_ZN5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EED2Ev:
   65|  13.1k|      ~AlignmentBuffer() { secure_scrub_memory(m_buffer.data(), m_buffer.size()); }
_ZN5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EEC2Ev:
   63|  13.1k|      AlignmentBuffer() : m_position(0) {}
_ZN5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE5clearEv:
   72|  29.5k|      void clear() {
   73|  29.5k|         clear_mem(m_buffer.data(), m_buffer.size());
   74|  29.5k|         m_position = 0;
   75|  29.5k|      }
_ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EEC2Ev:
   63|    269|      AlignmentBuffer() : m_position(0) {}
_ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE5clearEv:
   72|    655|      void clear() {
   73|    655|         clear_mem(m_buffer.data(), m_buffer.size());
   74|    655|         m_position = 0;
   75|    655|      }
_ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EED2Ev:
   65|    269|      ~AlignmentBuffer() { secure_scrub_memory(m_buffer.data(), m_buffer.size()); }
_ZN5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE21handle_unaligned_dataERNS_12BufferSlicerE:
  167|  25.3k|      [[nodiscard]] std::optional<std::span<const T>> handle_unaligned_data(BufferSlicer& slicer) {
  168|       |         // When the final block is to be deferred, we would need to store and
  169|       |         // hold a buffer that contains exactly one block until more data is
  170|       |         // passed or it is explicitly consumed.
  171|  25.3k|         const size_t defer = (defers_final_block()) ? 1 : 0;
  ------------------
  |  Branch (171:31): [True: 0, False: 25.3k]
  ------------------
  172|       |
  173|  25.3k|         if(in_alignment() && slicer.remaining() >= m_buffer.size() + defer) {
  ------------------
  |  Branch (173:13): [True: 25.2k, False: 84]
  |  Branch (173:31): [True: 9.25k, False: 16.0k]
  ------------------
  174|       |            // We are currently in alignment and the passed-in data source
  175|       |            // contains enough data to benefit from aligned processing.
  176|       |            // Therefore, we don't copy anything into the intermittent buffer.
  177|  9.25k|            return std::nullopt;
  178|  9.25k|         }
  179|       |
  180|       |         // Fill the buffer with as much input data as needed to reach alignment
  181|       |         // or until the input source is depleted.
  182|  16.1k|         const auto elements_to_consume = std::min(m_buffer.size() - m_position, slicer.remaining());
  183|  16.1k|         append(slicer.take(elements_to_consume));
  184|       |
  185|       |         // If we collected enough data, we push out one full block. When
  186|       |         // deferring the final block is enabled, we additionally check that
  187|       |         // more input data is available to continue processing a consecutive
  188|       |         // block.
  189|  16.1k|         if(ready_to_consume() && (!defers_final_block() || !slicer.empty())) {
  ------------------
  |  Branch (189:13): [True: 5, False: 16.0k]
  |  Branch (189:36): [True: 5, False: 0]
  |  Branch (189:61): [True: 0, False: 0]
  ------------------
  190|      5|            return consume();
  191|  16.0k|         } else {
  192|  16.0k|            return std::nullopt;
  193|  16.0k|         }
  194|  16.1k|      }
_ZNK5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE18defers_final_blockEv:
  234|  35.2k|      constexpr bool defers_final_block() const {
  235|  35.2k|         return FINAL_BLOCK_STRATEGY == AlignmentBufferFinalBlock::must_be_deferred;
  236|  35.2k|      }
_ZN5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE6appendENSt3__14spanIKhLm18446744073709551615EEE:
   91|  32.4k|      void append(std::span<const T> elements) {
   92|  32.4k|         BOTAN_ASSERT_NOMSG(elements.size() <= elements_until_alignment());
  ------------------
  |  |   60|  32.4k|   do {                                                                     \
  |  |   61|  32.4k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 32.4k]
  |  |  ------------------
  |  |   62|  32.4k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  32.4k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   93|  32.4k|         std::copy(elements.begin(), elements.end(), m_buffer.begin() + m_position);
   94|  32.4k|         m_position += elements.size();
   95|  32.4k|      }
_ZNK5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE24elements_until_alignmentEv:
  222|  83.6k|      size_t elements_until_alignment() const { return m_buffer.size() - m_position; }
_ZNK5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE16ready_to_consumeEv:
  232|  69.7k|      bool ready_to_consume() const { return m_position == m_buffer.size(); }
_ZN5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE7consumeEv:
  201|  18.6k|      [[nodiscard]] std::span<const T> consume() {
  202|  18.6k|         BOTAN_ASSERT_NOMSG(ready_to_consume());
  ------------------
  |  |   60|  18.6k|   do {                                                                     \
  |  |   61|  18.6k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 18.6k]
  |  |  ------------------
  |  |   62|  18.6k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  18.6k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  203|  18.6k|         m_position = 0;
  204|  18.6k|         return m_buffer;
  205|  18.6k|      }
_ZNK5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE12in_alignmentEv:
  227|  60.5k|      bool in_alignment() const { return m_position == 0; }
_ZNK5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE23aligned_data_to_processERNS_12BufferSlicerE:
  127|  9.19k|      [[nodiscard]] std::tuple<std::span<const uint8_t>, size_t> aligned_data_to_process(BufferSlicer& slicer) const {
  128|  9.19k|         BOTAN_ASSERT_NOMSG(in_alignment());
  ------------------
  |  |   60|  9.19k|   do {                                                                     \
  |  |   61|  9.19k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 9.19k]
  |  |  ------------------
  |  |   62|  9.19k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  9.19k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  129|       |
  130|       |         // When the final block is to be deferred, the last block must not be
  131|       |         // selected for processing if there is no (unaligned) extra input data.
  132|  9.19k|         const size_t defer = (defers_final_block()) ? 1 : 0;
  ------------------
  |  Branch (132:31): [True: 0, False: 9.19k]
  ------------------
  133|  9.19k|         const size_t full_blocks_to_process = (slicer.remaining() - defer) / m_buffer.size();
  134|  9.19k|         return {slicer.take(full_blocks_to_process * m_buffer.size()), full_blocks_to_process};
  135|  9.19k|      }
_ZN5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE18fill_up_with_zerosEv:
   80|  18.6k|      void fill_up_with_zeros() {
   81|  18.6k|         if(!ready_to_consume()) {
  ------------------
  |  Branch (81:13): [True: 18.6k, False: 34]
  ------------------
   82|  18.6k|            clear_mem(&m_buffer[m_position], elements_until_alignment());
   83|  18.6k|            m_position = m_buffer.size();
   84|  18.6k|         }
   85|  18.6k|      }
_ZN5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE20directly_modify_lastEm:
  114|  16.2k|      std::span<T> directly_modify_last(size_t elements) {
  115|  16.2k|         BOTAN_ASSERT_NOMSG(size() >= elements);
  ------------------
  |  |   60|  16.2k|   do {                                                                     \
  |  |   61|  16.2k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 16.2k]
  |  |  ------------------
  |  |   62|  16.2k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  16.2k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  116|  16.2k|         return std::span(m_buffer).last(elements);
  117|  16.2k|      }
_ZNK5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE4sizeEv:
  218|  16.3k|      constexpr size_t size() const { return m_buffer.size(); }
_ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE21handle_unaligned_dataERNS_12BufferSlicerE:
  167|    792|      [[nodiscard]] std::optional<std::span<const T>> handle_unaligned_data(BufferSlicer& slicer) {
  168|       |         // When the final block is to be deferred, we would need to store and
  169|       |         // hold a buffer that contains exactly one block until more data is
  170|       |         // passed or it is explicitly consumed.
  171|    792|         const size_t defer = (defers_final_block()) ? 1 : 0;
  ------------------
  |  Branch (171:31): [True: 0, False: 792]
  ------------------
  172|       |
  173|    792|         if(in_alignment() && slicer.remaining() >= m_buffer.size() + defer) {
  ------------------
  |  Branch (173:13): [True: 664, False: 128]
  |  Branch (173:31): [True: 269, False: 395]
  ------------------
  174|       |            // We are currently in alignment and the passed-in data source
  175|       |            // contains enough data to benefit from aligned processing.
  176|       |            // Therefore, we don't copy anything into the intermittent buffer.
  177|    269|            return std::nullopt;
  178|    269|         }
  179|       |
  180|       |         // Fill the buffer with as much input data as needed to reach alignment
  181|       |         // or until the input source is depleted.
  182|    523|         const auto elements_to_consume = std::min(m_buffer.size() - m_position, slicer.remaining());
  183|    523|         append(slicer.take(elements_to_consume));
  184|       |
  185|       |         // If we collected enough data, we push out one full block. When
  186|       |         // deferring the final block is enabled, we additionally check that
  187|       |         // more input data is available to continue processing a consecutive
  188|       |         // block.
  189|    523|         if(ready_to_consume() && (!defers_final_block() || !slicer.empty())) {
  ------------------
  |  Branch (189:13): [True: 8, False: 515]
  |  Branch (189:36): [True: 8, False: 0]
  |  Branch (189:61): [True: 0, False: 0]
  ------------------
  190|      8|            return consume();
  191|    515|         } else {
  192|    515|            return std::nullopt;
  193|    515|         }
  194|    523|      }
_ZNK5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE18defers_final_blockEv:
  234|  1.07k|      constexpr bool defers_final_block() const {
  235|  1.07k|         return FINAL_BLOCK_STRATEGY == AlignmentBufferFinalBlock::must_be_deferred;
  236|  1.07k|      }
_ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE6appendENSt3__14spanIKhLm18446744073709551615EEE:
   91|    909|      void append(std::span<const T> elements) {
   92|    909|         BOTAN_ASSERT_NOMSG(elements.size() <= elements_until_alignment());
  ------------------
  |  |   60|    909|   do {                                                                     \
  |  |   61|    909|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 909]
  |  |  ------------------
  |  |   62|    909|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    909|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   93|    909|         std::copy(elements.begin(), elements.end(), m_buffer.begin() + m_position);
   94|    909|         m_position += elements.size();
   95|    909|      }
_ZNK5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE24elements_until_alignmentEv:
  222|  2.07k|      size_t elements_until_alignment() const { return m_buffer.size() - m_position; }
_ZNK5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE16ready_to_consumeEv:
  232|  1.69k|      bool ready_to_consume() const { return m_position == m_buffer.size(); }
_ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE7consumeEv:
  201|    397|      [[nodiscard]] std::span<const T> consume() {
  202|    397|         BOTAN_ASSERT_NOMSG(ready_to_consume());
  ------------------
  |  |   60|    397|   do {                                                                     \
  |  |   61|    397|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 397]
  |  |  ------------------
  |  |   62|    397|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    397|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  203|    397|         m_position = 0;
  204|    397|         return m_buffer;
  205|    397|      }
_ZNK5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE12in_alignmentEv:
  227|  1.86k|      bool in_alignment() const { return m_position == 0; }
_ZNK5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE23aligned_data_to_processERNS_12BufferSlicerE:
  127|    277|      [[nodiscard]] std::tuple<std::span<const uint8_t>, size_t> aligned_data_to_process(BufferSlicer& slicer) const {
  128|    277|         BOTAN_ASSERT_NOMSG(in_alignment());
  ------------------
  |  |   60|    277|   do {                                                                     \
  |  |   61|    277|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 277]
  |  |  ------------------
  |  |   62|    277|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    277|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  129|       |
  130|       |         // When the final block is to be deferred, the last block must not be
  131|       |         // selected for processing if there is no (unaligned) extra input data.
  132|    277|         const size_t defer = (defers_final_block()) ? 1 : 0;
  ------------------
  |  Branch (132:31): [True: 0, False: 277]
  ------------------
  133|    277|         const size_t full_blocks_to_process = (slicer.remaining() - defer) / m_buffer.size();
  134|    277|         return {slicer.take(full_blocks_to_process * m_buffer.size()), full_blocks_to_process};
  135|    277|      }
_ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE18fill_up_with_zerosEv:
   80|    389|      void fill_up_with_zeros() {
   81|    389|         if(!ready_to_consume()) {
  ------------------
  |  Branch (81:13): [True: 389, False: 0]
  ------------------
   82|    389|            clear_mem(&m_buffer[m_position], elements_until_alignment());
   83|    389|            m_position = m_buffer.size();
   84|    389|         }
   85|    389|      }
_ZN5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE20directly_modify_lastEm:
  114|    386|      std::span<T> directly_modify_last(size_t elements) {
  115|    386|         BOTAN_ASSERT_NOMSG(size() >= elements);
  ------------------
  |  |   60|    386|   do {                                                                     \
  |  |   61|    386|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 386]
  |  |  ------------------
  |  |   62|    386|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    386|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  116|    386|         return std::span(m_buffer).last(elements);
  117|    386|      }
_ZNK5Botan15AlignmentBufferIhLm128ELNS_25AlignmentBufferFinalBlockE0EE4sizeEv:
  218|    386|      constexpr size_t size() const { return m_buffer.size(); }
_ZNK5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE29next_aligned_block_to_processERNS_12BufferSlicerE:
  144|    658|      [[nodiscard]] std::optional<std::span<const uint8_t>> next_aligned_block_to_process(BufferSlicer& slicer) const {
  145|    658|         BOTAN_ASSERT_NOMSG(in_alignment());
  ------------------
  |  |   60|    658|   do {                                                                     \
  |  |   61|    658|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 658]
  |  |  ------------------
  |  |   62|    658|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    658|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  146|       |
  147|       |         // When the final block is to be deferred, the last block must not be
  148|       |         // selected for processing if there is no (unaligned) extra input data.
  149|    658|         const size_t defer = (defers_final_block()) ? 1 : 0;
  ------------------
  |  Branch (149:31): [True: 0, False: 658]
  ------------------
  150|    658|         if(slicer.remaining() < m_buffer.size() + defer) {
  ------------------
  |  Branch (150:13): [True: 73, False: 585]
  ------------------
  151|     73|            return std::nullopt;
  152|     73|         }
  153|       |
  154|    585|         return slicer.take(m_buffer.size());
  155|    658|      }
_ZNK5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE18elements_in_bufferEv:
  220|     73|      size_t elements_in_buffer() const { return m_position; }
_ZN5Botan15AlignmentBufferIhLm64ELNS_25AlignmentBufferFinalBlockE0EE21directly_modify_firstEm:
  103|     73|      std::span<T> directly_modify_first(size_t elements) {
  104|     73|         BOTAN_ASSERT_NOMSG(size() >= elements);
  ------------------
  |  |   60|     73|   do {                                                                     \
  |  |   61|     73|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 73]
  |  |  ------------------
  |  |   62|     73|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|     73|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  105|     73|         return std::span(m_buffer).first(elements);
  106|     73|      }

_ZN5Botan8high_bitIjEEmT_:
   60|  13.5k|{
   61|  13.5k|   size_t hb = 0;
   62|       |
   63|  81.5k|   for(size_t s = 8 * sizeof(T) / 2; s > 0; s /= 2) {
  ------------------
  |  Branch (63:38): [True: 67.9k, False: 13.5k]
  ------------------
   64|  67.9k|      const size_t z = s * ((~ct_is_zero(n >> s)) & 1);
   65|  67.9k|      hb += z;
   66|  67.9k|      n >>= z;
   67|  67.9k|   }
   68|       |
   69|  13.5k|   hb += n;
   70|       |
   71|  13.5k|   return hb;
   72|  13.5k|}
_ZN5Botan10ct_is_zeroIjEET_S1_:
   35|  67.9k|{
   36|  67.9k|   return expand_top_bit<T>(~x & (x - 1));
   37|  67.9k|}
_ZN5Botan14expand_top_bitIjEET_S1_:
   25|  67.9k|{
   26|  67.9k|   return static_cast<T>(0) - (a >> (sizeof(T) * 8 - 1));
   27|  67.9k|}
_ZN5Botan14expand_top_bitIhEET_S1_:
   25|  7.14M|{
   26|  7.14M|   return static_cast<T>(0) - (a >> (sizeof(T) * 8 - 1));
   27|  7.14M|}
_ZN5Botan17significant_bytesImEEmT_:
   82|  9.14k|{
   83|  9.14k|   size_t b = 0;
   84|       |
   85|  36.5k|   for(size_t s = 8 * sizeof(n) / 2; s >= 8; s /= 2) {
  ------------------
  |  Branch (85:38): [True: 27.4k, False: 9.14k]
  ------------------
   86|  27.4k|      const size_t z = s * (~ct_is_zero(n >> s) & 1);
   87|  27.4k|      b += z / 8;
   88|  27.4k|      n >>= z;
   89|  27.4k|   }
   90|       |
   91|  9.14k|   b += (n != 0);
   92|       |
   93|  9.14k|   return b;
   94|  9.14k|}
_ZN5Botan10ct_is_zeroImEET_S1_:
   35|   364M|{
   36|   364M|   return expand_top_bit<T>(~x & (x - 1));
   37|   364M|}
_ZN5Botan14expand_top_bitImEET_S1_:
   25|   422M|{
   26|   422M|   return static_cast<T>(0) - (a >> (sizeof(T) * 8 - 1));
   27|   422M|}
_ZN5Botan6chooseIhEET_S1_S1_S1_:
  180|  7.14M|inline constexpr T choose(T mask, T a, T b) {
  181|       |   //return (mask & a) | (~mask & b);
  182|  7.14M|   return (b ^ (mask & (a ^ b)));
  183|  7.14M|}
_ZN5Botan13is_power_of_2ImEEbT_:
   47|   328k|{
   48|   328k|   return (arg != 0) && (arg != 1) && ((arg & static_cast<T>(arg - 1)) == 0);
  ------------------
  |  Branch (48:11): [True: 328k, False: 0]
  |  Branch (48:25): [True: 328k, False: 0]
  |  Branch (48:39): [True: 287k, False: 40.2k]
  ------------------
   49|   328k|}
_ZN5Botan6chooseIjEET_S1_S1_S1_:
  180|  6.37M|inline constexpr T choose(T mask, T a, T b) {
  181|       |   //return (mask & a) | (~mask & b);
  182|  6.37M|   return (b ^ (mask & (a ^ b)));
  183|  6.37M|}
_ZN5Botan8majorityIjEET_S1_S1_S1_:
  186|  3.18M|inline constexpr T majority(T a, T b, T c) {
  187|       |   /*
  188|       |   Considering each bit of a, b, c individually
  189|       |
  190|       |   If a xor b is set, then c is the deciding vote.
  191|       |
  192|       |   If a xor b is not set then either a and b are both set or both unset.
  193|       |   In either case the value of c doesn't matter, and examining b (or a)
  194|       |   allows us to determine which case we are in.
  195|       |   */
  196|  3.18M|   return choose(a ^ b, c, b);
  197|  3.18M|}
_ZN5Botan6chooseImEET_S1_S1_S1_:
  180|   646M|inline constexpr T choose(T mask, T a, T b) {
  181|       |   //return (mask & a) | (~mask & b);
  182|   646M|   return (b ^ (mask & (a ^ b)));
  183|   646M|}
_ZN5Botan8majorityImEET_S1_S1_S1_:
  186|  68.4k|inline constexpr T majority(T a, T b, T c) {
  187|       |   /*
  188|       |   Considering each bit of a, b, c individually
  189|       |
  190|       |   If a xor b is set, then c is the deciding vote.
  191|       |
  192|       |   If a xor b is not set then either a and b are both set or both unset.
  193|       |   In either case the value of c doesn't matter, and examining b (or a)
  194|       |   allows us to determine which case we are in.
  195|       |   */
  196|  68.4k|   return choose(a ^ b, c, b);
  197|  68.4k|}
_ZN5Botan8high_bitImEEmT_:
   60|   421k|{
   61|   421k|   size_t hb = 0;
   62|       |
   63|  2.95M|   for(size_t s = 8 * sizeof(T) / 2; s > 0; s /= 2) {
  ------------------
  |  Branch (63:38): [True: 2.53M, False: 421k]
  ------------------
   64|  2.53M|      const size_t z = s * ((~ct_is_zero(n >> s)) & 1);
   65|  2.53M|      hb += z;
   66|  2.53M|      n >>= z;
   67|  2.53M|   }
   68|       |
   69|   421k|   hb += n;
   70|       |
   71|   421k|   return hb;
   72|   421k|}
_ZN5Botan10ct_is_zeroIhEET_S1_:
   35|  6.56M|{
   36|  6.56M|   return expand_top_bit<T>(~x & (x - 1));
   37|  6.56M|}
_ZN5Botan10ct_is_zeroIiEET_S1_:
   35|     69|{
   36|     69|   return expand_top_bit<T>(~x & (x - 1));
   37|     69|}
_ZN5Botan14expand_top_bitIiEET_S1_:
   25|     69|{
   26|     69|   return static_cast<T>(0) - (a >> (sizeof(T) * 8 - 1));
   27|     69|}
_ZN5Botan3ctzImEEmT_:
  104|  1.15M|{
  105|       |   /*
  106|       |   * If n == 0 then this function will compute 8*sizeof(T)-1, so
  107|       |   * initialize lb to 1 if n == 0 to produce the expected result.
  108|       |   */
  109|  1.15M|   size_t lb = ct_is_zero(n) & 1;
  110|       |
  111|  8.08M|   for(size_t s = 8 * sizeof(T) / 2; s > 0; s /= 2) {
  ------------------
  |  Branch (111:38): [True: 6.93M, False: 1.15M]
  ------------------
  112|  6.93M|      const T mask = (static_cast<T>(1) << s) - 1;
  113|  6.93M|      const size_t z = s * (ct_is_zero(n & mask) & 1);
  114|  6.93M|      lb += z;
  115|  6.93M|      n >>= z;
  116|  6.93M|   }
  117|       |
  118|  1.15M|   return lb;
  119|  1.15M|}
_ZN5Botan12ceil_tobytesImEET_S1_:
  146|     36|{
  147|     36|   return (bits + 7) / 8;
  148|     36|}
_ZN5Botan8high_bitIhEEmT_:
   60|     23|{
   61|     23|   size_t hb = 0;
   62|       |
   63|     92|   for(size_t s = 8 * sizeof(T) / 2; s > 0; s /= 2) {
  ------------------
  |  Branch (63:38): [True: 69, False: 23]
  ------------------
   64|     69|      const size_t z = s * ((~ct_is_zero(n >> s)) & 1);
   65|     69|      hb += z;
   66|     69|      n >>= z;
   67|     69|   }
   68|       |
   69|     23|   hb += n;
   70|       |
   71|     23|   return hb;
   72|     23|}

_ZN5Botan13reverse_bytesEt:
   19|  4.10k|inline constexpr uint16_t reverse_bytes(uint16_t x) {
   20|  4.10k|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap16)
   21|  4.10k|   return __builtin_bswap16(x);
   22|       |#else
   23|       |   return static_cast<uint16_t>((x << 8) | (x >> 8));
   24|       |#endif
   25|  4.10k|}
_ZN5Botan13reverse_bytesEj:
   33|   718k|inline constexpr uint32_t reverse_bytes(uint32_t x) {
   34|   718k|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap32)
   35|   718k|   return __builtin_bswap32(x);
   36|       |#else
   37|       |   // MSVC at least recognizes this as a bswap
   38|       |   return ((x & 0x000000FF) << 24) | ((x & 0x0000FF00) << 8) | ((x & 0x00FF0000) >> 8) | ((x & 0xFF000000) >> 24);
   39|       |#endif
   40|   718k|}
_ZN5Botan13reverse_bytesEm:
   48|   106k|inline constexpr uint64_t reverse_bytes(uint64_t x) {
   49|   106k|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap64)
   50|   106k|   return __builtin_bswap64(x);
   51|       |#else
   52|       |   uint32_t hi = static_cast<uint32_t>(x >> 32);
   53|       |   uint32_t lo = static_cast<uint32_t>(x);
   54|       |
   55|       |   hi = reverse_bytes(hi);
   56|       |   lo = reverse_bytes(lo);
   57|       |
   58|       |   return (static_cast<uint64_t>(lo) << 32) | hi;
   59|       |#endif
   60|   106k|}

base64.cpp:_ZN5Botan11base_decodeIRNS_12_GLOBAL__N_16Base64EEEmOT_PhPKcmRmbb:
  118|    151|                   bool ignore_ws = true) {
  119|    151|   const size_t decoding_bytes_in = base.decoding_bytes_in();
  120|    151|   const size_t decoding_bytes_out = base.decoding_bytes_out();
  121|       |
  122|    151|   uint8_t* out_ptr = output;
  123|    151|   std::vector<uint8_t> decode_buf(decoding_bytes_in, 0);
  124|    151|   size_t decode_buf_pos = 0;
  125|    151|   size_t final_truncate = 0;
  126|       |
  127|    151|   clear_mem(output, base.decode_max_output(input_length));
  128|       |
  129|  25.5k|   for(size_t i = 0; i != input_length; ++i) {
  ------------------
  |  Branch (129:22): [True: 25.3k, False: 151]
  ------------------
  130|  25.3k|      const uint8_t bin = base.lookup_binary_value(input[i]);
  131|       |
  132|       |      // This call might throw Invalid_Argument
  133|  25.3k|      if(base.check_bad_char(bin, input[i], ignore_ws)) {
  ------------------
  |  Branch (133:10): [True: 21.5k, False: 3.85k]
  ------------------
  134|  21.5k|         decode_buf[decode_buf_pos] = bin;
  135|  21.5k|         ++decode_buf_pos;
  136|  21.5k|      }
  137|       |
  138|       |      /*
  139|       |      * If we're at the end of the input, pad with 0s and truncate
  140|       |      */
  141|  25.3k|      if(final_inputs && (i == input_length - 1)) {
  ------------------
  |  Branch (141:10): [True: 25.3k, False: 34]
  |  Branch (141:26): [True: 75, False: 25.2k]
  ------------------
  142|     75|         if(decode_buf_pos) {
  ------------------
  |  Branch (142:13): [True: 42, False: 33]
  ------------------
  143|    126|            for(size_t j = decode_buf_pos; j < decoding_bytes_in; ++j) {
  ------------------
  |  Branch (143:44): [True: 84, False: 42]
  ------------------
  144|     84|               decode_buf[j] = 0;
  145|     84|            }
  146|       |
  147|     42|            final_truncate = decoding_bytes_in - decode_buf_pos;
  148|     42|            decode_buf_pos = decoding_bytes_in;
  149|     42|         }
  150|     75|      }
  151|       |
  152|  25.3k|      if(decode_buf_pos == decoding_bytes_in) {
  ------------------
  |  Branch (152:10): [True: 5.40k, False: 19.9k]
  ------------------
  153|  5.40k|         base.decode(out_ptr, decode_buf.data());
  154|       |
  155|  5.40k|         out_ptr += decoding_bytes_out;
  156|  5.40k|         decode_buf_pos = 0;
  157|  5.40k|         input_consumed = i + 1;
  158|  5.40k|      }
  159|  25.3k|   }
  160|       |
  161|    693|   while(input_consumed < input_length && base.lookup_binary_value(input[input_consumed]) == 0x80) {
  ------------------
  |  Branch (161:10): [True: 560, False: 133]
  |  Branch (161:43): [True: 542, False: 18]
  ------------------
  162|    542|      ++input_consumed;
  163|    542|   }
  164|       |
  165|    151|   size_t written = (out_ptr - output) - base.bytes_to_remove(final_truncate);
  166|       |
  167|    151|   return written;
  168|    151|}
base64.cpp:_ZN5Botan18base_decode_to_vecINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_12_GLOBAL__N_16Base64EEET_OT0_PKcmb:
  183|    151|Vector base_decode_to_vec(Base&& base, const char input[], size_t input_length, bool ignore_ws) {
  184|    151|   const size_t output_length = base.decode_max_output(input_length);
  185|    151|   Vector bin(output_length);
  186|       |
  187|    151|   const size_t written = base_decode_full(base, bin.data(), input, input_length, ignore_ws);
  188|       |
  189|    151|   bin.resize(written);
  190|    151|   return bin;
  191|    151|}
base64.cpp:_ZN5Botan16base_decode_fullIRNS_12_GLOBAL__N_16Base64EEEmOT_PhPKcmb:
  171|    151|size_t base_decode_full(Base&& base, uint8_t output[], const char input[], size_t input_length, bool ignore_ws) {
  172|    151|   size_t consumed = 0;
  173|    151|   const size_t written = base_decode(base, output, input, input_length, consumed, true, ignore_ws);
  174|       |
  175|    151|   if(consumed != input_length) {
  ------------------
  |  Branch (175:7): [True: 18, False: 133]
  ------------------
  176|     18|      throw Invalid_Argument(base.name() + " decoding failed, input did not have full bytes");
  177|     18|   }
  178|       |
  179|    133|   return written;
  180|    151|}

_ZN5Botan5CPUID13has_cpuid_bitENS0_10CPUID_bitsE:
  333|  83.1k|      static bool has_cpuid_bit(CPUID_bits elem) {
  334|  83.1k|         const uint32_t elem32 = static_cast<uint32_t>(elem);
  335|  83.1k|         return state().has_bit(elem32);
  336|  83.1k|      }
_ZN5Botan5CPUID5stateEv:
  362|  83.1k|      static CPUID_Data& state() {
  363|  83.1k|         static CPUID::CPUID_Data g_cpuid;
  364|  83.1k|         return g_cpuid;
  365|  83.1k|      }
_ZNK5Botan5CPUID10CPUID_Data7has_bitEj:
  350|  83.1k|            bool has_bit(uint32_t bit) const { return (m_processor_features & bit) == bit; }
_ZN5Botan5CPUID8has_sse2Ev:
  208|  40.0k|      static bool has_sse2() { return has_cpuid_bit(CPUID_SSE2_BIT); }
_ZN5Botan5CPUID8has_bmi2Ev:
  240|  15.6k|      static bool has_bmi2() { return has_cpuid_bit(CPUID_BMI_BIT); }
_ZN5Botan5CPUID13has_intel_shaEv:
  255|  27.5k|      static bool has_intel_sha() { return has_sse2() && has_cpuid_bit(CPUID_SHA_BIT); }
  ------------------
  |  Branch (255:44): [True: 27.5k, False: 0]
  |  Branch (255:58): [True: 0, False: 27.5k]
  ------------------

_ZN5Botan2CT4MaskIhE3setEv:
   99|  14.5k|      static Mask<T> set() { return Mask<T>(static_cast<T>(~0)); }
_ZN5Botan2CT4MaskIhEC2Eh:
  280|  13.8M|      Mask(T m) : m_mask(m) {}
_ZN5Botan2CT4MaskIhE15is_within_rangeEhhh:
  150|   197k|      static Mask<T> is_within_range(T v, T l, T u) {
  151|       |         //return Mask<T>::is_gte(v, l) & Mask<T>::is_lte(v, u);
  152|       |
  153|   197k|         const T v_lt_l = v ^ ((v ^ l) | ((v - l) ^ v));
  154|   197k|         const T v_gt_u = u ^ ((u ^ v) | ((u - v) ^ u));
  155|   197k|         const T either = v_lt_l | v_gt_u;
  156|   197k|         return ~Mask<T>(expand_top_bit(either));
  157|   197k|      }
_ZNK5Botan2CT4MaskIhEcoEv:
  213|  6.67M|      Mask<T> operator~() const { return Mask<T>(~value()); }
_ZNK5Botan2CT4MaskIhE5valueEv:
  277|  13.8M|      T value() const { return m_mask; }
_ZN5Botan2CT4MaskIhE9is_any_ofEhSt16initializer_listIhE:
  159|  65.7k|      static Mask<T> is_any_of(T v, std::initializer_list<T> accepted) {
  160|  65.7k|         T accept = 0;
  161|       |
  162|   263k|         for(auto a : accepted) {
  ------------------
  |  Branch (162:21): [True: 263k, False: 65.7k]
  ------------------
  163|   263k|            const T diff = a ^ v;
  164|   263k|            const T eq_zero = ~diff & (diff - 1);
  165|   263k|            accept |= eq_zero;
  166|   263k|         }
  167|       |
  168|  65.7k|         return Mask<T>(expand_top_bit(accept));
  169|  65.7k|      }
_ZNK5Botan2CT4MaskIhE7as_boolEv:
  272|  14.7k|      bool as_bool() const { return unpoisoned_value() != 0; }
_ZNK5Botan2CT4MaskIhE16unpoisoned_valueEv:
  263|  14.7k|      T unpoisoned_value() const {
  264|  14.7k|         T r = value();
  265|  14.7k|         CT::unpoison(r);
  266|  14.7k|         return r;
  267|  14.7k|      }
_ZN5Botan2CT8unpoisonIhEEvRT_:
   64|  14.7k|inline void unpoison(T& p) {
   65|       |#if defined(BOTAN_HAS_VALGRIND)
   66|       |   VALGRIND_MAKE_MEM_DEFINED(&p, sizeof(T));
   67|       |#else
   68|  14.7k|   BOTAN_UNUSED(p);
  ------------------
  |  |  118|  14.7k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   69|  14.7k|#endif
   70|  14.7k|}
_ZN5Botan2CT4MaskIhE5is_ltEhh:
  133|   326k|      static Mask<T> is_lt(T x, T y) { return Mask<T>(expand_top_bit<T>(x ^ ((x ^ y) | ((x - y) ^ x)))); }
_ZNK5Botan2CT4MaskIhE6selectEhh:
  228|  7.14M|      T select(T x, T y) const { return choose(value(), x, y); }
_ZN5Botan2CT4MaskImE8is_equalEmm:
  128|  41.6M|      static Mask<T> is_equal(T x, T y) { return Mask<T>::is_zero(static_cast<T>(x ^ y)); }
_ZN5Botan2CT4MaskImE5is_ltEmm:
  133|  58.5M|      static Mask<T> is_lt(T x, T y) { return Mask<T>(expand_top_bit<T>(x ^ ((x ^ y) | ((x - y) ^ x)))); }
_ZN5Botan2CT4MaskImEC2Em:
  280|   300M|      Mask(T m) : m_mask(m) {}
_ZNK5Botan2CT4MaskImE11select_maskES2_S2_:
  239|  16.0M|      Mask<T> select_mask(Mask<T> x, Mask<T> y) const { return Mask<T>(select(x.value(), y.value())); }
_ZNK5Botan2CT4MaskImE5valueEv:
  277|   827M|      T value() const { return m_mask; }
_ZN5Botan2CT4MaskImEoRES2_:
  190|  1.19M|      Mask<T>& operator|=(Mask<T> o) {
  191|  1.19M|         m_mask |= o.value();
  192|  1.19M|         return (*this);
  193|  1.19M|      }
_ZN5Botan2CT4MaskImEaNES2_:
  174|  34.9k|      Mask<T>& operator&=(Mask<T> o) {
  175|  34.9k|         m_mask &= o.value();
  176|  34.9k|         return (*this);
  177|  34.9k|      }
_ZNK5Botan2CT4MaskImE13if_set_returnEm:
  218|  80.6M|      T if_set_return(T x) const { return m_mask & x; }
_ZN5Botan2CT4MaskImE6expandEm:
  109|  67.4M|      static Mask<T> expand(T v) { return ~Mask<T>::is_zero(v); }
_ZNK5Botan2CT4MaskImEcoEv:
  213|  86.5M|      Mask<T> operator~() const { return Mask<T>(~value()); }
_ZNK5Botan2CT4MaskImE6selectEmm:
  228|   646M|      T select(T x, T y) const { return choose(value(), x, y); }
_ZNK5Botan2CT4MaskImE8select_nEPmPKmS5_m:
  245|  16.8M|      void select_n(T output[], const T x[], const T y[], size_t len) const {
  246|   111M|         for(size_t i = 0; i != len; ++i) {
  ------------------
  |  Branch (246:28): [True: 94.8M, False: 16.8M]
  ------------------
  247|  94.8M|            output[i] = this->select(x[i], y[i]);
  248|  94.8M|         }
  249|  16.8M|      }
_ZN5Botan2CT4MaskImE7is_zeroEm:
  123|   118M|      static Mask<T> is_zero(T x) { return Mask<T>(ct_is_zero<T>(x)); }
_ZN5Botan2CT8unpoisonImEEvRT_:
   64|  48.0M|inline void unpoison(T& p) {
   65|       |#if defined(BOTAN_HAS_VALGRIND)
   66|       |   VALGRIND_MAKE_MEM_DEFINED(&p, sizeof(T));
   67|       |#else
   68|  48.0M|   BOTAN_UNUSED(p);
  ------------------
  |  |  118|  48.0M|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   69|  48.0M|#endif
   70|  48.0M|}
_ZNK5Botan2CT4MaskImE7as_boolEv:
  272|  20.1M|      bool as_bool() const { return unpoisoned_value() != 0; }
_ZNK5Botan2CT4MaskImE16unpoisoned_valueEv:
  263|  20.1M|      T unpoisoned_value() const {
  264|  20.1M|         T r = value();
  265|  20.1M|         CT::unpoison(r);
  266|  20.1M|         return r;
  267|  20.1M|      }
_ZN5Botan2CT8unpoisonIKmEEvRT_:
   64|   421k|inline void unpoison(T& p) {
   65|       |#if defined(BOTAN_HAS_VALGRIND)
   66|       |   VALGRIND_MAKE_MEM_DEFINED(&p, sizeof(T));
   67|       |#else
   68|   421k|   BOTAN_UNUSED(p);
  ------------------
  |  |  118|   421k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   69|   421k|#endif
   70|   421k|}
_ZN5Botan2CT4MaskIhE6expandEh:
  109|  6.48M|      static Mask<T> expand(T v) { return ~Mask<T>::is_zero(v); }
_ZN5Botan2CT4MaskIhE7is_zeroEh:
  123|  6.56M|      static Mask<T> is_zero(T x) { return Mask<T>(ct_is_zero<T>(x)); }
_ZN5Botan2CT20conditional_copy_memImEENS0_4MaskIT_EES3_PS3_PKS3_S7_m:
  292|   177k|inline Mask<T> conditional_copy_mem(T cnd, T* to, const T* from0, const T* from1, size_t elems) {
  293|   177k|   const auto mask = CT::Mask<T>::expand(cnd);
  294|   177k|   return CT::conditional_copy_mem(mask, to, from0, from1, elems);
  295|   177k|}
_ZN5Botan2CT20conditional_copy_memImEENS0_4MaskIT_EES4_PS3_PKS3_S7_m:
  286|   177k|inline Mask<T> conditional_copy_mem(Mask<T> mask, T* to, const T* from0, const T* from1, size_t elems) {
  287|   177k|   mask.select_n(to, from0, from1, elems);
  288|   177k|   return mask;
  289|   177k|}
_ZN5Botan2CT20conditional_swap_ptrIPKmEEvbRT_S5_:
  315|  5.36M|inline void conditional_swap_ptr(bool cnd, T& x, T& y) {
  316|  5.36M|   uintptr_t xp = reinterpret_cast<uintptr_t>(x);
  317|  5.36M|   uintptr_t yp = reinterpret_cast<uintptr_t>(y);
  318|       |
  319|  5.36M|   conditional_swap<uintptr_t>(cnd, xp, yp);
  320|       |
  321|  5.36M|   x = reinterpret_cast<T>(xp);
  322|  5.36M|   y = reinterpret_cast<T>(yp);
  323|  5.36M|}
_ZN5Botan2CT16conditional_swapImEEvbRT_S3_:
  305|  10.7M|inline void conditional_swap(bool cnd, T& x, T& y) {
  306|  10.7M|   const auto swap = CT::Mask<T>::expand(cnd);
  307|       |
  308|  10.7M|   T t0 = swap.select(y, x);
  309|  10.7M|   T t1 = swap.select(x, y);
  310|  10.7M|   x = t0;
  311|  10.7M|   y = t1;
  312|  10.7M|}
_ZN5Botan2CT8is_equalIhEENS0_4MaskIT_EEPKS3_S6_m:
  339|    218|inline CT::Mask<T> is_equal(const T x[], const T y[], size_t len) {
  340|    218|   volatile T difference = 0;
  341|       |
  342|  2.51k|   for(size_t i = 0; i != len; ++i) {
  ------------------
  |  Branch (342:22): [True: 2.30k, False: 218]
  ------------------
  343|  2.30k|      difference = difference | (x[i] ^ y[i]);
  344|  2.30k|   }
  345|       |
  346|    218|   return CT::Mask<T>::is_zero(difference);
  347|    218|}
_ZN5Botan2CT4MaskIhE8is_equalEhh:
  128|  77.8k|      static Mask<T> is_equal(T x, T y) { return Mask<T>::is_zero(static_cast<T>(x ^ y)); }
_ZN5Botan2CT4MaskImE6is_gteEmm:
  148|  19.0M|      static Mask<T> is_gte(T x, T y) { return ~Mask<T>::is_lt(x, y); }
_ZN5Botan2CTorENS0_4MaskImEES2_:
  208|  19.5M|      friend Mask<T> operator|(Mask<T> x, Mask<T> y) { return Mask<T>(x.value() | y.value()); }
_ZN5Botan2CTeoENS0_4MaskImEES2_:
  203|  5.27k|      friend Mask<T> operator^(Mask<T> x, Mask<T> y) { return Mask<T>(x.value() ^ y.value()); }
_ZN5Botan2CT4MaskImE3setEv:
   99|  1.29k|      static Mask<T> set() { return Mask<T>(static_cast<T>(~0)); }
_ZN5Botan2CT6poisonImEEvPKT_m:
   46|  1.29k|inline void poison(const T* p, size_t n) {
   47|       |#if defined(BOTAN_HAS_VALGRIND)
   48|       |   VALGRIND_MAKE_MEM_UNDEFINED(p, n * sizeof(T));
   49|       |#else
   50|  1.29k|   BOTAN_UNUSED(p, n);
  ------------------
  |  |  118|  1.29k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   51|  1.29k|#endif
   52|  1.29k|}
_ZN5Botan2CT4MaskImE15if_set_zero_outEPmm:
  254|  1.29k|      void if_set_zero_out(T buf[], size_t elems) {
  255|  6.54k|         for(size_t i = 0; i != elems; ++i) {
  ------------------
  |  Branch (255:28): [True: 5.25k, False: 1.29k]
  ------------------
  256|  5.25k|            buf[i] = this->if_not_set_return(buf[i]);
  257|  5.25k|         }
  258|  1.29k|      }
_ZNK5Botan2CT4MaskImE17if_not_set_returnEm:
  223|  1.16M|      T if_not_set_return(T x) const { return ~m_mask & x; }
_ZN5Botan2CT8unpoisonImEEvPKT_m:
   55|  1.29k|inline void unpoison(const T* p, size_t n) {
   56|       |#if defined(BOTAN_HAS_VALGRIND)
   57|       |   VALGRIND_MAKE_MEM_DEFINED(p, n * sizeof(T));
   58|       |#else
   59|  1.29k|   BOTAN_UNUSED(p, n);
  ------------------
  |  |  118|  1.29k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   60|  1.29k|#endif
   61|  1.29k|}
_ZN5Botan2CT4MaskImE7clearedEv:
  104|   132k|      static Mask<T> cleared() { return Mask<T>(0); }
_ZN5Botan2CTanENS0_4MaskImEES2_:
  198|   821k|      friend Mask<T> operator&(Mask<T> x, Mask<T> y) { return Mask<T>(x.value() & y.value()); }
_ZN5Botan2CT9all_zerosImEENS0_4MaskIT_EEPKS3_m:
  326|   631k|inline CT::Mask<T> all_zeros(const T elem[], size_t len) {
  327|   631k|   T sum = 0;
  328|  3.20M|   for(size_t i = 0; i != len; ++i) {
  ------------------
  |  Branch (328:22): [True: 2.56M, False: 631k]
  ------------------
  329|  2.56M|      sum |= elem[i];
  330|  2.56M|   }
  331|   631k|   return CT::Mask<T>::is_zero(sum);
  332|   631k|}
_ZN5Botan2CT22conditional_assign_memImEENS0_4MaskIT_EES3_PS3_PKS3_m:
  298|  10.5M|inline Mask<T> conditional_assign_mem(T cnd, T* sink, const T* src, size_t elems) {
  299|  10.5M|   const auto mask = CT::Mask<T>::expand(cnd);
  300|  10.5M|   mask.select_n(sink, src, sink, elems);
  301|  10.5M|   return mask;
  302|  10.5M|}
_ZN5Botan2CT8unpoisonIlEEvRT_:
   64|   374k|inline void unpoison(T& p) {
   65|       |#if defined(BOTAN_HAS_VALGRIND)
   66|       |   VALGRIND_MAKE_MEM_DEFINED(&p, sizeof(T));
   67|       |#else
   68|   374k|   BOTAN_UNUSED(p);
  ------------------
  |  |  118|   374k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   69|   374k|#endif
   70|   374k|}

_ZN5Botan9ct_divideERKNS_6BigIntES2_:
   49|  4.27k|inline BigInt ct_divide(const BigInt& x, const BigInt& y) {
   50|  4.27k|   BigInt q, r;
   51|  4.27k|   ct_divide(x, y, q, r);
   52|  4.27k|   return q;
   53|  4.27k|}

_ZNK5Botan12DL_PublicKey5groupEv:
   29|     32|      const DL_Group& group() const { return m_group; }

_ZN5Botan8FE_25519C2ESt16initializer_listIiE:
   37|  1.53k|      FE_25519(std::initializer_list<int32_t> x) {
   38|  1.53k|         if(x.size() != 10) {
  ------------------
  |  Branch (38:13): [True: 0, False: 1.53k]
  ------------------
   39|      0|            throw Invalid_Argument("Invalid FE_25519 initializer list");
   40|      0|         }
   41|  1.53k|         copy_mem(m_fe, x.begin(), 10);
   42|  1.53k|      }

_ZN5Botan4EMSAD2Ev:
   25|    384|      virtual ~EMSA() = default;

_ZN5Botan10fmt_detail6do_fmtERNSt3__119basic_ostringstreamIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS1_17basic_string_viewIcS4_EE:
   20|  23.0k|inline void do_fmt(std::ostringstream& oss, std::string_view format) {
   21|  23.0k|   oss << format;
   22|  23.0k|}
_ZN5Botan3fmtIJNSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEEEENS1_12basic_stringIcS4_NS1_9allocatorIcEEEES5_DpRKT_:
   53|  17.4k|std::string fmt(std::string_view format, const T&... args) {
   54|  17.4k|   std::ostringstream oss;
   55|  17.4k|   oss.imbue(std::locale::classic());
   56|  17.4k|   fmt_detail::do_fmt(oss, format, args...);
   57|  17.4k|   return oss.str();
   58|  17.4k|}
_ZN5Botan10fmt_detail6do_fmtINSt3__117basic_string_viewIcNS2_11char_traitsIcEEEEJEEEvRNS2_19basic_ostringstreamIcS5_NS2_9allocatorIcEEEES6_RKT_DpRKT0_:
   25|  18.2k|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   26|  18.2k|   size_t i = 0;
   27|       |
   28|   179k|   while(i < format.size()) {
  ------------------
  |  Branch (28:10): [True: 179k, False: 0]
  ------------------
   29|   179k|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (29:10): [True: 18.2k, False: 161k]
  |  Branch (29:30): [True: 18.2k, False: 0]
  |  Branch (29:59): [True: 18.2k, False: 0]
  ------------------
   30|  18.2k|         oss << val;
   31|  18.2k|         return do_fmt(oss, format.substr(i + 2), rest...);
   32|   161k|      } else {
   33|   161k|         oss << format[i];
   34|   161k|      }
   35|       |
   36|   161k|      i += 1;
   37|   161k|   }
   38|  18.2k|}
_ZN5Botan3fmtIJNSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEPKcEEENS1_12basic_stringIcS4_NS1_9allocatorIcEEEES5_DpRKT_:
   53|  3.94k|std::string fmt(std::string_view format, const T&... args) {
   54|  3.94k|   std::ostringstream oss;
   55|  3.94k|   oss.imbue(std::locale::classic());
   56|  3.94k|   fmt_detail::do_fmt(oss, format, args...);
   57|  3.94k|   return oss.str();
   58|  3.94k|}
_ZN5Botan10fmt_detail6do_fmtINSt3__117basic_string_viewIcNS2_11char_traitsIcEEEEJPKcEEEvRNS2_19basic_ostringstreamIcS5_NS2_9allocatorIcEEEES6_RKT_DpRKT0_:
   25|  3.94k|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   26|  3.94k|   size_t i = 0;
   27|       |
   28|  3.94k|   while(i < format.size()) {
  ------------------
  |  Branch (28:10): [True: 3.94k, False: 0]
  ------------------
   29|  3.94k|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (29:10): [True: 3.94k, False: 0]
  |  Branch (29:30): [True: 3.94k, False: 0]
  |  Branch (29:59): [True: 3.94k, False: 0]
  ------------------
   30|  3.94k|         oss << val;
   31|  3.94k|         return do_fmt(oss, format.substr(i + 2), rest...);
   32|  3.94k|      } else {
   33|      0|         oss << format[i];
   34|      0|      }
   35|       |
   36|      0|      i += 1;
   37|      0|   }
   38|  3.94k|}
_ZN5Botan10fmt_detail6do_fmtIPKcJEEEvRNSt3__119basic_ostringstreamIcNS4_11char_traitsIcEENS4_9allocatorIcEEEENS4_17basic_string_viewIcS7_EERKT_DpRKT0_:
   25|  4.04k|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   26|  4.04k|   size_t i = 0;
   27|       |
   28|  55.4k|   while(i < format.size()) {
  ------------------
  |  Branch (28:10): [True: 55.4k, False: 0]
  ------------------
   29|  55.4k|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (29:10): [True: 4.04k, False: 51.3k]
  |  Branch (29:30): [True: 4.04k, False: 0]
  |  Branch (29:59): [True: 4.04k, False: 0]
  ------------------
   30|  4.04k|         oss << val;
   31|  4.04k|         return do_fmt(oss, format.substr(i + 2), rest...);
   32|  51.3k|      } else {
   33|  51.3k|         oss << format[i];
   34|  51.3k|      }
   35|       |
   36|  51.3k|      i += 1;
   37|  51.3k|   }
   38|  4.04k|}
_ZN5Botan3fmtIJPKcNSt3__117basic_string_viewIcNS3_11char_traitsIcEEEEEEENS3_12basic_stringIcS6_NS3_9allocatorIcEEEES7_DpRKT_:
   53|    455|std::string fmt(std::string_view format, const T&... args) {
   54|    455|   std::ostringstream oss;
   55|    455|   oss.imbue(std::locale::classic());
   56|    455|   fmt_detail::do_fmt(oss, format, args...);
   57|    455|   return oss.str();
   58|    455|}
_ZN5Botan10fmt_detail6do_fmtIPKcJNSt3__117basic_string_viewIcNS4_11char_traitsIcEEEEEEEvRNS4_19basic_ostringstreamIcS7_NS4_9allocatorIcEEEES8_RKT_DpRKT0_:
   25|    455|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   26|    455|   size_t i = 0;
   27|       |
   28|    455|   while(i < format.size()) {
  ------------------
  |  Branch (28:10): [True: 455, False: 0]
  ------------------
   29|    455|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (29:10): [True: 455, False: 0]
  |  Branch (29:30): [True: 455, False: 0]
  |  Branch (29:59): [True: 455, False: 0]
  ------------------
   30|    455|         oss << val;
   31|    455|         return do_fmt(oss, format.substr(i + 2), rest...);
   32|    455|      } else {
   33|      0|         oss << format[i];
   34|      0|      }
   35|       |
   36|      0|      i += 1;
   37|      0|   }
   38|    455|}
_ZN5Botan10fmt_detail6do_fmtImJEEEvRNSt3__119basic_ostringstreamIcNS2_11char_traitsIcEENS2_9allocatorIcEEEENS2_17basic_string_viewIcS5_EERKT_DpRKT0_:
   25|     38|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   26|     38|   size_t i = 0;
   27|       |
   28|    362|   while(i < format.size()) {
  ------------------
  |  Branch (28:10): [True: 362, False: 0]
  ------------------
   29|    362|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (29:10): [True: 38, False: 324]
  |  Branch (29:30): [True: 38, False: 0]
  |  Branch (29:59): [True: 38, False: 0]
  ------------------
   30|     38|         oss << val;
   31|     38|         return do_fmt(oss, format.substr(i + 2), rest...);
   32|    324|      } else {
   33|    324|         oss << format[i];
   34|    324|      }
   35|       |
   36|    324|      i += 1;
   37|    324|   }
   38|     38|}
_ZN5Botan3fmtIJNSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEjEEENS1_12basic_stringIcS4_NS1_9allocatorIcEEEES5_DpRKT_:
   53|    346|std::string fmt(std::string_view format, const T&... args) {
   54|    346|   std::ostringstream oss;
   55|    346|   oss.imbue(std::locale::classic());
   56|    346|   fmt_detail::do_fmt(oss, format, args...);
   57|    346|   return oss.str();
   58|    346|}
_ZN5Botan10fmt_detail6do_fmtINSt3__117basic_string_viewIcNS2_11char_traitsIcEEEEJjEEEvRNS2_19basic_ostringstreamIcS5_NS2_9allocatorIcEEEES6_RKT_DpRKT0_:
   25|    346|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   26|    346|   size_t i = 0;
   27|       |
   28|    346|   while(i < format.size()) {
  ------------------
  |  Branch (28:10): [True: 346, False: 0]
  ------------------
   29|    346|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (29:10): [True: 346, False: 0]
  |  Branch (29:30): [True: 346, False: 0]
  |  Branch (29:59): [True: 346, False: 0]
  ------------------
   30|    346|         oss << val;
   31|    346|         return do_fmt(oss, format.substr(i + 2), rest...);
   32|    346|      } else {
   33|      0|         oss << format[i];
   34|      0|      }
   35|       |
   36|      0|      i += 1;
   37|      0|   }
   38|    346|}
_ZN5Botan10fmt_detail6do_fmtIjJEEEvRNSt3__119basic_ostringstreamIcNS2_11char_traitsIcEENS2_9allocatorIcEEEENS2_17basic_string_viewIcS5_EERKT_DpRKT0_:
   25|    467|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   26|    467|   size_t i = 0;
   27|       |
   28|  5.15k|   while(i < format.size()) {
  ------------------
  |  Branch (28:10): [True: 5.15k, False: 0]
  ------------------
   29|  5.15k|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (29:10): [True: 467, False: 4.68k]
  |  Branch (29:30): [True: 467, False: 0]
  |  Branch (29:59): [True: 467, False: 0]
  ------------------
   30|    467|         oss << val;
   31|    467|         return do_fmt(oss, format.substr(i + 2), rest...);
   32|  4.68k|      } else {
   33|  4.68k|         oss << format[i];
   34|  4.68k|      }
   35|       |
   36|  4.68k|      i += 1;
   37|  4.68k|   }
   38|    467|}
_ZN5Botan3fmtIJjEEENSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS1_17basic_string_viewIcS4_EEDpRKT_:
   53|    121|std::string fmt(std::string_view format, const T&... args) {
   54|    121|   std::ostringstream oss;
   55|    121|   oss.imbue(std::locale::classic());
   56|    121|   fmt_detail::do_fmt(oss, format, args...);
   57|    121|   return oss.str();
   58|    121|}
_ZN5Botan3fmtIJNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEEEEES7_NS1_17basic_string_viewIcS4_EEDpRKT_:
   53|    316|std::string fmt(std::string_view format, const T&... args) {
   54|    316|   std::ostringstream oss;
   55|    316|   oss.imbue(std::locale::classic());
   56|    316|   fmt_detail::do_fmt(oss, format, args...);
   57|    316|   return oss.str();
   58|    316|}
_ZN5Botan10fmt_detail6do_fmtINSt3__112basic_stringIcNS2_11char_traitsIcEENS2_9allocatorIcEEEEJEEEvRNS2_19basic_ostringstreamIcS5_S7_EENS2_17basic_string_viewIcS5_EERKT_DpRKT0_:
   25|    316|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   26|    316|   size_t i = 0;
   27|       |
   28|  4.18k|   while(i < format.size()) {
  ------------------
  |  Branch (28:10): [True: 4.18k, False: 0]
  ------------------
   29|  4.18k|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (29:10): [True: 316, False: 3.86k]
  |  Branch (29:30): [True: 316, False: 0]
  |  Branch (29:59): [True: 316, False: 0]
  ------------------
   30|    316|         oss << val;
   31|    316|         return do_fmt(oss, format.substr(i + 2), rest...);
   32|  3.86k|      } else {
   33|  3.86k|         oss << format[i];
   34|  3.86k|      }
   35|       |
   36|  3.86k|      i += 1;
   37|  3.86k|   }
   38|    316|}
_ZN5Botan3fmtIJmEEENSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS1_17basic_string_viewIcS4_EEDpRKT_:
   53|      2|std::string fmt(std::string_view format, const T&... args) {
   54|      2|   std::ostringstream oss;
   55|      2|   oss.imbue(std::locale::classic());
   56|      2|   fmt_detail::do_fmt(oss, format, args...);
   57|      2|   return oss.str();
   58|      2|}
_ZN5Botan3fmtIJNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEEmEEES7_NS1_17basic_string_viewIcS4_EEDpRKT_:
   53|     36|std::string fmt(std::string_view format, const T&... args) {
   54|     36|   std::ostringstream oss;
   55|     36|   oss.imbue(std::locale::classic());
   56|     36|   fmt_detail::do_fmt(oss, format, args...);
   57|     36|   return oss.str();
   58|     36|}
_ZN5Botan10fmt_detail6do_fmtINSt3__112basic_stringIcNS2_11char_traitsIcEENS2_9allocatorIcEEEEJmEEEvRNS2_19basic_ostringstreamIcS5_S7_EENS2_17basic_string_viewIcS5_EERKT_DpRKT0_:
   25|     36|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   26|     36|   size_t i = 0;
   27|       |
   28|     72|   while(i < format.size()) {
  ------------------
  |  Branch (28:10): [True: 72, False: 0]
  ------------------
   29|     72|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (29:10): [True: 36, False: 36]
  |  Branch (29:30): [True: 36, False: 0]
  |  Branch (29:59): [True: 36, False: 0]
  ------------------
   30|     36|         oss << val;
   31|     36|         return do_fmt(oss, format.substr(i + 2), rest...);
   32|     36|      } else {
   33|     36|         oss << format[i];
   34|     36|      }
   35|       |
   36|     36|      i += 1;
   37|     36|   }
   38|     36|}
_ZN5Botan3fmtIJPKcS2_S2_EEENSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEENS3_17basic_string_viewIcS6_EEDpRKT_:
   53|     94|std::string fmt(std::string_view format, const T&... args) {
   54|     94|   std::ostringstream oss;
   55|     94|   oss.imbue(std::locale::classic());
   56|     94|   fmt_detail::do_fmt(oss, format, args...);
   57|     94|   return oss.str();
   58|     94|}
_ZN5Botan10fmt_detail6do_fmtIPKcJS3_S3_EEEvRNSt3__119basic_ostringstreamIcNS4_11char_traitsIcEENS4_9allocatorIcEEEENS4_17basic_string_viewIcS7_EERKT_DpRKT0_:
   25|     94|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   26|     94|   size_t i = 0;
   27|       |
   28|     94|   while(i < format.size()) {
  ------------------
  |  Branch (28:10): [True: 94, False: 0]
  ------------------
   29|     94|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (29:10): [True: 94, False: 0]
  |  Branch (29:30): [True: 94, False: 0]
  |  Branch (29:59): [True: 94, False: 0]
  ------------------
   30|     94|         oss << val;
   31|     94|         return do_fmt(oss, format.substr(i + 2), rest...);
   32|     94|      } else {
   33|      0|         oss << format[i];
   34|      0|      }
   35|       |
   36|      0|      i += 1;
   37|      0|   }
   38|     94|}
_ZN5Botan10fmt_detail6do_fmtIPKcJS3_EEEvRNSt3__119basic_ostringstreamIcNS4_11char_traitsIcEENS4_9allocatorIcEEEENS4_17basic_string_viewIcS7_EERKT_DpRKT0_:
   25|     94|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   26|     94|   size_t i = 0;
   27|       |
   28|    470|   while(i < format.size()) {
  ------------------
  |  Branch (28:10): [True: 470, False: 0]
  ------------------
   29|    470|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (29:10): [True: 94, False: 376]
  |  Branch (29:30): [True: 94, False: 0]
  |  Branch (29:59): [True: 94, False: 0]
  ------------------
   30|     94|         oss << val;
   31|     94|         return do_fmt(oss, format.substr(i + 2), rest...);
   32|    376|      } else {
   33|    376|         oss << format[i];
   34|    376|      }
   35|       |
   36|    376|      i += 1;
   37|    376|   }
   38|     94|}
_ZN5Botan3fmtIJmPKcEEENSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEENS3_17basic_string_viewIcS6_EEDpRKT_:
   53|      1|std::string fmt(std::string_view format, const T&... args) {
   54|      1|   std::ostringstream oss;
   55|      1|   oss.imbue(std::locale::classic());
   56|      1|   fmt_detail::do_fmt(oss, format, args...);
   57|      1|   return oss.str();
   58|      1|}
_ZN5Botan10fmt_detail6do_fmtImJPKcEEEvRNSt3__119basic_ostringstreamIcNS4_11char_traitsIcEENS4_9allocatorIcEEEENS4_17basic_string_viewIcS7_EERKT_DpRKT0_:
   25|      1|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   26|      1|   size_t i = 0;
   27|       |
   28|     14|   while(i < format.size()) {
  ------------------
  |  Branch (28:10): [True: 14, False: 0]
  ------------------
   29|     14|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (29:10): [True: 1, False: 13]
  |  Branch (29:30): [True: 1, False: 0]
  |  Branch (29:59): [True: 1, False: 0]
  ------------------
   30|      1|         oss << val;
   31|      1|         return do_fmt(oss, format.substr(i + 2), rest...);
   32|     13|      } else {
   33|     13|         oss << format[i];
   34|     13|      }
   35|       |
   36|     13|      i += 1;
   37|     13|   }
   38|      1|}
_ZN5Botan3fmtIJNS_3OIDEEEENSt3__112basic_stringIcNS2_11char_traitsIcEENS2_9allocatorIcEEEENS2_17basic_string_viewIcS5_EEDpRKT_:
   53|      1|std::string fmt(std::string_view format, const T&... args) {
   54|      1|   std::ostringstream oss;
   55|      1|   oss.imbue(std::locale::classic());
   56|      1|   fmt_detail::do_fmt(oss, format, args...);
   57|      1|   return oss.str();
   58|      1|}
_ZN5Botan10fmt_detail6do_fmtINS_3OIDEJEEEvRNSt3__119basic_ostringstreamIcNS3_11char_traitsIcEENS3_9allocatorIcEEEENS3_17basic_string_viewIcS6_EERKT_DpRKT0_:
   25|      1|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   26|      1|   size_t i = 0;
   27|       |
   28|     14|   while(i < format.size()) {
  ------------------
  |  Branch (28:10): [True: 14, False: 0]
  ------------------
   29|     14|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (29:10): [True: 1, False: 13]
  |  Branch (29:30): [True: 1, False: 0]
  |  Branch (29:59): [True: 1, False: 0]
  ------------------
   30|      1|         oss << val;
   31|      1|         return do_fmt(oss, format.substr(i + 2), rest...);
   32|     13|      } else {
   33|     13|         oss << format[i];
   34|     13|      }
   35|       |
   36|     13|      i += 1;
   37|     13|   }
   38|      1|}
_ZN5Botan3fmtIJNS_3OIDENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEEEEENS2_12basic_stringIcS5_NS2_9allocatorIcEEEES6_DpRKT_:
   53|    311|std::string fmt(std::string_view format, const T&... args) {
   54|    311|   std::ostringstream oss;
   55|    311|   oss.imbue(std::locale::classic());
   56|    311|   fmt_detail::do_fmt(oss, format, args...);
   57|    311|   return oss.str();
   58|    311|}
_ZN5Botan10fmt_detail6do_fmtINS_3OIDEJNSt3__117basic_string_viewIcNS3_11char_traitsIcEEEEEEEvRNS3_19basic_ostringstreamIcS6_NS3_9allocatorIcEEEES7_RKT_DpRKT0_:
   25|    311|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   26|    311|   size_t i = 0;
   27|       |
   28|  11.1k|   while(i < format.size()) {
  ------------------
  |  Branch (28:10): [True: 11.1k, False: 0]
  ------------------
   29|  11.1k|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (29:10): [True: 311, False: 10.8k]
  |  Branch (29:30): [True: 311, False: 0]
  |  Branch (29:59): [True: 311, False: 0]
  ------------------
   30|    311|         oss << val;
   31|    311|         return do_fmt(oss, format.substr(i + 2), rest...);
   32|  10.8k|      } else {
   33|  10.8k|         oss << format[i];
   34|  10.8k|      }
   35|       |
   36|  10.8k|      i += 1;
   37|  10.8k|   }
   38|    311|}

_ZN5Botan8get_byteILm0EmEEhT0_:
   39|  45.0k|{
   40|  45.0k|   const size_t shift = ((~B) & (sizeof(T) - 1)) << 3;
   41|  45.0k|   return static_cast<uint8_t>((input >> shift) & 0xFF);
   42|  45.0k|}
_ZN5Botan11make_uint16Ehh:
   50|     55|inline constexpr uint16_t make_uint16(uint8_t i0, uint8_t i1) {
   51|     55|   return static_cast<uint16_t>((static_cast<uint16_t>(i0) << 8) | i1);
   52|     55|}
_ZN5Botan12get_byte_varImEEhmT_:
   27|  34.8k|inline constexpr uint8_t get_byte_var(size_t byte_num, T input) {
   28|  34.8k|   return static_cast<uint8_t>(input >> (((~byte_num) & (sizeof(T) - 1)) << 3));
   29|  34.8k|}
_ZN5Botan8store_leImEEvT_Ph:
  418|    189|inline constexpr void store_le(T in, uint8_t out[sizeof(T)]) {
  419|    189|   store_le(in, std::span<uint8_t, sizeof(T)>(out, sizeof(T)));
  420|    189|}
_ZN5Botan8store_leImNSt3__14spanIhLm8EEEEEvT_OT0_:
  383|    189|inline constexpr void store_le(T in, OutR&& out_range) {
  384|    189|   ranges::assert_exact_byte_length<sizeof(T)>(out_range);
  385|    189|   std::span out{out_range};
  386|    189|   if constexpr(sizeof(T) == 1) {
  ------------------
  |  Branch (386:17): [Folded - Ignored]
  ------------------
  387|    189|      out[0] = static_cast<uint8_t>(in);
  388|    189|   } else {
  389|       |#if defined(BOTAN_TARGET_CPU_IS_BIG_ENDIAN)
  390|       |      typecast_copy(out, reverse_bytes(in));
  391|       |#elif defined(BOTAN_TARGET_CPU_IS_LITTLE_ENDIAN)
  392|    189|      typecast_copy(out, in);
  393|       |#else
  394|       |      [&]<size_t... i>(std::index_sequence<i...>) {
  395|       |         ((out[i] = get_byte<sizeof(T) - i - 1>(in)), ...);
  396|       |      }
  397|       |      (std::make_index_sequence<sizeof(T)>());
  398|       |#endif
  399|    189|   }
  400|    189|}
_ZN5Botan15copy_out_vec_leIjNS_16secure_allocatorIjEEEEvPhmRKNSt3__16vectorIT_T0_EE:
  540|    116|void copy_out_vec_le(uint8_t out[], size_t out_bytes, const std::vector<T, Alloc>& in) {
  541|    116|   copy_out_le(out, out_bytes, in.data());
  542|    116|}
_ZN5Botan11copy_out_leIjEEvPhmPKT_:
  526|    116|void copy_out_le(uint8_t out[], size_t out_bytes, const T in[]) {
  527|    580|   while(out_bytes >= sizeof(T)) {
  ------------------
  |  Branch (527:10): [True: 464, False: 116]
  ------------------
  528|    464|      store_le(in[0], out);
  529|    464|      out += sizeof(T);
  530|    464|      out_bytes -= sizeof(T);
  531|    464|      in += 1;
  532|    464|   }
  533|       |
  534|    116|   for(size_t i = 0; i != out_bytes; ++i) {
  ------------------
  |  Branch (534:22): [True: 0, False: 116]
  ------------------
  535|      0|      out[i] = get_byte_var(sizeof(T) - 1 - (i % 8), in[0]);
  536|      0|   }
  537|    116|}
_ZN5Botan8store_leIjEEvT_Ph:
  418|    464|inline constexpr void store_le(T in, uint8_t out[sizeof(T)]) {
  419|    464|   store_le(in, std::span<uint8_t, sizeof(T)>(out, sizeof(T)));
  420|    464|}
_ZN5Botan8store_leIjNSt3__14spanIhLm4EEEEEvT_OT0_:
  383|    464|inline constexpr void store_le(T in, OutR&& out_range) {
  384|    464|   ranges::assert_exact_byte_length<sizeof(T)>(out_range);
  385|    464|   std::span out{out_range};
  386|    464|   if constexpr(sizeof(T) == 1) {
  ------------------
  |  Branch (386:17): [Folded - Ignored]
  ------------------
  387|    464|      out[0] = static_cast<uint8_t>(in);
  388|    464|   } else {
  389|       |#if defined(BOTAN_TARGET_CPU_IS_BIG_ENDIAN)
  390|       |      typecast_copy(out, reverse_bytes(in));
  391|       |#elif defined(BOTAN_TARGET_CPU_IS_LITTLE_ENDIAN)
  392|    464|      typecast_copy(out, in);
  393|       |#else
  394|       |      [&]<size_t... i>(std::index_sequence<i...>) {
  395|       |         ((out[i] = get_byte<sizeof(T) - i - 1>(in)), ...);
  396|       |      }
  397|       |      (std::make_index_sequence<sizeof(T)>());
  398|       |#endif
  399|    464|   }
  400|    464|}
_ZN5Botan7load_leIjEEvPT_PKhm:
  310|    484|inline constexpr void load_le(T out[], const uint8_t in[], size_t count) {
  311|    484|   if(count > 0) {
  ------------------
  |  Branch (311:7): [True: 484, False: 0]
  ------------------
  312|    484|#if defined(BOTAN_TARGET_CPU_IS_LITTLE_ENDIAN)
  313|    484|      typecast_copy(out, in, count);
  314|       |
  315|       |#elif defined(BOTAN_TARGET_CPU_IS_BIG_ENDIAN)
  316|       |      typecast_copy(out, in, count);
  317|       |
  318|       |      for(size_t i = 0; i != count; ++i)
  319|       |         out[i] = reverse_bytes(out[i]);
  320|       |#else
  321|       |      for(size_t i = 0; i != count; ++i)
  322|       |         out[i] = load_le<T>(in, i);
  323|       |#endif
  324|    484|   }
  325|    484|}
_ZN5Botan8store_beImEEvT_Ph:
  408|  35.7k|inline constexpr void store_be(T in, uint8_t out[sizeof(T)]) {
  409|  35.7k|   store_be(in, std::span<uint8_t, sizeof(T)>(out, sizeof(T)));
  410|  35.7k|}
_ZN5Botan8store_beImNSt3__14spanIhLm8EEEEEvT_OT0_:
  358|  35.7k|inline constexpr void store_be(T in, OutR&& out_range) {
  359|  35.7k|   ranges::assert_exact_byte_length<sizeof(T)>(out_range);
  360|  35.7k|   std::span out{out_range};
  361|  35.7k|   if constexpr(sizeof(T) == 1) {
  ------------------
  |  Branch (361:17): [Folded - Ignored]
  ------------------
  362|  35.7k|      out[0] = static_cast<uint8_t>(in);
  363|  35.7k|   } else {
  364|       |#if defined(BOTAN_TARGET_CPU_IS_BIG_ENDIAN)
  365|       |      typecast_copy(out, in);
  366|       |#elif defined(BOTAN_TARGET_CPU_IS_LITTLE_ENDIAN)
  367|  35.7k|      typecast_copy(out, reverse_bytes(in));
  368|       |#else
  369|       |      [&]<size_t... i>(std::index_sequence<i...>) {
  370|       |         ((out[i] = get_byte<i>(in)), ...);
  371|       |      }
  372|       |      (std::make_index_sequence<sizeof(T)>());
  373|       |#endif
  374|  35.7k|   }
  375|  35.7k|}
_ZN5Botan15copy_out_vec_beIjNS_16secure_allocatorIjEEEEvPhmRKNSt3__16vectorIT_T0_EE:
  521|  16.1k|void copy_out_vec_be(uint8_t out[], size_t out_bytes, const std::vector<T, Alloc>& in) {
  522|  16.1k|   copy_out_be(out, out_bytes, in.data());
  523|  16.1k|}
_ZN5Botan11copy_out_beIjEEvPhmPKT_:
  507|  16.1k|void copy_out_be(uint8_t out[], size_t out_bytes, const T in[]) {
  508|   126k|   while(out_bytes >= sizeof(T)) {
  ------------------
  |  Branch (508:10): [True: 109k, False: 16.1k]
  ------------------
  509|   109k|      store_be(in[0], out);
  510|   109k|      out += sizeof(T);
  511|   109k|      out_bytes -= sizeof(T);
  512|   109k|      in += 1;
  513|   109k|   }
  514|       |
  515|  16.1k|   for(size_t i = 0; i != out_bytes; ++i) {
  ------------------
  |  Branch (515:22): [True: 0, False: 16.1k]
  ------------------
  516|      0|      out[i] = get_byte_var(i % 8, in[0]);
  517|      0|   }
  518|  16.1k|}
_ZN5Botan8store_beIjEEvT_Ph:
  408|   112k|inline constexpr void store_be(T in, uint8_t out[sizeof(T)]) {
  409|   112k|   store_be(in, std::span<uint8_t, sizeof(T)>(out, sizeof(T)));
  410|   112k|}
_ZN5Botan8store_beIjNSt3__14spanIhLm4EEEEEvT_OT0_:
  358|   112k|inline constexpr void store_be(T in, OutR&& out_range) {
  359|   112k|   ranges::assert_exact_byte_length<sizeof(T)>(out_range);
  360|   112k|   std::span out{out_range};
  361|   112k|   if constexpr(sizeof(T) == 1) {
  ------------------
  |  Branch (361:17): [Folded - Ignored]
  ------------------
  362|   112k|      out[0] = static_cast<uint8_t>(in);
  363|   112k|   } else {
  364|       |#if defined(BOTAN_TARGET_CPU_IS_BIG_ENDIAN)
  365|       |      typecast_copy(out, in);
  366|       |#elif defined(BOTAN_TARGET_CPU_IS_LITTLE_ENDIAN)
  367|   112k|      typecast_copy(out, reverse_bytes(in));
  368|       |#else
  369|       |      [&]<size_t... i>(std::index_sequence<i...>) {
  370|       |         ((out[i] = get_byte<i>(in)), ...);
  371|       |      }
  372|       |      (std::make_index_sequence<sizeof(T)>());
  373|       |#endif
  374|   112k|   }
  375|   112k|}
_ZN5Botan7load_beIjEET_PKhm:
  226|   605k|inline constexpr T load_be(const uint8_t in[], size_t off) {
  227|       |   // asserts that *in points to the correct amount of memory
  228|   605k|   return load_be<T>(std::span<const uint8_t, sizeof(T)>(in + off * sizeof(T), sizeof(T)));
  229|   605k|}
_ZN5Botan7load_beIjNSt3__14spanIKhLm4EEEEET_OT0_:
   92|   605k|inline constexpr T load_be(InR&& in_range) {
   93|   605k|   ranges::assert_exact_byte_length<sizeof(T)>(in_range);
   94|   605k|   std::span in{in_range};
   95|   605k|   if constexpr(sizeof(T) == 1) {
  ------------------
  |  Branch (95:17): [Folded - Ignored]
  ------------------
   96|   605k|      return static_cast<T>(in[0]);
   97|   605k|   } else {
   98|       |#if defined(BOTAN_TARGET_CPU_IS_BIG_ENDIAN)
   99|       |      return typecast_copy<T>(in);
  100|       |#elif defined(BOTAN_TARGET_CPU_IS_LITTLE_ENDIAN)
  101|   605k|      return reverse_bytes(typecast_copy<T>(in));
  102|       |#else
  103|       |      return [&]<size_t... i>(std::index_sequence<i...>) {
  104|       |         return ((static_cast<T>(in[i]) << ((sizeof(T) - i - 1) * 8)) | ...);
  105|       |      }
  106|       |      (std::make_index_sequence<sizeof(T)>());
  107|       |#endif
  108|   605k|   }
  109|   605k|}
_ZN5Botan7load_beImEET_PKhm:
  226|  70.8k|inline constexpr T load_be(const uint8_t in[], size_t off) {
  227|       |   // asserts that *in points to the correct amount of memory
  228|  70.8k|   return load_be<T>(std::span<const uint8_t, sizeof(T)>(in + off * sizeof(T), sizeof(T)));
  229|  70.8k|}
_ZN5Botan7load_beImNSt3__14spanIKhLm8EEEEET_OT0_:
   92|  70.8k|inline constexpr T load_be(InR&& in_range) {
   93|  70.8k|   ranges::assert_exact_byte_length<sizeof(T)>(in_range);
   94|  70.8k|   std::span in{in_range};
   95|  70.8k|   if constexpr(sizeof(T) == 1) {
  ------------------
  |  Branch (95:17): [Folded - Ignored]
  ------------------
   96|  70.8k|      return static_cast<T>(in[0]);
   97|  70.8k|   } else {
   98|       |#if defined(BOTAN_TARGET_CPU_IS_BIG_ENDIAN)
   99|       |      return typecast_copy<T>(in);
  100|       |#elif defined(BOTAN_TARGET_CPU_IS_LITTLE_ENDIAN)
  101|  70.8k|      return reverse_bytes(typecast_copy<T>(in));
  102|       |#else
  103|       |      return [&]<size_t... i>(std::index_sequence<i...>) {
  104|       |         return ((static_cast<T>(in[i]) << ((sizeof(T) - i - 1) * 8)) | ...);
  105|       |      }
  106|       |      (std::make_index_sequence<sizeof(T)>());
  107|       |#endif
  108|  70.8k|   }
  109|  70.8k|}
_ZN5Botan15copy_out_vec_beImNS_16secure_allocatorImEEEEvPhmRKNSt3__16vectorIT_T0_EE:
  521|    386|void copy_out_vec_be(uint8_t out[], size_t out_bytes, const std::vector<T, Alloc>& in) {
  522|    386|   copy_out_be(out, out_bytes, in.data());
  523|    386|}
_ZN5Botan11copy_out_beImEEvPhmPKT_:
  507|    386|void copy_out_be(uint8_t out[], size_t out_bytes, const T in[]) {
  508|  2.71k|   while(out_bytes >= sizeof(T)) {
  ------------------
  |  Branch (508:10): [True: 2.33k, False: 386]
  ------------------
  509|  2.33k|      store_be(in[0], out);
  510|  2.33k|      out += sizeof(T);
  511|  2.33k|      out_bytes -= sizeof(T);
  512|  2.33k|      in += 1;
  513|  2.33k|   }
  514|       |
  515|    386|   for(size_t i = 0; i != out_bytes; ++i) {
  ------------------
  |  Branch (515:22): [True: 0, False: 386]
  ------------------
  516|      0|      out[i] = get_byte_var(i % 8, in[0]);
  517|      0|   }
  518|    386|}
_ZN5Botan7load_beItEET_PKhm:
  226|  4.10k|inline constexpr T load_be(const uint8_t in[], size_t off) {
  227|       |   // asserts that *in points to the correct amount of memory
  228|  4.10k|   return load_be<T>(std::span<const uint8_t, sizeof(T)>(in + off * sizeof(T), sizeof(T)));
  229|  4.10k|}
_ZN5Botan7load_beItNSt3__14spanIKhLm2EEEEET_OT0_:
   92|  4.10k|inline constexpr T load_be(InR&& in_range) {
   93|  4.10k|   ranges::assert_exact_byte_length<sizeof(T)>(in_range);
   94|  4.10k|   std::span in{in_range};
   95|  4.10k|   if constexpr(sizeof(T) == 1) {
  ------------------
  |  Branch (95:17): [Folded - Ignored]
  ------------------
   96|  4.10k|      return static_cast<T>(in[0]);
   97|  4.10k|   } else {
   98|       |#if defined(BOTAN_TARGET_CPU_IS_BIG_ENDIAN)
   99|       |      return typecast_copy<T>(in);
  100|       |#elif defined(BOTAN_TARGET_CPU_IS_LITTLE_ENDIAN)
  101|  4.10k|      return reverse_bytes(typecast_copy<T>(in));
  102|       |#else
  103|       |      return [&]<size_t... i>(std::index_sequence<i...>) {
  104|       |         return ((static_cast<T>(in[i]) << ((sizeof(T) - i - 1) * 8)) | ...);
  105|       |      }
  106|       |      (std::make_index_sequence<sizeof(T)>());
  107|       |#endif
  108|  4.10k|   }
  109|  4.10k|}

_ZNK5Botan3MD54nameEv:
   32|    116|      std::string name() const override { return "MD5"; }
_ZNK5Botan3MD513output_lengthEv:
   34|    229|      size_t output_length() const override { return output_bytes; }

_ZN5Botan18MerkleDamgard_HashINS_5SHA_1EEC2Ev:
   42|  6.42k|      MerkleDamgard_Hash() { clear(); }
_ZN5Botan18MerkleDamgard_HashINS_5SHA_1EE5clearEv:
   70|  12.8k|      void clear() {
   71|  12.8k|         MD::init(m_digest);
   72|  12.8k|         m_buffer.clear();
   73|  12.8k|         m_count = 0;
   74|  12.8k|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_224EEC2Ev:
   42|    180|      MerkleDamgard_Hash() { clear(); }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_224EE5clearEv:
   70|    360|      void clear() {
   71|    360|         MD::init(m_digest);
   72|    360|         m_buffer.clear();
   73|    360|         m_count = 0;
   74|    360|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_256EEC2Ev:
   42|  6.35k|      MerkleDamgard_Hash() { clear(); }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_256EE5clearEv:
   70|  15.9k|      void clear() {
   71|  15.9k|         MD::init(m_digest);
   72|  15.9k|         m_buffer.clear();
   73|  15.9k|         m_count = 0;
   74|  15.9k|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_384EEC2Ev:
   42|    229|      MerkleDamgard_Hash() { clear(); }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_384EE5clearEv:
   70|    575|      void clear() {
   71|    575|         MD::init(m_digest);
   72|    575|         m_buffer.clear();
   73|    575|         m_count = 0;
   74|    575|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_512EEC2Ev:
   42|     24|      MerkleDamgard_Hash() { clear(); }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_512EE5clearEv:
   70|     48|      void clear() {
   71|     48|         MD::init(m_digest);
   72|     48|         m_buffer.clear();
   73|     48|         m_count = 0;
   74|     48|      }
_ZN5Botan18MerkleDamgard_HashINS_11SHA_512_256EEC2Ev:
   42|     16|      MerkleDamgard_Hash() { clear(); }
_ZN5Botan18MerkleDamgard_HashINS_11SHA_512_256EE5clearEv:
   70|     32|      void clear() {
   71|     32|         MD::init(m_digest);
   72|     32|         m_buffer.clear();
   73|     32|         m_count = 0;
   74|     32|      }
_ZN5Botan18MerkleDamgard_HashINS_3MD5EEC2Ev:
   42|    116|      MerkleDamgard_Hash() { clear(); }
_ZN5Botan18MerkleDamgard_HashINS_3MD5EE5clearEv:
   70|    232|      void clear() {
   71|    232|         MD::init(m_digest);
   72|    232|         m_buffer.clear();
   73|    232|         m_count = 0;
   74|    232|      }
_ZN5Botan18MerkleDamgard_HashINS_3MD5EE6updateENSt3__14spanIKhLm18446744073709551615EEE:
   44|    116|      void update(std::span<const uint8_t> input) {
   45|    116|         BufferSlicer in(input);
   46|       |
   47|    348|         while(!in.empty()) {
  ------------------
  |  Branch (47:16): [True: 232, False: 116]
  ------------------
   48|    232|            if(const auto one_block = m_buffer.handle_unaligned_data(in)) {
  ------------------
  |  Branch (48:27): [True: 0, False: 232]
  ------------------
   49|      0|               MD::compress_n(m_digest, one_block.value(), 1);
   50|      0|            }
   51|       |
   52|    232|            if(m_buffer.in_alignment()) {
  ------------------
  |  Branch (52:16): [True: 116, False: 116]
  ------------------
   53|    116|               const auto [aligned_data, full_blocks] = m_buffer.aligned_data_to_process(in);
   54|    116|               if(full_blocks > 0) {
  ------------------
  |  Branch (54:19): [True: 116, False: 0]
  ------------------
   55|    116|                  MD::compress_n(m_digest, aligned_data, full_blocks);
   56|    116|               }
   57|    116|            }
   58|    232|         }
   59|       |
   60|    116|         m_count += input.size();
   61|    116|      }
_ZN5Botan18MerkleDamgard_HashINS_3MD5EE5finalENSt3__14spanIhLm18446744073709551615EEE:
   63|    116|      void final(std::span<uint8_t> output) {
   64|    116|         append_padding_bit();
   65|    116|         append_counter_and_finalize();
   66|    116|         copy_output(output);
   67|    116|         clear();
   68|    116|      }
_ZN5Botan18MerkleDamgard_HashINS_3MD5EE18append_padding_bitEv:
   77|    116|      void append_padding_bit() {
   78|    116|         BOTAN_ASSERT_NOMSG(!m_buffer.ready_to_consume());
  ------------------
  |  |   60|    116|   do {                                                                     \
  |  |   61|    116|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 116]
  |  |  ------------------
  |  |   62|    116|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    116|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   79|    116|         if constexpr(MD::bit_endianness == MD_Endian::Big) {
  ------------------
  |  Branch (79:23): [Folded - Ignored]
  ------------------
   80|    116|            const uint8_t final_byte = 0x80;
   81|    116|            m_buffer.append({&final_byte, 1});
   82|    116|         } else {
   83|    116|            const uint8_t final_byte = 0x01;
   84|    116|            m_buffer.append({&final_byte, 1});
   85|    116|         }
   86|    116|      }
_ZN5Botan18MerkleDamgard_HashINS_3MD5EE27append_counter_and_finalizeEv:
   88|    116|      void append_counter_and_finalize() {
   89|       |         // Compress the remaining data if the final data block does not provide
   90|       |         // enough space for the counter bytes.
   91|    116|         if(m_buffer.elements_until_alignment() < MD::ctr_bytes) {
  ------------------
  |  Branch (91:13): [True: 1, False: 115]
  ------------------
   92|      1|            m_buffer.fill_up_with_zeros();
   93|      1|            MD::compress_n(m_digest, m_buffer.consume(), 1);
   94|      1|         }
   95|       |
   96|       |         // Make sure that any remaining bytes in the very last block are zero.
   97|    116|         BOTAN_ASSERT_NOMSG(m_buffer.elements_until_alignment() >= MD::ctr_bytes);
  ------------------
  |  |   60|    116|   do {                                                                     \
  |  |   61|    116|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 116]
  |  |  ------------------
  |  |   62|    116|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    116|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   98|    116|         m_buffer.fill_up_with_zeros();
   99|       |
  100|       |         // Replace a bunch of the right-most zero-padding with the counter bytes.
  101|    116|         const uint64_t bit_count = m_count * 8;
  102|    116|         auto last_bytes = m_buffer.directly_modify_last(sizeof(bit_count));
  103|    116|         if constexpr(MD::byte_endianness == MD_Endian::Big) {
  ------------------
  |  Branch (103:23): [Folded - Ignored]
  ------------------
  104|    116|            store_be(bit_count, last_bytes.data());
  105|    116|         } else {
  106|    116|            store_le(bit_count, last_bytes.data());
  107|    116|         }
  108|       |
  109|       |         // Compress the very last block.
  110|    116|         MD::compress_n(m_digest, m_buffer.consume(), 1);
  111|    116|      }
_ZN5Botan18MerkleDamgard_HashINS_3MD5EE11copy_outputENSt3__14spanIhLm18446744073709551615EEE:
  113|    116|      void copy_output(std::span<uint8_t> output) {
  114|    116|         BOTAN_ASSERT_NOMSG(output.size() >= MD::output_bytes);
  ------------------
  |  |   60|    116|   do {                                                                     \
  |  |   61|    116|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 116]
  |  |  ------------------
  |  |   62|    116|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    116|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  115|       |
  116|    116|         if constexpr(MD::byte_endianness == MD_Endian::Big) {
  ------------------
  |  Branch (116:23): [Folded - Ignored]
  ------------------
  117|    116|            copy_out_vec_be(output.data(), MD::output_bytes, m_digest);
  118|    116|         } else {
  119|    116|            copy_out_vec_le(output.data(), MD::output_bytes, m_digest);
  120|    116|         }
  121|    116|      }
_ZN5Botan18MerkleDamgard_HashINS_5SHA_1EE6updateENSt3__14spanIKhLm18446744073709551615EEE:
   44|  6.46k|      void update(std::span<const uint8_t> input) {
   45|  6.46k|         BufferSlicer in(input);
   46|       |
   47|  17.6k|         while(!in.empty()) {
  ------------------
  |  Branch (47:16): [True: 11.1k, False: 6.46k]
  ------------------
   48|  11.1k|            if(const auto one_block = m_buffer.handle_unaligned_data(in)) {
  ------------------
  |  Branch (48:27): [True: 1, False: 11.1k]
  ------------------
   49|      1|               MD::compress_n(m_digest, one_block.value(), 1);
   50|      1|            }
   51|       |
   52|  11.1k|            if(m_buffer.in_alignment()) {
  ------------------
  |  Branch (52:16): [True: 4.94k, False: 6.21k]
  ------------------
   53|  4.94k|               const auto [aligned_data, full_blocks] = m_buffer.aligned_data_to_process(in);
   54|  4.94k|               if(full_blocks > 0) {
  ------------------
  |  Branch (54:19): [True: 4.94k, False: 0]
  ------------------
   55|  4.94k|                  MD::compress_n(m_digest, aligned_data, full_blocks);
   56|  4.94k|               }
   57|  4.94k|            }
   58|  11.1k|         }
   59|       |
   60|  6.46k|         m_count += input.size();
   61|  6.46k|      }
_ZN5Botan18MerkleDamgard_HashINS_5SHA_1EE5finalENSt3__14spanIhLm18446744073709551615EEE:
   63|  6.44k|      void final(std::span<uint8_t> output) {
   64|  6.44k|         append_padding_bit();
   65|  6.44k|         append_counter_and_finalize();
   66|  6.44k|         copy_output(output);
   67|  6.44k|         clear();
   68|  6.44k|      }
_ZN5Botan18MerkleDamgard_HashINS_5SHA_1EE18append_padding_bitEv:
   77|  6.44k|      void append_padding_bit() {
   78|  6.44k|         BOTAN_ASSERT_NOMSG(!m_buffer.ready_to_consume());
  ------------------
  |  |   60|  6.44k|   do {                                                                     \
  |  |   61|  6.44k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 6.44k]
  |  |  ------------------
  |  |   62|  6.44k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  6.44k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   79|  6.44k|         if constexpr(MD::bit_endianness == MD_Endian::Big) {
  ------------------
  |  Branch (79:23): [Folded - Ignored]
  ------------------
   80|  6.44k|            const uint8_t final_byte = 0x80;
   81|  6.44k|            m_buffer.append({&final_byte, 1});
   82|  6.44k|         } else {
   83|  6.44k|            const uint8_t final_byte = 0x01;
   84|  6.44k|            m_buffer.append({&final_byte, 1});
   85|  6.44k|         }
   86|  6.44k|      }
_ZN5Botan18MerkleDamgard_HashINS_5SHA_1EE27append_counter_and_finalizeEv:
   88|  6.44k|      void append_counter_and_finalize() {
   89|       |         // Compress the remaining data if the final data block does not provide
   90|       |         // enough space for the counter bytes.
   91|  6.44k|         if(m_buffer.elements_until_alignment() < MD::ctr_bytes) {
  ------------------
  |  Branch (91:13): [True: 1.10k, False: 5.34k]
  ------------------
   92|  1.10k|            m_buffer.fill_up_with_zeros();
   93|  1.10k|            MD::compress_n(m_digest, m_buffer.consume(), 1);
   94|  1.10k|         }
   95|       |
   96|       |         // Make sure that any remaining bytes in the very last block are zero.
   97|  6.44k|         BOTAN_ASSERT_NOMSG(m_buffer.elements_until_alignment() >= MD::ctr_bytes);
  ------------------
  |  |   60|  6.44k|   do {                                                                     \
  |  |   61|  6.44k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 6.44k]
  |  |  ------------------
  |  |   62|  6.44k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  6.44k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   98|  6.44k|         m_buffer.fill_up_with_zeros();
   99|       |
  100|       |         // Replace a bunch of the right-most zero-padding with the counter bytes.
  101|  6.44k|         const uint64_t bit_count = m_count * 8;
  102|  6.44k|         auto last_bytes = m_buffer.directly_modify_last(sizeof(bit_count));
  103|  6.44k|         if constexpr(MD::byte_endianness == MD_Endian::Big) {
  ------------------
  |  Branch (103:23): [Folded - Ignored]
  ------------------
  104|  6.44k|            store_be(bit_count, last_bytes.data());
  105|  6.44k|         } else {
  106|  6.44k|            store_le(bit_count, last_bytes.data());
  107|  6.44k|         }
  108|       |
  109|       |         // Compress the very last block.
  110|  6.44k|         MD::compress_n(m_digest, m_buffer.consume(), 1);
  111|  6.44k|      }
_ZN5Botan18MerkleDamgard_HashINS_5SHA_1EE11copy_outputENSt3__14spanIhLm18446744073709551615EEE:
  113|  6.44k|      void copy_output(std::span<uint8_t> output) {
  114|  6.44k|         BOTAN_ASSERT_NOMSG(output.size() >= MD::output_bytes);
  ------------------
  |  |   60|  6.44k|   do {                                                                     \
  |  |   61|  6.44k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 6.44k]
  |  |  ------------------
  |  |   62|  6.44k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  6.44k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  115|       |
  116|  6.44k|         if constexpr(MD::byte_endianness == MD_Endian::Big) {
  ------------------
  |  Branch (116:23): [Folded - Ignored]
  ------------------
  117|  6.44k|            copy_out_vec_be(output.data(), MD::output_bytes, m_digest);
  118|  6.44k|         } else {
  119|  6.44k|            copy_out_vec_le(output.data(), MD::output_bytes, m_digest);
  120|  6.44k|         }
  121|  6.44k|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_224EE6updateENSt3__14spanIKhLm18446744073709551615EEE:
   44|    180|      void update(std::span<const uint8_t> input) {
   45|    180|         BufferSlicer in(input);
   46|       |
   47|    539|         while(!in.empty()) {
  ------------------
  |  Branch (47:16): [True: 359, False: 180]
  ------------------
   48|    359|            if(const auto one_block = m_buffer.handle_unaligned_data(in)) {
  ------------------
  |  Branch (48:27): [True: 0, False: 359]
  ------------------
   49|      0|               MD::compress_n(m_digest, one_block.value(), 1);
   50|      0|            }
   51|       |
   52|    359|            if(m_buffer.in_alignment()) {
  ------------------
  |  Branch (52:16): [True: 180, False: 179]
  ------------------
   53|    180|               const auto [aligned_data, full_blocks] = m_buffer.aligned_data_to_process(in);
   54|    180|               if(full_blocks > 0) {
  ------------------
  |  Branch (54:19): [True: 180, False: 0]
  ------------------
   55|    180|                  MD::compress_n(m_digest, aligned_data, full_blocks);
   56|    180|               }
   57|    180|            }
   58|    359|         }
   59|       |
   60|    180|         m_count += input.size();
   61|    180|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_224EE5finalENSt3__14spanIhLm18446744073709551615EEE:
   63|    180|      void final(std::span<uint8_t> output) {
   64|    180|         append_padding_bit();
   65|    180|         append_counter_and_finalize();
   66|    180|         copy_output(output);
   67|    180|         clear();
   68|    180|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_224EE18append_padding_bitEv:
   77|    180|      void append_padding_bit() {
   78|    180|         BOTAN_ASSERT_NOMSG(!m_buffer.ready_to_consume());
  ------------------
  |  |   60|    180|   do {                                                                     \
  |  |   61|    180|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 180]
  |  |  ------------------
  |  |   62|    180|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    180|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   79|    180|         if constexpr(MD::bit_endianness == MD_Endian::Big) {
  ------------------
  |  Branch (79:23): [Folded - Ignored]
  ------------------
   80|    180|            const uint8_t final_byte = 0x80;
   81|    180|            m_buffer.append({&final_byte, 1});
   82|    180|         } else {
   83|    180|            const uint8_t final_byte = 0x01;
   84|    180|            m_buffer.append({&final_byte, 1});
   85|    180|         }
   86|    180|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_224EE27append_counter_and_finalizeEv:
   88|    180|      void append_counter_and_finalize() {
   89|       |         // Compress the remaining data if the final data block does not provide
   90|       |         // enough space for the counter bytes.
   91|    180|         if(m_buffer.elements_until_alignment() < MD::ctr_bytes) {
  ------------------
  |  Branch (91:13): [True: 1, False: 179]
  ------------------
   92|      1|            m_buffer.fill_up_with_zeros();
   93|      1|            MD::compress_n(m_digest, m_buffer.consume(), 1);
   94|      1|         }
   95|       |
   96|       |         // Make sure that any remaining bytes in the very last block are zero.
   97|    180|         BOTAN_ASSERT_NOMSG(m_buffer.elements_until_alignment() >= MD::ctr_bytes);
  ------------------
  |  |   60|    180|   do {                                                                     \
  |  |   61|    180|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 180]
  |  |  ------------------
  |  |   62|    180|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    180|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   98|    180|         m_buffer.fill_up_with_zeros();
   99|       |
  100|       |         // Replace a bunch of the right-most zero-padding with the counter bytes.
  101|    180|         const uint64_t bit_count = m_count * 8;
  102|    180|         auto last_bytes = m_buffer.directly_modify_last(sizeof(bit_count));
  103|    180|         if constexpr(MD::byte_endianness == MD_Endian::Big) {
  ------------------
  |  Branch (103:23): [Folded - Ignored]
  ------------------
  104|    180|            store_be(bit_count, last_bytes.data());
  105|    180|         } else {
  106|    180|            store_le(bit_count, last_bytes.data());
  107|    180|         }
  108|       |
  109|       |         // Compress the very last block.
  110|    180|         MD::compress_n(m_digest, m_buffer.consume(), 1);
  111|    180|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_224EE11copy_outputENSt3__14spanIhLm18446744073709551615EEE:
  113|    180|      void copy_output(std::span<uint8_t> output) {
  114|    180|         BOTAN_ASSERT_NOMSG(output.size() >= MD::output_bytes);
  ------------------
  |  |   60|    180|   do {                                                                     \
  |  |   61|    180|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 180]
  |  |  ------------------
  |  |   62|    180|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    180|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  115|       |
  116|    180|         if constexpr(MD::byte_endianness == MD_Endian::Big) {
  ------------------
  |  Branch (116:23): [Folded - Ignored]
  ------------------
  117|    180|            copy_out_vec_be(output.data(), MD::output_bytes, m_digest);
  118|    180|         } else {
  119|    180|            copy_out_vec_le(output.data(), MD::output_bytes, m_digest);
  120|    180|         }
  121|    180|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_256EE6updateENSt3__14spanIKhLm18446744073709551615EEE:
   44|  9.61k|      void update(std::span<const uint8_t> input) {
   45|  9.61k|         BufferSlicer in(input);
   46|       |
   47|  23.0k|         while(!in.empty()) {
  ------------------
  |  Branch (47:16): [True: 13.4k, False: 9.61k]
  ------------------
   48|  13.4k|            if(const auto one_block = m_buffer.handle_unaligned_data(in)) {
  ------------------
  |  Branch (48:27): [True: 4, False: 13.4k]
  ------------------
   49|      4|               MD::compress_n(m_digest, one_block.value(), 1);
   50|      4|            }
   51|       |
   52|  13.4k|            if(m_buffer.in_alignment()) {
  ------------------
  |  Branch (52:16): [True: 3.94k, False: 9.51k]
  ------------------
   53|  3.94k|               const auto [aligned_data, full_blocks] = m_buffer.aligned_data_to_process(in);
   54|  3.94k|               if(full_blocks > 0) {
  ------------------
  |  Branch (54:19): [True: 3.94k, False: 0]
  ------------------
   55|  3.94k|                  MD::compress_n(m_digest, aligned_data, full_blocks);
   56|  3.94k|               }
   57|  3.94k|            }
   58|  13.4k|         }
   59|       |
   60|  9.61k|         m_count += input.size();
   61|  9.61k|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_256EE5finalENSt3__14spanIhLm18446744073709551615EEE:
   63|  9.54k|      void final(std::span<uint8_t> output) {
   64|  9.54k|         append_padding_bit();
   65|  9.54k|         append_counter_and_finalize();
   66|  9.54k|         copy_output(output);
   67|  9.54k|         clear();
   68|  9.54k|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_256EE18append_padding_bitEv:
   77|  9.54k|      void append_padding_bit() {
   78|  9.54k|         BOTAN_ASSERT_NOMSG(!m_buffer.ready_to_consume());
  ------------------
  |  |   60|  9.54k|   do {                                                                     \
  |  |   61|  9.54k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 9.54k]
  |  |  ------------------
  |  |   62|  9.54k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  9.54k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   79|  9.54k|         if constexpr(MD::bit_endianness == MD_Endian::Big) {
  ------------------
  |  Branch (79:23): [Folded - Ignored]
  ------------------
   80|  9.54k|            const uint8_t final_byte = 0x80;
   81|  9.54k|            m_buffer.append({&final_byte, 1});
   82|  9.54k|         } else {
   83|  9.54k|            const uint8_t final_byte = 0x01;
   84|  9.54k|            m_buffer.append({&final_byte, 1});
   85|  9.54k|         }
   86|  9.54k|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_256EE27append_counter_and_finalizeEv:
   88|  9.54k|      void append_counter_and_finalize() {
   89|       |         // Compress the remaining data if the final data block does not provide
   90|       |         // enough space for the counter bytes.
   91|  9.54k|         if(m_buffer.elements_until_alignment() < MD::ctr_bytes) {
  ------------------
  |  Branch (91:13): [True: 1.15k, False: 8.39k]
  ------------------
   92|  1.15k|            m_buffer.fill_up_with_zeros();
   93|  1.15k|            MD::compress_n(m_digest, m_buffer.consume(), 1);
   94|  1.15k|         }
   95|       |
   96|       |         // Make sure that any remaining bytes in the very last block are zero.
   97|  9.54k|         BOTAN_ASSERT_NOMSG(m_buffer.elements_until_alignment() >= MD::ctr_bytes);
  ------------------
  |  |   60|  9.54k|   do {                                                                     \
  |  |   61|  9.54k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 9.54k]
  |  |  ------------------
  |  |   62|  9.54k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  9.54k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   98|  9.54k|         m_buffer.fill_up_with_zeros();
   99|       |
  100|       |         // Replace a bunch of the right-most zero-padding with the counter bytes.
  101|  9.54k|         const uint64_t bit_count = m_count * 8;
  102|  9.54k|         auto last_bytes = m_buffer.directly_modify_last(sizeof(bit_count));
  103|  9.54k|         if constexpr(MD::byte_endianness == MD_Endian::Big) {
  ------------------
  |  Branch (103:23): [Folded - Ignored]
  ------------------
  104|  9.54k|            store_be(bit_count, last_bytes.data());
  105|  9.54k|         } else {
  106|  9.54k|            store_le(bit_count, last_bytes.data());
  107|  9.54k|         }
  108|       |
  109|       |         // Compress the very last block.
  110|  9.54k|         MD::compress_n(m_digest, m_buffer.consume(), 1);
  111|  9.54k|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_256EE11copy_outputENSt3__14spanIhLm18446744073709551615EEE:
  113|  9.54k|      void copy_output(std::span<uint8_t> output) {
  114|  9.54k|         BOTAN_ASSERT_NOMSG(output.size() >= MD::output_bytes);
  ------------------
  |  |   60|  9.54k|   do {                                                                     \
  |  |   61|  9.54k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 9.54k]
  |  |  ------------------
  |  |   62|  9.54k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  9.54k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  115|       |
  116|  9.54k|         if constexpr(MD::byte_endianness == MD_Endian::Big) {
  ------------------
  |  Branch (116:23): [Folded - Ignored]
  ------------------
  117|  9.54k|            copy_out_vec_be(output.data(), MD::output_bytes, m_digest);
  118|  9.54k|         } else {
  119|  9.54k|            copy_out_vec_le(output.data(), MD::output_bytes, m_digest);
  120|  9.54k|         }
  121|  9.54k|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_384EE6updateENSt3__14spanIKhLm18446744073709551615EEE:
   44|    477|      void update(std::span<const uint8_t> input) {
   45|    477|         BufferSlicer in(input);
   46|       |
   47|  1.19k|         while(!in.empty()) {
  ------------------
  |  Branch (47:16): [True: 713, False: 477]
  ------------------
   48|    713|            if(const auto one_block = m_buffer.handle_unaligned_data(in)) {
  ------------------
  |  Branch (48:27): [True: 8, False: 705]
  ------------------
   49|      8|               MD::compress_n(m_digest, one_block.value(), 1);
   50|      8|            }
   51|       |
   52|    713|            if(m_buffer.in_alignment()) {
  ------------------
  |  Branch (52:16): [True: 237, False: 476]
  ------------------
   53|    237|               const auto [aligned_data, full_blocks] = m_buffer.aligned_data_to_process(in);
   54|    237|               if(full_blocks > 0) {
  ------------------
  |  Branch (54:19): [True: 237, False: 0]
  ------------------
   55|    237|                  MD::compress_n(m_digest, aligned_data, full_blocks);
   56|    237|               }
   57|    237|            }
   58|    713|         }
   59|       |
   60|    477|         m_count += input.size();
   61|    477|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_512EE6updateENSt3__14spanIKhLm18446744073709551615EEE:
   44|     24|      void update(std::span<const uint8_t> input) {
   45|     24|         BufferSlicer in(input);
   46|       |
   47|     71|         while(!in.empty()) {
  ------------------
  |  Branch (47:16): [True: 47, False: 24]
  ------------------
   48|     47|            if(const auto one_block = m_buffer.handle_unaligned_data(in)) {
  ------------------
  |  Branch (48:27): [True: 0, False: 47]
  ------------------
   49|      0|               MD::compress_n(m_digest, one_block.value(), 1);
   50|      0|            }
   51|       |
   52|     47|            if(m_buffer.in_alignment()) {
  ------------------
  |  Branch (52:16): [True: 24, False: 23]
  ------------------
   53|     24|               const auto [aligned_data, full_blocks] = m_buffer.aligned_data_to_process(in);
   54|     24|               if(full_blocks > 0) {
  ------------------
  |  Branch (54:19): [True: 24, False: 0]
  ------------------
   55|     24|                  MD::compress_n(m_digest, aligned_data, full_blocks);
   56|     24|               }
   57|     24|            }
   58|     47|         }
   59|       |
   60|     24|         m_count += input.size();
   61|     24|      }
_ZN5Botan18MerkleDamgard_HashINS_11SHA_512_256EE6updateENSt3__14spanIKhLm18446744073709551615EEE:
   44|     16|      void update(std::span<const uint8_t> input) {
   45|     16|         BufferSlicer in(input);
   46|       |
   47|     48|         while(!in.empty()) {
  ------------------
  |  Branch (47:16): [True: 32, False: 16]
  ------------------
   48|     32|            if(const auto one_block = m_buffer.handle_unaligned_data(in)) {
  ------------------
  |  Branch (48:27): [True: 0, False: 32]
  ------------------
   49|      0|               MD::compress_n(m_digest, one_block.value(), 1);
   50|      0|            }
   51|       |
   52|     32|            if(m_buffer.in_alignment()) {
  ------------------
  |  Branch (52:16): [True: 16, False: 16]
  ------------------
   53|     16|               const auto [aligned_data, full_blocks] = m_buffer.aligned_data_to_process(in);
   54|     16|               if(full_blocks > 0) {
  ------------------
  |  Branch (54:19): [True: 16, False: 0]
  ------------------
   55|     16|                  MD::compress_n(m_digest, aligned_data, full_blocks);
   56|     16|               }
   57|     16|            }
   58|     32|         }
   59|       |
   60|     16|         m_count += input.size();
   61|     16|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_384EE5finalENSt3__14spanIhLm18446744073709551615EEE:
   63|    346|      void final(std::span<uint8_t> output) {
   64|    346|         append_padding_bit();
   65|    346|         append_counter_and_finalize();
   66|    346|         copy_output(output);
   67|    346|         clear();
   68|    346|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_384EE18append_padding_bitEv:
   77|    346|      void append_padding_bit() {
   78|    346|         BOTAN_ASSERT_NOMSG(!m_buffer.ready_to_consume());
  ------------------
  |  |   60|    346|   do {                                                                     \
  |  |   61|    346|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 346]
  |  |  ------------------
  |  |   62|    346|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    346|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   79|    346|         if constexpr(MD::bit_endianness == MD_Endian::Big) {
  ------------------
  |  Branch (79:23): [Folded - Ignored]
  ------------------
   80|    346|            const uint8_t final_byte = 0x80;
   81|    346|            m_buffer.append({&final_byte, 1});
   82|    346|         } else {
   83|    346|            const uint8_t final_byte = 0x01;
   84|    346|            m_buffer.append({&final_byte, 1});
   85|    346|         }
   86|    346|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_384EE27append_counter_and_finalizeEv:
   88|    346|      void append_counter_and_finalize() {
   89|       |         // Compress the remaining data if the final data block does not provide
   90|       |         // enough space for the counter bytes.
   91|    346|         if(m_buffer.elements_until_alignment() < MD::ctr_bytes) {
  ------------------
  |  Branch (91:13): [True: 2, False: 344]
  ------------------
   92|      2|            m_buffer.fill_up_with_zeros();
   93|      2|            MD::compress_n(m_digest, m_buffer.consume(), 1);
   94|      2|         }
   95|       |
   96|       |         // Make sure that any remaining bytes in the very last block are zero.
   97|    346|         BOTAN_ASSERT_NOMSG(m_buffer.elements_until_alignment() >= MD::ctr_bytes);
  ------------------
  |  |   60|    346|   do {                                                                     \
  |  |   61|    346|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 346]
  |  |  ------------------
  |  |   62|    346|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    346|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   98|    346|         m_buffer.fill_up_with_zeros();
   99|       |
  100|       |         // Replace a bunch of the right-most zero-padding with the counter bytes.
  101|    346|         const uint64_t bit_count = m_count * 8;
  102|    346|         auto last_bytes = m_buffer.directly_modify_last(sizeof(bit_count));
  103|    346|         if constexpr(MD::byte_endianness == MD_Endian::Big) {
  ------------------
  |  Branch (103:23): [Folded - Ignored]
  ------------------
  104|    346|            store_be(bit_count, last_bytes.data());
  105|    346|         } else {
  106|    346|            store_le(bit_count, last_bytes.data());
  107|    346|         }
  108|       |
  109|       |         // Compress the very last block.
  110|    346|         MD::compress_n(m_digest, m_buffer.consume(), 1);
  111|    346|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_384EE11copy_outputENSt3__14spanIhLm18446744073709551615EEE:
  113|    346|      void copy_output(std::span<uint8_t> output) {
  114|    346|         BOTAN_ASSERT_NOMSG(output.size() >= MD::output_bytes);
  ------------------
  |  |   60|    346|   do {                                                                     \
  |  |   61|    346|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 346]
  |  |  ------------------
  |  |   62|    346|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    346|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  115|       |
  116|    346|         if constexpr(MD::byte_endianness == MD_Endian::Big) {
  ------------------
  |  Branch (116:23): [Folded - Ignored]
  ------------------
  117|    346|            copy_out_vec_be(output.data(), MD::output_bytes, m_digest);
  118|    346|         } else {
  119|    346|            copy_out_vec_le(output.data(), MD::output_bytes, m_digest);
  120|    346|         }
  121|    346|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_512EE5finalENSt3__14spanIhLm18446744073709551615EEE:
   63|     24|      void final(std::span<uint8_t> output) {
   64|     24|         append_padding_bit();
   65|     24|         append_counter_and_finalize();
   66|     24|         copy_output(output);
   67|     24|         clear();
   68|     24|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_512EE18append_padding_bitEv:
   77|     24|      void append_padding_bit() {
   78|     24|         BOTAN_ASSERT_NOMSG(!m_buffer.ready_to_consume());
  ------------------
  |  |   60|     24|   do {                                                                     \
  |  |   61|     24|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 24]
  |  |  ------------------
  |  |   62|     24|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|     24|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   79|     24|         if constexpr(MD::bit_endianness == MD_Endian::Big) {
  ------------------
  |  Branch (79:23): [Folded - Ignored]
  ------------------
   80|     24|            const uint8_t final_byte = 0x80;
   81|     24|            m_buffer.append({&final_byte, 1});
   82|     24|         } else {
   83|     24|            const uint8_t final_byte = 0x01;
   84|     24|            m_buffer.append({&final_byte, 1});
   85|     24|         }
   86|     24|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_512EE27append_counter_and_finalizeEv:
   88|     24|      void append_counter_and_finalize() {
   89|       |         // Compress the remaining data if the final data block does not provide
   90|       |         // enough space for the counter bytes.
   91|     24|         if(m_buffer.elements_until_alignment() < MD::ctr_bytes) {
  ------------------
  |  Branch (91:13): [True: 1, False: 23]
  ------------------
   92|      1|            m_buffer.fill_up_with_zeros();
   93|      1|            MD::compress_n(m_digest, m_buffer.consume(), 1);
   94|      1|         }
   95|       |
   96|       |         // Make sure that any remaining bytes in the very last block are zero.
   97|     24|         BOTAN_ASSERT_NOMSG(m_buffer.elements_until_alignment() >= MD::ctr_bytes);
  ------------------
  |  |   60|     24|   do {                                                                     \
  |  |   61|     24|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 24]
  |  |  ------------------
  |  |   62|     24|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|     24|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   98|     24|         m_buffer.fill_up_with_zeros();
   99|       |
  100|       |         // Replace a bunch of the right-most zero-padding with the counter bytes.
  101|     24|         const uint64_t bit_count = m_count * 8;
  102|     24|         auto last_bytes = m_buffer.directly_modify_last(sizeof(bit_count));
  103|     24|         if constexpr(MD::byte_endianness == MD_Endian::Big) {
  ------------------
  |  Branch (103:23): [Folded - Ignored]
  ------------------
  104|     24|            store_be(bit_count, last_bytes.data());
  105|     24|         } else {
  106|     24|            store_le(bit_count, last_bytes.data());
  107|     24|         }
  108|       |
  109|       |         // Compress the very last block.
  110|     24|         MD::compress_n(m_digest, m_buffer.consume(), 1);
  111|     24|      }
_ZN5Botan18MerkleDamgard_HashINS_7SHA_512EE11copy_outputENSt3__14spanIhLm18446744073709551615EEE:
  113|     24|      void copy_output(std::span<uint8_t> output) {
  114|     24|         BOTAN_ASSERT_NOMSG(output.size() >= MD::output_bytes);
  ------------------
  |  |   60|     24|   do {                                                                     \
  |  |   61|     24|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 24]
  |  |  ------------------
  |  |   62|     24|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|     24|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  115|       |
  116|     24|         if constexpr(MD::byte_endianness == MD_Endian::Big) {
  ------------------
  |  Branch (116:23): [Folded - Ignored]
  ------------------
  117|     24|            copy_out_vec_be(output.data(), MD::output_bytes, m_digest);
  118|     24|         } else {
  119|     24|            copy_out_vec_le(output.data(), MD::output_bytes, m_digest);
  120|     24|         }
  121|     24|      }
_ZN5Botan18MerkleDamgard_HashINS_11SHA_512_256EE5finalENSt3__14spanIhLm18446744073709551615EEE:
   63|     16|      void final(std::span<uint8_t> output) {
   64|     16|         append_padding_bit();
   65|     16|         append_counter_and_finalize();
   66|     16|         copy_output(output);
   67|     16|         clear();
   68|     16|      }
_ZN5Botan18MerkleDamgard_HashINS_11SHA_512_256EE18append_padding_bitEv:
   77|     16|      void append_padding_bit() {
   78|     16|         BOTAN_ASSERT_NOMSG(!m_buffer.ready_to_consume());
  ------------------
  |  |   60|     16|   do {                                                                     \
  |  |   61|     16|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 16]
  |  |  ------------------
  |  |   62|     16|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|     16|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   79|     16|         if constexpr(MD::bit_endianness == MD_Endian::Big) {
  ------------------
  |  Branch (79:23): [Folded - Ignored]
  ------------------
   80|     16|            const uint8_t final_byte = 0x80;
   81|     16|            m_buffer.append({&final_byte, 1});
   82|     16|         } else {
   83|     16|            const uint8_t final_byte = 0x01;
   84|     16|            m_buffer.append({&final_byte, 1});
   85|     16|         }
   86|     16|      }
_ZN5Botan18MerkleDamgard_HashINS_11SHA_512_256EE27append_counter_and_finalizeEv:
   88|     16|      void append_counter_and_finalize() {
   89|       |         // Compress the remaining data if the final data block does not provide
   90|       |         // enough space for the counter bytes.
   91|     16|         if(m_buffer.elements_until_alignment() < MD::ctr_bytes) {
  ------------------
  |  Branch (91:13): [True: 0, False: 16]
  ------------------
   92|      0|            m_buffer.fill_up_with_zeros();
   93|      0|            MD::compress_n(m_digest, m_buffer.consume(), 1);
   94|      0|         }
   95|       |
   96|       |         // Make sure that any remaining bytes in the very last block are zero.
   97|     16|         BOTAN_ASSERT_NOMSG(m_buffer.elements_until_alignment() >= MD::ctr_bytes);
  ------------------
  |  |   60|     16|   do {                                                                     \
  |  |   61|     16|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 16]
  |  |  ------------------
  |  |   62|     16|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|     16|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   98|     16|         m_buffer.fill_up_with_zeros();
   99|       |
  100|       |         // Replace a bunch of the right-most zero-padding with the counter bytes.
  101|     16|         const uint64_t bit_count = m_count * 8;
  102|     16|         auto last_bytes = m_buffer.directly_modify_last(sizeof(bit_count));
  103|     16|         if constexpr(MD::byte_endianness == MD_Endian::Big) {
  ------------------
  |  Branch (103:23): [Folded - Ignored]
  ------------------
  104|     16|            store_be(bit_count, last_bytes.data());
  105|     16|         } else {
  106|     16|            store_le(bit_count, last_bytes.data());
  107|     16|         }
  108|       |
  109|       |         // Compress the very last block.
  110|     16|         MD::compress_n(m_digest, m_buffer.consume(), 1);
  111|     16|      }
_ZN5Botan18MerkleDamgard_HashINS_11SHA_512_256EE11copy_outputENSt3__14spanIhLm18446744073709551615EEE:
  113|     16|      void copy_output(std::span<uint8_t> output) {
  114|     16|         BOTAN_ASSERT_NOMSG(output.size() >= MD::output_bytes);
  ------------------
  |  |   60|     16|   do {                                                                     \
  |  |   61|     16|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 16]
  |  |  ------------------
  |  |   62|     16|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|     16|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  115|       |
  116|     16|         if constexpr(MD::byte_endianness == MD_Endian::Big) {
  ------------------
  |  Branch (116:23): [Folded - Ignored]
  ------------------
  117|     16|            copy_out_vec_be(output.data(), MD::output_bytes, m_digest);
  118|     16|         } else {
  119|     16|            copy_out_vec_le(output.data(), MD::output_bytes, m_digest);
  120|     16|         }
  121|     16|      }

_ZNK5Botan14Montgomery_Int4reprEv:
   76|  1.00M|      const BigInt& repr() const { return m_v; }
_ZNK5Botan14Montgomery_Int17const_time_poisonEv:
  122|  20.3k|      void const_time_poison() const { m_v.const_time_poison(); }
_ZNK5Botan14Montgomery_Int19const_time_unpoisonEv:
  124|  16.5k|      void const_time_unpoison() const { return m_v.const_time_unpoison(); }
_ZNK5Botan17Montgomery_Params1pEv:
  148|  33.1k|      const BigInt& p() const { return m_p; }
_ZNK5Botan17Montgomery_Params2R1Ev:
  150|  16.5k|      const BigInt& R1() const { return m_r1; }
_ZNK5Botan17Montgomery_Params2R2Ev:
  152|  16.5k|      const BigInt& R2() const { return m_r2; }
_ZNK5Botan17Montgomery_Params7p_wordsEv:
  158|   261k|      size_t p_words() const { return m_p_words; }

_ZN5Botan17monty_exp_vartimeERKNSt3__110shared_ptrIKNS_17Montgomery_ParamsEEERKNS_6BigIntES9_:
   51|  14.9k|                                const BigInt& k) {
   52|  14.9k|   auto precomputed = monty_precompute(params_p, g, 4, false);
   53|  14.9k|   return monty_execute_vartime(*precomputed, k);
   54|  14.9k|}

_ZN5Botan10word8_sub3EPmPKmS2_m:
  413|  20.7M|inline word word8_sub3(word z[8], const word x[8], const word y[8], word carry) {
  414|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  415|       |   asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "sbbl"))
  416|       |       : [carry] "=r"(carry)
  417|       |       : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry)
  418|       |       : "cc", "memory");
  419|       |
  420|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  421|  20.7M|   asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "sbbq"))
  422|  20.7M|       : [carry] "=r"(carry)
  423|  20.7M|       : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry)
  424|  20.7M|       : "cc", "memory");
  425|       |
  426|       |#else
  427|       |   z[0] = word_sub(x[0], y[0], &carry);
  428|       |   z[1] = word_sub(x[1], y[1], &carry);
  429|       |   z[2] = word_sub(x[2], y[2], &carry);
  430|       |   z[3] = word_sub(x[3], y[3], &carry);
  431|       |   z[4] = word_sub(x[4], y[4], &carry);
  432|       |   z[5] = word_sub(x[5], y[5], &carry);
  433|       |   z[6] = word_sub(x[6], y[6], &carry);
  434|       |   z[7] = word_sub(x[7], y[7], &carry);
  435|       |#endif
  436|       |
  437|  20.7M|   return carry;
  438|  20.7M|}
_ZN5Botan8word_subEmmPm:
  326|   203M|inline word word_sub(word x, word y, word* carry) {
  327|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  328|       |   asm(ADD_OR_SUBTRACT(ASM("sbbl %[y],%[x]"))
  329|       |       : [x] "=r"(x), [carry] "=r"(*carry)
  330|       |       : "0"(x), [y] "rm"(y), "1"(*carry)
  331|       |       : "cc");
  332|       |   return x;
  333|       |
  334|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  335|   203M|   asm(ADD_OR_SUBTRACT(ASM("sbbq %[y],%[x]"))
  336|   203M|       : [x] "=r"(x), [carry] "=r"(*carry)
  337|   203M|       : "0"(x), [y] "rm"(y), "1"(*carry)
  338|   203M|       : "cc");
  339|   203M|   return x;
  340|       |
  341|       |#else
  342|       |   word t0 = x - y;
  343|       |   word c1 = (t0 > x);
  344|       |   word z = t0 - *carry;
  345|       |   *carry = c1 | (z > t0);
  346|       |   return z;
  347|       |#endif
  348|   203M|}
_ZN5Botan10word8_add3EPmPKmS2_m:
  296|  1.28M|inline word word8_add3(word z[8], const word x[8], const word y[8], word carry) {
  297|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  298|       |   asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "adcl"))
  299|       |       : [carry] "=r"(carry)
  300|       |       : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry)
  301|       |       : "cc", "memory");
  302|       |
  303|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  304|  1.28M|   asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "adcq"))
  305|  1.28M|       : [carry] "=r"(carry)
  306|  1.28M|       : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry)
  307|  1.28M|       : "cc", "memory");
  308|       |
  309|       |#else
  310|       |   z[0] = word_add(x[0], y[0], &carry);
  311|       |   z[1] = word_add(x[1], y[1], &carry);
  312|       |   z[2] = word_add(x[2], y[2], &carry);
  313|       |   z[3] = word_add(x[3], y[3], &carry);
  314|       |   z[4] = word_add(x[4], y[4], &carry);
  315|       |   z[5] = word_add(x[5], y[5], &carry);
  316|       |   z[6] = word_add(x[6], y[6], &carry);
  317|       |   z[7] = word_add(x[7], y[7], &carry);
  318|       |#endif
  319|       |
  320|  1.28M|   return carry;
  321|  1.28M|}
_ZN5Botan8word_addEmmPm:
  237|  52.9M|inline word word_add(word x, word y, word* carry) {
  238|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  239|       |   asm(ADD_OR_SUBTRACT(ASM("adcl %[y],%[x]"))
  240|       |       : [x] "=r"(x), [carry] "=r"(*carry)
  241|       |       : "0"(x), [y] "rm"(y), "1"(*carry)
  242|       |       : "cc");
  243|       |   return x;
  244|       |
  245|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  246|       |
  247|  52.9M|   asm(ADD_OR_SUBTRACT(ASM("adcq %[y],%[x]"))
  248|  52.9M|       : [x] "=r"(x), [carry] "=r"(*carry)
  249|  52.9M|       : "0"(x), [y] "rm"(y), "1"(*carry)
  250|  52.9M|       : "cc");
  251|  52.9M|   return x;
  252|       |
  253|       |#else
  254|       |   word z = x + y;
  255|       |   word c1 = (z < x);
  256|       |   z += *carry;
  257|       |   *carry = c1 | (z < *carry);
  258|       |   return z;
  259|       |#endif
  260|  52.9M|}
_ZN5Botan10word_madd2EmmPm:
   44|  10.8M|inline word word_madd2(word a, word b, word* c) {
   45|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
   46|       |   asm(R"(
   47|       |      mull %[b]
   48|       |      addl %[c],%[a]
   49|       |      adcl $0,%[carry]
   50|       |      )"
   51|       |       : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*c)
   52|       |       : "0"(a), "1"(b), [c] "g"(*c)
   53|       |       : "cc");
   54|       |
   55|       |   return a;
   56|       |
   57|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
   58|  10.8M|   asm(R"(
   59|  10.8M|      mulq %[b]
   60|  10.8M|      addq %[c],%[a]
   61|  10.8M|      adcq $0,%[carry]
   62|  10.8M|      )"
   63|  10.8M|       : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*c)
   64|  10.8M|       : "0"(a), "1"(b), [c] "g"(*c)
   65|  10.8M|       : "cc");
   66|       |
   67|  10.8M|   return a;
   68|       |
   69|       |#elif defined(BOTAN_MP_DWORD)
   70|       |   const BOTAN_MP_DWORD s = static_cast<BOTAN_MP_DWORD>(a) * b + *c;
   71|       |   *c = static_cast<word>(s >> BOTAN_MP_WORD_BITS);
   72|       |   return static_cast<word>(s);
   73|       |#else
   74|       |   static_assert(BOTAN_MP_WORD_BITS == 64, "Unexpected word size");
   75|       |
   76|       |   word hi = 0, lo = 0;
   77|       |
   78|       |   mul64x64_128(a, b, &lo, &hi);
   79|       |
   80|       |   lo += *c;
   81|       |   hi += (lo < *c);  // carry?
   82|       |
   83|       |   *c = hi;
   84|       |   return lo;
   85|       |#endif
   86|  10.8M|}
_ZN5Botan10word_madd3EmmmPm:
   91|  44.8M|inline word word_madd3(word a, word b, word c, word* d) {
   92|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
   93|       |   asm(R"(
   94|       |      mull %[b]
   95|       |
   96|       |      addl %[c],%[a]
   97|       |      adcl $0,%[carry]
   98|       |
   99|       |      addl %[d],%[a]
  100|       |      adcl $0,%[carry]
  101|       |      )"
  102|       |       : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*d)
  103|       |       : "0"(a), "1"(b), [c] "g"(c), [d] "g"(*d)
  104|       |       : "cc");
  105|       |
  106|       |   return a;
  107|       |
  108|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  109|  44.8M|   asm(R"(
  110|  44.8M|      mulq %[b]
  111|  44.8M|
  112|  44.8M|      addq %[c],%[a]
  113|  44.8M|      adcq $0,%[carry]
  114|  44.8M|
  115|  44.8M|      addq %[d],%[a]
  116|  44.8M|      adcq $0,%[carry]
  117|  44.8M|      )"
  118|  44.8M|       : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*d)
  119|  44.8M|       : "0"(a), "1"(b), [c] "g"(c), [d] "g"(*d)
  120|  44.8M|       : "cc");
  121|       |
  122|  44.8M|   return a;
  123|       |
  124|       |#elif defined(BOTAN_MP_DWORD)
  125|       |   const BOTAN_MP_DWORD s = static_cast<BOTAN_MP_DWORD>(a) * b + c + *d;
  126|       |   *d = static_cast<word>(s >> BOTAN_MP_WORD_BITS);
  127|       |   return static_cast<word>(s);
  128|       |#else
  129|       |   static_assert(BOTAN_MP_WORD_BITS == 64, "Unexpected word size");
  130|       |
  131|       |   word hi = 0, lo = 0;
  132|       |
  133|       |   mul64x64_128(a, b, &lo, &hi);
  134|       |
  135|       |   lo += c;
  136|       |   hi += (lo < c);  // carry?
  137|       |
  138|       |   lo += *d;
  139|       |   hi += (lo < *d);  // carry?
  140|       |
  141|       |   *d = hi;
  142|       |   return lo;
  143|       |#endif
  144|  44.8M|}
_ZN5Botan10word8_add2EPmPKmm:
  265|   486k|inline word word8_add2(word x[8], const word y[8], word carry) {
  266|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  267|       |   asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "adcl"))
  268|       |       : [carry] "=r"(carry)
  269|       |       : [x] "r"(x), [y] "r"(y), "0"(carry)
  270|       |       : "cc", "memory");
  271|       |
  272|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  273|       |
  274|   486k|   asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "adcq"))
  275|   486k|       : [carry] "=r"(carry)
  276|   486k|       : [x] "r"(x), [y] "r"(y), "0"(carry)
  277|   486k|       : "cc", "memory");
  278|       |
  279|       |#else
  280|       |   x[0] = word_add(x[0], y[0], &carry);
  281|       |   x[1] = word_add(x[1], y[1], &carry);
  282|       |   x[2] = word_add(x[2], y[2], &carry);
  283|       |   x[3] = word_add(x[3], y[3], &carry);
  284|       |   x[4] = word_add(x[4], y[4], &carry);
  285|       |   x[5] = word_add(x[5], y[5], &carry);
  286|       |   x[6] = word_add(x[6], y[6], &carry);
  287|       |   x[7] = word_add(x[7], y[7], &carry);
  288|       |#endif
  289|       |
  290|   486k|   return carry;
  291|   486k|}
_ZN5Botan10word8_sub2EPmPKmm:
  353|   115k|inline word word8_sub2(word x[8], const word y[8], word carry) {
  354|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  355|       |   asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "sbbl"))
  356|       |       : [carry] "=r"(carry)
  357|       |       : [x] "r"(x), [y] "r"(y), "0"(carry)
  358|       |       : "cc", "memory");
  359|       |
  360|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  361|   115k|   asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "sbbq"))
  362|   115k|       : [carry] "=r"(carry)
  363|   115k|       : [x] "r"(x), [y] "r"(y), "0"(carry)
  364|   115k|       : "cc", "memory");
  365|       |
  366|       |#else
  367|       |   x[0] = word_sub(x[0], y[0], &carry);
  368|       |   x[1] = word_sub(x[1], y[1], &carry);
  369|       |   x[2] = word_sub(x[2], y[2], &carry);
  370|       |   x[3] = word_sub(x[3], y[3], &carry);
  371|       |   x[4] = word_sub(x[4], y[4], &carry);
  372|       |   x[5] = word_sub(x[5], y[5], &carry);
  373|       |   x[6] = word_sub(x[6], y[6], &carry);
  374|       |   x[7] = word_sub(x[7], y[7], &carry);
  375|       |#endif
  376|       |
  377|   115k|   return carry;
  378|   115k|}
_ZN5Botan14word8_sub2_revEPmPKmm:
  383|    624|inline word word8_sub2_rev(word x[8], const word y[8], word carry) {
  384|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  385|       |   asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "sbbl"))
  386|       |       : [carry] "=r"(carry)
  387|       |       : [x] "r"(y), [y] "r"(x), [z] "r"(x), "0"(carry)
  388|       |       : "cc", "memory");
  389|       |
  390|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  391|    624|   asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "sbbq"))
  392|    624|       : [carry] "=r"(carry)
  393|    624|       : [x] "r"(y), [y] "r"(x), [z] "r"(x), "0"(carry)
  394|    624|       : "cc", "memory");
  395|       |
  396|       |#else
  397|       |   x[0] = word_sub(y[0], x[0], &carry);
  398|       |   x[1] = word_sub(y[1], x[1], &carry);
  399|       |   x[2] = word_sub(y[2], x[2], &carry);
  400|       |   x[3] = word_sub(y[3], x[3], &carry);
  401|       |   x[4] = word_sub(y[4], x[4], &carry);
  402|       |   x[5] = word_sub(y[5], x[5], &carry);
  403|       |   x[6] = word_sub(y[6], x[6], &carry);
  404|       |   x[7] = word_sub(y[7], x[7], &carry);
  405|       |#endif
  406|       |
  407|    624|   return carry;
  408|    624|}
_ZN5Botan13word8_linmul2EPmmm:
  443|  22.9M|inline word word8_linmul2(word x[8], word y, word carry) {
  444|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  445|       |   asm(DO_8_TIMES(LINMUL_OP, "x") : [carry] "=r"(carry) : [x] "r"(x), [y] "rm"(y), "0"(carry) : "cc", "%eax", "%edx");
  446|       |
  447|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  448|  22.9M|   asm(DO_8_TIMES(LINMUL_OP, "x") : [carry] "=r"(carry) : [x] "r"(x), [y] "rm"(y), "0"(carry) : "cc", "%rax", "%rdx");
  449|       |
  450|       |#else
  451|       |   x[0] = word_madd2(x[0], y, &carry);
  452|       |   x[1] = word_madd2(x[1], y, &carry);
  453|       |   x[2] = word_madd2(x[2], y, &carry);
  454|       |   x[3] = word_madd2(x[3], y, &carry);
  455|       |   x[4] = word_madd2(x[4], y, &carry);
  456|       |   x[5] = word_madd2(x[5], y, &carry);
  457|       |   x[6] = word_madd2(x[6], y, &carry);
  458|       |   x[7] = word_madd2(x[7], y, &carry);
  459|       |#endif
  460|       |
  461|  22.9M|   return carry;
  462|  22.9M|}
_ZN5Botan13word8_linmul3EPmPKmmm:
  467|   414k|inline word word8_linmul3(word z[8], const word x[8], word y, word carry) {
  468|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  469|       |   asm(DO_8_TIMES(LINMUL_OP, "z")
  470|       |       : [carry] "=r"(carry)
  471|       |       : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry)
  472|       |       : "cc", "%eax", "%edx");
  473|       |
  474|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  475|   414k|   asm(DO_8_TIMES(LINMUL_OP, "z")
  476|   414k|       : [carry] "=r"(carry)
  477|   414k|       : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry)
  478|   414k|       : "cc", "%rax", "%rdx");
  479|       |
  480|       |#else
  481|       |   z[0] = word_madd2(x[0], y, &carry);
  482|       |   z[1] = word_madd2(x[1], y, &carry);
  483|       |   z[2] = word_madd2(x[2], y, &carry);
  484|       |   z[3] = word_madd2(x[3], y, &carry);
  485|       |   z[4] = word_madd2(x[4], y, &carry);
  486|       |   z[5] = word_madd2(x[5], y, &carry);
  487|       |   z[6] = word_madd2(x[6], y, &carry);
  488|       |   z[7] = word_madd2(x[7], y, &carry);
  489|       |#endif
  490|       |
  491|   414k|   return carry;
  492|   414k|}
_ZN5Botan11word8_madd3EPmPKmmm:
  497|  3.97M|inline word word8_madd3(word z[8], const word x[8], word y, word carry) {
  498|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  499|       |   asm(DO_8_TIMES(MULADD_OP, "")
  500|       |       : [carry] "=r"(carry)
  501|       |       : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry)
  502|       |       : "cc", "%eax", "%edx");
  503|       |
  504|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  505|  3.97M|   asm(DO_8_TIMES(MULADD_OP, "")
  506|  3.97M|       : [carry] "=r"(carry)
  507|  3.97M|       : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry)
  508|  3.97M|       : "cc", "%rax", "%rdx");
  509|       |
  510|       |#else
  511|       |   z[0] = word_madd3(x[0], y, z[0], &carry);
  512|       |   z[1] = word_madd3(x[1], y, z[1], &carry);
  513|       |   z[2] = word_madd3(x[2], y, z[2], &carry);
  514|       |   z[3] = word_madd3(x[3], y, z[3], &carry);
  515|       |   z[4] = word_madd3(x[4], y, z[4], &carry);
  516|       |   z[5] = word_madd3(x[5], y, z[5], &carry);
  517|       |   z[6] = word_madd3(x[6], y, z[6], &carry);
  518|       |   z[7] = word_madd3(x[7], y, z[7], &carry);
  519|       |#endif
  520|       |
  521|  3.97M|   return carry;
  522|  3.97M|}
_ZN5Botan12word3_muladdEPmS0_S0_mm:
  528|   407M|inline void word3_muladd(word* w2, word* w1, word* w0, word x, word y) {
  529|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  530|       |   word z0 = 0, z1 = 0;
  531|       |
  532|       |   asm("mull %[y]" : "=a"(z0), "=d"(z1) : "a"(x), [y] "rm"(y) : "cc");
  533|       |
  534|       |   asm(R"(
  535|       |       addl %[z0],%[w0]
  536|       |       adcl %[z1],%[w1]
  537|       |       adcl $0,%[w2]
  538|       |       )"
  539|       |       : [w0] "=r"(*w0), [w1] "=r"(*w1), [w2] "=r"(*w2)
  540|       |       : [z0] "r"(z0), [z1] "r"(z1), "0"(*w0), "1"(*w1), "2"(*w2)
  541|       |       : "cc");
  542|       |
  543|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  544|   407M|   word z0 = 0, z1 = 0;
  545|       |
  546|   407M|   asm("mulq %[y]" : "=a"(z0), "=d"(z1) : "a"(x), [y] "rm"(y) : "cc");
  547|       |
  548|   407M|   asm(R"(
  549|   407M|       addq %[z0],%[w0]
  550|   407M|       adcq %[z1],%[w1]
  551|   407M|       adcq $0,%[w2]
  552|   407M|       )"
  553|   407M|       : [w0] "=r"(*w0), [w1] "=r"(*w1), [w2] "=r"(*w2)
  554|   407M|       : [z0] "r"(z0), [z1] "r"(z1), "0"(*w0), "1"(*w1), "2"(*w2)
  555|   407M|       : "cc");
  556|       |
  557|       |#else
  558|       |   word carry = *w0;
  559|       |   *w0 = word_madd2(x, y, &carry);
  560|       |   *w1 += carry;
  561|       |   *w2 += (*w1 < carry);
  562|       |#endif
  563|   407M|}
_ZN5Botan9word3_addEPmS0_S0_m:
  569|  74.2M|inline void word3_add(word* w2, word* w1, word* w0, word x) {
  570|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  571|       |   asm(R"(
  572|       |      addl %[x],%[w0]
  573|       |      adcl $0,%[w1]
  574|       |      adcl $0,%[w2]
  575|       |      )"
  576|       |       : [w0] "=r"(*w0), [w1] "=r"(*w1), [w2] "=r"(*w2)
  577|       |       : [x] "r"(x), "0"(*w0), "1"(*w1), "2"(*w2)
  578|       |       : "cc");
  579|       |
  580|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  581|  74.2M|   asm(R"(
  582|  74.2M|      addq %[x],%[w0]
  583|  74.2M|      adcq $0,%[w1]
  584|  74.2M|      adcq $0,%[w2]
  585|  74.2M|      )"
  586|  74.2M|       : [w0] "=r"(*w0), [w1] "=r"(*w1), [w2] "=r"(*w2)
  587|  74.2M|       : [x] "r"(x), "0"(*w0), "1"(*w1), "2"(*w2)
  588|  74.2M|       : "cc");
  589|       |
  590|       |#else
  591|       |   *w0 += x;
  592|       |   word c1 = (*w0 < x);
  593|       |   *w1 += c1;
  594|       |   word c2 = (*w1 < c1);
  595|       |   *w2 += c2;
  596|       |#endif
  597|  74.2M|}
_ZN5Botan14word3_muladd_2EPmS0_S0_mm:
  603|  41.0M|inline void word3_muladd_2(word* w2, word* w1, word* w0, word x, word y) {
  604|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  605|       |   word z0 = 0, z1 = 0;
  606|       |
  607|       |   asm("mull %[y]" : "=a"(z0), "=d"(z1) : "a"(x), [y] "rm"(y) : "cc");
  608|       |
  609|       |   asm(R"(
  610|       |      addl %[z0],%[w0]
  611|       |      adcl %[z1],%[w1]
  612|       |      adcl $0,%[w2]
  613|       |
  614|       |      addl %[z0],%[w0]
  615|       |      adcl %[z1],%[w1]
  616|       |      adcl $0,%[w2]
  617|       |      )"
  618|       |       : [w0] "=r"(*w0), [w1] "=r"(*w1), [w2] "=r"(*w2)
  619|       |       : [z0] "r"(z0), [z1] "r"(z1), "0"(*w0), "1"(*w1), "2"(*w2)
  620|       |       : "cc");
  621|       |
  622|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  623|  41.0M|   word z0 = 0, z1 = 0;
  624|       |
  625|  41.0M|   asm("mulq %[y]" : "=a"(z0), "=d"(z1) : "a"(x), [y] "rm"(y) : "cc");
  626|       |
  627|  41.0M|   asm(R"(
  628|  41.0M|      addq %[z0],%[w0]
  629|  41.0M|      adcq %[z1],%[w1]
  630|  41.0M|      adcq $0,%[w2]
  631|  41.0M|
  632|  41.0M|      addq %[z0],%[w0]
  633|  41.0M|      adcq %[z1],%[w1]
  634|  41.0M|      adcq $0,%[w2]
  635|  41.0M|      )"
  636|  41.0M|       : [w0] "=r"(*w0), [w1] "=r"(*w1), [w2] "=r"(*w2)
  637|  41.0M|       : [z0] "r"(z0), [z1] "r"(z1), "0"(*w0), "1"(*w1), "2"(*w2)
  638|  41.0M|       : "cc");
  639|       |
  640|       |#else
  641|       |   word carry = 0;
  642|       |   x = word_madd2(x, y, &carry);
  643|       |   y = carry;
  644|       |
  645|       |   word top = (y >> (BOTAN_MP_WORD_BITS - 1));
  646|       |   y <<= 1;
  647|       |   y |= (x >> (BOTAN_MP_WORD_BITS - 1));
  648|       |   x <<= 1;
  649|       |
  650|       |   carry = 0;
  651|       |   *w0 = word_add(*w0, x, &carry);
  652|       |   *w1 = word_add(*w1, y, &carry);
  653|       |   *w2 = word_add(*w2, top, &carry);
  654|       |#endif
  655|  41.0M|}

_ZN5Botan10bigint_cmpEPKmmS1_m:
  490|  5.56M|inline int32_t bigint_cmp(const word x[], size_t x_size, const word y[], size_t y_size) {
  491|  5.56M|   static_assert(sizeof(word) >= sizeof(uint32_t), "Size assumption");
  492|       |
  493|  5.56M|   const word LT = static_cast<word>(-1);
  494|  5.56M|   const word EQ = 0;
  495|  5.56M|   const word GT = 1;
  496|       |
  497|  5.56M|   const size_t common_elems = std::min(x_size, y_size);
  498|       |
  499|  5.56M|   word result = EQ;  // until found otherwise
  500|       |
  501|  29.0M|   for(size_t i = 0; i != common_elems; i++) {
  ------------------
  |  Branch (501:22): [True: 23.4M, False: 5.56M]
  ------------------
  502|  23.4M|      const auto is_eq = CT::Mask<word>::is_equal(x[i], y[i]);
  503|  23.4M|      const auto is_lt = CT::Mask<word>::is_lt(x[i], y[i]);
  504|       |
  505|  23.4M|      result = is_eq.select(result, is_lt.select(LT, GT));
  506|  23.4M|   }
  507|       |
  508|  5.56M|   if(x_size < y_size) {
  ------------------
  |  Branch (508:7): [True: 3.16M, False: 2.39M]
  ------------------
  509|  3.16M|      word mask = 0;
  510|  17.0M|      for(size_t i = x_size; i != y_size; i++) {
  ------------------
  |  Branch (510:30): [True: 13.9M, False: 3.16M]
  ------------------
  511|  13.9M|         mask |= y[i];
  512|  13.9M|      }
  513|       |
  514|       |      // If any bits were set in high part of y, then x < y
  515|  3.16M|      result = CT::Mask<word>::is_zero(mask).select(result, LT);
  516|  3.16M|   } else if(y_size < x_size) {
  ------------------
  |  Branch (516:14): [True: 7.75k, False: 2.39M]
  ------------------
  517|  7.75k|      word mask = 0;
  518|  37.1k|      for(size_t i = y_size; i != x_size; i++) {
  ------------------
  |  Branch (518:30): [True: 29.4k, False: 7.75k]
  ------------------
  519|  29.4k|         mask |= x[i];
  520|  29.4k|      }
  521|       |
  522|       |      // If any bits were set in high part of x, then x > y
  523|  7.75k|      result = CT::Mask<word>::is_zero(mask).select(result, GT);
  524|  7.75k|   }
  525|       |
  526|  5.56M|   CT::unpoison(result);
  527|  5.56M|   BOTAN_DEBUG_ASSERT(result == LT || result == GT || result == EQ);
  ------------------
  |  |   99|  5.56M|      do {                          \
  |  |  100|  5.56M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  528|  5.56M|   return static_cast<int32_t>(result);
  529|  5.56M|}
_ZN5Botan15bigint_ct_is_eqEPKmmS1_m:
  568|   227k|inline CT::Mask<word> bigint_ct_is_eq(const word x[], size_t x_size, const word y[], size_t y_size) {
  569|   227k|   const size_t common_elems = std::min(x_size, y_size);
  570|       |
  571|   227k|   word diff = 0;
  572|       |
  573|  1.05M|   for(size_t i = 0; i != common_elems; i++) {
  ------------------
  |  Branch (573:22): [True: 829k, False: 227k]
  ------------------
  574|   829k|      diff |= (x[i] ^ y[i]);
  575|   829k|   }
  576|       |
  577|       |   // If any bits were set in high part of x/y, then they are not equal
  578|   227k|   if(x_size < y_size) {
  ------------------
  |  Branch (578:7): [True: 23.8k, False: 203k]
  ------------------
  579|  59.8k|      for(size_t i = x_size; i != y_size; i++) {
  ------------------
  |  Branch (579:30): [True: 36.0k, False: 23.8k]
  ------------------
  580|  36.0k|         diff |= y[i];
  581|  36.0k|      }
  582|   203k|   } else if(y_size < x_size) {
  ------------------
  |  Branch (582:14): [True: 19.4k, False: 183k]
  ------------------
  583|  47.4k|      for(size_t i = y_size; i != x_size; i++) {
  ------------------
  |  Branch (583:30): [True: 27.9k, False: 19.4k]
  ------------------
  584|  27.9k|         diff |= x[i];
  585|  27.9k|      }
  586|  19.4k|   }
  587|       |
  588|   227k|   return CT::Mask<word>::is_zero(diff);
  589|   227k|}
_ZN5Botan15bigint_ct_is_ltEPKmmS1_mb:
  537|  3.91M|   const word x[], size_t x_size, const word y[], size_t y_size, bool lt_or_equal = false) {
  538|  3.91M|   const size_t common_elems = std::min(x_size, y_size);
  539|       |
  540|  3.91M|   auto is_lt = CT::Mask<word>::expand(lt_or_equal);
  541|       |
  542|  19.9M|   for(size_t i = 0; i != common_elems; i++) {
  ------------------
  |  Branch (542:22): [True: 16.0M, False: 3.91M]
  ------------------
  543|  16.0M|      const auto eq = CT::Mask<word>::is_equal(x[i], y[i]);
  544|  16.0M|      const auto lt = CT::Mask<word>::is_lt(x[i], y[i]);
  545|  16.0M|      is_lt = eq.select_mask(is_lt, lt);
  546|  16.0M|   }
  547|       |
  548|  3.91M|   if(x_size < y_size) {
  ------------------
  |  Branch (548:7): [True: 37.7k, False: 3.87M]
  ------------------
  549|  37.7k|      word mask = 0;
  550|   180k|      for(size_t i = x_size; i != y_size; i++) {
  ------------------
  |  Branch (550:30): [True: 142k, False: 37.7k]
  ------------------
  551|   142k|         mask |= y[i];
  552|   142k|      }
  553|       |      // If any bits were set in high part of y, then is_lt should be forced true
  554|  37.7k|      is_lt |= CT::Mask<word>::expand(mask);
  555|  3.87M|   } else if(y_size < x_size) {
  ------------------
  |  Branch (555:14): [True: 25.7k, False: 3.85M]
  ------------------
  556|  25.7k|      word mask = 0;
  557|   107k|      for(size_t i = y_size; i != x_size; i++) {
  ------------------
  |  Branch (557:30): [True: 82.0k, False: 25.7k]
  ------------------
  558|  82.0k|         mask |= x[i];
  559|  82.0k|      }
  560|       |
  561|       |      // If any bits were set in high part of x, then is_lt should be false
  562|  25.7k|      is_lt &= CT::Mask<word>::is_zero(mask);
  563|  25.7k|   }
  564|       |
  565|  3.91M|   return is_lt;
  566|  3.91M|}
_ZN5Botan11bigint_sub3EPmPKmmS2_m:
  321|  31.7M|inline word bigint_sub3(word z[], const word x[], size_t x_size, const word y[], size_t y_size) {
  322|  31.7M|   word borrow = 0;
  323|       |
  324|  31.7M|   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
  ------------------
  |  |   51|  31.7M|   do {                                                                                 \
  |  |   52|  31.7M|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 31.7M]
  |  |  ------------------
  |  |   53|  31.7M|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  31.7M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  325|       |
  326|  31.7M|   const size_t blocks = y_size - (y_size % 8);
  327|       |
  328|  51.4M|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (328:22): [True: 19.6M, False: 31.7M]
  ------------------
  329|  19.6M|      borrow = word8_sub3(z + i, x + i, y + i, borrow);
  330|  19.6M|   }
  331|       |
  332|   145M|   for(size_t i = blocks; i != y_size; ++i) {
  ------------------
  |  Branch (332:27): [True: 113M, False: 31.7M]
  ------------------
  333|   113M|      z[i] = word_sub(x[i], y[i], &borrow);
  334|   113M|   }
  335|       |
  336|   100M|   for(size_t i = y_size; i != x_size; ++i) {
  ------------------
  |  Branch (336:27): [True: 68.9M, False: 31.7M]
  ------------------
  337|  68.9M|      z[i] = word_sub(x[i], 0, &borrow);
  338|  68.9M|   }
  339|       |
  340|  31.7M|   return borrow;
  341|  31.7M|}
_ZN5Botan14bigint_cnd_addEmPmmPKmm:
   40|  3.07M|inline word bigint_cnd_add(word cnd, word x[], word x_size, const word y[], size_t y_size) {
   41|  3.07M|   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
  ------------------
  |  |   51|  3.07M|   do {                                                                                 \
  |  |   52|  3.07M|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 3.07M]
  |  |  ------------------
  |  |   53|  3.07M|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  3.07M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   42|       |
   43|  3.07M|   const auto mask = CT::Mask<word>::expand(cnd);
   44|       |
   45|  3.07M|   word carry = 0;
   46|       |
   47|  3.07M|   const size_t blocks = y_size - (y_size % 8);
   48|  3.07M|   word z[8] = {0};
   49|       |
   50|  3.36M|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (50:22): [True: 294k, False: 3.07M]
  ------------------
   51|   294k|      carry = word8_add3(z, x + i, y + i, carry);
   52|   294k|      mask.select_n(x + i, z, x + i, 8);
   53|   294k|   }
   54|       |
   55|  14.6M|   for(size_t i = blocks; i != y_size; ++i) {
  ------------------
  |  Branch (55:27): [True: 11.5M, False: 3.07M]
  ------------------
   56|  11.5M|      z[0] = word_add(x[i], y[i], &carry);
   57|  11.5M|      x[i] = mask.select(z[0], x[i]);
   58|  11.5M|   }
   59|       |
   60|  7.20M|   for(size_t i = y_size; i != x_size; ++i) {
  ------------------
  |  Branch (60:27): [True: 4.13M, False: 3.07M]
  ------------------
   61|  4.13M|      z[0] = word_add(x[i], 0, &carry);
   62|  4.13M|      x[i] = mask.select(z[0], x[i]);
   63|  4.13M|   }
   64|       |
   65|  3.07M|   return mask.if_set_return(carry);
   66|  3.07M|}
_ZN5Botan11bigint_shl2EPmPKmmmm:
  417|  83.4k|inline void bigint_shl2(word y[], const word x[], size_t x_size, size_t word_shift, size_t bit_shift) {
  418|  83.4k|   copy_mem(y + word_shift, x, x_size);
  419|       |
  420|  83.4k|   const auto carry_mask = CT::Mask<word>::expand(bit_shift);
  421|  83.4k|   const word carry_shift = carry_mask.if_set_return(BOTAN_MP_WORD_BITS - bit_shift);
  ------------------
  |  |   50|  83.4k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  422|       |
  423|  83.4k|   word carry = 0;
  424|   463k|   for(size_t i = word_shift; i != x_size + word_shift + 1; ++i) {
  ------------------
  |  Branch (424:31): [True: 380k, False: 83.4k]
  ------------------
  425|   380k|      const word w = y[i];
  426|   380k|      y[i] = (w << bit_shift) | carry;
  427|   380k|      carry = carry_mask.if_set_return(w >> carry_shift);
  428|   380k|   }
  429|  83.4k|}
_ZN5Botan15bigint_cnd_swapEmPmS0_m:
   29|  7.15M|inline void bigint_cnd_swap(word cnd, word x[], word y[], size_t size) {
   30|  7.15M|   const auto mask = CT::Mask<word>::expand(cnd);
   31|       |
   32|   206M|   for(size_t i = 0; i != size; ++i) {
  ------------------
  |  Branch (32:22): [True: 198M, False: 7.15M]
  ------------------
   33|   198M|      const word a = x[i];
   34|   198M|      const word b = y[i];
   35|   198M|      x[i] = mask.select(b, a);
   36|   198M|      y[i] = mask.select(a, b);
   37|   198M|   }
   38|  7.15M|}
_ZN5Botan14bigint_cnd_addEmPmPKmm:
   72|  1.90M|inline word bigint_cnd_add(word cnd, word x[], const word y[], size_t size) {
   73|  1.90M|   return bigint_cnd_add(cnd, x, size, y, size);
   74|  1.90M|}
_ZN5Botan14bigint_cnd_subEmPmmPKmm:
   80|  1.77M|inline word bigint_cnd_sub(word cnd, word x[], size_t x_size, const word y[], size_t y_size) {
   81|  1.77M|   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
  ------------------
  |  |   51|  1.77M|   do {                                                                                 \
  |  |   52|  1.77M|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 1.77M]
  |  |  ------------------
  |  |   53|  1.77M|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  1.77M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   82|       |
   83|  1.77M|   const auto mask = CT::Mask<word>::expand(cnd);
   84|       |
   85|  1.77M|   word carry = 0;
   86|       |
   87|  1.77M|   const size_t blocks = y_size - (y_size % 8);
   88|  1.77M|   word z[8] = {0};
   89|       |
   90|  2.40M|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (90:22): [True: 632k, False: 1.77M]
  ------------------
   91|   632k|      carry = word8_sub3(z, x + i, y + i, carry);
   92|   632k|      mask.select_n(x + i, z, x + i, 8);
   93|   632k|   }
   94|       |
   95|  6.89M|   for(size_t i = blocks; i != y_size; ++i) {
  ------------------
  |  Branch (95:27): [True: 5.12M, False: 1.77M]
  ------------------
   96|  5.12M|      z[0] = word_sub(x[i], y[i], &carry);
   97|  5.12M|      x[i] = mask.select(z[0], x[i]);
   98|  5.12M|   }
   99|       |
  100|  1.77M|   for(size_t i = y_size; i != x_size; ++i) {
  ------------------
  |  Branch (100:27): [True: 0, False: 1.77M]
  ------------------
  101|      0|      z[0] = word_sub(x[i], 0, &carry);
  102|      0|      x[i] = mask.select(z[0], x[i]);
  103|      0|   }
  104|       |
  105|  1.77M|   return mask.if_set_return(carry);
  106|  1.77M|}
_ZN5Botan14bigint_cnd_subEmPmPKmm:
  112|  1.77M|inline word bigint_cnd_sub(word cnd, word x[], const word y[], size_t size) {
  113|  1.77M|   return bigint_cnd_sub(cnd, x, size, y, size);
  114|  1.77M|}
_ZN5Botan21bigint_cnd_add_or_subENS_2CT4MaskImEEPmPKmm:
  123|  5.27k|inline void bigint_cnd_add_or_sub(CT::Mask<word> mask, word x[], const word y[], size_t size) {
  124|  5.27k|   const size_t blocks = size - (size % 8);
  125|       |
  126|  5.27k|   word carry = 0;
  127|  5.27k|   word borrow = 0;
  128|       |
  129|  5.27k|   word t0[8] = {0};
  130|  5.27k|   word t1[8] = {0};
  131|       |
  132|  51.4k|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (132:22): [True: 46.1k, False: 5.27k]
  ------------------
  133|  46.1k|      carry = word8_add3(t0, x + i, y + i, carry);
  134|  46.1k|      borrow = word8_sub3(t1, x + i, y + i, borrow);
  135|       |
  136|   415k|      for(size_t j = 0; j != 8; ++j) {
  ------------------
  |  Branch (136:25): [True: 369k, False: 46.1k]
  ------------------
  137|   369k|         x[i + j] = mask.select(t0[j], t1[j]);
  138|   369k|      }
  139|  46.1k|   }
  140|       |
  141|  8.26k|   for(size_t i = blocks; i != size; ++i) {
  ------------------
  |  Branch (141:27): [True: 2.98k, False: 5.27k]
  ------------------
  142|  2.98k|      const word a = word_add(x[i], y[i], &carry);
  143|  2.98k|      const word s = word_sub(x[i], y[i], &borrow);
  144|       |
  145|  2.98k|      x[i] = mask.select(a, s);
  146|  2.98k|   }
  147|  5.27k|}
_ZN5Botan17bigint_cnd_addsubENS_2CT4MaskImEEPmPKmS5_m:
  158|  3.39M|inline word bigint_cnd_addsub(CT::Mask<word> mask, word x[], const word y[], const word z[], size_t size) {
  159|  3.39M|   const size_t blocks = size - (size % 8);
  160|       |
  161|  3.39M|   word carry = 0;
  162|  3.39M|   word borrow = 0;
  163|       |
  164|  3.39M|   word t0[8] = {0};
  165|  3.39M|   word t1[8] = {0};
  166|       |
  167|  3.63M|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (167:22): [True: 242k, False: 3.39M]
  ------------------
  168|   242k|      carry = word8_add3(t0, x + i, y + i, carry);
  169|   242k|      borrow = word8_sub3(t1, x + i, z + i, borrow);
  170|       |
  171|  2.17M|      for(size_t j = 0; j != 8; ++j) {
  ------------------
  |  Branch (171:25): [True: 1.93M, False: 242k]
  ------------------
  172|  1.93M|         x[i + j] = mask.select(t0[j], t1[j]);
  173|  1.93M|      }
  174|   242k|   }
  175|       |
  176|  16.1M|   for(size_t i = blocks; i != size; ++i) {
  ------------------
  |  Branch (176:27): [True: 12.7M, False: 3.39M]
  ------------------
  177|  12.7M|      t0[0] = word_add(x[i], y[i], &carry);
  178|  12.7M|      t1[0] = word_sub(x[i], z[i], &borrow);
  179|  12.7M|      x[i] = mask.select(t0[0], t1[0]);
  180|  12.7M|   }
  181|       |
  182|  3.39M|   return mask.select(carry, borrow);
  183|  3.39M|}
_ZN5Botan14bigint_cnd_absEmPmm:
  190|   635k|inline void bigint_cnd_abs(word cnd, word x[], size_t size) {
  191|   635k|   const auto mask = CT::Mask<word>::expand(cnd);
  192|       |
  193|   635k|   word carry = mask.if_set_return(1);
  194|  3.45M|   for(size_t i = 0; i != size; ++i) {
  ------------------
  |  Branch (194:22): [True: 2.81M, False: 635k]
  ------------------
  195|  2.81M|      const word z = word_add(~x[i], 0, &carry);
  196|  2.81M|      x[i] = mask.select(z, x[i]);
  197|  2.81M|   }
  198|   635k|}
_ZN5Botan14bigint_add2_ncEPmmPKmm:
  203|  2.74M|inline word bigint_add2_nc(word x[], size_t x_size, const word y[], size_t y_size) {
  204|  2.74M|   word carry = 0;
  205|       |
  206|  2.74M|   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
  ------------------
  |  |   51|  2.74M|   do {                                                                                 \
  |  |   52|  2.74M|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 2.74M]
  |  |  ------------------
  |  |   53|  2.74M|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  2.74M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  207|       |
  208|  2.74M|   const size_t blocks = y_size - (y_size % 8);
  209|       |
  210|  3.23M|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (210:22): [True: 486k, False: 2.74M]
  ------------------
  211|   486k|      carry = word8_add2(x + i, y + i, carry);
  212|   486k|   }
  213|       |
  214|  16.2M|   for(size_t i = blocks; i != y_size; ++i) {
  ------------------
  |  Branch (214:27): [True: 13.5M, False: 2.74M]
  ------------------
  215|  13.5M|      x[i] = word_add(x[i], y[i], &carry);
  216|  13.5M|   }
  217|       |
  218|  7.78M|   for(size_t i = y_size; i != x_size; ++i) {
  ------------------
  |  Branch (218:27): [True: 5.03M, False: 2.74M]
  ------------------
  219|  5.03M|      x[i] = word_add(x[i], 0, &carry);
  220|  5.03M|   }
  221|       |
  222|  2.74M|   return carry;
  223|  2.74M|}
_ZN5Botan14bigint_add3_ncEPmPKmmS2_m:
  228|  1.29M|inline word bigint_add3_nc(word z[], const word x[], size_t x_size, const word y[], size_t y_size) {
  229|  1.29M|   if(x_size < y_size) {
  ------------------
  |  Branch (229:7): [True: 17.7k, False: 1.27M]
  ------------------
  230|  17.7k|      return bigint_add3_nc(z, y, y_size, x, x_size);
  231|  17.7k|   }
  232|       |
  233|  1.27M|   word carry = 0;
  234|       |
  235|  1.27M|   const size_t blocks = y_size - (y_size % 8);
  236|       |
  237|  1.97M|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (237:22): [True: 697k, False: 1.27M]
  ------------------
  238|   697k|      carry = word8_add3(z + i, x + i, y + i, carry);
  239|   697k|   }
  240|       |
  241|  4.35M|   for(size_t i = blocks; i != y_size; ++i) {
  ------------------
  |  Branch (241:27): [True: 3.08M, False: 1.27M]
  ------------------
  242|  3.08M|      z[i] = word_add(x[i], y[i], &carry);
  243|  3.08M|   }
  244|       |
  245|  1.33M|   for(size_t i = y_size; i != x_size; ++i) {
  ------------------
  |  Branch (245:27): [True: 56.2k, False: 1.27M]
  ------------------
  246|  56.2k|      z[i] = word_add(x[i], 0, &carry);
  247|  56.2k|   }
  248|       |
  249|  1.27M|   return carry;
  250|  1.29M|}
_ZN5Botan11bigint_add2EPmmPKmm:
  259|  2.70M|inline void bigint_add2(word x[], size_t x_size, const word y[], size_t y_size) {
  260|  2.70M|   x[x_size] += bigint_add2_nc(x, x_size, y, y_size);
  261|  2.70M|}
_ZN5Botan11bigint_add3EPmPKmmS2_m:
  266|   599k|inline void bigint_add3(word z[], const word x[], size_t x_size, const word y[], size_t y_size) {
  267|   599k|   z[x_size > y_size ? x_size : y_size] += bigint_add3_nc(z, x, x_size, y, y_size);
  ------------------
  |  Branch (267:6): [True: 11.0k, False: 588k]
  ------------------
  268|   599k|}
_ZN5Botan11bigint_sub2EPmmPKmm:
  273|   583k|inline word bigint_sub2(word x[], size_t x_size, const word y[], size_t y_size) {
  274|   583k|   word borrow = 0;
  275|       |
  276|   583k|   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
  ------------------
  |  |   51|   583k|   do {                                                                                 \
  |  |   52|   583k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 583k]
  |  |  ------------------
  |  |   53|   583k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|   583k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  277|       |
  278|   583k|   const size_t blocks = y_size - (y_size % 8);
  279|       |
  280|   698k|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (280:22): [True: 115k, False: 583k]
  ------------------
  281|   115k|      borrow = word8_sub2(x + i, y + i, borrow);
  282|   115k|   }
  283|       |
  284|  3.25M|   for(size_t i = blocks; i != y_size; ++i) {
  ------------------
  |  Branch (284:27): [True: 2.66M, False: 583k]
  ------------------
  285|  2.66M|      x[i] = word_sub(x[i], y[i], &borrow);
  286|  2.66M|   }
  287|       |
  288|  1.26M|   for(size_t i = y_size; i != x_size; ++i) {
  ------------------
  |  Branch (288:27): [True: 684k, False: 583k]
  ------------------
  289|   684k|      x[i] = word_sub(x[i], 0, &borrow);
  290|   684k|   }
  291|       |
  292|   583k|   return borrow;
  293|   583k|}
_ZN5Botan15bigint_sub2_revEPmPKmm:
  298|  11.9k|inline void bigint_sub2_rev(word x[], const word y[], size_t y_size) {
  299|  11.9k|   word borrow = 0;
  300|       |
  301|  11.9k|   const size_t blocks = y_size - (y_size % 8);
  302|       |
  303|  12.5k|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (303:22): [True: 624, False: 11.9k]
  ------------------
  304|    624|      borrow = word8_sub2_rev(x + i, y + i, borrow);
  305|    624|   }
  306|       |
  307|  71.2k|   for(size_t i = blocks; i != y_size; ++i) {
  ------------------
  |  Branch (307:27): [True: 59.3k, False: 11.9k]
  ------------------
  308|  59.3k|      x[i] = word_sub(y[i], x[i], &borrow);
  309|  59.3k|   }
  310|       |
  311|  11.9k|   BOTAN_ASSERT(borrow == 0, "y must be greater than x");
  ------------------
  |  |   51|  11.9k|   do {                                                                                 \
  |  |   52|  11.9k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 11.9k]
  |  |  ------------------
  |  |   53|  11.9k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  11.9k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  312|  11.9k|}
_ZN5Botan14bigint_sub_absEPmPKmS2_mS0_:
  355|  19.6k|inline CT::Mask<word> bigint_sub_abs(word z[], const word x[], const word y[], size_t N, word ws[]) {
  356|       |   // Subtract in both direction then conditional copy out the result
  357|       |
  358|  19.6k|   word* ws0 = ws;
  359|  19.6k|   word* ws1 = ws + N;
  360|       |
  361|  19.6k|   word borrow0 = 0;
  362|  19.6k|   word borrow1 = 0;
  363|       |
  364|  19.6k|   const size_t blocks = N - (N % 8);
  365|       |
  366|  75.8k|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (366:22): [True: 56.1k, False: 19.6k]
  ------------------
  367|  56.1k|      borrow0 = word8_sub3(ws0 + i, x + i, y + i, borrow0);
  368|  56.1k|      borrow1 = word8_sub3(ws1 + i, y + i, x + i, borrow1);
  369|  56.1k|   }
  370|       |
  371|  28.3k|   for(size_t i = blocks; i != N; ++i) {
  ------------------
  |  Branch (371:27): [True: 8.67k, False: 19.6k]
  ------------------
  372|  8.67k|      ws0[i] = word_sub(x[i], y[i], &borrow0);
  373|  8.67k|      ws1[i] = word_sub(y[i], x[i], &borrow1);
  374|  8.67k|   }
  375|       |
  376|  19.6k|   return CT::conditional_copy_mem(borrow0, z, ws1, ws0, N);
  377|  19.6k|}
_ZN5Botan11bigint_shl1EPmmmmm:
  382|   165k|inline void bigint_shl1(word x[], size_t x_size, size_t x_words, size_t word_shift, size_t bit_shift) {
  383|   165k|   copy_mem(x + word_shift, x, x_words);
  384|   165k|   clear_mem(x, word_shift);
  385|       |
  386|   165k|   const auto carry_mask = CT::Mask<word>::expand(bit_shift);
  387|   165k|   const word carry_shift = carry_mask.if_set_return(BOTAN_MP_WORD_BITS - bit_shift);
  ------------------
  |  |   50|   165k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  388|       |
  389|   165k|   word carry = 0;
  390|   854k|   for(size_t i = word_shift; i != x_size; ++i) {
  ------------------
  |  Branch (390:31): [True: 689k, False: 165k]
  ------------------
  391|   689k|      const word w = x[i];
  392|   689k|      x[i] = (w << bit_shift) | carry;
  393|   689k|      carry = carry_mask.if_set_return(w >> carry_shift);
  394|   689k|   }
  395|   165k|}
_ZN5Botan11bigint_shr1EPmmmm:
  397|  7.48M|inline void bigint_shr1(word x[], size_t x_size, size_t word_shift, size_t bit_shift) {
  398|  7.48M|   const size_t top = x_size >= word_shift ? (x_size - word_shift) : 0;
  ------------------
  |  Branch (398:23): [True: 7.45M, False: 22.9k]
  ------------------
  399|       |
  400|  7.48M|   if(top > 0) {
  ------------------
  |  Branch (400:7): [True: 7.45M, False: 27.7k]
  ------------------
  401|  7.45M|      copy_mem(x, x + word_shift, top);
  402|  7.45M|   }
  403|  7.48M|   clear_mem(x + top, std::min(word_shift, x_size));
  404|       |
  405|  7.48M|   const auto carry_mask = CT::Mask<word>::expand(bit_shift);
  406|  7.48M|   const word carry_shift = carry_mask.if_set_return(BOTAN_MP_WORD_BITS - bit_shift);
  ------------------
  |  |   50|  7.48M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  407|       |
  408|  7.48M|   word carry = 0;
  409|       |
  410|  63.3M|   for(size_t i = 0; i != top; ++i) {
  ------------------
  |  Branch (410:22): [True: 55.8M, False: 7.48M]
  ------------------
  411|  55.8M|      const word w = x[top - i - 1];
  412|  55.8M|      x[top - i - 1] = (w >> bit_shift) | carry;
  413|  55.8M|      carry = carry_mask.if_set_return(w << carry_shift);
  414|  55.8M|   }
  415|  7.48M|}
_ZN5Botan11bigint_shr2EPmPKmmmm:
  431|   507k|inline void bigint_shr2(word y[], const word x[], size_t x_size, size_t word_shift, size_t bit_shift) {
  432|   507k|   const size_t new_size = x_size < word_shift ? 0 : (x_size - word_shift);
  ------------------
  |  Branch (432:28): [True: 2, False: 507k]
  ------------------
  433|       |
  434|   507k|   if(new_size > 0) {
  ------------------
  |  Branch (434:7): [True: 507k, False: 112]
  ------------------
  435|   507k|      copy_mem(y, x + word_shift, new_size);
  436|   507k|   }
  437|       |
  438|   507k|   const auto carry_mask = CT::Mask<word>::expand(bit_shift);
  439|   507k|   const word carry_shift = carry_mask.if_set_return(BOTAN_MP_WORD_BITS - bit_shift);
  ------------------
  |  |   50|   507k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  440|       |
  441|   507k|   word carry = 0;
  442|  5.57M|   for(size_t i = new_size; i > 0; --i) {
  ------------------
  |  Branch (442:29): [True: 5.06M, False: 507k]
  ------------------
  443|  5.06M|      word w = y[i - 1];
  444|  5.06M|      y[i - 1] = (w >> bit_shift) | carry;
  445|  5.06M|      carry = carry_mask.if_set_return(w << carry_shift);
  446|  5.06M|   }
  447|   507k|}
_ZN5Botan14bigint_linmul2EPmmm:
  452|  5.06M|[[nodiscard]] inline word bigint_linmul2(word x[], size_t x_size, word y) {
  453|  5.06M|   const size_t blocks = x_size - (x_size % 8);
  454|       |
  455|  5.06M|   word carry = 0;
  456|       |
  457|  27.9M|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (457:22): [True: 22.9M, False: 5.06M]
  ------------------
  458|  22.9M|      carry = word8_linmul2(x + i, y, carry);
  459|  22.9M|   }
  460|       |
  461|  6.69M|   for(size_t i = blocks; i != x_size; ++i) {
  ------------------
  |  Branch (461:27): [True: 1.63M, False: 5.06M]
  ------------------
  462|  1.63M|      x[i] = word_madd2(x[i], y, &carry);
  463|  1.63M|   }
  464|       |
  465|  5.06M|   return carry;
  466|  5.06M|}
_ZN5Botan14bigint_linmul3EPmPKmmm:
  468|  2.36M|inline void bigint_linmul3(word z[], const word x[], size_t x_size, word y) {
  469|  2.36M|   const size_t blocks = x_size - (x_size % 8);
  470|       |
  471|  2.36M|   word carry = 0;
  472|       |
  473|  2.77M|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (473:22): [True: 414k, False: 2.36M]
  ------------------
  474|   414k|      carry = word8_linmul3(z + i, x + i, y, carry);
  475|   414k|   }
  476|       |
  477|  11.1M|   for(size_t i = blocks; i != x_size; ++i) {
  ------------------
  |  Branch (477:27): [True: 8.75M, False: 2.36M]
  ------------------
  478|  8.75M|      z[i] = word_madd2(x[i], y, &carry);
  479|  8.75M|   }
  480|       |
  481|  2.36M|   z[x_size] = carry;
  482|  2.36M|}
_ZN5Botan14bigint_sub_absEPmPKmmS2_m:
  604|  5.36M|inline int32_t bigint_sub_abs(word z[], const word x[], size_t x_size, const word y[], size_t y_size) {
  605|  5.36M|   const int32_t relative_size = bigint_cmp(x, x_size, y, y_size);
  606|       |
  607|       |   // Swap if relative_size == -1
  608|  5.36M|   const bool need_swap = relative_size < 0;
  609|  5.36M|   CT::conditional_swap_ptr(need_swap, x, y);
  610|  5.36M|   CT::conditional_swap(need_swap, x_size, y_size);
  611|       |
  612|       |   /*
  613|       |   * We know at this point that x >= y so if y_size is larger than
  614|       |   * x_size, we are guaranteed they are just leading zeros which can
  615|       |   * be ignored
  616|       |   */
  617|  5.36M|   y_size = std::min(x_size, y_size);
  618|       |
  619|  5.36M|   bigint_sub3(z, x, x_size, y, y_size);
  620|       |
  621|  5.36M|   return relative_size;
  622|  5.36M|}
_ZN5Botan14bigint_mod_subEPmPKmS2_mS0_:
  633|   544k|inline void bigint_mod_sub(word t[], const word s[], const word mod[], size_t mod_sw, word ws[]) {
  634|       |   // is t < s or not?
  635|   544k|   const auto is_lt = bigint_ct_is_lt(t, mod_sw, s, mod_sw);
  636|       |
  637|       |   // ws = p - s
  638|   544k|   const word borrow = bigint_sub3(ws, mod, mod_sw, s, mod_sw);
  639|       |
  640|       |   // Compute either (t - s) or (t + (p - s)) depending on mask
  641|   544k|   const word carry = bigint_cnd_addsub(is_lt, t, ws, s, mod_sw);
  642|       |
  643|   544k|   BOTAN_DEBUG_ASSERT(borrow == 0 && carry == 0);
  ------------------
  |  |   99|   544k|      do {                          \
  |  |  100|   544k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  644|   544k|   BOTAN_UNUSED(carry, borrow);
  ------------------
  |  |  118|   544k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  645|   544k|}
_ZN5Botan20bigint_divop_vartimeEmmm:
  665|   104k|inline word bigint_divop_vartime(word n1, word n0, word d) {
  666|   104k|   if(d == 0) {
  ------------------
  |  Branch (666:7): [True: 0, False: 104k]
  ------------------
  667|      0|      throw Invalid_Argument("bigint_divop_vartime divide by zero");
  668|      0|   }
  669|       |
  670|   104k|#if defined(BOTAN_MP_DWORD)
  671|   104k|   return static_cast<word>(((static_cast<BOTAN_MP_DWORD>(n1) << BOTAN_MP_WORD_BITS) | n0) / d);
  ------------------
  |  |   50|   104k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  672|       |#else
  673|       |
  674|       |   word high = n1 % d;
  675|       |   word quotient = 0;
  676|       |
  677|       |   for(size_t i = 0; i != BOTAN_MP_WORD_BITS; ++i) {
  678|       |      const word high_top_bit = high >> (BOTAN_MP_WORD_BITS - 1);
  679|       |
  680|       |      high <<= 1;
  681|       |      high |= (n0 >> (BOTAN_MP_WORD_BITS - 1 - i)) & 1;
  682|       |      quotient <<= 1;
  683|       |
  684|       |      if(high_top_bit || high >= d) {
  685|       |         high -= d;
  686|       |         quotient |= 1;
  687|       |      }
  688|       |   }
  689|       |
  690|       |   return quotient;
  691|       |#endif
  692|   104k|}
_ZN5Botan20bigint_modop_vartimeEmmm:
  697|  69.1k|inline word bigint_modop_vartime(word n1, word n0, word d) {
  698|  69.1k|   if(d == 0) {
  ------------------
  |  Branch (698:7): [True: 0, False: 69.1k]
  ------------------
  699|      0|      throw Invalid_Argument("bigint_modop_vartime divide by zero");
  700|      0|   }
  701|       |
  702|  69.1k|#if defined(BOTAN_MP_DWORD)
  703|  69.1k|   return ((static_cast<BOTAN_MP_DWORD>(n1) << BOTAN_MP_WORD_BITS) | n0) % d;
  ------------------
  |  |   50|  69.1k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  704|       |#else
  705|       |   word z = bigint_divop_vartime(n1, n0, d);
  706|       |   word dummy = 0;
  707|       |   z = word_madd2(z, d, &dummy);
  708|       |   return (n0 - z);
  709|       |#endif
  710|  69.1k|}
_ZN5Botan17bigint_monty_redcEPmPKmmmS0_m:
  757|  10.5M|inline void bigint_monty_redc(word z[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size) {
  758|  10.5M|   const size_t z_size = 2 * p_size;
  759|       |
  760|  10.5M|   BOTAN_ARG_CHECK(ws_size >= p_size + 1, "Montgomery workspace too small");
  ------------------
  |  |   30|  10.5M|   do {                                                          \
  |  |   31|  10.5M|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 10.5M]
  |  |  ------------------
  |  |   32|  10.5M|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  10.5M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  761|       |
  762|  10.5M|   if(p_size == 4) {
  ------------------
  |  Branch (762:7): [True: 9.27M, False: 1.25M]
  ------------------
  763|  9.27M|      bigint_monty_redc_4(z, p, p_dash, ws);
  764|  9.27M|   } else if(p_size == 6) {
  ------------------
  |  Branch (764:14): [True: 84.7k, False: 1.16M]
  ------------------
  765|  84.7k|      bigint_monty_redc_6(z, p, p_dash, ws);
  766|  1.16M|   } else if(p_size == 8) {
  ------------------
  |  Branch (766:14): [True: 34.8k, False: 1.13M]
  ------------------
  767|  34.8k|      bigint_monty_redc_8(z, p, p_dash, ws);
  768|  1.13M|   } else if(p_size == 16) {
  ------------------
  |  Branch (768:14): [True: 1.11k, False: 1.13M]
  ------------------
  769|  1.11k|      bigint_monty_redc_16(z, p, p_dash, ws);
  770|  1.13M|   } else if(p_size == 24) {
  ------------------
  |  Branch (770:14): [True: 857, False: 1.13M]
  ------------------
  771|    857|      bigint_monty_redc_24(z, p, p_dash, ws);
  772|  1.13M|   } else if(p_size == 32) {
  ------------------
  |  Branch (772:14): [True: 2.79k, False: 1.12M]
  ------------------
  773|  2.79k|      bigint_monty_redc_32(z, p, p_dash, ws);
  774|  1.12M|   } else {
  775|  1.12M|      bigint_monty_redc_generic(z, z_size, p, p_size, p_dash, ws);
  776|  1.12M|   }
  777|  10.5M|}
_ZN5Botan16bigint_mod_sub_nILm4EEEvPmPKmS3_S1_:
  648|  2.74M|inline void bigint_mod_sub_n(word t[], const word s[], const word mod[], word ws[]) {
  649|       |   // is t < s or not?
  650|  2.74M|   const auto is_lt = bigint_ct_is_lt(t, N, s, N);
  651|       |
  652|       |   // ws = p - s
  653|  2.74M|   const word borrow = bigint_sub3(ws, mod, N, s, N);
  654|       |
  655|       |   // Compute either (t - s) or (t + (p - s)) depending on mask
  656|  2.74M|   const word carry = bigint_cnd_addsub(is_lt, t, ws, s, N);
  657|       |
  658|  2.74M|   BOTAN_DEBUG_ASSERT(borrow == 0 && carry == 0);
  ------------------
  |  |   99|  2.74M|      do {                          \
  |  |  100|  2.74M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  659|  2.74M|   BOTAN_UNUSED(carry, borrow);
  ------------------
  |  |  118|  2.74M|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  660|  2.74M|}
_ZN5Botan16bigint_mod_sub_nILm6EEEvPmPKmS3_S1_:
  648|   103k|inline void bigint_mod_sub_n(word t[], const word s[], const word mod[], word ws[]) {
  649|       |   // is t < s or not?
  650|   103k|   const auto is_lt = bigint_ct_is_lt(t, N, s, N);
  651|       |
  652|       |   // ws = p - s
  653|   103k|   const word borrow = bigint_sub3(ws, mod, N, s, N);
  654|       |
  655|       |   // Compute either (t - s) or (t + (p - s)) depending on mask
  656|   103k|   const word carry = bigint_cnd_addsub(is_lt, t, ws, s, N);
  657|       |
  658|   103k|   BOTAN_DEBUG_ASSERT(borrow == 0 && carry == 0);
  ------------------
  |  |   99|   103k|      do {                          \
  |  |  100|   103k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  659|   103k|   BOTAN_UNUSED(carry, borrow);
  ------------------
  |  |  118|   103k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  660|   103k|}

