int sphincs_sign(unsigned char const *message, unsigned long long length,
                 unsigned char const sk[64], unsigned char const masks[1024]) {
  int a = 0, h = 0, i = 0, j = 0, l = 0;
  unsigned char leafidx = 0;
  unsigned char R[2 * 32];
  unsigned char digest[64];
  unsigned char seed[32];
  unsigned char leaves[32 * 32];
  unsigned char wots_pk[67 * 32];
  unsigned char root[32];
  unsigned char *addr = R + 32;
  prf(R, message, length, sk + 64 / 2);
  for (i = 0; i < 32 + 8; ++i) {
    printf("%02x", R[(i < 8 ? 32 + i : i - 8)]);
  }
  printf("\n");
  hash_any_n_2n(digest, R, message, length);
  addr[0] = (12 << 4) | (addr[0] & 0x0f);
  prf_64(seed, addr, sk);
  horst_sign_opti(digest, seed, masks);
  horst_keygen(root, seed, masks);
  for (a = 0; a < 12; ++a) {
    addr[0] = (addr[0] & 0x0f);
    if (a != 0) {
      for (i = 8 - 1; i > 0; --i) {
        addr[i] = ((addr[i] & 0xe0) >> 5) | ((addr[i - 1] & 0x1f) << 3);
      }
      addr[0] = (a << 4) & 0xf0;
    } else {
      addr[0] = (a << 4) | addr[0];
    }
    leafidx = addr[8 - 1] & 0x1f;
    for (l = 0; l < 32; ++l) {
      addr[8 - 1] = (addr[8 - 1] & 0xe0) | l;
      prf_64(seed, addr, sk);
      if (l == leafidx) {
        wotsp_sign(root, seed, masks);
      }
      wotsp_keygen(wots_pk, seed, masks);
      do {
        for (i = 67, h = 0; i > 1; i = 1 + ((i - 1) / 2), h++) {
          for (j = 0; j < i; j += 2) {
            if (j + 2 > i) {
              memcpy(wots_pk + (j / 2) * 32, wots_pk + (j)*32, 32);
            } else {
              hash_nn_n_mask(wots_pk + (j / 2) * 32, wots_pk + (j)*32,
                             wots_pk + (j + 1) * 32, masks + (2 * h) * 32);
            }
          }
        }
      } while (0);
      for (i = 0; i < 32; ++i) {
        leaves[l * 32 + i] = wots_pk[0 * 32 + i];
      }
    }
    for (i = 0; i < 5; ++i) {
      if ((leafidx & 1) == 0) {
        leafidx += 1;
      } else {
        leafidx -= 1;
      }
      if (i < 5 - 1) {
        for (j = 0; j < 32; ++j) {
          printf("%02x", leaves[leafidx * 32 + j]);
        }
      }
      for (j = 0; j < (1 << (5 - i)); j += 2) {
        hash_nn_n_mask(leaves + (j / 2) * 32, leaves + (j)*32,
                       leaves + (j + 1) * 32, masks + 2 * (7 + i) * 32);
      }
      leafidx /= 2;
    }
    for (i = 0; i < 32; ++i) {
      seed[i] = 0;
      root[i] = leaves[i + 0 * 32];
    }
  }
  return 0;
}


x86 assembly (clang, -O0):
<sphincs_sign>:
push   %rbp
mov    %rsp,%rbp
sub    $0xd70,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
mov    %rcx,-0x20(%rbp)
movl   $0x0,-0x24(%rbp)
movl   $0x0,-0x28(%rbp)
movl   $0x0,-0x2c(%rbp)
movl   $0x0,-0x30(%rbp)
movl   $0x0,-0x34(%rbp)
movb   $0x0,-0x35(%rbp)
lea    -0x80(%rbp),%rax
add    $0x20,%rax
mov    %rax,-0xd68(%rbp)
lea    -0x80(%rbp),%rdi
mov    -0x8(%rbp),%rsi
mov    -0x10(%rbp),%rdx
mov    -0x18(%rbp),%rcx
add    $0x20,%rcx
mov    $0x0,%al
call   1050 <prf@plt>
movl   $0x0,-0x2c(%rbp)
cmpl   $0x28,-0x2c(%rbp)
jge    125d <sphincs_sign+0xcd>
cmpl   $0x8,-0x2c(%rbp)
jge    1228 <sphincs_sign+0x98>
mov    -0x2c(%rbp),%eax
add    $0x20,%eax
mov    %eax,-0xd6c(%rbp)
jmp    1234 <sphincs_sign+0xa4>
mov    -0x2c(%rbp),%eax
sub    $0x8,%eax
mov    %eax,-0xd6c(%rbp)
mov    -0xd6c(%rbp),%eax
cltq
movzbl -0x80(%rbp,%rax,1),%esi
lea    0xdb8(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    -0x2c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x2c(%rbp)
jmp    1203 <sphincs_sign+0x73>
lea    0xda1(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    -0xc0(%rbp),%rdi
lea    -0x80(%rbp),%rsi
mov    -0x8(%rbp),%rdx
mov    -0x10(%rbp),%rcx
mov    $0x0,%al
call   1030 <hash_any_n_2n@plt>
mov    -0xd68(%rbp),%rax
movzbl (%rax),%eax
and    $0xf,%eax
or     $0xc0,%eax
mov    %al,%cl
mov    -0xd68(%rbp),%rax
mov    %cl,(%rax)
lea    -0xe0(%rbp),%rdi
mov    -0xd68(%rbp),%rsi
mov    -0x18(%rbp),%rdx
mov    $0x0,%al
call   1070 <prf_64@plt>
lea    -0xc0(%rbp),%rdi
lea    -0xe0(%rbp),%rsi
mov    -0x20(%rbp),%rdx
mov    $0x0,%al
call   10a0 <horst_sign_opti@plt>
lea    -0xd60(%rbp),%rdi
lea    -0xe0(%rbp),%rsi
mov    -0x20(%rbp),%rdx
mov    $0x0,%al
call   1080 <horst_keygen@plt>
movl   $0x0,-0x24(%rbp)
cmpl   $0xc,-0x24(%rbp)
jge    1766 <sphincs_sign+0x5d6>
mov    -0xd68(%rbp),%rax
movzbl (%rax),%eax
and    $0xf,%eax
mov    %al,%cl
mov    -0xd68(%rbp),%rax
mov    %cl,(%rax)
cmpl   $0x0,-0x24(%rbp)
je     139d <sphincs_sign+0x20d>
movl   $0x7,-0x2c(%rbp)
cmpl   $0x0,-0x2c(%rbp)
jle    1382 <sphincs_sign+0x1f2>
mov    -0xd68(%rbp),%rax
movslq -0x2c(%rbp),%rcx
movzbl (%rax,%rcx,1),%eax
and    $0xe0,%eax
sar    $0x5,%eax
mov    -0xd68(%rbp),%rcx
mov    -0x2c(%rbp),%edx
sub    $0x1,%edx
movslq %edx,%rdx
movzbl (%rcx,%rdx,1),%ecx
and    $0x1f,%ecx
shl    $0x3,%ecx
or     %ecx,%eax
mov    %al,%dl
mov    -0xd68(%rbp),%rax
movslq -0x2c(%rbp),%rcx
mov    %dl,(%rax,%rcx,1)
mov    -0x2c(%rbp),%eax
add    $0xffffffff,%eax
mov    %eax,-0x2c(%rbp)
jmp    1327 <sphincs_sign+0x197>
mov    -0x24(%rbp),%eax
