#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ acorn128_initialization_32bitversion(unsigned char const *,
                                                        unsigned char const *,
                                                        unsigned long long *);
int /*<<< orphan*/ acorn128_tag_generation_32bits_version(unsigned long long,
                                                          unsigned long long,
                                                          int, unsigned char *,
                                                          unsigned long long *);
int /*<<< orphan*/ decrypt_32bits(unsigned long long *, unsigned int *,
                                  unsigned int, unsigned int *, unsigned int,
                                  unsigned int);
int /*<<< orphan*/ decrypt_8bits(unsigned long long *, unsigned int *,
                                 unsigned int, unsigned int *, unsigned int,
                                 unsigned int);
int /*<<< orphan*/ encrypt_32bits(unsigned long long *, unsigned int,
                                  unsigned int *, unsigned int *, unsigned int,
                                  unsigned int);
int /*<<< orphan*/ encrypt_8bits(unsigned long long *, unsigned int,
                                 unsigned int *, unsigned int *, unsigned int,
                                 unsigned int);
int crypto_aead_decrypt(unsigned char *m, unsigned long long *mlen,
                        unsigned char *nsec, const unsigned char *c,
                        unsigned long long clen, const unsigned char *ad,
                        unsigned long long adlen, const unsigned char *npub,
                        const unsigned char *k) {
  unsigned long long i;
  unsigned char tag[16], check = 0;
  unsigned int plaintextword, ciphertextword, ksword;
  unsigned long long state[7];
  unsigned int ca, cb;
  acorn128_initialization_32bitversion(k, npub, state);
  ca = 0xffffffff;
  cb = 0xffffffff;
  for (i = 0; i < adlen / 4; i = i + 1) {
    encrypt_32bits(state, ((unsigned int *)ad)[i], &ciphertextword, &ksword, ca,
                   cb);
  }
  for (i = adlen & 0xfffffffffffffffcULL; i < adlen; i++) {
    ca = 0xff;
    cb = 0xff;
    plaintextword = ad[i];
    encrypt_8bits(state, plaintextword, &ciphertextword, &ksword, ca, cb);
  }
  for (i = 0; i < 256 / 32; i++) {
    if (i == 0)
      plaintextword = 0x1;
    else
      plaintextword = 0;
    if (i < 128 / 32)
      ca = 0xffffffff;
    else
      ca = 0;
    cb = 0xffffffff;
    encrypt_32bits(state, plaintextword, &ciphertextword, &ksword, ca, cb);
  }
  ca = 0xffffffff;
  cb = 0;
  *mlen = clen - 16;
  for (i = 0; i < *mlen / 4; i = i + 1) {
    decrypt_32bits(state, &(((unsigned int *)m)[i]), ((unsigned int *)c)[i],
                   &ksword, ca, cb);
  }
  for (i = *mlen & 0xfffffffffffffffcULL; i < *mlen; i++) {
    ca = 0xff;
    cb = 0x0;
    ciphertextword = c[i];
    decrypt_8bits(state, &plaintextword, ciphertextword, &ksword, ca, cb);
    m[i] = plaintextword;
  }
  for (i = 0; i < 256 / 32; i++) {
    if (i == 0)
      plaintextword = 0x1;
    else
      plaintextword = 0;
    if (i < 128 / 32)
      ca = 0xffffffff;
    else
      ca = 0;
    cb = 0;
    encrypt_32bits(state, plaintextword, &ciphertextword, &ksword, ca, cb);
  }
  acorn128_tag_generation_32bits_version(*mlen, adlen, 16, tag, state);
  for (i = 0; i < 16; i++)