_ZN5Botan6PK_Ops22Verification_with_HashD2Ev:
   52|    493|      ~Verification_with_Hash() override = default;

_ZNK5Botan10PSS_Params10hash_algidEv:
   27|     81|      const AlgorithmIdentifier& hash_algid() const { return m_hash; }
_ZNK5Botan10PSS_Params9mgf_algidEv:
   29|     40|      const AlgorithmIdentifier& mgf_algid() const { return m_mgf; }
_ZNK5Botan10PSS_Params14mgf_hash_algidEv:
   31|     39|      const AlgorithmIdentifier& mgf_hash_algid() const { return m_mgf_hash; }
_ZNK5Botan10PSS_Params11salt_lengthEv:
   33|     36|      size_t salt_length() const { return m_salt_len; }
_ZNK5Botan10PSS_Params13trailer_fieldEv:
   35|     37|      size_t trailer_field() const { return m_trailer_field; }
_ZNK5Botan10PSS_Params13hash_functionEv:
   37|     42|      std::string hash_function() const { return hash_algid().oid().to_formatted_string(); }
_ZNK5Botan10PSS_Params12mgf_functionEv:
   39|     40|      std::string mgf_function() const { return mgf_algid().oid().to_formatted_string(); }
_ZN5Botan10PSS_ParamsC2INSt3__19allocatorIhEEEERKNS2_6vectorIhT_EE:
   25|     54|      PSS_Params(const std::vector<uint8_t, Alloc>& vec) : PSS_Params(vec.data(), vec.size()) {}

_ZN5Botan4rotlILm7EjEET0_S1_:
   23|  1.93k|{
   24|  1.93k|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  1.93k|}
_ZN5Botan4rotlILm11EjEET0_S1_:
   23|  1.93k|{
   24|  1.93k|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  1.93k|}
_ZN5Botan4rotlILm5EjEET0_S1_:
   23|  3.09M|{
   24|  3.09M|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  3.09M|}
_ZN5Botan4rotlILm9EjEET0_S1_:
   23|  1.93k|{
   24|  1.93k|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  1.93k|}
_ZN5Botan4rotlILm15EjEET0_S1_:
   23|  1.93k|{
   24|  1.93k|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  1.93k|}
_ZN5Botan4rotlILm12EjEET0_S1_:
   23|  1.93k|{
   24|  1.93k|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  1.93k|}
_ZN5Botan4rotlILm17EjEET0_S1_:
   23|  1.93k|{
   24|  1.93k|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  1.93k|}
_ZN5Botan4rotlILm22EjEET0_S1_:
   23|  1.93k|{
   24|  1.93k|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  1.93k|}
_ZN5Botan4rotlILm14EjEET0_S1_:
   23|  1.93k|{
   24|  1.93k|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  1.93k|}
_ZN5Botan4rotlILm20EjEET0_S1_:
   23|  1.93k|{
   24|  1.93k|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  1.93k|}
_ZN5Botan4rotlILm4EjEET0_S1_:
   23|  1.93k|{
   24|  1.93k|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  1.93k|}
_ZN5Botan4rotlILm16EjEET0_S1_:
   23|  1.93k|{
   24|  1.93k|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  1.93k|}
_ZN5Botan4rotlILm23EjEET0_S1_:
   23|  1.93k|{
   24|  1.93k|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  1.93k|}
_ZN5Botan4rotlILm6EjEET0_S1_:
   23|  1.93k|{
   24|  1.93k|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  1.93k|}
_ZN5Botan4rotlILm10EjEET0_S1_:
   23|  1.93k|{
   24|  1.93k|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  1.93k|}
_ZN5Botan4rotlILm21EjEET0_S1_:
   23|  1.93k|{
   24|  1.93k|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  1.93k|}
_ZN5Botan4rotlILm30EjEET0_S1_:
   23|  3.09M|{
   24|  3.09M|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  3.09M|}
_ZN5Botan3rhoILm2ELm13ELm22EjEET2_S1_:
   51|  2.40M|inline constexpr T rho(T x) {
   52|  2.40M|   return rotr<R1>(x) ^ rotr<R2>(x) ^ rotr<R3>(x);
   53|  2.40M|}
_ZN5Botan4rotrILm2EjEET0_S1_:
   35|  2.40M|{
   36|  2.40M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  2.40M|}
_ZN5Botan4rotrILm13EjEET0_S1_:
   35|  2.40M|{
   36|  2.40M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  2.40M|}
_ZN5Botan4rotrILm22EjEET0_S1_:
   35|  2.40M|{
   36|  2.40M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  2.40M|}
_ZN5Botan3rhoILm6ELm11ELm25EjEET2_S1_:
   51|  2.40M|inline constexpr T rho(T x) {
   52|  2.40M|   return rotr<R1>(x) ^ rotr<R2>(x) ^ rotr<R3>(x);
   53|  2.40M|}
_ZN5Botan4rotrILm6EjEET0_S1_:
   35|  2.40M|{
   36|  2.40M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  2.40M|}
_ZN5Botan4rotrILm11EjEET0_S1_:
   35|  2.40M|{
   36|  2.40M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  2.40M|}
_ZN5Botan4rotrILm25EjEET0_S1_:
   35|  2.40M|{
   36|  2.40M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  2.40M|}
_ZN5Botan5sigmaILm17ELm19ELm10EjEET2_S1_:
   43|  2.40M|inline constexpr T sigma(T x) {
   44|  2.40M|   return rotr<R1>(x) ^ rotr<R2>(x) ^ (x >> S);
   45|  2.40M|}
_ZN5Botan4rotrILm17EjEET0_S1_:
   35|  2.40M|{
   36|  2.40M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  2.40M|}
_ZN5Botan4rotrILm19EjEET0_S1_:
   35|  2.40M|{
   36|  2.40M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  2.40M|}
_ZN5Botan5sigmaILm7ELm18ELm3EjEET2_S1_:
   43|  2.40M|inline constexpr T sigma(T x) {
   44|  2.40M|   return rotr<R1>(x) ^ rotr<R2>(x) ^ (x >> S);
   45|  2.40M|}
_ZN5Botan4rotrILm7EjEET0_S1_:
   35|  2.40M|{
   36|  2.40M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  2.40M|}
_ZN5Botan4rotrILm18EjEET0_S1_:
   35|  2.40M|{
   36|  2.40M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  2.40M|}
_ZN5Botan3rhoILm14ELm18ELm41EmEET2_S1_:
   51|  68.4k|inline constexpr T rho(T x) {
   52|  68.4k|   return rotr<R1>(x) ^ rotr<R2>(x) ^ rotr<R3>(x);
   53|  68.4k|}
_ZN5Botan4rotrILm14EmEET0_S1_:
   35|  68.4k|{
   36|  68.4k|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  68.4k|}
_ZN5Botan4rotrILm18EmEET0_S1_:
   35|  68.4k|{
   36|  68.4k|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  68.4k|}
_ZN5Botan4rotrILm41EmEET0_S1_:
   35|  68.4k|{
   36|  68.4k|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  68.4k|}
_ZN5Botan3rhoILm28ELm34ELm39EmEET2_S1_:
   51|  68.4k|inline constexpr T rho(T x) {
   52|  68.4k|   return rotr<R1>(x) ^ rotr<R2>(x) ^ rotr<R3>(x);
   53|  68.4k|}
_ZN5Botan4rotrILm28EmEET0_S1_:
   35|  68.4k|{
   36|  68.4k|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  68.4k|}
_ZN5Botan4rotrILm34EmEET0_S1_:
   35|  68.4k|{
   36|  68.4k|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  68.4k|}
_ZN5Botan4rotrILm39EmEET0_S1_:
   35|  68.4k|{
   36|  68.4k|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  68.4k|}
_ZN5Botan5sigmaILm19ELm61ELm6EmEET2_S1_:
   43|  68.4k|inline constexpr T sigma(T x) {
   44|  68.4k|   return rotr<R1>(x) ^ rotr<R2>(x) ^ (x >> S);
   45|  68.4k|}
_ZN5Botan4rotrILm19EmEET0_S1_:
   35|  68.4k|{
   36|  68.4k|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  68.4k|}
_ZN5Botan4rotrILm61EmEET0_S1_:
   35|  68.4k|{
   36|  68.4k|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  68.4k|}
_ZN5Botan5sigmaILm1ELm8ELm7EmEET2_S1_:
   43|  68.4k|inline constexpr T sigma(T x) {
   44|  68.4k|   return rotr<R1>(x) ^ rotr<R2>(x) ^ (x >> S);
   45|  68.4k|}
_ZN5Botan4rotrILm1EmEET0_S1_:
   35|  68.4k|{
   36|  68.4k|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  68.4k|}
_ZN5Botan4rotrILm8EmEET0_S1_:
   35|  68.4k|{
   36|  68.4k|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  68.4k|}

_ZN5Botan8round_upEmm:
   21|  30.5k|inline size_t round_up(size_t n, size_t align_to) {
   22|  30.5k|   BOTAN_ARG_CHECK(align_to != 0, "align_to must not be 0");
  ------------------
  |  |   30|  30.5k|   do {                                                          \
  |  |   31|  30.5k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 30.5k]
  |  |  ------------------
  |  |   32|  30.5k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  30.5k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   23|       |
   24|  30.5k|   if(n % align_to) {
  ------------------
  |  Branch (24:7): [True: 25.4k, False: 5.18k]
  ------------------
   25|  25.4k|      n += align_to - (n % align_to);
   26|  25.4k|   }
   27|  30.5k|   return n;
   28|  30.5k|}

_ZN5Botan11checked_mulEmm:
   47|  20.7M|inline std::optional<size_t> checked_mul(size_t x, size_t y) {
   48|  20.7M|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_add_overflow)
   49|  20.7M|   size_t z;
   50|  20.7M|   if(__builtin_mul_overflow(x, y, &z)) [[unlikely]]
  ------------------
  |  Branch (50:7): [True: 0, False: 20.7M]
  ------------------
   51|       |#elif defined(_MSC_VER)
   52|       |   size_t z;
   53|       |   if(SizeTMult(x, y, &z) != S_OK) [[unlikely]]
   54|       |#else
   55|       |   size_t z = x * y;
   56|       |   if(y && z / y != x) [[unlikely]]
   57|       |#endif
   58|      0|   {
   59|      0|      return std::nullopt;
   60|      0|   }
   61|  20.7M|   return z;
   62|  20.7M|}
_ZN5Botan11checked_addEmmPKci:
   30|   175k|inline size_t checked_add(size_t x, size_t y, const char* file, int line) {
   31|   175k|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_add_overflow)
   32|   175k|   size_t z;
   33|   175k|   if(__builtin_add_overflow(x, y, &z)) [[unlikely]]
  ------------------
  |  Branch (33:7): [True: 0, False: 175k]
  ------------------
   34|       |#elif defined(_MSC_VER)
   35|       |   size_t z;
   36|       |   if(SizeTAdd(x, y, &z) != S_OK) [[unlikely]]
   37|       |#else
   38|       |   size_t z = x + y;
   39|       |   if(z < x) [[unlikely]]
   40|       |#endif
   41|      0|   {
   42|      0|      throw Integer_Overflow_Detected(file, line);
   43|      0|   }
   44|   175k|   return z;
   45|   175k|}

_ZNK5Botan9SCAN_Name9algo_nameEv:
   44|  1.80k|      const std::string& algo_name() const { return m_alg_name; }
_ZNK5Botan9SCAN_Name9arg_countEv:
   49|  1.60k|      size_t arg_count() const { return m_args.size(); }
_ZNK5Botan9SCAN_Name17arg_count_betweenEmm:
   56|     36|      bool arg_count_between(size_t lower, size_t upper) const {
   57|     36|         return ((arg_count() >= lower) && (arg_count() <= upper));
  ------------------
  |  Branch (57:18): [True: 36, False: 0]
  |  Branch (57:44): [True: 36, False: 0]
  ------------------
   58|     36|      }

_ZNK5Botan5SHA_14nameEv:
   32|    152|      std::string name() const override { return "SHA-1"; }
_ZNK5Botan5SHA_113output_lengthEv:
   34|  6.58k|      size_t output_length() const override { return 20; }

_ZNK5Botan7SHA_2244nameEv:
   33|     35|      std::string name() const override { return "SHA-224"; }
_ZNK5Botan7SHA_22413output_lengthEv:
   35|    215|      size_t output_length() const override { return output_bytes; }
_ZNK5Botan7SHA_2564nameEv:
   73|     22|      std::string name() const override { return "SHA-256"; }
_ZNK5Botan7SHA_25613output_lengthEv:
   75|  9.57k|      size_t output_length() const override { return output_bytes; }

_ZN5Botan9SHA2_32_FEjjjRjjjjS0_S0_jjjj:
   31|  2.40M|                                  uint32_t magic) {
   32|  2.40M|   uint32_t A_rho = rho<2, 13, 22>(A);
   33|  2.40M|   uint32_t E_rho = rho<6, 11, 25>(E);
   34|  2.40M|   uint32_t M2_sigma = sigma<17, 19, 10>(M2);
   35|  2.40M|   uint32_t M4_sigma = sigma<7, 18, 3>(M4);
   36|  2.40M|   H += magic + E_rho + choose(E, F, G) + M1;
   37|  2.40M|   D += H;
   38|  2.40M|   H += A_rho + majority(A, B, C);
   39|  2.40M|   M1 += M2_sigma + M3 + M4_sigma;
   40|  2.40M|}

_ZNK5Botan7SHA_3844nameEv:
   32|      1|      std::string name() const override { return "SHA-384"; }
_ZNK5Botan7SHA_38413output_lengthEv:
   34|    389|      size_t output_length() const override { return output_bytes; }
_ZNK5Botan7SHA_5124nameEv:
   72|      6|      std::string name() const override { return "SHA-512"; }
_ZNK5Botan7SHA_51213output_lengthEv:
   74|     30|      size_t output_length() const override { return output_bytes; }
_ZNK5Botan11SHA_512_2564nameEv:
  123|     16|      std::string name() const override { return "SHA-512-256"; }
_ZNK5Botan11SHA_512_25613output_lengthEv:
  125|     31|      size_t output_length() const override { return output_bytes; }

_ZN5Botan9SHA2_64_FEmmmRmmmmS0_S0_mmmm:
   31|  68.4k|                                  uint64_t magic) {
   32|  68.4k|   const uint64_t E_rho = rho<14, 18, 41>(E);
   33|  68.4k|   const uint64_t A_rho = rho<28, 34, 39>(A);
   34|  68.4k|   const uint64_t M2_sigma = sigma<19, 61, 6>(M2);
   35|  68.4k|   const uint64_t M4_sigma = sigma<1, 8, 7>(M4);
   36|  68.4k|   H += magic + E_rho + choose(E, F, G) + M1;
   37|  68.4k|   D += H;
   38|  68.4k|   H += A_rho + majority(A, B, C);
   39|  68.4k|   M1 += M2_sigma + M3 + M4_sigma;
   40|  68.4k|}

_ZN5Botan9SIMD_4x325splatEj:
  129|  49.9k|      static SIMD_4x32 splat(uint32_t B) noexcept {
  130|  49.9k|#if defined(BOTAN_SIMD_USE_SSE2)
  131|  49.9k|         return SIMD_4x32(_mm_set1_epi32(B));
  132|       |#elif defined(BOTAN_SIMD_USE_NEON)
  133|       |         return SIMD_4x32(vdupq_n_u32(B));
  134|       |#else
  135|       |         return SIMD_4x32(B, B, B, B);
  136|       |#endif
  137|  49.9k|      }
_ZN5Botan9SIMD_4x32C2EDv2_x:
  597|  4.07M|      explicit SIMD_4x32(native_simd_type x) noexcept : m_simd(x) {}
_ZN5Botan9SIMD_4x327load_beEPKv:
  172|   154k|      static SIMD_4x32 load_be(const void* in) noexcept {
  173|   154k|#if defined(BOTAN_SIMD_USE_SSE2)
  174|   154k|         return load_le(in).bswap();
  175|       |
  176|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  177|       |         uint32_t R[4];
  178|       |         Botan::load_be(R, static_cast<const uint8_t*>(in), 4);
  179|       |         return SIMD_4x32(R);
  180|       |
  181|       |#elif defined(BOTAN_SIMD_USE_NEON)
  182|       |         SIMD_4x32 l(vld1q_u32(static_cast<const uint32_t*>(in)));
  183|       |         return CPUID::is_little_endian() ? l.bswap() : l;
  184|       |#endif
  185|   154k|      }
_ZN5Botan9SIMD_4x327load_leEPKv:
  156|   154k|      static SIMD_4x32 load_le(const void* in) noexcept {
  157|   154k|#if defined(BOTAN_SIMD_USE_SSE2)
  158|   154k|         return SIMD_4x32(_mm_loadu_si128(reinterpret_cast<const __m128i*>(in)));
  159|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  160|       |         uint32_t R[4];
  161|       |         Botan::load_le(R, static_cast<const uint8_t*>(in), 4);
  162|       |         return SIMD_4x32(R);
  163|       |#elif defined(BOTAN_SIMD_USE_NEON)
  164|       |         SIMD_4x32 l(vld1q_u32(static_cast<const uint32_t*>(in)));
  165|       |         return CPUID::is_big_endian() ? l.bswap() : l;
  166|       |#endif
  167|   154k|      }
_ZNK5Botan9SIMD_4x325bswapEv:
  474|   154k|      SIMD_4x32 bswap() const noexcept {
  475|   154k|#if defined(BOTAN_SIMD_USE_SSE2)
  476|       |
  477|   154k|         __m128i T = m_simd;
  478|   154k|         T = _mm_shufflehi_epi16(T, _MM_SHUFFLE(2, 3, 0, 1));
  479|   154k|         T = _mm_shufflelo_epi16(T, _MM_SHUFFLE(2, 3, 0, 1));
  480|   154k|         return SIMD_4x32(_mm_or_si128(_mm_srli_epi16(T, 8), _mm_slli_epi16(T, 8)));
  481|       |
  482|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  483|       |         return SIMD_4x32(vec_revb(m_simd));
  484|       |
  485|       |#elif defined(BOTAN_SIMD_USE_NEON)
  486|       |         return SIMD_4x32(vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(m_simd))));
  487|       |#endif
  488|   154k|      }
_ZNK5Botan9SIMD_4x32plERKS0_:
  321|   773k|      SIMD_4x32 operator+(const SIMD_4x32& other) const noexcept {
  322|   773k|         SIMD_4x32 retval(*this);
  323|   773k|         retval += other;
  324|   773k|         return retval;
  325|   773k|      }
_ZN5Botan9SIMD_4x32pLERKS0_:
  363|   773k|      void operator+=(const SIMD_4x32& other) noexcept {
  364|   773k|#if defined(BOTAN_SIMD_USE_SSE2)
  365|   773k|         m_simd = _mm_add_epi32(m_simd, other.m_simd);
  366|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  367|       |         m_simd = vec_add(m_simd, other.m_simd);
  368|       |#elif defined(BOTAN_SIMD_USE_NEON)
  369|       |         m_simd = vaddq_u32(m_simd, other.m_simd);
  370|       |#endif
  371|   773k|      }
_ZNK5Botan9SIMD_4x328store_leEPj:
  187|   773k|      void store_le(uint32_t out[4]) const noexcept { this->store_le(reinterpret_cast<uint8_t*>(out)); }
_ZNK5Botan9SIMD_4x328store_leEPh:
  196|   773k|      void store_le(uint8_t out[]) const noexcept {
  197|   773k|#if defined(BOTAN_SIMD_USE_SSE2)
  198|       |
  199|   773k|         _mm_storeu_si128(reinterpret_cast<__m128i*>(out), raw());
  200|       |
  201|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  202|       |
  203|       |         union {
  204|       |               __vector unsigned int V;
  205|       |               uint32_t R[4];
  206|       |         } vec;
  207|       |
  208|       |         vec.V = raw();
  209|       |         Botan::store_le(out, vec.R[0], vec.R[1], vec.R[2], vec.R[3]);
  210|       |
  211|       |#elif defined(BOTAN_SIMD_USE_NEON)
  212|       |         if(CPUID::is_little_endian()) {
  213|       |            vst1q_u8(out, vreinterpretq_u8_u32(m_simd));
  214|       |         } else {
  215|       |            vst1q_u8(out, vreinterpretq_u8_u32(bswap().m_simd));
  216|       |         }
  217|       |#endif
  218|   773k|      }
_ZNK5Botan9SIMD_4x323rawEv:
  595|  3.86M|      native_simd_type raw() const noexcept { return m_simd; }
_ZNK5Botan9SIMD_4x3217shift_elems_rightILm1EEES0_v:
  514|   618k|      {
  515|   618k|#if defined(BOTAN_SIMD_USE_SSE2)
  516|   618k|         return SIMD_4x32(_mm_srli_si128(raw(), 4 * I));
  517|       |#elif defined(BOTAN_SIMD_USE_NEON)
  518|       |         return SIMD_4x32(vextq_u32(raw(), vdupq_n_u32(0), I));
  519|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  520|       |         const __vector unsigned int zero = vec_splat_u32(0);
  521|       |
  522|       |         const __vector unsigned char shuf[3] = {
  523|       |            {4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19},
  524|       |            {8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23},
  525|       |            {12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27},
  526|       |         };
  527|       |
  528|       |         return SIMD_4x32(vec_perm(raw(), zero, shuf[I - 1]));
  529|       |#endif
  530|   618k|      }
_ZN5Botan9SIMD_4x32eOERKS0_:
  383|  2.47M|      void operator^=(const SIMD_4x32& other) noexcept {
  384|  2.47M|#if defined(BOTAN_SIMD_USE_SSE2)
  385|  2.47M|         m_simd = _mm_xor_si128(m_simd, other.m_simd);
  386|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  387|       |         m_simd = vec_xor(m_simd, other.m_simd);
  388|       |#elif defined(BOTAN_SIMD_USE_NEON)
  389|       |         m_simd = veorq_u32(m_simd, other.m_simd);
  390|       |#endif
  391|  2.47M|      }
_ZNK5Botan9SIMD_4x3216shift_elems_leftILm3EEES0_v:
  493|   618k|      {
  494|   618k|#if defined(BOTAN_SIMD_USE_SSE2)
  495|   618k|         return SIMD_4x32(_mm_slli_si128(raw(), 4 * I));
  496|       |#elif defined(BOTAN_SIMD_USE_NEON)
  497|       |         return SIMD_4x32(vextq_u32(vdupq_n_u32(0), raw(), 4 - I));
  498|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  499|       |         const __vector unsigned int zero = vec_splat_u32(0);
  500|       |
  501|       |         const __vector unsigned char shuf[3] = {
  502|       |            {16, 17, 18, 19, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11},
  503|       |            {16, 17, 18, 19, 20, 21, 22, 23, 0, 1, 2, 3, 4, 5, 6, 7},
  504|       |            {16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 0, 1, 2, 3},
  505|       |         };
  506|       |
  507|       |         return SIMD_4x32(vec_perm(raw(), zero, shuf[I - 1]));
  508|       |#endif
  509|   618k|      }
_ZNK5Botan9SIMD_4x324rotlILm1EEES0_v:
  281|   618k|      {
  282|   618k|#if defined(BOTAN_SIMD_USE_SSE2)
  283|       |
  284|   618k|         return SIMD_4x32(_mm_or_si128(_mm_slli_epi32(m_simd, static_cast<int>(ROT)),
  285|   618k|                                       _mm_srli_epi32(m_simd, static_cast<int>(32 - ROT))));
  286|       |
  287|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  288|       |
  289|       |         const unsigned int r = static_cast<unsigned int>(ROT);
  290|       |         __vector unsigned int rot = {r, r, r, r};
  291|       |         return SIMD_4x32(vec_rl(m_simd, rot));
  292|       |
  293|       |#elif defined(BOTAN_SIMD_USE_NEON)
  294|       |
  295|       |   #if defined(BOTAN_TARGET_ARCH_IS_ARM64)
  296|       |
  297|       |         if constexpr(ROT == 8) {
  298|       |            const uint8_t maskb[16] = {3, 0, 1, 2, 7, 4, 5, 6, 11, 8, 9, 10, 15, 12, 13, 14};
  299|       |            const uint8x16_t mask = vld1q_u8(maskb);
  300|       |            return SIMD_4x32(vreinterpretq_u32_u8(vqtbl1q_u8(vreinterpretq_u8_u32(m_simd), mask)));
  301|       |         } else if constexpr(ROT == 16) {
  302|       |            return SIMD_4x32(vreinterpretq_u32_u16(vrev32q_u16(vreinterpretq_u16_u32(m_simd))));
  303|       |         }
  304|       |   #endif
  305|       |         return SIMD_4x32(
  306|       |            vorrq_u32(vshlq_n_u32(m_simd, static_cast<int>(ROT)), vshrq_n_u32(m_simd, static_cast<int>(32 - ROT))));
  307|       |#endif
  308|   618k|      }
_ZNK5Botan9SIMD_4x324rotlILm2EEES0_v:
  281|   618k|      {
  282|   618k|#if defined(BOTAN_SIMD_USE_SSE2)
  283|       |
  284|   618k|         return SIMD_4x32(_mm_or_si128(_mm_slli_epi32(m_simd, static_cast<int>(ROT)),
  285|   618k|                                       _mm_srli_epi32(m_simd, static_cast<int>(32 - ROT))));
  286|       |
  287|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  288|       |
  289|       |         const unsigned int r = static_cast<unsigned int>(ROT);
  290|       |         __vector unsigned int rot = {r, r, r, r};
  291|       |         return SIMD_4x32(vec_rl(m_simd, rot));
  292|       |
  293|       |#elif defined(BOTAN_SIMD_USE_NEON)
  294|       |
  295|       |   #if defined(BOTAN_TARGET_ARCH_IS_ARM64)
  296|       |
  297|       |         if constexpr(ROT == 8) {
  298|       |            const uint8_t maskb[16] = {3, 0, 1, 2, 7, 4, 5, 6, 11, 8, 9, 10, 15, 12, 13, 14};
  299|       |            const uint8x16_t mask = vld1q_u8(maskb);
  300|       |            return SIMD_4x32(vreinterpretq_u32_u8(vqtbl1q_u8(vreinterpretq_u8_u32(m_simd), mask)));
  301|       |         } else if constexpr(ROT == 16) {
  302|       |            return SIMD_4x32(vreinterpretq_u32_u16(vrev32q_u16(vreinterpretq_u16_u32(m_simd))));
  303|       |         }
  304|       |   #endif
  305|       |         return SIMD_4x32(
  306|       |            vorrq_u32(vshlq_n_u32(m_simd, static_cast<int>(ROT)), vshrq_n_u32(m_simd, static_cast<int>(32 - ROT))));
  307|       |#endif
  308|   618k|      }
_ZN5Botan9SIMD_4x32C2Ejjjj:
  113|     96|      SIMD_4x32(uint32_t B0, uint32_t B1, uint32_t B2, uint32_t B3) noexcept {
  114|     96|#if defined(BOTAN_SIMD_USE_SSE2)
  115|     96|         m_simd = _mm_set_epi32(B3, B2, B1, B0);
  116|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  117|       |         __vector unsigned int val = {B0, B1, B2, B3};
  118|       |         m_simd = val;
  119|       |#elif defined(BOTAN_SIMD_USE_NEON)
  120|       |         // Better way to do this?
  121|       |         const uint32_t B[4] = {B0, B1, B2, B3};
  122|       |         m_simd = vld1q_u32(B);
  123|       |#endif
  124|     96|      }
_ZN5Botan9SIMD_4x328splat_u8Eh:
  142|      2|      static SIMD_4x32 splat_u8(uint8_t B) noexcept {
  143|      2|#if defined(BOTAN_SIMD_USE_SSE2)
  144|      2|         return SIMD_4x32(_mm_set1_epi8(B));
  145|       |#elif defined(BOTAN_SIMD_USE_NEON)
  146|       |         return SIMD_4x32(vreinterpretq_u32_u8(vdupq_n_u8(B)));
  147|       |#else
  148|       |         const uint32_t B4 = make_uint32(B, B, B, B);
  149|       |         return SIMD_4x32(B4, B4, B4, B4);
  150|       |#endif
  151|      2|      }

_ZN5Botan12BufferSlicerC2ENSt3__14spanIKhLm18446744073709551615EEE:
  143|  45.3k|      BufferSlicer(std::span<const uint8_t> buffer) : m_remaining(buffer) {}
_ZN5Botan12BufferSlicer4takeEm:
  155|   104k|      std::span<const uint8_t> take(const size_t count) {
  156|   104k|         BOTAN_STATE_CHECK(remaining() >= count);
  ------------------
  |  |   42|   104k|   do {                                                         \
  |  |   43|   104k|      if(!(expr))                                               \
  |  |  ------------------
  |  |  |  Branch (43:10): [True: 0, False: 104k]
  |  |  ------------------
  |  |   44|   104k|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   45|   104k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (45:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  157|   104k|         auto result = m_remaining.first(count);
  158|   104k|         m_remaining = m_remaining.subspan(count);
  159|   104k|         return result;
  160|   104k|      }
_ZNK5Botan12BufferSlicer9remainingEv:
  184|   157k|      size_t remaining() const { return m_remaining.size(); }
_ZNK5Botan12BufferSlicer5emptyEv:
  186|  43.1k|      bool empty() const { return m_remaining.empty(); }
_ZN5Botan13BufferStufferC2ENSt3__14spanIhLm18446744073709551615EEE:
  201|    311|      BufferStuffer(std::span<uint8_t> buffer) : m_buffer(buffer) {}
_ZN5Botan13BufferStuffer4nextEm:
  207|  1.49k|      std::span<uint8_t> next(size_t bytes) {
  208|  1.49k|         BOTAN_STATE_CHECK(m_buffer.size() >= bytes);
  ------------------
  |  |   42|  1.49k|   do {                                                         \
  |  |   43|  1.49k|      if(!(expr))                                               \
  |  |  ------------------
  |  |  |  Branch (43:10): [True: 0, False: 1.49k]
  |  |  ------------------
  |  |   44|  1.49k|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   45|  1.49k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (45:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  209|       |
  210|  1.49k|         auto result = m_buffer.first(bytes);
  211|  1.49k|         m_buffer = m_buffer.subspan(bytes);
  212|  1.49k|         return result;
  213|  1.49k|      }
_ZN5Botan13BufferStuffer6appendENSt3__14spanIKhLm18446744073709551615EEE:
  234|    603|      void append(std::span<const uint8_t> buffer) {
  235|    603|         auto sink = next(buffer.size());
  236|    603|         std::copy(buffer.begin(), buffer.end(), sink.begin());
  237|    603|      }
_ZN5Botan13BufferStuffer6appendEhm:
  239|    895|      void append(uint8_t b, size_t repeat = 1) {
  240|    895|         auto sink = next(repeat);
  241|    895|         std::fill(sink.begin(), sink.end(), b);
  242|    895|      }
_ZNK5Botan13BufferStuffer4fullEv:
  244|    292|      bool full() const { return m_buffer.empty(); }
_ZNK5Botan13BufferStuffer18remaining_capacityEv:
  246|    311|      size_t remaining_capacity() const { return m_buffer.size(); }
_ZN5Botan15multimap_insertINS_3OIDENS_11ASN1_StringEEEvRNSt3__18multimapIT_T0_NS3_4lessIS5_EENS3_9allocatorINS3_4pairIKS5_S6_EEEEEERSB_RKS6_:
  109|  1.51k|void multimap_insert(std::multimap<K, V>& multimap, const K& key, const V& value) {
  110|  1.51k|   multimap.insert(std::make_pair(key, value));
  111|  1.51k|}
_ZN5Botan15multimap_insertINSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEES7_EEvRNS1_8multimapIT_T0_NS1_4lessIS9_EENS5_INS1_4pairIKS9_SA_EEEEEERSE_RKSA_:
  109|    626|void multimap_insert(std::multimap<K, V>& multimap, const K& key, const V& value) {
  110|    626|   multimap.insert(std::make_pair(key, value));
  111|    626|}
_ZN5Botan15multimap_insertINS_3OIDENSt3__112basic_stringIcNS2_11char_traitsIcEENS2_9allocatorIcEEEEEEvRNS2_8multimapIT_T0_NS2_4lessISA_EENS6_INS2_4pairIKSA_SB_EEEEEERSF_RKSB_:
  109|  5.91k|void multimap_insert(std::multimap<K, V>& multimap, const K& key, const V& value) {
  110|  5.91k|   multimap.insert(std::make_pair(key, value));
  111|  5.91k|}

_ZNK5Botan8Streebog13output_lengthEv:
   23|    219|      size_t output_length() const override { return m_output_bits / 8; }

_ZN5Botan21Allocator_InitializerC2Ev:
   40|      1|      Allocator_Initializer() { initialize_allocator(); }

_ZN5Botan11ASN1_ObjectD2Ev:
  120|   474k|      virtual ~ASN1_Object() = default;
_ZN5Botan10BER_ObjectC2Ev:
  128|   477k|      BER_Object() : m_type_tag(ASN1_Type::NoObject), m_class_tag(ASN1_Class::Universal) {}
_ZNK5Botan10BER_Object6is_setEv:
  138|   712k|      bool is_set() const { return m_type_tag != ASN1_Type::NoObject; }
_ZNK5Botan10BER_Object7taggingEv:
  140|   369k|      uint32_t tagging() const { return type_tag() | class_tag(); }
_ZNK5Botan10BER_Object8type_tagEv:
  142|   369k|      ASN1_Type type_tag() const { return m_type_tag; }
_ZNK5Botan10BER_Object9class_tagEv:
  144|   369k|      ASN1_Class class_tag() const { return m_class_tag; }
_ZNK5Botan10BER_Object4typeEv:
  146|  44.6k|      ASN1_Type type() const { return m_type_tag; }
_ZNK5Botan10BER_Object9get_classEv:
  148|  1.87k|      ASN1_Class get_class() const { return m_class_tag; }
_ZNK5Botan10BER_Object4bitsEv:
  150|  4.52M|      const uint8_t* bits() const { return m_value.data(); }
_ZNK5Botan10BER_Object6lengthEv:
  152|  9.46M|      size_t length() const { return m_value.size(); }
_ZN5Botan10BER_Object12mutable_bitsEm:
  169|   317k|      uint8_t* mutable_bits(size_t length) {
  170|   317k|         m_value.resize(length);
  171|   317k|         return m_value.data();
  172|   317k|      }
_ZN5Botan3OIDC2ESt16initializer_listIjE:
  229|  4.56k|      explicit OID(std::initializer_list<uint32_t> init) : m_id(init) {
  230|  4.56k|         BOTAN_ARG_CHECK(m_id.size() > 2 && m_id[0] <= 2 && (m_id[0] != 2 || m_id[1] <= 39), "Invalid OID");
  ------------------
  |  |   30|  4.56k|   do {                                                          \
  |  |   31|  22.9k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:12): [True: 4.56k, False: 0]
  |  |  |  Branch (31:12): [True: 4.56k, False: 0]
  |  |  |  Branch (31:12): [True: 4.49k, False: 73]
  |  |  |  Branch (31:12): [True: 73, False: 0]
  |  |  ------------------
  |  |   32|  4.56k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  4.56k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  231|  4.56k|      }
_ZNK5Botan3OID5emptyEv:
  265|   343k|      bool empty() const { return m_id.empty(); }
_ZNK5Botan3OID9has_valueEv:
  271|  1.75k|      bool has_value() const { return (m_id.empty() == false); }
_ZNK5Botan3OID14get_componentsEv:
  277|   179k|      const std::vector<uint32_t>& get_components() const { return m_id; }
_ZNK5Botan3OIDeqERKS0_:
  309|   206k|      bool operator==(const OID& other) const { return m_id == other.m_id; }
_ZNK5Botan11ASN1_String5valueEv:
  415|  9.00k|      const std::string& value() const { return m_utf8_str; }
_ZNK5Botan11ASN1_String5emptyEv:
  419|  13.9k|      bool empty() const { return m_utf8_str.empty(); }
_ZNK5Botan19AlgorithmIdentifier3oidEv:
  455|  17.6k|      const OID& oid() const { return m_oid; }
_ZNK5Botan19AlgorithmIdentifier10parametersEv:
  457|  7.52k|      const std::vector<uint8_t>& parameters() const { return m_parameters; }
_ZNK5Botan19AlgorithmIdentifier20parameters_are_emptyEv:
  469|  8.87k|      bool parameters_are_empty() const { return m_parameters.empty(); }
_ZNK5Botan19AlgorithmIdentifier28parameters_are_null_or_emptyEv:
  471|  8.34k|      bool parameters_are_null_or_empty() const { return parameters_are_empty() || parameters_are_null(); }
  ------------------
  |  Branch (471:58): [True: 2.90k, False: 5.43k]
  |  Branch (471:84): [True: 4.49k, False: 949]
  ------------------
_ZN5BotanorENS_10ASN1_ClassES0_:
   78|   165k|inline ASN1_Class operator|(ASN1_Class x, ASN1_Class y) {
   79|   165k|   return static_cast<ASN1_Class>(static_cast<uint32_t>(x) | static_cast<uint32_t>(y));
   80|   165k|}
_ZN5BotanorENS_9ASN1_TypeENS_10ASN1_ClassE:
   82|   369k|inline uint32_t operator|(ASN1_Type x, ASN1_Class y) {
   83|   369k|   return static_cast<uint32_t>(x) | static_cast<uint32_t>(y);
   84|   369k|}
_ZN5BotanorENS_10ASN1_ClassENS_9ASN1_TypeE:
   86|  51.3k|inline uint32_t operator|(ASN1_Class x, ASN1_Type y) {
   87|  51.3k|   return static_cast<uint32_t>(x) | static_cast<uint32_t>(y);
   88|  51.3k|}
_ZN5BotanneERKNS_3OIDES2_:
  326|  7.45k|inline bool operator!=(const OID& a, const OID& b) {
  327|  7.45k|   return !(a == b);
  328|  7.45k|}
_ZN5Botan11ASN1_ObjectC2Ev:
  117|   320k|      ASN1_Object() = default;
_ZN5Botan19AlgorithmIdentifierC2Ev:
  447|  20.7k|      AlgorithmIdentifier() = default;
_ZN5Botan3OIDC2Ev:
  218|  55.7k|      explicit OID() = default;
_ZN5Botan9ASN1_TimeC2Ev:
  362|  10.9k|      ASN1_Time() = default;
_ZN5Botan10BER_ObjectaSEOS0_:
  136|  83.0k|      BER_Object& operator=(BER_Object&& other) = default;
_ZN5Botan11ASN1_ObjectaSERKS0_:
  119|    298|      ASN1_Object& operator=(const ASN1_Object&) = default;
_ZN5Botan11ASN1_ObjectC2ERKS0_:
  118|   154k|      ASN1_Object(const ASN1_Object&) = default;
_ZN5Botan10BER_ObjectC2EOS0_:
  134|   129k|      BER_Object(BER_Object&& other) = default;
_ZN5Botan10BER_ObjectaSERKS0_:
  132|  2.38k|      BER_Object& operator=(const BER_Object& other) = default;

_ZN5Botan12ignore_paramIRmEEvOT_:
  111|  48.2M|void ignore_param(T&&) {}
_ZN5Botan13ignore_paramsIJRhEEEvDpOT_:
  114|  14.7k|void ignore_params(T&&... args) {
  115|  14.7k|   (ignore_param(args), ...);
  116|  14.7k|}
_ZN5Botan12ignore_paramIRhEEvOT_:
  111|  14.7k|void ignore_param(T&&) {}
_ZN5Botan13ignore_paramsIJRmEEEvDpOT_:
  114|  48.2M|void ignore_params(T&&... args) {
  115|  48.2M|   (ignore_param(args), ...);
  116|  48.2M|}
_ZN5Botan13ignore_paramsIJRKmEEEvDpOT_:
  114|   421k|void ignore_params(T&&... args) {
  115|   421k|   (ignore_param(args), ...);
  116|   421k|}
_ZN5Botan12ignore_paramIRKmEEvOT_:
  111|  7.21M|void ignore_param(T&&) {}
_ZN5Botan13ignore_paramsIJRKmS2_EEEvDpOT_:
  114|  3.39M|void ignore_params(T&&... args) {
  115|  3.39M|   (ignore_param(args), ...);
  116|  3.39M|}
_ZN5Botan13ignore_paramsIJRPKmRmEEEvDpOT_:
  114|  2.58k|void ignore_params(T&&... args) {
  115|  2.58k|   (ignore_param(args), ...);
  116|  2.58k|}
_ZN5Botan12ignore_paramIRPKmEEvOT_:
  111|  2.58k|void ignore_param(T&&) {}
_ZN5Botan13ignore_paramsIJRNSt3__16vectorImNS_16secure_allocatorImEEEEEEEvDpOT_:
  114|   469k|void ignore_params(T&&... args) {
  115|   469k|   (ignore_param(args), ...);
  116|   469k|}
_ZN5Botan12ignore_paramIRNSt3__16vectorImNS_16secure_allocatorImEEEEEEvOT_:
  111|   469k|void ignore_param(T&&) {}
_ZN5Botan13ignore_paramsIJRlEEEvDpOT_:
  114|   374k|void ignore_params(T&&... args) {
  115|   374k|   (ignore_param(args), ...);
  116|   374k|}
_ZN5Botan12ignore_paramIRlEEvOT_:
  111|   374k|void ignore_param(T&&) {}

_ZN5Botan11BER_Decoder14start_sequenceEv:
  113|  91.7k|      BER_Decoder start_sequence() { return start_cons(ASN1_Type::Sequence, ASN1_Class::Universal); }
_ZN5Botan11BER_Decoder6decodeINSt3__19allocatorIhEEEERS0_RNS2_6vectorIhT_EENS_9ASN1_TypeE:
  198|  27.0k|      BER_Decoder& decode(std::vector<uint8_t, Alloc>& out, ASN1_Type real_type) {
  199|  27.0k|         return decode(out, real_type, real_type, ASN1_Class::Universal);
  200|  27.0k|      }
_ZN5Botan11BER_Decoder9raw_bytesINSt3__19allocatorIhEEEERS0_RNS2_6vectorIhT_EE:
  162|  35.9k|      BER_Decoder& raw_bytes(std::vector<uint8_t, Alloc>& out) {
  163|  35.9k|         out.clear();
  164|  35.9k|         uint8_t buf;
  165|  3.62M|         while(m_source->read_byte(buf)) {
  ------------------
  |  Branch (165:16): [True: 3.58M, False: 35.9k]
  ------------------
  166|  3.58M|            out.push_back(buf);
  167|  3.58M|         }
  168|  35.9k|         return (*this);
  169|  35.9k|      }
_ZN5Botan11BER_DecoderC2ENSt3__14spanIKhLm18446744073709551615EEE:
   32|    646|      BER_Decoder(std::span<const uint8_t> buf) : BER_Decoder(buf.data(), buf.size()) {}
_ZN5Botan11BER_DecoderC2ERKNS_10BER_ObjectE:
   52|  8.14k|      BER_Decoder(const BER_Object& obj) : BER_Decoder(obj.bits(), obj.length()) {}
_ZN5Botan11BER_DecoderC2EONS_10BER_ObjectE:
   57|  1.84k|      BER_Decoder(BER_Object&& obj) : BER_Decoder(std::move(obj), nullptr) {}
_ZN5Botan11BER_Decoder8get_nextERNS_10BER_ObjectE:
   69|  9.27k|      BER_Decoder& get_next(BER_Object& ber) {
   70|  9.27k|         ber = get_next_object();
   71|  9.27k|         return (*this);
   72|  9.27k|      }
_ZN5Botan11BER_Decoder9start_setEv:
  115|  14.7k|      BER_Decoder start_set() { return start_cons(ASN1_Type::Set, ASN1_Class::Universal); }
_ZN5Botan11BER_Decoder22start_context_specificEj:
  117|    563|      BER_Decoder start_context_specific(uint32_t tag) {
  118|    563|         return start_cons(ASN1_Type(tag), ASN1_Class::ContextSpecific);
  119|    563|      }
_ZN5Botan11BER_Decoder6decodeERm:
  181|  2.82k|      BER_Decoder& decode(size_t& out) { return decode(out, ASN1_Type::Integer, ASN1_Class::Universal); }
_ZN5Botan11BER_Decoder6decodeERNS_6BigIntE:
  186|  9.32k|      BER_Decoder& decode(BigInt& out) { return decode(out, ASN1_Type::Integer, ASN1_Class::Universal); }
_ZN5Botan11BER_Decoder15decode_optionalImEERS0_RT_NS_9ASN1_TypeENS_10ASN1_ClassERKS3_:
  317|  6.48k|BER_Decoder& BER_Decoder::decode_optional(T& out, ASN1_Type type_tag, ASN1_Class class_tag, const T& default_value) {
  318|  6.48k|   BER_Object obj = get_next_object();
  319|       |
  320|  6.48k|   if(obj.is_a(type_tag, class_tag)) {
  ------------------
  |  Branch (320:7): [True: 1.96k, False: 4.52k]
  ------------------
  321|  1.96k|      if(class_tag == ASN1_Class::ExplicitContextSpecific) {
  ------------------
  |  Branch (321:10): [True: 1.75k, False: 205]
  ------------------
  322|  1.75k|         BER_Decoder(std::move(obj)).decode(out).verify_end();
  323|  1.75k|      } else {
  324|    205|         push_back(std::move(obj));
  325|    205|         decode(out, type_tag, class_tag);
  326|    205|      }
  327|  4.52k|   } else {
  328|  4.52k|      out = default_value;
  329|  4.52k|      push_back(std::move(obj));
  330|  4.52k|   }
  331|       |
  332|  6.48k|   return (*this);
  333|  6.48k|}
_ZN5Botan11BER_Decoder22decode_optional_stringINSt3__19allocatorIhEEEERS0_RNS2_6vectorIhT_EENS_9ASN1_TypeEjNS_10ASN1_ClassE:
  275|  10.1k|                                          ASN1_Class class_tag = ASN1_Class::ContextSpecific) {
  276|  10.1k|         BER_Object obj = get_next_object();
  277|       |
  278|  10.1k|         ASN1_Type type_tag = static_cast<ASN1_Type>(expected_tag);
  279|       |
  280|  10.1k|         if(obj.is_a(type_tag, class_tag)) {
  ------------------
  |  Branch (280:13): [True: 101, False: 10.0k]
  ------------------
  281|    101|            if(class_tag == ASN1_Class::ExplicitContextSpecific) {
  ------------------
  |  Branch (281:16): [True: 0, False: 101]
  ------------------
  282|      0|               BER_Decoder(std::move(obj)).decode(out, real_type).verify_end();
  283|    101|            } else {
  284|    101|               push_back(std::move(obj));
  285|    101|               decode(out, real_type, type_tag, class_tag);
  286|    101|            }
  287|  10.0k|         } else {
  288|  10.0k|            out.clear();
  289|  10.0k|            push_back(std::move(obj));
  290|  10.0k|         }
  291|       |
  292|  10.1k|         return (*this);
  293|  10.1k|      }
_ZN5Botan11BER_Decoder6decodeINS_16secure_allocatorIhEEEERS0_RNSt3__16vectorIhT_EENS_9ASN1_TypeE:
  198|  1.31k|      BER_Decoder& decode(std::vector<uint8_t, Alloc>& out, ASN1_Type real_type) {
  199|  1.31k|         return decode(out, real_type, real_type, ASN1_Class::Universal);
  200|  1.31k|      }
_ZN5Botan11BER_Decoder15decode_optionalIbEERS0_RT_NS_9ASN1_TypeENS_10ASN1_ClassERKS3_:
  317|  13.2k|BER_Decoder& BER_Decoder::decode_optional(T& out, ASN1_Type type_tag, ASN1_Class class_tag, const T& default_value) {
  318|  13.2k|   BER_Object obj = get_next_object();
  319|       |
  320|  13.2k|   if(obj.is_a(type_tag, class_tag)) {
  ------------------
  |  Branch (320:7): [True: 2.71k, False: 10.5k]
  ------------------
  321|  2.71k|      if(class_tag == ASN1_Class::ExplicitContextSpecific) {
  ------------------
  |  Branch (321:10): [True: 0, False: 2.71k]
  ------------------
  322|      0|         BER_Decoder(std::move(obj)).decode(out).verify_end();
  323|  2.71k|      } else {
  324|  2.71k|         push_back(std::move(obj));
  325|  2.71k|         decode(out, type_tag, class_tag);
  326|  2.71k|      }
  327|  10.5k|   } else {
  328|  10.5k|      out = default_value;
  329|  10.5k|      push_back(std::move(obj));
  330|  10.5k|   }
  331|       |
  332|  13.2k|   return (*this);
  333|  13.2k|}
_ZN5Botan11BER_Decoder11decode_listINS_3OIDEEERS0_RNSt3__16vectorIT_NS4_9allocatorIS6_EEEENS_9ASN1_TypeENS_10ASN1_ClassE:
  364|    218|BER_Decoder& BER_Decoder::decode_list(std::vector<T>& vec, ASN1_Type type_tag, ASN1_Class class_tag) {
  365|    218|   BER_Decoder list = start_cons(type_tag, class_tag);
  366|       |
  367|    644|   while(list.more_items()) {
  ------------------
  |  Branch (367:10): [True: 426, False: 218]
  ------------------
  368|    426|      T value;
  369|    426|      list.decode(value);
  370|    426|      vec.push_back(std::move(value));
  371|    426|   }
  372|       |
  373|    218|   list.end_cons();
  374|       |
  375|    218|   return (*this);
  376|    218|}
_ZN5Botan11BER_Decoder11decode_listINS_14GeneralSubtreeEEERS0_RNSt3__16vectorIT_NS4_9allocatorIS6_EEEENS_9ASN1_TypeENS_10ASN1_ClassE:
  364|  1.23k|BER_Decoder& BER_Decoder::decode_list(std::vector<T>& vec, ASN1_Type type_tag, ASN1_Class class_tag) {
  365|  1.23k|   BER_Decoder list = start_cons(type_tag, class_tag);
  366|       |
  367|  2.76k|   while(list.more_items()) {
  ------------------
  |  Branch (367:10): [True: 1.53k, False: 1.23k]
  ------------------
  368|  1.53k|      T value;
  369|  1.53k|      list.decode(value);
  370|  1.53k|      vec.push_back(std::move(value));
  371|  1.53k|   }
  372|       |
  373|  1.23k|   list.end_cons();
  374|       |
  375|  1.23k|   return (*this);
  376|  1.23k|}
x509_ext.cpp:_ZN5Botan11BER_Decoder11decode_listINS_14Cert_Extension12_GLOBAL__N_118Policy_InformationEEERS0_RNSt3__16vectorIT_NS6_9allocatorIS8_EEEENS_9ASN1_TypeENS_10ASN1_ClassE:
  364|    375|BER_Decoder& BER_Decoder::decode_list(std::vector<T>& vec, ASN1_Type type_tag, ASN1_Class class_tag) {
  365|    375|   BER_Decoder list = start_cons(type_tag, class_tag);
  366|       |
  367|    751|   while(list.more_items()) {
  ------------------
  |  Branch (367:10): [True: 376, False: 375]
  ------------------
  368|    376|      T value;
  369|    376|      list.decode(value);
  370|    376|      vec.push_back(std::move(value));
  371|    376|   }
  372|       |
  373|    375|   list.end_cons();
  374|       |
  375|    375|   return (*this);
  376|    375|}
_ZN5Botan11BER_Decoder11decode_listINS_14Cert_Extension23CRL_Distribution_Points18Distribution_PointEEERS0_RNSt3__16vectorIT_NS6_9allocatorIS8_EEEENS_9ASN1_TypeENS_10ASN1_ClassE:
  364|    508|BER_Decoder& BER_Decoder::decode_list(std::vector<T>& vec, ASN1_Type type_tag, ASN1_Class class_tag) {
  365|    508|   BER_Decoder list = start_cons(type_tag, class_tag);
  366|       |
  367|  1.03k|   while(list.more_items()) {
  ------------------
  |  Branch (367:10): [True: 529, False: 508]
  ------------------
  368|    529|      T value;
  369|    529|      list.decode(value);
  370|    529|      vec.push_back(std::move(value));
  371|    529|   }
  372|       |
  373|    508|   list.end_cons();
  374|       |
  375|    508|   return (*this);
  376|    508|}
_ZN5Botan11BER_Decoder24decode_optional_implicitINS_15AlternativeNameEEERS0_RT_NS_9ASN1_TypeENS_10ASN1_ClassES6_S7_RKS4_:
  344|    450|                                                   const T& default_value) {
  345|    450|   BER_Object obj = get_next_object();
  346|       |
  347|    450|   if(obj.is_a(type_tag, class_tag)) {
  ------------------
  |  Branch (347:7): [True: 263, False: 187]
  ------------------
  348|    263|      obj.set_tagging(real_type, real_class);
  349|    263|      push_back(std::move(obj));
  350|    263|      decode(out, real_type, real_class);
  351|    263|   } else {
  352|       |      // Not what we wanted, push it back on the stream
  353|    187|      out = default_value;
  354|    187|      push_back(std::move(obj));
  355|    187|   }
  356|       |
  357|    450|   return (*this);
  358|    450|}
_ZN5Botan11BER_Decoder16decode_and_checkImEERS0_RKT_NSt3__117basic_string_viewIcNS6_11char_traitsIcEEEE:
  257|    658|      BER_Decoder& decode_and_check(const T& expected, std::string_view error_msg) {
  258|    658|         T actual;
  259|    658|         decode(actual);
  260|       |
  261|    658|         if(actual != expected) {
  ------------------
  |  Branch (261:13): [True: 30, False: 628]
  ------------------
  262|     30|            throw Decoding_Error(error_msg);
  263|     30|         }
  264|       |
  265|    628|         return (*this);
  266|    658|      }
_ZN5Botan11BER_Decoder15decode_optionalINS_19AlgorithmIdentifierEEERS0_RT_NS_9ASN1_TypeENS_10ASN1_ClassERKS4_:
  317|     98|BER_Decoder& BER_Decoder::decode_optional(T& out, ASN1_Type type_tag, ASN1_Class class_tag, const T& default_value) {
  318|     98|   BER_Object obj = get_next_object();
  319|       |
  320|     98|   if(obj.is_a(type_tag, class_tag)) {
  ------------------
  |  Branch (320:7): [True: 91, False: 7]
  ------------------
  321|     91|      if(class_tag == ASN1_Class::ExplicitContextSpecific) {
  ------------------
  |  Branch (321:10): [True: 91, False: 0]
  ------------------
  322|     91|         BER_Decoder(std::move(obj)).decode(out).verify_end();
  323|     91|      } else {
  324|      0|         push_back(std::move(obj));
  325|      0|         decode(out, type_tag, class_tag);
  326|      0|      }
  327|     91|   } else {
  328|      7|      out = default_value;
  329|      7|      push_back(std::move(obj));
  330|      7|   }
  331|       |
  332|     98|   return (*this);
  333|     98|}
_ZN5Botan11BER_Decoder16decode_and_checkINS_3OIDEEERS0_RKT_NSt3__117basic_string_viewIcNS7_11char_traitsIcEEEE:
  257|    627|      BER_Decoder& decode_and_check(const T& expected, std::string_view error_msg) {
  258|    627|         T actual;
  259|    627|         decode(actual);
  260|       |
  261|    627|         if(actual != expected) {
  ------------------
  |  Branch (261:13): [True: 11, False: 616]
  ------------------
  262|     11|            throw Decoding_Error(error_msg);
  263|     11|         }
  264|       |
  265|    616|         return (*this);
  266|    627|      }
_ZN5Botan11BER_Decoder22decode_optional_stringINSt3__19allocatorIhEEEERS0_RNS2_6vectorIhT_EENS_9ASN1_TypeESA_NS_10ASN1_ClassE:
  299|    612|                                          ASN1_Class class_tag = ASN1_Class::ContextSpecific) {
  300|    612|         return decode_optional_string(out, real_type, static_cast<uint32_t>(expected_tag), class_tag);
  301|    612|      }

_ZN5Botan6BigIntC2Ev:
   40|  8.93M|      BigInt() = default;
_ZNK5Botan6BigInt11is_negativeEv:
  528|  34.7M|      bool is_negative() const { return (sign() == Negative); }
_ZNK5Botan6BigInt4signEv:
  540|  66.1M|      Sign sign() const { return (m_signedness); }
_ZN5Botan6BigInt6encodeERKS0_:
  753|  4.91k|      static std::vector<uint8_t> encode(const BigInt& n) {
  754|  4.91k|         std::vector<uint8_t> output(n.bytes());
  755|  4.91k|         n.binary_encode(output.data());
  756|  4.91k|         return output;
  757|  4.91k|      }
_ZN5Botan6BigIntD2Ev:
  148|  11.7M|      ~BigInt() { const_time_unpoison(); }
_ZNK5Botan6BigInt19const_time_unpoisonEv:
  726|  11.7M|      void const_time_unpoison() const {}
_ZN5Botan6BigInt4zeroEv:
   45|  83.1k|      static BigInt zero() { return BigInt(); }
_ZN5Botan6BigInt3oneEv:
   50|  2.28k|      static BigInt one() { return BigInt::from_word(1); }
_ZN5Botan6BigIntC2EOS0_:
  146|   477k|      BigInt(BigInt&& other) { this->swap(other); }
_ZN5Botan6BigIntaSEOS0_:
  153|  3.81M|      BigInt& operator=(BigInt&& other) {
  154|  3.81M|         if(this != &other) {
  ------------------
  |  Branch (154:13): [True: 3.81M, False: 0]
  ------------------
  155|  3.81M|            this->swap(other);
  156|  3.81M|         }
  157|       |
  158|  3.81M|         return (*this);
  159|  3.81M|      }
_ZN5Botan6BigInt4swapERS0_:
  170|  6.56M|      void swap(BigInt& other) {
  171|  6.56M|         m_data.swap(other.m_data);
  172|  6.56M|         std::swap(m_signedness, other.m_signedness);
  173|  6.56M|      }
_ZN5Botan6BigInt8swap_regERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  177|  8.44M|      void swap_reg(secure_vector<word>& reg) {
  178|  8.44M|         m_data.swap(reg);
  179|       |         // sign left unchanged
  180|  8.44M|      }
_ZN5Botan6BigIntpLERKS0_:
  186|   107k|      BigInt& operator+=(const BigInt& y) { return add(y.data(), y.sig_words(), y.sign()); }
_ZN5Botan6BigIntpLEm:
  192|  4.22k|      BigInt& operator+=(word y) { return add(&y, 1, Positive); }
_ZN5Botan6BigIntmIERKS0_:
  198|   104k|      BigInt& operator-=(const BigInt& y) { return sub(y.data(), y.sig_words(), y.sign()); }
_ZN5Botan6BigIntmIEm:
  204|  2.75k|      BigInt& operator-=(word y) { return sub(&y, 1, Positive); }
_ZN5Botan6BigInt3subEPKmmNS0_4SignE:
  292|   107k|      BigInt& sub(const word y[], size_t y_words, Sign sign) {
  293|   107k|         return add(y, y_words, sign == Positive ? Negative : Positive);
  ------------------
  |  Branch (293:33): [True: 107k, False: 0]
  ------------------
  294|   107k|      }
_ZN5Botan6BigInt5clearEv:
  370|   652k|      void clear() {
  371|   652k|         m_data.set_to_zero();
  372|   652k|         m_signedness = Positive;
  373|   652k|      }
_ZNK5Botan6BigInt7is_evenEv:
  410|  21.9k|      bool is_even() const { return (get_bit(0) == 0); }
_ZNK5Botan6BigInt6is_oddEv:
  416|   698k|      bool is_odd() const { return (get_bit(0) == 1); }
_ZNK5Botan6BigInt10is_nonzeroEv:
  422|  2.60M|      bool is_nonzero() const { return (!is_zero()); }
_ZNK5Botan6BigInt7is_zeroEv:
  428|  5.01M|      bool is_zero() const { return (sig_words() == 0); }
_ZN5Botan6BigInt7set_bitEm:
  434|  21.6k|      void set_bit(size_t n) { conditionally_set_bit(n, true); }
_ZN5Botan6BigInt21conditionally_set_bitEmb:
  444|  26.9M|      void conditionally_set_bit(size_t n, bool set_it) {
  445|  26.9M|         const size_t which = n / BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  26.9M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  446|  26.9M|         const word mask = static_cast<word>(set_it) << (n % BOTAN_MP_WORD_BITS);
  ------------------
  |  |   50|  26.9M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  447|  26.9M|         m_data.set_word_at(which, word_at(which) | mask);
  448|  26.9M|      }
_ZN5Botan6BigInt9mask_bitsEm:
  460|  3.57M|      void mask_bits(size_t n) { m_data.mask_bits(n); }
_ZNK5Botan6BigInt7get_bitEm:
  467|  23.9M|      bool get_bit(size_t n) const { return ((word_at(n / BOTAN_MP_WORD_BITS) >> (n % BOTAN_MP_WORD_BITS)) & 1); }
  ------------------
  |  |   50|  23.9M|#define BOTAN_MP_WORD_BITS 64
  ------------------
                    bool get_bit(size_t n) const { return ((word_at(n / BOTAN_MP_WORD_BITS) >> (n % BOTAN_MP_WORD_BITS)) & 1); }
  ------------------
  |  |   50|  23.9M|#define BOTAN_MP_WORD_BITS 64
  ------------------
_ZNK5Botan6BigInt7word_atEm:
  518|  69.9M|      word word_at(size_t n) const { return m_data.get_word_at(n); }
_ZN5Botan6BigInt11set_word_atEmm:
  520|  9.86M|      void set_word_at(size_t i, word w) { m_data.set_word_at(i, w); }
_ZN5Botan6BigInt9set_wordsEPKmm:
  522|   162k|      void set_words(const word w[], size_t len) { m_data.set_words(w, len); }
_ZNK5Botan6BigInt11is_positiveEv:
  534|   604k|      bool is_positive() const { return (sign() == Positive); }
_ZNK5Botan6BigInt12reverse_signEv:
  545|  64.9k|      Sign reverse_sign() const {
  546|  64.9k|         if(sign() == Positive) {
  ------------------
  |  Branch (546:13): [True: 63.1k, False: 1.78k]
  ------------------
  547|  63.1k|            return Negative;
  548|  63.1k|         }
  549|  1.78k|         return Positive;
  550|  64.9k|      }
_ZN5Botan6BigInt9flip_signEv:
  555|  6.12k|      void flip_sign() { set_sign(reverse_sign()); }
_ZN5Botan6BigInt8set_signENS0_4SignE:
  561|  17.2M|      void set_sign(Sign sign) {
  562|  17.2M|         if(sign == Negative && is_zero()) {
  ------------------
  |  Branch (562:13): [True: 333k, False: 16.8M]
  |  Branch (562:33): [True: 2.15k, False: 331k]
  ------------------
  563|  2.15k|            sign = Positive;
  564|  2.15k|         }
  565|       |
  566|  17.2M|         m_signedness = sign;
  567|  17.2M|      }
_ZNK5Botan6BigInt4sizeEv:
  578|  97.9M|      size_t size() const { return m_data.size(); }
_ZNK5Botan6BigInt9sig_wordsEv:
  584|  43.8M|      size_t sig_words() const { return m_data.sig_words(); }
_ZN5Botan6BigInt12mutable_dataEv:
  609|  58.6M|      word* mutable_data() { return m_data.mutable_data(); }
_ZNK5Botan6BigInt4dataEv:
  615|  92.8M|      const word* data() const { return m_data.const_data(); }
_ZN5Botan6BigInt15get_word_vectorEv:
  620|  1.22M|      secure_vector<word>& get_word_vector() { return m_data.mutable_vector(); }
_ZNK5Botan6BigInt15get_word_vectorEv:
  625|  1.00M|      const secure_vector<word>& get_word_vector() const { return m_data.const_vector(); }
_ZNK5Botan6BigInt7grow_toEm:
  631|  30.9M|      void grow_to(size_t n) const { m_data.grow_to(n); }
_ZNK5Botan6BigInt17const_time_poisonEv:
  724|  20.3k|      void const_time_poison() const {}
_ZN5Botan6BigInt10power_of_2Em:
  742|  16.7k|      static BigInt power_of_2(size_t n) {
  743|  16.7k|         BigInt b;
  744|  16.7k|         b.set_bit(n);
  745|  16.7k|         return b;
  746|  16.7k|      }
_ZN5Botan6BigInt6decodeEPKhm:
  776|  4.07k|      static BigInt decode(const uint8_t buf[], size_t length) { return BigInt(buf, length); }
_ZN5Botan6BigInt4Data12mutable_dataEv:
  834|  64.9M|            word* mutable_data() {
  835|  64.9M|               invalidate_sig_words();
  836|  64.9M|               return m_reg.data();
  837|  64.9M|            }
_ZNK5Botan6BigInt4Data10const_dataEv:
  839|  92.8M|            const word* const_data() const { return m_reg.data(); }
_ZN5Botan6BigInt4Data14mutable_vectorEv:
  841|  1.22M|            secure_vector<word>& mutable_vector() {
  842|  1.22M|               invalidate_sig_words();
  843|  1.22M|               return m_reg;
  844|  1.22M|            }
_ZNK5Botan6BigInt4Data12const_vectorEv:
  846|  1.00M|            const secure_vector<word>& const_vector() const { return m_reg; }
_ZNK5Botan6BigInt4Data11get_word_atEm:
  848|  69.9M|            word get_word_at(size_t n) const {
  849|  69.9M|               if(n < m_reg.size()) {
  ------------------
  |  Branch (849:19): [True: 69.5M, False: 375k]
  ------------------
  850|  69.5M|                  return m_reg[n];
  851|  69.5M|               }
  852|   375k|               return 0;
  853|  69.9M|            }
_ZN5Botan6BigInt4Data11set_word_atEmm:
  855|  36.7M|            void set_word_at(size_t i, word w) {
  856|  36.7M|               invalidate_sig_words();
  857|  36.7M|               if(i >= m_reg.size()) {
  ------------------
  |  Branch (857:19): [True: 5.33M, False: 31.4M]
  ------------------
  858|  5.33M|                  if(w == 0) {
  ------------------
  |  Branch (858:22): [True: 5.26M, False: 73.4k]
  ------------------
  859|  5.26M|                     return;
  860|  5.26M|                  }
  861|  73.4k|                  grow_to(i + 1);
  862|  73.4k|               }
  863|  31.5M|               m_reg[i] = w;
  864|  31.5M|            }
_ZN5Botan6BigInt4Data9set_wordsEPKmm:
  866|   162k|            void set_words(const word w[], size_t len) {
  867|   162k|               invalidate_sig_words();
  868|   162k|               m_reg.assign(w, w + len);
  869|   162k|            }
_ZN5Botan6BigInt4Data11set_to_zeroEv:
  871|   652k|            void set_to_zero() {
  872|   652k|               m_reg.resize(m_reg.capacity());
  873|   652k|               clear_mem(m_reg.data(), m_reg.size());
  874|   652k|               m_sig_words = 0;
  875|   652k|            }
_ZN5Botan6BigInt4Data9mask_bitsEm:
  883|  3.57M|            void mask_bits(size_t n) {
  884|  3.57M|               if(n == 0) {
  ------------------
  |  Branch (884:19): [True: 0, False: 3.57M]
  ------------------
  885|      0|                  return set_to_zero();
  886|      0|               }
  887|       |
  888|  3.57M|               const size_t top_word = n / BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  3.57M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  889|       |
  890|       |               // if(top_word < sig_words()) ?
  891|  3.57M|               if(top_word < size()) {
  ------------------
  |  Branch (891:19): [True: 3.55M, False: 15.5k]
  ------------------
  892|  3.55M|                  const word mask = (static_cast<word>(1) << (n % BOTAN_MP_WORD_BITS)) - 1;
  ------------------
  |  |   50|  3.55M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  893|  3.55M|                  const size_t len = size() - (top_word + 1);
  894|  3.55M|                  if(len > 0) {
  ------------------
  |  Branch (894:22): [True: 3.54M, False: 15.0k]
  ------------------
  895|  3.54M|                     clear_mem(&m_reg[top_word + 1], len);
  896|  3.54M|                  }
  897|  3.55M|                  m_reg[top_word] &= mask;
  898|  3.55M|                  invalidate_sig_words();
  899|  3.55M|               }
  900|  3.57M|            }
_ZNK5Botan6BigInt4Data7grow_toEm:
  902|  31.2M|            void grow_to(size_t n) const {
  903|  31.2M|               if(n > size()) {
  ------------------
  |  Branch (903:19): [True: 8.33M, False: 22.8M]
  ------------------
  904|  8.33M|                  if(n <= m_reg.capacity()) {
  ------------------
  |  Branch (904:22): [True: 2.83M, False: 5.49M]
  ------------------
  905|  2.83M|                     m_reg.resize(n);
  906|  5.49M|                  } else {
  907|  5.49M|                     m_reg.resize(n + (8 - (n % 8)));
  908|  5.49M|                  }
  909|  8.33M|               }
  910|  31.2M|            }
_ZNK5Botan6BigInt4Data4sizeEv:
  912|   142M|            size_t size() const { return m_reg.size(); }
_ZN5Botan6BigInt4Data4swapERS1_:
  921|  6.56M|            void swap(Data& other) {
  922|  6.56M|               m_reg.swap(other.m_reg);
  923|  6.56M|               std::swap(m_sig_words, other.m_sig_words);
  924|  6.56M|            }
_ZN5Botan6BigInt4Data4swapERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  926|  8.46M|            void swap(secure_vector<word>& reg) {
  927|  8.46M|               m_reg.swap(reg);
  928|  8.46M|               invalidate_sig_words();
  929|  8.46M|            }
_ZNK5Botan6BigInt4Data20invalidate_sig_wordsEv:
  931|   115M|            void invalidate_sig_words() const { m_sig_words = sig_words_npos; }
_ZNK5Botan6BigInt4Data9sig_wordsEv:
  933|  43.8M|            size_t sig_words() const {
  934|  43.8M|               if(m_sig_words == sig_words_npos) {
  ------------------
  |  Branch (934:19): [True: 22.2M, False: 21.6M]
  ------------------
  935|  22.2M|                  m_sig_words = calc_sig_words();
  936|  22.2M|               } else {
  937|  21.6M|                  BOTAN_DEBUG_ASSERT(m_sig_words == calc_sig_words());
  ------------------
  |  |   99|  21.6M|      do {                          \
  |  |  100|  21.6M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  938|  21.6M|               }
  939|  43.8M|               return m_sig_words;
  940|  43.8M|            }
_ZN5BotanplERKNS_6BigIntES2_:
  958|   704k|inline BigInt operator+(const BigInt& x, const BigInt& y) {
  959|   704k|   return BigInt::add2(x, y.data(), y.sig_words(), y.sign());
  960|   704k|}
_ZN5BotanplERKNS_6BigIntEm:
  962|  2.92k|inline BigInt operator+(const BigInt& x, word y) {
  963|  2.92k|   return BigInt::add2(x, &y, 1, BigInt::Positive);
  964|  2.92k|}
_ZN5BotanmiERKNS_6BigIntES2_:
  970|  58.8k|inline BigInt operator-(const BigInt& x, const BigInt& y) {
  971|  58.8k|   return BigInt::add2(x, y.data(), y.sig_words(), y.reverse_sign());
  972|  58.8k|}
_ZN5BotanmiERKNS_6BigIntEm:
  974|  2.68k|inline BigInt operator-(const BigInt& x, word y) {
  975|  2.68k|   return BigInt::add2(x, &y, 1, BigInt::Negative);
  976|  2.68k|}
_ZN5BotanmlEmRKNS_6BigIntE:
  981|   210k|inline BigInt operator*(word x, const BigInt& y) {
  982|   210k|   return y * x;
  983|   210k|}
_ZN5BotaneqERKNS_6BigIntES2_:
  995|   223k|inline bool operator==(const BigInt& a, const BigInt& b) {
  996|   223k|   return a.is_equal(b);
  997|   223k|}
_ZN5BotanneERKNS_6BigIntES2_:
  999|  3.39k|inline bool operator!=(const BigInt& a, const BigInt& b) {
 1000|  3.39k|   return !a.is_equal(b);
 1001|  3.39k|}
_ZN5BotangeERKNS_6BigIntES2_:
 1007|  5.43k|inline bool operator>=(const BigInt& a, const BigInt& b) {
 1008|  5.43k|   return (a.cmp(b) >= 0);
 1009|  5.43k|}
_ZN5BotanltERKNS_6BigIntES2_:
 1011|   180k|inline bool operator<(const BigInt& a, const BigInt& b) {
 1012|   180k|   return a.is_less_than(b);
 1013|   180k|}
_ZN5BotangtERKNS_6BigIntES2_:
 1015|   130k|inline bool operator>(const BigInt& a, const BigInt& b) {
 1016|   130k|   return b.is_less_than(a);
 1017|   130k|}
_ZN5BotaneqERKNS_6BigIntEm:
 1019|  39.5k|inline bool operator==(const BigInt& a, word b) {
 1020|  39.5k|   return (a.cmp_word(b) == 0);
 1021|  39.5k|}
_ZN5BotanneERKNS_6BigIntEm:
 1023|   679k|inline bool operator!=(const BigInt& a, word b) {
 1024|   679k|   return (a.cmp_word(b) != 0);
 1025|   679k|}
_ZN5BotanleERKNS_6BigIntEm:
 1027|  5.77k|inline bool operator<=(const BigInt& a, word b) {
 1028|  5.77k|   return (a.cmp_word(b) <= 0);
 1029|  5.77k|}
_ZN5BotangeERKNS_6BigIntEm:
 1031|  2.10k|inline bool operator>=(const BigInt& a, word b) {
 1032|  2.10k|   return (a.cmp_word(b) >= 0);
 1033|  2.10k|}
_ZN5BotanltERKNS_6BigIntEm:
 1035|  26.7k|inline bool operator<(const BigInt& a, word b) {
 1036|  26.7k|   return (a.cmp_word(b) < 0);
 1037|  26.7k|}
_ZN5BotangtERKNS_6BigIntEm:
 1039|   164k|inline bool operator>(const BigInt& a, word b) {
 1040|   164k|   return (a.cmp_word(b) > 0);
 1041|   164k|}
_ZN5Botan6BigIntC2ERKS0_:
   80|  2.28M|      BigInt(const BigInt& other) = default;
_ZN5Botan6BigIntaSERKS0_:
  164|  5.06M|      BigInt& operator=(const BigInt&) = default;

_ZN5Botan20Buffered_Computation6updateEPKhm:
   35|  7.34k|      void update(const uint8_t in[], size_t length) { add_data({in, length}); }
_ZN5Botan20Buffered_Computation6updateENSt3__14spanIKhLm18446744073709551615EEE:
   41|  9.43k|      void update(std::span<const uint8_t> in) { add_data(in); }
_ZN5Botan20Buffered_Computation5finalEPh:
   70|    186|      void final(uint8_t out[]) { final_result({out, output_length()}); }
_ZN5Botan20Buffered_Computation12final_stdvecEv:
   84|  9.80k|      std::vector<uint8_t> final_stdvec() { return final<std::vector<uint8_t>>(); }
_ZN5Botan20Buffered_Computation5finalINSt3__16vectorIhNS2_9allocatorIhEEEEEET_v:
   78|  9.80k|      T final() {
   79|  9.80k|         T output(output_length());
   80|  9.80k|         final_result(output);
   81|  9.80k|         return output;
   82|  9.80k|      }
_ZN5Botan20Buffered_ComputationD2Ev:
  134|  13.4k|      virtual ~Buffered_Computation() = default;
_ZN5Botan20Buffered_Computation7processINSt3__16vectorIhNS_16secure_allocatorIhEEEEEET_PKhm:
  105|  6.27k|      T process(const uint8_t in[], size_t length) {
  106|  6.27k|         update(in, length);
  107|  6.27k|         return final<T>();
  108|  6.27k|      }
_ZN5Botan20Buffered_Computation5finalINSt3__16vectorIhNS_16secure_allocatorIhEEEEEET_v:
   78|  6.76k|      T final() {
   79|  6.76k|         T output(output_length());
   80|  6.76k|         final_result(output);
   81|  6.76k|         return output;
   82|  6.76k|      }

_ZN5Botan6ranges25assert_equal_byte_lengthsIRNSt3__14spanIhLm18446744073709551615EEEJRNS3_IKhLm18446744073709551615EEEEEEvOT_DpOT0_:
  107|    186|{
  108|    186|   const std::span s0{r0};
  109|       |
  110|    186|   if constexpr(decltype(s0)::extent != std::dynamic_extent) {
  ------------------
  |  Branch (110:17): [Folded - Ignored]
  ------------------
  111|    186|      constexpr size_t expected_size = s0.size_bytes();
  112|    186|      (assert_exact_byte_length<expected_size>(rs), ...);
  113|    186|   } else {
  114|    186|      const size_t expected_size = s0.size_bytes();
  115|    186|      BOTAN_ARG_CHECK(((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...),
  ------------------
  |  |   30|    186|   do {                                                          \
  |  |   31|    186|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 186]
  |  |  ------------------
  |  |   32|    186|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|    186|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  116|    186|                      "memory regions don't have equal lengths");
  117|    186|   }
  118|    186|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm32ERNSt3__14spanIhLm32EEEEEvOT0_:
   86|    165|inline constexpr void assert_exact_byte_length(R&& r) {
   87|    165|   const std::span s{r};
   88|    165|   if constexpr(decltype(s)::extent != std::dynamic_extent) {
  ------------------
  |  Branch (88:17): [Folded - Ignored]
  ------------------
   89|    165|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   90|    165|   } else {
   91|    165|      BOTAN_ASSERT(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   92|    165|   }
   93|    165|}
_ZN5Botan6ranges25assert_equal_byte_lengthsIRNSt3__15arrayImLm4EEEJRNS2_4spanIhLm32EEEEEEvOT_DpOT0_:
  107|    165|{
  108|    165|   const std::span s0{r0};
  109|       |
  110|    165|   if constexpr(decltype(s0)::extent != std::dynamic_extent) {
  ------------------
  |  Branch (110:17): [Folded - Ignored]
  ------------------
  111|    165|      constexpr size_t expected_size = s0.size_bytes();
  112|    165|      (assert_exact_byte_length<expected_size>(rs), ...);
  113|    165|   } else {
  114|    165|      const size_t expected_size = s0.size_bytes();
  115|    165|      BOTAN_ARG_CHECK(((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...),
  116|    165|                      "memory regions don't have equal lengths");
  117|    165|   }
  118|    165|}
_ZN5Botan6ranges10size_bytesIRNSt3__15arrayImLm4EEEEEmOT_:
   73|    330|inline constexpr size_t size_bytes(spanable_range auto&& r) {
   74|    330|   return std::span{r}.size_bytes();
   75|    330|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm32ERNSt3__14spanIKhLm32EEEEEvOT0_:
   86|    165|inline constexpr void assert_exact_byte_length(R&& r) {
   87|    165|   const std::span s{r};
   88|    165|   if constexpr(decltype(s)::extent != std::dynamic_extent) {
  ------------------
  |  Branch (88:17): [Folded - Ignored]
  ------------------
   89|    165|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   90|    165|   } else {
   91|    165|      BOTAN_ASSERT(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   92|    165|   }
   93|    165|}
_ZN5Botan6ranges25assert_equal_byte_lengthsIRNSt3__15arrayImLm4EEEJRNS2_4spanIKhLm32EEEEEEvOT_DpOT0_:
  107|    165|{
  108|    165|   const std::span s0{r0};
  109|       |
  110|    165|   if constexpr(decltype(s0)::extent != std::dynamic_extent) {
  ------------------
  |  Branch (110:17): [Folded - Ignored]
  ------------------
  111|    165|      constexpr size_t expected_size = s0.size_bytes();
  112|    165|      (assert_exact_byte_length<expected_size>(rs), ...);
  113|    165|   } else {
  114|    165|      const size_t expected_size = s0.size_bytes();
  115|    165|      BOTAN_ARG_CHECK(((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...),
  116|    165|                      "memory regions don't have equal lengths");
  117|    165|   }
  118|    165|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm32ERNSt3__15arrayImLm4EEEEEvOT0_:
   86|    165|inline constexpr void assert_exact_byte_length(R&& r) {
   87|    165|   const std::span s{r};
   88|    165|   if constexpr(decltype(s)::extent != std::dynamic_extent) {
  ------------------
  |  Branch (88:17): [Folded - Ignored]
  ------------------
   89|    165|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   90|    165|   } else {
   91|    165|      BOTAN_ASSERT(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   92|    165|   }
   93|    165|}
_ZN5Botan6ranges25assert_equal_byte_lengthsIRNSt3__14spanIhLm32EEEJRNS2_5arrayImLm4EEEEEEvOT_DpOT0_:
  107|    165|{
  108|    165|   const std::span s0{r0};
  109|       |
  110|    165|   if constexpr(decltype(s0)::extent != std::dynamic_extent) {
  ------------------
  |  Branch (110:17): [Folded - Ignored]
  ------------------
  111|    165|      constexpr size_t expected_size = s0.size_bytes();
  112|    165|      (assert_exact_byte_length<expected_size>(rs), ...);
  113|    165|   } else {
  114|    165|      const size_t expected_size = s0.size_bytes();
  115|    165|      BOTAN_ARG_CHECK(((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...),
  116|    165|                      "memory regions don't have equal lengths");
  117|    165|   }
  118|    165|}
_ZN5Botan6ranges10size_bytesIRNSt3__14spanIhLm32EEEEEmOT_:
   73|    165|inline constexpr size_t size_bytes(spanable_range auto&& r) {
   74|    165|   return std::span{r}.size_bytes();
   75|    165|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm4ERNSt3__14spanIKhLm4EEEEEvOT0_:
   86|  1.21M|inline constexpr void assert_exact_byte_length(R&& r) {
   87|  1.21M|   const std::span s{r};
   88|  1.21M|   if constexpr(decltype(s)::extent != std::dynamic_extent) {
  ------------------
  |  Branch (88:17): [Folded - Ignored]
  ------------------
   89|  1.21M|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   90|  1.21M|   } else {
   91|  1.21M|      BOTAN_ASSERT(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   92|  1.21M|   }
   93|  1.21M|}
_ZN5Botan6ranges25assert_equal_byte_lengthsIRNSt3__14spanIjLm1EEEJRNS3_IKhLm4EEEEEEvOT_DpOT0_:
  107|   605k|{
  108|   605k|   const std::span s0{r0};
  109|       |
  110|   605k|   if constexpr(decltype(s0)::extent != std::dynamic_extent) {
  ------------------
  |  Branch (110:17): [Folded - Ignored]
  ------------------
  111|   605k|      constexpr size_t expected_size = s0.size_bytes();
  112|   605k|      (assert_exact_byte_length<expected_size>(rs), ...);
  113|   605k|   } else {
  114|   605k|      const size_t expected_size = s0.size_bytes();
  115|   605k|      BOTAN_ARG_CHECK(((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...),
  116|   605k|                      "memory regions don't have equal lengths");
  117|   605k|   }
  118|   605k|}
_ZN5Botan6ranges10size_bytesIRNSt3__14spanIjLm1EEEEEmOT_:
   73|   605k|inline constexpr size_t size_bytes(spanable_range auto&& r) {
   74|   605k|   return std::span{r}.size_bytes();
   75|   605k|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm8ERNSt3__14spanIhLm8EEEEEvOT0_:
   86|  35.9k|inline constexpr void assert_exact_byte_length(R&& r) {
   87|  35.9k|   const std::span s{r};
   88|  35.9k|   if constexpr(decltype(s)::extent != std::dynamic_extent) {
  ------------------
  |  Branch (88:17): [Folded - Ignored]
  ------------------
   89|  35.9k|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   90|  35.9k|   } else {
   91|  35.9k|      BOTAN_ASSERT(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   92|  35.9k|   }
   93|  35.9k|}
_ZN5Botan6ranges25assert_equal_byte_lengthsIRNSt3__14spanIhLm8EEEJRNS3_IKmLm1EEEEEEvOT_DpOT0_:
  107|  35.9k|{
  108|  35.9k|   const std::span s0{r0};
  109|       |
  110|  35.9k|   if constexpr(decltype(s0)::extent != std::dynamic_extent) {
  ------------------
  |  Branch (110:17): [Folded - Ignored]
  ------------------
  111|  35.9k|      constexpr size_t expected_size = s0.size_bytes();
  112|  35.9k|      (assert_exact_byte_length<expected_size>(rs), ...);
  113|  35.9k|   } else {
  114|  35.9k|      const size_t expected_size = s0.size_bytes();
  115|  35.9k|      BOTAN_ARG_CHECK(((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...),
  116|  35.9k|                      "memory regions don't have equal lengths");
  117|  35.9k|   }
  118|  35.9k|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm8ERNSt3__14spanIKmLm1EEEEEvOT0_:
   86|  35.9k|inline constexpr void assert_exact_byte_length(R&& r) {
   87|  35.9k|   const std::span s{r};
   88|  35.9k|   if constexpr(decltype(s)::extent != std::dynamic_extent) {
  ------------------
  |  Branch (88:17): [Folded - Ignored]
  ------------------
   89|  35.9k|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   90|  35.9k|   } else {
   91|  35.9k|      BOTAN_ASSERT(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   92|  35.9k|   }
   93|  35.9k|}
_ZN5Botan6ranges10size_bytesIRNSt3__14spanIhLm8EEEEEmOT_:
   73|  35.9k|inline constexpr size_t size_bytes(spanable_range auto&& r) {
   74|  35.9k|   return std::span{r}.size_bytes();
   75|  35.9k|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm4ERNSt3__14spanIhLm4EEEEEvOT0_:
   86|   113k|inline constexpr void assert_exact_byte_length(R&& r) {
   87|   113k|   const std::span s{r};
   88|   113k|   if constexpr(decltype(s)::extent != std::dynamic_extent) {
  ------------------
  |  Branch (88:17): [Folded - Ignored]
  ------------------
   89|   113k|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   90|   113k|   } else {
   91|   113k|      BOTAN_ASSERT(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   92|   113k|   }
   93|   113k|}
_ZN5Botan6ranges25assert_equal_byte_lengthsIRNSt3__14spanIhLm4EEEJRNS3_IKjLm1EEEEEEvOT_DpOT0_:
  107|   113k|{
  108|   113k|   const std::span s0{r0};
  109|       |
  110|   113k|   if constexpr(decltype(s0)::extent != std::dynamic_extent) {
  ------------------
  |  Branch (110:17): [Folded - Ignored]
  ------------------
  111|   113k|      constexpr size_t expected_size = s0.size_bytes();
  112|   113k|      (assert_exact_byte_length<expected_size>(rs), ...);
  113|   113k|   } else {
  114|   113k|      const size_t expected_size = s0.size_bytes();
  115|   113k|      BOTAN_ARG_CHECK(((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...),
  116|   113k|                      "memory regions don't have equal lengths");
  117|   113k|   }
  118|   113k|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm4ERNSt3__14spanIKjLm1EEEEEvOT0_:
   86|   113k|inline constexpr void assert_exact_byte_length(R&& r) {
   87|   113k|   const std::span s{r};
   88|   113k|   if constexpr(decltype(s)::extent != std::dynamic_extent) {
  ------------------
  |  Branch (88:17): [Folded - Ignored]
  ------------------
   89|   113k|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   90|   113k|   } else {
   91|   113k|      BOTAN_ASSERT(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   92|   113k|   }
   93|   113k|}
_ZN5Botan6ranges10size_bytesIRNSt3__14spanIhLm4EEEEEmOT_:
   73|   113k|inline constexpr size_t size_bytes(spanable_range auto&& r) {
   74|   113k|   return std::span{r}.size_bytes();
   75|   113k|}
_ZN5Botan6ranges25assert_equal_byte_lengthsIRNSt3__14spanIjLm18446744073709551615EEEJRNS3_IKhLm18446744073709551615EEEEEEvOT_DpOT0_:
  107|    484|{
  108|    484|   const std::span s0{r0};
  109|       |
  110|    484|   if constexpr(decltype(s0)::extent != std::dynamic_extent) {
  ------------------
  |  Branch (110:17): [Folded - Ignored]
  ------------------
  111|    484|      constexpr size_t expected_size = s0.size_bytes();
  112|    484|      (assert_exact_byte_length<expected_size>(rs), ...);
  113|    484|   } else {
  114|    484|      const size_t expected_size = s0.size_bytes();
  115|    484|      BOTAN_ARG_CHECK(((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...),
  ------------------
  |  |   30|    484|   do {                                                          \
  |  |   31|    484|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 484]
  |  |  ------------------
  |  |   32|    484|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|    484|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  116|    484|                      "memory regions don't have equal lengths");
  117|    484|   }
  118|    484|}
_ZN5Botan6ranges10size_bytesIRNSt3__14spanIjLm18446744073709551615EEEEEmOT_:
   73|    484|inline constexpr size_t size_bytes(spanable_range auto&& r) {
   74|    484|   return std::span{r}.size_bytes();
   75|    484|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm8ERNSt3__14spanIKhLm8EEEEEvOT0_:
   86|   141k|inline constexpr void assert_exact_byte_length(R&& r) {
   87|   141k|   const std::span s{r};
   88|   141k|   if constexpr(decltype(s)::extent != std::dynamic_extent) {
  ------------------
  |  Branch (88:17): [Folded - Ignored]
  ------------------
   89|   141k|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   90|   141k|   } else {
   91|   141k|      BOTAN_ASSERT(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   92|   141k|   }
   93|   141k|}
_ZN5Botan6ranges25assert_equal_byte_lengthsIRNSt3__14spanImLm1EEEJRNS3_IKhLm8EEEEEEvOT_DpOT0_:
  107|  70.8k|{
  108|  70.8k|   const std::span s0{r0};
  109|       |
  110|  70.8k|   if constexpr(decltype(s0)::extent != std::dynamic_extent) {
  ------------------
  |  Branch (110:17): [Folded - Ignored]
  ------------------
  111|  70.8k|      constexpr size_t expected_size = s0.size_bytes();
  112|  70.8k|      (assert_exact_byte_length<expected_size>(rs), ...);
  113|  70.8k|   } else {
  114|  70.8k|      const size_t expected_size = s0.size_bytes();
  115|  70.8k|      BOTAN_ARG_CHECK(((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...),
  116|  70.8k|                      "memory regions don't have equal lengths");
  117|  70.8k|   }
  118|  70.8k|}
_ZN5Botan6ranges10size_bytesIRNSt3__14spanImLm1EEEEEmOT_:
   73|  70.8k|inline constexpr size_t size_bytes(spanable_range auto&& r) {
   74|  70.8k|   return std::span{r}.size_bytes();
   75|  70.8k|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm2ERNSt3__14spanIKhLm2EEEEEvOT0_:
   86|  8.21k|inline constexpr void assert_exact_byte_length(R&& r) {
   87|  8.21k|   const std::span s{r};
   88|  8.21k|   if constexpr(decltype(s)::extent != std::dynamic_extent) {
  ------------------
  |  Branch (88:17): [Folded - Ignored]
  ------------------
   89|  8.21k|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   90|  8.21k|   } else {
   91|  8.21k|      BOTAN_ASSERT(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   92|  8.21k|   }
   93|  8.21k|}
_ZN5Botan6ranges25assert_equal_byte_lengthsIRNSt3__14spanItLm1EEEJRNS3_IKhLm2EEEEEEvOT_DpOT0_:
  107|  4.10k|{
  108|  4.10k|   const std::span s0{r0};
  109|       |
  110|  4.10k|   if constexpr(decltype(s0)::extent != std::dynamic_extent) {
  ------------------
  |  Branch (110:17): [Folded - Ignored]
  ------------------
  111|  4.10k|      constexpr size_t expected_size = s0.size_bytes();
  112|  4.10k|      (assert_exact_byte_length<expected_size>(rs), ...);
  113|  4.10k|   } else {
  114|  4.10k|      const size_t expected_size = s0.size_bytes();
  115|  4.10k|      BOTAN_ARG_CHECK(((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...),
  116|  4.10k|                      "memory regions don't have equal lengths");
  117|  4.10k|   }
  118|  4.10k|}
_ZN5Botan6ranges10size_bytesIRNSt3__14spanItLm1EEEEEmOT_:
   73|  4.10k|inline constexpr size_t size_bytes(spanable_range auto&& r) {
   74|  4.10k|   return std::span{r}.size_bytes();
   75|  4.10k|}

_ZN5Botan8CurveGFpC2Ev:
   90|   488k|      CurveGFp() = default;
_ZNK5Botan13CurveGFp_Repr9curve_mulERNS_6BigIntERKS1_S4_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
   60|  6.23M|      void curve_mul(BigInt& z, const BigInt& x, const BigInt& y, secure_vector<word>& ws) const {
   61|  6.23M|         BOTAN_DEBUG_ASSERT(x.sig_words() <= get_p_words());
  ------------------
  |  |   99|  6.23M|      do {                          \
  |  |  100|  6.23M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   62|  6.23M|         curve_mul_words(z, x.data(), x.size(), y, ws);
   63|  6.23M|      }
_ZNK5Botan13CurveGFp_Repr9curve_sqrERNS_6BigIntERKS1_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
   68|  2.69M|      void curve_sqr(BigInt& z, const BigInt& x, secure_vector<word>& ws) const {
   69|  2.69M|         BOTAN_DEBUG_ASSERT(x.sig_words() <= get_p_words());
  ------------------
  |  |   99|  2.69M|      do {                          \
  |  |  100|  2.69M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   70|  2.69M|         curve_sqr_words(z, x.data(), x.size(), ws);
   71|  2.69M|      }
_ZN5Botan8CurveGFpC2ERKNS_6BigIntES3_S3_:
   98|    640|      CurveGFp(const BigInt& p, const BigInt& a, const BigInt& b) : m_repr(choose_repr(p, a, b)) {}
_ZNK5Botan8CurveGFp5get_aEv:
  107|  43.1k|      const BigInt& get_a() const { return m_repr->get_a(); }
_ZNK5Botan8CurveGFp5get_bEv:
  112|  42.2k|      const BigInt& get_b() const { return m_repr->get_b(); }
_ZNK5Botan8CurveGFp5get_pEv:
  118|   821k|      const BigInt& get_p() const { return m_repr->get_p(); }
_ZNK5Botan8CurveGFp11get_p_wordsEv:
  120|   315k|      size_t get_p_words() const { return m_repr->get_p_words(); }
_ZNK5Botan8CurveGFp11get_ws_sizeEv:
  122|   595k|      size_t get_ws_size() const { return m_repr->get_ws_size(); }
_ZNK5Botan8CurveGFp9get_a_repEv:
  124|  30.8k|      const BigInt& get_a_rep() const { return m_repr->get_a_rep(); }
_ZNK5Botan8CurveGFp9get_b_repEv:
  126|  3.28k|      const BigInt& get_b_rep() const { return m_repr->get_b_rep(); }
_ZNK5Botan8CurveGFp9get_1_repEv:
  128|  6.92k|      const BigInt& get_1_rep() const { return m_repr->get_1_rep(); }
_ZNK5Botan8CurveGFp12a_is_minus_3Ev:
  130|   157k|      bool a_is_minus_3() const { return m_repr->a_is_minus_3(); }
_ZNK5Botan8CurveGFp9a_is_zeroEv:
  132|   286k|      bool a_is_zero() const { return m_repr->a_is_zero(); }
_ZNK5Botan8CurveGFp6is_oneERKNS_6BigIntE:
  134|    267|      bool is_one(const BigInt& x) const { return m_repr->is_one(x); }
_ZNK5Botan8CurveGFp14invert_elementERKNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  136|  1.26k|      BigInt invert_element(const BigInt& x, secure_vector<word>& ws) const { return m_repr->invert_element(x, ws); }
_ZNK5Botan8CurveGFp6to_repERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  138|  2.91k|      void to_rep(BigInt& x, secure_vector<word>& ws) const { m_repr->to_curve_rep(x, ws); }
_ZNK5Botan8CurveGFp8from_repERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  140|    267|      void from_rep(BigInt& x, secure_vector<word>& ws) const { m_repr->from_curve_rep(x, ws); }
_ZNK5Botan8CurveGFp15from_rep_to_tmpERKNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  142|  4.98k|      BigInt from_rep_to_tmp(const BigInt& x, secure_vector<word>& ws) const {
  143|  4.98k|         BigInt xt(x);
  144|  4.98k|         m_repr->from_curve_rep(xt, ws);
  145|  4.98k|         return xt;
  146|  4.98k|      }
_ZNK5Botan8CurveGFp3mulERNS_6BigIntERKS1_S4_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  150|  4.81M|      void mul(BigInt& z, const BigInt& x, const BigInt& y, secure_vector<word>& ws) const {
  151|  4.81M|         m_repr->curve_mul(z, x, y, ws);
  152|  4.81M|      }
_ZNK5Botan8CurveGFp3mulERNS_6BigIntEPKmmRKS1_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  154|  1.17M|      void mul(BigInt& z, const word x_w[], size_t x_size, const BigInt& y, secure_vector<word>& ws) const {
  155|  1.17M|         m_repr->curve_mul_words(z, x_w, x_size, y, ws);
  156|  1.17M|      }
_ZNK5Botan8CurveGFp3sqrERNS_6BigIntERKS1_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  158|  2.58M|      void sqr(BigInt& z, const BigInt& x, secure_vector<word>& ws) const { m_repr->curve_sqr(z, x, ws); }
_ZNK5Botan8CurveGFp3sqrERNS_6BigIntEPKmmRNSt3__16vectorImNS_16secure_allocatorImEEEE:
  160|   285k|      void sqr(BigInt& z, const word x_w[], size_t x_size, secure_vector<word>& ws) const {
  161|   285k|         m_repr->curve_sqr_words(z, x_w, x_size, ws);
  162|   285k|      }
_ZNK5Botan8CurveGFp10mul_to_tmpERKNS_6BigIntES3_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  168|  1.41M|      BigInt mul_to_tmp(const BigInt& x, const BigInt& y, secure_vector<word>& ws) const {
  169|  1.41M|         BigInt z;
  170|  1.41M|         m_repr->curve_mul(z, x, y, ws);
  171|  1.41M|         return z;
  172|  1.41M|      }
_ZNK5Botan8CurveGFp10sqr_to_tmpERKNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  174|  8.53k|      BigInt sqr_to_tmp(const BigInt& x, secure_vector<word>& ws) const {
  175|  8.53k|         BigInt z;
  176|  8.53k|         m_repr->curve_sqr(z, x, ws);
  177|  8.53k|         return z;
  178|  8.53k|      }
_ZN5Botan8CurveGFp4swapERS0_:
  180|   418k|      void swap(CurveGFp& other) { std::swap(m_repr, other.m_repr); }
_ZNK5Botan8CurveGFpeqERKS0_:
  189|   315k|      inline bool operator==(const CurveGFp& other) const {
  190|   315k|         if(m_repr.get() == other.m_repr.get()) {
  ------------------
  |  Branch (190:13): [True: 315k, False: 0]
  ------------------
  191|   315k|            return true;
  192|   315k|         }
  193|       |
  194|      0|         return (get_p() == other.get_p()) && (get_a() == other.get_a()) && (get_b() == other.get_b());
  ------------------
  |  Branch (194:17): [True: 0, False: 0]
  |  Branch (194:47): [True: 0, False: 0]
  |  Branch (194:77): [True: 0, False: 0]
  ------------------
  195|   315k|      }
_ZN5Botan8CurveGFpC2ERKS0_:
  100|   287k|      CurveGFp(const CurveGFp&) = default;
_ZN5Botan8CurveGFpaSERKS0_:
  102|   275k|      CurveGFp& operator=(const CurveGFp&) = default;
_ZN5Botan13CurveGFp_ReprD2Ev:
   23|    640|      virtual ~CurveGFp_Repr() = default;

_ZN5Botan17DataSource_MemoryC2EPKhm:
  118|  49.3k|      DataSource_Memory(const uint8_t in[], size_t length) : m_source(in, in + length), m_offset(0) {}
_ZN5Botan10DataSourceC2Ev:
   91|   173k|      DataSource() = default;
_ZN5Botan10DataSourceD2Ev:
   92|   173k|      virtual ~DataSource() = default;
_ZN5Botan17DataSource_MemoryC2ENSt3__16vectorIhNS_16secure_allocatorIhEEEE:
  124|  14.5k|      explicit DataSource_Memory(secure_vector<uint8_t> in) : m_source(std::move(in)), m_offset(0) {}
_ZN5Botan17DataSource_MemoryC2ERKNSt3__16vectorIhNS1_9allocatorIhEEEE:
  136|  3.03k|      explicit DataSource_Memory(const std::vector<uint8_t>& in) : m_source(in.begin(), in.end()), m_offset(0) {}

_ZN5Botan11DER_Encoder14start_sequenceEv:
   65|  25.4k|      DER_Encoder& start_sequence() { return start_cons(ASN1_Type::Sequence, ASN1_Class::Universal); }
_ZN5Botan11DER_Encoder9raw_bytesINSt3__19allocatorIhEEEERS0_RKNS2_6vectorIhT_EE:
   88|  6.73k|      DER_Encoder& raw_bytes(const std::vector<uint8_t, Alloc>& val) {
   89|  6.73k|         return raw_bytes(val.data(), val.size());
   90|  6.73k|      }
_ZN5Botan11DER_Encoder6encodeINSt3__19allocatorIhEEEERS0_RKNS2_6vectorIhT_EENS_9ASN1_TypeE:
   99|  3.13k|      DER_Encoder& encode(const std::vector<uint8_t, Alloc>& vec, ASN1_Type real_type) {
  100|  3.13k|         return encode(vec.data(), vec.size(), real_type);
  101|  3.13k|      }
_ZN5Botan11DER_Encoder10add_objectENS_9ASN1_TypeENS_10ASN1_ClassERKNSt3__16vectorIhNS3_9allocatorIhEEEE:
  163|  3.18k|      DER_Encoder& add_object(ASN1_Type type_tag, ASN1_Class class_tag, const std::vector<uint8_t>& rep) {
  164|  3.18k|         return add_object(type_tag, class_tag, rep.data(), rep.size());
  165|  3.18k|      }
_ZN5Botan11DER_Encoder10add_objectENS_9ASN1_TypeENS_10ASN1_ClassERKNSt3__16vectorIhNS_16secure_allocatorIhEEEE:
  167|  3.57k|      DER_Encoder& add_object(ASN1_Type type_tag, ASN1_Class class_tag, const secure_vector<uint8_t>& rep) {
  168|  3.57k|         return add_object(type_tag, class_tag, rep.data(), rep.size());
  169|  3.57k|      }
_ZN5Botan11DER_Encoder12DER_SequenceC2EOS1_:
  192|  53.6k|                  m_set_contents(std::move(seq.m_set_contents)) {}
_ZN5Botan11DER_Encoder11encode_listINS_6BigIntEEERS0_RKNSt3__16vectorIT_NS4_9allocatorIS6_EEEE:
  132|    225|      DER_Encoder& encode_list(const std::vector<T>& values) {
  133|    675|         for(size_t i = 0; i != values.size(); ++i) {
  ------------------
  |  Branch (133:28): [True: 450, False: 225]
  ------------------
  134|    450|            encode(values[i]);
  135|    450|         }
  136|    225|         return (*this);
  137|    225|      }

_ZNK5Botan12DH_PublicKey9algo_nameEv:
   50|      4|      std::string algo_name() const override { return "DH"; }

_ZN5Botan8DL_GroupC2INSt3__19allocatorIhEEEERKNS2_6vectorIhT_EENS_15DL_Group_FormatE:
  124|     88|            DL_Group(ber.data(), ber.size(), format) {}

_ZNK5Botan8EC_Group6OS2ECPENSt3__14spanIKhLm18446744073709551615EEE:
  337|  1.85k|      EC_Point OS2ECP(std::span<const uint8_t> encoded_point) const {
  338|  1.85k|         return this->OS2ECP(encoded_point.data(), encoded_point.size());
  339|  1.85k|      }
_ZN5Botan8EC_GroupC2ERKS0_:
  105|    493|      EC_Group(const EC_Group&) = default;
_ZN5Botan8EC_GroupaSEOS0_:
  109|     92|      EC_Group& operator=(EC_Group&&) = default;
_ZN5Botan8EC_GroupC2INSt3__19allocatorIhEEEERKNS2_6vectorIhT_EE:
   78|  2.09k|      EC_Group(const std::vector<uint8_t, Alloc>& ber) : EC_Group(ber.data(), ber.size()) {}

_ZN5Botan8EC_PointC2Ev:
   42|   483k|      EC_Point() = default;
_ZN5Botan8EC_PointC2EOS0_:
   58|  5.32k|      EC_Point(EC_Point&& other) { this->swap(other); }
_ZN5Botan8EC_PointaSEOS0_:
   68|   344k|      EC_Point& operator=(EC_Point&& other) {
   69|   344k|         if(this != &other) {
  ------------------
  |  Branch (69:13): [True: 344k, False: 0]
  ------------------
   70|   344k|            this->swap(other);
   71|   344k|         }
   72|   344k|         return (*this);
   73|   344k|      }
_ZNK5Botan8EC_Point5get_xEv:
  139|   464k|      const BigInt& get_x() const { return m_coord_x; }
_ZNK5Botan8EC_Point5get_yEv:
  146|   464k|      const BigInt& get_y() const { return m_coord_y; }
_ZNK5Botan8EC_Point7is_zeroEv:
  177|  1.07M|      bool is_zero() const { return m_coord_z.is_zero(); }
_ZN5Botan8EC_Point3addERKS0_RNSt3__16vectorINS_6BigIntENS3_9allocatorIS5_EEEE:
  216|   294k|      void add(const EC_Point& other, std::vector<BigInt>& workspace) {
  217|   294k|         BOTAN_ARG_CHECK(m_curve == other.m_curve, "cannot add points on different curves");
  ------------------
  |  |   30|   294k|   do {                                                          \
  |  |   31|   294k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 294k]
  |  |  ------------------
  |  |   32|   294k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|   294k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  218|       |
  219|   294k|         const size_t p_words = m_curve.get_p_words();
  220|       |
  221|   294k|         add(other.m_coord_x.data(),
  222|   294k|             std::min(p_words, other.m_coord_x.size()),
  223|   294k|             other.m_coord_y.data(),
  224|   294k|             std::min(p_words, other.m_coord_y.size()),
  225|   294k|             other.m_coord_z.data(),
  226|   294k|             std::min(p_words, other.m_coord_z.size()),
  227|   294k|             workspace);
  228|   294k|      }
_ZN5Botan8EC_Point10add_affineERKS0_RNSt3__16vectorINS_6BigIntENS3_9allocatorIS5_EEEE:
  254|  21.7k|      void add_affine(const EC_Point& other, std::vector<BigInt>& workspace) {
  255|  21.7k|         BOTAN_ASSERT_NOMSG(m_curve == other.m_curve);
  ------------------
  |  |   60|  21.7k|   do {                                                                     \
  |  |   61|  21.7k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 21.7k]
  |  |  ------------------
  |  |   62|  21.7k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  21.7k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  256|  21.7k|         BOTAN_DEBUG_ASSERT(other.is_affine());
  ------------------
  |  |   99|  21.7k|      do {                          \
  |  |  100|  21.7k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  257|       |
  258|  21.7k|         const size_t p_words = m_curve.get_p_words();
  259|  21.7k|         add_affine(other.m_coord_x.data(),
  260|  21.7k|                    std::min(p_words, other.m_coord_x.size()),
  261|  21.7k|                    other.m_coord_y.data(),
  262|  21.7k|                    std::min(p_words, other.m_coord_y.size()),
  263|  21.7k|                    workspace);
  264|  21.7k|      }
_ZNK5Botan8EC_Point4plusERKS0_RNSt3__16vectorINS_6BigIntENS3_9allocatorIS5_EEEE:
  297|   280k|      EC_Point plus(const EC_Point& other, std::vector<BigInt>& workspace) const {
  298|   280k|         EC_Point x = (*this);
  299|   280k|         x.add(other, workspace);
  300|   280k|         return x;
  301|   280k|      }
_ZNK5Botan8EC_Point4zeroEv:
  317|    267|      EC_Point zero() const { return EC_Point(m_curve); }
_ZNK5Botan8EC_Point9get_curveEv:
  325|  1.26k|      const CurveGFp& get_curve() const { return m_curve; }
_ZN5Botan8EC_PointC2ERKS0_:
   53|   285k|      EC_Point(const EC_Point&) = default;
_ZN5Botan8EC_PointaSERKS0_:
   63|   275k|      EC_Point& operator=(const EC_Point&) = default;

_ZN5Botan12EC_PublicKeyC2Ev:
  106|    102|      EC_PublicKey() : m_domain_params{}, m_public_key{}, m_domain_encoding(EC_Group_Encoding::Explicit) {}
_ZN5Botan12EC_PublicKeyD2Ev:
   32|    833|      ~EC_PublicKey() override = default;
_ZNK5Botan12EC_PublicKey12public_pointEv:
   40|    493|      const EC_Point& public_point() const { return m_public_key; }
_ZNK5Botan12EC_PublicKey6domainEv:
   54|  2.92k|      const EC_Group& domain() const { return m_domain_params; }

_ZN5Botan14ECDH_PublicKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE:
   28|      2|            EC_PublicKey(alg_id, key_bits) {}
_ZNK5Botan14ECDH_PublicKey9algo_nameEv:
   41|      1|      std::string algo_name() const override { return "ECDH"; }

_ZN5Botan15ECDSA_PublicKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE:
   35|  2.09k|            EC_PublicKey(alg_id, key_bits) {}
_ZNK5Botan15ECDSA_PublicKey13message_partsEv:
   55|    840|      size_t message_parts() const override { return 2; }
_ZNK5Botan15ECDSA_PublicKey17message_part_sizeEv:
   57|    420|      size_t message_part_size() const override { return domain().get_order().bytes(); }

_ZNK5Botan9Exception4whatEv:
   93|  3.94k|      const char* what() const noexcept override { return m_msg.c_str(); }
_ZN5Botan13Invalid_StateC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
  208|     86|      explicit Invalid_State(std::string_view err) : Exception(err) {}
_ZN5Botan12Lookup_ErrorC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
  237|      6|      explicit Lookup_Error(std::string_view err) : Exception(err) {}

_ZNK5Botan19GOST_3410_PublicKey13message_partsEv:
   47|     73|      size_t message_parts() const override { return 2; }
_ZNK5Botan19GOST_3410_PublicKey17message_part_sizeEv:
   49|     73|      size_t message_part_size() const override { return domain().get_order().bytes(); }
_ZNK5Botan19GOST_3410_PublicKey29default_x509_signature_formatEv:
   51|     73|      Signature_Format default_x509_signature_format() const override { return Signature_Format::Standard; }

_ZN5Botan10hex_encodeENSt3__14spanIKhLm18446744073709551615EEEb:
   43|  6.27k|inline std::string hex_encode(std::span<const uint8_t> input, bool uppercase = true) {
   44|  6.27k|   return hex_encode(input.data(), input.size(), uppercase);
   45|  6.27k|}

_ZN5Botan13typecast_copyIRNSt3__15arrayImLm4EEERNS1_4spanIhLm32EEEEEvOT_OT0_:
  176|    165|inline constexpr void typecast_copy(ToR&& out, FromR&& in) {
  177|    165|   ranges::assert_equal_byte_lengths(out, in);
  178|    165|   std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  179|    165|}
_ZN5Botan13typecast_copyINSt3__15arrayImLm4EEENS1_4spanIhLm32EEEEET_OT0_:
  209|    165|inline constexpr ToT typecast_copy(FromR&& src) noexcept {
  210|    165|   ToT dst;
  211|    165|   typecast_copy(dst, src);
  212|    165|   return dst;
  213|    165|}
_ZN5Botan13typecast_copyIRNSt3__15arrayImLm4EEERNS1_4spanIKhLm32EEEEEvOT_OT0_:
  176|    165|inline constexpr void typecast_copy(ToR&& out, FromR&& in) {
  177|    165|   ranges::assert_equal_byte_lengths(out, in);
  178|    165|   std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  179|    165|}
_ZN5Botan13typecast_copyINSt3__15arrayImLm4EEENS1_4spanIKhLm32EEEEET_OT0_:
  209|    165|inline constexpr ToT typecast_copy(FromR&& src) noexcept {
  210|    165|   ToT dst;
  211|    165|   typecast_copy(dst, src);
  212|    165|   return dst;
  213|    165|}
_ZN5Botan13typecast_copyINSt3__14spanIhLm32EEERNS1_5arrayImLm4EEEEEvOT_OT0_:
  176|    165|inline constexpr void typecast_copy(ToR&& out, FromR&& in) {
  177|    165|   ranges::assert_equal_byte_lengths(out, in);
  178|    165|   std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  179|    165|}
_ZN5Botan7xor_bufINSt3__14spanIhLm18446744073709551615EEENS2_IKhLm18446744073709551615EEEEEvOT_OT0_:
  341|    186|                              ranges::contiguous_range<uint8_t> auto&& in) {
  342|    186|   ranges::assert_equal_byte_lengths(out, in);
  343|       |
  344|    186|   std::span o{out};
  345|    186|   std::span i{in};
  346|       |
  347|    351|   for(; o.size_bytes() >= 32; o = o.subspan(32), i = i.subspan(32)) {
  ------------------
  |  Branch (347:10): [True: 165, False: 186]
  ------------------
  348|    165|      auto x = typecast_copy<std::array<uint64_t, 4>>(o.template first<32>());
  349|    165|      const auto y = typecast_copy<std::array<uint64_t, 4>>(i.template first<32>());
  350|       |
  351|    165|      x[0] ^= y[0];
  352|    165|      x[1] ^= y[1];
  353|    165|      x[2] ^= y[2];
  354|    165|      x[3] ^= y[3];
  355|       |
  356|    165|      typecast_copy(o.template first<32>(), x);
  357|    165|   }
  358|       |
  359|  2.39k|   for(size_t off = 0; off != o.size_bytes(); ++off) {
  ------------------
  |  Branch (359:24): [True: 2.20k, False: 186]
  ------------------
  360|  2.20k|      o[off] ^= i[off];
  361|  2.20k|   }
  362|    186|}
_ZN5Botan11clear_bytesEPvm:
  103|  53.6M|inline constexpr void clear_bytes(void* ptr, size_t bytes) {
  104|  53.6M|   if(bytes > 0) {
  ------------------
  |  Branch (104:7): [True: 51.2M, False: 2.41M]
  ------------------
  105|  51.2M|      std::memset(ptr, 0, bytes);
  106|  51.2M|   }
  107|  53.6M|}
_ZN5Botan22cast_char_ptr_to_uint8EPKc:
  272|    883|inline const uint8_t* cast_char_ptr_to_uint8(const char* s) {
  273|    883|   return reinterpret_cast<const uint8_t*>(s);
  274|    883|}
_ZN5Botan22cast_uint8_ptr_to_charEPKh:
  276|  33.9k|inline const char* cast_uint8_ptr_to_char(const uint8_t* b) {
  277|  33.9k|   return reinterpret_cast<const char*>(b);
  278|  33.9k|}
_ZN5Botan7xor_bufEPhPKhm:
  402|    186|inline void xor_buf(uint8_t out[], const uint8_t in[], size_t length) {
  403|       |   // simply assumes that *out and *in point to "length" allocated bytes at least
  404|    186|   xor_buf(std::span{out, length}, std::span{in, length});
  405|    186|}
_ZN5Botan8copy_memIhEEvPT_PKS1_m:
  146|  5.07M|inline constexpr void copy_mem(T* out, const T* in, size_t n) {
  147|  5.07M|   BOTAN_ASSERT_IMPLICATION(n > 0, in != nullptr && out != nullptr, "If n > 0 then args are not null");
  ------------------
  |  |   78|  5.07M|   do {                                                                                          \
  |  |   79|  9.93M|      if((expr1) && !(expr2))                                                                    \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 4.96M, False: 107k]
  |  |  |  Branch (79:23): [True: 4.96M, False: 0]
  |  |  |  Branch (79:23): [True: 4.96M, False: 0]
  |  |  ------------------
  |  |   80|  5.07M|         Botan::assertion_failure(#expr1 " implies " #expr2, msg, __func__, __FILE__, __LINE__); \
  |  |   81|  5.07M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (81:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  148|       |
  149|  5.07M|   if(in != nullptr && out != nullptr && n > 0) {
  ------------------
  |  Branch (149:7): [True: 5.07M, False: 6.16k]
  |  Branch (149:24): [True: 5.03M, False: 40.7k]
  |  Branch (149:42): [True: 4.96M, False: 60.8k]
  ------------------
  150|  4.96M|      std::memmove(out, in, sizeof(T) * n);
  151|  4.96M|   }
  152|  5.07M|}
_ZN5Botan9clear_memImEEvPT_m:
  120|  53.6M|inline constexpr void clear_mem(T* ptr, size_t n) {
  121|  53.6M|   clear_bytes(ptr, sizeof(T) * n);
  122|  53.6M|}
_ZN5Botan9clear_memIhEEvPT_m:
  120|  50.1k|inline constexpr void clear_mem(T* ptr, size_t n) {
  121|  50.1k|   clear_bytes(ptr, sizeof(T) * n);
  122|  50.1k|}
_ZN5Botan13typecast_copyIjRNSt3__14spanIKhLm4EEEEET_OT0_:
  209|   605k|inline constexpr ToT typecast_copy(FromR&& src) noexcept {
  210|   605k|   ToT dst;
  211|   605k|   typecast_copy(dst, src);
  212|   605k|   return dst;
  213|   605k|}
_ZN5Botan13typecast_copyIjRNSt3__14spanIKhLm4EEEEEvRT_OT0_:
  188|   605k|inline constexpr void typecast_copy(ToT& out, FromR&& in) noexcept {
  189|   605k|   typecast_copy(std::span<ToT, 1>(&out, 1), in);
  190|   605k|}
_ZN5Botan13typecast_copyINSt3__14spanIjLm1EEERNS2_IKhLm4EEEEEvOT_OT0_:
  176|   605k|inline constexpr void typecast_copy(ToR&& out, FromR&& in) {
  177|   605k|   ranges::assert_equal_byte_lengths(out, in);
  178|   605k|   std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  179|   605k|}
_ZN5Botan13typecast_copyIRNSt3__14spanIhLm8EEEmEEvOT_RKT0_:
  199|  35.9k|inline constexpr void typecast_copy(ToR&& out, const FromT& in) {
  200|  35.9k|   typecast_copy(out, std::span<const FromT, 1>(&in, 1));
  201|  35.9k|}
_ZN5Botan13typecast_copyIRNSt3__14spanIhLm8EEENS2_IKmLm1EEEEEvOT_OT0_:
  176|  35.9k|inline constexpr void typecast_copy(ToR&& out, FromR&& in) {
  177|  35.9k|   ranges::assert_equal_byte_lengths(out, in);
  178|  35.9k|   std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  179|  35.9k|}
_ZN5Botan13typecast_copyIRNSt3__14spanIhLm4EEEjEEvOT_RKT0_:
  199|   113k|inline constexpr void typecast_copy(ToR&& out, const FromT& in) {
  200|   113k|   typecast_copy(out, std::span<const FromT, 1>(&in, 1));
  201|   113k|}
_ZN5Botan13typecast_copyIRNSt3__14spanIhLm4EEENS2_IKjLm1EEEEEvOT_OT0_:
  176|   113k|inline constexpr void typecast_copy(ToR&& out, FromR&& in) {
  177|   113k|   ranges::assert_equal_byte_lengths(out, in);
  178|   113k|   std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  179|   113k|}
_ZN5Botan13typecast_copyIjEEvPT_PKhm:
  228|    484|{
  229|       |   // asserts that *in and *out point to the correct amount of memory
  230|    484|   typecast_copy(std::span<T>(out, N), std::span<const uint8_t>(in, N * sizeof(T)));
  231|    484|}
_ZN5Botan13typecast_copyINSt3__14spanIjLm18446744073709551615EEENS2_IKhLm18446744073709551615EEEEEvOT_OT0_:
  176|    484|inline constexpr void typecast_copy(ToR&& out, FromR&& in) {
  177|    484|   ranges::assert_equal_byte_lengths(out, in);
  178|    484|   std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  179|    484|}
_ZN5Botan13typecast_copyImRNSt3__14spanIKhLm8EEEEET_OT0_:
  209|  70.8k|inline constexpr ToT typecast_copy(FromR&& src) noexcept {
  210|  70.8k|   ToT dst;
  211|  70.8k|   typecast_copy(dst, src);
  212|  70.8k|   return dst;
  213|  70.8k|}
_ZN5Botan13typecast_copyImRNSt3__14spanIKhLm8EEEEEvRT_OT0_:
  188|  70.8k|inline constexpr void typecast_copy(ToT& out, FromR&& in) noexcept {
  189|  70.8k|   typecast_copy(std::span<ToT, 1>(&out, 1), in);
  190|  70.8k|}
_ZN5Botan13typecast_copyINSt3__14spanImLm1EEERNS2_IKhLm8EEEEEvOT_OT0_:
  176|  70.8k|inline constexpr void typecast_copy(ToR&& out, FromR&& in) {
  177|  70.8k|   ranges::assert_equal_byte_lengths(out, in);
  178|  70.8k|   std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  179|  70.8k|}
_ZN5Botan8copy_memImEEvPT_PKS1_m:
  146|  9.98M|inline constexpr void copy_mem(T* out, const T* in, size_t n) {
  147|  9.98M|   BOTAN_ASSERT_IMPLICATION(n > 0, in != nullptr && out != nullptr, "If n > 0 then args are not null");
  ------------------
  |  |   78|  9.98M|   do {                                                                                          \
  |  |   79|  19.9M|      if((expr1) && !(expr2))                                                                    \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 9.98M, False: 1]
  |  |  |  Branch (79:23): [True: 9.98M, False: 0]
  |  |  |  Branch (79:23): [True: 9.98M, False: 0]
  |  |  ------------------
  |  |   80|  9.98M|         Botan::assertion_failure(#expr1 " implies " #expr2, msg, __func__, __FILE__, __LINE__); \
  |  |   81|  9.98M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (81:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  148|       |
  149|  9.98M|   if(in != nullptr && out != nullptr && n > 0) {
  ------------------
  |  Branch (149:7): [True: 9.98M, False: 0]
  |  Branch (149:24): [True: 9.98M, False: 0]
  |  Branch (149:42): [True: 9.98M, False: 1]
  ------------------
  150|  9.98M|      std::memmove(out, in, sizeof(T) * n);
  151|  9.98M|   }
  152|  9.98M|}
_ZN5Botan13typecast_copyItRNSt3__14spanIKhLm2EEEEET_OT0_:
  209|  4.10k|inline constexpr ToT typecast_copy(FromR&& src) noexcept {
  210|  4.10k|   ToT dst;
  211|  4.10k|   typecast_copy(dst, src);
  212|  4.10k|   return dst;
  213|  4.10k|}
_ZN5Botan13typecast_copyItRNSt3__14spanIKhLm2EEEEEvRT_OT0_:
  188|  4.10k|inline constexpr void typecast_copy(ToT& out, FromR&& in) noexcept {
  189|  4.10k|   typecast_copy(std::span<ToT, 1>(&out, 1), in);
  190|  4.10k|}
_ZN5Botan13typecast_copyINSt3__14spanItLm1EEERNS2_IKhLm2EEEEEvOT_OT0_:
  176|  4.10k|inline constexpr void typecast_copy(ToR&& out, FromR&& in) {
  177|  4.10k|   ranges::assert_equal_byte_lengths(out, in);
  178|  4.10k|   std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  179|  4.10k|}
_ZN5Botan9clear_memIjEEvPT_m:
  120|      1|inline constexpr void clear_mem(T* ptr, size_t n) {
  121|      1|   clear_bytes(ptr, sizeof(T) * n);
  122|      1|}
_ZN5Botan8copy_memIiEEvPT_PKS1_m:
  146|  1.53k|inline constexpr void copy_mem(T* out, const T* in, size_t n) {
  147|  1.53k|   BOTAN_ASSERT_IMPLICATION(n > 0, in != nullptr && out != nullptr, "If n > 0 then args are not null");
  ------------------
  |  |   78|  1.53k|   do {                                                                                          \
  |  |   79|  3.07k|      if((expr1) && !(expr2))                                                                    \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 1.53k, False: 0]
  |  |  |  Branch (79:23): [True: 1.53k, False: 0]
  |  |  |  Branch (79:23): [True: 1.53k, False: 0]
  |  |  ------------------
  |  |   80|  1.53k|         Botan::assertion_failure(#expr1 " implies " #expr2, msg, __func__, __FILE__, __LINE__); \
  |  |   81|  1.53k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (81:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  148|       |
  149|  1.53k|   if(in != nullptr && out != nullptr && n > 0) {
  ------------------
  |  Branch (149:7): [True: 1.53k, False: 0]
  |  Branch (149:24): [True: 1.53k, False: 0]
  |  Branch (149:42): [True: 1.53k, False: 0]
  ------------------
  150|  1.53k|      std::memmove(out, in, sizeof(T) * n);
  151|  1.53k|   }
  152|  1.53k|}

_ZNK5Botan10Public_Key13message_partsEv:
  177|    768|      virtual size_t message_parts() const { return 1; }
_ZNK5Botan10Public_Key17message_part_sizeEv:
  188|    384|      virtual size_t message_part_size() const { return 0; }
_ZNK5Botan10Public_Key29default_x509_signature_formatEv:
  190|    804|      virtual Signature_Format default_x509_signature_format() const {
  191|    804|         return (this->message_parts() >= 2) ? Signature_Format::DerSequence : Signature_Format::Standard;
  ------------------
  |  Branch (191:17): [True: 420, False: 384]
  ------------------
  192|    804|      }
_ZN5Botan22create_hex_fingerprintENSt3__14spanIKhLm18446744073709551615EEENS0_17basic_string_viewIcNS0_11char_traitsIcEEEE:
  386|  6.27k|inline std::string create_hex_fingerprint(std::span<const uint8_t> vec, std::string_view hash_name) {
  387|  6.27k|   return create_hex_fingerprint(vec.data(), vec.size(), hash_name);
  388|  6.27k|}
_ZN5Botan14Asymmetric_KeyD2Ev:
   61|  2.76k|      virtual ~Asymmetric_Key() = default;

_ZN5Botan6PK_Ops12VerificationD2Ev:
   88|  1.21k|      virtual ~Verification() = default;

_ZN5Botan15Key_ConstraintsC2ENS0_4BitsE:
  139|    444|      Key_Constraints(Key_Constraints::Bits bits) : m_value(bits) {}
_ZN5Botan15Key_ConstraintsC2Ej:
  141|     55|      explicit Key_Constraints(uint32_t bits) : m_value(bits) {}
_ZN5Botan15Key_ConstraintsC2Ev:
  143|  5.48k|      Key_Constraints() : m_value(0) {}
_ZNK5Botan15Key_Constraints8includesENS0_4BitsE:
  158|      2|      bool includes(Key_Constraints::Bits other) const { return (m_value & other) == other; }
_ZNK5Botan15Key_Constraints5emptyEv:
  165|      9|      bool empty() const { return m_value == 0; }

_ZN5Botan7X509_DNC2Ev:
   39|  13.1k|      X509_DN() = default;
_ZN5Botan10ExtensionsC2Ev:
  517|  5.48k|      Extensions() = default;
_ZN5Botan15NameConstraintsC2Ev:
  299|  7.32k|      NameConstraints() : m_permitted_subtrees(), m_excluded_subtrees() {}
_ZNK5Botan7X509_DN8get_bitsEv:
   62|  9.11k|      const std::vector<uint8_t>& get_bits() const { return m_dn_bits; }
_ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension9Key_UsageEEEPKT_RKNS_3OIDE:
  397|  3.54k|      const T* get_extension_object_as(const OID& oid = T::static_oid()) const {
  398|  3.54k|         if(const Certificate_Extension* extn = get_extension_object(oid)) {
  ------------------
  |  Branch (398:42): [True: 36, False: 3.51k]
  ------------------
  399|       |            // Unknown_Extension oid_name is empty
  400|     36|            if(extn->oid_name().empty()) {
  ------------------
  |  Branch (400:16): [True: 31, False: 5]
  ------------------
  401|     31|               return nullptr;
  402|     31|            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
  ------------------
  |  Branch (402:32): [True: 5, False: 0]
  ------------------
  403|      5|               return extn_as_T;
  404|      5|            } else {
  405|      0|               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
  406|      0|            }
  407|     36|         }
  408|       |
  409|  3.51k|         return nullptr;
  410|  3.54k|      }
_ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension14Subject_Key_IDEEEPKT_RKNS_3OIDE:
  397|  3.54k|      const T* get_extension_object_as(const OID& oid = T::static_oid()) const {
  398|  3.54k|         if(const Certificate_Extension* extn = get_extension_object(oid)) {
  ------------------
  |  Branch (398:42): [True: 29, False: 3.51k]
  ------------------
  399|       |            // Unknown_Extension oid_name is empty
  400|     29|            if(extn->oid_name().empty()) {
  ------------------
  |  Branch (400:16): [True: 16, False: 13]
  ------------------
  401|     16|               return nullptr;
  402|     16|            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
  ------------------
  |  Branch (402:32): [True: 13, False: 0]
  ------------------
  403|     13|               return extn_as_T;
  404|     13|            } else {
  405|      0|               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
  406|      0|            }
  407|     29|         }
  408|       |
  409|  3.51k|         return nullptr;
  410|  3.54k|      }
_ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension16Authority_Key_IDEEEPKT_RKNS_3OIDE:
  397|  3.54k|      const T* get_extension_object_as(const OID& oid = T::static_oid()) const {
  398|  3.54k|         if(const Certificate_Extension* extn = get_extension_object(oid)) {
  ------------------
  |  Branch (398:42): [True: 41, False: 3.50k]
  ------------------
  399|       |            // Unknown_Extension oid_name is empty
  400|     41|            if(extn->oid_name().empty()) {
  ------------------
  |  Branch (400:16): [True: 27, False: 14]
  ------------------
  401|     27|               return nullptr;
  402|     27|            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
  ------------------
  |  Branch (402:32): [True: 14, False: 0]
  ------------------
  403|     14|               return extn_as_T;
  404|     14|            } else {
  405|      0|               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
  406|      0|            }
  407|     41|         }
  408|       |
  409|  3.50k|         return nullptr;
  410|  3.54k|      }
_ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension16Name_ConstraintsEEEPKT_RKNS_3OIDE:
  397|  3.54k|      const T* get_extension_object_as(const OID& oid = T::static_oid()) const {
  398|  3.54k|         if(const Certificate_Extension* extn = get_extension_object(oid)) {
  ------------------
  |  Branch (398:42): [True: 45, False: 3.50k]
  ------------------
  399|       |            // Unknown_Extension oid_name is empty
  400|     45|            if(extn->oid_name().empty()) {
  ------------------
  |  Branch (400:16): [True: 33, False: 12]
  ------------------
  401|     33|               return nullptr;
  402|     33|            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
  ------------------
  |  Branch (402:32): [True: 12, False: 0]
  ------------------
  403|     12|               return extn_as_T;
  404|     12|            } else {
  405|      0|               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
  406|      0|            }
  407|     45|         }
  408|       |
  409|  3.50k|         return nullptr;
  410|  3.54k|      }
_ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension17Basic_ConstraintsEEEPKT_RKNS_3OIDE:
  397|  3.54k|      const T* get_extension_object_as(const OID& oid = T::static_oid()) const {
  398|  3.54k|         if(const Certificate_Extension* extn = get_extension_object(oid)) {
  ------------------
  |  Branch (398:42): [True: 13, False: 3.53k]
  ------------------
  399|       |            // Unknown_Extension oid_name is empty
  400|     13|            if(extn->oid_name().empty()) {
  ------------------
  |  Branch (400:16): [True: 4, False: 9]
  ------------------
  401|      4|               return nullptr;
  402|      9|            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
  ------------------
  |  Branch (402:32): [True: 9, False: 0]
  ------------------
  403|      9|               return extn_as_T;
  404|      9|            } else {
  405|      0|               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
  406|      0|            }
  407|     13|         }
  408|       |
  409|  3.53k|         return nullptr;
  410|  3.54k|      }
_ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension23Issuer_Alternative_NameEEEPKT_RKNS_3OIDE:
  397|  3.54k|      const T* get_extension_object_as(const OID& oid = T::static_oid()) const {
  398|  3.54k|         if(const Certificate_Extension* extn = get_extension_object(oid)) {
  ------------------
  |  Branch (398:42): [True: 92, False: 3.45k]
  ------------------
  399|       |            // Unknown_Extension oid_name is empty
  400|     92|            if(extn->oid_name().empty()) {
  ------------------
  |  Branch (400:16): [True: 46, False: 46]
  ------------------
  401|     46|               return nullptr;
  402|     46|            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
  ------------------
  |  Branch (402:32): [True: 46, False: 0]
  ------------------
  403|     46|               return extn_as_T;
  404|     46|            } else {
  405|      0|               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
  406|      0|            }
  407|     92|         }
  408|       |
  409|  3.45k|         return nullptr;
  410|  3.54k|      }
_ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension24Subject_Alternative_NameEEEPKT_RKNS_3OIDE:
  397|  3.54k|      const T* get_extension_object_as(const OID& oid = T::static_oid()) const {
  398|  3.54k|         if(const Certificate_Extension* extn = get_extension_object(oid)) {
  ------------------
  |  Branch (398:42): [True: 222, False: 3.32k]
  ------------------
  399|       |            // Unknown_Extension oid_name is empty
  400|    222|            if(extn->oid_name().empty()) {
  ------------------
  |  Branch (400:16): [True: 160, False: 62]
  ------------------
  401|    160|               return nullptr;
  402|    160|            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
  ------------------
  |  Branch (402:32): [True: 62, False: 0]
  ------------------
  403|     62|               return extn_as_T;
  404|     62|            } else {
  405|      0|               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
  406|      0|            }
  407|    222|         }
  408|       |
  409|  3.32k|         return nullptr;
  410|  3.54k|      }
_ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension18Extended_Key_UsageEEEPKT_RKNS_3OIDE:
  397|  3.54k|      const T* get_extension_object_as(const OID& oid = T::static_oid()) const {
  398|  3.54k|         if(const Certificate_Extension* extn = get_extension_object(oid)) {
  ------------------
  |  Branch (398:42): [True: 35, False: 3.51k]
  ------------------
  399|       |            // Unknown_Extension oid_name is empty
  400|     35|            if(extn->oid_name().empty()) {
  ------------------
  |  Branch (400:16): [True: 10, False: 25]
  ------------------
  401|     10|               return nullptr;
  402|     25|            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
  ------------------
  |  Branch (402:32): [True: 25, False: 0]
  ------------------
  403|     25|               return extn_as_T;
  404|     25|            } else {
  405|      0|               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
  406|      0|            }
  407|     35|         }
  408|       |
  409|  3.51k|         return nullptr;
  410|  3.54k|      }
_ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension20Certificate_PoliciesEEEPKT_RKNS_3OIDE:
  397|  3.54k|      const T* get_extension_object_as(const OID& oid = T::static_oid()) const {
  398|  3.54k|         if(const Certificate_Extension* extn = get_extension_object(oid)) {
  ------------------
  |  Branch (398:42): [True: 15, False: 3.53k]
  ------------------
  399|       |            // Unknown_Extension oid_name is empty
  400|     15|            if(extn->oid_name().empty()) {
  ------------------
  |  Branch (400:16): [True: 12, False: 3]
  ------------------
  401|     12|               return nullptr;
  402|     12|            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
  ------------------
  |  Branch (402:32): [True: 3, False: 0]
  ------------------
  403|      3|               return extn_as_T;
  404|      3|            } else {
  405|      0|               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
  406|      0|            }
  407|     15|         }
  408|       |
  409|  3.53k|         return nullptr;
  410|  3.54k|      }
_ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension28Authority_Information_AccessEEEPKT_RKNS_3OIDE:
  397|  3.54k|      const T* get_extension_object_as(const OID& oid = T::static_oid()) const {
  398|  3.54k|         if(const Certificate_Extension* extn = get_extension_object(oid)) {
  ------------------
  |  Branch (398:42): [True: 23, False: 3.52k]
  ------------------
  399|       |            // Unknown_Extension oid_name is empty
  400|     23|            if(extn->oid_name().empty()) {
  ------------------
  |  Branch (400:16): [True: 12, False: 11]
  ------------------
  401|     12|               return nullptr;
  402|     12|            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
  ------------------
  |  Branch (402:32): [True: 11, False: 0]
  ------------------
  403|     11|               return extn_as_T;
  404|     11|            } else {
  405|      0|               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
  406|      0|            }
  407|     23|         }
  408|       |
  409|  3.52k|         return nullptr;
  410|  3.54k|      }
_ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension23CRL_Distribution_PointsEEEPKT_RKNS_3OIDE:
  397|  3.54k|      const T* get_extension_object_as(const OID& oid = T::static_oid()) const {
  398|  3.54k|         if(const Certificate_Extension* extn = get_extension_object(oid)) {
  ------------------
  |  Branch (398:42): [True: 23, False: 3.52k]
  ------------------
  399|       |            // Unknown_Extension oid_name is empty
  400|     23|            if(extn->oid_name().empty()) {
  ------------------
  |  Branch (400:16): [True: 20, False: 3]
  ------------------
  401|     20|               return nullptr;
  402|     20|            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
  ------------------
  |  Branch (402:32): [True: 3, False: 0]
  ------------------
  403|      3|               return extn_as_T;
  404|      3|            } else {
  405|      0|               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
  406|      0|            }
  407|     23|         }
  408|       |
  409|  3.52k|         return nullptr;
  410|  3.54k|      }
_ZNK5Botan7X509_DN7dn_infoEv:
   70|  1.48k|      const std::vector<std::pair<OID, ASN1_String>>& dn_info() const { return m_rdn; }
_ZN5Botan14GeneralSubtreeC2Ev:
  246|  1.53k|      GeneralSubtree() : m_base(), m_minimum(0), m_maximum(std::numeric_limits<std::size_t>::max()) {}
_ZN5Botan15NameConstraintsC2EONSt3__16vectorINS_14GeneralSubtreeENS1_9allocatorIS3_EEEES7_:
  308|    133|            m_permitted_subtrees(permitted_subtrees), m_excluded_subtrees(excluded_subtrees) {}
_ZN5Botan10Extensions15Extensions_InfoC2EbRKNSt3__16vectorIhNS2_9allocatorIhEEEENS2_10unique_ptrINS_21Certificate_ExtensionENS2_14default_deleteISA_EEEE:
  538|  12.7k|                  m_obj(std::move(ext)), m_bits(encoding), m_critical(critical) {}
_ZNK5Botan10Extensions15Extensions_Info3objEv:
  544|    574|            const Certificate_Extension& obj() const {
  545|    574|               BOTAN_ASSERT_NONNULL(m_obj.get());
  ------------------
  |  |   87|    574|   do {                                                                                   \
  |  |   88|    574|      if((ptr) == nullptr)                                                                \
  |  |  ------------------
  |  |  |  Branch (88:10): [True: 0, False: 574]
  |  |  ------------------
  |  |   89|    574|         Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \
  |  |   90|    574|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  546|    574|               return *m_obj;
  547|    574|            }
_ZN5Botan11GeneralNameC2Ev:
  194|  1.53k|      GeneralName() = default;
_ZN5Botan21Certificate_ExtensionD2Ev:
  371|  18.7k|      virtual ~Certificate_Extension() = default;

_ZN5Botan11PK_Verifier14verify_messageENSt3__14spanIKhLm18446744073709551615EEES4_:
  325|    877|      bool verify_message(std::span<const uint8_t> msg, std::span<const uint8_t> sig) {
  326|    877|         return verify_message(msg.data(), msg.size(), sig.data(), sig.size());
  327|    877|      }

_ZNK5Botan15Modular_Reducer8multiplyERKNS_6BigIntES3_:
   30|   496k|      BigInt multiply(const BigInt& x, const BigInt& y) const { return reduce(x * y); }
_ZNK5Botan15Modular_Reducer11get_modulusEv:
   20|    634|      const BigInt& get_modulus() const { return m_modulus; }
_ZNK5Botan15Modular_Reducer6squareERKNS_6BigIntE:
   43|  1.16M|      BigInt square(const BigInt& x) const { return reduce(Botan::square(x)); }

_ZN5Botan16secure_allocatorIhE8allocateEm:
   45|   410k|      T* allocate(std::size_t n) { return static_cast<T*>(allocate_memory(n, sizeof(T))); }
_ZN5Botan16secure_allocatorIhE10deallocateEPhm:
   47|   410k|      void deallocate(T* p, std::size_t n) { deallocate_memory(p, n, sizeof(T)); }
_ZN5BotanneIhhEEbRKNS_16secure_allocatorIT_EERKNS1_IT0_EE:
   56|  83.7k|inline bool operator!=(const secure_allocator<T>&, const secure_allocator<U>&) {
   57|  83.7k|   return false;
   58|  83.7k|}
_ZN5Botan16secure_allocatorImE10deallocateEPmm:
   47|  20.2M|      void deallocate(T* p, std::size_t n) { deallocate_memory(p, n, sizeof(T)); }
_ZN5Botan16secure_allocatorImE8allocateEm:
   45|  20.2M|      T* allocate(std::size_t n) { return static_cast<T*>(allocate_memory(n, sizeof(T))); }
_ZN5BotanpLIhNS_16secure_allocatorIhEEmEERNSt3__16vectorIT_T0_EES8_RKNS3_4pairIPS5_T1_EE:
   98|  14.7k|std::vector<T, Alloc>& operator+=(std::vector<T, Alloc>& out, const std::pair<T*, L>& in) {
   99|  14.7k|   out.insert(out.end(), in.first, in.first + in.second);
  100|  14.7k|   return out;
  101|  14.7k|}
_ZN5BotanpLIhNS_16secure_allocatorIhEES2_EERNSt3__16vectorIT_T0_EES8_RKNS4_IS5_T1_EE:
   80|     14|std::vector<T, Alloc>& operator+=(std::vector<T, Alloc>& out, const std::vector<T, Alloc2>& in) {
   81|     14|   out.insert(out.end(), in.begin(), in.end());
   82|     14|   return out;
   83|     14|}
_ZN5BotanpLIhNS_16secure_allocatorIhEEmEERNSt3__16vectorIT_T0_EES8_RKNS3_4pairIPKS5_T1_EE:
   92|  51.3k|std::vector<T, Alloc>& operator+=(std::vector<T, Alloc>& out, const std::pair<const T*, L>& in) {
   93|  51.3k|   out.insert(out.end(), in.first, in.first + in.second);
   94|  51.3k|   return out;
   95|  51.3k|}
_ZN5Botan16secure_allocatorIjE10deallocateEPjm:
   47|  13.0k|      void deallocate(T* p, std::size_t n) { deallocate_memory(p, n, sizeof(T)); }
_ZN5Botan16secure_allocatorIjE8allocateEm:
   45|  13.0k|      T* allocate(std::size_t n) { return static_cast<T*>(allocate_memory(n, sizeof(T))); }
_ZN5Botan7zeroiseImNS_16secure_allocatorImEEEEvRNSt3__16vectorIT_T0_EE:
  108|    146|void zeroise(std::vector<T, Alloc>& vec) {
  109|    146|   std::fill(vec.begin(), vec.end(), static_cast<T>(0));
  110|    146|}
_ZN5BotanpLIhNSt3__19allocatorIhEENS_16secure_allocatorIhEEEERNS1_6vectorIT_T0_EESA_RKNS6_IS7_T1_EE:
   80|    786|std::vector<T, Alloc>& operator+=(std::vector<T, Alloc>& out, const std::vector<T, Alloc2>& in) {
   81|    786|   out.insert(out.end(), in.begin(), in.end());
   82|    786|   return out;
   83|    786|}

_ZN5Botan14Cert_Extension9Key_Usage10static_oidEv:
   66|  15.8k|      static OID static_oid() { return OID("2.5.29.15"); }
_ZNK5Botan14Cert_Extension9Key_Usage15get_constraintsEv:
   64|      5|      Key_Constraints get_constraints() const { return m_constraints; }
_ZN5Botan14Cert_Extension14Subject_Key_ID10static_oidEv:
   98|  16.3k|      static OID static_oid() { return OID("2.5.29.14"); }
_ZNK5Botan14Cert_Extension14Subject_Key_ID10get_key_idEv:
   96|     13|      const std::vector<uint8_t>& get_key_id() const { return m_key_id; }
_ZN5Botan14Cert_Extension16Authority_Key_ID10static_oidEv:
  128|  13.0k|      static OID static_oid() { return OID("2.5.29.35"); }
_ZNK5Botan14Cert_Extension16Authority_Key_ID10get_key_idEv:
  126|     14|      const std::vector<uint8_t>& get_key_id() const { return m_key_id; }
_ZN5Botan14Cert_Extension16Name_Constraints10static_oidEv:
  250|  12.6k|      static OID static_oid() { return OID("2.5.29.30"); }
_ZNK5Botan14Cert_Extension16Name_Constraints20get_name_constraintsEv:
  248|     12|      const NameConstraints& get_name_constraints() const { return m_name_constraints; }
_ZN5Botan14Cert_Extension17Basic_Constraints10static_oidEv:
   37|  14.3k|      static OID static_oid() { return OID("2.5.29.19"); }
_ZNK5Botan14Cert_Extension17Basic_Constraints9get_is_caEv:
   33|      9|      bool get_is_ca() const { return m_is_ca; }
_ZN5Botan14Cert_Extension23Issuer_Alternative_Name10static_oidEv:
  178|  14.8k|      static OID static_oid() { return OID("2.5.29.18"); }
_ZNK5Botan14Cert_Extension23Issuer_Alternative_Name12get_alt_nameEv:
  176|     46|      const AlternativeName& get_alt_name() const { return m_alt_name; }
_ZN5Botan14Cert_Extension24Subject_Alternative_Name10static_oidEv:
  150|  15.4k|      static OID static_oid() { return OID("2.5.29.17"); }
_ZNK5Botan14Cert_Extension24Subject_Alternative_Name12get_alt_nameEv:
  148|     62|      const AlternativeName& get_alt_name() const { return m_alt_name; }
_ZN5Botan14Cert_Extension18Extended_Key_Usage10static_oidEv:
  214|  9.53k|      static OID static_oid() { return OID("2.5.29.37"); }
_ZNK5Botan14Cert_Extension18Extended_Key_Usage18object_identifiersEv:
  212|     25|      const std::vector<OID>& object_identifiers() const { return m_oids; }
_ZN5Botan14Cert_Extension20Certificate_Policies10static_oidEv:
  280|  9.90k|      static OID static_oid() { return OID("2.5.29.32"); }
_ZNK5Botan14Cert_Extension20Certificate_Policies15get_policy_oidsEv:
  278|      3|      const std::vector<OID>& get_policy_oids() const { return m_oids; }
_ZN5Botan14Cert_Extension28Authority_Information_Access10static_oidEv:
  318|  9.31k|      static OID static_oid() { return OID("1.3.6.1.5.5.7.1.1"); }
_ZNK5Botan14Cert_Extension28Authority_Information_Access14ocsp_responderEv:
  316|     11|      std::string ocsp_responder() const { return m_ocsp_responder; }
_ZNK5Botan14Cert_Extension28Authority_Information_Access10ca_issuersEv:
  322|     11|      const std::vector<std::string>& ca_issuers() const { return m_ca_issuers; }
_ZN5Botan14Cert_Extension23CRL_Distribution_Points10static_oidEv:
  424|  10.7k|      static OID static_oid() { return OID("2.5.29.31"); }
_ZNK5Botan14Cert_Extension23CRL_Distribution_Points21crl_distribution_urlsEv:
  422|      3|      const std::vector<std::string>& crl_distribution_urls() const { return m_crl_distribution_urls; }
_ZN5Botan14Cert_Extension17Basic_ConstraintsC2Ebm:
   31|    749|      Basic_Constraints(bool ca = false, size_t limit = 0) : m_is_ca(ca), m_path_limit(limit) {}
_ZNK5Botan14Cert_Extension17Basic_Constraints8oid_nameEv:
   42|      9|      std::string oid_name() const override { return "X509v3.BasicConstraints"; }
_ZN5Botan14Cert_Extension9Key_UsageC2Ev:
   62|    444|      explicit Key_Usage() : m_constraints(Key_Constraints::None) {}
_ZNK5Botan14Cert_Extension9Key_Usage8oid_nameEv:
   71|      5|      std::string oid_name() const override { return "X509v3.KeyUsage"; }
_ZNK5Botan14Cert_Extension14Subject_Key_ID8oid_nameEv:
  103|     13|      std::string oid_name() const override { return "X509v3.SubjectKeyIdentifier"; }
_ZNK5Botan14Cert_Extension16Authority_Key_ID8oid_nameEv:
  133|     14|      std::string oid_name() const override { return "X509v3.AuthorityKeyIdentifier"; }
_ZN5Botan14Cert_Extension24Subject_Alternative_NameC2ERKNS_15AlternativeNameE:
  158|    590|      explicit Subject_Alternative_Name(const AlternativeName& name = AlternativeName()) : m_alt_name(name) {}
_ZNK5Botan14Cert_Extension24Subject_Alternative_Name8oid_nameEv:
  161|     62|      std::string oid_name() const override { return "X509v3.SubjectAlternativeName"; }
_ZN5Botan14Cert_Extension23Issuer_Alternative_NameC2ERKNS_15AlternativeNameE:
  186|    475|      explicit Issuer_Alternative_Name(const AlternativeName& name = AlternativeName()) : m_alt_name(name) {}
_ZNK5Botan14Cert_Extension23Issuer_Alternative_Name8oid_nameEv:
  189|     46|      std::string oid_name() const override { return "X509v3.IssuerAlternativeName"; }
_ZNK5Botan14Cert_Extension18Extended_Key_Usage8oid_nameEv:
  219|     25|      std::string oid_name() const override { return "X509v3.ExtendedKeyUsage"; }
_ZNK5Botan14Cert_Extension16Name_Constraints8oid_nameEv:
  255|     12|      std::string oid_name() const override { return "X509v3.NameConstraints"; }
_ZNK5Botan14Cert_Extension20Certificate_Policies8oid_nameEv:
  291|      3|      std::string oid_name() const override { return "X509v3.CertificatePolicies"; }
_ZNK5Botan14Cert_Extension28Authority_Information_Access8oid_nameEv:
  325|     11|      std::string oid_name() const override { return "PKIX.AuthorityInformationAccess"; }
_ZN5Botan14Cert_Extension10CRL_NumberC2Ev:
  343|    413|      CRL_Number() : m_has_value(false), m_crl_number(0) {}
_ZN5Botan14Cert_Extension10CRL_Number10static_oidEv:
  349|  10.0k|      static OID static_oid() { return OID("2.5.29.20"); }
_ZN5Botan14Cert_Extension14CRL_ReasonCodeC2ENS_8CRL_CodeE:
  374|    210|      explicit CRL_ReasonCode(CRL_Code r = CRL_Code::Unspecified) : m_reason(r) {}
_ZN5Botan14Cert_Extension14CRL_ReasonCode10static_oidEv:
  378|  9.67k|      static OID static_oid() { return OID("2.5.29.21"); }
_ZN5Botan14Cert_Extension23CRL_Distribution_Points18Distribution_PointC2ERKNS_15AlternativeNameE:
  404|    890|            explicit Distribution_Point(const AlternativeName& name = AlternativeName()) : m_point(name) {}
_ZNK5Botan14Cert_Extension23CRL_Distribution_Points18Distribution_Point5pointEv:
  406|    230|            const AlternativeName& point() const { return m_point; }
_ZNK5Botan14Cert_Extension23CRL_Distribution_Points8oid_nameEv:
  429|      3|      std::string oid_name() const override { return "X509v3.CRLDistributionPoints"; }
_ZN5Botan14Cert_Extension30CRL_Issuing_Distribution_Point10static_oidEv:
  457|  6.72k|      static OID static_oid() { return OID("2.5.29.28"); }
_ZN5Botan14Cert_Extension17Unknown_ExtensionC2ERKNS_3OIDEb:
  509|  11.3k|      Unknown_Extension(const OID& oid, bool critical) : m_oid(oid), m_critical(critical) {}
_ZNK5Botan14Cert_Extension17Unknown_Extension8oid_nameEv:
  543|    371|      std::string oid_name() const override { return ""; }
_ZN5Botan14Cert_Extension14Subject_Key_IDC2Ev:
   86|    417|      Subject_Key_ID() = default;
_ZN5Botan14Cert_Extension16Authority_Key_IDC2Ev:
  122|    395|      Authority_Key_ID() = default;
_ZN5Botan14Cert_Extension16Name_ConstraintsC2Ev:
  238|  1.83k|      Name_Constraints() = default;
_ZN5Botan14Cert_Extension23CRL_Distribution_PointsC2Ev:
  416|    508|      CRL_Distribution_Points() = default;
_ZN5Botan14Cert_Extension30CRL_Issuing_Distribution_PointC2Ev:
  446|    361|      CRL_Issuing_Distribution_Point() = default;
_ZN5Botan14Cert_Extension20Certificate_PoliciesC2Ev:
  274|    375|      Certificate_Policies() = default;
_ZN5Botan14Cert_Extension18Extended_Key_UsageC2Ev:
  208|    218|      Extended_Key_Usage() = default;
_ZN5Botan14Cert_Extension28Authority_Information_AccessC2Ev:
  310|    363|      Authority_Information_Access() = default;

_ZN5Botan4X5098load_keyERKNSt3__16vectorIhNS1_9allocatorIhEEEE:
   58|  3.03k|inline std::unique_ptr<Public_Key> load_key(const std::vector<uint8_t>& enc) {
   59|  3.03k|   DataSource_Memory source(enc);
   60|  3.03k|   return X509::load_key(source);
   61|  3.03k|}

_ZN5Botan11X509_ObjectD2Ev:
  103|  6.60k|      ~X509_Object() override = default;
_ZNK5Botan11X509_Object9signatureEv:
   37|  4.01k|      const std::vector<uint8_t>& signature() const { return m_sig; }
_ZNK5Botan11X509_Object11signed_bodyEv:
   42|  9.02k|      const std::vector<uint8_t>& signed_body() const { return m_tbs_bits; }
_ZNK5Botan11X509_Object19signature_algorithmEv:
   47|  9.48k|      const AlgorithmIdentifier& signature_algorithm() const { return m_sig_algo; }
_ZN5Botan11X509_ObjectC2Ev:
  121|  6.60k|      X509_Object() = default;

_Z4fuzzPKhm:
   12|  6.60k|void fuzz(const uint8_t in[], size_t len) {
   13|  6.60k|   if(len > max_fuzzer_input_size) {
  ------------------
  |  Branch (13:7): [True: 0, False: 6.60k]
  ------------------
   14|      0|      return;
   15|      0|   }
   16|       |
   17|  6.60k|   try {
   18|  6.60k|      Botan::DataSource_Memory input(in, len);
   19|  6.60k|      Botan::X509_Certificate cert(input);
   20|  6.60k|   } catch(Botan::Exception& e) {}
   21|  6.60k|}

LLVMFuzzerInitialize:
   24|      2|extern "C" int LLVMFuzzerInitialize(int*, char***) {
   25|       |   /*
   26|       |   * This disables the mlock pool, as overwrites within the pool are
   27|       |   * opaque to ASan or other instrumentation.
   28|       |   */
   29|      2|   ::setenv("BOTAN_MLOCK_POOL_SIZE", "0", 1);
   30|      2|   return 0;
   31|      2|}
LLVMFuzzerTestOneInput:
   34|  6.61k|extern "C" int LLVMFuzzerTestOneInput(const uint8_t in[], size_t len) {
   35|  6.61k|   if(len <= max_fuzzer_input_size) {
  ------------------
  |  Branch (35:7): [True: 6.60k, False: 9]
  ------------------
   36|  6.60k|      fuzz(in, len);
   37|  6.60k|   }
   38|  6.61k|   return 0;
   39|  6.61k|}

_ZN5Botan19AlgorithmIdentifierC2ERKNS_3OIDERKNSt3__16vectorIhNS4_9allocatorIhEEEE:
   19|     54|      m_oid(oid), m_parameters(param) {}
_ZN5Botan19AlgorithmIdentifierC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEERKNS1_6vectorIhNS1_9allocatorIhEEEE:
   25|     54|      AlgorithmIdentifier(OID::from_string(oid), param) {}
_ZN5Botan19AlgorithmIdentifierC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEENS0_15Encoding_OptionE:
   42|     54|      m_oid(OID::from_string(oid)), m_parameters() {
   43|     54|   const uint8_t DER_NULL[] = {0x05, 0x00};
   44|       |
   45|     54|   if(option == USE_NULL_PARAM) {
  ------------------
  |  Branch (45:7): [True: 54, False: 0]
  ------------------
   46|     54|      m_parameters.assign(DER_NULL, DER_NULL + 2);
   47|     54|   }
   48|     54|}
_ZNK5Botan19AlgorithmIdentifier19parameters_are_nullEv:
   50|  5.46k|bool AlgorithmIdentifier::parameters_are_null() const {
   51|  5.46k|   return (m_parameters.size() == 2 && (m_parameters[0] == 0x05) && (m_parameters[1] == 0x00));
  ------------------
  |  Branch (51:12): [True: 5.19k, False: 273]
  |  Branch (51:40): [True: 4.54k, False: 654]
  |  Branch (51:69): [True: 4.51k, False: 23]
  ------------------
   52|  5.46k|}
_ZN5BotaneqERKNS_19AlgorithmIdentifierES2_:
   54|  4.66k|bool operator==(const AlgorithmIdentifier& a1, const AlgorithmIdentifier& a2) {
   55|  4.66k|   if(a1.oid() != a2.oid()) {
  ------------------
  |  Branch (55:7): [True: 24, False: 4.64k]
  ------------------
   56|     24|      return false;
   57|     24|   }
   58|       |
   59|       |   /*
   60|       |   * Treat NULL and empty as equivalent
   61|       |   */
   62|  4.64k|   if(a1.parameters_are_null_or_empty() && a2.parameters_are_null_or_empty()) {
  ------------------
  |  Branch (62:7): [True: 3.70k, False: 933]
  |  Branch (62:44): [True: 3.69k, False: 16]
  ------------------
   63|  3.69k|      return true;
   64|  3.69k|   }
   65|       |
   66|    949|   return (a1.parameters() == a2.parameters());
   67|  4.64k|}
_ZN5BotanneERKNS_19AlgorithmIdentifierES2_:
   69|  4.66k|bool operator!=(const AlgorithmIdentifier& a1, const AlgorithmIdentifier& a2) {
   70|  4.66k|   return !(a1 == a2);
   71|  4.66k|}
_ZNK5Botan19AlgorithmIdentifier11encode_intoERNS_11DER_EncoderE:
   76|  3.60k|void AlgorithmIdentifier::encode_into(DER_Encoder& codec) const {
   77|  3.60k|   codec.start_sequence().encode(oid()).raw_bytes(parameters()).end_cons();
   78|  3.60k|}
_ZN5Botan19AlgorithmIdentifier11decode_fromERNS_11BER_DecoderE:
   83|  18.7k|void AlgorithmIdentifier::decode_from(BER_Decoder& codec) {
   84|  18.7k|   codec.start_sequence().decode(m_oid).raw_bytes(m_parameters).end_cons();
   85|  18.7k|}

