#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int uint64_t;
typedef int uint32_t;

/* Variables and functions */
int /*<<< orphan*/ compute_root(unsigned char *, unsigned char *, int,
                                int /*<<< orphan*/, unsigned char *, int,
                                unsigned char const *, int *);
int /*<<< orphan*/ copy_keypair_addr(int *, int *);
int /*<<< orphan*/ copy_subtree_addr(int *, int *);
int /*<<< orphan*/ fors_pk_from_sig(unsigned char *, unsigned char *,
                                    unsigned char *, unsigned char const *,
                                    int *);
int /*<<< orphan*/ hash_message(unsigned char *, int *, int *, unsigned char *,
                                unsigned char const *, unsigned char *,
                                unsigned long long);
int /*<<< orphan*/ initialize_hash_function(unsigned char const *,
                                            int /*<<< orphan*/ *);
scalar_t__ memcmp(unsigned char *, unsigned char const *, int);
int /*<<< orphan*/ memcpy(unsigned char *, unsigned char const *, int);
int /*<<< orphan*/ memmove(unsigned char *, unsigned char const *,
                           unsigned long long);
int /*<<< orphan*/ memset(unsigned char *, int /*<<< orphan*/,
                          unsigned long long);
int /*<<< orphan*/ set_keypair_addr(int *, int);
int /*<<< orphan*/ set_layer_addr(int *, unsigned int);
int /*<<< orphan*/ set_tree_addr(int *, int);
int /*<<< orphan*/ set_type(int *, int);
int /*<<< orphan*/ thash(unsigned char *, unsigned char *, int,
                         unsigned char const *, int *);
int /*<<< orphan*/ wots_pk_from_sig(unsigned char *, unsigned char *,
                                    unsigned char *, unsigned char const *,
                                    int *);
int crypto_sign_open(unsigned char *m, unsigned long long *mlen,
                     const unsigned char *sm, unsigned long long smlen,
                     const unsigned char *pk) {
  const unsigned char *pub_seed = pk;
  const unsigned char *pub_root = pk + 16;
  unsigned char mhash[((9 * 30 + 7) / 8)];
  unsigned char wots_pk[(((8 * 16 / 4) + 3) * 16)];
  unsigned char root[16];
  unsigned char leaf[16];
  unsigned char sig[(16 + ((9 + 1) * 30 * 16) + 20 * (((8 * 16 / 4) + 3) * 16) +
                     60 * 16)];
  unsigned char *sigptr = sig;
  unsigned int i;
  uint64_t tree;
  uint32_t idx_leaf;
  uint32_t wots_addr[8] = {0};
  uint32_t tree_addr[8] = {0};
  uint32_t wots_pk_addr[8] = {0};
  initialize_hash_function(pub_seed, NULL);
  set_type(wots_addr, 0);
  set_type(tree_addr, 2);
  set_type(wots_pk_addr, 1);
