#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ sha;
typedef int /*<<< orphan*/ md;
typedef unsigned char SHA512_CTX;
typedef int /*<<< orphan*/ EC_POINT;
typedef int /*<<< orphan*/ EC_GROUP;
typedef int /*<<< orphan*/ BN_CTX;
typedef int /*<<< orphan*/ BIGNUM;

/* Variables and functions */
int /*<<< orphan*/ BN_CTX_end(int /*<<< orphan*/ *);
int /*<<< orphan*/ BN_CTX_free(int /*<<< orphan*/ *);
int /*<<< orphan*/ *BN_CTX_new();
int /*<<< orphan*/ BN_CTX_start(int /*<<< orphan*/ *);
int /*<<< orphan*/ BN_bin2bn(unsigned char *, int, int /*<<< orphan*/ *);
int /*<<< orphan*/ BN_clear(int /*<<< orphan*/ *);
int /*<<< orphan*/ BN_clear_free(int /*<<< orphan*/ *);
int /*<<< orphan*/ BN_free(int /*<<< orphan*/ *);
int /*<<< orphan*/ *BN_new();
int /*<<< orphan*/ BN_nnmod(int /*<<< orphan*/ *, int /*<<< orphan*/ *,
                            int /*<<< orphan*/ *, int /*<<< orphan*/ *);
int BN_num_bits(int /*<<< orphan*/ *);
int /*<<< orphan*/ EC_GROUP_get_order(int /*<<< orphan*/ const *,
                                      int /*<<< orphan*/ *,
                                      int /*<<< orphan*/ *);
int /*<<< orphan*/ EC_POINT_invert(int /*<<< orphan*/ const *,
                                   int /*<<< orphan*/ *, int /*<<< orphan*/ *);
int /*<<< orphan*/ EC_POINT_mul(int /*<<< orphan*/ const *,
                                int /*<<< orphan*/ *, int /*<<< orphan*/ *,
                                int /*<<< orphan*/ const *,
                                int /*<<< orphan*/ *, int /*<<< orphan*/ *);
int SHA512_DIGEST_LENGTH;
int /*<<< orphan*/ SHA512_Final(unsigned char *, unsigned char *);
int /*<<< orphan*/ SHA512_Init(unsigned char *);
int /*<<< orphan*/ SHA512_Update(unsigned char *, ...);
int /*<<< orphan*/ bzero(unsigned char *, int);
int strlen(char const *);
int PAKE_setup(const EC_GROUP *group, const EC_POINT *U, const EC_POINT *V,
               const char *password, const char *server_name,
               const char *client_name, BIGNUM *pi_0, BIGNUM *pi_1, EC_POINT *L,
               EC_POINT *U_minus_pi_0, EC_POINT *V_pi_0) {
  int ret = 0;
  unsigned char side = 0;
  SHA512_CTX sha;
  unsigned char md[SHA512_DIGEST_LENGTH];
  BIGNUM *order = NULL, *tmp = NULL;
  BN_CTX *ctx = NULL;
  if (!(ctx = BN_CTX_new()))
    goto err;
  BN_CTX_start(ctx);
  order = BN_new();
  tmp = BN_new();
  if (!order || !tmp)
    goto err;
  if (!EC_GROUP_get_order(group, order, ctx))
    goto err;
  if (BN_num_bits(order) > 512 - 64)
    goto err;
  if (!SHA512_Init(&sha))
    goto err;
  if (!SHA512_Update(&sha, &side, 1))
    goto err;
  if (!SHA512_Update(&sha, server_name, 1 + strlen(server_name)))
    goto err;
  if (!SHA512_Update(&sha, client_name, 1 + strlen(client_name)))
    goto err;
  if (!SHA512_Update(&sha, password, 1 + strlen(password)))
    goto err;
  if (!SHA512_Final(md, &sha))
    goto err;
  if (!BN_bin2bn(md, sizeof(md), tmp))
    goto err;
  if (!BN_nnmod(pi_0, tmp, order, ctx))
    goto err;
  side = 1;
  if (!SHA512_Init(&sha))
    goto err;
  if (!SHA512_Update(&sha, &side, 1))
    goto err;
  if (!SHA512_Update(&sha, server_name, 1 + strlen(server_name)))
    goto err;
  if (!SHA512_Update(&sha, client_name, 1 + strlen(client_name)))
    goto err;
  if (!SHA512_Update(&sha, password, 1 + strlen(password)))
    goto err;
  if (!SHA512_Final(md, &sha))
    goto err;
  if (!BN_bin2bn(md, sizeof(md), tmp))
    goto err;
  if (!BN_nnmod(pi_1, tmp, order, ctx))
    goto err;
  if (V_pi_0 && !EC_POINT_mul(group, V_pi_0, NULL, V, pi_0, ctx))
    goto err;
  if (U_minus_pi_0 && (!EC_POINT_mul(group, U_minus_pi_0, NULL, U, pi_0, ctx) ||
                       !EC_POINT_invert(group, U_minus_pi_0, ctx)))
    goto err;
  if (L && !EC_POINT_mul(group, L, pi_1, NULL, NULL, ctx))
    goto err;
  ret = 1;
err:
  if (!ret) {
    BN_clear(pi_0);
    BN_clear(pi_1);
  }
  bzero(md, sizeof(md));
  bzero(&sha, sizeof(sha));
  if (order)
    BN_free(order);
  if (tmp)
    BN_clear_free(tmp);
