; LLVM IR from sca-secure-library-sca25519/sca25519 :: cw/sca25519_cw_eph/crypto/scalarmult (scalarmult_25519)

; Unoptimized IR (clang -disable-llvm-passes):
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

%struct._ST_curve25519ladderstepWorkingState = type { %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, i32, i8 }
%union.UN_256bitValue_ = type { [4 x %union.UN_64bitValue_] }
%union.UN_64bitValue_ = type { [1 x i64] }
%union.UN_512bitValue_ = type { [8 x i64] }

; Function Attrs: nounwind uwtable
define dso_local i32 @crypto_scalarmult_curve25519(ptr noundef %0, ptr noundef %1, ptr noundef %2) #0 {
  %4 = alloca ptr, align 8
  %5 = alloca ptr, align 8
  %6 = alloca ptr, align 8
  %7 = alloca %struct._ST_curve25519ladderstepWorkingState, align 8
  %8 = alloca i8, align 1
  %9 = alloca i8, align 1
  %10 = alloca i32, align 4
  %11 = alloca %union.UN_512bitValue_, align 8
  %12 = alloca i32, align 4
  %13 = alloca i32, align 4
  %14 = alloca i32, align 4
  %15 = alloca i8, align 1
  %16 = alloca i8, align 1
  store ptr %0, ptr %4, align 8, !tbaa !5
  store ptr %1, ptr %5, align 8, !tbaa !5
  store ptr %2, ptr %6, align 8, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 232, ptr %7) #3
  call void @llvm.lifetime.start.p0(i64 1, ptr %8) #3
  call void @llvm.lifetime.start.p0(i64 1, ptr %9) #3
  store volatile i8 -1, ptr %9, align 1, !tbaa !9
  call void @llvm.lifetime.start.p0(i64 4, ptr %10) #3
  store volatile i32 0, ptr %10, align 4, !tbaa !10
  %17 = load ptr, ptr %4, align 8, !tbaa !5
  call void @randombytes(ptr noundef %17, i64 noundef 32)
  store i8 0, ptr %8, align 1, !tbaa !9
  br label %18

18:                                               ; preds = %32, %3
  %19 = load i8, ptr %8, align 1, !tbaa !9
  %20 = zext i8 %19 to i32
  %21 = icmp slt i32 %20, 32
  br i1 %21, label %22, label %35

22:                                               ; preds = %18
  %23 = load ptr, ptr %5, align 8, !tbaa !5
  %24 = load i8, ptr %8, align 1, !tbaa !9
  %25 = zext i8 %24 to i64
  %26 = getelementptr inbounds i8, ptr %23, i64 %25
  %27 = load i8, ptr %26, align 1, !tbaa !9
  %28 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 6
  %29 = load i8, ptr %8, align 1, !tbaa !9
  %30 = zext i8 %29 to i64
  %31 = getelementptr inbounds [32 x i8], ptr %28, i64 0, i64 %30
  store i8 %27, ptr %31, align 1, !tbaa !9
  br label %32

32:                                               ; preds = %22
  %33 = load i8, ptr %8, align 1, !tbaa !9
  %34 = add i8 %33, 1
  store i8 %34, ptr %8, align 1, !tbaa !9
  br label %18, !llvm.loop !12

35:                                               ; preds = %18
  %36 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 0
  %37 = load ptr, ptr %6, align 8, !tbaa !5
  call void @fe25519_unpack(ptr noundef %36, ptr noundef %37)
  %38 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 3
  call void @fe25519_setone(ptr noundef %38)
  %39 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 4
  call void @fe25519_setzero(ptr noundef %39)
  %40 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 1
  %41 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 0
  call void @fe25519_cpy(ptr noundef %40, ptr noundef %41)
  %42 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 2
  call void @fe25519_setone(ptr noundef %42)
  %43 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 6
  %44 = getelementptr inbounds [32 x i8], ptr %43, i64 0, i64 31
  %45 = load i8, ptr %44, align 1, !tbaa !9
  %46 = zext i8 %45 to i32
  %47 = and i32 %46, 127
  %48 = trunc i32 %47 to i8
  store i8 %48, ptr %44, align 1, !tbaa !9
  %49 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 6
  %50 = getelementptr inbounds [32 x i8], ptr %49, i64 0, i64 31
  %51 = load i8, ptr %50, align 1, !tbaa !9
  %52 = zext i8 %51 to i32
  %53 = or i32 %52, 64
  %54 = trunc i32 %53 to i8
  store i8 %54, ptr %50, align 1, !tbaa !9
  %55 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 6
  call void @shiftRightOne(ptr noundef %55)
  %56 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 6
  call void @shiftRightOne(ptr noundef %56)
  %57 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 6
  call void @shiftRightOne(ptr noundef %57)
  %58 = load volatile i32, ptr %10, align 4, !tbaa !10
  %59 = add i32 %58, 163
  store volatile i32 %59, ptr %10, align 4, !tbaa !10
  call void @curve25519_doublePointP(ptr noundef %7)
  call void @curve25519_doublePointP(ptr noundef %7)
  call void @curve25519_doublePointP(ptr noundef %7)
  %60 = load volatile i32, ptr %10, align 4, !tbaa !10
  %61 = add i32 %60, 163
  store volatile i32 %61, ptr %10, align 4, !tbaa !10
  %62 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 2
  %63 = call i32 @fe25519_iszero(ptr noundef %62)
  %64 = icmp ne i32 %63, 0
  br i1 %64, label %66, label %65

