_ZN5Botan17ct_expand_top_bitITkNSt3__117unsigned_integralEmEET_S2_:
   28|  23.6k|BOTAN_FORCE_INLINE constexpr T ct_expand_top_bit(T a) {
   29|  23.6k|   const T top = CT::value_barrier<T>(a >> (sizeof(T) * 8 - 1));
   30|  23.6k|   return static_cast<T>(0) - top;
   31|  23.6k|}
_ZN5Botan6chooseITkNSt3__117unsigned_integralEmEET_S2_S2_S2_:
  216|  20.2k|BOTAN_FORCE_INLINE constexpr T choose(T mask, T a, T b) {
  217|       |   //return (mask & a) | (~mask & b);
  218|  20.2k|   return (b ^ (mask & (a ^ b)));
  219|  20.2k|}
_ZN5Botan10ct_is_zeroITkNSt3__117unsigned_integralEmEET_S2_:
   37|  23.6k|BOTAN_FORCE_INLINE constexpr T ct_is_zero(T x) {
   38|  23.6k|   return ct_expand_top_bit<T>(~x & (x - 1));
   39|  23.6k|}
_ZN5Botan10ct_is_zeroITkNSt3__117unsigned_integralEhEET_S2_:
   37|    297|BOTAN_FORCE_INLINE constexpr T ct_is_zero(T x) {
   38|    297|   return ct_expand_top_bit<T>(~x & (x - 1));
   39|    297|}
_ZN5Botan17ct_expand_top_bitITkNSt3__117unsigned_integralEhEET_S2_:
   28|    297|BOTAN_FORCE_INLINE constexpr T ct_expand_top_bit(T a) {
   29|    297|   const T top = CT::value_barrier<T>(a >> (sizeof(T) * 8 - 1));
   30|    297|   return static_cast<T>(0) - top;
   31|    297|}
_ZN5Botan6chooseITkNSt3__117unsigned_integralEhEET_S2_S2_S2_:
  216|    297|BOTAN_FORCE_INLINE constexpr T choose(T mask, T a, T b) {
  217|       |   //return (mask & a) | (~mask & b);
  218|    297|   return (b ^ (mask & (a ^ b)));
  219|    297|}

_ZN5Botan13reverse_bytesITkNSt3__117unsigned_integralEmQooooooeqstT_Li1EeqstS2_Li2EeqstS2_Li4EeqstS2_Li8EEES2_S2_:
   25|  9.37k|inline constexpr T reverse_bytes(T x) {
   26|       |   if constexpr(sizeof(T) == 1) {
   27|       |      return x;
   28|       |   } else if constexpr(sizeof(T) == 2) {
   29|       |#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap16)
   30|       |      return static_cast<T>(__builtin_bswap16(x));
   31|       |#else
   32|       |      return static_cast<T>((x << 8) | (x >> 8));
   33|       |#endif
   34|       |   } else if constexpr(sizeof(T) == 4) {
   35|       |#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap32)
   36|       |      return static_cast<T>(__builtin_bswap32(x));
   37|       |#else
   38|       |      // MSVC at least recognizes this as a bswap
   39|       |      return static_cast<T>(((x & 0x000000FF) << 24) | ((x & 0x0000FF00) << 8) | ((x & 0x00FF0000) >> 8) |
   40|       |                            ((x & 0xFF000000) >> 24));
   41|       |#endif
   42|  9.37k|   } else if constexpr(sizeof(T) == 8) {
   43|  9.37k|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap64)
   44|  9.37k|      return static_cast<T>(__builtin_bswap64(x));
   45|       |#else
   46|       |      uint32_t hi = static_cast<uint32_t>(x >> 32);
   47|       |      uint32_t lo = static_cast<uint32_t>(x);
   48|       |
   49|       |      hi = reverse_bytes(hi);
   50|       |      lo = reverse_bytes(lo);
   51|       |
   52|       |      return (static_cast<T>(lo) << 32) | hi;
   53|       |#endif
   54|  9.37k|   }
   55|  9.37k|}

_ZN5Botan2CT4MaskImEC2Em:
  637|  4.05k|      constexpr explicit Mask(T m) : m_mask(m) {}
_ZNK5Botan2CT4MaskImE5valueEv:
  630|  4.99k|      constexpr T value() const { return value_barrier<T>(m_mask); }
_ZN5Botan2CT4MaskImE7is_zeroEm:
  437|  1.70k|      static constexpr Mask<T> is_zero(T x) { return Mask<T>(ct_is_zero<T>(value_barrier<T>(x))); }
_ZN5Botan2CT8unpoisonITkNSt3__18integralEmEEvRKT_:
  112|    891|constexpr void unpoison(const T& p) {
  113|    891|   unpoison(&p, 1);
  114|    891|}
_ZN5Botan2CT8unpoisonImEEvPKT_m:
   67|  1.78k|constexpr inline void unpoison(const T* p, size_t n) {
   68|       |#if defined(BOTAN_HAS_VALGRIND)
   69|       |   if(!std::is_constant_evaluated()) {
   70|       |      VALGRIND_MAKE_MEM_DEFINED(p, n * sizeof(T));
   71|       |   }
   72|       |#endif
   73|       |
   74|  1.78k|   BOTAN_UNUSED(p, n);
  ------------------
  |  |  151|  1.78k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   75|  1.78k|}
_ZNK5Botan2CT4MaskImEcoEv:
  533|  2.03k|      constexpr Mask<T> operator~() const { return Mask<T>(~value()); }
_ZN5Botan2CT4MaskImE6expandEm:
  392|  1.40k|      static constexpr Mask<T> expand(T v) { return ~Mask<T>::is_zero(value_barrier<T>(v)); }
_ZNK5Botan2CT4MaskImE7as_boolEv:
  614|    297|      constexpr bool as_bool() const { return unpoisoned_value() != 0; }
_ZNK5Botan2CT4MaskImE16unpoisoned_valueEv:
  598|    297|      constexpr T unpoisoned_value() const {
  599|    297|         T r = value();
  600|    297|         CT::unpoison(r);
  601|    297|         return r;
  602|    297|      }
_ZNK5Botan2CT4MaskImE8select_nEPmPKmS5_m:
  565|    779|      constexpr void select_n(T output[], const T x[], const T y[], size_t len) const {
  566|    779|         const T mask = value();
  567|  21.0k|         for(size_t i = 0; i != len; ++i) {
  ------------------
  |  Branch (567:28): [True: 20.2k, False: 779]
  ------------------
  568|  20.2k|            output[i] = choose(mask, x[i], y[i]);
  569|  20.2k|         }
  570|    779|      }
_ZN5Botan2CT4MaskIhE11expand_boolEb:
  397|    297|      static constexpr Mask<T> expand_bool(bool v) { return Mask<T>::expand(static_cast<T>(v)); }
_ZN5Botan2CT4MaskIhE6expandEh:
  392|    297|      static constexpr Mask<T> expand(T v) { return ~Mask<T>::is_zero(value_barrier<T>(v)); }
_ZN5Botan2CT4MaskIhE7is_zeroEh:
  437|    297|      static constexpr Mask<T> is_zero(T x) { return Mask<T>(ct_is_zero<T>(value_barrier<T>(x))); }
_ZN5Botan2CT4MaskIhEC2Eh:
  637|    594|      constexpr explicit Mask(T m) : m_mask(m) {}
_ZNK5Botan2CT4MaskIhEcoEv:
  533|    297|      constexpr Mask<T> operator~() const { return Mask<T>(~value()); }
_ZNK5Botan2CT4MaskIhE5valueEv:
  630|    594|      constexpr T value() const { return value_barrier<T>(m_mask); }
_ZNK5Botan2CT4MaskIhE6selectEhh:
  548|    297|      constexpr T select(T x, T y) const { return choose(value(), x, y); }
_ZN5Botan2CT20conditional_copy_memImEENS0_4MaskIT_EES3_PS3_PKS3_S7_m:
  738|    779|constexpr inline Mask<T> conditional_copy_mem(T cnd, T* dest, const T* if_set, const T* if_unset, size_t elems) {
  739|    779|   const auto mask = CT::Mask<T>::expand(cnd);
  740|    779|   return CT::conditional_copy_mem(mask, dest, if_set, if_unset, elems);
  741|    779|}
_ZN5Botan2CT20conditional_copy_memImEENS0_4MaskIT_EES4_PS3_PKS3_S7_m:
  732|    779|constexpr inline Mask<T> conditional_copy_mem(Mask<T> mask, T* dest, const T* if_set, const T* if_unset, size_t elems) {
  733|    779|   mask.select_n(dest, if_set, if_unset, elems);
  734|    779|   return mask;
  735|    779|}
_ZN5Botan2CTeoENS0_4MaskImEES2_:
  523|    314|      friend constexpr Mask<T> operator^(Mask<T> x, Mask<T> y) { return Mask<T>(x.value() ^ y.value()); }

_ZN5Botan11checked_mulITkNSt3__117unsigned_integralEmEENS1_8optionalIT_EES3_S3_:
   46|  1.65k|constexpr inline std::optional<T> checked_mul(T a, T b) {
   47|       |   // Multiplication by 1U is a hack to work around C's insane
   48|       |   // integer promotion rules.
   49|       |   // https://stackoverflow.com/questions/24795651
   50|  1.65k|   const T r = (1U * a) * b;
   51|       |   // If a == 0 then the multiply certainly did not overflow
   52|       |   // Otherwise r / a == b unless overflow occurred
   53|  1.65k|   if(a != 0 && r / a != b) {
  ------------------
  |  Branch (53:7): [True: 1.65k, False: 0]
  |  Branch (53:17): [True: 0, False: 1.65k]
  ------------------
   54|      0|      return {};
   55|      0|   }
   56|  1.65k|   return r;
   57|  1.65k|}

_ZN5Botan7load_beImJNSt3__14spanIKhLm8EEEEEEDaDpOT0_:
  504|  9.14k|inline constexpr auto load_be(ParamTs&&... params) {
  505|  9.14k|   return detail::load_any<std::endian::big, OutT>(std::forward<ParamTs>(params)...);
  506|  9.14k|}
_ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_:
  278|  9.14k|inline constexpr WrappedOutT load_any(InR&& in_range) {
  279|  9.14k|   using OutT = detail::wrapped_type<WrappedOutT>;
  280|  9.14k|   ranges::assert_exact_byte_length<sizeof(OutT)>(in_range);
  281|       |
  282|  9.14k|   return detail::wrap_strong_type_or_enum<WrappedOutT>([&]() -> OutT {
  283|       |      // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  284|       |      // internally to copy ranges on a byte-by-byte basis, which is not allowed
  285|       |      // in a `constexpr` context.
  286|  9.14k|      if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  287|  9.14k|         return fallback_load_any<endianness, OutT>(std::forward<InR>(in_range));
  288|  9.14k|      } else {
  289|  9.14k|         const std::span in{in_range};
  290|  9.14k|         if constexpr(sizeof(OutT) == 1) {
  291|  9.14k|            return static_cast<OutT>(in[0]);
  292|  9.14k|         } else if constexpr(endianness == std::endian::native) {
  293|  9.14k|            return typecast_copy<OutT>(in);
  294|  9.14k|         } else {
  295|  9.14k|            static_assert(opposite(endianness) == std::endian::native);
  296|  9.14k|            return reverse_bytes(typecast_copy<OutT>(in));
  297|  9.14k|         }
  298|  9.14k|      }
  299|  9.14k|   }());
  300|  9.14k|}
_ZN5Botan6detail24wrap_strong_type_or_enumITkNS0_20unsigned_integralishEmTkNSt3__117unsigned_integralEmEEDaT0_:
  200|  9.37k|constexpr auto wrap_strong_type_or_enum(T t) {
  201|       |   if constexpr(std::is_enum_v<OutT>) {
  202|       |      return static_cast<OutT>(t);
  203|  9.37k|   } else {
  204|  9.37k|      return Botan::wrap_strong_type<OutT>(t);
  205|  9.37k|   }
  206|  9.37k|}
_ZZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_ENKUlvE_clEv:
  282|  9.14k|   return detail::wrap_strong_type_or_enum<WrappedOutT>([&]() -> OutT {
  283|       |      // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  284|       |      // internally to copy ranges on a byte-by-byte basis, which is not allowed
  285|       |      // in a `constexpr` context.
  286|  9.14k|      if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  ------------------
  |  Branch (286:10): [Folded, False: 9.14k]
  ------------------
  287|      0|         return fallback_load_any<endianness, OutT>(std::forward<InR>(in_range));
  288|  9.14k|      } else {
  289|  9.14k|         const std::span in{in_range};
  290|       |         if constexpr(sizeof(OutT) == 1) {
  291|       |            return static_cast<OutT>(in[0]);
  292|       |         } else if constexpr(endianness == std::endian::native) {
  293|       |            return typecast_copy<OutT>(in);
  294|  9.14k|         } else {
  295|  9.14k|            static_assert(opposite(endianness) == std::endian::native);
  296|  9.14k|            return reverse_bytes(typecast_copy<OutT>(in));
  297|  9.14k|         }
  298|  9.14k|      }
  299|  9.14k|   }());
_ZN5Botan7load_beImJRNSt3__15arrayIhLm8EEEEEEDaDpOT0_:
  504|    226|inline constexpr auto load_be(ParamTs&&... params) {
  505|    226|   return detail::load_any<std::endian::big, OutT>(std::forward<ParamTs>(params)...);
  506|    226|}
_ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEERNS2_5arrayIhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_:
  278|    226|inline constexpr WrappedOutT load_any(InR&& in_range) {
  279|    226|   using OutT = detail::wrapped_type<WrappedOutT>;
  280|    226|   ranges::assert_exact_byte_length<sizeof(OutT)>(in_range);
  281|       |
  282|    226|   return detail::wrap_strong_type_or_enum<WrappedOutT>([&]() -> OutT {
  283|       |      // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  284|       |      // internally to copy ranges on a byte-by-byte basis, which is not allowed
  285|       |      // in a `constexpr` context.
  286|    226|      if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  287|    226|         return fallback_load_any<endianness, OutT>(std::forward<InR>(in_range));
  288|    226|      } else {
  289|    226|         const std::span in{in_range};
  290|    226|         if constexpr(sizeof(OutT) == 1) {
  291|    226|            return static_cast<OutT>(in[0]);
  292|    226|         } else if constexpr(endianness == std::endian::native) {
  293|    226|            return typecast_copy<OutT>(in);
  294|    226|         } else {
  295|    226|            static_assert(opposite(endianness) == std::endian::native);
  296|    226|            return reverse_bytes(typecast_copy<OutT>(in));
  297|    226|         }
  298|    226|      }
  299|    226|   }());
  300|    226|}
_ZZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEERNS2_5arrayIhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_ENKUlvE_clEv:
  282|    226|   return detail::wrap_strong_type_or_enum<WrappedOutT>([&]() -> OutT {
  283|       |      // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  284|       |      // internally to copy ranges on a byte-by-byte basis, which is not allowed
  285|       |      // in a `constexpr` context.
  286|    226|      if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  ------------------
  |  Branch (286:10): [Folded, False: 226]
  ------------------
  287|      0|         return fallback_load_any<endianness, OutT>(std::forward<InR>(in_range));
  288|    226|      } else {
  289|    226|         const std::span in{in_range};
  290|       |         if constexpr(sizeof(OutT) == 1) {
  291|       |            return static_cast<OutT>(in[0]);
  292|       |         } else if constexpr(endianness == std::endian::native) {
  293|       |            return typecast_copy<OutT>(in);
  294|    226|         } else {
  295|    226|            static_assert(opposite(endianness) == std::endian::native);
  296|    226|            return reverse_bytes(typecast_copy<OutT>(in));
  297|    226|         }
  298|    226|      }
  299|    226|   }());

