unsigned char *xmlSerializeHexCharRef(unsigned char *out, int val) {
  unsigned char *ptr;
  *out++ = '&';
  *out++ = '#';
  *out++ = 'x';
  if (val < 0x10)
    ptr = out;
  else if (val < 0x100)
    ptr = out + 1;
  else if (val < 0x1000)
    ptr = out + 2;
  else if (val < 0x10000)
    ptr = out + 3;
  else if (val < 0x100000)
    ptr = out + 4;
  else
    ptr = out + 5;
  out = ptr + 1;
  while (val > 0) {
    switch (val & 0xF) {
    case 0:
      *ptr-- = '0';
      break;
    case 1:
      *ptr-- = '1';
      break;
    case 2:
      *ptr-- = '2';
      break;
    case 3:
      *ptr-- = '3';
      break;
    case 4:
      *ptr-- = '4';
      break;
    case 5:
      *ptr-- = '5';
      break;
    case 6:
      *ptr-- = '6';
      break;
    case 7:
      *ptr-- = '7';
      break;
    case 8:
      *ptr-- = '8';
      break;
    case 9:
      *ptr-- = '9';
      break;
    case 0xA:
      *ptr-- = 'A';
      break;
    case 0xB:
      *ptr-- = 'B';
      break;
    case 0xC:
      *ptr-- = 'C';
      break;
    case 0xD:
      *ptr-- = 'D';
      break;
    case 0xE:
      *ptr-- = 'E';
      break;
    case 0xF:
      *ptr-- = 'F';
      break;
    default:
      *ptr-- = '0';
      break;
    }
    val >>= 4;
  }
  *out++ = ';';
  *out = 0;
  return (out);
}


x86 assembly (clang, -O0):
<xmlSerializeHexCharRef>:
push   %rbp
mov    %rsp,%rbp
mov    %rdi,-0x8(%rbp)
mov    %esi,-0xc(%rbp)
mov    -0x8(%rbp),%rax
mov    %rax,%rcx
add    $0x1,%rcx
mov    %rcx,-0x8(%rbp)
movb   $0x26,(%rax)
mov    -0x8(%rbp),%rax
mov    %rax,%rcx
add    $0x1,%rcx
mov    %rcx,-0x8(%rbp)
movb   $0x23,(%rax)
mov    -0x8(%rbp),%rax
mov    %rax,%rcx
add    $0x1,%rcx
mov    %rcx,-0x8(%rbp)
movb   $0x78,(%rax)
cmpl   $0x10,-0xc(%rbp)
jge    1158 <xmlSerializeHexCharRef+0x58>
mov    -0x8(%rbp),%rax
mov    %rax,-0x18(%rbp)
jmp    11f0 <xmlSerializeHexCharRef+0xf0>
cmpl   $0x100,-0xc(%rbp)
jge    1176 <xmlSerializeHexCharRef+0x76>
mov    -0x8(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x18(%rbp)
jmp    11eb <xmlSerializeHexCharRef+0xeb>
cmpl   $0x1000,-0xc(%rbp)
jge    1194 <xmlSerializeHexCharRef+0x94>
mov    -0x8(%rbp),%rax
add    $0x2,%rax
mov    %rax,-0x18(%rbp)
jmp    11e6 <xmlSerializeHexCharRef+0xe6>
cmpl   $0x10000,-0xc(%rbp)
jge    11b2 <xmlSerializeHexCharRef+0xb2>
mov    -0x8(%rbp),%rax
add    $0x3,%rax
mov    %rax,-0x18(%rbp)
jmp    11e1 <xmlSerializeHexCharRef+0xe1>
cmpl   $0x100000,-0xc(%rbp)
jge    11d0 <xmlSerializeHexCharRef+0xd0>
mov    -0x8(%rbp),%rax
add    $0x4,%rax
mov    %rax,-0x18(%rbp)
jmp    11dc <xmlSerializeHexCharRef+0xdc>
mov    -0x8(%rbp),%rax
add    $0x5,%rax
mov    %rax,-0x18(%rbp)
jmp    11e1 <xmlSerializeHexCharRef+0xe1>
jmp    11e6 <xmlSerializeHexCharRef+0xe6>
jmp    11eb <xmlSerializeHexCharRef+0xeb>
jmp    11f0 <xmlSerializeHexCharRef+0xf0>
mov    -0x18(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x8(%rbp)
cmpl   $0x0,-0xc(%rbp)
jle    13bd <xmlSerializeHexCharRef+0x2bd>
