#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ aes256ctr(unsigned char *, unsigned char *,
                             unsigned long long, unsigned char *,
                             unsigned char *);
int /*<<< orphan*/ aescrypt(unsigned char *, unsigned char *, unsigned int *);
int /*<<< orphan*/ aeskey(unsigned int *, unsigned char *);
int /*<<< orphan*/ bzero(unsigned char *, int);
int /*<<< orphan*/ crypto_ghash(unsigned char *, unsigned char *,
                                unsigned long long, unsigned char *,
                                unsigned char *);
int /*<<< orphan*/ memcpy(unsigned char *, unsigned char *, int);
void aes256gcmcrypt(unsigned char *c, unsigned char *m, unsigned long long mlen,
                    unsigned char *nonce, unsigned char *key) {
  unsigned char zeros[16];
  unsigned char h[16];
  unsigned int space[60];
  unsigned char j0[16];
  unsigned char tag[16];
  bzero(zeros, 16);
  memcpy(j0, nonce, 12);
  j0[12] = 0;
  j0[13] = 0;
  j0[14] = 0;
  j0[15] = 1;
  aeskey(space, key);
  aescrypt(h, zeros, space);
  for (int i = 0; i < 60; i++) {
    space[i] = 0;
  }
  aes256ctr(c, m, mlen, key, j0);
  crypto_ghash(tag, c + 16, mlen - 16, h, c);
  memcpy(c, tag, 16);
  for (int i = 0; i < 16; i++) {
    h[i] = 0;
  }
  return;
}


x86 assembly (clang, -O0):
<aes256gcmcrypt>:
push   %rbp
mov    %rsp,%rbp
sub    $0x170,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
mov    %rcx,-0x20(%rbp)
mov    %r8,-0x28(%rbp)
lea    -0x40(%rbp),%rdi
mov    $0x10,%esi
call   1050 <bzero@plt>
lea    -0x150(%rbp),%rdi
mov    -0x20(%rbp),%rsi
mov    $0xc,%edx
call   1040 <memcpy@plt>
movb   $0x0,-0x144(%rbp)
movb   $0x0,-0x143(%rbp)
movb   $0x0,-0x142(%rbp)
movb   $0x1,-0x141(%rbp)
lea    -0x140(%rbp),%rdi
mov    -0x28(%rbp),%rsi
call   1060 <aeskey@plt>
lea    -0x50(%rbp),%rdi
lea    -0x40(%rbp),%rsi
lea    -0x140(%rbp),%rdx
call   1030 <aescrypt@plt>
movl   $0x0,-0x164(%rbp)
cmpl   $0x3c,-0x164(%rbp)
jge    121f <aes256gcmcrypt+0xbf>
movslq -0x164(%rbp),%rax
movl   $0x0,-0x140(%rbp,%rax,4)
mov    -0x164(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x164(%rbp)
jmp    11ec <aes256gcmcrypt+0x8c>
mov    -0x8(%rbp),%rdi
mov    -0x10(%rbp),%rsi
mov    -0x18(%rbp),%rdx
mov    -0x28(%rbp),%rcx
lea    -0x150(%rbp),%r8
call   1070 <aes256ctr@plt>
lea    -0x160(%rbp),%rdi
mov    -0x8(%rbp),%rsi
add    $0x10,%rsi
mov    -0x18(%rbp),%rdx
sub    $0x10,%rdx
lea    -0x50(%rbp),%rcx
mov    -0x8(%rbp),%r8
call   1080 <crypto_ghash@plt>
mov    -0x8(%rbp),%rdi
lea    -0x160(%rbp),%rsi
mov    $0x10,%edx
call   1040 <memcpy@plt>
movl   $0x0,-0x168(%rbp)
cmpl   $0x10,-0x168(%rbp)
jge    12ab <aes256gcmcrypt+0x14b>
movslq -0x168(%rbp),%rax
movb   $0x0,-0x50(%rbp,%rax,1)
mov    -0x168(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x168(%rbp)
jmp    127e <aes256gcmcrypt+0x11e>
