_ZN6PKHashC2ERK7CPubKey:
   23|  3.62k|PKHash::PKHash(const CPubKey& pubkey) : BaseHash(pubkey.GetID()) {}
_Z7ToKeyIDRK6PKHash:
   30|  1.81k|{
   31|  1.81k|    return CKeyID{uint160{key_hash}};
   32|  1.81k|}
_Z23GetScriptForDestinationRKNSt3__17variantIJ14CNoDestination17PubKeyDestination6PKHash10ScriptHash19WitnessV0ScriptHash16WitnessV0KeyHash16WitnessV1Taproot11PayToAnchor14WitnessUnknownEEE:
  167|  5.43k|{
  168|  5.43k|    return std::visit(CScriptVisitor(), dest);
  169|  5.43k|}
_Z18IsValidDestinationRKNSt3__17variantIJ14CNoDestination17PubKeyDestination6PKHash10ScriptHash19WitnessV0ScriptHash16WitnessV0KeyHash16WitnessV1Taproot11PayToAnchor14WitnessUnknownEEE:
  171|  1.81k|bool IsValidDestination(const CTxDestination& dest) {
  172|  1.81k|    return std::visit(ValidDestinationVisitor(), dest);
  173|  1.81k|}
addresstype.cpp:_ZNK12_GLOBAL__N_114CScriptVisitorclERK6PKHash:
  122|  1.81k|    {
  123|  1.81k|        return CScript() << OP_DUP << OP_HASH160 << ToByteVector(keyID) << OP_EQUALVERIFY << OP_CHECKSIG;
  124|  1.81k|    }
addresstype.cpp:_ZNK12_GLOBAL__N_114CScriptVisitorclERK16WitnessV0KeyHash:
  132|  3.62k|    {
  133|  3.62k|        return CScript() << OP_0 << ToByteVector(id);
  134|  3.62k|    }
addresstype.cpp:_ZNK12_GLOBAL__N_123ValidDestinationVisitorclERK6PKHash:
  157|  1.81k|    bool operator()(const PKHash& dest) const { return true; }

_ZN6PKHashC2ERK7uint160:
   50|  1.81k|    explicit PKHash(const uint160& hash) : BaseHash(hash) {}
_ZN16WitnessV0KeyHashC2ERK7uint160:
   82|  3.62k|    explicit WitnessV0KeyHash(const uint160& hash) : BaseHash(hash) {}

_Z12EncodeBase58NSt3__14spanIKhLm18446744073709551615EEE:
   90|  3.62k|{
   91|       |    // Skip & count leading zeroes.
   92|  3.62k|    int zeroes = 0;
   93|  3.62k|    int length = 0;
   94|  3.62k|    while (input.size() > 0 && input[0] == 0) {
  ------------------
  |  Branch (94:12): [True: 3.62k, False: 0]
  |  Branch (94:32): [True: 0, False: 3.62k]
  ------------------
   95|      0|        input = input.subspan(1);
   96|      0|        zeroes++;
   97|      0|    }
   98|       |    // Allocate enough space in big-endian base58 representation.
   99|  3.62k|    int size = input.size() * 138 / 100 + 1; // log(256) / log(58), rounded up.
  100|  3.62k|    std::vector<unsigned char> b58(size);
  101|       |    // Process the bytes.
  102|   117k|    while (input.size() > 0) {
  ------------------
  |  Branch (102:12): [True: 114k, False: 3.62k]
  ------------------
  103|   114k|        int carry = input[0];
  104|   114k|        int i = 0;
  105|       |        // Apply "b58 = b58 * 256 + ch".
  106|  2.79M|        for (std::vector<unsigned char>::reverse_iterator it = b58.rbegin(); (carry != 0 || i < length) && (it != b58.rend()); it++, i++) {
  ------------------
  |  Branch (106:78): [True: 2.68M, False: 114k]
  |  Branch (106:79): [True: 2.66M, False: 137k]
  |  Branch (106:93): [True: 23.0k, False: 114k]
  |  Branch (106:108): [True: 2.68M, False: 0]
  ------------------
  107|  2.68M|            carry += 256 * (*it);
  108|  2.68M|            *it = carry % 58;
  109|  2.68M|            carry /= 58;
  110|  2.68M|        }
  111|       |
  112|   114k|        assert(carry == 0);
  ------------------
  |  Branch (112:9): [True: 114k, False: 0]
  ------------------
  113|   114k|        length = i;
  114|   114k|        input = input.subspan(1);
  115|   114k|    }
  116|       |    // Skip leading zeroes in base58 result.
  117|  3.62k|    std::vector<unsigned char>::iterator it = b58.begin() + (size - length);
  118|  3.62k|    while (it != b58.end() && *it == 0)
  ------------------
  |  Branch (118:12): [True: 3.62k, False: 0]
  |  Branch (118:12): [True: 0, False: 3.62k]
  |  Branch (118:31): [True: 0, False: 3.62k]
  ------------------
  119|      0|        it++;
  120|       |    // Translate the result into a string.
  121|  3.62k|    std::string str;
  122|  3.62k|    str.reserve(zeroes + (b58.end() - it));
  123|  3.62k|    str.assign(zeroes, '1');
  124|   159k|    while (it != b58.end())
  ------------------
  |  Branch (124:12): [True: 155k, False: 3.62k]
  ------------------
  125|   155k|        str += pszBase58[*(it++)];
  126|  3.62k|    return str;
  127|  3.62k|}
_Z17EncodeBase58CheckNSt3__14spanIKhLm18446744073709551615EEE:
  138|  3.62k|{
  139|       |    // add 4-byte hash check to the end
  140|  3.62k|    std::vector<unsigned char> vch(input.begin(), input.end());
  141|  3.62k|    uint256 hash = Hash(vch);
  142|  3.62k|    vch.insert(vch.end(), hash.data(), hash.data() + 4);
  143|  3.62k|    return EncodeBase58(vch);
  144|  3.62k|}
_Z17DecodeBase58CheckRKNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEERNS_6vectorIhNS3_IhEEEEi:
  164|  3.62k|{
  165|  3.62k|    if (ContainsNUL(str)) {
  ------------------
  |  Branch (165:9): [True: 0, False: 3.62k]
  ------------------
  166|      0|        return false;
  167|      0|    }
  168|  3.62k|    return DecodeBase58Check(str.c_str(), vchRet, max_ret);
  169|  3.62k|}
base58.cpp:_ZL12DecodeBase58PKcRNSt3__16vectorIhNS1_9allocatorIhEEEEi:
   41|  3.62k|{
   42|       |    // Skip leading spaces.
   43|  3.62k|    while (*psz && IsSpace(*psz))
  ------------------
  |  Branch (43:12): [True: 3.62k, False: 0]
  |  Branch (43:20): [True: 0, False: 3.62k]
  ------------------
   44|      0|        psz++;
   45|       |    // Skip and count leading '1's.
   46|  3.62k|    int zeroes = 0;
   47|  3.62k|    int length = 0;
   48|  3.62k|    while (*psz == '1') {
  ------------------
  |  Branch (48:12): [True: 0, False: 3.62k]
  ------------------
   49|      0|        zeroes++;
   50|      0|        if (zeroes > max_ret_len) return false;
  ------------------
  |  Branch (50:13): [True: 0, False: 0]
  ------------------
   51|      0|        psz++;
   52|      0|    }
   53|       |    // Allocate enough space in big-endian base256 representation.
   54|  3.62k|    int size = strlen(psz) * 733 /1000 + 1; // log(58) / log(256), rounded up.
   55|  3.62k|    std::vector<unsigned char> b256(size);
   56|       |    // Process the characters.
   57|  3.62k|    static_assert(std::size(mapBase58) == 256, "mapBase58.size() should be 256"); // guarantee not out of range
   58|   159k|    while (*psz && !IsSpace(*psz)) {
  ------------------
  |  Branch (58:12): [True: 155k, False: 3.62k]
  |  Branch (58:20): [True: 155k, False: 0]
  ------------------
   59|       |        // Decode base58 character
   60|   155k|        int carry = mapBase58[(uint8_t)*psz];
   61|   155k|        if (carry == -1)  // Invalid b58 character
  ------------------
  |  Branch (61:13): [True: 0, False: 155k]
  ------------------
   62|      0|            return false;
   63|   155k|        int i = 0;
   64|  2.83M|        for (std::vector<unsigned char>::reverse_iterator it = b256.rbegin(); (carry != 0 || i < length) && (it != b256.rend()); ++it, ++i) {
  ------------------
  |  Branch (64:79): [True: 2.68M, False: 155k]
  |  Branch (64:80): [True: 2.63M, False: 200k]
  |  Branch (64:94): [True: 44.9k, False: 155k]
  |  Branch (64:109): [True: 2.68M, False: 0]
  ------------------
   65|  2.68M|            carry += 58 * (*it);
   66|  2.68M|            *it = carry % 256;
   67|  2.68M|            carry /= 256;
   68|  2.68M|        }
   69|   155k|        assert(carry == 0);
  ------------------
  |  Branch (69:9): [True: 155k, False: 0]
  ------------------
   70|   155k|        length = i;
   71|   155k|        if (length + zeroes > max_ret_len) return false;
  ------------------
  |  Branch (71:13): [True: 0, False: 155k]
  ------------------
   72|   155k|        psz++;
   73|   155k|    }
   74|       |    // Skip trailing spaces.
   75|  3.62k|    while (IsSpace(*psz))
  ------------------
  |  Branch (75:12): [True: 0, False: 3.62k]
  ------------------
   76|      0|        psz++;
   77|  3.62k|    if (*psz != 0)
  ------------------
  |  Branch (77:9): [True: 0, False: 3.62k]
  ------------------
   78|      0|        return false;
   79|       |    // Skip leading zeroes in b256.
   80|  3.62k|    std::vector<unsigned char>::iterator it = b256.begin() + (size - length);
   81|       |    // Copy result into output vector.
   82|  3.62k|    vch.reserve(zeroes + (b256.end() - it));
   83|  3.62k|    vch.assign(zeroes, 0x00);
   84|   117k|    while (it != b256.end())
  ------------------
  |  Branch (84:12): [True: 114k, False: 3.62k]
  ------------------
   85|   114k|        vch.push_back(*(it++));
   86|  3.62k|    return true;
   87|  3.62k|}
base58.cpp:_ZL17DecodeBase58CheckPKcRNSt3__16vectorIhNS1_9allocatorIhEEEEi:
  147|  3.62k|{
  148|  3.62k|    if (!DecodeBase58(psz, vchRet, max_ret_len > std::numeric_limits<int>::max() - 4 ? std::numeric_limits<int>::max() : max_ret_len + 4) ||
  ------------------
  |  Branch (148:9): [True: 0, False: 3.62k]
  |  Branch (148:36): [True: 0, False: 3.62k]
  ------------------
  149|  3.62k|        (vchRet.size() < 4)) {
  ------------------
  |  Branch (149:9): [True: 0, False: 3.62k]
  ------------------
  150|      0|        vchRet.clear();
  151|      0|        return false;
  152|      0|    }
  153|       |    // re-calculate the checksum, ensure it matches the included 4-byte checksum
  154|  3.62k|    uint256 hash = Hash(std::span{vchRet}.first(vchRet.size() - 4));
  155|  3.62k|    if (memcmp(&hash, &vchRet[vchRet.size() - 4], 4) != 0) {
  ------------------
  |  Branch (155:9): [True: 0, False: 3.62k]
  ------------------
  156|      0|        vchRet.clear();
  157|      0|        return false;
  158|      0|    }
  159|  3.62k|    vchRet.resize(vchRet.size() - 4);
  160|  3.62k|    return true;
  161|  3.62k|}

_Z6Paramsv:
  128|  7.24k|const CChainParams &Params() {
  129|  7.24k|    assert(globalChainParams);
  ------------------
  |  Branch (129:5): [True: 7.24k, False: 0]
  ------------------
  130|  7.24k|    return *globalChainParams;
  131|  7.24k|}

_ZN11ArgsManagerD2Ev:
  130|      2|ArgsManager::~ArgsManager() = default;

_Z17internal_bswap_32j:
   54|  1.26M|{
   55|  1.26M|#ifdef bitcoin_builtin_bswap32
   56|  1.26M|    return bitcoin_builtin_bswap32(x);
  ------------------
  |  |   24|  1.26M|#      define bitcoin_builtin_bswap32(x) __builtin_bswap32(x)
  ------------------
   57|       |#else
   58|       |    return (((x & 0xff000000U) >> 24) | ((x & 0x00ff0000U) >>  8) |
   59|       |            ((x & 0x0000ff00U) <<  8) | ((x & 0x000000ffU) << 24));
   60|       |#endif
   61|  1.26M|}
_Z17internal_bswap_64m:
   64|   440k|{
   65|   440k|#ifdef bitcoin_builtin_bswap64
   66|   440k|    return bitcoin_builtin_bswap64(x);
  ------------------
  |  |   27|   440k|#      define bitcoin_builtin_bswap64(x) __builtin_bswap64(x)
  ------------------
   67|       |#else
   68|       |     return (((x & 0xff00000000000000ull) >> 56)
   69|       |          | ((x & 0x00ff000000000000ull) >> 40)
   70|       |          | ((x & 0x0000ff0000000000ull) >> 24)
   71|       |          | ((x & 0x000000ff00000000ull) >> 8)
   72|       |          | ((x & 0x00000000ff000000ull) << 8)
   73|       |          | ((x & 0x0000000000ff0000ull) << 24)
   74|       |          | ((x & 0x000000000000ff00ull) << 40)
   75|       |          | ((x & 0x00000000000000ffull) << 56));
   76|       |#endif
   77|   440k|}

_Z16be32toh_internalj:
   44|   840k|{
   45|   840k|    if constexpr (std::endian::native == std::endian::little) return internal_bswap_32(big_endian_32bits);
   46|       |        else return big_endian_32bits;
   47|   840k|}
_Z16htobe32_internalj:
   34|   423k|{
   35|   423k|    if constexpr (std::endian::native == std::endian::little) return internal_bswap_32(host_32bits);
   36|       |        else return host_32bits;
   37|   423k|}
_Z16htole64_internalm:
   59|  23.5k|{
   60|       |    if constexpr (std::endian::native == std::endian::big) return internal_bswap_64(host_64bits);
   61|  23.5k|        else return host_64bits;
   62|  23.5k|}
_Z16be64toh_internalm:
   64|   289k|{
   65|   289k|    if constexpr (std::endian::native == std::endian::little) return internal_bswap_64(big_endian_64bits);
   66|       |        else return big_endian_64bits;
   67|   289k|}
_Z16htobe64_internalm:
   54|   150k|{
   55|   150k|    if constexpr (std::endian::native == std::endian::little) return internal_bswap_64(host_64bits);
   56|       |        else return host_64bits;
   57|   150k|}
_Z16htole32_internalj:
   39|   157k|{
   40|       |    if constexpr (std::endian::native == std::endian::big) return internal_bswap_32(host_32bits);
   41|   157k|        else return host_32bits;
   42|   157k|}
_Z16le32toh_internalj:
   49|   391k|{
   50|       |    if constexpr (std::endian::native == std::endian::big) return internal_bswap_32(little_endian_32bits);
   51|   391k|        else return little_endian_32bits;
   52|   391k|}

_ZN15ChaCha20Aligned6SetKeyENSt3__14spanIKSt4byteLm18446744073709551615EEE:
   25|  1.88k|{
   26|  1.88k|    assert(key.size() == KEYLEN);
  ------------------
  |  Branch (26:5): [True: 1.88k, False: 0]
  ------------------
   27|  1.88k|    input[0] = ReadLE32(key.data() + 0);
   28|  1.88k|    input[1] = ReadLE32(key.data() + 4);
   29|  1.88k|    input[2] = ReadLE32(key.data() + 8);
   30|  1.88k|    input[3] = ReadLE32(key.data() + 12);
   31|  1.88k|    input[4] = ReadLE32(key.data() + 16);
   32|  1.88k|    input[5] = ReadLE32(key.data() + 20);
   33|  1.88k|    input[6] = ReadLE32(key.data() + 24);
   34|  1.88k|    input[7] = ReadLE32(key.data() + 28);
   35|  1.88k|    input[8] = 0;
   36|  1.88k|    input[9] = 0;
   37|  1.88k|    input[10] = 0;
   38|  1.88k|    input[11] = 0;
   39|  1.88k|}
_ZN15ChaCha20AlignedD2Ev:
   42|  1.89k|{
   43|  1.89k|    memory_cleanse(input, sizeof(input));
   44|  1.89k|}
_ZN15ChaCha20AlignedC2ENSt3__14spanIKSt4byteLm18446744073709551615EEE:
   47|  1.88k|{
   48|  1.88k|    SetKey(key);
   49|  1.88k|}
_ZN8ChaCha209KeystreamENSt3__14spanISt4byteLm18446744073709551615EEE:
  282|  3.62k|{
  283|  3.62k|    if (out.empty()) return;
  ------------------
  |  Branch (283:9): [True: 0, False: 3.62k]
  ------------------
  284|  3.62k|    if (m_bufleft) {
  ------------------
  |  Branch (284:9): [True: 1.81k, False: 1.81k]
  ------------------
  285|  1.81k|        unsigned reuse = std::min<size_t>(m_bufleft, out.size());
  286|  1.81k|        std::copy(m_buffer.end() - m_bufleft, m_buffer.end() - m_bufleft + reuse, out.begin());
  287|  1.81k|        m_bufleft -= reuse;
  288|  1.81k|        out = out.subspan(reuse);
  289|  1.81k|    }
  290|  3.62k|    if (out.size() >= m_aligned.BLOCKLEN) {
  ------------------
  |  Branch (290:9): [True: 0, False: 3.62k]
  ------------------
  291|      0|        size_t blocks = out.size() / m_aligned.BLOCKLEN;
  292|      0|        m_aligned.Keystream(out.first(blocks * m_aligned.BLOCKLEN));
  293|      0|        out = out.subspan(blocks * m_aligned.BLOCKLEN);
  294|      0|    }
  295|  3.62k|    if (!out.empty()) {
  ------------------
  |  Branch (295:9): [True: 1.81k, False: 1.81k]
  ------------------
  296|  1.81k|        m_aligned.Keystream(m_buffer);
  297|  1.81k|        std::copy(m_buffer.begin(), m_buffer.begin() + out.size(), out.begin());
  298|  1.81k|        m_bufleft = m_aligned.BLOCKLEN - out.size();
  299|  1.81k|    }
  300|  3.62k|}
_ZN8ChaCha20D2Ev:
  332|  1.89k|{
  333|  1.89k|    memory_cleanse(m_buffer.data(), m_buffer.size());
  334|  1.89k|}
_ZN15ChaCha20Aligned9KeystreamENSt3__14spanISt4byteLm18446744073709551615EEE:
   60|  1.81k|{
   61|  1.81k|    std::byte* c = output.data();
   62|  1.81k|    size_t blocks = output.size() / BLOCKLEN;
   63|  1.81k|    assert(blocks * BLOCKLEN == output.size());
  ------------------
  |  Branch (63:5): [True: 1.81k, False: 0]
  ------------------
   64|       |
   65|  1.81k|    uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
   66|  1.81k|    uint32_t j4, j5, j6, j7, j8, j9, j10, j11, j12, j13, j14, j15;
   67|       |
   68|  1.81k|    if (!blocks) return;
  ------------------
  |  Branch (68:9): [True: 0, False: 1.81k]
  ------------------
   69|       |
   70|  1.81k|    j4 = input[0];
   71|  1.81k|    j5 = input[1];
   72|  1.81k|    j6 = input[2];
   73|  1.81k|    j7 = input[3];
   74|  1.81k|    j8 = input[4];
   75|  1.81k|    j9 = input[5];
   76|  1.81k|    j10 = input[6];
   77|  1.81k|    j11 = input[7];
   78|  1.81k|    j12 = input[8];
   79|  1.81k|    j13 = input[9];
   80|  1.81k|    j14 = input[10];
   81|  1.81k|    j15 = input[11];
   82|       |
   83|  1.81k|    for (;;) {
   84|  1.81k|        x0 = 0x61707865;
   85|  1.81k|        x1 = 0x3320646e;
   86|  1.81k|        x2 = 0x79622d32;
   87|  1.81k|        x3 = 0x6b206574;
   88|  1.81k|        x4 = j4;
   89|  1.81k|        x5 = j5;
   90|  1.81k|        x6 = j6;
   91|  1.81k|        x7 = j7;
   92|  1.81k|        x8 = j8;
   93|  1.81k|        x9 = j9;
   94|  1.81k|        x10 = j10;
   95|  1.81k|        x11 = j11;
   96|  1.81k|        x12 = j12;
   97|  1.81k|        x13 = j13;
   98|  1.81k|        x14 = j14;
   99|  1.81k|        x15 = j15;
  100|       |
  101|       |        // The 20 inner ChaCha20 rounds are unrolled here for performance.
  102|  1.81k|        REPEAT10(
  ------------------
  |  |   22|  1.81k|#define REPEAT10(a) do { {a}; {a}; {a}; {a}; {a}; {a}; {a}; {a}; {a}; {a}; } while(0)
  |  |  ------------------
  |  |  |  Branch (22:84): [Folded, False: 1.81k]
  |  |  ------------------
  ------------------
  103|  1.81k|            QUARTERROUND( x0, x4, x8,x12);
  104|  1.81k|            QUARTERROUND( x1, x5, x9,x13);
  105|  1.81k|            QUARTERROUND( x2, x6,x10,x14);
  106|  1.81k|            QUARTERROUND( x3, x7,x11,x15);
  107|  1.81k|            QUARTERROUND( x0, x5,x10,x15);
  108|  1.81k|            QUARTERROUND( x1, x6,x11,x12);
  109|  1.81k|            QUARTERROUND( x2, x7, x8,x13);
  110|  1.81k|            QUARTERROUND( x3, x4, x9,x14);
  111|  1.81k|        );
  112|       |
  113|  1.81k|        x0 += 0x61707865;
  114|  1.81k|        x1 += 0x3320646e;
  115|  1.81k|        x2 += 0x79622d32;
  116|  1.81k|        x3 += 0x6b206574;
  117|  1.81k|        x4 += j4;
  118|  1.81k|        x5 += j5;
  119|  1.81k|        x6 += j6;
  120|  1.81k|        x7 += j7;
  121|  1.81k|        x8 += j8;
  122|  1.81k|        x9 += j9;
  123|  1.81k|        x10 += j10;
  124|  1.81k|        x11 += j11;
  125|  1.81k|        x12 += j12;
  126|  1.81k|        x13 += j13;
  127|  1.81k|        x14 += j14;
  128|  1.81k|        x15 += j15;
  129|       |
  130|  1.81k|        ++j12;
  131|  1.81k|        if (!j12) ++j13;
  ------------------
  |  Branch (131:13): [True: 0, False: 1.81k]
  ------------------
  132|       |
  133|  1.81k|        WriteLE32(c + 0, x0);
  134|  1.81k|        WriteLE32(c + 4, x1);
  135|  1.81k|        WriteLE32(c + 8, x2);
  136|  1.81k|        WriteLE32(c + 12, x3);
  137|  1.81k|        WriteLE32(c + 16, x4);
  138|  1.81k|        WriteLE32(c + 20, x5);
  139|  1.81k|        WriteLE32(c + 24, x6);
  140|  1.81k|        WriteLE32(c + 28, x7);
  141|  1.81k|        WriteLE32(c + 32, x8);
  142|  1.81k|        WriteLE32(c + 36, x9);
  143|  1.81k|        WriteLE32(c + 40, x10);
  144|  1.81k|        WriteLE32(c + 44, x11);
  145|  1.81k|        WriteLE32(c + 48, x12);
  146|  1.81k|        WriteLE32(c + 52, x13);
  147|  1.81k|        WriteLE32(c + 56, x14);
  148|  1.81k|        WriteLE32(c + 60, x15);
  149|       |
  150|  1.81k|        if (blocks == 1) {
  ------------------
  |  Branch (150:13): [True: 1.81k, False: 0]
  ------------------
  151|  1.81k|            input[8] = j12;
  152|  1.81k|            input[9] = j13;
  153|  1.81k|            return;
  154|  1.81k|        }
  155|      0|        blocks -= 1;
  156|      0|        c += BLOCKLEN;
  157|      0|    }
  158|  1.81k|}

_ZN8ChaCha20C2ENSt3__14spanIKSt4byteLm18446744073709551615EEE:
   90|  1.88k|    ChaCha20(std::span<const std::byte> key) noexcept : m_aligned(key) {}

_Z9WriteLE32ITk8ByteTypeSt4byteEvPT_j:
   51|  28.9k|{
   52|  28.9k|    uint32_t v = htole32_internal(x);
   53|  28.9k|    memcpy(ptr, &v, 4);
   54|  28.9k|}
_Z8ReadLE32ITk8ByteTypeSt4byteEjPKT_:
   28|  15.0k|{
   29|  15.0k|    uint32_t x;
   30|  15.0k|    memcpy(&x, ptr, 4);
   31|  15.0k|    return le32toh_internal(x);
   32|  15.0k|}
_Z8ReadLE32ITk8ByteTypehEjPKT_:
   28|   376k|{
   29|   376k|    uint32_t x;
   30|   376k|    memcpy(&x, ptr, 4);
   31|   376k|    return le32toh_internal(x);
   32|   376k|}
_Z9WriteLE32ITk8ByteTypehEvPT_j:
   51|   128k|{
   52|   128k|    uint32_t v = htole32_internal(x);
   53|   128k|    memcpy(ptr, &v, 4);
   54|   128k|}
_Z8ReadBE32ITk8ByteTypehEjPKT_:
   73|   840k|{
   74|   840k|    uint32_t x;
   75|   840k|    memcpy(&x, ptr, 4);
   76|   840k|    return be32toh_internal(x);
   77|   840k|}
_Z9WriteBE32ITk8ByteTypehEvPT_j:
   96|   423k|{
   97|   423k|    uint32_t v = htobe32_internal(x);
   98|   423k|    memcpy(ptr, &v, 4);
   99|   423k|}
_Z9WriteLE64ITk8ByteTypehEvPT_m:
   58|  23.5k|{
   59|  23.5k|    uint64_t v = htole64_internal(x);
   60|  23.5k|    memcpy(ptr, &v, 8);
   61|  23.5k|}
_Z8ReadBE64ITk8ByteTypehEmPKT_:
   81|   289k|{
   82|   289k|    uint64_t x;
   83|   289k|    memcpy(&x, ptr, 8);
   84|   289k|    return be64toh_internal(x);
   85|   289k|}
_Z9WriteBE64ITk8ByteTypehEvPT_m:
  103|   150k|{
  104|   150k|    uint64_t v = htobe64_internal(x);
  105|   150k|    memcpy(ptr, &v, 8);
  106|   150k|}

_Z6HexStrNSt3__14spanIKhLm18446744073709551615EEE:
   31|  3.69k|{
   32|  3.69k|    std::string rv(s.size() * 2, '\0');
   33|  3.69k|    static constexpr auto byte_to_hex = CreateByteToHexMap();
   34|  3.69k|    static_assert(sizeof(byte_to_hex) == 512);
   35|       |
   36|  3.69k|    char* it = rv.data();
   37|   120k|    for (uint8_t v : s) {
  ------------------
  |  Branch (37:20): [True: 120k, False: 3.69k]
  ------------------
   38|   120k|        std::memcpy(it, byte_to_hex[v].data(), 2);
   39|   120k|        it += 2;
   40|   120k|    }
   41|       |
   42|  3.69k|    assert(it == rv.data() + rv.size());
  ------------------
  |  Branch (42:5): [True: 3.69k, False: 0]
  ------------------
   43|  3.69k|    return rv;
   44|  3.69k|}
_Z8HexDigitc:
   65|   239k|{
   66|   239k|    return p_util_hexdigit[(unsigned char)c];
   67|   239k|}

_ZN12CHMAC_SHA512C2EPKhm:
   13|  3.62k|{
   14|  3.62k|    unsigned char rkey[128];
   15|  3.62k|    if (keylen <= 128) {
  ------------------
  |  Branch (15:9): [True: 3.62k, False: 0]
  ------------------
   16|  3.62k|        memcpy(rkey, key, keylen);
   17|  3.62k|        memset(rkey + keylen, 0, 128 - keylen);
   18|  3.62k|    } else {
   19|      0|        CSHA512().Write(key, keylen).Finalize(rkey);
   20|      0|        memset(rkey + 64, 0, 64);
   21|      0|    }
   22|       |
   23|   467k|    for (int n = 0; n < 128; n++)
  ------------------
  |  Branch (23:21): [True: 463k, False: 3.62k]
  ------------------
   24|   463k|        rkey[n] ^= 0x5c;
   25|  3.62k|    outer.Write(rkey, 128);
   26|       |
   27|   467k|    for (int n = 0; n < 128; n++)
  ------------------
  |  Branch (27:21): [True: 463k, False: 3.62k]
  ------------------
   28|   463k|        rkey[n] ^= 0x5c ^ 0x36;
   29|  3.62k|    inner.Write(rkey, 128);
   30|       |
   31|  3.62k|    memory_cleanse(rkey, sizeof(rkey));
   32|  3.62k|}
_ZN12CHMAC_SHA5128FinalizeEPh:
   35|  3.62k|{
   36|  3.62k|    unsigned char temp[64];
   37|  3.62k|    inner.Finalize(temp);
   38|  3.62k|    outer.Write(temp, 64).Finalize(hash);
   39|  3.62k|    memory_cleanse(temp, sizeof(temp));
   40|  3.62k|}

_ZN12CHMAC_SHA5125WriteEPKhm:
   24|  10.8k|    {
   25|  10.8k|        inner.Write(data, len);
   26|  10.8k|        return *this;
   27|  10.8k|    }

_ZN10CRIPEMD160C2Ev:
  243|  23.5k|{
  244|  23.5k|    ripemd160::Initialize(s);
  245|  23.5k|}
_ZN10CRIPEMD1605WriteEPKhm:
  248|  70.6k|{
  249|  70.6k|    const unsigned char* end = data + len;
  250|  70.6k|    size_t bufsize = bytes % 64;
  251|  70.6k|    if (bufsize && bufsize + len >= 64) {
  ------------------
  |  Branch (251:9): [True: 47.0k, False: 23.5k]
  |  Branch (251:20): [True: 23.5k, False: 23.5k]
  ------------------
  252|       |        // Fill the buffer, and process it.
  253|  23.5k|        memcpy(buf + bufsize, data, 64 - bufsize);
  254|  23.5k|        bytes += 64 - bufsize;
  255|  23.5k|        data += 64 - bufsize;
  256|  23.5k|        ripemd160::Transform(s, buf);
  257|  23.5k|        bufsize = 0;
  258|  23.5k|    }
  259|  70.6k|    while (end - data >= 64) {
  ------------------
  |  Branch (259:12): [True: 0, False: 70.6k]
  ------------------
  260|       |        // Process full chunks directly from the source.
  261|      0|        ripemd160::Transform(s, data);
  262|      0|        bytes += 64;
  263|      0|        data += 64;
  264|      0|    }
  265|  70.6k|    if (end > data) {
  ------------------
  |  Branch (265:9): [True: 47.0k, False: 23.5k]
  ------------------
  266|       |        // Fill the buffer with what remains.
  267|  47.0k|        memcpy(buf + bufsize, data, end - data);
  268|  47.0k|        bytes += end - data;
  269|  47.0k|    }
  270|  70.6k|    return *this;
  271|  70.6k|}
_ZN10CRIPEMD1608FinalizeEPh:
  274|  23.5k|{
  275|  23.5k|    static const unsigned char pad[64] = {0x80};
  276|  23.5k|    unsigned char sizedesc[8];
  277|  23.5k|    WriteLE64(sizedesc, bytes << 3);
  278|  23.5k|    Write(pad, 1 + ((119 - (bytes % 64)) % 64));
  279|  23.5k|    Write(sizedesc, 8);
  280|  23.5k|    WriteLE32(hash, s[0]);
  281|  23.5k|    WriteLE32(hash + 4, s[1]);
  282|  23.5k|    WriteLE32(hash + 8, s[2]);
  283|  23.5k|    WriteLE32(hash + 12, s[3]);
  284|  23.5k|    WriteLE32(hash + 16, s[4]);
  285|  23.5k|}
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd16010InitializeEPj:
   25|  23.5k|{
   26|  23.5k|    s[0] = 0x67452301ul;
   27|  23.5k|    s[1] = 0xEFCDAB89ul;
   28|  23.5k|    s[2] = 0x98BADCFEul;
   29|  23.5k|    s[3] = 0x10325476ul;
   30|  23.5k|    s[4] = 0xC3D2E1F0ul;
   31|  23.5k|}
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1609TransformEPjPKh:
   55|  23.5k|{
   56|  23.5k|    uint32_t a1 = s[0], b1 = s[1], c1 = s[2], d1 = s[3], e1 = s[4];
   57|  23.5k|    uint32_t a2 = a1, b2 = b1, c2 = c1, d2 = d1, e2 = e1;
   58|  23.5k|    uint32_t w0 = ReadLE32(chunk + 0), w1 = ReadLE32(chunk + 4), w2 = ReadLE32(chunk + 8), w3 = ReadLE32(chunk + 12);
   59|  23.5k|    uint32_t w4 = ReadLE32(chunk + 16), w5 = ReadLE32(chunk + 20), w6 = ReadLE32(chunk + 24), w7 = ReadLE32(chunk + 28);
   60|  23.5k|    uint32_t w8 = ReadLE32(chunk + 32), w9 = ReadLE32(chunk + 36), w10 = ReadLE32(chunk + 40), w11 = ReadLE32(chunk + 44);
   61|  23.5k|    uint32_t w12 = ReadLE32(chunk + 48), w13 = ReadLE32(chunk + 52), w14 = ReadLE32(chunk + 56), w15 = ReadLE32(chunk + 60);
   62|       |
   63|  23.5k|    R11(a1, b1, c1, d1, e1, w0, 11);
   64|  23.5k|    R12(a2, b2, c2, d2, e2, w5, 8);
   65|  23.5k|    R11(e1, a1, b1, c1, d1, w1, 14);
   66|  23.5k|    R12(e2, a2, b2, c2, d2, w14, 9);
   67|  23.5k|    R11(d1, e1, a1, b1, c1, w2, 15);
   68|  23.5k|    R12(d2, e2, a2, b2, c2, w7, 9);
   69|  23.5k|    R11(c1, d1, e1, a1, b1, w3, 12);
   70|  23.5k|    R12(c2, d2, e2, a2, b2, w0, 11);
   71|  23.5k|    R11(b1, c1, d1, e1, a1, w4, 5);
   72|  23.5k|    R12(b2, c2, d2, e2, a2, w9, 13);
   73|  23.5k|    R11(a1, b1, c1, d1, e1, w5, 8);
   74|  23.5k|    R12(a2, b2, c2, d2, e2, w2, 15);
   75|  23.5k|    R11(e1, a1, b1, c1, d1, w6, 7);
   76|  23.5k|    R12(e2, a2, b2, c2, d2, w11, 15);
   77|  23.5k|    R11(d1, e1, a1, b1, c1, w7, 9);
   78|  23.5k|    R12(d2, e2, a2, b2, c2, w4, 5);
   79|  23.5k|    R11(c1, d1, e1, a1, b1, w8, 11);
   80|  23.5k|    R12(c2, d2, e2, a2, b2, w13, 7);
   81|  23.5k|    R11(b1, c1, d1, e1, a1, w9, 13);
   82|  23.5k|    R12(b2, c2, d2, e2, a2, w6, 7);
   83|  23.5k|    R11(a1, b1, c1, d1, e1, w10, 14);
   84|  23.5k|    R12(a2, b2, c2, d2, e2, w15, 8);
   85|  23.5k|    R11(e1, a1, b1, c1, d1, w11, 15);
   86|  23.5k|    R12(e2, a2, b2, c2, d2, w8, 11);
   87|  23.5k|    R11(d1, e1, a1, b1, c1, w12, 6);
   88|  23.5k|    R12(d2, e2, a2, b2, c2, w1, 14);
   89|  23.5k|    R11(c1, d1, e1, a1, b1, w13, 7);
   90|  23.5k|    R12(c2, d2, e2, a2, b2, w10, 14);
   91|  23.5k|    R11(b1, c1, d1, e1, a1, w14, 9);
   92|  23.5k|    R12(b2, c2, d2, e2, a2, w3, 12);
   93|  23.5k|    R11(a1, b1, c1, d1, e1, w15, 8);
   94|  23.5k|    R12(a2, b2, c2, d2, e2, w12, 6);
   95|       |
   96|  23.5k|    R21(e1, a1, b1, c1, d1, w7, 7);
   97|  23.5k|    R22(e2, a2, b2, c2, d2, w6, 9);
   98|  23.5k|    R21(d1, e1, a1, b1, c1, w4, 6);
   99|  23.5k|    R22(d2, e2, a2, b2, c2, w11, 13);
  100|  23.5k|    R21(c1, d1, e1, a1, b1, w13, 8);
  101|  23.5k|    R22(c2, d2, e2, a2, b2, w3, 15);
  102|  23.5k|    R21(b1, c1, d1, e1, a1, w1, 13);
  103|  23.5k|    R22(b2, c2, d2, e2, a2, w7, 7);
  104|  23.5k|    R21(a1, b1, c1, d1, e1, w10, 11);
  105|  23.5k|    R22(a2, b2, c2, d2, e2, w0, 12);
  106|  23.5k|    R21(e1, a1, b1, c1, d1, w6, 9);
  107|  23.5k|    R22(e2, a2, b2, c2, d2, w13, 8);
  108|  23.5k|    R21(d1, e1, a1, b1, c1, w15, 7);
  109|  23.5k|    R22(d2, e2, a2, b2, c2, w5, 9);
  110|  23.5k|    R21(c1, d1, e1, a1, b1, w3, 15);
  111|  23.5k|    R22(c2, d2, e2, a2, b2, w10, 11);
  112|  23.5k|    R21(b1, c1, d1, e1, a1, w12, 7);
  113|  23.5k|    R22(b2, c2, d2, e2, a2, w14, 7);
  114|  23.5k|    R21(a1, b1, c1, d1, e1, w0, 12);
  115|  23.5k|    R22(a2, b2, c2, d2, e2, w15, 7);
  116|  23.5k|    R21(e1, a1, b1, c1, d1, w9, 15);
  117|  23.5k|    R22(e2, a2, b2, c2, d2, w8, 12);
  118|  23.5k|    R21(d1, e1, a1, b1, c1, w5, 9);
  119|  23.5k|    R22(d2, e2, a2, b2, c2, w12, 7);
  120|  23.5k|    R21(c1, d1, e1, a1, b1, w2, 11);
  121|  23.5k|    R22(c2, d2, e2, a2, b2, w4, 6);
  122|  23.5k|    R21(b1, c1, d1, e1, a1, w14, 7);
  123|  23.5k|    R22(b2, c2, d2, e2, a2, w9, 15);
  124|  23.5k|    R21(a1, b1, c1, d1, e1, w11, 13);
  125|  23.5k|    R22(a2, b2, c2, d2, e2, w1, 13);
  126|  23.5k|    R21(e1, a1, b1, c1, d1, w8, 12);
  127|  23.5k|    R22(e2, a2, b2, c2, d2, w2, 11);
  128|       |
  129|  23.5k|    R31(d1, e1, a1, b1, c1, w3, 11);
  130|  23.5k|    R32(d2, e2, a2, b2, c2, w15, 9);
  131|  23.5k|    R31(c1, d1, e1, a1, b1, w10, 13);
  132|  23.5k|    R32(c2, d2, e2, a2, b2, w5, 7);
  133|  23.5k|    R31(b1, c1, d1, e1, a1, w14, 6);
  134|  23.5k|    R32(b2, c2, d2, e2, a2, w1, 15);
  135|  23.5k|    R31(a1, b1, c1, d1, e1, w4, 7);
  136|  23.5k|    R32(a2, b2, c2, d2, e2, w3, 11);
  137|  23.5k|    R31(e1, a1, b1, c1, d1, w9, 14);
  138|  23.5k|    R32(e2, a2, b2, c2, d2, w7, 8);
  139|  23.5k|    R31(d1, e1, a1, b1, c1, w15, 9);
  140|  23.5k|    R32(d2, e2, a2, b2, c2, w14, 6);
  141|  23.5k|    R31(c1, d1, e1, a1, b1, w8, 13);
  142|  23.5k|    R32(c2, d2, e2, a2, b2, w6, 6);
  143|  23.5k|    R31(b1, c1, d1, e1, a1, w1, 15);
  144|  23.5k|    R32(b2, c2, d2, e2, a2, w9, 14);
  145|  23.5k|    R31(a1, b1, c1, d1, e1, w2, 14);
  146|  23.5k|    R32(a2, b2, c2, d2, e2, w11, 12);
  147|  23.5k|    R31(e1, a1, b1, c1, d1, w7, 8);
  148|  23.5k|    R32(e2, a2, b2, c2, d2, w8, 13);
  149|  23.5k|    R31(d1, e1, a1, b1, c1, w0, 13);
  150|  23.5k|    R32(d2, e2, a2, b2, c2, w12, 5);
  151|  23.5k|    R31(c1, d1, e1, a1, b1, w6, 6);
  152|  23.5k|    R32(c2, d2, e2, a2, b2, w2, 14);
  153|  23.5k|    R31(b1, c1, d1, e1, a1, w13, 5);
  154|  23.5k|    R32(b2, c2, d2, e2, a2, w10, 13);
  155|  23.5k|    R31(a1, b1, c1, d1, e1, w11, 12);
  156|  23.5k|    R32(a2, b2, c2, d2, e2, w0, 13);
  157|  23.5k|    R31(e1, a1, b1, c1, d1, w5, 7);
  158|  23.5k|    R32(e2, a2, b2, c2, d2, w4, 7);
  159|  23.5k|    R31(d1, e1, a1, b1, c1, w12, 5);
  160|  23.5k|    R32(d2, e2, a2, b2, c2, w13, 5);
  161|       |
  162|  23.5k|    R41(c1, d1, e1, a1, b1, w1, 11);
  163|  23.5k|    R42(c2, d2, e2, a2, b2, w8, 15);
  164|  23.5k|    R41(b1, c1, d1, e1, a1, w9, 12);
  165|  23.5k|    R42(b2, c2, d2, e2, a2, w6, 5);
  166|  23.5k|    R41(a1, b1, c1, d1, e1, w11, 14);
  167|  23.5k|    R42(a2, b2, c2, d2, e2, w4, 8);
  168|  23.5k|    R41(e1, a1, b1, c1, d1, w10, 15);
  169|  23.5k|    R42(e2, a2, b2, c2, d2, w1, 11);
  170|  23.5k|    R41(d1, e1, a1, b1, c1, w0, 14);
  171|  23.5k|    R42(d2, e2, a2, b2, c2, w3, 14);
  172|  23.5k|    R41(c1, d1, e1, a1, b1, w8, 15);
  173|  23.5k|    R42(c2, d2, e2, a2, b2, w11, 14);
  174|  23.5k|    R41(b1, c1, d1, e1, a1, w12, 9);
  175|  23.5k|    R42(b2, c2, d2, e2, a2, w15, 6);
  176|  23.5k|    R41(a1, b1, c1, d1, e1, w4, 8);
  177|  23.5k|    R42(a2, b2, c2, d2, e2, w0, 14);
  178|  23.5k|    R41(e1, a1, b1, c1, d1, w13, 9);
  179|  23.5k|    R42(e2, a2, b2, c2, d2, w5, 6);
  180|  23.5k|    R41(d1, e1, a1, b1, c1, w3, 14);
  181|  23.5k|    R42(d2, e2, a2, b2, c2, w12, 9);
  182|  23.5k|    R41(c1, d1, e1, a1, b1, w7, 5);
  183|  23.5k|    R42(c2, d2, e2, a2, b2, w2, 12);
  184|  23.5k|    R41(b1, c1, d1, e1, a1, w15, 6);
  185|  23.5k|    R42(b2, c2, d2, e2, a2, w13, 9);
  186|  23.5k|    R41(a1, b1, c1, d1, e1, w14, 8);
  187|  23.5k|    R42(a2, b2, c2, d2, e2, w9, 12);
  188|  23.5k|    R41(e1, a1, b1, c1, d1, w5, 6);
  189|  23.5k|    R42(e2, a2, b2, c2, d2, w7, 5);
  190|  23.5k|    R41(d1, e1, a1, b1, c1, w6, 5);
  191|  23.5k|    R42(d2, e2, a2, b2, c2, w10, 15);
  192|  23.5k|    R41(c1, d1, e1, a1, b1, w2, 12);
  193|  23.5k|    R42(c2, d2, e2, a2, b2, w14, 8);
  194|       |
  195|  23.5k|    R51(b1, c1, d1, e1, a1, w4, 9);
  196|  23.5k|    R52(b2, c2, d2, e2, a2, w12, 8);
  197|  23.5k|    R51(a1, b1, c1, d1, e1, w0, 15);
  198|  23.5k|    R52(a2, b2, c2, d2, e2, w15, 5);
  199|  23.5k|    R51(e1, a1, b1, c1, d1, w5, 5);
  200|  23.5k|    R52(e2, a2, b2, c2, d2, w10, 12);
  201|  23.5k|    R51(d1, e1, a1, b1, c1, w9, 11);
  202|  23.5k|    R52(d2, e2, a2, b2, c2, w4, 9);
  203|  23.5k|    R51(c1, d1, e1, a1, b1, w7, 6);
  204|  23.5k|    R52(c2, d2, e2, a2, b2, w1, 12);
  205|  23.5k|    R51(b1, c1, d1, e1, a1, w12, 8);
  206|  23.5k|    R52(b2, c2, d2, e2, a2, w5, 5);
  207|  23.5k|    R51(a1, b1, c1, d1, e1, w2, 13);
  208|  23.5k|    R52(a2, b2, c2, d2, e2, w8, 14);
  209|  23.5k|    R51(e1, a1, b1, c1, d1, w10, 12);
  210|  23.5k|    R52(e2, a2, b2, c2, d2, w7, 6);
  211|  23.5k|    R51(d1, e1, a1, b1, c1, w14, 5);
  212|  23.5k|    R52(d2, e2, a2, b2, c2, w6, 8);
  213|  23.5k|    R51(c1, d1, e1, a1, b1, w1, 12);
  214|  23.5k|    R52(c2, d2, e2, a2, b2, w2, 13);
  215|  23.5k|    R51(b1, c1, d1, e1, a1, w3, 13);
  216|  23.5k|    R52(b2, c2, d2, e2, a2, w13, 6);
  217|  23.5k|    R51(a1, b1, c1, d1, e1, w8, 14);
  218|  23.5k|    R52(a2, b2, c2, d2, e2, w14, 5);
  219|  23.5k|    R51(e1, a1, b1, c1, d1, w11, 11);
  220|  23.5k|    R52(e2, a2, b2, c2, d2, w0, 15);
  221|  23.5k|    R51(d1, e1, a1, b1, c1, w6, 8);
  222|  23.5k|    R52(d2, e2, a2, b2, c2, w3, 13);
  223|  23.5k|    R51(c1, d1, e1, a1, b1, w15, 5);
  224|  23.5k|    R52(c2, d2, e2, a2, b2, w9, 11);
  225|  23.5k|    R51(b1, c1, d1, e1, a1, w13, 6);
  226|  23.5k|    R52(b2, c2, d2, e2, a2, w11, 11);
  227|       |
  228|  23.5k|    uint32_t t = s[0];
  229|  23.5k|    s[0] = s[1] + c1 + d2;
  230|  23.5k|    s[1] = s[2] + d1 + e2;
  231|  23.5k|    s[2] = s[3] + e1 + a2;
  232|  23.5k|    s[3] = s[4] + a1 + b2;
  233|  23.5k|    s[4] = t + b1 + c2;
  234|  23.5k|}
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R11ERjjS1_jjji:
   41|   376k|void inline R11(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f1(b, c, d), x, 0, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1605RoundERjjS1_jjjjji:
   36|  3.76M|{
   37|  3.76M|    a = rol(a + f + x + k, r) + e;
   38|  3.76M|    c = rol(c, 10);
   39|  3.76M|}
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603rolEji:
   33|  7.53M|uint32_t inline rol(uint32_t x, int i) { return (x << i) | (x >> (32 - i)); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1602f1Ejjj:
   17|   753k|uint32_t inline f1(uint32_t x, uint32_t y, uint32_t z) { return x ^ y ^ z; }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R12ERjjS1_jjji:
   47|   376k|void inline R12(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f5(b, c, d), x, 0x50A28BE6ul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1602f5Ejjj:
   21|   753k|uint32_t inline f5(uint32_t x, uint32_t y, uint32_t z) { return x ^ (y | ~z); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R21ERjjS1_jjji:
   42|   376k|void inline R21(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f2(b, c, d), x, 0x5A827999ul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1602f2Ejjj:
   18|   753k|uint32_t inline f2(uint32_t x, uint32_t y, uint32_t z) { return (x & y) | (~x & z); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R22ERjjS1_jjji:
   48|   376k|void inline R22(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f4(b, c, d), x, 0x5C4DD124ul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1602f4Ejjj:
   20|   753k|uint32_t inline f4(uint32_t x, uint32_t y, uint32_t z) { return (x & z) | (y & ~z); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R31ERjjS1_jjji:
   43|   376k|void inline R31(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f3(b, c, d), x, 0x6ED9EBA1ul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1602f3Ejjj:
   19|   753k|uint32_t inline f3(uint32_t x, uint32_t y, uint32_t z) { return (x | ~y) ^ z; }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R32ERjjS1_jjji:
   49|   376k|void inline R32(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f3(b, c, d), x, 0x6D703EF3ul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R41ERjjS1_jjji:
   44|   376k|void inline R41(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f4(b, c, d), x, 0x8F1BBCDCul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R42ERjjS1_jjji:
   50|   376k|void inline R42(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f2(b, c, d), x, 0x7A6D76E9ul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R51ERjjS1_jjji:
   45|   376k|void inline R51(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f5(b, c, d), x, 0xA953FD4Eul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R52ERjjS1_jjji:
   51|   376k|void inline R52(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f1(b, c, d), x, 0, r); }

_ZN7CSHA256C2Ev:
  695|  38.0k|{
  696|  38.0k|    sha256::Initialize(s);
  697|  38.0k|}
_ZN7CSHA2565WriteEPKhm:
  700|   161k|{
  701|   161k|    const unsigned char* end = data + len;
  702|   161k|    size_t bufsize = bytes % 64;
  703|   161k|    if (bufsize && bufsize + len >= 64) {
  ------------------
  |  Branch (703:9): [True: 108k, False: 52.5k]
  |  Branch (703:20): [True: 52.5k, False: 56.1k]
  ------------------
  704|       |        // Fill the buffer, and process it.
  705|  52.5k|        memcpy(buf + bufsize, data, 64 - bufsize);
  706|  52.5k|        bytes += 64 - bufsize;
  707|  52.5k|        data += 64 - bufsize;
  708|  52.5k|        Transform(s, buf, 1);
  709|  52.5k|        bufsize = 0;
  710|  52.5k|    }
  711|   161k|    if (end - data >= 64) {
  ------------------
  |  Branch (711:9): [True: 0, False: 161k]
  ------------------
  712|      0|        size_t blocks = (end - data) / 64;
  713|      0|        Transform(s, data, blocks);
  714|      0|        data += 64 * blocks;
  715|      0|        bytes += 64 * blocks;
  716|      0|    }
  717|   161k|    if (end > data) {
  ------------------
  |  Branch (717:9): [True: 108k, False: 52.5k]
  ------------------
  718|       |        // Fill the buffer with what remains.
  719|   108k|        memcpy(buf + bufsize, data, end - data);
  720|   108k|        bytes += end - data;
  721|   108k|    }
  722|   161k|    return *this;
  723|   161k|}
_ZN7CSHA2568FinalizeEPh:
  726|  52.5k|{
  727|  52.5k|    static const unsigned char pad[64] = {0x80};
  728|  52.5k|    unsigned char sizedesc[8];
  729|  52.5k|    WriteBE64(sizedesc, bytes << 3);
  730|  52.5k|    Write(pad, 1 + ((119 - (bytes % 64)) % 64));
  731|  52.5k|    Write(sizedesc, 8);
  732|  52.5k|    WriteBE32(hash, s[0]);
  733|  52.5k|    WriteBE32(hash + 4, s[1]);
  734|  52.5k|    WriteBE32(hash + 8, s[2]);
  735|  52.5k|    WriteBE32(hash + 12, s[3]);
  736|  52.5k|    WriteBE32(hash + 16, s[4]);
  737|  52.5k|    WriteBE32(hash + 20, s[5]);
  738|  52.5k|    WriteBE32(hash + 24, s[6]);
  739|  52.5k|    WriteBE32(hash + 28, s[7]);
  740|  52.5k|}
_ZN7CSHA2565ResetEv:
  743|  14.4k|{
  744|  14.4k|    bytes = 0;
  745|  14.4k|    sha256::Initialize(s);
  746|  14.4k|    return *this;
  747|  14.4k|}
sha256.cpp:_ZN12_GLOBAL__N_16sha2569TransformEPjPKhm:
  100|  52.5k|{
  101|   105k|    while (blocks--) {
  ------------------
  |  Branch (101:12): [True: 52.5k, False: 52.5k]
  ------------------
  102|  52.5k|        uint32_t a = s[0], b = s[1], c = s[2], d = s[3], e = s[4], f = s[5], g = s[6], h = s[7];
  103|  52.5k|        uint32_t w0, w1, w2, w3, w4, w5, w6, w7, w8, w9, w10, w11, w12, w13, w14, w15;
  104|       |
  105|  52.5k|        Round(a, b, c, d, e, f, g, h, 0x428a2f98 + (w0 = ReadBE32(chunk + 0)));
  106|  52.5k|        Round(h, a, b, c, d, e, f, g, 0x71374491 + (w1 = ReadBE32(chunk + 4)));
  107|  52.5k|        Round(g, h, a, b, c, d, e, f, 0xb5c0fbcf + (w2 = ReadBE32(chunk + 8)));
  108|  52.5k|        Round(f, g, h, a, b, c, d, e, 0xe9b5dba5 + (w3 = ReadBE32(chunk + 12)));
  109|  52.5k|        Round(e, f, g, h, a, b, c, d, 0x3956c25b + (w4 = ReadBE32(chunk + 16)));
  110|  52.5k|        Round(d, e, f, g, h, a, b, c, 0x59f111f1 + (w5 = ReadBE32(chunk + 20)));
  111|  52.5k|        Round(c, d, e, f, g, h, a, b, 0x923f82a4 + (w6 = ReadBE32(chunk + 24)));
  112|  52.5k|        Round(b, c, d, e, f, g, h, a, 0xab1c5ed5 + (w7 = ReadBE32(chunk + 28)));
  113|  52.5k|        Round(a, b, c, d, e, f, g, h, 0xd807aa98 + (w8 = ReadBE32(chunk + 32)));
  114|  52.5k|        Round(h, a, b, c, d, e, f, g, 0x12835b01 + (w9 = ReadBE32(chunk + 36)));
  115|  52.5k|        Round(g, h, a, b, c, d, e, f, 0x243185be + (w10 = ReadBE32(chunk + 40)));
  116|  52.5k|        Round(f, g, h, a, b, c, d, e, 0x550c7dc3 + (w11 = ReadBE32(chunk + 44)));
  117|  52.5k|        Round(e, f, g, h, a, b, c, d, 0x72be5d74 + (w12 = ReadBE32(chunk + 48)));
  118|  52.5k|        Round(d, e, f, g, h, a, b, c, 0x80deb1fe + (w13 = ReadBE32(chunk + 52)));
  119|  52.5k|        Round(c, d, e, f, g, h, a, b, 0x9bdc06a7 + (w14 = ReadBE32(chunk + 56)));
  120|  52.5k|        Round(b, c, d, e, f, g, h, a, 0xc19bf174 + (w15 = ReadBE32(chunk + 60)));
  121|       |
  122|  52.5k|        Round(a, b, c, d, e, f, g, h, 0xe49b69c1 + (w0 += sigma1(w14) + w9 + sigma0(w1)));
  123|  52.5k|        Round(h, a, b, c, d, e, f, g, 0xefbe4786 + (w1 += sigma1(w15) + w10 + sigma0(w2)));
  124|  52.5k|        Round(g, h, a, b, c, d, e, f, 0x0fc19dc6 + (w2 += sigma1(w0) + w11 + sigma0(w3)));
  125|  52.5k|        Round(f, g, h, a, b, c, d, e, 0x240ca1cc + (w3 += sigma1(w1) + w12 + sigma0(w4)));
  126|  52.5k|        Round(e, f, g, h, a, b, c, d, 0x2de92c6f + (w4 += sigma1(w2) + w13 + sigma0(w5)));
  127|  52.5k|        Round(d, e, f, g, h, a, b, c, 0x4a7484aa + (w5 += sigma1(w3) + w14 + sigma0(w6)));
  128|  52.5k|        Round(c, d, e, f, g, h, a, b, 0x5cb0a9dc + (w6 += sigma1(w4) + w15 + sigma0(w7)));
  129|  52.5k|        Round(b, c, d, e, f, g, h, a, 0x76f988da + (w7 += sigma1(w5) + w0 + sigma0(w8)));
  130|  52.5k|        Round(a, b, c, d, e, f, g, h, 0x983e5152 + (w8 += sigma1(w6) + w1 + sigma0(w9)));
  131|  52.5k|        Round(h, a, b, c, d, e, f, g, 0xa831c66d + (w9 += sigma1(w7) + w2 + sigma0(w10)));
  132|  52.5k|        Round(g, h, a, b, c, d, e, f, 0xb00327c8 + (w10 += sigma1(w8) + w3 + sigma0(w11)));
  133|  52.5k|        Round(f, g, h, a, b, c, d, e, 0xbf597fc7 + (w11 += sigma1(w9) + w4 + sigma0(w12)));
  134|  52.5k|        Round(e, f, g, h, a, b, c, d, 0xc6e00bf3 + (w12 += sigma1(w10) + w5 + sigma0(w13)));
  135|  52.5k|        Round(d, e, f, g, h, a, b, c, 0xd5a79147 + (w13 += sigma1(w11) + w6 + sigma0(w14)));
  136|  52.5k|        Round(c, d, e, f, g, h, a, b, 0x06ca6351 + (w14 += sigma1(w12) + w7 + sigma0(w15)));
  137|  52.5k|        Round(b, c, d, e, f, g, h, a, 0x14292967 + (w15 += sigma1(w13) + w8 + sigma0(w0)));
  138|       |
  139|  52.5k|        Round(a, b, c, d, e, f, g, h, 0x27b70a85 + (w0 += sigma1(w14) + w9 + sigma0(w1)));
  140|  52.5k|        Round(h, a, b, c, d, e, f, g, 0x2e1b2138 + (w1 += sigma1(w15) + w10 + sigma0(w2)));
  141|  52.5k|        Round(g, h, a, b, c, d, e, f, 0x4d2c6dfc + (w2 += sigma1(w0) + w11 + sigma0(w3)));
  142|  52.5k|        Round(f, g, h, a, b, c, d, e, 0x53380d13 + (w3 += sigma1(w1) + w12 + sigma0(w4)));
  143|  52.5k|        Round(e, f, g, h, a, b, c, d, 0x650a7354 + (w4 += sigma1(w2) + w13 + sigma0(w5)));
  144|  52.5k|        Round(d, e, f, g, h, a, b, c, 0x766a0abb + (w5 += sigma1(w3) + w14 + sigma0(w6)));
  145|  52.5k|        Round(c, d, e, f, g, h, a, b, 0x81c2c92e + (w6 += sigma1(w4) + w15 + sigma0(w7)));
  146|  52.5k|        Round(b, c, d, e, f, g, h, a, 0x92722c85 + (w7 += sigma1(w5) + w0 + sigma0(w8)));
  147|  52.5k|        Round(a, b, c, d, e, f, g, h, 0xa2bfe8a1 + (w8 += sigma1(w6) + w1 + sigma0(w9)));
  148|  52.5k|        Round(h, a, b, c, d, e, f, g, 0xa81a664b + (w9 += sigma1(w7) + w2 + sigma0(w10)));
  149|  52.5k|        Round(g, h, a, b, c, d, e, f, 0xc24b8b70 + (w10 += sigma1(w8) + w3 + sigma0(w11)));
  150|  52.5k|        Round(f, g, h, a, b, c, d, e, 0xc76c51a3 + (w11 += sigma1(w9) + w4 + sigma0(w12)));
  151|  52.5k|        Round(e, f, g, h, a, b, c, d, 0xd192e819 + (w12 += sigma1(w10) + w5 + sigma0(w13)));
  152|  52.5k|        Round(d, e, f, g, h, a, b, c, 0xd6990624 + (w13 += sigma1(w11) + w6 + sigma0(w14)));
  153|  52.5k|        Round(c, d, e, f, g, h, a, b, 0xf40e3585 + (w14 += sigma1(w12) + w7 + sigma0(w15)));
  154|  52.5k|        Round(b, c, d, e, f, g, h, a, 0x106aa070 + (w15 += sigma1(w13) + w8 + sigma0(w0)));
  155|       |
  156|  52.5k|        Round(a, b, c, d, e, f, g, h, 0x19a4c116 + (w0 += sigma1(w14) + w9 + sigma0(w1)));
  157|  52.5k|        Round(h, a, b, c, d, e, f, g, 0x1e376c08 + (w1 += sigma1(w15) + w10 + sigma0(w2)));
  158|  52.5k|        Round(g, h, a, b, c, d, e, f, 0x2748774c + (w2 += sigma1(w0) + w11 + sigma0(w3)));
  159|  52.5k|        Round(f, g, h, a, b, c, d, e, 0x34b0bcb5 + (w3 += sigma1(w1) + w12 + sigma0(w4)));
  160|  52.5k|        Round(e, f, g, h, a, b, c, d, 0x391c0cb3 + (w4 += sigma1(w2) + w13 + sigma0(w5)));
  161|  52.5k|        Round(d, e, f, g, h, a, b, c, 0x4ed8aa4a + (w5 += sigma1(w3) + w14 + sigma0(w6)));
  162|  52.5k|        Round(c, d, e, f, g, h, a, b, 0x5b9cca4f + (w6 += sigma1(w4) + w15 + sigma0(w7)));
  163|  52.5k|        Round(b, c, d, e, f, g, h, a, 0x682e6ff3 + (w7 += sigma1(w5) + w0 + sigma0(w8)));
  164|  52.5k|        Round(a, b, c, d, e, f, g, h, 0x748f82ee + (w8 += sigma1(w6) + w1 + sigma0(w9)));
  165|  52.5k|        Round(h, a, b, c, d, e, f, g, 0x78a5636f + (w9 += sigma1(w7) + w2 + sigma0(w10)));
  166|  52.5k|        Round(g, h, a, b, c, d, e, f, 0x84c87814 + (w10 += sigma1(w8) + w3 + sigma0(w11)));
  167|  52.5k|        Round(f, g, h, a, b, c, d, e, 0x8cc70208 + (w11 += sigma1(w9) + w4 + sigma0(w12)));
  168|  52.5k|        Round(e, f, g, h, a, b, c, d, 0x90befffa + (w12 += sigma1(w10) + w5 + sigma0(w13)));
  169|  52.5k|        Round(d, e, f, g, h, a, b, c, 0xa4506ceb + (w13 += sigma1(w11) + w6 + sigma0(w14)));
  170|  52.5k|        Round(c, d, e, f, g, h, a, b, 0xbef9a3f7 + (w14 + sigma1(w12) + w7 + sigma0(w15)));
  171|  52.5k|        Round(b, c, d, e, f, g, h, a, 0xc67178f2 + (w15 + sigma1(w13) + w8 + sigma0(w0)));
  172|       |
  173|  52.5k|        s[0] += a;
  174|  52.5k|        s[1] += b;
  175|  52.5k|        s[2] += c;
  176|  52.5k|        s[3] += d;
  177|  52.5k|        s[4] += e;
  178|  52.5k|        s[5] += f;
  179|  52.5k|        s[6] += g;
  180|  52.5k|        s[7] += h;
  181|  52.5k|        chunk += 64;
  182|  52.5k|    }
  183|  52.5k|}
sha256.cpp:_ZN12_GLOBAL__N_16sha2565RoundEjjjRjjjjS1_j:
   78|  3.36M|{
   79|  3.36M|    uint32_t t1 = h + Sigma1(e) + Ch(e, f, g) + k;
   80|  3.36M|    uint32_t t2 = Sigma0(a) + Maj(a, b, c);
   81|  3.36M|    d += t1;
   82|  3.36M|    h = t1 + t2;
   83|  3.36M|}
sha256.cpp:_ZN12_GLOBAL__N_16sha2566Sigma1Ej:
   72|  3.36M|uint32_t inline Sigma1(uint32_t x) { return (x >> 6 | x << 26) ^ (x >> 11 | x << 21) ^ (x >> 25 | x << 7); }
sha256.cpp:_ZN12_GLOBAL__N_16sha2562ChEjjj:
   69|  3.36M|uint32_t inline Ch(uint32_t x, uint32_t y, uint32_t z) { return z ^ (x & (y ^ z)); }
sha256.cpp:_ZN12_GLOBAL__N_16sha2566Sigma0Ej:
   71|  3.36M|uint32_t inline Sigma0(uint32_t x) { return (x >> 2 | x << 30) ^ (x >> 13 | x << 19) ^ (x >> 22 | x << 10); }
sha256.cpp:_ZN12_GLOBAL__N_16sha2563MajEjjj:
   70|  3.36M|uint32_t inline Maj(uint32_t x, uint32_t y, uint32_t z) { return (x & y) | (z & (x | y)); }
sha256.cpp:_ZN12_GLOBAL__N_16sha2566sigma1Ej:
   74|  2.52M|uint32_t inline sigma1(uint32_t x) { return (x >> 17 | x << 15) ^ (x >> 19 | x << 13) ^ (x >> 10); }
sha256.cpp:_ZN12_GLOBAL__N_16sha2566sigma0Ej:
   73|  2.52M|uint32_t inline sigma0(uint32_t x) { return (x >> 7 | x << 25) ^ (x >> 18 | x << 14) ^ (x >> 3); }
sha256.cpp:_ZN12_GLOBAL__N_16sha25610InitializeEPj:
   87|  52.5k|{
   88|  52.5k|    s[0] = 0x6a09e667ul;
   89|  52.5k|    s[1] = 0xbb67ae85ul;
   90|  52.5k|    s[2] = 0x3c6ef372ul;
   91|  52.5k|    s[3] = 0xa54ff53aul;
   92|  52.5k|    s[4] = 0x510e527ful;
   93|  52.5k|    s[5] = 0x9b05688cul;
   94|  52.5k|    s[6] = 0x1f83d9abul;
   95|  52.5k|    s[7] = 0x5be0cd19ul;
   96|  52.5k|}

_ZN7CSHA512C2Ev:
  155|  10.8k|{
  156|  10.8k|    sha512::Initialize(s);
  157|  10.8k|}
_ZN7CSHA5125WriteEPKhm:
  160|  61.5k|{
  161|  61.5k|    const unsigned char* end = data + len;
  162|  61.5k|    size_t bufsize = bytes % 128;
  163|  61.5k|    if (bufsize && bufsize + len >= 128) {
  ------------------
  |  Branch (163:9): [True: 43.4k, False: 18.1k]
  |  Branch (163:20): [True: 10.8k, False: 32.5k]
  ------------------
  164|       |        // Fill the buffer, and process it.
  165|  10.8k|        memcpy(buf + bufsize, data, 128 - bufsize);
  166|  10.8k|        bytes += 128 - bufsize;
  167|  10.8k|        data += 128 - bufsize;
  168|  10.8k|        sha512::Transform(s, buf);
  169|  10.8k|        bufsize = 0;
  170|  10.8k|    }
  171|  68.8k|    while (end - data >= 128) {
  ------------------
  |  Branch (171:12): [True: 7.24k, False: 61.5k]
  ------------------
  172|       |        // Process full chunks directly from the source.
  173|  7.24k|        sha512::Transform(s, data);
  174|  7.24k|        data += 128;
  175|  7.24k|        bytes += 128;
  176|  7.24k|    }
  177|  61.5k|    if (end > data) {
  ------------------
  |  Branch (177:9): [True: 43.4k, False: 18.1k]
  ------------------
  178|       |        // Fill the buffer with what remains.
  179|  43.4k|        memcpy(buf + bufsize, data, end - data);
  180|  43.4k|        bytes += end - data;
  181|  43.4k|    }
  182|  61.5k|    return *this;
  183|  61.5k|}
_ZN7CSHA5128FinalizeEPh:
  186|  10.8k|{
  187|  10.8k|    static const unsigned char pad[128] = {0x80};
  188|  10.8k|    unsigned char sizedesc[16] = {0x00};
  189|  10.8k|    WriteBE64(sizedesc + 8, bytes << 3);
  190|  10.8k|    Write(pad, 1 + ((239 - (bytes % 128)) % 128));
  191|  10.8k|    Write(sizedesc, 16);
  192|  10.8k|    WriteBE64(hash, s[0]);
  193|  10.8k|    WriteBE64(hash + 8, s[1]);
  194|  10.8k|    WriteBE64(hash + 16, s[2]);
  195|  10.8k|    WriteBE64(hash + 24, s[3]);
  196|  10.8k|    WriteBE64(hash + 32, s[4]);
  197|  10.8k|    WriteBE64(hash + 40, s[5]);
  198|  10.8k|    WriteBE64(hash + 48, s[6]);
  199|  10.8k|    WriteBE64(hash + 56, s[7]);
  200|  10.8k|}
_ZN7CSHA5125ResetEv:
  203|  3.62k|{
  204|  3.62k|    bytes = 0;
  205|  3.62k|    sha512::Initialize(s);
  206|  3.62k|    return *this;
  207|  3.62k|}
sha512.cpp:_ZN12_GLOBAL__N_16sha51210InitializeEPm:
   35|  14.4k|{
   36|  14.4k|    s[0] = 0x6a09e667f3bcc908ull;
   37|  14.4k|    s[1] = 0xbb67ae8584caa73bull;
   38|  14.4k|    s[2] = 0x3c6ef372fe94f82bull;
   39|  14.4k|    s[3] = 0xa54ff53a5f1d36f1ull;
   40|  14.4k|    s[4] = 0x510e527fade682d1ull;
   41|  14.4k|    s[5] = 0x9b05688c2b3e6c1full;
   42|  14.4k|    s[6] = 0x1f83d9abfb41bd6bull;
   43|  14.4k|    s[7] = 0x5be0cd19137e2179ull;
   44|  14.4k|}
sha512.cpp:_ZN12_GLOBAL__N_16sha5129TransformEPmPKh:
   48|  18.1k|{
   49|  18.1k|    uint64_t a = s[0], b = s[1], c = s[2], d = s[3], e = s[4], f = s[5], g = s[6], h = s[7];
   50|  18.1k|    uint64_t w0, w1, w2, w3, w4, w5, w6, w7, w8, w9, w10, w11, w12, w13, w14, w15;
   51|       |
   52|  18.1k|    Round(a, b, c, d, e, f, g, h, 0x428a2f98d728ae22ull, w0 = ReadBE64(chunk + 0));
   53|  18.1k|    Round(h, a, b, c, d, e, f, g, 0x7137449123ef65cdull, w1 = ReadBE64(chunk + 8));
   54|  18.1k|    Round(g, h, a, b, c, d, e, f, 0xb5c0fbcfec4d3b2full, w2 = ReadBE64(chunk + 16));
   55|  18.1k|    Round(f, g, h, a, b, c, d, e, 0xe9b5dba58189dbbcull, w3 = ReadBE64(chunk + 24));
   56|  18.1k|    Round(e, f, g, h, a, b, c, d, 0x3956c25bf348b538ull, w4 = ReadBE64(chunk + 32));
   57|  18.1k|    Round(d, e, f, g, h, a, b, c, 0x59f111f1b605d019ull, w5 = ReadBE64(chunk + 40));
   58|  18.1k|    Round(c, d, e, f, g, h, a, b, 0x923f82a4af194f9bull, w6 = ReadBE64(chunk + 48));
   59|  18.1k|    Round(b, c, d, e, f, g, h, a, 0xab1c5ed5da6d8118ull, w7 = ReadBE64(chunk + 56));
   60|  18.1k|    Round(a, b, c, d, e, f, g, h, 0xd807aa98a3030242ull, w8 = ReadBE64(chunk + 64));
   61|  18.1k|    Round(h, a, b, c, d, e, f, g, 0x12835b0145706fbeull, w9 = ReadBE64(chunk + 72));
   62|  18.1k|    Round(g, h, a, b, c, d, e, f, 0x243185be4ee4b28cull, w10 = ReadBE64(chunk + 80));
   63|  18.1k|    Round(f, g, h, a, b, c, d, e, 0x550c7dc3d5ffb4e2ull, w11 = ReadBE64(chunk + 88));
   64|  18.1k|    Round(e, f, g, h, a, b, c, d, 0x72be5d74f27b896full, w12 = ReadBE64(chunk + 96));
   65|  18.1k|    Round(d, e, f, g, h, a, b, c, 0x80deb1fe3b1696b1ull, w13 = ReadBE64(chunk + 104));
   66|  18.1k|    Round(c, d, e, f, g, h, a, b, 0x9bdc06a725c71235ull, w14 = ReadBE64(chunk + 112));
   67|  18.1k|    Round(b, c, d, e, f, g, h, a, 0xc19bf174cf692694ull, w15 = ReadBE64(chunk + 120));
   68|       |
   69|  18.1k|    Round(a, b, c, d, e, f, g, h, 0xe49b69c19ef14ad2ull, w0 += sigma1(w14) + w9 + sigma0(w1));
   70|  18.1k|    Round(h, a, b, c, d, e, f, g, 0xefbe4786384f25e3ull, w1 += sigma1(w15) + w10 + sigma0(w2));
   71|  18.1k|    Round(g, h, a, b, c, d, e, f, 0x0fc19dc68b8cd5b5ull, w2 += sigma1(w0) + w11 + sigma0(w3));
   72|  18.1k|    Round(f, g, h, a, b, c, d, e, 0x240ca1cc77ac9c65ull, w3 += sigma1(w1) + w12 + sigma0(w4));
   73|  18.1k|    Round(e, f, g, h, a, b, c, d, 0x2de92c6f592b0275ull, w4 += sigma1(w2) + w13 + sigma0(w5));
   74|  18.1k|    Round(d, e, f, g, h, a, b, c, 0x4a7484aa6ea6e483ull, w5 += sigma1(w3) + w14 + sigma0(w6));
   75|  18.1k|    Round(c, d, e, f, g, h, a, b, 0x5cb0a9dcbd41fbd4ull, w6 += sigma1(w4) + w15 + sigma0(w7));
   76|  18.1k|    Round(b, c, d, e, f, g, h, a, 0x76f988da831153b5ull, w7 += sigma1(w5) + w0 + sigma0(w8));
   77|  18.1k|    Round(a, b, c, d, e, f, g, h, 0x983e5152ee66dfabull, w8 += sigma1(w6) + w1 + sigma0(w9));
   78|  18.1k|    Round(h, a, b, c, d, e, f, g, 0xa831c66d2db43210ull, w9 += sigma1(w7) + w2 + sigma0(w10));
   79|  18.1k|    Round(g, h, a, b, c, d, e, f, 0xb00327c898fb213full, w10 += sigma1(w8) + w3 + sigma0(w11));
   80|  18.1k|    Round(f, g, h, a, b, c, d, e, 0xbf597fc7beef0ee4ull, w11 += sigma1(w9) + w4 + sigma0(w12));
   81|  18.1k|    Round(e, f, g, h, a, b, c, d, 0xc6e00bf33da88fc2ull, w12 += sigma1(w10) + w5 + sigma0(w13));
   82|  18.1k|    Round(d, e, f, g, h, a, b, c, 0xd5a79147930aa725ull, w13 += sigma1(w11) + w6 + sigma0(w14));
   83|  18.1k|    Round(c, d, e, f, g, h, a, b, 0x06ca6351e003826full, w14 += sigma1(w12) + w7 + sigma0(w15));
   84|  18.1k|    Round(b, c, d, e, f, g, h, a, 0x142929670a0e6e70ull, w15 += sigma1(w13) + w8 + sigma0(w0));
   85|       |
   86|  18.1k|    Round(a, b, c, d, e, f, g, h, 0x27b70a8546d22ffcull, w0 += sigma1(w14) + w9 + sigma0(w1));
   87|  18.1k|    Round(h, a, b, c, d, e, f, g, 0x2e1b21385c26c926ull, w1 += sigma1(w15) + w10 + sigma0(w2));
   88|  18.1k|    Round(g, h, a, b, c, d, e, f, 0x4d2c6dfc5ac42aedull, w2 += sigma1(w0) + w11 + sigma0(w3));
   89|  18.1k|    Round(f, g, h, a, b, c, d, e, 0x53380d139d95b3dfull, w3 += sigma1(w1) + w12 + sigma0(w4));
   90|  18.1k|    Round(e, f, g, h, a, b, c, d, 0x650a73548baf63deull, w4 += sigma1(w2) + w13 + sigma0(w5));
   91|  18.1k|    Round(d, e, f, g, h, a, b, c, 0x766a0abb3c77b2a8ull, w5 += sigma1(w3) + w14 + sigma0(w6));
   92|  18.1k|    Round(c, d, e, f, g, h, a, b, 0x81c2c92e47edaee6ull, w6 += sigma1(w4) + w15 + sigma0(w7));
   93|  18.1k|    Round(b, c, d, e, f, g, h, a, 0x92722c851482353bull, w7 += sigma1(w5) + w0 + sigma0(w8));
   94|  18.1k|    Round(a, b, c, d, e, f, g, h, 0xa2bfe8a14cf10364ull, w8 += sigma1(w6) + w1 + sigma0(w9));
   95|  18.1k|    Round(h, a, b, c, d, e, f, g, 0xa81a664bbc423001ull, w9 += sigma1(w7) + w2 + sigma0(w10));
   96|  18.1k|    Round(g, h, a, b, c, d, e, f, 0xc24b8b70d0f89791ull, w10 += sigma1(w8) + w3 + sigma0(w11));
   97|  18.1k|    Round(f, g, h, a, b, c, d, e, 0xc76c51a30654be30ull, w11 += sigma1(w9) + w4 + sigma0(w12));
   98|  18.1k|    Round(e, f, g, h, a, b, c, d, 0xd192e819d6ef5218ull, w12 += sigma1(w10) + w5 + sigma0(w13));
   99|  18.1k|    Round(d, e, f, g, h, a, b, c, 0xd69906245565a910ull, w13 += sigma1(w11) + w6 + sigma0(w14));
  100|  18.1k|    Round(c, d, e, f, g, h, a, b, 0xf40e35855771202aull, w14 += sigma1(w12) + w7 + sigma0(w15));
  101|  18.1k|    Round(b, c, d, e, f, g, h, a, 0x106aa07032bbd1b8ull, w15 += sigma1(w13) + w8 + sigma0(w0));
  102|       |
  103|  18.1k|    Round(a, b, c, d, e, f, g, h, 0x19a4c116b8d2d0c8ull, w0 += sigma1(w14) + w9 + sigma0(w1));
  104|  18.1k|    Round(h, a, b, c, d, e, f, g, 0x1e376c085141ab53ull, w1 += sigma1(w15) + w10 + sigma0(w2));
  105|  18.1k|    Round(g, h, a, b, c, d, e, f, 0x2748774cdf8eeb99ull, w2 += sigma1(w0) + w11 + sigma0(w3));
  106|  18.1k|    Round(f, g, h, a, b, c, d, e, 0x34b0bcb5e19b48a8ull, w3 += sigma1(w1) + w12 + sigma0(w4));
  107|  18.1k|    Round(e, f, g, h, a, b, c, d, 0x391c0cb3c5c95a63ull, w4 += sigma1(w2) + w13 + sigma0(w5));
  108|  18.1k|    Round(d, e, f, g, h, a, b, c, 0x4ed8aa4ae3418acbull, w5 += sigma1(w3) + w14 + sigma0(w6));
  109|  18.1k|    Round(c, d, e, f, g, h, a, b, 0x5b9cca4f7763e373ull, w6 += sigma1(w4) + w15 + sigma0(w7));
  110|  18.1k|    Round(b, c, d, e, f, g, h, a, 0x682e6ff3d6b2b8a3ull, w7 += sigma1(w5) + w0 + sigma0(w8));
  111|  18.1k|    Round(a, b, c, d, e, f, g, h, 0x748f82ee5defb2fcull, w8 += sigma1(w6) + w1 + sigma0(w9));
  112|  18.1k|    Round(h, a, b, c, d, e, f, g, 0x78a5636f43172f60ull, w9 += sigma1(w7) + w2 + sigma0(w10));
  113|  18.1k|    Round(g, h, a, b, c, d, e, f, 0x84c87814a1f0ab72ull, w10 += sigma1(w8) + w3 + sigma0(w11));
  114|  18.1k|    Round(f, g, h, a, b, c, d, e, 0x8cc702081a6439ecull, w11 += sigma1(w9) + w4 + sigma0(w12));
  115|  18.1k|    Round(e, f, g, h, a, b, c, d, 0x90befffa23631e28ull, w12 += sigma1(w10) + w5 + sigma0(w13));
  116|  18.1k|    Round(d, e, f, g, h, a, b, c, 0xa4506cebde82bde9ull, w13 += sigma1(w11) + w6 + sigma0(w14));
  117|  18.1k|    Round(c, d, e, f, g, h, a, b, 0xbef9a3f7b2c67915ull, w14 += sigma1(w12) + w7 + sigma0(w15));
  118|  18.1k|    Round(b, c, d, e, f, g, h, a, 0xc67178f2e372532bull, w15 += sigma1(w13) + w8 + sigma0(w0));
  119|       |
  120|  18.1k|    Round(a, b, c, d, e, f, g, h, 0xca273eceea26619cull, w0 += sigma1(w14) + w9 + sigma0(w1));
  121|  18.1k|    Round(h, a, b, c, d, e, f, g, 0xd186b8c721c0c207ull, w1 += sigma1(w15) + w10 + sigma0(w2));
  122|  18.1k|    Round(g, h, a, b, c, d, e, f, 0xeada7dd6cde0eb1eull, w2 += sigma1(w0) + w11 + sigma0(w3));
  123|  18.1k|    Round(f, g, h, a, b, c, d, e, 0xf57d4f7fee6ed178ull, w3 += sigma1(w1) + w12 + sigma0(w4));
  124|  18.1k|    Round(e, f, g, h, a, b, c, d, 0x06f067aa72176fbaull, w4 += sigma1(w2) + w13 + sigma0(w5));
  125|  18.1k|    Round(d, e, f, g, h, a, b, c, 0x0a637dc5a2c898a6ull, w5 += sigma1(w3) + w14 + sigma0(w6));
  126|  18.1k|    Round(c, d, e, f, g, h, a, b, 0x113f9804bef90daeull, w6 += sigma1(w4) + w15 + sigma0(w7));
  127|  18.1k|    Round(b, c, d, e, f, g, h, a, 0x1b710b35131c471bull, w7 += sigma1(w5) + w0 + sigma0(w8));
  128|  18.1k|    Round(a, b, c, d, e, f, g, h, 0x28db77f523047d84ull, w8 += sigma1(w6) + w1 + sigma0(w9));
  129|  18.1k|    Round(h, a, b, c, d, e, f, g, 0x32caab7b40c72493ull, w9 += sigma1(w7) + w2 + sigma0(w10));
  130|  18.1k|    Round(g, h, a, b, c, d, e, f, 0x3c9ebe0a15c9bebcull, w10 += sigma1(w8) + w3 + sigma0(w11));
  131|  18.1k|    Round(f, g, h, a, b, c, d, e, 0x431d67c49c100d4cull, w11 += sigma1(w9) + w4 + sigma0(w12));
  132|  18.1k|    Round(e, f, g, h, a, b, c, d, 0x4cc5d4becb3e42b6ull, w12 += sigma1(w10) + w5 + sigma0(w13));
  133|  18.1k|    Round(d, e, f, g, h, a, b, c, 0x597f299cfc657e2aull, w13 += sigma1(w11) + w6 + sigma0(w14));
  134|  18.1k|    Round(c, d, e, f, g, h, a, b, 0x5fcb6fab3ad6faecull, w14 + sigma1(w12) + w7 + sigma0(w15));
  135|  18.1k|    Round(b, c, d, e, f, g, h, a, 0x6c44198c4a475817ull, w15 + sigma1(w13) + w8 + sigma0(w0));
  136|       |
  137|  18.1k|    s[0] += a;
  138|  18.1k|    s[1] += b;
  139|  18.1k|    s[2] += c;
  140|  18.1k|    s[3] += d;
  141|  18.1k|    s[4] += e;
  142|  18.1k|    s[5] += f;
  143|  18.1k|    s[6] += g;
  144|  18.1k|    s[7] += h;
  145|  18.1k|}
sha512.cpp:_ZN12_GLOBAL__N_16sha5125RoundEmmmRmmmmS1_mm:
   26|  1.44M|{
   27|  1.44M|    uint64_t t1 = h + Sigma1(e) + Ch(e, f, g) + k + w;
   28|  1.44M|    uint64_t t2 = Sigma0(a) + Maj(a, b, c);
   29|  1.44M|    d += t1;
   30|  1.44M|    h = t1 + t2;
   31|  1.44M|}
sha512.cpp:_ZN12_GLOBAL__N_16sha5126Sigma1Em:
   20|  1.44M|uint64_t inline Sigma1(uint64_t x) { return (x >> 14 | x << 50) ^ (x >> 18 | x << 46) ^ (x >> 41 | x << 23); }
sha512.cpp:_ZN12_GLOBAL__N_16sha5122ChEmmm:
   17|  1.44M|uint64_t inline Ch(uint64_t x, uint64_t y, uint64_t z) { return z ^ (x & (y ^ z)); }
sha512.cpp:_ZN12_GLOBAL__N_16sha5126Sigma0Em:
   19|  1.44M|uint64_t inline Sigma0(uint64_t x) { return (x >> 28 | x << 36) ^ (x >> 34 | x << 30) ^ (x >> 39 | x << 25); }
sha512.cpp:_ZN12_GLOBAL__N_16sha5123MajEmmm:
   18|  1.44M|uint64_t inline Maj(uint64_t x, uint64_t y, uint64_t z) { return (x & y) | (z & (x | y)); }
sha512.cpp:_ZN12_GLOBAL__N_16sha5126sigma1Em:
   22|  1.15M|uint64_t inline sigma1(uint64_t x) { return (x >> 19 | x << 45) ^ (x >> 61 | x << 3) ^ (x >> 6); }
sha512.cpp:_ZN12_GLOBAL__N_16sha5126sigma0Em:
   21|  1.15M|uint64_t inline sigma0(uint64_t x) { return (x >> 1 | x << 63) ^ (x >> 8 | x << 56) ^ (x >> 7); }

_Z9BIP32HashRK9ChainCodejhPKhPh:
   72|  3.62k|{
   73|  3.62k|    unsigned char num[4];
   74|  3.62k|    WriteBE32(num, nChild);
   75|  3.62k|    CHMAC_SHA512(chainCode.begin(), chainCode.size()).Write(&header, 1).Write(data, 32).Write(num, 4).Finalize(output);
   76|  3.62k|}

_ZN9ChainCodeC2ERK9base_blobILj256EE:
   27|  3.62k|    constexpr explicit ChainCode(const base_blob<256>& b) : base_blob<256>(b) {}
_Z4HashINSt3__14spanIhLm18446744073709551615EEEE7uint256RKT_:
   84|  3.62k|{
   85|  3.62k|    uint256 result;
   86|  3.62k|    CHash256().Write(MakeUCharSpan(in1)).Finalize(result);
   87|  3.62k|    return result;
   88|  3.62k|}
_Z4HashINSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEEA8_hE7uint256RKT_RKT0_:
   92|  3.62k|inline uint256 Hash(const T1& in1, const T2& in2) {
   93|  3.62k|    uint256 result;
   94|  3.62k|    CHash256().Write(MakeUCharSpan(in1)).Write(MakeUCharSpan(in2)).Finalize(result);
   95|  3.62k|    return result;
   96|  3.62k|}
_Z4HashINSt3__14spanIKhLm18446744073709551615EEEE7uint256RKT_:
   84|  3.62k|{
   85|  3.62k|    uint256 result;
   86|  3.62k|    CHash256().Write(MakeUCharSpan(in1)).Finalize(result);
   87|  3.62k|    return result;
   88|  3.62k|}
_ZN9ChainCodeC2Ev:
   25|  3.62k|    constexpr ChainCode() = default;
_Z4HashINSt3__16vectorIhNS0_9allocatorIhEEEEE7uint256RKT_:
   84|  3.62k|{
   85|  3.62k|    uint256 result;
   86|  3.62k|    CHash256().Write(MakeUCharSpan(in1)).Finalize(result);
   87|  3.62k|    return result;
   88|  3.62k|}
_ZN9ChainCodeD2Ev:
   28|  7.24k|    ~ChainCode() { memory_cleanse(data(), size()); }
_Z7Hash160INSt3__14spanIKhLm18446744073709551615EEEE7uint160RKT_:
  101|  19.9k|{
  102|  19.9k|    uint160 result;
  103|  19.9k|    CHash160().Write(MakeUCharSpan(in1)).Finalize(result);
  104|  19.9k|    return result;
  105|  19.9k|}
_ZN8CHash2565WriteENSt3__14spanIKhLm18446744073709551615EEE:
   45|  18.1k|    CHash256& Write(std::span<const unsigned char> input) {
   46|  18.1k|        sha.Write(input.data(), input.size());
   47|  18.1k|        return *this;
   48|  18.1k|    }
_ZN8CHash2568FinalizeENSt3__14spanIhLm18446744073709551615EEE:
   38|  14.4k|    void Finalize(std::span<unsigned char> output) {
   39|  14.4k|        assert(output.size() == OUTPUT_SIZE);
  ------------------
  |  Branch (39:9): [True: 14.4k, False: 0]
  ------------------
   40|  14.4k|        unsigned char buf[CSHA256::OUTPUT_SIZE];
   41|  14.4k|        sha.Finalize(buf);
   42|  14.4k|        sha.Reset().Write(buf, CSHA256::OUTPUT_SIZE).Finalize(output.data());
   43|  14.4k|    }
_Z7Hash160I7CScriptE7uint160RKT_:
  101|  3.62k|{
  102|  3.62k|    uint160 result;
  103|  3.62k|    CHash160().Write(MakeUCharSpan(in1)).Finalize(result);
  104|  3.62k|    return result;
  105|  3.62k|}
_ZN8CHash1605WriteENSt3__14spanIKhLm18446744073709551615EEE:
   70|  23.5k|    CHash160& Write(std::span<const unsigned char> input) {
   71|  23.5k|        sha.Write(input.data(), input.size());
   72|  23.5k|        return *this;
   73|  23.5k|    }
_ZN8CHash1608FinalizeENSt3__14spanIhLm18446744073709551615EEE:
   63|  23.5k|    void Finalize(std::span<unsigned char> output) {
   64|  23.5k|        assert(output.size() == OUTPUT_SIZE);
  ------------------
  |  Branch (64:9): [True: 23.5k, False: 0]
  ------------------
   65|  23.5k|        unsigned char buf[CSHA256::OUTPUT_SIZE];
   66|  23.5k|        sha.Finalize(buf);
   67|  23.5k|        CRIPEMD160().Write(buf, CSHA256::OUTPUT_SIZE).Finalize(output.data());
   68|  23.5k|    }

_ZNK12CChainParams12Base58PrefixENS_10Base58TypeE:
  114|  7.24k|    const std::vector<unsigned char>& Base58Prefix(Base58Type type) const { return base58Prefixes[type]; }
_ZNK12CChainParams9Bech32HRPEv:
  115|  3.62k|    const std::string& Bech32HRP() const { return bech32_hrp; }