65:                                               ; preds = %35
  br label %201

66:                                               ; preds = %35
  %67 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 2
  %68 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 2
  %69 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 3
  %70 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 4
  %71 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 0
  call void @fe25519_invert_useProvidedScratchBuffers(ptr noundef %67, ptr noundef %68, ptr noundef %69, ptr noundef %70, ptr noundef %71)
  %72 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 1
  %73 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 1
  %74 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 2
  call void @fe25519_mul_asm(ptr noundef %72, ptr noundef %73, ptr noundef %74)
  %75 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 1
  call void @fe25519_reduceCompletely(ptr noundef %75)
  %76 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 0
  %77 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 1
  call void @fe25519_cpy(ptr noundef %76, ptr noundef %77)
  %78 = getelementptr inbounds [64 x i8], ptr %11, i64 0, i64 0
  call void @randombytes(ptr noundef %78, i64 noundef 64)
  %79 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 2
  call void @fe25519_reduceTo256Bits_asm(ptr noundef %79, ptr noundef %11)
  %80 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 2
  call void @fe25519_reduceCompletely(ptr noundef %80)
  %81 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 2
  %82 = getelementptr inbounds [32 x i8], ptr %81, i64 0, i64 31
  %83 = load i8, ptr %82, align 1, !tbaa !9
  %84 = zext i8 %83 to i32
  %85 = or i32 %84, 128
  %86 = trunc i32 %85 to i8
  store i8 %86, ptr %82, align 1, !tbaa !9
  %87 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 1
  %88 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 2
  %89 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 0
  call void @fe25519_mul_asm(ptr noundef %87, ptr noundef %88, ptr noundef %89)
  %90 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 3
  call void @fe25519_setone(ptr noundef %90)
  %91 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 4
  call void @fe25519_setzero(ptr noundef %91)
  call void @curve25519_ladderstep(ptr noundef %7)
  %92 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 7
  store i32 251, ptr %92, align 8, !tbaa !14
  store i8 7, ptr %8, align 1, !tbaa !9
  br label %93

93:                                               ; preds = %142, %66
  %94 = load i8, ptr %8, align 1, !tbaa !9
  %95 = zext i8 %94 to i32
  %96 = icmp sge i32 %95, 1
  br i1 %96, label %97, label %145