mov    -0xc(%rbp),%eax
and    $0xf,%eax
mov    %rax,-0x20(%rbp)
sub    $0xf,%eax
ja     139d <xmlSerializeHexCharRef+0x29d>
mov    -0x20(%rbp),%rax
lea    0xddc(%rip),%rcx
movslq (%rcx,%rax,4),%rax
add    %rcx,%rax
jmp    *%rax
mov    -0x18(%rbp),%rax
mov    %rax,%rcx
add    $0xffffffffffffffff,%rcx
mov    %rcx,-0x18(%rbp)
movb   $0x30,(%rax)
jmp    13af <xmlSerializeHexCharRef+0x2af>
mov    -0x18(%rbp),%rax
mov    %rax,%rcx
add    $0xffffffffffffffff,%rcx
mov    %rcx,-0x18(%rbp)
movb   $0x31,(%rax)
jmp    13af <xmlSerializeHexCharRef+0x2af>
mov    -0x18(%rbp),%rax
mov    %rax,%rcx
add    $0xffffffffffffffff,%rcx
mov    %rcx,-0x18(%rbp)
movb   $0x32,(%rax)
jmp    13af <xmlSerializeHexCharRef+0x2af>
mov    -0x18(%rbp),%rax
mov    %rax,%rcx
add    $0xffffffffffffffff,%rcx
mov    %rcx,-0x18(%rbp)
movb   $0x33,(%rax)
jmp    13af <xmlSerializeHexCharRef+0x2af>
mov    -0x18(%rbp),%rax
mov    %rax,%rcx
add    $0xffffffffffffffff,%rcx
mov    %rcx,-0x18(%rbp)
movb   $0x34,(%rax)
jmp    13af <xmlSerializeHexCharRef+0x2af>
mov    -0x18(%rbp),%rax
mov    %rax,%rcx
add    $0xffffffffffffffff,%rcx
mov    %rcx,-0x18(%rbp)
movb   $0x35,(%rax)
jmp    13af <xmlSerializeHexCharRef+0x2af>
mov    -0x18(%rbp),%rax
mov    %rax,%rcx
add    $0xffffffffffffffff,%rcx
mov    %rcx,-0x18(%rbp)
movb   $0x36,(%rax)
jmp    13af <xmlSerializeHexCharRef+0x2af>
mov    -0x18(%rbp),%rax
mov    %rax,%rcx
add    $0xffffffffffffffff,%rcx
mov    %rcx,-0x18(%rbp)
movb   $0x37,(%rax)
jmp    13af <xmlSerializeHexCharRef+0x2af>
mov    -0x18(%rbp),%rax
mov    %rax,%rcx
add    $0xffffffffffffffff,%rcx
mov    %rcx,-0x18(%rbp)
movb   $0x38,(%rax)
jmp    13af <xmlSerializeHexCharRef+0x2af>
mov    -0x18(%rbp),%rax
mov    %rax,%rcx
add    $0xffffffffffffffff,%rcx
mov    %rcx,-0x18(%rbp)
movb   $0x39,(%rax)
jmp    13af <xmlSerializeHexCharRef+0x2af>
mov    -0x18(%rbp),%rax
mov    %rax,%rcx
add    $0xffffffffffffffff,%rcx
mov    %rcx,-0x18(%rbp)
movb   $0x41,(%rax)
jmp    13af <xmlSerializeHexCharRef+0x2af>
mov    -0x18(%rbp),%rax
mov    %rax,%rcx
add    $0xffffffffffffffff,%rcx
mov    %rcx,-0x18(%rbp)
movb   $0x42,(%rax)
jmp    13af <xmlSerializeHexCharRef+0x2af>
mov    -0x18(%rbp),%rax
mov    %rax,%rcx
add    $0xffffffffffffffff,%rcx
mov    %rcx,-0x18(%rbp)
movb   $0x43,(%rax)
jmp    13af <xmlSerializeHexCharRef+0x2af>
mov    -0x18(%rbp),%rax
mov    %rax,%rcx
add    $0xffffffffffffffff,%rcx
mov    %rcx,-0x18(%rbp)
movb   $0x44,(%rax)
jmp    13af <xmlSerializeHexCharRef+0x2af>
mov    -0x18(%rbp),%rax
mov    %rax,%rcx
add    $0xffffffffffffffff,%rcx
mov    %rcx,-0x18(%rbp)
movb   $0x45,(%rax)
jmp    13af <xmlSerializeHexCharRef+0x2af>
mov    -0x18(%rbp),%rax
mov    %rax,%rcx
add    $0xffffffffffffffff,%rcx
mov    %rcx,-0x18(%rbp)
movb   $0x46,(%rax)
jmp    13af <xmlSerializeHexCharRef+0x2af>
mov    -0x18(%rbp),%rax
mov    %rax,%rcx
add    $0xffffffffffffffff,%rcx
mov    %rcx,-0x18(%rbp)
movb   $0x30,(%rax)
mov    -0xc(%rbp),%eax
