#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ curve25519_freeze(unsigned int *);
int /*<<< orphan*/ curve25519_mainloop(unsigned int *, unsigned char *);
int /*<<< orphan*/ curve25519_mult(unsigned int *, unsigned int *,
                                   unsigned int *);
int /*<<< orphan*/ curve25519_recip(unsigned int *, unsigned int *);
int curve25519_crypto_scalarmult(unsigned char *q, const unsigned char *n,
                                 const unsigned char *p) {
  unsigned int work[96];
  unsigned char e[32];
  unsigned int i;
  for (i = 0; i < 32; ++i)
    e[i] = n[i];
  e[0] &= 248;
  e[31] &= 127;
  e[31] |= 64;
  for (i = 0; i < 32; ++i)
    work[i] = p[i];
  curve25519_mainloop(work, e);
  curve25519_recip(work + 32, work + 32);
  curve25519_mult(work + 64, work, work + 32);
  curve25519_freeze(work + 64);
  for (i = 0; i < 32; ++i)
    q[i] = work[64 + i];
  return 0;
}


x86 assembly (clang, -O0):
<curve25519_crypto_scalarmult>:
push   %rbp
mov    %rsp,%rbp
sub    $0x1d0,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
movl   $0x0,-0x1c4(%rbp)
cmpl   $0x20,-0x1c4(%rbp)
jae    119c <curve25519_crypto_scalarmult+0x5c>
mov    -0x10(%rbp),%rax
mov    -0x1c4(%rbp),%ecx
mov    (%rax,%rcx,1),%cl
mov    -0x1c4(%rbp),%eax
mov    %cl,-0x1c0(%rbp,%rax,1)
mov    -0x1c4(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1c4(%rbp)
jmp    1161 <curve25519_crypto_scalarmult+0x21>
movzbl -0x1c0(%rbp),%eax
and    $0xf8,%eax
mov    %al,-0x1c0(%rbp)
movzbl -0x1a1(%rbp),%eax
and    $0x7f,%eax
mov    %al,-0x1a1(%rbp)
movzbl -0x1a1(%rbp),%eax
or     $0x40,%eax
mov    %al,-0x1a1(%rbp)
movl   $0x0,-0x1c4(%rbp)
cmpl   $0x20,-0x1c4(%rbp)
jae    1214 <curve25519_crypto_scalarmult+0xd4>
mov    -0x18(%rbp),%rax
mov    -0x1c4(%rbp),%ecx
movzbl (%rax,%rcx,1),%ecx
mov    -0x1c4(%rbp),%eax
mov    %ecx,-0x1a0(%rbp,%rax,4)
mov    -0x1c4(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1c4(%rbp)
jmp    11d8 <curve25519_crypto_scalarmult+0x98>
lea    -0x1a0(%rbp),%rdi
lea    -0x1c0(%rbp),%rsi
call   1040 <curve25519_mainloop@plt>
lea    -0x1a0(%rbp),%rdi
add    $0x80,%rdi
lea    -0x1a0(%rbp),%rsi
add    $0x80,%rsi
call   1030 <curve25519_recip@plt>
lea    -0x1a0(%rbp),%rdi
add    $0x100,%rdi
lea    -0x1a0(%rbp),%rsi
lea    -0x1a0(%rbp),%rdx
add    $0x80,%rdx
call   1060 <curve25519_mult@plt>
lea    -0x1a0(%rbp),%rdi
add    $0x100,%rdi
call   1050 <curve25519_freeze@plt>
movl   $0x0,-0x1c4(%rbp)
cmpl   $0x20,-0x1c4(%rbp)
jae    12cf <curve25519_crypto_scalarmult+0x18f>
mov    -0x1c4(%rbp),%eax
add    $0x40,%eax
mov    %eax,%eax
mov    -0x1a0(%rbp,%rax,4),%eax
mov    %al,%dl
mov    -0x8(%rbp),%rax
mov    -0x1c4(%rbp),%ecx
mov    %dl,(%rax,%rcx,1)
mov    -0x1c4(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1c4(%rbp)
jmp    128d <curve25519_crypto_scalarmult+0x14d>
xor    %eax,%eax