shl    $0x4,%eax
and    $0xf0,%eax
mov    %al,%cl
mov    -0xd68(%rbp),%rax
mov    %cl,(%rax)
jmp    13ba <sphincs_sign+0x22a>
mov    -0x24(%rbp),%eax
shl    $0x4,%eax
mov    -0xd68(%rbp),%rcx
movzbl (%rcx),%ecx
or     %ecx,%eax
mov    %al,%cl
mov    -0xd68(%rbp),%rax
mov    %cl,(%rax)
mov    -0xd68(%rbp),%rax
movzbl 0x7(%rax),%eax
and    $0x1f,%eax
mov    %al,-0x35(%rbp)
movl   $0x0,-0x34(%rbp)
cmpl   $0x20,-0x34(%rbp)
jge    15d9 <sphincs_sign+0x449>
mov    -0xd68(%rbp),%rax
movzbl 0x7(%rax),%eax
and    $0xe0,%eax
or     -0x34(%rbp),%eax
mov    %al,%cl
mov    -0xd68(%rbp),%rax
mov    %cl,0x7(%rax)
lea    -0xe0(%rbp),%rdi
mov    -0xd68(%rbp),%rsi
mov    -0x18(%rbp),%rdx
mov    $0x0,%al
call   1070 <prf_64@plt>
mov    -0x34(%rbp),%eax
movzbl -0x35(%rbp),%ecx
cmp    %ecx,%eax
jne    143c <sphincs_sign+0x2ac>
lea    -0xd60(%rbp),%rdi
lea    -0xe0(%rbp),%rsi
mov    -0x20(%rbp),%rdx
mov    $0x0,%al
call   10b0 <wotsp_sign@plt>
lea    -0xd40(%rbp),%rdi
lea    -0xe0(%rbp),%rsi
mov    -0x20(%rbp),%rdx
mov    $0x0,%al
call   1060 <wotsp_keygen@plt>
movl   $0x43,-0x2c(%rbp)
movl   $0x0,-0x28(%rbp)
cmpl   $0x1,-0x2c(%rbp)
jle    1581 <sphincs_sign+0x3f1>
movl   $0x0,-0x30(%rbp)
mov    -0x30(%rbp),%eax
cmp    -0x2c(%rbp),%eax
jge    155a <sphincs_sign+0x3ca>
mov    -0x30(%rbp),%eax
add    $0x2,%eax
cmp    -0x2c(%rbp),%eax
jle    14ed <sphincs_sign+0x35d>
mov    -0x30(%rbp),%eax
mov    $0x2,%ecx
cltd
idiv   %ecx
shl    $0x5,%eax
cltq
mov    -0x30(%rbp),%ecx
shl    $0x5,%ecx
movslq %ecx,%rcx
mov    -0xd40(%rbp,%rcx,1),%rdx
ff
mov    %rdx,-0xd40(%rbp,%rax,1)
ff
mov    -0xd38(%rbp,%rcx,1),%rdx
ff
mov    %rdx,-0xd38(%rbp,%rax,1)
ff
mov    -0xd30(%rbp,%rcx,1),%rdx
ff
mov    %rdx,-0xd30(%rbp,%rax,1)
ff
mov    -0xd28(%rbp,%rcx,1),%rcx
ff
mov    %rcx,-0xd28(%rbp,%rax,1)
ff
jmp    1547 <sphincs_sign+0x3b7>
lea    -0xd40(%rbp),%rdi
mov    -0x30(%rbp),%eax
mov    $0x2,%ecx
cltd
idiv   %ecx
shl    $0x5,%eax
cltq
add    %rax,%rdi
lea    -0xd40(%rbp),%rsi
mov    -0x30(%rbp),%eax
shl    $0x5,%eax
cltq
add    %rax,%rsi
lea    -0xd40(%rbp),%rdx
mov    -0x30(%rbp),%eax
add    $0x1,%eax
shl    $0x5,%eax
cltq
add    %rax,%rdx
mov    -0x20(%rbp),%rcx
mov    -0x28(%rbp),%eax
shl    $0x1,%eax
shl    $0x5,%eax
cltq
add    %rax,%rcx
mov    $0x0,%al
call   1090 <hash_nn_n_mask@plt>
jmp    154c <sphincs_sign+0x3bc>
mov    -0x30(%rbp),%eax
add    $0x2,%eax
mov    %eax,-0x30(%rbp)
jmp    1474 <sphincs_sign+0x2e4>
jmp    155f <sphincs_sign+0x3cf>
mov    -0x2c(%rbp),%eax
sub    $0x1,%eax
mov    $0x2,%ecx
cltd
idiv   %ecx
add    $0x1,%eax
mov    %eax,-0x2c(%rbp)
mov    -0x28(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x28(%rbp)
jmp    1463 <sphincs_sign+0x2d3>
jmp    1586 <sphincs_sign+0x3f6>
movl   $0x0,-0x2c(%rbp)
cmpl   $0x20,-0x2c(%rbp)
jge    15c6 <sphincs_sign+0x436>
mov    -0x2c(%rbp),%eax
add    $0x0,%eax
cltq
mov    -0xd40(%rbp,%rax,1),%cl
mov    -0x34(%rbp),%eax
shl    $0x5,%eax
add    -0x2c(%rbp),%eax
cltq
mov    %cl,-0x4e0(%rbp,%rax,1)
mov    -0x2c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x2c(%rbp)
jmp    158d <sphincs_sign+0x3fd>
jmp    15cb <sphincs_sign+0x43b>
mov    -0x34(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x34(%rbp)
jmp    13d2 <sphincs_sign+0x242>
movl   $0x0,-0x2c(%rbp)
cmpl   $0x5,-0x2c(%rbp)
jge    170e <sphincs_sign+0x57e>
movzbl -0x35(%rbp),%eax
and    $0x1,%eax
cmp    $0x0,%eax
jne    1609 <sphincs_sign+0x479>
movzbl -0x35(%rbp),%eax
add    $0x1,%eax
mov    %al,-0x35(%rbp)
jmp    1613 <sphincs_sign+0x483>
movzbl -0x35(%rbp),%eax
sub    $0x1,%eax
mov    %al,-0x35(%rbp)
cmpl   $0x4,-0x2c(%rbp)
jge    1663 <sphincs_sign+0x4d3>
movl   $0x0,-0x30(%rbp)
cmpl   $0x20,-0x30(%rbp)
jge    165e <sphincs_sign+0x4ce>
movzbl -0x35(%rbp),%eax
shl    $0x5,%eax
add    -0x30(%rbp),%eax
cltq
movzbl -0x4e0(%rbp,%rax,1),%esi
ff
lea    0x9b7(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    -0x30(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x30(%rbp)
jmp    1624 <sphincs_sign+0x494>
jmp    1663 <sphincs_sign+0x4d3>
movl   $0x0,-0x30(%rbp)
mov    -0x30(%rbp),%eax
mov    $0x5,%ecx
sub    -0x2c(%rbp),%ecx
mov    $0x1,%edx
shl    %cl,%edx
mov    %edx,%ecx
cmp    %ecx,%eax
jge    16f1 <sphincs_sign+0x561>
lea    -0x4e0(%rbp),%rdi
mov    -0x30(%rbp),%eax
mov    $0x2,%ecx
cltd
idiv   %ecx
shl    $0x5,%eax
cltq
add    %rax,%rdi
lea    -0x4e0(%rbp),%rsi
mov    -0x30(%rbp),%eax
shl    $0x5,%eax
cltq
add    %rax,%rsi
lea    -0x4e0(%rbp),%rdx
mov    -0x30(%rbp),%eax
add    $0x1,%eax
shl    $0x5,%eax
cltq
add    %rax,%rdx
mov    -0x20(%rbp),%rcx
mov    -0x2c(%rbp),%eax
add    $0x7,%eax
shl    $0x1,%eax
shl    $0x5,%eax
cltq
add    %rax,%rcx
mov    $0x0,%al
call   1090 <hash_nn_n_mask@plt>
mov    -0x30(%rbp),%eax
add    $0x2,%eax
mov    %eax,-0x30(%rbp)
jmp    166a <sphincs_sign+0x4da>
movzbl -0x35(%rbp),%eax
mov    $0x2,%ecx
cltd
idiv   %ecx
mov    %al,-0x35(%rbp)
mov    -0x2c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x2c(%rbp)
jmp    15e0 <sphincs_sign+0x450>
movl   $0x0,-0x2c(%rbp)