    check |= (tag[i] ^ c[clen - 16 + i]);
  if (check == 0)
    return 0;
  else
    return -1;
}


x86 assembly (clang, -O0):
<crypto_aead_decrypt>:
push   %rbp
mov    %rsp,%rbp
sub    $0xb0,%rsp
mov    0x20(%rbp),%rax
mov    0x18(%rbp),%rax
mov    0x10(%rbp),%rax
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %rcx,-0x28(%rbp)
mov    %r8,-0x30(%rbp)
mov    %r9,-0x38(%rbp)
movb   $0x0,-0x51(%rbp)
mov    0x20(%rbp),%rdi
mov    0x18(%rbp),%rsi
lea    -0xa0(%rbp),%rdx
call   1060 <acorn128_initialization_32bitversion@plt>
movl   $0xffffffff,-0xa4(%rbp)
ff ff ff
movl   $0xffffffff,-0xa8(%rbp)
ff ff ff
movq   $0x0,-0x40(%rbp)
mov    -0x40(%rbp),%rax
mov    0x10(%rbp),%rcx
shr    $0x2,%rcx
cmp    %rcx,%rax
jae    1216 <crypto_aead_decrypt+0xb6>
lea    -0xa0(%rbp),%rdi
mov    -0x38(%rbp),%rax
mov    -0x40(%rbp),%rcx
mov    (%rax,%rcx,4),%esi
mov    -0xa4(%rbp),%r8d
mov    -0xa8(%rbp),%r9d
lea    -0x5c(%rbp),%rdx
lea    -0x60(%rbp),%rcx
call   1040 <encrypt_32bits@plt>
mov    -0x40(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x40(%rbp)
jmp    11c3 <crypto_aead_decrypt+0x63>
mov    0x10(%rbp),%rax
and    $0xfffffffffffffffc,%rax
mov    %rax,-0x40(%rbp)
mov    -0x40(%rbp),%rax
cmp    0x10(%rbp),%rax
jae    1289 <crypto_aead_decrypt+0x129>
movl   $0xff,-0xa4(%rbp)
movl   $0xff,-0xa8(%rbp)
mov    -0x38(%rbp),%rax
mov    -0x40(%rbp),%rcx
movzbl (%rax,%rcx,1),%eax
mov    %eax,-0x58(%rbp)
lea    -0xa0(%rbp),%rdi
mov    -0x58(%rbp),%esi
mov    -0xa4(%rbp),%r8d
mov    -0xa8(%rbp),%r9d
lea    -0x5c(%rbp),%rdx
lea    -0x60(%rbp),%rcx
call   1070 <encrypt_8bits@plt>
mov    -0x40(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x40(%rbp)
jmp    1222 <crypto_aead_decrypt+0xc2>
movq   $0x0,-0x40(%rbp)
cmpq   $0x8,-0x40(%rbp)
jae    131e <crypto_aead_decrypt+0x1be>
cmpq   $0x0,-0x40(%rbp)
jne    12b3 <crypto_aead_decrypt+0x153>
movl   $0x1,-0x58(%rbp)
jmp    12ba <crypto_aead_decrypt+0x15a>
movl   $0x0,-0x58(%rbp)
cmpq   $0x4,-0x40(%rbp)
jae    12d4 <crypto_aead_decrypt+0x174>
movl   $0xffffffff,-0xa4(%rbp)
ff ff ff
jmp    12de <crypto_aead_decrypt+0x17e>
movl   $0x0,-0xa4(%rbp)
movl   $0xffffffff,-0xa8(%rbp)
ff ff ff
lea    -0xa0(%rbp),%rdi
mov    -0x58(%rbp),%esi
mov    -0xa4(%rbp),%r8d
mov    -0xa8(%rbp),%r9d
lea    -0x5c(%rbp),%rdx
lea    -0x60(%rbp),%rcx
call   1040 <encrypt_32bits@plt>
mov    -0x40(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x40(%rbp)
jmp    1291 <crypto_aead_decrypt+0x131>
movl   $0xffffffff,-0xa4(%rbp)
ff ff ff
movl   $0x0,-0xa8(%rbp)
mov    -0x30(%rbp),%rcx
sub    $0x10,%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
movq   $0x0,-0x40(%rbp)
mov    -0x40(%rbp),%rax
mov    -0x18(%rbp),%rcx
mov    (%rcx),%rcx
shr    $0x2,%rcx
cmp    %rcx,%rax
jae    13aa <crypto_aead_decrypt+0x24a>
lea    -0xa0(%rbp),%rdi
mov    -0x10(%rbp),%rsi
mov    -0x40(%rbp),%rax
shl    $0x2,%rax
add    %rax,%rsi
mov    -0x28(%rbp),%rax
mov    -0x40(%rbp),%rcx
mov    (%rax,%rcx,4),%edx
mov    -0xa4(%rbp),%r8d
mov    -0xa8(%rbp),%r9d
lea    -0x60(%rbp),%rcx
call   1080 <decrypt_32bits@plt>
mov    -0x40(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x40(%rbp)
jmp    1349 <crypto_aead_decrypt+0x1e9>
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
and    $0xfffffffffffffffc,%rax
mov    %rax,-0x40(%rbp)
mov    -0x40(%rbp),%rax
mov    -0x18(%rbp),%rcx
cmp    (%rcx),%rax
jae    1433 <crypto_aead_decrypt+0x2d3>
movl   $0xff,-0xa4(%rbp)