_ZN5Botan14zeroize_bufferITkNSt3__117unsigned_integralEmEEvPT_m:
   37|  1.86k|inline void zeroize_buffer(T buf[], size_t n) {
   38|  1.86k|   if(n > 0) {
  ------------------
  |  Branch (38:7): [True: 1.85k, False: 8]
  ------------------
   39|  1.85k|      std::memset(buf, 0, sizeof(T) * n);
   40|  1.85k|   }
   41|  1.86k|}

_ZN5Botan10word8_add3ITkNS_8WordTypeEmEET_PS1_PKS1_S4_S1_:
  304|  2.94k|inline constexpr auto word8_add3(W z[8], const W x[8], const W y[8], W carry) -> W {
  305|  2.94k|#if defined(BOTAN_MP_USE_X86_64_ASM)
  306|  2.94k|   if constexpr(std::same_as<W, uint64_t>) {
  307|  2.94k|      if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (307:10): [True: 2.94k, Folded]
  ------------------
  308|  2.94k|         asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "adcq"))
  309|  2.94k|                      : [carry] "=r"(carry)
  310|  2.94k|                      : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry)
  311|  2.94k|                      : "cc", "memory");
  312|  2.94k|         return carry;
  313|  2.94k|      }
  314|  2.94k|   }
  315|      0|#endif
  316|       |
  317|      0|   z[0] = word_add(x[0], y[0], &carry);
  318|  2.94k|   z[1] = word_add(x[1], y[1], &carry);
  319|  2.94k|   z[2] = word_add(x[2], y[2], &carry);
  320|  2.94k|   z[3] = word_add(x[3], y[3], &carry);
  321|  2.94k|   z[4] = word_add(x[4], y[4], &carry);
  322|  2.94k|   z[5] = word_add(x[5], y[5], &carry);
  323|  2.94k|   z[6] = word_add(x[6], y[6], &carry);
  324|  2.94k|   z[7] = word_add(x[7], y[7], &carry);
  325|  2.94k|   return carry;
  326|  2.94k|}
_ZN5Botan8word_addITkNS_8WordTypeEmEET_S1_S1_PS1_:
  239|  49.9k|inline constexpr auto word_add(W x, W y, W* carry) -> W {
  240|  49.9k|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_addc)
  241|  49.9k|   if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (241:7): [True: 49.9k, Folded]
  ------------------
  242|       |      if constexpr(std::same_as<W, unsigned int>) {
  243|       |         return __builtin_addc(x, y, *carry & 1, carry);
  244|  49.9k|      } else if constexpr(std::same_as<W, unsigned long>) {
  245|  49.9k|         return __builtin_addcl(x, y, *carry & 1, carry);
  246|       |      } else if constexpr(std::same_as<W, unsigned long long>) {
  247|       |         return __builtin_addcll(x, y, *carry & 1, carry);
  248|       |      }
  249|  49.9k|   }
  250|      0|#endif
  251|       |
  252|       |   if constexpr(WordInfo<W>::dword_is_native && use_dword_for_word_add) {
  253|       |      /*
  254|       |      TODO(Botan4) this is largely a performance hack for GCCs that don't
  255|       |      support __builtin_addc, if we increase the minimum supported version of
  256|       |      GCC to GCC 14 then we can remove this and not worry about it
  257|       |      */
  258|       |      const W cb = *carry & 1;
  259|       |      const auto s = typename WordInfo<W>::dword(x) + y + cb;
  260|       |      *carry = static_cast<W>(s >> WordInfo<W>::bits);
  261|       |      return static_cast<W>(s);
  262|  49.9k|   } else {
  263|  49.9k|      const W cb = *carry & 1;
  264|  49.9k|      W z = x + y;
  265|  49.9k|      W c1 = (z < x);
  266|  49.9k|      z += cb;
  267|  49.9k|      *carry = c1 | (z < cb);
  268|  49.9k|      return z;
  269|  49.9k|   }
  270|  49.9k|}
_ZN5Botan10word8_sub3ITkNS_8WordTypeEmEET_PS1_PKS1_S4_S1_:
  385|  4.71k|inline constexpr auto word8_sub3(W z[8], const W x[8], const W y[8], W carry) -> W {
  386|  4.71k|#if defined(BOTAN_MP_USE_X86_64_ASM)
  387|  4.71k|   if constexpr(std::same_as<W, uint64_t>) {
  388|  4.71k|      if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (388:10): [True: 4.71k, Folded]
  ------------------
  389|  4.71k|         asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "sbbq"))
  390|  4.71k|                      : [carry] "=r"(carry)
  391|  4.71k|                      : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry)
  392|  4.71k|                      : "cc", "memory");
  393|  4.71k|         return carry;
  394|  4.71k|      }
  395|  4.71k|   }
  396|      0|#endif
  397|       |
  398|      0|   z[0] = word_sub(x[0], y[0], &carry);
  399|  4.71k|   z[1] = word_sub(x[1], y[1], &carry);
  400|  4.71k|   z[2] = word_sub(x[2], y[2], &carry);
  401|  4.71k|   z[3] = word_sub(x[3], y[3], &carry);
  402|  4.71k|   z[4] = word_sub(x[4], y[4], &carry);
  403|  4.71k|   z[5] = word_sub(x[5], y[5], &carry);
  404|  4.71k|   z[6] = word_sub(x[6], y[6], &carry);
  405|  4.71k|   z[7] = word_sub(x[7], y[7], &carry);
  406|  4.71k|   return carry;
  407|  4.71k|}
_ZN5Botan8word_subITkNS_8WordTypeEmEET_S1_S1_PS1_:
  332|  31.4k|inline constexpr auto word_sub(W x, W y, W* carry) -> W {
  333|  31.4k|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_subc)
  334|  31.4k|   if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (334:7): [True: 31.4k, Folded]
  ------------------
  335|       |      if constexpr(std::same_as<W, unsigned int>) {
  336|       |         return __builtin_subc(x, y, *carry & 1, carry);
  337|  31.4k|      } else if constexpr(std::same_as<W, unsigned long>) {
  338|  31.4k|         return __builtin_subcl(x, y, *carry & 1, carry);
  339|       |      } else if constexpr(std::same_as<W, unsigned long long>) {
  340|       |         return __builtin_subcll(x, y, *carry & 1, carry);
  341|       |      }
  342|  31.4k|   }
  343|      0|#endif
  344|       |
  345|      0|   const W cb = *carry & 1;
  346|  31.4k|   W t0 = x - y;
  347|  31.4k|   W c1 = (t0 > x);
  348|  31.4k|   W z = t0 - cb;
  349|  31.4k|   *carry = c1 | (z > t0);
  350|  31.4k|   return z;
  351|  31.4k|}
_ZN5Botan10word_madd2ITkNS_8WordTypeEmEET_S1_S1_PS1_:
   90|    238|inline constexpr auto word_madd2(W a, W b, W* c) -> W {
   91|    238|#if defined(BOTAN_MP_USE_X86_64_ASM)
   92|    238|   if constexpr(std::same_as<W, uint64_t>) {
   93|    238|      if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (93:10): [True: 238, Folded]
  ------------------
   94|    238|         asm(R"(
   95|    238|            mulq %[b]
   96|    238|            addq %[c],%[a]
   97|    238|            adcq $0,%[carry]
   98|    238|            )"
   99|    238|             : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*c)
  100|    238|             : "0"(a), "1"(b), [c] "g"(*c)
  101|    238|             : "cc");
  102|       |
  103|    238|         return a;
  104|    238|      }
  105|    238|   }
  106|       |#elif defined(BOTAN_MP_USE_AARCH64_ASM)
  107|       |   if constexpr(std::same_as<W, uint64_t>) {
  108|       |      if(!std::is_constant_evaluated()) {
  109|       |         W lo = 0;
  110|       |         W hi = 0;
  111|       |         asm(R"(
  112|       |            mul  %[lo], %[a], %[b]
  113|       |            umulh %[hi], %[a], %[b]
  114|       |            adds %[lo], %[lo], %[c]
  115|       |            adc  %[hi], %[hi], xzr
  116|       |            )"
  117|       |             : [lo] "=&r"(lo), [hi] "=&r"(hi)
  118|       |             : [a] "r"(a), [b] "r"(b), [c] "r"(*c)
  119|       |             : "cc");
  120|       |
  121|       |         *c = hi;
  122|       |         return lo;
  123|       |      }
  124|       |   }
  125|       |#endif
  126|       |
  127|      0|   typedef typename WordInfo<W>::dword dword;
  128|    238|   const dword s = dword(a) * b + *c;
  129|    238|   *c = static_cast<W>(s >> WordInfo<W>::bits);
  130|    238|   return static_cast<W>(s);
  131|    238|}
_ZN5Botan11word8_madd3ITkNS_8WordTypeEmEET_PS1_PKS1_S1_S1_:
  441|  68.3k|inline constexpr auto word8_madd3(W z[8], const W x[8], W y, W carry) -> W {
  442|  68.3k|#if defined(BOTAN_MP_USE_X86_64_ASM)
  443|  68.3k|   if constexpr(std::same_as<W, uint64_t>) {
  444|  68.3k|      if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (444:10): [True: 68.3k, Folded]
  ------------------
  445|  68.3k|         asm volatile(DO_8_TIMES(MULADD_OP, "")
  446|  68.3k|                      : [carry] "=r"(carry)
  447|  68.3k|                      : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry)
  448|  68.3k|                      : "cc", "%rax", "%rdx", "memory");
  449|  68.3k|         return carry;
  450|  68.3k|      }
  451|  68.3k|   }
  452|      0|#endif
  453|       |
  454|      0|   z[0] = word_madd3(x[0], y, z[0], &carry);
  455|  68.3k|   z[1] = word_madd3(x[1], y, z[1], &carry);
  456|  68.3k|   z[2] = word_madd3(x[2], y, z[2], &carry);
  457|  68.3k|   z[3] = word_madd3(x[3], y, z[3], &carry);
  458|  68.3k|   z[4] = word_madd3(x[4], y, z[4], &carry);
  459|  68.3k|   z[5] = word_madd3(x[5], y, z[5], &carry);
  460|  68.3k|   z[6] = word_madd3(x[6], y, z[6], &carry);
  461|  68.3k|   z[7] = word_madd3(x[7], y, z[7], &carry);
  462|  68.3k|   return carry;
  463|  68.3k|}
_ZN5Botan10word_madd3ITkNS_8WordTypeEmEET_S1_S1_S1_PS1_:
  137|  71.9k|inline constexpr auto word_madd3(W a, W b, W c, W* d) -> W {
  138|  71.9k|#if defined(BOTAN_MP_USE_X86_64_ASM)
  139|  71.9k|   if constexpr(std::same_as<W, uint64_t>) {
  140|  71.9k|      if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (140:10): [True: 71.9k, Folded]
  ------------------
  141|  71.9k|         asm(R"(
  142|  71.9k|            mulq %[b]
  143|  71.9k|
  144|  71.9k|            addq %[c],%[a]
  145|  71.9k|            adcq $0,%[carry]
  146|  71.9k|
  147|  71.9k|            addq %[d],%[a]
  148|  71.9k|            adcq $0,%[carry]
  149|  71.9k|            )"
  150|  71.9k|             : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*d)
  151|  71.9k|             : "0"(a), "1"(b), [c] "g"(c), [d] "g"(*d)
  152|  71.9k|             : "cc");
  153|       |
  154|  71.9k|         return a;
  155|  71.9k|      }
  156|  71.9k|   }
  157|       |#elif defined(BOTAN_MP_USE_AARCH64_ASM)
  158|       |   if constexpr(std::same_as<W, uint64_t>) {
  159|       |      if(!std::is_constant_evaluated()) {
  160|       |         W lo = 0;
  161|       |         W hi = 0;
  162|       |         asm(R"(
  163|       |            mul  %[lo], %[a], %[b]
  164|       |            umulh %[hi], %[a], %[b]
  165|       |            adds %[lo], %[lo], %[c]
  166|       |            adc  %[hi], %[hi], xzr
  167|       |            adds %[lo], %[lo], %[d]
  168|       |            adc  %[hi], %[hi], xzr
  169|       |            )"
  170|       |             : [lo] "=&r"(lo), [hi] "=&r"(hi)
  171|       |             : [a] "r"(a), [b] "r"(b), [c] "r"(c), [d] "r"(*d)
  172|       |             : "cc");
  173|       |
  174|       |         *d = hi;
  175|       |         return lo;
  176|       |      }
  177|       |   }
  178|       |#endif
  179|       |
  180|      0|   typedef typename WordInfo<W>::dword dword;
  181|  71.9k|   const dword s = dword(a) * b + c + *d;
  182|  71.9k|   *d = static_cast<W>(s >> WordInfo<W>::bits);
  183|  71.9k|   return static_cast<W>(s);
  184|  71.9k|}
_ZN5Botan10word8_add2ITkNS_8WordTypeEmEET_PS1_PKS1_S1_:
  276|  2.94k|inline constexpr auto word8_add2(W x[8], const W y[8], W carry) -> W {
  277|  2.94k|#if defined(BOTAN_MP_USE_X86_64_ASM)
  278|  2.94k|   if constexpr(std::same_as<W, uint64_t>) {
  279|  2.94k|      if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (279:10): [True: 2.94k, Folded]
  ------------------
  280|  2.94k|         asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "adcq"))
  281|  2.94k|                      : [carry] "=r"(carry)
  282|  2.94k|                      : [x] "r"(x), [y] "r"(y), "0"(carry)
  283|  2.94k|                      : "cc", "memory");
  284|  2.94k|         return carry;
  285|  2.94k|      }
  286|  2.94k|   }
  287|      0|#endif
  288|       |
  289|      0|   x[0] = word_add(x[0], y[0], &carry);
  290|  2.94k|   x[1] = word_add(x[1], y[1], &carry);
  291|  2.94k|   x[2] = word_add(x[2], y[2], &carry);
  292|  2.94k|   x[3] = word_add(x[3], y[3], &carry);
  293|  2.94k|   x[4] = word_add(x[4], y[4], &carry);
  294|  2.94k|   x[5] = word_add(x[5], y[5], &carry);
  295|  2.94k|   x[6] = word_add(x[6], y[6], &carry);
  296|  2.94k|   x[7] = word_add(x[7], y[7], &carry);
  297|  2.94k|   return carry;
  298|  2.94k|}
_ZN5Botan10word8_sub2ITkNS_8WordTypeEmEET_PS1_PKS1_S1_:
  357|    958|inline constexpr auto word8_sub2(W x[8], const W y[8], W carry) -> W {
  358|    958|#if defined(BOTAN_MP_USE_X86_64_ASM)
  359|    958|   if constexpr(std::same_as<W, uint64_t>) {
  360|    958|      if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (360:10): [True: 958, Folded]
  ------------------
  361|    958|         asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "sbbq"))
  362|    958|                      : [carry] "=r"(carry)
  363|    958|                      : [x] "r"(x), [y] "r"(y), "0"(carry)
  364|    958|                      : "cc", "memory");
  365|    958|         return carry;
  366|    958|      }
  367|    958|   }
  368|      0|#endif
  369|       |
  370|      0|   x[0] = word_sub(x[0], y[0], &carry);
  371|    958|   x[1] = word_sub(x[1], y[1], &carry);
  372|    958|   x[2] = word_sub(x[2], y[2], &carry);
  373|    958|   x[3] = word_sub(x[3], y[3], &carry);
  374|    958|   x[4] = word_sub(x[4], y[4], &carry);
  375|    958|   x[5] = word_sub(x[5], y[5], &carry);
  376|    958|   x[6] = word_sub(x[6], y[6], &carry);
  377|    958|   x[7] = word_sub(x[7], y[7], &carry);
  378|    958|   return carry;
  379|    958|}
_ZN5Botan5word3ImEC2Ev:
  478|    669|      constexpr word3() : m_w(0) {}
_ZN5Botan5word3ImE3mulEmm:
  480|   128k|      inline constexpr void mul(W x, W y) { m_w += static_cast<W3>(x) * y; }
_ZN5Botan5word3ImE7extractEv:
  486|  21.4k|      inline constexpr W extract() {
  487|  21.4k|         W r = static_cast<W>(m_w);
  488|  21.4k|         m_w >>= WordInfo<W>::bits;
  489|  21.4k|         return r;
  490|  21.4k|      }
_ZN5Botan5word3ImE6mul_x2Emm:
  482|  27.3k|      inline constexpr void mul_x2(W x, W y) { m_w += static_cast<W3>(x) * y * 2; }

