#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int uint32_t;

/* Variables and functions */
int /*<<< orphan*/ MessageExpansion256(int *, int *, int *);
int /*<<< orphan*/ roundAESkeyfirst(int *, int *, int *);
void E256(uint32_t pt[8], uint32_t ct[8], uint32_t message[16],
          uint32_t salt[8], uint32_t counter[2]) {
  uint32_t state[8], i, j;
  uint32_t input[4], output[4], temp;
  uint32_t rk[(12 * 4 * (3))];
  for (i = 0; i < 8; i++)
    state[i] = pt[i];
  for (i = 0; i < 16; i++)
    rk[i] = message[i];
  MessageExpansion256(rk, salt, counter);
  for (i = 0; i < 12; i++) {
    for (j = 0; j < 4; j++)
      input[j] = state[4 + j];
    roundAESkeyfirst(input, output, rk + 12 * i);
    for (j = 0; j < 4; j++)
      input[j] = output[j];
    roundAESkeyfirst(input, output, rk + 12 * i + 4);
    for (j = 0; j < 4; j++)
      input[j] = output[j];
    roundAESkeyfirst(input, output, rk + 12 * i + 8);
    for (j = 0; j < 4; j++)
      state[j] ^= output[j];
    for (j = 0; j < 4; j++) {
      temp = state[j];
      state[j] = state[j + 4];
      state[j + 4] = temp;
    }
  }
  for (i = 0; i < 8; i++)
    ct[i] = state[i];
  return;
}


x86 assembly (clang, -O0):
<E256>:
push   %rbp
mov    %rsp,%rbp
sub    $0x2d0,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
mov    %rcx,-0x20(%rbp)
mov    %r8,-0x28(%rbp)
movl   $0x0,-0x54(%rbp)
cmpl   $0x8,-0x54(%rbp)
jge    1171 <E256+0x51>
mov    -0x8(%rbp),%rax
movslq -0x54(%rbp),%rcx
mov    (%rax,%rcx,4),%ecx
movslq -0x54(%rbp),%rax
mov    %ecx,-0x50(%rbp,%rax,4)
mov    -0x54(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x54(%rbp)
jmp    1146 <E256+0x26>
movl   $0x0,-0x54(%rbp)
cmpl   $0x10,-0x54(%rbp)
jge    11a6 <E256+0x86>
mov    -0x18(%rbp),%rax
movslq -0x54(%rbp),%rcx
mov    (%rax,%rcx,4),%ecx
movslq -0x54(%rbp),%rax
mov    %ecx,-0x2d0(%rbp,%rax,4)
mov    -0x54(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x54(%rbp)
jmp    1178 <E256+0x58>
lea    -0x2d0(%rbp),%rdi
mov    -0x20(%rbp),%rsi
mov    -0x28(%rbp),%rdx
call   1030 <MessageExpansion256@plt>
movl   $0x0,-0x54(%rbp)
cmpl   $0xc,-0x54(%rbp)
jge    1360 <E256+0x240>
movl   $0x0,-0x58(%rbp)
cmpl   $0x4,-0x58(%rbp)
jge    11fe <E256+0xde>
mov    -0x58(%rbp),%eax
add    $0x4,%eax
cltq
mov    -0x50(%rbp,%rax,4),%ecx
movslq -0x58(%rbp),%rax
mov    %ecx,-0x70(%rbp,%rax,4)
mov    -0x58(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x58(%rbp)
jmp    11d2 <E256+0xb2>
lea    -0x70(%rbp),%rdi
lea    -0x80(%rbp),%rsi
lea    -0x2d0(%rbp),%rdx
imul   $0xc,-0x54(%rbp),%eax
cltq
shl    $0x2,%rax
add    %rax,%rdx
call   1040 <roundAESkeyfirst@plt>
movl   $0x0,-0x58(%rbp)
cmpl   $0x4,-0x58(%rbp)
jge    124e <E256+0x12e>
movslq -0x58(%rbp),%rax
mov    -0x80(%rbp,%rax,4),%ecx
movslq -0x58(%rbp),%rax
mov    %ecx,-0x70(%rbp,%rax,4)
mov    -0x58(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x58(%rbp)
jmp    1226 <E256+0x106>
lea    -0x70(%rbp),%rdi
lea    -0x80(%rbp),%rsi
lea    -0x2d0(%rbp),%rdx
imul   $0xc,-0x54(%rbp),%eax
cltq
shl    $0x2,%rax
add    %rax,%rdx
add    $0x10,%rdx
call   1040 <roundAESkeyfirst@plt>