_ZNK5Botan11ASN1_Object10BER_encodeEv:
   19|  3.60k|std::vector<uint8_t> ASN1_Object::BER_encode() const {
   20|  3.60k|   std::vector<uint8_t> output;
   21|  3.60k|   DER_Encoder der(output);
   22|  3.60k|   this->encode_into(der);
   23|  3.60k|   return output;
   24|  3.60k|}
_ZNK5Botan10BER_Object11assert_is_aENS_9ASN1_TypeENS_10ASN1_ClassENSt3__117basic_string_viewIcNS3_11char_traitsIcEEEE:
   29|   156k|void BER_Object::assert_is_a(ASN1_Type expected_type_tag, ASN1_Class expected_class_tag, std::string_view descr) const {
   30|   156k|   if(this->is_a(expected_type_tag, expected_class_tag) == false) {
  ------------------
  |  Branch (30:7): [True: 3.95k, False: 152k]
  ------------------
   31|  3.95k|      std::stringstream msg;
   32|       |
   33|  3.95k|      msg << "Tag mismatch when decoding " << descr << " got ";
   34|       |
   35|  3.95k|      if(m_class_tag == ASN1_Class::NoObject && m_type_tag == ASN1_Type::NoObject) {
  ------------------
  |  Branch (35:10): [True: 716, False: 3.23k]
  |  Branch (35:49): [True: 716, False: 0]
  ------------------
   36|    716|         msg << "EOF";
   37|  3.23k|      } else {
   38|  3.23k|         if(m_class_tag == ASN1_Class::Universal || m_class_tag == ASN1_Class::Constructed) {
  ------------------
  |  Branch (38:13): [True: 976, False: 2.26k]
  |  Branch (38:53): [True: 1.50k, False: 760]
  ------------------
   39|  2.47k|            msg << asn1_tag_to_string(m_type_tag);
   40|  2.47k|         } else {
   41|    760|            msg << std::to_string(static_cast<uint32_t>(m_type_tag));
   42|    760|         }
   43|       |
   44|  3.23k|         msg << "/" << asn1_class_to_string(m_class_tag);
   45|  3.23k|      }
   46|       |
   47|  3.95k|      msg << " expected ";
   48|       |
   49|  3.95k|      if(expected_class_tag == ASN1_Class::Universal || expected_class_tag == ASN1_Class::Constructed) {
  ------------------
  |  Branch (49:10): [True: 1.19k, False: 2.75k]
  |  Branch (49:57): [True: 2.65k, False: 104]
  ------------------
   50|  3.84k|         msg << asn1_tag_to_string(expected_type_tag);
   51|  3.84k|      } else {
   52|    104|         msg << std::to_string(static_cast<uint32_t>(expected_type_tag));
   53|    104|      }
   54|       |
   55|  3.95k|      msg << "/" << asn1_class_to_string(expected_class_tag);
   56|       |
   57|  3.95k|      throw BER_Decoding_Error(msg.str());
   58|  3.95k|   }
   59|   156k|}
_ZNK5Botan10BER_Object4is_aENS_9ASN1_TypeENS_10ASN1_ClassE:
   61|   332k|bool BER_Object::is_a(ASN1_Type expected_type_tag, ASN1_Class expected_class_tag) const {
   62|   332k|   return (m_type_tag == expected_type_tag && m_class_tag == expected_class_tag);
  ------------------
  |  Branch (62:12): [True: 184k, False: 147k]
  |  Branch (62:47): [True: 180k, False: 4.36k]
  ------------------
   63|   332k|}
_ZNK5Botan10BER_Object4is_aEiNS_10ASN1_ClassE:
   65|   146k|bool BER_Object::is_a(int expected_type_tag, ASN1_Class expected_class_tag) const {
   66|   146k|   return is_a(ASN1_Type(expected_type_tag), expected_class_tag);
   67|   146k|}
_ZN5Botan10BER_Object11set_taggingENS_9ASN1_TypeENS_10ASN1_ClassE:
   69|   332k|void BER_Object::set_tagging(ASN1_Type type_tag, ASN1_Class class_tag) {
   70|   332k|   m_type_tag = type_tag;
   71|   332k|   m_class_tag = class_tag;
   72|   332k|}
_ZN5Botan20asn1_class_to_stringENS_10ASN1_ClassE:
   74|  7.19k|std::string asn1_class_to_string(ASN1_Class type) {
   75|  7.19k|   switch(type) {
   76|  2.17k|      case ASN1_Class::Universal:
  ------------------
  |  Branch (76:7): [True: 2.17k, False: 5.01k]
  ------------------
   77|  2.17k|         return "UNIVERSAL";
   78|  4.15k|      case ASN1_Class::Constructed:
  ------------------
  |  Branch (78:7): [True: 4.15k, False: 3.03k]
  ------------------
   79|  4.15k|         return "CONSTRUCTED";
   80|    155|      case ASN1_Class::ContextSpecific:
  ------------------
  |  Branch (80:7): [True: 155, False: 7.03k]
  ------------------
   81|    155|         return "CONTEXT_SPECIFIC";
   82|    148|      case ASN1_Class::Application:
  ------------------
  |  Branch (82:7): [True: 148, False: 7.04k]
  ------------------
   83|    148|         return "APPLICATION";
   84|    131|      case ASN1_Class::Private:
  ------------------
  |  Branch (84:7): [True: 131, False: 7.05k]
  ------------------
   85|    131|         return "PRIVATE";
   86|      0|      case ASN1_Class::NoObject:
  ------------------
  |  Branch (86:7): [True: 0, False: 7.19k]
  ------------------
   87|      0|         return "NO_OBJECT";
   88|    430|      default:
  ------------------
  |  Branch (88:7): [True: 430, False: 6.76k]
  ------------------
   89|    430|         return "CLASS(" + std::to_string(static_cast<size_t>(type)) + ")";
   90|  7.19k|   }
   91|  7.19k|}
_ZN5Botan18asn1_tag_to_stringENS_9ASN1_TypeE:
   93|  6.36k|std::string asn1_tag_to_string(ASN1_Type type) {
   94|  6.36k|   switch(type) {
   95|  2.65k|      case ASN1_Type::Sequence:
  ------------------
  |  Branch (95:7): [True: 2.65k, False: 3.71k]
  ------------------
   96|  2.65k|         return "SEQUENCE";
   97|       |
   98|    335|      case ASN1_Type::Set:
  ------------------
  |  Branch (98:7): [True: 335, False: 6.02k]
  ------------------
   99|    335|         return "SET";
  100|       |
  101|    159|      case ASN1_Type::PrintableString:
  ------------------
  |  Branch (101:7): [True: 159, False: 6.20k]
  ------------------
  102|    159|         return "PRINTABLE STRING";
  103|       |
  104|    106|      case ASN1_Type::NumericString:
  ------------------
  |  Branch (104:7): [True: 106, False: 6.25k]
  ------------------
  105|    106|         return "NUMERIC STRING";
  106|       |
  107|    136|      case ASN1_Type::Ia5String:
  ------------------
  |  Branch (107:7): [True: 136, False: 6.22k]
  ------------------
  108|    136|         return "IA5 STRING";
  109|       |
  110|    106|      case ASN1_Type::TeletexString:
  ------------------
  |  Branch (110:7): [True: 106, False: 6.25k]
  ------------------
  111|    106|         return "T61 STRING";
  112|       |
  113|     62|      case ASN1_Type::Utf8String:
  ------------------
  |  Branch (113:7): [True: 62, False: 6.30k]
  ------------------
  114|     62|         return "UTF8 STRING";
  115|       |
  116|    105|      case ASN1_Type::VisibleString:
  ------------------
  |  Branch (116:7): [True: 105, False: 6.25k]
  ------------------
  117|    105|         return "VISIBLE STRING";
  118|       |
  119|     21|      case ASN1_Type::BmpString:
  ------------------
  |  Branch (119:7): [True: 21, False: 6.34k]
  ------------------
  120|     21|         return "BMP STRING";
  121|       |
  122|     31|      case ASN1_Type::UniversalString:
  ------------------
  |  Branch (122:7): [True: 31, False: 6.33k]
  ------------------
  123|     31|         return "UNIVERSAL STRING";
  124|       |
  125|     58|      case ASN1_Type::UtcTime:
  ------------------
  |  Branch (125:7): [True: 58, False: 6.30k]
  ------------------
  126|     58|         return "UTC TIME";
  127|       |
  128|    112|      case ASN1_Type::GeneralizedTime:
  ------------------
  |  Branch (128:7): [True: 112, False: 6.25k]
  ------------------
  129|    112|         return "GENERALIZED TIME";
  130|       |
  131|    535|      case ASN1_Type::OctetString:
  ------------------
  |  Branch (131:7): [True: 535, False: 5.82k]
  ------------------
  132|    535|         return "OCTET STRING";
  133|       |
  134|    425|      case ASN1_Type::BitString:
  ------------------
  |  Branch (134:7): [True: 425, False: 5.93k]
  ------------------
  135|    425|         return "BIT STRING";
  136|       |
  137|    181|      case ASN1_Type::Enumerated:
  ------------------
  |  Branch (137:7): [True: 181, False: 6.18k]
  ------------------
  138|    181|         return "ENUMERATED";
  139|       |
  140|    510|      case ASN1_Type::Integer:
  ------------------
  |  Branch (140:7): [True: 510, False: 5.85k]
  ------------------
  141|    510|         return "INTEGER";
  142|       |
  143|     71|      case ASN1_Type::Null:
  ------------------
  |  Branch (143:7): [True: 71, False: 6.29k]
  ------------------
  144|     71|         return "NULL";
  145|       |
  146|     72|      case ASN1_Type::ObjectId:
  ------------------
  |  Branch (146:7): [True: 72, False: 6.29k]
  ------------------
  147|     72|         return "OBJECT";
  148|       |
  149|    127|      case ASN1_Type::Boolean:
  ------------------
  |  Branch (149:7): [True: 127, False: 6.23k]
  ------------------
  150|    127|         return "BOOLEAN";
  151|       |
  152|     11|      case ASN1_Type::NoObject:
  ------------------
  |  Branch (152:7): [True: 11, False: 6.35k]
  ------------------
  153|     11|         return "NO_OBJECT";
  154|       |
  155|    547|      default:
  ------------------
  |  Branch (155:7): [True: 547, False: 5.81k]
  ------------------
  156|    547|         return "TAG(" + std::to_string(static_cast<uint32_t>(type)) + ")";
  157|  6.36k|   }
  158|  6.36k|}
_ZN5Botan18BER_Decoding_ErrorC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
  163|  7.80k|BER_Decoding_Error::BER_Decoding_Error(std::string_view str) : Decoding_Error(fmt("BER: {}", str)) {}
_ZN5Botan11BER_Bad_TagC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEj:
  165|    346|BER_Bad_Tag::BER_Bad_Tag(std::string_view str, uint32_t tagging) : BER_Decoding_Error(fmt("{}: {}", str, tagging)) {}
_ZN5Botan4ASN115put_in_sequenceERKNSt3__16vectorIhNS1_9allocatorIhEEEE:
  172|  14.5k|std::vector<uint8_t> put_in_sequence(const std::vector<uint8_t>& contents) {
  173|  14.5k|   return ASN1::put_in_sequence(contents.data(), contents.size());
  174|  14.5k|}
_ZN5Botan4ASN115put_in_sequenceEPKhm:
  176|  14.5k|std::vector<uint8_t> put_in_sequence(const uint8_t bits[], size_t len) {
  177|  14.5k|   std::vector<uint8_t> output;
  178|  14.5k|   DER_Encoder(output).start_sequence().raw_bytes(bits, len).end_cons();
  179|  14.5k|   return output;
  180|  14.5k|}
_ZN5Botan4ASN19to_stringERKNS_10BER_ObjectE:
  185|  33.1k|std::string to_string(const BER_Object& obj) {
  186|  33.1k|   return std::string(cast_uint8_ptr_to_char(obj.bits()), obj.length());
  187|  33.1k|}
_ZN5Botan4ASN19maybe_BERERNS_10DataSourceE:
  192|  9.63k|bool maybe_BER(DataSource& source) {
  193|  9.63k|   uint8_t first_u8;
  194|  9.63k|   if(!source.peek_byte(first_u8)) {
  ------------------
  |  Branch (194:7): [True: 0, False: 9.63k]
  ------------------
  195|      0|      BOTAN_ASSERT_EQUAL(source.read_byte(first_u8), 0, "Expected EOF");
  ------------------
  |  |   69|      0|   do {                                                                                                \
  |  |   70|      0|      if((expr1) != (expr2))                                                                           \
  |  |  ------------------
  |  |  |  Branch (70:10): [True: 0, False: 0]
  |  |  ------------------
  |  |   71|      0|         Botan::assertion_failure(#expr1 " == " #expr2, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   72|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (72:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  196|      0|      throw Stream_IO_Error("ASN1::maybe_BER: Source was empty");
  197|      0|   }
  198|       |
  199|  9.63k|   const auto cons_seq = static_cast<uint8_t>(ASN1_Class::Constructed) | static_cast<uint8_t>(ASN1_Type::Sequence);
  200|  9.63k|   if(first_u8 == cons_seq) {
  ------------------
  |  Branch (200:7): [True: 9.32k, False: 304]
  ------------------
  201|  9.32k|      return true;
  202|  9.32k|   }
  203|    304|   return false;
  204|  9.63k|}

_ZN5Botan3OID11from_stringENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   74|    817|OID OID::from_string(std::string_view str) {
   75|    817|   if(str.empty()) {
  ------------------
  |  Branch (75:7): [True: 0, False: 817]
  ------------------
   76|      0|      throw Invalid_Argument("OID::from_string argument must be non-empty");
   77|      0|   }
   78|       |
   79|    817|   OID o = OID_Map::global_registry().str2oid(str);
   80|    817|   if(o.has_value()) {
  ------------------
  |  Branch (80:7): [True: 817, False: 0]
  ------------------
   81|    817|      return o;
   82|    817|   }
   83|       |
   84|      0|   std::vector<uint32_t> raw = parse_oid_str(str);
   85|       |
   86|      0|   if(!raw.empty()) {
  ------------------
  |  Branch (86:7): [True: 0, False: 0]
  ------------------
   87|      0|      return OID(std::move(raw));
   88|      0|   }
   89|       |
   90|      0|   throw Lookup_Error(fmt("No OID associated with name '{}'", str));
   91|      0|}
_ZN5Botan3OIDC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   96|   169k|OID::OID(std::string_view oid_str) {
   97|   169k|   if(!oid_str.empty()) {
  ------------------
  |  Branch (97:7): [True: 169k, False: 0]
  ------------------
   98|   169k|      m_id = parse_oid_str(oid_str);
   99|   169k|      if(m_id.size() < 2 || m_id[0] > 2 || (m_id[0] < 2 && m_id[1] > 39)) {
  ------------------
  |  Branch (99:10): [True: 0, False: 169k]
  |  Branch (99:29): [True: 0, False: 169k]
  |  Branch (99:45): [True: 9.93k, False: 159k]
  |  Branch (99:60): [True: 0, False: 9.93k]
  ------------------
  100|      0|         throw Decoding_Error(fmt("Invalid OID '{}'", oid_str));
  101|      0|      }
  102|   169k|   }
  103|   169k|}
_ZNK5Botan3OID9to_stringEv:
  108|  23.2k|std::string OID::to_string() const {
  109|  23.2k|   std::ostringstream out;
  110|  23.2k|   out << (*this);
  111|  23.2k|   return out.str();
  112|  23.2k|}
_ZNK5Botan3OID19to_formatted_stringEv:
  114|  7.47k|std::string OID::to_formatted_string() const {
  115|  7.47k|   std::string s = this->human_name_or_empty();
  116|  7.47k|   if(!s.empty()) {
  ------------------
  |  Branch (116:7): [True: 4.47k, False: 3.00k]
  ------------------
  117|  4.47k|      return s;
  118|  4.47k|   }
  119|  3.00k|   return this->to_string();
  120|  7.47k|}
_ZNK5Botan3OID19human_name_or_emptyEv:
  122|  7.47k|std::string OID::human_name_or_empty() const {
  123|  7.47k|   return OID_Map::global_registry().oid2str(*this);
  124|  7.47k|}
_ZN5BotanltERKNS_3OIDES2_:
  133|  78.1k|bool operator<(const OID& a, const OID& b) {
  134|  78.1k|   const std::vector<uint32_t>& oid1 = a.get_components();
  135|  78.1k|   const std::vector<uint32_t>& oid2 = b.get_components();
  136|       |
  137|  78.1k|   return std::lexicographical_compare(oid1.begin(), oid1.end(), oid2.begin(), oid2.end());
  138|  78.1k|}
_ZN5BotanlsERNSt3__113basic_ostreamIcNS0_11char_traitsIcEEEERKNS_3OIDE:
  140|  23.5k|std::ostream& operator<<(std::ostream& out, const OID& oid) {
  141|  23.5k|   const auto& val = oid.get_components();
  142|       |
  143|   150k|   for(size_t i = 0; i != val.size(); ++i) {
  ------------------
  |  Branch (143:22): [True: 127k, False: 23.5k]
  ------------------
  144|       |      // avoid locale issues with integer formatting
  145|   127k|      out << std::to_string(val[i]);
  146|   127k|      if(i != val.size() - 1) {
  ------------------
  |  Branch (146:10): [True: 103k, False: 23.5k]
  ------------------
  147|   103k|         out << ".";
  148|   103k|      }
  149|   127k|   }
  150|       |
  151|  23.5k|   return out;
  152|  23.5k|}
_ZNK5Botan3OID11encode_intoERNS_11DER_EncoderE:
  157|  3.60k|void OID::encode_into(DER_Encoder& der) const {
  158|  3.60k|   if(m_id.size() < 2) {
  ------------------
  |  Branch (158:7): [True: 0, False: 3.60k]
  ------------------
  159|      0|      throw Invalid_Argument("OID::encode_into: OID is invalid");
  160|      0|   }
  161|       |
  162|  3.60k|   std::vector<uint8_t> encoding;
  163|       |
  164|  3.60k|   if(m_id[0] > 2 || m_id[1] >= 40) {
  ------------------
  |  Branch (164:7): [True: 411, False: 3.18k]
  |  Branch (164:22): [True: 0, False: 3.18k]
  ------------------
  165|    411|      throw Encoding_Error("Invalid OID prefix, cannot encode");
  166|    411|   }
  167|       |
  168|  3.18k|   encoding.push_back(static_cast<uint8_t>(40 * m_id[0] + m_id[1]));
  169|       |
  170|  16.9k|   for(size_t i = 2; i != m_id.size(); ++i) {
  ------------------
  |  Branch (170:22): [True: 13.8k, False: 3.18k]
  ------------------
  171|  13.8k|      if(m_id[i] == 0) {
  ------------------
  |  Branch (171:10): [True: 223, False: 13.5k]
  ------------------
  172|    223|         encoding.push_back(0);
  173|  13.5k|      } else {
  174|  13.5k|         size_t blocks = high_bit(m_id[i]) + 6;
  175|  13.5k|         blocks = (blocks - (blocks % 7)) / 7;
  176|       |
  177|  13.5k|         BOTAN_ASSERT(blocks > 0, "Math works");
  ------------------
  |  |   51|  13.5k|   do {                                                                                 \
  |  |   52|  13.5k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 13.5k]
  |  |  ------------------
  |  |   53|  13.5k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  13.5k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  178|       |
  179|  20.3k|         for(size_t j = 0; j != blocks - 1; ++j) {
  ------------------
  |  Branch (179:28): [True: 6.75k, False: 13.5k]
  ------------------
  180|  6.75k|            encoding.push_back(0x80 | ((m_id[i] >> 7 * (blocks - j - 1)) & 0x7F));
  181|  6.75k|         }
  182|  13.5k|         encoding.push_back(m_id[i] & 0x7F);
  183|  13.5k|      }
  184|  13.8k|   }
  185|  3.18k|   der.add_object(ASN1_Type::ObjectId, ASN1_Class::Universal, encoding);
  186|  3.18k|}
_ZN5Botan3OID11decode_fromERNS_11BER_DecoderE:
  191|  51.4k|void OID::decode_from(BER_Decoder& decoder) {
  192|  51.4k|   BER_Object obj = decoder.get_next_object();
  193|  51.4k|   if(obj.tagging() != (ASN1_Class::Universal | ASN1_Type::ObjectId)) {
  ------------------
  |  Branch (193:7): [True: 289, False: 51.1k]
  ------------------
  194|    289|      throw BER_Bad_Tag("Error decoding OID, unknown tag", obj.tagging());
  195|    289|   }
  196|       |
  197|  51.1k|   const size_t length = obj.length();
  198|  51.1k|   const uint8_t* bits = obj.bits();
  199|       |
  200|  51.1k|   if(length < 2 && !(length == 1 && bits[0] == 0)) {
  ------------------
  |  Branch (200:7): [True: 2.26k, False: 48.9k]
  |  Branch (200:23): [True: 2.23k, False: 22]
  |  Branch (200:38): [True: 2.21k, False: 21]
  ------------------
  201|     43|      throw BER_Decoding_Error("OID encoding is too short");
  202|     43|   }
  203|       |
  204|  51.1k|   m_id.clear();
  205|  51.1k|   m_id.push_back(bits[0] / 40);
  206|  51.1k|   m_id.push_back(bits[0] % 40);
  207|       |
  208|  51.1k|   size_t i = 0;
  209|   268k|   while(i != length - 1) {
  ------------------
  |  Branch (209:10): [True: 217k, False: 51.0k]
  ------------------
  210|   217k|      uint32_t component = 0;
  211|   274k|      while(i != length - 1) {
  ------------------
  |  Branch (211:13): [True: 266k, False: 7.85k]
  ------------------
  212|   266k|         ++i;
  213|       |
  214|   266k|         if(component >> (32 - 7)) {
  ------------------
  |  Branch (214:13): [True: 50, False: 266k]
  ------------------
  215|     50|            throw Decoding_Error("OID component overflow");
  216|     50|         }
  217|       |
  218|   266k|         component = (component << 7) + (bits[i] & 0x7F);
  219|       |
  220|   266k|         if(!(bits[i] & 0x80)) {
  ------------------
  |  Branch (220:13): [True: 209k, False: 57.3k]
  ------------------
  221|   209k|            break;
  222|   209k|         }
  223|   266k|      }
  224|   217k|      m_id.push_back(component);
  225|   217k|   }
  226|  51.1k|}
asn1_oid.cpp:_ZN5Botan12_GLOBAL__N_113parse_oid_strENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   24|   169k|std::vector<uint32_t> parse_oid_str(std::string_view oid) {
   25|   169k|   try {
   26|   169k|      std::string elem;
   27|   169k|      std::vector<uint32_t> oid_elems;
   28|       |
   29|  1.60M|      for(char c : oid) {
  ------------------
  |  Branch (29:18): [True: 1.60M, False: 169k]
  ------------------
   30|  1.60M|         if(c == '.') {
  ------------------
  |  Branch (30:13): [True: 555k, False: 1.04M]
  ------------------
   31|   555k|            if(elem.empty()) {
  ------------------
  |  Branch (31:16): [True: 0, False: 555k]
  ------------------
   32|      0|               return std::vector<uint32_t>();
   33|      0|            }
   34|   555k|            oid_elems.push_back(to_u32bit(elem));
   35|   555k|            elem.clear();
   36|  1.04M|         } else {
   37|  1.04M|            elem += c;
   38|  1.04M|         }
   39|  1.60M|      }
   40|       |
   41|   169k|      if(!elem.empty()) {
  ------------------
  |  Branch (41:10): [True: 169k, False: 0]
  ------------------
   42|   169k|         oid_elems.push_back(to_u32bit(elem));
   43|   169k|      }
   44|       |
   45|   169k|      return oid_elems;
   46|   169k|   } catch(Invalid_Argument&)  // thrown by to_u32bit
   47|   169k|   {
   48|      0|      return std::vector<uint32_t>();
   49|      0|   }
   50|   169k|}

_ZN5Botan11ASN1_String14is_string_typeENS_9ASN1_TypeE:
   60|  2.12k|bool ASN1_String::is_string_type(ASN1_Type tag) {
   61|  2.12k|   return is_asn1_string_type(tag);
   62|  2.12k|}
_ZN5Botan11ASN1_StringC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEENS_9ASN1_TypeE:
   64|  16.0k|ASN1_String::ASN1_String(std::string_view str, ASN1_Type t) : m_utf8_str(str), m_tag(t) {
   65|  16.0k|   if(!is_utf8_subset_string_type(m_tag)) {
  ------------------
  |  Branch (65:7): [True: 6, False: 16.0k]
  ------------------
   66|      6|      throw Invalid_Argument("ASN1_String only supports encoding to UTF-8 or a UTF-8 subset");
   67|      6|   }
   68|  16.0k|}
_ZN5Botan11ASN1_StringC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   70|  14.5k|ASN1_String::ASN1_String(std::string_view str) : ASN1_String(str, choose_encoding(str)) {}
_ZN5Botan11ASN1_String11decode_fromERNS_11BER_DecoderE:
   88|  14.3k|void ASN1_String::decode_from(BER_Decoder& source) {
   89|  14.3k|   BER_Object obj = source.get_next_object();
   90|       |
   91|  14.3k|   if(!is_asn1_string_type(obj.type())) {
  ------------------
  |  Branch (91:7): [True: 121, False: 14.2k]
  ------------------
   92|    121|      auto typ = static_cast<uint32_t>(obj.type());
   93|    121|      throw Decoding_Error(fmt("ASN1_String: Unknown string type {}", typ));
   94|    121|   }
   95|       |
   96|  14.2k|   m_tag = obj.type();
   97|  14.2k|   m_data.assign(obj.bits(), obj.bits() + obj.length());
   98|       |
   99|  14.2k|   if(m_tag == ASN1_Type::BmpString) {
  ------------------
  |  Branch (99:7): [True: 749, False: 13.4k]
  ------------------
  100|    749|      m_utf8_str = ucs2_to_utf8(m_data.data(), m_data.size());
  101|  13.4k|   } else if(m_tag == ASN1_Type::UniversalString) {
  ------------------
  |  Branch (101:14): [True: 249, False: 13.2k]
  ------------------
  102|    249|      m_utf8_str = ucs4_to_utf8(m_data.data(), m_data.size());
  103|  13.2k|   } else if(m_tag == ASN1_Type::TeletexString) {
  ------------------
  |  Branch (103:14): [True: 1.11k, False: 12.1k]
  ------------------
  104|       |      /*
  105|       |      TeletexString is nominally ITU T.61 not ISO-8859-1 but it seems
  106|       |      the majority of implementations actually used that charset here.
  107|       |      */
  108|  1.11k|      m_utf8_str = latin1_to_utf8(m_data.data(), m_data.size());
  109|  12.1k|   } else {
  110|       |      // All other supported string types are UTF-8 or some subset thereof
  111|  12.1k|      m_utf8_str = ASN1::to_string(obj);
  112|  12.1k|   }
  113|  14.2k|}
asn1_str.cpp:_ZN5Botan12_GLOBAL__N_119is_asn1_string_typeENS_9ASN1_TypeE:
   52|  16.4k|bool is_asn1_string_type(ASN1_Type tag) {
   53|  16.4k|   return (is_utf8_subset_string_type(tag) || tag == ASN1_Type::TeletexString || tag == ASN1_Type::BmpString ||
  ------------------
  |  Branch (53:12): [True: 13.6k, False: 2.75k]
  |  Branch (53:47): [True: 1.19k, False: 1.56k]
  |  Branch (53:82): [True: 945, False: 619]
  ------------------
   54|  16.4k|           tag == ASN1_Type::UniversalString);
  ------------------
  |  Branch (54:12): [True: 251, False: 368]
  ------------------
   55|  16.4k|}
asn1_str.cpp:_ZN5Botan12_GLOBAL__N_126is_utf8_subset_string_typeENS_9ASN1_TypeE:
   47|  32.4k|bool is_utf8_subset_string_type(ASN1_Type tag) {
   48|  32.4k|   return (tag == ASN1_Type::NumericString || tag == ASN1_Type::PrintableString || tag == ASN1_Type::VisibleString ||
  ------------------
  |  Branch (48:12): [True: 2.32k, False: 30.1k]
  |  Branch (48:47): [True: 22.5k, False: 7.57k]
  |  Branch (48:84): [True: 1.47k, False: 6.10k]
  ------------------
   49|  32.4k|           tag == ASN1_Type::Ia5String || tag == ASN1_Type::Utf8String);
  ------------------
  |  Branch (49:12): [True: 2.03k, False: 4.06k]
  |  Branch (49:43): [True: 1.30k, False: 2.76k]
  ------------------
   50|  32.4k|}
asn1_str.cpp:_ZN5Botan12_GLOBAL__N_115choose_encodingENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   23|  14.5k|ASN1_Type choose_encoding(std::string_view str) {
   24|  14.5k|   auto all_printable = CT::Mask<uint8_t>::set();
   25|       |
   26|  14.5k|   for(size_t i = 0; i != str.size(); ++i) {
  ------------------
  |  Branch (26:22): [True: 0, False: 14.5k]
  ------------------
   27|      0|      const uint8_t c = static_cast<uint8_t>(str[i]);
   28|       |
   29|      0|      auto is_alpha_lower = CT::Mask<uint8_t>::is_within_range(c, 'a', 'z');
   30|      0|      auto is_alpha_upper = CT::Mask<uint8_t>::is_within_range(c, 'A', 'Z');
   31|      0|      auto is_decimal = CT::Mask<uint8_t>::is_within_range(c, '0', '9');
   32|       |
   33|      0|      auto is_print_punc = CT::Mask<uint8_t>::is_any_of(c, {' ', '(', ')', '+', ',', '-', '.', '/', ':', '=', '?'});
   34|       |
   35|      0|      auto is_printable = is_alpha_lower | is_alpha_upper | is_decimal | is_print_punc;
   36|       |
   37|      0|      all_printable &= is_printable;
   38|      0|   }
   39|       |
   40|  14.5k|   if(all_printable.as_bool()) {
  ------------------
  |  Branch (40:7): [True: 14.5k, False: 0]
  ------------------
   41|  14.5k|      return ASN1_Type::PrintableString;
   42|  14.5k|   } else {
   43|      0|      return ASN1_Type::Utf8String;
   44|      0|   }
   45|  14.5k|}

_ZN5Botan9ASN1_Time11decode_fromERNS_11BER_DecoderE:
   53|  9.46k|void ASN1_Time::decode_from(BER_Decoder& source) {
   54|  9.46k|   BER_Object ber_time = source.get_next_object();
   55|       |
   56|  9.46k|   set_to(ASN1::to_string(ber_time), ber_time.type());
   57|  9.46k|}
_ZN5Botan9ASN1_Time6set_toENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEENS_9ASN1_TypeE:
  157|  9.46k|void ASN1_Time::set_to(std::string_view t_spec, ASN1_Type spec_tag) {
  158|  9.46k|   BOTAN_ARG_CHECK(spec_tag == ASN1_Type::UtcTime || spec_tag == ASN1_Type::GeneralizedTime,
  ------------------
  |  |   30|  9.46k|   do {                                                          \
  |  |   31|  9.68k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:12): [True: 9.24k, False: 221]
  |  |  |  Branch (31:12): [True: 166, False: 55]
  |  |  ------------------
  |  |   32|  9.46k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  9.46k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  159|  9.46k|                   "Invalid tag for ASN1_Time");
  160|       |
  161|  9.46k|   if(spec_tag == ASN1_Type::GeneralizedTime) {
  ------------------
  |  Branch (161:7): [True: 166, False: 9.29k]
  ------------------
  162|    166|      BOTAN_ARG_CHECK(t_spec.size() == 15, "Invalid GeneralizedTime input string");
  ------------------
  |  |   30|    166|   do {                                                          \
  |  |   31|    166|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 11, False: 155]
  |  |  ------------------
  |  |   32|    166|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|    166|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  163|  9.29k|   } else if(spec_tag == ASN1_Type::UtcTime) {
  ------------------
  |  Branch (163:14): [True: 9.24k, False: 55]
  ------------------
  164|  9.24k|      BOTAN_ARG_CHECK(t_spec.size() == 13, "Invalid UTCTime input string");
  ------------------
  |  |   30|  9.24k|   do {                                                          \
  |  |   31|  9.24k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 15, False: 9.22k]
  |  |  ------------------
  |  |   32|  9.24k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  9.24k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  165|  9.24k|   }
  166|       |
  167|  9.46k|   BOTAN_ARG_CHECK(t_spec.back() == 'Z', "Botan does not support ASN1 times with timezones other than Z");
  ------------------
  |  |   30|  9.46k|   do {                                                          \
  |  |   31|  9.46k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 10, False: 9.45k]
  |  |  ------------------
  |  |   32|  9.46k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  9.46k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  168|       |
  169|  9.46k|   const size_t field_len = 2;
  170|       |
  171|  9.46k|   const size_t year_start = 0;
  172|  9.46k|   const size_t year_len = (spec_tag == ASN1_Type::UtcTime) ? 2 : 4;
  ------------------
  |  Branch (172:28): [True: 9.21k, False: 244]
  ------------------
  173|  9.46k|   const size_t month_start = year_start + year_len;
  174|  9.46k|   const size_t day_start = month_start + field_len;
  175|  9.46k|   const size_t hour_start = day_start + field_len;
  176|  9.46k|   const size_t min_start = hour_start + field_len;
  177|  9.46k|   const size_t sec_start = min_start + field_len;
  178|       |
  179|  9.46k|   m_year = to_u32bit(t_spec.substr(year_start, year_len));
  180|  9.46k|   m_month = to_u32bit(t_spec.substr(month_start, field_len));
  181|  9.46k|   m_day = to_u32bit(t_spec.substr(day_start, field_len));
  182|  9.46k|   m_hour = to_u32bit(t_spec.substr(hour_start, field_len));
  183|  9.46k|   m_minute = to_u32bit(t_spec.substr(min_start, field_len));
  184|  9.46k|   m_second = to_u32bit(t_spec.substr(sec_start, field_len));
  185|  9.46k|   m_tag = spec_tag;
  186|       |
  187|  9.46k|   if(spec_tag == ASN1_Type::UtcTime) {
  ------------------
  |  Branch (187:7): [True: 9.20k, False: 255]
  ------------------
  188|  9.20k|      if(m_year >= 50) {
  ------------------
  |  Branch (188:10): [True: 2.78k, False: 6.41k]
  ------------------
  189|  2.78k|         m_year += 1900;
  190|  6.41k|      } else {
  191|  6.41k|         m_year += 2000;
  192|  6.41k|      }
  193|  9.20k|   }
  194|       |
  195|  9.46k|   if(!passes_sanity_check()) {
  ------------------
  |  Branch (195:7): [True: 47, False: 9.41k]
  ------------------
  196|     47|      throw Invalid_Argument(fmt("ASN1_Time string '{}' does not seem to be valid", t_spec));
  197|     47|   }
  198|  9.46k|}
_ZNK5Botan9ASN1_Time19passes_sanity_checkEv:
  203|  9.35k|bool ASN1_Time::passes_sanity_check() const {
  204|       |   // AppVeyor's trust store includes a cert with expiration date in 3016 ...
  205|  9.35k|   if(m_year < 1950 || m_year > 3100) {
  ------------------
  |  Branch (205:7): [True: 9, False: 9.34k]
  |  Branch (205:24): [True: 5, False: 9.34k]
  ------------------
  206|     14|      return false;
  207|     14|   }
  208|  9.34k|   if(m_month == 0 || m_month > 12) {
  ------------------
  |  Branch (208:7): [True: 2, False: 9.34k]
  |  Branch (208:23): [True: 9, False: 9.33k]
  ------------------
  209|     11|      return false;
  210|     11|   }
  211|       |
  212|  9.33k|   const uint32_t days_in_month[12] = {31, 28 + 1, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31};
  213|       |
  214|  9.33k|   if(m_day == 0 || m_day > days_in_month[m_month - 1]) {
  ------------------
  |  Branch (214:7): [True: 2, False: 9.33k]
  |  Branch (214:21): [True: 8, False: 9.32k]
  ------------------
  215|     10|      return false;
  216|     10|   }
  217|       |
  218|  9.32k|   if(m_month == 2 && m_day == 29) {
  ------------------
  |  Branch (218:7): [True: 878, False: 8.44k]
  |  Branch (218:23): [True: 72, False: 806]
  ------------------
  219|     72|      if(m_year % 4 != 0) {
  ------------------
  |  Branch (219:10): [True: 2, False: 70]
  ------------------
  220|      2|         return false;  // not a leap year
  221|      2|      }
  222|       |
  223|     70|      if(m_year % 100 == 0 && m_year % 400 != 0) {
  ------------------
  |  Branch (223:10): [True: 5, False: 65]
  |  Branch (223:31): [True: 2, False: 3]
  ------------------
  224|      2|         return false;
  225|      2|      }
  226|     70|   }
  227|       |
  228|  9.31k|   if(m_hour >= 24 || m_minute >= 60 || m_second > 60) {
  ------------------
  |  Branch (228:7): [True: 2, False: 9.31k]
  |  Branch (228:23): [True: 1, False: 9.31k]
  |  Branch (228:41): [True: 4, False: 9.31k]
  ------------------
  229|      7|      return false;
  230|      7|   }
  231|       |
  232|  9.31k|   if(m_tag == ASN1_Type::UtcTime) {
  ------------------
  |  Branch (232:7): [True: 9.18k, False: 130]
  ------------------
  233|       |      /*
  234|       |      UTCTime limits the value of components such that leap seconds
  235|       |      are not covered. See "UNIVERSAL 23" in "Information technology
  236|       |      Abstract Syntax Notation One (ASN.1): Specification of basic notation"
  237|       |
  238|       |      http://www.itu.int/ITU-T/studygroups/com17/languages/
  239|       |      */
  240|  9.18k|      if(m_second > 59) {
  ------------------
  |  Branch (240:10): [True: 1, False: 9.18k]
  ------------------
  241|      1|         return false;
  242|      1|      }
  243|  9.18k|   }
  244|       |
  245|  9.31k|   return true;
  246|  9.31k|}

_ZNK5Botan11BER_Decoder10more_itemsEv:
  195|   104k|bool BER_Decoder::more_items() const {
  196|   104k|   if(m_source->end_of_data() && !m_pushed.is_set()) {
  ------------------
  |  Branch (196:7): [True: 26.9k, False: 77.6k]
  |  Branch (196:34): [True: 26.9k, False: 0]
  ------------------
  197|  26.9k|      return false;
  198|  26.9k|   }
  199|  77.6k|   return true;
  200|   104k|}
_ZN5Botan11BER_Decoder10verify_endEv:
  205|  8.15k|BER_Decoder& BER_Decoder::verify_end() {
  206|  8.15k|   return verify_end("BER_Decoder::verify_end called, but data remains");
  207|  8.15k|}
_ZN5Botan11BER_Decoder10verify_endENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
  212|  12.7k|BER_Decoder& BER_Decoder::verify_end(std::string_view err) {
  213|  12.7k|   if(!m_source->end_of_data() || m_pushed.is_set()) {
  ------------------
  |  Branch (213:7): [True: 66, False: 12.7k]
  |  Branch (213:35): [True: 0, False: 12.7k]
  ------------------
  214|     66|      throw Decoding_Error(err);
  215|     66|   }
  216|  12.7k|   return (*this);
  217|  12.7k|}
_ZN5Botan11BER_Decoder17discard_remainingEv:
  222|    269|BER_Decoder& BER_Decoder::discard_remaining() {
  223|    269|   uint8_t buf;
  224|  1.60k|   while(m_source->read_byte(buf)) {}
  ------------------
  |  Branch (224:10): [True: 1.33k, False: 269]
  ------------------
  225|    269|   return (*this);
  226|    269|}
_ZN5Botan11BER_Decoder15get_next_objectEv:
  231|   307k|BER_Object BER_Decoder::get_next_object() {
  232|   307k|   BER_Object next;
  233|       |
  234|   307k|   if(m_pushed.is_set()) {
  ------------------
  |  Branch (234:7): [True: 22.6k, False: 284k]
  ------------------
  235|  22.6k|      std::swap(next, m_pushed);
  236|  22.6k|      return next;
  237|  22.6k|   }
  238|       |
  239|   332k|   for(;;) {
  240|   332k|      ASN1_Type type_tag;
  241|   332k|      ASN1_Class class_tag;
  242|   332k|      decode_tag(m_source, type_tag, class_tag);
  243|   332k|      next.set_tagging(type_tag, class_tag);
  244|   332k|      if(next.is_set() == false) {  // no more objects
  ------------------
  |  Branch (244:10): [True: 11.6k, False: 320k]
  ------------------
  245|  11.6k|         return next;
  246|  11.6k|      }
  247|       |
  248|   320k|      size_t field_size;
  249|   320k|      const size_t length = decode_length(m_source, field_size, ALLOWED_EOC_NESTINGS);
  250|   320k|      if(!m_source->check_available(length)) {
  ------------------
  |  Branch (250:10): [True: 1.75k, False: 318k]
  ------------------
  251|  1.75k|         throw BER_Decoding_Error("Value truncated");
  252|  1.75k|      }
  253|       |
  254|   318k|      uint8_t* out = next.mutable_bits(length);
  255|   318k|      if(m_source->read(out, length) != length) {
  ------------------
  |  Branch (255:10): [True: 0, False: 318k]
  ------------------
  256|      0|         throw BER_Decoding_Error("Value truncated");
  257|      0|      }
  258|       |
  259|   318k|      if(next.tagging() == static_cast<uint32_t>(ASN1_Type::Eoc)) {
  ------------------
  |  Branch (259:10): [True: 47.8k, False: 271k]
  ------------------
  260|  47.8k|         continue;
  261|   271k|      } else {
  262|   271k|         break;
  263|   271k|      }
  264|   318k|   }
  265|       |
  266|   271k|   return next;
  267|   284k|}
_ZN5Botan11BER_Decoder9push_backERKNS_10BER_ObjectE:
  272|  2.38k|void BER_Decoder::push_back(const BER_Object& obj) {
  273|  2.38k|   if(m_pushed.is_set()) {
  ------------------
  |  Branch (273:7): [True: 0, False: 2.38k]
  ------------------
  274|      0|      throw Invalid_State("BER_Decoder: Only one push back is allowed");
  275|      0|   }
  276|  2.38k|   m_pushed = obj;
  277|  2.38k|}
_ZN5Botan11BER_Decoder9push_backEONS_10BER_ObjectE:
  279|  28.3k|void BER_Decoder::push_back(BER_Object&& obj) {
  280|  28.3k|   if(m_pushed.is_set()) {
  ------------------
  |  Branch (280:7): [True: 0, False: 28.3k]
  ------------------
  281|      0|      throw Invalid_State("BER_Decoder: Only one push back is allowed");
  282|      0|   }
  283|  28.3k|   m_pushed = std::move(obj);
  284|  28.3k|}
_ZN5Botan11BER_Decoder10start_consENS_9ASN1_TypeENS_10ASN1_ClassE:
  286|   109k|BER_Decoder BER_Decoder::start_cons(ASN1_Type type_tag, ASN1_Class class_tag) {
  287|   109k|   BER_Object obj = get_next_object();
  288|   109k|   obj.assert_is_a(type_tag, class_tag | ASN1_Class::Constructed);
  289|   109k|   return BER_Decoder(std::move(obj), this);
  290|   109k|}
_ZN5Botan11BER_Decoder8end_consEv:
  295|  80.7k|BER_Decoder& BER_Decoder::end_cons() {
  296|  80.7k|   if(!m_parent) {
  ------------------
  |  Branch (296:7): [True: 0, False: 80.7k]
  ------------------
  297|      0|      throw Invalid_State("BER_Decoder::end_cons called with null parent");
  298|      0|   }
  299|  80.7k|   if(!m_source->end_of_data()) {
  ------------------
  |  Branch (299:7): [True: 423, False: 80.3k]
  ------------------
  300|    423|      throw Decoding_Error("BER_Decoder::end_cons called with data left");
  301|    423|   }
  302|  80.3k|   return (*m_parent);
  303|  80.7k|}
_ZN5Botan11BER_DecoderC2EONS_10BER_ObjectEPS0_:
  305|   106k|BER_Decoder::BER_Decoder(BER_Object&& obj, BER_Decoder* parent) {
  306|   106k|   m_data_src = std::make_unique<DataSource_BERObject>(std::move(obj));
  307|   106k|   m_source = m_data_src.get();
  308|   106k|   m_parent = parent;
  309|   106k|}
_ZN5Botan11BER_DecoderC2ERNS_10DataSourceE:
  314|  9.32k|BER_Decoder::BER_Decoder(DataSource& src) {
  315|  9.32k|   m_source = &src;
  316|  9.32k|}
_ZN5Botan11BER_DecoderC2EPKhm:
  321|  13.4k|BER_Decoder::BER_Decoder(const uint8_t data[], size_t length) {
  322|  13.4k|   m_data_src = std::make_unique<DataSource_Memory>(data, length);
  323|  13.4k|   m_source = m_data_src.get();
  324|  13.4k|}
_ZN5Botan11BER_DecoderC2ERKNSt3__16vectorIhNS1_9allocatorIhEEEE:
  337|  29.2k|BER_Decoder::BER_Decoder(const std::vector<uint8_t>& data) {
  338|  29.2k|   m_data_src = std::make_unique<DataSource_Memory>(data.data(), data.size());
  339|  29.2k|   m_source = m_data_src.get();
  340|  29.2k|}
_ZN5Botan11BER_Decoder6decodeERNS_11ASN1_ObjectENS_9ASN1_TypeENS_10ASN1_ClassE:
  356|   112k|BER_Decoder& BER_Decoder::decode(ASN1_Object& obj, ASN1_Type /*unused*/, ASN1_Class /*unused*/) {
  357|   112k|   obj.decode_from(*this);
  358|   112k|   return (*this);
  359|   112k|}
_ZN5Botan11BER_Decoder26decode_octet_string_bigintERNS_6BigIntE:
  373|  1.22k|BER_Decoder& BER_Decoder::decode_octet_string_bigint(BigInt& out) {
  374|  1.22k|   secure_vector<uint8_t> out_vec;
  375|  1.22k|   decode(out_vec, ASN1_Type::OctetString);
  376|  1.22k|   out = BigInt::decode(out_vec.data(), out_vec.size());
  377|  1.22k|   return (*this);
  378|  1.22k|}
_ZN5Botan11BER_Decoder6decodeERbNS_9ASN1_TypeENS_10ASN1_ClassE:
  383|  2.71k|BER_Decoder& BER_Decoder::decode(bool& out, ASN1_Type type_tag, ASN1_Class class_tag) {
  384|  2.71k|   BER_Object obj = get_next_object();
  385|  2.71k|   obj.assert_is_a(type_tag, class_tag);
  386|       |
  387|  2.71k|   if(obj.length() != 1) {
  ------------------
  |  Branch (387:7): [True: 37, False: 2.67k]
  ------------------
  388|     37|      throw BER_Decoding_Error("BER boolean value had invalid size");
  389|     37|   }
  390|       |
  391|  2.67k|   out = (obj.bits()[0]) ? true : false;
  ------------------
  |  Branch (391:10): [True: 2.61k, False: 59]
  ------------------
  392|  2.67k|   return (*this);
  393|  2.71k|}
_ZN5Botan11BER_Decoder6decodeERmNS_9ASN1_TypeENS_10ASN1_ClassE:
  398|  3.24k|BER_Decoder& BER_Decoder::decode(size_t& out, ASN1_Type type_tag, ASN1_Class class_tag) {
  399|  3.24k|   BigInt integer;
  400|  3.24k|   decode(integer, type_tag, class_tag);
  401|       |
  402|  3.24k|   if(integer.is_negative()) {
  ------------------
  |  Branch (402:7): [True: 22, False: 3.21k]
  ------------------
  403|     22|      throw BER_Decoding_Error("Decoded small integer value was negative");
  404|     22|   }
  405|       |
  406|  3.21k|   if(integer.bits() > 32) {
  ------------------
  |  Branch (406:7): [True: 141, False: 3.07k]
  ------------------
  407|    141|      throw BER_Decoding_Error("Decoded integer value larger than expected");
  408|    141|   }
  409|       |
  410|  3.07k|   out = 0;
  411|  13.1k|   for(size_t i = 0; i != 4; ++i) {
  ------------------
  |  Branch (411:22): [True: 10.0k, False: 3.07k]
  ------------------
  412|  10.0k|      out = (out << 8) | integer.byte_at(3 - i);
  413|  10.0k|   }
  414|       |
  415|  3.07k|   return (*this);
  416|  3.21k|}
_ZN5Botan11BER_Decoder6decodeERNS_6BigIntENS_9ASN1_TypeENS_10ASN1_ClassE:
  444|  12.5k|BER_Decoder& BER_Decoder::decode(BigInt& out, ASN1_Type type_tag, ASN1_Class class_tag) {
  445|  12.5k|   BER_Object obj = get_next_object();
  446|  12.5k|   obj.assert_is_a(type_tag, class_tag);
  447|       |
  448|  12.5k|   if(obj.length() == 0) {
  ------------------
  |  Branch (448:7): [True: 1.47k, False: 11.0k]
  ------------------
  449|  1.47k|      out.clear();
  450|  11.0k|   } else {
  451|  11.0k|      const bool negative = (obj.bits()[0] & 0x80) ? true : false;
  ------------------
  |  Branch (451:29): [True: 1.62k, False: 9.47k]
  ------------------
  452|       |
  453|  11.0k|      if(negative) {
  ------------------
  |  Branch (453:10): [True: 1.62k, False: 9.47k]
  ------------------
  454|  1.62k|         secure_vector<uint8_t> vec(obj.bits(), obj.bits() + obj.length());
  455|  2.61k|         for(size_t i = obj.length(); i > 0; --i) {
  ------------------
  |  Branch (455:39): [True: 2.61k, False: 0]
  ------------------
  456|  2.61k|            if(vec[i - 1]--) {
  ------------------
  |  Branch (456:16): [True: 1.62k, False: 995]
  ------------------
  457|  1.62k|               break;
  458|  1.62k|            }
  459|  2.61k|         }
  460|  13.8k|         for(size_t i = 0; i != obj.length(); ++i) {
  ------------------
  |  Branch (460:28): [True: 12.1k, False: 1.62k]
  ------------------
  461|  12.1k|            vec[i] = ~vec[i];
  462|  12.1k|         }
  463|  1.62k|         out = BigInt(vec.data(), vec.size());
  464|  1.62k|         out.flip_sign();
  465|  9.47k|      } else {
  466|  9.47k|         out = BigInt(obj.bits(), obj.length());
  467|  9.47k|      }
  468|  11.0k|   }
  469|       |
  470|  12.5k|   return (*this);
  471|  12.5k|}
_ZN5Botan11BER_Decoder6decodeERNSt3__16vectorIhNS_16secure_allocatorIhEEEENS_9ASN1_TypeES7_NS_10ASN1_ClassE:
  509|  1.31k|                                 ASN1_Class class_tag) {
  510|  1.31k|   if(real_type != ASN1_Type::OctetString && real_type != ASN1_Type::BitString) {
  ------------------
  |  Branch (510:7): [True: 0, False: 1.31k]
  |  Branch (510:46): [True: 0, False: 0]
  ------------------
  511|      0|      throw BER_Bad_Tag("Bad tag for {BIT,OCTET} STRING", static_cast<uint32_t>(real_type));
  512|      0|   }
  513|       |
  514|  1.31k|   asn1_decode_binary_string(buffer, get_next_object(), real_type, type_tag, class_tag);
  515|  1.31k|   return (*this);
  516|  1.31k|}
_ZN5Botan11BER_Decoder6decodeERNSt3__16vectorIhNS1_9allocatorIhEEEENS_9ASN1_TypeES7_NS_10ASN1_ClassE:
  521|  27.1k|                                 ASN1_Class class_tag) {
  522|  27.1k|   if(real_type != ASN1_Type::OctetString && real_type != ASN1_Type::BitString) {
  ------------------
  |  Branch (522:7): [True: 13.2k, False: 13.8k]
  |  Branch (522:46): [True: 0, False: 13.2k]
  ------------------
  523|      0|      throw BER_Bad_Tag("Bad tag for {BIT,OCTET} STRING", static_cast<uint32_t>(real_type));
  524|      0|   }
  525|       |
  526|  27.1k|   asn1_decode_binary_string(buffer, get_next_object(), real_type, type_tag, class_tag);
  527|  27.1k|   return (*this);
  528|  27.1k|}
ber_dec.cpp:_ZN5Botan12_GLOBAL__N_110decode_tagEPNS_10DataSourceERNS_9ASN1_TypeERNS_10ASN1_ClassE:
   29|   399k|size_t decode_tag(DataSource* ber, ASN1_Type& type_tag, ASN1_Class& class_tag) {
   30|   399k|   uint8_t b;
   31|   399k|   if(!ber->read_byte(b)) {
  ------------------
  |  Branch (31:7): [True: 19.7k, False: 379k]
  ------------------
   32|  19.7k|      type_tag = ASN1_Type::NoObject;
   33|  19.7k|      class_tag = ASN1_Class::NoObject;
   34|  19.7k|      return 0;
   35|  19.7k|   }
   36|       |
   37|   379k|   if((b & 0x1F) != 0x1F) {
  ------------------
  |  Branch (37:7): [True: 376k, False: 3.44k]
  ------------------
   38|   376k|      type_tag = ASN1_Type(b & 0x1F);
   39|   376k|      class_tag = ASN1_Class(b & 0xE0);
   40|   376k|      return 1;
   41|   376k|   }
   42|       |
   43|  3.44k|   size_t tag_bytes = 1;
   44|  3.44k|   class_tag = ASN1_Class(b & 0xE0);
   45|       |
   46|  3.44k|   size_t tag_buf = 0;
   47|  8.22k|   while(true) {
  ------------------
  |  Branch (47:10): [Folded - Ignored]
  ------------------
   48|  8.22k|      if(!ber->read_byte(b)) {
  ------------------
  |  Branch (48:10): [True: 114, False: 8.11k]
  ------------------
   49|    114|         throw BER_Decoding_Error("Long-form tag truncated");
   50|    114|      }
   51|  8.11k|      if(tag_buf & 0xFF000000) {
  ------------------
  |  Branch (51:10): [True: 109, False: 8.00k]
  ------------------
   52|    109|         throw BER_Decoding_Error("Long-form tag overflowed 32 bits");
   53|    109|      }
   54|  8.00k|      ++tag_bytes;
   55|  8.00k|      tag_buf = (tag_buf << 7) | (b & 0x7F);
   56|  8.00k|      if((b & 0x80) == 0) {
  ------------------
  |  Branch (56:10): [True: 3.22k, False: 4.78k]
  ------------------
   57|  3.22k|         break;
   58|  3.22k|      }
   59|  8.00k|   }
   60|  3.22k|   type_tag = ASN1_Type(tag_buf);
   61|  3.22k|   return tag_bytes;
   62|  3.44k|}
ber_dec.cpp:_ZN5Botan12_GLOBAL__N_113decode_lengthEPNS_10DataSourceERmm:
   72|   379k|size_t decode_length(DataSource* ber, size_t& field_size, size_t allow_indef) {
   73|   379k|   uint8_t b;
   74|   379k|   if(!ber->read_byte(b)) {
  ------------------
  |  Branch (74:7): [True: 354, False: 379k]
  ------------------
   75|    354|      throw BER_Decoding_Error("Length field not found");
   76|    354|   }
   77|   379k|   field_size = 1;
   78|   379k|   if((b & 0x80) == 0) {
  ------------------
  |  Branch (78:7): [True: 335k, False: 43.3k]
  ------------------
   79|   335k|      return b;
   80|   335k|   }
   81|       |
   82|  43.3k|   field_size += (b & 0x7F);
   83|  43.3k|   if(field_size > 5) {
  ------------------
  |  Branch (83:7): [True: 783, False: 42.5k]
  ------------------
   84|    783|      throw BER_Decoding_Error("Length field is too large");
   85|    783|   }
   86|       |
   87|  42.5k|   if(field_size == 1) {
  ------------------
  |  Branch (87:7): [True: 14.4k, False: 28.1k]
  ------------------
   88|  14.4k|      if(allow_indef == 0) {
  ------------------
  |  Branch (88:10): [True: 12, False: 14.4k]
  ------------------
   89|     12|         throw BER_Decoding_Error("Nested EOC markers too deep, rejecting to avoid stack exhaustion");
   90|  14.4k|      } else {
   91|  14.4k|         return find_eoc(ber, allow_indef - 1);
   92|  14.4k|      }
   93|  14.4k|   }
   94|       |
   95|  28.1k|   size_t length = 0;
   96|       |
   97|  73.1k|   for(size_t i = 0; i != field_size - 1; ++i) {
  ------------------
  |  Branch (97:22): [True: 45.0k, False: 28.0k]
  ------------------
   98|  45.0k|      if(get_byte<0>(length) != 0) {
  ------------------
  |  Branch (98:10): [True: 0, False: 45.0k]
  ------------------
   99|      0|         throw BER_Decoding_Error("Field length overflow");
  100|      0|      }
  101|  45.0k|      if(!ber->read_byte(b)) {
  ------------------
  |  Branch (101:10): [True: 54, False: 45.0k]
  ------------------
  102|     54|         throw BER_Decoding_Error("Corrupted length field");
  103|     54|      }
  104|  45.0k|      length = (length << 8) | b;
  105|  45.0k|   }
  106|  28.0k|   return length;
  107|  28.1k|}
ber_dec.cpp:_ZN5Botan12_GLOBAL__N_18find_eocEPNS_10DataSourceEm:
  112|  14.4k|size_t find_eoc(DataSource* ber, size_t allow_indef) {
  113|  14.4k|   secure_vector<uint8_t> buffer(BOTAN_DEFAULT_BUFFER_SIZE), data;
  ------------------
  |  |  388|  14.4k|#define BOTAN_DEFAULT_BUFFER_SIZE 4096
  ------------------
  114|       |
  115|  29.2k|   while(true) {
  ------------------
  |  Branch (115:10): [Folded - Ignored]
  ------------------
  116|  29.2k|      const size_t got = ber->peek(buffer.data(), buffer.size(), data.size());
  117|  29.2k|      if(got == 0) {
  ------------------
  |  Branch (117:10): [True: 14.4k, False: 14.7k]
  ------------------
  118|  14.4k|         break;
  119|  14.4k|      }
  120|       |
  121|  14.7k|      data += std::make_pair(buffer.data(), got);
  122|  14.7k|   }
  123|       |
  124|  14.4k|   DataSource_Memory source(data);
  125|  14.4k|   data.clear();
  126|       |
  127|  14.4k|   size_t length = 0;
  128|  67.9k|   while(true) {
  ------------------
  |  Branch (128:10): [Folded - Ignored]
  ------------------
  129|  67.3k|      ASN1_Type type_tag;
  130|  67.3k|      ASN1_Class class_tag;
  131|  67.3k|      size_t tag_size = decode_tag(&source, type_tag, class_tag);
  132|  67.3k|      if(type_tag == ASN1_Type::NoObject) {
  ------------------
  |  Branch (132:10): [True: 8.28k, False: 59.0k]
  ------------------
  133|  8.28k|         break;
  134|  8.28k|      }
  135|       |
  136|  59.0k|      size_t length_size = 0;
  137|  59.0k|      size_t item_size = decode_length(&source, length_size, allow_indef);
  138|  59.0k|      source.discard_next(item_size);
  139|       |
  140|  59.0k|      length = BOTAN_CHECKED_ADD(length, item_size);
  ------------------
  |  |   73|  59.0k|#define BOTAN_CHECKED_ADD(x, y) checked_add(x, y, __FILE__, __LINE__)
  ------------------
  141|  59.0k|      length = BOTAN_CHECKED_ADD(length, tag_size);
  ------------------
  |  |   73|  59.0k|#define BOTAN_CHECKED_ADD(x, y) checked_add(x, y, __FILE__, __LINE__)
  ------------------
  142|  59.0k|      length = BOTAN_CHECKED_ADD(length, length_size);
  ------------------
  |  |   73|  59.0k|#define BOTAN_CHECKED_ADD(x, y) checked_add(x, y, __FILE__, __LINE__)
  ------------------
  143|       |
  144|  59.0k|      if(type_tag == ASN1_Type::Eoc && class_tag == ASN1_Class::Universal) {
  ------------------
  |  Branch (144:10): [True: 7.39k, False: 51.6k]
  |  Branch (144:40): [True: 5.57k, False: 1.81k]
  ------------------
  145|  5.57k|         break;
  146|  5.57k|      }
  147|  59.0k|   }
  148|  14.4k|   return length;
  149|  14.4k|}
ber_dec.cpp:_ZN5Botan12_GLOBAL__N_120DataSource_BERObjectC2EONS_10BER_ObjectE:
  183|   106k|      explicit DataSource_BERObject(BER_Object&& obj) : m_obj(std::move(obj)), m_offset(0) {}
ber_dec.cpp:_ZN5Botan12_GLOBAL__N_120DataSource_BERObject4readEPhm:
  153|  4.31M|      size_t read(uint8_t out[], size_t length) override {
  154|  4.31M|         BOTAN_ASSERT_NOMSG(m_offset <= m_obj.length());
  ------------------
  |  |   60|  4.31M|   do {                                                                     \
  |  |   61|  4.31M|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 4.31M]
  |  |  ------------------
  |  |   62|  4.31M|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  4.31M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  155|  4.31M|         const size_t got = std::min<size_t>(m_obj.length() - m_offset, length);
  156|  4.31M|         copy_mem(out, m_obj.bits() + m_offset, got);
  157|  4.31M|         m_offset += got;
  158|  4.31M|         return got;
  159|  4.31M|      }
ber_dec.cpp:_ZN5Botan12_GLOBAL__N_120DataSource_BERObject15check_availableEm:
  174|   221k|      bool check_available(size_t n) override {
  175|   221k|         BOTAN_ASSERT_NOMSG(m_offset <= m_obj.length());
  ------------------
  |  |   60|   221k|   do {                                                                     \
  |  |   61|   221k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 221k]
  |  |  ------------------
  |  |   62|   221k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|   221k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  176|   221k|         return (n <= (m_obj.length() - m_offset));
  177|   221k|      }
ber_dec.cpp:_ZNK5Botan12_GLOBAL__N_120DataSource_BERObject4peekEPhmm:
  161|  5.41k|      size_t peek(uint8_t out[], size_t length, size_t peek_offset) const override {
  162|  5.41k|         BOTAN_ASSERT_NOMSG(m_offset <= m_obj.length());
  ------------------
  |  |   60|  5.41k|   do {                                                                     \
  |  |   61|  5.41k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 5.41k]
  |  |  ------------------
  |  |   62|  5.41k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  5.41k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  163|  5.41k|         const size_t bytes_left = m_obj.length() - m_offset;
  164|       |
  165|  5.41k|         if(peek_offset >= bytes_left) {
  ------------------
  |  Branch (165:13): [True: 2.70k, False: 2.71k]
  ------------------
  166|  2.70k|            return 0;
  167|  2.70k|         }
  168|       |
  169|  2.71k|         const size_t got = std::min(bytes_left - peek_offset, length);
  170|  2.71k|         copy_mem(out, m_obj.bits() + m_offset + peek_offset, got);
  171|  2.71k|         return got;
  172|  5.41k|      }
ber_dec.cpp:_ZNK5Botan12_GLOBAL__N_120DataSource_BERObject11end_of_dataEv:
  179|   159k|      bool end_of_data() const override { return get_bytes_read() == m_obj.length(); }
ber_dec.cpp:_ZNK5Botan12_GLOBAL__N_120DataSource_BERObject14get_bytes_readEv:
  181|   159k|      size_t get_bytes_read() const override { return m_offset; }
ber_dec.cpp:_ZN5Botan12_GLOBAL__N_125asn1_decode_binary_stringINS_16secure_allocatorIhEEEEvRNSt3__16vectorIhT_EERKNS_10BER_ObjectENS_9ASN1_TypeESC_NS_10ASN1_ClassE:
  480|  1.31k|                               ASN1_Class class_tag) {
  481|  1.31k|   obj.assert_is_a(type_tag, class_tag);
  482|       |
  483|  1.31k|   if(real_type == ASN1_Type::OctetString) {
  ------------------
  |  Branch (483:7): [True: 1.31k, False: 3]
  ------------------
  484|  1.31k|      buffer.assign(obj.bits(), obj.bits() + obj.length());
  485|  1.31k|   } else {
  486|      3|      if(obj.length() == 0) {
  ------------------
  |  Branch (486:10): [True: 0, False: 3]
  ------------------
  487|      0|         throw BER_Decoding_Error("Invalid BIT STRING");
  488|      0|      }
  489|      3|      if(obj.bits()[0] >= 8) {
  ------------------
  |  Branch (489:10): [True: 0, False: 3]
  ------------------
  490|      0|         throw BER_Decoding_Error("Bad number of unused bits in BIT STRING");
  491|      0|      }
  492|       |
  493|      3|      buffer.resize(obj.length() - 1);
  494|       |
  495|      3|      if(obj.length() > 1) {
  ------------------
  |  Branch (495:10): [True: 0, False: 3]
  ------------------
  496|      0|         copy_mem(buffer.data(), obj.bits() + 1, obj.length() - 1);
  497|      0|      }
  498|      3|   }
  499|  1.31k|}
ber_dec.cpp:_ZN5Botan12_GLOBAL__N_125asn1_decode_binary_stringINSt3__19allocatorIhEEEEvRNS2_6vectorIhT_EERKNS_10BER_ObjectENS_9ASN1_TypeESC_NS_10ASN1_ClassE:
  480|  27.0k|                               ASN1_Class class_tag) {
  481|  27.0k|   obj.assert_is_a(type_tag, class_tag);
  482|       |
  483|  27.0k|   if(real_type == ASN1_Type::OctetString) {
  ------------------
  |  Branch (483:7): [True: 13.5k, False: 13.5k]
  ------------------
  484|  13.5k|      buffer.assign(obj.bits(), obj.bits() + obj.length());
  485|  13.5k|   } else {
  486|  13.5k|      if(obj.length() == 0) {
  ------------------
  |  Branch (486:10): [True: 3, False: 13.5k]
  ------------------
  487|      3|         throw BER_Decoding_Error("Invalid BIT STRING");
  488|      3|      }
  489|  13.5k|      if(obj.bits()[0] >= 8) {
  ------------------
  |  Branch (489:10): [True: 5, False: 13.5k]
  ------------------
  490|      5|         throw BER_Decoding_Error("Bad number of unused bits in BIT STRING");
  491|      5|      }
  492|       |
  493|  13.5k|      buffer.resize(obj.length() - 1);
  494|       |
  495|  13.5k|      if(obj.length() > 1) {
  ------------------
  |  Branch (495:10): [True: 9.30k, False: 4.24k]
  ------------------
  496|  9.30k|         copy_mem(buffer.data(), obj.bits() + 1, obj.length() - 1);
  497|  9.30k|      }
  498|  13.5k|   }
  499|  27.0k|}

_ZN5Botan11DER_EncoderC2ERNSt3__16vectorIhNS1_9allocatorIhEEEE:
   71|  18.3k|DER_Encoder::DER_Encoder(std::vector<uint8_t>& vec) {
   72|  18.3k|   m_append_output = [&vec](const uint8_t b[], size_t l) { vec.insert(vec.end(), b, b + l); };
   73|  18.3k|}
_ZN5Botan11DER_Encoder12DER_Sequence13push_contentsERS0_:
   78|  24.6k|void DER_Encoder::DER_Sequence::push_contents(DER_Encoder& der) {
   79|  24.6k|   const auto real_class_tag = m_class_tag | ASN1_Class::Constructed;
   80|       |
   81|  24.6k|   if(m_type_tag == ASN1_Type::Set) {
  ------------------
  |  Branch (81:7): [True: 0, False: 24.6k]
  ------------------
   82|      0|      std::sort(m_set_contents.begin(), m_set_contents.end());
   83|      0|      for(const auto& set_elem : m_set_contents) {
  ------------------
  |  Branch (83:32): [True: 0, False: 0]
  ------------------
   84|      0|         m_contents += set_elem;
   85|      0|      }
   86|      0|      m_set_contents.clear();
   87|      0|   }
   88|       |
   89|  24.6k|   der.add_object(m_type_tag, real_class_tag, m_contents.data(), m_contents.size());
   90|  24.6k|   m_contents.clear();
   91|  24.6k|}
_ZN5Botan11DER_Encoder12DER_Sequence9add_bytesEPKhm:
   96|  21.2k|void DER_Encoder::DER_Sequence::add_bytes(const uint8_t data[], size_t length) {
   97|  21.2k|   if(m_type_tag == ASN1_Type::Set) {
  ------------------
  |  Branch (97:7): [True: 0, False: 21.2k]
  ------------------
   98|      0|      m_set_contents.push_back(secure_vector<uint8_t>(data, data + length));
   99|  21.2k|   } else {
  100|  21.2k|      m_contents += std::make_pair(data, length);
  101|  21.2k|   }
  102|  21.2k|}
_ZN5Botan11DER_Encoder12DER_Sequence9add_bytesEPKhmS3_m:
  104|  13.4k|void DER_Encoder::DER_Sequence::add_bytes(const uint8_t hdr[], size_t hdr_len, const uint8_t val[], size_t val_len) {
  105|  13.4k|   if(m_type_tag == ASN1_Type::Set) {
  ------------------
  |  Branch (105:7): [True: 0, False: 13.4k]
  ------------------
  106|      0|      secure_vector<uint8_t> m;
  107|      0|      m.reserve(hdr_len + val_len);
  108|      0|      m += std::make_pair(hdr, hdr_len);
  109|      0|      m += std::make_pair(val, val_len);
  110|      0|      m_set_contents.push_back(std::move(m));
  111|  13.4k|   } else {
  112|  13.4k|      m_contents += std::make_pair(hdr, hdr_len);
  113|  13.4k|      m_contents += std::make_pair(val, val_len);
  114|  13.4k|   }
  115|  13.4k|}
_ZN5Botan11DER_Encoder12DER_SequenceC2ENS_9ASN1_TypeENS_10ASN1_ClassE:
  127|  25.4k|DER_Encoder::DER_Sequence::DER_Sequence(ASN1_Type t1, ASN1_Class t2) : m_type_tag(t1), m_class_tag(t2) {}
_ZN5Botan11DER_Encoder10start_consENS_9ASN1_TypeENS_10ASN1_ClassE:
  163|  25.4k|DER_Encoder& DER_Encoder::start_cons(ASN1_Type type_tag, ASN1_Class class_tag) {
  164|  25.4k|   m_subsequences.push_back(DER_Sequence(type_tag, class_tag));
  165|  25.4k|   return (*this);
  166|  25.4k|}
_ZN5Botan11DER_Encoder8end_consEv:
  171|  24.6k|DER_Encoder& DER_Encoder::end_cons() {
  172|  24.6k|   if(m_subsequences.empty()) {
  ------------------
  |  Branch (172:7): [True: 0, False: 24.6k]
  ------------------
  173|      0|      throw Invalid_State("DER_Encoder::end_cons: No such sequence");
  174|      0|   }
  175|       |
  176|  24.6k|   DER_Sequence last_seq = std::move(m_subsequences[m_subsequences.size() - 1]);
  177|  24.6k|   m_subsequences.pop_back();
  178|  24.6k|   last_seq.push_contents(*this);
  179|       |
  180|  24.6k|   return (*this);
  181|  24.6k|}
_ZN5Botan11DER_Encoder9raw_bytesEPKhm:
  207|  21.2k|DER_Encoder& DER_Encoder::raw_bytes(const uint8_t bytes[], size_t length) {
  208|  21.2k|   if(!m_subsequences.empty()) {
  ------------------
  |  Branch (208:7): [True: 21.2k, False: 0]
  ------------------
  209|  21.2k|      m_subsequences[m_subsequences.size() - 1].add_bytes(bytes, length);
  210|  21.2k|   } else if(m_append_output) {
  ------------------
  |  Branch (210:14): [True: 0, False: 0]
  ------------------
  211|      0|      m_append_output(bytes, length);
  212|      0|   } else {
  213|      0|      m_default_outbuf += std::make_pair(bytes, length);
  214|      0|   }
  215|       |
  216|  21.2k|   return (*this);
  217|  21.2k|}
_ZN5Botan11DER_Encoder10add_objectENS_9ASN1_TypeENS_10ASN1_ClassEPKhm:
  222|  31.4k|DER_Encoder& DER_Encoder::add_object(ASN1_Type type_tag, ASN1_Class class_tag, const uint8_t rep[], size_t length) {
  223|  31.4k|   std::vector<uint8_t> hdr;
  224|  31.4k|   encode_tag(hdr, type_tag, class_tag);
  225|  31.4k|   encode_length(hdr, length);
  226|       |
  227|  31.4k|   if(!m_subsequences.empty()) {
  ------------------
  |  Branch (227:7): [True: 13.4k, False: 17.9k]
  ------------------
  228|  13.4k|      m_subsequences[m_subsequences.size() - 1].add_bytes(hdr.data(), hdr.size(), rep, length);
  229|  17.9k|   } else if(m_append_output) {
  ------------------
  |  Branch (229:14): [True: 17.9k, False: 0]
  ------------------
  230|  17.9k|      m_append_output(hdr.data(), hdr.size());
  231|  17.9k|      m_append_output(rep, length);
  232|  17.9k|   } else {
  233|      0|      m_default_outbuf += hdr;
  234|      0|      m_default_outbuf += std::make_pair(rep, length);
  235|      0|   }
  236|       |
  237|  31.4k|   return (*this);
  238|  31.4k|}
_ZN5Botan11DER_Encoder6encodeERKNS_6BigIntE:
  264|    450|DER_Encoder& DER_Encoder::encode(const BigInt& n) {
  265|    450|   return encode(n, ASN1_Type::Integer, ASN1_Class::Universal);
  266|    450|}
_ZN5Botan11DER_Encoder6encodeEPKhmNS_9ASN1_TypeE:
  271|  3.13k|DER_Encoder& DER_Encoder::encode(const uint8_t bytes[], size_t length, ASN1_Type real_type) {
  272|  3.13k|   return encode(bytes, length, real_type, real_type, ASN1_Class::Universal);
  273|  3.13k|}
_ZN5Botan11DER_Encoder6encodeERKNS_6BigIntENS_9ASN1_TypeENS_10ASN1_ClassE:
  293|    450|DER_Encoder& DER_Encoder::encode(const BigInt& n, ASN1_Type type_tag, ASN1_Class class_tag) {
  294|    450|   if(n == 0) {
  ------------------
  |  Branch (294:7): [True: 6, False: 444]
  ------------------
  295|      6|      return add_object(type_tag, class_tag, 0);
  296|      6|   }
  297|       |
  298|    444|   const size_t extra_zero = (n.bits() % 8 == 0) ? 1 : 0;
  ------------------
  |  Branch (298:30): [True: 12, False: 432]
  ------------------
  299|    444|   secure_vector<uint8_t> contents(extra_zero + n.bytes());
  300|    444|   n.binary_encode(&contents[extra_zero]);
  301|    444|   if(n < 0) {
  ------------------
  |  Branch (301:7): [True: 0, False: 444]
  ------------------
  302|      0|      for(unsigned char& content : contents) {
  ------------------
  |  Branch (302:34): [True: 0, False: 0]
  ------------------
  303|      0|         content = ~content;
  304|      0|      }
  305|      0|      for(size_t i = contents.size(); i > 0; --i) {
  ------------------
  |  Branch (305:39): [True: 0, False: 0]
  ------------------
  306|      0|         if(++contents[i - 1]) {
  ------------------
  |  Branch (306:13): [True: 0, False: 0]
  ------------------
  307|      0|            break;
  308|      0|         }
  309|      0|      }
  310|      0|   }
  311|       |
  312|    444|   return add_object(type_tag, class_tag, contents);
  313|    450|}
_ZN5Botan11DER_Encoder6encodeEPKhmNS_9ASN1_TypeES3_NS_10ASN1_ClassE:
  319|  3.13k|   const uint8_t bytes[], size_t length, ASN1_Type real_type, ASN1_Type type_tag, ASN1_Class class_tag) {
  320|  3.13k|   if(real_type != ASN1_Type::OctetString && real_type != ASN1_Type::BitString) {
  ------------------
  |  Branch (320:7): [True: 3.13k, False: 0]
  |  Branch (320:46): [True: 0, False: 3.13k]
  ------------------
  321|      0|      throw Invalid_Argument("DER_Encoder: Invalid tag for byte/bit string");
  322|      0|   }
  323|       |
  324|  3.13k|   if(real_type == ASN1_Type::BitString) {
  ------------------
  |  Branch (324:7): [True: 3.13k, False: 0]
  ------------------
  325|  3.13k|      secure_vector<uint8_t> encoded;
  326|  3.13k|      encoded.push_back(0);
  327|  3.13k|      encoded += std::make_pair(bytes, length);
  328|  3.13k|      return add_object(type_tag, class_tag, encoded);
  329|  3.13k|   } else {
  330|      0|      return add_object(type_tag, class_tag, bytes, length);
  331|      0|   }
  332|  3.13k|}
_ZN5Botan11DER_Encoder6encodeERKNS_11ASN1_ObjectE:
  334|  7.14k|DER_Encoder& DER_Encoder::encode(const ASN1_Object& obj) {
  335|  7.14k|   obj.encode_into(*this);
  336|  7.14k|   return (*this);
  337|  7.14k|}
_ZN5Botan11DER_Encoder10add_objectENS_9ASN1_TypeENS_10ASN1_ClassEh:
  351|      6|DER_Encoder& DER_Encoder::add_object(ASN1_Type type_tag, ASN1_Class class_tag, uint8_t rep) {
  352|      6|   return add_object(type_tag, class_tag, &rep, 1);
  353|      6|}
der_enc.cpp:_ZN5Botan12_GLOBAL__N_110encode_tagERNSt3__16vectorIhNS1_9allocatorIhEEEENS_9ASN1_TypeENS_10ASN1_ClassE:
   24|  31.4k|void encode_tag(std::vector<uint8_t>& encoded_tag, ASN1_Type type_tag_e, ASN1_Class class_tag_e) {
   25|  31.4k|   const uint32_t type_tag = static_cast<uint32_t>(type_tag_e);
   26|  31.4k|   const uint32_t class_tag = static_cast<uint32_t>(class_tag_e);
   27|       |
   28|  31.4k|   if((class_tag | 0xE0) != 0xE0) {
  ------------------
  |  Branch (28:7): [True: 0, False: 31.4k]
  ------------------
   29|      0|      throw Encoding_Error(fmt("DER_Encoder: Invalid class tag {}", std::to_string(class_tag)));
   30|      0|   }
   31|       |
   32|  31.4k|   if(type_tag <= 30) {
  ------------------
  |  Branch (32:7): [True: 31.4k, False: 0]
  ------------------
   33|  31.4k|      encoded_tag.push_back(static_cast<uint8_t>(type_tag | class_tag));
   34|  31.4k|   } else {
   35|      0|      size_t blocks = high_bit(static_cast<uint32_t>(type_tag)) + 6;
   36|      0|      blocks = (blocks - (blocks % 7)) / 7;
   37|       |
   38|      0|      BOTAN_ASSERT_NOMSG(blocks > 0);
  ------------------
  |  |   60|      0|   do {                                                                     \
  |  |   61|      0|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 0]
  |  |  ------------------
  |  |   62|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   39|       |
   40|      0|      encoded_tag.push_back(static_cast<uint8_t>(class_tag | 0x1F));
   41|      0|      for(size_t i = 0; i != blocks - 1; ++i) {
  ------------------
  |  Branch (41:25): [True: 0, False: 0]
  ------------------
   42|      0|         encoded_tag.push_back(0x80 | ((type_tag >> 7 * (blocks - i - 1)) & 0x7F));
   43|      0|      }
   44|      0|      encoded_tag.push_back(type_tag & 0x7F);
   45|      0|   }
   46|  31.4k|}
der_enc.cpp:_ZN5Botan12_GLOBAL__N_113encode_lengthERNSt3__16vectorIhNS1_9allocatorIhEEEEm:
   51|  31.4k|void encode_length(std::vector<uint8_t>& encoded_length, size_t length) {
   52|  31.4k|   if(length <= 127) {
  ------------------
  |  Branch (52:7): [True: 22.2k, False: 9.14k]
  ------------------
   53|  22.2k|      encoded_length.push_back(static_cast<uint8_t>(length));
   54|  22.2k|   } else {
   55|  9.14k|      const size_t bytes_needed = significant_bytes(length);
   56|       |
   57|  9.14k|      encoded_length.push_back(static_cast<uint8_t>(0x80 | bytes_needed));
   58|       |
   59|  23.2k|      for(size_t i = sizeof(length) - bytes_needed; i < sizeof(length); ++i) {
  ------------------
  |  Branch (59:53): [True: 14.1k, False: 9.14k]
  ------------------
   60|  14.1k|         encoded_length.push_back(get_byte_var(i, length));
   61|  14.1k|      }
   62|  9.14k|   }
   63|  31.4k|}
der_enc.cpp:_ZZN5Botan11DER_EncoderC1ERNSt3__16vectorIhNS1_9allocatorIhEEEEENK3$_1clEPKhm:
   72|  35.9k|   m_append_output = [&vec](const uint8_t b[], size_t l) { vec.insert(vec.end(), b, b + l); };

_ZN5Botan7OID_MapC2Ev:
   11|      1|OID_Map::OID_Map() {
   12|      1|   m_str2oid = OID_Map::load_str2oid_map();
   13|      1|   m_oid2str = OID_Map::load_oid2str_map();
   14|      1|}
_ZN5Botan7OID_Map15global_registryEv:
   16|  8.29k|OID_Map& OID_Map::global_registry() {
   17|  8.29k|   static OID_Map g_map;
   18|  8.29k|   return g_map;
   19|  8.29k|}
_ZN5Botan7OID_Map7oid2strERKNS_3OIDE:
   56|  7.47k|std::string OID_Map::oid2str(const OID& oid) {
   57|  7.47k|   const std::string oid_str = oid.to_string();
   58|       |
   59|  7.47k|   lock_guard_type<mutex_type> lock(m_mutex);
   60|       |
   61|  7.47k|   auto i = m_oid2str.find(oid_str);
   62|  7.47k|   if(i != m_oid2str.end()) {
  ------------------
  |  Branch (62:7): [True: 4.47k, False: 3.00k]
  ------------------
   63|  4.47k|      return i->second;
   64|  4.47k|   }
   65|       |
   66|  3.00k|   return "";
   67|  7.47k|}
_ZN5Botan7OID_Map7str2oidENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   69|    817|OID OID_Map::str2oid(std::string_view str) {
   70|    817|   lock_guard_type<mutex_type> lock(m_mutex);
   71|    817|   auto i = m_str2oid.find(std::string(str));
   72|    817|   if(i != m_str2oid.end()) {
  ------------------
  |  Branch (72:7): [True: 817, False: 0]
  ------------------
   73|    817|      return i->second;
   74|    817|   }
   75|       |
   76|      0|   return OID();
   77|    817|}

_ZN5Botan7OID_Map16load_oid2str_mapEv:
   17|      1|std::unordered_map<std::string, std::string> OID_Map::load_oid2str_map() {
   18|      1|   return std::unordered_map<std::string, std::string>{
   19|       |
   20|      1|      {"0.3.4401.5.3.1.9.26", "Camellia-192/GCM"},
   21|      1|      {"0.3.4401.5.3.1.9.46", "Camellia-256/GCM"},
   22|      1|      {"0.3.4401.5.3.1.9.6", "Camellia-128/GCM"},
   23|      1|      {"0.4.0.127.0.15.1.1.13.0", "XMSS"},
   24|      1|      {"1.0.14888.3.0.5", "ECKCDSA"},
   25|      1|      {"1.2.156.10197.1.104.100", "SM4/OCB"},
   26|      1|      {"1.2.156.10197.1.104.2", "SM4/CBC"},
   27|      1|      {"1.2.156.10197.1.104.8", "SM4/GCM"},
   28|      1|      {"1.2.156.10197.1.301", "sm2p256v1"},
   29|      1|      {"1.2.156.10197.1.301.1", "SM2"},
   30|      1|      {"1.2.156.10197.1.301.2", "SM2_Kex"},
   31|      1|      {"1.2.156.10197.1.301.3", "SM2_Enc"},
   32|      1|      {"1.2.156.10197.1.401", "SM3"},
   33|      1|      {"1.2.156.10197.1.501", "SM2_Sig/SM3"},
   34|      1|      {"1.2.156.10197.1.504", "RSA/EMSA3(SM3)"},
   35|      1|      {"1.2.250.1.223.101.256.1", "frp256v1"},
   36|      1|      {"1.2.392.200011.61.1.1.1.2", "Camellia-128/CBC"},
   37|      1|      {"1.2.392.200011.61.1.1.1.3", "Camellia-192/CBC"},
   38|      1|      {"1.2.392.200011.61.1.1.1.4", "Camellia-256/CBC"},
   39|      1|      {"1.2.410.200004.1.100.4.3", "ECKCDSA/SHA-1"},
   40|      1|      {"1.2.410.200004.1.100.4.4", "ECKCDSA/SHA-224"},
   41|      1|      {"1.2.410.200004.1.100.4.5", "ECKCDSA/SHA-256"},
   42|      1|      {"1.2.410.200004.1.4", "SEED/CBC"},
   43|      1|      {"1.2.643.100.1", "GOST.OGRN"},
   44|      1|      {"1.2.643.100.111", "GOST.SubjectSigningTool"},
   45|      1|      {"1.2.643.100.112", "GOST.IssuerSigningTool"},
   46|      1|      {"1.2.643.2.2.19", "GOST-34.10"},
   47|      1|      {"1.2.643.2.2.3", "GOST-34.10/GOST-R-34.11-94"},
   48|      1|      {"1.2.643.2.2.35.1", "gost_256A"},
   49|      1|      {"1.2.643.2.2.36.0", "gost_256A"},
   50|      1|      {"1.2.643.3.131.1.1", "GOST.INN"},
   51|      1|      {"1.2.643.7.1.1.1.1", "GOST-34.10-2012-256"},
   52|      1|      {"1.2.643.7.1.1.1.2", "GOST-34.10-2012-512"},
   53|      1|      {"1.2.643.7.1.1.2.2", "Streebog-256"},
   54|      1|      {"1.2.643.7.1.1.2.3", "Streebog-512"},
   55|      1|      {"1.2.643.7.1.1.3.2", "GOST-34.10-2012-256/Streebog-256"},
   56|      1|      {"1.2.643.7.1.1.3.3", "GOST-34.10-2012-512/Streebog-512"},
   57|      1|      {"1.2.643.7.1.2.1.1.1", "gost_256A"},
   58|      1|      {"1.2.643.7.1.2.1.1.2", "gost_256B"},
   59|      1|      {"1.2.643.7.1.2.1.2.1", "gost_512A"},
   60|      1|      {"1.2.643.7.1.2.1.2.2", "gost_512B"},
   61|      1|      {"1.2.840.10040.4.1", "DSA"},
   62|      1|      {"1.2.840.10040.4.3", "DSA/SHA-1"},
   63|      1|      {"1.2.840.10045.2.1", "ECDSA"},
   64|      1|      {"1.2.840.10045.3.1.1", "secp192r1"},
   65|      1|      {"1.2.840.10045.3.1.2", "x962_p192v2"},
   66|      1|      {"1.2.840.10045.3.1.3", "x962_p192v3"},
   67|      1|      {"1.2.840.10045.3.1.4", "x962_p239v1"},
   68|      1|      {"1.2.840.10045.3.1.5", "x962_p239v2"},
   69|      1|      {"1.2.840.10045.3.1.6", "x962_p239v3"},
   70|      1|      {"1.2.840.10045.3.1.7", "secp256r1"},
   71|      1|      {"1.2.840.10045.4.1", "ECDSA/SHA-1"},
   72|      1|      {"1.2.840.10045.4.3.1", "ECDSA/SHA-224"},
   73|      1|      {"1.2.840.10045.4.3.2", "ECDSA/SHA-256"},
   74|      1|      {"1.2.840.10045.4.3.3", "ECDSA/SHA-384"},
   75|      1|      {"1.2.840.10045.4.3.4", "ECDSA/SHA-512"},
   76|      1|      {"1.2.840.10046.2.1", "DH"},
   77|      1|      {"1.2.840.113533.7.66.10", "CAST-128/CBC"},
   78|      1|      {"1.2.840.113533.7.66.15", "KeyWrap.CAST-128"},
   79|      1|      {"1.2.840.113549.1.1.1", "RSA"},
   80|      1|      {"1.2.840.113549.1.1.10", "RSA/EMSA4"},
   81|      1|      {"1.2.840.113549.1.1.11", "RSA/EMSA3(SHA-256)"},
   82|      1|      {"1.2.840.113549.1.1.12", "RSA/EMSA3(SHA-384)"},
   83|      1|      {"1.2.840.113549.1.1.13", "RSA/EMSA3(SHA-512)"},
   84|      1|      {"1.2.840.113549.1.1.14", "RSA/EMSA3(SHA-224)"},
   85|      1|      {"1.2.840.113549.1.1.16", "RSA/EMSA3(SHA-512-256)"},
   86|      1|      {"1.2.840.113549.1.1.4", "RSA/EMSA3(MD5)"},
   87|      1|      {"1.2.840.113549.1.1.5", "RSA/EMSA3(SHA-1)"},
   88|      1|      {"1.2.840.113549.1.1.7", "RSA/OAEP"},
   89|      1|      {"1.2.840.113549.1.1.8", "MGF1"},
   90|      1|      {"1.2.840.113549.1.5.12", "PKCS5.PBKDF2"},
   91|      1|      {"1.2.840.113549.1.5.13", "PBE-PKCS5v20"},
   92|      1|      {"1.2.840.113549.1.9.1", "PKCS9.EmailAddress"},
   93|      1|      {"1.2.840.113549.1.9.14", "PKCS9.ExtensionRequest"},
   94|      1|      {"1.2.840.113549.1.9.16.3.18", "ChaCha20Poly1305"},
   95|      1|      {"1.2.840.113549.1.9.16.3.6", "KeyWrap.TripleDES"},
   96|      1|      {"1.2.840.113549.1.9.16.3.8", "Compression.Zlib"},
   97|      1|      {"1.2.840.113549.1.9.2", "PKCS9.UnstructuredName"},
   98|      1|      {"1.2.840.113549.1.9.3", "PKCS9.ContentType"},
   99|      1|      {"1.2.840.113549.1.9.4", "PKCS9.MessageDigest"},
  100|      1|      {"1.2.840.113549.1.9.7", "PKCS9.ChallengePassword"},
  101|      1|      {"1.2.840.113549.2.10", "HMAC(SHA-384)"},
  102|      1|      {"1.2.840.113549.2.11", "HMAC(SHA-512)"},
  103|      1|      {"1.2.840.113549.2.13", "HMAC(SHA-512-256)"},
  104|      1|      {"1.2.840.113549.2.5", "MD5"},
  105|      1|      {"1.2.840.113549.2.7", "HMAC(SHA-1)"},
  106|      1|      {"1.2.840.113549.2.8", "HMAC(SHA-224)"},
  107|      1|      {"1.2.840.113549.2.9", "HMAC(SHA-256)"},
  108|      1|      {"1.2.840.113549.3.7", "TripleDES/CBC"},
  109|      1|      {"1.3.101.110", "Curve25519"},
  110|      1|      {"1.3.101.112", "Ed25519"},
  111|      1|      {"1.3.132.0.10", "secp256k1"},
  112|      1|      {"1.3.132.0.30", "secp160r2"},
  113|      1|      {"1.3.132.0.31", "secp192k1"},
  114|      1|      {"1.3.132.0.32", "secp224k1"},
  115|      1|      {"1.3.132.0.33", "secp224r1"},
  116|      1|      {"1.3.132.0.34", "secp384r1"},
  117|      1|      {"1.3.132.0.35", "secp521r1"},
  118|      1|      {"1.3.132.0.8", "secp160r1"},
  119|      1|      {"1.3.132.0.9", "secp160k1"},
  120|      1|      {"1.3.132.1.12", "ECDH"},
  121|      1|      {"1.3.14.3.2.26", "SHA-1"},
  122|      1|      {"1.3.14.3.2.7", "DES/CBC"},
  123|      1|      {"1.3.36.3.2.1", "RIPEMD-160"},
  124|      1|      {"1.3.36.3.3.1.2", "RSA/EMSA3(RIPEMD-160)"},
  125|      1|      {"1.3.36.3.3.2.5.2.1", "ECGDSA"},
  126|      1|      {"1.3.36.3.3.2.5.4.1", "ECGDSA/RIPEMD-160"},
  127|      1|      {"1.3.36.3.3.2.5.4.2", "ECGDSA/SHA-1"},
  128|      1|      {"1.3.36.3.3.2.5.4.3", "ECGDSA/SHA-224"},
  129|      1|      {"1.3.36.3.3.2.5.4.4", "ECGDSA/SHA-256"},
  130|      1|      {"1.3.36.3.3.2.5.4.5", "ECGDSA/SHA-384"},
  131|      1|      {"1.3.36.3.3.2.5.4.6", "ECGDSA/SHA-512"},
  132|      1|      {"1.3.36.3.3.2.8.1.1.1", "brainpool160r1"},
  133|      1|      {"1.3.36.3.3.2.8.1.1.11", "brainpool384r1"},
  134|      1|      {"1.3.36.3.3.2.8.1.1.13", "brainpool512r1"},
  135|      1|      {"1.3.36.3.3.2.8.1.1.3", "brainpool192r1"},
  136|      1|      {"1.3.36.3.3.2.8.1.1.5", "brainpool224r1"},
  137|      1|      {"1.3.36.3.3.2.8.1.1.7", "brainpool256r1"},
  138|      1|      {"1.3.36.3.3.2.8.1.1.9", "brainpool320r1"},
  139|      1|      {"1.3.6.1.4.1.11591.15.1", "OpenPGP.Ed25519"},
  140|      1|      {"1.3.6.1.4.1.11591.4.11", "Scrypt"},
  141|      1|      {"1.3.6.1.4.1.25258.1.10.1", "Dilithium-4x4-AES-r3"},
  142|      1|      {"1.3.6.1.4.1.25258.1.10.2", "Dilithium-6x5-AES-r3"},
  143|      1|      {"1.3.6.1.4.1.25258.1.10.3", "Dilithium-8x7-AES-r3"},
  144|      1|      {"1.3.6.1.4.1.25258.1.11.1", "Kyber-512-90s-r3"},
  145|      1|      {"1.3.6.1.4.1.25258.1.11.2", "Kyber-768-90s-r3"},
  146|      1|      {"1.3.6.1.4.1.25258.1.11.3", "Kyber-1024-90s-r3"},
  147|      1|      {"1.3.6.1.4.1.25258.1.12.1.1", "SphincsPlus-shake-128s-r3.1"},
  148|      1|      {"1.3.6.1.4.1.25258.1.12.1.2", "SphincsPlus-shake-128f-r3.1"},
  149|      1|      {"1.3.6.1.4.1.25258.1.12.1.3", "SphincsPlus-shake-192s-r3.1"},
  150|      1|      {"1.3.6.1.4.1.25258.1.12.1.4", "SphincsPlus-shake-192f-r3.1"},
  151|      1|      {"1.3.6.1.4.1.25258.1.12.1.5", "SphincsPlus-shake-256s-r3.1"},
  152|      1|      {"1.3.6.1.4.1.25258.1.12.1.6", "SphincsPlus-shake-256f-r3.1"},
  153|      1|      {"1.3.6.1.4.1.25258.1.12.2.1", "SphincsPlus-sha2-128s-r3.1"},
  154|      1|      {"1.3.6.1.4.1.25258.1.12.2.2", "SphincsPlus-sha2-128f-r3.1"},
  155|      1|      {"1.3.6.1.4.1.25258.1.12.2.3", "SphincsPlus-sha2-192s-r3.1"},
  156|      1|      {"1.3.6.1.4.1.25258.1.12.2.4", "SphincsPlus-sha2-192f-r3.1"},
  157|      1|      {"1.3.6.1.4.1.25258.1.12.2.5", "SphincsPlus-sha2-256s-r3.1"},
  158|      1|      {"1.3.6.1.4.1.25258.1.12.2.6", "SphincsPlus-sha2-256f-r3.1"},
  159|      1|      {"1.3.6.1.4.1.25258.1.12.3.1", "SphincsPlus-haraka-128s-r3.1"},
  160|      1|      {"1.3.6.1.4.1.25258.1.12.3.2", "SphincsPlus-haraka-128f-r3.1"},
  161|      1|      {"1.3.6.1.4.1.25258.1.12.3.3", "SphincsPlus-haraka-192s-r3.1"},
  162|      1|      {"1.3.6.1.4.1.25258.1.12.3.4", "SphincsPlus-haraka-192f-r3.1"},
  163|      1|      {"1.3.6.1.4.1.25258.1.12.3.5", "SphincsPlus-haraka-256s-r3.1"},
  164|      1|      {"1.3.6.1.4.1.25258.1.12.3.6", "SphincsPlus-haraka-256f-r3.1"},
  165|      1|      {"1.3.6.1.4.1.25258.1.14.1", "FrodoKEM-640-SHAKE"},
  166|      1|      {"1.3.6.1.4.1.25258.1.14.2", "FrodoKEM-976-SHAKE"},
  167|      1|      {"1.3.6.1.4.1.25258.1.14.3", "FrodoKEM-1344-SHAKE"},
  168|      1|      {"1.3.6.1.4.1.25258.1.15.1", "FrodoKEM-640-AES"},
  169|      1|      {"1.3.6.1.4.1.25258.1.15.2", "FrodoKEM-976-AES"},
  170|      1|      {"1.3.6.1.4.1.25258.1.15.3", "FrodoKEM-1344-AES"},
  171|      1|      {"1.3.6.1.4.1.25258.1.16.1", "eFrodoKEM-640-SHAKE"},
  172|      1|      {"1.3.6.1.4.1.25258.1.16.2", "eFrodoKEM-976-SHAKE"},
  173|      1|      {"1.3.6.1.4.1.25258.1.16.3", "eFrodoKEM-1344-SHAKE"},
  174|      1|      {"1.3.6.1.4.1.25258.1.17.1", "eFrodoKEM-640-AES"},
  175|      1|      {"1.3.6.1.4.1.25258.1.17.2", "eFrodoKEM-976-AES"},
  176|      1|      {"1.3.6.1.4.1.25258.1.17.3", "eFrodoKEM-1344-AES"},
  177|      1|      {"1.3.6.1.4.1.25258.1.3", "McEliece"},
  178|      1|      {"1.3.6.1.4.1.25258.1.5", "XMSS-draft6"},
  179|      1|      {"1.3.6.1.4.1.25258.1.6.1", "GOST-34.10-2012-256/SHA-256"},
  180|      1|      {"1.3.6.1.4.1.25258.1.7.1", "Kyber-512-r3"},
  181|      1|      {"1.3.6.1.4.1.25258.1.7.2", "Kyber-768-r3"},
  182|      1|      {"1.3.6.1.4.1.25258.1.7.3", "Kyber-1024-r3"},
  183|      1|      {"1.3.6.1.4.1.25258.1.8", "XMSS-draft12"},
  184|      1|      {"1.3.6.1.4.1.25258.1.9.1", "Dilithium-4x4-r3"},
  185|      1|      {"1.3.6.1.4.1.25258.1.9.2", "Dilithium-6x5-r3"},
  186|      1|      {"1.3.6.1.4.1.25258.1.9.3", "Dilithium-8x7-r3"},
  187|      1|      {"1.3.6.1.4.1.25258.3.1", "Serpent/CBC"},
  188|      1|      {"1.3.6.1.4.1.25258.3.101", "Serpent/GCM"},
  189|      1|      {"1.3.6.1.4.1.25258.3.102", "Twofish/GCM"},
  190|      1|      {"1.3.6.1.4.1.25258.3.2", "Threefish-512/CBC"},
  191|      1|      {"1.3.6.1.4.1.25258.3.2.1", "AES-128/OCB"},
  192|      1|      {"1.3.6.1.4.1.25258.3.2.2", "AES-192/OCB"},
  193|      1|      {"1.3.6.1.4.1.25258.3.2.3", "AES-256/OCB"},
  194|      1|      {"1.3.6.1.4.1.25258.3.2.4", "Serpent/OCB"},
  195|      1|      {"1.3.6.1.4.1.25258.3.2.5", "Twofish/OCB"},
  196|      1|      {"1.3.6.1.4.1.25258.3.2.6", "Camellia-128/OCB"},
  197|      1|      {"1.3.6.1.4.1.25258.3.2.7", "Camellia-192/OCB"},
  198|      1|      {"1.3.6.1.4.1.25258.3.2.8", "Camellia-256/OCB"},
  199|      1|      {"1.3.6.1.4.1.25258.3.3", "Twofish/CBC"},
  200|      1|      {"1.3.6.1.4.1.25258.3.4.1", "AES-128/SIV"},
  201|      1|      {"1.3.6.1.4.1.25258.3.4.2", "AES-192/SIV"},
  202|      1|      {"1.3.6.1.4.1.25258.3.4.3", "AES-256/SIV"},
  203|      1|      {"1.3.6.1.4.1.25258.3.4.4", "Serpent/SIV"},
  204|      1|      {"1.3.6.1.4.1.25258.3.4.5", "Twofish/SIV"},
  205|      1|      {"1.3.6.1.4.1.25258.3.4.6", "Camellia-128/SIV"},
  206|      1|      {"1.3.6.1.4.1.25258.3.4.7", "Camellia-192/SIV"},
  207|      1|      {"1.3.6.1.4.1.25258.3.4.8", "Camellia-256/SIV"},
  208|      1|      {"1.3.6.1.4.1.25258.3.4.9", "SM4/SIV"},
  209|      1|      {"1.3.6.1.4.1.3029.1.2.1", "ElGamal"},
  210|      1|      {"1.3.6.1.4.1.3029.1.5.1", "OpenPGP.Curve25519"},
  211|      1|      {"1.3.6.1.4.1.311.20.2.2", "Microsoft SmartcardLogon"},
  212|      1|      {"1.3.6.1.4.1.311.20.2.3", "Microsoft UPN"},
  213|      1|      {"1.3.6.1.4.1.8301.3.1.2.9.0.38", "secp521r1"},
  214|      1|      {"1.3.6.1.5.5.7.1.1", "PKIX.AuthorityInformationAccess"},
  215|      1|      {"1.3.6.1.5.5.7.3.1", "PKIX.ServerAuth"},
  216|      1|      {"1.3.6.1.5.5.7.3.2", "PKIX.ClientAuth"},
  217|      1|      {"1.3.6.1.5.5.7.3.3", "PKIX.CodeSigning"},
  218|      1|      {"1.3.6.1.5.5.7.3.4", "PKIX.EmailProtection"},
  219|      1|      {"1.3.6.1.5.5.7.3.5", "PKIX.IPsecEndSystem"},
  220|      1|      {"1.3.6.1.5.5.7.3.6", "PKIX.IPsecTunnel"},
  221|      1|      {"1.3.6.1.5.5.7.3.7", "PKIX.IPsecUser"},
  222|      1|      {"1.3.6.1.5.5.7.3.8", "PKIX.TimeStamping"},
  223|      1|      {"1.3.6.1.5.5.7.3.9", "PKIX.OCSPSigning"},
  224|      1|      {"1.3.6.1.5.5.7.48.1", "PKIX.OCSP"},
  225|      1|      {"1.3.6.1.5.5.7.48.1.1", "PKIX.OCSP.BasicResponse"},
  226|      1|      {"1.3.6.1.5.5.7.48.1.5", "PKIX.OCSP.NoCheck"},
  227|      1|      {"1.3.6.1.5.5.7.48.2", "PKIX.CertificateAuthorityIssuers"},
  228|      1|      {"1.3.6.1.5.5.7.8.5", "PKIX.XMPPAddr"},
  229|      1|      {"2.16.840.1.101.3.4.1.2", "AES-128/CBC"},
  230|      1|      {"2.16.840.1.101.3.4.1.22", "AES-192/CBC"},
  231|      1|      {"2.16.840.1.101.3.4.1.25", "KeyWrap.AES-192"},
  232|      1|      {"2.16.840.1.101.3.4.1.26", "AES-192/GCM"},
  233|      1|      {"2.16.840.1.101.3.4.1.27", "AES-192/CCM"},
  234|      1|      {"2.16.840.1.101.3.4.1.42", "AES-256/CBC"},
  235|      1|      {"2.16.840.1.101.3.4.1.45", "KeyWrap.AES-256"},
  236|      1|      {"2.16.840.1.101.3.4.1.46", "AES-256/GCM"},
  237|      1|      {"2.16.840.1.101.3.4.1.47", "AES-256/CCM"},
  238|      1|      {"2.16.840.1.101.3.4.1.5", "KeyWrap.AES-128"},
  239|      1|      {"2.16.840.1.101.3.4.1.6", "AES-128/GCM"},
  240|      1|      {"2.16.840.1.101.3.4.1.7", "AES-128/CCM"},
  241|      1|      {"2.16.840.1.101.3.4.2.1", "SHA-256"},
  242|      1|      {"2.16.840.1.101.3.4.2.10", "SHA-3(512)"},
  243|      1|      {"2.16.840.1.101.3.4.2.11", "SHAKE-128"},
  244|      1|      {"2.16.840.1.101.3.4.2.12", "SHAKE-256"},
  245|      1|      {"2.16.840.1.101.3.4.2.2", "SHA-384"},
  246|      1|      {"2.16.840.1.101.3.4.2.3", "SHA-512"},
  247|      1|      {"2.16.840.1.101.3.4.2.4", "SHA-224"},
  248|      1|      {"2.16.840.1.101.3.4.2.6", "SHA-512-256"},
  249|      1|      {"2.16.840.1.101.3.4.2.7", "SHA-3(224)"},
  250|      1|      {"2.16.840.1.101.3.4.2.8", "SHA-3(256)"},
  251|      1|      {"2.16.840.1.101.3.4.2.9", "SHA-3(384)"},
  252|      1|      {"2.16.840.1.101.3.4.3.1", "DSA/SHA-224"},
  253|      1|      {"2.16.840.1.101.3.4.3.10", "ECDSA/SHA-3(256)"},
  254|      1|      {"2.16.840.1.101.3.4.3.11", "ECDSA/SHA-3(384)"},
  255|      1|      {"2.16.840.1.101.3.4.3.12", "ECDSA/SHA-3(512)"},
  256|      1|      {"2.16.840.1.101.3.4.3.13", "RSA/EMSA3(SHA-3(224))"},
  257|      1|      {"2.16.840.1.101.3.4.3.14", "RSA/EMSA3(SHA-3(256))"},
  258|      1|      {"2.16.840.1.101.3.4.3.15", "RSA/EMSA3(SHA-3(384))"},
  259|      1|      {"2.16.840.1.101.3.4.3.16", "RSA/EMSA3(SHA-3(512))"},
  260|      1|      {"2.16.840.1.101.3.4.3.2", "DSA/SHA-256"},
  261|      1|      {"2.16.840.1.101.3.4.3.3", "DSA/SHA-384"},
  262|      1|      {"2.16.840.1.101.3.4.3.4", "DSA/SHA-512"},
  263|      1|      {"2.16.840.1.101.3.4.3.5", "DSA/SHA-3(224)"},
  264|      1|      {"2.16.840.1.101.3.4.3.6", "DSA/SHA-3(256)"},
  265|      1|      {"2.16.840.1.101.3.4.3.7", "DSA/SHA-3(384)"},
  266|      1|      {"2.16.840.1.101.3.4.3.8", "DSA/SHA-3(512)"},
  267|      1|      {"2.16.840.1.101.3.4.3.9", "ECDSA/SHA-3(224)"},
  268|      1|      {"2.16.840.1.113730.1.13", "Certificate Comment"},
  269|      1|      {"2.5.29.14", "X509v3.SubjectKeyIdentifier"},
  270|      1|      {"2.5.29.15", "X509v3.KeyUsage"},
  271|      1|      {"2.5.29.16", "X509v3.PrivateKeyUsagePeriod"},
  272|      1|      {"2.5.29.17", "X509v3.SubjectAlternativeName"},
  273|      1|      {"2.5.29.18", "X509v3.IssuerAlternativeName"},
  274|      1|      {"2.5.29.19", "X509v3.BasicConstraints"},
  275|      1|      {"2.5.29.20", "X509v3.CRLNumber"},
  276|      1|      {"2.5.29.21", "X509v3.ReasonCode"},
  277|      1|      {"2.5.29.23", "X509v3.HoldInstructionCode"},
  278|      1|      {"2.5.29.24", "X509v3.InvalidityDate"},
  279|      1|      {"2.5.29.28", "X509v3.CRLIssuingDistributionPoint"},
  280|      1|      {"2.5.29.30", "X509v3.NameConstraints"},
  281|      1|      {"2.5.29.31", "X509v3.CRLDistributionPoints"},
  282|      1|      {"2.5.29.32", "X509v3.CertificatePolicies"},
  283|      1|      {"2.5.29.32.0", "X509v3.AnyPolicy"},
  284|      1|      {"2.5.29.35", "X509v3.AuthorityKeyIdentifier"},
  285|      1|      {"2.5.29.36", "X509v3.PolicyConstraints"},
  286|      1|      {"2.5.29.37", "X509v3.ExtendedKeyUsage"},
  287|      1|      {"2.5.4.10", "X520.Organization"},
  288|      1|      {"2.5.4.11", "X520.OrganizationalUnit"},
  289|      1|      {"2.5.4.12", "X520.Title"},
  290|      1|      {"2.5.4.3", "X520.CommonName"},
  291|      1|      {"2.5.4.4", "X520.Surname"},
  292|      1|      {"2.5.4.42", "X520.GivenName"},
  293|      1|      {"2.5.4.43", "X520.Initials"},
  294|      1|      {"2.5.4.44", "X520.GenerationalQualifier"},
  295|      1|      {"2.5.4.46", "X520.DNQualifier"},
  296|      1|      {"2.5.4.5", "X520.SerialNumber"},
  297|      1|      {"2.5.4.6", "X520.Country"},
  298|      1|      {"2.5.4.65", "X520.Pseudonym"},
  299|      1|      {"2.5.4.7", "X520.Locality"},
  300|      1|      {"2.5.4.8", "X520.State"},
  301|      1|      {"2.5.4.9", "X520.StreetAddress"},
  302|      1|      {"2.5.8.1.1", "RSA"}};
  303|      1|}
_ZN5Botan7OID_Map16load_str2oid_mapEv:
  305|      1|std::unordered_map<std::string, OID> OID_Map::load_str2oid_map() {
  306|      1|   return std::unordered_map<std::string, OID>{
  307|       |
  308|      1|      {"AES-128/CBC", OID({2, 16, 840, 1, 101, 3, 4, 1, 2})},
  309|      1|      {"AES-128/CCM", OID({2, 16, 840, 1, 101, 3, 4, 1, 7})},
  310|      1|      {"AES-128/GCM", OID({2, 16, 840, 1, 101, 3, 4, 1, 6})},
  311|      1|      {"AES-128/OCB", OID({1, 3, 6, 1, 4, 1, 25258, 3, 2, 1})},
  312|      1|      {"AES-128/SIV", OID({1, 3, 6, 1, 4, 1, 25258, 3, 4, 1})},
  313|      1|      {"AES-192/CBC", OID({2, 16, 840, 1, 101, 3, 4, 1, 22})},
  314|      1|      {"AES-192/CCM", OID({2, 16, 840, 1, 101, 3, 4, 1, 27})},
  315|      1|      {"AES-192/GCM", OID({2, 16, 840, 1, 101, 3, 4, 1, 26})},
  316|      1|      {"AES-192/OCB", OID({1, 3, 6, 1, 4, 1, 25258, 3, 2, 2})},
  317|      1|      {"AES-192/SIV", OID({1, 3, 6, 1, 4, 1, 25258, 3, 4, 2})},
  318|      1|      {"AES-256/CBC", OID({2, 16, 840, 1, 101, 3, 4, 1, 42})},
  319|      1|      {"AES-256/CCM", OID({2, 16, 840, 1, 101, 3, 4, 1, 47})},
  320|      1|      {"AES-256/GCM", OID({2, 16, 840, 1, 101, 3, 4, 1, 46})},
  321|      1|      {"AES-256/OCB", OID({1, 3, 6, 1, 4, 1, 25258, 3, 2, 3})},
  322|      1|      {"AES-256/SIV", OID({1, 3, 6, 1, 4, 1, 25258, 3, 4, 3})},
  323|      1|      {"CAST-128/CBC", OID({1, 2, 840, 113533, 7, 66, 10})},
  324|      1|      {"Camellia-128/CBC", OID({1, 2, 392, 200011, 61, 1, 1, 1, 2})},
  325|      1|      {"Camellia-128/GCM", OID({0, 3, 4401, 5, 3, 1, 9, 6})},
  326|      1|      {"Camellia-128/OCB", OID({1, 3, 6, 1, 4, 1, 25258, 3, 2, 6})},
  327|      1|      {"Camellia-128/SIV", OID({1, 3, 6, 1, 4, 1, 25258, 3, 4, 6})},
  328|      1|      {"Camellia-192/CBC", OID({1, 2, 392, 200011, 61, 1, 1, 1, 3})},
  329|      1|      {"Camellia-192/GCM", OID({0, 3, 4401, 5, 3, 1, 9, 26})},
  330|      1|      {"Camellia-192/OCB", OID({1, 3, 6, 1, 4, 1, 25258, 3, 2, 7})},
  331|      1|      {"Camellia-192/SIV", OID({1, 3, 6, 1, 4, 1, 25258, 3, 4, 7})},
  332|      1|      {"Camellia-256/CBC", OID({1, 2, 392, 200011, 61, 1, 1, 1, 4})},
  333|      1|      {"Camellia-256/GCM", OID({0, 3, 4401, 5, 3, 1, 9, 46})},
  334|      1|      {"Camellia-256/OCB", OID({1, 3, 6, 1, 4, 1, 25258, 3, 2, 8})},
  335|      1|      {"Camellia-256/SIV", OID({1, 3, 6, 1, 4, 1, 25258, 3, 4, 8})},
  336|      1|      {"Certificate Comment", OID({2, 16, 840, 1, 113730, 1, 13})},
  337|      1|      {"ChaCha20Poly1305", OID({1, 2, 840, 113549, 1, 9, 16, 3, 18})},
  338|      1|      {"Compression.Zlib", OID({1, 2, 840, 113549, 1, 9, 16, 3, 8})},
  339|      1|      {"Curve25519", OID({1, 3, 101, 110})},
  340|      1|      {"DES/CBC", OID({1, 3, 14, 3, 2, 7})},
  341|      1|      {"DH", OID({1, 2, 840, 10046, 2, 1})},
  342|      1|      {"DSA", OID({1, 2, 840, 10040, 4, 1})},
  343|      1|      {"DSA/SHA-1", OID({1, 2, 840, 10040, 4, 3})},
  344|      1|      {"DSA/SHA-224", OID({2, 16, 840, 1, 101, 3, 4, 3, 1})},
  345|      1|      {"DSA/SHA-256", OID({2, 16, 840, 1, 101, 3, 4, 3, 2})},
  346|      1|      {"DSA/SHA-3(224)", OID({2, 16, 840, 1, 101, 3, 4, 3, 5})},
  347|      1|      {"DSA/SHA-3(256)", OID({2, 16, 840, 1, 101, 3, 4, 3, 6})},
  348|      1|      {"DSA/SHA-3(384)", OID({2, 16, 840, 1, 101, 3, 4, 3, 7})},
  349|      1|      {"DSA/SHA-3(512)", OID({2, 16, 840, 1, 101, 3, 4, 3, 8})},
  350|      1|      {"DSA/SHA-384", OID({2, 16, 840, 1, 101, 3, 4, 3, 3})},
  351|      1|      {"DSA/SHA-512", OID({2, 16, 840, 1, 101, 3, 4, 3, 4})},
  352|      1|      {"Dilithium-4x4-AES-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 10, 1})},
  353|      1|      {"Dilithium-4x4-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 9, 1})},
  354|      1|      {"Dilithium-6x5-AES-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 10, 2})},
  355|      1|      {"Dilithium-6x5-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 9, 2})},
  356|      1|      {"Dilithium-8x7-AES-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 10, 3})},
  357|      1|      {"Dilithium-8x7-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 9, 3})},
  358|      1|      {"ECDH", OID({1, 3, 132, 1, 12})},
  359|      1|      {"ECDSA", OID({1, 2, 840, 10045, 2, 1})},
  360|      1|      {"ECDSA/SHA-1", OID({1, 2, 840, 10045, 4, 1})},
  361|      1|      {"ECDSA/SHA-224", OID({1, 2, 840, 10045, 4, 3, 1})},
  362|      1|      {"ECDSA/SHA-256", OID({1, 2, 840, 10045, 4, 3, 2})},
  363|      1|      {"ECDSA/SHA-3(224)", OID({2, 16, 840, 1, 101, 3, 4, 3, 9})},
  364|      1|      {"ECDSA/SHA-3(256)", OID({2, 16, 840, 1, 101, 3, 4, 3, 10})},
  365|      1|      {"ECDSA/SHA-3(384)", OID({2, 16, 840, 1, 101, 3, 4, 3, 11})},
  366|      1|      {"ECDSA/SHA-3(512)", OID({2, 16, 840, 1, 101, 3, 4, 3, 12})},
  367|      1|      {"ECDSA/SHA-384", OID({1, 2, 840, 10045, 4, 3, 3})},
  368|      1|      {"ECDSA/SHA-512", OID({1, 2, 840, 10045, 4, 3, 4})},
  369|      1|      {"ECGDSA", OID({1, 3, 36, 3, 3, 2, 5, 2, 1})},
  370|      1|      {"ECGDSA/RIPEMD-160", OID({1, 3, 36, 3, 3, 2, 5, 4, 1})},
  371|      1|      {"ECGDSA/SHA-1", OID({1, 3, 36, 3, 3, 2, 5, 4, 2})},
  372|      1|      {"ECGDSA/SHA-224", OID({1, 3, 36, 3, 3, 2, 5, 4, 3})},
  373|      1|      {"ECGDSA/SHA-256", OID({1, 3, 36, 3, 3, 2, 5, 4, 4})},
  374|      1|      {"ECGDSA/SHA-384", OID({1, 3, 36, 3, 3, 2, 5, 4, 5})},
  375|      1|      {"ECGDSA/SHA-512", OID({1, 3, 36, 3, 3, 2, 5, 4, 6})},
  376|      1|      {"ECKCDSA", OID({1, 0, 14888, 3, 0, 5})},
  377|      1|      {"ECKCDSA/SHA-1", OID({1, 2, 410, 200004, 1, 100, 4, 3})},
  378|      1|      {"ECKCDSA/SHA-224", OID({1, 2, 410, 200004, 1, 100, 4, 4})},
  379|      1|      {"ECKCDSA/SHA-256", OID({1, 2, 410, 200004, 1, 100, 4, 5})},
  380|      1|      {"Ed25519", OID({1, 3, 101, 112})},
  381|      1|      {"ElGamal", OID({1, 3, 6, 1, 4, 1, 3029, 1, 2, 1})},
  382|      1|      {"FrodoKEM-1344-AES", OID({1, 3, 6, 1, 4, 1, 25258, 1, 15, 3})},
  383|      1|      {"FrodoKEM-1344-SHAKE", OID({1, 3, 6, 1, 4, 1, 25258, 1, 14, 3})},
  384|      1|      {"FrodoKEM-640-AES", OID({1, 3, 6, 1, 4, 1, 25258, 1, 15, 1})},
  385|      1|      {"FrodoKEM-640-SHAKE", OID({1, 3, 6, 1, 4, 1, 25258, 1, 14, 1})},
  386|      1|      {"FrodoKEM-976-AES", OID({1, 3, 6, 1, 4, 1, 25258, 1, 15, 2})},
  387|      1|      {"FrodoKEM-976-SHAKE", OID({1, 3, 6, 1, 4, 1, 25258, 1, 14, 2})},
  388|      1|      {"GOST-34.10", OID({1, 2, 643, 2, 2, 19})},
  389|      1|      {"GOST-34.10-2012-256", OID({1, 2, 643, 7, 1, 1, 1, 1})},
  390|      1|      {"GOST-34.10-2012-256/SHA-256", OID({1, 3, 6, 1, 4, 1, 25258, 1, 6, 1})},
  391|      1|      {"GOST-34.10-2012-256/Streebog-256", OID({1, 2, 643, 7, 1, 1, 3, 2})},
  392|      1|      {"GOST-34.10-2012-512", OID({1, 2, 643, 7, 1, 1, 1, 2})},
  393|      1|      {"GOST-34.10-2012-512/Streebog-512", OID({1, 2, 643, 7, 1, 1, 3, 3})},
  394|      1|      {"GOST-34.10/GOST-R-34.11-94", OID({1, 2, 643, 2, 2, 3})},
  395|      1|      {"GOST.INN", OID({1, 2, 643, 3, 131, 1, 1})},
  396|      1|      {"GOST.IssuerSigningTool", OID({1, 2, 643, 100, 112})},
  397|      1|      {"GOST.OGRN", OID({1, 2, 643, 100, 1})},
  398|      1|      {"GOST.SubjectSigningTool", OID({1, 2, 643, 100, 111})},
  399|      1|      {"HMAC(SHA-1)", OID({1, 2, 840, 113549, 2, 7})},
  400|      1|      {"HMAC(SHA-224)", OID({1, 2, 840, 113549, 2, 8})},
  401|      1|      {"HMAC(SHA-256)", OID({1, 2, 840, 113549, 2, 9})},
  402|      1|      {"HMAC(SHA-384)", OID({1, 2, 840, 113549, 2, 10})},
  403|      1|      {"HMAC(SHA-512)", OID({1, 2, 840, 113549, 2, 11})},
  404|      1|      {"HMAC(SHA-512-256)", OID({1, 2, 840, 113549, 2, 13})},
  405|      1|      {"KeyWrap.AES-128", OID({2, 16, 840, 1, 101, 3, 4, 1, 5})},
  406|      1|      {"KeyWrap.AES-192", OID({2, 16, 840, 1, 101, 3, 4, 1, 25})},
  407|      1|      {"KeyWrap.AES-256", OID({2, 16, 840, 1, 101, 3, 4, 1, 45})},
  408|      1|      {"KeyWrap.CAST-128", OID({1, 2, 840, 113533, 7, 66, 15})},
  409|      1|      {"KeyWrap.TripleDES", OID({1, 2, 840, 113549, 1, 9, 16, 3, 6})},
  410|      1|      {"Kyber-1024-90s-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 11, 3})},
  411|      1|      {"Kyber-1024-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 7, 3})},
  412|      1|      {"Kyber-512-90s-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 11, 1})},
  413|      1|      {"Kyber-512-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 7, 1})},
  414|      1|      {"Kyber-768-90s-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 11, 2})},
  415|      1|      {"Kyber-768-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 7, 2})},
  416|      1|      {"MD5", OID({1, 2, 840, 113549, 2, 5})},
  417|      1|      {"MGF1", OID({1, 2, 840, 113549, 1, 1, 8})},
  418|      1|      {"McEliece", OID({1, 3, 6, 1, 4, 1, 25258, 1, 3})},
  419|      1|      {"Microsoft SmartcardLogon", OID({1, 3, 6, 1, 4, 1, 311, 20, 2, 2})},
  420|      1|      {"Microsoft UPN", OID({1, 3, 6, 1, 4, 1, 311, 20, 2, 3})},
  421|      1|      {"OpenPGP.Curve25519", OID({1, 3, 6, 1, 4, 1, 3029, 1, 5, 1})},
  422|      1|      {"OpenPGP.Ed25519", OID({1, 3, 6, 1, 4, 1, 11591, 15, 1})},
  423|      1|      {"PBE-PKCS5v20", OID({1, 2, 840, 113549, 1, 5, 13})},
  424|      1|      {"PBES2", OID({1, 2, 840, 113549, 1, 5, 13})},
  425|      1|      {"PKCS5.PBKDF2", OID({1, 2, 840, 113549, 1, 5, 12})},
  426|      1|      {"PKCS9.ChallengePassword", OID({1, 2, 840, 113549, 1, 9, 7})},
  427|      1|      {"PKCS9.ContentType", OID({1, 2, 840, 113549, 1, 9, 3})},
  428|      1|      {"PKCS9.EmailAddress", OID({1, 2, 840, 113549, 1, 9, 1})},
  429|      1|      {"PKCS9.ExtensionRequest", OID({1, 2, 840, 113549, 1, 9, 14})},
  430|      1|      {"PKCS9.MessageDigest", OID({1, 2, 840, 113549, 1, 9, 4})},
  431|      1|      {"PKCS9.UnstructuredName", OID({1, 2, 840, 113549, 1, 9, 2})},
  432|      1|      {"PKIX.AuthorityInformationAccess", OID({1, 3, 6, 1, 5, 5, 7, 1, 1})},
  433|      1|      {"PKIX.CertificateAuthorityIssuers", OID({1, 3, 6, 1, 5, 5, 7, 48, 2})},
  434|      1|      {"PKIX.ClientAuth", OID({1, 3, 6, 1, 5, 5, 7, 3, 2})},
  435|      1|      {"PKIX.CodeSigning", OID({1, 3, 6, 1, 5, 5, 7, 3, 3})},
  436|      1|      {"PKIX.EmailProtection", OID({1, 3, 6, 1, 5, 5, 7, 3, 4})},
  437|      1|      {"PKIX.IPsecEndSystem", OID({1, 3, 6, 1, 5, 5, 7, 3, 5})},
  438|      1|      {"PKIX.IPsecTunnel", OID({1, 3, 6, 1, 5, 5, 7, 3, 6})},
  439|      1|      {"PKIX.IPsecUser", OID({1, 3, 6, 1, 5, 5, 7, 3, 7})},
  440|      1|      {"PKIX.OCSP", OID({1, 3, 6, 1, 5, 5, 7, 48, 1})},
  441|      1|      {"PKIX.OCSP.BasicResponse", OID({1, 3, 6, 1, 5, 5, 7, 48, 1, 1})},
  442|      1|      {"PKIX.OCSP.NoCheck", OID({1, 3, 6, 1, 5, 5, 7, 48, 1, 5})},
  443|      1|      {"PKIX.OCSPSigning", OID({1, 3, 6, 1, 5, 5, 7, 3, 9})},
  444|      1|      {"PKIX.ServerAuth", OID({1, 3, 6, 1, 5, 5, 7, 3, 1})},
  445|      1|      {"PKIX.TimeStamping", OID({1, 3, 6, 1, 5, 5, 7, 3, 8})},
  446|      1|      {"PKIX.XMPPAddr", OID({1, 3, 6, 1, 5, 5, 7, 8, 5})},
  447|      1|      {"RIPEMD-160", OID({1, 3, 36, 3, 2, 1})},
  448|      1|      {"RSA", OID({1, 2, 840, 113549, 1, 1, 1})},
  449|      1|      {"RSA/EMSA3(MD5)", OID({1, 2, 840, 113549, 1, 1, 4})},
  450|      1|      {"RSA/EMSA3(RIPEMD-160)", OID({1, 3, 36, 3, 3, 1, 2})},
  451|      1|      {"RSA/EMSA3(SHA-1)", OID({1, 2, 840, 113549, 1, 1, 5})},
  452|      1|      {"RSA/EMSA3(SHA-224)", OID({1, 2, 840, 113549, 1, 1, 14})},
  453|      1|      {"RSA/EMSA3(SHA-256)", OID({1, 2, 840, 113549, 1, 1, 11})},
  454|      1|      {"RSA/EMSA3(SHA-3(224))", OID({2, 16, 840, 1, 101, 3, 4, 3, 13})},
  455|      1|      {"RSA/EMSA3(SHA-3(256))", OID({2, 16, 840, 1, 101, 3, 4, 3, 14})},
  456|      1|      {"RSA/EMSA3(SHA-3(384))", OID({2, 16, 840, 1, 101, 3, 4, 3, 15})},
  457|      1|      {"RSA/EMSA3(SHA-3(512))", OID({2, 16, 840, 1, 101, 3, 4, 3, 16})},
  458|      1|      {"RSA/EMSA3(SHA-384)", OID({1, 2, 840, 113549, 1, 1, 12})},
  459|      1|      {"RSA/EMSA3(SHA-512)", OID({1, 2, 840, 113549, 1, 1, 13})},
  460|      1|      {"RSA/EMSA3(SHA-512-256)", OID({1, 2, 840, 113549, 1, 1, 16})},
  461|      1|      {"RSA/EMSA3(SM3)", OID({1, 2, 156, 10197, 1, 504})},
  462|      1|      {"RSA/EMSA4", OID({1, 2, 840, 113549, 1, 1, 10})},
  463|      1|      {"RSA/OAEP", OID({1, 2, 840, 113549, 1, 1, 7})},
  464|      1|      {"SEED/CBC", OID({1, 2, 410, 200004, 1, 4})},
  465|      1|      {"SHA-1", OID({1, 3, 14, 3, 2, 26})},
  466|      1|      {"SHA-224", OID({2, 16, 840, 1, 101, 3, 4, 2, 4})},
  467|      1|      {"SHA-256", OID({2, 16, 840, 1, 101, 3, 4, 2, 1})},
  468|      1|      {"SHA-3(224)", OID({2, 16, 840, 1, 101, 3, 4, 2, 7})},
  469|      1|      {"SHA-3(256)", OID({2, 16, 840, 1, 101, 3, 4, 2, 8})},
  470|      1|      {"SHA-3(384)", OID({2, 16, 840, 1, 101, 3, 4, 2, 9})},
  471|      1|      {"SHA-3(512)", OID({2, 16, 840, 1, 101, 3, 4, 2, 10})},
  472|      1|      {"SHA-384", OID({2, 16, 840, 1, 101, 3, 4, 2, 2})},
  473|      1|      {"SHA-512", OID({2, 16, 840, 1, 101, 3, 4, 2, 3})},
  474|      1|      {"SHA-512-256", OID({2, 16, 840, 1, 101, 3, 4, 2, 6})},
  475|      1|      {"SHAKE-128", OID({2, 16, 840, 1, 101, 3, 4, 2, 11})},
  476|      1|      {"SHAKE-256", OID({2, 16, 840, 1, 101, 3, 4, 2, 12})},
  477|      1|      {"SM2", OID({1, 2, 156, 10197, 1, 301, 1})},
  478|      1|      {"SM2_Enc", OID({1, 2, 156, 10197, 1, 301, 3})},
  479|      1|      {"SM2_Kex", OID({1, 2, 156, 10197, 1, 301, 2})},
  480|      1|      {"SM2_Sig", OID({1, 2, 156, 10197, 1, 301, 1})},
  481|      1|      {"SM2_Sig/SM3", OID({1, 2, 156, 10197, 1, 501})},
  482|      1|      {"SM3", OID({1, 2, 156, 10197, 1, 401})},
  483|      1|      {"SM4/CBC", OID({1, 2, 156, 10197, 1, 104, 2})},
  484|      1|      {"SM4/GCM", OID({1, 2, 156, 10197, 1, 104, 8})},
  485|      1|      {"SM4/OCB", OID({1, 2, 156, 10197, 1, 104, 100})},
  486|      1|      {"SM4/SIV", OID({1, 3, 6, 1, 4, 1, 25258, 3, 4, 9})},
  487|      1|      {"Scrypt", OID({1, 3, 6, 1, 4, 1, 11591, 4, 11})},
  488|      1|      {"Serpent/CBC", OID({1, 3, 6, 1, 4, 1, 25258, 3, 1})},
  489|      1|      {"Serpent/GCM", OID({1, 3, 6, 1, 4, 1, 25258, 3, 101})},
  490|      1|      {"Serpent/OCB", OID({1, 3, 6, 1, 4, 1, 25258, 3, 2, 4})},
  491|      1|      {"Serpent/SIV", OID({1, 3, 6, 1, 4, 1, 25258, 3, 4, 4})},
  492|      1|      {"SphincsPlus-haraka-128f-r3.1", OID({1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 2})},
  493|      1|      {"SphincsPlus-haraka-128s-r3.1", OID({1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 1})},
  494|      1|      {"SphincsPlus-haraka-192f-r3.1", OID({1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 4})},
  495|      1|      {"SphincsPlus-haraka-192s-r3.1", OID({1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 3})},
  496|      1|      {"SphincsPlus-haraka-256f-r3.1", OID({1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 6})},
  497|      1|      {"SphincsPlus-haraka-256s-r3.1", OID({1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 5})},
  498|      1|      {"SphincsPlus-sha2-128f-r3.1", OID({1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 2})},
  499|      1|      {"SphincsPlus-sha2-128s-r3.1", OID({1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 1})},
  500|      1|      {"SphincsPlus-sha2-192f-r3.1", OID({1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 4})},
  501|      1|      {"SphincsPlus-sha2-192s-r3.1", OID({1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 3})},
  502|      1|      {"SphincsPlus-sha2-256f-r3.1", OID({1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 6})},
  503|      1|      {"SphincsPlus-sha2-256s-r3.1", OID({1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 5})},
  504|      1|      {"SphincsPlus-shake-128f-r3.1", OID({1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 2})},
  505|      1|      {"SphincsPlus-shake-128s-r3.1", OID({1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 1})},
  506|      1|      {"SphincsPlus-shake-192f-r3.1", OID({1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 4})},
  507|      1|      {"SphincsPlus-shake-192s-r3.1", OID({1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 3})},
  508|      1|      {"SphincsPlus-shake-256f-r3.1", OID({1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 6})},
  509|      1|      {"SphincsPlus-shake-256s-r3.1", OID({1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 5})},
  510|      1|      {"Streebog-256", OID({1, 2, 643, 7, 1, 1, 2, 2})},
  511|      1|      {"Streebog-512", OID({1, 2, 643, 7, 1, 1, 2, 3})},
  512|      1|      {"Threefish-512/CBC", OID({1, 3, 6, 1, 4, 1, 25258, 3, 2})},
  513|      1|      {"TripleDES/CBC", OID({1, 2, 840, 113549, 3, 7})},
  514|      1|      {"Twofish/CBC", OID({1, 3, 6, 1, 4, 1, 25258, 3, 3})},
  515|      1|      {"Twofish/GCM", OID({1, 3, 6, 1, 4, 1, 25258, 3, 102})},
  516|      1|      {"Twofish/OCB", OID({1, 3, 6, 1, 4, 1, 25258, 3, 2, 5})},
  517|      1|      {"Twofish/SIV", OID({1, 3, 6, 1, 4, 1, 25258, 3, 4, 5})},
  518|      1|      {"X509v3.AnyPolicy", OID({2, 5, 29, 32, 0})},
  519|      1|      {"X509v3.AuthorityKeyIdentifier", OID({2, 5, 29, 35})},
  520|      1|      {"X509v3.BasicConstraints", OID({2, 5, 29, 19})},
  521|      1|      {"X509v3.CRLDistributionPoints", OID({2, 5, 29, 31})},
  522|      1|      {"X509v3.CRLIssuingDistributionPoint", OID({2, 5, 29, 28})},
  523|      1|      {"X509v3.CRLNumber", OID({2, 5, 29, 20})},
  524|      1|      {"X509v3.CertificatePolicies", OID({2, 5, 29, 32})},
  525|      1|      {"X509v3.ExtendedKeyUsage", OID({2, 5, 29, 37})},
  526|      1|      {"X509v3.HoldInstructionCode", OID({2, 5, 29, 23})},
  527|      1|      {"X509v3.InvalidityDate", OID({2, 5, 29, 24})},
  528|      1|      {"X509v3.IssuerAlternativeName", OID({2, 5, 29, 18})},
  529|      1|      {"X509v3.KeyUsage", OID({2, 5, 29, 15})},
  530|      1|      {"X509v3.NameConstraints", OID({2, 5, 29, 30})},
  531|      1|      {"X509v3.PolicyConstraints", OID({2, 5, 29, 36})},
  532|      1|      {"X509v3.PrivateKeyUsagePeriod", OID({2, 5, 29, 16})},
  533|      1|      {"X509v3.ReasonCode", OID({2, 5, 29, 21})},
  534|      1|      {"X509v3.SubjectAlternativeName", OID({2, 5, 29, 17})},
  535|      1|      {"X509v3.SubjectKeyIdentifier", OID({2, 5, 29, 14})},
  536|      1|      {"X520.CommonName", OID({2, 5, 4, 3})},
  537|      1|      {"X520.Country", OID({2, 5, 4, 6})},
  538|      1|      {"X520.DNQualifier", OID({2, 5, 4, 46})},
  539|      1|      {"X520.GenerationalQualifier", OID({2, 5, 4, 44})},
  540|      1|      {"X520.GivenName", OID({2, 5, 4, 42})},
  541|      1|      {"X520.Initials", OID({2, 5, 4, 43})},
  542|      1|      {"X520.Locality", OID({2, 5, 4, 7})},
  543|      1|      {"X520.Organization", OID({2, 5, 4, 10})},
  544|      1|      {"X520.OrganizationalUnit", OID({2, 5, 4, 11})},
  545|      1|      {"X520.Pseudonym", OID({2, 5, 4, 65})},
  546|      1|      {"X520.SerialNumber", OID({2, 5, 4, 5})},
  547|      1|      {"X520.State", OID({2, 5, 4, 8})},
  548|      1|      {"X520.StreetAddress", OID({2, 5, 4, 9})},
  549|      1|      {"X520.Surname", OID({2, 5, 4, 4})},
  550|      1|      {"X520.Title", OID({2, 5, 4, 12})},
  551|      1|      {"XMSS", OID({0, 4, 0, 127, 0, 15, 1, 1, 13, 0})},
  552|      1|      {"XMSS-draft12", OID({1, 3, 6, 1, 4, 1, 25258, 1, 8})},
  553|      1|      {"XMSS-draft6", OID({1, 3, 6, 1, 4, 1, 25258, 1, 5})},
  554|      1|      {"brainpool160r1", OID({1, 3, 36, 3, 3, 2, 8, 1, 1, 1})},
  555|      1|      {"brainpool192r1", OID({1, 3, 36, 3, 3, 2, 8, 1, 1, 3})},
  556|      1|      {"brainpool224r1", OID({1, 3, 36, 3, 3, 2, 8, 1, 1, 5})},
  557|      1|      {"brainpool256r1", OID({1, 3, 36, 3, 3, 2, 8, 1, 1, 7})},
  558|      1|      {"brainpool320r1", OID({1, 3, 36, 3, 3, 2, 8, 1, 1, 9})},
  559|      1|      {"brainpool384r1", OID({1, 3, 36, 3, 3, 2, 8, 1, 1, 11})},
  560|      1|      {"brainpool512r1", OID({1, 3, 36, 3, 3, 2, 8, 1, 1, 13})},
  561|      1|      {"eFrodoKEM-1344-AES", OID({1, 3, 6, 1, 4, 1, 25258, 1, 17, 3})},
  562|      1|      {"eFrodoKEM-1344-SHAKE", OID({1, 3, 6, 1, 4, 1, 25258, 1, 16, 3})},
  563|      1|      {"eFrodoKEM-640-AES", OID({1, 3, 6, 1, 4, 1, 25258, 1, 17, 1})},
  564|      1|      {"eFrodoKEM-640-SHAKE", OID({1, 3, 6, 1, 4, 1, 25258, 1, 16, 1})},
  565|      1|      {"eFrodoKEM-976-AES", OID({1, 3, 6, 1, 4, 1, 25258, 1, 17, 2})},
  566|      1|      {"eFrodoKEM-976-SHAKE", OID({1, 3, 6, 1, 4, 1, 25258, 1, 16, 2})},
  567|      1|      {"frp256v1", OID({1, 2, 250, 1, 223, 101, 256, 1})},
  568|      1|      {"gost_256A", OID({1, 2, 643, 7, 1, 2, 1, 1, 1})},
  569|      1|      {"gost_256B", OID({1, 2, 643, 7, 1, 2, 1, 1, 2})},
  570|      1|      {"gost_512A", OID({1, 2, 643, 7, 1, 2, 1, 2, 1})},
  571|      1|      {"gost_512B", OID({1, 2, 643, 7, 1, 2, 1, 2, 2})},
  572|      1|      {"secp160k1", OID({1, 3, 132, 0, 9})},
  573|      1|      {"secp160r1", OID({1, 3, 132, 0, 8})},
  574|      1|      {"secp160r2", OID({1, 3, 132, 0, 30})},
  575|      1|      {"secp192k1", OID({1, 3, 132, 0, 31})},
  576|      1|      {"secp192r1", OID({1, 2, 840, 10045, 3, 1, 1})},
  577|      1|      {"secp224k1", OID({1, 3, 132, 0, 32})},
  578|      1|      {"secp224r1", OID({1, 3, 132, 0, 33})},
  579|      1|      {"secp256k1", OID({1, 3, 132, 0, 10})},
  580|      1|      {"secp256r1", OID({1, 2, 840, 10045, 3, 1, 7})},
  581|      1|      {"secp384r1", OID({1, 3, 132, 0, 34})},
  582|      1|      {"secp521r1", OID({1, 3, 132, 0, 35})},
  583|      1|      {"sm2p256v1", OID({1, 2, 156, 10197, 1, 301})},
  584|      1|      {"x962_p192v2", OID({1, 2, 840, 10045, 3, 1, 2})},
  585|      1|      {"x962_p192v3", OID({1, 2, 840, 10045, 3, 1, 3})},
  586|      1|      {"x962_p239v1", OID({1, 2, 840, 10045, 3, 1, 4})},
  587|      1|      {"x962_p239v2", OID({1, 2, 840, 10045, 3, 1, 5})},
  588|      1|      {"x962_p239v3", OID({1, 2, 840, 10045, 3, 1, 6})}};
  589|      1|}

_ZN5Botan10PSS_ParamsC2EPKhm:
   37|     54|PSS_Params::PSS_Params(const uint8_t der[], size_t der_len) {
   38|     54|   BER_Decoder decoder(der, der_len);
   39|     54|   this->decode_from(decoder);
   40|     54|}
_ZN5Botan10PSS_Params11decode_fromERNS_11BER_DecoderE:
   67|     54|void PSS_Params::decode_from(BER_Decoder& from) {
   68|     54|   const AlgorithmIdentifier default_hash("SHA-1", AlgorithmIdentifier::USE_NULL_PARAM);
   69|     54|   const AlgorithmIdentifier default_mgf("MGF1", default_hash.BER_encode());
   70|     54|   const size_t default_salt_len = 20;
   71|     54|   const size_t default_trailer = 1;
   72|       |
   73|     54|   from.start_sequence()
   74|     54|      .decode_optional(m_hash, ASN1_Type(0), ASN1_Class::ExplicitContextSpecific, default_hash)
   75|     54|      .decode_optional(m_mgf, ASN1_Type(1), ASN1_Class::ExplicitContextSpecific, default_mgf)
   76|     54|      .decode_optional(m_salt_len, ASN1_Type(2), ASN1_Class::ExplicitContextSpecific, default_salt_len)
   77|     54|      .decode_optional(m_trailer_field, ASN1_Type(3), ASN1_Class::ExplicitContextSpecific, default_trailer)
   78|     54|      .end_cons();
   79|       |
   80|     54|   BER_Decoder(m_mgf.parameters()).decode(m_mgf_hash);
   81|     54|}

_ZN5Botan20Buffered_Computation9update_beEj:
   19|    186|void Buffered_Computation::update_be(uint32_t val) {
   20|    186|   uint8_t inb[sizeof(val)];
   21|    186|   store_be(val, inb);
   22|    186|   add_data({inb, sizeof(inb)});
   23|    186|}

_ZN5Botan13base64_decodeEPKcmb:
  174|    151|secure_vector<uint8_t> base64_decode(const char input[], size_t input_length, bool ignore_ws) {
  175|    151|   return base_decode_to_vec<secure_vector<uint8_t>>(Base64(), input, input_length, ignore_ws);
  176|    151|}
base64.cpp:_ZN5Botan12_GLOBAL__N_16Base6417decode_max_outputEm:
   41|    302|      static inline size_t decode_max_output(size_t input_length) {
   42|    302|         return (round_up(input_length, m_encoding_bytes_out) * m_encoding_bytes_in) / m_encoding_bytes_out;
   43|    302|      }
base64.cpp:_ZN5Botan12_GLOBAL__N_16Base6417decoding_bytes_inEv:
   29|    151|      static inline size_t decoding_bytes_in() noexcept { return m_encoding_bytes_out; }
base64.cpp:_ZN5Botan12_GLOBAL__N_16Base6418decoding_bytes_outEv:
   31|    151|      static inline size_t decoding_bytes_out() noexcept { return m_encoding_bytes_in; }
base64.cpp:_ZN5Botan12_GLOBAL__N_16Base6419lookup_binary_valueEc:
  103|  25.9k|uint8_t Base64::lookup_binary_value(char input) noexcept {
  104|  25.9k|   const uint8_t c = static_cast<uint8_t>(input);
  105|       |
  106|  25.9k|   const auto is_alpha_upper = CT::Mask<uint8_t>::is_within_range(c, uint8_t('A'), uint8_t('Z'));
  107|  25.9k|   const auto is_alpha_lower = CT::Mask<uint8_t>::is_within_range(c, uint8_t('a'), uint8_t('z'));
  108|  25.9k|   const auto is_decimal = CT::Mask<uint8_t>::is_within_range(c, uint8_t('0'), uint8_t('9'));
  109|       |
  110|  25.9k|   const auto is_plus = CT::Mask<uint8_t>::is_equal(c, uint8_t('+'));
  111|  25.9k|   const auto is_slash = CT::Mask<uint8_t>::is_equal(c, uint8_t('/'));
  112|  25.9k|   const auto is_equal = CT::Mask<uint8_t>::is_equal(c, uint8_t('='));
  113|       |
  114|  25.9k|   const auto is_whitespace =
  115|  25.9k|      CT::Mask<uint8_t>::is_any_of(c, {uint8_t(' '), uint8_t('\t'), uint8_t('\n'), uint8_t('\r')});
  116|       |
  117|  25.9k|   const uint8_t c_upper = c - uint8_t('A');
  118|  25.9k|   const uint8_t c_lower = c - uint8_t('a') + 26;
  119|  25.9k|   const uint8_t c_decim = c - uint8_t('0') + 2 * 26;
  120|       |
  121|  25.9k|   uint8_t ret = 0xFF;  // default value
  122|       |
  123|  25.9k|   ret = is_alpha_upper.select(c_upper, ret);
  124|  25.9k|   ret = is_alpha_lower.select(c_lower, ret);
  125|  25.9k|   ret = is_decimal.select(c_decim, ret);
  126|  25.9k|   ret = is_plus.select(62, ret);
  127|  25.9k|   ret = is_slash.select(63, ret);
  128|  25.9k|   ret = is_equal.select(0x81, ret);
  129|  25.9k|   ret = is_whitespace.select(0x80, ret);
  130|       |
  131|  25.9k|   return ret;
  132|  25.9k|}
base64.cpp:_ZN5Botan12_GLOBAL__N_16Base6414check_bad_charEhcb:
  135|  25.3k|bool Base64::check_bad_char(uint8_t bin, char input, bool ignore_ws) {
  136|  25.3k|   if(bin <= 0x3F) {
  ------------------
  |  Branch (136:7): [True: 21.5k, False: 3.85k]
  ------------------
  137|  21.5k|      return true;
  138|  21.5k|   } else if(!(bin == 0x81 || (bin == 0x80 && ignore_ws))) {
  ------------------
  |  Branch (138:16): [True: 600, False: 3.25k]
  |  Branch (138:32): [True: 3.22k, False: 34]
  |  Branch (138:47): [True: 3.22k, False: 0]
  ------------------
  139|     34|      throw Invalid_Argument(fmt("base64_decode: invalid character '{}'", format_char_for_display(input)));
  140|     34|   }
  141|  3.82k|   return false;
  142|  25.3k|}
base64.cpp:_ZN5Botan12_GLOBAL__N_16Base646decodeEPhPKh:
   51|  5.40k|      static void decode(uint8_t* out_ptr, const uint8_t decode_buf[4]) {
   52|  5.40k|         out_ptr[0] = (decode_buf[0] << 2) | (decode_buf[1] >> 4);
   53|  5.40k|         out_ptr[1] = (decode_buf[1] << 4) | (decode_buf[2] >> 2);
   54|  5.40k|         out_ptr[2] = (decode_buf[2] << 6) | decode_buf[3];
   55|  5.40k|      }
base64.cpp:_ZN5Botan12_GLOBAL__N_16Base6415bytes_to_removeEm:
   57|    117|      static inline size_t bytes_to_remove(size_t final_truncate) { return final_truncate; }
base64.cpp:_ZN5Botan12_GLOBAL__N_16Base644nameEv:
   23|     18|      static inline std::string name() noexcept { return "base64"; }

_ZN5Botan10hex_encodeEPcPKhmb:
   33|  6.27k|void hex_encode(char output[], const uint8_t input[], size_t input_length, bool uppercase) {
   34|   169k|   for(size_t i = 0; i != input_length; ++i) {
  ------------------
  |  Branch (34:22): [True: 163k, False: 6.27k]
  ------------------
   35|   163k|      const uint8_t n0 = (input[i] >> 4) & 0xF;
   36|   163k|      const uint8_t n1 = (input[i]) & 0xF;
   37|       |
   38|   163k|      output[2 * i] = hex_encode_nibble(n0, uppercase);
   39|   163k|      output[2 * i + 1] = hex_encode_nibble(n1, uppercase);
   40|   163k|   }
   41|  6.27k|}
_ZN5Botan10hex_encodeEPKhmb:
   43|  6.27k|std::string hex_encode(const uint8_t input[], size_t input_length, bool uppercase) {
   44|  6.27k|   std::string output(2 * input_length, 0);
   45|       |
   46|  6.27k|   if(input_length) {
  ------------------
  |  Branch (46:7): [True: 6.27k, False: 0]
  ------------------
   47|  6.27k|      hex_encode(&output.front(), input, input_length, uppercase);
   48|  6.27k|   }
   49|       |
   50|  6.27k|   return output;
   51|  6.27k|}
_ZN5Botan10hex_decodeEPhPKcmRmb:
   81|    762|size_t hex_decode(uint8_t output[], const char input[], size_t input_length, size_t& input_consumed, bool ignore_ws) {
   82|    762|   uint8_t* out_ptr = output;
   83|    762|   bool top_nibble = true;
   84|       |
   85|    762|   clear_mem(output, input_length / 2);
   86|       |
   87|  40.5k|   for(size_t i = 0; i != input_length; ++i) {
  ------------------
  |  Branch (87:22): [True: 39.8k, False: 762]
  ------------------
   88|  39.8k|      const uint8_t bin = hex_char_to_bin(input[i]);
   89|       |
   90|  39.8k|      if(bin >= 0x10) {
  ------------------
  |  Branch (90:10): [True: 0, False: 39.8k]
  ------------------
   91|      0|         if(bin == 0x80 && ignore_ws) {
  ------------------
  |  Branch (91:13): [True: 0, False: 0]
  |  Branch (91:28): [True: 0, False: 0]
  ------------------
   92|      0|            continue;
   93|      0|         }
   94|       |
   95|      0|         throw Invalid_Argument(fmt("hex_decode: invalid character '{}'", format_char_for_display(input[i])));
   96|      0|      }
   97|       |
   98|  39.8k|      if(top_nibble) {
  ------------------
  |  Branch (98:10): [True: 19.9k, False: 19.9k]
  ------------------
   99|  19.9k|         *out_ptr |= bin << 4;
  100|  19.9k|      } else {
  101|  19.9k|         *out_ptr |= bin;
  102|  19.9k|      }
  103|       |
  104|  39.8k|      top_nibble = !top_nibble;
  105|  39.8k|      if(top_nibble) {
  ------------------
  |  Branch (105:10): [True: 19.9k, False: 19.9k]
  ------------------
  106|  19.9k|         ++out_ptr;
  107|  19.9k|      }
  108|  39.8k|   }
  109|       |
  110|    762|   input_consumed = input_length;
  111|    762|   size_t written = (out_ptr - output);
  112|       |
  113|       |   /*
  114|       |   * We only got half of a uint8_t at the end; zap the half-written
  115|       |   * output and mark it as unread
  116|       |   */
  117|    762|   if(!top_nibble) {
  ------------------
  |  Branch (117:7): [True: 0, False: 762]
  ------------------
  118|      0|      *out_ptr = 0;
  119|      0|      input_consumed -= 1;
  120|      0|   }
  121|       |
  122|    762|   return written;
  123|    762|}
_ZN5Botan10hex_decodeEPhPKcmb:
  125|    762|size_t hex_decode(uint8_t output[], const char input[], size_t input_length, bool ignore_ws) {
  126|    762|   size_t consumed = 0;
  127|    762|   size_t written = hex_decode(output, input, input_length, consumed, ignore_ws);
  128|       |
  129|    762|   if(consumed != input_length) {
  ------------------
  |  Branch (129:7): [True: 0, False: 762]
  ------------------
  130|      0|      throw Invalid_Argument("hex_decode: input did not have full bytes");
  131|      0|   }
  132|       |
  133|    762|   return written;
  134|    762|}
_ZN5Botan17hex_decode_lockedEPKcmb:
  144|    762|secure_vector<uint8_t> hex_decode_locked(const char input[], size_t input_length, bool ignore_ws) {
  145|    762|   secure_vector<uint8_t> bin(1 + input_length / 2);
  146|       |
  147|    762|   size_t written = hex_decode(bin.data(), input, input_length, ignore_ws);
  148|       |
  149|    762|   bin.resize(written);
  150|    762|   return bin;
  151|    762|}
hex.cpp:_ZN5Botan12_GLOBAL__N_117hex_encode_nibbleEhb:
   20|   326k|char hex_encode_nibble(uint8_t n, bool uppercase) {
   21|   326k|   BOTAN_DEBUG_ASSERT(n <= 15);
  ------------------
  |  |   99|   326k|      do {                          \
  |  |  100|   326k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   22|       |
   23|   326k|   const auto in_09 = CT::Mask<uint8_t>::is_lt(n, 10);
   24|       |
   25|   326k|   const char c_09 = n + '0';
   26|   326k|   const char c_af = n + (uppercase ? 'A' : 'a') - 10;
  ------------------
  |  Branch (26:27): [True: 326k, False: 0]
  ------------------
   27|       |
   28|   326k|   return in_09.select(c_09, c_af);
   29|   326k|}
hex.cpp:_ZN5Botan12_GLOBAL__N_115hex_char_to_binEc:
   55|  39.8k|uint8_t hex_char_to_bin(char input) {
   56|  39.8k|   const uint8_t c = static_cast<uint8_t>(input);
   57|       |
   58|  39.8k|   const auto is_alpha_upper = CT::Mask<uint8_t>::is_within_range(c, uint8_t('A'), uint8_t('F'));
   59|  39.8k|   const auto is_alpha_lower = CT::Mask<uint8_t>::is_within_range(c, uint8_t('a'), uint8_t('f'));
   60|  39.8k|   const auto is_decimal = CT::Mask<uint8_t>::is_within_range(c, uint8_t('0'), uint8_t('9'));
   61|       |
   62|  39.8k|   const auto is_whitespace =
   63|  39.8k|      CT::Mask<uint8_t>::is_any_of(c, {uint8_t(' '), uint8_t('\t'), uint8_t('\n'), uint8_t('\r')});
   64|       |
   65|  39.8k|   const uint8_t c_upper = c - uint8_t('A') + 10;
   66|  39.8k|   const uint8_t c_lower = c - uint8_t('a') + 10;
   67|  39.8k|   const uint8_t c_decim = c - uint8_t('0');
   68|       |
   69|  39.8k|   uint8_t ret = 0xFF;  // default value
   70|       |
   71|  39.8k|   ret = is_alpha_upper.select(c_upper, ret);
   72|  39.8k|   ret = is_alpha_lower.select(c_lower, ret);
   73|  39.8k|   ret = is_decimal.select(c_decim, ret);
   74|  39.8k|   ret = is_whitespace.select(0x80, ret);
   75|       |
   76|  39.8k|   return ret;
   77|  39.8k|}

_ZN5Botan12HashFunction6createENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_:
  107|  13.4k|std::unique_ptr<HashFunction> HashFunction::create(std::string_view algo_spec, std::string_view provider) {
  108|       |#if defined(BOTAN_HAS_COMMONCRYPTO)
  109|       |   if(provider.empty() || provider == "commoncrypto") {
  110|       |      if(auto hash = make_commoncrypto_hash(algo_spec))
  111|       |         return hash;
  112|       |
  113|       |      if(!provider.empty())
  114|       |         return nullptr;
  115|       |   }
  116|       |#endif
  117|       |
  118|  13.4k|   if(provider.empty() == false && provider != "base") {
  ------------------
  |  Branch (118:7): [True: 0, False: 13.4k]
  |  Branch (118:36): [True: 0, False: 0]
  ------------------
  119|      0|      return nullptr;  // unknown provider
  120|      0|   }
  121|       |
  122|  13.4k|#if defined(BOTAN_HAS_SHA1)
  123|  13.4k|   if(algo_spec == "SHA-1") {
  ------------------
  |  Branch (123:7): [True: 6.42k, False: 6.99k]
  ------------------
  124|  6.42k|      return std::make_unique<SHA_1>();
  125|  6.42k|   }
  126|  6.99k|#endif
  127|       |
  128|  6.99k|#if defined(BOTAN_HAS_SHA2_32)
  129|  6.99k|   if(algo_spec == "SHA-224") {
  ------------------
  |  Branch (129:7): [True: 180, False: 6.81k]
  ------------------
  130|    180|      return std::make_unique<SHA_224>();
  131|    180|   }
  132|       |
  133|  6.81k|   if(algo_spec == "SHA-256") {
  ------------------
  |  Branch (133:7): [True: 6.35k, False: 458]
  ------------------
  134|  6.35k|      return std::make_unique<SHA_256>();
  135|  6.35k|   }
  136|    458|#endif
  137|       |
  138|    458|#if defined(BOTAN_HAS_SHA2_64)
  139|    458|   if(algo_spec == "SHA-384") {
  ------------------
  |  Branch (139:7): [True: 229, False: 229]
  ------------------
  140|    229|      return std::make_unique<SHA_384>();
  141|    229|   }
  142|       |
  143|    229|   if(algo_spec == "SHA-512") {
  ------------------
  |  Branch (143:7): [True: 24, False: 205]
  ------------------
  144|     24|      return std::make_unique<SHA_512>();
  145|     24|   }
  146|       |
  147|    205|   if(algo_spec == "SHA-512-256") {
  ------------------
  |  Branch (147:7): [True: 16, False: 189]
  ------------------
  148|     16|      return std::make_unique<SHA_512_256>();
  149|     16|   }
  150|    189|#endif
  151|       |
  152|    189|#if defined(BOTAN_HAS_RIPEMD_160)
  153|    189|   if(algo_spec == "RIPEMD-160") {
  ------------------
  |  Branch (153:7): [True: 0, False: 189]
  ------------------
  154|      0|      return std::make_unique<RIPEMD_160>();
  155|      0|   }
  156|    189|#endif
  157|       |
  158|    189|#if defined(BOTAN_HAS_WHIRLPOOL)
  159|    189|   if(algo_spec == "Whirlpool") {
  ------------------
  |  Branch (159:7): [True: 0, False: 189]
  ------------------
  160|      0|      return std::make_unique<Whirlpool>();
  161|      0|   }
  162|    189|#endif
  163|       |
  164|    189|#if defined(BOTAN_HAS_MD5)
  165|    189|   if(algo_spec == "MD5") {
  ------------------
  |  Branch (165:7): [True: 116, False: 73]
  ------------------
  166|    116|      return std::make_unique<MD5>();
  167|    116|   }
  168|     73|#endif
  169|       |
  170|     73|#if defined(BOTAN_HAS_MD4)
  171|     73|   if(algo_spec == "MD4") {
  ------------------
  |  Branch (171:7): [True: 0, False: 73]
  ------------------
  172|      0|      return std::make_unique<MD4>();
  173|      0|   }
  174|     73|#endif
  175|       |
  176|     73|#if defined(BOTAN_HAS_GOST_34_11)
  177|     73|   if(algo_spec == "GOST-R-34.11-94" || algo_spec == "GOST-34.11") {
  ------------------
  |  Branch (177:7): [True: 0, False: 73]
  |  Branch (177:41): [True: 0, False: 73]
  ------------------
  178|      0|      return std::make_unique<GOST_34_11>();
  179|      0|   }
  180|     73|#endif
  181|       |
  182|     73|#if defined(BOTAN_HAS_ADLER32)
  183|     73|   if(algo_spec == "Adler32") {
  ------------------
  |  Branch (183:7): [True: 0, False: 73]
  ------------------
  184|      0|      return std::make_unique<Adler32>();
  185|      0|   }
  186|     73|#endif
  187|       |
  188|     73|#if defined(BOTAN_HAS_CRC24)
  189|     73|   if(algo_spec == "CRC24") {
  ------------------
  |  Branch (189:7): [True: 0, False: 73]
  ------------------
  190|      0|      return std::make_unique<CRC24>();
  191|      0|   }
  192|     73|#endif
  193|       |
  194|     73|#if defined(BOTAN_HAS_CRC32)
  195|     73|   if(algo_spec == "CRC32") {
  ------------------
  |  Branch (195:7): [True: 0, False: 73]
  ------------------
  196|      0|      return std::make_unique<CRC32>();
  197|      0|   }
  198|     73|#endif
  199|       |
  200|     73|#if defined(BOTAN_HAS_STREEBOG)
  201|     73|   if(algo_spec == "Streebog-256") {
  ------------------
  |  Branch (201:7): [True: 71, False: 2]
  ------------------
  202|     71|      return std::make_unique<Streebog>(256);
  203|     71|   }
  204|      2|   if(algo_spec == "Streebog-512") {
  ------------------
  |  Branch (204:7): [True: 2, False: 0]
  ------------------
  205|      2|      return std::make_unique<Streebog>(512);
  206|      2|   }
  207|      0|#endif
  208|       |
  209|      0|#if defined(BOTAN_HAS_SM3)
  210|      0|   if(algo_spec == "SM3") {
  ------------------
  |  Branch (210:7): [True: 0, False: 0]
  ------------------
  211|      0|      return std::make_unique<SM3>();
  212|      0|   }
  213|      0|#endif
  214|       |
  215|      0|   const SCAN_Name req(algo_spec);
  216|       |
  217|      0|#if defined(BOTAN_HAS_SKEIN_512)
  218|      0|   if(req.algo_name() == "Skein-512") {
  ------------------
  |  Branch (218:7): [True: 0, False: 0]
  ------------------
  219|      0|      return std::make_unique<Skein_512>(req.arg_as_integer(0, 512), req.arg(1, ""));
  220|      0|   }
  221|      0|#endif
  222|       |
  223|      0|#if defined(BOTAN_HAS_BLAKE2B)
  224|      0|   if(req.algo_name() == "Blake2b" || req.algo_name() == "BLAKE2b") {
  ------------------
  |  Branch (224:7): [True: 0, False: 0]
  |  Branch (224:39): [True: 0, False: 0]
  ------------------
  225|      0|      return std::make_unique<BLAKE2b>(req.arg_as_integer(0, 512));
  226|      0|   }
  227|      0|#endif
  228|       |
  229|      0|#if defined(BOTAN_HAS_BLAKE2S)
  230|      0|   if(req.algo_name() == "Blake2s" || req.algo_name() == "BLAKE2s") {
  ------------------
  |  Branch (230:7): [True: 0, False: 0]
  |  Branch (230:39): [True: 0, False: 0]
  ------------------
  231|      0|      return std::make_unique<BLAKE2s>(req.arg_as_integer(0, 256));
  232|      0|   }
  233|      0|#endif
  234|       |
  235|      0|#if defined(BOTAN_HAS_KECCAK)
  236|      0|   if(req.algo_name() == "Keccak-1600") {
  ------------------
  |  Branch (236:7): [True: 0, False: 0]
  ------------------
  237|      0|      return std::make_unique<Keccak_1600>(req.arg_as_integer(0, 512));
  238|      0|   }
  239|      0|#endif
  240|       |
  241|      0|#if defined(BOTAN_HAS_SHA3)
  242|      0|   if(req.algo_name() == "SHA-3") {
  ------------------
  |  Branch (242:7): [True: 0, False: 0]
  ------------------
  243|      0|      return std::make_unique<SHA_3>(req.arg_as_integer(0, 512));
  244|      0|   }
  245|      0|#endif
  246|       |
  247|      0|#if defined(BOTAN_HAS_SHAKE)
  248|      0|   if(req.algo_name() == "SHAKE-128" && req.arg_count() == 1) {
  ------------------
  |  Branch (248:7): [True: 0, False: 0]
  |  Branch (248:41): [True: 0, False: 0]
  ------------------
  249|      0|      return std::make_unique<SHAKE_128>(req.arg_as_integer(0));
  250|      0|   }
  251|      0|   if(req.algo_name() == "SHAKE-256" && req.arg_count() == 1) {
  ------------------
  |  Branch (251:7): [True: 0, False: 0]
  |  Branch (251:41): [True: 0, False: 0]
  ------------------
  252|      0|      return std::make_unique<SHAKE_256>(req.arg_as_integer(0));
  253|      0|   }
  254|      0|#endif
  255|       |
  256|      0|#if defined(BOTAN_HAS_PARALLEL_HASH)
  257|      0|   if(req.algo_name() == "Parallel") {
  ------------------
  |  Branch (257:7): [True: 0, False: 0]
  ------------------
  258|      0|      std::vector<std::unique_ptr<HashFunction>> hashes;
  259|       |
  260|      0|      for(size_t i = 0; i != req.arg_count(); ++i) {
  ------------------
  |  Branch (260:25): [True: 0, False: 0]
  ------------------
  261|      0|         auto h = HashFunction::create(req.arg(i));
  262|      0|         if(!h) {
  ------------------
  |  Branch (262:13): [True: 0, False: 0]
  ------------------
  263|      0|            return nullptr;
  264|      0|         }
  265|      0|         hashes.push_back(std::move(h));
  266|      0|      }
  267|       |
  268|      0|      return std::make_unique<Parallel>(hashes);
  269|      0|   }
  270|      0|#endif
  271|       |
  272|      0|#if defined(BOTAN_HAS_TRUNCATED_HASH)
  273|      0|   if(req.algo_name() == "Truncated" && req.arg_count() == 2) {
  ------------------
  |  Branch (273:7): [True: 0, False: 0]
  |  Branch (273:41): [True: 0, False: 0]
  ------------------
  274|      0|      auto hash = HashFunction::create(req.arg(0));
  275|      0|      if(!hash) {
  ------------------
  |  Branch (275:10): [True: 0, False: 0]
  ------------------
  276|      0|         return nullptr;
  277|      0|      }
  278|       |
  279|      0|      return std::make_unique<Truncated_Hash>(std::move(hash), req.arg_as_integer(1));
  280|      0|   }
  281|      0|#endif
  282|       |
  283|      0|#if defined(BOTAN_HAS_COMB4P)
  284|      0|   if(req.algo_name() == "Comb4P" && req.arg_count() == 2) {
  ------------------
  |  Branch (284:7): [True: 0, False: 0]
  |  Branch (284:38): [True: 0, False: 0]
  ------------------
  285|      0|      auto h1 = HashFunction::create(req.arg(0));
  286|      0|      auto h2 = HashFunction::create(req.arg(1));
  287|       |
  288|      0|      if(h1 && h2) {
  ------------------
  |  Branch (288:10): [True: 0, False: 0]
  |  Branch (288:16): [True: 0, False: 0]
  ------------------
  289|      0|         return std::make_unique<Comb4P>(std::move(h1), std::move(h2));
  290|      0|      }
  291|      0|   }
  292|      0|#endif
  293|       |
  294|      0|   return nullptr;
  295|      0|}
_ZN5Botan12HashFunction15create_or_throwENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_:
  298|  6.69k|std::unique_ptr<HashFunction> HashFunction::create_or_throw(std::string_view algo, std::string_view provider) {
  299|  6.69k|   if(auto hash = HashFunction::create(algo, provider)) {
  ------------------
  |  Branch (299:12): [True: 6.69k, False: 0]
  ------------------
  300|  6.69k|      return hash;
  301|  6.69k|   }
  302|      0|   throw Lookup_Error("Hash", algo, provider);
  303|  6.69k|}