_ZN5Botan11bigint_add3ITkNS_8WordTypeEmEET_PS1_PKS1_mS4_m:
  121|    465|inline constexpr auto bigint_add3(W z[], const W x[], size_t x_size, const W y[], size_t y_size) -> W {
  122|    465|   if(x_size < y_size) {
  ------------------
  |  Branch (122:7): [True: 0, False: 465]
  ------------------
  123|      0|      return bigint_add3(z, y, y_size, x, x_size);
  124|      0|   }
  125|       |
  126|    465|   W carry = 0;
  127|       |
  128|    465|   const size_t blocks = y_size - (y_size % 8);
  129|       |
  130|  3.41k|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (130:22): [True: 2.94k, False: 465]
  ------------------
  131|  2.94k|      carry = word8_add3(z + i, x + i, y + i, carry);
  132|  2.94k|   }
  133|       |
  134|  1.08k|   for(size_t i = blocks; i != y_size; ++i) {
  ------------------
  |  Branch (134:27): [True: 618, False: 465]
  ------------------
  135|    618|      z[i] = word_add(x[i], y[i], &carry);
  136|    618|   }
  137|       |
  138|    465|   for(size_t i = y_size; i != x_size; ++i) {
  ------------------
  |  Branch (138:27): [True: 0, False: 465]
  ------------------
  139|      0|      z[i] = word_add(x[i], static_cast<W>(0), &carry);
  140|      0|   }
  141|       |
  142|    465|   return carry;
  143|    465|}
_ZN5Botan14bigint_linmul3ITkNS_8WordTypeEmEEvPT_PKS1_mS1_:
  417|    238|inline constexpr void bigint_linmul3(W z[], const W x[], size_t x_size, W y) {
  418|    238|   const size_t blocks = x_size - (x_size % 8);
  419|       |
  420|    238|   W carry = 0;
  421|       |
  422|    238|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (422:22): [True: 0, False: 238]
  ------------------
  423|      0|      carry = word8_linmul3(z + i, x + i, y, carry);
  424|      0|   }
  425|       |
  426|    476|   for(size_t i = blocks; i != x_size; ++i) {
  ------------------
  |  Branch (426:27): [True: 238, False: 238]
  ------------------
  427|    238|      z[i] = word_madd2(x[i], y, &carry);
  428|    238|   }
  429|       |
  430|    238|   z[x_size] = carry;
  431|    238|}
_ZN5Botan15bigint_ct_is_eqITkNS_8WordTypeEmEENS_2CT4MaskIT_EEPKS3_mS6_m:
  540|    297|inline constexpr auto bigint_ct_is_eq(const W x[], size_t x_size, const W y[], size_t y_size) -> CT::Mask<W> {
  541|    297|   const size_t common_elems = std::min(x_size, y_size);
  542|       |
  543|    297|   W diff = 0;
  544|       |
  545|  15.5k|   for(size_t i = 0; i != common_elems; i++) {
  ------------------
  |  Branch (545:22): [True: 15.2k, False: 297]
  ------------------
  546|  15.2k|      diff |= (x[i] ^ y[i]);
  547|  15.2k|   }
  548|       |
  549|       |   // If any bits were set in high part of x/y, then they are not equal
  550|    297|   if(x_size < y_size) {
  ------------------
  |  Branch (550:7): [True: 297, False: 0]
  ------------------
  551|  9.35k|      for(size_t i = x_size; i != y_size; i++) {
  ------------------
  |  Branch (551:30): [True: 9.06k, False: 297]
  ------------------
  552|  9.06k|         diff |= y[i];
  553|  9.06k|      }
  554|    297|   } else if(y_size < x_size) {
  ------------------
  |  Branch (554:14): [True: 0, False: 0]
  ------------------
  555|      0|      for(size_t i = y_size; i != x_size; i++) {
  ------------------
  |  Branch (555:30): [True: 0, False: 0]
  ------------------
  556|      0|         diff |= x[i];
  557|      0|      }
  558|      0|   }
  559|       |
  560|    297|   return CT::Mask<W>::is_zero(diff);
  561|    297|}
_ZN5Botan14bigint_cnd_addITkNS_8WordTypeEmEET_S1_PS1_PKS1_m:
   46|    314|inline constexpr W bigint_cnd_add(W cnd, W x[], const W y[], size_t size) {
   47|    314|   const auto mask = CT::Mask<W>::expand(cnd).value();
   48|       |
   49|    314|   W carry = 0;
   50|       |
   51|  24.8k|   for(size_t i = 0; i != size; ++i) {
  ------------------
  |  Branch (51:22): [True: 24.5k, False: 314]
  ------------------
   52|  24.5k|      x[i] = word_add(x[i], y[i] & mask, &carry);
   53|  24.5k|   }
   54|       |
   55|    314|   return (mask & carry);
   56|    314|}
_ZN5Botan14bigint_sub_absITkNS_8WordTypeEmEENS_2CT4MaskIT_EEPS3_PKS3_S7_mS5_:
  280|    779|inline constexpr auto bigint_sub_abs(W z[], const W x[], const W y[], size_t N, W ws[]) -> CT::Mask<W> {
  281|       |   // Subtract in both direction then conditional copy out the result
  282|       |
  283|    779|   W* ws0 = ws;
  284|    779|   W* ws1 = ws + N;
  285|       |
  286|    779|   W borrow0 = 0;
  287|    779|   W borrow1 = 0;
  288|       |
  289|    779|   const size_t blocks = N - (N % 8);
  290|       |
  291|  3.13k|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (291:22): [True: 2.35k, False: 779]
  ------------------
  292|  2.35k|      borrow0 = word8_sub3(ws0 + i, x + i, y + i, borrow0);
  293|  2.35k|      borrow1 = word8_sub3(ws1 + i, y + i, x + i, borrow1);
  294|  2.35k|   }
  295|       |
  296|  2.18k|   for(size_t i = blocks; i != N; ++i) {
  ------------------
  |  Branch (296:27): [True: 1.40k, False: 779]
  ------------------
  297|  1.40k|      ws0[i] = word_sub(x[i], y[i], &borrow0);
  298|  1.40k|      ws1[i] = word_sub(y[i], x[i], &borrow1);
  299|  1.40k|   }
  300|       |
  301|    779|   return CT::conditional_copy_mem(borrow0, z, ws1, ws0, N);
  302|    779|}
_ZN5Botan11bigint_add2ITkNS_8WordTypeEmEET_PS1_mPKS1_m:
   95|  1.39k|inline constexpr auto bigint_add2(W x[], size_t x_size, const W y[], size_t y_size) -> W {
   96|  1.39k|   W carry = 0;
   97|       |
   98|  1.39k|   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
  ------------------
  |  |   71|  1.39k|   do {                                                                                 \
  |  |   72|  1.39k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                                     \
  |  |   73|  1.39k|      if(!(expr)) {                                                                     \
  |  |  ------------------
  |  |  |  Branch (73:10): [True: 0, False: 1.39k]
  |  |  ------------------
  |  |   74|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                            \
  |  |   75|      0|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   76|      0|      }                                                                                 \
  |  |   77|  1.39k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (77:12): [Folded, False: 1.39k]
  |  |  ------------------
  ------------------
   99|       |
  100|  1.39k|   const size_t blocks = y_size - (y_size % 8);
  101|       |
  102|  4.34k|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (102:22): [True: 2.94k, False: 1.39k]
  ------------------
  103|  2.94k|      carry = word8_add2(x + i, y + i, carry);
  104|  2.94k|   }
  105|       |
  106|  2.94k|   for(size_t i = blocks; i != y_size; ++i) {
  ------------------
  |  Branch (106:27): [True: 1.54k, False: 1.39k]
  ------------------
  107|  1.54k|      x[i] = word_add(x[i], y[i], &carry);
  108|  1.54k|   }
  109|       |
  110|  24.6k|   for(size_t i = y_size; i != x_size; ++i) {
  ------------------
  |  Branch (110:27): [True: 23.2k, False: 1.39k]
  ------------------
  111|  23.2k|      x[i] = word_add(x[i], static_cast<W>(0), &carry);
  112|  23.2k|   }
  113|       |
  114|  1.39k|   return carry;
  115|  1.39k|}
_ZN5Botan14bigint_cnd_subITkNS_8WordTypeEmEET_S1_PS1_PKS1_m:
   63|    314|inline constexpr auto bigint_cnd_sub(W cnd, W x[], const W y[], size_t size) -> W {
   64|    314|   const auto mask = CT::Mask<W>::expand(cnd).value();
   65|       |
   66|    314|   W carry = 0;
   67|       |
   68|  24.8k|   for(size_t i = 0; i != size; ++i) {
  ------------------
  |  Branch (68:22): [True: 24.5k, False: 314]
  ------------------
   69|  24.5k|      x[i] = word_sub(x[i], y[i] & mask, &carry);
   70|  24.5k|   }
   71|       |
   72|    314|   return (mask & carry);
   73|    314|}
_ZN5Botan11bigint_sub2ITkNS_8WordTypeEmEET_PS1_mPKS1_m:
  149|    151|inline constexpr auto bigint_sub2(W x[], size_t x_size, const W y[], size_t y_size) -> W {
  150|    151|   W borrow = 0;
  151|       |
  152|    151|   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
  ------------------
  |  |   71|    151|   do {                                                                                 \
  |  |   72|    151|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                                     \
  |  |   73|    151|      if(!(expr)) {                                                                     \
  |  |  ------------------
  |  |  |  Branch (73:10): [True: 0, False: 151]
  |  |  ------------------
  |  |   74|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                            \
  |  |   75|      0|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   76|      0|      }                                                                                 \
  |  |   77|    151|   } while(0)
  |  |  ------------------
  |  |  |  Branch (77:12): [Folded, False: 151]
  |  |  ------------------
  ------------------
  153|       |
  154|    151|   const size_t blocks = y_size - (y_size % 8);
  155|       |
  156|  1.10k|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (156:22): [True: 958, False: 151]
  ------------------
  157|    958|      borrow = word8_sub2(x + i, y + i, borrow);
  158|    958|   }
  159|       |
  160|    347|   for(size_t i = blocks; i != y_size; ++i) {
  ------------------
  |  Branch (160:27): [True: 196, False: 151]
  ------------------
  161|    196|      x[i] = word_sub(x[i], y[i], &borrow);
  162|    196|   }
  163|       |
  164|  4.08k|   for(size_t i = y_size; i != x_size; ++i) {
  ------------------
  |  Branch (164:27): [True: 3.93k, False: 151]
  ------------------
  165|  3.93k|      x[i] = word_sub(x[i], static_cast<W>(0), &borrow);
  166|  3.93k|   }
  167|       |
  168|    151|   return borrow;
  169|    151|}

