unsigned short dns_k_shuffle16(unsigned short n, unsigned s) {
  static const unsigned char sbox[256] = {
      0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b,
      0xfe, 0xd7, 0xab, 0x76, 0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0,
      0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0, 0xb7, 0xfd, 0x93, 0x26,
      0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
      0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2,
      0xeb, 0x27, 0xb2, 0x75, 0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0,
      0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84, 0x53, 0xd1, 0x00, 0xed,
      0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
      0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f,
      0x50, 0x3c, 0x9f, 0xa8, 0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5,
      0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2, 0xcd, 0x0c, 0x13, 0xec,
      0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
      0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14,
      0xde, 0x5e, 0x0b, 0xdb, 0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c,
      0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79, 0xe7, 0xc8, 0x37, 0x6d,
      0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
      0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f,
      0x4b, 0xbd, 0x8b, 0x8a, 0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e,
      0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e, 0xe1, 0xf8, 0x98, 0x11,
      0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
      0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f,
      0xb0, 0x54, 0xbb, 0x16};
  unsigned char a, b;
  unsigned i;
  a = 0xff & (n >> 0);
  b = 0xff & (n >> 8);
  for (i = 0; i < 4; i++) {
    a ^= 0xff & s;
    a = sbox[a] ^ b;
    b = sbox[b] ^ a;
    s >>= 8;
  }
  return ((0xff00 & (a << 8)) | (0x00ff & (b << 0)));
}


x86 assembly (clang, -O0):
<dns_k_shuffle16>:
push   %rbp
mov    %rsp,%rbp
mov    %di,%ax
mov    %ax,-0x2(%rbp)
mov    %esi,-0x8(%rbp)
movzwl -0x2(%rbp),%eax
sar    $0x0,%eax
and    $0xff,%eax
mov    %al,-0x9(%rbp)
movzwl -0x2(%rbp),%eax
sar    $0x8,%eax
and    $0xff,%eax
mov    %al,-0xa(%rbp)
movl   $0x0,-0x10(%rbp)
cmpl   $0x4,-0x10(%rbp)
jae    119a <dns_k_shuffle16+0x9a>
mov    -0x8(%rbp),%ecx
and    $0xff,%ecx
movzbl -0x9(%rbp),%eax
xor    %ecx,%eax
mov    %al,-0x9(%rbp)
movzbl -0x9(%rbp),%eax
mov    %eax,%ecx
lea    0xea4(%rip),%rax
movzbl (%rax,%rcx,1),%eax
movzbl -0xa(%rbp),%ecx
xor    %ecx,%eax
mov    %al,-0x9(%rbp)
movzbl -0xa(%rbp),%eax
mov    %eax,%ecx
lea    0xe8a(%rip),%rax
movzbl (%rax,%rcx,1),%eax
movzbl -0x9(%rbp),%ecx
xor    %ecx,%eax
mov    %al,-0xa(%rbp)
mov    -0x8(%rbp),%eax
shr    $0x8,%eax
mov    %eax,-0x8(%rbp)
mov    -0x10(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x10(%rbp)
jmp    1133 <dns_k_shuffle16+0x33>