  *mlen = smlen -
          (16 + ((9 + 1) * 30 * 16) + 20 * (((8 * 16 / 4) + 3) * 16) + 60 * 16);
  memcpy(sig, sm,
         (16 + ((9 + 1) * 30 * 16) + 20 * (((8 * 16 / 4) + 3) * 16) + 60 * 16));
  memmove(
      m + (16 + ((9 + 1) * 30 * 16) + 20 * (((8 * 16 / 4) + 3) * 16) + 60 * 16),
      sm +
          (16 + ((9 + 1) * 30 * 16) + 20 * (((8 * 16 / 4) + 3) * 16) + 60 * 16),
      *mlen);
  hash_message(
      mhash, &tree, &idx_leaf, sigptr, pk,
      m + (16 + ((9 + 1) * 30 * 16) + 20 * (((8 * 16 / 4) + 3) * 16) + 60 * 16),
      *mlen);
  sigptr += 16;
  set_tree_addr(wots_addr, tree);
  set_keypair_addr(wots_addr, idx_leaf);
  fors_pk_from_sig(root, sigptr, mhash, pub_seed, wots_addr);
  sigptr += ((9 + 1) * 30 * 16);
  for (i = 0; i < 20; i++) {
    set_layer_addr(tree_addr, i);
    set_tree_addr(tree_addr, tree);
    copy_subtree_addr(wots_addr, tree_addr);
    set_keypair_addr(wots_addr, idx_leaf);
    copy_keypair_addr(wots_pk_addr, wots_addr);
    wots_pk_from_sig(wots_pk, sigptr, root, pub_seed, wots_addr);
    sigptr += (((8 * 16 / 4) + 3) * 16);
    thash(leaf, wots_pk, ((8 * 16 / 4) + 3), pub_seed, wots_pk_addr);
    compute_root(root, leaf, idx_leaf, 0, sigptr, (60 / 20), pub_seed,
                 tree_addr);
    sigptr += (60 / 20) * 16;
    idx_leaf = (tree & ((1 << (60 / 20)) - 1));
    tree = tree >> (60 / 20);
  }
  if (memcmp(root, pub_root, 16)) {
    memset(m, 0, *mlen);
    *mlen = 0;
    return -1;
  }
  memmove(
      m,
      m + (16 + ((9 + 1) * 30 * 16) + 20 * (((8 * 16 / 4) + 3) * 16) + 60 * 16),
      *mlen);
  return 0;
}


x86 assembly (clang, -O0):
<crypto_sign_open>:
push   %rbp
mov    %rsp,%rbp
sub    $0x45a0,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %rcx,-0x28(%rbp)
mov    %r8,-0x30(%rbp)
mov    -0x30(%rbp),%rax
mov    %rax,-0x38(%rbp)
mov    -0x30(%rbp),%rax
add    $0x10,%rax
mov    %rax,-0x40(%rbp)
lea    -0x4510(%rbp),%rax
mov    %rax,-0x4518(%rbp)
lea    -0x4550(%rbp),%rdi
xor    %esi,%esi
mov    $0x20,%edx
call   1090 <memset@plt>
lea    -0x4570(%rbp),%rdi
xor    %esi,%esi
mov    $0x20,%edx
call   1090 <memset@plt>
lea    -0x4590(%rbp),%rdi
xor    %esi,%esi
mov    $0x20,%edx
call   1090 <memset@plt>
mov    -0x38(%rbp),%rdi
xor    %eax,%eax
mov    %eax,%esi
call   1120 <initialize_hash_function@plt>
lea    -0x4550(%rbp),%rdi
xor    %esi,%esi
call   1040 <set_type@plt>
lea    -0x4570(%rbp),%rdi
mov    $0x2,%esi
call   1040 <set_type@plt>
lea    -0x4590(%rbp),%rdi
mov    $0x1,%esi
call   1040 <set_type@plt>
mov    -0x28(%rbp),%rcx
sub    $0x4250,%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
lea    -0x4510(%rbp),%rdi
mov    -0x20(%rbp),%rsi
mov    $0x4250,%edx
