#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ crypto_onetimeauth_poly1305_tinynacl(unsigned char *,
                                                        unsigned char const *,
                                                        unsigned long long,
                                                        unsigned char const *);
int crypto_onetimeauth_poly1305_tinynacl_verify(const unsigned char *h,
                                                const unsigned char *in,
                                                unsigned long long l,
                                                const unsigned char *k) {
  unsigned char correct[16];
  unsigned int d = 0;
  long long i;
  crypto_onetimeauth_poly1305_tinynacl(correct, in, l, k);
  for (i = 0; i < 16; ++i)
    d |= correct[i] ^ h[i];
  return (1 & ((d - 1) >> 8)) - 1;
}


x86 assembly (clang, -O0):
<crypto_onetimeauth_poly1305_tinynacl_verify>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
mov    %rcx,-0x20(%rbp)
movl   $0x0,-0x34(%rbp)
lea    -0x30(%rbp),%rdi
mov    -0x10(%rbp),%rsi
mov    -0x18(%rbp),%rdx
mov    -0x20(%rbp),%rcx
call   1030 <crypto_onetimeauth_poly1305_tinynacl@plt>
movq   $0x0,-0x40(%rbp)
cmpq   $0x10,-0x40(%rbp)
jge    1185 <crypto_onetimeauth_poly1305_tinynacl_verify+0x75>
mov    -0x40(%rbp),%rax
movzbl -0x30(%rbp,%rax,1),%eax
mov    -0x8(%rbp),%rcx
mov    -0x40(%rbp),%rdx
movzbl (%rcx,%rdx,1),%ecx
xor    %ecx,%eax
or     -0x34(%rbp),%eax
mov    %eax,-0x34(%rbp)
mov    -0x40(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x40(%rbp)
jmp    114c <crypto_onetimeauth_poly1305_tinynacl_verify+0x3c>
mov    -0x34(%rbp),%eax
sub    $0x1,%eax
shr    $0x8,%eax
and    $0x1,%eax
sub    $0x1,%eax
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<crypto_onetimeauth_poly1305_tinynacl_verify>:
push   %rbx
sub    $0x10,%rsp
mov    %rdi,%rbx
mov    %rsp,%rdi
call   1030 <crypto_onetimeauth_poly1305_tinynacl@plt>
movdqu (%rbx),%xmm0
pxor   (%rsp),%xmm0
pshufd $0xee,%xmm0,%xmm1
por    %xmm0,%xmm1
pshufd $0x55,%xmm1,%xmm0
por    %xmm1,%xmm0
movdqa %xmm0,%xmm1
psrld  $0x10,%xmm1
por    %xmm0,%xmm1
movdqa %xmm1,%xmm0
psrlw  $0x8,%xmm0
por    %xmm1,%xmm0
movd   %xmm0,%eax
movzbl %al,%eax
add    $0xffffffff,%eax
shr    $0x8,%eax
and    $0x1,%eax
add    $0xffffffff,%eax
add    $0x10,%rsp
pop    %rbx
ret

LLVM IR (-O0):
define i32 @crypto_onetimeauth_poly1305_tinynacl_verify(i8* %0, i8* %1, i64 %2, i8* %3) {
%5 = alloca i8*
%6 = alloca i8*
%7 = alloca i64
%8 = alloca i8*
%9 = alloca [16 x i8]
%10 = alloca i32
%11 = alloca i64
store i8* %0, i8** %5
store i8* %1, i8** %6
store i64 %2, i64* %7
store i8* %3, i8** %8
store i32 0, i32* %10
%12 = getelementptr inbounds [16 x i8], [16 x i8]* %9, i64 0, i64 0
%13 = load i8*, i8** %6
%14 = load i64, i64* %7
%15 = load i8*, i8** %8
%16 = call i32 @crypto_onetimeauth_poly1305_tinynacl(i8* %12, i8* %13, i64 %14, i8* %15)
store i64 0, i64* %11
br label %17
17: ; preds = %33, %4
%18 = load i64, i64* %11
%19 = icmp slt i64 %18, 16
br i1 %19, label %20, label %36
20: ; preds = %17
%21 = load i64, i64* %11
%22 = getelementptr inbounds [16 x i8], [16 x i8]* %9, i64 0, i64 %21
%23 = load i8, i8* %22
%24 = zext i8 %23 to i32
%25 = load i8*, i8** %5
%26 = load i64, i64* %11
%27 = getelementptr inbounds i8, i8* %25, i64 %26
%28 = load i8, i8* %27
%29 = zext i8 %28 to i32
%30 = xor i32 %24, %29
%31 = load i32, i32* %10
%32 = or i32 %31, %30
store i32 %32, i32* %10
br label %33
33: ; preds = %20
%34 = load i64, i64* %11
%35 = add nsw i64 %34, 1
store i64 %35, i64* %11
br label %17
36: ; preds = %17
%37 = load i32, i32* %10
%38 = sub i32 %37, 1
%39 = lshr i32 %38, 8
%40 = and i32 1, %39
%41 = sub i32 %40, 1
ret i32 %41
}

LLVM IR (-O2):
define i32 @crypto_onetimeauth_poly1305_tinynacl_verify(i8* nocapture %0, i8* %1, i64 %2, i8* %3) {
%5 = alloca <16 x i8>
%6 = getelementptr inbounds <16 x i8>, <16 x i8>* %5, i64 0, i64 0
%7 = call i32 @crypto_onetimeauth_poly1305_tinynacl(i8* %6, i8* %1, i64 %2, i8* %3)
%8 = load <16 x i8>, <16 x i8>* %5
%9 = bitcast i8* %0 to <16 x i8>*
%10 = load <16 x i8>, <16 x i8>* %9
%11 = xor <16 x i8> %10, %8
%12 = call i8 @llvm.vector.reduce.or.v16i8(<16 x i8> %11)
%13 = zext i8 %12 to i32
%14 = add nuw nsw i32 %13, 511
%15 = lshr i32 %14, 8
%16 = and i32 %15, 1
%17 = add nsw i32 %16, -1
ret i32 %17
}