#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ KeyExpansion(unsigned char const *, unsigned long *, int);
unsigned long long calc_pad_len_regular_version(unsigned long long,
                                                unsigned long long,
                                                unsigned long long);
int /*<<< orphan*/ crypto_aead_encrypt(unsigned char *, unsigned long long *,
                                       int /*<<< orphan*/ *, int /*<<< orphan*/,
                                       unsigned char const *,
                                       unsigned long long, int /*<<< orphan*/ *,
                                       unsigned char const *,
                                       unsigned char const *);
int /*<<< orphan*/ free(unsigned char *);
scalar_t__ malloc(unsigned long long);
scalar_t__ memcpy(unsigned char *, unsigned char const *, unsigned long long);
int /*<<< orphan*/ regular_ecb_decrypt(unsigned char *, unsigned long long,
                                       unsigned long *);
int crypto_aead_decrypt(unsigned char *m, unsigned long long mlen,
                        unsigned char *nsec, const unsigned char *c,
                        unsigned long long clen, const unsigned char *ad,
                        unsigned long long adlen, const unsigned char *npub,
                        const unsigned char *k) {
  unsigned long expanded_key[44];
  KeyExpansion(k, expanded_key, 128);
  unsigned char tmp_blk[16];
  unsigned long long tmp_num[10];
  if (clen < 16) {
    return -1;
  }
  if (clen == 16) {
    crypto_aead_encrypt(tmp_blk, tmp_num, NULL, 0, ad, adlen, NULL, npub, k);
    if ((memcpy(tmp_blk, c, 16) == 0) && (*tmp_num == 16)) {
      return 0;
    } else {
      return -1;
    }
  }
  if ((clen > 16) && (clen < 2 * 16)) {
    return -1;
  }
  unsigned long long padlen =
      calc_pad_len_regular_version(mlen, adlen, (unsigned long long)16);
  unsigned char *pad = (unsigned char *)malloc(padlen);
  int i;
  int adres, pres;
  if (adlen % 16 == 0) {
    adres = 0;
  } else {
    adres = 16 - (adlen % 16);
  }
  if (mlen % 16 == 0) {
    pres = 0;
  } else {
    pres = 16 - (mlen % 16);
  }
  unsigned long long tmp;
  unsigned long long reg_index;
  unsigned long long cur = 0;
  for (i = 0; i < 16 - 1; i++) {
    pad[cur] = 0;
    cur++;
  }
  pad[cur] = 1;
  cur++;
  memcpy(&pad[cur], npub, 16);
  cur = cur + 16;
  tmp = adlen;
  for (i = 0; i < 8; i++) {
    pad[cur + 7 - i] = tmp % 256;
    tmp = tmp / 256;
  }
  cur = cur + 8;
  tmp = mlen;
  for (i = 0; i < 8; i++) {
    pad[cur + 7 - i] = tmp % 256;
    tmp = tmp / 256;
  }
  cur = cur + 8;
  memcpy(&pad[cur], ad, adlen);
  cur = cur + adlen;
  for (i = 0; i < adres; i++) {
    pad[cur] = 0;
    cur++;
  }
  reg_index = cur;
  memcpy(&pad[reg_index], c, clen);
  regular_ecb_decrypt(&pad[reg_index], clen, expanded_key);
  for (cur = reg_index; cur < reg_index + 16 + pres; cur++) {
    if (pad[cur] != 0) {
      return -1;
    }
  }
  memcpy(m, &pad[cur], mlen);
  free(pad);
  return 0;
}


x86 assembly (clang, -O0):
<crypto_aead_decrypt>:
push   %rbp
mov    %rsp,%rbp
sub    $0x250,%rsp
