#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ ERR_R_MALLOC_FAILURE;
int /*<<< orphan*/ EVP_Digest(void *, int, unsigned char *,
                              int /*<<< orphan*/ *, int /*<<< orphan*/,
                              int /*<<< orphan*/ *);
int /*<<< orphan*/ EVP_sha1();
scalar_t__ MGF1(unsigned char *, int, unsigned char *, int);
scalar_t__ RAND_bytes(unsigned char *, int);
int /*<<< orphan*/ RSA_F_RSA_PADDING_ADD_PKCS1_OAEP;
int /*<<< orphan*/ RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE;
int /*<<< orphan*/ RSA_R_KEY_SIZE_TOO_SMALL;
int /*<<< orphan*/ RSAerr(int /*<<< orphan*/, int /*<<< orphan*/);
int SHA_DIGEST_LENGTH;
int /*<<< orphan*/ free(unsigned char *);
unsigned char *malloc(int);
int /*<<< orphan*/ memcpy(unsigned char *, unsigned char const *, int);
int /*<<< orphan*/ memset(unsigned char *, int /*<<< orphan*/, int);
int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen,
                               const unsigned char *from, int flen,
                               const unsigned char *param, int plen) {
  int i, emlen = tlen - 1;
  unsigned char *db, *seed;
  unsigned char *dbmask, seedmask[SHA_DIGEST_LENGTH];
  if (flen > emlen - 2 * SHA_DIGEST_LENGTH - 1) {
    RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
    return 0;
  }
  if (emlen < 2 * SHA_DIGEST_LENGTH + 1) {
    RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, RSA_R_KEY_SIZE_TOO_SMALL);
    return 0;
  }
  to[0] = 0;
  seed = to + 1;
  db = to + SHA_DIGEST_LENGTH + 1;
  if (!EVP_Digest((void *)param, plen, db, NULL, EVP_sha1(), NULL))
    return 0;
  memset(db + SHA_DIGEST_LENGTH, 0, emlen - flen - 2 * SHA_DIGEST_LENGTH - 1);
  db[emlen - flen - SHA_DIGEST_LENGTH - 1] = 0x01;
  memcpy(db + emlen - flen - SHA_DIGEST_LENGTH, from, flen);
  if (RAND_bytes(seed, SHA_DIGEST_LENGTH) <= 0)
    return 0;
  dbmask = malloc(emlen - SHA_DIGEST_LENGTH);
  if (dbmask == NULL) {
    RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, ERR_R_MALLOC_FAILURE);
    return 0;
  }
  if (MGF1(dbmask, emlen - SHA_DIGEST_LENGTH, seed, SHA_DIGEST_LENGTH) < 0)
    return 0;
  for (i = 0; i < emlen - SHA_DIGEST_LENGTH; i++)
    db[i] ^= dbmask[i];
  if (MGF1(seedmask, SHA_DIGEST_LENGTH, db, emlen - SHA_DIGEST_LENGTH) < 0)
    return 0;
  for (i = 0; i < SHA_DIGEST_LENGTH; i++)
    seed[i] ^= seedmask[i];
  free(dbmask);
  return 1;
}


x86 assembly (clang, -O0):
<RSA_padding_add_PKCS1_OAEP>:
push   %rbp
mov    %rsp,%rbp
sub    $0x90,%rsp
mov    %rdi,-0x10(%rbp)
mov    %esi,-0x14(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %ecx,-0x24(%rbp)
mov    %r8,-0x30(%rbp)
mov    %r9d,-0x34(%rbp)
mov    -0x14(%rbp),%eax
add    $0xffffffff,%eax
mov    %eax,-0x3c(%rbp)
mov    0x2e1f(%rip),%rax
mov    (%rax),%eax
mov    %rsp,%rcx
mov    %rcx,-0x60(%rbp)
mov    %rax,%rdx
add    $0xf,%rdx
and    $0xfffffffffffffff0,%rdx
mov    %rsp,%rcx