movzbl -0x9(%rbp),%eax
shl    $0x8,%eax
and    $0xff00,%eax
movzbl -0xa(%rbp),%ecx
shl    $0x0,%ecx
and    $0xff,%ecx
or     %ecx,%eax
movzwl %ax,%eax
pop    %rbp
ret

x86 assembly (clang, -O2):
<dns_k_shuffle16>:
mov    %edi,%ecx
shr    $0x8,%rcx
xor    %esi,%edi
movzbl %dil,%edx
lea    0xeed(%rip),%rax
mov    (%rdx,%rax,1),%dl
xor    %cl,%dl
mov    (%rcx,%rax,1),%cl
xor    %dl,%cl
mov    %esi,%edi
shr    $0x8,%edi
xor    %dl,%dil
movzbl %dil,%edx
movzbl %cl,%edi
xor    (%rdx,%rax,1),%cl
mov    (%rdi,%rax,1),%dl
xor    %cl,%dl
mov    %esi,%edi
shr    $0x10,%edi
xor    %cl,%dil
movzbl %dil,%ecx
movzbl %dl,%edi
xor    (%rcx,%rax,1),%dl
mov    (%rdi,%rax,1),%cl
xor    %dl,%cl
shr    $0x18,%esi
xor    %dl,%sil
movzbl %sil,%edx
movzbl %cl,%esi
xor    (%rdx,%rax,1),%cl
movzbl %cl,%edx
xor    (%rsi,%rax,1),%cl
shl    $0x8,%edx
movzbl %cl,%eax
or     %edx,%eax
ret

LLVM IR (-O0):
@dns_k_shuffle16.sbox = internal constant [256 x i8] c"c|w{\F2ko\C50\01g+\FE\D7\ABv\CA\82\C9}\FAYG\F0\AD\D4\A2\AF\9C\A4r\C0\B7\FD\93&6?\F7\CC4\A5\E5\F1q\D81\15\04\C7#\C3\18\96\05\9A\07\12\80\E2\EB'\B2u\09\83,\1A\1BnZ\A0R;\D6\B3)\E3/\84S\D1\00\ED \FC\B1[j\CB\BE9JLX\CF\D0\EF\AA\FBCM3\85E\F9\02\7FP<\9F\A8Q\A3@\8F\92\9D8\F5\BC\B6\DA!\10\FF\F3\D2\CD\0C\13\EC_\97D\17\C4\A7~=d]\19s`\81O\DC\22*\90\88F\EE\B8\14\DE^\0B\DB\E02:\0AI\06$\\\C2\D3\ACb\91\95\E4y\E7\C87m\8D\D5N\A9lV\F4\EAez\AE\08\BAx%.\1C\A6\B4\C6\E8\DDt\1FK\BD\8B\8Ap>\B5fH\03\F6\0Ea5W\B9\86\C1\1D\9E\E1\F8\98\11i\D9\8E\94\9B\1E\87\E9\CEU(\DF\8C\A1\89\0D\BF\E6BhA\99-\0F\B0T\BB\16"
define zeroext i16 @dns_k_shuffle16(i16 zeroext %0, i32 %1) {
%3 = alloca i16
%4 = alloca i32
%5 = alloca i8
%6 = alloca i8
%7 = alloca i32
store i16 %0, i16* %3
store i32 %1, i32* %4
%8 = load i16, i16* %3
%9 = zext i16 %8 to i32
%10 = ashr i32 %9, 0
%11 = and i32 255, %10
%12 = trunc i32 %11 to i8
store i8 %12, i8* %5
%13 = load i16, i16* %3
%14 = zext i16 %13 to i32
%15 = ashr i32 %14, 8
%16 = and i32 255, %15
%17 = trunc i32 %16 to i8
store i8 %17, i8* %6
store i32 0, i32* %7
br label %18
18: ; preds = %48, %2
%19 = load i32, i32* %7
%20 = icmp ult i32 %19, 4
br i1 %20, label %21, label %51
21: ; preds = %18
%22 = load i32, i32* %4
%23 = and i32 255, %22
%24 = load i8, i8* %5
%25 = zext i8 %24 to i32
%26 = xor i32 %25, %23
%27 = trunc i32 %26 to i8
store i8 %27, i8* %5
%28 = load i8, i8* %5
%29 = zext i8 %28 to i64
%30 = getelementptr inbounds [256 x i8], [256 x i8]* @dns_k_shuffle16.sbox, i64 0, i64 %29
%31 = load i8, i8* %30
%32 = zext i8 %31 to i32
%33 = load i8, i8* %6
%34 = zext i8 %33 to i32
%35 = xor i32 %32, %34
%36 = trunc i32 %35 to i8
store i8 %36, i8* %5
%37 = load i8, i8* %6
%38 = zext i8 %37 to i64
%39 = getelementptr inbounds [256 x i8], [256 x i8]* @dns_k_shuffle16.sbox, i64 0, i64 %38
%40 = load i8, i8* %39
%41 = zext i8 %40 to i32
%42 = load i8, i8* %5
%43 = zext i8 %42 to i32
%44 = xor i32 %41, %43
%45 = trunc i32 %44 to i8
