.0 (git@github.com:llvm/llvm-project.git a4bf6cd7cfb1a1421ba92bca9d017b49936c55e4)"}
!5 = !{!6, !6, i64 0}
!6 = !{!"any pointer", !7, i64 0}
!7 = !{!"omnipotent char", !8, i64 0}
!8 = !{!"Simple C/C++ TBAA"}
!9 = !{!10, !10, i64 0}
!10 = !{!"int", !7, i64 0}
!11 = !{!7, !7, i64 0}
!12 = distinct !{!12, !13}
!13 = !{!"llvm.loop.mustprogress"}
!14 = !{!15, !6, i64 0}
!15 = !{!"", !6, i64 0, !6, i64 8, !6, i64 16}
!16 = !{!15, !6, i64 8}
!17 = !{!15, !6, i64 16}
!18 = distinct !{!18, !13}
!19 = !{!20, !10, i64 224}
!20 = !{!"_ST_curve25519ladderstepWorkingState", !7, i64 0, !7, i64 32, !7, i64 64, !7, i64 96, !7, i64 128, !7, i64 160, !7, i64 192, !10, i64 224, !7, i64 228}
!21 = distinct !{!21, !13}
!22 = distinct !{!22, !13}
!23 = distinct !{!23, !13}
!24 = distinct !{!24, !13}
!25 = distinct !{!25, !13}
!26 = distinct !{!26, !13}


; Optimized IR (opt -passes='default<O3>'):
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

%struct._ST_curve25519ladderstepWorkingState = type { %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, i32, i8 }
%union.UN_256bitValue_ = type { [4 x %union.UN_64bitValue_] }
%union.UN_64bitValue_ = type { [1 x i64] }
%struct.point25519 = type { ptr, ptr, ptr }
%union.UN_512bitValue_ = type { [8 x i64] }

@Rx = external hidden global { [32 x i8] }, align 8
@Ry = external hidden global { [32 x i8] }, align 8
@Rz = external hidden global { <{ i8, [31 x i8] }> }, align 8
@Sx = external hidden global { [32 x i8] }, align 8
@Sy = external hidden global { [32 x i8] }, align 8
@Sz = external hidden global { <{ i8, [31 x i8] }> }, align 8
@static_key = external hidden local_unnamed_addr global { [32 x i8] }, align 8
@blindingFactor = external hidden global { <{ [8 x i8], [24 x i8] }> }, align 8

; Function Attrs: mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.start.p0(i64 immarg, ptr nocapture) #0

; Function Attrs: nounwind uwtable
declare dso_local void @update_static_key_curve25519() local_unnamed_addr #1

; Function Attrs: mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.end.p0(i64 immarg, ptr nocapture) #0

declare void @fe25519_cpy(ptr noundef, ptr noundef) local_unnamed_addr #2

declare void @randombytes(ptr noundef, i64 noundef) local_unnamed_addr #2

; Function Attrs: nounwind uwtable
declare hidden void @curve25519_doublePoint(ptr noundef, ptr noundef) local_unnamed_addr #1

; Function Attrs: nounwind uwtable
declare hidden void @curve25519_addPoint(ptr noundef, ptr noundef, ptr noundef) local_unnamed_addr #1

declare void @fe25519_setzero(ptr noundef) local_unnamed_addr #2

declare void @fe25519_reduceTo256Bits_asm(ptr noundef, ptr noundef) local_unnamed_addr #2

declare void @sc25519_mul(ptr noundef, ptr noundef, ptr noundef) local_unnamed_addr #2

