#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ freeze(unsigned int *);
int /*<<< orphan*/ mainloop(unsigned int *, unsigned char *);
int /*<<< orphan*/ mult(unsigned int *, unsigned int *, unsigned int *);
int /*<<< orphan*/ recip(unsigned int *, unsigned int *);
void curve25519(unsigned char *q, const unsigned char *n,
                const unsigned char *p) {
  unsigned int work[96];
  unsigned char e[32];
  unsigned int i;
  for (i = 0; i < 32; ++i)
    e[i] = n[i];
  e[0] &= 248;
  e[31] &= 127;
  e[31] |= 64;
  for (i = 0; i < 32; ++i)
    work[i] = p[i];
  work[31] &= 127;
  mainloop(work, e);
  recip(work + 32, work + 32);
  mult(work + 64, work, work + 32);
  freeze(work + 64);
  for (i = 0; i < 32; ++i)
    q[i] = work[64 + i];
}


x86 assembly (clang, -O0):
<curve25519>:
push   %rbp
mov    %rsp,%rbp
sub    $0x1d0,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
movl   $0x0,-0x1c4(%rbp)
cmpl   $0x20,-0x1c4(%rbp)
jae    119c <curve25519+0x5c>
mov    -0x10(%rbp),%rax
mov    -0x1c4(%rbp),%ecx
mov    (%rax,%rcx,1),%cl
mov    -0x1c4(%rbp),%eax
mov    %cl,-0x1c0(%rbp,%rax,1)
mov    -0x1c4(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1c4(%rbp)
jmp    1161 <curve25519+0x21>
movzbl -0x1c0(%rbp),%eax
and    $0xf8,%eax
mov    %al,-0x1c0(%rbp)
movzbl -0x1a1(%rbp),%eax
and    $0x7f,%eax
mov    %al,-0x1a1(%rbp)
movzbl -0x1a1(%rbp),%eax
or     $0x40,%eax
mov    %al,-0x1a1(%rbp)
movl   $0x0,-0x1c4(%rbp)
cmpl   $0x20,-0x1c4(%rbp)
jae    1214 <curve25519+0xd4>
mov    -0x18(%rbp),%rax
mov    -0x1c4(%rbp),%ecx
movzbl (%rax,%rcx,1),%ecx
mov    -0x1c4(%rbp),%eax
mov    %ecx,-0x1a0(%rbp,%rax,4)
mov    -0x1c4(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1c4(%rbp)
jmp    11d8 <curve25519+0x98>
mov    -0x124(%rbp),%eax
and    $0x7f,%eax
mov    %eax,-0x124(%rbp)
lea    -0x1a0(%rbp),%rdi
lea    -0x1c0(%rbp),%rsi
call   1060 <mainloop@plt>
lea    -0x1a0(%rbp),%rdi
add    $0x80,%rdi
lea    -0x1a0(%rbp),%rsi
add    $0x80,%rsi
call   1050 <recip@plt>
lea    -0x1a0(%rbp),%rdi
add    $0x100,%rdi
lea    -0x1a0(%rbp),%rsi
lea    -0x1a0(%rbp),%rdx
add    $0x80,%rdx
call   1030 <mult@plt>
lea    -0x1a0(%rbp),%rdi
add    $0x100,%rdi
call   1040 <freeze@plt>
movl   $0x0,-0x1c4(%rbp)
cmpl   $0x20,-0x1c4(%rbp)
jae    12de <curve25519+0x19e>
mov    -0x1c4(%rbp),%eax
add    $0x40,%eax
mov    %eax,%eax
mov    -0x1a0(%rbp,%rax,4),%eax
mov    %al,%dl
mov    -0x8(%rbp),%rax
mov    -0x1c4(%rbp),%ecx
mov    %dl,(%rax,%rcx,1)
mov    -0x1c4(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1c4(%rbp)
jmp    129c <curve25519+0x15c>
add    $0x1d0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<curve25519>:
push   %r15
push   %r14
push   %r12
push   %rbx
sub    $0x1a8,%rsp
movdqu (%rsi),%xmm0
movups 0x10(%rsi),%xmm1
movdqa %xmm0,(%rsp)
movaps %xmm1,0x10(%rsp)
andb   $0xf8,(%rsp)
mov    %rdi,%r15
mov    0x1f(%rsp),%al
and    $0x3f,%al
or     $0x40,%al
mov    %al,0x1f(%rsp)
movd   (%rdx),%xmm1