cmpl   $0x20,-0x2c(%rbp)
jge    1753 <sphincs_sign+0x5c3>
movslq -0x2c(%rbp),%rax
movb   $0x0,-0xe0(%rbp,%rax,1)
mov    -0x2c(%rbp),%eax
add    $0x0,%eax
cltq
mov    -0x4e0(%rbp,%rax,1),%cl
movslq -0x2c(%rbp),%rax
mov    %cl,-0xd60(%rbp,%rax,1)
mov    -0x2c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x2c(%rbp)
jmp    1715 <sphincs_sign+0x585>
jmp    1758 <sphincs_sign+0x5c8>
mov    -0x24(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x24(%rbp)
jmp    12f4 <sphincs_sign+0x164>
xor    %eax,%eax
add    $0xd70,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<sphincs_sign>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0xd68,%rsp
mov    %rcx,0x8(%rsp)
mov    %rsi,%r15
mov    %rdi,%r14
mov    %rdx,0x68(%rsp)
lea    0x20(%rdx),%rcx
lea    0x20(%rsp),%rdi
mov    %r14,%rsi
mov    %r15,%rdx
xor    %eax,%eax
call   1060 <prf@plt>
lea    0x40(%rsp),%r12
lea    0x18(%rsp),%r13
lea    0xe18(%rip),%rbx
xor    %ebp,%ebp
nopw   0x0(%rax,%rax,1)
cmp    $0x8,%ebp
mov    %r13,%rax
cmovb  %r12,%rax
movzbl (%rax,%rbp,1),%esi
mov    %rbx,%rdi
xor    %eax,%eax
call   1050 <printf@plt>
add    $0x1,%rbp
cmp    $0x28,%ebp
jne    11f0 <sphincs_sign+0x50>
lea    0x40(%rsp),%rbp
mov    $0xa,%edi
call   1030 <putchar@plt>
lea    0xc0(%rsp),%rbx
lea    0x20(%rsp),%rsi
mov    %rbx,%rdi
mov    %r14,%rdx
mov    %r15,%rcx
xor    %eax,%eax
call   1040 <hash_any_n_2n@plt>
mov    0x40(%rsp),%al
and    $0xf,%al
or     $0xc0,%al
mov    %al,0x40(%rsp)
lea    0x80(%rsp),%r14
mov    %r14,%rdi
mov    %rbp,%rsi
mov    0x68(%rsp),%rdx
xor    %eax,%eax
call   1080 <prf_64@plt>
mov    %rbx,%rdi
mov    %r14,%rsi
mov    0x8(%rsp),%rbx
mov    %rbx,%rdx
xor    %eax,%eax
call   10b0 <horst_sign_opti@plt>
lea    0xa0(%rsp),%rdi
mov    %r14,%rsi
mov    %rbx,%rdx
xor    %eax,%eax
call   1090 <horst_keygen@plt>
xor    %ebx,%ebx
nop
mov    0x40(%rsp),%cl
and    $0xf,%cl
test   %ebx,%ebx
mov    %ebx,0x18(%rsp)
je     1340 <sphincs_sign+0x1a0>
mov    0x47(%rsp),%dl
mov    0x46(%rsp),%sil
shr    $0x5,%dl
lea    0x0(,%rsi,8),%eax
or     %dl,%al
mov    0x45(%rsp),%dl
shr    $0x5,%sil
lea    0x0(,%rdx,8),%edi
or     %sil,%dil
mov    %dil,0x46(%rsp)
mov    0x44(%rsp),%sil
shr    $0x5,%dl
lea    0x0(,%rsi,8),%edi
or     %dl,%dil
mov    %dil,0x45(%rsp)
mov    0x43(%rsp),%dl
shr    $0x5,%sil
lea    0x0(,%rdx,8),%edi
or     %sil,%dil
mov    %dil,0x44(%rsp)
mov    0x41(%rsp),%sil
mov    0x42(%rsp),%dil
shr    $0x5,%dl
lea    0x0(,%rdi,8),%ebp
or     %dl,%bpl
mov    %bpl,0x43(%rsp)
shr    $0x5,%dil
lea    0x0(,%rsi,8),%edx
or     %dil,%dl
mov    %dl,0x42(%rsp)
shr    $0x5,%sil
shl    $0x3,%cl
or     %sil,%cl
mov    %cl,0x41(%rsp)
mov    %ebx,%ecx
shl    $0x4,%cl
jmp    1344 <sphincs_sign+0x1a4>
mov    0x47(%rsp),%al
mov    %cl,0x40(%rsp)
mov    %eax,%ecx
and    $0x1f,%cl
mov    %cl,0x7(%rsp)
movzbl %cl,%ecx
mov    %ecx,0x1c(%rsp)
xor    %ebx,%ebx
nopw   0x0(%rax,%rax,1)
mov    %rbx,%rbp
shl    $0x5,%rbp
and    $0xe0,%al
mov    %ebx,%ecx
or     %al,%cl
mov    %cl,0x47(%rsp)
mov    %r14,%rdi
lea    0x40(%rsp),%rsi
mov    0x68(%rsp),%rdx
xor    %eax,%eax
call   1080 <prf_64@plt>
mov    %rbx,0x78(%rsp)
cmp    0x1c(%rsp),%ebx
jne    13a7 <sphincs_sign+0x207>
lea    0xa0(%rsp),%rdi
mov    %r14,%rsi
mov    0x8(%rsp),%rdx
xor    %eax,%eax
call   10c0 <wotsp_sign@plt>
lea    (%rsp,%rbp,1),%rax
add    $0x100,%rax
mov    %rax,0x70(%rsp)
lea    0x500(%rsp),%rdi
mov    %r14,%rsi
mov    0x8(%rsp),%rdx
xor    %eax,%eax
call   1070 <wotsp_keygen@plt>
mov    $0x43,%r13d
xor    %eax,%eax
mov    %rax,0x10(%rsp)
jmp    1412 <sphincs_sign+0x272>
nopl   0x0(%rax)
mov    %r13d,%eax
add    $0xffffffff,%eax
shr    $0x1f,%eax
add    %eax,%r13d
add    $0xffffffff,%r13d
sar    %r13d
add    $0x1,%r13d
mov    0x10(%rsp),%rcx
add    $0x1,%rcx
mov    %rcx,%rax
mov    %rcx,0x10(%rsp)
cmp    $0x7,%rcx
je     14c0 <sphincs_sign+0x320>
test   %r13d,%r13d
jle    13e0 <sphincs_sign+0x240>
mov    0x10(%rsp),%r15
shl    $0x6,%r15
add    0x8(%rsp),%r15
mov    %r13d,%ebx
xor    %r14d,%r14d
xor    %r12d,%r12d
xor    %ebp,%ebp
jmp    1481 <sphincs_sign+0x2e1>
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax)
lea    (%rsp,%rax,1),%rdi
add    $0x500,%rdi
mov    %r12d,%eax
lea    0x500(%rsp,%rax,1),%rsi
lea    0x20(%r12),%eax
lea    (%rsp,%rax,1),%rdx
add    $0x500,%rdx
mov    %r15,%rcx
xor    %eax,%eax
call   10a0 <hash_nn_n_mask@plt>
add    $0x40,%r12
add    $0x20,%r14
cmp    %rbx,%rbp
jae    13e0 <sphincs_sign+0x240>
add    $0x2,%rbp
mov    %r14d,%eax
and    $0xffffffe0,%eax
cmp    %rbx,%rbp
jbe    1440 <sphincs_sign+0x2a0>
mov    %r12d,%ecx
and    $0xffffffc0,%ecx
movaps 0x500(%rsp,%rcx,1),%xmm0
movaps 0x510(%rsp,%rcx,1),%xmm1
movaps %xmm1,0x510(%rsp,%rax,1)
movaps %xmm0,0x500(%rsp,%rax,1)
jmp    1470 <sphincs_sign+0x2d0>
nopl   0x0(%rax,%rax,1)
movaps 0x500(%rsp),%xmm0
movaps 0x510(%rsp),%xmm1
mov    0x70(%rsp),%rax
movaps %xmm1,0x10(%rax)
movaps %xmm0,(%rax)
mov    0x78(%rsp),%rbx
add    $0x1,%rbx
cmp    $0x20,%rbx
je     1500 <sphincs_sign+0x360>
mov    0x47(%rsp),%al
lea    0x80(%rsp),%r14
