#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ ERR_R_MALLOC_FAILURE;
int /*<<< orphan*/ EVP_Digest(void *, int, unsigned char *,
                              int /*<<< orphan*/ *, int /*<<< orphan*/,
                              int /*<<< orphan*/ *);
int /*<<< orphan*/ EVP_sha256();
scalar_t__ MGF1_SHA256(unsigned char *, int, unsigned char *, int);
int /*<<< orphan*/ OPENSSL_free(unsigned char *);
unsigned char *OPENSSL_malloc(int);
scalar_t__ RAND_bytes(unsigned char *, int);
int /*<<< orphan*/ RSA_F_RSA_PADDING_ADD_PKCS1_OAEP;
int /*<<< orphan*/ RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE;
int /*<<< orphan*/ RSA_R_KEY_SIZE_TOO_SMALL;
int /*<<< orphan*/ RSAerr(int /*<<< orphan*/, int /*<<< orphan*/);
int SHA256_DIGEST_LENGTH;
int /*<<< orphan*/ memcpy(unsigned char *, unsigned char const *, unsigned int);
int /*<<< orphan*/ memset(unsigned char *, int /*<<< orphan*/, int);
int RSA_padding_add_PKCS1_OAEP_SHA256(unsigned char *to, int tlen,
                                      const unsigned char *from, int flen,
                                      const unsigned char *param, int plen) {
  int i, emlen = tlen - 1;
  unsigned char *db, *seed;
  unsigned char *dbmask, seedmask[SHA256_DIGEST_LENGTH];
  if (flen > emlen - 2 * SHA256_DIGEST_LENGTH - 1) {
    RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
    return 0;
  }
  if (emlen < 2 * SHA256_DIGEST_LENGTH + 1) {
    RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, RSA_R_KEY_SIZE_TOO_SMALL);
    return 0;
  }
  to[0] = 0;
  seed = to + 1;
  db = to + SHA256_DIGEST_LENGTH + 1;
  if (!EVP_Digest((void *)param, plen, db, NULL, EVP_sha256(), NULL))
    return 0;
  memset(db + SHA256_DIGEST_LENGTH, 0,
         emlen - flen - 2 * SHA256_DIGEST_LENGTH - 1);
  db[emlen - flen - SHA256_DIGEST_LENGTH - 1] = 0x01;
  memcpy(db + emlen - flen - SHA256_DIGEST_LENGTH, from, (unsigned int)flen);
  if (RAND_bytes(seed, SHA256_DIGEST_LENGTH) <= 0)
    return 0;
  dbmask = OPENSSL_malloc(emlen - SHA256_DIGEST_LENGTH);
  if (dbmask == NULL) {
    RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, ERR_R_MALLOC_FAILURE);
    return 0;
  }
  if (MGF1_SHA256(dbmask, emlen - SHA256_DIGEST_LENGTH, seed,
                  SHA256_DIGEST_LENGTH) < 0)
    return 0;
  for (i = 0; i < emlen - SHA256_DIGEST_LENGTH; i++)
    db[i] ^= dbmask[i];
  if (MGF1_SHA256(seedmask, SHA256_DIGEST_LENGTH, db,
                  emlen - SHA256_DIGEST_LENGTH) < 0)
    return 0;
  for (i = 0; i < SHA256_DIGEST_LENGTH; i++)
    seed[i] ^= seedmask[i];
  OPENSSL_free(dbmask);
  return 1;
}


x86 assembly (clang, -O0):
<RSA_padding_add_PKCS1_OAEP_SHA256>:
push   %rbp
mov    %rsp,%rbp
sub    $0x90,%rsp
mov    %rdi,-0x10(%rbp)
mov    %esi,-0x14(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %ecx,-0x24(%rbp)
mov    %r8,-0x30(%rbp)
mov    %r9d,-0x34(%rbp)
mov    -0x14(%rbp),%eax
add    $0xffffffff,%eax
mov    %eax,-0x3c(%rbp)
mov    0x2e07(%rip),%rax
mov    (%rax),%eax
mov    %rsp,%rcx
