#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ crypto_onetimeauth_poly1305(unsigned char *, unsigned char *,
                                               unsigned long long,
                                               unsigned char *);
int /*<<< orphan*/
crypto_stream_xsalsa_xor(unsigned char *, unsigned char const *,
                         unsigned long long, unsigned char const *,
                         unsigned char const *, unsigned int);
int crypto_secretbox_xsalsa(unsigned char *c, const unsigned char *m,
                            unsigned long long mlen, const unsigned char *n,
                            const unsigned char *k, unsigned int rounds) {
  int i;
  if (mlen < 32)
    return -1;
  crypto_stream_xsalsa_xor(c, m, mlen, n, k, rounds);
  crypto_onetimeauth_poly1305(c + 16, c + 32, mlen - 32, c);
  for (i = 0; i < 16; ++i)
    c[i] = 0;
  return 0;
}


x86 assembly (clang, -O0):
<crypto_secretbox_xsalsa>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %rcx,-0x28(%rbp)
mov    %r8,-0x30(%rbp)
mov    %r9d,-0x34(%rbp)
cmpq   $0x20,-0x20(%rbp)
jae    1157 <crypto_secretbox_xsalsa+0x37>
movl   $0xffffffff,-0x4(%rbp)
jmp    11c7 <crypto_secretbox_xsalsa+0xa7>
mov    -0x10(%rbp),%rdi
mov    -0x18(%rbp),%rsi
mov    -0x20(%rbp),%rdx
mov    -0x28(%rbp),%rcx
mov    -0x30(%rbp),%r8
mov    -0x34(%rbp),%r9d
call   1040 <crypto_stream_xsalsa_xor@plt>
mov    -0x10(%rbp),%rdi
add    $0x10,%rdi
mov    -0x10(%rbp),%rsi
add    $0x20,%rsi
mov    -0x20(%rbp),%rdx
sub    $0x20,%rdx
mov    -0x10(%rbp),%rcx
call   1030 <crypto_onetimeauth_poly1305@plt>
movl   $0x0,-0x38(%rbp)
cmpl   $0x10,-0x38(%rbp)
jge    11c0 <crypto_secretbox_xsalsa+0xa0>
mov    -0x10(%rbp),%rax
movslq -0x38(%rbp),%rcx
movb   $0x0,(%rax,%rcx,1)
mov    -0x38(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x38(%rbp)
jmp    119c <crypto_secretbox_xsalsa+0x7c>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<crypto_secretbox_xsalsa>:
mov    $0xffffffff,%eax
cmp    $0x20,%rdx
jb     1161 <crypto_secretbox_xsalsa+0x41>
push   %r14
push   %rbx
push   %rax
mov    %rdx,%rbx
mov    %rdi,%r14
call   1040 <crypto_stream_xsalsa_xor@plt>
lea    0x10(%r14),%rdi
lea    0x20(%r14),%rsi
add    $0xffffffffffffffe0,%rbx
mov    %rbx,%rdx
mov    %r14,%rcx
call   1030 <crypto_onetimeauth_poly1305@plt>
xorps  %xmm0,%xmm0
movups %xmm0,(%r14)
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
define i32 @crypto_secretbox_xsalsa(i8* %0, i8* %1, i64 %2, i8* %3, i8* %4, i32 %5) {
%7 = alloca i32
%8 = alloca i8*
%9 = alloca i8*
%10 = alloca i64
%11 = alloca i8*
%12 = alloca i8*
%13 = alloca i32
%14 = alloca i32
store i8* %0, i8** %8
store i8* %1, i8** %9
store i64 %2, i64* %10
store i8* %3, i8** %11
store i8* %4, i8** %12
store i32 %5, i32* %13
%15 = load i64, i64* %10
%16 = icmp ult i64 %15, 32
br i1 %16, label %17, label %18
17: ; preds = %6
store i32 -1, i32* %7
br label %46
18: ; preds = %6
%19 = load i8*, i8** %8
%20 = load i8*, i8** %9
%21 = load i64, i64* %10
%22 = load i8*, i8** %11
%23 = load i8*, i8** %12
%24 = load i32, i32* %13
%25 = call i32 @crypto_stream_xsalsa_xor(i8* %19, i8* %20, i64 %21, i8* %22, i8* %23, i32 %24)
%26 = load i8*, i8** %8
%27 = getelementptr inbounds i8, i8* %26, i64 16
%28 = load i8*, i8** %8
%29 = getelementptr inbounds i8, i8* %28, i64 32
%30 = load i64, i64* %10
%31 = sub i64 %30, 32
%32 = load i8*, i8** %8
%33 = call i32 @crypto_onetimeauth_poly1305(i8* %27, i8* %29, i64 %31, i8* %32)
store i32 0, i32* %14
br label %34
34: ; preds = %42, %18
%35 = load i32, i32* %14
%36 = icmp slt i32 %35, 16
br i1 %36, label %37, label %45
37: ; preds = %34
%38 = load i8*, i8** %8
%39 = load i32, i32* %14
%40 = sext i32 %39 to i64
%41 = getelementptr inbounds i8, i8* %38, i64 %40
store i8 0, i8* %41
br label %42
42: ; preds = %37
%43 = load i32, i32* %14
%44 = add nsw i32 %43, 1
store i32 %44, i32* %14
br label %34
45: ; preds = %34
store i32 0, i32* %7
br label %46
46: ; preds = %45, %17
%47 = load i32, i32* %7
ret i32 %47
}

LLVM IR (-O2):
define i32 @crypto_secretbox_xsalsa(i8* %0, i8* %1, i64 %2, i8* %3, i8* %4, i32 %5) {
%7 = icmp ult i64 %2, 32
br i1 %7, label %14, label %8
8: ; preds = %6
%9 = tail call i32 @crypto_stream_xsalsa_xor(i8* %0, i8* %1, i64 %2, i8* %3, i8* %4, i32 %5)
%10 = getelementptr inbounds i8, i8* %0, i64 16
%11 = getelementptr inbounds i8, i8* %0, i64 32
%12 = add i64 %2, -32
%13 = tail call i32 @crypto_onetimeauth_poly1305(i8* %10, i8* %11, i64 %12, i8* %0)
br label %14
14: ; preds = %8, %6
%15 = phi i32 [ -1, %6 ], [ 0, %8 ]
ret i32 %15
}