#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ EVP_MD;
typedef int /*<<< orphan*/ EVP_CIPHER_CTX;
typedef int /*<<< orphan*/ EVP_CIPHER;
typedef int /*<<< orphan*/ EC_KEY;
typedef int /*<<< orphan*/ BIGNUM;

/* Variables and functions */
int /*<<< orphan*/ *BN_bin2bn(unsigned char const *, size_t,
                              int /*<<< orphan*/ *);
int /*<<< orphan*/ BN_bn2bin(int /*<<< orphan*/ *, unsigned char *);
int /*<<< orphan*/ *BN_new();
size_t BN_num_bytes(int /*<<< orphan*/ *);
int /*<<< orphan*/ BN_print_fp(int /*<<< orphan*/, int /*<<< orphan*/ *);
scalar_t__ EC_KEY_private_derive_S(int /*<<< orphan*/ const *,
                                   int /*<<< orphan*/ *, int /*<<< orphan*/ *);
int /*<<< orphan*/ *EVP_CIPHER_CTX_new();
size_t EVP_CIPHER_iv_length(int /*<<< orphan*/ const *);
size_t EVP_CIPHER_key_length(int /*<<< orphan*/ const *);
int /*<<< orphan*/ EVP_DecryptFinal_ex(int /*<<< orphan*/ *, unsigned char *,
                                       int *);
int /*<<< orphan*/ EVP_DecryptInit_ex(int /*<<< orphan*/ *,
                                      int /*<<< orphan*/ const *,
                                      int /*<<< orphan*/ *, unsigned char *,
                                      unsigned char *);
int /*<<< orphan*/ EVP_DecryptUpdate(int /*<<< orphan*/ *, unsigned char *,
                                     int *, unsigned char const *, size_t);
size_t EVP_MD_block_size(int /*<<< orphan*/ const *);
int /*<<< orphan*/ *EVP_aes_256_cbc();
int /*<<< orphan*/ *EVP_sha1();
int /*<<< orphan*/ HMAC(int /*<<< orphan*/ const *, unsigned char *, size_t,
                        unsigned char const *, size_t, unsigned char *,
                        unsigned int *);
int /*<<< orphan*/ PKCS5_PBKDF2_HMAC(char const *, size_t,
                                     unsigned char const *, size_t, int,
                                     int /*<<< orphan*/ const *, size_t,
                                     unsigned char *);
scalar_t__ memcmp(unsigned char *, unsigned char const *, unsigned int);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ stdout;
int decipher(const EC_KEY *key, const unsigned char *R_in, size_t R_len,
             const unsigned char *c_in, size_t c_len, const unsigned char *d_in,
             size_t d_len, const unsigned char *salt, size_t salt_len) {
  BIGNUM *R = BN_bin2bn(R_in, R_len, BN_new());
  BIGNUM *S = BN_new();
  if (EC_KEY_private_derive_S(key, R, S) != 0) {
    printf("Key derivation failed\n");
    return -1;
  }
  printf("S_decipher = ");
  BN_print_fp(stdout, S);
  printf("\n");
  size_t S_len = BN_num_bytes(S);
  unsigned char password[S_len];
  BN_bn2bin(S, password);
  const EVP_MD *md = EVP_sha1();
  const EVP_CIPHER *cipher = EVP_aes_256_cbc();
  size_t ke_len = EVP_CIPHER_key_length(cipher) + EVP_CIPHER_iv_length(cipher);
  size_t km_len = EVP_MD_block_size(md);
