#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ aes256gcmcrypt(unsigned char *, unsigned char *,
                                  unsigned char, unsigned char *,
                                  unsigned char *);
scalar_t__ aes256gcmdecrypt(unsigned char *, unsigned char *, unsigned char,
                            unsigned char *, unsigned char *);
int /*<<< orphan*/ aes256gcmtomcrypt(unsigned char *, unsigned char *,
                                     unsigned char, unsigned char *,
                                     unsigned char *);
int /*<<< orphan*/ bzero(unsigned char *, int);
int /*<<< orphan*/ exit(int /*<<< orphan*/);
int memcmp(unsigned char *, unsigned char *, int);
int /*<<< orphan*/ printf(char *);
int main(int argc, char *argv[]) {
  unsigned char key[16] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                           0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
  unsigned char m[256];
  bzero(m, 32);
  unsigned char mlen = 200;
  unsigned char c1[256];
  unsigned char c2[256];
  bzero(c1, 32);
  bzero(c2, 32);
  unsigned char nonce[12] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
  int failure;
  aes256gcmcrypt(c1, m, mlen, nonce, key);
  aes256gcmtomcrypt(c2, m, mlen, nonce, key);
  printf("start\n");
  printf("section box");
  failure = memcmp(c1, c2, 32);
  if (failure) {
    printf("0\n");
  } else {
    printf("1\n");
  }
  if (aes256gcmdecrypt(m, c2, mlen, nonce, key)) {
    printf("0\n");
  } else {
    printf("1\n");
  }
  c2[1] ^= 1;
  if (!aes256gcmdecrypt(m, c2, mlen, nonce, key)) {
    printf("0\n");
  } else {
    printf("1\n");
  }
  exit(0);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x340,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
lea    -0x20(%rbp),%rdi
xor    %esi,%esi
mov    $0x10,%edx
call   1040 <memset@plt>
lea    -0x120(%rbp),%rdi
mov    $0x20,%esi
call   1080 <bzero@plt>
movb   $0xc8,-0x121(%rbp)
lea    -0x230(%rbp),%rdi
mov    $0x20,%esi
call   1080 <bzero@plt>
lea    -0x330(%rbp),%rdi
mov    $0x20,%esi
call   1080 <bzero@plt>
lea    -0x33c(%rbp),%rdi
xor    %esi,%esi
mov    $0xc,%edx
call   1040 <memset@plt>
lea    -0x230(%rbp),%rdi
lea    -0x120(%rbp),%rsi
mov    -0x121(%rbp),%al
lea    -0x33c(%rbp),%rcx
lea    -0x20(%rbp),%r8
movzbl %al,%edx
call   10a0 <aes256gcmcrypt@plt>
lea    -0x330(%rbp),%rdi
lea    -0x120(%rbp),%rsi
mov    -0x121(%rbp),%al
lea    -0x33c(%rbp),%rcx
lea    -0x20(%rbp),%r8
movzbl %al,%edx
call   1060 <aes256gcmtomcrypt@plt>
lea    0xdb5(%rip),%rdi
call   1030 <printf@plt>
lea    0xdb0(%rip),%rdi
call   1030 <printf@plt>
lea    -0x230(%rbp),%rdi
lea    -0x330(%rbp),%rsi
mov    $0x20,%edx
call   1050 <memcmp@plt>
mov    %eax,-0x340(%rbp)
cmpl   $0x0,-0x340(%rbp)
je     1298 <main+0x118>
lea    0xd85(%rip),%rdi
call   1030 <printf@plt>