  if (ctx) {
    BN_CTX_end(ctx);
    BN_CTX_free(ctx);
  }
  return ret;
}


x86 assembly (clang, -O0):
<PAKE_setup>:
push   %rbp
mov    %rsp,%rbp
sub    $0xa0,%rsp
mov    0x30(%rbp),%rax
mov    0x28(%rbp),%rax
mov    0x20(%rbp),%rax
mov    0x18(%rbp),%rax
mov    0x10(%rbp),%rax
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
mov    %rcx,-0x20(%rbp)
mov    %r8,-0x28(%rbp)
mov    %r9,-0x30(%rbp)
movl   $0x0,-0x34(%rbp)
movb   $0x0,-0x35(%rbp)
mov    0x2d6f(%rip),%rax
mov    (%rax),%eax
mov    %rax,-0x70(%rbp)
mov    %rsp,%rcx
mov    %rcx,-0x40(%rbp)
mov    %rax,%rdx
add    $0xf,%rdx
and    $0xfffffffffffffff0,%rdx
mov    %rsp,%rcx
sub    %rdx,%rcx
mov    %rcx,-0x68(%rbp)
mov    %rcx,%rsp
mov    %rax,-0x48(%rbp)
movq   $0x0,-0x50(%rbp)
movq   $0x0,-0x58(%rbp)
movq   $0x0,-0x60(%rbp)
mov    $0x0,%al
call   10e0 <BN_CTX_new@plt>
mov    %rax,-0x60(%rbp)
cmp    $0x0,%rax
jne    12d4 <PAKE_setup+0xa4>
jmp    1687 <PAKE_setup+0x457>
mov    -0x60(%rbp),%rdi
call   10c0 <BN_CTX_start@plt>
mov    $0x0,%al
call   1030 <BN_new@plt>
mov    %rax,-0x50(%rbp)
mov    $0x0,%al
call   1030 <BN_new@plt>
mov    %rax,-0x58(%rbp)
cmpq   $0x0,-0x50(%rbp)
je     1309 <PAKE_setup+0xd9>
cmpq   $0x0,-0x58(%rbp)
jne    130e <PAKE_setup+0xde>
jmp    1687 <PAKE_setup+0x457>
mov    -0x8(%rbp),%rdi
mov    -0x50(%rbp),%rsi
mov    -0x60(%rbp),%rdx
call   1090 <EC_GROUP_get_order@plt>
cmp    $0x0,%eax
jne    132d <PAKE_setup+0xfd>
jmp    1687 <PAKE_setup+0x457>
mov    -0x50(%rbp),%rdi
call   1050 <BN_num_bits@plt>
cmp    $0x1c0,%eax
jle    1346 <PAKE_setup+0x116>
jmp    1687 <PAKE_setup+0x457>
lea    -0x36(%rbp),%rdi
call   1150 <SHA512_Init@plt>
cmp    $0x0,%eax
jne    135d <PAKE_setup+0x12d>
jmp    1687 <PAKE_setup+0x457>
lea    -0x36(%rbp),%rdi
lea    -0x35(%rbp),%rsi
mov    $0x1,%edx
mov    $0x0,%al
call   10a0 <SHA512_Update@plt>
cmp    $0x0,%eax
jne    137f <PAKE_setup+0x14f>
jmp    1687 <PAKE_setup+0x457>
mov    -0x28(%rbp),%rax
mov    %rax,-0x78(%rbp)
mov    -0x28(%rbp),%rdi
call   1060 <strlen@plt>
mov    -0x78(%rbp),%rsi
mov    %eax,%edx
add    $0x1,%edx
lea    -0x36(%rbp),%rdi
mov    $0x0,%al
call   10a0 <SHA512_Update@plt>
cmp    $0x0,%eax
jne    13b2 <PAKE_setup+0x182>
jmp    1687 <PAKE_setup+0x457>
mov    -0x30(%rbp),%rax
mov    %rax,-0x80(%rbp)
mov    -0x30(%rbp),%rdi
call   1060 <strlen@plt>
mov    -0x80(%rbp),%rsi
mov    %eax,%edx
add    $0x1,%edx
lea    -0x36(%rbp),%rdi
mov    $0x0,%al
call   10a0 <SHA512_Update@plt>
cmp    $0x0,%eax
jne    13e5 <PAKE_setup+0x1b5>
jmp    1687 <PAKE_setup+0x457>
mov    -0x20(%rbp),%rax
mov    %rax,-0x88(%rbp)
mov    -0x20(%rbp),%rdi
call   1060 <strlen@plt>
mov    -0x88(%rbp),%rsi
mov    %eax,%edx
add    $0x1,%edx
lea    -0x36(%rbp),%rdi
mov    $0x0,%al
call   10a0 <SHA512_Update@plt>
cmp    $0x0,%eax
jne    141e <PAKE_setup+0x1ee>
jmp    1687 <PAKE_setup+0x457>
mov    -0x68(%rbp),%rdi
lea    -0x36(%rbp),%rsi
call   1100 <SHA512_Final@plt>
cmp    $0x0,%eax
jne    1439 <PAKE_setup+0x209>
jmp    1687 <PAKE_setup+0x457>
mov    -0x68(%rbp),%rdi
mov    -0x70(%rbp),%rax
mov    %eax,%esi
mov    -0x58(%rbp),%rdx
call   1070 <BN_bin2bn@plt>
cmp    $0x0,%eax
jne    145a <PAKE_setup+0x22a>
jmp    1687 <PAKE_setup+0x457>
mov    0x10(%rbp),%rdi
mov    -0x58(%rbp),%rsi
mov    -0x50(%rbp),%rdx
mov    -0x60(%rbp),%rcx
call   10f0 <BN_nnmod@plt>
cmp    $0x0,%eax
jne    147d <PAKE_setup+0x24d>
jmp    1687 <PAKE_setup+0x457>
movb   $0x1,-0x35(%rbp)
lea    -0x36(%rbp),%rdi
call   1150 <SHA512_Init@plt>
cmp    $0x0,%eax
jne    1498 <PAKE_setup+0x268>
jmp    1687 <PAKE_setup+0x457>
lea    -0x36(%rbp),%rdi
lea    -0x35(%rbp),%rsi
mov    $0x1,%edx
mov    $0x0,%al
call   10a0 <SHA512_Update@plt>
cmp    $0x0,%eax
jne    14ba <PAKE_setup+0x28a>
jmp    1687 <PAKE_setup+0x457>
mov    -0x28(%rbp),%rax
mov    %rax,-0x90(%rbp)
mov    -0x28(%rbp),%rdi
call   1060 <strlen@plt>
mov    -0x90(%rbp),%rsi
mov    %eax,%edx
add    $0x1,%edx
lea    -0x36(%rbp),%rdi
mov    $0x0,%al
call   10a0 <SHA512_Update@plt>
cmp    $0x0,%eax
