#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ buf;

/* Variables and functions */
int /*<<< orphan*/ cleanup_(unsigned char *, int);
int /*<<< orphan*/ crypto_hash_sha512_tinynacl(unsigned char *, unsigned char *,
                                               int);
int crypto_kem_sntrup761_tinynacl_dec(unsigned char *, unsigned char const *,
                                      unsigned char const *);
int crypto_scalarmult_curve25519_tinynacl(unsigned char *,
                                          unsigned char const *,
                                          unsigned char const *);
int /*<<< orphan*/ randombytes(unsigned char *, int);
unsigned char returnmask(int);
int crypto_kem_sntrup761x25519_tinynacl_dec(unsigned char *k,
                                            const unsigned char *c,
                                            const unsigned char *sk) {
  int r = 0;
  long long i;
  unsigned char buf[32 + 32];
  unsigned char tmp[32 + 32];
  unsigned char b;
  r |= crypto_kem_sntrup761_tinynacl_dec(buf, c, sk);
  sk += 1763;
  c += 1039;
  r |= crypto_scalarmult_curve25519_tinynacl(buf + 32, sk, c);
  randombytes(tmp, sizeof tmp);
  b = returnmask(r);
  for (i = 0; i < 32 + 32; ++i)
    tmp[i] = b & (tmp[i] ^ buf[i]);
  for (i = 0; i < 32 + 32; ++i)
    buf[i] ^= tmp[i];
  crypto_hash_sha512_tinynacl(k, buf, sizeof buf);
  cleanup_((buf), sizeof(buf));
  return r;
}


x86 assembly (clang, -O0):
<crypto_kem_sntrup761x25519_tinynacl_dec>:
push   %rbp
mov    %rsp,%rbp
sub    $0xc0,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
movl   $0x0,-0x1c(%rbp)
lea    -0x70(%rbp),%rdi
mov    -0x10(%rbp),%rsi
mov    -0x18(%rbp),%rdx
call   1030 <crypto_kem_sntrup761_tinynacl_dec@plt>
or     -0x1c(%rbp),%eax
mov    %eax,-0x1c(%rbp)
mov    -0x18(%rbp),%rax
add    $0x6e3,%rax
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rax
add    $0x40f,%rax
mov    %rax,-0x10(%rbp)
lea    -0x70(%rbp),%rdi
add    $0x20,%rdi
mov    -0x18(%rbp),%rsi
mov    -0x10(%rbp),%rdx
call   1040 <crypto_scalarmult_curve25519_tinynacl@plt>
or     -0x1c(%rbp),%eax
mov    %eax,-0x1c(%rbp)
lea    -0xb0(%rbp),%rdi
mov    $0x40,%esi
call   1050 <randombytes@plt>
mov    -0x1c(%rbp),%edi
call   1060 <returnmask@plt>
mov    %al,-0xb1(%rbp)
movq   $0x0,-0x28(%rbp)
cmpq   $0x40,-0x28(%rbp)
jge    123c <crypto_kem_sntrup761x25519_tinynacl_dec+0xdc>
movzbl -0xb1(%rbp),%eax
mov    -0x28(%rbp),%rcx
movzbl -0xb0(%rbp,%rcx,1),%ecx
ff
mov    -0x28(%rbp),%rdx
movzbl -0x70(%rbp,%rdx,1),%edx
xor    %edx,%ecx
and    %ecx,%eax
mov    %al,%cl
mov    -0x28(%rbp),%rax
mov    %cl,-0xb0(%rbp,%rax,1)
mov    -0x28(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x28(%rbp)
jmp    11f3 <crypto_kem_sntrup761x25519_tinynacl_dec+0x93>
movq   $0x0,-0x28(%rbp)
cmpq   $0x40,-0x28(%rbp)
jge    127b <crypto_kem_sntrup761x25519_tinynacl_dec+0x11b>
mov    -0x28(%rbp),%rax
movzbl -0xb0(%rbp,%rax,1),%edx
ff
mov    -0x28(%rbp),%rax
movzbl -0x70(%rbp,%rax,1),%ecx