jmp    12a4 <main+0x124>
lea    0xd77(%rip),%rdi
call   1030 <printf@plt>
lea    -0x120(%rbp),%rdi
lea    -0x330(%rbp),%rsi
mov    -0x121(%rbp),%al
lea    -0x33c(%rbp),%rcx
lea    -0x20(%rbp),%r8
movzbl %al,%edx
call   1070 <aes256gcmdecrypt@plt>
cmp    $0x0,%rax
je     12e6 <main+0x166>
lea    0xd37(%rip),%rdi
call   1030 <printf@plt>
jmp    12f2 <main+0x172>
lea    0xd29(%rip),%rdi
call   1030 <printf@plt>
movzbl -0x32f(%rbp),%eax
xor    $0x1,%eax
mov    %al,-0x32f(%rbp)
lea    -0x120(%rbp),%rdi
lea    -0x330(%rbp),%rsi
mov    -0x121(%rbp),%al
lea    -0x33c(%rbp),%rcx
lea    -0x20(%rbp),%r8
movzbl %al,%edx
call   1070 <aes256gcmdecrypt@plt>
cmp    $0x0,%rax
jne    1344 <main+0x1c4>
lea    0xcd9(%rip),%rdi
call   1030 <printf@plt>
jmp    1350 <main+0x1d0>
lea    0xccb(%rip),%rdi
call   1030 <printf@plt>
xor    %edi,%edi
call   1090 <exit@plt>

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x328,%rsp
xorps  %xmm0,%xmm0
movaps %xmm0,0x10(%rsp)
lea    0x20(%rsp),%rbx
mov    %rbx,%rdi
mov    $0x20,%esi
call   1080 <bzero@plt>
lea    0x220(%rsp),%r13
mov    %r13,%rdi
mov    $0x20,%esi
call   1080 <bzero@plt>
lea    0x120(%rsp),%r14
mov    %r14,%rdi
mov    $0x20,%esi
call   1080 <bzero@plt>
movl   $0x0,0x8(%rsp)
movq   $0x0,(%rsp)
mov    %rsp,%r15
lea    0x10(%rsp),%r12
mov    %r13,%rdi
mov    %rbx,%rsi
mov    $0xc8,%edx
mov    %r15,%rcx
mov    %r12,%r8
call   10a0 <aes256gcmcrypt@plt>
mov    %r14,%rdi
mov    %rbx,%rsi
mov    $0xc8,%edx
mov    %r15,%rcx
mov    %r12,%r8
call   1060 <aes256gcmtomcrypt@plt>
lea    0xdec(%rip),%rdi
call   1030 <puts@plt>
lea    0xdd4(%rip),%rdi
call   1040 <printf@plt>
mov    %r13,%rdi
mov    %r14,%rsi
mov    $0x20,%edx
call   1050 <memcmp@plt>
test   %eax,%eax
lea    0xdc8(%rip),%rbx
lea    0xdc3(%rip),%rbp
mov    %rbp,%rdi
cmove  %rbx,%rdi
call   1030 <puts@plt>
lea    0x20(%rsp),%rdi
mov    %r14,%rsi
mov    $0xc8,%edx
mov    %r15,%rcx
mov    %r12,%r8
call   1070 <aes256gcmdecrypt@plt>
test   %rax,%rax
mov    %rbp,%rdi
cmove  %rbx,%rdi
call   1030 <puts@plt>
xorb   $0x1,0x121(%rsp)
01
lea    0x20(%rsp),%rdi
mov    %r14,%rsi
mov    $0xc8,%edx
mov    %r15,%rcx
mov    %r12,%r8
call   1070 <aes256gcmdecrypt@plt>
test   %rax,%rax
cmove  %rbp,%rbx
mov    %rbx,%rdi
call   1030 <puts@plt>
xor    %edi,%edi
call   1090 <exit@plt>

LLVM IR (-O0):
@.str = [7 x i8] c"start\0A\00"
@.str.1 = [12 x i8] c"section box\00"
@.str.2 = [3 x i8] c"0\0A\00"
@.str.3 = [3 x i8] c"1\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca [16 x i8]
%7 = alloca [256 x i8]
%8 = alloca i8
%9 = alloca [256 x i8]
%10 = alloca [256 x i8]
%11 = alloca [12 x i8]
%12 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%13 = bitcast [16 x i8]* %6 to i8*
%14 = getelementptr inbounds [256 x i8], [256 x i8]* %7, i64 0, i64 0
%15 = call i32 @bzero(i8* %14, i32 32)