97:                                               ; preds = %93
  call void @llvm.lifetime.start.p0(i64 4, ptr %12) #3
  %98 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 6
  %99 = load i8, ptr %8, align 1, !tbaa !9
  %100 = zext i8 %99 to i64
  %101 = getelementptr inbounds [8 x i32], ptr %98, i64 0, i64 %100
  %102 = load i32, ptr %101, align 4, !tbaa !9
  store i32 %102, ptr %12, align 4, !tbaa !10
  call void @llvm.lifetime.start.p0(i64 4, ptr %13) #3
  %103 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 6
  %104 = load i8, ptr %8, align 1, !tbaa !9
  %105 = zext i8 %104 to i32
  %106 = sub nsw i32 %105, 1
  %107 = sext i32 %106 to i64
  %108 = getelementptr inbounds [8 x i32], ptr %103, i64 0, i64 %107
  %109 = load i32, ptr %108, align 4, !tbaa !9
  store i32 %109, ptr %13, align 4, !tbaa !10
  call void @llvm.lifetime.start.p0(i64 4, ptr %14) #3
  %110 = load i32, ptr %12, align 4, !tbaa !10
  %111 = shl i32 %110, 1
  %112 = load i32, ptr %12, align 4, !tbaa !10
  %113 = xor i32 %111, %112
  store i32 %113, ptr %14, align 4, !tbaa !10
  %114 = load i32, ptr %14, align 4, !tbaa !10
  %115 = lshr i32 %114, 16
  %116 = trunc i32 %115 to i16
  %117 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 6
  %118 = load i8, ptr %8, align 1, !tbaa !9
  %119 = zext i8 %118 to i32
  %120 = mul nsw i32 2, %119
  %121 = add nsw i32 %120, 1
  %122 = sext i32 %121 to i64
  %123 = getelementptr inbounds [16 x i16], ptr %117, i64 0, i64 %122
  store i16 %116, ptr %123, align 2, !tbaa !9
  %124 = load i32, ptr %12, align 4, !tbaa !10
  %125 = shl i32 %124, 16
  %126 = load i32, ptr %13, align 4, !tbaa !10
  %127 = lshr i32 %126, 16
  %128 = or i32 %125, %127
  store i32 %128, ptr %12, align 4, !tbaa !10
  %129 = load i32, ptr %12, align 4, !tbaa !10
  %130 = shl i32 %129, 1
  %131 = load i32, ptr %12, align 4, !tbaa !10
  %132 = xor i32 %131, %130
  store i32 %132, ptr %12, align 4, !tbaa !10
  %133 = load i32, ptr %12, align 4, !tbaa !10
  %134 = lshr i32 %133, 16
  %135 = trunc i32 %134 to i16
  %136 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 6
  %137 = load i8, ptr %8, align 1, !tbaa !9
  %138 = zext i8 %137 to i32
  %139 = mul nsw i32 2, %138
  %140 = sext i32 %139 to i64
  %141 = getelementptr inbounds [16 x i16], ptr %136, i64 0, i64 %140
  store i16 %135, ptr %141, align 2, !tbaa !9
  call void @llvm.lifetime.end.p0(i64 4, ptr %14) #3
  call void @llvm.lifetime.end.p0(i64 4, ptr %13) #3
  call void @llvm.lifetime.end.p0(i64 4, ptr %12) #3
  br label %142

142:                                              ; preds = %97
  %143 = load i8, ptr %8, align 1, !tbaa !9
  %144 = add i8 %143, -1
  store i8 %144, ptr %8, align 1, !tbaa !9
  br label %93, !llvm.loop !16

145:                                              ; preds = %93
  %146 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 6
  %147 = getelementptr inbounds [8 x i32], ptr %146, i64 0, i64 0
  %148 = load i32, ptr %147, align 8, !tbaa !9
  %149 = shl i32 %148, 1
  %150 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 6
  %151 = getelementptr inbounds [8 x i32], ptr %150, i64 0, i64 0
  %152 = load i32, ptr %151, align 8, !tbaa !9
  %153 = xor i32 %152, %149
  store i32 %153, ptr %151, align 8, !tbaa !9
  %154 = load volatile i32, ptr %10, align 4, !tbaa !10
  %155 = add i32 %154, 163
  store volatile i32 %155, ptr %10, align 4, !tbaa !10
  br label %156

156:                                              ; preds = %182, %145
  %157 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 7
  %158 = load i32, ptr %157, align 8, !tbaa !14
  %159 = icmp sge i32 %158, 0
  br i1 %159, label %160, label %186

160:                                              ; preds = %156
  call void @llvm.lifetime.start.p0(i64 1, ptr %15) #3
  %161 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 7
  %162 = load i32, ptr %161, align 8, !tbaa !14
  %163 = ashr i32 %162, 5
  %164 = trunc i32 %163 to i8
  store i8 %164, ptr %15, align 1, !tbaa !9
  call void @llvm.lifetime.start.p0(i64 1, ptr %16) #3
  %165 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 7
  %166 = load i32, ptr %165, align 8, !tbaa !14
  %167 = and i32 %166, 31
  %168 = trunc i32 %167 to i8
  store i8 %168, ptr %16, align 1, !tbaa !9
  %169 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 6
  %170 = load i8, ptr %15, align 1, !tbaa !9
  %171 = zext i8 %170 to i64
  %172 = getelementptr inbounds [8 x i32], ptr %169, i64 0, i64 %171
  %173 = load i32, ptr %172, align 4, !tbaa !9
  %174 = load i8, ptr %16, align 1, !tbaa !9
  %175 = zext i8 %174 to i32
  call void @maskScalarBitsWithRandomAndCswap(ptr noundef %7, i32 noundef %173, i32 noundef %175)
  call void @llvm.lifetime.end.p0(i64 1, ptr %16) #3
  call void @llvm.lifetime.end.p0(i64 1, ptr %15) #3
  %176 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 7
  %177 = load i32, ptr %176, align 8, !tbaa !14
  %178 = icmp sge i32 %177, 1
  br i1 %178, label %179, label %182