jne    14f3 <PAKE_setup+0x2c3>
jmp    1687 <PAKE_setup+0x457>
mov    -0x30(%rbp),%rax
mov    %rax,-0x98(%rbp)
mov    -0x30(%rbp),%rdi
call   1060 <strlen@plt>
mov    -0x98(%rbp),%rsi
mov    %eax,%edx
add    $0x1,%edx
lea    -0x36(%rbp),%rdi
mov    $0x0,%al
call   10a0 <SHA512_Update@plt>
cmp    $0x0,%eax
jne    152c <PAKE_setup+0x2fc>
jmp    1687 <PAKE_setup+0x457>
mov    -0x20(%rbp),%rax
mov    %rax,-0xa0(%rbp)
mov    -0x20(%rbp),%rdi
call   1060 <strlen@plt>
mov    -0xa0(%rbp),%rsi
mov    %eax,%edx
add    $0x1,%edx
lea    -0x36(%rbp),%rdi
mov    $0x0,%al
call   10a0 <SHA512_Update@plt>
cmp    $0x0,%eax
jne    1565 <PAKE_setup+0x335>
jmp    1687 <PAKE_setup+0x457>
mov    -0x68(%rbp),%rdi
lea    -0x36(%rbp),%rsi
call   1100 <SHA512_Final@plt>
cmp    $0x0,%eax
jne    1580 <PAKE_setup+0x350>
jmp    1687 <PAKE_setup+0x457>
mov    -0x68(%rbp),%rdi
mov    -0x70(%rbp),%rax
mov    %eax,%esi
mov    -0x58(%rbp),%rdx
call   1070 <BN_bin2bn@plt>
cmp    $0x0,%eax
jne    15a1 <PAKE_setup+0x371>
jmp    1687 <PAKE_setup+0x457>
mov    0x18(%rbp),%rdi
mov    -0x58(%rbp),%rsi
mov    -0x50(%rbp),%rdx
mov    -0x60(%rbp),%rcx
call   10f0 <BN_nnmod@plt>
cmp    $0x0,%eax
jne    15c4 <PAKE_setup+0x394>
jmp    1687 <PAKE_setup+0x457>
cmpq   $0x0,0x30(%rbp)
je     15fa <PAKE_setup+0x3ca>
mov    -0x8(%rbp),%rdi
mov    0x30(%rbp),%rsi
mov    -0x18(%rbp),%rcx
mov    0x10(%rbp),%r8
mov    -0x60(%rbp),%r9
xor    %eax,%eax
mov    %eax,%edx
call   1040 <EC_POINT_mul@plt>
cmp    $0x0,%eax
jne    15fa <PAKE_setup+0x3ca>
jmp    1687 <PAKE_setup+0x457>
cmpq   $0x0,0x28(%rbp)
je     164a <PAKE_setup+0x41a>
mov    -0x8(%rbp),%rdi
mov    0x28(%rbp),%rsi
mov    -0x10(%rbp),%rcx
mov    0x10(%rbp),%r8
mov    -0x60(%rbp),%r9
xor    %eax,%eax
mov    %eax,%edx
call   1040 <EC_POINT_mul@plt>
cmp    $0x0,%eax
je     1645 <PAKE_setup+0x415>
mov    -0x8(%rbp),%rdi
mov    0x28(%rbp),%rsi
mov    -0x60(%rbp),%rdx
call   1130 <EC_POINT_invert@plt>
cmp    $0x0,%eax
jne    164a <PAKE_setup+0x41a>
jmp    1687 <PAKE_setup+0x457>
cmpq   $0x0,0x20(%rbp)
je     1680 <PAKE_setup+0x450>
mov    -0x8(%rbp),%rdi
mov    0x20(%rbp),%rsi
mov    0x18(%rbp),%rdx
mov    -0x60(%rbp),%r9
xor    %eax,%eax
mov    %eax,%r8d
mov    %r8,%rcx
call   1040 <EC_POINT_mul@plt>
cmp    $0x0,%eax
jne    1680 <PAKE_setup+0x450>
jmp    1687 <PAKE_setup+0x457>
movl   $0x1,-0x34(%rbp)
cmpl   $0x0,-0x34(%rbp)
jne    16a3 <PAKE_setup+0x473>
mov    0x10(%rbp),%rdi
call   1110 <BN_clear@plt>
mov    0x18(%rbp),%rdi
call   1110 <BN_clear@plt>
mov    -0x68(%rbp),%rdi
mov    -0x70(%rbp),%rax
mov    %eax,%esi
call   1120 <bzero@plt>
lea    -0x36(%rbp),%rdi
mov    $0x1,%esi
call   1120 <bzero@plt>
cmpq   $0x0,-0x50(%rbp)
je     16d4 <PAKE_setup+0x4a4>
mov    -0x50(%rbp),%rdi
call   10d0 <BN_free@plt>
cmpq   $0x0,-0x58(%rbp)
je     16e8 <PAKE_setup+0x4b8>
mov    -0x58(%rbp),%rdi
call   1140 <BN_clear_free@plt>
cmpq   $0x0,-0x60(%rbp)
je     1705 <PAKE_setup+0x4d5>
mov    -0x60(%rbp),%rdi
call   10b0 <BN_CTX_end@plt>
mov    -0x60(%rbp),%rdi
call   1080 <BN_CTX_free@plt>
mov    -0x34(%rbp),%eax
mov    -0x40(%rbp),%rcx
mov    %rcx,%rsp
mov    %rbp,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<PAKE_setup>:
push   %rbp
mov    %rsp,%rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x48,%rsp
mov    %r9,-0x50(%rbp)
mov    %r8,-0x38(%rbp)
mov    %rcx,-0x48(%rbp)
mov    %rdx,-0x68(%rbp)
mov    %rsi,%r13
mov    %rdi,%rbx
mov    %rsp,-0x70(%rbp)
movb   $0x0,-0x2a(%rbp)
mov    0x2d82(%rip),%rax
mov    (%rax),%r14d
mov    %rsp,%r12
mov    %r14,%rax
add    $0xf,%rax
and    $0xfffffffffffffff0,%rax
sub    %rax,%r12
mov    %r12,%rsp
xor    %eax,%eax
call   10e0 <BN_CTX_new@plt>
mov    %rax,%r15
test   %rax,%rax
je     1554 <PAKE_setup+0x324>
mov    %r13,-0x60(%rbp)
mov    %rbx,-0x40(%rbp)
mov    %r15,%rdi
call   10c0 <BN_CTX_start@plt>
xor    %eax,%eax
call   1030 <BN_new@plt>
mov    %rax,%rbx
xor    %eax,%eax
call   1030 <BN_new@plt>
test   %rbx,%rbx
mov    %rax,-0x58(%rbp)
je     154f <PAKE_setup+0x31f>
mov    %rax,%r13