declare void @sc25519_inverse(ptr noundef, ptr noundef) local_unnamed_addr #2

declare void @cpy_256bitvalue(ptr noundef, ptr noundef) local_unnamed_addr #2

; Function Attrs: nounwind uwtable
define dso_local i32 @crypto_scalarmult_curve25519(ptr noundef %0, ptr noundef %1) local_unnamed_addr #1 {
  %3 = alloca %struct._ST_curve25519ladderstepWorkingState, align 8
  %4 = alloca i32, align 4
  %5 = alloca i32, align 4
  %6 = alloca %union.UN_256bitValue_, align 8
  %7 = alloca %union.UN_256bitValue_, align 8
  %8 = alloca %struct.point25519, align 8
  %9 = alloca %struct.point25519, align 8
  %10 = alloca %union.UN_512bitValue_, align 8
  %11 = alloca %union.UN_256bitValue_, align 8
  %12 = alloca %union.UN_256bitValue_, align 8
  %13 = alloca %union.UN_256bitValue_, align 8
  %14 = alloca %union.UN_256bitValue_, align 16
  %15 = alloca %union.UN_256bitValue_, align 8
  %16 = alloca %union.UN_256bitValue_, align 8
  %17 = alloca %union.UN_256bitValue_, align 8
  %18 = alloca %struct.point25519, align 8
  %19 = alloca %union.UN_256bitValue_, align 8
  call void @llvm.lifetime.start.p0(i64 232, ptr nonnull %3) #4
  call void @llvm.lifetime.start.p0(i64 4, ptr nonnull %4)
  store volatile i32 -1, ptr %4, align 4, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 4, ptr nonnull %5)
  store volatile i32 0, ptr %5, align 4, !tbaa !5
  tail call void @randombytes(ptr noundef %0, i64 noundef 32) #4
  %20 = getelementptr inbounds i8, ptr %3, i64 192
  %21 = load i8, ptr @static_key, align 8, !tbaa !9
  store i8 %21, ptr %20, align 8, !tbaa !9
  %.0..0..0..0. = load volatile i32, ptr %5, align 4, !tbaa !5
  %22 = add i32 %.0..0..0..0., 9
  store volatile i32 %22, ptr %5, align 4, !tbaa !5
  %23 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 1), align 1, !tbaa !9
  %24 = getelementptr inbounds i8, ptr %3, i64 193
  store i8 %23, ptr %24, align 1, !tbaa !9
  %.0..0..0..0..1 = load volatile i32, ptr %5, align 4, !tbaa !5
  %25 = add i32 %.0..0..0..0..1, 9
  store volatile i32 %25, ptr %5, align 4, !tbaa !5
  %26 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 2), align 2, !tbaa !9
  %27 = getelementptr inbounds i8, ptr %3, i64 194
  store i8 %26, ptr %27, align 2, !tbaa !9
  %.0..0..0..0..2 = load volatile i32, ptr %5, align 4, !tbaa !5
  %28 = add i32 %.0..0..0..0..2, 9
  store volatile i32 %28, ptr %5, align 4, !tbaa !5
  %29 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 3), align 1, !tbaa !9
  %30 = getelementptr inbounds i8, ptr %3, i64 195
  store i8 %29, ptr %30, align 1, !tbaa !9
  %.0..0..0..0..3 = load volatile i32, ptr %5, align 4, !tbaa !5
  %31 = add i32 %.0..0..0..0..3, 9
  store volatile i32 %31, ptr %5, align 4, !tbaa !5
  %32 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 4), align 4, !tbaa !9
  %33 = getelementptr inbounds i8, ptr %3, i64 196
  store i8 %32, ptr %33, align 4, !tbaa !9
  %.0..0..0..0..4 = load volatile i32, ptr %5, align 4, !tbaa !5
  %34 = add i32 %.0..0..0..0..4, 9
  store volatile i32 %34, ptr %5, align 4, !tbaa !5
  %35 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 5), align 1, !tbaa !9
  %36 = getelementptr inbounds i8, ptr %3, i64 197
  store i8 %35, ptr %36, align 1, !tbaa !9
  %.0..0..0..0..5 = load volatile i32, ptr %5, align 4, !tbaa !5
  %37 = add i32 %.0..0..0..0..5, 9
  store volatile i32 %37, ptr %5, align 4, !tbaa !5
  %38 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 6), align 2, !tbaa !9
  %39 = getelementptr inbounds i8, ptr %3, i64 198
  store i8 %38, ptr %39, align 2, !tbaa !9
  %.0..0..0..0..6 = load volatile i32, ptr %5, align 4, !tbaa !5
  %40 = add i32 %.0..0..0..0..6, 9
  store volatile i32 %40, ptr %5, align 4, !tbaa !5
  %41 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 7), align 1, !tbaa !9
  %42 = getelementptr inbounds i8, ptr %3, i64 199
  store i8 %41, ptr %42, align 1, !tbaa !9
  %.0..0..0..0..7 = load volatile i32, ptr %5, align 4, !tbaa !5
  %43 = add i32 %.0..0..0..0..7, 9
  store volatile i32 %43, ptr %5, align 4, !tbaa !5
  %44 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 8), align 8, !tbaa !9
  %45 = getelementptr inbounds i8, ptr %3, i64 200
  store i8 %44, ptr %45, align 8, !tbaa !9
  %.0..0..0..0..8 = load volatile i32, ptr %5, align 4, !tbaa !5
  %46 = add i32 %.0..0..0..0..8, 9
  store volatile i32 %46, ptr %5, align 4, !tbaa !5
  %47 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 9), align 1, !tbaa !9
  %48 = getelementptr inbounds i8, ptr %3, i64 201
  store i8 %47, ptr %48, align 1, !tbaa !9
