#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ crypto_onetimeauth_poly1305(unsigned char *, unsigned char *,
                                               unsigned long long,
                                               unsigned char *);
int /*<<< orphan*/ crypto_stream_xsalsa20_xor(unsigned char *,
                                              unsigned char const *,
                                              unsigned long long,
                                              unsigned char const *,
                                              unsigned char const *);
int crypto_secretbox_xsalsa20poly1305(unsigned char *c, const unsigned char *m,
                                      unsigned long long mlen,
                                      const unsigned char *n,
                                      const unsigned char *k) {
  int i;
  if (mlen < 32)
    return -1;
  crypto_stream_xsalsa20_xor(c, m, mlen, n, k);
  crypto_onetimeauth_poly1305(c + 16, c + 32, mlen - 32, c);
  for (i = 0; i < 16; ++i)
    c[i] = 0;
  return 0;
}


x86 assembly (clang, -O0):
<crypto_secretbox_xsalsa20poly1305>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %rcx,-0x28(%rbp)
mov    %r8,-0x30(%rbp)
cmpq   $0x20,-0x20(%rbp)
jae    1153 <crypto_secretbox_xsalsa20poly1305+0x33>
movl   $0xffffffff,-0x4(%rbp)
jmp    11bf <crypto_secretbox_xsalsa20poly1305+0x9f>
mov    -0x10(%rbp),%rdi
mov    -0x18(%rbp),%rsi
mov    -0x20(%rbp),%rdx
mov    -0x28(%rbp),%rcx
mov    -0x30(%rbp),%r8
call   1040 <crypto_stream_xsalsa20_xor@plt>
mov    -0x10(%rbp),%rdi
add    $0x10,%rdi
mov    -0x10(%rbp),%rsi
add    $0x20,%rsi
mov    -0x20(%rbp),%rdx
sub    $0x20,%rdx
mov    -0x10(%rbp),%rcx
call   1030 <crypto_onetimeauth_poly1305@plt>
movl   $0x0,-0x34(%rbp)
cmpl   $0x10,-0x34(%rbp)
jge    11b8 <crypto_secretbox_xsalsa20poly1305+0x98>
mov    -0x10(%rbp),%rax
movslq -0x34(%rbp),%rcx
movb   $0x0,(%rax,%rcx,1)
mov    -0x34(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x34(%rbp)
jmp    1194 <crypto_secretbox_xsalsa20poly1305+0x74>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<crypto_secretbox_xsalsa20poly1305>:
mov    $0xffffffff,%eax
cmp    $0x20,%rdx
jb     1161 <crypto_secretbox_xsalsa20poly1305+0x41>
push   %r14
push   %rbx
push   %rax
mov    %rdx,%rbx
mov    %rdi,%r14
call   1040 <crypto_stream_xsalsa20_xor@plt>
lea    0x10(%r14),%rdi
lea    0x20(%r14),%rsi
add    $0xffffffffffffffe0,%rbx
mov    %rbx,%rdx
mov    %r14,%rcx
call   1030 <crypto_onetimeauth_poly1305@plt>
xorps  %xmm0,%xmm0
movups %xmm0,(%r14)
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
define i32 @crypto_secretbox_xsalsa20poly1305(i8* %0, i8* %1, i64 %2, i8* %3, i8* %4) {
%6 = alloca i32
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i64
%10 = alloca i8*
%11 = alloca i8*
%12 = alloca i32
store i8* %0, i8** %7
store i8* %1, i8** %8
store i64 %2, i64* %9
store i8* %3, i8** %10
store i8* %4, i8** %11
%13 = load i64, i64* %9
%14 = icmp ult i64 %13, 32
br i1 %14, label %15, label %16
15: ; preds = %5
store i32 -1, i32* %6
br label %43
16: ; preds = %5
%17 = load i8*, i8** %7
%18 = load i8*, i8** %8
%19 = load i64, i64* %9
%20 = load i8*, i8** %10
%21 = load i8*, i8** %11
%22 = call i32 @crypto_stream_xsalsa20_xor(i8* %17, i8* %18, i64 %19, i8* %20, i8* %21)
%23 = load i8*, i8** %7
%24 = getelementptr inbounds i8, i8* %23, i64 16
%25 = load i8*, i8** %7
%26 = getelementptr inbounds i8, i8* %25, i64 32
%27 = load i64, i64* %9
%28 = sub i64 %27, 32
%29 = load i8*, i8** %7
%30 = call i32 @crypto_onetimeauth_poly1305(i8* %24, i8* %26, i64 %28, i8* %29)
store i32 0, i32* %12
br label %31
31: ; preds = %39, %16
%32 = load i32, i32* %12
%33 = icmp slt i32 %32, 16
br i1 %33, label %34, label %42
34: ; preds = %31
%35 = load i8*, i8** %7
%36 = load i32, i32* %12
%37 = sext i32 %36 to i64
%38 = getelementptr inbounds i8, i8* %35, i64 %37
store i8 0, i8* %38
br label %39
39: ; preds = %34
%40 = load i32, i32* %12
%41 = add nsw i32 %40, 1
store i32 %41, i32* %12
br label %31
42: ; preds = %31
store i32 0, i32* %6
br label %43
43: ; preds = %42, %15
%44 = load i32, i32* %6
ret i32 %44
}

LLVM IR (-O2):
define i32 @crypto_secretbox_xsalsa20poly1305(i8* %0, i8* %1, i64 %2, i8* %3, i8* %4) {
%6 = icmp ult i64 %2, 32
br i1 %6, label %13, label %7
7: ; preds = %5
%8 = tail call i32 @crypto_stream_xsalsa20_xor(i8* %0, i8* %1, i64 %2, i8* %3, i8* %4)
%9 = getelementptr inbounds i8, i8* %0, i64 16
%10 = getelementptr inbounds i8, i8* %0, i64 32
%11 = add i64 %2, -32
%12 = tail call i32 @crypto_onetimeauth_poly1305(i8* %9, i8* %10, i64 %11, i8* %0)
br label %13
13: ; preds = %7, %5
%14 = phi i32 [ -1, %5 ], [ 0, %7 ]
ret i32 %14
}