test   %rax,%rax
je     154f <PAKE_setup+0x31f>
mov    -0x40(%rbp),%rdi
mov    %rbx,%rsi
mov    %r15,%rdx
call   1090 <EC_GROUP_get_order@plt>
test   %eax,%eax
je     154f <PAKE_setup+0x31f>
mov    %rbx,%rdi
call   1050 <BN_num_bits@plt>
cmp    $0x1c0,%eax
jg     154f <PAKE_setup+0x31f>
lea    -0x29(%rbp),%rdi
call   1150 <SHA512_Init@plt>
test   %eax,%eax
je     154f <PAKE_setup+0x31f>
lea    -0x29(%rbp),%rdi
lea    -0x2a(%rbp),%rsi
mov    $0x1,%edx
xor    %eax,%eax
call   10a0 <SHA512_Update@plt>
test   %eax,%eax
je     154f <PAKE_setup+0x31f>
mov    -0x38(%rbp),%rdi
call   1060 <strlen@plt>
lea    0x1(%rax),%edx
lea    -0x29(%rbp),%rdi
mov    -0x38(%rbp),%rsi
xor    %eax,%eax
call   10a0 <SHA512_Update@plt>
test   %eax,%eax
je     154f <PAKE_setup+0x31f>
mov    -0x50(%rbp),%rdi
call   1060 <strlen@plt>
lea    0x1(%rax),%edx
lea    -0x29(%rbp),%rdi
mov    -0x50(%rbp),%rsi
xor    %eax,%eax
call   10a0 <SHA512_Update@plt>
test   %eax,%eax
je     154f <PAKE_setup+0x31f>
mov    -0x48(%rbp),%rdi
call   1060 <strlen@plt>
lea    0x1(%rax),%edx
lea    -0x29(%rbp),%rdi
mov    -0x48(%rbp),%rsi
xor    %eax,%eax
call   10a0 <SHA512_Update@plt>
test   %eax,%eax
je     154f <PAKE_setup+0x31f>
lea    -0x29(%rbp),%rsi
mov    %r12,%rdi
call   1100 <SHA512_Final@plt>
test   %eax,%eax
je     154f <PAKE_setup+0x31f>
mov    %r12,%rdi
mov    %r14d,%esi
mov    %r13,%rdx
call   1070 <BN_bin2bn@plt>
test   %eax,%eax
je     154f <PAKE_setup+0x31f>
mov    0x10(%rbp),%rdi
mov    %r13,%rsi
mov    %rbx,%rdx
mov    %r15,%rcx
call   10f0 <BN_nnmod@plt>
test   %eax,%eax
je     154f <PAKE_setup+0x31f>
movb   $0x1,-0x2a(%rbp)
lea    -0x29(%rbp),%rdi
call   1150 <SHA512_Init@plt>
test   %eax,%eax
je     154f <PAKE_setup+0x31f>
lea    -0x29(%rbp),%rdi
lea    -0x2a(%rbp),%rsi
mov    $0x1,%edx
xor    %eax,%eax
call   10a0 <SHA512_Update@plt>
test   %eax,%eax
je     154f <PAKE_setup+0x31f>
mov    -0x38(%rbp),%rdi
call   1060 <strlen@plt>
lea    0x1(%rax),%edx
lea    -0x29(%rbp),%rdi
mov    -0x38(%rbp),%rsi
xor    %eax,%eax
call   10a0 <SHA512_Update@plt>
test   %eax,%eax
je     154f <PAKE_setup+0x31f>
mov    -0x50(%rbp),%rdi
call   1060 <strlen@plt>
lea    0x1(%rax),%edx
lea    -0x29(%rbp),%rdi
mov    -0x50(%rbp),%rsi
xor    %eax,%eax
call   10a0 <SHA512_Update@plt>
test   %eax,%eax
je     154f <PAKE_setup+0x31f>
mov    -0x48(%rbp),%rdi
call   1060 <strlen@plt>
lea    0x1(%rax),%edx
lea    -0x29(%rbp),%rdi
mov    -0x48(%rbp),%rsi
xor    %eax,%eax
call   10a0 <SHA512_Update@plt>
test   %eax,%eax
je     154f <PAKE_setup+0x31f>
lea    -0x29(%rbp),%rsi
mov    %r12,%rdi
call   1100 <SHA512_Final@plt>
test   %eax,%eax
je     154f <PAKE_setup+0x31f>
mov    %r12,%rdi
mov    %r14,%r13
mov    %r14d,%esi
mov    -0x58(%rbp),%rdx
call   1070 <BN_bin2bn@plt>
test   %eax,%eax
je     155f <PAKE_setup+0x32f>
mov    0x18(%rbp),%rdi
mov    -0x58(%rbp),%rsi
mov    %rbx,-0x38(%rbp)
mov    %rbx,%rdx
mov    %r15,%rcx
call   10f0 <BN_nnmod@plt>
test   %eax,%eax
je     15d3 <PAKE_setup+0x3a3>
mov    0x30(%rbp),%rsi
test   %rsi,%rsi
je     14dc <PAKE_setup+0x2ac>
mov    -0x40(%rbp),%rdi
xor    %edx,%edx
mov    -0x68(%rbp),%rcx
mov    0x10(%rbp),%r8
mov    %r15,%r9
call   1040 <EC_POINT_mul@plt>
test   %eax,%eax
je     15d3 <PAKE_setup+0x3a3>
mov    0x28(%rbp),%r14
test   %r14,%r14
je     151d <PAKE_setup+0x2ed>
mov    -0x40(%rbp),%rdi
mov    %r14,%rsi
xor    %edx,%edx
mov    -0x60(%rbp),%rcx
mov    0x10(%rbp),%r8
mov    %r15,%r9
call   1040 <EC_POINT_mul@plt>
test   %eax,%eax
je     15d3 <PAKE_setup+0x3a3>
mov    -0x40(%rbp),%rdi
mov    %r14,%rsi
mov    %r15,%rdx
call   1130 <EC_POINT_invert@plt>
test   %eax,%eax
je     15d3 <PAKE_setup+0x3a3>
mov    0x20(%rbp),%rsi
mov    $0x1,%r14d
test   %rsi,%rsi
je     15d9 <PAKE_setup+0x3a9>
mov    -0x40(%rbp),%rdi
mov    0x18(%rbp),%rdx
xor    %ecx,%ecx
xor    %r8d,%r8d
mov    %r15,%r9
call   1040 <EC_POINT_mul@plt>
test   %eax,%eax
mov    -0x38(%rbp),%rbx
jne    1574 <PAKE_setup+0x344>
jmp    155f <PAKE_setup+0x32f>
mov    %r14,%r13
