#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ uint8_t;

/* Variables and functions */
int /*<<< orphan*/ AESKeySteup(unsigned char const *, unsigned int *);
int /*<<< orphan*/ jambu_aut_ad_full(unsigned int *, unsigned int *,
                                     unsigned int *);
int /*<<< orphan*/ jambu_aut_ad_partial(unsigned int *, unsigned char const *,
                                        unsigned int *, unsigned int *,
                                        unsigned long long);
int /*<<< orphan*/ jambu_aut_ad_step(unsigned int *, unsigned char const *,
                                     unsigned int *, unsigned int *);
int /*<<< orphan*/ jambu_dec_aut_msg_step(unsigned int *, unsigned char *,
                                          unsigned char const *, unsigned int *,
                                          unsigned int *);
int /*<<< orphan*/ jambu_dec_aut_partial(unsigned int *, unsigned char *,
                                         unsigned char const *, unsigned int *,
                                         unsigned int *, unsigned long long);
int /*<<< orphan*/ jambu_enc_aut_msg_full(unsigned int *, unsigned int *,
                                          unsigned int *);
int /*<<< orphan*/ jambu_initialization(unsigned int *, unsigned char const *,
                                        unsigned int *, unsigned int *);
int jambu_tag_verification(unsigned int *, unsigned long long,
                           unsigned char const *, unsigned int *,
                           unsigned int *);
int /*<<< orphan*/ memset(unsigned int *, int /*<<< orphan*/, int);
int crypto_aead_decrypt(unsigned char *m, unsigned long long *mlen,
                        unsigned char *nsec, const unsigned char *c,
                        unsigned long long clen, const unsigned char *ad,
                        unsigned long long adlen, const unsigned char *npub,
                        const unsigned char *k) {
  unsigned int i;
  uint8_t check = 0;
  unsigned int jambu_state[4];
  unsigned int stateR[2];
  unsigned int EK[44];
  AESKeySteup(k, EK);
  memset(jambu_state, 0, 16);
  memset(stateR, 0, 8);
  jambu_initialization(EK, npub, jambu_state, stateR);
  for (i = 0; (i + 8) <= adlen; i += 8) {
    jambu_aut_ad_step(EK, ad + i, jambu_state, stateR);
  }
  if ((adlen & 0x7) != 0) {
    jambu_aut_ad_partial(EK, ad + i, jambu_state, stateR, adlen & 0x7);
  } else {
    jambu_aut_ad_full(EK, jambu_state, stateR);
  }
  *mlen = clen - 8;
  for (i = 0; (i + 8) <= *mlen; i = i + 8) {
    jambu_dec_aut_msg_step(EK, m + i, c + i, jambu_state, stateR);
  }
  if (((*mlen) & 0x7) != 0) {
    jambu_dec_aut_partial(EK, m + i, c + i, jambu_state, stateR, *mlen & 0x7);
  } else {
    jambu_enc_aut_msg_full(EK, jambu_state, stateR);
  }
