int sphincs_keygen(unsigned char pk[32], unsigned char const sk1[32],
                   unsigned char const masks[1024]) {
  int i = 0, j = 0, l = 0, h = 0;
  unsigned char addr[8];
  unsigned char seed[32];
  unsigned char leaves[32 * 32];
  unsigned char wots_pk[67 * 32];
  memset(addr, 0, 8);
  addr[0] = ((12 - 1) << 4);
  for (l = 0; l < 32; ++l) {
    addr[8 - 1] = l;
    prf_64(seed, addr, sk1);
    wotsp_keygen(wots_pk, seed, masks);
    do {
      for (i = 67, h = 0; i > 1; i = 1 + ((i - 1) / 2), h++) {
        for (j = 0; j < i; j += 2) {
          if (j + 2 > i) {
            memcpy(wots_pk + (j / 2) * 32, wots_pk + (j)*32, 32);
          } else {
            hash_nn_n_mask(wots_pk + (j / 2) * 32, wots_pk + (j)*32,
                           wots_pk + (j + 1) * 32, masks + (2 * h) * 32);
          }
        }
      }
    } while (0);
    for (i = 0; i < 32; ++i) {
      leaves[l * 32 + i] = wots_pk[0 * 32 + i];
    }
  }
  do {
    for (i = 32, h = 0; i > 1; i = 1 + ((i - 1) / 2), h++) {
      for (j = 0; j < i; j += 2) {
        if (j + 2 > i) {
          memcpy(leaves + (j / 2) * 32, leaves + (j)*32, 32);
        } else {
          hash_nn_n_mask(leaves + (j / 2) * 32, leaves + (j)*32,
                         leaves + (j + 1) * 32, masks + (2 * h) * 32);
        }
      }
    }
  } while (0);
  for (i = 0; i < 32; ++i) {
    pk[i] = leaves[0 * 32 + i];
  }
  return 0;
}


x86 assembly (clang, -O0):
<sphincs_keygen>:
push   %rbp
mov    %rsp,%rbp
sub    $0xcb0,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
movl   $0x0,-0x1c(%rbp)
movl   $0x0,-0x20(%rbp)
movl   $0x0,-0x24(%rbp)
movl   $0x0,-0x28(%rbp)
lea    -0x30(%rbp),%rdi
xor    %esi,%esi
mov    $0x8,%edx
call   1030 <memset@plt>
movb   $0xb0,-0x30(%rbp)
movl   $0x0,-0x24(%rbp)
cmpl   $0x20,-0x24(%rbp)
jge    134b <sphincs_keygen+0x20b>
mov    -0x24(%rbp),%eax
mov    %al,-0x29(%rbp)
lea    -0x50(%rbp),%rdi
lea    -0x30(%rbp),%rsi
mov    -0x10(%rbp),%rdx
mov    $0x0,%al
call   1050 <prf_64@plt>
lea    -0xcb0(%rbp),%rdi
lea    -0x50(%rbp),%rsi
mov    -0x18(%rbp),%rdx
mov    $0x0,%al
call   1040 <wotsp_keygen@plt>
movl   $0x43,-0x1c(%rbp)
movl   $0x0,-0x28(%rbp)
cmpl   $0x1,-0x1c(%rbp)
jle    12f3 <sphincs_keygen+0x1b3>
movl   $0x0,-0x20(%rbp)
mov    -0x20(%rbp),%eax
cmp    -0x1c(%rbp),%eax
jge    12cc <sphincs_keygen+0x18c>
mov    -0x20(%rbp),%eax
add    $0x2,%eax
cmp    -0x1c(%rbp),%eax
jle    125f <sphincs_keygen+0x11f>
mov    -0x20(%rbp),%eax
mov    $0x2,%ecx
cltd
idiv   %ecx
shl    $0x5,%eax
cltq
mov    -0x20(%rbp),%ecx
shl    $0x5,%ecx
movslq %ecx,%rcx
mov    -0xcb0(%rbp,%rcx,1),%rdx
ff
mov    %rdx,-0xcb0(%rbp,%rax,1)
ff
mov    -0xca8(%rbp,%rcx,1),%rdx
ff
mov    %rdx,-0xca8(%rbp,%rax,1)
ff
mov    -0xca0(%rbp,%rcx,1),%rdx
ff
mov    %rdx,-0xca0(%rbp,%rax,1)
ff