mov    %rcx,-0x60(%rbp)
mov    %rax,%rdx
add    $0xf,%rdx
and    $0xfffffffffffffff0,%rdx
mov    %rsp,%rcx
sub    %rdx,%rcx
mov    %rcx,-0x78(%rbp)
mov    %rcx,%rsp
mov    %rax,-0x68(%rbp)
mov    -0x24(%rbp),%eax
mov    -0x3c(%rbp),%ecx
mov    0x2dd5(%rip),%rdx
mov    (%rdx),%edx
shl    $0x1,%edx
sub    %edx,%ecx
sub    $0x1,%ecx
cmp    %ecx,%eax
jle    122f <RSA_padding_add_PKCS1_OAEP_SHA256+0x9f>
mov    0x2ddc(%rip),%rax
mov    (%rax),%edi
mov    0x2dcb(%rip),%rax
mov    (%rax),%esi
call   1090 <RSAerr@plt>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
jmp    151b <RSA_padding_add_PKCS1_OAEP_SHA256+0x38b>
mov    -0x3c(%rbp),%eax
mov    0x2d8f(%rip),%rcx
mov    (%rcx),%ecx
shl    $0x1,%ecx
add    $0x1,%ecx
cmp    %ecx,%eax
jge    1273 <RSA_padding_add_PKCS1_OAEP_SHA256+0xe3>
mov    0x2d98(%rip),%rax
mov    (%rax),%edi
mov    0x2d5f(%rip),%rax
mov    (%rax),%esi
call   1090 <RSAerr@plt>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
jmp    151b <RSA_padding_add_PKCS1_OAEP_SHA256+0x38b>
mov    -0x10(%rbp),%rax
movb   $0x0,(%rax)
mov    -0x10(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x50(%rbp)
mov    -0x10(%rbp),%rax
mov    0x2d37(%rip),%rcx
movslq (%rcx),%rcx
add    %rcx,%rax
add    $0x1,%rax
mov    %rax,-0x48(%rbp)
mov    -0x30(%rbp),%rax
mov    %rax,-0x90(%rbp)
mov    -0x34(%rbp),%eax
mov    %eax,-0x84(%rbp)
mov    -0x48(%rbp),%rax
mov    %rax,-0x80(%rbp)
mov    $0x0,%al
call   10b0 <EVP_sha256@plt>
mov    -0x90(%rbp),%rdi
mov    -0x84(%rbp),%esi
mov    -0x80(%rbp),%rdx
mov    %eax,%r8d
xor    %eax,%eax
mov    %eax,%r9d
mov    %r9,%rcx
call   1080 <EVP_Digest@plt>
cmp    $0x0,%eax
jne    12ff <RSA_padding_add_PKCS1_OAEP_SHA256+0x16f>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
jmp    151b <RSA_padding_add_PKCS1_OAEP_SHA256+0x38b>
mov    -0x48(%rbp),%rdi
mov    0x2cbe(%rip),%rax
movslq (%rax),%rax
add    %rax,%rdi
mov    -0x3c(%rbp),%edx
sub    -0x24(%rbp),%edx
mov    0x2cab(%rip),%rax
mov    (%rax),%eax
shl    $0x1,%eax
sub    %eax,%edx
sub    $0x1,%edx
xor    %esi,%esi
call   1050 <memset@plt>
mov    -0x48(%rbp),%rax
mov    -0x3c(%rbp),%ecx
sub    -0x24(%rbp),%ecx
mov    0x2c89(%rip),%rdx
sub    (%rdx),%ecx
sub    $0x1,%ecx
movslq %ecx,%rcx
movb   $0x1,(%rax,%rcx,1)
mov    -0x48(%rbp),%rdi
movslq -0x3c(%rbp),%rax
add    %rax,%rdi
movslq -0x24(%rbp),%rcx
xor    %eax,%eax
sub    %rcx,%rax
add    %rax,%rdi
mov    0x2c5f(%rip),%rax
movslq (%rax),%rcx
xor    %eax,%eax
sub    %rcx,%rax
add    %rax,%rdi
mov    -0x20(%rbp),%rsi
mov    -0x24(%rbp),%edx
call   1060 <memcpy@plt>
mov    -0x50(%rbp),%rdi
mov    0x2c3d(%rip),%rax
mov    (%rax),%esi
call   1030 <RAND_bytes@plt>
cmp    $0x0,%rax
jg     13af <RSA_padding_add_PKCS1_OAEP_SHA256+0x21f>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
jmp    151b <RSA_padding_add_PKCS1_OAEP_SHA256+0x38b>
mov    -0x3c(%rbp),%edi
mov    0x2c0f(%rip),%rax
sub    (%rax),%edi
call   1070 <OPENSSL_malloc@plt>
mov    %rax,-0x58(%rbp)
cmpq   $0x0,-0x58(%rbp)
jne    13f9 <RSA_padding_add_PKCS1_OAEP_SHA256+0x269>