sar    $0x4,%eax
mov    %eax,-0xc(%rbp)
jmp    11fc <xmlSerializeHexCharRef+0xfc>
mov    -0x8(%rbp),%rax
mov    %rax,%rcx
add    $0x1,%rcx
mov    %rcx,-0x8(%rbp)
movb   $0x3b,(%rax)
mov    -0x8(%rbp),%rax
movb   $0x0,(%rax)
mov    -0x8(%rbp),%rax
pop    %rbp
ret

x86 assembly (clang, -O2):
<xmlSerializeHexCharRef>:
mov    %rdi,%rax
movw   $0x2326,(%rdi)
movb   $0x78,0x2(%rdi)
cmp    $0x10,%esi
jge    111b <xmlSerializeHexCharRef+0x1b>
add    $0x3,%rax
test   %esi,%esi
jg     1157 <xmlSerializeHexCharRef+0x57>
jmp    118c <xmlSerializeHexCharRef+0x8c>
cmp    $0xff,%esi
ja     1129 <xmlSerializeHexCharRef+0x29>
add    $0x4,%rax
jmp    1157 <xmlSerializeHexCharRef+0x57>
cmp    $0xfff,%esi
ja     1137 <xmlSerializeHexCharRef+0x37>
add    $0x5,%rax
jmp    1157 <xmlSerializeHexCharRef+0x57>
cmp    $0xffff,%esi
ja     1145 <xmlSerializeHexCharRef+0x45>
add    $0x6,%rax
jmp    1157 <xmlSerializeHexCharRef+0x57>
cmp    $0xfffff,%esi
ja     1153 <xmlSerializeHexCharRef+0x53>
add    $0x7,%rax
jmp    1157 <xmlSerializeHexCharRef+0x57>
add    $0x8,%rax
lea    0xea2(%rip),%r8
mov    %rax,%rdx
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax,%rax,1)
mov    %esi,%edi
and    $0xf,%edi
movzbl (%rdi,%r8,1),%ecx
mov    %cl,(%rdx)
add    $0xffffffffffffffff,%rdx
mov    %esi,%ecx
shr    $0x4,%ecx
cmp    $0xf,%esi
mov    %ecx,%esi
ja     1170 <xmlSerializeHexCharRef+0x70>
movw   $0x3b,0x1(%rax)
add    $0x2,%rax
ret

LLVM IR (-O0):
define i8* @xmlSerializeHexCharRef(i8* %0, i32 %1) {
%3 = alloca i8*
%4 = alloca i32
%5 = alloca i8*
store i8* %0, i8** %3
store i32 %1, i32* %4
%6 = load i8*, i8** %3
%7 = getelementptr inbounds i8, i8* %6, i32 1
store i8* %7, i8** %3
store i8 38, i8* %6
%8 = load i8*, i8** %3
%9 = getelementptr inbounds i8, i8* %8, i32 1
store i8* %9, i8** %3
store i8 35, i8* %8
%10 = load i8*, i8** %3
%11 = getelementptr inbounds i8, i8* %10, i32 1
store i8* %11, i8** %3
store i8 120, i8* %10
%12 = load i32, i32* %4
%13 = icmp slt i32 %12, 16
br i1 %13, label %14, label %16
14: ; preds = %2
%15 = load i8*, i8** %3
store i8* %15, i8** %5
br label %47
16: ; preds = %2
%17 = load i32, i32* %4
%18 = icmp slt i32 %17, 256
br i1 %18, label %19, label %22
19: ; preds = %16
%20 = load i8*, i8** %3
%21 = getelementptr inbounds i8, i8* %20, i64 1
store i8* %21, i8** %5
br label %46
22: ; preds = %16
%23 = load i32, i32* %4
%24 = icmp slt i32 %23, 4096
br i1 %24, label %25, label %28
25: ; preds = %22
%26 = load i8*, i8** %3
%27 = getelementptr inbounds i8, i8* %26, i64 2
store i8* %27, i8** %5
br label %45
28: ; preds = %22
%29 = load i32, i32* %4
%30 = icmp slt i32 %29, 65536
br i1 %30, label %31, label %34
31: ; preds = %28
%32 = load i8*, i8** %3
%33 = getelementptr inbounds i8, i8* %32, i64 3
store i8* %33, i8** %5
br label %44
34: ; preds = %28
%35 = load i32, i32* %4
%36 = icmp slt i32 %35, 1048576
br i1 %36, label %37, label %40
37: ; preds = %34
%38 = load i8*, i8** %3