mov    -0xc98(%rbp,%rcx,1),%rcx
ff
mov    %rcx,-0xc98(%rbp,%rax,1)
ff
jmp    12b9 <sphincs_keygen+0x179>
lea    -0xcb0(%rbp),%rdi
mov    -0x20(%rbp),%eax
mov    $0x2,%ecx
cltd
idiv   %ecx
shl    $0x5,%eax
cltq
add    %rax,%rdi
lea    -0xcb0(%rbp),%rsi
mov    -0x20(%rbp),%eax
shl    $0x5,%eax
cltq
add    %rax,%rsi
lea    -0xcb0(%rbp),%rdx
mov    -0x20(%rbp),%eax
add    $0x1,%eax
shl    $0x5,%eax
cltq
add    %rax,%rdx
mov    -0x18(%rbp),%rcx
mov    -0x28(%rbp),%eax
shl    $0x1,%eax
shl    $0x5,%eax
cltq
add    %rax,%rcx
mov    $0x0,%al
call   1060 <hash_nn_n_mask@plt>
jmp    12be <sphincs_keygen+0x17e>
mov    -0x20(%rbp),%eax
add    $0x2,%eax
mov    %eax,-0x20(%rbp)
jmp    11e6 <sphincs_keygen+0xa6>
jmp    12d1 <sphincs_keygen+0x191>
mov    -0x1c(%rbp),%eax
sub    $0x1,%eax
mov    $0x2,%ecx
cltd
idiv   %ecx
add    $0x1,%eax
mov    %eax,-0x1c(%rbp)
mov    -0x28(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x28(%rbp)
jmp    11d5 <sphincs_keygen+0x95>
jmp    12f8 <sphincs_keygen+0x1b8>
movl   $0x0,-0x1c(%rbp)
cmpl   $0x20,-0x1c(%rbp)
jge    1338 <sphincs_keygen+0x1f8>
mov    -0x1c(%rbp),%eax
add    $0x0,%eax
cltq
mov    -0xcb0(%rbp,%rax,1),%cl
mov    -0x24(%rbp),%eax
shl    $0x5,%eax
add    -0x1c(%rbp),%eax
cltq
mov    %cl,-0x450(%rbp,%rax,1)
mov    -0x1c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1c(%rbp)
jmp    12ff <sphincs_keygen+0x1bf>
jmp    133d <sphincs_keygen+0x1fd>
mov    -0x24(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x24(%rbp)
jmp    118e <sphincs_keygen+0x4e>
jmp    1350 <sphincs_keygen+0x210>
movl   $0x20,-0x1c(%rbp)
movl   $0x0,-0x28(%rbp)
cmpl   $0x1,-0x1c(%rbp)
jle    147c <sphincs_keygen+0x33c>
movl   $0x0,-0x20(%rbp)
mov    -0x20(%rbp),%eax
cmp    -0x1c(%rbp),%eax
jge    1455 <sphincs_keygen+0x315>
mov    -0x20(%rbp),%eax
add    $0x2,%eax
cmp    -0x1c(%rbp),%eax
jle    13e8 <sphincs_keygen+0x2a8>
mov    -0x20(%rbp),%eax
mov    $0x2,%ecx
cltd
idiv   %ecx
shl    $0x5,%eax
cltq
mov    -0x20(%rbp),%ecx
shl    $0x5,%ecx
movslq %ecx,%rcx
mov    -0x450(%rbp,%rcx,1),%rdx
ff
mov    %rdx,-0x450(%rbp,%rax,1)
ff
mov    -0x448(%rbp,%rcx,1),%rdx
ff
mov    %rdx,-0x448(%rbp,%rax,1)
ff
mov    -0x440(%rbp,%rcx,1),%rdx
ff
mov    %rdx,-0x440(%rbp,%rax,1)
ff
mov    -0x438(%rbp,%rcx,1),%rcx
ff
mov    %rcx,-0x438(%rbp,%rax,1)
ff
jmp    1442 <sphincs_keygen+0x302>
lea    -0x450(%rbp),%rdi
mov    -0x20(%rbp),%eax
mov    $0x2,%ecx
cltd
idiv   %ecx
shl    $0x5,%eax
cltq
add    %rax,%rdi
lea    -0x450(%rbp),%rsi
mov    -0x20(%rbp),%eax
shl    $0x5,%eax
cltq
add    %rax,%rsi
lea    -0x450(%rbp),%rdx
mov    -0x20(%rbp),%eax
add    $0x1,%eax
shl    $0x5,%eax
cltq
add    %rax,%rdx
mov    -0x18(%rbp),%rcx
mov    -0x28(%rbp),%eax
shl    $0x1,%eax
shl    $0x5,%eax
cltq
add    %rax,%rcx
mov    $0x0,%al
call   1060 <hash_nn_n_mask@plt>
jmp    1447 <sphincs_keygen+0x307>