sub    %rdx,%rcx
mov    %rcx,-0x78(%rbp)
mov    %rcx,%rsp
mov    %rax,-0x68(%rbp)
mov    -0x24(%rbp),%eax
mov    -0x3c(%rbp),%ecx
mov    0x2ded(%rip),%rdx
mov    (%rdx),%edx
shl    $0x1,%edx
sub    %edx,%ecx
sub    $0x1,%ecx
cmp    %ecx,%eax
jle    122f <RSA_padding_add_PKCS1_OAEP+0x9f>
mov    0x2ddc(%rip),%rax
mov    (%rax),%edi
mov    0x2dc3(%rip),%rax
mov    (%rax),%esi
call   10b0 <RSAerr@plt>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
jmp    151b <RSA_padding_add_PKCS1_OAEP+0x38b>
mov    -0x3c(%rbp),%eax
mov    0x2da7(%rip),%rcx
mov    (%rcx),%ecx
shl    $0x1,%ecx
add    $0x1,%ecx
cmp    %ecx,%eax
jge    1273 <RSA_padding_add_PKCS1_OAEP+0xe3>
mov    0x2d98(%rip),%rax
mov    (%rax),%edi
mov    0x2d5f(%rip),%rax
mov    (%rax),%esi
call   10b0 <RSAerr@plt>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
jmp    151b <RSA_padding_add_PKCS1_OAEP+0x38b>
mov    -0x10(%rbp),%rax
movb   $0x0,(%rax)
mov    -0x10(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x50(%rbp)
mov    -0x10(%rbp),%rax
mov    0x2d4f(%rip),%rcx
movslq (%rcx),%rcx
add    %rcx,%rax
add    $0x1,%rax
mov    %rax,-0x48(%rbp)
mov    -0x30(%rbp),%rax
mov    %rax,-0x90(%rbp)
mov    -0x34(%rbp),%eax
mov    %eax,-0x84(%rbp)
mov    -0x48(%rbp),%rax
mov    %rax,-0x80(%rbp)
mov    $0x0,%al
call   1040 <EVP_sha1@plt>
mov    -0x90(%rbp),%rdi
mov    -0x84(%rbp),%esi
mov    -0x80(%rbp),%rdx
mov    %eax,%r8d
xor    %eax,%eax
mov    %eax,%r9d
mov    %r9,%rcx
call   1090 <EVP_Digest@plt>
cmp    $0x0,%eax
jne    12ff <RSA_padding_add_PKCS1_OAEP+0x16f>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
jmp    151b <RSA_padding_add_PKCS1_OAEP+0x38b>
mov    -0x48(%rbp),%rdi
mov    0x2cd6(%rip),%rax
movslq (%rax),%rax
add    %rax,%rdi
mov    -0x3c(%rbp),%edx
sub    -0x24(%rbp),%edx
mov    0x2cc3(%rip),%rax
mov    (%rax),%eax
shl    $0x1,%eax
sub    %eax,%edx
sub    $0x1,%edx
xor    %esi,%esi
call   1060 <memset@plt>
mov    -0x48(%rbp),%rax
mov    -0x3c(%rbp),%ecx
sub    -0x24(%rbp),%ecx
mov    0x2ca1(%rip),%rdx
sub    (%rdx),%ecx
sub    $0x1,%ecx
movslq %ecx,%rcx
movb   $0x1,(%rax,%rcx,1)
mov    -0x48(%rbp),%rdi
movslq -0x3c(%rbp),%rax
add    %rax,%rdi
movslq -0x24(%rbp),%rcx
xor    %eax,%eax
sub    %rcx,%rax
add    %rax,%rdi
mov    0x2c77(%rip),%rax
movslq (%rax),%rcx
xor    %eax,%eax
sub    %rcx,%rax
add    %rax,%rdi
mov    -0x20(%rbp),%rsi
mov    -0x24(%rbp),%edx
call   1070 <memcpy@plt>
mov    -0x50(%rbp),%rdi
mov    0x2c55(%rip),%rax
mov    (%rax),%esi
call   1050 <RAND_bytes@plt>
cmp    $0x0,%rax
jg     13af <RSA_padding_add_PKCS1_OAEP+0x21f>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
jmp    151b <RSA_padding_add_PKCS1_OAEP+0x38b>
mov    -0x3c(%rbp),%edi
mov    0x2c27(%rip),%rax
sub    (%rax),%edi
call   1080 <malloc@plt>
mov    %rax,-0x58(%rbp)
cmpq   $0x0,-0x58(%rbp)
jne    13f9 <RSA_padding_add_PKCS1_OAEP+0x269>
mov    0x2c12(%rip),%rax
mov    (%rax),%edi