call   10d0 <memcpy@plt>
mov    -0x10(%rbp),%rdi
add    $0x4250,%rdi
mov    -0x20(%rbp),%rsi
add    $0x4250,%rsi
mov    -0x18(%rbp),%rax
mov    (%rax),%rdx
call   10f0 <memmove@plt>
lea    -0x70(%rbp),%rdi
mov    -0x4518(%rbp),%rcx
mov    -0x30(%rbp),%r8
mov    -0x10(%rbp),%r9
add    $0x4250,%r9
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
lea    -0x4520(%rbp),%rsi
lea    -0x4524(%rbp),%rdx
mov    %rax,(%rsp)
call   1100 <hash_message@plt>
mov    -0x4518(%rbp),%rax
add    $0x10,%rax
mov    %rax,-0x4518(%rbp)
lea    -0x4550(%rbp),%rdi
mov    -0x4520(%rbp),%esi
call   10a0 <set_tree_addr@plt>
lea    -0x4550(%rbp),%rdi
mov    -0x4524(%rbp),%esi
call   1080 <set_keypair_addr@plt>
lea    -0x2b0(%rbp),%rdi
mov    -0x4518(%rbp),%rsi
lea    -0x70(%rbp),%rdx
mov    -0x38(%rbp),%rcx
lea    -0x4550(%rbp),%r8
call   1050 <fors_pk_from_sig@plt>
mov    -0x4518(%rbp),%rax
add    $0x12c0,%rax
mov    %rax,-0x4518(%rbp)
movl   $0x0,-0x451c(%rbp)
cmpl   $0x14,-0x451c(%rbp)
jae    14f3 <crypto_sign_open+0x2f3>
lea    -0x4570(%rbp),%rdi
mov    -0x451c(%rbp),%esi
call   1070 <set_layer_addr@plt>
lea    -0x4570(%rbp),%rdi
mov    -0x4520(%rbp),%esi
call   10a0 <set_tree_addr@plt>
lea    -0x4550(%rbp),%rdi
lea    -0x4570(%rbp),%rsi
call   10e0 <copy_subtree_addr@plt>
lea    -0x4550(%rbp),%rdi
mov    -0x4524(%rbp),%esi
call   1080 <set_keypair_addr@plt>
lea    -0x4590(%rbp),%rdi
lea    -0x4550(%rbp),%rsi
call   1060 <copy_keypair_addr@plt>
lea    -0x2a0(%rbp),%rdi
mov    -0x4518(%rbp),%rsi
lea    -0x2b0(%rbp),%rdx
mov    -0x38(%rbp),%rcx
lea    -0x4550(%rbp),%r8
call   10c0 <wots_pk_from_sig@plt>
mov    -0x4518(%rbp),%rax
add    $0x230,%rax
mov    %rax,-0x4518(%rbp)
lea    -0x2c0(%rbp),%rdi
lea    -0x2a0(%rbp),%rsi
mov    -0x38(%rbp),%rcx
lea    -0x4590(%rbp),%r8
mov    $0x23,%edx
call   1030 <thash@plt>
lea    -0x2b0(%rbp),%rdi
lea    -0x2c0(%rbp),%rsi
mov    -0x4524(%rbp),%edx
mov    -0x4518(%rbp),%r8
mov    -0x38(%rbp),%r10
lea    -0x4570(%rbp),%rax
xor    %ecx,%ecx
mov    $0x3,%r9d
mov    %r10,(%rsp)
mov    %rax,0x8(%rsp)
call   1110 <compute_root@plt>
mov    -0x4518(%rbp),%rax
add    $0x30,%rax
mov    %rax,-0x4518(%rbp)
mov    -0x4520(%rbp),%eax
and    $0x7,%eax
mov    %eax,-0x4524(%rbp)
mov    -0x4520(%rbp),%eax
sar    $0x3,%eax
mov    %eax,-0x4520(%rbp)
mov    -0x451c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x451c(%rbp)
jmp    13ae <crypto_sign_open+0x1ae>
lea    -0x2b0(%rbp),%rdi
mov    -0x40(%rbp),%rsi
mov    $0x10,%edx
call   10b0 <memcmp@plt>
cmp    $0x0,%rax
je     153b <crypto_sign_open+0x33b>
mov    -0x10(%rbp),%rdi
mov    -0x18(%rbp),%rax
mov    (%rax),%rdx
xor    %esi,%esi
call   1090 <memset@plt>
mov    -0x18(%rbp),%rax