179:                                              ; preds = %160
  call void @curve25519_ladderstep(ptr noundef %7)
  %180 = load volatile i32, ptr %10, align 4, !tbaa !10
  %181 = add i32 %180, 9
  store volatile i32 %181, ptr %10, align 4, !tbaa !10
  br label %182

182:                                              ; preds = %179, %160
  %183 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 7
  %184 = load i32, ptr %183, align 8, !tbaa !14
  %185 = add nsw i32 %184, -1
  store i32 %185, ptr %183, align 8, !tbaa !14
  br label %156, !llvm.loop !17

186:                                              ; preds = %156
  %187 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 2
  %188 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 2
  %189 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 3
  %190 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 4
  %191 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 0
  call void @fe25519_invert_useProvidedScratchBuffers(ptr noundef %187, ptr noundef %188, ptr noundef %189, ptr noundef %190, ptr noundef %191)
  %192 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 1
  %193 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 1
  %194 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 2
  call void @fe25519_mul_asm(ptr noundef %192, ptr noundef %193, ptr noundef %194)
  %195 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 1
  call void @fe25519_reduceCompletely(ptr noundef %195)
  %196 = load volatile i32, ptr %10, align 4, !tbaa !10
  %197 = add i32 %196, 163
  store volatile i32 %197, ptr %10, align 4, !tbaa !10
  %198 = load volatile i32, ptr %10, align 4, !tbaa !10
  %199 = icmp ne i32 %198, 2911
  br i1 %199, label %200, label %204

200:                                              ; preds = %186
  br label %201

201:                                              ; preds = %200, %65
  store volatile i8 -1, ptr %9, align 1, !tbaa !9
  %202 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 1
  %203 = getelementptr inbounds [32 x i8], ptr %202, i64 0, i64 0
  call void @randombytes(ptr noundef %203, i64 noundef 32)
  br label %205

204:                                              ; preds = %186
  store volatile i8 0, ptr %9, align 1, !tbaa !9
  br label %205

205:                                              ; preds = %204, %201
  %206 = load ptr, ptr %4, align 8, !tbaa !5
  %207 = getelementptr inbounds %struct._ST_curve25519ladderstepWorkingState, ptr %7, i32 0, i32 1
  call void @fe25519_pack(ptr noundef %206, ptr noundef %207)
  %208 = load volatile i8, ptr %9, align 1, !tbaa !9
  %209 = zext i8 %208 to i32
  call void @llvm.lifetime.end.p0(i64 4, ptr %10) #3
  call void @llvm.lifetime.end.p0(i64 1, ptr %9) #3
  call void @llvm.lifetime.end.p0(i64 1, ptr %8) #3
  call void @llvm.lifetime.end.p0(i64 232, ptr %7) #3
  ret i32 %209
}

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.start.p0(i64 immarg, ptr nocapture) #1

declare void @randombytes(ptr noundef, i64 noundef) #2

declare void @fe25519_unpack(ptr noundef, ptr noundef) #2

declare void @fe25519_setone(ptr noundef) #2

declare void @fe25519_setzero(ptr noundef) #2

declare void @fe25519_cpy(ptr noundef, ptr noundef) #2

declare void @shiftRightOne(ptr noundef) #2

; Function Attrs: nounwind uwtable
declare hidden void @curve25519_doublePointP(ptr noundef) #0

declare i32 @fe25519_iszero(ptr noundef) #2

declare void @fe25519_invert_useProvidedScratchBuffers(ptr noundef, ptr noundef, ptr noundef, ptr noundef, ptr noundef) #2

declare void @fe25519_mul_asm(ptr noundef, ptr noundef, ptr noundef) #2

declare void @fe25519_reduceCompletely(ptr noundef) #2

declare void @fe25519_reduceTo256Bits_asm(ptr noundef, ptr noundef) #2

; Function Attrs: nounwind uwtable
declare hidden void @curve25519_ladderstep(ptr noundef) #0

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.end.p0(i64 immarg, ptr nocapture) #1

; Function Attrs: nounwind uwtable
declare hidden void @maskScalarBitsWithRandomAndCswap(ptr noundef, i32 noundef, i32 noundef) #0

declare void @fe25519_pack(ptr noundef, ptr noundef) #2

attributes #0 = { nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #1 = { nocallback nofree nosync nounwind willreturn memory(argmem: readwrite) }
attributes #2 = { "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #3 = { nounwind }