pxor   %xmm0,%xmm0
punpcklbw %xmm0,%xmm1
punpcklwd %xmm0,%xmm1
movdqa %xmm1,0x20(%rsp)
movd   0x4(%rdx),%xmm1
punpcklbw %xmm0,%xmm1
punpcklwd %xmm0,%xmm1
movdqa %xmm1,0x30(%rsp)
movd   0x8(%rdx),%xmm1
punpcklbw %xmm0,%xmm1
punpcklwd %xmm0,%xmm1
movdqa %xmm1,0x40(%rsp)
movd   0xc(%rdx),%xmm1
punpcklbw %xmm0,%xmm1
punpcklwd %xmm0,%xmm1
movdqa %xmm1,0x50(%rsp)
movd   0x10(%rdx),%xmm1
punpcklbw %xmm0,%xmm1
punpcklwd %xmm0,%xmm1
movdqa %xmm1,0x60(%rsp)
movd   0x14(%rdx),%xmm1
punpcklbw %xmm0,%xmm1
punpcklwd %xmm0,%xmm1
movdqa %xmm1,0x70(%rsp)
movd   0x18(%rdx),%xmm1
punpcklbw %xmm0,%xmm1
punpcklwd %xmm0,%xmm1
movdqa %xmm1,0x80(%rsp)
movzbl 0x1c(%rdx),%eax
mov    %eax,0x90(%rsp)
movzbl 0x1d(%rdx),%eax
mov    %eax,0x94(%rsp)
movzbl 0x1e(%rdx),%eax
mov    %eax,0x98(%rsp)
movzbl 0x1f(%rdx),%eax
and    $0x7f,%eax
mov    %eax,0x9c(%rsp)
lea    0x20(%rsp),%r14
mov    %rsp,%rsi
mov    %r14,%rdi
call   1060 <mainloop@plt>
lea    0xa0(%rsp),%rbx
mov    %rbx,%rdi
mov    %rbx,%rsi
call   1050 <recip@plt>
lea    0x120(%rsp),%r12
mov    %r12,%rdi
mov    %r14,%rsi
mov    %rbx,%rdx
call   1030 <mult@plt>
mov    %r12,%rdi
call   1040 <freeze@plt>
movdqa 0xd8a(%rip),%xmm0
movdqa 0x120(%rsp),%xmm1
pand   %xmm0,%xmm1
packuswb %xmm1,%xmm1
packuswb %xmm1,%xmm1
movd   %xmm1,(%r15)
movdqa 0x130(%rsp),%xmm1
pand   %xmm0,%xmm1
packuswb %xmm1,%xmm1
packuswb %xmm1,%xmm1
movd   %xmm1,0x4(%r15)
movdqa 0x140(%rsp),%xmm1
pand   %xmm0,%xmm1
packuswb %xmm1,%xmm1
packuswb %xmm1,%xmm1
movd   %xmm1,0x8(%r15)
movdqa 0x150(%rsp),%xmm1
pand   %xmm0,%xmm1
packuswb %xmm1,%xmm1
packuswb %xmm1,%xmm1
movd   %xmm1,0xc(%r15)
movdqa 0x160(%rsp),%xmm1
pand   %xmm0,%xmm1
packuswb %xmm1,%xmm1
packuswb %xmm1,%xmm1
movd   %xmm1,0x10(%r15)
movdqa 0x170(%rsp),%xmm1
pand   %xmm0,%xmm1
packuswb %xmm1,%xmm1
packuswb %xmm1,%xmm1
movd   %xmm1,0x14(%r15)
movdqa 0x180(%rsp),%xmm1
pand   %xmm0,%xmm1
packuswb %xmm1,%xmm1
packuswb %xmm1,%xmm1
movd   %xmm1,0x18(%r15)
pand   0x190(%rsp),%xmm0
packuswb %xmm0,%xmm0
packuswb %xmm0,%xmm0
movd   %xmm0,0x1c(%r15)
add    $0x1a8,%rsp
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
define void @curve25519(i8* %0, i8* %1, i8* %2) {
%4 = alloca i8*
%5 = alloca i8*
%6 = alloca i8*
%7 = alloca [96 x i32]
%8 = alloca [32 x i8]
%9 = alloca i32
store i8* %0, i8** %4
store i8* %1, i8** %5
store i8* %2, i8** %6
store i32 0, i32* %9
br label %10
10: ; preds = %22, %3
%11 = load i32, i32* %9
%12 = icmp ult i32 %11, 32
br i1 %12, label %13, label %25
13: ; preds = %10
%14 = load i8*, i8** %5
%15 = load i32, i32* %9
%16 = zext i32 %15 to i64
%17 = getelementptr inbounds i8, i8* %14, i64 %16
%18 = load i8, i8* %17
%19 = load i32, i32* %9
%20 = zext i32 %19 to i64
%21 = getelementptr inbounds [32 x i8], [32 x i8]* %8, i64 0, i64 %20
store i8 %18, i8* %21
br label %22
22: ; preds = %13
%23 = load i32, i32* %9
%24 = add i32 %23, 1
store i32 %24, i32* %9
br label %10
25: ; preds = %10