mov    0x2bf1(%rip),%rax
mov    (%rax),%esi
call   10b0 <RSAerr@plt>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
jmp    151b <RSA_padding_add_PKCS1_OAEP+0x38b>
mov    -0x58(%rbp),%rdi
mov    -0x3c(%rbp),%esi
mov    0x2bd9(%rip),%rax
sub    (%rax),%esi
mov    -0x50(%rbp),%rdx
mov    0x2bcc(%rip),%rax
mov    (%rax),%ecx
call   10a0 <MGF1@plt>
cmp    $0x0,%rax
jge    1438 <RSA_padding_add_PKCS1_OAEP+0x2a8>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
jmp    151b <RSA_padding_add_PKCS1_OAEP+0x38b>
movl   $0x0,-0x38(%rbp)
mov    -0x38(%rbp),%eax
mov    -0x3c(%rbp),%ecx
mov    0x2b94(%rip),%rdx
sub    (%rdx),%ecx
cmp    %ecx,%eax
jge    1481 <RSA_padding_add_PKCS1_OAEP+0x2f1>
mov    -0x58(%rbp),%rax
movslq -0x38(%rbp),%rcx
movzbl (%rax,%rcx,1),%esi
mov    -0x48(%rbp),%rax
movslq -0x38(%rbp),%rcx
movzbl (%rax,%rcx,1),%edx
xor    %esi,%edx
mov    %dl,(%rax,%rcx,1)
mov    -0x38(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x38(%rbp)
jmp    143f <RSA_padding_add_PKCS1_OAEP+0x2af>
mov    -0x78(%rbp),%rdi
mov    0x2b54(%rip),%rax
mov    (%rax),%esi
mov    -0x48(%rbp),%rdx
mov    -0x3c(%rbp),%ecx
mov    0x2b44(%rip),%rax
sub    (%rax),%ecx
call   10a0 <MGF1@plt>
cmp    $0x0,%rax
jge    14c0 <RSA_padding_add_PKCS1_OAEP+0x330>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
jmp    151b <RSA_padding_add_PKCS1_OAEP+0x38b>
movl   $0x0,-0x38(%rbp)
mov    -0x38(%rbp),%eax
mov    0x2b0f(%rip),%rcx
cmp    (%rcx),%eax
jge    1504 <RSA_padding_add_PKCS1_OAEP+0x374>
mov    -0x78(%rbp),%rax
movslq -0x38(%rbp),%rcx
movzbl (%rax,%rcx,1),%esi
mov    -0x50(%rbp),%rax
movslq -0x38(%rbp),%rcx
movzbl (%rax,%rcx,1),%edx
xor    %esi,%edx
mov    %dl,(%rax,%rcx,1)
mov    -0x38(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x38(%rbp)
jmp    14c7 <RSA_padding_add_PKCS1_OAEP+0x337>
mov    -0x58(%rbp),%rdi
call   1030 <free@plt>
movl   $0x1,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
mov    -0x60(%rbp),%rax
mov    %rax,%rsp
mov    -0x4(%rbp),%eax
mov    %rbp,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<RSA_padding_add_PKCS1_OAEP>:
push   %rbp
mov    %rsp,%rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    %ecx,%r13d
mov    %esi,%r15d
mov    0x2e32(%rip),%rsi
mov    (%rsi),%eax
mov    %rsp,%rbx
mov    %rax,%rcx
add    $0xf,%rcx
and    $0xfffffffffffffff0,%rcx
sub    %rcx,%rbx
mov    %rbx,%rsp
add    %eax,%eax
mov    %eax,%ecx
not    %ecx
add    %r15d,%ecx
add    $0xffffffff,%ecx
cmp    %r13d,%ecx
jge    11ea <RSA_padding_add_PKCS1_OAEP+0x5a>
mov    0x2e0c(%rip),%rax
mov    (%rax),%edi
mov    0x2df3(%rip),%rax
jmp    1393 <RSA_padding_add_PKCS1_OAEP+0x203>
or     $0x1,%eax
cmp    %r15d,%eax
jge    1383 <RSA_padding_add_PKCS1_OAEP+0x1f3>
mov    %r8,%r12
mov    %rdx,-0x40(%rbp)
movb   $0x0,(%rdi)
movslq (%rsi),%rax
lea    (%rdi,%rax,1),%r14
add    $0x1,%r14
xor    %eax,%eax
mov    %rdi,-0x38(%rbp)
mov    %r9d,-0x30(%rbp)