!llvm.module.flags = !{!0, !1, !2, !3}
!llvm.ident = !{!4}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{i32 8, !"PIC Level", i32 2}
!2 = !{i32 7, !"PIE Level", i32 2}
!3 = !{i32 7, !"uwtable", i32 2}
!4 = !{!"clang version 19.1.0 (git@github.com:llvm/llvm-project.git a4bf6cd7cfb1a1421ba92bca9d017b49936c55e4)"}
!5 = !{!6, !6, i64 0}
!6 = !{!"any pointer", !7, i64 0}
!7 = !{!"omnipotent char", !8, i64 0}
!8 = !{!"Simple C/C++ TBAA"}
!9 = !{!7, !7, i64 0}
!10 = !{!11, !11, i64 0}
!11 = !{!"int", !7, i64 0}
!12 = distinct !{!12, !13}
!13 = !{!"llvm.loop.mustprogress"}
!14 = !{!15, !11, i64 224}
!15 = !{!"_ST_curve25519ladderstepWorkingState", !7, i64 0, !7, i64 32, !7, i64 64, !7, i64 96, !7, i64 128, !7, i64 160, !7, i64 192, !11, i64 224, !7, i64 228}
!16 = distinct !{!16, !13}
!17 = distinct !{!17, !13}


; Optimized IR (opt -passes='default<O3>'):
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

%struct._ST_curve25519ladderstepWorkingState = type { %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, %union.UN_256bitValue_, i32, i8 }
%union.UN_256bitValue_ = type { [4 x %union.UN_64bitValue_] }
%union.UN_64bitValue_ = type { [1 x i64] }
%union.UN_512bitValue_ = type { [8 x i64] }

; Function Attrs: nounwind uwtable
define dso_local range(i32 0, 256) i32 @crypto_scalarmult_curve25519(ptr noundef %0, ptr nocapture noundef readonly %1, ptr noundef %2) local_unnamed_addr #0 {
  %4 = alloca %struct._ST_curve25519ladderstepWorkingState, align 8
  %5 = alloca i8, align 1
  %6 = alloca i32, align 4
  %7 = alloca %union.UN_512bitValue_, align 8
  call void @llvm.lifetime.start.p0(i64 232, ptr nonnull %4) #5
  call void @llvm.lifetime.start.p0(i64 1, ptr nonnull %5)
  store volatile i8 -1, ptr %5, align 1, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 4, ptr nonnull %6)
  store volatile i32 0, ptr %6, align 4, !tbaa !8
  tail call void @randombytes(ptr noundef %0, i64 noundef 32) #5
  %8 = getelementptr inbounds i8, ptr %4, i64 192
  call void @llvm.memcpy.p0.p0.i64(ptr noundef nonnull align 8 dereferenceable(32) %8, ptr noundef nonnull align 1 dereferenceable(32) %1, i64 32, i1 false), !tbaa !5
  call void @fe25519_unpack(ptr noundef nonnull %4, ptr noundef %2) #5
  %9 = getelementptr inbounds i8, ptr %4, i64 96
  call void @fe25519_setone(ptr noundef nonnull %9) #5
  %10 = getelementptr inbounds i8, ptr %4, i64 128
  call void @fe25519_setzero(ptr noundef nonnull %10) #5
  %11 = getelementptr inbounds i8, ptr %4, i64 32
  call void @fe25519_cpy(ptr noundef nonnull %11, ptr noundef nonnull %4) #5
  %12 = getelementptr inbounds i8, ptr %4, i64 64
  call void @fe25519_setone(ptr noundef nonnull %12) #5
  %13 = getelementptr inbounds i8, ptr %4, i64 223
  %14 = load i8, ptr %13, align 1, !tbaa !5
  %15 = and i8 %14, 63
  %16 = or disjoint i8 %15, 64
  store i8 %16, ptr %13, align 1, !tbaa !5
  call void @shiftRightOne(ptr noundef nonnull %8) #5
  call void @shiftRightOne(ptr noundef nonnull %8) #5
  call void @shiftRightOne(ptr noundef nonnull %8) #5
  %.0..0..0..0. = load volatile i32, ptr %6, align 4, !tbaa !8
  %17 = add i32 %.0..0..0..0., 163
  store volatile i32 %17, ptr %6, align 4, !tbaa !8
  call void @curve25519_doublePointP(ptr noundef nonnull %4)
  call void @curve25519_doublePointP(ptr noundef nonnull %4)
  call void @curve25519_doublePointP(ptr noundef nonnull %4)
  %.0..0..0..0.10 = load volatile i32, ptr %6, align 4, !tbaa !8
  %18 = add i32 %.0..0..0..0.10, 163
  store volatile i32 %18, ptr %6, align 4, !tbaa !8
  %19 = call i32 @fe25519_iszero(ptr noundef nonnull %12) #5
  %.not = icmp eq i32 %19, 0
  br i1 %.not, label %95, label %20