_Z20ec_seckey_import_derPK24secp256k1_context_structPhPKhm:
   40|  3.62k|int ec_seckey_import_der(const secp256k1_context* ctx, unsigned char *out32, const unsigned char *seckey, size_t seckeylen) {
   41|  3.62k|    const unsigned char *end = seckey + seckeylen;
   42|  3.62k|    memset(out32, 0, 32);
   43|       |    /* sequence header */
   44|  3.62k|    if (end - seckey < 1 || *seckey != 0x30u) {
  ------------------
  |  Branch (44:9): [True: 0, False: 3.62k]
  |  Branch (44:29): [True: 0, False: 3.62k]
  ------------------
   45|      0|        return 0;
   46|      0|    }
   47|  3.62k|    seckey++;
   48|       |    /* sequence length constructor */
   49|  3.62k|    if (end - seckey < 1 || !(*seckey & 0x80u)) {
  ------------------
  |  Branch (49:9): [True: 0, False: 3.62k]
  |  Branch (49:29): [True: 0, False: 3.62k]
  ------------------
   50|      0|        return 0;
   51|      0|    }
   52|  3.62k|    ptrdiff_t lenb = *seckey & ~0x80u; seckey++;
   53|  3.62k|    if (lenb < 1 || lenb > 2) {
  ------------------
  |  Branch (53:9): [True: 0, False: 3.62k]
  |  Branch (53:21): [True: 0, False: 3.62k]
  ------------------
   54|      0|        return 0;
   55|      0|    }
   56|  3.62k|    if (end - seckey < lenb) {
  ------------------
  |  Branch (56:9): [True: 0, False: 3.62k]
  ------------------
   57|      0|        return 0;
   58|      0|    }
   59|       |    /* sequence length */
   60|  3.62k|    ptrdiff_t len = seckey[lenb-1] | (lenb > 1 ? seckey[lenb-2] << 8 : 0u);
  ------------------
  |  Branch (60:39): [True: 0, False: 3.62k]
  ------------------
   61|  3.62k|    seckey += lenb;
   62|  3.62k|    if (end - seckey < len) {
  ------------------
  |  Branch (62:9): [True: 0, False: 3.62k]
  ------------------
   63|      0|        return 0;
   64|      0|    }
   65|       |    /* sequence element 0: version number (=1) */
   66|  3.62k|    if (end - seckey < 3 || seckey[0] != 0x02u || seckey[1] != 0x01u || seckey[2] != 0x01u) {
  ------------------
  |  Branch (66:9): [True: 0, False: 3.62k]
  |  Branch (66:29): [True: 0, False: 3.62k]
  |  Branch (66:51): [True: 0, False: 3.62k]
  |  Branch (66:73): [True: 0, False: 3.62k]
  ------------------
   67|      0|        return 0;
   68|      0|    }
   69|  3.62k|    seckey += 3;
   70|       |    /* sequence element 1: octet string, up to 32 bytes */
   71|  3.62k|    if (end - seckey < 2 || seckey[0] != 0x04u) {
  ------------------
  |  Branch (71:9): [True: 0, False: 3.62k]
  |  Branch (71:29): [True: 0, False: 3.62k]
  ------------------
   72|      0|        return 0;
   73|      0|    }
   74|  3.62k|    ptrdiff_t oslen = seckey[1];
   75|  3.62k|    seckey += 2;
   76|  3.62k|    if (oslen > 32 || end - seckey < oslen) {
  ------------------
  |  Branch (76:9): [True: 0, False: 3.62k]
  |  Branch (76:23): [True: 0, False: 3.62k]
  ------------------
   77|      0|        return 0;
   78|      0|    }
   79|  3.62k|    memcpy(out32 + (32 - oslen), seckey, oslen);
   80|  3.62k|    if (!secp256k1_ec_seckey_verify(ctx, out32)) {
  ------------------
  |  Branch (80:9): [True: 0, False: 3.62k]
  ------------------
   81|      0|        memset(out32, 0, 32);
   82|      0|        return 0;
   83|      0|    }
   84|  3.62k|    return 1;
   85|  3.62k|}
_Z20ec_seckey_export_derPK24secp256k1_context_structPhPmPKhb:
   97|  1.81k|int ec_seckey_export_der(const secp256k1_context *ctx, unsigned char *seckey, size_t *seckeylen, const unsigned char *key32, bool compressed) {
   98|  1.81k|    assert(*seckeylen >= CKey::SIZE);
  ------------------
  |  Branch (98:5): [True: 1.81k, False: 0]
  ------------------
   99|  1.81k|    secp256k1_pubkey pubkey;
  100|  1.81k|    size_t pubkeylen = 0;
  101|  1.81k|    if (!secp256k1_ec_pubkey_create(ctx, &pubkey, key32)) {
  ------------------
  |  Branch (101:9): [True: 0, False: 1.81k]
  ------------------
  102|      0|        *seckeylen = 0;
  103|      0|        return 0;
  104|      0|    }
  105|  1.81k|    if (compressed) {
  ------------------
  |  Branch (105:9): [True: 1.81k, False: 0]
  ------------------
  106|  1.81k|        static const unsigned char begin[] = {
  107|  1.81k|            0x30,0x81,0xD3,0x02,0x01,0x01,0x04,0x20
  108|  1.81k|        };
  109|  1.81k|        static const unsigned char middle[] = {
  110|  1.81k|            0xA0,0x81,0x85,0x30,0x81,0x82,0x02,0x01,0x01,0x30,0x2C,0x06,0x07,0x2A,0x86,0x48,
  111|  1.81k|            0xCE,0x3D,0x01,0x01,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
  112|  1.81k|            0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
  113|  1.81k|            0xFF,0xFF,0xFE,0xFF,0xFF,0xFC,0x2F,0x30,0x06,0x04,0x01,0x00,0x04,0x01,0x07,0x04,
  114|  1.81k|            0x21,0x02,0x79,0xBE,0x66,0x7E,0xF9,0xDC,0xBB,0xAC,0x55,0xA0,0x62,0x95,0xCE,0x87,
  115|  1.81k|            0x0B,0x07,0x02,0x9B,0xFC,0xDB,0x2D,0xCE,0x28,0xD9,0x59,0xF2,0x81,0x5B,0x16,0xF8,
  116|  1.81k|            0x17,0x98,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
  117|  1.81k|            0xFF,0xFF,0xFF,0xFF,0xFE,0xBA,0xAE,0xDC,0xE6,0xAF,0x48,0xA0,0x3B,0xBF,0xD2,0x5E,
  118|  1.81k|            0x8C,0xD0,0x36,0x41,0x41,0x02,0x01,0x01,0xA1,0x24,0x03,0x22,0x00
  119|  1.81k|        };
  120|  1.81k|        unsigned char *ptr = seckey;
  121|  1.81k|        memcpy(ptr, begin, sizeof(begin)); ptr += sizeof(begin);
  122|  1.81k|        memcpy(ptr, key32, 32); ptr += 32;
  123|  1.81k|        memcpy(ptr, middle, sizeof(middle)); ptr += sizeof(middle);
  124|  1.81k|        pubkeylen = CPubKey::COMPRESSED_SIZE;
  125|  1.81k|        secp256k1_ec_pubkey_serialize(ctx, ptr, &pubkeylen, &pubkey, SECP256K1_EC_COMPRESSED);
  ------------------
  |  |  216|  1.81k|#define SECP256K1_EC_COMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION | SECP256K1_FLAGS_BIT_COMPRESSION)
  |  |  ------------------
  |  |  |  |  197|  1.81k|#define SECP256K1_FLAGS_TYPE_COMPRESSION (1 << 1)
  |  |  ------------------
  |  |               #define SECP256K1_EC_COMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION | SECP256K1_FLAGS_BIT_COMPRESSION)
  |  |  ------------------
  |  |  |  |  202|  1.81k|#define SECP256K1_FLAGS_BIT_COMPRESSION (1 << 8)
  |  |  ------------------
  ------------------
  126|  1.81k|        ptr += pubkeylen;
  127|  1.81k|        *seckeylen = ptr - seckey;
  128|  1.81k|        assert(*seckeylen == CKey::COMPRESSED_SIZE);
  ------------------
  |  Branch (128:9): [True: 1.81k, False: 0]
  ------------------
  129|  1.81k|    } else {
  130|      0|        static const unsigned char begin[] = {
  131|      0|            0x30,0x82,0x01,0x13,0x02,0x01,0x01,0x04,0x20
  132|      0|        };
  133|      0|        static const unsigned char middle[] = {
  134|      0|            0xA0,0x81,0xA5,0x30,0x81,0xA2,0x02,0x01,0x01,0x30,0x2C,0x06,0x07,0x2A,0x86,0x48,
  135|      0|            0xCE,0x3D,0x01,0x01,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
  136|      0|            0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
  137|      0|            0xFF,0xFF,0xFE,0xFF,0xFF,0xFC,0x2F,0x30,0x06,0x04,0x01,0x00,0x04,0x01,0x07,0x04,
  138|      0|            0x41,0x04,0x79,0xBE,0x66,0x7E,0xF9,0xDC,0xBB,0xAC,0x55,0xA0,0x62,0x95,0xCE,0x87,
  139|      0|            0x0B,0x07,0x02,0x9B,0xFC,0xDB,0x2D,0xCE,0x28,0xD9,0x59,0xF2,0x81,0x5B,0x16,0xF8,
  140|      0|            0x17,0x98,0x48,0x3A,0xDA,0x77,0x26,0xA3,0xC4,0x65,0x5D,0xA4,0xFB,0xFC,0x0E,0x11,
  141|      0|            0x08,0xA8,0xFD,0x17,0xB4,0x48,0xA6,0x85,0x54,0x19,0x9C,0x47,0xD0,0x8F,0xFB,0x10,
  142|      0|            0xD4,0xB8,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
  143|      0|            0xFF,0xFF,0xFF,0xFF,0xFE,0xBA,0xAE,0xDC,0xE6,0xAF,0x48,0xA0,0x3B,0xBF,0xD2,0x5E,
  144|      0|            0x8C,0xD0,0x36,0x41,0x41,0x02,0x01,0x01,0xA1,0x44,0x03,0x42,0x00
  145|      0|        };
  146|      0|        unsigned char *ptr = seckey;
  147|      0|        memcpy(ptr, begin, sizeof(begin)); ptr += sizeof(begin);
  148|      0|        memcpy(ptr, key32, 32); ptr += 32;
  149|      0|        memcpy(ptr, middle, sizeof(middle)); ptr += sizeof(middle);
  150|      0|        pubkeylen = CPubKey::SIZE;
  151|      0|        secp256k1_ec_pubkey_serialize(ctx, ptr, &pubkeylen, &pubkey, SECP256K1_EC_UNCOMPRESSED);
  ------------------
  |  |  217|      0|#define SECP256K1_EC_UNCOMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION)
  |  |  ------------------
  |  |  |  |  197|      0|#define SECP256K1_FLAGS_TYPE_COMPRESSION (1 << 1)
  |  |  ------------------
  ------------------
  152|      0|        ptr += pubkeylen;
  153|      0|        *seckeylen = ptr - seckey;
  154|      0|        assert(*seckeylen == CKey::SIZE);
  ------------------
  |  Branch (154:9): [True: 0, False: 0]
  ------------------
  155|      0|    }
  156|  1.81k|    return 1;
  157|  1.81k|}
_ZN4CKey5CheckEPKh:
  159|  9.10k|bool CKey::Check(const unsigned char *vch) {
  160|  9.10k|    return secp256k1_ec_seckey_verify(secp256k1_context_static, vch);
  161|  9.10k|}
_ZNK4CKey10GetPrivKeyEv:
  171|  1.81k|CPrivKey CKey::GetPrivKey() const {
  172|  1.81k|    assert(keydata);
  ------------------
  |  Branch (172:5): [True: 1.81k, False: 0]
  ------------------
  173|  1.81k|    CPrivKey seckey;
  174|  1.81k|    int ret;
  175|  1.81k|    size_t seckeylen;
  176|  1.81k|    seckey.resize(SIZE);
  177|  1.81k|    seckeylen = SIZE;
  178|  1.81k|    ret = ec_seckey_export_der(secp256k1_context_sign, seckey.data(), &seckeylen, UCharCast(begin()), fCompressed);
  179|  1.81k|    assert(ret);
  ------------------
  |  Branch (179:5): [True: 1.81k, False: 0]
  ------------------
  180|  1.81k|    seckey.resize(seckeylen);
  181|  1.81k|    return seckey;
  182|  1.81k|}
_ZNK4CKey9GetPubKeyEv:
  184|  7.24k|CPubKey CKey::GetPubKey() const {
  185|  7.24k|    assert(keydata);
  ------------------
  |  Branch (185:5): [True: 7.24k, False: 0]
  ------------------
  186|  7.24k|    secp256k1_pubkey pubkey;
  187|  7.24k|    size_t clen = CPubKey::SIZE;
  188|  7.24k|    CPubKey result;
  189|  7.24k|    int ret = secp256k1_ec_pubkey_create(secp256k1_context_sign, &pubkey, UCharCast(begin()));
  190|  7.24k|    assert(ret);
  ------------------
  |  Branch (190:5): [True: 7.24k, False: 0]
  ------------------
  191|  7.24k|    secp256k1_ec_pubkey_serialize(secp256k1_context_static, (unsigned char*)result.begin(), &clen, &pubkey, fCompressed ? SECP256K1_EC_COMPRESSED : SECP256K1_EC_UNCOMPRESSED);
  ------------------
  |  |  216|  7.24k|#define SECP256K1_EC_COMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION | SECP256K1_FLAGS_BIT_COMPRESSION)
  |  |  ------------------
  |  |  |  |  197|  7.24k|#define SECP256K1_FLAGS_TYPE_COMPRESSION (1 << 1)
  |  |  ------------------
  |  |               #define SECP256K1_EC_COMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION | SECP256K1_FLAGS_BIT_COMPRESSION)
  |  |  ------------------
  |  |  |  |  202|  7.24k|#define SECP256K1_FLAGS_BIT_COMPRESSION (1 << 8)
  |  |  ------------------
  ------------------
                  secp256k1_ec_pubkey_serialize(secp256k1_context_static, (unsigned char*)result.begin(), &clen, &pubkey, fCompressed ? SECP256K1_EC_COMPRESSED : SECP256K1_EC_UNCOMPRESSED);
  ------------------
  |  |  217|  7.24k|#define SECP256K1_EC_UNCOMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION)
  |  |  ------------------
  |  |  |  |  197|      0|#define SECP256K1_FLAGS_TYPE_COMPRESSION (1 << 1)
  |  |  ------------------
  ------------------
  |  Branch (191:109): [True: 7.24k, False: 0]
  ------------------
  192|  7.24k|    assert(result.size() == clen);
  ------------------
  |  Branch (192:5): [True: 7.24k, False: 0]
  ------------------
  193|  7.24k|    assert(result.IsValid());
  ------------------
  |  Branch (193:5): [True: 7.24k, False: 0]
  ------------------
  194|  7.24k|    return result;
  195|  7.24k|}
_Z10SigHasLowRPK25secp256k1_ecdsa_signature:
  199|  11.1k|{
  200|  11.1k|    unsigned char compact_sig[64];
  201|  11.1k|    secp256k1_ecdsa_signature_serialize_compact(secp256k1_context_static, compact_sig, sig);
  202|       |
  203|       |    // In DER serialization, all values are interpreted as big-endian, signed integers. The highest bit in the integer indicates
  204|       |    // its signed-ness; 0 is positive, 1 is negative. When the value is interpreted as a negative integer, it must be converted
  205|       |    // to a positive value by prepending a 0x00 byte so that the highest bit is 0. We can avoid this prepending by ensuring that
  206|       |    // our highest bit is always 0, and thus we must check that the first byte is less than 0x80.
  207|  11.1k|    return compact_sig[0] < 0x80;
  208|  11.1k|}
_ZNK4CKey4SignERK7uint256RNSt3__16vectorIhNS3_9allocatorIhEEEEbj:
  210|  5.43k|bool CKey::Sign(const uint256 &hash, std::vector<unsigned char>& vchSig, bool grind, uint32_t test_case) const {
  211|  5.43k|    if (!keydata)
  ------------------
  |  Branch (211:9): [True: 0, False: 5.43k]
  ------------------
  212|      0|        return false;
  213|  5.43k|    vchSig.resize(CPubKey::SIGNATURE_SIZE);
  214|  5.43k|    size_t nSigLen = CPubKey::SIGNATURE_SIZE;
  215|  5.43k|    unsigned char extra_entropy[32] = {0};
  216|  5.43k|    WriteLE32(extra_entropy, test_case);
  217|  5.43k|    secp256k1_ecdsa_signature sig;
  218|  5.43k|    uint32_t counter = 0;
  219|  5.43k|    int ret = secp256k1_ecdsa_sign(secp256k1_context_sign, &sig, hash.begin(), UCharCast(begin()), secp256k1_nonce_function_rfc6979, (!grind && test_case) ? extra_entropy : nullptr);
  ------------------
  |  Branch (219:135): [True: 1.81k, False: 3.62k]
  |  Branch (219:145): [True: 0, False: 1.81k]
  ------------------
  220|       |
  221|       |    // Grind for low R
  222|  11.1k|    while (ret && !SigHasLowR(&sig) && grind) {
  ------------------
  |  Branch (222:12): [True: 11.1k, False: 0]
  |  Branch (222:19): [True: 6.68k, False: 4.49k]
  |  Branch (222:40): [True: 5.74k, False: 941]
  ------------------
  223|  5.74k|        WriteLE32(extra_entropy, ++counter);
  224|  5.74k|        ret = secp256k1_ecdsa_sign(secp256k1_context_sign, &sig, hash.begin(), UCharCast(begin()), secp256k1_nonce_function_rfc6979, extra_entropy);
  225|  5.74k|    }
  226|  5.43k|    assert(ret);
  ------------------
  |  Branch (226:5): [True: 5.43k, False: 0]
  ------------------
  227|  5.43k|    secp256k1_ecdsa_signature_serialize_der(secp256k1_context_static, vchSig.data(), &nSigLen, &sig);
  228|  5.43k|    vchSig.resize(nSigLen);
  229|       |    // Additional verification step to prevent using a potentially corrupted signature
  230|  5.43k|    secp256k1_pubkey pk;
  231|  5.43k|    ret = secp256k1_ec_pubkey_create(secp256k1_context_sign, &pk, UCharCast(begin()));
  232|  5.43k|    assert(ret);
  ------------------
  |  Branch (232:5): [True: 5.43k, False: 0]
  ------------------
  233|  5.43k|    ret = secp256k1_ecdsa_verify(secp256k1_context_static, &sig, hash.begin(), &pk);
  234|  5.43k|    assert(ret);
  ------------------
  |  Branch (234:5): [True: 5.43k, False: 0]
  ------------------
  235|  5.43k|    return true;
  236|  5.43k|}
_ZNK4CKey12VerifyPubKeyERK7CPubKey:
  238|  3.62k|bool CKey::VerifyPubKey(const CPubKey& pubkey) const {
  239|  3.62k|    if (pubkey.IsCompressed() != fCompressed) {
  ------------------
  |  Branch (239:9): [True: 0, False: 3.62k]
  ------------------
  240|      0|        return false;
  241|      0|    }
  242|  3.62k|    unsigned char rnd[8];
  243|  3.62k|    std::string str = "Bitcoin key verification\n";
  244|  3.62k|    GetRandBytes(rnd);
  245|  3.62k|    uint256 hash{Hash(str, rnd)};
  246|  3.62k|    std::vector<unsigned char> vchSig;
  247|  3.62k|    Sign(hash, vchSig);
  248|  3.62k|    return pubkey.Verify(hash, vchSig);
  249|  3.62k|}
_ZNK4CKey11SignCompactERK7uint256RNSt3__16vectorIhNS3_9allocatorIhEEEE:
  251|  1.81k|bool CKey::SignCompact(const uint256 &hash, std::vector<unsigned char>& vchSig) const {
  252|  1.81k|    if (!keydata)
  ------------------
  |  Branch (252:9): [True: 0, False: 1.81k]
  ------------------
  253|      0|        return false;
  254|  1.81k|    vchSig.resize(CPubKey::COMPACT_SIGNATURE_SIZE);
  255|  1.81k|    int rec = -1;
  256|  1.81k|    secp256k1_ecdsa_recoverable_signature rsig;
  257|  1.81k|    int ret = secp256k1_ecdsa_sign_recoverable(secp256k1_context_sign, &rsig, hash.begin(), UCharCast(begin()), secp256k1_nonce_function_rfc6979, nullptr);
  258|  1.81k|    assert(ret);
  ------------------
  |  Branch (258:5): [True: 1.81k, False: 0]
  ------------------
  259|  1.81k|    ret = secp256k1_ecdsa_recoverable_signature_serialize_compact(secp256k1_context_static, &vchSig[1], &rec, &rsig);
  260|  1.81k|    assert(ret);
  ------------------
  |  Branch (260:5): [True: 1.81k, False: 0]
  ------------------
  261|  1.81k|    assert(rec != -1);
  ------------------
  |  Branch (261:5): [True: 1.81k, False: 0]
  ------------------
  262|  1.81k|    vchSig[0] = 27 + rec + (fCompressed ? 4 : 0);
  ------------------
  |  Branch (262:29): [True: 1.81k, False: 0]
  ------------------
  263|       |    // Additional verification step to prevent using a potentially corrupted signature
  264|  1.81k|    secp256k1_pubkey epk, rpk;
  265|  1.81k|    ret = secp256k1_ec_pubkey_create(secp256k1_context_sign, &epk, UCharCast(begin()));
  266|  1.81k|    assert(ret);
  ------------------
  |  Branch (266:5): [True: 1.81k, False: 0]
  ------------------
  267|  1.81k|    ret = secp256k1_ecdsa_recover(secp256k1_context_static, &rpk, &rsig, hash.begin());
  268|  1.81k|    assert(ret);
  ------------------
  |  Branch (268:5): [True: 1.81k, False: 0]
  ------------------
  269|  1.81k|    ret = secp256k1_ec_pubkey_cmp(secp256k1_context_static, &epk, &rpk);
  270|  1.81k|    assert(ret == 0);
  ------------------
  |  Branch (270:5): [True: 1.81k, False: 0]
  ------------------
  271|  1.81k|    return true;
  272|  1.81k|}
_ZN4CKey4LoadERKNSt3__16vectorIh16secure_allocatorIhEEERK7CPubKeyb:
  280|  3.62k|bool CKey::Load(const CPrivKey &seckey, const CPubKey &vchPubKey, bool fSkipCheck=false) {
  281|  3.62k|    MakeKeyData();
  282|  3.62k|    if (!ec_seckey_import_der(secp256k1_context_static, (unsigned char*)begin(), seckey.data(), seckey.size())) {
  ------------------
  |  Branch (282:9): [True: 0, False: 3.62k]
  ------------------
  283|      0|        ClearKeyData();
  284|      0|        return false;
  285|      0|    }
  286|  3.62k|    fCompressed = vchPubKey.IsCompressed();
  287|       |
  288|  3.62k|    if (fSkipCheck)
  ------------------
  |  Branch (288:9): [True: 1.81k, False: 1.81k]
  ------------------
  289|  1.81k|        return true;
  290|       |
  291|  1.81k|    return VerifyPubKey(vchPubKey);
  292|  3.62k|}
_ZNK4CKey6DeriveERS_R9ChainCodejRKS1_:
  294|  1.81k|bool CKey::Derive(CKey& keyChild, ChainCode &ccChild, unsigned int nChild, const ChainCode& cc) const {
  295|  1.81k|    assert(IsValid());
  ------------------
  |  Branch (295:5): [True: 1.81k, False: 0]
  ------------------
  296|  1.81k|    assert(IsCompressed());
  ------------------
  |  Branch (296:5): [True: 1.81k, False: 0]
  ------------------
  297|  1.81k|    std::vector<unsigned char, secure_allocator<unsigned char>> vout(64);
  298|  1.81k|    if ((nChild >> 31) == 0) {
  ------------------
  |  Branch (298:9): [True: 1.81k, False: 0]
  ------------------
  299|  1.81k|        CPubKey pubkey = GetPubKey();
  300|  1.81k|        assert(pubkey.size() == CPubKey::COMPRESSED_SIZE);
  ------------------
  |  Branch (300:9): [True: 1.81k, False: 0]
  ------------------
  301|  1.81k|        BIP32Hash(cc, nChild, *pubkey.begin(), pubkey.begin()+1, vout.data());
  302|  1.81k|    } else {
  303|      0|        assert(size() == 32);
  ------------------
  |  Branch (303:9): [True: 0, False: 0]
  ------------------
  304|      0|        BIP32Hash(cc, nChild, 0, UCharCast(begin()), vout.data());
  305|      0|    }
  306|  1.81k|    memcpy(ccChild.begin(), vout.data()+32, 32);
  307|  1.81k|    keyChild.Set(begin(), begin() + 32, true);
  308|  1.81k|    bool ret = secp256k1_ec_seckey_tweak_add(secp256k1_context_static, (unsigned char*)keyChild.begin(), vout.data());
  309|  1.81k|    if (!ret) keyChild.ClearKeyData();
  ------------------
  |  Branch (309:9): [True: 0, False: 1.81k]
  ------------------
  310|  1.81k|    return ret;
  311|  1.81k|}
_ZN11ECC_ContextD2Ev:
  501|      2|{
  502|      2|    ECC_Stop();
  503|      2|}
key.cpp:_ZL8ECC_Stopv:
  486|      2|static void ECC_Stop() {
  487|      2|    secp256k1_context *ctx = secp256k1_context_sign;
  488|      2|    secp256k1_context_sign = nullptr;
  489|       |
  490|      2|    if (ctx) {
  ------------------
  |  Branch (490:9): [True: 2, False: 0]
  ------------------
  491|      2|        secp256k1_context_destroy(ctx);
  492|      2|    }
  493|      2|}

_ZN4CKey3SetINSt3__111__wrap_iterIPKhEEEEvT_S6_b:
  109|  3.69k|    {
  110|  3.69k|        if (size_t(pend - pbegin) != std::tuple_size_v<KeyType>) {
  ------------------
  |  Branch (110:13): [True: 29, False: 3.66k]
  ------------------
  111|     29|            ClearKeyData();
  112|  3.66k|        } else if (Check(UCharCast(&pbegin[0]))) {
  ------------------
  |  Branch (112:20): [True: 3.62k, False: 46]
  ------------------
  113|  3.62k|            MakeKeyData();
  114|  3.62k|            memcpy(keydata->data(), (unsigned char*)&pbegin[0], keydata->size());
  115|  3.62k|            fCompressed = fCompressedIn;
  116|  3.62k|        } else {
  117|     46|            ClearKeyData();
  118|     46|        }
  119|  3.69k|    }
_ZeqRK4CKeyS1_:
  100|  12.6k|    {
  101|  12.6k|        return a.fCompressed == b.fCompressed &&
  ------------------
  |  Branch (101:16): [True: 9.05k, False: 3.62k]
  ------------------
  102|  9.05k|            a.size() == b.size() &&
  ------------------
  |  Branch (102:13): [True: 9.05k, False: 0]
  ------------------
  103|  9.05k|            memcmp(a.data(), b.data(), a.size()) == 0;
  ------------------
  |  Branch (103:13): [True: 7.24k, False: 1.81k]
  ------------------
  104|  12.6k|    }
_ZN4CKey3SetIPKSt4byteEEvT_S4_b:
  109|  3.62k|    {
  110|  3.62k|        if (size_t(pend - pbegin) != std::tuple_size_v<KeyType>) {
  ------------------
  |  Branch (110:13): [True: 0, False: 3.62k]
  ------------------
  111|      0|            ClearKeyData();
  112|  3.62k|        } else if (Check(UCharCast(&pbegin[0]))) {
  ------------------
  |  Branch (112:20): [True: 3.62k, False: 0]
  ------------------
  113|  3.62k|            MakeKeyData();
  114|  3.62k|            memcpy(keydata->data(), (unsigned char*)&pbegin[0], keydata->size());
  115|  3.62k|            fCompressed = fCompressedIn;
  116|  3.62k|        } else {
  117|      0|            ClearKeyData();
  118|      0|        }
  119|  3.62k|    }
_ZNK4CKey12IsCompressedEv:
  131|  10.8k|    bool IsCompressed() const { return fCompressed; }
_ZN4CKey3SetINSt3__111__wrap_iterIPhEEEEvT_S5_b:
  109|  1.81k|    {
  110|  1.81k|        if (size_t(pend - pbegin) != std::tuple_size_v<KeyType>) {
  ------------------
  |  Branch (110:13): [True: 0, False: 1.81k]
  ------------------
  111|      0|            ClearKeyData();
  112|  1.81k|        } else if (Check(UCharCast(&pbegin[0]))) {
  ------------------
  |  Branch (112:20): [True: 1.81k, False: 0]
  ------------------
  113|  1.81k|            MakeKeyData();
  114|  1.81k|            memcpy(keydata->data(), (unsigned char*)&pbegin[0], keydata->size());
  115|  1.81k|            fCompressed = fCompressedIn;
  116|  1.81k|        } else {
  117|      0|            ClearKeyData();
  118|      0|        }
  119|  1.81k|    }
_ZNK4CKey5beginEv:
  124|  45.5k|    const std::byte* begin() const { return data(); }
_ZNK4CKey3endEv:
  125|  7.24k|    const std::byte* end() const { return data() + size(); }
_ZNK4CKey4dataEv:
  123|  70.9k|    const std::byte* data() const { return keydata ? reinterpret_cast<const std::byte*>(keydata->data()) : nullptr; }
  ------------------
  |  Branch (123:44): [True: 70.9k, False: 0]
  ------------------
_ZNK4CKey4sizeEv:
  122|  43.4k|    unsigned int size() const { return keydata ? keydata->size() : 0; }
  ------------------
  |  Branch (122:40): [True: 41.6k, False: 1.81k]
  ------------------
_ZN4CKeyC2Ev:
   79|  21.8k|    CKey() noexcept = default;
_ZN4CKeyaSERKS_:
   84|  7.24k|    {
   85|  7.24k|        if (this != &other) {
  ------------------
  |  Branch (85:13): [True: 7.24k, False: 0]
  ------------------
   86|  7.24k|            if (other.keydata) {
  ------------------
  |  Branch (86:17): [True: 7.24k, False: 0]
  ------------------
   87|  7.24k|                MakeKeyData();
   88|  7.24k|                *keydata = *other.keydata;
   89|  7.24k|            } else {
   90|      0|                ClearKeyData();
   91|      0|            }
   92|  7.24k|            fCompressed = other.fCompressed;
   93|  7.24k|        }
   94|  7.24k|        return *this;
   95|  7.24k|    }
_ZN4CKey11MakeKeyDataEv:
   69|  19.9k|    {
   70|  19.9k|        if (!keydata) keydata = make_secure_unique<KeyType>();
  ------------------
  |  Branch (70:13): [True: 19.9k, False: 0]
  ------------------
   71|  19.9k|    }
_ZN4CKey12ClearKeyDataEv:
   74|     75|    {
   75|     75|        keydata.reset();
   76|     75|    }
_ZNK4CKey7IsValidEv:
  128|  10.9k|    bool IsValid() const { return !!keydata; }

_Z12DecodeSecretRKNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEE:
  215|  1.81k|{
  216|  1.81k|    CKey key;
  217|  1.81k|    std::vector<unsigned char> data;
  218|  1.81k|    if (DecodeBase58Check(str, data, 34)) {
  ------------------
  |  Branch (218:9): [True: 1.81k, False: 0]
  ------------------
  219|  1.81k|        const std::vector<unsigned char>& privkey_prefix = Params().Base58Prefix(CChainParams::SECRET_KEY);
  220|  1.81k|        if ((data.size() == 32 + privkey_prefix.size() || (data.size() == 33 + privkey_prefix.size() && data.back() == 1)) &&
  ------------------
  |  Branch (220:14): [True: 0, False: 1.81k]
  |  Branch (220:60): [True: 1.81k, False: 0]
  |  Branch (220:105): [True: 1.81k, False: 0]
  ------------------
  221|  1.81k|            std::equal(privkey_prefix.begin(), privkey_prefix.end(), data.begin())) {
  ------------------
  |  Branch (221:13): [True: 1.81k, False: 0]
  ------------------
  222|  1.81k|            bool compressed = data.size() == 33 + privkey_prefix.size();
  223|  1.81k|            key.Set(data.begin() + privkey_prefix.size(), data.begin() + privkey_prefix.size() + 32, compressed);
  224|  1.81k|        }
  225|  1.81k|    }
  226|  1.81k|    if (!data.empty()) {
  ------------------
  |  Branch (226:9): [True: 1.81k, False: 0]
  ------------------
  227|  1.81k|        memory_cleanse(data.data(), data.size());
  228|  1.81k|    }
  229|  1.81k|    return key;
  230|  1.81k|}
_Z12EncodeSecretRK4CKey:
  233|  1.81k|{
  234|  1.81k|    assert(key.IsValid());
  ------------------
  |  Branch (234:5): [True: 1.81k, False: 0]
  ------------------
  235|  1.81k|    std::vector<unsigned char> data = Params().Base58Prefix(CChainParams::SECRET_KEY);
  236|  1.81k|    data.insert(data.end(), UCharCast(key.begin()), UCharCast(key.end()));
  237|  1.81k|    if (key.IsCompressed()) {
  ------------------
  |  Branch (237:9): [True: 1.81k, False: 0]
  ------------------
  238|  1.81k|        data.push_back(1);
  239|  1.81k|    }
  240|  1.81k|    std::string ret = EncodeBase58Check(data);
  241|  1.81k|    memory_cleanse(data.data(), data.size());
  242|  1.81k|    return ret;
  243|  1.81k|}
_Z17EncodeDestinationRKNSt3__17variantIJ14CNoDestination17PubKeyDestination6PKHash10ScriptHash19WitnessV0ScriptHash16WitnessV0KeyHash16WitnessV1Taproot11PayToAnchor14WitnessUnknownEEE:
  296|  1.81k|{
  297|  1.81k|    return std::visit(DestinationEncoder(Params()), dest);
  298|  1.81k|}
_Z17DecodeDestinationRKNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEERS5_PNS_6vectorIiNS3_IiEEEE:
  301|  1.81k|{
  302|  1.81k|    return DecodeDestination(str, Params(), error_msg, error_locations);
  303|  1.81k|}
_Z17DecodeDestinationRKNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEE:
  306|  1.81k|{
  307|  1.81k|    std::string error_msg;
  308|  1.81k|    return DecodeDestination(str, error_msg);
  309|  1.81k|}
key_io.cpp:_ZNK12_GLOBAL__N_118DestinationEncoderclERK6PKHash:
   32|  1.81k|    {
   33|  1.81k|        std::vector<unsigned char> data = m_params.Base58Prefix(CChainParams::PUBKEY_ADDRESS);
   34|  1.81k|        data.insert(data.end(), id.begin(), id.end());
   35|  1.81k|        return EncodeBase58Check(data);
   36|  1.81k|    }
key_io.cpp:_ZN12_GLOBAL__N_118DestinationEncoderC2ERK12CChainParams:
   29|  1.81k|    explicit DestinationEncoder(const CChainParams& params) : m_params(params) {}
key_io.cpp:_ZN12_GLOBAL__N_117DecodeDestinationERKNSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEERK12CChainParamsRS6_PNS0_6vectorIiNS4_IiEEEE:
   86|  1.81k|{
   87|  1.81k|    std::vector<unsigned char> data;
   88|  1.81k|    uint160 hash;
   89|  1.81k|    error_str = "";
   90|       |
   91|       |    // Note this will be false if it is a valid Bech32 address for a different network
   92|  1.81k|    bool is_bech32 = (ToLower(str.substr(0, params.Bech32HRP().size())) == params.Bech32HRP());
   93|       |
   94|  1.81k|    if (!is_bech32 && DecodeBase58Check(str, data, 21)) {
  ------------------
  |  Branch (94:9): [True: 1.81k, False: 0]
  |  Branch (94:23): [True: 1.81k, False: 0]
  ------------------
   95|       |        // base58-encoded Bitcoin addresses.
   96|       |        // Public-key-hash-addresses have version 0 (or 111 testnet).
   97|       |        // The data vector contains RIPEMD160(SHA256(pubkey)), where pubkey is the serialized public key.
   98|  1.81k|        const std::vector<unsigned char>& pubkey_prefix = params.Base58Prefix(CChainParams::PUBKEY_ADDRESS);
   99|  1.81k|        if (data.size() == hash.size() + pubkey_prefix.size() && std::equal(pubkey_prefix.begin(), pubkey_prefix.end(), data.begin())) {
  ------------------
  |  Branch (99:13): [True: 1.81k, False: 0]
  |  Branch (99:66): [True: 1.81k, False: 0]
  ------------------
  100|  1.81k|            std::copy(data.begin() + pubkey_prefix.size(), data.end(), hash.begin());
  101|  1.81k|            return PKHash(hash);
  102|  1.81k|        }
  103|       |        // Script-hash-addresses have version 5 (or 196 testnet).
  104|       |        // The data vector contains RIPEMD160(SHA256(cscript)), where cscript is the serialized redemption script.
  105|      0|        const std::vector<unsigned char>& script_prefix = params.Base58Prefix(CChainParams::SCRIPT_ADDRESS);
  106|      0|        if (data.size() == hash.size() + script_prefix.size() && std::equal(script_prefix.begin(), script_prefix.end(), data.begin())) {
  ------------------
  |  Branch (106:13): [True: 0, False: 0]
  |  Branch (106:66): [True: 0, False: 0]
  ------------------
  107|      0|            std::copy(data.begin() + script_prefix.size(), data.end(), hash.begin());
  108|      0|            return ScriptHash(hash);
  109|      0|        }
  110|       |
  111|       |        // If the prefix of data matches either the script or pubkey prefix, the length must have been wrong
  112|      0|        if ((data.size() >= script_prefix.size() &&
  ------------------
  |  Branch (112:14): [True: 0, False: 0]
  ------------------
  113|      0|                std::equal(script_prefix.begin(), script_prefix.end(), data.begin())) ||
  ------------------
  |  Branch (113:17): [True: 0, False: 0]
  ------------------
  114|      0|            (data.size() >= pubkey_prefix.size() &&
  ------------------
  |  Branch (114:14): [True: 0, False: 0]
  ------------------
  115|      0|                std::equal(pubkey_prefix.begin(), pubkey_prefix.end(), data.begin()))) {
  ------------------
  |  Branch (115:17): [True: 0, False: 0]
  ------------------
  116|      0|            error_str = "Invalid length for Base58 address (P2PKH or P2SH)";
  117|      0|        } else {
  118|      0|            error_str = "Invalid or unsupported Base58-encoded address.";
  119|      0|        }
  120|      0|        return CNoDestination();
  121|      0|    } else if (!is_bech32) {
  ------------------
  |  Branch (121:16): [True: 0, False: 0]
  ------------------
  122|       |        // Try Base58 decoding without the checksum, using a much larger max length
  123|      0|        if (!DecodeBase58(str, data, 100)) {
  ------------------
  |  Branch (123:13): [True: 0, False: 0]
  ------------------
  124|      0|            error_str = "Invalid or unsupported Segwit (Bech32) or Base58 encoding.";
  125|      0|        } else {
  126|      0|            error_str = "Invalid checksum or length of Base58 address (P2PKH or P2SH)";
  127|      0|        }
  128|      0|        return CNoDestination();
  129|      0|    }
  130|       |
  131|      0|    data.clear();
  132|      0|    const auto dec = bech32::Decode(str);
  133|      0|    if (dec.encoding == bech32::Encoding::BECH32 || dec.encoding == bech32::Encoding::BECH32M) {
  ------------------
  |  Branch (133:9): [True: 0, False: 0]
  |  Branch (133:53): [True: 0, False: 0]
  ------------------
  134|      0|        if (dec.data.empty()) {
  ------------------
  |  Branch (134:13): [True: 0, False: 0]
  ------------------
  135|      0|            error_str = "Empty Bech32 data section";
  136|      0|            return CNoDestination();
  137|      0|        }
  138|       |        // Bech32 decoding
  139|      0|        if (dec.hrp != params.Bech32HRP()) {
  ------------------
  |  Branch (139:13): [True: 0, False: 0]
  ------------------
  140|      0|            error_str = strprintf("Invalid or unsupported prefix for Segwit (Bech32) address (expected %s, got %s).", params.Bech32HRP(), dec.hrp);
  ------------------
  |  | 1172|      0|#define strprintf tfm::format
  ------------------
  141|      0|            return CNoDestination();
  142|      0|        }
  143|      0|        int version = dec.data[0]; // The first 5 bit symbol is the witness version (0-16)
  144|      0|        if (version == 0 && dec.encoding != bech32::Encoding::BECH32) {
  ------------------
  |  Branch (144:13): [True: 0, False: 0]
  |  Branch (144:29): [True: 0, False: 0]
  ------------------
  145|      0|            error_str = "Version 0 witness address must use Bech32 checksum";
  146|      0|            return CNoDestination();
  147|      0|        }
  148|      0|        if (version != 0 && dec.encoding != bech32::Encoding::BECH32M) {
  ------------------
  |  Branch (148:13): [True: 0, False: 0]
  |  Branch (148:29): [True: 0, False: 0]
  ------------------
  149|      0|            error_str = "Version 1+ witness address must use Bech32m checksum";
  150|      0|            return CNoDestination();
  151|      0|        }
  152|       |        // The rest of the symbols are converted witness program bytes.
  153|      0|        data.reserve(((dec.data.size() - 1) * 5) / 8);
  154|      0|        if (ConvertBits<5, 8, false>([&](unsigned char c) { data.push_back(c); }, dec.data.begin() + 1, dec.data.end())) {
  ------------------
  |  Branch (154:13): [True: 0, False: 0]
  ------------------
  155|       |
  156|      0|            std::string_view byte_str{data.size() == 1 ? "byte" : "bytes"};
  ------------------
  |  Branch (156:39): [True: 0, False: 0]
  ------------------
  157|       |
  158|      0|            if (version == 0) {
  ------------------
  |  Branch (158:17): [True: 0, False: 0]
  ------------------
  159|      0|                {
  160|      0|                    WitnessV0KeyHash keyid;
  161|      0|                    if (data.size() == keyid.size()) {
  ------------------
  |  Branch (161:25): [True: 0, False: 0]
  ------------------
  162|      0|                        std::copy(data.begin(), data.end(), keyid.begin());
  163|      0|                        return keyid;
  164|      0|                    }
  165|      0|                }
  166|      0|                {
  167|      0|                    WitnessV0ScriptHash scriptid;
  168|      0|                    if (data.size() == scriptid.size()) {
  ------------------
  |  Branch (168:25): [True: 0, False: 0]
  ------------------
  169|      0|                        std::copy(data.begin(), data.end(), scriptid.begin());
  170|      0|                        return scriptid;
  171|      0|                    }
  172|      0|                }
  173|       |
  174|      0|                error_str = strprintf("Invalid Bech32 v0 address program size (%d %s), per BIP141", data.size(), byte_str);
  ------------------
  |  | 1172|      0|#define strprintf tfm::format
  ------------------
  175|      0|                return CNoDestination();
  176|      0|            }
  177|       |
  178|      0|            if (version == 1 && data.size() == WITNESS_V1_TAPROOT_SIZE) {
  ------------------
  |  Branch (178:17): [True: 0, False: 0]
  |  Branch (178:33): [True: 0, False: 0]
  ------------------
  179|      0|                static_assert(WITNESS_V1_TAPROOT_SIZE == WitnessV1Taproot::size());
  180|      0|                WitnessV1Taproot tap;
  181|      0|                std::copy(data.begin(), data.end(), tap.begin());
  182|      0|                return tap;
  183|      0|            }
  184|       |
  185|      0|            if (CScript::IsPayToAnchor(version, data)) {
  ------------------
  |  Branch (185:17): [True: 0, False: 0]
  ------------------
  186|      0|                return PayToAnchor();
  187|      0|            }
  188|       |
  189|      0|            if (version > 16) {
  ------------------
  |  Branch (189:17): [True: 0, False: 0]
  ------------------
  190|      0|                error_str = "Invalid Bech32 address witness version";
  191|      0|                return CNoDestination();
  192|      0|            }
  193|       |
  194|      0|            if (data.size() < 2 || data.size() > BECH32_WITNESS_PROG_MAX_LEN) {
  ------------------
  |  Branch (194:17): [True: 0, False: 0]
  |  Branch (194:36): [True: 0, False: 0]
  ------------------
  195|      0|                error_str = strprintf("Invalid Bech32 address program size (%d %s)", data.size(), byte_str);
  ------------------
  |  | 1172|      0|#define strprintf tfm::format
  ------------------
  196|      0|                return CNoDestination();
  197|      0|            }
  198|       |
  199|      0|            return WitnessUnknown{version, data};
  200|      0|        } else {
  201|      0|            error_str = strprintf("Invalid padding in Bech32 data section");
  ------------------
  |  | 1172|      0|#define strprintf tfm::format
  ------------------
  202|      0|            return CNoDestination();
  203|      0|        }
  204|      0|    }
  205|       |
  206|       |    // Perform Bech32 error location
  207|      0|    auto res = bech32::LocateErrors(str);
  208|      0|    error_str = res.first;
  209|      0|    if (error_locations) *error_locations = std::move(res.second);
  ------------------
  |  Branch (209:9): [True: 0, False: 0]
  ------------------
  210|      0|    return CNoDestination();
  211|      0|}

_Z11LogInstancev:
   27|  1.88k|{
   28|       |/**
   29|       | * NOTE: the logger instances is leaked on exit. This is ugly, but will be
   30|       | * cleaned up by the OS/libc. Defining a logger as a global object doesn't work
   31|       | * since the order of destruction of static/global objects is undefined.
   32|       | * Consider if the logger gets destroyed, and then some later destructor calls
   33|       | * LogInfo, maybe indirectly, and you get a core dump at shutdown trying to
   34|       | * access the logger. When the shutdown sequence is fully audited and tested,
   35|       | * explicit destruction of these objects can be implemented by changing this
   36|       | * from a raw pointer to a std::unique_ptr.
   37|       | * Since the ~Logger() destructor is never called, the Logger class and all
   38|       | * its subclasses must have implicitly-defined destructors.
   39|       | *
   40|       | * This method of initialization was originally introduced in
   41|       | * ee3374234c60aba2cc4c5cd5cac1c0aefc2d817c.
   42|       | */
   43|  1.88k|    static BCLog::Logger* g_logger{new BCLog::Logger()};
   44|  1.88k|    return *g_logger;
   45|  1.88k|}
_ZN5BCLog6Logger8LogPrintEN4util3log5EntryE:
  435|  1.88k|{
  436|  1.88k|    STDLOCK(m_cs);
  ------------------
  |  |   41|  1.88k|#define STDLOCK(cs) StdMutex::Guard BITCOIN_UNIQUE_NAME(criticalblock){StdMutex::CheckNotHeld(cs)}
  |  |  ------------------
  |  |  |  |   11|  1.88k|#define BITCOIN_UNIQUE_NAME(name) PASTE2(name, __COUNTER__)
  |  |  |  |  ------------------
  |  |  |  |  |  |    9|  1.88k|#define PASTE2(x, y) PASTE(x, y)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |    8|  1.88k|#define PASTE(x, y) x ## y
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  437|  1.88k|    return LogPrint_(std::move(entry));
  438|  1.88k|}
_ZN5BCLog6Logger9LogPrint_EN4util3log5EntryE:
  442|  1.88k|{
  443|  1.88k|    if (m_buffering) {
  ------------------
  |  Branch (443:9): [True: 1.88k, False: 0]
  ------------------
  444|  1.88k|        {
  445|  1.88k|            m_cur_buffer_memusage += MemUsage(entry);
  446|  1.88k|            m_msgs_before_open.push_back(std::move(entry));
  447|  1.88k|        }
  448|       |
  449|  1.88k|        while (m_cur_buffer_memusage > m_max_buffer_memusage) {
  ------------------
  |  Branch (449:16): [True: 0, False: 1.88k]
  ------------------
  450|      0|            if (m_msgs_before_open.empty()) {
  ------------------
  |  Branch (450:17): [True: 0, False: 0]
  ------------------
  451|      0|                m_cur_buffer_memusage = 0;
  452|      0|                break;
  453|      0|            }
  454|      0|            m_cur_buffer_memusage -= MemUsage(m_msgs_before_open.front());
  455|      0|            m_msgs_before_open.pop_front();
  456|      0|            ++m_buffer_lines_discarded;
  457|      0|        }
  458|       |
  459|  1.88k|        return;
  460|  1.88k|    }
  461|       |
  462|      0|    std::string str_prefixed{Format(entry)};
  463|      0|    bool ratelimit{false};
  464|      0|    if (entry.should_ratelimit && m_limiter) {
  ------------------
  |  Branch (464:9): [True: 0, False: 0]
  |  Branch (464:35): [True: 0, False: 0]
  ------------------
  465|      0|        auto status{m_limiter->Consume(entry.source_loc, str_prefixed)};
  466|      0|        if (status == LogRateLimiter::Status::NEWLY_SUPPRESSED) {
  ------------------
  |  Branch (466:13): [True: 0, False: 0]
  ------------------
  467|       |            // NOLINTNEXTLINE(misc-no-recursion)
  468|      0|            LogPrint_({
  469|      0|                .category = LogFlags::ALL,
  470|      0|                .level = Level::Warning,
  471|      0|                .should_ratelimit = false, // with should_ratelimit=false, this cannot lead to infinite recursion
  472|      0|                .source_loc = SourceLocation{__func__},
  473|      0|                .message = strprintf(
  ------------------
  |  | 1172|      0|#define strprintf tfm::format
  ------------------
  474|      0|                    "Excessive logging detected from %s:%d (%s): >%d bytes logged during "
  475|      0|                    "the last time window of %is. Suppressing logging to disk from this "
  476|      0|                    "source location until time window resets. Console logging "
  477|      0|                    "unaffected. Last log entry.",
  478|      0|                    entry.source_loc.file_name(), entry.source_loc.line(), entry.source_loc.function_name_short(),
  479|      0|                    m_limiter->m_max_bytes,
  480|      0|                    Ticks<std::chrono::seconds>(m_limiter->m_reset_window)),
  481|      0|            });
  482|      0|        } else if (status == LogRateLimiter::Status::STILL_SUPPRESSED) {
  ------------------
  |  Branch (482:20): [True: 0, False: 0]
  ------------------
  483|      0|            ratelimit = true;
  484|      0|        }
  485|      0|    }
  486|       |
  487|       |    // To avoid confusion caused by dropped log messages when debugging an issue,
  488|       |    // we prefix log lines with "[*]" when there are any suppressed source locations.
  489|      0|    if (m_limiter && m_limiter->SuppressionsActive()) {
  ------------------
  |  Branch (489:9): [True: 0, False: 0]
  |  Branch (489:22): [True: 0, False: 0]
  ------------------
  490|      0|        str_prefixed.insert(0, "[*] ");
  491|      0|    }
  492|       |
  493|      0|    if (m_print_to_console) {
  ------------------
  |  Branch (493:9): [True: 0, False: 0]
  ------------------
  494|       |        // print to console
  495|      0|        fwrite(str_prefixed.data(), 1, str_prefixed.size(), stdout);
  496|      0|        fflush(stdout);
  497|      0|    }
  498|      0|    for (const auto& cb : m_print_callbacks) {
  ------------------
  |  Branch (498:25): [True: 0, False: 0]
  ------------------
  499|      0|        cb(str_prefixed);
  500|      0|    }
  501|      0|    if (m_print_to_file && !ratelimit) {
  ------------------
  |  Branch (501:9): [True: 0, False: 0]
  |  Branch (501:28): [True: 0, False: 0]
  ------------------
  502|      0|        assert(m_fileout != nullptr);
  ------------------
  |  Branch (502:9): [True: 0, False: 0]
  ------------------
  503|       |
  504|       |        // reopen the log file, if requested
  505|      0|        if (m_reopen_file) {
  ------------------
  |  Branch (505:13): [True: 0, False: 0]
  ------------------
  506|      0|            m_reopen_file = false;
  507|      0|            FILE* new_fileout = fsbridge::fopen(m_file_path, "a");
  508|      0|            if (new_fileout) {
  ------------------
  |  Branch (508:17): [True: 0, False: 0]
  ------------------
  509|      0|                setbuf(new_fileout, nullptr); // unbuffered
  510|      0|                fclose(m_fileout);
  511|      0|                m_fileout = new_fileout;
  512|      0|            }
  513|      0|        }
  514|      0|        FileWriteStr(str_prefixed, m_fileout);
  515|      0|    }
  516|      0|}
_ZN4util3log3LogENS0_5EntryE:
  630|  1.88k|{
  631|  1.88k|    BCLog::Logger& logger{LogInstance()};
  632|  1.88k|    if (logger.Enabled()) {
  ------------------
  |  Branch (632:9): [True: 1.88k, False: 0]
  ------------------
  633|  1.88k|        logger.LogPrint(std::move(entry));
  634|  1.88k|    }
  635|  1.88k|}
logging.cpp:_ZL8MemUsageRKN4util3log5EntryE:
  378|  1.88k|{
  379|  1.88k|    return memusage::DynamicUsage(log.message) +
  380|  1.88k|           memusage::DynamicUsage(log.thread_name) +
  381|  1.88k|           memusage::MallocUsage(sizeof(memusage::list_node<util::log::Entry>));
  382|  1.88k|}

_ZNK5BCLog6Logger7EnabledEv:
  185|  1.88k|        {
  186|  1.88k|            STDLOCK(m_cs);
  ------------------
  |  |   41|  1.88k|#define STDLOCK(cs) StdMutex::Guard BITCOIN_UNIQUE_NAME(criticalblock){StdMutex::CheckNotHeld(cs)}
  |  |  ------------------
  |  |  |  |   11|  1.88k|#define BITCOIN_UNIQUE_NAME(name) PASTE2(name, __COUNTER__)
  |  |  |  |  ------------------
  |  |  |  |  |  |    9|  1.88k|#define PASTE2(x, y) PASTE(x, y)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |    8|  1.88k|#define PASTE(x, y) x ## y
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  187|  1.88k|            return m_buffering || m_print_to_console || m_print_to_file || !m_print_callbacks.empty();
  ------------------
  |  Branch (187:20): [True: 1.88k, False: 0]
  |  Branch (187:35): [True: 0, False: 0]
  |  Branch (187:57): [True: 0, False: 0]
  |  Branch (187:76): [True: 0, False: 0]
  ------------------
  188|  1.88k|        }

logging.cpp:_ZN8memusageL12DynamicUsageERKNSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE:
   95|  3.77k|{
   96|  3.77k|    const char* s_ptr = reinterpret_cast<const char*>(&s);
   97|       |    // Don't count the dynamic memory used for string, if it resides in the
   98|       |    // "small string" optimization area (which stores data inside the object itself, up to some
   99|       |    // size; 15 bytes in modern libstdc++).
  100|  3.77k|    if (!std::less{}(s.data(), s_ptr) && !std::greater{}(s.data() + s.size(), s_ptr + sizeof(s))) {
  ------------------
  |  Branch (100:9): [True: 1.88k, False: 1.88k]
  |  Branch (100:9): [True: 1.88k, False: 1.88k]
  |  Branch (100:42): [True: 1.88k, False: 0]
  ------------------
  101|  1.88k|        return 0;
  102|  1.88k|    }
  103|  1.88k|    return MallocUsage(s.capacity());
  104|  3.77k|}
logging.cpp:_ZN8memusageL11MallocUsageEm:
   53|  3.77k|{
   54|       |    // Measured on libc6 2.19 on Linux.
   55|  3.77k|    if (alloc == 0) {
  ------------------
  |  Branch (55:9): [True: 0, False: 3.77k]
  ------------------
   56|      0|        return 0;
   57|  3.77k|    } else if (sizeof(void*) == 8) {
  ------------------
  |  Branch (57:16): [True: 3.77k, Folded]
  ------------------
   58|  3.77k|        return ((alloc + 31) >> 4) << 4;
   59|  3.77k|    } else if (sizeof(void*) == 4) {
  ------------------
  |  Branch (59:16): [Folded, False: 0]
  ------------------
   60|      0|        return ((alloc + 15) >> 3) << 3;
   61|      0|    } else {
   62|       |        assert(0);
  ------------------
  |  Branch (62:9): [Folded, False: 0]
  ------------------
   63|      0|    }
   64|  3.77k|}

_ZN11CNetCleanupD2Ev:
 3676|      2|    {
 3677|       |#ifdef WIN32
 3678|       |        // Shutdown Windows Sockets
 3679|       |        WSACleanup();
 3680|       |#endif
 3681|      2|    }

_Z10IsStandardRK7CScriptR9TxoutType:
   81|  3.62k|{
   82|  3.62k|    std::vector<std::vector<unsigned char> > vSolutions;
   83|  3.62k|    whichType = Solver(scriptPubKey, vSolutions);
   84|       |
   85|  3.62k|    if (whichType == TxoutType::NONSTANDARD) {
  ------------------
  |  Branch (85:9): [True: 0, False: 3.62k]
  ------------------
   86|      0|        return false;
   87|  3.62k|    } else if (whichType == TxoutType::MULTISIG) {
  ------------------
  |  Branch (87:16): [True: 1.81k, False: 1.81k]
  ------------------
   88|  1.81k|        unsigned char m = vSolutions.front()[0];
   89|  1.81k|        unsigned char n = vSolutions.back()[0];
   90|       |        // Support up to x-of-3 multisig txns as standard
   91|  1.81k|        if (n < 1 || n > 3)
  ------------------
  |  Branch (91:13): [True: 0, False: 1.81k]
  |  Branch (91:22): [True: 0, False: 1.81k]
  ------------------
   92|      0|            return false;
   93|  1.81k|        if (m < 1 || m > n)
  ------------------
  |  Branch (93:13): [True: 0, False: 1.81k]
  |  Branch (93:22): [True: 0, False: 1.81k]
  ------------------
   94|      0|            return false;
   95|  1.81k|    }
   96|       |
   97|  3.62k|    return true;
   98|  3.62k|}

_ZNK9prevectorILj36EhjiE4backEv:
  412|  7.24k|    const T& back() const {
  413|  7.24k|        return *item_ptr(size() - 1);
  414|  7.24k|    }
_ZNK9prevectorILj16EhjiE9is_directEv:
  126|     16|    bool is_direct() const { return _size <= N; }
_ZN9prevectorILj16EhjiED2Ev:
  422|     16|    ~prevector() {
  423|     16|        if (!is_direct()) {
  ------------------
  |  Branch (423:13): [True: 0, False: 16]
  ------------------
  424|      0|            free(_union.indirect_contents.indirect);
  425|      0|            _union.indirect_contents.indirect = nullptr;
  426|      0|        }
  427|     16|    }
_ZN9prevectorILj36EhjiE9push_backERKh:
  392|  3.62k|    void push_back(const T& value) {
  393|  3.62k|        emplace_back(value);
  394|  3.62k|    }
_ZN9prevectorILj36EhjiE12emplace_backIJRKhEEEvDpOT_:
  383|  3.62k|    void emplace_back(Args&&... args) {
  384|  3.62k|        size_type new_size = size() + 1;
  385|  3.62k|        if (capacity() < new_size) {
  ------------------
  |  Branch (385:13): [True: 0, False: 3.62k]
  ------------------
  386|      0|            change_capacity(new_size + (new_size >> 1));
  387|      0|        }
  388|  3.62k|        new(item_ptr(size())) T(std::forward<Args>(args)...);
  389|  3.62k|        _size++;
  390|  3.62k|    }
_ZN9prevectorILj36EhjiEaSEOS0_:
  237|  3.62k|    prevector& operator=(prevector<N, T, Size, Diff>&& other) noexcept {
  238|  3.62k|        if (!is_direct()) {
  ------------------
  |  Branch (238:13): [True: 0, False: 3.62k]
  ------------------
  239|      0|            free(_union.indirect_contents.indirect);
  240|      0|        }
  241|  3.62k|        _union = std::move(other._union);
  242|  3.62k|        _size = other._size;
  243|  3.62k|        other._size = 0;
  244|  3.62k|        return *this;
  245|  3.62k|    }
_ZNK9prevectorILj36EhjiE4dataEv:
  468|  3.62k|    const value_type* data() const {
  469|  3.62k|        return item_ptr(0);
  470|  3.62k|    }
_ZN9prevectorILj36EhjiE4fillITkNSt3__114input_iteratorENS0_14const_iteratorEEEvPhT_S5_:
  167|  7.24k|    void fill(T* dst, InputIterator first, InputIterator last) {
  168|   195k|        while (first != last) {
  ------------------
  |  Branch (168:16): [True: 188k, False: 7.24k]
  ------------------
  169|   188k|            new(static_cast<void*>(dst)) T(*first);
  170|   188k|            ++dst;
  171|   188k|            ++first;
  172|   188k|        }
  173|  7.24k|    }
_ZNK9prevectorILj36EhjiE14const_iteratoreqES1_:
  102|   199k|        bool operator==(const_iterator x) const { return ptr == x.ptr; }
_ZN9prevectorILj36EhjiE14const_iteratorppEv:
   92|   220k|        const_iterator& operator++() { ptr++; return *this; }
_ZNK9prevectorILj36EhjiEixEj:
  272|  43.4k|    const T& operator[](size_type pos) const {
  273|  43.4k|        return *item_ptr(pos);
  274|  43.4k|    }
_ZN9prevectorILj36EhjiE8item_ptrEi:
  159|   108k|    T* item_ptr(difference_type pos) { return is_direct() ? direct_ptr(pos) : indirect_ptr(pos); }
  ------------------
  |  Branch (159:47): [True: 106k, False: 1.81k]
  ------------------
_ZNK9prevectorILj36EhjiE9is_directEv:
  126|   610k|    bool is_direct() const { return _size <= N; }
_ZN9prevectorILj36EhjiE10direct_ptrEi:
  122|   108k|    T* direct_ptr(difference_type pos) { return reinterpret_cast<T*>(_union.direct) + pos; }
_ZN9prevectorILj36EhjiE12indirect_ptrEi:
  124|  1.81k|    T* indirect_ptr(difference_type pos) { return reinterpret_cast<T*>(_union.indirect_contents.indirect) + pos; }
_ZN9prevectorILj36EhjiE15change_capacityEj:
  128|  9.05k|    void change_capacity(size_type new_capacity) {
  129|  9.05k|        if (new_capacity <= N) {
  ------------------
  |  Branch (129:13): [True: 7.24k, False: 1.81k]
  ------------------
  130|  7.24k|            if (!is_direct()) {
  ------------------
  |  Branch (130:17): [True: 0, False: 7.24k]
  ------------------
  131|      0|                T* indirect = indirect_ptr(0);
  132|      0|                T* src = indirect;
  133|      0|                T* dst = direct_ptr(0);
  134|      0|                memcpy(dst, src, size() * sizeof(T));
  135|      0|                free(indirect);
  136|      0|                _size -= N + 1;
  137|      0|            }
  138|  7.24k|        } else {
  139|  1.81k|            if (!is_direct()) {
  ------------------
  |  Branch (139:17): [True: 0, False: 1.81k]
  ------------------
  140|       |                /* FIXME: Because malloc/realloc here won't call new_handler if allocation fails, assert
  141|       |                    success. These should instead use an allocator or new/delete so that handlers
  142|       |                    are called as necessary, but performance would be slightly degraded by doing so. */
  143|      0|                _union.indirect_contents.indirect = static_cast<char*>(realloc(_union.indirect_contents.indirect, ((size_t)sizeof(T)) * new_capacity));
  144|      0|                assert(_union.indirect_contents.indirect);
  ------------------
  |  Branch (144:17): [True: 0, False: 0]
  ------------------
  145|      0|                _union.indirect_contents.capacity = new_capacity;
  146|  1.81k|            } else {
  147|  1.81k|                char* new_indirect = static_cast<char*>(malloc(((size_t)sizeof(T)) * new_capacity));
  148|  1.81k|                assert(new_indirect);
  ------------------
  |  Branch (148:17): [True: 1.81k, False: 0]
  ------------------
  149|  1.81k|                T* src = direct_ptr(0);
  150|  1.81k|                T* dst = reinterpret_cast<T*>(new_indirect);
  151|  1.81k|                memcpy(dst, src, size() * sizeof(T));
  152|  1.81k|                _union.indirect_contents.indirect = new_indirect;
  153|  1.81k|                _union.indirect_contents.capacity = new_capacity;
  154|  1.81k|                _size += N + 1;
  155|  1.81k|            }
  156|  1.81k|        }
  157|  9.05k|    }
_ZNK9prevectorILj36EhjiE3endEv:
  258|  68.8k|    const_iterator end() const { return const_iterator(item_ptr(size())); }
_ZNK9prevectorILj36EhjiE8item_ptrEi:
  160|   152k|    const T* item_ptr(difference_type pos) const { return is_direct() ? direct_ptr(pos) : indirect_ptr(pos); }
  ------------------
  |  Branch (160:59): [True: 68.8k, False: 83.3k]
  ------------------
_ZNK9prevectorILj36EhjiE10direct_ptrEi:
  123|  68.8k|    const T* direct_ptr(difference_type pos) const { return reinterpret_cast<const T*>(_union.direct) + pos; }
_ZNK9prevectorILj36EhjiE12indirect_ptrEi:
  125|  83.3k|    const T* indirect_ptr(difference_type pos) const { return reinterpret_cast<const T*>(_union.indirect_contents.indirect) + pos; }
_ZNK9prevectorILj36EhjiE4sizeEv:
  247|   280k|    size_type size() const {
  248|   280k|        return is_direct() ? _size : _size - N - 1;
  ------------------
  |  Branch (248:16): [True: 181k, False: 99.6k]
  ------------------
  249|   280k|    }
_ZNK9prevectorILj36EhjiE5beginEv:
  256|  28.9k|    const_iterator begin() const { return const_iterator(item_ptr(0)); }
_ZNK9prevectorILj36EhjiE14const_iteratordeEv:
   89|   354k|        const T& operator*() const { return *ptr; }
_ZNK9prevectorILj36EhjiE14const_iteratorssES1_:
  103|  57.9k|        auto operator<=>(const_iterator x) const { return ptr <=> x.ptr; }
_ZNK9prevectorILj36EhjiE14const_iteratorptEv:
   90|  21.7k|        const T* operator->() const { return ptr; }
_ZN9prevectorILj36EhjiEC2Ev:
  196|  12.6k|    prevector() = default;
_ZN9prevectorILj36EhjiE6insertENS0_8iteratorERKh:
  307|  23.5k|    iterator insert(iterator pos, const T& value) {
  308|  23.5k|        size_type p = pos - begin();
  309|  23.5k|        size_type new_size = size() + 1;
  310|  23.5k|        if (capacity() < new_size) {
  ------------------
  |  Branch (310:13): [True: 1.81k, False: 21.7k]
  ------------------
  311|  1.81k|            change_capacity(new_size + (new_size >> 1));
  312|  1.81k|        }
  313|  23.5k|        T* ptr = item_ptr(p);
  314|  23.5k|        T* dst = ptr + 1;
  315|  23.5k|        memmove(dst, ptr, (size() - p) * sizeof(T));
  316|  23.5k|        _size++;
  317|  23.5k|        new(static_cast<void*>(ptr)) T(value);
  318|  23.5k|        return iterator(ptr);
  319|  23.5k|    }
_ZmiN9prevectorILj36EhjiE8iteratorES1_:
   68|  32.5k|        difference_type friend operator-(iterator a, iterator b) { return (&(*a) - &(*b)); }
_ZNK9prevectorILj36EhjiE8iteratordeEv:
   61|  65.1k|        T& operator*() const { return *ptr; }
_ZNK9prevectorILj36EhjiE8capacityEv:
  260|  36.2k|    size_t capacity() const {
  261|  36.2k|        if (is_direct()) {
  ------------------
  |  Branch (261:13): [True: 36.2k, False: 0]
  ------------------
  262|  36.2k|            return N;
  263|  36.2k|        } else {
  264|      0|            return _union.indirect_contents.capacity;
  265|      0|        }
  266|  36.2k|    }
_ZN9prevectorILj36EhjiE8iteratorC2EPh:
   60|  88.7k|        iterator(T* ptr_) : ptr(ptr_) {}
_ZN9prevectorILj36EhjiE6insertITkNSt3__114input_iteratorENS2_11__wrap_iterIPKhEEEEvNS0_8iteratorET_S8_:
  335|  9.05k|    void insert(iterator pos, InputIterator first, InputIterator last) {
  336|  9.05k|        size_type p = pos - begin();
  337|  9.05k|        difference_type count = last - first;
  338|  9.05k|        size_type new_size = size() + count;
  339|  9.05k|        if (capacity() < new_size) {
  ------------------
  |  Branch (339:13): [True: 0, False: 9.05k]
  ------------------
  340|      0|            change_capacity(new_size + (new_size >> 1));
  341|      0|        }
  342|  9.05k|        T* ptr = item_ptr(p);
  343|  9.05k|        T* dst = ptr + count;
  344|  9.05k|        memmove(dst, ptr, (size() - p) * sizeof(T));
  345|  9.05k|        _size += count;
  346|  9.05k|        fill(ptr, first, last);
  347|  9.05k|    }
_ZN9prevectorILj36EhjiE4fillITkNSt3__114input_iteratorENS2_11__wrap_iterIPKhEEEEvPhT_S8_:
  167|  9.05k|    void fill(T* dst, InputIterator first, InputIterator last) {
  168|   237k|        while (first != last) {
  ------------------
  |  Branch (168:16): [True: 228k, False: 9.05k]
  ------------------
  169|   228k|            new(static_cast<void*>(dst)) T(*first);
  170|   228k|            ++dst;
  171|   228k|            ++first;
  172|   228k|        }
  173|  9.05k|    }
_ZN9prevectorILj36EhjiEC2ERKS0_:
  216|  7.24k|    prevector(const prevector<N, T, Size, Diff>& other) {
  217|  7.24k|        size_type n = other.size();
  218|  7.24k|        change_capacity(n);
  219|  7.24k|        _size += n;
  220|  7.24k|        fill(item_ptr(0), other.begin(),  other.end());
  221|  7.24k|    }
_ZN9prevectorILj36EhjiE3endEv:
  257|  32.5k|    iterator end() { return iterator(item_ptr(size())); }
_ZN9prevectorILj36EhjiE5beginEv:
  255|  32.5k|    iterator begin() { return iterator(item_ptr(0)); }
_ZN9prevectorILj36EhjiED2Ev:
  422|  19.9k|    ~prevector() {
  423|  19.9k|        if (!is_direct()) {
  ------------------
  |  Branch (423:13): [True: 1.81k, False: 18.1k]
  ------------------
  424|  1.81k|            free(_union.indirect_contents.indirect);
  425|  1.81k|            _union.indirect_contents.indirect = nullptr;
  426|  1.81k|        }
  427|  19.9k|    }
_ZN9prevectorILj36EhjiE14const_iteratorC2EPKh:
   87|   119k|        const_iterator(const T* ptr_) : ptr(ptr_) {}
_ZNK9prevectorILj36EhjiE14const_iteratorplEj:
   97|  21.7k|        const_iterator operator+(size_type n) const { return const_iterator(ptr + n); }
_ZmiN9prevectorILj36EhjiE14const_iteratorES1_:
   96|  65.1k|        difference_type friend operator-(const_iterator a, const_iterator b) { return (&(*a) - &(*b)); }
_ZN9prevectorILj36EhjiE14const_iteratorppEi:
   94|  32.5k|        const_iterator operator++(int) { const_iterator copy(*this); ++(*this); return copy; }
_ZN9prevectorILj36EhjiE14const_iteratorpLEj:
   99|  10.8k|        const_iterator& operator+=(size_type n) { ptr += n; return *this; }

_Z29ecdsa_signature_parse_der_laxP25secp256k1_ecdsa_signaturePKhm:
   45|  10.8k|int ecdsa_signature_parse_der_lax(secp256k1_ecdsa_signature* sig, const unsigned char *input, size_t inputlen) {
   46|  10.8k|    size_t rpos, rlen, spos, slen;
   47|  10.8k|    size_t pos = 0;
   48|  10.8k|    size_t lenbyte;
   49|  10.8k|    unsigned char tmpsig[64] = {0};
   50|  10.8k|    int overflow = 0;
   51|       |
   52|       |    /* Hack to initialize sig with a correctly-parsed but invalid signature. */
   53|  10.8k|    secp256k1_ecdsa_signature_parse_compact(secp256k1_context_static, sig, tmpsig);
   54|       |
   55|       |    /* Sequence tag byte */
   56|  10.8k|    if (pos == inputlen || input[pos] != 0x30) {
  ------------------
  |  Branch (56:9): [True: 0, False: 10.8k]
  |  Branch (56:28): [True: 0, False: 10.8k]
  ------------------
   57|      0|        return 0;
   58|      0|    }
   59|  10.8k|    pos++;
   60|       |
   61|       |    /* Sequence length bytes */
   62|  10.8k|    if (pos == inputlen) {
  ------------------
  |  Branch (62:9): [True: 0, False: 10.8k]
  ------------------
   63|      0|        return 0;
   64|      0|    }
   65|  10.8k|    lenbyte = input[pos++];
   66|  10.8k|    if (lenbyte & 0x80) {
  ------------------
  |  Branch (66:9): [True: 0, False: 10.8k]
  ------------------
   67|      0|        lenbyte -= 0x80;
   68|      0|        if (lenbyte > inputlen - pos) {
  ------------------
  |  Branch (68:13): [True: 0, False: 0]
  ------------------
   69|      0|            return 0;
   70|      0|        }
   71|      0|        pos += lenbyte;
   72|      0|    }
   73|       |
   74|       |    /* Integer tag byte for R */
   75|  10.8k|    if (pos == inputlen || input[pos] != 0x02) {
  ------------------
  |  Branch (75:9): [True: 0, False: 10.8k]
  |  Branch (75:28): [True: 0, False: 10.8k]
  ------------------
   76|      0|        return 0;
   77|      0|    }
   78|  10.8k|    pos++;
   79|       |
   80|       |    /* Integer length for R */
   81|  10.8k|    if (pos == inputlen) {
  ------------------
  |  Branch (81:9): [True: 0, False: 10.8k]
  ------------------
   82|      0|        return 0;
   83|      0|    }
   84|  10.8k|    lenbyte = input[pos++];
   85|  10.8k|    if (lenbyte & 0x80) {
  ------------------
  |  Branch (85:9): [True: 0, False: 10.8k]
  ------------------
   86|      0|        lenbyte -= 0x80;
   87|      0|        if (lenbyte > inputlen - pos) {
  ------------------
  |  Branch (87:13): [True: 0, False: 0]
  ------------------
   88|      0|            return 0;
   89|      0|        }
   90|      0|        while (lenbyte > 0 && input[pos] == 0) {
  ------------------
  |  Branch (90:16): [True: 0, False: 0]
  |  Branch (90:31): [True: 0, False: 0]
  ------------------
   91|      0|            pos++;
   92|      0|            lenbyte--;
   93|      0|        }
   94|      0|        static_assert(sizeof(size_t) >= 4, "size_t too small");
   95|      0|        if (lenbyte >= 4) {
  ------------------
  |  Branch (95:13): [True: 0, False: 0]
  ------------------
   96|      0|            return 0;
   97|      0|        }
   98|      0|        rlen = 0;
   99|      0|        while (lenbyte > 0) {
  ------------------
  |  Branch (99:16): [True: 0, False: 0]
  ------------------
  100|      0|            rlen = (rlen << 8) + input[pos];
  101|      0|            pos++;
  102|      0|            lenbyte--;
  103|      0|        }
  104|  10.8k|    } else {
  105|  10.8k|        rlen = lenbyte;
  106|  10.8k|    }
  107|  10.8k|    if (rlen > inputlen - pos) {
  ------------------
  |  Branch (107:9): [True: 0, False: 10.8k]
  ------------------
  108|      0|        return 0;
  109|      0|    }
  110|  10.8k|    rpos = pos;
  111|  10.8k|    pos += rlen;
  112|       |
  113|       |    /* Integer tag byte for S */
  114|  10.8k|    if (pos == inputlen || input[pos] != 0x02) {
  ------------------
  |  Branch (114:9): [True: 0, False: 10.8k]
  |  Branch (114:28): [True: 0, False: 10.8k]
  ------------------
  115|      0|        return 0;
  116|      0|    }
  117|  10.8k|    pos++;
  118|       |
  119|       |    /* Integer length for S */
  120|  10.8k|    if (pos == inputlen) {
  ------------------
  |  Branch (120:9): [True: 0, False: 10.8k]
  ------------------
  121|      0|        return 0;
  122|      0|    }
  123|  10.8k|    lenbyte = input[pos++];
  124|  10.8k|    if (lenbyte & 0x80) {
  ------------------
  |  Branch (124:9): [True: 0, False: 10.8k]
  ------------------
  125|      0|        lenbyte -= 0x80;
  126|      0|        if (lenbyte > inputlen - pos) {
  ------------------
  |  Branch (126:13): [True: 0, False: 0]
  ------------------
  127|      0|            return 0;
  128|      0|        }
  129|      0|        while (lenbyte > 0 && input[pos] == 0) {
  ------------------
  |  Branch (129:16): [True: 0, False: 0]
  |  Branch (129:31): [True: 0, False: 0]
  ------------------
  130|      0|            pos++;
  131|      0|            lenbyte--;
  132|      0|        }
  133|      0|        static_assert(sizeof(size_t) >= 4, "size_t too small");
  134|      0|        if (lenbyte >= 4) {
  ------------------
  |  Branch (134:13): [True: 0, False: 0]
  ------------------
  135|      0|            return 0;
  136|      0|        }
  137|      0|        slen = 0;
  138|      0|        while (lenbyte > 0) {
  ------------------
  |  Branch (138:16): [True: 0, False: 0]
  ------------------
  139|      0|            slen = (slen << 8) + input[pos];
  140|      0|            pos++;
  141|      0|            lenbyte--;
  142|      0|        }
  143|  10.8k|    } else {
  144|  10.8k|        slen = lenbyte;
  145|  10.8k|    }
  146|  10.8k|    if (slen > inputlen - pos) {
  ------------------
  |  Branch (146:9): [True: 3.62k, False: 7.24k]
  ------------------
  147|  3.62k|        return 0;
  148|  3.62k|    }
  149|  7.24k|    spos = pos;
  150|       |
  151|       |    /* Ignore leading zeroes in R */
  152|  9.15k|    while (rlen > 0 && input[rpos] == 0) {
  ------------------
  |  Branch (152:12): [True: 9.15k, False: 0]
  |  Branch (152:24): [True: 1.91k, False: 7.24k]
  ------------------
  153|  1.91k|        rlen--;
  154|  1.91k|        rpos++;
  155|  1.91k|    }
  156|       |    /* Copy R value */
  157|  7.24k|    if (rlen > 32) {
  ------------------
  |  Branch (157:9): [True: 0, False: 7.24k]
  ------------------
  158|      0|        overflow = 1;
  159|  7.24k|    } else {
  160|  7.24k|        memcpy(tmpsig + 32 - rlen, input + rpos, rlen);
  161|  7.24k|    }
  162|       |
  163|       |    /* Ignore leading zeroes in S */
  164|  7.29k|    while (slen > 0 && input[spos] == 0) {
  ------------------
  |  Branch (164:12): [True: 7.29k, False: 0]
  |  Branch (164:24): [True: 50, False: 7.24k]
  ------------------
  165|     50|        slen--;
  166|     50|        spos++;
  167|     50|    }
  168|       |    /* Copy S value */
  169|  7.24k|    if (slen > 32) {
  ------------------
  |  Branch (169:9): [True: 0, False: 7.24k]
  ------------------
  170|      0|        overflow = 1;
  171|  7.24k|    } else {
  172|  7.24k|        memcpy(tmpsig + 64 - slen, input + spos, slen);
  173|  7.24k|    }
  174|       |
  175|  7.24k|    if (!overflow) {
  ------------------
  |  Branch (175:9): [True: 7.24k, False: 0]
  ------------------
  176|  7.24k|        overflow = !secp256k1_ecdsa_signature_parse_compact(secp256k1_context_static, sig, tmpsig);
  177|  7.24k|    }
  178|  7.24k|    if (overflow) {
  ------------------
  |  Branch (178:9): [True: 0, False: 7.24k]
  ------------------
  179|       |        /* Overwrite the result again with a correctly-parsed but invalid
  180|       |           signature if parsing failed. */
  181|      0|        memset(tmpsig, 0, 64);
  182|      0|        secp256k1_ecdsa_signature_parse_compact(secp256k1_context_static, sig, tmpsig);
  183|      0|    }
  184|  7.24k|    return 1;
  185|  10.8k|}
_ZNK7CPubKey6VerifyERK7uint256RKNSt3__16vectorIhNS3_9allocatorIhEEEE:
  283|  7.24k|bool CPubKey::Verify(const uint256 &hash, const std::vector<unsigned char>& vchSig) const {
  284|  7.24k|    if (!IsValid())
  ------------------
  |  Branch (284:9): [True: 0, False: 7.24k]
  ------------------
  285|      0|        return false;
  286|  7.24k|    secp256k1_pubkey pubkey;
  287|  7.24k|    secp256k1_ecdsa_signature sig;
  288|  7.24k|    if (!secp256k1_ec_pubkey_parse(secp256k1_context_static, &pubkey, vch, size())) {
  ------------------
  |  Branch (288:9): [True: 0, False: 7.24k]
  ------------------
  289|      0|        return false;
  290|      0|    }
  291|  7.24k|    if (!ecdsa_signature_parse_der_lax(&sig, vchSig.data(), vchSig.size())) {
  ------------------
  |  Branch (291:9): [True: 1.81k, False: 5.43k]
  ------------------
  292|  1.81k|        return false;
  293|  1.81k|    }
  294|       |    /* libsecp256k1's ECDSA verification requires lower-S signatures, which have
  295|       |     * not historically been enforced in Bitcoin, so normalize them first. */
  296|  5.43k|    secp256k1_ecdsa_signature_normalize(secp256k1_context_static, &sig, &sig);
  297|  5.43k|    return secp256k1_ecdsa_verify(secp256k1_context_static, &sig, hash.begin(), &pubkey);
  298|  7.24k|}
_ZN7CPubKey14RecoverCompactERK7uint256RKNSt3__16vectorIhNS3_9allocatorIhEEEE:
  300|  1.81k|bool CPubKey::RecoverCompact(const uint256 &hash, const std::vector<unsigned char>& vchSig) {
  301|  1.81k|    if (vchSig.size() != COMPACT_SIGNATURE_SIZE)
  ------------------
  |  Branch (301:9): [True: 0, False: 1.81k]
  ------------------
  302|      0|        return false;
  303|  1.81k|    int recid = (vchSig[0] - 27) & 3;
  304|  1.81k|    bool fComp = ((vchSig[0] - 27) & 4) != 0;
  305|  1.81k|    secp256k1_pubkey pubkey;
  306|  1.81k|    secp256k1_ecdsa_recoverable_signature sig;
  307|  1.81k|    if (!secp256k1_ecdsa_recoverable_signature_parse_compact(secp256k1_context_static, &sig, &vchSig[1], recid)) {
  ------------------
  |  Branch (307:9): [True: 0, False: 1.81k]
  ------------------
  308|      0|        return false;
  309|      0|    }
  310|  1.81k|    if (!secp256k1_ecdsa_recover(secp256k1_context_static, &pubkey, &sig, hash.begin())) {
  ------------------
  |  Branch (310:9): [True: 0, False: 1.81k]
  ------------------
  311|      0|        return false;
  312|      0|    }
  313|  1.81k|    unsigned char pub[SIZE];
  314|  1.81k|    size_t publen = SIZE;
  315|  1.81k|    secp256k1_ec_pubkey_serialize(secp256k1_context_static, pub, &publen, &pubkey, fComp ? SECP256K1_EC_COMPRESSED : SECP256K1_EC_UNCOMPRESSED);
  ------------------
  |  |  216|  1.81k|#define SECP256K1_EC_COMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION | SECP256K1_FLAGS_BIT_COMPRESSION)
  |  |  ------------------
  |  |  |  |  197|  1.81k|#define SECP256K1_FLAGS_TYPE_COMPRESSION (1 << 1)
  |  |  ------------------
  |  |               #define SECP256K1_EC_COMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION | SECP256K1_FLAGS_BIT_COMPRESSION)
  |  |  ------------------
  |  |  |  |  202|  1.81k|#define SECP256K1_FLAGS_BIT_COMPRESSION (1 << 8)
  |  |  ------------------
  ------------------
                  secp256k1_ec_pubkey_serialize(secp256k1_context_static, pub, &publen, &pubkey, fComp ? SECP256K1_EC_COMPRESSED : SECP256K1_EC_UNCOMPRESSED);
  ------------------
  |  |  217|  1.81k|#define SECP256K1_EC_UNCOMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION)
  |  |  ------------------
  |  |  |  |  197|      0|#define SECP256K1_FLAGS_TYPE_COMPRESSION (1 << 1)
  |  |  ------------------
  ------------------
  |  Branch (315:84): [True: 1.81k, False: 0]
  ------------------
  316|  1.81k|    Set(pub, pub + publen);
  317|  1.81k|    return true;
  318|  1.81k|}
_ZNK7CPubKey12IsFullyValidEv:
  320|  7.24k|bool CPubKey::IsFullyValid() const {
  321|  7.24k|    if (!IsValid())
  ------------------
  |  Branch (321:9): [True: 1.81k, False: 5.43k]
  ------------------
  322|  1.81k|        return false;
  323|  5.43k|    secp256k1_pubkey pubkey;
  324|  5.43k|    return secp256k1_ec_pubkey_parse(secp256k1_context_static, &pubkey, vch, size());
  325|  7.24k|}
_ZN7CPubKey10DecompressEv:
  327|  1.81k|bool CPubKey::Decompress() {
  328|  1.81k|    if (!IsValid())
  ------------------
  |  Branch (328:9): [True: 0, False: 1.81k]
  ------------------
  329|      0|        return false;
  330|  1.81k|    secp256k1_pubkey pubkey;
  331|  1.81k|    if (!secp256k1_ec_pubkey_parse(secp256k1_context_static, &pubkey, vch, size())) {
  ------------------
  |  Branch (331:9): [True: 0, False: 1.81k]
  ------------------
  332|      0|        return false;
  333|      0|    }
  334|  1.81k|    unsigned char pub[SIZE];
  335|  1.81k|    size_t publen = SIZE;
  336|  1.81k|    secp256k1_ec_pubkey_serialize(secp256k1_context_static, pub, &publen, &pubkey, SECP256K1_EC_UNCOMPRESSED);
  ------------------
  |  |  217|  1.81k|#define SECP256K1_EC_UNCOMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION)
  |  |  ------------------
  |  |  |  |  197|  1.81k|#define SECP256K1_FLAGS_TYPE_COMPRESSION (1 << 1)
  |  |  ------------------
  ------------------
  337|  1.81k|    Set(pub, pub + publen);
  338|  1.81k|    return true;
  339|  1.81k|}
_ZNK7CPubKey6DeriveERS_R9ChainCodejRKS1_P7uint256:
  341|  1.81k|bool CPubKey::Derive(CPubKey& pubkeyChild, ChainCode &ccChild, unsigned int nChild, const ChainCode& cc, uint256* bip32_tweak_out) const {
  342|  1.81k|    assert(IsValid());
  ------------------
  |  Branch (342:5): [True: 1.81k, False: 0]
  ------------------
  343|  1.81k|    assert((nChild >> 31) == 0);
  ------------------
  |  Branch (343:5): [True: 1.81k, False: 0]
  ------------------
  344|  1.81k|    assert(size() == COMPRESSED_SIZE);
  ------------------
  |  Branch (344:5): [True: 1.81k, False: 0]
  ------------------
  345|  1.81k|    unsigned char out[64];
  346|  1.81k|    BIP32Hash(cc, nChild, *begin(), begin()+1, out);
  347|  1.81k|    memcpy(ccChild.begin(), out+32, 32);
  348|  1.81k|    if (bip32_tweak_out) {
  ------------------
  |  Branch (348:9): [True: 0, False: 1.81k]
  ------------------
  349|      0|        memcpy(bip32_tweak_out->begin(), out, 32);
  350|      0|    }
  351|  1.81k|    secp256k1_pubkey pubkey;
  352|  1.81k|    if (!secp256k1_ec_pubkey_parse(secp256k1_context_static, &pubkey, vch, size())) {
  ------------------
  |  Branch (352:9): [True: 0, False: 1.81k]
  ------------------
  353|      0|        return false;
  354|      0|    }
  355|  1.81k|    if (!secp256k1_ec_pubkey_tweak_add(secp256k1_context_static, &pubkey, out)) {
  ------------------
  |  Branch (355:9): [True: 0, False: 1.81k]
  ------------------
  356|      0|        return false;
  357|      0|    }
  358|  1.81k|    unsigned char pub[COMPRESSED_SIZE];
  359|  1.81k|    size_t publen = COMPRESSED_SIZE;
  360|  1.81k|    secp256k1_ec_pubkey_serialize(secp256k1_context_static, pub, &publen, &pubkey, SECP256K1_EC_COMPRESSED);
  ------------------
  |  |  216|  1.81k|#define SECP256K1_EC_COMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION | SECP256K1_FLAGS_BIT_COMPRESSION)
  |  |  ------------------
  |  |  |  |  197|  1.81k|#define SECP256K1_FLAGS_TYPE_COMPRESSION (1 << 1)
  |  |  ------------------
  |  |               #define SECP256K1_EC_COMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION | SECP256K1_FLAGS_BIT_COMPRESSION)
  |  |  ------------------
  |  |  |  |  202|  1.81k|#define SECP256K1_FLAGS_BIT_COMPRESSION (1 << 8)
  |  |  ------------------
  ------------------
  361|  1.81k|    pubkeyChild.Set(pub, pub + publen);
  362|  1.81k|    return true;
  363|  1.81k|}
_ZN7CPubKey9CheckLowSERKNSt3__16vectorIhNS0_9allocatorIhEEEE:
  423|  3.62k|/* static */ bool CPubKey::CheckLowS(const std::vector<unsigned char>& vchSig) {
  424|  3.62k|    secp256k1_ecdsa_signature sig;
  425|  3.62k|    if (!ecdsa_signature_parse_der_lax(&sig, vchSig.data(), vchSig.size())) {
  ------------------
  |  Branch (425:9): [True: 1.81k, False: 1.81k]
  ------------------
  426|  1.81k|        return false;
  427|  1.81k|    }
  428|  1.81k|    return (!secp256k1_ecdsa_signature_normalize(secp256k1_context_static, nullptr, &sig));
  429|  3.62k|}

