#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ acorn128_initialization_32bitversion(unsigned char const *,
                                                        unsigned char const *,
                                                        unsigned long long *);
int /*<<< orphan*/ acorn128_tag_generation_32bits_version(unsigned long long,
                                                          unsigned long long,
                                                          int, unsigned char *,
                                                          unsigned long long *);
int /*<<< orphan*/ encrypt_32bits(unsigned long long *, unsigned int,
                                  unsigned int *, unsigned int *, unsigned int,
                                  unsigned int);
int /*<<< orphan*/ encrypt_8bits(unsigned long long *, unsigned int,
                                 unsigned int *, unsigned int *, unsigned int,
                                 unsigned int);
int /*<<< orphan*/ memcpy(unsigned char *, unsigned char *, int);
int crypto_aead_encrypt(unsigned char *c, unsigned long long *clen,
                        const unsigned char *m, unsigned long long mlen,
                        const unsigned char *ad, unsigned long long adlen,
                        const unsigned char *nsec, const unsigned char *npub,
                        const unsigned char *k) {
  unsigned long long i;
  unsigned char mac[16];
  unsigned int plaintextword, ciphertextword, ksword;
  unsigned long long state[7];
  unsigned int ca, cb;
  acorn128_initialization_32bitversion(k, npub, state);
  ca = 0xffffffff;
  cb = 0xffffffff;
  for (i = 0; i < adlen / 4; i = i + 1) {
    encrypt_32bits(state, ((unsigned int *)ad)[i], &ciphertextword, &ksword, ca,
                   cb);
  }
  for (i = adlen & 0xfffffffffffffffcULL; i < adlen; i++) {
    ca = 0xff;
    cb = 0xff;
    plaintextword = ad[i];
    encrypt_8bits(state, plaintextword, &ciphertextword, &ksword, ca, cb);
  }
  for (i = 0; i < 256 / 32; i++) {
    if (i == 0)
      plaintextword = 0x1;
    else
      plaintextword = 0;
    if (i < 128 / 32)
      ca = 0xffffffff;
    else
      ca = 0;
    cb = 0xffffffff;
    encrypt_32bits(state, plaintextword, &ciphertextword, &ksword, ca, cb);
  }
  ca = 0xffffffff;
  cb = 0;
  for (i = 0; i < mlen / 4; i = i + 1) {
    encrypt_32bits(state, ((unsigned int *)m)[i], &(((unsigned int *)c)[i]),
                   &ksword, ca, cb);
  }
  for (i = mlen & 0xfffffffffffffffcULL; i < mlen; i++) {
    ca = 0xff;
    cb = 0x0;
    plaintextword = m[i];
    encrypt_8bits(state, plaintextword, &ciphertextword, &ksword, ca, cb);
    c[i] = ciphertextword;
  }
  for (i = 0; i < 256 / 32; i++) {
    if (i == 0)
      plaintextword = 0x1;
    else
      plaintextword = 0;
    if (i < 128 / 32)
      ca = 0xffffffff;
    else
      ca = 0;
    cb = 0;
    encrypt_32bits(state, plaintextword, &ciphertextword, &ksword, ca, cb);
  }
  acorn128_tag_generation_32bits_version(mlen, adlen, 16, mac, state);