call   1040 <EVP_sha1@plt>
mov    %r12,%rdi
xor    %r12d,%r12d
mov    -0x30(%rbp),%esi
mov    %r14,-0x30(%rbp)
mov    %r14,%rdx
xor    %ecx,%ecx
mov    %eax,%r8d
xor    %r9d,%r9d
call   1090 <EVP_Digest@plt>
test   %eax,%eax
je     139d <RSA_padding_add_PKCS1_OAEP+0x20d>
add    $0xffffffff,%r15d
addq   $0x1,-0x38(%rbp)
mov    0x2d91(%rip),%rax
movslq (%rax),%rdi
lea    (%rdi,%rdi,1),%edx
add    -0x30(%rbp),%rdi
mov    %r15d,%r14d
sub    %r13d,%r14d
not    %edx
add    %r14d,%edx
xor    %r12d,%r12d
xor    %esi,%esi
call   1060 <memset@plt>
mov    0x2d6b(%rip),%rcx
mov    (%rcx),%eax
not    %eax
add    %r14d,%eax
cltq
mov    -0x30(%rbp),%rdx
movb   $0x1,(%rdx,%rax,1)
movslq %r15d,%rdi
add    %rdx,%rdi
movslq %r13d,%rax
sub    %rax,%rdi
movslq (%rcx),%rax
mov    %rcx,%r14
sub    %rax,%rdi
mov    -0x40(%rbp),%rsi
mov    %r13d,%edx
call   1070 <memcpy@plt>
mov    (%r14),%esi
mov    -0x38(%rbp),%rdi
call   1050 <RAND_bytes@plt>
test   %rax,%rax
jle    139d <RSA_padding_add_PKCS1_OAEP+0x20d>
mov    0x2d1d(%rip),%rax
mov    (%rax),%r14d
mov    %r15d,%r12d
sub    %r14d,%r12d
mov    %r12d,%edi
call   1080 <malloc@plt>
test   %rax,%rax
je     13af <RSA_padding_add_PKCS1_OAEP+0x21f>
mov    %rax,%r13
mov    %rax,%rdi
mov    %r12d,%esi
mov    -0x38(%rbp),%rdx
mov    %r14d,%ecx
call   10a0 <MGF1@plt>
test   %rax,%rax
js     139a <RSA_padding_add_PKCS1_OAEP+0x20a>
mov    0x2cde(%rip),%r8
mov    (%r8),%esi
mov    %r15d,%ecx
sub    %esi,%ecx
mov    $0x0,%r12d
mov    -0x30(%rbp),%rdi
jle    133d <RSA_padding_add_PKCS1_OAEP+0x1ad>
xor    %eax,%eax
nopl   0x0(%rax,%rax,1)
movzbl 0x0(%r13,%rax,1),%ecx
xor    %cl,(%rdi,%rax,1)
add    $0x1,%rax
mov    (%r8),%esi
mov    %r15d,%ecx
sub    %esi,%ecx
movslq %ecx,%rdx
cmp    %rdx,%rax
jl     1320 <RSA_padding_add_PKCS1_OAEP+0x190>
mov    %rdi,%rdx
mov    %rbx,%rdi
mov    %r8,%r14
call   10a0 <MGF1@plt>
test   %rax,%rax
mov    -0x38(%rbp),%rdx
js     139d <RSA_padding_add_PKCS1_OAEP+0x20d>
cmpl   $0x0,(%r14)
jle    1373 <RSA_padding_add_PKCS1_OAEP+0x1e3>
mov    %r14,%rsi
xor    %eax,%eax
nop
movzbl (%rbx,%rax,1),%ecx
xor    %cl,(%rdx,%rax,1)
add    $0x1,%rax
movslq (%rsi),%rcx
cmp    %rcx,%rax
jl     1360 <RSA_padding_add_PKCS1_OAEP+0x1d0>
mov    %r13,%rdi
call   1030 <free@plt>
mov    $0x1,%r12d
jmp    139d <RSA_padding_add_PKCS1_OAEP+0x20d>
mov    0x2c5e(%rip),%rax
mov    (%rax),%edi
mov    0x2c25(%rip),%rax
mov    (%rax),%esi
call   10b0 <RSAerr@plt>
xor    %r12d,%r12d
mov    %r12d,%eax
lea    -0x28(%rbp),%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
mov    0x2c32(%rip),%rax
mov    (%rax),%edi
mov    0x2c11(%rip),%rax
jmp    1393 <RSA_padding_add_PKCS1_OAEP+0x203>

LLVM IR (-O0):
@SHA_DIGEST_LENGTH = global i32 0
@RSA_F_RSA_PADDING_ADD_PKCS1_OAEP = global i32 0
@RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE = global i32 0
@RSA_R_KEY_SIZE_TOO_SMALL = global i32 0
@ERR_R_MALLOC_FAILURE = global i32 0