xor    %edx,%ecx
mov    %cl,-0x70(%rbp,%rax,1)
mov    -0x28(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x28(%rbp)
jmp    1244 <crypto_kem_sntrup761x25519_tinynacl_dec+0xe4>
mov    -0x8(%rbp),%rdi
lea    -0x70(%rbp),%rsi
mov    $0x40,%edx
call   1070 <crypto_hash_sha512_tinynacl@plt>
lea    -0x70(%rbp),%rdi
mov    $0x40,%esi
call   1080 <cleanup_@plt>
mov    -0x1c(%rbp),%eax
add    $0xc0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<crypto_kem_sntrup761x25519_tinynacl_dec>:
push   %rbp
push   %r15
push   %r14
push   %r12
push   %rbx
sub    $0x80,%rsp
mov    %rdx,%rbp
mov    %rsi,%rbx
mov    %rdi,%r15
mov    %rsp,%r14
mov    %r14,%rdi
call   1030 <crypto_kem_sntrup761_tinynacl_dec@plt>
mov    %eax,%r12d
add    $0x6e3,%rbp
add    $0x40f,%rbx
lea    0x20(%rsp),%rdi
mov    %rbp,%rsi
mov    %rbx,%rdx
call   1040 <crypto_scalarmult_curve25519_tinynacl@plt>
mov    %eax,%ebp
or     %r12d,%ebp
lea    0x40(%rsp),%rdi
mov    $0x40,%esi
call   1050 <randombytes@plt>
mov    %ebp,%edi
call   1060 <returnmask@plt>
movzbl %al,%eax
movd   %eax,%xmm0
punpcklbw %xmm0,%xmm0
pshuflw $0x0,%xmm0,%xmm0
pshufd $0x0,%xmm0,%xmm2
movdqa (%rsp),%xmm3
movdqa 0x10(%rsp),%xmm4
movdqa 0x20(%rsp),%xmm1
movdqa 0x30(%rsp),%xmm8
movdqa 0x40(%rsp),%xmm5
pxor   %xmm3,%xmm5
pand   %xmm2,%xmm5
movdqa %xmm5,0x40(%rsp)
movdqa 0x50(%rsp),%xmm6
pxor   %xmm4,%xmm6
pand   %xmm2,%xmm6
movdqa %xmm6,0x50(%rsp)
movdqa 0x60(%rsp),%xmm7
pxor   %xmm1,%xmm7
pand   %xmm2,%xmm7
movdqa %xmm7,0x60(%rsp)
movdqa 0x70(%rsp),%xmm0
pxor   %xmm8,%xmm0
pand   %xmm2,%xmm0
movdqa %xmm0,0x70(%rsp)
pxor   %xmm3,%xmm5
movdqa %xmm5,(%rsp)
pxor   %xmm4,%xmm6
movdqa %xmm6,0x10(%rsp)
pxor   %xmm1,%xmm7
movdqa %xmm7,0x20(%rsp)
pxor   %xmm8,%xmm0
movdqa %xmm0,0x30(%rsp)
mov    %r15,%rdi
mov    %r14,%rsi
mov    $0x40,%edx
call   1070 <crypto_hash_sha512_tinynacl@plt>
mov    %r14,%rdi
mov    $0x40,%esi
call   1080 <cleanup_@plt>
mov    %ebp,%eax
add    $0x80,%rsp
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
define i32 @crypto_kem_sntrup761x25519_tinynacl_dec(i8* %0, i8* %1, i8* %2) {
%4 = alloca i8*
%5 = alloca i8*
%6 = alloca i8*
%7 = alloca i32
%8 = alloca i64
%9 = alloca [64 x i8]
%10 = alloca [64 x i8]
%11 = alloca i8
store i8* %0, i8** %4
store i8* %1, i8** %5
store i8* %2, i8** %6
store i32 0, i32* %7
%12 = getelementptr inbounds [64 x i8], [64 x i8]* %9, i64 0, i64 0
%13 = load i8*, i8** %5
%14 = load i8*, i8** %6
%15 = call i32 @crypto_kem_sntrup761_tinynacl_dec(i8* %12, i8* %13, i8* %14)
%16 = load i32, i32* %7
%17 = or i32 %16, %15
store i32 %17, i32* %7
%18 = load i8*, i8** %6
%19 = getelementptr inbounds i8, i8* %18, i64 1763
store i8* %19, i8** %6
%20 = load i8*, i8** %5
%21 = getelementptr inbounds i8, i8* %20, i64 1039
store i8* %21, i8** %5
%22 = getelementptr inbounds [64 x i8], [64 x i8]* %9, i64 0, i64 0
%23 = getelementptr inbounds i8, i8* %22, i64 32
%24 = load i8*, i8** %6
%25 = load i8*, i8** %5
%26 = call i32 @crypto_scalarmult_curve25519_tinynacl(i8* %23, i8* %24, i8* %25)