_ZN5Botan8round_upEmm:
   26|    297|constexpr inline size_t round_up(size_t n, size_t align_to) {
   27|       |   // Arguably returning n in this case would also be sensible
   28|    297|   BOTAN_ARG_CHECK(align_to != 0, "align_to must not be 0");
  ------------------
  |  |   35|    297|   do {                                                          \
  |  |   36|    297|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|    297|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 297]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|    297|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 297]
  |  |  ------------------
  ------------------
   29|       |
   30|    297|   if(n % align_to > 0) {
  ------------------
  |  Branch (30:7): [True: 268, False: 29]
  ------------------
   31|    268|      const size_t adj = align_to - (n % align_to);
   32|    268|      BOTAN_ARG_CHECK(n + adj >= n, "Integer overflow during rounding");
  ------------------
  |  |   35|    268|   do {                                                          \
  |  |   36|    268|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|    268|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 268]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|    268|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 268]
  |  |  ------------------
  ------------------
   33|    268|      n += adj;
   34|    268|   }
   35|    297|   return n;
   36|    297|}

_ZN5Botan2CT13value_barrierITkNSt3__117unsigned_integralEmQntsr3stdE7same_asIbT_EEES3_S3_:
   43|  31.7k|constexpr inline T value_barrier(T x) {
   44|  31.7k|   if(std::is_constant_evaluated()) {
  ------------------
  |  Branch (44:7): [Folded, False: 31.7k]
  ------------------
   45|      0|      return x;
   46|  31.7k|   } else {
   47|  31.7k|#if defined(BOTAN_CT_VALUE_BARRIER_USE_ASM)
   48|       |      /*
   49|       |      * We may want a "stronger" statement such as
   50|       |      *     asm volatile("" : "+r,m"(x) : : "memory);
   51|       |      * (see https://theunixzoo.co.uk/blog/2021-10-14-preventing-optimisations.html)
   52|       |      * however the current approach seems sufficient with current compilers,
   53|       |      * and is minimally damaging with regards to degrading code generation.
   54|       |      */
   55|  31.7k|      asm("" : "+r"(x) : /* no input */);  // NOLINT(*-no-assembler)
   56|  31.7k|      return x;
   57|       |#elif defined(BOTAN_CT_VALUE_BARRIER_USE_VOLATILE)
   58|       |      volatile T vx = x;
   59|       |      return vx;
   60|       |#else
   61|       |      return x;
   62|       |#endif
   63|  31.7k|   }
   64|  31.7k|}
_ZN5Botan2CT13value_barrierITkNSt3__117unsigned_integralEhQntsr3stdE7same_asIbT_EEES3_S3_:
   43|  1.48k|constexpr inline T value_barrier(T x) {
   44|  1.48k|   if(std::is_constant_evaluated()) {
  ------------------
  |  Branch (44:7): [Folded, False: 1.48k]
  ------------------
   45|      0|      return x;
   46|  1.48k|   } else {
   47|  1.48k|#if defined(BOTAN_CT_VALUE_BARRIER_USE_ASM)
   48|       |      /*
   49|       |      * We may want a "stronger" statement such as
   50|       |      *     asm volatile("" : "+r,m"(x) : : "memory);
   51|       |      * (see https://theunixzoo.co.uk/blog/2021-10-14-preventing-optimisations.html)
   52|       |      * however the current approach seems sufficient with current compilers,
   53|       |      * and is minimally damaging with regards to degrading code generation.
   54|       |      */
   55|  1.48k|      asm("" : "+r"(x) : /* no input */);  // NOLINT(*-no-assembler)
   56|  1.48k|      return x;
   57|       |#elif defined(BOTAN_CT_VALUE_BARRIER_USE_VOLATILE)
   58|       |      volatile T vx = x;
   59|       |      return vx;
   60|       |#else
   61|       |      return x;
   62|       |#endif
   63|  1.48k|   }
   64|  1.48k|}

_ZN5Botan13ignore_paramsIJPKmmEEEvDpRKT_:
  149|  1.78k|constexpr void ignore_params([[maybe_unused]] const T&... args) {}

_ZN5BotanneERKNS_6BigIntES2_:
 1323|    297|inline bool operator!=(const BigInt& a, const BigInt& b) {
 1324|    297|   return !a.is_equal(b);
 1325|    297|}
_ZN5Botan6BigIntD2Ev:
  185|    891|      ~BigInt() { _const_time_unpoison(); }
_ZN5Botan6BigInt8swap_regERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  218|    297|      BOTAN_DEPRECATED("Deprecated no replacement") void swap_reg(secure_vector<word>& reg) {
  219|    297|         m_data.swap(reg);
  220|       |         // sign left unchanged
  221|    297|      }
_ZN5Botan6BigInt5clearEv:
  441|    297|      void clear() {
  442|    297|         m_data.set_to_zero();
  443|    297|         m_signedness = Positive;
  444|    297|      }
_ZNK5Botan6BigInt7word_atEm:
  601|    119|      word word_at(size_t n) const { return m_data.get_word_at(n); }
_ZNK5Botan6BigInt4signEv:
  641|  1.47k|      Sign sign() const { return (m_signedness); }
_ZN5Botan6BigInt8set_signENS0_4SignE:
  663|    594|      void set_sign(Sign sign) {
  664|    594|         if(sign == Negative && is_zero()) {
  ------------------
  |  Branch (664:13): [True: 0, False: 594]
  |  Branch (664:33): [True: 0, False: 0]
  ------------------
  665|      0|            sign = Positive;
  666|      0|         }
  667|       |
  668|    594|         m_signedness = sign;
  669|    594|      }
_ZNK5Botan6BigInt4sizeEv:
  681|  2.18k|      size_t size() const { return m_data.size(); }
_ZNK5Botan6BigInt9sig_wordsEv:
  687|    891|      size_t sig_words() const { return m_data.sig_words(); }
_ZN5Botan6BigInt12mutable_dataEv:
  712|    293|      BOTAN_DEPRECATED("Deprecated no replacement") word* mutable_data() { return m_data.mutable_data(); }
_ZNK5Botan6BigInt7grow_toEm:
  738|    297|      BOTAN_DEPRECATED("Deprecated no replacement") void grow_to(size_t n) const { m_data.grow_to(n); }
_ZNK5Botan6BigInt5_dataEv:
 1033|  1.35k|      const word* _data() const { return m_data.const_data(); }
_ZN5Botan6BigInt4Data12mutable_dataEv:
 1083|    293|            word* mutable_data() {
 1084|    293|               invalidate_sig_words();
 1085|    293|               return m_reg.data();
 1086|    293|            }
_ZNK5Botan6BigInt4Data10const_dataEv:
 1088|  2.24k|            const word* const_data() const { return m_reg.data(); }
_ZNK5Botan6BigInt4Data11get_word_atEm:
 1099|    119|            word get_word_at(size_t n) const {
 1100|    119|               if(n < m_reg.size()) {
  ------------------
  |  Branch (1100:19): [True: 119, False: 0]
  ------------------
 1101|    119|                  return m_reg[n];
 1102|    119|               }
 1103|      0|               return 0;
 1104|    119|            }
_ZNK5Botan6BigInt4Data7grow_toEm:
 1126|    297|            void grow_to(size_t n) const {
 1127|    297|               if(n > size()) {
  ------------------
  |  Branch (1127:19): [True: 297, False: 0]
  ------------------
 1128|    297|                  if(n <= m_reg.capacity()) {
  ------------------
  |  Branch (1128:22): [True: 0, False: 297]
  ------------------
 1129|      0|                     m_reg.resize(n);
 1130|    297|                  } else {
 1131|    297|                     m_reg.resize(n + (8 - (n % 8)));
 1132|    297|                  }
 1133|    297|               }
 1134|    297|            }
_ZNK5Botan6BigInt4Data4sizeEv:
 1136|  3.36k|            size_t size() const { return m_reg.size(); }
_ZN5Botan6BigInt4Data4swapERNSt3__16vectorImNS_16secure_allocatorImEEEE:
 1156|    594|            void swap(secure_vector<word>& reg) noexcept {
 1157|    594|               m_reg.swap(reg);
 1158|    594|               invalidate_sig_words();
 1159|    594|            }
_ZNK5Botan6BigInt4Data20invalidate_sig_wordsEv:
 1161|    887|            void invalidate_sig_words() const noexcept { m_sig_words = sig_words_npos; }
_ZNK5Botan6BigInt4Data9sig_wordsEv:
 1163|    891|            size_t sig_words() const {
 1164|    891|               if(m_sig_words == sig_words_npos) {
  ------------------
  |  Branch (1164:19): [True: 594, False: 297]
  ------------------
 1165|    594|                  m_sig_words = calc_sig_words();
 1166|    594|               }
 1167|    891|               return m_sig_words;
 1168|    891|            }
_ZN5Botan6BigIntC2Ev:
   45|    594|      BigInt() = default;
_ZN5Botan6BigIntC2ERKS0_:
   88|    297|      BigInt(const BigInt& other) = default;

_ZN5Botan9clear_memImEEvPT_m:
  118|    297|inline constexpr void clear_mem(T* ptr, size_t n) {
  119|    297|   clear_bytes(ptr, sizeof(T) * n);
  120|    297|}
_ZN5Botan11clear_bytesEPvm:
  101|    297|inline constexpr void clear_bytes(void* ptr, size_t bytes) {
  102|    297|   if(bytes > 0) {
  ------------------
  |  Branch (102:7): [True: 0, False: 297]
  ------------------
  103|      0|      std::memset(ptr, 0, bytes);
  104|      0|   }
  105|    297|}
_ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIKhLm8EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vIS6_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEEES6_RKSB_:
  210|  9.14k|inline constexpr ToT typecast_copy(const FromR& src) {
  211|  9.14k|   ToT dst;  // NOLINT(*-member-init)
  212|  9.14k|   typecast_copy(dst, src);
  213|  9.14k|   return dst;
  214|  9.14k|}
_ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIKhLm8EEEQaaaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIT_Entsr3std6rangesE5rangeISK_EEEvRSK_RKSA_:
  188|  9.14k|inline constexpr void typecast_copy(ToT& out, const FromR& in) {
  189|  9.14k|   typecast_copy(std::span<ToT, 1>(&out, 1), in);
  190|  9.14k|}
_ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm1EEETkNS1_16contiguous_rangeENS3_IKhLm8EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEEEvOSL_RKSB_:
  176|  9.14k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) {
  177|  9.14k|   ranges::assert_equal_byte_lengths(out, in);
  178|  9.14k|   std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  179|  9.14k|}
_ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanIhLm18446744073709551615EEETkNS1_16contiguous_rangeENS3_IKhLm18446744073709551615EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_:
  160|    226|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) {
  161|    226|   ranges::assert_equal_byte_lengths(out, in);
  162|    226|   if(std::is_constant_evaluated()) {
  ------------------
  |  Branch (162:7): [Folded, False: 226]
  ------------------
  163|      0|      std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out));
  164|    226|   } else if(ranges::size_bytes(out) > 0) {
  ------------------
  |  Branch (164:14): [True: 226, False: 0]
  ------------------
  165|    226|      std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  166|    226|   }
  167|    226|}
_ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIhLm8EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vIS5_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEEES5_RKSA_:
  210|    226|inline constexpr ToT typecast_copy(const FromR& src) {
  211|    226|   ToT dst;  // NOLINT(*-member-init)
  212|    226|   typecast_copy(dst, src);
  213|    226|   return dst;
  214|    226|}
_ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIhLm8EEEQaaaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISC_EESD_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIT_Entsr3std6rangesE5rangeISJ_EEEvRSJ_RKS9_:
  188|    226|inline constexpr void typecast_copy(ToT& out, const FromR& in) {
  189|    226|   typecast_copy(std::span<ToT, 1>(&out, 1), in);
  190|    226|}
_ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm1EEETkNS1_16contiguous_rangeENS3_IhLm8EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS6_IXsr21__is_primary_templateINS7_Iu14__remove_cvrefIDTclL_ZNS9_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSF_ISN_EESO_E4type10value_typeEEEEvOSK_RKSA_:
  176|    226|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) {
  177|    226|   ranges::assert_equal_byte_lengths(out, in);
  178|    226|   std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  179|    226|}

_ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__14spanIhLm8EEEEEvRKT0_:
   77|    226|inline constexpr void assert_exact_byte_length(const R& r) {
   78|    226|   const std::span s{r};
   79|    226|   if constexpr(statically_spanable_range<R>) {
   80|    226|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   81|       |   } else {
   82|       |      if(s.size_bytes() != expected) {
   83|       |         memory_region_size_violation();
   84|       |      }
   85|       |   }
   86|    226|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__14spanIKhLm8EEEEEvRKT0_:
   77|  18.2k|inline constexpr void assert_exact_byte_length(const R& r) {
   78|  18.2k|   const std::span s{r};
   79|  18.2k|   if constexpr(statically_spanable_range<R>) {
   80|  18.2k|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   81|       |   } else {
   82|       |      if(s.size_bytes() != expected) {
   83|       |         memory_region_size_violation();
   84|       |      }
   85|       |   }
   86|  18.2k|}
_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm1EEETpTkNS0_14spanable_rangeEJNS3_IKhLm8EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|  9.14k|{
  101|  9.14k|   const std::span s0{r0};
  102|       |
  103|  9.14k|   if constexpr(statically_spanable_range<R0>) {
  104|  9.14k|      constexpr size_t expected_size = s0.size_bytes();
  105|  9.14k|      (assert_exact_byte_length<expected_size>(rs), ...);
  106|       |   } else {
  107|       |      const size_t expected_size = s0.size_bytes();
  108|       |      const bool correct_size =
  109|       |         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|       |      if(!correct_size) {
  112|       |         memory_region_size_violation();
  113|       |      }
  114|       |   }
  115|  9.14k|}
_ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm1EEEEEmRKT_:
   59|  9.37k|inline constexpr size_t size_bytes(const spanable_range auto& r) {
   60|  9.37k|   return std::span{r}.size_bytes();
   61|  9.37k|}
_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEETpTkNS0_14spanable_rangeEJNS3_IKhLm18446744073709551615EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|    226|{
  101|    226|   const std::span s0{r0};
  102|       |
  103|       |   if constexpr(statically_spanable_range<R0>) {
  104|       |      constexpr size_t expected_size = s0.size_bytes();
  105|       |      (assert_exact_byte_length<expected_size>(rs), ...);
  106|    226|   } else {
  107|    226|      const size_t expected_size = s0.size_bytes();
  108|    226|      const bool correct_size =
  109|    226|         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|    226|      if(!correct_size) {
  ------------------
  |  Branch (111:10): [True: 0, False: 226]
  ------------------
  112|      0|         memory_region_size_violation();
  113|      0|      }
  114|    226|   }
  115|    226|}
_ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEEEEmRKT_:
   59|    452|inline constexpr size_t size_bytes(const spanable_range auto& r) {
   60|    452|   return std::span{r}.size_bytes();
   61|    452|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__15arrayIhLm8EEEEEvRKT0_:
   77|    226|inline constexpr void assert_exact_byte_length(const R& r) {
   78|    226|   const std::span s{r};
   79|    226|   if constexpr(statically_spanable_range<R>) {
   80|    226|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   81|       |   } else {
   82|       |      if(s.size_bytes() != expected) {
   83|       |         memory_region_size_violation();
   84|       |      }
   85|       |   }
   86|    226|}
_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm1EEETpTkNS0_14spanable_rangeEJNS3_IhLm8EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|    226|{
  101|    226|   const std::span s0{r0};
  102|       |
  103|    226|   if constexpr(statically_spanable_range<R0>) {
  104|    226|      constexpr size_t expected_size = s0.size_bytes();
  105|    226|      (assert_exact_byte_length<expected_size>(rs), ...);
  106|       |   } else {
  107|       |      const size_t expected_size = s0.size_bytes();
  108|       |      const bool correct_size =
  109|       |         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|       |      if(!correct_size) {
  112|       |         memory_region_size_violation();
  113|       |      }
  114|       |   }
  115|    226|}

_ZN5Botan16secure_allocatorImE10deallocateEPmm:
  102|  1.65k|      void deallocate(T* p, std::size_t n) { deallocate_memory(p, n, sizeof(T)); }
_ZN5Botan16secure_allocatorImE8allocateEm:
   95|  1.65k|      T* allocate(std::size_t n) { return static_cast<T*>(allocate_memory(n, sizeof(T))); }

_ZN5Botan16wrap_strong_typeImRmQoosr3stdE18constructible_fromIT_T0_Eaasr8conceptsE11strong_typeIS2_Esr3stdE18constructible_fromINS2_12wrapped_typeES3_EEEDcOS3_:
  353|  9.37k|[[nodiscard]] constexpr decltype(auto) wrap_strong_type(ParamT&& t) {
  354|  9.37k|   if constexpr(std::same_as<std::remove_cvref_t<ParamT>, T>) {
  355|       |      // Noop, if the parameter type already is the desired return type.
  356|  9.37k|      return std::forward<ParamT>(t);
  357|       |   } else if constexpr(std::constructible_from<T, ParamT>) {
  358|       |      // Implicit conversion from the parameter type to the return type.
  359|       |      return T{std::forward<ParamT>(t)};
  360|       |   } else {
  361|       |      // Explicitly calling the wrapped type's constructor to support
  362|       |      // implicit conversions on types that mark their constructors as explicit.
  363|       |      static_assert(concepts::strong_type<T> && std::constructible_from<typename T::wrapped_type, ParamT>);
  364|       |      return T{typename T::wrapped_type{std::forward<ParamT>(t)}};
  365|       |   }
  366|  9.37k|}

_Z4fuzzNSt3__14spanIKhLm18446744073709551615EEE:
   12|    313|void fuzz(std::span<const uint8_t> in) {
   13|    313|   if(in.size() > 8192 / 8) {
  ------------------
  |  Branch (13:7): [True: 16, False: 297]
  ------------------
   14|     16|      return;
   15|     16|   }
   16|       |
   17|    297|   const Botan::BigInt x = Botan::BigInt::from_bytes(in);
   18|       |
   19|    297|   const Botan::BigInt x_sqr = square(x);
   20|    297|   const Botan::BigInt x_mul = x * x;
   21|       |
   22|    297|   FUZZER_ASSERT_EQUAL(x_sqr, x_mul);
  ------------------
  |  |   79|    297|   do {                                                                                      \
  |  |   80|    297|      if((x) != (y)) {                                                                       \
  |  |  ------------------
  |  |  |  Branch (80:10): [True: 0, False: 297]
  |  |  ------------------
  |  |   81|      0|         FUZZER_WRITE_AND_CRASH(#x << " = " << (x) << " != " << #y << " = " << (y) << "\n"); \
  |  |  ------------------
  |  |  |  |   70|      0|   do {                                                                                                       \
  |  |  |  |   71|      0|      std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \
  |  |  |  |   72|      0|      abort();                                                                                                \
  |  |  |  |   73|      0|   } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (73:12): [Folded, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   82|      0|      }                                                                                      \
  |  |   83|    297|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 297]
  |  |  ------------------
  ------------------
   23|    297|}

LLVMFuzzerInitialize:
   28|      2|extern "C" int LLVMFuzzerInitialize(int* /*argc*/, char*** /*argv*/) {
   29|       |   /*
   30|       |   * This disables the mlock pool, as overwrites within the pool are
   31|       |   * opaque to ASan or other instrumentation.
   32|       |   */
   33|      2|   ::setenv("BOTAN_MLOCK_POOL_SIZE", "0", 1);
   34|      2|   return 0;
   35|      2|}
LLVMFuzzerTestOneInput:
   39|    323|extern "C" int LLVMFuzzerTestOneInput(const uint8_t in[], size_t len) {
   40|    323|   if(len <= max_fuzzer_input_size) {
  ------------------
  |  Branch (40:7): [True: 313, False: 10]
  ------------------
   41|    313|      try {
   42|    313|         fuzz(std::span<const uint8_t>(in, len));
   43|    313|      } catch(const std::exception& e) {
   44|      0|         std::cerr << "Uncaught exception from fuzzer driver " << e.what() << "\n";
   45|      0|         abort();
   46|      0|      } catch(...) {
   47|      0|         std::cerr << "Uncaught exception from fuzzer driver (unknown type)\n";
   48|      0|         abort();
   49|      0|      }
   50|    313|   }
   51|    323|   return 0;
   52|    323|}

_ZN5Botan6BigInt6squareERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  191|    297|BigInt& BigInt::square(secure_vector<word>& ws) {
  192|    297|   const size_t sw = sig_words();
  193|       |
  194|    297|   secure_vector<word> z(2 * sw);
  195|    297|   ws.resize(z.size());
  196|       |
  197|    297|   bigint_sqr(z.data(), z.size(), _data(), size(), sw, ws.data(), ws.size());
  198|       |
  199|    297|   swap_reg(z);
  200|    297|   set_sign(BigInt::Positive);
  201|       |
  202|    297|   return (*this);
  203|    297|}

_ZN5BotanmlERKNS_6BigIntES2_:
   57|    297|BigInt operator*(const BigInt& x, const BigInt& y) {
   58|    297|   const size_t x_sw = x.sig_words();
   59|    297|   const size_t y_sw = y.sig_words();
   60|       |
   61|    297|   BigInt z = BigInt::with_capacity(x.size() + y.size());
   62|       |
   63|    297|   if(x_sw == 1 && y_sw > 0) {
  ------------------
  |  Branch (63:7): [True: 119, False: 178]
  |  Branch (63:20): [True: 119, False: 0]
  ------------------
   64|    119|      bigint_linmul3(z.mutable_data(), y._data(), y_sw, x.word_at(0));
   65|    178|   } else if(y_sw == 1 && x_sw > 0) {
  ------------------
  |  Branch (65:14): [True: 0, False: 178]
  |  Branch (65:27): [True: 0, False: 0]
  ------------------
   66|      0|      bigint_linmul3(z.mutable_data(), x._data(), x_sw, y.word_at(0));
   67|    178|   } else if(x_sw > 0 && y_sw > 0) {
  ------------------
  |  Branch (67:14): [True: 174, False: 4]
  |  Branch (67:26): [True: 174, False: 0]
  ------------------
   68|    174|      secure_vector<word> workspace(z.size());
   69|       |
   70|    174|      bigint_mul(z.mutable_data(),
   71|    174|                 z.size(),
   72|    174|                 x._data(),
   73|    174|                 x.size(),
   74|    174|                 x_sw,
   75|    174|                 y._data(),
   76|    174|                 y.size(),
   77|    174|                 y_sw,
   78|    174|                 workspace.data(),
   79|    174|                 workspace.size());
   80|    174|   }
   81|       |
   82|    297|   z.cond_flip_sign(x_sw > 0 && y_sw > 0 && x.sign() != y.sign());
  ------------------
  |  Branch (82:21): [True: 293, False: 4]
  |  Branch (82:33): [True: 293, False: 0]
  |  Branch (82:45): [True: 0, False: 293]
  ------------------
   83|       |
   84|    297|   return z;
   85|    297|}