add    $0x1d0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<curve25519_crypto_scalarmult>:
push   %r15
push   %r14
push   %r12
push   %rbx
sub    $0x1a8,%rsp
mov    %rdi,%r15
movdqu (%rsi),%xmm0
movups 0x10(%rsi),%xmm1
movdqa %xmm0,(%rsp)
movaps %xmm1,0x10(%rsp)
andb   $0xf8,(%rsp)
mov    0x1f(%rsp),%al
and    $0x3f,%al
or     $0x40,%al
mov    %al,0x1f(%rsp)
movd   (%rdx),%xmm1
pxor   %xmm0,%xmm0
punpcklbw %xmm0,%xmm1
punpcklwd %xmm0,%xmm1
movdqa %xmm1,0x20(%rsp)
movd   0x4(%rdx),%xmm1
punpcklbw %xmm0,%xmm1
punpcklwd %xmm0,%xmm1
movdqa %xmm1,0x30(%rsp)
movd   0x8(%rdx),%xmm1
punpcklbw %xmm0,%xmm1
punpcklwd %xmm0,%xmm1
movdqa %xmm1,0x40(%rsp)
movd   0xc(%rdx),%xmm1
punpcklbw %xmm0,%xmm1
punpcklwd %xmm0,%xmm1
movdqa %xmm1,0x50(%rsp)
movd   0x10(%rdx),%xmm1
punpcklbw %xmm0,%xmm1
punpcklwd %xmm0,%xmm1
movdqa %xmm1,0x60(%rsp)
movd   0x14(%rdx),%xmm1
punpcklbw %xmm0,%xmm1
punpcklwd %xmm0,%xmm1
movdqa %xmm1,0x70(%rsp)
movd   0x18(%rdx),%xmm1
punpcklbw %xmm0,%xmm1
punpcklwd %xmm0,%xmm1
movdqa %xmm1,0x80(%rsp)
movd   0x1c(%rdx),%xmm1
punpcklbw %xmm0,%xmm1
punpcklwd %xmm0,%xmm1
movdqa %xmm1,0x90(%rsp)
lea    0x20(%rsp),%r14
mov    %rsp,%rsi
mov    %r14,%rdi
call   1040 <curve25519_mainloop@plt>
lea    0xa0(%rsp),%rbx
mov    %rbx,%rdi
mov    %rbx,%rsi
call   1030 <curve25519_recip@plt>
lea    0x120(%rsp),%r12
mov    %r12,%rdi
mov    %r14,%rsi
mov    %rbx,%rdx
call   1060 <curve25519_mult@plt>
mov    %r12,%rdi
call   1050 <curve25519_freeze@plt>
movdqa 0xda3(%rip),%xmm0
movdqa 0x120(%rsp),%xmm1
pand   %xmm0,%xmm1
packuswb %xmm1,%xmm1
packuswb %xmm1,%xmm1
movd   %xmm1,(%r15)
movdqa 0x130(%rsp),%xmm1
pand   %xmm0,%xmm1
packuswb %xmm1,%xmm1
packuswb %xmm1,%xmm1
movd   %xmm1,0x4(%r15)
movdqa 0x140(%rsp),%xmm1
pand   %xmm0,%xmm1
packuswb %xmm1,%xmm1
packuswb %xmm1,%xmm1
movd   %xmm1,0x8(%r15)
movdqa 0x150(%rsp),%xmm1
pand   %xmm0,%xmm1
packuswb %xmm1,%xmm1
packuswb %xmm1,%xmm1
movd   %xmm1,0xc(%r15)
movdqa 0x160(%rsp),%xmm1
pand   %xmm0,%xmm1
packuswb %xmm1,%xmm1
packuswb %xmm1,%xmm1
movd   %xmm1,0x10(%r15)
movdqa 0x170(%rsp),%xmm1
pand   %xmm0,%xmm1
packuswb %xmm1,%xmm1
packuswb %xmm1,%xmm1
movd   %xmm1,0x14(%r15)
movdqa 0x180(%rsp),%xmm1
pand   %xmm0,%xmm1
packuswb %xmm1,%xmm1
packuswb %xmm1,%xmm1
movd   %xmm1,0x18(%r15)
pand   0x190(%rsp),%xmm0
packuswb %xmm0,%xmm0
packuswb %xmm0,%xmm0
movd   %xmm0,0x1c(%r15)
xor    %eax,%eax
add    $0x1a8,%rsp
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
define i32 @curve25519_crypto_scalarmult(i8* %0, i8* %1, i8* %2) {
%4 = alloca i8*
%5 = alloca i8*
%6 = alloca i8*
%7 = alloca [96 x i32]
%8 = alloca [32 x i8]
%9 = alloca i32
store i8* %0, i8** %4
store i8* %1, i8** %5
store i8* %2, i8** %6
store i32 0, i32* %9
br label %10
10: ; preds = %22, %3
%11 = load i32, i32* %9
%12 = icmp ult i32 %11, 32
br i1 %12, label %13, label %25
13: ; preds = %10
%14 = load i8*, i8** %5
%15 = load i32, i32* %9
%16 = zext i32 %15 to i64