mov    0x2c12(%rip),%rax
mov    (%rax),%edi
mov    0x2bf9(%rip),%rax
mov    (%rax),%esi
call   1090 <RSAerr@plt>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
jmp    151b <RSA_padding_add_PKCS1_OAEP_SHA256+0x38b>
mov    -0x58(%rbp),%rdi
mov    -0x3c(%rbp),%esi
mov    0x2bc1(%rip),%rax
sub    (%rax),%esi
mov    -0x50(%rbp),%rdx
mov    0x2bb4(%rip),%rax
mov    (%rax),%ecx
call   1040 <MGF1_SHA256@plt>
cmp    $0x0,%rax
jge    1438 <RSA_padding_add_PKCS1_OAEP_SHA256+0x2a8>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
jmp    151b <RSA_padding_add_PKCS1_OAEP_SHA256+0x38b>
movl   $0x0,-0x38(%rbp)
mov    -0x38(%rbp),%eax
mov    -0x3c(%rbp),%ecx
mov    0x2b7c(%rip),%rdx
sub    (%rdx),%ecx
cmp    %ecx,%eax
jge    1481 <RSA_padding_add_PKCS1_OAEP_SHA256+0x2f1>
mov    -0x58(%rbp),%rax
movslq -0x38(%rbp),%rcx
movzbl (%rax,%rcx,1),%esi
mov    -0x48(%rbp),%rax
movslq -0x38(%rbp),%rcx
movzbl (%rax,%rcx,1),%edx
xor    %esi,%edx
mov    %dl,(%rax,%rcx,1)
mov    -0x38(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x38(%rbp)
jmp    143f <RSA_padding_add_PKCS1_OAEP_SHA256+0x2af>
mov    -0x78(%rbp),%rdi
mov    0x2b3c(%rip),%rax
mov    (%rax),%esi
mov    -0x48(%rbp),%rdx
mov    -0x3c(%rbp),%ecx
mov    0x2b2c(%rip),%rax
sub    (%rax),%ecx
call   1040 <MGF1_SHA256@plt>
cmp    $0x0,%rax
jge    14c0 <RSA_padding_add_PKCS1_OAEP_SHA256+0x330>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
jmp    151b <RSA_padding_add_PKCS1_OAEP_SHA256+0x38b>
movl   $0x0,-0x38(%rbp)
mov    -0x38(%rbp),%eax
mov    0x2af7(%rip),%rcx
cmp    (%rcx),%eax
jge    1504 <RSA_padding_add_PKCS1_OAEP_SHA256+0x374>
mov    -0x78(%rbp),%rax
movslq -0x38(%rbp),%rcx
movzbl (%rax,%rcx,1),%esi
mov    -0x50(%rbp),%rax
movslq -0x38(%rbp),%rcx
movzbl (%rax,%rcx,1),%edx
xor    %esi,%edx
mov    %dl,(%rax,%rcx,1)
mov    -0x38(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x38(%rbp)
jmp    14c7 <RSA_padding_add_PKCS1_OAEP_SHA256+0x337>
mov    -0x58(%rbp),%rdi
call   10a0 <OPENSSL_free@plt>
movl   $0x1,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
mov    -0x60(%rbp),%rax
mov    %rax,%rsp
mov    -0x4(%rbp),%eax
mov    %rbp,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<RSA_padding_add_PKCS1_OAEP_SHA256>:
push   %rbp
mov    %rsp,%rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x28,%rsp
mov    %ecx,%r13d
mov    %esi,%ebx
mov    0x2e1b(%rip),%rsi
mov    (%rsi),%eax
mov    %rsp,%r15
mov    %rax,%rcx
add    $0xf,%rcx
and    $0xfffffffffffffff0,%rcx
sub    %rcx,%r15
mov    %r15,%rsp
add    %eax,%eax
mov    %eax,%ecx
not    %ecx
add    %ebx,%ecx
add    $0xffffffff,%ecx
cmp    %r13d,%ecx
jge    11e8 <RSA_padding_add_PKCS1_OAEP_SHA256+0x58>
mov    0x2e0e(%rip),%rax
mov    (%rax),%edi
mov    0x2dfd(%rip),%rax
jmp    1394 <RSA_padding_add_PKCS1_OAEP_SHA256+0x204>
or     $0x1,%eax
cmp    %ebx,%eax
jge    1384 <RSA_padding_add_PKCS1_OAEP_SHA256+0x1f4>
mov    %r8,%r12
mov    %rdx,-0x48(%rbp)
movb   $0x0,(%rdi)
movslq (%rsi),%rax
lea    (%rdi,%rax,1),%r14