movl   $0x0,-0x58(%rbp)
cmpl   $0x4,-0x58(%rbp)
jge    12a2 <E256+0x182>
movslq -0x58(%rbp),%rax
mov    -0x80(%rbp,%rax,4),%ecx
movslq -0x58(%rbp),%rax
mov    %ecx,-0x70(%rbp,%rax,4)
mov    -0x58(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x58(%rbp)
jmp    127a <E256+0x15a>
lea    -0x70(%rbp),%rdi
lea    -0x80(%rbp),%rsi
lea    -0x2d0(%rbp),%rdx
imul   $0xc,-0x54(%rbp),%eax
cltq
shl    $0x2,%rax
add    %rax,%rdx
add    $0x20,%rdx
call   1040 <roundAESkeyfirst@plt>
movl   $0x0,-0x58(%rbp)
cmpl   $0x4,-0x58(%rbp)
jge    12fa <E256+0x1da>
movslq -0x58(%rbp),%rax
mov    -0x80(%rbp,%rax,4),%ecx
movslq -0x58(%rbp),%rax
xor    -0x50(%rbp,%rax,4),%ecx
mov    %ecx,-0x50(%rbp,%rax,4)
mov    -0x58(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x58(%rbp)
jmp    12ce <E256+0x1ae>
movl   $0x0,-0x58(%rbp)
cmpl   $0x4,-0x58(%rbp)
jge    134d <E256+0x22d>
movslq -0x58(%rbp),%rax
mov    -0x50(%rbp,%rax,4),%eax
mov    %eax,-0x84(%rbp)
mov    -0x58(%rbp),%eax
add    $0x4,%eax
cltq
mov    -0x50(%rbp,%rax,4),%ecx
movslq -0x58(%rbp),%rax
mov    %ecx,-0x50(%rbp,%rax,4)
mov    -0x84(%rbp),%ecx
mov    -0x58(%rbp),%eax
add    $0x4,%eax
cltq
mov    %ecx,-0x50(%rbp,%rax,4)
mov    -0x58(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x58(%rbp)
jmp    1301 <E256+0x1e1>
jmp    1352 <E256+0x232>
mov    -0x54(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x54(%rbp)
jmp    11c1 <E256+0xa1>
movl   $0x0,-0x54(%rbp)
cmpl   $0x8,-0x54(%rbp)
jge    1392 <E256+0x272>
movslq -0x54(%rbp),%rax
mov    -0x50(%rbp,%rax,4),%edx
mov    -0x10(%rbp),%rax
movslq -0x54(%rbp),%rcx
mov    %edx,(%rax,%rcx,4)
mov    -0x54(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x54(%rbp)
jmp    1367 <E256+0x247>
add    $0x2d0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<E256>:
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x280,%rsp
mov    %rsi,%r14
movups (%rdi),%xmm0
movaps %xmm0,0x30(%rsp)
movups 0x10(%rdi),%xmm0
movaps %xmm0,(%rsp)
movups (%rdx),%xmm0
movups 0x10(%rdx),%xmm1
movups 0x20(%rdx),%xmm2
movups 0x30(%rdx),%xmm3
movaps %xmm3,0x70(%rsp)
movaps %xmm2,0x60(%rsp)
movaps %xmm1,0x50(%rsp)
movaps %xmm0,0x40(%rsp)
lea    0x40(%rsp),%rbx
mov    %rbx,%rdi
mov    %rcx,%rsi
mov    %r8,%rdx
call   1030 <MessageExpansion256@plt>
movaps (%rsp),%xmm1
mov    $0xc,%r13d
lea    0x20(%rsp),%r15
lea    0x10(%rsp),%r12
nopl   (%rax)
movaps %xmm1,(%rsp)
movaps %xmm1,0x20(%rsp)
mov    %r15,%rdi
mov    %r12,%rsi
mov    %rbx,%rdx
call   1040 <roundAESkeyfirst@plt>
movaps 0x10(%rsp),%xmm0
movaps %xmm0,0x20(%rsp)
lea    0x10(%rbx),%rdx
mov    %r15,%rdi
mov    %r12,%rsi
call   1040 <roundAESkeyfirst@plt>
movaps 0x10(%rsp),%xmm0
movaps %xmm0,0x20(%rsp)
lea    0x20(%rbx),%rdx
mov    %r15,%rdi
mov    %r12,%rsi
call   1040 <roundAESkeyfirst@plt>
movaps (%rsp),%xmm0
movaps 0x30(%rsp),%xmm1
xorps  0x10(%rsp),%xmm1
add    $0x30,%rbx
movaps %xmm0,0x30(%rsp)
add    $0xffffffffffffffff,%r13
jne    1190 <E256+0x70>
movups %xmm0,(%r14)
movups %xmm1,0x10(%r14)
add    $0x280,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
define void @E256(i32* %0, i32* %1, i32* %2, i32* %3, i32* %4) {
%6 = alloca i32*