movl   $0x0,-0xa8(%rbp)
mov    -0x28(%rbp),%rax
mov    -0x40(%rbp),%rcx
movzbl (%rax,%rcx,1),%eax
mov    %eax,-0x5c(%rbp)
lea    -0xa0(%rbp),%rdi
mov    -0x5c(%rbp),%edx
mov    -0xa4(%rbp),%r8d
mov    -0xa8(%rbp),%r9d
lea    -0x58(%rbp),%rsi
lea    -0x60(%rbp),%rcx
call   1030 <decrypt_8bits@plt>
mov    -0x58(%rbp),%eax
mov    %al,%dl
mov    -0x10(%rbp),%rax
mov    -0x40(%rbp),%rcx
mov    %dl,(%rax,%rcx,1)
mov    -0x40(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x40(%rbp)
jmp    13b9 <crypto_aead_decrypt+0x259>
movq   $0x0,-0x40(%rbp)
cmpq   $0x8,-0x40(%rbp)
jae    14c8 <crypto_aead_decrypt+0x368>
cmpq   $0x0,-0x40(%rbp)
jne    145d <crypto_aead_decrypt+0x2fd>
movl   $0x1,-0x58(%rbp)
jmp    1464 <crypto_aead_decrypt+0x304>
movl   $0x0,-0x58(%rbp)
cmpq   $0x4,-0x40(%rbp)
jae    147e <crypto_aead_decrypt+0x31e>
movl   $0xffffffff,-0xa4(%rbp)
ff ff ff
jmp    1488 <crypto_aead_decrypt+0x328>
movl   $0x0,-0xa4(%rbp)
movl   $0x0,-0xa8(%rbp)
lea    -0xa0(%rbp),%rdi
mov    -0x58(%rbp),%esi
mov    -0xa4(%rbp),%r8d
mov    -0xa8(%rbp),%r9d
lea    -0x5c(%rbp),%rdx
lea    -0x60(%rbp),%rcx
call   1040 <encrypt_32bits@plt>
mov    -0x40(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x40(%rbp)
jmp    143b <crypto_aead_decrypt+0x2db>
mov    -0x18(%rbp),%rax
mov    (%rax),%rdi
mov    0x10(%rbp),%rsi
lea    -0x50(%rbp),%rcx
lea    -0xa0(%rbp),%r8
mov    $0x10,%edx
call   1050 <acorn128_tag_generation_32bits_version@plt>
movq   $0x0,-0x40(%rbp)
cmpq   $0x10,-0x40(%rbp)
jae    1534 <crypto_aead_decrypt+0x3d4>
mov    -0x40(%rbp),%rax
movzbl -0x50(%rbp,%rax,1),%ecx
mov    -0x28(%rbp),%rax
mov    -0x30(%rbp),%rdx
sub    $0x10,%rdx
add    -0x40(%rbp),%rdx
movzbl (%rax,%rdx,1),%eax
xor    %eax,%ecx
movzbl -0x51(%rbp),%eax
or     %ecx,%eax
mov    %al,-0x51(%rbp)
mov    -0x40(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x40(%rbp)
jmp    14f0 <crypto_aead_decrypt+0x390>
movzbl -0x51(%rbp),%eax
cmp    $0x0,%eax
jne    154d <crypto_aead_decrypt+0x3ed>
movl   $0x0,-0x4(%rbp)
jmp    1554 <crypto_aead_decrypt+0x3f4>
movl   $0xffffffff,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0xb0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<crypto_aead_decrypt>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x88,%rsp
mov    %r9,%rbp
mov    %r8,0x18(%rsp)
mov    %rcx,0x28(%rsp)
mov    %rsi,0x10(%rsp)
mov    %rdi,0x20(%rsp)
mov    0xd0(%rsp),%rdi
mov    0xc8(%rsp),%rsi
lea    0x30(%rsp),%rdx
call   1060 <acorn128_initialization_32bitversion@plt>
cmpq   $0x4,0xc0(%rsp)
jb     11f8 <crypto_aead_decrypt+0x98>
mov    0xc0(%rsp),%rbx
shr    $0x2,%rbx
xor    %r14d,%r14d
lea    0x30(%rsp),%r15
lea    0xc(%rsp),%r13
lea    0x8(%rsp),%r12
nopl   0x0(%rax,%rax,1)
mov    0x0(%rbp,%r14,4),%esi
mov    %r15,%rdi
mov    %r13,%rdx
mov    %r12,%rcx
mov    $0xffffffff,%r8d
mov    $0xffffffff,%r9d
call   1040 <encrypt_32bits@plt>
add    $0x1,%r14
cmp    %r14,%rbx
jne    11d0 <crypto_aead_decrypt+0x70>
mov    0xc0(%rsp),%rbx
mov    %rbx,%r12
and    $0xfffffffffffffffc,%r12
cmp    %rbx,%r12
jae    1249 <crypto_aead_decrypt+0xe9>
lea    0x30(%rsp),%r15
lea    0xc(%rsp),%r14
lea    0x8(%rsp),%r13
nopl   0x0(%rax,%rax,1)
movzbl 0x0(%rbp,%r12,1),%esi
mov    %r15,%rdi
mov    %r14,%rdx
mov    %r13,%rcx
mov    $0xff,%r8d
mov    $0xff,%r9d
call   1070 <encrypt_8bits@plt>
add    $0x1,%r12
cmp    %r12,%rbx
jne    1220 <crypto_aead_decrypt+0xc0>
lea    0x30(%rsp),%rbp