jmp    1360 <sphincs_sign+0x1c0>
nopl   0x0(%rax)
xor    %r12d,%r12d
mov    0x7(%rsp),%cl
nopw   0x0(%rax,%rax,1)
mov    %ecx,%eax
and    $0x1,%al
neg    %al
sbb    %r15d,%r15d
or     $0x1,%r15b
add    %cl,%r15b
cmp    $0x4,%r12
lea    0xad5(%rip),%r14
je     1568 <sphincs_sign+0x3c8>
movzbl %r15b,%eax
shl    $0x5,%rax
lea    (%rsp,%rax,1),%rbx
add    $0x100,%rbx
xor    %ebp,%ebp
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax)
movzbl (%rbx,%rbp,1),%esi
mov    %r14,%rdi
xor    %eax,%eax
call   1050 <printf@plt>
add    $0x1,%rbp
cmp    $0x20,%rbp
jne    1550 <sphincs_sign+0x3b0>
mov    %r15d,0x10(%rsp)
mov    $0x5,%cl
sub    %r12b,%cl
mov    $0x1,%r14d
shl    %cl,%r14d
mov    %r12,%rax
shl    $0x6,%rax
mov    0x8(%rsp),%rcx
lea    (%rax,%rcx,1),%r15
add    $0x1c0,%r15
xor    %r13d,%r13d
lea    0x100(%rsp),%rbp
mov    %rbp,%rbx
lea    0x20(%rbx),%rdx
mov    %rbp,%rdi
mov    %rbx,%rsi
mov    %r15,%rcx
xor    %eax,%eax
call   10a0 <hash_nn_n_mask@plt>
add    $0x20,%rbp
add    $0x40,%rbx
add    $0x2,%r13d
cmp    %r13d,%r14d
jg     15a0 <sphincs_sign+0x400>
mov    0x10(%rsp),%eax
shr    %al
add    $0x1,%r12
mov    %eax,%ecx
cmp    $0x5,%r12
jne    1510 <sphincs_sign+0x370>
xorps  %xmm0,%xmm0
movaps %xmm0,0x90(%rsp)
movaps %xmm0,0x80(%rsp)
movaps 0x100(%rsp),%xmm0
movaps 0x110(%rsp),%xmm1
movaps %xmm0,0xa0(%rsp)
movaps %xmm1,0xb0(%rsp)
mov    0x18(%rsp),%ebx
add    $0x1,%ebx
cmp    $0xc,%ebx
lea    0x80(%rsp),%r14
jne    1290 <sphincs_sign+0xf0>
xor    %eax,%eax
add    $0xd68,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [5 x i8] c"%02x\00"
@.str.1 = [2 x i8] c"\0A\00"
define i32 @sphincs_sign(i8* %0, i64 %1, i8* %2, i8* %3) {
%5 = alloca i8*
%6 = alloca i64
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i32
%10 = alloca i32
%11 = alloca i32
%12 = alloca i32
%13 = alloca i32
%14 = alloca i8
%15 = alloca [64 x i8]
%16 = alloca [64 x i8]
%17 = alloca [32 x i8]
%18 = alloca [1024 x i8]
%19 = alloca [2144 x i8]
%20 = alloca [32 x i8]
%21 = alloca i8*
store i8* %0, i8** %5
store i64 %1, i64* %6
store i8* %2, i8** %7
store i8* %3, i8** %8
store i32 0, i32* %9
store i32 0, i32* %10
store i32 0, i32* %11
store i32 0, i32* %12
store i32 0, i32* %13
store i8 0, i8* %14
%22 = getelementptr inbounds [64 x i8], [64 x i8]* %15, i64 0, i64 0
%23 = getelementptr inbounds i8, i8* %22, i64 32
store i8* %23, i8** %21
%24 = getelementptr inbounds [64 x i8], [64 x i8]* %15, i64 0, i64 0
%25 = load i8*, i8** %5
%26 = load i64, i64* %6
%27 = load i8*, i8** %7
%28 = getelementptr inbounds i8, i8* %27, i64 32
%29 = call i32 (i8*, i8*, i64, i8*, ...) bitcast (i32 (...)* @prf to i32 (i8*, i8*, i64, i8*, ...)*)(i8* %24, i8* %25, i64 %26, i8* %28)
store i32 0, i32* %11
br label %30
30: ; preds = %49, %4
%31 = load i32, i32* %11
%32 = icmp slt i32 %31, 40
br i1 %32, label %33, label %52
33: ; preds = %30
%34 = load i32, i32* %11
%35 = icmp slt i32 %34, 8
br i1 %35, label %36, label %39
36: ; preds = %33
%37 = load i32, i32* %11
%38 = add nsw i32 32, %37
br label %42
39: ; preds = %33
%40 = load i32, i32* %11
%41 = sub nsw i32 %40, 8
br label %42
42: ; preds = %39, %36
%43 = phi i32 [ %38, %36 ], [ %41, %39 ]
%44 = sext i32 %43 to i64
%45 = getelementptr inbounds [64 x i8], [64 x i8]* %15, i64 0, i64 %44
%46 = load i8, i8* %45
%47 = zext i8 %46 to i32
%48 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %47)
br label %49
49: ; preds = %42
%50 = load i32, i32* %11
%51 = add nsw i32 %50, 1
store i32 %51, i32* %11
br label %30
52: ; preds = %30
%53 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0))
%54 = getelementptr inbounds [64 x i8], [64 x i8]* %16, i64 0, i64 0
%55 = getelementptr inbounds [64 x i8], [64 x i8]* %15, i64 0, i64 0
%56 = load i8*, i8** %5
%57 = load i64, i64* %6
%58 = call i32 (i8*, i8*, i8*, i64, ...) bitcast (i32 (...)* @hash_any_n_2n to i32 (i8*, i8*, i8*, i64, ...)*)(i8* %54, i8* %55, i8* %56, i64 %57)
%59 = load i8*, i8** %21
%60 = getelementptr inbounds i8, i8* %59, i64 0
%61 = load i8, i8* %60
%62 = zext i8 %61 to i32
%63 = and i32 %62, 15
%64 = or i32 192, %63
%65 = trunc i32 %64 to i8
%66 = load i8*, i8** %21
%67 = getelementptr inbounds i8, i8* %66, i64 0
store i8 %65, i8* %67
%68 = getelementptr inbounds [32 x i8], [32 x i8]* %17, i64 0, i64 0
%69 = load i8*, i8** %21
%70 = load i8*, i8** %7
%71 = call i32 (i8*, i8*, i8*, ...) bitcast (i32 (...)* @prf_64 to i32 (i8*, i8*, i8*, ...)*)(i8* %68, i8* %69, i8* %70)
%72 = getelementptr inbounds [64 x i8], [64 x i8]* %16, i64 0, i64 0
%73 = getelementptr inbounds [32 x i8], [32 x i8]* %17, i64 0, i64 0
%74 = load i8*, i8** %8
%75 = call i32 (i8*, i8*, i8*, ...) bitcast (i32 (...)* @horst_sign_opti to i32 (i8*, i8*, i8*, ...)*)(i8* %72, i8* %73, i8* %74)
%76 = getelementptr inbounds [32 x i8], [32 x i8]* %20, i64 0, i64 0
%77 = getelementptr inbounds [32 x i8], [32 x i8]* %17, i64 0, i64 0
%78 = load i8*, i8** %8
%79 = call i32 (i8*, i8*, i8*, ...) bitcast (i32 (...)* @horst_keygen to i32 (i8*, i8*, i8*, ...)*)(i8* %76, i8* %77, i8* %78)