%26 = getelementptr inbounds [32 x i8], [32 x i8]* %8, i64 0, i64 0
%27 = load i8, i8* %26
%28 = zext i8 %27 to i32
%29 = and i32 %28, 248
%30 = trunc i32 %29 to i8
store i8 %30, i8* %26
%31 = getelementptr inbounds [32 x i8], [32 x i8]* %8, i64 0, i64 31
%32 = load i8, i8* %31
%33 = zext i8 %32 to i32
%34 = and i32 %33, 127
%35 = trunc i32 %34 to i8
store i8 %35, i8* %31
%36 = getelementptr inbounds [32 x i8], [32 x i8]* %8, i64 0, i64 31
%37 = load i8, i8* %36
%38 = zext i8 %37 to i32
%39 = or i32 %38, 64
%40 = trunc i32 %39 to i8
store i8 %40, i8* %36
store i32 0, i32* %9
br label %41
41: ; preds = %54, %25
%42 = load i32, i32* %9
%43 = icmp ult i32 %42, 32
br i1 %43, label %44, label %57
44: ; preds = %41
%45 = load i8*, i8** %6
%46 = load i32, i32* %9
%47 = zext i32 %46 to i64
%48 = getelementptr inbounds i8, i8* %45, i64 %47
%49 = load i8, i8* %48
%50 = zext i8 %49 to i32
%51 = load i32, i32* %9
%52 = zext i32 %51 to i64
%53 = getelementptr inbounds [96 x i32], [96 x i32]* %7, i64 0, i64 %52
store i32 %50, i32* %53
br label %54
54: ; preds = %44
%55 = load i32, i32* %9
%56 = add i32 %55, 1
store i32 %56, i32* %9
br label %41
57: ; preds = %41
%58 = getelementptr inbounds [96 x i32], [96 x i32]* %7, i64 0, i64 31
%59 = load i32, i32* %58
%60 = and i32 %59, 127
store i32 %60, i32* %58
%61 = getelementptr inbounds [96 x i32], [96 x i32]* %7, i64 0, i64 0
%62 = getelementptr inbounds [32 x i8], [32 x i8]* %8, i64 0, i64 0
%63 = call i32 @mainloop(i32* %61, i8* %62)
%64 = getelementptr inbounds [96 x i32], [96 x i32]* %7, i64 0, i64 0
%65 = getelementptr inbounds i32, i32* %64, i64 32
%66 = getelementptr inbounds [96 x i32], [96 x i32]* %7, i64 0, i64 0
%67 = getelementptr inbounds i32, i32* %66, i64 32
%68 = call i32 @recip(i32* %65, i32* %67)
%69 = getelementptr inbounds [96 x i32], [96 x i32]* %7, i64 0, i64 0
%70 = getelementptr inbounds i32, i32* %69, i64 64
%71 = getelementptr inbounds [96 x i32], [96 x i32]* %7, i64 0, i64 0
%72 = getelementptr inbounds [96 x i32], [96 x i32]* %7, i64 0, i64 0
%73 = getelementptr inbounds i32, i32* %72, i64 32
%74 = call i32 @mult(i32* %70, i32* %71, i32* %73)
%75 = getelementptr inbounds [96 x i32], [96 x i32]* %7, i64 0, i64 0
%76 = getelementptr inbounds i32, i32* %75, i64 64
%77 = call i32 @freeze(i32* %76)
store i32 0, i32* %9
br label %78
78: ; preds = %92, %57
%79 = load i32, i32* %9
%80 = icmp ult i32 %79, 32
br i1 %80, label %81, label %95
81: ; preds = %78
%82 = load i32, i32* %9
%83 = add i32 64, %82
%84 = zext i32 %83 to i64
%85 = getelementptr inbounds [96 x i32], [96 x i32]* %7, i64 0, i64 %84
%86 = load i32, i32* %85
%87 = trunc i32 %86 to i8
%88 = load i8*, i8** %4
%89 = load i32, i32* %9
%90 = zext i32 %89 to i64
%91 = getelementptr inbounds i8, i8* %88, i64 %90
store i8 %87, i8* %91
br label %92
92: ; preds = %81
%93 = load i32, i32* %9
%94 = add i32 %93, 1
store i32 %94, i32* %9
br label %78
95: ; preds = %78
ret void
}

LLVM IR (-O2):