movq   $0x0,(%rax)
movl   $0xffffffff,-0x4(%rbp)
jmp    155d <crypto_sign_open+0x35d>
mov    -0x10(%rbp),%rdi
mov    -0x10(%rbp),%rsi
add    $0x4250,%rsi
mov    -0x18(%rbp),%rax
mov    (%rax),%rdx
call   10f0 <memmove@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x45a0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<crypto_sign_open>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x4568,%rsp
mov    %r8,%r13
mov    %rcx,%r15
mov    %rdx,%r14
mov    %rsi,%rbp
mov    %rdi,0x10(%rsp)
xorps  %xmm0,%xmm0
movaps %xmm0,0x90(%rsp)
movaps %xmm0,0x80(%rsp)
movaps %xmm0,0x70(%rsp)
movaps %xmm0,0x60(%rsp)
movaps %xmm0,0x50(%rsp)
movaps %xmm0,0x40(%rsp)
xor    %ebx,%ebx
mov    %r8,%rdi
xor    %esi,%esi
call   1120 <initialize_hash_function@plt>
lea    0x80(%rsp),%r12
mov    %r12,%rdi
xor    %esi,%esi
call   1040 <set_type@plt>
lea    0x60(%rsp),%rdi
mov    $0x2,%esi
call   1040 <set_type@plt>
lea    0x40(%rsp),%rdi
mov    $0x1,%esi
call   1040 <set_type@plt>
add    $0xffffffffffffbdb0,%r15
mov    %r15,0x0(%rbp)
lea    0x310(%rsp),%rdi
mov    %r14,%rsi
mov    $0x4250,%edx
call   10d0 <memcpy@plt>
mov    0x10(%rsp),%rax
lea    0x4250(%rax),%r15
add    $0x4250,%r14
mov    0x0(%rbp),%rdx
mov    %r15,%rdi
mov    %r14,%rsi
call   10f0 <memmove@plt>
sub    $0x8,%rsp
lea    0xb8(%rsp),%r14
lea    0x14(%rsp),%rsi
lea    0x10(%rsp),%rdx
mov    %r14,%rdi
lea    0x318(%rsp),%rcx
mov    %r13,%r8
mov    %r15,0x28(%rsp)
mov    %r15,%r9
mov    %rbp,0x30(%rsp)
push   0x0(%rbp)
call   1100 <hash_message@plt>
add    $0x10,%rsp
lea    0x320(%rsp),%r15
mov    0xc(%rsp),%esi
mov    %r12,%rdi
call   10a0 <set_tree_addr@plt>
mov    0x8(%rsp),%esi
mov    %r12,%rdi
call   1080 <set_keypair_addr@plt>
lea    0x30(%rsp),%rdi
mov    %r15,%rsi
mov    %r14,%rdx
mov    %r13,0x18(%rsp)
mov    %r13,%rcx
mov    %r12,%r8
call   1050 <fors_pk_from_sig@plt>
lea    0x15e0(%rsp),%r14
nopw   0x0(%rax,%rax,1)
lea    0x60(%rsp),%r12
mov    %r12,%rdi
mov    %ebx,%esi
call   1070 <set_layer_addr@plt>
mov    0xc(%rsp),%esi
mov    %r12,%rdi
call   10a0 <set_tree_addr@plt>
lea    0x80(%rsp),%rbp
mov    %rbp,%rdi
mov    %r12,%rsi
call   10e0 <copy_subtree_addr@plt>
mov    0x8(%rsp),%esi
mov    %rbp,%rdi
call   1080 <set_keypair_addr@plt>
lea    0x40(%rsp),%rdi
mov    %rbp,%rsi
call   1060 <copy_keypair_addr@plt>
lea    0xe0(%rsp),%r15
mov    %r15,%rdi
mov    %r14,%rsi
lea    0x30(%rsp),%r13
mov    %r13,%rdx
mov    0x18(%rsp),%r12
mov    %r12,%rcx
mov    %rbp,%r8
call   10c0 <wots_pk_from_sig@plt>
lea    0xa0(%rsp),%rbp
mov    %rbp,%rdi
mov    %r15,%rsi
mov    $0x23,%edx
mov    %r12,%rcx
lea    0x40(%rsp),%r8
call   1030 <thash@plt>
mov    0x8(%rsp),%edx