_ZNK7CPubKeyixEj:
  122|  59.7k|    const unsigned char& operator[](unsigned int pos) const { return vch[pos]; }
_ZN7CPubKeyC2INSt3__111__wrap_iterIPKhEEEET_S6_:
  107|  1.81k|    {
  108|  1.81k|        Set(pbegin, pend);
  109|  1.81k|    }
_ZN7CPubKey9ValidSizeERKNSt3__16vectorIhNS0_9allocatorIhEEEE:
   83|  14.4k|    bool static ValidSize(const std::vector<unsigned char> &vch) {
   84|  14.4k|      return vch.size() > 0 && GetLen(vch[0]) == vch.size();
  ------------------
  |  Branch (84:14): [True: 10.8k, False: 3.62k]
  |  Branch (84:32): [True: 9.05k, False: 1.81k]
  ------------------
   85|  14.4k|    }
_ZNK7CPubKey7GetHashEv:
  173|  1.81k|    {
  174|  1.81k|        return Hash(std::span{vch}.first(size()));
  175|  1.81k|    }
_ZeqRK7CPubKeyS1_:
  126|  16.2k|    {
  127|  16.2k|        return a.vch[0] == b.vch[0] &&
  ------------------
  |  Branch (127:16): [True: 11.7k, False: 4.52k]
  ------------------
  128|  11.7k|               memcmp(a.vch, b.vch, a.size()) == 0;
  ------------------
  |  Branch (128:16): [True: 10.8k, False: 910]
  ------------------
  129|  16.2k|    }
_ZltRK7CPubKeyS1_:
  131|  1.81k|    {
  132|  1.81k|        return a.vch[0] < b.vch[0] ||
  ------------------
  |  Branch (132:16): [True: 1.81k, False: 0]
  ------------------
  133|      0|               (a.vch[0] == b.vch[0] && memcmp(a.vch, b.vch, a.size()) < 0);
  ------------------
  |  Branch (133:17): [True: 0, False: 0]
  |  Branch (133:41): [True: 0, False: 0]
  ------------------
  134|  1.81k|    }
_ZNK7CPubKey9SerializeI10DataStreamEEvRT_:
  144|  1.81k|    {
  145|  1.81k|        unsigned int len = size();
  146|  1.81k|        ::WriteCompactSize(s, len);
  147|  1.81k|        s << std::span{vch, len};
  148|  1.81k|    }
_ZN7CPubKey11UnserializeI10DataStreamEEvRT_:
  151|  1.81k|    {
  152|  1.81k|        const unsigned int len(::ReadCompactSize(s));
  153|  1.81k|        if (len <= SIZE) {
  ------------------
  |  Branch (153:13): [True: 1.81k, False: 0]
  ------------------
  154|  1.81k|            s >> std::span{vch, len};
  155|  1.81k|            if (len != size()) {
  ------------------
  |  Branch (155:17): [True: 0, False: 1.81k]
  ------------------
  156|      0|                Invalidate();
  157|      0|            }
  158|  1.81k|        } else {
  159|       |            // invalid pubkey, skip available data
  160|      0|            s.ignore(len);
  161|      0|            Invalidate();
  162|      0|        }
  163|  1.81k|    }
_ZNK7CPubKey3endEv:
  121|  9.05k|    const unsigned char* end() const { return vch + size(); }
_ZNK7CPubKey12IsCompressedEv:
  207|  18.1k|    {
  208|  18.1k|        return size() == COMPRESSED_SIZE;
  209|  18.1k|    }
_ZNK7CPubKey4dataEv:
  119|  3.62k|    const unsigned char* data() const { return vch; }
_ZN7CPubKey6GetLenEh:
   67|   218k|    {
   68|   218k|        if (chHeader == 2 || chHeader == 3)
  ------------------
  |  Branch (68:13): [True: 104k, False: 114k]
  |  Branch (68:30): [True: 105k, False: 9.05k]
  ------------------
   69|   209k|            return COMPRESSED_SIZE;
   70|  9.05k|        if (chHeader == 4 || chHeader == 6 || chHeader == 7)
  ------------------
  |  Branch (70:13): [True: 5.43k, False: 3.62k]
  |  Branch (70:30): [True: 0, False: 3.62k]
  |  Branch (70:47): [True: 0, False: 3.62k]
  ------------------
   71|  5.43k|            return SIZE;
   72|  3.62k|        return 0;
   73|  9.05k|    }
_ZN7CPubKey10InvalidateEv:
   77|  18.1k|    {
   78|  18.1k|        vch[0] = 0xFF;
   79|  18.1k|    }
_ZN7CPubKeyC2ENSt3__14spanIKhLm18446744073709551615EEE:
  113|  3.62k|    {
  114|  3.62k|        Set(_vch.begin(), _vch.end());
  115|  3.62k|    }
_ZNK7CPubKey4sizeEv:
  118|   194k|    unsigned int size() const { return GetLen(vch[0]); }
_ZNK7CPubKey7IsValidEv:
  192|  30.7k|    {
  193|  30.7k|        return size() > 0;
  194|  30.7k|    }
_ZN7CPubKey3SetINSt3__111__wrap_iterIPKhEEEEvT_S6_:
   96|  7.24k|    {
   97|  7.24k|        int len = pend == pbegin ? 0 : GetLen(pbegin[0]);
  ------------------
  |  Branch (97:19): [True: 0, False: 7.24k]
  ------------------
   98|  7.24k|        if (len && len == (pend - pbegin))
  ------------------
  |  Branch (98:13): [True: 7.24k, False: 0]
  |  Branch (98:20): [True: 7.24k, False: 0]
  ------------------
   99|  7.24k|            memcpy(vch, (unsigned char*)&pbegin[0], len);
  100|      0|        else
  101|      0|            Invalidate();
  102|  7.24k|    }
_ZN7CPubKeyC2Ev:
   89|  18.1k|    {
   90|  18.1k|        Invalidate();
   91|  18.1k|    }
_ZNK7CPubKey5GetIDEv:
  167|  19.9k|    {
  168|  19.9k|        return CKeyID(Hash160(std::span{vch}.first(size())));
  169|  19.9k|    }
_ZN6CKeyIDC2ERK7uint160:
   29|  21.7k|    explicit CKeyID(const uint160& in) : uint160(in) {}
_ZNK7CPubKey5beginEv:
  120|  28.9k|    const unsigned char* begin() const { return vch; }
_ZN7CPubKey3SetIPhEEvT_S2_:
   96|  5.43k|    {
   97|  5.43k|        int len = pend == pbegin ? 0 : GetLen(pbegin[0]);
  ------------------
  |  Branch (97:19): [True: 0, False: 5.43k]
  ------------------
   98|  5.43k|        if (len && len == (pend - pbegin))
  ------------------
  |  Branch (98:13): [True: 5.43k, False: 0]
  |  Branch (98:20): [True: 5.43k, False: 0]
  ------------------
   99|  5.43k|            memcpy(vch, (unsigned char*)&pbegin[0], len);
  100|      0|        else
  101|      0|            Invalidate();
  102|  5.43k|    }

_Z30MakeRandDeterministicDANGEROUSRK7uint256:
  596|  1.88k|{
  597|  1.88k|    GetRNGState().MakeDeterministic(seed);
  598|  1.88k|}
_Z12GetRandBytesNSt3__14spanIhLm18446744073709551615EEE:
  602|  3.62k|{
  603|  3.62k|    g_used_g_prng = true;
  604|  3.62k|    ProcRand(bytes.data(), bytes.size(), RNGLevel::FAST, /*always_use_real_rng=*/false);
  605|  3.62k|}
random.cpp:_ZN12_GLOBAL__N_111GetRNGStateEv:
  451|  5.50k|{
  452|       |    // This idiom relies on the guarantee that static variable are initialized
  453|       |    // on first call, even when multiple parallel calls are permitted.
  454|  5.50k|    static std::vector<RNGState, secure_allocator<RNGState>> g_rng(1);
  455|  5.50k|    return g_rng[0];
  456|  5.50k|}
random.cpp:_ZN12_GLOBAL__N_18RNGStateD2Ev:
  367|      2|    ~RNGState() = default;
random.cpp:_ZN12_GLOBAL__N_18RNGState17MakeDeterministicERK7uint256:
  400|  1.88k|    {
  401|  1.88k|        LOCK(m_mutex);
  ------------------
  |  |  268|  1.88k|#define LOCK(cs) UniqueLock BITCOIN_UNIQUE_NAME(criticalblock)(MaybeCheckNotHeld(cs), #cs, __FILE__, __LINE__)
  |  |  ------------------
  |  |  |  |   11|  1.88k|#define BITCOIN_UNIQUE_NAME(name) PASTE2(name, __COUNTER__)
  |  |  |  |  ------------------
  |  |  |  |  |  |    9|  1.88k|#define PASTE2(x, y) PASTE(x, y)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |    8|  1.88k|#define PASTE(x, y) x ## y
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  402|  1.88k|        m_deterministic_prng.emplace(MakeByteSpan(seed));
  403|  1.88k|    }
random.cpp:_ZN12_GLOBAL__N_18ProcRandEPhiNS_8RNGLevelEb:
  563|  3.62k|{
  564|       |    // Make sure the RNG is initialized first (as all Seed* function possibly need hwrand to be available).
  565|  3.62k|    RNGState& rng = GetRNGState();
  566|       |
  567|  3.62k|    assert(num <= 32);
  ------------------
  |  Branch (567:5): [True: 3.62k, False: 0]
  ------------------
  568|       |
  569|  3.62k|    CSHA512 hasher;
  570|  3.62k|    switch (level) {
  ------------------
  |  Branch (570:13): [True: 3.62k, False: 0]
  ------------------
  571|  3.62k|    case RNGLevel::FAST:
  ------------------
  |  Branch (571:5): [True: 3.62k, False: 0]
  ------------------
  572|  3.62k|        SeedFast(hasher);
  573|  3.62k|        break;
  574|      0|    case RNGLevel::SLOW:
  ------------------
  |  Branch (574:5): [True: 0, False: 3.62k]
  ------------------
  575|      0|        SeedSlow(hasher, rng);
  576|      0|        break;
  577|      0|    case RNGLevel::PERIODIC:
  ------------------
  |  Branch (577:5): [True: 0, False: 3.62k]
  ------------------
  578|      0|        SeedPeriodic(hasher, rng);
  579|      0|        break;
  580|  3.62k|    }
  581|       |
  582|       |    // Combine with and update state
  583|  3.62k|    if (!rng.MixExtract(out, num, std::move(hasher), false, always_use_real_rng)) {
  ------------------
  |  Branch (583:9): [True: 0, False: 3.62k]
  ------------------
  584|       |        // On the first invocation, also seed with SeedStartup().
  585|      0|        CSHA512 startup_hasher;
  586|      0|        SeedStartup(startup_hasher, rng);
  587|      0|        rng.MixExtract(out, num, std::move(startup_hasher), true, always_use_real_rng);
  588|      0|    }
  589|  3.62k|}
random.cpp:_ZN12_GLOBAL__N_18SeedFastER7CSHA512:
  470|  3.62k|{
  471|  3.62k|    unsigned char buffer[32];
  472|       |
  473|       |    // Stack pointer to indirectly commit to thread/callstack
  474|  3.62k|    const unsigned char* ptr = buffer;
  475|  3.62k|    hasher.Write((const unsigned char*)&ptr, sizeof(ptr));
  476|       |
  477|       |    // Hardware randomness is very fast when available; use it always.
  478|  3.62k|    SeedHardwareFast(hasher);
  479|       |
  480|       |    // High-precision timestamp
  481|  3.62k|    SeedTimestamp(hasher);
  482|  3.62k|}
random.cpp:_ZN12_GLOBAL__N_116SeedHardwareFastER7CSHA512:
  199|  3.62k|void SeedHardwareFast(CSHA512& hasher) noexcept {
  200|  3.62k|#if defined(__x86_64__) || defined(__amd64__) || defined(__i386__)
  201|  3.62k|    if (g_rdrand_supported) {
  ------------------
  |  Branch (201:9): [True: 3.62k, False: 0]
  ------------------
  202|  3.62k|        uint64_t out = GetRdRand();
  203|  3.62k|        hasher.Write((const unsigned char*)&out, sizeof(out));
  204|  3.62k|        return;
  205|  3.62k|    }
  206|  3.62k|#endif
  207|  3.62k|}
random.cpp:_ZN12_GLOBAL__N_19GetRdRandEv:
  122|  3.62k|{
  123|       |    // RdRand may very rarely fail. Invoke it up to 10 times in a loop to reduce this risk.
  124|       |#ifdef __i386__
  125|       |    uint8_t ok = 0;
  126|       |    // Initialize to 0 to silence a compiler warning that r1 or r2 may be used
  127|       |    // uninitialized. Even if rdrand fails (!ok) it will set the output to 0,
  128|       |    // but there is no way that the compiler could know that.
  129|       |    uint32_t r1 = 0, r2 = 0;
  130|       |    for (int i = 0; i < 10; ++i) {
  131|       |        __asm__ volatile (".byte 0x0f, 0xc7, 0xf0; setc %1" : "=a"(r1), "=q"(ok) :: "cc"); // rdrand %eax
  132|       |        if (ok) break;
  133|       |    }
  134|       |    for (int i = 0; i < 10; ++i) {
  135|       |        __asm__ volatile (".byte 0x0f, 0xc7, 0xf0; setc %1" : "=a"(r2), "=q"(ok) :: "cc"); // rdrand %eax
  136|       |        if (ok) break;
  137|       |    }
  138|       |    return (((uint64_t)r2) << 32) | r1;
  139|       |#elif defined(__x86_64__) || defined(__amd64__)
  140|       |    uint8_t ok = 0;
  141|  3.62k|    uint64_t r1 = 0; // See above why we initialize to 0.
  142|  3.62k|    for (int i = 0; i < 10; ++i) {
  ------------------
  |  Branch (142:21): [True: 3.62k, False: 0]
  ------------------
  143|  3.62k|        __asm__ volatile (".byte 0x48, 0x0f, 0xc7, 0xf0; setc %1" : "=a"(r1), "=q"(ok) :: "cc"); // rdrand %rax
  144|  3.62k|        if (ok) break;
  ------------------
  |  Branch (144:13): [True: 3.62k, False: 0]
  ------------------
  145|  3.62k|    }
  146|  3.62k|    return r1;
  147|       |#else
  148|       |#error "RdRand is only supported on x86 and x86_64"
  149|       |#endif
  150|  3.62k|}
random.cpp:_ZN12_GLOBAL__N_113SeedTimestampER7CSHA512:
  464|  3.62k|{
  465|  3.62k|    int64_t perfcounter = GetPerformanceCounter();
  466|  3.62k|    hasher.Write((const unsigned char*)&perfcounter, sizeof(perfcounter));
  467|  3.62k|}
random.cpp:_ZN12_GLOBAL__N_121GetPerformanceCounterEv:
   61|  3.62k|{
   62|       |    // Read the hardware time stamp counter when available.
   63|       |    // See https://en.wikipedia.org/wiki/Time_Stamp_Counter for more information.
   64|       |#if defined(_MSC_VER) && (defined(_M_IX86) || defined(_M_X64))
   65|       |    return __rdtsc();
   66|       |#elif !defined(_MSC_VER) && defined(__i386__)
   67|       |    uint64_t r = 0;
   68|       |    __asm__ volatile ("rdtsc" : "=A"(r)); // Constrain the r variable to the eax:edx pair.
   69|       |    return r;
   70|       |#elif !defined(_MSC_VER) && (defined(__x86_64__) || defined(__amd64__))
   71|       |    uint64_t r1 = 0, r2 = 0;
   72|  3.62k|    __asm__ volatile ("rdtsc" : "=a"(r1), "=d"(r2)); // Constrain r1 to rax and r2 to rdx.
   73|  3.62k|    return (r2 << 32) | r1;
   74|       |#else
   75|       |    // Fall back to using standard library clock (usually microsecond or nanosecond precision)
   76|       |    return std::chrono::high_resolution_clock::now().time_since_epoch().count();
   77|       |#endif
   78|  3.62k|}
random.cpp:_ZN12_GLOBAL__N_18RNGState10MixExtractEPhmO7CSHA512bb:
  413|  3.62k|    {
  414|  3.62k|        assert(num <= 32);
  ------------------
  |  Branch (414:9): [True: 3.62k, False: 0]
  ------------------
  415|  3.62k|        unsigned char buf[64];
  416|  3.62k|        static_assert(sizeof(buf) == CSHA512::OUTPUT_SIZE, "Buffer needs to have hasher's output size");
  417|  3.62k|        bool ret;
  418|  3.62k|        {
  419|  3.62k|            LOCK(m_mutex);
  ------------------
  |  |  268|  3.62k|#define LOCK(cs) UniqueLock BITCOIN_UNIQUE_NAME(criticalblock)(MaybeCheckNotHeld(cs), #cs, __FILE__, __LINE__)
  |  |  ------------------
  |  |  |  |   11|  3.62k|#define BITCOIN_UNIQUE_NAME(name) PASTE2(name, __COUNTER__)
  |  |  |  |  ------------------
  |  |  |  |  |  |    9|  3.62k|#define PASTE2(x, y) PASTE(x, y)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |    8|  3.62k|#define PASTE(x, y) x ## y
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  420|  3.62k|            ret = (m_strongly_seeded |= strong_seed);
  421|       |            // Write the current state of the RNG into the hasher
  422|  3.62k|            hasher.Write(m_state, 32);
  423|       |            // Write a new counter number into the state
  424|  3.62k|            hasher.Write((const unsigned char*)&m_counter, sizeof(m_counter));
  425|  3.62k|            ++m_counter;
  426|       |            // Finalize the hasher
  427|  3.62k|            hasher.Finalize(buf);
  428|       |            // Store the last 32 bytes of the hash output as new RNG state.
  429|  3.62k|            memcpy(m_state, buf + 32, 32);
  430|       |            // Handle requests for deterministic randomness.
  431|  3.62k|            if (!always_use_real_rng && m_deterministic_prng.has_value()) [[unlikely]] {
  ------------------
  |  Branch (431:17): [True: 3.62k, False: 0]
  |  Branch (431:41): [True: 3.62k, False: 0]
  ------------------
  432|       |                // Overwrite the beginning of buf, which will be used for output.
  433|  3.62k|                m_deterministic_prng->Keystream(std::as_writable_bytes(std::span{buf, num}));
  434|       |                // Do not require strong seeding for deterministic output.
  435|  3.62k|                ret = true;
  436|  3.62k|            }
  437|  3.62k|        }
  438|       |        // If desired, copy (up to) the first 32 bytes of the hash output as output.
  439|  3.62k|        if (num) {
  ------------------
  |  Branch (439:13): [True: 3.62k, False: 0]
  ------------------
  440|  3.62k|            assert(out != nullptr);
  ------------------
  |  Branch (440:13): [True: 3.62k, False: 0]
  ------------------
  441|  3.62k|            memcpy(out, buf, num);
  442|  3.62k|        }
  443|       |        // Best effort cleanup of internal state
  444|  3.62k|        hasher.Reset();
  445|  3.62k|        memory_cleanse(buf, 64);
  446|  3.62k|        return ret;
  447|  3.62k|    }

_Z11HexToPubKeyRKNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEE:
  221|  1.81k|{
  222|  1.81k|    if (!IsHex(hex_in)) {
  ------------------
  |  Branch (222:9): [True: 0, False: 1.81k]
  ------------------
  223|      0|        throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, "Pubkey \"" + hex_in + "\" must be a hex string");
  224|      0|    }
  225|  1.81k|    if (hex_in.length() != 66 && hex_in.length() != 130) {
  ------------------
  |  Branch (225:9): [True: 0, False: 1.81k]
  |  Branch (225:34): [True: 0, False: 0]
  ------------------
  226|      0|        throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, "Pubkey \"" + hex_in + "\" must have a length of either 33 or 65 bytes");
  227|      0|    }
  228|  1.81k|    CPubKey vchPubKey(ParseHex(hex_in));
  229|  1.81k|    if (!vchPubKey.IsFullyValid()) {
  ------------------
  |  Branch (229:9): [True: 0, False: 1.81k]
  ------------------
  230|      0|        throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, "Pubkey \"" + hex_in + "\" must be cryptographically valid.");
  231|      0|    }
  232|  1.81k|    return vchPubKey;
  233|  1.81k|}

_ZN20BaseSignatureCheckerD2Ev:
  298|      2|    virtual ~BaseSignatureChecker() = default;

_ZN9CScriptIDC2ERK7CScript:
   17|  3.62k|CScriptID::CScriptID(const CScript& in) : BaseHash(Hash160(in)) {}
_ZNK7CScript17IsPayToScriptHashEv:
  225|  14.4k|{
  226|       |    // Extra-fast test for pay-to-script-hash CScripts:
  227|  14.4k|    return (this->size() == 23 &&
  ------------------
  |  Branch (227:13): [True: 0, False: 14.4k]
  ------------------
  228|      0|            (*this)[0] == OP_HASH160 &&
  ------------------
  |  Branch (228:13): [True: 0, False: 0]
  ------------------
  229|      0|            (*this)[1] == 0x14 &&
  ------------------
  |  Branch (229:13): [True: 0, False: 0]
  ------------------
  230|      0|            (*this)[22] == OP_EQUAL);
  ------------------
  |  Branch (230:13): [True: 0, False: 0]
  ------------------
  231|  14.4k|}
_ZNK7CScript24IsPayToWitnessScriptHashEv:
  234|  3.62k|{
  235|       |    // Extra-fast test for pay-to-witness-script-hash CScripts:
  236|  3.62k|    return (this->size() == 34 &&
  ------------------
  |  Branch (236:13): [True: 0, False: 3.62k]
  ------------------
  237|      0|            (*this)[0] == OP_0 &&
  ------------------
  |  Branch (237:13): [True: 0, False: 0]
  ------------------
  238|      0|            (*this)[1] == 0x20);
  ------------------
  |  Branch (238:13): [True: 0, False: 0]
  ------------------
  239|  3.62k|}
_ZNK7CScript16IsWitnessProgramERiRNSt3__16vectorIhNS1_9allocatorIhEEEE:
  251|  10.8k|{
  252|  10.8k|    if (this->size() < 4 || this->size() > 42) {
  ------------------
  |  Branch (252:9): [True: 0, False: 10.8k]
  |  Branch (252:29): [True: 0, False: 10.8k]
  ------------------
  253|      0|        return false;
  254|      0|    }
  255|  10.8k|    if ((*this)[0] != OP_0 && ((*this)[0] < OP_1 || (*this)[0] > OP_16)) {
  ------------------
  |  Branch (255:9): [True: 10.8k, False: 0]
  |  Branch (255:32): [True: 5.43k, False: 5.43k]
  |  Branch (255:53): [True: 0, False: 5.43k]
  ------------------
  256|  5.43k|        return false;
  257|  5.43k|    }
  258|  5.43k|    if ((size_t)((*this)[1] + 2) == this->size()) {
  ------------------
  |  Branch (258:9): [True: 0, False: 5.43k]
  ------------------
  259|      0|        version = DecodeOP_N((opcodetype)(*this)[0]);
  260|      0|        program = std::vector<unsigned char>(this->begin() + 2, this->end());
  261|      0|        return true;
  262|      0|    }
  263|  5.43k|    return false;
  264|  5.43k|}
_ZNK7CScript10IsPushOnlyEN9prevectorILj36EhjiE14const_iteratorE:
  267|  3.62k|{
  268|  10.8k|    while (pc < end())
  ------------------
  |  Branch (268:12): [True: 10.8k, False: 0]
  ------------------
  269|  10.8k|    {
  270|  10.8k|        opcodetype opcode;
  271|  10.8k|        if (!GetOp(pc, opcode))
  ------------------
  |  Branch (271:13): [True: 0, False: 10.8k]
  ------------------
  272|      0|            return false;
  273|       |        // Note that IsPushOnly() *does* consider OP_RESERVED to be a
  274|       |        // push-type opcode, however execution of OP_RESERVED fails, so
  275|       |        // it's not relevant to P2SH/BIP62 as the scriptSig would fail prior to
  276|       |        // the P2SH special validation code being executed.
  277|  10.8k|        if (opcode > OP_16)
  ------------------
  |  Branch (277:13): [True: 3.62k, False: 7.24k]
  ------------------
  278|  3.62k|            return false;
  279|  10.8k|    }
  280|      0|    return true;
  281|  3.62k|}
_ZNK7CScript10IsPushOnlyEv:
  284|  3.62k|{
  285|  3.62k|    return this->IsPushOnly(begin());
  286|  3.62k|}
_ZNK7CScript11HasValidOpsEv:
  301|  3.62k|{
  302|  3.62k|    CScript::const_iterator it = begin();
  303|  14.4k|    while (it < end()) {
  ------------------
  |  Branch (303:12): [True: 10.8k, False: 3.62k]
  ------------------
  304|  10.8k|        opcodetype opcode;
  305|  10.8k|        std::vector<unsigned char> item;
  306|  10.8k|        if (!GetOp(it, opcode, item) || opcode > MAX_OPCODE || item.size() > MAX_SCRIPT_ELEMENT_SIZE) {
  ------------------
  |  Branch (306:13): [True: 0, False: 10.8k]
  |  Branch (306:41): [True: 0, False: 10.8k]
  |  Branch (306:64): [True: 0, False: 10.8k]
  ------------------
  307|      0|            return false;
  308|      0|        }
  309|  10.8k|    }
  310|  3.62k|    return true;
  311|  3.62k|}
_Z11GetScriptOpRN9prevectorILj36EhjiE14const_iteratorES1_R10opcodetypePNSt3__16vectorIhNS5_9allocatorIhEEEE:
  314|  32.5k|{
  315|  32.5k|    opcodeRet = OP_INVALIDOPCODE;
  316|  32.5k|    if (pvchRet)
  ------------------
  |  Branch (316:9): [True: 21.7k, False: 10.8k]
  ------------------
  317|  21.7k|        pvchRet->clear();
  318|  32.5k|    if (pc >= end)
  ------------------
  |  Branch (318:9): [True: 0, False: 32.5k]
  ------------------
  319|      0|        return false;
  320|       |
  321|       |    // Read instruction
  322|  32.5k|    if (end - pc < 1)
  ------------------
  |  Branch (322:9): [True: 0, False: 32.5k]
  ------------------
  323|      0|        return false;
  324|  32.5k|    unsigned int opcode = *pc++;
  325|       |
  326|       |    // Immediate operand
  327|  32.5k|    if (opcode <= OP_PUSHDATA4)
  ------------------
  |  Branch (327:9): [True: 10.8k, False: 21.7k]
  ------------------
  328|  10.8k|    {
  329|  10.8k|        unsigned int nSize = 0;
  330|  10.8k|        if (opcode < OP_PUSHDATA1)
  ------------------
  |  Branch (330:13): [True: 10.8k, False: 0]
  ------------------
  331|  10.8k|        {
  332|  10.8k|            nSize = opcode;
  333|  10.8k|        }
  334|      0|        else if (opcode == OP_PUSHDATA1)
  ------------------
  |  Branch (334:18): [True: 0, False: 0]
  ------------------
  335|      0|        {
  336|      0|            if (end - pc < 1)
  ------------------
  |  Branch (336:17): [True: 0, False: 0]
  ------------------
  337|      0|                return false;
  338|      0|            nSize = *pc++;
  339|      0|        }
  340|      0|        else if (opcode == OP_PUSHDATA2)
  ------------------
  |  Branch (340:18): [True: 0, False: 0]
  ------------------
  341|      0|        {
  342|      0|            if (end - pc < 2)
  ------------------
  |  Branch (342:17): [True: 0, False: 0]
  ------------------
  343|      0|                return false;
  344|      0|            nSize = ReadLE16(&pc[0]);
  345|      0|            pc += 2;
  346|      0|        }
  347|      0|        else if (opcode == OP_PUSHDATA4)
  ------------------
  |  Branch (347:18): [True: 0, False: 0]
  ------------------
  348|      0|        {
  349|      0|            if (end - pc < 4)
  ------------------
  |  Branch (349:17): [True: 0, False: 0]
  ------------------
  350|      0|                return false;
  351|      0|            nSize = ReadLE32(&pc[0]);
  352|      0|            pc += 4;
  353|      0|        }
  354|  10.8k|        if (end - pc < 0 || (unsigned int)(end - pc) < nSize)
  ------------------
  |  Branch (354:13): [True: 0, False: 10.8k]
  |  Branch (354:29): [True: 0, False: 10.8k]
  ------------------
  355|      0|            return false;
  356|  10.8k|        if (pvchRet)
  ------------------
  |  Branch (356:13): [True: 7.24k, False: 3.62k]
  ------------------
  357|  7.24k|            pvchRet->assign(pc, pc + nSize);
  358|  10.8k|        pc += nSize;
  359|  10.8k|    }
  360|       |
  361|  32.5k|    opcodeRet = static_cast<opcodetype>(opcode);
  362|  32.5k|    return true;
  363|  32.5k|}

_Z12ToByteVectorI6PKHashENSt3__16vectorIhNS1_9allocatorIhEEEERKT_:
   69|  1.81k|{
   70|  1.81k|    return std::vector<unsigned char>(in.begin(), in.end());
   71|  1.81k|}
_Z12ToByteVectorI16WitnessV0KeyHashENSt3__16vectorIhNS1_9allocatorIhEEEERKT_:
   69|  3.62k|{
   70|  3.62k|    return std::vector<unsigned char>(in.begin(), in.end());
   71|  3.62k|}
_Z12ToByteVectorI7CPubKeyENSt3__16vectorIhNS1_9allocatorIhEEEERKT_:
   69|  1.81k|{
   70|  1.81k|    return std::vector<unsigned char>(in.begin(), in.end());
   71|  1.81k|}
_ZNK7CScript13IsUnspendableEv:
  565|  3.62k|    {
  566|  3.62k|        return (size() > 0 && *begin() == OP_RETURN) || (size() > MAX_SCRIPT_SIZE);
  ------------------
  |  Branch (566:17): [True: 3.62k, False: 0]
  |  Branch (566:31): [True: 0, False: 3.62k]
  |  Branch (566:57): [True: 0, False: 3.62k]
  ------------------
  567|  3.62k|    }
_ZN7CScriptlsEl:
  468|  3.62k|    CScript& operator<<(int64_t b) LIFETIMEBOUND { return push_int64(b); }
_ZN7CScript10push_int64El:
  435|  3.62k|    {
  436|  3.62k|        if (n == -1 || (n >= 1 && n <= 16))
  ------------------
  |  Branch (436:13): [True: 0, False: 3.62k]
  |  Branch (436:25): [True: 3.62k, False: 0]
  |  Branch (436:35): [True: 3.62k, False: 0]
  ------------------
  437|  3.62k|        {
  438|  3.62k|            push_back(n + (OP_1 - 1));
  439|  3.62k|        }
  440|      0|        else if (n == 0)
  ------------------
  |  Branch (440:18): [True: 0, False: 0]
  ------------------
  441|      0|        {
  442|      0|            push_back(OP_0);
  443|      0|        }
  444|      0|        else
  445|      0|        {
  446|      0|            *this << CScriptNum::serialize(n);
  447|      0|        }
  448|  3.62k|        return *this;
  449|  3.62k|    }
_ZNK7CScript5GetOpERN9prevectorILj36EhjiE14const_iteratorER10opcodetypeRNSt3__16vectorIhNS6_9allocatorIhEEEE:
  498|  21.7k|    {
  499|  21.7k|        return GetScriptOp(pc, end(), opcodeRet, &vchRet);
  500|  21.7k|    }
_ZNK7CScript5GetOpERN9prevectorILj36EhjiE14const_iteratorER10opcodetype:
  503|  10.8k|    {
  504|  10.8k|        return GetScriptOp(pc, end(), opcodeRet, nullptr);
  505|  10.8k|    }
_ZN7CScriptC2Ev:
  452|  12.6k|    CScript() = default;
_ZN7CScriptlsENSt3__14spanIKhLm18446744073709551615EEE:
  493|  9.05k|    {
  494|  9.05k|        return *this << std::as_bytes(b);
  495|  9.05k|    }
_ZN7CScriptlsENSt3__14spanIKSt4byteLm18446744073709551615EEE:
  485|  9.05k|    {
  486|  9.05k|        AppendDataSize(b.size());
  487|  9.05k|        AppendData({reinterpret_cast<const value_type*>(b.data()), b.size()});
  488|  9.05k|        return *this;
  489|  9.05k|    }
_ZN7CScript14AppendDataSizeEj:
  409|  9.05k|    {
  410|  9.05k|        if (size < OP_PUSHDATA1) {
  ------------------
  |  Branch (410:13): [True: 9.05k, False: 0]
  ------------------
  411|  9.05k|            insert(end(), static_cast<value_type>(size));
  412|  9.05k|        } else if (size <= 0xff) {
  ------------------
  |  Branch (412:20): [True: 0, False: 0]
  ------------------
  413|      0|            insert(end(), OP_PUSHDATA1);
  414|      0|            insert(end(), static_cast<value_type>(size));
  415|      0|        } else if (size <= 0xffff) {
  ------------------
  |  Branch (415:20): [True: 0, False: 0]
  ------------------
  416|      0|            insert(end(), OP_PUSHDATA2);
  417|      0|            value_type data[2];
  418|      0|            WriteLE16(data, size);
  419|      0|            insert(end(), std::cbegin(data), std::cend(data));
  420|      0|        } else {
  421|      0|            insert(end(), OP_PUSHDATA4);
  422|      0|            value_type data[4];
  423|      0|            WriteLE32(data, size);
  424|      0|            insert(end(), std::cbegin(data), std::cend(data));
  425|      0|        }
  426|  9.05k|    }
_ZN7CScript10AppendDataENSt3__14spanIKhLm18446744073709551615EEE:
  429|  9.05k|    {
  430|  9.05k|        insert(end(), data.begin(), data.end());
  431|  9.05k|    }
_ZN7CScriptlsE10opcodetype:
  471|  14.4k|    {
  472|  14.4k|        if (opcode < 0 || opcode > 0xff)
  ------------------
  |  Branch (472:13): [True: 0, False: 14.4k]
  |  Branch (472:27): [True: 0, False: 14.4k]
  ------------------
  473|      0|            throw std::runtime_error("CScript::operator<<(): invalid opcode");
  474|  14.4k|        insert(end(), (unsigned char)opcode);
  475|  14.4k|        return *this;
  476|  14.4k|    }
_ZN7CScript10DecodeOP_NE10opcodetype:
  509|  7.24k|    {
  510|  7.24k|        if (opcode == OP_0)
  ------------------
  |  Branch (510:13): [True: 0, False: 7.24k]
  ------------------
  511|      0|            return 0;
  512|  7.24k|        assert(opcode >= OP_1 && opcode <= OP_16);
  ------------------
  |  Branch (512:9): [True: 7.24k, False: 0]
  |  Branch (512:9): [True: 7.24k, False: 0]
  |  Branch (512:9): [True: 7.24k, False: 0]
  ------------------
  513|  7.24k|        return (int)opcode - (int)(OP_1 - 1);
  514|  7.24k|    }

_Z14IsSegWitOutputRK15SigningProviderRK7CScript:
 1007|  3.62k|{
 1008|  3.62k|    int version;
 1009|  3.62k|    valtype program;
 1010|  3.62k|    if (script.IsWitnessProgram(version, program)) return true;
  ------------------
  |  Branch (1010:9): [True: 0, False: 3.62k]
  ------------------
 1011|  3.62k|    if (script.IsPayToScriptHash()) {
  ------------------
  |  Branch (1011:9): [True: 0, False: 3.62k]
  ------------------
 1012|      0|        std::vector<valtype> solutions;
 1013|      0|        auto whichtype = Solver(script, solutions);
 1014|      0|        if (whichtype == TxoutType::SCRIPTHASH) {
  ------------------
  |  Branch (1014:13): [True: 0, False: 0]
  ------------------
 1015|      0|            auto h160 = uint160(solutions[0]);
 1016|      0|            CScript subscript;
 1017|      0|            if (provider.GetCScript(CScriptID{h160}, subscript)) {
  ------------------
  |  Branch (1017:17): [True: 0, False: 0]
  ------------------
 1018|      0|                if (subscript.IsWitnessProgram(version, program)) return true;
  ------------------
  |  Branch (1018:21): [True: 0, False: 0]
  ------------------
 1019|      0|            }
 1020|      0|        }
 1021|      0|    }
 1022|  3.62k|    return false;
 1023|  3.62k|}

_ZN20BaseSignatureCreatorD2Ev:
   41|      4|    virtual ~BaseSignatureCreator() = default;

_ZN23FillableSigningProvider32ImplicitlyLearnRelatedKeyScriptsERK7CPubKey:
  164|  3.62k|{
  165|  3.62k|    AssertLockHeld(cs_KeyStore);
  ------------------
  |  |  144|  3.62k|#define AssertLockHeld(cs) AssertLockHeldInternal(#cs, __FILE__, __LINE__, &cs)
  ------------------
  166|  3.62k|    CKeyID key_id = pubkey.GetID();
  167|       |    // This adds the redeemscripts necessary to detect P2WPKH and P2SH-P2WPKH
  168|       |    // outputs. Technically P2WPKH outputs don't have a redeemscript to be
  169|       |    // spent. However, our current IsMine logic requires the corresponding
  170|       |    // P2SH-P2WPKH redeemscript to be present in the wallet in order to accept
  171|       |    // payment even to P2WPKH outputs.
  172|       |    // Also note that having superfluous scripts in the keystore never hurts.
  173|       |    // They're only used to guide recursion in signing and IsMine logic - if
  174|       |    // a script is present but we can't do anything with it, it has no effect.
  175|       |    // "Implicitly" refers to fact that scripts are derived automatically from
  176|       |    // existing keys, and are present in memory, even without being explicitly
  177|       |    // loaded (e.g. from a file).
  178|  3.62k|    if (pubkey.IsCompressed()) {
  ------------------
  |  Branch (178:9): [True: 3.62k, False: 0]
  ------------------
  179|  3.62k|        CScript script = GetScriptForDestination(WitnessV0KeyHash(key_id));
  180|       |        // This does not use AddCScript, as it may be overridden.
  181|  3.62k|        CScriptID id(script);
  182|  3.62k|        mapScripts[id] = std::move(script);
  183|  3.62k|    }
  184|  3.62k|}
_ZNK23FillableSigningProvider9GetPubKeyERK6CKeyIDR7CPubKey:
  187|  1.81k|{
  188|  1.81k|    CKey key;
  189|  1.81k|    if (!GetKey(address, key)) {
  ------------------
  |  Branch (189:9): [True: 0, False: 1.81k]
  ------------------
  190|      0|        return false;
  191|      0|    }
  192|  1.81k|    vchPubKeyOut = key.GetPubKey();
  193|  1.81k|    return true;
  194|  1.81k|}
_ZN23FillableSigningProvider12AddKeyPubKeyERK4CKeyRK7CPubKey:
  197|  3.62k|{
  198|  3.62k|    LOCK(cs_KeyStore);
  ------------------
  |  |  268|  3.62k|#define LOCK(cs) UniqueLock BITCOIN_UNIQUE_NAME(criticalblock)(MaybeCheckNotHeld(cs), #cs, __FILE__, __LINE__)
  |  |  ------------------
  |  |  |  |   11|  3.62k|#define BITCOIN_UNIQUE_NAME(name) PASTE2(name, __COUNTER__)
  |  |  |  |  ------------------
  |  |  |  |  |  |    9|  3.62k|#define PASTE2(x, y) PASTE(x, y)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |    8|  3.62k|#define PASTE(x, y) x ## y
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  199|  3.62k|    mapKeys[pubkey.GetID()] = key;
  200|  3.62k|    ImplicitlyLearnRelatedKeyScripts(pubkey);
  201|  3.62k|    return true;
  202|  3.62k|}
_ZNK23FillableSigningProvider7HaveKeyERK6CKeyID:
  205|  9.05k|{
  206|  9.05k|    LOCK(cs_KeyStore);
  ------------------
  |  |  268|  9.05k|#define LOCK(cs) UniqueLock BITCOIN_UNIQUE_NAME(criticalblock)(MaybeCheckNotHeld(cs), #cs, __FILE__, __LINE__)
  |  |  ------------------
  |  |  |  |   11|  9.05k|#define BITCOIN_UNIQUE_NAME(name) PASTE2(name, __COUNTER__)
  |  |  |  |  ------------------
  |  |  |  |  |  |    9|  9.05k|#define PASTE2(x, y) PASTE(x, y)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |    8|  9.05k|#define PASTE(x, y) x ## y
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  207|  9.05k|    return mapKeys.contains(address);
  208|  9.05k|}
_ZNK23FillableSigningProvider7GetKeysEv:
  211|  3.62k|{
  212|  3.62k|    LOCK(cs_KeyStore);
  ------------------
  |  |  268|  3.62k|#define LOCK(cs) UniqueLock BITCOIN_UNIQUE_NAME(criticalblock)(MaybeCheckNotHeld(cs), #cs, __FILE__, __LINE__)
  |  |  ------------------
  |  |  |  |   11|  3.62k|#define BITCOIN_UNIQUE_NAME(name) PASTE2(name, __COUNTER__)
  |  |  |  |  ------------------
  |  |  |  |  |  |    9|  3.62k|#define PASTE2(x, y) PASTE(x, y)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |    8|  3.62k|#define PASTE(x, y) x ## y
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  213|  3.62k|    std::set<CKeyID> set_address;
  214|  3.62k|    for (const auto& mi : mapKeys) {
  ------------------
  |  Branch (214:25): [True: 1.81k, False: 3.62k]
  ------------------
  215|  1.81k|        set_address.insert(mi.first);
  216|  1.81k|    }
  217|  3.62k|    return set_address;
  218|  3.62k|}
_ZNK23FillableSigningProvider6GetKeyERK6CKeyIDR4CKey:
  221|  3.62k|{
  222|  3.62k|    LOCK(cs_KeyStore);
  ------------------
  |  |  268|  3.62k|#define LOCK(cs) UniqueLock BITCOIN_UNIQUE_NAME(criticalblock)(MaybeCheckNotHeld(cs), #cs, __FILE__, __LINE__)
  |  |  ------------------
  |  |  |  |   11|  3.62k|#define BITCOIN_UNIQUE_NAME(name) PASTE2(name, __COUNTER__)
  |  |  |  |  ------------------
  |  |  |  |  |  |    9|  3.62k|#define PASTE2(x, y) PASTE(x, y)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |    8|  3.62k|#define PASTE(x, y) x ## y
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  223|  3.62k|    KeyMap::const_iterator mi = mapKeys.find(address);
  224|  3.62k|    if (mi != mapKeys.end()) {
  ------------------
  |  Branch (224:9): [True: 3.62k, False: 0]
  ------------------
  225|  3.62k|        keyOut = mi->second;
  226|  3.62k|        return true;
  227|  3.62k|    }
  228|      0|    return false;
  229|  3.62k|}
_Z20GetKeyForDestinationRK15SigningProviderRKNSt3__17variantIJ14CNoDestination17PubKeyDestination6PKHash10ScriptHash19WitnessV0ScriptHash16WitnessV0KeyHash16WitnessV1Taproot11PayToAnchor14WitnessUnknownEEE:
  272|  1.81k|{
  273|       |    // Only supports destinations which map to single public keys:
  274|       |    // P2PKH, P2WPKH, P2SH-P2WPKH, P2TR
  275|  1.81k|    if (auto id = std::get_if<PKHash>(&dest)) {
  ------------------
  |  Branch (275:14): [True: 1.81k, False: 0]
  ------------------
  276|  1.81k|        return ToKeyID(*id);
  277|  1.81k|    }
  278|      0|    if (auto witness_id = std::get_if<WitnessV0KeyHash>(&dest)) {
  ------------------
  |  Branch (278:14): [True: 0, False: 0]
  ------------------
  279|      0|        return ToKeyID(*witness_id);
  280|      0|    }
  281|      0|    if (auto script_hash = std::get_if<ScriptHash>(&dest)) {
  ------------------
  |  Branch (281:14): [True: 0, False: 0]
  ------------------
  282|      0|        CScript script;
  283|      0|        CScriptID script_id = ToScriptID(*script_hash);
  284|      0|        CTxDestination inner_dest;
  285|      0|        if (store.GetCScript(script_id, script) && ExtractDestination(script, inner_dest)) {
  ------------------
  |  Branch (285:13): [True: 0, False: 0]
  |  Branch (285:52): [True: 0, False: 0]
  ------------------
  286|      0|            if (auto inner_witness_id = std::get_if<WitnessV0KeyHash>(&inner_dest)) {
  ------------------
  |  Branch (286:22): [True: 0, False: 0]
  ------------------
  287|      0|                return ToKeyID(*inner_witness_id);
  288|      0|            }
  289|      0|        }
  290|      0|    }
  291|      0|    if (auto output_key = std::get_if<WitnessV1Taproot>(&dest)) {
  ------------------
  |  Branch (291:14): [True: 0, False: 0]
  ------------------
  292|      0|        TaprootSpendData spenddata;
  293|      0|        CPubKey pub;
  294|      0|        if (store.GetTaprootSpendData(*output_key, spenddata)
  ------------------
  |  Branch (294:13): [True: 0, False: 0]
  ------------------
  295|      0|            && !spenddata.internal_key.IsNull()
  ------------------
  |  Branch (295:16): [True: 0, False: 0]
  ------------------
  296|      0|            && spenddata.merkle_root.IsNull()
  ------------------
  |  Branch (296:16): [True: 0, False: 0]
  ------------------
  297|      0|            && store.GetPubKeyByXOnly(spenddata.internal_key, pub)) {
  ------------------
  |  Branch (297:16): [True: 0, False: 0]
  ------------------
  298|      0|            return pub.GetID();
  299|      0|        }
  300|      0|    }
  301|      0|    return CKeyID();
  302|      0|}

_ZN23FillableSigningProvider6AddKeyERK4CKey:
  322|  1.81k|    virtual bool AddKey(const CKey &key) { return AddKeyPubKey(key, key.GetPubKey()); }
_ZN15SigningProviderD2Ev:
  170|  3.62k|    virtual ~SigningProvider() = default;
_ZNK15SigningProvider12GetKeyOriginERK6CKeyIDR13KeyOriginInfo:
  176|  1.81k|    virtual bool GetKeyOrigin(const CKeyID& keyid, KeyOriginInfo& info) const { return false; }

_Z6SolverRK7CScriptRNSt3__16vectorINS3_IhNS2_9allocatorIhEEEENS4_IS6_EEEE:
  142|  7.24k|{
  143|  7.24k|    vSolutionsRet.clear();
  144|       |
  145|       |    // Shortcut for pay-to-script-hash, which are more constrained than the other types:
  146|       |    // it is always OP_HASH160 20 [20 byte hash] OP_EQUAL
  147|  7.24k|    if (scriptPubKey.IsPayToScriptHash())
  ------------------
  |  Branch (147:9): [True: 0, False: 7.24k]
  ------------------
  148|      0|    {
  149|      0|        std::vector<unsigned char> hashBytes(scriptPubKey.begin()+2, scriptPubKey.begin()+22);
  150|      0|        vSolutionsRet.push_back(hashBytes);
  151|      0|        return TxoutType::SCRIPTHASH;
  152|      0|    }
  153|       |
  154|  7.24k|    int witnessversion;
  155|  7.24k|    std::vector<unsigned char> witnessprogram;
  156|  7.24k|    if (scriptPubKey.IsWitnessProgram(witnessversion, witnessprogram)) {
  ------------------
  |  Branch (156:9): [True: 0, False: 7.24k]
  ------------------
  157|      0|        if (witnessversion == 0 && witnessprogram.size() == WITNESS_V0_KEYHASH_SIZE) {
  ------------------
  |  Branch (157:13): [True: 0, False: 0]
  |  Branch (157:36): [True: 0, False: 0]
  ------------------
  158|      0|            vSolutionsRet.push_back(std::move(witnessprogram));
  159|      0|            return TxoutType::WITNESS_V0_KEYHASH;
  160|      0|        }
  161|      0|        if (witnessversion == 0 && witnessprogram.size() == WITNESS_V0_SCRIPTHASH_SIZE) {
  ------------------
  |  Branch (161:13): [True: 0, False: 0]
  |  Branch (161:36): [True: 0, False: 0]
  ------------------
  162|      0|            vSolutionsRet.push_back(std::move(witnessprogram));
  163|      0|            return TxoutType::WITNESS_V0_SCRIPTHASH;
  164|      0|        }
  165|      0|        if (witnessversion == 1 && witnessprogram.size() == WITNESS_V1_TAPROOT_SIZE) {
  ------------------
  |  Branch (165:13): [True: 0, False: 0]
  |  Branch (165:36): [True: 0, False: 0]
  ------------------
  166|      0|            vSolutionsRet.push_back(std::move(witnessprogram));
  167|      0|            return TxoutType::WITNESS_V1_TAPROOT;
  168|      0|        }
  169|      0|        if (scriptPubKey.IsPayToAnchor()) {
  ------------------
  |  Branch (169:13): [True: 0, False: 0]
  ------------------
  170|      0|            return TxoutType::ANCHOR;
  171|      0|        }
  172|      0|        if (witnessversion != 0) {
  ------------------
  |  Branch (172:13): [True: 0, False: 0]
  ------------------
  173|      0|            vSolutionsRet.push_back(std::vector<unsigned char>{(unsigned char)witnessversion});
  174|      0|            vSolutionsRet.push_back(std::move(witnessprogram));
  175|      0|            return TxoutType::WITNESS_UNKNOWN;
  176|      0|        }
  177|      0|        return TxoutType::NONSTANDARD;
  178|      0|    }
  179|       |
  180|       |    // Provably prunable, data-carrying output
  181|       |    //
  182|       |    // So long as script passes the IsUnspendable() test and all but the first
  183|       |    // byte passes the IsPushOnly() test we don't care what exactly is in the
  184|       |    // script.
  185|  7.24k|    if (scriptPubKey.size() >= 1 && scriptPubKey[0] == OP_RETURN && scriptPubKey.IsPushOnly(scriptPubKey.begin()+1)) {
  ------------------
  |  Branch (185:9): [True: 7.24k, False: 0]
  |  Branch (185:9): [True: 0, False: 7.24k]
  |  Branch (185:37): [True: 0, False: 7.24k]
  |  Branch (185:69): [True: 0, False: 0]
  ------------------
  186|      0|        return TxoutType::NULL_DATA;
  187|      0|    }
  188|       |
  189|  7.24k|    std::vector<unsigned char> data;
  190|  7.24k|    if (MatchPayToPubkey(scriptPubKey, data)) {
  ------------------
  |  Branch (190:9): [True: 3.62k, False: 3.62k]
  ------------------
  191|  3.62k|        vSolutionsRet.push_back(std::move(data));
  192|  3.62k|        return TxoutType::PUBKEY;
  193|  3.62k|    }
  194|       |
  195|  3.62k|    if (MatchPayToPubkeyHash(scriptPubKey, data)) {
  ------------------
  |  Branch (195:9): [True: 0, False: 3.62k]
  ------------------
  196|      0|        vSolutionsRet.push_back(std::move(data));
  197|      0|        return TxoutType::PUBKEYHASH;
  198|      0|    }
  199|       |
  200|  3.62k|    int required;
  201|  3.62k|    std::vector<std::vector<unsigned char>> keys;
  202|  3.62k|    if (MatchMultisig(scriptPubKey, required, keys)) {
  ------------------
  |  Branch (202:9): [True: 3.62k, False: 0]
  ------------------
  203|  3.62k|        vSolutionsRet.push_back({static_cast<unsigned char>(required)}); // safe as required is in range 1..20
  204|  3.62k|        vSolutionsRet.insert(vSolutionsRet.end(), keys.begin(), keys.end());
  205|  3.62k|        vSolutionsRet.push_back({static_cast<unsigned char>(keys.size())}); // safe as size is in range 1..20
  206|  3.62k|        return TxoutType::MULTISIG;
  207|  3.62k|    }
  208|       |
  209|      0|    vSolutionsRet.clear();
  210|      0|    return TxoutType::NONSTANDARD;
  211|  3.62k|}
_Z21GetScriptForRawPubKeyRK7CPubKey:
  214|  1.81k|{
  215|  1.81k|    return CScript() << std::vector<unsigned char>(pubKey.begin(), pubKey.end()) << OP_CHECKSIG;
  216|  1.81k|}
_Z20GetScriptForMultisigiRKNSt3__16vectorI7CPubKeyNS_9allocatorIS1_EEEE:
  219|  1.81k|{
  220|  1.81k|    CScript script;
  221|       |
  222|  1.81k|    script << nRequired;
  223|  1.81k|    for (const CPubKey& key : keys)
  ------------------
  |  Branch (223:29): [True: 1.81k, False: 1.81k]
  ------------------
  224|  1.81k|        script << ToByteVector(key);
  225|  1.81k|    script << keys.size() << OP_CHECKMULTISIG;
  226|       |
  227|  1.81k|    return script;
  228|  1.81k|}
solver.cpp:_ZL15GetScriptNumber10opcodetypeNSt3__16vectorIhNS0_9allocatorIhEEEEii:
   67|  7.24k|{
   68|  7.24k|    int count;
   69|  7.24k|    if (IsSmallInteger(opcode)) {
  ------------------
  |  Branch (69:9): [True: 7.24k, False: 0]
  ------------------
   70|  7.24k|        count = CScript::DecodeOP_N(opcode);
   71|  7.24k|    } else if (IsPushdataOp(opcode)) {
  ------------------
  |  Branch (71:16): [True: 0, False: 0]
  ------------------
   72|      0|        if (!CheckMinimalPush(data, opcode)) return {};
  ------------------
  |  Branch (72:13): [True: 0, False: 0]
  ------------------
   73|      0|        try {
   74|      0|            count = CScriptNum(data, /* fRequireMinimal = */ true).getint();
   75|      0|        } catch (const scriptnum_error&) {
   76|      0|            return {};
   77|      0|        }
   78|      0|    } else {
   79|      0|        return {};
   80|      0|    }
   81|  7.24k|    if (count < min || count > max) return {};
  ------------------
  |  Branch (81:9): [True: 0, False: 7.24k]
  |  Branch (81:24): [True: 0, False: 7.24k]
  ------------------
   82|  7.24k|    return count;
   83|  7.24k|}
solver.cpp:_ZL14IsSmallInteger10opcodetype:
   60|  7.24k|{
   61|  7.24k|    return opcode >= OP_1 && opcode <= OP_16;
  ------------------
  |  Branch (61:12): [True: 7.24k, False: 0]
  |  Branch (61:30): [True: 7.24k, False: 0]
  ------------------
   62|  7.24k|}
solver.cpp:_ZL16MatchPayToPubkeyRK7CScriptRNSt3__16vectorIhNS2_9allocatorIhEEEE:
   37|  7.24k|{
   38|  7.24k|    if (script.size() == CPubKey::SIZE + 2 && script[0] == CPubKey::SIZE && script.back() == OP_CHECKSIG) {
  ------------------
  |  Branch (38:9): [True: 0, False: 7.24k]
  |  Branch (38:47): [True: 0, False: 0]
  |  Branch (38:77): [True: 0, False: 0]
  ------------------
   39|      0|        pubkey = valtype(script.begin() + 1, script.begin() + CPubKey::SIZE + 1);
   40|      0|        return CPubKey::ValidSize(pubkey);
   41|      0|    }
   42|  7.24k|    if (script.size() == CPubKey::COMPRESSED_SIZE + 2 && script[0] == CPubKey::COMPRESSED_SIZE && script.back() == OP_CHECKSIG) {
  ------------------
  |  Branch (42:9): [True: 3.62k, False: 3.62k]
  |  Branch (42:58): [True: 3.62k, False: 0]
  |  Branch (42:99): [True: 3.62k, False: 0]
  ------------------
   43|  3.62k|        pubkey = valtype(script.begin() + 1, script.begin() + CPubKey::COMPRESSED_SIZE + 1);
   44|  3.62k|        return CPubKey::ValidSize(pubkey);
   45|  3.62k|    }
   46|  3.62k|    return false;
   47|  7.24k|}
solver.cpp:_ZL20MatchPayToPubkeyHashRK7CScriptRNSt3__16vectorIhNS2_9allocatorIhEEEE:
   50|  3.62k|{
   51|  3.62k|    if (script.size() == 25 && script[0] == OP_DUP && script[1] == OP_HASH160 && script[2] == 20 && script[23] == OP_EQUALVERIFY && script[24] == OP_CHECKSIG) {
  ------------------
  |  Branch (51:9): [True: 0, False: 3.62k]
  |  Branch (51:32): [True: 0, False: 0]
  |  Branch (51:55): [True: 0, False: 0]
  |  Branch (51:82): [True: 0, False: 0]
  |  Branch (51:101): [True: 0, False: 0]
  |  Branch (51:133): [True: 0, False: 0]
  ------------------
   52|      0|        pubkeyhash = valtype(script.begin () + 3, script.begin() + 23);
   53|      0|        return true;
   54|      0|    }
   55|  3.62k|    return false;
   56|  3.62k|}
solver.cpp:_ZL13MatchMultisigRK7CScriptRiRNSt3__16vectorINS4_IhNS3_9allocatorIhEEEENS5_IS7_EEEE:
   86|  3.62k|{
   87|  3.62k|    opcodetype opcode;
   88|  3.62k|    valtype data;
   89|       |
   90|  3.62k|    CScript::const_iterator it = script.begin();
   91|  3.62k|    if (script.size() < 1 || script.back() != OP_CHECKMULTISIG) return false;
  ------------------
  |  Branch (91:9): [True: 0, False: 3.62k]
  |  Branch (91:30): [True: 0, False: 3.62k]
  ------------------
   92|       |
   93|  3.62k|    if (!script.GetOp(it, opcode, data)) return false;
  ------------------
  |  Branch (93:9): [True: 0, False: 3.62k]
  ------------------
   94|  3.62k|    auto req_sigs = GetScriptNumber(opcode, data, 1, MAX_PUBKEYS_PER_MULTISIG);
   95|  3.62k|    if (!req_sigs) return false;
  ------------------
  |  Branch (95:9): [True: 0, False: 3.62k]
  ------------------
   96|  3.62k|    required_sigs = *req_sigs;
   97|  7.24k|    while (script.GetOp(it, opcode, data) && CPubKey::ValidSize(data)) {
  ------------------
  |  Branch (97:12): [True: 7.24k, False: 0]
  |  Branch (97:46): [True: 3.62k, False: 3.62k]
  ------------------
   98|  3.62k|        pubkeys.emplace_back(std::move(data));
   99|  3.62k|    }
  100|  3.62k|    auto num_keys = GetScriptNumber(opcode, data, required_sigs, MAX_PUBKEYS_PER_MULTISIG);
  101|  3.62k|    if (!num_keys) return false;
  ------------------
  |  Branch (101:9): [True: 0, False: 3.62k]
  ------------------
  102|  3.62k|    if (pubkeys.size() != static_cast<unsigned long>(*num_keys)) return false;
  ------------------
  |  Branch (102:9): [True: 0, False: 3.62k]
  ------------------
  103|       |
  104|  3.62k|    return (it + 1 == script.end());
  105|  3.62k|}

secp256k1.c:secp256k1_ecdsa_sig_serialize:
  171|  5.43k|static int secp256k1_ecdsa_sig_serialize(unsigned char *sig, size_t *size, const secp256k1_scalar* ar, const secp256k1_scalar* as) {
  172|  5.43k|    unsigned char r[33] = {0}, s[33] = {0};
  173|  5.43k|    unsigned char *rp = r, *sp = s;
  174|  5.43k|    size_t lenR = 33, lenS = 33;
  175|  5.43k|    secp256k1_scalar_get_b32(&r[1], ar);
  176|  5.43k|    secp256k1_scalar_get_b32(&s[1], as);
  177|  9.96k|    while (lenR > 1 && rp[0] == 0 && rp[1] < 0x80) { lenR--; rp++; }
  ------------------
  |  Branch (177:12): [True: 9.96k, False: 0]
  |  Branch (177:24): [True: 5.49k, False: 4.46k]
  |  Branch (177:38): [True: 4.52k, False: 967]
  ------------------
  178|  10.9k|    while (lenS > 1 && sp[0] == 0 && sp[1] < 0x80) { lenS--; sp++; }
  ------------------
  |  Branch (178:12): [True: 10.9k, False: 0]
  |  Branch (178:24): [True: 5.52k, False: 5.39k]
  |  Branch (178:38): [True: 5.48k, False: 36]
  ------------------
  179|  5.43k|    if (*size < 6+lenS+lenR) {
  ------------------
  |  Branch (179:9): [True: 0, False: 5.43k]
  ------------------
  180|      0|        *size = 6 + lenS + lenR;
  181|      0|        return 0;
  182|      0|    }
  183|  5.43k|    *size = 6 + lenS + lenR;
  184|  5.43k|    sig[0] = 0x30;
  185|  5.43k|    sig[1] = 4 + lenS + lenR;
  186|  5.43k|    sig[2] = 0x02;
  187|  5.43k|    sig[3] = lenR;
  188|  5.43k|    memcpy(sig+4, rp, lenR);
  189|  5.43k|    sig[4+lenR] = 0x02;
  190|  5.43k|    sig[5+lenR] = lenS;
  191|  5.43k|    memcpy(sig+lenR+6, sp, lenS);
  192|  5.43k|    return 1;
  193|  5.43k|}
secp256k1.c:secp256k1_ecdsa_sig_verify:
  195|  10.8k|static int secp256k1_ecdsa_sig_verify(const secp256k1_scalar *sigr, const secp256k1_scalar *sigs, const secp256k1_ge *pubkey, const secp256k1_scalar *message) {
  196|  10.8k|    unsigned char c[32];
  197|  10.8k|    secp256k1_scalar sn, u1, u2;
  198|  10.8k|#if !defined(EXHAUSTIVE_TEST_ORDER)
  199|  10.8k|    int range;
  200|  10.8k|    secp256k1_fe xr;
  201|  10.8k|#endif
  202|  10.8k|    secp256k1_gej pubkeyj;
  203|  10.8k|    secp256k1_gej pr;
  204|       |
  205|  10.8k|    if (secp256k1_scalar_is_zero(sigr) || secp256k1_scalar_is_zero(sigs)) {
  ------------------
  |  Branch (205:9): [True: 0, False: 10.8k]
  |  Branch (205:43): [True: 0, False: 10.8k]
  ------------------
  206|      0|        return 0;
  207|      0|    }
  208|       |
  209|  10.8k|    secp256k1_scalar_inverse_var(&sn, sigs);
  210|  10.8k|    secp256k1_scalar_mul(&u1, &sn, message);
  211|  10.8k|    secp256k1_scalar_mul(&u2, &sn, sigr);
  212|  10.8k|    secp256k1_gej_set_ge(&pubkeyj, pubkey);
  213|  10.8k|    secp256k1_ecmult(&pr, &pubkeyj, &u2, &u1);
  214|  10.8k|    if (secp256k1_gej_is_infinity(&pr)) {
  ------------------
  |  Branch (214:9): [True: 0, False: 10.8k]
  ------------------
  215|      0|        return 0;
  216|      0|    }
  217|       |
  218|       |#if defined(EXHAUSTIVE_TEST_ORDER)
  219|       |{
  220|       |    secp256k1_scalar computed_r;
  221|       |    secp256k1_ge pr_ge;
  222|       |    secp256k1_ge_set_gej(&pr_ge, &pr);
  223|       |    secp256k1_fe_normalize(&pr_ge.x);
  224|       |
  225|       |    secp256k1_fe_get_b32(c, &pr_ge.x);
  226|       |    secp256k1_scalar_set_b32(&computed_r, c, NULL);
  227|       |    return secp256k1_scalar_eq(sigr, &computed_r);
  228|       |}
  229|       |#else
  230|       |
  231|       |    /* Interpret sigr as a field element xr  */
  232|  10.8k|    secp256k1_scalar_get_b32(c, sigr);
  233|  10.8k|    range = secp256k1_fe_set_b32_limit(&xr, c);
  ------------------
  |  |   88|  10.8k|#  define secp256k1_fe_set_b32_limit secp256k1_fe_impl_set_b32_limit
  ------------------
  234|       |#ifdef VERIFY
  235|       |    /* We know that c is in range; it comes from a scalar. */
  236|       |    VERIFY_CHECK(range);
  237|       |#else
  238|  10.8k|    (void)range;
  239|  10.8k|#endif
  240|       |
  241|       |    /** We now have the recomputed R point in pr, and its claimed x coordinate (modulo n)
  242|       |     *  in xr. Naively, we would extract the x coordinate from pr (requiring a inversion modulo p),
  243|       |     *  compute the remainder modulo n, and compare it to xr. However:
  244|       |     *
  245|       |     *        xr == X(pr) mod n
  246|       |     *    <=> exists h. (xr + h * n < p && xr + h * n == X(pr))
  247|       |     *    [Since 2 * n > p, h can only be 0 or 1]
  248|       |     *    <=> (xr == X(pr)) || (xr + n < p && xr + n == X(pr))
  249|       |     *    [In Jacobian coordinates, X(pr) is pr.x / pr.z^2 mod p]
  250|       |     *    <=> (xr == pr.x / pr.z^2 mod p) || (xr + n < p && xr + n == pr.x / pr.z^2 mod p)
  251|       |     *    [Multiplying both sides of the equations by pr.z^2 mod p]
  252|       |     *    <=> (xr * pr.z^2 mod p == pr.x) || (xr + n < p && (xr + n) * pr.z^2 mod p == pr.x)
  253|       |     *
  254|       |     *  Thus, we can avoid the inversion, but we have to check both cases separately.
  255|       |     *  secp256k1_gej_eq_x implements the (xr * pr.z^2 mod p == pr.x) test.
  256|       |     */
  257|  10.8k|    if (secp256k1_gej_eq_x_var(&xr, &pr)) {
  ------------------
  |  Branch (257:9): [True: 10.8k, False: 0]
  ------------------
  258|       |        /* xr * pr.z^2 mod p == pr.x, so the signature is valid. */
  259|  10.8k|        return 1;
  260|  10.8k|    }
  261|      0|    if (secp256k1_fe_cmp_var(&xr, &secp256k1_ecdsa_const_p_minus_order) >= 0) {
  ------------------
  |  |   86|      0|#  define secp256k1_fe_cmp_var secp256k1_fe_impl_cmp_var
  ------------------
  |  Branch (261:9): [True: 0, False: 0]
  ------------------
  262|       |        /* xr + n >= p, so we can skip testing the second case. */
  263|      0|        return 0;
  264|      0|    }
  265|      0|    secp256k1_fe_add(&xr, &secp256k1_ecdsa_const_order_as_fe);
  ------------------
  |  |   92|      0|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  266|      0|    if (secp256k1_gej_eq_x_var(&xr, &pr)) {
  ------------------
  |  Branch (266:9): [True: 0, False: 0]
  ------------------
  267|       |        /* (xr + n) * pr.z^2 mod p == pr.x, so the signature is valid. */
  268|      0|        return 1;
  269|      0|    }
  270|      0|    return 0;
  271|      0|#endif
  272|      0|}
secp256k1.c:secp256k1_ecdsa_sig_sign:
  274|  12.9k|static int secp256k1_ecdsa_sig_sign(const secp256k1_ecmult_gen_context *ctx, secp256k1_scalar *sigr, secp256k1_scalar *sigs, const secp256k1_scalar *seckey, const secp256k1_scalar *message, const secp256k1_scalar *nonce, int *recid) {
  275|  12.9k|    unsigned char b[32];
  276|  12.9k|    secp256k1_ge r;
  277|  12.9k|    secp256k1_scalar n;
  278|  12.9k|    int overflow = 0;
  279|  12.9k|    int high;
  280|       |
  281|  12.9k|    secp256k1_ecmult_gen_ge(ctx, &r, nonce);
  282|  12.9k|    secp256k1_fe_normalize(&r.x);
  ------------------
  |  |   78|  12.9k|#  define secp256k1_fe_normalize secp256k1_fe_impl_normalize
  ------------------
  283|  12.9k|    secp256k1_fe_normalize(&r.y);
  ------------------
  |  |   78|  12.9k|#  define secp256k1_fe_normalize secp256k1_fe_impl_normalize
  ------------------
  284|  12.9k|    secp256k1_fe_get_b32(b, &r.x);
  ------------------
  |  |   89|  12.9k|#  define secp256k1_fe_get_b32 secp256k1_fe_impl_get_b32
  ------------------
  285|  12.9k|    secp256k1_scalar_set_b32(sigr, b, &overflow);
  286|  12.9k|    if (recid) {
  ------------------
  |  Branch (286:9): [True: 1.81k, False: 11.1k]
  ------------------
  287|       |        /* The overflow condition is cryptographically unreachable as hitting it requires finding the discrete log
  288|       |         * of some P where P.x >= order, and only 1 in about 2^127 points meet this criteria.
  289|       |         */
  290|  1.81k|        *recid = (overflow << 1) | secp256k1_fe_is_odd(&r.y);
  ------------------
  |  |   85|  1.81k|#  define secp256k1_fe_is_odd secp256k1_fe_impl_is_odd
  ------------------
  291|  1.81k|    }
  292|  12.9k|    secp256k1_scalar_mul(&n, sigr, seckey);
  293|  12.9k|    secp256k1_scalar_add(&n, &n, message);
  294|  12.9k|    secp256k1_scalar_inverse(sigs, nonce);
  295|  12.9k|    secp256k1_scalar_mul(sigs, sigs, &n);
  296|  12.9k|    secp256k1_scalar_clear(&n);
  297|  12.9k|    secp256k1_ge_clear(&r);
  298|  12.9k|    high = secp256k1_scalar_is_high(sigs);
  299|  12.9k|    secp256k1_scalar_cond_negate(sigs, high);
  300|  12.9k|    if (recid) {
  ------------------
  |  Branch (300:9): [True: 1.81k, False: 11.1k]
  ------------------
  301|  1.81k|        *recid ^= high;
  302|  1.81k|    }
  303|       |    /* P.x = order is on the curve, so technically sig->r could end up being zero, which would be an invalid signature.
  304|       |     * This is cryptographically unreachable as hitting it requires finding the discrete log of P.x = N.
  305|       |     */
  306|  12.9k|    return (int)(!secp256k1_scalar_is_zero(sigr)) & (int)(!secp256k1_scalar_is_zero(sigs));
  307|  12.9k|}

secp256k1.c:secp256k1_eckey_pubkey_parse:
   18|  16.2k|static int secp256k1_eckey_pubkey_parse(secp256k1_ge *elem, const unsigned char *pub, size_t size) {
   19|  16.2k|    if (size == 33 && (pub[0] == SECP256K1_TAG_PUBKEY_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_ODD)) {
  ------------------
  |  |  220|  32.5k|#define SECP256K1_TAG_PUBKEY_EVEN 0x02
  ------------------
                  if (size == 33 && (pub[0] == SECP256K1_TAG_PUBKEY_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_ODD)) {
  ------------------
  |  |  221|  8.18k|#define SECP256K1_TAG_PUBKEY_ODD 0x03
  ------------------
  |  Branch (19:9): [True: 16.2k, False: 0]
  |  Branch (19:24): [True: 8.11k, False: 8.18k]
  |  Branch (19:63): [True: 8.18k, False: 0]
  ------------------
   20|  16.2k|        secp256k1_fe x;
   21|  16.2k|        return secp256k1_fe_set_b32_limit(&x, pub+1) && secp256k1_ge_set_xo_var(elem, &x, pub[0] == SECP256K1_TAG_PUBKEY_ODD);
  ------------------
  |  |   88|  16.2k|#  define secp256k1_fe_set_b32_limit secp256k1_fe_impl_set_b32_limit
  ------------------
                      return secp256k1_fe_set_b32_limit(&x, pub+1) && secp256k1_ge_set_xo_var(elem, &x, pub[0] == SECP256K1_TAG_PUBKEY_ODD);
  ------------------
  |  |  221|  16.2k|#define SECP256K1_TAG_PUBKEY_ODD 0x03
  ------------------
  |  Branch (21:16): [True: 16.2k, False: 0]
  |  Branch (21:57): [True: 16.2k, False: 0]
  ------------------
   22|  16.2k|    } else if (size == 65 && (pub[0] == SECP256K1_TAG_PUBKEY_UNCOMPRESSED || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD)) {
  ------------------
  |  |  222|      0|#define SECP256K1_TAG_PUBKEY_UNCOMPRESSED 0x04
  ------------------
                  } else if (size == 65 && (pub[0] == SECP256K1_TAG_PUBKEY_UNCOMPRESSED || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD)) {
  ------------------
  |  |  223|      0|#define SECP256K1_TAG_PUBKEY_HYBRID_EVEN 0x06
  ------------------
                  } else if (size == 65 && (pub[0] == SECP256K1_TAG_PUBKEY_UNCOMPRESSED || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD)) {
  ------------------
  |  |  224|      0|#define SECP256K1_TAG_PUBKEY_HYBRID_ODD 0x07
  ------------------
  |  Branch (22:16): [True: 0, False: 0]
  |  Branch (22:31): [True: 0, False: 0]
  |  Branch (22:78): [True: 0, False: 0]
  |  Branch (22:124): [True: 0, False: 0]
  ------------------
   23|      0|        secp256k1_fe x, y;
   24|      0|        if (!secp256k1_fe_set_b32_limit(&x, pub+1) || !secp256k1_fe_set_b32_limit(&y, pub+33)) {
  ------------------
  |  |   88|      0|#  define secp256k1_fe_set_b32_limit secp256k1_fe_impl_set_b32_limit
  ------------------
                      if (!secp256k1_fe_set_b32_limit(&x, pub+1) || !secp256k1_fe_set_b32_limit(&y, pub+33)) {
  ------------------
  |  |   88|      0|#  define secp256k1_fe_set_b32_limit secp256k1_fe_impl_set_b32_limit
  ------------------
  |  Branch (24:13): [True: 0, False: 0]
  |  Branch (24:55): [True: 0, False: 0]
  ------------------
   25|      0|            return 0;
   26|      0|        }
   27|      0|        secp256k1_ge_set_xy(elem, &x, &y);
   28|      0|        if ((pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD) &&
  ------------------
  |  |  223|      0|#define SECP256K1_TAG_PUBKEY_HYBRID_EVEN 0x06
  ------------------
                      if ((pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD) &&
  ------------------
  |  |  224|      0|#define SECP256K1_TAG_PUBKEY_HYBRID_ODD 0x07
  ------------------
  |  Branch (28:14): [True: 0, False: 0]
  |  Branch (28:60): [True: 0, False: 0]
  ------------------
   29|      0|            secp256k1_fe_is_odd(&y) != (pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD)) {
  ------------------
  |  |   85|      0|#  define secp256k1_fe_is_odd secp256k1_fe_impl_is_odd
  ------------------
                          secp256k1_fe_is_odd(&y) != (pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD)) {
  ------------------
  |  |  224|      0|#define SECP256K1_TAG_PUBKEY_HYBRID_ODD 0x07
  ------------------
  |  Branch (29:13): [True: 0, False: 0]
  ------------------
   30|      0|            return 0;
   31|      0|        }
   32|      0|        return secp256k1_ge_is_valid_var(elem);
   33|      0|    } else {
   34|      0|        return 0;
   35|      0|    }
   36|  16.2k|}
secp256k1.c:secp256k1_eckey_pubkey_serialize33:
   38|  16.2k|static void secp256k1_eckey_pubkey_serialize33(secp256k1_ge *elem, unsigned char *pub33) {
   39|  16.2k|    VERIFY_CHECK(!secp256k1_ge_is_infinity(elem));
   40|       |
   41|  16.2k|    secp256k1_fe_normalize_var(&elem->x);
  ------------------
  |  |   80|  16.2k|#  define secp256k1_fe_normalize_var secp256k1_fe_impl_normalize_var
  ------------------
   42|  16.2k|    secp256k1_fe_normalize_var(&elem->y);
  ------------------
  |  |   80|  16.2k|#  define secp256k1_fe_normalize_var secp256k1_fe_impl_normalize_var
  ------------------
   43|  16.2k|    pub33[0] = secp256k1_fe_is_odd(&elem->y) ? SECP256K1_TAG_PUBKEY_ODD : SECP256K1_TAG_PUBKEY_EVEN;
  ------------------
  |  |   85|  16.2k|#  define secp256k1_fe_is_odd secp256k1_fe_impl_is_odd
  ------------------
                  pub33[0] = secp256k1_fe_is_odd(&elem->y) ? SECP256K1_TAG_PUBKEY_ODD : SECP256K1_TAG_PUBKEY_EVEN;
  ------------------
  |  |  221|  8.18k|#define SECP256K1_TAG_PUBKEY_ODD 0x03
  ------------------
                  pub33[0] = secp256k1_fe_is_odd(&elem->y) ? SECP256K1_TAG_PUBKEY_ODD : SECP256K1_TAG_PUBKEY_EVEN;
  ------------------
  |  |  220|  24.4k|#define SECP256K1_TAG_PUBKEY_EVEN 0x02
  ------------------
  |  Branch (43:16): [True: 8.18k, False: 8.11k]
  ------------------
   44|  16.2k|    secp256k1_fe_get_b32(&pub33[1], &elem->x);
  ------------------
  |  |   89|  16.2k|#  define secp256k1_fe_get_b32 secp256k1_fe_impl_get_b32
  ------------------
   45|  16.2k|}
secp256k1.c:secp256k1_eckey_pubkey_serialize65:
   47|  1.81k|static void secp256k1_eckey_pubkey_serialize65(secp256k1_ge *elem, unsigned char *pub65) {
   48|  1.81k|    VERIFY_CHECK(!secp256k1_ge_is_infinity(elem));
   49|       |
   50|  1.81k|    secp256k1_fe_normalize_var(&elem->x);
  ------------------
  |  |   80|  1.81k|#  define secp256k1_fe_normalize_var secp256k1_fe_impl_normalize_var
  ------------------
   51|  1.81k|    secp256k1_fe_normalize_var(&elem->y);
  ------------------
  |  |   80|  1.81k|#  define secp256k1_fe_normalize_var secp256k1_fe_impl_normalize_var
  ------------------
   52|  1.81k|    pub65[0] = SECP256K1_TAG_PUBKEY_UNCOMPRESSED;
  ------------------
  |  |  222|  1.81k|#define SECP256K1_TAG_PUBKEY_UNCOMPRESSED 0x04
  ------------------
   53|  1.81k|    secp256k1_fe_get_b32(&pub65[1], &elem->x);
  ------------------
  |  |   89|  1.81k|#  define secp256k1_fe_get_b32 secp256k1_fe_impl_get_b32
  ------------------
   54|  1.81k|    secp256k1_fe_get_b32(&pub65[33], &elem->y);
  ------------------
  |  |   89|  1.81k|#  define secp256k1_fe_get_b32 secp256k1_fe_impl_get_b32
  ------------------
   55|  1.81k|}
secp256k1.c:secp256k1_eckey_privkey_tweak_add:
   57|  1.81k|static int secp256k1_eckey_privkey_tweak_add(secp256k1_scalar *key, const secp256k1_scalar *tweak) {
   58|  1.81k|    secp256k1_scalar_add(key, key, tweak);
   59|  1.81k|    return !secp256k1_scalar_is_zero(key);
   60|  1.81k|}
secp256k1.c:secp256k1_eckey_pubkey_tweak_add:
   62|  1.81k|static int secp256k1_eckey_pubkey_tweak_add(secp256k1_ge *key, const secp256k1_scalar *tweak) {
   63|  1.81k|    secp256k1_gej pt;
   64|  1.81k|    secp256k1_gej_set_ge(&pt, key);
   65|  1.81k|    secp256k1_ecmult(&pt, &pt, &secp256k1_scalar_one, tweak);
   66|       |
   67|  1.81k|    if (secp256k1_gej_is_infinity(&pt)) {
  ------------------
  |  Branch (67:9): [True: 0, False: 1.81k]
  ------------------
   68|      0|        return 0;
   69|      0|    }
   70|  1.81k|    secp256k1_ge_set_gej(key, &pt);
   71|  1.81k|    return 1;
   72|  1.81k|}

secp256k1.c:secp256k1_ecmult_gen_context_clear:
   26|      2|static void secp256k1_ecmult_gen_context_clear(secp256k1_ecmult_gen_context *ctx) {
   27|      2|    ctx->built = 0;
   28|      2|    secp256k1_scalar_clear(&ctx->scalar_offset);
   29|      2|    secp256k1_ge_clear(&ctx->ge_offset);
   30|      2|    secp256k1_fe_clear(&ctx->proj_blind);
   31|      2|}
secp256k1.c:secp256k1_ecmult_gen_context_is_built:
   22|  29.2k|static int secp256k1_ecmult_gen_context_is_built(const secp256k1_ecmult_gen_context* ctx) {
   23|  29.2k|    return ctx->built;
   24|  29.2k|}
secp256k1.c:secp256k1_ecmult_gen_gej:
   54|  29.2k|static void secp256k1_ecmult_gen_gej(const secp256k1_ecmult_gen_context *ctx, secp256k1_gej *r, const secp256k1_scalar *gn) {
   55|  29.2k|    uint32_t comb_off;
   56|  29.2k|    secp256k1_ge add;
   57|  29.2k|    secp256k1_fe neg;
   58|  29.2k|    secp256k1_ge_storage adds;
   59|  29.2k|    secp256k1_scalar d;
   60|       |    /* Array of uint32_t values large enough to store COMB_BITS bits. Only the bottom
   61|       |     * 8 are ever nonzero, but having the zero padding at the end if COMB_BITS>256
   62|       |     * avoids the need to deal with out-of-bounds reads from a scalar. */
   63|  29.2k|    uint32_t recoded[(COMB_BITS + 31) >> 5] = {0};
   64|  29.2k|    int first = 1, i;
   65|       |
   66|  29.2k|    memset(&adds, 0, sizeof(adds));
   67|       |
   68|       |    /* We want to compute R = gn*G.
   69|       |     *
   70|       |     * To blind the scalar used in the computation, we rewrite this to be
   71|       |     * R = (gn - b)*G + b*G, with a blinding value b determined by the context.
   72|       |     *
   73|       |     * The multiplication (gn-b)*G will be performed using a signed-digit multi-comb (see Section
   74|       |     * 3.3 of "Fast and compact elliptic-curve cryptography" by Mike Hamburg,
   75|       |     * https://eprint.iacr.org/2012/309).
   76|       |     *
   77|       |     * Let comb(s, P) = sum((2*s[i]-1)*2^i*P for i=0..COMB_BITS-1), where s[i] is the i'th bit of
   78|       |     * the binary representation of scalar s. So the s[i] values determine whether -2^i*P (s[i]=0)
   79|       |     * or +2^i*P (s[i]=1) are added together. COMB_BITS is at least 256, so all bits of s are
   80|       |     * covered. By manipulating:
   81|       |     *
   82|       |     *     comb(s, P) = sum((2*s[i]-1)*2^i*P for i=0..COMB_BITS-1)
   83|       |     * <=> comb(s, P) = sum((2*s[i]-1)*2^i for i=0..COMB_BITS-1) * P
   84|       |     * <=> comb(s, P) = (2*sum(s[i]*2^i for i=0..COMB_BITS-1) - sum(2^i for i=0..COMB_BITS-1)) * P
   85|       |     * <=> comb(s, P) = (2*s - (2^COMB_BITS - 1)) * P
   86|       |     *
   87|       |     * If we wanted to compute (gn-b)*G as comb(s, G), it would need to hold that
   88|       |     *
   89|       |     *     (gn - b) * G = (2*s - (2^COMB_BITS - 1)) * G
   90|       |     * <=> s = (gn - b + (2^COMB_BITS - 1))/2 (mod order)
   91|       |     *
   92|       |     * We use an alternative here that avoids the modular division by two: instead we compute
   93|       |     * (gn-b)*G as comb(d, G/2). For that to hold it must be the case that
   94|       |     *
   95|       |     *     (gn - b) * G = (2*d - (2^COMB_BITS - 1)) * (G/2)
   96|       |     * <=> d = gn - b + (2^COMB_BITS - 1)/2 (mod order)
   97|       |     *
   98|       |     * Adding precomputation, our final equations become:
   99|       |     *
  100|       |     *     ctx->scalar_offset = (2^COMB_BITS - 1)/2 - b (mod order)
  101|       |     *     ctx->ge_offset = b*G
  102|       |     *     d = gn + ctx->scalar_offset (mod order)
  103|       |     *     R = comb(d, G/2) + ctx->ge_offset
  104|       |     *
  105|       |     * comb(d, G/2) function is then computed by summing + or - 2^(i-1)*G, for i=0..COMB_BITS-1,
  106|       |     * depending on the value of the bits d[i] of the binary representation of scalar d.
  107|       |     */
  108|       |
  109|       |    /* Compute the scalar d = (gn + ctx->scalar_offset). */
  110|  29.2k|    secp256k1_scalar_add(&d, &ctx->scalar_offset, gn);
  111|       |    /* Convert to recoded array. */
  112|   263k|    for (i = 0; i < 8 && i < ((COMB_BITS + 31) >> 5); ++i) {
  ------------------
  |  |   85|   234k|#define COMB_BITS (COMB_BLOCKS * COMB_TEETH * COMB_SPACING)
  |  |  ------------------
  |  |  |  |   79|   234k|#define COMB_SPACING CEIL_DIV(COMB_RANGE, COMB_BLOCKS * COMB_TEETH)
  |  |  |  |  ------------------
  |  |  |  |  |  |  190|   234k|#define CEIL_DIV(x, y) (1 + ((x) - 1) / (y))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (112:17): [True: 234k, False: 29.2k]
  |  Branch (112:26): [True: 234k, False: 0]
  ------------------
  113|   234k|        recoded[i] = secp256k1_scalar_get_bits_limb32(&d, 32 * i, 32);
  114|   234k|    }
  115|  29.2k|    secp256k1_scalar_clear(&d);
  116|       |
  117|       |    /* In secp256k1_ecmult_gen_prec_table we have precomputed sums of the
  118|       |     * (2*d[i]-1) * 2^(i-1) * G points, for various combinations of i positions.
  119|       |     * We rewrite our equation in terms of these table entries.
  120|       |     *
  121|       |     * Let mask(b) = sum(2^((b*COMB_TEETH + t)*COMB_SPACING) for t=0..COMB_TEETH-1),
  122|       |     * with b ranging from 0 to COMB_BLOCKS-1. So for example with COMB_BLOCKS=11,
  123|       |     * COMB_TEETH=6, COMB_SPACING=4, we would have:
  124|       |     *   mask(0)  = 2^0   + 2^4   + 2^8   + 2^12  + 2^16  + 2^20,
  125|       |     *   mask(1)  = 2^24  + 2^28  + 2^32  + 2^36  + 2^40  + 2^44,
  126|       |     *   mask(2)  = 2^48  + 2^52  + 2^56  + 2^60  + 2^64  + 2^68,
  127|       |     *   ...
  128|       |     *   mask(10) = 2^240 + 2^244 + 2^248 + 2^252 + 2^256 + 2^260
  129|       |     *
  130|       |     * We will split up the bits d[i] using these masks. Specifically, each mask is
  131|       |     * used COMB_SPACING times, with different shifts:
  132|       |     *
  133|       |     * d = (d & mask(0)<<0) + (d & mask(1)<<0) + ... + (d & mask(COMB_BLOCKS-1)<<0) +
  134|       |     *     (d & mask(0)<<1) + (d & mask(1)<<1) + ... + (d & mask(COMB_BLOCKS-1)<<1) +
  135|       |     *     ...
  136|       |     *     (d & mask(0)<<(COMB_SPACING-1)) + ...
  137|       |     *
  138|       |     * Now define table(b, m) = (m - mask(b)/2) * G, and we will precompute these values for
  139|       |     * b=0..COMB_BLOCKS-1, and for all values m which (d & mask(b)) can take (so m can take on
  140|       |     * 2^COMB_TEETH distinct values).
  141|       |     *
  142|       |     * If m=(d & mask(b)), then table(b, m) is the sum of 2^i * (2*d[i]-1) * G/2, with i
  143|       |     * iterating over the set bits in mask(b). In our example, table(2, 2^48 + 2^56 + 2^68)
  144|       |     * would equal (2^48 - 2^52 + 2^56 - 2^60 - 2^64 + 2^68) * G/2.
  145|       |     *
  146|       |     * With that, we can rewrite comb(d, G/2) as:
  147|       |     *
  148|       |     *     2^0 * (table(0, d>>0 & mask(0)) + ... + table(COMB_BLOCKS-1, d>>0 & mask(COMP_BLOCKS-1)))
  149|       |     *   + 2^1 * (table(0, d>>1 & mask(0)) + ... + table(COMB_BLOCKS-1, d>>1 & mask(COMP_BLOCKS-1)))
  150|       |     *   + 2^2 * (table(0, d>>2 & mask(0)) + ... + table(COMB_BLOCKS-1, d>>2 & mask(COMP_BLOCKS-1)))
  151|       |     *   + ...
  152|       |     *   + 2^(COMB_SPACING-1) * (table(0, d>>(COMB_SPACING-1) & mask(0)) + ...)
  153|       |     *
  154|       |     * Or more generically as
  155|       |     *
  156|       |     *   sum(2^i * sum(table(b, d>>i & mask(b)), b=0..COMB_BLOCKS-1), i=0..COMB_SPACING-1)
  157|       |     *
  158|       |     * This is implemented using an outer loop that runs in reverse order over the lines of this
  159|       |     * equation, which in each iteration runs an inner loop that adds the terms of that line and
  160|       |     * then doubles the result before proceeding to the next line.
  161|       |     *
  162|       |     * In pseudocode:
  163|       |     *   c = infinity
  164|       |     *   for comb_off in range(COMB_SPACING - 1, -1, -1):
  165|       |     *     for block in range(COMB_BLOCKS):
  166|       |     *       c += table(block, (d >> comb_off) & mask(block))
  167|       |     *     if comb_off > 0:
  168|       |     *       c = 2*c
  169|       |     *   return c
  170|       |     *
  171|       |     * This computes c = comb(d, G/2), and thus finally R = c + ctx->ge_offset. Note that it would
  172|       |     * be possible to apply an initial offset instead of a final offset (moving ge_offset to take
  173|       |     * the place of infinity above), but the chosen approach allows using (in a future improvement)
  174|       |     * an incomplete addition formula for most of the multiplication.
  175|       |     *
  176|       |     * The last question is how to implement the table(b, m) function. For any value of b,
  177|       |     * m=(d & mask(b)) can only take on at most 2^COMB_TEETH possible values (the last one may have
  178|       |     * fewer as there mask(b) may exceed the curve order). So we could create COMB_BLOCK tables
  179|       |     * which contain a value for each such m value.
  180|       |     *
  181|       |     * Now note that if m=(d & mask(b)), then flipping the relevant bits of m results in negating
  182|       |     * the result of table(b, m). This is because table(b,m XOR mask(b)) = table(b, mask(b) - m) =
  183|       |     * (mask(b) - m - mask(b)/2)*G = (-m + mask(b)/2)*G = -(m - mask(b)/2)*G = -table(b, m).
  184|       |     * Because of this it suffices to only store the first half of the m values for every b. If an
  185|       |     * entry from the second half is needed, we look up its bit-flipped version instead, and negate
  186|       |     * it.
  187|       |     *
  188|       |     * secp256k1_ecmult_gen_prec_table[b][index] stores the table(b, m) entries. Index
  189|       |     * is the relevant mask(b) bits of m packed together without gaps. */
  190|       |
  191|       |    /* Outer loop: iterate over comb_off from COMB_SPACING - 1 down to 0. */
  192|  29.2k|    comb_off = COMB_SPACING - 1;
  ------------------
  |  |   79|  29.2k|#define COMB_SPACING CEIL_DIV(COMB_RANGE, COMB_BLOCKS * COMB_TEETH)
  |  |  ------------------
  |  |  |  |  190|  29.2k|#define CEIL_DIV(x, y) (1 + ((x) - 1) / (y))
  |  |  ------------------
  ------------------
  193|  29.2k|    while (1) {
  ------------------
  |  Branch (193:12): [True: 29.2k, Folded]
  ------------------
  194|  29.2k|        uint32_t block;
  195|  29.2k|        uint32_t bit_pos = comb_off;
  196|       |        /* Inner loop: for each block, add table entries to the result. */
  197|  1.28M|        for (block = 0; block < COMB_BLOCKS; ++block) {
  ------------------
  |  Branch (197:25): [True: 1.25M, False: 29.2k]
  ------------------
  198|       |            /* Gather the mask(block)-selected bits of d into bits. They're packed:
  199|       |             * bits[tooth] = d[(block*COMB_TEETH + tooth)*COMB_SPACING + comb_off]. */
  200|  1.25M|            uint32_t bits = 0, sign, abs, index, tooth;
  201|       |            /* Instead of reading individual bits here to construct the bits variable,
  202|       |             * build up the result by xoring rotated reads together. In every iteration,
  203|       |             * one additional bit is made correct, starting at the bottom. The bits
  204|       |             * above that contain junk. This reduces leakage by avoiding computations
  205|       |             * on variables that can have only a low number of possible values (e.g.,
  206|       |             * just two values when reading a single bit into a variable.) See:
  207|       |             * https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-alam.pdf
  208|       |             */
  209|  8.81M|            for (tooth = 0; tooth < COMB_TEETH; ++tooth) {
  ------------------
  |  Branch (209:29): [True: 7.55M, False: 1.25M]
  ------------------
  210|       |                /* Construct bitdata s.t. the bottom bit is the bit we'd like to read.
  211|       |                 *
  212|       |                 * We could just set bitdata = recoded[bit_pos >> 5] >> (bit_pos & 0x1f)
  213|       |                 * but this would simply discard the bits that fall off at the bottom,
  214|       |                 * and thus, for example, bitdata could still have only two values if we
  215|       |                 * happen to shift by exactly 31 positions. We use a rotation instead,
  216|       |                 * which ensures that bitdata doesn't lose entropy. This relies on the
  217|       |                 * rotation being atomic, i.e., the compiler emitting an actual rot
  218|       |                 * instruction. */
  219|  7.55M|                uint32_t bitdata = secp256k1_rotr32(recoded[bit_pos >> 5], bit_pos & 0x1f);
  220|       |
  221|       |                /* Clear the bit at position tooth, but sssh, don't tell clang. */
  222|  7.55M|                uint32_t volatile vmask = ~(1 << tooth);
  223|  7.55M|                bits &= vmask;
  224|       |
  225|       |                /* Write the bit into position tooth (and junk into higher bits). */
  226|  7.55M|                bits ^= bitdata << tooth;
  227|  7.55M|                bit_pos += COMB_SPACING;
  ------------------
  |  |   79|  7.55M|#define COMB_SPACING CEIL_DIV(COMB_RANGE, COMB_BLOCKS * COMB_TEETH)
  |  |  ------------------
  |  |  |  |  190|  7.55M|#define CEIL_DIV(x, y) (1 + ((x) - 1) / (y))
  |  |  ------------------
  ------------------
  228|  7.55M|            }
  229|       |
  230|       |            /* If the top bit of bits is 1, flip them all (corresponding to looking up
  231|       |             * the negated table value), and remember to negate the result in sign. */
  232|  1.25M|            sign = (bits >> (COMB_TEETH - 1)) & 1;
  233|  1.25M|            abs = (bits ^ -sign) & (COMB_POINTS - 1);
  ------------------
  |  |   87|  1.25M|#define COMB_POINTS (1 << (COMB_TEETH - 1))
  ------------------
  234|  1.25M|            VERIFY_CHECK(sign == 0 || sign == 1);
  235|  1.25M|            VERIFY_CHECK(abs < COMB_POINTS);
  236|       |
  237|       |            /** This uses a conditional move to avoid any secret data in array indexes.
  238|       |             *   _Any_ use of secret indexes has been demonstrated to result in timing
  239|       |             *   sidechannels, even when the cache-line access patterns are uniform.
  240|       |             *  See also:
  241|       |             *   "A word of warning", CHES 2013 Rump Session, by Daniel J. Bernstein and Peter Schwabe
  242|       |             *    (https://cryptojedi.org/peter/data/chesrump-20130822.pdf) and
  243|       |             *   "Cache Attacks and Countermeasures: the Case of AES", RSA 2006,
  244|       |             *    by Dag Arne Osvik, Adi Shamir, and Eran Tromer
  245|       |             *    (https://eprint.iacr.org/2005/271.pdf)
  246|       |             */
  247|  41.5M|            for (index = 0; index < COMB_POINTS; ++index) {
  ------------------
  |  |   87|  41.5M|#define COMB_POINTS (1 << (COMB_TEETH - 1))
  ------------------
  |  Branch (247:29): [True: 40.2M, False: 1.25M]
  ------------------
  248|  40.2M|                secp256k1_ge_storage_cmov(&adds, &secp256k1_ecmult_gen_prec_table[block][index], index == abs);
  249|  40.2M|            }
  250|       |
  251|       |            /* Set add=adds or add=-adds, in constant time, based on sign. */
  252|  1.25M|            secp256k1_ge_from_storage(&add, &adds);
  253|  1.25M|            secp256k1_fe_negate(&neg, &add.y, 1);
  ------------------
  |  |  211|  1.25M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|  1.25M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  1.25M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 1.25M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  1.25M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 1.25M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  1.25M|    } \
  |  |  |  |   94|  1.25M|    stmt; \
  |  |  |  |   95|  1.25M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 1.25M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  254|  1.25M|            secp256k1_fe_cmov(&add.y, &neg, sign);
  ------------------
  |  |   95|  1.25M|#  define secp256k1_fe_cmov secp256k1_fe_impl_cmov
  ------------------
  255|       |
  256|       |            /* Add the looked up and conditionally negated value to r. */
  257|  1.25M|            if (EXPECT(first, 0)) {
  ------------------
  |  |  146|  1.25M|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  ------------------
  |  |  |  Branch (146:21): [True: 29.2k, False: 1.22M]
  |  |  ------------------
  ------------------
  258|       |                /* If this is the first table lookup, we can skip addition. */
  259|  29.2k|                secp256k1_gej_set_ge(r, &add);
  260|       |                /* Give the entry a random Z coordinate to blind intermediary results. */
  261|  29.2k|                secp256k1_gej_rescale(r, &ctx->proj_blind);
  262|  29.2k|                first = 0;
  263|  1.22M|            } else {
  264|  1.22M|                secp256k1_gej_add_ge(r, r, &add);
  265|  1.22M|            }
  266|  1.25M|        }
  267|       |
  268|       |        /* Double the result, except in the last iteration. */
  269|  29.2k|        if (comb_off-- == 0) break;
  ------------------
  |  Branch (269:13): [True: 29.2k, False: 0]
  ------------------
  270|      0|        secp256k1_gej_double(r, r);
  271|      0|    }
  272|       |
  273|       |    /* Correct for the scalar_offset added at the start (ge_offset = b*G, while b was
  274|       |     * subtracted from the input scalar gn). */
  275|  29.2k|    secp256k1_gej_add_ge(r, r, &ctx->ge_offset);
  276|       |
  277|       |    /* Cleanup. */
  278|  29.2k|    secp256k1_fe_clear(&neg);
  279|  29.2k|    secp256k1_ge_clear(&add);
  280|  29.2k|    secp256k1_memclear_explicit(&adds, sizeof(adds));
  281|  29.2k|    secp256k1_memclear_explicit(&recoded, sizeof(recoded));
  282|  29.2k|}
secp256k1.c:secp256k1_ecmult_gen_ge:
  284|  29.2k|SECP256K1_INLINE static void secp256k1_ecmult_gen_ge(const secp256k1_ecmult_gen_context *ctx, secp256k1_ge *r, const secp256k1_scalar *a) {
  285|  29.2k|    secp256k1_gej rj;
  286|  29.2k|    secp256k1_ecmult_gen_gej(ctx, &rj, a);
  287|  29.2k|    secp256k1_ge_set_gej(r, &rj);
  288|       |    /* Jacobian coordinates resulting from our multiplication algorithm could potentially leak
  289|       |     * information about the secret input scalar, so clear the memory out to be on the safe side. */
  290|  29.2k|    secp256k1_gej_clear(&rj);
  291|  29.2k|}