jmp    155f <PAKE_setup+0x32f>
mov    %r14,%r13
xor    %eax,%eax
mov    %rax,-0x58(%rbp)
xor    %ebx,%ebx
mov    0x10(%rbp),%rdi
call   1110 <BN_clear@plt>
mov    0x18(%rbp),%rdi
call   1110 <BN_clear@plt>
xor    %r14d,%r14d
mov    %r12,%rdi
mov    %r13d,%esi
call   1120 <bzero@plt>
lea    -0x29(%rbp),%rdi
mov    $0x1,%esi
call   1120 <bzero@plt>
test   %rbx,%rbx
je     159a <PAKE_setup+0x36a>
mov    %rbx,%rdi
call   10d0 <BN_free@plt>
mov    -0x58(%rbp),%rdi
test   %rdi,%rdi
je     15a8 <PAKE_setup+0x378>
call   1140 <BN_clear_free@plt>
test   %r15,%r15
je     15bd <PAKE_setup+0x38d>
mov    %r15,%rdi
call   10b0 <BN_CTX_end@plt>
mov    %r15,%rdi
call   1080 <BN_CTX_free@plt>
mov    -0x70(%rbp),%rsp
mov    %r14d,%eax
lea    -0x28(%rbp),%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
mov    -0x38(%rbp),%rbx
jmp    155f <PAKE_setup+0x32f>
mov    -0x38(%rbp),%rbx
jmp    1574 <PAKE_setup+0x344>

LLVM IR (-O0):
@SHA512_DIGEST_LENGTH = global i32 0
define i32 @PAKE_setup(i32* %0, i32* %1, i32* %2, i8* %3, i8* %4, i8* %5, i32* %6, i32* %7, i32* %8, i32* %9, i32* %10) {
%12 = alloca i32*
%13 = alloca i32*
%14 = alloca i32*
%15 = alloca i8*
%16 = alloca i8*
%17 = alloca i8*
%18 = alloca i32*
%19 = alloca i32*
%20 = alloca i32*
%21 = alloca i32*
%22 = alloca i32*
%23 = alloca i32
%24 = alloca i8
%25 = alloca i8
%26 = alloca i8*
%27 = alloca i64
%28 = alloca i32*
%29 = alloca i32*
%30 = alloca i32*
store i32* %0, i32** %12
store i32* %1, i32** %13
store i32* %2, i32** %14
store i8* %3, i8** %15
store i8* %4, i8** %16
store i8* %5, i8** %17
store i32* %6, i32** %18
store i32* %7, i32** %19
store i32* %8, i32** %20
store i32* %9, i32** %21
store i32* %10, i32** %22
store i32 0, i32* %23
store i8 0, i8* %24
%31 = load i32, i32* @SHA512_DIGEST_LENGTH
%32 = zext i32 %31 to i64
%33 = call i8* @llvm.stacksave()
store i8* %33, i8** %26
%34 = alloca i8, i64 %32
store i64 %32, i64* %27
store i32* null, i32** %28
store i32* null, i32** %29
store i32* null, i32** %30
%35 = call i32* (...) @BN_CTX_new()
store i32* %35, i32** %30
%36 = icmp ne i32* %35, null
br i1 %36, label %38, label %37
37: ; preds = %11
br label %203
38: ; preds = %11
%39 = load i32*, i32** %30
%40 = call i32 @BN_CTX_start(i32* %39)
%41 = call i32* (...) @BN_new()
store i32* %41, i32** %28
%42 = call i32* (...) @BN_new()
store i32* %42, i32** %29
%43 = load i32*, i32** %28
%44 = icmp ne i32* %43, null
br i1 %44, label %45, label %48
45: ; preds = %38
%46 = load i32*, i32** %29
%47 = icmp ne i32* %46, null
br i1 %47, label %49, label %48
48: ; preds = %45, %38
br label %203
49: ; preds = %45
%50 = load i32*, i32** %12
%51 = load i32*, i32** %28
%52 = load i32*, i32** %30
%53 = call i32 @EC_GROUP_get_order(i32* %50, i32* %51, i32* %52)
%54 = icmp ne i32 %53, 0
br i1 %54, label %56, label %55
55: ; preds = %49
br label %203
56: ; preds = %49
%57 = load i32*, i32** %28
%58 = call i32 @BN_num_bits(i32* %57)
%59 = icmp sgt i32 %58, 448
br i1 %59, label %60, label %61
60: ; preds = %56
br label %203
61: ; preds = %56
%62 = call i32 @SHA512_Init(i8* %25)
%63 = icmp ne i32 %62, 0
br i1 %63, label %65, label %64
64: ; preds = %61
br label %203
65: ; preds = %61
%66 = call i32 (i8*, ...) @SHA512_Update(i8* %25, i8* %24, i32 1)
%67 = icmp ne i32 %66, 0
br i1 %67, label %69, label %68
68: ; preds = %65
br label %203
69: ; preds = %65
%70 = load i8*, i8** %16
%71 = load i8*, i8** %16
%72 = call i32 @strlen(i8* %71)
%73 = add nsw i32 1, %72
%74 = call i32 (i8*, ...) @SHA512_Update(i8* %25, i8* %70, i32 %73)
%75 = icmp ne i32 %74, 0
br i1 %75, label %77, label %76
76: ; preds = %69
br label %203
77: ; preds = %69
%78 = load i8*, i8** %17
%79 = load i8*, i8** %17
%80 = call i32 @strlen(i8* %79)
%81 = add nsw i32 1, %80
%82 = call i32 (i8*, ...) @SHA512_Update(i8* %25, i8* %78, i32 %81)
%83 = icmp ne i32 %82, 0
br i1 %83, label %85, label %84
84: ; preds = %77
br label %203
85: ; preds = %77
%86 = load i8*, i8** %15
%87 = load i8*, i8** %15
%88 = call i32 @strlen(i8* %87)