_ZN5Botan6BigInt13with_capacityEm:
   50|    297|BigInt BigInt::with_capacity(size_t size) {
   51|    297|   BigInt bn;
   52|    297|   bn.grow_to(size);
   53|    297|   return bn;
   54|    297|}
_ZN5Botan6BigInt10from_bytesENSt3__14spanIKhLm18446744073709551615EEE:
   82|    297|BigInt BigInt::from_bytes(std::span<const uint8_t> input) {
   83|    297|   BigInt r;
   84|    297|   r.assign_from_bytes(input);
   85|    297|   return r;
   86|    297|}
_ZNK5Botan6BigInt8is_equalERKS0_:
  155|    297|bool BigInt::is_equal(const BigInt& other) const {
  156|    297|   if(this->sign() != other.sign()) {
  ------------------
  |  Branch (156:7): [True: 0, False: 297]
  ------------------
  157|      0|      return false;
  158|      0|   }
  159|       |
  160|    297|   return bigint_ct_is_eq(this->_data(), this->size(), other._data(), other.size()).as_bool();
  161|    297|}
_ZN5Botan6BigInt4Data11set_to_zeroEv:
  190|    297|void BigInt::Data::set_to_zero() {
  191|    297|   m_reg.resize(m_reg.capacity());
  192|    297|   clear_mem(m_reg.data(), m_reg.size());
  193|    297|   m_sig_words = 0;
  194|    297|}
_ZNK5Botan6BigInt4Data14calc_sig_wordsEv:
  214|    594|size_t BigInt::Data::calc_sig_words() const {
  215|    594|   const size_t sz = m_reg.size();
  216|    594|   size_t sig = sz;
  217|       |
  218|    594|   word sub = 1;
  219|       |
  220|  22.5k|   for(size_t i = 0; i != sz; ++i) {
  ------------------
  |  Branch (220:22): [True: 21.9k, False: 594]
  ------------------
  221|  21.9k|      const word w = m_reg[sz - i - 1];
  222|  21.9k|      sub &= ct_is_zero(w);
  223|  21.9k|      sig -= sub;
  224|  21.9k|   }
  225|       |
  226|       |   /*
  227|       |   * This depends on the data so is poisoned, but unpoison it here as
  228|       |   * later conditionals are made on the size.
  229|       |   */
  230|    594|   CT::unpoison(sig);
  231|       |
  232|    594|   return sig;
  233|    594|}
_ZN5Botan6BigInt17assign_from_bytesENSt3__14spanIKhLm18446744073709551615EEE:
  424|    297|void BigInt::assign_from_bytes(std::span<const uint8_t> bytes) {
  425|    297|   clear();
  426|       |
  427|    297|   const size_t length = bytes.size();
  428|    297|   const size_t full_words = length / sizeof(word);
  429|    297|   const size_t extra_bytes = length % sizeof(word);
  430|       |
  431|    297|   secure_vector<word> reg((round_up(full_words + (extra_bytes > 0 ? 1 : 0), 8)));
  ------------------
  |  Branch (431:52): [True: 226, False: 71]
  ------------------
  432|       |
  433|  9.44k|   for(size_t i = 0; i != full_words; ++i) {
  ------------------
  |  Branch (433:22): [True: 9.14k, False: 297]
  ------------------
  434|  9.14k|      reg[i] = load_be<word>(bytes.last<sizeof(word)>());
  435|  9.14k|      bytes = bytes.first(bytes.size() - sizeof(word));
  436|  9.14k|   }
  437|       |
  438|    297|   if(!bytes.empty()) {
  ------------------
  |  Branch (438:7): [True: 226, False: 71]
  ------------------
  439|    226|      BOTAN_ASSERT_NOMSG(extra_bytes == bytes.size());
  ------------------
  |  |   84|    226|   do {                                                                     \
  |  |   85|    226|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   86|    226|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (86:10): [True: 0, False: 226]
  |  |  ------------------
  |  |   87|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   88|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   89|      0|      }                                                                     \
  |  |   90|    226|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded, False: 226]
  |  |  ------------------
  ------------------
  440|    226|      std::array<uint8_t, sizeof(word)> last_partial_word = {0};
  441|    226|      copy_mem(std::span{last_partial_word}.last(extra_bytes), bytes);
  442|    226|      reg[full_words] = load_be<word>(last_partial_word);
  443|    226|   }
  444|       |
  445|    297|   m_data.swap(reg);
  446|    297|}
_ZN5Botan6BigInt14cond_flip_signEb:
  520|    297|void BigInt::cond_flip_sign(bool predicate) {
  521|       |   // This code is assuming Negative == 0, Positive == 1
  522|       |
  523|    297|   const auto mask = CT::Mask<uint8_t>::expand_bool(predicate);
  524|       |
  525|    297|   const uint8_t current_sign = static_cast<uint8_t>(sign());
  526|       |
  527|    297|   const uint8_t new_sign = mask.select(current_sign ^ 1, current_sign);
  528|       |
  529|    297|   set_sign(static_cast<Sign>(new_sign));
  530|    297|}
_ZNK5Botan6BigInt20_const_time_unpoisonEv:
  558|    891|void BigInt::_const_time_unpoison() const {
  559|    891|   CT::unpoison(m_data.const_data(), m_data.size());
  560|    891|}