mov    -0x20(%rbp),%eax
add    $0x2,%eax
mov    %eax,-0x20(%rbp)
jmp    136f <sphincs_keygen+0x22f>
jmp    145a <sphincs_keygen+0x31a>
mov    -0x1c(%rbp),%eax
sub    $0x1,%eax
mov    $0x2,%ecx
cltd
idiv   %ecx
add    $0x1,%eax
mov    %eax,-0x1c(%rbp)
mov    -0x28(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x28(%rbp)
jmp    135e <sphincs_keygen+0x21e>
jmp    1481 <sphincs_keygen+0x341>
movl   $0x0,-0x1c(%rbp)
cmpl   $0x20,-0x1c(%rbp)
jge    14ba <sphincs_keygen+0x37a>
mov    -0x1c(%rbp),%eax
add    $0x0,%eax
cltq
mov    -0x450(%rbp,%rax,1),%dl
mov    -0x8(%rbp),%rax
movslq -0x1c(%rbp),%rcx
mov    %dl,(%rax,%rcx,1)
mov    -0x1c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1c(%rbp)
jmp    1488 <sphincs_keygen+0x348>
xor    %eax,%eax
add    $0xcb0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<sphincs_keygen>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0xcc8,%rsp
mov    %rdx,0x10(%rsp)
mov    %rsi,0x28(%rsp)
mov    %rdi,0x20(%rsp)
movq   $0xb0,0x18(%rsp)
xor    %ecx,%ecx
jmp    118f <sphincs_keygen+0x5f>
nopl   (%rax)
movaps 0x460(%rsp),%xmm0
movaps 0x470(%rsp),%xmm1
mov    0x30(%rsp),%rax
movaps %xmm1,0x10(%rax)
movaps %xmm0,(%rax)
mov    0x38(%rsp),%rcx
add    $0x1,%rcx
cmp    $0x20,%rcx
je     12b7 <sphincs_keygen+0x187>
mov    %rcx,%rax
shl    $0x5,%rax
add    %rsp,%rax
add    $0x60,%rax
mov    %rax,0x30(%rsp)
mov    %rcx,0x38(%rsp)
mov    %cl,0x1f(%rsp)
lea    0x40(%rsp),%rbx
mov    %rbx,%rdi
lea    0x18(%rsp),%rsi
mov    0x28(%rsp),%rdx
xor    %eax,%eax
call   1040 <prf_64@plt>
lea    0x460(%rsp),%rdi
mov    %rbx,%rsi
mov    0x10(%rsp),%rdx
xor    %eax,%eax
call   1030 <wotsp_keygen@plt>
mov    $0x43,%ebx
xor    %eax,%eax
mov    %rax,0x8(%rsp)
jmp    121d <sphincs_keygen+0xed>
nopl   0x0(%rax)
mov    %ebx,%eax
add    $0xffffffff,%eax
shr    $0x1f,%eax
add    %eax,%ebx
add    $0xffffffff,%ebx
sar    %ebx
add    $0x1,%ebx
mov    0x8(%rsp),%rcx
add    $0x1,%rcx
mov    %rcx,%rax
mov    %rcx,0x8(%rsp)
cmp    $0x7,%rcx
je     1160 <sphincs_keygen+0x30>
test   %ebx,%ebx
jle    11f0 <sphincs_keygen+0xc0>
mov    0x8(%rsp),%r14
shl    $0x6,%r14
add    0x10(%rsp),%r14
mov    %ebx,%ebp
xor    %r13d,%r13d
xor    %r15d,%r15d
xor    %r12d,%r12d
jmp    1280 <sphincs_keygen+0x150>
nopl   0x0(%rax)
lea    (%rsp,%rax,1),%rdi
add    $0x460,%rdi
mov    %r15d,%eax
lea    0x460(%rsp,%rax,1),%rsi
lea    0x20(%r15),%eax
lea    (%rsp,%rax,1),%rdx
add    $0x460,%rdx
mov    %r14,%rcx
xor    %eax,%eax
call   1050 <hash_nn_n_mask@plt>
add    $0x40,%r15
add    $0x20,%r13
cmp    %rbp,%r12
jae    11f0 <sphincs_keygen+0xc0>
add    $0x2,%r12
mov    %r13d,%eax
and    $0xffffffe0,%eax
cmp    %rbp,%r12
jbe    1240 <sphincs_keygen+0x110>
mov    %r15d,%ecx
and    $0xffffffc0,%ecx
movaps 0x460(%rsp,%rcx,1),%xmm0
movaps 0x470(%rsp,%rcx,1),%xmm1