  unsigned char ke_km[ke_len + km_len];
  unsigned char dc_out[2048] = {0};
  size_t dc_len = 0;
  int outl = 0;
  PKCS5_PBKDF2_HMAC((const char *)password, S_len, salt, salt_len, 2000, md,
                    ke_len + km_len, ke_km);
  unsigned char dv_out[km_len];
  unsigned int dv_len;
  HMAC(md, ke_km + ke_len, km_len, c_in, c_len, dv_out, &dv_len);
  if (d_len != dv_len || memcmp(dv_out, d_in, dv_len) != 0)
    printf("MAC verification failed\n");
  EVP_CIPHER_CTX *ectx = EVP_CIPHER_CTX_new();
  EVP_DecryptInit_ex(ectx, cipher, NULL, ke_km,
                     ke_km + EVP_CIPHER_key_length(cipher));
  EVP_DecryptUpdate(ectx, dc_out + dc_len, &outl, c_in, c_len);
  dc_len += outl;
  EVP_DecryptFinal_ex(ectx, dc_out + dc_len, &outl);
  dc_len += outl;
  dc_out[dc_len] = 0;
  printf("%s\n", dc_out);
  return 0;
}


x86 assembly (clang, -O0):
<decipher>:
push   %rbp
mov    %rsp,%rbp
sub    $0x910,%rsp
mov    0x20(%rbp),%rax
mov    0x18(%rbp),%rax
mov    0x10(%rbp),%rax
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %rcx,-0x28(%rbp)
mov    %r8,-0x30(%rbp)
mov    %r9,-0x38(%rbp)
mov    -0x18(%rbp),%rax
mov    %rax,-0x8c8(%rbp)
mov    -0x20(%rbp),%rax
mov    %rax,-0x8c0(%rbp)
mov    $0x0,%al
call   1040 <BN_new@plt>
mov    -0x8c8(%rbp),%rdi
mov    -0x8c0(%rbp),%rsi
mov    %rax,%rdx
call   1090 <BN_bin2bn@plt>
mov    %rax,-0x40(%rbp)
mov    $0x0,%al
call   1040 <BN_new@plt>
mov    %rax,-0x48(%rbp)
mov    -0x10(%rbp),%rdi
mov    -0x40(%rbp),%rsi
mov    -0x48(%rbp),%rdx
call   1070 <EC_KEY_private_derive_S@plt>
cmp    $0x0,%rax
je     12e6 <decipher+0xa6>
lea    0xd2d(%rip),%rdi
mov    $0x0,%al
call   10a0 <printf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    15f0 <decipher+0x3b0>
lea    0xd2a(%rip),%rdi
xor    %eax,%eax
mov    %eax,-0x8e4(%rbp)
mov    %al,-0x8f1(%rbp)
call   10a0 <printf@plt>
mov    0x2cd9(%rip),%rax
mov    (%rax),%edi
mov    -0x48(%rbp),%rsi
call   10e0 <BN_print_fp@plt>
mov    -0x8f1(%rbp),%al
lea    0xd1d(%rip),%rdi
call   10a0 <printf@plt>
mov    -0x48(%rbp),%rdi
call   1110 <BN_num_bytes@plt>
mov    %rax,-0x50(%rbp)
mov    -0x50(%rbp),%rax
mov    %rsp,%rcx
mov    %rcx,-0x58(%rbp)
mov    %rax,%rcx
add    $0xf,%rcx
and    $0xfffffffffffffff0,%rcx
mov    %rsp,%rsi
sub    %rcx,%rsi
mov    %rsi,-0x8e0(%rbp)
mov    %rsi,%rsp
mov    %rax,-0x60(%rbp)
mov    -0x48(%rbp),%rdi
call   1120 <BN_bn2bin@plt>
mov    -0x8f1(%rbp),%al
call   1080 <EVP_sha1@plt>
mov    %rax,%rcx
mov    -0x8f1(%rbp),%al
mov    %rcx,-0x68(%rbp)
call   1050 <EVP_aes_256_cbc@plt>
mov    %rax,-0x70(%rbp)
mov    -0x70(%rbp),%rdi
call   1140 <EVP_CIPHER_key_length@plt>
mov    %rax,-0x8f0(%rbp)
mov    -0x70(%rbp),%rdi
call   10d0 <EVP_CIPHER_iv_length@plt>
mov    %rax,%rcx
mov    -0x8f0(%rbp),%rax
add    %rcx,%rax
mov    %rax,-0x78(%rbp)
mov    -0x68(%rbp),%rdi
call   1160 <EVP_MD_block_size@plt>
mov    -0x8e4(%rbp),%esi
mov    %rax,-0x80(%rbp)
mov    -0x78(%rbp),%rcx
