#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
scalar_t__ crypto_onetimeauth_poly1305_verify(unsigned char const *,
                                              unsigned char const *,
                                              unsigned long long,
                                              unsigned char *);
int /*<<< orphan*/ crypto_stream_xsalsa20(unsigned char *, int,
                                          unsigned char const *,
                                          unsigned char const *);
int /*<<< orphan*/ crypto_stream_xsalsa20_xor(unsigned char *,
                                              unsigned char const *,
                                              unsigned long long,
                                              unsigned char const *,
                                              unsigned char const *);
int crypto_secretbox_xsalsa20poly1305_open(unsigned char *m,
                                           const unsigned char *c,
                                           unsigned long long clen,
                                           const unsigned char *n,
                                           const unsigned char *k) {
  int i;
  unsigned char subkey[32];
  if (clen < 32)
    return -1;
  crypto_stream_xsalsa20(subkey, 32, n, k);
  if (crypto_onetimeauth_poly1305_verify(c + 16, c + 32, clen - 32, subkey) !=
      0)
    return -1;
  crypto_stream_xsalsa20_xor(m, c, clen, n, k);
  for (i = 0; i < 32; ++i)
    m[i] = 0;
  return 0;
}


x86 assembly (clang, -O0):
<crypto_secretbox_xsalsa20poly1305_open>:
push   %rbp
mov    %rsp,%rbp
sub    $0x60,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %rcx,-0x28(%rbp)
mov    %r8,-0x30(%rbp)
cmpq   $0x20,-0x20(%rbp)
jae    1163 <crypto_secretbox_xsalsa20poly1305_open+0x33>
movl   $0xffffffff,-0x4(%rbp)
jmp    11fb <crypto_secretbox_xsalsa20poly1305_open+0xcb>
lea    -0x60(%rbp),%rdi
mov    -0x28(%rbp),%rdx
mov    -0x30(%rbp),%rcx
mov    $0x20,%esi
call   1030 <crypto_stream_xsalsa20@plt>
mov    -0x18(%rbp),%rdi
add    $0x10,%rdi
mov    -0x18(%rbp),%rsi
add    $0x20,%rsi
mov    -0x20(%rbp),%rdx
sub    $0x20,%rdx
lea    -0x60(%rbp),%rcx
call   1040 <crypto_onetimeauth_poly1305_verify@plt>
cmp    $0x0,%rax
je     11b0 <crypto_secretbox_xsalsa20poly1305_open+0x80>
movl   $0xffffffff,-0x4(%rbp)
jmp    11fb <crypto_secretbox_xsalsa20poly1305_open+0xcb>
mov    -0x10(%rbp),%rdi
mov    -0x18(%rbp),%rsi
mov    -0x20(%rbp),%rdx
mov    -0x28(%rbp),%rcx
mov    -0x30(%rbp),%r8
call   1050 <crypto_stream_xsalsa20_xor@plt>
movl   $0x0,-0x34(%rbp)
cmpl   $0x20,-0x34(%rbp)
jge    11f4 <crypto_secretbox_xsalsa20poly1305_open+0xc4>
mov    -0x10(%rbp),%rax
movslq -0x34(%rbp),%rcx
movb   $0x0,(%rax,%rcx,1)
mov    -0x34(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x34(%rbp)
jmp    11d0 <crypto_secretbox_xsalsa20poly1305_open+0xa0>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x60,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<crypto_secretbox_xsalsa20poly1305_open>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x28,%rsp
mov    $0xffffffff,%r13d
cmp    $0x20,%rdx
jb     11a8 <crypto_secretbox_xsalsa20poly1305_open+0x78>
mov    %r8,%r15
mov    %rcx,%r12
mov    %rdx,%rbx
mov    %rsi,%rbp
mov    %rdi,%r14
mov    %rsp,%rdi
mov    $0x20,%esi
mov    %rcx,%rdx