add    $0x170,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<aes256gcmcrypt>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x138,%rsp
mov    %r8,%r15
mov    %rcx,%rbp
mov    %rdx,%rbx
mov    %rsi,%r12
mov    %rdi,%r14
lea    0x120(%rsp),%r13
mov    %r13,%rdi
mov    $0x10,%esi
call   1050 <bzero@plt>
mov    %rsp,%rdi
mov    %rbp,%rsi
mov    $0xc,%edx
call   1040 <memcpy@plt>
movl   $0x1000000,0xc(%rsp)
01
lea    0x20(%rsp),%rbp
mov    %rbp,%rdi
mov    %r15,%rsi
call   1060 <aeskey@plt>
lea    0x10(%rsp),%rdi
mov    %r13,%rsi
mov    %rbp,%rdx
call   1030 <aescrypt@plt>
xorps  %xmm0,%xmm0
movaps %xmm0,0x20(%rsp)
movaps %xmm0,0x30(%rsp)
movaps %xmm0,0x40(%rsp)
movaps %xmm0,0x50(%rsp)
movaps %xmm0,0x60(%rsp)
movaps %xmm0,0x70(%rsp)
movaps %xmm0,0x80(%rsp)
movaps %xmm0,0x90(%rsp)
movaps %xmm0,0xa0(%rsp)
movaps %xmm0,0xb0(%rsp)
movaps %xmm0,0xc0(%rsp)
movaps %xmm0,0xd0(%rsp)
movaps %xmm0,0xe0(%rsp)
movaps %xmm0,0xf0(%rsp)
movaps %xmm0,0x100(%rsp)
mov    %r14,%rdi
mov    %r12,%rsi
mov    %rbx,%rdx
mov    %r15,%rcx
mov    %rsp,%r8
call   1070 <aes256ctr@plt>
lea    0x10(%r14),%rsi
add    $0xfffffffffffffff0,%rbx
lea    0x110(%rsp),%rbp
mov    %rbp,%rdi
mov    %rbx,%rdx
lea    0x10(%rsp),%rcx
mov    %r14,%r8
call   1080 <crypto_ghash@plt>
mov    %r14,%rdi
mov    %rbp,%rsi
mov    $0x10,%edx
call   1040 <memcpy@plt>
add    $0x138,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
define void @aes256gcmcrypt(i8* %0, i8* %1, i64 %2, i8* %3, i8* %4) {
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i64
%9 = alloca i8*
%10 = alloca i8*
%11 = alloca [16 x i8]
%12 = alloca [16 x i8]
%13 = alloca [60 x i32]
%14 = alloca [16 x i8]
%15 = alloca [16 x i8]
%16 = alloca i32
%17 = alloca i32
store i8* %0, i8** %6
store i8* %1, i8** %7
store i64 %2, i64* %8
store i8* %3, i8** %9
store i8* %4, i8** %10
%18 = getelementptr inbounds [16 x i8], [16 x i8]* %11, i64 0, i64 0
%19 = call i32 @bzero(i8* %18, i32 16)
%20 = getelementptr inbounds [16 x i8], [16 x i8]* %14, i64 0, i64 0
%21 = load i8*, i8** %9
%22 = call i32 @memcpy(i8* %20, i8* %21, i32 12)
%23 = getelementptr inbounds [16 x i8], [16 x i8]* %14, i64 0, i64 12
store i8 0, i8* %23
%24 = getelementptr inbounds [16 x i8], [16 x i8]* %14, i64 0, i64 13
store i8 0, i8* %24
%25 = getelementptr inbounds [16 x i8], [16 x i8]* %14, i64 0, i64 14
store i8 0, i8* %25
%26 = getelementptr inbounds [16 x i8], [16 x i8]* %14, i64 0, i64 15
store i8 1, i8* %26
%27 = getelementptr inbounds [60 x i32], [60 x i32]* %13, i64 0, i64 0
%28 = load i8*, i8** %10
%29 = call i32 @aeskey(i32* %27, i8* %28)
%30 = getelementptr inbounds [16 x i8], [16 x i8]* %12, i64 0, i64 0
%31 = getelementptr inbounds [16 x i8], [16 x i8]* %11, i64 0, i64 0
%32 = getelementptr inbounds [60 x i32], [60 x i32]* %13, i64 0, i64 0
%33 = call i32 @aescrypt(i8* %30, i8* %31, i32* %32)
store i32 0, i32* %16
br label %34
34: ; preds = %41, %5
%35 = load i32, i32* %16