mov    -0x80(%rbp),%rdx
mov    %rcx,%rax
add    %rdx,%rax
lea    0xf(%rcx,%rdx,1),%rdx
and    $0xfffffffffffffff0,%rdx
mov    %rsp,%rcx
sub    %rdx,%rcx
mov    %rcx,-0x8d8(%rbp)
mov    %rcx,%rsp
mov    %rax,-0x88(%rbp)
lea    -0x890(%rbp),%rdi
mov    $0x800,%edx
call   10b0 <memset@plt>
mov    -0x8e0(%rbp),%rdi
mov    -0x8d8(%rbp),%r10
movq   $0x0,-0x898(%rbp)
movl   $0x0,-0x89c(%rbp)
mov    -0x50(%rbp),%rsi
mov    0x18(%rbp),%rdx
mov    0x20(%rbp),%rcx
mov    -0x68(%rbp),%r9
mov    -0x78(%rbp),%r8
mov    -0x80(%rbp),%rax
add    %rax,%r8
sub    $0x10,%rsp
mov    %rsp,%rax
mov    %r10,0x8(%rax)
mov    %r8,(%rax)
mov    $0x7d0,%r8d
call   1060 <PKCS5_PBKDF2_HMAC@plt>
mov    -0x8d8(%rbp),%rsi
add    $0x10,%rsp
mov    -0x80(%rbp),%rax
mov    %rax,%rcx
add    $0xf,%rcx
and    $0xfffffffffffffff0,%rcx
mov    %rsp,%r9
sub    %rcx,%r9
mov    %r9,-0x8d0(%rbp)
mov    %r9,%rsp
mov    %rax,-0x8a8(%rbp)
mov    -0x68(%rbp),%rdi
add    -0x78(%rbp),%rsi
mov    -0x80(%rbp),%rdx
mov    -0x28(%rbp),%rcx
mov    -0x30(%rbp),%r8
lea    -0x8ac(%rbp),%rax
sub    $0x10,%rsp
mov    %rax,(%rsp)
call   10f0 <HMAC@plt>
add    $0x10,%rsp
mov    0x10(%rbp),%rax
mov    -0x8ac(%rbp),%ecx
cmp    %rcx,%rax
jne    14e8 <decipher+0x2a8>
mov    -0x8d0(%rbp),%rdi
mov    -0x38(%rbp),%rsi
mov    -0x8ac(%rbp),%edx
call   10c0 <memcmp@plt>
cmp    $0x0,%rax
je     14f6 <decipher+0x2b6>
lea    0xb36(%rip),%rdi
mov    $0x0,%al
call   10a0 <printf@plt>
mov    $0x0,%al
call   1130 <EVP_CIPHER_CTX_new@plt>
mov    %rax,-0x8b8(%rbp)
mov    -0x8b8(%rbp),%rax
mov    %rax,-0x908(%rbp)
mov    -0x70(%rbp),%rax
mov    %rax,-0x900(%rbp)
mov    -0x70(%rbp),%rdi
call   1140 <EVP_CIPHER_key_length@plt>
mov    -0x908(%rbp),%rdi
mov    -0x900(%rbp),%rsi
mov    -0x8d8(%rbp),%rcx
mov    %rcx,%r8
add    %rax,%r8
xor    %eax,%eax
mov    %eax,%edx
call   1100 <EVP_DecryptInit_ex@plt>
mov    -0x8b8(%rbp),%rdi
lea    -0x890(%rbp),%rsi
add    -0x898(%rbp),%rsi
mov    -0x28(%rbp),%rcx
mov    -0x30(%rbp),%r8
lea    -0x89c(%rbp),%rdx
call   1150 <EVP_DecryptUpdate@plt>
movslq -0x89c(%rbp),%rax
add    -0x898(%rbp),%rax
mov    %rax,-0x898(%rbp)
mov    -0x8b8(%rbp),%rdi
lea    -0x890(%rbp),%rsi
add    -0x898(%rbp),%rsi
lea    -0x89c(%rbp),%rdx
call   1030 <EVP_DecryptFinal_ex@plt>
movslq -0x89c(%rbp),%rax
add    -0x898(%rbp),%rax
mov    %rax,-0x898(%rbp)
mov    -0x898(%rbp),%rax
movb   $0x0,-0x890(%rbp,%rax,1)
lea    -0x890(%rbp),%rsi
lea    0xa63(%rip),%rdi
mov    $0x0,%al
call   10a0 <printf@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x58(%rbp),%rax
mov    %rax,%rsp
mov    -0x4(%rbp),%eax
mov    %rbp,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<decipher>:
push   %rbp
mov    %rsp,%rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x848,%rsp
mov    %r9,%r13
mov    %r8,%r12
mov    %rcx,-0x40(%rbp)
mov    %rdx,%r14
mov    %rsi,%rbx
mov    %rdi,%r15
xor    %eax,%eax
call   1060 <BN_new@plt>
