#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ EC_POINT;
typedef int /*<<< orphan*/ EC_KEY;
typedef int /*<<< orphan*/ EC_GROUP;
typedef int /*<<< orphan*/ BN_CTX;
typedef int /*<<< orphan*/ BIGNUM;

/* Variables and functions */
int /*<<< orphan*/ BN_CTX_free(int /*<<< orphan*/ *);
int /*<<< orphan*/ *BN_CTX_new();
int /*<<< orphan*/ BN_free(int /*<<< orphan*/ *);
int /*<<< orphan*/ *BN_new();
int /*<<< orphan*/ EC_GROUP_get_order(int /*<<< orphan*/ const *,
                                      int /*<<< orphan*/ *,
                                      int /*<<< orphan*/ *);
int /*<<< orphan*/ *EC_KEY_get0_group(int /*<<< orphan*/ const *);
int /*<<< orphan*/ *EC_KEY_get0_private_key(int /*<<< orphan*/ const *);
int /*<<< orphan*/ *EC_POINT_bn2point(int /*<<< orphan*/ const *,
                                      int /*<<< orphan*/ const *,
                                      int /*<<< orphan*/ *,
                                      int /*<<< orphan*/ *);
int /*<<< orphan*/ EC_POINT_free(int /*<<< orphan*/ *);
int /*<<< orphan*/ EC_POINT_get_affine_coordinates_GF2m(
    int /*<<< orphan*/ const *, int /*<<< orphan*/ *, int /*<<< orphan*/ *,
    int /*<<< orphan*/ *, int /*<<< orphan*/ *);
int /*<<< orphan*/ EC_POINT_is_at_infinity(int /*<<< orphan*/ const *,
                                           int /*<<< orphan*/ *);
int /*<<< orphan*/ *EC_POINT_mult_BN(int /*<<< orphan*/ const *,
                                     int /*<<< orphan*/ *, int /*<<< orphan*/ *,
                                     int /*<<< orphan*/ const *,
                                     int /*<<< orphan*/ *);
int EC_KEY_private_derive_S(const EC_KEY *key, const BIGNUM *R, BIGNUM *S) {
  int ret = -1;
  BN_CTX *ctx = BN_CTX_new();
  BIGNUM *n = BN_new();
  BIGNUM *Py = BN_new();
  const EC_GROUP *group = EC_KEY_get0_group(key);
  EC_POINT *Rp = EC_POINT_bn2point(group, R, NULL, ctx);
  const BIGNUM *kB = EC_KEY_get0_private_key(key);
  EC_GROUP_get_order(group, n, ctx);
  EC_POINT *P = EC_POINT_mult_BN(group, NULL, Rp, kB, ctx);
  if (!EC_POINT_is_at_infinity(group, P)) {
    EC_POINT_get_affine_coordinates_GF2m(group, P, S, Py, ctx);
    ret = 0;
  }
  BN_free(n);
  BN_free(Py);
  EC_POINT_free(Rp);
  EC_POINT_free(P);
  BN_CTX_free(ctx);
  return ret;
}


x86 assembly (clang, -O0):
<EC_KEY_private_derive_S>:
push   %rbp
mov    %rsp,%rbp
sub    $0x60,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
movl   $0xffffffff,-0x1c(%rbp)
mov    $0x0,%al
call   10a0 <BN_CTX_new@plt>
mov    %rax,-0x28(%rbp)
mov    $0x0,%al
call   1030 <BN_new@plt>
mov    %rax,-0x30(%rbp)
mov    $0x0,%al
call   1030 <BN_new@plt>
mov    %rax,-0x38(%rbp)
mov    -0x8(%rbp),%rdi
call   10b0 <EC_KEY_get0_group@plt>
mov    %rax,-0x40(%rbp)
mov    -0x40(%rbp),%rdi
mov    -0x10(%rbp),%rsi
mov    -0x28(%rbp),%rcx
xor    %eax,%eax
mov    %eax,%edx