%7 = alloca i32*
%8 = alloca i32*
%9 = alloca i32*
%10 = alloca i32*
%11 = alloca [8 x i32]
%12 = alloca i32
%13 = alloca i32
%14 = alloca [4 x i32]
%15 = alloca [4 x i32]
%16 = alloca i32
%17 = alloca [144 x i32]
store i32* %0, i32** %6
store i32* %1, i32** %7
store i32* %2, i32** %8
store i32* %3, i32** %9
store i32* %4, i32** %10
store i32 0, i32* %12
br label %18
18: ; preds = %30, %5
%19 = load i32, i32* %12
%20 = icmp slt i32 %19, 8
br i1 %20, label %21, label %33
21: ; preds = %18
%22 = load i32*, i32** %6
%23 = load i32, i32* %12
%24 = sext i32 %23 to i64
%25 = getelementptr inbounds i32, i32* %22, i64 %24
%26 = load i32, i32* %25
%27 = load i32, i32* %12
%28 = sext i32 %27 to i64
%29 = getelementptr inbounds [8 x i32], [8 x i32]* %11, i64 0, i64 %28
store i32 %26, i32* %29
br label %30
30: ; preds = %21
%31 = load i32, i32* %12
%32 = add nsw i32 %31, 1
store i32 %32, i32* %12
br label %18
33: ; preds = %18
store i32 0, i32* %12
br label %34
34: ; preds = %46, %33
%35 = load i32, i32* %12
%36 = icmp slt i32 %35, 16
br i1 %36, label %37, label %49
37: ; preds = %34
%38 = load i32*, i32** %8
%39 = load i32, i32* %12
%40 = sext i32 %39 to i64
%41 = getelementptr inbounds i32, i32* %38, i64 %40
%42 = load i32, i32* %41
%43 = load i32, i32* %12
%44 = sext i32 %43 to i64
%45 = getelementptr inbounds [144 x i32], [144 x i32]* %17, i64 0, i64 %44
store i32 %42, i32* %45
br label %46
46: ; preds = %37
%47 = load i32, i32* %12
%48 = add nsw i32 %47, 1
store i32 %48, i32* %12
br label %34
49: ; preds = %34
%50 = getelementptr inbounds [144 x i32], [144 x i32]* %17, i64 0, i64 0
%51 = load i32*, i32** %9
%52 = load i32*, i32** %10
%53 = call i32 @MessageExpansion256(i32* %50, i32* %51, i32* %52)
store i32 0, i32* %12
br label %54
54: ; preds = %172, %49
%55 = load i32, i32* %12
%56 = icmp slt i32 %55, 12
br i1 %56, label %57, label %175
57: ; preds = %54
store i32 0, i32* %13
br label %58
58: ; preds = %70, %57
%59 = load i32, i32* %13
%60 = icmp slt i32 %59, 4
br i1 %60, label %61, label %73
61: ; preds = %58
%62 = load i32, i32* %13
%63 = add nsw i32 4, %62
%64 = sext i32 %63 to i64
%65 = getelementptr inbounds [8 x i32], [8 x i32]* %11, i64 0, i64 %64
%66 = load i32, i32* %65
%67 = load i32, i32* %13
%68 = sext i32 %67 to i64
%69 = getelementptr inbounds [4 x i32], [4 x i32]* %14, i64 0, i64 %68
store i32 %66, i32* %69
br label %70
70: ; preds = %61
%71 = load i32, i32* %13
%72 = add nsw i32 %71, 1
store i32 %72, i32* %13
br label %58
73: ; preds = %58
%74 = getelementptr inbounds [4 x i32], [4 x i32]* %14, i64 0, i64 0
%75 = getelementptr inbounds [4 x i32], [4 x i32]* %15, i64 0, i64 0
%76 = getelementptr inbounds [144 x i32], [144 x i32]* %17, i64 0, i64 0
%77 = load i32, i32* %12
%78 = mul nsw i32 12, %77
%79 = sext i32 %78 to i64
%80 = getelementptr inbounds i32, i32* %76, i64 %79
%81 = call i32 @roundAESkeyfirst(i32* %74, i32* %75, i32* %80)
store i32 0, i32* %13
br label %82
82: ; preds = %93, %73
%83 = load i32, i32* %13
%84 = icmp slt i32 %83, 4
br i1 %84, label %85, label %96
85: ; preds = %82
%86 = load i32, i32* %13
%87 = sext i32 %86 to i64