mov    %rbx,%rdi
mov    %r14,%rsi
mov    %rax,%rdx
call   10b0 <BN_bin2bn@plt>
mov    %rax,%rbx
xor    %eax,%eax
call   1060 <BN_new@plt>
mov    %rax,%r14
mov    %r15,%rdi
mov    %rbx,%rsi
mov    %rax,%rdx
call   1090 <EC_KEY_private_derive_S@plt>
test   %rax,%rax
je     12d3 <decipher+0x73>
lea    0xd63(%rip),%rdi
call   1050 <puts@plt>
mov    $0xffffffff,%r14d
jmp    14aa <decipher+0x24a>
mov    %r13,-0x48(%rbp)
lea    0xd22(%rip),%rdi
xor    %eax,%eax
call   10c0 <printf@plt>
mov    0x2cf4(%rip),%rax
mov    (%rax),%edi
mov    %r14,%rsi
call   1100 <BN_print_fp@plt>
mov    $0xa,%edi
call   1040 <putchar@plt>
mov    %r14,%rdi
call   1130 <BN_num_bytes@plt>
mov    %rax,-0x58(%rbp)
mov    %rsp,-0x68(%rbp)
mov    %r12,-0x38(%rbp)
mov    %rsp,%r12
lea    0xf(%rax),%rcx
and    $0xfffffffffffffff0,%rcx
sub    %rcx,%r12
mov    %r12,%rsp
mov    %r14,%rdi
mov    %r12,%rsi
call   1140 <BN_bn2bin@plt>
xor    %eax,%eax
call   10a0 <EVP_sha1@plt>
mov    %rax,%r15
mov    %rax,-0x50(%rbp)
xor    %eax,%eax
call   1070 <EVP_aes_256_cbc@plt>
mov    %rax,%rbx
mov    %rax,%rdi
call   1160 <EVP_CIPHER_key_length@plt>
mov    %rax,%r14
mov    %rbx,-0x60(%rbp)
mov    %rbx,%rdi
call   10f0 <EVP_CIPHER_iv_length@plt>
add    %rax,%r14
mov    %r15,%rdi
call   1180 <EVP_MD_block_size@plt>
mov    %rax,%r15
lea    (%r14,%rax,1),%rbx
add    %r14,%rax
add    $0xf,%rax
and    $0xfffffffffffffff0,%rax
mov    %rsp,%r13
sub    %rax,%r13
mov    %r13,%rsp
lea    -0x870(%rbp),%rdi
mov    $0x800,%edx
xor    %esi,%esi
call   10d0 <memset@plt>
movl   $0x0,-0x2c(%rbp)
mov    %r12,%rdi
mov    -0x58(%rbp),%rsi
mov    0x18(%rbp),%rdx
mov    0x20(%rbp),%rcx
mov    $0x7d0,%r8d
mov    -0x50(%rbp),%r12
mov    %r12,%r9
push   %r13
push   %rbx
call   1080 <PKCS5_PBKDF2_HMAC@plt>
add    $0x10,%rsp
mov    %rsp,%rbx
lea    0xf(%r15),%rax
and    $0xfffffffffffffff0,%rax
sub    %rax,%rbx
mov    %rbx,%rsp
add    %r13,%r14
sub    $0x8,%rsp
lea    -0x30(%rbp),%rax
mov    %r12,%rdi
mov    %r14,%rsi
mov    %r15,%rdx
mov    -0x40(%rbp),%rcx
mov    -0x38(%rbp),%r8
mov    %rbx,%r9
push   %rax
call   1110 <HMAC@plt>
add    $0x10,%rsp
mov    -0x30(%rbp),%edx
cmp    0x10(%rbp),%rdx
jne    141b <decipher+0x1bb>
mov    %rbx,%rdi
mov    -0x48(%rbp),%rsi
call   10e0 <memcmp@plt>
test   %rax,%rax
je     1427 <decipher+0x1c7>
lea    0xbec(%rip),%rdi
call   1050 <puts@plt>
xor    %r14d,%r14d
xor    %eax,%eax
call   1150 <EVP_CIPHER_CTX_new@plt>
mov    %rax,%r15
mov    -0x60(%rbp),%rbx
mov    %rbx,%rdi
call   1160 <EVP_CIPHER_key_length@plt>
lea    (%rax,%r13,1),%r8
mov    %r15,%rdi
mov    %rbx,%rsi
xor    %edx,%edx
mov    %r13,%rcx
call   1120 <EVP_DecryptInit_ex@plt>
lea    -0x870(%rbp),%r13
lea    -0x2c(%rbp),%r12
mov    %r15,%rdi
mov    %r13,%rsi
mov    %r12,%rdx
mov    -0x40(%rbp),%rcx
mov    -0x38(%rbp),%r8
call   1170 <EVP_DecryptUpdate@plt>
movslq -0x2c(%rbp),%rbx
lea    (%rbx,%rbp,1),%rsi
add    $0xfffffffffffff790,%rsi