  return jambu_tag_verification(EK, *mlen, c, jambu_state, stateR);
  return 0;
}


x86 assembly (clang, -O0):
<crypto_aead_decrypt>:
push   %rbp
mov    %rsp,%rbp
sub    $0x110,%rsp
mov    0x20(%rbp),%rax
mov    0x18(%rbp),%rax
mov    0x10(%rbp),%rax
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
mov    %rcx,-0x20(%rbp)
mov    %r8,-0x28(%rbp)
mov    %r9,-0x30(%rbp)
movl   $0x0,-0x38(%rbp)
mov    0x20(%rbp),%rdi
lea    -0x110(%rbp),%rsi
call   10a0 <AESKeySteup@plt>
lea    -0x50(%rbp),%rdi
xor    %esi,%esi
mov    $0x10,%edx
call   1080 <memset@plt>
lea    -0x58(%rbp),%rdi
xor    %esi,%esi
mov    $0x8,%edx
call   1080 <memset@plt>
lea    -0x110(%rbp),%rdi
mov    0x18(%rbp),%rsi
lea    -0x50(%rbp),%rdx
lea    -0x58(%rbp),%rcx
call   1040 <jambu_initialization@plt>
movl   $0x0,-0x34(%rbp)
mov    -0x34(%rbp),%eax
add    $0x8,%eax
mov    %eax,%eax
cmp    0x10(%rbp),%rax
ja     1263 <crypto_aead_decrypt+0xc3>
lea    -0x110(%rbp),%rdi
mov    -0x30(%rbp),%rsi
mov    -0x34(%rbp),%eax
add    %rax,%rsi
lea    -0x50(%rbp),%rdx
lea    -0x58(%rbp),%rcx
call   1090 <jambu_aut_ad_step@plt>
mov    -0x34(%rbp),%eax
add    $0x8,%eax
mov    %eax,-0x34(%rbp)
jmp    1225 <crypto_aead_decrypt+0x85>
mov    0x10(%rbp),%rax
and    $0x7,%rax
cmp    $0x0,%rax
je     12a0 <crypto_aead_decrypt+0x100>
lea    -0x110(%rbp),%rdi
mov    -0x30(%rbp),%rsi
mov    -0x34(%rbp),%eax
add    %rax,%rsi
lea    -0x50(%rbp),%rdx
lea    -0x58(%rbp),%rcx
mov    0x10(%rbp),%r8
and    $0x7,%r8
call   10b0 <jambu_aut_ad_partial@plt>
jmp    12b4 <crypto_aead_decrypt+0x114>
lea    -0x110(%rbp),%rdi
lea    -0x50(%rbp),%rsi
lea    -0x58(%rbp),%rdx
call   1060 <jambu_aut_ad_full@plt>
mov    -0x28(%rbp),%rcx
sub    $0x8,%rcx
mov    -0x10(%rbp),%rax
mov    %rcx,(%rax)
movl   $0x0,-0x34(%rbp)
mov    -0x34(%rbp),%eax
add    $0x8,%eax
mov    %eax,%eax
mov    -0x10(%rbp),%rcx
cmp    (%rcx),%rax
ja     1315 <crypto_aead_decrypt+0x175>
lea    -0x110(%rbp),%rdi
mov    -0x8(%rbp),%rsi
mov    -0x34(%rbp),%eax
add    %rax,%rsi
mov    -0x20(%rbp),%rdx
mov    -0x34(%rbp),%eax
add    %rax,%rdx
lea    -0x50(%rbp),%rcx
lea    -0x58(%rbp),%r8
call   1030 <jambu_dec_aut_msg_step@plt>
mov    -0x34(%rbp),%eax
add    $0x8,%eax
mov    %eax,-0x34(%rbp)
jmp    12ca <crypto_aead_decrypt+0x12a>
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
and    $0x7,%rax
cmp    $0x0,%rax
je     1362 <crypto_aead_decrypt+0x1c2>
lea    -0x110(%rbp),%rdi
mov    -0x8(%rbp),%rsi
mov    -0x34(%rbp),%eax
add    %rax,%rsi
mov    -0x20(%rbp),%rdx
mov    -0x34(%rbp),%eax
add    %rax,%rdx
lea    -0x50(%rbp),%rcx
lea    -0x58(%rbp),%r8
mov    -0x10(%rbp),%rax
mov    (%rax),%r9
and    $0x7,%r9
call   1050 <jambu_dec_aut_partial@plt>
jmp    1376 <crypto_aead_decrypt+0x1d6>
lea    -0x110(%rbp),%rdi
lea    -0x50(%rbp),%rsi
lea    -0x58(%rbp),%rdx
call   10c0 <jambu_enc_aut_msg_full@plt>