define void @curve25519(i8* nocapture writeonly %0, i8* nocapture %1, i8* nocapture %2) {
%4 = alloca [96 x i32]
%5 = alloca [32 x i8]
%6 = getelementptr inbounds [32 x i8], [32 x i8]* %5, i64 0, i64 0
%7 = bitcast [96 x i32]* %4 to i8*
%8 = getelementptr inbounds [32 x i8], [32 x i8]* %5, i64 0, i64 0
%9 = load i8, i8* %8
%10 = and i8 %9, -8
store i8 %10, i8* %8
%11 = getelementptr inbounds [32 x i8], [32 x i8]* %5, i64 0, i64 31
%12 = load i8, i8* %11
%13 = and i8 %12, 63
%14 = or i8 %13, 64
store i8 %14, i8* %11
%15 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 0
%16 = bitcast i8* %2 to <4 x i8>*
%17 = load <4 x i8>, <4 x i8>* %16
%18 = zext <4 x i8> %17 to <4 x i32>
%19 = bitcast [96 x i32]* %4 to <4 x i32>*
store <4 x i32> %18, <4 x i32>* %19
%20 = getelementptr inbounds i8, i8* %2, i64 4
%21 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 4
%22 = bitcast i8* %20 to <4 x i8>*
%23 = load <4 x i8>, <4 x i8>* %22
%24 = zext <4 x i8> %23 to <4 x i32>
%25 = bitcast i32* %21 to <4 x i32>*
store <4 x i32> %24, <4 x i32>* %25
%26 = getelementptr inbounds i8, i8* %2, i64 8
%27 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 8
%28 = bitcast i8* %26 to <4 x i8>*
%29 = load <4 x i8>, <4 x i8>* %28
%30 = zext <4 x i8> %29 to <4 x i32>
%31 = bitcast i32* %27 to <4 x i32>*
store <4 x i32> %30, <4 x i32>* %31
%32 = getelementptr inbounds i8, i8* %2, i64 12
%33 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 12
%34 = bitcast i8* %32 to <4 x i8>*
%35 = load <4 x i8>, <4 x i8>* %34
%36 = zext <4 x i8> %35 to <4 x i32>
%37 = bitcast i32* %33 to <4 x i32>*
store <4 x i32> %36, <4 x i32>* %37
%38 = getelementptr inbounds i8, i8* %2, i64 16
%39 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 16
%40 = bitcast i8* %38 to <4 x i8>*
%41 = load <4 x i8>, <4 x i8>* %40
%42 = zext <4 x i8> %41 to <4 x i32>
%43 = bitcast i32* %39 to <4 x i32>*
store <4 x i32> %42, <4 x i32>* %43
%44 = getelementptr inbounds i8, i8* %2, i64 20
%45 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 20
%46 = bitcast i8* %44 to <4 x i8>*
%47 = load <4 x i8>, <4 x i8>* %46
%48 = zext <4 x i8> %47 to <4 x i32>
%49 = bitcast i32* %45 to <4 x i32>*
store <4 x i32> %48, <4 x i32>* %49
%50 = getelementptr inbounds i8, i8* %2, i64 24
%51 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 24
%52 = bitcast i8* %50 to <4 x i8>*
%53 = load <4 x i8>, <4 x i8>* %52
%54 = zext <4 x i8> %53 to <4 x i32>
%55 = bitcast i32* %51 to <4 x i32>*
store <4 x i32> %54, <4 x i32>* %55
%56 = getelementptr inbounds i8, i8* %2, i64 28
%57 = load i8, i8* %56
%58 = zext i8 %57 to i32
%59 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 28
store i32 %58, i32* %59
%60 = getelementptr inbounds i8, i8* %2, i64 29
%61 = load i8, i8* %60
%62 = zext i8 %61 to i32
%63 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 29
store i32 %62, i32* %63
%64 = getelementptr inbounds i8, i8* %2, i64 30
%65 = load i8, i8* %64