mov    0x20(%rbp),%rax
mov    0x18(%rbp),%rax
mov    0x10(%rbp),%rax
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %rcx,-0x28(%rbp)
mov    %r8,-0x30(%rbp)
mov    %r9,-0x38(%rbp)
mov    0x20(%rbp),%rdi
lea    -0x1a0(%rbp),%rsi
mov    $0x80,%edx
call   1070 <KeyExpansion@plt>
cmpq   $0x10,-0x30(%rbp)
jae    11cb <crypto_aead_decrypt+0x5b>
movl   $0xffffffff,-0x4(%rbp)
jmp    163a <crypto_aead_decrypt+0x4ca>
cmpq   $0x10,-0x30(%rbp)
jne    1256 <crypto_aead_decrypt+0xe6>
lea    -0x1b0(%rbp),%rdi
lea    -0x200(%rbp),%rsi
mov    -0x38(%rbp),%r8
mov    0x10(%rbp),%r9
mov    0x18(%rbp),%r10
mov    0x20(%rbp),%rax
xor    %ecx,%ecx
mov    %ecx,%edx
xor    %ecx,%ecx
movq   $0x0,(%rsp)
mov    %r10,0x8(%rsp)
mov    %rax,0x10(%rsp)
call   1080 <crypto_aead_encrypt@plt>
lea    -0x1b0(%rbp),%rdi
mov    -0x28(%rbp),%rsi
mov    $0x10,%edx
call   1060 <memcpy@plt>
cmp    $0x0,%rax
jne    124a <crypto_aead_decrypt+0xda>
cmpq   $0x10,-0x200(%rbp)
10
jne    124a <crypto_aead_decrypt+0xda>
movl   $0x0,-0x4(%rbp)
jmp    163a <crypto_aead_decrypt+0x4ca>
movl   $0xffffffff,-0x4(%rbp)
jmp    163a <crypto_aead_decrypt+0x4ca>
cmpq   $0x10,-0x30(%rbp)
jbe    1278 <crypto_aead_decrypt+0x108>
cmpq   $0x20,-0x30(%rbp)
jae    1278 <crypto_aead_decrypt+0x108>
movl   $0xffffffff,-0x4(%rbp)
jmp    163a <crypto_aead_decrypt+0x4ca>
mov    -0x18(%rbp),%rdi
mov    0x10(%rbp),%rsi
mov    $0x10,%edx
call   1040 <calc_pad_len_regular_version@plt>
mov    %rax,-0x208(%rbp)
mov    -0x208(%rbp),%rdi
call   1090 <malloc@plt>
mov    %rax,-0x210(%rbp)
mov    0x10(%rbp),%rax
and    $0xf,%rax
cmp    $0x0,%rax
jne    12c5 <crypto_aead_decrypt+0x155>
movl   $0x0,-0x218(%rbp)
jmp    12db <crypto_aead_decrypt+0x16b>
mov    0x10(%rbp),%rcx
and    $0xf,%rcx
mov    $0x10,%eax
sub    %rcx,%rax
mov    %eax,-0x218(%rbp)
mov    -0x18(%rbp),%rax
and    $0xf,%rax
cmp    $0x0,%rax
jne    12fc <crypto_aead_decrypt+0x18c>
movl   $0x0,-0x21c(%rbp)
jmp    1312 <crypto_aead_decrypt+0x1a2>
mov    -0x18(%rbp),%rcx
and    $0xf,%rcx
mov    $0x10,%eax
sub    %rcx,%rax
mov    %eax,-0x21c(%rbp)
movq   $0x0,-0x238(%rbp)
movl   $0x0,-0x214(%rbp)
cmpl   $0xf,-0x214(%rbp)
jge    136c <crypto_aead_decrypt+0x1fc>
mov    -0x210(%rbp),%rax
mov    -0x238(%rbp),%rcx
movb   $0x0,(%rax,%rcx,1)
mov    -0x238(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x238(%rbp)
mov    -0x214(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x214(%rbp)
jmp    1327 <crypto_aead_decrypt+0x1b7>
mov    -0x210(%rbp),%rax
mov    -0x238(%rbp),%rcx
movb   $0x1,(%rax,%rcx,1)
mov    -0x238(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x238(%rbp)
mov    -0x210(%rbp),%rdi
add    -0x238(%rbp),%rdi
mov    0x18(%rbp),%rsi
mov    $0x10,%edx
call   1060 <memcpy@plt>
mov    -0x238(%rbp),%rax
add    $0x10,%rax
mov    %rax,-0x238(%rbp)
mov    0x10(%rbp),%rax
mov    %rax,-0x228(%rbp)
movl   $0x0,-0x214(%rbp)
cmpl   $0x8,-0x214(%rbp)
jge    1434 <crypto_aead_decrypt+0x2c4>
mov    -0x228(%rbp),%rax
and    $0xff,%rax
mov    %al,%dl
mov    -0x210(%rbp),%rax
mov    -0x238(%rbp),%rcx
add    $0x7,%rcx
movslq -0x214(%rbp),%rsi
sub    %rsi,%rcx
mov    %dl,(%rax,%rcx,1)
mov    -0x228(%rbp),%rax
shr    $0x8,%rax