lea    -0x110(%rbp),%rdi
mov    -0x10(%rbp),%rax
mov    (%rax),%rsi
mov    -0x20(%rbp),%rdx
lea    -0x50(%rbp),%rcx
lea    -0x58(%rbp),%r8
call   1070 <jambu_tag_verification@plt>
add    $0x110,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<crypto_aead_decrypt>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0xe8,%rsp
mov    %r9,%r13
mov    %r8,%rbx
mov    %rcx,0x28(%rsp)
mov    %rsi,0x20(%rsp)
mov    %rdi,%r15
mov    0x120(%rsp),%rbp
mov    0x130(%rsp),%rdi
lea    0x30(%rsp),%rsi
call   10a0 <AESKeySteup@plt>
lea    0x10(%rsp),%rdi
xor    %r14d,%r14d
xor    %esi,%esi
mov    $0x10,%edx
call   1080 <memset@plt>
lea    0x8(%rsp),%r12
mov    %r12,%rdi
xor    %esi,%esi
mov    $0x8,%edx
call   1080 <memset@plt>
lea    0x30(%rsp),%rdi
mov    0x128(%rsp),%rsi
lea    0x10(%rsp),%rdx
mov    %r12,%rcx
call   1040 <jambu_initialization@plt>
cmp    $0x8,%rbp
jb     1255 <crypto_aead_decrypt+0xb5>
xor    %r14d,%r14d
lea    0x8(%rsp),%r12
xchg   %ax,%ax
mov    %r14d,%esi
add    %r13,%rsi
lea    0x30(%rsp),%rdi
lea    0x10(%rsp),%rdx
mov    %r12,%rcx
call   1090 <jambu_aut_ad_step@plt>
lea    0x10(%r14),%eax
add    $0x8,%r14d
cmp    %rbp,%rax
jbe    1230 <crypto_aead_decrypt+0x90>
and    $0x7,%rbp
je     127d <crypto_aead_decrypt+0xdd>
mov    %r14d,%eax
add    %rax,%r13
lea    0x30(%rsp),%rdi
lea    0x10(%rsp),%rdx
lea    0x8(%rsp),%rcx
mov    %r13,%rsi
mov    %rbp,%r8
call   10b0 <jambu_aut_ad_partial@plt>
jmp    1291 <crypto_aead_decrypt+0xf1>
lea    0x30(%rsp),%rdi
lea    0x10(%rsp),%rsi
lea    0x8(%rsp),%rdx
call   1060 <jambu_aut_ad_full@plt>
mov    0x28(%rsp),%r12
add    $0xfffffffffffffff8,%rbx
mov    0x20(%rsp),%rax
mov    %rbx,(%rax)
xor    %ebp,%ebp
cmp    $0x8,%rbx
mov    %r15,%rsi
jb     12ef <crypto_aead_decrypt+0x14f>
xor    %ebp,%ebp
lea    0x10(%rsp),%r13
lea    0x8(%rsp),%r14
nopl   0x0(%rax)
mov    %ebp,%edx
lea    (%r15,%rdx,1),%rsi
add    %r12,%rdx
lea    0x30(%rsp),%rdi
mov    %r13,%rcx
mov    %r14,%r8
call   1030 <jambu_dec_aut_msg_step@plt>
mov    %r15,%rsi
lea    0x10(%rbp),%eax
mov    0x20(%rsp),%rcx
mov    (%rcx),%rbx
add    $0x8,%ebp
cmp    %rax,%rbx
jae    12c0 <crypto_aead_decrypt+0x120>
and    $0x7,%rbx
je     1316 <crypto_aead_decrypt+0x176>
mov    %ebp,%edx
add    %rdx,%rsi
add    %r12,%rdx
lea    0x30(%rsp),%rdi
lea    0x10(%rsp),%rcx
lea    0x8(%rsp),%r8
mov    %rbx,%r9
call   1050 <jambu_dec_aut_partial@plt>
jmp    132a <crypto_aead_decrypt+0x18a>
lea    0x30(%rsp),%rdi
lea    0x10(%rsp),%rsi
lea    0x8(%rsp),%rdx
call   10c0 <jambu_enc_aut_msg_full@plt>
mov    0x20(%rsp),%rax
mov    (%rax),%rsi
lea    0x30(%rsp),%rdi
lea    0x10(%rsp),%rcx
lea    0x8(%rsp),%r8
mov    %r12,%rdx
call   1070 <jambu_tag_verification@plt>
add    $0xe8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