call   1040 <EC_POINT_bn2point@plt>
mov    %rax,-0x48(%rbp)
mov    -0x8(%rbp),%rdi
call   1050 <EC_KEY_get0_private_key@plt>
mov    %rax,-0x50(%rbp)
mov    -0x40(%rbp),%rdi
mov    -0x30(%rbp),%rsi
mov    -0x28(%rbp),%rdx
call   1070 <EC_GROUP_get_order@plt>
mov    -0x40(%rbp),%rdi
mov    -0x48(%rbp),%rdx
mov    -0x50(%rbp),%rcx
mov    -0x28(%rbp),%r8
xor    %eax,%eax
mov    %eax,%esi
call   1080 <EC_POINT_mult_BN@plt>
mov    %rax,-0x58(%rbp)
mov    -0x40(%rbp),%rdi
mov    -0x58(%rbp),%rsi
call   10c0 <EC_POINT_is_at_infinity@plt>
cmp    $0x0,%eax
jne    1293 <EC_KEY_private_derive_S+0xd3>
mov    -0x40(%rbp),%rdi
mov    -0x58(%rbp),%rsi
mov    -0x18(%rbp),%rdx
mov    -0x38(%rbp),%rcx
mov    -0x28(%rbp),%r8
call   10d0 <EC_POINT_get_affine_coordinates_GF2m@plt>
movl   $0x0,-0x1c(%rbp)
mov    -0x30(%rbp),%rdi
call   1090 <BN_free@plt>
mov    -0x38(%rbp),%rdi
call   1090 <BN_free@plt>
mov    -0x48(%rbp),%rdi
call   10e0 <EC_POINT_free@plt>
mov    -0x58(%rbp),%rdi
call   10e0 <EC_POINT_free@plt>
mov    -0x28(%rbp),%rdi
call   1060 <BN_CTX_free@plt>
mov    -0x1c(%rbp),%eax
add    $0x60,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<EC_KEY_private_derive_S>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    %rdx,0x10(%rsp)
mov    %rsi,%r14
mov    %rdi,%rbx
xor    %eax,%eax
call   10a0 <BN_CTX_new@plt>
mov    %rax,%r12
xor    %eax,%eax
call   1030 <BN_new@plt>
mov    %rax,%r15
xor    %eax,%eax
call   1030 <BN_new@plt>
mov    %rax,0x8(%rsp)
mov    %rbx,%rdi
call   10b0 <EC_KEY_get0_group@plt>
mov    %rax,%rbp
mov    %rax,%rdi
mov    %r14,%rsi
xor    %edx,%edx
mov    %r12,%rcx
call   1040 <EC_POINT_bn2point@plt>
mov    %rax,%r13
mov    %rbx,%rdi
call   1050 <EC_KEY_get0_private_key@plt>
mov    %rax,%rbx
mov    %rbp,%rdi
mov    %r15,%rsi
mov    %r12,%rdx
call   1070 <EC_GROUP_get_order@plt>
mov    %rbp,%rdi
xor    %esi,%esi
mov    %r13,%rdx
mov    %rbx,%rcx
mov    %r12,%r8
call   1080 <EC_POINT_mult_BN@plt>
mov    %rax,%r14
mov    %rbp,%rdi
mov    %rax,%rsi
call   10c0 <EC_POINT_is_at_infinity@plt>
mov    $0xffffffff,%ebx
test   %eax,%eax
jne    1274 <EC_KEY_private_derive_S+0xb4>
mov    %rbp,%rdi
mov    %r14,%rsi
mov    0x10(%rsp),%rdx
mov    0x8(%rsp),%rcx
mov    %r12,%r8
call   10d0 <EC_POINT_get_affine_coordinates_GF2m@plt>
xor    %ebx,%ebx
mov    %r15,%rdi
call   1090 <BN_free@plt>
mov    0x8(%rsp),%rdi
call   1090 <BN_free@plt>
mov    %r13,%rdi
call   10e0 <EC_POINT_free@plt>
mov    %r14,%rdi
call   10e0 <EC_POINT_free@plt>
mov    %r12,%rdi
call   1060 <BN_CTX_free@plt>
mov    %ebx,%eax
add    $0x18,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
define i32 @EC_KEY_private_derive_S(i32* %0, i32* %1, i32* %2) {
%4 = alloca i32*
%5 = alloca i32*
%6 = alloca i32*
%7 = alloca i32
%8 = alloca i32*
%9 = alloca i32*
%10 = alloca i32*
%11 = alloca i32*
%12 = alloca i32*
%13 = alloca i32*
%14 = alloca i32*
store i32* %0, i32** %4