mov    %rax,-0x228(%rbp)
mov    -0x214(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x214(%rbp)
jmp    13d3 <crypto_aead_decrypt+0x263>
mov    -0x238(%rbp),%rax
add    $0x8,%rax
mov    %rax,-0x238(%rbp)
mov    -0x18(%rbp),%rax
mov    %rax,-0x228(%rbp)
movl   $0x0,-0x214(%rbp)
cmpl   $0x8,-0x214(%rbp)
jge    14bc <crypto_aead_decrypt+0x34c>
mov    -0x228(%rbp),%rax
and    $0xff,%rax
mov    %al,%dl
mov    -0x210(%rbp),%rax
mov    -0x238(%rbp),%rcx
add    $0x7,%rcx
movslq -0x214(%rbp),%rsi
sub    %rsi,%rcx
mov    %dl,(%rax,%rcx,1)
mov    -0x228(%rbp),%rax
shr    $0x8,%rax
mov    %rax,-0x228(%rbp)
mov    -0x214(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x214(%rbp)
jmp    145b <crypto_aead_decrypt+0x2eb>
mov    -0x238(%rbp),%rax
add    $0x8,%rax
mov    %rax,-0x238(%rbp)
mov    -0x210(%rbp),%rdi
add    -0x238(%rbp),%rdi
mov    -0x38(%rbp),%rsi
mov    0x10(%rbp),%rdx
call   1060 <memcpy@plt>
mov    -0x238(%rbp),%rax
add    0x10(%rbp),%rax
mov    %rax,-0x238(%rbp)
movl   $0x0,-0x214(%rbp)
mov    -0x214(%rbp),%eax
cmp    -0x218(%rbp),%eax
jge    154f <crypto_aead_decrypt+0x3df>
mov    -0x210(%rbp),%rax
mov    -0x238(%rbp),%rcx
movb   $0x0,(%rax,%rcx,1)
mov    -0x238(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x238(%rbp)
mov    -0x214(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x214(%rbp)
jmp    1505 <crypto_aead_decrypt+0x395>
mov    -0x238(%rbp),%rax
mov    %rax,-0x230(%rbp)
mov    -0x210(%rbp),%rdi
add    -0x230(%rbp),%rdi
mov    -0x28(%rbp),%rsi
mov    -0x30(%rbp),%rdx
call   1060 <memcpy@plt>
mov    -0x210(%rbp),%rdi
add    -0x230(%rbp),%rdi
mov    -0x30(%rbp),%rsi
lea    -0x1a0(%rbp),%rdx
call   1050 <regular_ecb_decrypt@plt>
mov    -0x230(%rbp),%rax
mov    %rax,-0x238(%rbp)
mov    -0x238(%rbp),%rax
mov    -0x230(%rbp),%rcx
add    $0x10,%rcx
movslq -0x21c(%rbp),%rdx
add    %rdx,%rcx
cmp    %rcx,%rax
jae    160c <crypto_aead_decrypt+0x49c>
mov    -0x210(%rbp),%rax
mov    -0x238(%rbp),%rcx
movzbl (%rax,%rcx,1),%eax
cmp    $0x0,%eax
je     15f0 <crypto_aead_decrypt+0x480>
movl   $0xffffffff,-0x4(%rbp)
jmp    163a <crypto_aead_decrypt+0x4ca>
jmp    15f5 <crypto_aead_decrypt+0x485>
mov    -0x238(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x238(%rbp)
jmp    15a4 <crypto_aead_decrypt+0x434>
mov    -0x10(%rbp),%rdi
mov    -0x210(%rbp),%rsi
add    -0x238(%rbp),%rsi
mov    -0x18(%rbp),%rdx
call   1060 <memcpy@plt>
mov    -0x210(%rbp),%rdi
call   1030 <free@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x250,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<crypto_aead_decrypt>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x1e8,%rsp
mov    %r9,%r14
mov    %r8,%r12
mov    %rcx,%r15
mov    %rsi,0x8(%rsp)
mov    %rdi,%rbx
mov    0x230(%rsp),%rbp
lea    0x80(%rsp),%rsi
mov    %rbp,%rdi
mov    $0x80,%edx
call   1080 <KeyExpansion@plt>
mov    $0xffffffff,%r13d
cmp    $0x10,%r12
jb     13f3 <crypto_aead_decrypt+0x273>
mov    %rbx,0x18(%rsp)
mov    0x220(%rsp),%r9
jne    1234 <crypto_aead_decrypt+0xb4>
sub    $0x8,%rsp
lea    0x28(%rsp),%rbx
lea    0x38(%rsp),%rsi
mov    %rbx,%rdi
xor    %edx,%edx
xor    %ecx,%ecx
mov    %r14,%r8
push   %rbp
push   0x238(%rsp)