%66 = zext i8 %65 to i32
%67 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 30
store i32 %66, i32* %67
%68 = getelementptr inbounds i8, i8* %2, i64 31
%69 = load i8, i8* %68
%70 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 31
%71 = and i8 %69, 127
%72 = zext i8 %71 to i32
store i32 %72, i32* %70
%73 = call i32 @mainloop(i32* %15, i8* %8)
%74 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 32
%75 = call i32 @recip(i32* %74, i32* %74)
%76 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 64
%77 = call i32 @mult(i32* %76, i32* %15, i32* %74)
%78 = call i32 @freeze(i32* %76)
%79 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 64
%80 = bitcast i32* %79 to <4 x i32>*
%81 = load <4 x i32>, <4 x i32>* %80
%82 = trunc <4 x i32> %81 to <4 x i8>
%83 = bitcast i8* %0 to <4 x i8>*
store <4 x i8> %82, <4 x i8>* %83
%84 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 68
%85 = bitcast i32* %84 to <4 x i32>*
%86 = load <4 x i32>, <4 x i32>* %85
%87 = trunc <4 x i32> %86 to <4 x i8>
%88 = getelementptr inbounds i8, i8* %0, i64 4
%89 = bitcast i8* %88 to <4 x i8>*
store <4 x i8> %87, <4 x i8>* %89
%90 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 72
%91 = bitcast i32* %90 to <4 x i32>*
%92 = load <4 x i32>, <4 x i32>* %91
%93 = trunc <4 x i32> %92 to <4 x i8>
%94 = getelementptr inbounds i8, i8* %0, i64 8
%95 = bitcast i8* %94 to <4 x i8>*
store <4 x i8> %93, <4 x i8>* %95
%96 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 76
%97 = bitcast i32* %96 to <4 x i32>*
%98 = load <4 x i32>, <4 x i32>* %97
%99 = trunc <4 x i32> %98 to <4 x i8>
%100 = getelementptr inbounds i8, i8* %0, i64 12
%101 = bitcast i8* %100 to <4 x i8>*
store <4 x i8> %99, <4 x i8>* %101
%102 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 80
%103 = bitcast i32* %102 to <4 x i32>*
%104 = load <4 x i32>, <4 x i32>* %103
%105 = trunc <4 x i32> %104 to <4 x i8>
%106 = getelementptr inbounds i8, i8* %0, i64 16
%107 = bitcast i8* %106 to <4 x i8>*
store <4 x i8> %105, <4 x i8>* %107
%108 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 84
%109 = bitcast i32* %108 to <4 x i32>*
%110 = load <4 x i32>, <4 x i32>* %109
%111 = trunc <4 x i32> %110 to <4 x i8>
%112 = getelementptr inbounds i8, i8* %0, i64 20
%113 = bitcast i8* %112 to <4 x i8>*
store <4 x i8> %111, <4 x i8>* %113
%114 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 88
%115 = bitcast i32* %114 to <4 x i32>*
%116 = load <4 x i32>, <4 x i32>* %115
%117 = trunc <4 x i32> %116 to <4 x i8>
%118 = getelementptr inbounds i8, i8* %0, i64 24
%119 = bitcast i8* %118 to <4 x i8>*
store <4 x i8> %117, <4 x i8>* %119
%120 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 92
%121 = bitcast i32* %120 to <4 x i32>*
%122 = load <4 x i32>, <4 x i32>* %121
%123 = trunc <4 x i32> %122 to <4 x i8>
%124 = getelementptr inbounds i8, i8* %0, i64 28
%125 = bitcast i8* %124 to <4 x i8>*
store <4 x i8> %123, <4 x i8>* %125
ret void
}