  *clen = mlen + 16;
  memcpy(c + mlen, mac, 16);
  return 0;
}


x86 assembly (clang, -O0):
<crypto_aead_encrypt>:
push   %rbp
mov    %rsp,%rbp
sub    $0xb0,%rsp
mov    0x20(%rbp),%rax
mov    0x18(%rbp),%rax
mov    0x10(%rbp),%rax
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
mov    %rcx,-0x20(%rbp)
mov    %r8,-0x28(%rbp)
mov    %r9,-0x30(%rbp)
mov    0x20(%rbp),%rdi
mov    0x18(%rbp),%rsi
lea    -0xa0(%rbp),%rdx
call   1050 <acorn128_initialization_32bitversion@plt>
movl   $0xffffffff,-0xa4(%rbp)
ff ff ff
movl   $0xffffffff,-0xa8(%rbp)
ff ff ff
movq   $0x0,-0x38(%rbp)
mov    -0x38(%rbp),%rax
mov    -0x30(%rbp),%rcx
shr    $0x2,%rcx
cmp    %rcx,%rax
jae    1202 <crypto_aead_encrypt+0xb2>
lea    -0xa0(%rbp),%rdi
mov    -0x28(%rbp),%rax
mov    -0x38(%rbp),%rcx
mov    (%rax,%rcx,4),%esi
mov    -0xa4(%rbp),%r8d
mov    -0xa8(%rbp),%r9d
lea    -0x58(%rbp),%rdx
lea    -0x5c(%rbp),%rcx
call   1030 <encrypt_32bits@plt>
mov    -0x38(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x38(%rbp)
jmp    11af <crypto_aead_encrypt+0x5f>
mov    -0x30(%rbp),%rax
and    $0xfffffffffffffffc,%rax
mov    %rax,-0x38(%rbp)
mov    -0x38(%rbp),%rax
cmp    -0x30(%rbp),%rax
jae    1275 <crypto_aead_encrypt+0x125>
movl   $0xff,-0xa4(%rbp)
movl   $0xff,-0xa8(%rbp)
mov    -0x28(%rbp),%rax
mov    -0x38(%rbp),%rcx
movzbl (%rax,%rcx,1),%eax
mov    %eax,-0x54(%rbp)
lea    -0xa0(%rbp),%rdi
mov    -0x54(%rbp),%esi
mov    -0xa4(%rbp),%r8d
mov    -0xa8(%rbp),%r9d
lea    -0x58(%rbp),%rdx
lea    -0x5c(%rbp),%rcx
call   1070 <encrypt_8bits@plt>
mov    -0x38(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x38(%rbp)
jmp    120e <crypto_aead_encrypt+0xbe>
movq   $0x0,-0x38(%rbp)
cmpq   $0x8,-0x38(%rbp)
jae    130a <crypto_aead_encrypt+0x1ba>
cmpq   $0x0,-0x38(%rbp)
jne    129f <crypto_aead_encrypt+0x14f>
movl   $0x1,-0x54(%rbp)
jmp    12a6 <crypto_aead_encrypt+0x156>
movl   $0x0,-0x54(%rbp)
cmpq   $0x4,-0x38(%rbp)
jae    12c0 <crypto_aead_encrypt+0x170>
movl   $0xffffffff,-0xa4(%rbp)
ff ff ff
jmp    12ca <crypto_aead_encrypt+0x17a>
movl   $0x0,-0xa4(%rbp)
movl   $0xffffffff,-0xa8(%rbp)
ff ff ff
lea    -0xa0(%rbp),%rdi
mov    -0x54(%rbp),%esi
mov    -0xa4(%rbp),%r8d
mov    -0xa8(%rbp),%r9d
lea    -0x58(%rbp),%rdx
lea    -0x5c(%rbp),%rcx
call   1030 <encrypt_32bits@plt>
mov    -0x38(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x38(%rbp)
jmp    127d <crypto_aead_encrypt+0x12d>
movl   $0xffffffff,-0xa4(%rbp)
ff ff ff
movl   $0x0,-0xa8(%rbp)
movq   $0x0,-0x38(%rbp)
mov    -0x38(%rbp),%rax
mov    -0x20(%rbp),%rcx
shr    $0x2,%rcx
cmp    %rcx,%rax
jae    1384 <crypto_aead_encrypt+0x234>
lea    -0xa0(%rbp),%rdi
mov    -0x18(%rbp),%rax
mov    -0x38(%rbp),%rcx
mov    (%rax,%rcx,4),%esi
mov    -0x8(%rbp),%rdx
mov    -0x38(%rbp),%rax
shl    $0x2,%rax
add    %rax,%rdx
mov    -0xa4(%rbp),%r8d
mov    -0xa8(%rbp),%r9d
lea    -0x5c(%rbp),%rcx
call   1030 <encrypt_32bits@plt>
mov    -0x38(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x38(%rbp)
jmp    1326 <crypto_aead_encrypt+0x1d6>