push   $0x0
call   1090 <crypto_aead_encrypt@plt>
add    $0x20,%rsp
mov    $0x10,%edx
mov    %rbx,%rdi
mov    %r15,%rsi
call   1070 <memcpy@plt>
mov    0x30(%rsp),%rcx
xor    $0x10,%rcx
xor    %r13d,%r13d
or     %rax,%rcx
setne  %r13b
neg    %r13d
jmp    13f3 <crypto_aead_decrypt+0x273>
cmp    $0x20,%r12
jb     13f3 <crypto_aead_decrypt+0x273>
mov    $0x10,%edx
mov    0x8(%rsp),%rbp
mov    %rbp,%rdi
mov    %r9,%rsi
call   1050 <calc_pad_len_regular_version@plt>
mov    %rax,%rdi
call   10a0 <malloc@plt>
mov    %rax,%rbx
mov    %ebp,%eax
and    $0xf,%eax
mov    %rax,0x10(%rsp)
movq   $0x0,(%rbx)
movq   $0x0,0x7(%rbx)
movb   $0x1,0xf(%rbx)
lea    0x10(%rbx),%rdi
mov    $0x10,%edx
mov    0x228(%rsp),%rsi
call   1070 <memcpy@plt>
mov    0x220(%rsp),%rax
bswap  %eax
mov    %eax,0x24(%rbx)
mov    0x220(%rsp),%rax
shr    $0x20,%rax
mov    %al,0x23(%rbx)
mov    0x220(%rsp),%rax
shr    $0x28,%rax
mov    %al,0x22(%rbx)
mov    0x220(%rsp),%rax
shr    $0x30,%rax
mov    %al,0x21(%rbx)
mov    0x220(%rsp),%rax
shr    $0x38,%rax
mov    %al,0x20(%rbx)
mov    %rbp,%rcx
mov    %cl,0x2f(%rbx)
mov    %ch,0x2e(%rbx)
mov    %rbp,%rax
shr    $0x10,%rax
mov    %al,0x2d(%rbx)
mov    %rbp,%rax
shr    $0x18,%rax
mov    %al,0x2c(%rbx)
mov    %rbp,%rax
shr    $0x20,%rax
mov    %al,0x2b(%rbx)
mov    %rbp,%rax
shr    $0x28,%rax
mov    %al,0x2a(%rbx)
mov    %rbp,%rax
shr    $0x30,%rax
mov    %al,0x29(%rbx)
mov    %rbp,%rax
shr    $0x38,%rax
mov    %al,0x28(%rbx)
lea    0x30(%rbx),%rdi
mov    %r14,%rsi
mov    0x220(%rsp),%rdx
call   1070 <memcpy@plt>
mov    0x220(%rsp),%rax
lea    0x30(%rax),%r14
mov    %rax,%rbp
and    $0xf,%rbp
je     136b <crypto_aead_decrypt+0x1eb>
mov    $0x10,%edx
sub    %rbp,%rdx
add    %rbx,%r14
mov    %r14,%rdi
xor    %esi,%esi
mov    %rax,%r14
call   1040 <memset@plt>
xor    $0xf,%rbp
add    %rbp,%r14
add    $0x31,%r14
lea    (%rbx,%r14,1),%rbp
mov    %rbp,%rdi
mov    %r15,%rsi
mov    %r12,%rdx
call   1070 <memcpy@plt>
lea    0x80(%rsp),%rdx
mov    %rbp,%rdi
mov    %r12,%rsi
call   1060 <regular_ecb_decrypt@plt>
mov    $0x20,%eax
mov    0x10(%rsp),%rcx
sub    %rcx,%rax
test   %rcx,%rcx
mov    $0x10,%ecx
cmove  %rcx,%rax
lea    (%rax,%r14,1),%rcx
cmp    %rcx,%r14
jae    13d3 <crypto_aead_decrypt+0x253>
xor    %edx,%edx
cs nopw 0x0(%rax,%rax,1)
xchg   %ax,%ax
cmpb   $0x0,0x0(%rbp,%rdx,1)
jne    13f3 <crypto_aead_decrypt+0x273>
add    $0x1,%rdx
cmp    %rdx,%rax
jne    13c0 <crypto_aead_decrypt+0x240>
mov    %rcx,%r14
add    %rbx,%r14
mov    0x18(%rsp),%rdi
mov    %r14,%rsi
mov    0x8(%rsp),%rdx
call   1070 <memcpy@plt>
mov    %rbx,%rdi
call   1030 <free@plt>
xor    %r13d,%r13d
mov    %r13d,%eax
add    $0x1e8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
define i32 @crypto_aead_decrypt(i8* %0, i64 %1, i8* %2, i8* %3, i64 %4, i8* %5, i64 %6, i8* %7, i8* %8) {
%10 = alloca i32
%11 = alloca i8*
%12 = alloca i64
%13 = alloca i8*
%14 = alloca i8*
%15 = alloca i64
%16 = alloca i8*
%17 = alloca i64
%18 = alloca i8*
%19 = alloca i8*
%20 = alloca [44 x i64]
%21 = alloca [16 x i8]
%22 = alloca [10 x i64]
%23 = alloca i64
%24 = alloca i8*
%25 = alloca i32
%26 = alloca i32
%27 = alloca i32
%28 = alloca i64
%29 = alloca i64