add    $0x1,%r14
xor    %eax,%eax
mov    %rdi,-0x40(%rbp)
mov    %r9d,-0x38(%rbp)
call   10b0 <EVP_sha256@plt>
mov    %r12,%rdi
xor    %ecx,%ecx
mov    %rcx,-0x30(%rbp)
mov    -0x38(%rbp),%esi
mov    %r14,-0x38(%rbp)
mov    %r14,%rdx
xor    %ecx,%ecx
mov    %eax,%r8d
xor    %r9d,%r9d
call   1080 <EVP_Digest@plt>
test   %eax,%eax
je     13a1 <RSA_padding_add_PKCS1_OAEP_SHA256+0x211>
add    $0xffffffff,%ebx
addq   $0x1,-0x40(%rbp)
mov    0x2d7a(%rip),%rax
movslq (%rax),%rdi
lea    (%rdi,%rdi,1),%edx
mov    -0x38(%rbp),%r12
add    %r12,%rdi
mov    %ebx,%r14d
sub    %r13d,%r14d
not    %edx
add    %r14d,%edx
xor    %eax,%eax
mov    %rax,-0x30(%rbp)
xor    %esi,%esi
call   1050 <memset@plt>
mov    0x2d4e(%rip),%rcx
mov    (%rcx),%eax
not    %eax
add    %r14d,%eax
cltq
movb   $0x1,(%r12,%rax,1)
movslq %ebx,%rdi
add    %r12,%rdi
movslq %r13d,%rax
sub    %rax,%rdi
movslq (%rcx),%rax
mov    %rcx,%r14
sub    %rax,%rdi
mov    -0x48(%rbp),%rsi
mov    %r13d,%edx
call   1060 <memcpy@plt>
mov    (%r14),%esi
mov    -0x40(%rbp),%rdi
mov    %rdi,%r14
call   1030 <RAND_bytes@plt>
test   %rax,%rax
jle    13a1 <RSA_padding_add_PKCS1_OAEP_SHA256+0x211>
mov    %ebx,%edi
mov    0x2cfe(%rip),%rax
sub    (%rax),%edi
call   1070 <OPENSSL_malloc@plt>
test   %rax,%rax
je     13b4 <RSA_padding_add_PKCS1_OAEP_SHA256+0x224>
mov    %rax,%r13
mov    0x2ce4(%rip),%rax
mov    (%rax),%ecx
mov    %ebx,%esi
sub    %ecx,%esi
mov    %r13,%rdi
mov    %r14,%rdx
call   1040 <MGF1_SHA256@plt>
test   %rax,%rax
js     13a1 <RSA_padding_add_PKCS1_OAEP_SHA256+0x211>
mov    0x2cc3(%rip),%r8
mov    (%r8),%esi
mov    %ebx,%ecx
sub    %esi,%ecx
mov    -0x38(%rbp),%rdi
jle    133c <RSA_padding_add_PKCS1_OAEP_SHA256+0x1ac>
xor    %eax,%eax
cs nopw 0x0(%rax,%rax,1)
xchg   %ax,%ax
movzbl 0x0(%r13,%rax,1),%ecx
xor    %cl,(%rdi,%rax,1)
add    $0x1,%rax
mov    (%r8),%esi
mov    %ebx,%ecx
sub    %esi,%ecx
movslq %ecx,%rdx
cmp    %rdx,%rax
jl     1320 <RSA_padding_add_PKCS1_OAEP_SHA256+0x190>
mov    %rdi,%rdx
mov    %r15,%rdi
mov    %r8,%rbx
call   1040 <MGF1_SHA256@plt>
test   %rax,%rax
js     13a1 <RSA_padding_add_PKCS1_OAEP_SHA256+0x211>
cmpl   $0x0,(%rbx)
jle    1375 <RSA_padding_add_PKCS1_OAEP_SHA256+0x1e5>
mov    %rbx,%rsi
xor    %eax,%eax
nopl   0x0(%rax)
movzbl (%r15,%rax,1),%ecx
xor    %cl,(%r14,%rax,1)
add    $0x1,%rax
movslq (%rsi),%rcx
cmp    %rcx,%rax
jl     1360 <RSA_padding_add_PKCS1_OAEP_SHA256+0x1d0>
mov    %r13,%rdi
call   10a0 <OPENSSL_free@plt>
mov    $0x1,%eax
jmp    139d <RSA_padding_add_PKCS1_OAEP_SHA256+0x20d>
mov    0x2c5d(%rip),%rax
mov    (%rax),%edi
mov    0x2c24(%rip),%rax
mov    (%rax),%esi
call   1090 <RSAerr@plt>
xor    %eax,%eax
mov    %rax,-0x30(%rbp)
mov    -0x30(%rbp),%rax
lea    -0x28(%rbp),%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
mov    0x2c2d(%rip),%rax
mov    (%rax),%edi
mov    0x2c14(%rip),%rax
mov    (%rax),%esi
call   1090 <RSAerr@plt>
jmp    13a1 <RSA_padding_add_PKCS1_OAEP_SHA256+0x211>

LLVM IR (-O0):
@SHA256_DIGEST_LENGTH = global i32 0