define i32 @crypto_aead_decrypt(i8* %0, i64* %1, i8* %2, i8* %3, i64 %4, i8* %5, i64 %6, i8* %7, i8* %8) {
%10 = alloca i8*
%11 = alloca i64*
%12 = alloca i8*
%13 = alloca i8*
%14 = alloca i64
%15 = alloca i8*
%16 = alloca i64
%17 = alloca i8*
%18 = alloca i8*
%19 = alloca i32
%20 = alloca i32
%21 = alloca [4 x i32]
%22 = alloca [2 x i32]
%23 = alloca [44 x i32]
store i8* %0, i8** %10
store i64* %1, i64** %11
store i8* %2, i8** %12
store i8* %3, i8** %13
store i64 %4, i64* %14
store i8* %5, i8** %15
store i64 %6, i64* %16
store i8* %7, i8** %17
store i8* %8, i8** %18
store i32 0, i32* %20
%24 = load i8*, i8** %18
%25 = getelementptr inbounds [44 x i32], [44 x i32]* %23, i64 0, i64 0
%26 = call i32 @AESKeySteup(i8* %24, i32* %25)
%27 = getelementptr inbounds [4 x i32], [4 x i32]* %21, i64 0, i64 0
%28 = call i32 @memset(i32* %27, i32 0, i32 16)
%29 = getelementptr inbounds [2 x i32], [2 x i32]* %22, i64 0, i64 0
%30 = call i32 @memset(i32* %29, i32 0, i32 8)
%31 = getelementptr inbounds [44 x i32], [44 x i32]* %23, i64 0, i64 0
%32 = load i8*, i8** %17
%33 = getelementptr inbounds [4 x i32], [4 x i32]* %21, i64 0, i64 0
%34 = getelementptr inbounds [2 x i32], [2 x i32]* %22, i64 0, i64 0
%35 = call i32 @jambu_initialization(i32* %31, i8* %32, i32* %33, i32* %34)
store i32 0, i32* %19
br label %36
36: ; preds = %51, %9
%37 = load i32, i32* %19
%38 = add i32 %37, 8
%39 = zext i32 %38 to i64
%40 = load i64, i64* %16
%41 = icmp ule i64 %39, %40
br i1 %41, label %42, label %54
42: ; preds = %36
%43 = getelementptr inbounds [44 x i32], [44 x i32]* %23, i64 0, i64 0
%44 = load i8*, i8** %15
%45 = load i32, i32* %19
%46 = zext i32 %45 to i64
%47 = getelementptr inbounds i8, i8* %44, i64 %46
%48 = getelementptr inbounds [4 x i32], [4 x i32]* %21, i64 0, i64 0
%49 = getelementptr inbounds [2 x i32], [2 x i32]* %22, i64 0, i64 0
%50 = call i32 @jambu_aut_ad_step(i32* %43, i8* %47, i32* %48, i32* %49)
br label %51
51: ; preds = %42
%52 = load i32, i32* %19
%53 = add i32 %52, 8
store i32 %53, i32* %19
br label %36
54: ; preds = %36
%55 = load i64, i64* %16
%56 = and i64 %55, 7
%57 = icmp ne i64 %56, 0
br i1 %57, label %58, label %69
58: ; preds = %54
%59 = getelementptr inbounds [44 x i32], [44 x i32]* %23, i64 0, i64 0
%60 = load i8*, i8** %15
%61 = load i32, i32* %19
%62 = zext i32 %61 to i64
%63 = getelementptr inbounds i8, i8* %60, i64 %62
%64 = getelementptr inbounds [4 x i32], [4 x i32]* %21, i64 0, i64 0
%65 = getelementptr inbounds [2 x i32], [2 x i32]* %22, i64 0, i64 0
%66 = load i64, i64* %16
%67 = and i64 %66, 7
%68 = call i32 @jambu_aut_ad_partial(i32* %59, i8* %63, i32* %64, i32* %65, i64 %67)
br label %74
69: ; preds = %54
%70 = getelementptr inbounds [44 x i32], [44 x i32]* %23, i64 0, i64 0
%71 = getelementptr inbounds [4 x i32], [4 x i32]* %21, i64 0, i64 0