lea    0xc(%rsp),%rbx
lea    0x8(%rsp),%r15
mov    %rbp,%rdi
mov    $0x1,%esi
mov    %rbx,%rdx
mov    %r15,%rcx
mov    $0xffffffff,%r8d
mov    $0xffffffff,%r9d
call   1040 <encrypt_32bits@plt>
mov    %rbp,%rdi
xor    %esi,%esi
mov    %rbx,%rdx
mov    %r15,%rcx
mov    $0xffffffff,%r8d
mov    $0xffffffff,%r9d
call   1040 <encrypt_32bits@plt>
mov    %rbp,%rdi
xor    %esi,%esi
mov    %rbx,%rdx
mov    %r15,%rcx
mov    $0xffffffff,%r8d
mov    $0xffffffff,%r9d
call   1040 <encrypt_32bits@plt>
mov    %rbp,%rdi
xor    %esi,%esi
mov    %rbx,%rdx
mov    %r15,%rcx
mov    $0xffffffff,%r8d
mov    $0xffffffff,%r9d
call   1040 <encrypt_32bits@plt>
mov    %rbp,%rdi
xor    %esi,%esi
mov    %rbx,%rdx
mov    %r15,%rcx
xor    %r8d,%r8d
mov    $0xffffffff,%r9d
call   1040 <encrypt_32bits@plt>
mov    %rbp,%rdi
xor    %esi,%esi
mov    %rbx,%rdx
mov    %r15,%rcx
xor    %r8d,%r8d
mov    $0xffffffff,%r9d
call   1040 <encrypt_32bits@plt>
mov    %rbp,%rdi
xor    %esi,%esi
mov    %rbx,%rdx
mov    %r15,%rcx
xor    %r8d,%r8d
mov    $0xffffffff,%r9d
call   1040 <encrypt_32bits@plt>
movl   $0x0,0x4(%rsp)
mov    %rbp,%rdi
xor    %esi,%esi
mov    %rbx,%rdx
mov    %r15,%rcx
xor    %r8d,%r8d
mov    $0xffffffff,%r9d
call   1040 <encrypt_32bits@plt>
mov    0x18(%rsp),%rcx
add    $0xfffffffffffffff0,%rcx
mov    0x10(%rsp),%rsi
mov    %rcx,(%rsi)
mov    %rcx,%rax
mov    %rcx,%rdx
mov    %rcx,0x18(%rsp)
cmp    $0x4,%rcx
mov    0x28(%rsp),%r12
jb     13a7 <crypto_aead_decrypt+0x247>
xor    %ebx,%ebx
lea    0x30(%rsp),%r15
lea    0x8(%rsp),%r13
mov    0x20(%rsp),%rbp
nop
mov    (%r12,%rbx,4),%edx
mov    %r15,%rdi
mov    %rbp,%rsi
mov    %r13,%rcx
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1080 <decrypt_32bits@plt>
mov    0x10(%rsp),%rsi
add    $0x1,%rbx
mov    (%rsi),%rax
mov    %rax,%rcx
shr    $0x2,%rcx
add    $0x4,%rbp
cmp    %rcx,%rbx
jb     1370 <crypto_aead_decrypt+0x210>
mov    %rax,%rbp
and    $0xfffffffffffffffc,%rbp
cmp    %rax,%rbp
mov    0x20(%rsp),%r15
jae    1407 <crypto_aead_decrypt+0x2a7>
lea    0x30(%rsp),%r14
lea    0x4(%rsp),%r13
lea    0x8(%rsp),%rbx
nopw   0x0(%rax,%rax,1)
movzbl (%r12,%rbp,1),%edx
mov    %edx,0xc(%rsp)
mov    %r14,%rdi
mov    %r13,%rsi
mov    %rbx,%rcx
mov    $0xff,%r8d
xor    %r9d,%r9d
call   1030 <decrypt_8bits@plt>
movzbl 0x4(%rsp),%eax
mov    %al,(%r15,%rbp,1)
add    $0x1,%rbp
mov    0x10(%rsp),%rax
cmp    (%rax),%rbp
jb     13d0 <crypto_aead_decrypt+0x270>
movl   $0x1,0x4(%rsp)
lea    0x30(%rsp),%r13
lea    0xc(%rsp),%rbp
lea    0x8(%rsp),%rbx
mov    %r13,%rdi
mov    $0x1,%esi
mov    %rbp,%rdx
mov    %rbx,%rcx
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1040 <encrypt_32bits@plt>
movl   $0x0,0x4(%rsp)
mov    %r13,%rdi
xor    %esi,%esi
mov    %rbp,%rdx
mov    %rbx,%rcx
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1040 <encrypt_32bits@plt>
movl   $0x0,0x4(%rsp)
mov    %r13,%rdi
xor    %esi,%esi
mov    %rbp,%rdx
mov    %rbx,%rcx
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1040 <encrypt_32bits@plt>
movl   $0x0,0x4(%rsp)
mov    %r13,%rdi
xor    %esi,%esi
mov    %rbp,%rdx
mov    %rbx,%rcx
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1040 <encrypt_32bits@plt>
movl   $0x0,0x4(%rsp)
mov    %r13,%rdi
xor    %esi,%esi
mov    %rbp,%rdx
mov    %rbx,%rcx
xor    %r8d,%r8d
xor    %r9d,%r9d
call   1040 <encrypt_32bits@plt>
movl   $0x0,0x4(%rsp)
mov    %r13,%rdi
xor    %esi,%esi
mov    %rbp,%rdx
mov    %rbx,%rcx
xor    %r8d,%r8d