%89 = add nsw i32 1, %88
%90 = call i32 (i8*, ...) @SHA512_Update(i8* %25, i8* %86, i32 %89)
%91 = icmp ne i32 %90, 0
br i1 %91, label %93, label %92
92: ; preds = %85
br label %203
93: ; preds = %85
%94 = call i32 @SHA512_Final(i8* %34, i8* %25)
%95 = icmp ne i32 %94, 0
br i1 %95, label %97, label %96
96: ; preds = %93
br label %203
97: ; preds = %93
%98 = trunc i64 %32 to i32
%99 = load i32*, i32** %29
%100 = call i32 @BN_bin2bn(i8* %34, i32 %98, i32* %99)
%101 = icmp ne i32 %100, 0
br i1 %101, label %103, label %102
102: ; preds = %97
br label %203
103: ; preds = %97
%104 = load i32*, i32** %18
%105 = load i32*, i32** %29
%106 = load i32*, i32** %28
%107 = load i32*, i32** %30
%108 = call i32 @BN_nnmod(i32* %104, i32* %105, i32* %106, i32* %107)
%109 = icmp ne i32 %108, 0
br i1 %109, label %111, label %110
110: ; preds = %103
br label %203
111: ; preds = %103
store i8 1, i8* %24
%112 = call i32 @SHA512_Init(i8* %25)
%113 = icmp ne i32 %112, 0
br i1 %113, label %115, label %114
114: ; preds = %111
br label %203
115: ; preds = %111
%116 = call i32 (i8*, ...) @SHA512_Update(i8* %25, i8* %24, i32 1)
%117 = icmp ne i32 %116, 0
br i1 %117, label %119, label %118
118: ; preds = %115
br label %203
119: ; preds = %115
%120 = load i8*, i8** %16
%121 = load i8*, i8** %16
%122 = call i32 @strlen(i8* %121)
%123 = add nsw i32 1, %122
%124 = call i32 (i8*, ...) @SHA512_Update(i8* %25, i8* %120, i32 %123)
%125 = icmp ne i32 %124, 0
br i1 %125, label %127, label %126
126: ; preds = %119
br label %203
127: ; preds = %119
%128 = load i8*, i8** %17
%129 = load i8*, i8** %17
%130 = call i32 @strlen(i8* %129)
%131 = add nsw i32 1, %130
%132 = call i32 (i8*, ...) @SHA512_Update(i8* %25, i8* %128, i32 %131)
%133 = icmp ne i32 %132, 0
br i1 %133, label %135, label %134
134: ; preds = %127
br label %203
135: ; preds = %127
%136 = load i8*, i8** %15
%137 = load i8*, i8** %15
%138 = call i32 @strlen(i8* %137)
%139 = add nsw i32 1, %138
%140 = call i32 (i8*, ...) @SHA512_Update(i8* %25, i8* %136, i32 %139)
%141 = icmp ne i32 %140, 0
br i1 %141, label %143, label %142
142: ; preds = %135
br label %203
143: ; preds = %135
%144 = call i32 @SHA512_Final(i8* %34, i8* %25)
%145 = icmp ne i32 %144, 0
br i1 %145, label %147, label %146
146: ; preds = %143
br label %203
147: ; preds = %143
%148 = trunc i64 %32 to i32
%149 = load i32*, i32** %29
%150 = call i32 @BN_bin2bn(i8* %34, i32 %148, i32* %149)
%151 = icmp ne i32 %150, 0
br i1 %151, label %153, label %152
152: ; preds = %147
br label %203
153: ; preds = %147
%154 = load i32*, i32** %19
%155 = load i32*, i32** %29
%156 = load i32*, i32** %28
%157 = load i32*, i32** %30
%158 = call i32 @BN_nnmod(i32* %154, i32* %155, i32* %156, i32* %157)
%159 = icmp ne i32 %158, 0
br i1 %159, label %161, label %160
160: ; preds = %153
br label %203
161: ; preds = %153
%162 = load i32*, i32** %22
%163 = icmp ne i32* %162, null
br i1 %163, label %164, label %173
164: ; preds = %161
%165 = load i32*, i32** %12
%166 = load i32*, i32** %22
%167 = load i32*, i32** %14
%168 = load i32*, i32** %18
%169 = load i32*, i32** %30
%170 = call i32 @EC_POINT_mul(i32* %165, i32* %166, i32* null, i32* %167, i32* %168, i32* %169)
%171 = icmp ne i32 %170, 0
br i1 %171, label %173, label %172
172: ; preds = %164
br label %203
173: ; preds = %164, %161
%174 = load i32*, i32** %21
%175 = icmp ne i32* %174, null
br i1 %175, label %176, label %191
176: ; preds = %173
%177 = load i32*, i32** %12
%178 = load i32*, i32** %21
%179 = load i32*, i32** %13
%180 = load i32*, i32** %18
%181 = load i32*, i32** %30
%182 = call i32 @EC_POINT_mul(i32* %177, i32* %178, i32* null, i32* %179, i32* %180, i32* %181)
%183 = icmp ne i32 %182, 0
br i1 %183, label %184, label %190
184: ; preds = %176
%185 = load i32*, i32** %12
%186 = load i32*, i32** %21
%187 = load i32*, i32** %30
%188 = call i32 @EC_POINT_invert(i32* %185, i32* %186, i32* %187)
%189 = icmp ne i32 %188, 0
br i1 %189, label %191, label %190
190: ; preds = %184, %176
br label %203