secp256k1.c:secp256k1_ecmult:
  365|  16.2k|static void secp256k1_ecmult(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_scalar *na, const secp256k1_scalar *ng) {
  366|  16.2k|    secp256k1_fe aux[ECMULT_TABLE_SIZE(WINDOW_A)];
  367|  16.2k|    secp256k1_ge pre_a[ECMULT_TABLE_SIZE(WINDOW_A)];
  368|  16.2k|    struct secp256k1_strauss_point_state ps[1];
  369|  16.2k|    struct secp256k1_strauss_state state;
  370|       |
  371|  16.2k|    state.aux = aux;
  372|  16.2k|    state.pre_a = pre_a;
  373|  16.2k|    state.ps = ps;
  374|  16.2k|    secp256k1_ecmult_strauss_wnaf(&state, r, 1, a, na, ng);
  375|  16.2k|}
secp256k1.c:secp256k1_ecmult_strauss_wnaf:
  252|  16.2k|static void secp256k1_ecmult_strauss_wnaf(const struct secp256k1_strauss_state *state, secp256k1_gej *r, size_t num, const secp256k1_gej *a, const secp256k1_scalar *na, const secp256k1_scalar *ng) {
  253|  16.2k|    secp256k1_ge tmpa;
  254|  16.2k|    secp256k1_fe Z;
  255|       |    /* Split G factors. */
  256|  16.2k|    secp256k1_scalar ng_1, ng_128;
  257|  16.2k|    int wnaf_ng_1[129];
  258|  16.2k|    int bits_ng_1 = 0;
  259|  16.2k|    int wnaf_ng_128[129];
  260|  16.2k|    int bits_ng_128 = 0;
  261|  16.2k|    int i;
  262|  16.2k|    int bits = 0;
  263|  16.2k|    size_t np;
  264|  16.2k|    size_t no = 0;
  265|       |
  266|  16.2k|    secp256k1_fe_set_int(&Z, 1);
  ------------------
  |  |   83|  16.2k|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  267|  32.5k|    for (np = 0; np < num; ++np) {
  ------------------
  |  Branch (267:18): [True: 16.2k, False: 16.2k]
  ------------------
  268|  16.2k|        secp256k1_gej tmp;
  269|  16.2k|        secp256k1_scalar na_1, na_lam;
  270|  16.2k|        if (secp256k1_scalar_is_zero(&na[np]) || secp256k1_gej_is_infinity(&a[np])) {
  ------------------
  |  Branch (270:13): [True: 0, False: 16.2k]
  |  Branch (270:50): [True: 0, False: 16.2k]
  ------------------
  271|      0|            continue;
  272|      0|        }
  273|       |        /* split na into na_1 and na_lam (where na = na_1 + na_lam*lambda, and na_1 and na_lam are ~128 bit) */
  274|  16.2k|        secp256k1_scalar_split_lambda(&na_1, &na_lam, &na[np]);
  275|       |
  276|       |        /* build wnaf representation for na_1 and na_lam. */
  277|  16.2k|        state->ps[no].bits_na_1   = secp256k1_ecmult_wnaf_small(state->ps[no].wnaf_na_1,   129, &na_1,   WINDOW_A);
  ------------------
  |  |   32|  16.2k|#  define WINDOW_A 5
  ------------------
  278|  16.2k|        state->ps[no].bits_na_lam = secp256k1_ecmult_wnaf_small(state->ps[no].wnaf_na_lam, 129, &na_lam, WINDOW_A);
  ------------------
  |  |   32|  16.2k|#  define WINDOW_A 5
  ------------------
  279|  16.2k|        VERIFY_CHECK(state->ps[no].bits_na_1 <= 129);
  280|  16.2k|        VERIFY_CHECK(state->ps[no].bits_na_lam <= 129);
  281|  16.2k|        if (state->ps[no].bits_na_1 > bits) {
  ------------------
  |  Branch (281:13): [True: 16.2k, False: 0]
  ------------------
  282|  16.2k|            bits = state->ps[no].bits_na_1;
  283|  16.2k|        }
  284|  16.2k|        if (state->ps[no].bits_na_lam > bits) {
  ------------------
  |  Branch (284:13): [True: 5.43k, False: 10.8k]
  ------------------
  285|  5.43k|            bits = state->ps[no].bits_na_lam;
  286|  5.43k|        }
  287|       |
  288|       |        /* Calculate odd multiples of a.
  289|       |         * All multiples are brought to the same Z 'denominator', which is stored
  290|       |         * in Z. Due to secp256k1' isomorphism we can do all operations pretending
  291|       |         * that the Z coordinate was 1, use affine addition formulae, and correct
  292|       |         * the Z coordinate of the result once at the end.
  293|       |         * The exception is the precomputed G table points, which are actually
  294|       |         * affine. Compared to the base used for other points, they have a Z ratio
  295|       |         * of 1/Z, so we can use secp256k1_gej_add_zinv_var, which uses the same
  296|       |         * isomorphism to efficiently add with a known Z inverse.
  297|       |         */
  298|  16.2k|        tmp = a[np];
  299|  16.2k|        if (no) {
  ------------------
  |  Branch (299:13): [True: 0, False: 16.2k]
  ------------------
  300|      0|            secp256k1_gej_rescale(&tmp, &Z);
  301|      0|        }
  302|  16.2k|        secp256k1_ecmult_odd_multiples_table(ECMULT_TABLE_SIZE(WINDOW_A), state->pre_a + no * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), &Z, &tmp);
  ------------------
  |  |   41|  16.2k|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
                      secp256k1_ecmult_odd_multiples_table(ECMULT_TABLE_SIZE(WINDOW_A), state->pre_a + no * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), &Z, &tmp);
  ------------------
  |  |   41|  16.2k|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
                      secp256k1_ecmult_odd_multiples_table(ECMULT_TABLE_SIZE(WINDOW_A), state->pre_a + no * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), &Z, &tmp);
  ------------------
  |  |   41|  16.2k|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
  303|  16.2k|        if (no) secp256k1_fe_mul(state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), &(a[np].z));
  ------------------
  |  |   93|      0|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
                      if (no) secp256k1_fe_mul(state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), &(a[np].z));
  ------------------
  |  |   41|      0|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
                      if (no) secp256k1_fe_mul(state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), &(a[np].z));
  ------------------
  |  |   41|      0|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
  |  Branch (303:13): [True: 0, False: 16.2k]
  ------------------
  304|       |
  305|  16.2k|        ++no;
  306|  16.2k|    }
  307|       |
  308|       |    /* Bring them to the same Z denominator. */
  309|  16.2k|    if (no) {
  ------------------
  |  Branch (309:9): [True: 16.2k, False: 0]
  ------------------
  310|  16.2k|        secp256k1_ge_table_set_globalz(ECMULT_TABLE_SIZE(WINDOW_A) * no, state->pre_a, state->aux);
  ------------------
  |  |   41|  16.2k|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
  311|  16.2k|    }
  312|       |
  313|  32.5k|    for (np = 0; np < no; ++np) {
  ------------------
  |  Branch (313:18): [True: 16.2k, False: 16.2k]
  ------------------
  314|  16.2k|        size_t j;
  315|   146k|        for (j = 0; j < ECMULT_TABLE_SIZE(WINDOW_A); j++) {
  ------------------
  |  |   41|   146k|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
  |  Branch (315:21): [True: 130k, False: 16.2k]
  ------------------
  316|   130k|            secp256k1_fe_mul(&state->aux[np * ECMULT_TABLE_SIZE(WINDOW_A) + j], &state->pre_a[np * ECMULT_TABLE_SIZE(WINDOW_A) + j].x, &secp256k1_const_beta);
  ------------------
  |  |   93|   130k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
                          secp256k1_fe_mul(&state->aux[np * ECMULT_TABLE_SIZE(WINDOW_A) + j], &state->pre_a[np * ECMULT_TABLE_SIZE(WINDOW_A) + j].x, &secp256k1_const_beta);
  ------------------
  |  |   41|   130k|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
                          secp256k1_fe_mul(&state->aux[np * ECMULT_TABLE_SIZE(WINDOW_A) + j], &state->pre_a[np * ECMULT_TABLE_SIZE(WINDOW_A) + j].x, &secp256k1_const_beta);
  ------------------
  |  |   41|   130k|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
  317|   130k|        }
  318|  16.2k|    }
  319|       |
  320|  16.2k|    if (ng) {
  ------------------
  |  Branch (320:9): [True: 16.2k, False: 0]
  ------------------
  321|       |        /* split ng into ng_1 and ng_128 (where gn = gn_1 + gn_128*2^128, and gn_1 and gn_128 are ~128 bit) */
  322|  16.2k|        secp256k1_scalar_split_128(&ng_1, &ng_128, ng);
  323|       |
  324|       |        /* Build wnaf representation for ng_1 and ng_128 */
  325|  16.2k|        bits_ng_1   = secp256k1_ecmult_wnaf(wnaf_ng_1,   129, &ng_1,   WINDOW_G);
  ------------------
  |  |   31|  16.2k|#    define WINDOW_G ECMULT_WINDOW_SIZE
  ------------------
  326|  16.2k|        bits_ng_128 = secp256k1_ecmult_wnaf(wnaf_ng_128, 129, &ng_128, WINDOW_G);
  ------------------
  |  |   31|  16.2k|#    define WINDOW_G ECMULT_WINDOW_SIZE
  ------------------
  327|  16.2k|        if (bits_ng_1 > bits) {
  ------------------
  |  Branch (327:13): [True: 5.26k, False: 11.0k]
  ------------------
  328|  5.26k|            bits = bits_ng_1;
  329|  5.26k|        }
  330|  16.2k|        if (bits_ng_128 > bits) {
  ------------------
  |  Branch (330:13): [True: 3.58k, False: 12.7k]
  ------------------
  331|  3.58k|            bits = bits_ng_128;
  332|  3.58k|        }
  333|  16.2k|    }
  334|       |
  335|  16.2k|    secp256k1_gej_set_infinity(r);
  336|       |
  337|  2.08M|    for (i = bits - 1; i >= 0; i--) {
  ------------------
  |  Branch (337:24): [True: 2.07M, False: 16.2k]
  ------------------
  338|  2.07M|        int n;
  339|  2.07M|        secp256k1_gej_double_var(r, r, NULL);
  340|  4.14M|        for (np = 0; np < no; ++np) {
  ------------------
  |  Branch (340:22): [True: 2.07M, False: 2.07M]
  ------------------
  341|  2.07M|            if (i < state->ps[np].bits_na_1 && (n = state->ps[np].wnaf_na_1[i])) {
  ------------------
  |  Branch (341:17): [True: 1.81M, False: 252k]
  |  Branch (341:48): [True: 315k, False: 1.50M]
  ------------------
  342|   315k|                secp256k1_ecmult_table_get_ge(&tmpa, state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
  ------------------
  |  |   41|   315k|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
                              secp256k1_ecmult_table_get_ge(&tmpa, state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
  ------------------
  |  |   32|   315k|#  define WINDOW_A 5
  ------------------
  343|   315k|                secp256k1_gej_add_ge_var(r, r, &tmpa, NULL);
  344|   315k|            }
  345|  2.07M|            if (i < state->ps[np].bits_na_lam && (n = state->ps[np].wnaf_na_lam[i])) {
  ------------------
  |  Branch (345:17): [True: 1.81M, False: 260k]
  |  Branch (345:50): [True: 311k, False: 1.49M]
  ------------------
  346|   311k|                secp256k1_ecmult_table_get_ge_lambda(&tmpa, state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
  ------------------
  |  |   41|   311k|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
                              secp256k1_ecmult_table_get_ge_lambda(&tmpa, state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
  ------------------
  |  |   41|   311k|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
                              secp256k1_ecmult_table_get_ge_lambda(&tmpa, state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
  ------------------
  |  |   32|   311k|#  define WINDOW_A 5
  ------------------
  347|   311k|                secp256k1_gej_add_ge_var(r, r, &tmpa, NULL);
  348|   311k|            }
  349|  2.07M|        }
  350|  2.07M|        if (i < bits_ng_1 && (n = wnaf_ng_1[i])) {
  ------------------
  |  Branch (350:13): [True: 1.98M, False: 88.7k]
  |  Branch (350:30): [True: 138k, False: 1.84M]
  ------------------
  351|   138k|            secp256k1_ecmult_table_get_ge_storage(&tmpa, secp256k1_pre_g, n, WINDOW_G);
  ------------------
  |  |   31|   138k|#    define WINDOW_G ECMULT_WINDOW_SIZE
  ------------------
  352|   138k|            secp256k1_gej_add_zinv_var(r, r, &tmpa, &Z);
  353|   138k|        }
  354|  2.07M|        if (i < bits_ng_128 && (n = wnaf_ng_128[i])) {
  ------------------
  |  Branch (354:13): [True: 1.98M, False: 85.8k]
  |  Branch (354:32): [True: 138k, False: 1.84M]
  ------------------
  355|   138k|            secp256k1_ecmult_table_get_ge_storage(&tmpa, secp256k1_pre_g_128, n, WINDOW_G);
  ------------------
  |  |   31|   138k|#    define WINDOW_G ECMULT_WINDOW_SIZE
  ------------------
  356|   138k|            secp256k1_gej_add_zinv_var(r, r, &tmpa, &Z);
  357|   138k|        }
  358|  2.07M|    }
  359|       |
  360|  16.2k|    if (!secp256k1_gej_is_infinity(r)) {
  ------------------
  |  Branch (360:9): [True: 16.2k, False: 0]
  ------------------
  361|  16.2k|        secp256k1_fe_mul(&r->z, &r->z, &Z);
  ------------------
  |  |   93|  16.2k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  362|  16.2k|    }
  363|  16.2k|}
secp256k1.c:secp256k1_ecmult_wnaf_small:
  224|  32.5k|static int secp256k1_ecmult_wnaf_small(int8_t *wnaf, int len, const secp256k1_scalar *a, int w) {
  225|  32.5k|    int wnaf_tmp[256];
  226|  32.5k|    int ret, i;
  227|       |
  228|  32.5k|    VERIFY_CHECK(2 <= w && w <= 8);
  229|  32.5k|    ret = secp256k1_ecmult_wnaf(wnaf_tmp, len, a, w);
  230|       |
  231|  4.23M|    for (i = 0; i < len; i++) {
  ------------------
  |  Branch (231:17): [True: 4.20M, False: 32.5k]
  ------------------
  232|  4.20M|        wnaf[i] = (int8_t)wnaf_tmp[i];
  233|  4.20M|    }
  234|       |
  235|  32.5k|    return ret;
  236|  32.5k|}
secp256k1.c:secp256k1_ecmult_odd_multiples_table:
   73|  16.2k|static void secp256k1_ecmult_odd_multiples_table(size_t n, secp256k1_ge *pre_a, secp256k1_fe *zr, secp256k1_fe *z, const secp256k1_gej *a) {
   74|  16.2k|    secp256k1_gej d, ai;
   75|  16.2k|    secp256k1_ge d_ge;
   76|  16.2k|    size_t i;
   77|       |
   78|  16.2k|    VERIFY_CHECK(!secp256k1_gej_is_infinity(a));
   79|       |
   80|  16.2k|    secp256k1_gej_double_var(&d, a, NULL);
   81|       |
   82|       |    /*
   83|       |     * Perform the additions using an isomorphic curve Y^2 = X^3 + 7*C^6 where C := d.z.
   84|       |     * The isomorphism, phi, maps a secp256k1 point (x, y) to the point (x*C^2, y*C^3) on the other curve.
   85|       |     * In Jacobian coordinates phi maps (x, y, z) to (x*C^2, y*C^3, z) or, equivalently to (x, y, z/C).
   86|       |     *
   87|       |     *     phi(x, y, z) = (x*C^2, y*C^3, z) = (x, y, z/C)
   88|       |     *   d_ge := phi(d) = (d.x, d.y, 1)
   89|       |     *     ai := phi(a) = (a.x*C^2, a.y*C^3, a.z)
   90|       |     *
   91|       |     * The group addition functions work correctly on these isomorphic curves.
   92|       |     * In particular phi(d) is easy to represent in affine coordinates under this isomorphism.
   93|       |     * This lets us use the faster secp256k1_gej_add_ge_var group addition function that we wouldn't be able to use otherwise.
   94|       |     */
   95|  16.2k|    secp256k1_ge_set_xy(&d_ge, &d.x, &d.y);
   96|  16.2k|    secp256k1_ge_set_gej_zinv(&pre_a[0], a, &d.z);
   97|  16.2k|    secp256k1_gej_set_ge(&ai, &pre_a[0]);
   98|  16.2k|    ai.z = a->z;
   99|       |
  100|       |    /* pre_a[0] is the point (a.x*C^2, a.y*C^3, a.z*C) which is equivalent to a.
  101|       |     * Set zr[0] to C, which is the ratio between the omitted z(pre_a[0]) value and a.z.
  102|       |     */
  103|  16.2k|    zr[0] = d.z;
  104|       |
  105|   130k|    for (i = 1; i < n; i++) {
  ------------------
  |  Branch (105:17): [True: 114k, False: 16.2k]
  ------------------
  106|   114k|        secp256k1_gej_add_ge_var(&ai, &ai, &d_ge, &zr[i]);
  107|   114k|        secp256k1_ge_set_xy(&pre_a[i], &ai.x, &ai.y);
  108|   114k|    }
  109|       |
  110|       |    /* Multiply the last z-coordinate by C to undo the isomorphism.
  111|       |     * Since the z-coordinates of the pre_a values are implied by the zr array of z-coordinate ratios,
  112|       |     * undoing the isomorphism here undoes the isomorphism for all pre_a values.
  113|       |     */
  114|  16.2k|    secp256k1_fe_mul(z, &ai.z, &d.z);
  ------------------
  |  |   93|  16.2k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  115|  16.2k|}
secp256k1.c:secp256k1_ecmult_wnaf:
  162|  65.1k|static int secp256k1_ecmult_wnaf(int *wnaf, int len, const secp256k1_scalar *a, int w) {
  163|  65.1k|    secp256k1_scalar s;
  164|  65.1k|    int last_set_bit = -1;
  165|  65.1k|    int bit = 0;
  166|  65.1k|    int sign = 1;
  167|  65.1k|    int carry = 0;
  168|       |
  169|  65.1k|    VERIFY_CHECK(wnaf != NULL);
  170|  65.1k|    VERIFY_CHECK(0 <= len && len <= 256);
  171|  65.1k|    VERIFY_CHECK(a != NULL);
  172|  65.1k|    VERIFY_CHECK(2 <= w && w <= 31);
  173|       |
  174|  8.47M|    for (bit = 0; bit < len; bit++) {
  ------------------
  |  Branch (174:19): [True: 8.41M, False: 65.1k]
  ------------------
  175|  8.41M|        wnaf[bit] = 0;
  176|  8.41M|    }
  177|       |
  178|  65.1k|    s = *a;
  179|  65.1k|    if (secp256k1_scalar_get_bits_limb32(&s, 255, 1)) {
  ------------------
  |  Branch (179:9): [True: 14.4k, False: 50.7k]
  ------------------
  180|  14.4k|        secp256k1_scalar_negate(&s, &s);
  181|  14.4k|        sign = -1;
  182|  14.4k|    }
  183|       |
  184|  65.1k|    bit = 0;
  185|  2.34M|    while (bit < len) {
  ------------------
  |  Branch (185:12): [True: 2.28M, False: 65.1k]
  ------------------
  186|  2.28M|        int now;
  187|  2.28M|        int word;
  188|  2.28M|        if (secp256k1_scalar_get_bits_limb32(&s, bit, 1) == (unsigned int)carry) {
  ------------------
  |  Branch (188:13): [True: 1.37M, False: 904k]
  ------------------
  189|  1.37M|            bit++;
  190|  1.37M|            continue;
  191|  1.37M|        }
  192|       |
  193|   904k|        now = w;
  194|   904k|        if (now > len - bit) {
  ------------------
  |  Branch (194:13): [True: 40.8k, False: 863k]
  ------------------
  195|  40.8k|            now = len - bit;
  196|  40.8k|        }
  197|       |
  198|   904k|        word = secp256k1_scalar_get_bits_var(&s, bit, now) + carry;
  199|       |
  200|   904k|        carry = (word >> (w-1)) & 1;
  201|   904k|        word -= carry << w;
  202|       |
  203|   904k|        wnaf[bit] = sign * word;
  204|   904k|        last_set_bit = bit;
  205|       |
  206|   904k|        bit += now;
  207|   904k|    }
  208|       |#ifdef VERIFY
  209|       |    {
  210|       |        int verify_bit = bit;
  211|       |
  212|       |        VERIFY_CHECK(carry == 0);
  213|       |
  214|       |        while (verify_bit < 256) {
  215|       |            VERIFY_CHECK(secp256k1_scalar_get_bits_limb32(&s, verify_bit, 1) == 0);
  216|       |            verify_bit++;
  217|       |        }
  218|       |    }
  219|       |#endif
  220|  65.1k|    return last_set_bit + 1;
  221|  65.1k|}
secp256k1.c:secp256k1_ecmult_table_get_ge:
  125|   315k|SECP256K1_INLINE static void secp256k1_ecmult_table_get_ge(secp256k1_ge *r, const secp256k1_ge *pre, int n, int w) {
  126|   315k|    secp256k1_ecmult_table_verify(n,w);
  127|   315k|    if (n > 0) {
  ------------------
  |  Branch (127:9): [True: 159k, False: 156k]
  ------------------
  128|   159k|        *r = pre[(n-1)/2];
  129|   159k|    } else {
  130|   156k|        *r = pre[(-n-1)/2];
  131|   156k|        secp256k1_fe_negate(&(r->y), &(r->y), 1);
  ------------------
  |  |  211|   156k|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|   156k|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|   156k|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 156k]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|   156k|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 156k, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|   156k|    } \
  |  |  |  |   94|   156k|    stmt; \
  |  |  |  |   95|   156k|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 156k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  132|   156k|    }
  133|   315k|}
secp256k1.c:secp256k1_ecmult_table_verify:
  117|   904k|SECP256K1_INLINE static void secp256k1_ecmult_table_verify(int n, int w) {
  118|   904k|    (void)n;
  119|   904k|    (void)w;
  120|   904k|    VERIFY_CHECK(((n) & 1) == 1);
  121|   904k|    VERIFY_CHECK((n) >= -((1 << ((w)-1)) - 1));
  122|   904k|    VERIFY_CHECK((n) <=  ((1 << ((w)-1)) - 1));
  123|   904k|}
secp256k1.c:secp256k1_ecmult_table_get_ge_lambda:
  135|   311k|SECP256K1_INLINE static void secp256k1_ecmult_table_get_ge_lambda(secp256k1_ge *r, const secp256k1_ge *pre, const secp256k1_fe *x, int n, int w) {
  136|   311k|    secp256k1_ecmult_table_verify(n,w);
  137|   311k|    if (n > 0) {
  ------------------
  |  Branch (137:9): [True: 156k, False: 155k]
  ------------------
  138|   156k|        secp256k1_ge_set_xy(r, &x[(n-1)/2], &pre[(n-1)/2].y);
  139|   156k|    } else {
  140|   155k|        secp256k1_ge_set_xy(r, &x[(-n-1)/2], &pre[(-n-1)/2].y);
  141|   155k|        secp256k1_fe_negate(&(r->y), &(r->y), 1);
  ------------------
  |  |  211|   155k|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|   155k|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|   155k|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 155k]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|   155k|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 155k, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|   155k|    } \
  |  |  |  |   94|   155k|    stmt; \
  |  |  |  |   95|   155k|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 155k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  142|   155k|    }
  143|   311k|}
secp256k1.c:secp256k1_ecmult_table_get_ge_storage:
  145|   276k|SECP256K1_INLINE static void secp256k1_ecmult_table_get_ge_storage(secp256k1_ge *r, const secp256k1_ge_storage *pre, int n, int w) {
  146|   276k|    secp256k1_ecmult_table_verify(n,w);
  147|   276k|    if (n > 0) {
  ------------------
  |  Branch (147:9): [True: 153k, False: 123k]
  ------------------
  148|   153k|        secp256k1_ge_from_storage(r, &pre[(n-1)/2]);
  149|   153k|    } else {
  150|   123k|        secp256k1_ge_from_storage(r, &pre[(-n-1)/2]);
  151|   123k|        secp256k1_fe_negate(&(r->y), &(r->y), 1);
  ------------------
  |  |  211|   123k|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|   123k|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|   123k|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 123k]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|   123k|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 123k, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|   123k|    } \
  |  |  |  |   94|   123k|    stmt; \
  |  |  |  |   95|   123k|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 123k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  152|   123k|    }
  153|   276k|}

secp256k1.c:secp256k1_fe_impl_sqr:
  317|  22.8M|SECP256K1_FORCE_INLINE static void secp256k1_fe_impl_sqr(secp256k1_fe *r, const secp256k1_fe *a) {
  318|  22.8M|    secp256k1_fe_sqr_inner(r->n, a->n);
  319|  22.8M|}
secp256k1.c:secp256k1_fe_impl_mul:
  313|  24.5M|SECP256K1_FORCE_INLINE static void secp256k1_fe_impl_mul(secp256k1_fe *r, const secp256k1_fe *a, const secp256k1_fe * SECP256K1_RESTRICT b) {
  314|  24.5M|    secp256k1_fe_mul_inner(r->n, a->n, b->n);
  315|  24.5M|}
secp256k1.c:secp256k1_fe_impl_add_int:
  301|  19.9k|SECP256K1_INLINE static void secp256k1_fe_impl_add_int(secp256k1_fe *r, int a) {
  302|  19.9k|    r->n[0] += a;
  303|  19.9k|}
secp256k1.c:secp256k1_fe_impl_is_zero:
  206|  30.7k|SECP256K1_INLINE static int secp256k1_fe_impl_is_zero(const secp256k1_fe *a) {
  207|  30.7k|    const uint64_t *t = a->n;
  208|  30.7k|    return (t[0] | t[1] | t[2] | t[3] | t[4]) == 0;
  209|  30.7k|}
secp256k1.c:secp256k1_fe_impl_add:
  305|  24.1M|SECP256K1_INLINE static void secp256k1_fe_impl_add(secp256k1_fe *r, const secp256k1_fe *a) {
  306|  24.1M|    r->n[0] += a->n[0];
  307|  24.1M|    r->n[1] += a->n[1];
  308|  24.1M|    r->n[2] += a->n[2];
  309|  24.1M|    r->n[3] += a->n[3];
  310|  24.1M|    r->n[4] += a->n[4];
  311|  24.1M|}
secp256k1.c:secp256k1_fe_impl_normalize_weak:
   80|  16.2k|static void secp256k1_fe_impl_normalize_weak(secp256k1_fe *r) {
   81|  16.2k|    uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
   82|       |
   83|       |    /* Reduce t4 at the start so there will be at most a single carry from the first pass */
   84|  16.2k|    uint64_t x = t4 >> 48; t4 &= 0x0FFFFFFFFFFFFULL;
   85|       |
   86|       |    /* The first pass ensures the magnitude is 1, ... */
   87|  16.2k|    t0 += x * 0x1000003D1ULL;
   88|  16.2k|    t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL;
   89|  16.2k|    t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL;
   90|  16.2k|    t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL;
   91|  16.2k|    t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL;
   92|       |
   93|       |    /* ... except for a possible carry at bit 48 of t4 (i.e. bit 256 of the field element) */
   94|  16.2k|    VERIFY_CHECK(t4 >> 49 == 0);
   95|       |
   96|  16.2k|    r->n[0] = t0; r->n[1] = t1; r->n[2] = t2; r->n[3] = t3; r->n[4] = t4;
   97|  16.2k|}
secp256k1.c:secp256k1_fe_impl_negate_unchecked:
  278|  12.6M|SECP256K1_INLINE static void secp256k1_fe_impl_negate_unchecked(secp256k1_fe *r, const secp256k1_fe *a, int m) {
  279|       |    /* For all legal values of m (0..31), the following properties hold: */
  280|  12.6M|    VERIFY_CHECK(0xFFFFEFFFFFC2FULL * 2 * (m + 1) >= 0xFFFFFFFFFFFFFULL * 2 * m);
  281|  12.6M|    VERIFY_CHECK(0xFFFFFFFFFFFFFULL * 2 * (m + 1) >= 0xFFFFFFFFFFFFFULL * 2 * m);
  282|  12.6M|    VERIFY_CHECK(0x0FFFFFFFFFFFFULL * 2 * (m + 1) >= 0x0FFFFFFFFFFFFULL * 2 * m);
  283|       |
  284|       |    /* Due to the properties above, the left hand in the subtractions below is never less than
  285|       |     * the right hand. */
  286|  12.6M|    r->n[0] = 0xFFFFEFFFFFC2FULL * 2 * (m + 1) - a->n[0];
  287|  12.6M|    r->n[1] = 0xFFFFFFFFFFFFFULL * 2 * (m + 1) - a->n[1];
  288|  12.6M|    r->n[2] = 0xFFFFFFFFFFFFFULL * 2 * (m + 1) - a->n[2];
  289|  12.6M|    r->n[3] = 0xFFFFFFFFFFFFFULL * 2 * (m + 1) - a->n[3];
  290|  12.6M|    r->n[4] = 0x0FFFFFFFFFFFFULL * 2 * (m + 1) - a->n[4];
  291|  12.6M|}
secp256k1.c:secp256k1_fe_impl_cmov:
  321|  8.81M|SECP256K1_INLINE static void secp256k1_fe_impl_cmov(secp256k1_fe *r, const secp256k1_fe *a, int flag) {
  322|  8.81M|    uint64_t mask0, mask1;
  323|  8.81M|    volatile int vflag = flag;
  324|  8.81M|    VERIFY_CHECK(flag == 0 || flag == 1);
  325|  8.81M|    SECP256K1_CHECKMEM_CHECK_VERIFY(r->n, sizeof(r->n));
  ------------------
  |  |  114|  8.81M|#define SECP256K1_CHECKMEM_CHECK_VERIFY(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|  8.81M|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 8.81M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  326|  8.81M|    mask0 = vflag + ~((uint64_t)0);
  327|  8.81M|    mask1 = ~mask0;
  328|  8.81M|    r->n[0] = (r->n[0] & mask0) | (a->n[0] & mask1);
  329|  8.81M|    r->n[1] = (r->n[1] & mask0) | (a->n[1] & mask1);
  330|  8.81M|    r->n[2] = (r->n[2] & mask0) | (a->n[2] & mask1);
  331|  8.81M|    r->n[3] = (r->n[3] & mask0) | (a->n[3] & mask1);
  332|  8.81M|    r->n[4] = (r->n[4] & mask0) | (a->n[4] & mask1);
  333|  8.81M|}
secp256k1.c:secp256k1_fe_impl_normalizes_to_zero:
  137|  2.54M|static int secp256k1_fe_impl_normalizes_to_zero(const secp256k1_fe *r) {
  138|  2.54M|    uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
  139|       |
  140|       |    /* z0 tracks a possible raw value of 0, z1 tracks a possible raw value of P */
  141|  2.54M|    uint64_t z0, z1;
  142|       |
  143|       |    /* Reduce t4 at the start so there will be at most a single carry from the first pass */
  144|  2.54M|    uint64_t x = t4 >> 48; t4 &= 0x0FFFFFFFFFFFFULL;
  145|       |
  146|       |    /* The first pass ensures the magnitude is 1, ... */
  147|  2.54M|    t0 += x * 0x1000003D1ULL;
  148|  2.54M|    t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL; z0  = t0; z1  = t0 ^ 0x1000003D0ULL;
  149|  2.54M|    t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL; z0 |= t1; z1 &= t1;
  150|  2.54M|    t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL; z0 |= t2; z1 &= t2;
  151|  2.54M|    t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL; z0 |= t3; z1 &= t3;
  152|  2.54M|                                                z0 |= t4; z1 &= t4 ^ 0xF000000000000ULL;
  153|       |
  154|       |    /* ... except for a possible carry at bit 48 of t4 (i.e. bit 256 of the field element) */
  155|  2.54M|    VERIFY_CHECK(t4 >> 49 == 0);
  156|       |
  157|  2.54M|    return (z0 == 0) | (z1 == 0xFFFFFFFFFFFFFULL);
  158|  2.54M|}
secp256k1.c:secp256k1_fe_impl_set_int:
  201|   226k|SECP256K1_INLINE static void secp256k1_fe_impl_set_int(secp256k1_fe *r, int a) {
  202|   226k|    r->n[0] = a;
  203|   226k|    r->n[1] = r->n[2] = r->n[3] = r->n[4] = 0;
  204|   226k|}
secp256k1.c:secp256k1_fe_impl_mul_int_unchecked:
  293|  4.59M|SECP256K1_INLINE static void secp256k1_fe_impl_mul_int_unchecked(secp256k1_fe *r, int a) {
  294|  4.59M|    r->n[0] *= a;
  295|  4.59M|    r->n[1] *= a;
  296|  4.59M|    r->n[2] *= a;
  297|  4.59M|    r->n[3] *= a;
  298|  4.59M|    r->n[4] *= a;
  299|  4.59M|}
secp256k1.c:secp256k1_fe_impl_half:
  335|  3.33M|static SECP256K1_INLINE void secp256k1_fe_impl_half(secp256k1_fe *r) {
  336|  3.33M|    uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
  337|  3.33M|    uint64_t one = (uint64_t)1;
  338|  3.33M|    uint64_t mask = -(t0 & one) >> 12;
  339|       |
  340|       |    /* Bounds analysis (over the rationals).
  341|       |     *
  342|       |     * Let m = r->magnitude
  343|       |     *     C = 0xFFFFFFFFFFFFFULL * 2
  344|       |     *     D = 0x0FFFFFFFFFFFFULL * 2
  345|       |     *
  346|       |     * Initial bounds: t0..t3 <= C * m
  347|       |     *                     t4 <= D * m
  348|       |     */
  349|       |
  350|  3.33M|    t0 += 0xFFFFEFFFFFC2FULL & mask;
  351|  3.33M|    t1 += mask;
  352|  3.33M|    t2 += mask;
  353|  3.33M|    t3 += mask;
  354|  3.33M|    t4 += mask >> 4;
  355|       |
  356|  3.33M|    VERIFY_CHECK((t0 & one) == 0);
  357|       |
  358|       |    /* t0..t3: added <= C/2
  359|       |     *     t4: added <= D/2
  360|       |     *
  361|       |     * Current bounds: t0..t3 <= C * (m + 1/2)
  362|       |     *                     t4 <= D * (m + 1/2)
  363|       |     */
  364|       |
  365|  3.33M|    r->n[0] = (t0 >> 1) + ((t1 & one) << 51);
  366|  3.33M|    r->n[1] = (t1 >> 1) + ((t2 & one) << 51);
  367|  3.33M|    r->n[2] = (t2 >> 1) + ((t3 & one) << 51);
  368|  3.33M|    r->n[3] = (t3 >> 1) + ((t4 & one) << 51);
  369|  3.33M|    r->n[4] = (t4 >> 1);
  370|       |
  371|       |    /* t0..t3: shifted right and added <= C/4 + 1/2
  372|       |     *     t4: shifted right
  373|       |     *
  374|       |     * Current bounds: t0..t3 <= C * (m/2 + 1/2)
  375|       |     *                     t4 <= D * (m/2 + 1/4)
  376|       |     *
  377|       |     * Therefore the output magnitude (M) has to be set such that:
  378|       |     *     t0..t3: C * M >= C * (m/2 + 1/2)
  379|       |     *         t4: D * M >= D * (m/2 + 1/4)
  380|       |     *
  381|       |     * It suffices for all limbs that, for any input magnitude m:
  382|       |     *     M >= m/2 + 1/2
  383|       |     *
  384|       |     * and since we want the smallest such integer value for M:
  385|       |     *     M == floor(m/2) + 1
  386|       |     */
  387|  3.33M|}
secp256k1.c:secp256k1_fe_impl_inv:
  453|  31.0k|static void secp256k1_fe_impl_inv(secp256k1_fe *r, const secp256k1_fe *x) {
  454|  31.0k|    secp256k1_fe tmp = *x;
  455|  31.0k|    secp256k1_modinv64_signed62 s;
  456|       |
  457|  31.0k|    secp256k1_fe_normalize(&tmp);
  ------------------
  |  |   78|  31.0k|#  define secp256k1_fe_normalize secp256k1_fe_impl_normalize
  ------------------
  458|  31.0k|    secp256k1_fe_to_signed62(&s, &tmp);
  459|  31.0k|    secp256k1_modinv64(&s, &secp256k1_const_modinfo_fe);
  460|  31.0k|    secp256k1_fe_from_signed62(r, &s);
  461|  31.0k|}
secp256k1.c:secp256k1_fe_to_signed62:
  437|  34.7k|static void secp256k1_fe_to_signed62(secp256k1_modinv64_signed62 *r, const secp256k1_fe *a) {
  438|  34.7k|    const uint64_t M62 = UINT64_MAX >> 2;
  439|  34.7k|    const uint64_t a0 = a->n[0], a1 = a->n[1], a2 = a->n[2], a3 = a->n[3], a4 = a->n[4];
  440|       |
  441|  34.7k|    r->v[0] = (a0       | a1 << 52) & M62;
  442|  34.7k|    r->v[1] = (a1 >> 10 | a2 << 42) & M62;
  443|  34.7k|    r->v[2] = (a2 >> 20 | a3 << 32) & M62;
  444|  34.7k|    r->v[3] = (a3 >> 30 | a4 << 22) & M62;
  445|  34.7k|    r->v[4] =  a4 >> 40;
  446|  34.7k|}
secp256k1.c:secp256k1_fe_from_signed62:
  417|  34.7k|static void secp256k1_fe_from_signed62(secp256k1_fe *r, const secp256k1_modinv64_signed62 *a) {
  418|  34.7k|    const uint64_t M52 = UINT64_MAX >> 12;
  419|  34.7k|    const uint64_t a0 = a->v[0], a1 = a->v[1], a2 = a->v[2], a3 = a->v[3], a4 = a->v[4];
  420|       |
  421|       |    /* The output from secp256k1_modinv64{_var} should be normalized to range [0,modulus), and
  422|       |     * have limbs in [0,2^62). The modulus is < 2^256, so the top limb must be below 2^(256-62*4).
  423|       |     */
  424|  34.7k|    VERIFY_CHECK(a0 >> 62 == 0);
  425|  34.7k|    VERIFY_CHECK(a1 >> 62 == 0);
  426|  34.7k|    VERIFY_CHECK(a2 >> 62 == 0);
  427|  34.7k|    VERIFY_CHECK(a3 >> 62 == 0);
  428|  34.7k|    VERIFY_CHECK(a4 >> 8 == 0);
  429|       |
  430|  34.7k|    r->n[0] =  a0                   & M52;
  431|  34.7k|    r->n[1] = (a0 >> 52 | a1 << 10) & M52;
  432|  34.7k|    r->n[2] = (a1 >> 42 | a2 << 20) & M52;
  433|  34.7k|    r->n[3] = (a2 >> 32 | a3 << 30) & M52;
  434|  34.7k|    r->n[4] = (a3 >> 22 | a4 << 40);
  435|  34.7k|}
secp256k1.c:secp256k1_fe_impl_set_b32_limit:
  265|  30.7k|static int secp256k1_fe_impl_set_b32_limit(secp256k1_fe *r, const unsigned char *a) {
  266|  30.7k|    secp256k1_fe_impl_set_b32_mod(r, a);
  267|  30.7k|    return !((r->n[4] == 0x0FFFFFFFFFFFFULL) & ((r->n[3] & r->n[2] & r->n[1]) == 0xFFFFFFFFFFFFFULL) & (r->n[0] >= 0xFFFFEFFFFFC2FULL));
  268|  30.7k|}
secp256k1.c:secp256k1_fe_impl_get_b32:
  271|  32.9k|static void secp256k1_fe_impl_get_b32(unsigned char *r, const secp256k1_fe *a) {
  272|  32.9k|    secp256k1_write_be64(&r[0], (a->n[4] << 16) | (a->n[3] >> 36));
  273|  32.9k|    secp256k1_write_be64(&r[8], (a->n[3] << 28) | (a->n[2] >> 24));
  274|  32.9k|    secp256k1_write_be64(&r[16], (a->n[2] << 40) | (a->n[1] >> 12));
  275|  32.9k|    secp256k1_write_be64(&r[24], (a->n[1] << 52) | a->n[0]);
  276|  32.9k|}
secp256k1.c:secp256k1_fe_impl_normalize_var:
   99|  59.7k|static void secp256k1_fe_impl_normalize_var(secp256k1_fe *r) {
  100|  59.7k|    uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
  101|       |
  102|       |    /* Reduce t4 at the start so there will be at most a single carry from the first pass */
  103|  59.7k|    uint64_t m;
  104|  59.7k|    uint64_t x = t4 >> 48; t4 &= 0x0FFFFFFFFFFFFULL;
  105|       |
  106|       |    /* The first pass ensures the magnitude is 1, ... */
  107|  59.7k|    t0 += x * 0x1000003D1ULL;
  108|  59.7k|    t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL;
  109|  59.7k|    t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL; m = t1;
  110|  59.7k|    t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL; m &= t2;
  111|  59.7k|    t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL; m &= t3;
  112|       |
  113|       |    /* ... except for a possible carry at bit 48 of t4 (i.e. bit 256 of the field element) */
  114|  59.7k|    VERIFY_CHECK(t4 >> 49 == 0);
  115|       |
  116|       |    /* At most a single final reduction is needed; check if the value is >= the field characteristic */
  117|  59.7k|    x = (t4 >> 48) | ((t4 == 0x0FFFFFFFFFFFFULL) & (m == 0xFFFFFFFFFFFFFULL)
  118|  59.7k|        & (t0 >= 0xFFFFEFFFFFC2FULL));
  119|       |
  120|  59.7k|    if (x) {
  ------------------
  |  Branch (120:9): [True: 0, False: 59.7k]
  ------------------
  121|      0|        t0 += 0x1000003D1ULL;
  122|      0|        t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL;
  123|      0|        t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL;
  124|      0|        t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL;
  125|      0|        t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL;
  126|       |
  127|       |        /* If t4 didn't carry to bit 48 already, then it should have after any final reduction */
  128|      0|        VERIFY_CHECK(t4 >> 48 == x);
  129|       |
  130|       |        /* Mask off the possible multiple of 2^256 from the final reduction */
  131|      0|        t4 &= 0x0FFFFFFFFFFFFULL;
  132|      0|    }
  133|       |
  134|  59.7k|    r->n[0] = t0; r->n[1] = t1; r->n[2] = t2; r->n[3] = t3; r->n[4] = t4;
  135|  59.7k|}
secp256k1.c:secp256k1_fe_impl_is_odd:
  211|  38.0k|SECP256K1_INLINE static int secp256k1_fe_impl_is_odd(const secp256k1_fe *a) {
  212|  38.0k|    return a->n[0] & 1;
  213|  38.0k|}
secp256k1.c:secp256k1_fe_impl_from_storage:
  409|  3.13M|static SECP256K1_INLINE void secp256k1_fe_impl_from_storage(secp256k1_fe *r, const secp256k1_fe_storage *a) {
  410|  3.13M|    r->n[0] = a->n[0] & 0xFFFFFFFFFFFFFULL;
  411|  3.13M|    r->n[1] = a->n[0] >> 52 | ((a->n[1] << 12) & 0xFFFFFFFFFFFFFULL);
  412|  3.13M|    r->n[2] = a->n[1] >> 40 | ((a->n[2] << 24) & 0xFFFFFFFFFFFFFULL);
  413|  3.13M|    r->n[3] = a->n[2] >> 28 | ((a->n[3] << 36) & 0xFFFFFFFFFFFFFULL);
  414|  3.13M|    r->n[4] = a->n[3] >> 16;
  415|  3.13M|}
secp256k1.c:secp256k1_fe_impl_normalizes_to_zero_var:
  160|  1.00M|static int secp256k1_fe_impl_normalizes_to_zero_var(const secp256k1_fe *r) {
  161|  1.00M|    uint64_t t0, t1, t2, t3, t4;
  162|  1.00M|    uint64_t z0, z1;
  163|  1.00M|    uint64_t x;
  164|       |
  165|  1.00M|    t0 = r->n[0];
  166|  1.00M|    t4 = r->n[4];
  167|       |
  168|       |    /* Reduce t4 at the start so there will be at most a single carry from the first pass */
  169|  1.00M|    x = t4 >> 48;
  170|       |
  171|       |    /* The first pass ensures the magnitude is 1, ... */
  172|  1.00M|    t0 += x * 0x1000003D1ULL;
  173|       |
  174|       |    /* z0 tracks a possible raw value of 0, z1 tracks a possible raw value of P */
  175|  1.00M|    z0 = t0 & 0xFFFFFFFFFFFFFULL;
  176|  1.00M|    z1 = z0 ^ 0x1000003D0ULL;
  177|       |
  178|       |    /* Fast return path should catch the majority of cases */
  179|  1.00M|    if ((z0 != 0ULL) & (z1 != 0xFFFFFFFFFFFFFULL)) {
  ------------------
  |  Branch (179:9): [True: 1.00M, False: 4]
  ------------------
  180|  1.00M|        return 0;
  181|  1.00M|    }
  182|       |
  183|      4|    t1 = r->n[1];
  184|      4|    t2 = r->n[2];
  185|      4|    t3 = r->n[3];
  186|       |
  187|      4|    t4 &= 0x0FFFFFFFFFFFFULL;
  188|       |
  189|      4|    t1 += (t0 >> 52);
  190|      4|    t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL; z0 |= t1; z1 &= t1;
  191|      4|    t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL; z0 |= t2; z1 &= t2;
  192|      4|    t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL; z0 |= t3; z1 &= t3;
  193|      4|                                                z0 |= t4; z1 &= t4 ^ 0xF000000000000ULL;
  194|       |
  195|       |    /* ... except for a possible carry at bit 48 of t4 (i.e. bit 256 of the field element) */
  196|      4|    VERIFY_CHECK(t4 >> 49 == 0);
  197|       |
  198|      4|    return (z0 == 0) | (z1 == 0xFFFFFFFFFFFFFULL);
  199|  1.00M|}
secp256k1.c:secp256k1_fe_impl_inv_var:
  463|  3.62k|static void secp256k1_fe_impl_inv_var(secp256k1_fe *r, const secp256k1_fe *x) {
  464|  3.62k|    secp256k1_fe tmp = *x;
  465|  3.62k|    secp256k1_modinv64_signed62 s;
  466|       |
  467|  3.62k|    secp256k1_fe_normalize_var(&tmp);
  ------------------
  |  |   80|  3.62k|#  define secp256k1_fe_normalize_var secp256k1_fe_impl_normalize_var
  ------------------
  468|  3.62k|    secp256k1_fe_to_signed62(&s, &tmp);
  469|  3.62k|    secp256k1_modinv64_var(&s, &secp256k1_const_modinfo_fe);
  470|  3.62k|    secp256k1_fe_from_signed62(r, &s);
  471|  3.62k|}
secp256k1.c:secp256k1_fe_storage_cmov:
  389|  80.5M|static SECP256K1_INLINE void secp256k1_fe_storage_cmov(secp256k1_fe_storage *r, const secp256k1_fe_storage *a, int flag) {
  390|  80.5M|    uint64_t mask0, mask1;
  391|  80.5M|    volatile int vflag = flag;
  392|  80.5M|    VERIFY_CHECK(flag == 0 || flag == 1);
  393|  80.5M|    SECP256K1_CHECKMEM_CHECK_VERIFY(r->n, sizeof(r->n));
  ------------------
  |  |  114|  80.5M|#define SECP256K1_CHECKMEM_CHECK_VERIFY(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|  80.5M|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 80.5M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  394|  80.5M|    mask0 = vflag + ~((uint64_t)0);
  395|  80.5M|    mask1 = ~mask0;
  396|  80.5M|    r->n[0] = (r->n[0] & mask0) | (a->n[0] & mask1);
  397|  80.5M|    r->n[1] = (r->n[1] & mask0) | (a->n[1] & mask1);
  398|  80.5M|    r->n[2] = (r->n[2] & mask0) | (a->n[2] & mask1);
  399|  80.5M|    r->n[3] = (r->n[3] & mask0) | (a->n[3] & mask1);
  400|  80.5M|}
secp256k1.c:secp256k1_fe_impl_set_b32_mod:
  228|  30.7k|static void secp256k1_fe_impl_set_b32_mod(secp256k1_fe *r, const unsigned char *a) {
  229|  30.7k|    r->n[0] = (uint64_t)a[31]
  230|  30.7k|            | ((uint64_t)a[30] << 8)
  231|  30.7k|            | ((uint64_t)a[29] << 16)
  232|  30.7k|            | ((uint64_t)a[28] << 24)
  233|  30.7k|            | ((uint64_t)a[27] << 32)
  234|  30.7k|            | ((uint64_t)a[26] << 40)
  235|  30.7k|            | ((uint64_t)(a[25] & 0xF)  << 48);
  236|  30.7k|    r->n[1] = (uint64_t)((a[25] >> 4) & 0xF)
  237|  30.7k|            | ((uint64_t)a[24] << 4)
  238|  30.7k|            | ((uint64_t)a[23] << 12)
  239|  30.7k|            | ((uint64_t)a[22] << 20)
  240|  30.7k|            | ((uint64_t)a[21] << 28)
  241|  30.7k|            | ((uint64_t)a[20] << 36)
  242|  30.7k|            | ((uint64_t)a[19] << 44);
  243|  30.7k|    r->n[2] = (uint64_t)a[18]
  244|  30.7k|            | ((uint64_t)a[17] << 8)
  245|  30.7k|            | ((uint64_t)a[16] << 16)
  246|  30.7k|            | ((uint64_t)a[15] << 24)
  247|  30.7k|            | ((uint64_t)a[14] << 32)
  248|  30.7k|            | ((uint64_t)a[13] << 40)
  249|  30.7k|            | ((uint64_t)(a[12] & 0xF) << 48);
  250|  30.7k|    r->n[3] = (uint64_t)((a[12] >> 4) & 0xF)
  251|  30.7k|            | ((uint64_t)a[11] << 4)
  252|  30.7k|            | ((uint64_t)a[10] << 12)
  253|  30.7k|            | ((uint64_t)a[9]  << 20)
  254|  30.7k|            | ((uint64_t)a[8]  << 28)
  255|  30.7k|            | ((uint64_t)a[7]  << 36)
  256|  30.7k|            | ((uint64_t)a[6]  << 44);
  257|  30.7k|    r->n[4] = (uint64_t)a[5]
  258|  30.7k|            | ((uint64_t)a[4] << 8)
  259|  30.7k|            | ((uint64_t)a[3] << 16)
  260|  30.7k|            | ((uint64_t)a[2] << 24)
  261|  30.7k|            | ((uint64_t)a[1] << 32)
  262|  30.7k|            | ((uint64_t)a[0] << 40);
  263|  30.7k|}
secp256k1.c:secp256k1_fe_impl_normalize:
   43|   133k|static void secp256k1_fe_impl_normalize(secp256k1_fe *r) {
   44|   133k|    uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
   45|       |
   46|       |    /* Reduce t4 at the start so there will be at most a single carry from the first pass */
   47|   133k|    uint64_t m;
   48|   133k|    uint64_t x = t4 >> 48; t4 &= 0x0FFFFFFFFFFFFULL;
   49|       |
   50|       |    /* The first pass ensures the magnitude is 1, ... */
   51|   133k|    t0 += x * 0x1000003D1ULL;
   52|   133k|    t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL;
   53|   133k|    t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL; m = t1;
   54|   133k|    t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL; m &= t2;
   55|   133k|    t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL; m &= t3;
   56|       |
   57|       |    /* ... except for a possible carry at bit 48 of t4 (i.e. bit 256 of the field element) */
   58|   133k|    VERIFY_CHECK(t4 >> 49 == 0);
   59|       |
   60|       |    /* At most a single final reduction is needed; check if the value is >= the field characteristic */
   61|   133k|    x = (t4 >> 48) | ((t4 == 0x0FFFFFFFFFFFFULL) & (m == 0xFFFFFFFFFFFFFULL)
   62|   133k|        & (t0 >= 0xFFFFEFFFFFC2FULL));
   63|       |
   64|       |    /* Apply the final reduction (for constant-time behaviour, we do it always) */
   65|   133k|    t0 += x * 0x1000003D1ULL;
   66|   133k|    t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL;
   67|   133k|    t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL;
   68|   133k|    t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL;
   69|   133k|    t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL;
   70|       |
   71|       |    /* If t4 didn't carry to bit 48 already, then it should have after any final reduction */
   72|   133k|    VERIFY_CHECK(t4 >> 48 == x);
   73|       |
   74|       |    /* Mask off the possible multiple of 2^256 from the final reduction */
   75|   133k|    t4 &= 0x0FFFFFFFFFFFFULL;
   76|       |
   77|   133k|    r->n[0] = t0; r->n[1] = t1; r->n[2] = t2; r->n[3] = t3; r->n[4] = t4;
   78|   133k|}
secp256k1.c:secp256k1_fe_impl_to_storage:
  402|  76.0k|static void secp256k1_fe_impl_to_storage(secp256k1_fe_storage *r, const secp256k1_fe *a) {
  403|  76.0k|    r->n[0] = a->n[0] | a->n[1] << 52;
  404|  76.0k|    r->n[1] = a->n[1] >> 12 | a->n[2] << 40;
  405|  76.0k|    r->n[2] = a->n[2] >> 24 | a->n[3] << 28;
  406|  76.0k|    r->n[3] = a->n[3] >> 36 | a->n[4] << 16;
  407|  76.0k|}

secp256k1.c:secp256k1_fe_sqr_inner:
  154|  22.8M|SECP256K1_FORCE_INLINE static void secp256k1_fe_sqr_inner(uint64_t *r, const uint64_t *a) {
  155|  22.8M|    secp256k1_uint128 c, d;
  156|  22.8M|    uint64_t a0 = a[0], a1 = a[1], a2 = a[2], a3 = a[3], a4 = a[4];
  157|  22.8M|    uint64_t t3, t4, tx, u0;
  158|  22.8M|    const uint64_t M = 0xFFFFFFFFFFFFFULL, R = 0x1000003D10ULL;
  159|       |
  160|  22.8M|    VERIFY_BITS(a[0], 56);
  161|  22.8M|    VERIFY_BITS(a[1], 56);
  162|  22.8M|    VERIFY_BITS(a[2], 56);
  163|  22.8M|    VERIFY_BITS(a[3], 56);
  164|  22.8M|    VERIFY_BITS(a[4], 52);
  165|       |
  166|       |    /**  [... a b c] is a shorthand for ... + a<<104 + b<<52 + c<<0 mod n.
  167|       |     *  px is a shorthand for sum(a[i]*a[x-i], i=0..x).
  168|       |     *  Note that [x 0 0 0 0 0] = [x*R].
  169|       |     */
  170|       |
  171|  22.8M|    secp256k1_u128_mul(&d, a0*2, a3);
  172|  22.8M|    secp256k1_u128_accum_mul(&d, a1*2, a2);
  173|  22.8M|    VERIFY_BITS_128(&d, 114);
  174|       |    /* [d 0 0 0] = [p3 0 0 0] */
  175|  22.8M|    secp256k1_u128_mul(&c, a4, a4);
  176|  22.8M|    VERIFY_BITS_128(&c, 112);
  177|       |    /* [c 0 0 0 0 d 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
  178|  22.8M|    secp256k1_u128_accum_mul(&d, R, secp256k1_u128_to_u64(&c)); secp256k1_u128_rshift(&c, 64);
  179|  22.8M|    VERIFY_BITS_128(&d, 115);
  180|  22.8M|    VERIFY_BITS_128(&c, 48);
  181|       |    /* [(c<<12) 0 0 0 0 0 d 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
  182|  22.8M|    t3 = secp256k1_u128_to_u64(&d) & M; secp256k1_u128_rshift(&d, 52);
  183|  22.8M|    VERIFY_BITS(t3, 52);
  184|  22.8M|    VERIFY_BITS_128(&d, 63);
  185|       |    /* [(c<<12) 0 0 0 0 d t3 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
  186|       |
  187|  22.8M|    a4 *= 2;
  188|  22.8M|    secp256k1_u128_accum_mul(&d, a0, a4);
  189|  22.8M|    secp256k1_u128_accum_mul(&d, a1*2, a3);
  190|  22.8M|    secp256k1_u128_accum_mul(&d, a2, a2);
  191|  22.8M|    VERIFY_BITS_128(&d, 115);
  192|       |    /* [(c<<12) 0 0 0 0 d t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
  193|  22.8M|    secp256k1_u128_accum_mul(&d, R << 12, secp256k1_u128_to_u64(&c));
  194|  22.8M|    VERIFY_BITS_128(&d, 116);
  195|       |    /* [d t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
  196|  22.8M|    t4 = secp256k1_u128_to_u64(&d) & M; secp256k1_u128_rshift(&d, 52);
  197|  22.8M|    VERIFY_BITS(t4, 52);
  198|  22.8M|    VERIFY_BITS_128(&d, 64);
  199|       |    /* [d t4 t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
  200|  22.8M|    tx = (t4 >> 48); t4 &= (M >> 4);
  201|  22.8M|    VERIFY_BITS(tx, 4);
  202|  22.8M|    VERIFY_BITS(t4, 48);
  203|       |    /* [d t4+(tx<<48) t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
  204|       |
  205|  22.8M|    secp256k1_u128_mul(&c, a0, a0);
  206|  22.8M|    VERIFY_BITS_128(&c, 112);
  207|       |    /* [d t4+(tx<<48) t3 0 0 c] = [p8 0 0 0 p4 p3 0 0 p0] */
  208|  22.8M|    secp256k1_u128_accum_mul(&d, a1, a4);
  209|  22.8M|    secp256k1_u128_accum_mul(&d, a2*2, a3);
  210|  22.8M|    VERIFY_BITS_128(&d, 114);
  211|       |    /* [d t4+(tx<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
  212|  22.8M|    u0 = secp256k1_u128_to_u64(&d) & M; secp256k1_u128_rshift(&d, 52);
  213|  22.8M|    VERIFY_BITS(u0, 52);
  214|  22.8M|    VERIFY_BITS_128(&d, 62);
  215|       |    /* [d u0 t4+(tx<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
  216|       |    /* [d 0 t4+(tx<<48)+(u0<<52) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
  217|  22.8M|    u0 = (u0 << 4) | tx;
  218|  22.8M|    VERIFY_BITS(u0, 56);
  219|       |    /* [d 0 t4+(u0<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
  220|  22.8M|    secp256k1_u128_accum_mul(&c, u0, R >> 4);
  221|  22.8M|    VERIFY_BITS_128(&c, 113);
  222|       |    /* [d 0 t4 t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
  223|  22.8M|    r[0] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  224|  22.8M|    VERIFY_BITS(r[0], 52);
  225|  22.8M|    VERIFY_BITS_128(&c, 61);
  226|       |    /* [d 0 t4 t3 0 c r0] = [p8 0 0 p5 p4 p3 0 0 p0] */
  227|       |
  228|  22.8M|    a0 *= 2;
  229|  22.8M|    secp256k1_u128_accum_mul(&c, a0, a1);
  230|  22.8M|    VERIFY_BITS_128(&c, 114);
  231|       |    /* [d 0 t4 t3 0 c r0] = [p8 0 0 p5 p4 p3 0 p1 p0] */
  232|  22.8M|    secp256k1_u128_accum_mul(&d, a2, a4);
  233|  22.8M|    secp256k1_u128_accum_mul(&d, a3, a3);
  234|  22.8M|    VERIFY_BITS_128(&d, 114);
  235|       |    /* [d 0 t4 t3 0 c r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
  236|  22.8M|    secp256k1_u128_accum_mul(&c, secp256k1_u128_to_u64(&d) & M, R); secp256k1_u128_rshift(&d, 52);
  237|  22.8M|    VERIFY_BITS_128(&c, 115);
  238|  22.8M|    VERIFY_BITS_128(&d, 62);
  239|       |    /* [d 0 0 t4 t3 0 c r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
  240|  22.8M|    r[1] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  241|  22.8M|    VERIFY_BITS(r[1], 52);
  242|  22.8M|    VERIFY_BITS_128(&c, 63);
  243|       |    /* [d 0 0 t4 t3 c r1 r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
  244|       |
  245|  22.8M|    secp256k1_u128_accum_mul(&c, a0, a2);
  246|  22.8M|    secp256k1_u128_accum_mul(&c, a1, a1);
  247|  22.8M|    VERIFY_BITS_128(&c, 114);
  248|       |    /* [d 0 0 t4 t3 c r1 r0] = [p8 0 p6 p5 p4 p3 p2 p1 p0] */
  249|  22.8M|    secp256k1_u128_accum_mul(&d, a3, a4);
  250|  22.8M|    VERIFY_BITS_128(&d, 114);
  251|       |    /* [d 0 0 t4 t3 c r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  252|  22.8M|    secp256k1_u128_accum_mul(&c, R, secp256k1_u128_to_u64(&d)); secp256k1_u128_rshift(&d, 64);
  253|  22.8M|    VERIFY_BITS_128(&c, 115);
  254|  22.8M|    VERIFY_BITS_128(&d, 50);
  255|       |    /* [(d<<12) 0 0 0 t4 t3 c r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  256|  22.8M|    r[2] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  257|  22.8M|    VERIFY_BITS(r[2], 52);
  258|  22.8M|    VERIFY_BITS_128(&c, 63);
  259|       |    /* [(d<<12) 0 0 0 t4 t3+c r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  260|       |
  261|  22.8M|    secp256k1_u128_accum_mul(&c, R << 12, secp256k1_u128_to_u64(&d));
  262|  22.8M|    secp256k1_u128_accum_u64(&c, t3);
  263|  22.8M|    VERIFY_BITS_128(&c, 100);
  264|       |    /* [t4 c r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  265|  22.8M|    r[3] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  266|  22.8M|    VERIFY_BITS(r[3], 52);
  267|  22.8M|    VERIFY_BITS_128(&c, 48);
  268|       |    /* [t4+c r3 r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  269|  22.8M|    r[4] = secp256k1_u128_to_u64(&c) + t4;
  270|  22.8M|    VERIFY_BITS(r[4], 49);
  271|       |    /* [r4 r3 r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  272|  22.8M|}
secp256k1.c:secp256k1_fe_mul_inner:
   18|  24.5M|SECP256K1_FORCE_INLINE static void secp256k1_fe_mul_inner(uint64_t *r, const uint64_t *a, const uint64_t * SECP256K1_RESTRICT b) {
   19|  24.5M|    secp256k1_uint128 c, d;
   20|  24.5M|    uint64_t t3, t4, tx, u0;
   21|  24.5M|    uint64_t a0 = a[0], a1 = a[1], a2 = a[2], a3 = a[3], a4 = a[4];
   22|  24.5M|    const uint64_t M = 0xFFFFFFFFFFFFFULL, R = 0x1000003D10ULL;
   23|       |
   24|  24.5M|    VERIFY_BITS(a[0], 56);
   25|  24.5M|    VERIFY_BITS(a[1], 56);
   26|  24.5M|    VERIFY_BITS(a[2], 56);
   27|  24.5M|    VERIFY_BITS(a[3], 56);
   28|  24.5M|    VERIFY_BITS(a[4], 52);
   29|  24.5M|    VERIFY_BITS(b[0], 56);
   30|  24.5M|    VERIFY_BITS(b[1], 56);
   31|  24.5M|    VERIFY_BITS(b[2], 56);
   32|  24.5M|    VERIFY_BITS(b[3], 56);
   33|  24.5M|    VERIFY_BITS(b[4], 52);
   34|  24.5M|    VERIFY_CHECK(r != b);
   35|  24.5M|    VERIFY_CHECK(a != b);
   36|       |
   37|       |    /*  [... a b c] is a shorthand for ... + a<<104 + b<<52 + c<<0 mod n.
   38|       |     *  for 0 <= x <= 4, px is a shorthand for sum(a[i]*b[x-i], i=0..x).
   39|       |     *  for 4 <= x <= 8, px is a shorthand for sum(a[i]*b[x-i], i=(x-4)..4)
   40|       |     *  Note that [x 0 0 0 0 0] = [x*R].
   41|       |     */
   42|       |
   43|  24.5M|    secp256k1_u128_mul(&d, a0, b[3]);
   44|  24.5M|    secp256k1_u128_accum_mul(&d, a1, b[2]);
   45|  24.5M|    secp256k1_u128_accum_mul(&d, a2, b[1]);
   46|  24.5M|    secp256k1_u128_accum_mul(&d, a3, b[0]);
   47|  24.5M|    VERIFY_BITS_128(&d, 114);
   48|       |    /* [d 0 0 0] = [p3 0 0 0] */
   49|  24.5M|    secp256k1_u128_mul(&c, a4, b[4]);
   50|  24.5M|    VERIFY_BITS_128(&c, 112);
   51|       |    /* [c 0 0 0 0 d 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
   52|  24.5M|    secp256k1_u128_accum_mul(&d, R, secp256k1_u128_to_u64(&c)); secp256k1_u128_rshift(&c, 64);
   53|  24.5M|    VERIFY_BITS_128(&d, 115);
   54|  24.5M|    VERIFY_BITS_128(&c, 48);
   55|       |    /* [(c<<12) 0 0 0 0 0 d 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
   56|  24.5M|    t3 = secp256k1_u128_to_u64(&d) & M; secp256k1_u128_rshift(&d, 52);
   57|  24.5M|    VERIFY_BITS(t3, 52);
   58|  24.5M|    VERIFY_BITS_128(&d, 63);
   59|       |    /* [(c<<12) 0 0 0 0 d t3 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
   60|       |
   61|  24.5M|    secp256k1_u128_accum_mul(&d, a0, b[4]);
   62|  24.5M|    secp256k1_u128_accum_mul(&d, a1, b[3]);
   63|  24.5M|    secp256k1_u128_accum_mul(&d, a2, b[2]);
   64|  24.5M|    secp256k1_u128_accum_mul(&d, a3, b[1]);
   65|  24.5M|    secp256k1_u128_accum_mul(&d, a4, b[0]);
   66|  24.5M|    VERIFY_BITS_128(&d, 115);
   67|       |    /* [(c<<12) 0 0 0 0 d t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
   68|  24.5M|    secp256k1_u128_accum_mul(&d, R << 12, secp256k1_u128_to_u64(&c));
   69|  24.5M|    VERIFY_BITS_128(&d, 116);
   70|       |    /* [d t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
   71|  24.5M|    t4 = secp256k1_u128_to_u64(&d) & M; secp256k1_u128_rshift(&d, 52);
   72|  24.5M|    VERIFY_BITS(t4, 52);
   73|  24.5M|    VERIFY_BITS_128(&d, 64);
   74|       |    /* [d t4 t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
   75|  24.5M|    tx = (t4 >> 48); t4 &= (M >> 4);
   76|  24.5M|    VERIFY_BITS(tx, 4);
   77|  24.5M|    VERIFY_BITS(t4, 48);
   78|       |    /* [d t4+(tx<<48) t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
   79|       |
   80|  24.5M|    secp256k1_u128_mul(&c, a0, b[0]);
   81|  24.5M|    VERIFY_BITS_128(&c, 112);
   82|       |    /* [d t4+(tx<<48) t3 0 0 c] = [p8 0 0 0 p4 p3 0 0 p0] */
   83|  24.5M|    secp256k1_u128_accum_mul(&d, a1, b[4]);
   84|  24.5M|    secp256k1_u128_accum_mul(&d, a2, b[3]);
   85|  24.5M|    secp256k1_u128_accum_mul(&d, a3, b[2]);
   86|  24.5M|    secp256k1_u128_accum_mul(&d, a4, b[1]);
   87|  24.5M|    VERIFY_BITS_128(&d, 114);
   88|       |    /* [d t4+(tx<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
   89|  24.5M|    u0 = secp256k1_u128_to_u64(&d) & M; secp256k1_u128_rshift(&d, 52);
   90|  24.5M|    VERIFY_BITS(u0, 52);
   91|  24.5M|    VERIFY_BITS_128(&d, 62);
   92|       |    /* [d u0 t4+(tx<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
   93|       |    /* [d 0 t4+(tx<<48)+(u0<<52) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
   94|  24.5M|    u0 = (u0 << 4) | tx;
   95|  24.5M|    VERIFY_BITS(u0, 56);
   96|       |    /* [d 0 t4+(u0<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
   97|  24.5M|    secp256k1_u128_accum_mul(&c, u0, R >> 4);
   98|  24.5M|    VERIFY_BITS_128(&c, 113);
   99|       |    /* [d 0 t4 t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
  100|  24.5M|    r[0] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  101|  24.5M|    VERIFY_BITS(r[0], 52);
  102|  24.5M|    VERIFY_BITS_128(&c, 61);
  103|       |    /* [d 0 t4 t3 0 c r0] = [p8 0 0 p5 p4 p3 0 0 p0] */
  104|       |
  105|  24.5M|    secp256k1_u128_accum_mul(&c, a0, b[1]);
  106|  24.5M|    secp256k1_u128_accum_mul(&c, a1, b[0]);
  107|  24.5M|    VERIFY_BITS_128(&c, 114);
  108|       |    /* [d 0 t4 t3 0 c r0] = [p8 0 0 p5 p4 p3 0 p1 p0] */
  109|  24.5M|    secp256k1_u128_accum_mul(&d, a2, b[4]);
  110|  24.5M|    secp256k1_u128_accum_mul(&d, a3, b[3]);
  111|  24.5M|    secp256k1_u128_accum_mul(&d, a4, b[2]);
  112|  24.5M|    VERIFY_BITS_128(&d, 114);
  113|       |    /* [d 0 t4 t3 0 c r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
  114|  24.5M|    secp256k1_u128_accum_mul(&c, secp256k1_u128_to_u64(&d) & M, R); secp256k1_u128_rshift(&d, 52);
  115|  24.5M|    VERIFY_BITS_128(&c, 115);
  116|  24.5M|    VERIFY_BITS_128(&d, 62);
  117|       |    /* [d 0 0 t4 t3 0 c r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
  118|  24.5M|    r[1] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  119|  24.5M|    VERIFY_BITS(r[1], 52);
  120|  24.5M|    VERIFY_BITS_128(&c, 63);
  121|       |    /* [d 0 0 t4 t3 c r1 r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
  122|       |
  123|  24.5M|    secp256k1_u128_accum_mul(&c, a0, b[2]);
  124|  24.5M|    secp256k1_u128_accum_mul(&c, a1, b[1]);
  125|  24.5M|    secp256k1_u128_accum_mul(&c, a2, b[0]);
  126|  24.5M|    VERIFY_BITS_128(&c, 114);
  127|       |    /* [d 0 0 t4 t3 c r1 r0] = [p8 0 p6 p5 p4 p3 p2 p1 p0] */
  128|  24.5M|    secp256k1_u128_accum_mul(&d, a3, b[4]);
  129|  24.5M|    secp256k1_u128_accum_mul(&d, a4, b[3]);
  130|  24.5M|    VERIFY_BITS_128(&d, 114);
  131|       |    /* [d 0 0 t4 t3 c t1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  132|  24.5M|    secp256k1_u128_accum_mul(&c, R, secp256k1_u128_to_u64(&d)); secp256k1_u128_rshift(&d, 64);
  133|  24.5M|    VERIFY_BITS_128(&c, 115);
  134|  24.5M|    VERIFY_BITS_128(&d, 50);
  135|       |    /* [(d<<12) 0 0 0 t4 t3 c r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  136|       |
  137|  24.5M|    r[2] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  138|  24.5M|    VERIFY_BITS(r[2], 52);
  139|  24.5M|    VERIFY_BITS_128(&c, 63);
  140|       |    /* [(d<<12) 0 0 0 t4 t3+c r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  141|  24.5M|    secp256k1_u128_accum_mul(&c, R << 12, secp256k1_u128_to_u64(&d));
  142|  24.5M|    secp256k1_u128_accum_u64(&c, t3);
  143|  24.5M|    VERIFY_BITS_128(&c, 100);
  144|       |    /* [t4 c r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  145|  24.5M|    r[3] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  146|  24.5M|    VERIFY_BITS(r[3], 52);
  147|  24.5M|    VERIFY_BITS_128(&c, 48);
  148|       |    /* [t4+c r3 r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  149|  24.5M|    r[4] = secp256k1_u128_to_u64(&c) + t4;
  150|  24.5M|    VERIFY_BITS(r[4], 49);
  151|       |    /* [r4 r3 r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  152|  24.5M|}

secp256k1.c:secp256k1_fe_verify:
  149|  50.4M|static void secp256k1_fe_verify(const secp256k1_fe *a) { (void)a; }
secp256k1.c:secp256k1_fe_verify_magnitude:
  150|  48.9M|static void secp256k1_fe_verify_magnitude(const secp256k1_fe *a, int m) { (void)a; (void)m; }
secp256k1.c:secp256k1_fe_sqrt:
   37|  19.9k|static int secp256k1_fe_sqrt(secp256k1_fe * SECP256K1_RESTRICT r, const secp256k1_fe * SECP256K1_RESTRICT a) {
   38|       |    /** Given that p is congruent to 3 mod 4, we can compute the square root of
   39|       |     *  a mod p as the (p+1)/4'th power of a.
   40|       |     *
   41|       |     *  As (p+1)/4 is an even number, it will have the same result for a and for
   42|       |     *  (-a). Only one of these two numbers actually has a square root however,
   43|       |     *  so we test at the end by squaring and comparing to the input.
   44|       |     *  Also because (p+1)/4 is an even number, the computed square root is
   45|       |     *  itself always a square (a ** ((p+1)/4) is the square of a ** ((p+1)/8)).
   46|       |     */
   47|  19.9k|    secp256k1_fe x2, x3, x6, x9, x11, x22, x44, x88, x176, x220, x223, t1;
   48|  19.9k|    int j, ret;
   49|       |
   50|  19.9k|    VERIFY_CHECK(r != a);
   51|  19.9k|    SECP256K1_FE_VERIFY(a);
  ------------------
  |  |  345|  19.9k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   52|  19.9k|    SECP256K1_FE_VERIFY_MAGNITUDE(a, 8);
  ------------------
  |  |  349|  19.9k|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   53|       |
   54|       |    /** The binary representation of (p + 1)/4 has 3 blocks of 1s, with lengths in
   55|       |     *  { 2, 22, 223 }. Use an addition chain to calculate 2^n - 1 for each block:
   56|       |     *  1, [2], 3, 6, 9, 11, [22], 44, 88, 176, 220, [223]
   57|       |     */
   58|       |
   59|  19.9k|    secp256k1_fe_sqr(&x2, a);
  ------------------
  |  |   94|  19.9k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   60|  19.9k|    secp256k1_fe_mul(&x2, &x2, a);
  ------------------
  |  |   93|  19.9k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
   61|       |
   62|  19.9k|    secp256k1_fe_sqr(&x3, &x2);
  ------------------
  |  |   94|  19.9k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   63|  19.9k|    secp256k1_fe_mul(&x3, &x3, a);
  ------------------
  |  |   93|  19.9k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
   64|       |
   65|  19.9k|    x6 = x3;
   66|  79.6k|    for (j=0; j<3; j++) {
  ------------------
  |  Branch (66:15): [True: 59.7k, False: 19.9k]
  ------------------
   67|  59.7k|        secp256k1_fe_sqr(&x6, &x6);
  ------------------
  |  |   94|  59.7k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   68|  59.7k|    }
   69|  19.9k|    secp256k1_fe_mul(&x6, &x6, &x3);
  ------------------
  |  |   93|  19.9k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
   70|       |
   71|  19.9k|    x9 = x6;
   72|  79.6k|    for (j=0; j<3; j++) {
  ------------------
  |  Branch (72:15): [True: 59.7k, False: 19.9k]
  ------------------
   73|  59.7k|        secp256k1_fe_sqr(&x9, &x9);
  ------------------
  |  |   94|  59.7k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   74|  59.7k|    }
   75|  19.9k|    secp256k1_fe_mul(&x9, &x9, &x3);
  ------------------
  |  |   93|  19.9k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
   76|       |
   77|  19.9k|    x11 = x9;
   78|  59.7k|    for (j=0; j<2; j++) {
  ------------------
  |  Branch (78:15): [True: 39.8k, False: 19.9k]
  ------------------
   79|  39.8k|        secp256k1_fe_sqr(&x11, &x11);
  ------------------
  |  |   94|  39.8k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   80|  39.8k|    }
   81|  19.9k|    secp256k1_fe_mul(&x11, &x11, &x2);
  ------------------
  |  |   93|  19.9k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
   82|       |
   83|  19.9k|    x22 = x11;
   84|   239k|    for (j=0; j<11; j++) {
  ------------------
  |  Branch (84:15): [True: 219k, False: 19.9k]
  ------------------
   85|   219k|        secp256k1_fe_sqr(&x22, &x22);
  ------------------
  |  |   94|   219k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   86|   219k|    }
   87|  19.9k|    secp256k1_fe_mul(&x22, &x22, &x11);
  ------------------
  |  |   93|  19.9k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
   88|       |
   89|  19.9k|    x44 = x22;
   90|   458k|    for (j=0; j<22; j++) {
  ------------------
  |  Branch (90:15): [True: 438k, False: 19.9k]
  ------------------
   91|   438k|        secp256k1_fe_sqr(&x44, &x44);
  ------------------
  |  |   94|   438k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   92|   438k|    }
   93|  19.9k|    secp256k1_fe_mul(&x44, &x44, &x22);
  ------------------
  |  |   93|  19.9k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
   94|       |
   95|  19.9k|    x88 = x44;
   96|   896k|    for (j=0; j<44; j++) {
  ------------------
  |  Branch (96:15): [True: 876k, False: 19.9k]
  ------------------
   97|   876k|        secp256k1_fe_sqr(&x88, &x88);
  ------------------
  |  |   94|   876k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   98|   876k|    }
   99|  19.9k|    secp256k1_fe_mul(&x88, &x88, &x44);
  ------------------
  |  |   93|  19.9k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  100|       |
  101|  19.9k|    x176 = x88;
  102|  1.77M|    for (j=0; j<88; j++) {
  ------------------
  |  Branch (102:15): [True: 1.75M, False: 19.9k]
  ------------------
  103|  1.75M|        secp256k1_fe_sqr(&x176, &x176);
  ------------------
  |  |   94|  1.75M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  104|  1.75M|    }
  105|  19.9k|    secp256k1_fe_mul(&x176, &x176, &x88);
  ------------------
  |  |   93|  19.9k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  106|       |
  107|  19.9k|    x220 = x176;
  108|   896k|    for (j=0; j<44; j++) {
  ------------------
  |  Branch (108:15): [True: 876k, False: 19.9k]
  ------------------
  109|   876k|        secp256k1_fe_sqr(&x220, &x220);
  ------------------
  |  |   94|   876k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  110|   876k|    }
  111|  19.9k|    secp256k1_fe_mul(&x220, &x220, &x44);
  ------------------
  |  |   93|  19.9k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  112|       |
  113|  19.9k|    x223 = x220;
  114|  79.6k|    for (j=0; j<3; j++) {
  ------------------
  |  Branch (114:15): [True: 59.7k, False: 19.9k]
  ------------------
  115|  59.7k|        secp256k1_fe_sqr(&x223, &x223);
  ------------------
  |  |   94|  59.7k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  116|  59.7k|    }
  117|  19.9k|    secp256k1_fe_mul(&x223, &x223, &x3);
  ------------------
  |  |   93|  19.9k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  118|       |
  119|       |    /* The final result is then assembled using a sliding window over the blocks. */
  120|       |
  121|  19.9k|    t1 = x223;
  122|   478k|    for (j=0; j<23; j++) {
  ------------------
  |  Branch (122:15): [True: 458k, False: 19.9k]
  ------------------
  123|   458k|        secp256k1_fe_sqr(&t1, &t1);
  ------------------
  |  |   94|   458k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  124|   458k|    }
  125|  19.9k|    secp256k1_fe_mul(&t1, &t1, &x22);
  ------------------
  |  |   93|  19.9k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  126|   139k|    for (j=0; j<6; j++) {
  ------------------
  |  Branch (126:15): [True: 119k, False: 19.9k]
  ------------------
  127|   119k|        secp256k1_fe_sqr(&t1, &t1);
  ------------------
  |  |   94|   119k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  128|   119k|    }
  129|  19.9k|    secp256k1_fe_mul(&t1, &t1, &x2);
  ------------------
  |  |   93|  19.9k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  130|  19.9k|    secp256k1_fe_sqr(&t1, &t1);
  ------------------
  |  |   94|  19.9k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  131|  19.9k|    secp256k1_fe_sqr(r, &t1);
  ------------------
  |  |   94|  19.9k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  132|       |
  133|       |    /* Check that a square root was actually calculated */
  134|       |
  135|  19.9k|    secp256k1_fe_sqr(&t1, r);
  ------------------
  |  |   94|  19.9k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  136|  19.9k|    ret = secp256k1_fe_equal(&t1, a);
  137|       |
  138|       |#ifdef VERIFY
  139|       |    if (!ret) {
  140|       |        secp256k1_fe_negate(&t1, &t1, 1);
  141|       |        secp256k1_fe_normalize_var(&t1);
  142|       |        VERIFY_CHECK(secp256k1_fe_equal(&t1, a));
  143|       |    }
  144|       |#endif
  145|  19.9k|    return ret;
  146|  19.9k|}
secp256k1.c:secp256k1_fe_equal:
   25|  30.7k|SECP256K1_INLINE static int secp256k1_fe_equal(const secp256k1_fe *a, const secp256k1_fe *b) {
   26|  30.7k|    secp256k1_fe na;
   27|  30.7k|    SECP256K1_FE_VERIFY(a);
  ------------------
  |  |  345|  30.7k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   28|  30.7k|    SECP256K1_FE_VERIFY(b);
  ------------------
  |  |  345|  30.7k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   29|  30.7k|    SECP256K1_FE_VERIFY_MAGNITUDE(a, 1);
  ------------------
  |  |  349|  30.7k|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   30|  30.7k|    SECP256K1_FE_VERIFY_MAGNITUDE(b, 30);
  ------------------
  |  |  349|  30.7k|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   31|       |
   32|  30.7k|    secp256k1_fe_negate(&na, a, 1);
  ------------------
  |  |  211|  30.7k|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|  30.7k|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  30.7k|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 30.7k]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  30.7k|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 30.7k, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  30.7k|    } \
  |  |  |  |   94|  30.7k|    stmt; \
  |  |  |  |   95|  30.7k|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 30.7k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
   33|  30.7k|    secp256k1_fe_add(&na, b);
  ------------------
  |  |   92|  30.7k|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
   34|  30.7k|    return secp256k1_fe_normalizes_to_zero(&na);
  ------------------
  |  |   81|  30.7k|#  define secp256k1_fe_normalizes_to_zero secp256k1_fe_impl_normalizes_to_zero
  ------------------
   35|  30.7k|}
secp256k1.c:secp256k1_fe_clear:
   21|  29.2k|SECP256K1_INLINE static void secp256k1_fe_clear(secp256k1_fe *a) {
   22|  29.2k|    secp256k1_memclear_explicit(a, sizeof(secp256k1_fe));
   23|  29.2k|}