lea    0x230(%r14),%r8
mov    %r13,%rdi
mov    %rbp,%rsi
xor    %ecx,%ecx
mov    $0x3,%r9d
lea    0x60(%rsp),%rax
push   %rax
push   %r12
call   1110 <compute_root@plt>
add    $0x10,%rsp
mov    0xc(%rsp),%eax
mov    %eax,%ecx
and    $0x7,%ecx
mov    %ecx,0x8(%rsp)
sar    $0x3,%eax
mov    %eax,0xc(%rsp)
add    $0x1,%ebx
add    $0x260,%r14
cmp    $0x14,%ebx
jne    1350 <crypto_sign_open+0x150>
mov    0x18(%rsp),%rsi
add    $0x10,%rsi
lea    0x30(%rsp),%rdi
mov    $0x10,%edx
call   10b0 <memcmp@plt>
mov    0x28(%rsp),%rbx
mov    (%rbx),%rdx
test   %rax,%rax
je     146d <crypto_sign_open+0x26d>
mov    0x10(%rsp),%rdi
xor    %esi,%esi
call   1090 <memset@plt>
movq   $0x0,(%rbx)
mov    $0xffffffff,%eax
jmp    147e <crypto_sign_open+0x27e>
mov    0x10(%rsp),%rdi
mov    0x20(%rsp),%rsi
call   10f0 <memmove@plt>
xor    %eax,%eax
add    $0x4568,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
define i32 @crypto_sign_open(i8* %0, i64* %1, i8* %2, i64 %3, i8* %4) {
%6 = alloca i32
%7 = alloca i8*
%8 = alloca i64*
%9 = alloca i8*
%10 = alloca i64
%11 = alloca i8*
%12 = alloca i8*
%13 = alloca i8*
%14 = alloca [34 x i8]
%15 = alloca [560 x i8]
%16 = alloca [16 x i8]
%17 = alloca [16 x i8]
%18 = alloca [16976 x i8]
%19 = alloca i8*
%20 = alloca i32
%21 = alloca i32
%22 = alloca i32
%23 = alloca [8 x i32]
%24 = alloca [8 x i32]
%25 = alloca [8 x i32]
store i8* %0, i8** %7
store i64* %1, i64** %8
store i8* %2, i8** %9
store i64 %3, i64* %10
store i8* %4, i8** %11
%26 = load i8*, i8** %11
store i8* %26, i8** %12
%27 = load i8*, i8** %11
%28 = getelementptr inbounds i8, i8* %27, i64 16
store i8* %28, i8** %13
%29 = getelementptr inbounds [16976 x i8], [16976 x i8]* %18, i64 0, i64 0
store i8* %29, i8** %19
%30 = bitcast [8 x i32]* %23 to i8*
%31 = bitcast [8 x i32]* %24 to i8*
%32 = bitcast [8 x i32]* %25 to i8*
%33 = load i8*, i8** %12
%34 = call i32 @initialize_hash_function(i8* %33, i32* null)
%35 = getelementptr inbounds [8 x i32], [8 x i32]* %23, i64 0, i64 0
%36 = call i32 @set_type(i32* %35, i32 0)
%37 = getelementptr inbounds [8 x i32], [8 x i32]* %24, i64 0, i64 0
%38 = call i32 @set_type(i32* %37, i32 2)
%39 = getelementptr inbounds [8 x i32], [8 x i32]* %25, i64 0, i64 0
%40 = call i32 @set_type(i32* %39, i32 1)
%41 = load i64, i64* %10
%42 = sub i64 %41, 16976
%43 = load i64*, i64** %8
store i64 %42, i64* %43
%44 = getelementptr inbounds [16976 x i8], [16976 x i8]* %18, i64 0, i64 0
%45 = load i8*, i8** %9
%46 = call i32 @memcpy(i8* %44, i8* %45, i32 16976)
%47 = load i8*, i8** %7
%48 = getelementptr inbounds i8, i8* %47, i64 16976
%49 = load i8*, i8** %9
%50 = getelementptr inbounds i8, i8* %49, i64 16976
%51 = load i64*, i64** %8