  %.0..0..0..0..9 = load volatile i32, ptr %5, align 4, !tbaa !5
  %49 = add i32 %.0..0..0..0..9, 9
  store volatile i32 %49, ptr %5, align 4, !tbaa !5
  %50 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 10), align 2, !tbaa !9
  %51 = getelementptr inbounds i8, ptr %3, i64 202
  store i8 %50, ptr %51, align 2, !tbaa !9
  %.0..0..0..0..10 = load volatile i32, ptr %5, align 4, !tbaa !5
  %52 = add i32 %.0..0..0..0..10, 9
  store volatile i32 %52, ptr %5, align 4, !tbaa !5
  %53 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 11), align 1, !tbaa !9
  %54 = getelementptr inbounds i8, ptr %3, i64 203
  store i8 %53, ptr %54, align 1, !tbaa !9
  %.0..0..0..0..11 = load volatile i32, ptr %5, align 4, !tbaa !5
  %55 = add i32 %.0..0..0..0..11, 9
  store volatile i32 %55, ptr %5, align 4, !tbaa !5
  %56 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 12), align 4, !tbaa !9
  %57 = getelementptr inbounds i8, ptr %3, i64 204
  store i8 %56, ptr %57, align 4, !tbaa !9
  %.0..0..0..0..12 = load volatile i32, ptr %5, align 4, !tbaa !5
  %58 = add i32 %.0..0..0..0..12, 9
  store volatile i32 %58, ptr %5, align 4, !tbaa !5
  %59 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 13), align 1, !tbaa !9
  %60 = getelementptr inbounds i8, ptr %3, i64 205
  store i8 %59, ptr %60, align 1, !tbaa !9
  %.0..0..0..0..13 = load volatile i32, ptr %5, align 4, !tbaa !5
  %61 = add i32 %.0..0..0..0..13, 9
  store volatile i32 %61, ptr %5, align 4, !tbaa !5
  %62 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 14), align 2, !tbaa !9
  %63 = getelementptr inbounds i8, ptr %3, i64 206
  store i8 %62, ptr %63, align 2, !tbaa !9
  %.0..0..0..0..14 = load volatile i32, ptr %5, align 4, !tbaa !5
  %64 = add i32 %.0..0..0..0..14, 9
  store volatile i32 %64, ptr %5, align 4, !tbaa !5
  %65 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 15), align 1, !tbaa !9
  %66 = getelementptr inbounds i8, ptr %3, i64 207
  store i8 %65, ptr %66, align 1, !tbaa !9
  %.0..0..0..0..15 = load volatile i32, ptr %5, align 4, !tbaa !5
  %67 = add i32 %.0..0..0..0..15, 9
  store volatile i32 %67, ptr %5, align 4, !tbaa !5
  %68 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 16), align 8, !tbaa !9
  %69 = getelementptr inbounds i8, ptr %3, i64 208
  store i8 %68, ptr %69, align 8, !tbaa !9
  %.0..0..0..0..16 = load volatile i32, ptr %5, align 4, !tbaa !5
  %70 = add i32 %.0..0..0..0..16, 9
  store volatile i32 %70, ptr %5, align 4, !tbaa !5
  %71 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 17), align 1, !tbaa !9
  %72 = getelementptr inbounds i8, ptr %3, i64 209
  store i8 %71, ptr %72, align 1, !tbaa !9
  %.0..0..0..0..17 = load volatile i32, ptr %5, align 4, !tbaa !5
  %73 = add i32 %.0..0..0..0..17, 9
  store volatile i32 %73, ptr %5, align 4, !tbaa !5
  %74 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 18), align 2, !tbaa !9
  %75 = getelementptr inbounds i8, ptr %3, i64 210
  store i8 %74, ptr %75, align 2, !tbaa !9
  %.0..0..0..0..18 = load volatile i32, ptr %5, align 4, !tbaa !5
  %76 = add i32 %.0..0..0..0..18, 9
  store volatile i32 %76, ptr %5, align 4, !tbaa !5
  %77 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 19), align 1, !tbaa !9
  %78 = getelementptr inbounds i8, ptr %3, i64 211
  store i8 %77, ptr %78, align 1, !tbaa !9
  %.0..0..0..0..19 = load volatile i32, ptr %5, align 4, !tbaa !5
  %79 = add i32 %.0..0..0..0..19, 9
  store volatile i32 %79, ptr %5, align 4, !tbaa !5
  %80 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 20), align 4, !tbaa !9
  %81 = getelementptr inbounds i8, ptr %3, i64 212
  store i8 %80, ptr %81, align 4, !tbaa !9
  %.0..0..0..0..20 = load volatile i32, ptr %5, align 4, !tbaa !5
  %82 = add i32 %.0..0..0..0..20, 9
  store volatile i32 %82, ptr %5, align 4, !tbaa !5
  %83 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 21), align 1, !tbaa !9
  %84 = getelementptr inbounds i8, ptr %3, i64 213
  store i8 %83, ptr %84, align 1, !tbaa !9
  %.0..0..0..0..21 = load volatile i32, ptr %5, align 4, !tbaa !5
  %85 = add i32 %.0..0..0..0..21, 9
  store volatile i32 %85, ptr %5, align 4, !tbaa !5
  %86 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 22), align 2, !tbaa !9
  %87 = getelementptr inbounds i8, ptr %3, i64 214
  store i8 %86, ptr %87, align 2, !tbaa !9
  %.0..0..0..0..22 = load volatile i32, ptr %5, align 4, !tbaa !5
  %88 = add i32 %.0..0..0..0..22, 9
  store volatile i32 %88, ptr %5, align 4, !tbaa !5
  %89 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 23), align 1, !tbaa !9