%30 = alloca i64
store i8* %0, i8** %11
store i64 %1, i64* %12
store i8* %2, i8** %13
store i8* %3, i8** %14
store i64 %4, i64* %15
store i8* %5, i8** %16
store i64 %6, i64* %17
store i8* %7, i8** %18
store i8* %8, i8** %19
%31 = load i8*, i8** %19
%32 = getelementptr inbounds [44 x i64], [44 x i64]* %20, i64 0, i64 0
%33 = call i32 @KeyExpansion(i8* %31, i64* %32, i32 128)
%34 = load i64, i64* %15
%35 = icmp ult i64 %34, 16
br i1 %35, label %36, label %37
36: ; preds = %9
store i32 -1, i32* %10
br label %229
37: ; preds = %9
%38 = load i64, i64* %15
%39 = icmp eq i64 %38, 16
br i1 %39, label %40, label %58
40: ; preds = %37
%41 = getelementptr inbounds [16 x i8], [16 x i8]* %21, i64 0, i64 0
%42 = getelementptr inbounds [10 x i64], [10 x i64]* %22, i64 0, i64 0
%43 = load i8*, i8** %16
%44 = load i64, i64* %17
%45 = load i8*, i8** %18
%46 = load i8*, i8** %19
%47 = call i32 @crypto_aead_encrypt(i8* %41, i64* %42, i32* null, i32 0, i8* %43, i64 %44, i32* null, i8* %45, i8* %46)
%48 = getelementptr inbounds [16 x i8], [16 x i8]* %21, i64 0, i64 0
%49 = load i8*, i8** %14
%50 = call i64 @memcpy(i8* %48, i8* %49, i64 16)
%51 = icmp eq i64 %50, 0
br i1 %51, label %52, label %57
52: ; preds = %40
%53 = getelementptr inbounds [10 x i64], [10 x i64]* %22, i64 0, i64 0
%54 = load i64, i64* %53
%55 = icmp eq i64 %54, 16
br i1 %55, label %56, label %57
56: ; preds = %52
store i32 0, i32* %10
br label %229
57: ; preds = %52, %40
store i32 -1, i32* %10
br label %229
58: ; preds = %37
%59 = load i64, i64* %15
%60 = icmp ugt i64 %59, 16
br i1 %60, label %61, label %65
61: ; preds = %58
%62 = load i64, i64* %15
%63 = icmp ult i64 %62, 32
br i1 %63, label %64, label %65
64: ; preds = %61
store i32 -1, i32* %10
br label %229
65: ; preds = %61, %58
%66 = load i64, i64* %12
%67 = load i64, i64* %17
%68 = call i64 @calc_pad_len_regular_version(i64 %66, i64 %67, i64 16)
store i64 %68, i64* %23
%69 = load i64, i64* %23
%70 = call i64 @malloc(i64 %69)
%71 = inttoptr i64 %70 to i8*
store i8* %71, i8** %24
%72 = load i64, i64* %17
%73 = urem i64 %72, 16
%74 = icmp eq i64 %73, 0
br i1 %74, label %75, label %76
75: ; preds = %65
store i32 0, i32* %26
br label %81
76: ; preds = %65
%77 = load i64, i64* %17
%78 = urem i64 %77, 16
%79 = sub i64 16, %78
%80 = trunc i64 %79 to i32
store i32 %80, i32* %26
br label %81
81: ; preds = %76, %75
%82 = load i64, i64* %12
%83 = urem i64 %82, 16
%84 = icmp eq i64 %83, 0
br i1 %84, label %85, label %86
85: ; preds = %81
store i32 0, i32* %27
br label %91
86: ; preds = %81
%87 = load i64, i64* %12
%88 = urem i64 %87, 16
%89 = sub i64 16, %88
%90 = trunc i64 %89 to i32
store i32 %90, i32* %27
br label %91
91: ; preds = %86, %85
store i64 0, i64* %30
store i32 0, i32* %25
br label %92
92: ; preds = %101, %91
%93 = load i32, i32* %25
%94 = icmp slt i32 %93, 15
br i1 %94, label %95, label %104
95: ; preds = %92
%96 = load i8*, i8** %24
%97 = load i64, i64* %30
%98 = getelementptr inbounds i8, i8* %96, i64 %97
store i8 0, i8* %98
%99 = load i64, i64* %30
%100 = add i64 %99, 1
store i64 %100, i64* %30
br label %101
101: ; preds = %95
%102 = load i32, i32* %25
%103 = add nsw i32 %102, 1