mov    %r8,%rcx
call   1030 <crypto_stream_xsalsa20@plt>
lea    0x10(%rbp),%rdi
lea    0x20(%rbp),%rsi
lea    -0x20(%rbx),%rdx
mov    %rsp,%rcx
call   1040 <crypto_onetimeauth_poly1305_verify@plt>
test   %rax,%rax
jne    11a8 <crypto_secretbox_xsalsa20poly1305_open+0x78>
mov    %r14,%rdi
mov    %rbp,%rsi
mov    %rbx,%rdx
mov    %r12,%rcx
mov    %r15,%r8
call   1050 <crypto_stream_xsalsa20_xor@plt>
xorps  %xmm0,%xmm0
movups %xmm0,(%r14)
movups %xmm0,0x10(%r14)
xor    %r13d,%r13d
mov    %r13d,%eax
add    $0x28,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
define i32 @crypto_secretbox_xsalsa20poly1305_open(i8* %0, i8* %1, i64 %2, i8* %3, i8* %4) {
%6 = alloca i32
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i64
%10 = alloca i8*
%11 = alloca i8*
%12 = alloca i32
%13 = alloca [32 x i8]
store i8* %0, i8** %7
store i8* %1, i8** %8
store i64 %2, i64* %9
store i8* %3, i8** %10
store i8* %4, i8** %11
%14 = load i64, i64* %9
%15 = icmp ult i64 %14, 32
br i1 %15, label %16, label %17
16: ; preds = %5
store i32 -1, i32* %6
br label %51
17: ; preds = %5
%18 = getelementptr inbounds [32 x i8], [32 x i8]* %13, i64 0, i64 0
%19 = load i8*, i8** %10
%20 = load i8*, i8** %11
%21 = call i32 @crypto_stream_xsalsa20(i8* %18, i32 32, i8* %19, i8* %20)
%22 = load i8*, i8** %8
%23 = getelementptr inbounds i8, i8* %22, i64 16
%24 = load i8*, i8** %8
%25 = getelementptr inbounds i8, i8* %24, i64 32
%26 = load i64, i64* %9
%27 = sub i64 %26, 32
%28 = getelementptr inbounds [32 x i8], [32 x i8]* %13, i64 0, i64 0
%29 = call i64 @crypto_onetimeauth_poly1305_verify(i8* %23, i8* %25, i64 %27, i8* %28)
%30 = icmp ne i64 %29, 0
br i1 %30, label %31, label %32
31: ; preds = %17
store i32 -1, i32* %6
br label %51
32: ; preds = %17
%33 = load i8*, i8** %7
%34 = load i8*, i8** %8
%35 = load i64, i64* %9
%36 = load i8*, i8** %10
%37 = load i8*, i8** %11
%38 = call i32 @crypto_stream_xsalsa20_xor(i8* %33, i8* %34, i64 %35, i8* %36, i8* %37)
store i32 0, i32* %12
br label %39
39: ; preds = %47, %32
%40 = load i32, i32* %12
%41 = icmp slt i32 %40, 32
br i1 %41, label %42, label %50
42: ; preds = %39
%43 = load i8*, i8** %7
%44 = load i32, i32* %12
%45 = sext i32 %44 to i64
%46 = getelementptr inbounds i8, i8* %43, i64 %45
store i8 0, i8* %46
br label %47
47: ; preds = %42
%48 = load i32, i32* %12
%49 = add nsw i32 %48, 1
store i32 %49, i32* %12
br label %39
50: ; preds = %39
store i32 0, i32* %6
br label %51
51: ; preds = %50, %31, %16
%52 = load i32, i32* %6
ret i32 %52
}

LLVM IR (-O2):
define i32 @crypto_secretbox_xsalsa20poly1305_open(i8* %0, i8* %1, i64 %2, i8* %3, i8* %4) {
%6 = alloca [32 x i8]
%7 = getelementptr inbounds [32 x i8], [32 x i8]* %6, i64 0, i64 0
%8 = icmp ult i64 %2, 32
br i1 %8, label %18, label %9
9: ; preds = %5
%10 = call i32 @crypto_stream_xsalsa20(i8* %7, i32 32, i8* %3, i8* %4)
%11 = getelementptr inbounds i8, i8* %1, i64 16
%12 = getelementptr inbounds i8, i8* %1, i64 32
%13 = add i64 %2, -32
%14 = call i64 @crypto_onetimeauth_poly1305_verify(i8* %11, i8* %12, i64 %13, i8* %7)
%15 = icmp eq i64 %14, 0
br i1 %15, label %16, label %18
16: ; preds = %9
%17 = call i32 @crypto_stream_xsalsa20_xor(i8* %0, i8* %1, i64 %2, i8* %3, i8* %4)
br label %18
18: ; preds = %16, %9, %5
%19 = phi i32 [ -1, %5 ], [ -1, %9 ], [ 0, %16 ]
ret i32 %19
}