191: ; preds = %184, %173
%192 = load i32*, i32** %20
%193 = icmp ne i32* %192, null
br i1 %193, label %194, label %202
194: ; preds = %191
%195 = load i32*, i32** %12
%196 = load i32*, i32** %20
%197 = load i32*, i32** %19
%198 = load i32*, i32** %30
%199 = call i32 @EC_POINT_mul(i32* %195, i32* %196, i32* %197, i32* null, i32* null, i32* %198)
%200 = icmp ne i32 %199, 0
br i1 %200, label %202, label %201
201: ; preds = %194
br label %203
202: ; preds = %194, %191
store i32 1, i32* %23
br label %203
203: ; preds = %202, %201, %190, %172, %160, %152, %146, %142, %134, %126, %118, %114, %110, %102, %96, %92, %84, %76, %68, %64, %60, %55, %48, %37
%204 = load i32, i32* %23
%205 = icmp ne i32 %204, 0
br i1 %205, label %211, label %206
206: ; preds = %203
%207 = load i32*, i32** %18
%208 = call i32 @BN_clear(i32* %207)
%209 = load i32*, i32** %19
%210 = call i32 @BN_clear(i32* %209)
br label %211
211: ; preds = %206, %203
%212 = trunc i64 %32 to i32
%213 = call i32 @bzero(i8* %34, i32 %212)
%214 = call i32 @bzero(i8* %25, i32 1)
%215 = load i32*, i32** %28
%216 = icmp ne i32* %215, null
br i1 %216, label %217, label %220
217: ; preds = %211
%218 = load i32*, i32** %28
%219 = call i32 @BN_free(i32* %218)
br label %220
220: ; preds = %217, %211
%221 = load i32*, i32** %29
%222 = icmp ne i32* %221, null
br i1 %222, label %223, label %226
223: ; preds = %220
%224 = load i32*, i32** %29
%225 = call i32 @BN_clear_free(i32* %224)
br label %226
226: ; preds = %223, %220
%227 = load i32*, i32** %30
%228 = icmp ne i32* %227, null
br i1 %228, label %229, label %234
229: ; preds = %226
%230 = load i32*, i32** %30
%231 = call i32 @BN_CTX_end(i32* %230)
%232 = load i32*, i32** %30
%233 = call i32 @BN_CTX_free(i32* %232)
br label %234
234: ; preds = %229, %226
%235 = load i32, i32* %23
%236 = load i8*, i8** %26
ret i32 %235
}

LLVM IR (-O2):
@SHA512_DIGEST_LENGTH = global i32 0
define i32 @PAKE_setup(i32* %0, i32* %1, i32* %2, i8* %3, i8* %4, i8* %5, i32* %6, i32* %7, i32* %8, i32* %9, i32* %10) {
%12 = alloca i8
%13 = alloca i8
store i8 0, i8* %12
%14 = load i32, i32* @SHA512_DIGEST_LENGTH
%15 = zext i32 %14 to i64
%16 = tail call i8* @llvm.stacksave()
%17 = alloca i8, i64 %15
%18 = tail call i32* (...) @BN_CTX_new()
%19 = icmp eq i32* %18, null
br i1 %19, label %111, label %20
20: ; preds = %11
%21 = tail call i32 @BN_CTX_start(i32* %18)
%22 = tail call i32* (...) @BN_new()
%23 = tail call i32* (...) @BN_new()
%24 = icmp ne i32* %22, null
%25 = icmp ne i32* %23, null
%26 = select i1 %24, i1 %25, i1 false
br i1 %26, label %27, label %111
27: ; preds = %20
%28 = tail call i32 @EC_GROUP_get_order(i32* %0, i32* %22, i32* %18)
%29 = icmp eq i32 %28, 0
br i1 %29, label %111, label %30
30: ; preds = %27
%31 = tail call i32 @BN_num_bits(i32* %22)
%32 = icmp sgt i32 %31, 448
br i1 %32, label %111, label %33
33: ; preds = %30
%34 = call i32 @SHA512_Init(i8* %13)
%35 = icmp eq i32 %34, 0
br i1 %35, label %111, label %36
36: ; preds = %33
%37 = call i32 (i8*, ...) @SHA512_Update(i8* %13, i8* %12, i32 1)
%38 = icmp eq i32 %37, 0
br i1 %38, label %111, label %39
39: ; preds = %36
%40 = call i32 @strlen(i8* %4)
%41 = add nsw i32 %40, 1
%42 = call i32 (i8*, ...) @SHA512_Update(i8* %13, i8* %4, i32 %41)
%43 = icmp eq i32 %42, 0
br i1 %43, label %111, label %44
44: ; preds = %39
%45 = call i32 @strlen(i8* %5)
%46 = add nsw i32 %45, 1
%47 = call i32 (i8*, ...) @SHA512_Update(i8* %13, i8* %5, i32 %46)
%48 = icmp eq i32 %47, 0
br i1 %48, label %111, label %49
49: ; preds = %44
%50 = call i32 @strlen(i8* %3)
%51 = add nsw i32 %50, 1
%52 = call i32 (i8*, ...) @SHA512_Update(i8* %13, i8* %3, i32 %51)
%53 = icmp eq i32 %52, 0
br i1 %53, label %111, label %54
54: ; preds = %49
%55 = call i32 @SHA512_Final(i8* %17, i8* %13)
%56 = icmp eq i32 %55, 0
br i1 %56, label %111, label %57
57: ; preds = %54
%58 = call i32 @BN_bin2bn(i8* %17, i32 %14, i32* %23)
%59 = icmp eq i32 %58, 0
br i1 %59, label %111, label %60
60: ; preds = %57
%61 = call i32 @BN_nnmod(i32* %6, i32* %23, i32* %22, i32* %18)