_ZN5Botan3MD510compress_nERNSt3__16vectorIjNS_16secure_allocatorIjEEEENS1_4spanIKhLm18446744073709551615EEEm:
   62|    233|void MD5::compress_n(MD5::digest_type& digest, std::span<const uint8_t> input, size_t blocks) {
   63|    233|   uint32_t A = digest[0], B = digest[1], C = digest[2], D = digest[3];
   64|    233|   std::array<uint32_t, 16> M;
   65|       |
   66|    233|   BufferSlicer in(input);
   67|       |
   68|    717|   for(size_t i = 0; i != blocks; ++i) {
  ------------------
  |  Branch (68:22): [True: 484, False: 233]
  ------------------
   69|    484|      load_le(M.data(), in.take(block_bytes).data(), M.size());
   70|       |
   71|    484|      FF<7>(A, B, C, D, M[0] + 0xD76AA478);
   72|    484|      FF<12>(D, A, B, C, M[1] + 0xE8C7B756);
   73|    484|      FF<17>(C, D, A, B, M[2] + 0x242070DB);
   74|    484|      FF<22>(B, C, D, A, M[3] + 0xC1BDCEEE);
   75|    484|      FF<7>(A, B, C, D, M[4] + 0xF57C0FAF);
   76|    484|      FF<12>(D, A, B, C, M[5] + 0x4787C62A);
   77|    484|      FF<17>(C, D, A, B, M[6] + 0xA8304613);
   78|    484|      FF<22>(B, C, D, A, M[7] + 0xFD469501);
   79|    484|      FF<7>(A, B, C, D, M[8] + 0x698098D8);
   80|    484|      FF<12>(D, A, B, C, M[9] + 0x8B44F7AF);
   81|    484|      FF<17>(C, D, A, B, M[10] + 0xFFFF5BB1);
   82|    484|      FF<22>(B, C, D, A, M[11] + 0x895CD7BE);
   83|    484|      FF<7>(A, B, C, D, M[12] + 0x6B901122);
   84|    484|      FF<12>(D, A, B, C, M[13] + 0xFD987193);
   85|    484|      FF<17>(C, D, A, B, M[14] + 0xA679438E);
   86|    484|      FF<22>(B, C, D, A, M[15] + 0x49B40821);
   87|       |
   88|    484|      GG<5>(A, B, C, D, M[1] + 0xF61E2562);
   89|    484|      GG<9>(D, A, B, C, M[6] + 0xC040B340);
   90|    484|      GG<14>(C, D, A, B, M[11] + 0x265E5A51);
   91|    484|      GG<20>(B, C, D, A, M[0] + 0xE9B6C7AA);
   92|    484|      GG<5>(A, B, C, D, M[5] + 0xD62F105D);
   93|    484|      GG<9>(D, A, B, C, M[10] + 0x02441453);
   94|    484|      GG<14>(C, D, A, B, M[15] + 0xD8A1E681);
   95|    484|      GG<20>(B, C, D, A, M[4] + 0xE7D3FBC8);
   96|    484|      GG<5>(A, B, C, D, M[9] + 0x21E1CDE6);
   97|    484|      GG<9>(D, A, B, C, M[14] + 0xC33707D6);
   98|    484|      GG<14>(C, D, A, B, M[3] + 0xF4D50D87);
   99|    484|      GG<20>(B, C, D, A, M[8] + 0x455A14ED);
  100|    484|      GG<5>(A, B, C, D, M[13] + 0xA9E3E905);
  101|    484|      GG<9>(D, A, B, C, M[2] + 0xFCEFA3F8);
  102|    484|      GG<14>(C, D, A, B, M[7] + 0x676F02D9);
  103|    484|      GG<20>(B, C, D, A, M[12] + 0x8D2A4C8A);
  104|       |
  105|    484|      HH<4>(A, B, C, D, M[5] + 0xFFFA3942);
  106|    484|      HH<11>(D, A, B, C, M[8] + 0x8771F681);
  107|    484|      HH<16>(C, D, A, B, M[11] + 0x6D9D6122);
  108|    484|      HH<23>(B, C, D, A, M[14] + 0xFDE5380C);
  109|    484|      HH<4>(A, B, C, D, M[1] + 0xA4BEEA44);
  110|    484|      HH<11>(D, A, B, C, M[4] + 0x4BDECFA9);
  111|    484|      HH<16>(C, D, A, B, M[7] + 0xF6BB4B60);
  112|    484|      HH<23>(B, C, D, A, M[10] + 0xBEBFBC70);
  113|    484|      HH<4>(A, B, C, D, M[13] + 0x289B7EC6);
  114|    484|      HH<11>(D, A, B, C, M[0] + 0xEAA127FA);
  115|    484|      HH<16>(C, D, A, B, M[3] + 0xD4EF3085);
  116|    484|      HH<23>(B, C, D, A, M[6] + 0x04881D05);
  117|    484|      HH<4>(A, B, C, D, M[9] + 0xD9D4D039);
  118|    484|      HH<11>(D, A, B, C, M[12] + 0xE6DB99E5);
  119|    484|      HH<16>(C, D, A, B, M[15] + 0x1FA27CF8);
  120|    484|      HH<23>(B, C, D, A, M[2] + 0xC4AC5665);
  121|       |
  122|    484|      II<6>(A, B, C, D, M[0] + 0xF4292244);
  123|    484|      II<10>(D, A, B, C, M[7] + 0x432AFF97);
  124|    484|      II<15>(C, D, A, B, M[14] + 0xAB9423A7);
  125|    484|      II<21>(B, C, D, A, M[5] + 0xFC93A039);
  126|    484|      II<6>(A, B, C, D, M[12] + 0x655B59C3);
  127|    484|      II<10>(D, A, B, C, M[3] + 0x8F0CCC92);
  128|    484|      II<15>(C, D, A, B, M[10] + 0xFFEFF47D);
  129|    484|      II<21>(B, C, D, A, M[1] + 0x85845DD1);
  130|    484|      II<6>(A, B, C, D, M[8] + 0x6FA87E4F);
  131|    484|      II<10>(D, A, B, C, M[15] + 0xFE2CE6E0);
  132|    484|      II<15>(C, D, A, B, M[6] + 0xA3014314);
  133|    484|      II<21>(B, C, D, A, M[13] + 0x4E0811A1);
  134|    484|      II<6>(A, B, C, D, M[4] + 0xF7537E82);
  135|    484|      II<10>(D, A, B, C, M[11] + 0xBD3AF235);
  136|    484|      II<15>(C, D, A, B, M[2] + 0x2AD7D2BB);
  137|    484|      II<21>(B, C, D, A, M[9] + 0xEB86D391);
  138|       |
  139|    484|      A = (digest[0] += A);
  140|    484|      B = (digest[1] += B);
  141|    484|      C = (digest[2] += C);
  142|    484|      D = (digest[3] += D);
  143|    484|   }
  144|    233|}
_ZN5Botan3MD54initERNSt3__16vectorIjNS_16secure_allocatorIjEEEE:
  146|    232|void MD5::init(digest_type& digest) {
  147|    232|   digest.assign({0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476});
  148|    232|}
_ZN5Botan3MD58add_dataENSt3__14spanIKhLm18446744073709551615EEE:
  158|    116|void MD5::add_data(std::span<const uint8_t> input) {
  159|    116|   m_md.update(input);
  160|    116|}
_ZN5Botan3MD512final_resultENSt3__14spanIhLm18446744073709551615EEE:
  162|    116|void MD5::final_result(std::span<uint8_t> output) {
  163|    116|   m_md.final(output);
  164|    116|}
md5.cpp:_ZN5Botan12_GLOBAL__N_12FFILm7EEEvRjjjjj:
   24|  1.93k|inline void FF(uint32_t& A, uint32_t B, uint32_t C, uint32_t D, uint32_t M) {
   25|  1.93k|   A += choose(B, C, D) + M;
   26|  1.93k|   A = rotl<S>(A) + B;
   27|  1.93k|}
md5.cpp:_ZN5Botan12_GLOBAL__N_12FFILm12EEEvRjjjjj:
   24|  1.93k|inline void FF(uint32_t& A, uint32_t B, uint32_t C, uint32_t D, uint32_t M) {
   25|  1.93k|   A += choose(B, C, D) + M;
   26|  1.93k|   A = rotl<S>(A) + B;
   27|  1.93k|}
md5.cpp:_ZN5Botan12_GLOBAL__N_12FFILm17EEEvRjjjjj:
   24|  1.93k|inline void FF(uint32_t& A, uint32_t B, uint32_t C, uint32_t D, uint32_t M) {
   25|  1.93k|   A += choose(B, C, D) + M;
   26|  1.93k|   A = rotl<S>(A) + B;
   27|  1.93k|}
md5.cpp:_ZN5Botan12_GLOBAL__N_12FFILm22EEEvRjjjjj:
   24|  1.93k|inline void FF(uint32_t& A, uint32_t B, uint32_t C, uint32_t D, uint32_t M) {
   25|  1.93k|   A += choose(B, C, D) + M;
   26|  1.93k|   A = rotl<S>(A) + B;
   27|  1.93k|}
md5.cpp:_ZN5Botan12_GLOBAL__N_12GGILm5EEEvRjjjjj:
   33|  1.93k|inline void GG(uint32_t& A, uint32_t B, uint32_t C, uint32_t D, uint32_t M) {
   34|  1.93k|   A += choose(D, B, C) + M;
   35|  1.93k|   A = rotl<S>(A) + B;
   36|  1.93k|}
md5.cpp:_ZN5Botan12_GLOBAL__N_12GGILm9EEEvRjjjjj:
   33|  1.93k|inline void GG(uint32_t& A, uint32_t B, uint32_t C, uint32_t D, uint32_t M) {
   34|  1.93k|   A += choose(D, B, C) + M;
   35|  1.93k|   A = rotl<S>(A) + B;
   36|  1.93k|}
md5.cpp:_ZN5Botan12_GLOBAL__N_12GGILm14EEEvRjjjjj:
   33|  1.93k|inline void GG(uint32_t& A, uint32_t B, uint32_t C, uint32_t D, uint32_t M) {
   34|  1.93k|   A += choose(D, B, C) + M;
   35|  1.93k|   A = rotl<S>(A) + B;
   36|  1.93k|}
md5.cpp:_ZN5Botan12_GLOBAL__N_12GGILm20EEEvRjjjjj:
   33|  1.93k|inline void GG(uint32_t& A, uint32_t B, uint32_t C, uint32_t D, uint32_t M) {
   34|  1.93k|   A += choose(D, B, C) + M;
   35|  1.93k|   A = rotl<S>(A) + B;
   36|  1.93k|}
md5.cpp:_ZN5Botan12_GLOBAL__N_12HHILm4EEEvRjjjjj:
   42|  1.93k|inline void HH(uint32_t& A, uint32_t B, uint32_t C, uint32_t D, uint32_t M) {
   43|  1.93k|   A += (B ^ C ^ D) + M;
   44|  1.93k|   A = rotl<S>(A) + B;
   45|  1.93k|}
md5.cpp:_ZN5Botan12_GLOBAL__N_12HHILm11EEEvRjjjjj:
   42|  1.93k|inline void HH(uint32_t& A, uint32_t B, uint32_t C, uint32_t D, uint32_t M) {
   43|  1.93k|   A += (B ^ C ^ D) + M;
   44|  1.93k|   A = rotl<S>(A) + B;
   45|  1.93k|}
md5.cpp:_ZN5Botan12_GLOBAL__N_12HHILm16EEEvRjjjjj:
   42|  1.93k|inline void HH(uint32_t& A, uint32_t B, uint32_t C, uint32_t D, uint32_t M) {
   43|  1.93k|   A += (B ^ C ^ D) + M;
   44|  1.93k|   A = rotl<S>(A) + B;
   45|  1.93k|}
md5.cpp:_ZN5Botan12_GLOBAL__N_12HHILm23EEEvRjjjjj:
   42|  1.93k|inline void HH(uint32_t& A, uint32_t B, uint32_t C, uint32_t D, uint32_t M) {
   43|  1.93k|   A += (B ^ C ^ D) + M;
   44|  1.93k|   A = rotl<S>(A) + B;
   45|  1.93k|}
md5.cpp:_ZN5Botan12_GLOBAL__N_12IIILm6EEEvRjjjjj:
   51|  1.93k|inline void II(uint32_t& A, uint32_t B, uint32_t C, uint32_t D, uint32_t M) {
   52|       |   // This expr is choose(D, B ^ C, ~C), but that is slower
   53|  1.93k|   A += (C ^ (B | ~D)) + M;
   54|  1.93k|   A = rotl<S>(A) + B;
   55|  1.93k|}
md5.cpp:_ZN5Botan12_GLOBAL__N_12IIILm10EEEvRjjjjj:
   51|  1.93k|inline void II(uint32_t& A, uint32_t B, uint32_t C, uint32_t D, uint32_t M) {
   52|       |   // This expr is choose(D, B ^ C, ~C), but that is slower
   53|  1.93k|   A += (C ^ (B | ~D)) + M;
   54|  1.93k|   A = rotl<S>(A) + B;
   55|  1.93k|}
md5.cpp:_ZN5Botan12_GLOBAL__N_12IIILm15EEEvRjjjjj:
   51|  1.93k|inline void II(uint32_t& A, uint32_t B, uint32_t C, uint32_t D, uint32_t M) {
   52|       |   // This expr is choose(D, B ^ C, ~C), but that is slower
   53|  1.93k|   A += (C ^ (B | ~D)) + M;
   54|  1.93k|   A = rotl<S>(A) + B;
   55|  1.93k|}
md5.cpp:_ZN5Botan12_GLOBAL__N_12IIILm21EEEvRjjjjj:
   51|  1.93k|inline void II(uint32_t& A, uint32_t B, uint32_t C, uint32_t D, uint32_t M) {
   52|       |   // This expr is choose(D, B ^ C, ~C), but that is slower
   53|  1.93k|   A += (C ^ (B | ~D)) + M;
   54|  1.93k|   A = rotl<S>(A) + B;
   55|  1.93k|}

_ZN5Botan5SHA_110compress_nERNSt3__16vectorIjNS_16secure_allocatorIjEEEENS1_4spanIKhLm18446744073709551615EEEm:
   63|  12.4k|void SHA_1::compress_n(digest_type& digest, std::span<const uint8_t> input, size_t blocks) {
   64|  12.4k|   using namespace SHA1_F;
   65|       |
   66|  12.4k|#if defined(BOTAN_HAS_SHA1_X86_SHA_NI)
   67|  12.4k|   if(CPUID::has_intel_sha()) {
  ------------------
  |  Branch (67:7): [True: 0, False: 12.4k]
  ------------------
   68|      0|      return sha1_compress_x86(digest, input, blocks);
   69|      0|   }
   70|  12.4k|#endif
   71|       |
   72|       |#if defined(BOTAN_HAS_SHA1_ARMV8)
   73|       |   if(CPUID::has_arm_sha1()) {
   74|       |      return sha1_armv8_compress_n(digest, input, blocks);
   75|       |   }
   76|       |#endif
   77|       |
   78|  12.4k|#if defined(BOTAN_HAS_SHA1_SSE2)
   79|  12.4k|   if(CPUID::has_sse2()) {
  ------------------
  |  Branch (79:7): [True: 12.4k, False: 0]
  ------------------
   80|  12.4k|      return sse2_compress_n(digest, input, blocks);
   81|  12.4k|   }
   82|       |
   83|      0|#endif
   84|       |
   85|      0|   uint32_t A = digest[0], B = digest[1], C = digest[2], D = digest[3], E = digest[4];
   86|      0|   std::array<uint32_t, 80> W;
   87|       |
   88|      0|   BufferSlicer in(input);
   89|       |
   90|      0|   for(size_t i = 0; i != blocks; ++i) {
  ------------------
  |  Branch (90:22): [True: 0, False: 0]
  ------------------
   91|      0|      load_be(W.data(), in.take(block_bytes).data(), 16);
   92|       |
   93|      0|      for(size_t j = 16; j != 80; j += 8) {
  ------------------
  |  Branch (93:26): [True: 0, False: 0]
  ------------------
   94|      0|         W[j] = rotl<1>(W[j - 3] ^ W[j - 8] ^ W[j - 14] ^ W[j - 16]);
   95|      0|         W[j + 1] = rotl<1>(W[j - 2] ^ W[j - 7] ^ W[j - 13] ^ W[j - 15]);
   96|      0|         W[j + 2] = rotl<1>(W[j - 1] ^ W[j - 6] ^ W[j - 12] ^ W[j - 14]);
   97|      0|         W[j + 3] = rotl<1>(W[j] ^ W[j - 5] ^ W[j - 11] ^ W[j - 13]);
   98|      0|         W[j + 4] = rotl<1>(W[j + 1] ^ W[j - 4] ^ W[j - 10] ^ W[j - 12]);
   99|      0|         W[j + 5] = rotl<1>(W[j + 2] ^ W[j - 3] ^ W[j - 9] ^ W[j - 11]);
  100|      0|         W[j + 6] = rotl<1>(W[j + 3] ^ W[j - 2] ^ W[j - 8] ^ W[j - 10]);
  101|      0|         W[j + 7] = rotl<1>(W[j + 4] ^ W[j - 1] ^ W[j - 7] ^ W[j - 9]);
  102|      0|      }
  103|       |
  104|      0|      F1(A, B, C, D, E, W[0]);
  105|      0|      F1(E, A, B, C, D, W[1]);
  106|      0|      F1(D, E, A, B, C, W[2]);
  107|      0|      F1(C, D, E, A, B, W[3]);
  108|      0|      F1(B, C, D, E, A, W[4]);
  109|      0|      F1(A, B, C, D, E, W[5]);
  110|      0|      F1(E, A, B, C, D, W[6]);
  111|      0|      F1(D, E, A, B, C, W[7]);
  112|      0|      F1(C, D, E, A, B, W[8]);
  113|      0|      F1(B, C, D, E, A, W[9]);
  114|      0|      F1(A, B, C, D, E, W[10]);
  115|      0|      F1(E, A, B, C, D, W[11]);
  116|      0|      F1(D, E, A, B, C, W[12]);
  117|      0|      F1(C, D, E, A, B, W[13]);
  118|      0|      F1(B, C, D, E, A, W[14]);
  119|      0|      F1(A, B, C, D, E, W[15]);
  120|      0|      F1(E, A, B, C, D, W[16]);
  121|      0|      F1(D, E, A, B, C, W[17]);
  122|      0|      F1(C, D, E, A, B, W[18]);
  123|      0|      F1(B, C, D, E, A, W[19]);
  124|       |
  125|      0|      F2(A, B, C, D, E, W[20]);
  126|      0|      F2(E, A, B, C, D, W[21]);
  127|      0|      F2(D, E, A, B, C, W[22]);
  128|      0|      F2(C, D, E, A, B, W[23]);
  129|      0|      F2(B, C, D, E, A, W[24]);
  130|      0|      F2(A, B, C, D, E, W[25]);
  131|      0|      F2(E, A, B, C, D, W[26]);
  132|      0|      F2(D, E, A, B, C, W[27]);
  133|      0|      F2(C, D, E, A, B, W[28]);
  134|      0|      F2(B, C, D, E, A, W[29]);
  135|      0|      F2(A, B, C, D, E, W[30]);
  136|      0|      F2(E, A, B, C, D, W[31]);
  137|      0|      F2(D, E, A, B, C, W[32]);
  138|      0|      F2(C, D, E, A, B, W[33]);
  139|      0|      F2(B, C, D, E, A, W[34]);
  140|      0|      F2(A, B, C, D, E, W[35]);
  141|      0|      F2(E, A, B, C, D, W[36]);
  142|      0|      F2(D, E, A, B, C, W[37]);
  143|      0|      F2(C, D, E, A, B, W[38]);
  144|      0|      F2(B, C, D, E, A, W[39]);
  145|       |
  146|      0|      F3(A, B, C, D, E, W[40]);
  147|      0|      F3(E, A, B, C, D, W[41]);
  148|      0|      F3(D, E, A, B, C, W[42]);
  149|      0|      F3(C, D, E, A, B, W[43]);
  150|      0|      F3(B, C, D, E, A, W[44]);
  151|      0|      F3(A, B, C, D, E, W[45]);
  152|      0|      F3(E, A, B, C, D, W[46]);
  153|      0|      F3(D, E, A, B, C, W[47]);
  154|      0|      F3(C, D, E, A, B, W[48]);
  155|      0|      F3(B, C, D, E, A, W[49]);
  156|      0|      F3(A, B, C, D, E, W[50]);
  157|      0|      F3(E, A, B, C, D, W[51]);
  158|      0|      F3(D, E, A, B, C, W[52]);
  159|      0|      F3(C, D, E, A, B, W[53]);
  160|      0|      F3(B, C, D, E, A, W[54]);
  161|      0|      F3(A, B, C, D, E, W[55]);
  162|      0|      F3(E, A, B, C, D, W[56]);
  163|      0|      F3(D, E, A, B, C, W[57]);
  164|      0|      F3(C, D, E, A, B, W[58]);
  165|      0|      F3(B, C, D, E, A, W[59]);
  166|       |
  167|      0|      F4(A, B, C, D, E, W[60]);
  168|      0|      F4(E, A, B, C, D, W[61]);
  169|      0|      F4(D, E, A, B, C, W[62]);
  170|      0|      F4(C, D, E, A, B, W[63]);
  171|      0|      F4(B, C, D, E, A, W[64]);
  172|      0|      F4(A, B, C, D, E, W[65]);
  173|      0|      F4(E, A, B, C, D, W[66]);
  174|      0|      F4(D, E, A, B, C, W[67]);
  175|      0|      F4(C, D, E, A, B, W[68]);
  176|      0|      F4(B, C, D, E, A, W[69]);
  177|      0|      F4(A, B, C, D, E, W[70]);
  178|      0|      F4(E, A, B, C, D, W[71]);
  179|      0|      F4(D, E, A, B, C, W[72]);
  180|      0|      F4(C, D, E, A, B, W[73]);
  181|      0|      F4(B, C, D, E, A, W[74]);
  182|      0|      F4(A, B, C, D, E, W[75]);
  183|      0|      F4(E, A, B, C, D, W[76]);
  184|      0|      F4(D, E, A, B, C, W[77]);
  185|      0|      F4(C, D, E, A, B, W[78]);
  186|      0|      F4(B, C, D, E, A, W[79]);
  187|       |
  188|      0|      A = (digest[0] += A);
  189|      0|      B = (digest[1] += B);
  190|      0|      C = (digest[2] += C);
  191|      0|      D = (digest[3] += D);
  192|      0|      E = (digest[4] += E);
  193|      0|   }
  194|      0|}
_ZN5Botan5SHA_14initERNSt3__16vectorIjNS_16secure_allocatorIjEEEE:
  199|  12.8k|void SHA_1::init(digest_type& digest) {
  200|  12.8k|   digest.assign({0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476, 0xC3D2E1F0});
  201|  12.8k|}
_ZN5Botan5SHA_18add_dataENSt3__14spanIKhLm18446744073709551615EEE:
  233|  6.46k|void SHA_1::add_data(std::span<const uint8_t> input) {
  234|  6.46k|   m_md.update(input);
  235|  6.46k|}
_ZN5Botan5SHA_112final_resultENSt3__14spanIhLm18446744073709551615EEE:
  237|  6.44k|void SHA_1::final_result(std::span<uint8_t> output) {
  238|  6.44k|   m_md.final(output);
  239|  6.44k|}

_ZN5Botan5SHA_115sse2_compress_nERNSt3__16vectorIjNS_16secure_allocatorIjEEEENS1_4spanIKhLm18446744073709551615EEEm:
  115|  12.4k|BOTAN_FUNC_ISA("sse2") void SHA_1::sse2_compress_n(digest_type& digest, std::span<const uint8_t> input, size_t blocks) {
  116|  12.4k|   using namespace SHA1_SSE2_F;
  117|       |
  118|  12.4k|   const SIMD_4x32 K00_19 = SIMD_4x32::splat(0x5A827999);
  119|  12.4k|   const SIMD_4x32 K20_39 = SIMD_4x32::splat(0x6ED9EBA1);
  120|  12.4k|   const SIMD_4x32 K40_59 = SIMD_4x32::splat(0x8F1BBCDC);
  121|  12.4k|   const SIMD_4x32 K60_79 = SIMD_4x32::splat(0xCA62C1D6);
  122|       |
  123|  12.4k|   uint32_t A = digest[0], B = digest[1], C = digest[2], D = digest[3], E = digest[4];
  124|       |
  125|  12.4k|   BufferSlicer in(input);
  126|       |
  127|  51.1k|   for(size_t i = 0; i != blocks; ++i) {
  ------------------
  |  Branch (127:22): [True: 38.6k, False: 12.4k]
  ------------------
  128|  38.6k|      uint32_t PT[4];
  129|       |
  130|  38.6k|      const auto block = in.take(block_bytes);
  131|       |
  132|  38.6k|      SIMD_4x32 W0 = SIMD_4x32::load_be(&block[0]);
  133|  38.6k|      SIMD_4x32 W1 = SIMD_4x32::load_be(&block[16]);
  134|  38.6k|      SIMD_4x32 W2 = SIMD_4x32::load_be(&block[32]);
  135|  38.6k|      SIMD_4x32 W3 = SIMD_4x32::load_be(&block[48]);
  136|       |
  137|  38.6k|      SIMD_4x32 P0 = W0 + K00_19;
  138|  38.6k|      SIMD_4x32 P1 = W1 + K00_19;
  139|  38.6k|      SIMD_4x32 P2 = W2 + K00_19;
  140|  38.6k|      SIMD_4x32 P3 = W3 + K00_19;
  141|       |
  142|  38.6k|      SIMD_4x32(P0).store_le(PT);
  143|  38.6k|      F1(A, B, C, D, E, PT[0]);
  144|  38.6k|      F1(E, A, B, C, D, PT[1]);
  145|  38.6k|      F1(D, E, A, B, C, PT[2]);
  146|  38.6k|      F1(C, D, E, A, B, PT[3]);
  147|  38.6k|      P0 = prep(W0, W1, W2, W3, K00_19);
  148|       |
  149|  38.6k|      SIMD_4x32(P1).store_le(PT);
  150|  38.6k|      F1(B, C, D, E, A, PT[0]);
  151|  38.6k|      F1(A, B, C, D, E, PT[1]);
  152|  38.6k|      F1(E, A, B, C, D, PT[2]);
  153|  38.6k|      F1(D, E, A, B, C, PT[3]);
  154|  38.6k|      P1 = prep(W1, W2, W3, W0, K20_39);
  155|       |
  156|  38.6k|      SIMD_4x32(P2).store_le(PT);
  157|  38.6k|      F1(C, D, E, A, B, PT[0]);
  158|  38.6k|      F1(B, C, D, E, A, PT[1]);
  159|  38.6k|      F1(A, B, C, D, E, PT[2]);
  160|  38.6k|      F1(E, A, B, C, D, PT[3]);
  161|  38.6k|      P2 = prep(W2, W3, W0, W1, K20_39);
  162|       |
  163|  38.6k|      SIMD_4x32(P3).store_le(PT);
  164|  38.6k|      F1(D, E, A, B, C, PT[0]);
  165|  38.6k|      F1(C, D, E, A, B, PT[1]);
  166|  38.6k|      F1(B, C, D, E, A, PT[2]);
  167|  38.6k|      F1(A, B, C, D, E, PT[3]);
  168|  38.6k|      P3 = prep(W3, W0, W1, W2, K20_39);
  169|       |
  170|  38.6k|      SIMD_4x32(P0).store_le(PT);
  171|  38.6k|      F1(E, A, B, C, D, PT[0]);
  172|  38.6k|      F1(D, E, A, B, C, PT[1]);
  173|  38.6k|      F1(C, D, E, A, B, PT[2]);
  174|  38.6k|      F1(B, C, D, E, A, PT[3]);
  175|  38.6k|      P0 = prep(W0, W1, W2, W3, K20_39);
  176|       |
  177|  38.6k|      SIMD_4x32(P1).store_le(PT);
  178|  38.6k|      F2(A, B, C, D, E, PT[0]);
  179|  38.6k|      F2(E, A, B, C, D, PT[1]);
  180|  38.6k|      F2(D, E, A, B, C, PT[2]);
  181|  38.6k|      F2(C, D, E, A, B, PT[3]);
  182|  38.6k|      P1 = prep(W1, W2, W3, W0, K20_39);
  183|       |
  184|  38.6k|      SIMD_4x32(P2).store_le(PT);
  185|  38.6k|      F2(B, C, D, E, A, PT[0]);
  186|  38.6k|      F2(A, B, C, D, E, PT[1]);
  187|  38.6k|      F2(E, A, B, C, D, PT[2]);
  188|  38.6k|      F2(D, E, A, B, C, PT[3]);
  189|  38.6k|      P2 = prep(W2, W3, W0, W1, K40_59);
  190|       |
  191|  38.6k|      SIMD_4x32(P3).store_le(PT);
  192|  38.6k|      F2(C, D, E, A, B, PT[0]);
  193|  38.6k|      F2(B, C, D, E, A, PT[1]);
  194|  38.6k|      F2(A, B, C, D, E, PT[2]);
  195|  38.6k|      F2(E, A, B, C, D, PT[3]);
  196|  38.6k|      P3 = prep(W3, W0, W1, W2, K40_59);
  197|       |
  198|  38.6k|      SIMD_4x32(P0).store_le(PT);
  199|  38.6k|      F2(D, E, A, B, C, PT[0]);
  200|  38.6k|      F2(C, D, E, A, B, PT[1]);
  201|  38.6k|      F2(B, C, D, E, A, PT[2]);
  202|  38.6k|      F2(A, B, C, D, E, PT[3]);
  203|  38.6k|      P0 = prep(W0, W1, W2, W3, K40_59);
  204|       |
  205|  38.6k|      SIMD_4x32(P1).store_le(PT);
  206|  38.6k|      F2(E, A, B, C, D, PT[0]);
  207|  38.6k|      F2(D, E, A, B, C, PT[1]);
  208|  38.6k|      F2(C, D, E, A, B, PT[2]);
  209|  38.6k|      F2(B, C, D, E, A, PT[3]);
  210|  38.6k|      P1 = prep(W1, W2, W3, W0, K40_59);
  211|       |
  212|  38.6k|      SIMD_4x32(P2).store_le(PT);
  213|  38.6k|      F3(A, B, C, D, E, PT[0]);
  214|  38.6k|      F3(E, A, B, C, D, PT[1]);
  215|  38.6k|      F3(D, E, A, B, C, PT[2]);
  216|  38.6k|      F3(C, D, E, A, B, PT[3]);
  217|  38.6k|      P2 = prep(W2, W3, W0, W1, K40_59);
  218|       |
  219|  38.6k|      SIMD_4x32(P3).store_le(PT);
  220|  38.6k|      F3(B, C, D, E, A, PT[0]);
  221|  38.6k|      F3(A, B, C, D, E, PT[1]);
  222|  38.6k|      F3(E, A, B, C, D, PT[2]);
  223|  38.6k|      F3(D, E, A, B, C, PT[3]);
  224|  38.6k|      P3 = prep(W3, W0, W1, W2, K60_79);
  225|       |
  226|  38.6k|      SIMD_4x32(P0).store_le(PT);
  227|  38.6k|      F3(C, D, E, A, B, PT[0]);
  228|  38.6k|      F3(B, C, D, E, A, PT[1]);
  229|  38.6k|      F3(A, B, C, D, E, PT[2]);
  230|  38.6k|      F3(E, A, B, C, D, PT[3]);
  231|  38.6k|      P0 = prep(W0, W1, W2, W3, K60_79);
  232|       |
  233|  38.6k|      SIMD_4x32(P1).store_le(PT);
  234|  38.6k|      F3(D, E, A, B, C, PT[0]);
  235|  38.6k|      F3(C, D, E, A, B, PT[1]);
  236|  38.6k|      F3(B, C, D, E, A, PT[2]);
  237|  38.6k|      F3(A, B, C, D, E, PT[3]);
  238|  38.6k|      P1 = prep(W1, W2, W3, W0, K60_79);
  239|       |
  240|  38.6k|      SIMD_4x32(P2).store_le(PT);
  241|  38.6k|      F3(E, A, B, C, D, PT[0]);
  242|  38.6k|      F3(D, E, A, B, C, PT[1]);
  243|  38.6k|      F3(C, D, E, A, B, PT[2]);
  244|  38.6k|      F3(B, C, D, E, A, PT[3]);
  245|  38.6k|      P2 = prep(W2, W3, W0, W1, K60_79);
  246|       |
  247|  38.6k|      SIMD_4x32(P3).store_le(PT);
  248|  38.6k|      F4(A, B, C, D, E, PT[0]);
  249|  38.6k|      F4(E, A, B, C, D, PT[1]);
  250|  38.6k|      F4(D, E, A, B, C, PT[2]);
  251|  38.6k|      F4(C, D, E, A, B, PT[3]);
  252|  38.6k|      P3 = prep(W3, W0, W1, W2, K60_79);
  253|       |
  254|  38.6k|      SIMD_4x32(P0).store_le(PT);
  255|  38.6k|      F4(B, C, D, E, A, PT[0]);
  256|  38.6k|      F4(A, B, C, D, E, PT[1]);
  257|  38.6k|      F4(E, A, B, C, D, PT[2]);
  258|  38.6k|      F4(D, E, A, B, C, PT[3]);
  259|       |
  260|  38.6k|      SIMD_4x32(P1).store_le(PT);
  261|  38.6k|      F4(C, D, E, A, B, PT[0]);
  262|  38.6k|      F4(B, C, D, E, A, PT[1]);
  263|  38.6k|      F4(A, B, C, D, E, PT[2]);
  264|  38.6k|      F4(E, A, B, C, D, PT[3]);
  265|       |
  266|  38.6k|      SIMD_4x32(P2).store_le(PT);
  267|  38.6k|      F4(D, E, A, B, C, PT[0]);
  268|  38.6k|      F4(C, D, E, A, B, PT[1]);
  269|  38.6k|      F4(B, C, D, E, A, PT[2]);
  270|  38.6k|      F4(A, B, C, D, E, PT[3]);
  271|       |
  272|  38.6k|      SIMD_4x32(P3).store_le(PT);
  273|  38.6k|      F4(E, A, B, C, D, PT[0]);
  274|  38.6k|      F4(D, E, A, B, C, PT[1]);
  275|  38.6k|      F4(C, D, E, A, B, PT[2]);
  276|  38.6k|      F4(B, C, D, E, A, PT[3]);
  277|       |
  278|  38.6k|      A = (digest[0] += A);
  279|  38.6k|      B = (digest[1] += B);
  280|  38.6k|      C = (digest[2] += C);
  281|  38.6k|      D = (digest[3] += D);
  282|  38.6k|      E = (digest[4] += E);
  283|  38.6k|   }
  284|  12.4k|}
sha1_sse2.cpp:_ZN5Botan11SHA1_SSE2_F12_GLOBAL__N_12F1EjRjjjS2_j:
   78|   773k|inline void F1(uint32_t A, uint32_t& B, uint32_t C, uint32_t D, uint32_t& E, uint32_t msg) {
   79|   773k|   E += choose(B, C, D) + msg + rotl<5>(A);
   80|   773k|   B = rotl<30>(B);
   81|   773k|}
sha1_sse2.cpp:_ZN5Botan11SHA1_SSE2_F12_GLOBAL__N_14prepERNS_9SIMD_4x32ES2_S2_S2_S2_:
   51|   618k|BOTAN_FORCE_INLINE SIMD_4x32 prep(SIMD_4x32& XW0, SIMD_4x32 XW1, SIMD_4x32 XW2, SIMD_4x32 XW3, SIMD_4x32 K) {
   52|   618k|   SIMD_4x32 T0 = XW0;
   53|       |   /* load W[t-4] 16-byte aligned, and shift */
   54|   618k|   SIMD_4x32 T2 = XW3.shift_elems_right<1>();
   55|       |   /* get high 64-bits of XW0 into low 64-bits */
   56|   618k|   SIMD_4x32 T1 = SIMD_4x32(_mm_shuffle_epi32(XW0.raw(), _MM_SHUFFLE(1, 0, 3, 2)));
   57|       |   /* load high 64-bits of T1 */
   58|   618k|   T1 = SIMD_4x32(_mm_unpacklo_epi64(T1.raw(), XW1.raw()));
   59|       |
   60|   618k|   T0 ^= T1;
   61|   618k|   T2 ^= XW2;
   62|   618k|   T0 ^= T2;
   63|       |   /* unrotated W[t]..W[t+2] in T0 ... still need W[t+3] */
   64|       |
   65|   618k|   T2 = T0.shift_elems_left<3>();
   66|   618k|   T0 = T0.rotl<1>();
   67|   618k|   T2 = T2.rotl<2>();
   68|       |
   69|   618k|   T0 ^= T2; /* T0 now has W[t+3] */
   70|       |
   71|   618k|   XW0 = T0;
   72|   618k|   return T0 + K;
   73|   618k|}
sha1_sse2.cpp:_ZN5Botan11SHA1_SSE2_F12_GLOBAL__N_12F2EjRjjjS2_j:
   86|   773k|inline void F2(uint32_t A, uint32_t& B, uint32_t C, uint32_t D, uint32_t& E, uint32_t msg) {
   87|   773k|   E += (B ^ C ^ D) + msg + rotl<5>(A);
   88|   773k|   B = rotl<30>(B);
   89|   773k|}
sha1_sse2.cpp:_ZN5Botan11SHA1_SSE2_F12_GLOBAL__N_12F3EjRjjjS2_j:
   94|   773k|inline void F3(uint32_t A, uint32_t& B, uint32_t C, uint32_t D, uint32_t& E, uint32_t msg) {
   95|   773k|   E += majority(B, C, D) + msg + rotl<5>(A);
   96|   773k|   B = rotl<30>(B);
   97|   773k|}
sha1_sse2.cpp:_ZN5Botan11SHA1_SSE2_F12_GLOBAL__N_12F4EjRjjjS2_j:
  102|   773k|inline void F4(uint32_t A, uint32_t& B, uint32_t C, uint32_t D, uint32_t& E, uint32_t msg) {
  103|   773k|   E += (B ^ C ^ D) + msg + rotl<5>(A);
  104|   773k|   B = rotl<30>(B);
  105|   773k|}

_ZN5Botan7SHA_25615compress_digestERNSt3__16vectorIjNS_16secure_allocatorIjEEEENS1_4spanIKhLm18446744073709551615EEEm:
   49|  15.0k|void SHA_256::compress_digest(digest_type& digest, std::span<const uint8_t> input, size_t blocks) {
   50|  15.0k|#if defined(BOTAN_HAS_SHA2_32_X86)
   51|  15.0k|   if(CPUID::has_intel_sha()) {
  ------------------
  |  Branch (51:7): [True: 0, False: 15.0k]
  ------------------
   52|      0|      return SHA_256::compress_digest_x86(digest, input, blocks);
   53|      0|   }
   54|  15.0k|#endif
   55|       |
   56|  15.0k|#if defined(BOTAN_HAS_SHA2_32_X86_BMI2)
   57|  15.0k|   if(CPUID::has_bmi2()) {
  ------------------
  |  Branch (57:7): [True: 15.0k, False: 0]
  ------------------
   58|  15.0k|      return SHA_256::compress_digest_x86_bmi2(digest, input, blocks);
   59|  15.0k|   }
   60|      0|#endif
   61|       |
   62|       |#if defined(BOTAN_HAS_SHA2_32_ARMV8)
   63|       |   if(CPUID::has_arm_sha2()) {
   64|       |      return SHA_256::compress_digest_armv8(digest, input, blocks);
   65|       |   }
   66|       |#endif
   67|       |
   68|      0|   uint32_t A = digest[0], B = digest[1], C = digest[2], D = digest[3], E = digest[4], F = digest[5], G = digest[6],
   69|      0|            H = digest[7];
   70|       |
   71|      0|   BufferSlicer in(input);
   72|       |
   73|      0|   for(size_t i = 0; i != blocks; ++i) {
  ------------------
  |  Branch (73:22): [True: 0, False: 0]
  ------------------
   74|      0|      const auto block = in.take(block_bytes);
   75|       |
   76|      0|      uint32_t W00 = load_be<uint32_t>(block.data(), 0);
   77|      0|      uint32_t W01 = load_be<uint32_t>(block.data(), 1);
   78|      0|      uint32_t W02 = load_be<uint32_t>(block.data(), 2);
   79|      0|      uint32_t W03 = load_be<uint32_t>(block.data(), 3);
   80|      0|      uint32_t W04 = load_be<uint32_t>(block.data(), 4);
   81|      0|      uint32_t W05 = load_be<uint32_t>(block.data(), 5);
   82|      0|      uint32_t W06 = load_be<uint32_t>(block.data(), 6);
   83|      0|      uint32_t W07 = load_be<uint32_t>(block.data(), 7);
   84|      0|      uint32_t W08 = load_be<uint32_t>(block.data(), 8);
   85|      0|      uint32_t W09 = load_be<uint32_t>(block.data(), 9);
   86|      0|      uint32_t W10 = load_be<uint32_t>(block.data(), 10);
   87|      0|      uint32_t W11 = load_be<uint32_t>(block.data(), 11);
   88|      0|      uint32_t W12 = load_be<uint32_t>(block.data(), 12);
   89|      0|      uint32_t W13 = load_be<uint32_t>(block.data(), 13);
   90|      0|      uint32_t W14 = load_be<uint32_t>(block.data(), 14);
   91|      0|      uint32_t W15 = load_be<uint32_t>(block.data(), 15);
   92|       |
   93|      0|      SHA2_32_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x428A2F98);
   94|      0|      SHA2_32_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x71374491);
   95|      0|      SHA2_32_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0xB5C0FBCF);
   96|      0|      SHA2_32_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0xE9B5DBA5);
   97|      0|      SHA2_32_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x3956C25B);
   98|      0|      SHA2_32_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x59F111F1);
   99|      0|      SHA2_32_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x923F82A4);
  100|      0|      SHA2_32_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0xAB1C5ED5);
  101|      0|      SHA2_32_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0xD807AA98);
  102|      0|      SHA2_32_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0x12835B01);
  103|      0|      SHA2_32_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0x243185BE);
  104|      0|      SHA2_32_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0x550C7DC3);
  105|      0|      SHA2_32_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0x72BE5D74);
  106|      0|      SHA2_32_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0x80DEB1FE);
  107|      0|      SHA2_32_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0x9BDC06A7);
  108|      0|      SHA2_32_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0xC19BF174);
  109|       |
  110|      0|      SHA2_32_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0xE49B69C1);
  111|      0|      SHA2_32_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0xEFBE4786);
  112|      0|      SHA2_32_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x0FC19DC6);
  113|      0|      SHA2_32_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x240CA1CC);
  114|      0|      SHA2_32_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x2DE92C6F);
  115|      0|      SHA2_32_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x4A7484AA);
  116|      0|      SHA2_32_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x5CB0A9DC);
  117|      0|      SHA2_32_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x76F988DA);
  118|      0|      SHA2_32_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0x983E5152);
  119|      0|      SHA2_32_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0xA831C66D);
  120|      0|      SHA2_32_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0xB00327C8);
  121|      0|      SHA2_32_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0xBF597FC7);
  122|      0|      SHA2_32_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0xC6E00BF3);
  123|      0|      SHA2_32_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xD5A79147);
  124|      0|      SHA2_32_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0x06CA6351);
  125|      0|      SHA2_32_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0x14292967);
  126|       |
  127|      0|      SHA2_32_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x27B70A85);
  128|      0|      SHA2_32_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x2E1B2138);
  129|      0|      SHA2_32_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x4D2C6DFC);
  130|      0|      SHA2_32_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x53380D13);
  131|      0|      SHA2_32_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x650A7354);
  132|      0|      SHA2_32_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x766A0ABB);
  133|      0|      SHA2_32_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x81C2C92E);
  134|      0|      SHA2_32_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x92722C85);
  135|      0|      SHA2_32_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0xA2BFE8A1);
  136|      0|      SHA2_32_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0xA81A664B);
  137|      0|      SHA2_32_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0xC24B8B70);
  138|      0|      SHA2_32_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0xC76C51A3);
  139|      0|      SHA2_32_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0xD192E819);
  140|      0|      SHA2_32_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xD6990624);
  141|      0|      SHA2_32_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0xF40E3585);
  142|      0|      SHA2_32_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0x106AA070);
  143|       |
  144|      0|      SHA2_32_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x19A4C116);
  145|      0|      SHA2_32_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x1E376C08);
  146|      0|      SHA2_32_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x2748774C);
  147|      0|      SHA2_32_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x34B0BCB5);
  148|      0|      SHA2_32_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x391C0CB3);
  149|      0|      SHA2_32_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x4ED8AA4A);
  150|      0|      SHA2_32_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x5B9CCA4F);
  151|      0|      SHA2_32_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x682E6FF3);
  152|      0|      SHA2_32_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0x748F82EE);
  153|      0|      SHA2_32_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0x78A5636F);
  154|      0|      SHA2_32_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0x84C87814);
  155|      0|      SHA2_32_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0x8CC70208);
  156|      0|      SHA2_32_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0x90BEFFFA);
  157|      0|      SHA2_32_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xA4506CEB);
  158|      0|      SHA2_32_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0xBEF9A3F7);
  159|      0|      SHA2_32_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0xC67178F2);
  160|       |
  161|      0|      A = (digest[0] += A);
  162|      0|      B = (digest[1] += B);
  163|      0|      C = (digest[2] += C);
  164|      0|      D = (digest[3] += D);
  165|      0|      E = (digest[4] += E);
  166|      0|      F = (digest[5] += F);
  167|      0|      G = (digest[6] += G);
  168|      0|      H = (digest[7] += H);
  169|      0|   }
  170|      0|}
_ZN5Botan7SHA_22410compress_nERNSt3__16vectorIjNS_16secure_allocatorIjEEEENS1_4spanIKhLm18446744073709551615EEEm:
  176|    361|void SHA_224::compress_n(digest_type& digest, std::span<const uint8_t> input, size_t blocks) {
  177|    361|   SHA_256::compress_digest(digest, input, blocks);
  178|    361|}
_ZN5Botan7SHA_2244initERNSt3__16vectorIjNS_16secure_allocatorIjEEEE:
  180|    360|void SHA_224::init(digest_type& digest) {
  181|    360|   digest.assign({0xC1059ED8, 0x367CD507, 0x3070DD17, 0xF70E5939, 0xFFC00B31, 0x68581511, 0x64F98FA7, 0xBEFA4FA4});
  182|    360|}
_ZN5Botan7SHA_2248add_dataENSt3__14spanIKhLm18446744073709551615EEE:
  192|    180|void SHA_224::add_data(std::span<const uint8_t> input) {
  193|    180|   m_md.update(input);
  194|    180|}
_ZN5Botan7SHA_22412final_resultENSt3__14spanIhLm18446744073709551615EEE:
  196|    180|void SHA_224::final_result(std::span<uint8_t> output) {
  197|    180|   m_md.final(output);
  198|    180|}
_ZN5Botan7SHA_25610compress_nERNSt3__16vectorIjNS_16secure_allocatorIjEEEENS1_4spanIKhLm18446744073709551615EEEm:
  204|  14.6k|void SHA_256::compress_n(digest_type& digest, std::span<const uint8_t> input, size_t blocks) {
  205|  14.6k|   SHA_256::compress_digest(digest, input, blocks);
  206|  14.6k|}
_ZN5Botan7SHA_2564initERNSt3__16vectorIjNS_16secure_allocatorIjEEEE:
  208|  15.9k|void SHA_256::init(digest_type& digest) {
  209|  15.9k|   digest.assign({0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A, 0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19});
  210|  15.9k|}
_ZN5Botan7SHA_2568add_dataENSt3__14spanIKhLm18446744073709551615EEE:
  220|  9.61k|void SHA_256::add_data(std::span<const uint8_t> input) {
  221|  9.61k|   m_md.update(input);
  222|  9.61k|}
_ZN5Botan7SHA_25612final_resultENSt3__14spanIhLm18446744073709551615EEE:
  224|  9.54k|void SHA_256::final_result(std::span<uint8_t> output) {
  225|  9.54k|   m_md.final(output);
  226|  9.54k|}

_ZN5Botan7SHA_25624compress_digest_x86_bmi2ERNSt3__16vectorIjNS_16secure_allocatorIjEEEENS1_4spanIKhLm18446744073709551615EEEm:
   24|  15.0k|void SHA_256::compress_digest_x86_bmi2(digest_type& digest, std::span<const uint8_t> input, size_t blocks) {
   25|  15.0k|   uint32_t A = digest[0], B = digest[1], C = digest[2], D = digest[3], E = digest[4], F = digest[5], G = digest[6],
   26|  15.0k|            H = digest[7];
   27|       |
   28|  15.0k|   BufferSlicer in(input);
   29|       |
   30|  52.6k|   for(size_t i = 0; i != blocks; ++i) {
  ------------------
  |  Branch (30:22): [True: 37.6k, False: 15.0k]
  ------------------
   31|  37.6k|      const auto block = in.take(block_bytes);
   32|       |
   33|  37.6k|      uint32_t W00 = load_be<uint32_t>(block.data(), 0);
   34|  37.6k|      uint32_t W01 = load_be<uint32_t>(block.data(), 1);
   35|  37.6k|      uint32_t W02 = load_be<uint32_t>(block.data(), 2);
   36|  37.6k|      uint32_t W03 = load_be<uint32_t>(block.data(), 3);
   37|  37.6k|      uint32_t W04 = load_be<uint32_t>(block.data(), 4);
   38|  37.6k|      uint32_t W05 = load_be<uint32_t>(block.data(), 5);
   39|  37.6k|      uint32_t W06 = load_be<uint32_t>(block.data(), 6);
   40|  37.6k|      uint32_t W07 = load_be<uint32_t>(block.data(), 7);
   41|  37.6k|      uint32_t W08 = load_be<uint32_t>(block.data(), 8);
   42|  37.6k|      uint32_t W09 = load_be<uint32_t>(block.data(), 9);
   43|  37.6k|      uint32_t W10 = load_be<uint32_t>(block.data(), 10);
   44|  37.6k|      uint32_t W11 = load_be<uint32_t>(block.data(), 11);
   45|  37.6k|      uint32_t W12 = load_be<uint32_t>(block.data(), 12);
   46|  37.6k|      uint32_t W13 = load_be<uint32_t>(block.data(), 13);
   47|  37.6k|      uint32_t W14 = load_be<uint32_t>(block.data(), 14);
   48|  37.6k|      uint32_t W15 = load_be<uint32_t>(block.data(), 15);
   49|       |
   50|  37.6k|      SHA2_32_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x428A2F98);
   51|  37.6k|      SHA2_32_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x71374491);
   52|  37.6k|      SHA2_32_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0xB5C0FBCF);
   53|  37.6k|      SHA2_32_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0xE9B5DBA5);
   54|  37.6k|      SHA2_32_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x3956C25B);
   55|  37.6k|      SHA2_32_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x59F111F1);
   56|  37.6k|      SHA2_32_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x923F82A4);
   57|  37.6k|      SHA2_32_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0xAB1C5ED5);
   58|  37.6k|      SHA2_32_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0xD807AA98);
   59|  37.6k|      SHA2_32_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0x12835B01);
   60|  37.6k|      SHA2_32_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0x243185BE);
   61|  37.6k|      SHA2_32_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0x550C7DC3);
   62|  37.6k|      SHA2_32_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0x72BE5D74);
   63|  37.6k|      SHA2_32_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0x80DEB1FE);
   64|  37.6k|      SHA2_32_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0x9BDC06A7);
   65|  37.6k|      SHA2_32_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0xC19BF174);
   66|       |
   67|  37.6k|      SHA2_32_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0xE49B69C1);
   68|  37.6k|      SHA2_32_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0xEFBE4786);
   69|  37.6k|      SHA2_32_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x0FC19DC6);
   70|  37.6k|      SHA2_32_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x240CA1CC);
   71|  37.6k|      SHA2_32_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x2DE92C6F);
   72|  37.6k|      SHA2_32_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x4A7484AA);
   73|  37.6k|      SHA2_32_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x5CB0A9DC);
   74|  37.6k|      SHA2_32_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x76F988DA);
   75|  37.6k|      SHA2_32_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0x983E5152);
   76|  37.6k|      SHA2_32_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0xA831C66D);
   77|  37.6k|      SHA2_32_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0xB00327C8);
   78|  37.6k|      SHA2_32_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0xBF597FC7);
   79|  37.6k|      SHA2_32_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0xC6E00BF3);
   80|  37.6k|      SHA2_32_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xD5A79147);
   81|  37.6k|      SHA2_32_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0x06CA6351);
   82|  37.6k|      SHA2_32_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0x14292967);
   83|       |
   84|  37.6k|      SHA2_32_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x27B70A85);
   85|  37.6k|      SHA2_32_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x2E1B2138);
   86|  37.6k|      SHA2_32_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x4D2C6DFC);
   87|  37.6k|      SHA2_32_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x53380D13);
   88|  37.6k|      SHA2_32_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x650A7354);
   89|  37.6k|      SHA2_32_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x766A0ABB);
   90|  37.6k|      SHA2_32_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x81C2C92E);
   91|  37.6k|      SHA2_32_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x92722C85);
   92|  37.6k|      SHA2_32_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0xA2BFE8A1);
   93|  37.6k|      SHA2_32_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0xA81A664B);
   94|  37.6k|      SHA2_32_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0xC24B8B70);
   95|  37.6k|      SHA2_32_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0xC76C51A3);
   96|  37.6k|      SHA2_32_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0xD192E819);
   97|  37.6k|      SHA2_32_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xD6990624);
   98|  37.6k|      SHA2_32_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0xF40E3585);
   99|  37.6k|      SHA2_32_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0x106AA070);
  100|       |
  101|  37.6k|      SHA2_32_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x19A4C116);
  102|  37.6k|      SHA2_32_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x1E376C08);
  103|  37.6k|      SHA2_32_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x2748774C);
  104|  37.6k|      SHA2_32_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x34B0BCB5);
  105|  37.6k|      SHA2_32_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x391C0CB3);
  106|  37.6k|      SHA2_32_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x4ED8AA4A);
  107|  37.6k|      SHA2_32_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x5B9CCA4F);
  108|  37.6k|      SHA2_32_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x682E6FF3);
  109|  37.6k|      SHA2_32_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0x748F82EE);
  110|  37.6k|      SHA2_32_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0x78A5636F);
  111|  37.6k|      SHA2_32_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0x84C87814);
  112|  37.6k|      SHA2_32_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0x8CC70208);
  113|  37.6k|      SHA2_32_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0x90BEFFFA);
  114|  37.6k|      SHA2_32_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xA4506CEB);
  115|  37.6k|      SHA2_32_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0xBEF9A3F7);
  116|  37.6k|      SHA2_32_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0xC67178F2);
  117|       |
  118|  37.6k|      A = (digest[0] += A);
  119|  37.6k|      B = (digest[1] += B);
  120|  37.6k|      C = (digest[2] += C);
  121|  37.6k|      D = (digest[3] += D);
  122|  37.6k|      E = (digest[4] += E);
  123|  37.6k|      F = (digest[5] += F);
  124|  37.6k|      G = (digest[6] += G);
  125|  37.6k|      H = (digest[7] += H);
  126|  37.6k|   }
  127|  15.0k|}

_ZN5Botan7SHA_51215compress_digestERNSt3__16vectorImNS_16secure_allocatorImEEEENS1_4spanIKhLm18446744073709551615EEEm:
   43|    674|void SHA_512::compress_digest(digest_type& digest, std::span<const uint8_t> input, size_t blocks) {
   44|    674|#if defined(BOTAN_HAS_SHA2_64_BMI2)
   45|    674|   if(CPUID::has_bmi2()) {
  ------------------
  |  Branch (45:7): [True: 674, False: 0]
  ------------------
   46|    674|      return compress_digest_bmi2(digest, input, blocks);
   47|    674|   }
   48|      0|#endif
   49|       |
   50|       |#if defined(BOTAN_HAS_SHA2_64_ARMV8)
   51|       |   if(CPUID::has_arm_sha2_512()) {
   52|       |      return compress_digest_armv8(digest, input, blocks);
   53|       |   }
   54|       |#endif
   55|       |
   56|      0|   uint64_t A = digest[0], B = digest[1], C = digest[2], D = digest[3], E = digest[4], F = digest[5], G = digest[6],
   57|      0|            H = digest[7];
   58|       |
   59|      0|   BufferSlicer in(input);
   60|       |
   61|      0|   for(size_t i = 0; i != blocks; ++i) {
  ------------------
  |  Branch (61:22): [True: 0, False: 0]
  ------------------
   62|      0|      const auto block = in.take(block_bytes);
   63|       |
   64|      0|      uint64_t W00 = load_be<uint64_t>(block.data(), 0);
   65|      0|      uint64_t W01 = load_be<uint64_t>(block.data(), 1);
   66|      0|      uint64_t W02 = load_be<uint64_t>(block.data(), 2);
   67|      0|      uint64_t W03 = load_be<uint64_t>(block.data(), 3);
   68|      0|      uint64_t W04 = load_be<uint64_t>(block.data(), 4);
   69|      0|      uint64_t W05 = load_be<uint64_t>(block.data(), 5);
   70|      0|      uint64_t W06 = load_be<uint64_t>(block.data(), 6);
   71|      0|      uint64_t W07 = load_be<uint64_t>(block.data(), 7);
   72|      0|      uint64_t W08 = load_be<uint64_t>(block.data(), 8);
   73|      0|      uint64_t W09 = load_be<uint64_t>(block.data(), 9);
   74|      0|      uint64_t W10 = load_be<uint64_t>(block.data(), 10);
   75|      0|      uint64_t W11 = load_be<uint64_t>(block.data(), 11);
   76|      0|      uint64_t W12 = load_be<uint64_t>(block.data(), 12);
   77|      0|      uint64_t W13 = load_be<uint64_t>(block.data(), 13);
   78|      0|      uint64_t W14 = load_be<uint64_t>(block.data(), 14);
   79|      0|      uint64_t W15 = load_be<uint64_t>(block.data(), 15);
   80|       |
   81|      0|      SHA2_64_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x428A2F98D728AE22);
   82|      0|      SHA2_64_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x7137449123EF65CD);
   83|      0|      SHA2_64_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0xB5C0FBCFEC4D3B2F);
   84|      0|      SHA2_64_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0xE9B5DBA58189DBBC);
   85|      0|      SHA2_64_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x3956C25BF348B538);
   86|      0|      SHA2_64_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x59F111F1B605D019);
   87|      0|      SHA2_64_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x923F82A4AF194F9B);
   88|      0|      SHA2_64_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0xAB1C5ED5DA6D8118);
   89|      0|      SHA2_64_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0xD807AA98A3030242);
   90|      0|      SHA2_64_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0x12835B0145706FBE);
   91|      0|      SHA2_64_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0x243185BE4EE4B28C);
   92|      0|      SHA2_64_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0x550C7DC3D5FFB4E2);
   93|      0|      SHA2_64_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0x72BE5D74F27B896F);
   94|      0|      SHA2_64_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0x80DEB1FE3B1696B1);
   95|      0|      SHA2_64_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0x9BDC06A725C71235);
   96|      0|      SHA2_64_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0xC19BF174CF692694);
   97|      0|      SHA2_64_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0xE49B69C19EF14AD2);
   98|      0|      SHA2_64_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0xEFBE4786384F25E3);
   99|      0|      SHA2_64_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x0FC19DC68B8CD5B5);
  100|      0|      SHA2_64_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x240CA1CC77AC9C65);
  101|      0|      SHA2_64_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x2DE92C6F592B0275);
  102|      0|      SHA2_64_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x4A7484AA6EA6E483);
  103|      0|      SHA2_64_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x5CB0A9DCBD41FBD4);
  104|      0|      SHA2_64_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x76F988DA831153B5);
  105|      0|      SHA2_64_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0x983E5152EE66DFAB);
  106|      0|      SHA2_64_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0xA831C66D2DB43210);
  107|      0|      SHA2_64_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0xB00327C898FB213F);
  108|      0|      SHA2_64_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0xBF597FC7BEEF0EE4);
  109|      0|      SHA2_64_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0xC6E00BF33DA88FC2);
  110|      0|      SHA2_64_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xD5A79147930AA725);
  111|      0|      SHA2_64_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0x06CA6351E003826F);
  112|      0|      SHA2_64_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0x142929670A0E6E70);
  113|      0|      SHA2_64_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x27B70A8546D22FFC);
  114|      0|      SHA2_64_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x2E1B21385C26C926);
  115|      0|      SHA2_64_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x4D2C6DFC5AC42AED);
  116|      0|      SHA2_64_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x53380D139D95B3DF);
  117|      0|      SHA2_64_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x650A73548BAF63DE);
  118|      0|      SHA2_64_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x766A0ABB3C77B2A8);
  119|      0|      SHA2_64_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x81C2C92E47EDAEE6);
  120|      0|      SHA2_64_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x92722C851482353B);
  121|      0|      SHA2_64_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0xA2BFE8A14CF10364);
  122|      0|      SHA2_64_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0xA81A664BBC423001);
  123|      0|      SHA2_64_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0xC24B8B70D0F89791);
  124|      0|      SHA2_64_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0xC76C51A30654BE30);
  125|      0|      SHA2_64_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0xD192E819D6EF5218);
  126|      0|      SHA2_64_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xD69906245565A910);
  127|      0|      SHA2_64_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0xF40E35855771202A);
  128|      0|      SHA2_64_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0x106AA07032BBD1B8);
  129|      0|      SHA2_64_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x19A4C116B8D2D0C8);
  130|      0|      SHA2_64_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x1E376C085141AB53);
  131|      0|      SHA2_64_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x2748774CDF8EEB99);
  132|      0|      SHA2_64_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x34B0BCB5E19B48A8);
  133|      0|      SHA2_64_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x391C0CB3C5C95A63);
  134|      0|      SHA2_64_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x4ED8AA4AE3418ACB);
  135|      0|      SHA2_64_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x5B9CCA4F7763E373);
  136|      0|      SHA2_64_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x682E6FF3D6B2B8A3);
  137|      0|      SHA2_64_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0x748F82EE5DEFB2FC);
  138|      0|      SHA2_64_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0x78A5636F43172F60);
  139|      0|      SHA2_64_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0x84C87814A1F0AB72);
  140|      0|      SHA2_64_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0x8CC702081A6439EC);
  141|      0|      SHA2_64_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0x90BEFFFA23631E28);
  142|      0|      SHA2_64_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xA4506CEBDE82BDE9);
  143|      0|      SHA2_64_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0xBEF9A3F7B2C67915);
  144|      0|      SHA2_64_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0xC67178F2E372532B);
  145|      0|      SHA2_64_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0xCA273ECEEA26619C);
  146|      0|      SHA2_64_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0xD186B8C721C0C207);
  147|      0|      SHA2_64_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0xEADA7DD6CDE0EB1E);
  148|      0|      SHA2_64_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0xF57D4F7FEE6ED178);
  149|      0|      SHA2_64_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x06F067AA72176FBA);
  150|      0|      SHA2_64_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x0A637DC5A2C898A6);
  151|      0|      SHA2_64_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x113F9804BEF90DAE);
  152|      0|      SHA2_64_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x1B710B35131C471B);
  153|      0|      SHA2_64_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0x28DB77F523047D84);
  154|      0|      SHA2_64_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0x32CAAB7B40C72493);
  155|      0|      SHA2_64_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0x3C9EBE0A15C9BEBC);
  156|      0|      SHA2_64_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0x431D67C49C100D4C);
  157|      0|      SHA2_64_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0x4CC5D4BECB3E42B6);
  158|      0|      SHA2_64_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0x597F299CFC657E2A);
  159|      0|      SHA2_64_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0x5FCB6FAB3AD6FAEC);
  160|      0|      SHA2_64_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0x6C44198C4A475817);
  161|       |
  162|      0|      A = (digest[0] += A);
  163|      0|      B = (digest[1] += B);
  164|      0|      C = (digest[2] += C);
  165|      0|      D = (digest[3] += D);
  166|      0|      E = (digest[4] += E);
  167|      0|      F = (digest[5] += F);
  168|      0|      G = (digest[6] += G);
  169|      0|      H = (digest[7] += H);
  170|      0|   }
  171|      0|}
_ZN5Botan11SHA_512_25610compress_nERNSt3__16vectorImNS_16secure_allocatorImEEEENS1_4spanIKhLm18446744073709551615EEEm:
  185|     32|void SHA_512_256::compress_n(digest_type& digest, std::span<const uint8_t> input, size_t blocks) {
  186|     32|   SHA_512::compress_digest(digest, input, blocks);
  187|     32|}
_ZN5Botan7SHA_38410compress_nERNSt3__16vectorImNS_16secure_allocatorImEEEENS1_4spanIKhLm18446744073709551615EEEm:
  189|    593|void SHA_384::compress_n(digest_type& digest, std::span<const uint8_t> input, size_t blocks) {
  190|    593|   SHA_512::compress_digest(digest, input, blocks);
  191|    593|}
_ZN5Botan7SHA_51210compress_nERNSt3__16vectorImNS_16secure_allocatorImEEEENS1_4spanIKhLm18446744073709551615EEEm:
  193|     49|void SHA_512::compress_n(digest_type& digest, std::span<const uint8_t> input, size_t blocks) {
  194|     49|   SHA_512::compress_digest(digest, input, blocks);
  195|     49|}
_ZN5Botan11SHA_512_2564initERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  197|     32|void SHA_512_256::init(digest_type& digest) {
  198|     32|   digest.assign({0x22312194FC2BF72C,
  199|     32|                  0x9F555FA3C84C64C2,
  200|     32|                  0x2393B86B6F53B151,
  201|     32|                  0x963877195940EABD,
  202|     32|                  0x96283EE2A88EFFE3,
  203|     32|                  0xBE5E1E2553863992,
  204|     32|                  0x2B0199FC2C85B8AA,
  205|     32|                  0x0EB72DDC81C52CA2});
  206|     32|}
_ZN5Botan7SHA_3844initERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  208|    575|void SHA_384::init(digest_type& digest) {
  209|    575|   digest.assign({0xCBBB9D5DC1059ED8,
  210|    575|                  0x629A292A367CD507,
  211|    575|                  0x9159015A3070DD17,
  212|    575|                  0x152FECD8F70E5939,
  213|    575|                  0x67332667FFC00B31,
  214|    575|                  0x8EB44A8768581511,
  215|    575|                  0xDB0C2E0D64F98FA7,
  216|    575|                  0x47B5481DBEFA4FA4});
  217|    575|}
_ZN5Botan7SHA_5124initERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  219|     48|void SHA_512::init(digest_type& digest) {
  220|     48|   digest.assign({0x6A09E667F3BCC908,
  221|     48|                  0xBB67AE8584CAA73B,
  222|     48|                  0x3C6EF372FE94F82B,
  223|     48|                  0xA54FF53A5F1D36F1,
  224|     48|                  0x510E527FADE682D1,
  225|     48|                  0x9B05688C2B3E6C1F,
  226|     48|                  0x1F83D9ABFB41BD6B,
  227|     48|                  0x5BE0CD19137E2179});
  228|     48|}
_ZN5Botan7SHA_3848add_dataENSt3__14spanIKhLm18446744073709551615EEE:
  254|    477|void SHA_384::add_data(std::span<const uint8_t> input) {
  255|    477|   m_md.update(input);
  256|    477|}
_ZN5Botan7SHA_5128add_dataENSt3__14spanIKhLm18446744073709551615EEE:
  258|     24|void SHA_512::add_data(std::span<const uint8_t> input) {
  259|     24|   m_md.update(input);
  260|     24|}
_ZN5Botan11SHA_512_2568add_dataENSt3__14spanIKhLm18446744073709551615EEE:
  262|     16|void SHA_512_256::add_data(std::span<const uint8_t> input) {
  263|     16|   m_md.update(input);
  264|     16|}
_ZN5Botan7SHA_38412final_resultENSt3__14spanIhLm18446744073709551615EEE:
  266|    346|void SHA_384::final_result(std::span<uint8_t> output) {
  267|    346|   m_md.final(output);
  268|    346|}
_ZN5Botan7SHA_51212final_resultENSt3__14spanIhLm18446744073709551615EEE:
  270|     24|void SHA_512::final_result(std::span<uint8_t> output) {
  271|     24|   m_md.final(output);
  272|     24|}
_ZN5Botan11SHA_512_25612final_resultENSt3__14spanIhLm18446744073709551615EEE:
  274|     16|void SHA_512_256::final_result(std::span<uint8_t> output) {
  275|     16|   m_md.final(output);
  276|     16|}

_ZN5Botan7SHA_51220compress_digest_bmi2ERNSt3__16vectorImNS_16secure_allocatorImEEEENS1_4spanIKhLm18446744073709551615EEEm:
   17|    674|void SHA_512::compress_digest_bmi2(digest_type& digest, std::span<const uint8_t> input, size_t blocks) {
   18|    674|   uint64_t A = digest[0], B = digest[1], C = digest[2], D = digest[3], E = digest[4], F = digest[5], G = digest[6],
   19|    674|            H = digest[7];
   20|       |
   21|    674|   BufferSlicer in(input);
   22|       |
   23|  1.52k|   for(size_t i = 0; i != blocks; ++i) {
  ------------------
  |  Branch (23:22): [True: 855, False: 674]
  ------------------
   24|    855|      const auto block = in.take(block_bytes);
   25|       |
   26|    855|      uint64_t W00 = load_be<uint64_t>(block.data(), 0);
   27|    855|      uint64_t W01 = load_be<uint64_t>(block.data(), 1);
   28|    855|      uint64_t W02 = load_be<uint64_t>(block.data(), 2);
   29|    855|      uint64_t W03 = load_be<uint64_t>(block.data(), 3);
   30|    855|      uint64_t W04 = load_be<uint64_t>(block.data(), 4);
   31|    855|      uint64_t W05 = load_be<uint64_t>(block.data(), 5);
   32|    855|      uint64_t W06 = load_be<uint64_t>(block.data(), 6);
   33|    855|      uint64_t W07 = load_be<uint64_t>(block.data(), 7);
   34|    855|      uint64_t W08 = load_be<uint64_t>(block.data(), 8);
   35|    855|      uint64_t W09 = load_be<uint64_t>(block.data(), 9);
   36|    855|      uint64_t W10 = load_be<uint64_t>(block.data(), 10);
   37|    855|      uint64_t W11 = load_be<uint64_t>(block.data(), 11);
   38|    855|      uint64_t W12 = load_be<uint64_t>(block.data(), 12);
   39|    855|      uint64_t W13 = load_be<uint64_t>(block.data(), 13);
   40|    855|      uint64_t W14 = load_be<uint64_t>(block.data(), 14);
   41|    855|      uint64_t W15 = load_be<uint64_t>(block.data(), 15);
   42|       |
   43|    855|      SHA2_64_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x428A2F98D728AE22);
   44|    855|      SHA2_64_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x7137449123EF65CD);
   45|    855|      SHA2_64_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0xB5C0FBCFEC4D3B2F);
   46|    855|      SHA2_64_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0xE9B5DBA58189DBBC);
   47|    855|      SHA2_64_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x3956C25BF348B538);
   48|    855|      SHA2_64_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x59F111F1B605D019);
   49|    855|      SHA2_64_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x923F82A4AF194F9B);
   50|    855|      SHA2_64_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0xAB1C5ED5DA6D8118);
   51|    855|      SHA2_64_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0xD807AA98A3030242);
   52|    855|      SHA2_64_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0x12835B0145706FBE);
   53|    855|      SHA2_64_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0x243185BE4EE4B28C);
   54|    855|      SHA2_64_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0x550C7DC3D5FFB4E2);
   55|    855|      SHA2_64_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0x72BE5D74F27B896F);
   56|    855|      SHA2_64_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0x80DEB1FE3B1696B1);
   57|    855|      SHA2_64_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0x9BDC06A725C71235);
   58|    855|      SHA2_64_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0xC19BF174CF692694);
   59|    855|      SHA2_64_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0xE49B69C19EF14AD2);
   60|    855|      SHA2_64_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0xEFBE4786384F25E3);
   61|    855|      SHA2_64_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x0FC19DC68B8CD5B5);
   62|    855|      SHA2_64_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x240CA1CC77AC9C65);
   63|    855|      SHA2_64_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x2DE92C6F592B0275);
   64|    855|      SHA2_64_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x4A7484AA6EA6E483);
   65|    855|      SHA2_64_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x5CB0A9DCBD41FBD4);
   66|    855|      SHA2_64_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x76F988DA831153B5);
   67|    855|      SHA2_64_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0x983E5152EE66DFAB);
   68|    855|      SHA2_64_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0xA831C66D2DB43210);
   69|    855|      SHA2_64_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0xB00327C898FB213F);
   70|    855|      SHA2_64_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0xBF597FC7BEEF0EE4);
   71|    855|      SHA2_64_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0xC6E00BF33DA88FC2);
   72|    855|      SHA2_64_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xD5A79147930AA725);
   73|    855|      SHA2_64_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0x06CA6351E003826F);
   74|    855|      SHA2_64_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0x142929670A0E6E70);
   75|    855|      SHA2_64_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x27B70A8546D22FFC);
   76|    855|      SHA2_64_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x2E1B21385C26C926);
   77|    855|      SHA2_64_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x4D2C6DFC5AC42AED);
   78|    855|      SHA2_64_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x53380D139D95B3DF);
   79|    855|      SHA2_64_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x650A73548BAF63DE);
   80|    855|      SHA2_64_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x766A0ABB3C77B2A8);
   81|    855|      SHA2_64_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x81C2C92E47EDAEE6);
   82|    855|      SHA2_64_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x92722C851482353B);
   83|    855|      SHA2_64_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0xA2BFE8A14CF10364);
   84|    855|      SHA2_64_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0xA81A664BBC423001);
   85|    855|      SHA2_64_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0xC24B8B70D0F89791);
   86|    855|      SHA2_64_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0xC76C51A30654BE30);
   87|    855|      SHA2_64_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0xD192E819D6EF5218);
   88|    855|      SHA2_64_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xD69906245565A910);
   89|    855|      SHA2_64_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0xF40E35855771202A);
   90|    855|      SHA2_64_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0x106AA07032BBD1B8);
   91|    855|      SHA2_64_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x19A4C116B8D2D0C8);
   92|    855|      SHA2_64_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x1E376C085141AB53);
   93|    855|      SHA2_64_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x2748774CDF8EEB99);
   94|    855|      SHA2_64_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x34B0BCB5E19B48A8);
   95|    855|      SHA2_64_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x391C0CB3C5C95A63);
   96|    855|      SHA2_64_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x4ED8AA4AE3418ACB);
   97|    855|      SHA2_64_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x5B9CCA4F7763E373);
   98|    855|      SHA2_64_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x682E6FF3D6B2B8A3);
   99|    855|      SHA2_64_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0x748F82EE5DEFB2FC);
  100|    855|      SHA2_64_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0x78A5636F43172F60);
  101|    855|      SHA2_64_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0x84C87814A1F0AB72);
  102|    855|      SHA2_64_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0x8CC702081A6439EC);
  103|    855|      SHA2_64_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0x90BEFFFA23631E28);
  104|    855|      SHA2_64_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xA4506CEBDE82BDE9);
  105|    855|      SHA2_64_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0xBEF9A3F7B2C67915);
  106|    855|      SHA2_64_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0xC67178F2E372532B);
  107|    855|      SHA2_64_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0xCA273ECEEA26619C);
  108|    855|      SHA2_64_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0xD186B8C721C0C207);
  109|    855|      SHA2_64_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0xEADA7DD6CDE0EB1E);
  110|    855|      SHA2_64_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0xF57D4F7FEE6ED178);
  111|    855|      SHA2_64_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x06F067AA72176FBA);
  112|    855|      SHA2_64_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x0A637DC5A2C898A6);
  113|    855|      SHA2_64_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x113F9804BEF90DAE);
  114|    855|      SHA2_64_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x1B710B35131C471B);
  115|    855|      SHA2_64_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0x28DB77F523047D84);
  116|    855|      SHA2_64_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0x32CAAB7B40C72493);
  117|    855|      SHA2_64_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0x3C9EBE0A15C9BEBC);
  118|    855|      SHA2_64_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0x431D67C49C100D4C);
  119|    855|      SHA2_64_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0x4CC5D4BECB3E42B6);
  120|    855|      SHA2_64_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0x597F299CFC657E2A);
  121|    855|      SHA2_64_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0x5FCB6FAB3AD6FAEC);
  122|    855|      SHA2_64_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0x6C44198C4A475817);
  123|       |
  124|    855|      A = (digest[0] += A);
  125|    855|      B = (digest[1] += B);
  126|    855|      C = (digest[2] += C);
  127|    855|      D = (digest[3] += D);
  128|    855|      E = (digest[4] += E);
  129|    855|      F = (digest[5] += F);
  130|    855|      G = (digest[6] += G);
  131|    855|      H = (digest[7] += H);
  132|    855|   }
  133|    674|}

_ZN5Botan8StreebogC2Em:
   25|     73|Streebog::Streebog(size_t output_bits) : m_output_bits(output_bits), m_count(0), m_h(8), m_S(8) {
   26|     73|   if(output_bits != 256 && output_bits != 512) {
  ------------------
  |  Branch (26:7): [True: 2, False: 71]
  |  Branch (26:29): [True: 0, False: 2]
  ------------------
   27|      0|      throw Invalid_Argument(fmt("Streebog: Invalid output length {}", output_bits));
   28|      0|   }
   29|       |
   30|     73|   clear();
   31|     73|}
_ZN5Botan8Streebog5clearEv:
   40|    146|void Streebog::clear() {
   41|    146|   m_count = 0;
   42|    146|   m_buffer.clear();
   43|    146|   zeroise(m_S);
   44|       |
   45|    146|   const uint64_t fill = (m_output_bits == 512) ? 0 : 0x0101010101010101;
  ------------------
  |  Branch (45:26): [True: 4, False: 142]
  ------------------
   46|    146|   std::fill(m_h.begin(), m_h.end(), fill);
   47|    146|}
_ZN5Botan8Streebog8add_dataENSt3__14spanIKhLm18446744073709551615EEE:
   52|     73|void Streebog::add_data(std::span<const uint8_t> input) {
   53|     73|   BufferSlicer in(input);
   54|       |
   55|    219|   while(!in.empty()) {
  ------------------
  |  Branch (55:10): [True: 146, False: 73]
  ------------------
   56|    146|      if(const auto one_block = m_buffer.handle_unaligned_data(in)) {
  ------------------
  |  Branch (56:21): [True: 0, False: 146]
  ------------------
   57|      0|         compress(one_block->data());
   58|      0|         m_count += 512;
   59|      0|      }
   60|       |
   61|    146|      if(m_buffer.in_alignment()) {
  ------------------
  |  Branch (61:10): [True: 73, False: 73]
  ------------------
   62|    658|         while(const auto aligned_block = m_buffer.next_aligned_block_to_process(in)) {
  ------------------
  |  Branch (62:27): [True: 585, False: 73]
  ------------------
   63|    585|            compress(aligned_block->data());
   64|    585|            m_count += 512;
   65|    585|         }
   66|     73|      }
   67|    146|   }
   68|     73|}
_ZN5Botan8Streebog12final_resultENSt3__14spanIhLm18446744073709551615EEE:
   73|     73|void Streebog::final_result(std::span<uint8_t> output) {
   74|     73|   const auto pos = m_buffer.elements_in_buffer();
   75|       |
   76|     73|   const uint8_t padding = 0x01;
   77|     73|   m_buffer.append({&padding, 1});
   78|     73|   m_buffer.fill_up_with_zeros();
   79|       |
   80|     73|   compress(m_buffer.consume().data());
   81|     73|   m_count += pos * 8;
   82|       |
   83|     73|   m_buffer.fill_up_with_zeros();
   84|     73|   store_le(m_count, m_buffer.directly_modify_first(sizeof(m_count)).data());
   85|     73|   compress(m_buffer.consume().data(), true);
   86|       |
   87|     73|   compress_64(m_S.data(), true);
   88|       |   // FIXME
   89|     73|   std::memcpy(output.data(), &m_h[8 - output_length() / 8], output_length());
   90|     73|   clear();
   91|     73|}
_ZN5Botan8Streebog8compressEPKhb:
  121|    731|void Streebog::compress(const uint8_t input[], bool last_block) {
  122|    731|   uint64_t M[8];
  123|    731|   std::memcpy(M, input, 64);
  124|       |
  125|    731|   compress_64(M, last_block);
  126|    731|}
_ZN5Botan8Streebog11compress_64EPKmb:
  128|    804|void Streebog::compress_64(const uint64_t M[], bool last_block) {
  129|    804|   const uint64_t N = last_block ? 0 : force_le(m_count);
  ------------------
  |  Branch (129:23): [True: 146, False: 658]
  ------------------
  130|       |
  131|    804|   uint64_t hN[8];
  132|    804|   uint64_t A[8];
  133|       |
  134|    804|   copy_mem(hN, m_h.data(), 8);
  135|    804|   hN[0] ^= N;
  136|    804|   lps(hN);
  137|       |
  138|    804|   copy_mem(A, hN, 8);
  139|       |
  140|  7.23k|   for(size_t i = 0; i != 8; ++i) {
  ------------------
  |  Branch (140:22): [True: 6.43k, False: 804]
  ------------------
  141|  6.43k|      hN[i] ^= M[i];
  142|  6.43k|   }
  143|       |
  144|  10.4k|   for(size_t i = 0; i < 12; ++i) {
  ------------------
  |  Branch (144:22): [True: 9.64k, False: 804]
  ------------------
  145|  86.8k|      for(size_t j = 0; j != 8; ++j) {
  ------------------
  |  Branch (145:25): [True: 77.1k, False: 9.64k]
  ------------------
  146|  77.1k|         A[j] ^= force_le(STREEBOG_C[i][j]);
  147|  77.1k|      }
  148|  9.64k|      lps(A);
  149|       |
  150|  9.64k|      lps(hN);
  151|  86.8k|      for(size_t j = 0; j != 8; ++j) {
  ------------------
  |  Branch (151:25): [True: 77.1k, False: 9.64k]
  ------------------
  152|  77.1k|         hN[j] ^= A[j];
  153|  77.1k|      }
  154|  9.64k|   }
  155|       |
  156|  7.23k|   for(size_t i = 0; i != 8; ++i) {
  ------------------
  |  Branch (156:22): [True: 6.43k, False: 804]
  ------------------
  157|  6.43k|      m_h[i] ^= hN[i] ^ M[i];
  158|  6.43k|   }
  159|       |
  160|    804|   if(!last_block) {
  ------------------
  |  Branch (160:7): [True: 658, False: 146]
  ------------------
  161|    658|      uint64_t carry = 0;
  162|  5.92k|      for(int i = 0; i < 8; i++) {
  ------------------
  |  Branch (162:22): [True: 5.26k, False: 658]
  ------------------
  163|  5.26k|         const uint64_t m = force_le(M[i]);
  164|  5.26k|         const uint64_t hi = force_le(m_S[i]);
  165|  5.26k|         const uint64_t t = hi + m + carry;
  166|       |
  167|  5.26k|         m_S[i] = force_le(t);
  168|  5.26k|         if(t != m) {
  ------------------
  |  Branch (168:13): [True: 4.68k, False: 584]
  ------------------
  169|  4.68k|            carry = (t < m);
  170|  4.68k|         }
  171|  5.26k|      }
  172|    658|   }
  173|    804|}
streebog.cpp:_ZN5Botan12_GLOBAL__N_18force_leEm:
   95|  1.38M|inline uint64_t force_le(uint64_t x) {
   96|  1.38M|#if defined(BOTAN_TARGET_CPU_IS_LITTLE_ENDIAN)
   97|  1.38M|   return x;
   98|       |#elif defined(BOTAN_TARGET_CPU_IS_BIG_ENDIAN)
   99|       |   return reverse_bytes(x);
  100|       |#else
  101|       |   store_le(x, reinterpret_cast<uint8_t*>(&x));
  102|       |   return x;
  103|       |#endif
  104|  1.38M|}
streebog.cpp:_ZN5Botan12_GLOBAL__N_13lpsEPm:
  106|  20.1k|inline void lps(uint64_t block[8]) {
  107|  20.1k|   uint8_t r[64];
  108|       |   // FIXME
  109|  20.1k|   std::memcpy(r, block, 64);
  110|       |
  111|   180k|   for(int i = 0; i < 8; ++i) {
  ------------------
  |  Branch (111:19): [True: 160k, False: 20.1k]
  ------------------
  112|   160k|      block[i] = force_le(STREEBOG_Ax[0][r[i + 0 * 8]]) ^ force_le(STREEBOG_Ax[1][r[i + 1 * 8]]) ^
  113|   160k|                 force_le(STREEBOG_Ax[2][r[i + 2 * 8]]) ^ force_le(STREEBOG_Ax[3][r[i + 3 * 8]]) ^
  114|   160k|                 force_le(STREEBOG_Ax[4][r[i + 4 * 8]]) ^ force_le(STREEBOG_Ax[5][r[i + 5 * 8]]) ^
  115|   160k|                 force_le(STREEBOG_Ax[6][r[i + 6 * 8]]) ^ force_le(STREEBOG_Ax[7][r[i + 7 * 8]]);
  116|   160k|   }
  117|  20.1k|}

_ZN5Botan6BigInt11encode_1363ERKS0_m:
  105|    789|secure_vector<uint8_t> BigInt::encode_1363(const BigInt& n, size_t bytes) {
  106|    789|   if(n.bytes() > bytes) {
  ------------------
  |  Branch (106:7): [True: 3, False: 786]
  ------------------
  107|      3|      throw Encoding_Error("encode_1363: n is too large to encode properly");
  108|      3|   }
  109|       |
  110|    786|   secure_vector<uint8_t> output(bytes);
  111|    786|   n.binary_encode(output.data(), output.size());
  112|    786|   return output;
  113|    789|}
_ZN5Botan6BigInt6decodeEPKhmNS0_4BaseE:
  151|    883|BigInt BigInt::decode(const uint8_t buf[], size_t length, Base base) {
  152|    883|   BigInt r;
  153|    883|   if(base == Binary) {
  ------------------
  |  Branch (153:7): [True: 0, False: 883]
  ------------------
  154|      0|      r.binary_decode(buf, length);
  155|    883|   } else if(base == Hexadecimal) {
  ------------------
  |  Branch (155:14): [True: 748, False: 135]
  ------------------
  156|    748|      secure_vector<uint8_t> binary;
  157|       |
  158|    748|      if(length % 2) {
  ------------------
  |  Branch (158:10): [True: 14, False: 734]
  ------------------
  159|       |         // Handle lack of leading 0
  160|     14|         const char buf0_with_leading_0[2] = {'0', static_cast<char>(buf[0])};
  161|       |
  162|     14|         binary = hex_decode_locked(buf0_with_leading_0, 2);
  163|       |
  164|     14|         binary += hex_decode_locked(cast_uint8_ptr_to_char(&buf[1]), length - 1, false);
  165|    734|      } else {
  166|    734|         binary = hex_decode_locked(cast_uint8_ptr_to_char(buf), length, false);
  167|    734|      }
  168|       |
  169|    748|      r.binary_decode(binary.data(), binary.size());
  170|    748|   } else if(base == Decimal) {
  ------------------
  |  Branch (170:14): [True: 135, False: 0]
  ------------------
  171|       |      // This could be made faster using the same trick as to_dec_string
  172|    270|      for(size_t i = 0; i != length; ++i) {
  ------------------
  |  Branch (172:25): [True: 135, False: 135]
  ------------------
  173|    135|         const char c = buf[i];
  174|       |
  175|    135|         if(c < '0' || c > '9') {
  ------------------
  |  Branch (175:13): [True: 0, False: 135]
  |  Branch (175:24): [True: 0, False: 135]
  ------------------
  176|      0|            throw Invalid_Argument("BigInt::decode: invalid decimal char");
  177|      0|         }
  178|       |
  179|    135|         const uint8_t x = c - '0';
  180|    135|         BOTAN_ASSERT_NOMSG(x < 10);
  ------------------
  |  |   60|    135|   do {                                                                     \
  |  |   61|    135|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 135]
  |  |  ------------------
  |  |   62|    135|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    135|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  181|       |
  182|    135|         r *= 10;
  183|    135|         r += x;
  184|    135|      }
  185|    135|   } else {
  186|      0|      throw Invalid_Argument("Unknown BigInt decoding method");
  187|      0|   }
  188|    883|   return r;
  189|    883|}

_ZN5Botan6BigInt3addEPKmmNS0_4SignE:
   16|  2.81M|BigInt& BigInt::add(const word y[], size_t y_words, Sign y_sign) {
   17|  2.81M|   const size_t x_sw = sig_words();
   18|       |
   19|  2.81M|   grow_to(std::max(x_sw, y_words) + 1);
   20|       |
   21|  2.81M|   if(sign() == y_sign) {
  ------------------
  |  Branch (21:7): [True: 2.70M, False: 117k]
  ------------------
   22|  2.70M|      bigint_add2(mutable_data(), size() - 1, y, y_words);
   23|  2.70M|   } else {
   24|   117k|      const int32_t relative_size = bigint_cmp(data(), x_sw, y, y_words);
   25|       |
   26|   117k|      if(relative_size >= 0) {
  ------------------
  |  Branch (26:10): [True: 105k, False: 11.9k]
  ------------------
   27|       |         // *this >= y
   28|   105k|         bigint_sub2(mutable_data(), x_sw, y, y_words);
   29|   105k|      } else {
   30|       |         // *this < y
   31|  11.9k|         bigint_sub2_rev(mutable_data(), y, y_words);
   32|  11.9k|      }
   33|       |
   34|       |      //this->sign_fixup(relative_size, y_sign);
   35|   117k|      if(relative_size < 0) {
  ------------------
  |  Branch (35:10): [True: 11.9k, False: 105k]
  ------------------
   36|  11.9k|         set_sign(y_sign);
   37|   105k|      } else if(relative_size == 0) {
  ------------------
  |  Branch (37:17): [True: 0, False: 105k]
  ------------------
   38|      0|         set_sign(Positive);
   39|      0|      }
   40|   117k|   }
   41|       |
   42|  2.81M|   return (*this);
   43|  2.81M|}
_ZN5Botan6BigInt7mod_addERKS0_S2_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
   45|   157k|BigInt& BigInt::mod_add(const BigInt& s, const BigInt& mod, secure_vector<word>& ws) {
   46|   157k|   if(this->is_negative() || s.is_negative() || mod.is_negative()) {
  ------------------
  |  Branch (46:7): [True: 0, False: 157k]
  |  Branch (46:30): [True: 0, False: 157k]
  |  Branch (46:49): [True: 0, False: 157k]
  ------------------
   47|      0|      throw Invalid_Argument("BigInt::mod_add expects all arguments are positive");
   48|      0|   }
   49|       |
   50|   157k|   BOTAN_DEBUG_ASSERT(*this < mod);
  ------------------
  |  |   99|   157k|      do {                          \
  |  |  100|   157k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   51|   157k|   BOTAN_DEBUG_ASSERT(s < mod);
  ------------------
  |  |   99|   157k|      do {                          \
  |  |  100|   157k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   52|       |
   53|       |   /*
   54|       |   t + s or t + s - p == t - (p - s)
   55|       |
   56|       |   So first compute ws = p - s
   57|       |
   58|       |   Then compute t + s and t - ws
   59|       |
   60|       |   If t - ws does not borrow, then that is the correct valued
   61|       |   */
   62|       |
   63|   157k|   const size_t mod_sw = mod.sig_words();
   64|   157k|   BOTAN_ARG_CHECK(mod_sw > 0, "BigInt::mod_add modulus must be positive");
  ------------------
  |  |   30|   157k|   do {                                                          \
  |  |   31|   157k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 157k]
  |  |  ------------------
  |  |   32|   157k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|   157k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   65|       |
   66|   157k|   this->grow_to(mod_sw);
   67|   157k|   s.grow_to(mod_sw);
   68|       |
   69|       |   // First mod_sw for p - s, 2*mod_sw for bigint_addsub workspace
   70|   157k|   if(ws.size() < 3 * mod_sw) {
  ------------------
  |  Branch (70:7): [True: 105k, False: 52.5k]
  ------------------
   71|   105k|      ws.resize(3 * mod_sw);
   72|   105k|   }
   73|       |
   74|   157k|   word borrow = bigint_sub3(&ws[0], mod.data(), mod_sw, s.data(), mod_sw);
   75|   157k|   BOTAN_DEBUG_ASSERT(borrow == 0);
  ------------------
  |  |   99|   157k|      do {                          \
  |  |  100|   157k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   76|   157k|   BOTAN_UNUSED(borrow);
  ------------------
  |  |  118|   157k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   77|       |
   78|       |   // Compute t - ws
   79|   157k|   borrow = bigint_sub3(&ws[mod_sw], this->data(), mod_sw, &ws[0], mod_sw);
   80|       |
   81|       |   // Compute t + s
   82|   157k|   bigint_add3_nc(&ws[mod_sw * 2], this->data(), mod_sw, s.data(), mod_sw);
   83|       |
   84|   157k|   CT::conditional_copy_mem(borrow, &ws[0], &ws[mod_sw * 2], &ws[mod_sw], mod_sw);
   85|   157k|   set_words(&ws[0], mod_sw);
   86|       |
   87|   157k|   return (*this);
   88|   157k|}
_ZN5Botan6BigInt7mod_subERKS0_S2_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
   90|  3.39M|BigInt& BigInt::mod_sub(const BigInt& s, const BigInt& mod, secure_vector<word>& ws) {
   91|  3.39M|   if(this->is_negative() || s.is_negative() || mod.is_negative()) {
  ------------------
  |  Branch (91:7): [True: 0, False: 3.39M]
  |  Branch (91:30): [True: 0, False: 3.39M]
  |  Branch (91:49): [True: 0, False: 3.39M]
  ------------------
   92|      0|      throw Invalid_Argument("BigInt::mod_sub expects all arguments are positive");
   93|      0|   }
   94|       |
   95|       |   // We are assuming in this function that *this and s are no more than mod_sw words long
   96|  3.39M|   BOTAN_DEBUG_ASSERT(*this < mod);
  ------------------
  |  |   99|  3.39M|      do {                          \
  |  |  100|  3.39M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   97|  3.39M|   BOTAN_DEBUG_ASSERT(s < mod);
  ------------------
  |  |   99|  3.39M|      do {                          \
  |  |  100|  3.39M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   98|       |
   99|  3.39M|   const size_t mod_sw = mod.sig_words();
  100|       |
  101|  3.39M|   this->grow_to(mod_sw);
  102|  3.39M|   s.grow_to(mod_sw);
  103|       |
  104|  3.39M|   if(ws.size() < mod_sw) {
  ------------------
  |  Branch (104:7): [True: 0, False: 3.39M]
  ------------------
  105|      0|      ws.resize(mod_sw);
  106|      0|   }
  107|       |
  108|  3.39M|   if(mod_sw == 4) {
  ------------------
  |  Branch (108:7): [True: 2.74M, False: 647k]
  ------------------
  109|  2.74M|      bigint_mod_sub_n<4>(mutable_data(), s.data(), mod.data(), ws.data());
  110|  2.74M|   } else if(mod_sw == 6) {
  ------------------
  |  Branch (110:14): [True: 103k, False: 544k]
  ------------------
  111|   103k|      bigint_mod_sub_n<6>(mutable_data(), s.data(), mod.data(), ws.data());
  112|   544k|   } else {
  113|   544k|      bigint_mod_sub(mutable_data(), s.data(), mod.data(), mod_sw, ws.data());
  114|   544k|   }
  115|       |
  116|  3.39M|   return (*this);
  117|  3.39M|}
_ZN5Botan6BigInt7mod_mulEhRKS0_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  119|  1.14M|BigInt& BigInt::mod_mul(uint8_t y, const BigInt& mod, secure_vector<word>& ws) {
  120|  1.14M|   BOTAN_ARG_CHECK(this->is_negative() == false, "*this must be positive");
  ------------------
  |  |   30|  1.14M|   do {                                                          \
  |  |   31|  1.14M|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 1.14M]
  |  |  ------------------
  |  |   32|  1.14M|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  1.14M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  121|  1.14M|   BOTAN_ARG_CHECK(y < 16, "y too large");
  ------------------
  |  |   30|  1.14M|   do {                                                          \
  |  |   31|  1.14M|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 1.14M]
  |  |  ------------------
  |  |   32|  1.14M|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  1.14M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  122|       |
  123|  1.14M|   BOTAN_DEBUG_ASSERT(*this < mod);
  ------------------
  |  |   99|  1.14M|      do {                          \
  |  |  100|  1.14M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  124|       |
  125|  1.14M|   *this *= static_cast<word>(y);
  126|  1.14M|   this->reduce_below(mod, ws);
  127|  1.14M|   return (*this);
  128|  1.14M|}
_ZN5Botan6BigInt7rev_subEPKmmRNSt3__16vectorImNS_16secure_allocatorImEEEE:
  130|  2.59M|BigInt& BigInt::rev_sub(const word y[], size_t y_sw, secure_vector<word>& ws) {
  131|  2.59M|   if(this->sign() != BigInt::Positive) {
  ------------------
  |  Branch (131:7): [True: 0, False: 2.59M]
  ------------------
  132|      0|      throw Invalid_State("BigInt::sub_rev requires this is positive");
  133|      0|   }
  134|       |
  135|  2.59M|   const size_t x_sw = this->sig_words();
  136|       |
  137|  2.59M|   ws.resize(std::max(x_sw, y_sw));
  138|  2.59M|   clear_mem(ws.data(), ws.size());
  139|       |
  140|  2.59M|   const int32_t relative_size = bigint_sub_abs(ws.data(), data(), x_sw, y, y_sw);
  141|       |
  142|  2.59M|   this->cond_flip_sign(relative_size > 0);
  143|  2.59M|   this->swap_reg(ws);
  144|       |
  145|  2.59M|   return (*this);
  146|  2.59M|}
_ZN5Botan6BigInt3mulERKS0_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  156|  5.19M|BigInt& BigInt::mul(const BigInt& y, secure_vector<word>& ws) {
  157|  5.19M|   const size_t x_sw = sig_words();
  158|  5.19M|   const size_t y_sw = y.sig_words();
  159|  5.19M|   set_sign((sign() == y.sign()) ? Positive : Negative);
  ------------------
  |  Branch (159:13): [True: 5.19M, False: 0]
  ------------------
  160|       |
  161|  5.19M|   if(x_sw == 0 || y_sw == 0) {
  ------------------
  |  Branch (161:7): [True: 627k, False: 4.56M]
  |  Branch (161:20): [True: 0, False: 4.56M]
  ------------------
  162|   627k|      clear();
  163|   627k|      set_sign(Positive);
  164|  4.56M|   } else if(x_sw == 1 && y_sw) {
  ------------------
  |  Branch (164:14): [True: 1.73M, False: 2.83M]
  |  Branch (164:27): [True: 1.73M, False: 0]
  ------------------
  165|  1.73M|      grow_to(y_sw + 1);
  166|  1.73M|      bigint_linmul3(mutable_data(), y.data(), y_sw, word_at(0));
  167|  2.83M|   } else if(y_sw == 1 && x_sw) {
  ------------------
  |  Branch (167:14): [True: 0, False: 2.83M]
  |  Branch (167:27): [True: 0, False: 0]
  ------------------
  168|      0|      word carry = bigint_linmul2(mutable_data(), x_sw, y.word_at(0));
  169|      0|      set_word_at(x_sw, carry);
  170|  2.83M|   } else {
  171|  2.83M|      const size_t new_size = x_sw + y_sw + 1;
  172|  2.83M|      ws.resize(new_size);
  173|  2.83M|      secure_vector<word> z_reg(new_size);
  174|       |
  175|  2.83M|      bigint_mul(z_reg.data(), z_reg.size(), data(), size(), x_sw, y.data(), y.size(), y_sw, ws.data(), ws.size());
  176|       |
  177|  2.83M|      this->swap_reg(z_reg);
  178|  2.83M|   }
  179|       |
  180|  5.19M|   return (*this);
  181|  5.19M|}
_ZN5Botan6BigInt6squareERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  183|  1.16M|BigInt& BigInt::square(secure_vector<word>& ws) {
  184|  1.16M|   const size_t sw = sig_words();
  185|       |
  186|  1.16M|   secure_vector<word> z(2 * sw);
  187|  1.16M|   ws.resize(z.size());
  188|       |
  189|  1.16M|   bigint_sqr(z.data(), z.size(), data(), size(), sw, ws.data(), ws.size());
  190|       |
  191|  1.16M|   swap_reg(z);
  192|  1.16M|   set_sign(BigInt::Positive);
  193|       |
  194|  1.16M|   return (*this);
  195|  1.16M|}
_ZN5Botan6BigIntmLEm:
  197|  5.06M|BigInt& BigInt::operator*=(word y) {
  198|  5.06M|   if(y == 0) {
  ------------------
  |  Branch (198:7): [True: 0, False: 5.06M]
  ------------------
  199|      0|      clear();
  200|      0|      set_sign(Positive);
  201|      0|   }
  202|       |
  203|  5.06M|   const word carry = bigint_linmul2(mutable_data(), size(), y);
  204|  5.06M|   set_word_at(size(), carry);
  205|       |
  206|  5.06M|   return (*this);
  207|  5.06M|}
_ZN5Botan6BigIntrMERKS0_:
  224|   130k|BigInt& BigInt::operator%=(const BigInt& mod) {
  225|   130k|   return (*this = (*this) % mod);
  226|   130k|}
_ZN5Botan6BigIntlSEm:
  260|   165k|BigInt& BigInt::operator<<=(size_t shift) {
  261|   165k|   const size_t shift_words = shift / BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|   165k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  262|   165k|   const size_t shift_bits = shift % BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|   165k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  263|   165k|   const size_t size = sig_words();
  264|       |
  265|   165k|   const size_t bits_free = top_bits_free();
  266|       |
  267|   165k|   const size_t new_size = size + shift_words + (bits_free < shift_bits);
  268|       |
  269|   165k|   m_data.grow_to(new_size);
  270|       |
  271|   165k|   bigint_shl1(m_data.mutable_data(), new_size, size, shift_words, shift_bits);
  272|       |
  273|   165k|   return (*this);
  274|   165k|}
_ZN5Botan6BigIntrSEm:
  279|  6.21M|BigInt& BigInt::operator>>=(size_t shift) {
  280|  6.21M|   const size_t shift_words = shift / BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  6.21M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  281|  6.21M|   const size_t shift_bits = shift % BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  6.21M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  282|       |
  283|  6.21M|   bigint_shr1(m_data.mutable_data(), m_data.size(), shift_words, shift_bits);
  284|       |
  285|  6.21M|   if(is_negative() && is_zero()) {
  ------------------
  |  Branch (285:7): [True: 0, False: 6.21M]
  |  Branch (285:24): [True: 0, False: 0]
  ------------------
  286|      0|      set_sign(Positive);
  287|      0|   }
  288|       |
  289|  6.21M|   return (*this);
  290|  6.21M|}

_ZN5Botan6BigInt4add2ERKS0_PKmmNS0_4SignE:
   19|   768k|BigInt BigInt::add2(const BigInt& x, const word y[], size_t y_words, BigInt::Sign y_sign) {
   20|   768k|   const size_t x_sw = x.sig_words();
   21|       |
   22|   768k|   BigInt z = BigInt::with_capacity(std::max(x_sw, y_words) + 1);
   23|       |
   24|   768k|   if(x.sign() == y_sign) {
  ------------------
  |  Branch (24:7): [True: 599k, False: 169k]
  ------------------
   25|   599k|      bigint_add3(z.mutable_data(), x.data(), x_sw, y, y_words);
   26|   599k|      z.set_sign(x.sign());
   27|   599k|   } else {
   28|   169k|      const int32_t relative_size = bigint_sub_abs(z.mutable_data(), x.data(), x_sw, y, y_words);
   29|       |
   30|       |      //z.sign_fixup(relative_size, y_sign);
   31|   169k|      if(relative_size < 0) {
  ------------------
  |  Branch (31:10): [True: 100k, False: 68.8k]
  ------------------
   32|   100k|         z.set_sign(y_sign);
   33|   100k|      } else if(relative_size == 0) {
  ------------------
  |  Branch (33:17): [True: 26, False: 68.7k]
  ------------------
   34|     26|         z.set_sign(BigInt::Positive);
   35|  68.7k|      } else {
   36|  68.7k|         z.set_sign(x.sign());
   37|  68.7k|      }
   38|   169k|   }
   39|       |
   40|   768k|   return z;
   41|   768k|}
_ZN5BotanmlERKNS_6BigIntES2_:
   46|   735k|BigInt operator*(const BigInt& x, const BigInt& y) {
   47|   735k|   const size_t x_sw = x.sig_words();
   48|   735k|   const size_t y_sw = y.sig_words();
   49|       |
   50|   735k|   BigInt z = BigInt::with_capacity(x.size() + y.size());
   51|       |
   52|   735k|   if(x_sw == 1 && y_sw) {
  ------------------
  |  Branch (52:7): [True: 253k, False: 482k]
  |  Branch (52:20): [True: 252k, False: 1.04k]
  ------------------
   53|   252k|      bigint_linmul3(z.mutable_data(), y.data(), y_sw, x.word_at(0));
   54|   483k|   } else if(y_sw == 1 && x_sw) {
  ------------------
  |  Branch (54:14): [True: 225k, False: 257k]
  |  Branch (54:27): [True: 223k, False: 1.71k]
  ------------------
   55|   223k|      bigint_linmul3(z.mutable_data(), x.data(), x_sw, y.word_at(0));
   56|   259k|   } else if(x_sw && y_sw) {
  ------------------
  |  Branch (56:14): [True: 256k, False: 3.16k]
  |  Branch (56:22): [True: 254k, False: 1.76k]
  ------------------
   57|   254k|      secure_vector<word> workspace(z.size());
   58|       |
   59|   254k|      bigint_mul(z.mutable_data(),
   60|   254k|                 z.size(),
   61|   254k|                 x.data(),
   62|   254k|                 x.size(),
   63|   254k|                 x_sw,
   64|   254k|                 y.data(),
   65|   254k|                 y.size(),
   66|   254k|                 y_sw,
   67|   254k|                 workspace.data(),
   68|   254k|                 workspace.size());
   69|   254k|   }
   70|       |
   71|   735k|   z.cond_flip_sign(x_sw > 0 && y_sw > 0 && x.sign() != y.sign());
  ------------------
  |  Branch (71:21): [True: 731k, False: 3.16k]
  |  Branch (71:33): [True: 730k, False: 1.76k]
  |  Branch (71:45): [True: 215k, False: 514k]
  ------------------
   72|       |
   73|   735k|   return z;
   74|   735k|}
_ZN5BotanmlERKNS_6BigIntEm:
   79|   210k|BigInt operator*(const BigInt& x, word y) {
   80|   210k|   const size_t x_sw = x.sig_words();
   81|       |
   82|   210k|   BigInt z = BigInt::with_capacity(x_sw + 1);
   83|       |
   84|   210k|   if(x_sw && y) {
  ------------------
  |  Branch (84:7): [True: 210k, False: 0]
  |  Branch (84:15): [True: 105k, False: 104k]
  ------------------
   85|   105k|      bigint_linmul3(z.mutable_data(), x.data(), x_sw, y);
   86|   105k|      z.set_sign(x.sign());
   87|   105k|   }
   88|       |
   89|   210k|   return z;
   90|   210k|}
_ZN5BotandvERKNS_6BigIntES2_:
   95|  1.61k|BigInt operator/(const BigInt& x, const BigInt& y) {
   96|  1.61k|   if(y.sig_words() == 1) {
  ------------------
  |  Branch (96:7): [True: 198, False: 1.41k]
  ------------------
   97|    198|      return x / y.word_at(0);
   98|    198|   }
   99|       |
  100|  1.41k|   BigInt q, r;
  101|  1.41k|   vartime_divide(x, y, q, r);
  102|  1.41k|   return q;
  103|  1.61k|}
_ZN5BotandvERKNS_6BigIntEm:
  108|   131k|BigInt operator/(const BigInt& x, word y) {
  109|   131k|   if(y == 0) {
  ------------------
  |  Branch (109:7): [True: 0, False: 131k]
  ------------------
  110|      0|      throw Invalid_Argument("BigInt::operator/ divide by zero");
  111|      0|   }
  112|       |
  113|   131k|   BigInt q;
  114|   131k|   word r;
  115|   131k|   ct_divide_word(x, y, q, r);
  116|   131k|   return q;
  117|   131k|}
_ZN5BotanrmERKNS_6BigIntES2_:
  122|   145k|BigInt operator%(const BigInt& n, const BigInt& mod) {
  123|   145k|   if(mod.is_zero()) {
  ------------------
  |  Branch (123:7): [True: 0, False: 145k]
  ------------------
  124|      0|      throw Invalid_Argument("BigInt::operator% divide by zero");
  125|      0|   }
  126|   145k|   if(mod.is_negative()) {
  ------------------
  |  Branch (126:7): [True: 0, False: 145k]
  ------------------
  127|      0|      throw Invalid_Argument("BigInt::operator% modulus must be > 0");
  128|      0|   }
  129|   145k|   if(n.is_positive() && mod.is_positive() && n < mod) {
  ------------------
  |  Branch (129:7): [True: 142k, False: 2.30k]
  |  Branch (129:26): [True: 142k, False: 0]
  |  Branch (129:47): [True: 23.3k, False: 119k]
  ------------------
  130|  23.3k|      return n;
  131|  23.3k|   }
  132|       |
  133|   121k|   if(mod.sig_words() == 1) {
  ------------------
  |  Branch (133:7): [True: 40.2k, False: 81.4k]
  ------------------
  134|  40.2k|      return BigInt::from_word(n % mod.word_at(0));
  135|  40.2k|   }
  136|       |
  137|  81.4k|   BigInt q, r;
  138|  81.4k|   vartime_divide(n, mod, q, r);
  139|  81.4k|   return r;
  140|   121k|}
_ZN5BotanrmERKNS_6BigIntEm:
  145|   328k|word operator%(const BigInt& n, word mod) {
  146|   328k|   if(mod == 0) {
  ------------------
  |  Branch (146:7): [True: 0, False: 328k]
  ------------------
  147|      0|      throw Invalid_Argument("BigInt::operator% divide by zero");
  148|      0|   }
  149|       |
  150|   328k|   if(mod == 1) {
  ------------------
  |  Branch (150:7): [True: 0, False: 328k]
  ------------------
  151|      0|      return 0;
  152|      0|   }
  153|       |
  154|   328k|   word remainder = 0;
  155|       |
  156|   328k|   if(is_power_of_2(mod)) {
  ------------------
  |  Branch (156:7): [True: 287k, False: 40.2k]
  ------------------
  157|   287k|      remainder = (n.word_at(0) & (mod - 1));
  158|   287k|   } else {
  159|  40.2k|      const size_t sw = n.sig_words();
  160|   109k|      for(size_t i = sw; i > 0; --i) {
  ------------------
  |  Branch (160:26): [True: 69.1k, False: 40.2k]
  ------------------
  161|  69.1k|         remainder = bigint_modop_vartime(remainder, n.word_at(i - 1), mod);
  162|  69.1k|      }
  163|  40.2k|   }
  164|       |
  165|   328k|   if(remainder && n.sign() == BigInt::Negative) {
  ------------------
  |  Branch (165:7): [True: 328k, False: 0]
  |  Branch (165:20): [True: 154, False: 327k]
  ------------------
  166|    154|      return mod - remainder;
  167|    154|   }
  168|   327k|   return remainder;
  169|   328k|}
_ZN5BotanlsERKNS_6BigIntEm:
  174|  83.4k|BigInt operator<<(const BigInt& x, size_t shift) {
  175|  83.4k|   const size_t shift_words = shift / BOTAN_MP_WORD_BITS, shift_bits = shift % BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  83.4k|#define BOTAN_MP_WORD_BITS 64
  ------------------
                 const size_t shift_words = shift / BOTAN_MP_WORD_BITS, shift_bits = shift % BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  83.4k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  176|       |
  177|  83.4k|   const size_t x_sw = x.sig_words();
  178|       |
  179|  83.4k|   BigInt y = BigInt::with_capacity(x_sw + shift_words + (shift_bits ? 1 : 0));
  ------------------
  |  Branch (179:59): [True: 538, False: 82.8k]
  ------------------
  180|  83.4k|   bigint_shl2(y.mutable_data(), x.data(), x_sw, shift_words, shift_bits);
  181|  83.4k|   y.set_sign(x.sign());
  182|  83.4k|   return y;
  183|  83.4k|}
_ZN5BotanrsERKNS_6BigIntEm:
  188|  2.40k|BigInt operator>>(const BigInt& x, size_t shift) {
  189|  2.40k|   const size_t shift_words = shift / BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  2.40k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  190|  2.40k|   const size_t shift_bits = shift % BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  2.40k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  191|  2.40k|   const size_t x_sw = x.sig_words();
  192|       |
  193|  2.40k|   if(shift_words >= x_sw) {
  ------------------
  |  Branch (193:7): [True: 0, False: 2.40k]
  ------------------
  194|      0|      return BigInt::zero();
  195|      0|   }
  196|       |
  197|  2.40k|   BigInt y = BigInt::with_capacity(x_sw - shift_words);
  198|  2.40k|   bigint_shr2(y.mutable_data(), x.data(), x_sw, shift_words, shift_bits);
  199|       |
  200|  2.40k|   if(x.is_negative() && y.is_zero()) {
  ------------------
  |  Branch (200:7): [True: 0, False: 2.40k]
  |  Branch (200:26): [True: 0, False: 0]
  ------------------
  201|      0|      y.set_sign(BigInt::Positive);
  202|  2.40k|   } else {
  203|  2.40k|      y.set_sign(x.sign());
  204|  2.40k|   }
  205|       |
  206|  2.40k|   return y;
  207|  2.40k|}

_ZN5Botan6BigIntC2Em:
   18|    916|BigInt::BigInt(uint64_t n) {
   19|    916|#if BOTAN_MP_WORD_BITS == 64
   20|    916|   m_data.set_word_at(0, n);
   21|       |#else
   22|       |   m_data.set_word_at(1, static_cast<word>(n >> 32));
   23|       |   m_data.set_word_at(0, static_cast<word>(n));
   24|       |#endif
   25|    916|}
_ZN5Botan6BigInt8from_u64Em:
   28|    338|BigInt BigInt::from_u64(uint64_t n) {
   29|    338|   BigInt bn;
   30|       |
   31|    338|#if BOTAN_MP_WORD_BITS == 64
   32|    338|   bn.set_word_at(0, n);
   33|       |#else
   34|       |   bn.set_word_at(1, static_cast<word>(n >> 32));
   35|       |   bn.set_word_at(0, static_cast<word>(n));
   36|       |#endif
   37|       |
   38|    338|   return bn;
   39|    338|}
_ZN5Botan6BigInt9from_wordEm:
   42|  51.3k|BigInt BigInt::from_word(word n) {
   43|  51.3k|   BigInt bn;
   44|  51.3k|   bn.set_word_at(0, n);
   45|  51.3k|   return bn;
   46|  51.3k|}
_ZN5Botan6BigInt8from_s32Ei:
   49|    338|BigInt BigInt::from_s32(int32_t n) {
   50|    338|   if(n >= 0) {
  ------------------
  |  Branch (50:7): [True: 0, False: 338]
  ------------------
   51|      0|      return BigInt::from_u64(static_cast<uint64_t>(n));
   52|    338|   } else {
   53|    338|      return -BigInt::from_u64(static_cast<uint64_t>(-n));
   54|    338|   }
   55|    338|}
_ZN5Botan6BigInt13with_capacityEm:
   58|  2.18M|BigInt BigInt::with_capacity(size_t size) {
   59|  2.18M|   BigInt bn;
   60|  2.18M|   bn.grow_to(size);
   61|  2.18M|   return bn;
   62|  2.18M|}
_ZN5Botan6BigIntC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   67|    883|BigInt::BigInt(std::string_view str) {
   68|    883|   Base base = Decimal;
   69|    883|   size_t markers = 0;
   70|    883|   bool negative = false;
   71|       |
   72|    883|   if(str.length() > 0 && str[0] == '-') {
  ------------------
  |  Branch (72:7): [True: 883, False: 0]
  |  Branch (72:27): [True: 0, False: 883]
  ------------------
   73|      0|      markers += 1;
   74|      0|      negative = true;
   75|      0|   }
   76|       |
   77|    883|   if(str.length() > markers + 2 && str[markers] == '0' && str[markers + 1] == 'x') {
  ------------------
  |  Branch (77:7): [True: 748, False: 135]
  |  Branch (77:37): [True: 748, False: 0]
  |  Branch (77:60): [True: 748, False: 0]
  ------------------
   78|    748|      markers += 2;
   79|    748|      base = Hexadecimal;
   80|    748|   }
   81|       |
   82|    883|   *this = decode(cast_char_ptr_to_uint8(str.data()) + markers, str.length() - markers, base);
   83|       |
   84|    883|   if(negative) {
  ------------------
  |  Branch (84:7): [True: 0, False: 883]
  ------------------
   85|      0|      set_sign(Negative);
   86|    883|   } else {
   87|    883|      set_sign(Positive);
   88|    883|   }
   89|    883|}
_ZN5Botan6BigIntC2EPKhm:
   91|  15.5k|BigInt::BigInt(const uint8_t input[], size_t length) {
   92|  15.5k|   binary_decode(input, length);
   93|  15.5k|}
_ZN5Botan6BigInt24from_bytes_with_max_bitsEPKhmm:
  103|    202|BigInt BigInt::from_bytes_with_max_bits(const uint8_t input[], size_t length, size_t max_bits) {
  104|    202|   const size_t input_bits = 8 * length;
  105|       |
  106|    202|   BigInt bn;
  107|    202|   bn.binary_decode(input, length);
  108|       |
  109|    202|   if(input_bits > max_bits) {
  ------------------
  |  Branch (109:7): [True: 75, False: 127]
  ------------------
  110|     75|      const size_t bits_to_shift = input_bits - max_bits;
  111|       |
  112|     75|      bn >>= bits_to_shift;
  113|     75|   }
  114|       |
  115|    202|   return bn;
  116|    202|}
_ZNK5Botan6BigInt7byte_atEm:
  125|  10.0k|uint8_t BigInt::byte_at(size_t n) const {
  126|  10.0k|   return get_byte_var(sizeof(word) - (n % sizeof(word)) - 1, word_at(n / sizeof(word)));
  127|  10.0k|}
_ZNK5Botan6BigInt8cmp_wordEm:
  129|   918k|int32_t BigInt::cmp_word(word other) const {
  130|   918k|   if(is_negative()) {
  ------------------
  |  Branch (130:7): [True: 2.65k, False: 915k]
  ------------------
  131|  2.65k|      return -1;  // other is positive ...
  132|  2.65k|   }
  133|       |
  134|   915k|   const size_t sw = this->sig_words();
  135|   915k|   if(sw > 1) {
  ------------------
  |  Branch (135:7): [True: 839k, False: 76.7k]
  ------------------
  136|   839k|      return 1;  // must be larger since other is just one word ...
  137|   839k|   }
  138|       |
  139|  76.7k|   return bigint_cmp(this->data(), sw, &other, 1);
  140|   915k|}
_ZNK5Botan6BigInt3cmpERKS0_b:
  145|  5.43k|int32_t BigInt::cmp(const BigInt& other, bool check_signs) const {
  146|  5.43k|   if(check_signs) {
  ------------------
  |  Branch (146:7): [True: 5.43k, False: 0]
  ------------------
  147|  5.43k|      if(other.is_positive() && this->is_negative()) {
  ------------------
  |  Branch (147:10): [True: 5.43k, False: 0]
  |  Branch (147:33): [True: 0, False: 5.43k]
  ------------------
  148|      0|         return -1;
  149|      0|      }
  150|       |
  151|  5.43k|      if(other.is_negative() && this->is_positive()) {
  ------------------
  |  Branch (151:10): [True: 0, False: 5.43k]
  |  Branch (151:33): [True: 0, False: 0]
  ------------------
  152|      0|         return 1;
  153|      0|      }
  154|       |
  155|  5.43k|      if(other.is_negative() && this->is_negative()) {
  ------------------
  |  Branch (155:10): [True: 0, False: 5.43k]
  |  Branch (155:33): [True: 0, False: 0]
  ------------------
  156|      0|         return (-bigint_cmp(this->data(), this->size(), other.data(), other.size()));
  157|      0|      }
  158|  5.43k|   }
  159|       |
  160|  5.43k|   return bigint_cmp(this->data(), this->size(), other.data(), other.size());
  161|  5.43k|}
_ZNK5Botan6BigInt8is_equalERKS0_:
  163|   227k|bool BigInt::is_equal(const BigInt& other) const {
  164|   227k|   if(this->sign() != other.sign()) {
  ------------------
  |  Branch (164:7): [True: 0, False: 227k]
  ------------------
  165|      0|      return false;
  166|      0|   }
  167|       |
  168|   227k|   return bigint_ct_is_eq(this->data(), this->sig_words(), other.data(), other.sig_words()).as_bool();
  169|   227k|}
_ZNK5Botan6BigInt12is_less_thanERKS0_:
  171|   311k|bool BigInt::is_less_than(const BigInt& other) const {
  172|   311k|   if(this->is_negative() && other.is_positive()) {
  ------------------
  |  Branch (172:7): [True: 54, False: 311k]
  |  Branch (172:30): [True: 54, False: 0]
  ------------------
  173|     54|      return true;
  174|     54|   }
  175|       |
  176|   311k|   if(this->is_positive() && other.is_negative()) {
  ------------------
  |  Branch (176:7): [True: 311k, False: 0]
  |  Branch (176:30): [True: 0, False: 311k]
  ------------------
  177|      0|      return false;
  178|      0|   }
  179|       |
  180|   311k|   if(other.is_negative() && this->is_negative()) {
  ------------------
  |  Branch (180:7): [True: 0, False: 311k]
  |  Branch (180:30): [True: 0, False: 0]
  ------------------
  181|      0|      return bigint_ct_is_lt(other.data(), other.sig_words(), this->data(), this->sig_words()).as_bool();
  182|      0|   }
  183|       |
  184|   311k|   return bigint_ct_is_lt(this->data(), this->sig_words(), other.data(), other.sig_words()).as_bool();
  185|   311k|}
_ZNK5Botan6BigInt12encode_wordsEPmm:
  187|   929k|void BigInt::encode_words(word out[], size_t size) const {
  188|   929k|   const size_t words = sig_words();
  189|       |
  190|   929k|   if(words > size) {
  ------------------
  |  Branch (190:7): [True: 0, False: 929k]
  ------------------
  191|      0|      throw Encoding_Error("BigInt::encode_words value too large to encode");
  192|      0|   }
  193|       |
  194|   929k|   clear_mem(out, size);
  195|   929k|   copy_mem(out, data(), words);
  196|   929k|}
_ZNK5Botan6BigInt4Data14calc_sig_wordsEv:
  198|  22.2M|size_t BigInt::Data::calc_sig_words() const {
  199|  22.2M|   const size_t sz = m_reg.size();
  200|  22.2M|   size_t sig = sz;
  201|       |
  202|  22.2M|   word sub = 1;
  203|       |
  204|   257M|   for(size_t i = 0; i != sz; ++i) {
  ------------------
  |  Branch (204:22): [True: 235M, False: 22.2M]
  ------------------
  205|   235M|      const word w = m_reg[sz - i - 1];
  206|   235M|      sub &= ct_is_zero(w);
  207|   235M|      sig -= sub;
  208|   235M|   }
  209|       |
  210|       |   /*
  211|       |   * This depends on the data so is poisoned, but unpoison it here as
  212|       |   * later conditionals are made on the size.
  213|       |   */
  214|  22.2M|   CT::unpoison(sig);
  215|       |
  216|  22.2M|   return sig;
  217|  22.2M|}
_ZNK5Botan6BigInt13get_substringEmm:
  222|   313k|uint32_t BigInt::get_substring(size_t offset, size_t length) const {
  223|   313k|   if(length == 0 || length > 32) {
  ------------------
  |  Branch (223:7): [True: 0, False: 313k]
  |  Branch (223:22): [True: 0, False: 313k]
  ------------------
  224|      0|      throw Invalid_Argument("BigInt::get_substring invalid substring length");
  225|      0|   }
  226|       |
  227|   313k|   const uint32_t mask = 0xFFFFFFFF >> (32 - length);
  228|       |
  229|   313k|   const size_t word_offset = offset / BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|   313k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  230|   313k|   const size_t wshift = (offset % BOTAN_MP_WORD_BITS);
  ------------------
  |  |   50|   313k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  231|       |
  232|       |   /*
  233|       |   * The substring is contained within one or at most two words. The
  234|       |   * offset and length are not secret, so we can perform conditional
  235|       |   * operations on those values.
  236|       |   */
  237|   313k|   const word w0 = word_at(word_offset);
  238|       |
  239|   313k|   if(wshift == 0 || (offset + length) / BOTAN_MP_WORD_BITS == word_offset) {
  ------------------
  |  |   50|   285k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  |  Branch (239:7): [True: 28.0k, False: 285k]
  |  Branch (239:22): [True: 273k, False: 11.9k]
  ------------------
  240|   301k|      return static_cast<uint32_t>(w0 >> wshift) & mask;
  241|   301k|   } else {
  242|  11.9k|      const word w1 = word_at(word_offset + 1);
  243|  11.9k|      return static_cast<uint32_t>((w0 >> wshift) | (w1 << (BOTAN_MP_WORD_BITS - wshift))) & mask;
  ------------------
  |  |   50|  11.9k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  244|  11.9k|   }
  245|   313k|}
_ZNK5Botan6BigInt5bytesEv:
  277|  12.4k|size_t BigInt::bytes() const {
  278|  12.4k|   return round_up(bits(), 8) / 8;
  279|  12.4k|}
_ZNK5Botan6BigInt13top_bits_freeEv:
  281|   421k|size_t BigInt::top_bits_free() const {
  282|   421k|   const size_t words = sig_words();
  283|       |
  284|   421k|   const word top_word = word_at(words - 1);
  285|   421k|   const size_t bits_used = high_bit(top_word);
  286|   421k|   CT::unpoison(bits_used);
  287|   421k|   return BOTAN_MP_WORD_BITS - bits_used;
  ------------------
  |  |   50|   421k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  288|   421k|}
_ZNK5Botan6BigInt4bitsEv:
  290|   175k|size_t BigInt::bits() const {
  291|   175k|   const size_t words = sig_words();
  292|       |
  293|   175k|   if(words == 0) {
  ------------------
  |  Branch (293:7): [True: 2.28k, False: 173k]
  ------------------
  294|  2.28k|      return 0;
  295|  2.28k|   }
  296|       |
  297|   173k|   const size_t full_words = (words - 1) * BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|   173k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  298|   173k|   const size_t top_bits = BOTAN_MP_WORD_BITS - top_bits_free();
  ------------------
  |  |   50|   173k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  299|       |
  300|   173k|   return full_words + top_bits;
  301|   175k|}
_ZNK5Botan6BigIntngEv:
  306|    405|BigInt BigInt::operator-() const {
  307|    405|   BigInt x = (*this);
  308|    405|   x.flip_sign();
  309|    405|   return x;
  310|    405|}
_ZN5Botan6BigInt12reduce_belowERKS0_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  312|  1.22M|size_t BigInt::reduce_below(const BigInt& p, secure_vector<word>& ws) {
  313|  1.22M|   if(p.is_negative() || this->is_negative()) {
  ------------------
  |  Branch (313:7): [True: 0, False: 1.22M]
  |  Branch (313:26): [True: 0, False: 1.22M]
  ------------------
  314|      0|      throw Invalid_Argument("BigInt::reduce_below both values must be positive");
  315|      0|   }
  316|       |
  317|  1.22M|   const size_t p_words = p.sig_words();
  318|       |
  319|  1.22M|   if(size() < p_words + 1) {
  ------------------
  |  Branch (319:7): [True: 109, False: 1.22M]
  ------------------
  320|    109|      grow_to(p_words + 1);
  321|    109|   }
  322|       |
  323|  1.22M|   if(ws.size() < p_words + 1) {
  ------------------
  |  Branch (323:7): [True: 82.8k, False: 1.14M]
  ------------------
  324|  82.8k|      ws.resize(p_words + 1);
  325|  82.8k|   }
  326|       |
  327|  1.22M|   clear_mem(ws.data(), ws.size());
  328|       |
  329|  1.22M|   size_t reductions = 0;
  330|       |
  331|  3.07M|   for(;;) {
  332|  3.07M|      word borrow = bigint_sub3(ws.data(), data(), p_words + 1, p.data(), p_words);
  333|  3.07M|      if(borrow) {
  ------------------
  |  Branch (333:10): [True: 1.22M, False: 1.84M]
  ------------------
  334|  1.22M|         break;
  335|  1.22M|      }
  336|       |
  337|  1.84M|      ++reductions;
  338|  1.84M|      swap_reg(ws);
  339|  1.84M|   }
  340|       |
  341|  1.22M|   return reductions;
  342|  1.22M|}
_ZN5Botan6BigInt15ct_reduce_belowERKS0_RNSt3__16vectorImNS_16secure_allocatorImEEEEm:
  344|  2.59M|void BigInt::ct_reduce_below(const BigInt& mod, secure_vector<word>& ws, size_t bound) {
  345|  2.59M|   if(mod.is_negative() || this->is_negative()) {
  ------------------
  |  Branch (345:7): [True: 0, False: 2.59M]
  |  Branch (345:28): [True: 0, False: 2.59M]
  ------------------
  346|      0|      throw Invalid_Argument("BigInt::ct_reduce_below both values must be positive");
  347|      0|   }
  348|       |
  349|  2.59M|   const size_t mod_words = mod.sig_words();
  350|       |
  351|  2.59M|   grow_to(mod_words);
  352|       |
  353|  2.59M|   const size_t sz = size();
  354|       |
  355|  2.59M|   ws.resize(sz);
  356|       |
  357|  2.59M|   clear_mem(ws.data(), sz);
  358|       |
  359|  7.79M|   for(size_t i = 0; i != bound; ++i) {
  ------------------
  |  Branch (359:22): [True: 5.19M, False: 2.59M]
  ------------------
  360|  5.19M|      word borrow = bigint_sub3(ws.data(), data(), sz, mod.data(), mod_words);
  361|       |
  362|  5.19M|      CT::Mask<word>::is_zero(borrow).select_n(mutable_data(), ws.data(), data(), sz);
  363|  5.19M|   }
  364|  2.59M|}
_ZNK5Botan6BigInt3absEv:
  369|  2.15k|BigInt BigInt::abs() const {
  370|  2.15k|   BigInt x = (*this);
  371|  2.15k|   x.set_sign(Positive);
  372|  2.15k|   return x;
  373|  2.15k|}
_ZNK5Botan6BigInt13binary_encodeEPh:
  375|  5.35k|void BigInt::binary_encode(uint8_t buf[]) const {
  376|  5.35k|   this->binary_encode(buf, bytes());
  377|  5.35k|}
_ZNK5Botan6BigInt13binary_encodeEPhm:
  382|  6.14k|void BigInt::binary_encode(uint8_t output[], size_t len) const {
  383|  6.14k|   const size_t full_words = len / sizeof(word);
  384|  6.14k|   const size_t extra_bytes = len % sizeof(word);
  385|       |
  386|  23.0k|   for(size_t i = 0; i != full_words; ++i) {
  ------------------
  |  Branch (386:22): [True: 16.8k, False: 6.14k]
  ------------------
  387|  16.8k|      const word w = word_at(i);
  388|  16.8k|      store_be(w, output + (len - (i + 1) * sizeof(word)));
  389|  16.8k|   }
  390|       |
  391|  6.14k|   if(extra_bytes > 0) {
  ------------------
  |  Branch (391:7): [True: 4.01k, False: 2.13k]
  ------------------
  392|  4.01k|      const word w = word_at(full_words);
  393|       |
  394|  14.6k|      for(size_t i = 0; i != extra_bytes; ++i) {
  ------------------
  |  Branch (394:25): [True: 10.6k, False: 4.01k]
  ------------------
  395|  10.6k|         output[extra_bytes - i - 1] = get_byte_var(sizeof(word) - i - 1, w);
  396|  10.6k|      }
  397|  4.01k|   }
  398|  6.14k|}
_ZN5Botan6BigInt13binary_decodeEPKhm:
  403|  16.9k|void BigInt::binary_decode(const uint8_t buf[], size_t length) {
  404|  16.9k|   clear();
  405|       |
  406|  16.9k|   const size_t full_words = length / sizeof(word);
  407|  16.9k|   const size_t extra_bytes = length % sizeof(word);
  408|       |
  409|  16.9k|   secure_vector<word> reg((round_up(full_words + (extra_bytes > 0 ? 1 : 0), 8)));
  ------------------
  |  Branch (409:52): [True: 13.9k, False: 2.99k]
  ------------------
  410|       |
  411|  74.1k|   for(size_t i = 0; i != full_words; ++i) {
  ------------------
  |  Branch (411:22): [True: 57.1k, False: 16.9k]
  ------------------
  412|  57.1k|      reg[i] = load_be<word>(buf + length - sizeof(word) * (i + 1), 0);
  413|  57.1k|   }
  414|       |
  415|  16.9k|   if(extra_bytes > 0) {
  ------------------
  |  Branch (415:7): [True: 13.9k, False: 2.99k]
  ------------------
  416|  55.7k|      for(size_t i = 0; i != extra_bytes; ++i) {
  ------------------
  |  Branch (416:25): [True: 41.8k, False: 13.9k]
  ------------------
  417|  41.8k|         reg[full_words] = (reg[full_words] << 8) | buf[i];
  418|  41.8k|      }
  419|  13.9k|   }
  420|       |
  421|  16.9k|   m_data.swap(reg);
  422|  16.9k|}
_ZN5Botan6BigInt11ct_cond_addEbRKS0_:
  424|   695k|void BigInt::ct_cond_add(bool predicate, const BigInt& value) {
  425|   695k|   if(this->is_negative() || value.is_negative()) {
  ------------------
  |  Branch (425:7): [True: 0, False: 695k]
  |  Branch (425:30): [True: 0, False: 695k]
  ------------------
  426|      0|      throw Invalid_Argument("BigInt::ct_cond_add requires both values to be positive");
  427|      0|   }
  428|   695k|   this->grow_to(1 + value.sig_words());
  429|       |
  430|   695k|   bigint_cnd_add(static_cast<word>(predicate), this->mutable_data(), this->size(), value.data(), value.sig_words());
  431|   695k|}
_ZN5Botan6BigInt12ct_cond_swapEbRS0_:
  467|  3.91M|void BigInt::ct_cond_swap(bool predicate, BigInt& other) {
  468|  3.91M|   const size_t max_words = std::max(size(), other.size());
  469|  3.91M|   grow_to(max_words);
  470|  3.91M|   other.grow_to(max_words);
  471|       |
  472|  3.91M|   bigint_cnd_swap(predicate, this->mutable_data(), other.mutable_data(), max_words);
  473|  3.91M|}
_ZN5Botan6BigInt14cond_flip_signEb:
  475|  6.48M|void BigInt::cond_flip_sign(bool predicate) {
  476|       |   // This code is assuming Negative == 0, Positive == 1
  477|       |
  478|  6.48M|   const auto mask = CT::Mask<uint8_t>::expand(predicate);
  479|       |
  480|  6.48M|   const uint8_t current_sign = static_cast<uint8_t>(sign());
  481|       |
  482|  6.48M|   const uint8_t new_sign = mask.select(current_sign ^ 1, current_sign);
  483|       |
  484|  6.48M|   set_sign(static_cast<Sign>(new_sign));
  485|  6.48M|}
_ZN5Botan6BigInt14ct_cond_assignEbRKS0_:
  487|   463k|void BigInt::ct_cond_assign(bool predicate, const BigInt& other) {
  488|   463k|   const size_t t_words = size();
  489|   463k|   const size_t o_words = other.size();
  490|       |
  491|   463k|   if(o_words < t_words) {
  ------------------
  |  Branch (491:7): [True: 19.8k, False: 443k]
  ------------------
  492|  19.8k|      grow_to(o_words);
  493|  19.8k|   }
  494|       |
  495|   463k|   const size_t r_words = std::max(t_words, o_words);
  496|       |
  497|   463k|   const auto mask = CT::Mask<word>::expand(predicate);
  498|       |
  499|  5.21M|   for(size_t i = 0; i != r_words; ++i) {
  ------------------
  |  Branch (499:22): [True: 4.75M, False: 463k]
  ------------------
  500|  4.75M|      const word o_word = other.word_at(i);
  501|  4.75M|      const word t_word = this->word_at(i);
  502|  4.75M|      this->set_word_at(i, mask.select(o_word, t_word));
  503|  4.75M|   }
  504|       |
  505|   463k|   const bool different_sign = sign() != other.sign();
  506|   463k|   cond_flip_sign(predicate && different_sign);
  ------------------
  |  Branch (506:19): [True: 156k, False: 307k]
  |  Branch (506:32): [True: 0, False: 156k]
  ------------------
  507|   463k|}

_ZN5Botan9ct_divideERKNS_6BigIntES2_RS0_S3_:
   48|  4.27k|void ct_divide(const BigInt& x, const BigInt& y, BigInt& q_out, BigInt& r_out) {
   49|  4.27k|   if(y.is_zero()) {
  ------------------
  |  Branch (49:7): [True: 0, False: 4.27k]
  ------------------
   50|      0|      throw Invalid_Argument("ct_divide: cannot divide by zero");
   51|      0|   }
   52|       |
   53|  4.27k|   const size_t x_words = x.sig_words();
   54|  4.27k|   const size_t y_words = y.sig_words();
   55|       |
   56|  4.27k|   const size_t x_bits = x.bits();
   57|       |
   58|  4.27k|   BigInt q = BigInt::with_capacity(x_words);
   59|  4.27k|   BigInt r = BigInt::with_capacity(y_words);
   60|  4.27k|   BigInt t = BigInt::with_capacity(y_words);  // a temporary
   61|       |
   62|  3.92M|   for(size_t i = 0; i != x_bits; ++i) {
  ------------------
  |  Branch (62:22): [True: 3.91M, False: 4.27k]
  ------------------
   63|  3.91M|      const size_t b = x_bits - 1 - i;
   64|  3.91M|      const bool x_b = x.get_bit(b);
   65|       |
   66|  3.91M|      r *= 2;
   67|  3.91M|      r.conditionally_set_bit(0, x_b);
   68|       |
   69|  3.91M|      const bool r_gte_y = bigint_sub3(t.mutable_data(), r.data(), r.size(), y.data(), y_words) == 0;
   70|       |
   71|  3.91M|      q.conditionally_set_bit(b, r_gte_y);
   72|  3.91M|      r.ct_cond_swap(r_gte_y, t);
   73|  3.91M|   }
   74|       |
   75|  4.27k|   sign_fixup(x, y, q, r);
   76|  4.27k|   r_out = r;
   77|  4.27k|   q_out = q;
   78|  4.27k|}
_ZN5Botan14ct_divide_wordERKNS_6BigIntEmRS0_Rm:
   80|   131k|void ct_divide_word(const BigInt& x, word y, BigInt& q_out, word& r_out) {
   81|   131k|   if(y == 0) {
  ------------------
  |  Branch (81:7): [True: 0, False: 131k]
  ------------------
   82|      0|      throw Invalid_Argument("ct_divide_word: cannot divide by zero");
   83|      0|   }
   84|       |
   85|   131k|   const size_t x_words = x.sig_words();
   86|   131k|   const size_t x_bits = x.bits();
   87|       |
   88|   131k|   BigInt q = BigInt::with_capacity(x_words);
   89|   131k|   word r = 0;
   90|       |
   91|  19.1M|   for(size_t i = 0; i != x_bits; ++i) {
  ------------------
  |  Branch (91:22): [True: 19.0M, False: 131k]
  ------------------
   92|  19.0M|      const size_t b = x_bits - 1 - i;
   93|  19.0M|      const bool x_b = x.get_bit(b);
   94|       |
   95|  19.0M|      const auto r_carry = CT::Mask<word>::expand(r >> (BOTAN_MP_WORD_BITS - 1));
  ------------------
  |  |   50|  19.0M|#define BOTAN_MP_WORD_BITS 64
  ------------------
   96|       |
   97|  19.0M|      r *= 2;
   98|  19.0M|      r += x_b;
   99|       |
  100|  19.0M|      const auto r_gte_y = CT::Mask<word>::is_gte(r, y) | r_carry;
  101|  19.0M|      q.conditionally_set_bit(b, r_gte_y.as_bool());
  102|  19.0M|      r = r_gte_y.select(r - y, r);
  103|  19.0M|   }
  104|       |
  105|   131k|   if(x.is_negative()) {
  ------------------
  |  Branch (105:7): [True: 0, False: 131k]
  ------------------
  106|      0|      q.flip_sign();
  107|      0|      if(r != 0) {
  ------------------
  |  Branch (107:10): [True: 0, False: 0]
  ------------------
  108|      0|         --q;
  109|      0|         r = y - r;
  110|      0|      }
  111|      0|   }
  112|       |
  113|   131k|   r_out = r;
  114|   131k|   q_out = q;
  115|   131k|}
_ZN5Botan14vartime_divideERKNS_6BigIntES2_RS0_S3_:
  155|  82.8k|void vartime_divide(const BigInt& x, const BigInt& y_arg, BigInt& q_out, BigInt& r_out) {
  156|  82.8k|   if(y_arg.is_zero()) {
  ------------------
  |  Branch (156:7): [True: 0, False: 82.8k]
  ------------------
  157|      0|      throw Invalid_Argument("vartime_divide: cannot divide by zero");
  158|      0|   }
  159|       |
  160|  82.8k|   const size_t y_words = y_arg.sig_words();
  161|       |
  162|  82.8k|   BOTAN_ASSERT_NOMSG(y_words > 0);
  ------------------
  |  |   60|  82.8k|   do {                                                                     \
  |  |   61|  82.8k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 82.8k]
  |  |  ------------------
  |  |   62|  82.8k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  82.8k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  163|       |
  164|  82.8k|   BigInt y = y_arg;
  165|       |
  166|  82.8k|   BigInt r = x;
  167|  82.8k|   BigInt q = BigInt::zero();
  168|  82.8k|   secure_vector<word> ws;
  169|       |
  170|  82.8k|   r.set_sign(BigInt::Positive);
  171|  82.8k|   y.set_sign(BigInt::Positive);
  172|       |
  173|       |   // Calculate shifts needed to normalize y with high bit set
  174|  82.8k|   const size_t shifts = y.top_bits_free();
  175|       |
  176|  82.8k|   y <<= shifts;
  177|  82.8k|   r <<= shifts;
  178|       |
  179|       |   // we know y has not changed size, since we only shifted up to set high bit
  180|  82.8k|   const size_t t = y_words - 1;
  181|  82.8k|   const size_t n = std::max(y_words, r.sig_words()) - 1;  // r may have changed size however
  182|       |
  183|  82.8k|   BOTAN_ASSERT_NOMSG(n >= t);
  ------------------
  |  |   60|  82.8k|   do {                                                                     \
  |  |   61|  82.8k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 82.8k]
  |  |  ------------------
  |  |   62|  82.8k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  82.8k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  184|       |
  185|  82.8k|   q.grow_to(n - t + 1);
  186|       |
  187|  82.8k|   word* q_words = q.mutable_data();
  188|       |
  189|  82.8k|   BigInt shifted_y = y << (BOTAN_MP_WORD_BITS * (n - t));
  ------------------
  |  |   50|  82.8k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  190|       |
  191|       |   // Set q_{n-t} to number of times r > shifted_y
  192|  82.8k|   q_words[n - t] = r.reduce_below(shifted_y, ws);
  193|       |
  194|  82.8k|   const word y_t0 = y.word_at(t);
  195|  82.8k|   const word y_t1 = y.word_at(t - 1);
  196|  82.8k|   BOTAN_DEBUG_ASSERT((y_t0 >> (BOTAN_MP_WORD_BITS - 1)) == 1);
  ------------------
  |  |   99|  82.8k|      do {                          \
  |  |  100|  82.8k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  197|       |
  198|   187k|   for(size_t j = n; j != t; --j) {
  ------------------
  |  Branch (198:22): [True: 104k, False: 82.8k]
  ------------------
  199|   104k|      const word x_j0 = r.word_at(j);
  200|   104k|      const word x_j1 = r.word_at(j - 1);
  201|   104k|      const word x_j2 = r.word_at(j - 2);
  202|       |
  203|   104k|      word qjt = bigint_divop_vartime(x_j0, x_j1, y_t0);
  204|       |
  205|   104k|      qjt = CT::Mask<word>::is_equal(x_j0, y_t0).select(MP_WORD_MAX, qjt);
  206|       |
  207|       |      // Per HAC 14.23, this operation is required at most twice
  208|   104k|      qjt -= division_check(qjt, y_t0, y_t1, x_j0, x_j1, x_j2);
  209|   104k|      qjt -= division_check(qjt, y_t0, y_t1, x_j0, x_j1, x_j2);
  210|   104k|      BOTAN_DEBUG_ASSERT(division_check(qjt, y_t0, y_t1, x_j0, x_j1, x_j2) == false);
  ------------------
  |  |   99|   104k|      do {                          \
  |  |  100|   104k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  211|       |
  212|   104k|      shifted_y >>= BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|   104k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  213|       |      // Now shifted_y == y << (BOTAN_MP_WORD_BITS * (j-t-1))
  214|       |
  215|       |      // TODO this sequence could be better
  216|   104k|      r -= qjt * shifted_y;
  217|   104k|      qjt -= r.is_negative();
  218|   104k|      r += static_cast<word>(r.is_negative()) * shifted_y;
  219|       |
  220|   104k|      q_words[j - t - 1] = qjt;
  221|   104k|   }
  222|       |
  223|  82.8k|   r >>= shifts;
  224|       |
  225|  82.8k|   sign_fixup(x, y_arg, q, r);
  226|       |
  227|  82.8k|   r_out = r;
  228|  82.8k|   q_out = q;
  229|  82.8k|}
divide.cpp:_ZN5Botan12_GLOBAL__N_110sign_fixupERKNS_6BigIntES3_RS1_S4_:
   21|  87.1k|void sign_fixup(const BigInt& x, const BigInt& y, BigInt& q, BigInt& r) {
   22|  87.1k|   q.cond_flip_sign(x.sign() != y.sign());
   23|       |
   24|  87.1k|   if(x.is_negative() && r.is_nonzero()) {
  ------------------
  |  Branch (24:7): [True: 2.15k, False: 84.9k]
  |  Branch (24:26): [True: 2.15k, False: 0]
  ------------------
   25|  2.15k|      q -= 1;
   26|  2.15k|      r = y.abs() - r;
   27|  2.15k|   }
   28|  87.1k|}
divide.cpp:_ZN5Botan12_GLOBAL__N_114division_checkEmmmmmm:
   30|   209k|inline bool division_check(word q, word y2, word y1, word x3, word x2, word x1) {
   31|       |   /*
   32|       |   Compute (y3,y2,y1) = (y2,y1) * q
   33|       |   and return true if (y3,y2,y1) > (x3,x2,x1)
   34|       |   */
   35|       |
   36|   209k|   word y3 = 0;
   37|   209k|   y1 = word_madd2(q, y1, &y3);
   38|   209k|   y2 = word_madd2(q, y2, &y3);
   39|       |
   40|   209k|   const word x[3] = {x1, x2, x3};
   41|   209k|   const word y[3] = {y1, y2, y3};
   42|       |
   43|   209k|   return bigint_ct_is_lt(x, 3, y, 3).as_bool();
   44|   209k|}