20:                                               ; preds = %3
  call void @fe25519_invert_useProvidedScratchBuffers(ptr noundef nonnull %12, ptr noundef nonnull %12, ptr noundef nonnull %9, ptr noundef nonnull %10, ptr noundef nonnull %4) #5
  call void @fe25519_mul_asm(ptr noundef nonnull %11, ptr noundef nonnull %11, ptr noundef nonnull %12) #5
  call void @fe25519_reduceCompletely(ptr noundef nonnull %11) #5
  call void @fe25519_cpy(ptr noundef nonnull %4, ptr noundef nonnull %11) #5
  call void @randombytes(ptr noundef nonnull %7, i64 noundef 64) #5
  call void @fe25519_reduceTo256Bits_asm(ptr noundef nonnull %12, ptr noundef nonnull %7) #5
  call void @fe25519_reduceCompletely(ptr noundef nonnull %12) #5
  %21 = getelementptr inbounds i8, ptr %4, i64 95
  %22 = load i8, ptr %21, align 1, !tbaa !5
  %23 = or i8 %22, -128
  store i8 %23, ptr %21, align 1, !tbaa !5
  call void @fe25519_mul_asm(ptr noundef nonnull %11, ptr noundef nonnull %12, ptr noundef nonnull %4) #5
  call void @fe25519_setone(ptr noundef nonnull %9) #5
  call void @fe25519_setzero(ptr noundef nonnull %10) #5
  call void @curve25519_ladderstep(ptr noundef nonnull %4)
  %24 = getelementptr inbounds i8, ptr %4, i64 224
  store i32 251, ptr %24, align 8, !tbaa !10
  %25 = getelementptr inbounds i8, ptr %4, i64 220
  %26 = load i32, ptr %25, align 4, !tbaa !5
  %27 = getelementptr inbounds i8, ptr %4, i64 216
  %28 = load i32, ptr %27, align 8, !tbaa !5
  %29 = shl i32 %26, 1
  %30 = xor i32 %29, %26
  %31 = lshr i32 %30, 16
  %32 = trunc nuw i32 %31 to i16
  %33 = getelementptr inbounds i8, ptr %4, i64 222
  store i16 %32, ptr %33, align 2, !tbaa !5
  %34 = call i32 @llvm.fshl.i32(i32 %26, i32 %28, i32 16)
  %35 = shl i32 %34, 1
  %36 = xor i32 %35, %34
  %37 = lshr i32 %36, 16
  %38 = trunc nuw i32 %37 to i16
  store i16 %38, ptr %25, align 4, !tbaa !5
  %39 = getelementptr inbounds i8, ptr %4, i64 212
  %40 = load i32, ptr %39, align 4, !tbaa !5
  %41 = call i32 @llvm.fshl.i32(i32 %28, i32 %40, i32 16)
  %42 = getelementptr inbounds i8, ptr %4, i64 208
  %43 = load i32, ptr %42, align 8, !tbaa !5
  %44 = call i32 @llvm.fshl.i32(i32 %40, i32 %43, i32 16)
  %45 = insertelement <4 x i32> poison, i32 %44, i64 0
  %46 = insertelement <4 x i32> %45, i32 %40, i64 1
  %47 = insertelement <4 x i32> %46, i32 %41, i64 2
  %48 = insertelement <4 x i32> %47, i32 %28, i64 3
  %49 = shl <4 x i32> %48, <i32 1, i32 1, i32 1, i32 1>
  %50 = xor <4 x i32> %49, %48
  %51 = lshr <4 x i32> %50, <i32 16, i32 16, i32 16, i32 16>
  %52 = trunc nuw <4 x i32> %51 to <4 x i16>
  store <4 x i16> %52, ptr %39, align 4, !tbaa !5
  %53 = getelementptr inbounds i8, ptr %4, i64 204
  %54 = load i32, ptr %53, align 4, !tbaa !5
  %55 = call i32 @llvm.fshl.i32(i32 %43, i32 %54, i32 16)
  %56 = getelementptr inbounds i8, ptr %4, i64 200
  %57 = load i32, ptr %56, align 8, !tbaa !5
  %58 = call i32 @llvm.fshl.i32(i32 %54, i32 %57, i32 16)
  %59 = getelementptr inbounds i8, ptr %4, i64 196
  %60 = load i32, ptr %59, align 4, !tbaa !5
  %61 = call i32 @llvm.fshl.i32(i32 %57, i32 %60, i32 16)
  %62 = load i32, ptr %8, align 8, !tbaa !5
  %63 = call i32 @llvm.fshl.i32(i32 %60, i32 %62, i32 16)
  %64 = insertelement <8 x i32> poison, i32 %63, i64 0
  %65 = insertelement <8 x i32> %64, i32 %60, i64 1
  %66 = insertelement <8 x i32> %65, i32 %61, i64 2
  %67 = insertelement <8 x i32> %66, i32 %57, i64 3
  %68 = insertelement <8 x i32> %67, i32 %58, i64 4
  %69 = insertelement <8 x i32> %68, i32 %54, i64 5
  %70 = insertelement <8 x i32> %69, i32 %55, i64 6
  %71 = insertelement <8 x i32> %70, i32 %43, i64 7
  %72 = shl <8 x i32> %71, <i32 1, i32 1, i32 1, i32 1, i32 1, i32 1, i32 1, i32 1>
  %73 = xor <8 x i32> %72, %71
  %74 = lshr <8 x i32> %73, <i32 16, i32 16, i32 16, i32 16, i32 16, i32 16, i32 16, i32 16>
  %75 = trunc nuw <8 x i32> %74 to <8 x i16>
  store <8 x i16> %75, ptr %59, align 4, !tbaa !5
  %76 = shl i32 %62, 1
  %77 = xor i32 %76, %62
  store i32 %77, ptr %8, align 8, !tbaa !5
  %.0..0..0..0.11 = load volatile i32, ptr %6, align 4, !tbaa !8
  %78 = add i32 %.0..0..0..0.11, 163
  store volatile i32 %78, ptr %6, align 4, !tbaa !8
  %.pr = load i32, ptr %24, align 8, !tbaa !10
  %79 = icmp sgt i32 %.pr, -1
  br i1 %79, label %.lr.ph, label %._crit_edge