mov    -0x20(%rbp),%rax
and    $0xfffffffffffffffc,%rax
mov    %rax,-0x38(%rbp)
mov    -0x38(%rbp),%rax
cmp    -0x20(%rbp),%rax
jae    1407 <crypto_aead_encrypt+0x2b7>
movl   $0xff,-0xa4(%rbp)
movl   $0x0,-0xa8(%rbp)
mov    -0x18(%rbp),%rax
mov    -0x38(%rbp),%rcx
movzbl (%rax,%rcx,1),%eax
mov    %eax,-0x54(%rbp)
lea    -0xa0(%rbp),%rdi
mov    -0x54(%rbp),%esi
mov    -0xa4(%rbp),%r8d
mov    -0xa8(%rbp),%r9d
lea    -0x58(%rbp),%rdx
lea    -0x5c(%rbp),%rcx
call   1070 <encrypt_8bits@plt>
mov    -0x58(%rbp),%eax
mov    %al,%dl
mov    -0x8(%rbp),%rax
mov    -0x38(%rbp),%rcx
mov    %dl,(%rax,%rcx,1)
mov    -0x38(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x38(%rbp)
jmp    1390 <crypto_aead_encrypt+0x240>
movq   $0x0,-0x38(%rbp)
cmpq   $0x8,-0x38(%rbp)
jae    149c <crypto_aead_encrypt+0x34c>
cmpq   $0x0,-0x38(%rbp)
jne    1431 <crypto_aead_encrypt+0x2e1>
movl   $0x1,-0x54(%rbp)
jmp    1438 <crypto_aead_encrypt+0x2e8>
movl   $0x0,-0x54(%rbp)
cmpq   $0x4,-0x38(%rbp)
jae    1452 <crypto_aead_encrypt+0x302>
movl   $0xffffffff,-0xa4(%rbp)
ff ff ff
jmp    145c <crypto_aead_encrypt+0x30c>
movl   $0x0,-0xa4(%rbp)
movl   $0x0,-0xa8(%rbp)
lea    -0xa0(%rbp),%rdi
mov    -0x54(%rbp),%esi
mov    -0xa4(%rbp),%r8d
mov    -0xa8(%rbp),%r9d
lea    -0x58(%rbp),%rdx
lea    -0x5c(%rbp),%rcx
call   1030 <encrypt_32bits@plt>
mov    -0x38(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x38(%rbp)
jmp    140f <crypto_aead_encrypt+0x2bf>
mov    -0x20(%rbp),%rdi
mov    -0x30(%rbp),%rsi
lea    -0x50(%rbp),%rcx
lea    -0xa0(%rbp),%r8
mov    $0x10,%edx
call   1040 <acorn128_tag_generation_32bits_version@plt>
mov    -0x20(%rbp),%rcx
add    $0x10,%rcx
mov    -0x10(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x8(%rbp),%rdi
add    -0x20(%rbp),%rdi
lea    -0x50(%rbp),%rsi
mov    $0x10,%edx
call   1060 <memcpy@plt>
xor    %eax,%eax
add    $0xb0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<crypto_aead_encrypt>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x88,%rsp
mov    %r9,%rbx
mov    %r8,%rbp
mov    %rcx,0x28(%rsp)
mov    %rdx,0x18(%rsp)
mov    %rsi,0x20(%rsp)
mov    %rdi,0x10(%rsp)
mov    0xd0(%rsp),%rdi
mov    0xc8(%rsp),%rsi
lea    0x30(%rsp),%rdx
call   1050 <acorn128_initialization_32bitversion@plt>
mov    %rbx,0x8(%rsp)
cmp    $0x4,%rbx
jb     11e8 <crypto_aead_encrypt+0x98>
mov    0x8(%rsp),%rbx
shr    $0x2,%rbx
xor    %r15d,%r15d
lea    0x30(%rsp),%r14
lea    0x4(%rsp),%r12
mov    %rsp,%r13
nopl   0x0(%rax)
mov    0x0(%rbp,%r15,4),%esi
mov    %r14,%rdi
mov    %r12,%rdx
mov    %r13,%rcx
mov    $0xffffffff,%r8d
mov    $0xffffffff,%r9d
call   1030 <encrypt_32bits@plt>
add    $0x1,%r15
cmp    %r15,%rbx
jne    11c0 <crypto_aead_encrypt+0x70>
mov    0x8(%rsp),%rbx
mov    %rbx,%r13
and    $0xfffffffffffffffc,%r13
cmp    %rbx,%r13
jae    1239 <crypto_aead_encrypt+0xe9>
lea    0x30(%rsp),%r14
lea    0x4(%rsp),%r15
mov    %rsp,%r12
cs nopw 0x0(%rax,%rax,1)
movzbl 0x0(%rbp,%r13,1),%esi
mov    %r14,%rdi
mov    %r15,%rdx
mov    %r12,%rcx
mov    $0xff,%r8d