_ZN5Botan17bigint_comba_sqr4EPmPKm:
   16|  3.72M|void bigint_comba_sqr4(word z[8], const word x[4]) {
   17|  3.72M|   word w2 = 0, w1 = 0, w0 = 0;
   18|       |
   19|  3.72M|   word3_muladd(&w2, &w1, &w0, x[0], x[0]);
   20|  3.72M|   z[0] = w0;
   21|  3.72M|   w0 = 0;
   22|       |
   23|  3.72M|   word3_muladd_2(&w0, &w2, &w1, x[0], x[1]);
   24|  3.72M|   z[1] = w1;
   25|  3.72M|   w1 = 0;
   26|       |
   27|  3.72M|   word3_muladd_2(&w1, &w0, &w2, x[0], x[2]);
   28|  3.72M|   word3_muladd(&w1, &w0, &w2, x[1], x[1]);
   29|  3.72M|   z[2] = w2;
   30|  3.72M|   w2 = 0;
   31|       |
   32|  3.72M|   word3_muladd_2(&w2, &w1, &w0, x[0], x[3]);
   33|  3.72M|   word3_muladd_2(&w2, &w1, &w0, x[1], x[2]);
   34|  3.72M|   z[3] = w0;
   35|  3.72M|   w0 = 0;
   36|       |
   37|  3.72M|   word3_muladd_2(&w0, &w2, &w1, x[1], x[3]);
   38|  3.72M|   word3_muladd(&w0, &w2, &w1, x[2], x[2]);
   39|  3.72M|   z[4] = w1;
   40|  3.72M|   w1 = 0;
   41|       |
   42|  3.72M|   word3_muladd_2(&w1, &w0, &w2, x[2], x[3]);
   43|  3.72M|   z[5] = w2;
   44|  3.72M|   w2 = 0;
   45|       |
   46|  3.72M|   word3_muladd(&w2, &w1, &w0, x[3], x[3]);
   47|  3.72M|   z[6] = w0;
   48|  3.72M|   z[7] = w1;
   49|  3.72M|}
_ZN5Botan17bigint_comba_mul4EPmPKmS2_:
   54|  8.43M|void bigint_comba_mul4(word z[8], const word x[4], const word y[4]) {
   55|  8.43M|   word w2 = 0, w1 = 0, w0 = 0;
   56|       |
   57|  8.43M|   word3_muladd(&w2, &w1, &w0, x[0], y[0]);
   58|  8.43M|   z[0] = w0;
   59|  8.43M|   w0 = 0;
   60|       |
   61|  8.43M|   word3_muladd(&w0, &w2, &w1, x[0], y[1]);
   62|  8.43M|   word3_muladd(&w0, &w2, &w1, x[1], y[0]);
   63|  8.43M|   z[1] = w1;
   64|  8.43M|   w1 = 0;
   65|       |
   66|  8.43M|   word3_muladd(&w1, &w0, &w2, x[0], y[2]);
   67|  8.43M|   word3_muladd(&w1, &w0, &w2, x[1], y[1]);
   68|  8.43M|   word3_muladd(&w1, &w0, &w2, x[2], y[0]);
   69|  8.43M|   z[2] = w2;
   70|  8.43M|   w2 = 0;
   71|       |
   72|  8.43M|   word3_muladd(&w2, &w1, &w0, x[0], y[3]);
   73|  8.43M|   word3_muladd(&w2, &w1, &w0, x[1], y[2]);
   74|  8.43M|   word3_muladd(&w2, &w1, &w0, x[2], y[1]);
   75|  8.43M|   word3_muladd(&w2, &w1, &w0, x[3], y[0]);
   76|  8.43M|   z[3] = w0;
   77|  8.43M|   w0 = 0;
   78|       |
   79|  8.43M|   word3_muladd(&w0, &w2, &w1, x[1], y[3]);
   80|  8.43M|   word3_muladd(&w0, &w2, &w1, x[2], y[2]);
   81|  8.43M|   word3_muladd(&w0, &w2, &w1, x[3], y[1]);
   82|  8.43M|   z[4] = w1;
   83|  8.43M|   w1 = 0;
   84|       |
   85|  8.43M|   word3_muladd(&w1, &w0, &w2, x[2], y[3]);
   86|  8.43M|   word3_muladd(&w1, &w0, &w2, x[3], y[2]);
   87|  8.43M|   z[5] = w2;
   88|  8.43M|   w2 = 0;
   89|       |
   90|  8.43M|   word3_muladd(&w2, &w1, &w0, x[3], y[3]);
   91|  8.43M|   z[6] = w0;
   92|  8.43M|   z[7] = w1;
   93|  8.43M|}
_ZN5Botan17bigint_comba_sqr6EPmPKm:
   98|   192k|void bigint_comba_sqr6(word z[12], const word x[6]) {
   99|   192k|   word w2 = 0, w1 = 0, w0 = 0;
  100|       |
  101|   192k|   word3_muladd(&w2, &w1, &w0, x[0], x[0]);
  102|   192k|   z[0] = w0;
  103|   192k|   w0 = 0;
  104|       |
  105|   192k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[1]);
  106|   192k|   z[1] = w1;
  107|   192k|   w1 = 0;
  108|       |
  109|   192k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[2]);
  110|   192k|   word3_muladd(&w1, &w0, &w2, x[1], x[1]);
  111|   192k|   z[2] = w2;
  112|   192k|   w2 = 0;
  113|       |
  114|   192k|   word3_muladd_2(&w2, &w1, &w0, x[0], x[3]);
  115|   192k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[2]);
  116|   192k|   z[3] = w0;
  117|   192k|   w0 = 0;
  118|       |
  119|   192k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[4]);
  120|   192k|   word3_muladd_2(&w0, &w2, &w1, x[1], x[3]);
  121|   192k|   word3_muladd(&w0, &w2, &w1, x[2], x[2]);
  122|   192k|   z[4] = w1;
  123|   192k|   w1 = 0;
  124|       |
  125|   192k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[5]);
  126|   192k|   word3_muladd_2(&w1, &w0, &w2, x[1], x[4]);
  127|   192k|   word3_muladd_2(&w1, &w0, &w2, x[2], x[3]);
  128|   192k|   z[5] = w2;
  129|   192k|   w2 = 0;
  130|       |
  131|   192k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[5]);
  132|   192k|   word3_muladd_2(&w2, &w1, &w0, x[2], x[4]);
  133|   192k|   word3_muladd(&w2, &w1, &w0, x[3], x[3]);
  134|   192k|   z[6] = w0;
  135|   192k|   w0 = 0;
  136|       |
  137|   192k|   word3_muladd_2(&w0, &w2, &w1, x[2], x[5]);
  138|   192k|   word3_muladd_2(&w0, &w2, &w1, x[3], x[4]);
  139|   192k|   z[7] = w1;
  140|   192k|   w1 = 0;
  141|       |
  142|   192k|   word3_muladd_2(&w1, &w0, &w2, x[3], x[5]);
  143|   192k|   word3_muladd(&w1, &w0, &w2, x[4], x[4]);
  144|   192k|   z[8] = w2;
  145|   192k|   w2 = 0;
  146|       |
  147|   192k|   word3_muladd_2(&w2, &w1, &w0, x[4], x[5]);
  148|   192k|   z[9] = w0;
  149|   192k|   w0 = 0;
  150|       |
  151|   192k|   word3_muladd(&w0, &w2, &w1, x[5], x[5]);
  152|   192k|   z[10] = w1;
  153|   192k|   z[11] = w2;
  154|   192k|}
_ZN5Botan17bigint_comba_mul6EPmPKmS2_:
  159|   174k|void bigint_comba_mul6(word z[12], const word x[6], const word y[6]) {
  160|   174k|   word w2 = 0, w1 = 0, w0 = 0;
  161|       |
  162|   174k|   word3_muladd(&w2, &w1, &w0, x[0], y[0]);
  163|   174k|   z[0] = w0;
  164|   174k|   w0 = 0;
  165|       |
  166|   174k|   word3_muladd(&w0, &w2, &w1, x[0], y[1]);
  167|   174k|   word3_muladd(&w0, &w2, &w1, x[1], y[0]);
  168|   174k|   z[1] = w1;
  169|   174k|   w1 = 0;
  170|       |
  171|   174k|   word3_muladd(&w1, &w0, &w2, x[0], y[2]);
  172|   174k|   word3_muladd(&w1, &w0, &w2, x[1], y[1]);
  173|   174k|   word3_muladd(&w1, &w0, &w2, x[2], y[0]);
  174|   174k|   z[2] = w2;
  175|   174k|   w2 = 0;
  176|       |
  177|   174k|   word3_muladd(&w2, &w1, &w0, x[0], y[3]);
  178|   174k|   word3_muladd(&w2, &w1, &w0, x[1], y[2]);
  179|   174k|   word3_muladd(&w2, &w1, &w0, x[2], y[1]);
  180|   174k|   word3_muladd(&w2, &w1, &w0, x[3], y[0]);
  181|   174k|   z[3] = w0;
  182|   174k|   w0 = 0;
  183|       |
  184|   174k|   word3_muladd(&w0, &w2, &w1, x[0], y[4]);
  185|   174k|   word3_muladd(&w0, &w2, &w1, x[1], y[3]);
  186|   174k|   word3_muladd(&w0, &w2, &w1, x[2], y[2]);
  187|   174k|   word3_muladd(&w0, &w2, &w1, x[3], y[1]);
  188|   174k|   word3_muladd(&w0, &w2, &w1, x[4], y[0]);
  189|   174k|   z[4] = w1;
  190|   174k|   w1 = 0;
  191|       |
  192|   174k|   word3_muladd(&w1, &w0, &w2, x[0], y[5]);
  193|   174k|   word3_muladd(&w1, &w0, &w2, x[1], y[4]);
  194|   174k|   word3_muladd(&w1, &w0, &w2, x[2], y[3]);
  195|   174k|   word3_muladd(&w1, &w0, &w2, x[3], y[2]);
  196|   174k|   word3_muladd(&w1, &w0, &w2, x[4], y[1]);
  197|   174k|   word3_muladd(&w1, &w0, &w2, x[5], y[0]);
  198|   174k|   z[5] = w2;
  199|   174k|   w2 = 0;
  200|       |
  201|   174k|   word3_muladd(&w2, &w1, &w0, x[1], y[5]);
  202|   174k|   word3_muladd(&w2, &w1, &w0, x[2], y[4]);
  203|   174k|   word3_muladd(&w2, &w1, &w0, x[3], y[3]);
  204|   174k|   word3_muladd(&w2, &w1, &w0, x[4], y[2]);
  205|   174k|   word3_muladd(&w2, &w1, &w0, x[5], y[1]);
  206|   174k|   z[6] = w0;
  207|   174k|   w0 = 0;
  208|       |
  209|   174k|   word3_muladd(&w0, &w2, &w1, x[2], y[5]);
  210|   174k|   word3_muladd(&w0, &w2, &w1, x[3], y[4]);
  211|   174k|   word3_muladd(&w0, &w2, &w1, x[4], y[3]);
  212|   174k|   word3_muladd(&w0, &w2, &w1, x[5], y[2]);
  213|   174k|   z[7] = w1;
  214|   174k|   w1 = 0;
  215|       |
  216|   174k|   word3_muladd(&w1, &w0, &w2, x[3], y[5]);
  217|   174k|   word3_muladd(&w1, &w0, &w2, x[4], y[4]);
  218|   174k|   word3_muladd(&w1, &w0, &w2, x[5], y[3]);
  219|   174k|   z[8] = w2;
  220|   174k|   w2 = 0;
  221|       |
  222|   174k|   word3_muladd(&w2, &w1, &w0, x[4], y[5]);
  223|   174k|   word3_muladd(&w2, &w1, &w0, x[5], y[4]);
  224|   174k|   z[9] = w0;
  225|   174k|   w0 = 0;
  226|       |
  227|   174k|   word3_muladd(&w0, &w2, &w1, x[5], y[5]);
  228|   174k|   z[10] = w1;
  229|   174k|   z[11] = w2;
  230|   174k|}
_ZN5Botan17bigint_comba_sqr8EPmPKm:
  235|  42.9k|void bigint_comba_sqr8(word z[16], const word x[8]) {
  236|  42.9k|   word w2 = 0, w1 = 0, w0 = 0;
  237|       |
  238|  42.9k|   word3_muladd(&w2, &w1, &w0, x[0], x[0]);
  239|  42.9k|   z[0] = w0;
  240|  42.9k|   w0 = 0;
  241|       |
  242|  42.9k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[1]);
  243|  42.9k|   z[1] = w1;
  244|  42.9k|   w1 = 0;
  245|       |
  246|  42.9k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[2]);
  247|  42.9k|   word3_muladd(&w1, &w0, &w2, x[1], x[1]);
  248|  42.9k|   z[2] = w2;
  249|  42.9k|   w2 = 0;
  250|       |
  251|  42.9k|   word3_muladd_2(&w2, &w1, &w0, x[0], x[3]);
  252|  42.9k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[2]);
  253|  42.9k|   z[3] = w0;
  254|  42.9k|   w0 = 0;
  255|       |
  256|  42.9k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[4]);
  257|  42.9k|   word3_muladd_2(&w0, &w2, &w1, x[1], x[3]);
  258|  42.9k|   word3_muladd(&w0, &w2, &w1, x[2], x[2]);
  259|  42.9k|   z[4] = w1;
  260|  42.9k|   w1 = 0;
  261|       |
  262|  42.9k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[5]);
  263|  42.9k|   word3_muladd_2(&w1, &w0, &w2, x[1], x[4]);
  264|  42.9k|   word3_muladd_2(&w1, &w0, &w2, x[2], x[3]);
  265|  42.9k|   z[5] = w2;
  266|  42.9k|   w2 = 0;
  267|       |
  268|  42.9k|   word3_muladd_2(&w2, &w1, &w0, x[0], x[6]);
  269|  42.9k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[5]);
  270|  42.9k|   word3_muladd_2(&w2, &w1, &w0, x[2], x[4]);
  271|  42.9k|   word3_muladd(&w2, &w1, &w0, x[3], x[3]);
  272|  42.9k|   z[6] = w0;
  273|  42.9k|   w0 = 0;
  274|       |
  275|  42.9k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[7]);
  276|  42.9k|   word3_muladd_2(&w0, &w2, &w1, x[1], x[6]);
  277|  42.9k|   word3_muladd_2(&w0, &w2, &w1, x[2], x[5]);
  278|  42.9k|   word3_muladd_2(&w0, &w2, &w1, x[3], x[4]);
  279|  42.9k|   z[7] = w1;
  280|  42.9k|   w1 = 0;
  281|       |
  282|  42.9k|   word3_muladd_2(&w1, &w0, &w2, x[1], x[7]);
  283|  42.9k|   word3_muladd_2(&w1, &w0, &w2, x[2], x[6]);
  284|  42.9k|   word3_muladd_2(&w1, &w0, &w2, x[3], x[5]);
  285|  42.9k|   word3_muladd(&w1, &w0, &w2, x[4], x[4]);
  286|  42.9k|   z[8] = w2;
  287|  42.9k|   w2 = 0;
  288|       |
  289|  42.9k|   word3_muladd_2(&w2, &w1, &w0, x[2], x[7]);
  290|  42.9k|   word3_muladd_2(&w2, &w1, &w0, x[3], x[6]);
  291|  42.9k|   word3_muladd_2(&w2, &w1, &w0, x[4], x[5]);
  292|  42.9k|   z[9] = w0;
  293|  42.9k|   w0 = 0;
  294|       |
  295|  42.9k|   word3_muladd_2(&w0, &w2, &w1, x[3], x[7]);
  296|  42.9k|   word3_muladd_2(&w0, &w2, &w1, x[4], x[6]);
  297|  42.9k|   word3_muladd(&w0, &w2, &w1, x[5], x[5]);
  298|  42.9k|   z[10] = w1;
  299|  42.9k|   w1 = 0;
  300|       |
  301|  42.9k|   word3_muladd_2(&w1, &w0, &w2, x[4], x[7]);
  302|  42.9k|   word3_muladd_2(&w1, &w0, &w2, x[5], x[6]);
  303|  42.9k|   z[11] = w2;
  304|  42.9k|   w2 = 0;
  305|       |
  306|  42.9k|   word3_muladd_2(&w2, &w1, &w0, x[5], x[7]);
  307|  42.9k|   word3_muladd(&w2, &w1, &w0, x[6], x[6]);
  308|  42.9k|   z[12] = w0;
  309|  42.9k|   w0 = 0;
  310|       |
  311|  42.9k|   word3_muladd_2(&w0, &w2, &w1, x[6], x[7]);
  312|  42.9k|   z[13] = w1;
  313|  42.9k|   w1 = 0;
  314|       |
  315|  42.9k|   word3_muladd(&w1, &w0, &w2, x[7], x[7]);
  316|  42.9k|   z[14] = w2;
  317|  42.9k|   z[15] = w0;
  318|  42.9k|}
_ZN5Botan17bigint_comba_mul8EPmPKmS2_:
  323|  53.5k|void bigint_comba_mul8(word z[16], const word x[8], const word y[8]) {
  324|  53.5k|   word w2 = 0, w1 = 0, w0 = 0;
  325|       |
  326|  53.5k|   word3_muladd(&w2, &w1, &w0, x[0], y[0]);
  327|  53.5k|   z[0] = w0;
  328|  53.5k|   w0 = 0;
  329|       |
  330|  53.5k|   word3_muladd(&w0, &w2, &w1, x[0], y[1]);
  331|  53.5k|   word3_muladd(&w0, &w2, &w1, x[1], y[0]);
  332|  53.5k|   z[1] = w1;
  333|  53.5k|   w1 = 0;
  334|       |
  335|  53.5k|   word3_muladd(&w1, &w0, &w2, x[0], y[2]);
  336|  53.5k|   word3_muladd(&w1, &w0, &w2, x[1], y[1]);
  337|  53.5k|   word3_muladd(&w1, &w0, &w2, x[2], y[0]);
  338|  53.5k|   z[2] = w2;
  339|  53.5k|   w2 = 0;
  340|       |
  341|  53.5k|   word3_muladd(&w2, &w1, &w0, x[0], y[3]);
  342|  53.5k|   word3_muladd(&w2, &w1, &w0, x[1], y[2]);
  343|  53.5k|   word3_muladd(&w2, &w1, &w0, x[2], y[1]);
  344|  53.5k|   word3_muladd(&w2, &w1, &w0, x[3], y[0]);
  345|  53.5k|   z[3] = w0;
  346|  53.5k|   w0 = 0;
  347|       |
  348|  53.5k|   word3_muladd(&w0, &w2, &w1, x[0], y[4]);
  349|  53.5k|   word3_muladd(&w0, &w2, &w1, x[1], y[3]);
  350|  53.5k|   word3_muladd(&w0, &w2, &w1, x[2], y[2]);
  351|  53.5k|   word3_muladd(&w0, &w2, &w1, x[3], y[1]);
  352|  53.5k|   word3_muladd(&w0, &w2, &w1, x[4], y[0]);
  353|  53.5k|   z[4] = w1;
  354|  53.5k|   w1 = 0;
  355|       |
  356|  53.5k|   word3_muladd(&w1, &w0, &w2, x[0], y[5]);
  357|  53.5k|   word3_muladd(&w1, &w0, &w2, x[1], y[4]);
  358|  53.5k|   word3_muladd(&w1, &w0, &w2, x[2], y[3]);
  359|  53.5k|   word3_muladd(&w1, &w0, &w2, x[3], y[2]);
  360|  53.5k|   word3_muladd(&w1, &w0, &w2, x[4], y[1]);
  361|  53.5k|   word3_muladd(&w1, &w0, &w2, x[5], y[0]);
  362|  53.5k|   z[5] = w2;
  363|  53.5k|   w2 = 0;
  364|       |
  365|  53.5k|   word3_muladd(&w2, &w1, &w0, x[0], y[6]);
  366|  53.5k|   word3_muladd(&w2, &w1, &w0, x[1], y[5]);
  367|  53.5k|   word3_muladd(&w2, &w1, &w0, x[2], y[4]);
  368|  53.5k|   word3_muladd(&w2, &w1, &w0, x[3], y[3]);
  369|  53.5k|   word3_muladd(&w2, &w1, &w0, x[4], y[2]);
  370|  53.5k|   word3_muladd(&w2, &w1, &w0, x[5], y[1]);
  371|  53.5k|   word3_muladd(&w2, &w1, &w0, x[6], y[0]);
  372|  53.5k|   z[6] = w0;
  373|  53.5k|   w0 = 0;
  374|       |
  375|  53.5k|   word3_muladd(&w0, &w2, &w1, x[0], y[7]);
  376|  53.5k|   word3_muladd(&w0, &w2, &w1, x[1], y[6]);
  377|  53.5k|   word3_muladd(&w0, &w2, &w1, x[2], y[5]);
  378|  53.5k|   word3_muladd(&w0, &w2, &w1, x[3], y[4]);
  379|  53.5k|   word3_muladd(&w0, &w2, &w1, x[4], y[3]);
  380|  53.5k|   word3_muladd(&w0, &w2, &w1, x[5], y[2]);
  381|  53.5k|   word3_muladd(&w0, &w2, &w1, x[6], y[1]);
  382|  53.5k|   word3_muladd(&w0, &w2, &w1, x[7], y[0]);
  383|  53.5k|   z[7] = w1;
  384|  53.5k|   w1 = 0;
  385|       |
  386|  53.5k|   word3_muladd(&w1, &w0, &w2, x[1], y[7]);
  387|  53.5k|   word3_muladd(&w1, &w0, &w2, x[2], y[6]);
  388|  53.5k|   word3_muladd(&w1, &w0, &w2, x[3], y[5]);
  389|  53.5k|   word3_muladd(&w1, &w0, &w2, x[4], y[4]);
  390|  53.5k|   word3_muladd(&w1, &w0, &w2, x[5], y[3]);
  391|  53.5k|   word3_muladd(&w1, &w0, &w2, x[6], y[2]);
  392|  53.5k|   word3_muladd(&w1, &w0, &w2, x[7], y[1]);
  393|  53.5k|   z[8] = w2;
  394|  53.5k|   w2 = 0;
  395|       |
  396|  53.5k|   word3_muladd(&w2, &w1, &w0, x[2], y[7]);
  397|  53.5k|   word3_muladd(&w2, &w1, &w0, x[3], y[6]);
  398|  53.5k|   word3_muladd(&w2, &w1, &w0, x[4], y[5]);
  399|  53.5k|   word3_muladd(&w2, &w1, &w0, x[5], y[4]);
  400|  53.5k|   word3_muladd(&w2, &w1, &w0, x[6], y[3]);
  401|  53.5k|   word3_muladd(&w2, &w1, &w0, x[7], y[2]);
  402|  53.5k|   z[9] = w0;
  403|  53.5k|   w0 = 0;
  404|       |
  405|  53.5k|   word3_muladd(&w0, &w2, &w1, x[3], y[7]);
  406|  53.5k|   word3_muladd(&w0, &w2, &w1, x[4], y[6]);
  407|  53.5k|   word3_muladd(&w0, &w2, &w1, x[5], y[5]);
  408|  53.5k|   word3_muladd(&w0, &w2, &w1, x[6], y[4]);
  409|  53.5k|   word3_muladd(&w0, &w2, &w1, x[7], y[3]);
  410|  53.5k|   z[10] = w1;
  411|  53.5k|   w1 = 0;
  412|       |
  413|  53.5k|   word3_muladd(&w1, &w0, &w2, x[4], y[7]);
  414|  53.5k|   word3_muladd(&w1, &w0, &w2, x[5], y[6]);
  415|  53.5k|   word3_muladd(&w1, &w0, &w2, x[6], y[5]);
  416|  53.5k|   word3_muladd(&w1, &w0, &w2, x[7], y[4]);
  417|  53.5k|   z[11] = w2;
  418|  53.5k|   w2 = 0;
  419|       |
  420|  53.5k|   word3_muladd(&w2, &w1, &w0, x[5], y[7]);
  421|  53.5k|   word3_muladd(&w2, &w1, &w0, x[6], y[6]);
  422|  53.5k|   word3_muladd(&w2, &w1, &w0, x[7], y[5]);
  423|  53.5k|   z[12] = w0;
  424|  53.5k|   w0 = 0;
  425|       |
  426|  53.5k|   word3_muladd(&w0, &w2, &w1, x[6], y[7]);
  427|  53.5k|   word3_muladd(&w0, &w2, &w1, x[7], y[6]);
  428|  53.5k|   z[13] = w1;
  429|  53.5k|   w1 = 0;
  430|       |
  431|  53.5k|   word3_muladd(&w1, &w0, &w2, x[7], y[7]);
  432|  53.5k|   z[14] = w2;
  433|  53.5k|   z[15] = w0;
  434|  53.5k|}
_ZN5Botan17bigint_comba_sqr9EPmPKm:
  439|   332k|void bigint_comba_sqr9(word z[18], const word x[9]) {
  440|   332k|   word w2 = 0, w1 = 0, w0 = 0;
  441|       |
  442|   332k|   word3_muladd(&w2, &w1, &w0, x[0], x[0]);
  443|   332k|   z[0] = w0;
  444|   332k|   w0 = 0;
  445|       |
  446|   332k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[1]);
  447|   332k|   z[1] = w1;
  448|   332k|   w1 = 0;
  449|       |
  450|   332k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[2]);
  451|   332k|   word3_muladd(&w1, &w0, &w2, x[1], x[1]);
  452|   332k|   z[2] = w2;
  453|   332k|   w2 = 0;
  454|       |
  455|   332k|   word3_muladd_2(&w2, &w1, &w0, x[0], x[3]);
  456|   332k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[2]);
  457|   332k|   z[3] = w0;
  458|   332k|   w0 = 0;
  459|       |
  460|   332k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[4]);
  461|   332k|   word3_muladd_2(&w0, &w2, &w1, x[1], x[3]);
  462|   332k|   word3_muladd(&w0, &w2, &w1, x[2], x[2]);
  463|   332k|   z[4] = w1;
  464|   332k|   w1 = 0;
  465|       |
  466|   332k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[5]);
  467|   332k|   word3_muladd_2(&w1, &w0, &w2, x[1], x[4]);
  468|   332k|   word3_muladd_2(&w1, &w0, &w2, x[2], x[3]);
  469|   332k|   z[5] = w2;
  470|   332k|   w2 = 0;
  471|       |
  472|   332k|   word3_muladd_2(&w2, &w1, &w0, x[0], x[6]);
  473|   332k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[5]);
  474|   332k|   word3_muladd_2(&w2, &w1, &w0, x[2], x[4]);
  475|   332k|   word3_muladd(&w2, &w1, &w0, x[3], x[3]);
  476|   332k|   z[6] = w0;
  477|   332k|   w0 = 0;
  478|       |
  479|   332k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[7]);
  480|   332k|   word3_muladd_2(&w0, &w2, &w1, x[1], x[6]);
  481|   332k|   word3_muladd_2(&w0, &w2, &w1, x[2], x[5]);
  482|   332k|   word3_muladd_2(&w0, &w2, &w1, x[3], x[4]);
  483|   332k|   z[7] = w1;
  484|   332k|   w1 = 0;
  485|       |
  486|   332k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[8]);
  487|   332k|   word3_muladd_2(&w1, &w0, &w2, x[1], x[7]);
  488|   332k|   word3_muladd_2(&w1, &w0, &w2, x[2], x[6]);
  489|   332k|   word3_muladd_2(&w1, &w0, &w2, x[3], x[5]);
  490|   332k|   word3_muladd(&w1, &w0, &w2, x[4], x[4]);
  491|   332k|   z[8] = w2;
  492|   332k|   w2 = 0;
  493|       |
  494|   332k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[8]);
  495|   332k|   word3_muladd_2(&w2, &w1, &w0, x[2], x[7]);
  496|   332k|   word3_muladd_2(&w2, &w1, &w0, x[3], x[6]);
  497|   332k|   word3_muladd_2(&w2, &w1, &w0, x[4], x[5]);
  498|   332k|   z[9] = w0;
  499|   332k|   w0 = 0;
  500|       |
  501|   332k|   word3_muladd_2(&w0, &w2, &w1, x[2], x[8]);
  502|   332k|   word3_muladd_2(&w0, &w2, &w1, x[3], x[7]);
  503|   332k|   word3_muladd_2(&w0, &w2, &w1, x[4], x[6]);
  504|   332k|   word3_muladd(&w0, &w2, &w1, x[5], x[5]);
  505|   332k|   z[10] = w1;
  506|   332k|   w1 = 0;
  507|       |
  508|   332k|   word3_muladd_2(&w1, &w0, &w2, x[3], x[8]);
  509|   332k|   word3_muladd_2(&w1, &w0, &w2, x[4], x[7]);
  510|   332k|   word3_muladd_2(&w1, &w0, &w2, x[5], x[6]);
  511|   332k|   z[11] = w2;
  512|   332k|   w2 = 0;
  513|       |
  514|   332k|   word3_muladd_2(&w2, &w1, &w0, x[4], x[8]);
  515|   332k|   word3_muladd_2(&w2, &w1, &w0, x[5], x[7]);
  516|   332k|   word3_muladd(&w2, &w1, &w0, x[6], x[6]);
  517|   332k|   z[12] = w0;
  518|   332k|   w0 = 0;
  519|       |
  520|   332k|   word3_muladd_2(&w0, &w2, &w1, x[5], x[8]);
  521|   332k|   word3_muladd_2(&w0, &w2, &w1, x[6], x[7]);
  522|   332k|   z[13] = w1;
  523|   332k|   w1 = 0;
  524|       |
  525|   332k|   word3_muladd_2(&w1, &w0, &w2, x[6], x[8]);
  526|   332k|   word3_muladd(&w1, &w0, &w2, x[7], x[7]);
  527|   332k|   z[14] = w2;
  528|   332k|   w2 = 0;
  529|       |
  530|   332k|   word3_muladd_2(&w2, &w1, &w0, x[7], x[8]);
  531|   332k|   z[15] = w0;
  532|   332k|   w0 = 0;
  533|       |
  534|   332k|   word3_muladd(&w0, &w2, &w1, x[8], x[8]);
  535|   332k|   z[16] = w1;
  536|   332k|   z[17] = w2;
  537|   332k|}
_ZN5Botan17bigint_comba_mul9EPmPKmS2_:
  542|   348k|void bigint_comba_mul9(word z[18], const word x[9], const word y[9]) {
  543|   348k|   word w2 = 0, w1 = 0, w0 = 0;
  544|       |
  545|   348k|   word3_muladd(&w2, &w1, &w0, x[0], y[0]);
  546|   348k|   z[0] = w0;
  547|   348k|   w0 = 0;
  548|       |
  549|   348k|   word3_muladd(&w0, &w2, &w1, x[0], y[1]);
  550|   348k|   word3_muladd(&w0, &w2, &w1, x[1], y[0]);
  551|   348k|   z[1] = w1;
  552|   348k|   w1 = 0;
  553|       |
  554|   348k|   word3_muladd(&w1, &w0, &w2, x[0], y[2]);
  555|   348k|   word3_muladd(&w1, &w0, &w2, x[1], y[1]);
  556|   348k|   word3_muladd(&w1, &w0, &w2, x[2], y[0]);
  557|   348k|   z[2] = w2;
  558|   348k|   w2 = 0;
  559|       |
  560|   348k|   word3_muladd(&w2, &w1, &w0, x[0], y[3]);
  561|   348k|   word3_muladd(&w2, &w1, &w0, x[1], y[2]);
  562|   348k|   word3_muladd(&w2, &w1, &w0, x[2], y[1]);
  563|   348k|   word3_muladd(&w2, &w1, &w0, x[3], y[0]);
  564|   348k|   z[3] = w0;
  565|   348k|   w0 = 0;
  566|       |
  567|   348k|   word3_muladd(&w0, &w2, &w1, x[0], y[4]);
  568|   348k|   word3_muladd(&w0, &w2, &w1, x[1], y[3]);
  569|   348k|   word3_muladd(&w0, &w2, &w1, x[2], y[2]);
  570|   348k|   word3_muladd(&w0, &w2, &w1, x[3], y[1]);
  571|   348k|   word3_muladd(&w0, &w2, &w1, x[4], y[0]);
  572|   348k|   z[4] = w1;
  573|   348k|   w1 = 0;
  574|       |
  575|   348k|   word3_muladd(&w1, &w0, &w2, x[0], y[5]);
  576|   348k|   word3_muladd(&w1, &w0, &w2, x[1], y[4]);
  577|   348k|   word3_muladd(&w1, &w0, &w2, x[2], y[3]);
  578|   348k|   word3_muladd(&w1, &w0, &w2, x[3], y[2]);
  579|   348k|   word3_muladd(&w1, &w0, &w2, x[4], y[1]);
  580|   348k|   word3_muladd(&w1, &w0, &w2, x[5], y[0]);
  581|   348k|   z[5] = w2;
  582|   348k|   w2 = 0;
  583|       |
  584|   348k|   word3_muladd(&w2, &w1, &w0, x[0], y[6]);
  585|   348k|   word3_muladd(&w2, &w1, &w0, x[1], y[5]);
  586|   348k|   word3_muladd(&w2, &w1, &w0, x[2], y[4]);
  587|   348k|   word3_muladd(&w2, &w1, &w0, x[3], y[3]);
  588|   348k|   word3_muladd(&w2, &w1, &w0, x[4], y[2]);
  589|   348k|   word3_muladd(&w2, &w1, &w0, x[5], y[1]);
  590|   348k|   word3_muladd(&w2, &w1, &w0, x[6], y[0]);
  591|   348k|   z[6] = w0;
  592|   348k|   w0 = 0;
  593|       |
  594|   348k|   word3_muladd(&w0, &w2, &w1, x[0], y[7]);
  595|   348k|   word3_muladd(&w0, &w2, &w1, x[1], y[6]);
  596|   348k|   word3_muladd(&w0, &w2, &w1, x[2], y[5]);
  597|   348k|   word3_muladd(&w0, &w2, &w1, x[3], y[4]);
  598|   348k|   word3_muladd(&w0, &w2, &w1, x[4], y[3]);
  599|   348k|   word3_muladd(&w0, &w2, &w1, x[5], y[2]);
  600|   348k|   word3_muladd(&w0, &w2, &w1, x[6], y[1]);
  601|   348k|   word3_muladd(&w0, &w2, &w1, x[7], y[0]);
  602|   348k|   z[7] = w1;
  603|   348k|   w1 = 0;
  604|       |
  605|   348k|   word3_muladd(&w1, &w0, &w2, x[0], y[8]);
  606|   348k|   word3_muladd(&w1, &w0, &w2, x[1], y[7]);
  607|   348k|   word3_muladd(&w1, &w0, &w2, x[2], y[6]);
  608|   348k|   word3_muladd(&w1, &w0, &w2, x[3], y[5]);
  609|   348k|   word3_muladd(&w1, &w0, &w2, x[4], y[4]);
  610|   348k|   word3_muladd(&w1, &w0, &w2, x[5], y[3]);
  611|   348k|   word3_muladd(&w1, &w0, &w2, x[6], y[2]);
  612|   348k|   word3_muladd(&w1, &w0, &w2, x[7], y[1]);
  613|   348k|   word3_muladd(&w1, &w0, &w2, x[8], y[0]);
  614|   348k|   z[8] = w2;
  615|   348k|   w2 = 0;
  616|       |
  617|   348k|   word3_muladd(&w2, &w1, &w0, x[1], y[8]);
  618|   348k|   word3_muladd(&w2, &w1, &w0, x[2], y[7]);
  619|   348k|   word3_muladd(&w2, &w1, &w0, x[3], y[6]);
  620|   348k|   word3_muladd(&w2, &w1, &w0, x[4], y[5]);
  621|   348k|   word3_muladd(&w2, &w1, &w0, x[5], y[4]);
  622|   348k|   word3_muladd(&w2, &w1, &w0, x[6], y[3]);
  623|   348k|   word3_muladd(&w2, &w1, &w0, x[7], y[2]);
  624|   348k|   word3_muladd(&w2, &w1, &w0, x[8], y[1]);
  625|   348k|   z[9] = w0;
  626|   348k|   w0 = 0;
  627|       |
  628|   348k|   word3_muladd(&w0, &w2, &w1, x[2], y[8]);
  629|   348k|   word3_muladd(&w0, &w2, &w1, x[3], y[7]);
  630|   348k|   word3_muladd(&w0, &w2, &w1, x[4], y[6]);
  631|   348k|   word3_muladd(&w0, &w2, &w1, x[5], y[5]);
  632|   348k|   word3_muladd(&w0, &w2, &w1, x[6], y[4]);
  633|   348k|   word3_muladd(&w0, &w2, &w1, x[7], y[3]);
  634|   348k|   word3_muladd(&w0, &w2, &w1, x[8], y[2]);
  635|   348k|   z[10] = w1;
  636|   348k|   w1 = 0;
  637|       |
  638|   348k|   word3_muladd(&w1, &w0, &w2, x[3], y[8]);
  639|   348k|   word3_muladd(&w1, &w0, &w2, x[4], y[7]);
  640|   348k|   word3_muladd(&w1, &w0, &w2, x[5], y[6]);
  641|   348k|   word3_muladd(&w1, &w0, &w2, x[6], y[5]);
  642|   348k|   word3_muladd(&w1, &w0, &w2, x[7], y[4]);
  643|   348k|   word3_muladd(&w1, &w0, &w2, x[8], y[3]);
  644|   348k|   z[11] = w2;
  645|   348k|   w2 = 0;
  646|       |
  647|   348k|   word3_muladd(&w2, &w1, &w0, x[4], y[8]);
  648|   348k|   word3_muladd(&w2, &w1, &w0, x[5], y[7]);
  649|   348k|   word3_muladd(&w2, &w1, &w0, x[6], y[6]);
  650|   348k|   word3_muladd(&w2, &w1, &w0, x[7], y[5]);
  651|   348k|   word3_muladd(&w2, &w1, &w0, x[8], y[4]);
  652|   348k|   z[12] = w0;
  653|   348k|   w0 = 0;
  654|       |
  655|   348k|   word3_muladd(&w0, &w2, &w1, x[5], y[8]);
  656|   348k|   word3_muladd(&w0, &w2, &w1, x[6], y[7]);
  657|   348k|   word3_muladd(&w0, &w2, &w1, x[7], y[6]);
  658|   348k|   word3_muladd(&w0, &w2, &w1, x[8], y[5]);
  659|   348k|   z[13] = w1;
  660|   348k|   w1 = 0;
  661|       |
  662|   348k|   word3_muladd(&w1, &w0, &w2, x[6], y[8]);
  663|   348k|   word3_muladd(&w1, &w0, &w2, x[7], y[7]);
  664|   348k|   word3_muladd(&w1, &w0, &w2, x[8], y[6]);
  665|   348k|   z[14] = w2;
  666|   348k|   w2 = 0;
  667|       |
  668|   348k|   word3_muladd(&w2, &w1, &w0, x[7], y[8]);
  669|   348k|   word3_muladd(&w2, &w1, &w0, x[8], y[7]);
  670|   348k|   z[15] = w0;
  671|   348k|   w0 = 0;
  672|       |
  673|   348k|   word3_muladd(&w0, &w2, &w1, x[8], y[8]);
  674|   348k|   z[16] = w1;
  675|   348k|   z[17] = w2;
  676|   348k|}
_ZN5Botan18bigint_comba_sqr16EPmPKm:
  681|  19.2k|void bigint_comba_sqr16(word z[32], const word x[16]) {
  682|  19.2k|   word w2 = 0, w1 = 0, w0 = 0;
  683|       |
  684|  19.2k|   word3_muladd(&w2, &w1, &w0, x[0], x[0]);
  685|  19.2k|   z[0] = w0;
  686|  19.2k|   w0 = 0;
  687|       |
  688|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[1]);
  689|  19.2k|   z[1] = w1;
  690|  19.2k|   w1 = 0;
  691|       |
  692|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[2]);
  693|  19.2k|   word3_muladd(&w1, &w0, &w2, x[1], x[1]);
  694|  19.2k|   z[2] = w2;
  695|  19.2k|   w2 = 0;
  696|       |
  697|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[0], x[3]);
  698|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[2]);
  699|  19.2k|   z[3] = w0;
  700|  19.2k|   w0 = 0;
  701|       |
  702|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[4]);
  703|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[1], x[3]);
  704|  19.2k|   word3_muladd(&w0, &w2, &w1, x[2], x[2]);
  705|  19.2k|   z[4] = w1;
  706|  19.2k|   w1 = 0;
  707|       |
  708|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[5]);
  709|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[1], x[4]);
  710|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[2], x[3]);
  711|  19.2k|   z[5] = w2;
  712|  19.2k|   w2 = 0;
  713|       |
  714|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[0], x[6]);
  715|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[5]);
  716|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[2], x[4]);
  717|  19.2k|   word3_muladd(&w2, &w1, &w0, x[3], x[3]);
  718|  19.2k|   z[6] = w0;
  719|  19.2k|   w0 = 0;
  720|       |
  721|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[7]);
  722|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[1], x[6]);
  723|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[2], x[5]);
  724|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[3], x[4]);
  725|  19.2k|   z[7] = w1;
  726|  19.2k|   w1 = 0;
  727|       |
  728|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[8]);
  729|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[1], x[7]);
  730|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[2], x[6]);
  731|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[3], x[5]);
  732|  19.2k|   word3_muladd(&w1, &w0, &w2, x[4], x[4]);
  733|  19.2k|   z[8] = w2;
  734|  19.2k|   w2 = 0;
  735|       |
  736|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[0], x[9]);
  737|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[8]);
  738|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[2], x[7]);
  739|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[3], x[6]);
  740|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[4], x[5]);
  741|  19.2k|   z[9] = w0;
  742|  19.2k|   w0 = 0;
  743|       |
  744|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[10]);
  745|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[1], x[9]);
  746|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[2], x[8]);
  747|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[3], x[7]);
  748|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[4], x[6]);
  749|  19.2k|   word3_muladd(&w0, &w2, &w1, x[5], x[5]);
  750|  19.2k|   z[10] = w1;
  751|  19.2k|   w1 = 0;
  752|       |
  753|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[11]);
  754|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[1], x[10]);
  755|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[2], x[9]);
  756|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[3], x[8]);
  757|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[4], x[7]);
  758|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[5], x[6]);
  759|  19.2k|   z[11] = w2;
  760|  19.2k|   w2 = 0;
  761|       |
  762|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[0], x[12]);
  763|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[11]);
  764|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[2], x[10]);
  765|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[3], x[9]);
  766|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[4], x[8]);
  767|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[5], x[7]);
  768|  19.2k|   word3_muladd(&w2, &w1, &w0, x[6], x[6]);
  769|  19.2k|   z[12] = w0;
  770|  19.2k|   w0 = 0;
  771|       |
  772|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[13]);
  773|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[1], x[12]);
  774|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[2], x[11]);
  775|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[3], x[10]);
  776|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[4], x[9]);
  777|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[5], x[8]);
  778|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[6], x[7]);
  779|  19.2k|   z[13] = w1;
  780|  19.2k|   w1 = 0;
  781|       |
  782|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[14]);
  783|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[1], x[13]);
  784|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[2], x[12]);
  785|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[3], x[11]);
  786|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[4], x[10]);
  787|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[5], x[9]);
  788|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[6], x[8]);
  789|  19.2k|   word3_muladd(&w1, &w0, &w2, x[7], x[7]);
  790|  19.2k|   z[14] = w2;
  791|  19.2k|   w2 = 0;
  792|       |
  793|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[0], x[15]);
  794|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[14]);
  795|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[2], x[13]);
  796|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[3], x[12]);
  797|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[4], x[11]);
  798|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[5], x[10]);
  799|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[6], x[9]);
  800|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[7], x[8]);
  801|  19.2k|   z[15] = w0;
  802|  19.2k|   w0 = 0;
  803|       |
  804|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[1], x[15]);
  805|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[2], x[14]);
  806|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[3], x[13]);
  807|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[4], x[12]);
  808|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[5], x[11]);
  809|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[6], x[10]);
  810|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[7], x[9]);
  811|  19.2k|   word3_muladd(&w0, &w2, &w1, x[8], x[8]);
  812|  19.2k|   z[16] = w1;
  813|  19.2k|   w1 = 0;
  814|       |
  815|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[2], x[15]);
  816|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[3], x[14]);
  817|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[4], x[13]);
  818|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[5], x[12]);
  819|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[6], x[11]);
  820|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[7], x[10]);
  821|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[8], x[9]);
  822|  19.2k|   z[17] = w2;
  823|  19.2k|   w2 = 0;
  824|       |
  825|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[3], x[15]);
  826|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[4], x[14]);
  827|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[5], x[13]);
  828|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[6], x[12]);
  829|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[7], x[11]);
  830|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[8], x[10]);
  831|  19.2k|   word3_muladd(&w2, &w1, &w0, x[9], x[9]);
  832|  19.2k|   z[18] = w0;
  833|  19.2k|   w0 = 0;
  834|       |
  835|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[4], x[15]);
  836|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[5], x[14]);
  837|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[6], x[13]);
  838|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[7], x[12]);
  839|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[8], x[11]);
  840|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[9], x[10]);
  841|  19.2k|   z[19] = w1;
  842|  19.2k|   w1 = 0;
  843|       |
  844|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[5], x[15]);
  845|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[6], x[14]);
  846|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[7], x[13]);
  847|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[8], x[12]);
  848|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[9], x[11]);
  849|  19.2k|   word3_muladd(&w1, &w0, &w2, x[10], x[10]);
  850|  19.2k|   z[20] = w2;
  851|  19.2k|   w2 = 0;
  852|       |
  853|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[6], x[15]);
  854|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[7], x[14]);
  855|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[8], x[13]);
  856|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[9], x[12]);
  857|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[10], x[11]);
  858|  19.2k|   z[21] = w0;
  859|  19.2k|   w0 = 0;
  860|       |
  861|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[7], x[15]);
  862|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[8], x[14]);
  863|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[9], x[13]);
  864|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[10], x[12]);
  865|  19.2k|   word3_muladd(&w0, &w2, &w1, x[11], x[11]);
  866|  19.2k|   z[22] = w1;
  867|  19.2k|   w1 = 0;
  868|       |
  869|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[8], x[15]);
  870|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[9], x[14]);
  871|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[10], x[13]);
  872|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[11], x[12]);
  873|  19.2k|   z[23] = w2;
  874|  19.2k|   w2 = 0;
  875|       |
  876|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[9], x[15]);
  877|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[10], x[14]);
  878|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[11], x[13]);
  879|  19.2k|   word3_muladd(&w2, &w1, &w0, x[12], x[12]);
  880|  19.2k|   z[24] = w0;
  881|  19.2k|   w0 = 0;
  882|       |
  883|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[10], x[15]);
  884|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[11], x[14]);
  885|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[12], x[13]);
  886|  19.2k|   z[25] = w1;
  887|  19.2k|   w1 = 0;
  888|       |
  889|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[11], x[15]);
  890|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[12], x[14]);
  891|  19.2k|   word3_muladd(&w1, &w0, &w2, x[13], x[13]);
  892|  19.2k|   z[26] = w2;
  893|  19.2k|   w2 = 0;
  894|       |
  895|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[12], x[15]);
  896|  19.2k|   word3_muladd_2(&w2, &w1, &w0, x[13], x[14]);
  897|  19.2k|   z[27] = w0;
  898|  19.2k|   w0 = 0;
  899|       |
  900|  19.2k|   word3_muladd_2(&w0, &w2, &w1, x[13], x[15]);
  901|  19.2k|   word3_muladd(&w0, &w2, &w1, x[14], x[14]);
  902|  19.2k|   z[28] = w1;
  903|  19.2k|   w1 = 0;
  904|       |
  905|  19.2k|   word3_muladd_2(&w1, &w0, &w2, x[14], x[15]);
  906|  19.2k|   z[29] = w2;
  907|  19.2k|   w2 = 0;
  908|       |
  909|  19.2k|   word3_muladd(&w2, &w1, &w0, x[15], x[15]);
  910|  19.2k|   z[30] = w0;
  911|  19.2k|   z[31] = w1;
  912|  19.2k|}
_ZN5Botan18bigint_comba_mul16EPmPKmS2_:
  917|  34.8k|void bigint_comba_mul16(word z[32], const word x[16], const word y[16]) {
  918|  34.8k|   word w2 = 0, w1 = 0, w0 = 0;
  919|       |
  920|  34.8k|   word3_muladd(&w2, &w1, &w0, x[0], y[0]);
  921|  34.8k|   z[0] = w0;
  922|  34.8k|   w0 = 0;
  923|       |
  924|  34.8k|   word3_muladd(&w0, &w2, &w1, x[0], y[1]);
  925|  34.8k|   word3_muladd(&w0, &w2, &w1, x[1], y[0]);
  926|  34.8k|   z[1] = w1;
  927|  34.8k|   w1 = 0;
  928|       |
  929|  34.8k|   word3_muladd(&w1, &w0, &w2, x[0], y[2]);
  930|  34.8k|   word3_muladd(&w1, &w0, &w2, x[1], y[1]);
  931|  34.8k|   word3_muladd(&w1, &w0, &w2, x[2], y[0]);
  932|  34.8k|   z[2] = w2;
  933|  34.8k|   w2 = 0;
  934|       |
  935|  34.8k|   word3_muladd(&w2, &w1, &w0, x[0], y[3]);
  936|  34.8k|   word3_muladd(&w2, &w1, &w0, x[1], y[2]);
  937|  34.8k|   word3_muladd(&w2, &w1, &w0, x[2], y[1]);
  938|  34.8k|   word3_muladd(&w2, &w1, &w0, x[3], y[0]);
  939|  34.8k|   z[3] = w0;
  940|  34.8k|   w0 = 0;
  941|       |
  942|  34.8k|   word3_muladd(&w0, &w2, &w1, x[0], y[4]);
  943|  34.8k|   word3_muladd(&w0, &w2, &w1, x[1], y[3]);
  944|  34.8k|   word3_muladd(&w0, &w2, &w1, x[2], y[2]);
  945|  34.8k|   word3_muladd(&w0, &w2, &w1, x[3], y[1]);
  946|  34.8k|   word3_muladd(&w0, &w2, &w1, x[4], y[0]);
  947|  34.8k|   z[4] = w1;
  948|  34.8k|   w1 = 0;
  949|       |
  950|  34.8k|   word3_muladd(&w1, &w0, &w2, x[0], y[5]);
  951|  34.8k|   word3_muladd(&w1, &w0, &w2, x[1], y[4]);
  952|  34.8k|   word3_muladd(&w1, &w0, &w2, x[2], y[3]);
  953|  34.8k|   word3_muladd(&w1, &w0, &w2, x[3], y[2]);
  954|  34.8k|   word3_muladd(&w1, &w0, &w2, x[4], y[1]);
  955|  34.8k|   word3_muladd(&w1, &w0, &w2, x[5], y[0]);
  956|  34.8k|   z[5] = w2;
  957|  34.8k|   w2 = 0;
  958|       |
  959|  34.8k|   word3_muladd(&w2, &w1, &w0, x[0], y[6]);
  960|  34.8k|   word3_muladd(&w2, &w1, &w0, x[1], y[5]);
  961|  34.8k|   word3_muladd(&w2, &w1, &w0, x[2], y[4]);
  962|  34.8k|   word3_muladd(&w2, &w1, &w0, x[3], y[3]);
  963|  34.8k|   word3_muladd(&w2, &w1, &w0, x[4], y[2]);
  964|  34.8k|   word3_muladd(&w2, &w1, &w0, x[5], y[1]);
  965|  34.8k|   word3_muladd(&w2, &w1, &w0, x[6], y[0]);
  966|  34.8k|   z[6] = w0;
  967|  34.8k|   w0 = 0;
  968|       |
  969|  34.8k|   word3_muladd(&w0, &w2, &w1, x[0], y[7]);
  970|  34.8k|   word3_muladd(&w0, &w2, &w1, x[1], y[6]);
  971|  34.8k|   word3_muladd(&w0, &w2, &w1, x[2], y[5]);
  972|  34.8k|   word3_muladd(&w0, &w2, &w1, x[3], y[4]);
  973|  34.8k|   word3_muladd(&w0, &w2, &w1, x[4], y[3]);
  974|  34.8k|   word3_muladd(&w0, &w2, &w1, x[5], y[2]);
  975|  34.8k|   word3_muladd(&w0, &w2, &w1, x[6], y[1]);
  976|  34.8k|   word3_muladd(&w0, &w2, &w1, x[7], y[0]);
  977|  34.8k|   z[7] = w1;
  978|  34.8k|   w1 = 0;
  979|       |
  980|  34.8k|   word3_muladd(&w1, &w0, &w2, x[0], y[8]);
  981|  34.8k|   word3_muladd(&w1, &w0, &w2, x[1], y[7]);
  982|  34.8k|   word3_muladd(&w1, &w0, &w2, x[2], y[6]);
  983|  34.8k|   word3_muladd(&w1, &w0, &w2, x[3], y[5]);
  984|  34.8k|   word3_muladd(&w1, &w0, &w2, x[4], y[4]);
  985|  34.8k|   word3_muladd(&w1, &w0, &w2, x[5], y[3]);
  986|  34.8k|   word3_muladd(&w1, &w0, &w2, x[6], y[2]);
  987|  34.8k|   word3_muladd(&w1, &w0, &w2, x[7], y[1]);
  988|  34.8k|   word3_muladd(&w1, &w0, &w2, x[8], y[0]);
  989|  34.8k|   z[8] = w2;
  990|  34.8k|   w2 = 0;
  991|       |
  992|  34.8k|   word3_muladd(&w2, &w1, &w0, x[0], y[9]);
  993|  34.8k|   word3_muladd(&w2, &w1, &w0, x[1], y[8]);
  994|  34.8k|   word3_muladd(&w2, &w1, &w0, x[2], y[7]);
  995|  34.8k|   word3_muladd(&w2, &w1, &w0, x[3], y[6]);
  996|  34.8k|   word3_muladd(&w2, &w1, &w0, x[4], y[5]);
  997|  34.8k|   word3_muladd(&w2, &w1, &w0, x[5], y[4]);
  998|  34.8k|   word3_muladd(&w2, &w1, &w0, x[6], y[3]);
  999|  34.8k|   word3_muladd(&w2, &w1, &w0, x[7], y[2]);
 1000|  34.8k|   word3_muladd(&w2, &w1, &w0, x[8], y[1]);
 1001|  34.8k|   word3_muladd(&w2, &w1, &w0, x[9], y[0]);
 1002|  34.8k|   z[9] = w0;
 1003|  34.8k|   w0 = 0;
 1004|       |
 1005|  34.8k|   word3_muladd(&w0, &w2, &w1, x[0], y[10]);
 1006|  34.8k|   word3_muladd(&w0, &w2, &w1, x[1], y[9]);
 1007|  34.8k|   word3_muladd(&w0, &w2, &w1, x[2], y[8]);
 1008|  34.8k|   word3_muladd(&w0, &w2, &w1, x[3], y[7]);
 1009|  34.8k|   word3_muladd(&w0, &w2, &w1, x[4], y[6]);
 1010|  34.8k|   word3_muladd(&w0, &w2, &w1, x[5], y[5]);
 1011|  34.8k|   word3_muladd(&w0, &w2, &w1, x[6], y[4]);
 1012|  34.8k|   word3_muladd(&w0, &w2, &w1, x[7], y[3]);
 1013|  34.8k|   word3_muladd(&w0, &w2, &w1, x[8], y[2]);
 1014|  34.8k|   word3_muladd(&w0, &w2, &w1, x[9], y[1]);
 1015|  34.8k|   word3_muladd(&w0, &w2, &w1, x[10], y[0]);
 1016|  34.8k|   z[10] = w1;
 1017|  34.8k|   w1 = 0;
 1018|       |
 1019|  34.8k|   word3_muladd(&w1, &w0, &w2, x[0], y[11]);
 1020|  34.8k|   word3_muladd(&w1, &w0, &w2, x[1], y[10]);
 1021|  34.8k|   word3_muladd(&w1, &w0, &w2, x[2], y[9]);
 1022|  34.8k|   word3_muladd(&w1, &w0, &w2, x[3], y[8]);
 1023|  34.8k|   word3_muladd(&w1, &w0, &w2, x[4], y[7]);
 1024|  34.8k|   word3_muladd(&w1, &w0, &w2, x[5], y[6]);
 1025|  34.8k|   word3_muladd(&w1, &w0, &w2, x[6], y[5]);
 1026|  34.8k|   word3_muladd(&w1, &w0, &w2, x[7], y[4]);
 1027|  34.8k|   word3_muladd(&w1, &w0, &w2, x[8], y[3]);
 1028|  34.8k|   word3_muladd(&w1, &w0, &w2, x[9], y[2]);
 1029|  34.8k|   word3_muladd(&w1, &w0, &w2, x[10], y[1]);
 1030|  34.8k|   word3_muladd(&w1, &w0, &w2, x[11], y[0]);
 1031|  34.8k|   z[11] = w2;
 1032|  34.8k|   w2 = 0;
 1033|       |
 1034|  34.8k|   word3_muladd(&w2, &w1, &w0, x[0], y[12]);
 1035|  34.8k|   word3_muladd(&w2, &w1, &w0, x[1], y[11]);
 1036|  34.8k|   word3_muladd(&w2, &w1, &w0, x[2], y[10]);
 1037|  34.8k|   word3_muladd(&w2, &w1, &w0, x[3], y[9]);
 1038|  34.8k|   word3_muladd(&w2, &w1, &w0, x[4], y[8]);
 1039|  34.8k|   word3_muladd(&w2, &w1, &w0, x[5], y[7]);
 1040|  34.8k|   word3_muladd(&w2, &w1, &w0, x[6], y[6]);
 1041|  34.8k|   word3_muladd(&w2, &w1, &w0, x[7], y[5]);
 1042|  34.8k|   word3_muladd(&w2, &w1, &w0, x[8], y[4]);
 1043|  34.8k|   word3_muladd(&w2, &w1, &w0, x[9], y[3]);
 1044|  34.8k|   word3_muladd(&w2, &w1, &w0, x[10], y[2]);
 1045|  34.8k|   word3_muladd(&w2, &w1, &w0, x[11], y[1]);
 1046|  34.8k|   word3_muladd(&w2, &w1, &w0, x[12], y[0]);
 1047|  34.8k|   z[12] = w0;
 1048|  34.8k|   w0 = 0;
 1049|       |
 1050|  34.8k|   word3_muladd(&w0, &w2, &w1, x[0], y[13]);
 1051|  34.8k|   word3_muladd(&w0, &w2, &w1, x[1], y[12]);
 1052|  34.8k|   word3_muladd(&w0, &w2, &w1, x[2], y[11]);
 1053|  34.8k|   word3_muladd(&w0, &w2, &w1, x[3], y[10]);
 1054|  34.8k|   word3_muladd(&w0, &w2, &w1, x[4], y[9]);
 1055|  34.8k|   word3_muladd(&w0, &w2, &w1, x[5], y[8]);
 1056|  34.8k|   word3_muladd(&w0, &w2, &w1, x[6], y[7]);
 1057|  34.8k|   word3_muladd(&w0, &w2, &w1, x[7], y[6]);
 1058|  34.8k|   word3_muladd(&w0, &w2, &w1, x[8], y[5]);
 1059|  34.8k|   word3_muladd(&w0, &w2, &w1, x[9], y[4]);
 1060|  34.8k|   word3_muladd(&w0, &w2, &w1, x[10], y[3]);
 1061|  34.8k|   word3_muladd(&w0, &w2, &w1, x[11], y[2]);
 1062|  34.8k|   word3_muladd(&w0, &w2, &w1, x[12], y[1]);
 1063|  34.8k|   word3_muladd(&w0, &w2, &w1, x[13], y[0]);
 1064|  34.8k|   z[13] = w1;
 1065|  34.8k|   w1 = 0;
 1066|       |
 1067|  34.8k|   word3_muladd(&w1, &w0, &w2, x[0], y[14]);
 1068|  34.8k|   word3_muladd(&w1, &w0, &w2, x[1], y[13]);
 1069|  34.8k|   word3_muladd(&w1, &w0, &w2, x[2], y[12]);
 1070|  34.8k|   word3_muladd(&w1, &w0, &w2, x[3], y[11]);
 1071|  34.8k|   word3_muladd(&w1, &w0, &w2, x[4], y[10]);
 1072|  34.8k|   word3_muladd(&w1, &w0, &w2, x[5], y[9]);
 1073|  34.8k|   word3_muladd(&w1, &w0, &w2, x[6], y[8]);
 1074|  34.8k|   word3_muladd(&w1, &w0, &w2, x[7], y[7]);
 1075|  34.8k|   word3_muladd(&w1, &w0, &w2, x[8], y[6]);
 1076|  34.8k|   word3_muladd(&w1, &w0, &w2, x[9], y[5]);
 1077|  34.8k|   word3_muladd(&w1, &w0, &w2, x[10], y[4]);
 1078|  34.8k|   word3_muladd(&w1, &w0, &w2, x[11], y[3]);
 1079|  34.8k|   word3_muladd(&w1, &w0, &w2, x[12], y[2]);
 1080|  34.8k|   word3_muladd(&w1, &w0, &w2, x[13], y[1]);
 1081|  34.8k|   word3_muladd(&w1, &w0, &w2, x[14], y[0]);
 1082|  34.8k|   z[14] = w2;
 1083|  34.8k|   w2 = 0;
 1084|       |
 1085|  34.8k|   word3_muladd(&w2, &w1, &w0, x[0], y[15]);
 1086|  34.8k|   word3_muladd(&w2, &w1, &w0, x[1], y[14]);
 1087|  34.8k|   word3_muladd(&w2, &w1, &w0, x[2], y[13]);
 1088|  34.8k|   word3_muladd(&w2, &w1, &w0, x[3], y[12]);
 1089|  34.8k|   word3_muladd(&w2, &w1, &w0, x[4], y[11]);
 1090|  34.8k|   word3_muladd(&w2, &w1, &w0, x[5], y[10]);
 1091|  34.8k|   word3_muladd(&w2, &w1, &w0, x[6], y[9]);
 1092|  34.8k|   word3_muladd(&w2, &w1, &w0, x[7], y[8]);
 1093|  34.8k|   word3_muladd(&w2, &w1, &w0, x[8], y[7]);
 1094|  34.8k|   word3_muladd(&w2, &w1, &w0, x[9], y[6]);
 1095|  34.8k|   word3_muladd(&w2, &w1, &w0, x[10], y[5]);
 1096|  34.8k|   word3_muladd(&w2, &w1, &w0, x[11], y[4]);
 1097|  34.8k|   word3_muladd(&w2, &w1, &w0, x[12], y[3]);
 1098|  34.8k|   word3_muladd(&w2, &w1, &w0, x[13], y[2]);
 1099|  34.8k|   word3_muladd(&w2, &w1, &w0, x[14], y[1]);
 1100|  34.8k|   word3_muladd(&w2, &w1, &w0, x[15], y[0]);
 1101|  34.8k|   z[15] = w0;
 1102|  34.8k|   w0 = 0;
 1103|       |
 1104|  34.8k|   word3_muladd(&w0, &w2, &w1, x[1], y[15]);
 1105|  34.8k|   word3_muladd(&w0, &w2, &w1, x[2], y[14]);
 1106|  34.8k|   word3_muladd(&w0, &w2, &w1, x[3], y[13]);
 1107|  34.8k|   word3_muladd(&w0, &w2, &w1, x[4], y[12]);
 1108|  34.8k|   word3_muladd(&w0, &w2, &w1, x[5], y[11]);
 1109|  34.8k|   word3_muladd(&w0, &w2, &w1, x[6], y[10]);
 1110|  34.8k|   word3_muladd(&w0, &w2, &w1, x[7], y[9]);
 1111|  34.8k|   word3_muladd(&w0, &w2, &w1, x[8], y[8]);
 1112|  34.8k|   word3_muladd(&w0, &w2, &w1, x[9], y[7]);
 1113|  34.8k|   word3_muladd(&w0, &w2, &w1, x[10], y[6]);
 1114|  34.8k|   word3_muladd(&w0, &w2, &w1, x[11], y[5]);
 1115|  34.8k|   word3_muladd(&w0, &w2, &w1, x[12], y[4]);
 1116|  34.8k|   word3_muladd(&w0, &w2, &w1, x[13], y[3]);
 1117|  34.8k|   word3_muladd(&w0, &w2, &w1, x[14], y[2]);
 1118|  34.8k|   word3_muladd(&w0, &w2, &w1, x[15], y[1]);
 1119|  34.8k|   z[16] = w1;
 1120|  34.8k|   w1 = 0;
 1121|       |
 1122|  34.8k|   word3_muladd(&w1, &w0, &w2, x[2], y[15]);
 1123|  34.8k|   word3_muladd(&w1, &w0, &w2, x[3], y[14]);
 1124|  34.8k|   word3_muladd(&w1, &w0, &w2, x[4], y[13]);
 1125|  34.8k|   word3_muladd(&w1, &w0, &w2, x[5], y[12]);
 1126|  34.8k|   word3_muladd(&w1, &w0, &w2, x[6], y[11]);
 1127|  34.8k|   word3_muladd(&w1, &w0, &w2, x[7], y[10]);
 1128|  34.8k|   word3_muladd(&w1, &w0, &w2, x[8], y[9]);
 1129|  34.8k|   word3_muladd(&w1, &w0, &w2, x[9], y[8]);
 1130|  34.8k|   word3_muladd(&w1, &w0, &w2, x[10], y[7]);
 1131|  34.8k|   word3_muladd(&w1, &w0, &w2, x[11], y[6]);
 1132|  34.8k|   word3_muladd(&w1, &w0, &w2, x[12], y[5]);
 1133|  34.8k|   word3_muladd(&w1, &w0, &w2, x[13], y[4]);
 1134|  34.8k|   word3_muladd(&w1, &w0, &w2, x[14], y[3]);
 1135|  34.8k|   word3_muladd(&w1, &w0, &w2, x[15], y[2]);
 1136|  34.8k|   z[17] = w2;
 1137|  34.8k|   w2 = 0;
 1138|       |
 1139|  34.8k|   word3_muladd(&w2, &w1, &w0, x[3], y[15]);
 1140|  34.8k|   word3_muladd(&w2, &w1, &w0, x[4], y[14]);
 1141|  34.8k|   word3_muladd(&w2, &w1, &w0, x[5], y[13]);
 1142|  34.8k|   word3_muladd(&w2, &w1, &w0, x[6], y[12]);
 1143|  34.8k|   word3_muladd(&w2, &w1, &w0, x[7], y[11]);
 1144|  34.8k|   word3_muladd(&w2, &w1, &w0, x[8], y[10]);
 1145|  34.8k|   word3_muladd(&w2, &w1, &w0, x[9], y[9]);
 1146|  34.8k|   word3_muladd(&w2, &w1, &w0, x[10], y[8]);
 1147|  34.8k|   word3_muladd(&w2, &w1, &w0, x[11], y[7]);
 1148|  34.8k|   word3_muladd(&w2, &w1, &w0, x[12], y[6]);
 1149|  34.8k|   word3_muladd(&w2, &w1, &w0, x[13], y[5]);
 1150|  34.8k|   word3_muladd(&w2, &w1, &w0, x[14], y[4]);
 1151|  34.8k|   word3_muladd(&w2, &w1, &w0, x[15], y[3]);
 1152|  34.8k|   z[18] = w0;
 1153|  34.8k|   w0 = 0;
 1154|       |
 1155|  34.8k|   word3_muladd(&w0, &w2, &w1, x[4], y[15]);
 1156|  34.8k|   word3_muladd(&w0, &w2, &w1, x[5], y[14]);
 1157|  34.8k|   word3_muladd(&w0, &w2, &w1, x[6], y[13]);
 1158|  34.8k|   word3_muladd(&w0, &w2, &w1, x[7], y[12]);
 1159|  34.8k|   word3_muladd(&w0, &w2, &w1, x[8], y[11]);
 1160|  34.8k|   word3_muladd(&w0, &w2, &w1, x[9], y[10]);
 1161|  34.8k|   word3_muladd(&w0, &w2, &w1, x[10], y[9]);
 1162|  34.8k|   word3_muladd(&w0, &w2, &w1, x[11], y[8]);
 1163|  34.8k|   word3_muladd(&w0, &w2, &w1, x[12], y[7]);
 1164|  34.8k|   word3_muladd(&w0, &w2, &w1, x[13], y[6]);
 1165|  34.8k|   word3_muladd(&w0, &w2, &w1, x[14], y[5]);
 1166|  34.8k|   word3_muladd(&w0, &w2, &w1, x[15], y[4]);
 1167|  34.8k|   z[19] = w1;
 1168|  34.8k|   w1 = 0;
 1169|       |
 1170|  34.8k|   word3_muladd(&w1, &w0, &w2, x[5], y[15]);
 1171|  34.8k|   word3_muladd(&w1, &w0, &w2, x[6], y[14]);
 1172|  34.8k|   word3_muladd(&w1, &w0, &w2, x[7], y[13]);
 1173|  34.8k|   word3_muladd(&w1, &w0, &w2, x[8], y[12]);
 1174|  34.8k|   word3_muladd(&w1, &w0, &w2, x[9], y[11]);
 1175|  34.8k|   word3_muladd(&w1, &w0, &w2, x[10], y[10]);
 1176|  34.8k|   word3_muladd(&w1, &w0, &w2, x[11], y[9]);
 1177|  34.8k|   word3_muladd(&w1, &w0, &w2, x[12], y[8]);
 1178|  34.8k|   word3_muladd(&w1, &w0, &w2, x[13], y[7]);
 1179|  34.8k|   word3_muladd(&w1, &w0, &w2, x[14], y[6]);
 1180|  34.8k|   word3_muladd(&w1, &w0, &w2, x[15], y[5]);
 1181|  34.8k|   z[20] = w2;
 1182|  34.8k|   w2 = 0;
 1183|       |
 1184|  34.8k|   word3_muladd(&w2, &w1, &w0, x[6], y[15]);
 1185|  34.8k|   word3_muladd(&w2, &w1, &w0, x[7], y[14]);
 1186|  34.8k|   word3_muladd(&w2, &w1, &w0, x[8], y[13]);
 1187|  34.8k|   word3_muladd(&w2, &w1, &w0, x[9], y[12]);
 1188|  34.8k|   word3_muladd(&w2, &w1, &w0, x[10], y[11]);
 1189|  34.8k|   word3_muladd(&w2, &w1, &w0, x[11], y[10]);
 1190|  34.8k|   word3_muladd(&w2, &w1, &w0, x[12], y[9]);
 1191|  34.8k|   word3_muladd(&w2, &w1, &w0, x[13], y[8]);
 1192|  34.8k|   word3_muladd(&w2, &w1, &w0, x[14], y[7]);
 1193|  34.8k|   word3_muladd(&w2, &w1, &w0, x[15], y[6]);
 1194|  34.8k|   z[21] = w0;
 1195|  34.8k|   w0 = 0;
 1196|       |
 1197|  34.8k|   word3_muladd(&w0, &w2, &w1, x[7], y[15]);
 1198|  34.8k|   word3_muladd(&w0, &w2, &w1, x[8], y[14]);
 1199|  34.8k|   word3_muladd(&w0, &w2, &w1, x[9], y[13]);
 1200|  34.8k|   word3_muladd(&w0, &w2, &w1, x[10], y[12]);
 1201|  34.8k|   word3_muladd(&w0, &w2, &w1, x[11], y[11]);
 1202|  34.8k|   word3_muladd(&w0, &w2, &w1, x[12], y[10]);
 1203|  34.8k|   word3_muladd(&w0, &w2, &w1, x[13], y[9]);
 1204|  34.8k|   word3_muladd(&w0, &w2, &w1, x[14], y[8]);
 1205|  34.8k|   word3_muladd(&w0, &w2, &w1, x[15], y[7]);
 1206|  34.8k|   z[22] = w1;
 1207|  34.8k|   w1 = 0;
 1208|       |
 1209|  34.8k|   word3_muladd(&w1, &w0, &w2, x[8], y[15]);
 1210|  34.8k|   word3_muladd(&w1, &w0, &w2, x[9], y[14]);
 1211|  34.8k|   word3_muladd(&w1, &w0, &w2, x[10], y[13]);
 1212|  34.8k|   word3_muladd(&w1, &w0, &w2, x[11], y[12]);
 1213|  34.8k|   word3_muladd(&w1, &w0, &w2, x[12], y[11]);
 1214|  34.8k|   word3_muladd(&w1, &w0, &w2, x[13], y[10]);
 1215|  34.8k|   word3_muladd(&w1, &w0, &w2, x[14], y[9]);
 1216|  34.8k|   word3_muladd(&w1, &w0, &w2, x[15], y[8]);
 1217|  34.8k|   z[23] = w2;
 1218|  34.8k|   w2 = 0;
 1219|       |
 1220|  34.8k|   word3_muladd(&w2, &w1, &w0, x[9], y[15]);
 1221|  34.8k|   word3_muladd(&w2, &w1, &w0, x[10], y[14]);
 1222|  34.8k|   word3_muladd(&w2, &w1, &w0, x[11], y[13]);
 1223|  34.8k|   word3_muladd(&w2, &w1, &w0, x[12], y[12]);
 1224|  34.8k|   word3_muladd(&w2, &w1, &w0, x[13], y[11]);
 1225|  34.8k|   word3_muladd(&w2, &w1, &w0, x[14], y[10]);
 1226|  34.8k|   word3_muladd(&w2, &w1, &w0, x[15], y[9]);
 1227|  34.8k|   z[24] = w0;
 1228|  34.8k|   w0 = 0;
 1229|       |
 1230|  34.8k|   word3_muladd(&w0, &w2, &w1, x[10], y[15]);
 1231|  34.8k|   word3_muladd(&w0, &w2, &w1, x[11], y[14]);
 1232|  34.8k|   word3_muladd(&w0, &w2, &w1, x[12], y[13]);
 1233|  34.8k|   word3_muladd(&w0, &w2, &w1, x[13], y[12]);
 1234|  34.8k|   word3_muladd(&w0, &w2, &w1, x[14], y[11]);
 1235|  34.8k|   word3_muladd(&w0, &w2, &w1, x[15], y[10]);
 1236|  34.8k|   z[25] = w1;
 1237|  34.8k|   w1 = 0;
 1238|       |
 1239|  34.8k|   word3_muladd(&w1, &w0, &w2, x[11], y[15]);
 1240|  34.8k|   word3_muladd(&w1, &w0, &w2, x[12], y[14]);
 1241|  34.8k|   word3_muladd(&w1, &w0, &w2, x[13], y[13]);
 1242|  34.8k|   word3_muladd(&w1, &w0, &w2, x[14], y[12]);
 1243|  34.8k|   word3_muladd(&w1, &w0, &w2, x[15], y[11]);
 1244|  34.8k|   z[26] = w2;
 1245|  34.8k|   w2 = 0;
 1246|       |
 1247|  34.8k|   word3_muladd(&w2, &w1, &w0, x[12], y[15]);
 1248|  34.8k|   word3_muladd(&w2, &w1, &w0, x[13], y[14]);
 1249|  34.8k|   word3_muladd(&w2, &w1, &w0, x[14], y[13]);
 1250|  34.8k|   word3_muladd(&w2, &w1, &w0, x[15], y[12]);
 1251|  34.8k|   z[27] = w0;
 1252|  34.8k|   w0 = 0;
 1253|       |
 1254|  34.8k|   word3_muladd(&w0, &w2, &w1, x[13], y[15]);
 1255|  34.8k|   word3_muladd(&w0, &w2, &w1, x[14], y[14]);
 1256|  34.8k|   word3_muladd(&w0, &w2, &w1, x[15], y[13]);
 1257|  34.8k|   z[28] = w1;
 1258|  34.8k|   w1 = 0;
 1259|       |
 1260|  34.8k|   word3_muladd(&w1, &w0, &w2, x[14], y[15]);
 1261|  34.8k|   word3_muladd(&w1, &w0, &w2, x[15], y[14]);
 1262|  34.8k|   z[29] = w2;
 1263|  34.8k|   w2 = 0;
 1264|       |
 1265|  34.8k|   word3_muladd(&w2, &w1, &w0, x[15], y[15]);
 1266|  34.8k|   z[30] = w0;
 1267|  34.8k|   z[31] = w1;
 1268|  34.8k|}
_ZN5Botan18bigint_comba_sqr24EPmPKm:
 1273|  1.12k|void bigint_comba_sqr24(word z[48], const word x[24]) {
 1274|  1.12k|   word w2 = 0, w1 = 0, w0 = 0;
 1275|       |
 1276|  1.12k|   word3_muladd(&w2, &w1, &w0, x[0], x[0]);
 1277|  1.12k|   z[0] = w0;
 1278|  1.12k|   w0 = 0;
 1279|       |
 1280|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[1]);
 1281|  1.12k|   z[1] = w1;
 1282|  1.12k|   w1 = 0;
 1283|       |
 1284|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[2]);
 1285|  1.12k|   word3_muladd(&w1, &w0, &w2, x[1], x[1]);
 1286|  1.12k|   z[2] = w2;
 1287|  1.12k|   w2 = 0;
 1288|       |
 1289|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[0], x[3]);
 1290|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[2]);
 1291|  1.12k|   z[3] = w0;
 1292|  1.12k|   w0 = 0;
 1293|       |
 1294|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[4]);
 1295|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[1], x[3]);
 1296|  1.12k|   word3_muladd(&w0, &w2, &w1, x[2], x[2]);
 1297|  1.12k|   z[4] = w1;
 1298|  1.12k|   w1 = 0;
 1299|       |
 1300|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[5]);
 1301|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[1], x[4]);
 1302|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[2], x[3]);
 1303|  1.12k|   z[5] = w2;
 1304|  1.12k|   w2 = 0;
 1305|       |
 1306|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[0], x[6]);
 1307|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[5]);
 1308|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[2], x[4]);
 1309|  1.12k|   word3_muladd(&w2, &w1, &w0, x[3], x[3]);
 1310|  1.12k|   z[6] = w0;
 1311|  1.12k|   w0 = 0;
 1312|       |
 1313|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[7]);
 1314|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[1], x[6]);
 1315|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[2], x[5]);
 1316|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[3], x[4]);
 1317|  1.12k|   z[7] = w1;
 1318|  1.12k|   w1 = 0;
 1319|       |
 1320|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[8]);
 1321|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[1], x[7]);
 1322|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[2], x[6]);
 1323|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[3], x[5]);
 1324|  1.12k|   word3_muladd(&w1, &w0, &w2, x[4], x[4]);
 1325|  1.12k|   z[8] = w2;
 1326|  1.12k|   w2 = 0;
 1327|       |
 1328|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[0], x[9]);
 1329|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[8]);
 1330|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[2], x[7]);
 1331|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[3], x[6]);
 1332|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[4], x[5]);
 1333|  1.12k|   z[9] = w0;
 1334|  1.12k|   w0 = 0;
 1335|       |
 1336|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[10]);
 1337|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[1], x[9]);
 1338|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[2], x[8]);
 1339|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[3], x[7]);
 1340|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[4], x[6]);
 1341|  1.12k|   word3_muladd(&w0, &w2, &w1, x[5], x[5]);
 1342|  1.12k|   z[10] = w1;
 1343|  1.12k|   w1 = 0;
 1344|       |
 1345|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[11]);
 1346|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[1], x[10]);
 1347|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[2], x[9]);
 1348|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[3], x[8]);
 1349|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[4], x[7]);
 1350|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[5], x[6]);
 1351|  1.12k|   z[11] = w2;
 1352|  1.12k|   w2 = 0;
 1353|       |
 1354|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[0], x[12]);
 1355|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[11]);
 1356|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[2], x[10]);
 1357|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[3], x[9]);
 1358|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[4], x[8]);
 1359|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[5], x[7]);
 1360|  1.12k|   word3_muladd(&w2, &w1, &w0, x[6], x[6]);
 1361|  1.12k|   z[12] = w0;
 1362|  1.12k|   w0 = 0;
 1363|       |
 1364|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[13]);
 1365|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[1], x[12]);
 1366|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[2], x[11]);
 1367|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[3], x[10]);
 1368|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[4], x[9]);
 1369|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[5], x[8]);
 1370|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[6], x[7]);
 1371|  1.12k|   z[13] = w1;
 1372|  1.12k|   w1 = 0;
 1373|       |
 1374|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[14]);
 1375|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[1], x[13]);
 1376|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[2], x[12]);
 1377|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[3], x[11]);
 1378|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[4], x[10]);
 1379|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[5], x[9]);
 1380|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[6], x[8]);
 1381|  1.12k|   word3_muladd(&w1, &w0, &w2, x[7], x[7]);
 1382|  1.12k|   z[14] = w2;
 1383|  1.12k|   w2 = 0;
 1384|       |
 1385|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[0], x[15]);
 1386|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[14]);
 1387|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[2], x[13]);
 1388|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[3], x[12]);
 1389|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[4], x[11]);
 1390|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[5], x[10]);
 1391|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[6], x[9]);
 1392|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[7], x[8]);
 1393|  1.12k|   z[15] = w0;
 1394|  1.12k|   w0 = 0;
 1395|       |
 1396|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[16]);
 1397|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[1], x[15]);
 1398|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[2], x[14]);
 1399|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[3], x[13]);
 1400|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[4], x[12]);
 1401|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[5], x[11]);
 1402|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[6], x[10]);
 1403|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[7], x[9]);
 1404|  1.12k|   word3_muladd(&w0, &w2, &w1, x[8], x[8]);
 1405|  1.12k|   z[16] = w1;
 1406|  1.12k|   w1 = 0;
 1407|       |
 1408|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[17]);
 1409|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[1], x[16]);
 1410|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[2], x[15]);
 1411|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[3], x[14]);
 1412|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[4], x[13]);
 1413|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[5], x[12]);
 1414|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[6], x[11]);
 1415|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[7], x[10]);
 1416|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[8], x[9]);
 1417|  1.12k|   z[17] = w2;
 1418|  1.12k|   w2 = 0;
 1419|       |
 1420|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[0], x[18]);
 1421|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[17]);
 1422|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[2], x[16]);
 1423|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[3], x[15]);
 1424|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[4], x[14]);
 1425|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[5], x[13]);
 1426|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[6], x[12]);
 1427|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[7], x[11]);
 1428|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[8], x[10]);
 1429|  1.12k|   word3_muladd(&w2, &w1, &w0, x[9], x[9]);
 1430|  1.12k|   z[18] = w0;
 1431|  1.12k|   w0 = 0;
 1432|       |
 1433|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[19]);
 1434|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[1], x[18]);
 1435|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[2], x[17]);
 1436|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[3], x[16]);
 1437|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[4], x[15]);
 1438|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[5], x[14]);
 1439|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[6], x[13]);
 1440|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[7], x[12]);
 1441|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[8], x[11]);
 1442|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[9], x[10]);
 1443|  1.12k|   z[19] = w1;
 1444|  1.12k|   w1 = 0;
 1445|       |
 1446|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[20]);
 1447|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[1], x[19]);
 1448|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[2], x[18]);
 1449|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[3], x[17]);
 1450|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[4], x[16]);
 1451|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[5], x[15]);
 1452|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[6], x[14]);
 1453|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[7], x[13]);
 1454|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[8], x[12]);
 1455|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[9], x[11]);
 1456|  1.12k|   word3_muladd(&w1, &w0, &w2, x[10], x[10]);
 1457|  1.12k|   z[20] = w2;
 1458|  1.12k|   w2 = 0;
 1459|       |
 1460|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[0], x[21]);
 1461|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[20]);
 1462|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[2], x[19]);
 1463|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[3], x[18]);
 1464|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[4], x[17]);
 1465|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[5], x[16]);
 1466|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[6], x[15]);
 1467|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[7], x[14]);
 1468|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[8], x[13]);
 1469|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[9], x[12]);
 1470|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[10], x[11]);
 1471|  1.12k|   z[21] = w0;
 1472|  1.12k|   w0 = 0;
 1473|       |
 1474|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[22]);
 1475|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[1], x[21]);
 1476|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[2], x[20]);
 1477|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[3], x[19]);
 1478|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[4], x[18]);
 1479|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[5], x[17]);
 1480|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[6], x[16]);
 1481|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[7], x[15]);
 1482|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[8], x[14]);
 1483|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[9], x[13]);
 1484|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[10], x[12]);
 1485|  1.12k|   word3_muladd(&w0, &w2, &w1, x[11], x[11]);
 1486|  1.12k|   z[22] = w1;
 1487|  1.12k|   w1 = 0;
 1488|       |
 1489|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[23]);
 1490|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[1], x[22]);
 1491|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[2], x[21]);
 1492|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[3], x[20]);
 1493|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[4], x[19]);
 1494|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[5], x[18]);
 1495|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[6], x[17]);
 1496|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[7], x[16]);
 1497|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[8], x[15]);
 1498|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[9], x[14]);
 1499|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[10], x[13]);
 1500|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[11], x[12]);
 1501|  1.12k|   z[23] = w2;
 1502|  1.12k|   w2 = 0;
 1503|       |
 1504|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[23]);
 1505|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[2], x[22]);
 1506|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[3], x[21]);
 1507|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[4], x[20]);
 1508|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[5], x[19]);
 1509|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[6], x[18]);
 1510|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[7], x[17]);
 1511|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[8], x[16]);
 1512|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[9], x[15]);
 1513|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[10], x[14]);
 1514|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[11], x[13]);
 1515|  1.12k|   word3_muladd(&w2, &w1, &w0, x[12], x[12]);
 1516|  1.12k|   z[24] = w0;
 1517|  1.12k|   w0 = 0;
 1518|       |
 1519|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[2], x[23]);
 1520|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[3], x[22]);
 1521|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[4], x[21]);
 1522|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[5], x[20]);
 1523|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[6], x[19]);
 1524|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[7], x[18]);
 1525|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[8], x[17]);
 1526|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[9], x[16]);
 1527|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[10], x[15]);
 1528|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[11], x[14]);
 1529|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[12], x[13]);
 1530|  1.12k|   z[25] = w1;
 1531|  1.12k|   w1 = 0;
 1532|       |
 1533|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[3], x[23]);
 1534|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[4], x[22]);
 1535|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[5], x[21]);
 1536|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[6], x[20]);
 1537|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[7], x[19]);
 1538|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[8], x[18]);
 1539|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[9], x[17]);
 1540|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[10], x[16]);
 1541|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[11], x[15]);
 1542|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[12], x[14]);
 1543|  1.12k|   word3_muladd(&w1, &w0, &w2, x[13], x[13]);
 1544|  1.12k|   z[26] = w2;
 1545|  1.12k|   w2 = 0;
 1546|       |
 1547|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[4], x[23]);
 1548|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[5], x[22]);
 1549|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[6], x[21]);
 1550|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[7], x[20]);
 1551|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[8], x[19]);
 1552|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[9], x[18]);
 1553|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[10], x[17]);
 1554|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[11], x[16]);
 1555|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[12], x[15]);
 1556|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[13], x[14]);
 1557|  1.12k|   z[27] = w0;
 1558|  1.12k|   w0 = 0;
 1559|       |
 1560|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[5], x[23]);
 1561|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[6], x[22]);
 1562|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[7], x[21]);
 1563|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[8], x[20]);
 1564|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[9], x[19]);
 1565|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[10], x[18]);
 1566|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[11], x[17]);
 1567|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[12], x[16]);
 1568|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[13], x[15]);
 1569|  1.12k|   word3_muladd(&w0, &w2, &w1, x[14], x[14]);
 1570|  1.12k|   z[28] = w1;
 1571|  1.12k|   w1 = 0;
 1572|       |
 1573|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[6], x[23]);
 1574|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[7], x[22]);
 1575|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[8], x[21]);
 1576|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[9], x[20]);
 1577|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[10], x[19]);
 1578|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[11], x[18]);
 1579|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[12], x[17]);
 1580|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[13], x[16]);
 1581|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[14], x[15]);
 1582|  1.12k|   z[29] = w2;
 1583|  1.12k|   w2 = 0;
 1584|       |
 1585|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[7], x[23]);
 1586|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[8], x[22]);
 1587|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[9], x[21]);
 1588|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[10], x[20]);
 1589|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[11], x[19]);
 1590|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[12], x[18]);
 1591|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[13], x[17]);
 1592|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[14], x[16]);
 1593|  1.12k|   word3_muladd(&w2, &w1, &w0, x[15], x[15]);
 1594|  1.12k|   z[30] = w0;
 1595|  1.12k|   w0 = 0;
 1596|       |
 1597|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[8], x[23]);
 1598|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[9], x[22]);
 1599|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[10], x[21]);
 1600|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[11], x[20]);
 1601|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[12], x[19]);
 1602|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[13], x[18]);
 1603|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[14], x[17]);
 1604|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[15], x[16]);
 1605|  1.12k|   z[31] = w1;
 1606|  1.12k|   w1 = 0;
 1607|       |
 1608|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[9], x[23]);
 1609|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[10], x[22]);
 1610|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[11], x[21]);
 1611|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[12], x[20]);
 1612|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[13], x[19]);
 1613|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[14], x[18]);
 1614|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[15], x[17]);
 1615|  1.12k|   word3_muladd(&w1, &w0, &w2, x[16], x[16]);
 1616|  1.12k|   z[32] = w2;
 1617|  1.12k|   w2 = 0;
 1618|       |
 1619|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[10], x[23]);
 1620|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[11], x[22]);
 1621|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[12], x[21]);
 1622|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[13], x[20]);
 1623|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[14], x[19]);
 1624|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[15], x[18]);
 1625|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[16], x[17]);
 1626|  1.12k|   z[33] = w0;
 1627|  1.12k|   w0 = 0;
 1628|       |
 1629|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[11], x[23]);
 1630|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[12], x[22]);
 1631|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[13], x[21]);
 1632|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[14], x[20]);
 1633|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[15], x[19]);
 1634|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[16], x[18]);
 1635|  1.12k|   word3_muladd(&w0, &w2, &w1, x[17], x[17]);
 1636|  1.12k|   z[34] = w1;
 1637|  1.12k|   w1 = 0;
 1638|       |
 1639|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[12], x[23]);
 1640|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[13], x[22]);
 1641|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[14], x[21]);
 1642|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[15], x[20]);
 1643|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[16], x[19]);
 1644|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[17], x[18]);
 1645|  1.12k|   z[35] = w2;
 1646|  1.12k|   w2 = 0;
 1647|       |
 1648|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[13], x[23]);
 1649|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[14], x[22]);
 1650|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[15], x[21]);
 1651|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[16], x[20]);
 1652|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[17], x[19]);
 1653|  1.12k|   word3_muladd(&w2, &w1, &w0, x[18], x[18]);
 1654|  1.12k|   z[36] = w0;
 1655|  1.12k|   w0 = 0;
 1656|       |
 1657|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[14], x[23]);
 1658|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[15], x[22]);
 1659|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[16], x[21]);
 1660|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[17], x[20]);
 1661|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[18], x[19]);
 1662|  1.12k|   z[37] = w1;
 1663|  1.12k|   w1 = 0;
 1664|       |
 1665|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[15], x[23]);
 1666|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[16], x[22]);
 1667|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[17], x[21]);
 1668|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[18], x[20]);
 1669|  1.12k|   word3_muladd(&w1, &w0, &w2, x[19], x[19]);
 1670|  1.12k|   z[38] = w2;
 1671|  1.12k|   w2 = 0;
 1672|       |
 1673|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[16], x[23]);
 1674|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[17], x[22]);
 1675|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[18], x[21]);
 1676|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[19], x[20]);
 1677|  1.12k|   z[39] = w0;
 1678|  1.12k|   w0 = 0;
 1679|       |
 1680|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[17], x[23]);
 1681|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[18], x[22]);
 1682|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[19], x[21]);
 1683|  1.12k|   word3_muladd(&w0, &w2, &w1, x[20], x[20]);
 1684|  1.12k|   z[40] = w1;
 1685|  1.12k|   w1 = 0;
 1686|       |
 1687|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[18], x[23]);
 1688|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[19], x[22]);
 1689|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[20], x[21]);
 1690|  1.12k|   z[41] = w2;
 1691|  1.12k|   w2 = 0;
 1692|       |
 1693|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[19], x[23]);
 1694|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[20], x[22]);
 1695|  1.12k|   word3_muladd(&w2, &w1, &w0, x[21], x[21]);
 1696|  1.12k|   z[42] = w0;
 1697|  1.12k|   w0 = 0;
 1698|       |
 1699|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[20], x[23]);
 1700|  1.12k|   word3_muladd_2(&w0, &w2, &w1, x[21], x[22]);
 1701|  1.12k|   z[43] = w1;
 1702|  1.12k|   w1 = 0;
 1703|       |
 1704|  1.12k|   word3_muladd_2(&w1, &w0, &w2, x[21], x[23]);
 1705|  1.12k|   word3_muladd(&w1, &w0, &w2, x[22], x[22]);
 1706|  1.12k|   z[44] = w2;
 1707|  1.12k|   w2 = 0;
 1708|       |
 1709|  1.12k|   word3_muladd_2(&w2, &w1, &w0, x[22], x[23]);
 1710|  1.12k|   z[45] = w0;
 1711|  1.12k|   w0 = 0;
 1712|       |
 1713|  1.12k|   word3_muladd(&w0, &w2, &w1, x[23], x[23]);
 1714|  1.12k|   z[46] = w1;
 1715|  1.12k|   z[47] = w2;
 1716|  1.12k|}
_ZN5Botan18bigint_comba_mul24EPmPKmS2_:
 1721|  1.25k|void bigint_comba_mul24(word z[48], const word x[24], const word y[24]) {
 1722|  1.25k|   word w2 = 0, w1 = 0, w0 = 0;
 1723|       |
 1724|  1.25k|   word3_muladd(&w2, &w1, &w0, x[0], y[0]);
 1725|  1.25k|   z[0] = w0;
 1726|  1.25k|   w0 = 0;
 1727|       |
 1728|  1.25k|   word3_muladd(&w0, &w2, &w1, x[0], y[1]);
 1729|  1.25k|   word3_muladd(&w0, &w2, &w1, x[1], y[0]);
 1730|  1.25k|   z[1] = w1;
 1731|  1.25k|   w1 = 0;
 1732|       |
 1733|  1.25k|   word3_muladd(&w1, &w0, &w2, x[0], y[2]);
 1734|  1.25k|   word3_muladd(&w1, &w0, &w2, x[1], y[1]);
 1735|  1.25k|   word3_muladd(&w1, &w0, &w2, x[2], y[0]);
 1736|  1.25k|   z[2] = w2;
 1737|  1.25k|   w2 = 0;
 1738|       |
 1739|  1.25k|   word3_muladd(&w2, &w1, &w0, x[0], y[3]);
 1740|  1.25k|   word3_muladd(&w2, &w1, &w0, x[1], y[2]);
 1741|  1.25k|   word3_muladd(&w2, &w1, &w0, x[2], y[1]);
 1742|  1.25k|   word3_muladd(&w2, &w1, &w0, x[3], y[0]);
 1743|  1.25k|   z[3] = w0;
 1744|  1.25k|   w0 = 0;
 1745|       |
 1746|  1.25k|   word3_muladd(&w0, &w2, &w1, x[0], y[4]);
 1747|  1.25k|   word3_muladd(&w0, &w2, &w1, x[1], y[3]);
 1748|  1.25k|   word3_muladd(&w0, &w2, &w1, x[2], y[2]);
 1749|  1.25k|   word3_muladd(&w0, &w2, &w1, x[3], y[1]);
 1750|  1.25k|   word3_muladd(&w0, &w2, &w1, x[4], y[0]);
 1751|  1.25k|   z[4] = w1;
 1752|  1.25k|   w1 = 0;
 1753|       |
 1754|  1.25k|   word3_muladd(&w1, &w0, &w2, x[0], y[5]);
 1755|  1.25k|   word3_muladd(&w1, &w0, &w2, x[1], y[4]);
 1756|  1.25k|   word3_muladd(&w1, &w0, &w2, x[2], y[3]);
 1757|  1.25k|   word3_muladd(&w1, &w0, &w2, x[3], y[2]);
 1758|  1.25k|   word3_muladd(&w1, &w0, &w2, x[4], y[1]);
 1759|  1.25k|   word3_muladd(&w1, &w0, &w2, x[5], y[0]);
 1760|  1.25k|   z[5] = w2;
 1761|  1.25k|   w2 = 0;
 1762|       |
 1763|  1.25k|   word3_muladd(&w2, &w1, &w0, x[0], y[6]);
 1764|  1.25k|   word3_muladd(&w2, &w1, &w0, x[1], y[5]);
 1765|  1.25k|   word3_muladd(&w2, &w1, &w0, x[2], y[4]);
 1766|  1.25k|   word3_muladd(&w2, &w1, &w0, x[3], y[3]);
 1767|  1.25k|   word3_muladd(&w2, &w1, &w0, x[4], y[2]);
 1768|  1.25k|   word3_muladd(&w2, &w1, &w0, x[5], y[1]);
 1769|  1.25k|   word3_muladd(&w2, &w1, &w0, x[6], y[0]);
 1770|  1.25k|   z[6] = w0;
 1771|  1.25k|   w0 = 0;
 1772|       |
 1773|  1.25k|   word3_muladd(&w0, &w2, &w1, x[0], y[7]);
 1774|  1.25k|   word3_muladd(&w0, &w2, &w1, x[1], y[6]);
 1775|  1.25k|   word3_muladd(&w0, &w2, &w1, x[2], y[5]);
 1776|  1.25k|   word3_muladd(&w0, &w2, &w1, x[3], y[4]);
 1777|  1.25k|   word3_muladd(&w0, &w2, &w1, x[4], y[3]);
 1778|  1.25k|   word3_muladd(&w0, &w2, &w1, x[5], y[2]);
 1779|  1.25k|   word3_muladd(&w0, &w2, &w1, x[6], y[1]);
 1780|  1.25k|   word3_muladd(&w0, &w2, &w1, x[7], y[0]);
 1781|  1.25k|   z[7] = w1;
 1782|  1.25k|   w1 = 0;
 1783|       |
 1784|  1.25k|   word3_muladd(&w1, &w0, &w2, x[0], y[8]);
 1785|  1.25k|   word3_muladd(&w1, &w0, &w2, x[1], y[7]);
 1786|  1.25k|   word3_muladd(&w1, &w0, &w2, x[2], y[6]);
 1787|  1.25k|   word3_muladd(&w1, &w0, &w2, x[3], y[5]);
 1788|  1.25k|   word3_muladd(&w1, &w0, &w2, x[4], y[4]);
 1789|  1.25k|   word3_muladd(&w1, &w0, &w2, x[5], y[3]);
 1790|  1.25k|   word3_muladd(&w1, &w0, &w2, x[6], y[2]);
 1791|  1.25k|   word3_muladd(&w1, &w0, &w2, x[7], y[1]);
 1792|  1.25k|   word3_muladd(&w1, &w0, &w2, x[8], y[0]);
 1793|  1.25k|   z[8] = w2;
 1794|  1.25k|   w2 = 0;
 1795|       |
 1796|  1.25k|   word3_muladd(&w2, &w1, &w0, x[0], y[9]);
 1797|  1.25k|   word3_muladd(&w2, &w1, &w0, x[1], y[8]);
 1798|  1.25k|   word3_muladd(&w2, &w1, &w0, x[2], y[7]);
 1799|  1.25k|   word3_muladd(&w2, &w1, &w0, x[3], y[6]);
 1800|  1.25k|   word3_muladd(&w2, &w1, &w0, x[4], y[5]);
 1801|  1.25k|   word3_muladd(&w2, &w1, &w0, x[5], y[4]);
 1802|  1.25k|   word3_muladd(&w2, &w1, &w0, x[6], y[3]);
 1803|  1.25k|   word3_muladd(&w2, &w1, &w0, x[7], y[2]);
 1804|  1.25k|   word3_muladd(&w2, &w1, &w0, x[8], y[1]);
 1805|  1.25k|   word3_muladd(&w2, &w1, &w0, x[9], y[0]);
 1806|  1.25k|   z[9] = w0;
 1807|  1.25k|   w0 = 0;
 1808|       |
 1809|  1.25k|   word3_muladd(&w0, &w2, &w1, x[0], y[10]);
 1810|  1.25k|   word3_muladd(&w0, &w2, &w1, x[1], y[9]);
 1811|  1.25k|   word3_muladd(&w0, &w2, &w1, x[2], y[8]);
 1812|  1.25k|   word3_muladd(&w0, &w2, &w1, x[3], y[7]);
 1813|  1.25k|   word3_muladd(&w0, &w2, &w1, x[4], y[6]);
 1814|  1.25k|   word3_muladd(&w0, &w2, &w1, x[5], y[5]);
 1815|  1.25k|   word3_muladd(&w0, &w2, &w1, x[6], y[4]);
 1816|  1.25k|   word3_muladd(&w0, &w2, &w1, x[7], y[3]);
 1817|  1.25k|   word3_muladd(&w0, &w2, &w1, x[8], y[2]);
 1818|  1.25k|   word3_muladd(&w0, &w2, &w1, x[9], y[1]);
 1819|  1.25k|   word3_muladd(&w0, &w2, &w1, x[10], y[0]);
 1820|  1.25k|   z[10] = w1;
 1821|  1.25k|   w1 = 0;
 1822|       |
 1823|  1.25k|   word3_muladd(&w1, &w0, &w2, x[0], y[11]);
 1824|  1.25k|   word3_muladd(&w1, &w0, &w2, x[1], y[10]);
 1825|  1.25k|   word3_muladd(&w1, &w0, &w2, x[2], y[9]);
 1826|  1.25k|   word3_muladd(&w1, &w0, &w2, x[3], y[8]);
 1827|  1.25k|   word3_muladd(&w1, &w0, &w2, x[4], y[7]);
 1828|  1.25k|   word3_muladd(&w1, &w0, &w2, x[5], y[6]);
 1829|  1.25k|   word3_muladd(&w1, &w0, &w2, x[6], y[5]);
 1830|  1.25k|   word3_muladd(&w1, &w0, &w2, x[7], y[4]);
 1831|  1.25k|   word3_muladd(&w1, &w0, &w2, x[8], y[3]);
 1832|  1.25k|   word3_muladd(&w1, &w0, &w2, x[9], y[2]);
 1833|  1.25k|   word3_muladd(&w1, &w0, &w2, x[10], y[1]);
 1834|  1.25k|   word3_muladd(&w1, &w0, &w2, x[11], y[0]);
 1835|  1.25k|   z[11] = w2;
 1836|  1.25k|   w2 = 0;
 1837|       |
 1838|  1.25k|   word3_muladd(&w2, &w1, &w0, x[0], y[12]);
 1839|  1.25k|   word3_muladd(&w2, &w1, &w0, x[1], y[11]);
 1840|  1.25k|   word3_muladd(&w2, &w1, &w0, x[2], y[10]);
 1841|  1.25k|   word3_muladd(&w2, &w1, &w0, x[3], y[9]);
 1842|  1.25k|   word3_muladd(&w2, &w1, &w0, x[4], y[8]);
 1843|  1.25k|   word3_muladd(&w2, &w1, &w0, x[5], y[7]);
 1844|  1.25k|   word3_muladd(&w2, &w1, &w0, x[6], y[6]);
 1845|  1.25k|   word3_muladd(&w2, &w1, &w0, x[7], y[5]);
 1846|  1.25k|   word3_muladd(&w2, &w1, &w0, x[8], y[4]);
 1847|  1.25k|   word3_muladd(&w2, &w1, &w0, x[9], y[3]);
 1848|  1.25k|   word3_muladd(&w2, &w1, &w0, x[10], y[2]);
 1849|  1.25k|   word3_muladd(&w2, &w1, &w0, x[11], y[1]);
 1850|  1.25k|   word3_muladd(&w2, &w1, &w0, x[12], y[0]);
 1851|  1.25k|   z[12] = w0;
 1852|  1.25k|   w0 = 0;
 1853|       |
 1854|  1.25k|   word3_muladd(&w0, &w2, &w1, x[0], y[13]);
 1855|  1.25k|   word3_muladd(&w0, &w2, &w1, x[1], y[12]);
 1856|  1.25k|   word3_muladd(&w0, &w2, &w1, x[2], y[11]);
 1857|  1.25k|   word3_muladd(&w0, &w2, &w1, x[3], y[10]);
 1858|  1.25k|   word3_muladd(&w0, &w2, &w1, x[4], y[9]);
 1859|  1.25k|   word3_muladd(&w0, &w2, &w1, x[5], y[8]);
 1860|  1.25k|   word3_muladd(&w0, &w2, &w1, x[6], y[7]);
 1861|  1.25k|   word3_muladd(&w0, &w2, &w1, x[7], y[6]);
 1862|  1.25k|   word3_muladd(&w0, &w2, &w1, x[8], y[5]);
 1863|  1.25k|   word3_muladd(&w0, &w2, &w1, x[9], y[4]);
 1864|  1.25k|   word3_muladd(&w0, &w2, &w1, x[10], y[3]);
 1865|  1.25k|   word3_muladd(&w0, &w2, &w1, x[11], y[2]);
 1866|  1.25k|   word3_muladd(&w0, &w2, &w1, x[12], y[1]);
 1867|  1.25k|   word3_muladd(&w0, &w2, &w1, x[13], y[0]);
 1868|  1.25k|   z[13] = w1;
 1869|  1.25k|   w1 = 0;
 1870|       |
 1871|  1.25k|   word3_muladd(&w1, &w0, &w2, x[0], y[14]);
 1872|  1.25k|   word3_muladd(&w1, &w0, &w2, x[1], y[13]);
 1873|  1.25k|   word3_muladd(&w1, &w0, &w2, x[2], y[12]);
 1874|  1.25k|   word3_muladd(&w1, &w0, &w2, x[3], y[11]);
 1875|  1.25k|   word3_muladd(&w1, &w0, &w2, x[4], y[10]);
 1876|  1.25k|   word3_muladd(&w1, &w0, &w2, x[5], y[9]);
 1877|  1.25k|   word3_muladd(&w1, &w0, &w2, x[6], y[8]);
 1878|  1.25k|   word3_muladd(&w1, &w0, &w2, x[7], y[7]);
 1879|  1.25k|   word3_muladd(&w1, &w0, &w2, x[8], y[6]);
 1880|  1.25k|   word3_muladd(&w1, &w0, &w2, x[9], y[5]);
 1881|  1.25k|   word3_muladd(&w1, &w0, &w2, x[10], y[4]);
 1882|  1.25k|   word3_muladd(&w1, &w0, &w2, x[11], y[3]);
 1883|  1.25k|   word3_muladd(&w1, &w0, &w2, x[12], y[2]);
 1884|  1.25k|   word3_muladd(&w1, &w0, &w2, x[13], y[1]);
 1885|  1.25k|   word3_muladd(&w1, &w0, &w2, x[14], y[0]);
 1886|  1.25k|   z[14] = w2;
 1887|  1.25k|   w2 = 0;
 1888|       |
 1889|  1.25k|   word3_muladd(&w2, &w1, &w0, x[0], y[15]);
 1890|  1.25k|   word3_muladd(&w2, &w1, &w0, x[1], y[14]);
 1891|  1.25k|   word3_muladd(&w2, &w1, &w0, x[2], y[13]);
 1892|  1.25k|   word3_muladd(&w2, &w1, &w0, x[3], y[12]);
 1893|  1.25k|   word3_muladd(&w2, &w1, &w0, x[4], y[11]);
 1894|  1.25k|   word3_muladd(&w2, &w1, &w0, x[5], y[10]);
 1895|  1.25k|   word3_muladd(&w2, &w1, &w0, x[6], y[9]);
 1896|  1.25k|   word3_muladd(&w2, &w1, &w0, x[7], y[8]);
 1897|  1.25k|   word3_muladd(&w2, &w1, &w0, x[8], y[7]);
 1898|  1.25k|   word3_muladd(&w2, &w1, &w0, x[9], y[6]);
 1899|  1.25k|   word3_muladd(&w2, &w1, &w0, x[10], y[5]);
 1900|  1.25k|   word3_muladd(&w2, &w1, &w0, x[11], y[4]);
 1901|  1.25k|   word3_muladd(&w2, &w1, &w0, x[12], y[3]);
 1902|  1.25k|   word3_muladd(&w2, &w1, &w0, x[13], y[2]);
 1903|  1.25k|   word3_muladd(&w2, &w1, &w0, x[14], y[1]);
 1904|  1.25k|   word3_muladd(&w2, &w1, &w0, x[15], y[0]);
 1905|  1.25k|   z[15] = w0;
 1906|  1.25k|   w0 = 0;
 1907|       |
 1908|  1.25k|   word3_muladd(&w0, &w2, &w1, x[0], y[16]);
 1909|  1.25k|   word3_muladd(&w0, &w2, &w1, x[1], y[15]);
 1910|  1.25k|   word3_muladd(&w0, &w2, &w1, x[2], y[14]);
 1911|  1.25k|   word3_muladd(&w0, &w2, &w1, x[3], y[13]);
 1912|  1.25k|   word3_muladd(&w0, &w2, &w1, x[4], y[12]);
 1913|  1.25k|   word3_muladd(&w0, &w2, &w1, x[5], y[11]);
 1914|  1.25k|   word3_muladd(&w0, &w2, &w1, x[6], y[10]);
 1915|  1.25k|   word3_muladd(&w0, &w2, &w1, x[7], y[9]);
 1916|  1.25k|   word3_muladd(&w0, &w2, &w1, x[8], y[8]);
 1917|  1.25k|   word3_muladd(&w0, &w2, &w1, x[9], y[7]);
 1918|  1.25k|   word3_muladd(&w0, &w2, &w1, x[10], y[6]);
 1919|  1.25k|   word3_muladd(&w0, &w2, &w1, x[11], y[5]);
 1920|  1.25k|   word3_muladd(&w0, &w2, &w1, x[12], y[4]);
 1921|  1.25k|   word3_muladd(&w0, &w2, &w1, x[13], y[3]);
 1922|  1.25k|   word3_muladd(&w0, &w2, &w1, x[14], y[2]);
 1923|  1.25k|   word3_muladd(&w0, &w2, &w1, x[15], y[1]);
 1924|  1.25k|   word3_muladd(&w0, &w2, &w1, x[16], y[0]);
 1925|  1.25k|   z[16] = w1;
 1926|  1.25k|   w1 = 0;
 1927|       |
 1928|  1.25k|   word3_muladd(&w1, &w0, &w2, x[0], y[17]);
 1929|  1.25k|   word3_muladd(&w1, &w0, &w2, x[1], y[16]);
 1930|  1.25k|   word3_muladd(&w1, &w0, &w2, x[2], y[15]);
 1931|  1.25k|   word3_muladd(&w1, &w0, &w2, x[3], y[14]);
 1932|  1.25k|   word3_muladd(&w1, &w0, &w2, x[4], y[13]);
 1933|  1.25k|   word3_muladd(&w1, &w0, &w2, x[5], y[12]);
 1934|  1.25k|   word3_muladd(&w1, &w0, &w2, x[6], y[11]);
 1935|  1.25k|   word3_muladd(&w1, &w0, &w2, x[7], y[10]);
 1936|  1.25k|   word3_muladd(&w1, &w0, &w2, x[8], y[9]);
 1937|  1.25k|   word3_muladd(&w1, &w0, &w2, x[9], y[8]);
 1938|  1.25k|   word3_muladd(&w1, &w0, &w2, x[10], y[7]);
 1939|  1.25k|   word3_muladd(&w1, &w0, &w2, x[11], y[6]);
 1940|  1.25k|   word3_muladd(&w1, &w0, &w2, x[12], y[5]);
 1941|  1.25k|   word3_muladd(&w1, &w0, &w2, x[13], y[4]);
 1942|  1.25k|   word3_muladd(&w1, &w0, &w2, x[14], y[3]);
 1943|  1.25k|   word3_muladd(&w1, &w0, &w2, x[15], y[2]);
 1944|  1.25k|   word3_muladd(&w1, &w0, &w2, x[16], y[1]);
 1945|  1.25k|   word3_muladd(&w1, &w0, &w2, x[17], y[0]);
 1946|  1.25k|   z[17] = w2;
 1947|  1.25k|   w2 = 0;
 1948|       |
 1949|  1.25k|   word3_muladd(&w2, &w1, &w0, x[0], y[18]);
 1950|  1.25k|   word3_muladd(&w2, &w1, &w0, x[1], y[17]);
 1951|  1.25k|   word3_muladd(&w2, &w1, &w0, x[2], y[16]);
 1952|  1.25k|   word3_muladd(&w2, &w1, &w0, x[3], y[15]);
 1953|  1.25k|   word3_muladd(&w2, &w1, &w0, x[4], y[14]);
 1954|  1.25k|   word3_muladd(&w2, &w1, &w0, x[5], y[13]);
 1955|  1.25k|   word3_muladd(&w2, &w1, &w0, x[6], y[12]);
 1956|  1.25k|   word3_muladd(&w2, &w1, &w0, x[7], y[11]);
 1957|  1.25k|   word3_muladd(&w2, &w1, &w0, x[8], y[10]);
 1958|  1.25k|   word3_muladd(&w2, &w1, &w0, x[9], y[9]);
 1959|  1.25k|   word3_muladd(&w2, &w1, &w0, x[10], y[8]);
 1960|  1.25k|   word3_muladd(&w2, &w1, &w0, x[11], y[7]);
 1961|  1.25k|   word3_muladd(&w2, &w1, &w0, x[12], y[6]);
 1962|  1.25k|   word3_muladd(&w2, &w1, &w0, x[13], y[5]);
 1963|  1.25k|   word3_muladd(&w2, &w1, &w0, x[14], y[4]);
 1964|  1.25k|   word3_muladd(&w2, &w1, &w0, x[15], y[3]);
 1965|  1.25k|   word3_muladd(&w2, &w1, &w0, x[16], y[2]);
 1966|  1.25k|   word3_muladd(&w2, &w1, &w0, x[17], y[1]);
 1967|  1.25k|   word3_muladd(&w2, &w1, &w0, x[18], y[0]);
 1968|  1.25k|   z[18] = w0;
 1969|  1.25k|   w0 = 0;
 1970|       |
 1971|  1.25k|   word3_muladd(&w0, &w2, &w1, x[0], y[19]);
 1972|  1.25k|   word3_muladd(&w0, &w2, &w1, x[1], y[18]);
 1973|  1.25k|   word3_muladd(&w0, &w2, &w1, x[2], y[17]);
 1974|  1.25k|   word3_muladd(&w0, &w2, &w1, x[3], y[16]);
 1975|  1.25k|   word3_muladd(&w0, &w2, &w1, x[4], y[15]);
 1976|  1.25k|   word3_muladd(&w0, &w2, &w1, x[5], y[14]);
 1977|  1.25k|   word3_muladd(&w0, &w2, &w1, x[6], y[13]);
 1978|  1.25k|   word3_muladd(&w0, &w2, &w1, x[7], y[12]);
 1979|  1.25k|   word3_muladd(&w0, &w2, &w1, x[8], y[11]);
 1980|  1.25k|   word3_muladd(&w0, &w2, &w1, x[9], y[10]);
 1981|  1.25k|   word3_muladd(&w0, &w2, &w1, x[10], y[9]);
 1982|  1.25k|   word3_muladd(&w0, &w2, &w1, x[11], y[8]);
 1983|  1.25k|   word3_muladd(&w0, &w2, &w1, x[12], y[7]);
 1984|  1.25k|   word3_muladd(&w0, &w2, &w1, x[13], y[6]);
 1985|  1.25k|   word3_muladd(&w0, &w2, &w1, x[14], y[5]);
 1986|  1.25k|   word3_muladd(&w0, &w2, &w1, x[15], y[4]);
 1987|  1.25k|   word3_muladd(&w0, &w2, &w1, x[16], y[3]);
 1988|  1.25k|   word3_muladd(&w0, &w2, &w1, x[17], y[2]);
 1989|  1.25k|   word3_muladd(&w0, &w2, &w1, x[18], y[1]);
 1990|  1.25k|   word3_muladd(&w0, &w2, &w1, x[19], y[0]);
 1991|  1.25k|   z[19] = w1;
 1992|  1.25k|   w1 = 0;
 1993|       |
 1994|  1.25k|   word3_muladd(&w1, &w0, &w2, x[0], y[20]);
 1995|  1.25k|   word3_muladd(&w1, &w0, &w2, x[1], y[19]);
 1996|  1.25k|   word3_muladd(&w1, &w0, &w2, x[2], y[18]);
 1997|  1.25k|   word3_muladd(&w1, &w0, &w2, x[3], y[17]);
 1998|  1.25k|   word3_muladd(&w1, &w0, &w2, x[4], y[16]);
 1999|  1.25k|   word3_muladd(&w1, &w0, &w2, x[5], y[15]);
 2000|  1.25k|   word3_muladd(&w1, &w0, &w2, x[6], y[14]);
 2001|  1.25k|   word3_muladd(&w1, &w0, &w2, x[7], y[13]);
 2002|  1.25k|   word3_muladd(&w1, &w0, &w2, x[8], y[12]);
 2003|  1.25k|   word3_muladd(&w1, &w0, &w2, x[9], y[11]);
 2004|  1.25k|   word3_muladd(&w1, &w0, &w2, x[10], y[10]);
 2005|  1.25k|   word3_muladd(&w1, &w0, &w2, x[11], y[9]);
 2006|  1.25k|   word3_muladd(&w1, &w0, &w2, x[12], y[8]);
 2007|  1.25k|   word3_muladd(&w1, &w0, &w2, x[13], y[7]);
 2008|  1.25k|   word3_muladd(&w1, &w0, &w2, x[14], y[6]);
 2009|  1.25k|   word3_muladd(&w1, &w0, &w2, x[15], y[5]);
 2010|  1.25k|   word3_muladd(&w1, &w0, &w2, x[16], y[4]);
 2011|  1.25k|   word3_muladd(&w1, &w0, &w2, x[17], y[3]);
 2012|  1.25k|   word3_muladd(&w1, &w0, &w2, x[18], y[2]);
 2013|  1.25k|   word3_muladd(&w1, &w0, &w2, x[19], y[1]);
 2014|  1.25k|   word3_muladd(&w1, &w0, &w2, x[20], y[0]);
 2015|  1.25k|   z[20] = w2;
 2016|  1.25k|   w2 = 0;
 2017|       |
 2018|  1.25k|   word3_muladd(&w2, &w1, &w0, x[0], y[21]);
 2019|  1.25k|   word3_muladd(&w2, &w1, &w0, x[1], y[20]);
 2020|  1.25k|   word3_muladd(&w2, &w1, &w0, x[2], y[19]);
 2021|  1.25k|   word3_muladd(&w2, &w1, &w0, x[3], y[18]);
 2022|  1.25k|   word3_muladd(&w2, &w1, &w0, x[4], y[17]);
 2023|  1.25k|   word3_muladd(&w2, &w1, &w0, x[5], y[16]);
 2024|  1.25k|   word3_muladd(&w2, &w1, &w0, x[6], y[15]);
 2025|  1.25k|   word3_muladd(&w2, &w1, &w0, x[7], y[14]);
 2026|  1.25k|   word3_muladd(&w2, &w1, &w0, x[8], y[13]);
 2027|  1.25k|   word3_muladd(&w2, &w1, &w0, x[9], y[12]);
 2028|  1.25k|   word3_muladd(&w2, &w1, &w0, x[10], y[11]);
 2029|  1.25k|   word3_muladd(&w2, &w1, &w0, x[11], y[10]);
 2030|  1.25k|   word3_muladd(&w2, &w1, &w0, x[12], y[9]);
 2031|  1.25k|   word3_muladd(&w2, &w1, &w0, x[13], y[8]);
 2032|  1.25k|   word3_muladd(&w2, &w1, &w0, x[14], y[7]);
 2033|  1.25k|   word3_muladd(&w2, &w1, &w0, x[15], y[6]);
 2034|  1.25k|   word3_muladd(&w2, &w1, &w0, x[16], y[5]);
 2035|  1.25k|   word3_muladd(&w2, &w1, &w0, x[17], y[4]);
 2036|  1.25k|   word3_muladd(&w2, &w1, &w0, x[18], y[3]);
 2037|  1.25k|   word3_muladd(&w2, &w1, &w0, x[19], y[2]);
 2038|  1.25k|   word3_muladd(&w2, &w1, &w0, x[20], y[1]);
 2039|  1.25k|   word3_muladd(&w2, &w1, &w0, x[21], y[0]);
 2040|  1.25k|   z[21] = w0;
 2041|  1.25k|   w0 = 0;
 2042|       |
 2043|  1.25k|   word3_muladd(&w0, &w2, &w1, x[0], y[22]);
 2044|  1.25k|   word3_muladd(&w0, &w2, &w1, x[1], y[21]);
 2045|  1.25k|   word3_muladd(&w0, &w2, &w1, x[2], y[20]);
 2046|  1.25k|   word3_muladd(&w0, &w2, &w1, x[3], y[19]);
 2047|  1.25k|   word3_muladd(&w0, &w2, &w1, x[4], y[18]);
 2048|  1.25k|   word3_muladd(&w0, &w2, &w1, x[5], y[17]);
 2049|  1.25k|   word3_muladd(&w0, &w2, &w1, x[6], y[16]);
 2050|  1.25k|   word3_muladd(&w0, &w2, &w1, x[7], y[15]);
 2051|  1.25k|   word3_muladd(&w0, &w2, &w1, x[8], y[14]);
 2052|  1.25k|   word3_muladd(&w0, &w2, &w1, x[9], y[13]);
 2053|  1.25k|   word3_muladd(&w0, &w2, &w1, x[10], y[12]);
 2054|  1.25k|   word3_muladd(&w0, &w2, &w1, x[11], y[11]);
 2055|  1.25k|   word3_muladd(&w0, &w2, &w1, x[12], y[10]);
 2056|  1.25k|   word3_muladd(&w0, &w2, &w1, x[13], y[9]);
 2057|  1.25k|   word3_muladd(&w0, &w2, &w1, x[14], y[8]);
 2058|  1.25k|   word3_muladd(&w0, &w2, &w1, x[15], y[7]);
 2059|  1.25k|   word3_muladd(&w0, &w2, &w1, x[16], y[6]);
 2060|  1.25k|   word3_muladd(&w0, &w2, &w1, x[17], y[5]);
 2061|  1.25k|   word3_muladd(&w0, &w2, &w1, x[18], y[4]);
 2062|  1.25k|   word3_muladd(&w0, &w2, &w1, x[19], y[3]);
 2063|  1.25k|   word3_muladd(&w0, &w2, &w1, x[20], y[2]);
 2064|  1.25k|   word3_muladd(&w0, &w2, &w1, x[21], y[1]);
 2065|  1.25k|   word3_muladd(&w0, &w2, &w1, x[22], y[0]);
 2066|  1.25k|   z[22] = w1;
 2067|  1.25k|   w1 = 0;
 2068|       |
 2069|  1.25k|   word3_muladd(&w1, &w0, &w2, x[0], y[23]);
 2070|  1.25k|   word3_muladd(&w1, &w0, &w2, x[1], y[22]);
 2071|  1.25k|   word3_muladd(&w1, &w0, &w2, x[2], y[21]);
 2072|  1.25k|   word3_muladd(&w1, &w0, &w2, x[3], y[20]);
 2073|  1.25k|   word3_muladd(&w1, &w0, &w2, x[4], y[19]);
 2074|  1.25k|   word3_muladd(&w1, &w0, &w2, x[5], y[18]);
 2075|  1.25k|   word3_muladd(&w1, &w0, &w2, x[6], y[17]);
 2076|  1.25k|   word3_muladd(&w1, &w0, &w2, x[7], y[16]);
 2077|  1.25k|   word3_muladd(&w1, &w0, &w2, x[8], y[15]);
 2078|  1.25k|   word3_muladd(&w1, &w0, &w2, x[9], y[14]);
 2079|  1.25k|   word3_muladd(&w1, &w0, &w2, x[10], y[13]);
 2080|  1.25k|   word3_muladd(&w1, &w0, &w2, x[11], y[12]);
 2081|  1.25k|   word3_muladd(&w1, &w0, &w2, x[12], y[11]);
 2082|  1.25k|   word3_muladd(&w1, &w0, &w2, x[13], y[10]);
 2083|  1.25k|   word3_muladd(&w1, &w0, &w2, x[14], y[9]);
 2084|  1.25k|   word3_muladd(&w1, &w0, &w2, x[15], y[8]);
 2085|  1.25k|   word3_muladd(&w1, &w0, &w2, x[16], y[7]);
 2086|  1.25k|   word3_muladd(&w1, &w0, &w2, x[17], y[6]);
 2087|  1.25k|   word3_muladd(&w1, &w0, &w2, x[18], y[5]);
 2088|  1.25k|   word3_muladd(&w1, &w0, &w2, x[19], y[4]);
 2089|  1.25k|   word3_muladd(&w1, &w0, &w2, x[20], y[3]);
 2090|  1.25k|   word3_muladd(&w1, &w0, &w2, x[21], y[2]);
 2091|  1.25k|   word3_muladd(&w1, &w0, &w2, x[22], y[1]);
 2092|  1.25k|   word3_muladd(&w1, &w0, &w2, x[23], y[0]);
 2093|  1.25k|   z[23] = w2;
 2094|  1.25k|   w2 = 0;
 2095|       |
 2096|  1.25k|   word3_muladd(&w2, &w1, &w0, x[1], y[23]);
 2097|  1.25k|   word3_muladd(&w2, &w1, &w0, x[2], y[22]);
 2098|  1.25k|   word3_muladd(&w2, &w1, &w0, x[3], y[21]);
 2099|  1.25k|   word3_muladd(&w2, &w1, &w0, x[4], y[20]);
 2100|  1.25k|   word3_muladd(&w2, &w1, &w0, x[5], y[19]);
 2101|  1.25k|   word3_muladd(&w2, &w1, &w0, x[6], y[18]);
 2102|  1.25k|   word3_muladd(&w2, &w1, &w0, x[7], y[17]);
 2103|  1.25k|   word3_muladd(&w2, &w1, &w0, x[8], y[16]);
 2104|  1.25k|   word3_muladd(&w2, &w1, &w0, x[9], y[15]);
 2105|  1.25k|   word3_muladd(&w2, &w1, &w0, x[10], y[14]);
 2106|  1.25k|   word3_muladd(&w2, &w1, &w0, x[11], y[13]);
 2107|  1.25k|   word3_muladd(&w2, &w1, &w0, x[12], y[12]);
 2108|  1.25k|   word3_muladd(&w2, &w1, &w0, x[13], y[11]);
 2109|  1.25k|   word3_muladd(&w2, &w1, &w0, x[14], y[10]);
 2110|  1.25k|   word3_muladd(&w2, &w1, &w0, x[15], y[9]);
 2111|  1.25k|   word3_muladd(&w2, &w1, &w0, x[16], y[8]);
 2112|  1.25k|   word3_muladd(&w2, &w1, &w0, x[17], y[7]);
 2113|  1.25k|   word3_muladd(&w2, &w1, &w0, x[18], y[6]);
 2114|  1.25k|   word3_muladd(&w2, &w1, &w0, x[19], y[5]);
 2115|  1.25k|   word3_muladd(&w2, &w1, &w0, x[20], y[4]);
 2116|  1.25k|   word3_muladd(&w2, &w1, &w0, x[21], y[3]);
 2117|  1.25k|   word3_muladd(&w2, &w1, &w0, x[22], y[2]);
 2118|  1.25k|   word3_muladd(&w2, &w1, &w0, x[23], y[1]);
 2119|  1.25k|   z[24] = w0;
 2120|  1.25k|   w0 = 0;
 2121|       |
 2122|  1.25k|   word3_muladd(&w0, &w2, &w1, x[2], y[23]);
 2123|  1.25k|   word3_muladd(&w0, &w2, &w1, x[3], y[22]);
 2124|  1.25k|   word3_muladd(&w0, &w2, &w1, x[4], y[21]);
 2125|  1.25k|   word3_muladd(&w0, &w2, &w1, x[5], y[20]);
 2126|  1.25k|   word3_muladd(&w0, &w2, &w1, x[6], y[19]);
 2127|  1.25k|   word3_muladd(&w0, &w2, &w1, x[7], y[18]);
 2128|  1.25k|   word3_muladd(&w0, &w2, &w1, x[8], y[17]);
 2129|  1.25k|   word3_muladd(&w0, &w2, &w1, x[9], y[16]);
 2130|  1.25k|   word3_muladd(&w0, &w2, &w1, x[10], y[15]);
 2131|  1.25k|   word3_muladd(&w0, &w2, &w1, x[11], y[14]);
 2132|  1.25k|   word3_muladd(&w0, &w2, &w1, x[12], y[13]);
 2133|  1.25k|   word3_muladd(&w0, &w2, &w1, x[13], y[12]);
 2134|  1.25k|   word3_muladd(&w0, &w2, &w1, x[14], y[11]);
 2135|  1.25k|   word3_muladd(&w0, &w2, &w1, x[15], y[10]);
 2136|  1.25k|   word3_muladd(&w0, &w2, &w1, x[16], y[9]);
 2137|  1.25k|   word3_muladd(&w0, &w2, &w1, x[17], y[8]);
 2138|  1.25k|   word3_muladd(&w0, &w2, &w1, x[18], y[7]);
 2139|  1.25k|   word3_muladd(&w0, &w2, &w1, x[19], y[6]);
 2140|  1.25k|   word3_muladd(&w0, &w2, &w1, x[20], y[5]);
 2141|  1.25k|   word3_muladd(&w0, &w2, &w1, x[21], y[4]);
 2142|  1.25k|   word3_muladd(&w0, &w2, &w1, x[22], y[3]);
 2143|  1.25k|   word3_muladd(&w0, &w2, &w1, x[23], y[2]);
 2144|  1.25k|   z[25] = w1;
 2145|  1.25k|   w1 = 0;
 2146|       |
 2147|  1.25k|   word3_muladd(&w1, &w0, &w2, x[3], y[23]);
 2148|  1.25k|   word3_muladd(&w1, &w0, &w2, x[4], y[22]);
 2149|  1.25k|   word3_muladd(&w1, &w0, &w2, x[5], y[21]);
 2150|  1.25k|   word3_muladd(&w1, &w0, &w2, x[6], y[20]);
 2151|  1.25k|   word3_muladd(&w1, &w0, &w2, x[7], y[19]);
 2152|  1.25k|   word3_muladd(&w1, &w0, &w2, x[8], y[18]);
 2153|  1.25k|   word3_muladd(&w1, &w0, &w2, x[9], y[17]);
 2154|  1.25k|   word3_muladd(&w1, &w0, &w2, x[10], y[16]);
 2155|  1.25k|   word3_muladd(&w1, &w0, &w2, x[11], y[15]);
 2156|  1.25k|   word3_muladd(&w1, &w0, &w2, x[12], y[14]);
 2157|  1.25k|   word3_muladd(&w1, &w0, &w2, x[13], y[13]);
 2158|  1.25k|   word3_muladd(&w1, &w0, &w2, x[14], y[12]);
 2159|  1.25k|   word3_muladd(&w1, &w0, &w2, x[15], y[11]);
 2160|  1.25k|   word3_muladd(&w1, &w0, &w2, x[16], y[10]);
 2161|  1.25k|   word3_muladd(&w1, &w0, &w2, x[17], y[9]);
 2162|  1.25k|   word3_muladd(&w1, &w0, &w2, x[18], y[8]);
 2163|  1.25k|   word3_muladd(&w1, &w0, &w2, x[19], y[7]);
 2164|  1.25k|   word3_muladd(&w1, &w0, &w2, x[20], y[6]);
 2165|  1.25k|   word3_muladd(&w1, &w0, &w2, x[21], y[5]);
 2166|  1.25k|   word3_muladd(&w1, &w0, &w2, x[22], y[4]);
 2167|  1.25k|   word3_muladd(&w1, &w0, &w2, x[23], y[3]);
 2168|  1.25k|   z[26] = w2;
 2169|  1.25k|   w2 = 0;
 2170|       |
 2171|  1.25k|   word3_muladd(&w2, &w1, &w0, x[4], y[23]);
 2172|  1.25k|   word3_muladd(&w2, &w1, &w0, x[5], y[22]);
 2173|  1.25k|   word3_muladd(&w2, &w1, &w0, x[6], y[21]);
 2174|  1.25k|   word3_muladd(&w2, &w1, &w0, x[7], y[20]);
 2175|  1.25k|   word3_muladd(&w2, &w1, &w0, x[8], y[19]);
 2176|  1.25k|   word3_muladd(&w2, &w1, &w0, x[9], y[18]);
 2177|  1.25k|   word3_muladd(&w2, &w1, &w0, x[10], y[17]);
 2178|  1.25k|   word3_muladd(&w2, &w1, &w0, x[11], y[16]);
 2179|  1.25k|   word3_muladd(&w2, &w1, &w0, x[12], y[15]);
 2180|  1.25k|   word3_muladd(&w2, &w1, &w0, x[13], y[14]);
 2181|  1.25k|   word3_muladd(&w2, &w1, &w0, x[14], y[13]);
 2182|  1.25k|   word3_muladd(&w2, &w1, &w0, x[15], y[12]);
 2183|  1.25k|   word3_muladd(&w2, &w1, &w0, x[16], y[11]);
 2184|  1.25k|   word3_muladd(&w2, &w1, &w0, x[17], y[10]);
 2185|  1.25k|   word3_muladd(&w2, &w1, &w0, x[18], y[9]);
 2186|  1.25k|   word3_muladd(&w2, &w1, &w0, x[19], y[8]);
 2187|  1.25k|   word3_muladd(&w2, &w1, &w0, x[20], y[7]);
 2188|  1.25k|   word3_muladd(&w2, &w1, &w0, x[21], y[6]);
 2189|  1.25k|   word3_muladd(&w2, &w1, &w0, x[22], y[5]);
 2190|  1.25k|   word3_muladd(&w2, &w1, &w0, x[23], y[4]);
 2191|  1.25k|   z[27] = w0;
 2192|  1.25k|   w0 = 0;
 2193|       |
 2194|  1.25k|   word3_muladd(&w0, &w2, &w1, x[5], y[23]);
 2195|  1.25k|   word3_muladd(&w0, &w2, &w1, x[6], y[22]);
 2196|  1.25k|   word3_muladd(&w0, &w2, &w1, x[7], y[21]);
 2197|  1.25k|   word3_muladd(&w0, &w2, &w1, x[8], y[20]);
 2198|  1.25k|   word3_muladd(&w0, &w2, &w1, x[9], y[19]);
 2199|  1.25k|   word3_muladd(&w0, &w2, &w1, x[10], y[18]);
 2200|  1.25k|   word3_muladd(&w0, &w2, &w1, x[11], y[17]);
 2201|  1.25k|   word3_muladd(&w0, &w2, &w1, x[12], y[16]);
 2202|  1.25k|   word3_muladd(&w0, &w2, &w1, x[13], y[15]);
 2203|  1.25k|   word3_muladd(&w0, &w2, &w1, x[14], y[14]);
 2204|  1.25k|   word3_muladd(&w0, &w2, &w1, x[15], y[13]);
 2205|  1.25k|   word3_muladd(&w0, &w2, &w1, x[16], y[12]);
 2206|  1.25k|   word3_muladd(&w0, &w2, &w1, x[17], y[11]);
 2207|  1.25k|   word3_muladd(&w0, &w2, &w1, x[18], y[10]);
 2208|  1.25k|   word3_muladd(&w0, &w2, &w1, x[19], y[9]);
 2209|  1.25k|   word3_muladd(&w0, &w2, &w1, x[20], y[8]);
 2210|  1.25k|   word3_muladd(&w0, &w2, &w1, x[21], y[7]);
 2211|  1.25k|   word3_muladd(&w0, &w2, &w1, x[22], y[6]);
 2212|  1.25k|   word3_muladd(&w0, &w2, &w1, x[23], y[5]);
 2213|  1.25k|   z[28] = w1;
 2214|  1.25k|   w1 = 0;
 2215|       |
 2216|  1.25k|   word3_muladd(&w1, &w0, &w2, x[6], y[23]);
 2217|  1.25k|   word3_muladd(&w1, &w0, &w2, x[7], y[22]);
 2218|  1.25k|   word3_muladd(&w1, &w0, &w2, x[8], y[21]);
 2219|  1.25k|   word3_muladd(&w1, &w0, &w2, x[9], y[20]);
 2220|  1.25k|   word3_muladd(&w1, &w0, &w2, x[10], y[19]);
 2221|  1.25k|   word3_muladd(&w1, &w0, &w2, x[11], y[18]);
 2222|  1.25k|   word3_muladd(&w1, &w0, &w2, x[12], y[17]);
 2223|  1.25k|   word3_muladd(&w1, &w0, &w2, x[13], y[16]);
 2224|  1.25k|   word3_muladd(&w1, &w0, &w2, x[14], y[15]);
 2225|  1.25k|   word3_muladd(&w1, &w0, &w2, x[15], y[14]);
 2226|  1.25k|   word3_muladd(&w1, &w0, &w2, x[16], y[13]);
 2227|  1.25k|   word3_muladd(&w1, &w0, &w2, x[17], y[12]);
 2228|  1.25k|   word3_muladd(&w1, &w0, &w2, x[18], y[11]);
 2229|  1.25k|   word3_muladd(&w1, &w0, &w2, x[19], y[10]);
 2230|  1.25k|   word3_muladd(&w1, &w0, &w2, x[20], y[9]);
 2231|  1.25k|   word3_muladd(&w1, &w0, &w2, x[21], y[8]);
 2232|  1.25k|   word3_muladd(&w1, &w0, &w2, x[22], y[7]);
 2233|  1.25k|   word3_muladd(&w1, &w0, &w2, x[23], y[6]);
 2234|  1.25k|   z[29] = w2;
 2235|  1.25k|   w2 = 0;
 2236|       |
 2237|  1.25k|   word3_muladd(&w2, &w1, &w0, x[7], y[23]);
 2238|  1.25k|   word3_muladd(&w2, &w1, &w0, x[8], y[22]);
 2239|  1.25k|   word3_muladd(&w2, &w1, &w0, x[9], y[21]);
 2240|  1.25k|   word3_muladd(&w2, &w1, &w0, x[10], y[20]);
 2241|  1.25k|   word3_muladd(&w2, &w1, &w0, x[11], y[19]);
 2242|  1.25k|   word3_muladd(&w2, &w1, &w0, x[12], y[18]);
 2243|  1.25k|   word3_muladd(&w2, &w1, &w0, x[13], y[17]);
 2244|  1.25k|   word3_muladd(&w2, &w1, &w0, x[14], y[16]);
 2245|  1.25k|   word3_muladd(&w2, &w1, &w0, x[15], y[15]);
 2246|  1.25k|   word3_muladd(&w2, &w1, &w0, x[16], y[14]);
 2247|  1.25k|   word3_muladd(&w2, &w1, &w0, x[17], y[13]);
 2248|  1.25k|   word3_muladd(&w2, &w1, &w0, x[18], y[12]);
 2249|  1.25k|   word3_muladd(&w2, &w1, &w0, x[19], y[11]);
 2250|  1.25k|   word3_muladd(&w2, &w1, &w0, x[20], y[10]);
 2251|  1.25k|   word3_muladd(&w2, &w1, &w0, x[21], y[9]);
 2252|  1.25k|   word3_muladd(&w2, &w1, &w0, x[22], y[8]);
 2253|  1.25k|   word3_muladd(&w2, &w1, &w0, x[23], y[7]);
 2254|  1.25k|   z[30] = w0;
 2255|  1.25k|   w0 = 0;
 2256|       |
 2257|  1.25k|   word3_muladd(&w0, &w2, &w1, x[8], y[23]);
 2258|  1.25k|   word3_muladd(&w0, &w2, &w1, x[9], y[22]);
 2259|  1.25k|   word3_muladd(&w0, &w2, &w1, x[10], y[21]);
 2260|  1.25k|   word3_muladd(&w0, &w2, &w1, x[11], y[20]);
 2261|  1.25k|   word3_muladd(&w0, &w2, &w1, x[12], y[19]);
 2262|  1.25k|   word3_muladd(&w0, &w2, &w1, x[13], y[18]);
 2263|  1.25k|   word3_muladd(&w0, &w2, &w1, x[14], y[17]);
 2264|  1.25k|   word3_muladd(&w0, &w2, &w1, x[15], y[16]);
 2265|  1.25k|   word3_muladd(&w0, &w2, &w1, x[16], y[15]);
 2266|  1.25k|   word3_muladd(&w0, &w2, &w1, x[17], y[14]);
 2267|  1.25k|   word3_muladd(&w0, &w2, &w1, x[18], y[13]);
 2268|  1.25k|   word3_muladd(&w0, &w2, &w1, x[19], y[12]);
 2269|  1.25k|   word3_muladd(&w0, &w2, &w1, x[20], y[11]);
 2270|  1.25k|   word3_muladd(&w0, &w2, &w1, x[21], y[10]);
 2271|  1.25k|   word3_muladd(&w0, &w2, &w1, x[22], y[9]);
 2272|  1.25k|   word3_muladd(&w0, &w2, &w1, x[23], y[8]);
 2273|  1.25k|   z[31] = w1;
 2274|  1.25k|   w1 = 0;
 2275|       |
 2276|  1.25k|   word3_muladd(&w1, &w0, &w2, x[9], y[23]);
 2277|  1.25k|   word3_muladd(&w1, &w0, &w2, x[10], y[22]);
 2278|  1.25k|   word3_muladd(&w1, &w0, &w2, x[11], y[21]);
 2279|  1.25k|   word3_muladd(&w1, &w0, &w2, x[12], y[20]);
 2280|  1.25k|   word3_muladd(&w1, &w0, &w2, x[13], y[19]);
 2281|  1.25k|   word3_muladd(&w1, &w0, &w2, x[14], y[18]);
 2282|  1.25k|   word3_muladd(&w1, &w0, &w2, x[15], y[17]);
 2283|  1.25k|   word3_muladd(&w1, &w0, &w2, x[16], y[16]);
 2284|  1.25k|   word3_muladd(&w1, &w0, &w2, x[17], y[15]);
 2285|  1.25k|   word3_muladd(&w1, &w0, &w2, x[18], y[14]);
 2286|  1.25k|   word3_muladd(&w1, &w0, &w2, x[19], y[13]);
 2287|  1.25k|   word3_muladd(&w1, &w0, &w2, x[20], y[12]);
 2288|  1.25k|   word3_muladd(&w1, &w0, &w2, x[21], y[11]);
 2289|  1.25k|   word3_muladd(&w1, &w0, &w2, x[22], y[10]);
 2290|  1.25k|   word3_muladd(&w1, &w0, &w2, x[23], y[9]);
 2291|  1.25k|   z[32] = w2;
 2292|  1.25k|   w2 = 0;
 2293|       |
 2294|  1.25k|   word3_muladd(&w2, &w1, &w0, x[10], y[23]);
 2295|  1.25k|   word3_muladd(&w2, &w1, &w0, x[11], y[22]);
 2296|  1.25k|   word3_muladd(&w2, &w1, &w0, x[12], y[21]);
 2297|  1.25k|   word3_muladd(&w2, &w1, &w0, x[13], y[20]);
 2298|  1.25k|   word3_muladd(&w2, &w1, &w0, x[14], y[19]);
 2299|  1.25k|   word3_muladd(&w2, &w1, &w0, x[15], y[18]);
 2300|  1.25k|   word3_muladd(&w2, &w1, &w0, x[16], y[17]);
 2301|  1.25k|   word3_muladd(&w2, &w1, &w0, x[17], y[16]);
 2302|  1.25k|   word3_muladd(&w2, &w1, &w0, x[18], y[15]);
 2303|  1.25k|   word3_muladd(&w2, &w1, &w0, x[19], y[14]);
 2304|  1.25k|   word3_muladd(&w2, &w1, &w0, x[20], y[13]);
 2305|  1.25k|   word3_muladd(&w2, &w1, &w0, x[21], y[12]);
 2306|  1.25k|   word3_muladd(&w2, &w1, &w0, x[22], y[11]);
 2307|  1.25k|   word3_muladd(&w2, &w1, &w0, x[23], y[10]);
 2308|  1.25k|   z[33] = w0;
 2309|  1.25k|   w0 = 0;
 2310|       |
 2311|  1.25k|   word3_muladd(&w0, &w2, &w1, x[11], y[23]);
 2312|  1.25k|   word3_muladd(&w0, &w2, &w1, x[12], y[22]);
 2313|  1.25k|   word3_muladd(&w0, &w2, &w1, x[13], y[21]);
 2314|  1.25k|   word3_muladd(&w0, &w2, &w1, x[14], y[20]);
 2315|  1.25k|   word3_muladd(&w0, &w2, &w1, x[15], y[19]);
 2316|  1.25k|   word3_muladd(&w0, &w2, &w1, x[16], y[18]);
 2317|  1.25k|   word3_muladd(&w0, &w2, &w1, x[17], y[17]);
 2318|  1.25k|   word3_muladd(&w0, &w2, &w1, x[18], y[16]);
 2319|  1.25k|   word3_muladd(&w0, &w2, &w1, x[19], y[15]);
 2320|  1.25k|   word3_muladd(&w0, &w2, &w1, x[20], y[14]);
 2321|  1.25k|   word3_muladd(&w0, &w2, &w1, x[21], y[13]);
 2322|  1.25k|   word3_muladd(&w0, &w2, &w1, x[22], y[12]);
 2323|  1.25k|   word3_muladd(&w0, &w2, &w1, x[23], y[11]);
 2324|  1.25k|   z[34] = w1;
 2325|  1.25k|   w1 = 0;
 2326|       |
 2327|  1.25k|   word3_muladd(&w1, &w0, &w2, x[12], y[23]);
 2328|  1.25k|   word3_muladd(&w1, &w0, &w2, x[13], y[22]);
 2329|  1.25k|   word3_muladd(&w1, &w0, &w2, x[14], y[21]);
 2330|  1.25k|   word3_muladd(&w1, &w0, &w2, x[15], y[20]);
 2331|  1.25k|   word3_muladd(&w1, &w0, &w2, x[16], y[19]);
 2332|  1.25k|   word3_muladd(&w1, &w0, &w2, x[17], y[18]);
 2333|  1.25k|   word3_muladd(&w1, &w0, &w2, x[18], y[17]);
 2334|  1.25k|   word3_muladd(&w1, &w0, &w2, x[19], y[16]);
 2335|  1.25k|   word3_muladd(&w1, &w0, &w2, x[20], y[15]);
 2336|  1.25k|   word3_muladd(&w1, &w0, &w2, x[21], y[14]);
 2337|  1.25k|   word3_muladd(&w1, &w0, &w2, x[22], y[13]);
 2338|  1.25k|   word3_muladd(&w1, &w0, &w2, x[23], y[12]);
 2339|  1.25k|   z[35] = w2;
 2340|  1.25k|   w2 = 0;
 2341|       |
 2342|  1.25k|   word3_muladd(&w2, &w1, &w0, x[13], y[23]);
 2343|  1.25k|   word3_muladd(&w2, &w1, &w0, x[14], y[22]);
 2344|  1.25k|   word3_muladd(&w2, &w1, &w0, x[15], y[21]);
 2345|  1.25k|   word3_muladd(&w2, &w1, &w0, x[16], y[20]);
 2346|  1.25k|   word3_muladd(&w2, &w1, &w0, x[17], y[19]);
 2347|  1.25k|   word3_muladd(&w2, &w1, &w0, x[18], y[18]);
 2348|  1.25k|   word3_muladd(&w2, &w1, &w0, x[19], y[17]);
 2349|  1.25k|   word3_muladd(&w2, &w1, &w0, x[20], y[16]);
 2350|  1.25k|   word3_muladd(&w2, &w1, &w0, x[21], y[15]);
 2351|  1.25k|   word3_muladd(&w2, &w1, &w0, x[22], y[14]);
 2352|  1.25k|   word3_muladd(&w2, &w1, &w0, x[23], y[13]);
 2353|  1.25k|   z[36] = w0;
 2354|  1.25k|   w0 = 0;
 2355|       |
 2356|  1.25k|   word3_muladd(&w0, &w2, &w1, x[14], y[23]);
 2357|  1.25k|   word3_muladd(&w0, &w2, &w1, x[15], y[22]);
 2358|  1.25k|   word3_muladd(&w0, &w2, &w1, x[16], y[21]);
 2359|  1.25k|   word3_muladd(&w0, &w2, &w1, x[17], y[20]);
 2360|  1.25k|   word3_muladd(&w0, &w2, &w1, x[18], y[19]);
 2361|  1.25k|   word3_muladd(&w0, &w2, &w1, x[19], y[18]);
 2362|  1.25k|   word3_muladd(&w0, &w2, &w1, x[20], y[17]);
 2363|  1.25k|   word3_muladd(&w0, &w2, &w1, x[21], y[16]);
 2364|  1.25k|   word3_muladd(&w0, &w2, &w1, x[22], y[15]);
 2365|  1.25k|   word3_muladd(&w0, &w2, &w1, x[23], y[14]);
 2366|  1.25k|   z[37] = w1;
 2367|  1.25k|   w1 = 0;
 2368|       |
 2369|  1.25k|   word3_muladd(&w1, &w0, &w2, x[15], y[23]);
 2370|  1.25k|   word3_muladd(&w1, &w0, &w2, x[16], y[22]);
 2371|  1.25k|   word3_muladd(&w1, &w0, &w2, x[17], y[21]);
 2372|  1.25k|   word3_muladd(&w1, &w0, &w2, x[18], y[20]);
 2373|  1.25k|   word3_muladd(&w1, &w0, &w2, x[19], y[19]);
 2374|  1.25k|   word3_muladd(&w1, &w0, &w2, x[20], y[18]);
 2375|  1.25k|   word3_muladd(&w1, &w0, &w2, x[21], y[17]);
 2376|  1.25k|   word3_muladd(&w1, &w0, &w2, x[22], y[16]);
 2377|  1.25k|   word3_muladd(&w1, &w0, &w2, x[23], y[15]);
 2378|  1.25k|   z[38] = w2;
 2379|  1.25k|   w2 = 0;
 2380|       |
 2381|  1.25k|   word3_muladd(&w2, &w1, &w0, x[16], y[23]);
 2382|  1.25k|   word3_muladd(&w2, &w1, &w0, x[17], y[22]);
 2383|  1.25k|   word3_muladd(&w2, &w1, &w0, x[18], y[21]);
 2384|  1.25k|   word3_muladd(&w2, &w1, &w0, x[19], y[20]);
 2385|  1.25k|   word3_muladd(&w2, &w1, &w0, x[20], y[19]);
 2386|  1.25k|   word3_muladd(&w2, &w1, &w0, x[21], y[18]);
 2387|  1.25k|   word3_muladd(&w2, &w1, &w0, x[22], y[17]);
 2388|  1.25k|   word3_muladd(&w2, &w1, &w0, x[23], y[16]);
 2389|  1.25k|   z[39] = w0;
 2390|  1.25k|   w0 = 0;
 2391|       |
 2392|  1.25k|   word3_muladd(&w0, &w2, &w1, x[17], y[23]);
 2393|  1.25k|   word3_muladd(&w0, &w2, &w1, x[18], y[22]);
 2394|  1.25k|   word3_muladd(&w0, &w2, &w1, x[19], y[21]);
 2395|  1.25k|   word3_muladd(&w0, &w2, &w1, x[20], y[20]);
 2396|  1.25k|   word3_muladd(&w0, &w2, &w1, x[21], y[19]);
 2397|  1.25k|   word3_muladd(&w0, &w2, &w1, x[22], y[18]);
 2398|  1.25k|   word3_muladd(&w0, &w2, &w1, x[23], y[17]);
 2399|  1.25k|   z[40] = w1;
 2400|  1.25k|   w1 = 0;
 2401|       |
 2402|  1.25k|   word3_muladd(&w1, &w0, &w2, x[18], y[23]);
 2403|  1.25k|   word3_muladd(&w1, &w0, &w2, x[19], y[22]);
 2404|  1.25k|   word3_muladd(&w1, &w0, &w2, x[20], y[21]);
 2405|  1.25k|   word3_muladd(&w1, &w0, &w2, x[21], y[20]);
 2406|  1.25k|   word3_muladd(&w1, &w0, &w2, x[22], y[19]);
 2407|  1.25k|   word3_muladd(&w1, &w0, &w2, x[23], y[18]);
 2408|  1.25k|   z[41] = w2;
 2409|  1.25k|   w2 = 0;
 2410|       |
 2411|  1.25k|   word3_muladd(&w2, &w1, &w0, x[19], y[23]);
 2412|  1.25k|   word3_muladd(&w2, &w1, &w0, x[20], y[22]);
 2413|  1.25k|   word3_muladd(&w2, &w1, &w0, x[21], y[21]);
 2414|  1.25k|   word3_muladd(&w2, &w1, &w0, x[22], y[20]);
 2415|  1.25k|   word3_muladd(&w2, &w1, &w0, x[23], y[19]);
 2416|  1.25k|   z[42] = w0;
 2417|  1.25k|   w0 = 0;
 2418|       |
 2419|  1.25k|   word3_muladd(&w0, &w2, &w1, x[20], y[23]);
 2420|  1.25k|   word3_muladd(&w0, &w2, &w1, x[21], y[22]);
 2421|  1.25k|   word3_muladd(&w0, &w2, &w1, x[22], y[21]);
 2422|  1.25k|   word3_muladd(&w0, &w2, &w1, x[23], y[20]);
 2423|  1.25k|   z[43] = w1;
 2424|  1.25k|   w1 = 0;
 2425|       |
 2426|  1.25k|   word3_muladd(&w1, &w0, &w2, x[21], y[23]);
 2427|  1.25k|   word3_muladd(&w1, &w0, &w2, x[22], y[22]);
 2428|  1.25k|   word3_muladd(&w1, &w0, &w2, x[23], y[21]);
 2429|  1.25k|   z[44] = w2;
 2430|  1.25k|   w2 = 0;
 2431|       |
 2432|  1.25k|   word3_muladd(&w2, &w1, &w0, x[22], y[23]);
 2433|  1.25k|   word3_muladd(&w2, &w1, &w0, x[23], y[22]);
 2434|  1.25k|   z[45] = w0;
 2435|  1.25k|   w0 = 0;
 2436|       |
 2437|  1.25k|   word3_muladd(&w0, &w2, &w1, x[23], y[23]);
 2438|  1.25k|   z[46] = w1;
 2439|  1.25k|   z[47] = w2;
 2440|  1.25k|}

_ZN5Botan12basecase_mulEPmmPKmmS2_m:
   20|  1.85M|void basecase_mul(word z[], size_t z_size, const word x[], size_t x_size, const word y[], size_t y_size) {
   21|  1.85M|   if(z_size < x_size + y_size) {
  ------------------
  |  Branch (21:7): [True: 0, False: 1.85M]
  ------------------
   22|      0|      throw Invalid_Argument("basecase_mul z_size too small");
   23|      0|   }
   24|       |
   25|  1.85M|   const size_t x_size_8 = x_size - (x_size % 8);
   26|       |
   27|  1.85M|   clear_mem(z, z_size);
   28|       |
   29|  10.8M|   for(size_t i = 0; i != y_size; ++i) {
  ------------------
  |  Branch (29:22): [True: 8.99M, False: 1.85M]
  ------------------
   30|  8.99M|      const word y_i = y[i];
   31|       |
   32|  8.99M|      word carry = 0;
   33|       |
   34|  11.3M|      for(size_t j = 0; j != x_size_8; j += 8) {
  ------------------
  |  Branch (34:25): [True: 2.32M, False: 8.99M]
  ------------------
   35|  2.32M|         carry = word8_madd3(z + i + j, x + j, y_i, carry);
   36|  2.32M|      }
   37|       |
   38|  45.7M|      for(size_t j = x_size_8; j != x_size; ++j) {
  ------------------
  |  Branch (38:32): [True: 36.7M, False: 8.99M]
  ------------------
   39|  36.7M|         z[i + j] = word_madd3(x[j], y_i, z[i + j], &carry);
   40|  36.7M|      }
   41|       |
   42|  8.99M|      z[x_size + i] = carry;
   43|  8.99M|   }
   44|  1.85M|}
_ZN5Botan12basecase_sqrEPmmPKmm:
   46|   511k|void basecase_sqr(word z[], size_t z_size, const word x[], size_t x_size) {
   47|   511k|   if(z_size < 2 * x_size) {
  ------------------
  |  Branch (47:7): [True: 0, False: 511k]
  ------------------
   48|      0|      throw Invalid_Argument("basecase_sqr z_size too small");
   49|      0|   }
   50|       |
   51|   511k|   const size_t x_size_8 = x_size - (x_size % 8);
   52|       |
   53|   511k|   clear_mem(z, z_size);
   54|       |
   55|  2.70M|   for(size_t i = 0; i != x_size; ++i) {
  ------------------
  |  Branch (55:22): [True: 2.19M, False: 511k]
  ------------------
   56|  2.19M|      const word x_i = x[i];
   57|       |
   58|  2.19M|      word carry = 0;
   59|       |
   60|  3.84M|      for(size_t j = 0; j != x_size_8; j += 8) {
  ------------------
  |  Branch (60:25): [True: 1.64M, False: 2.19M]
  ------------------
   61|  1.64M|         carry = word8_madd3(z + i + j, x + j, x_i, carry);
   62|  1.64M|      }
   63|       |
   64|  10.3M|      for(size_t j = x_size_8; j != x_size; ++j) {
  ------------------
  |  Branch (64:32): [True: 8.16M, False: 2.19M]
  ------------------
   65|  8.16M|         z[i + j] = word_madd3(x[j], x_i, z[i + j], &carry);
   66|  8.16M|      }
   67|       |
   68|  2.19M|      z[x_size + i] = carry;
   69|  2.19M|   }
   70|   511k|}
_ZN5Botan10bigint_mulEPmmPKmmmS2_mmS0_m:
  291|  10.8M|                size_t ws_size) {
  292|  10.8M|   clear_mem(z, z_size);
  293|       |
  294|  10.8M|   if(x_sw == 1) {
  ------------------
  |  Branch (294:7): [True: 6.31k, False: 10.8M]
  ------------------
  295|  6.31k|      bigint_linmul3(z, y, y_sw, x[0]);
  296|  10.8M|   } else if(y_sw == 1) {
  ------------------
  |  Branch (296:14): [True: 21, False: 10.8M]
  ------------------
  297|     21|      bigint_linmul3(z, x, x_sw, y[0]);
  298|  10.8M|   } else if(sized_for_comba_mul<4>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (298:14): [True: 8.43M, False: 2.45M]
  ------------------
  299|  8.43M|      bigint_comba_mul4(z, x, y);
  300|  8.43M|   } else if(sized_for_comba_mul<6>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (300:14): [True: 174k, False: 2.28M]
  ------------------
  301|   174k|      bigint_comba_mul6(z, x, y);
  302|  2.28M|   } else if(sized_for_comba_mul<8>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (302:14): [True: 53.5k, False: 2.23M]
  ------------------
  303|  53.5k|      bigint_comba_mul8(z, x, y);
  304|  2.23M|   } else if(sized_for_comba_mul<9>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (304:14): [True: 348k, False: 1.88M]
  ------------------
  305|   348k|      bigint_comba_mul9(z, x, y);
  306|  1.88M|   } else if(sized_for_comba_mul<16>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (306:14): [True: 24.7k, False: 1.85M]
  ------------------
  307|  24.7k|      bigint_comba_mul16(z, x, y);
  308|  1.85M|   } else if(sized_for_comba_mul<24>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (308:14): [True: 756, False: 1.85M]
  ------------------
  309|    756|      bigint_comba_mul24(z, x, y);
  310|  1.85M|   } else if(x_sw < KARATSUBA_MULTIPLY_THRESHOLD || y_sw < KARATSUBA_MULTIPLY_THRESHOLD || !workspace) {
  ------------------
  |  Branch (310:14): [True: 1.85M, False: 3.01k]
  |  Branch (310:53): [True: 362, False: 2.65k]
  |  Branch (310:92): [True: 0, False: 2.65k]
  ------------------
  311|  1.85M|      basecase_mul(z, z_size, x, x_sw, y, y_sw);
  312|  1.85M|   } else {
  313|  2.65k|      const size_t N = karatsuba_size(z_size, x_size, x_sw, y_size, y_sw);
  314|       |
  315|  2.65k|      if(N && z_size >= 2 * N && ws_size >= 2 * N) {
  ------------------
  |  Branch (315:10): [True: 1.86k, False: 790]
  |  Branch (315:15): [True: 1.85k, False: 5]
  |  Branch (315:34): [True: 1.85k, False: 5]
  ------------------
  316|  1.85k|         karatsuba_mul(z, x, y, N, workspace);
  317|  1.85k|      } else {
  318|    800|         basecase_mul(z, z_size, x, x_sw, y, y_sw);
  319|    800|      }
  320|  2.65k|   }
  321|  10.8M|}
_ZN5Botan10bigint_sqrEPmmPKmmmS0_m:
  326|  4.84M|void bigint_sqr(word z[], size_t z_size, const word x[], size_t x_size, size_t x_sw, word workspace[], size_t ws_size) {
  327|  4.84M|   clear_mem(z, z_size);
  328|       |
  329|  4.84M|   BOTAN_ASSERT(z_size / 2 >= x_sw, "Output size is sufficient");
  ------------------
  |  |   51|  4.84M|   do {                                                                                 \
  |  |   52|  4.84M|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 4.84M]
  |  |  ------------------
  |  |   53|  4.84M|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  4.84M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  330|       |
  331|  4.84M|   if(x_sw == 1) {
  ------------------
  |  Branch (331:7): [True: 36.6k, False: 4.80M]
  ------------------
  332|  36.6k|      bigint_linmul3(z, x, x_sw, x[0]);
  333|  4.80M|   } else if(sized_for_comba_sqr<4>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (333:14): [True: 3.72M, False: 1.08M]
  ------------------
  334|  3.72M|      bigint_comba_sqr4(z, x);
  335|  3.72M|   } else if(sized_for_comba_sqr<6>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (335:14): [True: 192k, False: 888k]
  ------------------
  336|   192k|      bigint_comba_sqr6(z, x);
  337|   888k|   } else if(sized_for_comba_sqr<8>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (337:14): [True: 42.9k, False: 845k]
  ------------------
  338|  42.9k|      bigint_comba_sqr8(z, x);
  339|   845k|   } else if(sized_for_comba_sqr<9>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (339:14): [True: 332k, False: 513k]
  ------------------
  340|   332k|      bigint_comba_sqr9(z, x);
  341|   513k|   } else if(sized_for_comba_sqr<16>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (341:14): [True: 656, False: 512k]
  ------------------
  342|    656|      bigint_comba_sqr16(z, x);
  343|   512k|   } else if(sized_for_comba_sqr<24>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (343:14): [True: 522, False: 512k]
  ------------------
  344|    522|      bigint_comba_sqr24(z, x);
  345|   512k|   } else if(x_size < KARATSUBA_SQUARE_THRESHOLD || !workspace) {
  ------------------
  |  Branch (345:14): [True: 482k, False: 29.5k]
  |  Branch (345:53): [True: 0, False: 29.5k]
  ------------------
  346|   482k|      basecase_sqr(z, z_size, x, x_sw);
  347|   482k|   } else {
  348|  29.5k|      const size_t N = karatsuba_size(z_size, x_size, x_sw);
  349|       |
  350|  29.5k|      if(N && z_size >= 2 * N && ws_size >= 2 * N) {
  ------------------
  |  Branch (350:10): [True: 11.5k, False: 18.0k]
  |  Branch (350:15): [True: 11.5k, False: 0]
  |  Branch (350:34): [True: 11.5k, False: 0]
  ------------------
  351|  11.5k|         karatsuba_sqr(z, x, N, workspace);
  352|  18.0k|      } else {
  353|  18.0k|         basecase_sqr(z, z_size, x, x_sw);
  354|  18.0k|      }
  355|  29.5k|   }
  356|  4.84M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_114karatsuba_sizeEmmmmm:
  202|  2.65k|size_t karatsuba_size(size_t z_size, size_t x_size, size_t x_sw, size_t y_size, size_t y_sw) {
  203|  2.65k|   if(x_sw > x_size || x_sw > y_size || y_sw > x_size || y_sw > y_size) {
  ------------------
  |  Branch (203:7): [True: 0, False: 2.65k]
  |  Branch (203:24): [True: 0, False: 2.65k]
  |  Branch (203:41): [True: 74, False: 2.57k]
  |  Branch (203:58): [True: 0, False: 2.57k]
  ------------------
  204|     74|      return 0;
  205|     74|   }
  206|       |
  207|  2.57k|   if(((x_size == x_sw) && (x_size % 2)) || ((y_size == y_sw) && (y_size % 2))) {
  ------------------
  |  Branch (207:8): [True: 21, False: 2.55k]
  |  Branch (207:28): [True: 0, False: 21]
  |  Branch (207:46): [True: 23, False: 2.55k]
  |  Branch (207:66): [True: 0, False: 23]
  ------------------
  208|      0|      return 0;
  209|      0|   }
  210|       |
  211|  2.57k|   const size_t start = (x_sw > y_sw) ? x_sw : y_sw;
  ------------------
  |  Branch (211:25): [True: 18, False: 2.56k]
  ------------------
  212|  2.57k|   const size_t end = (x_size < y_size) ? x_size : y_size;
  ------------------
  |  Branch (212:23): [True: 199, False: 2.38k]
  ------------------
  213|       |
  214|  2.57k|   if(start == end) {
  ------------------
  |  Branch (214:7): [True: 44, False: 2.53k]
  ------------------
  215|     44|      if(start % 2) {
  ------------------
  |  Branch (215:10): [True: 0, False: 44]
  ------------------
  216|      0|         return 0;
  217|      0|      }
  218|     44|      return start;
  219|     44|   }
  220|       |
  221|  3.23k|   for(size_t j = start; j <= end; ++j) {
  ------------------
  |  Branch (221:26): [True: 3.23k, False: 0]
  ------------------
  222|  3.23k|      if(j % 2) {
  ------------------
  |  Branch (222:10): [True: 695, False: 2.53k]
  ------------------
  223|    695|         continue;
  224|    695|      }
  225|       |
  226|  2.53k|      if(2 * j > z_size) {
  ------------------
  |  Branch (226:10): [True: 716, False: 1.81k]
  ------------------
  227|    716|         return 0;
  228|    716|      }
  229|       |
  230|  1.81k|      if(x_sw <= j && j <= x_size && y_sw <= j && j <= y_size) {
  ------------------
  |  Branch (230:10): [True: 1.81k, False: 0]
  |  Branch (230:23): [True: 1.81k, False: 0]
  |  Branch (230:38): [True: 1.81k, False: 0]
  |  Branch (230:51): [True: 1.81k, False: 0]
  ------------------
  231|  1.81k|         if(j % 4 == 2 && (j + 2) <= x_size && (j + 2) <= y_size && 2 * (j + 2) <= z_size) {
  ------------------
  |  Branch (231:13): [True: 339, False: 1.48k]
  |  Branch (231:27): [True: 339, False: 0]
  |  Branch (231:48): [True: 339, False: 0]
  |  Branch (231:69): [True: 75, False: 264]
  ------------------
  232|     75|            return j + 2;
  233|     75|         }
  234|  1.74k|         return j;
  235|  1.81k|      }
  236|  1.81k|   }
  237|       |
  238|      0|   return 0;
  239|  2.53k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_113karatsuba_mulEPmPKmS3_mS1_:
   80|  17.6k|void karatsuba_mul(word z[], const word x[], const word y[], size_t N, word workspace[]) {
   81|  17.6k|   if(N < KARATSUBA_MULTIPLY_THRESHOLD || N % 2) {
  ------------------
  |  Branch (81:7): [True: 11.9k, False: 5.76k]
  |  Branch (81:43): [True: 486, False: 5.27k]
  ------------------
   82|  12.4k|      switch(N) {
   83|      0|         case 6:
  ------------------
  |  Branch (83:10): [True: 0, False: 12.4k]
  ------------------
   84|      0|            return bigint_comba_mul6(z, x, y);
   85|      0|         case 8:
  ------------------
  |  Branch (85:10): [True: 0, False: 12.4k]
  ------------------
   86|      0|            return bigint_comba_mul8(z, x, y);
   87|      0|         case 9:
  ------------------
  |  Branch (87:10): [True: 0, False: 12.4k]
  ------------------
   88|      0|            return bigint_comba_mul9(z, x, y);
   89|  10.0k|         case 16:
  ------------------
  |  Branch (89:10): [True: 10.0k, False: 2.40k]
  ------------------
   90|  10.0k|            return bigint_comba_mul16(z, x, y);
   91|    498|         case 24:
  ------------------
  |  Branch (91:10): [True: 498, False: 11.9k]
  ------------------
   92|    498|            return bigint_comba_mul24(z, x, y);
   93|  1.90k|         default:
  ------------------
  |  Branch (93:10): [True: 1.90k, False: 10.5k]
  ------------------
   94|  1.90k|            return basecase_mul(z, 2 * N, x, N, y, N);
   95|  12.4k|      }
   96|  12.4k|   }
   97|       |
   98|  5.27k|   const size_t N2 = N / 2;
   99|       |
  100|  5.27k|   const word* x0 = x;
  101|  5.27k|   const word* x1 = x + N2;
  102|  5.27k|   const word* y0 = y;
  103|  5.27k|   const word* y1 = y + N2;
  104|  5.27k|   word* z0 = z;
  105|  5.27k|   word* z1 = z + N;
  106|       |
  107|  5.27k|   word* ws0 = workspace;
  108|  5.27k|   word* ws1 = workspace + N;
  109|       |
  110|  5.27k|   clear_mem(workspace, 2 * N);
  111|       |
  112|       |   /*
  113|       |   * If either of cmp0 or cmp1 is zero then z0 or z1 resp is zero here,
  114|       |   * resulting in a no-op - z0*z1 will be equal to zero so we don't need to do
  115|       |   * anything, clear_mem above already set the correct result.
  116|       |   *
  117|       |   * However we ignore the result of the comparisons and always perform the
  118|       |   * subtractions and recursively multiply to avoid the timing channel.
  119|       |   */
  120|       |
  121|       |   // First compute (X_lo - X_hi)*(Y_hi - Y_lo)
  122|  5.27k|   const auto cmp0 = bigint_sub_abs(z0, x0, x1, N2, workspace);
  123|  5.27k|   const auto cmp1 = bigint_sub_abs(z1, y1, y0, N2, workspace);
  124|  5.27k|   const auto neg_mask = ~(cmp0 ^ cmp1);
  125|       |
  126|  5.27k|   karatsuba_mul(ws0, z0, z1, N2, ws1);
  127|       |
  128|       |   // Compute X_lo * Y_lo
  129|  5.27k|   karatsuba_mul(z0, x0, y0, N2, ws1);
  130|       |
  131|       |   // Compute X_hi * Y_hi
  132|  5.27k|   karatsuba_mul(z1, x1, y1, N2, ws1);
  133|       |
  134|  5.27k|   const word ws_carry = bigint_add3_nc(ws1, z0, N, z1, N);
  135|  5.27k|   word z_carry = bigint_add2_nc(z + N2, N, ws1, N);
  136|       |
  137|  5.27k|   z_carry += bigint_add2_nc(z + N + N2, N2, &ws_carry, 1);
  138|  5.27k|   bigint_add2_nc(z + N + N2, N2, &z_carry, 1);
  139|       |
  140|  5.27k|   clear_mem(workspace + N, N2);
  141|       |
  142|  5.27k|   bigint_cnd_add_or_sub(neg_mask, z + N2, workspace, 2 * N - N2);
  143|  5.27k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_114karatsuba_sizeEmmm:
  244|  29.5k|size_t karatsuba_size(size_t z_size, size_t x_size, size_t x_sw) {
  245|  29.5k|   if(x_sw == x_size) {
  ------------------
  |  Branch (245:7): [True: 0, False: 29.5k]
  ------------------
  246|      0|      if(x_sw % 2) {
  ------------------
  |  Branch (246:10): [True: 0, False: 0]
  ------------------
  247|      0|         return 0;
  248|      0|      }
  249|      0|      return x_sw;
  250|      0|   }
  251|       |
  252|  47.6k|   for(size_t j = x_sw; j <= x_size; ++j) {
  ------------------
  |  Branch (252:25): [True: 47.6k, False: 0]
  ------------------
  253|  47.6k|      if(j % 2) {
  ------------------
  |  Branch (253:10): [True: 18.0k, False: 29.5k]
  ------------------
  254|  18.0k|         continue;
  255|  18.0k|      }
  256|       |
  257|  29.5k|      if(2 * j > z_size) {
  ------------------
  |  Branch (257:10): [True: 18.0k, False: 11.5k]
  ------------------
  258|  18.0k|         return 0;
  259|  18.0k|      }
  260|       |
  261|  11.5k|      if(j % 4 == 2 && (j + 2) <= x_size && 2 * (j + 2) <= z_size) {
  ------------------
  |  Branch (261:10): [True: 1.39k, False: 10.1k]
  |  Branch (261:24): [True: 1.39k, False: 0]
  |  Branch (261:45): [True: 0, False: 1.39k]
  ------------------
  262|      0|         return j + 2;
  263|      0|      }
  264|  11.5k|      return j;
  265|  11.5k|   }
  266|       |
  267|      0|   return 0;
  268|  29.5k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_113karatsuba_sqrEPmPKmmS1_:
  148|  38.8k|void karatsuba_sqr(word z[], const word x[], size_t N, word workspace[]) {
  149|  38.8k|   if(N < KARATSUBA_SQUARE_THRESHOLD || N % 2) {
  ------------------
  |  Branch (149:7): [True: 29.0k, False: 9.74k]
  |  Branch (149:41): [True: 648, False: 9.10k]
  ------------------
  150|  29.7k|      switch(N) {
  151|      0|         case 6:
  ------------------
  |  Branch (151:10): [True: 0, False: 29.7k]
  ------------------
  152|      0|            return bigint_comba_sqr6(z, x);
  153|      0|         case 8:
  ------------------
  |  Branch (153:10): [True: 0, False: 29.7k]
  ------------------
  154|      0|            return bigint_comba_sqr8(z, x);
  155|      0|         case 9:
  ------------------
  |  Branch (155:10): [True: 0, False: 29.7k]
  ------------------
  156|      0|            return bigint_comba_sqr9(z, x);
  157|  18.6k|         case 16:
  ------------------
  |  Branch (157:10): [True: 18.6k, False: 11.0k]
  ------------------
  158|  18.6k|            return bigint_comba_sqr16(z, x);
  159|    606|         case 24:
  ------------------
  |  Branch (159:10): [True: 606, False: 29.1k]
  ------------------
  160|    606|            return bigint_comba_sqr24(z, x);
  161|  10.4k|         default:
  ------------------
  |  Branch (161:10): [True: 10.4k, False: 19.2k]
  ------------------
  162|  10.4k|            return basecase_sqr(z, 2 * N, x, N);
  163|  29.7k|      }
  164|  29.7k|   }
  165|       |
  166|  9.10k|   const size_t N2 = N / 2;
  167|       |
  168|  9.10k|   const word* x0 = x;
  169|  9.10k|   const word* x1 = x + N2;
  170|  9.10k|   word* z0 = z;
  171|  9.10k|   word* z1 = z + N;
  172|       |
  173|  9.10k|   word* ws0 = workspace;
  174|  9.10k|   word* ws1 = workspace + N;
  175|       |
  176|  9.10k|   clear_mem(workspace, 2 * N);
  177|       |
  178|       |   // See comment in karatsuba_mul
  179|  9.10k|   bigint_sub_abs(z0, x0, x1, N2, workspace);
  180|  9.10k|   karatsuba_sqr(ws0, z0, N2, ws1);
  181|       |
  182|  9.10k|   karatsuba_sqr(z0, x0, N2, ws1);
  183|  9.10k|   karatsuba_sqr(z1, x1, N2, ws1);
  184|       |
  185|  9.10k|   const word ws_carry = bigint_add3_nc(ws1, z0, N, z1, N);
  186|  9.10k|   word z_carry = bigint_add2_nc(z + N2, N, ws1, N);
  187|       |
  188|  9.10k|   z_carry += bigint_add2_nc(z + N + N2, N2, &ws_carry, 1);
  189|  9.10k|   bigint_add2_nc(z + N + N2, N2, &z_carry, 1);
  190|       |
  191|       |   /*
  192|       |   * This is only actually required if cmp (result of bigint_sub_abs) is != 0,
  193|       |   * however if cmp==0 then ws0[0:N] == 0 and avoiding the jump hides a
  194|       |   * timing channel.
  195|       |   */
  196|  9.10k|   bigint_sub2(z + N2, 2 * N - N2, ws0, N);
  197|  9.10k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm4EEEbmmmmm:
  271|  10.8M|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  272|  10.8M|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (272:12): [True: 9.49M, False: 1.39M]
  |  Branch (272:26): [True: 9.38M, False: 113k]
  |  Branch (272:42): [True: 8.93M, False: 446k]
  |  Branch (272:56): [True: 8.91M, False: 22.8k]
  |  Branch (272:72): [True: 8.43M, False: 484k]
  ------------------
  273|  10.8M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm6EEEbmmmmm:
  271|  2.45M|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  272|  2.45M|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (272:12): [True: 1.87M, False: 578k]
  |  Branch (272:26): [True: 1.71M, False: 169k]
  |  Branch (272:42): [True: 1.68M, False: 21.3k]
  |  Branch (272:56): [True: 1.65M, False: 30.4k]
  |  Branch (272:72): [True: 174k, False: 1.48M]
  ------------------
  273|  2.45M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm8EEEbmmmmm:
  271|  2.28M|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  272|  2.28M|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (272:12): [True: 1.80M, False: 476k]
  |  Branch (272:26): [True: 1.47M, False: 334k]
  |  Branch (272:42): [True: 1.44M, False: 29.3k]
  |  Branch (272:56): [True: 1.37M, False: 67.4k]
  |  Branch (272:72): [True: 53.5k, False: 1.32M]
  ------------------
  273|  2.28M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm9EEEbmmmmm:
  271|  2.23M|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  272|  2.23M|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (272:12): [True: 2.11M, False: 118k]
  |  Branch (272:26): [True: 710k, False: 1.40M]
  |  Branch (272:42): [True: 682k, False: 27.7k]
  |  Branch (272:56): [True: 543k, False: 139k]
  |  Branch (272:72): [True: 348k, False: 194k]
  ------------------
  273|  2.23M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm16EEEbmmmmm:
  271|  1.88M|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  272|  1.88M|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (272:12): [True: 1.87M, False: 4.97k]
  |  Branch (272:26): [True: 367k, False: 1.50M]
  |  Branch (272:42): [True: 367k, False: 367]
  |  Branch (272:56): [True: 311k, False: 56.4k]
  |  Branch (272:72): [True: 24.7k, False: 286k]
  ------------------
  273|  1.88M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm24EEEbmmmmm:
  271|  1.85M|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  272|  1.85M|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (272:12): [True: 1.85M, False: 3.78k]
  |  Branch (272:26): [True: 250k, False: 1.60M]
  |  Branch (272:42): [True: 249k, False: 316]
  |  Branch (272:56): [True: 39.9k, False: 209k]
  |  Branch (272:72): [True: 756, False: 39.2k]
  ------------------
  273|  1.85M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm4EEEbmmm:
  276|  4.80M|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  277|  4.80M|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (277:12): [True: 4.15M, False: 650k]
  |  Branch (277:26): [True: 4.12M, False: 27.0k]
  |  Branch (277:42): [True: 3.72M, False: 403k]
  ------------------
  278|  4.80M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm6EEEbmmm:
  276|  1.08M|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  277|  1.08M|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (277:12): [True: 628k, False: 452k]
  |  Branch (277:26): [True: 591k, False: 36.8k]
  |  Branch (277:42): [True: 192k, False: 399k]
  ------------------
  278|  1.08M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm8EEEbmmm:
  276|   888k|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  277|   888k|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (277:12): [True: 492k, False: 395k]
  |  Branch (277:26): [True: 385k, False: 107k]
  |  Branch (277:42): [True: 42.9k, False: 342k]
  ------------------
  278|   888k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm9EEEbmmm:
  276|   845k|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  277|   845k|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (277:12): [True: 781k, False: 63.8k]
  |  Branch (277:26): [True: 447k, False: 334k]
  |  Branch (277:42): [True: 332k, False: 115k]
  ------------------
  278|   845k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm16EEEbmmm:
  276|   513k|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  277|   513k|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (277:12): [True: 507k, False: 5.81k]
  |  Branch (277:26): [True: 153k, False: 353k]
  |  Branch (277:42): [True: 656, False: 153k]
  ------------------
  278|   513k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm24EEEbmmm:
  276|   512k|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  277|   512k|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (277:12): [True: 507k, False: 4.89k]
  |  Branch (277:26): [True: 44.0k, False: 463k]
  |  Branch (277:42): [True: 522, False: 43.5k]
  ------------------
  278|   512k|}

_ZN5Botan25bigint_monty_redc_genericEPmmPKmmmS0_:
   31|  1.12M|void bigint_monty_redc_generic(word z[], size_t z_size, const word p[], size_t p_size, word p_dash, word ws[]) {
   32|  1.12M|   BOTAN_ARG_CHECK(z_size >= 2 * p_size && p_size > 0, "Invalid sizes for bigint_monty_redc_generic");
  ------------------
  |  |   30|  1.12M|   do {                                                          \
  |  |   31|  2.25M|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:12): [True: 1.12M, False: 0]
  |  |  |  Branch (31:12): [True: 1.12M, False: 0]
  |  |  ------------------
  |  |   32|  1.12M|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  1.12M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   33|       |
   34|  1.12M|   word w2 = 0, w1 = 0, w0 = 0;
   35|       |
   36|  1.12M|   w0 = z[0];
   37|       |
   38|  1.12M|   ws[0] = w0 * p_dash;
   39|       |
   40|  1.12M|   word3_muladd(&w2, &w1, &w0, ws[0], p[0]);
   41|       |
   42|  1.12M|   w0 = w1;
   43|  1.12M|   w1 = w2;
   44|  1.12M|   w2 = 0;
   45|       |
   46|  4.37M|   for(size_t i = 1; i != p_size; ++i) {
  ------------------
  |  Branch (46:22): [True: 3.24M, False: 1.12M]
  ------------------
   47|  25.0M|      for(size_t j = 0; j < i; ++j) {
  ------------------
  |  Branch (47:25): [True: 21.8M, False: 3.24M]
  ------------------
   48|  21.8M|         word3_muladd(&w2, &w1, &w0, ws[j], p[i - j]);
   49|  21.8M|      }
   50|       |
   51|  3.24M|      word3_add(&w2, &w1, &w0, z[i]);
   52|       |
   53|  3.24M|      ws[i] = w0 * p_dash;
   54|       |
   55|  3.24M|      word3_muladd(&w2, &w1, &w0, ws[i], p[0]);
   56|       |
   57|  3.24M|      w0 = w1;
   58|  3.24M|      w1 = w2;
   59|  3.24M|      w2 = 0;
   60|  3.24M|   }
   61|       |
   62|  4.37M|   for(size_t i = 0; i != p_size - 1; ++i) {
  ------------------
  |  Branch (62:22): [True: 3.24M, False: 1.12M]
  ------------------
   63|  25.0M|      for(size_t j = i + 1; j != p_size; ++j) {
  ------------------
  |  Branch (63:29): [True: 21.8M, False: 3.24M]
  ------------------
   64|  21.8M|         word3_muladd(&w2, &w1, &w0, ws[j], p[p_size + i - j]);
   65|  21.8M|      }
   66|       |
   67|  3.24M|      word3_add(&w2, &w1, &w0, z[p_size + i]);
   68|       |
   69|  3.24M|      ws[i] = w0;
   70|       |
   71|  3.24M|      w0 = w1;
   72|  3.24M|      w1 = w2;
   73|  3.24M|      w2 = 0;
   74|  3.24M|   }
   75|       |
   76|  1.12M|   word3_add(&w2, &w1, &w0, z[2 * p_size - 1]);
   77|       |
   78|  1.12M|   ws[p_size - 1] = w0;
   79|  1.12M|   ws[p_size] = w1;
   80|       |
   81|       |   /*
   82|       |   * The result might need to be reduced mod p. To avoid a timing
   83|       |   * channel, always perform the subtraction. If in the compution
   84|       |   * of x - p a borrow is required then x was already < p.
   85|       |   *
   86|       |   * x starts at ws[0] and is p_size+1 bytes long.
   87|       |   * x - p starts at z[0] and is also p_size+1 bytes log
   88|       |   *
   89|       |   * If borrow was set then x was already < p and the subtraction
   90|       |   * was not needed. In that case overwrite z[0:p_size] with the
   91|       |   * original x in ws[0:p_size].
   92|       |   *
   93|       |   * We only copy out p_size in the final step because we know
   94|       |   * the Montgomery result is < P
   95|       |   */
   96|       |
   97|  1.12M|   word borrow = bigint_sub3(z, ws, p_size + 1, p, p_size);
   98|       |
   99|  1.12M|   BOTAN_DEBUG_ASSERT(borrow == 0 || borrow == 1);
  ------------------
  |  |   99|  1.12M|      do {                          \
  |  |  100|  1.12M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  100|       |
  101|  1.12M|   CT::conditional_assign_mem(borrow, z, ws, p_size);
  102|  1.12M|   clear_mem(z + p_size, z_size - p_size);
  103|  1.12M|}