_ZN5Botan17bigint_comba_sqr4EPmPKm:
   17|      4|void bigint_comba_sqr4(word z[8], const word x[4]) {
   18|      4|   word3<word> accum;
   19|       |
   20|      4|   accum.mul(x[0], x[0]);
   21|      4|   z[0] = accum.extract();
   22|      4|   accum.mul_x2(x[0], x[1]);
   23|      4|   z[1] = accum.extract();
   24|      4|   accum.mul_x2(x[0], x[2]);
   25|      4|   accum.mul(x[1], x[1]);
   26|      4|   z[2] = accum.extract();
   27|      4|   accum.mul_x2(x[0], x[3]);
   28|      4|   accum.mul_x2(x[1], x[2]);
   29|      4|   z[3] = accum.extract();
   30|      4|   accum.mul_x2(x[1], x[3]);
   31|      4|   accum.mul(x[2], x[2]);
   32|      4|   z[4] = accum.extract();
   33|      4|   accum.mul_x2(x[2], x[3]);
   34|      4|   z[5] = accum.extract();
   35|      4|   accum.mul(x[3], x[3]);
   36|      4|   z[6] = accum.extract();
   37|      4|   z[7] = accum.extract();
   38|      4|}
_ZN5Botan17bigint_comba_mul4EPmPKmS2_:
   43|     19|void bigint_comba_mul4(word z[8], const word x[4], const word y[4]) {
   44|     19|   word3<word> accum;
   45|       |
   46|     19|   accum.mul(x[0], y[0]);
   47|     19|   z[0] = accum.extract();
   48|     19|   accum.mul(x[0], y[1]);
   49|     19|   accum.mul(x[1], y[0]);
   50|     19|   z[1] = accum.extract();
   51|     19|   accum.mul(x[0], y[2]);
   52|     19|   accum.mul(x[1], y[1]);
   53|     19|   accum.mul(x[2], y[0]);
   54|     19|   z[2] = accum.extract();
   55|     19|   accum.mul(x[0], y[3]);
   56|     19|   accum.mul(x[1], y[2]);
   57|     19|   accum.mul(x[2], y[1]);
   58|     19|   accum.mul(x[3], y[0]);
   59|     19|   z[3] = accum.extract();
   60|     19|   accum.mul(x[1], y[3]);
   61|     19|   accum.mul(x[2], y[2]);
   62|     19|   accum.mul(x[3], y[1]);
   63|     19|   z[4] = accum.extract();
   64|     19|   accum.mul(x[2], y[3]);
   65|     19|   accum.mul(x[3], y[2]);
   66|     19|   z[5] = accum.extract();
   67|     19|   accum.mul(x[3], y[3]);
   68|     19|   z[6] = accum.extract();
   69|     19|   z[7] = accum.extract();
   70|     19|}
_ZN5Botan17bigint_comba_sqr6EPmPKm:
   75|      2|void bigint_comba_sqr6(word z[12], const word x[6]) {
   76|      2|   word3<word> accum;
   77|       |
   78|      2|   accum.mul(x[0], x[0]);
   79|      2|   z[0] = accum.extract();
   80|      2|   accum.mul_x2(x[0], x[1]);
   81|      2|   z[1] = accum.extract();
   82|      2|   accum.mul_x2(x[0], x[2]);
   83|      2|   accum.mul(x[1], x[1]);
   84|      2|   z[2] = accum.extract();
   85|      2|   accum.mul_x2(x[0], x[3]);
   86|      2|   accum.mul_x2(x[1], x[2]);
   87|      2|   z[3] = accum.extract();
   88|      2|   accum.mul_x2(x[0], x[4]);
   89|      2|   accum.mul_x2(x[1], x[3]);
   90|      2|   accum.mul(x[2], x[2]);
   91|      2|   z[4] = accum.extract();
   92|      2|   accum.mul_x2(x[0], x[5]);
   93|      2|   accum.mul_x2(x[1], x[4]);
   94|      2|   accum.mul_x2(x[2], x[3]);
   95|      2|   z[5] = accum.extract();
   96|      2|   accum.mul_x2(x[1], x[5]);
   97|      2|   accum.mul_x2(x[2], x[4]);
   98|      2|   accum.mul(x[3], x[3]);
   99|      2|   z[6] = accum.extract();
  100|      2|   accum.mul_x2(x[2], x[5]);
  101|      2|   accum.mul_x2(x[3], x[4]);
  102|      2|   z[7] = accum.extract();
  103|      2|   accum.mul_x2(x[3], x[5]);
  104|      2|   accum.mul(x[4], x[4]);
  105|      2|   z[8] = accum.extract();
  106|      2|   accum.mul_x2(x[4], x[5]);
  107|      2|   z[9] = accum.extract();
  108|      2|   accum.mul(x[5], x[5]);
  109|      2|   z[10] = accum.extract();
  110|      2|   z[11] = accum.extract();
  111|      2|}
_ZN5Botan17bigint_comba_mul6EPmPKmS2_:
  116|      7|void bigint_comba_mul6(word z[12], const word x[6], const word y[6]) {
  117|      7|   word3<word> accum;
  118|       |
  119|      7|   accum.mul(x[0], y[0]);
  120|      7|   z[0] = accum.extract();
  121|      7|   accum.mul(x[0], y[1]);
  122|      7|   accum.mul(x[1], y[0]);
  123|      7|   z[1] = accum.extract();
  124|      7|   accum.mul(x[0], y[2]);
  125|      7|   accum.mul(x[1], y[1]);
  126|      7|   accum.mul(x[2], y[0]);
  127|      7|   z[2] = accum.extract();
  128|      7|   accum.mul(x[0], y[3]);
  129|      7|   accum.mul(x[1], y[2]);
  130|      7|   accum.mul(x[2], y[1]);
  131|      7|   accum.mul(x[3], y[0]);
  132|      7|   z[3] = accum.extract();
  133|      7|   accum.mul(x[0], y[4]);
  134|      7|   accum.mul(x[1], y[3]);
  135|      7|   accum.mul(x[2], y[2]);
  136|      7|   accum.mul(x[3], y[1]);
  137|      7|   accum.mul(x[4], y[0]);
  138|      7|   z[4] = accum.extract();
  139|      7|   accum.mul(x[0], y[5]);
  140|      7|   accum.mul(x[1], y[4]);
  141|      7|   accum.mul(x[2], y[3]);
  142|      7|   accum.mul(x[3], y[2]);
  143|      7|   accum.mul(x[4], y[1]);
  144|      7|   accum.mul(x[5], y[0]);
  145|      7|   z[5] = accum.extract();
  146|      7|   accum.mul(x[1], y[5]);
  147|      7|   accum.mul(x[2], y[4]);
  148|      7|   accum.mul(x[3], y[3]);
  149|      7|   accum.mul(x[4], y[2]);
  150|      7|   accum.mul(x[5], y[1]);
  151|      7|   z[6] = accum.extract();
  152|      7|   accum.mul(x[2], y[5]);
  153|      7|   accum.mul(x[3], y[4]);
  154|      7|   accum.mul(x[4], y[3]);
  155|      7|   accum.mul(x[5], y[2]);
  156|      7|   z[7] = accum.extract();
  157|      7|   accum.mul(x[3], y[5]);
  158|      7|   accum.mul(x[4], y[4]);
  159|      7|   accum.mul(x[5], y[3]);
  160|      7|   z[8] = accum.extract();
  161|      7|   accum.mul(x[4], y[5]);
  162|      7|   accum.mul(x[5], y[4]);
  163|      7|   z[9] = accum.extract();
  164|      7|   accum.mul(x[5], y[5]);
  165|      7|   z[10] = accum.extract();
  166|      7|   z[11] = accum.extract();
  167|      7|}
_ZN5Botan17bigint_comba_sqr8EPmPKm:
  293|      5|void bigint_comba_sqr8(word z[16], const word x[8]) {
  294|      5|   word3<word> accum;
  295|       |
  296|      5|   accum.mul(x[0], x[0]);
  297|      5|   z[0] = accum.extract();
  298|      5|   accum.mul_x2(x[0], x[1]);
  299|      5|   z[1] = accum.extract();
  300|      5|   accum.mul_x2(x[0], x[2]);
  301|      5|   accum.mul(x[1], x[1]);
  302|      5|   z[2] = accum.extract();
  303|      5|   accum.mul_x2(x[0], x[3]);
  304|      5|   accum.mul_x2(x[1], x[2]);
  305|      5|   z[3] = accum.extract();
  306|      5|   accum.mul_x2(x[0], x[4]);
  307|      5|   accum.mul_x2(x[1], x[3]);
  308|      5|   accum.mul(x[2], x[2]);
  309|      5|   z[4] = accum.extract();
  310|      5|   accum.mul_x2(x[0], x[5]);
  311|      5|   accum.mul_x2(x[1], x[4]);
  312|      5|   accum.mul_x2(x[2], x[3]);
  313|      5|   z[5] = accum.extract();
  314|      5|   accum.mul_x2(x[0], x[6]);
  315|      5|   accum.mul_x2(x[1], x[5]);
  316|      5|   accum.mul_x2(x[2], x[4]);
  317|      5|   accum.mul(x[3], x[3]);
  318|      5|   z[6] = accum.extract();
  319|      5|   accum.mul_x2(x[0], x[7]);
  320|      5|   accum.mul_x2(x[1], x[6]);
  321|      5|   accum.mul_x2(x[2], x[5]);
  322|      5|   accum.mul_x2(x[3], x[4]);
  323|      5|   z[7] = accum.extract();
  324|      5|   accum.mul_x2(x[1], x[7]);
  325|      5|   accum.mul_x2(x[2], x[6]);
  326|      5|   accum.mul_x2(x[3], x[5]);
  327|      5|   accum.mul(x[4], x[4]);
  328|      5|   z[8] = accum.extract();
  329|      5|   accum.mul_x2(x[2], x[7]);
  330|      5|   accum.mul_x2(x[3], x[6]);
  331|      5|   accum.mul_x2(x[4], x[5]);
  332|      5|   z[9] = accum.extract();
  333|      5|   accum.mul_x2(x[3], x[7]);
  334|      5|   accum.mul_x2(x[4], x[6]);
  335|      5|   accum.mul(x[5], x[5]);
  336|      5|   z[10] = accum.extract();
  337|      5|   accum.mul_x2(x[4], x[7]);
  338|      5|   accum.mul_x2(x[5], x[6]);
  339|      5|   z[11] = accum.extract();
  340|      5|   accum.mul_x2(x[5], x[7]);
  341|      5|   accum.mul(x[6], x[6]);
  342|      5|   z[12] = accum.extract();
  343|      5|   accum.mul_x2(x[6], x[7]);
  344|      5|   z[13] = accum.extract();
  345|      5|   accum.mul(x[7], x[7]);
  346|      5|   z[14] = accum.extract();
  347|      5|   z[15] = accum.extract();
  348|      5|}
_ZN5Botan17bigint_comba_mul8EPmPKmS2_:
  353|     11|void bigint_comba_mul8(word z[16], const word x[8], const word y[8]) {
  354|     11|   word3<word> accum;
  355|       |
  356|     11|   accum.mul(x[0], y[0]);
  357|     11|   z[0] = accum.extract();
  358|     11|   accum.mul(x[0], y[1]);
  359|     11|   accum.mul(x[1], y[0]);
  360|     11|   z[1] = accum.extract();
  361|     11|   accum.mul(x[0], y[2]);
  362|     11|   accum.mul(x[1], y[1]);
  363|     11|   accum.mul(x[2], y[0]);
  364|     11|   z[2] = accum.extract();
  365|     11|   accum.mul(x[0], y[3]);
  366|     11|   accum.mul(x[1], y[2]);
  367|     11|   accum.mul(x[2], y[1]);
  368|     11|   accum.mul(x[3], y[0]);
  369|     11|   z[3] = accum.extract();
  370|     11|   accum.mul(x[0], y[4]);
  371|     11|   accum.mul(x[1], y[3]);
  372|     11|   accum.mul(x[2], y[2]);
  373|     11|   accum.mul(x[3], y[1]);
  374|     11|   accum.mul(x[4], y[0]);
  375|     11|   z[4] = accum.extract();
  376|     11|   accum.mul(x[0], y[5]);
  377|     11|   accum.mul(x[1], y[4]);
  378|     11|   accum.mul(x[2], y[3]);
  379|     11|   accum.mul(x[3], y[2]);
  380|     11|   accum.mul(x[4], y[1]);
  381|     11|   accum.mul(x[5], y[0]);
  382|     11|   z[5] = accum.extract();
  383|     11|   accum.mul(x[0], y[6]);
  384|     11|   accum.mul(x[1], y[5]);
  385|     11|   accum.mul(x[2], y[4]);
  386|     11|   accum.mul(x[3], y[3]);
  387|     11|   accum.mul(x[4], y[2]);
  388|     11|   accum.mul(x[5], y[1]);
  389|     11|   accum.mul(x[6], y[0]);
  390|     11|   z[6] = accum.extract();
  391|     11|   accum.mul(x[0], y[7]);
  392|     11|   accum.mul(x[1], y[6]);
  393|     11|   accum.mul(x[2], y[5]);
  394|     11|   accum.mul(x[3], y[4]);
  395|     11|   accum.mul(x[4], y[3]);
  396|     11|   accum.mul(x[5], y[2]);
  397|     11|   accum.mul(x[6], y[1]);
  398|     11|   accum.mul(x[7], y[0]);
  399|     11|   z[7] = accum.extract();
  400|     11|   accum.mul(x[1], y[7]);
  401|     11|   accum.mul(x[2], y[6]);
  402|     11|   accum.mul(x[3], y[5]);
  403|     11|   accum.mul(x[4], y[4]);
  404|     11|   accum.mul(x[5], y[3]);
  405|     11|   accum.mul(x[6], y[2]);
  406|     11|   accum.mul(x[7], y[1]);
  407|     11|   z[8] = accum.extract();
  408|     11|   accum.mul(x[2], y[7]);
  409|     11|   accum.mul(x[3], y[6]);
  410|     11|   accum.mul(x[4], y[5]);
  411|     11|   accum.mul(x[5], y[4]);
  412|     11|   accum.mul(x[6], y[3]);
  413|     11|   accum.mul(x[7], y[2]);
  414|     11|   z[9] = accum.extract();
  415|     11|   accum.mul(x[3], y[7]);
  416|     11|   accum.mul(x[4], y[6]);
  417|     11|   accum.mul(x[5], y[5]);
  418|     11|   accum.mul(x[6], y[4]);
  419|     11|   accum.mul(x[7], y[3]);
  420|     11|   z[10] = accum.extract();
  421|     11|   accum.mul(x[4], y[7]);
  422|     11|   accum.mul(x[5], y[6]);
  423|     11|   accum.mul(x[6], y[5]);
  424|     11|   accum.mul(x[7], y[4]);
  425|     11|   z[11] = accum.extract();
  426|     11|   accum.mul(x[5], y[7]);
  427|     11|   accum.mul(x[6], y[6]);
  428|     11|   accum.mul(x[7], y[5]);
  429|     11|   z[12] = accum.extract();
  430|     11|   accum.mul(x[6], y[7]);
  431|     11|   accum.mul(x[7], y[6]);
  432|     11|   z[13] = accum.extract();
  433|     11|   accum.mul(x[7], y[7]);
  434|     11|   z[14] = accum.extract();
  435|     11|   z[15] = accum.extract();
  436|     11|}
_ZN5Botan17bigint_comba_sqr9EPmPKm:
  441|      5|void bigint_comba_sqr9(word z[18], const word x[9]) {
  442|      5|   word3<word> accum;
  443|       |
  444|      5|   accum.mul(x[0], x[0]);
  445|      5|   z[0] = accum.extract();
  446|      5|   accum.mul_x2(x[0], x[1]);
  447|      5|   z[1] = accum.extract();
  448|      5|   accum.mul_x2(x[0], x[2]);
  449|      5|   accum.mul(x[1], x[1]);
  450|      5|   z[2] = accum.extract();
  451|      5|   accum.mul_x2(x[0], x[3]);
  452|      5|   accum.mul_x2(x[1], x[2]);
  453|      5|   z[3] = accum.extract();
  454|      5|   accum.mul_x2(x[0], x[4]);
  455|      5|   accum.mul_x2(x[1], x[3]);
  456|      5|   accum.mul(x[2], x[2]);
  457|      5|   z[4] = accum.extract();
  458|      5|   accum.mul_x2(x[0], x[5]);
  459|      5|   accum.mul_x2(x[1], x[4]);
  460|      5|   accum.mul_x2(x[2], x[3]);
  461|      5|   z[5] = accum.extract();
  462|      5|   accum.mul_x2(x[0], x[6]);
  463|      5|   accum.mul_x2(x[1], x[5]);
  464|      5|   accum.mul_x2(x[2], x[4]);
  465|      5|   accum.mul(x[3], x[3]);
  466|      5|   z[6] = accum.extract();
  467|      5|   accum.mul_x2(x[0], x[7]);
  468|      5|   accum.mul_x2(x[1], x[6]);
  469|      5|   accum.mul_x2(x[2], x[5]);
  470|      5|   accum.mul_x2(x[3], x[4]);
  471|      5|   z[7] = accum.extract();
  472|      5|   accum.mul_x2(x[0], x[8]);
  473|      5|   accum.mul_x2(x[1], x[7]);
  474|      5|   accum.mul_x2(x[2], x[6]);
  475|      5|   accum.mul_x2(x[3], x[5]);
  476|      5|   accum.mul(x[4], x[4]);
  477|      5|   z[8] = accum.extract();
  478|      5|   accum.mul_x2(x[1], x[8]);
  479|      5|   accum.mul_x2(x[2], x[7]);
  480|      5|   accum.mul_x2(x[3], x[6]);
  481|      5|   accum.mul_x2(x[4], x[5]);
  482|      5|   z[9] = accum.extract();
  483|      5|   accum.mul_x2(x[2], x[8]);
  484|      5|   accum.mul_x2(x[3], x[7]);
  485|      5|   accum.mul_x2(x[4], x[6]);
  486|      5|   accum.mul(x[5], x[5]);
  487|      5|   z[10] = accum.extract();
  488|      5|   accum.mul_x2(x[3], x[8]);
  489|      5|   accum.mul_x2(x[4], x[7]);
  490|      5|   accum.mul_x2(x[5], x[6]);