mov    $0xff,%r9d
call   1070 <encrypt_8bits@plt>
add    $0x1,%r13
cmp    %r13,%rbx
jne    1210 <crypto_aead_encrypt+0xc0>
lea    0x30(%rsp),%rbp
lea    0x4(%rsp),%rbx
mov    %rsp,%r14
mov    %rbp,%rdi
mov    $0x1,%esi
mov    %rbx,%rdx
mov    %r14,%rcx
mov    $0xffffffff,%r8d
mov    $0xffffffff,%r9d
call   1030 <encrypt_32bits@plt>
mov    %rbp,%rdi
xor    %esi,%esi
mov    %rbx,%rdx
mov    %r14,%rcx
mov    $0xffffffff,%r8d
mov    $0xffffffff,%r9d
call   1030 <encrypt_32bits@plt>
mov    %rbp,%rdi
xor    %esi,%esi
mov    %rbx,%rdx
mov    %r14,%rcx
mov    $0xffffffff,%r8d
mov    $0xffffffff,%r9d
call   1030 <encrypt_32bits@plt>
mov    %rbp,%rdi
xor    %esi,%esi
mov    %rbx,%rdx
mov    %r14,%rcx
mov    $0xffffffff,%r8d
mov    $0xffffffff,%r9d
call   1030 <encrypt_32bits@plt>
mov    %rbp,%rdi
xor    %esi,%esi
mov    %rbx,%rdx
mov    %r14,%rcx
xor    %r8d,%r8d
mov    $0xffffffff,%r9d
call   1030 <encrypt_32bits@plt>
mov    %rbp,%rdi
xor    %esi,%esi
mov    %rbx,%rdx
mov    %r14,%rcx
xor    %r8d,%r8d
mov    $0xffffffff,%r9d
call   1030 <encrypt_32bits@plt>
mov    %rbp,%rdi
xor    %esi,%esi
mov    %rbx,%rdx
mov    %r14,%rcx
xor    %r8d,%r8d
mov    $0xffffffff,%r9d
call   1030 <encrypt_32bits@plt>
mov    %rbp,%rdi
xor    %esi,%esi
mov    %rbx,%rdx
mov    %r14,%rcx
xor    %r8d,%r8d
mov    $0xffffffff,%r9d
call   1030 <encrypt_32bits@plt>
mov    0x28(%rsp),%r15
cmp    $0x4,%r15
mov    0x18(%rsp),%r12
jb     136a <crypto_aead_encrypt+0x21a>
mov    %r15,%r13
shr    $0x2,%r13
xor    %ebx,%ebx
mov    %rsp,%r14
mov    0x10(%rsp),%rbp
xchg   %ax,%ax
mov    (%r12,%rbx,4),%esi
lea    0x30(%rsp),%rdi
mov    %rbp,%rdx
mov    %r14,%rcx
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1030 <encrypt_32bits@plt>
add    $0x1,%rbx
add    $0x4,%rbp
cmp    %rbx,%r13
jne    1340 <crypto_aead_encrypt+0x1f0>
mov    %r15,%rbp
and    $0xfffffffffffffffc,%rbp
cmp    %r15,%rbp
jae    13c2 <crypto_aead_encrypt+0x272>
lea    0x30(%rsp),%r13
lea    0x4(%rsp),%rbx
mov    %rsp,%r14
cs nopw 0x0(%rax,%rax,1)
nopl   (%rax)
movzbl (%r12,%rbp,1),%esi
mov    %r13,%rdi
mov    %rbx,%rdx
mov    %r14,%rcx
mov    $0xff,%r8d
xor    %r9d,%r9d
call   1070 <encrypt_8bits@plt>
movzbl 0x4(%rsp),%eax
mov    0x10(%rsp),%rcx
mov    %al,(%rcx,%rbp,1)
add    $0x1,%rbp
cmp    %rbp,%r15
jne    1390 <crypto_aead_encrypt+0x240>
mov    %r15,%r14
lea    0x30(%rsp),%r15
lea    0x4(%rsp),%rbp
mov    %rsp,%rbx
mov    %r15,%rdi
mov    $0x1,%esi
mov    %rbp,%rdx
mov    %rbx,%rcx
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1030 <encrypt_32bits@plt>
mov    %r15,%rdi
xor    %esi,%esi
mov    %rbp,%rdx
mov    %rbx,%rcx
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1030 <encrypt_32bits@plt>
mov    %r15,%rdi
xor    %esi,%esi
mov    %rbp,%rdx
mov    %rbx,%rcx
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1030 <encrypt_32bits@plt>
mov    %r15,%rdi
xor    %esi,%esi
mov    %rbp,%rdx
mov    %rbx,%rcx
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1030 <encrypt_32bits@plt>
mov    %r15,%rdi
xor    %esi,%esi
mov    %rbp,%rdx