%52 = load i64, i64* %51
%53 = call i32 @memmove(i8* %48, i8* %50, i64 %52)
%54 = getelementptr inbounds [34 x i8], [34 x i8]* %14, i64 0, i64 0
%55 = load i8*, i8** %19
%56 = load i8*, i8** %11
%57 = load i8*, i8** %7
%58 = getelementptr inbounds i8, i8* %57, i64 16976
%59 = load i64*, i64** %8
%60 = load i64, i64* %59
%61 = call i32 @hash_message(i8* %54, i32* %21, i32* %22, i8* %55, i8* %56, i8* %58, i64 %60)
%62 = load i8*, i8** %19
%63 = getelementptr inbounds i8, i8* %62, i64 16
store i8* %63, i8** %19
%64 = getelementptr inbounds [8 x i32], [8 x i32]* %23, i64 0, i64 0
%65 = load i32, i32* %21
%66 = call i32 @set_tree_addr(i32* %64, i32 %65)
%67 = getelementptr inbounds [8 x i32], [8 x i32]* %23, i64 0, i64 0
%68 = load i32, i32* %22
%69 = call i32 @set_keypair_addr(i32* %67, i32 %68)
%70 = getelementptr inbounds [16 x i8], [16 x i8]* %16, i64 0, i64 0
%71 = load i8*, i8** %19
%72 = getelementptr inbounds [34 x i8], [34 x i8]* %14, i64 0, i64 0
%73 = load i8*, i8** %12
%74 = getelementptr inbounds [8 x i32], [8 x i32]* %23, i64 0, i64 0
%75 = call i32 @fors_pk_from_sig(i8* %70, i8* %71, i8* %72, i8* %73, i32* %74)
%76 = load i8*, i8** %19
%77 = getelementptr inbounds i8, i8* %76, i64 4800
store i8* %77, i8** %19
store i32 0, i32* %20
br label %78
78: ; preds = %123, %5
%79 = load i32, i32* %20
%80 = icmp ult i32 %79, 20
br i1 %80, label %81, label %126
81: ; preds = %78
%82 = getelementptr inbounds [8 x i32], [8 x i32]* %24, i64 0, i64 0
%83 = load i32, i32* %20
%84 = call i32 @set_layer_addr(i32* %82, i32 %83)
%85 = getelementptr inbounds [8 x i32], [8 x i32]* %24, i64 0, i64 0
%86 = load i32, i32* %21
%87 = call i32 @set_tree_addr(i32* %85, i32 %86)
%88 = getelementptr inbounds [8 x i32], [8 x i32]* %23, i64 0, i64 0
%89 = getelementptr inbounds [8 x i32], [8 x i32]* %24, i64 0, i64 0
%90 = call i32 @copy_subtree_addr(i32* %88, i32* %89)
%91 = getelementptr inbounds [8 x i32], [8 x i32]* %23, i64 0, i64 0
%92 = load i32, i32* %22
%93 = call i32 @set_keypair_addr(i32* %91, i32 %92)
%94 = getelementptr inbounds [8 x i32], [8 x i32]* %25, i64 0, i64 0
%95 = getelementptr inbounds [8 x i32], [8 x i32]* %23, i64 0, i64 0
%96 = call i32 @copy_keypair_addr(i32* %94, i32* %95)
%97 = getelementptr inbounds [560 x i8], [560 x i8]* %15, i64 0, i64 0
%98 = load i8*, i8** %19
%99 = getelementptr inbounds [16 x i8], [16 x i8]* %16, i64 0, i64 0
%100 = load i8*, i8** %12
%101 = getelementptr inbounds [8 x i32], [8 x i32]* %23, i64 0, i64 0
%102 = call i32 @wots_pk_from_sig(i8* %97, i8* %98, i8* %99, i8* %100, i32* %101)
%103 = load i8*, i8** %19
%104 = getelementptr inbounds i8, i8* %103, i64 560
store i8* %104, i8** %19