xor    %r9d,%r9d
call   1040 <encrypt_32bits@plt>
movl   $0x0,0x4(%rsp)
mov    %r13,%rdi
xor    %esi,%esi
mov    %rbp,%rdx
mov    %rbx,%rcx
xor    %r8d,%r8d
xor    %r9d,%r9d
call   1040 <encrypt_32bits@plt>
movl   $0x0,0x4(%rsp)
mov    %r13,%rdi
xor    %esi,%esi
mov    %rbp,%rdx
mov    %rbx,%rcx
xor    %r8d,%r8d
xor    %r9d,%r9d
call   1040 <encrypt_32bits@plt>
mov    0x10(%rsp),%rax
mov    (%rax),%rdi
lea    0x70(%rsp),%rcx
mov    0xc0(%rsp),%rsi
mov    $0x10,%edx
mov    %r13,%r8
call   1050 <acorn128_tag_generation_32bits_version@plt>
mov    0x18(%rsp),%rax
movdqu (%r12,%rax,1),%xmm0
pxor   0x70(%rsp),%xmm0
pxor   %xmm1,%xmm1
pcmpeqb %xmm0,%xmm1
pmovmskb %xmm1,%ecx
xor    %eax,%eax
cmp    $0xffff,%ecx
setne  %al
neg    %eax
add    $0x88,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
define i32 @crypto_aead_decrypt(i8* %0, i64* %1, i8* %2, i8* %3, i64 %4, i8* %5, i64 %6, i8* %7, i8* %8) {
%10 = alloca i32
%11 = alloca i8*
%12 = alloca i64*
%13 = alloca i8*
%14 = alloca i8*
%15 = alloca i64
%16 = alloca i8*
%17 = alloca i64
%18 = alloca i8*
%19 = alloca i8*
%20 = alloca i64
%21 = alloca [16 x i8]
%22 = alloca i8
%23 = alloca i32
%24 = alloca i32
%25 = alloca i32
%26 = alloca [7 x i64]
%27 = alloca i32
%28 = alloca i32
store i8* %0, i8** %11
store i64* %1, i64** %12
store i8* %2, i8** %13
store i8* %3, i8** %14
store i64 %4, i64* %15
store i8* %5, i8** %16
store i64 %6, i64* %17
store i8* %7, i8** %18
store i8* %8, i8** %19
store i8 0, i8* %22
%29 = load i8*, i8** %19
%30 = load i8*, i8** %18
%31 = getelementptr inbounds [7 x i64], [7 x i64]* %26, i64 0, i64 0
%32 = call i32 @acorn128_initialization_32bitversion(i8* %29, i8* %30, i64* %31)
store i32 -1, i32* %27
store i32 -1, i32* %28
store i64 0, i64* %20
br label %33
33: ; preds = %48, %9
%34 = load i64, i64* %20
%35 = load i64, i64* %17
%36 = udiv i64 %35, 4
%37 = icmp ult i64 %34, %36
br i1 %37, label %38, label %51
38: ; preds = %33
%39 = getelementptr inbounds [7 x i64], [7 x i64]* %26, i64 0, i64 0
%40 = load i8*, i8** %16
%41 = bitcast i8* %40 to i32*
%42 = load i64, i64* %20
%43 = getelementptr inbounds i32, i32* %41, i64 %42
%44 = load i32, i32* %43
%45 = load i32, i32* %27
%46 = load i32, i32* %28
%47 = call i32 @encrypt_32bits(i64* %39, i32 %44, i32* %24, i32* %25, i32 %45, i32 %46)
br label %48
48: ; preds = %38
%49 = load i64, i64* %20
%50 = add i64 %49, 1
store i64 %50, i64* %20
br label %33
51: ; preds = %33
%52 = load i64, i64* %17
%53 = and i64 %52, -4
store i64 %53, i64* %20
br label %54
54: ; preds = %69, %51
%55 = load i64, i64* %20
%56 = load i64, i64* %17
%57 = icmp ult i64 %55, %56
br i1 %57, label %58, label %72
58: ; preds = %54
store i32 255, i32* %27
store i32 255, i32* %28
%59 = load i8*, i8** %16
%60 = load i64, i64* %20
%61 = getelementptr inbounds i8, i8* %59, i64 %60
%62 = load i8, i8* %61
%63 = zext i8 %62 to i32
store i32 %63, i32* %23
%64 = getelementptr inbounds [7 x i64], [7 x i64]* %26, i64 0, i64 0
%65 = load i32, i32* %23
%66 = load i32, i32* %27
%67 = load i32, i32* %28
%68 = call i32 @encrypt_8bits(i64* %64, i32 %65, i32* %24, i32* %25, i32 %66, i32 %67)
br label %69
69: ; preds = %58
%70 = load i64, i64* %20
%71 = add i64 %70, 1
store i64 %71, i64* %20
br label %54
72: ; preds = %54
store i64 0, i64* %20
br label %73
73: ; preds = %92, %72
%74 = load i64, i64* %20
%75 = icmp ult i64 %74, 8
br i1 %75, label %76, label %95
76: ; preds = %73
