#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
scalar_t__ crypto_onetimeauth_poly1305_verify(unsigned char const *,
                                              unsigned char const *,
                                              unsigned long long,
                                              unsigned char *);
int /*<<< orphan*/ crypto_stream_xsalsa(unsigned char *, int,
                                        unsigned char const *,
                                        unsigned char const *, unsigned int);
int /*<<< orphan*/
crypto_stream_xsalsa_xor(unsigned char *, unsigned char const *,
                         unsigned long long, unsigned char const *,
                         unsigned char const *, unsigned int);
int crypto_secretbox_xsalsa_open(unsigned char *m, const unsigned char *c,
                                 unsigned long long clen,
                                 const unsigned char *n, const unsigned char *k,
                                 unsigned int rounds) {
  int i;
  unsigned char subkey[32];
  if (clen < 32)
    return -1;
  crypto_stream_xsalsa(subkey, 32, n, k, rounds);
  if (crypto_onetimeauth_poly1305_verify(c + 16, c + 32, clen - 32, subkey) !=
      0)
    return -1;
  crypto_stream_xsalsa_xor(m, c, clen, n, k, rounds);
  for (i = 0; i < 32; ++i)
    m[i] = 0;
  return 0;
}


x86 assembly (clang, -O0):
<crypto_secretbox_xsalsa_open>:
push   %rbp
mov    %rsp,%rbp
sub    $0x60,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %rcx,-0x28(%rbp)
mov    %r8,-0x30(%rbp)
mov    %r9d,-0x34(%rbp)
cmpq   $0x20,-0x20(%rbp)
jae    1167 <crypto_secretbox_xsalsa_open+0x37>
movl   $0xffffffff,-0x4(%rbp)
jmp    1207 <crypto_secretbox_xsalsa_open+0xd7>
lea    -0x60(%rbp),%rdi
mov    -0x28(%rbp),%rdx
mov    -0x30(%rbp),%rcx
mov    -0x34(%rbp),%r8d
mov    $0x20,%esi
call   1030 <crypto_stream_xsalsa@plt>
mov    -0x18(%rbp),%rdi
add    $0x10,%rdi
mov    -0x18(%rbp),%rsi
add    $0x20,%rsi
mov    -0x20(%rbp),%rdx
sub    $0x20,%rdx
lea    -0x60(%rbp),%rcx
call   1040 <crypto_onetimeauth_poly1305_verify@plt>
cmp    $0x0,%rax
je     11b8 <crypto_secretbox_xsalsa_open+0x88>
movl   $0xffffffff,-0x4(%rbp)
jmp    1207 <crypto_secretbox_xsalsa_open+0xd7>
mov    -0x10(%rbp),%rdi
mov    -0x18(%rbp),%rsi
mov    -0x20(%rbp),%rdx
mov    -0x28(%rbp),%rcx
mov    -0x30(%rbp),%r8
mov    -0x34(%rbp),%r9d
call   1050 <crypto_stream_xsalsa_xor@plt>
movl   $0x0,-0x38(%rbp)
cmpl   $0x20,-0x38(%rbp)
jge    1200 <crypto_secretbox_xsalsa_open+0xd0>
mov    -0x10(%rbp),%rax
movslq -0x38(%rbp),%rcx
movb   $0x0,(%rax,%rcx,1)
mov    -0x38(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x38(%rbp)
jmp    11dc <crypto_secretbox_xsalsa_open+0xac>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x60,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<crypto_secretbox_xsalsa_open>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x38,%rsp
mov    $0xffffffff,%ebp
cmp    $0x20,%rdx
jb     11b9 <crypto_secretbox_xsalsa_open+0x89>
mov    %r9d,%r15d
mov    %r8,%r12
mov    %rcx,%r13
mov    %rdx,%rbx
mov    %rsi,%r14
mov    %rdi,0x8(%rsp)
lea    0x10(%rsp),%rdi
mov    $0x20,%esi
mov    %rcx,%rdx
mov    %r8,%rcx
mov    %r9d,%r8d
call   1030 <crypto_stream_xsalsa@plt>
lea    0x10(%r14),%rdi
lea    0x20(%r14),%rsi
lea    -0x20(%rbx),%rdx