secp256k1.c:secp256k1_ge_set_xy:
  132|   445k|static void secp256k1_ge_set_xy(secp256k1_ge *r, const secp256k1_fe *x, const secp256k1_fe *y) {
  133|   445k|    SECP256K1_FE_VERIFY(x);
  ------------------
  |  |  345|   445k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  134|   445k|    SECP256K1_FE_VERIFY(y);
  ------------------
  |  |  345|   445k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  135|       |
  136|   445k|    r->infinity = 0;
  137|   445k|    r->x = *x;
  138|   445k|    r->y = *y;
  139|       |
  140|   445k|    SECP256K1_GE_VERIFY(r);
  ------------------
  |  |  212|   445k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  141|   445k|}
secp256k1.c:secp256k1_ge_verify:
   78|  4.71M|static void secp256k1_ge_verify(const secp256k1_ge *a) {
   79|  4.71M|    SECP256K1_FE_VERIFY(&a->x);
  ------------------
  |  |  345|  4.71M|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   80|  4.71M|    SECP256K1_FE_VERIFY(&a->y);
  ------------------
  |  |  345|  4.71M|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   81|  4.71M|    SECP256K1_FE_VERIFY_MAGNITUDE(&a->x, SECP256K1_GE_X_MAGNITUDE_MAX);
  ------------------
  |  |  349|  4.71M|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   82|  4.71M|    SECP256K1_FE_VERIFY_MAGNITUDE(&a->y, SECP256K1_GE_Y_MAGNITUDE_MAX);
  ------------------
  |  |  349|  4.71M|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   83|  4.71M|    VERIFY_CHECK(a->infinity == 0 || a->infinity == 1);
   84|  4.71M|    (void)a;
   85|  4.71M|}
secp256k1.c:secp256k1_ge_is_in_correct_subgroup:
  926|  16.2k|static int secp256k1_ge_is_in_correct_subgroup(const secp256k1_ge* ge) {
  927|       |#ifdef EXHAUSTIVE_TEST_ORDER
  928|       |    secp256k1_gej out;
  929|       |    int i;
  930|       |    SECP256K1_GE_VERIFY(ge);
  931|       |
  932|       |    /* A very simple EC multiplication ladder that avoids a dependency on ecmult. */
  933|       |    secp256k1_gej_set_infinity(&out);
  934|       |    for (i = 0; i < 32; ++i) {
  935|       |        secp256k1_gej_double_var(&out, &out, NULL);
  936|       |        if ((((uint32_t)EXHAUSTIVE_TEST_ORDER) >> (31 - i)) & 1) {
  937|       |            secp256k1_gej_add_ge_var(&out, &out, ge, NULL);
  938|       |        }
  939|       |    }
  940|       |    return secp256k1_gej_is_infinity(&out);
  941|       |#else
  942|  16.2k|    SECP256K1_GE_VERIFY(ge);
  ------------------
  |  |  212|  16.2k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  943|       |
  944|  16.2k|    (void)ge;
  945|       |    /* The real secp256k1 group has cofactor 1, so the subgroup is the entire curve. */
  946|  16.2k|    return 1;
  947|  16.2k|#endif
  948|  16.2k|}
secp256k1.c:secp256k1_ge_clear:
  343|  58.5k|static void secp256k1_ge_clear(secp256k1_ge *r) {
  344|  58.5k|    secp256k1_memclear_explicit(r, sizeof(secp256k1_ge));
  345|  58.5k|}
secp256k1.c:secp256k1_gej_eq_x_var:
  417|  10.8k|static int secp256k1_gej_eq_x_var(const secp256k1_fe *x, const secp256k1_gej *a) {
  418|  10.8k|    secp256k1_fe r;
  419|  10.8k|    SECP256K1_FE_VERIFY(x);
  ------------------
  |  |  345|  10.8k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  420|  10.8k|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|  10.8k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  421|  10.8k|    VERIFY_CHECK(!a->infinity);
  422|       |
  423|  10.8k|    secp256k1_fe_sqr(&r, &a->z); secp256k1_fe_mul(&r, &r, x);
  ------------------
  |  |   94|  10.8k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
                  secp256k1_fe_sqr(&r, &a->z); secp256k1_fe_mul(&r, &r, x);
  ------------------
  |  |   93|  10.8k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  424|  10.8k|    return secp256k1_fe_equal(&r, &a->x);
  425|  10.8k|}
secp256k1.c:secp256k1_gej_verify:
   87|  13.1M|static void secp256k1_gej_verify(const secp256k1_gej *a) {
   88|  13.1M|    SECP256K1_FE_VERIFY(&a->x);
  ------------------
  |  |  345|  13.1M|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   89|  13.1M|    SECP256K1_FE_VERIFY(&a->y);
  ------------------
  |  |  345|  13.1M|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   90|  13.1M|    SECP256K1_FE_VERIFY(&a->z);
  ------------------
  |  |  345|  13.1M|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   91|  13.1M|    SECP256K1_FE_VERIFY_MAGNITUDE(&a->x, SECP256K1_GEJ_X_MAGNITUDE_MAX);
  ------------------
  |  |  349|  13.1M|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   92|  13.1M|    SECP256K1_FE_VERIFY_MAGNITUDE(&a->y, SECP256K1_GEJ_Y_MAGNITUDE_MAX);
  ------------------
  |  |  349|  13.1M|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   93|  13.1M|    SECP256K1_FE_VERIFY_MAGNITUDE(&a->z, SECP256K1_GEJ_Z_MAGNITUDE_MAX);
  ------------------
  |  |  349|  13.1M|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   94|  13.1M|    VERIFY_CHECK(a->infinity == 0 || a->infinity == 1);
   95|  13.1M|    (void)a;
   96|  13.1M|}
secp256k1.c:secp256k1_gej_set_infinity:
  322|  32.5k|static void secp256k1_gej_set_infinity(secp256k1_gej *r) {
  323|  32.5k|    r->infinity = 1;
  324|  32.5k|    secp256k1_fe_set_int(&r->x, 0);
  ------------------
  |  |   83|  32.5k|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  325|  32.5k|    secp256k1_fe_set_int(&r->y, 0);
  ------------------
  |  |   83|  32.5k|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  326|  32.5k|    secp256k1_fe_set_int(&r->z, 0);
  ------------------
  |  |   83|  32.5k|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  327|       |
  328|  32.5k|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  216|  32.5k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  329|  32.5k|}
secp256k1.c:secp256k1_gej_add_ge:
  724|  1.25M|static void secp256k1_gej_add_ge(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b) {
  725|       |    /* Operations: 7 mul, 5 sqr, 21 add/cmov/half/mul_int/negate/normalizes_to_zero */
  726|  1.25M|    secp256k1_fe zz, u1, u2, s1, s2, t, tt, m, n, q, rr;
  727|  1.25M|    secp256k1_fe m_alt, rr_alt;
  728|  1.25M|    int degenerate;
  729|  1.25M|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|  1.25M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  730|  1.25M|    SECP256K1_GE_VERIFY(b);
  ------------------
  |  |  212|  1.25M|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  731|  1.25M|    VERIFY_CHECK(!b->infinity);
  732|       |
  733|       |    /*  In:
  734|       |     *    Eric Brier and Marc Joye, Weierstrass Elliptic Curves and Side-Channel Attacks.
  735|       |     *    In D. Naccache and P. Paillier, Eds., Public Key Cryptography, vol. 2274 of Lecture Notes in Computer Science, pages 335-345. Springer-Verlag, 2002.
  736|       |     *  we find as solution for a unified addition/doubling formula:
  737|       |     *    lambda = ((x1 + x2)^2 - x1 * x2 + a) / (y1 + y2), with a = 0 for secp256k1's curve equation.
  738|       |     *    x3 = lambda^2 - (x1 + x2)
  739|       |     *    2*y3 = lambda * (x1 + x2 - 2 * x3) - (y1 + y2).
  740|       |     *
  741|       |     *  Substituting x_i = Xi / Zi^2 and yi = Yi / Zi^3, for i=1,2,3, gives:
  742|       |     *    U1 = X1*Z2^2, U2 = X2*Z1^2
  743|       |     *    S1 = Y1*Z2^3, S2 = Y2*Z1^3
  744|       |     *    Z = Z1*Z2
  745|       |     *    T = U1+U2
  746|       |     *    M = S1+S2
  747|       |     *    Q = -T*M^2
  748|       |     *    R = T^2-U1*U2
  749|       |     *    X3 = R^2+Q
  750|       |     *    Y3 = -(R*(2*X3+Q)+M^4)/2
  751|       |     *    Z3 = M*Z
  752|       |     *  (Note that the paper uses xi = Xi / Zi and yi = Yi / Zi instead.)
  753|       |     *
  754|       |     *  This formula has the benefit of being the same for both addition
  755|       |     *  of distinct points and doubling. However, it breaks down in the
  756|       |     *  case that either point is infinity, or that y1 = -y2. We handle
  757|       |     *  these cases in the following ways:
  758|       |     *
  759|       |     *    - If b is infinity we simply bail by means of a VERIFY_CHECK.
  760|       |     *
  761|       |     *    - If a is infinity, we detect this, and at the end of the
  762|       |     *      computation replace the result (which will be meaningless,
  763|       |     *      but we compute to be constant-time) with b.x : b.y : 1.
  764|       |     *
  765|       |     *    - If a = -b, we have y1 = -y2, which is a degenerate case.
  766|       |     *      But here the answer is infinity, so we simply set the
  767|       |     *      infinity flag of the result, overriding the computed values
  768|       |     *      without even needing to cmov.
  769|       |     *
  770|       |     *    - If y1 = -y2 but x1 != x2, which does occur thanks to certain
  771|       |     *      properties of our curve (specifically, 1 has nontrivial cube
  772|       |     *      roots in our field, and the curve equation has no x coefficient)
  773|       |     *      then the answer is not infinity but also not given by the above
  774|       |     *      equation. In this case, we cmov in place an alternate expression
  775|       |     *      for lambda. Specifically (y1 - y2)/(x1 - x2). Where both these
  776|       |     *      expressions for lambda are defined, they are equal, and can be
  777|       |     *      obtained from each other by multiplication by (y1 + y2)/(y1 + y2)
  778|       |     *      then substitution of x^3 + 7 for y^2 (using the curve equation).
  779|       |     *      For all pairs of nonzero points (a, b) at least one is defined,
  780|       |     *      so this covers everything.
  781|       |     */
  782|       |
  783|  1.25M|    secp256k1_fe_sqr(&zz, &a->z);                       /* z = Z1^2 */
  ------------------
  |  |   94|  1.25M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  784|  1.25M|    u1 = a->x;                                          /* u1 = U1 = X1*Z2^2 (GEJ_X_M) */
  785|  1.25M|    secp256k1_fe_mul(&u2, &b->x, &zz);                  /* u2 = U2 = X2*Z1^2 (1) */
  ------------------
  |  |   93|  1.25M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  786|  1.25M|    s1 = a->y;                                          /* s1 = S1 = Y1*Z2^3 (GEJ_Y_M) */
  787|  1.25M|    secp256k1_fe_mul(&s2, &b->y, &zz);                  /* s2 = Y2*Z1^2 (1) */
  ------------------
  |  |   93|  1.25M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  788|  1.25M|    secp256k1_fe_mul(&s2, &s2, &a->z);                  /* s2 = S2 = Y2*Z1^3 (1) */
  ------------------
  |  |   93|  1.25M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  789|  1.25M|    t = u1; secp256k1_fe_add(&t, &u2);                  /* t = T = U1+U2 (GEJ_X_M+1) */
  ------------------
  |  |   92|  1.25M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  790|  1.25M|    m = s1; secp256k1_fe_add(&m, &s2);                  /* m = M = S1+S2 (GEJ_Y_M+1) */
  ------------------
  |  |   92|  1.25M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  791|  1.25M|    secp256k1_fe_sqr(&rr, &t);                          /* rr = T^2 (1) */
  ------------------
  |  |   94|  1.25M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  792|  1.25M|    secp256k1_fe_negate(&m_alt, &u2, 1);                /* Malt = -X2*Z1^2 (2) */
  ------------------
  |  |  211|  1.25M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|  1.25M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  1.25M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 1.25M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  1.25M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 1.25M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  1.25M|    } \
  |  |  |  |   94|  1.25M|    stmt; \
  |  |  |  |   95|  1.25M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 1.25M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  793|  1.25M|    secp256k1_fe_mul(&tt, &u1, &m_alt);                 /* tt = -U1*U2 (1) */
  ------------------
  |  |   93|  1.25M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  794|  1.25M|    secp256k1_fe_add(&rr, &tt);                         /* rr = R = T^2-U1*U2 (2) */
  ------------------
  |  |   92|  1.25M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  795|       |    /* If lambda = R/M = R/0 we have a problem (except in the "trivial"
  796|       |     * case that Z = z1z2 = 0, and this is special-cased later on). */
  797|  1.25M|    degenerate = secp256k1_fe_normalizes_to_zero(&m);
  ------------------
  |  |   81|  1.25M|#  define secp256k1_fe_normalizes_to_zero secp256k1_fe_impl_normalizes_to_zero
  ------------------
  798|       |    /* This only occurs when y1 == -y2 and x1^3 == x2^3, but x1 != x2.
  799|       |     * This means either x1 == beta*x2 or beta*x1 == x2, where beta is
  800|       |     * a nontrivial cube root of one. In either case, an alternate
  801|       |     * non-indeterminate expression for lambda is (y1 - y2)/(x1 - x2),
  802|       |     * so we set R/M equal to this. */
  803|  1.25M|    rr_alt = s1;
  804|  1.25M|    secp256k1_fe_mul_int(&rr_alt, 2);       /* rr_alt = Y1*Z2^3 - Y2*Z1^3 (GEJ_Y_M*2) */
  ------------------
  |  |  233|  1.25M|#define secp256k1_fe_mul_int(r, a) ASSERT_INT_CONST_AND_DO(a, secp256k1_fe_mul_int_unchecked(r, a))
  |  |  ------------------
  |  |  |  |   87|  1.25M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  1.25M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 1.25M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  1.25M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 1.25M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  1.25M|    } \
  |  |  |  |   94|  1.25M|    stmt; \
  |  |  |  |   95|  1.25M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 1.25M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  805|  1.25M|    secp256k1_fe_add(&m_alt, &u1);          /* Malt = X1*Z2^2 - X2*Z1^2 (GEJ_X_M+2) */
  ------------------
  |  |   92|  1.25M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  806|       |
  807|  1.25M|    secp256k1_fe_cmov(&rr_alt, &rr, !degenerate);       /* rr_alt (GEJ_Y_M*2) */
  ------------------
  |  |   95|  1.25M|#  define secp256k1_fe_cmov secp256k1_fe_impl_cmov
  ------------------
  808|  1.25M|    secp256k1_fe_cmov(&m_alt, &m, !degenerate);         /* m_alt (GEJ_X_M+2) */
  ------------------
  |  |   95|  1.25M|#  define secp256k1_fe_cmov secp256k1_fe_impl_cmov
  ------------------
  809|       |    /* Now Ralt / Malt = lambda and is guaranteed not to be Ralt / 0.
  810|       |     * From here on out Ralt and Malt represent the numerator
  811|       |     * and denominator of lambda; R and M represent the explicit
  812|       |     * expressions x1^2 + x2^2 + x1x2 and y1 + y2. */
  813|  1.25M|    secp256k1_fe_sqr(&n, &m_alt);                       /* n = Malt^2 (1) */
  ------------------
  |  |   94|  1.25M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  814|  1.25M|    secp256k1_fe_negate(&q, &t,
  ------------------
  |  |  211|  1.25M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|  1.25M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  1.25M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 1.25M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  1.25M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 1.25M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  1.25M|    } \
  |  |  |  |   94|  1.25M|    stmt; \
  |  |  |  |   95|  1.25M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 1.25M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  815|  1.25M|        SECP256K1_GEJ_X_MAGNITUDE_MAX + 1);             /* q = -T (GEJ_X_M+2) */
  816|  1.25M|    secp256k1_fe_mul(&q, &q, &n);                       /* q = Q = -T*Malt^2 (1) */
  ------------------
  |  |   93|  1.25M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  817|       |    /* These two lines use the observation that either M == Malt or M == 0,
  818|       |     * so M^3 * Malt is either Malt^4 (which is computed by squaring), or
  819|       |     * zero (which is "computed" by cmov). So the cost is one squaring
  820|       |     * versus two multiplications. */
  821|  1.25M|    secp256k1_fe_sqr(&n, &n);                           /* n = Malt^4 (1) */
  ------------------
  |  |   94|  1.25M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  822|  1.25M|    secp256k1_fe_cmov(&n, &m, degenerate);              /* n = M^3 * Malt (GEJ_Y_M+1) */
  ------------------
  |  |   95|  1.25M|#  define secp256k1_fe_cmov secp256k1_fe_impl_cmov
  ------------------
  823|  1.25M|    secp256k1_fe_sqr(&t, &rr_alt);                      /* t = Ralt^2 (1) */
  ------------------
  |  |   94|  1.25M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  824|  1.25M|    secp256k1_fe_mul(&r->z, &a->z, &m_alt);             /* r->z = Z3 = Malt*Z (1) */
  ------------------
  |  |   93|  1.25M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  825|  1.25M|    secp256k1_fe_add(&t, &q);                           /* t = Ralt^2 + Q (2) */
  ------------------
  |  |   92|  1.25M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  826|  1.25M|    r->x = t;                                           /* r->x = X3 = Ralt^2 + Q (2) */
  827|  1.25M|    secp256k1_fe_mul_int(&t, 2);                        /* t = 2*X3 (4) */
  ------------------
  |  |  233|  1.25M|#define secp256k1_fe_mul_int(r, a) ASSERT_INT_CONST_AND_DO(a, secp256k1_fe_mul_int_unchecked(r, a))
  |  |  ------------------
  |  |  |  |   87|  1.25M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  1.25M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 1.25M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  1.25M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 1.25M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  1.25M|    } \
  |  |  |  |   94|  1.25M|    stmt; \
  |  |  |  |   95|  1.25M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 1.25M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  828|  1.25M|    secp256k1_fe_add(&t, &q);                           /* t = 2*X3 + Q (5) */
  ------------------
  |  |   92|  1.25M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  829|  1.25M|    secp256k1_fe_mul(&t, &t, &rr_alt);                  /* t = Ralt*(2*X3 + Q) (1) */
  ------------------
  |  |   93|  1.25M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  830|  1.25M|    secp256k1_fe_add(&t, &n);                           /* t = Ralt*(2*X3 + Q) + M^3*Malt (GEJ_Y_M+2) */
  ------------------
  |  |   92|  1.25M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  831|  1.25M|    secp256k1_fe_negate(&r->y, &t,
  ------------------
  |  |  211|  1.25M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|  1.25M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  1.25M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 1.25M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  1.25M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 1.25M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  1.25M|    } \
  |  |  |  |   94|  1.25M|    stmt; \
  |  |  |  |   95|  1.25M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 1.25M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  832|  1.25M|        SECP256K1_GEJ_Y_MAGNITUDE_MAX + 2);             /* r->y = -(Ralt*(2*X3 + Q) + M^3*Malt) (GEJ_Y_M+3) */
  833|  1.25M|    secp256k1_fe_half(&r->y);                           /* r->y = Y3 = -(Ralt*(2*X3 + Q) + M^3*Malt)/2 ((GEJ_Y_M+3)/2 + 1) */
  ------------------
  |  |  101|  1.25M|#  define secp256k1_fe_half secp256k1_fe_impl_half
  ------------------
  834|       |
  835|       |    /* In case a->infinity == 1, replace r with (b->x, b->y, 1). */
  836|  1.25M|    secp256k1_fe_cmov(&r->x, &b->x, a->infinity);
  ------------------
  |  |   95|  1.25M|#  define secp256k1_fe_cmov secp256k1_fe_impl_cmov
  ------------------
  837|  1.25M|    secp256k1_fe_cmov(&r->y, &b->y, a->infinity);
  ------------------
  |  |   95|  1.25M|#  define secp256k1_fe_cmov secp256k1_fe_impl_cmov
  ------------------
  838|  1.25M|    secp256k1_fe_cmov(&r->z, &secp256k1_fe_one, a->infinity);
  ------------------
  |  |   95|  1.25M|#  define secp256k1_fe_cmov secp256k1_fe_impl_cmov
  ------------------
  839|       |
  840|       |    /* Set r->infinity if r->z is 0.
  841|       |     *
  842|       |     * If a->infinity is set, then r->infinity = (r->z == 0) = (1 == 0) = false,
  843|       |     * which is correct because the function assumes that b is not infinity.
  844|       |     *
  845|       |     * Now assume !a->infinity. This implies Z = Z1 != 0.
  846|       |     *
  847|       |     * Case y1 = -y2:
  848|       |     * In this case we could have a = -b, namely if x1 = x2.
  849|       |     * We have degenerate = true, r->z = (x1 - x2) * Z.
  850|       |     * Then r->infinity = ((x1 - x2)Z == 0) = (x1 == x2) = (a == -b).
  851|       |     *
  852|       |     * Case y1 != -y2:
  853|       |     * In this case, we can't have a = -b.
  854|       |     * We have degenerate = false, r->z = (y1 + y2) * Z.
  855|       |     * Then r->infinity = ((y1 + y2)Z == 0) = (y1 == -y2) = false. */
  856|  1.25M|    r->infinity = secp256k1_fe_normalizes_to_zero(&r->z);
  ------------------
  |  |   81|  1.25M|#  define secp256k1_fe_normalizes_to_zero secp256k1_fe_impl_normalizes_to_zero
  ------------------
  857|       |
  858|  1.25M|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  216|  1.25M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  859|  1.25M|}
secp256k1.c:secp256k1_gej_is_infinity:
  440|  52.5k|static int secp256k1_gej_is_infinity(const secp256k1_gej *a) {
  441|  52.5k|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|  52.5k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  442|       |
  443|  52.5k|    return a->infinity;
  444|  52.5k|}
secp256k1.c:secp256k1_ge_set_gej:
  159|  31.0k|static void secp256k1_ge_set_gej(secp256k1_ge *r, secp256k1_gej *a) {
  160|  31.0k|    secp256k1_fe z2, z3;
  161|  31.0k|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|  31.0k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  162|       |
  163|  31.0k|    r->infinity = a->infinity;
  164|  31.0k|    secp256k1_fe_inv(&a->z, &a->z);
  ------------------
  |  |   98|  31.0k|#  define secp256k1_fe_inv secp256k1_fe_impl_inv
  ------------------
  165|  31.0k|    secp256k1_fe_sqr(&z2, &a->z);
  ------------------
  |  |   94|  31.0k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  166|  31.0k|    secp256k1_fe_mul(&z3, &a->z, &z2);
  ------------------
  |  |   93|  31.0k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  167|  31.0k|    secp256k1_fe_mul(&a->x, &a->x, &z2);
  ------------------
  |  |   93|  31.0k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  168|  31.0k|    secp256k1_fe_mul(&a->y, &a->y, &z3);
  ------------------
  |  |   93|  31.0k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  169|  31.0k|    secp256k1_fe_set_int(&a->z, 1);
  ------------------
  |  |   83|  31.0k|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  170|  31.0k|    r->x = a->x;
  171|  31.0k|    r->y = a->y;
  172|       |
  173|  31.0k|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|  31.0k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  174|  31.0k|    SECP256K1_GE_VERIFY(r);
  ------------------
  |  |  212|  31.0k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  175|  31.0k|}
secp256k1.c:secp256k1_ge_set_xo_var:
  347|  19.9k|static int secp256k1_ge_set_xo_var(secp256k1_ge *r, const secp256k1_fe *x, int odd) {
  348|  19.9k|    secp256k1_fe x2, x3;
  349|  19.9k|    int ret;
  350|  19.9k|    SECP256K1_FE_VERIFY(x);
  ------------------
  |  |  345|  19.9k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  351|       |
  352|  19.9k|    r->x = *x;
  353|  19.9k|    secp256k1_fe_sqr(&x2, x);
  ------------------
  |  |   94|  19.9k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  354|  19.9k|    secp256k1_fe_mul(&x3, x, &x2);
  ------------------
  |  |   93|  19.9k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  355|  19.9k|    r->infinity = 0;
  356|  19.9k|    secp256k1_fe_add_int(&x3, SECP256K1_B);
  ------------------
  |  |  102|  19.9k|#  define secp256k1_fe_add_int secp256k1_fe_impl_add_int
  ------------------
                  secp256k1_fe_add_int(&x3, SECP256K1_B);
  ------------------
  |  |   73|  19.9k|#define SECP256K1_B 7
  ------------------
  357|  19.9k|    ret = secp256k1_fe_sqrt(&r->y, &x3);
  358|  19.9k|    secp256k1_fe_normalize_var(&r->y);
  ------------------
  |  |   80|  19.9k|#  define secp256k1_fe_normalize_var secp256k1_fe_impl_normalize_var
  ------------------
  359|  19.9k|    if (secp256k1_fe_is_odd(&r->y) != odd) {
  ------------------
  |  |   85|  19.9k|#  define secp256k1_fe_is_odd secp256k1_fe_impl_is_odd
  ------------------
  |  Branch (359:9): [True: 9.91k, False: 10.0k]
  ------------------
  360|  9.91k|        secp256k1_fe_negate(&r->y, &r->y, 1);
  ------------------
  |  |  211|  9.91k|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|  9.91k|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  9.91k|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 9.91k]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  9.91k|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 9.91k, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  9.91k|    } \
  |  |  |  |   94|  9.91k|    stmt; \
  |  |  |  |   95|  9.91k|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 9.91k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  361|  9.91k|    }
  362|       |
  363|  19.9k|    SECP256K1_GE_VERIFY(r);
  ------------------
  |  |  212|  19.9k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  364|  19.9k|    return ret;
  365|  19.9k|}
secp256k1.c:secp256k1_gej_set_ge:
  367|  70.4k|static void secp256k1_gej_set_ge(secp256k1_gej *r, const secp256k1_ge *a) {
  368|  70.4k|   SECP256K1_GE_VERIFY(a);
  ------------------
  |  |  212|  70.4k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  369|       |
  370|  70.4k|   r->infinity = a->infinity;
  371|  70.4k|   r->x = a->x;
  372|  70.4k|   r->y = a->y;
  373|  70.4k|   secp256k1_fe_set_int(&r->z, 1);
  ------------------
  |  |   83|  70.4k|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  374|       |
  375|  70.4k|   SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  216|  70.4k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  376|  70.4k|}
secp256k1.c:secp256k1_gej_rescale:
  861|  29.2k|static void secp256k1_gej_rescale(secp256k1_gej *r, const secp256k1_fe *s) {
  862|       |    /* Operations: 4 mul, 1 sqr */
  863|  29.2k|    secp256k1_fe zz;
  864|  29.2k|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  216|  29.2k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  865|  29.2k|    SECP256K1_FE_VERIFY(s);
  ------------------
  |  |  345|  29.2k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  866|  29.2k|    VERIFY_CHECK(!secp256k1_fe_normalizes_to_zero_var(s));
  867|       |
  868|  29.2k|    secp256k1_fe_sqr(&zz, s);
  ------------------
  |  |   94|  29.2k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  869|  29.2k|    secp256k1_fe_mul(&r->x, &r->x, &zz);                /* r->x *= s^2 */
  ------------------
  |  |   93|  29.2k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  870|  29.2k|    secp256k1_fe_mul(&r->y, &r->y, &zz);
  ------------------
  |  |   93|  29.2k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  871|  29.2k|    secp256k1_fe_mul(&r->y, &r->y, s);                  /* r->y *= s^3 */
  ------------------
  |  |   93|  29.2k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  872|  29.2k|    secp256k1_fe_mul(&r->z, &r->z, s);                  /* r->z *= s   */
  ------------------
  |  |   93|  29.2k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  873|       |
  874|  29.2k|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  216|  29.2k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  875|  29.2k|}
secp256k1.c:secp256k1_ge_set_gej_zinv:
   99|  16.2k|static void secp256k1_ge_set_gej_zinv(secp256k1_ge *r, const secp256k1_gej *a, const secp256k1_fe *zi) {
  100|  16.2k|    secp256k1_fe zi2;
  101|  16.2k|    secp256k1_fe zi3;
  102|  16.2k|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|  16.2k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  103|  16.2k|    SECP256K1_FE_VERIFY(zi);
  ------------------
  |  |  345|  16.2k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  104|  16.2k|    VERIFY_CHECK(!a->infinity);
  105|       |
  106|  16.2k|    secp256k1_fe_sqr(&zi2, zi);
  ------------------
  |  |   94|  16.2k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  107|  16.2k|    secp256k1_fe_mul(&zi3, &zi2, zi);
  ------------------
  |  |   93|  16.2k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  108|  16.2k|    secp256k1_fe_mul(&r->x, &a->x, &zi2);
  ------------------
  |  |   93|  16.2k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  109|  16.2k|    secp256k1_fe_mul(&r->y, &a->y, &zi3);
  ------------------
  |  |   93|  16.2k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  110|  16.2k|    r->infinity = a->infinity;
  111|       |
  112|  16.2k|    SECP256K1_GE_VERIFY(r);
  ------------------
  |  |  212|  16.2k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  113|  16.2k|}
secp256k1.c:secp256k1_ge_table_set_globalz:
  289|  16.2k|static void secp256k1_ge_table_set_globalz(size_t len, secp256k1_ge *a, const secp256k1_fe *zr) {
  290|  16.2k|    size_t i;
  291|  16.2k|    secp256k1_fe zs;
  292|       |#ifdef VERIFY
  293|       |    for (i = 0; i < len; i++) {
  294|       |        SECP256K1_GE_VERIFY(&a[i]);
  295|       |        SECP256K1_FE_VERIFY(&zr[i]);
  296|       |    }
  297|       |#endif
  298|       |
  299|  16.2k|    if (len > 0) {
  ------------------
  |  Branch (299:9): [True: 16.2k, False: 0]
  ------------------
  300|  16.2k|        i = len - 1;
  301|       |        /* Ensure all y values are in weak normal form for fast negation of points */
  302|  16.2k|        secp256k1_fe_normalize_weak(&a[i].y);
  ------------------
  |  |   79|  16.2k|#  define secp256k1_fe_normalize_weak secp256k1_fe_impl_normalize_weak
  ------------------
  303|  16.2k|        zs = zr[i];
  304|       |
  305|       |        /* Work our way backwards, using the z-ratios to scale the x/y values. */
  306|   130k|        while (i > 0) {
  ------------------
  |  Branch (306:16): [True: 114k, False: 16.2k]
  ------------------
  307|   114k|            if (i != len - 1) {
  ------------------
  |  Branch (307:17): [True: 97.7k, False: 16.2k]
  ------------------
  308|  97.7k|                secp256k1_fe_mul(&zs, &zs, &zr[i]);
  ------------------
  |  |   93|  97.7k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  309|  97.7k|            }
  310|   114k|            i--;
  311|   114k|            secp256k1_ge_set_ge_zinv(&a[i], &a[i], &zs);
  312|   114k|        }
  313|  16.2k|    }
  314|       |
  315|       |#ifdef VERIFY
  316|       |    for (i = 0; i < len; i++) {
  317|       |        SECP256K1_GE_VERIFY(&a[i]);
  318|       |    }
  319|       |#endif
  320|  16.2k|}
secp256k1.c:secp256k1_ge_set_ge_zinv:
  116|   114k|static void secp256k1_ge_set_ge_zinv(secp256k1_ge *r, const secp256k1_ge *a, const secp256k1_fe *zi) {
  117|   114k|    secp256k1_fe zi2;
  118|   114k|    secp256k1_fe zi3;
  119|   114k|    SECP256K1_GE_VERIFY(a);
  ------------------
  |  |  212|   114k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  120|   114k|    SECP256K1_FE_VERIFY(zi);
  ------------------
  |  |  345|   114k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  121|   114k|    VERIFY_CHECK(!a->infinity);
  122|       |
  123|   114k|    secp256k1_fe_sqr(&zi2, zi);
  ------------------
  |  |   94|   114k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  124|   114k|    secp256k1_fe_mul(&zi3, &zi2, zi);
  ------------------
  |  |   93|   114k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  125|   114k|    secp256k1_fe_mul(&r->x, &a->x, &zi2);
  ------------------
  |  |   93|   114k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  126|   114k|    secp256k1_fe_mul(&r->y, &a->y, &zi3);
  ------------------
  |  |   93|   114k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  127|   114k|    r->infinity = a->infinity;
  128|       |
  129|   114k|    SECP256K1_GE_VERIFY(r);
  ------------------
  |  |  212|   114k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  130|   114k|}
secp256k1.c:secp256k1_gej_double_var:
  495|  2.08M|static void secp256k1_gej_double_var(secp256k1_gej *r, const secp256k1_gej *a, secp256k1_fe *rzr) {
  496|  2.08M|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|  2.08M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  497|       |
  498|       |    /** For secp256k1, 2Q is infinity if and only if Q is infinity. This is because if 2Q = infinity,
  499|       |     *  Q must equal -Q, or that Q.y == -(Q.y), or Q.y is 0. For a point on y^2 = x^3 + 7 to have
  500|       |     *  y=0, x^3 must be -7 mod p. However, -7 has no cube root mod p.
  501|       |     *
  502|       |     *  Having said this, if this function receives a point on a sextic twist, e.g. by
  503|       |     *  a fault attack, it is possible for y to be 0. This happens for y^2 = x^3 + 6,
  504|       |     *  since -6 does have a cube root mod p. For this point, this function will not set
  505|       |     *  the infinity flag even though the point doubles to infinity, and the result
  506|       |     *  point will be gibberish (z = 0 but infinity = 0).
  507|       |     */
  508|  2.08M|    if (a->infinity) {
  ------------------
  |  Branch (508:9): [True: 16.2k, False: 2.07M]
  ------------------
  509|  16.2k|        secp256k1_gej_set_infinity(r);
  510|  16.2k|        if (rzr != NULL) {
  ------------------
  |  Branch (510:13): [True: 0, False: 16.2k]
  ------------------
  511|      0|            secp256k1_fe_set_int(rzr, 1);
  ------------------
  |  |   83|      0|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  512|      0|        }
  513|  16.2k|        return;
  514|  16.2k|    }
  515|       |
  516|  2.07M|    if (rzr != NULL) {
  ------------------
  |  Branch (516:9): [True: 0, False: 2.07M]
  ------------------
  517|      0|        *rzr = a->y;
  518|      0|        secp256k1_fe_normalize_weak(rzr);
  ------------------
  |  |   79|      0|#  define secp256k1_fe_normalize_weak secp256k1_fe_impl_normalize_weak
  ------------------
  519|      0|    }
  520|       |
  521|  2.07M|    secp256k1_gej_double(r, a);
  522|       |
  523|  2.07M|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  216|  2.07M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  524|  2.07M|}
secp256k1.c:secp256k1_gej_double:
  460|  2.07M|static SECP256K1_INLINE void secp256k1_gej_double(secp256k1_gej *r, const secp256k1_gej *a) {
  461|       |    /* Operations: 3 mul, 4 sqr, 8 add/half/mul_int/negate */
  462|  2.07M|    secp256k1_fe l, s, t;
  463|  2.07M|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|  2.07M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  464|       |
  465|  2.07M|    r->infinity = a->infinity;
  466|       |
  467|       |    /* Formula used:
  468|       |     * L = (3/2) * X1^2
  469|       |     * S = Y1^2
  470|       |     * T = -X1*S
  471|       |     * X3 = L^2 + 2*T
  472|       |     * Y3 = -(L*(X3 + T) + S^2)
  473|       |     * Z3 = Y1*Z1
  474|       |     */
  475|       |
  476|  2.07M|    secp256k1_fe_mul(&r->z, &a->z, &a->y); /* Z3 = Y1*Z1 (1) */
  ------------------
  |  |   93|  2.07M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  477|  2.07M|    secp256k1_fe_sqr(&s, &a->y);           /* S = Y1^2 (1) */
  ------------------
  |  |   94|  2.07M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  478|  2.07M|    secp256k1_fe_sqr(&l, &a->x);           /* L = X1^2 (1) */
  ------------------
  |  |   94|  2.07M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  479|  2.07M|    secp256k1_fe_mul_int(&l, 3);           /* L = 3*X1^2 (3) */
  ------------------
  |  |  233|  2.07M|#define secp256k1_fe_mul_int(r, a) ASSERT_INT_CONST_AND_DO(a, secp256k1_fe_mul_int_unchecked(r, a))
  |  |  ------------------
  |  |  |  |   87|  2.07M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  2.07M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 2.07M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  2.07M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 2.07M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  2.07M|    } \
  |  |  |  |   94|  2.07M|    stmt; \
  |  |  |  |   95|  2.07M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 2.07M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  480|  2.07M|    secp256k1_fe_half(&l);                 /* L = 3/2*X1^2 (2) */
  ------------------
  |  |  101|  2.07M|#  define secp256k1_fe_half secp256k1_fe_impl_half
  ------------------
  481|  2.07M|    secp256k1_fe_negate(&t, &s, 1);        /* T = -S (2) */
  ------------------
  |  |  211|  2.07M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|  2.07M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  2.07M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 2.07M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  2.07M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 2.07M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  2.07M|    } \
  |  |  |  |   94|  2.07M|    stmt; \
  |  |  |  |   95|  2.07M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 2.07M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  482|  2.07M|    secp256k1_fe_mul(&t, &t, &a->x);       /* T = -X1*S (1) */
  ------------------
  |  |   93|  2.07M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  483|  2.07M|    secp256k1_fe_sqr(&r->x, &l);           /* X3 = L^2 (1) */
  ------------------
  |  |   94|  2.07M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  484|  2.07M|    secp256k1_fe_add(&r->x, &t);           /* X3 = L^2 + T (2) */
  ------------------
  |  |   92|  2.07M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  485|  2.07M|    secp256k1_fe_add(&r->x, &t);           /* X3 = L^2 + 2*T (3) */
  ------------------
  |  |   92|  2.07M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  486|  2.07M|    secp256k1_fe_sqr(&s, &s);              /* S' = S^2 (1) */
  ------------------
  |  |   94|  2.07M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  487|  2.07M|    secp256k1_fe_add(&t, &r->x);           /* T' = X3 + T (4) */
  ------------------
  |  |   92|  2.07M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  488|  2.07M|    secp256k1_fe_mul(&r->y, &t, &l);       /* Y3 = L*(X3 + T) (1) */
  ------------------
  |  |   93|  2.07M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  489|  2.07M|    secp256k1_fe_add(&r->y, &s);           /* Y3 = L*(X3 + T) + S^2 (2) */
  ------------------
  |  |   92|  2.07M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  490|  2.07M|    secp256k1_fe_negate(&r->y, &r->y, 2);  /* Y3 = -(L*(X3 + T) + S^2) (3) */
  ------------------
  |  |  211|  2.07M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|  2.07M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  2.07M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 2.07M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  2.07M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 2.07M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  2.07M|    } \
  |  |  |  |   94|  2.07M|    stmt; \
  |  |  |  |   95|  2.07M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 2.07M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  491|       |
  492|  2.07M|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  216|  2.07M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  493|  2.07M|}
secp256k1.c:secp256k1_ge_from_storage:
  890|  1.56M|static void secp256k1_ge_from_storage(secp256k1_ge *r, const secp256k1_ge_storage *a) {
  891|  1.56M|    secp256k1_fe_from_storage(&r->x, &a->x);
  ------------------
  |  |   97|  1.56M|#  define secp256k1_fe_from_storage secp256k1_fe_impl_from_storage
  ------------------
  892|  1.56M|    secp256k1_fe_from_storage(&r->y, &a->y);
  ------------------
  |  |   97|  1.56M|#  define secp256k1_fe_from_storage secp256k1_fe_impl_from_storage
  ------------------
  893|  1.56M|    r->infinity = 0;
  894|       |
  895|  1.56M|    SECP256K1_GE_VERIFY(r);
  ------------------
  |  |  212|  1.56M|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  896|  1.56M|}
secp256k1.c:secp256k1_gej_add_zinv_var:
  653|   276k|static void secp256k1_gej_add_zinv_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b, const secp256k1_fe *bzinv) {
  654|       |    /* Operations: 9 mul, 3 sqr, 11 add/negate/normalizes_to_zero (ignoring special cases) */
  655|   276k|    secp256k1_fe az, z12, u1, u2, s1, s2, h, i, h2, h3, t;
  656|   276k|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|   276k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  657|   276k|    SECP256K1_GE_VERIFY(b);
  ------------------
  |  |  212|   276k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  658|   276k|    SECP256K1_FE_VERIFY(bzinv);
  ------------------
  |  |  345|   276k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  659|       |
  660|   276k|    if (a->infinity) {
  ------------------
  |  Branch (660:9): [True: 7.68k, False: 269k]
  ------------------
  661|  7.68k|        secp256k1_fe bzinv2, bzinv3;
  662|  7.68k|        r->infinity = b->infinity;
  663|  7.68k|        secp256k1_fe_sqr(&bzinv2, bzinv);
  ------------------
  |  |   94|  7.68k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  664|  7.68k|        secp256k1_fe_mul(&bzinv3, &bzinv2, bzinv);
  ------------------
  |  |   93|  7.68k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  665|  7.68k|        secp256k1_fe_mul(&r->x, &b->x, &bzinv2);
  ------------------
  |  |   93|  7.68k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  666|  7.68k|        secp256k1_fe_mul(&r->y, &b->y, &bzinv3);
  ------------------
  |  |   93|  7.68k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  667|  7.68k|        secp256k1_fe_set_int(&r->z, 1);
  ------------------
  |  |   83|  7.68k|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  668|  7.68k|        SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  216|  7.68k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  669|  7.68k|        return;
  670|  7.68k|    }
  671|   269k|    if (b->infinity) {
  ------------------
  |  Branch (671:9): [True: 0, False: 269k]
  ------------------
  672|      0|        *r = *a;
  673|      0|        return;
  674|      0|    }
  675|       |
  676|       |    /** We need to calculate (rx,ry,rz) = (ax,ay,az) + (bx,by,1/bzinv). Due to
  677|       |     *  secp256k1's isomorphism we can multiply the Z coordinates on both sides
  678|       |     *  by bzinv, and get: (rx,ry,rz*bzinv) = (ax,ay,az*bzinv) + (bx,by,1).
  679|       |     *  This means that (rx,ry,rz) can be calculated as
  680|       |     *  (ax,ay,az*bzinv) + (bx,by,1), when not applying the bzinv factor to rz.
  681|       |     *  The variable az below holds the modified Z coordinate for a, which is used
  682|       |     *  for the computation of rx and ry, but not for rz.
  683|       |     */
  684|   269k|    secp256k1_fe_mul(&az, &a->z, bzinv);
  ------------------
  |  |   93|   269k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  685|       |
  686|   269k|    secp256k1_fe_sqr(&z12, &az);
  ------------------
  |  |   94|   269k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  687|   269k|    u1 = a->x;
  688|   269k|    secp256k1_fe_mul(&u2, &b->x, &z12);
  ------------------
  |  |   93|   269k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  689|   269k|    s1 = a->y;
  690|   269k|    secp256k1_fe_mul(&s2, &b->y, &z12); secp256k1_fe_mul(&s2, &s2, &az);
  ------------------
  |  |   93|   269k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
                  secp256k1_fe_mul(&s2, &b->y, &z12); secp256k1_fe_mul(&s2, &s2, &az);
  ------------------
  |  |   93|   269k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  691|   269k|    secp256k1_fe_negate(&h, &u1, SECP256K1_GEJ_X_MAGNITUDE_MAX); secp256k1_fe_add(&h, &u2);
  ------------------
  |  |  211|   269k|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|   269k|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|   269k|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 269k]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|   269k|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 269k, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|   269k|    } \
  |  |  |  |   94|   269k|    stmt; \
  |  |  |  |   95|   269k|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 269k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
                  secp256k1_fe_negate(&h, &u1, SECP256K1_GEJ_X_MAGNITUDE_MAX); secp256k1_fe_add(&h, &u2);
  ------------------
  |  |   92|   269k|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  692|   269k|    secp256k1_fe_negate(&i, &s2, 1); secp256k1_fe_add(&i, &s1);
  ------------------
  |  |  211|   269k|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|   269k|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|   269k|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 269k]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|   269k|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 269k, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|   269k|    } \
  |  |  |  |   94|   269k|    stmt; \
  |  |  |  |   95|   269k|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 269k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
                  secp256k1_fe_negate(&i, &s2, 1); secp256k1_fe_add(&i, &s1);
  ------------------
  |  |   92|   269k|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  693|   269k|    if (secp256k1_fe_normalizes_to_zero_var(&h)) {
  ------------------
  |  |   82|   269k|#  define secp256k1_fe_normalizes_to_zero_var secp256k1_fe_impl_normalizes_to_zero_var
  ------------------
  |  Branch (693:9): [True: 2, False: 269k]
  ------------------
  694|      2|        if (secp256k1_fe_normalizes_to_zero_var(&i)) {
  ------------------
  |  |   82|      2|#  define secp256k1_fe_normalizes_to_zero_var secp256k1_fe_impl_normalizes_to_zero_var
  ------------------
  |  Branch (694:13): [True: 2, False: 0]
  ------------------
  695|      2|            secp256k1_gej_double_var(r, a, NULL);
  696|      2|        } else {
  697|      0|            secp256k1_gej_set_infinity(r);
  698|      0|        }
  699|      2|        return;
  700|      2|    }
  701|       |
  702|   269k|    r->infinity = 0;
  703|   269k|    secp256k1_fe_mul(&r->z, &a->z, &h);
  ------------------
  |  |   93|   269k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  704|       |
  705|   269k|    secp256k1_fe_sqr(&h2, &h);
  ------------------
  |  |   94|   269k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  706|   269k|    secp256k1_fe_negate(&h2, &h2, 1);
  ------------------
  |  |  211|   269k|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|   269k|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|   269k|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 269k]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|   269k|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 269k, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|   269k|    } \
  |  |  |  |   94|   269k|    stmt; \
  |  |  |  |   95|   269k|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 269k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  707|   269k|    secp256k1_fe_mul(&h3, &h2, &h);
  ------------------
  |  |   93|   269k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  708|   269k|    secp256k1_fe_mul(&t, &u1, &h2);
  ------------------
  |  |   93|   269k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  709|       |
  710|   269k|    secp256k1_fe_sqr(&r->x, &i);
  ------------------
  |  |   94|   269k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  711|   269k|    secp256k1_fe_add(&r->x, &h3);
  ------------------
  |  |   92|   269k|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  712|   269k|    secp256k1_fe_add(&r->x, &t);
  ------------------
  |  |   92|   269k|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  713|   269k|    secp256k1_fe_add(&r->x, &t);
  ------------------
  |  |   92|   269k|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  714|       |
  715|   269k|    secp256k1_fe_add(&t, &r->x);
  ------------------
  |  |   92|   269k|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  716|   269k|    secp256k1_fe_mul(&r->y, &t, &i);
  ------------------
  |  |   93|   269k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  717|   269k|    secp256k1_fe_mul(&h3, &h3, &s1);
  ------------------
  |  |   93|   269k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  718|   269k|    secp256k1_fe_add(&r->y, &h3);
  ------------------
  |  |   92|   269k|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  719|       |
  720|   269k|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  216|   269k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  721|   269k|}
secp256k1.c:secp256k1_ge_set_gej_var:
  177|  3.62k|static void secp256k1_ge_set_gej_var(secp256k1_ge *r, secp256k1_gej *a) {
  178|  3.62k|    secp256k1_fe z2, z3;
  179|  3.62k|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|  3.62k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  180|       |
  181|  3.62k|    if (secp256k1_gej_is_infinity(a)) {
  ------------------
  |  Branch (181:9): [True: 0, False: 3.62k]
  ------------------
  182|      0|        secp256k1_ge_set_infinity(r);
  183|      0|        return;
  184|      0|    }
  185|  3.62k|    r->infinity = 0;
  186|  3.62k|    secp256k1_fe_inv_var(&a->z, &a->z);
  ------------------
  |  |   99|  3.62k|#  define secp256k1_fe_inv_var secp256k1_fe_impl_inv_var
  ------------------
  187|  3.62k|    secp256k1_fe_sqr(&z2, &a->z);
  ------------------
  |  |   94|  3.62k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  188|  3.62k|    secp256k1_fe_mul(&z3, &a->z, &z2);
  ------------------
  |  |   93|  3.62k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  189|  3.62k|    secp256k1_fe_mul(&a->x, &a->x, &z2);
  ------------------
  |  |   93|  3.62k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  190|  3.62k|    secp256k1_fe_mul(&a->y, &a->y, &z3);
  ------------------
  |  |   93|  3.62k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  191|  3.62k|    secp256k1_fe_set_int(&a->z, 1);
  ------------------
  |  |   83|  3.62k|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  192|  3.62k|    secp256k1_ge_set_xy(r, &a->x, &a->y);
  193|       |
  194|  3.62k|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|  3.62k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  195|  3.62k|    SECP256K1_GE_VERIFY(r);
  ------------------
  |  |  212|  3.62k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  196|  3.62k|}
secp256k1.c:secp256k1_ge_storage_cmov:
  911|  40.2M|static SECP256K1_INLINE void secp256k1_ge_storage_cmov(secp256k1_ge_storage *r, const secp256k1_ge_storage *a, int flag) {
  912|  40.2M|    VERIFY_CHECK(flag == 0 || flag == 1);
  913|  40.2M|    secp256k1_fe_storage_cmov(&r->x, &a->x, flag);
  914|  40.2M|    secp256k1_fe_storage_cmov(&r->y, &a->y, flag);
  915|  40.2M|}
secp256k1.c:secp256k1_gej_clear:
  339|  29.2k|static void secp256k1_gej_clear(secp256k1_gej *r) {
  340|  29.2k|    secp256k1_memclear_explicit(r, sizeof(secp256k1_gej));
  341|  29.2k|}
secp256k1.c:secp256k1_gej_add_ge_var:
  590|   741k|static void secp256k1_gej_add_ge_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b, secp256k1_fe *rzr) {
  591|       |    /* Operations: 8 mul, 3 sqr, 11 add/negate/normalizes_to_zero (ignoring special cases) */
  592|   741k|    secp256k1_fe z12, u1, u2, s1, s2, h, i, h2, h3, t;
  593|   741k|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|   741k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  594|   741k|    SECP256K1_GE_VERIFY(b);
  ------------------
  |  |  212|   741k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  595|       |
  596|   741k|    if (a->infinity) {
  ------------------
  |  Branch (596:9): [True: 8.61k, False: 732k]
  ------------------
  597|  8.61k|        VERIFY_CHECK(rzr == NULL);
  598|  8.61k|        secp256k1_gej_set_ge(r, b);
  599|  8.61k|        return;
  600|  8.61k|    }
  601|   732k|    if (b->infinity) {
  ------------------
  |  Branch (601:9): [True: 0, False: 732k]
  ------------------
  602|      0|        if (rzr != NULL) {
  ------------------
  |  Branch (602:13): [True: 0, False: 0]
  ------------------
  603|      0|            secp256k1_fe_set_int(rzr, 1);
  ------------------
  |  |   83|      0|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  604|      0|        }
  605|      0|        *r = *a;
  606|      0|        return;
  607|      0|    }
  608|       |
  609|   732k|    secp256k1_fe_sqr(&z12, &a->z);
  ------------------
  |  |   94|   732k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  610|   732k|    u1 = a->x;
  611|   732k|    secp256k1_fe_mul(&u2, &b->x, &z12);
  ------------------
  |  |   93|   732k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  612|   732k|    s1 = a->y;
  613|   732k|    secp256k1_fe_mul(&s2, &b->y, &z12); secp256k1_fe_mul(&s2, &s2, &a->z);
  ------------------
  |  |   93|   732k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
                  secp256k1_fe_mul(&s2, &b->y, &z12); secp256k1_fe_mul(&s2, &s2, &a->z);
  ------------------
  |  |   93|   732k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  614|   732k|    secp256k1_fe_negate(&h, &u1, SECP256K1_GEJ_X_MAGNITUDE_MAX); secp256k1_fe_add(&h, &u2);
  ------------------
  |  |  211|   732k|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|   732k|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|   732k|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 732k]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|   732k|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 732k, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|   732k|    } \
  |  |  |  |   94|   732k|    stmt; \
  |  |  |  |   95|   732k|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 732k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
                  secp256k1_fe_negate(&h, &u1, SECP256K1_GEJ_X_MAGNITUDE_MAX); secp256k1_fe_add(&h, &u2);
  ------------------
  |  |   92|   732k|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  615|   732k|    secp256k1_fe_negate(&i, &s2, 1); secp256k1_fe_add(&i, &s1);
  ------------------
  |  |  211|   732k|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|   732k|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|   732k|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 732k]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|   732k|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 732k, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|   732k|    } \
  |  |  |  |   94|   732k|    stmt; \
  |  |  |  |   95|   732k|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 732k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
                  secp256k1_fe_negate(&i, &s2, 1); secp256k1_fe_add(&i, &s1);
  ------------------
  |  |   92|   732k|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  616|   732k|    if (secp256k1_fe_normalizes_to_zero_var(&h)) {
  ------------------
  |  |   82|   732k|#  define secp256k1_fe_normalizes_to_zero_var secp256k1_fe_impl_normalizes_to_zero_var
  ------------------
  |  Branch (616:9): [True: 0, False: 732k]
  ------------------
  617|      0|        if (secp256k1_fe_normalizes_to_zero_var(&i)) {
  ------------------
  |  |   82|      0|#  define secp256k1_fe_normalizes_to_zero_var secp256k1_fe_impl_normalizes_to_zero_var
  ------------------
  |  Branch (617:13): [True: 0, False: 0]
  ------------------
  618|      0|            secp256k1_gej_double_var(r, a, rzr);
  619|      0|        } else {
  620|      0|            if (rzr != NULL) {
  ------------------
  |  Branch (620:17): [True: 0, False: 0]
  ------------------
  621|      0|                secp256k1_fe_set_int(rzr, 0);
  ------------------
  |  |   83|      0|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  622|      0|            }
  623|      0|            secp256k1_gej_set_infinity(r);
  624|      0|        }
  625|      0|        return;
  626|      0|    }
  627|       |
  628|   732k|    r->infinity = 0;
  629|   732k|    if (rzr != NULL) {
  ------------------
  |  Branch (629:9): [True: 114k, False: 618k]
  ------------------
  630|   114k|        *rzr = h;
  631|   114k|    }
  632|   732k|    secp256k1_fe_mul(&r->z, &a->z, &h);
  ------------------
  |  |   93|   732k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  633|       |
  634|   732k|    secp256k1_fe_sqr(&h2, &h);
  ------------------
  |  |   94|   732k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  635|   732k|    secp256k1_fe_negate(&h2, &h2, 1);
  ------------------
  |  |  211|   732k|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|   732k|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|   732k|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 732k]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|   732k|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 732k, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|   732k|    } \
  |  |  |  |   94|   732k|    stmt; \
  |  |  |  |   95|   732k|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 732k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  636|   732k|    secp256k1_fe_mul(&h3, &h2, &h);
  ------------------
  |  |   93|   732k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  637|   732k|    secp256k1_fe_mul(&t, &u1, &h2);
  ------------------
  |  |   93|   732k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  638|       |
  639|   732k|    secp256k1_fe_sqr(&r->x, &i);
  ------------------
  |  |   94|   732k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  640|   732k|    secp256k1_fe_add(&r->x, &h3);
  ------------------
  |  |   92|   732k|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  641|   732k|    secp256k1_fe_add(&r->x, &t);
  ------------------
  |  |   92|   732k|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  642|   732k|    secp256k1_fe_add(&r->x, &t);
  ------------------
  |  |   92|   732k|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  643|       |
  644|   732k|    secp256k1_fe_add(&t, &r->x);
  ------------------
  |  |   92|   732k|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  645|   732k|    secp256k1_fe_mul(&r->y, &t, &i);
  ------------------
  |  |   93|   732k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  646|   732k|    secp256k1_fe_mul(&h3, &h3, &s1);
  ------------------
  |  |   93|   732k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  647|   732k|    secp256k1_fe_add(&r->y, &h3);
  ------------------
  |  |   92|   732k|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  648|       |
  649|   732k|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  216|   732k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  650|   732k|    if (rzr != NULL) SECP256K1_FE_VERIFY(rzr);
  ------------------
  |  |  345|   114k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  |  Branch (650:9): [True: 114k, False: 618k]
  ------------------
  651|   732k|}
secp256k1.c:secp256k1_ge_to_bytes:
  977|  38.0k|static void secp256k1_ge_to_bytes(unsigned char *buf, const secp256k1_ge *a) {
  978|  38.0k|    secp256k1_ge_storage s;
  979|       |
  980|       |    /* We require that the secp256k1_ge_storage type is exactly 64 bytes.
  981|       |     * This is formally not guaranteed by the C standard, but should hold on any
  982|       |     * sane compiler in the real world. */
  983|  38.0k|    STATIC_ASSERT(sizeof(secp256k1_ge_storage) == 64);
  ------------------
  |  |   74|  38.0k|#define STATIC_ASSERT(expr) do { \
  |  |   75|  38.0k|    switch(0) { \
  |  |  ------------------
  |  |  |  Branch (75:12): [Folded, False: 0]
  |  |  ------------------
  |  |   76|  38.0k|        case 0: \
  |  |  ------------------
  |  |  |  Branch (76:9): [True: 38.0k, False: 0]
  |  |  ------------------
  |  |   77|  38.0k|        /* If expr evaluates to 0, we have two case labels "0", which is illegal. */ \
  |  |   78|  38.0k|        case /* ERROR: static assertion failed */ (expr): \
  |  |  ------------------
  |  |  |  Branch (78:9): [True: 0, False: 38.0k]
  |  |  ------------------
  |  |   79|  38.0k|        ; \
  |  |   80|  38.0k|    } \
  |  |   81|  38.0k|} while(0)
  |  |  ------------------
  |  |  |  Branch (81:9): [Folded, False: 38.0k]
  |  |  ------------------
  ------------------
  984|  38.0k|    VERIFY_CHECK(!secp256k1_ge_is_infinity(a));
  985|  38.0k|    secp256k1_ge_to_storage(&s, a);
  986|  38.0k|    memcpy(buf, &s, 64);
  987|  38.0k|}
secp256k1.c:secp256k1_ge_to_storage:
  877|  38.0k|static void secp256k1_ge_to_storage(secp256k1_ge_storage *r, const secp256k1_ge *a) {
  878|  38.0k|    secp256k1_fe x, y;
  879|  38.0k|    SECP256K1_GE_VERIFY(a);
  ------------------
  |  |  212|  38.0k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  880|  38.0k|    VERIFY_CHECK(!a->infinity);
  881|       |
  882|  38.0k|    x = a->x;
  883|  38.0k|    secp256k1_fe_normalize(&x);
  ------------------
  |  |   78|  38.0k|#  define secp256k1_fe_normalize secp256k1_fe_impl_normalize
  ------------------
  884|  38.0k|    y = a->y;
  885|  38.0k|    secp256k1_fe_normalize(&y);
  ------------------
  |  |   78|  38.0k|#  define secp256k1_fe_normalize secp256k1_fe_impl_normalize
  ------------------
  886|  38.0k|    secp256k1_fe_to_storage(&r->x, &x);
  ------------------
  |  |   96|  38.0k|#  define secp256k1_fe_to_storage secp256k1_fe_impl_to_storage
  ------------------
  887|  38.0k|    secp256k1_fe_to_storage(&r->y, &y);
  ------------------
  |  |   96|  38.0k|#  define secp256k1_fe_to_storage secp256k1_fe_impl_to_storage
  ------------------
  888|  38.0k|}
secp256k1.c:secp256k1_ge_from_bytes:
  989|  30.7k|static void secp256k1_ge_from_bytes(secp256k1_ge *r, const unsigned char *buf) {
  990|  30.7k|    secp256k1_ge_storage s;
  991|       |
  992|  30.7k|    STATIC_ASSERT(sizeof(secp256k1_ge_storage) == 64);
  ------------------
  |  |   74|  30.7k|#define STATIC_ASSERT(expr) do { \
  |  |   75|  30.7k|    switch(0) { \
  |  |  ------------------
  |  |  |  Branch (75:12): [Folded, False: 0]
  |  |  ------------------
  |  |   76|  30.7k|        case 0: \
  |  |  ------------------
  |  |  |  Branch (76:9): [True: 30.7k, False: 0]
  |  |  ------------------
  |  |   77|  30.7k|        /* If expr evaluates to 0, we have two case labels "0", which is illegal. */ \
  |  |   78|  30.7k|        case /* ERROR: static assertion failed */ (expr): \
  |  |  ------------------
  |  |  |  Branch (78:9): [True: 0, False: 30.7k]
  |  |  ------------------
  |  |   79|  30.7k|        ; \
  |  |   80|  30.7k|    } \
  |  |   81|  30.7k|} while(0)
  |  |  ------------------
  |  |  |  Branch (81:9): [Folded, False: 30.7k]
  |  |  ------------------
  ------------------
  993|  30.7k|    memcpy(&s, buf, 64);
  994|  30.7k|    secp256k1_ge_from_storage(r, &s);
  995|  30.7k|}

secp256k1.c:secp256k1_sha256_transform:
  133|   297k|static void secp256k1_sha256_transform(uint32_t *state, const unsigned char *blocks64, size_t n_blocks) {
  134|   594k|    while (n_blocks--) {
  ------------------
  |  Branch (134:12): [True: 297k, False: 297k]
  ------------------
  135|   297k|        secp256k1_sha256_transform_impl(state, blocks64);
  136|   297k|        blocks64 += 64;
  137|   297k|    }
  138|   297k|}
secp256k1.c:secp256k1_sha256_transform_impl:
   51|   297k|static void secp256k1_sha256_transform_impl(uint32_t* s, const unsigned char* buf) {
   52|   297k|    uint32_t a = s[0], b = s[1], c = s[2], d = s[3], e = s[4], f = s[5], g = s[6], h = s[7];
   53|   297k|    uint32_t w0, w1, w2, w3, w4, w5, w6, w7, w8, w9, w10, w11, w12, w13, w14, w15;
   54|       |
   55|   297k|    Round(a, b, c, d, e, f, g, h, 0x428a2f98,  w0 = secp256k1_read_be32(&buf[0]));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   56|   297k|    Round(h, a, b, c, d, e, f, g, 0x71374491,  w1 = secp256k1_read_be32(&buf[4]));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   57|   297k|    Round(g, h, a, b, c, d, e, f, 0xb5c0fbcf,  w2 = secp256k1_read_be32(&buf[8]));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   58|   297k|    Round(f, g, h, a, b, c, d, e, 0xe9b5dba5,  w3 = secp256k1_read_be32(&buf[12]));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   59|   297k|    Round(e, f, g, h, a, b, c, d, 0x3956c25b,  w4 = secp256k1_read_be32(&buf[16]));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   60|   297k|    Round(d, e, f, g, h, a, b, c, 0x59f111f1,  w5 = secp256k1_read_be32(&buf[20]));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   61|   297k|    Round(c, d, e, f, g, h, a, b, 0x923f82a4,  w6 = secp256k1_read_be32(&buf[24]));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   62|   297k|    Round(b, c, d, e, f, g, h, a, 0xab1c5ed5,  w7 = secp256k1_read_be32(&buf[28]));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   63|   297k|    Round(a, b, c, d, e, f, g, h, 0xd807aa98,  w8 = secp256k1_read_be32(&buf[32]));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   64|   297k|    Round(h, a, b, c, d, e, f, g, 0x12835b01,  w9 = secp256k1_read_be32(&buf[36]));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   65|   297k|    Round(g, h, a, b, c, d, e, f, 0x243185be, w10 = secp256k1_read_be32(&buf[40]));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   66|   297k|    Round(f, g, h, a, b, c, d, e, 0x550c7dc3, w11 = secp256k1_read_be32(&buf[44]));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   67|   297k|    Round(e, f, g, h, a, b, c, d, 0x72be5d74, w12 = secp256k1_read_be32(&buf[48]));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   68|   297k|    Round(d, e, f, g, h, a, b, c, 0x80deb1fe, w13 = secp256k1_read_be32(&buf[52]));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   69|   297k|    Round(c, d, e, f, g, h, a, b, 0x9bdc06a7, w14 = secp256k1_read_be32(&buf[56]));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   70|   297k|    Round(b, c, d, e, f, g, h, a, 0xc19bf174, w15 = secp256k1_read_be32(&buf[60]));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   71|       |
   72|   297k|    Round(a, b, c, d, e, f, g, h, 0xe49b69c1, w0 += sigma1(w14) + w9 + sigma0(w1));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   73|   297k|    Round(h, a, b, c, d, e, f, g, 0xefbe4786, w1 += sigma1(w15) + w10 + sigma0(w2));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   74|   297k|    Round(g, h, a, b, c, d, e, f, 0x0fc19dc6, w2 += sigma1(w0) + w11 + sigma0(w3));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   75|   297k|    Round(f, g, h, a, b, c, d, e, 0x240ca1cc, w3 += sigma1(w1) + w12 + sigma0(w4));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   76|   297k|    Round(e, f, g, h, a, b, c, d, 0x2de92c6f, w4 += sigma1(w2) + w13 + sigma0(w5));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   77|   297k|    Round(d, e, f, g, h, a, b, c, 0x4a7484aa, w5 += sigma1(w3) + w14 + sigma0(w6));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   78|   297k|    Round(c, d, e, f, g, h, a, b, 0x5cb0a9dc, w6 += sigma1(w4) + w15 + sigma0(w7));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   79|   297k|    Round(b, c, d, e, f, g, h, a, 0x76f988da, w7 += sigma1(w5) + w0 + sigma0(w8));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   80|   297k|    Round(a, b, c, d, e, f, g, h, 0x983e5152, w8 += sigma1(w6) + w1 + sigma0(w9));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   81|   297k|    Round(h, a, b, c, d, e, f, g, 0xa831c66d, w9 += sigma1(w7) + w2 + sigma0(w10));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   82|   297k|    Round(g, h, a, b, c, d, e, f, 0xb00327c8, w10 += sigma1(w8) + w3 + sigma0(w11));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   83|   297k|    Round(f, g, h, a, b, c, d, e, 0xbf597fc7, w11 += sigma1(w9) + w4 + sigma0(w12));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   84|   297k|    Round(e, f, g, h, a, b, c, d, 0xc6e00bf3, w12 += sigma1(w10) + w5 + sigma0(w13));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   85|   297k|    Round(d, e, f, g, h, a, b, c, 0xd5a79147, w13 += sigma1(w11) + w6 + sigma0(w14));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   86|   297k|    Round(c, d, e, f, g, h, a, b, 0x06ca6351, w14 += sigma1(w12) + w7 + sigma0(w15));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   87|   297k|    Round(b, c, d, e, f, g, h, a, 0x14292967, w15 += sigma1(w13) + w8 + sigma0(w0));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   88|       |
   89|   297k|    Round(a, b, c, d, e, f, g, h, 0x27b70a85, w0 += sigma1(w14) + w9 + sigma0(w1));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   90|   297k|    Round(h, a, b, c, d, e, f, g, 0x2e1b2138, w1 += sigma1(w15) + w10 + sigma0(w2));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   91|   297k|    Round(g, h, a, b, c, d, e, f, 0x4d2c6dfc, w2 += sigma1(w0) + w11 + sigma0(w3));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   92|   297k|    Round(f, g, h, a, b, c, d, e, 0x53380d13, w3 += sigma1(w1) + w12 + sigma0(w4));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   93|   297k|    Round(e, f, g, h, a, b, c, d, 0x650a7354, w4 += sigma1(w2) + w13 + sigma0(w5));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   94|   297k|    Round(d, e, f, g, h, a, b, c, 0x766a0abb, w5 += sigma1(w3) + w14 + sigma0(w6));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   95|   297k|    Round(c, d, e, f, g, h, a, b, 0x81c2c92e, w6 += sigma1(w4) + w15 + sigma0(w7));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   96|   297k|    Round(b, c, d, e, f, g, h, a, 0x92722c85, w7 += sigma1(w5) + w0 + sigma0(w8));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   97|   297k|    Round(a, b, c, d, e, f, g, h, 0xa2bfe8a1, w8 += sigma1(w6) + w1 + sigma0(w9));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   98|   297k|    Round(h, a, b, c, d, e, f, g, 0xa81a664b, w9 += sigma1(w7) + w2 + sigma0(w10));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
   99|   297k|    Round(g, h, a, b, c, d, e, f, 0xc24b8b70, w10 += sigma1(w8) + w3 + sigma0(w11));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
  100|   297k|    Round(f, g, h, a, b, c, d, e, 0xc76c51a3, w11 += sigma1(w9) + w4 + sigma0(w12));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
  101|   297k|    Round(e, f, g, h, a, b, c, d, 0xd192e819, w12 += sigma1(w10) + w5 + sigma0(w13));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
  102|   297k|    Round(d, e, f, g, h, a, b, c, 0xd6990624, w13 += sigma1(w11) + w6 + sigma0(w14));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
  103|   297k|    Round(c, d, e, f, g, h, a, b, 0xf40e3585, w14 += sigma1(w12) + w7 + sigma0(w15));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
  104|   297k|    Round(b, c, d, e, f, g, h, a, 0x106aa070, w15 += sigma1(w13) + w8 + sigma0(w0));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
  105|       |
  106|   297k|    Round(a, b, c, d, e, f, g, h, 0x19a4c116, w0 += sigma1(w14) + w9 + sigma0(w1));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
  107|   297k|    Round(h, a, b, c, d, e, f, g, 0x1e376c08, w1 += sigma1(w15) + w10 + sigma0(w2));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
  108|   297k|    Round(g, h, a, b, c, d, e, f, 0x2748774c, w2 += sigma1(w0) + w11 + sigma0(w3));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
  109|   297k|    Round(f, g, h, a, b, c, d, e, 0x34b0bcb5, w3 += sigma1(w1) + w12 + sigma0(w4));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
  110|   297k|    Round(e, f, g, h, a, b, c, d, 0x391c0cb3, w4 += sigma1(w2) + w13 + sigma0(w5));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
  111|   297k|    Round(d, e, f, g, h, a, b, c, 0x4ed8aa4a, w5 += sigma1(w3) + w14 + sigma0(w6));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
  112|   297k|    Round(c, d, e, f, g, h, a, b, 0x5b9cca4f, w6 += sigma1(w4) + w15 + sigma0(w7));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
  113|   297k|    Round(b, c, d, e, f, g, h, a, 0x682e6ff3, w7 += sigma1(w5) + w0 + sigma0(w8));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
  114|   297k|    Round(a, b, c, d, e, f, g, h, 0x748f82ee, w8 += sigma1(w6) + w1 + sigma0(w9));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
  115|   297k|    Round(h, a, b, c, d, e, f, g, 0x78a5636f, w9 += sigma1(w7) + w2 + sigma0(w10));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
  116|   297k|    Round(g, h, a, b, c, d, e, f, 0x84c87814, w10 += sigma1(w8) + w3 + sigma0(w11));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
  117|   297k|    Round(f, g, h, a, b, c, d, e, 0x8cc70208, w11 += sigma1(w9) + w4 + sigma0(w12));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
  118|   297k|    Round(e, f, g, h, a, b, c, d, 0x90befffa, w12 += sigma1(w10) + w5 + sigma0(w13));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
  119|   297k|    Round(d, e, f, g, h, a, b, c, 0xa4506ceb, w13 += sigma1(w11) + w6 + sigma0(w14));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
  120|   297k|    Round(c, d, e, f, g, h, a, b, 0xbef9a3f7, w14 + sigma1(w12) + w7 + sigma0(w15));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
  121|   297k|    Round(b, c, d, e, f, g, h, a, 0xc67178f2, w15 + sigma1(w13) + w8 + sigma0(w0));
  ------------------
  |  |   24|   297k|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|   297k|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|   297k|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|   297k|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|   297k|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|   297k|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|   297k|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|   297k|    (d) += t1; \
  |  |   28|   297k|    (h) = t1 + t2; \
  |  |   29|   297k|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 297k]
  |  |  ------------------
  ------------------
  122|       |
  123|   297k|    s[0] += a;
  124|   297k|    s[1] += b;
  125|   297k|    s[2] += c;
  126|   297k|    s[3] += d;
  127|   297k|    s[4] += e;
  128|   297k|    s[5] += f;
  129|   297k|    s[6] += g;
  130|   297k|    s[7] += h;
  131|   297k|}
secp256k1.c:secp256k1_sha256_initialize:
   31|   129k|static void secp256k1_sha256_initialize(secp256k1_sha256 *hash) {
   32|   129k|    hash->s[0] = 0x6a09e667ul;
   33|   129k|    hash->s[1] = 0xbb67ae85ul;
   34|   129k|    hash->s[2] = 0x3c6ef372ul;
   35|   129k|    hash->s[3] = 0xa54ff53aul;
   36|   129k|    hash->s[4] = 0x510e527ful;
   37|   129k|    hash->s[5] = 0x9b05688cul;
   38|   129k|    hash->s[6] = 0x1f83d9abul;
   39|   129k|    hash->s[7] = 0x5be0cd19ul;
   40|   129k|    hash->bytes = 0;
   41|   129k|}
secp256k1.c:secp256k1_rfc6979_hmac_sha256_initialize:
  320|  12.9k|static void secp256k1_rfc6979_hmac_sha256_initialize(const secp256k1_hash_ctx *hash_ctx, secp256k1_rfc6979_hmac_sha256 *rng, const unsigned char *key, size_t keylen) {
  321|  12.9k|    secp256k1_hmac_sha256 hmac;
  322|  12.9k|    static const unsigned char zero[1] = {0x00};
  323|  12.9k|    static const unsigned char one[1] = {0x01};
  324|       |
  325|  12.9k|    memset(rng->v, 0x01, 32); /* RFC6979 3.2.b. */
  326|  12.9k|    memset(rng->k, 0x00, 32); /* RFC6979 3.2.c. */
  327|       |
  328|       |    /* RFC6979 3.2.d. */
  329|  12.9k|    secp256k1_hmac_sha256_initialize(hash_ctx, &hmac, rng->k, 32);
  330|  12.9k|    secp256k1_hmac_sha256_write(hash_ctx, &hmac, rng->v, 32);
  331|  12.9k|    secp256k1_hmac_sha256_write(hash_ctx, &hmac, zero, 1);
  332|  12.9k|    secp256k1_hmac_sha256_write(hash_ctx, &hmac, key, keylen);
  333|  12.9k|    secp256k1_hmac_sha256_finalize(hash_ctx, &hmac, rng->k);
  334|  12.9k|    secp256k1_hmac_sha256_initialize(hash_ctx, &hmac, rng->k, 32);
  335|  12.9k|    secp256k1_hmac_sha256_write(hash_ctx, &hmac, rng->v, 32);
  336|  12.9k|    secp256k1_hmac_sha256_finalize(hash_ctx, &hmac, rng->v);
  337|       |
  338|       |    /* RFC6979 3.2.f. */
  339|  12.9k|    secp256k1_hmac_sha256_initialize(hash_ctx, &hmac, rng->k, 32);
  340|  12.9k|    secp256k1_hmac_sha256_write(hash_ctx, &hmac, rng->v, 32);
  341|  12.9k|    secp256k1_hmac_sha256_write(hash_ctx, &hmac, one, 1);
  342|  12.9k|    secp256k1_hmac_sha256_write(hash_ctx, &hmac, key, keylen);
  343|  12.9k|    secp256k1_hmac_sha256_finalize(hash_ctx, &hmac, rng->k);
  344|  12.9k|    secp256k1_hmac_sha256_initialize(hash_ctx, &hmac, rng->k, 32);
  345|  12.9k|    secp256k1_hmac_sha256_write(hash_ctx, &hmac, rng->v, 32);
  346|  12.9k|    secp256k1_hmac_sha256_finalize(hash_ctx, &hmac, rng->v);
  347|  12.9k|    rng->retry = 0;
  348|  12.9k|}
secp256k1.c:secp256k1_hmac_sha256_initialize:
  276|  64.9k|static void secp256k1_hmac_sha256_initialize(const secp256k1_hash_ctx *hash_ctx, secp256k1_hmac_sha256 *hash, const unsigned char *key, size_t keylen) {
  277|  64.9k|    size_t n;
  278|  64.9k|    unsigned char rkey[64];
  279|  64.9k|    if (keylen <= sizeof(rkey)) {
  ------------------
  |  Branch (279:9): [True: 64.9k, False: 0]
  ------------------
  280|  64.9k|        memcpy(rkey, key, keylen);
  281|  64.9k|        memset(rkey + keylen, 0, sizeof(rkey) - keylen);
  282|  64.9k|    } else {
  283|      0|        secp256k1_sha256 sha256;
  284|      0|        secp256k1_sha256_initialize(&sha256);
  285|      0|        secp256k1_sha256_write(hash_ctx, &sha256, key, keylen);
  286|      0|        secp256k1_sha256_finalize(hash_ctx, &sha256, rkey);
  287|      0|        memset(rkey + 32, 0, 32);
  288|      0|    }
  289|       |
  290|  64.9k|    secp256k1_sha256_initialize(&hash->outer);
  291|  4.22M|    for (n = 0; n < sizeof(rkey); n++) {
  ------------------
  |  Branch (291:17): [True: 4.15M, False: 64.9k]
  ------------------
  292|  4.15M|        rkey[n] ^= 0x5c;
  293|  4.15M|    }
  294|  64.9k|    secp256k1_sha256_write(hash_ctx, &hash->outer, rkey, sizeof(rkey));
  295|       |
  296|  64.9k|    secp256k1_sha256_initialize(&hash->inner);
  297|  4.22M|    for (n = 0; n < sizeof(rkey); n++) {
  ------------------
  |  Branch (297:17): [True: 4.15M, False: 64.9k]
  ------------------
  298|  4.15M|        rkey[n] ^= 0x5c ^ 0x36;
  299|  4.15M|    }
  300|  64.9k|    secp256k1_sha256_write(hash_ctx, &hash->inner, rkey, sizeof(rkey));
  301|  64.9k|    secp256k1_memclear_explicit(rkey, sizeof(rkey));
  302|  64.9k|}
secp256k1.c:secp256k1_hmac_sha256_write:
  304|   116k|static void secp256k1_hmac_sha256_write(const secp256k1_hash_ctx *hash_ctx, secp256k1_hmac_sha256 *hash, const unsigned char *data, size_t size) {
  305|   116k|    secp256k1_sha256_write(hash_ctx, &hash->inner, data, size);
  306|   116k|}
secp256k1.c:secp256k1_hmac_sha256_finalize:
  308|  64.9k|static void secp256k1_hmac_sha256_finalize(const secp256k1_hash_ctx *hash_ctx, secp256k1_hmac_sha256 *hash, unsigned char *out32) {
  309|  64.9k|    unsigned char temp[32];
  310|  64.9k|    secp256k1_sha256_finalize(hash_ctx, &hash->inner, temp);
  311|  64.9k|    secp256k1_sha256_write(hash_ctx, &hash->outer, temp, 32);
  312|  64.9k|    secp256k1_memclear_explicit(temp, sizeof(temp));
  313|  64.9k|    secp256k1_sha256_finalize(hash_ctx, &hash->outer, out32);
  314|  64.9k|}
secp256k1.c:secp256k1_rfc6979_hmac_sha256_generate:
  350|  12.9k|static void secp256k1_rfc6979_hmac_sha256_generate(const secp256k1_hash_ctx *hash_ctx, secp256k1_rfc6979_hmac_sha256 *rng, unsigned char *out, size_t outlen) {
  351|       |    /* RFC6979 3.2.h. */
  352|  12.9k|    static const unsigned char zero[1] = {0x00};
  353|  12.9k|    if (rng->retry) {
  ------------------
  |  Branch (353:9): [True: 0, False: 12.9k]
  ------------------
  354|      0|        secp256k1_hmac_sha256 hmac;
  355|      0|        secp256k1_hmac_sha256_initialize(hash_ctx, &hmac, rng->k, 32);
  356|      0|        secp256k1_hmac_sha256_write(hash_ctx, &hmac, rng->v, 32);
  357|      0|        secp256k1_hmac_sha256_write(hash_ctx, &hmac, zero, 1);
  358|      0|        secp256k1_hmac_sha256_finalize(hash_ctx, &hmac, rng->k);
  359|      0|        secp256k1_hmac_sha256_initialize(hash_ctx, &hmac, rng->k, 32);
  360|      0|        secp256k1_hmac_sha256_write(hash_ctx, &hmac, rng->v, 32);
  361|      0|        secp256k1_hmac_sha256_finalize(hash_ctx, &hmac, rng->v);
  362|      0|    }
  363|       |
  364|  25.9k|    while (outlen > 0) {
  ------------------
  |  Branch (364:12): [True: 12.9k, False: 12.9k]
  ------------------
  365|  12.9k|        secp256k1_hmac_sha256 hmac;
  366|  12.9k|        size_t now = outlen;
  367|  12.9k|        secp256k1_hmac_sha256_initialize(hash_ctx, &hmac, rng->k, 32);
  368|  12.9k|        secp256k1_hmac_sha256_write(hash_ctx, &hmac, rng->v, 32);
  369|  12.9k|        secp256k1_hmac_sha256_finalize(hash_ctx, &hmac, rng->v);
  370|  12.9k|        if (now > 32) {
  ------------------
  |  Branch (370:13): [True: 0, False: 12.9k]
  ------------------
  371|      0|            now = 32;
  372|      0|        }
  373|  12.9k|        memcpy(out, rng->v, now);
  374|  12.9k|        out += now;
  375|  12.9k|        outlen -= now;
  376|  12.9k|    }
  377|       |
  378|  12.9k|    rng->retry = 1;
  379|  12.9k|}
secp256k1.c:secp256k1_rfc6979_hmac_sha256_finalize:
  381|  12.9k|static void secp256k1_rfc6979_hmac_sha256_finalize(secp256k1_rfc6979_hmac_sha256 *rng) {
  382|  12.9k|    (void) rng;
  383|  12.9k|}
secp256k1.c:secp256k1_rfc6979_hmac_sha256_clear:
  385|  12.9k|static void secp256k1_rfc6979_hmac_sha256_clear(secp256k1_rfc6979_hmac_sha256 *rng) {
  386|  12.9k|    secp256k1_memclear_explicit(rng, sizeof(*rng));
  387|  12.9k|}
secp256k1.c:secp256k1_sha256_write:
  210|   571k|static void secp256k1_sha256_write(const secp256k1_hash_ctx *hash_ctx, secp256k1_sha256 *hash, const unsigned char *data, size_t len) {
  211|   571k|    size_t chunk_len;
  212|   571k|    size_t bufsize = hash->bytes & 0x3F;
  213|   571k|    hash->bytes += len;
  214|   571k|    VERIFY_CHECK(hash->bytes >= len);
  215|   571k|    VERIFY_CHECK(hash_ctx != NULL);
  216|   571k|    VERIFY_CHECK(hash_ctx->fn_sha256_compression != NULL);
  217|       |
  218|       |    /* If we exceed the 64-byte block size with this input, process it and wipe the buffer */
  219|   571k|    chunk_len = 64 - bufsize;
  220|   571k|    if (bufsize && len >= chunk_len) {
  ------------------
  |  Branch (220:9): [True: 311k, False: 259k]
  |  Branch (220:20): [True: 155k, False: 155k]
  ------------------
  221|   155k|        memcpy(hash->buf + bufsize, data, chunk_len);
  222|   155k|        data += chunk_len;
  223|   155k|        len -= chunk_len;
  224|   155k|        hash_ctx->fn_sha256_compression(hash->s, hash->buf, 1);
  225|   155k|        bufsize = 0;
  226|   155k|    }
  227|       |
  228|       |    /* If we still have data to process, invoke compression directly on the input */
  229|   571k|    if (len >= 64) {
  ------------------
  |  Branch (229:9): [True: 141k, False: 430k]
  ------------------
  230|   141k|        const size_t n_blocks = len / 64;
  231|   141k|        const size_t advance = n_blocks * 64;
  232|   141k|        hash_ctx->fn_sha256_compression(hash->s, data, n_blocks);
  233|   141k|        data += advance;
  234|   141k|        len -= advance;
  235|   141k|    }
  236|       |
  237|       |    /* Fill the buffer with what remains */
  238|   571k|    if (len) {
  ------------------
  |  Branch (238:9): [True: 311k, False: 259k]
  ------------------
  239|   311k|        memcpy(hash->buf + bufsize, data, len);
  240|   311k|    }
  241|   571k|}
secp256k1.c:secp256k1_sha256_finalize:
  243|   129k|static void secp256k1_sha256_finalize(const secp256k1_hash_ctx *hash_ctx, secp256k1_sha256 *hash, unsigned char *out32) {
  244|   129k|    static const unsigned char pad[64] = {0x80};
  245|   129k|    unsigned char sizedesc[8];
  246|   129k|    int i;
  247|       |    /* The maximum message size of SHA256 is 2^64-1 bits. */
  248|   129k|    VERIFY_CHECK(hash->bytes < ((uint64_t)1 << 61));
  249|   129k|    secp256k1_write_be32(&sizedesc[0], hash->bytes >> 29);
  250|   129k|    secp256k1_write_be32(&sizedesc[4], hash->bytes << 3);
  251|   129k|    secp256k1_sha256_write(hash_ctx, hash, pad, 1 + ((119 - (hash->bytes % 64)) % 64));
  252|   129k|    secp256k1_sha256_write(hash_ctx, hash, sizedesc, 8);
  253|  1.16M|    for (i = 0; i < 8; i++) {
  ------------------
  |  Branch (253:17): [True: 1.03M, False: 129k]
  ------------------
  254|  1.03M|        secp256k1_write_be32(&out32[4*i], hash->s[i]);
  255|  1.03M|        hash->s[i] = 0;
  256|  1.03M|    }
  257|   129k|}

secp256k1.c:secp256k1_u128_mul:
   11|   142M|static SECP256K1_INLINE void secp256k1_u128_mul(secp256k1_uint128 *r, uint64_t a, uint64_t b) {
   12|   142M|   *r = (uint128_t)a * b;
   13|   142M|}
secp256k1.c:secp256k1_u128_accum_mul:
   15|  1.09G|static SECP256K1_INLINE void secp256k1_u128_accum_mul(secp256k1_uint128 *r, uint64_t a, uint64_t b) {
   16|  1.09G|   *r += (uint128_t)a * b;
   17|  1.09G|}
secp256k1.c:secp256k1_u128_to_u64:
   28|   618M|static SECP256K1_INLINE uint64_t secp256k1_u128_to_u64(const secp256k1_uint128 *a) {
   29|   618M|   return (uint64_t)(*a);
   30|   618M|}
secp256k1.c:secp256k1_u128_rshift:
   23|   475M|static SECP256K1_INLINE void secp256k1_u128_rshift(secp256k1_uint128 *r, unsigned int n) {
   24|   475M|   VERIFY_CHECK(n < 128);
   25|   475M|   *r >>= n;
   26|   475M|}
secp256k1.c:secp256k1_u128_accum_u64:
   19|  50.4M|static SECP256K1_INLINE void secp256k1_u128_accum_u64(secp256k1_uint128 *r, uint64_t a) {
   20|  50.4M|   *r += a;
   21|  50.4M|}
secp256k1.c:secp256k1_u128_from_u64:
   36|   490k|static SECP256K1_INLINE void secp256k1_u128_from_u64(secp256k1_uint128 *r, uint64_t a) {
   37|   490k|   *r = a;
   38|   490k|}
secp256k1.c:secp256k1_i128_mul:
   49|  2.41M|static SECP256K1_INLINE void secp256k1_i128_mul(secp256k1_int128 *r, int64_t a, int64_t b) {
   50|  2.41M|   *r = (int128_t)a * b;
   51|  2.41M|}
secp256k1.c:secp256k1_i128_accum_mul:
   53|  23.7M|static SECP256K1_INLINE void secp256k1_i128_accum_mul(secp256k1_int128 *r, int64_t a, int64_t b) {
   54|  23.7M|   int128_t ab = (int128_t)a * b;
   55|  23.7M|   VERIFY_CHECK(0 <= ab ? *r <= INT128_MAX - ab : INT128_MIN - ab <= *r);
   56|  23.7M|   *r += ab;
   57|  23.7M|}
secp256k1.c:secp256k1_i128_to_u64:
   71|  10.1M|static SECP256K1_INLINE uint64_t secp256k1_i128_to_u64(const secp256k1_int128 *a) {
   72|  10.1M|   return (uint64_t)*a;
   73|  10.1M|}
secp256k1.c:secp256k1_i128_rshift:
   66|  11.3M|static SECP256K1_INLINE void secp256k1_i128_rshift(secp256k1_int128 *r, unsigned int n) {
   67|  11.3M|   VERIFY_CHECK(n < 128);
   68|  11.3M|   *r >>= n;
   69|  11.3M|}
secp256k1.c:secp256k1_i128_to_i64:
   75|  2.41M|static SECP256K1_INLINE int64_t secp256k1_i128_to_i64(const secp256k1_int128 *a) {
   76|  2.41M|   VERIFY_CHECK(INT64_MIN <= *a && *a <= INT64_MAX);
   77|  2.41M|   return *a;
   78|  2.41M|}