movaps %xmm1,0x470(%rsp,%rax,1)
movaps %xmm0,0x460(%rsp,%rax,1)
jmp    126f <sphincs_keygen+0x13f>
mov    $0x20,%r13d
xor    %eax,%eax
mov    %rax,0x8(%rsp)
jmp    1302 <sphincs_keygen+0x1d2>
cs nopw 0x0(%rax,%rax,1)
mov    %r13d,%eax
add    $0xffffffff,%eax
shr    $0x1f,%eax
add    %eax,%r13d
add    $0xffffffff,%r13d
sar    %r13d
add    $0x1,%r13d
mov    0x8(%rsp),%rcx
add    $0x1,%rcx
mov    %rcx,%rax
mov    %rcx,0x8(%rsp)
cmp    $0x5,%rcx
je     138e <sphincs_keygen+0x25e>
test   %r13d,%r13d
jle    12d0 <sphincs_keygen+0x1a0>
mov    0x8(%rsp),%r12
shl    $0x6,%r12
add    0x10(%rsp),%r12
mov    %r13d,%r15d
xor    %ebx,%ebx
xor    %ebp,%ebp
xor    %r14d,%r14d
jmp    1365 <sphincs_keygen+0x235>
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax,%rax,1)
lea    (%rsp,%rax,1),%rdi
add    $0x60,%rdi
mov    %ebp,%eax
lea    0x60(%rsp,%rax,1),%rsi
lea    0x20(%rbp),%eax
lea    (%rsp,%rax,1),%rdx
add    $0x60,%rdx
mov    %r12,%rcx
xor    %eax,%eax
call   1050 <hash_nn_n_mask@plt>
add    $0x40,%rbp
add    $0x20,%rbx
cmp    %r15,%r14
jae    12d0 <sphincs_keygen+0x1a0>
add    $0x2,%r14
mov    %ebx,%eax
and    $0xffffffe0,%eax
cmp    %r15,%r14
jbe    1330 <sphincs_keygen+0x200>
mov    %ebp,%ecx
and    $0xffffffc0,%ecx
movaps 0x60(%rsp,%rcx,1),%xmm0
movaps 0x70(%rsp,%rcx,1),%xmm1
movaps %xmm1,0x70(%rsp,%rax,1)
movaps %xmm0,0x60(%rsp,%rax,1)
jmp    1354 <sphincs_keygen+0x224>
movaps 0x60(%rsp),%xmm0
movaps 0x70(%rsp),%xmm1
mov    0x20(%rsp),%rax
movups %xmm1,0x10(%rax)
movups %xmm0,(%rax)
xor    %eax,%eax
add    $0xcc8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
define i32 @sphincs_keygen(i8* %0, i8* %1, i8* %2) {
%4 = alloca i8*
%5 = alloca i8*
%6 = alloca i8*
%7 = alloca i32
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
%11 = alloca [8 x i8]
%12 = alloca [32 x i8]
%13 = alloca [1024 x i8]
%14 = alloca [2144 x i8]
store i8* %0, i8** %4
store i8* %1, i8** %5
store i8* %2, i8** %6
store i32 0, i32* %7
store i32 0, i32* %8
store i32 0, i32* %9
store i32 0, i32* %10
%15 = getelementptr inbounds [8 x i8], [8 x i8]* %11, i64 0, i64 0
%16 = getelementptr inbounds [8 x i8], [8 x i8]* %11, i64 0, i64 0
store i8 -80, i8* %16
store i32 0, i32* %9
br label %17
17: ; preds = %116, %3
%18 = load i32, i32* %9
%19 = icmp slt i32 %18, 32
br i1 %19, label %20, label %119
20: ; preds = %17
%21 = load i32, i32* %9
%22 = trunc i32 %21 to i8
%23 = getelementptr inbounds [8 x i8], [8 x i8]* %11, i64 0, i64 7
store i8 %22, i8* %23
%24 = getelementptr inbounds [32 x i8], [32 x i8]* %12, i64 0, i64 0
%25 = getelementptr inbounds [8 x i8], [8 x i8]* %11, i64 0, i64 0
%26 = load i8*, i8** %5
%27 = call i32 (i8*, i8*, i8*, ...) bitcast (i32 (...)* @prf_64 to i32 (i8*, i8*, i8*, ...)*)(i8* %24, i8* %25, i8* %26)
%28 = getelementptr inbounds [2144 x i8], [2144 x i8]* %14, i64 0, i64 0