mov    %r15,%rdi
mov    %r12,%rdx
call   1030 <EVP_DecryptFinal_ex@plt>
movslq -0x2c(%rbp),%rax
add    %rbx,%rax
movb   $0x0,-0x870(%rbp,%rax,1)
mov    %r13,%rdi
call   1050 <puts@plt>
mov    -0x68(%rbp),%rsp
mov    %r14d,%eax
lea    -0x28(%rbp),%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [23 x i8] c"Key derivation failed\0A\00"
@.str.1 = [14 x i8] c"S_decipher = \00"
@stdout = global i32 0
@.str.2 = [2 x i8] c"\0A\00"
@.str.3 = [25 x i8] c"MAC verification failed\0A\00"
@.str.4 = [4 x i8] c"%s\0A\00"
define i32 @decipher(i32* %0, i8* %1, i64 %2, i8* %3, i64 %4, i8* %5, i64 %6, i8* %7, i64 %8) {
%10 = alloca i32
%11 = alloca i32*
%12 = alloca i8*
%13 = alloca i64
%14 = alloca i8*
%15 = alloca i64
%16 = alloca i8*
%17 = alloca i64
%18 = alloca i8*
%19 = alloca i64
%20 = alloca i32*
%21 = alloca i32*
%22 = alloca i64
%23 = alloca i8*
%24 = alloca i64
%25 = alloca i32*
%26 = alloca i32*
%27 = alloca i64
%28 = alloca i64
%29 = alloca i64
%30 = alloca [2048 x i8]
%31 = alloca i64
%32 = alloca i32
%33 = alloca i64
%34 = alloca i32
%35 = alloca i32*
store i32* %0, i32** %11
store i8* %1, i8** %12
store i64 %2, i64* %13
store i8* %3, i8** %14
store i64 %4, i64* %15
store i8* %5, i8** %16
store i64 %6, i64* %17
store i8* %7, i8** %18
store i64 %8, i64* %19
%36 = load i8*, i8** %12
%37 = load i64, i64* %13
%38 = call i32* (...) @BN_new()
%39 = call i32* @BN_bin2bn(i8* %36, i64 %37, i32* %38)
store i32* %39, i32** %20
%40 = call i32* (...) @BN_new()
store i32* %40, i32** %21
%41 = load i32*, i32** %11
%42 = load i32*, i32** %20
%43 = load i32*, i32** %21
%44 = call i64 @EC_KEY_private_derive_S(i32* %41, i32* %42, i32* %43)
%45 = icmp ne i64 %44, 0
br i1 %45, label %46, label %48
46: ; preds = %9
%47 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str, i64 0, i64 0))
store i32 -1, i32* %10
br label %136
48: ; preds = %9
%49 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.1, i64 0, i64 0))
%50 = load i32, i32* @stdout
%51 = load i32*, i32** %21
%52 = call i32 @BN_print_fp(i32 %50, i32* %51)
%53 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.2, i64 0, i64 0))
%54 = load i32*, i32** %21
%55 = call i64 @BN_num_bytes(i32* %54)
store i64 %55, i64* %22
%56 = load i64, i64* %22
%57 = call i8* @llvm.stacksave()
store i8* %57, i8** %23
%58 = alloca i8, i64 %56
store i64 %56, i64* %24
%59 = load i32*, i32** %21
%60 = call i32 @BN_bn2bin(i32* %59, i8* %58)
%61 = call i32* (...) @EVP_sha1()
store i32* %61, i32** %25
%62 = call i32* (...) @EVP_aes_256_cbc()
store i32* %62, i32** %26
%63 = load i32*, i32** %26
%64 = call i64 @EVP_CIPHER_key_length(i32* %63)
%65 = load i32*, i32** %26
%66 = call i64 @EVP_CIPHER_iv_length(i32* %65)
%67 = add i64 %64, %66
store i64 %67, i64* %27
%68 = load i32*, i32** %25
%69 = call i64 @EVP_MD_block_size(i32* %68)
store i64 %69, i64* %28
%70 = load i64, i64* %27
%71 = load i64, i64* %28
%72 = add i64 %70, %71