  %90 = getelementptr inbounds i8, ptr %3, i64 215
  store i8 %89, ptr %90, align 1, !tbaa !9
  %.0..0..0..0..23 = load volatile i32, ptr %5, align 4, !tbaa !5
  %91 = add i32 %.0..0..0..0..23, 9
  store volatile i32 %91, ptr %5, align 4, !tbaa !5
  %92 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 24), align 8, !tbaa !9
  %93 = getelementptr inbounds i8, ptr %3, i64 216
  store i8 %92, ptr %93, align 8, !tbaa !9
  %.0..0..0..0..24 = load volatile i32, ptr %5, align 4, !tbaa !5
  %94 = add i32 %.0..0..0..0..24, 9
  store volatile i32 %94, ptr %5, align 4, !tbaa !5
  %95 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 25), align 1, !tbaa !9
  %96 = getelementptr inbounds i8, ptr %3, i64 217
  store i8 %95, ptr %96, align 1, !tbaa !9
  %.0..0..0..0..25 = load volatile i32, ptr %5, align 4, !tbaa !5
  %97 = add i32 %.0..0..0..0..25, 9
  store volatile i32 %97, ptr %5, align 4, !tbaa !5
  %98 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 26), align 2, !tbaa !9
  %99 = getelementptr inbounds i8, ptr %3, i64 218
  store i8 %98, ptr %99, align 2, !tbaa !9
  %.0..0..0..0..26 = load volatile i32, ptr %5, align 4, !tbaa !5
  %100 = add i32 %.0..0..0..0..26, 9
  store volatile i32 %100, ptr %5, align 4, !tbaa !5
  %101 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 27), align 1, !tbaa !9
  %102 = getelementptr inbounds i8, ptr %3, i64 219
  store i8 %101, ptr %102, align 1, !tbaa !9
  %.0..0..0..0..27 = load volatile i32, ptr %5, align 4, !tbaa !5
  %103 = add i32 %.0..0..0..0..27, 9
  store volatile i32 %103, ptr %5, align 4, !tbaa !5
  %104 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 28), align 4, !tbaa !9
  %105 = getelementptr inbounds i8, ptr %3, i64 220
  store i8 %104, ptr %105, align 4, !tbaa !9
  %.0..0..0..0..28 = load volatile i32, ptr %5, align 4, !tbaa !5
  %106 = add i32 %.0..0..0..0..28, 9
  store volatile i32 %106, ptr %5, align 4, !tbaa !5
  %107 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 29), align 1, !tbaa !9
  %108 = getelementptr inbounds i8, ptr %3, i64 221
  store i8 %107, ptr %108, align 1, !tbaa !9
  %.0..0..0..0..29 = load volatile i32, ptr %5, align 4, !tbaa !5
  %109 = add i32 %.0..0..0..0..29, 9
  store volatile i32 %109, ptr %5, align 4, !tbaa !5
  %110 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 30), align 2, !tbaa !9
  %111 = getelementptr inbounds i8, ptr %3, i64 222
  store i8 %110, ptr %111, align 2, !tbaa !9
  %.0..0..0..0..30 = load volatile i32, ptr %5, align 4, !tbaa !5
  %112 = add i32 %.0..0..0..0..30, 9
  store volatile i32 %112, ptr %5, align 4, !tbaa !5
  %113 = load i8, ptr getelementptr inbounds (i8, ptr @static_key, i64 31), align 1, !tbaa !9
  %114 = getelementptr inbounds i8, ptr %3, i64 223
  store i8 %113, ptr %114, align 1, !tbaa !9
  %.0..0..0..0..31 = load volatile i32, ptr %5, align 4, !tbaa !5
  %115 = add i32 %.0..0..0..0..31, 9
  store volatile i32 %115, ptr %5, align 4, !tbaa !5
  call void @fe25519_unpack(ptr noundef nonnull %3, ptr noundef %1) #4
  %116 = getelementptr inbounds i8, ptr %3, i64 96
  call void @fe25519_setone(ptr noundef nonnull %116) #4
  %117 = getelementptr inbounds i8, ptr %3, i64 128
  call void @fe25519_setzero(ptr noundef nonnull %117) #4
  %118 = getelementptr inbounds i8, ptr %3, i64 32
  call void @fe25519_cpy(ptr noundef nonnull %118, ptr noundef nonnull %3) #4
  %119 = getelementptr inbounds i8, ptr %3, i64 64
  call void @fe25519_setone(ptr noundef nonnull %119) #4
  %.0..0..0..0.20 = load volatile i32, ptr %5, align 4, !tbaa !5
  %120 = add i32 %.0..0..0..0.20, 9
  store volatile i32 %120, ptr %5, align 4, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 32, ptr nonnull %6) #4
  call void @llvm.lifetime.start.p0(i64 32, ptr nonnull %7) #4
  call void @llvm.lifetime.start.p0(i64 24, ptr nonnull %8) #4
  call void @llvm.lifetime.start.p0(i64 24, ptr nonnull %9) #4
  store ptr %118, ptr %8, align 8, !tbaa !10
  %121 = getelementptr inbounds i8, ptr %8, i64 8
  store ptr %6, ptr %121, align 8, !tbaa !13
  %122 = getelementptr inbounds i8, ptr %8, i64 16
  store ptr %119, ptr %122, align 8, !tbaa !14
  store ptr @Rx, ptr %9, align 8, !tbaa !10
  %123 = getelementptr inbounds i8, ptr %9, i64 8
  store ptr @Ry, ptr %123, align 8, !tbaa !13
  %124 = getelementptr inbounds i8, ptr %9, i64 16
  store ptr @Rz, ptr %124, align 8, !tbaa !14
  %125 = call i32 @computeY_curve25519_affine(ptr noundef nonnull %6, ptr noundef nonnull %3)
  %.not = icmp eq i32 %125, 0
  br i1 %.not, label %126, label %278