%39 = getelementptr inbounds i8, i8* %38, i64 4
store i8* %39, i8** %5
br label %43
40: ; preds = %34
%41 = load i8*, i8** %3
%42 = getelementptr inbounds i8, i8* %41, i64 5
store i8* %42, i8** %5
br label %43
43: ; preds = %40, %37
br label %44
44: ; preds = %43, %31
br label %45
45: ; preds = %44, %25
br label %46
46: ; preds = %45, %19
br label %47
47: ; preds = %46, %14
%48 = load i8*, i8** %5
%49 = getelementptr inbounds i8, i8* %48, i64 1
store i8* %49, i8** %3
br label %50
50: ; preds = %107, %47
%51 = load i32, i32* %4
%52 = icmp sgt i32 %51, 0
br i1 %52, label %53, label %110
53: ; preds = %50
%54 = load i32, i32* %4
%55 = and i32 %54, 15
switch i32 %55, label %104 [
i32 0, label %56
i32 1, label %59
i32 2, label %62
i32 3, label %65
i32 4, label %68
i32 5, label %71
i32 6, label %74
i32 7, label %77
i32 8, label %80
i32 9, label %83
i32 10, label %86
i32 11, label %89
i32 12, label %92
i32 13, label %95
i32 14, label %98
i32 15, label %101
]
56: ; preds = %53
%57 = load i8*, i8** %5
%58 = getelementptr inbounds i8, i8* %57, i32 -1
store i8* %58, i8** %5
store i8 48, i8* %57
br label %107
59: ; preds = %53
%60 = load i8*, i8** %5
%61 = getelementptr inbounds i8, i8* %60, i32 -1
store i8* %61, i8** %5
store i8 49, i8* %60
br label %107
62: ; preds = %53
%63 = load i8*, i8** %5
%64 = getelementptr inbounds i8, i8* %63, i32 -1
store i8* %64, i8** %5
store i8 50, i8* %63
br label %107
65: ; preds = %53
%66 = load i8*, i8** %5
%67 = getelementptr inbounds i8, i8* %66, i32 -1
store i8* %67, i8** %5
store i8 51, i8* %66
br label %107
68: ; preds = %53
%69 = load i8*, i8** %5
%70 = getelementptr inbounds i8, i8* %69, i32 -1
store i8* %70, i8** %5
store i8 52, i8* %69
br label %107
71: ; preds = %53
%72 = load i8*, i8** %5
%73 = getelementptr inbounds i8, i8* %72, i32 -1
store i8* %73, i8** %5
store i8 53, i8* %72
br label %107
74: ; preds = %53
%75 = load i8*, i8** %5
%76 = getelementptr inbounds i8, i8* %75, i32 -1
store i8* %76, i8** %5
store i8 54, i8* %75
br label %107
77: ; preds = %53
%78 = load i8*, i8** %5
%79 = getelementptr inbounds i8, i8* %78, i32 -1
store i8* %79, i8** %5
store i8 55, i8* %78
br label %107
80: ; preds = %53
%81 = load i8*, i8** %5
%82 = getelementptr inbounds i8, i8* %81, i32 -1
store i8* %82, i8** %5
store i8 56, i8* %81
br label %107
83: ; preds = %53
%84 = load i8*, i8** %5
%85 = getelementptr inbounds i8, i8* %84, i32 -1
store i8* %85, i8** %5
store i8 57, i8* %84
br label %107
86: ; preds = %53
%87 = load i8*, i8** %5
%88 = getelementptr inbounds i8, i8* %87, i32 -1
store i8* %88, i8** %5
store i8 65, i8* %87
br label %107
89: ; preds = %53
%90 = load i8*, i8** %5
%91 = getelementptr inbounds i8, i8* %90, i32 -1
store i8* %91, i8** %5
store i8 66, i8* %90
br label %107
92: ; preds = %53
%93 = load i8*, i8** %5
%94 = getelementptr inbounds i8, i8* %93, i32 -1
store i8* %94, i8** %5
store i8 67, i8* %93
br label %107
95: ; preds = %53
%96 = load i8*, i8** %5