store i32 %103, i32* %25
br label %92
104: ; preds = %92
%105 = load i8*, i8** %24
%106 = load i64, i64* %30
%107 = getelementptr inbounds i8, i8* %105, i64 %106
store i8 1, i8* %107
%108 = load i64, i64* %30
%109 = add i64 %108, 1
store i64 %109, i64* %30
%110 = load i8*, i8** %24
%111 = load i64, i64* %30
%112 = getelementptr inbounds i8, i8* %110, i64 %111
%113 = load i8*, i8** %18
%114 = call i64 @memcpy(i8* %112, i8* %113, i64 16)
%115 = load i64, i64* %30
%116 = add i64 %115, 16
store i64 %116, i64* %30
%117 = load i64, i64* %17
store i64 %117, i64* %28
store i32 0, i32* %25
br label %118
118: ; preds = %134, %104
%119 = load i32, i32* %25
%120 = icmp slt i32 %119, 8
br i1 %120, label %121, label %137
121: ; preds = %118
%122 = load i64, i64* %28
%123 = urem i64 %122, 256
%124 = trunc i64 %123 to i8
%125 = load i8*, i8** %24
%126 = load i64, i64* %30
%127 = add i64 %126, 7
%128 = load i32, i32* %25
%129 = sext i32 %128 to i64
%130 = sub i64 %127, %129
%131 = getelementptr inbounds i8, i8* %125, i64 %130
store i8 %124, i8* %131
%132 = load i64, i64* %28
%133 = udiv i64 %132, 256
store i64 %133, i64* %28
br label %134
134: ; preds = %121
%135 = load i32, i32* %25
%136 = add nsw i32 %135, 1
store i32 %136, i32* %25
br label %118
137: ; preds = %118
%138 = load i64, i64* %30
%139 = add i64 %138, 8
store i64 %139, i64* %30
%140 = load i64, i64* %12
store i64 %140, i64* %28
store i32 0, i32* %25
br label %141
141: ; preds = %157, %137
%142 = load i32, i32* %25
%143 = icmp slt i32 %142, 8
br i1 %143, label %144, label %160
144: ; preds = %141
%145 = load i64, i64* %28
%146 = urem i64 %145, 256
%147 = trunc i64 %146 to i8
%148 = load i8*, i8** %24
%149 = load i64, i64* %30
%150 = add i64 %149, 7
%151 = load i32, i32* %25
%152 = sext i32 %151 to i64
%153 = sub i64 %150, %152
%154 = getelementptr inbounds i8, i8* %148, i64 %153
store i8 %147, i8* %154
%155 = load i64, i64* %28
%156 = udiv i64 %155, 256
store i64 %156, i64* %28
br label %157
157: ; preds = %144
%158 = load i32, i32* %25
%159 = add nsw i32 %158, 1
store i32 %159, i32* %25
br label %141
160: ; preds = %141
%161 = load i64, i64* %30
%162 = add i64 %161, 8
store i64 %162, i64* %30
%163 = load i8*, i8** %24
%164 = load i64, i64* %30
%165 = getelementptr inbounds i8, i8* %163, i64 %164
%166 = load i8*, i8** %16
%167 = load i64, i64* %17
%168 = call i64 @memcpy(i8* %165, i8* %166, i64 %167)
%169 = load i64, i64* %30
%170 = load i64, i64* %17
%171 = add i64 %169, %170
store i64 %171, i64* %30
store i32 0, i32* %25
br label %172
172: ; preds = %182, %160
%173 = load i32, i32* %25
%174 = load i32, i32* %26
%175 = icmp slt i32 %173, %174
br i1 %175, label %176, label %185
176: ; preds = %172
%177 = load i8*, i8** %24
%178 = load i64, i64* %30
%179 = getelementptr inbounds i8, i8* %177, i64 %178
store i8 0, i8* %179
%180 = load i64, i64* %30
%181 = add i64 %180, 1
store i64 %181, i64* %30
br label %182
182: ; preds = %176
%183 = load i32, i32* %25
%184 = add nsw i32 %183, 1
store i32 %184, i32* %25
br label %172
185: ; preds = %172
%186 = load i64, i64* %30
store i64 %186, i64* %29
%187 = load i8*, i8** %24
%188 = load i64, i64* %29