%73 = alloca i8, i64 %72
store i64 %72, i64* %29
%74 = bitcast [2048 x i8]* %30 to i8*
store i64 0, i64* %31
store i32 0, i32* %32
%75 = load i64, i64* %22
%76 = load i8*, i8** %18
%77 = load i64, i64* %19
%78 = load i32*, i32** %25
%79 = load i64, i64* %27
%80 = load i64, i64* %28
%81 = add i64 %79, %80
%82 = call i32 @PKCS5_PBKDF2_HMAC(i8* %58, i64 %75, i8* %76, i64 %77, i32 2000, i32* %78, i64 %81, i8* %73)
%83 = load i64, i64* %28
%84 = alloca i8, i64 %83
store i64 %83, i64* %33
%85 = load i32*, i32** %25
%86 = load i64, i64* %27
%87 = getelementptr inbounds i8, i8* %73, i64 %86
%88 = load i64, i64* %28
%89 = load i8*, i8** %14
%90 = load i64, i64* %15
%91 = call i32 @HMAC(i32* %85, i8* %87, i64 %88, i8* %89, i64 %90, i8* %84, i32* %34)
%92 = load i64, i64* %17
%93 = load i32, i32* %34
%94 = zext i32 %93 to i64
%95 = icmp ne i64 %92, %94
br i1 %95, label %101, label %96
96: ; preds = %48
%97 = load i8*, i8** %16
%98 = load i32, i32* %34
%99 = call i64 @memcmp(i8* %84, i8* %97, i32 %98)
%100 = icmp ne i64 %99, 0
br i1 %100, label %101, label %103
101: ; preds = %96, %48
%102 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.3, i64 0, i64 0))
br label %103
103: ; preds = %101, %96
%104 = call i32* (...) @EVP_CIPHER_CTX_new()
store i32* %104, i32** %35
%105 = load i32*, i32** %35
%106 = load i32*, i32** %26
%107 = load i32*, i32** %26
%108 = call i64 @EVP_CIPHER_key_length(i32* %107)
%109 = getelementptr inbounds i8, i8* %73, i64 %108
%110 = call i32 @EVP_DecryptInit_ex(i32* %105, i32* %106, i32* null, i8* %73, i8* %109)
%111 = load i32*, i32** %35
%112 = getelementptr inbounds [2048 x i8], [2048 x i8]* %30, i64 0, i64 0
%113 = load i64, i64* %31
%114 = getelementptr inbounds i8, i8* %112, i64 %113
%115 = load i8*, i8** %14
%116 = load i64, i64* %15
%117 = call i32 @EVP_DecryptUpdate(i32* %111, i8* %114, i32* %32, i8* %115, i64 %116)
%118 = load i32, i32* %32
%119 = sext i32 %118 to i64
%120 = load i64, i64* %31
%121 = add i64 %120, %119
store i64 %121, i64* %31
%122 = load i32*, i32** %35
%123 = getelementptr inbounds [2048 x i8], [2048 x i8]* %30, i64 0, i64 0
%124 = load i64, i64* %31
%125 = getelementptr inbounds i8, i8* %123, i64 %124
%126 = call i32 @EVP_DecryptFinal_ex(i32* %122, i8* %125, i32* %32)
%127 = load i32, i32* %32
%128 = sext i32 %127 to i64
%129 = load i64, i64* %31
%130 = add i64 %129, %128
store i64 %130, i64* %31
%131 = load i64, i64* %31
%132 = getelementptr inbounds [2048 x i8], [2048 x i8]* %30, i64 0, i64 %131
store i8 0, i8* %132
%133 = getelementptr inbounds [2048 x i8], [2048 x i8]* %30, i64 0, i64 0
%134 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.4, i64 0, i64 0), i8* %133)
store i32 0, i32* %10
%135 = load i8*, i8** %23
br label %136
136: ; preds = %103, %46
%137 = load i32, i32* %10
ret i32 %137
}

LLVM IR (-O2):
@.str.1 = [14 x i8] c"S_decipher = \00"
@stdout = global i32 0