%97 = getelementptr inbounds i8, i8* %96, i32 -1
store i8* %97, i8** %5
store i8 68, i8* %96
br label %107
98: ; preds = %53
%99 = load i8*, i8** %5
%100 = getelementptr inbounds i8, i8* %99, i32 -1
store i8* %100, i8** %5
store i8 69, i8* %99
br label %107
101: ; preds = %53
%102 = load i8*, i8** %5
%103 = getelementptr inbounds i8, i8* %102, i32 -1
store i8* %103, i8** %5
store i8 70, i8* %102
br label %107
104: ; preds = %53
%105 = load i8*, i8** %5
%106 = getelementptr inbounds i8, i8* %105, i32 -1
store i8* %106, i8** %5
store i8 48, i8* %105
br label %107
107: ; preds = %104, %101, %98, %95, %92, %89, %86, %83, %80, %77, %74, %71, %68, %65, %62, %59, %56
%108 = load i32, i32* %4
%109 = ashr i32 %108, 4
store i32 %109, i32* %4
br label %50
110: ; preds = %50
%111 = load i8*, i8** %3
%112 = getelementptr inbounds i8, i8* %111, i32 1
store i8* %112, i8** %3
store i8 59, i8* %111
%113 = load i8*, i8** %3
store i8 0, i8* %113
%114 = load i8*, i8** %3
ret i8* %114
}

LLVM IR (-O2):
@switch.table.xmlSerializeHexCharRef = [16 x i8] c"0123456789ABCDEF"
define i8* @xmlSerializeHexCharRef(i8* writeonly %0, i32 %1) {
%3 = getelementptr inbounds i8, i8* %0, i64 1
store i8 38, i8* %0
%4 = getelementptr inbounds i8, i8* %0, i64 2
store i8 35, i8* %3
store i8 120, i8* %4
%5 = icmp slt i32 %1, 16
br i1 %5, label %24, label %6
6: ; preds = %2
%7 = icmp ult i32 %1, 256
br i1 %7, label %8, label %10
8: ; preds = %6
%9 = getelementptr inbounds i8, i8* %0, i64 4
br label %27
10: ; preds = %6
%11 = icmp ult i32 %1, 4096
br i1 %11, label %12, label %14
12: ; preds = %10
%13 = getelementptr inbounds i8, i8* %0, i64 5
br label %27
14: ; preds = %10
%15 = icmp ult i32 %1, 65536
br i1 %15, label %16, label %18
16: ; preds = %14
%17 = getelementptr inbounds i8, i8* %0, i64 6
br label %27
18: ; preds = %14
%19 = icmp ult i32 %1, 1048576
br i1 %19, label %20, label %22
20: ; preds = %18
%21 = getelementptr inbounds i8, i8* %0, i64 7
br label %27
22: ; preds = %18
%23 = getelementptr inbounds i8, i8* %0, i64 8
br label %27
24: ; preds = %2
%25 = getelementptr inbounds i8, i8* %0, i64 3
%26 = icmp sgt i32 %1, 0
br i1 %26, label %27, label %39
27: ; preds = %12, %20, %22, %16, %8, %24
%28 = phi i8* [ %25, %24 ], [ %23, %22 ], [ %21, %20 ], [ %17, %16 ], [ %13, %12 ], [ %9, %8 ]
br label %29
29: ; preds = %27, %29
%30 = phi i8* [ %36, %29 ], [ %28, %27 ]
%31 = phi i32 [ %37, %29 ], [ %1, %27 ]
%32 = and i32 %31, 15
%33 = zext i32 %32 to i64
%34 = getelementptr inbounds [16 x i8], [16 x i8]* @switch.table.xmlSerializeHexCharRef, i64 0, i64 %33
%35 = load i8, i8* %34
store i8 %35, i8* %30
%36 = getelementptr inbounds i8, i8* %30, i64 -1
%37 = lshr i32 %31, 4
%38 = icmp ult i32 %31, 16
br i1 %38, label %39, label %29
39: ; preds = %29, %24
%40 = phi i8* [ %25, %24 ], [ %28, %29 ]
%41 = getelementptr inbounds i8, i8* %40, i64 1
%42 = getelementptr inbounds i8, i8* %40, i64 2
store i8 59, i8* %41
store i8 0, i8* %42
ret i8* %42
}