#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef scalar_t__ uint64_t;

/* Variables and functions */
int /*<<< orphan*/ keccak_absorb(scalar_t__ *, int, unsigned char *, int, int);
int /*<<< orphan*/ keccak_squeezeblocks(unsigned char *, int, scalar_t__ *,
                                        int);
int crypto_stream_shake128(unsigned char *output, unsigned long long outlen,
                           const unsigned char *nonce,
                           const unsigned char *key) {
  unsigned char t[8 + 32];
  unsigned char d[168];
  uint64_t s[25];
  size_t i;
  for (i = 0; i < 32; i++)
    t[i] = key[i];
  for (i = 0; i < 8; i++)
    t[i + 32] = nonce[i];
  for (i = 0; i < 25; i++)
    s[i] = 0;
  keccak_absorb(s, 168, t, 32 + 8, 0x1F);
  keccak_squeezeblocks(output, outlen / 168, s, 168);
  output += (outlen / 168) * 168;
  if (outlen % 168) {
    keccak_squeezeblocks(d, 1, s, 168);
    for (i = 0; i < outlen % 168; i++)
      output[i] = d[i];
  }
  return 0;
}


x86 assembly (clang, -O0):
<crypto_stream_shake128>:
push   %rbp
mov    %rsp,%rbp
sub    $0x1e0,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
mov    %rcx,-0x20(%rbp)
movq   $0x0,-0x1d8(%rbp)
cmpq   $0x20,-0x1d8(%rbp)
20
jae    1184 <crypto_stream_shake128+0x64>
mov    -0x20(%rbp),%rax
mov    -0x1d8(%rbp),%rcx
mov    (%rax,%rcx,1),%cl
mov    -0x1d8(%rbp),%rax
mov    %cl,-0x50(%rbp,%rax,1)
mov    -0x1d8(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x1d8(%rbp)
jmp    1146 <crypto_stream_shake128+0x26>
movq   $0x0,-0x1d8(%rbp)
cmpq   $0x8,-0x1d8(%rbp)
08
jae    11cd <crypto_stream_shake128+0xad>
mov    -0x18(%rbp),%rax
mov    -0x1d8(%rbp),%rcx
mov    (%rax,%rcx,1),%cl
mov    -0x1d8(%rbp),%rax
mov    %cl,-0x30(%rbp,%rax,1)
mov    -0x1d8(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x1d8(%rbp)
jmp    118f <crypto_stream_shake128+0x6f>
movq   $0x0,-0x1d8(%rbp)
cmpq   $0x19,-0x1d8(%rbp)
19
jae    1210 <crypto_stream_shake128+0xf0>
mov    -0x1d8(%rbp),%rax
movq   $0x0,-0x1d0(%rbp,%rax,8)
mov    -0x1d8(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x1d8(%rbp)
jmp    11d8 <crypto_stream_shake128+0xb8>
lea    -0x1d0(%rbp),%rdi
lea    -0x50(%rbp),%rdx
mov    $0xa8,%esi
mov    $0x28,%ecx
mov    $0x1f,%r8d
call   1040 <keccak_absorb@plt>
mov    -0x8(%rbp),%rdi
mov    -0x10(%rbp),%rax
mov    $0xa8,%ecx
xor    %edx,%edx
div    %rcx
mov    %eax,%esi
lea    -0x1d0(%rbp),%rdx
mov    $0xa8,%ecx
call   1030 <keccak_squeezeblocks@plt>
mov    -0x10(%rbp),%rax
mov    $0xa8,%ecx
xor    %edx,%edx
div    %rcx
imul   $0xa8,%rax,%rax
add    -0x8(%rbp),%rax
mov    %rax,-0x8(%rbp)
mov    -0x10(%rbp),%rax
mov    $0xa8,%ecx
xor    %edx,%edx
div    %rcx
cmp    $0x0,%rdx
je     1316 <crypto_stream_shake128+0x1f6>
lea    -0x100(%rbp),%rdi
lea    -0x1d0(%rbp),%rdx
mov    $0x1,%esi
mov    $0xa8,%ecx
call   1030 <keccak_squeezeblocks@plt>
movq   $0x0,-0x1d8(%rbp)
mov    -0x1d8(%rbp),%rax
mov    %rax,-0x1e0(%rbp)
mov    -0x10(%rbp),%rax
mov    $0xa8,%ecx
xor    %edx,%edx
div    %rcx
mov    -0x1e0(%rbp),%rax
cmp    %rdx,%rax
jae    1311 <crypto_stream_shake128+0x1f1>
mov    -0x1d8(%rbp),%rax
mov    -0x100(%rbp,%rax,1),%dl