%29 = getelementptr inbounds [32 x i8], [32 x i8]* %12, i64 0, i64 0
%30 = load i8*, i8** %6
%31 = call i32 (i8*, i8*, i8*, ...) bitcast (i32 (...)* @wotsp_keygen to i32 (i8*, i8*, i8*, ...)*)(i8* %28, i8* %29, i8* %30)
br label %32
32: ; preds = %20
store i32 67, i32* %7
store i32 0, i32* %10
br label %33
33: ; preds = %88, %32
%34 = load i32, i32* %7
%35 = icmp sgt i32 %34, 1
br i1 %35, label %36, label %95
36: ; preds = %33
store i32 0, i32* %8
br label %37
37: ; preds = %84, %36
%38 = load i32, i32* %8
%39 = load i32, i32* %7
%40 = icmp slt i32 %38, %39
br i1 %40, label %41, label %87
41: ; preds = %37
%42 = load i32, i32* %8
%43 = add nsw i32 %42, 2
%44 = load i32, i32* %7
%45 = icmp sgt i32 %43, %44
br i1 %45, label %46, label %58
46: ; preds = %41
%47 = getelementptr inbounds [2144 x i8], [2144 x i8]* %14, i64 0, i64 0
%48 = load i32, i32* %8
%49 = sdiv i32 %48, 2
%50 = mul nsw i32 %49, 32
%51 = sext i32 %50 to i64
%52 = getelementptr inbounds i8, i8* %47, i64 %51
%53 = getelementptr inbounds [2144 x i8], [2144 x i8]* %14, i64 0, i64 0
%54 = load i32, i32* %8
%55 = mul nsw i32 %54, 32
%56 = sext i32 %55 to i64
%57 = getelementptr inbounds i8, i8* %53, i64 %56
br label %83
58: ; preds = %41
%59 = getelementptr inbounds [2144 x i8], [2144 x i8]* %14, i64 0, i64 0
%60 = load i32, i32* %8
%61 = sdiv i32 %60, 2
%62 = mul nsw i32 %61, 32
%63 = sext i32 %62 to i64
%64 = getelementptr inbounds i8, i8* %59, i64 %63
%65 = getelementptr inbounds [2144 x i8], [2144 x i8]* %14, i64 0, i64 0
%66 = load i32, i32* %8
%67 = mul nsw i32 %66, 32
%68 = sext i32 %67 to i64
%69 = getelementptr inbounds i8, i8* %65, i64 %68
%70 = getelementptr inbounds [2144 x i8], [2144 x i8]* %14, i64 0, i64 0
%71 = load i32, i32* %8
%72 = add nsw i32 %71, 1
%73 = mul nsw i32 %72, 32
%74 = sext i32 %73 to i64
%75 = getelementptr inbounds i8, i8* %70, i64 %74
%76 = load i8*, i8** %6
%77 = load i32, i32* %10
%78 = mul nsw i32 2, %77
%79 = mul nsw i32 %78, 32
%80 = sext i32 %79 to i64
%81 = getelementptr inbounds i8, i8* %76, i64 %80
%82 = call i32 (i8*, i8*, i8*, i8*, ...) bitcast (i32 (...)* @hash_nn_n_mask to i32 (i8*, i8*, i8*, i8*, ...)*)(i8* %64, i8* %69, i8* %75, i8* %81)
br label %83
83: ; preds = %58, %46
br label %84
84: ; preds = %83
%85 = load i32, i32* %8
%86 = add nsw i32 %85, 2
store i32 %86, i32* %8
br label %37
87: ; preds = %37
br label %88
88: ; preds = %87
%89 = load i32, i32* %7
%90 = sub nsw i32 %89, 1
%91 = sdiv i32 %90, 2
%92 = add nsw i32 1, %91
store i32 %92, i32* %7
%93 = load i32, i32* %10
%94 = add nsw i32 %93, 1
store i32 %94, i32* %10
br label %33
95: ; preds = %33
br label %96
96: ; preds = %95
store i32 0, i32* %7
br label %97
97: ; preds = %112, %96
%98 = load i32, i32* %7
%99 = icmp slt i32 %98, 32
br i1 %99, label %100, label %115