%62 = icmp eq i32 %61, 0
br i1 %62, label %111, label %63
63: ; preds = %60
store i8 1, i8* %12
%64 = call i32 @SHA512_Init(i8* %13)
%65 = icmp eq i32 %64, 0
br i1 %65, label %111, label %66
66: ; preds = %63
%67 = call i32 (i8*, ...) @SHA512_Update(i8* %13, i8* %12, i32 1)
%68 = icmp eq i32 %67, 0
br i1 %68, label %111, label %69
69: ; preds = %66
%70 = call i32 @strlen(i8* %4)
%71 = add nsw i32 %70, 1
%72 = call i32 (i8*, ...) @SHA512_Update(i8* %13, i8* %4, i32 %71)
%73 = icmp eq i32 %72, 0
br i1 %73, label %111, label %74
74: ; preds = %69
%75 = call i32 @strlen(i8* %5)
%76 = add nsw i32 %75, 1
%77 = call i32 (i8*, ...) @SHA512_Update(i8* %13, i8* %5, i32 %76)
%78 = icmp eq i32 %77, 0
br i1 %78, label %111, label %79
79: ; preds = %74
%80 = call i32 @strlen(i8* %3)
%81 = add nsw i32 %80, 1
%82 = call i32 (i8*, ...) @SHA512_Update(i8* %13, i8* %3, i32 %81)
%83 = icmp eq i32 %82, 0
br i1 %83, label %111, label %84
84: ; preds = %79
%85 = call i32 @SHA512_Final(i8* %17, i8* %13)
%86 = icmp eq i32 %85, 0
br i1 %86, label %111, label %87
87: ; preds = %84
%88 = call i32 @BN_bin2bn(i8* %17, i32 %14, i32* %23)
%89 = icmp eq i32 %88, 0
br i1 %89, label %111, label %90
90: ; preds = %87
%91 = call i32 @BN_nnmod(i32* %7, i32* %23, i32* %22, i32* %18)
%92 = icmp eq i32 %91, 0
br i1 %92, label %111, label %93
93: ; preds = %90
%94 = icmp eq i32* %10, null
br i1 %94, label %98, label %95
95: ; preds = %93
%96 = call i32 @EC_POINT_mul(i32* %0, i32* %10, i32* null, i32* %2, i32* %6, i32* %18)
%97 = icmp eq i32 %96, 0
br i1 %97, label %111, label %98
98: ; preds = %95, %93
%99 = icmp eq i32* %9, null
br i1 %99, label %106, label %100
100: ; preds = %98
%101 = call i32 @EC_POINT_mul(i32* %0, i32* %9, i32* null, i32* %1, i32* %6, i32* %18)
%102 = icmp eq i32 %101, 0
br i1 %102, label %111, label %103
103: ; preds = %100
%104 = call i32 @EC_POINT_invert(i32* %0, i32* %9, i32* %18)
%105 = icmp eq i32 %104, 0
br i1 %105, label %111, label %106
106: ; preds = %103, %98
%107 = icmp eq i32* %8, null
br i1 %107, label %116, label %108
108: ; preds = %106
%109 = call i32 @EC_POINT_mul(i32* %0, i32* %8, i32* %7, i32* null, i32* null, i32* %18)
%110 = icmp eq i32 %109, 0
br i1 %110, label %111, label %116
111: ; preds = %108, %100, %103, %95, %90, %87, %84, %79, %74, %69, %66, %63, %60, %57, %54, %49, %44, %39, %36, %33, %30, %27, %20, %11
%112 = phi i32* [ null, %11 ], [ %22, %20 ], [ %22, %27 ], [ %22, %30 ], [ %22, %33 ], [ %22, %36 ], [ %22, %39 ], [ %22, %44 ], [ %22, %49 ], [ %22, %54 ], [ %22, %57 ], [ %22, %60 ], [ %22, %63 ], [ %22, %66 ], [ %22, %69 ], [ %22, %74 ], [ %22, %79 ], [ %22, %84 ], [ %22, %87 ], [ %22, %90 ], [ %22, %95 ], [ %22, %103 ], [ %22, %100 ], [ %22, %108 ]
%113 = phi i32* [ null, %11 ], [ %23, %20 ], [ %23, %27 ], [ %23, %30 ], [ %23, %33 ], [ %23, %36 ], [ %23, %39 ], [ %23, %44 ], [ %23, %49 ], [ %23, %54 ], [ %23, %57 ], [ %23, %60 ], [ %23, %63 ], [ %23, %66 ], [ %23, %69 ], [ %23, %74 ], [ %23, %79 ], [ %23, %84 ], [ %23, %87 ], [ %23, %90 ], [ %23, %95 ], [ %23, %103 ], [ %23, %100 ], [ %23, %108 ]
%114 = call i32 @BN_clear(i32* %6)
%115 = call i32 @BN_clear(i32* %7)
br label %116
116: ; preds = %108, %106, %111
%117 = phi i32* [ %113, %111 ], [ %23, %106 ], [ %23, %108 ]
%118 = phi i32* [ %112, %111 ], [ %22, %106 ], [ %22, %108 ]
%119 = phi i32 [ 0, %111 ], [ 1, %106 ], [ 1, %108 ]
%120 = call i32 @bzero(i8* %17, i32 %14)
%121 = call i32 @bzero(i8* %13, i32 1)
%122 = icmp eq i32* %118, null
br i1 %122, label %125, label %123
123: ; preds = %116
%124 = call i32 @BN_free(i32* %118)
br label %125
125: ; preds = %123, %116
%126 = icmp eq i32* %117, null
br i1 %126, label %129, label %127
127: ; preds = %125
%128 = call i32 @BN_clear_free(i32* %117)
br label %129
129: ; preds = %127, %125
br i1 %19, label %133, label %130
130: ; preds = %129
%131 = call i32 @BN_CTX_end(i32* %18)
%132 = call i32 @BN_CTX_free(i32* %18)
br label %133
133: ; preds = %130, %129
ret i32 %119
}