%105 = getelementptr inbounds [16 x i8], [16 x i8]* %17, i64 0, i64 0
%106 = getelementptr inbounds [560 x i8], [560 x i8]* %15, i64 0, i64 0
%107 = load i8*, i8** %12
%108 = getelementptr inbounds [8 x i32], [8 x i32]* %25, i64 0, i64 0
%109 = call i32 @thash(i8* %105, i8* %106, i32 35, i8* %107, i32* %108)
%110 = getelementptr inbounds [16 x i8], [16 x i8]* %16, i64 0, i64 0
%111 = getelementptr inbounds [16 x i8], [16 x i8]* %17, i64 0, i64 0
%112 = load i32, i32* %22
%113 = load i8*, i8** %19
%114 = load i8*, i8** %12
%115 = getelementptr inbounds [8 x i32], [8 x i32]* %24, i64 0, i64 0
%116 = call i32 @compute_root(i8* %110, i8* %111, i32 %112, i32 0, i8* %113, i32 3, i8* %114, i32* %115)
%117 = load i8*, i8** %19
%118 = getelementptr inbounds i8, i8* %117, i64 48
store i8* %118, i8** %19
%119 = load i32, i32* %21
%120 = and i32 %119, 7
store i32 %120, i32* %22
%121 = load i32, i32* %21
%122 = ashr i32 %121, 3
store i32 %122, i32* %21
br label %123
123: ; preds = %81
%124 = load i32, i32* %20
%125 = add i32 %124, 1
store i32 %125, i32* %20
br label %78
126: ; preds = %78
%127 = getelementptr inbounds [16 x i8], [16 x i8]* %16, i64 0, i64 0
%128 = load i8*, i8** %13
%129 = call i64 @memcmp(i8* %127, i8* %128, i32 16)
%130 = icmp ne i64 %129, 0
br i1 %130, label %131, label %137
131: ; preds = %126
%132 = load i8*, i8** %7
%133 = load i64*, i64** %8
%134 = load i64, i64* %133
%135 = call i32 @memset(i8* %132, i32 0, i64 %134)
%136 = load i64*, i64** %8
store i64 0, i64* %136
store i32 -1, i32* %6
br label %144
137: ; preds = %126
%138 = load i8*, i8** %7
%139 = load i8*, i8** %7
%140 = getelementptr inbounds i8, i8* %139, i64 16976
%141 = load i64*, i64** %8
%142 = load i64, i64* %141
%143 = call i32 @memmove(i8* %138, i8* %140, i64 %142)
store i32 0, i32* %6
br label %144
144: ; preds = %137, %131
%145 = load i32, i32* %6
ret i32 %145
}

LLVM IR (-O2):
define i32 @crypto_sign_open(i8* %0, i64* nocapture %1, i8* %2, i64 %3, i8* %4) {
%6 = alloca [34 x i8]
%7 = alloca [560 x i8]
%8 = alloca [16 x i8]
%9 = alloca [16 x i8]
%10 = alloca [16976 x i8]
%11 = alloca i32
%12 = alloca i32
%13 = alloca [8 x i32]
%14 = alloca [8 x i32]
%15 = alloca [8 x i32]
%16 = getelementptr inbounds [34 x i8], [34 x i8]* %6, i64 0, i64 0
%17 = getelementptr inbounds [560 x i8], [560 x i8]* %7, i64 0, i64 0
%18 = getelementptr inbounds [16 x i8], [16 x i8]* %8, i64 0, i64 0
%19 = getelementptr inbounds [16 x i8], [16 x i8]* %9, i64 0, i64 0
%20 = getelementptr inbounds [16976 x i8], [16976 x i8]* %10, i64 0, i64 0
%21 = bitcast i32* %11 to i8*
%22 = bitcast i32* %12 to i8*
%23 = bitcast [8 x i32]* %13 to i8*
%24 = bitcast [8 x i32]* %14 to i8*