store i32 0, i32* %9
br label %80
80: ; preds = %374, %52
%81 = load i32, i32* %9
%82 = icmp slt i32 %81, 12
br i1 %82, label %83, label %377
83: ; preds = %80
%84 = load i8*, i8** %21
%85 = getelementptr inbounds i8, i8* %84, i64 0
%86 = load i8, i8* %85
%87 = zext i8 %86 to i32
%88 = and i32 %87, 15
%89 = trunc i32 %88 to i8
%90 = load i8*, i8** %21
%91 = getelementptr inbounds i8, i8* %90, i64 0
store i8 %89, i8* %91
%92 = load i32, i32* %9
%93 = icmp ne i32 %92, 0
br i1 %93, label %94, label %132
94: ; preds = %83
store i32 7, i32* %11
br label %95
95: ; preds = %122, %94
%96 = load i32, i32* %11
%97 = icmp sgt i32 %96, 0
br i1 %97, label %98, label %125
98: ; preds = %95
%99 = load i8*, i8** %21
%100 = load i32, i32* %11
%101 = sext i32 %100 to i64
%102 = getelementptr inbounds i8, i8* %99, i64 %101
%103 = load i8, i8* %102
%104 = zext i8 %103 to i32
%105 = and i32 %104, 224
%106 = ashr i32 %105, 5
%107 = load i8*, i8** %21
%108 = load i32, i32* %11
%109 = sub nsw i32 %108, 1
%110 = sext i32 %109 to i64
%111 = getelementptr inbounds i8, i8* %107, i64 %110
%112 = load i8, i8* %111
%113 = zext i8 %112 to i32
%114 = and i32 %113, 31
%115 = shl i32 %114, 3
%116 = or i32 %106, %115
%117 = trunc i32 %116 to i8
%118 = load i8*, i8** %21
%119 = load i32, i32* %11
%120 = sext i32 %119 to i64
%121 = getelementptr inbounds i8, i8* %118, i64 %120
store i8 %117, i8* %121
br label %122
122: ; preds = %98
%123 = load i32, i32* %11
%124 = add nsw i32 %123, -1
store i32 %124, i32* %11
br label %95
125: ; preds = %95
%126 = load i32, i32* %9
%127 = shl i32 %126, 4
%128 = and i32 %127, 240
%129 = trunc i32 %128 to i8
%130 = load i8*, i8** %21
%131 = getelementptr inbounds i8, i8* %130, i64 0
store i8 %129, i8* %131
br label %143
132: ; preds = %83
%133 = load i32, i32* %9
%134 = shl i32 %133, 4
%135 = load i8*, i8** %21
%136 = getelementptr inbounds i8, i8* %135, i64 0
%137 = load i8, i8* %136
%138 = zext i8 %137 to i32
%139 = or i32 %134, %138
%140 = trunc i32 %139 to i8
%141 = load i8*, i8** %21
%142 = getelementptr inbounds i8, i8* %141, i64 0
store i8 %140, i8* %142
br label %143
143: ; preds = %132, %125
%144 = load i8*, i8** %21
%145 = getelementptr inbounds i8, i8* %144, i64 7
%146 = load i8, i8* %145
%147 = zext i8 %146 to i32
%148 = and i32 %147, 31
%149 = trunc i32 %148 to i8
store i8 %149, i8* %14
store i32 0, i32* %13
br label %150
150: ; preds = %266, %143
%151 = load i32, i32* %13
%152 = icmp slt i32 %151, 32
br i1 %152, label %153, label %269
153: ; preds = %150
%154 = load i8*, i8** %21
%155 = getelementptr inbounds i8, i8* %154, i64 7
%156 = load i8, i8* %155
%157 = zext i8 %156 to i32
%158 = and i32 %157, 224
%159 = load i32, i32* %13
%160 = or i32 %158, %159
%161 = trunc i32 %160 to i8
%162 = load i8*, i8** %21
%163 = getelementptr inbounds i8, i8* %162, i64 7
store i8 %161, i8* %163
%164 = getelementptr inbounds [32 x i8], [32 x i8]* %17, i64 0, i64 0
%165 = load i8*, i8** %21
%166 = load i8*, i8** %7
%167 = call i32 (i8*, i8*, i8*, ...) bitcast (i32 (...)* @prf_64 to i32 (i8*, i8*, i8*, ...)*)(i8* %164, i8* %165, i8* %166)
%168 = load i32, i32* %13
%169 = load i8, i8* %14
%170 = zext i8 %169 to i32
%171 = icmp eq i32 %168, %170
br i1 %171, label %172, label %177
172: ; preds = %153
%173 = getelementptr inbounds [32 x i8], [32 x i8]* %20, i64 0, i64 0
%174 = getelementptr inbounds [32 x i8], [32 x i8]* %17, i64 0, i64 0
%175 = load i8*, i8** %8
%176 = call i32 (i8*, i8*, i8*, ...) bitcast (i32 (...)* @wotsp_sign to i32 (i8*, i8*, i8*, ...)*)(i8* %173, i8* %174, i8* %175)
br label %177
177: ; preds = %172, %153
%178 = getelementptr inbounds [2144 x i8], [2144 x i8]* %19, i64 0, i64 0
%179 = getelementptr inbounds [32 x i8], [32 x i8]* %17, i64 0, i64 0
%180 = load i8*, i8** %8
%181 = call i32 (i8*, i8*, i8*, ...) bitcast (i32 (...)* @wotsp_keygen to i32 (i8*, i8*, i8*, ...)*)(i8* %178, i8* %179, i8* %180)
br label %182
182: ; preds = %177
store i32 67, i32* %11
store i32 0, i32* %10
br label %183
183: ; preds = %238, %182
%184 = load i32, i32* %11
%185 = icmp sgt i32 %184, 1
br i1 %185, label %186, label %245
186: ; preds = %183
store i32 0, i32* %12
br label %187
187: ; preds = %234, %186
%188 = load i32, i32* %12
%189 = load i32, i32* %11
%190 = icmp slt i32 %188, %189
br i1 %190, label %191, label %237
191: ; preds = %187
%192 = load i32, i32* %12
%193 = add nsw i32 %192, 2
%194 = load i32, i32* %11
%195 = icmp sgt i32 %193, %194
br i1 %195, label %196, label %208
196: ; preds = %191
%197 = getelementptr inbounds [2144 x i8], [2144 x i8]* %19, i64 0, i64 0
%198 = load i32, i32* %12
%199 = sdiv i32 %198, 2
%200 = mul nsw i32 %199, 32
%201 = sext i32 %200 to i64
%202 = getelementptr inbounds i8, i8* %197, i64 %201
%203 = getelementptr inbounds [2144 x i8], [2144 x i8]* %19, i64 0, i64 0
%204 = load i32, i32* %12
%205 = mul nsw i32 %204, 32
%206 = sext i32 %205 to i64
%207 = getelementptr inbounds i8, i8* %203, i64 %206
br label %233
208: ; preds = %191
%209 = getelementptr inbounds [2144 x i8], [2144 x i8]* %19, i64 0, i64 0