_ZN5Botan19bigint_monty_redc_4EPmPKmmS0_:
   14|  9.27M|void bigint_monty_redc_4(word z[8], const word p[4], word p_dash, word ws[]) {
   15|  9.27M|   word w2 = 0, w1 = 0, w0 = 0;
   16|  9.27M|   w0 = z[0];
   17|  9.27M|   ws[0] = w0 * p_dash;
   18|  9.27M|   word3_muladd(&w2, &w1, &w0, ws[0], p[0]);
   19|  9.27M|   w0 = w1;
   20|  9.27M|   w1 = w2;
   21|  9.27M|   w2 = 0;
   22|  9.27M|   word3_muladd(&w2, &w1, &w0, ws[0], p[1]);
   23|  9.27M|   word3_add(&w2, &w1, &w0, z[1]);
   24|  9.27M|   ws[1] = w0 * p_dash;
   25|  9.27M|   word3_muladd(&w2, &w1, &w0, ws[1], p[0]);
   26|  9.27M|   w0 = w1;
   27|  9.27M|   w1 = w2;
   28|  9.27M|   w2 = 0;
   29|  9.27M|   word3_muladd(&w2, &w1, &w0, ws[0], p[2]);
   30|  9.27M|   word3_muladd(&w2, &w1, &w0, ws[1], p[1]);
   31|  9.27M|   word3_add(&w2, &w1, &w0, z[2]);
   32|  9.27M|   ws[2] = w0 * p_dash;
   33|  9.27M|   word3_muladd(&w2, &w1, &w0, ws[2], p[0]);
   34|  9.27M|   w0 = w1;
   35|  9.27M|   w1 = w2;
   36|  9.27M|   w2 = 0;
   37|  9.27M|   word3_muladd(&w2, &w1, &w0, ws[0], p[3]);
   38|  9.27M|   word3_muladd(&w2, &w1, &w0, ws[1], p[2]);
   39|  9.27M|   word3_muladd(&w2, &w1, &w0, ws[2], p[1]);
   40|  9.27M|   word3_add(&w2, &w1, &w0, z[3]);
   41|  9.27M|   ws[3] = w0 * p_dash;
   42|  9.27M|   word3_muladd(&w2, &w1, &w0, ws[3], p[0]);
   43|  9.27M|   w0 = w1;
   44|  9.27M|   w1 = w2;
   45|  9.27M|   w2 = 0;
   46|  9.27M|   word3_muladd(&w2, &w1, &w0, ws[1], p[3]);
   47|  9.27M|   word3_muladd(&w2, &w1, &w0, ws[2], p[2]);
   48|  9.27M|   word3_muladd(&w2, &w1, &w0, ws[3], p[1]);
   49|  9.27M|   word3_add(&w2, &w1, &w0, z[4]);
   50|  9.27M|   ws[0] = w0;
   51|  9.27M|   w0 = w1;
   52|  9.27M|   w1 = w2;
   53|  9.27M|   w2 = 0;
   54|  9.27M|   word3_muladd(&w2, &w1, &w0, ws[2], p[3]);
   55|  9.27M|   word3_muladd(&w2, &w1, &w0, ws[3], p[2]);
   56|  9.27M|   word3_add(&w2, &w1, &w0, z[5]);
   57|  9.27M|   ws[1] = w0;
   58|  9.27M|   w0 = w1;
   59|  9.27M|   w1 = w2;
   60|  9.27M|   w2 = 0;
   61|  9.27M|   word3_muladd(&w2, &w1, &w0, ws[3], p[3]);
   62|  9.27M|   word3_add(&w2, &w1, &w0, z[6]);
   63|  9.27M|   ws[2] = w0;
   64|  9.27M|   w0 = w1;
   65|  9.27M|   w1 = w2;
   66|  9.27M|   w2 = 0;
   67|  9.27M|   word3_add(&w2, &w1, &w0, z[7]);
   68|  9.27M|   ws[3] = w0;
   69|  9.27M|   ws[4] = w1;
   70|  9.27M|   word borrow = bigint_sub3(z, ws, 4 + 1, p, 4);
   71|  9.27M|   CT::conditional_assign_mem(borrow, z, ws, 4);
   72|  9.27M|   clear_mem(z + 4, 4);
   73|  9.27M|}
_ZN5Botan19bigint_monty_redc_6EPmPKmmS0_:
   75|  84.7k|void bigint_monty_redc_6(word z[12], const word p[6], word p_dash, word ws[]) {
   76|  84.7k|   word w2 = 0, w1 = 0, w0 = 0;
   77|  84.7k|   w0 = z[0];
   78|  84.7k|   ws[0] = w0 * p_dash;
   79|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[0], p[0]);
   80|  84.7k|   w0 = w1;
   81|  84.7k|   w1 = w2;
   82|  84.7k|   w2 = 0;
   83|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[0], p[1]);
   84|  84.7k|   word3_add(&w2, &w1, &w0, z[1]);
   85|  84.7k|   ws[1] = w0 * p_dash;
   86|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[1], p[0]);
   87|  84.7k|   w0 = w1;
   88|  84.7k|   w1 = w2;
   89|  84.7k|   w2 = 0;
   90|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[0], p[2]);
   91|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[1], p[1]);
   92|  84.7k|   word3_add(&w2, &w1, &w0, z[2]);
   93|  84.7k|   ws[2] = w0 * p_dash;
   94|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[2], p[0]);
   95|  84.7k|   w0 = w1;
   96|  84.7k|   w1 = w2;
   97|  84.7k|   w2 = 0;
   98|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[0], p[3]);
   99|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[1], p[2]);
  100|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[2], p[1]);
  101|  84.7k|   word3_add(&w2, &w1, &w0, z[3]);
  102|  84.7k|   ws[3] = w0 * p_dash;
  103|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[3], p[0]);
  104|  84.7k|   w0 = w1;
  105|  84.7k|   w1 = w2;
  106|  84.7k|   w2 = 0;
  107|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[0], p[4]);
  108|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[1], p[3]);
  109|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[2], p[2]);
  110|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[3], p[1]);
  111|  84.7k|   word3_add(&w2, &w1, &w0, z[4]);
  112|  84.7k|   ws[4] = w0 * p_dash;
  113|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[4], p[0]);
  114|  84.7k|   w0 = w1;
  115|  84.7k|   w1 = w2;
  116|  84.7k|   w2 = 0;
  117|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[0], p[5]);
  118|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[1], p[4]);
  119|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[2], p[3]);
  120|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[3], p[2]);
  121|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[4], p[1]);
  122|  84.7k|   word3_add(&w2, &w1, &w0, z[5]);
  123|  84.7k|   ws[5] = w0 * p_dash;
  124|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[5], p[0]);
  125|  84.7k|   w0 = w1;
  126|  84.7k|   w1 = w2;
  127|  84.7k|   w2 = 0;
  128|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[1], p[5]);
  129|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[2], p[4]);
  130|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[3], p[3]);
  131|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[4], p[2]);
  132|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[5], p[1]);
  133|  84.7k|   word3_add(&w2, &w1, &w0, z[6]);
  134|  84.7k|   ws[0] = w0;
  135|  84.7k|   w0 = w1;
  136|  84.7k|   w1 = w2;
  137|  84.7k|   w2 = 0;
  138|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[2], p[5]);
  139|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[3], p[4]);
  140|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[4], p[3]);
  141|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[5], p[2]);
  142|  84.7k|   word3_add(&w2, &w1, &w0, z[7]);
  143|  84.7k|   ws[1] = w0;
  144|  84.7k|   w0 = w1;
  145|  84.7k|   w1 = w2;
  146|  84.7k|   w2 = 0;
  147|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[3], p[5]);
  148|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[4], p[4]);
  149|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[5], p[3]);
  150|  84.7k|   word3_add(&w2, &w1, &w0, z[8]);
  151|  84.7k|   ws[2] = w0;
  152|  84.7k|   w0 = w1;
  153|  84.7k|   w1 = w2;
  154|  84.7k|   w2 = 0;
  155|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[4], p[5]);
  156|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[5], p[4]);
  157|  84.7k|   word3_add(&w2, &w1, &w0, z[9]);
  158|  84.7k|   ws[3] = w0;
  159|  84.7k|   w0 = w1;
  160|  84.7k|   w1 = w2;
  161|  84.7k|   w2 = 0;
  162|  84.7k|   word3_muladd(&w2, &w1, &w0, ws[5], p[5]);
  163|  84.7k|   word3_add(&w2, &w1, &w0, z[10]);
  164|  84.7k|   ws[4] = w0;
  165|  84.7k|   w0 = w1;
  166|  84.7k|   w1 = w2;
  167|  84.7k|   w2 = 0;
  168|  84.7k|   word3_add(&w2, &w1, &w0, z[11]);
  169|  84.7k|   ws[5] = w0;
  170|  84.7k|   ws[6] = w1;
  171|  84.7k|   word borrow = bigint_sub3(z, ws, 6 + 1, p, 6);
  172|  84.7k|   CT::conditional_assign_mem(borrow, z, ws, 6);
  173|  84.7k|   clear_mem(z + 6, 6);
  174|  84.7k|}
_ZN5Botan19bigint_monty_redc_8EPmPKmmS0_:
  176|  34.8k|void bigint_monty_redc_8(word z[16], const word p[8], word p_dash, word ws[]) {
  177|  34.8k|   word w2 = 0, w1 = 0, w0 = 0;
  178|  34.8k|   w0 = z[0];
  179|  34.8k|   ws[0] = w0 * p_dash;
  180|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[0], p[0]);
  181|  34.8k|   w0 = w1;
  182|  34.8k|   w1 = w2;
  183|  34.8k|   w2 = 0;
  184|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[0], p[1]);
  185|  34.8k|   word3_add(&w2, &w1, &w0, z[1]);
  186|  34.8k|   ws[1] = w0 * p_dash;
  187|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[1], p[0]);
  188|  34.8k|   w0 = w1;
  189|  34.8k|   w1 = w2;
  190|  34.8k|   w2 = 0;
  191|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[0], p[2]);
  192|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[1], p[1]);
  193|  34.8k|   word3_add(&w2, &w1, &w0, z[2]);
  194|  34.8k|   ws[2] = w0 * p_dash;
  195|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[2], p[0]);
  196|  34.8k|   w0 = w1;
  197|  34.8k|   w1 = w2;
  198|  34.8k|   w2 = 0;
  199|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[0], p[3]);
  200|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[1], p[2]);
  201|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[2], p[1]);
  202|  34.8k|   word3_add(&w2, &w1, &w0, z[3]);
  203|  34.8k|   ws[3] = w0 * p_dash;
  204|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[3], p[0]);
  205|  34.8k|   w0 = w1;
  206|  34.8k|   w1 = w2;
  207|  34.8k|   w2 = 0;
  208|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[0], p[4]);
  209|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[1], p[3]);
  210|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[2], p[2]);
  211|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[3], p[1]);
  212|  34.8k|   word3_add(&w2, &w1, &w0, z[4]);
  213|  34.8k|   ws[4] = w0 * p_dash;
  214|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[4], p[0]);
  215|  34.8k|   w0 = w1;
  216|  34.8k|   w1 = w2;
  217|  34.8k|   w2 = 0;
  218|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[0], p[5]);
  219|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[1], p[4]);
  220|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[2], p[3]);
  221|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[3], p[2]);
  222|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[4], p[1]);
  223|  34.8k|   word3_add(&w2, &w1, &w0, z[5]);
  224|  34.8k|   ws[5] = w0 * p_dash;
  225|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[5], p[0]);
  226|  34.8k|   w0 = w1;
  227|  34.8k|   w1 = w2;
  228|  34.8k|   w2 = 0;
  229|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[0], p[6]);
  230|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[1], p[5]);
  231|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[2], p[4]);
  232|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[3], p[3]);
  233|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[4], p[2]);
  234|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[5], p[1]);
  235|  34.8k|   word3_add(&w2, &w1, &w0, z[6]);
  236|  34.8k|   ws[6] = w0 * p_dash;
  237|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[6], p[0]);
  238|  34.8k|   w0 = w1;
  239|  34.8k|   w1 = w2;
  240|  34.8k|   w2 = 0;
  241|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[0], p[7]);
  242|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[1], p[6]);
  243|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[2], p[5]);
  244|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[3], p[4]);
  245|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[4], p[3]);
  246|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[5], p[2]);
  247|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[6], p[1]);
  248|  34.8k|   word3_add(&w2, &w1, &w0, z[7]);
  249|  34.8k|   ws[7] = w0 * p_dash;
  250|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[7], p[0]);
  251|  34.8k|   w0 = w1;
  252|  34.8k|   w1 = w2;
  253|  34.8k|   w2 = 0;
  254|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[1], p[7]);
  255|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[2], p[6]);
  256|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[3], p[5]);
  257|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[4], p[4]);
  258|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[5], p[3]);
  259|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[6], p[2]);
  260|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[7], p[1]);
  261|  34.8k|   word3_add(&w2, &w1, &w0, z[8]);
  262|  34.8k|   ws[0] = w0;
  263|  34.8k|   w0 = w1;
  264|  34.8k|   w1 = w2;
  265|  34.8k|   w2 = 0;
  266|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[2], p[7]);
  267|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[3], p[6]);
  268|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[4], p[5]);
  269|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[5], p[4]);
  270|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[6], p[3]);
  271|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[7], p[2]);
  272|  34.8k|   word3_add(&w2, &w1, &w0, z[9]);
  273|  34.8k|   ws[1] = w0;
  274|  34.8k|   w0 = w1;
  275|  34.8k|   w1 = w2;
  276|  34.8k|   w2 = 0;
  277|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[3], p[7]);
  278|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[4], p[6]);
  279|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[5], p[5]);
  280|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[6], p[4]);
  281|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[7], p[3]);
  282|  34.8k|   word3_add(&w2, &w1, &w0, z[10]);
  283|  34.8k|   ws[2] = w0;
  284|  34.8k|   w0 = w1;
  285|  34.8k|   w1 = w2;
  286|  34.8k|   w2 = 0;
  287|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[4], p[7]);
  288|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[5], p[6]);
  289|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[6], p[5]);
  290|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[7], p[4]);
  291|  34.8k|   word3_add(&w2, &w1, &w0, z[11]);
  292|  34.8k|   ws[3] = w0;
  293|  34.8k|   w0 = w1;
  294|  34.8k|   w1 = w2;
  295|  34.8k|   w2 = 0;
  296|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[5], p[7]);
  297|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[6], p[6]);
  298|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[7], p[5]);
  299|  34.8k|   word3_add(&w2, &w1, &w0, z[12]);
  300|  34.8k|   ws[4] = w0;
  301|  34.8k|   w0 = w1;
  302|  34.8k|   w1 = w2;
  303|  34.8k|   w2 = 0;
  304|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[6], p[7]);
  305|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[7], p[6]);
  306|  34.8k|   word3_add(&w2, &w1, &w0, z[13]);
  307|  34.8k|   ws[5] = w0;
  308|  34.8k|   w0 = w1;
  309|  34.8k|   w1 = w2;
  310|  34.8k|   w2 = 0;
  311|  34.8k|   word3_muladd(&w2, &w1, &w0, ws[7], p[7]);
  312|  34.8k|   word3_add(&w2, &w1, &w0, z[14]);
  313|  34.8k|   ws[6] = w0;
  314|  34.8k|   w0 = w1;
  315|  34.8k|   w1 = w2;
  316|  34.8k|   w2 = 0;
  317|  34.8k|   word3_add(&w2, &w1, &w0, z[15]);
  318|  34.8k|   ws[7] = w0;
  319|  34.8k|   ws[8] = w1;
  320|  34.8k|   word borrow = bigint_sub3(z, ws, 8 + 1, p, 8);
  321|  34.8k|   CT::conditional_assign_mem(borrow, z, ws, 8);
  322|  34.8k|   clear_mem(z + 8, 8);
  323|  34.8k|}
_ZN5Botan20bigint_monty_redc_16EPmPKmmS0_:
  325|  1.11k|void bigint_monty_redc_16(word z[32], const word p[16], word p_dash, word ws[]) {
  326|  1.11k|   word w2 = 0, w1 = 0, w0 = 0;
  327|  1.11k|   w0 = z[0];
  328|  1.11k|   ws[0] = w0 * p_dash;
  329|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[0], p[0]);
  330|  1.11k|   w0 = w1;
  331|  1.11k|   w1 = w2;
  332|  1.11k|   w2 = 0;
  333|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[0], p[1]);
  334|  1.11k|   word3_add(&w2, &w1, &w0, z[1]);
  335|  1.11k|   ws[1] = w0 * p_dash;
  336|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[1], p[0]);
  337|  1.11k|   w0 = w1;
  338|  1.11k|   w1 = w2;
  339|  1.11k|   w2 = 0;
  340|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[0], p[2]);
  341|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[1], p[1]);
  342|  1.11k|   word3_add(&w2, &w1, &w0, z[2]);
  343|  1.11k|   ws[2] = w0 * p_dash;
  344|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[2], p[0]);
  345|  1.11k|   w0 = w1;
  346|  1.11k|   w1 = w2;
  347|  1.11k|   w2 = 0;
  348|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[0], p[3]);
  349|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[1], p[2]);
  350|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[2], p[1]);
  351|  1.11k|   word3_add(&w2, &w1, &w0, z[3]);
  352|  1.11k|   ws[3] = w0 * p_dash;
  353|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[3], p[0]);
  354|  1.11k|   w0 = w1;
  355|  1.11k|   w1 = w2;
  356|  1.11k|   w2 = 0;
  357|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[0], p[4]);
  358|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[1], p[3]);
  359|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[2], p[2]);
  360|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[3], p[1]);
  361|  1.11k|   word3_add(&w2, &w1, &w0, z[4]);
  362|  1.11k|   ws[4] = w0 * p_dash;
  363|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[4], p[0]);
  364|  1.11k|   w0 = w1;
  365|  1.11k|   w1 = w2;
  366|  1.11k|   w2 = 0;
  367|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[0], p[5]);
  368|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[1], p[4]);
  369|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[2], p[3]);
  370|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[3], p[2]);
  371|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[4], p[1]);
  372|  1.11k|   word3_add(&w2, &w1, &w0, z[5]);
  373|  1.11k|   ws[5] = w0 * p_dash;
  374|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[5], p[0]);
  375|  1.11k|   w0 = w1;
  376|  1.11k|   w1 = w2;
  377|  1.11k|   w2 = 0;
  378|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[0], p[6]);
  379|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[1], p[5]);
  380|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[2], p[4]);
  381|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[3], p[3]);
  382|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[4], p[2]);
  383|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[5], p[1]);
  384|  1.11k|   word3_add(&w2, &w1, &w0, z[6]);
  385|  1.11k|   ws[6] = w0 * p_dash;
  386|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[6], p[0]);
  387|  1.11k|   w0 = w1;
  388|  1.11k|   w1 = w2;
  389|  1.11k|   w2 = 0;
  390|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[0], p[7]);
  391|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[1], p[6]);
  392|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[2], p[5]);
  393|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[3], p[4]);
  394|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[4], p[3]);
  395|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[5], p[2]);
  396|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[6], p[1]);
  397|  1.11k|   word3_add(&w2, &w1, &w0, z[7]);
  398|  1.11k|   ws[7] = w0 * p_dash;
  399|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[7], p[0]);
  400|  1.11k|   w0 = w1;
  401|  1.11k|   w1 = w2;
  402|  1.11k|   w2 = 0;
  403|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[0], p[8]);
  404|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[1], p[7]);
  405|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[2], p[6]);
  406|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[3], p[5]);
  407|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[4], p[4]);
  408|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[5], p[3]);
  409|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[6], p[2]);
  410|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[7], p[1]);
  411|  1.11k|   word3_add(&w2, &w1, &w0, z[8]);
  412|  1.11k|   ws[8] = w0 * p_dash;
  413|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[8], p[0]);
  414|  1.11k|   w0 = w1;
  415|  1.11k|   w1 = w2;
  416|  1.11k|   w2 = 0;
  417|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[0], p[9]);
  418|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[1], p[8]);
  419|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[2], p[7]);
  420|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[3], p[6]);
  421|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[4], p[5]);
  422|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[5], p[4]);
  423|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[6], p[3]);
  424|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[7], p[2]);
  425|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[8], p[1]);
  426|  1.11k|   word3_add(&w2, &w1, &w0, z[9]);
  427|  1.11k|   ws[9] = w0 * p_dash;
  428|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[9], p[0]);
  429|  1.11k|   w0 = w1;
  430|  1.11k|   w1 = w2;
  431|  1.11k|   w2 = 0;
  432|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[0], p[10]);
  433|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[1], p[9]);
  434|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[2], p[8]);
  435|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[3], p[7]);
  436|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[4], p[6]);
  437|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[5], p[5]);
  438|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[6], p[4]);
  439|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[7], p[3]);
  440|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[8], p[2]);
  441|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[9], p[1]);
  442|  1.11k|   word3_add(&w2, &w1, &w0, z[10]);
  443|  1.11k|   ws[10] = w0 * p_dash;
  444|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[10], p[0]);
  445|  1.11k|   w0 = w1;
  446|  1.11k|   w1 = w2;
  447|  1.11k|   w2 = 0;
  448|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[0], p[11]);
  449|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[1], p[10]);
  450|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[2], p[9]);
  451|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[3], p[8]);
  452|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[4], p[7]);
  453|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[5], p[6]);
  454|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[6], p[5]);
  455|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[7], p[4]);
  456|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[8], p[3]);
  457|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[9], p[2]);
  458|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[10], p[1]);
  459|  1.11k|   word3_add(&w2, &w1, &w0, z[11]);
  460|  1.11k|   ws[11] = w0 * p_dash;
  461|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[11], p[0]);
  462|  1.11k|   w0 = w1;
  463|  1.11k|   w1 = w2;
  464|  1.11k|   w2 = 0;
  465|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[0], p[12]);
  466|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[1], p[11]);
  467|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[2], p[10]);
  468|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[3], p[9]);
  469|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[4], p[8]);
  470|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[5], p[7]);
  471|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[6], p[6]);
  472|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[7], p[5]);
  473|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[8], p[4]);
  474|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[9], p[3]);
  475|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[10], p[2]);
  476|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[11], p[1]);
  477|  1.11k|   word3_add(&w2, &w1, &w0, z[12]);
  478|  1.11k|   ws[12] = w0 * p_dash;
  479|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[12], p[0]);
  480|  1.11k|   w0 = w1;
  481|  1.11k|   w1 = w2;
  482|  1.11k|   w2 = 0;
  483|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[0], p[13]);
  484|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[1], p[12]);
  485|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[2], p[11]);
  486|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[3], p[10]);
  487|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[4], p[9]);
  488|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[5], p[8]);
  489|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[6], p[7]);
  490|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[7], p[6]);
  491|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[8], p[5]);
  492|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[9], p[4]);
  493|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[10], p[3]);
  494|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[11], p[2]);
  495|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[12], p[1]);
  496|  1.11k|   word3_add(&w2, &w1, &w0, z[13]);
  497|  1.11k|   ws[13] = w0 * p_dash;
  498|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[13], p[0]);
  499|  1.11k|   w0 = w1;
  500|  1.11k|   w1 = w2;
  501|  1.11k|   w2 = 0;
  502|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[0], p[14]);
  503|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[1], p[13]);
  504|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[2], p[12]);
  505|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[3], p[11]);
  506|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[4], p[10]);
  507|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[5], p[9]);
  508|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[6], p[8]);
  509|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[7], p[7]);
  510|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[8], p[6]);
  511|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[9], p[5]);
  512|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[10], p[4]);
  513|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[11], p[3]);
  514|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[12], p[2]);
  515|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[13], p[1]);
  516|  1.11k|   word3_add(&w2, &w1, &w0, z[14]);
  517|  1.11k|   ws[14] = w0 * p_dash;
  518|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[14], p[0]);
  519|  1.11k|   w0 = w1;
  520|  1.11k|   w1 = w2;
  521|  1.11k|   w2 = 0;
  522|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[0], p[15]);
  523|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[1], p[14]);
  524|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[2], p[13]);
  525|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[3], p[12]);
  526|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[4], p[11]);
  527|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[5], p[10]);
  528|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[6], p[9]);
  529|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[7], p[8]);
  530|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[8], p[7]);
  531|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[9], p[6]);
  532|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[10], p[5]);
  533|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[11], p[4]);
  534|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[12], p[3]);
  535|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[13], p[2]);
  536|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[14], p[1]);
  537|  1.11k|   word3_add(&w2, &w1, &w0, z[15]);
  538|  1.11k|   ws[15] = w0 * p_dash;
  539|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[15], p[0]);
  540|  1.11k|   w0 = w1;
  541|  1.11k|   w1 = w2;
  542|  1.11k|   w2 = 0;
  543|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[1], p[15]);
  544|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[2], p[14]);
  545|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[3], p[13]);
  546|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[4], p[12]);
  547|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[5], p[11]);
  548|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[6], p[10]);
  549|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[7], p[9]);
  550|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[8], p[8]);
  551|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[9], p[7]);
  552|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[10], p[6]);
  553|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[11], p[5]);
  554|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[12], p[4]);
  555|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[13], p[3]);
  556|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[14], p[2]);
  557|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[15], p[1]);
  558|  1.11k|   word3_add(&w2, &w1, &w0, z[16]);
  559|  1.11k|   ws[0] = w0;
  560|  1.11k|   w0 = w1;
  561|  1.11k|   w1 = w2;
  562|  1.11k|   w2 = 0;
  563|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[2], p[15]);
  564|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[3], p[14]);
  565|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[4], p[13]);
  566|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[5], p[12]);
  567|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[6], p[11]);
  568|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[7], p[10]);
  569|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[8], p[9]);
  570|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[9], p[8]);
  571|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[10], p[7]);
  572|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[11], p[6]);
  573|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[12], p[5]);
  574|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[13], p[4]);
  575|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[14], p[3]);
  576|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[15], p[2]);
  577|  1.11k|   word3_add(&w2, &w1, &w0, z[17]);
  578|  1.11k|   ws[1] = w0;
  579|  1.11k|   w0 = w1;
  580|  1.11k|   w1 = w2;
  581|  1.11k|   w2 = 0;
  582|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[3], p[15]);
  583|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[4], p[14]);
  584|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[5], p[13]);
  585|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[6], p[12]);
  586|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[7], p[11]);
  587|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[8], p[10]);
  588|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[9], p[9]);
  589|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[10], p[8]);
  590|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[11], p[7]);
  591|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[12], p[6]);
  592|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[13], p[5]);
  593|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[14], p[4]);
  594|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[15], p[3]);
  595|  1.11k|   word3_add(&w2, &w1, &w0, z[18]);
  596|  1.11k|   ws[2] = w0;
  597|  1.11k|   w0 = w1;
  598|  1.11k|   w1 = w2;
  599|  1.11k|   w2 = 0;
  600|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[4], p[15]);
  601|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[5], p[14]);
  602|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[6], p[13]);
  603|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[7], p[12]);
  604|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[8], p[11]);
  605|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[9], p[10]);
  606|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[10], p[9]);
  607|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[11], p[8]);
  608|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[12], p[7]);
  609|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[13], p[6]);
  610|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[14], p[5]);
  611|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[15], p[4]);
  612|  1.11k|   word3_add(&w2, &w1, &w0, z[19]);
  613|  1.11k|   ws[3] = w0;
  614|  1.11k|   w0 = w1;
  615|  1.11k|   w1 = w2;
  616|  1.11k|   w2 = 0;
  617|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[5], p[15]);
  618|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[6], p[14]);
  619|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[7], p[13]);
  620|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[8], p[12]);
  621|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[9], p[11]);
  622|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[10], p[10]);
  623|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[11], p[9]);
  624|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[12], p[8]);
  625|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[13], p[7]);
  626|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[14], p[6]);
  627|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[15], p[5]);
  628|  1.11k|   word3_add(&w2, &w1, &w0, z[20]);
  629|  1.11k|   ws[4] = w0;
  630|  1.11k|   w0 = w1;
  631|  1.11k|   w1 = w2;
  632|  1.11k|   w2 = 0;
  633|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[6], p[15]);
  634|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[7], p[14]);
  635|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[8], p[13]);
  636|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[9], p[12]);
  637|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[10], p[11]);
  638|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[11], p[10]);
  639|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[12], p[9]);
  640|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[13], p[8]);
  641|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[14], p[7]);
  642|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[15], p[6]);
  643|  1.11k|   word3_add(&w2, &w1, &w0, z[21]);
  644|  1.11k|   ws[5] = w0;
  645|  1.11k|   w0 = w1;
  646|  1.11k|   w1 = w2;
  647|  1.11k|   w2 = 0;
  648|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[7], p[15]);
  649|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[8], p[14]);
  650|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[9], p[13]);
  651|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[10], p[12]);
  652|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[11], p[11]);
  653|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[12], p[10]);
  654|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[13], p[9]);
  655|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[14], p[8]);
  656|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[15], p[7]);
  657|  1.11k|   word3_add(&w2, &w1, &w0, z[22]);
  658|  1.11k|   ws[6] = w0;
  659|  1.11k|   w0 = w1;
  660|  1.11k|   w1 = w2;
  661|  1.11k|   w2 = 0;
  662|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[8], p[15]);
  663|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[9], p[14]);
  664|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[10], p[13]);
  665|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[11], p[12]);
  666|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[12], p[11]);
  667|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[13], p[10]);
  668|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[14], p[9]);
  669|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[15], p[8]);
  670|  1.11k|   word3_add(&w2, &w1, &w0, z[23]);
  671|  1.11k|   ws[7] = w0;
  672|  1.11k|   w0 = w1;
  673|  1.11k|   w1 = w2;
  674|  1.11k|   w2 = 0;
  675|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[9], p[15]);
  676|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[10], p[14]);
  677|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[11], p[13]);
  678|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[12], p[12]);
  679|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[13], p[11]);
  680|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[14], p[10]);
  681|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[15], p[9]);
  682|  1.11k|   word3_add(&w2, &w1, &w0, z[24]);
  683|  1.11k|   ws[8] = w0;
  684|  1.11k|   w0 = w1;
  685|  1.11k|   w1 = w2;
  686|  1.11k|   w2 = 0;
  687|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[10], p[15]);
  688|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[11], p[14]);
  689|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[12], p[13]);
  690|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[13], p[12]);
  691|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[14], p[11]);
  692|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[15], p[10]);
  693|  1.11k|   word3_add(&w2, &w1, &w0, z[25]);
  694|  1.11k|   ws[9] = w0;
  695|  1.11k|   w0 = w1;
  696|  1.11k|   w1 = w2;
  697|  1.11k|   w2 = 0;
  698|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[11], p[15]);
  699|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[12], p[14]);
  700|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[13], p[13]);
  701|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[14], p[12]);
  702|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[15], p[11]);
  703|  1.11k|   word3_add(&w2, &w1, &w0, z[26]);
  704|  1.11k|   ws[10] = w0;
  705|  1.11k|   w0 = w1;
  706|  1.11k|   w1 = w2;
  707|  1.11k|   w2 = 0;
  708|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[12], p[15]);
  709|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[13], p[14]);
  710|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[14], p[13]);
  711|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[15], p[12]);
  712|  1.11k|   word3_add(&w2, &w1, &w0, z[27]);
  713|  1.11k|   ws[11] = w0;
  714|  1.11k|   w0 = w1;
  715|  1.11k|   w1 = w2;
  716|  1.11k|   w2 = 0;
  717|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[13], p[15]);
  718|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[14], p[14]);
  719|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[15], p[13]);
  720|  1.11k|   word3_add(&w2, &w1, &w0, z[28]);
  721|  1.11k|   ws[12] = w0;
  722|  1.11k|   w0 = w1;
  723|  1.11k|   w1 = w2;
  724|  1.11k|   w2 = 0;
  725|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[14], p[15]);
  726|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[15], p[14]);
  727|  1.11k|   word3_add(&w2, &w1, &w0, z[29]);
  728|  1.11k|   ws[13] = w0;
  729|  1.11k|   w0 = w1;
  730|  1.11k|   w1 = w2;
  731|  1.11k|   w2 = 0;
  732|  1.11k|   word3_muladd(&w2, &w1, &w0, ws[15], p[15]);
  733|  1.11k|   word3_add(&w2, &w1, &w0, z[30]);
  734|  1.11k|   ws[14] = w0;
  735|  1.11k|   w0 = w1;
  736|  1.11k|   w1 = w2;
  737|  1.11k|   w2 = 0;
  738|  1.11k|   word3_add(&w2, &w1, &w0, z[31]);
  739|  1.11k|   ws[15] = w0;
  740|  1.11k|   ws[16] = w1;
  741|  1.11k|   word borrow = bigint_sub3(z, ws, 16 + 1, p, 16);
  742|  1.11k|   CT::conditional_assign_mem(borrow, z, ws, 16);
  743|  1.11k|   clear_mem(z + 16, 16);
  744|  1.11k|}
_ZN5Botan20bigint_monty_redc_24EPmPKmmS0_:
  746|    857|void bigint_monty_redc_24(word z[48], const word p[24], word p_dash, word ws[]) {
  747|    857|   word w2 = 0, w1 = 0, w0 = 0;
  748|    857|   w0 = z[0];
  749|    857|   ws[0] = w0 * p_dash;
  750|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[0]);
  751|    857|   w0 = w1;
  752|    857|   w1 = w2;
  753|    857|   w2 = 0;
  754|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[1]);
  755|    857|   word3_add(&w2, &w1, &w0, z[1]);
  756|    857|   ws[1] = w0 * p_dash;
  757|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[0]);
  758|    857|   w0 = w1;
  759|    857|   w1 = w2;
  760|    857|   w2 = 0;
  761|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[2]);
  762|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[1]);
  763|    857|   word3_add(&w2, &w1, &w0, z[2]);
  764|    857|   ws[2] = w0 * p_dash;
  765|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[0]);
  766|    857|   w0 = w1;
  767|    857|   w1 = w2;
  768|    857|   w2 = 0;
  769|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[3]);
  770|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[2]);
  771|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[1]);
  772|    857|   word3_add(&w2, &w1, &w0, z[3]);
  773|    857|   ws[3] = w0 * p_dash;
  774|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[0]);
  775|    857|   w0 = w1;
  776|    857|   w1 = w2;
  777|    857|   w2 = 0;
  778|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[4]);
  779|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[3]);
  780|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[2]);
  781|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[1]);
  782|    857|   word3_add(&w2, &w1, &w0, z[4]);
  783|    857|   ws[4] = w0 * p_dash;
  784|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[0]);
  785|    857|   w0 = w1;
  786|    857|   w1 = w2;
  787|    857|   w2 = 0;
  788|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[5]);
  789|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[4]);
  790|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[3]);
  791|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[2]);
  792|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[1]);
  793|    857|   word3_add(&w2, &w1, &w0, z[5]);
  794|    857|   ws[5] = w0 * p_dash;
  795|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[0]);
  796|    857|   w0 = w1;
  797|    857|   w1 = w2;
  798|    857|   w2 = 0;
  799|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[6]);
  800|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[5]);
  801|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[4]);
  802|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[3]);
  803|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[2]);
  804|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[1]);
  805|    857|   word3_add(&w2, &w1, &w0, z[6]);
  806|    857|   ws[6] = w0 * p_dash;
  807|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[0]);
  808|    857|   w0 = w1;
  809|    857|   w1 = w2;
  810|    857|   w2 = 0;
  811|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[7]);
  812|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[6]);
  813|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[5]);
  814|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[4]);
  815|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[3]);
  816|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[2]);
  817|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[1]);
  818|    857|   word3_add(&w2, &w1, &w0, z[7]);
  819|    857|   ws[7] = w0 * p_dash;
  820|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[0]);
  821|    857|   w0 = w1;
  822|    857|   w1 = w2;
  823|    857|   w2 = 0;
  824|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[8]);
  825|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[7]);
  826|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[6]);
  827|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[5]);
  828|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[4]);
  829|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[3]);
  830|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[2]);
  831|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[1]);
  832|    857|   word3_add(&w2, &w1, &w0, z[8]);
  833|    857|   ws[8] = w0 * p_dash;
  834|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[0]);
  835|    857|   w0 = w1;
  836|    857|   w1 = w2;
  837|    857|   w2 = 0;
  838|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[9]);
  839|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[8]);
  840|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[7]);
  841|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[6]);
  842|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[5]);
  843|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[4]);
  844|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[3]);
  845|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[2]);
  846|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[1]);
  847|    857|   word3_add(&w2, &w1, &w0, z[9]);
  848|    857|   ws[9] = w0 * p_dash;
  849|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[0]);
  850|    857|   w0 = w1;
  851|    857|   w1 = w2;
  852|    857|   w2 = 0;
  853|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[10]);
  854|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[9]);
  855|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[8]);
  856|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[7]);
  857|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[6]);
  858|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[5]);
  859|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[4]);
  860|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[3]);
  861|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[2]);
  862|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[1]);
  863|    857|   word3_add(&w2, &w1, &w0, z[10]);
  864|    857|   ws[10] = w0 * p_dash;
  865|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[0]);
  866|    857|   w0 = w1;
  867|    857|   w1 = w2;
  868|    857|   w2 = 0;
  869|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[11]);
  870|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[10]);
  871|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[9]);
  872|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[8]);
  873|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[7]);
  874|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[6]);
  875|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[5]);
  876|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[4]);
  877|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[3]);
  878|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[2]);
  879|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[1]);
  880|    857|   word3_add(&w2, &w1, &w0, z[11]);
  881|    857|   ws[11] = w0 * p_dash;
  882|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[0]);
  883|    857|   w0 = w1;
  884|    857|   w1 = w2;
  885|    857|   w2 = 0;
  886|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[12]);
  887|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[11]);
  888|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[10]);
  889|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[9]);
  890|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[8]);
  891|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[7]);
  892|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[6]);
  893|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[5]);
  894|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[4]);
  895|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[3]);
  896|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[2]);
  897|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[1]);
  898|    857|   word3_add(&w2, &w1, &w0, z[12]);
  899|    857|   ws[12] = w0 * p_dash;
  900|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[0]);
  901|    857|   w0 = w1;
  902|    857|   w1 = w2;
  903|    857|   w2 = 0;
  904|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[13]);
  905|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[12]);
  906|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[11]);
  907|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[10]);
  908|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[9]);
  909|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[8]);
  910|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[7]);
  911|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[6]);
  912|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[5]);
  913|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[4]);
  914|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[3]);
  915|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[2]);
  916|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[1]);
  917|    857|   word3_add(&w2, &w1, &w0, z[13]);
  918|    857|   ws[13] = w0 * p_dash;
  919|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[0]);
  920|    857|   w0 = w1;
  921|    857|   w1 = w2;
  922|    857|   w2 = 0;
  923|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[14]);
  924|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[13]);
  925|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[12]);
  926|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[11]);
  927|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[10]);
  928|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[9]);
  929|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[8]);
  930|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[7]);
  931|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[6]);
  932|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[5]);
  933|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[4]);
  934|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[3]);
  935|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[2]);
  936|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[1]);
  937|    857|   word3_add(&w2, &w1, &w0, z[14]);
  938|    857|   ws[14] = w0 * p_dash;
  939|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[0]);
  940|    857|   w0 = w1;
  941|    857|   w1 = w2;
  942|    857|   w2 = 0;
  943|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[15]);
  944|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[14]);
  945|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[13]);
  946|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[12]);
  947|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[11]);
  948|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[10]);
  949|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[9]);
  950|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[8]);
  951|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[7]);
  952|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[6]);
  953|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[5]);
  954|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[4]);
  955|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[3]);
  956|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[2]);
  957|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[1]);
  958|    857|   word3_add(&w2, &w1, &w0, z[15]);
  959|    857|   ws[15] = w0 * p_dash;
  960|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[0]);
  961|    857|   w0 = w1;
  962|    857|   w1 = w2;
  963|    857|   w2 = 0;
  964|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[16]);
  965|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[15]);
  966|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[14]);
  967|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[13]);
  968|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[12]);
  969|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[11]);
  970|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[10]);
  971|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[9]);
  972|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[8]);
  973|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[7]);
  974|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[6]);
  975|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[5]);
  976|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[4]);
  977|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[3]);
  978|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[2]);
  979|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[1]);
  980|    857|   word3_add(&w2, &w1, &w0, z[16]);
  981|    857|   ws[16] = w0 * p_dash;
  982|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[0]);
  983|    857|   w0 = w1;
  984|    857|   w1 = w2;
  985|    857|   w2 = 0;
  986|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[17]);
  987|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[16]);
  988|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[15]);
  989|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[14]);
  990|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[13]);
  991|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[12]);
  992|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[11]);
  993|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[10]);
  994|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[9]);
  995|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[8]);
  996|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[7]);
  997|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[6]);
  998|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[5]);
  999|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[4]);
 1000|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[3]);
 1001|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[2]);
 1002|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[1]);
 1003|    857|   word3_add(&w2, &w1, &w0, z[17]);
 1004|    857|   ws[17] = w0 * p_dash;
 1005|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[0]);
 1006|    857|   w0 = w1;
 1007|    857|   w1 = w2;
 1008|    857|   w2 = 0;
 1009|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[18]);
 1010|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[17]);
 1011|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[16]);
 1012|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[15]);
 1013|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[14]);
 1014|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[13]);
 1015|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[12]);
 1016|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[11]);
 1017|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[10]);
 1018|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[9]);
 1019|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[8]);
 1020|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[7]);
 1021|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[6]);
 1022|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[5]);
 1023|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[4]);
 1024|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[3]);
 1025|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[2]);
 1026|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[1]);
 1027|    857|   word3_add(&w2, &w1, &w0, z[18]);
 1028|    857|   ws[18] = w0 * p_dash;
 1029|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[0]);
 1030|    857|   w0 = w1;
 1031|    857|   w1 = w2;
 1032|    857|   w2 = 0;
 1033|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[19]);
 1034|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[18]);
 1035|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[17]);
 1036|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[16]);
 1037|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[15]);
 1038|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[14]);
 1039|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[13]);
 1040|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[12]);
 1041|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[11]);
 1042|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[10]);
 1043|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[9]);
 1044|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[8]);
 1045|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[7]);
 1046|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[6]);
 1047|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[5]);
 1048|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[4]);
 1049|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[3]);
 1050|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[2]);
 1051|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[1]);
 1052|    857|   word3_add(&w2, &w1, &w0, z[19]);
 1053|    857|   ws[19] = w0 * p_dash;
 1054|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[0]);
 1055|    857|   w0 = w1;
 1056|    857|   w1 = w2;
 1057|    857|   w2 = 0;
 1058|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[20]);
 1059|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[19]);
 1060|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[18]);
 1061|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[17]);
 1062|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[16]);
 1063|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[15]);
 1064|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[14]);
 1065|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[13]);
 1066|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[12]);
 1067|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[11]);
 1068|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[10]);
 1069|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[9]);
 1070|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[8]);
 1071|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[7]);
 1072|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[6]);
 1073|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[5]);
 1074|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[4]);
 1075|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[3]);
 1076|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[2]);
 1077|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[1]);
 1078|    857|   word3_add(&w2, &w1, &w0, z[20]);
 1079|    857|   ws[20] = w0 * p_dash;
 1080|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[0]);
 1081|    857|   w0 = w1;
 1082|    857|   w1 = w2;
 1083|    857|   w2 = 0;
 1084|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[21]);
 1085|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[20]);
 1086|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[19]);
 1087|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[18]);
 1088|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[17]);
 1089|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[16]);
 1090|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[15]);
 1091|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[14]);
 1092|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[13]);
 1093|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[12]);
 1094|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[11]);
 1095|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[10]);
 1096|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[9]);
 1097|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[8]);
 1098|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[7]);
 1099|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[6]);
 1100|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[5]);
 1101|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[4]);
 1102|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[3]);
 1103|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[2]);
 1104|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[1]);
 1105|    857|   word3_add(&w2, &w1, &w0, z[21]);
 1106|    857|   ws[21] = w0 * p_dash;
 1107|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[0]);
 1108|    857|   w0 = w1;
 1109|    857|   w1 = w2;
 1110|    857|   w2 = 0;
 1111|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[22]);
 1112|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[21]);
 1113|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[20]);
 1114|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[19]);
 1115|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[18]);
 1116|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[17]);
 1117|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[16]);
 1118|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[15]);
 1119|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[14]);
 1120|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[13]);
 1121|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[12]);
 1122|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[11]);
 1123|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[10]);
 1124|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[9]);
 1125|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[8]);
 1126|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[7]);
 1127|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[6]);
 1128|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[5]);
 1129|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[4]);
 1130|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[3]);
 1131|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[2]);
 1132|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[1]);
 1133|    857|   word3_add(&w2, &w1, &w0, z[22]);
 1134|    857|   ws[22] = w0 * p_dash;
 1135|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[0]);
 1136|    857|   w0 = w1;
 1137|    857|   w1 = w2;
 1138|    857|   w2 = 0;
 1139|    857|   word3_muladd(&w2, &w1, &w0, ws[0], p[23]);
 1140|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[22]);
 1141|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[21]);
 1142|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[20]);
 1143|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[19]);
 1144|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[18]);
 1145|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[17]);
 1146|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[16]);
 1147|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[15]);
 1148|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[14]);
 1149|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[13]);
 1150|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[12]);
 1151|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[11]);
 1152|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[10]);
 1153|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[9]);
 1154|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[8]);
 1155|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[7]);
 1156|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[6]);
 1157|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[5]);
 1158|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[4]);
 1159|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[3]);
 1160|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[2]);
 1161|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[1]);
 1162|    857|   word3_add(&w2, &w1, &w0, z[23]);
 1163|    857|   ws[23] = w0 * p_dash;
 1164|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[0]);
 1165|    857|   w0 = w1;
 1166|    857|   w1 = w2;
 1167|    857|   w2 = 0;
 1168|    857|   word3_muladd(&w2, &w1, &w0, ws[1], p[23]);
 1169|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[22]);
 1170|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[21]);
 1171|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[20]);
 1172|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[19]);
 1173|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[18]);
 1174|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[17]);
 1175|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[16]);
 1176|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[15]);
 1177|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[14]);
 1178|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[13]);
 1179|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[12]);
 1180|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[11]);
 1181|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[10]);
 1182|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[9]);
 1183|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[8]);
 1184|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[7]);
 1185|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[6]);
 1186|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[5]);
 1187|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[4]);
 1188|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[3]);
 1189|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[2]);
 1190|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[1]);
 1191|    857|   word3_add(&w2, &w1, &w0, z[24]);
 1192|    857|   ws[0] = w0;
 1193|    857|   w0 = w1;
 1194|    857|   w1 = w2;
 1195|    857|   w2 = 0;
 1196|    857|   word3_muladd(&w2, &w1, &w0, ws[2], p[23]);
 1197|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[22]);
 1198|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[21]);
 1199|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[20]);
 1200|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[19]);
 1201|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[18]);
 1202|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[17]);
 1203|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[16]);
 1204|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[15]);
 1205|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[14]);
 1206|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[13]);
 1207|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[12]);
 1208|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[11]);
 1209|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[10]);
 1210|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[9]);
 1211|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[8]);
 1212|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[7]);
 1213|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[6]);
 1214|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[5]);
 1215|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[4]);
 1216|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[3]);
 1217|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[2]);
 1218|    857|   word3_add(&w2, &w1, &w0, z[25]);
 1219|    857|   ws[1] = w0;
 1220|    857|   w0 = w1;
 1221|    857|   w1 = w2;
 1222|    857|   w2 = 0;
 1223|    857|   word3_muladd(&w2, &w1, &w0, ws[3], p[23]);
 1224|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[22]);
 1225|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[21]);
 1226|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[20]);
 1227|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[19]);
 1228|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[18]);
 1229|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[17]);
 1230|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[16]);
 1231|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[15]);
 1232|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[14]);
 1233|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[13]);
 1234|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[12]);
 1235|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[11]);
 1236|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[10]);
 1237|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[9]);
 1238|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[8]);
 1239|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[7]);
 1240|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[6]);
 1241|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[5]);
 1242|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[4]);
 1243|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[3]);
 1244|    857|   word3_add(&w2, &w1, &w0, z[26]);
 1245|    857|   ws[2] = w0;
 1246|    857|   w0 = w1;
 1247|    857|   w1 = w2;
 1248|    857|   w2 = 0;
 1249|    857|   word3_muladd(&w2, &w1, &w0, ws[4], p[23]);
 1250|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[22]);
 1251|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[21]);
 1252|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[20]);
 1253|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[19]);
 1254|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[18]);
 1255|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[17]);
 1256|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[16]);
 1257|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[15]);
 1258|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[14]);
 1259|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[13]);
 1260|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[12]);
 1261|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[11]);
 1262|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[10]);
 1263|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[9]);
 1264|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[8]);
 1265|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[7]);
 1266|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[6]);
 1267|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[5]);
 1268|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[4]);
 1269|    857|   word3_add(&w2, &w1, &w0, z[27]);
 1270|    857|   ws[3] = w0;
 1271|    857|   w0 = w1;
 1272|    857|   w1 = w2;
 1273|    857|   w2 = 0;
 1274|    857|   word3_muladd(&w2, &w1, &w0, ws[5], p[23]);
 1275|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[22]);
 1276|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[21]);
 1277|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[20]);
 1278|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[19]);
 1279|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[18]);
 1280|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[17]);
 1281|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[16]);
 1282|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[15]);
 1283|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[14]);
 1284|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[13]);
 1285|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[12]);
 1286|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[11]);
 1287|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[10]);
 1288|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[9]);
 1289|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[8]);
 1290|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[7]);
 1291|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[6]);
 1292|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[5]);
 1293|    857|   word3_add(&w2, &w1, &w0, z[28]);
 1294|    857|   ws[4] = w0;
 1295|    857|   w0 = w1;
 1296|    857|   w1 = w2;
 1297|    857|   w2 = 0;
 1298|    857|   word3_muladd(&w2, &w1, &w0, ws[6], p[23]);
 1299|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[22]);
 1300|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[21]);
 1301|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[20]);
 1302|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[19]);
 1303|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[18]);
 1304|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[17]);
 1305|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[16]);
 1306|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[15]);
 1307|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[14]);
 1308|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[13]);
 1309|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[12]);
 1310|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[11]);
 1311|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[10]);
 1312|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[9]);
 1313|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[8]);
 1314|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[7]);
 1315|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[6]);
 1316|    857|   word3_add(&w2, &w1, &w0, z[29]);
 1317|    857|   ws[5] = w0;
 1318|    857|   w0 = w1;
 1319|    857|   w1 = w2;
 1320|    857|   w2 = 0;
 1321|    857|   word3_muladd(&w2, &w1, &w0, ws[7], p[23]);
 1322|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[22]);
 1323|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[21]);
 1324|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[20]);
 1325|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[19]);
 1326|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[18]);
 1327|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[17]);
 1328|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[16]);
 1329|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[15]);
 1330|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[14]);
 1331|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[13]);
 1332|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[12]);
 1333|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[11]);
 1334|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[10]);
 1335|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[9]);
 1336|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[8]);
 1337|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[7]);
 1338|    857|   word3_add(&w2, &w1, &w0, z[30]);
 1339|    857|   ws[6] = w0;
 1340|    857|   w0 = w1;
 1341|    857|   w1 = w2;
 1342|    857|   w2 = 0;
 1343|    857|   word3_muladd(&w2, &w1, &w0, ws[8], p[23]);
 1344|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[22]);
 1345|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[21]);
 1346|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[20]);
 1347|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[19]);
 1348|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[18]);
 1349|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[17]);
 1350|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[16]);
 1351|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[15]);
 1352|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[14]);
 1353|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[13]);
 1354|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[12]);
 1355|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[11]);
 1356|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[10]);
 1357|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[9]);
 1358|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[8]);
 1359|    857|   word3_add(&w2, &w1, &w0, z[31]);
 1360|    857|   ws[7] = w0;
 1361|    857|   w0 = w1;
 1362|    857|   w1 = w2;
 1363|    857|   w2 = 0;
 1364|    857|   word3_muladd(&w2, &w1, &w0, ws[9], p[23]);
 1365|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[22]);
 1366|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[21]);
 1367|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[20]);
 1368|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[19]);
 1369|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[18]);
 1370|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[17]);
 1371|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[16]);
 1372|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[15]);
 1373|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[14]);
 1374|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[13]);
 1375|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[12]);
 1376|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[11]);
 1377|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[10]);
 1378|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[9]);
 1379|    857|   word3_add(&w2, &w1, &w0, z[32]);
 1380|    857|   ws[8] = w0;
 1381|    857|   w0 = w1;
 1382|    857|   w1 = w2;
 1383|    857|   w2 = 0;
 1384|    857|   word3_muladd(&w2, &w1, &w0, ws[10], p[23]);
 1385|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[22]);
 1386|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[21]);
 1387|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[20]);
 1388|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[19]);
 1389|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[18]);
 1390|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[17]);
 1391|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[16]);
 1392|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[15]);
 1393|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[14]);
 1394|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[13]);
 1395|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[12]);
 1396|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[11]);
 1397|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[10]);
 1398|    857|   word3_add(&w2, &w1, &w0, z[33]);
 1399|    857|   ws[9] = w0;
 1400|    857|   w0 = w1;
 1401|    857|   w1 = w2;
 1402|    857|   w2 = 0;
 1403|    857|   word3_muladd(&w2, &w1, &w0, ws[11], p[23]);
 1404|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[22]);
 1405|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[21]);
 1406|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[20]);
 1407|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[19]);
 1408|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[18]);
 1409|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[17]);
 1410|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[16]);
 1411|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[15]);
 1412|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[14]);
 1413|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[13]);
 1414|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[12]);
 1415|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[11]);
 1416|    857|   word3_add(&w2, &w1, &w0, z[34]);
 1417|    857|   ws[10] = w0;
 1418|    857|   w0 = w1;
 1419|    857|   w1 = w2;
 1420|    857|   w2 = 0;
 1421|    857|   word3_muladd(&w2, &w1, &w0, ws[12], p[23]);
 1422|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[22]);
 1423|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[21]);
 1424|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[20]);
 1425|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[19]);
 1426|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[18]);
 1427|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[17]);
 1428|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[16]);
 1429|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[15]);
 1430|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[14]);
 1431|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[13]);
 1432|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[12]);
 1433|    857|   word3_add(&w2, &w1, &w0, z[35]);
 1434|    857|   ws[11] = w0;
 1435|    857|   w0 = w1;
 1436|    857|   w1 = w2;
 1437|    857|   w2 = 0;
 1438|    857|   word3_muladd(&w2, &w1, &w0, ws[13], p[23]);
 1439|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[22]);
 1440|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[21]);
 1441|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[20]);
 1442|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[19]);
 1443|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[18]);
 1444|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[17]);
 1445|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[16]);
 1446|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[15]);
 1447|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[14]);
 1448|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[13]);
 1449|    857|   word3_add(&w2, &w1, &w0, z[36]);
 1450|    857|   ws[12] = w0;
 1451|    857|   w0 = w1;
 1452|    857|   w1 = w2;
 1453|    857|   w2 = 0;
 1454|    857|   word3_muladd(&w2, &w1, &w0, ws[14], p[23]);
 1455|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[22]);
 1456|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[21]);
 1457|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[20]);
 1458|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[19]);
 1459|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[18]);
 1460|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[17]);
 1461|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[16]);
 1462|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[15]);
 1463|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[14]);
 1464|    857|   word3_add(&w2, &w1, &w0, z[37]);
 1465|    857|   ws[13] = w0;
 1466|    857|   w0 = w1;
 1467|    857|   w1 = w2;
 1468|    857|   w2 = 0;
 1469|    857|   word3_muladd(&w2, &w1, &w0, ws[15], p[23]);
 1470|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[22]);
 1471|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[21]);
 1472|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[20]);
 1473|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[19]);
 1474|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[18]);
 1475|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[17]);
 1476|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[16]);
 1477|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[15]);
 1478|    857|   word3_add(&w2, &w1, &w0, z[38]);
 1479|    857|   ws[14] = w0;
 1480|    857|   w0 = w1;
 1481|    857|   w1 = w2;
 1482|    857|   w2 = 0;
 1483|    857|   word3_muladd(&w2, &w1, &w0, ws[16], p[23]);
 1484|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[22]);
 1485|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[21]);
 1486|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[20]);
 1487|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[19]);
 1488|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[18]);
 1489|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[17]);
 1490|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[16]);
 1491|    857|   word3_add(&w2, &w1, &w0, z[39]);
 1492|    857|   ws[15] = w0;
 1493|    857|   w0 = w1;
 1494|    857|   w1 = w2;
 1495|    857|   w2 = 0;
 1496|    857|   word3_muladd(&w2, &w1, &w0, ws[17], p[23]);
 1497|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[22]);
 1498|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[21]);
 1499|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[20]);
 1500|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[19]);
 1501|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[18]);
 1502|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[17]);
 1503|    857|   word3_add(&w2, &w1, &w0, z[40]);
 1504|    857|   ws[16] = w0;
 1505|    857|   w0 = w1;
 1506|    857|   w1 = w2;
 1507|    857|   w2 = 0;
 1508|    857|   word3_muladd(&w2, &w1, &w0, ws[18], p[23]);
 1509|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[22]);
 1510|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[21]);
 1511|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[20]);
 1512|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[19]);
 1513|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[18]);
 1514|    857|   word3_add(&w2, &w1, &w0, z[41]);
 1515|    857|   ws[17] = w0;
 1516|    857|   w0 = w1;
 1517|    857|   w1 = w2;
 1518|    857|   w2 = 0;
 1519|    857|   word3_muladd(&w2, &w1, &w0, ws[19], p[23]);
 1520|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[22]);
 1521|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[21]);
 1522|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[20]);
 1523|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[19]);
 1524|    857|   word3_add(&w2, &w1, &w0, z[42]);
 1525|    857|   ws[18] = w0;
 1526|    857|   w0 = w1;
 1527|    857|   w1 = w2;
 1528|    857|   w2 = 0;
 1529|    857|   word3_muladd(&w2, &w1, &w0, ws[20], p[23]);
 1530|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[22]);
 1531|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[21]);
 1532|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[20]);
 1533|    857|   word3_add(&w2, &w1, &w0, z[43]);
 1534|    857|   ws[19] = w0;
 1535|    857|   w0 = w1;
 1536|    857|   w1 = w2;
 1537|    857|   w2 = 0;
 1538|    857|   word3_muladd(&w2, &w1, &w0, ws[21], p[23]);
 1539|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[22]);
 1540|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[21]);
 1541|    857|   word3_add(&w2, &w1, &w0, z[44]);
 1542|    857|   ws[20] = w0;
 1543|    857|   w0 = w1;
 1544|    857|   w1 = w2;
 1545|    857|   w2 = 0;
 1546|    857|   word3_muladd(&w2, &w1, &w0, ws[22], p[23]);
 1547|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[22]);
 1548|    857|   word3_add(&w2, &w1, &w0, z[45]);
 1549|    857|   ws[21] = w0;
 1550|    857|   w0 = w1;
 1551|    857|   w1 = w2;
 1552|    857|   w2 = 0;
 1553|    857|   word3_muladd(&w2, &w1, &w0, ws[23], p[23]);
 1554|    857|   word3_add(&w2, &w1, &w0, z[46]);
 1555|    857|   ws[22] = w0;
 1556|    857|   w0 = w1;
 1557|    857|   w1 = w2;
 1558|    857|   w2 = 0;
 1559|    857|   word3_add(&w2, &w1, &w0, z[47]);
 1560|    857|   ws[23] = w0;
 1561|    857|   ws[24] = w1;
 1562|    857|   word borrow = bigint_sub3(z, ws, 24 + 1, p, 24);
 1563|    857|   CT::conditional_assign_mem(borrow, z, ws, 24);
 1564|    857|   clear_mem(z + 24, 24);
 1565|    857|}
_ZN5Botan20bigint_monty_redc_32EPmPKmmS0_:
 1567|  2.79k|void bigint_monty_redc_32(word z[64], const word p[32], word p_dash, word ws[]) {
 1568|  2.79k|   word w2 = 0, w1 = 0, w0 = 0;
 1569|  2.79k|   w0 = z[0];
 1570|  2.79k|   ws[0] = w0 * p_dash;
 1571|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[0]);
 1572|  2.79k|   w0 = w1;
 1573|  2.79k|   w1 = w2;
 1574|  2.79k|   w2 = 0;
 1575|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[1]);
 1576|  2.79k|   word3_add(&w2, &w1, &w0, z[1]);
 1577|  2.79k|   ws[1] = w0 * p_dash;
 1578|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[0]);
 1579|  2.79k|   w0 = w1;
 1580|  2.79k|   w1 = w2;
 1581|  2.79k|   w2 = 0;
 1582|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[2]);
 1583|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[1]);
 1584|  2.79k|   word3_add(&w2, &w1, &w0, z[2]);
 1585|  2.79k|   ws[2] = w0 * p_dash;
 1586|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[0]);
 1587|  2.79k|   w0 = w1;
 1588|  2.79k|   w1 = w2;
 1589|  2.79k|   w2 = 0;
 1590|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[3]);
 1591|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[2]);
 1592|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[1]);
 1593|  2.79k|   word3_add(&w2, &w1, &w0, z[3]);
 1594|  2.79k|   ws[3] = w0 * p_dash;
 1595|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[0]);
 1596|  2.79k|   w0 = w1;
 1597|  2.79k|   w1 = w2;
 1598|  2.79k|   w2 = 0;
 1599|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[4]);
 1600|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[3]);
 1601|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[2]);
 1602|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[1]);
 1603|  2.79k|   word3_add(&w2, &w1, &w0, z[4]);
 1604|  2.79k|   ws[4] = w0 * p_dash;
 1605|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[0]);
 1606|  2.79k|   w0 = w1;
 1607|  2.79k|   w1 = w2;
 1608|  2.79k|   w2 = 0;
 1609|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[5]);
 1610|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[4]);
 1611|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[3]);
 1612|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[2]);
 1613|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[1]);
 1614|  2.79k|   word3_add(&w2, &w1, &w0, z[5]);
 1615|  2.79k|   ws[5] = w0 * p_dash;
 1616|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[0]);
 1617|  2.79k|   w0 = w1;
 1618|  2.79k|   w1 = w2;
 1619|  2.79k|   w2 = 0;
 1620|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[6]);
 1621|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[5]);
 1622|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[4]);
 1623|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[3]);
 1624|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[2]);
 1625|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[1]);
 1626|  2.79k|   word3_add(&w2, &w1, &w0, z[6]);
 1627|  2.79k|   ws[6] = w0 * p_dash;
 1628|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[0]);
 1629|  2.79k|   w0 = w1;
 1630|  2.79k|   w1 = w2;
 1631|  2.79k|   w2 = 0;
 1632|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[7]);
 1633|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[6]);
 1634|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[5]);
 1635|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[4]);
 1636|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[3]);
 1637|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[2]);
 1638|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[1]);
 1639|  2.79k|   word3_add(&w2, &w1, &w0, z[7]);
 1640|  2.79k|   ws[7] = w0 * p_dash;
 1641|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[0]);
 1642|  2.79k|   w0 = w1;
 1643|  2.79k|   w1 = w2;
 1644|  2.79k|   w2 = 0;
 1645|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[8]);
 1646|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[7]);
 1647|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[6]);
 1648|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[5]);
 1649|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[4]);
 1650|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[3]);
 1651|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[2]);
 1652|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[1]);
 1653|  2.79k|   word3_add(&w2, &w1, &w0, z[8]);
 1654|  2.79k|   ws[8] = w0 * p_dash;
 1655|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[0]);
 1656|  2.79k|   w0 = w1;
 1657|  2.79k|   w1 = w2;
 1658|  2.79k|   w2 = 0;
 1659|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[9]);
 1660|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[8]);
 1661|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[7]);
 1662|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[6]);
 1663|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[5]);
 1664|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[4]);
 1665|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[3]);
 1666|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[2]);
 1667|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[1]);
 1668|  2.79k|   word3_add(&w2, &w1, &w0, z[9]);
 1669|  2.79k|   ws[9] = w0 * p_dash;
 1670|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[0]);
 1671|  2.79k|   w0 = w1;
 1672|  2.79k|   w1 = w2;
 1673|  2.79k|   w2 = 0;
 1674|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[10]);
 1675|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[9]);
 1676|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[8]);
 1677|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[7]);
 1678|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[6]);
 1679|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[5]);
 1680|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[4]);
 1681|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[3]);
 1682|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[2]);
 1683|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[1]);
 1684|  2.79k|   word3_add(&w2, &w1, &w0, z[10]);
 1685|  2.79k|   ws[10] = w0 * p_dash;
 1686|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[0]);
 1687|  2.79k|   w0 = w1;
 1688|  2.79k|   w1 = w2;
 1689|  2.79k|   w2 = 0;
 1690|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[11]);
 1691|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[10]);
 1692|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[9]);
 1693|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[8]);
 1694|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[7]);
 1695|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[6]);
 1696|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[5]);
 1697|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[4]);
 1698|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[3]);
 1699|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[2]);
 1700|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[1]);
 1701|  2.79k|   word3_add(&w2, &w1, &w0, z[11]);
 1702|  2.79k|   ws[11] = w0 * p_dash;
 1703|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[0]);
 1704|  2.79k|   w0 = w1;
 1705|  2.79k|   w1 = w2;
 1706|  2.79k|   w2 = 0;
 1707|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[12]);
 1708|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[11]);
 1709|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[10]);
 1710|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[9]);
 1711|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[8]);
 1712|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[7]);
 1713|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[6]);
 1714|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[5]);
 1715|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[4]);
 1716|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[3]);
 1717|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[2]);
 1718|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[1]);
 1719|  2.79k|   word3_add(&w2, &w1, &w0, z[12]);
 1720|  2.79k|   ws[12] = w0 * p_dash;
 1721|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[0]);
 1722|  2.79k|   w0 = w1;
 1723|  2.79k|   w1 = w2;
 1724|  2.79k|   w2 = 0;
 1725|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[13]);
 1726|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[12]);
 1727|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[11]);
 1728|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[10]);
 1729|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[9]);
 1730|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[8]);
 1731|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[7]);
 1732|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[6]);
 1733|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[5]);
 1734|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[4]);
 1735|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[3]);
 1736|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[2]);
 1737|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[1]);
 1738|  2.79k|   word3_add(&w2, &w1, &w0, z[13]);
 1739|  2.79k|   ws[13] = w0 * p_dash;
 1740|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[0]);
 1741|  2.79k|   w0 = w1;
 1742|  2.79k|   w1 = w2;
 1743|  2.79k|   w2 = 0;
 1744|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[14]);
 1745|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[13]);
 1746|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[12]);
 1747|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[11]);
 1748|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[10]);
 1749|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[9]);
 1750|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[8]);
 1751|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[7]);
 1752|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[6]);
 1753|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[5]);
 1754|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[4]);
 1755|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[3]);
 1756|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[2]);
 1757|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[1]);
 1758|  2.79k|   word3_add(&w2, &w1, &w0, z[14]);
 1759|  2.79k|   ws[14] = w0 * p_dash;
 1760|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[0]);
 1761|  2.79k|   w0 = w1;
 1762|  2.79k|   w1 = w2;
 1763|  2.79k|   w2 = 0;
 1764|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[15]);
 1765|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[14]);
 1766|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[13]);
 1767|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[12]);
 1768|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[11]);
 1769|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[10]);
 1770|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[9]);
 1771|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[8]);
 1772|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[7]);
 1773|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[6]);
 1774|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[5]);
 1775|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[4]);
 1776|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[3]);
 1777|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[2]);
 1778|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[1]);
 1779|  2.79k|   word3_add(&w2, &w1, &w0, z[15]);
 1780|  2.79k|   ws[15] = w0 * p_dash;
 1781|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[0]);
 1782|  2.79k|   w0 = w1;
 1783|  2.79k|   w1 = w2;
 1784|  2.79k|   w2 = 0;
 1785|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[16]);
 1786|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[15]);
 1787|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[14]);
 1788|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[13]);
 1789|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[12]);
 1790|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[11]);
 1791|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[10]);
 1792|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[9]);
 1793|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[8]);
 1794|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[7]);
 1795|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[6]);
 1796|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[5]);
 1797|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[4]);
 1798|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[3]);
 1799|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[2]);
 1800|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[1]);
 1801|  2.79k|   word3_add(&w2, &w1, &w0, z[16]);
 1802|  2.79k|   ws[16] = w0 * p_dash;
 1803|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[0]);
 1804|  2.79k|   w0 = w1;
 1805|  2.79k|   w1 = w2;
 1806|  2.79k|   w2 = 0;
 1807|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[17]);
 1808|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[16]);
 1809|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[15]);
 1810|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[14]);
 1811|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[13]);
 1812|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[12]);
 1813|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[11]);
 1814|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[10]);
 1815|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[9]);
 1816|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[8]);
 1817|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[7]);
 1818|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[6]);
 1819|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[5]);
 1820|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[4]);
 1821|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[3]);
 1822|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[2]);
 1823|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[1]);
 1824|  2.79k|   word3_add(&w2, &w1, &w0, z[17]);
 1825|  2.79k|   ws[17] = w0 * p_dash;
 1826|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[0]);
 1827|  2.79k|   w0 = w1;
 1828|  2.79k|   w1 = w2;
 1829|  2.79k|   w2 = 0;
 1830|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[18]);
 1831|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[17]);
 1832|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[16]);
 1833|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[15]);
 1834|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[14]);
 1835|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[13]);
 1836|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[12]);
 1837|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[11]);
 1838|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[10]);
 1839|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[9]);
 1840|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[8]);
 1841|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[7]);
 1842|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[6]);
 1843|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[5]);
 1844|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[4]);
 1845|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[3]);
 1846|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[2]);
 1847|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[1]);
 1848|  2.79k|   word3_add(&w2, &w1, &w0, z[18]);
 1849|  2.79k|   ws[18] = w0 * p_dash;
 1850|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[0]);
 1851|  2.79k|   w0 = w1;
 1852|  2.79k|   w1 = w2;
 1853|  2.79k|   w2 = 0;
 1854|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[19]);
 1855|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[18]);
 1856|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[17]);
 1857|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[16]);
 1858|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[15]);
 1859|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[14]);
 1860|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[13]);
 1861|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[12]);
 1862|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[11]);
 1863|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[10]);
 1864|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[9]);
 1865|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[8]);
 1866|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[7]);
 1867|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[6]);
 1868|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[5]);
 1869|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[4]);
 1870|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[3]);
 1871|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[2]);
 1872|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[1]);
 1873|  2.79k|   word3_add(&w2, &w1, &w0, z[19]);
 1874|  2.79k|   ws[19] = w0 * p_dash;
 1875|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[0]);
 1876|  2.79k|   w0 = w1;
 1877|  2.79k|   w1 = w2;
 1878|  2.79k|   w2 = 0;
 1879|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[20]);
 1880|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[19]);
 1881|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[18]);
 1882|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[17]);
 1883|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[16]);
 1884|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[15]);
 1885|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[14]);
 1886|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[13]);
 1887|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[12]);
 1888|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[11]);
 1889|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[10]);
 1890|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[9]);
 1891|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[8]);
 1892|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[7]);
 1893|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[6]);
 1894|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[5]);
 1895|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[4]);
 1896|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[3]);
 1897|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[2]);
 1898|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[1]);
 1899|  2.79k|   word3_add(&w2, &w1, &w0, z[20]);
 1900|  2.79k|   ws[20] = w0 * p_dash;
 1901|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[0]);
 1902|  2.79k|   w0 = w1;
 1903|  2.79k|   w1 = w2;
 1904|  2.79k|   w2 = 0;
 1905|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[21]);
 1906|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[20]);
 1907|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[19]);
 1908|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[18]);
 1909|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[17]);
 1910|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[16]);
 1911|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[15]);
 1912|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[14]);
 1913|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[13]);
 1914|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[12]);
 1915|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[11]);
 1916|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[10]);
 1917|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[9]);
 1918|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[8]);
 1919|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[7]);
 1920|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[6]);
 1921|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[5]);
 1922|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[4]);
 1923|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[3]);
 1924|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[2]);
 1925|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[1]);
 1926|  2.79k|   word3_add(&w2, &w1, &w0, z[21]);
 1927|  2.79k|   ws[21] = w0 * p_dash;
 1928|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[0]);
 1929|  2.79k|   w0 = w1;
 1930|  2.79k|   w1 = w2;
 1931|  2.79k|   w2 = 0;
 1932|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[22]);
 1933|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[21]);
 1934|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[20]);
 1935|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[19]);
 1936|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[18]);
 1937|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[17]);
 1938|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[16]);
 1939|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[15]);
 1940|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[14]);
 1941|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[13]);
 1942|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[12]);
 1943|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[11]);
 1944|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[10]);
 1945|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[9]);
 1946|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[8]);
 1947|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[7]);
 1948|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[6]);
 1949|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[5]);
 1950|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[4]);
 1951|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[3]);
 1952|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[2]);
 1953|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[1]);
 1954|  2.79k|   word3_add(&w2, &w1, &w0, z[22]);
 1955|  2.79k|   ws[22] = w0 * p_dash;
 1956|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[0]);
 1957|  2.79k|   w0 = w1;
 1958|  2.79k|   w1 = w2;
 1959|  2.79k|   w2 = 0;
 1960|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[23]);
 1961|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[22]);
 1962|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[21]);
 1963|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[20]);
 1964|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[19]);
 1965|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[18]);
 1966|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[17]);
 1967|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[16]);
 1968|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[15]);
 1969|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[14]);
 1970|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[13]);
 1971|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[12]);
 1972|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[11]);
 1973|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[10]);
 1974|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[9]);
 1975|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[8]);
 1976|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[7]);
 1977|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[6]);
 1978|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[5]);
 1979|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[4]);
 1980|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[3]);
 1981|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[2]);
 1982|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[1]);
 1983|  2.79k|   word3_add(&w2, &w1, &w0, z[23]);
 1984|  2.79k|   ws[23] = w0 * p_dash;
 1985|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[0]);
 1986|  2.79k|   w0 = w1;
 1987|  2.79k|   w1 = w2;
 1988|  2.79k|   w2 = 0;
 1989|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[24]);
 1990|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[23]);
 1991|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[22]);
 1992|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[21]);
 1993|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[20]);
 1994|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[19]);
 1995|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[18]);
 1996|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[17]);
 1997|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[16]);
 1998|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[15]);
 1999|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[14]);
 2000|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[13]);
 2001|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[12]);
 2002|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[11]);
 2003|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[10]);
 2004|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[9]);
 2005|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[8]);
 2006|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[7]);
 2007|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[6]);
 2008|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[5]);
 2009|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[4]);
 2010|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[3]);
 2011|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[2]);
 2012|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[1]);
 2013|  2.79k|   word3_add(&w2, &w1, &w0, z[24]);
 2014|  2.79k|   ws[24] = w0 * p_dash;
 2015|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[0]);
 2016|  2.79k|   w0 = w1;
 2017|  2.79k|   w1 = w2;
 2018|  2.79k|   w2 = 0;
 2019|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[25]);
 2020|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[24]);
 2021|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[23]);
 2022|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[22]);
 2023|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[21]);
 2024|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[20]);
 2025|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[19]);
 2026|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[18]);
 2027|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[17]);
 2028|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[16]);
 2029|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[15]);
 2030|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[14]);
 2031|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[13]);
 2032|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[12]);
 2033|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[11]);
 2034|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[10]);
 2035|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[9]);
 2036|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[8]);
 2037|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[7]);
 2038|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[6]);
 2039|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[5]);
 2040|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[4]);
 2041|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[3]);
 2042|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[2]);
 2043|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[1]);
 2044|  2.79k|   word3_add(&w2, &w1, &w0, z[25]);
 2045|  2.79k|   ws[25] = w0 * p_dash;
 2046|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[0]);
 2047|  2.79k|   w0 = w1;
 2048|  2.79k|   w1 = w2;
 2049|  2.79k|   w2 = 0;
 2050|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[26]);
 2051|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[25]);
 2052|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[24]);
 2053|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[23]);
 2054|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[22]);
 2055|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[21]);
 2056|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[20]);
 2057|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[19]);
 2058|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[18]);
 2059|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[17]);
 2060|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[16]);
 2061|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[15]);
 2062|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[14]);
 2063|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[13]);
 2064|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[12]);
 2065|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[11]);
 2066|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[10]);
 2067|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[9]);
 2068|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[8]);
 2069|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[7]);
 2070|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[6]);
 2071|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[5]);
 2072|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[4]);
 2073|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[3]);
 2074|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[2]);
 2075|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[1]);
 2076|  2.79k|   word3_add(&w2, &w1, &w0, z[26]);
 2077|  2.79k|   ws[26] = w0 * p_dash;
 2078|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[0]);
 2079|  2.79k|   w0 = w1;
 2080|  2.79k|   w1 = w2;
 2081|  2.79k|   w2 = 0;
 2082|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[27]);
 2083|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[26]);
 2084|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[25]);
 2085|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[24]);
 2086|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[23]);
 2087|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[22]);
 2088|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[21]);
 2089|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[20]);
 2090|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[19]);
 2091|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[18]);
 2092|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[17]);
 2093|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[16]);
 2094|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[15]);
 2095|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[14]);
 2096|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[13]);
 2097|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[12]);
 2098|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[11]);
 2099|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[10]);
 2100|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[9]);
 2101|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[8]);
 2102|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[7]);
 2103|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[6]);
 2104|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[5]);
 2105|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[4]);
 2106|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[3]);
 2107|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[2]);
 2108|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[1]);
 2109|  2.79k|   word3_add(&w2, &w1, &w0, z[27]);
 2110|  2.79k|   ws[27] = w0 * p_dash;
 2111|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[0]);
 2112|  2.79k|   w0 = w1;
 2113|  2.79k|   w1 = w2;
 2114|  2.79k|   w2 = 0;
 2115|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[28]);
 2116|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[27]);
 2117|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[26]);
 2118|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[25]);
 2119|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[24]);
 2120|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[23]);
 2121|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[22]);
 2122|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[21]);
 2123|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[20]);
 2124|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[19]);
 2125|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[18]);
 2126|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[17]);
 2127|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[16]);
 2128|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[15]);
 2129|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[14]);
 2130|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[13]);
 2131|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[12]);
 2132|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[11]);
 2133|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[10]);
 2134|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[9]);
 2135|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[8]);
 2136|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[7]);
 2137|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[6]);
 2138|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[5]);
 2139|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[4]);
 2140|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[3]);
 2141|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[2]);
 2142|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[1]);
 2143|  2.79k|   word3_add(&w2, &w1, &w0, z[28]);
 2144|  2.79k|   ws[28] = w0 * p_dash;
 2145|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[0]);
 2146|  2.79k|   w0 = w1;
 2147|  2.79k|   w1 = w2;
 2148|  2.79k|   w2 = 0;
 2149|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[29]);
 2150|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[28]);
 2151|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[27]);
 2152|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[26]);
 2153|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[25]);
 2154|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[24]);
 2155|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[23]);
 2156|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[22]);
 2157|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[21]);
 2158|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[20]);
 2159|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[19]);
 2160|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[18]);
 2161|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[17]);
 2162|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[16]);
 2163|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[15]);
 2164|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[14]);
 2165|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[13]);
 2166|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[12]);
 2167|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[11]);
 2168|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[10]);
 2169|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[9]);
 2170|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[8]);
 2171|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[7]);
 2172|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[6]);
 2173|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[5]);
 2174|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[4]);
 2175|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[3]);
 2176|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[2]);
 2177|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[1]);
 2178|  2.79k|   word3_add(&w2, &w1, &w0, z[29]);
 2179|  2.79k|   ws[29] = w0 * p_dash;
 2180|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[0]);
 2181|  2.79k|   w0 = w1;
 2182|  2.79k|   w1 = w2;
 2183|  2.79k|   w2 = 0;
 2184|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[30]);
 2185|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[29]);
 2186|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[28]);
 2187|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[27]);
 2188|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[26]);
 2189|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[25]);
 2190|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[24]);
 2191|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[23]);
 2192|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[22]);
 2193|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[21]);
 2194|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[20]);
 2195|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[19]);
 2196|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[18]);
 2197|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[17]);
 2198|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[16]);
 2199|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[15]);
 2200|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[14]);
 2201|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[13]);
 2202|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[12]);
 2203|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[11]);
 2204|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[10]);
 2205|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[9]);
 2206|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[8]);
 2207|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[7]);
 2208|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[6]);
 2209|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[5]);
 2210|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[4]);
 2211|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[3]);
 2212|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[2]);
 2213|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[1]);
 2214|  2.79k|   word3_add(&w2, &w1, &w0, z[30]);
 2215|  2.79k|   ws[30] = w0 * p_dash;
 2216|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[0]);
 2217|  2.79k|   w0 = w1;
 2218|  2.79k|   w1 = w2;
 2219|  2.79k|   w2 = 0;
 2220|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[0], p[31]);
 2221|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[30]);
 2222|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[29]);
 2223|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[28]);
 2224|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[27]);
 2225|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[26]);
 2226|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[25]);
 2227|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[24]);
 2228|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[23]);
 2229|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[22]);
 2230|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[21]);
 2231|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[20]);
 2232|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[19]);
 2233|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[18]);
 2234|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[17]);
 2235|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[16]);
 2236|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[15]);
 2237|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[14]);
 2238|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[13]);
 2239|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[12]);
 2240|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[11]);
 2241|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[10]);
 2242|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[9]);
 2243|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[8]);
 2244|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[7]);
 2245|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[6]);
 2246|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[5]);
 2247|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[4]);
 2248|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[3]);
 2249|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[2]);
 2250|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[1]);
 2251|  2.79k|   word3_add(&w2, &w1, &w0, z[31]);
 2252|  2.79k|   ws[31] = w0 * p_dash;
 2253|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[0]);
 2254|  2.79k|   w0 = w1;
 2255|  2.79k|   w1 = w2;
 2256|  2.79k|   w2 = 0;
 2257|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[1], p[31]);
 2258|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[30]);
 2259|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[29]);
 2260|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[28]);
 2261|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[27]);
 2262|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[26]);
 2263|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[25]);
 2264|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[24]);
 2265|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[23]);
 2266|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[22]);
 2267|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[21]);
 2268|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[20]);
 2269|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[19]);
 2270|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[18]);
 2271|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[17]);
 2272|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[16]);
 2273|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[15]);
 2274|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[14]);
 2275|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[13]);
 2276|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[12]);
 2277|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[11]);
 2278|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[10]);
 2279|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[9]);
 2280|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[8]);
 2281|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[7]);
 2282|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[6]);
 2283|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[5]);
 2284|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[4]);
 2285|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[3]);
 2286|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[2]);
 2287|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[1]);
 2288|  2.79k|   word3_add(&w2, &w1, &w0, z[32]);
 2289|  2.79k|   ws[0] = w0;
 2290|  2.79k|   w0 = w1;
 2291|  2.79k|   w1 = w2;
 2292|  2.79k|   w2 = 0;
 2293|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[2], p[31]);
 2294|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[30]);
 2295|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[29]);
 2296|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[28]);
 2297|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[27]);
 2298|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[26]);
 2299|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[25]);
 2300|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[24]);
 2301|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[23]);
 2302|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[22]);
 2303|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[21]);
 2304|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[20]);
 2305|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[19]);
 2306|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[18]);
 2307|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[17]);
 2308|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[16]);
 2309|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[15]);
 2310|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[14]);
 2311|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[13]);
 2312|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[12]);
 2313|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[11]);
 2314|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[10]);
 2315|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[9]);
 2316|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[8]);
 2317|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[7]);
 2318|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[6]);
 2319|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[5]);
 2320|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[4]);
 2321|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[3]);
 2322|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[2]);
 2323|  2.79k|   word3_add(&w2, &w1, &w0, z[33]);
 2324|  2.79k|   ws[1] = w0;
 2325|  2.79k|   w0 = w1;
 2326|  2.79k|   w1 = w2;
 2327|  2.79k|   w2 = 0;
 2328|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[3], p[31]);
 2329|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[30]);
 2330|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[29]);
 2331|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[28]);
 2332|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[27]);
 2333|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[26]);
 2334|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[25]);
 2335|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[24]);
 2336|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[23]);
 2337|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[22]);
 2338|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[21]);
 2339|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[20]);
 2340|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[19]);
 2341|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[18]);
 2342|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[17]);
 2343|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[16]);
 2344|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[15]);
 2345|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[14]);
 2346|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[13]);
 2347|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[12]);
 2348|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[11]);
 2349|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[10]);
 2350|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[9]);
 2351|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[8]);
 2352|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[7]);
 2353|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[6]);
 2354|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[5]);
 2355|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[4]);
 2356|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[3]);
 2357|  2.79k|   word3_add(&w2, &w1, &w0, z[34]);
 2358|  2.79k|   ws[2] = w0;
 2359|  2.79k|   w0 = w1;
 2360|  2.79k|   w1 = w2;
 2361|  2.79k|   w2 = 0;
 2362|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[4], p[31]);
 2363|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[30]);
 2364|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[29]);
 2365|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[28]);
 2366|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[27]);
 2367|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[26]);
 2368|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[25]);
 2369|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[24]);
 2370|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[23]);
 2371|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[22]);
 2372|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[21]);
 2373|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[20]);
 2374|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[19]);
 2375|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[18]);
 2376|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[17]);
 2377|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[16]);
 2378|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[15]);
 2379|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[14]);
 2380|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[13]);
 2381|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[12]);
 2382|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[11]);
 2383|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[10]);
 2384|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[9]);
 2385|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[8]);
 2386|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[7]);
 2387|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[6]);
 2388|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[5]);
 2389|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[4]);
 2390|  2.79k|   word3_add(&w2, &w1, &w0, z[35]);
 2391|  2.79k|   ws[3] = w0;
 2392|  2.79k|   w0 = w1;
 2393|  2.79k|   w1 = w2;
 2394|  2.79k|   w2 = 0;
 2395|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[5], p[31]);
 2396|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[30]);
 2397|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[29]);
 2398|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[28]);
 2399|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[27]);
 2400|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[26]);
 2401|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[25]);
 2402|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[24]);
 2403|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[23]);
 2404|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[22]);
 2405|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[21]);
 2406|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[20]);
 2407|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[19]);
 2408|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[18]);
 2409|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[17]);
 2410|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[16]);
 2411|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[15]);
 2412|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[14]);
 2413|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[13]);
 2414|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[12]);
 2415|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[11]);
 2416|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[10]);
 2417|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[9]);
 2418|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[8]);
 2419|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[7]);
 2420|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[6]);
 2421|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[5]);
 2422|  2.79k|   word3_add(&w2, &w1, &w0, z[36]);
 2423|  2.79k|   ws[4] = w0;
 2424|  2.79k|   w0 = w1;
 2425|  2.79k|   w1 = w2;
 2426|  2.79k|   w2 = 0;
 2427|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[6], p[31]);
 2428|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[30]);
 2429|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[29]);
 2430|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[28]);
 2431|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[27]);
 2432|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[26]);
 2433|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[25]);
 2434|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[24]);
 2435|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[23]);
 2436|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[22]);
 2437|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[21]);
 2438|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[20]);
 2439|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[19]);
 2440|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[18]);
 2441|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[17]);
 2442|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[16]);
 2443|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[15]);
 2444|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[14]);
 2445|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[13]);
 2446|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[12]);
 2447|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[11]);
 2448|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[10]);
 2449|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[9]);
 2450|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[8]);
 2451|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[7]);
 2452|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[6]);
 2453|  2.79k|   word3_add(&w2, &w1, &w0, z[37]);
 2454|  2.79k|   ws[5] = w0;
 2455|  2.79k|   w0 = w1;
 2456|  2.79k|   w1 = w2;
 2457|  2.79k|   w2 = 0;
 2458|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[7], p[31]);
 2459|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[30]);
 2460|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[29]);
 2461|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[28]);
 2462|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[27]);
 2463|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[26]);
 2464|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[25]);
 2465|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[24]);
 2466|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[23]);
 2467|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[22]);
 2468|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[21]);
 2469|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[20]);
 2470|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[19]);
 2471|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[18]);
 2472|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[17]);
 2473|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[16]);
 2474|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[15]);
 2475|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[14]);
 2476|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[13]);
 2477|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[12]);
 2478|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[11]);
 2479|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[10]);
 2480|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[9]);
 2481|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[8]);
 2482|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[7]);
 2483|  2.79k|   word3_add(&w2, &w1, &w0, z[38]);
 2484|  2.79k|   ws[6] = w0;
 2485|  2.79k|   w0 = w1;
 2486|  2.79k|   w1 = w2;
 2487|  2.79k|   w2 = 0;
 2488|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[8], p[31]);
 2489|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[30]);
 2490|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[29]);
 2491|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[28]);
 2492|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[27]);
 2493|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[26]);
 2494|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[25]);
 2495|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[24]);
 2496|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[23]);
 2497|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[22]);
 2498|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[21]);
 2499|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[20]);
 2500|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[19]);
 2501|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[18]);
 2502|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[17]);
 2503|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[16]);
 2504|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[15]);
 2505|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[14]);
 2506|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[13]);
 2507|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[12]);
 2508|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[11]);
 2509|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[10]);
 2510|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[9]);
 2511|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[8]);
 2512|  2.79k|   word3_add(&w2, &w1, &w0, z[39]);
 2513|  2.79k|   ws[7] = w0;
 2514|  2.79k|   w0 = w1;
 2515|  2.79k|   w1 = w2;
 2516|  2.79k|   w2 = 0;
 2517|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[9], p[31]);
 2518|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[30]);
 2519|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[29]);
 2520|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[28]);
 2521|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[27]);
 2522|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[26]);
 2523|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[25]);
 2524|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[24]);
 2525|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[23]);
 2526|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[22]);
 2527|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[21]);
 2528|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[20]);
 2529|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[19]);
 2530|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[18]);
 2531|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[17]);
 2532|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[16]);
 2533|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[15]);
 2534|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[14]);
 2535|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[13]);
 2536|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[12]);
 2537|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[11]);
 2538|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[10]);
 2539|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[9]);
 2540|  2.79k|   word3_add(&w2, &w1, &w0, z[40]);
 2541|  2.79k|   ws[8] = w0;
 2542|  2.79k|   w0 = w1;
 2543|  2.79k|   w1 = w2;
 2544|  2.79k|   w2 = 0;
 2545|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[10], p[31]);
 2546|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[30]);
 2547|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[29]);
 2548|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[28]);
 2549|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[27]);
 2550|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[26]);
 2551|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[25]);
 2552|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[24]);
 2553|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[23]);
 2554|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[22]);
 2555|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[21]);
 2556|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[20]);
 2557|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[19]);
 2558|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[18]);
 2559|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[17]);
 2560|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[16]);
 2561|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[15]);
 2562|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[14]);
 2563|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[13]);
 2564|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[12]);
 2565|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[11]);
 2566|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[10]);
 2567|  2.79k|   word3_add(&w2, &w1, &w0, z[41]);
 2568|  2.79k|   ws[9] = w0;
 2569|  2.79k|   w0 = w1;
 2570|  2.79k|   w1 = w2;
 2571|  2.79k|   w2 = 0;
 2572|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[11], p[31]);
 2573|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[30]);
 2574|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[29]);
 2575|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[28]);
 2576|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[27]);
 2577|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[26]);
 2578|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[25]);
 2579|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[24]);
 2580|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[23]);
 2581|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[22]);
 2582|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[21]);
 2583|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[20]);
 2584|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[19]);
 2585|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[18]);
 2586|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[17]);
 2587|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[16]);
 2588|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[15]);
 2589|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[14]);
 2590|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[13]);
 2591|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[12]);
 2592|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[11]);
 2593|  2.79k|   word3_add(&w2, &w1, &w0, z[42]);
 2594|  2.79k|   ws[10] = w0;
 2595|  2.79k|   w0 = w1;
 2596|  2.79k|   w1 = w2;
 2597|  2.79k|   w2 = 0;
 2598|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[12], p[31]);
 2599|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[30]);
 2600|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[29]);
 2601|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[28]);
 2602|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[27]);
 2603|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[26]);
 2604|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[25]);
 2605|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[24]);
 2606|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[23]);
 2607|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[22]);
 2608|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[21]);
 2609|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[20]);
 2610|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[19]);
 2611|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[18]);
 2612|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[17]);
 2613|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[16]);
 2614|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[15]);
 2615|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[14]);
 2616|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[13]);
 2617|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[12]);
 2618|  2.79k|   word3_add(&w2, &w1, &w0, z[43]);
 2619|  2.79k|   ws[11] = w0;
 2620|  2.79k|   w0 = w1;
 2621|  2.79k|   w1 = w2;
 2622|  2.79k|   w2 = 0;
 2623|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[13], p[31]);
 2624|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[30]);
 2625|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[29]);
 2626|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[28]);
 2627|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[27]);
 2628|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[26]);
 2629|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[25]);
 2630|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[24]);
 2631|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[23]);
 2632|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[22]);
 2633|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[21]);
 2634|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[20]);
 2635|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[19]);
 2636|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[18]);
 2637|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[17]);
 2638|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[16]);
 2639|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[15]);
 2640|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[14]);
 2641|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[13]);
 2642|  2.79k|   word3_add(&w2, &w1, &w0, z[44]);
 2643|  2.79k|   ws[12] = w0;
 2644|  2.79k|   w0 = w1;
 2645|  2.79k|   w1 = w2;
 2646|  2.79k|   w2 = 0;
 2647|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[14], p[31]);
 2648|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[30]);
 2649|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[29]);
 2650|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[28]);
 2651|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[27]);
 2652|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[26]);
 2653|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[25]);
 2654|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[24]);
 2655|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[23]);
 2656|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[22]);
 2657|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[21]);
 2658|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[20]);
 2659|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[19]);
 2660|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[18]);
 2661|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[17]);
 2662|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[16]);
 2663|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[15]);
 2664|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[14]);
 2665|  2.79k|   word3_add(&w2, &w1, &w0, z[45]);
 2666|  2.79k|   ws[13] = w0;
 2667|  2.79k|   w0 = w1;
 2668|  2.79k|   w1 = w2;
 2669|  2.79k|   w2 = 0;
 2670|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[15], p[31]);
 2671|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[30]);
 2672|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[29]);
 2673|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[28]);
 2674|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[27]);
 2675|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[26]);
 2676|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[25]);
 2677|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[24]);
 2678|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[23]);
 2679|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[22]);
 2680|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[21]);
 2681|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[20]);
 2682|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[19]);
 2683|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[18]);
 2684|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[17]);
 2685|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[16]);
 2686|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[15]);
 2687|  2.79k|   word3_add(&w2, &w1, &w0, z[46]);
 2688|  2.79k|   ws[14] = w0;
 2689|  2.79k|   w0 = w1;
 2690|  2.79k|   w1 = w2;
 2691|  2.79k|   w2 = 0;
 2692|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[16], p[31]);
 2693|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[30]);
 2694|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[29]);
 2695|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[28]);
 2696|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[27]);
 2697|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[26]);
 2698|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[25]);
 2699|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[24]);
 2700|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[23]);
 2701|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[22]);
 2702|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[21]);
 2703|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[20]);
 2704|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[19]);
 2705|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[18]);
 2706|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[17]);
 2707|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[16]);
 2708|  2.79k|   word3_add(&w2, &w1, &w0, z[47]);
 2709|  2.79k|   ws[15] = w0;
 2710|  2.79k|   w0 = w1;
 2711|  2.79k|   w1 = w2;
 2712|  2.79k|   w2 = 0;
 2713|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[17], p[31]);
 2714|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[30]);
 2715|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[29]);
 2716|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[28]);
 2717|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[27]);
 2718|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[26]);
 2719|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[25]);
 2720|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[24]);
 2721|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[23]);
 2722|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[22]);
 2723|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[21]);
 2724|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[20]);
 2725|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[19]);
 2726|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[18]);
 2727|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[17]);
 2728|  2.79k|   word3_add(&w2, &w1, &w0, z[48]);
 2729|  2.79k|   ws[16] = w0;
 2730|  2.79k|   w0 = w1;
 2731|  2.79k|   w1 = w2;
 2732|  2.79k|   w2 = 0;
 2733|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[18], p[31]);
 2734|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[30]);
 2735|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[29]);
 2736|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[28]);
 2737|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[27]);
 2738|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[26]);
 2739|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[25]);
 2740|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[24]);
 2741|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[23]);
 2742|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[22]);
 2743|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[21]);
 2744|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[20]);
 2745|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[19]);
 2746|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[18]);
 2747|  2.79k|   word3_add(&w2, &w1, &w0, z[49]);
 2748|  2.79k|   ws[17] = w0;
 2749|  2.79k|   w0 = w1;
 2750|  2.79k|   w1 = w2;
 2751|  2.79k|   w2 = 0;
 2752|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[19], p[31]);
 2753|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[30]);
 2754|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[29]);
 2755|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[28]);
 2756|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[27]);
 2757|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[26]);
 2758|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[25]);
 2759|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[24]);
 2760|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[23]);
 2761|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[22]);
 2762|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[21]);
 2763|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[20]);
 2764|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[19]);
 2765|  2.79k|   word3_add(&w2, &w1, &w0, z[50]);
 2766|  2.79k|   ws[18] = w0;
 2767|  2.79k|   w0 = w1;
 2768|  2.79k|   w1 = w2;
 2769|  2.79k|   w2 = 0;
 2770|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[20], p[31]);
 2771|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[30]);
 2772|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[29]);
 2773|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[28]);
 2774|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[27]);
 2775|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[26]);
 2776|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[25]);
 2777|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[24]);
 2778|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[23]);
 2779|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[22]);
 2780|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[21]);
 2781|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[20]);
 2782|  2.79k|   word3_add(&w2, &w1, &w0, z[51]);
 2783|  2.79k|   ws[19] = w0;
 2784|  2.79k|   w0 = w1;
 2785|  2.79k|   w1 = w2;
 2786|  2.79k|   w2 = 0;
 2787|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[21], p[31]);
 2788|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[30]);
 2789|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[29]);
 2790|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[28]);
 2791|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[27]);
 2792|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[26]);
 2793|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[25]);
 2794|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[24]);
 2795|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[23]);
 2796|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[22]);
 2797|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[21]);
 2798|  2.79k|   word3_add(&w2, &w1, &w0, z[52]);
 2799|  2.79k|   ws[20] = w0;
 2800|  2.79k|   w0 = w1;
 2801|  2.79k|   w1 = w2;
 2802|  2.79k|   w2 = 0;
 2803|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[22], p[31]);
 2804|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[30]);
 2805|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[29]);
 2806|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[28]);
 2807|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[27]);
 2808|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[26]);
 2809|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[25]);
 2810|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[24]);
 2811|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[23]);
 2812|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[22]);
 2813|  2.79k|   word3_add(&w2, &w1, &w0, z[53]);
 2814|  2.79k|   ws[21] = w0;
 2815|  2.79k|   w0 = w1;
 2816|  2.79k|   w1 = w2;
 2817|  2.79k|   w2 = 0;
 2818|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[23], p[31]);
 2819|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[30]);
 2820|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[29]);
 2821|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[28]);
 2822|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[27]);
 2823|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[26]);
 2824|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[25]);
 2825|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[24]);
 2826|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[23]);
 2827|  2.79k|   word3_add(&w2, &w1, &w0, z[54]);
 2828|  2.79k|   ws[22] = w0;
 2829|  2.79k|   w0 = w1;
 2830|  2.79k|   w1 = w2;
 2831|  2.79k|   w2 = 0;
 2832|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[24], p[31]);
 2833|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[30]);
 2834|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[29]);
 2835|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[28]);
 2836|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[27]);
 2837|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[26]);
 2838|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[25]);
 2839|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[24]);
 2840|  2.79k|   word3_add(&w2, &w1, &w0, z[55]);
 2841|  2.79k|   ws[23] = w0;
 2842|  2.79k|   w0 = w1;
 2843|  2.79k|   w1 = w2;
 2844|  2.79k|   w2 = 0;
 2845|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[25], p[31]);
 2846|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[30]);
 2847|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[29]);
 2848|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[28]);
 2849|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[27]);
 2850|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[26]);
 2851|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[25]);
 2852|  2.79k|   word3_add(&w2, &w1, &w0, z[56]);
 2853|  2.79k|   ws[24] = w0;
 2854|  2.79k|   w0 = w1;
 2855|  2.79k|   w1 = w2;
 2856|  2.79k|   w2 = 0;
 2857|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[26], p[31]);
 2858|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[30]);
 2859|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[29]);
 2860|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[28]);
 2861|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[27]);
 2862|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[26]);
 2863|  2.79k|   word3_add(&w2, &w1, &w0, z[57]);
 2864|  2.79k|   ws[25] = w0;
 2865|  2.79k|   w0 = w1;
 2866|  2.79k|   w1 = w2;
 2867|  2.79k|   w2 = 0;
 2868|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[27], p[31]);
 2869|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[30]);
 2870|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[29]);
 2871|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[28]);
 2872|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[27]);
 2873|  2.79k|   word3_add(&w2, &w1, &w0, z[58]);
 2874|  2.79k|   ws[26] = w0;
 2875|  2.79k|   w0 = w1;
 2876|  2.79k|   w1 = w2;
 2877|  2.79k|   w2 = 0;
 2878|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[28], p[31]);
 2879|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[30]);
 2880|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[29]);
 2881|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[28]);
 2882|  2.79k|   word3_add(&w2, &w1, &w0, z[59]);
 2883|  2.79k|   ws[27] = w0;
 2884|  2.79k|   w0 = w1;
 2885|  2.79k|   w1 = w2;
 2886|  2.79k|   w2 = 0;
 2887|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[29], p[31]);
 2888|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[30]);
 2889|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[29]);
 2890|  2.79k|   word3_add(&w2, &w1, &w0, z[60]);
 2891|  2.79k|   ws[28] = w0;
 2892|  2.79k|   w0 = w1;
 2893|  2.79k|   w1 = w2;
 2894|  2.79k|   w2 = 0;
 2895|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[30], p[31]);
 2896|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[30]);
 2897|  2.79k|   word3_add(&w2, &w1, &w0, z[61]);
 2898|  2.79k|   ws[29] = w0;
 2899|  2.79k|   w0 = w1;
 2900|  2.79k|   w1 = w2;
 2901|  2.79k|   w2 = 0;
 2902|  2.79k|   word3_muladd(&w2, &w1, &w0, ws[31], p[31]);
 2903|  2.79k|   word3_add(&w2, &w1, &w0, z[62]);
 2904|  2.79k|   ws[30] = w0;
 2905|  2.79k|   w0 = w1;
 2906|  2.79k|   w1 = w2;
 2907|  2.79k|   w2 = 0;
 2908|  2.79k|   word3_add(&w2, &w1, &w0, z[63]);
 2909|  2.79k|   ws[31] = w0;
 2910|  2.79k|   ws[32] = w1;
 2911|  2.79k|   word borrow = bigint_sub3(z, ws, 32 + 1, p, 32);
 2912|  2.79k|   CT::conditional_assign_mem(borrow, z, ws, 32);
 2913|  2.79k|   clear_mem(z + 32, 32);
 2914|  2.79k|}

_ZN5Botan11inverse_modERKNS_6BigIntES2_:
  178|  1.29k|BigInt inverse_mod(const BigInt& n, const BigInt& mod) {
  179|  1.29k|   if(mod.is_zero()) {
  ------------------
  |  Branch (179:7): [True: 0, False: 1.29k]
  ------------------
  180|      0|      throw Invalid_Argument("inverse_mod modulus cannot be zero");
  181|      0|   }
  182|  1.29k|   if(mod.is_negative() || n.is_negative()) {
  ------------------
  |  Branch (182:7): [True: 0, False: 1.29k]
  |  Branch (182:28): [True: 0, False: 1.29k]
  ------------------
  183|      0|      throw Invalid_Argument("inverse_mod: arguments must be non-negative");
  184|      0|   }
  185|  1.29k|   if(n.is_zero() || (n.is_even() && mod.is_even())) {
  ------------------
  |  Branch (185:7): [True: 0, False: 1.29k]
  |  Branch (185:23): [True: 565, False: 725]
  |  Branch (185:38): [True: 0, False: 565]
  ------------------
  186|      0|      return BigInt::zero();
  187|      0|   }
  188|       |
  189|  1.29k|   if(mod.is_odd()) {
  ------------------
  |  Branch (189:7): [True: 1.29k, False: 0]
  ------------------
  190|       |      /*
  191|       |      Fastpath for common case. This leaks if n is greater than mod or
  192|       |      not, but we don't guarantee const time behavior in that case.
  193|       |      */
  194|  1.29k|      if(n < mod) {
  ------------------
  |  Branch (194:10): [True: 1.29k, False: 0]
  ------------------
  195|  1.29k|         return inverse_mod_odd_modulus(n, mod);
  196|  1.29k|      } else {
  197|      0|         return inverse_mod_odd_modulus(ct_modulo(n, mod), mod);
  198|      0|      }
  199|  1.29k|   }
  200|       |
  201|       |   // If n is even and mod is even we already returned 0
  202|       |   // If n is even and mod is odd we jumped directly to odd-modulus algo
  203|      0|   BOTAN_DEBUG_ASSERT(n.is_odd());
  ------------------
  |  |   99|      0|      do {                          \
  |  |  100|      0|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  204|       |
  205|      0|   const size_t mod_lz = low_zero_bits(mod);
  206|      0|   BOTAN_ASSERT_NOMSG(mod_lz > 0);
  ------------------
  |  |   60|      0|   do {                                                                     \
  |  |   61|      0|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 0]
  |  |  ------------------
  |  |   62|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  207|      0|   const size_t mod_bits = mod.bits();
  208|      0|   BOTAN_ASSERT_NOMSG(mod_bits > mod_lz);
  ------------------
  |  |   60|      0|   do {                                                                     \
  |  |   61|      0|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 0]
  |  |  ------------------
  |  |   62|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  209|       |
  210|      0|   if(mod_lz == mod_bits - 1) {
  ------------------
  |  Branch (210:7): [True: 0, False: 0]
  ------------------
  211|       |      // In this case we are performing an inversion modulo 2^k
  212|      0|      return inverse_mod_pow2(n, mod_lz);
  213|      0|   }
  214|       |
  215|      0|   if(mod_lz == 1) {
  ------------------
  |  Branch (215:7): [True: 0, False: 0]
  ------------------
  216|       |      /*
  217|       |      Inversion modulo 2*o is an easier special case of CRT
  218|       |
  219|       |      This is exactly the main CRT flow below but taking advantage of
  220|       |      the fact that any odd number ^-1 modulo 2 is 1. As a result both
  221|       |      inv_2k and c can be taken to be 1, m2k is 2, and h is always
  222|       |      either 0 or 1, and its value depends only on the low bit of inv_o.
  223|       |
  224|       |      This is worth special casing because we generate RSA primes such
  225|       |      that phi(n) is of this form. However this only works for keys
  226|       |      that we generated in this way; pre-existing keys will typically
  227|       |      fall back to the general algorithm below.
  228|       |      */
  229|       |
  230|      0|      const BigInt o = mod >> 1;
  231|      0|      const BigInt n_redc = ct_modulo(n, o);
  232|      0|      const BigInt inv_o = inverse_mod_odd_modulus(n_redc, o);
  233|       |
  234|       |      // No modular inverse in this case:
  235|      0|      if(inv_o == 0) {
  ------------------
  |  Branch (235:10): [True: 0, False: 0]
  ------------------
  236|      0|         return BigInt::zero();
  237|      0|      }
  238|       |
  239|      0|      BigInt h = inv_o;
  240|      0|      h.ct_cond_add(!inv_o.get_bit(0), o);
  241|      0|      return h;
  242|      0|   }
  243|       |
  244|       |   /*
  245|       |   * In this case we are performing an inversion modulo 2^k*o for
  246|       |   * some k >= 2 and some odd (not necessarily prime) integer.
  247|       |   * Compute the inversions modulo 2^k and modulo o, then combine them
  248|       |   * using CRT, which is possible because 2^k and o are relatively prime.
  249|       |   */
  250|       |
  251|      0|   const BigInt o = mod >> mod_lz;
  252|      0|   const BigInt n_redc = ct_modulo(n, o);
  253|      0|   const BigInt inv_o = inverse_mod_odd_modulus(n_redc, o);
  254|      0|   const BigInt inv_2k = inverse_mod_pow2(n, mod_lz);
  255|       |
  256|       |   // No modular inverse in this case:
  257|      0|   if(inv_o == 0 || inv_2k == 0) {
  ------------------
  |  Branch (257:7): [True: 0, False: 0]
  |  Branch (257:21): [True: 0, False: 0]
  ------------------
  258|      0|      return BigInt::zero();
  259|      0|   }
  260|       |
  261|      0|   const BigInt m2k = BigInt::power_of_2(mod_lz);
  262|       |   // Compute the CRT parameter
  263|      0|   const BigInt c = inverse_mod_pow2(o, mod_lz);
  264|       |
  265|       |   // Compute h = c*(inv_2k-inv_o) mod 2^k
  266|      0|   BigInt h = c * (inv_2k - inv_o);
  267|      0|   const bool h_neg = h.is_negative();
  268|      0|   h.set_sign(BigInt::Positive);
  269|      0|   h.mask_bits(mod_lz);
  270|      0|   const bool h_nonzero = h.is_nonzero();
  271|      0|   h.ct_cond_assign(h_nonzero && h_neg, m2k - h);
  ------------------
  |  Branch (271:21): [True: 0, False: 0]
  |  Branch (271:34): [True: 0, False: 0]
  ------------------
  272|       |
  273|       |   // Return result inv_o + h * o
  274|      0|   h *= o;
  275|      0|   h += inv_o;
  276|      0|   return h;
  277|      0|}
mod_inv.cpp:_ZN5Botan12_GLOBAL__N_123inverse_mod_odd_modulusERKNS_6BigIntES3_:
   18|  1.29k|BigInt inverse_mod_odd_modulus(const BigInt& n, const BigInt& mod) {
   19|       |   // Caller should assure these preconditions:
   20|  1.29k|   BOTAN_DEBUG_ASSERT(n.is_positive());
  ------------------
  |  |   99|  1.29k|      do {                          \
  |  |  100|  1.29k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   21|  1.29k|   BOTAN_DEBUG_ASSERT(mod.is_positive());
  ------------------
  |  |   99|  1.29k|      do {                          \
  |  |  100|  1.29k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   22|  1.29k|   BOTAN_DEBUG_ASSERT(n < mod);
  ------------------
  |  |   99|  1.29k|      do {                          \
  |  |  100|  1.29k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   23|  1.29k|   BOTAN_DEBUG_ASSERT(mod >= 3 && mod.is_odd());
  ------------------
  |  |   99|  1.29k|      do {                          \
  |  |  100|  1.29k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   24|       |
   25|       |   /*
   26|       |   This uses a modular inversion algorithm designed by Niels Möller
   27|       |   and implemented in Nettle. The same algorithm was later also
   28|       |   adapted to GMP in mpn_sec_invert.
   29|       |
   30|       |   It can be easily implemented in a way that does not depend on
   31|       |   secret branches or memory lookups, providing resistance against
   32|       |   some forms of side channel attack.
   33|       |
   34|       |   There is also a description of the algorithm in Appendix 5 of "Fast
   35|       |   Software Polynomial Multiplication on ARM Processors using the NEON Engine"
   36|       |   by Danilo Câmara, Conrado P. L. Gouvêa, Julio López, and Ricardo
   37|       |   Dahab in LNCS 8182
   38|       |      https://conradoplg.cryptoland.net/files/2010/12/mocrysen13.pdf
   39|       |
   40|       |   Thanks to Niels for creating the algorithm, explaining some things
   41|       |   about it, and the reference to the paper.
   42|       |   */
   43|       |
   44|  1.29k|   const size_t mod_words = mod.sig_words();
   45|  1.29k|   BOTAN_ASSERT(mod_words > 0, "Not empty");
  ------------------
  |  |   51|  1.29k|   do {                                                                                 \
  |  |   52|  1.29k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 1.29k]
  |  |  ------------------
  |  |   53|  1.29k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  1.29k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   46|       |
   47|  1.29k|   secure_vector<word> tmp_mem(5 * mod_words);
   48|       |
   49|  1.29k|   word* v_w = &tmp_mem[0];
   50|  1.29k|   word* u_w = &tmp_mem[1 * mod_words];
   51|  1.29k|   word* b_w = &tmp_mem[2 * mod_words];
   52|  1.29k|   word* a_w = &tmp_mem[3 * mod_words];
   53|  1.29k|   word* mp1o2 = &tmp_mem[4 * mod_words];
   54|       |
   55|  1.29k|   CT::poison(tmp_mem.data(), tmp_mem.size());
   56|       |
   57|  1.29k|   copy_mem(a_w, n.data(), std::min(n.size(), mod_words));
   58|  1.29k|   copy_mem(b_w, mod.data(), std::min(mod.size(), mod_words));
   59|  1.29k|   u_w[0] = 1;
   60|       |   // v_w = 0
   61|       |
   62|       |   // compute (mod + 1) / 2 which [because mod is odd] is equal to
   63|       |   // (mod / 2) + 1
   64|  1.29k|   copy_mem(mp1o2, mod.data(), std::min(mod.size(), mod_words));
   65|  1.29k|   bigint_shr1(mp1o2, mod_words, 0, 1);
   66|  1.29k|   word carry = bigint_add2_nc(mp1o2, mod_words, u_w, 1);
   67|  1.29k|   BOTAN_ASSERT_NOMSG(carry == 0);
  ------------------
  |  |   60|  1.29k|   do {                                                                     \
  |  |   61|  1.29k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 1.29k]
  |  |  ------------------
  |  |   62|  1.29k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  1.29k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   68|       |
   69|       |   // Only n.bits() + mod.bits() iterations are required, but avoid leaking the size of n
   70|  1.29k|   const size_t execs = 2 * mod.bits();
   71|       |
   72|   636k|   for(size_t i = 0; i != execs; ++i) {
  ------------------
  |  Branch (72:22): [True: 635k, False: 1.29k]
  ------------------
   73|   635k|      const word odd_a = a_w[0] & 1;
   74|       |
   75|       |      //if(odd_a) a -= b
   76|   635k|      word underflow = bigint_cnd_sub(odd_a, a_w, b_w, mod_words);
   77|       |
   78|       |      //if(underflow) { b -= a; a = abs(a); swap(u, v); }
   79|   635k|      bigint_cnd_add(underflow, b_w, a_w, mod_words);
   80|   635k|      bigint_cnd_abs(underflow, a_w, mod_words);
   81|   635k|      bigint_cnd_swap(underflow, u_w, v_w, mod_words);
   82|       |
   83|       |      // a >>= 1
   84|   635k|      bigint_shr1(a_w, mod_words, 0, 1);
   85|       |
   86|       |      //if(odd_a) u -= v;
   87|   635k|      word borrow = bigint_cnd_sub(odd_a, u_w, v_w, mod_words);
   88|       |
   89|       |      // if(borrow) u += p
   90|   635k|      bigint_cnd_add(borrow, u_w, mod.data(), mod_words);
   91|       |
   92|   635k|      const word odd_u = u_w[0] & 1;
   93|       |
   94|       |      // u >>= 1
   95|   635k|      bigint_shr1(u_w, mod_words, 0, 1);
   96|       |
   97|       |      //if(odd_u) u += mp1o2;
   98|   635k|      bigint_cnd_add(odd_u, u_w, mp1o2, mod_words);
   99|   635k|   }
  100|       |
  101|  1.29k|   auto a_is_0 = CT::Mask<word>::set();
  102|  6.54k|   for(size_t i = 0; i != mod_words; ++i) {
  ------------------
  |  Branch (102:22): [True: 5.25k, False: 1.29k]
  ------------------
  103|  5.25k|      a_is_0 &= CT::Mask<word>::is_zero(a_w[i]);
  104|  5.25k|   }
  105|       |
  106|  1.29k|   auto b_is_1 = CT::Mask<word>::is_equal(b_w[0], 1);
  107|  5.25k|   for(size_t i = 1; i != mod_words; ++i) {
  ------------------
  |  Branch (107:22): [True: 3.96k, False: 1.29k]
  ------------------
  108|  3.96k|      b_is_1 &= CT::Mask<word>::is_zero(b_w[i]);
  109|  3.96k|   }
  110|       |
  111|  1.29k|   BOTAN_ASSERT(a_is_0.as_bool(), "A is zero");
  ------------------
  |  |   51|  1.29k|   do {                                                                                 \
  |  |   52|  1.29k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 1.29k]
  |  |  ------------------
  |  |   53|  1.29k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  1.29k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  112|       |
  113|       |   // if b != 1 then gcd(n,mod) > 1 and inverse does not exist
  114|       |   // in which case zero out the result to indicate this
  115|  1.29k|   (~b_is_1).if_set_zero_out(v_w, mod_words);
  116|       |
  117|       |   /*
  118|       |   * We've placed the result in the lowest words of the temp buffer.
  119|       |   * So just clear out the other values and then give that buffer to a
  120|       |   * BigInt.
  121|       |   */
  122|  1.29k|   clear_mem(&tmp_mem[mod_words], 4 * mod_words);
  123|       |
  124|  1.29k|   CT::unpoison(tmp_mem.data(), tmp_mem.size());
  125|       |
  126|  1.29k|   BigInt r;
  127|  1.29k|   r.swap_reg(tmp_mem);
  128|  1.29k|   return r;
  129|  1.29k|}

_ZN5Botan13monty_inverseEm:
   16|  3.58k|word monty_inverse(word a) {
   17|  3.58k|   if(a % 2 == 0) {
  ------------------
  |  Branch (17:7): [True: 0, False: 3.58k]
  ------------------
   18|      0|      throw Invalid_Argument("monty_inverse only valid for odd integers");
   19|      0|   }
   20|       |
   21|       |   /*
   22|       |   * From "A New Algorithm for Inversion mod p^k" by Çetin Kaya Koç
   23|       |   * https://eprint.iacr.org/2017/411.pdf sections 5 and 7.
   24|       |   */
   25|       |
   26|  3.58k|   word b = 1;
   27|  3.58k|   word r = 0;
   28|       |
   29|   233k|   for(size_t i = 0; i != BOTAN_MP_WORD_BITS; ++i) {
  ------------------
  |  |   50|   233k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  |  Branch (29:22): [True: 229k, False: 3.58k]
  ------------------
   30|   229k|      const word bi = b % 2;
   31|   229k|      r >>= 1;
   32|   229k|      r += bi << (BOTAN_MP_WORD_BITS - 1);
  ------------------
  |  |   50|   229k|#define BOTAN_MP_WORD_BITS 64
  ------------------
   33|       |
   34|   229k|      b -= a * bi;
   35|   229k|      b >>= 1;
   36|   229k|   }
   37|       |
   38|       |   // Now invert in addition space
   39|  3.58k|   r = (MP_WORD_MAX - r) + 1;
   40|       |
   41|  3.58k|   return r;
   42|  3.58k|}
_ZN5Botan17Montgomery_ParamsC2ERKNS_6BigIntERKNS_15Modular_ReducerE:
   44|  2.48k|Montgomery_Params::Montgomery_Params(const BigInt& p, const Modular_Reducer& mod_p) {
   45|  2.48k|   if(p.is_even() || p < 3) {
  ------------------
  |  Branch (45:7): [True: 3, False: 2.48k]
  |  Branch (45:22): [True: 1, False: 2.48k]
  ------------------
   46|      4|      throw Invalid_Argument("Montgomery_Params invalid modulus");
   47|      4|   }
   48|       |
   49|  2.48k|   m_p = p;
   50|  2.48k|   m_p_words = m_p.sig_words();
   51|  2.48k|   m_p_dash = monty_inverse(m_p.word_at(0));
   52|       |
   53|  2.48k|   const BigInt r = BigInt::power_of_2(m_p_words * BOTAN_MP_WORD_BITS);
  ------------------
  |  |   50|  2.48k|#define BOTAN_MP_WORD_BITS 64
  ------------------
   54|       |
   55|  2.48k|   m_r1 = mod_p.reduce(r);
   56|  2.48k|   m_r2 = mod_p.square(m_r1);
   57|  2.48k|   m_r3 = mod_p.multiply(m_r1, m_r2);
   58|  2.48k|}
_ZN5Botan17Montgomery_ParamsC2ERKNS_6BigIntE:
   60|    471|Montgomery_Params::Montgomery_Params(const BigInt& p) {
   61|    471|   if(p.is_even() || p < 3) {
  ------------------
  |  Branch (61:7): [True: 0, False: 471]
  |  Branch (61:22): [True: 0, False: 471]
  ------------------
   62|      0|      throw Invalid_Argument("Montgomery_Params invalid modulus");
   63|      0|   }
   64|       |
   65|    471|   m_p = p;
   66|    471|   m_p_words = m_p.sig_words();
   67|    471|   m_p_dash = monty_inverse(m_p.word_at(0));
   68|       |
   69|    471|   const BigInt r = BigInt::power_of_2(m_p_words * BOTAN_MP_WORD_BITS);
  ------------------
  |  |   50|    471|#define BOTAN_MP_WORD_BITS 64
  ------------------
   70|       |
   71|       |   // It might be faster to use ct_modulo here vs setting up Barrett reduction?
   72|    471|   Modular_Reducer mod_p(p);
   73|       |
   74|    471|   m_r1 = mod_p.reduce(r);
   75|    471|   m_r2 = mod_p.square(m_r1);
   76|    471|   m_r3 = mod_p.multiply(m_r1, m_r2);
   77|    471|}
_ZNK5Botan17Montgomery_Params4redcERKNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
   84|  16.5k|BigInt Montgomery_Params::redc(const BigInt& x, secure_vector<word>& ws) const {
   85|  16.5k|   const size_t output_size = m_p_words + 1;
   86|       |
   87|  16.5k|   if(ws.size() < output_size) {
  ------------------
  |  Branch (87:7): [True: 16.5k, False: 0]
  ------------------
   88|  16.5k|      ws.resize(output_size);
   89|  16.5k|   }
   90|       |
   91|  16.5k|   BigInt z = x;
   92|  16.5k|   z.grow_to(2 * m_p_words);
   93|       |
   94|  16.5k|   bigint_monty_redc(z.mutable_data(), m_p.data(), m_p_words, m_p_dash, ws.data(), ws.size());
   95|       |
   96|  16.5k|   return z;
   97|  16.5k|}
_ZNK5Botan17Montgomery_Params3mulERKNS_6BigIntES3_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
   99|   243k|BigInt Montgomery_Params::mul(const BigInt& x, const BigInt& y, secure_vector<word>& ws) const {
  100|   243k|   const size_t output_size = 2 * m_p_words + 2;
  101|       |
  102|   243k|   if(ws.size() < output_size) {
  ------------------
  |  Branch (102:7): [True: 243k, False: 0]
  ------------------
  103|   243k|      ws.resize(output_size);
  104|   243k|   }
  105|       |
  106|   243k|   BOTAN_DEBUG_ASSERT(x.sig_words() <= m_p_words);
  ------------------
  |  |   99|   243k|      do {                          \
  |  |  100|   243k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  107|   243k|   BOTAN_DEBUG_ASSERT(y.sig_words() <= m_p_words);
  ------------------
  |  |   99|   243k|      do {                          \
  |  |  100|   243k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  108|       |
  109|   243k|   BigInt z = BigInt::with_capacity(output_size);
  110|   243k|   bigint_mul(z.mutable_data(),
  111|   243k|              z.size(),
  112|   243k|              x.data(),
  113|   243k|              x.size(),
  114|   243k|              std::min(m_p_words, x.size()),
  115|   243k|              y.data(),
  116|   243k|              y.size(),
  117|   243k|              std::min(m_p_words, y.size()),
  118|   243k|              ws.data(),
  119|   243k|              ws.size());
  120|       |
  121|   243k|   bigint_monty_redc(z.mutable_data(), m_p.data(), m_p_words, m_p_dash, ws.data(), ws.size());
  122|       |
  123|   243k|   return z;
  124|   243k|}
_ZNK5Botan17Montgomery_Params6mul_byERNS_6BigIntERKNSt3__16vectorImNS_16secure_allocatorImEEEERS7_:
  151|  61.3k|void Montgomery_Params::mul_by(BigInt& x, const secure_vector<word>& y, secure_vector<word>& ws) const {
  152|  61.3k|   const size_t output_size = 2 * m_p_words;
  153|       |
  154|  61.3k|   if(ws.size() < 2 * output_size) {
  ------------------
  |  Branch (154:7): [True: 0, False: 61.3k]
  ------------------
  155|      0|      ws.resize(2 * output_size);
  156|      0|   }
  157|       |
  158|  61.3k|   word* z_data = &ws[0];
  159|  61.3k|   word* ws_data = &ws[output_size];
  160|       |
  161|  61.3k|   BOTAN_DEBUG_ASSERT(x.sig_words() <= m_p_words);
  ------------------
  |  |   99|  61.3k|      do {                          \
  |  |  100|  61.3k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  162|       |
  163|  61.3k|   bigint_mul(z_data,
  164|  61.3k|              output_size,
  165|  61.3k|              x.data(),
  166|  61.3k|              x.size(),
  167|  61.3k|              std::min(m_p_words, x.size()),
  168|  61.3k|              y.data(),
  169|  61.3k|              y.size(),
  170|  61.3k|              std::min(m_p_words, y.size()),
  171|  61.3k|              ws_data,
  172|  61.3k|              output_size);
  173|       |
  174|  61.3k|   bigint_monty_redc(z_data, m_p.data(), m_p_words, m_p_dash, ws_data, output_size);
  175|       |
  176|  61.3k|   if(x.size() < output_size) {
  ------------------
  |  Branch (176:7): [True: 0, False: 61.3k]
  ------------------
  177|      0|      x.grow_to(output_size);
  178|      0|   }
  179|  61.3k|   copy_mem(x.mutable_data(), z_data, output_size);
  180|  61.3k|}
_ZNK5Botan17Montgomery_Params6mul_byERNS_6BigIntERKS1_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  182|  88.9k|void Montgomery_Params::mul_by(BigInt& x, const BigInt& y, secure_vector<word>& ws) const {
  183|  88.9k|   const size_t output_size = 2 * m_p_words;
  184|       |
  185|  88.9k|   if(ws.size() < 2 * output_size) {
  ------------------
  |  Branch (185:7): [True: 0, False: 88.9k]
  ------------------
  186|      0|      ws.resize(2 * output_size);
  187|      0|   }
  188|       |
  189|  88.9k|   word* z_data = &ws[0];
  190|  88.9k|   word* ws_data = &ws[output_size];
  191|       |
  192|  88.9k|   BOTAN_DEBUG_ASSERT(x.sig_words() <= m_p_words);
  ------------------
  |  |   99|  88.9k|      do {                          \
  |  |  100|  88.9k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  193|       |
  194|  88.9k|   bigint_mul(z_data,
  195|  88.9k|              output_size,
  196|  88.9k|              x.data(),
  197|  88.9k|              x.size(),
  198|  88.9k|              std::min(m_p_words, x.size()),
  199|  88.9k|              y.data(),
  200|  88.9k|              y.size(),
  201|  88.9k|              std::min(m_p_words, y.size()),
  202|  88.9k|              ws_data,
  203|  88.9k|              output_size);
  204|       |
  205|  88.9k|   bigint_monty_redc(z_data, m_p.data(), m_p_words, m_p_dash, ws_data, output_size);
  206|       |
  207|  88.9k|   if(x.size() < output_size) {
  ------------------
  |  Branch (207:7): [True: 0, False: 88.9k]
  ------------------
  208|      0|      x.grow_to(output_size);
  209|      0|   }
  210|  88.9k|   copy_mem(x.mutable_data(), z_data, output_size);
  211|  88.9k|}
_ZNK5Botan17Montgomery_Params11square_thisERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  231|   689k|void Montgomery_Params::square_this(BigInt& x, secure_vector<word>& ws) const {
  232|   689k|   const size_t output_size = 2 * m_p_words;
  233|       |
  234|   689k|   if(ws.size() < 2 * output_size) {
  ------------------
  |  Branch (234:7): [True: 4.16k, False: 685k]
  ------------------
  235|  4.16k|      ws.resize(2 * output_size);
  236|  4.16k|   }
  237|       |
  238|   689k|   word* z_data = &ws[0];
  239|   689k|   word* ws_data = &ws[output_size];
  240|       |
  241|   689k|   BOTAN_DEBUG_ASSERT(x.sig_words() <= m_p_words);
  ------------------
  |  |   99|   689k|      do {                          \
  |  |  100|   689k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  242|       |
  243|   689k|   bigint_sqr(z_data, output_size, x.data(), x.size(), std::min(m_p_words, x.size()), ws_data, output_size);
  244|       |
  245|   689k|   bigint_monty_redc(z_data, m_p.data(), m_p_words, m_p_dash, ws_data, output_size);
  246|       |
  247|   689k|   if(x.size() < output_size) {
  ------------------
  |  Branch (247:7): [True: 1.19k, False: 688k]
  ------------------
  248|  1.19k|      x.grow_to(output_size);
  249|  1.19k|   }
  250|   689k|   copy_mem(x.mutable_data(), z_data, output_size);
  251|   689k|}
_ZN5Botan14Montgomery_IntC2ERKNSt3__110shared_ptrIKNS_17Montgomery_ParamsEEERKNS_6BigIntEb:
  256|   260k|      m_params(params) {
  257|   260k|   if(redc_needed == false) {
  ------------------
  |  Branch (257:7): [True: 243k, False: 16.5k]
  ------------------
  258|   243k|      m_v = v;
  259|   243k|   } else {
  260|  16.5k|      BOTAN_ASSERT_NOMSG(m_v < m_params->p());
  ------------------
  |  |   60|  16.5k|   do {                                                                     \
  |  |   61|  16.5k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 16.5k]
  |  |  ------------------
  |  |   62|  16.5k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  16.5k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  261|  16.5k|      secure_vector<word> ws;
  262|  16.5k|      m_v = m_params->mul(v, m_params->R2(), ws);
  263|  16.5k|   }
  264|   260k|}
_ZN5Botan14Montgomery_IntC2ENSt3__110shared_ptrIKNS_17Montgomery_ParamsEEEPKmmb:
  282|  1.19k|      m_params(std::move(params)) {
  283|  1.19k|   m_v.set_words(words, len);
  284|       |
  285|  1.19k|   if(redc_needed) {
  ------------------
  |  Branch (285:7): [True: 0, False: 1.19k]
  ------------------
  286|      0|      BOTAN_ASSERT_NOMSG(m_v < m_params->p());
  ------------------
  |  |   60|      0|   do {                                                                     \
  |  |   61|      0|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 0]
  |  |  ------------------
  |  |   62|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  287|      0|      secure_vector<word> ws;
  288|      0|      m_v = m_params->mul(m_v, m_params->R2(), ws);
  289|      0|   }
  290|  1.19k|}
_ZN5Botan14Montgomery_Int8fix_sizeEv:
  292|   260k|void Montgomery_Int::fix_size() {
  293|   260k|   const size_t p_words = m_params->p_words();
  294|       |
  295|   260k|   if(m_v.sig_words() > p_words) {
  ------------------
  |  Branch (295:7): [True: 1, False: 260k]
  ------------------
  296|      1|      throw Internal_Error("Montgomery_Int::fix_size v too large");
  297|      1|   }
  298|       |
  299|   260k|   m_v.grow_to(p_words);
  300|   260k|}
_ZNK5Botan14Montgomery_Int5valueEv:
  324|  16.5k|BigInt Montgomery_Int::value() const {
  325|  16.5k|   secure_vector<word> ws;
  326|  16.5k|   return m_params->redc(m_v, ws);
  327|  16.5k|}
_ZNK5Botan14Montgomery_IntmlERKS0_:
  363|   227k|Montgomery_Int Montgomery_Int::operator*(const Montgomery_Int& other) const {
  364|   227k|   secure_vector<word> ws;
  365|   227k|   return Montgomery_Int(m_params, m_params->mul(m_v, other.m_v, ws), false);
  366|   227k|}
_ZN5Botan14Montgomery_Int6mul_byERKS0_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  372|  88.9k|Montgomery_Int& Montgomery_Int::mul_by(const Montgomery_Int& other, secure_vector<word>& ws) {
  373|  88.9k|   m_params->mul_by(m_v, other.m_v, ws);
  374|  88.9k|   return (*this);
  375|  88.9k|}
_ZN5Botan14Montgomery_Int6mul_byERKNSt3__16vectorImNS_16secure_allocatorImEEEERS5_:
  377|  61.3k|Montgomery_Int& Montgomery_Int::mul_by(const secure_vector<word>& other, secure_vector<word>& ws) {
  378|  61.3k|   m_params->mul_by(m_v, other, ws);
  379|  61.3k|   return (*this);
  380|  61.3k|}
_ZN5Botan14Montgomery_Int19square_this_n_timesERNSt3__16vectorImNS_16secure_allocatorImEEEEm:
  392|   215k|Montgomery_Int& Montgomery_Int::square_this_n_times(secure_vector<word>& ws, size_t n) {
  393|   905k|   for(size_t i = 0; i != n; ++i) {
  ------------------
  |  Branch (393:22): [True: 689k, False: 215k]
  ------------------
  394|   689k|      m_params->square_this(m_v, ws);
  395|   689k|   }
  396|   215k|   return (*this);
  397|   215k|}

_ZN5Botan30Montgomery_Exponentation_StateC2ERKNSt3__110shared_ptrIKNS_17Montgomery_ParamsEEERKNS_6BigIntEmb:
   40|  16.5k|      m_params(params), m_window_bits(window_bits == 0 ? 4 : window_bits) {
   41|  16.5k|   BOTAN_ARG_CHECK(g < m_params->p(), "Montgomery base too big");
  ------------------
  |  |   30|  16.5k|   do {                                                          \
  |  |   31|  16.5k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 2, False: 16.5k]
  |  |  ------------------
  |  |   32|  16.5k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  16.5k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   42|       |
   43|  16.5k|   if(m_window_bits < 1 || m_window_bits > 12) {  // really even 8 is too large ...
  ------------------
  |  Branch (43:7): [True: 2, False: 16.5k]
  |  Branch (43:28): [True: 0, False: 16.5k]
  ------------------
   44|      0|      throw Invalid_Argument("Invalid window bits for Montgomery exponentiation");
   45|      0|   }
   46|       |
   47|  16.5k|   const size_t window_size = (static_cast<size_t>(1) << m_window_bits);
   48|       |
   49|  16.5k|   m_g.reserve(window_size);
   50|       |
   51|  16.5k|   m_g.push_back(Montgomery_Int(m_params, m_params->R1(), false));
   52|       |
   53|  16.5k|   m_g.push_back(Montgomery_Int(m_params, g));
   54|       |
   55|   243k|   for(size_t i = 2; i != window_size; ++i) {
  ------------------
  |  Branch (55:22): [True: 227k, False: 16.5k]
  ------------------
   56|   227k|      m_g.push_back(m_g[1] * m_g[i - 1]);
   57|   227k|   }
   58|       |
   59|       |   // Resize each element to exactly p words
   60|   277k|   for(size_t i = 0; i != window_size; ++i) {
  ------------------
  |  Branch (60:22): [True: 260k, False: 16.5k]
  ------------------
   61|   260k|      m_g[i].fix_size();
   62|   260k|      if(const_time) {
  ------------------
  |  Branch (62:10): [True: 20.3k, False: 240k]
  ------------------
   63|  20.3k|         m_g[i].const_time_poison();
   64|  20.3k|      }
   65|   260k|   }
   66|  16.5k|}
_ZNK5Botan30Montgomery_Exponentation_State14exponentiationERKNS_6BigIntEm:
   95|  1.19k|BigInt Montgomery_Exponentation_State::exponentiation(const BigInt& scalar, size_t max_k_bits) const {
   96|  1.19k|   BOTAN_DEBUG_ASSERT(scalar.bits() <= max_k_bits);
  ------------------
  |  |   99|  1.19k|      do {                          \
  |  |  100|  1.19k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   97|       |   // TODO add a const-time implementation of above assert and use it in release builds
   98|       |
   99|  1.19k|   const size_t exp_nibbles = (max_k_bits + m_window_bits - 1) / m_window_bits;
  100|       |
  101|  1.19k|   if(exp_nibbles == 0) {
  ------------------
  |  Branch (101:7): [True: 0, False: 1.19k]
  ------------------
  102|      0|      return BigInt::one();
  103|      0|   }
  104|       |
  105|  1.19k|   secure_vector<word> e_bits(m_params->p_words());
  106|  1.19k|   secure_vector<word> ws;
  107|       |
  108|  1.19k|   const_time_lookup(e_bits, m_g, scalar.get_substring(m_window_bits * (exp_nibbles - 1), m_window_bits));
  109|  1.19k|   Montgomery_Int x(m_params, e_bits.data(), e_bits.size(), false);
  110|       |
  111|  62.5k|   for(size_t i = exp_nibbles - 1; i > 0; --i) {
  ------------------
  |  Branch (111:36): [True: 61.3k, False: 1.19k]
  ------------------
  112|  61.3k|      x.square_this_n_times(ws, m_window_bits);
  113|  61.3k|      const_time_lookup(e_bits, m_g, scalar.get_substring(m_window_bits * (i - 1), m_window_bits));
  114|  61.3k|      x.mul_by(e_bits, ws);
  115|  61.3k|   }
  116|       |
  117|  1.19k|   x.const_time_unpoison();
  118|  1.19k|   return x.value();
  119|  1.19k|}
_ZNK5Botan30Montgomery_Exponentation_State22exponentiation_vartimeERKNS_6BigIntE:
  121|  15.3k|BigInt Montgomery_Exponentation_State::exponentiation_vartime(const BigInt& scalar) const {
  122|  15.3k|   const size_t exp_nibbles = (scalar.bits() + m_window_bits - 1) / m_window_bits;
  123|       |
  124|  15.3k|   secure_vector<word> ws;
  125|       |
  126|  15.3k|   if(exp_nibbles == 0) {
  ------------------
  |  Branch (126:7): [True: 0, False: 15.3k]
  ------------------
  127|      0|      return BigInt::one();
  128|      0|   }
  129|       |
  130|  15.3k|   Montgomery_Int x = m_g[scalar.get_substring(m_window_bits * (exp_nibbles - 1), m_window_bits)];
  131|       |
  132|   169k|   for(size_t i = exp_nibbles - 1; i > 0; --i) {
  ------------------
  |  Branch (132:36): [True: 154k, False: 15.3k]
  ------------------
  133|   154k|      x.square_this_n_times(ws, m_window_bits);
  134|       |
  135|   154k|      const uint32_t nibble = scalar.get_substring(m_window_bits * (i - 1), m_window_bits);
  136|   154k|      if(nibble > 0) {
  ------------------
  |  Branch (136:10): [True: 88.9k, False: 65.4k]
  ------------------
  137|  88.9k|         x.mul_by(m_g[nibble], ws);
  138|  88.9k|      }
  139|   154k|   }
  140|       |
  141|  15.3k|   x.const_time_unpoison();
  142|  15.3k|   return x.value();
  143|  15.3k|}
_ZN5Botan16monty_precomputeERKNSt3__110shared_ptrIKNS_17Montgomery_ParamsEEERKNS_6BigIntEmb:
  146|  16.5k|   const std::shared_ptr<const Montgomery_Params>& params, const BigInt& g, size_t window_bits, bool const_time) {
  147|  16.5k|   return std::make_shared<const Montgomery_Exponentation_State>(params, g, window_bits, const_time);
  148|  16.5k|}
_ZN5Botan13monty_executeERKNS_30Montgomery_Exponentation_StateERKNS_6BigIntEm:
  150|  1.19k|BigInt monty_execute(const Montgomery_Exponentation_State& precomputed_state, const BigInt& k, size_t max_k_bits) {
  151|  1.19k|   return precomputed_state.exponentiation(k, max_k_bits);
  152|  1.19k|}
_ZN5Botan21monty_execute_vartimeERKNS_30Montgomery_Exponentation_StateERKNS_6BigIntE:
  154|  15.3k|BigInt monty_execute_vartime(const Montgomery_Exponentation_State& precomputed_state, const BigInt& k) {
  155|  15.3k|   return precomputed_state.exponentiation_vartime(k);
  156|  15.3k|}
monty_exp.cpp:_ZN5Botan12_GLOBAL__N_117const_time_lookupERNSt3__16vectorImNS_16secure_allocatorImEEEERKNS2_INS_14Montgomery_IntENS1_9allocatorIS7_EEEEm:
   70|  62.5k|void const_time_lookup(secure_vector<word>& output, const std::vector<Montgomery_Int>& g, size_t nibble) {
   71|  62.5k|   BOTAN_ASSERT_NOMSG(g.size() % 2 == 0);  // actually a power of 2
  ------------------
  |  |   60|  62.5k|   do {                                                                     \
  |  |   61|  62.5k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 62.5k]
  |  |  ------------------
  |  |   62|  62.5k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  62.5k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   72|       |
   73|  62.5k|   const size_t words = output.size();
   74|       |
   75|  62.5k|   clear_mem(output.data(), output.size());
   76|       |
   77|   562k|   for(size_t i = 0; i != g.size(); i += 2) {
  ------------------
  |  Branch (77:22): [True: 500k, False: 62.5k]
  ------------------
   78|   500k|      const secure_vector<word>& vec_0 = g[i].repr().get_word_vector();
   79|   500k|      const secure_vector<word>& vec_1 = g[i + 1].repr().get_word_vector();
   80|       |
   81|   500k|      BOTAN_ASSERT_NOMSG(vec_0.size() >= words && vec_1.size() >= words);
  ------------------
  |  |   60|   500k|   do {                                                                     \
  |  |   61|  1.00M|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:12): [True: 500k, False: 0]
  |  |  |  Branch (61:12): [True: 500k, False: 0]
  |  |  ------------------
  |  |   62|   500k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|   500k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   82|       |
   83|   500k|      const auto mask_0 = CT::Mask<word>::is_equal(nibble, i);
   84|   500k|      const auto mask_1 = CT::Mask<word>::is_equal(nibble, i + 1);
   85|       |
   86|  2.90M|      for(size_t w = 0; w != words; ++w) {
  ------------------
  |  Branch (86:25): [True: 2.40M, False: 500k]
  ------------------
   87|  2.40M|         output[w] |= mask_0.if_set_return(vec_0[w]);
   88|  2.40M|         output[w] |= mask_1.if_set_return(vec_1[w]);
   89|  2.40M|      }
   90|   500k|   }
   91|  62.5k|}

_ZN5Botan10prime_p521Ev:
   15|  44.6k|const BigInt& prime_p521() {
   16|  44.6k|   static const BigInt p521(
   17|  44.6k|      "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
   18|  44.6k|      "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF");
   19|       |
   20|  44.6k|   return p521;
   21|  44.6k|}
_ZN5Botan9redc_p521ERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
   23|   505k|void redc_p521(BigInt& x, secure_vector<word>& ws) {
   24|   505k|   BOTAN_DEBUG_ASSERT(x.is_positive());
  ------------------
  |  |   99|   505k|      do {                          \
  |  |  100|   505k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   25|       |
   26|   505k|   const size_t p_full_words = 521 / BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|   505k|#define BOTAN_MP_WORD_BITS 64
  ------------------
   27|   505k|   const size_t p_top_bits = 521 % BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|   505k|#define BOTAN_MP_WORD_BITS 64
  ------------------
   28|   505k|   const size_t p_words = p_full_words + 1;
   29|       |
   30|   505k|#if(BOTAN_MP_WORD_BITS == 64)
   31|   505k|   static const word p521_words[p_words] = {0xFFFFFFFFFFFFFFFF,
   32|   505k|                                            0xFFFFFFFFFFFFFFFF,
   33|   505k|                                            0xFFFFFFFFFFFFFFFF,
   34|   505k|                                            0xFFFFFFFFFFFFFFFF,
   35|   505k|                                            0xFFFFFFFFFFFFFFFF,
   36|   505k|                                            0xFFFFFFFFFFFFFFFF,
   37|   505k|                                            0xFFFFFFFFFFFFFFFF,
   38|   505k|                                            0xFFFFFFFFFFFFFFFF,
   39|   505k|                                            0x1FF};
   40|       |#else
   41|       |   static const word p521_words[p_words] = {0xFFFFFFFF,
   42|       |                                            0xFFFFFFFF,
   43|       |                                            0xFFFFFFFF,
   44|       |                                            0xFFFFFFFF,
   45|       |                                            0xFFFFFFFF,
   46|       |                                            0xFFFFFFFF,
   47|       |                                            0xFFFFFFFF,
   48|       |                                            0xFFFFFFFF,
   49|       |                                            0xFFFFFFFF,
   50|       |                                            0xFFFFFFFF,
   51|       |                                            0xFFFFFFFF,
   52|       |                                            0xFFFFFFFF,
   53|       |                                            0xFFFFFFFF,
   54|       |                                            0xFFFFFFFF,
   55|       |                                            0xFFFFFFFF,
   56|       |                                            0xFFFFFFFF,
   57|       |                                            0x1FF};
   58|       |#endif
   59|       |
   60|   505k|   if(ws.size() < p_words + 1) {
  ------------------
  |  Branch (60:7): [True: 0, False: 505k]
  ------------------
   61|      0|      ws.resize(p_words + 1);
   62|      0|   }
   63|       |
   64|   505k|   clear_mem(ws.data(), ws.size());
   65|   505k|   bigint_shr2(ws.data(), x.data(), std::min(x.size(), 2 * p_words), p_full_words, p_top_bits);
   66|       |
   67|   505k|   x.mask_bits(521);
   68|   505k|   x.grow_to(p_words);
   69|       |
   70|       |   // Word-level carry will be zero
   71|   505k|   word carry = bigint_add3_nc(x.mutable_data(), x.data(), p_words, ws.data(), p_words);
   72|   505k|   BOTAN_ASSERT_EQUAL(carry, 0, "Final carry in P-521 reduction");
  ------------------
  |  |   69|   505k|   do {                                                                                                \
  |  |   70|   505k|      if((expr1) != (expr2))                                                                           \
  |  |  ------------------
  |  |  |  Branch (70:10): [True: 0, False: 505k]
  |  |  ------------------
  |  |   71|   505k|         Botan::assertion_failure(#expr1 " == " #expr2, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   72|   505k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (72:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   73|       |
   74|   505k|   const word top_word = x.word_at(p_full_words);
   75|       |
   76|       |   /*
   77|       |   * Check if we need to reduce modulo P
   78|       |   * There are two possible cases:
   79|       |   * - The result overflowed past 521 bits, in which case bit 522 will be set
   80|       |   * - The result is exactly 2**521 - 1
   81|       |   */
   82|   505k|   const auto bit_522_set = CT::Mask<word>::expand(top_word >> p_top_bits);
   83|       |
   84|   505k|   word and_512 = MP_WORD_MAX;
   85|  4.54M|   for(size_t i = 0; i != p_full_words; ++i) {
  ------------------
  |  Branch (85:22): [True: 4.04M, False: 505k]
  ------------------
   86|  4.04M|      and_512 &= x.word_at(i);
   87|  4.04M|   }
   88|   505k|   const auto all_512_low_bits_set = CT::Mask<word>::is_equal(and_512, MP_WORD_MAX);
   89|   505k|   const auto has_p521_top_word = CT::Mask<word>::is_equal(top_word, 0x1FF);
   90|   505k|   const auto is_p521 = all_512_low_bits_set & has_p521_top_word;
   91|       |
   92|   505k|   const auto needs_reduction = is_p521 | bit_522_set;
   93|       |
   94|   505k|   bigint_cnd_sub(needs_reduction.value(), x.mutable_data(), p521_words, p_words);
   95|   505k|}
_ZN5Botan10prime_p192Ev:
  122|  9.52k|const BigInt& prime_p192() {
  123|  9.52k|   static const BigInt p192("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF");
  124|  9.52k|   return p192;
  125|  9.52k|}
_ZN5Botan9redc_p192ERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  127|  94.5k|void redc_p192(BigInt& x, secure_vector<word>& ws) {
  128|  94.5k|   BOTAN_DEBUG_ASSERT(x.is_positive());
  ------------------
  |  |   99|  94.5k|      do {                          \
  |  |  100|  94.5k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  129|       |
  130|  94.5k|   BOTAN_UNUSED(ws);
  ------------------
  |  |  118|  94.5k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  131|       |
  132|  94.5k|   static const size_t p192_limbs = 192 / BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  94.5k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  133|       |
  134|  94.5k|   x.grow_to(2 * p192_limbs);
  135|  94.5k|   word* xw = x.mutable_data();
  136|       |
  137|  94.5k|   const uint64_t X00 = get_uint32(xw, 0);
  138|  94.5k|   const uint64_t X01 = get_uint32(xw, 1);
  139|  94.5k|   const uint64_t X02 = get_uint32(xw, 2);
  140|  94.5k|   const uint64_t X03 = get_uint32(xw, 3);
  141|  94.5k|   const uint64_t X04 = get_uint32(xw, 4);
  142|  94.5k|   const uint64_t X05 = get_uint32(xw, 5);
  143|  94.5k|   const uint64_t X06 = get_uint32(xw, 6);
  144|  94.5k|   const uint64_t X07 = get_uint32(xw, 7);
  145|  94.5k|   const uint64_t X08 = get_uint32(xw, 8);
  146|  94.5k|   const uint64_t X09 = get_uint32(xw, 9);
  147|  94.5k|   const uint64_t X10 = get_uint32(xw, 10);
  148|  94.5k|   const uint64_t X11 = get_uint32(xw, 11);
  149|       |
  150|  94.5k|   const uint64_t S0 = X00 + X06 + X10;
  151|  94.5k|   const uint64_t S1 = X01 + X07 + X11;
  152|  94.5k|   const uint64_t S2 = X02 + X06 + X08 + X10;
  153|  94.5k|   const uint64_t S3 = X03 + X07 + X09 + X11;
  154|  94.5k|   const uint64_t S4 = X04 + X08 + X10;
  155|  94.5k|   const uint64_t S5 = X05 + X09 + X11;
  156|       |
  157|  94.5k|   uint64_t S = 0;
  158|  94.5k|   uint32_t R0 = 0, R1 = 0;
  159|       |
  160|  94.5k|   S += S0;
  161|  94.5k|   R0 = static_cast<uint32_t>(S);
  162|  94.5k|   S >>= 32;
  163|       |
  164|  94.5k|   S += S1;
  165|  94.5k|   R1 = static_cast<uint32_t>(S);
  166|  94.5k|   S >>= 32;
  167|       |
  168|  94.5k|   set_words(xw, 0, R0, R1);
  169|       |
  170|  94.5k|   S += S2;
  171|  94.5k|   R0 = static_cast<uint32_t>(S);
  172|  94.5k|   S >>= 32;
  173|       |
  174|  94.5k|   S += S3;
  175|  94.5k|   R1 = static_cast<uint32_t>(S);
  176|  94.5k|   S >>= 32;
  177|       |
  178|  94.5k|   set_words(xw, 2, R0, R1);
  179|       |
  180|  94.5k|   S += S4;
  181|  94.5k|   R0 = static_cast<uint32_t>(S);
  182|  94.5k|   S >>= 32;
  183|       |
  184|  94.5k|   S += S5;
  185|  94.5k|   R1 = static_cast<uint32_t>(S);
  186|  94.5k|   S >>= 32;
  187|       |
  188|  94.5k|   set_words(xw, 4, R0, R1);
  189|       |
  190|       |   // No underflow possible
  191|       |
  192|       |   /*
  193|       |   This is a table of (i*P-192) % 2**192 for i in 1...3
  194|       |   */
  195|  94.5k|   static const word p192_mults[3][p192_limbs] = {
  196|  94.5k|#if(BOTAN_MP_WORD_BITS == 64)
  197|  94.5k|      {0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFE, 0xFFFFFFFFFFFFFFFF},
  198|  94.5k|      {0xFFFFFFFFFFFFFFFE, 0xFFFFFFFFFFFFFFFD, 0xFFFFFFFFFFFFFFFF},
  199|  94.5k|      {0xFFFFFFFFFFFFFFFD, 0xFFFFFFFFFFFFFFFC, 0xFFFFFFFFFFFFFFFF},
  200|       |#else
  201|       |      {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFE, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF},
  202|       |      {0xFFFFFFFE, 0xFFFFFFFF, 0xFFFFFFFD, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF},
  203|       |      {0xFFFFFFFD, 0xFFFFFFFF, 0xFFFFFFFC, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF},
  204|       |#endif
  205|  94.5k|   };
  206|       |
  207|  94.5k|   CT::unpoison(S);
  208|  94.5k|   BOTAN_ASSERT(S <= 2, "Expected overflow");
  ------------------
  |  |   51|  94.5k|   do {                                                                                 \
  |  |   52|  94.5k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 94.5k]
  |  |  ------------------
  |  |   53|  94.5k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  94.5k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  209|       |
  210|  94.5k|   BOTAN_ASSERT_NOMSG(x.size() >= p192_limbs + 1);
  ------------------
  |  |   60|  94.5k|   do {                                                                     \
  |  |   61|  94.5k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 94.5k]
  |  |  ------------------
  |  |   62|  94.5k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  94.5k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  211|  94.5k|   x.mask_bits(192);
  212|  94.5k|   word borrow = bigint_sub2(x.mutable_data(), p192_limbs + 1, p192_mults[S], p192_limbs);
  213|  94.5k|   BOTAN_DEBUG_ASSERT(borrow == 0 || borrow == 1);
  ------------------
  |  |   99|  94.5k|      do {                          \
  |  |  100|  94.5k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  214|  94.5k|   bigint_cnd_add(borrow, x.mutable_data(), p192_limbs + 1, p192_mults[0], p192_limbs);
  215|  94.5k|}
_ZN5Botan10prime_p224Ev:
  217|  8.15k|const BigInt& prime_p224() {
  218|  8.15k|   static const BigInt p224("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001");
  219|  8.15k|   return p224;
  220|  8.15k|}
_ZN5Botan9redc_p224ERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  222|  75.0k|void redc_p224(BigInt& x, secure_vector<word>& ws) {
  223|  75.0k|   BOTAN_DEBUG_ASSERT(x.is_positive());
  ------------------
  |  |   99|  75.0k|      do {                          \
  |  |  100|  75.0k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  224|       |
  225|  75.0k|   static const size_t p224_limbs = (BOTAN_MP_WORD_BITS == 32) ? 7 : 4;
  ------------------
  |  |   50|  75.0k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  |  Branch (225:37): [Folded - Ignored]
  ------------------
  226|       |
  227|  75.0k|   BOTAN_UNUSED(ws);
  ------------------
  |  |  118|  75.0k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  228|       |
  229|  75.0k|   x.grow_to(2 * p224_limbs);
  230|  75.0k|   word* xw = x.mutable_data();
  231|       |
  232|  75.0k|   const int64_t X00 = get_uint32(xw, 0);
  233|  75.0k|   const int64_t X01 = get_uint32(xw, 1);
  234|  75.0k|   const int64_t X02 = get_uint32(xw, 2);
  235|  75.0k|   const int64_t X03 = get_uint32(xw, 3);
  236|  75.0k|   const int64_t X04 = get_uint32(xw, 4);
  237|  75.0k|   const int64_t X05 = get_uint32(xw, 5);
  238|  75.0k|   const int64_t X06 = get_uint32(xw, 6);
  239|  75.0k|   const int64_t X07 = get_uint32(xw, 7);
  240|  75.0k|   const int64_t X08 = get_uint32(xw, 8);
  241|  75.0k|   const int64_t X09 = get_uint32(xw, 9);
  242|  75.0k|   const int64_t X10 = get_uint32(xw, 10);
  243|  75.0k|   const int64_t X11 = get_uint32(xw, 11);
  244|  75.0k|   const int64_t X12 = get_uint32(xw, 12);
  245|  75.0k|   const int64_t X13 = get_uint32(xw, 13);
  246|       |
  247|       |   // One full copy of P224 is added, so the result is always positive
  248|       |
  249|  75.0k|   const int64_t S0 = 0x00000001 + X00 - X07 - X11;
  250|  75.0k|   const int64_t S1 = 0x00000000 + X01 - X08 - X12;
  251|  75.0k|   const int64_t S2 = 0x00000000 + X02 - X09 - X13;
  252|  75.0k|   const int64_t S3 = 0xFFFFFFFF + X03 + X07 + X11 - X10;
  253|  75.0k|   const int64_t S4 = 0xFFFFFFFF + X04 + X08 + X12 - X11;
  254|  75.0k|   const int64_t S5 = 0xFFFFFFFF + X05 + X09 + X13 - X12;
  255|  75.0k|   const int64_t S6 = 0xFFFFFFFF + X06 + X10 - X13;
  256|       |
  257|  75.0k|   int64_t S = 0;
  258|  75.0k|   uint32_t R0 = 0, R1 = 0;
  259|       |
  260|  75.0k|   S += S0;
  261|  75.0k|   R0 = static_cast<uint32_t>(S);
  262|  75.0k|   S >>= 32;
  263|       |
  264|  75.0k|   S += S1;
  265|  75.0k|   R1 = static_cast<uint32_t>(S);
  266|  75.0k|   S >>= 32;
  267|       |
  268|  75.0k|   set_words(xw, 0, R0, R1);
  269|       |
  270|  75.0k|   S += S2;
  271|  75.0k|   R0 = static_cast<uint32_t>(S);
  272|  75.0k|   S >>= 32;
  273|       |
  274|  75.0k|   S += S3;
  275|  75.0k|   R1 = static_cast<uint32_t>(S);
  276|  75.0k|   S >>= 32;
  277|       |
  278|  75.0k|   set_words(xw, 2, R0, R1);
  279|       |
  280|  75.0k|   S += S4;
  281|  75.0k|   R0 = static_cast<uint32_t>(S);
  282|  75.0k|   S >>= 32;
  283|       |
  284|  75.0k|   S += S5;
  285|  75.0k|   R1 = static_cast<uint32_t>(S);
  286|  75.0k|   S >>= 32;
  287|       |
  288|  75.0k|   set_words(xw, 4, R0, R1);
  289|       |
  290|  75.0k|   S += S6;
  291|  75.0k|   R0 = static_cast<uint32_t>(S);
  292|  75.0k|   S >>= 32;
  293|       |
  294|  75.0k|   set_words(xw, 6, R0, 0);
  295|       |
  296|  75.0k|   static const word p224_mults[3][p224_limbs] = {
  297|  75.0k|#if(BOTAN_MP_WORD_BITS == 64)
  298|  75.0k|      {0x0000000000000001, 0xFFFFFFFF00000000, 0xFFFFFFFFFFFFFFFF, 0x00000000FFFFFFFF},
  299|  75.0k|      {0x0000000000000002, 0xFFFFFFFE00000000, 0xFFFFFFFFFFFFFFFF, 0x00000000FFFFFFFF},
  300|  75.0k|      {0x0000000000000003, 0xFFFFFFFD00000000, 0xFFFFFFFFFFFFFFFF, 0x00000000FFFFFFFF},
  301|       |#else
  302|       |      {0x00000001, 0x00000000, 0x00000000, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF},
  303|       |      {0x00000002, 0x00000000, 0x00000000, 0xFFFFFFFE, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF},
  304|       |      {0x00000003, 0x00000000, 0x00000000, 0xFFFFFFFD, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF}
  305|       |#endif
  306|       |
  307|  75.0k|   };
  308|       |
  309|  75.0k|   CT::unpoison(S);
  310|  75.0k|   BOTAN_ASSERT(S >= 0 && S <= 2, "Expected overflow");
  ------------------
  |  |   51|  75.0k|   do {                                                                                 \
  |  |   52|   150k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:12): [True: 75.0k, False: 0]
  |  |  |  Branch (52:12): [True: 75.0k, False: 0]
  |  |  ------------------
  |  |   53|  75.0k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  75.0k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  311|       |
  312|  75.0k|   BOTAN_ASSERT_NOMSG(x.size() >= p224_limbs + 1);
  ------------------
  |  |   60|  75.0k|   do {                                                                     \
  |  |   61|  75.0k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 75.0k]
  |  |  ------------------
  |  |   62|  75.0k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  75.0k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  313|  75.0k|   x.mask_bits(224);
  314|  75.0k|   word borrow = bigint_sub2(x.mutable_data(), p224_limbs + 1, p224_mults[S], p224_limbs);
  315|  75.0k|   BOTAN_DEBUG_ASSERT(borrow == 0 || borrow == 1);
  ------------------
  |  |   99|  75.0k|      do {                          \
  |  |  100|  75.0k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  316|  75.0k|   bigint_cnd_add(borrow, x.mutable_data(), p224_limbs + 1, p224_mults[0], p224_limbs);
  317|  75.0k|}
_ZN5Botan10prime_p256Ev:
  319|  5.70k|const BigInt& prime_p256() {
  320|  5.70k|   static const BigInt p256("0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF");
  321|  5.70k|   return p256;
  322|  5.70k|}
_ZN5Botan9redc_p256ERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  324|  58.9k|void redc_p256(BigInt& x, secure_vector<word>& ws) {
  325|  58.9k|   BOTAN_DEBUG_ASSERT(x.is_positive());
  ------------------
  |  |   99|  58.9k|      do {                          \
  |  |  100|  58.9k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  326|       |
  327|  58.9k|   static const size_t p256_limbs = (BOTAN_MP_WORD_BITS == 32) ? 8 : 4;
  ------------------
  |  |   50|  58.9k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  |  Branch (327:37): [Folded - Ignored]
  ------------------
  328|       |
  329|  58.9k|   BOTAN_UNUSED(ws);
  ------------------
  |  |  118|  58.9k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  330|       |
  331|  58.9k|   x.grow_to(2 * p256_limbs);
  332|  58.9k|   word* xw = x.mutable_data();
  333|       |
  334|  58.9k|   const int64_t X00 = get_uint32(xw, 0);
  335|  58.9k|   const int64_t X01 = get_uint32(xw, 1);
  336|  58.9k|   const int64_t X02 = get_uint32(xw, 2);
  337|  58.9k|   const int64_t X03 = get_uint32(xw, 3);
  338|  58.9k|   const int64_t X04 = get_uint32(xw, 4);
  339|  58.9k|   const int64_t X05 = get_uint32(xw, 5);
  340|  58.9k|   const int64_t X06 = get_uint32(xw, 6);
  341|  58.9k|   const int64_t X07 = get_uint32(xw, 7);
  342|  58.9k|   const int64_t X08 = get_uint32(xw, 8);
  343|  58.9k|   const int64_t X09 = get_uint32(xw, 9);
  344|  58.9k|   const int64_t X10 = get_uint32(xw, 10);
  345|  58.9k|   const int64_t X11 = get_uint32(xw, 11);
  346|  58.9k|   const int64_t X12 = get_uint32(xw, 12);
  347|  58.9k|   const int64_t X13 = get_uint32(xw, 13);
  348|  58.9k|   const int64_t X14 = get_uint32(xw, 14);
  349|  58.9k|   const int64_t X15 = get_uint32(xw, 15);
  350|       |
  351|       |   // Adds 6 * P-256 to prevent underflow
  352|  58.9k|   const int64_t S0 = 0xFFFFFFFA + X00 + X08 + X09 - (X11 + X12 + X13) - X14;
  353|  58.9k|   const int64_t S1 = 0xFFFFFFFF + X01 + X09 + X10 - X12 - (X13 + X14 + X15);
  354|  58.9k|   const int64_t S2 = 0xFFFFFFFF + X02 + X10 + X11 - (X13 + X14 + X15);
  355|  58.9k|   const int64_t S3 = 0x00000005 + X03 + (X11 + X12) * 2 + X13 - X15 - X08 - X09;
  356|  58.9k|   const int64_t S4 = 0x00000000 + X04 + (X12 + X13) * 2 + X14 - X09 - X10;
  357|  58.9k|   const int64_t S5 = 0x00000000 + X05 + (X13 + X14) * 2 + X15 - X10 - X11;
  358|  58.9k|   const int64_t S6 = 0x00000006 + X06 + X13 + X14 * 3 + X15 * 2 - X08 - X09;
  359|  58.9k|   const int64_t S7 = 0xFFFFFFFA + X07 + X15 * 3 + X08 - X10 - (X11 + X12 + X13);
  360|       |
  361|  58.9k|   int64_t S = 0;
  362|       |
  363|  58.9k|   uint32_t R0 = 0, R1 = 0;
  364|       |
  365|  58.9k|   S += S0;
  366|  58.9k|   R0 = static_cast<uint32_t>(S);
  367|  58.9k|   S >>= 32;
  368|       |
  369|  58.9k|   S += S1;
  370|  58.9k|   R1 = static_cast<uint32_t>(S);
  371|  58.9k|   S >>= 32;
  372|       |
  373|  58.9k|   set_words(xw, 0, R0, R1);
  374|       |
  375|  58.9k|   S += S2;
  376|  58.9k|   R0 = static_cast<uint32_t>(S);
  377|  58.9k|   S >>= 32;
  378|       |
  379|  58.9k|   S += S3;
  380|  58.9k|   R1 = static_cast<uint32_t>(S);
  381|  58.9k|   S >>= 32;
  382|       |
  383|  58.9k|   set_words(xw, 2, R0, R1);
  384|       |
  385|  58.9k|   S += S4;
  386|  58.9k|   R0 = static_cast<uint32_t>(S);
  387|  58.9k|   S >>= 32;
  388|       |
  389|  58.9k|   S += S5;
  390|  58.9k|   R1 = static_cast<uint32_t>(S);
  391|  58.9k|   S >>= 32;
  392|       |
  393|  58.9k|   set_words(xw, 4, R0, R1);
  394|       |
  395|  58.9k|   S += S6;
  396|  58.9k|   R0 = static_cast<uint32_t>(S);
  397|  58.9k|   S >>= 32;
  398|       |
  399|  58.9k|   S += S7;
  400|  58.9k|   R1 = static_cast<uint32_t>(S);
  401|  58.9k|   S >>= 32;
  402|  58.9k|   set_words(xw, 6, R0, R1);
  403|       |
  404|  58.9k|   S += 5;  // the top digits of 6*P-256
  405|       |
  406|       |   /*
  407|       |   This is a table of (i*P-256) % 2**256 for i in 1...10
  408|       |   */
  409|  58.9k|   static const word p256_mults[11][p256_limbs] = {
  410|  58.9k|#if(BOTAN_MP_WORD_BITS == 64)
  411|  58.9k|      {0xFFFFFFFFFFFFFFFF, 0x00000000FFFFFFFF, 0x0000000000000000, 0xFFFFFFFF00000001},
  412|  58.9k|      {0xFFFFFFFFFFFFFFFE, 0x00000001FFFFFFFF, 0x0000000000000000, 0xFFFFFFFE00000002},
  413|  58.9k|      {0xFFFFFFFFFFFFFFFD, 0x00000002FFFFFFFF, 0x0000000000000000, 0xFFFFFFFD00000003},
  414|  58.9k|      {0xFFFFFFFFFFFFFFFC, 0x00000003FFFFFFFF, 0x0000000000000000, 0xFFFFFFFC00000004},
  415|  58.9k|      {0xFFFFFFFFFFFFFFFB, 0x00000004FFFFFFFF, 0x0000000000000000, 0xFFFFFFFB00000005},
  416|  58.9k|      {0xFFFFFFFFFFFFFFFA, 0x00000005FFFFFFFF, 0x0000000000000000, 0xFFFFFFFA00000006},
  417|  58.9k|      {0xFFFFFFFFFFFFFFF9, 0x00000006FFFFFFFF, 0x0000000000000000, 0xFFFFFFF900000007},
  418|  58.9k|      {0xFFFFFFFFFFFFFFF8, 0x00000007FFFFFFFF, 0x0000000000000000, 0xFFFFFFF800000008},
  419|  58.9k|      {0xFFFFFFFFFFFFFFF7, 0x00000008FFFFFFFF, 0x0000000000000000, 0xFFFFFFF700000009},
  420|  58.9k|      {0xFFFFFFFFFFFFFFF6, 0x00000009FFFFFFFF, 0x0000000000000000, 0xFFFFFFF60000000A},
  421|  58.9k|      {0xFFFFFFFFFFFFFFF5, 0x0000000AFFFFFFFF, 0x0000000000000000, 0xFFFFFFF50000000B},
  422|       |#else
  423|       |      {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000000, 0x00000000, 0x00000000, 0x00000001, 0xFFFFFFFF},
  424|       |      {0xFFFFFFFE, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000001, 0x00000000, 0x00000000, 0x00000002, 0xFFFFFFFE},
  425|       |      {0xFFFFFFFD, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000002, 0x00000000, 0x00000000, 0x00000003, 0xFFFFFFFD},
  426|       |      {0xFFFFFFFC, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000003, 0x00000000, 0x00000000, 0x00000004, 0xFFFFFFFC},
  427|       |      {0xFFFFFFFB, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000004, 0x00000000, 0x00000000, 0x00000005, 0xFFFFFFFB},
  428|       |      {0xFFFFFFFA, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000005, 0x00000000, 0x00000000, 0x00000006, 0xFFFFFFFA},
  429|       |      {0xFFFFFFF9, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000006, 0x00000000, 0x00000000, 0x00000007, 0xFFFFFFF9},
  430|       |      {0xFFFFFFF8, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000007, 0x00000000, 0x00000000, 0x00000008, 0xFFFFFFF8},
  431|       |      {0xFFFFFFF7, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000008, 0x00000000, 0x00000000, 0x00000009, 0xFFFFFFF7},
  432|       |      {0xFFFFFFF6, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000009, 0x00000000, 0x00000000, 0x0000000A, 0xFFFFFFF6},
  433|       |      {0xFFFFFFF5, 0xFFFFFFFF, 0xFFFFFFFF, 0x0000000A, 0x00000000, 0x00000000, 0x0000000B, 0xFFFFFFF5},
  434|       |#endif
  435|  58.9k|   };
  436|       |
  437|  58.9k|   CT::unpoison(S);
  438|  58.9k|   BOTAN_ASSERT(S >= 0 && S <= 10, "Expected overflow");
  ------------------
  |  |   51|  58.9k|   do {                                                                                 \
  |  |   52|   117k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:12): [True: 58.9k, False: 0]
  |  |  |  Branch (52:12): [True: 58.9k, False: 0]
  |  |  ------------------
  |  |   53|  58.9k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  58.9k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  439|       |
  440|  58.9k|   BOTAN_ASSERT_NOMSG(x.size() >= p256_limbs + 1);
  ------------------
  |  |   60|  58.9k|   do {                                                                     \
  |  |   61|  58.9k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 58.9k]
  |  |  ------------------
  |  |   62|  58.9k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  58.9k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  441|  58.9k|   x.mask_bits(256);
  442|  58.9k|   word borrow = bigint_sub2(x.mutable_data(), p256_limbs + 1, p256_mults[S], p256_limbs);
  443|  58.9k|   BOTAN_DEBUG_ASSERT(borrow == 0 || borrow == 1);
  ------------------
  |  |   99|  58.9k|      do {                          \
  |  |  100|  58.9k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  444|  58.9k|   bigint_cnd_add(borrow, x.mutable_data(), p256_limbs + 1, p256_mults[0], p256_limbs);
  445|  58.9k|}
_ZN5Botan10prime_p384Ev:
  447|  19.8k|const BigInt& prime_p384() {
  448|  19.8k|   static const BigInt p384(
  449|  19.8k|      "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFF");
  450|  19.8k|   return p384;
  451|  19.8k|}
_ZN5Botan9redc_p384ERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  453|   240k|void redc_p384(BigInt& x, secure_vector<word>& ws) {
  454|   240k|   BOTAN_DEBUG_ASSERT(x.is_positive());
  ------------------
  |  |   99|   240k|      do {                          \
  |  |  100|   240k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  455|       |
  456|   240k|   BOTAN_UNUSED(ws);
  ------------------
  |  |  118|   240k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  457|       |
  458|   240k|   static const size_t p384_limbs = (BOTAN_MP_WORD_BITS == 32) ? 12 : 6;
  ------------------
  |  |   50|   240k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  |  Branch (458:37): [Folded - Ignored]
  ------------------
  459|       |
  460|   240k|   x.grow_to(2 * p384_limbs);
  461|   240k|   word* xw = x.mutable_data();
  462|       |
  463|   240k|   const int64_t X00 = get_uint32(xw, 0);
  464|   240k|   const int64_t X01 = get_uint32(xw, 1);
  465|   240k|   const int64_t X02 = get_uint32(xw, 2);
  466|   240k|   const int64_t X03 = get_uint32(xw, 3);
  467|   240k|   const int64_t X04 = get_uint32(xw, 4);
  468|   240k|   const int64_t X05 = get_uint32(xw, 5);
  469|   240k|   const int64_t X06 = get_uint32(xw, 6);
  470|   240k|   const int64_t X07 = get_uint32(xw, 7);
  471|   240k|   const int64_t X08 = get_uint32(xw, 8);
  472|   240k|   const int64_t X09 = get_uint32(xw, 9);
  473|   240k|   const int64_t X10 = get_uint32(xw, 10);
  474|   240k|   const int64_t X11 = get_uint32(xw, 11);
  475|   240k|   const int64_t X12 = get_uint32(xw, 12);
  476|   240k|   const int64_t X13 = get_uint32(xw, 13);
  477|   240k|   const int64_t X14 = get_uint32(xw, 14);
  478|   240k|   const int64_t X15 = get_uint32(xw, 15);
  479|   240k|   const int64_t X16 = get_uint32(xw, 16);
  480|   240k|   const int64_t X17 = get_uint32(xw, 17);
  481|   240k|   const int64_t X18 = get_uint32(xw, 18);
  482|   240k|   const int64_t X19 = get_uint32(xw, 19);
  483|   240k|   const int64_t X20 = get_uint32(xw, 20);
  484|   240k|   const int64_t X21 = get_uint32(xw, 21);
  485|   240k|   const int64_t X22 = get_uint32(xw, 22);
  486|   240k|   const int64_t X23 = get_uint32(xw, 23);
  487|       |
  488|       |   // One copy of P-384 is added to prevent underflow
  489|   240k|   const int64_t S0 = 0xFFFFFFFF + X00 + X12 + X20 + X21 - X23;
  490|   240k|   const int64_t S1 = 0x00000000 + X01 + X13 + X22 + X23 - X12 - X20;
  491|   240k|   const int64_t S2 = 0x00000000 + X02 + X14 + X23 - X13 - X21;
  492|   240k|   const int64_t S3 = 0xFFFFFFFF + X03 + X12 + X15 + X20 + X21 - X14 - X22 - X23;
  493|   240k|   const int64_t S4 = 0xFFFFFFFE + X04 + X12 + X13 + X16 + X20 + X21 * 2 + X22 - X15 - X23 * 2;
  494|   240k|   const int64_t S5 = 0xFFFFFFFF + X05 + X13 + X14 + X17 + X21 + X22 * 2 + X23 - X16;
  495|   240k|   const int64_t S6 = 0xFFFFFFFF + X06 + X14 + X15 + X18 + X22 + X23 * 2 - X17;
  496|   240k|   const int64_t S7 = 0xFFFFFFFF + X07 + X15 + X16 + X19 + X23 - X18;
  497|   240k|   const int64_t S8 = 0xFFFFFFFF + X08 + X16 + X17 + X20 - X19;
  498|   240k|   const int64_t S9 = 0xFFFFFFFF + X09 + X17 + X18 + X21 - X20;
  499|   240k|   const int64_t SA = 0xFFFFFFFF + X10 + X18 + X19 + X22 - X21;
  500|   240k|   const int64_t SB = 0xFFFFFFFF + X11 + X19 + X20 + X23 - X22;
  501|       |
  502|   240k|   int64_t S = 0;
  503|       |
  504|   240k|   uint32_t R0 = 0, R1 = 0;
  505|       |
  506|   240k|   S += S0;
  507|   240k|   R0 = static_cast<uint32_t>(S);
  508|   240k|   S >>= 32;
  509|       |
  510|   240k|   S += S1;
  511|   240k|   R1 = static_cast<uint32_t>(S);
  512|   240k|   S >>= 32;
  513|       |
  514|   240k|   set_words(xw, 0, R0, R1);
  515|       |
  516|   240k|   S += S2;
  517|   240k|   R0 = static_cast<uint32_t>(S);
  518|   240k|   S >>= 32;
  519|       |
  520|   240k|   S += S3;
  521|   240k|   R1 = static_cast<uint32_t>(S);
  522|   240k|   S >>= 32;
  523|       |
  524|   240k|   set_words(xw, 2, R0, R1);
  525|       |
  526|   240k|   S += S4;
  527|   240k|   R0 = static_cast<uint32_t>(S);
  528|   240k|   S >>= 32;
  529|       |
  530|   240k|   S += S5;
  531|   240k|   R1 = static_cast<uint32_t>(S);
  532|   240k|   S >>= 32;
  533|       |
  534|   240k|   set_words(xw, 4, R0, R1);
  535|       |
  536|   240k|   S += S6;
  537|   240k|   R0 = static_cast<uint32_t>(S);
  538|   240k|   S >>= 32;
  539|       |
  540|   240k|   S += S7;
  541|   240k|   R1 = static_cast<uint32_t>(S);
  542|   240k|   S >>= 32;
  543|       |
  544|   240k|   set_words(xw, 6, R0, R1);
  545|       |
  546|   240k|   S += S8;
  547|   240k|   R0 = static_cast<uint32_t>(S);
  548|   240k|   S >>= 32;
  549|       |
  550|   240k|   S += S9;
  551|   240k|   R1 = static_cast<uint32_t>(S);
  552|   240k|   S >>= 32;
  553|       |
  554|   240k|   set_words(xw, 8, R0, R1);
  555|       |
  556|   240k|   S += SA;
  557|   240k|   R0 = static_cast<uint32_t>(S);
  558|   240k|   S >>= 32;
  559|       |
  560|   240k|   S += SB;
  561|   240k|   R1 = static_cast<uint32_t>(S);
  562|   240k|   S >>= 32;
  563|       |
  564|   240k|   set_words(xw, 10, R0, R1);
  565|       |
  566|       |   /*
  567|       |   This is a table of (i*P-384) % 2**384 for i in 1...4
  568|       |   */
  569|   240k|   static const word p384_mults[5][p384_limbs] = {
  570|   240k|#if(BOTAN_MP_WORD_BITS == 64)
  571|   240k|      {0x00000000FFFFFFFF,
  572|   240k|       0xFFFFFFFF00000000,
  573|   240k|       0xFFFFFFFFFFFFFFFE,
  574|   240k|       0xFFFFFFFFFFFFFFFF,
  575|   240k|       0xFFFFFFFFFFFFFFFF,
  576|   240k|       0xFFFFFFFFFFFFFFFF},
  577|   240k|      {0x00000001FFFFFFFE,
  578|   240k|       0xFFFFFFFE00000000,
  579|   240k|       0xFFFFFFFFFFFFFFFD,
  580|   240k|       0xFFFFFFFFFFFFFFFF,
  581|   240k|       0xFFFFFFFFFFFFFFFF,
  582|   240k|       0xFFFFFFFFFFFFFFFF},
  583|   240k|      {0x00000002FFFFFFFD,
  584|   240k|       0xFFFFFFFD00000000,
  585|   240k|       0xFFFFFFFFFFFFFFFC,
  586|   240k|       0xFFFFFFFFFFFFFFFF,
  587|   240k|       0xFFFFFFFFFFFFFFFF,
  588|   240k|       0xFFFFFFFFFFFFFFFF},
  589|   240k|      {0x00000003FFFFFFFC,
  590|   240k|       0xFFFFFFFC00000000,
  591|   240k|       0xFFFFFFFFFFFFFFFB,
  592|   240k|       0xFFFFFFFFFFFFFFFF,
  593|   240k|       0xFFFFFFFFFFFFFFFF,
  594|   240k|       0xFFFFFFFFFFFFFFFF},
  595|   240k|      {0x00000004FFFFFFFB,
  596|   240k|       0xFFFFFFFB00000000,
  597|   240k|       0xFFFFFFFFFFFFFFFA,
  598|   240k|       0xFFFFFFFFFFFFFFFF,
  599|   240k|       0xFFFFFFFFFFFFFFFF,
  600|   240k|       0xFFFFFFFFFFFFFFFF},
  601|       |
  602|       |#else
  603|       |      {0xFFFFFFFF,
  604|       |       0x00000000,
  605|       |       0x00000000,
  606|       |       0xFFFFFFFF,
  607|       |       0xFFFFFFFE,
  608|       |       0xFFFFFFFF,
  609|       |       0xFFFFFFFF,
  610|       |       0xFFFFFFFF,
  611|       |       0xFFFFFFFF,
  612|       |       0xFFFFFFFF,
  613|       |       0xFFFFFFFF,
  614|       |       0xFFFFFFFF},
  615|       |      {0xFFFFFFFE,
  616|       |       0x00000001,
  617|       |       0x00000000,
  618|       |       0xFFFFFFFE,
  619|       |       0xFFFFFFFD,
  620|       |       0xFFFFFFFF,
  621|       |       0xFFFFFFFF,
  622|       |       0xFFFFFFFF,
  623|       |       0xFFFFFFFF,
  624|       |       0xFFFFFFFF,
  625|       |       0xFFFFFFFF,
  626|       |       0xFFFFFFFF},
  627|       |      {0xFFFFFFFD,
  628|       |       0x00000002,
  629|       |       0x00000000,
  630|       |       0xFFFFFFFD,
  631|       |       0xFFFFFFFC,
  632|       |       0xFFFFFFFF,
  633|       |       0xFFFFFFFF,
  634|       |       0xFFFFFFFF,
  635|       |       0xFFFFFFFF,
  636|       |       0xFFFFFFFF,
  637|       |       0xFFFFFFFF,
  638|       |       0xFFFFFFFF},
  639|       |      {0xFFFFFFFC,
  640|       |       0x00000003,
  641|       |       0x00000000,
  642|       |       0xFFFFFFFC,
  643|       |       0xFFFFFFFB,
  644|       |       0xFFFFFFFF,
  645|       |       0xFFFFFFFF,
  646|       |       0xFFFFFFFF,
  647|       |       0xFFFFFFFF,
  648|       |       0xFFFFFFFF,
  649|       |       0xFFFFFFFF,
  650|       |       0xFFFFFFFF},
  651|       |      {0xFFFFFFFB,
  652|       |       0x00000004,
  653|       |       0x00000000,
  654|       |       0xFFFFFFFB,
  655|       |       0xFFFFFFFA,
  656|       |       0xFFFFFFFF,
  657|       |       0xFFFFFFFF,
  658|       |       0xFFFFFFFF,
  659|       |       0xFFFFFFFF,
  660|       |       0xFFFFFFFF,
  661|       |       0xFFFFFFFF,
  662|       |       0xFFFFFFFF},
  663|       |#endif
  664|   240k|   };
  665|       |
  666|   240k|   CT::unpoison(S);
  667|   240k|   BOTAN_ASSERT(S >= 0 && S <= 4, "Expected overflow");
  ------------------
  |  |   51|   240k|   do {                                                                                 \
  |  |   52|   480k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:12): [True: 240k, False: 0]
  |  |  |  Branch (52:12): [True: 240k, False: 0]
  |  |  ------------------
  |  |   53|   240k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|   240k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  668|       |
  669|   240k|   BOTAN_ASSERT_NOMSG(x.size() >= p384_limbs + 1);
  ------------------
  |  |   60|   240k|   do {                                                                     \
  |  |   61|   240k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 240k]
  |  |  ------------------
  |  |   62|   240k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|   240k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  670|   240k|   x.mask_bits(384);
  671|   240k|   word borrow = bigint_sub2(x.mutable_data(), p384_limbs + 1, p384_mults[S], p384_limbs);
  672|   240k|   BOTAN_DEBUG_ASSERT(borrow == 0 || borrow == 1);
  ------------------
  |  |   99|   240k|      do {                          \
  |  |  100|   240k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  673|   240k|   bigint_cnd_add(borrow, x.mutable_data(), p384_limbs + 1, p384_mults[0], p384_limbs);
  674|   240k|}
nistp_redc.cpp:_ZN5Botan12_GLOBAL__N_110get_uint32EPKmm:
  103|  8.89M|inline uint32_t get_uint32(const word xw[], size_t i) {
  104|       |#if(BOTAN_MP_WORD_BITS == 32)
  105|       |   return xw[i];
  106|       |#else
  107|  8.89M|   return static_cast<uint32_t>(xw[i / 2] >> ((i % 2) * 32));
  108|  8.89M|#endif
  109|  8.89M|}
nistp_redc.cpp:_ZN5Botan12_GLOBAL__N_19set_wordsEPmmjj:
  111|  2.26M|inline void set_words(word x[], size_t i, uint32_t R0, uint32_t R1) {
  112|       |#if(BOTAN_MP_WORD_BITS == 32)
  113|       |   x[i] = R0;
  114|       |   x[i + 1] = R1;
  115|       |#else
  116|  2.26M|   x[i / 2] = (static_cast<uint64_t>(R1) << 32) | R0;
  117|  2.26M|#endif
  118|  2.26M|}