%36 = icmp slt i32 %35, 60
br i1 %36, label %37, label %44
37: ; preds = %34
%38 = load i32, i32* %16
%39 = sext i32 %38 to i64
%40 = getelementptr inbounds [60 x i32], [60 x i32]* %13, i64 0, i64 %39
store i32 0, i32* %40
br label %41
41: ; preds = %37
%42 = load i32, i32* %16
%43 = add nsw i32 %42, 1
store i32 %43, i32* %16
br label %34
44: ; preds = %34
%45 = load i8*, i8** %6
%46 = load i8*, i8** %7
%47 = load i64, i64* %8
%48 = load i8*, i8** %10
%49 = getelementptr inbounds [16 x i8], [16 x i8]* %14, i64 0, i64 0
%50 = call i32 @aes256ctr(i8* %45, i8* %46, i64 %47, i8* %48, i8* %49)
%51 = getelementptr inbounds [16 x i8], [16 x i8]* %15, i64 0, i64 0
%52 = load i8*, i8** %6
%53 = getelementptr inbounds i8, i8* %52, i64 16
%54 = load i64, i64* %8
%55 = sub i64 %54, 16
%56 = getelementptr inbounds [16 x i8], [16 x i8]* %12, i64 0, i64 0
%57 = load i8*, i8** %6
%58 = call i32 @crypto_ghash(i8* %51, i8* %53, i64 %55, i8* %56, i8* %57)
%59 = load i8*, i8** %6
%60 = getelementptr inbounds [16 x i8], [16 x i8]* %15, i64 0, i64 0
%61 = call i32 @memcpy(i8* %59, i8* %60, i32 16)
store i32 0, i32* %17
br label %62
62: ; preds = %69, %44
%63 = load i32, i32* %17
%64 = icmp slt i32 %63, 16
br i1 %64, label %65, label %72
65: ; preds = %62
%66 = load i32, i32* %17
%67 = sext i32 %66 to i64
%68 = getelementptr inbounds [16 x i8], [16 x i8]* %12, i64 0, i64 %67
store i8 0, i8* %68
br label %69
69: ; preds = %65
%70 = load i32, i32* %17
%71 = add nsw i32 %70, 1
store i32 %71, i32* %17
br label %62
72: ; preds = %62
ret void
}

LLVM IR (-O2):
define void @aes256gcmcrypt(i8* %0, i8* %1, i64 %2, i8* %3, i8* %4) {
%6 = alloca [16 x i8]
%7 = alloca [16 x i8]
%8 = alloca [60 x i32]
%9 = bitcast [60 x i32]* %8 to i8*
%10 = alloca [16 x i8]
%11 = alloca [16 x i8]
%12 = getelementptr inbounds [16 x i8], [16 x i8]* %6, i64 0, i64 0
%13 = getelementptr inbounds [16 x i8], [16 x i8]* %7, i64 0, i64 0
%14 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 0
%15 = getelementptr inbounds [16 x i8], [16 x i8]* %11, i64 0, i64 0
%16 = call i32 @bzero(i8* %12, i32 16)
%17 = call i32 @memcpy(i8* %14, i8* %3, i32 12)
%18 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 12
store i8 0, i8* %18
%19 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 13
store i8 0, i8* %19
%20 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 14
store i8 0, i8* %20
%21 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 15
store i8 1, i8* %21
%22 = getelementptr inbounds [60 x i32], [60 x i32]* %8, i64 0, i64 0
%23 = call i32 @aeskey(i32* %22, i8* %4)
%24 = call i32 @aescrypt(i8* %13, i8* %12, i32* %22)
%25 = call i32 @aes256ctr(i8* %0, i8* %1, i64 %2, i8* %4, i8* %14)
%26 = getelementptr inbounds i8, i8* %0, i64 16
%27 = add i64 %2, -16
%28 = call i32 @crypto_ghash(i8* %15, i8* %26, i64 %27, i8* %13, i8* %0)
%29 = call i32 @memcpy(i8* %0, i8* %15, i32 16)
ret void
}