lea    0x10(%rsp),%rcx
call   1040 <crypto_onetimeauth_poly1305_verify@plt>
test   %rax,%rax
jne    11b9 <crypto_secretbox_xsalsa_open+0x89>
mov    0x8(%rsp),%rbp
mov    %rbp,%rdi
mov    %r14,%rsi
mov    %rbx,%rdx
mov    %r13,%rcx
mov    %r12,%r8
mov    %r15d,%r9d
call   1050 <crypto_stream_xsalsa_xor@plt>
xorps  %xmm0,%xmm0
movups %xmm0,0x0(%rbp)
movups %xmm0,0x10(%rbp)
xor    %ebp,%ebp
mov    %ebp,%eax
add    $0x38,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
define i32 @crypto_secretbox_xsalsa_open(i8* %0, i8* %1, i64 %2, i8* %3, i8* %4, i32 %5) {
%7 = alloca i32
%8 = alloca i8*
%9 = alloca i8*
%10 = alloca i64
%11 = alloca i8*
%12 = alloca i8*
%13 = alloca i32
%14 = alloca i32
%15 = alloca [32 x i8]
store i8* %0, i8** %8
store i8* %1, i8** %9
store i64 %2, i64* %10
store i8* %3, i8** %11
store i8* %4, i8** %12
store i32 %5, i32* %13
%16 = load i64, i64* %10
%17 = icmp ult i64 %16, 32
br i1 %17, label %18, label %19
18: ; preds = %6
store i32 -1, i32* %7
br label %55
19: ; preds = %6
%20 = getelementptr inbounds [32 x i8], [32 x i8]* %15, i64 0, i64 0
%21 = load i8*, i8** %11
%22 = load i8*, i8** %12
%23 = load i32, i32* %13
%24 = call i32 @crypto_stream_xsalsa(i8* %20, i32 32, i8* %21, i8* %22, i32 %23)
%25 = load i8*, i8** %9
%26 = getelementptr inbounds i8, i8* %25, i64 16
%27 = load i8*, i8** %9
%28 = getelementptr inbounds i8, i8* %27, i64 32
%29 = load i64, i64* %10
%30 = sub i64 %29, 32
%31 = getelementptr inbounds [32 x i8], [32 x i8]* %15, i64 0, i64 0
%32 = call i64 @crypto_onetimeauth_poly1305_verify(i8* %26, i8* %28, i64 %30, i8* %31)
%33 = icmp ne i64 %32, 0
br i1 %33, label %34, label %35
34: ; preds = %19
store i32 -1, i32* %7
br label %55
35: ; preds = %19
%36 = load i8*, i8** %8
%37 = load i8*, i8** %9
%38 = load i64, i64* %10
%39 = load i8*, i8** %11
%40 = load i8*, i8** %12
%41 = load i32, i32* %13
%42 = call i32 @crypto_stream_xsalsa_xor(i8* %36, i8* %37, i64 %38, i8* %39, i8* %40, i32 %41)
store i32 0, i32* %14
br label %43
43: ; preds = %51, %35
%44 = load i32, i32* %14
%45 = icmp slt i32 %44, 32
br i1 %45, label %46, label %54
46: ; preds = %43
%47 = load i8*, i8** %8
%48 = load i32, i32* %14
%49 = sext i32 %48 to i64
%50 = getelementptr inbounds i8, i8* %47, i64 %49
store i8 0, i8* %50
br label %51
51: ; preds = %46
%52 = load i32, i32* %14
%53 = add nsw i32 %52, 1
store i32 %53, i32* %14
br label %43
54: ; preds = %43
store i32 0, i32* %7
br label %55
55: ; preds = %54, %34, %18
%56 = load i32, i32* %7
ret i32 %56
}

LLVM IR (-O2):
define i32 @crypto_secretbox_xsalsa_open(i8* %0, i8* %1, i64 %2, i8* %3, i8* %4, i32 %5) {
%7 = alloca [32 x i8]
%8 = getelementptr inbounds [32 x i8], [32 x i8]* %7, i64 0, i64 0
%9 = icmp ult i64 %2, 32
br i1 %9, label %19, label %10
10: ; preds = %6
%11 = call i32 @crypto_stream_xsalsa(i8* %8, i32 32, i8* %3, i8* %4, i32 %5)
%12 = getelementptr inbounds i8, i8* %1, i64 16
%13 = getelementptr inbounds i8, i8* %1, i64 32
%14 = add i64 %2, -32
%15 = call i64 @crypto_onetimeauth_poly1305_verify(i8* %12, i8* %13, i64 %14, i8* %8)
%16 = icmp eq i64 %15, 0
br i1 %16, label %17, label %19
17: ; preds = %10
%18 = call i32 @crypto_stream_xsalsa_xor(i8* %0, i8* %1, i64 %2, i8* %3, i8* %4, i32 %5)
br label %19
19: ; preds = %17, %10, %6
%20 = phi i32 [ -1, %6 ], [ -1, %10 ], [ 0, %17 ]
ret i32 %20
}