%210 = load i32, i32* %12
%211 = sdiv i32 %210, 2
%212 = mul nsw i32 %211, 32
%213 = sext i32 %212 to i64
%214 = getelementptr inbounds i8, i8* %209, i64 %213
%215 = getelementptr inbounds [2144 x i8], [2144 x i8]* %19, i64 0, i64 0
%216 = load i32, i32* %12
%217 = mul nsw i32 %216, 32
%218 = sext i32 %217 to i64
%219 = getelementptr inbounds i8, i8* %215, i64 %218
%220 = getelementptr inbounds [2144 x i8], [2144 x i8]* %19, i64 0, i64 0
%221 = load i32, i32* %12
%222 = add nsw i32 %221, 1
%223 = mul nsw i32 %222, 32
%224 = sext i32 %223 to i64
%225 = getelementptr inbounds i8, i8* %220, i64 %224
%226 = load i8*, i8** %8
%227 = load i32, i32* %10
%228 = mul nsw i32 2, %227
%229 = mul nsw i32 %228, 32
%230 = sext i32 %229 to i64
%231 = getelementptr inbounds i8, i8* %226, i64 %230
%232 = call i32 (i8*, i8*, i8*, i8*, ...) bitcast (i32 (...)* @hash_nn_n_mask to i32 (i8*, i8*, i8*, i8*, ...)*)(i8* %214, i8* %219, i8* %225, i8* %231)
br label %233
233: ; preds = %208, %196
br label %234
234: ; preds = %233
%235 = load i32, i32* %12
%236 = add nsw i32 %235, 2
store i32 %236, i32* %12
br label %187
237: ; preds = %187
br label %238
238: ; preds = %237
%239 = load i32, i32* %11
%240 = sub nsw i32 %239, 1
%241 = sdiv i32 %240, 2
%242 = add nsw i32 1, %241
store i32 %242, i32* %11
%243 = load i32, i32* %10
%244 = add nsw i32 %243, 1
store i32 %244, i32* %10
br label %183
245: ; preds = %183
br label %246
246: ; preds = %245
store i32 0, i32* %11
br label %247
247: ; preds = %262, %246
%248 = load i32, i32* %11
%249 = icmp slt i32 %248, 32
br i1 %249, label %250, label %265
250: ; preds = %247
%251 = load i32, i32* %11
%252 = add nsw i32 0, %251
%253 = sext i32 %252 to i64
%254 = getelementptr inbounds [2144 x i8], [2144 x i8]* %19, i64 0, i64 %253
%255 = load i8, i8* %254
%256 = load i32, i32* %13
%257 = mul nsw i32 %256, 32
%258 = load i32, i32* %11
%259 = add nsw i32 %257, %258
%260 = sext i32 %259 to i64
%261 = getelementptr inbounds [1024 x i8], [1024 x i8]* %18, i64 0, i64 %260
store i8 %255, i8* %261
br label %262
262: ; preds = %250
%263 = load i32, i32* %11
%264 = add nsw i32 %263, 1
store i32 %264, i32* %11
br label %247
265: ; preds = %247
br label %266
266: ; preds = %265
%267 = load i32, i32* %13
%268 = add nsw i32 %267, 1
store i32 %268, i32* %13
br label %150
269: ; preds = %150
store i32 0, i32* %11
br label %270
270: ; preds = %351, %269
%271 = load i32, i32* %11
%272 = icmp slt i32 %271, 5
br i1 %272, label %273, label %354
273: ; preds = %270
%274 = load i8, i8* %14
%275 = zext i8 %274 to i32
%276 = and i32 %275, 1
%277 = icmp eq i32 %276, 0
br i1 %277, label %278, label %283
278: ; preds = %273
%279 = load i8, i8* %14
%280 = zext i8 %279 to i32
%281 = add nsw i32 %280, 1
%282 = trunc i32 %281 to i8
store i8 %282, i8* %14
br label %288
283: ; preds = %273
%284 = load i8, i8* %14
%285 = zext i8 %284 to i32
%286 = sub nsw i32 %285, 1
%287 = trunc i32 %286 to i8
store i8 %287, i8* %14
br label %288
288: ; preds = %283, %278
%289 = load i32, i32* %11
%290 = icmp slt i32 %289, 4
br i1 %290, label %291, label %310
291: ; preds = %288
store i32 0, i32* %12
br label %292
292: ; preds = %306, %291
%293 = load i32, i32* %12
%294 = icmp slt i32 %293, 32
br i1 %294, label %295, label %309
295: ; preds = %292
%296 = load i8, i8* %14
%297 = zext i8 %296 to i32
%298 = mul nsw i32 %297, 32
%299 = load i32, i32* %12
%300 = add nsw i32 %298, %299
%301 = sext i32 %300 to i64
%302 = getelementptr inbounds [1024 x i8], [1024 x i8]* %18, i64 0, i64 %301
%303 = load i8, i8* %302
%304 = zext i8 %303 to i32
%305 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %304)
br label %306
306: ; preds = %295
%307 = load i32, i32* %12
%308 = add nsw i32 %307, 1
store i32 %308, i32* %12
br label %292
309: ; preds = %292
br label %310
310: ; preds = %309, %288
store i32 0, i32* %12
br label %311
311: ; preds = %343, %310
%312 = load i32, i32* %12
%313 = load i32, i32* %11
%314 = sub nsw i32 5, %313
%315 = shl i32 1, %314
%316 = icmp slt i32 %312, %315
br i1 %316, label %317, label %346
317: ; preds = %311
%318 = getelementptr inbounds [1024 x i8], [1024 x i8]* %18, i64 0, i64 0
%319 = load i32, i32* %12
%320 = sdiv i32 %319, 2
%321 = mul nsw i32 %320, 32
%322 = sext i32 %321 to i64
%323 = getelementptr inbounds i8, i8* %318, i64 %322
%324 = getelementptr inbounds [1024 x i8], [1024 x i8]* %18, i64 0, i64 0
%325 = load i32, i32* %12
%326 = mul nsw i32 %325, 32
%327 = sext i32 %326 to i64
%328 = getelementptr inbounds i8, i8* %324, i64 %327
%329 = getelementptr inbounds [1024 x i8], [1024 x i8]* %18, i64 0, i64 0
%330 = load i32, i32* %12
%331 = add nsw i32 %330, 1
%332 = mul nsw i32 %331, 32
%333 = sext i32 %332 to i64
%334 = getelementptr inbounds i8, i8* %329, i64 %333
%335 = load i8*, i8** %8
%336 = load i32, i32* %11
%337 = add nsw i32 7, %336
%338 = mul nsw i32 2, %337
%339 = mul nsw i32 %338, 32
%340 = sext i32 %339 to i64
%341 = getelementptr inbounds i8, i8* %335, i64 %340