126:                                              ; preds = %2
  call void @curve25519_addPoint(ptr noundef nonnull %8, ptr noundef nonnull %8, ptr noundef nonnull %9)
  call void @curve25519_doublePoint(ptr noundef nonnull %8, ptr noundef nonnull %8)
  call void @curve25519_doublePoint(ptr noundef nonnull %8, ptr noundef nonnull %8)
  call void @curve25519_doublePoint(ptr noundef nonnull %8, ptr noundef nonnull %8)
  %127 = getelementptr inbounds i8, ptr %3, i64 160
  call void @fe25519_setzero(ptr noundef nonnull %127) #4
  br label %128

128:                                              ; preds = %128, %126
  call void @randombytes(ptr noundef nonnull %127, i64 noundef 8) #4
  %129 = load i64, ptr %127, align 8, !tbaa !9
  %.not67 = icmp eq i64 %129, 0
  br i1 %.not67, label %128, label %130, !llvm.loop !15

130:                                              ; preds = %128
  call void @randombytes(ptr noundef nonnull %10, i64 noundef 64) #4
  call void @fe25519_reduceTo256Bits_asm(ptr noundef nonnull %13, ptr noundef nonnull %10) #4
  call void @sc25519_mul(ptr noundef nonnull %11, ptr noundef nonnull %127, ptr noundef nonnull %13) #4
  call void @sc25519_inverse(ptr noundef nonnull %11, ptr noundef nonnull %11) #4
  call void @sc25519_mul(ptr noundef nonnull %12, ptr noundef nonnull %11, ptr noundef nonnull %13) #4
  call void @sc25519_mul(ptr noundef nonnull %20, ptr noundef nonnull %20, ptr noundef nonnull %12) #4
  call void @sc25519_mul(ptr noundef nonnull %20, ptr noundef nonnull %20, ptr noundef nonnull @blindingFactor) #4
  %.0..0..0..0.21 = load volatile i32, ptr %5, align 4, !tbaa !5
  %131 = add i32 %.0..0..0..0.21, 163
  store volatile i32 %131, ptr %5, align 4, !tbaa !5
  call void @fe25519_invert_useProvidedScratchBuffers(ptr noundef nonnull %119, ptr noundef nonnull %119, ptr noundef nonnull %116, ptr noundef nonnull %117, ptr noundef nonnull %3) #4
  call void @fe25519_mul_asm(ptr noundef nonnull %118, ptr noundef nonnull %118, ptr noundef nonnull %119) #4
  call void @fe25519_reduceCompletely(ptr noundef nonnull %118) #4
  call void @fe25519_mul_asm(ptr noundef nonnull %6, ptr noundef nonnull %6, ptr noundef nonnull %119) #4
  call void @fe25519_cpy(ptr noundef nonnull %3, ptr noundef nonnull %118) #4
  call void @randombytes(ptr noundef nonnull %10, i64 noundef 64) #4
  call void @fe25519_reduceTo256Bits_asm(ptr noundef nonnull %117, ptr noundef nonnull %10) #4
  call void @fe25519_reduceCompletely(ptr noundef nonnull %117) #4
  %132 = getelementptr inbounds i8, ptr %3, i64 159
  %133 = load i8, ptr %132, align 1, !tbaa !9
  %134 = or i8 %133, -128
  store i8 %134, ptr %132, align 1, !tbaa !9
  call void @fe25519_mul_asm(ptr noundef nonnull %116, ptr noundef nonnull %117, ptr noundef nonnull %3) #4
  call void @fe25519_setone(ptr noundef nonnull %118) #4
  call void @fe25519_setzero(ptr noundef nonnull %119) #4
  %135 = getelementptr inbounds i8, ptr %3, i64 224
  store i32 253, ptr %135, align 8, !tbaa !17
  %136 = load i32, ptr %105, align 4, !tbaa !9
  %137 = load i32, ptr %93, align 8, !tbaa !9
  %138 = shl i32 %136, 1
  %139 = xor i32 %138, %136
  %140 = lshr i32 %139, 16
  %141 = trunc nuw i32 %140 to i16
  store i16 %141, ptr %111, align 2, !tbaa !9
  %142 = call i32 @llvm.fshl.i32(i32 %136, i32 %137, i32 16)
  %143 = shl i32 %142, 1
  %144 = xor i32 %143, %142
  %145 = lshr i32 %144, 16
  %146 = trunc nuw i32 %145 to i16
  store i16 %146, ptr %105, align 4, !tbaa !9
  %147 = load i32, ptr %81, align 4, !tbaa !9
  %148 = call i32 @llvm.fshl.i32(i32 %137, i32 %147, i32 16)
  %149 = load i32, ptr %69, align 8, !tbaa !9
  %150 = call i32 @llvm.fshl.i32(i32 %147, i32 %149, i32 16)
  %151 = insertelement <4 x i32> poison, i32 %150, i64 0
  %152 = insertelement <4 x i32> %151, i32 %147, i64 1
  %153 = insertelement <4 x i32> %152, i32 %148, i64 2
  %154 = insertelement <4 x i32> %153, i32 %137, i64 3
  %155 = shl <4 x i32> %154, <i32 1, i32 1, i32 1, i32 1>
  %156 = xor <4 x i32> %155, %154
  %157 = lshr <4 x i32> %156, <i32 16, i32 16, i32 16, i32 16>
  %158 = trunc nuw <4 x i32> %157 to <4 x i16>
  store <4 x i16> %158, ptr %81, align 4, !tbaa !9
  %159 = load i32, ptr %57, align 4, !tbaa !9
  %160 = call i32 @llvm.fshl.i32(i32 %149, i32 %159, i32 16)
  %161 = load i32, ptr %45, align 8, !tbaa !9
  %162 = call i32 @llvm.fshl.i32(i32 %159, i32 %161, i32 16)
  %163 = load i32, ptr %33, align 4, !tbaa !9
  %164 = call i32 @llvm.fshl.i32(i32 %161, i32 %163, i32 16)
  %165 = load i32, ptr %20, align 8, !tbaa !9
  %166 = call i32 @llvm.fshl.i32(i32 %163, i32 %165, i32 16)
  %167 = insertelement <8 x i32> poison, i32 %166, i64 0
  %168 = insertelement <8 x i32> %167, i32 %163, i64 1
  %169 = insertelement <8 x i32> %168, i32 %164, i64 2
  %170 = insertelement <8 x i32> %169, i32 %161, i64 3
  %171 = insertelement <8 x i32> %170, i32 %162, i64 4
  %172 = insertelement <8 x i32> %171, i32 %159, i64 5
  %173 = insertelement <8 x i32> %172, i32 %160, i64 6
  %174 = insertelement <8 x i32> %173, i32 %149, i64 7
  %175 = shl <8 x i32> %174, <i32 1, i32 1, i32 1, i32 1, i32 1, i32 1, i32 1, i32 1>
  %176 = xor <8 x i32> %175, %174
  %177 = lshr <8 x i32> %176, <i32 16, i32 16, i32 16, i32 16, i32 16, i32 16, i32 16, i32 16>
  %178 = trunc nuw <8 x i32> %177 to <8 x i16>
  store <8 x i16> %178, ptr %33, align 4, !tbaa !9
  %179 = shl i32 %165, 1
  %180 = xor i32 %179, %165
  store i32 %180, ptr %20, align 8, !tbaa !9
  call void @randombytes(ptr noundef nonnull %14, i64 noundef 32) #4
  %181 = getelementptr inbounds i8, ptr %14, i64 31
  %182 = load i8, ptr %181, align 1, !tbaa !9
  %183 = and i8 %182, 63
  store i8 %183, ptr %181, align 1, !tbaa !9
  call void @cpy_256bitvalue(ptr noundef nonnull %15, ptr noundef nonnull %14) #4
  %184 = getelementptr inbounds i8, ptr %15, i64 28
  %185 = load i32, ptr %184, align 4, !tbaa !9
  %186 = getelementptr inbounds i8, ptr %15, i64 24
  %187 = load i32, ptr %186, align 8, !tbaa !9
  %188 = call i32 @llvm.fshl.i32(i32 %185, i32 %187, i32 1)
  store i32 %188, ptr %184, align 4, !tbaa !9
  %189 = getelementptr inbounds i8, ptr %15, i64 20
  %190 = load i32, ptr %189, align 4, !tbaa !9
  %191 = call i32 @llvm.fshl.i32(i32 %187, i32 %190, i32 1)
  store i32 %191, ptr %186, align 8, !tbaa !9
  %192 = getelementptr inbounds i8, ptr %14, i64 16
  %193 = load <4 x i32>, ptr %192, align 16, !tbaa !9
  %194 = load <4 x i32>, ptr %69, align 8, !tbaa !9
  %195 = xor <4 x i32> %194, %193
  store <4 x i32> %195, ptr %69, align 8, !tbaa !9
  %196 = getelementptr inbounds i8, ptr %15, i64 4
  %197 = load i32, ptr %15, align 8, !tbaa !9
  %198 = load <4 x i32>, ptr %196, align 4, !tbaa !9
  %199 = extractelement <4 x i32> %198, i64 3
  %200 = call i32 @llvm.fshl.i32(i32 %190, i32 %199, i32 1)
  store i32 %200, ptr %189, align 4, !tbaa !9
  %201 = insertelement <4 x i32> poison, i32 %197, i64 0
  %202 = shufflevector <4 x i32> %201, <4 x i32> %198, <4 x i32> <i32 0, i32 4, i32 5, i32 6>
  %203 = call <4 x i32> @llvm.fshl.v4i32(<4 x i32> %198, <4 x i32> %202, <4 x i32> <i32 1, i32 1, i32 1, i32 1>)
  store <4 x i32> %203, ptr %196, align 4, !tbaa !9
  %204 = shl i32 %197, 1
  store i32 %204, ptr %15, align 8, !tbaa !9
  %205 = load <4 x i32>, ptr %14, align 16, !tbaa !9
  %206 = load <4 x i32>, ptr %20, align 8, !tbaa !9
  %207 = xor <4 x i32> %206, %205
  store <4 x i32> %207, ptr %20, align 8, !tbaa !9
  %.0..0..0..0.22 = load volatile i32, ptr %5, align 4, !tbaa !5
  %208 = add i32 %.0..0..0..0.22, 163
  store volatile i32 %208, ptr %5, align 4, !tbaa !5
  call void @maskScalarBitsWithRandomAndCswap(ptr noundef nonnull %3, i32 noundef %188, i32 noundef 30)
  %.pr = load i32, ptr %135, align 8, !tbaa !17
  %209 = icmp sgt i32 %.pr, -1
  br i1 %209, label %.lr.ph, label %._crit_edge