store i32* %1, i32** %5
store i32* %2, i32** %6
store i32 -1, i32* %7
%15 = call i32* (...) @BN_CTX_new()
store i32* %15, i32** %8
%16 = call i32* (...) @BN_new()
store i32* %16, i32** %9
%17 = call i32* (...) @BN_new()
store i32* %17, i32** %10
%18 = load i32*, i32** %4
%19 = call i32* @EC_KEY_get0_group(i32* %18)
store i32* %19, i32** %11
%20 = load i32*, i32** %11
%21 = load i32*, i32** %5
%22 = load i32*, i32** %8
%23 = call i32* @EC_POINT_bn2point(i32* %20, i32* %21, i32* null, i32* %22)
store i32* %23, i32** %12
%24 = load i32*, i32** %4
%25 = call i32* @EC_KEY_get0_private_key(i32* %24)
store i32* %25, i32** %13
%26 = load i32*, i32** %11
%27 = load i32*, i32** %9
%28 = load i32*, i32** %8
%29 = call i32 @EC_GROUP_get_order(i32* %26, i32* %27, i32* %28)
%30 = load i32*, i32** %11
%31 = load i32*, i32** %12
%32 = load i32*, i32** %13
%33 = load i32*, i32** %8
%34 = call i32* @EC_POINT_mult_BN(i32* %30, i32* null, i32* %31, i32* %32, i32* %33)
store i32* %34, i32** %14
%35 = load i32*, i32** %11
%36 = load i32*, i32** %14
%37 = call i32 @EC_POINT_is_at_infinity(i32* %35, i32* %36)
%38 = icmp ne i32 %37, 0
br i1 %38, label %46, label %39
39: ; preds = %3
%40 = load i32*, i32** %11
%41 = load i32*, i32** %14
%42 = load i32*, i32** %6
%43 = load i32*, i32** %10
%44 = load i32*, i32** %8
%45 = call i32 @EC_POINT_get_affine_coordinates_GF2m(i32* %40, i32* %41, i32* %42, i32* %43, i32* %44)
store i32 0, i32* %7
br label %46
46: ; preds = %39, %3
%47 = load i32*, i32** %9
%48 = call i32 @BN_free(i32* %47)
%49 = load i32*, i32** %10
%50 = call i32 @BN_free(i32* %49)
%51 = load i32*, i32** %12
%52 = call i32 @EC_POINT_free(i32* %51)
%53 = load i32*, i32** %14
%54 = call i32 @EC_POINT_free(i32* %53)
%55 = load i32*, i32** %8
%56 = call i32 @BN_CTX_free(i32* %55)
%57 = load i32, i32* %7
ret i32 %57
}

LLVM IR (-O2):
define i32 @EC_KEY_private_derive_S(i32* %0, i32* %1, i32* %2) {
%4 = tail call i32* (...) @BN_CTX_new()
%5 = tail call i32* (...) @BN_new()
%6 = tail call i32* (...) @BN_new()
%7 = tail call i32* @EC_KEY_get0_group(i32* %0)
%8 = tail call i32* @EC_POINT_bn2point(i32* %7, i32* %1, i32* null, i32* %4)
%9 = tail call i32* @EC_KEY_get0_private_key(i32* %0)
%10 = tail call i32 @EC_GROUP_get_order(i32* %7, i32* %5, i32* %4)
%11 = tail call i32* @EC_POINT_mult_BN(i32* %7, i32* null, i32* %8, i32* %9, i32* %4)
%12 = tail call i32 @EC_POINT_is_at_infinity(i32* %7, i32* %11)
%13 = icmp eq i32 %12, 0
br i1 %13, label %14, label %16
14: ; preds = %3
%15 = tail call i32 @EC_POINT_get_affine_coordinates_GF2m(i32* %7, i32* %11, i32* %2, i32* %6, i32* %4)
br label %16
16: ; preds = %14, %3
%17 = phi i32 [ -1, %3 ], [ 0, %14 ]
%18 = tail call i32 @BN_free(i32* %5)
%19 = tail call i32 @BN_free(i32* %6)
%20 = tail call i32 @EC_POINT_free(i32* %8)
%21 = tail call i32 @EC_POINT_free(i32* %11)
%22 = tail call i32 @BN_CTX_free(i32* %4)
ret i32 %17
}