store i8 -56, i8* %8
%16 = getelementptr inbounds [256 x i8], [256 x i8]* %9, i64 0, i64 0
%17 = call i32 @bzero(i8* %16, i32 32)
%18 = getelementptr inbounds [256 x i8], [256 x i8]* %10, i64 0, i64 0
%19 = call i32 @bzero(i8* %18, i32 32)
%20 = bitcast [12 x i8]* %11 to i8*
%21 = getelementptr inbounds [256 x i8], [256 x i8]* %9, i64 0, i64 0
%22 = getelementptr inbounds [256 x i8], [256 x i8]* %7, i64 0, i64 0
%23 = load i8, i8* %8
%24 = getelementptr inbounds [12 x i8], [12 x i8]* %11, i64 0, i64 0
%25 = getelementptr inbounds [16 x i8], [16 x i8]* %6, i64 0, i64 0
%26 = call i32 @aes256gcmcrypt(i8* %21, i8* %22, i8 zeroext %23, i8* %24, i8* %25)
%27 = getelementptr inbounds [256 x i8], [256 x i8]* %10, i64 0, i64 0
%28 = getelementptr inbounds [256 x i8], [256 x i8]* %7, i64 0, i64 0
%29 = load i8, i8* %8
%30 = getelementptr inbounds [12 x i8], [12 x i8]* %11, i64 0, i64 0
%31 = getelementptr inbounds [16 x i8], [16 x i8]* %6, i64 0, i64 0
%32 = call i32 @aes256gcmtomcrypt(i8* %27, i8* %28, i8 zeroext %29, i8* %30, i8* %31)
%33 = call i32 @printf(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0))
%34 = call i32 @printf(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.1, i64 0, i64 0))
%35 = getelementptr inbounds [256 x i8], [256 x i8]* %9, i64 0, i64 0
%36 = getelementptr inbounds [256 x i8], [256 x i8]* %10, i64 0, i64 0
%37 = call i32 @memcmp(i8* %35, i8* %36, i32 32)
store i32 %37, i32* %12
%38 = load i32, i32* %12
%39 = icmp ne i32 %38, 0
br i1 %39, label %40, label %42
40: ; preds = %2
%41 = call i32 @printf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0))
br label %44
42: ; preds = %2
%43 = call i32 @printf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.3, i64 0, i64 0))
br label %44
44: ; preds = %42, %40
%45 = getelementptr inbounds [256 x i8], [256 x i8]* %7, i64 0, i64 0
%46 = getelementptr inbounds [256 x i8], [256 x i8]* %10, i64 0, i64 0
%47 = load i8, i8* %8
%48 = getelementptr inbounds [12 x i8], [12 x i8]* %11, i64 0, i64 0
%49 = getelementptr inbounds [16 x i8], [16 x i8]* %6, i64 0, i64 0
%50 = call i64 @aes256gcmdecrypt(i8* %45, i8* %46, i8 zeroext %47, i8* %48, i8* %49)
%51 = icmp ne i64 %50, 0
br i1 %51, label %52, label %54
52: ; preds = %44
%53 = call i32 @printf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0))
br label %56
54: ; preds = %44
%55 = call i32 @printf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.3, i64 0, i64 0))
br label %56
56: ; preds = %54, %52
%57 = getelementptr inbounds [256 x i8], [256 x i8]* %10, i64 0, i64 1
%58 = load i8, i8* %57
%59 = zext i8 %58 to i32
%60 = xor i32 %59, 1
%61 = trunc i32 %60 to i8
store i8 %61, i8* %57
%62 = getelementptr inbounds [256 x i8], [256 x i8]* %7, i64 0, i64 0
%63 = getelementptr inbounds [256 x i8], [256 x i8]* %10, i64 0, i64 0