%17 = getelementptr inbounds i8, i8* %14, i64 %16
%18 = load i8, i8* %17
%19 = load i32, i32* %9
%20 = zext i32 %19 to i64
%21 = getelementptr inbounds [32 x i8], [32 x i8]* %8, i64 0, i64 %20
store i8 %18, i8* %21
br label %22
22: ; preds = %13
%23 = load i32, i32* %9
%24 = add i32 %23, 1
store i32 %24, i32* %9
br label %10
25: ; preds = %10
%26 = getelementptr inbounds [32 x i8], [32 x i8]* %8, i64 0, i64 0
%27 = load i8, i8* %26
%28 = zext i8 %27 to i32
%29 = and i32 %28, 248
%30 = trunc i32 %29 to i8
store i8 %30, i8* %26
%31 = getelementptr inbounds [32 x i8], [32 x i8]* %8, i64 0, i64 31
%32 = load i8, i8* %31
%33 = zext i8 %32 to i32
%34 = and i32 %33, 127
%35 = trunc i32 %34 to i8
store i8 %35, i8* %31
%36 = getelementptr inbounds [32 x i8], [32 x i8]* %8, i64 0, i64 31
%37 = load i8, i8* %36
%38 = zext i8 %37 to i32
%39 = or i32 %38, 64
%40 = trunc i32 %39 to i8
store i8 %40, i8* %36
store i32 0, i32* %9
br label %41
41: ; preds = %54, %25
%42 = load i32, i32* %9
%43 = icmp ult i32 %42, 32
br i1 %43, label %44, label %57
44: ; preds = %41
%45 = load i8*, i8** %6
%46 = load i32, i32* %9
%47 = zext i32 %46 to i64
%48 = getelementptr inbounds i8, i8* %45, i64 %47
%49 = load i8, i8* %48
%50 = zext i8 %49 to i32
%51 = load i32, i32* %9
%52 = zext i32 %51 to i64
%53 = getelementptr inbounds [96 x i32], [96 x i32]* %7, i64 0, i64 %52
store i32 %50, i32* %53
br label %54
54: ; preds = %44
%55 = load i32, i32* %9
%56 = add i32 %55, 1
store i32 %56, i32* %9
br label %41
57: ; preds = %41
%58 = getelementptr inbounds [96 x i32], [96 x i32]* %7, i64 0, i64 0
%59 = getelementptr inbounds [32 x i8], [32 x i8]* %8, i64 0, i64 0
%60 = call i32 @curve25519_mainloop(i32* %58, i8* %59)
%61 = getelementptr inbounds [96 x i32], [96 x i32]* %7, i64 0, i64 0
%62 = getelementptr inbounds i32, i32* %61, i64 32
%63 = getelementptr inbounds [96 x i32], [96 x i32]* %7, i64 0, i64 0
%64 = getelementptr inbounds i32, i32* %63, i64 32
%65 = call i32 @curve25519_recip(i32* %62, i32* %64)
%66 = getelementptr inbounds [96 x i32], [96 x i32]* %7, i64 0, i64 0
%67 = getelementptr inbounds i32, i32* %66, i64 64
%68 = getelementptr inbounds [96 x i32], [96 x i32]* %7, i64 0, i64 0
%69 = getelementptr inbounds [96 x i32], [96 x i32]* %7, i64 0, i64 0
%70 = getelementptr inbounds i32, i32* %69, i64 32
%71 = call i32 @curve25519_mult(i32* %67, i32* %68, i32* %70)
%72 = getelementptr inbounds [96 x i32], [96 x i32]* %7, i64 0, i64 0
%73 = getelementptr inbounds i32, i32* %72, i64 64
%74 = call i32 @curve25519_freeze(i32* %73)
store i32 0, i32* %9
br label %75
75: ; preds = %89, %57
%76 = load i32, i32* %9
%77 = icmp ult i32 %76, 32
br i1 %77, label %78, label %92
78: ; preds = %75
%79 = load i32, i32* %9
%80 = add i32 64, %79
%81 = zext i32 %80 to i64
%82 = getelementptr inbounds [96 x i32], [96 x i32]* %7, i64 0, i64 %81
%83 = load i32, i32* %82
%84 = trunc i32 %83 to i8