define i32 @RSA_padding_add_PKCS1_OAEP(i8* %0, i32 %1, i8* %2, i32 %3, i8* %4, i32 %5) {
%7 = alloca i32
%8 = alloca i8*
%9 = alloca i32
%10 = alloca i8*
%11 = alloca i32
%12 = alloca i8*
%13 = alloca i32
%14 = alloca i32
%15 = alloca i32
%16 = alloca i8*
%17 = alloca i8*
%18 = alloca i8*
%19 = alloca i8*
%20 = alloca i64
%21 = alloca i32
store i8* %0, i8** %8
store i32 %1, i32* %9
store i8* %2, i8** %10
store i32 %3, i32* %11
store i8* %4, i8** %12
store i32 %5, i32* %13
%22 = load i32, i32* %9
%23 = sub nsw i32 %22, 1
store i32 %23, i32* %15
%24 = load i32, i32* @SHA_DIGEST_LENGTH
%25 = zext i32 %24 to i64
%26 = call i8* @llvm.stacksave()
store i8* %26, i8** %19
%27 = alloca i8, i64 %25
store i64 %25, i64* %20
%28 = load i32, i32* %11
%29 = load i32, i32* %15
%30 = load i32, i32* @SHA_DIGEST_LENGTH
%31 = mul nsw i32 2, %30
%32 = sub nsw i32 %29, %31
%33 = sub nsw i32 %32, 1
%34 = icmp sgt i32 %28, %33
br i1 %34, label %35, label %39
35: ; preds = %6
%36 = load i32, i32* @RSA_F_RSA_PADDING_ADD_PKCS1_OAEP
%37 = load i32, i32* @RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE
%38 = call i32 @RSAerr(i32 %36, i32 %37)
store i32 0, i32* %7
store i32 1, i32* %21
br label %188
39: ; preds = %6
%40 = load i32, i32* %15
%41 = load i32, i32* @SHA_DIGEST_LENGTH
%42 = mul nsw i32 2, %41
%43 = add nsw i32 %42, 1
%44 = icmp slt i32 %40, %43
br i1 %44, label %45, label %49
45: ; preds = %39
%46 = load i32, i32* @RSA_F_RSA_PADDING_ADD_PKCS1_OAEP
%47 = load i32, i32* @RSA_R_KEY_SIZE_TOO_SMALL
%48 = call i32 @RSAerr(i32 %46, i32 %47)
store i32 0, i32* %7
store i32 1, i32* %21
br label %188
49: ; preds = %39
%50 = load i8*, i8** %8
%51 = getelementptr inbounds i8, i8* %50, i64 0
store i8 0, i8* %51
%52 = load i8*, i8** %8
%53 = getelementptr inbounds i8, i8* %52, i64 1
store i8* %53, i8** %17
%54 = load i8*, i8** %8
%55 = load i32, i32* @SHA_DIGEST_LENGTH
%56 = sext i32 %55 to i64
%57 = getelementptr inbounds i8, i8* %54, i64 %56
%58 = getelementptr inbounds i8, i8* %57, i64 1
store i8* %58, i8** %16
%59 = load i8*, i8** %12
%60 = load i32, i32* %13
%61 = load i8*, i8** %16
%62 = call i32 (...) @EVP_sha1()
%63 = call i32 @EVP_Digest(i8* %59, i32 %60, i8* %61, i32* null, i32 %62, i32* null)
%64 = icmp ne i32 %63, 0
br i1 %64, label %66, label %65
65: ; preds = %49
store i32 0, i32* %7
store i32 1, i32* %21
br label %188
66: ; preds = %49
%67 = load i8*, i8** %16
%68 = load i32, i32* @SHA_DIGEST_LENGTH
%69 = sext i32 %68 to i64
%70 = getelementptr inbounds i8, i8* %67, i64 %69
%71 = load i32, i32* %15
%72 = load i32, i32* %11
%73 = sub nsw i32 %71, %72
%74 = load i32, i32* @SHA_DIGEST_LENGTH
%75 = mul nsw i32 2, %74
%76 = sub nsw i32 %73, %75
%77 = sub nsw i32 %76, 1
%78 = call i32 @memset(i8* %70, i32 0, i32 %77)
%79 = load i8*, i8** %16
%80 = load i32, i32* %15
%81 = load i32, i32* %11
%82 = sub nsw i32 %80, %81
%83 = load i32, i32* @SHA_DIGEST_LENGTH