store i8 %45, i8* %6
%46 = load i32, i32* %4
%47 = lshr i32 %46, 8
store i32 %47, i32* %4
br label %48
48: ; preds = %21
%49 = load i32, i32* %7
%50 = add i32 %49, 1
store i32 %50, i32* %7
br label %18
51: ; preds = %18
%52 = load i8, i8* %5
%53 = zext i8 %52 to i32
%54 = shl i32 %53, 8
%55 = and i32 65280, %54
%56 = load i8, i8* %6
%57 = zext i8 %56 to i32
%58 = shl i32 %57, 0
%59 = and i32 255, %58
%60 = or i32 %55, %59
%61 = trunc i32 %60 to i16
ret i16 %61
}

LLVM IR (-O2):
@dns_k_shuffle16.sbox = internal unnamed_addr constant [256 x i8] c"c|w{\F2ko\C50\01g+\FE\D7\ABv\CA\82\C9}\FAYG\F0\AD\D4\A2\AF\9C\A4r\C0\B7\FD\93&6?\F7\CC4\A5\E5\F1q\D81\15\04\C7#\C3\18\96\05\9A\07\12\80\E2\EB'\B2u\09\83,\1A\1BnZ\A0R;\D6\B3)\E3/\84S\D1\00\ED \FC\B1[j\CB\BE9JLX\CF\D0\EF\AA\FBCM3\85E\F9\02\7FP<\9F\A8Q\A3@\8F\92\9D8\F5\BC\B6\DA!\10\FF\F3\D2\CD\0C\13\EC_\97D\17\C4\A7~=d]\19s`\81O\DC\22*\90\88F\EE\B8\14\DE^\0B\DB\E02:\0AI\06$\\\C2\D3\ACb\91\95\E4y\E7\C87m\8D\D5N\A9lV\F4\EAez\AE\08\BAx%.\1C\A6\B4\C6\E8\DDt\1FK\BD\8B\8Ap>\B5fH\03\F6\0Ea5W\B9\86\C1\1D\9E\E1\F8\98\11i\D9\8E\94\9B\1E\87\E9\CEU(\DF\8C\A1\89\0D\BF\E6BhA\99-\0F\B0T\BB\16"
define zeroext i16 @dns_k_shuffle16(i16 zeroext %0, i32 %1) {
%3 = zext i16 %0 to i64
%4 = lshr i16 %0, 8
%5 = trunc i16 %4 to i8
%6 = zext i32 %1 to i64
%7 = xor i64 %3, %6
%8 = and i64 %7, 255
%9 = getelementptr inbounds [256 x i8], [256 x i8]* @dns_k_shuffle16.sbox, i64 0, i64 %8
%10 = load i8, i8* %9
%11 = xor i8 %10, %5
%12 = zext i16 %4 to i64
%13 = getelementptr inbounds [256 x i8], [256 x i8]* @dns_k_shuffle16.sbox, i64 0, i64 %12
%14 = load i8, i8* %13
%15 = xor i8 %14, %11
%16 = lshr i32 %1, 8
%17 = trunc i32 %16 to i8
%18 = xor i8 %11, %17
%19 = zext i8 %18 to i64
%20 = getelementptr inbounds [256 x i8], [256 x i8]* @dns_k_shuffle16.sbox, i64 0, i64 %19
%21 = load i8, i8* %20
%22 = xor i8 %21, %15
%23 = zext i8 %15 to i64
%24 = getelementptr inbounds [256 x i8], [256 x i8]* @dns_k_shuffle16.sbox, i64 0, i64 %23
%25 = load i8, i8* %24
%26 = xor i8 %25, %22
%27 = lshr i32 %1, 16
%28 = trunc i32 %27 to i8
%29 = xor i8 %22, %28
%30 = zext i8 %29 to i64
%31 = getelementptr inbounds [256 x i8], [256 x i8]* @dns_k_shuffle16.sbox, i64 0, i64 %30
%32 = load i8, i8* %31
%33 = xor i8 %32, %26
%34 = zext i8 %26 to i64
%35 = getelementptr inbounds [256 x i8], [256 x i8]* @dns_k_shuffle16.sbox, i64 0, i64 %34
%36 = load i8, i8* %35
%37 = xor i8 %36, %33
%38 = lshr i32 %1, 24
%39 = trunc i32 %38 to i8
%40 = xor i8 %33, %39
%41 = zext i8 %40 to i64
%42 = getelementptr inbounds [256 x i8], [256 x i8]* @dns_k_shuffle16.sbox, i64 0, i64 %41
%43 = load i8, i8* %42
%44 = xor i8 %43, %37
%45 = zext i8 %37 to i64
%46 = getelementptr inbounds [256 x i8], [256 x i8]* @dns_k_shuffle16.sbox, i64 0, i64 %45
%47 = load i8, i8* %46
%48 = xor i8 %47, %44
%49 = zext i8 %44 to i16
%50 = shl nuw i16 %49, 8
%51 = zext i8 %48 to i16
%52 = or i16 %50, %51
ret i16 %52
}