%342 = call i32 (i8*, i8*, i8*, i8*, ...) bitcast (i32 (...)* @hash_nn_n_mask to i32 (i8*, i8*, i8*, i8*, ...)*)(i8* %323, i8* %328, i8* %334, i8* %341)
br label %343
343: ; preds = %317
%344 = load i32, i32* %12
%345 = add nsw i32 %344, 2
store i32 %345, i32* %12
br label %311
346: ; preds = %311
%347 = load i8, i8* %14
%348 = zext i8 %347 to i32
%349 = sdiv i32 %348, 2
%350 = trunc i32 %349 to i8
store i8 %350, i8* %14
br label %351
351: ; preds = %346
%352 = load i32, i32* %11
%353 = add nsw i32 %352, 1
store i32 %353, i32* %11
br label %270
354: ; preds = %270
store i32 0, i32* %11
br label %355
355: ; preds = %370, %354
%356 = load i32, i32* %11
%357 = icmp slt i32 %356, 32
br i1 %357, label %358, label %373
358: ; preds = %355
%359 = load i32, i32* %11
%360 = sext i32 %359 to i64
%361 = getelementptr inbounds [32 x i8], [32 x i8]* %17, i64 0, i64 %360
store i8 0, i8* %361
%362 = load i32, i32* %11
%363 = add nsw i32 %362, 0
%364 = sext i32 %363 to i64
%365 = getelementptr inbounds [1024 x i8], [1024 x i8]* %18, i64 0, i64 %364
%366 = load i8, i8* %365
%367 = load i32, i32* %11
%368 = sext i32 %367 to i64
%369 = getelementptr inbounds [32 x i8], [32 x i8]* %20, i64 0, i64 %368
store i8 %366, i8* %369
br label %370
370: ; preds = %358
%371 = load i32, i32* %11
%372 = add nsw i32 %371, 1
store i32 %372, i32* %11
br label %355
373: ; preds = %355
br label %374
374: ; preds = %373
%375 = load i32, i32* %9
%376 = add nsw i32 %375, 1
store i32 %376, i32* %9
br label %80
377: ; preds = %80
ret i32 0
}

LLVM IR (-O2):
@.str = [5 x i8] c"%02x\00"
define i32 @sphincs_sign(i8* %0, i64 %1, i8* %2, i8* %3) {
%5 = alloca [64 x i8]
%6 = alloca [64 x i8]
%7 = alloca [32 x i8]
%8 = getelementptr inbounds [32 x i8], [32 x i8]* %7, i64 0, i64 0
%9 = alloca [1024 x i8]
%10 = getelementptr inbounds [1024 x i8], [1024 x i8]* %9, i64 0, i64 0
%11 = alloca [2144 x i8]
%12 = getelementptr inbounds [2144 x i8], [2144 x i8]* %11, i64 0, i64 0
%13 = alloca [32 x i8]
%14 = getelementptr inbounds [32 x i8], [32 x i8]* %13, i64 0, i64 0
%15 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 0
%16 = getelementptr inbounds [64 x i8], [64 x i8]* %6, i64 0, i64 0
%17 = getelementptr inbounds [32 x i8], [32 x i8]* %7, i64 0, i64 0
%18 = getelementptr inbounds [1024 x i8], [1024 x i8]* %9, i64 0, i64 0
%19 = getelementptr inbounds [2144 x i8], [2144 x i8]* %11, i64 0, i64 0
%20 = getelementptr inbounds [32 x i8], [32 x i8]* %13, i64 0, i64 0
%21 = getelementptr inbounds i8, i8* %2, i64 32
%22 = call i32 (i8*, i8*, i64, i8*, ...) bitcast (i32 (...)* @prf to i32 (i8*, i8*, i64, i8*, ...)*)(i8* %15, i8* %0, i64 %1, i8* %21)
br label %23
23: ; preds = %4, %23
%24 = phi i32 [ 0, %4 ], [ %33, %23 ]
%25 = icmp ult i32 %24, 8
%26 = select i1 %25, i32 32, i32 -8
%27 = add nsw i32 %26, %24
%28 = sext i32 %27 to i64
%29 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 %28
%30 = load i8, i8* %29
%31 = zext i8 %30 to i32
%32 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %31)
%33 = add nuw nsw i32 %24, 1
%34 = icmp eq i32 %33, 40
br i1 %34, label %35, label %23
35: ; preds = %23
%36 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 32
%37 = call i32 @putchar(i32 10)
%38 = call i32 (i8*, i8*, i8*, i64, ...) bitcast (i32 (...)* @hash_any_n_2n to i32 (i8*, i8*, i8*, i64, ...)*)(i8* %16, i8* %15, i8* %0, i64 %1)
%39 = load i8, i8* %36
%40 = and i8 %39, 15
%41 = or i8 %40, -64
store i8 %41, i8* %36
%42 = call i32 (i8*, i8*, i8*, ...) bitcast (i32 (...)* @prf_64 to i32 (i8*, i8*, i8*, ...)*)(i8* %17, i8* %36, i8* %2)
%43 = call i32 (i8*, i8*, i8*, ...) bitcast (i32 (...)* @horst_sign_opti to i32 (i8*, i8*, i8*, ...)*)(i8* %16, i8* %17, i8* %3)
%44 = call i32 (i8*, i8*, i8*, ...) bitcast (i32 (...)* @horst_keygen to i32 (i8*, i8*, i8*, ...)*)(i8* %20, i8* %17, i8* %3)
%45 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 39
%46 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 39
%47 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 38
%48 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 37
%49 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 36
%50 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 35
%51 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 34
%52 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 33
br label %53
53: ; preds = %35, %184
%54 = phi i32 [ 0, %35 ], [ %185, %184 ]
%55 = load i8, i8* %36
%56 = and i8 %55, 15
%57 = icmp eq i32 %54, 0
br i1 %57, label %58, label %60
58: ; preds = %53
%59 = load i8, i8* %45
br label %77
60: ; preds = %53
%61 = load i8, i8* %46
%62 = load i8, i8* %47
%63 = call i8 @llvm.fshl.i8(i8 %62, i8 %61, i8 3)
%64 = load i8, i8* %48
%65 = call i8 @llvm.fshl.i8(i8 %64, i8 %62, i8 3)
store i8 %65, i8* %47
%66 = load i8, i8* %49
%67 = call i8 @llvm.fshl.i8(i8 %66, i8 %64, i8 3)
store i8 %67, i8* %48
%68 = load i8, i8* %50
%69 = call i8 @llvm.fshl.i8(i8 %68, i8 %66, i8 3)
store i8 %69, i8* %49
%70 = load i8, i8* %51
%71 = call i8 @llvm.fshl.i8(i8 %70, i8 %68, i8 3)