%64 = load i8, i8* %8
%65 = getelementptr inbounds [12 x i8], [12 x i8]* %11, i64 0, i64 0
%66 = getelementptr inbounds [16 x i8], [16 x i8]* %6, i64 0, i64 0
%67 = call i64 @aes256gcmdecrypt(i8* %62, i8* %63, i8 zeroext %64, i8* %65, i8* %66)
%68 = icmp ne i64 %67, 0
br i1 %68, label %71, label %69
69: ; preds = %56
%70 = call i32 @printf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0))
br label %73
71: ; preds = %56
%72 = call i32 @printf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.3, i64 0, i64 0))
br label %73
73: ; preds = %71, %69
%74 = call i32 @exit(i32 0)
unreachable
}

LLVM IR (-O2):
@.str.1 = [12 x i8] c"section box\00"
@str = [6 x i8] c"start\00"
@str.7 = [2 x i8] c"1\00"
@str.9 = [2 x i8] c"0\00"
define i32 @main(i32 %0, i8** nocapture readnone %1) {
%3 = alloca [16 x i8]
%4 = alloca [256 x i8]
%5 = alloca [256 x i8]
%6 = alloca [256 x i8]
%7 = alloca [12 x i8]
%8 = getelementptr inbounds [16 x i8], [16 x i8]* %3, i64 0, i64 0
%9 = getelementptr inbounds [256 x i8], [256 x i8]* %4, i64 0, i64 0
%10 = call i32 @bzero(i8* %9, i32 32)
%11 = getelementptr inbounds [256 x i8], [256 x i8]* %5, i64 0, i64 0
%12 = getelementptr inbounds [256 x i8], [256 x i8]* %6, i64 0, i64 0
%13 = call i32 @bzero(i8* %11, i32 32)
%14 = call i32 @bzero(i8* %12, i32 32)
%15 = getelementptr inbounds [12 x i8], [12 x i8]* %7, i64 0, i64 0
%16 = call i32 @aes256gcmcrypt(i8* %11, i8* %9, i8 zeroext -56, i8* %15, i8* %8)
%17 = call i32 @aes256gcmtomcrypt(i8* %12, i8* %9, i8 zeroext -56, i8* %15, i8* %8)
%18 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([6 x i8], [6 x i8]* @str, i64 0, i64 0))
%19 = call i32 @printf(i8* dereferenceable(1) getelementptr inbounds ([12 x i8], [12 x i8]* @.str.1, i64 0, i64 0))
%20 = call i32 @memcmp(i8* %11, i8* %12, i32 32)
%21 = icmp eq i32 %20, 0
%22 = select i1 %21, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @str.7, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @str.9, i64 0, i64 0)
%23 = call i32 @puts(i8* dereferenceable(1) %22)
%24 = call i64 @aes256gcmdecrypt(i8* %9, i8* %12, i8 zeroext -56, i8* %15, i8* %8)
%25 = icmp eq i64 %24, 0
%26 = select i1 %25, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @str.7, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @str.9, i64 0, i64 0)
%27 = call i32 @puts(i8* dereferenceable(1) %26)
%28 = getelementptr inbounds [256 x i8], [256 x i8]* %6, i64 0, i64 1
%29 = load i8, i8* %28
%30 = xor i8 %29, 1
store i8 %30, i8* %28
%31 = call i64 @aes256gcmdecrypt(i8* %9, i8* %12, i8 zeroext -56, i8* %15, i8* %8)
%32 = icmp eq i64 %31, 0
%33 = select i1 %32, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @str.9, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @str.7, i64 0, i64 0)
%34 = call i32 @puts(i8* dereferenceable(1) %33)
%35 = call i32 @exit(i32 0)
unreachable
}