100: ; preds = %97
%101 = load i32, i32* %7
%102 = add nsw i32 0, %101
%103 = sext i32 %102 to i64
%104 = getelementptr inbounds [2144 x i8], [2144 x i8]* %14, i64 0, i64 %103
%105 = load i8, i8* %104
%106 = load i32, i32* %9
%107 = mul nsw i32 %106, 32
%108 = load i32, i32* %7
%109 = add nsw i32 %107, %108
%110 = sext i32 %109 to i64
%111 = getelementptr inbounds [1024 x i8], [1024 x i8]* %13, i64 0, i64 %110
store i8 %105, i8* %111
br label %112
112: ; preds = %100
%113 = load i32, i32* %7
%114 = add nsw i32 %113, 1
store i32 %114, i32* %7
br label %97
115: ; preds = %97
br label %116
116: ; preds = %115
%117 = load i32, i32* %9
%118 = add nsw i32 %117, 1
store i32 %118, i32* %9
br label %17
119: ; preds = %17
br label %120
120: ; preds = %119
store i32 32, i32* %7
store i32 0, i32* %10
br label %121
121: ; preds = %176, %120
%122 = load i32, i32* %7
%123 = icmp sgt i32 %122, 1
br i1 %123, label %124, label %183
124: ; preds = %121
store i32 0, i32* %8
br label %125
125: ; preds = %172, %124
%126 = load i32, i32* %8
%127 = load i32, i32* %7
%128 = icmp slt i32 %126, %127
br i1 %128, label %129, label %175
129: ; preds = %125
%130 = load i32, i32* %8
%131 = add nsw i32 %130, 2
%132 = load i32, i32* %7
%133 = icmp sgt i32 %131, %132
br i1 %133, label %134, label %146
134: ; preds = %129
%135 = getelementptr inbounds [1024 x i8], [1024 x i8]* %13, i64 0, i64 0
%136 = load i32, i32* %8
%137 = sdiv i32 %136, 2
%138 = mul nsw i32 %137, 32
%139 = sext i32 %138 to i64
%140 = getelementptr inbounds i8, i8* %135, i64 %139
%141 = getelementptr inbounds [1024 x i8], [1024 x i8]* %13, i64 0, i64 0
%142 = load i32, i32* %8
%143 = mul nsw i32 %142, 32
%144 = sext i32 %143 to i64
%145 = getelementptr inbounds i8, i8* %141, i64 %144
br label %171
146: ; preds = %129
%147 = getelementptr inbounds [1024 x i8], [1024 x i8]* %13, i64 0, i64 0
%148 = load i32, i32* %8
%149 = sdiv i32 %148, 2
%150 = mul nsw i32 %149, 32
%151 = sext i32 %150 to i64
%152 = getelementptr inbounds i8, i8* %147, i64 %151
%153 = getelementptr inbounds [1024 x i8], [1024 x i8]* %13, i64 0, i64 0
%154 = load i32, i32* %8
%155 = mul nsw i32 %154, 32
%156 = sext i32 %155 to i64
%157 = getelementptr inbounds i8, i8* %153, i64 %156
%158 = getelementptr inbounds [1024 x i8], [1024 x i8]* %13, i64 0, i64 0
%159 = load i32, i32* %8
%160 = add nsw i32 %159, 1
%161 = mul nsw i32 %160, 32
%162 = sext i32 %161 to i64
%163 = getelementptr inbounds i8, i8* %158, i64 %162
%164 = load i8*, i8** %6
%165 = load i32, i32* %10
%166 = mul nsw i32 2, %165
%167 = mul nsw i32 %166, 32
%168 = sext i32 %167 to i64
%169 = getelementptr inbounds i8, i8* %164, i64 %168
%170 = call i32 (i8*, i8*, i8*, i8*, ...) bitcast (i32 (...)* @hash_nn_n_mask to i32 (i8*, i8*, i8*, i8*, ...)*)(i8* %152, i8* %157, i8* %163, i8* %169)
