#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ crypto_smult_curve25519_athlon_fromdouble(unsigned char *,
                                                             double *);
int /*<<< orphan*/ crypto_smult_curve25519_athlon_init();
int /*<<< orphan*/ crypto_smult_curve25519_athlon_mainloop(double *,
                                                           unsigned char *);
int /*<<< orphan*/ crypto_smult_curve25519_athlon_mult(double *, double *,
                                                       double *);
int /*<<< orphan*/ crypto_smult_curve25519_athlon_recip(double *, double *);
int /*<<< orphan*/
crypto_smult_curve25519_athlon_todouble(double *, unsigned char const *);
int curve25519(unsigned char *q, const unsigned char *n,
               const unsigned char *p) {
  double work[30];
  unsigned char e[32];
  int i;
  for (i = 0; i < 32; ++i)
    e[i] = n[i];
  e[0] &= 248;
  e[31] &= 127;
  e[31] |= 64;
  crypto_smult_curve25519_athlon_init();
  crypto_smult_curve25519_athlon_todouble(work, p);
  crypto_smult_curve25519_athlon_mainloop(work, e);
  crypto_smult_curve25519_athlon_recip(work + 10, work + 10);
  crypto_smult_curve25519_athlon_mult(work + 20, work, work + 10);
  crypto_smult_curve25519_athlon_fromdouble(q, work + 20);
  return 0;
}


x86 assembly (clang, -O0):
<curve25519>:
push   %rbp
mov    %rsp,%rbp
sub    $0x140,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
movl   $0x0,-0x134(%rbp)
cmpl   $0x20,-0x134(%rbp)
jge    11be <curve25519+0x5e>
mov    -0x10(%rbp),%rax
movslq -0x134(%rbp),%rcx
mov    (%rax,%rcx,1),%cl
movslq -0x134(%rbp),%rax
mov    %cl,-0x130(%rbp,%rax,1)
mov    -0x134(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x134(%rbp)
jmp    1181 <curve25519+0x21>
movzbl -0x130(%rbp),%eax
and    $0xf8,%eax
mov    %al,-0x130(%rbp)
movzbl -0x111(%rbp),%eax
and    $0x7f,%eax
mov    %al,-0x111(%rbp)
movzbl -0x111(%rbp),%eax
or     $0x40,%eax
mov    %al,-0x111(%rbp)
mov    $0x0,%al
call   1050 <crypto_smult_curve25519_athlon_init@plt>
lea    -0x110(%rbp),%rdi
mov    -0x18(%rbp),%rsi
call   1080 <crypto_smult_curve25519_athlon_todouble@plt>
lea    -0x110(%rbp),%rdi
lea    -0x130(%rbp),%rsi
call   1070 <crypto_smult_curve25519_athlon_mainloop@plt>
lea    -0x110(%rbp),%rdi
add    $0x50,%rdi
lea    -0x110(%rbp),%rsi
add    $0x50,%rsi
call   1030 <crypto_smult_curve25519_athlon_recip@plt>
lea    -0x110(%rbp),%rdi
add    $0xa0,%rdi
lea    -0x110(%rbp),%rsi
lea    -0x110(%rbp),%rdx
add    $0x50,%rdx
call   1060 <crypto_smult_curve25519_athlon_mult@plt>
mov    -0x8(%rbp),%rdi
lea    -0x110(%rbp),%rsi
add    $0xa0,%rsi
call   1040 <crypto_smult_curve25519_athlon_fromdouble@plt>
xor    %eax,%eax
add    $0x140,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<curve25519>:
push   %r15
push   %r14
push   %r12
push   %rbx
sub    $0x118,%rsp
mov    %rdx,%r15
mov    %rdi,%r14
movups (%rsi),%xmm0
movups 0x10(%rsi),%xmm1
movaps %xmm0,(%rsp)
movaps %xmm1,0x10(%rsp)
andb   $0xf8,(%rsp)
mov    0x1f(%rsp),%al
and    $0x3f,%al
or     $0x40,%al
mov    %al,0x1f(%rsp)
xor    %eax,%eax
call   1050 <crypto_smult_curve25519_athlon_init@plt>
lea    0x20(%rsp),%r12
mov    %r12,%rdi
mov    %r15,%rsi
call   1080 <crypto_smult_curve25519_athlon_todouble@plt>
mov    %rsp,%rsi
mov    %r12,%rdi
call   1070 <crypto_smult_curve25519_athlon_mainloop@plt>
lea    0x70(%rsp),%rbx
mov    %rbx,%rdi
mov    %rbx,%rsi
call   1030 <crypto_smult_curve25519_athlon_recip@plt>
lea    0xc0(%rsp),%r15
mov    %r15,%rdi
mov    %r12,%rsi
mov    %rbx,%rdx
call   1060 <crypto_smult_curve25519_athlon_mult@plt>
mov    %r14,%rdi
mov    %r15,%rsi
call   1040 <crypto_smult_curve25519_athlon_fromdouble@plt>
xor    %eax,%eax
add    $0x118,%rsp
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
define i32 @curve25519(i8* %0, i8* %1, i8* %2) {
%4 = alloca i8*
%5 = alloca i8*
%6 = alloca i8*
%7 = alloca [30 x double]
%8 = alloca [32 x i8]
%9 = alloca i32