mov    %rbx,%rcx
xor    %r8d,%r8d
xor    %r9d,%r9d
call   1030 <encrypt_32bits@plt>
mov    %r15,%rdi
xor    %esi,%esi
mov    %rbp,%rdx
mov    %rbx,%rcx
xor    %r8d,%r8d
xor    %r9d,%r9d
call   1030 <encrypt_32bits@plt>
mov    %r15,%rdi
xor    %esi,%esi
mov    %rbp,%rdx
mov    %rbx,%rcx
xor    %r8d,%r8d
xor    %r9d,%r9d
call   1030 <encrypt_32bits@plt>
mov    %r15,%rdi
xor    %esi,%esi
mov    %rbp,%rdx
mov    %rbx,%rcx
xor    %r8d,%r8d
xor    %r9d,%r9d
call   1030 <encrypt_32bits@plt>
lea    0x70(%rsp),%rbx
mov    %r14,%rdi
mov    0x8(%rsp),%rsi
mov    $0x10,%edx
mov    %rbx,%rcx
mov    %r15,%r8
call   1040 <acorn128_tag_generation_32bits_version@plt>
lea    0x10(%r14),%rax
mov    0x20(%rsp),%rcx
mov    %rax,(%rcx)
mov    0x10(%rsp),%rdi
add    %r14,%rdi
mov    %rbx,%rsi
mov    $0x10,%edx
call   1060 <memcpy@plt>
xor    %eax,%eax
add    $0x88,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
define i32 @crypto_aead_encrypt(i8* %0, i64* %1, i8* %2, i64 %3, i8* %4, i64 %5, i8* %6, i8* %7, i8* %8) {
%10 = alloca i8*
%11 = alloca i64*
%12 = alloca i8*
%13 = alloca i64
%14 = alloca i8*
%15 = alloca i64
%16 = alloca i8*
%17 = alloca i8*
%18 = alloca i8*
%19 = alloca i64
%20 = alloca [16 x i8]
%21 = alloca i32
%22 = alloca i32
%23 = alloca i32
%24 = alloca [7 x i64]
%25 = alloca i32
%26 = alloca i32
store i8* %0, i8** %10
store i64* %1, i64** %11
store i8* %2, i8** %12
store i64 %3, i64* %13
store i8* %4, i8** %14
store i64 %5, i64* %15
store i8* %6, i8** %16
store i8* %7, i8** %17
store i8* %8, i8** %18
%27 = load i8*, i8** %18
%28 = load i8*, i8** %17
%29 = getelementptr inbounds [7 x i64], [7 x i64]* %24, i64 0, i64 0
%30 = call i32 @acorn128_initialization_32bitversion(i8* %27, i8* %28, i64* %29)
store i32 -1, i32* %25
store i32 -1, i32* %26
store i64 0, i64* %19
br label %31
31: ; preds = %46, %9
%32 = load i64, i64* %19
%33 = load i64, i64* %15
%34 = udiv i64 %33, 4
%35 = icmp ult i64 %32, %34
br i1 %35, label %36, label %49
36: ; preds = %31
%37 = getelementptr inbounds [7 x i64], [7 x i64]* %24, i64 0, i64 0
%38 = load i8*, i8** %14
%39 = bitcast i8* %38 to i32*
%40 = load i64, i64* %19
%41 = getelementptr inbounds i32, i32* %39, i64 %40
%42 = load i32, i32* %41
%43 = load i32, i32* %25
%44 = load i32, i32* %26
%45 = call i32 @encrypt_32bits(i64* %37, i32 %42, i32* %22, i32* %23, i32 %43, i32 %44)
br label %46
46: ; preds = %36
%47 = load i64, i64* %19
%48 = add i64 %47, 1
store i64 %48, i64* %19
br label %31
49: ; preds = %31
%50 = load i64, i64* %15
%51 = and i64 %50, -4
store i64 %51, i64* %19
br label %52
52: ; preds = %67, %49
%53 = load i64, i64* %19
%54 = load i64, i64* %15
%55 = icmp ult i64 %53, %54
br i1 %55, label %56, label %70
56: ; preds = %52
store i32 255, i32* %25
store i32 255, i32* %26
%57 = load i8*, i8** %14
%58 = load i64, i64* %19
%59 = getelementptr inbounds i8, i8* %57, i64 %58
%60 = load i8, i8* %59
%61 = zext i8 %60 to i32
store i32 %61, i32* %21
%62 = getelementptr inbounds [7 x i64], [7 x i64]* %24, i64 0, i64 0