secp256k1.c:secp256k1_modinv64_var:
  637|  18.1k|static void secp256k1_modinv64_var(secp256k1_modinv64_signed62 *x, const secp256k1_modinv64_modinfo *modinfo) {
  638|       |    /* Start with d=0, e=1, f=modulus, g=x, eta=-1. */
  639|  18.1k|    secp256k1_modinv64_signed62 d = {{0, 0, 0, 0, 0}};
  640|  18.1k|    secp256k1_modinv64_signed62 e = {{1, 0, 0, 0, 0}};
  641|  18.1k|    secp256k1_modinv64_signed62 f = modinfo->modulus;
  642|  18.1k|    secp256k1_modinv64_signed62 g = *x;
  643|       |#ifdef VERIFY
  644|       |    int i = 0;
  645|       |#endif
  646|  18.1k|    int j, len = 5;
  647|  18.1k|    int64_t eta = -1; /* eta = -delta; delta is initially 1 */
  648|  18.1k|    int64_t cond, fn, gn;
  649|       |
  650|       |    /* Do iterations of 62 divsteps each until g=0. */
  651|   163k|    while (1) {
  ------------------
  |  Branch (651:12): [True: 163k, Folded]
  ------------------
  652|       |        /* Compute transition matrix and new eta after 62 divsteps. */
  653|   163k|        secp256k1_modinv64_trans2x2 t;
  654|   163k|        eta = secp256k1_modinv64_divsteps_62_var(eta, f.v[0], g.v[0], &t);
  655|       |        /* Update d,e using that transition matrix. */
  656|   163k|        secp256k1_modinv64_update_de_62(&d, &e, &t, modinfo);
  657|       |        /* Update f,g using that transition matrix. */
  658|   163k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, -1) > 0); /* f > -modulus */
  659|   163k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, 1) <= 0); /* f <= modulus */
  660|   163k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, -1) > 0); /* g > -modulus */
  661|   163k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, 1) < 0);  /* g <  modulus */
  662|       |
  663|   163k|        secp256k1_modinv64_update_fg_62_var(len, &f, &g, &t);
  664|       |        /* If the bottom limb of g is zero, there is a chance that g=0. */
  665|   163k|        if (g.v[0] == 0) {
  ------------------
  |  Branch (665:13): [True: 18.1k, False: 144k]
  ------------------
  666|  18.1k|            cond = 0;
  667|       |            /* Check if the other limbs are also 0. */
  668|  18.1k|            for (j = 1; j < len; ++j) {
  ------------------
  |  Branch (668:25): [True: 0, False: 18.1k]
  ------------------
  669|      0|                cond |= g.v[j];
  670|      0|            }
  671|       |            /* If so, we're done. */
  672|  18.1k|            if (cond == 0) break;
  ------------------
  |  Branch (672:17): [True: 18.1k, False: 0]
  ------------------
  673|  18.1k|        }
  674|       |
  675|       |        /* Determine if len>1 and limb (len-1) of both f and g is 0 or -1. */
  676|   144k|        fn = f.v[len - 1];
  677|   144k|        gn = g.v[len - 1];
  678|   144k|        cond = ((int64_t)len - 2) >> 63;
  679|   144k|        cond |= fn ^ (fn >> 63);
  680|   144k|        cond |= gn ^ (gn >> 63);
  681|       |        /* If so, reduce length, propagating the sign of f and g's top limb into the one below. */
  682|   144k|        if (cond == 0) {
  ------------------
  |  Branch (682:13): [True: 72.4k, False: 72.4k]
  ------------------
  683|  72.4k|            f.v[len - 2] |= (uint64_t)fn << 62;
  684|  72.4k|            g.v[len - 2] |= (uint64_t)gn << 62;
  685|  72.4k|            --len;
  686|  72.4k|        }
  687|       |
  688|   144k|        VERIFY_CHECK(++i < 12); /* We should never need more than 12*62 = 744 divsteps */
  689|   144k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, -1) > 0); /* f > -modulus */
  690|   144k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, 1) <= 0); /* f <= modulus */
  691|   144k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, -1) > 0); /* g > -modulus */
  692|   144k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, 1) < 0);  /* g <  modulus */
  693|   144k|    }
  694|       |
  695|       |    /* At this point g is 0 and (if g was not originally 0) f must now equal +/- GCD of
  696|       |     * the initial f, g values i.e. +/- 1, and d now contains +/- the modular inverse. */
  697|       |
  698|       |    /* g == 0 */
  699|  18.1k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, len, &SECP256K1_SIGNED62_ONE, 0) == 0);
  700|       |    /* |f| == 1, or (x == 0 and d == 0 and f == modulus) */
  701|  18.1k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, len, &SECP256K1_SIGNED62_ONE, -1) == 0 ||
  702|  18.1k|                 secp256k1_modinv64_mul_cmp_62(&f, len, &SECP256K1_SIGNED62_ONE, 1) == 0 ||
  703|  18.1k|                 (secp256k1_modinv64_mul_cmp_62(x, 5, &SECP256K1_SIGNED62_ONE, 0) == 0 &&
  704|  18.1k|                  secp256k1_modinv64_mul_cmp_62(&d, 5, &SECP256K1_SIGNED62_ONE, 0) == 0 &&
  705|  18.1k|                  secp256k1_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, 1) == 0));
  706|       |
  707|       |    /* Optionally negate d, normalize to [0,modulus), and return it. */
  708|  18.1k|    secp256k1_modinv64_normalize_62(&d, f.v[len - 1], modinfo);
  709|  18.1k|    *x = d;
  710|  18.1k|}
secp256k1.c:secp256k1_modinv64_divsteps_62_var:
  239|   163k|static int64_t secp256k1_modinv64_divsteps_62_var(int64_t eta, uint64_t f0, uint64_t g0, secp256k1_modinv64_trans2x2 *t) {
  240|       |    /* Transformation matrix; see comments in secp256k1_modinv64_divsteps_62. */
  241|   163k|    uint64_t u = 1, v = 0, q = 0, r = 1;
  242|   163k|    uint64_t f = f0, g = g0, m;
  243|   163k|    uint32_t w;
  244|   163k|    int i = 62, limit, zeros;
  245|       |
  246|  2.66M|    for (;;) {
  247|       |        /* Use a sentinel bit to count zeros only up to i. */
  248|  2.66M|        zeros = secp256k1_ctz64_var(g | (UINT64_MAX << i));
  249|       |        /* Perform zeros divsteps at once; they all just divide g by two. */
  250|  2.66M|        g >>= zeros;
  251|  2.66M|        u <<= zeros;
  252|  2.66M|        v <<= zeros;
  253|  2.66M|        eta -= zeros;
  254|  2.66M|        i -= zeros;
  255|       |        /* We're done once we've done 62 divsteps. */
  256|  2.66M|        if (i == 0) break;
  ------------------
  |  Branch (256:13): [True: 163k, False: 2.50M]
  ------------------
  257|  2.50M|        VERIFY_CHECK((f & 1) == 1);
  258|  2.50M|        VERIFY_CHECK((g & 1) == 1);
  259|  2.50M|        VERIFY_CHECK((u * f0 + v * g0) == f << (62 - i));
  260|  2.50M|        VERIFY_CHECK((q * f0 + r * g0) == g << (62 - i));
  261|       |        /* Bounds on eta that follow from the bounds on iteration count (max 12*62 divsteps). */
  262|  2.50M|        VERIFY_CHECK(eta >= -745 && eta <= 745);
  263|       |        /* If eta is negative, negate it and replace f,g with g,-f. */
  264|  2.50M|        if (eta < 0) {
  ------------------
  |  Branch (264:13): [True: 2.41M, False: 87.1k]
  ------------------
  265|  2.41M|            uint64_t tmp;
  266|  2.41M|            eta = -eta;
  267|  2.41M|            tmp = f; f = g; g = -tmp;
  268|  2.41M|            tmp = u; u = q; q = -tmp;
  269|  2.41M|            tmp = v; v = r; r = -tmp;
  270|       |            /* Use a formula to cancel out up to 6 bits of g. Also, no more than i can be cancelled
  271|       |             * out (as we'd be done before that point), and no more than eta+1 can be done as its
  272|       |             * sign will flip again once that happens. */
  273|  2.41M|            limit = ((int)eta + 1) > i ? i : ((int)eta + 1);
  ------------------
  |  Branch (273:21): [True: 48.3k, False: 2.36M]
  ------------------
  274|  2.41M|            VERIFY_CHECK(limit > 0 && limit <= 62);
  275|       |            /* m is a mask for the bottom min(limit, 6) bits. */
  276|  2.41M|            m = (UINT64_MAX >> (64 - limit)) & 63U;
  277|       |            /* Find what multiple of f must be added to g to cancel its bottom min(limit, 6)
  278|       |             * bits. */
  279|  2.41M|            w = (f * g * (f * f - 2)) & m;
  280|  2.41M|        } else {
  281|       |            /* In this branch, use a simpler formula that only lets us cancel up to 4 bits of g, as
  282|       |             * eta tends to be smaller here. */
  283|  87.1k|            limit = ((int)eta + 1) > i ? i : ((int)eta + 1);
  ------------------
  |  Branch (283:21): [True: 554, False: 86.5k]
  ------------------
  284|  87.1k|            VERIFY_CHECK(limit > 0 && limit <= 62);
  285|       |            /* m is a mask for the bottom min(limit, 4) bits. */
  286|  87.1k|            m = (UINT64_MAX >> (64 - limit)) & 15U;
  287|       |            /* Find what multiple of f must be added to g to cancel its bottom min(limit, 4)
  288|       |             * bits. */
  289|  87.1k|            w = f + (((f + 1) & 4) << 1);
  290|  87.1k|            w = (-w * g) & m;
  291|  87.1k|        }
  292|  2.50M|        g += f * w;
  293|  2.50M|        q += u * w;
  294|  2.50M|        r += v * w;
  295|  2.50M|        VERIFY_CHECK((g & m) == 0);
  296|  2.50M|    }
  297|       |    /* Return data in t and return value. */
  298|   163k|    t->u = (int64_t)u;
  299|   163k|    t->v = (int64_t)v;
  300|   163k|    t->q = (int64_t)q;
  301|   163k|    t->r = (int64_t)r;
  302|       |
  303|       |    /* The determinant of t must be a power of two. This guarantees that multiplication with t
  304|       |     * does not change the gcd of f and g, apart from adding a power-of-2 factor to it (which
  305|       |     * will be divided out again). As each divstep's individual matrix has determinant 2, the
  306|       |     * aggregate of 62 of them will have determinant 2^62. */
  307|   163k|    VERIFY_CHECK(secp256k1_modinv64_det_check_pow2(t, 62, 0));
  308|       |
  309|   163k|    return eta;
  310|   163k|}
secp256k1.c:secp256k1_modinv64_update_de_62:
  411|   603k|static void secp256k1_modinv64_update_de_62(secp256k1_modinv64_signed62 *d, secp256k1_modinv64_signed62 *e, const secp256k1_modinv64_trans2x2 *t, const secp256k1_modinv64_modinfo* modinfo) {
  412|   603k|    const uint64_t M62 = UINT64_MAX >> 2;
  413|   603k|    const int64_t d0 = d->v[0], d1 = d->v[1], d2 = d->v[2], d3 = d->v[3], d4 = d->v[4];
  414|   603k|    const int64_t e0 = e->v[0], e1 = e->v[1], e2 = e->v[2], e3 = e->v[3], e4 = e->v[4];
  415|   603k|    const int64_t u = t->u, v = t->v, q = t->q, r = t->r;
  416|   603k|    int64_t md, me, sd, se;
  417|   603k|    secp256k1_int128 cd, ce;
  418|   603k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(d, 5, &modinfo->modulus, -2) > 0); /* d > -2*modulus */
  419|   603k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(d, 5, &modinfo->modulus, 1) < 0);  /* d <    modulus */
  420|   603k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(e, 5, &modinfo->modulus, -2) > 0); /* e > -2*modulus */
  421|   603k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(e, 5, &modinfo->modulus, 1) < 0);  /* e <    modulus */
  422|   603k|    VERIFY_CHECK(secp256k1_modinv64_abs(u) <= (((int64_t)1 << 62) - secp256k1_modinv64_abs(v))); /* |u|+|v| <= 2^62 */
  423|   603k|    VERIFY_CHECK(secp256k1_modinv64_abs(q) <= (((int64_t)1 << 62) - secp256k1_modinv64_abs(r))); /* |q|+|r| <= 2^62 */
  424|       |
  425|       |    /* [md,me] start as zero; plus [u,q] if d is negative; plus [v,r] if e is negative. */
  426|   603k|    sd = d4 >> 63;
  427|   603k|    se = e4 >> 63;
  428|   603k|    md = (u & sd) + (v & se);
  429|   603k|    me = (q & sd) + (r & se);
  430|       |    /* Begin computing t*[d,e]. */
  431|   603k|    secp256k1_i128_mul(&cd, u, d0);
  432|   603k|    secp256k1_i128_accum_mul(&cd, v, e0);
  433|   603k|    secp256k1_i128_mul(&ce, q, d0);
  434|   603k|    secp256k1_i128_accum_mul(&ce, r, e0);
  435|       |    /* Correct md,me so that t*[d,e]+modulus*[md,me] has 62 zero bottom bits. */
  436|   603k|    md -= (modinfo->modulus_inv62 * secp256k1_i128_to_u64(&cd) + md) & M62;
  437|   603k|    me -= (modinfo->modulus_inv62 * secp256k1_i128_to_u64(&ce) + me) & M62;
  438|       |    /* Update the beginning of computation for t*[d,e]+modulus*[md,me] now md,me are known. */
  439|   603k|    secp256k1_i128_accum_mul(&cd, modinfo->modulus.v[0], md);
  440|   603k|    secp256k1_i128_accum_mul(&ce, modinfo->modulus.v[0], me);
  441|       |    /* Verify that the low 62 bits of the computation are indeed zero, and then throw them away. */
  442|   603k|    VERIFY_CHECK((secp256k1_i128_to_u64(&cd) & M62) == 0); secp256k1_i128_rshift(&cd, 62);
  443|   603k|    VERIFY_CHECK((secp256k1_i128_to_u64(&ce) & M62) == 0); secp256k1_i128_rshift(&ce, 62);
  444|       |    /* Compute limb 1 of t*[d,e]+modulus*[md,me], and store it as output limb 0 (= down shift). */
  445|   603k|    secp256k1_i128_accum_mul(&cd, u, d1);
  446|   603k|    secp256k1_i128_accum_mul(&cd, v, e1);
  447|   603k|    secp256k1_i128_accum_mul(&ce, q, d1);
  448|   603k|    secp256k1_i128_accum_mul(&ce, r, e1);
  449|   603k|    if (modinfo->modulus.v[1]) { /* Optimize for the case where limb of modulus is zero. */
  ------------------
  |  Branch (449:9): [True: 260k, False: 343k]
  ------------------
  450|   260k|        secp256k1_i128_accum_mul(&cd, modinfo->modulus.v[1], md);
  451|   260k|        secp256k1_i128_accum_mul(&ce, modinfo->modulus.v[1], me);
  452|   260k|    }
  453|   603k|    d->v[0] = secp256k1_i128_to_u64(&cd) & M62; secp256k1_i128_rshift(&cd, 62);
  454|   603k|    e->v[0] = secp256k1_i128_to_u64(&ce) & M62; secp256k1_i128_rshift(&ce, 62);
  455|       |    /* Compute limb 2 of t*[d,e]+modulus*[md,me], and store it as output limb 1. */
  456|   603k|    secp256k1_i128_accum_mul(&cd, u, d2);
  457|   603k|    secp256k1_i128_accum_mul(&cd, v, e2);
  458|   603k|    secp256k1_i128_accum_mul(&ce, q, d2);
  459|   603k|    secp256k1_i128_accum_mul(&ce, r, e2);
  460|   603k|    if (modinfo->modulus.v[2]) { /* Optimize for the case where limb of modulus is zero. */
  ------------------
  |  Branch (460:9): [True: 260k, False: 343k]
  ------------------
  461|   260k|        secp256k1_i128_accum_mul(&cd, modinfo->modulus.v[2], md);
  462|   260k|        secp256k1_i128_accum_mul(&ce, modinfo->modulus.v[2], me);
  463|   260k|    }
  464|   603k|    d->v[1] = secp256k1_i128_to_u64(&cd) & M62; secp256k1_i128_rshift(&cd, 62);
  465|   603k|    e->v[1] = secp256k1_i128_to_u64(&ce) & M62; secp256k1_i128_rshift(&ce, 62);
  466|       |    /* Compute limb 3 of t*[d,e]+modulus*[md,me], and store it as output limb 2. */
  467|   603k|    secp256k1_i128_accum_mul(&cd, u, d3);
  468|   603k|    secp256k1_i128_accum_mul(&cd, v, e3);
  469|   603k|    secp256k1_i128_accum_mul(&ce, q, d3);
  470|   603k|    secp256k1_i128_accum_mul(&ce, r, e3);
  471|   603k|    if (modinfo->modulus.v[3]) { /* Optimize for the case where limb of modulus is zero. */
  ------------------
  |  Branch (471:9): [True: 0, False: 603k]
  ------------------
  472|      0|        secp256k1_i128_accum_mul(&cd, modinfo->modulus.v[3], md);
  473|      0|        secp256k1_i128_accum_mul(&ce, modinfo->modulus.v[3], me);
  474|      0|    }
  475|   603k|    d->v[2] = secp256k1_i128_to_u64(&cd) & M62; secp256k1_i128_rshift(&cd, 62);
  476|   603k|    e->v[2] = secp256k1_i128_to_u64(&ce) & M62; secp256k1_i128_rshift(&ce, 62);
  477|       |    /* Compute limb 4 of t*[d,e]+modulus*[md,me], and store it as output limb 3. */
  478|   603k|    secp256k1_i128_accum_mul(&cd, u, d4);
  479|   603k|    secp256k1_i128_accum_mul(&cd, v, e4);
  480|   603k|    secp256k1_i128_accum_mul(&ce, q, d4);
  481|   603k|    secp256k1_i128_accum_mul(&ce, r, e4);
  482|   603k|    secp256k1_i128_accum_mul(&cd, modinfo->modulus.v[4], md);
  483|   603k|    secp256k1_i128_accum_mul(&ce, modinfo->modulus.v[4], me);
  484|   603k|    d->v[3] = secp256k1_i128_to_u64(&cd) & M62; secp256k1_i128_rshift(&cd, 62);
  485|   603k|    e->v[3] = secp256k1_i128_to_u64(&ce) & M62; secp256k1_i128_rshift(&ce, 62);
  486|       |    /* What remains is limb 5 of t*[d,e]+modulus*[md,me]; store it as output limb 4. */
  487|   603k|    d->v[4] = secp256k1_i128_to_i64(&cd);
  488|   603k|    e->v[4] = secp256k1_i128_to_i64(&ce);
  489|       |
  490|   603k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(d, 5, &modinfo->modulus, -2) > 0); /* d > -2*modulus */
  491|   603k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(d, 5, &modinfo->modulus, 1) < 0);  /* d <    modulus */
  492|   603k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(e, 5, &modinfo->modulus, -2) > 0); /* e > -2*modulus */
  493|   603k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(e, 5, &modinfo->modulus, 1) < 0);  /* e <    modulus */
  494|   603k|}
secp256k1.c:secp256k1_modinv64_update_fg_62_var:
  553|   163k|static void secp256k1_modinv64_update_fg_62_var(int len, secp256k1_modinv64_signed62 *f, secp256k1_modinv64_signed62 *g, const secp256k1_modinv64_trans2x2 *t) {
  554|   163k|    const uint64_t M62 = UINT64_MAX >> 2;
  555|   163k|    const int64_t u = t->u, v = t->v, q = t->q, r = t->r;
  556|   163k|    int64_t fi, gi;
  557|   163k|    secp256k1_int128 cf, cg;
  558|   163k|    int i;
  559|   163k|    VERIFY_CHECK(len > 0);
  560|       |    /* Start computing t*[f,g]. */
  561|   163k|    fi = f->v[0];
  562|   163k|    gi = g->v[0];
  563|   163k|    secp256k1_i128_mul(&cf, u, fi);
  564|   163k|    secp256k1_i128_accum_mul(&cf, v, gi);
  565|   163k|    secp256k1_i128_mul(&cg, q, fi);
  566|   163k|    secp256k1_i128_accum_mul(&cg, r, gi);
  567|       |    /* Verify that the bottom 62 bits of the result are zero, and then throw them away. */
  568|   163k|    VERIFY_CHECK((secp256k1_i128_to_u64(&cf) & M62) == 0); secp256k1_i128_rshift(&cf, 62);
  569|   163k|    VERIFY_CHECK((secp256k1_i128_to_u64(&cg) & M62) == 0); secp256k1_i128_rshift(&cg, 62);
  570|       |    /* Now iteratively compute limb i=1..len of t*[f,g], and store them in output limb i-1 (shifting
  571|       |     * down by 62 bits). */
  572|   452k|    for (i = 1; i < len; ++i) {
  ------------------
  |  Branch (572:17): [True: 289k, False: 163k]
  ------------------
  573|   289k|        fi = f->v[i];
  574|   289k|        gi = g->v[i];
  575|   289k|        secp256k1_i128_accum_mul(&cf, u, fi);
  576|   289k|        secp256k1_i128_accum_mul(&cf, v, gi);
  577|   289k|        secp256k1_i128_accum_mul(&cg, q, fi);
  578|   289k|        secp256k1_i128_accum_mul(&cg, r, gi);
  579|   289k|        f->v[i - 1] = secp256k1_i128_to_u64(&cf) & M62; secp256k1_i128_rshift(&cf, 62);
  580|   289k|        g->v[i - 1] = secp256k1_i128_to_u64(&cg) & M62; secp256k1_i128_rshift(&cg, 62);
  581|   289k|    }
  582|       |    /* What remains is limb (len) of t*[f,g]; store it as output limb (len-1). */
  583|   163k|    f->v[len - 1] = secp256k1_i128_to_i64(&cf);
  584|   163k|    g->v[len - 1] = secp256k1_i128_to_i64(&cg);
  585|   163k|}
secp256k1.c:secp256k1_modinv64_normalize_62:
   88|  62.1k|static void secp256k1_modinv64_normalize_62(secp256k1_modinv64_signed62 *r, int64_t sign, const secp256k1_modinv64_modinfo *modinfo) {
   89|  62.1k|    const int64_t M62 = (int64_t)(UINT64_MAX >> 2);
   90|  62.1k|    int64_t r0 = r->v[0], r1 = r->v[1], r2 = r->v[2], r3 = r->v[3], r4 = r->v[4];
   91|  62.1k|    volatile int64_t cond_add, cond_negate;
   92|       |
   93|       |#ifdef VERIFY
   94|       |    /* Verify that all limbs are in range (-2^62,2^62). */
   95|       |    int i;
   96|       |    for (i = 0; i < 5; ++i) {
   97|       |        VERIFY_CHECK(r->v[i] >= -M62);
   98|       |        VERIFY_CHECK(r->v[i] <= M62);
   99|       |    }
  100|       |    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(r, 5, &modinfo->modulus, -2) > 0); /* r > -2*modulus */
  101|       |    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(r, 5, &modinfo->modulus, 1) < 0); /* r < modulus */
  102|       |#endif
  103|       |
  104|       |    /* In a first step, add the modulus if the input is negative, and then negate if requested.
  105|       |     * This brings r from range (-2*modulus,modulus) to range (-modulus,modulus). As all input
  106|       |     * limbs are in range (-2^62,2^62), this cannot overflow an int64_t. Note that the right
  107|       |     * shifts below are signed sign-extending shifts (see assumptions.h for tests that that is
  108|       |     * indeed the behavior of the right shift operator). */
  109|  62.1k|    cond_add = r4 >> 63;
  110|  62.1k|    r0 += modinfo->modulus.v[0] & cond_add;
  111|  62.1k|    r1 += modinfo->modulus.v[1] & cond_add;
  112|  62.1k|    r2 += modinfo->modulus.v[2] & cond_add;
  113|  62.1k|    r3 += modinfo->modulus.v[3] & cond_add;
  114|  62.1k|    r4 += modinfo->modulus.v[4] & cond_add;
  115|  62.1k|    cond_negate = sign >> 63;
  116|  62.1k|    r0 = (r0 ^ cond_negate) - cond_negate;
  117|  62.1k|    r1 = (r1 ^ cond_negate) - cond_negate;
  118|  62.1k|    r2 = (r2 ^ cond_negate) - cond_negate;
  119|  62.1k|    r3 = (r3 ^ cond_negate) - cond_negate;
  120|  62.1k|    r4 = (r4 ^ cond_negate) - cond_negate;
  121|       |    /* Propagate the top bits, to bring limbs back to range (-2^62,2^62). */
  122|  62.1k|    r1 += r0 >> 62; r0 &= M62;
  123|  62.1k|    r2 += r1 >> 62; r1 &= M62;
  124|  62.1k|    r3 += r2 >> 62; r2 &= M62;
  125|  62.1k|    r4 += r3 >> 62; r3 &= M62;
  126|       |
  127|       |    /* In a second step add the modulus again if the result is still negative, bringing
  128|       |     * r to range [0,modulus). */
  129|  62.1k|    cond_add = r4 >> 63;
  130|  62.1k|    r0 += modinfo->modulus.v[0] & cond_add;
  131|  62.1k|    r1 += modinfo->modulus.v[1] & cond_add;
  132|  62.1k|    r2 += modinfo->modulus.v[2] & cond_add;
  133|  62.1k|    r3 += modinfo->modulus.v[3] & cond_add;
  134|  62.1k|    r4 += modinfo->modulus.v[4] & cond_add;
  135|       |    /* And propagate again. */
  136|  62.1k|    r1 += r0 >> 62; r0 &= M62;
  137|  62.1k|    r2 += r1 >> 62; r1 &= M62;
  138|  62.1k|    r3 += r2 >> 62; r2 &= M62;
  139|  62.1k|    r4 += r3 >> 62; r3 &= M62;
  140|       |
  141|  62.1k|    r->v[0] = r0;
  142|  62.1k|    r->v[1] = r1;
  143|  62.1k|    r->v[2] = r2;
  144|  62.1k|    r->v[3] = r3;
  145|  62.1k|    r->v[4] = r4;
  146|       |
  147|  62.1k|    VERIFY_CHECK(r0 >> 62 == 0);
  148|  62.1k|    VERIFY_CHECK(r1 >> 62 == 0);
  149|  62.1k|    VERIFY_CHECK(r2 >> 62 == 0);
  150|  62.1k|    VERIFY_CHECK(r3 >> 62 == 0);
  151|  62.1k|    VERIFY_CHECK(r4 >> 62 == 0);
  152|  62.1k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(r, 5, &modinfo->modulus, 0) >= 0); /* r >= 0 */
  153|  62.1k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(r, 5, &modinfo->modulus, 1) < 0); /* r < modulus */
  154|  62.1k|}
secp256k1.c:secp256k1_modinv64:
  588|  44.0k|static void secp256k1_modinv64(secp256k1_modinv64_signed62 *x, const secp256k1_modinv64_modinfo *modinfo) {
  589|       |    /* Start with d=0, e=1, f=modulus, g=x, zeta=-1. */
  590|  44.0k|    secp256k1_modinv64_signed62 d = {{0, 0, 0, 0, 0}};
  591|  44.0k|    secp256k1_modinv64_signed62 e = {{1, 0, 0, 0, 0}};
  592|  44.0k|    secp256k1_modinv64_signed62 f = modinfo->modulus;
  593|  44.0k|    secp256k1_modinv64_signed62 g = *x;
  594|  44.0k|    int i;
  595|  44.0k|    int64_t zeta = -1; /* zeta = -(delta+1/2); delta starts at 1/2. */
  596|       |
  597|       |    /* Do 10 iterations of 59 divsteps each = 590 divsteps. This suffices for 256-bit inputs. */
  598|   484k|    for (i = 0; i < 10; ++i) {
  ------------------
  |  Branch (598:17): [True: 440k, False: 44.0k]
  ------------------
  599|       |        /* Compute transition matrix and new zeta after 59 divsteps. */
  600|   440k|        secp256k1_modinv64_trans2x2 t;
  601|   440k|        zeta = secp256k1_modinv64_divsteps_59(zeta, f.v[0], g.v[0], &t);
  602|       |        /* Update d,e using that transition matrix. */
  603|   440k|        secp256k1_modinv64_update_de_62(&d, &e, &t, modinfo);
  604|       |        /* Update f,g using that transition matrix. */
  605|   440k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, -1) > 0); /* f > -modulus */
  606|   440k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, 1) <= 0); /* f <= modulus */
  607|   440k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, 5, &modinfo->modulus, -1) > 0); /* g > -modulus */
  608|   440k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, 5, &modinfo->modulus, 1) < 0);  /* g <  modulus */
  609|       |
  610|   440k|        secp256k1_modinv64_update_fg_62(&f, &g, &t);
  611|       |
  612|   440k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, -1) > 0); /* f > -modulus */
  613|   440k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, 1) <= 0); /* f <= modulus */
  614|   440k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, 5, &modinfo->modulus, -1) > 0); /* g > -modulus */
  615|   440k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, 5, &modinfo->modulus, 1) < 0);  /* g <  modulus */
  616|   440k|    }
  617|       |
  618|       |    /* At this point sufficient iterations have been performed that g must have reached 0
  619|       |     * and (if g was not originally 0) f must now equal +/- GCD of the initial f, g
  620|       |     * values i.e. +/- 1, and d now contains +/- the modular inverse. */
  621|       |
  622|       |    /* g == 0 */
  623|  44.0k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, 5, &SECP256K1_SIGNED62_ONE, 0) == 0);
  624|       |    /* |f| == 1, or (x == 0 and d == 0 and f == modulus) */
  625|  44.0k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, 5, &SECP256K1_SIGNED62_ONE, -1) == 0 ||
  626|  44.0k|                 secp256k1_modinv64_mul_cmp_62(&f, 5, &SECP256K1_SIGNED62_ONE, 1) == 0 ||
  627|  44.0k|                 (secp256k1_modinv64_mul_cmp_62(x, 5, &SECP256K1_SIGNED62_ONE, 0) == 0 &&
  628|  44.0k|                  secp256k1_modinv64_mul_cmp_62(&d, 5, &SECP256K1_SIGNED62_ONE, 0) == 0 &&
  629|  44.0k|                  secp256k1_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, 1) == 0));
  630|       |
  631|       |    /* Optionally negate d, normalize to [0,modulus), and return it. */
  632|  44.0k|    secp256k1_modinv64_normalize_62(&d, f.v[4], modinfo);
  633|  44.0k|    *x = d;
  634|  44.0k|}
secp256k1.c:secp256k1_modinv64_divsteps_59:
  167|   440k|static int64_t secp256k1_modinv64_divsteps_59(int64_t zeta, uint64_t f0, uint64_t g0, secp256k1_modinv64_trans2x2 *t) {
  168|       |    /* u,v,q,r are the elements of the transformation matrix being built up,
  169|       |     * starting with the identity matrix times 8 (because the caller expects
  170|       |     * a result scaled by 2^62). Semantically they are signed integers
  171|       |     * in range [-2^62,2^62], but here represented as unsigned mod 2^64. This
  172|       |     * permits left shifting (which is UB for negative numbers). The range
  173|       |     * being inside [-2^63,2^63) means that casting to signed works correctly.
  174|       |     */
  175|   440k|    uint64_t u = 8, v = 0, q = 0, r = 8;
  176|   440k|    volatile uint64_t c1, c2;
  177|   440k|    uint64_t mask1, mask2, f = f0, g = g0, x, y, z;
  178|   440k|    int i;
  179|       |
  180|  26.4M|    for (i = 3; i < 62; ++i) {
  ------------------
  |  Branch (180:17): [True: 26.0M, False: 440k]
  ------------------
  181|  26.0M|        VERIFY_CHECK((f & 1) == 1); /* f must always be odd */
  182|  26.0M|        VERIFY_CHECK((u * f0 + v * g0) == f << i);
  183|  26.0M|        VERIFY_CHECK((q * f0 + r * g0) == g << i);
  184|       |        /* Compute conditional masks for (zeta < 0) and for (g & 1). */
  185|  26.0M|        c1 = zeta >> 63;
  186|  26.0M|        mask1 = c1;
  187|  26.0M|        c2 = g & 1;
  188|  26.0M|        mask2 = -c2;
  189|       |        /* Compute x,y,z, conditionally negated versions of f,u,v. */
  190|  26.0M|        x = (f ^ mask1) - mask1;
  191|  26.0M|        y = (u ^ mask1) - mask1;
  192|  26.0M|        z = (v ^ mask1) - mask1;
  193|       |        /* Conditionally add x,y,z to g,q,r. */
  194|  26.0M|        g += x & mask2;
  195|  26.0M|        q += y & mask2;
  196|  26.0M|        r += z & mask2;
  197|       |        /* In what follows, c1 is a condition mask for (zeta < 0) and (g & 1). */
  198|  26.0M|        mask1 &= mask2;
  199|       |        /* Conditionally change zeta into -zeta-2 or zeta-1. */
  200|  26.0M|        zeta = (zeta ^ mask1) - 1;
  201|       |        /* Conditionally add g,q,r to f,u,v. */
  202|  26.0M|        f += g & mask1;
  203|  26.0M|        u += q & mask1;
  204|  26.0M|        v += r & mask1;
  205|       |        /* Shifts */
  206|  26.0M|        g >>= 1;
  207|  26.0M|        u <<= 1;
  208|  26.0M|        v <<= 1;
  209|       |        /* Bounds on zeta that follow from the bounds on iteration count (max 10*59 divsteps). */
  210|  26.0M|        VERIFY_CHECK(zeta >= -591 && zeta <= 591);
  211|  26.0M|    }
  212|       |    /* Return data in t and return value. */
  213|   440k|    t->u = (int64_t)u;
  214|   440k|    t->v = (int64_t)v;
  215|   440k|    t->q = (int64_t)q;
  216|   440k|    t->r = (int64_t)r;
  217|       |
  218|       |    /* The determinant of t must be a power of two. This guarantees that multiplication with t
  219|       |     * does not change the gcd of f and g, apart from adding a power-of-2 factor to it (which
  220|       |     * will be divided out again). As each divstep's individual matrix has determinant 2, the
  221|       |     * aggregate of 59 of them will have determinant 2^59. Multiplying with the initial
  222|       |     * 8*identity (which has determinant 2^6) means the overall outputs has determinant
  223|       |     * 2^65. */
  224|   440k|    VERIFY_CHECK(secp256k1_modinv64_det_check_pow2(t, 65, 0));
  225|       |
  226|   440k|    return zeta;
  227|   440k|}
secp256k1.c:secp256k1_modinv64_update_fg_62:
  500|   440k|static void secp256k1_modinv64_update_fg_62(secp256k1_modinv64_signed62 *f, secp256k1_modinv64_signed62 *g, const secp256k1_modinv64_trans2x2 *t) {
  501|   440k|    const uint64_t M62 = UINT64_MAX >> 2;
  502|   440k|    const int64_t f0 = f->v[0], f1 = f->v[1], f2 = f->v[2], f3 = f->v[3], f4 = f->v[4];
  503|   440k|    const int64_t g0 = g->v[0], g1 = g->v[1], g2 = g->v[2], g3 = g->v[3], g4 = g->v[4];
  504|   440k|    const int64_t u = t->u, v = t->v, q = t->q, r = t->r;
  505|   440k|    secp256k1_int128 cf, cg;
  506|       |    /* Start computing t*[f,g]. */
  507|   440k|    secp256k1_i128_mul(&cf, u, f0);
  508|   440k|    secp256k1_i128_accum_mul(&cf, v, g0);
  509|   440k|    secp256k1_i128_mul(&cg, q, f0);
  510|   440k|    secp256k1_i128_accum_mul(&cg, r, g0);
  511|       |    /* Verify that the bottom 62 bits of the result are zero, and then throw them away. */
  512|   440k|    VERIFY_CHECK((secp256k1_i128_to_u64(&cf) & M62) == 0); secp256k1_i128_rshift(&cf, 62);
  513|   440k|    VERIFY_CHECK((secp256k1_i128_to_u64(&cg) & M62) == 0); secp256k1_i128_rshift(&cg, 62);
  514|       |    /* Compute limb 1 of t*[f,g], and store it as output limb 0 (= down shift). */
  515|   440k|    secp256k1_i128_accum_mul(&cf, u, f1);
  516|   440k|    secp256k1_i128_accum_mul(&cf, v, g1);
  517|   440k|    secp256k1_i128_accum_mul(&cg, q, f1);
  518|   440k|    secp256k1_i128_accum_mul(&cg, r, g1);
  519|   440k|    f->v[0] = secp256k1_i128_to_u64(&cf) & M62; secp256k1_i128_rshift(&cf, 62);
  520|   440k|    g->v[0] = secp256k1_i128_to_u64(&cg) & M62; secp256k1_i128_rshift(&cg, 62);
  521|       |    /* Compute limb 2 of t*[f,g], and store it as output limb 1. */
  522|   440k|    secp256k1_i128_accum_mul(&cf, u, f2);
  523|   440k|    secp256k1_i128_accum_mul(&cf, v, g2);
  524|   440k|    secp256k1_i128_accum_mul(&cg, q, f2);
  525|   440k|    secp256k1_i128_accum_mul(&cg, r, g2);
  526|   440k|    f->v[1] = secp256k1_i128_to_u64(&cf) & M62; secp256k1_i128_rshift(&cf, 62);
  527|   440k|    g->v[1] = secp256k1_i128_to_u64(&cg) & M62; secp256k1_i128_rshift(&cg, 62);
  528|       |    /* Compute limb 3 of t*[f,g], and store it as output limb 2. */
  529|   440k|    secp256k1_i128_accum_mul(&cf, u, f3);
  530|   440k|    secp256k1_i128_accum_mul(&cf, v, g3);
  531|   440k|    secp256k1_i128_accum_mul(&cg, q, f3);
  532|   440k|    secp256k1_i128_accum_mul(&cg, r, g3);
  533|   440k|    f->v[2] = secp256k1_i128_to_u64(&cf) & M62; secp256k1_i128_rshift(&cf, 62);
  534|   440k|    g->v[2] = secp256k1_i128_to_u64(&cg) & M62; secp256k1_i128_rshift(&cg, 62);
  535|       |    /* Compute limb 4 of t*[f,g], and store it as output limb 3. */
  536|   440k|    secp256k1_i128_accum_mul(&cf, u, f4);
  537|   440k|    secp256k1_i128_accum_mul(&cf, v, g4);
  538|   440k|    secp256k1_i128_accum_mul(&cg, q, f4);
  539|   440k|    secp256k1_i128_accum_mul(&cg, r, g4);
  540|   440k|    f->v[3] = secp256k1_i128_to_u64(&cf) & M62; secp256k1_i128_rshift(&cf, 62);
  541|   440k|    g->v[3] = secp256k1_i128_to_u64(&cg) & M62; secp256k1_i128_rshift(&cg, 62);
  542|       |    /* What remains is limb 5 of t*[f,g]; store it as output limb 4. */
  543|   440k|    f->v[4] = secp256k1_i128_to_i64(&cf);
  544|   440k|    g->v[4] = secp256k1_i128_to_i64(&cg);
  545|   440k|}

secp256k1_ecdsa_recoverable_signature_parse_compact:
   38|  1.81k|int secp256k1_ecdsa_recoverable_signature_parse_compact(const secp256k1_context* ctx, secp256k1_ecdsa_recoverable_signature* sig, const unsigned char *input64, int recid) {
   39|  1.81k|    secp256k1_scalar r, s;
   40|  1.81k|    int ret = 1;
   41|  1.81k|    int overflow = 0;
   42|       |
   43|  1.81k|    VERIFY_CHECK(ctx != NULL);
   44|  1.81k|    ARG_CHECK(sig != NULL);
  ------------------
  |  |   45|  1.81k|#define ARG_CHECK(cond) do { \
  |  |   46|  1.81k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  1.81k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 1.81k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  1.81k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 1.81k]
  |  |  ------------------
  ------------------
   45|  1.81k|    ARG_CHECK(input64 != NULL);
  ------------------
  |  |   45|  1.81k|#define ARG_CHECK(cond) do { \
  |  |   46|  1.81k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  1.81k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 1.81k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  1.81k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 1.81k]
  |  |  ------------------
  ------------------
   46|  1.81k|    ARG_CHECK(recid >= 0 && recid <= 3);
  ------------------
  |  |   45|  1.81k|#define ARG_CHECK(cond) do { \
  |  |   46|  1.81k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  3.62k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 1.81k]
  |  |  |  |  |  Branch (146:39): [True: 1.81k, False: 0]
  |  |  |  |  |  Branch (146:39): [True: 1.81k, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  1.81k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 1.81k]
  |  |  ------------------
  ------------------
   47|       |
   48|  1.81k|    secp256k1_scalar_set_b32(&r, &input64[0], &overflow);
   49|  1.81k|    ret &= !overflow;
   50|  1.81k|    secp256k1_scalar_set_b32(&s, &input64[32], &overflow);
   51|  1.81k|    ret &= !overflow;
   52|  1.81k|    if (ret) {
  ------------------
  |  Branch (52:9): [True: 1.81k, False: 0]
  ------------------
   53|  1.81k|        secp256k1_ecdsa_recoverable_signature_save(sig, &r, &s, recid);
   54|  1.81k|    } else {
   55|      0|        memset(sig, 0, sizeof(*sig));
   56|      0|    }
   57|  1.81k|    return ret;
   58|  1.81k|}
secp256k1_ecdsa_recoverable_signature_serialize_compact:
   60|  1.81k|int secp256k1_ecdsa_recoverable_signature_serialize_compact(const secp256k1_context* ctx, unsigned char *output64, int *recid, const secp256k1_ecdsa_recoverable_signature* sig) {
   61|  1.81k|    secp256k1_scalar r, s;
   62|       |
   63|  1.81k|    VERIFY_CHECK(ctx != NULL);
   64|  1.81k|    ARG_CHECK(output64 != NULL);
  ------------------
  |  |   45|  1.81k|#define ARG_CHECK(cond) do { \
  |  |   46|  1.81k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  1.81k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 1.81k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  1.81k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 1.81k]
  |  |  ------------------
  ------------------
   65|  1.81k|    ARG_CHECK(sig != NULL);
  ------------------
  |  |   45|  1.81k|#define ARG_CHECK(cond) do { \
  |  |   46|  1.81k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  1.81k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 1.81k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  1.81k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 1.81k]
  |  |  ------------------
  ------------------
   66|  1.81k|    ARG_CHECK(recid != NULL);
  ------------------
  |  |   45|  1.81k|#define ARG_CHECK(cond) do { \
  |  |   46|  1.81k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  1.81k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 1.81k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  1.81k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 1.81k]
  |  |  ------------------
  ------------------
   67|       |
   68|  1.81k|    secp256k1_ecdsa_recoverable_signature_load(ctx, &r, &s, recid, sig);
   69|  1.81k|    secp256k1_scalar_get_b32(&output64[0], &r);
   70|  1.81k|    secp256k1_scalar_get_b32(&output64[32], &s);
   71|  1.81k|    return 1;
   72|  1.81k|}
secp256k1_ecdsa_sign_recoverable:
  123|  1.81k|int secp256k1_ecdsa_sign_recoverable(const secp256k1_context* ctx, secp256k1_ecdsa_recoverable_signature *signature, const unsigned char *msghash32, const unsigned char *seckey, secp256k1_nonce_function noncefp, const void* noncedata) {
  124|  1.81k|    secp256k1_scalar r, s;
  125|  1.81k|    int ret, recid;
  126|  1.81k|    VERIFY_CHECK(ctx != NULL);
  127|  1.81k|    ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
  ------------------
  |  |   45|  1.81k|#define ARG_CHECK(cond) do { \
  |  |   46|  1.81k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  1.81k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 1.81k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  1.81k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 1.81k]
  |  |  ------------------
  ------------------
  128|  1.81k|    ARG_CHECK(msghash32 != NULL);
  ------------------
  |  |   45|  1.81k|#define ARG_CHECK(cond) do { \
  |  |   46|  1.81k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  1.81k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 1.81k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  1.81k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 1.81k]
  |  |  ------------------
  ------------------
  129|  1.81k|    ARG_CHECK(signature != NULL);
  ------------------
  |  |   45|  1.81k|#define ARG_CHECK(cond) do { \
  |  |   46|  1.81k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  1.81k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 1.81k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  1.81k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 1.81k]
  |  |  ------------------
  ------------------
  130|  1.81k|    ARG_CHECK(seckey != NULL);
  ------------------
  |  |   45|  1.81k|#define ARG_CHECK(cond) do { \
  |  |   46|  1.81k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  1.81k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 1.81k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  1.81k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 1.81k]
  |  |  ------------------
  ------------------
  131|       |
  132|  1.81k|    ret = secp256k1_ecdsa_sign_inner(ctx, &r, &s, &recid, msghash32, seckey, noncefp, noncedata);
  133|  1.81k|    secp256k1_ecdsa_recoverable_signature_save(signature, &r, &s, recid);
  134|  1.81k|    return ret;
  135|  1.81k|}
secp256k1_ecdsa_recover:
  137|  3.62k|int secp256k1_ecdsa_recover(const secp256k1_context* ctx, secp256k1_pubkey *pubkey, const secp256k1_ecdsa_recoverable_signature *signature, const unsigned char *msghash32) {
  138|  3.62k|    secp256k1_ge q;
  139|  3.62k|    secp256k1_scalar r, s;
  140|  3.62k|    secp256k1_scalar m;
  141|  3.62k|    int recid;
  142|  3.62k|    VERIFY_CHECK(ctx != NULL);
  143|  3.62k|    ARG_CHECK(msghash32 != NULL);
  ------------------
  |  |   45|  3.62k|#define ARG_CHECK(cond) do { \
  |  |   46|  3.62k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  3.62k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 3.62k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  3.62k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 3.62k]
  |  |  ------------------
  ------------------
  144|  3.62k|    ARG_CHECK(signature != NULL);
  ------------------
  |  |   45|  3.62k|#define ARG_CHECK(cond) do { \
  |  |   46|  3.62k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  3.62k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 3.62k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  3.62k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 3.62k]
  |  |  ------------------
  ------------------
  145|  3.62k|    ARG_CHECK(pubkey != NULL);
  ------------------
  |  |   45|  3.62k|#define ARG_CHECK(cond) do { \
  |  |   46|  3.62k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  3.62k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 3.62k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  3.62k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 3.62k]
  |  |  ------------------
  ------------------
  146|       |
  147|  3.62k|    secp256k1_ecdsa_recoverable_signature_load(ctx, &r, &s, &recid, signature);
  148|  3.62k|    VERIFY_CHECK(recid >= 0 && recid < 4);  /* should have been caught in parse_compact */
  149|  3.62k|    secp256k1_scalar_set_b32(&m, msghash32, NULL);
  150|  3.62k|    if (secp256k1_ecdsa_sig_recover(&r, &s, &q, &m, recid)) {
  ------------------
  |  Branch (150:9): [True: 3.62k, False: 0]
  ------------------
  151|  3.62k|        secp256k1_pubkey_save(pubkey, &q);
  152|  3.62k|        return 1;
  153|  3.62k|    } else {
  154|      0|        memset(pubkey, 0, sizeof(*pubkey));
  155|      0|        return 0;
  156|      0|    }
  157|  3.62k|}
secp256k1.c:secp256k1_ecdsa_recoverable_signature_save:
   27|  3.62k|static void secp256k1_ecdsa_recoverable_signature_save(secp256k1_ecdsa_recoverable_signature* sig, const secp256k1_scalar* r, const secp256k1_scalar* s, int recid) {
   28|  3.62k|    if (sizeof(secp256k1_scalar) == 32) {
  ------------------
  |  Branch (28:9): [True: 3.62k, Folded]
  ------------------
   29|  3.62k|        memcpy(&sig->data[0], r, 32);
   30|  3.62k|        memcpy(&sig->data[32], s, 32);
   31|  3.62k|    } else {
   32|      0|        secp256k1_scalar_get_b32(&sig->data[0], r);
   33|      0|        secp256k1_scalar_get_b32(&sig->data[32], s);
   34|      0|    }
   35|  3.62k|    sig->data[64] = recid;
   36|  3.62k|}
secp256k1.c:secp256k1_ecdsa_recoverable_signature_load:
   12|  5.43k|static void secp256k1_ecdsa_recoverable_signature_load(const secp256k1_context* ctx, secp256k1_scalar* r, secp256k1_scalar* s, int* recid, const secp256k1_ecdsa_recoverable_signature* sig) {
   13|  5.43k|    (void)ctx;
   14|  5.43k|    if (sizeof(secp256k1_scalar) == 32) {
  ------------------
  |  Branch (14:9): [True: 5.43k, Folded]
  ------------------
   15|       |        /* When the secp256k1_scalar type is exactly 32 byte, use its
   16|       |         * representation inside secp256k1_ecdsa_signature, as conversion is very fast.
   17|       |         * Note that secp256k1_ecdsa_signature_save must use the same representation. */
   18|  5.43k|        memcpy(r, &sig->data[0], 32);
   19|  5.43k|        memcpy(s, &sig->data[32], 32);
   20|  5.43k|    } else {
   21|      0|        secp256k1_scalar_set_b32(r, &sig->data[0], NULL);
   22|       |        secp256k1_scalar_set_b32(s, &sig->data[32], NULL);
   23|      0|    }
   24|  5.43k|    *recid = sig->data[64];
   25|  5.43k|}
secp256k1.c:secp256k1_ecdsa_sig_recover:
   87|  3.62k|static int secp256k1_ecdsa_sig_recover(const secp256k1_scalar *sigr, const secp256k1_scalar* sigs, secp256k1_ge *pubkey, const secp256k1_scalar *message, int recid) {
   88|  3.62k|    unsigned char brx[32];
   89|  3.62k|    secp256k1_fe fx;
   90|  3.62k|    secp256k1_ge x;
   91|  3.62k|    secp256k1_gej xj;
   92|  3.62k|    secp256k1_scalar rn, u1, u2;
   93|  3.62k|    secp256k1_gej qj;
   94|  3.62k|    int r;
   95|       |
   96|  3.62k|    if (secp256k1_scalar_is_zero(sigr) || secp256k1_scalar_is_zero(sigs)) {
  ------------------
  |  Branch (96:9): [True: 0, False: 3.62k]
  |  Branch (96:43): [True: 0, False: 3.62k]
  ------------------
   97|      0|        return 0;
   98|      0|    }
   99|       |
  100|  3.62k|    secp256k1_scalar_get_b32(brx, sigr);
  101|  3.62k|    r = secp256k1_fe_set_b32_limit(&fx, brx);
  ------------------
  |  |   88|  3.62k|#  define secp256k1_fe_set_b32_limit secp256k1_fe_impl_set_b32_limit
  ------------------
  102|  3.62k|    (void)r;
  103|  3.62k|    VERIFY_CHECK(r); /* brx comes from a scalar, so is less than the order; certainly less than p */
  104|  3.62k|    if (recid & 2) {
  ------------------
  |  Branch (104:9): [True: 0, False: 3.62k]
  ------------------
  105|      0|        if (secp256k1_fe_cmp_var(&fx, &secp256k1_ecdsa_const_p_minus_order) >= 0) {
  ------------------
  |  |   86|      0|#  define secp256k1_fe_cmp_var secp256k1_fe_impl_cmp_var
  ------------------
  |  Branch (105:13): [True: 0, False: 0]
  ------------------
  106|      0|            return 0;
  107|      0|        }
  108|      0|        secp256k1_fe_add(&fx, &secp256k1_ecdsa_const_order_as_fe);
  ------------------
  |  |   92|      0|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  109|      0|    }
  110|  3.62k|    if (!secp256k1_ge_set_xo_var(&x, &fx, recid & 1)) {
  ------------------
  |  Branch (110:9): [True: 0, False: 3.62k]
  ------------------
  111|      0|        return 0;
  112|      0|    }
  113|  3.62k|    secp256k1_gej_set_ge(&xj, &x);
  114|  3.62k|    secp256k1_scalar_inverse_var(&rn, sigr);
  115|  3.62k|    secp256k1_scalar_mul(&u1, &rn, message);
  116|  3.62k|    secp256k1_scalar_negate(&u1, &u1);
  117|  3.62k|    secp256k1_scalar_mul(&u2, &rn, sigs);
  118|  3.62k|    secp256k1_ecmult(&qj, &xj, &u2, &u1);
  119|  3.62k|    secp256k1_ge_set_gej_var(pubkey, &qj);
  120|  3.62k|    return !secp256k1_gej_is_infinity(&qj);
  121|  3.62k|}

secp256k1.c:secp256k1_scalar_set_b32:
  147|   153k|static void secp256k1_scalar_set_b32(secp256k1_scalar *r, const unsigned char *b32, int *overflow) {
  148|   153k|    int over;
  149|   153k|    r->d[0] = secp256k1_read_be64(&b32[24]);
  150|   153k|    r->d[1] = secp256k1_read_be64(&b32[16]);
  151|   153k|    r->d[2] = secp256k1_read_be64(&b32[8]);
  152|   153k|    r->d[3] = secp256k1_read_be64(&b32[0]);
  153|   153k|    over = secp256k1_scalar_reduce(r, secp256k1_scalar_check_overflow(r));
  154|   153k|    if (overflow) {
  ------------------
  |  Branch (154:9): [True: 113k, False: 40.4k]
  ------------------
  155|   113k|        *overflow = over;
  156|   113k|    }
  157|       |
  158|   153k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   153k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  159|   153k|}
secp256k1.c:secp256k1_scalar_reduce:
   76|   334k|SECP256K1_INLINE static int secp256k1_scalar_reduce(secp256k1_scalar *r, unsigned int overflow) {
   77|   334k|    secp256k1_uint128 t;
   78|   334k|    VERIFY_CHECK(overflow <= 1);
   79|       |
   80|   334k|    secp256k1_u128_from_u64(&t, r->d[0]);
   81|   334k|    secp256k1_u128_accum_u64(&t, overflow * SECP256K1_N_C_0);
  ------------------
  |  |   22|   334k|#define SECP256K1_N_C_0 (~SECP256K1_N_0 + 1)
  |  |  ------------------
  |  |  |  |   16|   334k|#define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
  |  |  ------------------
  ------------------
   82|   334k|    r->d[0] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
   83|   334k|    secp256k1_u128_accum_u64(&t, r->d[1]);
   84|   334k|    secp256k1_u128_accum_u64(&t, overflow * SECP256K1_N_C_1);
  ------------------
  |  |   23|   334k|#define SECP256K1_N_C_1 (~SECP256K1_N_1)
  |  |  ------------------
  |  |  |  |   17|   334k|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  |  |  ------------------
  ------------------
   85|   334k|    r->d[1] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
   86|   334k|    secp256k1_u128_accum_u64(&t, r->d[2]);
   87|   334k|    secp256k1_u128_accum_u64(&t, overflow * SECP256K1_N_C_2);
  ------------------
  |  |   24|   334k|#define SECP256K1_N_C_2 (1)
  ------------------
   88|   334k|    r->d[2] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
   89|   334k|    secp256k1_u128_accum_u64(&t, r->d[3]);
   90|   334k|    r->d[3] = secp256k1_u128_to_u64(&t);
   91|       |
   92|   334k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   334k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
   93|   334k|    return overflow;
   94|   334k|}
secp256k1.c:secp256k1_scalar_check_overflow:
   64|   334k|SECP256K1_INLINE static int secp256k1_scalar_check_overflow(const secp256k1_scalar *a) {
   65|   334k|    int yes = 0;
   66|   334k|    int no = 0;
   67|   334k|    no |= (a->d[3] < SECP256K1_N_3); /* No need for a > check. */
  ------------------
  |  |   19|   334k|#define SECP256K1_N_3 ((uint64_t)0xFFFFFFFFFFFFFFFFULL)
  ------------------
   68|   334k|    no |= (a->d[2] < SECP256K1_N_2);
  ------------------
  |  |   18|   334k|#define SECP256K1_N_2 ((uint64_t)0xFFFFFFFFFFFFFFFEULL)
  ------------------
   69|   334k|    yes |= (a->d[2] > SECP256K1_N_2) & ~no;
  ------------------
  |  |   18|   334k|#define SECP256K1_N_2 ((uint64_t)0xFFFFFFFFFFFFFFFEULL)
  ------------------
   70|   334k|    no |= (a->d[1] < SECP256K1_N_1);
  ------------------
  |  |   17|   334k|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  ------------------
   71|   334k|    yes |= (a->d[1] > SECP256K1_N_1) & ~no;
  ------------------
  |  |   17|   334k|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  ------------------
   72|   334k|    yes |= (a->d[0] >= SECP256K1_N_0) & ~no;
  ------------------
  |  |   16|   334k|#define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
  ------------------
   73|   334k|    return yes;
   74|   334k|}
secp256k1.c:secp256k1_scalar_get_b32:
  161|  66.1k|static void secp256k1_scalar_get_b32(unsigned char *bin, const secp256k1_scalar* a) {
  162|  66.1k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|  66.1k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  163|       |
  164|  66.1k|    secp256k1_write_be64(&bin[0],  a->d[3]);
  165|  66.1k|    secp256k1_write_be64(&bin[8],  a->d[2]);
  166|  66.1k|    secp256k1_write_be64(&bin[16], a->d[1]);
  167|  66.1k|    secp256k1_write_be64(&bin[24], a->d[0]);
  168|  66.1k|}
secp256k1.c:secp256k1_scalar_is_high:
  244|  31.0k|static int secp256k1_scalar_is_high(const secp256k1_scalar *a) {
  245|  31.0k|    int yes = 0;
  246|  31.0k|    int no = 0;
  247|  31.0k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|  31.0k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  248|       |
  249|  31.0k|    no |= (a->d[3] < SECP256K1_N_H_3);
  ------------------
  |  |   30|  31.0k|#define SECP256K1_N_H_3 ((uint64_t)0x7FFFFFFFFFFFFFFFULL)
  ------------------
  250|  31.0k|    yes |= (a->d[3] > SECP256K1_N_H_3) & ~no;
  ------------------
  |  |   30|  31.0k|#define SECP256K1_N_H_3 ((uint64_t)0x7FFFFFFFFFFFFFFFULL)
  ------------------
  251|  31.0k|    no |= (a->d[2] < SECP256K1_N_H_2) & ~yes; /* No need for a > check. */
  ------------------
  |  |   29|  31.0k|#define SECP256K1_N_H_2 ((uint64_t)0xFFFFFFFFFFFFFFFFULL)
  ------------------
  252|  31.0k|    no |= (a->d[1] < SECP256K1_N_H_1) & ~yes;
  ------------------
  |  |   28|  31.0k|#define SECP256K1_N_H_1 ((uint64_t)0x5D576E7357A4501DULL)
  ------------------
  253|  31.0k|    yes |= (a->d[1] > SECP256K1_N_H_1) & ~no;
  ------------------
  |  |   28|  31.0k|#define SECP256K1_N_H_1 ((uint64_t)0x5D576E7357A4501DULL)
  ------------------
  254|  31.0k|    yes |= (a->d[0] > SECP256K1_N_H_0) & ~no;
  ------------------
  |  |   27|  31.0k|#define SECP256K1_N_H_0 ((uint64_t)0xDFE92F46681B20A0ULL)
  ------------------
  255|  31.0k|    return yes;
  256|  31.0k|}
secp256k1.c:secp256k1_scalar_negate:
  176|  34.3k|static void secp256k1_scalar_negate(secp256k1_scalar *r, const secp256k1_scalar *a) {
  177|  34.3k|    uint64_t nonzero = 0xFFFFFFFFFFFFFFFFULL * (secp256k1_scalar_is_zero(a) == 0);
  178|  34.3k|    secp256k1_uint128 t;
  179|  34.3k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|  34.3k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  180|       |
  181|  34.3k|    secp256k1_u128_from_u64(&t, ~a->d[0]);
  182|  34.3k|    secp256k1_u128_accum_u64(&t, SECP256K1_N_0 + 1);
  ------------------
  |  |   16|  34.3k|#define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
  ------------------
  183|  34.3k|    r->d[0] = secp256k1_u128_to_u64(&t) & nonzero; secp256k1_u128_rshift(&t, 64);
  184|  34.3k|    secp256k1_u128_accum_u64(&t, ~a->d[1]);
  185|  34.3k|    secp256k1_u128_accum_u64(&t, SECP256K1_N_1);
  ------------------
  |  |   17|  34.3k|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  ------------------
  186|  34.3k|    r->d[1] = secp256k1_u128_to_u64(&t) & nonzero; secp256k1_u128_rshift(&t, 64);
  187|  34.3k|    secp256k1_u128_accum_u64(&t, ~a->d[2]);
  188|  34.3k|    secp256k1_u128_accum_u64(&t, SECP256K1_N_2);
  ------------------
  |  |   18|  34.3k|#define SECP256K1_N_2 ((uint64_t)0xFFFFFFFFFFFFFFFEULL)
  ------------------
  189|  34.3k|    r->d[2] = secp256k1_u128_to_u64(&t) & nonzero; secp256k1_u128_rshift(&t, 64);
  190|  34.3k|    secp256k1_u128_accum_u64(&t, ~a->d[3]);
  191|  34.3k|    secp256k1_u128_accum_u64(&t, SECP256K1_N_3);
  ------------------
  |  |   19|  34.3k|#define SECP256K1_N_3 ((uint64_t)0xFFFFFFFFFFFFFFFFULL)
  ------------------
  192|  34.3k|    r->d[3] = secp256k1_u128_to_u64(&t) & nonzero;
  193|       |
  194|  34.3k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|  34.3k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  195|  34.3k|}
secp256k1.c:secp256k1_scalar_inverse_var:
  984|  14.4k|static void secp256k1_scalar_inverse_var(secp256k1_scalar *r, const secp256k1_scalar *x) {
  985|  14.4k|    secp256k1_modinv64_signed62 s;
  986|       |#ifdef VERIFY
  987|       |    int zero_in = secp256k1_scalar_is_zero(x);
  988|       |#endif
  989|  14.4k|    SECP256K1_SCALAR_VERIFY(x);
  ------------------
  |  |  103|  14.4k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  990|       |
  991|  14.4k|    secp256k1_scalar_to_signed62(&s, x);
  992|  14.4k|    secp256k1_modinv64_var(&s, &secp256k1_const_modinfo_scalar);
  993|  14.4k|    secp256k1_scalar_from_signed62(r, &s);
  994|       |
  995|  14.4k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|  14.4k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  996|  14.4k|    VERIFY_CHECK(secp256k1_scalar_is_zero(r) == zero_in);
  997|  14.4k|}
secp256k1.c:secp256k1_scalar_to_signed62:
  952|  27.4k|static void secp256k1_scalar_to_signed62(secp256k1_modinv64_signed62 *r, const secp256k1_scalar *a) {
  953|  27.4k|    const uint64_t M62 = UINT64_MAX >> 2;
  954|  27.4k|    const uint64_t a0 = a->d[0], a1 = a->d[1], a2 = a->d[2], a3 = a->d[3];
  955|  27.4k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|  27.4k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  956|       |
  957|  27.4k|    r->v[0] =  a0                   & M62;
  958|  27.4k|    r->v[1] = (a0 >> 62 | a1 <<  2) & M62;
  959|  27.4k|    r->v[2] = (a1 >> 60 | a2 <<  4) & M62;
  960|  27.4k|    r->v[3] = (a2 >> 58 | a3 <<  6) & M62;
  961|  27.4k|    r->v[4] =  a3 >> 56;
  962|  27.4k|}
secp256k1.c:secp256k1_scalar_from_signed62:
  932|  27.4k|static void secp256k1_scalar_from_signed62(secp256k1_scalar *r, const secp256k1_modinv64_signed62 *a) {
  933|  27.4k|    const uint64_t a0 = a->v[0], a1 = a->v[1], a2 = a->v[2], a3 = a->v[3], a4 = a->v[4];
  934|       |
  935|       |    /* The output from secp256k1_modinv64{_var} should be normalized to range [0,modulus), and
  936|       |     * have limbs in [0,2^62). The modulus is < 2^256, so the top limb must be below 2^(256-62*4).
  937|       |     */
  938|  27.4k|    VERIFY_CHECK(a0 >> 62 == 0);
  939|  27.4k|    VERIFY_CHECK(a1 >> 62 == 0);
  940|  27.4k|    VERIFY_CHECK(a2 >> 62 == 0);
  941|  27.4k|    VERIFY_CHECK(a3 >> 62 == 0);
  942|  27.4k|    VERIFY_CHECK(a4 >> 8 == 0);
  943|       |
  944|  27.4k|    r->d[0] = a0      | a1 << 62;
  945|  27.4k|    r->d[1] = a1 >> 2 | a2 << 60;
  946|  27.4k|    r->d[2] = a2 >> 4 | a3 << 58;
  947|  27.4k|    r->d[3] = a3 >> 6 | a4 << 56;
  948|       |
  949|  27.4k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|  27.4k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  950|  27.4k|}
secp256k1.c:secp256k1_scalar_inverse:
  969|  12.9k|static void secp256k1_scalar_inverse(secp256k1_scalar *r, const secp256k1_scalar *x) {
  970|  12.9k|    secp256k1_modinv64_signed62 s;
  971|       |#ifdef VERIFY
  972|       |    int zero_in = secp256k1_scalar_is_zero(x);
  973|       |#endif
  974|  12.9k|    SECP256K1_SCALAR_VERIFY(x);
  ------------------
  |  |  103|  12.9k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  975|       |
  976|  12.9k|    secp256k1_scalar_to_signed62(&s, x);
  977|  12.9k|    secp256k1_modinv64(&s, &secp256k1_const_modinfo_scalar);
  978|  12.9k|    secp256k1_scalar_from_signed62(r, &s);
  979|       |
  980|  12.9k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|  12.9k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  981|  12.9k|    VERIFY_CHECK(secp256k1_scalar_is_zero(r) == zero_in);
  982|  12.9k|}
secp256k1.c:secp256k1_scalar_cond_negate:
  258|  12.9k|static int secp256k1_scalar_cond_negate(secp256k1_scalar *r, int flag) {
  259|       |    /* If we are flag = 0, mask = 00...00 and this is a no-op;
  260|       |     * if we are flag = 1, mask = 11...11 and this is identical to secp256k1_scalar_negate */
  261|  12.9k|    volatile int vflag = flag;
  262|  12.9k|    uint64_t mask = -vflag;
  263|  12.9k|    uint64_t nonzero = (secp256k1_scalar_is_zero(r) != 0) - 1;
  264|  12.9k|    secp256k1_uint128 t;
  265|  12.9k|    VERIFY_CHECK(flag == 0 || flag == 1);
  266|  12.9k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|  12.9k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  267|       |
  268|  12.9k|    secp256k1_u128_from_u64(&t, r->d[0] ^ mask);
  269|  12.9k|    secp256k1_u128_accum_u64(&t, (SECP256K1_N_0 + 1) & mask);
  ------------------
  |  |   16|  12.9k|#define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
  ------------------
  270|  12.9k|    r->d[0] = secp256k1_u128_to_u64(&t) & nonzero; secp256k1_u128_rshift(&t, 64);
  271|  12.9k|    secp256k1_u128_accum_u64(&t, r->d[1] ^ mask);
  272|  12.9k|    secp256k1_u128_accum_u64(&t, SECP256K1_N_1 & mask);
  ------------------
  |  |   17|  12.9k|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  ------------------
  273|  12.9k|    r->d[1] = secp256k1_u128_to_u64(&t) & nonzero; secp256k1_u128_rshift(&t, 64);
  274|  12.9k|    secp256k1_u128_accum_u64(&t, r->d[2] ^ mask);
  275|  12.9k|    secp256k1_u128_accum_u64(&t, SECP256K1_N_2 & mask);
  ------------------
  |  |   18|  12.9k|#define SECP256K1_N_2 ((uint64_t)0xFFFFFFFFFFFFFFFEULL)
  ------------------
  276|  12.9k|    r->d[2] = secp256k1_u128_to_u64(&t) & nonzero; secp256k1_u128_rshift(&t, 64);
  277|  12.9k|    secp256k1_u128_accum_u64(&t, r->d[3] ^ mask);
  278|  12.9k|    secp256k1_u128_accum_u64(&t, SECP256K1_N_3 & mask);
  ------------------
  |  |   19|  12.9k|#define SECP256K1_N_3 ((uint64_t)0xFFFFFFFFFFFFFFFFULL)
  ------------------
  279|  12.9k|    r->d[3] = secp256k1_u128_to_u64(&t) & nonzero;
  280|       |
  281|  12.9k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|  12.9k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  282|  12.9k|    return 2 * (mask == 0) - 1;
  283|  12.9k|}
secp256k1.c:secp256k1_scalar_cmov:
  915|  57.0k|static SECP256K1_INLINE void secp256k1_scalar_cmov(secp256k1_scalar *r, const secp256k1_scalar *a, int flag) {
  916|  57.0k|    uint64_t mask0, mask1;
  917|  57.0k|    volatile int vflag = flag;
  918|  57.0k|    VERIFY_CHECK(flag == 0 || flag == 1);
  919|  57.0k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|  57.0k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  920|  57.0k|    SECP256K1_CHECKMEM_CHECK_VERIFY(r->d, sizeof(r->d));
  ------------------
  |  |  114|  57.0k|#define SECP256K1_CHECKMEM_CHECK_VERIFY(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|  57.0k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 57.0k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  921|       |
  922|  57.0k|    mask0 = vflag + ~((uint64_t)0);
  923|  57.0k|    mask1 = ~mask0;
  924|  57.0k|    r->d[0] = (r->d[0] & mask0) | (a->d[0] & mask1);
  925|  57.0k|    r->d[1] = (r->d[1] & mask0) | (a->d[1] & mask1);
  926|  57.0k|    r->d[2] = (r->d[2] & mask0) | (a->d[2] & mask1);
  927|  57.0k|    r->d[3] = (r->d[3] & mask0) | (a->d[3] & mask1);
  928|       |
  929|  57.0k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|  57.0k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  930|  57.0k|}
secp256k1.c:secp256k1_scalar_mul_shift_var:
  893|  32.5k|SECP256K1_INLINE static void secp256k1_scalar_mul_shift_var(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b, unsigned int shift) {
  894|  32.5k|    uint64_t l[8];
  895|  32.5k|    unsigned int shiftlimbs;
  896|  32.5k|    unsigned int shiftlow;
  897|  32.5k|    unsigned int shifthigh;
  898|  32.5k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|  32.5k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  899|  32.5k|    SECP256K1_SCALAR_VERIFY(b);
  ------------------
  |  |  103|  32.5k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  900|  32.5k|    VERIFY_CHECK(shift >= 256);
  901|       |
  902|  32.5k|    secp256k1_scalar_mul_512(l, a, b);
  903|  32.5k|    shiftlimbs = shift >> 6;
  904|  32.5k|    shiftlow = shift & 0x3F;
  905|  32.5k|    shifthigh = 64 - shiftlow;
  906|  32.5k|    r->d[0] = shift < 512 ? (l[0 + shiftlimbs] >> shiftlow | (shift < 448 && shiftlow ? (l[1 + shiftlimbs] << shifthigh) : 0)) : 0;
  ------------------
  |  Branch (906:15): [True: 32.5k, False: 0]
  |  Branch (906:63): [True: 32.5k, False: 0]
  |  Branch (906:78): [True: 0, False: 32.5k]
  ------------------
  907|  32.5k|    r->d[1] = shift < 448 ? (l[1 + shiftlimbs] >> shiftlow | (shift < 384 && shiftlow ? (l[2 + shiftlimbs] << shifthigh) : 0)) : 0;
  ------------------
  |  Branch (907:15): [True: 32.5k, False: 0]
  |  Branch (907:63): [True: 0, False: 32.5k]
  |  Branch (907:78): [True: 0, False: 0]
  ------------------
  908|  32.5k|    r->d[2] = shift < 384 ? (l[2 + shiftlimbs] >> shiftlow | (shift < 320 && shiftlow ? (l[3 + shiftlimbs] << shifthigh) : 0)) : 0;
  ------------------
  |  Branch (908:15): [True: 0, False: 32.5k]
  |  Branch (908:63): [True: 0, False: 0]
  |  Branch (908:78): [True: 0, False: 0]
  ------------------
  909|  32.5k|    r->d[3] = shift < 320 ? (l[3 + shiftlimbs] >> shiftlow) : 0;
  ------------------
  |  Branch (909:15): [True: 0, False: 32.5k]
  ------------------
  910|  32.5k|    secp256k1_scalar_cadd_bit(r, 0, (l[(shift - 1) >> 6] >> ((shift - 1) & 0x3f)) & 1);
  911|       |
  912|  32.5k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|  32.5k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  913|  32.5k|}
secp256k1.c:secp256k1_scalar_mul_512:
  682|   136k|static void secp256k1_scalar_mul_512(uint64_t *l8, const secp256k1_scalar *a, const secp256k1_scalar *b) {
  683|   136k|#ifdef USE_ASM_X86_64
  684|   136k|    const uint64_t *pb = b->d;
  685|   136k|    __asm__ __volatile__(
  686|       |    /* Preload */
  687|   136k|    "movq 0(%%rdi), %%r15\n"
  688|   136k|    "movq 8(%%rdi), %%rbx\n"
  689|   136k|    "movq 16(%%rdi), %%rcx\n"
  690|   136k|    "movq 0(%%rdx), %%r11\n"
  691|   136k|    "movq 8(%%rdx), %%r12\n"
  692|   136k|    "movq 16(%%rdx), %%r13\n"
  693|   136k|    "movq 24(%%rdx), %%r14\n"
  694|       |    /* (rax,rdx) = a0 * b0 */
  695|   136k|    "movq %%r15, %%rax\n"
  696|   136k|    "mulq %%r11\n"
  697|       |    /* Extract l8[0] */
  698|   136k|    "movq %%rax, 0(%%rsi)\n"
  699|       |    /* (r8,r9,r10) = (rdx) */
  700|   136k|    "movq %%rdx, %%r8\n"
  701|   136k|    "xorq %%r9, %%r9\n"
  702|   136k|    "xorq %%r10, %%r10\n"
  703|       |    /* (r8,r9,r10) += a0 * b1 */
  704|   136k|    "movq %%r15, %%rax\n"
  705|   136k|    "mulq %%r12\n"
  706|   136k|    "addq %%rax, %%r8\n"
  707|   136k|    "adcq %%rdx, %%r9\n"
  708|   136k|    "adcq $0, %%r10\n"
  709|       |    /* (r8,r9,r10) += a1 * b0 */
  710|   136k|    "movq %%rbx, %%rax\n"
  711|   136k|    "mulq %%r11\n"
  712|   136k|    "addq %%rax, %%r8\n"
  713|   136k|    "adcq %%rdx, %%r9\n"
  714|   136k|    "adcq $0, %%r10\n"
  715|       |    /* Extract l8[1] */
  716|   136k|    "movq %%r8, 8(%%rsi)\n"
  717|   136k|    "xorq %%r8, %%r8\n"
  718|       |    /* (r9,r10,r8) += a0 * b2 */
  719|   136k|    "movq %%r15, %%rax\n"
  720|   136k|    "mulq %%r13\n"
  721|   136k|    "addq %%rax, %%r9\n"
  722|   136k|    "adcq %%rdx, %%r10\n"
  723|   136k|    "adcq $0, %%r8\n"
  724|       |    /* (r9,r10,r8) += a1 * b1 */
  725|   136k|    "movq %%rbx, %%rax\n"
  726|   136k|    "mulq %%r12\n"
  727|   136k|    "addq %%rax, %%r9\n"
  728|   136k|    "adcq %%rdx, %%r10\n"
  729|   136k|    "adcq $0, %%r8\n"
  730|       |    /* (r9,r10,r8) += a2 * b0 */
  731|   136k|    "movq %%rcx, %%rax\n"
  732|   136k|    "mulq %%r11\n"
  733|   136k|    "addq %%rax, %%r9\n"
  734|   136k|    "adcq %%rdx, %%r10\n"
  735|   136k|    "adcq $0, %%r8\n"
  736|       |    /* Extract l8[2] */
  737|   136k|    "movq %%r9, 16(%%rsi)\n"
  738|   136k|    "xorq %%r9, %%r9\n"
  739|       |    /* (r10,r8,r9) += a0 * b3 */
  740|   136k|    "movq %%r15, %%rax\n"
  741|   136k|    "mulq %%r14\n"
  742|   136k|    "addq %%rax, %%r10\n"
  743|   136k|    "adcq %%rdx, %%r8\n"
  744|   136k|    "adcq $0, %%r9\n"
  745|       |    /* Preload a3 */
  746|   136k|    "movq 24(%%rdi), %%r15\n"
  747|       |    /* (r10,r8,r9) += a1 * b2 */
  748|   136k|    "movq %%rbx, %%rax\n"
  749|   136k|    "mulq %%r13\n"
  750|   136k|    "addq %%rax, %%r10\n"
  751|   136k|    "adcq %%rdx, %%r8\n"
  752|   136k|    "adcq $0, %%r9\n"
  753|       |    /* (r10,r8,r9) += a2 * b1 */
  754|   136k|    "movq %%rcx, %%rax\n"
  755|   136k|    "mulq %%r12\n"
  756|   136k|    "addq %%rax, %%r10\n"
  757|   136k|    "adcq %%rdx, %%r8\n"
  758|   136k|    "adcq $0, %%r9\n"
  759|       |    /* (r10,r8,r9) += a3 * b0 */
  760|   136k|    "movq %%r15, %%rax\n"
  761|   136k|    "mulq %%r11\n"
  762|   136k|    "addq %%rax, %%r10\n"
  763|   136k|    "adcq %%rdx, %%r8\n"
  764|   136k|    "adcq $0, %%r9\n"
  765|       |    /* Extract l8[3] */
  766|   136k|    "movq %%r10, 24(%%rsi)\n"
  767|   136k|    "xorq %%r10, %%r10\n"
  768|       |    /* (r8,r9,r10) += a1 * b3 */
  769|   136k|    "movq %%rbx, %%rax\n"
  770|   136k|    "mulq %%r14\n"
  771|   136k|    "addq %%rax, %%r8\n"
  772|   136k|    "adcq %%rdx, %%r9\n"
  773|   136k|    "adcq $0, %%r10\n"
  774|       |    /* (r8,r9,r10) += a2 * b2 */
  775|   136k|    "movq %%rcx, %%rax\n"
  776|   136k|    "mulq %%r13\n"
  777|   136k|    "addq %%rax, %%r8\n"
  778|   136k|    "adcq %%rdx, %%r9\n"
  779|   136k|    "adcq $0, %%r10\n"
  780|       |    /* (r8,r9,r10) += a3 * b1 */
  781|   136k|    "movq %%r15, %%rax\n"
  782|   136k|    "mulq %%r12\n"
  783|   136k|    "addq %%rax, %%r8\n"
  784|   136k|    "adcq %%rdx, %%r9\n"
  785|   136k|    "adcq $0, %%r10\n"
  786|       |    /* Extract l8[4] */
  787|   136k|    "movq %%r8, 32(%%rsi)\n"
  788|   136k|    "xorq %%r8, %%r8\n"
  789|       |    /* (r9,r10,r8) += a2 * b3 */
  790|   136k|    "movq %%rcx, %%rax\n"
  791|   136k|    "mulq %%r14\n"
  792|   136k|    "addq %%rax, %%r9\n"
  793|   136k|    "adcq %%rdx, %%r10\n"
  794|   136k|    "adcq $0, %%r8\n"
  795|       |    /* (r9,r10,r8) += a3 * b2 */
  796|   136k|    "movq %%r15, %%rax\n"
  797|   136k|    "mulq %%r13\n"
  798|   136k|    "addq %%rax, %%r9\n"
  799|   136k|    "adcq %%rdx, %%r10\n"
  800|   136k|    "adcq $0, %%r8\n"
  801|       |    /* Extract l8[5] */
  802|   136k|    "movq %%r9, 40(%%rsi)\n"
  803|       |    /* (r10,r8) += a3 * b3 */
  804|   136k|    "movq %%r15, %%rax\n"
  805|   136k|    "mulq %%r14\n"
  806|   136k|    "addq %%rax, %%r10\n"
  807|   136k|    "adcq %%rdx, %%r8\n"
  808|       |    /* Extract l8[6] */
  809|   136k|    "movq %%r10, 48(%%rsi)\n"
  810|       |    /* Extract l8[7] */
  811|   136k|    "movq %%r8, 56(%%rsi)\n"
  812|   136k|    : "+d"(pb)
  813|   136k|    : "S"(l8), "D"(a->d)
  814|   136k|    : "rax", "rbx", "rcx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15", "cc", "memory");
  815|       |
  816|   136k|    SECP256K1_CHECKMEM_MSAN_DEFINE(l8, sizeof(*l8) * 8);
  ------------------
  |  |   70|   136k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   136k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 136k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  817|       |
  818|       |#else
  819|       |    /* 160 bit accumulator. */
  820|       |    uint64_t c0 = 0, c1 = 0;
  821|       |    uint32_t c2 = 0;
  822|       |
  823|       |    /* l8[0..7] = a[0..3] * b[0..3]. */
  824|       |    muladd_fast(a->d[0], b->d[0]);
  825|       |    extract_fast(l8[0]);
  826|       |    muladd(a->d[0], b->d[1]);
  827|       |    muladd(a->d[1], b->d[0]);
  828|       |    extract(l8[1]);
  829|       |    muladd(a->d[0], b->d[2]);
  830|       |    muladd(a->d[1], b->d[1]);
  831|       |    muladd(a->d[2], b->d[0]);
  832|       |    extract(l8[2]);
  833|       |    muladd(a->d[0], b->d[3]);
  834|       |    muladd(a->d[1], b->d[2]);
  835|       |    muladd(a->d[2], b->d[1]);
  836|       |    muladd(a->d[3], b->d[0]);
  837|       |    extract(l8[3]);
  838|       |    muladd(a->d[1], b->d[3]);
  839|       |    muladd(a->d[2], b->d[2]);
  840|       |    muladd(a->d[3], b->d[1]);
  841|       |    extract(l8[4]);
  842|       |    muladd(a->d[2], b->d[3]);
  843|       |    muladd(a->d[3], b->d[2]);
  844|       |    extract(l8[5]);
  845|       |    muladd_fast(a->d[3], b->d[3]);
  846|       |    extract_fast(l8[6]);
  847|       |    VERIFY_CHECK(c1 == 0);
  848|       |    l8[7] = c0;
  849|       |#endif
  850|   136k|}
secp256k1.c:secp256k1_scalar_cadd_bit:
  122|  32.5k|static void secp256k1_scalar_cadd_bit(secp256k1_scalar *r, unsigned int bit, int flag) {
  123|  32.5k|    secp256k1_uint128 t;
  124|  32.5k|    volatile int vflag = flag;
  125|  32.5k|    VERIFY_CHECK(flag == 0 || flag == 1);
  126|  32.5k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|  32.5k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  127|  32.5k|    VERIFY_CHECK(bit < 256);
  128|       |
  129|  32.5k|    bit += ((uint32_t) vflag - 1) & 0x100;  /* forcing (bit >> 6) > 3 makes this a noop */
  130|  32.5k|    secp256k1_u128_from_u64(&t, r->d[0]);
  131|  32.5k|    secp256k1_u128_accum_u64(&t, ((uint64_t)((bit >> 6) == 0)) << (bit & 0x3F));
  132|  32.5k|    r->d[0] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
  133|  32.5k|    secp256k1_u128_accum_u64(&t, r->d[1]);
  134|  32.5k|    secp256k1_u128_accum_u64(&t, ((uint64_t)((bit >> 6) == 1)) << (bit & 0x3F));
  135|  32.5k|    r->d[1] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
  136|  32.5k|    secp256k1_u128_accum_u64(&t, r->d[2]);
  137|  32.5k|    secp256k1_u128_accum_u64(&t, ((uint64_t)((bit >> 6) == 2)) << (bit & 0x3F));
  138|  32.5k|    r->d[2] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
  139|  32.5k|    secp256k1_u128_accum_u64(&t, r->d[3]);
  140|  32.5k|    secp256k1_u128_accum_u64(&t, ((uint64_t)((bit >> 6) == 3)) << (bit & 0x3F));
  141|  32.5k|    r->d[3] = secp256k1_u128_to_u64(&t);
  142|       |
  143|  32.5k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|  32.5k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  144|  32.5k|    VERIFY_CHECK(secp256k1_u128_hi_u64(&t) == 0);
  145|  32.5k|}
secp256k1.c:secp256k1_scalar_split_128:
  870|  16.2k|static void secp256k1_scalar_split_128(secp256k1_scalar *r1, secp256k1_scalar *r2, const secp256k1_scalar *k) {
  871|  16.2k|    SECP256K1_SCALAR_VERIFY(k);
  ------------------
  |  |  103|  16.2k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  872|       |
  873|  16.2k|    r1->d[0] = k->d[0];
  874|  16.2k|    r1->d[1] = k->d[1];
  875|  16.2k|    r1->d[2] = 0;
  876|  16.2k|    r1->d[3] = 0;
  877|  16.2k|    r2->d[0] = k->d[2];
  878|  16.2k|    r2->d[1] = k->d[3];
  879|  16.2k|    r2->d[2] = 0;
  880|  16.2k|    r2->d[3] = 0;
  881|       |
  882|  16.2k|    SECP256K1_SCALAR_VERIFY(r1);
  ------------------
  |  |  103|  16.2k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  883|  16.2k|    SECP256K1_SCALAR_VERIFY(r2);
  ------------------
  |  |  103|  16.2k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  884|  16.2k|}
secp256k1.c:secp256k1_scalar_get_bits_limb32:
   41|  2.57M|SECP256K1_INLINE static uint32_t secp256k1_scalar_get_bits_limb32(const secp256k1_scalar *a, unsigned int offset, unsigned int count) {
   42|  2.57M|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|  2.57M|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
   43|  2.57M|    VERIFY_CHECK(count > 0 && count <= 32);
   44|  2.57M|    VERIFY_CHECK(offset <= 256 - count);
   45|  2.57M|    VERIFY_CHECK((offset + count - 1) >> 5 == offset >> 5);
   46|       |
   47|  2.57M|    return (a->d[offset >> 6] >> (offset & 0x3F)) & (0xFFFFFFFF >> (32 - count));
   48|  2.57M|}
secp256k1.c:secp256k1_scalar_get_bits_var:
   50|   904k|SECP256K1_INLINE static uint32_t secp256k1_scalar_get_bits_var(const secp256k1_scalar *a, unsigned int offset, unsigned int count) {
   51|   904k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|   904k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
   52|   904k|    VERIFY_CHECK(count > 0 && count <= 32);
   53|   904k|    VERIFY_CHECK(offset <= 256 - count);
   54|       |
   55|   904k|    if ((offset + count - 1) >> 6 == offset >> 6) {
  ------------------
  |  Branch (55:9): [True: 815k, False: 88.1k]
  ------------------
   56|   815k|        return (a->d[offset >> 6] >> (offset & 0x3F)) & (0xFFFFFFFF >> (32 - count));
   57|   815k|    } else {
   58|  88.1k|        VERIFY_CHECK((offset >> 6) + 1 < 4);
   59|  88.1k|        VERIFY_CHECK((offset & 0x3F) > 0);
   60|  88.1k|        return ((a->d[offset >> 6] >> (offset & 0x3F)) | (a->d[(offset >> 6) + 1] << (64 - (offset & 0x3F)))) & (0xFFFFFFFF >> (32 - count));
   61|  88.1k|    }
   62|   904k|}
secp256k1.c:secp256k1_scalar_is_zero:
  170|   177k|SECP256K1_INLINE static int secp256k1_scalar_is_zero(const secp256k1_scalar *a) {
  171|   177k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|   177k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  172|       |
  173|   177k|    return (a->d[0] | a->d[1] | a->d[2] | a->d[3]) == 0;
  174|   177k|}
secp256k1.c:secp256k1_scalar_mul:
  859|   103k|static void secp256k1_scalar_mul(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
  860|   103k|    uint64_t l[8];
  861|   103k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|   103k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  862|   103k|    SECP256K1_SCALAR_VERIFY(b);
  ------------------
  |  |  103|   103k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  863|       |
  864|   103k|    secp256k1_scalar_mul_512(l, a, b);
  865|   103k|    secp256k1_scalar_reduce_512(r, l);
  866|       |
  867|   103k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   103k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  868|   103k|}
secp256k1.c:secp256k1_scalar_reduce_512:
  351|   103k|static void secp256k1_scalar_reduce_512(secp256k1_scalar *r, const uint64_t *l) {
  352|   103k|#ifdef USE_ASM_X86_64
  353|       |    /* Reduce 512 bits into 385. */
  354|   103k|    uint64_t m0, m1, m2, m3, m4, m5, m6;
  355|   103k|    uint64_t p0, p1, p2, p3, p4;
  356|   103k|    uint64_t c;
  357|       |
  358|   103k|    __asm__ __volatile__(
  359|       |    /* Preload. */
  360|   103k|    "movq 32(%%rsi), %%r11\n"
  361|   103k|    "movq 40(%%rsi), %%r12\n"
  362|   103k|    "movq 48(%%rsi), %%r13\n"
  363|   103k|    "movq 56(%%rsi), %%r14\n"
  364|       |    /* Initialize r8,r9,r10 */
  365|   103k|    "movq 0(%%rsi), %%r8\n"
  366|   103k|    "xorq %%r9, %%r9\n"
  367|   103k|    "xorq %%r10, %%r10\n"
  368|       |    /* (r8,r9) += n0 * c0 */
  369|   103k|    "movq %8, %%rax\n"
  370|   103k|    "mulq %%r11\n"
  371|   103k|    "addq %%rax, %%r8\n"
  372|   103k|    "adcq %%rdx, %%r9\n"
  373|       |    /* extract m0 */
  374|   103k|    "movq %%r8, %q0\n"
  375|   103k|    "xorq %%r8, %%r8\n"
  376|       |    /* (r9,r10) += l1 */
  377|   103k|    "addq 8(%%rsi), %%r9\n"
  378|   103k|    "adcq $0, %%r10\n"
  379|       |    /* (r9,r10,r8) += n1 * c0 */
  380|   103k|    "movq %8, %%rax\n"
  381|   103k|    "mulq %%r12\n"
  382|   103k|    "addq %%rax, %%r9\n"
  383|   103k|    "adcq %%rdx, %%r10\n"
  384|   103k|    "adcq $0, %%r8\n"
  385|       |    /* (r9,r10,r8) += n0 * c1 */
  386|   103k|    "movq %9, %%rax\n"
  387|   103k|    "mulq %%r11\n"
  388|   103k|    "addq %%rax, %%r9\n"
  389|   103k|    "adcq %%rdx, %%r10\n"
  390|   103k|    "adcq $0, %%r8\n"
  391|       |    /* extract m1 */
  392|   103k|    "movq %%r9, %q1\n"
  393|   103k|    "xorq %%r9, %%r9\n"
  394|       |    /* (r10,r8,r9) += l2 */
  395|   103k|    "addq 16(%%rsi), %%r10\n"
  396|   103k|    "adcq $0, %%r8\n"
  397|   103k|    "adcq $0, %%r9\n"
  398|       |    /* (r10,r8,r9) += n2 * c0 */
  399|   103k|    "movq %8, %%rax\n"
  400|   103k|    "mulq %%r13\n"
  401|   103k|    "addq %%rax, %%r10\n"
  402|   103k|    "adcq %%rdx, %%r8\n"
  403|   103k|    "adcq $0, %%r9\n"
  404|       |    /* (r10,r8,r9) += n1 * c1 */
  405|   103k|    "movq %9, %%rax\n"
  406|   103k|    "mulq %%r12\n"
  407|   103k|    "addq %%rax, %%r10\n"
  408|   103k|    "adcq %%rdx, %%r8\n"
  409|   103k|    "adcq $0, %%r9\n"
  410|       |    /* (r10,r8,r9) += n0 */
  411|   103k|    "addq %%r11, %%r10\n"
  412|   103k|    "adcq $0, %%r8\n"
  413|   103k|    "adcq $0, %%r9\n"
  414|       |    /* extract m2 */
  415|   103k|    "movq %%r10, %q2\n"
  416|   103k|    "xorq %%r10, %%r10\n"
  417|       |    /* (r8,r9,r10) += l3 */
  418|   103k|    "addq 24(%%rsi), %%r8\n"
  419|   103k|    "adcq $0, %%r9\n"
  420|   103k|    "adcq $0, %%r10\n"
  421|       |    /* (r8,r9,r10) += n3 * c0 */
  422|   103k|    "movq %8, %%rax\n"
  423|   103k|    "mulq %%r14\n"
  424|   103k|    "addq %%rax, %%r8\n"
  425|   103k|    "adcq %%rdx, %%r9\n"
  426|   103k|    "adcq $0, %%r10\n"
  427|       |    /* (r8,r9,r10) += n2 * c1 */
  428|   103k|    "movq %9, %%rax\n"
  429|   103k|    "mulq %%r13\n"
  430|   103k|    "addq %%rax, %%r8\n"
  431|   103k|    "adcq %%rdx, %%r9\n"
  432|   103k|    "adcq $0, %%r10\n"
  433|       |    /* (r8,r9,r10) += n1 */
  434|   103k|    "addq %%r12, %%r8\n"
  435|   103k|    "adcq $0, %%r9\n"
  436|   103k|    "adcq $0, %%r10\n"
  437|       |    /* extract m3 */
  438|   103k|    "movq %%r8, %q3\n"
  439|   103k|    "xorq %%r8, %%r8\n"
  440|       |    /* (r9,r10,r8) += n3 * c1 */
  441|   103k|    "movq %9, %%rax\n"
  442|   103k|    "mulq %%r14\n"
  443|   103k|    "addq %%rax, %%r9\n"
  444|   103k|    "adcq %%rdx, %%r10\n"
  445|   103k|    "adcq $0, %%r8\n"
  446|       |    /* (r9,r10,r8) += n2 */
  447|   103k|    "addq %%r13, %%r9\n"
  448|   103k|    "adcq $0, %%r10\n"
  449|   103k|    "adcq $0, %%r8\n"
  450|       |    /* extract m4 */
  451|   103k|    "movq %%r9, %q4\n"
  452|       |    /* (r10,r8) += n3 */
  453|   103k|    "addq %%r14, %%r10\n"
  454|   103k|    "adcq $0, %%r8\n"
  455|       |    /* extract m5 */
  456|   103k|    "movq %%r10, %q5\n"
  457|       |    /* extract m6 */
  458|   103k|    "movq %%r8, %q6\n"
  459|   103k|    : "=&g"(m0), "=&g"(m1), "=&g"(m2), "=g"(m3), "=g"(m4), "=g"(m5), "=g"(m6)
  460|   103k|    : "S"(l), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
  ------------------
  |  |   22|   103k|#define SECP256K1_N_C_0 (~SECP256K1_N_0 + 1)
  |  |  ------------------
  |  |  |  |   16|   103k|#define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
  |  |  ------------------
  ------------------
                  : "S"(l), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
  ------------------
  |  |   23|   103k|#define SECP256K1_N_C_1 (~SECP256K1_N_1)
  |  |  ------------------
  |  |  |  |   17|   103k|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  |  |  ------------------
  ------------------
  461|   103k|    : "rax", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "cc");
  462|       |
  463|   103k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&m0, sizeof(m0));
  ------------------
  |  |   70|   103k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   103k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 103k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  464|   103k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&m1, sizeof(m1));
  ------------------
  |  |   70|   103k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   103k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 103k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  465|   103k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&m2, sizeof(m2));
  ------------------
  |  |   70|   103k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   103k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 103k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  466|   103k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&m3, sizeof(m3));
  ------------------
  |  |   70|   103k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   103k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 103k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  467|   103k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&m4, sizeof(m4));
  ------------------
  |  |   70|   103k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   103k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 103k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  468|   103k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&m5, sizeof(m5));
  ------------------
  |  |   70|   103k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   103k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 103k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  469|   103k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&m6, sizeof(m6));
  ------------------
  |  |   70|   103k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   103k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 103k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  470|       |
  471|       |    /* Reduce 385 bits into 258. */
  472|   103k|    __asm__ __volatile__(
  473|       |    /* Preload */
  474|   103k|    "movq %q9, %%r11\n"
  475|   103k|    "movq %q10, %%r12\n"
  476|   103k|    "movq %q11, %%r13\n"
  477|       |    /* Initialize (r8,r9,r10) */
  478|   103k|    "movq %q5, %%r8\n"
  479|   103k|    "xorq %%r9, %%r9\n"
  480|   103k|    "xorq %%r10, %%r10\n"
  481|       |    /* (r8,r9) += m4 * c0 */
  482|   103k|    "movq %12, %%rax\n"
  483|   103k|    "mulq %%r11\n"
  484|   103k|    "addq %%rax, %%r8\n"
  485|   103k|    "adcq %%rdx, %%r9\n"
  486|       |    /* extract p0 */
  487|   103k|    "movq %%r8, %q0\n"
  488|   103k|    "xorq %%r8, %%r8\n"
  489|       |    /* (r9,r10) += m1 */
  490|   103k|    "addq %q6, %%r9\n"
  491|   103k|    "adcq $0, %%r10\n"
  492|       |    /* (r9,r10,r8) += m5 * c0 */
  493|   103k|    "movq %12, %%rax\n"
  494|   103k|    "mulq %%r12\n"
  495|   103k|    "addq %%rax, %%r9\n"
  496|   103k|    "adcq %%rdx, %%r10\n"
  497|   103k|    "adcq $0, %%r8\n"
  498|       |    /* (r9,r10,r8) += m4 * c1 */
  499|   103k|    "movq %13, %%rax\n"
  500|   103k|    "mulq %%r11\n"
  501|   103k|    "addq %%rax, %%r9\n"
  502|   103k|    "adcq %%rdx, %%r10\n"
  503|   103k|    "adcq $0, %%r8\n"
  504|       |    /* extract p1 */
  505|   103k|    "movq %%r9, %q1\n"
  506|   103k|    "xorq %%r9, %%r9\n"
  507|       |    /* (r10,r8,r9) += m2 */
  508|   103k|    "addq %q7, %%r10\n"
  509|   103k|    "adcq $0, %%r8\n"
  510|   103k|    "adcq $0, %%r9\n"
  511|       |    /* (r10,r8,r9) += m6 * c0 */
  512|   103k|    "movq %12, %%rax\n"
  513|   103k|    "mulq %%r13\n"
  514|   103k|    "addq %%rax, %%r10\n"
  515|   103k|    "adcq %%rdx, %%r8\n"
  516|   103k|    "adcq $0, %%r9\n"
  517|       |    /* (r10,r8,r9) += m5 * c1 */
  518|   103k|    "movq %13, %%rax\n"
  519|   103k|    "mulq %%r12\n"
  520|   103k|    "addq %%rax, %%r10\n"
  521|   103k|    "adcq %%rdx, %%r8\n"
  522|   103k|    "adcq $0, %%r9\n"
  523|       |    /* (r10,r8,r9) += m4 */
  524|   103k|    "addq %%r11, %%r10\n"
  525|   103k|    "adcq $0, %%r8\n"
  526|   103k|    "adcq $0, %%r9\n"
  527|       |    /* extract p2 */
  528|   103k|    "movq %%r10, %q2\n"
  529|       |    /* (r8,r9) += m3 */
  530|   103k|    "addq %q8, %%r8\n"
  531|   103k|    "adcq $0, %%r9\n"
  532|       |    /* (r8,r9) += m6 * c1 */
  533|   103k|    "movq %13, %%rax\n"
  534|   103k|    "mulq %%r13\n"
  535|   103k|    "addq %%rax, %%r8\n"
  536|   103k|    "adcq %%rdx, %%r9\n"
  537|       |    /* (r8,r9) += m5 */
  538|   103k|    "addq %%r12, %%r8\n"
  539|   103k|    "adcq $0, %%r9\n"
  540|       |    /* extract p3 */
  541|   103k|    "movq %%r8, %q3\n"
  542|       |    /* (r9) += m6 */
  543|   103k|    "addq %%r13, %%r9\n"
  544|       |    /* extract p4 */
  545|   103k|    "movq %%r9, %q4\n"
  546|   103k|    : "=&g"(p0), "=&g"(p1), "=&g"(p2), "=g"(p3), "=g"(p4)
  547|   103k|    : "g"(m0), "g"(m1), "g"(m2), "g"(m3), "g"(m4), "g"(m5), "g"(m6), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
  ------------------
  |  |   22|   103k|#define SECP256K1_N_C_0 (~SECP256K1_N_0 + 1)
  |  |  ------------------
  |  |  |  |   16|   103k|#define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
  |  |  ------------------
  ------------------
                  : "g"(m0), "g"(m1), "g"(m2), "g"(m3), "g"(m4), "g"(m5), "g"(m6), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
  ------------------
  |  |   23|   103k|#define SECP256K1_N_C_1 (~SECP256K1_N_1)
  |  |  ------------------
  |  |  |  |   17|   103k|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  |  |  ------------------
  ------------------
  548|   103k|    : "rax", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "cc");
  549|       |
  550|   103k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&p0, sizeof(p0));
  ------------------
  |  |   70|   103k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   103k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 103k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  551|   103k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&p1, sizeof(p1));
  ------------------
  |  |   70|   103k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   103k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 103k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  552|   103k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&p2, sizeof(p2));
  ------------------
  |  |   70|   103k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   103k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 103k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  553|   103k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&p3, sizeof(p3));
  ------------------
  |  |   70|   103k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   103k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 103k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  554|   103k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&p4, sizeof(p4));
  ------------------
  |  |   70|   103k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   103k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 103k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  555|       |
  556|       |    /* Reduce 258 bits into 256. */
  557|   103k|    __asm__ __volatile__(
  558|       |    /* Preload */
  559|   103k|    "movq %q5, %%r10\n"
  560|       |    /* (rax,rdx) = p4 * c0 */
  561|   103k|    "movq %7, %%rax\n"
  562|   103k|    "mulq %%r10\n"
  563|       |    /* (rax,rdx) += p0 */
  564|   103k|    "addq %q1, %%rax\n"
  565|   103k|    "adcq $0, %%rdx\n"
  566|       |    /* extract r0 */
  567|   103k|    "movq %%rax, 0(%q6)\n"
  568|       |    /* Move to (r8,r9) */
  569|   103k|    "movq %%rdx, %%r8\n"
  570|   103k|    "xorq %%r9, %%r9\n"
  571|       |    /* (r8,r9) += p1 */
  572|   103k|    "addq %q2, %%r8\n"
  573|   103k|    "adcq $0, %%r9\n"
  574|       |    /* (r8,r9) += p4 * c1 */
  575|   103k|    "movq %8, %%rax\n"
  576|   103k|    "mulq %%r10\n"
  577|   103k|    "addq %%rax, %%r8\n"
  578|   103k|    "adcq %%rdx, %%r9\n"
  579|       |    /* Extract r1 */
  580|   103k|    "movq %%r8, 8(%q6)\n"
  581|   103k|    "xorq %%r8, %%r8\n"
  582|       |    /* (r9,r8) += p4 */
  583|   103k|    "addq %%r10, %%r9\n"
  584|   103k|    "adcq $0, %%r8\n"
  585|       |    /* (r9,r8) += p2 */
  586|   103k|    "addq %q3, %%r9\n"
  587|   103k|    "adcq $0, %%r8\n"
  588|       |    /* Extract r2 */
  589|   103k|    "movq %%r9, 16(%q6)\n"
  590|   103k|    "xorq %%r9, %%r9\n"
  591|       |    /* (r8,r9) += p3 */
  592|   103k|    "addq %q4, %%r8\n"
  593|   103k|    "adcq $0, %%r9\n"
  594|       |    /* Extract r3 */
  595|   103k|    "movq %%r8, 24(%q6)\n"
  596|       |    /* Extract c */
  597|   103k|    "movq %%r9, %q0\n"
  598|   103k|    : "=g"(c)
  599|   103k|    : "g"(p0), "g"(p1), "g"(p2), "g"(p3), "g"(p4), "D"(r), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
  ------------------
  |  |   22|   103k|#define SECP256K1_N_C_0 (~SECP256K1_N_0 + 1)
  |  |  ------------------
  |  |  |  |   16|   103k|#define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
  |  |  ------------------
  ------------------
                  : "g"(p0), "g"(p1), "g"(p2), "g"(p3), "g"(p4), "D"(r), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
  ------------------
  |  |   23|   103k|#define SECP256K1_N_C_1 (~SECP256K1_N_1)
  |  |  ------------------
  |  |  |  |   17|   103k|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  |  |  ------------------
  ------------------
  600|   103k|    : "rax", "rdx", "r8", "r9", "r10", "cc", "memory");
  601|       |
  602|   103k|    SECP256K1_CHECKMEM_MSAN_DEFINE(r, sizeof(*r));
  ------------------
  |  |   70|   103k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   103k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 103k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  603|   103k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&c, sizeof(c));
  ------------------
  |  |   70|   103k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   103k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 103k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  604|       |
  605|       |#else
  606|       |    secp256k1_uint128 c128;
  607|       |    uint64_t c, c0, c1, c2;
  608|       |    uint64_t n0 = l[4], n1 = l[5], n2 = l[6], n3 = l[7];
  609|       |    uint64_t m0, m1, m2, m3, m4, m5;
  610|       |    uint32_t m6;
  611|       |    uint64_t p0, p1, p2, p3;
  612|       |    uint32_t p4;
  613|       |
  614|       |    /* Reduce 512 bits into 385. */
  615|       |    /* m[0..6] = l[0..3] + n[0..3] * SECP256K1_N_C. */
  616|       |    c0 = l[0]; c1 = 0; c2 = 0;
  617|       |    muladd_fast(n0, SECP256K1_N_C_0);
  618|       |    extract_fast(m0);
  619|       |    sumadd_fast(l[1]);
  620|       |    muladd(n1, SECP256K1_N_C_0);
  621|       |    muladd(n0, SECP256K1_N_C_1);
  622|       |    extract(m1);
  623|       |    sumadd(l[2]);
  624|       |    muladd(n2, SECP256K1_N_C_0);
  625|       |    muladd(n1, SECP256K1_N_C_1);
  626|       |    sumadd(n0);
  627|       |    extract(m2);
  628|       |    sumadd(l[3]);
  629|       |    muladd(n3, SECP256K1_N_C_0);
  630|       |    muladd(n2, SECP256K1_N_C_1);
  631|       |    sumadd(n1);
  632|       |    extract(m3);
  633|       |    muladd(n3, SECP256K1_N_C_1);
  634|       |    sumadd(n2);
  635|       |    extract(m4);
  636|       |    sumadd_fast(n3);
  637|       |    extract_fast(m5);
  638|       |    VERIFY_CHECK(c0 <= 1);
  639|       |    m6 = c0;
  640|       |
  641|       |    /* Reduce 385 bits into 258. */
  642|       |    /* p[0..4] = m[0..3] + m[4..6] * SECP256K1_N_C. */
  643|       |    c0 = m0; c1 = 0; c2 = 0;
  644|       |    muladd_fast(m4, SECP256K1_N_C_0);
  645|       |    extract_fast(p0);
  646|       |    sumadd_fast(m1);
  647|       |    muladd(m5, SECP256K1_N_C_0);
  648|       |    muladd(m4, SECP256K1_N_C_1);
  649|       |    extract(p1);
  650|       |    sumadd(m2);
  651|       |    muladd(m6, SECP256K1_N_C_0);
  652|       |    muladd(m5, SECP256K1_N_C_1);
  653|       |    sumadd(m4);
  654|       |    extract(p2);
  655|       |    sumadd_fast(m3);
  656|       |    muladd_fast(m6, SECP256K1_N_C_1);
  657|       |    sumadd_fast(m5);
  658|       |    extract_fast(p3);
  659|       |    p4 = c0 + m6;
  660|       |    VERIFY_CHECK(p4 <= 2);
  661|       |
  662|       |    /* Reduce 258 bits into 256. */
  663|       |    /* r[0..3] = p[0..3] + p[4] * SECP256K1_N_C. */
  664|       |    secp256k1_u128_from_u64(&c128, p0);
  665|       |    secp256k1_u128_accum_mul(&c128, SECP256K1_N_C_0, p4);
  666|       |    r->d[0] = secp256k1_u128_to_u64(&c128); secp256k1_u128_rshift(&c128, 64);
  667|       |    secp256k1_u128_accum_u64(&c128, p1);
  668|       |    secp256k1_u128_accum_mul(&c128, SECP256K1_N_C_1, p4);
  669|       |    r->d[1] = secp256k1_u128_to_u64(&c128); secp256k1_u128_rshift(&c128, 64);
  670|       |    secp256k1_u128_accum_u64(&c128, p2);
  671|       |    secp256k1_u128_accum_u64(&c128, p4);
  672|       |    r->d[2] = secp256k1_u128_to_u64(&c128); secp256k1_u128_rshift(&c128, 64);
  673|       |    secp256k1_u128_accum_u64(&c128, p3);
  674|       |    r->d[3] = secp256k1_u128_to_u64(&c128);
  675|       |    c = secp256k1_u128_hi_u64(&c128);
  676|       |#endif
  677|       |
  678|       |    /* Final reduction of r. */
  679|   103k|    secp256k1_scalar_reduce(r, c + secp256k1_scalar_check_overflow(r));
  680|   103k|}
secp256k1.c:secp256k1_scalar_add:
   96|  76.6k|static int secp256k1_scalar_add(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
   97|  76.6k|    int overflow;
   98|  76.6k|    secp256k1_uint128 t;
   99|  76.6k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|  76.6k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  100|  76.6k|    SECP256K1_SCALAR_VERIFY(b);
  ------------------
  |  |  103|  76.6k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  101|       |
  102|  76.6k|    secp256k1_u128_from_u64(&t, a->d[0]);
  103|  76.6k|    secp256k1_u128_accum_u64(&t, b->d[0]);
  104|  76.6k|    r->d[0] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
  105|  76.6k|    secp256k1_u128_accum_u64(&t, a->d[1]);
  106|  76.6k|    secp256k1_u128_accum_u64(&t, b->d[1]);
  107|  76.6k|    r->d[1] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
  108|  76.6k|    secp256k1_u128_accum_u64(&t, a->d[2]);
  109|  76.6k|    secp256k1_u128_accum_u64(&t, b->d[2]);
  110|  76.6k|    r->d[2] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
  111|  76.6k|    secp256k1_u128_accum_u64(&t, a->d[3]);
  112|  76.6k|    secp256k1_u128_accum_u64(&t, b->d[3]);
  113|  76.6k|    r->d[3] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
  114|  76.6k|    overflow = secp256k1_u128_to_u64(&t) + secp256k1_scalar_check_overflow(r);
  115|  76.6k|    VERIFY_CHECK(overflow == 0 || overflow == 1);
  116|  76.6k|    secp256k1_scalar_reduce(r, overflow);
  117|       |
  118|  76.6k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|  76.6k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  119|  76.6k|    return overflow;
  120|  76.6k|}