%77 = load i64, i64* %20
%78 = icmp eq i64 %77, 0
br i1 %78, label %79, label %80
79: ; preds = %76
store i32 1, i32* %23
br label %81
80: ; preds = %76
store i32 0, i32* %23
br label %81
81: ; preds = %80, %79
%82 = load i64, i64* %20
%83 = icmp ult i64 %82, 4
br i1 %83, label %84, label %85
84: ; preds = %81
store i32 -1, i32* %27
br label %86
85: ; preds = %81
store i32 0, i32* %27
br label %86
86: ; preds = %85, %84
store i32 -1, i32* %28
%87 = getelementptr inbounds [7 x i64], [7 x i64]* %26, i64 0, i64 0
%88 = load i32, i32* %23
%89 = load i32, i32* %27
%90 = load i32, i32* %28
%91 = call i32 @encrypt_32bits(i64* %87, i32 %88, i32* %24, i32* %25, i32 %89, i32 %90)
br label %92
92: ; preds = %86
%93 = load i64, i64* %20
%94 = add i64 %93, 1
store i64 %94, i64* %20
br label %73
95: ; preds = %73
store i32 -1, i32* %27
store i32 0, i32* %28
%96 = load i64, i64* %15
%97 = sub i64 %96, 16
%98 = load i64*, i64** %12
store i64 %97, i64* %98
store i64 0, i64* %20
br label %99
99: ; preds = %119, %95
%100 = load i64, i64* %20
%101 = load i64*, i64** %12
%102 = load i64, i64* %101
%103 = udiv i64 %102, 4
%104 = icmp ult i64 %100, %103
br i1 %104, label %105, label %122
105: ; preds = %99
%106 = getelementptr inbounds [7 x i64], [7 x i64]* %26, i64 0, i64 0
%107 = load i8*, i8** %11
%108 = bitcast i8* %107 to i32*
%109 = load i64, i64* %20
%110 = getelementptr inbounds i32, i32* %108, i64 %109
%111 = load i8*, i8** %14
%112 = bitcast i8* %111 to i32*
%113 = load i64, i64* %20
%114 = getelementptr inbounds i32, i32* %112, i64 %113
%115 = load i32, i32* %114
%116 = load i32, i32* %27
%117 = load i32, i32* %28
%118 = call i32 @decrypt_32bits(i64* %106, i32* %110, i32 %115, i32* %25, i32 %116, i32 %117)
br label %119
119: ; preds = %105
%120 = load i64, i64* %20
%121 = add i64 %120, 1
store i64 %121, i64* %20
br label %99
122: ; preds = %99
%123 = load i64*, i64** %12
%124 = load i64, i64* %123
%125 = and i64 %124, -4
store i64 %125, i64* %20
br label %126
126: ; preds = %147, %122
%127 = load i64, i64* %20
%128 = load i64*, i64** %12
%129 = load i64, i64* %128
%130 = icmp ult i64 %127, %129
br i1 %130, label %131, label %150
131: ; preds = %126
store i32 255, i32* %27
store i32 0, i32* %28
%132 = load i8*, i8** %14
%133 = load i64, i64* %20
%134 = getelementptr inbounds i8, i8* %132, i64 %133
%135 = load i8, i8* %134
%136 = zext i8 %135 to i32
store i32 %136, i32* %24
%137 = getelementptr inbounds [7 x i64], [7 x i64]* %26, i64 0, i64 0
%138 = load i32, i32* %24
%139 = load i32, i32* %27
%140 = load i32, i32* %28
%141 = call i32 @decrypt_8bits(i64* %137, i32* %23, i32 %138, i32* %25, i32 %139, i32 %140)
%142 = load i32, i32* %23
%143 = trunc i32 %142 to i8
%144 = load i8*, i8** %11
%145 = load i64, i64* %20
%146 = getelementptr inbounds i8, i8* %144, i64 %145
store i8 %143, i8* %146
br label %147
147: ; preds = %131
%148 = load i64, i64* %20
%149 = add i64 %148, 1
store i64 %149, i64* %20
br label %126
150: ; preds = %126
store i64 0, i64* %20
br label %151
151: ; preds = %170, %150
%152 = load i64, i64* %20
%153 = icmp ult i64 %152, 8
br i1 %153, label %154, label %173
154: ; preds = %151
%155 = load i64, i64* %20
%156 = icmp eq i64 %155, 0
br i1 %156, label %157, label %158
157: ; preds = %154
store i32 1, i32* %23
br label %159
158: ; preds = %154
store i32 0, i32* %23
br label %159
159: ; preds = %158, %157
%160 = load i64, i64* %20
%161 = icmp ult i64 %160, 4