@RSA_F_RSA_PADDING_ADD_PKCS1_OAEP = global i32 0
@RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE = global i32 0
@RSA_R_KEY_SIZE_TOO_SMALL = global i32 0
@ERR_R_MALLOC_FAILURE = global i32 0
define i32 @RSA_padding_add_PKCS1_OAEP_SHA256(i8* %0, i32 %1, i8* %2, i32 %3, i8* %4, i32 %5) {
%7 = alloca i32
%8 = alloca i8*
%9 = alloca i32
%10 = alloca i8*
%11 = alloca i32
%12 = alloca i8*
%13 = alloca i32
%14 = alloca i32
%15 = alloca i32
%16 = alloca i8*
%17 = alloca i8*
%18 = alloca i8*
%19 = alloca i8*
%20 = alloca i64
%21 = alloca i32
store i8* %0, i8** %8
store i32 %1, i32* %9
store i8* %2, i8** %10
store i32 %3, i32* %11
store i8* %4, i8** %12
store i32 %5, i32* %13
%22 = load i32, i32* %9
%23 = sub nsw i32 %22, 1
store i32 %23, i32* %15
%24 = load i32, i32* @SHA256_DIGEST_LENGTH
%25 = zext i32 %24 to i64
%26 = call i8* @llvm.stacksave()
store i8* %26, i8** %19
%27 = alloca i8, i64 %25
store i64 %25, i64* %20
%28 = load i32, i32* %11
%29 = load i32, i32* %15
%30 = load i32, i32* @SHA256_DIGEST_LENGTH
%31 = mul nsw i32 2, %30
%32 = sub nsw i32 %29, %31
%33 = sub nsw i32 %32, 1
%34 = icmp sgt i32 %28, %33
br i1 %34, label %35, label %39
35: ; preds = %6
%36 = load i32, i32* @RSA_F_RSA_PADDING_ADD_PKCS1_OAEP
%37 = load i32, i32* @RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE
%38 = call i32 @RSAerr(i32 %36, i32 %37)
store i32 0, i32* %7
store i32 1, i32* %21
br label %188
39: ; preds = %6
%40 = load i32, i32* %15
%41 = load i32, i32* @SHA256_DIGEST_LENGTH
%42 = mul nsw i32 2, %41
%43 = add nsw i32 %42, 1
%44 = icmp slt i32 %40, %43
br i1 %44, label %45, label %49
45: ; preds = %39
%46 = load i32, i32* @RSA_F_RSA_PADDING_ADD_PKCS1_OAEP
%47 = load i32, i32* @RSA_R_KEY_SIZE_TOO_SMALL
%48 = call i32 @RSAerr(i32 %46, i32 %47)
store i32 0, i32* %7
store i32 1, i32* %21
br label %188
49: ; preds = %39
%50 = load i8*, i8** %8
%51 = getelementptr inbounds i8, i8* %50, i64 0
store i8 0, i8* %51
%52 = load i8*, i8** %8
%53 = getelementptr inbounds i8, i8* %52, i64 1
store i8* %53, i8** %17
%54 = load i8*, i8** %8
%55 = load i32, i32* @SHA256_DIGEST_LENGTH
%56 = sext i32 %55 to i64
%57 = getelementptr inbounds i8, i8* %54, i64 %56
%58 = getelementptr inbounds i8, i8* %57, i64 1
store i8* %58, i8** %16
%59 = load i8*, i8** %12
%60 = load i32, i32* %13
%61 = load i8*, i8** %16
%62 = call i32 (...) @EVP_sha256()
%63 = call i32 @EVP_Digest(i8* %59, i32 %60, i8* %61, i32* null, i32 %62, i32* null)
%64 = icmp ne i32 %63, 0
br i1 %64, label %66, label %65
65: ; preds = %49
store i32 0, i32* %7
store i32 1, i32* %21
br label %188
66: ; preds = %49
%67 = load i8*, i8** %16
%68 = load i32, i32* @SHA256_DIGEST_LENGTH
%69 = sext i32 %68 to i64
%70 = getelementptr inbounds i8, i8* %67, i64 %69
%71 = load i32, i32* %15
%72 = load i32, i32* %11
%73 = sub nsw i32 %71, %72
%74 = load i32, i32* @SHA256_DIGEST_LENGTH
%75 = mul nsw i32 2, %74
%76 = sub nsw i32 %73, %75
%77 = sub nsw i32 %76, 1
%78 = call i32 @memset(i8* %70, i32 0, i32 %77)
%79 = load i8*, i8** %16