store i8* %0, i8** %4
store i8* %1, i8** %5
store i8* %2, i8** %6
store i32 0, i32* %9
br label %10
10: ; preds = %22, %3
%11 = load i32, i32* %9
%12 = icmp slt i32 %11, 32
br i1 %12, label %13, label %25
13: ; preds = %10
%14 = load i8*, i8** %5
%15 = load i32, i32* %9
%16 = sext i32 %15 to i64
%17 = getelementptr inbounds i8, i8* %14, i64 %16
%18 = load i8, i8* %17
%19 = load i32, i32* %9
%20 = sext i32 %19 to i64
%21 = getelementptr inbounds [32 x i8], [32 x i8]* %8, i64 0, i64 %20
store i8 %18, i8* %21
br label %22
22: ; preds = %13
%23 = load i32, i32* %9
%24 = add nsw i32 %23, 1
store i32 %24, i32* %9
br label %10
25: ; preds = %10
%26 = getelementptr inbounds [32 x i8], [32 x i8]* %8, i64 0, i64 0
%27 = load i8, i8* %26
%28 = zext i8 %27 to i32
%29 = and i32 %28, 248
%30 = trunc i32 %29 to i8
store i8 %30, i8* %26
%31 = getelementptr inbounds [32 x i8], [32 x i8]* %8, i64 0, i64 31
%32 = load i8, i8* %31
%33 = zext i8 %32 to i32
%34 = and i32 %33, 127
%35 = trunc i32 %34 to i8
store i8 %35, i8* %31
%36 = getelementptr inbounds [32 x i8], [32 x i8]* %8, i64 0, i64 31
%37 = load i8, i8* %36
%38 = zext i8 %37 to i32
%39 = or i32 %38, 64
%40 = trunc i32 %39 to i8
store i8 %40, i8* %36
%41 = call i32 (...) @crypto_smult_curve25519_athlon_init()
%42 = getelementptr inbounds [30 x double], [30 x double]* %7, i64 0, i64 0
%43 = load i8*, i8** %6
%44 = call i32 @crypto_smult_curve25519_athlon_todouble(double* %42, i8* %43)
%45 = getelementptr inbounds [30 x double], [30 x double]* %7, i64 0, i64 0
%46 = getelementptr inbounds [32 x i8], [32 x i8]* %8, i64 0, i64 0
%47 = call i32 @crypto_smult_curve25519_athlon_mainloop(double* %45, i8* %46)
%48 = getelementptr inbounds [30 x double], [30 x double]* %7, i64 0, i64 0
%49 = getelementptr inbounds double, double* %48, i64 10
%50 = getelementptr inbounds [30 x double], [30 x double]* %7, i64 0, i64 0
%51 = getelementptr inbounds double, double* %50, i64 10
%52 = call i32 @crypto_smult_curve25519_athlon_recip(double* %49, double* %51)
%53 = getelementptr inbounds [30 x double], [30 x double]* %7, i64 0, i64 0
%54 = getelementptr inbounds double, double* %53, i64 20
%55 = getelementptr inbounds [30 x double], [30 x double]* %7, i64 0, i64 0
%56 = getelementptr inbounds [30 x double], [30 x double]* %7, i64 0, i64 0
%57 = getelementptr inbounds double, double* %56, i64 10
%58 = call i32 @crypto_smult_curve25519_athlon_mult(double* %54, double* %55, double* %57)
%59 = load i8*, i8** %4
%60 = getelementptr inbounds [30 x double], [30 x double]* %7, i64 0, i64 0
%61 = getelementptr inbounds double, double* %60, i64 20
%62 = call i32 @crypto_smult_curve25519_athlon_fromdouble(i8* %59, double* %61)
ret i32 0
}

LLVM IR (-O2):
define i32 @curve25519(i8* %0, i8* nocapture %1, i8* %2) {
%4 = alloca [30 x double]
%5 = alloca [32 x i8]
%6 = getelementptr inbounds [32 x i8], [32 x i8]* %5, i64 0, i64 0
%7 = bitcast [30 x double]* %4 to i8*
%8 = getelementptr inbounds [32 x i8], [32 x i8]* %5, i64 0, i64 0
%9 = load i8, i8* %8
%10 = and i8 %9, -8
store i8 %10, i8* %8
%11 = getelementptr inbounds [32 x i8], [32 x i8]* %5, i64 0, i64 31
%12 = load i8, i8* %11
%13 = and i8 %12, 63
%14 = or i8 %13, 64
store i8 %14, i8* %11
%15 = tail call i32 (...) @crypto_smult_curve25519_athlon_init()
%16 = getelementptr inbounds [30 x double], [30 x double]* %4, i64 0, i64 0
%17 = call i32 @crypto_smult_curve25519_athlon_todouble(double* %16, i8* %2)
%18 = call i32 @crypto_smult_curve25519_athlon_mainloop(double* %16, i8* %8)
%19 = getelementptr inbounds [30 x double], [30 x double]* %4, i64 0, i64 10
%20 = call i32 @crypto_smult_curve25519_athlon_recip(double* %19, double* %19)
%21 = getelementptr inbounds [30 x double], [30 x double]* %4, i64 0, i64 20
%22 = call i32 @crypto_smult_curve25519_athlon_mult(double* %21, double* %16, double* %19)
%23 = call i32 @crypto_smult_curve25519_athlon_fromdouble(i8* %0, double* %21)
ret i32 0
}