br i1 %161, label %162, label %163
162: ; preds = %159
store i32 -1, i32* %27
br label %164
163: ; preds = %159
store i32 0, i32* %27
br label %164
164: ; preds = %163, %162
store i32 0, i32* %28
%165 = getelementptr inbounds [7 x i64], [7 x i64]* %26, i64 0, i64 0
%166 = load i32, i32* %23
%167 = load i32, i32* %27
%168 = load i32, i32* %28
%169 = call i32 @encrypt_32bits(i64* %165, i32 %166, i32* %24, i32* %25, i32 %167, i32 %168)
br label %170
170: ; preds = %164
%171 = load i64, i64* %20
%172 = add i64 %171, 1
store i64 %172, i64* %20
br label %151
173: ; preds = %151
%174 = load i64*, i64** %12
%175 = load i64, i64* %174
%176 = load i64, i64* %17
%177 = getelementptr inbounds [16 x i8], [16 x i8]* %21, i64 0, i64 0
%178 = getelementptr inbounds [7 x i64], [7 x i64]* %26, i64 0, i64 0
%179 = call i32 @acorn128_tag_generation_32bits_version(i64 %175, i64 %176, i32 16, i8* %177, i64* %178)
store i64 0, i64* %20
br label %180
180: ; preds = %201, %173
%181 = load i64, i64* %20
%182 = icmp ult i64 %181, 16
br i1 %182, label %183, label %204
183: ; preds = %180
%184 = load i64, i64* %20
%185 = getelementptr inbounds [16 x i8], [16 x i8]* %21, i64 0, i64 %184
%186 = load i8, i8* %185
%187 = zext i8 %186 to i32
%188 = load i8*, i8** %14
%189 = load i64, i64* %15
%190 = sub i64 %189, 16
%191 = load i64, i64* %20
%192 = add i64 %190, %191
%193 = getelementptr inbounds i8, i8* %188, i64 %192
%194 = load i8, i8* %193
%195 = zext i8 %194 to i32
%196 = xor i32 %187, %195
%197 = load i8, i8* %22
%198 = zext i8 %197 to i32
%199 = or i32 %198, %196
%200 = trunc i32 %199 to i8
store i8 %200, i8* %22
br label %201
201: ; preds = %183
%202 = load i64, i64* %20
%203 = add i64 %202, 1
store i64 %203, i64* %20
br label %180
204: ; preds = %180
%205 = load i8, i8* %22
%206 = zext i8 %205 to i32
%207 = icmp eq i32 %206, 0
br i1 %207, label %208, label %209
208: ; preds = %204
store i32 0, i32* %10
br label %210
209: ; preds = %204
store i32 -1, i32* %10
br label %210
210: ; preds = %209, %208
%211 = load i32, i32* %10
ret i32 %211
}

LLVM IR (-O2):
define i32 @crypto_aead_decrypt(i8* %0, i64* nocapture %1, i8* nocapture readnone %2, i8* nocapture %3, i64 %4, i8* nocapture %5, i64 %6, i8* %7, i8* %8) {
%10 = alloca <16 x i8>
%11 = alloca i32
%12 = alloca i32
%13 = alloca i32
%14 = alloca [7 x i64]
%15 = getelementptr inbounds <16 x i8>, <16 x i8>* %10, i64 0, i64 0
%16 = bitcast i32* %11 to i8*
%17 = bitcast i32* %12 to i8*
%18 = bitcast i32* %13 to i8*
%19 = bitcast [7 x i64]* %14 to i8*
%20 = getelementptr inbounds [7 x i64], [7 x i64]* %14, i64 0, i64 0
%21 = call i32 @acorn128_initialization_32bitversion(i8* %8, i8* %7, i64* %20)
%22 = icmp ult i64 %6, 4
br i1 %22, label %33, label %23
23: ; preds = %9
%24 = lshr i64 %6, 2
%25 = bitcast i8* %5 to i32*
br label %26
26: ; preds = %23, %26
%27 = phi i64 [ 0, %23 ], [ %31, %26 ]
%28 = getelementptr inbounds i32, i32* %25, i64 %27
%29 = load i32, i32* %28
%30 = call i32 @encrypt_32bits(i64* %20, i32 %29, i32* %12, i32* %13, i32 -1, i32 -1)
%31 = add nuw nsw i64 %27, 1
%32 = icmp eq i64 %31, %24
br i1 %32, label %33, label %26
33: ; preds = %26, %9
%34 = and i64 %6, -4
%35 = icmp ult i64 %34, %6
br i1 %35, label %47, label %36
36: ; preds = %47, %33
%37 = call i32 @encrypt_32bits(i64* %20, i32 1, i32* %12, i32* %13, i32 -1, i32 -1)
%38 = call i32 @encrypt_32bits(i64* %20, i32 0, i32* %12, i32* %13, i32 -1, i32 -1)