%27 = load i32, i32* %7
%28 = or i32 %27, %26
store i32 %28, i32* %7
%29 = getelementptr inbounds [64 x i8], [64 x i8]* %10, i64 0, i64 0
%30 = call i32 @randombytes(i8* %29, i32 64)
%31 = load i32, i32* %7
%32 = call zeroext i8 @returnmask(i32 %31)
store i8 %32, i8* %11
store i64 0, i64* %8
br label %33
33: ; preds = %52, %3
%34 = load i64, i64* %8
%35 = icmp slt i64 %34, 64
br i1 %35, label %36, label %55
36: ; preds = %33
%37 = load i8, i8* %11
%38 = zext i8 %37 to i32
%39 = load i64, i64* %8
%40 = getelementptr inbounds [64 x i8], [64 x i8]* %10, i64 0, i64 %39
%41 = load i8, i8* %40
%42 = zext i8 %41 to i32
%43 = load i64, i64* %8
%44 = getelementptr inbounds [64 x i8], [64 x i8]* %9, i64 0, i64 %43
%45 = load i8, i8* %44
%46 = zext i8 %45 to i32
%47 = xor i32 %42, %46
%48 = and i32 %38, %47
%49 = trunc i32 %48 to i8
%50 = load i64, i64* %8
%51 = getelementptr inbounds [64 x i8], [64 x i8]* %10, i64 0, i64 %50
store i8 %49, i8* %51
br label %52
52: ; preds = %36
%53 = load i64, i64* %8
%54 = add nsw i64 %53, 1
store i64 %54, i64* %8
br label %33
55: ; preds = %33
store i64 0, i64* %8
br label %56
56: ; preds = %70, %55
%57 = load i64, i64* %8
%58 = icmp slt i64 %57, 64
br i1 %58, label %59, label %73
59: ; preds = %56
%60 = load i64, i64* %8
%61 = getelementptr inbounds [64 x i8], [64 x i8]* %10, i64 0, i64 %60
%62 = load i8, i8* %61
%63 = zext i8 %62 to i32
%64 = load i64, i64* %8
%65 = getelementptr inbounds [64 x i8], [64 x i8]* %9, i64 0, i64 %64
%66 = load i8, i8* %65
%67 = zext i8 %66 to i32
%68 = xor i32 %67, %63
%69 = trunc i32 %68 to i8
store i8 %69, i8* %65
br label %70
70: ; preds = %59
%71 = load i64, i64* %8
%72 = add nsw i64 %71, 1
store i64 %72, i64* %8
br label %56
73: ; preds = %56
%74 = load i8*, i8** %4
%75 = getelementptr inbounds [64 x i8], [64 x i8]* %9, i64 0, i64 0
%76 = call i32 @crypto_hash_sha512_tinynacl(i8* %74, i8* %75, i32 64)
%77 = getelementptr inbounds [64 x i8], [64 x i8]* %9, i64 0, i64 0
%78 = call i32 @cleanup_(i8* %77, i32 64)
%79 = load i32, i32* %7
ret i32 %79
}

LLVM IR (-O2):
define i32 @crypto_kem_sntrup761x25519_tinynacl_dec(i8* %0, i8* %1, i8* %2) {
%4 = alloca [64 x i8]
%5 = alloca [64 x i8]
%6 = getelementptr inbounds [64 x i8], [64 x i8]* %4, i64 0, i64 0
%7 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 0
%8 = call i32 @crypto_kem_sntrup761_tinynacl_dec(i8* %6, i8* %1, i8* %2)
%9 = getelementptr inbounds i8, i8* %2, i64 1763
%10 = getelementptr inbounds i8, i8* %1, i64 1039
%11 = getelementptr inbounds [64 x i8], [64 x i8]* %4, i64 0, i64 32
%12 = call i32 @crypto_scalarmult_curve25519_tinynacl(i8* %11, i8* %9, i8* %10)
%13 = or i32 %12, %8
%14 = call i32 @randombytes(i8* %7, i32 64)
%15 = call zeroext i8 @returnmask(i32 %13)
%16 = insertelement <16 x i8> poison, i8 %15, i64 0
%17 = shufflevector <16 x i8> %16, <16 x i8> poison, <16 x i32> zeroinitializer
%18 = bitcast [64 x i8]* %5 to <16 x i8>*
%19 = load <16 x i8>, <16 x i8>* %18