.lr.ph:                                           ; preds = %130, %220
  %210 = phi i32 [ %224, %220 ], [ %.pr, %130 ]
  %211 = lshr i32 %210, 5
  %212 = and i32 %210, 31
  %213 = and i32 %211, 255
  %214 = zext nneg i32 %213 to i64
  %215 = getelementptr inbounds [8 x i32], ptr %20, i64 0, i64 %214
  %216 = load i32, ptr %215, align 4, !tbaa !9
  call void @maskScalarBitsWithRandomAndCswap(ptr noundef nonnull %3, i32 noundef %216, i32 noundef %212)
  %217 = load i32, ptr %135, align 8, !tbaa !17
  %218 = icmp sgt i32 %217, 0
  br i1 %218, label %220, label %.thread

.thread:                                          ; preds = %.lr.ph
  %219 = add nsw i32 %217, -1
  store i32 %219, ptr %135, align 8, !tbaa !17
  br label %._crit_edge

220:                                              ; preds = %.lr.ph
  call void @curve25519_ladderstep(ptr noundef nonnull %3)
  %.0..0..0..0.23 = load volatile i32, ptr %5, align 4, !tbaa !5
  %221 = add i32 %.0..0..0..0.23, 9
  store volatile i32 %221, ptr %5, align 4, !tbaa !5
  %222 = getelementptr inbounds [8 x i32], ptr %15, i64 0, i64 %214
  %223 = load i32, ptr %222, align 4, !tbaa !9
  call void @maskScalarBitsWithRandomAndCswap(ptr noundef nonnull %3, i32 noundef %223, i32 noundef %212)
  %.pre = load i32, ptr %135, align 8, !tbaa !17
  %224 = add nsw i32 %.pre, -1
  store i32 %224, ptr %135, align 8, !tbaa !17
  %225 = icmp sgt i32 %.pre, 0
  br i1 %225, label %.lr.ph, label %._crit_edge, !llvm.loop !19

._crit_edge:                                      ; preds = %220, %.thread, %130
  call void @computeY_curve25519_projective(ptr noundef nonnull %7, ptr noundef nonnull %118, ptr noundef nonnull %119, ptr noundef nonnull %116, ptr noundef nonnull %117, ptr noundef nonnull %3, ptr noundef nonnull %6)
  call void @fe25519_invert_useProvidedScratchBuffers(ptr noundef nonnull %119, ptr noundef nonnull %119, ptr noundef nonnull %116, ptr noundef nonnull %117, ptr noundef nonnull %3) #4
  call void @fe25519_mul_asm(ptr noundef nonnull %118, ptr noundef nonnull %118, ptr noundef nonnull %119) #4
  call void @fe25519_reduceCompletely(ptr noundef nonnull %118) #4
  call void @fe25519_mul_asm(ptr noundef nonnull %7, ptr noundef nonnull %7, ptr noundef nonnull %119) #4
  call void @fe25519_cpy(ptr noundef nonnull %3, ptr noundef nonnull %118) #4
  call void @randombytes(ptr noundef nonnull %10, i64 noundef 64) #4
  call void @fe25519_reduceTo256Bits_asm(ptr noundef nonnull %117, ptr noundef nonnull %10) #4
  call void @fe25519_reduceCompletely(ptr noundef nonnull %117) #4
  %226 = load i8, ptr %132, align 1, !tbaa !9
  %227 = or i8 %226, -128
  store i8 %227, ptr %132, align 1, !tbaa !9
  call void @fe25519_mul_asm(ptr noundef nonnull %116, ptr noundef nonnull %117, ptr noundef nonnull %3) #4
  call void @fe25519_setone(ptr noundef nonnull %118) #4
  call void @fe25519_setzero(ptr noundef nonnull %119) #4
  store i32 64, ptr %135, align 8, !tbaa !17
  %228 = getelementptr inbounds i8, ptr %3, i64 168
  %229 = load i32, ptr %228, align 8, !tbaa !9
  %230 = getelementptr inbounds i8, ptr %3, i64 164
  %231 = load i32, ptr %230, align 4, !tbaa !9
  %232 = call i32 @llvm.fshl.i32(i32 %229, i32 %231, i32 1)
  %233 = xor i32 %232, %229
  store i32 %233, ptr %228, align 8, !tbaa !9
  %234 = load i32, ptr %127, align 8, !tbaa !9
  %235 = call i32 @llvm.fshl.i32(i32 %231, i32 %234, i32 1)
  %236 = xor i32 %235, %231
  store i32 %236, ptr %230, align 4, !tbaa !9
  %237 = shl i32 %234, 1
  %238 = xor i32 %237, %234
  store i32 %238, ptr %127, align 8, !tbaa !9
  call void @fe25519_setzero(ptr noundef nonnull %16) #4
  call void @randombytes(ptr noundef nonnull %16, i64 noundef 12) #4
  %239 = getelementptr inbounds i8, ptr %16, i64 2
  %240 = load i8, ptr %239, align 2, !tbaa !9
  %241 = and i8 %240, 1
  store i8 %241, ptr %239, align 2, !tbaa !9
  call void @cpy_256bitvalue(ptr noundef nonnull %17, ptr noundef nonnull %16) #4
  %242 = getelementptr inbounds i8, ptr %17, i64 8
  %243 = load i32, ptr %242, align 8, !tbaa !9
  %244 = getelementptr inbounds i8, ptr %17, i64 4
  %245 = load i32, ptr %244, align 4, !tbaa !9
  %246 = call i32 @llvm.fshl.i32(i32 %243, i32 %245, i32 1)
  store i32 %246, ptr %242, align 8, !tbaa !9
  %247 = getelementptr inbounds i8, ptr %16, i64 8
  %248 = load i32, ptr %247, align 8, !tbaa !9
  %249 = load i32, ptr %228, align 8, !tbaa !9
  %250 = xor i32 %249, %248
  store i32 %250, ptr %228, align 8, !tbaa !9
  %251 = load i32, ptr %17, align 8, !tbaa !9
  %252 = call i32 @llvm.fshl.i32(i32 %245, i32 %251, i32 1)
  store i32 %252, ptr %244, align 4, !tbaa !9
  %253 = shl i32 %251, 1
  store i32 %253, ptr %17, align 8, !tbaa !9
  %254 = load <2 x i32>, ptr %16, align 8, !tbaa !9
  %255 = load <2 x i32>, ptr %127, align 8, !tbaa !9
  %256 = xor <2 x i32> %255, %254
  store <2 x i32> %256, ptr %127, align 8, !tbaa !9
  %.0..0..0..0.24 = load volatile i32, ptr %5, align 4, !tbaa !5
  %257 = add i32 %.0..0..0..0.24, 163
  store volatile i32 %257, ptr %5, align 4, !tbaa !5
  call void @maskScalarBitsWithRandomAndCswap(ptr noundef nonnull %3, i32 noundef %246, i32 noundef 1)
  %.pr73 = load i32, ptr %135, align 8, !tbaa !17
  %258 = icmp sgt i32 %.pr73, -1
  br i1 %258, label %.lr.ph80, label %._crit_edge81