%72 = getelementptr inbounds [2 x i32], [2 x i32]* %22, i64 0, i64 0
%73 = call i32 @jambu_aut_ad_full(i32* %70, i32* %71, i32* %72)
br label %74
74: ; preds = %69, %58
%75 = load i64, i64* %14
%76 = sub i64 %75, 8
%77 = load i64*, i64** %11
store i64 %76, i64* %77
store i32 0, i32* %19
br label %78
78: ; preds = %98, %74
%79 = load i32, i32* %19
%80 = add i32 %79, 8
%81 = zext i32 %80 to i64
%82 = load i64*, i64** %11
%83 = load i64, i64* %82
%84 = icmp ule i64 %81, %83
br i1 %84, label %85, label %101
85: ; preds = %78
%86 = getelementptr inbounds [44 x i32], [44 x i32]* %23, i64 0, i64 0
%87 = load i8*, i8** %10
%88 = load i32, i32* %19
%89 = zext i32 %88 to i64
%90 = getelementptr inbounds i8, i8* %87, i64 %89
%91 = load i8*, i8** %13
%92 = load i32, i32* %19
%93 = zext i32 %92 to i64
%94 = getelementptr inbounds i8, i8* %91, i64 %93
%95 = getelementptr inbounds [4 x i32], [4 x i32]* %21, i64 0, i64 0
%96 = getelementptr inbounds [2 x i32], [2 x i32]* %22, i64 0, i64 0
%97 = call i32 @jambu_dec_aut_msg_step(i32* %86, i8* %90, i8* %94, i32* %95, i32* %96)
br label %98
98: ; preds = %85
%99 = load i32, i32* %19
%100 = add i32 %99, 8
store i32 %100, i32* %19
br label %78
101: ; preds = %78
%102 = load i64*, i64** %11
%103 = load i64, i64* %102
%104 = and i64 %103, 7
%105 = icmp ne i64 %104, 0
br i1 %105, label %106, label %122
106: ; preds = %101
%107 = getelementptr inbounds [44 x i32], [44 x i32]* %23, i64 0, i64 0
%108 = load i8*, i8** %10
%109 = load i32, i32* %19
%110 = zext i32 %109 to i64
%111 = getelementptr inbounds i8, i8* %108, i64 %110
%112 = load i8*, i8** %13
%113 = load i32, i32* %19
%114 = zext i32 %113 to i64
%115 = getelementptr inbounds i8, i8* %112, i64 %114
%116 = getelementptr inbounds [4 x i32], [4 x i32]* %21, i64 0, i64 0
%117 = getelementptr inbounds [2 x i32], [2 x i32]* %22, i64 0, i64 0
%118 = load i64*, i64** %11
%119 = load i64, i64* %118
%120 = and i64 %119, 7
%121 = call i32 @jambu_dec_aut_partial(i32* %107, i8* %111, i8* %115, i32* %116, i32* %117, i64 %120)
br label %127
122: ; preds = %101
%123 = getelementptr inbounds [44 x i32], [44 x i32]* %23, i64 0, i64 0
%124 = getelementptr inbounds [4 x i32], [4 x i32]* %21, i64 0, i64 0
%125 = getelementptr inbounds [2 x i32], [2 x i32]* %22, i64 0, i64 0
%126 = call i32 @jambu_enc_aut_msg_full(i32* %123, i32* %124, i32* %125)
br label %127
127: ; preds = %122, %106
%128 = getelementptr inbounds [44 x i32], [44 x i32]* %23, i64 0, i64 0
%129 = load i64*, i64** %11
%130 = load i64, i64* %129
%131 = load i8*, i8** %13
%132 = getelementptr inbounds [4 x i32], [4 x i32]* %21, i64 0, i64 0
%133 = getelementptr inbounds [2 x i32], [2 x i32]* %22, i64 0, i64 0
%134 = call i32 @jambu_tag_verification(i32* %128, i64 %130, i8* %131, i32* %132, i32* %133)
ret i32 %134
}

LLVM IR (-O2):