.lr.ph:                                           ; preds = %20, %90
  %80 = phi i32 [ %92, %90 ], [ %.pr, %20 ]
  %81 = lshr i32 %80, 5
  %82 = and i32 %80, 31
  %83 = and i32 %81, 255
  %84 = zext nneg i32 %83 to i64
  %85 = getelementptr inbounds [8 x i32], ptr %8, i64 0, i64 %84
  %86 = load i32, ptr %85, align 4, !tbaa !5
  call void @maskScalarBitsWithRandomAndCswap(ptr noundef nonnull %4, i32 noundef %86, i32 noundef %82)
  %87 = load i32, ptr %24, align 8, !tbaa !10
  %88 = icmp sgt i32 %87, 0
  br i1 %88, label %90, label %.thread

.thread:                                          ; preds = %.lr.ph
  %89 = add nsw i32 %87, -1
  store i32 %89, ptr %24, align 8, !tbaa !10
  br label %._crit_edge

90:                                               ; preds = %.lr.ph
  call void @curve25519_ladderstep(ptr noundef nonnull %4)
  %.0..0..0..0.12 = load volatile i32, ptr %6, align 4, !tbaa !8
  %91 = add i32 %.0..0..0..0.12, 9
  store volatile i32 %91, ptr %6, align 4, !tbaa !8
  %.pre = load i32, ptr %24, align 8, !tbaa !10
  %92 = add nsw i32 %.pre, -1
  store i32 %92, ptr %24, align 8, !tbaa !10
  %93 = icmp sgt i32 %.pre, 0
  br i1 %93, label %.lr.ph, label %._crit_edge, !llvm.loop !12

._crit_edge:                                      ; preds = %90, %.thread, %20
  call void @fe25519_invert_useProvidedScratchBuffers(ptr noundef nonnull %12, ptr noundef nonnull %12, ptr noundef nonnull %9, ptr noundef nonnull %10, ptr noundef nonnull %4) #5
  call void @fe25519_mul_asm(ptr noundef nonnull %11, ptr noundef nonnull %11, ptr noundef nonnull %12) #5
  call void @fe25519_reduceCompletely(ptr noundef nonnull %11) #5
  %.0..0..0..0.13 = load volatile i32, ptr %6, align 4, !tbaa !8
  %94 = add i32 %.0..0..0..0.13, 163
  store volatile i32 %94, ptr %6, align 4, !tbaa !8
  %.0..0..0..0.14 = load volatile i32, ptr %6, align 4, !tbaa !8
  %.not33 = icmp eq i32 %.0..0..0..0.14, 2911
  br i1 %.not33, label %96, label %95

95:                                               ; preds = %._crit_edge, %3
  store volatile i8 -1, ptr %5, align 1, !tbaa !5
  call void @randombytes(ptr noundef nonnull %11, i64 noundef 32) #5
  br label %97

96:                                               ; preds = %._crit_edge
  store volatile i8 0, ptr %5, align 1, !tbaa !5
  br label %97