_ZN5Botan17sqrt_modulo_primeERKNS_6BigIntES2_:
   26|  1.55k|BigInt sqrt_modulo_prime(const BigInt& a, const BigInt& p) {
   27|  1.55k|   BOTAN_ARG_CHECK(p > 1, "invalid prime");
  ------------------
  |  |   30|  1.55k|   do {                                                          \
  |  |   31|  1.55k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 1.55k]
  |  |  ------------------
  |  |   32|  1.55k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  1.55k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   28|  1.55k|   BOTAN_ARG_CHECK(a < p, "value to solve for must be less than p");
  ------------------
  |  |   30|  1.55k|   do {                                                          \
  |  |   31|  1.55k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 1.55k]
  |  |  ------------------
  |  |   32|  1.55k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  1.55k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   29|  1.55k|   BOTAN_ARG_CHECK(a >= 0, "value to solve for must not be negative");
  ------------------
  |  |   30|  1.55k|   do {                                                          \
  |  |   31|  1.55k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 1.55k]
  |  |  ------------------
  |  |   32|  1.55k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  1.55k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   30|       |
   31|       |   // some very easy cases
   32|  1.55k|   if(p == 2 || a <= 1) {
  ------------------
  |  Branch (32:7): [True: 0, False: 1.55k]
  |  Branch (32:17): [True: 0, False: 1.55k]
  ------------------
   33|      0|      return a;
   34|      0|   }
   35|       |
   36|  1.55k|   BOTAN_ARG_CHECK(p.is_odd(), "invalid prime");
  ------------------
  |  |   30|  1.55k|   do {                                                          \
  |  |   31|  1.55k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 1.55k]
  |  |  ------------------
  |  |   32|  1.55k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  1.55k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   37|       |
   38|  1.55k|   if(jacobi(a, p) != 1) {  // not a quadratic residue
  ------------------
  |  Branch (38:7): [True: 338, False: 1.21k]
  ------------------
   39|    338|      return BigInt::from_s32(-1);
   40|    338|   }
   41|       |
   42|  1.21k|   Modular_Reducer mod_p(p);
   43|  1.21k|   auto monty_p = std::make_shared<Montgomery_Params>(p, mod_p);
   44|       |
   45|       |   // If p == 3 (mod 4) there is a simple solution
   46|  1.21k|   if(p % 4 == 3) {
  ------------------
  |  Branch (46:7): [True: 610, False: 602]
  ------------------
   47|    610|      return monty_exp_vartime(monty_p, a, ((p + 1) >> 2));
   48|    610|   }
   49|       |
   50|       |   // Otherwise we have to use Shanks-Tonelli
   51|    602|   size_t s = low_zero_bits(p - 1);
   52|    602|   BigInt q = p >> s;
   53|       |
   54|    602|   q -= 1;
   55|    602|   q >>= 1;
   56|       |
   57|    602|   BigInt r = monty_exp_vartime(monty_p, a, q);
   58|    602|   BigInt n = mod_p.multiply(a, mod_p.square(r));
   59|    602|   r = mod_p.multiply(r, a);
   60|       |
   61|    602|   if(n == 1) {
  ------------------
  |  Branch (61:7): [True: 64, False: 538]
  ------------------
   62|     64|      return r;
   63|     64|   }
   64|       |
   65|       |   // find random quadratic nonresidue z
   66|    538|   word z = 2;
   67|  5.89k|   for(;;) {
   68|  5.89k|      if(jacobi(BigInt::from_word(z), p) == -1) {  // found one
  ------------------
  |  Branch (68:10): [True: 538, False: 5.35k]
  ------------------
   69|    538|         break;
   70|    538|      }
   71|       |
   72|  5.35k|      z += 1;  // try next z
   73|       |
   74|       |      /*
   75|       |      * The expected number of tests to find a non-residue modulo a
   76|       |      * prime is 2. If we have not found one after 256 then almost
   77|       |      * certainly we have been given a non-prime p.
   78|       |      */
   79|  5.35k|      if(z >= 256) {
  ------------------
  |  Branch (79:10): [True: 0, False: 5.35k]
  ------------------
   80|      0|         return BigInt::from_s32(-1);
   81|      0|      }
   82|  5.35k|   }
   83|       |
   84|    538|   BigInt c = monty_exp_vartime(monty_p, BigInt::from_word(z), (q << 1) + 1);
   85|       |
   86|  13.7k|   while(n > 1) {
  ------------------
  |  Branch (86:10): [True: 13.2k, False: 538]
  ------------------
   87|  13.2k|      q = n;
   88|       |
   89|  13.2k|      size_t i = 0;
   90|   679k|      while(q != 1) {
  ------------------
  |  Branch (90:13): [True: 666k, False: 13.2k]
  ------------------
   91|   666k|         q = mod_p.square(q);
   92|   666k|         ++i;
   93|       |
   94|   666k|         if(i >= s) {
  ------------------
  |  Branch (94:13): [True: 0, False: 666k]
  ------------------
   95|      0|            return BigInt::from_s32(-1);
   96|      0|         }
   97|   666k|      }
   98|       |
   99|  13.2k|      BOTAN_ASSERT_NOMSG(s >= (i + 1));  // No underflow!
  ------------------
  |  |   60|  13.2k|   do {                                                                     \
  |  |   61|  13.2k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 13.2k]
  |  |  ------------------
  |  |   62|  13.2k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  13.2k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  100|  13.2k|      c = monty_exp_vartime(monty_p, c, BigInt::power_of_2(s - i - 1));
  101|  13.2k|      r = mod_p.multiply(r, c);
  102|  13.2k|      c = mod_p.square(c);
  103|  13.2k|      n = mod_p.multiply(n, c);
  104|       |
  105|       |      // s decreases as the algorithm proceeds
  106|  13.2k|      BOTAN_ASSERT_NOMSG(s >= i);
  ------------------
  |  |   60|  13.2k|   do {                                                                     \
  |  |   61|  13.2k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 13.2k]
  |  |  ------------------
  |  |   62|  13.2k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  13.2k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  107|  13.2k|      s = i;
  108|  13.2k|   }
  109|       |
  110|    538|   return r;
  111|    538|}
_ZN5Botan6jacobiERKNS_6BigIntES2_:
  116|  12.6k|int32_t jacobi(const BigInt& a, const BigInt& n) {
  117|  12.6k|   if(n.is_even() || n < 2) {
  ------------------
  |  Branch (117:7): [True: 0, False: 12.6k]
  |  Branch (117:22): [True: 0, False: 12.6k]
  ------------------
  118|      0|      throw Invalid_Argument("jacobi: second argument must be odd and > 1");
  119|      0|   }
  120|       |
  121|  12.6k|   BigInt x = a % n;
  122|  12.6k|   BigInt y = n;
  123|  12.6k|   int32_t J = 1;
  124|       |
  125|   143k|   while(y > 1) {
  ------------------
  |  Branch (125:10): [True: 130k, False: 12.6k]
  ------------------
  126|   130k|      x %= y;
  127|   130k|      if(x > y / 2) {
  ------------------
  |  Branch (127:10): [True: 56.0k, False: 74.7k]
  ------------------
  128|  56.0k|         x = y - x;
  129|  56.0k|         if(y % 4 == 3) {
  ------------------
  |  Branch (129:13): [True: 27.1k, False: 28.9k]
  ------------------
  130|  27.1k|            J = -J;
  131|  27.1k|         }
  132|  56.0k|      }
  133|   130k|      if(x.is_zero()) {
  ------------------
  |  Branch (133:10): [True: 0, False: 130k]
  ------------------
  134|      0|         return 0;
  135|      0|      }
  136|       |
  137|   130k|      size_t shifts = low_zero_bits(x);
  138|   130k|      x >>= shifts;
  139|   130k|      if(shifts % 2) {
  ------------------
  |  Branch (139:10): [True: 40.2k, False: 90.5k]
  ------------------
  140|  40.2k|         word y_mod_8 = y % 8;
  141|  40.2k|         if(y_mod_8 == 3 || y_mod_8 == 5) {
  ------------------
  |  Branch (141:13): [True: 9.31k, False: 30.9k]
  |  Branch (141:29): [True: 9.74k, False: 21.1k]
  ------------------
  142|  19.0k|            J = -J;
  143|  19.0k|         }
  144|  40.2k|      }
  145|       |
  146|   130k|      if(x % 4 == 3 && y % 4 == 3) {
  ------------------
  |  Branch (146:10): [True: 59.4k, False: 71.3k]
  |  Branch (146:24): [True: 28.0k, False: 31.3k]
  ------------------
  147|  28.0k|         J = -J;
  148|  28.0k|      }
  149|   130k|      std::swap(x, y);
  150|   130k|   }
  151|  12.6k|   return J;
  152|  12.6k|}
_ZN5Botan6squareERKNS_6BigIntE:
  157|  1.16M|BigInt square(const BigInt& x) {
  158|  1.16M|   BigInt z = x;
  159|  1.16M|   secure_vector<word> ws;
  160|  1.16M|   z.square(ws);
  161|  1.16M|   return z;
  162|  1.16M|}
_ZN5Botan13low_zero_bitsERKNS_6BigIntE:
  167|   132k|size_t low_zero_bits(const BigInt& n) {
  168|   132k|   size_t low_zero = 0;
  169|       |
  170|   132k|   auto seen_nonempty_word = CT::Mask<word>::cleared();
  171|       |
  172|  1.28M|   for(size_t i = 0; i != n.size(); ++i) {
  ------------------
  |  Branch (172:22): [True: 1.15M, False: 132k]
  ------------------
  173|  1.15M|      const word x = n.word_at(i);
  174|       |
  175|       |      // ctz(0) will return sizeof(word)
  176|  1.15M|      const size_t tz_x = ctz(x);
  177|       |
  178|       |      // if x > 0 we want to count tz_x in total but not any
  179|       |      // further words, so set the mask after the addition
  180|  1.15M|      low_zero += seen_nonempty_word.if_not_set_return(tz_x);
  181|       |
  182|  1.15M|      seen_nonempty_word |= CT::Mask<word>::expand(x);
  183|  1.15M|   }
  184|       |
  185|       |   // if we saw no words with x > 0 then n == 0 and the value we have
  186|       |   // computed is meaningless. Instead return BigInt::zero() in that case.
  187|   132k|   return static_cast<size_t>(seen_nonempty_word.if_set_return(low_zero));
  188|   132k|}
_ZN5Botan17is_perfect_squareERKNS_6BigIntE:
  323|    271|BigInt is_perfect_square(const BigInt& C) {
  324|    271|   if(C < 1) {
  ------------------
  |  Branch (324:7): [True: 0, False: 271]
  ------------------
  325|      0|      throw Invalid_Argument("is_perfect_square requires C >= 1");
  326|      0|   }
  327|    271|   if(C == 1) {
  ------------------
  |  Branch (327:7): [True: 0, False: 271]
  ------------------
  328|      0|      return BigInt::one();
  329|      0|   }
  330|       |
  331|    271|   const size_t n = C.bits();
  332|    271|   const size_t m = (n + 1) / 2;
  333|    271|   const BigInt B = C + BigInt::power_of_2(m);
  334|       |
  335|    271|   BigInt X = BigInt::power_of_2(m) - 1;
  336|    271|   BigInt X2 = (X * X);
  337|       |
  338|  1.61k|   for(;;) {
  339|  1.61k|      X = (X2 + C) / (2 * X);
  340|  1.61k|      X2 = (X * X);
  341|       |
  342|  1.61k|      if(X2 < B) {
  ------------------
  |  Branch (342:10): [True: 271, False: 1.34k]
  ------------------
  343|    271|         break;
  344|    271|      }
  345|  1.61k|   }
  346|       |
  347|    271|   if(X2 == C) {
  ------------------
  |  Branch (347:7): [True: 0, False: 271]
  ------------------
  348|      0|      return X;
  349|    271|   } else {
  350|    271|      return BigInt::zero();
  351|    271|   }
  352|    271|}

_ZN5Botan23is_lucas_probable_primeERKNS_6BigIntERKNS_15Modular_ReducerE:
   18|  1.14k|bool is_lucas_probable_prime(const BigInt& C, const Modular_Reducer& mod_C) {
   19|  1.14k|   if(C == 2 || C == 3 || C == 5 || C == 7 || C == 11 || C == 13) {
  ------------------
  |  Branch (19:7): [True: 0, False: 1.14k]
  |  Branch (19:17): [True: 1, False: 1.14k]
  |  Branch (19:27): [True: 1, False: 1.14k]
  |  Branch (19:37): [True: 1, False: 1.14k]
  |  Branch (19:47): [True: 1, False: 1.14k]
  |  Branch (19:58): [True: 1, False: 1.14k]
  ------------------
   20|      5|      return true;
   21|      5|   }
   22|       |
   23|  1.14k|   if(C <= 1 || C.is_even()) {
  ------------------
  |  Branch (23:7): [True: 0, False: 1.14k]
  |  Branch (23:17): [True: 0, False: 1.14k]
  ------------------
   24|      0|      return false;
   25|      0|   }
   26|       |
   27|  1.14k|   BigInt D = BigInt::from_word(5);
   28|       |
   29|  5.23k|   for(;;) {
   30|  5.23k|      int32_t j = jacobi(D, C);
   31|  5.23k|      if(j == 0) {
  ------------------
  |  Branch (31:10): [True: 0, False: 5.23k]
  ------------------
   32|      0|         return false;
   33|      0|      }
   34|       |
   35|  5.23k|      if(j == -1) {
  ------------------
  |  Branch (35:10): [True: 1.14k, False: 4.09k]
  ------------------
   36|  1.14k|         break;
   37|  1.14k|      }
   38|       |
   39|       |      // Check 5, -7, 9, -11, 13, -15, 17, ...
   40|  4.09k|      if(D.is_negative()) {
  ------------------
  |  Branch (40:10): [True: 1.78k, False: 2.30k]
  ------------------
   41|  1.78k|         D.flip_sign();
   42|  1.78k|         D += 2;
   43|  2.30k|      } else {
   44|  2.30k|         D += 2;
   45|  2.30k|         D.flip_sign();
   46|  2.30k|      }
   47|       |
   48|  4.09k|      if(D == 17 && is_perfect_square(C).is_nonzero()) {
  ------------------
  |  Branch (48:10): [True: 271, False: 3.82k]
  |  Branch (48:10): [True: 0, False: 4.09k]
  |  Branch (48:21): [True: 0, False: 271]
  ------------------
   49|      0|         return false;
   50|      0|      }
   51|  4.09k|   }
   52|       |
   53|  1.14k|   const BigInt K = C + 1;
   54|  1.14k|   const size_t K_bits = K.bits() - 1;
   55|       |
   56|  1.14k|   BigInt U = BigInt::one();
   57|  1.14k|   BigInt V = BigInt::one();
   58|       |
   59|  1.14k|   BigInt Ut, Vt, U2, V2;
   60|       |
   61|   233k|   for(size_t i = 0; i != K_bits; ++i) {
  ------------------
  |  Branch (61:22): [True: 231k, False: 1.14k]
  ------------------
   62|   231k|      const bool k_bit = K.get_bit(K_bits - 1 - i);
   63|       |
   64|   231k|      Ut = mod_C.multiply(U, V);
   65|       |
   66|   231k|      Vt = mod_C.reduce(mod_C.square(V) + mod_C.multiply(D, mod_C.square(U)));
   67|   231k|      Vt.ct_cond_add(Vt.is_odd(), C);
   68|   231k|      Vt >>= 1;
   69|   231k|      Vt = mod_C.reduce(Vt);
   70|       |
   71|   231k|      U = Ut;
   72|   231k|      V = Vt;
   73|       |
   74|   231k|      U2 = mod_C.reduce(Ut + Vt);
   75|   231k|      U2.ct_cond_add(U2.is_odd(), C);
   76|   231k|      U2 >>= 1;
   77|       |
   78|   231k|      V2 = mod_C.reduce(Vt + Ut * D);
   79|   231k|      V2.ct_cond_add(V2.is_odd(), C);
   80|   231k|      V2 >>= 1;
   81|       |
   82|   231k|      U.ct_cond_assign(k_bit, U2);
   83|   231k|      V.ct_cond_assign(k_bit, V2);
   84|   231k|   }
   85|       |
   86|  1.14k|   return (U == 0);
   87|  1.14k|}
_ZN5Botan28is_bailie_psw_probable_primeERKNS_6BigIntERKNS_15Modular_ReducerE:
   89|  1.20k|bool is_bailie_psw_probable_prime(const BigInt& n, const Modular_Reducer& mod_n) {
   90|  1.20k|   if(n == 2) {
  ------------------
  |  Branch (90:7): [True: 2, False: 1.19k]
  ------------------
   91|      2|      return true;
   92|  1.19k|   } else if(n <= 1 || n.is_even()) {
  ------------------
  |  Branch (92:14): [True: 1, False: 1.19k]
  |  Branch (92:24): [True: 1, False: 1.19k]
  ------------------
   93|      2|      return false;
   94|      2|   }
   95|       |
   96|  1.19k|   auto monty_n = std::make_shared<Montgomery_Params>(n, mod_n);
   97|  1.19k|   const auto base = BigInt::from_word(2);
   98|  1.19k|   return passes_miller_rabin_test(n, mod_n, monty_n, base) && is_lucas_probable_prime(n, mod_n);
  ------------------
  |  Branch (98:11): [True: 1.14k, False: 48]
  |  Branch (98:64): [True: 1.14k, False: 1]
  ------------------
   99|  1.20k|}
_ZN5Botan28is_bailie_psw_probable_primeERKNS_6BigIntE:
  101|  1.20k|bool is_bailie_psw_probable_prime(const BigInt& n) {
  102|  1.20k|   Modular_Reducer mod_n(n);
  103|  1.20k|   return is_bailie_psw_probable_prime(n, mod_n);
  104|  1.20k|}
_ZN5Botan24passes_miller_rabin_testERKNS_6BigIntERKNS_15Modular_ReducerERKNSt3__110shared_ptrINS_17Montgomery_ParamsEEES2_:
  109|  1.19k|                              const BigInt& a) {
  110|  1.19k|   if(n < 3 || n.is_even()) {
  ------------------
  |  Branch (110:7): [True: 0, False: 1.19k]
  |  Branch (110:16): [True: 0, False: 1.19k]
  ------------------
  111|      0|      return false;
  112|      0|   }
  113|       |
  114|  1.19k|   BOTAN_ASSERT_NOMSG(n > 1);
  ------------------
  |  |   60|  1.19k|   do {                                                                     \
  |  |   61|  1.19k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 1.19k]
  |  |  ------------------
  |  |   62|  1.19k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  1.19k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  115|       |
  116|  1.19k|   const BigInt n_minus_1 = n - 1;
  117|  1.19k|   const size_t s = low_zero_bits(n_minus_1);
  118|  1.19k|   const BigInt nm1_s = n_minus_1 >> s;
  119|  1.19k|   const size_t n_bits = n.bits();
  120|       |
  121|  1.19k|   const size_t powm_window = 4;
  122|       |
  123|  1.19k|   auto powm_a_n = monty_precompute(monty_n, a, powm_window);
  124|       |
  125|  1.19k|   BigInt y = monty_execute(*powm_a_n, nm1_s, n_bits);
  126|       |
  127|  1.19k|   if(y == 1 || y == n_minus_1) {
  ------------------
  |  Branch (127:7): [True: 185, False: 1.01k]
  |  Branch (127:17): [True: 133, False: 878]
  ------------------
  128|    318|      return true;
  129|    318|   }
  130|       |
  131|  22.0k|   for(size_t i = 1; i != s; ++i) {
  ------------------
  |  Branch (131:22): [True: 21.9k, False: 47]
  ------------------
  132|  21.9k|      y = mod_n.square(y);
  133|       |
  134|  21.9k|      if(y == 1) {  // found a non-trivial square root
  ------------------
  |  Branch (134:10): [True: 1, False: 21.9k]
  ------------------
  135|      1|         return false;
  136|      1|      }
  137|       |
  138|       |      /*
  139|       |      -1 is the trivial square root of unity, so ``a`` is not a
  140|       |      witness for this number - give up
  141|       |      */
  142|  21.9k|      if(y == n_minus_1) {
  ------------------
  |  Branch (142:10): [True: 830, False: 21.1k]
  ------------------
  143|    830|         return true;
  144|    830|      }
  145|  21.9k|   }
  146|       |
  147|     47|   return false;
  148|    878|}

_ZN5Botan15Modular_ReducerC2ERKNS_6BigIntE:
   19|  4.31k|Modular_Reducer::Modular_Reducer(const BigInt& mod) {
   20|  4.31k|   if(mod < 0) {
  ------------------
  |  Branch (20:7): [True: 3, False: 4.31k]
  ------------------
   21|      3|      throw Invalid_Argument("Modular_Reducer: modulus must be positive");
   22|      3|   }
   23|       |
   24|       |   // Left uninitialized if mod == 0
   25|  4.31k|   m_mod_words = 0;
   26|       |
   27|  4.31k|   if(mod > 0) {
  ------------------
  |  Branch (27:7): [True: 4.27k, False: 38]
  ------------------
   28|  4.27k|      m_modulus = mod;
   29|  4.27k|      m_mod_words = m_modulus.sig_words();
   30|       |
   31|       |      // Compute mu = floor(2^{2k} / m)
   32|  4.27k|      m_mu.set_bit(2 * BOTAN_MP_WORD_BITS * m_mod_words);
  ------------------
  |  |   50|  4.27k|#define BOTAN_MP_WORD_BITS 64
  ------------------
   33|  4.27k|      m_mu = ct_divide(m_mu, m_modulus);
   34|  4.27k|   }
   35|  4.31k|}
_ZNK5Botan15Modular_Reducer6reduceERKNS_6BigIntE:
   37|  2.59M|BigInt Modular_Reducer::reduce(const BigInt& x) const {
   38|  2.59M|   BigInt r;
   39|  2.59M|   secure_vector<word> ws;
   40|  2.59M|   reduce(r, x, ws);
   41|  2.59M|   return r;
   42|  2.59M|}
_ZNK5Botan15Modular_Reducer6reduceERNS_6BigIntERKS1_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
   69|  2.59M|void Modular_Reducer::reduce(BigInt& t1, const BigInt& x, secure_vector<word>& ws) const {
   70|  2.59M|   if(&t1 == &x) {
  ------------------
  |  Branch (70:7): [True: 0, False: 2.59M]
  ------------------
   71|      0|      throw Invalid_State("Modular_Reducer arguments cannot alias");
   72|      0|   }
   73|  2.59M|   if(m_mod_words == 0) {
  ------------------
  |  Branch (73:7): [True: 0, False: 2.59M]
  ------------------
   74|      0|      throw Invalid_State("Modular_Reducer: Never initalized");
   75|      0|   }
   76|       |
   77|  2.59M|   const size_t x_sw = x.sig_words();
   78|       |
   79|  2.59M|   if(x_sw > 2 * m_mod_words) {
  ------------------
  |  Branch (79:7): [True: 0, False: 2.59M]
  ------------------
   80|       |      // too big, fall back to slow boat division
   81|      0|      t1 = ct_modulo(x, m_modulus);
   82|      0|      return;
   83|      0|   }
   84|       |
   85|  2.59M|   t1 = x;
   86|  2.59M|   t1.set_sign(BigInt::Positive);
   87|  2.59M|   t1 >>= (BOTAN_MP_WORD_BITS * (m_mod_words - 1));
  ------------------
  |  |   50|  2.59M|#define BOTAN_MP_WORD_BITS 64
  ------------------
   88|       |
   89|  2.59M|   t1.mul(m_mu, ws);
   90|  2.59M|   t1 >>= (BOTAN_MP_WORD_BITS * (m_mod_words + 1));
  ------------------
  |  |   50|  2.59M|#define BOTAN_MP_WORD_BITS 64
  ------------------
   91|       |
   92|       |   // TODO add masked mul to avoid computing high bits
   93|  2.59M|   t1.mul(m_modulus, ws);
   94|  2.59M|   t1.mask_bits(BOTAN_MP_WORD_BITS * (m_mod_words + 1));
  ------------------
  |  |   50|  2.59M|#define BOTAN_MP_WORD_BITS 64
  ------------------
   95|       |
   96|  2.59M|   t1.rev_sub(x.data(), std::min(x_sw, m_mod_words + 1), ws);
   97|       |
   98|       |   /*
   99|       |   * If t1 < 0 then we must add b^(k+1) where b = 2^w. To avoid a
  100|       |   * side channel perform the addition unconditionally, with ws set
  101|       |   * to either b^(k+1) or else 0.
  102|       |   */
  103|  2.59M|   const word t1_neg = t1.is_negative();
  104|       |
  105|  2.59M|   if(ws.size() < m_mod_words + 2) {
  ------------------
  |  Branch (105:7): [True: 15.3k, False: 2.58M]
  ------------------
  106|  15.3k|      ws.resize(m_mod_words + 2);
  107|  15.3k|   }
  108|  2.59M|   clear_mem(ws.data(), ws.size());
  109|  2.59M|   ws[m_mod_words + 1] = t1_neg;
  110|       |
  111|  2.59M|   t1.add(ws.data(), m_mod_words + 2, BigInt::Positive);
  112|       |
  113|       |   // Per HAC this step requires at most 2 subtractions
  114|  2.59M|   t1.ct_reduce_below(m_modulus, ws, 2);
  115|       |
  116|  2.59M|   cnd_rev_sub(t1.is_nonzero() && x.is_negative(), t1, m_modulus.data(), m_modulus.size(), ws);
  ------------------
  |  Branch (116:16): [True: 2.59M, False: 5.45k]
  |  Branch (116:35): [True: 207k, False: 2.38M]
  ------------------
  117|  2.59M|}
reducer.cpp:_ZN5Botan12_GLOBAL__N_111cnd_rev_subEbRNS_6BigIntEPKmmRNSt3__16vectorImNS_16secure_allocatorImEEEE:
   49|  2.59M|void cnd_rev_sub(bool cnd, BigInt& x, const word y[], size_t y_sw, secure_vector<word>& ws) {
   50|  2.59M|   if(x.sign() != BigInt::Positive) {
  ------------------
  |  Branch (50:7): [True: 0, False: 2.59M]
  ------------------
   51|      0|      throw Invalid_State("BigInt::sub_rev requires this is positive");
   52|      0|   }
   53|       |
   54|  2.59M|   const size_t x_sw = x.sig_words();
   55|       |
   56|  2.59M|   const size_t max_words = std::max(x_sw, y_sw);
   57|  2.59M|   ws.resize(std::max(x_sw, y_sw));
   58|  2.59M|   clear_mem(ws.data(), ws.size());
   59|  2.59M|   x.grow_to(max_words);
   60|       |
   61|  2.59M|   const int32_t relative_size = bigint_sub_abs(ws.data(), x.data(), x_sw, y, y_sw);
   62|       |
   63|  2.59M|   x.cond_flip_sign((relative_size > 0) && cnd);
  ------------------
  |  Branch (63:21): [True: 0, False: 2.59M]
  |  Branch (63:44): [True: 0, False: 0]
  ------------------
   64|  2.59M|   bigint_cnd_swap(cnd, x.mutable_data(), ws.data(), max_words);
   65|  2.59M|}

_ZN5Botan4EMSA6createENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   35|    385|std::unique_ptr<EMSA> EMSA::create(std::string_view algo_spec) {
   36|    385|   SCAN_Name req(algo_spec);
   37|       |
   38|    385|#if defined(BOTAN_HAS_EMSA_PKCS1)
   39|    385|   if(req.algo_name() == "EMSA_PKCS1" || req.algo_name() == "PKCS1v15" || req.algo_name() == "EMSA-PKCS1-v1_5" ||
  ------------------
  |  Branch (39:7): [True: 0, False: 385]
  |  Branch (39:42): [True: 0, False: 385]
  |  Branch (39:75): [True: 0, False: 385]
  ------------------
   40|    385|      req.algo_name() == "EMSA3") {
  ------------------
  |  Branch (40:7): [True: 348, False: 37]
  ------------------
   41|    348|      if(req.arg_count() == 2 && req.arg(0) == "Raw") {
  ------------------
  |  Branch (41:10): [True: 0, False: 348]
  |  Branch (41:10): [True: 0, False: 348]
  |  Branch (41:34): [True: 0, False: 0]
  ------------------
   42|      0|         return std::make_unique<EMSA_PKCS1v15_Raw>(req.arg(1));
   43|    348|      } else if(req.arg_count() == 1) {
  ------------------
  |  Branch (43:17): [True: 348, False: 0]
  ------------------
   44|    348|         if(req.arg(0) == "Raw") {
  ------------------
  |  Branch (44:13): [True: 0, False: 348]
  ------------------
   45|      0|            return std::make_unique<EMSA_PKCS1v15_Raw>();
   46|    348|         } else {
   47|    348|            if(auto hash = HashFunction::create(req.arg(0))) {
  ------------------
  |  Branch (47:21): [True: 348, False: 0]
  ------------------
   48|    348|               return std::make_unique<EMSA_PKCS1v15>(std::move(hash));
   49|    348|            }
   50|    348|         }
   51|    348|      }
   52|    348|   }
   53|     37|#endif
   54|       |
   55|     37|#if defined(BOTAN_HAS_EMSA_PSSR)
   56|     37|   if(req.algo_name() == "PSS_Raw" || req.algo_name() == "PSSR_Raw") {
  ------------------
  |  Branch (56:7): [True: 0, False: 37]
  |  Branch (56:39): [True: 0, False: 37]
  ------------------
   57|      0|      if(req.arg_count_between(1, 3) && req.arg(1, "MGF1") == "MGF1") {
  ------------------
  |  Branch (57:10): [True: 0, False: 0]
  |  Branch (57:10): [True: 0, False: 0]
  |  Branch (57:41): [True: 0, False: 0]
  ------------------
   58|      0|         if(auto hash = HashFunction::create(req.arg(0))) {
  ------------------
  |  Branch (58:18): [True: 0, False: 0]
  ------------------
   59|      0|            if(req.arg_count() == 3) {
  ------------------
  |  Branch (59:16): [True: 0, False: 0]
  ------------------
   60|      0|               const size_t salt_size = req.arg_as_integer(2, 0);
   61|      0|               return std::make_unique<PSSR_Raw>(std::move(hash), salt_size);
   62|      0|            } else {
   63|      0|               return std::make_unique<PSSR_Raw>(std::move(hash));
   64|      0|            }
   65|      0|         }
   66|      0|      }
   67|      0|   }
   68|       |
   69|     37|   if(req.algo_name() == "PSS" || req.algo_name() == "PSSR" || req.algo_name() == "EMSA-PSS" ||
  ------------------
  |  Branch (69:7): [True: 0, False: 37]
  |  Branch (69:35): [True: 0, False: 37]
  |  Branch (69:64): [True: 0, False: 37]
  ------------------
   70|     37|      req.algo_name() == "PSS-MGF1" || req.algo_name() == "EMSA4") {
  ------------------
  |  Branch (70:7): [True: 0, False: 37]
  |  Branch (70:40): [True: 36, False: 1]
  ------------------
   71|     36|      if(req.arg_count_between(1, 3) && req.arg(1, "MGF1") == "MGF1") {
  ------------------
  |  Branch (71:10): [True: 36, False: 0]
  |  Branch (71:10): [True: 36, False: 0]
  |  Branch (71:41): [True: 36, False: 0]
  ------------------
   72|     36|         if(auto hash = HashFunction::create(req.arg(0))) {
  ------------------
  |  Branch (72:18): [True: 36, False: 0]
  ------------------
   73|     36|            if(req.arg_count() == 3) {
  ------------------
  |  Branch (73:16): [True: 36, False: 0]
  ------------------
   74|     36|               const size_t salt_size = req.arg_as_integer(2, 0);
   75|     36|               return std::make_unique<PSSR>(std::move(hash), salt_size);
   76|     36|            } else {
   77|      0|               return std::make_unique<PSSR>(std::move(hash));
   78|      0|            }
   79|     36|         }
   80|     36|      }
   81|     36|   }
   82|      1|#endif
   83|       |
   84|      1|#if defined(BOTAN_HAS_ISO_9796)
   85|      1|   if(req.algo_name() == "ISO_9796_DS2") {
  ------------------
  |  Branch (85:7): [True: 0, False: 1]
  ------------------
   86|      0|      if(req.arg_count_between(1, 3)) {
  ------------------
  |  Branch (86:10): [True: 0, False: 0]
  ------------------
   87|      0|         if(auto hash = HashFunction::create(req.arg(0))) {
  ------------------
  |  Branch (87:18): [True: 0, False: 0]
  ------------------
   88|      0|            const size_t salt_size = req.arg_as_integer(2, hash->output_length());
   89|      0|            const bool implicit = req.arg(1, "exp") == "imp";
   90|      0|            return std::make_unique<ISO_9796_DS2>(std::move(hash), implicit, salt_size);
   91|      0|         }
   92|      0|      }
   93|      0|   }
   94|       |   //ISO-9796-2 DS 3 is deterministic and DS2 without a salt
   95|      1|   if(req.algo_name() == "ISO_9796_DS3") {
  ------------------
  |  Branch (95:7): [True: 0, False: 1]
  ------------------
   96|      0|      if(req.arg_count_between(1, 2)) {
  ------------------
  |  Branch (96:10): [True: 0, False: 0]
  ------------------
   97|      0|         if(auto hash = HashFunction::create(req.arg(0))) {
  ------------------
  |  Branch (97:18): [True: 0, False: 0]
  ------------------
   98|      0|            const bool implicit = req.arg(1, "exp") == "imp";
   99|      0|            return std::make_unique<ISO_9796_DS3>(std::move(hash), implicit);
  100|      0|         }
  101|      0|      }
  102|      0|   }
  103|      1|#endif
  104|       |
  105|      1|#if defined(BOTAN_HAS_EMSA_X931)
  106|      1|   if(req.algo_name() == "EMSA_X931" || req.algo_name() == "EMSA2" || req.algo_name() == "X9.31") {
  ------------------
  |  Branch (106:7): [True: 0, False: 1]
  |  Branch (106:41): [True: 0, False: 1]
  |  Branch (106:71): [True: 0, False: 1]
  ------------------
  107|      0|      if(req.arg_count() == 1) {
  ------------------
  |  Branch (107:10): [True: 0, False: 0]
  ------------------
  108|      0|         if(auto hash = HashFunction::create(req.arg(0))) {
  ------------------
  |  Branch (108:18): [True: 0, False: 0]
  ------------------
  109|      0|            return std::make_unique<EMSA_X931>(std::move(hash));
  110|      0|         }
  111|      0|      }
  112|      0|   }
  113|      1|#endif
  114|       |
  115|      1|#if defined(BOTAN_HAS_EMSA_RAW)
  116|      1|   if(req.algo_name() == "Raw") {
  ------------------
  |  Branch (116:7): [True: 0, False: 1]
  ------------------
  117|      0|      if(req.arg_count() == 0) {
  ------------------
  |  Branch (117:10): [True: 0, False: 0]
  ------------------
  118|      0|         return std::make_unique<EMSA_Raw>();
  119|      0|      } else {
  120|      0|         auto hash = HashFunction::create(req.arg(0));
  121|      0|         if(hash) {
  ------------------
  |  Branch (121:13): [True: 0, False: 0]
  ------------------
  122|      0|            return std::make_unique<EMSA_Raw>(hash->output_length());
  123|      0|         }
  124|      0|      }
  125|      0|   }
  126|      1|#endif
  127|       |
  128|      1|   return nullptr;
  129|      1|}
_ZN5Botan4EMSA15create_or_throwENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
  131|    385|std::unique_ptr<EMSA> EMSA::create_or_throw(std::string_view algo_spec) {
  132|    385|   auto emsa = EMSA::create(algo_spec);
  133|    385|   if(emsa) {
  ------------------
  |  Branch (133:7): [True: 384, False: 1]
  ------------------
  134|    384|      return emsa;
  135|    384|   }
  136|      1|   throw Algorithm_Not_Found(algo_spec);
  137|    385|}

_ZN5Botan13EMSA_PKCS1v156updateEPKhm:
   42|    348|void EMSA_PKCS1v15::update(const uint8_t input[], size_t length) {
   43|    348|   m_hash->update(input, length);
   44|    348|}
_ZN5Botan13EMSA_PKCS1v158raw_dataEv:
   46|    348|std::vector<uint8_t> EMSA_PKCS1v15::raw_data() {
   47|    348|   return m_hash->final_stdvec();
   48|    348|}
_ZN5Botan13EMSA_PKCS1v156verifyERKNSt3__16vectorIhNS1_9allocatorIhEEEES7_m:
   60|    318|bool EMSA_PKCS1v15::verify(const std::vector<uint8_t>& coded, const std::vector<uint8_t>& raw, size_t key_bits) {
   61|    318|   if(raw.size() != m_hash->output_length()) {
  ------------------
  |  Branch (61:7): [True: 0, False: 318]
  ------------------
   62|      0|      return false;
   63|      0|   }
   64|       |
   65|    318|   try {
   66|    318|      return coded == pkcs1v15_sig_encoding(raw, key_bits, m_hash_id);
   67|    318|   } catch(...) {
   68|     26|      return false;
   69|     26|   }
   70|    318|}
_ZN5Botan13EMSA_PKCS1v15C2ENSt3__110unique_ptrINS_12HashFunctionENS1_14default_deleteIS3_EEEE:
   72|    348|EMSA_PKCS1v15::EMSA_PKCS1v15(std::unique_ptr<HashFunction> hash) : m_hash(std::move(hash)) {
   73|    348|   m_hash_id = pkcs_hash_id(m_hash->name());
   74|    348|}
emsa_pkcs1.cpp:_ZN5Botan12_GLOBAL__N_121pkcs1v15_sig_encodingERKNSt3__16vectorIhNS1_9allocatorIhEEEEmNS1_4spanIKhLm18446744073709551615EEE:
   20|    318|                                           std::span<const uint8_t> hash_id) {
   21|    318|   const size_t output_length = output_bits / 8;
   22|       |
   23|    318|   if(output_length < hash_id.size() + msg.size() + 2 + 8) {
  ------------------
  |  Branch (23:7): [True: 26, False: 292]
  ------------------
   24|     26|      throw Encoding_Error("pkcs1v15_sig_encoding: Output length is too small");
   25|     26|   }
   26|       |
   27|    292|   std::vector<uint8_t> padded(output_length);
   28|    292|   BufferStuffer stuffer(padded);
   29|       |
   30|    292|   stuffer.append(0x01);
   31|    292|   stuffer.append(0xFF, stuffer.remaining_capacity() - (1 + hash_id.size() + msg.size()));
   32|    292|   stuffer.append(0x00);
   33|    292|   stuffer.append(hash_id);
   34|    292|   stuffer.append(msg);
   35|    292|   BOTAN_ASSERT_NOMSG(stuffer.full());
  ------------------
  |  |   60|    292|   do {                                                                     \
  |  |   61|    292|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 292]
  |  |  ------------------
  |  |   62|    292|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    292|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   36|       |
   37|    292|   return padded;
   38|    318|}

_ZN5Botan4PSSRC2ENSt3__110unique_ptrINS_12HashFunctionENS1_14default_deleteIS3_EEEEm:
  151|     36|      m_hash(std::move(hash)), m_salt_size(salt_size), m_required_salt_len(true) {}
_ZN5Botan4PSSR6updateEPKhm:
  156|     36|void PSSR::update(const uint8_t input[], size_t length) {
  157|     36|   m_hash->update(input, length);
  158|     36|}
_ZN5Botan4PSSR8raw_dataEv:
  163|     36|std::vector<uint8_t> PSSR::raw_data() {
  164|     36|   return m_hash->final_stdvec();
  165|     36|}
_ZN5Botan4PSSR6verifyERKNSt3__16vectorIhNS1_9allocatorIhEEEES7_m:
  177|     36|bool PSSR::verify(const std::vector<uint8_t>& coded, const std::vector<uint8_t>& raw, size_t key_bits) {
  178|     36|   size_t salt_size = 0;
  179|     36|   const bool ok = pss_verify(*m_hash, coded, raw, key_bits, &salt_size);
  180|       |
  181|     36|   if(m_required_salt_len && salt_size != m_salt_size) {
  ------------------
  |  Branch (181:7): [True: 36, False: 0]
  |  Branch (181:30): [True: 36, False: 0]
  ------------------
  182|     36|      return false;
  183|     36|   }
  184|       |
  185|      0|   return ok;
  186|     36|}
pssr.cpp:_ZN5Botan12_GLOBAL__N_110pss_verifyERNS_12HashFunctionERKNSt3__16vectorIhNS3_9allocatorIhEEEES9_mPm:
   70|     36|                size_t* out_salt_size) {
   71|     36|   const size_t HASH_SIZE = hash.output_length();
   72|     36|   const size_t key_bytes = ceil_tobytes(key_bits);
   73|       |
   74|     36|   if(key_bits < 8 * HASH_SIZE + 9) {
  ------------------
  |  Branch (74:7): [True: 0, False: 36]
  ------------------
   75|      0|      return false;
   76|      0|   }
   77|       |
   78|     36|   if(message_hash.size() != HASH_SIZE) {
  ------------------
  |  Branch (78:7): [True: 0, False: 36]
  ------------------
   79|      0|      return false;
   80|      0|   }
   81|       |
   82|     36|   if(pss_repr.size() > key_bytes || pss_repr.size() <= 1) {
  ------------------
  |  Branch (82:7): [True: 2, False: 34]
  |  Branch (82:38): [True: 1, False: 33]
  ------------------
   83|      3|      return false;
   84|      3|   }
   85|       |
   86|     33|   if(pss_repr[pss_repr.size() - 1] != 0xBC) {
  ------------------
  |  Branch (86:7): [True: 10, False: 23]
  ------------------
   87|     10|      return false;
   88|     10|   }
   89|       |
   90|     23|   std::vector<uint8_t> coded = pss_repr;
   91|     23|   if(coded.size() < key_bytes) {
  ------------------
  |  Branch (91:7): [True: 19, False: 4]
  ------------------
   92|     19|      std::vector<uint8_t> temp(key_bytes);
   93|     19|      BufferStuffer stuffer(temp);
   94|     19|      stuffer.append(0x00, stuffer.remaining_capacity() - coded.size());
   95|     19|      stuffer.append(coded);
   96|     19|      coded = temp;
   97|     19|   }
   98|       |
   99|     23|   const size_t TOP_BITS = 8 * ((key_bits + 7) / 8) - key_bits;
  100|     23|   if(TOP_BITS > 8 - high_bit(coded[0])) {
  ------------------
  |  Branch (100:7): [True: 1, False: 22]
  ------------------
  101|      1|      return false;
  102|      1|   }
  103|       |
  104|     22|   uint8_t* DB = coded.data();
  105|     22|   const size_t DB_size = coded.size() - HASH_SIZE - 1;
  106|       |
  107|     22|   const uint8_t* H = &coded[DB_size];
  108|     22|   const size_t H_size = HASH_SIZE;
  109|       |
  110|     22|   mgf1_mask(hash, H, H_size, DB, DB_size);
  111|     22|   DB[0] &= 0xFF >> TOP_BITS;
  112|       |
  113|     22|   size_t salt_offset = 0;
  114|     31|   for(size_t j = 0; j != DB_size; ++j) {
  ------------------
  |  Branch (114:22): [True: 31, False: 0]
  ------------------
  115|     31|      if(DB[j] == 0x01) {
  ------------------
  |  Branch (115:10): [True: 13, False: 18]
  ------------------
  116|     13|         salt_offset = j + 1;
  117|     13|         break;
  118|     13|      }
  119|     18|      if(DB[j]) {
  ------------------
  |  Branch (119:10): [True: 9, False: 9]
  ------------------
  120|      9|         return false;
  121|      9|      }
  122|     18|   }
  123|     13|   if(salt_offset == 0) {
  ------------------
  |  Branch (123:7): [True: 0, False: 13]
  ------------------
  124|      0|      return false;
  125|      0|   }
  126|       |
  127|     13|   const size_t salt_size = DB_size - salt_offset;
  128|       |
  129|     13|   std::array<uint8_t, 8> padding = {0};
  130|     13|   hash.update(padding);
  131|     13|   hash.update(message_hash);
  132|     13|   hash.update(&DB[salt_offset], salt_size);
  133|       |
  134|     13|   const std::vector<uint8_t> H2 = hash.final_stdvec();
  135|       |
  136|     13|   const bool ok = CT::is_equal(H, H2.data(), HASH_SIZE).as_bool();
  137|       |
  138|     13|   if(out_salt_size && ok) {
  ------------------
  |  Branch (138:7): [True: 13, False: 0]
  |  Branch (138:24): [True: 0, False: 13]
  ------------------
  139|      0|      *out_salt_size = salt_size;
  140|      0|   }
  141|       |
  142|     13|   return ok;
  143|     13|}

_ZN5Botan12pkcs_hash_idENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEE:
   78|    348|std::vector<uint8_t> pkcs_hash_id(std::string_view name) {
   79|       |   // Special case for SSL/TLS RSA signatures
   80|    348|   if(name == "Parallel(MD5,SHA-1)") {
  ------------------
  |  Branch (80:7): [True: 0, False: 348]
  ------------------
   81|      0|      return std::vector<uint8_t>();
   82|      0|   }
   83|       |
   84|       |   // If you add a value to this function, also update test_hash_id.cpp
   85|       |
   86|    348|   if(name == "MD5") {
  ------------------
  |  Branch (86:7): [True: 116, False: 232]
  ------------------
   87|    116|      return std::vector<uint8_t>(MD5_PKCS_ID, MD5_PKCS_ID + sizeof(MD5_PKCS_ID));
   88|    116|   }
   89|       |
   90|    232|   if(name == "RIPEMD-160") {
  ------------------
  |  Branch (90:7): [True: 0, False: 232]
  ------------------
   91|      0|      return std::vector<uint8_t>(RIPEMD_160_PKCS_ID, RIPEMD_160_PKCS_ID + sizeof(RIPEMD_160_PKCS_ID));
   92|      0|   }
   93|       |
   94|    232|   if(name == "SHA-1") {
  ------------------
  |  Branch (94:7): [True: 152, False: 80]
  ------------------
   95|    152|      return std::vector<uint8_t>(SHA_1_PKCS_ID, SHA_1_PKCS_ID + sizeof(SHA_1_PKCS_ID));
   96|    152|   }
   97|       |
   98|     80|   if(name == "SHA-224") {
  ------------------
  |  Branch (98:7): [True: 35, False: 45]
  ------------------
   99|     35|      return std::vector<uint8_t>(SHA_224_PKCS_ID, SHA_224_PKCS_ID + sizeof(SHA_224_PKCS_ID));
  100|     35|   }
  101|       |
  102|     45|   if(name == "SHA-256") {
  ------------------
  |  Branch (102:7): [True: 22, False: 23]
  ------------------
  103|     22|      return std::vector<uint8_t>(SHA_256_PKCS_ID, SHA_256_PKCS_ID + sizeof(SHA_256_PKCS_ID));
  104|     22|   }
  105|       |
  106|     23|   if(name == "SHA-384") {
  ------------------
  |  Branch (106:7): [True: 1, False: 22]
  ------------------
  107|      1|      return std::vector<uint8_t>(SHA_384_PKCS_ID, SHA_384_PKCS_ID + sizeof(SHA_384_PKCS_ID));
  108|      1|   }
  109|       |
  110|     22|   if(name == "SHA-512") {
  ------------------
  |  Branch (110:7): [True: 6, False: 16]
  ------------------
  111|      6|      return std::vector<uint8_t>(SHA_512_PKCS_ID, SHA_512_PKCS_ID + sizeof(SHA_512_PKCS_ID));
  112|      6|   }
  113|       |
  114|     16|   if(name == "SHA-512-256") {
  ------------------
  |  Branch (114:7): [True: 16, False: 0]
  ------------------
  115|     16|      return std::vector<uint8_t>(SHA_512_256_PKCS_ID, SHA_512_256_PKCS_ID + sizeof(SHA_512_256_PKCS_ID));
  116|     16|   }
  117|       |
  118|      0|   if(name == "SHA-3(224)") {
  ------------------
  |  Branch (118:7): [True: 0, False: 0]
  ------------------
  119|      0|      return std::vector<uint8_t>(SHA3_224_PKCS_ID, SHA3_224_PKCS_ID + sizeof(SHA3_224_PKCS_ID));
  120|      0|   }
  121|       |
  122|      0|   if(name == "SHA-3(256)") {
  ------------------
  |  Branch (122:7): [True: 0, False: 0]
  ------------------
  123|      0|      return std::vector<uint8_t>(SHA3_256_PKCS_ID, SHA3_256_PKCS_ID + sizeof(SHA3_256_PKCS_ID));
  124|      0|   }
  125|       |
  126|      0|   if(name == "SHA-3(384)") {
  ------------------
  |  Branch (126:7): [True: 0, False: 0]
  ------------------
  127|      0|      return std::vector<uint8_t>(SHA3_384_PKCS_ID, SHA3_384_PKCS_ID + sizeof(SHA3_384_PKCS_ID));
  128|      0|   }
  129|       |
  130|      0|   if(name == "SHA-3(512)") {
  ------------------
  |  Branch (130:7): [True: 0, False: 0]
  ------------------
  131|      0|      return std::vector<uint8_t>(SHA3_512_PKCS_ID, SHA3_512_PKCS_ID + sizeof(SHA3_512_PKCS_ID));
  132|      0|   }
  133|       |
  134|      0|   if(name == "SM3") {
  ------------------
  |  Branch (134:7): [True: 0, False: 0]
  ------------------
  135|      0|      return std::vector<uint8_t>(SM3_PKCS_ID, SM3_PKCS_ID + sizeof(SM3_PKCS_ID));
  136|      0|   }
  137|       |
  138|      0|   throw Invalid_Argument("No PKCS #1 identifier for " + std::string(name));
  139|      0|}

_ZN5Botan9mgf1_maskERNS_12HashFunctionEPKhmPhm:
   15|     22|void mgf1_mask(HashFunction& hash, const uint8_t in[], size_t in_len, uint8_t out[], size_t out_len) {
   16|     22|   uint32_t counter = 0;
   17|       |
   18|     22|   std::vector<uint8_t> buffer(hash.output_length());
   19|    208|   while(out_len) {
  ------------------
  |  Branch (19:10): [True: 186, False: 22]
  ------------------
   20|    186|      hash.update(in, in_len);
   21|    186|      hash.update_be(counter);
   22|    186|      hash.final(buffer.data());
   23|       |
   24|    186|      const size_t xored = std::min<size_t>(buffer.size(), out_len);
   25|    186|      xor_buf(out, buffer.data(), xored);
   26|    186|      out += xored;
   27|    186|      out_len -= xored;
   28|       |
   29|    186|      ++counter;
   30|    186|   }
   31|     22|}

_ZN5Botan20Curve25519_PublicKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE:
   47|      1|Curve25519_PublicKey::Curve25519_PublicKey(const AlgorithmIdentifier& /*unused*/, std::span<const uint8_t> key_bits) {
   48|      1|   m_public.assign(key_bits.begin(), key_bits.end());
   49|       |
   50|      1|   size_check(m_public.size(), "public key");
   51|      1|}
curve25519.cpp:_ZN5Botan12_GLOBAL__N_110size_checkEmPKc:
   25|      1|void size_check(size_t size, const char* thing) {
   26|      1|   if(size != 32) {
  ------------------
  |  Branch (26:7): [True: 1, False: 0]
  ------------------
   27|      1|      throw Decoding_Error(fmt("Invalid size {} for Curve2551 {}", size, thing));
   28|      1|   }
   29|      1|}

_ZN5Botan12DH_PublicKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE:
   16|     50|DH_PublicKey::DH_PublicKey(const AlgorithmIdentifier& alg_id, std::span<const uint8_t> key_bits) {
   17|     50|   m_public_key = std::make_shared<DL_PublicKey>(alg_id, key_bits, DL_Group_Format::ANSI_X9_42);
   18|     50|}

_ZN5Botan12DL_PublicKeyC2ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEENS_15DL_Group_FormatE:
   44|     88|      m_group(alg_id.parameters(), format), m_public_key(decode_single_bigint(key_bits)) {}
dl_scheme.cpp:_ZN5Botan12_GLOBAL__N_120decode_single_bigintENSt3__14spanIKhLm18446744073709551615EEE:
   17|     74|BigInt decode_single_bigint(std::span<const uint8_t> key_bits) {
   18|     74|   BigInt x;
   19|     74|   BER_Decoder(key_bits).decode(x);
   20|     74|   return x;
   21|     74|}

_ZN5Botan8DL_Group19BER_decode_DL_groupEPKhmNS_15DL_Group_FormatENS_15DL_Group_SourceE:
  119|     88|                                                             DL_Group_Source source) {
  120|     88|   BigInt p, q, g;
  121|       |
  122|     88|   BER_Decoder decoder(data, data_len);
  123|     88|   BER_Decoder ber = decoder.start_sequence();
  124|       |
  125|     88|   if(format == DL_Group_Format::ANSI_X9_57) {
  ------------------
  |  Branch (125:7): [True: 37, False: 51]
  ------------------
  126|     37|      ber.decode(p).decode(q).decode(g).verify_end();
  127|     51|   } else if(format == DL_Group_Format::ANSI_X9_42) {
  ------------------
  |  Branch (127:14): [True: 49, False: 2]
  ------------------
  128|     49|      ber.decode(p).decode(g).decode(q).discard_remaining();
  129|     49|   } else if(format == DL_Group_Format::PKCS_3) {
  ------------------
  |  Branch (129:14): [True: 0, False: 2]
  ------------------
  130|       |      // q is left as zero
  131|      0|      ber.decode(p).decode(g).discard_remaining();
  132|      2|   } else {
  133|      2|      throw Invalid_Argument("Unknown DL_Group encoding");
  134|      2|   }
  135|       |
  136|     86|   return std::make_shared<DL_Group_Data>(p, q, g, source);
  137|     88|}
_ZNK5Botan8DL_Group4dataEv:
  316|     32|const DL_Group_Data& DL_Group::data() const {
  317|     32|   if(m_data) {
  ------------------
  |  Branch (317:7): [True: 32, False: 0]
  ------------------
  318|     32|      return *m_data;
  319|     32|   }
  320|       |
  321|      0|   throw Invalid_State("DL_Group uninitialized");
  322|     32|}
_ZNK5Botan8DL_Group5has_qEv:
  448|     32|bool DL_Group::has_q() const {
  449|     32|   return data().q_is_set();
  450|     32|}
_ZN5Botan8DL_GroupC2EPKhmNS_15DL_Group_FormatE:
  582|     88|DL_Group::DL_Group(const uint8_t ber[], size_t ber_len, DL_Group_Format format) {
  583|     88|   m_data = BER_decode_DL_group(ber, ber_len, format, DL_Group_Source::ExternalSource);
  584|     88|}
_ZNK5Botan13DL_Group_Data8q_is_setEv:
   90|     32|      bool q_is_set() const { return m_q_bits > 0; }
_ZN5Botan13DL_Group_DataC2ERKNS_6BigIntES3_S3_NS_15DL_Group_SourceE:
   39|     84|            m_source(source) {}
_ZN5Botan13DL_Group_DataD2Ev:
   41|     74|      ~DL_Group_Data() = default;

_ZN5Botan13DSA_PublicKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE:
   55|     38|DSA_PublicKey::DSA_PublicKey(const AlgorithmIdentifier& alg_id, std::span<const uint8_t> key_bits) {
   56|     38|   m_public_key = std::make_shared<DL_PublicKey>(alg_id, key_bits, DL_Group_Format::ANSI_X9_57);
   57|       |
   58|     38|   BOTAN_ARG_CHECK(m_public_key->group().has_q(), "Q parameter must be set for DSA");
  ------------------
  |  |   30|     38|   do {                                                          \
  |  |   31|     38|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 1, False: 37]
  |  |  ------------------
  |  |   32|     38|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|     38|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   59|     38|}
_ZNK5Botan13DSA_PublicKey27create_x509_verification_opERKNS_19AlgorithmIdentifierENSt3__117basic_string_viewIcNS4_11char_traitsIcEEEE:
  260|     31|   const AlgorithmIdentifier& signature_algorithm, std::string_view provider) const {
  261|     31|   if(provider == "base" || provider.empty()) {
  ------------------
  |  Branch (261:7): [True: 0, False: 31]
  |  Branch (261:29): [True: 31, False: 0]
  ------------------
  262|     31|      return std::make_unique<DSA_Verification_Operation>(this->m_public_key, signature_algorithm);
  263|     31|   }
  264|       |
  265|      0|   throw Provider_Not_Found(algo_name(), provider);
  266|     31|}
dsa.cpp:_ZN5Botan12_GLOBAL__N_126DSA_Verification_OperationC2ERKNSt3__110shared_ptrIKNS_12DL_PublicKeyEEERKNS_19AlgorithmIdentifierE:
  209|     31|            PK_Ops::Verification_with_Hash(alg_id, "DSA"), m_key(key) {}

_ZN5Botan8CurveGFp11choose_reprERKNS_6BigIntES3_S3_:
  564|    640|std::shared_ptr<CurveGFp_Repr> CurveGFp::choose_repr(const BigInt& p, const BigInt& a, const BigInt& b) {
  565|    640|   if(p == prime_p192()) {
  ------------------
  |  Branch (565:7): [True: 3, False: 637]
  ------------------
  566|      3|      return std::make_shared<CurveGFp_P192>(a, b);
  567|      3|   }
  568|    637|   if(p == prime_p224()) {
  ------------------
  |  Branch (568:7): [True: 1, False: 636]
  ------------------
  569|      1|      return std::make_shared<CurveGFp_P224>(a, b);
  570|      1|   }
  571|    636|   if(p == prime_p256()) {
  ------------------
  |  Branch (571:7): [True: 1, False: 635]
  ------------------
  572|      1|      return std::make_shared<CurveGFp_P256>(a, b);
  573|      1|   }
  574|    635|   if(p == prime_p384()) {
  ------------------
  |  Branch (574:7): [True: 1, False: 634]
  ------------------
  575|      1|      return std::make_shared<CurveGFp_P384>(a, b);
  576|      1|   }
  577|    634|   if(p == prime_p521()) {
  ------------------
  |  Branch (577:7): [True: 1, False: 633]
  ------------------
  578|      1|      return std::make_shared<CurveGFp_P521>(a, b);
  579|      1|   }
  580|       |
  581|    633|   return std::make_shared<CurveGFp_Montgomery>(p, a, b);
  582|    634|}
curve_gfp.cpp:_ZN5Botan12_GLOBAL__N_113CurveGFp_P192C2ERKNS_6BigIntES4_:
  263|      3|      CurveGFp_P192(const BigInt& a, const BigInt& b) : CurveGFp_NIST(192, a, b) {}
curve_gfp.cpp:_ZN5Botan12_GLOBAL__N_113CurveGFp_NISTC2EmRKNS_6BigIntES4_:
  157|      7|            m_1(1), m_a(a), m_b(b), m_p_words((p_bits + BOTAN_MP_WORD_BITS - 1) / BOTAN_MP_WORD_BITS) {
  158|       |         // All Solinas prime curves are assumed a == -3
  159|      7|      }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_P1925get_pEv:
  265|  8.88k|      const BigInt& get_p() const override { return prime_p192(); }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST5get_aEv:
  165|    546|      const BigInt& get_a() const override { return m_a; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST5get_bEv:
  167|    546|      const BigInt& get_b() const override { return m_b; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST11get_p_wordsEv:
  171|  28.6k|      size_t get_p_words() const override { return m_p_words; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST11get_ws_sizeEv:
  173|  1.05M|      size_t get_ws_size() const override { return 2 * m_p_words; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST6is_oneERKNS_6BigIntE:
  179|    142|      bool is_one(const BigInt& x) const override { return x == 1; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST9a_is_zeroEv:
  161|  54.2k|      bool a_is_zero() const override { return false; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST12a_is_minus_3Ev:
  163|  54.2k|      bool a_is_minus_3() const override { return true; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST9get_a_repEv:
  175|    838|      const BigInt& get_a_rep() const override { return m_a; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST9get_b_repEv:
  177|  1.64k|      const BigInt& get_b_rep() const override { return m_b; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST9get_1_repEv:
  169|    949|      const BigInt& get_1_rep() const override { return m_1; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST14invert_elementERKNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  211|     97|BigInt CurveGFp_NIST::invert_element(const BigInt& x, secure_vector<word>& ws) const {
  212|     97|   BOTAN_UNUSED(ws);
  ------------------
  |  |  118|     97|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  213|     97|   return inverse_mod(x, get_p());
  214|     97|}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST12to_curve_repERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  181|    788|      void to_curve_rep(BigInt& x, secure_vector<word>& ws) const override { redc_mod_p(x, ws); }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST14from_curve_repERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  183|  2.62k|      void from_curve_rep(BigInt& x, secure_vector<word>& ws) const override { redc_mod_p(x, ws); }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST15curve_mul_wordsERNS_6BigIntEPKmmRKS2_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  217|   544k|   BigInt& z, const word x_w[], size_t x_size, const BigInt& y, secure_vector<word>& ws) const {
  218|   544k|   BOTAN_DEBUG_ASSERT(y.sig_words() <= m_p_words);
  ------------------
  |  |   99|   544k|      do {                          \
  |  |  100|   544k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  219|       |
  220|   544k|   if(ws.size() < get_ws_size()) {
  ------------------
  |  Branch (220:7): [True: 0, False: 544k]
  ------------------
  221|      0|      ws.resize(get_ws_size());
  222|      0|   }
  223|       |
  224|   544k|   const size_t output_size = 2 * m_p_words;
  225|   544k|   if(z.size() < output_size) {
  ------------------
  |  Branch (225:7): [True: 44.0k, False: 500k]
  ------------------
  226|  44.0k|      z.grow_to(output_size);
  227|  44.0k|   }
  228|       |
  229|   544k|   bigint_mul(z.mutable_data(),
  230|   544k|              z.size(),
  231|   544k|              x_w,
  232|   544k|              x_size,
  233|   544k|              std::min(m_p_words, x_size),
  234|   544k|              y.data(),
  235|   544k|              y.size(),
  236|   544k|              std::min(m_p_words, y.size()),
  237|   544k|              ws.data(),
  238|   544k|              ws.size());
  239|       |
  240|   544k|   this->redc_mod_p(z, ws);
  241|   544k|}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST15curve_sqr_wordsERNS_6BigIntEPKmmRNSt3__16vectorImNS_16secure_allocatorImEEEE:
  243|   426k|void CurveGFp_NIST::curve_sqr_words(BigInt& z, const word x[], size_t x_size, secure_vector<word>& ws) const {
  244|   426k|   if(ws.size() < get_ws_size()) {
  ------------------
  |  Branch (244:7): [True: 980, False: 425k]
  ------------------
  245|    980|      ws.resize(get_ws_size());
  246|    980|   }
  247|       |
  248|   426k|   const size_t output_size = 2 * m_p_words;
  249|   426k|   if(z.size() < output_size) {
  ------------------
  |  Branch (249:7): [True: 59.4k, False: 367k]
  ------------------
  250|  59.4k|      z.grow_to(output_size);
  251|  59.4k|   }
  252|       |
  253|   426k|   bigint_sqr(z.mutable_data(), output_size, x, x_size, std::min(m_p_words, x_size), ws.data(), ws.size());
  254|       |
  255|   426k|   this->redc_mod_p(z, ws);
  256|   426k|}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_P19210redc_mod_pERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  268|  94.5k|      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p192(x, ws); }
curve_gfp.cpp:_ZN5Botan12_GLOBAL__N_113CurveGFp_P224C2ERKNS_6BigIntES4_:
  276|      1|      CurveGFp_P224(const BigInt& a, const BigInt& b) : CurveGFp_NIST(224, a, b) {}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_P2245get_pEv:
  278|  7.51k|      const BigInt& get_p() const override { return prime_p224(); }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_P22410redc_mod_pERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  281|  75.0k|      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p224(x, ws); }
curve_gfp.cpp:_ZN5Botan12_GLOBAL__N_113CurveGFp_P256C2ERKNS_6BigIntES4_:
  289|      1|      CurveGFp_P256(const BigInt& a, const BigInt& b) : CurveGFp_NIST(256, a, b) {}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_P2565get_pEv:
  291|  5.06k|      const BigInt& get_p() const override { return prime_p256(); }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_P25614invert_elementERKNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  299|     23|BigInt CurveGFp_P256::invert_element(const BigInt& x, secure_vector<word>& ws) const {
  300|     23|   BigInt r, p2, p4, p8, p16, p32, tmp;
  301|       |
  302|     23|   curve_sqr(r, x, ws);
  303|       |
  304|     23|   curve_mul(p2, r, x, ws);
  305|     23|   curve_sqr(r, p2, ws);
  306|     23|   curve_sqr_tmp(r, tmp, ws);
  307|       |
  308|     23|   curve_mul(p4, r, p2, ws);
  309|       |
  310|     23|   curve_sqr(r, p4, ws);
  311|     92|   for(size_t i = 0; i != 3; ++i) {
  ------------------
  |  Branch (311:22): [True: 69, False: 23]
  ------------------
  312|     69|      curve_sqr_tmp(r, tmp, ws);
  313|     69|   }
  314|     23|   curve_mul(p8, r, p4, ws);
  315|       |
  316|     23|   curve_sqr(r, p8, ws);
  317|    184|   for(size_t i = 0; i != 7; ++i) {
  ------------------
  |  Branch (317:22): [True: 161, False: 23]
  ------------------
  318|    161|      curve_sqr_tmp(r, tmp, ws);
  319|    161|   }
  320|     23|   curve_mul(p16, r, p8, ws);
  321|       |
  322|     23|   curve_sqr(r, p16, ws);
  323|    368|   for(size_t i = 0; i != 15; ++i) {
  ------------------
  |  Branch (323:22): [True: 345, False: 23]
  ------------------
  324|    345|      curve_sqr_tmp(r, tmp, ws);
  325|    345|   }
  326|     23|   curve_mul(p32, r, p16, ws);
  327|       |
  328|     23|   curve_sqr(r, p32, ws);
  329|    736|   for(size_t i = 0; i != 31; ++i) {
  ------------------
  |  Branch (329:22): [True: 713, False: 23]
  ------------------
  330|    713|      curve_sqr_tmp(r, tmp, ws);
  331|    713|   }
  332|     23|   curve_mul_tmp(r, x, tmp, ws);
  333|       |
  334|  2.96k|   for(size_t i = 0; i != 32 * 4; ++i) {
  ------------------
  |  Branch (334:22): [True: 2.94k, False: 23]
  ------------------
  335|  2.94k|      curve_sqr_tmp(r, tmp, ws);
  336|  2.94k|   }
  337|     23|   curve_mul_tmp(r, p32, tmp, ws);
  338|       |
  339|    759|   for(size_t i = 0; i != 32; ++i) {
  ------------------
  |  Branch (339:22): [True: 736, False: 23]
  ------------------
  340|    736|      curve_sqr_tmp(r, tmp, ws);
  341|    736|   }
  342|     23|   curve_mul_tmp(r, p32, tmp, ws);
  343|       |
  344|    391|   for(size_t i = 0; i != 16; ++i) {
  ------------------
  |  Branch (344:22): [True: 368, False: 23]
  ------------------
  345|    368|      curve_sqr_tmp(r, tmp, ws);
  346|    368|   }
  347|     23|   curve_mul_tmp(r, p16, tmp, ws);
  348|    207|   for(size_t i = 0; i != 8; ++i) {
  ------------------
  |  Branch (348:22): [True: 184, False: 23]
  ------------------
  349|    184|      curve_sqr_tmp(r, tmp, ws);
  350|    184|   }
  351|     23|   curve_mul_tmp(r, p8, tmp, ws);
  352|       |
  353|    115|   for(size_t i = 0; i != 4; ++i) {
  ------------------
  |  Branch (353:22): [True: 92, False: 23]
  ------------------
  354|     92|      curve_sqr_tmp(r, tmp, ws);
  355|     92|   }
  356|     23|   curve_mul_tmp(r, p4, tmp, ws);
  357|       |
  358|     69|   for(size_t i = 0; i != 2; ++i) {
  ------------------
  |  Branch (358:22): [True: 46, False: 23]
  ------------------
  359|     46|      curve_sqr_tmp(r, tmp, ws);
  360|     46|   }
  361|     23|   curve_mul_tmp(r, p2, tmp, ws);
  362|       |
  363|     69|   for(size_t i = 0; i != 2; ++i) {
  ------------------
  |  Branch (363:22): [True: 46, False: 23]
  ------------------
  364|     46|      curve_sqr_tmp(r, tmp, ws);
  365|     46|   }
  366|     23|   curve_mul_tmp(r, x, tmp, ws);
  367|       |
  368|     23|   return r;
  369|     23|}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST13curve_sqr_tmpERNS_6BigIntES3_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  197|   104k|      void curve_sqr_tmp(BigInt& x, BigInt& tmp, secure_vector<word>& ws) const {
  198|   104k|         curve_sqr(tmp, x, ws);
  199|   104k|         x.swap(tmp);
  200|   104k|      }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST13curve_mul_tmpERNS_6BigIntERKS2_S3_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  192|  3.09k|      void curve_mul_tmp(BigInt& x, const BigInt& y, BigInt& tmp, secure_vector<word>& ws) const {
  193|  3.09k|         curve_mul(tmp, x, y, ws);
  194|  3.09k|         x.swap(tmp);
  195|  3.09k|      }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_P25610redc_mod_pERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  294|  58.9k|      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p256(x, ws); }
curve_gfp.cpp:_ZN5Botan12_GLOBAL__N_113CurveGFp_P384C2ERKNS_6BigIntES4_:
  376|      1|      CurveGFp_P384(const BigInt& a, const BigInt& b) : CurveGFp_NIST(384, a, b) {}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_P3845get_pEv:
  378|  19.2k|      const BigInt& get_p() const override { return prime_p384(); }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_P38414invert_elementERKNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  386|     99|BigInt CurveGFp_P384::invert_element(const BigInt& x, secure_vector<word>& ws) const {
  387|       |   // From https://briansmith.org/ecc-inversion-addition-chains-01
  388|       |
  389|     99|   BigInt r, x2, x3, x15, x30, tmp, rl;
  390|       |
  391|     99|   r = x;
  392|     99|   curve_sqr_tmp(r, tmp, ws);
  393|     99|   curve_mul_tmp(r, x, tmp, ws);
  394|     99|   x2 = r;
  395|       |
  396|     99|   curve_sqr_tmp(r, tmp, ws);
  397|     99|   curve_mul_tmp(r, x, tmp, ws);
  398|       |
  399|     99|   x3 = r;
  400|       |
  401|    396|   for(size_t i = 0; i != 3; ++i) {
  ------------------
  |  Branch (401:22): [True: 297, False: 99]
  ------------------
  402|    297|      curve_sqr_tmp(r, tmp, ws);
  403|    297|   }
  404|     99|   curve_mul_tmp(r, x3, tmp, ws);
  405|       |
  406|     99|   rl = r;
  407|    693|   for(size_t i = 0; i != 6; ++i) {
  ------------------
  |  Branch (407:22): [True: 594, False: 99]
  ------------------
  408|    594|      curve_sqr_tmp(r, tmp, ws);
  409|    594|   }
  410|     99|   curve_mul_tmp(r, rl, tmp, ws);
  411|       |
  412|    396|   for(size_t i = 0; i != 3; ++i) {
  ------------------
  |  Branch (412:22): [True: 297, False: 99]
  ------------------
  413|    297|      curve_sqr_tmp(r, tmp, ws);
  414|    297|   }
  415|     99|   curve_mul_tmp(r, x3, tmp, ws);
  416|       |
  417|     99|   x15 = r;
  418|  1.58k|   for(size_t i = 0; i != 15; ++i) {
  ------------------
  |  Branch (418:22): [True: 1.48k, False: 99]
  ------------------
  419|  1.48k|      curve_sqr_tmp(r, tmp, ws);
  420|  1.48k|   }
  421|     99|   curve_mul_tmp(r, x15, tmp, ws);
  422|       |
  423|     99|   x30 = r;
  424|  3.06k|   for(size_t i = 0; i != 30; ++i) {
  ------------------
  |  Branch (424:22): [True: 2.97k, False: 99]
  ------------------
  425|  2.97k|      curve_sqr_tmp(r, tmp, ws);
  426|  2.97k|   }
  427|     99|   curve_mul_tmp(r, x30, tmp, ws);
  428|       |
  429|     99|   rl = r;
  430|  6.03k|   for(size_t i = 0; i != 60; ++i) {
  ------------------
  |  Branch (430:22): [True: 5.94k, False: 99]
  ------------------
  431|  5.94k|      curve_sqr_tmp(r, tmp, ws);
  432|  5.94k|   }
  433|     99|   curve_mul_tmp(r, rl, tmp, ws);
  434|       |
  435|     99|   rl = r;
  436|  11.9k|   for(size_t i = 0; i != 120; ++i) {
  ------------------
  |  Branch (436:22): [True: 11.8k, False: 99]
  ------------------
  437|  11.8k|      curve_sqr_tmp(r, tmp, ws);
  438|  11.8k|   }
  439|     99|   curve_mul_tmp(r, rl, tmp, ws);
  440|       |
  441|  1.58k|   for(size_t i = 0; i != 15; ++i) {
  ------------------
  |  Branch (441:22): [True: 1.48k, False: 99]
  ------------------
  442|  1.48k|      curve_sqr_tmp(r, tmp, ws);
  443|  1.48k|   }
  444|     99|   curve_mul_tmp(r, x15, tmp, ws);
  445|       |
  446|  3.16k|   for(size_t i = 0; i != 31; ++i) {
  ------------------
  |  Branch (446:22): [True: 3.06k, False: 99]
  ------------------
  447|  3.06k|      curve_sqr_tmp(r, tmp, ws);
  448|  3.06k|   }
  449|     99|   curve_mul_tmp(r, x30, tmp, ws);
  450|       |
  451|    297|   for(size_t i = 0; i != 2; ++i) {
  ------------------
  |  Branch (451:22): [True: 198, False: 99]
  ------------------
  452|    198|      curve_sqr_tmp(r, tmp, ws);
  453|    198|   }
  454|     99|   curve_mul_tmp(r, x2, tmp, ws);
  455|       |
  456|  9.40k|   for(size_t i = 0; i != 94; ++i) {
  ------------------
  |  Branch (456:22): [True: 9.30k, False: 99]
  ------------------
  457|  9.30k|      curve_sqr_tmp(r, tmp, ws);
  458|  9.30k|   }
  459|     99|   curve_mul_tmp(r, x30, tmp, ws);
  460|       |
  461|    297|   for(size_t i = 0; i != 2; ++i) {
  ------------------
  |  Branch (461:22): [True: 198, False: 99]
  ------------------
  462|    198|      curve_sqr_tmp(r, tmp, ws);
  463|    198|   }
  464|       |
  465|     99|   curve_mul_tmp(r, x, tmp, ws);
  466|       |
  467|     99|   return r;
  468|     99|}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_P38410redc_mod_pERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  381|   240k|      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p384(x, ws); }
curve_gfp.cpp:_ZN5Botan12_GLOBAL__N_113CurveGFp_P521C2ERKNS_6BigIntES4_:
  475|      1|      CurveGFp_P521(const BigInt& a, const BigInt& b) : CurveGFp_NIST(521, a, b) {}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_P5215get_pEv:
  477|  44.0k|      const BigInt& get_p() const override { return prime_p521(); }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_P52114invert_elementERKNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  485|    117|BigInt CurveGFp_P521::invert_element(const BigInt& x, secure_vector<word>& ws) const {
  486|       |   // Addition chain from https://eprint.iacr.org/2014/852.pdf section
  487|       |
  488|    117|   BigInt r;
  489|    117|   BigInt rl;
  490|    117|   BigInt a7;
  491|    117|   BigInt tmp;
  492|       |
  493|    117|   curve_sqr(r, x, ws);
  494|    117|   curve_mul_tmp(r, x, tmp, ws);
  495|       |
  496|    117|   curve_sqr_tmp(r, tmp, ws);
  497|    117|   curve_mul_tmp(r, x, tmp, ws);
  498|       |
  499|    117|   rl = r;
  500|       |
  501|    468|   for(size_t i = 0; i != 3; ++i) {
  ------------------
  |  Branch (501:22): [True: 351, False: 117]
  ------------------
  502|    351|      curve_sqr_tmp(r, tmp, ws);
  503|    351|   }
  504|    117|   curve_mul_tmp(r, rl, tmp, ws);
  505|       |
  506|    117|   curve_sqr_tmp(r, tmp, ws);
  507|    117|   curve_mul_tmp(r, x, tmp, ws);
  508|    117|   a7 = r;  // need this value later
  509|       |
  510|    117|   curve_sqr_tmp(r, tmp, ws);
  511|    117|   curve_mul_tmp(r, x, tmp, ws);
  512|       |
  513|    117|   rl = r;
  514|  1.05k|   for(size_t i = 0; i != 8; ++i) {
  ------------------
  |  Branch (514:22): [True: 936, False: 117]
  ------------------
  515|    936|      curve_sqr_tmp(r, tmp, ws);
  516|    936|   }
  517|    117|   curve_mul_tmp(r, rl, tmp, ws);
  518|       |
  519|    117|   rl = r;
  520|  1.98k|   for(size_t i = 0; i != 16; ++i) {
  ------------------
  |  Branch (520:22): [True: 1.87k, False: 117]
  ------------------
  521|  1.87k|      curve_sqr_tmp(r, tmp, ws);
  522|  1.87k|   }
  523|    117|   curve_mul_tmp(r, rl, tmp, ws);
  524|       |
  525|    117|   rl = r;
  526|  3.86k|   for(size_t i = 0; i != 32; ++i) {
  ------------------
  |  Branch (526:22): [True: 3.74k, False: 117]
  ------------------
  527|  3.74k|      curve_sqr_tmp(r, tmp, ws);
  528|  3.74k|   }
  529|    117|   curve_mul_tmp(r, rl, tmp, ws);
  530|       |
  531|    117|   rl = r;
  532|  7.60k|   for(size_t i = 0; i != 64; ++i) {
  ------------------
  |  Branch (532:22): [True: 7.48k, False: 117]
  ------------------
  533|  7.48k|      curve_sqr_tmp(r, tmp, ws);
  534|  7.48k|   }
  535|    117|   curve_mul_tmp(r, rl, tmp, ws);
  536|       |
  537|    117|   rl = r;
  538|  15.0k|   for(size_t i = 0; i != 128; ++i) {
  ------------------
  |  Branch (538:22): [True: 14.9k, False: 117]
  ------------------
  539|  14.9k|      curve_sqr_tmp(r, tmp, ws);
  540|  14.9k|   }
  541|    117|   curve_mul_tmp(r, rl, tmp, ws);
  542|       |
  543|    117|   rl = r;
  544|  30.0k|   for(size_t i = 0; i != 256; ++i) {
  ------------------
  |  Branch (544:22): [True: 29.9k, False: 117]
  ------------------
  545|  29.9k|      curve_sqr_tmp(r, tmp, ws);
  546|  29.9k|   }
  547|    117|   curve_mul_tmp(r, rl, tmp, ws);
  548|       |
  549|    936|   for(size_t i = 0; i != 7; ++i) {
  ------------------
  |  Branch (549:22): [True: 819, False: 117]
  ------------------
  550|    819|      curve_sqr_tmp(r, tmp, ws);
  551|    819|   }
  552|    117|   curve_mul_tmp(r, a7, tmp, ws);
  553|       |
  554|    351|   for(size_t i = 0; i != 2; ++i) {
  ------------------
  |  Branch (554:22): [True: 234, False: 117]
  ------------------
  555|    234|      curve_sqr_tmp(r, tmp, ws);
  556|    234|   }
  557|    117|   curve_mul_tmp(r, x, tmp, ws);
  558|       |
  559|    117|   return r;
  560|    117|}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_P52110redc_mod_pERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  480|   505k|      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p521(x, ws); }
curve_gfp.cpp:_ZN5Botan12_GLOBAL__N_119CurveGFp_MontgomeryC2ERKNS_6BigIntES4_S4_:
   24|    633|            m_p(p), m_a(a), m_b(b), m_p_words(m_p.sig_words()), m_p_dash(monty_inverse(m_p.word_at(0))) {
   25|    633|         Modular_Reducer mod_p(m_p);
   26|       |
   27|    633|         m_r.set_bit(m_p_words * BOTAN_MP_WORD_BITS);
  ------------------
  |  |   50|    633|#define BOTAN_MP_WORD_BITS 64
  ------------------
   28|    633|         m_r = mod_p.reduce(m_r);
   29|       |
   30|    633|         m_r2 = mod_p.square(m_r);
   31|    633|         m_r3 = mod_p.multiply(m_r, m_r2);
   32|    633|         m_a_r = mod_p.multiply(m_r, m_a);
   33|    633|         m_b_r = mod_p.multiply(m_r, m_b);
   34|       |
   35|    633|         m_a_is_zero = m_a.is_zero();
   36|    633|         m_a_is_minus_3 = (m_a + 3 == m_p);
   37|    633|      }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery5get_pEv:
   47|   736k|      const BigInt& get_p() const override { return m_p; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery5get_aEv:
   43|  42.5k|      const BigInt& get_a() const override { return m_a; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery5get_bEv:
   45|  41.6k|      const BigInt& get_b() const override { return m_b; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery11get_p_wordsEv:
   57|   287k|      size_t get_p_words() const override { return m_p_words; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery11get_ws_sizeEv:
   59|  9.94M|      size_t get_ws_size() const override { return 2 * m_p_words; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery6is_oneERKNS_6BigIntE:
   55|    125|      bool is_one(const BigInt& x) const override { return x == m_r; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery9a_is_zeroEv:
   39|   232k|      bool a_is_zero() const override { return m_a_is_zero; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery12a_is_minus_3Ev:
   41|   103k|      bool a_is_minus_3() const override { return m_a_is_minus_3; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery9get_a_repEv:
   49|  30.0k|      const BigInt& get_a_rep() const override { return m_a_r; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery9get_b_repEv:
   51|  1.63k|      const BigInt& get_b_rep() const override { return m_b_r; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery9get_1_repEv:
   53|  5.97k|      const BigInt& get_1_rep() const override { return m_r; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery14invert_elementERKNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
   86|    926|BigInt CurveGFp_Montgomery::invert_element(const BigInt& x, secure_vector<word>& ws) const {
   87|       |   // Should we use Montgomery inverse instead?
   88|    926|   const BigInt inv = inverse_mod(x, m_p);
   89|    926|   BigInt res;
   90|    926|   curve_mul(res, inv, m_r3, ws);
   91|    926|   return res;
   92|    926|}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery12to_curve_repERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
   94|  2.12k|void CurveGFp_Montgomery::to_curve_rep(BigInt& x, secure_vector<word>& ws) const {
   95|  2.12k|   const BigInt tx = x;
   96|  2.12k|   curve_mul(x, tx, m_r2, ws);
   97|  2.12k|}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery14from_curve_repERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
   99|  2.62k|void CurveGFp_Montgomery::from_curve_rep(BigInt& z, secure_vector<word>& ws) const {
  100|  2.62k|   if(ws.size() < get_ws_size()) {
  ------------------
  |  Branch (100:7): [True: 0, False: 2.62k]
  ------------------
  101|      0|      ws.resize(get_ws_size());
  102|      0|   }
  103|       |
  104|  2.62k|   const size_t output_size = 2 * m_p_words;
  105|  2.62k|   if(z.size() < output_size) {
  ------------------
  |  Branch (105:7): [True: 0, False: 2.62k]
  ------------------
  106|      0|      z.grow_to(output_size);
  107|      0|   }
  108|       |
  109|  2.62k|   bigint_monty_redc(z.mutable_data(), m_p.data(), m_p_words, m_p_dash, ws.data(), ws.size());
  110|  2.62k|}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery15curve_mul_wordsERNS_6BigIntEPKmmRKS2_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  113|  6.87M|   BigInt& z, const word x_w[], size_t x_size, const BigInt& y, secure_vector<word>& ws) const {
  114|  6.87M|   BOTAN_DEBUG_ASSERT(y.sig_words() <= m_p_words);
  ------------------
  |  |   99|  6.87M|      do {                          \
  |  |  100|  6.87M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  115|       |
  116|  6.87M|   if(ws.size() < get_ws_size()) {
  ------------------
  |  Branch (116:7): [True: 0, False: 6.87M]
  ------------------
  117|      0|      ws.resize(get_ws_size());
  118|      0|   }
  119|       |
  120|  6.87M|   const size_t output_size = 2 * m_p_words;
  121|  6.87M|   if(z.size() < output_size) {
  ------------------
  |  Branch (121:7): [True: 1.84M, False: 5.02M]
  ------------------
  122|  1.84M|      z.grow_to(output_size);
  123|  1.84M|   }
  124|       |
  125|  6.87M|   bigint_mul(z.mutable_data(),
  126|  6.87M|              z.size(),
  127|  6.87M|              x_w,
  128|  6.87M|              x_size,
  129|  6.87M|              std::min(m_p_words, x_size),
  130|  6.87M|              y.data(),
  131|  6.87M|              y.size(),
  132|  6.87M|              std::min(m_p_words, y.size()),
  133|  6.87M|              ws.data(),
  134|  6.87M|              ws.size());
  135|       |
  136|  6.87M|   bigint_monty_redc(z.mutable_data(), m_p.data(), m_p_words, m_p_dash, ws.data(), ws.size());
  137|  6.87M|}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery15curve_sqr_wordsERNS_6BigIntEPKmmRNSt3__16vectorImNS_16secure_allocatorImEEEE:
  139|  2.55M|void CurveGFp_Montgomery::curve_sqr_words(BigInt& z, const word x[], size_t x_size, secure_vector<word>& ws) const {
  140|  2.55M|   if(ws.size() < get_ws_size()) {
  ------------------
  |  Branch (140:7): [True: 991, False: 2.55M]
  ------------------
  141|    991|      ws.resize(get_ws_size());
  142|    991|   }
  143|       |
  144|  2.55M|   const size_t output_size = 2 * m_p_words;
  145|  2.55M|   if(z.size() < output_size) {
  ------------------
  |  Branch (145:7): [True: 79.3k, False: 2.47M]
  ------------------
  146|  79.3k|      z.grow_to(output_size);
  147|  79.3k|   }
  148|       |
  149|  2.55M|   bigint_sqr(z.mutable_data(), z.size(), x, x_size, std::min(m_p_words, x_size), ws.data(), ws.size());
  150|       |
  151|  2.55M|   bigint_monty_redc(z.mutable_data(), m_p.data(), m_p_words, m_p_dash, ws.data(), ws.size());
  152|  2.55M|}

_ZN5Botan8EC_Group13ec_group_dataEv:
  289|  1.98k|EC_Group_Data_Map& EC_Group::ec_group_data() {
  290|       |   /*
  291|       |   * This exists purely to ensure the allocator is constructed before g_ec_data,
  292|       |   * which ensures that its destructor runs after ~g_ec_data is complete.
  293|       |   */
  294|       |
  295|  1.98k|   static Allocator_Initializer g_init_allocator;
  296|  1.98k|   static EC_Group_Data_Map g_ec_data;
  297|  1.98k|   return g_ec_data;
  298|  1.98k|}
_ZN5Botan8EC_Group18load_EC_group_infoEPKcS2_S2_S2_S2_S2_RKNS_3OIDE:
  312|    143|                                                            const OID& oid) {
  313|    143|   const BigInt p(p_str);
  314|    143|   const BigInt a(a_str);
  315|    143|   const BigInt b(b_str);
  316|    143|   const BigInt g_x(g_x_str);
  317|    143|   const BigInt g_y(g_y_str);
  318|    143|   const BigInt order(order_str);
  319|    143|   const BigInt cofactor(1);  // implicit
  320|       |
  321|    143|   return std::make_shared<EC_Group_Data>(p, a, b, g_x, g_y, order, cofactor, oid, EC_Group_Source::Builtin);
  322|    143|}
_ZN5Botan8EC_Group19BER_decode_EC_groupEPKhmNS_15EC_Group_SourceE:
  327|  2.09k|                                                                              EC_Group_Source source) {
  328|  2.09k|   BER_Decoder ber(bits, len);
  329|  2.09k|   BER_Object obj = ber.get_next_object();
  330|       |
  331|  2.09k|   if(obj.type() == ASN1_Type::ObjectId) {
  ------------------
  |  Branch (331:7): [True: 1.38k, False: 709]
  ------------------
  332|  1.38k|      OID dom_par_oid;
  333|  1.38k|      BER_Decoder(bits, len).decode(dom_par_oid);
  334|  1.38k|      return std::make_pair(ec_group_data().lookup(dom_par_oid), false);
  335|  1.38k|   }
  336|       |
  337|    709|   if(obj.type() == ASN1_Type::Sequence) {
  ------------------
  |  Branch (337:7): [True: 659, False: 50]
  ------------------
  338|    659|      BigInt p, a, b, order, cofactor;
  339|    659|      std::vector<uint8_t> base_pt;
  340|    659|      std::vector<uint8_t> seed;
  341|       |
  342|    659|      BER_Decoder(bits, len)
  343|    659|         .start_sequence()
  344|    659|         .decode_and_check<size_t>(1, "Unknown ECC param version code")
  345|    659|         .start_sequence()
  346|    659|         .decode_and_check(OID("1.2.840.10045.1.1"), "Only prime ECC fields supported")
  347|    659|         .decode(p)
  348|    659|         .end_cons()
  349|    659|         .start_sequence()
  350|    659|         .decode_octet_string_bigint(a)
  351|    659|         .decode_octet_string_bigint(b)
  352|    659|         .decode_optional_string(seed, ASN1_Type::BitString, ASN1_Type::BitString)
  353|    659|         .end_cons()
  354|    659|         .decode(base_pt, ASN1_Type::OctetString)
  355|    659|         .decode(order)
  356|    659|         .decode(cofactor)
  357|    659|         .end_cons()
  358|    659|         .verify_end();
  359|       |
  360|    659|      if(p.bits() < 112 || p.bits() > 1024) {
  ------------------
  |  Branch (360:10): [True: 49, False: 610]
  |  Branch (360:28): [True: 0, False: 610]
  ------------------
  361|      1|         throw Decoding_Error("ECC p parameter is invalid size");
  362|      1|      }
  363|       |
  364|    658|      if(p.is_negative() || !is_bailie_psw_probable_prime(p)) {
  ------------------
  |  Branch (364:10): [True: 49, False: 609]
  |  Branch (364:29): [True: 15, False: 594]
  ------------------
  365|     16|         throw Decoding_Error("ECC p parameter is not a prime");
  366|     16|      }
  367|       |
  368|    642|      if(a.is_negative() || a >= p) {
  ------------------
  |  Branch (368:10): [True: 48, False: 594]
  |  Branch (368:29): [True: 0, False: 594]
  ------------------
  369|      0|         throw Decoding_Error("Invalid ECC a parameter");
  370|      0|      }
  371|       |
  372|    642|      if(b <= 0 || b >= p) {
  ------------------
  |  Branch (372:10): [True: 49, False: 593]
  |  Branch (372:20): [True: 1, False: 592]
  ------------------
  373|      2|         throw Decoding_Error("Invalid ECC b parameter");
  374|      2|      }
  375|       |
  376|    640|      if(order <= 0 || !is_bailie_psw_probable_prime(order)) {
  ------------------
  |  Branch (376:10): [True: 49, False: 591]
  |  Branch (376:24): [True: 36, False: 555]
  ------------------
  377|     37|         throw Decoding_Error("Invalid ECC order parameter");
  378|     37|      }
  379|       |
  380|    603|      if(cofactor <= 0 || cofactor >= 16) {
  ------------------
  |  Branch (380:10): [True: 51, False: 552]
  |  Branch (380:27): [True: 43, False: 509]
  ------------------
  381|     46|         throw Decoding_Error("Invalid ECC cofactor parameter");
  382|     46|      }
  383|       |
  384|    557|      std::pair<BigInt, BigInt> base_xy = Botan::OS2ECP(base_pt.data(), base_pt.size(), p, a, b);
  385|       |
  386|    557|      auto data =
  387|    557|         ec_group_data().lookup_or_create(p, a, b, base_xy.first, base_xy.second, order, cofactor, OID(), source);
  388|    557|      return std::make_pair(data, true);
  389|    603|   }
  390|       |
  391|     50|   if(obj.type() == ASN1_Type::Null) {
  ------------------
  |  Branch (391:7): [True: 3, False: 47]
  ------------------
  392|      3|      throw Decoding_Error("Cannot handle ImplicitCA ECC parameters");
  393|     47|   } else {
  394|     47|      throw Decoding_Error(fmt("Unexpected tag {} while decoding ECC domain params", asn1_tag_to_string(obj.type())));
  395|     47|   }
  396|     50|}
_ZN5Botan8EC_GroupC2Ev:
  398|    102|EC_Group::EC_Group() = default;
_ZN5Botan8EC_GroupD2Ev:
  400|  2.54k|EC_Group::~EC_Group() = default;
_ZN5Botan8EC_GroupC2ERKNS_3OIDE:
  402|    100|EC_Group::EC_Group(const OID& domain_oid) {
  403|    100|   this->m_data = ec_group_data().lookup(domain_oid);
  404|    100|   if(!this->m_data) {
  ------------------
  |  Branch (404:7): [True: 8, False: 92]
  ------------------
  405|      8|      throw Invalid_Argument("Unknown EC_Group " + domain_oid.to_string());
  406|      8|   }
  407|    100|}
_ZN5Botan8EC_GroupC2EPKhm:
  455|  2.09k|EC_Group::EC_Group(const uint8_t ber[], size_t ber_len) {
  456|  2.09k|   auto data = BER_decode_EC_group(ber, ber_len, EC_Group_Source::ExternalSource);
  457|  2.09k|   m_data = data.first;
  458|  2.09k|   m_explicit_encoding = data.second;
  459|  2.09k|}
_ZNK5Botan8EC_Group4dataEv:
  461|  6.17k|const EC_Group_Data& EC_Group::data() const {
  462|  6.17k|   if(m_data == nullptr) {
  ------------------
  |  Branch (462:7): [True: 64, False: 6.11k]
  ------------------
  463|     64|      throw Invalid_State("EC_Group uninitialized");
  464|     64|   }
  465|  6.11k|   return *m_data;
  466|  6.17k|}
_ZNK5Botan8EC_Group10get_p_bitsEv:
  476|     92|size_t EC_Group::get_p_bits() const {
  477|     92|   return data().p_bits();
  478|     92|}
_ZNK5Botan8EC_Group14get_order_bitsEv:
  484|    202|size_t EC_Group::get_order_bits() const {
  485|    202|   return data().order_bits();
  486|    202|}
_ZNK5Botan8EC_Group15get_order_bytesEv:
  488|    490|size_t EC_Group::get_order_bytes() const {
  489|    490|   return data().order_bytes();
  490|    490|}
_ZNK5Botan8EC_Group14get_base_pointEv:
  504|    493|const EC_Point& EC_Group::get_base_point() const {
  505|    493|   return data().base_point();
  506|    493|}
_ZNK5Botan8EC_Group9get_orderEv:
  508|    965|const BigInt& EC_Group::get_order() const {
  509|    965|   return data().order();
  510|    965|}
_ZNK5Botan8EC_Group9mod_orderERKNS_6BigIntE:
  524|    467|BigInt EC_Group::mod_order(const BigInt& k) const {
  525|    467|   return data().mod_order(k);
  526|    467|}
_ZNK5Botan8EC_Group18multiply_mod_orderERKNS_6BigIntES3_:
  532|    534|BigInt EC_Group::multiply_mod_order(const BigInt& x, const BigInt& y) const {
  533|    534|   return data().multiply_mod_order(x, y);
  534|    534|}
_ZNK5Botan8EC_Group17inverse_mod_orderERKNS_6BigIntE:
  540|    267|BigInt EC_Group::inverse_mod_order(const BigInt& x) const {
  541|    267|   return data().inverse_mod_order(x);
  542|    267|}
_ZNK5Botan8EC_Group13get_curve_oidEv:
  544|    731|const OID& EC_Group::get_curve_oid() const {
  545|    731|   return data().oid();
  546|    731|}
_ZNK5Botan8EC_Group6OS2ECPEPKhm:
  561|  1.85k|EC_Point EC_Group::OS2ECP(const uint8_t bits[], size_t len) const {
  562|  1.85k|   return Botan::OS2ECP(bits, len, data().curve());
  563|  1.85k|}
_ZNK5Botan8EC_Group5pointERKNS_6BigIntES3_:
  565|     81|EC_Point EC_Group::point(const BigInt& x, const BigInt& y) const {
  566|       |   // TODO: randomize the representation?
  567|     81|   return EC_Point(data().curve(), x, y);
  568|     81|}
_ZN5Botan17EC_Group_Data_MapC2Ev:
  147|      1|      EC_Group_Data_Map() = default;
_ZN5Botan17EC_Group_Data_Map6lookupERKNS_3OIDE:
  156|  1.48k|      std::shared_ptr<EC_Group_Data> lookup(const OID& oid) {
  157|  1.48k|         lock_guard_type<mutex_type> lock(m_mutex);
  158|       |
  159|  65.1k|         for(auto i : m_registered_curves) {
  ------------------
  |  Branch (159:21): [True: 65.1k, False: 215]
  ------------------
  160|  65.1k|            if(i->oid() == oid) {
  ------------------
  |  Branch (160:16): [True: 1.26k, False: 63.8k]
  ------------------
  161|  1.26k|               return i;
  162|  1.26k|            }
  163|  65.1k|         }
  164|       |
  165|       |         // Not found, check hardcoded data
  166|    215|         std::shared_ptr<EC_Group_Data> data = EC_Group::EC_group_info(oid);
  167|       |
  168|    215|         if(data) {
  ------------------
  |  Branch (168:13): [True: 143, False: 72]
  ------------------
  169|  47.0k|            for(auto curve : m_registered_curves) {
  ------------------
  |  Branch (169:28): [True: 47.0k, False: 143]
  ------------------
  170|  47.0k|               if(curve->oid().empty() == true && curve->params_match(*data)) {
  ------------------
  |  Branch (170:19): [True: 36.8k, False: 10.1k]
  |  Branch (170:51): [True: 0, False: 36.8k]
  ------------------
  171|      0|                  curve->set_oid(oid);
  172|      0|                  return curve;
  173|      0|               }
  174|  47.0k|            }
  175|       |
  176|    143|            m_registered_curves.push_back(data);
  177|    143|            return data;
  178|    143|         }
  179|       |
  180|       |         // Nope, unknown curve
  181|     72|         return std::shared_ptr<EC_Group_Data>();
  182|    215|      }
_ZNK5Botan13EC_Group_Data12params_matchERKS0_:
   67|  36.8k|      bool params_match(const EC_Group_Data& other) const {
   68|  36.8k|         return params_match(
   69|  36.8k|            other.p(), other.a(), other.b(), other.g_x(), other.g_y(), other.order(), other.cofactor());
   70|  36.8k|      }
_ZNK5Botan13EC_Group_Data12params_matchERKNS_6BigIntES3_S3_S3_S3_S3_S3_:
   62|   184k|                        const BigInt& cofactor) const {
   63|   184k|         return (this->p() == p && this->a() == a && this->b() == b && this->order() == order &&
  ------------------
  |  Branch (63:18): [True: 4.55k, False: 180k]
  |  Branch (63:36): [True: 3.66k, False: 892]
  |  Branch (63:54): [True: 628, False: 3.03k]
  |  Branch (63:72): [True: 201, False: 427]
  ------------------
   64|   184k|                 this->cofactor() == cofactor && this->g_x() == g_x && this->g_y() == g_y);
  ------------------
  |  Branch (64:18): [True: 127, False: 74]
  |  Branch (64:50): [True: 28, False: 99]
  |  Branch (64:72): [True: 4, False: 24]
  ------------------
   65|   184k|      }
_ZN5Botan17EC_Group_Data_Map16lookup_or_createERKNS_6BigIntES3_S3_S3_S3_S3_S3_RKNS_3OIDENS_15EC_Group_SourceE:
  192|    501|                                                      EC_Group_Source source) {
  193|    501|         lock_guard_type<mutex_type> lock(m_mutex);
  194|       |
  195|   147k|         for(auto i : m_registered_curves) {
  ------------------
  |  Branch (195:21): [True: 147k, False: 497]
  ------------------
  196|       |            /*
  197|       |            * The params may be the same but you are trying to register under a
  198|       |            * different OID than the one we are using, so using a different
  199|       |            * group, since EC_Group's model assumes a single OID per group.
  200|       |            */
  201|   147k|            if(!oid.empty() && !i->oid().empty() && i->oid() != oid) {
  ------------------
  |  Branch (201:16): [True: 0, False: 147k]
  |  Branch (201:32): [True: 0, False: 0]
  |  Branch (201:53): [True: 0, False: 0]
  ------------------
  202|      0|               continue;
  203|      0|            }
  204|       |
  205|   147k|            const bool same_oid = !oid.empty() && i->oid() == oid;
  ------------------
  |  Branch (205:35): [True: 0, False: 147k]
  |  Branch (205:51): [True: 0, False: 0]
  ------------------
  206|   147k|            const bool same_params = i->params_match(p, a, b, g_x, g_y, order, cofactor);
  207|       |
  208|       |            /*
  209|       |            * If the params and OID are the same then we are done, just return
  210|       |            * the already registered curve obj.
  211|       |            */
  212|   147k|            if(same_params && same_oid) {
  ------------------
  |  Branch (212:16): [True: 4, False: 147k]
  |  Branch (212:31): [True: 0, False: 4]
  ------------------
  213|      0|               return i;
  214|      0|            }
  215|       |
  216|       |            /*
  217|       |            * If same params and the new OID is empty, then that's ok too
  218|       |            */
  219|   147k|            if(same_params && oid.empty()) {
  ------------------
  |  Branch (219:16): [True: 4, False: 147k]
  |  Branch (219:31): [True: 4, False: 0]
  ------------------
  220|      4|               return i;
  221|      4|            }
  222|       |
  223|       |            /*
  224|       |            * Check for someone trying to reuse an already in-use OID
  225|       |            */
  226|   147k|            if(same_oid && !same_params) {
  ------------------
  |  Branch (226:16): [True: 0, False: 147k]
  |  Branch (226:28): [True: 0, False: 0]
  ------------------
  227|      0|               throw Invalid_Argument("Attempting to register a curve using OID " + oid.to_string() +
  228|      0|                                      " but a distinct curve is already registered using that OID");
  229|      0|            }
  230|       |
  231|       |            /*
  232|       |            * If the same curve was previously created without an OID but is now
  233|       |            * being registered again using an OID, save that OID.
  234|       |            */
  235|   147k|            if(same_params && i->oid().empty() && !oid.empty()) {
  ------------------
  |  Branch (235:16): [True: 0, False: 147k]
  |  Branch (235:31): [True: 0, False: 0]
  |  Branch (235:51): [True: 0, False: 0]
  ------------------
  236|      0|               i->set_oid(oid);
  237|      0|               return i;
  238|      0|            }
  239|   147k|         }
  240|       |
  241|       |         /*
  242|       |         Not found in current list, so we need to create a new entry
  243|       |
  244|       |         If an OID is set, try to look up relative our static tables to detect a duplicate
  245|       |         registration under an OID
  246|       |         */
  247|       |
  248|    497|         std::shared_ptr<EC_Group_Data> new_group =
  249|    497|            std::make_shared<EC_Group_Data>(p, a, b, g_x, g_y, order, cofactor, oid, source);
  250|       |
  251|    497|         if(oid.has_value()) {
  ------------------
  |  Branch (251:13): [True: 0, False: 497]
  ------------------
  252|      0|            std::shared_ptr<EC_Group_Data> data = EC_Group::EC_group_info(oid);
  253|      0|            if(data != nullptr && !new_group->params_match(*data)) {
  ------------------
  |  Branch (253:16): [True: 0, False: 0]
  |  Branch (253:35): [True: 0, False: 0]
  ------------------
  254|      0|               throw Invalid_Argument("Attempting to register an EC group under OID of hardcoded group");
  255|      0|            }
  256|    497|         } else {
  257|       |            // Here try to use the order as a hint to look up the group id, to identify common groups
  258|    497|            const OID oid_from_store = EC_Group::EC_group_identity_from_order(order);
  259|    497|            if(oid_from_store.has_value()) {
  ------------------
  |  Branch (259:16): [True: 0, False: 497]
  ------------------
  260|      0|               std::shared_ptr<EC_Group_Data> data = EC_Group::EC_group_info(oid_from_store);
  261|       |
  262|       |               /*
  263|       |               If EC_group_identity_from_order returned an OID then looking up that OID
  264|       |               must always return a result.
  265|       |               */
  266|      0|               BOTAN_ASSERT_NOMSG(data != nullptr);
  ------------------
  |  |   60|      0|   do {                                                                     \
  |  |   61|      0|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 0]
  |  |  ------------------
  |  |   62|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  267|       |
  268|       |               /*
  269|       |               It is possible (if unlikely) that someone is registering another group
  270|       |               that happens to have an order equal to that of a well known group -
  271|       |               so verify all values before assigning the OID.
  272|       |               */
  273|      0|               if(new_group->params_match(*data)) {
  ------------------
  |  Branch (273:19): [True: 0, False: 0]
  ------------------
  274|      0|                  new_group->set_oid(oid_from_store);
  275|      0|               }
  276|      0|            }
  277|    497|         }
  278|       |
  279|    497|         m_registered_curves.push_back(new_group);
  280|    497|         return new_group;
  281|    497|      }
_ZN5Botan13EC_Group_DataC2ERKNS_6BigIntES3_S3_S3_S3_S3_S3_RKNS_3OIDENS_15EC_Group_SourceE:
   54|    640|            m_source(source) {}
_ZNK5Botan13EC_Group_Data6p_bitsEv:
   93|     92|      size_t p_bits() const { return m_p_bits; }
_ZNK5Botan13EC_Group_Data10order_bitsEv:
   97|    202|      size_t order_bits() const { return m_order_bits; }
_ZNK5Botan13EC_Group_Data11order_bytesEv:
   99|    490|      size_t order_bytes() const { return (m_order_bits + 7) / 8; }
_ZNK5Botan13EC_Group_Data1pEv:
   79|   221k|      const BigInt& p() const { return m_curve.get_p(); }
_ZNK5Botan13EC_Group_Data1aEv:
   81|  41.4k|      const BigInt& a() const { return m_curve.get_a(); }
_ZNK5Botan13EC_Group_Data1bEv:
   83|  40.5k|      const BigInt& b() const { return m_curve.get_b(); }
_ZNK5Botan13EC_Group_Data10base_pointEv:
  103|    493|      const EC_Point& base_point() const { return m_base_point; }
_ZNK5Botan13EC_Group_Data5orderEv:
   85|  38.4k|      const BigInt& order() const { return m_order; }
_ZNK5Botan13EC_Group_Data3g_xEv:
   89|  37.0k|      const BigInt& g_x() const { return m_g_x; }
_ZNK5Botan13EC_Group_Data3g_yEv:
   91|  36.9k|      const BigInt& g_y() const { return m_g_y; }
_ZNK5Botan13EC_Group_Data8cofactorEv:
   87|  37.0k|      const BigInt& cofactor() const { return m_cofactor; }
_ZNK5Botan13EC_Group_Data9mod_orderERKNS_6BigIntE:
  109|    467|      BigInt mod_order(const BigInt& x) const { return m_mod_order.reduce(x); }
_ZNK5Botan13EC_Group_Data18multiply_mod_orderERKNS_6BigIntES3_:
  113|    534|      BigInt multiply_mod_order(const BigInt& x, const BigInt& y) const { return m_mod_order.multiply(x, y); }
_ZNK5Botan13EC_Group_Data17inverse_mod_orderERKNS_6BigIntE:
  119|    267|      BigInt inverse_mod_order(const BigInt& x) const { return inverse_mod(x, m_order); }
_ZNK5Botan13EC_Group_Data3oidEv:
   77|   112k|      const OID& oid() const { return m_oid; }
_ZNK5Botan13EC_Group_Data5curveEv:
  101|  1.87k|      const CurveGFp& curve() const { return m_curve; }

_ZN5Botan8EC_Group13EC_group_infoERKNS_3OIDE:
   15|    215|std::shared_ptr<EC_Group_Data> EC_Group::EC_group_info(const OID& oid) {
   16|       |   // secp256r1
   17|    215|   if(oid == OID{1, 2, 840, 10045, 3, 1, 7}) {
  ------------------
  |  Branch (17:7): [True: 1, False: 214]
  ------------------
   18|      1|      return load_EC_group_info(
   19|      1|         "0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF",
   20|      1|         "0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC",
   21|      1|         "0x5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B",
   22|      1|         "0x6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296",
   23|      1|         "0x4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5",
   24|      1|         "0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551",
   25|      1|         oid);
   26|      1|   }
   27|       |
   28|       |   // secp384r1
   29|    214|   if(oid == OID{1, 3, 132, 0, 34}) {
  ------------------
  |  Branch (29:7): [True: 1, False: 213]
  ------------------
   30|      1|      return load_EC_group_info(
   31|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFF",
   32|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFC",
   33|      1|         "0xB3312FA7E23EE7E4988E056BE3F82D19181D9C6EFE8141120314088F5013875AC656398D8A2ED19D2A85C8EDD3EC2AEF",
   34|      1|         "0xAA87CA22BE8B05378EB1C71EF320AD746E1D3B628BA79B9859F741E082542A385502F25DBF55296C3A545E3872760AB7",
   35|      1|         "0x3617DE4A96262C6F5D9E98BF9292DC29F8F41DBD289A147CE9DA3113B5F0B8C00A60B1CE1D7E819D7A431D7C90EA0E5F",
   36|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973",
   37|      1|         oid);
   38|      1|   }
   39|       |
   40|       |   // secp521r1
   41|    213|   if(oid == OID{1, 3, 132, 0, 35}) {
  ------------------
  |  Branch (41:7): [True: 1, False: 212]
  ------------------
   42|      1|      return load_EC_group_info(
   43|      1|         "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
   44|      1|         "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC",
   45|      1|         "0x51953EB9618E1C9A1F929A21A0B68540EEA2DA725B99B315F3B8B489918EF109E156193951EC7E937B1652C0BD3BB1BF073573DF883D2C34F1EF451FD46B503F00",
   46|      1|         "0xC6858E06B70404E9CD9E3ECB662395B4429C648139053FB521F828AF606B4D3DBAA14B5E77EFE75928FE1DC127A2FFA8DE3348B3C1856A429BF97E7E31C2E5BD66",
   47|      1|         "0x11839296A789A3BC0045C8A5FB42C7D1BD998F54449579B446817AFBD17273E662C97EE72995EF42640C550B9013FAD0761353C7086A272C24088BE94769FD16650",
   48|      1|         "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409",
   49|      1|         oid);
   50|      1|   }
   51|       |
   52|       |   // brainpool160r1
   53|    212|   if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 1}) {
  ------------------
  |  Branch (53:7): [True: 0, False: 212]
  ------------------
   54|      0|      return load_EC_group_info(
   55|      0|         "0xE95E4A5F737059DC60DFC7AD95B3D8139515620F",
   56|      0|         "0x340E7BE2A280EB74E2BE61BADA745D97E8F7C300",
   57|      0|         "0x1E589A8595423412134FAA2DBDEC95C8D8675E58",
   58|      0|         "0xBED5AF16EA3F6A4F62938C4631EB5AF7BDBCDBC3",
   59|      0|         "0x1667CB477A1A8EC338F94741669C976316DA6321",
   60|      0|         "0xE95E4A5F737059DC60DF5991D45029409E60FC09",
   61|      0|         oid);
   62|      0|   }
   63|       |
   64|       |   // brainpool192r1
   65|    212|   if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 3}) {
  ------------------
  |  Branch (65:7): [True: 0, False: 212]
  ------------------
   66|      0|      return load_EC_group_info(
   67|      0|         "0xC302F41D932A36CDA7A3463093D18DB78FCE476DE1A86297",
   68|      0|         "0x6A91174076B1E0E19C39C031FE8685C1CAE040E5C69A28EF",
   69|      0|         "0x469A28EF7C28CCA3DC721D044F4496BCCA7EF4146FBF25C9",
   70|      0|         "0xC0A0647EAAB6A48753B033C56CB0F0900A2F5C4853375FD6",
   71|      0|         "0x14B690866ABD5BB88B5F4828C1490002E6773FA2FA299B8F",
   72|      0|         "0xC302F41D932A36CDA7A3462F9E9E916B5BE8F1029AC4ACC1",
   73|      0|         oid);
   74|      0|   }
   75|       |
   76|       |   // brainpool224r1
   77|    212|   if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 5}) {
  ------------------
  |  Branch (77:7): [True: 0, False: 212]
  ------------------
   78|      0|      return load_EC_group_info(
   79|      0|         "0xD7C134AA264366862A18302575D1D787B09F075797DA89F57EC8C0FF",
   80|      0|         "0x68A5E62CA9CE6C1C299803A6C1530B514E182AD8B0042A59CAD29F43",
   81|      0|         "0x2580F63CCFE44138870713B1A92369E33E2135D266DBB372386C400B",
   82|      0|         "0xD9029AD2C7E5CF4340823B2A87DC68C9E4CE3174C1E6EFDEE12C07D",
   83|      0|         "0x58AA56F772C0726F24C6B89E4ECDAC24354B9E99CAA3F6D3761402CD",
   84|      0|         "0xD7C134AA264366862A18302575D0FB98D116BC4B6DDEBCA3A5A7939F",
   85|      0|         oid);
   86|      0|   }
   87|       |
   88|       |   // brainpool256r1
   89|    212|   if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 7}) {
  ------------------
  |  Branch (89:7): [True: 0, False: 212]
  ------------------
   90|      0|      return load_EC_group_info(
   91|      0|         "0xA9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377",
   92|      0|         "0x7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9",
   93|      0|         "0x26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6",
   94|      0|         "0x8BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262",
   95|      0|         "0x547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997",
   96|      0|         "0xA9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7",
   97|      0|         oid);
   98|      0|   }
   99|       |
  100|       |   // brainpool320r1
  101|    212|   if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 9}) {
  ------------------
  |  Branch (101:7): [True: 0, False: 212]
  ------------------
  102|      0|      return load_EC_group_info(
  103|      0|         "0xD35E472036BC4FB7E13C785ED201E065F98FCFA6F6F40DEF4F92B9EC7893EC28FCD412B1F1B32E27",
  104|      0|         "0x3EE30B568FBAB0F883CCEBD46D3F3BB8A2A73513F5EB79DA66190EB085FFA9F492F375A97D860EB4",
  105|      0|         "0x520883949DFDBC42D3AD198640688A6FE13F41349554B49ACC31DCCD884539816F5EB4AC8FB1F1A6",
  106|      0|         "0x43BD7E9AFB53D8B85289BCC48EE5BFE6F20137D10A087EB6E7871E2A10A599C710AF8D0D39E20611",
  107|      0|         "0x14FDD05545EC1CC8AB4093247F77275E0743FFED117182EAA9C77877AAAC6AC7D35245D1692E8EE1",
  108|      0|         "0xD35E472036BC4FB7E13C785ED201E065F98FCFA5B68F12A32D482EC7EE8658E98691555B44C59311",
  109|      0|         oid);
  110|      0|   }
  111|       |
  112|       |   // brainpool384r1
  113|    212|   if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 11}) {
  ------------------
  |  Branch (113:7): [True: 0, False: 212]
  ------------------
  114|      0|      return load_EC_group_info(
  115|      0|         "0x8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B412B1DA197FB71123ACD3A729901D1A71874700133107EC53",
  116|      0|         "0x7BC382C63D8C150C3C72080ACE05AFA0C2BEA28E4FB22787139165EFBA91F90F8AA5814A503AD4EB04A8C7DD22CE2826",
  117|      0|         "0x4A8C7DD22CE28268B39B55416F0447C2FB77DE107DCD2A62E880EA53EEB62D57CB4390295DBC9943AB78696FA504C11",
  118|      0|         "0x1D1C64F068CF45FFA2A63A81B7C13F6B8847A3E77EF14FE3DB7FCAFE0CBD10E8E826E03436D646AAEF87B2E247D4AF1E",
  119|      0|         "0x8ABE1D7520F9C2A45CB1EB8E95CFD55262B70B29FEEC5864E19C054FF99129280E4646217791811142820341263C5315",
  120|      0|         "0x8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B31F166E6CAC0425A7CF3AB6AF6B7FC3103B883202E9046565",
  121|      0|         oid);
  122|      0|   }
  123|       |
  124|       |   // brainpool512r1
  125|    212|   if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 13}) {
  ------------------
  |  Branch (125:7): [True: 0, False: 212]
  ------------------
  126|      0|      return load_EC_group_info(
  127|      0|         "0xAADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA703308717D4D9B009BC66842AECDA12AE6A380E62881FF2F2D82C68528AA6056583A48F3",
  128|      0|         "0x7830A3318B603B89E2327145AC234CC594CBDD8D3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CA",
  129|      0|         "0x3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CADC083E67984050B75EBAE5DD2809BD638016F723",
  130|      0|         "0x81AEE4BDD82ED9645A21322E9C4C6A9385ED9F70B5D916C1B43B62EEF4D0098EFF3B1F78E2D0D48D50D1687B93B97D5F7C6D5047406A5E688B352209BCB9F822",
  131|      0|         "0x7DDE385D566332ECC0EABFA9CF7822FDF209F70024A57B1AA000C55B881F8111B2DCDE494A5F485E5BCA4BD88A2763AED1CA2B2FA8F0540678CD1E0F3AD80892",
  132|      0|         "0xAADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA70330870553E5C414CA92619418661197FAC10471DB1D381085DDADDB58796829CA90069",
  133|      0|         oid);
  134|      0|   }
  135|       |
  136|       |   // frp256v1
  137|    212|   if(oid == OID{1, 2, 250, 1, 223, 101, 256, 1}) {
  ------------------
  |  Branch (137:7): [True: 0, False: 212]
  ------------------
  138|      0|      return load_EC_group_info(
  139|      0|         "0xF1FD178C0B3AD58F10126DE8CE42435B3961ADBCABC8CA6DE8FCF353D86E9C03",
  140|      0|         "0xF1FD178C0B3AD58F10126DE8CE42435B3961ADBCABC8CA6DE8FCF353D86E9C00",
  141|      0|         "0xEE353FCA5428A9300D4ABA754A44C00FDFEC0C9AE4B1A1803075ED967B7BB73F",
  142|      0|         "0xB6B3D4C356C139EB31183D4749D423958C27D2DCAF98B70164C97A2DD98F5CFF",
  143|      0|         "0x6142E0F7C8B204911F9271F0F3ECEF8C2701C307E8E4C9E183115A1554062CFB",
  144|      0|         "0xF1FD178C0B3AD58F10126DE8CE42435B53DC67E140D2BF941FFDD459C6D655E1",
  145|      0|         oid);
  146|      0|   }
  147|       |
  148|       |   // gost_256A
  149|    212|   if(oid == OID{1, 2, 643, 7, 1, 2, 1, 1, 1} || oid == OID{1, 2, 643, 2, 2, 35, 1} || oid == OID{1, 2, 643, 2, 2, 36, 0}) {
  ------------------
  |  Branch (149:7): [True: 0, False: 212]
  |  Branch (149:7): [True: 127, False: 85]
  |  Branch (149:50): [True: 4, False: 208]
  |  Branch (149:88): [True: 123, False: 85]
  ------------------
  150|    127|      return load_EC_group_info(
  151|    127|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD97",
  152|    127|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD94",
  153|    127|         "0xA6",
  154|    127|         "1",
  155|    127|         "0x8D91E471E0989CDA27DF505A453F2B7635294F2DDF23E3B122ACC99C9E9F1E14",
  156|    127|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6C611070995AD10045841B09B761B893",
  157|    127|         OID{1, 2, 643, 7, 1, 2, 1, 1, 1});
  158|    127|   }
  159|       |
  160|       |   // gost_512A
  161|     85|   if(oid == OID{1, 2, 643, 7, 1, 2, 1, 2, 1}) {
  ------------------
  |  Branch (161:7): [True: 0, False: 85]
  ------------------
  162|      0|      return load_EC_group_info(
  163|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDC7",
  164|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDC4",
  165|      0|         "0xE8C2505DEDFC86DDC1BD0B2B6667F1DA34B82574761CB0E879BD081CFD0B6265EE3CB090F30D27614CB4574010DA90DD862EF9D4EBEE4761503190785A71C760",
  166|      0|         "3",
  167|      0|         "0x7503CFE87A836AE3A61B8816E25450E6CE5E1C93ACF1ABC1778064FDCBEFA921DF1626BE4FD036E93D75E6A50E3A41E98028FE5FC235F5B889A589CB5215F2A4",
  168|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF27E69532F48D89116FF22B8D4E0560609B4B38ABFAD2B85DCACDB1411F10B275",
  169|      0|         oid);
  170|      0|   }
  171|       |
  172|       |   // secp160k1
  173|     85|   if(oid == OID{1, 3, 132, 0, 9}) {
  ------------------
  |  Branch (173:7): [True: 1, False: 84]
  ------------------
  174|      1|      return load_EC_group_info(
  175|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73",
  176|      1|         "0",
  177|      1|         "7",
  178|      1|         "0x3B4C382CE37AA192A4019E763036F4F5DD4D7EBB",
  179|      1|         "0x938CF935318FDCED6BC28286531733C3F03C4FEE",
  180|      1|         "0x100000000000000000001B8FA16DFAB9ACA16B6B3",
  181|      1|         oid);
  182|      1|   }
  183|       |
  184|       |   // secp160r1
  185|     84|   if(oid == OID{1, 3, 132, 0, 8}) {
  ------------------
  |  Branch (185:7): [True: 1, False: 83]
  ------------------
  186|      1|      return load_EC_group_info(
  187|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFF",
  188|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFC",
  189|      1|         "0x1C97BEFC54BD7A8B65ACF89F81D4D4ADC565FA45",
  190|      1|         "0x4A96B5688EF573284664698968C38BB913CBFC82",
  191|      1|         "0x23A628553168947D59DCC912042351377AC5FB32",
  192|      1|         "0x100000000000000000001F4C8F927AED3CA752257",
  193|      1|         oid);
  194|      1|   }
  195|       |
  196|       |   // secp160r2
  197|     83|   if(oid == OID{1, 3, 132, 0, 30}) {
  ------------------
  |  Branch (197:7): [True: 1, False: 82]
  ------------------
  198|      1|      return load_EC_group_info(
  199|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73",
  200|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC70",
  201|      1|         "0xB4E134D3FB59EB8BAB57274904664D5AF50388BA",
  202|      1|         "0x52DCB034293A117E1F4FF11B30F7199D3144CE6D",
  203|      1|         "0xFEAFFEF2E331F296E071FA0DF9982CFEA7D43F2E",
  204|      1|         "0x100000000000000000000351EE786A818F3A1A16B",
  205|      1|         oid);
  206|      1|   }
  207|       |
  208|       |   // secp192k1
  209|     82|   if(oid == OID{1, 3, 132, 0, 31}) {
  ------------------
  |  Branch (209:7): [True: 1, False: 81]
  ------------------
  210|      1|      return load_EC_group_info(
  211|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFEE37",
  212|      1|         "0",
  213|      1|         "3",
  214|      1|         "0xDB4FF10EC057E9AE26B07D0280B7F4341DA5D1B1EAE06C7D",
  215|      1|         "0x9B2F2F6D9C5628A7844163D015BE86344082AA88D95E2F9D",
  216|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFE26F2FC170F69466A74DEFD8D",
  217|      1|         oid);
  218|      1|   }
  219|       |
  220|       |   // secp192r1
  221|     81|   if(oid == OID{1, 2, 840, 10045, 3, 1, 1}) {
  ------------------
  |  Branch (221:7): [True: 1, False: 80]
  ------------------
  222|      1|      return load_EC_group_info(
  223|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF",
  224|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC",
  225|      1|         "0x64210519E59C80E70FA7E9AB72243049FEB8DEECC146B9B1",
  226|      1|         "0x188DA80EB03090F67CBF20EB43A18800F4FF0AFD82FF1012",
  227|      1|         "0x7192B95FFC8DA78631011ED6B24CDD573F977A11E794811",
  228|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831",
  229|      1|         oid);
  230|      1|   }
  231|       |
  232|       |   // secp224k1
  233|     80|   if(oid == OID{1, 3, 132, 0, 32}) {
  ------------------
  |  Branch (233:7): [True: 1, False: 79]
  ------------------
  234|      1|      return load_EC_group_info(
  235|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFE56D",
  236|      1|         "0",
  237|      1|         "5",
  238|      1|         "0xA1455B334DF099DF30FC28A169A467E9E47075A90F7E650EB6B7A45C",
  239|      1|         "0x7E089FED7FBA344282CAFBD6F7E319F7C0B0BD59E2CA4BDB556D61A5",
  240|      1|         "0x10000000000000000000000000001DCE8D2EC6184CAF0A971769FB1F7",
  241|      1|         oid);
  242|      1|   }
  243|       |
  244|       |   // secp224r1
  245|     79|   if(oid == OID{1, 3, 132, 0, 33}) {
  ------------------
  |  Branch (245:7): [True: 1, False: 78]
  ------------------
  246|      1|      return load_EC_group_info(
  247|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001",
  248|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE",
  249|      1|         "0xB4050A850C04B3ABF54132565044B0B7D7BFD8BA270B39432355FFB4",
  250|      1|         "0xB70E0CBD6BB4BF7F321390B94A03C1D356C21122343280D6115C1D21",
  251|      1|         "0xBD376388B5F723FB4C22DFE6CD4375A05A07476444D5819985007E34",
  252|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D",
  253|      1|         oid);
  254|      1|   }
  255|       |
  256|       |   // secp256k1
  257|     78|   if(oid == OID{1, 3, 132, 0, 10}) {
  ------------------
  |  Branch (257:7): [True: 1, False: 77]
  ------------------
  258|      1|      return load_EC_group_info(
  259|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F",
  260|      1|         "0",
  261|      1|         "7",
  262|      1|         "0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798",
  263|      1|         "0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8",
  264|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141",
  265|      1|         oid);
  266|      1|   }
  267|       |
  268|       |   // sm2p256v1
  269|     77|   if(oid == OID{1, 2, 156, 10197, 1, 301}) {
  ------------------
  |  Branch (269:7): [True: 0, False: 77]
  ------------------
  270|      0|      return load_EC_group_info(
  271|      0|         "0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFF",
  272|      0|         "0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFC",
  273|      0|         "0x28E9FA9E9D9F5E344D5A9E4BCF6509A7F39789F515AB8F92DDBCBD414D940E93",
  274|      0|         "0x32C4AE2C1F1981195F9904466A39C9948FE30BBFF2660BE1715A4589334C74C7",
  275|      0|         "0xBC3736A2F4F6779C59BDCEE36B692153D0A9877CC62A474002DF32E52139F0A0",
  276|      0|         "0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFF7203DF6B21C6052B53BBF40939D54123",
  277|      0|         oid);
  278|      0|   }
  279|       |
  280|       |   // x962_p192v2
  281|     77|   if(oid == OID{1, 2, 840, 10045, 3, 1, 2}) {
  ------------------
  |  Branch (281:7): [True: 1, False: 76]
  ------------------
  282|      1|      return load_EC_group_info(
  283|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF",
  284|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC",
  285|      1|         "0xCC22D6DFB95C6B25E49C0D6364A4E5980C393AA21668D953",
  286|      1|         "0xEEA2BAE7E1497842F2DE7769CFE9C989C072AD696F48034A",
  287|      1|         "0x6574D11D69B6EC7A672BB82A083DF2F2B0847DE970B2DE15",
  288|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFE5FB1A724DC80418648D8DD31",
  289|      1|         oid);
  290|      1|   }
  291|       |
  292|       |   // x962_p192v3
  293|     76|   if(oid == OID{1, 2, 840, 10045, 3, 1, 3}) {
  ------------------
  |  Branch (293:7): [True: 1, False: 75]
  ------------------
  294|      1|      return load_EC_group_info(
  295|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF",
  296|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC",
  297|      1|         "0x22123DC2395A05CAA7423DAECCC94760A7D462256BD56916",
  298|      1|         "0x7D29778100C65A1DA1783716588DCE2B8B4AEE8E228F1896",
  299|      1|         "0x38A90F22637337334B49DCB66A6DC8F9978ACA7648A943B0",
  300|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFF7A62D031C83F4294F640EC13",
  301|      1|         oid);
  302|      1|   }
  303|       |
  304|       |   // x962_p239v1
  305|     75|   if(oid == OID{1, 2, 840, 10045, 3, 1, 4}) {
  ------------------
  |  Branch (305:7): [True: 1, False: 74]
  ------------------
  306|      1|      return load_EC_group_info(
  307|      1|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF",
  308|      1|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC",
  309|      1|         "0x6B016C3BDCF18941D0D654921475CA71A9DB2FB27D1D37796185C2942C0A",
  310|      1|         "0xFFA963CDCA8816CCC33B8642BEDF905C3D358573D3F27FBBD3B3CB9AAAF",
  311|      1|         "0x7DEBE8E4E90A5DAE6E4054CA530BA04654B36818CE226B39FCCB7B02F1AE",
  312|      1|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF9E5E9A9F5D9071FBD1522688909D0B",
  313|      1|         oid);
  314|      1|   }
  315|       |
  316|       |   // x962_p239v2
  317|     74|   if(oid == OID{1, 2, 840, 10045, 3, 1, 5}) {
  ------------------
  |  Branch (317:7): [True: 1, False: 73]
  ------------------
  318|      1|      return load_EC_group_info(
  319|      1|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF",
  320|      1|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC",
  321|      1|         "0x617FAB6832576CBBFED50D99F0249C3FEE58B94BA0038C7AE84C8C832F2C",
  322|      1|         "0x38AF09D98727705120C921BB5E9E26296A3CDCF2F35757A0EAFD87B830E7",
  323|      1|         "0x5B0125E4DBEA0EC7206DA0FC01D9B081329FB555DE6EF460237DFF8BE4BA",
  324|      1|         "0x7FFFFFFFFFFFFFFFFFFFFFFF800000CFA7E8594377D414C03821BC582063",
  325|      1|         oid);
  326|      1|   }
  327|       |
  328|       |   // x962_p239v3
  329|     73|   if(oid == OID{1, 2, 840, 10045, 3, 1, 6}) {
  ------------------
  |  Branch (329:7): [True: 1, False: 72]
  ------------------
  330|      1|      return load_EC_group_info(
  331|      1|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF",
  332|      1|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC",
  333|      1|         "0x255705FA2A306654B1F4CB03D6A750A30C250102D4988717D9BA15AB6D3E",
  334|      1|         "0x6768AE8E18BB92CFCF005C949AA2C6D94853D0E660BBF854B1C9505FE95A",
  335|      1|         "0x1607E6898F390C06BC1D552BAD226F3B6FCFE48B6E818499AF18E3ED6CF3",
  336|      1|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF975DEB41B3A6057C3C432146526551",
  337|      1|         oid);
  338|      1|   }
  339|       |
  340|     72|   return std::shared_ptr<EC_Group_Data>();
  341|     73|}
_ZN5Botan8EC_Group28EC_group_identity_from_orderERKNS_6BigIntE:
  345|    469|   {
  346|    469|   const uint32_t low_bits = static_cast<uint32_t>(order.word_at(0));
  347|       |
  348|    469|   if(low_bits == 0xFC632551 && order == BigInt("0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551")) {
  ------------------
  |  Branch (348:7): [True: 1, False: 468]
  |  Branch (348:7): [True: 0, False: 469]
  |  Branch (348:33): [True: 0, False: 1]
  ------------------
  349|      0|      return OID{1, 2, 840, 10045, 3, 1, 7};
  350|      0|   }
  351|       |
  352|    469|   if(low_bits == 0xCCC52973 && order == BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973")) {
  ------------------
  |  Branch (352:7): [True: 1, False: 468]
  |  Branch (352:7): [True: 0, False: 469]
  |  Branch (352:33): [True: 0, False: 1]
  ------------------
  353|      0|      return OID{1, 3, 132, 0, 34};
  354|      0|   }
  355|       |
  356|    469|   if(low_bits == 0x91386409 && order == BigInt("0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409")) {
  ------------------
  |  Branch (356:7): [True: 0, False: 469]
  |  Branch (356:7): [True: 0, False: 469]
  |  Branch (356:33): [True: 0, False: 0]
  ------------------
  357|      0|      return OID{1, 3, 132, 0, 35};
  358|      0|   }
  359|       |
  360|    469|   if(low_bits == 0x9E60FC09 && order == BigInt("0xE95E4A5F737059DC60DF5991D45029409E60FC09")) {
  ------------------
  |  Branch (360:7): [True: 1, False: 468]
  |  Branch (360:7): [True: 0, False: 469]
  |  Branch (360:33): [True: 0, False: 1]
  ------------------
  361|      0|      return OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 1};
  362|      0|   }
  363|       |
  364|    469|   if(low_bits == 0x9AC4ACC1 && order == BigInt("0xC302F41D932A36CDA7A3462F9E9E916B5BE8F1029AC4ACC1")) {
  ------------------
  |  Branch (364:7): [True: 0, False: 469]
  |  Branch (364:7): [True: 0, False: 469]
  |  Branch (364:33): [True: 0, False: 0]
  ------------------
  365|      0|      return OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 3};
  366|      0|   }
  367|       |
  368|    469|   if(low_bits == 0xA5A7939F && order == BigInt("0xD7C134AA264366862A18302575D0FB98D116BC4B6DDEBCA3A5A7939F")) {
  ------------------
  |  Branch (368:7): [True: 1, False: 468]
  |  Branch (368:7): [True: 0, False: 469]
  |  Branch (368:33): [True: 0, False: 1]
  ------------------
  369|      0|      return OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 5};
  370|      0|   }
  371|       |
  372|    469|   if(low_bits == 0x974856A7 && order == BigInt("0xA9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7")) {
  ------------------
  |  Branch (372:7): [True: 1, False: 468]
  |  Branch (372:7): [True: 0, False: 469]
  |  Branch (372:33): [True: 0, False: 1]
  ------------------
  373|      0|      return OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 7};
  374|      0|   }
  375|       |
  376|    469|   if(low_bits == 0x44C59311 && order == BigInt("0xD35E472036BC4FB7E13C785ED201E065F98FCFA5B68F12A32D482EC7EE8658E98691555B44C59311")) {
  ------------------
  |  Branch (376:7): [True: 0, False: 469]
  |  Branch (376:7): [True: 0, False: 469]
  |  Branch (376:33): [True: 0, False: 0]
  ------------------
  377|      0|      return OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 9};
  378|      0|   }
  379|       |
  380|    469|   if(low_bits == 0xE9046565 && order == BigInt("0x8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B31F166E6CAC0425A7CF3AB6AF6B7FC3103B883202E9046565")) {
  ------------------
  |  Branch (380:7): [True: 1, False: 468]
  |  Branch (380:7): [True: 0, False: 469]
  |  Branch (380:33): [True: 0, False: 1]
  ------------------
  381|      0|      return OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 11};
  382|      0|   }
  383|       |
  384|    469|   if(low_bits == 0x9CA90069 && order == BigInt("0xAADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA70330870553E5C414CA92619418661197FAC10471DB1D381085DDADDB58796829CA90069")) {
  ------------------
  |  Branch (384:7): [True: 1, False: 468]
  |  Branch (384:7): [True: 0, False: 469]
  |  Branch (384:33): [True: 0, False: 1]
  ------------------
  385|      0|      return OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 13};
  386|      0|   }
  387|       |
  388|    469|   if(low_bits == 0xC6D655E1 && order == BigInt("0xF1FD178C0B3AD58F10126DE8CE42435B53DC67E140D2BF941FFDD459C6D655E1")) {
  ------------------
  |  Branch (388:7): [True: 1, False: 468]
  |  Branch (388:7): [True: 0, False: 469]
  |  Branch (388:33): [True: 0, False: 1]
  ------------------
  389|      0|      return OID{1, 2, 250, 1, 223, 101, 256, 1};
  390|      0|   }
  391|       |
  392|    469|   if(low_bits == 0xB761B893 && order == BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6C611070995AD10045841B09B761B893")) {
  ------------------
  |  Branch (392:7): [True: 1, False: 468]
  |  Branch (392:7): [True: 0, False: 469]
  |  Branch (392:33): [True: 0, False: 1]
  ------------------
  393|      0|      return OID{1, 2, 643, 7, 1, 2, 1, 1, 1};
  394|      0|   }
  395|       |
  396|    469|   if(low_bits == 0x1F10B275 && order == BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF27E69532F48D89116FF22B8D4E0560609B4B38ABFAD2B85DCACDB1411F10B275")) {
  ------------------
  |  Branch (396:7): [True: 1, False: 468]
  |  Branch (396:7): [True: 0, False: 469]
  |  Branch (396:33): [True: 0, False: 1]
  ------------------
  397|      0|      return OID{1, 2, 643, 7, 1, 2, 1, 2, 1};
  398|      0|   }
  399|       |
  400|    469|   if(low_bits == 0xCA16B6B3 && order == BigInt("0x100000000000000000001B8FA16DFAB9ACA16B6B3")) {
  ------------------
  |  Branch (400:7): [True: 1, False: 468]
  |  Branch (400:7): [True: 0, False: 469]
  |  Branch (400:33): [True: 0, False: 1]
  ------------------
  401|      0|      return OID{1, 3, 132, 0, 9};
  402|      0|   }
  403|       |
  404|    469|   if(low_bits == 0xCA752257 && order == BigInt("0x100000000000000000001F4C8F927AED3CA752257")) {
  ------------------
  |  Branch (404:7): [True: 0, False: 469]
  |  Branch (404:7): [True: 0, False: 469]
  |  Branch (404:33): [True: 0, False: 0]
  ------------------
  405|      0|      return OID{1, 3, 132, 0, 8};
  406|      0|   }
  407|       |
  408|    469|   if(low_bits == 0xF3A1A16B && order == BigInt("0x100000000000000000000351EE786A818F3A1A16B")) {
  ------------------
  |  Branch (408:7): [True: 1, False: 468]
  |  Branch (408:7): [True: 0, False: 469]
  |  Branch (408:33): [True: 0, False: 1]
  ------------------
  409|      0|      return OID{1, 3, 132, 0, 30};
  410|      0|   }
  411|       |
  412|    469|   if(low_bits == 0x74DEFD8D && order == BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFE26F2FC170F69466A74DEFD8D")) {
  ------------------
  |  Branch (412:7): [True: 2, False: 467]
  |  Branch (412:7): [True: 0, False: 469]
  |  Branch (412:33): [True: 0, False: 2]
  ------------------
  413|      0|      return OID{1, 3, 132, 0, 31};
  414|      0|   }
  415|       |
  416|    469|   if(low_bits == 0xB4D22831 && order == BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831")) {
  ------------------
  |  Branch (416:7): [True: 0, False: 469]
  |  Branch (416:7): [True: 0, False: 469]
  |  Branch (416:33): [True: 0, False: 0]
  ------------------
  417|      0|      return OID{1, 2, 840, 10045, 3, 1, 1};
  418|      0|   }
  419|       |
  420|    469|   if(low_bits == 0x769FB1F7 && order == BigInt("0x10000000000000000000000000001DCE8D2EC6184CAF0A971769FB1F7")) {
  ------------------
  |  Branch (420:7): [True: 1, False: 468]
  |  Branch (420:7): [True: 0, False: 469]
  |  Branch (420:33): [True: 0, False: 1]
  ------------------
  421|      0|      return OID{1, 3, 132, 0, 32};
  422|      0|   }
  423|       |
  424|    469|   if(low_bits == 0x5C5C2A3D && order == BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D")) {
  ------------------
  |  Branch (424:7): [True: 1, False: 468]
  |  Branch (424:7): [True: 0, False: 469]
  |  Branch (424:33): [True: 0, False: 1]
  ------------------
  425|      0|      return OID{1, 3, 132, 0, 33};
  426|      0|   }
  427|       |
  428|    469|   if(low_bits == 0xD0364141 && order == BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141")) {
  ------------------
  |  Branch (428:7): [True: 0, False: 469]
  |  Branch (428:7): [True: 0, False: 469]
  |  Branch (428:33): [True: 0, False: 0]
  ------------------
  429|      0|      return OID{1, 3, 132, 0, 10};
  430|      0|   }
  431|       |
  432|    469|   if(low_bits == 0x39D54123 && order == BigInt("0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFF7203DF6B21C6052B53BBF40939D54123")) {
  ------------------
  |  Branch (432:7): [True: 0, False: 469]
  |  Branch (432:7): [True: 0, False: 469]
  |  Branch (432:33): [True: 0, False: 0]
  ------------------
  433|      0|      return OID{1, 2, 156, 10197, 1, 301};
  434|      0|   }
  435|       |
  436|    469|   if(low_bits == 0x48D8DD31 && order == BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFE5FB1A724DC80418648D8DD31")) {
  ------------------
  |  Branch (436:7): [True: 0, False: 469]
  |  Branch (436:7): [True: 0, False: 469]
  |  Branch (436:33): [True: 0, False: 0]
  ------------------
  437|      0|      return OID{1, 2, 840, 10045, 3, 1, 2};
  438|      0|   }
  439|       |
  440|    469|   if(low_bits == 0xF640EC13 && order == BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFF7A62D031C83F4294F640EC13")) {
  ------------------
  |  Branch (440:7): [True: 1, False: 468]
  |  Branch (440:7): [True: 0, False: 469]
  |  Branch (440:33): [True: 0, False: 1]
  ------------------
  441|      0|      return OID{1, 2, 840, 10045, 3, 1, 3};
  442|      0|   }
  443|       |
  444|    469|   if(low_bits == 0x88909D0B && order == BigInt("0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF9E5E9A9F5D9071FBD1522688909D0B")) {
  ------------------
  |  Branch (444:7): [True: 1, False: 468]
  |  Branch (444:7): [True: 0, False: 469]
  |  Branch (444:33): [True: 0, False: 1]
  ------------------
  445|      0|      return OID{1, 2, 840, 10045, 3, 1, 4};
  446|      0|   }
  447|       |
  448|    469|   if(low_bits == 0xBC582063 && order == BigInt("0x7FFFFFFFFFFFFFFFFFFFFFFF800000CFA7E8594377D414C03821BC582063")) {
  ------------------
  |  Branch (448:7): [True: 1, False: 468]
  |  Branch (448:7): [True: 0, False: 469]
  |  Branch (448:33): [True: 0, False: 1]
  ------------------
  449|      0|      return OID{1, 2, 840, 10045, 3, 1, 5};
  450|      0|   }
  451|       |
  452|    469|   if(low_bits == 0x46526551 && order == BigInt("0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF975DEB41B3A6057C3C432146526551")) {
  ------------------
  |  Branch (452:7): [True: 1, False: 468]
  |  Branch (452:7): [True: 0, False: 469]
  |  Branch (452:33): [True: 0, False: 1]
  ------------------
  453|      0|      return OID{1, 2, 840, 10045, 3, 1, 6};
  454|      0|   }
  455|       |
  456|    469|   return OID();
  457|    469|}

_ZN5Botan8EC_PointC2ERKNS_8CurveGFpE:
   18|    383|EC_Point::EC_Point(const CurveGFp& curve) : m_curve(curve), m_coord_x(0), m_coord_y(curve.get_1_rep()), m_coord_z(0) {
   19|       |   // Assumes Montgomery rep of zero is zero
   20|    383|}
_ZN5Botan8EC_PointC2ERKNS_8CurveGFpERKNS_6BigIntES6_:
   23|  1.89k|      m_curve(curve), m_coord_x(x), m_coord_y(y), m_coord_z(m_curve.get_1_rep()) {
   24|  1.89k|   if(x < 0 || x >= curve.get_p()) {
  ------------------
  |  Branch (24:7): [True: 0, False: 1.89k]
  |  Branch (24:16): [True: 429, False: 1.46k]
  ------------------
   25|    429|      throw Invalid_Argument("Invalid EC_Point affine x");
   26|    429|   }
   27|  1.46k|   if(y < 0 || y >= curve.get_p()) {
  ------------------
  |  Branch (27:7): [True: 0, False: 1.46k]
  |  Branch (27:16): [True: 5, False: 1.45k]
  ------------------
   28|      5|      throw Invalid_Argument("Invalid EC_Point affine y");
   29|      5|   }
   30|       |
   31|  1.45k|   secure_vector<word> monty_ws(m_curve.get_ws_size());
   32|  1.45k|   m_curve.to_rep(m_coord_x, monty_ws);
   33|  1.45k|   m_curve.to_rep(m_coord_y, monty_ws);
   34|  1.45k|}
_ZN5Botan8EC_Point10add_affineEPKmmS2_mRNSt3__16vectorINS_6BigIntENS3_9allocatorIS5_EEEE:
   74|  21.7k|   const word x_words[], size_t x_size, const word y_words[], size_t y_size, std::vector<BigInt>& ws_bn) {
   75|  21.7k|   if((CT::all_zeros(x_words, x_size) & CT::all_zeros(y_words, y_size)).as_bool()) {
  ------------------
  |  Branch (75:7): [True: 0, False: 21.7k]
  ------------------
   76|      0|      return;
   77|      0|   }
   78|       |
   79|  21.7k|   if(is_zero()) {
  ------------------
  |  Branch (79:7): [True: 184, False: 21.5k]
  ------------------
   80|    184|      m_coord_x.set_words(x_words, x_size);
   81|    184|      m_coord_y.set_words(y_words, y_size);
   82|    184|      m_coord_z = m_curve.get_1_rep();
   83|    184|      return;
   84|    184|   }
   85|       |
   86|  21.5k|   resize_ws(ws_bn, m_curve.get_ws_size());
   87|       |
   88|  21.5k|   secure_vector<word>& ws = ws_bn[0].get_word_vector();
   89|  21.5k|   secure_vector<word>& sub_ws = ws_bn[1].get_word_vector();
   90|       |
   91|  21.5k|   BigInt& T0 = ws_bn[2];
   92|  21.5k|   BigInt& T1 = ws_bn[3];
   93|  21.5k|   BigInt& T2 = ws_bn[4];
   94|  21.5k|   BigInt& T3 = ws_bn[5];
   95|  21.5k|   BigInt& T4 = ws_bn[6];
   96|       |
   97|       |   /*
   98|       |   https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2
   99|       |   simplified with Z2 = 1
  100|       |   */
  101|       |
  102|  21.5k|   const BigInt& p = m_curve.get_p();
  103|       |
  104|  21.5k|   m_curve.sqr(T3, m_coord_z, ws);            // z1^2
  105|  21.5k|   m_curve.mul(T4, x_words, x_size, T3, ws);  // x2*z1^2
  106|       |
  107|  21.5k|   m_curve.mul(T2, m_coord_z, T3, ws);        // z1^3
  108|  21.5k|   m_curve.mul(T0, y_words, y_size, T2, ws);  // y2*z1^3
  109|       |
  110|  21.5k|   T4.mod_sub(m_coord_x, p, sub_ws);  // x2*z1^2 - x1*z2^2
  111|       |
  112|  21.5k|   T0.mod_sub(m_coord_y, p, sub_ws);
  113|       |
  114|  21.5k|   if(T4.is_zero()) {
  ------------------
  |  Branch (114:7): [True: 1, False: 21.5k]
  ------------------
  115|      1|      if(T0.is_zero()) {
  ------------------
  |  Branch (115:10): [True: 1, False: 0]
  ------------------
  116|      1|         mult2(ws_bn);
  117|      1|         return;
  118|      1|      }
  119|       |
  120|       |      // setting to zero:
  121|      0|      m_coord_x.clear();
  122|      0|      m_coord_y = m_curve.get_1_rep();
  123|      0|      m_coord_z.clear();
  124|      0|      return;
  125|      1|   }
  126|       |
  127|  21.5k|   m_curve.sqr(T2, T4, ws);
  128|       |
  129|  21.5k|   m_curve.mul(T3, m_coord_x, T2, ws);
  130|       |
  131|  21.5k|   m_curve.mul(T1, T2, T4, ws);
  132|       |
  133|  21.5k|   m_curve.sqr(m_coord_x, T0, ws);
  134|  21.5k|   m_coord_x.mod_sub(T1, p, sub_ws);
  135|       |
  136|  21.5k|   m_coord_x.mod_sub(T3, p, sub_ws);
  137|  21.5k|   m_coord_x.mod_sub(T3, p, sub_ws);
  138|       |
  139|  21.5k|   T3.mod_sub(m_coord_x, p, sub_ws);
  140|       |
  141|  21.5k|   m_curve.mul(T2, T0, T3, ws);
  142|  21.5k|   m_curve.mul(T0, m_coord_y, T1, ws);
  143|  21.5k|   T2.mod_sub(T0, p, sub_ws);
  144|  21.5k|   m_coord_y.swap(T2);
  145|       |
  146|  21.5k|   m_curve.mul(T0, m_coord_z, T4, ws);
  147|  21.5k|   m_coord_z.swap(T0);
  148|  21.5k|}
_ZN5Botan8EC_Point3addEPKmmS2_mS2_mRNSt3__16vectorINS_6BigIntENS3_9allocatorIS5_EEEE:
  156|   294k|                   std::vector<BigInt>& ws_bn) {
  157|   294k|   if((CT::all_zeros(x_words, x_size) & CT::all_zeros(z_words, z_size)).as_bool()) {
  ------------------
  |  Branch (157:7): [True: 7.65k, False: 286k]
  ------------------
  158|  7.65k|      return;
  159|  7.65k|   }
  160|       |
  161|   286k|   if(is_zero()) {
  ------------------
  |  Branch (161:7): [True: 1.05k, False: 285k]
  ------------------
  162|  1.05k|      m_coord_x.set_words(x_words, x_size);
  163|  1.05k|      m_coord_y.set_words(y_words, y_size);
  164|  1.05k|      m_coord_z.set_words(z_words, z_size);
  165|  1.05k|      return;
  166|  1.05k|   }
  167|       |
  168|   285k|   resize_ws(ws_bn, m_curve.get_ws_size());
  169|       |
  170|   285k|   secure_vector<word>& ws = ws_bn[0].get_word_vector();
  171|   285k|   secure_vector<word>& sub_ws = ws_bn[1].get_word_vector();
  172|       |
  173|   285k|   BigInt& T0 = ws_bn[2];
  174|   285k|   BigInt& T1 = ws_bn[3];
  175|   285k|   BigInt& T2 = ws_bn[4];
  176|   285k|   BigInt& T3 = ws_bn[5];
  177|   285k|   BigInt& T4 = ws_bn[6];
  178|   285k|   BigInt& T5 = ws_bn[7];
  179|       |
  180|       |   /*
  181|       |   https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2
  182|       |   */
  183|       |
  184|   285k|   const BigInt& p = m_curve.get_p();
  185|       |
  186|   285k|   m_curve.sqr(T0, z_words, z_size, ws);      // z2^2
  187|   285k|   m_curve.mul(T1, m_coord_x, T0, ws);        // x1*z2^2
  188|   285k|   m_curve.mul(T3, z_words, z_size, T0, ws);  // z2^3
  189|   285k|   m_curve.mul(T2, m_coord_y, T3, ws);        // y1*z2^3
  190|       |
  191|   285k|   m_curve.sqr(T3, m_coord_z, ws);            // z1^2
  192|   285k|   m_curve.mul(T4, x_words, x_size, T3, ws);  // x2*z1^2
  193|       |
  194|   285k|   m_curve.mul(T5, m_coord_z, T3, ws);        // z1^3
  195|   285k|   m_curve.mul(T0, y_words, y_size, T5, ws);  // y2*z1^3
  196|       |
  197|   285k|   T4.mod_sub(T1, p, sub_ws);  // x2*z1^2 - x1*z2^2
  198|       |
  199|   285k|   T0.mod_sub(T2, p, sub_ws);
  200|       |
  201|   285k|   if(T4.is_zero()) {
  ------------------
  |  Branch (201:7): [True: 5.20k, False: 280k]
  ------------------
  202|  5.20k|      if(T0.is_zero()) {
  ------------------
  |  Branch (202:10): [True: 1.73k, False: 3.47k]
  ------------------
  203|  1.73k|         mult2(ws_bn);
  204|  1.73k|         return;
  205|  1.73k|      }
  206|       |
  207|       |      // setting to zero:
  208|  3.47k|      m_coord_x.clear();
  209|  3.47k|      m_coord_y = m_curve.get_1_rep();
  210|  3.47k|      m_coord_z.clear();
  211|  3.47k|      return;
  212|  5.20k|   }
  213|       |
  214|   280k|   m_curve.sqr(T5, T4, ws);
  215|       |
  216|   280k|   m_curve.mul(T3, T1, T5, ws);
  217|       |
  218|   280k|   m_curve.mul(T1, T5, T4, ws);
  219|       |
  220|   280k|   m_curve.sqr(m_coord_x, T0, ws);
  221|   280k|   m_coord_x.mod_sub(T1, p, sub_ws);
  222|   280k|   m_coord_x.mod_sub(T3, p, sub_ws);
  223|   280k|   m_coord_x.mod_sub(T3, p, sub_ws);
  224|       |
  225|   280k|   T3.mod_sub(m_coord_x, p, sub_ws);
  226|       |
  227|   280k|   m_curve.mul(m_coord_y, T0, T3, ws);
  228|   280k|   m_curve.mul(T3, T2, T1, ws);
  229|       |
  230|   280k|   m_coord_y.mod_sub(T3, p, sub_ws);
  231|       |
  232|   280k|   m_curve.mul(T3, z_words, z_size, m_coord_z, ws);
  233|   280k|   m_curve.mul(m_coord_z, T3, T4, ws);
  234|   280k|}
_ZN5Botan8EC_Point6mult2iEmRNSt3__16vectorINS_6BigIntENS1_9allocatorIS3_EEEE:
  236|  40.4k|void EC_Point::mult2i(size_t iterations, std::vector<BigInt>& ws_bn) {
  237|  40.4k|   if(iterations == 0) {
  ------------------
  |  Branch (237:7): [True: 0, False: 40.4k]
  ------------------
  238|      0|      return;
  239|      0|   }
  240|       |
  241|  40.4k|   if(m_coord_y.is_zero()) {
  ------------------
  |  Branch (241:7): [True: 0, False: 40.4k]
  ------------------
  242|      0|      *this = EC_Point(m_curve);  // setting myself to zero
  243|      0|      return;
  244|      0|   }
  245|       |
  246|       |   /*
  247|       |   TODO we can save 2 squarings per iteration by computing
  248|       |   a*Z^4 using values cached from previous iteration
  249|       |   */
  250|   121k|   for(size_t i = 0; i != iterations; ++i) {
  ------------------
  |  Branch (250:22): [True: 80.9k, False: 40.4k]
  ------------------
  251|  80.9k|      mult2(ws_bn);
  252|  80.9k|   }
  253|  40.4k|}
_ZN5Botan8EC_Point5mult2ERNSt3__16vectorINS_6BigIntENS1_9allocatorIS3_EEEE:
  256|   290k|void EC_Point::mult2(std::vector<BigInt>& ws_bn) {
  257|   290k|   if(is_zero()) {
  ------------------
  |  Branch (257:7): [True: 3.90k, False: 286k]
  ------------------
  258|  3.90k|      return;
  259|  3.90k|   }
  260|       |
  261|   286k|   if(m_coord_y.is_zero()) {
  ------------------
  |  Branch (261:7): [True: 9, False: 286k]
  ------------------
  262|      9|      *this = EC_Point(m_curve);  // setting myself to zero
  263|      9|      return;
  264|      9|   }
  265|       |
  266|   286k|   resize_ws(ws_bn, m_curve.get_ws_size());
  267|       |
  268|   286k|   secure_vector<word>& ws = ws_bn[0].get_word_vector();
  269|   286k|   secure_vector<word>& sub_ws = ws_bn[1].get_word_vector();
  270|       |
  271|   286k|   BigInt& T0 = ws_bn[2];
  272|   286k|   BigInt& T1 = ws_bn[3];
  273|   286k|   BigInt& T2 = ws_bn[4];
  274|   286k|   BigInt& T3 = ws_bn[5];
  275|   286k|   BigInt& T4 = ws_bn[6];
  276|       |
  277|       |   /*
  278|       |   https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-1986-cc
  279|       |   */
  280|   286k|   const BigInt& p = m_curve.get_p();
  281|       |
  282|   286k|   m_curve.sqr(T0, m_coord_y, ws);
  283|       |
  284|   286k|   m_curve.mul(T1, m_coord_x, T0, ws);
  285|   286k|   T1.mod_mul(4, p, sub_ws);
  286|       |
  287|   286k|   if(m_curve.a_is_zero()) {
  ------------------
  |  Branch (287:7): [True: 128k, False: 157k]
  ------------------
  288|       |      // if a == 0 then 3*x^2 + a*z^4 is just 3*x^2
  289|   128k|      m_curve.sqr(T4, m_coord_x, ws);  // x^2
  290|   128k|      T4.mod_mul(3, p, sub_ws);        // 3*x^2
  291|   157k|   } else if(m_curve.a_is_minus_3()) {
  ------------------
  |  Branch (291:14): [True: 128k, False: 29.1k]
  ------------------
  292|       |      /*
  293|       |      if a == -3 then
  294|       |        3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2)
  295|       |      */
  296|   128k|      m_curve.sqr(T3, m_coord_z, ws);  // z^2
  297|       |
  298|       |      // (x-z^2)
  299|   128k|      T2 = m_coord_x;
  300|   128k|      T2.mod_sub(T3, p, sub_ws);
  301|       |
  302|       |      // (x+z^2)
  303|   128k|      T3.mod_add(m_coord_x, p, sub_ws);
  304|       |
  305|   128k|      m_curve.mul(T4, T2, T3, ws);  // (x-z^2)*(x+z^2)
  306|       |
  307|   128k|      T4.mod_mul(3, p, sub_ws);  // 3*(x-z^2)*(x+z^2)
  308|   128k|   } else {
  309|  29.1k|      m_curve.sqr(T3, m_coord_z, ws);                // z^2
  310|  29.1k|      m_curve.sqr(T4, T3, ws);                       // z^4
  311|  29.1k|      m_curve.mul(T3, m_curve.get_a_rep(), T4, ws);  // a*z^4
  312|       |
  313|  29.1k|      m_curve.sqr(T4, m_coord_x, ws);  // x^2
  314|  29.1k|      T4.mod_mul(3, p, sub_ws);
  315|  29.1k|      T4.mod_add(T3, p, sub_ws);  // 3*x^2 + a*z^4
  316|  29.1k|   }
  317|       |
  318|   286k|   m_curve.sqr(T2, T4, ws);
  319|   286k|   T2.mod_sub(T1, p, sub_ws);
  320|   286k|   T2.mod_sub(T1, p, sub_ws);
  321|       |
  322|   286k|   m_curve.sqr(T3, T0, ws);
  323|   286k|   T3.mod_mul(8, p, sub_ws);
  324|       |
  325|   286k|   T1.mod_sub(T2, p, sub_ws);
  326|       |
  327|   286k|   m_curve.mul(T0, T4, T1, ws);
  328|   286k|   T0.mod_sub(T3, p, sub_ws);
  329|       |
  330|   286k|   m_coord_x.swap(T2);
  331|       |
  332|   286k|   m_curve.mul(T2, m_coord_y, m_coord_z, ws);
  333|   286k|   T2.mod_mul(2, p, sub_ws);
  334|       |
  335|   286k|   m_coord_y.swap(T0);
  336|   286k|   m_coord_z.swap(T2);
  337|   286k|}
_ZN5Botan8EC_Point16force_all_affineERNSt3__16vectorIS0_NS1_9allocatorIS0_EEEERNS2_ImNS_16secure_allocatorImEEEE:
  388|  1.01k|void EC_Point::force_all_affine(std::vector<EC_Point>& points, secure_vector<word>& ws) {
  389|  1.01k|   if(points.size() <= 1) {
  ------------------
  |  Branch (389:7): [True: 0, False: 1.01k]
  ------------------
  390|      0|      for(auto& point : points) {
  ------------------
  |  Branch (390:23): [True: 0, False: 0]
  ------------------
  391|      0|         point.force_affine();
  392|      0|      }
  393|      0|      return;
  394|      0|   }
  395|       |
  396|   470k|   for(auto& point : points) {
  ------------------
  |  Branch (396:20): [True: 470k, False: 995]
  ------------------
  397|   470k|      if(point.is_zero()) {
  ------------------
  |  Branch (397:10): [True: 22, False: 470k]
  ------------------
  398|     22|         throw Invalid_State("Cannot convert zero ECC point to affine");
  399|     22|      }
  400|   470k|   }
  401|       |
  402|       |   /*
  403|       |   For >= 2 points use Montgomery's trick
  404|       |
  405|       |   See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography"
  406|       |   (Hankerson, Menezes, Vanstone)
  407|       |
  408|       |   TODO is it really necessary to save all k points in c?
  409|       |   */
  410|       |
  411|    995|   const CurveGFp& curve = points[0].m_curve;
  412|    995|   const BigInt& rep_1 = curve.get_1_rep();
  413|       |
  414|    995|   if(ws.size() < curve.get_ws_size()) {
  ------------------
  |  Branch (414:7): [True: 0, False: 995]
  ------------------
  415|      0|      ws.resize(curve.get_ws_size());
  416|      0|   }
  417|       |
  418|    995|   std::vector<BigInt> c(points.size());
  419|    995|   c[0] = points[0].m_coord_z;
  420|       |
  421|   470k|   for(size_t i = 1; i != points.size(); ++i) {
  ------------------
  |  Branch (421:22): [True: 469k, False: 995]
  ------------------
  422|   469k|      curve.mul(c[i], c[i - 1], points[i].m_coord_z, ws);
  423|   469k|   }
  424|       |
  425|    995|   BigInt s_inv = curve.invert_element(c[c.size() - 1], ws);
  426|       |
  427|    995|   BigInt z_inv, z2_inv, z3_inv;
  428|       |
  429|   470k|   for(size_t i = points.size() - 1; i != 0; i--) {
  ------------------
  |  Branch (429:38): [True: 469k, False: 995]
  ------------------
  430|   469k|      EC_Point& point = points[i];
  431|       |
  432|   469k|      curve.mul(z_inv, s_inv, c[i - 1], ws);
  433|       |
  434|   469k|      s_inv = curve.mul_to_tmp(s_inv, point.m_coord_z, ws);
  435|       |
  436|   469k|      curve.sqr(z2_inv, z_inv, ws);
  437|   469k|      curve.mul(z3_inv, z2_inv, z_inv, ws);
  438|   469k|      point.m_coord_x = curve.mul_to_tmp(point.m_coord_x, z2_inv, ws);
  439|   469k|      point.m_coord_y = curve.mul_to_tmp(point.m_coord_y, z3_inv, ws);
  440|   469k|      point.m_coord_z = rep_1;
  441|   469k|   }
  442|       |
  443|    995|   curve.sqr(z2_inv, s_inv, ws);
  444|    995|   curve.mul(z3_inv, z2_inv, s_inv, ws);
  445|    995|   points[0].m_coord_x = curve.mul_to_tmp(points[0].m_coord_x, z2_inv, ws);
  446|    995|   points[0].m_coord_y = curve.mul_to_tmp(points[0].m_coord_y, z3_inv, ws);
  447|    995|   points[0].m_coord_z = rep_1;
  448|    995|}
_ZNK5Botan8EC_Point9is_affineEv:
  465|    267|bool EC_Point::is_affine() const {
  466|    267|   return m_curve.is_one(m_coord_z);
  467|    267|}
_ZNK5Botan8EC_Point12get_affine_xEv:
  469|    267|BigInt EC_Point::get_affine_x() const {
  470|    267|   if(is_zero()) {
  ------------------
  |  Branch (470:7): [True: 0, False: 267]
  ------------------
  471|      0|      throw Invalid_State("Cannot convert zero point to affine");
  472|      0|   }
  473|       |
  474|    267|   secure_vector<word> monty_ws;
  475|       |
  476|    267|   if(is_affine()) {
  ------------------
  |  Branch (476:7): [True: 0, False: 267]
  ------------------
  477|      0|      return m_curve.from_rep_to_tmp(m_coord_x, monty_ws);
  478|      0|   }
  479|       |
  480|    267|   BigInt z2 = m_curve.sqr_to_tmp(m_coord_z, monty_ws);
  481|    267|   z2 = m_curve.invert_element(z2, monty_ws);
  482|       |
  483|    267|   BigInt r;
  484|    267|   m_curve.mul(r, m_coord_x, z2, monty_ws);
  485|    267|   m_curve.from_rep(r, monty_ws);
  486|    267|   return r;
  487|    267|}
_ZNK5Botan8EC_Point12on_the_curveEv:
  510|  1.80k|bool EC_Point::on_the_curve() const {
  511|       |   /*
  512|       |   Is the point still on the curve?? (If everything is correct, the
  513|       |   point is always on its curve; then the function will return true.
  514|       |   If somehow the state is corrupted, which suggests a fault attack
  515|       |   (or internal computational error), then return false.
  516|       |   */
  517|  1.80k|   if(is_zero()) {
  ------------------
  |  Branch (517:7): [True: 105, False: 1.70k]
  ------------------
  518|    105|      return true;
  519|    105|   }
  520|       |
  521|  1.70k|   secure_vector<word> monty_ws;
  522|       |
  523|  1.70k|   const BigInt y2 = m_curve.from_rep_to_tmp(m_curve.sqr_to_tmp(m_coord_y, monty_ws), monty_ws);
  524|  1.70k|   const BigInt x3 = m_curve.mul_to_tmp(m_coord_x, m_curve.sqr_to_tmp(m_coord_x, monty_ws), monty_ws);
  525|  1.70k|   const BigInt ax = m_curve.mul_to_tmp(m_coord_x, m_curve.get_a_rep(), monty_ws);
  526|  1.70k|   const BigInt z2 = m_curve.sqr_to_tmp(m_coord_z, monty_ws);
  527|       |
  528|  1.70k|   if(m_coord_z == z2)  // Is z equal to 1 (in Montgomery form)?
  ------------------
  |  Branch (528:7): [True: 1.70k, False: 0]
  ------------------
  529|  1.70k|   {
  530|  1.70k|      if(y2 != m_curve.from_rep_to_tmp(x3 + ax + m_curve.get_b_rep(), monty_ws)) {
  ------------------
  |  Branch (530:10): [True: 124, False: 1.58k]
  ------------------
  531|    124|         return false;
  532|    124|      }
  533|  1.70k|   }
  534|       |
  535|  1.58k|   const BigInt z3 = m_curve.mul_to_tmp(m_coord_z, z2, monty_ws);
  536|  1.58k|   const BigInt ax_z4 = m_curve.mul_to_tmp(ax, m_curve.sqr_to_tmp(z2, monty_ws), monty_ws);
  537|  1.58k|   const BigInt b_z6 = m_curve.mul_to_tmp(m_curve.get_b_rep(), m_curve.sqr_to_tmp(z3, monty_ws), monty_ws);
  538|       |
  539|  1.58k|   if(y2 != m_curve.from_rep_to_tmp(x3 + ax_z4 + b_z6, monty_ws)) {
  ------------------
  |  Branch (539:7): [True: 0, False: 1.58k]
  ------------------
  540|      0|      return false;
  541|      0|   }
  542|       |
  543|  1.58k|   return true;
  544|  1.58k|}
_ZN5Botan8EC_Point4swapERS0_:
  547|   418k|void EC_Point::swap(EC_Point& other) {
  548|   418k|   m_curve.swap(other.m_curve);
  549|   418k|   m_coord_x.swap(other.m_coord_x);
  550|   418k|   m_coord_y.swap(other.m_coord_y);
  551|   418k|   m_coord_z.swap(other.m_coord_z);
  552|   418k|}
_ZN5Botan6OS2ECPEPKhmRKNS_8CurveGFpE:
  627|  1.79k|EC_Point OS2ECP(const uint8_t data[], size_t data_len, const CurveGFp& curve) {
  628|       |   // Should we really be doing this?
  629|  1.79k|   if(data_len <= 1) {
  ------------------
  |  Branch (629:7): [True: 107, False: 1.68k]
  ------------------
  630|    107|      return EC_Point(curve);  // return zero
  631|    107|   }
  632|       |
  633|  1.68k|   std::pair<BigInt, BigInt> xy = OS2ECP(data, data_len, curve.get_p(), curve.get_a(), curve.get_b());
  634|       |
  635|  1.68k|   EC_Point point(curve, xy.first, xy.second);
  636|       |
  637|  1.68k|   if(!point.on_the_curve()) {
  ------------------
  |  Branch (637:7): [True: 119, False: 1.56k]
  ------------------
  638|    119|      throw Decoding_Error("OS2ECP: Decoded point was not on the curve");
  639|    119|   }
  640|       |
  641|  1.56k|   return point;
  642|  1.68k|}
_ZN5Botan6OS2ECPEPKhmRKNS_6BigIntES4_S4_:
  645|  2.19k|   const uint8_t data[], size_t data_len, const BigInt& curve_p, const BigInt& curve_a, const BigInt& curve_b) {
  646|  2.19k|   if(data_len <= 1) {
  ------------------
  |  Branch (646:7): [True: 2, False: 2.19k]
  ------------------
  647|      2|      throw Decoding_Error("OS2ECP invalid point");
  648|      2|   }
  649|       |
  650|  2.19k|   const uint8_t pc = data[0];
  651|       |
  652|  2.19k|   BigInt x, y;
  653|       |
  654|  2.19k|   if(pc == 2 || pc == 3) {
  ------------------
  |  Branch (654:7): [True: 667, False: 1.52k]
  |  Branch (654:18): [True: 727, False: 796]
  ------------------
  655|       |      //compressed form
  656|  1.39k|      x = BigInt::decode(&data[1], data_len - 1);
  657|       |
  658|  1.39k|      const bool y_mod_2 = ((pc & 0x01) == 1);
  659|  1.39k|      y = decompress_point(y_mod_2, x, curve_p, curve_a, curve_b);
  660|  1.39k|   } else if(pc == 4) {
  ------------------
  |  Branch (660:14): [True: 572, False: 224]
  ------------------
  661|    572|      const size_t l = (data_len - 1) / 2;
  662|       |
  663|       |      // uncompressed form
  664|    572|      x = BigInt::decode(&data[1], l);
  665|    572|      y = BigInt::decode(&data[l + 1], l);
  666|    572|   } else if(pc == 6 || pc == 7) {
  ------------------
  |  Branch (666:14): [True: 82, False: 142]
  |  Branch (666:25): [True: 74, False: 68]
  ------------------
  667|    156|      const size_t l = (data_len - 1) / 2;
  668|       |
  669|       |      // hybrid form
  670|    156|      x = BigInt::decode(&data[1], l);
  671|    156|      y = BigInt::decode(&data[l + 1], l);
  672|       |
  673|    156|      const bool y_mod_2 = ((pc & 0x01) == 1);
  674|       |
  675|    156|      if(decompress_point(y_mod_2, x, curve_p, curve_a, curve_b) != y) {
  ------------------
  |  Branch (675:10): [True: 113, False: 43]
  ------------------
  676|    113|         throw Decoding_Error("OS2ECP: Decoding error in hybrid format");
  677|    113|      }
  678|    156|   } else {
  679|     68|      throw Invalid_Argument("OS2ECP: Unknown format type " + std::to_string(pc));
  680|     68|   }
  681|       |
  682|  2.00k|   return std::make_pair(x, y);
  683|  2.19k|}
ec_point.cpp:_ZN5Botan12_GLOBAL__N_19resize_wsERNSt3__16vectorINS_6BigIntENS1_9allocatorIS3_EEEEm:
   61|   593k|inline void resize_ws(std::vector<BigInt>& ws_bn, size_t cap_size) {
   62|   593k|   BOTAN_ASSERT(ws_bn.size() >= EC_Point::WORKSPACE_SIZE, "Expected size for EC_Point workspace");
  ------------------
  |  |   51|   593k|   do {                                                                                 \
  |  |   52|   593k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 593k]
  |  |  ------------------
  |  |   53|   593k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|   593k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   63|       |
   64|  4.74M|   for(auto& ws : ws_bn) {
  ------------------
  |  Branch (64:17): [True: 4.74M, False: 593k]
  ------------------
   65|  4.74M|      if(ws.size() < cap_size) {
  ------------------
  |  Branch (65:10): [True: 40.9k, False: 4.70M]
  ------------------
   66|  40.9k|         ws.get_word_vector().resize(cap_size);
   67|  40.9k|      }
   68|  4.74M|   }
   69|   593k|}
ec_point.cpp:_ZN5Botan12_GLOBAL__N_116decompress_pointEbRKNS_6BigIntES3_S3_S3_:
  604|  1.55k|   bool yMod2, const BigInt& x, const BigInt& curve_p, const BigInt& curve_a, const BigInt& curve_b) {
  605|  1.55k|   BigInt xpow3 = x * x * x;
  606|       |
  607|  1.55k|   BigInt g = curve_a * x;
  608|  1.55k|   g += xpow3;
  609|  1.55k|   g += curve_b;
  610|  1.55k|   g = g % curve_p;
  611|       |
  612|  1.55k|   BigInt z = sqrt_modulo_prime(g, curve_p);
  613|       |
  614|  1.55k|   if(z < 0) {
  ------------------
  |  Branch (614:7): [True: 338, False: 1.21k]
  ------------------
  615|    338|      throw Decoding_Error("Error during EC point decompression");
  616|    338|   }
  617|       |
  618|  1.21k|   if(z.get_bit(0) != yMod2) {
  ------------------
  |  Branch (618:7): [True: 609, False: 603]
  ------------------
  619|    609|      z = curve_p - z;
  620|    609|   }
  621|       |
  622|  1.21k|   return z;
  623|  1.55k|}