%189 = getelementptr inbounds i8, i8* %187, i64 %188
%190 = load i8*, i8** %14
%191 = load i64, i64* %15
%192 = call i64 @memcpy(i8* %189, i8* %190, i64 %191)
%193 = load i8*, i8** %24
%194 = load i64, i64* %29
%195 = getelementptr inbounds i8, i8* %193, i64 %194
%196 = load i64, i64* %15
%197 = getelementptr inbounds [44 x i64], [44 x i64]* %20, i64 0, i64 0
%198 = call i32 @regular_ecb_decrypt(i8* %195, i64 %196, i64* %197)
%199 = load i64, i64* %29
store i64 %199, i64* %30
br label %200
200: ; preds = %217, %185
%201 = load i64, i64* %30
%202 = load i64, i64* %29
%203 = add i64 %202, 16
%204 = load i32, i32* %27
%205 = sext i32 %204 to i64
%206 = add i64 %203, %205
%207 = icmp ult i64 %201, %206
br i1 %207, label %208, label %220
208: ; preds = %200
%209 = load i8*, i8** %24
%210 = load i64, i64* %30
%211 = getelementptr inbounds i8, i8* %209, i64 %210
%212 = load i8, i8* %211
%213 = zext i8 %212 to i32
%214 = icmp ne i32 %213, 0
br i1 %214, label %215, label %216
215: ; preds = %208
store i32 -1, i32* %10
br label %229
216: ; preds = %208
br label %217
217: ; preds = %216
%218 = load i64, i64* %30
%219 = add i64 %218, 1
store i64 %219, i64* %30
br label %200
220: ; preds = %200
%221 = load i8*, i8** %11
%222 = load i8*, i8** %24
%223 = load i64, i64* %30
%224 = getelementptr inbounds i8, i8* %222, i64 %223
%225 = load i64, i64* %12
%226 = call i64 @memcpy(i8* %221, i8* %224, i64 %225)
%227 = load i8*, i8** %24
%228 = call i32 @free(i8* %227)
store i32 0, i32* %10
br label %229
229: ; preds = %220, %215, %64, %57, %56, %36
%230 = load i32, i32* %10
ret i32 %230
}

LLVM IR (-O2):
define i32 @crypto_aead_decrypt(i8* %0, i64 %1, i8* nocapture readnone %2, i8* %3, i64 %4, i8* %5, i64 %6, i8* %7, i8* %8) {
%10 = alloca [44 x i64]
%11 = alloca [16 x i8]
%12 = alloca [10 x i64]
%13 = bitcast [44 x i64]* %10 to i8*
%14 = getelementptr inbounds [44 x i64], [44 x i64]* %10, i64 0, i64 0
%15 = call i32 @KeyExpansion(i8* %8, i64* %14, i32 128)
%16 = getelementptr inbounds [16 x i8], [16 x i8]* %11, i64 0, i64 0
%17 = bitcast [10 x i64]* %12 to i8*
%18 = icmp ult i64 %4, 16
br i1 %18, label %120, label %19
19: ; preds = %9
%20 = icmp eq i64 %4, 16
br i1 %20, label %21, label %30
21: ; preds = %19
%22 = getelementptr inbounds [10 x i64], [10 x i64]* %12, i64 0, i64 0
%23 = call i32 @crypto_aead_encrypt(i8* %16, i64* %22, i32* null, i32 0, i8* %5, i64 %6, i32* null, i8* %7, i8* %8)
%24 = call i64 @memcpy(i8* %16, i8* %3, i64 16)
%25 = icmp ne i64 %24, 0
%26 = load i64, i64* %22
%27 = icmp ne i64 %26, 16
%28 = select i1 %25, i1 true, i1 %27
%29 = sext i1 %28 to i32
br label %120
30: ; preds = %19
%31 = icmp ult i64 %4, 32
br i1 %31, label %120, label %32
32: ; preds = %30
%33 = call i64 @calc_pad_len_regular_version(i64 %1, i64 %6, i64 16)
%34 = call i64 @malloc(i64 %33)
%35 = inttoptr i64 %34 to i8*
%36 = and i64 %6, 15
%37 = and i64 %1, 15
%38 = icmp eq i64 %36, 0
%39 = getelementptr inbounds i8, i8* %35, i64 15
store i8 1, i8* %39
%40 = getelementptr inbounds i8, i8* %35, i64 16
%41 = call i64 @memcpy(i8* %40, i8* %7, i64 16)
%42 = trunc i64 %6 to i8
%43 = getelementptr inbounds i8, i8* %35, i64 39
store i8 %42, i8* %43