secp256k1.c:secp256k1_scalar_verify:
   42|  5.42M|static void secp256k1_scalar_verify(const secp256k1_scalar *r) {
   43|  5.42M|    VERIFY_CHECK(secp256k1_scalar_check_overflow(r) == 0);
   44|       |
   45|  5.42M|    (void)r;
   46|  5.42M|}
secp256k1.c:secp256k1_scalar_set_b32_seckey:
   34|  56.8k|static int secp256k1_scalar_set_b32_seckey(secp256k1_scalar *r, const unsigned char *bin) {
   35|  56.8k|    int overflow;
   36|  56.8k|    secp256k1_scalar_set_b32(r, bin, &overflow);
   37|       |
   38|  56.8k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|  56.8k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
   39|  56.8k|    return (!overflow) & (!secp256k1_scalar_is_zero(r));
   40|  56.8k|}
secp256k1.c:secp256k1_scalar_clear:
   30|   113k|SECP256K1_INLINE static void secp256k1_scalar_clear(secp256k1_scalar *r) {
   31|   113k|    secp256k1_memclear_explicit(r, sizeof(secp256k1_scalar));
   32|   113k|}
secp256k1.c:secp256k1_scalar_split_lambda:
  142|  16.2k|static void secp256k1_scalar_split_lambda(secp256k1_scalar * SECP256K1_RESTRICT r1, secp256k1_scalar * SECP256K1_RESTRICT r2, const secp256k1_scalar * SECP256K1_RESTRICT k) {
  143|  16.2k|    secp256k1_scalar c1, c2;
  144|  16.2k|    static const secp256k1_scalar minus_b1 = SECP256K1_SCALAR_CONST(
  ------------------
  |  |   17|  16.2k|#define SECP256K1_SCALAR_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{((uint64_t)(d1)) << 32 | (d0), ((uint64_t)(d3)) << 32 | (d2), ((uint64_t)(d5)) << 32 | (d4), ((uint64_t)(d7)) << 32 | (d6)}}
  ------------------
  145|  16.2k|        0x00000000UL, 0x00000000UL, 0x00000000UL, 0x00000000UL,
  146|  16.2k|        0xE4437ED6UL, 0x010E8828UL, 0x6F547FA9UL, 0x0ABFE4C3UL
  147|  16.2k|    );
  148|  16.2k|    static const secp256k1_scalar minus_b2 = SECP256K1_SCALAR_CONST(
  ------------------
  |  |   17|  16.2k|#define SECP256K1_SCALAR_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{((uint64_t)(d1)) << 32 | (d0), ((uint64_t)(d3)) << 32 | (d2), ((uint64_t)(d5)) << 32 | (d4), ((uint64_t)(d7)) << 32 | (d6)}}
  ------------------
  149|  16.2k|        0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFEUL,
  150|  16.2k|        0x8A280AC5UL, 0x0774346DUL, 0xD765CDA8UL, 0x3DB1562CUL
  151|  16.2k|    );
  152|  16.2k|    static const secp256k1_scalar g1 = SECP256K1_SCALAR_CONST(
  ------------------
  |  |   17|  16.2k|#define SECP256K1_SCALAR_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{((uint64_t)(d1)) << 32 | (d0), ((uint64_t)(d3)) << 32 | (d2), ((uint64_t)(d5)) << 32 | (d4), ((uint64_t)(d7)) << 32 | (d6)}}
  ------------------
  153|  16.2k|        0x3086D221UL, 0xA7D46BCDUL, 0xE86C90E4UL, 0x9284EB15UL,
  154|  16.2k|        0x3DAA8A14UL, 0x71E8CA7FUL, 0xE893209AUL, 0x45DBB031UL
  155|  16.2k|    );
  156|  16.2k|    static const secp256k1_scalar g2 = SECP256K1_SCALAR_CONST(
  ------------------
  |  |   17|  16.2k|#define SECP256K1_SCALAR_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{((uint64_t)(d1)) << 32 | (d0), ((uint64_t)(d3)) << 32 | (d2), ((uint64_t)(d5)) << 32 | (d4), ((uint64_t)(d7)) << 32 | (d6)}}
  ------------------
  157|  16.2k|        0xE4437ED6UL, 0x010E8828UL, 0x6F547FA9UL, 0x0ABFE4C4UL,
  158|  16.2k|        0x221208ACUL, 0x9DF506C6UL, 0x1571B4AEUL, 0x8AC47F71UL
  159|  16.2k|    );
  160|  16.2k|    SECP256K1_SCALAR_VERIFY(k);
  ------------------
  |  |  103|  16.2k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  161|  16.2k|    VERIFY_CHECK(r1 != k);
  162|  16.2k|    VERIFY_CHECK(r2 != k);
  163|  16.2k|    VERIFY_CHECK(r1 != r2);
  164|       |
  165|       |    /* these _var calls are constant time since the shift amount is constant */
  166|  16.2k|    secp256k1_scalar_mul_shift_var(&c1, k, &g1, 384);
  167|  16.2k|    secp256k1_scalar_mul_shift_var(&c2, k, &g2, 384);
  168|  16.2k|    secp256k1_scalar_mul(&c1, &c1, &minus_b1);
  169|  16.2k|    secp256k1_scalar_mul(&c2, &c2, &minus_b2);
  170|  16.2k|    secp256k1_scalar_add(r2, &c1, &c2);
  171|  16.2k|    secp256k1_scalar_mul(r1, r2, &secp256k1_const_lambda);
  172|  16.2k|    secp256k1_scalar_negate(r1, r1);
  173|  16.2k|    secp256k1_scalar_add(r1, r1, k);
  174|       |
  175|  16.2k|    SECP256K1_SCALAR_VERIFY(r1);
  ------------------
  |  |  103|  16.2k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  176|  16.2k|    SECP256K1_SCALAR_VERIFY(r2);
  ------------------
  |  |  103|  16.2k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  177|       |#ifdef VERIFY
  178|       |    secp256k1_scalar_split_lambda_verify(r1, r2, k);
  179|       |#endif
  180|  16.2k|}

secp256k1_context_preallocated_destroy:
  178|      2|void secp256k1_context_preallocated_destroy(secp256k1_context* ctx) {
  179|      2|    ARG_CHECK_VOID(ctx == NULL || secp256k1_context_is_proper(ctx));
  ------------------
  |  |   52|      2|#define ARG_CHECK_VOID(cond) do { \
  |  |   53|      2|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|      4|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 2]
  |  |  |  |  |  Branch (146:39): [True: 0, False: 2]
  |  |  |  |  |  Branch (146:39): [True: 2, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   54|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   55|      0|        return; \
  |  |   56|      0|    } \
  |  |   57|      2|} while(0)
  |  |  ------------------
  |  |  |  Branch (57:9): [Folded, False: 2]
  |  |  ------------------
  ------------------
  180|       |
  181|       |    /* Defined as noop */
  182|      2|    if (ctx == NULL) {
  ------------------
  |  Branch (182:9): [True: 0, False: 2]
  ------------------
  183|      0|        return;
  184|      0|    }
  185|       |
  186|      2|    secp256k1_ecmult_gen_context_clear(&ctx->ecmult_gen_ctx);
  187|      2|}
secp256k1_context_destroy:
  189|      2|void secp256k1_context_destroy(secp256k1_context* ctx) {
  190|      2|    ARG_CHECK_VOID(ctx == NULL || secp256k1_context_is_proper(ctx));
  ------------------
  |  |   52|      2|#define ARG_CHECK_VOID(cond) do { \
  |  |   53|      2|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|      4|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 2]
  |  |  |  |  |  Branch (146:39): [True: 0, False: 2]
  |  |  |  |  |  Branch (146:39): [True: 2, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   54|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   55|      0|        return; \
  |  |   56|      0|    } \
  |  |   57|      2|} while(0)
  |  |  ------------------
  |  |  |  Branch (57:9): [Folded, False: 2]
  |  |  ------------------
  ------------------
  191|       |
  192|       |    /* Defined as noop */
  193|      2|    if (ctx == NULL) {
  ------------------
  |  Branch (193:9): [True: 0, False: 2]
  ------------------
  194|      0|        return;
  195|      0|    }
  196|       |
  197|      2|    secp256k1_context_preallocated_destroy(ctx);
  198|      2|    free(ctx);
  199|      2|}
secp256k1_ec_pubkey_parse:
  268|  16.2k|int secp256k1_ec_pubkey_parse(const secp256k1_context* ctx, secp256k1_pubkey* pubkey, const unsigned char *input, size_t inputlen) {
  269|  16.2k|    secp256k1_ge Q;
  270|       |
  271|  16.2k|    VERIFY_CHECK(ctx != NULL);
  272|  16.2k|    ARG_CHECK(pubkey != NULL);
  ------------------
  |  |   45|  16.2k|#define ARG_CHECK(cond) do { \
  |  |   46|  16.2k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  16.2k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 16.2k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  16.2k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 16.2k]
  |  |  ------------------
  ------------------
  273|  16.2k|    memset(pubkey, 0, sizeof(*pubkey));
  274|  16.2k|    ARG_CHECK(input != NULL);
  ------------------
  |  |   45|  16.2k|#define ARG_CHECK(cond) do { \
  |  |   46|  16.2k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  16.2k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 16.2k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  16.2k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 16.2k]
  |  |  ------------------
  ------------------
  275|  16.2k|    if (!secp256k1_eckey_pubkey_parse(&Q, input, inputlen)) {
  ------------------
  |  Branch (275:9): [True: 0, False: 16.2k]
  ------------------
  276|      0|        return 0;
  277|      0|    }
  278|  16.2k|    if (!secp256k1_ge_is_in_correct_subgroup(&Q)) {
  ------------------
  |  Branch (278:9): [True: 0, False: 16.2k]
  ------------------
  279|      0|        return 0;
  280|      0|    }
  281|  16.2k|    secp256k1_pubkey_save(pubkey, &Q);
  282|  16.2k|    secp256k1_ge_clear(&Q);
  283|  16.2k|    return 1;
  284|  16.2k|}
secp256k1_ec_pubkey_serialize:
  286|  18.1k|int secp256k1_ec_pubkey_serialize(const secp256k1_context* ctx, unsigned char *output, size_t *outputlen, const secp256k1_pubkey* pubkey, unsigned int flags) {
  287|  18.1k|    secp256k1_ge Q;
  288|  18.1k|    size_t len;
  289|       |
  290|  18.1k|    VERIFY_CHECK(ctx != NULL);
  291|  18.1k|    ARG_CHECK(outputlen != NULL);
  ------------------
  |  |   45|  18.1k|#define ARG_CHECK(cond) do { \
  |  |   46|  18.1k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  18.1k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 18.1k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  18.1k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 18.1k]
  |  |  ------------------
  ------------------
  292|  18.1k|    ARG_CHECK(*outputlen >= ((flags & SECP256K1_FLAGS_BIT_COMPRESSION) ? 33u : 65u));
  ------------------
  |  |   45|  18.1k|#define ARG_CHECK(cond) do { \
  |  |   46|  18.1k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  36.2k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 18.1k]
  |  |  |  |  |  Branch (146:39): [True: 16.2k, False: 1.81k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  18.1k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 18.1k]
  |  |  ------------------
  ------------------
  293|  18.1k|    len = *outputlen;
  294|  18.1k|    *outputlen = 0;
  295|  18.1k|    ARG_CHECK(output != NULL);
  ------------------
  |  |   45|  18.1k|#define ARG_CHECK(cond) do { \
  |  |   46|  18.1k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  18.1k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 18.1k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  18.1k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 18.1k]
  |  |  ------------------
  ------------------
  296|  18.1k|    memset(output, 0, len);
  297|  18.1k|    ARG_CHECK(pubkey != NULL);
  ------------------
  |  |   45|  18.1k|#define ARG_CHECK(cond) do { \
  |  |   46|  18.1k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  18.1k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 18.1k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  18.1k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 18.1k]
  |  |  ------------------
  ------------------
  298|  18.1k|    ARG_CHECK((flags & SECP256K1_FLAGS_TYPE_MASK) == SECP256K1_FLAGS_TYPE_COMPRESSION);
  ------------------
  |  |   45|  18.1k|#define ARG_CHECK(cond) do { \
  |  |   46|  18.1k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  18.1k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 18.1k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  18.1k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 18.1k]
  |  |  ------------------
  ------------------
  299|  18.1k|    if (secp256k1_pubkey_load(ctx, &Q, pubkey)) {
  ------------------
  |  Branch (299:9): [True: 18.1k, False: 0]
  ------------------
  300|  18.1k|        if (flags & SECP256K1_FLAGS_BIT_COMPRESSION) {
  ------------------
  |  |  202|  18.1k|#define SECP256K1_FLAGS_BIT_COMPRESSION (1 << 8)
  ------------------
  |  Branch (300:13): [True: 16.2k, False: 1.81k]
  ------------------
  301|  16.2k|            secp256k1_eckey_pubkey_serialize33(&Q, output);
  302|  16.2k|            *outputlen = 33;
  303|  16.2k|        } else {
  304|  1.81k|            secp256k1_eckey_pubkey_serialize65(&Q, output);
  305|  1.81k|            *outputlen = 65;
  306|  1.81k|        }
  307|  18.1k|        return 1;
  308|  18.1k|    }
  309|      0|    return 0;
  310|  18.1k|}
secp256k1_ec_pubkey_cmp:
  312|  1.81k|int secp256k1_ec_pubkey_cmp(const secp256k1_context* ctx, const secp256k1_pubkey* pubkey0, const secp256k1_pubkey* pubkey1) {
  313|  1.81k|    unsigned char out[2][33];
  314|  1.81k|    const secp256k1_pubkey* pk[2];
  315|  1.81k|    int i;
  316|       |
  317|  1.81k|    VERIFY_CHECK(ctx != NULL);
  318|  1.81k|    pk[0] = pubkey0; pk[1] = pubkey1;
  319|  5.43k|    for (i = 0; i < 2; i++) {
  ------------------
  |  Branch (319:17): [True: 3.62k, False: 1.81k]
  ------------------
  320|  3.62k|        size_t out_size = sizeof(out[i]);
  321|       |        /* If the public key is NULL or invalid, ec_pubkey_serialize will call
  322|       |         * the illegal_callback and return 0. In that case we will serialize the
  323|       |         * key as all zeros which is less than any valid public key. This
  324|       |         * results in consistent comparisons even if NULL or invalid pubkeys are
  325|       |         * involved and prevents edge cases such as sorting algorithms that use
  326|       |         * this function and do not terminate as a result. */
  327|  3.62k|        if (!secp256k1_ec_pubkey_serialize(ctx, out[i], &out_size, pk[i], SECP256K1_EC_COMPRESSED)) {
  ------------------
  |  |  216|  3.62k|#define SECP256K1_EC_COMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION | SECP256K1_FLAGS_BIT_COMPRESSION)
  |  |  ------------------
  |  |  |  |  197|  3.62k|#define SECP256K1_FLAGS_TYPE_COMPRESSION (1 << 1)
  |  |  ------------------
  |  |               #define SECP256K1_EC_COMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION | SECP256K1_FLAGS_BIT_COMPRESSION)
  |  |  ------------------
  |  |  |  |  202|  3.62k|#define SECP256K1_FLAGS_BIT_COMPRESSION (1 << 8)
  |  |  ------------------
  ------------------
  |  Branch (327:13): [True: 0, False: 3.62k]
  ------------------
  328|       |            /* Note that ec_pubkey_serialize should already set the output to
  329|       |             * zero in that case, but it's not guaranteed by the API, we can't
  330|       |             * test it and writing a VERIFY_CHECK is more complex than
  331|       |             * explicitly memsetting (again). */
  332|      0|            memset(out[i], 0, sizeof(out[i]));
  333|      0|        }
  334|  3.62k|    }
  335|  1.81k|    return secp256k1_memcmp_var(out[0], out[1], sizeof(out[0]));
  336|  1.81k|}
secp256k1_ecdsa_signature_parse_compact:
  411|  18.1k|int secp256k1_ecdsa_signature_parse_compact(const secp256k1_context* ctx, secp256k1_ecdsa_signature* sig, const unsigned char *input64) {
  412|  18.1k|    secp256k1_scalar r, s;
  413|  18.1k|    int ret = 1;
  414|  18.1k|    int overflow = 0;
  415|       |
  416|  18.1k|    VERIFY_CHECK(ctx != NULL);
  417|  18.1k|    ARG_CHECK(sig != NULL);
  ------------------
  |  |   45|  18.1k|#define ARG_CHECK(cond) do { \
  |  |   46|  18.1k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  18.1k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 18.1k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  18.1k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 18.1k]
  |  |  ------------------
  ------------------
  418|  18.1k|    ARG_CHECK(input64 != NULL);
  ------------------
  |  |   45|  18.1k|#define ARG_CHECK(cond) do { \
  |  |   46|  18.1k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  18.1k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 18.1k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  18.1k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 18.1k]
  |  |  ------------------
  ------------------
  419|       |
  420|  18.1k|    secp256k1_scalar_set_b32(&r, &input64[0], &overflow);
  421|  18.1k|    ret &= !overflow;
  422|  18.1k|    secp256k1_scalar_set_b32(&s, &input64[32], &overflow);
  423|  18.1k|    ret &= !overflow;
  424|  18.1k|    if (ret) {
  ------------------
  |  Branch (424:9): [True: 18.1k, False: 0]
  ------------------
  425|  18.1k|        secp256k1_ecdsa_signature_save(sig, &r, &s);
  426|  18.1k|    } else {
  427|      0|        memset(sig, 0, sizeof(*sig));
  428|      0|    }
  429|  18.1k|    return ret;
  430|  18.1k|}
secp256k1_ecdsa_signature_serialize_der:
  432|  5.43k|int secp256k1_ecdsa_signature_serialize_der(const secp256k1_context* ctx, unsigned char *output, size_t *outputlen, const secp256k1_ecdsa_signature* sig) {
  433|  5.43k|    secp256k1_scalar r, s;
  434|       |
  435|  5.43k|    VERIFY_CHECK(ctx != NULL);
  436|  5.43k|    ARG_CHECK(output != NULL);
  ------------------
  |  |   45|  5.43k|#define ARG_CHECK(cond) do { \
  |  |   46|  5.43k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  5.43k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 5.43k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  5.43k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 5.43k]
  |  |  ------------------
  ------------------
  437|  5.43k|    ARG_CHECK(outputlen != NULL);
  ------------------
  |  |   45|  5.43k|#define ARG_CHECK(cond) do { \
  |  |   46|  5.43k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  5.43k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 5.43k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  5.43k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 5.43k]
  |  |  ------------------
  ------------------
  438|  5.43k|    ARG_CHECK(sig != NULL);
  ------------------
  |  |   45|  5.43k|#define ARG_CHECK(cond) do { \
  |  |   46|  5.43k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  5.43k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 5.43k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  5.43k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 5.43k]
  |  |  ------------------
  ------------------
  439|       |
  440|  5.43k|    secp256k1_ecdsa_signature_load(ctx, &r, &s, sig);
  441|  5.43k|    return secp256k1_ecdsa_sig_serialize(output, outputlen, &r, &s);
  442|  5.43k|}
secp256k1_ecdsa_signature_serialize_compact:
  444|  11.1k|int secp256k1_ecdsa_signature_serialize_compact(const secp256k1_context* ctx, unsigned char *output64, const secp256k1_ecdsa_signature* sig) {
  445|  11.1k|    secp256k1_scalar r, s;
  446|       |
  447|  11.1k|    VERIFY_CHECK(ctx != NULL);
  448|  11.1k|    ARG_CHECK(output64 != NULL);
  ------------------
  |  |   45|  11.1k|#define ARG_CHECK(cond) do { \
  |  |   46|  11.1k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  11.1k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 11.1k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  11.1k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 11.1k]
  |  |  ------------------
  ------------------
  449|  11.1k|    ARG_CHECK(sig != NULL);
  ------------------
  |  |   45|  11.1k|#define ARG_CHECK(cond) do { \
  |  |   46|  11.1k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  11.1k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 11.1k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  11.1k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 11.1k]
  |  |  ------------------
  ------------------
  450|       |
  451|  11.1k|    secp256k1_ecdsa_signature_load(ctx, &r, &s, sig);
  452|  11.1k|    secp256k1_scalar_get_b32(&output64[0], &r);
  453|  11.1k|    secp256k1_scalar_get_b32(&output64[32], &s);
  454|  11.1k|    return 1;
  455|  11.1k|}
secp256k1_ecdsa_signature_normalize:
  457|  7.24k|int secp256k1_ecdsa_signature_normalize(const secp256k1_context* ctx, secp256k1_ecdsa_signature *sigout, const secp256k1_ecdsa_signature *sigin) {
  458|  7.24k|    secp256k1_scalar r, s;
  459|  7.24k|    int ret = 0;
  460|       |
  461|  7.24k|    VERIFY_CHECK(ctx != NULL);
  462|  7.24k|    ARG_CHECK(sigin != NULL);
  ------------------
  |  |   45|  7.24k|#define ARG_CHECK(cond) do { \
  |  |   46|  7.24k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  7.24k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 7.24k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  7.24k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 7.24k]
  |  |  ------------------
  ------------------
  463|       |
  464|  7.24k|    secp256k1_ecdsa_signature_load(ctx, &r, &s, sigin);
  465|  7.24k|    ret = secp256k1_scalar_is_high(&s);
  466|  7.24k|    if (sigout != NULL) {
  ------------------
  |  Branch (466:9): [True: 5.43k, False: 1.81k]
  ------------------
  467|  5.43k|        if (ret) {
  ------------------
  |  Branch (467:13): [True: 0, False: 5.43k]
  ------------------
  468|      0|            secp256k1_scalar_negate(&s, &s);
  469|      0|        }
  470|  5.43k|        secp256k1_ecdsa_signature_save(sigout, &r, &s);
  471|  5.43k|    }
  472|       |
  473|  7.24k|    return ret;
  474|  7.24k|}
secp256k1_ecdsa_verify:
  476|  10.8k|int secp256k1_ecdsa_verify(const secp256k1_context* ctx, const secp256k1_ecdsa_signature *sig, const unsigned char *msghash32, const secp256k1_pubkey *pubkey) {
  477|  10.8k|    secp256k1_ge q;
  478|  10.8k|    secp256k1_scalar r, s;
  479|  10.8k|    secp256k1_scalar m;
  480|  10.8k|    VERIFY_CHECK(ctx != NULL);
  481|  10.8k|    ARG_CHECK(msghash32 != NULL);
  ------------------
  |  |   45|  10.8k|#define ARG_CHECK(cond) do { \
  |  |   46|  10.8k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  10.8k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 10.8k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  10.8k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 10.8k]
  |  |  ------------------
  ------------------
  482|  10.8k|    ARG_CHECK(sig != NULL);
  ------------------
  |  |   45|  10.8k|#define ARG_CHECK(cond) do { \
  |  |   46|  10.8k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  10.8k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 10.8k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  10.8k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 10.8k]
  |  |  ------------------
  ------------------
  483|  10.8k|    ARG_CHECK(pubkey != NULL);
  ------------------
  |  |   45|  10.8k|#define ARG_CHECK(cond) do { \
  |  |   46|  10.8k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  10.8k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 10.8k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  10.8k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 10.8k]
  |  |  ------------------
  ------------------
  484|       |
  485|  10.8k|    secp256k1_scalar_set_b32(&m, msghash32, NULL);
  486|  10.8k|    secp256k1_ecdsa_signature_load(ctx, &r, &s, sig);
  487|  10.8k|    return (!secp256k1_scalar_is_high(&s) &&
  ------------------
  |  Branch (487:13): [True: 10.8k, False: 0]
  ------------------
  488|  10.8k|            secp256k1_pubkey_load(ctx, &q, pubkey) &&
  ------------------
  |  Branch (488:13): [True: 10.8k, False: 0]
  ------------------
  489|  10.8k|            secp256k1_ecdsa_sig_verify(&r, &s, &q, &m));
  ------------------
  |  Branch (489:13): [True: 10.8k, False: 0]
  ------------------
  490|  10.8k|}
secp256k1_ecdsa_sign:
  601|  11.1k|int secp256k1_ecdsa_sign(const secp256k1_context* ctx, secp256k1_ecdsa_signature *signature, const unsigned char *msghash32, const unsigned char *seckey, secp256k1_nonce_function noncefp, const void* noncedata) {
  602|  11.1k|    secp256k1_scalar r, s;
  603|  11.1k|    int ret;
  604|  11.1k|    VERIFY_CHECK(ctx != NULL);
  605|  11.1k|    ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
  ------------------
  |  |   45|  11.1k|#define ARG_CHECK(cond) do { \
  |  |   46|  11.1k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  11.1k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 11.1k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  11.1k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 11.1k]
  |  |  ------------------
  ------------------
  606|  11.1k|    ARG_CHECK(msghash32 != NULL);
  ------------------
  |  |   45|  11.1k|#define ARG_CHECK(cond) do { \
  |  |   46|  11.1k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  11.1k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 11.1k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  11.1k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 11.1k]
  |  |  ------------------
  ------------------
  607|  11.1k|    ARG_CHECK(signature != NULL);
  ------------------
  |  |   45|  11.1k|#define ARG_CHECK(cond) do { \
  |  |   46|  11.1k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  11.1k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 11.1k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  11.1k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 11.1k]
  |  |  ------------------
  ------------------
  608|  11.1k|    ARG_CHECK(seckey != NULL);
  ------------------
  |  |   45|  11.1k|#define ARG_CHECK(cond) do { \
  |  |   46|  11.1k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  11.1k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 11.1k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  11.1k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 11.1k]
  |  |  ------------------
  ------------------
  609|       |
  610|  11.1k|    ret = secp256k1_ecdsa_sign_inner(ctx, &r, &s, NULL, msghash32, seckey, noncefp, noncedata);
  611|  11.1k|    secp256k1_ecdsa_signature_save(signature, &r, &s);
  612|  11.1k|    return ret;
  613|  11.1k|}
secp256k1_ec_seckey_verify:
  615|  12.7k|int secp256k1_ec_seckey_verify(const secp256k1_context* ctx, const unsigned char *seckey) {
  616|  12.7k|    secp256k1_scalar sec;
  617|  12.7k|    int ret;
  618|  12.7k|    VERIFY_CHECK(ctx != NULL);
  619|  12.7k|    ARG_CHECK(seckey != NULL);
  ------------------
  |  |   45|  12.7k|#define ARG_CHECK(cond) do { \
  |  |   46|  12.7k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  12.7k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 12.7k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  12.7k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 12.7k]
  |  |  ------------------
  ------------------
  620|       |
  621|  12.7k|    ret = secp256k1_scalar_set_b32_seckey(&sec, seckey);
  622|  12.7k|    secp256k1_scalar_clear(&sec);
  623|  12.7k|    return ret;
  624|  12.7k|}
secp256k1_ec_pubkey_create:
  636|  16.2k|int secp256k1_ec_pubkey_create(const secp256k1_context* ctx, secp256k1_pubkey *pubkey, const unsigned char *seckey) {
  637|  16.2k|    secp256k1_ge p;
  638|  16.2k|    secp256k1_scalar seckey_scalar;
  639|  16.2k|    int ret = 0;
  640|  16.2k|    VERIFY_CHECK(ctx != NULL);
  641|  16.2k|    ARG_CHECK(pubkey != NULL);
  ------------------
  |  |   45|  16.2k|#define ARG_CHECK(cond) do { \
  |  |   46|  16.2k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  16.2k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 16.2k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  16.2k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 16.2k]
  |  |  ------------------
  ------------------
  642|  16.2k|    memset(pubkey, 0, sizeof(*pubkey));
  643|  16.2k|    ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
  ------------------
  |  |   45|  16.2k|#define ARG_CHECK(cond) do { \
  |  |   46|  16.2k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  16.2k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 16.2k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  16.2k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 16.2k]
  |  |  ------------------
  ------------------
  644|  16.2k|    ARG_CHECK(seckey != NULL);
  ------------------
  |  |   45|  16.2k|#define ARG_CHECK(cond) do { \
  |  |   46|  16.2k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  16.2k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 16.2k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  16.2k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 16.2k]
  |  |  ------------------
  ------------------
  645|       |
  646|  16.2k|    ret = secp256k1_ec_pubkey_create_helper(&ctx->ecmult_gen_ctx, &seckey_scalar, &p, seckey);
  647|  16.2k|    secp256k1_pubkey_save(pubkey, &p);
  648|  16.2k|    secp256k1_memczero(pubkey, sizeof(*pubkey), !ret);
  649|       |
  650|  16.2k|    secp256k1_scalar_clear(&seckey_scalar);
  651|  16.2k|    return ret;
  652|  16.2k|}
secp256k1_ec_seckey_tweak_add:
  696|  1.81k|int secp256k1_ec_seckey_tweak_add(const secp256k1_context* ctx, unsigned char *seckey, const unsigned char *tweak32) {
  697|  1.81k|    secp256k1_scalar sec;
  698|  1.81k|    int ret = 0;
  699|  1.81k|    VERIFY_CHECK(ctx != NULL);
  700|  1.81k|    ARG_CHECK(seckey != NULL);
  ------------------
  |  |   45|  1.81k|#define ARG_CHECK(cond) do { \
  |  |   46|  1.81k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  1.81k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 1.81k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  1.81k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 1.81k]
  |  |  ------------------
  ------------------
  701|  1.81k|    ARG_CHECK(tweak32 != NULL);
  ------------------
  |  |   45|  1.81k|#define ARG_CHECK(cond) do { \
  |  |   46|  1.81k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  1.81k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 1.81k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  1.81k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 1.81k]
  |  |  ------------------
  ------------------
  702|       |
  703|  1.81k|    ret = secp256k1_scalar_set_b32_seckey(&sec, seckey);
  704|  1.81k|    ret &= secp256k1_ec_seckey_tweak_add_helper(&sec, tweak32);
  705|  1.81k|    secp256k1_scalar_cmov(&sec, &secp256k1_scalar_zero, !ret);
  706|  1.81k|    secp256k1_scalar_get_b32(seckey, &sec);
  707|       |
  708|  1.81k|    secp256k1_scalar_clear(&sec);
  709|  1.81k|    return ret;
  710|  1.81k|}
secp256k1_ec_pubkey_tweak_add:
  719|  1.81k|int secp256k1_ec_pubkey_tweak_add(const secp256k1_context* ctx, secp256k1_pubkey *pubkey, const unsigned char *tweak32) {
  720|  1.81k|    secp256k1_ge p;
  721|  1.81k|    int ret = 0;
  722|  1.81k|    VERIFY_CHECK(ctx != NULL);
  723|  1.81k|    ARG_CHECK(pubkey != NULL);
  ------------------
  |  |   45|  1.81k|#define ARG_CHECK(cond) do { \
  |  |   46|  1.81k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  1.81k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 1.81k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  1.81k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 1.81k]
  |  |  ------------------
  ------------------
  724|  1.81k|    ARG_CHECK(tweak32 != NULL);
  ------------------
  |  |   45|  1.81k|#define ARG_CHECK(cond) do { \
  |  |   46|  1.81k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  1.81k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 1.81k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  1.81k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 1.81k]
  |  |  ------------------
  ------------------
  725|       |
  726|  1.81k|    ret = secp256k1_pubkey_load(ctx, &p, pubkey);
  727|  1.81k|    memset(pubkey, 0, sizeof(*pubkey));
  728|  1.81k|    ret = ret && secp256k1_ec_pubkey_tweak_add_helper(&p, tweak32);
  ------------------
  |  Branch (728:11): [True: 1.81k, False: 0]
  |  Branch (728:18): [True: 1.81k, False: 0]
  ------------------
  729|  1.81k|    if (ret) {
  ------------------
  |  Branch (729:9): [True: 1.81k, False: 0]
  ------------------
  730|  1.81k|        secp256k1_pubkey_save(pubkey, &p);
  731|  1.81k|    }
  732|       |
  733|  1.81k|    return ret;
  734|  1.81k|}
secp256k1.c:secp256k1_context_is_proper:
   83|      4|static int secp256k1_context_is_proper(const secp256k1_context* ctx) {
   84|      4|    return secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx);
   85|      4|}
secp256k1.c:secp256k1_pubkey_save:
  264|  38.0k|static void secp256k1_pubkey_save(secp256k1_pubkey* pubkey, secp256k1_ge* ge) {
  265|  38.0k|    secp256k1_ge_to_bytes(pubkey->data, ge);
  266|  38.0k|}
secp256k1.c:secp256k1_pubkey_load:
  258|  30.7k|static int secp256k1_pubkey_load(const secp256k1_context* ctx, secp256k1_ge* ge, const secp256k1_pubkey* pubkey) {
  259|  30.7k|    secp256k1_ge_from_bytes(ge, pubkey->data);
  260|  30.7k|    ARG_CHECK(!secp256k1_fe_is_zero(&ge->x));
  ------------------
  |  |   45|  30.7k|#define ARG_CHECK(cond) do { \
  |  |   46|  30.7k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  30.7k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 30.7k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  30.7k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 30.7k]
  |  |  ------------------
  ------------------
  261|  30.7k|    return 1;
  262|  30.7k|}
secp256k1.c:secp256k1_ecdsa_signature_save:
  385|  34.7k|static void secp256k1_ecdsa_signature_save(secp256k1_ecdsa_signature* sig, const secp256k1_scalar* r, const secp256k1_scalar* s) {
  386|  34.7k|    if (sizeof(secp256k1_scalar) == 32) {
  ------------------
  |  Branch (386:9): [True: 34.7k, Folded]
  ------------------
  387|  34.7k|        memcpy(&sig->data[0], r, 32);
  388|  34.7k|        memcpy(&sig->data[32], s, 32);
  389|  34.7k|    } else {
  390|      0|        secp256k1_scalar_get_b32(&sig->data[0], r);
  391|      0|        secp256k1_scalar_get_b32(&sig->data[32], s);
  392|      0|    }
  393|  34.7k|}
secp256k1.c:secp256k1_ecdsa_signature_load:
  371|  34.7k|static void secp256k1_ecdsa_signature_load(const secp256k1_context* ctx, secp256k1_scalar* r, secp256k1_scalar* s, const secp256k1_ecdsa_signature* sig) {
  372|  34.7k|    (void)ctx;
  373|  34.7k|    if (sizeof(secp256k1_scalar) == 32) {
  ------------------
  |  Branch (373:9): [True: 34.7k, Folded]
  ------------------
  374|       |        /* When the secp256k1_scalar type is exactly 32 byte, use its
  375|       |         * representation inside secp256k1_ecdsa_signature, as conversion is very fast.
  376|       |         * Note that secp256k1_ecdsa_signature_save must use the same representation. */
  377|  34.7k|        memcpy(r, &sig->data[0], 32);
  378|  34.7k|        memcpy(s, &sig->data[32], 32);
  379|  34.7k|    } else {
  380|      0|        secp256k1_scalar_set_b32(r, &sig->data[0], NULL);
  381|       |        secp256k1_scalar_set_b32(s, &sig->data[32], NULL);
  382|      0|    }
  383|  34.7k|}
secp256k1.c:nonce_function_rfc6979_impl:
  497|  12.9k|static int nonce_function_rfc6979_impl(const secp256k1_hash_ctx *hash_ctx, unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *algo16, void *data, unsigned int counter) {
  498|  12.9k|   unsigned char keydata[112];
  499|  12.9k|   unsigned int offset = 0;
  500|  12.9k|   secp256k1_rfc6979_hmac_sha256 rng;
  501|  12.9k|   unsigned int i;
  502|  12.9k|   secp256k1_scalar msg;
  503|  12.9k|   unsigned char msgmod32[32];
  504|  12.9k|   secp256k1_scalar_set_b32(&msg, msg32, NULL);
  505|  12.9k|   secp256k1_scalar_get_b32(msgmod32, &msg);
  506|       |   /* We feed a byte array to the PRNG as input, consisting of:
  507|       |    * - the private key (32 bytes) and reduced message (32 bytes), see RFC 6979 3.2d.
  508|       |    * - optionally 32 extra bytes of data, see RFC 6979 3.6 Additional Data.
  509|       |    * - optionally 16 extra bytes with the algorithm name.
  510|       |    * Because the arguments have distinct fixed lengths it is not possible for
  511|       |    *  different argument mixtures to emulate each other and result in the same
  512|       |    *  nonces.
  513|       |    */
  514|  12.9k|   buffer_append(keydata, &offset, key32, 32);
  515|  12.9k|   buffer_append(keydata, &offset, msgmod32, 32);
  516|  12.9k|   if (data != NULL) {
  ------------------
  |  Branch (516:8): [True: 5.74k, False: 7.24k]
  ------------------
  517|  5.74k|       buffer_append(keydata, &offset, data, 32);
  518|  5.74k|   }
  519|  12.9k|   if (algo16 != NULL) {
  ------------------
  |  Branch (519:8): [True: 0, False: 12.9k]
  ------------------
  520|      0|       buffer_append(keydata, &offset, algo16, 16);
  521|      0|   }
  522|  12.9k|   secp256k1_rfc6979_hmac_sha256_initialize(hash_ctx, &rng, keydata, offset);
  523|  12.9k|   for (i = 0; ; i++) {
  524|  12.9k|       secp256k1_rfc6979_hmac_sha256_generate(hash_ctx, &rng, nonce32, 32);
  525|  12.9k|       if (i == counter) break;
  ------------------
  |  Branch (525:12): [True: 12.9k, False: 0]
  ------------------
  526|  12.9k|   }
  527|  12.9k|   secp256k1_rfc6979_hmac_sha256_finalize(&rng);
  528|       |
  529|  12.9k|   secp256k1_memclear_explicit(keydata, sizeof(keydata));
  530|  12.9k|   secp256k1_rfc6979_hmac_sha256_clear(&rng);
  531|  12.9k|   return 1;
  532|  12.9k|}
secp256k1.c:buffer_append:
  492|  31.7k|static SECP256K1_INLINE void buffer_append(unsigned char *buf, unsigned int *offset, const void *data, unsigned int len) {
  493|  31.7k|    memcpy(buf + *offset, data, len);
  494|  31.7k|    *offset += len;
  495|  31.7k|}
secp256k1.c:secp256k1_ecdsa_sign_inner:
  541|  12.9k|static int secp256k1_ecdsa_sign_inner(const secp256k1_context* ctx, secp256k1_scalar* r, secp256k1_scalar* s, int* recid, const unsigned char *msg32, const unsigned char *seckey, secp256k1_nonce_function noncefp, const void* noncedata) {
  542|  12.9k|    secp256k1_scalar sec, non, msg;
  543|  12.9k|    int ret = 0;
  544|  12.9k|    int is_sec_valid;
  545|  12.9k|    unsigned char nonce32[32];
  546|  12.9k|    unsigned int count = 0;
  547|       |    /* Default initialization here is important so we won't pass uninit values to the cmov in the end */
  548|  12.9k|    *r = secp256k1_scalar_zero;
  549|  12.9k|    *s = secp256k1_scalar_zero;
  550|  12.9k|    if (recid) {
  ------------------
  |  Branch (550:9): [True: 1.81k, False: 11.1k]
  ------------------
  551|  1.81k|        *recid = 0;
  552|  1.81k|    }
  553|       |
  554|       |    /* Fail if the secret key is invalid. */
  555|  12.9k|    is_sec_valid = secp256k1_scalar_set_b32_seckey(&sec, seckey);
  556|  12.9k|    secp256k1_scalar_cmov(&sec, &secp256k1_scalar_one, !is_sec_valid);
  557|  12.9k|    secp256k1_scalar_set_b32(&msg, msg32, NULL);
  558|  12.9k|    while (1) {
  ------------------
  |  Branch (558:12): [True: 12.9k, Folded]
  ------------------
  559|  12.9k|        int is_nonce_valid;
  560|       |
  561|  12.9k|        if (noncefp == NULL || noncefp == secp256k1_nonce_function_rfc6979) {
  ------------------
  |  Branch (561:13): [True: 0, False: 12.9k]
  |  Branch (561:32): [True: 12.9k, False: 0]
  ------------------
  562|       |            /* Use ctx-aware function by default */
  563|  12.9k|            ret = nonce_function_rfc6979_impl(secp256k1_get_hash_context(ctx), nonce32, msg32, seckey, NULL, (void*)noncedata, count);
  564|  12.9k|        } else {
  565|      0|            ret = !!noncefp(nonce32, msg32, seckey, NULL, (void*)noncedata, count);
  566|      0|        }
  567|       |
  568|  12.9k|        if (!ret) {
  ------------------
  |  Branch (568:13): [True: 0, False: 12.9k]
  ------------------
  569|      0|            break;
  570|      0|        }
  571|  12.9k|        is_nonce_valid = secp256k1_scalar_set_b32_seckey(&non, nonce32);
  572|       |        /* The nonce is still secret here, but it being invalid is less likely than 1:2^255. */
  573|  12.9k|        secp256k1_declassify(ctx, &is_nonce_valid, sizeof(is_nonce_valid));
  574|  12.9k|        if (is_nonce_valid) {
  ------------------
  |  Branch (574:13): [True: 12.9k, False: 0]
  ------------------
  575|  12.9k|            ret = secp256k1_ecdsa_sig_sign(&ctx->ecmult_gen_ctx, r, s, &sec, &msg, &non, recid);
  576|       |            /* The final signature is no longer a secret, nor is the fact that we were successful or not. */
  577|  12.9k|            secp256k1_declassify(ctx, &ret, sizeof(ret));
  578|  12.9k|            if (ret) {
  ------------------
  |  Branch (578:17): [True: 12.9k, False: 0]
  ------------------
  579|  12.9k|                break;
  580|  12.9k|            }
  581|  12.9k|        }
  582|      0|        count++;
  583|      0|    }
  584|       |    /* We don't want to declassify is_sec_valid and therefore the range of
  585|       |     * seckey. As a result is_sec_valid is included in ret only after ret was
  586|       |     * used as a branching variable. */
  587|  12.9k|    ret &= is_sec_valid;
  588|  12.9k|    secp256k1_memclear_explicit(nonce32, sizeof(nonce32));
  589|  12.9k|    secp256k1_scalar_clear(&msg);
  590|  12.9k|    secp256k1_scalar_clear(&non);
  591|  12.9k|    secp256k1_scalar_clear(&sec);
  592|  12.9k|    secp256k1_scalar_cmov(r, &secp256k1_scalar_zero, !ret);
  593|  12.9k|    secp256k1_scalar_cmov(s, &secp256k1_scalar_zero, !ret);
  594|  12.9k|    if (recid) {
  ------------------
  |  Branch (594:9): [True: 1.81k, False: 11.1k]
  ------------------
  595|  1.81k|        const int zero = 0;
  596|  1.81k|        secp256k1_int_cmov(recid, &zero, !ret);
  597|  1.81k|    }
  598|  12.9k|    return ret;
  599|  12.9k|}
secp256k1.c:secp256k1_ec_pubkey_create_helper:
  626|  16.2k|static int secp256k1_ec_pubkey_create_helper(const secp256k1_ecmult_gen_context *ecmult_gen_ctx, secp256k1_scalar *seckey_scalar, secp256k1_ge *p, const unsigned char *seckey) {
  627|  16.2k|    int ret;
  628|       |
  629|  16.2k|    ret = secp256k1_scalar_set_b32_seckey(seckey_scalar, seckey);
  630|  16.2k|    secp256k1_scalar_cmov(seckey_scalar, &secp256k1_scalar_one, !ret);
  631|       |
  632|  16.2k|    secp256k1_ecmult_gen_ge(ecmult_gen_ctx, p, seckey_scalar);
  633|  16.2k|    return ret;
  634|  16.2k|}
secp256k1.c:secp256k1_ec_seckey_tweak_add_helper:
  685|  1.81k|static int secp256k1_ec_seckey_tweak_add_helper(secp256k1_scalar *sec, const unsigned char *tweak32) {
  686|  1.81k|    secp256k1_scalar term;
  687|  1.81k|    int overflow = 0;
  688|  1.81k|    int ret = 0;
  689|       |
  690|  1.81k|    secp256k1_scalar_set_b32(&term, tweak32, &overflow);
  691|  1.81k|    ret = (!overflow) & secp256k1_eckey_privkey_tweak_add(sec, &term);
  692|  1.81k|    secp256k1_scalar_clear(&term);
  693|  1.81k|    return ret;
  694|  1.81k|}
secp256k1.c:secp256k1_ec_pubkey_tweak_add_helper:
  712|  1.81k|static int secp256k1_ec_pubkey_tweak_add_helper(secp256k1_ge *p, const unsigned char *tweak32) {
  713|  1.81k|    secp256k1_scalar term;
  714|  1.81k|    int overflow = 0;
  715|  1.81k|    secp256k1_scalar_set_b32(&term, tweak32, &overflow);
  716|  1.81k|    return !overflow && secp256k1_eckey_pubkey_tweak_add(p, &term);
  ------------------
  |  Branch (716:12): [True: 1.81k, False: 0]
  |  Branch (716:25): [True: 1.81k, False: 0]
  ------------------
  717|  1.81k|}
secp256k1.c:secp256k1_get_hash_context:
  237|  12.9k|static SECP256K1_INLINE const secp256k1_hash_ctx* secp256k1_get_hash_context(const secp256k1_context *ctx) {
  238|  12.9k|    return &ctx->hash_ctx;
  239|  12.9k|}
secp256k1.c:secp256k1_declassify:
  254|  25.9k|static SECP256K1_INLINE void secp256k1_declassify(const secp256k1_context* ctx, const void *p, size_t len) {
  255|  25.9k|    if (EXPECT(ctx->declassify, 0)) SECP256K1_CHECKMEM_DEFINE(p, len);
  ------------------
  |  |  146|  25.9k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  ------------------
  |  |  |  Branch (146:21): [True: 0, False: 25.9k]
  |  |  ------------------
  ------------------
                  if (EXPECT(ctx->declassify, 0)) SECP256K1_CHECKMEM_DEFINE(p, len);
  ------------------
  |  |  106|      0|#  define SECP256K1_CHECKMEM_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|      0|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  256|  25.9k|}

secp256k1.c:secp256k1_read_be32:
  428|  4.75M|SECP256K1_INLINE static uint32_t secp256k1_read_be32(const unsigned char* p) {
  429|  4.75M|    return (uint32_t)p[0] << 24 |
  430|  4.75M|           (uint32_t)p[1] << 16 |
  431|  4.75M|           (uint32_t)p[2] << 8  |
  432|  4.75M|           (uint32_t)p[3];
  433|  4.75M|}
secp256k1.c:secp256k1_memcmp_var:
  281|  1.81k|static SECP256K1_INLINE int secp256k1_memcmp_var(const void *s1, const void *s2, size_t n) {
  282|  1.81k|    const unsigned char *p1 = s1, *p2 = s2;
  283|  1.81k|    size_t i;
  284|       |
  285|  61.5k|    for (i = 0; i < n; i++) {
  ------------------
  |  Branch (285:17): [True: 59.7k, False: 1.81k]
  ------------------
  286|  59.7k|        int diff = p1[i] - p2[i];
  287|  59.7k|        if (diff != 0) {
  ------------------
  |  Branch (287:13): [True: 0, False: 59.7k]
  ------------------
  288|      0|            return diff;
  289|      0|        }
  290|  59.7k|    }
  291|  1.81k|    return 0;
  292|  1.81k|}
secp256k1.c:secp256k1_read_be64:
  444|   614k|SECP256K1_INLINE static uint64_t secp256k1_read_be64(const unsigned char* p) {
  445|   614k|    return (uint64_t)p[0] << 56 |
  446|   614k|           (uint64_t)p[1] << 48 |
  447|   614k|           (uint64_t)p[2] << 40 |
  448|   614k|           (uint64_t)p[3] << 32 |
  449|   614k|           (uint64_t)p[4] << 24 |
  450|   614k|           (uint64_t)p[5] << 16 |
  451|   614k|           (uint64_t)p[6] << 8  |
  452|   614k|           (uint64_t)p[7];
  453|   614k|}
secp256k1.c:secp256k1_ctz64_var:
  410|  2.66M|static SECP256K1_INLINE int secp256k1_ctz64_var(uint64_t x) {
  411|  2.66M|    VERIFY_CHECK(x != 0);
  412|  2.66M|#if (__has_builtin(__builtin_ctzl) || defined(__GNUC__))
  413|       |    /* If the unsigned long type is sufficient to represent the largest uint64_t, consider __builtin_ctzl. */
  414|  2.66M|    if (((unsigned long)UINT64_MAX) == UINT64_MAX) {
  ------------------
  |  Branch (414:9): [True: 2.66M, Folded]
  ------------------
  415|  2.66M|        return __builtin_ctzl(x);
  416|  2.66M|    }
  417|      0|#endif
  418|      0|#if (__has_builtin(__builtin_ctzll) || defined(__GNUC__))
  419|       |    /* Otherwise consider __builtin_ctzll (the unsigned long long type is always at least 64 bits). */
  420|      0|    return __builtin_ctzll(x);
  421|       |#else
  422|       |    /* If no suitable CTZ builtin is available, use a (variable time) software emulation. */
  423|       |    return secp256k1_ctz64_var_debruijn(x);
  424|       |#endif
  425|  2.66M|}
secp256k1.c:secp256k1_int_cmov:
  312|  1.81k|static SECP256K1_INLINE void secp256k1_int_cmov(int *r, const int *a, int flag) {
  313|  1.81k|    unsigned int mask0, mask1, r_masked, a_masked;
  314|       |    /* Access flag with a volatile-qualified lvalue.
  315|       |       This prevents clang from figuring out (after inlining) that flag can
  316|       |       take only be 0 or 1, which leads to variable time code. */
  317|  1.81k|    volatile int vflag = flag;
  318|       |
  319|  1.81k|    VERIFY_CHECK(flag == 0 || flag == 1);
  320|       |    /* Casting a negative int to unsigned and back to int is implementation defined behavior */
  321|  1.81k|    VERIFY_CHECK(*r >= 0 && *a >= 0);
  322|       |
  323|  1.81k|    mask0 = (unsigned int)vflag + ~0u;
  324|  1.81k|    mask1 = ~mask0;
  325|  1.81k|    r_masked = ((unsigned int)*r & mask0);
  326|  1.81k|    a_masked = ((unsigned int)*a & mask1);
  327|       |
  328|  1.81k|    *r = (int)(r_masked | a_masked);
  329|  1.81k|}
secp256k1.c:secp256k1_memczero:
  220|  16.2k|static SECP256K1_INLINE void secp256k1_memczero(void *s, size_t len, int flag) {
  221|  16.2k|    unsigned char *p = (unsigned char *)s;
  222|       |    /* Access flag with a volatile-qualified lvalue.
  223|       |       This prevents clang from figuring out (after inlining) that flag can
  224|       |       take only be 0 or 1, which leads to variable time code. */
  225|  16.2k|    volatile int vflag = flag;
  226|  16.2k|    unsigned char mask = -(unsigned char) vflag;
  227|  16.2k|    VERIFY_CHECK(flag == 0 || flag == 1);
  228|  1.05M|    while (len) {
  ------------------
  |  Branch (228:12): [True: 1.04M, False: 16.2k]
  ------------------
  229|  1.04M|        *p &= ~mask;
  230|  1.04M|        p++;
  231|  1.04M|        len--;
  232|  1.04M|    }
  233|  16.2k|}
secp256k1.c:secp256k1_rotr32:
  468|  7.55M|SECP256K1_INLINE static uint32_t secp256k1_rotr32(const uint32_t x, const unsigned int by) {
  469|       |#if defined(_MSC_VER)
  470|       |    return _rotr(x, by);  /* needs <stdlib.h> */
  471|       |#else
  472|       |    /* Reduce rotation amount to avoid UB when shifting. */
  473|  7.55M|    const unsigned int mask = CHAR_BIT * sizeof(x) - 1;
  474|       |    /* Turned into a rot instruction by GCC and clang. */
  475|  7.55M|    return (x >> (by & mask)) | (x << ((-by) & mask));
  476|  7.55M|#endif
  477|  7.55M|}
secp256k1.c:secp256k1_write_be64:
  456|   396k|SECP256K1_INLINE static void secp256k1_write_be64(unsigned char* p, uint64_t x) {
  457|   396k|    p[7] = x;
  458|   396k|    p[6] = x >>  8;
  459|   396k|    p[5] = x >> 16;
  460|   396k|    p[4] = x >> 24;
  461|   396k|    p[3] = x >> 32;
  462|   396k|    p[2] = x >> 40;
  463|   396k|    p[1] = x >> 48;
  464|   396k|    p[0] = x >> 56;
  465|   396k|}
secp256k1.c:secp256k1_memclear_explicit:
  268|   458k|static SECP256K1_INLINE void secp256k1_memclear_explicit(void *ptr, size_t len) {
  269|       |    /* The current implementation zeroes, but callers must not rely on this */
  270|   458k|    secp256k1_memzero_explicit(ptr, len);
  271|       |#ifdef VERIFY
  272|       |    SECP256K1_CHECKMEM_UNDEFINE(ptr, len);
  273|       |#endif
  274|   458k|}
secp256k1.c:secp256k1_memzero_explicit:
  236|   458k|static SECP256K1_INLINE void secp256k1_memzero_explicit(void *ptr, size_t len) {
  237|       |#if defined(_MSC_VER)
  238|       |    /* SecureZeroMemory is guaranteed not to be optimized out by MSVC. */
  239|       |    SecureZeroMemory(ptr, len);
  240|       |#elif defined(__GNUC__)
  241|       |    /* We use a memory barrier that scares the compiler away from optimizing out the memset.
  242|       |     *
  243|       |     * Quoting Adam Langley <agl@google.com> in commit ad1907fe73334d6c696c8539646c21b11178f20f
  244|       |     * in BoringSSL (ISC License):
  245|       |     *    As best as we can tell, this is sufficient to break any optimisations that
  246|       |     *    might try to eliminate "superfluous" memsets.
  247|       |     * This method is used in memzero_explicit() the Linux kernel, too. Its advantage is that it
  248|       |     * is pretty efficient, because the compiler can still implement the memset() efficiently,
  249|       |     * just not remove it entirely. See "Dead Store Elimination (Still) Considered Harmful" by
  250|       |     * Yang et al. (USENIX Security 2017) for more background.
  251|       |     */
  252|   458k|    memset(ptr, 0, len);
  253|   458k|    __asm__ __volatile__("" : : "r"(ptr) : "memory");
  254|       |#else
  255|       |    void *(*volatile const volatile_memset)(void *, int, size_t) = memset;
  256|       |    volatile_memset(ptr, 0, len);
  257|       |#endif
  258|   458k|}
secp256k1.c:secp256k1_write_be32:
  436|  1.29M|SECP256K1_INLINE static void secp256k1_write_be32(unsigned char* p, uint32_t x) {
  437|  1.29M|    p[3] = x;
  438|  1.29M|    p[2] = x >>  8;
  439|  1.29M|    p[1] = x >> 16;
  440|  1.29M|    p[0] = x >> 24;
  441|  1.29M|}

_Z15ReadCompactSizeI10DataStreamEmRT_b:
  334|  1.81k|{
  335|  1.81k|    uint8_t chSize = ser_readdata8(is);
  336|  1.81k|    uint64_t nSizeRet = 0;
  337|  1.81k|    if (chSize < 253)
  ------------------
  |  Branch (337:9): [True: 1.81k, False: 0]
  ------------------
  338|  1.81k|    {
  339|  1.81k|        nSizeRet = chSize;
  340|  1.81k|    }
  341|      0|    else if (chSize == 253)
  ------------------
  |  Branch (341:14): [True: 0, False: 0]
  ------------------
  342|      0|    {
  343|      0|        nSizeRet = ser_readdata16(is);
  344|      0|        if (nSizeRet < 253)
  ------------------
  |  Branch (344:13): [True: 0, False: 0]
  ------------------
  345|      0|            throw std::ios_base::failure("non-canonical ReadCompactSize()");
  346|      0|    }
  347|      0|    else if (chSize == 254)
  ------------------
  |  Branch (347:14): [True: 0, False: 0]
  ------------------
  348|      0|    {
  349|      0|        nSizeRet = ser_readdata32(is);
  350|      0|        if (nSizeRet < 0x10000u)
  ------------------
  |  Branch (350:13): [True: 0, False: 0]
  ------------------
  351|      0|            throw std::ios_base::failure("non-canonical ReadCompactSize()");
  352|      0|    }
  353|      0|    else
  354|      0|    {
  355|      0|        nSizeRet = ser_readdata64(is);
  356|      0|        if (nSizeRet < 0x100000000ULL)
  ------------------
  |  Branch (356:13): [True: 0, False: 0]
  ------------------
  357|      0|            throw std::ios_base::failure("non-canonical ReadCompactSize()");
  358|      0|    }
  359|  1.81k|    if (range_check && nSizeRet > MAX_SIZE) {
  ------------------
  |  Branch (359:9): [True: 1.81k, False: 0]
  |  Branch (359:24): [True: 0, False: 1.81k]
  ------------------
  360|      0|        throw std::ios_base::failure("ReadCompactSize(): size too large");
  361|      0|    }
  362|  1.81k|    return nSizeRet;
  363|  1.81k|}
_Z14ser_writedata8I10DataStreamEvRT_h:
   58|  1.81k|{
   59|  1.81k|    s.write(std::as_bytes(std::span{&obj, 1}));
   60|  1.81k|}
_Z16WriteCompactSizeI10DataStreamEvRT_m:
  303|  1.81k|{
  304|  1.81k|    if (nSize < 253)
  ------------------
  |  Branch (304:9): [True: 1.81k, False: 0]
  ------------------
  305|  1.81k|    {
  306|  1.81k|        ser_writedata8(os, nSize);
  307|  1.81k|    }
  308|      0|    else if (nSize <= std::numeric_limits<uint16_t>::max())
  ------------------
  |  Branch (308:14): [True: 0, False: 0]
  ------------------
  309|      0|    {
  310|      0|        ser_writedata8(os, 253);
  311|      0|        ser_writedata16(os, nSize);
  312|      0|    }
  313|      0|    else if (nSize <= std::numeric_limits<unsigned int>::max())
  ------------------
  |  Branch (313:14): [True: 0, False: 0]
  ------------------
  314|      0|    {
  315|      0|        ser_writedata8(os, 254);
  316|      0|        ser_writedata32(os, nSize);
  317|      0|    }
  318|      0|    else
  319|      0|    {
  320|      0|        ser_writedata8(os, 255);
  321|      0|        ser_writedata64(os, nSize);
  322|      0|    }
  323|  1.81k|    return;
  324|  1.81k|}
_Z9SerializeI10DataStreamTk9BasicByteKhEvRT_NSt3__14spanIT0_Lm18446744073709551615EEE:
  261|  1.81k|template <typename Stream, BasicByte B>           void Serialize(Stream& s, std::span<B> span)         { s.write(std::as_bytes(span)); }
_Z13ser_readdata8I10DataStreamEhRT_:
   82|  1.81k|{
   83|  1.81k|    uint8_t obj;
   84|  1.81k|    s.read(std::as_writable_bytes(std::span{&obj, 1}));
   85|  1.81k|    return obj;
   86|  1.81k|}
_Z11UnserializeI10DataStreamTk9BasicBytehEvRT_NSt3__14spanIT0_Lm18446744073709551615EEE:
  277|  1.81k|template <typename Stream, BasicByte B>           void Unserialize(Stream& s, std::span<B> span)    { s.read(std::as_writable_bytes(span)); }

_Z13MakeUCharSpanINSt3__14spanIhLm18446744073709551615EEEEDTcl13UCharSpanCasttlS1_fp_EEERKT_:
  111|  3.62k|template <typename V> constexpr auto MakeUCharSpan(const V& v) -> decltype(UCharSpanCast(std::span{v})) { return UCharSpanCast(std::span{v}); }
_Z13UCharSpanCastIhLm18446744073709551615EEDaNSt3__14spanIT_XT0_EEE:
  108|  3.62k|template <typename T, size_t N> constexpr auto UCharSpanCast(std::span<T, N> s) { return std::span<std::remove_pointer_t<decltype(UCharCast(s.data()))>, N>{UCharCast(s.data()), s.size()}; }
_Z13MakeUCharSpanINSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEEEDTcl13UCharSpanCasttlNS0_4spanEfp_EEERKT_:
  111|  3.62k|template <typename V> constexpr auto MakeUCharSpan(const V& v) -> decltype(UCharSpanCast(std::span{v})) { return UCharSpanCast(std::span{v}); }
_Z13MakeUCharSpanIA8_hEDTcl13UCharSpanCasttlNSt3__14spanEfp_EEERKT_:
  111|  3.62k|template <typename V> constexpr auto MakeUCharSpan(const V& v) -> decltype(UCharSpanCast(std::span{v})) { return UCharSpanCast(std::span{v}); }
_Z13UCharSpanCastIKhLm8EEDaNSt3__14spanIT_XT0_EEE:
  108|  3.62k|template <typename T, size_t N> constexpr auto UCharSpanCast(std::span<T, N> s) { return std::span<std::remove_pointer_t<decltype(UCharCast(s.data()))>, N>{UCharCast(s.data()), s.size()}; }
_Z9UCharCastPh:
   96|  5.43k|inline unsigned char* UCharCast(unsigned char* c) { return c; }
_Z13MakeUCharSpanINSt3__16vectorIhNS0_9allocatorIhEEEEEDTcl13UCharSpanCasttlNS0_4spanEfp_EEERKT_:
  111|  3.62k|template <typename V> constexpr auto MakeUCharSpan(const V& v) -> decltype(UCharSpanCast(std::span{v})) { return UCharSpanCast(std::span{v}); }
_Z13UCharSpanCastIKcLm18446744073709551615EEDaNSt3__14spanIT_XT0_EEE:
  108|  3.62k|template <typename T, size_t N> constexpr auto UCharSpanCast(std::span<T, N> s) { return std::span<std::remove_pointer_t<decltype(UCharCast(s.data()))>, N>{UCharCast(s.data()), s.size()}; }
_Z9UCharCastPKc:
   99|  3.62k|inline const unsigned char* UCharCast(const char* c) { return reinterpret_cast<const unsigned char*>(c); }
_Z13MakeUCharSpanINSt3__14spanIKhLm18446744073709551615EEEEDTcl13UCharSpanCasttlS1_fp_EEERKT_:
  111|  23.5k|template <typename V> constexpr auto MakeUCharSpan(const V& v) -> decltype(UCharSpanCast(std::span{v})) { return UCharSpanCast(std::span{v}); }
_Z13UCharSpanCastIKhLm18446744073709551615EEDaNSt3__14spanIT_XT0_EEE:
  108|  30.7k|template <typename T, size_t N> constexpr auto UCharSpanCast(std::span<T, N> s) { return std::span<std::remove_pointer_t<decltype(UCharCast(s.data()))>, N>{UCharCast(s.data()), s.size()}; }
_Z13MakeUCharSpanI7CScriptEDTcl13UCharSpanCasttlNSt3__14spanEfp_EEERKT_:
  111|  3.62k|template <typename V> constexpr auto MakeUCharSpan(const V& v) -> decltype(UCharSpanCast(std::span{v})) { return UCharSpanCast(std::span{v}); }
_Z9UCharCastPKh:
  100|  38.0k|inline const unsigned char* UCharCast(const unsigned char* c) { return c; }
_Z12MakeByteSpanI7uint256EDaRKT_:
   85|  1.88k|{
   86|  1.88k|    return std::as_bytes(std::span{v});
   87|  1.88k|}
_Z9UCharCastPKSt4byte:
  102|  36.5k|inline const unsigned char* UCharCast(const std::byte* c) { return reinterpret_cast<const unsigned char*>(c); }

_ZN10DataStream5writeENSt3__14spanIKSt4byteLm18446744073709551615EEE:
  245|  3.62k|    {
  246|       |        // Write to the end of the buffer
  247|  3.62k|        vch.insert(vch.end(), src.begin(), src.end());
  248|  3.62k|    }
_ZN10DataStream5clearEv:
  204|  1.81k|    void clear()                                     { vch.clear(); m_read_pos = 0; }
_ZN10DataStreamC2Ev:
  182|  1.81k|    explicit DataStream() = default;
_ZN10DataStreamlsINSt3__14spanIKhLm18446744073709551615EEEEERS_RKT_:
  252|  1.81k|    {
  253|  1.81k|        ::Serialize(*this, obj);
  254|  1.81k|        return (*this);
  255|  1.81k|    }
_ZN10DataStream4readENSt3__14spanISt4byteLm18446744073709551615EEE:
  212|  3.62k|    {
  213|  3.62k|        if (dst.size() == 0) return;
  ------------------
  |  Branch (213:13): [True: 0, False: 3.62k]
  ------------------
  214|       |
  215|       |        // Read from the beginning of the buffer
  216|  3.62k|        auto next_read_pos{CheckedAdd(m_read_pos, dst.size())};
  217|  3.62k|        if (!next_read_pos.has_value() || next_read_pos.value() > vch.size()) {
  ------------------
  |  Branch (217:13): [True: 0, False: 3.62k]
  |  Branch (217:43): [True: 0, False: 3.62k]
  ------------------
  218|      0|            throw std::ios_base::failure("DataStream::read(): end of data");
  219|      0|        }
  220|  3.62k|        memcpy(dst.data(), &vch[m_read_pos], dst.size());
  221|  3.62k|        if (next_read_pos.value() == vch.size()) {
  ------------------
  |  Branch (221:13): [True: 1.81k, False: 1.81k]
  ------------------
  222|       |            // If fully consumed, reset to empty state.
  223|  1.81k|            clear();
  224|  1.81k|            return;
  225|  1.81k|        }
  226|  1.81k|        m_read_pos = next_read_pos.value();
  227|  1.81k|    }
_ZN10DataStreamrsINSt3__14spanIhLm18446744073709551615EEEEERS_OT_:
  259|  1.81k|    {
  260|  1.81k|        ::Unserialize(*this, obj);
  261|  1.81k|        return (*this);
  262|  1.81k|    }

random.cpp:_ZN16secure_allocatorIN12_GLOBAL__N_18RNGStateEE10deallocateEPS1_m:
   37|      2|    {
   38|      2|        if (p != nullptr) {
  ------------------
  |  Branch (38:13): [True: 2, False: 0]
  ------------------
   39|      2|            memory_cleanse(p, sizeof(T) * n);
   40|      2|        }
   41|      2|        LockedPoolManager::Instance().free(p);
   42|      2|    }
_Z18make_secure_uniqueINSt3__15arrayIhLm32EEEJEENS0_10unique_ptrIT_19SecureUniqueDeleterIS4_EEEDpOT0_:
   67|  19.9k|{
   68|  19.9k|    T* p = secure_allocator<T>().allocate(1);
   69|       |
   70|       |    // initialize in place, and return as secure_unique_ptr
   71|  19.9k|    try {
   72|  19.9k|        return secure_unique_ptr<T>(new (p) T(std::forward<Args>(as)...));
   73|  19.9k|    } catch (...) {
   74|      0|        secure_allocator<T>().deallocate(p, 1);
   75|      0|        throw;
   76|      0|    }
   77|  19.9k|}
_ZN16secure_allocatorINSt3__15arrayIhLm32EEEE8allocateEm:
   28|  19.9k|    {
   29|  19.9k|        T* allocation = static_cast<T*>(LockedPoolManager::Instance().alloc(sizeof(T) * n));
   30|  19.9k|        if (!allocation) {
  ------------------
  |  Branch (30:13): [True: 0, False: 19.9k]
  ------------------
   31|      0|            throw std::bad_alloc();
   32|      0|        }
   33|  19.9k|        return allocation;
   34|  19.9k|    }
_ZN19SecureUniqueDeleterINSt3__15arrayIhLm32EEEEclEPS2_:
   57|  19.9k|    void operator()(T* t) noexcept {
   58|  19.9k|        secure_allocator<T>().deallocate(t, 1);
   59|  19.9k|    }
_ZN16secure_allocatorINSt3__15arrayIhLm32EEEE10deallocateEPS2_m:
   37|  19.9k|    {
   38|  19.9k|        if (p != nullptr) {
  ------------------
  |  Branch (38:13): [True: 19.9k, False: 0]
  ------------------
   39|  19.9k|            memory_cleanse(p, sizeof(T) * n);
   40|  19.9k|        }
   41|  19.9k|        LockedPoolManager::Instance().free(p);
   42|  19.9k|    }
_ZN16secure_allocatorIhE10deallocateEPhm:
   37|  3.62k|    {
   38|  3.62k|        if (p != nullptr) {
  ------------------
  |  Branch (38:13): [True: 3.62k, False: 0]
  ------------------
   39|  3.62k|            memory_cleanse(p, sizeof(T) * n);
   40|  3.62k|        }
   41|  3.62k|        LockedPoolManager::Instance().free(p);
   42|  3.62k|    }
_ZN16secure_allocatorIhE8allocateEm:
   28|  3.62k|    {
   29|  3.62k|        T* allocation = static_cast<T*>(LockedPoolManager::Instance().alloc(sizeof(T) * n));
   30|  3.62k|        if (!allocation) {
  ------------------
  |  Branch (30:13): [True: 0, False: 3.62k]
  ------------------
   31|      0|            throw std::bad_alloc();
   32|      0|        }
   33|  3.62k|        return allocation;
   34|  3.62k|    }

_ZN25zero_after_free_allocatorISt4byteE8allocateEm:
   25|  3.62k|    {
   26|  3.62k|        return std::allocator<T>{}.allocate(n);
   27|  3.62k|    }
_ZN25zero_after_free_allocatorISt4byteE10deallocateEPS0_m:
   30|  3.62k|    {
   31|  3.62k|        if (p != nullptr)
  ------------------
  |  Branch (31:13): [True: 3.62k, False: 0]
  ------------------
   32|  3.62k|            memory_cleanse(p, sizeof(T) * n);
   33|  3.62k|        std::allocator<T>{}.deallocate(p, n);
   34|  3.62k|    }

_Z14memory_cleansePvm:
   15|  52.6k|{
   16|       |#if defined(WIN32)
   17|       |    /* SecureZeroMemory is guaranteed not to be optimized out. */
   18|       |    SecureZeroMemory(ptr, len);
   19|       |#else
   20|  52.6k|    std::memset(ptr, 0, len);
   21|       |
   22|       |    /* Memory barrier that scares the compiler away from optimizing out the memset.
   23|       |     *
   24|       |     * Quoting Adam Langley <agl@google.com> in commit ad1907fe73334d6c696c8539646c21b11178f20f
   25|       |     * in BoringSSL (ISC License):
   26|       |     *    As best as we can tell, this is sufficient to break any optimisations that
   27|       |     *    might try to eliminate "superfluous" memsets.
   28|       |     * This method is used in memzero_explicit() the Linux kernel, too. Its advantage is that it
   29|       |     * is pretty efficient because the compiler can still implement the memset() efficiently,
   30|       |     * just not remove it entirely. See "Dead Store Elimination (Still) Considered Harmful" by
   31|       |     * Yang et al. (USENIX Security 2017) for more background.
   32|       |     */
   33|  52.6k|    __asm__ __volatile__("" : : "r"(ptr) : "memory");
   34|  52.6k|#endif
   35|  52.6k|}

_ZN5ArenaD2Ev:
   48|      2|Arena::~Arena() = default;
_ZN5Arena5allocEm:
   51|  23.5k|{
   52|       |    // Round to next multiple of alignment
   53|  23.5k|    size = align_up(size, alignment);
   54|       |
   55|       |    // Don't handle zero-sized chunks
   56|  23.5k|    if (size == 0)
  ------------------
  |  Branch (56:9): [True: 0, False: 23.5k]
  ------------------
   57|      0|        return nullptr;
   58|       |
   59|       |    // Pick a large enough free-chunk. Returns an iterator pointing to the first element that is not less than key.
   60|       |    // This allocation strategy is best-fit. According to "Dynamic Storage Allocation: A Survey and Critical Review",
   61|       |    // Wilson et. al. 1995, https://www.scs.stanford.edu/14wi-cs140/sched/readings/wilson.pdf, best-fit and first-fit
   62|       |    // policies seem to work well in practice.
   63|  23.5k|    auto size_ptr_it = size_to_free_chunk.lower_bound(size);
   64|  23.5k|    if (size_ptr_it == size_to_free_chunk.end())
  ------------------
  |  Branch (64:9): [True: 0, False: 23.5k]
  ------------------
   65|      0|        return nullptr;
   66|       |
   67|       |    // Create the used-chunk, taking its space from the end of the free-chunk
   68|  23.5k|    const size_t size_remaining = size_ptr_it->first - size;
   69|  23.5k|    char* const free_chunk = static_cast<char*>(size_ptr_it->second);
   70|  23.5k|    auto allocated = chunks_used.emplace(free_chunk + size_remaining, size).first;
   71|  23.5k|    chunks_free_end.erase(free_chunk + size_ptr_it->first);
   72|  23.5k|    if (size_ptr_it->first == size) {
  ------------------
  |  Branch (72:9): [True: 0, False: 23.5k]
  ------------------
   73|       |        // whole chunk is used up
   74|      0|        chunks_free.erase(size_ptr_it->second);
   75|  23.5k|    } else {
   76|       |        // still some memory left in the chunk
   77|  23.5k|        auto it_remaining = size_to_free_chunk.emplace(size_remaining, size_ptr_it->second);
   78|  23.5k|        chunks_free[size_ptr_it->second] = it_remaining;
   79|  23.5k|        chunks_free_end.emplace(free_chunk + size_remaining, it_remaining);
   80|  23.5k|    }
   81|  23.5k|    size_to_free_chunk.erase(size_ptr_it);
   82|       |
   83|  23.5k|    return allocated->first;
   84|  23.5k|}
_ZN5Arena4freeEPv:
   87|  23.5k|{
   88|       |    // Freeing the nullptr pointer is OK.
   89|  23.5k|    if (ptr == nullptr) {
  ------------------
  |  Branch (89:9): [True: 0, False: 23.5k]
  ------------------
   90|      0|        return;
   91|      0|    }
   92|       |
   93|       |    // Remove chunk from used map
   94|  23.5k|    auto i = chunks_used.find(ptr);
   95|  23.5k|    if (i == chunks_used.end()) {
  ------------------
  |  Branch (95:9): [True: 0, False: 23.5k]
  ------------------
   96|      0|        throw std::runtime_error("Arena: invalid or double free");
   97|      0|    }
   98|  23.5k|    auto freed = std::make_pair(static_cast<char*>(i->first), i->second);
   99|  23.5k|    chunks_used.erase(i);
  100|       |
  101|       |    // coalesce freed with previous chunk
  102|  23.5k|    auto prev = chunks_free_end.find(freed.first);
  103|  23.5k|    if (prev != chunks_free_end.end()) {
  ------------------
  |  Branch (103:9): [True: 21.7k, False: 1.81k]
  ------------------
  104|  21.7k|        freed.first -= prev->second->first;
  105|  21.7k|        freed.second += prev->second->first;
  106|  21.7k|        size_to_free_chunk.erase(prev->second);
  107|  21.7k|        chunks_free_end.erase(prev);
  108|  21.7k|    }
  109|       |
  110|       |    // coalesce freed with chunk after freed
  111|  23.5k|    auto next = chunks_free.find(freed.first + freed.second);
  112|  23.5k|    if (next != chunks_free.end()) {
  ------------------
  |  Branch (112:9): [True: 1.81k, False: 21.7k]
  ------------------
  113|  1.81k|        freed.second += next->second->first;
  114|  1.81k|        size_to_free_chunk.erase(next->second);
  115|  1.81k|        chunks_free.erase(next);
  116|  1.81k|    }
  117|       |
  118|       |    // Add/set space with coalesced free chunk
  119|  23.5k|    auto it = size_to_free_chunk.emplace(freed.second, freed.first);
  120|  23.5k|    chunks_free[freed.first] = it;
  121|  23.5k|    chunks_free_end[freed.first + freed.second] = it;
  122|  23.5k|}
_ZN24PosixLockedPageAllocator10FreeLockedEPvm:
  254|      2|{
  255|      2|    len = align_up(len, page_size);
  256|      2|    memory_cleanse(addr, len);
  257|      2|    munlock(addr, len);
  258|      2|    munmap(addr, len);
  259|      2|}
_ZN10LockedPoolD2Ev:
  283|      2|LockedPool::~LockedPool() = default;
_ZN10LockedPool5allocEm:
  286|  23.5k|{
  287|  23.5k|    std::lock_guard<std::mutex> lock(mutex);
  288|       |
  289|       |    // Don't handle impossible sizes
  290|  23.5k|    if (size == 0 || size > ARENA_SIZE)
  ------------------
  |  Branch (290:9): [True: 0, False: 23.5k]
  |  Branch (290:22): [True: 0, False: 23.5k]
  ------------------
  291|      0|        return nullptr;
  292|       |
  293|       |    // Try allocating from each current arena
  294|  23.5k|    for (auto &arena: arenas) {
  ------------------
  |  Branch (294:21): [True: 23.5k, False: 0]
  ------------------
  295|  23.5k|        void *addr = arena.alloc(size);
  296|  23.5k|        if (addr) {
  ------------------
  |  Branch (296:13): [True: 23.5k, False: 0]
  ------------------
  297|  23.5k|            return addr;
  298|  23.5k|        }
  299|  23.5k|    }
  300|       |    // If that fails, create a new one
  301|      0|    if (new_arena(ARENA_SIZE, ARENA_ALIGN)) {
  ------------------
  |  Branch (301:9): [True: 0, False: 0]
  ------------------
  302|      0|        return arenas.back().alloc(size);
  303|      0|    }
  304|      0|    return nullptr;
  305|      0|}
_ZN10LockedPool4freeEPv:
  308|  23.5k|{
  309|  23.5k|    std::lock_guard<std::mutex> lock(mutex);
  310|       |    // TODO we can do better than this linear search by keeping a map of arena
  311|       |    // extents to arena, and looking up the address.
  312|  23.5k|    for (auto &arena: arenas) {
  ------------------
  |  Branch (312:21): [True: 23.5k, False: 0]
  ------------------
  313|  23.5k|        if (arena.addressInArena(ptr)) {
  ------------------
  |  Branch (313:13): [True: 23.5k, False: 0]
  ------------------
  314|  23.5k|            arena.free(ptr);
  315|  23.5k|            return;
  316|  23.5k|        }
  317|  23.5k|    }
  318|      0|    throw std::runtime_error("LockedPool: invalid address not pointing to any arena");
  319|  23.5k|}
_ZN10LockedPool15LockedPageArenaD2Ev:
  370|      2|{
  371|      2|    allocator->FreeLocked(base, size);
  372|      2|}
_ZN17LockedPoolManager8InstanceEv:
  405|  47.0k|{
  406|  47.0k|    static std::once_flag init_flag;
  407|  47.0k|    std::call_once(init_flag, LockedPoolManager::CreateInstance);
  408|  47.0k|    return *LockedPoolManager::_instance;
  409|  47.0k|}
lockedpool.cpp:_ZL8align_upmm:
   32|  23.5k|{
   33|  23.5k|    return (x + align - 1) & ~(align - 1);
   34|  23.5k|}

_ZNK5Arena14addressInArenaEPv:
   90|  23.5k|    bool addressInArena(void *ptr) const { return ptr >= base && ptr < end; }
  ------------------
  |  Branch (90:51): [True: 23.5k, False: 0]
  |  Branch (90:66): [True: 23.5k, False: 0]
  ------------------
_ZN19LockedPageAllocatorD2Ev:
   22|      2|    virtual ~LockedPageAllocator() = default;