_ZN5Botan30EC_Point_Base_Point_PrecomputeC2ERKNS_8EC_PointERKNS_15Modular_ReducerE:
   30|    634|      m_base_point(base), m_mod_order(mod_order), m_p_words(base.get_curve().get_p().sig_words()) {
   31|    634|   std::vector<BigInt> ws(EC_Point::WORKSPACE_SIZE);
   32|       |
   33|    634|   const size_t p_bits = base.get_curve().get_p().bits();
   34|       |
   35|       |   /*
   36|       |   * Some of the curves (eg secp160k1) have an order slightly larger than
   37|       |   * the size of the prime modulus. In all cases they are at most 1 bit
   38|       |   * longer. The +1 compensates for this.
   39|       |   */
   40|    634|   const size_t T_bits = round_up(p_bits + blinding_size(mod_order.get_modulus()) + 1, WINDOW_BITS) / WINDOW_BITS;
   41|       |
   42|    634|   std::vector<EC_Point> T(WINDOW_SIZE * T_bits);
   43|       |
   44|    634|   EC_Point g = base;
   45|    634|   EC_Point g2, g4;
   46|       |
   47|  69.5k|   for(size_t i = 0; i != T_bits; i++) {
  ------------------
  |  Branch (47:22): [True: 68.8k, False: 634]
  ------------------
   48|  68.8k|      g2 = g;
   49|  68.8k|      g2.mult2(ws);
   50|  68.8k|      g4 = g2;
   51|  68.8k|      g4.mult2(ws);
   52|       |
   53|  68.8k|      T[7 * i + 0] = g;
   54|  68.8k|      T[7 * i + 1] = std::move(g2);
   55|  68.8k|      T[7 * i + 2] = T[7 * i + 1].plus(T[7 * i + 0], ws);  // g2+g
   56|  68.8k|      T[7 * i + 3] = g4;
   57|  68.8k|      T[7 * i + 4] = T[7 * i + 3].plus(T[7 * i + 0], ws);  // g4+g
   58|  68.8k|      T[7 * i + 5] = T[7 * i + 3].plus(T[7 * i + 1], ws);  // g4+g2
   59|  68.8k|      T[7 * i + 6] = T[7 * i + 3].plus(T[7 * i + 2], ws);  // g4+g2+g
   60|       |
   61|  68.8k|      g.swap(g4);
   62|  68.8k|      g.mult2(ws);
   63|  68.8k|   }
   64|       |
   65|    634|   EC_Point::force_all_affine(T, ws[0].get_word_vector());
   66|       |
   67|    634|   m_W.resize(T.size() * 2 * m_p_words);
   68|       |
   69|    634|   word* p = &m_W[0];
   70|   465k|   for(size_t i = 0; i != T.size(); ++i) {
  ------------------
  |  Branch (70:22): [True: 464k, False: 634]
  ------------------
   71|   464k|      T[i].get_x().encode_words(p, m_p_words);
   72|   464k|      p += m_p_words;
   73|   464k|      T[i].get_y().encode_words(p, m_p_words);
   74|   464k|      p += m_p_words;
   75|   464k|   }
   76|    634|}
_ZN5Botan31EC_Point_Multi_Point_PrecomputeC2ERKNS_8EC_PointES3_:
  295|    493|EC_Point_Multi_Point_Precompute::EC_Point_Multi_Point_Precompute(const EC_Point& x, const EC_Point& y) {
  296|    493|   if(x.on_the_curve() == false || y.on_the_curve() == false) {
  ------------------
  |  Branch (296:7): [True: 0, False: 493]
  |  Branch (296:36): [True: 0, False: 493]
  ------------------
  297|      0|      m_M.push_back(x.zero());
  298|      0|      return;
  299|      0|   }
  300|       |
  301|    493|   std::vector<BigInt> ws(EC_Point::WORKSPACE_SIZE);
  302|       |
  303|    493|   EC_Point x2 = x;
  304|    493|   x2.mult2(ws);
  305|       |
  306|    493|   const EC_Point x3(x2.plus(x, ws));
  307|       |
  308|    493|   EC_Point y2 = y;
  309|    493|   y2.mult2(ws);
  310|       |
  311|    493|   const EC_Point y3(y2.plus(y, ws));
  312|       |
  313|    493|   m_M.reserve(15);
  314|       |
  315|    493|   m_M.push_back(x);
  316|    493|   m_M.push_back(x2);
  317|    493|   m_M.push_back(x3);
  318|       |
  319|    493|   m_M.push_back(y);
  320|    493|   m_M.push_back(y.plus(x, ws));
  321|    493|   m_M.push_back(y.plus(x2, ws));
  322|    493|   m_M.push_back(y.plus(x3, ws));
  323|       |
  324|    493|   m_M.push_back(y2);
  325|    493|   m_M.push_back(y2.plus(x, ws));
  326|    493|   m_M.push_back(y2.plus(x2, ws));
  327|    493|   m_M.push_back(y2.plus(x3, ws));
  328|       |
  329|    493|   m_M.push_back(y3);
  330|    493|   m_M.push_back(y3.plus(x, ws));
  331|    493|   m_M.push_back(y3.plus(x2, ws));
  332|    493|   m_M.push_back(y3.plus(x3, ws));
  333|       |
  334|    493|   bool no_infinity = true;
  335|  7.39k|   for(auto& pt : m_M) {
  ------------------
  |  Branch (335:17): [True: 7.39k, False: 493]
  ------------------
  336|  7.39k|      if(pt.is_zero()) {
  ------------------
  |  Branch (336:10): [True: 330, False: 7.06k]
  ------------------
  337|    330|         no_infinity = false;
  338|    330|      }
  339|  7.39k|   }
  340|       |
  341|    493|   if(no_infinity) {
  ------------------
  |  Branch (341:7): [True: 383, False: 110]
  ------------------
  342|    383|      EC_Point::force_all_affine(m_M, ws[0].get_word_vector());
  343|    383|   }
  344|       |
  345|    493|   m_no_infinity = no_infinity;
  346|    493|}
_ZNK5Botan31EC_Point_Multi_Point_Precompute9multi_expERKNS_6BigIntES3_:
  348|    267|EC_Point EC_Point_Multi_Point_Precompute::multi_exp(const BigInt& z1, const BigInt& z2) const {
  349|    267|   if(m_M.size() == 1) {
  ------------------
  |  Branch (349:7): [True: 0, False: 267]
  ------------------
  350|      0|      return m_M[0];
  351|      0|   }
  352|       |
  353|    267|   std::vector<BigInt> ws(EC_Point::WORKSPACE_SIZE);
  354|       |
  355|    267|   const size_t z_bits = round_up(std::max(z1.bits(), z2.bits()), 2);
  356|       |
  357|    267|   EC_Point H = m_M[0].zero();
  358|       |
  359|  41.0k|   for(size_t i = 0; i != z_bits; i += 2) {
  ------------------
  |  Branch (359:22): [True: 40.7k, False: 267]
  ------------------
  360|  40.7k|      if(i > 0) {
  ------------------
  |  Branch (360:10): [True: 40.4k, False: 267]
  ------------------
  361|  40.4k|         H.mult2i(2, ws);
  362|  40.4k|      }
  363|       |
  364|  40.7k|      const uint32_t z1_b = z1.get_substring(z_bits - i - 2, 2);
  365|  40.7k|      const uint32_t z2_b = z2.get_substring(z_bits - i - 2, 2);
  366|       |
  367|  40.7k|      const uint32_t z12 = (4 * z2_b) + z1_b;
  368|       |
  369|       |      // This function is not intended to be const time
  370|  40.7k|      if(z12) {
  ------------------
  |  Branch (370:10): [True: 34.7k, False: 5.98k]
  ------------------
  371|  34.7k|         if(m_no_infinity) {
  ------------------
  |  Branch (371:13): [True: 21.7k, False: 13.0k]
  ------------------
  372|  21.7k|            H.add_affine(m_M[z12 - 1], ws);
  373|  21.7k|         } else {
  374|  13.0k|            H.add(m_M[z12 - 1], ws);
  375|  13.0k|         }
  376|  34.7k|      }
  377|  40.7k|   }
  378|       |
  379|    267|   if(z1.is_negative() != z2.is_negative()) {
  ------------------
  |  Branch (379:7): [True: 0, False: 267]
  ------------------
  380|      0|      H.negate();
  381|      0|   }
  382|       |
  383|    267|   return H;
  384|    267|}
point_mul.cpp:_ZN5Botan12_GLOBAL__N_113blinding_sizeERKNS_6BigIntE:
   18|    634|size_t blinding_size(const BigInt& group_order) {
   19|    634|   return (group_order.bits() + 1) / 2;
   20|    634|}

_ZN5Botan12EC_PublicKeyC2ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE:
   47|  2.09k|      m_domain_encoding(default_encoding_for(m_domain_params)) {}
ecc_key.cpp:_ZN5Botan12_GLOBAL__N_120default_encoding_forERNS_8EC_GroupE:
   31|    731|EC_Group_Encoding default_encoding_for(EC_Group& group) {
   32|    731|   if(group.get_curve_oid().empty()) {
  ------------------
  |  Branch (32:7): [True: 1, False: 730]
  ------------------
   33|      1|      return EC_Group_Encoding::Explicit;
   34|    730|   } else {
   35|    730|      return EC_Group_Encoding::NamedCurve;
   36|    730|   }
   37|    731|}

_ZNK5Botan15ECDSA_PublicKey27create_x509_verification_opERKNS_19AlgorithmIdentifierENSt3__117basic_string_viewIcNS4_11char_traitsIcEEEE:
  259|    730|   const AlgorithmIdentifier& signature_algorithm, std::string_view provider) const {
  260|    730|   if(provider == "base" || provider.empty()) {
  ------------------
  |  Branch (260:7): [True: 0, False: 730]
  |  Branch (260:29): [True: 730, False: 0]
  ------------------
  261|    730|      return std::make_unique<ECDSA_Verification_Operation>(*this, signature_algorithm);
  262|    730|   }
  263|       |
  264|      0|   throw Provider_Not_Found(algo_name(), provider);
  265|    730|}
ecdsa.cpp:_ZN5Botan12_GLOBAL__N_128ECDSA_Verification_Operation6verifyEPKhmS3_m:
  214|    417|bool ECDSA_Verification_Operation::verify(const uint8_t msg[], size_t msg_len, const uint8_t sig[], size_t sig_len) {
  215|    417|   if(sig_len != m_group.get_order_bytes() * 2) {
  ------------------
  |  Branch (215:7): [True: 215, False: 202]
  ------------------
  216|    215|      return false;
  217|    215|   }
  218|       |
  219|    202|   const BigInt e = BigInt::from_bytes_with_max_bits(msg, msg_len, m_group.get_order_bits());
  220|       |
  221|    202|   const BigInt r(sig, sig_len / 2);
  222|    202|   const BigInt s(sig + sig_len / 2, sig_len / 2);
  223|       |
  224|       |   // Cannot be negative here since we just decoded from binary
  225|    202|   if(r.is_zero() || s.is_zero()) {
  ------------------
  |  Branch (225:7): [True: 1, False: 201]
  |  Branch (225:22): [True: 1, False: 200]
  ------------------
  226|      2|      return false;
  227|      2|   }
  228|       |
  229|    200|   if(r >= m_group.get_order() || s >= m_group.get_order()) {
  ------------------
  |  Branch (229:7): [True: 0, False: 200]
  |  Branch (229:35): [True: 0, False: 200]
  ------------------
  230|      0|      return false;
  231|      0|   }
  232|       |
  233|    200|   const BigInt w = m_group.inverse_mod_order(s);
  234|       |
  235|    200|   const BigInt u1 = m_group.multiply_mod_order(m_group.mod_order(e), w);
  236|    200|   const BigInt u2 = m_group.multiply_mod_order(r, w);
  237|    200|   const EC_Point R = m_gy_mul.multi_exp(u1, u2);
  238|       |
  239|    200|   if(R.is_zero()) {
  ------------------
  |  Branch (239:7): [True: 0, False: 200]
  ------------------
  240|      0|      return false;
  241|      0|   }
  242|       |
  243|    200|   const BigInt v = m_group.mod_order(R.get_affine_x());
  244|    200|   return (v == r);
  245|    200|}
ecdsa.cpp:_ZN5Botan12_GLOBAL__N_128ECDSA_Verification_OperationC2ERKNS_15ECDSA_PublicKeyERKNS_19AlgorithmIdentifierE:
  205|    730|            m_gy_mul(m_group.get_base_point(), ecdsa.public_point()) {}

_ZN5Botan17Ed25519_PublicKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE:
   74|      1|Ed25519_PublicKey::Ed25519_PublicKey(const AlgorithmIdentifier& /*unused*/, std::span<const uint8_t> key_bits) {
   75|      1|   m_public.assign(key_bits.begin(), key_bits.end());
   76|       |
   77|      1|   if(m_public.size() != 32) {
  ------------------
  |  Branch (77:7): [True: 1, False: 0]
  ------------------
   78|      1|      throw Decoding_Error("Invalid size for Ed25519 public key");
   79|      1|   }
   80|      1|}

_ZN5Botan19GOST_3410_PublicKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE:
   64|    102|GOST_3410_PublicKey::GOST_3410_PublicKey(const AlgorithmIdentifier& alg_id, std::span<const uint8_t> key_bits) {
   65|    102|   OID ecc_param_id;
   66|       |
   67|       |   // The parameters also includes hash and cipher OIDs
   68|    102|   BER_Decoder(alg_id.parameters()).start_sequence().decode(ecc_param_id);
   69|       |
   70|    102|   m_domain_params = EC_Group(ecc_param_id);
   71|       |
   72|    102|   const size_t p_bits = m_domain_params.get_p_bits();
   73|    102|   if(p_bits != 256 && p_bits != 512) {
  ------------------
  |  Branch (73:7): [True: 2, False: 100]
  |  Branch (73:24): [True: 2, False: 0]
  ------------------
   74|      2|      throw Decoding_Error(fmt("GOST-34.10-2012 is not defined for parameters of size {}", p_bits));
   75|      2|   }
   76|       |
   77|    100|   secure_vector<uint8_t> bits;
   78|    100|   BER_Decoder(key_bits).decode(bits, ASN1_Type::OctetString);
   79|       |
   80|    100|   if(bits.size() != 2 * (p_bits / 8)) {
  ------------------
  |  Branch (80:7): [True: 7, False: 93]
  ------------------
   81|      7|      throw Decoding_Error("GOST-34.10-2020 invalid encoding of public key");
   82|      7|   }
   83|       |
   84|     93|   const size_t part_size = bits.size() / 2;
   85|       |
   86|       |   // Keys are stored in little endian format (WTF)
   87|  1.38k|   for(size_t i = 0; i != part_size / 2; ++i) {
  ------------------
  |  Branch (87:22): [True: 1.29k, False: 93]
  ------------------
   88|  1.29k|      std::swap(bits[i], bits[part_size - 1 - i]);
   89|  1.29k|      std::swap(bits[part_size + i], bits[2 * part_size - 1 - i]);
   90|  1.29k|   }
   91|       |
   92|     93|   BigInt x(bits.data(), part_size);
   93|     93|   BigInt y(&bits[part_size], part_size);
   94|       |
   95|     93|   m_public_key = domain().point(x, y);
   96|       |
   97|     93|   BOTAN_ASSERT(m_public_key.on_the_curve(), "Loaded GOST 34.10 public key is on the curve");
  ------------------
  |  |   51|     93|   do {                                                                                 \
  |  |   52|     93|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 5, False: 88]
  |  |  ------------------
  |  |   53|     93|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|     93|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   98|     93|}
_ZNK5Botan19GOST_3410_PublicKey27create_x509_verification_opERKNS_19AlgorithmIdentifierENSt3__117basic_string_viewIcNS4_11char_traitsIcEEEE:
  286|     75|   const AlgorithmIdentifier& signature_algorithm, std::string_view provider) const {
  287|     75|   if(provider == "base" || provider.empty()) {
  ------------------
  |  Branch (287:7): [True: 0, False: 75]
  |  Branch (287:29): [True: 75, False: 0]
  ------------------
  288|     75|      return std::make_unique<GOST_3410_Verification_Operation>(*this, signature_algorithm);
  289|     75|   }
  290|       |
  291|      0|   throw Provider_Not_Found(algo_name(), provider);
  292|     75|}
gost_3410.cpp:_ZN5Botan12_GLOBAL__N_132GOST_3410_Verification_Operation6verifyEPKhmS3_m:
  237|     73|                                              size_t sig_len) {
  238|     73|   if(sig_len != m_group.get_order_bytes() * 2) {
  ------------------
  |  Branch (238:7): [True: 1, False: 72]
  ------------------
  239|      1|      return false;
  240|      1|   }
  241|       |
  242|     72|   const BigInt s(sig, sig_len / 2);
  243|     72|   const BigInt r(sig + sig_len / 2, sig_len / 2);
  244|       |
  245|     72|   const BigInt& order = m_group.get_order();
  246|       |
  247|     72|   if(r <= 0 || r >= order || s <= 0 || s >= order) {
  ------------------
  |  Branch (247:7): [True: 1, False: 71]
  |  Branch (247:17): [True: 1, False: 70]
  |  Branch (247:31): [True: 1, False: 69]
  |  Branch (247:41): [True: 2, False: 67]
  ------------------
  248|      5|      return false;
  249|      5|   }
  250|       |
  251|     67|   BigInt e = decode_le(msg, msg_len);
  252|     67|   e = m_group.mod_order(e);
  253|     67|   if(e.is_zero()) {
  ------------------
  |  Branch (253:7): [True: 0, False: 67]
  ------------------
  254|      0|      e = BigInt::one();
  255|      0|   }
  256|       |
  257|     67|   const BigInt v = m_group.inverse_mod_order(e);
  258|       |
  259|     67|   const BigInt z1 = m_group.multiply_mod_order(s, v);
  260|     67|   const BigInt z2 = m_group.multiply_mod_order(-r, v);
  261|       |
  262|     67|   const EC_Point R = m_gy_mul.multi_exp(z1, z2);
  263|       |
  264|     67|   if(R.is_zero()) {
  ------------------
  |  Branch (264:7): [True: 0, False: 67]
  ------------------
  265|      0|      return false;
  266|      0|   }
  267|       |
  268|     67|   return (R.get_affine_x() == r);
  269|     67|}
gost_3410.cpp:_ZN5Botan12_GLOBAL__N_19decode_leEPKhm:
  114|     67|BigInt decode_le(const uint8_t msg[], size_t msg_len) {
  115|     67|   secure_vector<uint8_t> msg_le(msg, msg + msg_len);
  116|       |
  117|  1.17k|   for(size_t i = 0; i != msg_le.size() / 2; ++i) {
  ------------------
  |  Branch (117:22): [True: 1.10k, False: 67]
  ------------------
  118|  1.10k|      std::swap(msg_le[i], msg_le[msg_le.size() - 1 - i]);
  119|  1.10k|   }
  120|       |
  121|     67|   return BigInt(msg_le.data(), msg_le.size());
  122|     67|}
gost_3410.cpp:_ZN5Botan12_GLOBAL__N_132GOST_3410_Verification_OperationC2ERKNS_19GOST_3410_PublicKeyERKNS_19AlgorithmIdentifierE:
  225|     75|            m_gy_mul(m_group.get_base_point(), gost.public_point()) {}
gost_3410.cpp:_ZN5Botan12_GLOBAL__N_120gost_hash_from_algidERKNS_19AlgorithmIdentifierE:
  190|     75|std::string gost_hash_from_algid(const AlgorithmIdentifier& alg_id) {
  191|     75|   if(!alg_id.parameters_are_empty()) {
  ------------------
  |  Branch (191:7): [True: 1, False: 74]
  ------------------
  192|      1|      throw Decoding_Error("Unexpected non-empty AlgorithmIdentifier parameters for GOST 34.10 signature");
  193|      1|   }
  194|       |
  195|     74|   const std::string oid_str = alg_id.oid().to_formatted_string();
  196|     74|   if(oid_str == "GOST-34.10/GOST-R-34.11-94") {
  ------------------
  |  Branch (196:7): [True: 0, False: 74]
  ------------------
  197|      0|      return "GOST-R-34.11-94";
  198|      0|   }
  199|     74|   if(oid_str == "GOST-34.10-2012-256/Streebog-256") {
  ------------------
  |  Branch (199:7): [True: 71, False: 3]
  ------------------
  200|     71|      return "Streebog-256";
  201|     71|   }
  202|      3|   if(oid_str == "GOST-34.10-2012-512/Streebog-512") {
  ------------------
  |  Branch (202:7): [True: 2, False: 1]
  ------------------
  203|      2|      return "Streebog-512";
  204|      2|   }
  205|      1|   if(oid_str == "GOST-34.10-2012-256/SHA-256") {
  ------------------
  |  Branch (205:7): [True: 0, False: 1]
  ------------------
  206|      0|      return "SHA-256";
  207|      0|   }
  208|       |
  209|      1|   throw Decoding_Error(fmt("Unknown OID ({}) for GOST 34.10 signatures", alg_id.oid()));
  210|      1|}

_ZN5Botan8PEM_Code6decodeERNS_10DataSourceERNSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEE:
   62|    314|secure_vector<uint8_t> decode(DataSource& source, std::string& label) {
   63|    314|   const size_t RANDOM_CHAR_LIMIT = 8;
   64|       |
   65|    314|   label.clear();
   66|       |
   67|    314|   const std::string PEM_HEADER1 = "-----BEGIN ";
   68|    314|   const std::string PEM_HEADER2 = "-----";
   69|    314|   size_t position = 0;
   70|       |
   71|  4.48k|   while(position != PEM_HEADER1.length()) {
  ------------------
  |  Branch (71:10): [True: 4.21k, False: 273]
  ------------------
   72|  4.21k|      uint8_t b;
   73|  4.21k|      if(!source.read_byte(b)) {
  ------------------
  |  Branch (73:10): [True: 40, False: 4.17k]
  ------------------
   74|     40|         throw Decoding_Error("PEM: No PEM header found");
   75|     40|      }
   76|  4.17k|      if(static_cast<char>(b) == PEM_HEADER1[position]) {
  ------------------
  |  Branch (76:10): [True: 3.32k, False: 853]
  ------------------
   77|  3.32k|         ++position;
   78|  3.32k|      } else if(position >= RANDOM_CHAR_LIMIT) {
  ------------------
  |  Branch (78:17): [True: 1, False: 852]
  ------------------
   79|      1|         throw Decoding_Error("PEM: Malformed PEM header");
   80|    852|      } else {
   81|    852|         position = 0;
   82|    852|      }
   83|  4.17k|   }
   84|    273|   position = 0;
   85|  73.0k|   while(position != PEM_HEADER2.length()) {
  ------------------
  |  Branch (85:10): [True: 72.7k, False: 241]
  ------------------
   86|  72.7k|      uint8_t b;
   87|  72.7k|      if(!source.read_byte(b)) {
  ------------------
  |  Branch (87:10): [True: 29, False: 72.7k]
  ------------------
   88|     29|         throw Decoding_Error("PEM: No PEM header found");
   89|     29|      }
   90|  72.7k|      if(static_cast<char>(b) == PEM_HEADER2[position]) {
  ------------------
  |  Branch (90:10): [True: 1.22k, False: 71.5k]
  ------------------
   91|  1.22k|         ++position;
   92|  71.5k|      } else if(position) {
  ------------------
  |  Branch (92:17): [True: 3, False: 71.5k]
  ------------------
   93|      3|         throw Decoding_Error("PEM: Malformed PEM header");
   94|      3|      }
   95|       |
   96|  72.7k|      if(position == 0) {
  ------------------
  |  Branch (96:10): [True: 71.5k, False: 1.22k]
  ------------------
   97|  71.5k|         label += static_cast<char>(b);
   98|  71.5k|      }
   99|  72.7k|   }
  100|       |
  101|    241|   std::vector<char> b64;
  102|       |
  103|    241|   const std::string PEM_TRAILER = fmt("-----END {}-----", label);
  104|    241|   position = 0;
  105|  53.8k|   while(position != PEM_TRAILER.length()) {
  ------------------
  |  Branch (105:10): [True: 53.6k, False: 151]
  ------------------
  106|  53.6k|      uint8_t b;
  107|  53.6k|      if(!source.read_byte(b)) {
  ------------------
  |  Branch (107:10): [True: 85, False: 53.5k]
  ------------------
  108|     85|         throw Decoding_Error("PEM: No PEM trailer found");
  109|     85|      }
  110|  53.5k|      if(static_cast<char>(b) == PEM_TRAILER[position]) {
  ------------------
  |  Branch (110:10): [True: 7.12k, False: 46.4k]
  ------------------
  111|  7.12k|         ++position;
  112|  46.4k|      } else if(position) {
  ------------------
  |  Branch (112:17): [True: 5, False: 46.4k]
  ------------------
  113|      5|         throw Decoding_Error("PEM: Malformed PEM trailer");
  114|      5|      }
  115|       |
  116|  53.5k|      if(position == 0) {
  ------------------
  |  Branch (116:10): [True: 46.4k, False: 7.12k]
  ------------------
  117|  46.4k|         b64.push_back(b);
  118|  46.4k|      }
  119|  53.5k|   }
  120|       |
  121|    151|   return base64_decode(b64.data(), b64.size());
  122|    241|}
_ZN5Botan8PEM_Code7matchesERNS_10DataSourceENSt3__117basic_string_viewIcNS3_11char_traitsIcEEEEm:
  137|  9.32k|bool matches(DataSource& source, std::string_view extra, size_t search_range) {
  138|  9.32k|   const std::string PEM_HEADER = fmt("-----BEGIN {}", extra);
  139|       |
  140|  9.32k|   secure_vector<uint8_t> search_buf(search_range);
  141|  9.32k|   const size_t got = source.peek(search_buf.data(), search_buf.size(), 0);
  142|       |
  143|  9.32k|   if(got < PEM_HEADER.length()) {
  ------------------
  |  Branch (143:7): [True: 429, False: 8.90k]
  ------------------
  144|    429|      return false;
  145|    429|   }
  146|       |
  147|  8.90k|   size_t index = 0;
  148|       |
  149|  3.94M|   for(size_t j = 0; j != got; ++j) {
  ------------------
  |  Branch (149:22): [True: 3.93M, False: 8.89k]
  ------------------
  150|  3.93M|      if(static_cast<char>(search_buf[j]) == PEM_HEADER[index]) {
  ------------------
  |  Branch (150:10): [True: 16.2k, False: 3.92M]
  ------------------
  151|  16.2k|         ++index;
  152|  3.92M|      } else {
  153|  3.92M|         index = 0;
  154|  3.92M|      }
  155|       |
  156|  3.93M|      if(index == PEM_HEADER.size()) {
  ------------------
  |  Branch (156:10): [True: 10, False: 3.93M]
  ------------------
  157|     10|         return true;
  158|     10|      }
  159|  3.93M|   }
  160|       |
  161|  8.89k|   return false;
  162|  8.90k|}

_ZN5Botan15load_public_keyERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE:
   96|  2.99k|                                            [[maybe_unused]] std::span<const uint8_t> key_bits) {
   97|  2.99k|   const std::string oid_str = alg_id.oid().to_formatted_string();
   98|  2.99k|   const std::vector<std::string> alg_info = split_on(oid_str, '/');
   99|  2.99k|   std::string_view alg_name = alg_info[0];
  100|       |
  101|  2.99k|#if defined(BOTAN_HAS_RSA)
  102|  2.99k|   if(alg_name == "RSA") {
  ------------------
  |  Branch (102:7): [True: 482, False: 2.51k]
  ------------------
  103|    482|      return std::make_unique<RSA_PublicKey>(alg_id, key_bits);
  104|    482|   }
  105|  2.51k|#endif
  106|       |
  107|  2.51k|#if defined(BOTAN_HAS_CURVE_25519)
  108|  2.51k|   if(alg_name == "Curve25519") {
  ------------------
  |  Branch (108:7): [True: 1, False: 2.51k]
  ------------------
  109|      1|      return std::make_unique<Curve25519_PublicKey>(alg_id, key_bits);
  110|      1|   }
  111|  2.51k|#endif
  112|       |
  113|  2.51k|#if defined(BOTAN_HAS_MCELIECE)
  114|  2.51k|   if(alg_name == "McEliece") {
  ------------------
  |  Branch (114:7): [True: 0, False: 2.51k]
  ------------------
  115|      0|      return std::make_unique<McEliece_PublicKey>(key_bits);
  116|      0|   }
  117|  2.51k|#endif
  118|       |
  119|  2.51k|#if defined(BOTAN_HAS_FRODOKEM)
  120|  2.51k|   if(alg_name == "FrodoKEM" || alg_name.starts_with("FrodoKEM-") || alg_name.starts_with("eFrodoKEM-")) {
  ------------------
  |  Branch (120:7): [True: 0, False: 2.51k]
  |  Branch (120:33): [True: 0, False: 2.51k]
  |  Branch (120:70): [True: 0, False: 2.51k]
  ------------------
  121|      0|      return std::make_unique<FrodoKEM_PublicKey>(alg_id, key_bits);
  122|      0|   }
  123|  2.51k|#endif
  124|       |
  125|  2.51k|#if defined(BOTAN_HAS_KYBER) || defined(BOTAN_HAS_KYBER_90S)
  126|  2.51k|   if(alg_name == "Kyber" || alg_name.starts_with("Kyber-")) {
  ------------------
  |  Branch (126:7): [True: 0, False: 2.51k]
  |  Branch (126:30): [True: 0, False: 2.51k]
  ------------------
  127|      0|      return std::make_unique<Kyber_PublicKey>(alg_id, key_bits);
  128|      0|   }
  129|  2.51k|#endif
  130|       |
  131|  2.51k|#if defined(BOTAN_HAS_ECDSA)
  132|  2.51k|   if(alg_name == "ECDSA") {
  ------------------
  |  Branch (132:7): [True: 2.09k, False: 421]
  ------------------
  133|  2.09k|      return std::make_unique<ECDSA_PublicKey>(alg_id, key_bits);
  134|  2.09k|   }
  135|    421|#endif
  136|       |
  137|    421|#if defined(BOTAN_HAS_ECDH)
  138|    421|   if(alg_name == "ECDH") {
  ------------------
  |  Branch (138:7): [True: 2, False: 419]
  ------------------
  139|      2|      return std::make_unique<ECDH_PublicKey>(alg_id, key_bits);
  140|      2|   }
  141|    419|#endif
  142|       |
  143|    419|#if defined(BOTAN_HAS_DIFFIE_HELLMAN)
  144|    419|   if(alg_name == "DH") {
  ------------------
  |  Branch (144:7): [True: 50, False: 369]
  ------------------
  145|     50|      return std::make_unique<DH_PublicKey>(alg_id, key_bits);
  146|     50|   }
  147|    369|#endif
  148|       |
  149|    369|#if defined(BOTAN_HAS_DSA)
  150|    369|   if(alg_name == "DSA") {
  ------------------
  |  Branch (150:7): [True: 38, False: 331]
  ------------------
  151|     38|      return std::make_unique<DSA_PublicKey>(alg_id, key_bits);
  152|     38|   }
  153|    331|#endif
  154|       |
  155|    331|#if defined(BOTAN_HAS_ELGAMAL)
  156|    331|   if(alg_name == "ElGamal") {
  ------------------
  |  Branch (156:7): [True: 0, False: 331]
  ------------------
  157|      0|      return std::make_unique<ElGamal_PublicKey>(alg_id, key_bits);
  158|      0|   }
  159|    331|#endif
  160|       |
  161|    331|#if defined(BOTAN_HAS_ECGDSA)
  162|    331|   if(alg_name == "ECGDSA") {
  ------------------
  |  Branch (162:7): [True: 0, False: 331]
  ------------------
  163|      0|      return std::make_unique<ECGDSA_PublicKey>(alg_id, key_bits);
  164|      0|   }
  165|    331|#endif
  166|       |
  167|    331|#if defined(BOTAN_HAS_ECKCDSA)
  168|    331|   if(alg_name == "ECKCDSA") {
  ------------------
  |  Branch (168:7): [True: 0, False: 331]
  ------------------
  169|      0|      return std::make_unique<ECKCDSA_PublicKey>(alg_id, key_bits);
  170|      0|   }
  171|    331|#endif
  172|       |
  173|    331|#if defined(BOTAN_HAS_ED25519)
  174|    331|   if(alg_name == "Ed25519") {
  ------------------
  |  Branch (174:7): [True: 1, False: 330]
  ------------------
  175|      1|      return std::make_unique<Ed25519_PublicKey>(alg_id, key_bits);
  176|      1|   }
  177|    330|#endif
  178|       |
  179|    330|#if defined(BOTAN_HAS_GOST_34_10_2001)
  180|    330|   if(alg_name == "GOST-34.10" || alg_name == "GOST-34.10-2012-256" || alg_name == "GOST-34.10-2012-512") {
  ------------------
  |  Branch (180:7): [True: 11, False: 319]
  |  Branch (180:35): [True: 79, False: 240]
  |  Branch (180:72): [True: 12, False: 228]
  ------------------
  181|    102|      return std::make_unique<GOST_3410_PublicKey>(alg_id, key_bits);
  182|    102|   }
  183|    228|#endif
  184|       |
  185|    228|#if defined(BOTAN_HAS_SM2)
  186|    228|   if(alg_name == "SM2" || alg_name == "SM2_Sig" || alg_name == "SM2_Enc") {
  ------------------
  |  Branch (186:7): [True: 0, False: 228]
  |  Branch (186:28): [True: 0, False: 228]
  |  Branch (186:53): [True: 0, False: 228]
  ------------------
  187|      0|      return std::make_unique<SM2_PublicKey>(alg_id, key_bits);
  188|      0|   }
  189|    228|#endif
  190|       |
  191|    228|#if defined(BOTAN_HAS_XMSS_RFC8391)
  192|    228|   if(alg_name == "XMSS") {
  ------------------
  |  Branch (192:7): [True: 0, False: 228]
  ------------------
  193|      0|      return std::make_unique<XMSS_PublicKey>(key_bits);
  194|      0|   }
  195|    228|#endif
  196|       |
  197|    228|#if defined(BOTAN_HAS_DILITHIUM) || defined(BOTAN_HAS_DILITHIUM_AES)
  198|    228|   if(alg_name == "Dilithium" || alg_name.starts_with("Dilithium-")) {
  ------------------
  |  Branch (198:7): [True: 0, False: 228]
  |  Branch (198:34): [True: 0, False: 228]
  ------------------
  199|      0|      return std::make_unique<Dilithium_PublicKey>(alg_id, key_bits);
  200|      0|   }
  201|    228|#endif
  202|       |
  203|    228|#if defined(BOTAN_HAS_SPHINCS_PLUS_WITH_SHA2) || defined(BOTAN_HAS_SPHINCS_PLUS_WITH_SHAKE)
  204|    228|   if(alg_name == "SPHINCS+" || alg_name.starts_with("SphincsPlus-")) {
  ------------------
  |  Branch (204:7): [True: 0, False: 228]
  |  Branch (204:33): [True: 0, False: 228]
  ------------------
  205|      0|      return std::make_unique<SphincsPlus_PublicKey>(alg_id, key_bits);
  206|      0|   }
  207|    228|#endif
  208|       |
  209|    228|   throw Decoding_Error(fmt("Unknown or unavailable public key algorithm '{}'", alg_name));
  210|    228|}

_ZN5Botan22create_hex_fingerprintEPKhmNSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE:
   30|  6.27k|std::string create_hex_fingerprint(const uint8_t bits[], size_t bits_len, std::string_view hash_name) {
   31|  6.27k|   auto hash_fn = HashFunction::create_or_throw(hash_name);
   32|  6.27k|   const std::string hex_hash = hex_encode(hash_fn->process(bits, bits_len));
   33|       |
   34|  6.27k|   std::string fprint;
   35|       |
   36|   169k|   for(size_t i = 0; i != hex_hash.size(); i += 2) {
  ------------------
  |  Branch (36:22): [True: 163k, False: 6.27k]
  ------------------
   37|   163k|      if(i != 0) {
  ------------------
  |  Branch (37:10): [True: 156k, False: 6.27k]
  ------------------
   38|   156k|         fprint.push_back(':');
   39|   156k|      }
   40|       |
   41|   163k|      fprint.push_back(hex_hash[i]);
   42|   163k|      fprint.push_back(hex_hash[i + 1]);
   43|   163k|   }
   44|       |
   45|  6.27k|   return fprint;
   46|  6.27k|}
_ZNK5Botan10Public_Key27create_x509_verification_opERKNS_19AlgorithmIdentifierENSt3__117basic_string_viewIcNS4_11char_traitsIcEEEE:
  107|      5|                                                                              std::string_view /*provider*/) const {
  108|      5|   throw Lookup_Error(fmt("{} does not support X.509 verification", algo_name()));
  109|      5|}

_ZN5Botan6PK_Ops22Verification_with_HashC2ENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE:
  127|     73|      Verification(), m_hash(create_signature_hash(padding)) {}
_ZN5Botan6PK_Ops22Verification_with_HashC2ERKNS_19AlgorithmIdentifierENSt3__117basic_string_viewIcNS5_11char_traitsIcEEEEb:
  131|    761|                                                       bool allow_null_parameters) {
  132|    761|   const auto oid_info = split_on(alg_id.oid().to_formatted_string(), '/');
  133|       |
  134|    761|   if(oid_info.size() != 2 || oid_info[0] != pk_algo) {
  ------------------
  |  Branch (134:7): [True: 308, False: 453]
  |  Branch (134:31): [True: 3, False: 450]
  ------------------
  135|    311|      throw Decoding_Error(
  136|    311|         fmt("Unexpected AlgorithmIdentifier OID {} in association with {} key", alg_id.oid(), pk_algo));
  137|    311|   }
  138|       |
  139|    450|   if(!alg_id.parameters_are_empty()) {
  ------------------
  |  Branch (139:7): [True: 30, False: 420]
  ------------------
  140|     30|      if(alg_id.parameters_are_null()) {
  ------------------
  |  Branch (140:10): [True: 29, False: 1]
  ------------------
  141|     29|         if(!allow_null_parameters) {
  ------------------
  |  Branch (141:13): [True: 29, False: 0]
  ------------------
  142|     29|            throw Decoding_Error(fmt("Unexpected NULL AlgorithmIdentifier parameters for {}", pk_algo));
  143|     29|         }
  144|     29|      } else {
  145|      1|         throw Decoding_Error(fmt("Unexpected AlgorithmIdentifier parameters for {}", pk_algo));
  146|      1|      }
  147|     30|   }
  148|       |
  149|    420|   m_hash = HashFunction::create_or_throw(oid_info[1]);
  150|    420|}
_ZN5Botan6PK_Ops22Verification_with_Hash6updateEPKhm:
  152|    493|void PK_Ops::Verification_with_Hash::update(const uint8_t msg[], size_t msg_len) {
  153|    493|   m_hash->update(msg, msg_len);
  154|    493|}
_ZN5Botan6PK_Ops22Verification_with_Hash18is_valid_signatureEPKhm:
  156|    490|bool PK_Ops::Verification_with_Hash::is_valid_signature(const uint8_t sig[], size_t sig_len) {
  157|    490|   const secure_vector<uint8_t> msg = m_hash->final();
  158|    490|   return verify(msg.data(), msg.size(), sig, sig_len);
  159|    490|}
pk_ops.cpp:_ZN5Botan12_GLOBAL__N_121create_signature_hashENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   72|     73|std::unique_ptr<HashFunction> create_signature_hash(std::string_view padding) {
   73|     73|   if(auto hash = HashFunction::create(padding)) {
  ------------------
  |  Branch (73:12): [True: 73, False: 0]
  ------------------
   74|     73|      return hash;
   75|     73|   }
   76|       |
   77|      0|   SCAN_Name req(padding);
   78|       |
   79|      0|   if(req.algo_name() == "EMSA1" && req.arg_count() == 1) {
  ------------------
  |  Branch (79:7): [True: 0, False: 0]
  |  Branch (79:37): [True: 0, False: 0]
  ------------------
   80|      0|      if(auto hash = HashFunction::create(req.arg(0))) {
  ------------------
  |  Branch (80:15): [True: 0, False: 0]
  ------------------
   81|      0|         return hash;
   82|      0|      }
   83|      0|   }
   84|       |
   85|      0|#if defined(BOTAN_HAS_RAW_HASH_FN)
   86|      0|   if(req.algo_name() == "Raw") {
  ------------------
  |  Branch (86:7): [True: 0, False: 0]
  ------------------
   87|      0|      if(req.arg_count() == 0) {
  ------------------
  |  Branch (87:10): [True: 0, False: 0]
  ------------------
   88|      0|         return std::make_unique<RawHashFunction>("Raw", 0);
   89|      0|      }
   90|       |
   91|      0|      if(req.arg_count() == 1) {
  ------------------
  |  Branch (91:10): [True: 0, False: 0]
  ------------------
   92|      0|         if(auto hash = HashFunction::create(req.arg(0))) {
  ------------------
  |  Branch (92:18): [True: 0, False: 0]
  ------------------
   93|      0|            return std::make_unique<RawHashFunction>(std::move(hash));
   94|      0|         }
   95|      0|      }
   96|      0|   }
   97|      0|#endif
   98|       |
   99|      0|   throw Algorithm_Not_Found(padding);
  100|      0|}

_ZN5Botan11PK_VerifierC2ERKNS_10Public_KeyERKNS_19AlgorithmIdentifierENSt3__117basic_string_viewIcNS7_11char_traitsIcEEEE:
  341|  1.31k|                         std::string_view provider) {
  342|  1.31k|   m_op = key.create_x509_verification_op(signature_algorithm, provider);
  343|       |
  344|  1.31k|   if(!m_op) {
  ------------------
  |  Branch (344:7): [True: 0, False: 1.31k]
  ------------------
  345|      0|      throw Invalid_Argument(fmt("Key type {} does not support X.509 signature verification", key.algo_name()));
  346|      0|   }
  347|       |
  348|  1.31k|   m_sig_format = key.default_x509_signature_format();
  349|  1.31k|   m_parts = key.message_parts();
  350|  1.31k|   m_part_size = key.message_part_size();
  351|  1.31k|   check_der_format_supported(m_sig_format, m_parts);
  352|  1.31k|}
_ZN5Botan11PK_VerifierD2Ev:
  354|    877|PK_Verifier::~PK_Verifier() = default;
_ZN5Botan11PK_Verifier14verify_messageEPKhmS2_m:
  368|    877|bool PK_Verifier::verify_message(const uint8_t msg[], size_t msg_length, const uint8_t sig[], size_t sig_length) {
  369|    877|   update(msg, msg_length);
  370|    877|   return check_signature(sig, sig_length);
  371|    877|}
_ZN5Botan11PK_Verifier6updateEPKhm:
  377|    877|void PK_Verifier::update(const uint8_t in[], size_t length) {
  378|    877|   m_op->update(in, length);
  379|    877|}
_ZN5Botan11PK_Verifier15check_signatureEPKhm:
  413|    877|bool PK_Verifier::check_signature(const uint8_t sig[], size_t length) {
  414|    877|   try {
  415|    877|      if(m_sig_format == Signature_Format::Standard) {
  ------------------
  |  Branch (415:10): [True: 457, False: 420]
  ------------------
  416|    457|         return m_op->is_valid_signature(sig, length);
  417|    457|      } else if(m_sig_format == Signature_Format::DerSequence) {
  ------------------
  |  Branch (417:17): [True: 420, False: 0]
  ------------------
  418|    420|         bool decoding_success = false;
  419|    420|         std::vector<uint8_t> real_sig;
  420|       |
  421|    420|         try {
  422|    420|            real_sig = decode_der_signature(sig, length, m_parts, m_part_size);
  423|    420|            decoding_success = true;
  424|    420|         } catch(Decoding_Error&) {}
  425|       |
  426|    420|         bool accept = m_op->is_valid_signature(real_sig.data(), real_sig.size());
  427|       |
  428|    417|         return accept && decoding_success;
  ------------------
  |  Branch (428:17): [True: 0, False: 417]
  |  Branch (428:27): [True: 0, False: 0]
  ------------------
  429|    420|      } else {
  430|      0|         throw Internal_Error("PK_Verifier: Invalid signature format enum");
  431|      0|      }
  432|    877|   } catch(Invalid_Argument&) {
  433|      0|      return false;
  434|     30|   } catch(Decoding_Error&) {
  435|     30|      return false;
  436|     30|   } catch(Encoding_Error&) {
  437|      3|      return false;
  438|      3|   }
  439|    877|}
pubkey.cpp:_ZN5Botan12_GLOBAL__N_126check_der_format_supportedENS_16Signature_FormatEm:
  238|    877|void check_der_format_supported(Signature_Format format, size_t parts) {
  239|    877|   if(format != Signature_Format::Standard && parts == 1) {
  ------------------
  |  Branch (239:7): [True: 420, False: 457]
  |  Branch (239:47): [True: 0, False: 420]
  ------------------
  240|      0|      throw Invalid_Argument("This algorithm does not support DER encoding");
  241|      0|   }
  242|    877|}
pubkey.cpp:_ZN5Botan12_GLOBAL__N_120der_encode_signatureERKNSt3__16vectorIhNS1_9allocatorIhEEEEmm:
  284|    225|std::vector<uint8_t> der_encode_signature(const std::vector<uint8_t>& sig, size_t parts, size_t part_size) {
  285|    225|   if(sig.size() % parts != 0 || sig.size() != parts * part_size) {
  ------------------
  |  Branch (285:7): [True: 0, False: 225]
  |  Branch (285:34): [True: 0, False: 225]
  ------------------
  286|      0|      throw Encoding_Error("Unexpected size for DER signature");
  287|      0|   }
  288|       |
  289|    225|   std::vector<BigInt> sig_parts(parts);
  290|    675|   for(size_t i = 0; i != sig_parts.size(); ++i) {
  ------------------
  |  Branch (290:22): [True: 450, False: 225]
  ------------------
  291|    450|      sig_parts[i].binary_decode(&sig[part_size * i], part_size);
  292|    450|   }
  293|       |
  294|    225|   std::vector<uint8_t> output;
  295|    225|   DER_Encoder(output).start_sequence().encode_list(sig_parts).end_cons();
  296|    225|   return output;
  297|    225|}
pubkey.cpp:_ZN5Botan12_GLOBAL__N_120decode_der_signatureEPKhmmm:
  383|    420|std::vector<uint8_t> decode_der_signature(const uint8_t sig[], size_t length, size_t sig_parts, size_t sig_part_size) {
  384|    420|   std::vector<uint8_t> real_sig;
  385|    420|   BER_Decoder decoder(sig, length);
  386|    420|   BER_Decoder ber_sig = decoder.start_sequence();
  387|       |
  388|    420|   BOTAN_ASSERT_NOMSG(sig_parts != 0 && sig_part_size != 0);
  ------------------
  |  |   60|    420|   do {                                                                     \
  |  |   61|    690|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:12): [True: 270, False: 150]
  |  |  |  Branch (61:12): [True: 270, False: 0]
  |  |  ------------------
  |  |   62|    420|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    420|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  389|       |
  390|    420|   size_t count = 0;
  391|       |
  392|  1.24k|   while(ber_sig.more_items()) {
  ------------------
  |  Branch (392:10): [True: 820, False: 420]
  ------------------
  393|    820|      BigInt sig_part;
  394|    820|      ber_sig.decode(sig_part);
  395|    820|      real_sig += BigInt::encode_1363(sig_part, sig_part_size);
  396|    820|      ++count;
  397|    820|   }
  398|       |
  399|    420|   if(count != sig_parts) {
  ------------------
  |  Branch (399:7): [True: 11, False: 409]
  ------------------
  400|     11|      throw Decoding_Error("PK_Verifier: signature size invalid");
  401|     11|   }
  402|       |
  403|    409|   const std::vector<uint8_t> reencoded = der_encode_signature(real_sig, sig_parts, sig_part_size);
  404|       |
  405|    409|   if(reencoded.size() != length || CT::is_equal(reencoded.data(), sig, reencoded.size()).as_bool() == false) {
  ------------------
  |  Branch (405:7): [True: 204, False: 205]
  |  Branch (405:7): [True: 23, False: 386]
  |  Branch (405:37): [True: 3, False: 202]
  ------------------
  406|     23|      throw Decoding_Error("PK_Verifier: signature is not the canonical DER encoding");
  407|     23|   }
  408|    386|   return real_sig;
  409|    409|}

_ZNK5Botan13RSA_PublicKey11public_dataEv:
  118|    385|std::shared_ptr<const RSA_Public_Data> RSA_PublicKey::public_data() const {
  119|    385|   return m_public;
  120|    385|}
_ZN5Botan13RSA_PublicKey4initEONS_6BigIntES2_:
  144|    478|void RSA_PublicKey::init(BigInt&& n, BigInt&& e) {
  145|    478|   if(n.is_negative() || n.is_even() || n.bits() < 5 /* n >= 3*5 */ || e.is_negative() || e.is_even()) {
  ------------------
  |  Branch (145:7): [True: 2, False: 476]
  |  Branch (145:26): [True: 1, False: 475]
  |  Branch (145:41): [True: 1, False: 474]
  |  Branch (145:72): [True: 1, False: 473]
  |  Branch (145:91): [True: 2, False: 471]
  ------------------
  146|      7|      throw Decoding_Error("Invalid RSA public key parameters");
  147|      7|   }
  148|    471|   m_public = std::make_shared<RSA_Public_Data>(std::move(n), std::move(e));
  149|    471|}
_ZN5Botan13RSA_PublicKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE:
  151|    482|RSA_PublicKey::RSA_PublicKey(const AlgorithmIdentifier& /*unused*/, std::span<const uint8_t> key_bits) {
  152|    482|   BigInt n, e;
  153|    482|   BER_Decoder(key_bits).start_sequence().decode(n).decode(e).end_cons();
  154|       |
  155|    482|   init(std::move(n), std::move(e));
  156|    482|}
_ZNK5Botan13RSA_PublicKey27create_x509_verification_opERKNS_19AlgorithmIdentifierENSt3__117basic_string_viewIcNS4_11char_traitsIcEEEE:
  791|    471|                                                                                 std::string_view provider) const {
  792|    471|   if(provider == "base" || provider.empty()) {
  ------------------
  |  Branch (792:7): [True: 0, False: 471]
  |  Branch (792:29): [True: 471, False: 0]
  ------------------
  793|    471|      return std::make_unique<RSA_Verify_Operation>(*this, parse_rsa_signature_algorithm(alg_id));
  794|    471|   }
  795|       |
  796|      0|   throw Provider_Not_Found(algo_name(), provider);
  797|    471|}
_ZNK5Botan15RSA_Public_Data5get_nEv:
   46|    357|      const BigInt& get_n() const { return m_n; }
_ZNK5Botan15RSA_Public_Data19public_modulus_bitsEv:
   50|    354|      size_t public_modulus_bits() const { return m_public_modulus_bits; }
rsa.cpp:_ZN5Botan12_GLOBAL__N_129parse_rsa_signature_algorithmERKNS_19AlgorithmIdentifierE:
  742|    471|std::string parse_rsa_signature_algorithm(const AlgorithmIdentifier& alg_id) {
  743|    471|   const auto sig_info = split_on(alg_id.oid().to_formatted_string(), '/');
  744|       |
  745|    471|   if(sig_info.empty() || sig_info.size() != 2 || sig_info[0] != "RSA") {
  ------------------
  |  Branch (745:7): [True: 0, False: 471]
  |  Branch (745:27): [True: 3, False: 468]
  |  Branch (745:51): [True: 65, False: 403]
  ------------------
  746|     68|      throw Decoding_Error("Unknown AlgorithmIdentifier for RSA X.509 signatures");
  747|     68|   }
  748|       |
  749|    403|   std::string padding = sig_info[1];
  750|       |
  751|    403|   if(padding == "EMSA4") {
  ------------------
  |  Branch (751:7): [True: 54, False: 349]
  ------------------
  752|       |      // "MUST contain RSASSA-PSS-params"
  753|     54|      if(alg_id.parameters().empty()) {
  ------------------
  |  Branch (753:10): [True: 0, False: 54]
  ------------------
  754|      0|         throw Decoding_Error("PSS params must be provided");
  755|      0|      }
  756|       |
  757|     54|      PSS_Params pss_params(alg_id.parameters());
  758|       |
  759|       |      // hash_algo must be SHA1, SHA2-224, SHA2-256, SHA2-384 or SHA2-512
  760|     54|      const std::string hash_algo = pss_params.hash_function();
  761|     54|      if(hash_algo != "SHA-1" && hash_algo != "SHA-224" && hash_algo != "SHA-256" && hash_algo != "SHA-384" &&
  ------------------
  |  Branch (761:10): [True: 39, False: 15]
  |  Branch (761:34): [True: 39, False: 0]
  |  Branch (761:60): [True: 30, False: 9]
  |  Branch (761:86): [True: 3, False: 27]
  ------------------
  762|     54|         hash_algo != "SHA-512") {
  ------------------
  |  Branch (762:10): [True: 2, False: 1]
  ------------------
  763|      2|         throw Decoding_Error("Unacceptable hash for PSS signatures");
  764|      2|      }
  765|       |
  766|     52|      if(pss_params.mgf_function() != "MGF1") {
  ------------------
  |  Branch (766:10): [True: 1, False: 51]
  ------------------
  767|      1|         throw Decoding_Error("Unacceptable MGF for PSS signatures");
  768|      1|      }
  769|       |
  770|       |      // For MGF1, it is strongly RECOMMENDED that the underlying hash
  771|       |      // function be the same as the one identified by hashAlgorithm
  772|       |      //
  773|       |      // Must be SHA1, SHA2-224, SHA2-256, SHA2-384 or SHA2-512
  774|     51|      if(pss_params.hash_algid() != pss_params.mgf_hash_algid()) {
  ------------------
  |  Branch (774:10): [True: 2, False: 49]
  ------------------
  775|      2|         throw Decoding_Error("Unacceptable MGF hash for PSS signatures");
  776|      2|      }
  777|       |
  778|     49|      if(pss_params.trailer_field() != 1) {
  ------------------
  |  Branch (778:10): [True: 1, False: 48]
  ------------------
  779|      1|         throw Decoding_Error("Unacceptable trailer field for PSS signatures");
  780|      1|      }
  781|       |
  782|     48|      padding += fmt("({},MGF1,{})", hash_algo, pss_params.salt_length());
  783|     48|   }
  784|       |
  785|    397|   return padding;
  786|    403|}
_ZN5Botan15RSA_Public_DataC2EONS_6BigIntES2_:
   38|    471|            m_public_modulus_bytes(m_n.bytes()) {}
rsa.cpp:_ZN5Botan12_GLOBAL__N_120RSA_Public_OperationC2ERKNS_13RSA_PublicKeyE:
  623|    385|      explicit RSA_Public_Operation(const RSA_PublicKey& rsa) : m_public(rsa.public_data()) {}
rsa.cpp:_ZNK5Botan12_GLOBAL__N_120RSA_Public_Operation20public_modulus_bytesEv:
  636|    384|      size_t public_modulus_bytes() const { return m_public->public_modulus_bytes(); }
_ZNK5Botan15RSA_Public_Data20public_modulus_bytesEv:
   52|    384|      size_t public_modulus_bytes() const { return m_public_modulus_bytes; }
rsa.cpp:_ZNK5Botan12_GLOBAL__N_120RSA_Public_Operation19public_modulus_bitsEv:
  625|    354|      size_t public_modulus_bits() const { return m_public->public_modulus_bits(); }
rsa.cpp:_ZNK5Botan12_GLOBAL__N_120RSA_Public_Operation9public_opERKNS_6BigIntE:
  628|    357|      BigInt public_op(const BigInt& m) const {
  629|    357|         if(m >= m_public->get_n()) {
  ------------------
  |  Branch (629:13): [True: 3, False: 354]
  ------------------
  630|      3|            throw Decoding_Error("RSA public op - input is too large");
  631|      3|         }
  632|       |
  633|    354|         return m_public->public_op(m);
  634|    357|      }
_ZNK5Botan15RSA_Public_Data9public_opERKNS_6BigIntE:
   40|    354|      BigInt public_op(const BigInt& m) const {
   41|    354|         const size_t powm_window = 1;
   42|    354|         auto powm_m_n = monty_precompute(m_monty_n, m, powm_window, false);
   43|    354|         return monty_execute_vartime(*powm_m_n, m_e);
   44|    354|      }
rsa.cpp:_ZN5Botan12_GLOBAL__N_120RSA_Verify_OperationC2ERKNS_13RSA_PublicKeyENSt3__117basic_string_viewIcNS5_11char_traitsIcEEEE:
  674|    385|            RSA_Public_Operation(rsa), m_emsa(EMSA::create_or_throw(padding)) {}
rsa.cpp:_ZN5Botan12_GLOBAL__N_120RSA_Verify_Operation6updateEPKhm:
  665|    384|      void update(const uint8_t msg[], size_t msg_len) override { m_emsa->update(msg, msg_len); }
rsa.cpp:_ZN5Botan12_GLOBAL__N_120RSA_Verify_Operation18is_valid_signatureEPKhm:
  667|    384|      bool is_valid_signature(const uint8_t sig[], size_t sig_len) override {
  668|    384|         const auto msg = m_emsa->raw_data();
  669|    384|         const auto message_repr = recover_message_repr(sig, sig_len);
  670|    384|         return m_emsa->verify(message_repr, msg, public_modulus_bits() - 1);
  671|    384|      }
rsa.cpp:_ZN5Botan12_GLOBAL__N_120RSA_Verify_Operation20recover_message_reprEPKhm:
  679|    384|      std::vector<uint8_t> recover_message_repr(const uint8_t input[], size_t input_len) {
  680|    384|         if(input_len > public_modulus_bytes()) {
  ------------------
  |  Branch (680:13): [True: 27, False: 357]
  ------------------
  681|     27|            throw Decoding_Error("RSA signature too large to be valid for this key");
  682|     27|         }
  683|    357|         BigInt input_bn(input, input_len);
  684|    357|         return BigInt::encode(public_op(input_bn));
  685|    384|      }

_ZN5Botan14if_work_factorEm:
   36|     74|size_t if_work_factor(size_t bits) {
   37|     74|   if(bits < 512) {
  ------------------
  |  Branch (37:7): [True: 47, False: 27]
  ------------------
   38|     47|      return 0;
   39|     47|   }
   40|       |
   41|       |   // RFC 3766 estimates k at .02 and o(1) to be effectively zero for sizes of interest
   42|       |
   43|     27|   const double log2_k = -5.6438;  // log2(.02)
   44|     27|   return nfs_workfactor(bits, log2_k);
   45|     74|}
_ZN5Botan14dl_work_factorEm:
   47|     74|size_t dl_work_factor(size_t bits) {
   48|       |   // Lacking better estimates...
   49|     74|   return if_work_factor(bits);
   50|     74|}
_ZN5Botan16dl_exponent_sizeEm:
   52|     74|size_t dl_exponent_size(size_t bits) {
   53|     74|   if(bits == 0) {
  ------------------
  |  Branch (53:7): [True: 0, False: 74]
  ------------------
   54|      0|      return 0;
   55|      0|   }
   56|     74|   if(bits <= 256) {
  ------------------
  |  Branch (56:7): [True: 43, False: 31]
  ------------------
   57|     43|      return bits - 1;
   58|     43|   }
   59|     31|   if(bits <= 1024) {
  ------------------
  |  Branch (59:7): [True: 12, False: 19]
  ------------------
   60|     12|      return 192;
   61|     12|   }
   62|     19|   if(bits <= 1536) {
  ------------------
  |  Branch (62:7): [True: 12, False: 7]
  ------------------
   63|     12|      return 224;
   64|     12|   }
   65|      7|   if(bits <= 2048) {
  ------------------
  |  Branch (65:7): [True: 7, False: 0]
  ------------------
   66|      7|      return 256;
   67|      7|   }
   68|      0|   if(bits <= 4096) {
  ------------------
  |  Branch (68:7): [True: 0, False: 0]
  ------------------
   69|      0|      return 384;
   70|      0|   }
   71|      0|   return 512;
   72|      0|}
workfactor.cpp:_ZN5Botan12_GLOBAL__N_114nfs_workfactorEmd:
   20|     27|size_t nfs_workfactor(size_t bits, double log2_k) {
   21|       |   // approximates natural logarithm of an integer of given bitsize
   22|     27|   const double log2_e = 1.44269504088896340736;
   23|     27|   const double log_p = bits / log2_e;
   24|       |
   25|     27|   const double log_log_p = std::log(log_p);
   26|       |
   27|       |   // RFC 3766: k * e^((1.92 + o(1)) * cubrt(ln(n) * (ln(ln(n)))^2))
   28|     27|   const double est = 1.92 * std::pow(log_p * log_log_p * log_log_p, 1.0 / 3.0);
   29|       |
   30|       |   // return log2 of the workfactor
   31|     27|   return static_cast<size_t>(log2_k + log2_e * est);
   32|     27|}

_ZN5Botan4X5098load_keyERNS_10DataSourceE:
   28|  3.03k|std::unique_ptr<Public_Key> load_key(DataSource& source) {
   29|  3.03k|   try {
   30|  3.03k|      AlgorithmIdentifier alg_id;
   31|  3.03k|      std::vector<uint8_t> key_bits;
   32|       |
   33|  3.03k|      if(ASN1::maybe_BER(source) && !PEM_Code::matches(source)) {
  ------------------
  |  Branch (33:10): [True: 3.03k, False: 0]
  |  Branch (33:37): [True: 3.03k, False: 0]
  ------------------
   34|  3.03k|         BER_Decoder(source).start_sequence().decode(alg_id).decode(key_bits, ASN1_Type::BitString).end_cons();
   35|  3.03k|      } else {
   36|      0|         DataSource_Memory ber(PEM_Code::decode_check_label(source, "PUBLIC KEY"));
   37|       |
   38|      0|         BER_Decoder(ber).start_sequence().decode(alg_id).decode(key_bits, ASN1_Type::BitString).end_cons();
   39|      0|      }
   40|       |
   41|  3.03k|      if(key_bits.empty()) {
  ------------------
  |  Branch (41:10): [True: 10, False: 3.02k]
  ------------------
   42|     10|         throw Decoding_Error("X.509 public key decoding");
   43|     10|      }
   44|       |
   45|  3.02k|      return load_public_key(alg_id, key_bits);
   46|  3.03k|   } catch(Decoding_Error& e) {
   47|  1.10k|      throw Decoding_Error("X.509 public key decoding", e);
   48|  1.10k|   }
   49|  3.03k|}

_ZN5Botan15allocate_memoryEmm:
   20|  20.7M|BOTAN_MALLOC_FN void* allocate_memory(size_t elems, size_t elem_size) {
   21|  20.7M|   if(elems == 0 || elem_size == 0) {
  ------------------
  |  Branch (21:7): [True: 0, False: 20.7M]
  |  Branch (21:21): [True: 0, False: 20.7M]
  ------------------
   22|      0|      return nullptr;
   23|      0|   }
   24|       |
   25|       |   // Some calloc implementations do not check for overflow (?!?)
   26|       |
   27|  20.7M|   if(!BOTAN_CHECKED_MUL(elems, elem_size).has_value()) {
  ------------------
  |  |   74|  20.7M|#define BOTAN_CHECKED_MUL(x, y) checked_mul(x, y)
  ------------------
  |  Branch (27:7): [True: 0, False: 20.7M]
  ------------------
   28|      0|      throw std::bad_alloc();
   29|      0|   }
   30|       |
   31|       |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR)
   32|       |   if(void* p = mlock_allocator::instance().allocate(elems, elem_size)) {
   33|       |      return p;
   34|       |   }
   35|       |#endif
   36|       |
   37|       |#if defined(BOTAN_TARGET_OS_HAS_ALLOC_CONCEAL)
   38|       |   void* ptr = ::calloc_conceal(elems, elem_size);
   39|       |#else
   40|  20.7M|   void* ptr = std::calloc(elems, elem_size);  // NOLINT(*-no-malloc)
   41|  20.7M|#endif
   42|  20.7M|   if(!ptr) {
  ------------------
  |  Branch (42:7): [True: 0, False: 20.7M]
  ------------------
   43|      0|      [[unlikely]] throw std::bad_alloc();
   44|      0|   }
   45|  20.7M|   return ptr;
   46|  20.7M|}
_ZN5Botan17deallocate_memoryEPvmm:
   48|  20.7M|void deallocate_memory(void* p, size_t elems, size_t elem_size) {
   49|  20.7M|   if(p == nullptr) {
  ------------------
  |  Branch (49:7): [True: 0, False: 20.7M]
  ------------------
   50|      0|      [[unlikely]] return;
   51|      0|   }
   52|       |
   53|  20.7M|   secure_scrub_memory(p, elems * elem_size);
   54|       |
   55|       |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR)
   56|       |   if(mlock_allocator::instance().deallocate(p, elems, elem_size)) {
   57|       |      return;
   58|       |   }
   59|       |#endif
   60|       |
   61|  20.7M|   std::free(p);  // NOLINT(*-no-malloc)
   62|  20.7M|}
_ZN5Botan20initialize_allocatorEv:
   64|      1|void initialize_allocator() {
   65|       |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR)
   66|       |   mlock_allocator::instance();
   67|       |#endif
   68|      1|}

_ZN5Botan22throw_invalid_argumentEPKcS1_S1_:
   21|     94|void throw_invalid_argument(const char* message, const char* func, const char* file) {
   22|     94|   throw Invalid_Argument(fmt("{} in {}:{}", message, func, file));
   23|     94|}
_ZN5Botan17assertion_failureEPKcS1_S1_S1_i:
   29|      5|void assertion_failure(const char* expr_str, const char* assertion_made, const char* func, const char* file, int line) {
   30|      5|   std::ostringstream format;
   31|       |
   32|      5|   format << "False assertion ";
   33|       |
   34|      5|   if(assertion_made && assertion_made[0] != 0) {
  ------------------
  |  Branch (34:7): [True: 5, False: 0]
  |  Branch (34:25): [True: 5, False: 0]
  ------------------
   35|      5|      format << "'" << assertion_made << "' (expression " << expr_str << ") ";
   36|      5|   } else {
   37|      0|      format << expr_str << " ";
   38|      0|   }
   39|       |
   40|      5|   if(func) {
  ------------------
  |  Branch (40:7): [True: 5, False: 0]
  ------------------
   41|      5|      format << "in " << func << " ";
   42|      5|   }
   43|       |
   44|      5|   format << "@" << file << ":" << line;
   45|       |
   46|       |#if defined(BOTAN_TERMINATE_ON_ASSERTS)
   47|       |   std::cerr << format.str() << '\n';
   48|       |   std::abort();
   49|       |#else
   50|      5|   throw Internal_Error(format.str());
   51|      5|#endif
   52|      5|}

_ZN5Botan12ucs2_to_utf8EPKhm:
   54|    749|std::string ucs2_to_utf8(const uint8_t ucs2[], size_t len) {
   55|    749|   if(len % 2 != 0) {
  ------------------
  |  Branch (55:7): [True: 38, False: 711]
  ------------------
   56|     38|      throw Decoding_Error("Invalid length for UCS-2 string");
   57|     38|   }
   58|       |
   59|    711|   const size_t chars = len / 2;
   60|       |
   61|    711|   std::string s;
   62|  4.81k|   for(size_t i = 0; i != chars; ++i) {
  ------------------
  |  Branch (62:22): [True: 4.10k, False: 711]
  ------------------
   63|  4.10k|      const uint32_t c = load_be<uint16_t>(ucs2, i);
   64|  4.10k|      append_utf8_for(s, c);
   65|  4.10k|   }
   66|       |
   67|    711|   return s;
   68|    749|}
_ZN5Botan12ucs4_to_utf8EPKhm:
   70|    249|std::string ucs4_to_utf8(const uint8_t ucs4[], size_t len) {
   71|    249|   if(len % 4 != 0) {
  ------------------
  |  Branch (71:7): [True: 11, False: 238]
  ------------------
   72|     11|      throw Decoding_Error("Invalid length for UCS-4 string");
   73|     11|   }
   74|       |
   75|    238|   const size_t chars = len / 4;
   76|       |
   77|    238|   std::string s;
   78|    530|   for(size_t i = 0; i != chars; ++i) {
  ------------------
  |  Branch (78:22): [True: 292, False: 238]
  ------------------
   79|    292|      const uint32_t c = load_be<uint32_t>(ucs4, i);
   80|    292|      append_utf8_for(s, c);
   81|    292|   }
   82|       |
   83|    238|   return s;
   84|    249|}
_ZN5Botan14latin1_to_utf8EPKhm:
   89|  1.11k|std::string latin1_to_utf8(const uint8_t chars[], size_t len) {
   90|  1.11k|   std::string s;
   91|  17.7k|   for(size_t i = 0; i != len; ++i) {
  ------------------
  |  Branch (91:22): [True: 16.6k, False: 1.11k]
  ------------------
   92|  16.6k|      const uint32_t c = static_cast<uint8_t>(chars[i]);
   93|  16.6k|      append_utf8_for(s, c);
   94|  16.6k|   }
   95|  1.11k|   return s;
   96|  1.11k|}
_ZN5Botan23format_char_for_displayEc:
   98|     34|std::string format_char_for_display(char c) {
   99|     34|   std::ostringstream oss;
  100|       |
  101|     34|   oss << "'";
  102|       |
  103|     34|   if(c == '\t') {
  ------------------
  |  Branch (103:7): [True: 0, False: 34]
  ------------------
  104|      0|      oss << "\\t";
  105|     34|   } else if(c == '\n') {
  ------------------
  |  Branch (105:14): [True: 0, False: 34]
  ------------------
  106|      0|      oss << "\\n";
  107|     34|   } else if(c == '\r') {
  ------------------
  |  Branch (107:14): [True: 0, False: 34]
  ------------------
  108|      0|      oss << "\\r";
  109|     34|   } else if(static_cast<unsigned char>(c) >= 128) {
  ------------------
  |  Branch (109:14): [True: 14, False: 20]
  ------------------
  110|     14|      unsigned char z = static_cast<unsigned char>(c);
  111|     14|      oss << "\\x" << std::hex << std::uppercase << static_cast<int>(z);
  112|     20|   } else {
  113|     20|      oss << c;
  114|     20|   }
  115|       |
  116|     34|   oss << "'";
  117|       |
  118|     34|   return oss.str();
  119|     34|}
charset.cpp:_ZN5Botan12_GLOBAL__N_115append_utf8_forERNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEEj:
   18|  21.0k|void append_utf8_for(std::string& s, uint32_t c) {
   19|  21.0k|   if(c >= 0xD800 && c < 0xE000) {
  ------------------
  |  Branch (19:7): [True: 922, False: 20.0k]
  |  Branch (19:22): [True: 34, False: 888]
  ------------------
   20|     34|      throw Decoding_Error("Invalid Unicode character");
   21|     34|   }
   22|       |
   23|  20.9k|   if(c <= 0x7F) {
  ------------------
  |  Branch (23:7): [True: 14.6k, False: 6.35k]
  ------------------
   24|  14.6k|      const uint8_t b0 = static_cast<uint8_t>(c);
   25|  14.6k|      s.push_back(static_cast<char>(b0));
   26|  14.6k|   } else if(c <= 0x7FF) {
  ------------------
  |  Branch (26:14): [True: 2.78k, False: 3.57k]
  ------------------
   27|  2.78k|      const uint8_t b0 = 0xC0 | static_cast<uint8_t>(c >> 6);
   28|  2.78k|      const uint8_t b1 = 0x80 | static_cast<uint8_t>(c & 0x3F);
   29|  2.78k|      s.push_back(static_cast<char>(b0));
   30|  2.78k|      s.push_back(static_cast<char>(b1));
   31|  3.57k|   } else if(c <= 0xFFFF) {
  ------------------
  |  Branch (31:14): [True: 3.37k, False: 193]
  ------------------
   32|  3.37k|      const uint8_t b0 = 0xE0 | static_cast<uint8_t>(c >> 12);
   33|  3.37k|      const uint8_t b1 = 0x80 | static_cast<uint8_t>((c >> 6) & 0x3F);
   34|  3.37k|      const uint8_t b2 = 0x80 | static_cast<uint8_t>(c & 0x3F);
   35|  3.37k|      s.push_back(static_cast<char>(b0));
   36|  3.37k|      s.push_back(static_cast<char>(b1));
   37|  3.37k|      s.push_back(static_cast<char>(b2));
   38|  3.37k|   } else if(c <= 0x10FFFF) {
  ------------------
  |  Branch (38:14): [True: 137, False: 56]
  ------------------
   39|    137|      const uint8_t b0 = 0xF0 | static_cast<uint8_t>(c >> 18);
   40|    137|      const uint8_t b1 = 0x80 | static_cast<uint8_t>((c >> 12) & 0x3F);
   41|    137|      const uint8_t b2 = 0x80 | static_cast<uint8_t>((c >> 6) & 0x3F);
   42|    137|      const uint8_t b3 = 0x80 | static_cast<uint8_t>(c & 0x3F);
   43|    137|      s.push_back(static_cast<char>(b0));
   44|    137|      s.push_back(static_cast<char>(b1));
   45|    137|      s.push_back(static_cast<char>(b2));
   46|    137|      s.push_back(static_cast<char>(b3));
   47|    137|   } else {
   48|     56|      throw Decoding_Error("Invalid Unicode character");
   49|     56|   }
   50|  20.9k|}

_ZN5Botan5CPUID10CPUID_DataC2Ev:
  122|      1|CPUID::CPUID_Data::CPUID_Data() {
  123|      1|   m_processor_features = 0;
  124|       |
  125|      1|#if defined(BOTAN_TARGET_CPU_IS_PPC_FAMILY) || defined(BOTAN_TARGET_CPU_IS_ARM_FAMILY) || \
  126|      1|   defined(BOTAN_TARGET_CPU_IS_X86_FAMILY)
  127|       |
  128|      1|   m_processor_features = detect_cpu_features();
  129|       |
  130|      1|#endif
  131|       |
  132|      1|   m_processor_features |= CPUID::CPUID_INITIALIZED_BIT;
  133|       |
  134|      1|   if(runtime_check_if_big_endian()) {
  ------------------
  |  Branch (134:7): [True: 0, False: 1]
  ------------------
  135|      0|      m_processor_features |= CPUID::CPUID_IS_BIG_ENDIAN_BIT;
  136|      0|   }
  137|       |
  138|      1|   std::string clear_cpuid_env;
  139|      1|   if(OS::read_env_variable(clear_cpuid_env, "BOTAN_CLEAR_CPUID")) {
  ------------------
  |  Branch (139:7): [True: 0, False: 1]
  ------------------
  140|      0|      for(const auto& cpuid : split_on(clear_cpuid_env, ',')) {
  ------------------
  |  Branch (140:29): [True: 0, False: 0]
  ------------------
  141|      0|         for(auto& bit : CPUID::bit_from_string(cpuid)) {
  ------------------
  |  Branch (141:24): [True: 0, False: 0]
  ------------------
  142|      0|            const uint32_t cleared = ~static_cast<uint32_t>(bit);
  143|      0|            m_processor_features &= cleared;
  144|      0|         }
  145|      0|      }
  146|      0|   }
  147|      1|}
cpuid.cpp:_ZN5Botan12_GLOBAL__N_127runtime_check_if_big_endianEv:
   95|      1|bool runtime_check_if_big_endian() {
   96|       |   // Check runtime endian
   97|      1|   const uint32_t endian32 = 0x01234567;
   98|      1|   const uint8_t* e8 = reinterpret_cast<const uint8_t*>(&endian32);
   99|       |
  100|      1|   bool is_big_endian = false;
  101|       |
  102|      1|   if(e8[0] == 0x01 && e8[1] == 0x23 && e8[2] == 0x45 && e8[3] == 0x67) {
  ------------------
  |  Branch (102:7): [True: 0, False: 1]
  |  Branch (102:24): [True: 0, False: 0]
  |  Branch (102:41): [True: 0, False: 0]
  |  Branch (102:58): [True: 0, False: 0]
  ------------------
  103|      0|      is_big_endian = true;
  104|      1|   } else if(e8[0] == 0x67 && e8[1] == 0x45 && e8[2] == 0x23 && e8[3] == 0x01) {
  ------------------
  |  Branch (104:14): [True: 1, False: 0]
  |  Branch (104:31): [True: 1, False: 0]
  |  Branch (104:48): [True: 1, False: 0]
  |  Branch (104:65): [True: 1, False: 0]
  ------------------
  105|      1|      is_big_endian = false;
  106|      1|   } else {
  107|      0|      throw Internal_Error("Unexpected endian at runtime, neither big nor little");
  108|      0|   }
  109|       |
  110|       |   // If we were compiled with a known endian, verify it matches at runtime
  111|      1|#if defined(BOTAN_TARGET_CPU_IS_LITTLE_ENDIAN)
  112|      1|   BOTAN_ASSERT(!is_big_endian, "Build and runtime endian match");
  ------------------
  |  |   51|      1|   do {                                                                                 \
  |  |   52|      1|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 1]
  |  |  ------------------
  |  |   53|      1|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|      1|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  113|       |#elif defined(BOTAN_TARGET_CPU_IS_BIG_ENDIAN)
  114|       |   BOTAN_ASSERT(is_big_endian, "Build and runtime endian match");
  115|       |#endif
  116|       |
  117|      1|   return is_big_endian;
  118|      1|}

_ZN5Botan5CPUID10CPUID_Data19detect_cpu_featuresEv:
   71|      1|uint32_t CPUID::CPUID_Data::detect_cpu_features() {
   72|      1|   uint32_t features_detected = 0;
   73|      1|   uint32_t cpuid[4] = {0};
   74|      1|   bool has_os_ymm_support = false;
   75|      1|   bool has_os_zmm_support = false;
   76|       |
   77|       |   // CPUID 0: vendor identification, max sublevel
   78|      1|   invoke_cpuid(0, cpuid);
   79|       |
   80|      1|   const uint32_t max_supported_sublevel = cpuid[0];
   81|       |
   82|      1|   if(max_supported_sublevel >= 1) {
  ------------------
  |  Branch (82:7): [True: 1, False: 0]
  ------------------
   83|       |      // CPUID 1: feature bits
   84|      1|      invoke_cpuid(1, cpuid);
   85|      1|      const uint64_t flags0 = (static_cast<uint64_t>(cpuid[2]) << 32) | cpuid[3];
   86|       |
   87|      1|      enum x86_CPUID_1_bits : uint64_t {
   88|      1|         RDTSC = (1ULL << 4),
   89|      1|         SSE2 = (1ULL << 26),
   90|      1|         CLMUL = (1ULL << 33),
   91|      1|         SSSE3 = (1ULL << 41),
   92|      1|         AESNI = (1ULL << 57),
   93|      1|         OSXSAVE = (1ULL << 59),
   94|      1|         AVX = (1ULL << 60),
   95|      1|         RDRAND = (1ULL << 62)
   96|      1|      };
   97|       |
   98|      1|      if(flags0 & x86_CPUID_1_bits::RDTSC) {
  ------------------
  |  Branch (98:10): [True: 1, False: 0]
  ------------------
   99|      1|         features_detected |= CPUID::CPUID_RDTSC_BIT;
  100|      1|      }
  101|      1|      if(flags0 & x86_CPUID_1_bits::SSE2) {
  ------------------
  |  Branch (101:10): [True: 1, False: 0]
  ------------------
  102|      1|         features_detected |= CPUID::CPUID_SSE2_BIT;
  103|      1|      }
  104|      1|      if(flags0 & x86_CPUID_1_bits::CLMUL) {
  ------------------
  |  Branch (104:10): [True: 1, False: 0]
  ------------------
  105|      1|         features_detected |= CPUID::CPUID_CLMUL_BIT;
  106|      1|      }
  107|      1|      if(flags0 & x86_CPUID_1_bits::SSSE3) {
  ------------------
  |  Branch (107:10): [True: 1, False: 0]
  ------------------
  108|      1|         features_detected |= CPUID::CPUID_SSSE3_BIT;
  109|      1|      }
  110|      1|      if(flags0 & x86_CPUID_1_bits::AESNI) {
  ------------------
  |  Branch (110:10): [True: 1, False: 0]
  ------------------
  111|      1|         features_detected |= CPUID::CPUID_AESNI_BIT;
  112|      1|      }
  113|      1|      if(flags0 & x86_CPUID_1_bits::RDRAND) {
  ------------------
  |  Branch (113:10): [True: 1, False: 0]
  ------------------
  114|      1|         features_detected |= CPUID::CPUID_RDRAND_BIT;
  115|      1|      }
  116|       |
  117|      1|      if((flags0 & x86_CPUID_1_bits::AVX) && (flags0 & x86_CPUID_1_bits::OSXSAVE)) {
  ------------------
  |  Branch (117:10): [True: 1, False: 0]
  |  Branch (117:46): [True: 1, False: 0]
  ------------------
  118|      1|         const uint64_t xcr_flags = xgetbv();
  119|      1|         if((xcr_flags & 0x6) == 0x6) {
  ------------------
  |  Branch (119:13): [True: 1, False: 0]
  ------------------
  120|      1|            has_os_ymm_support = true;
  121|      1|            has_os_zmm_support = (xcr_flags & 0xE0) == 0xE0;
  122|      1|         }
  123|      1|      }
  124|      1|   }
  125|       |
  126|      1|   if(max_supported_sublevel >= 7) {
  ------------------
  |  Branch (126:7): [True: 1, False: 0]
  ------------------
  127|      1|      clear_mem(cpuid, 4);
  128|      1|      invoke_cpuid_sublevel(7, 0, cpuid);
  129|       |
  130|      1|      enum x86_CPUID_7_bits : uint64_t {
  131|      1|         BMI1 = (1ULL << 3),
  132|      1|         AVX2 = (1ULL << 5),
  133|      1|         BMI2 = (1ULL << 8),
  134|      1|         AVX512_F = (1ULL << 16),
  135|      1|         AVX512_DQ = (1ULL << 17),
  136|      1|         RDSEED = (1ULL << 18),
  137|      1|         ADX = (1ULL << 19),
  138|      1|         AVX512_IFMA = (1ULL << 21),
  139|      1|         SHA = (1ULL << 29),
  140|      1|         AVX512_BW = (1ULL << 30),
  141|      1|         AVX512_VL = (1ULL << 31),
  142|      1|         AVX512_VBMI = (1ULL << 33),
  143|      1|         AVX512_VBMI2 = (1ULL << 38),
  144|      1|         AVX512_VAES = (1ULL << 41),
  145|      1|         AVX512_VCLMUL = (1ULL << 42),
  146|      1|         AVX512_VBITALG = (1ULL << 44),
  147|      1|      };
  148|       |
  149|      1|      const uint64_t flags7 = (static_cast<uint64_t>(cpuid[2]) << 32) | cpuid[1];
  150|       |
  151|      1|      if((flags7 & x86_CPUID_7_bits::AVX2) && has_os_ymm_support) {
  ------------------
  |  Branch (151:10): [True: 1, False: 0]
  |  Branch (151:47): [True: 1, False: 0]
  ------------------
  152|      1|         features_detected |= CPUID::CPUID_AVX2_BIT;
  153|      1|      }
  154|      1|      if(flags7 & x86_CPUID_7_bits::RDSEED) {
  ------------------
  |  Branch (154:10): [True: 1, False: 0]
  ------------------
  155|      1|         features_detected |= CPUID::CPUID_RDSEED_BIT;
  156|      1|      }
  157|      1|      if(flags7 & x86_CPUID_7_bits::ADX) {
  ------------------
  |  Branch (157:10): [True: 1, False: 0]
  ------------------
  158|      1|         features_detected |= CPUID::CPUID_ADX_BIT;
  159|      1|      }
  160|      1|      if(flags7 & x86_CPUID_7_bits::SHA) {
  ------------------
  |  Branch (160:10): [True: 0, False: 1]
  ------------------
  161|      0|         features_detected |= CPUID::CPUID_SHA_BIT;
  162|      0|      }
  163|       |
  164|       |      /*
  165|       |      We only set the BMI bit if both BMI1 and BMI2 are supported, since
  166|       |      typically we want to use both extensions in the same code.
  167|       |      */
  168|      1|      if((flags7 & x86_CPUID_7_bits::BMI1) && (flags7 & x86_CPUID_7_bits::BMI2)) {
  ------------------
  |  Branch (168:10): [True: 1, False: 0]
  |  Branch (168:47): [True: 1, False: 0]
  ------------------
  169|      1|         features_detected |= CPUID::CPUID_BMI_BIT;
  170|      1|      }
  171|       |
  172|      1|      if((flags7 & x86_CPUID_7_bits::AVX512_F) && has_os_zmm_support) {
  ------------------
  |  Branch (172:10): [True: 0, False: 1]
  |  Branch (172:51): [True: 0, False: 0]
  ------------------
  173|      0|         const uint64_t AVX512_PROFILE_FLAGS = x86_CPUID_7_bits::AVX512_F | x86_CPUID_7_bits::AVX512_DQ |
  174|      0|                                               x86_CPUID_7_bits::AVX512_IFMA | x86_CPUID_7_bits::AVX512_BW |
  175|      0|                                               x86_CPUID_7_bits::AVX512_VL | x86_CPUID_7_bits::AVX512_VBMI |
  176|      0|                                               x86_CPUID_7_bits::AVX512_VBMI2 | x86_CPUID_7_bits::AVX512_VBITALG;
  177|       |
  178|       |         /*
  179|       |         We only enable AVX512 support if all of the above flags are available
  180|       |
  181|       |         This is more than we strictly need for most uses, however it also has
  182|       |         the effect of preventing execution of AVX512 codepaths on cores that
  183|       |         have serious downclocking problems when AVX512 code executes,
  184|       |         especially Intel Skylake.
  185|       |
  186|       |         VBMI2/VBITALG are the key flags here as they restrict us to Intel Ice
  187|       |         Lake/Rocket Lake, or AMD Zen4, all of which do not have penalties for
  188|       |         executing AVX512.
  189|       |
  190|       |         There is nothing stopping some future processor from supporting the
  191|       |         above flags and having AVX512 penalties, but maybe you should not have
  192|       |         bought such a processor.
  193|       |         */
  194|      0|         if((flags7 & AVX512_PROFILE_FLAGS) == AVX512_PROFILE_FLAGS) {
  ------------------
  |  Branch (194:13): [True: 0, False: 0]
  ------------------
  195|      0|            features_detected |= CPUID::CPUID_AVX512_BIT;
  196|       |
  197|      0|            if(flags7 & x86_CPUID_7_bits::AVX512_VAES) {
  ------------------
  |  Branch (197:16): [True: 0, False: 0]
  ------------------
  198|      0|               features_detected |= CPUID::CPUID_AVX512_AES_BIT;
  199|      0|            }
  200|      0|            if(flags7 & x86_CPUID_7_bits::AVX512_VCLMUL) {
  ------------------
  |  Branch (200:16): [True: 0, False: 0]
  ------------------
  201|      0|               features_detected |= CPUID::CPUID_AVX512_CLMUL_BIT;
  202|      0|            }
  203|      0|         }
  204|      0|      }
  205|      1|   }
  206|       |
  207|       |   /*
  208|       |   * If we don't have access to CPUID, we can still safely assume that
  209|       |   * any x86-64 processor has SSE2 and RDTSC
  210|       |   */
  211|      1|   #if defined(BOTAN_TARGET_ARCH_IS_X86_64)
  212|      1|   if(features_detected == 0) {
  ------------------
  |  Branch (212:7): [True: 0, False: 1]
  ------------------
  213|      0|      features_detected |= CPUID::CPUID_SSE2_BIT;
  214|      0|      features_detected |= CPUID::CPUID_RDTSC_BIT;
  215|      0|   }
  216|      1|   #endif
  217|       |
  218|      1|   return features_detected;
  219|      1|}
cpuid_x86.cpp:_ZN5Botan12_GLOBAL__N_112invoke_cpuidEjPj:
   33|      2|void invoke_cpuid(uint32_t type, uint32_t out[4]) {
   34|       |   #if defined(BOTAN_BUILD_COMPILER_IS_MSVC) || defined(BOTAN_BUILD_COMPILER_IS_INTEL)
   35|       |   __cpuid((int*)out, type);
   36|       |
   37|       |   #elif defined(BOTAN_BUILD_COMPILER_IS_GCC) || defined(BOTAN_BUILD_COMPILER_IS_CLANG)
   38|      2|   __get_cpuid(type, out, out + 1, out + 2, out + 3);
   39|       |
   40|       |   #elif defined(BOTAN_USE_GCC_INLINE_ASM)
   41|       |   asm("cpuid\n\t" : "=a"(out[0]), "=b"(out[1]), "=c"(out[2]), "=d"(out[3]) : "0"(type));
   42|       |
   43|       |   #else
   44|       |      #warning "No way of calling x86 cpuid instruction for this compiler"
   45|       |   clear_mem(out, 4);
   46|       |   #endif
   47|      2|}
cpuid_x86.cpp:_ZN5Botan12_GLOBAL__N_16xgetbvEv:
   49|      1|BOTAN_FUNC_ISA("xsave") uint64_t xgetbv() {
   50|      1|   return _xgetbv(0);
   51|      1|}
cpuid_x86.cpp:_ZN5Botan12_GLOBAL__N_121invoke_cpuid_sublevelEjjPj:
   53|      1|void invoke_cpuid_sublevel(uint32_t type, uint32_t level, uint32_t out[4]) {
   54|       |   #if defined(BOTAN_BUILD_COMPILER_IS_MSVC)
   55|       |   __cpuidex((int*)out, type, level);
   56|       |
   57|       |   #elif defined(BOTAN_BUILD_COMPILER_IS_GCC) || defined(BOTAN_BUILD_COMPILER_IS_CLANG)
   58|      1|   __cpuid_count(type, level, out[0], out[1], out[2], out[3]);
   59|       |
   60|       |   #elif defined(BOTAN_USE_GCC_INLINE_ASM)
   61|       |   asm("cpuid\n\t" : "=a"(out[0]), "=b"(out[1]), "=c"(out[2]), "=d"(out[3]) : "0"(type), "2"(level));
   62|       |
   63|       |   #else
   64|       |      #warning "No way of calling x86 cpuid instruction for this compiler"
   65|       |   clear_mem(out, 4);
   66|       |   #endif
   67|      1|}

_ZN5Botan10DataSource9read_byteERh:
   26|  4.58M|size_t DataSource::read_byte(uint8_t& out) {
   27|  4.58M|   return read(&out, 1);
   28|  4.58M|}
_ZNK5Botan10DataSource9peek_byteERh:
   33|  9.63k|size_t DataSource::peek_byte(uint8_t& out) const {
   34|  9.63k|   return peek(&out, 1, 0);
   35|  9.63k|}
_ZN5Botan10DataSource12discard_nextEm:
   40|  58.4k|size_t DataSource::discard_next(size_t n) {
   41|  58.4k|   uint8_t buf[64] = {0};
   42|  58.4k|   size_t discarded = 0;
   43|       |
   44|   186k|   while(n) {
  ------------------
  |  Branch (44:10): [True: 128k, False: 58.1k]
  ------------------
   45|   128k|      const size_t got = this->read(buf, std::min(n, sizeof(buf)));
   46|   128k|      discarded += got;
   47|   128k|      n -= got;
   48|       |
   49|   128k|      if(got == 0) {
  ------------------
  |  Branch (49:10): [True: 242, False: 127k]
  ------------------
   50|    242|         break;
   51|    242|      }
   52|   128k|   }
   53|       |
   54|  58.4k|   return discarded;
   55|  58.4k|}
_ZN5Botan17DataSource_Memory4readEPhm:
   60|   720k|size_t DataSource_Memory::read(uint8_t out[], size_t length) {
   61|   720k|   const size_t got = std::min<size_t>(m_source.size() - m_offset, length);
   62|   720k|   copy_mem(out, m_source.data() + m_offset, got);
   63|   720k|   m_offset += got;
   64|   720k|   return got;
   65|   720k|}
_ZN5Botan17DataSource_Memory15check_availableEm:
   67|  98.2k|bool DataSource_Memory::check_available(size_t n) {
   68|  98.2k|   return (n <= (m_source.size() - m_offset));
   69|  98.2k|}
_ZNK5Botan17DataSource_Memory4peekEPhmm:
   74|  42.7k|size_t DataSource_Memory::peek(uint8_t out[], size_t length, size_t peek_offset) const {
   75|  42.7k|   const size_t bytes_left = m_source.size() - m_offset;
   76|  42.7k|   if(peek_offset >= bytes_left) {
  ------------------
  |  Branch (76:7): [True: 11.7k, False: 31.0k]
  ------------------
   77|  11.7k|      return 0;
   78|  11.7k|   }
   79|       |
   80|  31.0k|   const size_t got = std::min(bytes_left - peek_offset, length);
   81|  31.0k|   copy_mem(out, &m_source[m_offset + peek_offset], got);
   82|  31.0k|   return got;
   83|  42.7k|}
_ZNK5Botan17DataSource_Memory11end_of_dataEv:
   88|  38.4k|bool DataSource_Memory::end_of_data() const {
   89|  38.4k|   return (m_offset == m_source.size());
   90|  38.4k|}

_ZN5Botan9ExceptionC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   71|  11.4k|Exception::Exception(std::string_view msg) : m_msg(msg) {}
_ZN5Botan9ExceptionC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEERKSt9exception:
   73|  3.94k|Exception::Exception(std::string_view msg, const std::exception& e) : m_msg(fmt("{} failed with {}", msg, e.what())) {}
_ZN5Botan9ExceptionC2EPKcNSt3__117basic_string_viewIcNS3_11char_traitsIcEEEE:
   75|    455|Exception::Exception(const char* prefix, std::string_view msg) : m_msg(fmt("{} {}", prefix, msg)) {}
_ZN5Botan16Invalid_ArgumentC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   77|    729|Invalid_Argument::Invalid_Argument(std::string_view msg) : Exception(msg) {}
_ZN5Botan14Internal_ErrorC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   99|      6|Internal_Error::Internal_Error(std::string_view err) : Exception("Internal error:", err) {}
_ZN5Botan19Algorithm_Not_FoundC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
  115|      1|      Lookup_Error(fmt("Could not find any algorithm named '{}'", name)) {}
_ZN5Botan14Encoding_ErrorC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
  123|    449|Encoding_Error::Encoding_Error(std::string_view name) : Exception("Encoding error:", name) {}
_ZN5Botan14Decoding_ErrorC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
  125|  10.5k|Decoding_Error::Decoding_Error(std::string_view name) : Exception(name) {}
_ZN5Botan14Decoding_ErrorC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEERKSt9exception:
  130|  3.94k|Decoding_Error::Decoding_Error(std::string_view msg, const std::exception& e) : Exception(msg, e) {}

_ZN5Botan19secure_scrub_memoryEPvm:
   87|  20.7M|void secure_scrub_memory(void* ptr, size_t n) {
   88|       |#if defined(BOTAN_TARGET_OS_HAS_RTLSECUREZEROMEMORY)
   89|       |   ::RtlSecureZeroMemory(ptr, n);
   90|       |
   91|       |#elif defined(BOTAN_TARGET_OS_HAS_EXPLICIT_BZERO)
   92|  20.7M|   ::explicit_bzero(ptr, n);
   93|       |
   94|       |#elif defined(BOTAN_TARGET_OS_HAS_EXPLICIT_MEMSET)
   95|       |   (void)::explicit_memset(ptr, 0, n);
   96|       |
   97|       |#elif defined(BOTAN_USE_VOLATILE_MEMSET_FOR_ZERO) && (BOTAN_USE_VOLATILE_MEMSET_FOR_ZERO == 1)
   98|       |   /*
   99|       |   Call memset through a static volatile pointer, which the compiler
  100|       |   should not elide. This construct should be safe in conforming
  101|       |   compilers, but who knows. I did confirm that on x86-64 GCC 6.1 and
  102|       |   Clang 3.8 both create code that saves the memset address in the
  103|       |   data segment and unconditionally loads and jumps to that address.
  104|       |   */
  105|       |   static void* (*const volatile memset_ptr)(void*, int, size_t) = std::memset;
  106|       |   (memset_ptr)(ptr, 0, n);
  107|       |#else
  108|       |
  109|       |   volatile uint8_t* p = reinterpret_cast<volatile uint8_t*>(ptr);
  110|       |
  111|       |   for(size_t i = 0; i != n; ++i)
  112|       |      p[i] = 0;
  113|       |#endif
  114|  20.7M|}
_ZN5Botan2OS10get_auxvalEm:
  128|      1|unsigned long OS::get_auxval(unsigned long id) {
  129|      1|#if defined(BOTAN_TARGET_OS_HAS_GETAUXVAL)
  130|      1|   return ::getauxval(id);
  131|       |#elif defined(BOTAN_TARGET_OS_IS_ANDROID) && defined(BOTAN_TARGET_ARCH_IS_ARM32)
  132|       |
  133|       |   if(id == 0)
  134|       |      return 0;
  135|       |
  136|       |   char** p = environ;
  137|       |
  138|       |   while(*p++ != nullptr)
  139|       |      ;
  140|       |
  141|       |   Elf32_auxv_t* e = reinterpret_cast<Elf32_auxv_t*>(p);
  142|       |
  143|       |   while(e != nullptr) {
  144|       |      if(e->a_type == id)
  145|       |         return e->a_un.a_val;
  146|       |      e++;
  147|       |   }
  148|       |
  149|       |   return 0;
  150|       |#elif defined(BOTAN_TARGET_OS_HAS_ELF_AUX_INFO)
  151|       |   unsigned long auxinfo = 0;
  152|       |   ::elf_aux_info(static_cast<int>(id), &auxinfo, sizeof(auxinfo));
  153|       |   return auxinfo;
  154|       |#elif defined(BOTAN_TARGET_OS_HAS_AUXINFO)
  155|       |   for(const AuxInfo* auxinfo = static_cast<AuxInfo*>(::_dlauxinfo()); auxinfo != AT_NULL; ++auxinfo) {
  156|       |      if(id == auxinfo->a_type)
  157|       |         return auxinfo->a_v;
  158|       |   }
  159|       |
  160|       |   return 0;
  161|       |#else
  162|       |   BOTAN_UNUSED(id);
  163|       |   return 0;
  164|       |#endif
  165|      1|}
_ZN5Botan2OS27running_in_privileged_stateEv:
  167|      1|bool OS::running_in_privileged_state() {
  168|      1|#if defined(AT_SECURE)
  169|      1|   return OS::get_auxval(AT_SECURE) != 0;
  170|       |#elif defined(BOTAN_TARGET_OS_HAS_POSIX1)
  171|       |   return (::getuid() != ::geteuid()) || (::getgid() != ::getegid());
  172|       |#else
  173|       |   return false;
  174|       |#endif
  175|      1|}
_ZN5Botan2OS17read_env_variableERNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS1_17basic_string_viewIcS4_EE:
  409|      1|bool OS::read_env_variable(std::string& value_out, std::string_view name_view) {
  410|      1|   value_out = "";
  411|       |
  412|      1|   if(running_in_privileged_state()) {
  ------------------
  |  Branch (412:7): [True: 0, False: 1]
  ------------------
  413|      0|      return false;
  414|      0|   }
  415|       |
  416|       |#if defined(BOTAN_TARGET_OS_HAS_WIN32) && defined(BOTAN_BUILD_COMPILER_IS_MSVC)
  417|       |   const std::string name(name_view);
  418|       |   char val[128] = {0};
  419|       |   size_t req_size = 0;
  420|       |   if(getenv_s(&req_size, val, sizeof(val), name.c_str()) == 0) {
  421|       |      // Microsoft's implementation always writes a terminating \0,
  422|       |      // and includes it in the reported length of the environment variable
  423|       |      // if a value exists.
  424|       |      if(req_size > 0 && val[req_size - 1] == '\0') {
  425|       |         value_out = std::string(val);
  426|       |      } else {
  427|       |         value_out = std::string(val, req_size);
  428|       |      }
  429|       |      return true;
  430|       |   }
  431|       |#else
  432|      1|   const std::string name(name_view);
  433|      1|   if(const char* val = std::getenv(name.c_str())) {
  ------------------
  |  Branch (433:19): [True: 0, False: 1]
  ------------------
  434|      0|      value_out = val;
  435|      0|      return true;
  436|      0|   }
  437|      1|#endif
  438|       |
  439|      1|   return false;
  440|      1|}

_ZN5Botan9to_u32bitENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEE:
   32|   780k|uint32_t to_u32bit(std::string_view str_view) {
   33|   780k|   const std::string str(str_view);
   34|       |
   35|       |   // std::stoul is not strict enough. Ensure that str is digit only [0-9]*
   36|  1.15M|   for(const char chr : str) {
  ------------------
  |  Branch (36:23): [True: 1.15M, False: 780k]
  ------------------
   37|  1.15M|      if(chr < '0' || chr > '9') {
  ------------------
  |  Branch (37:10): [True: 12, False: 1.15M]
  |  Branch (37:23): [True: 1, False: 1.15M]
  ------------------
   38|     13|         throw Invalid_Argument("to_u32bit invalid decimal string '" + str + "'");
   39|     13|      }
   40|  1.15M|   }
   41|       |
   42|   780k|   const unsigned long int x = std::stoul(str);
   43|       |
   44|   780k|   if constexpr(sizeof(unsigned long int) > 4) {
  ------------------
  |  Branch (44:17): [Folded - Ignored]
  ------------------
   45|       |      // x might be uint64
   46|   780k|      if(x > std::numeric_limits<uint32_t>::max()) {
  ------------------
  |  Branch (46:10): [True: 0, False: 780k]
  ------------------
   47|      0|         throw Invalid_Argument("Integer value of " + str + " exceeds 32 bit range");
   48|      0|      }
   49|   780k|   }
   50|       |
   51|   780k|   return static_cast<uint32_t>(x);
   52|   780k|}
_ZN5Botan8split_onENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEEc:
  111|  4.22k|std::vector<std::string> split_on(std::string_view str, char delim) {
  112|  4.22k|   std::vector<std::string> elems;
  113|  4.22k|   if(str.empty()) {
  ------------------
  |  Branch (113:7): [True: 0, False: 4.22k]
  ------------------
  114|      0|      return elems;
  115|      0|   }
  116|       |
  117|  4.22k|   std::string substr;
  118|  78.5k|   for(auto i = str.begin(); i != str.end(); ++i) {
  ------------------
  |  Branch (118:30): [True: 74.2k, False: 4.22k]
  ------------------
  119|  74.2k|      if(*i == delim) {
  ------------------
  |  Branch (119:10): [True: 2.13k, False: 72.1k]
  ------------------
  120|  2.13k|         if(!substr.empty()) {
  ------------------
  |  Branch (120:13): [True: 2.13k, False: 0]
  ------------------
  121|  2.13k|            elems.push_back(substr);
  122|  2.13k|         }
  123|  2.13k|         substr.clear();
  124|  72.1k|      } else {
  125|  72.1k|         substr += *i;
  126|  72.1k|      }
  127|  74.2k|   }
  128|       |
  129|  4.22k|   if(substr.empty()) {
  ------------------
  |  Branch (129:7): [True: 0, False: 4.22k]
  ------------------
  130|      0|      throw Invalid_Argument(fmt("Unable to split string '{}", str));
  131|      0|   }
  132|  4.22k|   elems.push_back(substr);
  133|       |
  134|  4.22k|   return elems;
  135|  4.22k|}
_ZN5Botan14ipv4_to_stringEj:
  181|  2.94k|std::string ipv4_to_string(uint32_t ip) {
  182|  2.94k|   std::string str;
  183|  2.94k|   uint8_t bits[4];
  184|  2.94k|   store_be(ip, bits);
  185|       |
  186|  14.7k|   for(size_t i = 0; i != 4; ++i) {
  ------------------
  |  Branch (186:22): [True: 11.7k, False: 2.94k]
  ------------------
  187|  11.7k|      if(i > 0) {
  ------------------
  |  Branch (187:10): [True: 8.82k, False: 2.94k]
  ------------------
  188|  8.82k|         str += ".";
  189|  8.82k|      }
  190|  11.7k|      str += std::to_string(bits[i]);
  191|  11.7k|   }
  192|       |
  193|  2.94k|   return str;
  194|  2.94k|}

_ZN5Botan9SCAN_NameC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   58|    385|SCAN_Name::SCAN_Name(std::string_view algo_spec) : m_orig_algo_spec(algo_spec), m_alg_name(), m_args(), m_mode_info() {
   59|    385|   if(algo_spec.empty()) {
  ------------------
  |  Branch (59:7): [True: 0, False: 385]
  ------------------
   60|      0|      throw Invalid_Argument("Expected algorithm name, got empty string");
   61|      0|   }
   62|       |
   63|    385|   std::vector<std::pair<size_t, std::string>> name;
   64|    385|   size_t level = 0;
   65|    385|   std::pair<size_t, std::string> accum = std::make_pair(level, "");
   66|       |
   67|    385|   const std::string decoding_error = "Bad SCAN name '" + m_orig_algo_spec + "': ";
   68|       |
   69|  4.95k|   for(char c : algo_spec) {
  ------------------
  |  Branch (69:15): [True: 4.95k, False: 385]
  ------------------
   70|  4.95k|      if(c == '/' || c == ',' || c == '(' || c == ')') {
  ------------------
  |  Branch (70:10): [True: 0, False: 4.95k]
  |  Branch (70:22): [True: 72, False: 4.88k]
  |  Branch (70:34): [True: 384, False: 4.50k]
  |  Branch (70:46): [True: 384, False: 4.11k]
  ------------------
   71|    840|         if(c == '(') {
  ------------------
  |  Branch (71:13): [True: 384, False: 456]
  ------------------
   72|    384|            ++level;
   73|    456|         } else if(c == ')') {
  ------------------
  |  Branch (73:20): [True: 384, False: 72]
  ------------------
   74|    384|            if(level == 0) {
  ------------------
  |  Branch (74:16): [True: 0, False: 384]
  ------------------
   75|      0|               throw Decoding_Error(decoding_error + "Mismatched parens");
   76|      0|            }
   77|    384|            --level;
   78|    384|         }
   79|       |
   80|    840|         if(c == '/' && level > 0) {
  ------------------
  |  Branch (80:13): [True: 0, False: 840]
  |  Branch (80:25): [True: 0, False: 0]
  ------------------
   81|      0|            accum.second.push_back(c);
   82|    840|         } else {
   83|    840|            if(!accum.second.empty()) {
  ------------------
  |  Branch (83:16): [True: 840, False: 0]
  ------------------
   84|    840|               name.push_back(accum);
   85|    840|            }
   86|    840|            accum = std::make_pair(level, "");
   87|    840|         }
   88|  4.11k|      } else {
   89|  4.11k|         accum.second.push_back(c);
   90|  4.11k|      }
   91|  4.95k|   }
   92|       |
   93|    385|   if(!accum.second.empty()) {
  ------------------
  |  Branch (93:7): [True: 1, False: 384]
  ------------------
   94|      1|      name.push_back(accum);
   95|      1|   }
   96|       |
   97|    385|   if(level != 0) {
  ------------------
  |  Branch (97:7): [True: 0, False: 385]
  ------------------
   98|      0|      throw Decoding_Error(decoding_error + "Missing close paren");
   99|      0|   }
  100|       |
  101|    385|   if(name.empty()) {
  ------------------
  |  Branch (101:7): [True: 0, False: 385]
  ------------------
  102|      0|      throw Decoding_Error(decoding_error + "Empty name");
  103|      0|   }
  104|       |
  105|    385|   m_alg_name = name[0].second;
  106|       |
  107|    385|   bool in_modes = false;
  108|       |
  109|    841|   for(size_t i = 1; i != name.size(); ++i) {
  ------------------
  |  Branch (109:22): [True: 456, False: 385]
  ------------------
  110|    456|      if(name[i].first == 0) {
  ------------------
  |  Branch (110:10): [True: 0, False: 456]
  ------------------
  111|      0|         m_mode_info.push_back(make_arg(name, i));
  112|      0|         in_modes = true;
  113|    456|      } else if(name[i].first == 1 && !in_modes) {
  ------------------
  |  Branch (113:17): [True: 456, False: 0]
  |  Branch (113:39): [True: 456, False: 0]
  ------------------
  114|    456|         m_args.push_back(make_arg(name, i));
  115|    456|      }
  116|    456|   }
  117|    385|}
_ZNK5Botan9SCAN_Name3argEm:
  119|    732|std::string SCAN_Name::arg(size_t i) const {
  120|    732|   if(i >= arg_count()) {
  ------------------
  |  Branch (120:7): [True: 0, False: 732]
  ------------------
  121|      0|      throw Invalid_Argument("SCAN_Name::arg " + std::to_string(i) + " out of range for '" + to_string() + "'");
  122|      0|   }
  123|    732|   return m_args[i];
  124|    732|}
_ZNK5Botan9SCAN_Name3argEmNSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
  126|     36|std::string SCAN_Name::arg(size_t i, std::string_view def_value) const {
  127|     36|   if(i >= arg_count()) {
  ------------------
  |  Branch (127:7): [True: 0, False: 36]
  ------------------
  128|      0|      return std::string(def_value);
  129|      0|   }
  130|     36|   return m_args[i];
  131|     36|}
_ZNK5Botan9SCAN_Name14arg_as_integerEmm:
  133|     36|size_t SCAN_Name::arg_as_integer(size_t i, size_t def_value) const {
  134|     36|   if(i >= arg_count()) {
  ------------------
  |  Branch (134:7): [True: 0, False: 36]
  ------------------
  135|      0|      return def_value;
  136|      0|   }
  137|     36|   return to_u32bit(m_args[i]);
  138|     36|}
scan_name.cpp:_ZN5Botan12_GLOBAL__N_18make_argERKNSt3__16vectorINS1_4pairImNS1_12basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEEEENS7_ISA_EEEEm:
   17|    456|std::string make_arg(const std::vector<std::pair<size_t, std::string>>& name, size_t start) {
   18|    456|   std::string output = name[start].second;
   19|    456|   size_t level = name[start].first;
   20|       |
   21|    456|   size_t paren_depth = 0;
   22|       |
   23|    456|   for(size_t i = start + 1; i != name.size(); ++i) {
  ------------------
  |  Branch (23:30): [True: 72, False: 384]
  ------------------
   24|     72|      if(name[i].first <= name[start].first) {
  ------------------
  |  Branch (24:10): [True: 72, False: 0]
  ------------------
   25|     72|         break;
   26|     72|      }
   27|       |
   28|      0|      if(name[i].first > level) {
  ------------------
  |  Branch (28:10): [True: 0, False: 0]
  ------------------
   29|      0|         output += "(" + name[i].second;
   30|      0|         ++paren_depth;
   31|      0|      } else if(name[i].first < level) {
  ------------------
  |  Branch (31:17): [True: 0, False: 0]
  ------------------
   32|      0|         for(size_t j = name[i].first; j < level; j++) {
  ------------------
  |  Branch (32:40): [True: 0, False: 0]
  ------------------
   33|      0|            output += ")";
   34|      0|            --paren_depth;
   35|      0|         }
   36|      0|         output += "," + name[i].second;
   37|      0|      } else {
   38|      0|         if(output[output.size() - 1] != '(') {
  ------------------
  |  Branch (38:13): [True: 0, False: 0]
  ------------------
   39|      0|            output += ",";
   40|      0|         }
   41|      0|         output += name[i].second;
   42|      0|      }
   43|       |
   44|      0|      level = name[i].first;
   45|      0|   }
   46|       |
   47|    456|   for(size_t i = 0; i != paren_depth; ++i) {
  ------------------
  |  Branch (47:22): [True: 0, False: 456]
  ------------------
   48|      0|      output += ")";
   49|      0|   }
   50|       |
   51|    456|   return output;
   52|    456|}

_ZN5Botan15AlternativeNameC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_S5_S5_:
   27|  13.3k|                                 std::string_view ip) {
   28|  13.3k|   add_attribute("RFC822", email_addr);
   29|  13.3k|   add_attribute("DNS", dns);
   30|  13.3k|   add_attribute("URI", uri);
   31|  13.3k|   add_attribute("IP", ip);
   32|  13.3k|}
_ZN5Botan15AlternativeName13add_attributeENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_:
   37|  67.2k|void AlternativeName::add_attribute(std::string_view type, std::string_view value) {
   38|  67.2k|   if(type.empty() || value.empty()) {
  ------------------
  |  Branch (38:7): [True: 0, False: 67.2k]
  |  Branch (38:23): [True: 57.5k, False: 9.65k]
  ------------------
   39|  57.5k|      return;
   40|  57.5k|   }
   41|       |
   42|  9.65k|   auto range = m_alt_info.equal_range(type);
   43|  95.0k|   for(auto j = range.first; j != range.second; ++j) {
  ------------------
  |  Branch (43:30): [True: 89.5k, False: 5.46k]
  ------------------
   44|  89.5k|      if(j->second == value) {
  ------------------
  |  Branch (44:10): [True: 4.18k, False: 85.3k]
  ------------------
   45|  4.18k|         return;
   46|  4.18k|      }
   47|  89.5k|   }
   48|       |
   49|  5.46k|   m_alt_info.emplace(type, value);
   50|  5.46k|}
_ZN5Botan15AlternativeName13add_othernameERKNS_3OIDENSt3__117basic_string_viewIcNS4_11char_traitsIcEEEENS_9ASN1_TypeE:
   55|  1.68k|void AlternativeName::add_othername(const OID& oid, std::string_view value, ASN1_Type type) {
   56|  1.68k|   if(value.empty()) {
  ------------------
  |  Branch (56:7): [True: 159, False: 1.52k]
  ------------------
   57|    159|      return;
   58|    159|   }
   59|  1.52k|   multimap_insert(m_othernames, oid, ASN1_String(value, type));
   60|  1.52k|}
_ZNK5Botan15AlternativeName8contentsEv:
   65|    230|std::multimap<std::string, std::string> AlternativeName::contents() const {
   66|    230|   std::multimap<std::string, std::string> names;
   67|       |
   68|    847|   for(const auto& name : m_alt_info) {
  ------------------
  |  Branch (68:25): [True: 847, False: 230]
  ------------------
   69|    847|      names.emplace(name.first, name.second);
   70|    847|   }
   71|       |
   72|    626|   for(const auto& othername : m_othernames) {
  ------------------
  |  Branch (72:30): [True: 626, False: 230]
  ------------------
   73|    626|      multimap_insert(names, othername.first.to_formatted_string(), othername.second.value());
   74|    626|   }
   75|       |
   76|    230|   return names;
   77|    230|}
_ZN5Botan15AlternativeName11decode_fromERNS_11BER_DecoderE:
  179|  1.32k|void AlternativeName::decode_from(BER_Decoder& source) {
  180|  1.32k|   BER_Decoder names = source.start_sequence();
  181|       |
  182|       |   // FIXME this is largely a duplication of GeneralName::decode_from
  183|       |
  184|  29.6k|   while(names.more_items()) {
  ------------------
  |  Branch (184:10): [True: 28.3k, False: 1.31k]
  ------------------
  185|  28.3k|      BER_Object obj = names.get_next_object();
  186|       |
  187|  28.3k|      if(obj.is_a(0, ASN1_Class::ContextSpecific)) {
  ------------------
  |  Branch (187:10): [True: 2.35k, False: 25.9k]
  ------------------
  188|  2.35k|         BER_Decoder othername(obj);
  189|       |
  190|  2.35k|         OID oid;
  191|  2.35k|         othername.decode(oid);
  192|  2.35k|         if(othername.more_items()) {
  ------------------
  |  Branch (192:13): [True: 2.18k, False: 165]
  ------------------
  193|  2.18k|            BER_Object othername_value_outer = othername.get_next_object();
  194|  2.18k|            othername.verify_end();
  195|       |
  196|  2.18k|            if(othername_value_outer.is_a(0, ASN1_Class::ExplicitContextSpecific) == false) {
  ------------------
  |  Branch (196:16): [True: 12, False: 2.17k]
  ------------------
  197|     12|               throw Decoding_Error("Invalid tags on otherName value");
  198|     12|            }
  199|       |
  200|  2.17k|            BER_Decoder othername_value_inner(othername_value_outer);
  201|       |
  202|  2.17k|            BER_Object value = othername_value_inner.get_next_object();
  203|  2.17k|            othername_value_inner.verify_end();
  204|       |
  205|  2.17k|            if(ASN1_String::is_string_type(value.type()) && value.get_class() == ASN1_Class::Universal) {
  ------------------
  |  Branch (205:16): [True: 1.87k, False: 300]
  |  Branch (205:61): [True: 1.68k, False: 191]
  ------------------
  206|  1.68k|               add_othername(oid, ASN1::to_string(value), value.type());
  207|  1.68k|            }
  208|  2.17k|         }
  209|  2.35k|      }
  210|  28.2k|      if(obj.is_a(1, ASN1_Class::ContextSpecific)) {
  ------------------
  |  Branch (210:10): [True: 5.59k, False: 22.6k]
  ------------------
  211|  5.59k|         add_attribute("RFC822", ASN1::to_string(obj));
  212|  22.6k|      } else if(obj.is_a(2, ASN1_Class::ContextSpecific)) {
  ------------------
  |  Branch (212:17): [True: 2.31k, False: 20.3k]
  ------------------
  213|  2.31k|         add_attribute("DNS", ASN1::to_string(obj));
  214|  20.3k|      } else if(obj.is_a(6, ASN1_Class::ContextSpecific)) {
  ------------------
  |  Branch (214:17): [True: 1.61k, False: 18.7k]
  ------------------
  215|  1.61k|         add_attribute("URI", ASN1::to_string(obj));
  216|  18.7k|      } else if(obj.is_a(4, ASN1_Class::ContextSpecific | ASN1_Class::Constructed)) {
  ------------------
  |  Branch (216:17): [True: 1.45k, False: 17.3k]
  ------------------
  217|  1.45k|         BER_Decoder dec(obj);
  218|  1.45k|         X509_DN dn;
  219|  1.45k|         std::stringstream ss;
  220|       |
  221|  1.45k|         dec.decode(dn);
  222|  1.45k|         ss << dn;
  223|       |
  224|  1.45k|         add_attribute("DN", ss.str());
  225|  17.3k|      } else if(obj.is_a(7, ASN1_Class::ContextSpecific)) {
  ------------------
  |  Branch (225:17): [True: 3.69k, False: 13.6k]
  ------------------
  226|  3.69k|         if(obj.length() == 4) {
  ------------------
  |  Branch (226:13): [True: 2.84k, False: 852]
  ------------------
  227|  2.84k|            const uint32_t ip = load_be<uint32_t>(obj.bits(), 0);
  228|  2.84k|            add_attribute("IP", ipv4_to_string(ip));
  229|  2.84k|         }
  230|  3.69k|      }
  231|  28.2k|   }
  232|  1.32k|}

_ZN5Botan11GeneralName11decode_fromERNS_11BER_DecoderE:
   36|  1.33k|void GeneralName::decode_from(BER_Decoder& ber) {
   37|  1.33k|   BER_Object obj = ber.get_next_object();
   38|       |
   39|  1.33k|   if(obj.is_a(1, ASN1_Class::ContextSpecific)) {
  ------------------
  |  Branch (39:7): [True: 186, False: 1.14k]
  ------------------
   40|    186|      m_type = "RFC822";
   41|    186|      m_name = ASN1::to_string(obj);
   42|  1.14k|   } else if(obj.is_a(2, ASN1_Class::ContextSpecific)) {
  ------------------
  |  Branch (42:14): [True: 180, False: 966]
  ------------------
   43|    180|      m_type = "DNS";
   44|    180|      m_name = ASN1::to_string(obj);
   45|    966|   } else if(obj.is_a(6, ASN1_Class::ContextSpecific)) {
  ------------------
  |  Branch (45:14): [True: 49, False: 917]
  ------------------
   46|     49|      m_type = "URI";
   47|     49|      m_name = ASN1::to_string(obj);
   48|    917|   } else if(obj.is_a(4, ASN1_Class::ContextSpecific | ASN1_Class::Constructed)) {
  ------------------
  |  Branch (48:14): [True: 702, False: 215]
  ------------------
   49|    702|      m_type = "DN";
   50|    702|      X509_DN dn;
   51|    702|      BER_Decoder dec(obj);
   52|    702|      std::stringstream ss;
   53|       |
   54|    702|      dn.decode_from(dec);
   55|    702|      ss << dn;
   56|       |
   57|    702|      m_name = ss.str();
   58|    702|   } else if(obj.is_a(7, ASN1_Class::ContextSpecific)) {
  ------------------
  |  Branch (58:14): [True: 58, False: 157]
  ------------------
   59|     58|      if(obj.length() == 8) {
  ------------------
  |  Branch (59:10): [True: 47, False: 11]
  ------------------
   60|     47|         m_type = "IP";
   61|     47|         m_name =
   62|     47|            ipv4_to_string(load_be<uint32_t>(obj.bits(), 0)) + "/" + ipv4_to_string(load_be<uint32_t>(obj.bits(), 1));
   63|     47|      } else if(obj.length() == 32) {
  ------------------
  |  Branch (63:17): [True: 1, False: 10]
  ------------------
   64|      1|         throw Decoding_Error("Unsupported IPv6 name constraint");
   65|     10|      } else {
   66|     10|         throw Decoding_Error("Invalid IP name constraint size " + std::to_string(obj.length()));
   67|     10|      }
   68|    157|   } else {
   69|    157|      throw Decoding_Error("Found unknown GeneralName type");
   70|    157|   }
   71|  1.33k|}
_ZN5Botan14GeneralSubtree11decode_fromERNS_11BER_DecoderE:
  204|  1.53k|void GeneralSubtree::decode_from(BER_Decoder& ber) {
  205|  1.53k|   ber.start_sequence()
  206|  1.53k|      .decode(m_base)
  207|  1.53k|      .decode_optional(m_minimum, ASN1_Type(0), ASN1_Class::ContextSpecific, size_t(0))
  208|  1.53k|      .end_cons();
  209|       |
  210|  1.53k|   if(m_minimum != 0) {
  ------------------
  |  Branch (210:7): [True: 36, False: 1.49k]
  ------------------
  211|     36|      throw Decoding_Error("GeneralSubtree minimum must be 0");
  212|     36|   }
  213|       |
  214|  1.49k|   m_maximum = std::numeric_limits<std::size_t>::max();
  215|  1.49k|}

_ZN5Botan7X509_DN13add_attributeERKNS_3OIDERKNS_11ASN1_StringE:
  100|  13.9k|void X509_DN::add_attribute(const OID& oid, const ASN1_String& str) {
  101|  13.9k|   if(str.empty()) {
  ------------------
  |  Branch (101:7): [True: 294, False: 13.6k]
  ------------------
  102|    294|      return;
  103|    294|   }
  104|       |
  105|  13.6k|   m_rdn.push_back(std::make_pair(oid, str));
  106|  13.6k|   m_dn_bits.clear();
  107|  13.6k|}
_ZNK5Botan7X509_DN14get_attributesEv:
  112|  7.09k|std::multimap<OID, std::string> X509_DN::get_attributes() const {
  113|  7.09k|   std::multimap<OID, std::string> retval;
  114|       |
  115|  7.09k|   for(auto& i : m_rdn) {
  ------------------
  |  Branch (115:16): [True: 5.91k, False: 7.09k]
  ------------------
  116|  5.91k|      multimap_insert(retval, i.first, i.second.value());
  117|  5.91k|   }
  118|  7.09k|   return retval;
  119|  7.09k|}
_ZN5BotaneqERKNS_7X509_DNES2_:
  220|  3.54k|bool operator==(const X509_DN& dn1, const X509_DN& dn2) {
  221|  3.54k|   auto attr1 = dn1.get_attributes();
  222|  3.54k|   auto attr2 = dn2.get_attributes();
  223|       |
  224|  3.54k|   if(attr1.size() != attr2.size()) {
  ------------------
  |  Branch (224:7): [True: 256, False: 3.29k]
  ------------------
  225|    256|      return false;
  226|    256|   }
  227|       |
  228|  3.29k|   auto p1 = attr1.begin();
  229|  3.29k|   auto p2 = attr2.begin();
  230|       |
  231|  5.20k|   while(true) {
  ------------------
  |  Branch (231:10): [Folded - Ignored]
  ------------------
  232|  5.20k|      if(p1 == attr1.end() && p2 == attr2.end()) {
  ------------------
  |  Branch (232:10): [True: 3.04k, False: 2.16k]
  |  Branch (232:10): [True: 3.04k, False: 2.16k]
  |  Branch (232:31): [True: 3.04k, False: 0]
  ------------------
  233|  3.04k|         break;
  234|  3.04k|      }
  235|  2.16k|      if(p1 == attr1.end()) {
  ------------------
  |  Branch (235:10): [True: 0, False: 2.16k]
  ------------------
  236|      0|         return false;
  237|      0|      }
  238|  2.16k|      if(p2 == attr2.end()) {
  ------------------
  |  Branch (238:10): [True: 0, False: 2.16k]
  ------------------
  239|      0|         return false;
  240|      0|      }
  241|  2.16k|      if(p1->first != p2->first) {
  ------------------
  |  Branch (241:10): [True: 207, False: 1.95k]
  ------------------
  242|    207|         return false;
  243|    207|      }
  244|  1.95k|      if(!x500_name_cmp(p1->second, p2->second)) {
  ------------------
  |  Branch (244:10): [True: 40, False: 1.91k]
  ------------------
  245|     40|         return false;
  246|     40|      }
  247|  1.91k|      ++p1;
  248|  1.91k|      ++p2;
  249|  1.91k|   }
  250|  3.04k|   return true;
  251|  3.29k|}
_ZN5Botan7X509_DN11decode_fromERNS_11BER_DecoderE:
  347|  11.8k|void X509_DN::decode_from(BER_Decoder& source) {
  348|  11.8k|   std::vector<uint8_t> bits;
  349|       |
  350|  11.8k|   source.start_sequence().raw_bytes(bits).end_cons();
  351|       |
  352|  11.8k|   BER_Decoder sequence(bits);
  353|       |
  354|  11.8k|   m_rdn.clear();
  355|       |
  356|  26.6k|   while(sequence.more_items()) {
  ------------------
  |  Branch (356:10): [True: 14.7k, False: 11.8k]
  ------------------
  357|  14.7k|      BER_Decoder rdn = sequence.start_set();
  358|       |
  359|  29.2k|      while(rdn.more_items()) {
  ------------------
  |  Branch (359:13): [True: 14.5k, False: 14.7k]
  ------------------
  360|  14.5k|         OID oid;
  361|  14.5k|         ASN1_String str;
  362|       |
  363|  14.5k|         rdn.start_sequence()
  364|  14.5k|            .decode(oid)
  365|  14.5k|            .decode(str)  // TODO support Any
  366|  14.5k|            .end_cons();
  367|       |
  368|  14.5k|         add_attribute(oid, str);
  369|  14.5k|      }
  370|  14.7k|   }
  371|       |
  372|       |   // Have to assign last as add_attribute zaps m_dn_bits
  373|  11.8k|   m_dn_bits = bits;
  374|  11.8k|}
_ZN5BotanlsERNSt3__113basic_ostreamIcNS0_11char_traitsIcEEEERKNS_7X509_DNE:
  408|  1.48k|std::ostream& operator<<(std::ostream& out, const X509_DN& dn) {
  409|  1.48k|   auto info = dn.dn_info();
  410|       |
  411|  3.95k|   for(size_t i = 0; i != info.size(); ++i) {
  ------------------
  |  Branch (411:22): [True: 2.46k, False: 1.48k]
  ------------------
  412|  2.46k|      out << to_short_form(info[i].first) << "=\"";
  413|  8.72k|      for(char c : info[i].second.value()) {
  ------------------
  |  Branch (413:18): [True: 8.72k, False: 2.46k]
  ------------------
  414|  8.72k|         if(c == '\\' || c == '\"') {
  ------------------
  |  Branch (414:13): [True: 256, False: 8.47k]
  |  Branch (414:26): [True: 323, False: 8.15k]
  ------------------
  415|    579|            out << "\\";
  416|    579|         }
  417|  8.72k|         out << c;
  418|  8.72k|      }
  419|  2.46k|      out << "\"";
  420|       |
  421|  2.46k|      if(i + 1 < info.size()) {
  ------------------
  |  Branch (421:10): [True: 1.12k, False: 1.34k]
  ------------------
  422|  1.12k|         out << ",";
  423|  1.12k|      }
  424|  2.46k|   }
  425|  1.48k|   return out;
  426|  1.48k|}
x509_dn.cpp:_ZN5Botan12_GLOBAL__N_113x500_name_cmpENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_:
   36|  1.95k|bool x500_name_cmp(std::string_view name1, std::string_view name2) {
   37|  1.95k|   auto p1 = name1.begin();
   38|  1.95k|   auto p2 = name2.begin();
   39|       |
   40|  2.06k|   while((p1 != name1.end()) && is_space(*p1)) {
  ------------------
  |  Branch (40:10): [True: 2.06k, False: 1]
  |  Branch (40:33): [True: 113, False: 1.95k]
  ------------------
   41|    113|      ++p1;
   42|    113|   }
   43|  2.17k|   while((p2 != name2.end()) && is_space(*p2)) {
  ------------------
  |  Branch (43:10): [True: 2.17k, False: 1]
  |  Branch (43:33): [True: 225, False: 1.95k]
  ------------------
   44|    225|      ++p2;
   45|    225|   }
   46|       |
   47|  26.3k|   while(p1 != name1.end() && p2 != name2.end()) {
  ------------------
  |  Branch (47:10): [True: 24.4k, False: 1.91k]
  |  Branch (47:31): [True: 24.4k, False: 9]
  ------------------
   48|  24.4k|      if(is_space(*p1)) {
  ------------------
  |  Branch (48:10): [True: 864, False: 23.5k]
  ------------------
   49|    864|         if(!is_space(*p2)) {
  ------------------
  |  Branch (49:13): [True: 1, False: 863]
  ------------------
   50|      1|            return false;
   51|      1|         }
   52|       |
   53|  2.05k|         while((p1 != name1.end()) && is_space(*p1)) {
  ------------------
  |  Branch (53:16): [True: 2.05k, False: 4]
  |  Branch (53:39): [True: 1.19k, False: 859]
  ------------------
   54|  1.19k|            ++p1;
   55|  1.19k|         }
   56|  2.08k|         while((p2 != name2.end()) && is_space(*p2)) {
  ------------------
  |  Branch (56:16): [True: 2.08k, False: 3]
  |  Branch (56:39): [True: 1.22k, False: 860]
  ------------------
   57|  1.22k|            ++p2;
   58|  1.22k|         }
   59|       |
   60|    863|         if(p1 == name1.end() && p2 == name2.end()) {
  ------------------
  |  Branch (60:13): [True: 4, False: 859]
  |  Branch (60:34): [True: 2, False: 2]
  ------------------
   61|      2|            return true;
   62|      2|         }
   63|    861|         if(p1 == name1.end() || p2 == name2.end()) {
  ------------------
  |  Branch (63:13): [True: 2, False: 859]
  |  Branch (63:34): [True: 1, False: 858]
  ------------------
   64|      3|            return false;
   65|      3|         }
   66|    861|      }
   67|       |
   68|  24.4k|      if(!caseless_cmp(*p1, *p2)) {
  ------------------
  |  Branch (68:10): [True: 22, False: 24.3k]
  ------------------
   69|     22|         return false;
   70|     22|      }
   71|  24.3k|      ++p1;
   72|  24.3k|      ++p2;
   73|  24.3k|   }
   74|       |
   75|  2.01k|   while((p1 != name1.end()) && is_space(*p1)) {
  ------------------
  |  Branch (75:10): [True: 93, False: 1.91k]
  |  Branch (75:33): [True: 86, False: 7]
  ------------------
   76|     86|      ++p1;
   77|     86|   }
   78|  2.00k|   while((p2 != name2.end()) && is_space(*p2)) {
  ------------------
  |  Branch (78:10): [True: 88, False: 1.91k]
  |  Branch (78:33): [True: 81, False: 7]
  ------------------
   79|     81|      ++p2;
   80|     81|   }
   81|       |
   82|  1.92k|   if((p1 != name1.end()) || (p2 != name2.end())) {
  ------------------
  |  Branch (82:7): [True: 7, False: 1.91k]
  |  Branch (82:30): [True: 7, False: 1.91k]
  ------------------
   83|     14|      return false;
   84|     14|   }
   85|  1.91k|   return true;
   86|  1.92k|}
x509_dn.cpp:_ZN5Botan12_GLOBAL__N_112_GLOBAL__N_18is_spaceEc:
   27|  33.8k|bool is_space(char c) {
   28|  33.8k|   return std::isspace(static_cast<unsigned char>(c));
   29|  33.8k|}
x509_dn.cpp:_ZN5Botan12_GLOBAL__N_112_GLOBAL__N_112caseless_cmpEcc:
   23|  24.4k|bool caseless_cmp(char a, char b) {
   24|  24.4k|   return (std::tolower(static_cast<unsigned char>(a)) == std::tolower(static_cast<unsigned char>(b)));
   25|  24.4k|}
x509_dn.cpp:_ZN5Botan12_GLOBAL__N_113to_short_formERKNS_3OIDE:
  378|  2.46k|std::string to_short_form(const OID& oid) {
  379|  2.46k|   std::string long_id = oid.to_formatted_string();
  380|       |
  381|  2.46k|   if(long_id == "X520.CommonName") {
  ------------------
  |  Branch (381:7): [True: 108, False: 2.35k]
  ------------------
  382|    108|      return "CN";
  383|    108|   }
  384|       |
  385|  2.35k|   if(long_id == "X520.Country") {
  ------------------
  |  Branch (385:7): [True: 168, False: 2.19k]
  ------------------
  386|    168|      return "C";
  387|    168|   }
  388|       |
  389|  2.19k|   if(long_id == "X520.Organization") {
  ------------------
  |  Branch (389:7): [True: 99, False: 2.09k]
  ------------------
  390|     99|      return "O";
  391|     99|   }
  392|       |
  393|  2.09k|   if(long_id == "X520.OrganizationalUnit") {
  ------------------
  |  Branch (393:7): [True: 173, False: 1.91k]
  ------------------
  394|    173|      return "OU";
  395|    173|   }
  396|       |
  397|  1.91k|   return long_id;
  398|  2.09k|}

_ZN5Botan10Extensions15create_extn_objERKNS_3OIDEbRKNSt3__16vectorIhNS4_9allocatorIhEEEE:
   93|  12.7k|                                                                   const std::vector<uint8_t>& body) {
   94|  12.7k|   const std::string oid_str = oid.to_string();
   95|       |
   96|  12.7k|   auto extn = extension_from_oid(oid);
   97|       |
   98|  12.7k|   if(!extn) {
  ------------------
  |  Branch (98:7): [True: 5.40k, False: 7.35k]
  ------------------
   99|       |      // some other unknown extension type
  100|  5.40k|      extn = std::make_unique<Cert_Extension::Unknown_Extension>(oid, critical);
  101|  5.40k|   }
  102|       |
  103|  12.7k|   try {
  104|  12.7k|      extn->decode_inner(body);
  105|  12.7k|   } catch(Decoding_Error&) {
  106|  5.96k|      extn = std::make_unique<Cert_Extension::Unknown_Extension>(oid, critical);
  107|  5.96k|      extn->decode_inner(body);
  108|  5.96k|   }
  109|  12.7k|   return extn;
  110|  12.7k|}
_ZNK5Botan10Extensions20get_extension_objectERKNS_3OIDE:
  190|  39.0k|const Certificate_Extension* Extensions::get_extension_object(const OID& oid) const {
  191|  39.0k|   auto extn = m_extension_info.find(oid);
  192|  39.0k|   if(extn == m_extension_info.end()) {
  ------------------
  |  Branch (192:7): [True: 38.4k, False: 574]
  ------------------
  193|  38.4k|      return nullptr;
  194|  38.4k|   }
  195|       |
  196|    574|   return &extn->second.obj();
  197|  39.0k|}
_ZN5Botan10Extensions11decode_fromERNS_11BER_DecoderE:
  247|  1.49k|void Extensions::decode_from(BER_Decoder& from_source) {
  248|  1.49k|   m_extension_oids.clear();
  249|  1.49k|   m_extension_info.clear();
  250|       |
  251|  1.49k|   BER_Decoder sequence = from_source.start_sequence();
  252|       |
  253|  15.1k|   while(sequence.more_items()) {
  ------------------
  |  Branch (253:10): [True: 13.6k, False: 1.49k]
  ------------------
  254|  13.6k|      OID oid;
  255|  13.6k|      bool critical;
  256|  13.6k|      std::vector<uint8_t> bits;
  257|       |
  258|  13.6k|      sequence.start_sequence()
  259|  13.6k|         .decode(oid)
  260|  13.6k|         .decode_optional(critical, ASN1_Type::Boolean, ASN1_Class::Universal, false)
  261|  13.6k|         .decode(bits, ASN1_Type::OctetString)
  262|  13.6k|         .end_cons();
  263|       |
  264|  13.6k|      auto obj = create_extn_obj(oid, critical, bits);
  265|  13.6k|      Extensions_Info info(critical, bits, std::move(obj));
  266|       |
  267|  13.6k|      m_extension_oids.push_back(oid);
  268|  13.6k|      m_extension_info.emplace(oid, info);
  269|  13.6k|   }
  270|  1.49k|   sequence.verify_end();
  271|  1.49k|}
_ZNK5Botan14Cert_Extension17Basic_Constraints14get_path_limitEv:
  278|      3|size_t Basic_Constraints::get_path_limit() const {
  279|      3|   if(!m_is_ca) {
  ------------------
  |  Branch (279:7): [True: 0, False: 3]
  ------------------
  280|      0|      throw Invalid_State("Basic_Constraints::get_path_limit: Not a CA");
  281|      0|   }
  282|      3|   return m_path_limit;
  283|      3|}
_ZN5Botan14Cert_Extension17Basic_Constraints12decode_innerERKNSt3__16vectorIhNS2_9allocatorIhEEEE:
  300|    749|void Basic_Constraints::decode_inner(const std::vector<uint8_t>& in) {
  301|    749|   BER_Decoder(in)
  302|    749|      .start_sequence()
  303|    749|      .decode_optional(m_is_ca, ASN1_Type::Boolean, ASN1_Class::Universal, false)
  304|    749|      .decode_optional(m_path_limit, ASN1_Type::Integer, ASN1_Class::Universal, NO_CERT_PATH_LIMIT)
  305|    749|      .end_cons();
  306|       |
  307|    749|   if(m_is_ca == false) {
  ------------------
  |  Branch (307:7): [True: 109, False: 640]
  ------------------
  308|    109|      m_path_limit = 0;
  309|    109|   }
  310|    749|}
_ZN5Botan14Cert_Extension9Key_Usage12decode_innerERKNSt3__16vectorIhNS2_9allocatorIhEEEE:
  338|    444|void Key_Usage::decode_inner(const std::vector<uint8_t>& in) {
  339|    444|   BER_Decoder ber(in);
  340|       |
  341|    444|   BER_Object obj = ber.get_next_object();
  342|       |
  343|    444|   obj.assert_is_a(ASN1_Type::BitString, ASN1_Class::Universal, "usage constraint");
  344|       |
  345|    444|   if(obj.length() != 2 && obj.length() != 3) {
  ------------------
  |  Branch (345:7): [True: 29, False: 415]
  |  Branch (345:28): [True: 17, False: 12]
  ------------------
  346|     17|      throw BER_Decoding_Error("Bad size for BITSTRING in usage constraint");
  347|     17|   }
  348|       |
  349|    427|   uint16_t usage = 0;
  350|       |
  351|    427|   const uint8_t* bits = obj.bits();
  352|       |
  353|    427|   if(bits[0] >= 8) {
  ------------------
  |  Branch (353:7): [True: 58, False: 369]
  ------------------
  354|     58|      throw BER_Decoding_Error("Invalid unused bits in usage constraint");
  355|     58|   }
  356|       |
  357|    369|   const uint8_t mask = static_cast<uint8_t>(0xFF << bits[0]);
  358|       |
  359|    369|   if(obj.length() == 2) {
  ------------------
  |  Branch (359:7): [True: 45, False: 324]
  ------------------
  360|     45|      usage = make_uint16(bits[1] & mask, 0);
  361|    324|   } else if(obj.length() == 3) {
  ------------------
  |  Branch (361:14): [True: 10, False: 314]
  ------------------
  362|     10|      usage = make_uint16(bits[1], bits[2] & mask);
  363|     10|   }
  364|       |
  365|    369|   m_constraints = Key_Constraints(usage);
  366|    369|}
_ZN5Botan14Cert_Extension14Subject_Key_ID12decode_innerERKNSt3__16vectorIhNS2_9allocatorIhEEEE:
  380|    417|void Subject_Key_ID::decode_inner(const std::vector<uint8_t>& in) {
  381|    417|   BER_Decoder(in).decode(m_key_id, ASN1_Type::OctetString).verify_end();
  382|    417|}
_ZN5Botan14Cert_Extension16Authority_Key_ID12decode_innerERKNSt3__16vectorIhNS2_9allocatorIhEEEE:
  417|    395|void Authority_Key_ID::decode_inner(const std::vector<uint8_t>& in) {
  418|    395|   BER_Decoder(in).start_sequence().decode_optional_string(m_key_id, ASN1_Type::OctetString, 0);
  419|    395|}
_ZN5Botan14Cert_Extension24Subject_Alternative_Name12decode_innerERKNSt3__16vectorIhNS2_9allocatorIhEEEE:
  442|    590|void Subject_Alternative_Name::decode_inner(const std::vector<uint8_t>& in) {
  443|    590|   BER_Decoder(in).decode(m_alt_name);
  444|    590|}
_ZN5Botan14Cert_Extension23Issuer_Alternative_Name12decode_innerERKNSt3__16vectorIhNS2_9allocatorIhEEEE:
  449|    475|void Issuer_Alternative_Name::decode_inner(const std::vector<uint8_t>& in) {
  450|    475|   BER_Decoder(in).decode(m_alt_name);
  451|    475|}
_ZN5Botan14Cert_Extension18Extended_Key_Usage12decode_innerERKNSt3__16vectorIhNS2_9allocatorIhEEEE:
  465|    218|void Extended_Key_Usage::decode_inner(const std::vector<uint8_t>& in) {
  466|    218|   BER_Decoder(in).decode_list(m_oids);
  467|    218|}
_ZN5Botan14Cert_Extension16Name_Constraints12decode_innerERKNSt3__16vectorIhNS2_9allocatorIhEEEE:
  479|  1.83k|void Name_Constraints::decode_inner(const std::vector<uint8_t>& in) {
  480|  1.83k|   std::vector<GeneralSubtree> permit, exclude;
  481|  1.83k|   BER_Decoder ber(in);
  482|  1.83k|   BER_Decoder ext = ber.start_sequence();
  483|  1.83k|   BER_Object per = ext.get_next_object();
  484|       |
  485|  1.83k|   ext.push_back(per);
  486|  1.83k|   if(per.is_a(0, ASN1_Class::Constructed | ASN1_Class::ContextSpecific)) {
  ------------------
  |  Branch (486:7): [True: 381, False: 1.45k]
  ------------------
  487|    381|      ext.decode_list(permit, ASN1_Type(0), ASN1_Class::Constructed | ASN1_Class::ContextSpecific);
  488|    381|      if(permit.empty()) {
  ------------------
  |  Branch (488:10): [True: 2, False: 379]
  ------------------
  489|      2|         throw Encoding_Error("Empty Name Contraint list");
  490|      2|      }
  491|    381|   }
  492|       |
  493|  1.83k|   BER_Object exc = ext.get_next_object();
  494|  1.83k|   ext.push_back(exc);
  495|  1.83k|   if(per.is_a(1, ASN1_Class::Constructed | ASN1_Class::ContextSpecific)) {
  ------------------
  |  Branch (495:7): [True: 852, False: 983]
  ------------------
  496|    852|      ext.decode_list(exclude, ASN1_Type(1), ASN1_Class::Constructed | ASN1_Class::ContextSpecific);
  497|    852|      if(exclude.empty()) {
  ------------------
  |  Branch (497:10): [True: 2, False: 850]
  ------------------
  498|      2|         throw Encoding_Error("Empty Name Contraint list");
  499|      2|      }
  500|    852|   }
  501|       |
  502|  1.83k|   ext.end_cons();
  503|       |
  504|  1.83k|   if(permit.empty() && exclude.empty()) {
  ------------------
  |  Branch (504:7): [True: 70, False: 1.76k]
  |  Branch (504:25): [True: 5, False: 65]
  ------------------
  505|      5|      throw Encoding_Error("Empty Name Contraint extension");
  506|      5|   }
  507|       |
  508|  1.82k|   m_name_constraints = NameConstraints(std::move(permit), std::move(exclude));
  509|  1.82k|}
_ZN5Botan14Cert_Extension20Certificate_Policies12decode_innerERKNSt3__16vectorIhNS2_9allocatorIhEEEE:
  608|    375|void Certificate_Policies::decode_inner(const std::vector<uint8_t>& in) {
  609|    375|   std::vector<Policy_Information> policies;
  610|       |
  611|    375|   BER_Decoder(in).decode_list(policies);
  612|    375|   m_oids.clear();
  613|    375|   for(const auto& policy : policies) {
  ------------------
  |  Branch (613:27): [True: 111, False: 375]
  ------------------
  614|    111|      m_oids.push_back(policy.oid());
  615|    111|   }
  616|    375|}
_ZN5Botan14Cert_Extension28Authority_Information_Access12decode_innerERKNSt3__16vectorIhNS2_9allocatorIhEEEE:
  656|    363|void Authority_Information_Access::decode_inner(const std::vector<uint8_t>& in) {
  657|    363|   BER_Decoder ber = BER_Decoder(in).start_sequence();
  658|       |
  659|    924|   while(ber.more_items()) {
  ------------------
  |  Branch (659:10): [True: 561, False: 363]
  ------------------
  660|    561|      OID oid;
  661|       |
  662|    561|      BER_Decoder info = ber.start_sequence();
  663|       |
  664|    561|      info.decode(oid);
  665|       |
  666|    561|      if(oid == OID::from_string("PKIX.OCSP")) {
  ------------------
  |  Branch (666:10): [True: 49, False: 512]
  ------------------
  667|     49|         BER_Object name = info.get_next_object();
  668|       |
  669|     49|         if(name.is_a(6, ASN1_Class::ContextSpecific)) {
  ------------------
  |  Branch (669:13): [True: 24, False: 25]
  ------------------
  670|     24|            m_ocsp_responder = ASN1::to_string(name);
  671|     24|         }
  672|     49|      }
  673|    561|      if(oid == OID::from_string("PKIX.CertificateAuthorityIssuers")) {
  ------------------
  |  Branch (673:10): [True: 76, False: 485]
  ------------------
  674|     76|         BER_Object name = info.get_next_object();
  675|       |
  676|     76|         if(name.is_a(6, ASN1_Class::ContextSpecific)) {
  ------------------
  |  Branch (676:13): [True: 47, False: 29]
  ------------------
  677|     47|            m_ca_issuers.push_back(ASN1::to_string(name));
  678|     47|         }
  679|     76|      }
  680|    561|   }
  681|    363|}
_ZN5Botan14Cert_Extension10CRL_Number12decode_innerERKNSt3__16vectorIhNS2_9allocatorIhEEEE:
  715|    413|void CRL_Number::decode_inner(const std::vector<uint8_t>& in) {
  716|    413|   BER_Decoder(in).decode(m_crl_number);
  717|    413|   m_has_value = true;
  718|    413|}
_ZN5Botan14Cert_Extension14CRL_ReasonCode12decode_innerERKNSt3__16vectorIhNS2_9allocatorIhEEEE:
  732|    210|void CRL_ReasonCode::decode_inner(const std::vector<uint8_t>& in) {
  733|    210|   size_t reason_code = 0;
  734|    210|   BER_Decoder(in).decode(reason_code, ASN1_Type::Enumerated, ASN1_Class::Universal);
  735|    210|   m_reason = static_cast<CRL_Code>(reason_code);
  736|    210|}
_ZN5Botan14Cert_Extension23CRL_Distribution_Points12decode_innerERKNSt3__16vectorIhNS2_9allocatorIhEEEE:
  744|    508|void CRL_Distribution_Points::decode_inner(const std::vector<uint8_t>& buf) {
  745|    508|   BER_Decoder(buf).decode_list(m_distribution_points).verify_end();
  746|       |
  747|    508|   std::stringstream ss;
  748|       |
  749|    508|   for(const auto& distribution_point : m_distribution_points) {
  ------------------
  |  Branch (749:39): [True: 230, False: 508]
  ------------------
  750|    230|      auto contents = distribution_point.point().contents();
  751|       |
  752|  1.47k|      for(const auto& pair : contents) {
  ------------------
  |  Branch (752:28): [True: 1.47k, False: 230]
  ------------------
  753|  1.47k|         ss << pair.first << ": " << pair.second << " ";
  754|  1.47k|      }
  755|    230|   }
  756|       |
  757|    508|   m_crl_distribution_urls.push_back(ss.str());
  758|    508|}
_ZN5Botan14Cert_Extension23CRL_Distribution_Points18Distribution_Point11decode_fromERNS_11BER_DecoderE:
  778|    890|void CRL_Distribution_Points::Distribution_Point::decode_from(BER_Decoder& ber) {
  779|    890|   ber.start_sequence()
  780|    890|      .start_context_specific(0)
  781|    890|      .decode_optional_implicit(m_point,
  782|    890|                                ASN1_Type(0),
  783|    890|                                ASN1_Class::ContextSpecific | ASN1_Class::Constructed,
  784|    890|                                ASN1_Type::Sequence,
  785|    890|                                ASN1_Class::Constructed)
  786|    890|      .end_cons()
  787|    890|      .end_cons();
  788|    890|}
_ZN5Botan14Cert_Extension30CRL_Issuing_Distribution_Point12decode_innerERKNSt3__16vectorIhNS2_9allocatorIhEEEE:
  794|    361|void CRL_Issuing_Distribution_Point::decode_inner(const std::vector<uint8_t>& buf) {
  795|    361|   BER_Decoder(buf).decode(m_distribution_point).verify_end();
  796|    361|}
_ZN5Botan14Cert_Extension17Unknown_Extension12decode_innerERKNSt3__16vectorIhNS2_9allocatorIhEEEE:
  806|  11.3k|void Unknown_Extension::decode_inner(const std::vector<uint8_t>& bytes) {
  807|       |   // Just treat as an opaque blob at this level
  808|  11.3k|   m_bytes = bytes;
  809|  11.3k|}
x509_ext.cpp:_ZN5Botan12_GLOBAL__N_118extension_from_oidERKNS_3OIDE:
   26|  12.7k|std::unique_ptr<Certificate_Extension> extension_from_oid(const OID& oid) {
   27|  12.7k|   if(oid == Cert_Extension::Subject_Key_ID::static_oid()) {
  ------------------
  |  Branch (27:7): [True: 417, False: 12.3k]
  ------------------
   28|    417|      return std::make_unique<Cert_Extension::Subject_Key_ID>();
   29|    417|   }
   30|       |
   31|  12.3k|   if(oid == Cert_Extension::Key_Usage::static_oid()) {
  ------------------
  |  Branch (31:7): [True: 444, False: 11.8k]
  ------------------
   32|    444|      return std::make_unique<Cert_Extension::Key_Usage>();
   33|    444|   }
   34|       |
   35|  11.8k|   if(oid == Cert_Extension::Subject_Alternative_Name::static_oid()) {
  ------------------
  |  Branch (35:7): [True: 590, False: 11.3k]
  ------------------
   36|    590|      return std::make_unique<Cert_Extension::Subject_Alternative_Name>();
   37|    590|   }
   38|       |
   39|  11.3k|   if(oid == Cert_Extension::Issuer_Alternative_Name::static_oid()) {
  ------------------
  |  Branch (39:7): [True: 475, False: 10.8k]
  ------------------
   40|    475|      return std::make_unique<Cert_Extension::Issuer_Alternative_Name>();
   41|    475|   }
   42|       |
   43|  10.8k|   if(oid == Cert_Extension::Basic_Constraints::static_oid()) {
  ------------------
  |  Branch (43:7): [True: 749, False: 10.0k]
  ------------------
   44|    749|      return std::make_unique<Cert_Extension::Basic_Constraints>();
   45|    749|   }
   46|       |
   47|  10.0k|   if(oid == Cert_Extension::CRL_Number::static_oid()) {
  ------------------
  |  Branch (47:7): [True: 413, False: 9.67k]
  ------------------
   48|    413|      return std::make_unique<Cert_Extension::CRL_Number>();
   49|    413|   }
   50|       |
   51|  9.67k|   if(oid == Cert_Extension::CRL_ReasonCode::static_oid()) {
  ------------------
  |  Branch (51:7): [True: 210, False: 9.46k]
  ------------------
   52|    210|      return std::make_unique<Cert_Extension::CRL_ReasonCode>();
   53|    210|   }
   54|       |
   55|  9.46k|   if(oid == Cert_Extension::Authority_Key_ID::static_oid()) {
  ------------------
  |  Branch (55:7): [True: 395, False: 9.06k]
  ------------------
   56|    395|      return std::make_unique<Cert_Extension::Authority_Key_ID>();
   57|    395|   }
   58|       |
   59|  9.06k|   if(oid == Cert_Extension::Name_Constraints::static_oid()) {
  ------------------
  |  Branch (59:7): [True: 1.83k, False: 7.22k]
  ------------------
   60|  1.83k|      return std::make_unique<Cert_Extension::Name_Constraints>();
   61|  1.83k|   }
   62|       |
   63|  7.22k|   if(oid == Cert_Extension::CRL_Distribution_Points::static_oid()) {
  ------------------
  |  Branch (63:7): [True: 508, False: 6.72k]
  ------------------
   64|    508|      return std::make_unique<Cert_Extension::CRL_Distribution_Points>();
   65|    508|   }
   66|       |
   67|  6.72k|   if(oid == Cert_Extension::CRL_Issuing_Distribution_Point::static_oid()) {
  ------------------
  |  Branch (67:7): [True: 361, False: 6.35k]
  ------------------
   68|    361|      return std::make_unique<Cert_Extension::CRL_Issuing_Distribution_Point>();
   69|    361|   }
   70|       |
   71|  6.35k|   if(oid == Cert_Extension::Certificate_Policies::static_oid()) {
  ------------------
  |  Branch (71:7): [True: 375, False: 5.98k]
  ------------------
   72|    375|      return std::make_unique<Cert_Extension::Certificate_Policies>();
   73|    375|   }
   74|       |
   75|  5.98k|   if(oid == Cert_Extension::Extended_Key_Usage::static_oid()) {
  ------------------
  |  Branch (75:7): [True: 218, False: 5.76k]
  ------------------
   76|    218|      return std::make_unique<Cert_Extension::Extended_Key_Usage>();
   77|    218|   }
   78|       |
   79|  5.76k|   if(oid == Cert_Extension::Authority_Information_Access::static_oid()) {
  ------------------
  |  Branch (79:7): [True: 363, False: 5.40k]
  ------------------
   80|    363|      return std::make_unique<Cert_Extension::Authority_Information_Access>();
   81|    363|   }
   82|       |
   83|  5.40k|   return nullptr;  // unknown
   84|  5.76k|}
x509_ext.cpp:_ZN5Botan14Cert_Extension12_GLOBAL__N_118Policy_Information11decode_fromERNS_11BER_DecoderE:
  579|    376|      void decode_from(BER_Decoder& codec) override {
  580|    376|         codec.start_sequence().decode(m_oid).discard_remaining().end_cons();
  581|    376|      }
x509_ext.cpp:_ZNK5Botan14Cert_Extension12_GLOBAL__N_118Policy_Information3oidEv:
  575|    111|      const OID& oid() const { return m_oid; }
x509_ext.cpp:_ZN5Botan14Cert_Extension12_GLOBAL__N_118Policy_InformationC2Ev:
  571|    376|      Policy_Information() = default;

_ZN5Botan11X509_Object9load_dataERNS_10DataSourceE:
   24|  6.60k|void X509_Object::load_data(DataSource& in) {
   25|  6.60k|   try {
   26|  6.60k|      if(ASN1::maybe_BER(in) && !PEM_Code::matches(in)) {
  ------------------
  |  Branch (26:10): [True: 6.29k, False: 304]
  |  Branch (26:33): [True: 6.28k, False: 10]
  ------------------
   27|  6.28k|         BER_Decoder dec(in);
   28|  6.28k|         decode_from(dec);
   29|  6.28k|      } else {
   30|    314|         std::string got_label;
   31|    314|         DataSource_Memory ber(PEM_Code::decode(in, got_label));
   32|       |
   33|    314|         if(got_label != PEM_label()) {
  ------------------
  |  Branch (33:13): [True: 98, False: 216]
  ------------------
   34|     98|            bool is_alternate = false;
   35|     98|            for(std::string_view alt_label : alternate_PEM_labels()) {
  ------------------
  |  Branch (35:44): [True: 98, False: 98]
  ------------------
   36|     98|               if(got_label == alt_label) {
  ------------------
  |  Branch (36:19): [True: 0, False: 98]
  ------------------
   37|      0|                  is_alternate = true;
   38|      0|                  break;
   39|      0|               }
   40|     98|            }
   41|       |
   42|     98|            if(!is_alternate) {
  ------------------
  |  Branch (42:16): [True: 98, False: 0]
  ------------------
   43|     98|               throw Decoding_Error("Unexpected PEM label for " + PEM_label() + " of " + got_label);
   44|     98|            }
   45|     98|         }
   46|       |
   47|    216|         BER_Decoder dec(ber);
   48|    216|         decode_from(dec);
   49|    216|      }
   50|  6.60k|   } catch(Decoding_Error& e) {
   51|  2.83k|      throw Decoding_Error(PEM_label() + " decoding", e);
   52|  2.83k|   }
   53|  6.60k|}
_ZNK5Botan11X509_Object11encode_intoERNS_11DER_EncoderE:
   55|  3.54k|void X509_Object::encode_into(DER_Encoder& to) const {
   56|  3.54k|   to.start_sequence()
   57|  3.54k|      .start_sequence()
   58|  3.54k|      .raw_bytes(signed_body())
   59|  3.54k|      .end_cons()
   60|  3.54k|      .encode(signature_algorithm())
   61|  3.54k|      .encode(signature(), ASN1_Type::BitString)
   62|  3.54k|      .end_cons();
   63|  3.54k|}
_ZN5Botan11X509_Object11decode_fromERNS_11BER_DecoderE:
   68|  6.28k|void X509_Object::decode_from(BER_Decoder& from) {
   69|  6.28k|   from.start_sequence()
   70|  6.28k|      .start_sequence()
   71|  6.28k|      .raw_bytes(m_tbs_bits)
   72|  6.28k|      .end_cons()
   73|  6.28k|      .decode(m_sig_algo)
   74|  6.28k|      .decode(m_sig, ASN1_Type::BitString)
   75|  6.28k|      .end_cons();
   76|       |
   77|  6.28k|   force_decode();
   78|  6.28k|}
_ZNK5Botan11X509_Object8tbs_dataEv:
   90|    877|std::vector<uint8_t> X509_Object::tbs_data() const {
   91|    877|   return ASN1::put_in_sequence(m_tbs_bits);
   92|    877|}
_ZNK5Botan11X509_Object16verify_signatureERKNS_10Public_KeyE:
  102|  1.31k|std::pair<Certificate_Status_Code, std::string> X509_Object::verify_signature(const Public_Key& pub_key) const {
  103|  1.31k|   try {
  104|  1.31k|      PK_Verifier verifier(pub_key, signature_algorithm());
  105|  1.31k|      const bool valid = verifier.verify_message(tbs_data(), signature());
  106|       |
  107|  1.31k|      if(valid) {
  ------------------
  |  Branch (107:10): [True: 0, False: 1.31k]
  ------------------
  108|      0|         return std::make_pair(Certificate_Status_Code::VERIFIED, verifier.hash_function());
  109|  1.31k|      } else {
  110|  1.31k|         return std::make_pair(Certificate_Status_Code::SIGNATURE_ERROR, "");
  111|  1.31k|      }
  112|  1.31k|   } catch(Decoding_Error&) {
  113|    429|      return std::make_pair(Certificate_Status_Code::SIGNATURE_ALGO_BAD_PARAMS, "");
  114|    429|   } catch(Algorithm_Not_Found&) {
  115|      1|      return std::make_pair(Certificate_Status_Code::SIGNATURE_ALGO_UNKNOWN, "");
  116|      5|   } catch(...) {
  117|       |      // This shouldn't happen, fallback to generic signature error
  118|      5|      return std::make_pair(Certificate_Status_Code::SIGNATURE_ERROR, "");
  119|      5|   }
  120|  1.31k|}

_ZNK5Botan16X509_Certificate9PEM_labelEv:
   70|  3.03k|std::string X509_Certificate::PEM_label() const {
   71|  3.03k|   return "CERTIFICATE";
   72|  3.03k|}
_ZNK5Botan16X509_Certificate20alternate_PEM_labelsEv:
   74|     98|std::vector<std::string> X509_Certificate::alternate_PEM_labels() const {
   75|     98|   return {"X509 CERTIFICATE"};
   76|     98|}
_ZN5Botan16X509_CertificateC2ERNS_10DataSourceE:
   78|  6.60k|X509_Certificate::X509_Certificate(DataSource& src) {
   79|  6.60k|   load_data(src);
   80|  6.60k|}
_ZN5Botan16X509_Certificate12force_decodeEv:
  282|  5.48k|void X509_Certificate::force_decode() {
  283|  5.48k|   m_data.reset();
  284|  5.48k|   m_data = parse_x509_cert_body(*this);
  285|  5.48k|}
x509cert.cpp:_ZN5Botan12_GLOBAL__N_120parse_x509_cert_bodyERKNS_11X509_ObjectE:
  101|  5.48k|std::unique_ptr<X509_Certificate_Data> parse_x509_cert_body(const X509_Object& obj) {
  102|  5.48k|   auto data = std::make_unique<X509_Certificate_Data>();
  103|       |
  104|  5.48k|   BigInt serial_bn;
  105|  5.48k|   BER_Object public_key;
  106|  5.48k|   BER_Object v3_exts_data;
  107|       |
  108|  5.48k|   BER_Decoder(obj.signed_body())
  109|  5.48k|      .decode_optional(data->m_version, ASN1_Type(0), ASN1_Class::Constructed | ASN1_Class::ContextSpecific)
  110|  5.48k|      .decode(serial_bn)
  111|  5.48k|      .decode(data->m_sig_algo_inner)
  112|  5.48k|      .decode(data->m_issuer_dn)
  113|  5.48k|      .start_sequence()
  114|  5.48k|      .decode(data->m_not_before)
  115|  5.48k|      .decode(data->m_not_after)
  116|  5.48k|      .end_cons()
  117|  5.48k|      .decode(data->m_subject_dn)
  118|  5.48k|      .get_next(public_key)
  119|  5.48k|      .decode_optional_string(data->m_v2_issuer_key_id, ASN1_Type::BitString, 1)
  120|  5.48k|      .decode_optional_string(data->m_v2_subject_key_id, ASN1_Type::BitString, 2)
  121|  5.48k|      .get_next(v3_exts_data)
  122|  5.48k|      .verify_end("TBSCertificate has extra data after extensions block");
  123|       |
  124|  5.48k|   if(data->m_version > 2) {
  ------------------
  |  Branch (124:7): [True: 5, False: 5.47k]
  ------------------
  125|      5|      throw Decoding_Error("Unknown X.509 cert version " + std::to_string(data->m_version));
  126|      5|   }
  127|  5.47k|   if(obj.signature_algorithm() != data->m_sig_algo_inner) {
  ------------------
  |  Branch (127:7): [True: 64, False: 5.41k]
  ------------------
  128|     64|      throw Decoding_Error("X.509 Certificate had differing algorithm identifers in inner and outer ID fields");
  129|     64|   }
  130|       |
  131|  5.41k|   public_key.assert_is_a(ASN1_Type::Sequence, ASN1_Class::Constructed, "X.509 certificate public key");
  132|       |
  133|       |   // crude method to save the serial's sign; will get lost during decoding, otherwise
  134|  5.41k|   data->m_serial_negative = serial_bn.is_negative();
  135|       |
  136|       |   // for general sanity convert wire version (0 based) to standards version (v1 .. v3)
  137|  5.41k|   data->m_version += 1;
  138|       |
  139|  5.41k|   data->m_serial = BigInt::encode(serial_bn);
  140|  5.41k|   data->m_subject_dn_bits = ASN1::put_in_sequence(data->m_subject_dn.get_bits());
  141|  5.41k|   data->m_issuer_dn_bits = ASN1::put_in_sequence(data->m_issuer_dn.get_bits());
  142|       |
  143|  5.41k|   data->m_subject_public_key_bits.assign(public_key.bits(), public_key.bits() + public_key.length());
  144|       |
  145|  5.41k|   data->m_subject_public_key_bits_seq = ASN1::put_in_sequence(data->m_subject_public_key_bits);
  146|       |
  147|  5.41k|   BER_Decoder(data->m_subject_public_key_bits)
  148|  5.41k|      .decode(data->m_subject_public_key_algid)
  149|  5.41k|      .decode(data->m_subject_public_key_bitstring, ASN1_Type::BitString);
  150|       |
  151|  5.41k|   if(v3_exts_data.is_a(3, ASN1_Class::Constructed | ASN1_Class::ContextSpecific)) {
  ------------------
  |  Branch (151:7): [True: 1.49k, False: 3.91k]
  ------------------
  152|       |      // Path validation will reject a v1/v2 cert with v3 extensions
  153|  1.49k|      BER_Decoder(v3_exts_data).decode(data->m_v3_extensions).verify_end();
  154|  3.91k|   } else if(v3_exts_data.is_set()) {
  ------------------
  |  Branch (154:14): [True: 57, False: 3.86k]
  ------------------
  155|     57|      throw BER_Bad_Tag("Unknown tag in X.509 cert", v3_exts_data.tagging());
  156|     57|   }
  157|       |
  158|       |   // Now cache some fields from the extensions
  159|  5.35k|   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Key_Usage>()) {
  ------------------
  |  Branch (159:12): [True: 5, False: 5.35k]
  ------------------
  160|      5|      data->m_key_constraints = ext->get_constraints();
  161|       |      /*
  162|       |      RFC 5280: When the keyUsage extension appears in a certificate,
  163|       |      at least one of the bits MUST be set to 1.
  164|       |      */
  165|      5|      if(data->m_key_constraints.empty()) {
  ------------------
  |  Branch (165:10): [True: 1, False: 4]
  ------------------
  166|      1|         throw Decoding_Error("Certificate has invalid encoding for KeyUsage");
  167|      1|      }
  168|      5|   }
  169|       |
  170|  5.35k|   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Subject_Key_ID>()) {
  ------------------
  |  Branch (170:12): [True: 13, False: 5.34k]
  ------------------
  171|     13|      data->m_subject_key_id = ext->get_key_id();
  172|     13|   }
  173|       |
  174|  5.35k|   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Authority_Key_ID>()) {
  ------------------
  |  Branch (174:12): [True: 14, False: 5.34k]
  ------------------
  175|     14|      data->m_authority_key_id = ext->get_key_id();
  176|     14|   }
  177|       |
  178|  5.35k|   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Name_Constraints>()) {
  ------------------
  |  Branch (178:12): [True: 12, False: 5.34k]
  ------------------
  179|     12|      data->m_name_constraints = ext->get_name_constraints();
  180|     12|   }
  181|       |
  182|  5.35k|   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Basic_Constraints>()) {
  ------------------
  |  Branch (182:12): [True: 9, False: 5.34k]
  ------------------
  183|      9|      if(ext->get_is_ca() == true) {
  ------------------
  |  Branch (183:10): [True: 4, False: 5]
  ------------------
  184|       |         /*
  185|       |         * RFC 5280 section 4.2.1.3 requires that CAs include KeyUsage in all
  186|       |         * intermediate CA certificates they issue. Currently we accept it being
  187|       |         * missing, as do most other implementations. But it may be worth
  188|       |         * removing this entirely, or alternately adding a warning level
  189|       |         * validation failure for it.
  190|       |         */
  191|      4|         if(data->m_key_constraints.empty() || data->m_key_constraints.includes(Key_Constraints::KeyCertSign)) {
  ------------------
  |  Branch (191:13): [True: 2, False: 2]
  |  Branch (191:48): [True: 1, False: 1]
  ------------------
  192|      3|            data->m_is_ca_certificate = true;
  193|      3|            data->m_path_len_constraint = ext->get_path_limit();
  194|      3|         }
  195|      4|      }
  196|      9|   }
  197|       |
  198|  5.35k|   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Issuer_Alternative_Name>()) {
  ------------------
  |  Branch (198:12): [True: 46, False: 5.31k]
  ------------------
  199|     46|      data->m_issuer_alt_name = ext->get_alt_name();
  200|     46|   }
  201|       |
  202|  5.35k|   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Subject_Alternative_Name>()) {
  ------------------
  |  Branch (202:12): [True: 62, False: 5.29k]
  ------------------
  203|     62|      data->m_subject_alt_name = ext->get_alt_name();
  204|     62|   }
  205|       |
  206|  5.35k|   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Extended_Key_Usage>()) {
  ------------------
  |  Branch (206:12): [True: 25, False: 5.33k]
  ------------------
  207|     25|      data->m_extended_key_usage = ext->object_identifiers();
  208|     25|   }
  209|       |
  210|  5.35k|   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Certificate_Policies>()) {
  ------------------
  |  Branch (210:12): [True: 3, False: 5.35k]
  ------------------
  211|      3|      data->m_cert_policies = ext->get_policy_oids();
  212|      3|   }
  213|       |
  214|  5.35k|   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Authority_Information_Access>()) {
  ------------------
  |  Branch (214:12): [True: 11, False: 5.34k]
  ------------------
  215|     11|      data->m_ocsp_responder = ext->ocsp_responder();
  216|     11|      data->m_ca_issuers = ext->ca_issuers();
  217|     11|   }
  218|       |
  219|  5.35k|   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::CRL_Distribution_Points>()) {
  ------------------
  |  Branch (219:12): [True: 3, False: 5.35k]
  ------------------
  220|      3|      data->m_crl_distribution_points = ext->crl_distribution_urls();
  221|      3|   }
  222|       |
  223|       |   // Check for self-signed vs self-issued certificates
  224|  5.35k|   if(data->m_subject_dn == data->m_issuer_dn) {
  ------------------
  |  Branch (224:7): [True: 3.04k, False: 2.31k]
  ------------------
  225|  3.04k|      if(data->m_subject_key_id.empty() == false && data->m_authority_key_id.empty() == false) {
  ------------------
  |  Branch (225:10): [True: 12, False: 3.03k]
  |  Branch (225:53): [True: 11, False: 1]
  ------------------
  226|     11|         data->m_self_signed = (data->m_subject_key_id == data->m_authority_key_id);
  227|  3.03k|      } else {
  228|       |         /*
  229|       |         If a parse error or unknown algorithm is encountered, default
  230|       |         to assuming it is self signed. We have no way of being certain but
  231|       |         that is usually the default case (self-issued is rare in practice).
  232|       |         */
  233|  3.03k|         data->m_self_signed = true;
  234|       |
  235|  3.03k|         try {
  236|  3.03k|            auto pub_key = X509::load_key(data->m_subject_public_key_bits_seq);
  237|       |
  238|  3.03k|            const auto sig_status = obj.verify_signature(*pub_key);
  239|       |
  240|  3.03k|            if(sig_status.first == Certificate_Status_Code::OK ||
  ------------------
  |  Branch (240:16): [True: 1.72k, False: 1.31k]
  ------------------
  241|  3.03k|               sig_status.first == Certificate_Status_Code::SIGNATURE_ALGO_UNKNOWN) {
  ------------------
  |  Branch (241:16): [True: 1, False: 1.31k]
  ------------------
  242|      1|               data->m_self_signed = true;
  243|  3.03k|            } else {
  244|  3.03k|               data->m_self_signed = false;
  245|  3.03k|            }
  246|  3.03k|         } catch(...) {
  247|       |            // ignore errors here to allow parsing to continue
  248|  1.72k|         }
  249|  3.03k|      }
  250|  3.04k|   }
  251|       |
  252|  5.35k|   const std::vector<uint8_t> full_encoding = obj.BER_encode();
  253|       |
  254|  5.35k|   auto sha1 = HashFunction::create("SHA-1");
  255|  5.35k|   if(sha1) {
  ------------------
  |  Branch (255:7): [True: 3.13k, False: 2.22k]
  ------------------
  256|  3.13k|      sha1->update(data->m_subject_public_key_bitstring);
  257|  3.13k|      data->m_subject_public_key_bitstring_sha1 = sha1->final_stdvec();
  258|       |      // otherwise left as empty, and we will throw if subject_public_key_bitstring_sha1 is called
  259|       |
  260|  3.13k|      data->m_fingerprint_sha1 = create_hex_fingerprint(full_encoding, "SHA-1");
  261|  3.13k|   }
  262|       |
  263|  5.35k|   auto sha256 = HashFunction::create("SHA-256");
  264|  5.35k|   if(sha256) {
  ------------------
  |  Branch (264:7): [True: 3.13k, False: 2.22k]
  ------------------
  265|  3.13k|      sha256->update(data->m_issuer_dn_bits);
  266|  3.13k|      data->m_issuer_dn_bits_sha256 = sha256->final_stdvec();
  267|       |
  268|  3.13k|      sha256->update(data->m_subject_dn_bits);
  269|  3.13k|      data->m_subject_dn_bits_sha256 = sha256->final_stdvec();
  270|       |
  271|  3.13k|      data->m_fingerprint_sha256 = create_hex_fingerprint(full_encoding, "SHA-256");
  272|  3.13k|   }
  273|       |
  274|  5.35k|   return data;
  275|  5.35k|}