%85 = load i8*, i8** %4
%86 = load i32, i32* %9
%87 = zext i32 %86 to i64
%88 = getelementptr inbounds i8, i8* %85, i64 %87
store i8 %84, i8* %88
br label %89
89: ; preds = %78
%90 = load i32, i32* %9
%91 = add i32 %90, 1
store i32 %91, i32* %9
br label %75
92: ; preds = %75
ret i32 0
}

LLVM IR (-O2):
define i32 @curve25519_crypto_scalarmult(i8* nocapture writeonly %0, i8* nocapture %1, i8* nocapture %2) {
%4 = alloca [96 x i32]
%5 = alloca [32 x i8]
%6 = getelementptr inbounds [32 x i8], [32 x i8]* %5, i64 0, i64 0
%7 = bitcast [96 x i32]* %4 to i8*
%8 = getelementptr inbounds [32 x i8], [32 x i8]* %5, i64 0, i64 0
%9 = load i8, i8* %8
%10 = and i8 %9, -8
store i8 %10, i8* %8
%11 = getelementptr inbounds [32 x i8], [32 x i8]* %5, i64 0, i64 31
%12 = load i8, i8* %11
%13 = and i8 %12, 63
%14 = or i8 %13, 64
store i8 %14, i8* %11
%15 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 0
%16 = bitcast i8* %2 to <4 x i8>*
%17 = load <4 x i8>, <4 x i8>* %16
%18 = zext <4 x i8> %17 to <4 x i32>
%19 = bitcast [96 x i32]* %4 to <4 x i32>*
store <4 x i32> %18, <4 x i32>* %19
%20 = getelementptr inbounds i8, i8* %2, i64 4
%21 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 4
%22 = bitcast i8* %20 to <4 x i8>*
%23 = load <4 x i8>, <4 x i8>* %22
%24 = zext <4 x i8> %23 to <4 x i32>
%25 = bitcast i32* %21 to <4 x i32>*
store <4 x i32> %24, <4 x i32>* %25
%26 = getelementptr inbounds i8, i8* %2, i64 8
%27 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 8
%28 = bitcast i8* %26 to <4 x i8>*
%29 = load <4 x i8>, <4 x i8>* %28
%30 = zext <4 x i8> %29 to <4 x i32>
%31 = bitcast i32* %27 to <4 x i32>*
store <4 x i32> %30, <4 x i32>* %31
%32 = getelementptr inbounds i8, i8* %2, i64 12
%33 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 12
%34 = bitcast i8* %32 to <4 x i8>*
%35 = load <4 x i8>, <4 x i8>* %34
%36 = zext <4 x i8> %35 to <4 x i32>
%37 = bitcast i32* %33 to <4 x i32>*
store <4 x i32> %36, <4 x i32>* %37
%38 = getelementptr inbounds i8, i8* %2, i64 16
%39 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 16
%40 = bitcast i8* %38 to <4 x i8>*
%41 = load <4 x i8>, <4 x i8>* %40
%42 = zext <4 x i8> %41 to <4 x i32>
%43 = bitcast i32* %39 to <4 x i32>*
store <4 x i32> %42, <4 x i32>* %43
%44 = getelementptr inbounds i8, i8* %2, i64 20
%45 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 20
%46 = bitcast i8* %44 to <4 x i8>*
%47 = load <4 x i8>, <4 x i8>* %46
%48 = zext <4 x i8> %47 to <4 x i32>
%49 = bitcast i32* %45 to <4 x i32>*
store <4 x i32> %48, <4 x i32>* %49
%50 = getelementptr inbounds i8, i8* %2, i64 24
%51 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 24
%52 = bitcast i8* %50 to <4 x i8>*
%53 = load <4 x i8>, <4 x i8>* %52
%54 = zext <4 x i8> %53 to <4 x i32>
%55 = bitcast i32* %51 to <4 x i32>*
store <4 x i32> %54, <4 x i32>* %55
%56 = getelementptr inbounds i8, i8* %2, i64 28