_ZN14AnnotatedMixinINSt3__115recursive_mutexEED2Ev:
   96|  3.62k|    ~AnnotatedMixin() {
   97|  3.62k|        DeleteLock((void*)this);
   98|  3.62k|    }
_Z17MaybeCheckNotHeldI14AnnotatedMixinINSt3__115recursive_mutexEEERT_S5_:
  264|  19.9k|inline MutexType& MaybeCheckNotHeld(MutexType& m) LOCKS_EXCLUDED(m) LOCK_RETURNED(m) { return m; }
_Z13EnterCriticalINSt3__115recursive_mutexEEvPKcS3_iPT_b:
   67|  19.9k|inline void EnterCritical(const char* pszName, const char* pszFile, int nLine, MutexType* cs, bool fTry = false) {}
_ZN10UniqueLockI14AnnotatedMixinINSt3__115recursive_mutexEEE5EnterEPKcS6_i:
  159|  19.9k|    {
  160|  19.9k|        EnterCritical(pszName, pszFile, nLine, Base::mutex());
  161|       |#ifdef DEBUG_LOCKCONTENTION
  162|       |        if (!Base::try_lock()) {
  163|       |            ContendedLock(pszName, pszFile, nLine, static_cast<Base&>(*this));
  164|       |        }
  165|       |#else
  166|  19.9k|        Base::lock();
  167|  19.9k|#endif
  168|  19.9k|    }
_ZN10UniqueLockI14AnnotatedMixinINSt3__115recursive_mutexEEEC2ERS3_PKcS7_ib:
  181|  19.9k|    UniqueLock(MutexType& mutexIn, const char* pszName, const char* pszFile, int nLine, bool fTry = false) EXCLUSIVE_LOCK_FUNCTION(mutexIn) : Base(mutexIn, std::defer_lock)
  182|  19.9k|    {
  183|  19.9k|        if (fTry)
  ------------------
  |  Branch (183:13): [True: 0, False: 19.9k]
  ------------------
  184|      0|            TryEnter(pszName, pszFile, nLine);
  185|  19.9k|        else
  186|  19.9k|            Enter(pszName, pszFile, nLine);
  187|  19.9k|    }
_ZN10UniqueLockI14AnnotatedMixinINSt3__115recursive_mutexEEED2Ev:
  201|  19.9k|    {
  202|  19.9k|        if (Base::owns_lock())
  ------------------
  |  Branch (202:13): [True: 19.9k, False: 0]
  ------------------
  203|  19.9k|            LeaveCritical();
  204|  19.9k|    }
_Z22AssertLockHeldInternalI14AnnotatedMixinINSt3__115recursive_mutexEEEvPKcS5_iPT_:
   71|  3.62k|inline void AssertLockHeldInternal(const char* pszName, const char* pszFile, int nLine, MutexType* cs) EXCLUSIVE_LOCKS_REQUIRED(cs) {}
_ZN14AnnotatedMixinINSt3__15mutexEED2Ev:
   96|     64|    ~AnnotatedMixin() {
   97|     64|        DeleteLock((void*)this);
   98|     64|    }
_Z10DeleteLockPv:
   74|  3.68k|inline void DeleteLock(void* cs) {}
_Z17MaybeCheckNotHeldR14AnnotatedMixinINSt3__15mutexEE:
  258|  5.53k|inline Mutex& MaybeCheckNotHeld(Mutex& cs) EXCLUSIVE_LOCKS_REQUIRED(!cs) LOCK_RETURNED(cs) { return cs; }
_ZN10UniqueLockI14AnnotatedMixinINSt3__15mutexEEEC2ERS3_PKcS7_ib:
  181|  5.53k|    UniqueLock(MutexType& mutexIn, const char* pszName, const char* pszFile, int nLine, bool fTry = false) EXCLUSIVE_LOCK_FUNCTION(mutexIn) : Base(mutexIn, std::defer_lock)
  182|  5.53k|    {
  183|  5.53k|        if (fTry)
  ------------------
  |  Branch (183:13): [True: 0, False: 5.53k]
  ------------------
  184|      0|            TryEnter(pszName, pszFile, nLine);
  185|  5.53k|        else
  186|  5.53k|            Enter(pszName, pszFile, nLine);
  187|  5.53k|    }
_Z13EnterCriticalINSt3__15mutexEEvPKcS3_iPT_b:
   67|  5.53k|inline void EnterCritical(const char* pszName, const char* pszFile, int nLine, MutexType* cs, bool fTry = false) {}
_Z13LeaveCriticalv:
   68|  25.4k|inline void LeaveCritical() {}
_ZN10UniqueLockI14AnnotatedMixinINSt3__15mutexEEE5EnterEPKcS6_i:
  159|  5.53k|    {
  160|  5.53k|        EnterCritical(pszName, pszFile, nLine, Base::mutex());
  161|       |#ifdef DEBUG_LOCKCONTENTION
  162|       |        if (!Base::try_lock()) {
  163|       |            ContendedLock(pszName, pszFile, nLine, static_cast<Base&>(*this));
  164|       |        }
  165|       |#else
  166|  5.53k|        Base::lock();
  167|  5.53k|#endif
  168|  5.53k|    }
_ZN10UniqueLockI14AnnotatedMixinINSt3__15mutexEEED2Ev:
  201|  5.53k|    {
  202|  5.53k|        if (Base::owns_lock())
  ------------------
  |  Branch (202:13): [True: 5.53k, False: 0]
  ------------------
  203|  5.53k|            LeaveCritical();
  204|  5.53k|    }

LLVMFuzzerTestOneInput:
  213|  1.88k|{
  214|  1.88k|    test_one_input({data, size});
  215|  1.88k|    return 0;
  216|  1.88k|}
fuzz.cpp:_ZL14test_one_inputNSt3__14spanIKhLm18446744073709551615EEE:
   84|  1.88k|{
   85|  1.88k|    CheckGlobals check{};
   86|  1.88k|    (*Assert(g_test_one_input))(buffer);
  ------------------
  |  |  116|  1.88k|#define Assert(val) inline_assertion_check<true>(val, std::source_location::current(), #val)
  ------------------
   87|  1.88k|}

_Z15key_fuzz_targetNSt3__14spanIKhLm18446744073709551615EEE:
   41|  1.88k|{
   42|  1.88k|    SeedRandomStateForTest(SeedRand::ZEROS);
   43|  1.88k|    const CKey key = [&] {
   44|  1.88k|        CKey k;
   45|  1.88k|        k.Set(buffer.begin(), buffer.end(), true);
   46|  1.88k|        return k;
   47|  1.88k|    }();
   48|  1.88k|    if (!key.IsValid()) {
  ------------------
  |  Branch (48:9): [True: 75, False: 1.81k]
  ------------------
   49|     75|        return;
   50|     75|    }
   51|       |
   52|  1.81k|    {
   53|  1.81k|        assert(key.begin() + key.size() == key.end());
  ------------------
  |  Branch (53:9): [True: 1.81k, False: 0]
  ------------------
   54|  1.81k|        assert(key.IsCompressed());
  ------------------
  |  Branch (54:9): [True: 1.81k, False: 0]
  ------------------
   55|  1.81k|        assert(key.size() == 32);
  ------------------
  |  Branch (55:9): [True: 1.81k, False: 0]
  ------------------
   56|  1.81k|        assert(DecodeSecret(EncodeSecret(key)) == key);
  ------------------
  |  Branch (56:9): [True: 1.81k, False: 0]
  ------------------
   57|  1.81k|    }
   58|       |
   59|  1.81k|    {
   60|  1.81k|        CKey invalid_key;
   61|  1.81k|        assert(!(invalid_key == key));
  ------------------
  |  Branch (61:9): [True: 1.81k, False: 0]
  ------------------
   62|  1.81k|        assert(!invalid_key.IsCompressed());
  ------------------
  |  Branch (62:9): [True: 1.81k, False: 0]
  ------------------
   63|  1.81k|        assert(!invalid_key.IsValid());
  ------------------
  |  Branch (63:9): [True: 1.81k, False: 0]
  ------------------
   64|  1.81k|        assert(invalid_key.size() == 0);
  ------------------
  |  Branch (64:9): [True: 1.81k, False: 0]
  ------------------
   65|  1.81k|    }
   66|       |
   67|  1.81k|    {
   68|  1.81k|        CKey uncompressed_key;
   69|  1.81k|        uncompressed_key.Set(buffer.begin(), buffer.end(), false);
   70|  1.81k|        assert(!(uncompressed_key == key));
  ------------------
  |  Branch (70:9): [True: 1.81k, False: 0]
  ------------------
   71|  1.81k|        assert(!uncompressed_key.IsCompressed());
  ------------------
  |  Branch (71:9): [True: 1.81k, False: 0]
  ------------------
   72|  1.81k|        assert(key.size() == 32);
  ------------------
  |  Branch (72:9): [True: 1.81k, False: 0]
  ------------------
   73|  1.81k|        assert(uncompressed_key.begin() + uncompressed_key.size() == uncompressed_key.end());
  ------------------
  |  Branch (73:9): [True: 1.81k, False: 0]
  ------------------
   74|  1.81k|        assert(uncompressed_key.IsValid());
  ------------------
  |  Branch (74:9): [True: 1.81k, False: 0]
  ------------------
   75|  1.81k|    }
   76|       |
   77|  1.81k|    {
   78|  1.81k|        CKey copied_key;
   79|  1.81k|        copied_key.Set(key.begin(), key.end(), key.IsCompressed());
   80|  1.81k|        assert(copied_key == key);
  ------------------
  |  Branch (80:9): [True: 1.81k, False: 0]
  ------------------
   81|  1.81k|    }
   82|       |
   83|  1.81k|    const uint256 random_uint256 = Hash(buffer);
   84|       |
   85|  1.81k|    {
   86|  1.81k|        CKey child_key;
   87|  1.81k|        ChainCode child_chaincode;
   88|  1.81k|        const bool ok = key.Derive(child_key, child_chaincode, 0, ChainCode{random_uint256});
   89|  1.81k|        assert(ok);
  ------------------
  |  Branch (89:9): [True: 1.81k, False: 0]
  ------------------
   90|  1.81k|        assert(child_key.IsValid());
  ------------------
  |  Branch (90:9): [True: 1.81k, False: 0]
  ------------------
   91|  1.81k|        assert(!(child_key == key));
  ------------------
  |  Branch (91:9): [True: 1.81k, False: 0]
  ------------------
   92|  1.81k|        assert(child_chaincode != random_uint256);
  ------------------
  |  Branch (92:9): [True: 1.81k, False: 0]
  ------------------
   93|  1.81k|    }
   94|       |
   95|  1.81k|    const CPubKey pubkey = key.GetPubKey();
   96|       |
   97|  1.81k|    {
   98|  1.81k|        assert(pubkey.size() == 33);
  ------------------
  |  Branch (98:9): [True: 1.81k, False: 0]
  ------------------
   99|  1.81k|        assert(key.VerifyPubKey(pubkey));
  ------------------
  |  Branch (99:9): [True: 1.81k, False: 0]
  ------------------
  100|  1.81k|        assert(pubkey.GetHash() != random_uint256);
  ------------------
  |  Branch (100:9): [True: 1.81k, False: 0]
  ------------------
  101|  1.81k|        assert(pubkey.begin() + pubkey.size() == pubkey.end());
  ------------------
  |  Branch (101:9): [True: 1.81k, False: 0]
  ------------------
  102|  1.81k|        assert(pubkey.data() == pubkey.begin());
  ------------------
  |  Branch (102:9): [True: 1.81k, False: 0]
  ------------------
  103|  1.81k|        assert(pubkey.IsCompressed());
  ------------------
  |  Branch (103:9): [True: 1.81k, False: 0]
  ------------------
  104|  1.81k|        assert(pubkey.IsValid());
  ------------------
  |  Branch (104:9): [True: 1.81k, False: 0]
  ------------------
  105|  1.81k|        assert(pubkey.IsFullyValid());
  ------------------
  |  Branch (105:9): [True: 1.81k, False: 0]
  ------------------
  106|  1.81k|        assert(HexToPubKey(HexStr(pubkey)) == pubkey);
  ------------------
  |  Branch (106:9): [True: 1.81k, False: 0]
  ------------------
  107|  1.81k|    }
  108|       |
  109|  1.81k|    {
  110|  1.81k|        DataStream data_stream{};
  111|  1.81k|        pubkey.Serialize(data_stream);
  112|       |
  113|  1.81k|        CPubKey pubkey_deserialized;
  114|  1.81k|        pubkey_deserialized.Unserialize(data_stream);
  115|  1.81k|        assert(pubkey_deserialized == pubkey);
  ------------------
  |  Branch (115:9): [True: 1.81k, False: 0]
  ------------------
  116|  1.81k|    }
  117|       |
  118|  1.81k|    {
  119|  1.81k|        const CScript tx_pubkey_script = GetScriptForRawPubKey(pubkey);
  120|  1.81k|        assert(!tx_pubkey_script.IsPayToScriptHash());
  ------------------
  |  Branch (120:9): [True: 1.81k, False: 0]
  ------------------
  121|  1.81k|        assert(!tx_pubkey_script.IsPayToWitnessScriptHash());
  ------------------
  |  Branch (121:9): [True: 1.81k, False: 0]
  ------------------
  122|  1.81k|        assert(!tx_pubkey_script.IsPushOnly());
  ------------------
  |  Branch (122:9): [True: 1.81k, False: 0]
  ------------------
  123|  1.81k|        assert(!tx_pubkey_script.IsUnspendable());
  ------------------
  |  Branch (123:9): [True: 1.81k, False: 0]
  ------------------
  124|  1.81k|        assert(tx_pubkey_script.HasValidOps());
  ------------------
  |  Branch (124:9): [True: 1.81k, False: 0]
  ------------------
  125|  1.81k|        assert(tx_pubkey_script.size() == 35);
  ------------------
  |  Branch (125:9): [True: 1.81k, False: 0]
  ------------------
  126|       |
  127|  1.81k|        const CScript tx_multisig_script = GetScriptForMultisig(1, {pubkey});
  128|  1.81k|        assert(!tx_multisig_script.IsPayToScriptHash());
  ------------------
  |  Branch (128:9): [True: 1.81k, False: 0]
  ------------------
  129|  1.81k|        assert(!tx_multisig_script.IsPayToWitnessScriptHash());
  ------------------
  |  Branch (129:9): [True: 1.81k, False: 0]
  ------------------
  130|  1.81k|        assert(!tx_multisig_script.IsPushOnly());
  ------------------
  |  Branch (130:9): [True: 1.81k, False: 0]
  ------------------
  131|  1.81k|        assert(!tx_multisig_script.IsUnspendable());
  ------------------
  |  Branch (131:9): [True: 1.81k, False: 0]
  ------------------
  132|  1.81k|        assert(tx_multisig_script.HasValidOps());
  ------------------
  |  Branch (132:9): [True: 1.81k, False: 0]
  ------------------
  133|  1.81k|        assert(tx_multisig_script.size() == 37);
  ------------------
  |  Branch (133:9): [True: 1.81k, False: 0]
  ------------------
  134|       |
  135|  1.81k|        FillableSigningProvider fillable_signing_provider;
  136|  1.81k|        assert(!IsSegWitOutput(fillable_signing_provider, tx_pubkey_script));
  ------------------
  |  Branch (136:9): [True: 1.81k, False: 0]
  ------------------
  137|  1.81k|        assert(!IsSegWitOutput(fillable_signing_provider, tx_multisig_script));
  ------------------
  |  Branch (137:9): [True: 1.81k, False: 0]
  ------------------
  138|  1.81k|        assert(fillable_signing_provider.GetKeys().size() == 0);
  ------------------
  |  Branch (138:9): [True: 1.81k, False: 0]
  ------------------
  139|  1.81k|        assert(!fillable_signing_provider.HaveKey(pubkey.GetID()));
  ------------------
  |  Branch (139:9): [True: 1.81k, False: 0]
  ------------------
  140|       |
  141|  1.81k|        const bool ok_add_key = fillable_signing_provider.AddKey(key);
  142|  1.81k|        assert(ok_add_key);
  ------------------
  |  Branch (142:9): [True: 1.81k, False: 0]
  ------------------
  143|  1.81k|        assert(fillable_signing_provider.HaveKey(pubkey.GetID()));
  ------------------
  |  Branch (143:9): [True: 1.81k, False: 0]
  ------------------
  144|       |
  145|  1.81k|        FillableSigningProvider fillable_signing_provider_pub;
  146|  1.81k|        assert(!fillable_signing_provider_pub.HaveKey(pubkey.GetID()));
  ------------------
  |  Branch (146:9): [True: 1.81k, False: 0]
  ------------------
  147|       |
  148|  1.81k|        const bool ok_add_key_pubkey = fillable_signing_provider_pub.AddKeyPubKey(key, pubkey);
  149|  1.81k|        assert(ok_add_key_pubkey);
  ------------------
  |  Branch (149:9): [True: 1.81k, False: 0]
  ------------------
  150|  1.81k|        assert(fillable_signing_provider_pub.HaveKey(pubkey.GetID()));
  ------------------
  |  Branch (150:9): [True: 1.81k, False: 0]
  ------------------
  151|       |
  152|  1.81k|        TxoutType which_type_tx_pubkey;
  153|  1.81k|        const bool is_standard_tx_pubkey = IsStandard(tx_pubkey_script, which_type_tx_pubkey);
  154|  1.81k|        assert(is_standard_tx_pubkey);
  ------------------
  |  Branch (154:9): [True: 1.81k, False: 0]
  ------------------
  155|  1.81k|        assert(which_type_tx_pubkey == TxoutType::PUBKEY);
  ------------------
  |  Branch (155:9): [True: 1.81k, False: 0]
  ------------------
  156|       |
  157|  1.81k|        TxoutType which_type_tx_multisig;
  158|  1.81k|        const bool is_standard_tx_multisig = IsStandard(tx_multisig_script, which_type_tx_multisig);
  159|  1.81k|        assert(is_standard_tx_multisig);
  ------------------
  |  Branch (159:9): [True: 1.81k, False: 0]
  ------------------
  160|  1.81k|        assert(which_type_tx_multisig == TxoutType::MULTISIG);
  ------------------
  |  Branch (160:9): [True: 1.81k, False: 0]
  ------------------
  161|       |
  162|  1.81k|        std::vector<std::vector<unsigned char>> v_solutions_ret_tx_pubkey;
  163|  1.81k|        const TxoutType outtype_tx_pubkey = Solver(tx_pubkey_script, v_solutions_ret_tx_pubkey);
  164|  1.81k|        assert(outtype_tx_pubkey == TxoutType::PUBKEY);
  ------------------
  |  Branch (164:9): [True: 1.81k, False: 0]
  ------------------
  165|  1.81k|        assert(v_solutions_ret_tx_pubkey.size() == 1);
  ------------------
  |  Branch (165:9): [True: 1.81k, False: 0]
  ------------------
  166|  1.81k|        assert(v_solutions_ret_tx_pubkey[0].size() == 33);
  ------------------
  |  Branch (166:9): [True: 1.81k, False: 0]
  ------------------
  167|       |
  168|  1.81k|        std::vector<std::vector<unsigned char>> v_solutions_ret_tx_multisig;
  169|  1.81k|        const TxoutType outtype_tx_multisig = Solver(tx_multisig_script, v_solutions_ret_tx_multisig);
  170|  1.81k|        assert(outtype_tx_multisig == TxoutType::MULTISIG);
  ------------------
  |  Branch (170:9): [True: 1.81k, False: 0]
  ------------------
  171|  1.81k|        assert(v_solutions_ret_tx_multisig.size() == 3);
  ------------------
  |  Branch (171:9): [True: 1.81k, False: 0]
  ------------------
  172|  1.81k|        assert(v_solutions_ret_tx_multisig[0].size() == 1);
  ------------------
  |  Branch (172:9): [True: 1.81k, False: 0]
  ------------------
  173|  1.81k|        assert(v_solutions_ret_tx_multisig[1].size() == 33);
  ------------------
  |  Branch (173:9): [True: 1.81k, False: 0]
  ------------------
  174|  1.81k|        assert(v_solutions_ret_tx_multisig[2].size() == 1);
  ------------------
  |  Branch (174:9): [True: 1.81k, False: 0]
  ------------------
  175|       |
  176|  1.81k|        OutputType output_type{};
  177|  1.81k|        const CTxDestination tx_destination{PKHash{pubkey}};
  178|  1.81k|        assert(output_type == OutputType::LEGACY);
  ------------------
  |  Branch (178:9): [True: 1.81k, False: 0]
  ------------------
  179|  1.81k|        assert(IsValidDestination(tx_destination));
  ------------------
  |  Branch (179:9): [True: 1.81k, False: 0]
  ------------------
  180|  1.81k|        assert(PKHash{pubkey} == *std::get_if<PKHash>(&tx_destination));
  ------------------
  |  Branch (180:9): [True: 1.81k, False: 0]
  ------------------
  181|       |
  182|  1.81k|        const CScript script_for_destination = GetScriptForDestination(tx_destination);
  183|  1.81k|        assert(script_for_destination.size() == 25);
  ------------------
  |  Branch (183:9): [True: 1.81k, False: 0]
  ------------------
  184|       |
  185|  1.81k|        const std::string destination_address = EncodeDestination(tx_destination);
  186|  1.81k|        assert(DecodeDestination(destination_address) == tx_destination);
  ------------------
  |  Branch (186:9): [True: 1.81k, False: 0]
  ------------------
  187|       |
  188|  1.81k|        CKeyID key_id = pubkey.GetID();
  189|  1.81k|        assert(!key_id.IsNull());
  ------------------
  |  Branch (189:9): [True: 1.81k, False: 0]
  ------------------
  190|  1.81k|        assert(key_id == CKeyID{key_id});
  ------------------
  |  Branch (190:9): [True: 1.81k, False: 0]
  ------------------
  191|  1.81k|        assert(key_id == GetKeyForDestination(fillable_signing_provider, tx_destination));
  ------------------
  |  Branch (191:9): [True: 1.81k, False: 0]
  ------------------
  192|       |
  193|  1.81k|        CPubKey pubkey_out;
  194|  1.81k|        const bool ok_get_pubkey = fillable_signing_provider.GetPubKey(key_id, pubkey_out);
  195|  1.81k|        assert(ok_get_pubkey);
  ------------------
  |  Branch (195:9): [True: 1.81k, False: 0]
  ------------------
  196|       |
  197|  1.81k|        CKey key_out;
  198|  1.81k|        const bool ok_get_key = fillable_signing_provider.GetKey(key_id, key_out);
  199|  1.81k|        assert(ok_get_key);
  ------------------
  |  Branch (199:9): [True: 1.81k, False: 0]
  ------------------
  200|  1.81k|        assert(fillable_signing_provider.GetKeys().size() == 1);
  ------------------
  |  Branch (200:9): [True: 1.81k, False: 0]
  ------------------
  201|  1.81k|        assert(fillable_signing_provider.HaveKey(key_id));
  ------------------
  |  Branch (201:9): [True: 1.81k, False: 0]
  ------------------
  202|       |
  203|  1.81k|        KeyOriginInfo key_origin_info;
  204|  1.81k|        const bool ok_get_key_origin = fillable_signing_provider.GetKeyOrigin(key_id, key_origin_info);
  205|  1.81k|        assert(!ok_get_key_origin);
  ------------------
  |  Branch (205:9): [True: 1.81k, False: 0]
  ------------------
  206|  1.81k|    }
  207|       |
  208|  1.81k|    {
  209|  1.81k|        const std::vector<unsigned char> vch_pubkey{pubkey.begin(), pubkey.end()};
  210|  1.81k|        assert(CPubKey::ValidSize(vch_pubkey));
  ------------------
  |  Branch (210:9): [True: 1.81k, False: 0]
  ------------------
  211|  1.81k|        assert(!CPubKey::ValidSize({pubkey.begin(), pubkey.begin() + pubkey.size() - 1}));
  ------------------
  |  Branch (211:9): [True: 1.81k, False: 0]
  ------------------
  212|       |
  213|  1.81k|        const CPubKey pubkey_ctor_1{vch_pubkey};
  214|  1.81k|        assert(pubkey == pubkey_ctor_1);
  ------------------
  |  Branch (214:9): [True: 1.81k, False: 0]
  ------------------
  215|       |
  216|  1.81k|        const CPubKey pubkey_ctor_2{vch_pubkey.begin(), vch_pubkey.end()};
  217|  1.81k|        assert(pubkey == pubkey_ctor_2);
  ------------------
  |  Branch (217:9): [True: 1.81k, False: 0]
  ------------------
  218|       |
  219|  1.81k|        CPubKey pubkey_set;
  220|  1.81k|        pubkey_set.Set(vch_pubkey.begin(), vch_pubkey.end());
  221|  1.81k|        assert(pubkey == pubkey_set);
  ------------------
  |  Branch (221:9): [True: 1.81k, False: 0]
  ------------------
  222|  1.81k|    }
  223|       |
  224|  1.81k|    {
  225|  1.81k|        const CPubKey invalid_pubkey{};
  226|  1.81k|        assert(!invalid_pubkey.IsValid());
  ------------------
  |  Branch (226:9): [True: 1.81k, False: 0]
  ------------------
  227|  1.81k|        assert(!invalid_pubkey.IsFullyValid());
  ------------------
  |  Branch (227:9): [True: 1.81k, False: 0]
  ------------------
  228|  1.81k|        assert(!(pubkey == invalid_pubkey));
  ------------------
  |  Branch (228:9): [True: 1.81k, False: 0]
  ------------------
  229|  1.81k|        assert(pubkey != invalid_pubkey);
  ------------------
  |  Branch (229:9): [True: 1.81k, False: 0]
  ------------------
  230|  1.81k|        assert(pubkey < invalid_pubkey);
  ------------------
  |  Branch (230:9): [True: 1.81k, False: 0]
  ------------------
  231|  1.81k|    }
  232|       |
  233|  1.81k|    {
  234|       |        // Cover CPubKey's operator[](unsigned int pos)
  235|  1.81k|        unsigned int sum = 0;
  236|  61.5k|        for (size_t i = 0; i < pubkey.size(); ++i) {
  ------------------
  |  Branch (236:28): [True: 59.7k, False: 1.81k]
  ------------------
  237|  59.7k|            sum += pubkey[i];
  238|  59.7k|        }
  239|  1.81k|        assert(std::accumulate(pubkey.begin(), pubkey.end(), 0U) == sum);
  ------------------
  |  Branch (239:9): [True: 1.81k, False: 0]
  ------------------
  240|  1.81k|    }
  241|       |
  242|  1.81k|    {
  243|  1.81k|        CPubKey decompressed_pubkey = pubkey;
  244|  1.81k|        assert(decompressed_pubkey.IsCompressed());
  ------------------
  |  Branch (244:9): [True: 1.81k, False: 0]
  ------------------
  245|       |
  246|  1.81k|        const bool ok = decompressed_pubkey.Decompress();
  247|  1.81k|        assert(ok);
  ------------------
  |  Branch (247:9): [True: 1.81k, False: 0]
  ------------------
  248|  1.81k|        assert(!decompressed_pubkey.IsCompressed());
  ------------------
  |  Branch (248:9): [True: 1.81k, False: 0]
  ------------------
  249|  1.81k|        assert(decompressed_pubkey.size() == 65);
  ------------------
  |  Branch (249:9): [True: 1.81k, False: 0]
  ------------------
  250|  1.81k|    }
  251|       |
  252|  1.81k|    {
  253|  1.81k|        std::vector<unsigned char> vch_sig;
  254|  1.81k|        const bool ok = key.Sign(random_uint256, vch_sig, false);
  255|  1.81k|        assert(ok);
  ------------------
  |  Branch (255:9): [True: 1.81k, False: 0]
  ------------------
  256|  1.81k|        assert(pubkey.Verify(random_uint256, vch_sig));
  ------------------
  |  Branch (256:9): [True: 1.81k, False: 0]
  ------------------
  257|  1.81k|        assert(CPubKey::CheckLowS(vch_sig));
  ------------------
  |  Branch (257:9): [True: 1.81k, False: 0]
  ------------------
  258|       |
  259|  1.81k|        const std::vector<unsigned char> vch_invalid_sig{vch_sig.begin(), vch_sig.begin() + vch_sig.size() - 1};
  260|  1.81k|        assert(!pubkey.Verify(random_uint256, vch_invalid_sig));
  ------------------
  |  Branch (260:9): [True: 1.81k, False: 0]
  ------------------
  261|  1.81k|        assert(!CPubKey::CheckLowS(vch_invalid_sig));
  ------------------
  |  Branch (261:9): [True: 1.81k, False: 0]
  ------------------
  262|  1.81k|    }
  263|       |
  264|  1.81k|    {
  265|  1.81k|        std::vector<unsigned char> vch_compact_sig;
  266|  1.81k|        const bool ok_sign_compact = key.SignCompact(random_uint256, vch_compact_sig);
  267|  1.81k|        assert(ok_sign_compact);
  ------------------
  |  Branch (267:9): [True: 1.81k, False: 0]
  ------------------
  268|       |
  269|  1.81k|        CPubKey recover_pubkey;
  270|  1.81k|        const bool ok_recover_compact = recover_pubkey.RecoverCompact(random_uint256, vch_compact_sig);
  271|  1.81k|        assert(ok_recover_compact);
  ------------------
  |  Branch (271:9): [True: 1.81k, False: 0]
  ------------------
  272|  1.81k|        assert(recover_pubkey == pubkey);
  ------------------
  |  Branch (272:9): [True: 1.81k, False: 0]
  ------------------
  273|  1.81k|    }
  274|       |
  275|  1.81k|    {
  276|  1.81k|        CPubKey child_pubkey;
  277|  1.81k|        ChainCode child_chaincode;
  278|  1.81k|        const bool ok = pubkey.Derive(child_pubkey, child_chaincode, 0, ChainCode{random_uint256});
  279|  1.81k|        assert(ok);
  ------------------
  |  Branch (279:9): [True: 1.81k, False: 0]
  ------------------
  280|  1.81k|        assert(child_pubkey != pubkey);
  ------------------
  |  Branch (280:9): [True: 1.81k, False: 0]
  ------------------
  281|  1.81k|        assert(child_pubkey.IsCompressed());
  ------------------
  |  Branch (281:9): [True: 1.81k, False: 0]
  ------------------
  282|  1.81k|        assert(child_pubkey.IsFullyValid());
  ------------------
  |  Branch (282:9): [True: 1.81k, False: 0]
  ------------------
  283|  1.81k|        assert(child_pubkey.IsValid());
  ------------------
  |  Branch (283:9): [True: 1.81k, False: 0]
  ------------------
  284|  1.81k|        assert(child_pubkey.size() == 33);
  ------------------
  |  Branch (284:9): [True: 1.81k, False: 0]
  ------------------
  285|  1.81k|        assert(child_chaincode != random_uint256);
  ------------------
  |  Branch (285:9): [True: 1.81k, False: 0]
  ------------------
  286|  1.81k|    }
  287|       |
  288|  1.81k|    const CPrivKey priv_key = key.GetPrivKey();
  289|       |
  290|  1.81k|    {
  291|  3.62k|        for (const bool skip_check : {true, false}) {
  ------------------
  |  Branch (291:36): [True: 3.62k, False: 1.81k]
  ------------------
  292|  3.62k|            CKey loaded_key;
  293|  3.62k|            const bool ok = loaded_key.Load(priv_key, pubkey, skip_check);
  294|  3.62k|            assert(ok);
  ------------------
  |  Branch (294:13): [True: 3.62k, False: 0]
  ------------------
  295|  3.62k|            assert(key == loaded_key);
  ------------------
  |  Branch (295:13): [True: 3.62k, False: 0]
  ------------------
  296|  3.62k|        }
  297|  1.81k|    }
  298|  1.81k|}
key.cpp:_ZZ15key_fuzz_targetNSt3__14spanIKhLm18446744073709551615EEEENK3$_0clEv:
   43|  1.88k|    const CKey key = [&] {
   44|  1.88k|        CKey k;
   45|  1.88k|        k.Set(buffer.begin(), buffer.end(), true);
   46|  1.88k|        return k;
   47|  1.88k|    }();

_ZN12CheckGlobalsC2Ev:
   59|  1.88k|CheckGlobals::CheckGlobals() : m_impl(std::make_unique<CheckGlobalsImpl>()) {}
_ZN12CheckGlobalsD2Ev:
   60|  1.88k|CheckGlobals::~CheckGlobals() = default;
_ZN16CheckGlobalsImplC2Ev:
   17|  1.88k|    {
   18|  1.88k|        g_used_g_prng = false;
   19|  1.88k|        g_seeded_g_prng_zero = false;
   20|  1.88k|        g_used_system_time = false;
   21|  1.88k|        SetMockTime(0s);
   22|  1.88k|        MockableSteadyClock::ClearMockTime();
   23|  1.88k|    }
_ZN16CheckGlobalsImplD2Ev:
   25|  1.88k|    {
   26|  1.88k|        if (g_used_g_prng && !g_seeded_g_prng_zero) {
  ------------------
  |  Branch (26:13): [True: 1.81k, False: 75]
  |  Branch (26:30): [True: 0, False: 1.81k]
  ------------------
   27|      0|            std::cerr << "\n\n"
   28|      0|                         "The current fuzz target used the global random state.\n\n"
   29|       |
   30|      0|                         "This is acceptable, but requires the fuzz target to call \n"
   31|      0|                         "SeedRandomStateForTest(SeedRand::ZEROS) in the first line \n"
   32|      0|                         "of the FUZZ_TARGET function.\n\n"
   33|       |
   34|      0|                         "An alternative solution would be to avoid any use of globals.\n\n"
   35|       |
   36|      0|                         "Without a solution, fuzz instability and non-determinism can lead \n"
   37|      0|                         "to non-reproducible bugs or inefficient fuzzing.\n\n"
   38|      0|                      << std::endl;
   39|      0|            std::abort(); // Abort, because AFL may try to recover from a std::exit
   40|      0|        }
   41|       |
   42|  1.88k|        if (g_used_system_time) {
  ------------------
  |  Branch (42:13): [True: 0, False: 1.88k]
  ------------------
   43|      0|            std::cerr << "\n\n"
   44|      0|                         "The current fuzz target accessed system time.\n\n"
   45|       |
   46|      0|                         "This is acceptable, but requires the fuzz target to use \n"
   47|      0|                         "a FakeNodeClock, FakeSteadyClock or call \n"
   48|      0|                         "SetMockTime() at the \n" "beginning of processing the \n"
   49|      0|                         "fuzz input.\n\n"
   50|       |
   51|      0|                         "Without setting mock time, time-dependent behavior can lead \n"
   52|      0|                         "to non-reproducible bugs or inefficient fuzzing.\n\n"
   53|      0|                      << std::endl;
   54|      0|            std::abort();
   55|      0|        }
   56|  1.88k|    }

__gcov_reset:
   13|      2|extern "C" __attribute__((weak)) void __gcov_reset(void) {}

_Z22SeedRandomStateForTest8SeedRand:
   20|  1.88k|{
   21|  1.88k|    constexpr auto RANDOM_CTX_SEED{"RANDOM_CTX_SEED"};
   22|       |
   23|       |    // Do this once, on the first call, regardless of seedtype, because once
   24|       |    // MakeRandDeterministicDANGEROUS is called, the output of GetRandHash is
   25|       |    // no longer truly random. It should be enough to get the seed once for the
   26|       |    // process.
   27|  1.88k|    static const auto g_ctx_seed = []() -> std::optional<uint256> {
   28|  1.88k|        if (EnableFuzzDeterminism()) return {};
   29|       |        // If RANDOM_CTX_SEED is set, use that as seed.
   30|  1.88k|        if (const char* num{std::getenv(RANDOM_CTX_SEED)}) {
   31|  1.88k|            if (auto num_parsed{uint256::FromUserHex(num)}) {
   32|  1.88k|                return *num_parsed;
   33|  1.88k|            } else {
   34|  1.88k|                std::cerr << RANDOM_CTX_SEED << " must consist of up to " << uint256::size() * 2 << " hex digits (\"0x\" prefix allowed), it was set to: '" << num << "'.\n";
   35|  1.88k|                std::abort();
   36|  1.88k|            }
   37|  1.88k|        }
   38|       |        // Otherwise use a (truly) random value.
   39|  1.88k|        return GetRandHash();
   40|  1.88k|    }();
   41|       |
   42|  1.88k|    g_seeded_g_prng_zero = seedtype == SeedRand::ZEROS;
   43|  1.88k|    if (EnableFuzzDeterminism()) {
  ------------------
  |  Branch (43:9): [True: 1.88k, False: 0]
  ------------------
   44|  1.88k|        Assert(g_seeded_g_prng_zero); // Only SeedRandomStateForTest(SeedRand::ZEROS) is allowed in fuzz tests
  ------------------
  |  |  116|  1.88k|#define Assert(val) inline_assertion_check<true>(val, std::source_location::current(), #val)
  ------------------
   45|  1.88k|        Assert(!g_used_g_prng);       // The global PRNG must not have been used before SeedRandomStateForTest(SeedRand::ZEROS)
  ------------------
  |  |  116|  1.88k|#define Assert(val) inline_assertion_check<true>(val, std::source_location::current(), #val)
  ------------------
   46|  1.88k|    }
   47|  1.88k|    const uint256& seed{seedtype == SeedRand::FIXED_SEED ? g_ctx_seed.value() : uint256::ZERO};
  ------------------
  |  Branch (47:25): [True: 0, False: 1.88k]
  ------------------
   48|  1.88k|    LogInfo("Setting random seed for current tests to %s=%s\n", RANDOM_CTX_SEED, seed.GetHex());
  ------------------
  |  |  125|  1.88k|#define LogInfo(...) detail_LogWithSrcLoc(BCLog::LogFlags::ALL, util::log::Level::Info, __VA_ARGS__)
  |  |  ------------------
  |  |  |  |  119|  1.88k|#define detail_LogWithSrcLoc(category, level, ...) util::log::LogPrintFormatInternal(SourceLocation{__func__}, category, level, __VA_ARGS__)
  |  |  ------------------
  ------------------
   49|  1.88k|    MakeRandDeterministicDANGEROUS(seed);
   50|  1.88k|}

_ZN10tinyformat6formatIJPKcNSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEEEEES9_NS_17FormatStringCheckIXsZT_EEEDpRKT_:
 1088|  1.88k|{
 1089|  1.88k|    std::ostringstream oss;
 1090|  1.88k|    format(oss, fmt, args...);
 1091|  1.88k|    return oss.str();
 1092|  1.88k|}
_ZN10tinyformat6formatIJPKcNSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEEEEEvRNS3_13basic_ostreamIcS6_EENS_17FormatStringCheckIXsZT_EEEDpRKT_:
 1080|  1.88k|{
 1081|  1.88k|    vformat(out, fmt, makeFormatList(args...));
 1082|  1.88k|}
_ZN10tinyformat14makeFormatListIJPKcNSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEEEEENS_6detail11FormatListNIXsZT_EEEDpRKT_:
 1044|  1.88k|{
 1045|  1.88k|    return detail::FormatListN<sizeof...(args)>(args...);
 1046|  1.88k|}
_ZN10tinyformat6detail11FormatListNILi2EEC2IJPKcNSt3__112basic_stringIcNS6_11char_traitsIcEENS6_9allocatorIcEEEEEEEDpRKT_:
  990|  1.88k|            : FormatList(&m_formatterStore[0], N),
  991|  1.88k|            m_formatterStore { FormatArg(args)... }
  992|  1.88k|        { static_assert(sizeof...(args) == N, "Number of args must be N"); }
_ZN10tinyformat17FormatStringCheckILj2EEcvPKcEv:
  197|  1.88k|    operator const char*() { return fmt; }
_ZN10tinyformat6detail9FormatArg10formatImplINSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEEEEvRNS3_13basic_ostreamIcS6_EEPKcSE_iPKv:
  558|  1.88k|        {
  559|  1.88k|            formatValue(out, fmtBegin, fmtEnd, ntrunc, *static_cast<const T*>(value));
  560|  1.88k|        }
_ZN10tinyformat11formatValueINSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEEEEvRNS1_13basic_ostreamIcS4_EEPKcSC_iRKT_:
  351|  1.88k|{
  352|  1.88k|#ifndef TINYFORMAT_ALLOW_WCHAR_STRINGS
  353|       |    // Since we don't support printing of wchar_t using "%ls", make it fail at
  354|       |    // compile time in preference to printing as a void* at runtime.
  355|  1.88k|    typedef typename detail::is_wchar<T>::tinyformat_wchar_is_not_supported DummyType;
  356|  1.88k|    (void) DummyType(); // avoid unused type warning with gcc-4.8
  357|  1.88k|#endif
  358|       |    // The mess here is to support the %c and %p conversions: if these
  359|       |    // conversions are active we try to convert the type to a char or const
  360|       |    // void* respectively and format that instead of the value itself.  For the
  361|       |    // %p conversion it's important to avoid dereferencing the pointer, which
  362|       |    // could otherwise lead to a crash when printing a dangling (const char*).
  363|  1.88k|    const bool canConvertToChar = detail::is_convertible<T,char>::value;
  364|  1.88k|    const bool canConvertToVoidPtr = detail::is_convertible<T, const void*>::value;
  365|  1.88k|    if (canConvertToChar && *(fmtEnd-1) == 'c')
  ------------------
  |  Branch (365:9): [Folded, False: 1.88k]
  |  Branch (365:29): [True: 0, False: 0]
  ------------------
  366|      0|        detail::formatValueAsType<T, char>::invoke(out, value);
  367|  1.88k|    else if (canConvertToVoidPtr && *(fmtEnd-1) == 'p')
  ------------------
  |  Branch (367:14): [Folded, False: 1.88k]
  |  Branch (367:37): [True: 0, False: 0]
  ------------------
  368|      0|        detail::formatValueAsType<T, const void*>::invoke(out, value);
  369|       |#ifdef TINYFORMAT_OLD_LIBSTDCPLUSPLUS_WORKAROUND
  370|       |    else if (detail::formatZeroIntegerWorkaround<T>::invoke(out, value)) /**/;
  371|       |#endif
  372|  1.88k|    else if (ntrunc >= 0) {
  ------------------
  |  Branch (372:14): [True: 0, False: 1.88k]
  ------------------
  373|       |        // Take care not to overread C strings in truncating conversions like
  374|       |        // "%.4s" where at most 4 characters may be read.
  375|      0|        detail::formatTruncated(out, value, ntrunc);
  376|      0|    }
  377|  1.88k|    else
  378|  1.88k|        out << value;
  379|  1.88k|}
_ZN10tinyformat6detail9FormatArgC2IPKcEERKT_:
  534|  1.88k|            : m_value(static_cast<const void*>(&value)),
  535|  1.88k|            m_formatImpl(&formatImpl<T>),
  536|  1.88k|            m_toIntImpl(&toIntImpl<T>)
  537|  1.88k|        { }
_ZN10tinyformat6detail9FormatArg10formatImplIPKcEEvRNSt3__113basic_ostreamIcNS5_11char_traitsIcEEEES4_S4_iPKv:
  558|  1.88k|        {
  559|  1.88k|            formatValue(out, fmtBegin, fmtEnd, ntrunc, *static_cast<const T*>(value));
  560|  1.88k|        }
_ZN10tinyformat11formatValueIPKcEEvRNSt3__113basic_ostreamIcNS3_11char_traitsIcEEEES2_S2_iRKT_:
  351|  1.88k|{
  352|  1.88k|#ifndef TINYFORMAT_ALLOW_WCHAR_STRINGS
  353|       |    // Since we don't support printing of wchar_t using "%ls", make it fail at
  354|       |    // compile time in preference to printing as a void* at runtime.
  355|  1.88k|    typedef typename detail::is_wchar<T>::tinyformat_wchar_is_not_supported DummyType;
  356|  1.88k|    (void) DummyType(); // avoid unused type warning with gcc-4.8
  357|  1.88k|#endif
  358|       |    // The mess here is to support the %c and %p conversions: if these
  359|       |    // conversions are active we try to convert the type to a char or const
  360|       |    // void* respectively and format that instead of the value itself.  For the
  361|       |    // %p conversion it's important to avoid dereferencing the pointer, which
  362|       |    // could otherwise lead to a crash when printing a dangling (const char*).
  363|  1.88k|    const bool canConvertToChar = detail::is_convertible<T,char>::value;
  364|  1.88k|    const bool canConvertToVoidPtr = detail::is_convertible<T, const void*>::value;
  365|  1.88k|    if (canConvertToChar && *(fmtEnd-1) == 'c')
  ------------------
  |  Branch (365:9): [Folded, False: 1.88k]
  |  Branch (365:29): [True: 0, False: 0]
  ------------------
  366|      0|        detail::formatValueAsType<T, char>::invoke(out, value);
  367|  1.88k|    else if (canConvertToVoidPtr && *(fmtEnd-1) == 'p')
  ------------------
  |  Branch (367:14): [True: 1.88k, Folded]
  |  Branch (367:37): [True: 0, False: 1.88k]
  ------------------
  368|      0|        detail::formatValueAsType<T, const void*>::invoke(out, value);
  369|       |#ifdef TINYFORMAT_OLD_LIBSTDCPLUSPLUS_WORKAROUND
  370|       |    else if (detail::formatZeroIntegerWorkaround<T>::invoke(out, value)) /**/;
  371|       |#endif
  372|  1.88k|    else if (ntrunc >= 0) {
  ------------------
  |  Branch (372:14): [True: 0, False: 1.88k]
  ------------------
  373|       |        // Take care not to overread C strings in truncating conversions like
  374|       |        // "%.4s" where at most 4 characters may be read.
  375|      0|        detail::formatTruncated(out, value, ntrunc);
  376|      0|    }
  377|  1.88k|    else
  378|  1.88k|        out << value;
  379|  1.88k|}
_ZN10tinyformat17FormatStringCheckILj2EEC2EN4util21ConstevalFormatStringILj2EEE:
  196|  1.88k|    FormatStringCheck(util::ConstevalFormatString<num_params> str) : fmt{str.fmt} {}
_ZNK10tinyformat6detail9FormatArg6formatERNSt3__113basic_ostreamIcNS2_11char_traitsIcEEEEPKcS9_i:
  541|  3.77k|        {
  542|  3.77k|            TINYFORMAT_ASSERT(m_value);
  ------------------
  |  |  153|  3.77k|#   define TINYFORMAT_ASSERT(cond) assert(cond)
  ------------------
  |  Branch (542:13): [True: 3.77k, False: 0]
  ------------------
  543|  3.77k|            TINYFORMAT_ASSERT(m_formatImpl);
  ------------------
  |  |  153|  3.77k|#   define TINYFORMAT_ASSERT(cond) assert(cond)
  ------------------
  |  Branch (543:13): [True: 3.77k, False: 0]
  ------------------
  544|  3.77k|            m_formatImpl(out, fmtBegin, fmtEnd, ntrunc, m_value);
  545|  3.77k|        }
_ZN10tinyformat10FormatListC2EPNS_6detail9FormatArgEi:
  966|  1.88k|            : m_args(args), m_N(N) { }
_ZN10tinyformat6detail21parseWidthOrPrecisionERiRPKcbPKNS0_9FormatArgES1_i:
  593|  3.77k|{
  594|  3.77k|    if (*c >= '0' && *c <= '9') {
  ------------------
  |  Branch (594:9): [True: 3.77k, False: 0]
  |  Branch (594:22): [True: 0, False: 3.77k]
  ------------------
  595|      0|        n = parseIntAndAdvance(c);
  596|      0|    }
  597|  3.77k|    else if (*c == '*') {
  ------------------
  |  Branch (597:14): [True: 0, False: 3.77k]
  ------------------
  598|      0|        ++c;
  599|      0|        n = 0;
  600|      0|        if (positionalMode) {
  ------------------
  |  Branch (600:13): [True: 0, False: 0]
  ------------------
  601|      0|            int pos = parseIntAndAdvance(c) - 1;
  602|      0|            if (*c != '$')
  ------------------
  |  Branch (602:17): [True: 0, False: 0]
  ------------------
  603|      0|                TINYFORMAT_ERROR("tinyformat: Non-positional argument used after a positional one");
  ------------------
  |  |  135|      0|#define TINYFORMAT_ERROR(reasonString) throw tinyformat::format_error(reasonString)
  ------------------
  604|      0|            if (pos >= 0 && pos < numArgs)
  ------------------
  |  Branch (604:17): [True: 0, False: 0]
  |  Branch (604:29): [True: 0, False: 0]
  ------------------
  605|      0|                n = args[pos].toInt();
  606|      0|            else
  607|      0|                TINYFORMAT_ERROR("tinyformat: Positional argument out of range");
  ------------------
  |  |  135|      0|#define TINYFORMAT_ERROR(reasonString) throw tinyformat::format_error(reasonString)
  ------------------
  608|      0|            ++c;
  609|      0|        }
  610|      0|        else {
  611|      0|            if (argIndex < numArgs)
  ------------------
  |  Branch (611:17): [True: 0, False: 0]
  ------------------
  612|      0|                n = args[argIndex++].toInt();
  613|      0|            else
  614|      0|                TINYFORMAT_ERROR("tinyformat: Not enough arguments to read variable width or precision");
  ------------------
  |  |  135|      0|#define TINYFORMAT_ERROR(reasonString) throw tinyformat::format_error(reasonString)
  ------------------
  615|      0|        }
  616|      0|    }
  617|  3.77k|    else {
  618|  3.77k|        return false;
  619|  3.77k|    }
  620|      0|    return true;
  621|  3.77k|}
_ZN10tinyformat6detail24printFormatStringLiteralERNSt3__113basic_ostreamIcNS1_11char_traitsIcEEEEPKc:
  629|  5.65k|{
  630|  5.65k|    const char* c = fmt;
  631|  86.7k|    for (;; ++c) {
  632|  86.7k|        if (*c == '\0') {
  ------------------
  |  Branch (632:13): [True: 1.88k, False: 84.8k]
  ------------------
  633|  1.88k|            out.write(fmt, c - fmt);
  634|  1.88k|            return c;
  635|  1.88k|        }
  636|  84.8k|        else if (*c == '%') {
  ------------------
  |  Branch (636:18): [True: 3.77k, False: 81.0k]
  ------------------
  637|  3.77k|            out.write(fmt, c - fmt);
  638|  3.77k|            if (*(c+1) != '%')
  ------------------
  |  Branch (638:17): [True: 3.77k, False: 0]
  ------------------
  639|  3.77k|                return c;
  640|       |            // for "%%", tack trailing % onto next literal section.
  641|      0|            fmt = ++c;
  642|      0|        }
  643|  86.7k|    }
  644|  5.65k|}
_ZN10tinyformat6detail21streamStateFromFormatERNSt3__113basic_ostreamIcNS1_11char_traitsIcEEEERbS7_RiPKcPKNS0_9FormatArgES8_i:
  685|  3.77k|{
  686|  3.77k|    TINYFORMAT_ASSERT(*fmtStart == '%');
  ------------------
  |  |  153|  3.77k|#   define TINYFORMAT_ASSERT(cond) assert(cond)
  ------------------
  |  Branch (686:5): [True: 3.77k, False: 0]
  ------------------
  687|       |    // Reset stream state to defaults.
  688|  3.77k|    out.width(0);
  689|  3.77k|    out.precision(6);
  690|  3.77k|    out.fill(' ');
  691|       |    // Reset most flags; ignore irrelevant unitbuf & skipws.
  692|  3.77k|    out.unsetf(std::ios::adjustfield | std::ios::basefield |
  693|  3.77k|               std::ios::floatfield | std::ios::showbase | std::ios::boolalpha |
  694|  3.77k|               std::ios::showpoint | std::ios::showpos | std::ios::uppercase);
  695|  3.77k|    bool precisionSet = false;
  696|  3.77k|    bool widthSet = false;
  697|  3.77k|    int widthExtra = 0;
  698|  3.77k|    const char* c = fmtStart + 1;
  699|       |
  700|       |    // 1) Parse an argument index (if followed by '$') or a width possibly
  701|       |    // preceded with '0' flag.
  702|  3.77k|    if (*c >= '0' && *c <= '9') {
  ------------------
  |  Branch (702:9): [True: 3.77k, False: 0]
  |  Branch (702:22): [True: 0, False: 3.77k]
  ------------------
  703|      0|        const char tmpc = *c;
  704|      0|        int value = parseIntAndAdvance(c);
  705|      0|        if (*c == '$') {
  ------------------
  |  Branch (705:13): [True: 0, False: 0]
  ------------------
  706|       |            // value is an argument index
  707|      0|            if (value > 0 && value <= numArgs)
  ------------------
  |  Branch (707:17): [True: 0, False: 0]
  |  Branch (707:30): [True: 0, False: 0]
  ------------------
  708|      0|                argIndex = value - 1;
  709|      0|            else
  710|      0|                TINYFORMAT_ERROR("tinyformat: Positional argument out of range");
  ------------------
  |  |  135|      0|#define TINYFORMAT_ERROR(reasonString) throw tinyformat::format_error(reasonString)
  ------------------
  711|      0|            ++c;
  712|      0|            positionalMode = true;
  713|      0|        }
  714|      0|        else if (positionalMode) {
  ------------------
  |  Branch (714:18): [True: 0, False: 0]
  ------------------
  715|      0|            TINYFORMAT_ERROR("tinyformat: Non-positional argument used after a positional one");
  ------------------
  |  |  135|      0|#define TINYFORMAT_ERROR(reasonString) throw tinyformat::format_error(reasonString)
  ------------------
  716|      0|        }
  717|      0|        else {
  718|      0|            if (tmpc == '0') {
  ------------------
  |  Branch (718:17): [True: 0, False: 0]
  ------------------
  719|       |                // Use internal padding so that numeric values are
  720|       |                // formatted correctly, eg -00010 rather than 000-10
  721|      0|                out.fill('0');
  722|      0|                out.setf(std::ios::internal, std::ios::adjustfield);
  723|      0|            }
  724|      0|            if (value != 0) {
  ------------------
  |  Branch (724:17): [True: 0, False: 0]
  ------------------
  725|       |                // Nonzero value means that we parsed width.
  726|      0|                widthSet = true;
  727|      0|                out.width(value);
  728|      0|            }
  729|      0|        }
  730|      0|    }
  731|  3.77k|    else if (positionalMode) {
  ------------------
  |  Branch (731:14): [True: 0, False: 3.77k]
  ------------------
  732|      0|        TINYFORMAT_ERROR("tinyformat: Non-positional argument used after a positional one");
  ------------------
  |  |  135|      0|#define TINYFORMAT_ERROR(reasonString) throw tinyformat::format_error(reasonString)
  ------------------
  733|      0|    }
  734|       |    // 2) Parse flags and width if we did not do it in previous step.
  735|  3.77k|    if (!widthSet) {
  ------------------
  |  Branch (735:9): [True: 3.77k, False: 0]
  ------------------
  736|       |        // Parse flags
  737|  3.77k|        for (;; ++c) {
  738|  3.77k|            switch (*c) {
  739|      0|                case '#':
  ------------------
  |  Branch (739:17): [True: 0, False: 3.77k]
  ------------------
  740|      0|                    out.setf(std::ios::showpoint | std::ios::showbase);
  741|      0|                    continue;
  742|      0|                case '0':
  ------------------
  |  Branch (742:17): [True: 0, False: 3.77k]
  ------------------
  743|       |                    // overridden by left alignment ('-' flag)
  744|      0|                    if (!(out.flags() & std::ios::left)) {
  ------------------
  |  Branch (744:25): [True: 0, False: 0]
  ------------------
  745|       |                        // Use internal padding so that numeric values are
  746|       |                        // formatted correctly, eg -00010 rather than 000-10
  747|      0|                        out.fill('0');
  748|      0|                        out.setf(std::ios::internal, std::ios::adjustfield);
  749|      0|                    }
  750|      0|                    continue;
  751|      0|                case '-':
  ------------------
  |  Branch (751:17): [True: 0, False: 3.77k]
  ------------------
  752|      0|                    out.fill(' ');
  753|      0|                    out.setf(std::ios::left, std::ios::adjustfield);
  754|      0|                    continue;
  755|      0|                case ' ':
  ------------------
  |  Branch (755:17): [True: 0, False: 3.77k]
  ------------------
  756|       |                    // overridden by show positive sign, '+' flag.
  757|      0|                    if (!(out.flags() & std::ios::showpos))
  ------------------
  |  Branch (757:25): [True: 0, False: 0]
  ------------------
  758|      0|                        spacePadPositive = true;
  759|      0|                    continue;
  760|      0|                case '+':
  ------------------
  |  Branch (760:17): [True: 0, False: 3.77k]
  ------------------
  761|      0|                    out.setf(std::ios::showpos);
  762|      0|                    spacePadPositive = false;
  763|      0|                    widthExtra = 1;
  764|      0|                    continue;
  765|  3.77k|                default:
  ------------------
  |  Branch (765:17): [True: 3.77k, False: 0]
  ------------------
  766|  3.77k|                    break;
  767|  3.77k|            }
  768|  3.77k|            break;
  769|  3.77k|        }
  770|       |        // Parse width
  771|  3.77k|        int width = 0;
  772|  3.77k|        widthSet = parseWidthOrPrecision(width, c, positionalMode,
  773|  3.77k|                                         args, argIndex, numArgs);
  774|  3.77k|        if (widthSet) {
  ------------------
  |  Branch (774:13): [True: 0, False: 3.77k]
  ------------------
  775|      0|            if (width < 0) {
  ------------------
  |  Branch (775:17): [True: 0, False: 0]
  ------------------
  776|       |                // negative widths correspond to '-' flag set
  777|      0|                out.fill(' ');
  778|      0|                out.setf(std::ios::left, std::ios::adjustfield);
  779|      0|                width = -width;
  780|      0|            }
  781|      0|            out.width(width);
  782|      0|        }
  783|  3.77k|    }
  784|       |    // 3) Parse precision
  785|  3.77k|    if (*c == '.') {
  ------------------
  |  Branch (785:9): [True: 0, False: 3.77k]
  ------------------
  786|      0|        ++c;
  787|      0|        int precision = 0;
  788|      0|        parseWidthOrPrecision(precision, c, positionalMode,
  789|      0|                              args, argIndex, numArgs);
  790|       |        // Presence of `.` indicates precision set, unless the inferred value
  791|       |        // was negative in which case the default is used.
  792|      0|        precisionSet = precision >= 0;
  793|      0|        if (precisionSet)
  ------------------
  |  Branch (793:13): [True: 0, False: 0]
  ------------------
  794|      0|            out.precision(precision);
  795|      0|    }
  796|       |    // 4) Ignore any C99 length modifier
  797|  3.77k|    while (*c == 'l' || *c == 'h' || *c == 'L' ||
  ------------------
  |  Branch (797:12): [True: 0, False: 3.77k]
  |  Branch (797:25): [True: 0, False: 3.77k]
  |  Branch (797:38): [True: 0, False: 3.77k]
  ------------------
  798|  3.77k|           *c == 'j' || *c == 'z' || *c == 't') {
  ------------------
  |  Branch (798:12): [True: 0, False: 3.77k]
  |  Branch (798:25): [True: 0, False: 3.77k]
  |  Branch (798:38): [True: 0, False: 3.77k]
  ------------------
  799|      0|        ++c;
  800|      0|    }
  801|       |    // 5) We're up to the conversion specifier character.
  802|       |    // Set stream flags based on conversion specifier (thanks to the
  803|       |    // boost::format class for forging the way here).
  804|  3.77k|    bool intConversion = false;
  805|  3.77k|    switch (*c) {
  806|      0|        case 'u': case 'd': case 'i':
  ------------------
  |  Branch (806:9): [True: 0, False: 3.77k]
  |  Branch (806:19): [True: 0, False: 3.77k]
  |  Branch (806:29): [True: 0, False: 3.77k]
  ------------------
  807|      0|            out.setf(std::ios::dec, std::ios::basefield);
  808|      0|            intConversion = true;
  809|      0|            break;
  810|      0|        case 'o':
  ------------------
  |  Branch (810:9): [True: 0, False: 3.77k]
  ------------------
  811|      0|            out.setf(std::ios::oct, std::ios::basefield);
  812|      0|            intConversion = true;
  813|      0|            break;
  814|      0|        case 'X':
  ------------------
  |  Branch (814:9): [True: 0, False: 3.77k]
  ------------------
  815|      0|            out.setf(std::ios::uppercase);
  816|      0|            [[fallthrough]];
  817|      0|        case 'x': case 'p':
  ------------------
  |  Branch (817:9): [True: 0, False: 3.77k]
  |  Branch (817:19): [True: 0, False: 3.77k]
  ------------------
  818|      0|            out.setf(std::ios::hex, std::ios::basefield);
  819|      0|            intConversion = true;
  820|      0|            break;
  821|      0|        case 'E':
  ------------------
  |  Branch (821:9): [True: 0, False: 3.77k]
  ------------------
  822|      0|            out.setf(std::ios::uppercase);
  823|      0|            [[fallthrough]];
  824|      0|        case 'e':
  ------------------
  |  Branch (824:9): [True: 0, False: 3.77k]
  ------------------
  825|      0|            out.setf(std::ios::scientific, std::ios::floatfield);
  826|      0|            out.setf(std::ios::dec, std::ios::basefield);
  827|      0|            break;
  828|      0|        case 'F':
  ------------------
  |  Branch (828:9): [True: 0, False: 3.77k]
  ------------------
  829|      0|            out.setf(std::ios::uppercase);
  830|      0|            [[fallthrough]];
  831|      0|        case 'f':
  ------------------
  |  Branch (831:9): [True: 0, False: 3.77k]
  ------------------
  832|      0|            out.setf(std::ios::fixed, std::ios::floatfield);
  833|      0|            break;
  834|      0|        case 'A':
  ------------------
  |  Branch (834:9): [True: 0, False: 3.77k]
  ------------------
  835|      0|            out.setf(std::ios::uppercase);
  836|      0|            [[fallthrough]];
  837|      0|        case 'a':
  ------------------
  |  Branch (837:9): [True: 0, False: 3.77k]
  ------------------
  838|       |#           ifdef _MSC_VER
  839|       |            // Workaround https://developercommunity.visualstudio.com/content/problem/520472/hexfloat-stream-output-does-not-ignore-precision-a.html
  840|       |            // by always setting maximum precision on MSVC to avoid precision
  841|       |            // loss for doubles.
  842|       |            out.precision(13);
  843|       |#           endif
  844|      0|            out.setf(std::ios::fixed | std::ios::scientific, std::ios::floatfield);
  845|      0|            break;
  846|      0|        case 'G':
  ------------------
  |  Branch (846:9): [True: 0, False: 3.77k]
  ------------------
  847|      0|            out.setf(std::ios::uppercase);
  848|      0|            [[fallthrough]];
  849|      0|        case 'g':
  ------------------
  |  Branch (849:9): [True: 0, False: 3.77k]
  ------------------
  850|      0|            out.setf(std::ios::dec, std::ios::basefield);
  851|       |            // As in boost::format, let stream decide float format.
  852|      0|            out.flags(out.flags() & ~std::ios::floatfield);
  853|      0|            break;
  854|      0|        case 'c':
  ------------------
  |  Branch (854:9): [True: 0, False: 3.77k]
  ------------------
  855|       |            // Handled as special case inside formatValue()
  856|      0|            break;
  857|  3.77k|        case 's':
  ------------------
  |  Branch (857:9): [True: 3.77k, False: 0]
  ------------------
  858|  3.77k|            if (precisionSet)
  ------------------
  |  Branch (858:17): [True: 0, False: 3.77k]
  ------------------
  859|      0|                ntrunc = static_cast<int>(out.precision());
  860|       |            // Make %s print Booleans as "true" and "false"
  861|  3.77k|            out.setf(std::ios::boolalpha);
  862|  3.77k|            break;
  863|      0|        case 'n':
  ------------------
  |  Branch (863:9): [True: 0, False: 3.77k]
  ------------------
  864|       |            // Not supported - will cause problems!
  865|      0|            TINYFORMAT_ERROR("tinyformat: %n conversion spec not supported");
  ------------------
  |  |  135|      0|#define TINYFORMAT_ERROR(reasonString) throw tinyformat::format_error(reasonString)
  ------------------
  866|      0|            break;
  867|      0|        case '\0':
  ------------------
  |  Branch (867:9): [True: 0, False: 3.77k]
  ------------------
  868|      0|            TINYFORMAT_ERROR("tinyformat: Conversion spec incorrectly "
  ------------------
  |  |  135|      0|#define TINYFORMAT_ERROR(reasonString) throw tinyformat::format_error(reasonString)
  ------------------
  869|      0|                             "terminated by end of string");
  870|      0|            return c;
  871|      0|        default:
  ------------------
  |  Branch (871:9): [True: 0, False: 3.77k]
  ------------------
  872|      0|            break;
  873|  3.77k|    }
  874|  3.77k|    if (intConversion && precisionSet && !widthSet) {
  ------------------
  |  Branch (874:9): [True: 0, False: 3.77k]
  |  Branch (874:26): [True: 0, False: 0]
  |  Branch (874:42): [True: 0, False: 0]
  ------------------
  875|       |        // "precision" for integers gives the minimum number of digits (to be
  876|       |        // padded with zeros on the left).  This isn't really supported by the
  877|       |        // iostreams, but we can approximately simulate it with the width if
  878|       |        // the width isn't otherwise used.
  879|      0|        out.width(out.precision() + widthExtra);
  880|      0|        out.setf(std::ios::internal, std::ios::adjustfield);
  881|      0|        out.fill('0');
  882|      0|    }
  883|  3.77k|    return c+1;
  884|  3.77k|}
_ZN10tinyformat6detail10formatImplERNSt3__113basic_ostreamIcNS1_11char_traitsIcEEEEPKcPKNS0_9FormatArgEi:
  891|  1.88k|{
  892|       |    // Saved stream state
  893|  1.88k|    std::streamsize origWidth = out.width();
  894|  1.88k|    std::streamsize origPrecision = out.precision();
  895|  1.88k|    std::ios::fmtflags origFlags = out.flags();
  896|  1.88k|    char origFill = out.fill();
  897|       |
  898|       |    // "Positional mode" means all format specs should be of the form "%n$..."
  899|       |    // with `n` an integer. We detect this in `streamStateFromFormat`.
  900|  1.88k|    bool positionalMode = false;
  901|  1.88k|    int argIndex = 0;
  902|  5.65k|    while (true) {
  ------------------
  |  Branch (902:12): [True: 5.65k, Folded]
  ------------------
  903|  5.65k|        fmt = printFormatStringLiteral(out, fmt);
  904|  5.65k|        if (*fmt == '\0') {
  ------------------
  |  Branch (904:13): [True: 1.88k, False: 3.77k]
  ------------------
  905|  1.88k|            if (!positionalMode && argIndex < numArgs) {
  ------------------
  |  Branch (905:17): [True: 1.88k, False: 0]
  |  Branch (905:36): [True: 0, False: 1.88k]
  ------------------
  906|      0|                TINYFORMAT_ERROR("tinyformat: Not enough conversion specifiers in format string");
  ------------------
  |  |  135|      0|#define TINYFORMAT_ERROR(reasonString) throw tinyformat::format_error(reasonString)
  ------------------
  907|      0|            }
  908|  1.88k|            break;
  909|  1.88k|        }
  910|  3.77k|        bool spacePadPositive = false;
  911|  3.77k|        int ntrunc = -1;
  912|  3.77k|        const char* fmtEnd = streamStateFromFormat(out, positionalMode, spacePadPositive, ntrunc, fmt,
  913|  3.77k|                                                   args, argIndex, numArgs);
  914|       |        // NB: argIndex may be incremented by reading variable width/precision
  915|       |        // in `streamStateFromFormat`, so do the bounds check here.
  916|  3.77k|        if (argIndex >= numArgs) {
  ------------------
  |  Branch (916:13): [True: 0, False: 3.77k]
  ------------------
  917|      0|            TINYFORMAT_ERROR("tinyformat: Too many conversion specifiers in format string");
  ------------------
  |  |  135|      0|#define TINYFORMAT_ERROR(reasonString) throw tinyformat::format_error(reasonString)
  ------------------
  918|      0|            return;
  919|      0|        }
  920|  3.77k|        const FormatArg& arg = args[argIndex];
  921|       |        // Format the arg into the stream.
  922|  3.77k|        if (!spacePadPositive) {
  ------------------
  |  Branch (922:13): [True: 3.77k, False: 0]
  ------------------
  923|  3.77k|            arg.format(out, fmt, fmtEnd, ntrunc);
  924|  3.77k|        }
  925|      0|        else {
  926|       |            // The following is a special case with no direct correspondence
  927|       |            // between stream formatting and the printf() behaviour.  Simulate
  928|       |            // it crudely by formatting into a temporary string stream and
  929|       |            // munging the resulting string.
  930|      0|            std::ostringstream tmpStream;
  931|      0|            tmpStream.copyfmt(out);
  932|      0|            tmpStream.setf(std::ios::showpos);
  933|      0|            arg.format(tmpStream, fmt, fmtEnd, ntrunc);
  934|      0|            std::string result = tmpStream.str(); // allocates... yuck.
  935|      0|            for (size_t i = 0, iend = result.size(); i < iend; ++i) {
  ------------------
  |  Branch (935:54): [True: 0, False: 0]
  ------------------
  936|      0|                if (result[i] == '+')
  ------------------
  |  Branch (936:21): [True: 0, False: 0]
  ------------------
  937|      0|                    result[i] = ' ';
  938|      0|            }
  939|      0|            out << result;
  940|      0|        }
  941|  3.77k|        if (!positionalMode)
  ------------------
  |  Branch (941:13): [True: 3.77k, False: 0]
  ------------------
  942|  3.77k|            ++argIndex;
  943|  3.77k|        fmt = fmtEnd;
  944|  3.77k|    }
  945|       |
  946|       |    // Restore stream state
  947|  1.88k|    out.width(origWidth);
  948|  1.88k|    out.precision(origPrecision);
  949|  1.88k|    out.flags(origFlags);
  950|  1.88k|    out.fill(origFill);
  951|  1.88k|}
_ZN10tinyformat7vformatERNSt3__113basic_ostreamIcNS0_11char_traitsIcEEEEPKcRKNS_10FormatListE:
 1070|  1.88k|{
 1071|  1.88k|    detail::formatImpl(out, fmt, list.m_args, list.m_N);
 1072|  1.88k|}
_ZN10tinyformat6detail9FormatArgC2INSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEEEERKT_:
  534|  1.88k|            : m_value(static_cast<const void*>(&value)),
  535|  1.88k|            m_formatImpl(&formatImpl<T>),
  536|  1.88k|            m_toIntImpl(&toIntImpl<T>)
  537|  1.88k|        { }

_ZNK9base_blobILj256EE6GetHexEv:
   12|  1.88k|{
   13|  1.88k|    uint8_t m_data_rev[WIDTH];
   14|  62.2k|    for (int i = 0; i < WIDTH; ++i) {
  ------------------
  |  Branch (14:21): [True: 60.3k, False: 1.88k]
  ------------------
   15|  60.3k|        m_data_rev[i] = m_data[WIDTH - 1 - i];
   16|  60.3k|    }
   17|  1.88k|    return HexStr(m_data_rev);
   18|  1.88k|}

_ZNK9base_blobILj160EE3endEv:
  105|  7.24k|    constexpr const unsigned char* end() const { return m_data.data() + WIDTH; }
_ZN9base_blobILj160EE5beginEv:
  101|  1.81k|    constexpr unsigned char* begin() { return m_data.data(); }
_ZNK9base_blobILj160EEeqERKS0_:
   62|  7.24k|    constexpr bool operator==(const base_blob&) const = default;
_ZN7uint160C2ENSt3__14spanIKhLm18446744073709551615EEE:
  188|  1.81k|    constexpr explicit uint160(std::span<const unsigned char> vch) : base_blob<160>(vch) {}
_ZN9base_blobILj160EEC2ENSt3__14spanIKhLm18446744073709551615EEE:
   43|  1.81k|    {
   44|  1.81k|        assert(vch.size() == WIDTH);
  ------------------
  |  Branch (44:9): [True: 1.81k, False: 0]
  ------------------
   45|  1.81k|        std::copy(vch.begin(), vch.end(), m_data.begin());
   46|  1.81k|    }
_ZNK9base_blobILj160EEssERKS0_:
   68|  18.1k|    constexpr std::strong_ordering operator<=>(const base_blob& other) const = default;
_ZNK9base_blobILj160EE4dataEv:
   98|  1.81k|    constexpr const unsigned char* data() const { return m_data.data(); }
_ZNK9base_blobILj160EE6IsNullEv:
   51|  1.81k|    {
   52|  1.81k|        return std::all_of(m_data.begin(), m_data.end(), [](uint8_t val) {
   53|  1.81k|            return val == 0;
   54|  1.81k|        });
   55|  1.81k|    }
_ZZNK9base_blobILj160EE6IsNullEvENKUlhE_clEh:
   52|  1.83k|        return std::all_of(m_data.begin(), m_data.end(), [](uint8_t val) {
   53|  1.83k|            return val == 0;
   54|  1.83k|        });
_ZNK9base_blobILj256EEeqERKS0_:
   62|  5.43k|    constexpr bool operator==(const base_blob&) const = default;
_ZNK9base_blobILj256EE5beginEv:
  104|  31.0k|    constexpr const unsigned char* begin() const { return m_data.data(); }
_ZNK9base_blobILj160EE5beginEv:
  104|  7.24k|    constexpr const unsigned char* begin() const { return m_data.data(); }
_ZN9base_blobILj256EE4dataEv:
   99|  28.9k|    constexpr unsigned char* data() { return m_data.data(); }
_ZN7uint160C2Ev:
  187|  25.3k|    constexpr uint160() = default;
_ZN9base_blobILj160EEC2Ev:
   37|  25.3k|    constexpr base_blob() : m_data() {}
_ZN9base_blobILj160EE4dataEv:
   99|  23.5k|    constexpr unsigned char* data() { return m_data.data(); }
_ZN9base_blobILj160EE4sizeEv:
  107|  27.1k|    static constexpr unsigned int size() { return WIDTH; }
_ZN7uint256C2Ev:
  200|  14.4k|    constexpr uint256() = default;
_ZN9base_blobILj256EEC2Ev:
   37|  18.1k|    constexpr base_blob() : m_data() {}
_ZN9base_blobILj256EE5beginEv:
  101|  3.62k|    constexpr unsigned char* begin() { return m_data.data(); }
_ZNK9base_blobILj256EE4dataEv:
   98|  1.88k|    constexpr const unsigned char* data() const { return m_data.data(); }
_ZN9base_blobILj256EE4sizeEv:
  107|  27.2k|    static constexpr unsigned int size() { return WIDTH; }

_ZN10btcsignals6signalIFvvENS_10null_valueEED2Ev:
  175|      6|    ~signal() = default;
_ZN10btcsignals6signalIFv20SynchronizationStatellbENS_10null_valueEED2Ev:
  175|      2|    ~signal() = default;
_ZN10btcsignals6signalIFv20SynchronizationStateRK11CBlockIndexdENS_10null_valueEED2Ev:
  175|      2|    ~signal() = default;
_ZN10btcsignals6signalIFvRKNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEEibENS_10null_valueEED2Ev:
  175|      2|    ~signal() = default;
_ZN10btcsignals6signalIFvbENS_10null_valueEED2Ev:
  175|      2|    ~signal() = default;
_ZN10btcsignals6signalIFviENS_10null_valueEED2Ev:
  175|      2|    ~signal() = default;
_ZN10btcsignals6signalIFvRKNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEEENS_10null_valueEED2Ev:
  175|      2|    ~signal() = default;
_ZN10btcsignals6signalIFbRK13bilingual_strRKNSt3__112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEjENS_6any_ofEED2Ev:
  175|      2|    ~signal() = default;
_ZN10btcsignals6signalIFvRK13bilingual_strjENS_10null_valueEED2Ev:
  175|      2|    ~signal() = default;

_Z22inline_assertion_checkILb1ERPKNSt3__18functionIFvNS0_4spanIKhLm18446744073709551615EEEEEEEOT0_SB_RKNS0_15source_locationENS0_17basic_string_viewIcNS0_11char_traitsIcEEEE:
   90|  1.88k|{
   91|  1.88k|    if (IS_ASSERT || std::is_constant_evaluated() || G_ABORT_ON_FAILED_ASSUME) {
  ------------------
  |  Branch (91:9): [True: 1.88k, Folded]
  |  Branch (91:22): [Folded, False: 0]
  |  Branch (91:54): [True: 0, Folded]
  ------------------
   92|  1.88k|        if (!val) {
  ------------------
  |  Branch (92:13): [True: 0, False: 1.88k]
  ------------------
   93|      0|            assertion_fail(loc, assertion);
   94|      0|        }
   95|  1.88k|    }
   96|  1.88k|    return std::forward<T>(val);
   97|  1.88k|}
_Z22inline_assertion_checkILb1ERNSt3__16atomicIbEEEOT0_S5_RKNS0_15source_locationENS0_17basic_string_viewIcNS0_11char_traitsIcEEEE:
   90|  1.88k|{
   91|  1.88k|    if (IS_ASSERT || std::is_constant_evaluated() || G_ABORT_ON_FAILED_ASSUME) {
  ------------------
  |  Branch (91:9): [True: 1.88k, Folded]
  |  Branch (91:22): [Folded, False: 0]
  |  Branch (91:54): [True: 0, Folded]
  ------------------
   92|  1.88k|        if (!val) {
  ------------------
  |  Branch (92:13): [True: 0, False: 1.88k]
  ------------------
   93|      0|            assertion_fail(loc, assertion);
   94|      0|        }
   95|  1.88k|    }
   96|  1.88k|    return std::forward<T>(val);
   97|  1.88k|}
_Z21EnableFuzzDeterminismv:
   39|  1.88k|{
   40|  1.88k|    if constexpr (G_FUZZING_BUILD) {
   41|  1.88k|        return true;
   42|       |    } else if constexpr (!G_ABORT_ON_FAILED_ASSUME) {
   43|       |        // Running fuzz tests is always disabled if Assume() doesn't abort
   44|       |        // (ie, non-fuzz non-debug builds), as otherwise tests which
   45|       |        // should fail due to a failing Assume may still pass. As such,
   46|       |        // we also statically disable fuzz determinism in that case.
   47|       |        return false;
   48|       |    } else {
   49|       |        return g_enable_dynamic_fuzz_determinism;
   50|       |    }
   51|  1.88k|}
_Z22inline_assertion_checkILb1EbEOT0_S1_RKNSt3__115source_locationENS2_17basic_string_viewIcNS2_11char_traitsIcEEEE:
   90|  3.77k|{
   91|  3.77k|    if (IS_ASSERT || std::is_constant_evaluated() || G_ABORT_ON_FAILED_ASSUME) {
  ------------------
  |  Branch (91:9): [True: 3.77k, Folded]
  |  Branch (91:22): [Folded, False: 0]
  |  Branch (91:54): [True: 0, Folded]
  ------------------
   92|  3.77k|        if (!val) {
  ------------------
  |  Branch (92:13): [True: 0, False: 3.77k]
  ------------------
   93|      0|            assertion_fail(loc, assertion);
   94|      0|        }
   95|  3.77k|    }
   96|  3.77k|    return std::forward<T>(val);
   97|  3.77k|}
_Z22inline_assertion_checkILb0EbEOT0_S1_RKNSt3__115source_locationENS2_17basic_string_viewIcNS2_11char_traitsIcEEEE:
   90|     10|{
   91|     10|    if (IS_ASSERT || std::is_constant_evaluated() || G_ABORT_ON_FAILED_ASSUME) {
  ------------------
  |  Branch (91:9): [Folded, False: 0]
  |  Branch (91:22): [Folded, False: 0]
  |  Branch (91:54): [True: 0, Folded]
  ------------------
   92|     10|        if (!val) {
  ------------------
  |  Branch (92:13): [True: 0, False: 10]
  ------------------
   93|      0|            assertion_fail(loc, assertion);
   94|      0|        }
   95|     10|    }
   96|     10|    return std::forward<T>(val);
   97|     10|}

_ZNK8BaseHashI7uint160E5beginEv:
   24|  7.24k|    {
   25|  7.24k|        return m_hash.begin();
   26|  7.24k|    }
_ZNK8BaseHashI7uint160E3endEv:
   34|  7.24k|    {
   35|  7.24k|        return m_hash.end();
   36|  7.24k|    }
_ZNK8BaseHashI7uint160E4dataEv:
   64|  1.81k|    const unsigned char* data() const { return m_hash.data(); }
_ZNK8BaseHashI7uint160E4sizeEv:
   59|  1.81k|    {
   60|  1.81k|        return m_hash.size();
   61|  1.81k|    }
_ZNK8BaseHashI7uint160EeqERKS1_:
   49|  3.62k|    {
   50|  3.62k|        return m_hash == other.m_hash;
   51|  3.62k|    }
_ZN8BaseHashI7uint160EC2ERKS0_:
   16|  12.6k|    explicit BaseHash(const HashType& in) : m_hash(in) {}

_ZN4util3log22LogPrintFormatInternalIJPKcNSt3__112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEEEEvO14SourceLocationN5BCLog8LogFlagsENS0_5LevelENS_21ConstevalFormatStringIXsZT_EEEDpRKT_:
  101|  1.88k|{
  102|  1.88k|    return LogPrintFormatInternal_(std::move(source_loc), flag, level, /*should_ratelimit=*/true, fmt, args...);
  103|  1.88k|}
_ZN4util3log23LogPrintFormatInternal_IJPKcNSt3__112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEEEEvO14SourceLocationN5BCLog8LogFlagsENS0_5LevelEbNS_21ConstevalFormatStringIXsZT_EEEDpRKT_:
   84|  1.88k|{
   85|  1.88k|    std::string log_msg;
   86|  1.88k|    try {
   87|  1.88k|        log_msg = tfm::format(fmt, args...);
   88|  1.88k|    } catch (tinyformat::format_error& fmterr) {
   89|      0|        log_msg = "Error \"" + std::string{fmterr.what()} + "\" while formatting log message: " + fmt.fmt;
   90|      0|    }
   91|  1.88k|    util::log::Log(util::log::Entry{
   92|  1.88k|        .category = flag,
   93|  1.88k|        .level = level,
   94|  1.88k|        .should_ratelimit = should_ratelimit,
   95|  1.88k|        .source_loc = std::move(source_loc),
   96|  1.88k|        .message = std::move(log_msg)});
   97|  1.88k|}
_ZN14SourceLocationC2EPKcNSt3__115source_locationE:
   31|  1.88k|        : m_func{func}, m_loc{loc} {}

_Z10CheckedAddImENSt3__18optionalIT_EES2_S2_:
   28|  3.62k|{
   29|  3.62k|    if (AdditionOverflow(i, j)) {
  ------------------
  |  Branch (29:9): [True: 0, False: 3.62k]
  ------------------
   30|      0|        return std::nullopt;
   31|      0|    }
   32|  3.62k|    return i + j;
   33|  3.62k|}
_Z16AdditionOverflowITkNSt3__18integralEmEbT_S1_:
   18|  3.62k|{
   19|       |    if constexpr (std::numeric_limits<T>::is_signed) {
   20|       |        return (i > 0 && j > std::numeric_limits<T>::max() - i) ||
   21|       |               (i < 0 && j < std::numeric_limits<T>::min() - i);
   22|       |    }
   23|  3.62k|    return std::numeric_limits<T>::max() - i < j;
   24|  3.62k|}

_ZN8StdMutex12CheckNotHeldERS_:
   37|  3.77k|    static inline StdMutex& CheckNotHeld(StdMutex& cs) EXCLUSIVE_LOCKS_REQUIRED(!cs) LOCK_RETURNED(cs) { return cs; }
_ZN8StdMutex5GuardC2ERS_:
   33|  3.77k|        explicit Guard(StdMutex& cs) EXCLUSIVE_LOCK_FUNCTION(cs) : std::lock_guard<StdMutex>(cs) {}

_Z5IsHexNSt3__117basic_string_viewIcNS_11char_traitsIcEEEE:
   41|  1.81k|{
   42|   119k|    for (char c : str) {
  ------------------
  |  Branch (42:17): [True: 119k, False: 1.81k]
  ------------------
   43|   119k|        if (HexDigit(c) < 0) return false;
  ------------------
  |  Branch (43:13): [True: 0, False: 119k]
  ------------------
   44|   119k|    }
   45|  1.81k|    return (str.size() > 0) && (str.size()%2 == 0);
  ------------------
  |  Branch (45:12): [True: 1.81k, False: 0]
  |  Branch (45:32): [True: 1.81k, False: 0]
  ------------------
   46|  1.81k|}
_Z11TryParseHexIhENSt3__18optionalINS0_6vectorIT_NS0_9allocatorIS3_EEEEEENS0_17basic_string_viewIcNS0_11char_traitsIcEEEE:
   50|  1.81k|{
   51|  1.81k|    std::vector<Byte> vch;
   52|  1.81k|    vch.reserve(str.size() / 2); // two hex characters form a single byte
   53|       |
   54|  1.81k|    auto it = str.begin();
   55|  61.5k|    while (it != str.end()) {
  ------------------
  |  Branch (55:12): [True: 59.7k, False: 1.81k]
  ------------------
   56|  59.7k|        if (IsSpace(*it)) {
  ------------------
  |  Branch (56:13): [True: 0, False: 59.7k]
  ------------------
   57|      0|            ++it;
   58|      0|            continue;
   59|      0|        }
   60|  59.7k|        auto c1 = HexDigit(*(it++));
   61|  59.7k|        if (it == str.end()) return std::nullopt;
  ------------------
  |  Branch (61:13): [True: 0, False: 59.7k]
  ------------------
   62|  59.7k|        auto c2 = HexDigit(*(it++));
   63|  59.7k|        if (c1 < 0 || c2 < 0) return std::nullopt;
  ------------------
  |  Branch (63:13): [True: 0, False: 59.7k]
  |  Branch (63:23): [True: 0, False: 59.7k]
  ------------------
   64|  59.7k|        vch.push_back(Byte(c1 << 4) | Byte(c2));
   65|  59.7k|    }
   66|  1.81k|    return vch;
   67|  1.81k|}
_Z7ToLowerNSt3__117basic_string_viewIcNS_11char_traitsIcEEEE:
  363|  1.81k|{
  364|  1.81k|    std::string r;
  365|  1.81k|    r.reserve(str.size());
  366|  7.24k|    for (auto ch : str) r += ToLower(ch);
  ------------------
  |  Branch (366:18): [True: 7.24k, False: 1.81k]
  ------------------
  367|  1.81k|    return r;
  368|  1.81k|}

_Z8ParseHexIhENSt3__16vectorIT_NS0_9allocatorIS2_EEEENS0_17basic_string_viewIcNS0_11char_traitsIcEEEE:
   70|  1.81k|{
   71|  1.81k|    return TryParseHex<Byte>(hex_str).value_or(std::vector<Byte>{});
   72|  1.81k|}
_Z7IsSpacec:
  166|   222k|constexpr inline bool IsSpace(char c) noexcept {
  167|   222k|    return c == ' ' || c == '\f' || c == '\n' || c == '\r' || c == '\t' || c == '\v';
  ------------------
  |  Branch (167:12): [True: 0, False: 222k]
  |  Branch (167:24): [True: 0, False: 222k]
  |  Branch (167:37): [True: 0, False: 222k]
  |  Branch (167:50): [True: 0, False: 222k]
  |  Branch (167:63): [True: 0, False: 222k]
  |  Branch (167:76): [True: 0, False: 222k]
  ------------------
  168|   222k|}
_Z7ToLowerc:
  256|  7.24k|{
  257|  7.24k|    return (c >= 'A' && c <= 'Z' ? (c - 'A') + 'a' : c);
  ------------------
  |  Branch (257:13): [True: 6.39k, False: 848]
  |  Branch (257:25): [True: 1.51k, False: 4.88k]
  ------------------
  258|  7.24k|}

_ZN4util11ContainsNULENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEE:
  238|  3.62k|{
  239|   155k|    for (auto c : str) {
  ------------------
  |  Branch (239:17): [True: 155k, False: 3.62k]
  ------------------
  240|   155k|        if (c == 0) return true;
  ------------------
  |  Branch (240:13): [True: 0, False: 155k]
  ------------------
  241|   155k|    }
  242|  3.62k|    return false;
  243|  3.62k|}

_ZN16CThreadInterruptD2Ev:
   32|      4|    virtual ~CThreadInterrupt() = default;

_ZN4util21ThreadGetInternalNameEv:
   56|  1.88k|std::string util::ThreadGetInternalName() { return g_thread_name; }

_ZN10ThreadPoolD2Ev:
   93|     10|    {
   94|     10|        Stop(); // In case it hasn't been stopped.
   95|     10|    }
_ZN10ThreadPool4StopEv:
  129|     10|    {
  130|       |        // Notify workers and join them
  131|     10|        std::vector<std::thread> threads_to_join;
  132|     10|        {
  133|     10|            LOCK(m_mutex);
  ------------------
  |  |  268|     10|#define LOCK(cs) UniqueLock BITCOIN_UNIQUE_NAME(criticalblock)(MaybeCheckNotHeld(cs), #cs, __FILE__, __LINE__)
  |  |  ------------------
  |  |  |  |   11|     10|#define BITCOIN_UNIQUE_NAME(name) PASTE2(name, __COUNTER__)
  |  |  |  |  ------------------
  |  |  |  |  |  |    9|     10|#define PASTE2(x, y) PASTE(x, y)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |    8|     10|#define PASTE(x, y) x ## y
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  134|       |            // Ensure Stop() is not called from a worker thread while workers are still registered,
  135|       |            // otherwise a self-join deadlock would occur.
  136|     10|            auto id = std::this_thread::get_id();
  137|     10|            for (const auto& worker : m_workers) assert(worker.get_id() != id);
  ------------------
  |  Branch (137:37): [True: 0, False: 10]
  |  Branch (137:50): [True: 0, False: 0]
  ------------------
  138|       |            // Early shutdown to return right away on any concurrent Submit() call
  139|     10|            m_interrupt = true;
  140|     10|            threads_to_join.swap(m_workers);
  141|     10|        }
  142|      0|        m_cv.notify_all();
  143|       |        // Help draining queue
  144|     10|        while (ProcessTask()) {}
  ------------------
  |  Branch (144:16): [True: 0, False: 10]
  ------------------
  145|       |        // Free resources
  146|     10|        for (auto& worker : threads_to_join) worker.join();
  ------------------
  |  Branch (146:27): [True: 0, False: 10]
  ------------------
  147|       |
  148|       |        // Since we currently wait for tasks completion, sanity-check empty queue
  149|     10|        LOCK(m_mutex);
  ------------------
  |  |  268|     10|#define LOCK(cs) UniqueLock BITCOIN_UNIQUE_NAME(criticalblock)(MaybeCheckNotHeld(cs), #cs, __FILE__, __LINE__)
  |  |  ------------------
  |  |  |  |   11|     10|#define BITCOIN_UNIQUE_NAME(name) PASTE2(name, __COUNTER__)
  |  |  |  |  ------------------
  |  |  |  |  |  |    9|     10|#define PASTE2(x, y) PASTE(x, y)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |    8|     10|#define PASTE(x, y) x ## y
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  150|     10|        Assume(m_work_queue.empty());
  ------------------
  |  |  128|     10|#define Assume(val) inline_assertion_check<false>(val, std::source_location::current(), #val)
  ------------------
  151|       |        // Re-allow Start() now that all workers have exited
  152|     10|        m_interrupt = false;
  153|     10|    }
_ZN10ThreadPool11ProcessTaskEv:
  244|     10|    {
  245|     10|        std::packaged_task<void()> task;
  246|     10|        {
  247|     10|            LOCK(m_mutex);
  ------------------
  |  |  268|     10|#define LOCK(cs) UniqueLock BITCOIN_UNIQUE_NAME(criticalblock)(MaybeCheckNotHeld(cs), #cs, __FILE__, __LINE__)
  |  |  ------------------
  |  |  |  |   11|     10|#define BITCOIN_UNIQUE_NAME(name) PASTE2(name, __COUNTER__)
  |  |  |  |  ------------------
  |  |  |  |  |  |    9|     10|#define PASTE2(x, y) PASTE(x, y)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |    8|     10|#define PASTE(x, y) x ## y
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  248|     10|            if (m_work_queue.empty()) return false;
  ------------------
  |  Branch (248:17): [True: 10, False: 0]
  ------------------
  249|       |
  250|       |            // Pop the task
  251|      0|            task = std::move(m_work_queue.front());
  252|      0|            m_work_queue.pop();
  253|      0|        }
  254|      0|        task();
  255|      0|        return true;
  256|     10|    }

_Z11SetMockTimeNSt3__16chrono8durationIxNS_5ratioILl1ELl1EEEEE:
   54|  1.88k|{
   55|  1.88k|    Assert(mock_time_in >= 0s);
  ------------------
  |  |  116|  1.88k|#define Assert(val) inline_assertion_check<true>(val, std::source_location::current(), #val)
  ------------------
   56|  1.88k|    g_mock_time.store(mock_time_in, std::memory_order_relaxed);
   57|  1.88k|}
_Z11GetMockTimev:
   60|  1.88k|{
   61|  1.88k|    return g_mock_time.load(std::memory_order_relaxed);
   62|  1.88k|}
_ZN19MockableSteadyClock13ClearMockTimeEv:
   84|  1.88k|{
   85|  1.88k|    g_mock_steady_time.store(0ms, std::memory_order_relaxed);
   86|  1.88k|}

_ZN19WalletInitInterfaceD2Ev:
   25|      2|    virtual ~WalletInitInterface() = default;