%88 = getelementptr inbounds [4 x i32], [4 x i32]* %15, i64 0, i64 %87
%89 = load i32, i32* %88
%90 = load i32, i32* %13
%91 = sext i32 %90 to i64
%92 = getelementptr inbounds [4 x i32], [4 x i32]* %14, i64 0, i64 %91
store i32 %89, i32* %92
br label %93
93: ; preds = %85
%94 = load i32, i32* %13
%95 = add nsw i32 %94, 1
store i32 %95, i32* %13
br label %82
96: ; preds = %82
%97 = getelementptr inbounds [4 x i32], [4 x i32]* %14, i64 0, i64 0
%98 = getelementptr inbounds [4 x i32], [4 x i32]* %15, i64 0, i64 0
%99 = getelementptr inbounds [144 x i32], [144 x i32]* %17, i64 0, i64 0
%100 = load i32, i32* %12
%101 = mul nsw i32 12, %100
%102 = sext i32 %101 to i64
%103 = getelementptr inbounds i32, i32* %99, i64 %102
%104 = getelementptr inbounds i32, i32* %103, i64 4
%105 = call i32 @roundAESkeyfirst(i32* %97, i32* %98, i32* %104)
store i32 0, i32* %13
br label %106
106: ; preds = %117, %96
%107 = load i32, i32* %13
%108 = icmp slt i32 %107, 4
br i1 %108, label %109, label %120
109: ; preds = %106
%110 = load i32, i32* %13
%111 = sext i32 %110 to i64
%112 = getelementptr inbounds [4 x i32], [4 x i32]* %15, i64 0, i64 %111
%113 = load i32, i32* %112
%114 = load i32, i32* %13
%115 = sext i32 %114 to i64
%116 = getelementptr inbounds [4 x i32], [4 x i32]* %14, i64 0, i64 %115
store i32 %113, i32* %116
br label %117
117: ; preds = %109
%118 = load i32, i32* %13
%119 = add nsw i32 %118, 1
store i32 %119, i32* %13
br label %106
120: ; preds = %106
%121 = getelementptr inbounds [4 x i32], [4 x i32]* %14, i64 0, i64 0
%122 = getelementptr inbounds [4 x i32], [4 x i32]* %15, i64 0, i64 0
%123 = getelementptr inbounds [144 x i32], [144 x i32]* %17, i64 0, i64 0
%124 = load i32, i32* %12
%125 = mul nsw i32 12, %124
%126 = sext i32 %125 to i64
%127 = getelementptr inbounds i32, i32* %123, i64 %126
%128 = getelementptr inbounds i32, i32* %127, i64 8
%129 = call i32 @roundAESkeyfirst(i32* %121, i32* %122, i32* %128)
store i32 0, i32* %13
br label %130
130: ; preds = %143, %120
%131 = load i32, i32* %13
%132 = icmp slt i32 %131, 4
br i1 %132, label %133, label %146
133: ; preds = %130
%134 = load i32, i32* %13
%135 = sext i32 %134 to i64
%136 = getelementptr inbounds [4 x i32], [4 x i32]* %15, i64 0, i64 %135
%137 = load i32, i32* %136
%138 = load i32, i32* %13
%139 = sext i32 %138 to i64
%140 = getelementptr inbounds [8 x i32], [8 x i32]* %11, i64 0, i64 %139
%141 = load i32, i32* %140
%142 = xor i32 %141, %137
store i32 %142, i32* %140
br label %143
143: ; preds = %133
%144 = load i32, i32* %13
%145 = add nsw i32 %144, 1
store i32 %145, i32* %13
br label %130
146: ; preds = %130
store i32 0, i32* %13
br label %147
147: ; preds = %168, %146
%148 = load i32, i32* %13
%149 = icmp slt i32 %148, 4
br i1 %149, label %150, label %171
150: ; preds = %147
%151 = load i32, i32* %13
%152 = sext i32 %151 to i64
%153 = getelementptr inbounds [8 x i32], [8 x i32]* %11, i64 0, i64 %152
%154 = load i32, i32* %153
store i32 %154, i32* %16
%155 = load i32, i32* %13
%156 = add nsw i32 %155, 4
%157 = sext i32 %156 to i64
%158 = getelementptr inbounds [8 x i32], [8 x i32]* %11, i64 0, i64 %157