.lr.ph80:                                         ; preds = %._crit_edge, %269
  %259 = phi i32 [ %273, %269 ], [ %.pr73, %._crit_edge ]
  %260 = lshr i32 %259, 5
  %261 = and i32 %259, 31
  %262 = and i32 %260, 255
  %263 = zext nneg i32 %262 to i64
  %264 = getelementptr inbounds [8 x i32], ptr %127, i64 0, i64 %263
  %265 = load i32, ptr %264, align 4, !tbaa !9
  call void @maskScalarBitsWithRandomAndCswap(ptr noundef nonnull %3, i32 noundef %265, i32 noundef %261)
  %266 = load i32, ptr %135, align 8, !tbaa !17
  %267 = icmp sgt i32 %266, 0
  br i1 %267, label %269, label %.thread88

.thread88:                                        ; preds = %.lr.ph80
  %268 = add nsw i32 %266, -1
  store i32 %268, ptr %135, align 8, !tbaa !17
  br label %._crit_edge81

269:                                              ; preds = %.lr.ph80
  call void @curve25519_ladderstep(ptr noundef nonnull %3)
  %.0..0..0..0.25 = load volatile i32, ptr %5, align 4, !tbaa !5
  %270 = add i32 %.0..0..0..0.25, 9
  store volatile i32 %270, ptr %5, align 4, !tbaa !5
  %271 = getelementptr inbounds [8 x i32], ptr %17, i64 0, i64 %263
  %272 = load i32, ptr %271, align 4, !tbaa !9
  call void @maskScalarBitsWithRandomAndCswap(ptr noundef nonnull %3, i32 noundef %272, i32 noundef %261)
  %.pre87 = load i32, ptr %135, align 8, !tbaa !17
  %273 = add nsw i32 %.pre87, -1
  store i32 %273, ptr %135, align 8, !tbaa !17
  %274 = icmp sgt i32 %.pre87, 0
  br i1 %274, label %.lr.ph80, label %._crit_edge81, !llvm.loop !20

._crit_edge81:                                    ; preds = %269, %.thread88, %._crit_edge
  call void @computeY_curve25519_projective(ptr noundef nonnull %6, ptr noundef nonnull %118, ptr noundef nonnull %119, ptr noundef nonnull %116, ptr noundef nonnull %117, ptr noundef nonnull %3, ptr noundef nonnull %7)
  store ptr @Sx, ptr %18, align 8, !tbaa !10
  %275 = getelementptr inbounds i8, ptr %18, i64 8
  store ptr %19, ptr %275, align 8, !tbaa !13
  %276 = getelementptr inbounds i8, ptr %18, i64 16
  store ptr @Sz, ptr %276, align 8, !tbaa !14
  store ptr %118, ptr %8, align 8, !tbaa !10
  store ptr %6, ptr %121, align 8, !tbaa !13
  store ptr %119, ptr %122, align 8, !tbaa !14
  call void @fe25519_cpy(ptr noundef nonnull %19, ptr noundef nonnull @Sy) #4
  call void @fe25519_neg(ptr noundef nonnull %19, ptr noundef nonnull %19) #4
  call void @curve25519_addPoint(ptr noundef nonnull %8, ptr noundef nonnull %8, ptr noundef nonnull %18)
  call void @fe25519_invert_useProvidedScratchBuffers(ptr noundef nonnull %119, ptr noundef nonnull %119, ptr noundef nonnull %116, ptr noundef nonnull %117, ptr noundef nonnull %3) #4
  call void @fe25519_mul_asm(ptr noundef nonnull %118, ptr noundef nonnull %118, ptr noundef nonnull %119) #4
  call void @fe25519_reduceCompletely(ptr noundef nonnull %118) #4
  %.0..0..0..0.26 = load volatile i32, ptr %5, align 4, !tbaa !5
  %277 = add i32 %.0..0..0..0.26, 163
  store volatile i32 %277, ptr %5, align 4, !tbaa !5
  %.0..0..0..0.27 = load volatile i32, ptr %5, align 4, !tbaa !5
  %.not72 = icmp eq i32 %.0..0..0..0.27, 3802
  br i1 %.not72, label %279, label %278