%63 = load i32, i32* %21
%64 = load i32, i32* %25
%65 = load i32, i32* %26
%66 = call i32 @encrypt_8bits(i64* %62, i32 %63, i32* %22, i32* %23, i32 %64, i32 %65)
br label %67
67: ; preds = %56
%68 = load i64, i64* %19
%69 = add i64 %68, 1
store i64 %69, i64* %19
br label %52
70: ; preds = %52
store i64 0, i64* %19
br label %71
71: ; preds = %90, %70
%72 = load i64, i64* %19
%73 = icmp ult i64 %72, 8
br i1 %73, label %74, label %93
74: ; preds = %71
%75 = load i64, i64* %19
%76 = icmp eq i64 %75, 0
br i1 %76, label %77, label %78
77: ; preds = %74
store i32 1, i32* %21
br label %79
78: ; preds = %74
store i32 0, i32* %21
br label %79
79: ; preds = %78, %77
%80 = load i64, i64* %19
%81 = icmp ult i64 %80, 4
br i1 %81, label %82, label %83
82: ; preds = %79
store i32 -1, i32* %25
br label %84
83: ; preds = %79
store i32 0, i32* %25
br label %84
84: ; preds = %83, %82
store i32 -1, i32* %26
%85 = getelementptr inbounds [7 x i64], [7 x i64]* %24, i64 0, i64 0
%86 = load i32, i32* %21
%87 = load i32, i32* %25
%88 = load i32, i32* %26
%89 = call i32 @encrypt_32bits(i64* %85, i32 %86, i32* %22, i32* %23, i32 %87, i32 %88)
br label %90
90: ; preds = %84
%91 = load i64, i64* %19
%92 = add i64 %91, 1
store i64 %92, i64* %19
br label %71
93: ; preds = %71
store i32 -1, i32* %25
store i32 0, i32* %26
store i64 0, i64* %19
br label %94
94: ; preds = %113, %93
%95 = load i64, i64* %19
%96 = load i64, i64* %13
%97 = udiv i64 %96, 4
%98 = icmp ult i64 %95, %97
br i1 %98, label %99, label %116
99: ; preds = %94
%100 = getelementptr inbounds [7 x i64], [7 x i64]* %24, i64 0, i64 0
%101 = load i8*, i8** %12
%102 = bitcast i8* %101 to i32*
%103 = load i64, i64* %19
%104 = getelementptr inbounds i32, i32* %102, i64 %103
%105 = load i32, i32* %104
%106 = load i8*, i8** %10
%107 = bitcast i8* %106 to i32*
%108 = load i64, i64* %19
%109 = getelementptr inbounds i32, i32* %107, i64 %108
%110 = load i32, i32* %25
%111 = load i32, i32* %26
%112 = call i32 @encrypt_32bits(i64* %100, i32 %105, i32* %109, i32* %23, i32 %110, i32 %111)
br label %113
113: ; preds = %99
%114 = load i64, i64* %19
%115 = add i64 %114, 1
store i64 %115, i64* %19
br label %94
116: ; preds = %94
%117 = load i64, i64* %13
%118 = and i64 %117, -4
store i64 %118, i64* %19
br label %119
119: ; preds = %139, %116
%120 = load i64, i64* %19
%121 = load i64, i64* %13
%122 = icmp ult i64 %120, %121
br i1 %122, label %123, label %142
123: ; preds = %119
store i32 255, i32* %25
store i32 0, i32* %26
%124 = load i8*, i8** %12
%125 = load i64, i64* %19
%126 = getelementptr inbounds i8, i8* %124, i64 %125
%127 = load i8, i8* %126
%128 = zext i8 %127 to i32
store i32 %128, i32* %21
%129 = getelementptr inbounds [7 x i64], [7 x i64]* %24, i64 0, i64 0
%130 = load i32, i32* %21
%131 = load i32, i32* %25
%132 = load i32, i32* %26
%133 = call i32 @encrypt_8bits(i64* %129, i32 %130, i32* %22, i32* %23, i32 %131, i32 %132)
%134 = load i32, i32* %22
%135 = trunc i32 %134 to i8
%136 = load i8*, i8** %10
%137 = load i64, i64* %19