%159 = load i32, i32* %158
%160 = load i32, i32* %13
%161 = sext i32 %160 to i64
%162 = getelementptr inbounds [8 x i32], [8 x i32]* %11, i64 0, i64 %161
store i32 %159, i32* %162
%163 = load i32, i32* %16
%164 = load i32, i32* %13
%165 = add nsw i32 %164, 4
%166 = sext i32 %165 to i64
%167 = getelementptr inbounds [8 x i32], [8 x i32]* %11, i64 0, i64 %166
store i32 %163, i32* %167
br label %168
168: ; preds = %150
%169 = load i32, i32* %13
%170 = add nsw i32 %169, 1
store i32 %170, i32* %13
br label %147
171: ; preds = %147
br label %172
172: ; preds = %171
%173 = load i32, i32* %12
%174 = add nsw i32 %173, 1
store i32 %174, i32* %12
br label %54
175: ; preds = %54
store i32 0, i32* %12
br label %176
176: ; preds = %188, %175
%177 = load i32, i32* %12
%178 = icmp slt i32 %177, 8
br i1 %178, label %179, label %191
179: ; preds = %176
%180 = load i32, i32* %12
%181 = sext i32 %180 to i64
%182 = getelementptr inbounds [8 x i32], [8 x i32]* %11, i64 0, i64 %181
%183 = load i32, i32* %182
%184 = load i32*, i32** %7
%185 = load i32, i32* %12
%186 = sext i32 %185 to i64
%187 = getelementptr inbounds i32, i32* %184, i64 %186
store i32 %183, i32* %187
br label %188
188: ; preds = %179
%189 = load i32, i32* %12
%190 = add nsw i32 %189, 1
store i32 %190, i32* %12
br label %176
191: ; preds = %176
ret void
}

LLVM IR (-O2):
define void @E256(i32* nocapture %0, i32* nocapture writeonly %1, i32* nocapture %2, i32* %3, i32* %4) {
%6 = bitcast i32* %2 to i8*
%7 = alloca <4 x i32>
%8 = bitcast <4 x i32>* %7 to i8*
%9 = alloca <4 x i32>
%10 = bitcast <4 x i32>* %9 to i8*
%11 = alloca [144 x i32]
%12 = bitcast [144 x i32]* %11 to i8*
%13 = bitcast i32* %0 to <4 x i32>*
%14 = load <4 x i32>, <4 x i32>* %13
%15 = getelementptr inbounds i32, i32* %0, i64 4
%16 = bitcast i32* %15 to <4 x i32>*
%17 = load <4 x i32>, <4 x i32>* %16
%18 = getelementptr inbounds [144 x i32], [144 x i32]* %11, i64 0, i64 0
%19 = call i32 @MessageExpansion256(i32* %18, i32* %3, i32* %4)
%20 = getelementptr inbounds <4 x i32>, <4 x i32>* %7, i64 0, i64 0
%21 = getelementptr inbounds <4 x i32>, <4 x i32>* %9, i64 0, i64 0
br label %22
22: ; preds = %5, %22
%23 = phi i64 [ 0, %5 ], [ %35, %22 ]
%24 = phi <4 x i32> [ %14, %5 ], [ %25, %22 ]
%25 = phi <4 x i32> [ %17, %5 ], [ %34, %22 ]
store <4 x i32> %25, <4 x i32>* %7
%26 = mul nuw nsw i64 %23, 12
%27 = getelementptr inbounds [144 x i32], [144 x i32]* %11, i64 0, i64 %26
%28 = call i32 @roundAESkeyfirst(i32* %20, i32* %21, i32* %27)
%29 = getelementptr inbounds i32, i32* %27, i64 4
%30 = call i32 @roundAESkeyfirst(i32* %20, i32* %21, i32* %29)
%31 = getelementptr inbounds i32, i32* %27, i64 8
%32 = call i32 @roundAESkeyfirst(i32* %20, i32* %21, i32* %31)
%33 = load <4 x i32>, <4 x i32>* %9
%34 = xor <4 x i32> %24, %33
%35 = add nuw nsw i64 %23, 1
%36 = icmp eq i64 %35, 12
br i1 %36, label %37, label %22
37: ; preds = %22
%38 = bitcast i32* %1 to <4 x i32>*
store <4 x i32> %25, <4 x i32>* %38
%39 = getelementptr inbounds i32, i32* %1, i64 4
%40 = bitcast i32* %39 to <4 x i32>*
store <4 x i32> %34, <4 x i32>* %40
ret void
}