%20 = bitcast [64 x i8]* %4 to <16 x i8>*
%21 = load <16 x i8>, <16 x i8>* %20
%22 = xor <16 x i8> %21, %19
%23 = and <16 x i8> %22, %17
%24 = bitcast [64 x i8]* %5 to <16 x i8>*
store <16 x i8> %23, <16 x i8>* %24
%25 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 16
%26 = bitcast i8* %25 to <16 x i8>*
%27 = load <16 x i8>, <16 x i8>* %26
%28 = getelementptr inbounds [64 x i8], [64 x i8]* %4, i64 0, i64 16
%29 = bitcast i8* %28 to <16 x i8>*
%30 = load <16 x i8>, <16 x i8>* %29
%31 = xor <16 x i8> %30, %27
%32 = and <16 x i8> %31, %17
%33 = bitcast i8* %25 to <16 x i8>*
store <16 x i8> %32, <16 x i8>* %33
%34 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 32
%35 = bitcast i8* %34 to <16 x i8>*
%36 = load <16 x i8>, <16 x i8>* %35
%37 = getelementptr inbounds [64 x i8], [64 x i8]* %4, i64 0, i64 32
%38 = bitcast i8* %37 to <16 x i8>*
%39 = load <16 x i8>, <16 x i8>* %38
%40 = xor <16 x i8> %39, %36
%41 = and <16 x i8> %40, %17
%42 = bitcast i8* %34 to <16 x i8>*
store <16 x i8> %41, <16 x i8>* %42
%43 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 48
%44 = bitcast i8* %43 to <16 x i8>*
%45 = load <16 x i8>, <16 x i8>* %44
%46 = getelementptr inbounds [64 x i8], [64 x i8]* %4, i64 0, i64 48
%47 = bitcast i8* %46 to <16 x i8>*
%48 = load <16 x i8>, <16 x i8>* %47
%49 = xor <16 x i8> %48, %45
%50 = and <16 x i8> %49, %17
%51 = bitcast i8* %43 to <16 x i8>*
store <16 x i8> %50, <16 x i8>* %51
%52 = bitcast [64 x i8]* %5 to <16 x i8>*
%53 = load <16 x i8>, <16 x i8>* %52
%54 = bitcast [64 x i8]* %4 to <16 x i8>*
%55 = load <16 x i8>, <16 x i8>* %54
%56 = xor <16 x i8> %55, %53
%57 = bitcast [64 x i8]* %4 to <16 x i8>*
store <16 x i8> %56, <16 x i8>* %57
%58 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 16
%59 = bitcast i8* %58 to <16 x i8>*
%60 = load <16 x i8>, <16 x i8>* %59
%61 = getelementptr inbounds [64 x i8], [64 x i8]* %4, i64 0, i64 16
%62 = bitcast i8* %61 to <16 x i8>*
%63 = load <16 x i8>, <16 x i8>* %62
%64 = xor <16 x i8> %63, %60
%65 = bitcast i8* %61 to <16 x i8>*
store <16 x i8> %64, <16 x i8>* %65
%66 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 32
%67 = bitcast i8* %66 to <16 x i8>*
%68 = load <16 x i8>, <16 x i8>* %67
%69 = getelementptr inbounds [64 x i8], [64 x i8]* %4, i64 0, i64 32
%70 = bitcast i8* %69 to <16 x i8>*
%71 = load <16 x i8>, <16 x i8>* %70
%72 = xor <16 x i8> %71, %68
%73 = bitcast i8* %69 to <16 x i8>*
store <16 x i8> %72, <16 x i8>* %73
%74 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 48
%75 = bitcast i8* %74 to <16 x i8>*
%76 = load <16 x i8>, <16 x i8>* %75
%77 = getelementptr inbounds [64 x i8], [64 x i8]* %4, i64 0, i64 48
%78 = bitcast i8* %77 to <16 x i8>*
%79 = load <16 x i8>, <16 x i8>* %78
%80 = xor <16 x i8> %79, %76
%81 = bitcast i8* %77 to <16 x i8>*
store <16 x i8> %80, <16 x i8>* %81
%82 = call i32 @crypto_hash_sha512_tinynacl(i8* %0, i8* %6, i32 64)
%83 = call i32 @cleanup_(i8* %6, i32 64)
ret i32 %13
}