%25 = bitcast [8 x i32]* %15 to i8*
%26 = tail call i32 @initialize_hash_function(i8* %4, i32* null)
%27 = getelementptr inbounds [8 x i32], [8 x i32]* %13, i64 0, i64 0
%28 = call i32 @set_type(i32* %27, i32 0)
%29 = getelementptr inbounds [8 x i32], [8 x i32]* %14, i64 0, i64 0
%30 = call i32 @set_type(i32* %29, i32 2)
%31 = getelementptr inbounds [8 x i32], [8 x i32]* %15, i64 0, i64 0
%32 = call i32 @set_type(i32* %31, i32 1)
%33 = add i64 %3, -16976
store i64 %33, i64* %1
%34 = call i32 @memcpy(i8* %20, i8* %2, i32 16976)
%35 = getelementptr inbounds i8, i8* %0, i64 16976
%36 = getelementptr inbounds i8, i8* %2, i64 16976
%37 = load i64, i64* %1
%38 = call i32 @memmove(i8* %35, i8* %36, i64 %37)
%39 = load i64, i64* %1
%40 = call i32 @hash_message(i8* %16, i32* %11, i32* %12, i8* %20, i8* %4, i8* %35, i64 %39)
%41 = getelementptr inbounds [16976 x i8], [16976 x i8]* %10, i64 0, i64 16
%42 = load i32, i32* %11
%43 = call i32 @set_tree_addr(i32* %27, i32 %42)
%44 = load i32, i32* %12
%45 = call i32 @set_keypair_addr(i32* %27, i32 %44)
%46 = call i32 @fors_pk_from_sig(i8* %18, i8* %41, i8* %16, i8* %4, i32* %27)
%47 = getelementptr inbounds [16976 x i8], [16976 x i8]* %10, i64 0, i64 4816
br label %48
48: ; preds = %5, %48
%49 = phi i32 [ 0, %5 ], [ %67, %48 ]
%50 = phi i8* [ %47, %5 ], [ %63, %48 ]
%51 = call i32 @set_layer_addr(i32* %29, i32 %49)
%52 = load i32, i32* %11
%53 = call i32 @set_tree_addr(i32* %29, i32 %52)
%54 = call i32 @copy_subtree_addr(i32* %27, i32* %29)
%55 = load i32, i32* %12
%56 = call i32 @set_keypair_addr(i32* %27, i32 %55)
%57 = call i32 @copy_keypair_addr(i32* %31, i32* %27)
%58 = call i32 @wots_pk_from_sig(i8* %17, i8* %50, i8* %18, i8* %4, i32* %27)
%59 = getelementptr inbounds i8, i8* %50, i64 560
%60 = call i32 @thash(i8* %19, i8* %17, i32 35, i8* %4, i32* %31)
%61 = load i32, i32* %12
%62 = call i32 @compute_root(i8* %18, i8* %19, i32 %61, i32 0, i8* %59, i32 3, i8* %4, i32* %29)
%63 = getelementptr inbounds i8, i8* %50, i64 608
%64 = load i32, i32* %11
%65 = and i32 %64, 7
store i32 %65, i32* %12
%66 = ashr i32 %64, 3
store i32 %66, i32* %11
%67 = add nuw nsw i32 %49, 1
%68 = icmp eq i32 %67, 20
br i1 %68, label %69, label %48
69: ; preds = %48
%70 = getelementptr inbounds i8, i8* %4, i64 16
%71 = call i64 @memcmp(i8* %18, i8* %70, i32 16)
%72 = icmp eq i64 %71, 0
%73 = load i64, i64* %1
br i1 %72, label %76, label %74
74: ; preds = %69
%75 = call i32 @memset(i8* %0, i32 0, i64 %73)
store i64 0, i64* %1
br label %78
76: ; preds = %69
%77 = call i32 @memmove(i8* %0, i8* %35, i64 %73)
br label %78
78: ; preds = %76, %74
%79 = phi i32 [ -1, %74 ], [ 0, %76 ]
ret i32 %79
}