%138 = getelementptr inbounds i8, i8* %136, i64 %137
store i8 %135, i8* %138
br label %139
139: ; preds = %123
%140 = load i64, i64* %19
%141 = add i64 %140, 1
store i64 %141, i64* %19
br label %119
142: ; preds = %119
store i64 0, i64* %19
br label %143
143: ; preds = %162, %142
%144 = load i64, i64* %19
%145 = icmp ult i64 %144, 8
br i1 %145, label %146, label %165
146: ; preds = %143
%147 = load i64, i64* %19
%148 = icmp eq i64 %147, 0
br i1 %148, label %149, label %150
149: ; preds = %146
store i32 1, i32* %21
br label %151
150: ; preds = %146
store i32 0, i32* %21
br label %151
151: ; preds = %150, %149
%152 = load i64, i64* %19
%153 = icmp ult i64 %152, 4
br i1 %153, label %154, label %155
154: ; preds = %151
store i32 -1, i32* %25
br label %156
155: ; preds = %151
store i32 0, i32* %25
br label %156
156: ; preds = %155, %154
store i32 0, i32* %26
%157 = getelementptr inbounds [7 x i64], [7 x i64]* %24, i64 0, i64 0
%158 = load i32, i32* %21
%159 = load i32, i32* %25
%160 = load i32, i32* %26
%161 = call i32 @encrypt_32bits(i64* %157, i32 %158, i32* %22, i32* %23, i32 %159, i32 %160)
br label %162
162: ; preds = %156
%163 = load i64, i64* %19
%164 = add i64 %163, 1
store i64 %164, i64* %19
br label %143
165: ; preds = %143
%166 = load i64, i64* %13
%167 = load i64, i64* %15
%168 = getelementptr inbounds [16 x i8], [16 x i8]* %20, i64 0, i64 0
%169 = getelementptr inbounds [7 x i64], [7 x i64]* %24, i64 0, i64 0
%170 = call i32 @acorn128_tag_generation_32bits_version(i64 %166, i64 %167, i32 16, i8* %168, i64* %169)
%171 = load i64, i64* %13
%172 = add i64 %171, 16
%173 = load i64*, i64** %11
store i64 %172, i64* %173
%174 = load i8*, i8** %10
%175 = load i64, i64* %13
%176 = getelementptr inbounds i8, i8* %174, i64 %175
%177 = getelementptr inbounds [16 x i8], [16 x i8]* %20, i64 0, i64 0
%178 = call i32 @memcpy(i8* %176, i8* %177, i32 16)
ret i32 0
}

LLVM IR (-O2):
define i32 @crypto_aead_encrypt(i8* %0, i64* nocapture writeonly %1, i8* nocapture %2, i64 %3, i8* nocapture %4, i64 %5, i8* nocapture readnone %6, i8* %7, i8* %8) {
%10 = alloca [16 x i8]
%11 = alloca i32
%12 = alloca i32
%13 = alloca [7 x i64]
%14 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 0
%15 = bitcast i32* %11 to i8*
%16 = bitcast i32* %12 to i8*
%17 = bitcast [7 x i64]* %13 to i8*
%18 = getelementptr inbounds [7 x i64], [7 x i64]* %13, i64 0, i64 0
%19 = call i32 @acorn128_initialization_32bitversion(i8* %8, i8* %7, i64* %18)
%20 = icmp ult i64 %5, 4
br i1 %20, label %31, label %21
21: ; preds = %9
%22 = lshr i64 %5, 2
%23 = bitcast i8* %4 to i32*
br label %24
24: ; preds = %21, %24
%25 = phi i64 [ 0, %21 ], [ %29, %24 ]
%26 = getelementptr inbounds i32, i32* %23, i64 %25
%27 = load i32, i32* %26
%28 = call i32 @encrypt_32bits(i64* %18, i32 %27, i32* %11, i32* %12, i32 -1, i32 -1)
%29 = add nuw nsw i64 %25, 1
%30 = icmp eq i64 %29, %22
br i1 %30, label %31, label %24
31: ; preds = %24, %9
%32 = and i64 %5, -4
%33 = icmp ult i64 %32, %5
br i1 %33, label %44, label %34
34: ; preds = %44, %31