278:                                              ; preds = %._crit_edge81, %2
  store volatile i32 -1, ptr %4, align 4, !tbaa !5
  call void @randombytes(ptr noundef nonnull %118, i64 noundef 32) #4
  br label %280

279:                                              ; preds = %._crit_edge81
  store volatile i32 0, ptr %4, align 4, !tbaa !5
  br label %280

280:                                              ; preds = %279, %278
  call void @fe25519_pack(ptr noundef %0, ptr noundef nonnull %118) #4
  call void @update_static_key_curve25519()
  %.0..0..0..0.28 = load volatile i32, ptr %4, align 4, !tbaa !5
  call void @llvm.lifetime.end.p0(i64 24, ptr nonnull %9) #4
  call void @llvm.lifetime.end.p0(i64 24, ptr nonnull %8) #4
  call void @llvm.lifetime.end.p0(i64 32, ptr nonnull %7) #4
  call void @llvm.lifetime.end.p0(i64 32, ptr nonnull %6) #4
  call void @llvm.lifetime.end.p0(i64 4, ptr nonnull %5)
  call void @llvm.lifetime.end.p0(i64 4, ptr nonnull %4)
  call void @llvm.lifetime.end.p0(i64 232, ptr nonnull %3) #4
  ret i32 %.0..0..0..0.28
}

declare void @fe25519_unpack(ptr noundef, ptr noundef) local_unnamed_addr #2

declare void @fe25519_setone(ptr noundef) local_unnamed_addr #2

; Function Attrs: nounwind uwtable
declare hidden i32 @computeY_curve25519_affine(ptr noundef, ptr noundef) local_unnamed_addr #1

declare void @fe25519_invert_useProvidedScratchBuffers(ptr noundef, ptr noundef, ptr noundef, ptr noundef, ptr noundef) local_unnamed_addr #2

declare void @fe25519_mul_asm(ptr noundef, ptr noundef, ptr noundef) local_unnamed_addr #2

declare void @fe25519_reduceCompletely(ptr noundef) local_unnamed_addr #2

; Function Attrs: nounwind uwtable
declare hidden void @maskScalarBitsWithRandomAndCswap(ptr noundef, i32 noundef, i32 noundef) local_unnamed_addr #1

; Function Attrs: nounwind uwtable
declare hidden void @curve25519_ladderstep(ptr noundef) local_unnamed_addr #1

; Function Attrs: nounwind uwtable
declare hidden void @computeY_curve25519_projective(ptr noundef, ptr noundef, ptr noundef, ptr noundef, ptr noundef, ptr noundef, ptr noundef) local_unnamed_addr #1

declare void @fe25519_neg(ptr noundef, ptr noundef) local_unnamed_addr #2

declare void @fe25519_pack(ptr noundef, ptr noundef) local_unnamed_addr #2

; Function Attrs: nocallback nofree nosync nounwind speculatable willreturn memory(none)
declare i32 @llvm.fshl.i32(i32, i32, i32) #3

; Function Attrs: nocallback nofree nosync nounwind speculatable willreturn memory(none)
declare <4 x i32> @llvm.fshl.v4i32(<4 x i32>, <4 x i32>, <4 x i32>) #3

attributes #0 = { mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite) }
attributes #1 = { nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #2 = { "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #3 = { nocallback nofree nosync nounwind speculatable willreturn memory(none) }
attributes #4 = { nounwind }

!llvm.module.flags = !{!0, !1, !2, !3}
!llvm.ident = !{!4}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{i32 8, !"PIC Level", i32 2}
!2 = !{i32 7, !"PIE Level", i32 2}
!3 = !{i32 7, !"uwtable", i32 2}
!4 = !{!"clang version 19.1.0 (git@github.com:llvm/llvm-project.git a4bf6cd7cfb1a1421ba92bca9d017b49936c55e4)"}
!5 = !{!6, !6, i64 0}
!6 = !{!"int", !7, i64 0}
!7 = !{!"omnipotent char", !8, i64 0}
!8 = !{!"Simple C/C++ TBAA"}
!9 = !{!7, !7, i64 0}
!10 = !{!11, !12, i64 0}
!11 = !{!"", !12, i64 0, !12, i64 8, !12, i64 16}
!12 = !{!"any pointer", !7, i64 0}
!13 = !{!11, !12, i64 8}
!14 = !{!11, !12, i64 16}
!15 = distinct !{!15, !16}
!16 = !{!"llvm.loop.mustprogress"}
!17 = !{!18, !6, i64 224}
!18 = !{!"_ST_curve25519ladderstepWorkingState", !7, i64 0, !7, i64 32, !7, i64 64, !7, i64 96, !7, i64 128, !7, i64 160, !7, i64 192, !6, i64 224, !7, i64 228}
!19 = distinct !{!19, !16}
!20 = distinct !{!20, !16}


; Effective O3 passes: CorrelatedValuePropagationPass,DSEPass,EarlyCSEPass,GVNPass,GlobalOptPass,IPSCCPPass,IndVarSimplifyPass,InferAlignmentPass,InferFunctionAttrsPass,InstCombinePass,InstSimplifyPass,JumpThreadingPass,LCSSAPass,LICMPass,LoopRotatePass,LoopSimplifyPass,LoopUnrollPass,ReassociatePass,SLPVectorizerPass,SROAPass,SimplifyCFGPass,TailCallElimPass