%80 = load i32, i32* %15
%81 = load i32, i32* %11
%82 = sub nsw i32 %80, %81
%83 = load i32, i32* @SHA256_DIGEST_LENGTH
%84 = sub nsw i32 %82, %83
%85 = sub nsw i32 %84, 1
%86 = sext i32 %85 to i64
%87 = getelementptr inbounds i8, i8* %79, i64 %86
store i8 1, i8* %87
%88 = load i8*, i8** %16
%89 = load i32, i32* %15
%90 = sext i32 %89 to i64
%91 = getelementptr inbounds i8, i8* %88, i64 %90
%92 = load i32, i32* %11
%93 = sext i32 %92 to i64
%94 = sub i64 0, %93
%95 = getelementptr inbounds i8, i8* %91, i64 %94
%96 = load i32, i32* @SHA256_DIGEST_LENGTH
%97 = sext i32 %96 to i64
%98 = sub i64 0, %97
%99 = getelementptr inbounds i8, i8* %95, i64 %98
%100 = load i8*, i8** %10
%101 = load i32, i32* %11
%102 = call i32 @memcpy(i8* %99, i8* %100, i32 %101)
%103 = load i8*, i8** %17
%104 = load i32, i32* @SHA256_DIGEST_LENGTH
%105 = call i64 @RAND_bytes(i8* %103, i32 %104)
%106 = icmp sle i64 %105, 0
br i1 %106, label %107, label %108
107: ; preds = %66
store i32 0, i32* %7
store i32 1, i32* %21
br label %188
108: ; preds = %66
%109 = load i32, i32* %15
%110 = load i32, i32* @SHA256_DIGEST_LENGTH
%111 = sub nsw i32 %109, %110
%112 = call i8* @OPENSSL_malloc(i32 %111)
store i8* %112, i8** %18
%113 = load i8*, i8** %18
%114 = icmp eq i8* %113, null
br i1 %114, label %115, label %119
115: ; preds = %108
%116 = load i32, i32* @RSA_F_RSA_PADDING_ADD_PKCS1_OAEP
%117 = load i32, i32* @ERR_R_MALLOC_FAILURE
%118 = call i32 @RSAerr(i32 %116, i32 %117)
store i32 0, i32* %7
store i32 1, i32* %21
br label %188
119: ; preds = %108
%120 = load i8*, i8** %18
%121 = load i32, i32* %15
%122 = load i32, i32* @SHA256_DIGEST_LENGTH
%123 = sub nsw i32 %121, %122
%124 = load i8*, i8** %17
%125 = load i32, i32* @SHA256_DIGEST_LENGTH
%126 = call i64 @MGF1_SHA256(i8* %120, i32 %123, i8* %124, i32 %125)
%127 = icmp slt i64 %126, 0
br i1 %127, label %128, label %129
128: ; preds = %119
store i32 0, i32* %7
store i32 1, i32* %21
br label %188
129: ; preds = %119
store i32 0, i32* %14
br label %130
130: ; preds = %151, %129
%131 = load i32, i32* %14
%132 = load i32, i32* %15
%133 = load i32, i32* @SHA256_DIGEST_LENGTH
%134 = sub nsw i32 %132, %133
%135 = icmp slt i32 %131, %134
br i1 %135, label %136, label %154
136: ; preds = %130
%137 = load i8*, i8** %18
%138 = load i32, i32* %14
%139 = sext i32 %138 to i64
%140 = getelementptr inbounds i8, i8* %137, i64 %139
%141 = load i8, i8* %140
%142 = zext i8 %141 to i32
%143 = load i8*, i8** %16
%144 = load i32, i32* %14
%145 = sext i32 %144 to i64
%146 = getelementptr inbounds i8, i8* %143, i64 %145
%147 = load i8, i8* %146
%148 = zext i8 %147 to i32
%149 = xor i32 %148, %142
%150 = trunc i32 %149 to i8
store i8 %150, i8* %146
br label %151
151: ; preds = %136
%152 = load i32, i32* %14
%153 = add nsw i32 %152, 1
store i32 %153, i32* %14
br label %130
154: ; preds = %130
%155 = load i32, i32* @SHA256_DIGEST_LENGTH
%156 = load i8*, i8** %16
%157 = load i32, i32* %15
%158 = load i32, i32* @SHA256_DIGEST_LENGTH
%159 = sub nsw i32 %157, %158