br label %171
171: ; preds = %146, %134
br label %172
172: ; preds = %171
%173 = load i32, i32* %8
%174 = add nsw i32 %173, 2
store i32 %174, i32* %8
br label %125
175: ; preds = %125
br label %176
176: ; preds = %175
%177 = load i32, i32* %7
%178 = sub nsw i32 %177, 1
%179 = sdiv i32 %178, 2
%180 = add nsw i32 1, %179
store i32 %180, i32* %7
%181 = load i32, i32* %10
%182 = add nsw i32 %181, 1
store i32 %182, i32* %10
br label %121
183: ; preds = %121
br label %184
184: ; preds = %183
store i32 0, i32* %7
br label %185
185: ; preds = %198, %184
%186 = load i32, i32* %7
%187 = icmp slt i32 %186, 32
br i1 %187, label %188, label %201
188: ; preds = %185
%189 = load i32, i32* %7
%190 = add nsw i32 0, %189
%191 = sext i32 %190 to i64
%192 = getelementptr inbounds [1024 x i8], [1024 x i8]* %13, i64 0, i64 %191
%193 = load i8, i8* %192
%194 = load i8*, i8** %4
%195 = load i32, i32* %7
%196 = sext i32 %195 to i64
%197 = getelementptr inbounds i8, i8* %194, i64 %196
store i8 %193, i8* %197
br label %198
198: ; preds = %188
%199 = load i32, i32* %7
%200 = add nsw i32 %199, 1
store i32 %200, i32* %7
br label %185
201: ; preds = %185
ret i32 0
}

LLVM IR (-O2):
define i32 @sphincs_keygen(i8* nocapture writeonly %0, i8* %1, i8* %2) {
%4 = alloca i64
%5 = bitcast i64* %4 to [8 x i8]*
%6 = alloca [32 x i8]
%7 = alloca [1024 x i8]
%8 = alloca [2144 x i8]
%9 = getelementptr inbounds [2144 x i8], [2144 x i8]* %8, i64 0, i64 0
%10 = bitcast i64* %4 to i8*
%11 = getelementptr inbounds [32 x i8], [32 x i8]* %6, i64 0, i64 0
%12 = getelementptr inbounds [1024 x i8], [1024 x i8]* %7, i64 0, i64 0
%13 = getelementptr inbounds [2144 x i8], [2144 x i8]* %8, i64 0, i64 0
store i64 176, i64* %4
%14 = getelementptr inbounds [8 x i8], [8 x i8]* %5, i64 0, i64 7
br label %15
15: ; preds = %3, %22
%16 = phi i64 [ 0, %3 ], [ %23, %22 ]
%17 = shl nuw nsw i64 %16, 5
%18 = getelementptr [1024 x i8], [1024 x i8]* %7, i64 0, i64 %17
%19 = trunc i64 %16 to i8
store i8 %19, i8* %14
%20 = call i32 (i8*, i8*, i8*, ...) bitcast (i32 (...)* @prf_64 to i32 (i8*, i8*, i8*, ...)*)(i8* %11, i8* %10, i8* %1)
%21 = call i32 (i8*, i8*, i8*, ...) bitcast (i32 (...)* @wotsp_keygen to i32 (i8*, i8*, i8*, ...)*)(i8* %13, i8* %11, i8* %2)
br label %25
22: ; preds = %58
%23 = add nuw nsw i64 %16, 1
%24 = icmp eq i64 %23, 32
br i1 %24, label %64, label %15
25: ; preds = %15, %58
%26 = phi i64 [ 0, %15 ], [ %62, %58 ]
%27 = phi i32 [ 67, %15 ], [ %61, %58 ]
%28 = icmp sgt i32 %27, 0
br i1 %28, label %29, label %58
29: ; preds = %25
%30 = shl nsw i64 %26, 6
%31 = getelementptr inbounds i8, i8* %2, i64 %30
%32 = zext i32 %27 to i64
br label %33
33: ; preds = %29, %56
%34 = phi i64 [ 0, %29 ], [ %35, %56 ]
%35 = add nuw nsw i64 %34, 2
%36 = icmp ugt i64 %35, %32
br i1 %36, label %37, label %44