%35 = call i32 @encrypt_32bits(i64* %18, i32 1, i32* %11, i32* %12, i32 -1, i32 -1)
%36 = call i32 @encrypt_32bits(i64* %18, i32 0, i32* %11, i32* %12, i32 -1, i32 -1)
%37 = call i32 @encrypt_32bits(i64* %18, i32 0, i32* %11, i32* %12, i32 -1, i32 -1)
%38 = call i32 @encrypt_32bits(i64* %18, i32 0, i32* %11, i32* %12, i32 -1, i32 -1)
%39 = call i32 @encrypt_32bits(i64* %18, i32 0, i32* %11, i32* %12, i32 0, i32 -1)
%40 = call i32 @encrypt_32bits(i64* %18, i32 0, i32* %11, i32* %12, i32 0, i32 -1)
%41 = call i32 @encrypt_32bits(i64* %18, i32 0, i32* %11, i32* %12, i32 0, i32 -1)
%42 = call i32 @encrypt_32bits(i64* %18, i32 0, i32* %11, i32* %12, i32 0, i32 -1)
%43 = icmp ult i64 %3, 4
br i1 %43, label %64, label %52
44: ; preds = %31, %44
%45 = phi i64 [ %50, %44 ], [ %32, %31 ]
%46 = getelementptr inbounds i8, i8* %4, i64 %45
%47 = load i8, i8* %46
%48 = zext i8 %47 to i32
%49 = call i32 @encrypt_8bits(i64* %18, i32 %48, i32* %11, i32* %12, i32 255, i32 255)
%50 = add i64 %45, 1
%51 = icmp eq i64 %50, %5
br i1 %51, label %34, label %44
52: ; preds = %34
%53 = lshr i64 %3, 2
%54 = bitcast i8* %2 to i32*
%55 = bitcast i8* %0 to i32*
br label %56
56: ; preds = %52, %56
%57 = phi i64 [ 0, %52 ], [ %62, %56 ]
%58 = getelementptr inbounds i32, i32* %54, i64 %57
%59 = load i32, i32* %58
%60 = getelementptr inbounds i32, i32* %55, i64 %57
%61 = call i32 @encrypt_32bits(i64* %18, i32 %59, i32* %60, i32* %12, i32 -1, i32 0)
%62 = add nuw nsw i64 %57, 1
%63 = icmp eq i64 %62, %53
br i1 %63, label %64, label %56
64: ; preds = %56, %34
%65 = and i64 %3, -4
%66 = icmp ult i64 %65, %3
br i1 %66, label %80, label %67
67: ; preds = %80, %64
%68 = call i32 @encrypt_32bits(i64* %18, i32 1, i32* %11, i32* %12, i32 -1, i32 0)
%69 = call i32 @encrypt_32bits(i64* %18, i32 0, i32* %11, i32* %12, i32 -1, i32 0)
%70 = call i32 @encrypt_32bits(i64* %18, i32 0, i32* %11, i32* %12, i32 -1, i32 0)
%71 = call i32 @encrypt_32bits(i64* %18, i32 0, i32* %11, i32* %12, i32 -1, i32 0)
%72 = call i32 @encrypt_32bits(i64* %18, i32 0, i32* %11, i32* %12, i32 0, i32 0)
%73 = call i32 @encrypt_32bits(i64* %18, i32 0, i32* %11, i32* %12, i32 0, i32 0)
%74 = call i32 @encrypt_32bits(i64* %18, i32 0, i32* %11, i32* %12, i32 0, i32 0)
%75 = call i32 @encrypt_32bits(i64* %18, i32 0, i32* %11, i32* %12, i32 0, i32 0)
%76 = call i32 @acorn128_tag_generation_32bits_version(i64 %3, i64 %5, i32 16, i8* %14, i64* %18)
%77 = add i64 %3, 16
store i64 %77, i64* %1
%78 = getelementptr inbounds i8, i8* %0, i64 %3
%79 = call i32 @memcpy(i8* %78, i8* %14, i32 16)
ret i32 0
80: ; preds = %64, %80
%81 = phi i64 [ %89, %80 ], [ %65, %64 ]
%82 = getelementptr inbounds i8, i8* %2, i64 %81
%83 = load i8, i8* %82
%84 = zext i8 %83 to i32
%85 = call i32 @encrypt_8bits(i64* %18, i32 %84, i32* %11, i32* %12, i32 255, i32 0)
%86 = load i32, i32* %11
%87 = trunc i32 %86 to i8
%88 = getelementptr inbounds i8, i8* %0, i64 %81
store i8 %87, i8* %88
%89 = add i64 %81, 1
%90 = icmp eq i64 %89, %3
br i1 %90, label %67, label %80
}