mov    -0x8(%rbp),%rax
mov    -0x1d8(%rbp),%rcx
mov    %dl,(%rax,%rcx,1)
mov    -0x1d8(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x1d8(%rbp)
jmp    12b2 <crypto_stream_shake128+0x192>
jmp    1316 <crypto_stream_shake128+0x1f6>
xor    %eax,%eax
add    $0x1e0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<crypto_stream_shake128>:
push   %r15
push   %r14
push   %r12
push   %rbx
sub    $0x1a8,%rsp
mov    %rsi,%r12
mov    %rdi,%r14
movups (%rcx),%xmm0
movups 0x10(%rcx),%xmm1
movaps %xmm0,(%rsp)
movaps %xmm1,0x10(%rsp)
mov    (%rdx),%rax
mov    %rax,0x20(%rsp)
xorps  %xmm0,%xmm0
movaps %xmm0,0xe0(%rsp)
movaps %xmm0,0xd0(%rsp)
movaps %xmm0,0xc0(%rsp)
movaps %xmm0,0xb0(%rsp)
movaps %xmm0,0xa0(%rsp)
movaps %xmm0,0x90(%rsp)
movaps %xmm0,0x80(%rsp)
movaps %xmm0,0x70(%rsp)
movaps %xmm0,0x60(%rsp)
movaps %xmm0,0x50(%rsp)
movaps %xmm0,0x40(%rsp)
movaps %xmm0,0x30(%rsp)
movq   $0x0,0xf0(%rsp)
lea    0x30(%rsp),%r15
mov    %rsp,%rdx
mov    %r15,%rdi
mov    $0xa8,%esi
mov    $0x28,%ecx
mov    $0x1f,%r8d
call   1050 <keccak_absorb@plt>
mov    %r12,%rax
shr    $0x3,%rax
movabs $0xc30c30c30c30c31,%rcx
c3 30 0c
mul    %rcx
mov    %rdx,%rbx
mov    %r14,%rdi
mov    %ebx,%esi
mov    %r15,%rdx
mov    $0xa8,%ecx
call   1030 <keccak_squeezeblocks@plt>
imul   $0xa8,%rbx,%rax
sub    %rax,%r12
je     1241 <crypto_stream_shake128+0x111>
add    %rax,%r14
lea    0x100(%rsp),%rbx
lea    0x30(%rsp),%rdx
mov    %rbx,%rdi
mov    $0x1,%esi
mov    $0xa8,%ecx
call   1030 <keccak_squeezeblocks@plt>
mov    %r14,%rdi
mov    %rbx,%rsi
mov    %r12,%rdx
call   1040 <memcpy@plt>
xor    %eax,%eax
add    $0x1a8,%rsp
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
define i32 @crypto_stream_shake128(i8* %0, i64 %1, i8* %2, i8* %3) {
%5 = alloca i8*
%6 = alloca i64
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca [40 x i8]
%10 = alloca [168 x i8]
%11 = alloca [25 x i64]
%12 = alloca i64
store i8* %0, i8** %5
store i64 %1, i64* %6
store i8* %2, i8** %7
store i8* %3, i8** %8
store i64 0, i64* %12
br label %13
13: ; preds = %23, %4
%14 = load i64, i64* %12
%15 = icmp ult i64 %14, 32
br i1 %15, label %16, label %26
16: ; preds = %13
%17 = load i8*, i8** %8
%18 = load i64, i64* %12
%19 = getelementptr inbounds i8, i8* %17, i64 %18
%20 = load i8, i8* %19
%21 = load i64, i64* %12
%22 = getelementptr inbounds [40 x i8], [40 x i8]* %9, i64 0, i64 %21
store i8 %20, i8* %22
br label %23
23: ; preds = %16
%24 = load i64, i64* %12
%25 = add i64 %24, 1
store i64 %25, i64* %12
br label %13
26: ; preds = %13
store i64 0, i64* %12
br label %27
27: ; preds = %38, %26
%28 = load i64, i64* %12
%29 = icmp ult i64 %28, 8
br i1 %29, label %30, label %41
30: ; preds = %27
%31 = load i8*, i8** %7
%32 = load i64, i64* %12
%33 = getelementptr inbounds i8, i8* %31, i64 %32
%34 = load i8, i8* %33
%35 = load i64, i64* %12
%36 = add i64 %35, 32
%37 = getelementptr inbounds [40 x i8], [40 x i8]* %9, i64 0, i64 %36
store i8 %34, i8* %37
br label %38
38: ; preds = %30
%39 = load i64, i64* %12
%40 = add i64 %39, 1
store i64 %40, i64* %12
br label %27
41: ; preds = %27
store i64 0, i64* %12
br label %42
42: ; preds = %48, %41
%43 = load i64, i64* %12