%39 = call i32 @encrypt_32bits(i64* %20, i32 0, i32* %12, i32* %13, i32 -1, i32 -1)
%40 = call i32 @encrypt_32bits(i64* %20, i32 0, i32* %12, i32* %13, i32 -1, i32 -1)
%41 = call i32 @encrypt_32bits(i64* %20, i32 0, i32* %12, i32* %13, i32 0, i32 -1)
%42 = call i32 @encrypt_32bits(i64* %20, i32 0, i32* %12, i32* %13, i32 0, i32 -1)
%43 = call i32 @encrypt_32bits(i64* %20, i32 0, i32* %12, i32* %13, i32 0, i32 -1)
store i32 0, i32* %11
%44 = call i32 @encrypt_32bits(i64* %20, i32 0, i32* %12, i32* %13, i32 0, i32 -1)
%45 = add i64 %4, -16
store i64 %45, i64* %1
%46 = icmp ult i64 %45, 4
br i1 %46, label %68, label %55
47: ; preds = %33, %47
%48 = phi i64 [ %53, %47 ], [ %34, %33 ]
%49 = getelementptr inbounds i8, i8* %5, i64 %48
%50 = load i8, i8* %49
%51 = zext i8 %50 to i32
%52 = call i32 @encrypt_8bits(i64* %20, i32 %51, i32* %12, i32* %13, i32 255, i32 255)
%53 = add i64 %48, 1
%54 = icmp eq i64 %53, %6
br i1 %54, label %36, label %47
55: ; preds = %36
%56 = bitcast i8* %0 to i32*
%57 = bitcast i8* %3 to i32*
br label %58
58: ; preds = %55, %58
%59 = phi i64 [ 0, %55 ], [ %64, %58 ]
%60 = getelementptr inbounds i32, i32* %56, i64 %59
%61 = getelementptr inbounds i32, i32* %57, i64 %59
%62 = load i32, i32* %61
%63 = call i32 @decrypt_32bits(i64* %20, i32* %60, i32 %62, i32* %13, i32 -1, i32 0)
%64 = add nuw nsw i64 %59, 1
%65 = load i64, i64* %1
%66 = lshr i64 %65, 2
%67 = icmp ult i64 %64, %66
br i1 %67, label %58, label %68
68: ; preds = %58, %36
%69 = phi i64 [ %45, %36 ], [ %65, %58 ]
%70 = and i64 %69, -4
%71 = icmp ult i64 %70, %69
br i1 %71, label %91, label %72
72: ; preds = %91, %68
store i32 1, i32* %11
%73 = call i32 @encrypt_32bits(i64* %20, i32 1, i32* %12, i32* %13, i32 -1, i32 0)
store i32 0, i32* %11
%74 = call i32 @encrypt_32bits(i64* %20, i32 0, i32* %12, i32* %13, i32 -1, i32 0)
store i32 0, i32* %11
%75 = call i32 @encrypt_32bits(i64* %20, i32 0, i32* %12, i32* %13, i32 -1, i32 0)
store i32 0, i32* %11
%76 = call i32 @encrypt_32bits(i64* %20, i32 0, i32* %12, i32* %13, i32 -1, i32 0)
store i32 0, i32* %11
%77 = call i32 @encrypt_32bits(i64* %20, i32 0, i32* %12, i32* %13, i32 0, i32 0)
store i32 0, i32* %11
%78 = call i32 @encrypt_32bits(i64* %20, i32 0, i32* %12, i32* %13, i32 0, i32 0)
store i32 0, i32* %11
%79 = call i32 @encrypt_32bits(i64* %20, i32 0, i32* %12, i32* %13, i32 0, i32 0)
store i32 0, i32* %11
%80 = call i32 @encrypt_32bits(i64* %20, i32 0, i32* %12, i32* %13, i32 0, i32 0)
%81 = load i64, i64* %1
%82 = call i32 @acorn128_tag_generation_32bits_version(i64 %81, i64 %6, i32 16, i8* %15, i64* %20)
%83 = getelementptr inbounds i8, i8* %3, i64 %45
%84 = load <16 x i8>, <16 x i8>* %10
%85 = bitcast i8* %83 to <16 x i8>*
%86 = load <16 x i8>, <16 x i8>* %85
%87 = xor <16 x i8> %86, %84
%88 = call i8 @llvm.vector.reduce.or.v16i8(<16 x i8> %87)
%89 = icmp ne i8 %88, 0
%90 = sext i1 %89 to i32
ret i32 %90
91: ; preds = %68, %91
%92 = phi i64 [ %100, %91 ], [ %70, %68 ]
%93 = getelementptr inbounds i8, i8* %3, i64 %92
%94 = load i8, i8* %93
%95 = zext i8 %94 to i32
store i32 %95, i32* %12
%96 = call i32 @decrypt_8bits(i64* %20, i32* %11, i32 %95, i32* %13, i32 255, i32 0)
%97 = load i32, i32* %11
%98 = trunc i32 %97 to i8
%99 = getelementptr inbounds i8, i8* %0, i64 %92
store i8 %98, i8* %99
%100 = add nuw i64 %92, 1
%101 = load i64, i64* %1
%102 = icmp ult i64 %100, %101
br i1 %102, label %91, label %72
}