@str = [24 x i8] c"MAC verification failed\00"
@str.5 = [22 x i8] c"Key derivation failed\00"
define i32 @decipher(i32* %0, i8* %1, i64 %2, i8* %3, i64 %4, i8* %5, i64 %6, i8* %7, i64 %8) {
%10 = alloca [2048 x i8]
%11 = alloca i32
%12 = alloca i32
%13 = tail call i32* (...) @BN_new()
%14 = tail call i32* @BN_bin2bn(i8* %1, i64 %2, i32* %13)
%15 = tail call i32* (...) @BN_new()
%16 = tail call i64 @EC_KEY_private_derive_S(i32* %0, i32* %14, i32* %15)
%17 = icmp eq i64 %16, 0
br i1 %17, label %20, label %18
18: ; preds = %9
%19 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([22 x i8], [22 x i8]* @str.5, i64 0, i64 0))
br label %67
20: ; preds = %9
%21 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([14 x i8], [14 x i8]* @.str.1, i64 0, i64 0))
%22 = load i32, i32* @stdout
%23 = tail call i32 @BN_print_fp(i32 %22, i32* %15)
%24 = tail call i32 @putchar(i32 10)
%25 = tail call i64 @BN_num_bytes(i32* %15)
%26 = tail call i8* @llvm.stacksave()
%27 = alloca i8, i64 %25
%28 = call i32 @BN_bn2bin(i32* %15, i8* %27)
%29 = call i32* (...) @EVP_sha1()
%30 = call i32* (...) @EVP_aes_256_cbc()
%31 = call i64 @EVP_CIPHER_key_length(i32* %30)
%32 = call i64 @EVP_CIPHER_iv_length(i32* %30)
%33 = add i64 %32, %31
%34 = call i64 @EVP_MD_block_size(i32* %29)
%35 = add i64 %33, %34
%36 = alloca i8, i64 %35
%37 = getelementptr inbounds [2048 x i8], [2048 x i8]* %10, i64 0, i64 0
%38 = bitcast i32* %11 to i8*
store i32 0, i32* %11
%39 = call i32 @PKCS5_PBKDF2_HMAC(i8* %27, i64 %25, i8* %7, i64 %8, i32 2000, i32* %29, i64 %35, i8* %36)
%40 = alloca i8, i64 %34
%41 = bitcast i32* %12 to i8*
%42 = getelementptr inbounds i8, i8* %36, i64 %33
%43 = call i32 @HMAC(i32* %29, i8* %42, i64 %34, i8* %3, i64 %4, i8* %40, i32* %12)
%44 = load i32, i32* %12
%45 = zext i32 %44 to i64
%46 = icmp eq i64 %45, %6
br i1 %46, label %47, label %50
47: ; preds = %20
%48 = call i64 @memcmp(i8* %40, i8* %5, i32 %44)
%49 = icmp eq i64 %48, 0
br i1 %49, label %52, label %50
50: ; preds = %47, %20
%51 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([24 x i8], [24 x i8]* @str, i64 0, i64 0))
br label %52
52: ; preds = %50, %47
%53 = call i32* (...) @EVP_CIPHER_CTX_new()
%54 = call i64 @EVP_CIPHER_key_length(i32* %30)
%55 = getelementptr inbounds i8, i8* %36, i64 %54
%56 = call i32 @EVP_DecryptInit_ex(i32* %53, i32* %30, i32* null, i8* %36, i8* %55)
%57 = call i32 @EVP_DecryptUpdate(i32* %53, i8* %37, i32* %11, i8* %3, i64 %4)
%58 = load i32, i32* %11
%59 = sext i32 %58 to i64
%60 = getelementptr inbounds [2048 x i8], [2048 x i8]* %10, i64 0, i64 %59
%61 = call i32 @EVP_DecryptFinal_ex(i32* %53, i8* %60, i32* %11)
%62 = load i32, i32* %11
%63 = sext i32 %62 to i64
%64 = add nsw i64 %63, %59
%65 = getelementptr inbounds [2048 x i8], [2048 x i8]* %10, i64 0, i64 %64
store i8 0, i8* %65
%66 = call i32 @puts(i8* %37)
br label %67
67: ; preds = %52, %18
%68 = phi i32 [ -1, %18 ], [ 0, %52 ]
ret i32 %68
}