%160 = call i64 @MGF1_SHA256(i8* %27, i32 %155, i8* %156, i32 %159)
%161 = icmp slt i64 %160, 0
br i1 %161, label %162, label %163
162: ; preds = %154
store i32 0, i32* %7
store i32 1, i32* %21
br label %188
163: ; preds = %154
store i32 0, i32* %14
br label %164
164: ; preds = %182, %163
%165 = load i32, i32* %14
%166 = load i32, i32* @SHA256_DIGEST_LENGTH
%167 = icmp slt i32 %165, %166
br i1 %167, label %168, label %185
168: ; preds = %164
%169 = load i32, i32* %14
%170 = sext i32 %169 to i64
%171 = getelementptr inbounds i8, i8* %27, i64 %170
%172 = load i8, i8* %171
%173 = zext i8 %172 to i32
%174 = load i8*, i8** %17
%175 = load i32, i32* %14
%176 = sext i32 %175 to i64
%177 = getelementptr inbounds i8, i8* %174, i64 %176
%178 = load i8, i8* %177
%179 = zext i8 %178 to i32
%180 = xor i32 %179, %173
%181 = trunc i32 %180 to i8
store i8 %181, i8* %177
br label %182
182: ; preds = %168
%183 = load i32, i32* %14
%184 = add nsw i32 %183, 1
store i32 %184, i32* %14
br label %164
185: ; preds = %164
%186 = load i8*, i8** %18
%187 = call i32 @OPENSSL_free(i8* %186)
store i32 1, i32* %7
store i32 1, i32* %21
br label %188
188: ; preds = %185, %162, %128, %115, %107, %65, %45, %35
%189 = load i8*, i8** %19
%190 = load i32, i32* %7
ret i32 %190
}

LLVM IR (-O2):
@SHA256_DIGEST_LENGTH = global i32 0
@RSA_F_RSA_PADDING_ADD_PKCS1_OAEP = global i32 0
@RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE = global i32 0
@RSA_R_KEY_SIZE_TOO_SMALL = global i32 0
@ERR_R_MALLOC_FAILURE = global i32 0
define i32 @RSA_padding_add_PKCS1_OAEP_SHA256(i8* %0, i32 %1, i8* %2, i32 %3, i8* %4, i32 %5) {
%7 = add nsw i32 %1, -1
%8 = load i32, i32* @SHA256_DIGEST_LENGTH
%9 = zext i32 %8 to i64
%10 = alloca i8, i64 %9
%11 = shl nsw i32 %8, 1
%12 = xor i32 %11, -1
%13 = add i32 %7, %12
%14 = icmp slt i32 %13, %3
br i1 %14, label %15, label %19
15: ; preds = %6
%16 = load i32, i32* @RSA_F_RSA_PADDING_ADD_PKCS1_OAEP
%17 = load i32, i32* @RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE
%18 = tail call i32 @RSAerr(i32 %16, i32 %17)
br label %113
19: ; preds = %6
%20 = or i32 %11, 1
%21 = icmp slt i32 %20, %1
br i1 %21, label %26, label %22
22: ; preds = %19
%23 = load i32, i32* @RSA_F_RSA_PADDING_ADD_PKCS1_OAEP
%24 = load i32, i32* @RSA_R_KEY_SIZE_TOO_SMALL
%25 = tail call i32 @RSAerr(i32 %23, i32 %24)
br label %113
26: ; preds = %19
store i8 0, i8* %0
%27 = getelementptr inbounds i8, i8* %0, i64 1
%28 = load i32, i32* @SHA256_DIGEST_LENGTH
%29 = sext i32 %28 to i64
%30 = getelementptr inbounds i8, i8* %0, i64 %29
%31 = getelementptr inbounds i8, i8* %30, i64 1
%32 = tail call i32 (...) @EVP_sha256()
%33 = tail call i32 @EVP_Digest(i8* %4, i32 %5, i8* %31, i32* null, i32 %32, i32* null)
%34 = icmp eq i32 %33, 0
br i1 %34, label %113, label %35
35: ; preds = %26
%36 = load i32, i32* @SHA256_DIGEST_LENGTH
%37 = sext i32 %36 to i64
%38 = getelementptr inbounds i8, i8* %31, i64 %37
%39 = sub nsw i32 %7, %3
%40 = mul i32 %36, -2
%41 = add i32 %39, -1