97:                                               ; preds = %96, %95
  call void @fe25519_pack(ptr noundef %0, ptr noundef nonnull %11) #5
  %.0..0..0..0.15 = load volatile i8, ptr %5, align 1, !tbaa !5
  %98 = zext i8 %.0..0..0..0.15 to i32
  call void @llvm.lifetime.end.p0(i64 4, ptr nonnull %6)
  call void @llvm.lifetime.end.p0(i64 1, ptr nonnull %5)
  call void @llvm.lifetime.end.p0(i64 232, ptr nonnull %4) #5
  ret i32 %98
}

; Function Attrs: mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.start.p0(i64 immarg, ptr nocapture) #1

declare void @randombytes(ptr noundef, i64 noundef) local_unnamed_addr #2

declare void @fe25519_unpack(ptr noundef, ptr noundef) local_unnamed_addr #2

declare void @fe25519_setone(ptr noundef) local_unnamed_addr #2

declare void @fe25519_setzero(ptr noundef) local_unnamed_addr #2

declare void @fe25519_cpy(ptr noundef, ptr noundef) local_unnamed_addr #2

declare void @shiftRightOne(ptr noundef) local_unnamed_addr #2

; Function Attrs: nounwind uwtable
declare hidden void @curve25519_doublePointP(ptr noundef) local_unnamed_addr #0

declare i32 @fe25519_iszero(ptr noundef) local_unnamed_addr #2

declare void @fe25519_invert_useProvidedScratchBuffers(ptr noundef, ptr noundef, ptr noundef, ptr noundef, ptr noundef) local_unnamed_addr #2

declare void @fe25519_mul_asm(ptr noundef, ptr noundef, ptr noundef) local_unnamed_addr #2

declare void @fe25519_reduceCompletely(ptr noundef) local_unnamed_addr #2

declare void @fe25519_reduceTo256Bits_asm(ptr noundef, ptr noundef) local_unnamed_addr #2

; Function Attrs: nounwind uwtable
declare hidden void @curve25519_ladderstep(ptr noundef) local_unnamed_addr #0

; Function Attrs: mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.end.p0(i64 immarg, ptr nocapture) #1

; Function Attrs: nounwind uwtable
declare hidden void @maskScalarBitsWithRandomAndCswap(ptr noundef, i32 noundef, i32 noundef) local_unnamed_addr #0

declare void @fe25519_pack(ptr noundef, ptr noundef) local_unnamed_addr #2

; Function Attrs: nocallback nofree nosync nounwind speculatable willreturn memory(none)
declare i32 @llvm.fshl.i32(i32, i32, i32) #3

; Function Attrs: nocallback nofree nounwind willreturn memory(argmem: readwrite)
declare void @llvm.memcpy.p0.p0.i64(ptr noalias nocapture writeonly, ptr noalias nocapture readonly, i64, i1 immarg) #4

attributes #0 = { nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #1 = { mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite) }
attributes #2 = { "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #3 = { nocallback nofree nosync nounwind speculatable willreturn memory(none) }
attributes #4 = { nocallback nofree nounwind willreturn memory(argmem: readwrite) }
attributes #5 = { nounwind }

!llvm.module.flags = !{!0, !1, !2, !3}
!llvm.ident = !{!4}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{i32 8, !"PIC Level", i32 2}
!2 = !{i32 7, !"PIE Level", i32 2}
!3 = !{i32 7, !"uwtable", i32 2}
!4 = !{!"clang version 19.1.0 (git@github.com:llvm/llvm-project.git a4bf6cd7cfb1a1421ba92bca9d017b49936c55e4)"}
!5 = !{!6, !6, i64 0}
!6 = !{!"omnipotent char", !7, i64 0}
!7 = !{!"Simple C/C++ TBAA"}
!8 = !{!9, !9, i64 0}
!9 = !{!"int", !6, i64 0}
!10 = !{!11, !9, i64 224}
!11 = !{!"_ST_curve25519ladderstepWorkingState", !6, i64 0, !6, i64 32, !6, i64 64, !6, i64 96, !6, i64 128, !6, i64 160, !6, i64 192, !9, i64 224, !6, i64 228}
!12 = distinct !{!12, !13}
!13 = !{!"llvm.loop.mustprogress"}


; Effective O3 passes: CorrelatedValuePropagationPass,EarlyCSEPass,GVNPass,GlobalOptPass,IPSCCPPass,IndVarSimplifyPass,InferAlignmentPass,InferFunctionAttrsPass,InstCombinePass,InstSimplifyPass,JumpThreadingPass,LCSSAPass,LICMPass,LoopIdiomRecognizePass,LoopRotatePass,LoopSimplifyPass,LoopUnrollPass,PostOrderFunctionAttrsPass,ReassociatePass,SLPVectorizerPass,SROAPass,SimplifyCFGPass,TailCallElimPass