%84 = sub nsw i32 %82, %83
%85 = sub nsw i32 %84, 1
%86 = sext i32 %85 to i64
%87 = getelementptr inbounds i8, i8* %79, i64 %86
store i8 1, i8* %87
%88 = load i8*, i8** %16
%89 = load i32, i32* %15
%90 = sext i32 %89 to i64
%91 = getelementptr inbounds i8, i8* %88, i64 %90
%92 = load i32, i32* %11
%93 = sext i32 %92 to i64
%94 = sub i64 0, %93
%95 = getelementptr inbounds i8, i8* %91, i64 %94
%96 = load i32, i32* @SHA_DIGEST_LENGTH
%97 = sext i32 %96 to i64
%98 = sub i64 0, %97
%99 = getelementptr inbounds i8, i8* %95, i64 %98
%100 = load i8*, i8** %10
%101 = load i32, i32* %11
%102 = call i32 @memcpy(i8* %99, i8* %100, i32 %101)
%103 = load i8*, i8** %17
%104 = load i32, i32* @SHA_DIGEST_LENGTH
%105 = call i64 @RAND_bytes(i8* %103, i32 %104)
%106 = icmp sle i64 %105, 0
br i1 %106, label %107, label %108
107: ; preds = %66
store i32 0, i32* %7
store i32 1, i32* %21
br label %188
108: ; preds = %66
%109 = load i32, i32* %15
%110 = load i32, i32* @SHA_DIGEST_LENGTH
%111 = sub nsw i32 %109, %110
%112 = call i8* @malloc(i32 %111)
store i8* %112, i8** %18
%113 = load i8*, i8** %18
%114 = icmp eq i8* %113, null
br i1 %114, label %115, label %119
115: ; preds = %108
%116 = load i32, i32* @RSA_F_RSA_PADDING_ADD_PKCS1_OAEP
%117 = load i32, i32* @ERR_R_MALLOC_FAILURE
%118 = call i32 @RSAerr(i32 %116, i32 %117)
store i32 0, i32* %7
store i32 1, i32* %21
br label %188
119: ; preds = %108
%120 = load i8*, i8** %18
%121 = load i32, i32* %15
%122 = load i32, i32* @SHA_DIGEST_LENGTH
%123 = sub nsw i32 %121, %122
%124 = load i8*, i8** %17
%125 = load i32, i32* @SHA_DIGEST_LENGTH
%126 = call i64 @MGF1(i8* %120, i32 %123, i8* %124, i32 %125)
%127 = icmp slt i64 %126, 0
br i1 %127, label %128, label %129
128: ; preds = %119
store i32 0, i32* %7
store i32 1, i32* %21
br label %188
129: ; preds = %119
store i32 0, i32* %14
br label %130
130: ; preds = %151, %129
%131 = load i32, i32* %14
%132 = load i32, i32* %15
%133 = load i32, i32* @SHA_DIGEST_LENGTH
%134 = sub nsw i32 %132, %133
%135 = icmp slt i32 %131, %134
br i1 %135, label %136, label %154
136: ; preds = %130
%137 = load i8*, i8** %18
%138 = load i32, i32* %14
%139 = sext i32 %138 to i64
%140 = getelementptr inbounds i8, i8* %137, i64 %139
%141 = load i8, i8* %140
%142 = zext i8 %141 to i32
%143 = load i8*, i8** %16
%144 = load i32, i32* %14
%145 = sext i32 %144 to i64
%146 = getelementptr inbounds i8, i8* %143, i64 %145
%147 = load i8, i8* %146
%148 = zext i8 %147 to i32
%149 = xor i32 %148, %142
%150 = trunc i32 %149 to i8
store i8 %150, i8* %146
br label %151
151: ; preds = %136
%152 = load i32, i32* %14
%153 = add nsw i32 %152, 1
store i32 %153, i32* %14
br label %130
154: ; preds = %130
%155 = load i32, i32* @SHA_DIGEST_LENGTH
%156 = load i8*, i8** %16
%157 = load i32, i32* %15
%158 = load i32, i32* @SHA_DIGEST_LENGTH
%159 = sub nsw i32 %157, %158
