#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ crypto_hash_sha512_tweet(unsigned char *,
                                            unsigned char const *, int);
int /*<<< orphan*/ explicit_memzero(unsigned char *, int);
int crypto_sign_ed25519_sk_to_curve25519(unsigned char *curve25519_sk,
                                         const unsigned char *ed25519_sk) {
  unsigned char h[64];
  int i;
  crypto_hash_sha512_tweet(h, ed25519_sk, 64 - 32);
  h[0] &= 248;
  h[31] &= 127;
  h[31] |= 64;
  for (i = 0; i < 32; ++i)
    curve25519_sk[i] = h[i];
  explicit_memzero(h, sizeof h);
  return 0;
}


x86 assembly (clang, -O0):
<crypto_sign_ed25519_sk_to_curve25519>:
push   %rbp
mov    %rsp,%rbp
sub    $0x60,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
lea    -0x50(%rbp),%rdi
mov    -0x10(%rbp),%rsi
mov    $0x20,%edx
call   1030 <crypto_hash_sha512_tweet@plt>
movzbl -0x50(%rbp),%eax
and    $0xf8,%eax
mov    %al,-0x50(%rbp)
movzbl -0x31(%rbp),%eax
and    $0x7f,%eax
mov    %al,-0x31(%rbp)
movzbl -0x31(%rbp),%eax
or     $0x40,%eax
mov    %al,-0x31(%rbp)
movl   $0x0,-0x54(%rbp)
cmpl   $0x20,-0x54(%rbp)
jge    1194 <crypto_sign_ed25519_sk_to_curve25519+0x74>
movslq -0x54(%rbp),%rax
mov    -0x50(%rbp,%rax,1),%dl
mov    -0x8(%rbp),%rax
movslq -0x54(%rbp),%rcx
mov    %dl,(%rax,%rcx,1)
mov    -0x54(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x54(%rbp)
jmp    1169 <crypto_sign_ed25519_sk_to_curve25519+0x49>
lea    -0x50(%rbp),%rdi
mov    $0x40,%esi
call   1040 <explicit_memzero@plt>
xor    %eax,%eax
add    $0x60,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<crypto_sign_ed25519_sk_to_curve25519>:
push   %r14
push   %rbx
sub    $0x48,%rsp
mov    %rdi,%rbx
mov    %rsp,%r14
mov    %r14,%rdi
mov    $0x20,%edx
call   1030 <crypto_hash_sha512_tweet@plt>
andb   $0xf8,(%rsp)
mov    0x1f(%rsp),%al
and    $0x3f,%al
or     $0x40,%al
mov    %al,0x1f(%rsp)
movaps (%rsp),%xmm0
movups %xmm0,(%rbx)
mov    0x10(%rsp),%rax
mov    %rax,0x10(%rbx)
mov    0x18(%rsp),%eax
mov    %eax,0x18(%rbx)
movzwl 0x1c(%rsp),%eax
mov    %ax,0x1c(%rbx)
mov    0x1e(%rsp),%al
mov    %al,0x1e(%rbx)
mov    0x1f(%rsp),%al
mov    %al,0x1f(%rbx)
mov    %r14,%rdi
mov    $0x40,%esi
call   1040 <explicit_memzero@plt>
xor    %eax,%eax
add    $0x48,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
define i32 @crypto_sign_ed25519_sk_to_curve25519(i8* %0, i8* %1) {
%3 = alloca i8*
%4 = alloca i8*
%5 = alloca [64 x i8]
%6 = alloca i32
store i8* %0, i8** %3
store i8* %1, i8** %4
%7 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 0
%8 = load i8*, i8** %4
%9 = call i32 @crypto_hash_sha512_tweet(i8* %7, i8* %8, i32 32)
%10 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 0
%11 = load i8, i8* %10
%12 = zext i8 %11 to i32
%13 = and i32 %12, 248
%14 = trunc i32 %13 to i8
store i8 %14, i8* %10
%15 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 31
%16 = load i8, i8* %15
%17 = zext i8 %16 to i32
%18 = and i32 %17, 127
%19 = trunc i32 %18 to i8
store i8 %19, i8* %15
%20 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 31
%21 = load i8, i8* %20
%22 = zext i8 %21 to i32
%23 = or i32 %22, 64
%24 = trunc i32 %23 to i8
store i8 %24, i8* %20
store i32 0, i32* %6
br label %25
25: ; preds = %37, %2
%26 = load i32, i32* %6
%27 = icmp slt i32 %26, 32
br i1 %27, label %28, label %40
28: ; preds = %25
%29 = load i32, i32* %6
%30 = sext i32 %29 to i64
%31 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 %30
%32 = load i8, i8* %31
%33 = load i8*, i8** %3
%34 = load i32, i32* %6
%35 = sext i32 %34 to i64
%36 = getelementptr inbounds i8, i8* %33, i64 %35
store i8 %32, i8* %36
br label %37
37: ; preds = %28
%38 = load i32, i32* %6
%39 = add nsw i32 %38, 1
store i32 %39, i32* %6
br label %25
40: ; preds = %25
%41 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 0
%42 = call i32 @explicit_memzero(i8* %41, i32 64)
ret i32 0
}

LLVM IR (-O2):
define i32 @crypto_sign_ed25519_sk_to_curve25519(i8* nocapture writeonly %0, i8* %1) {
%3 = alloca [64 x i8]
%4 = getelementptr inbounds [64 x i8], [64 x i8]* %3, i64 0, i64 0
%5 = getelementptr inbounds [64 x i8], [64 x i8]* %3, i64 0, i64 0
%6 = call i32 @crypto_hash_sha512_tweet(i8* %5, i8* %1, i32 32)
%7 = load i8, i8* %5
%8 = and i8 %7, -8
store i8 %8, i8* %5
%9 = getelementptr inbounds [64 x i8], [64 x i8]* %3, i64 0, i64 31
%10 = load i8, i8* %9
%11 = and i8 %10, 63
%12 = or i8 %11, 64
store i8 %12, i8* %9
%13 = call i32 @explicit_memzero(i8* %5, i32 64)
ret i32 0
}