37: ; preds = %33
%38 = shl i64 %34, 4
%39 = and i64 %38, 4294967264
%40 = getelementptr inbounds [2144 x i8], [2144 x i8]* %8, i64 0, i64 %39
%41 = shl i64 %34, 5
%42 = and i64 %41, 4294967232
%43 = getelementptr inbounds [2144 x i8], [2144 x i8]* %8, i64 0, i64 %42
br label %56
44: ; preds = %33
%45 = trunc i64 %34 to i32
%46 = shl i64 %34, 4
%47 = and i64 %46, 4294967264
%48 = getelementptr inbounds [2144 x i8], [2144 x i8]* %8, i64 0, i64 %47
%49 = shl nsw i32 %45, 5
%50 = zext i32 %49 to i64
%51 = getelementptr inbounds [2144 x i8], [2144 x i8]* %8, i64 0, i64 %50
%52 = or i32 %49, 32
%53 = zext i32 %52 to i64
%54 = getelementptr inbounds [2144 x i8], [2144 x i8]* %8, i64 0, i64 %53
%55 = call i32 (i8*, i8*, i8*, i8*, ...) bitcast (i32 (...)* @hash_nn_n_mask to i32 (i8*, i8*, i8*, i8*, ...)*)(i8* %48, i8* %51, i8* %54, i8* %31)
br label %56
56: ; preds = %37, %44
%57 = icmp ult i64 %35, %32
br i1 %57, label %33, label %58
58: ; preds = %56, %25
%59 = add nsw i32 %27, -1
%60 = sdiv i32 %59, 2
%61 = add nsw i32 %60, 1
%62 = add nuw nsw i64 %26, 1
%63 = icmp eq i64 %62, 7
br i1 %63, label %22, label %25
64: ; preds = %22, %97
%65 = phi i64 [ %101, %97 ], [ 0, %22 ]
%66 = phi i32 [ %100, %97 ], [ 32, %22 ]
%67 = icmp sgt i32 %66, 0
br i1 %67, label %68, label %97
68: ; preds = %64
%69 = shl nsw i64 %65, 6
%70 = getelementptr inbounds i8, i8* %2, i64 %69
%71 = zext i32 %66 to i64
br label %72
72: ; preds = %68, %95
%73 = phi i64 [ 0, %68 ], [ %74, %95 ]
%74 = add nuw nsw i64 %73, 2
%75 = icmp ugt i64 %74, %71
br i1 %75, label %76, label %83
76: ; preds = %72
%77 = shl i64 %73, 4
%78 = and i64 %77, 4294967264
%79 = getelementptr inbounds [1024 x i8], [1024 x i8]* %7, i64 0, i64 %78
%80 = shl i64 %73, 5
%81 = and i64 %80, 4294967232
%82 = getelementptr inbounds [1024 x i8], [1024 x i8]* %7, i64 0, i64 %81
br label %95
83: ; preds = %72
%84 = trunc i64 %73 to i32
%85 = shl i64 %73, 4
%86 = and i64 %85, 4294967264
%87 = getelementptr inbounds [1024 x i8], [1024 x i8]* %7, i64 0, i64 %86
%88 = shl nsw i32 %84, 5
%89 = zext i32 %88 to i64
%90 = getelementptr inbounds [1024 x i8], [1024 x i8]* %7, i64 0, i64 %89
%91 = or i32 %88, 32
%92 = zext i32 %91 to i64
%93 = getelementptr inbounds [1024 x i8], [1024 x i8]* %7, i64 0, i64 %92
%94 = call i32 (i8*, i8*, i8*, i8*, ...) bitcast (i32 (...)* @hash_nn_n_mask to i32 (i8*, i8*, i8*, i8*, ...)*)(i8* %87, i8* %90, i8* %93, i8* %70)
br label %95
95: ; preds = %76, %83
%96 = icmp ult i64 %74, %71
br i1 %96, label %72, label %97
97: ; preds = %95, %64
%98 = add nsw i32 %66, -1
%99 = sdiv i32 %98, 2
%100 = add nsw i32 %99, 1
%101 = add nuw nsw i64 %65, 1
%102 = icmp eq i64 %101, 5
br i1 %102, label %103, label %64
103: ; preds = %97
%104 = getelementptr inbounds [1024 x i8], [1024 x i8]* %7, i64 0, i64 0
ret i32 0
}