define i32 @crypto_aead_decrypt(i8* %0, i64* nocapture %1, i8* nocapture readnone %2, i8* %3, i64 %4, i8* %5, i64 %6, i8* %7, i8* %8) {
%10 = alloca [4 x i32]
%11 = alloca [2 x i32]
%12 = alloca [44 x i32]
%13 = bitcast [4 x i32]* %10 to i8*
%14 = bitcast [2 x i32]* %11 to i8*
%15 = bitcast [44 x i32]* %12 to i8*
%16 = getelementptr inbounds [44 x i32], [44 x i32]* %12, i64 0, i64 0
%17 = call i32 @AESKeySteup(i8* %8, i32* %16)
%18 = getelementptr inbounds [4 x i32], [4 x i32]* %10, i64 0, i64 0
%19 = call i32 @memset(i32* %18, i32 0, i32 16)
%20 = getelementptr inbounds [2 x i32], [2 x i32]* %11, i64 0, i64 0
%21 = call i32 @memset(i32* %20, i32 0, i32 8)
%22 = call i32 @jambu_initialization(i32* %16, i8* %7, i32* %18, i32* %20)
%23 = icmp ult i64 %6, 8
br i1 %23, label %33, label %24
24: ; preds = %9, %24
%25 = phi i32 [ %30, %24 ], [ 8, %9 ]
%26 = phi i32 [ %25, %24 ], [ 0, %9 ]
%27 = zext i32 %26 to i64
%28 = getelementptr inbounds i8, i8* %5, i64 %27
%29 = call i32 @jambu_aut_ad_step(i32* %16, i8* %28, i32* %18, i32* %20)
%30 = add i32 %25, 8
%31 = zext i32 %30 to i64
%32 = icmp ugt i64 %31, %6
br i1 %32, label %33, label %24
33: ; preds = %24, %9
%34 = phi i32 [ 0, %9 ], [ %25, %24 ]
%35 = and i64 %6, 7
%36 = icmp eq i64 %35, 0
br i1 %36, label %41, label %37
37: ; preds = %33
%38 = zext i32 %34 to i64
%39 = getelementptr inbounds i8, i8* %5, i64 %38
%40 = call i32 @jambu_aut_ad_partial(i32* %16, i8* %39, i32* %18, i32* %20, i64 %35)
br label %43
41: ; preds = %33
%42 = call i32 @jambu_aut_ad_full(i32* %16, i32* %18, i32* %20)
br label %43
43: ; preds = %41, %37
%44 = add i64 %4, -8
store i64 %44, i64* %1
%45 = icmp ult i64 %44, 8
br i1 %45, label %57, label %46
46: ; preds = %43, %46
%47 = phi i32 [ %53, %46 ], [ 8, %43 ]
%48 = phi i32 [ %47, %46 ], [ 0, %43 ]
%49 = zext i32 %48 to i64
%50 = getelementptr inbounds i8, i8* %0, i64 %49
%51 = getelementptr inbounds i8, i8* %3, i64 %49
%52 = call i32 @jambu_dec_aut_msg_step(i32* %16, i8* %50, i8* %51, i32* %18, i32* %20)
%53 = add i32 %47, 8
%54 = zext i32 %53 to i64
%55 = load i64, i64* %1
%56 = icmp ult i64 %55, %54
br i1 %56, label %57, label %46
57: ; preds = %46, %43
%58 = phi i32 [ 0, %43 ], [ %47, %46 ]
%59 = phi i64 [ %44, %43 ], [ %55, %46 ]
%60 = and i64 %59, 7
%61 = icmp eq i64 %60, 0
br i1 %61, label %67, label %62
62: ; preds = %57
%63 = zext i32 %58 to i64
%64 = getelementptr inbounds i8, i8* %0, i64 %63
%65 = getelementptr inbounds i8, i8* %3, i64 %63
%66 = call i32 @jambu_dec_aut_partial(i32* %16, i8* %64, i8* %65, i32* %18, i32* %20, i64 %60)
br label %69
67: ; preds = %57
%68 = call i32 @jambu_enc_aut_msg_full(i32* %16, i32* %18, i32* %20)
br label %69
69: ; preds = %67, %62
%70 = load i64, i64* %1
%71 = call i32 @jambu_tag_verification(i32* %16, i64 %70, i8* %3, i32* %18, i32* %20)
ret i32 %71
}