store i8 %71, i8* %50
%72 = load i8, i8* %52
%73 = call i8 @llvm.fshl.i8(i8 %72, i8 %70, i8 3)
store i8 %73, i8* %51
%74 = call i8 @llvm.fshl.i8(i8 %56, i8 %72, i8 3)
store i8 %74, i8* %52
%75 = trunc i32 %54 to i8
%76 = shl i8 %75, 4
br label %77
77: ; preds = %58, %60
%78 = phi i8 [ %63, %60 ], [ %59, %58 ]
%79 = phi i8 [ %76, %60 ], [ %56, %58 ]
store i8 %79, i8* %36
%80 = and i8 %78, 31
%81 = zext i8 %80 to i32
br label %82
82: ; preds = %100, %77
%83 = phi i8 [ %78, %77 ], [ %101, %100 ]
%84 = phi i64 [ 0, %77 ], [ %98, %100 ]
%85 = trunc i64 %84 to i32
%86 = shl nuw nsw i64 %84, 5
%87 = getelementptr [1024 x i8], [1024 x i8]* %9, i64 0, i64 %86
%88 = and i8 %83, -32
%89 = trunc i64 %84 to i8
%90 = or i8 %88, %89
store i8 %90, i8* %45
%91 = call i32 (i8*, i8*, i8*, ...) bitcast (i32 (...)* @prf_64 to i32 (i8*, i8*, i8*, ...)*)(i8* %17, i8* %36, i8* %2)
%92 = icmp eq i32 %85, %81
br i1 %92, label %93, label %95
93: ; preds = %82
%94 = call i32 (i8*, i8*, i8*, ...) bitcast (i32 (...)* @wotsp_sign to i32 (i8*, i8*, i8*, ...)*)(i8* %20, i8* %17, i8* %3)
br label %95
95: ; preds = %93, %82
%96 = call i32 (i8*, i8*, i8*, ...) bitcast (i32 (...)* @wotsp_keygen to i32 (i8*, i8*, i8*, ...)*)(i8* %19, i8* %17, i8* %3)
br label %102
97: ; preds = %135
%98 = add nuw nsw i64 %84, 1
%99 = icmp eq i64 %98, 32
br i1 %99, label %141, label %100
100: ; preds = %97
%101 = load i8, i8* %45
br label %82
102: ; preds = %95, %135
%103 = phi i64 [ 0, %95 ], [ %139, %135 ]
%104 = phi i32 [ 67, %95 ], [ %138, %135 ]
%105 = icmp sgt i32 %104, 0
br i1 %105, label %106, label %135
106: ; preds = %102
%107 = shl nsw i64 %103, 6
%108 = getelementptr inbounds i8, i8* %3, i64 %107
%109 = zext i32 %104 to i64
br label %110
110: ; preds = %106, %133
%111 = phi i64 [ 0, %106 ], [ %112, %133 ]
%112 = add nuw nsw i64 %111, 2
%113 = icmp ugt i64 %112, %109
br i1 %113, label %114, label %121
114: ; preds = %110
%115 = shl i64 %111, 4
%116 = and i64 %115, 4294967264
%117 = getelementptr inbounds [2144 x i8], [2144 x i8]* %11, i64 0, i64 %116
%118 = shl i64 %111, 5
%119 = and i64 %118, 4294967232
%120 = getelementptr inbounds [2144 x i8], [2144 x i8]* %11, i64 0, i64 %119
br label %133
121: ; preds = %110
%122 = trunc i64 %111 to i32
%123 = shl i64 %111, 4
%124 = and i64 %123, 4294967264
%125 = getelementptr inbounds [2144 x i8], [2144 x i8]* %11, i64 0, i64 %124
%126 = shl nsw i32 %122, 5
%127 = zext i32 %126 to i64
%128 = getelementptr inbounds [2144 x i8], [2144 x i8]* %11, i64 0, i64 %127
%129 = or i32 %126, 32
%130 = zext i32 %129 to i64
%131 = getelementptr inbounds [2144 x i8], [2144 x i8]* %11, i64 0, i64 %130
%132 = call i32 (i8*, i8*, i8*, i8*, ...) bitcast (i32 (...)* @hash_nn_n_mask to i32 (i8*, i8*, i8*, i8*, ...)*)(i8* %125, i8* %128, i8* %131, i8* %108)
br label %133
133: ; preds = %114, %121
%134 = icmp ult i64 %112, %109
br i1 %134, label %110, label %135
135: ; preds = %133, %102
%136 = add nsw i32 %104, -1
%137 = sdiv i32 %136, 2
%138 = add nsw i32 %137, 1
%139 = add nuw nsw i64 %103, 1
%140 = icmp eq i64 %139, 7
br i1 %140, label %97, label %102
141: ; preds = %97, %180
%142 = phi i64 [ %182, %180 ], [ 0, %97 ]
%143 = phi i8 [ %181, %180 ], [ %80, %97 ]
%144 = and i8 %143, 1
%145 = icmp eq i8 %144, 0
%146 = select i1 %145, i8 1, i8 -1
%147 = add i8 %146, %143
%148 = icmp eq i64 %142, 4
br i1 %148, label %161, label %149
149: ; preds = %141
%150 = zext i8 %147 to i64
%151 = shl nuw nsw i64 %150, 5
br label %152
152: ; preds = %149, %152
%153 = phi i64 [ 0, %149 ], [ %159, %152 ]
%154 = add nuw nsw i64 %153, %151
%155 = getelementptr inbounds [1024 x i8], [1024 x i8]* %9, i64 0, i64 %154
%156 = load i8, i8* %155
%157 = zext i8 %156 to i32
%158 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %157)
%159 = add nuw nsw i64 %153, 1
%160 = icmp eq i64 %159, 32
br i1 %160, label %161, label %152
161: ; preds = %152, %141
%162 = trunc i64 %142 to i32
%163 = sub i32 5, %162
%164 = shl nuw i32 1, %163
%165 = shl i64 %142, 6
%166 = add nuw nsw i64 %165, 448
%167 = getelementptr inbounds i8, i8* %3, i64 %166
br label %168
168: ; preds = %161, %168
%169 = phi i64 [ 0, %161 ], [ %177, %168 ]
%170 = shl nsw i64 %169, 4
%171 = getelementptr inbounds [1024 x i8], [1024 x i8]* %9, i64 0, i64 %170
%172 = shl nsw i64 %169, 5
%173 = getelementptr inbounds [1024 x i8], [1024 x i8]* %9, i64 0, i64 %172
%174 = or i64 %172, 32
%175 = getelementptr inbounds [1024 x i8], [1024 x i8]* %9, i64 0, i64 %174
%176 = call i32 (i8*, i8*, i8*, i8*, ...) bitcast (i32 (...)* @hash_nn_n_mask to i32 (i8*, i8*, i8*, i8*, ...)*)(i8* %171, i8* %173, i8* %175, i8* %167)
%177 = add nuw i64 %169, 2
%178 = trunc i64 %177 to i32
%179 = icmp sgt i32 %164, %178
br i1 %179, label %168, label %180
180: ; preds = %168
%181 = lshr i8 %147, 1
%182 = add nuw nsw i64 %142, 1
%183 = icmp eq i64 %182, 5
br i1 %183, label %184, label %141
184: ; preds = %180
%185 = add nuw nsw i32 %54, 1
%186 = icmp eq i32 %185, 12
br i1 %186, label %187, label %53
187: ; preds = %184
ret i32 0
}