%160 = call i64 @MGF1(i8* %27, i32 %155, i8* %156, i32 %159)
%161 = icmp slt i64 %160, 0
br i1 %161, label %162, label %163
162: ; preds = %154
store i32 0, i32* %7
store i32 1, i32* %21
br label %188
163: ; preds = %154
store i32 0, i32* %14
br label %164
164: ; preds = %182, %163
%165 = load i32, i32* %14
%166 = load i32, i32* @SHA_DIGEST_LENGTH
%167 = icmp slt i32 %165, %166
br i1 %167, label %168, label %185
168: ; preds = %164
%169 = load i32, i32* %14
%170 = sext i32 %169 to i64
%171 = getelementptr inbounds i8, i8* %27, i64 %170
%172 = load i8, i8* %171
%173 = zext i8 %172 to i32
%174 = load i8*, i8** %17
%175 = load i32, i32* %14
%176 = sext i32 %175 to i64
%177 = getelementptr inbounds i8, i8* %174, i64 %176
%178 = load i8, i8* %177
%179 = zext i8 %178 to i32
%180 = xor i32 %179, %173
%181 = trunc i32 %180 to i8
store i8 %181, i8* %177
br label %182
182: ; preds = %168
%183 = load i32, i32* %14
%184 = add nsw i32 %183, 1
store i32 %184, i32* %14
br label %164
185: ; preds = %164
%186 = load i8*, i8** %18
%187 = call i32 @free(i8* %186)
store i32 1, i32* %7
store i32 1, i32* %21
br label %188
188: ; preds = %185, %162, %128, %115, %107, %65, %45, %35
%189 = load i8*, i8** %19
%190 = load i32, i32* %7
ret i32 %190
}

LLVM IR (-O2):
@SHA_DIGEST_LENGTH = global i32 0
@RSA_F_RSA_PADDING_ADD_PKCS1_OAEP = global i32 0
@RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE = global i32 0
@RSA_R_KEY_SIZE_TOO_SMALL = global i32 0
@ERR_R_MALLOC_FAILURE = global i32 0
define i32 @RSA_padding_add_PKCS1_OAEP(i8* %0, i32 %1, i8* %2, i32 %3, i8* %4, i32 %5) {
%7 = add nsw i32 %1, -1
%8 = load i32, i32* @SHA_DIGEST_LENGTH
%9 = zext i32 %8 to i64
%10 = alloca i8, i64 %9
%11 = shl nsw i32 %8, 1
%12 = xor i32 %11, -1
%13 = add i32 %7, %12
%14 = icmp slt i32 %13, %3
br i1 %14, label %15, label %19
15: ; preds = %6
%16 = load i32, i32* @RSA_F_RSA_PADDING_ADD_PKCS1_OAEP
%17 = load i32, i32* @RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE
%18 = tail call i32 @RSAerr(i32 %16, i32 %17)
br label %111
19: ; preds = %6
%20 = or i32 %11, 1
%21 = icmp slt i32 %20, %1
br i1 %21, label %26, label %22
22: ; preds = %19
%23 = load i32, i32* @RSA_F_RSA_PADDING_ADD_PKCS1_OAEP
%24 = load i32, i32* @RSA_R_KEY_SIZE_TOO_SMALL
%25 = tail call i32 @RSAerr(i32 %23, i32 %24)
br label %111
26: ; preds = %19
store i8 0, i8* %0
%27 = getelementptr inbounds i8, i8* %0, i64 1
%28 = load i32, i32* @SHA_DIGEST_LENGTH
%29 = sext i32 %28 to i64
%30 = getelementptr inbounds i8, i8* %0, i64 %29
%31 = getelementptr inbounds i8, i8* %30, i64 1
%32 = tail call i32 (...) @EVP_sha1()
%33 = tail call i32 @EVP_Digest(i8* %4, i32 %5, i8* %31, i32* null, i32 %32, i32* null)
%34 = icmp eq i32 %33, 0
br i1 %34, label %111, label %35
35: ; preds = %26
%36 = load i32, i32* @SHA_DIGEST_LENGTH
%37 = sext i32 %36 to i64
%38 = getelementptr inbounds i8, i8* %31, i64 %37
%39 = sub nsw i32 %7, %3
%40 = mul i32 %36, -2