%42 = add i32 %41, %40
%43 = tail call i32 @memset(i8* %38, i32 0, i32 %42)
%44 = load i32, i32* @SHA256_DIGEST_LENGTH
%45 = xor i32 %44, -1
%46 = add i32 %39, %45
%47 = sext i32 %46 to i64
%48 = getelementptr inbounds i8, i8* %31, i64 %47
store i8 1, i8* %48
%49 = sext i32 %7 to i64
%50 = getelementptr inbounds i8, i8* %31, i64 %49
%51 = sext i32 %3 to i64
%52 = sub nsw i64 0, %51
%53 = getelementptr inbounds i8, i8* %50, i64 %52
%54 = load i32, i32* @SHA256_DIGEST_LENGTH
%55 = sext i32 %54 to i64
%56 = sub nsw i64 0, %55
%57 = getelementptr inbounds i8, i8* %53, i64 %56
%58 = tail call i32 @memcpy(i8* %57, i8* %2, i32 %3)
%59 = load i32, i32* @SHA256_DIGEST_LENGTH
%60 = tail call i64 @RAND_bytes(i8* %27, i32 %59)
%61 = icmp slt i64 %60, 1
br i1 %61, label %113, label %62
62: ; preds = %35
%63 = load i32, i32* @SHA256_DIGEST_LENGTH
%64 = sub nsw i32 %7, %63
%65 = tail call i8* @OPENSSL_malloc(i32 %64)
%66 = icmp eq i8* %65, null
br i1 %66, label %67, label %71
67: ; preds = %62
%68 = load i32, i32* @RSA_F_RSA_PADDING_ADD_PKCS1_OAEP
%69 = load i32, i32* @ERR_R_MALLOC_FAILURE
%70 = tail call i32 @RSAerr(i32 %68, i32 %69)
br label %113
71: ; preds = %62
%72 = load i32, i32* @SHA256_DIGEST_LENGTH
%73 = sub nsw i32 %7, %72
%74 = tail call i64 @MGF1_SHA256(i8* %65, i32 %73, i8* %27, i32 %72)
%75 = icmp slt i64 %74, 0
br i1 %75, label %113, label %76
76: ; preds = %71
%77 = load i32, i32* @SHA256_DIGEST_LENGTH
%78 = sub nsw i32 %7, %77
%79 = icmp sgt i32 %78, 0
br i1 %79, label %80, label %92
80: ; preds = %76, %80
%81 = phi i64 [ %87, %80 ], [ 0, %76 ]
%82 = getelementptr inbounds i8, i8* %65, i64 %81
%83 = load i8, i8* %82
%84 = getelementptr inbounds i8, i8* %31, i64 %81
%85 = load i8, i8* %84
%86 = xor i8 %85, %83
store i8 %86, i8* %84
%87 = add nuw nsw i64 %81, 1
%88 = load i32, i32* @SHA256_DIGEST_LENGTH
%89 = sub nsw i32 %7, %88
%90 = sext i32 %89 to i64
%91 = icmp slt i64 %87, %90
br i1 %91, label %80, label %92
92: ; preds = %80, %76
%93 = phi i32 [ %77, %76 ], [ %88, %80 ]
%94 = phi i32 [ %78, %76 ], [ %89, %80 ]
%95 = call i64 @MGF1_SHA256(i8* %10, i32 %93, i8* %31, i32 %94)
%96 = icmp slt i64 %95, 0
br i1 %96, label %113, label %97
97: ; preds = %92
%98 = load i32, i32* @SHA256_DIGEST_LENGTH
%99 = icmp sgt i32 %98, 0
br i1 %99, label %100, label %111
100: ; preds = %97, %100
%101 = phi i64 [ %107, %100 ], [ 0, %97 ]
%102 = getelementptr inbounds i8, i8* %10, i64 %101
%103 = load i8, i8* %102
%104 = getelementptr inbounds i8, i8* %27, i64 %101
%105 = load i8, i8* %104
%106 = xor i8 %105, %103
store i8 %106, i8* %104
%107 = add nuw nsw i64 %101, 1
%108 = load i32, i32* @SHA256_DIGEST_LENGTH
%109 = sext i32 %108 to i64
%110 = icmp slt i64 %107, %109
br i1 %110, label %100, label %111
111: ; preds = %100, %97
%112 = call i32 @OPENSSL_free(i8* %65)
br label %113
113: ; preds = %92, %71, %35, %26, %111, %67, %22, %15
%114 = phi i32 [ 0, %15 ], [ 0, %22 ], [ 0, %67 ], [ 1, %111 ], [ 0, %26 ], [ 0, %35 ], [ 0, %71 ], [ 0, %92 ]
ret i32 %114
}