%57 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 28
%58 = bitcast i8* %56 to <4 x i8>*
%59 = load <4 x i8>, <4 x i8>* %58
%60 = zext <4 x i8> %59 to <4 x i32>
%61 = bitcast i32* %57 to <4 x i32>*
store <4 x i32> %60, <4 x i32>* %61
%62 = call i32 @curve25519_mainloop(i32* %15, i8* %8)
%63 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 32
%64 = call i32 @curve25519_recip(i32* %63, i32* %63)
%65 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 64
%66 = call i32 @curve25519_mult(i32* %65, i32* %15, i32* %63)
%67 = call i32 @curve25519_freeze(i32* %65)
%68 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 64
%69 = bitcast i32* %68 to <4 x i32>*
%70 = load <4 x i32>, <4 x i32>* %69
%71 = trunc <4 x i32> %70 to <4 x i8>
%72 = bitcast i8* %0 to <4 x i8>*
store <4 x i8> %71, <4 x i8>* %72
%73 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 68
%74 = bitcast i32* %73 to <4 x i32>*
%75 = load <4 x i32>, <4 x i32>* %74
%76 = trunc <4 x i32> %75 to <4 x i8>
%77 = getelementptr inbounds i8, i8* %0, i64 4
%78 = bitcast i8* %77 to <4 x i8>*
store <4 x i8> %76, <4 x i8>* %78
%79 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 72
%80 = bitcast i32* %79 to <4 x i32>*
%81 = load <4 x i32>, <4 x i32>* %80
%82 = trunc <4 x i32> %81 to <4 x i8>
%83 = getelementptr inbounds i8, i8* %0, i64 8
%84 = bitcast i8* %83 to <4 x i8>*
store <4 x i8> %82, <4 x i8>* %84
%85 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 76
%86 = bitcast i32* %85 to <4 x i32>*
%87 = load <4 x i32>, <4 x i32>* %86
%88 = trunc <4 x i32> %87 to <4 x i8>
%89 = getelementptr inbounds i8, i8* %0, i64 12
%90 = bitcast i8* %89 to <4 x i8>*
store <4 x i8> %88, <4 x i8>* %90
%91 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 80
%92 = bitcast i32* %91 to <4 x i32>*
%93 = load <4 x i32>, <4 x i32>* %92
%94 = trunc <4 x i32> %93 to <4 x i8>
%95 = getelementptr inbounds i8, i8* %0, i64 16
%96 = bitcast i8* %95 to <4 x i8>*
store <4 x i8> %94, <4 x i8>* %96
%97 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 84
%98 = bitcast i32* %97 to <4 x i32>*
%99 = load <4 x i32>, <4 x i32>* %98
%100 = trunc <4 x i32> %99 to <4 x i8>
%101 = getelementptr inbounds i8, i8* %0, i64 20
%102 = bitcast i8* %101 to <4 x i8>*
store <4 x i8> %100, <4 x i8>* %102
%103 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 88
%104 = bitcast i32* %103 to <4 x i32>*
%105 = load <4 x i32>, <4 x i32>* %104
%106 = trunc <4 x i32> %105 to <4 x i8>
%107 = getelementptr inbounds i8, i8* %0, i64 24
%108 = bitcast i8* %107 to <4 x i8>*
store <4 x i8> %106, <4 x i8>* %108
%109 = getelementptr inbounds [96 x i32], [96 x i32]* %4, i64 0, i64 92
%110 = bitcast i32* %109 to <4 x i32>*
%111 = load <4 x i32>, <4 x i32>* %110
%112 = trunc <4 x i32> %111 to <4 x i8>
%113 = getelementptr inbounds i8, i8* %0, i64 28
%114 = bitcast i8* %113 to <4 x i8>*
store <4 x i8> %112, <4 x i8>* %114
ret i32 0
}