%41 = add i32 %39, -1
%42 = add i32 %41, %40
%43 = tail call i32 @memset(i8* %38, i32 0, i32 %42)
%44 = load i32, i32* @SHA_DIGEST_LENGTH
%45 = xor i32 %44, -1
%46 = add i32 %39, %45
%47 = sext i32 %46 to i64
%48 = getelementptr inbounds i8, i8* %31, i64 %47
store i8 1, i8* %48
%49 = sext i32 %7 to i64
%50 = getelementptr inbounds i8, i8* %31, i64 %49
%51 = sext i32 %3 to i64
%52 = sub nsw i64 0, %51
%53 = getelementptr inbounds i8, i8* %50, i64 %52
%54 = load i32, i32* @SHA_DIGEST_LENGTH
%55 = sext i32 %54 to i64
%56 = sub nsw i64 0, %55
%57 = getelementptr inbounds i8, i8* %53, i64 %56
%58 = tail call i32 @memcpy(i8* %57, i8* %2, i32 %3)
%59 = load i32, i32* @SHA_DIGEST_LENGTH
%60 = tail call i64 @RAND_bytes(i8* %27, i32 %59)
%61 = icmp slt i64 %60, 1
br i1 %61, label %111, label %62
62: ; preds = %35
%63 = load i32, i32* @SHA_DIGEST_LENGTH
%64 = sub nsw i32 %7, %63
%65 = tail call i8* @malloc(i32 %64)
%66 = icmp eq i8* %65, null
br i1 %66, label %67, label %71
67: ; preds = %62
%68 = load i32, i32* @RSA_F_RSA_PADDING_ADD_PKCS1_OAEP
%69 = load i32, i32* @ERR_R_MALLOC_FAILURE
%70 = tail call i32 @RSAerr(i32 %68, i32 %69)
br label %111
71: ; preds = %62
%72 = tail call i64 @MGF1(i8* %65, i32 %64, i8* %27, i32 %63)
%73 = icmp slt i64 %72, 0
br i1 %73, label %111, label %74
74: ; preds = %71
%75 = load i32, i32* @SHA_DIGEST_LENGTH
%76 = sub nsw i32 %7, %75
%77 = icmp sgt i32 %76, 0
br i1 %77, label %78, label %90
78: ; preds = %74, %78
%79 = phi i64 [ %85, %78 ], [ 0, %74 ]
%80 = getelementptr inbounds i8, i8* %65, i64 %79
%81 = load i8, i8* %80
%82 = getelementptr inbounds i8, i8* %31, i64 %79
%83 = load i8, i8* %82
%84 = xor i8 %83, %81
store i8 %84, i8* %82
%85 = add nuw nsw i64 %79, 1
%86 = load i32, i32* @SHA_DIGEST_LENGTH
%87 = sub nsw i32 %7, %86
%88 = sext i32 %87 to i64
%89 = icmp slt i64 %85, %88
br i1 %89, label %78, label %90
90: ; preds = %78, %74
%91 = phi i32 [ %75, %74 ], [ %86, %78 ]
%92 = phi i32 [ %76, %74 ], [ %87, %78 ]
%93 = call i64 @MGF1(i8* %10, i32 %91, i8* %31, i32 %92)
%94 = icmp slt i64 %93, 0
br i1 %94, label %111, label %95
95: ; preds = %90
%96 = load i32, i32* @SHA_DIGEST_LENGTH
%97 = icmp sgt i32 %96, 0
br i1 %97, label %98, label %109
98: ; preds = %95, %98
%99 = phi i64 [ %105, %98 ], [ 0, %95 ]
%100 = getelementptr inbounds i8, i8* %10, i64 %99
%101 = load i8, i8* %100
%102 = getelementptr inbounds i8, i8* %27, i64 %99
%103 = load i8, i8* %102
%104 = xor i8 %103, %101
store i8 %104, i8* %102
%105 = add nuw nsw i64 %99, 1
%106 = load i32, i32* @SHA_DIGEST_LENGTH
%107 = sext i32 %106 to i64
%108 = icmp slt i64 %105, %107
br i1 %108, label %98, label %109
109: ; preds = %98, %95
%110 = call i32 @free(i8* %65)
br label %111
111: ; preds = %90, %71, %35, %26, %109, %67, %22, %15
%112 = phi i32 [ 0, %15 ], [ 0, %22 ], [ 0, %67 ], [ 1, %109 ], [ 0, %26 ], [ 0, %35 ], [ 0, %71 ], [ 0, %90 ]
ret i32 %112
}