%44 = icmp ult i64 %43, 25
br i1 %44, label %45, label %51
45: ; preds = %42
%46 = load i64, i64* %12
%47 = getelementptr inbounds [25 x i64], [25 x i64]* %11, i64 0, i64 %46
store i64 0, i64* %47
br label %48
48: ; preds = %45
%49 = load i64, i64* %12
%50 = add i64 %49, 1
store i64 %50, i64* %12
br label %42
51: ; preds = %42
%52 = getelementptr inbounds [25 x i64], [25 x i64]* %11, i64 0, i64 0
%53 = getelementptr inbounds [40 x i8], [40 x i8]* %9, i64 0, i64 0
%54 = call i32 @keccak_absorb(i64* %52, i32 168, i8* %53, i32 40, i32 31)
%55 = load i8*, i8** %5
%56 = load i64, i64* %6
%57 = udiv i64 %56, 168
%58 = trunc i64 %57 to i32
%59 = getelementptr inbounds [25 x i64], [25 x i64]* %11, i64 0, i64 0
%60 = call i32 @keccak_squeezeblocks(i8* %55, i32 %58, i64* %59, i32 168)
%61 = load i64, i64* %6
%62 = udiv i64 %61, 168
%63 = mul i64 %62, 168
%64 = load i8*, i8** %5
%65 = getelementptr inbounds i8, i8* %64, i64 %63
store i8* %65, i8** %5
%66 = load i64, i64* %6
%67 = urem i64 %66, 168
%68 = icmp ne i64 %67, 0
br i1 %68, label %69, label %89
69: ; preds = %51
%70 = getelementptr inbounds [168 x i8], [168 x i8]* %10, i64 0, i64 0
%71 = getelementptr inbounds [25 x i64], [25 x i64]* %11, i64 0, i64 0
%72 = call i32 @keccak_squeezeblocks(i8* %70, i32 1, i64* %71, i32 168)
store i64 0, i64* %12
br label %73
73: ; preds = %85, %69
%74 = load i64, i64* %12
%75 = load i64, i64* %6
%76 = urem i64 %75, 168
%77 = icmp ult i64 %74, %76
br i1 %77, label %78, label %88
78: ; preds = %73
%79 = load i64, i64* %12
%80 = getelementptr inbounds [168 x i8], [168 x i8]* %10, i64 0, i64 %79
%81 = load i8, i8* %80
%82 = load i8*, i8** %5
%83 = load i64, i64* %12
%84 = getelementptr inbounds i8, i8* %82, i64 %83
store i8 %81, i8* %84
br label %85
85: ; preds = %78
%86 = load i64, i64* %12
%87 = add i64 %86, 1
store i64 %87, i64* %12
br label %73
88: ; preds = %73
br label %89
89: ; preds = %88, %51
ret i32 0
}

LLVM IR (-O2):
define i32 @crypto_stream_shake128(i8* %0, i64 %1, i8* nocapture %2, i8* nocapture %3) {
%5 = alloca [40 x i8]
%6 = getelementptr inbounds [40 x i8], [40 x i8]* %5, i64 0, i64 0
%7 = alloca [168 x i8]
%8 = alloca [25 x i64]
%9 = bitcast [25 x i64]* %8 to i8*
%10 = getelementptr inbounds [40 x i8], [40 x i8]* %5, i64 0, i64 0
%11 = getelementptr inbounds [168 x i8], [168 x i8]* %7, i64 0, i64 0
%12 = getelementptr inbounds [40 x i8], [40 x i8]* %5, i64 0, i64 32
%13 = bitcast i8* %2 to i64*
%14 = bitcast i8* %12 to i64*
%15 = load i64, i64* %13
store i64 %15, i64* %14
%16 = getelementptr inbounds [25 x i64], [25 x i64]* %8, i64 0, i64 0
%17 = call i32 @keccak_absorb(i64* %16, i32 168, i8* %10, i32 40, i32 31)
%18 = udiv i64 %1, 168
%19 = trunc i64 %18 to i32
%20 = call i32 @keccak_squeezeblocks(i8* %0, i32 %19, i64* %16, i32 168)
%21 = urem i64 %1, 168
%22 = icmp eq i64 %21, 0
br i1 %22, label %28, label %23
23: ; preds = %4
%24 = mul nuw i64 %18, 168
%25 = getelementptr i8, i8* %0, i64 %24
%26 = getelementptr inbounds [168 x i8], [168 x i8]* %7, i64 0, i64 0
%27 = call i32 @keccak_squeezeblocks(i8* %11, i32 1, i64* %16, i32 168)
br label %28
28: ; preds = %23, %4
ret i32 0
}