%44 = lshr i64 %6, 8
%45 = trunc i64 %44 to i8
%46 = getelementptr inbounds i8, i8* %35, i64 38
store i8 %45, i8* %46
%47 = lshr i64 %6, 16
%48 = trunc i64 %47 to i8
%49 = getelementptr inbounds i8, i8* %35, i64 37
store i8 %48, i8* %49
%50 = lshr i64 %6, 24
%51 = trunc i64 %50 to i8
%52 = getelementptr inbounds i8, i8* %35, i64 36
store i8 %51, i8* %52
%53 = lshr i64 %6, 32
%54 = trunc i64 %53 to i8
%55 = getelementptr inbounds i8, i8* %35, i64 35
store i8 %54, i8* %55
%56 = lshr i64 %6, 40
%57 = trunc i64 %56 to i8
%58 = getelementptr inbounds i8, i8* %35, i64 34
store i8 %57, i8* %58
%59 = lshr i64 %6, 48
%60 = trunc i64 %59 to i8
%61 = getelementptr inbounds i8, i8* %35, i64 33
store i8 %60, i8* %61
%62 = lshr i64 %6, 56
%63 = trunc i64 %62 to i8
%64 = getelementptr inbounds i8, i8* %35, i64 32
store i8 %63, i8* %64
%65 = trunc i64 %1 to i8
%66 = getelementptr inbounds i8, i8* %35, i64 47
store i8 %65, i8* %66
%67 = lshr i64 %1, 8
%68 = trunc i64 %67 to i8
%69 = getelementptr inbounds i8, i8* %35, i64 46
store i8 %68, i8* %69
%70 = lshr i64 %1, 16
%71 = trunc i64 %70 to i8
%72 = getelementptr inbounds i8, i8* %35, i64 45
store i8 %71, i8* %72
%73 = lshr i64 %1, 24
%74 = trunc i64 %73 to i8
%75 = getelementptr inbounds i8, i8* %35, i64 44
store i8 %74, i8* %75
%76 = lshr i64 %1, 32
%77 = trunc i64 %76 to i8
%78 = getelementptr inbounds i8, i8* %35, i64 43
store i8 %77, i8* %78
%79 = lshr i64 %1, 40
%80 = trunc i64 %79 to i8
%81 = getelementptr inbounds i8, i8* %35, i64 42
store i8 %80, i8* %81
%82 = lshr i64 %1, 48
%83 = trunc i64 %82 to i8
%84 = getelementptr inbounds i8, i8* %35, i64 41
store i8 %83, i8* %84
%85 = lshr i64 %1, 56
%86 = trunc i64 %85 to i8
%87 = getelementptr inbounds i8, i8* %35, i64 40
store i8 %86, i8* %87
%88 = icmp eq i64 %37, 0
%89 = getelementptr inbounds i8, i8* %35, i64 48
%90 = call i64 @memcpy(i8* %89, i8* %5, i64 %6)
%91 = add i64 %6, 48
br i1 %38, label %98, label %92
92: ; preds = %32
%93 = sub nuw nsw i64 16, %36
%94 = getelementptr i8, i8* %35, i64 %91
%95 = xor i64 %36, 15
%96 = add i64 %95, %6
%97 = add i64 %96, 49
br label %98
98: ; preds = %92, %32
%99 = phi i64 [ %91, %32 ], [ %97, %92 ]
%100 = getelementptr inbounds i8, i8* %35, i64 %99
%101 = call i64 @memcpy(i8* %100, i8* %3, i64 %4)
%102 = call i32 @regular_ecb_decrypt(i8* %100, i64 %4, i64* %14)
%103 = sub nuw nsw i64 32, %37
%104 = select i1 %88, i64 16, i64 %103
%105 = add i64 %104, %99
%106 = icmp ult i64 %99, %105
br i1 %106, label %107, label %115
107: ; preds = %98, %112
%108 = phi i64 [ %113, %112 ], [ %99, %98 ]
%109 = getelementptr inbounds i8, i8* %35, i64 %108
%110 = load i8, i8* %109
%111 = icmp eq i8 %110, 0
br i1 %111, label %112, label %120
112: ; preds = %107
%113 = add i64 %108, 1
%114 = icmp eq i64 %113, %105
br i1 %114, label %115, label %107
115: ; preds = %112, %98
%116 = phi i64 [ %99, %98 ], [ %105, %112 ]
%117 = getelementptr inbounds i8, i8* %35, i64 %116
%118 = call i64 @memcpy(i8* %0, i8* %117, i64 %1)
%119 = call i32 @free(i8* %35)
br label %120
120: ; preds = %107, %115, %30, %21, %9
%121 = phi i32 [ -1, %9 ], [ %29, %21 ], [ -1, %30 ], [ 0, %115 ], [ -1, %107 ]
ret i32 %121
}