  491|      5|   z[11] = accum.extract();
  492|      5|   accum.mul_x2(x[4], x[8]);
  493|      5|   accum.mul_x2(x[5], x[7]);
  494|      5|   accum.mul(x[6], x[6]);
  495|      5|   z[12] = accum.extract();
  496|      5|   accum.mul_x2(x[5], x[8]);
  497|      5|   accum.mul_x2(x[6], x[7]);
  498|      5|   z[13] = accum.extract();
  499|      5|   accum.mul_x2(x[6], x[8]);
  500|      5|   accum.mul(x[7], x[7]);
  501|      5|   z[14] = accum.extract();
  502|      5|   accum.mul_x2(x[7], x[8]);
  503|      5|   z[15] = accum.extract();
  504|      5|   accum.mul(x[8], x[8]);
  505|      5|   z[16] = accum.extract();
  506|      5|   z[17] = accum.extract();
  507|      5|}
_ZN5Botan17bigint_comba_mul9EPmPKmS2_:
  512|      5|void bigint_comba_mul9(word z[18], const word x[9], const word y[9]) {
  513|      5|   word3<word> accum;
  514|       |
  515|      5|   accum.mul(x[0], y[0]);
  516|      5|   z[0] = accum.extract();
  517|      5|   accum.mul(x[0], y[1]);
  518|      5|   accum.mul(x[1], y[0]);
  519|      5|   z[1] = accum.extract();
  520|      5|   accum.mul(x[0], y[2]);
  521|      5|   accum.mul(x[1], y[1]);
  522|      5|   accum.mul(x[2], y[0]);
  523|      5|   z[2] = accum.extract();
  524|      5|   accum.mul(x[0], y[3]);
  525|      5|   accum.mul(x[1], y[2]);
  526|      5|   accum.mul(x[2], y[1]);
  527|      5|   accum.mul(x[3], y[0]);
  528|      5|   z[3] = accum.extract();
  529|      5|   accum.mul(x[0], y[4]);
  530|      5|   accum.mul(x[1], y[3]);
  531|      5|   accum.mul(x[2], y[2]);
  532|      5|   accum.mul(x[3], y[1]);
  533|      5|   accum.mul(x[4], y[0]);
  534|      5|   z[4] = accum.extract();
  535|      5|   accum.mul(x[0], y[5]);
  536|      5|   accum.mul(x[1], y[4]);
  537|      5|   accum.mul(x[2], y[3]);
  538|      5|   accum.mul(x[3], y[2]);
  539|      5|   accum.mul(x[4], y[1]);
  540|      5|   accum.mul(x[5], y[0]);
  541|      5|   z[5] = accum.extract();
  542|      5|   accum.mul(x[0], y[6]);
  543|      5|   accum.mul(x[1], y[5]);
  544|      5|   accum.mul(x[2], y[4]);
  545|      5|   accum.mul(x[3], y[3]);
  546|      5|   accum.mul(x[4], y[2]);
  547|      5|   accum.mul(x[5], y[1]);
  548|      5|   accum.mul(x[6], y[0]);
  549|      5|   z[6] = accum.extract();
  550|      5|   accum.mul(x[0], y[7]);
  551|      5|   accum.mul(x[1], y[6]);
  552|      5|   accum.mul(x[2], y[5]);
  553|      5|   accum.mul(x[3], y[4]);
  554|      5|   accum.mul(x[4], y[3]);
  555|      5|   accum.mul(x[5], y[2]);
  556|      5|   accum.mul(x[6], y[1]);
  557|      5|   accum.mul(x[7], y[0]);
  558|      5|   z[7] = accum.extract();
  559|      5|   accum.mul(x[0], y[8]);
  560|      5|   accum.mul(x[1], y[7]);
  561|      5|   accum.mul(x[2], y[6]);
  562|      5|   accum.mul(x[3], y[5]);
  563|      5|   accum.mul(x[4], y[4]);
  564|      5|   accum.mul(x[5], y[3]);
  565|      5|   accum.mul(x[6], y[2]);
  566|      5|   accum.mul(x[7], y[1]);
  567|      5|   accum.mul(x[8], y[0]);
  568|      5|   z[8] = accum.extract();
  569|      5|   accum.mul(x[1], y[8]);
  570|      5|   accum.mul(x[2], y[7]);
  571|      5|   accum.mul(x[3], y[6]);
  572|      5|   accum.mul(x[4], y[5]);
  573|      5|   accum.mul(x[5], y[4]);
  574|      5|   accum.mul(x[6], y[3]);
  575|      5|   accum.mul(x[7], y[2]);
  576|      5|   accum.mul(x[8], y[1]);
  577|      5|   z[9] = accum.extract();
  578|      5|   accum.mul(x[2], y[8]);
  579|      5|   accum.mul(x[3], y[7]);
  580|      5|   accum.mul(x[4], y[6]);
  581|      5|   accum.mul(x[5], y[5]);
  582|      5|   accum.mul(x[6], y[4]);
  583|      5|   accum.mul(x[7], y[3]);
  584|      5|   accum.mul(x[8], y[2]);
  585|      5|   z[10] = accum.extract();
  586|      5|   accum.mul(x[3], y[8]);
  587|      5|   accum.mul(x[4], y[7]);
  588|      5|   accum.mul(x[5], y[6]);
  589|      5|   accum.mul(x[6], y[5]);
  590|      5|   accum.mul(x[7], y[4]);
  591|      5|   accum.mul(x[8], y[3]);
  592|      5|   z[11] = accum.extract();
  593|      5|   accum.mul(x[4], y[8]);
  594|      5|   accum.mul(x[5], y[7]);
  595|      5|   accum.mul(x[6], y[6]);
  596|      5|   accum.mul(x[7], y[5]);
  597|      5|   accum.mul(x[8], y[4]);
  598|      5|   z[12] = accum.extract();
  599|      5|   accum.mul(x[5], y[8]);
  600|      5|   accum.mul(x[6], y[7]);
  601|      5|   accum.mul(x[7], y[6]);
  602|      5|   accum.mul(x[8], y[5]);
  603|      5|   z[13] = accum.extract();
  604|      5|   accum.mul(x[6], y[8]);
  605|      5|   accum.mul(x[7], y[7]);
  606|      5|   accum.mul(x[8], y[6]);
  607|      5|   z[14] = accum.extract();
  608|      5|   accum.mul(x[7], y[8]);
  609|      5|   accum.mul(x[8], y[7]);
  610|      5|   z[15] = accum.extract();
  611|      5|   accum.mul(x[8], y[8]);
  612|      5|   z[16] = accum.extract();
  613|      5|   z[17] = accum.extract();
  614|      5|}
_ZN5Botan18bigint_comba_sqr16EPmPKm:
  619|    193|void bigint_comba_sqr16(word z[32], const word x[16]) {
  620|    193|   word3<word> accum;
  621|       |
  622|    193|   accum.mul(x[0], x[0]);
  623|    193|   z[0] = accum.extract();
  624|    193|   accum.mul_x2(x[0], x[1]);
  625|    193|   z[1] = accum.extract();
  626|    193|   accum.mul_x2(x[0], x[2]);
  627|    193|   accum.mul(x[1], x[1]);
  628|    193|   z[2] = accum.extract();
  629|    193|   accum.mul_x2(x[0], x[3]);
  630|    193|   accum.mul_x2(x[1], x[2]);
  631|    193|   z[3] = accum.extract();
  632|    193|   accum.mul_x2(x[0], x[4]);
  633|    193|   accum.mul_x2(x[1], x[3]);
  634|    193|   accum.mul(x[2], x[2]);
  635|    193|   z[4] = accum.extract();
  636|    193|   accum.mul_x2(x[0], x[5]);
  637|    193|   accum.mul_x2(x[1], x[4]);
  638|    193|   accum.mul_x2(x[2], x[3]);
  639|    193|   z[5] = accum.extract();
  640|    193|   accum.mul_x2(x[0], x[6]);
  641|    193|   accum.mul_x2(x[1], x[5]);
  642|    193|   accum.mul_x2(x[2], x[4]);
  643|    193|   accum.mul(x[3], x[3]);
  644|    193|   z[6] = accum.extract();
  645|    193|   accum.mul_x2(x[0], x[7]);
  646|    193|   accum.mul_x2(x[1], x[6]);
  647|    193|   accum.mul_x2(x[2], x[5]);
  648|    193|   accum.mul_x2(x[3], x[4]);
  649|    193|   z[7] = accum.extract();
  650|    193|   accum.mul_x2(x[0], x[8]);
  651|    193|   accum.mul_x2(x[1], x[7]);
  652|    193|   accum.mul_x2(x[2], x[6]);
  653|    193|   accum.mul_x2(x[3], x[5]);
  654|    193|   accum.mul(x[4], x[4]);
  655|    193|   z[8] = accum.extract();
  656|    193|   accum.mul_x2(x[0], x[9]);
  657|    193|   accum.mul_x2(x[1], x[8]);
  658|    193|   accum.mul_x2(x[2], x[7]);
  659|    193|   accum.mul_x2(x[3], x[6]);
  660|    193|   accum.mul_x2(x[4], x[5]);
  661|    193|   z[9] = accum.extract();
  662|    193|   accum.mul_x2(x[0], x[10]);
  663|    193|   accum.mul_x2(x[1], x[9]);
  664|    193|   accum.mul_x2(x[2], x[8]);
  665|    193|   accum.mul_x2(x[3], x[7]);
  666|    193|   accum.mul_x2(x[4], x[6]);
  667|    193|   accum.mul(x[5], x[5]);
  668|    193|   z[10] = accum.extract();
  669|    193|   accum.mul_x2(x[0], x[11]);
  670|    193|   accum.mul_x2(x[1], x[10]);
  671|    193|   accum.mul_x2(x[2], x[9]);
  672|    193|   accum.mul_x2(x[3], x[8]);
  673|    193|   accum.mul_x2(x[4], x[7]);
  674|    193|   accum.mul_x2(x[5], x[6]);
  675|    193|   z[11] = accum.extract();
  676|    193|   accum.mul_x2(x[0], x[12]);
  677|    193|   accum.mul_x2(x[1], x[11]);
  678|    193|   accum.mul_x2(x[2], x[10]);
  679|    193|   accum.mul_x2(x[3], x[9]);
  680|    193|   accum.mul_x2(x[4], x[8]);
  681|    193|   accum.mul_x2(x[5], x[7]);
  682|    193|   accum.mul(x[6], x[6]);
  683|    193|   z[12] = accum.extract();
  684|    193|   accum.mul_x2(x[0], x[13]);
  685|    193|   accum.mul_x2(x[1], x[12]);
  686|    193|   accum.mul_x2(x[2], x[11]);
  687|    193|   accum.mul_x2(x[3], x[10]);
  688|    193|   accum.mul_x2(x[4], x[9]);
  689|    193|   accum.mul_x2(x[5], x[8]);
  690|    193|   accum.mul_x2(x[6], x[7]);
  691|    193|   z[13] = accum.extract();
  692|    193|   accum.mul_x2(x[0], x[14]);
  693|    193|   accum.mul_x2(x[1], x[13]);
  694|    193|   accum.mul_x2(x[2], x[12]);
  695|    193|   accum.mul_x2(x[3], x[11]);
  696|    193|   accum.mul_x2(x[4], x[10]);
  697|    193|   accum.mul_x2(x[5], x[9]);
  698|    193|   accum.mul_x2(x[6], x[8]);
  699|    193|   accum.mul(x[7], x[7]);
  700|    193|   z[14] = accum.extract();
  701|    193|   accum.mul_x2(x[0], x[15]);
  702|    193|   accum.mul_x2(x[1], x[14]);
  703|    193|   accum.mul_x2(x[2], x[13]);
  704|    193|   accum.mul_x2(x[3], x[12]);
  705|    193|   accum.mul_x2(x[4], x[11]);
  706|    193|   accum.mul_x2(x[5], x[10]);
  707|    193|   accum.mul_x2(x[6], x[9]);
  708|    193|   accum.mul_x2(x[7], x[8]);
  709|    193|   z[15] = accum.extract();
  710|    193|   accum.mul_x2(x[1], x[15]);
  711|    193|   accum.mul_x2(x[2], x[14]);
  712|    193|   accum.mul_x2(x[3], x[13]);
  713|    193|   accum.mul_x2(x[4], x[12]);
  714|    193|   accum.mul_x2(x[5], x[11]);
  715|    193|   accum.mul_x2(x[6], x[10]);
  716|    193|   accum.mul_x2(x[7], x[9]);
  717|    193|   accum.mul(x[8], x[8]);
  718|    193|   z[16] = accum.extract();
  719|    193|   accum.mul_x2(x[2], x[15]);
  720|    193|   accum.mul_x2(x[3], x[14]);
  721|    193|   accum.mul_x2(x[4], x[13]);
  722|    193|   accum.mul_x2(x[5], x[12]);
  723|    193|   accum.mul_x2(x[6], x[11]);
  724|    193|   accum.mul_x2(x[7], x[10]);
  725|    193|   accum.mul_x2(x[8], x[9]);
  726|    193|   z[17] = accum.extract();
  727|    193|   accum.mul_x2(x[3], x[15]);
  728|    193|   accum.mul_x2(x[4], x[14]);
  729|    193|   accum.mul_x2(x[5], x[13]);
  730|    193|   accum.mul_x2(x[6], x[12]);
  731|    193|   accum.mul_x2(x[7], x[11]);
  732|    193|   accum.mul_x2(x[8], x[10]);
  733|    193|   accum.mul(x[9], x[9]);
  734|    193|   z[18] = accum.extract();
  735|    193|   accum.mul_x2(x[4], x[15]);
  736|    193|   accum.mul_x2(x[5], x[14]);
  737|    193|   accum.mul_x2(x[6], x[13]);
  738|    193|   accum.mul_x2(x[7], x[12]);
  739|    193|   accum.mul_x2(x[8], x[11]);
  740|    193|   accum.mul_x2(x[9], x[10]);
  741|    193|   z[19] = accum.extract();
  742|    193|   accum.mul_x2(x[5], x[15]);
  743|    193|   accum.mul_x2(x[6], x[14]);
  744|    193|   accum.mul_x2(x[7], x[13]);
  745|    193|   accum.mul_x2(x[8], x[12]);
  746|    193|   accum.mul_x2(x[9], x[11]);
  747|    193|   accum.mul(x[10], x[10]);
  748|    193|   z[20] = accum.extract();
  749|    193|   accum.mul_x2(x[6], x[15]);
  750|    193|   accum.mul_x2(x[7], x[14]);
  751|    193|   accum.mul_x2(x[8], x[13]);
  752|    193|   accum.mul_x2(x[9], x[12]);
  753|    193|   accum.mul_x2(x[10], x[11]);
  754|    193|   z[21] = accum.extract();
  755|    193|   accum.mul_x2(x[7], x[15]);
  756|    193|   accum.mul_x2(x[8], x[14]);
  757|    193|   accum.mul_x2(x[9], x[13]);
  758|    193|   accum.mul_x2(x[10], x[12]);
  759|    193|   accum.mul(x[11], x[11]);
  760|    193|   z[22] = accum.extract();
  761|    193|   accum.mul_x2(x[8], x[15]);
  762|    193|   accum.mul_x2(x[9], x[14]);
  763|    193|   accum.mul_x2(x[10], x[13]);
  764|    193|   accum.mul_x2(x[11], x[12]);
  765|    193|   z[23] = accum.extract();
  766|    193|   accum.mul_x2(x[9], x[15]);
  767|    193|   accum.mul_x2(x[10], x[14]);
  768|    193|   accum.mul_x2(x[11], x[13]);
  769|    193|   accum.mul(x[12], x[12]);
  770|    193|   z[24] = accum.extract();
  771|    193|   accum.mul_x2(x[10], x[15]);
  772|    193|   accum.mul_x2(x[11], x[14]);
  773|    193|   accum.mul_x2(x[12], x[13]);
  774|    193|   z[25] = accum.extract();
  775|    193|   accum.mul_x2(x[11], x[15]);
  776|    193|   accum.mul_x2(x[12], x[14]);
  777|    193|   accum.mul(x[13], x[13]);
  778|    193|   z[26] = accum.extract();
  779|    193|   accum.mul_x2(x[12], x[15]);
  780|    193|   accum.mul_x2(x[13], x[14]);
  781|    193|   z[27] = accum.extract();
  782|    193|   accum.mul_x2(x[13], x[15]);
  783|    193|   accum.mul(x[14], x[14]);
  784|    193|   z[28] = accum.extract();
  785|    193|   accum.mul_x2(x[14], x[15]);
  786|    193|   z[29] = accum.extract();
  787|    193|   accum.mul(x[15], x[15]);
  788|    193|   z[30] = accum.extract();
  789|    193|   z[31] = accum.extract();
  790|    193|}
_ZN5Botan18bigint_comba_mul16EPmPKmS2_:
  795|    342|void bigint_comba_mul16(word z[32], const word x[16], const word y[16]) {
  796|    342|   word3<word> accum;
  797|       |
  798|    342|   accum.mul(x[0], y[0]);
  799|    342|   z[0] = accum.extract();
  800|    342|   accum.mul(x[0], y[1]);
  801|    342|   accum.mul(x[1], y[0]);
  802|    342|   z[1] = accum.extract();
  803|    342|   accum.mul(x[0], y[2]);
  804|    342|   accum.mul(x[1], y[1]);
  805|    342|   accum.mul(x[2], y[0]);
  806|    342|   z[2] = accum.extract();
  807|    342|   accum.mul(x[0], y[3]);
  808|    342|   accum.mul(x[1], y[2]);
  809|    342|   accum.mul(x[2], y[1]);
  810|    342|   accum.mul(x[3], y[0]);
  811|    342|   z[3] = accum.extract();
  812|    342|   accum.mul(x[0], y[4]);
  813|    342|   accum.mul(x[1], y[3]);
  814|    342|   accum.mul(x[2], y[2]);
  815|    342|   accum.mul(x[3], y[1]);
  816|    342|   accum.mul(x[4], y[0]);
  817|    342|   z[4] = accum.extract();
  818|    342|   accum.mul(x[0], y[5]);
  819|    342|   accum.mul(x[1], y[4]);
  820|    342|   accum.mul(x[2], y[3]);
  821|    342|   accum.mul(x[3], y[2]);
  822|    342|   accum.mul(x[4], y[1]);
  823|    342|   accum.mul(x[5], y[0]);
  824|    342|   z[5] = accum.extract();
  825|    342|   accum.mul(x[0], y[6]);
  826|    342|   accum.mul(x[1], y[5]);
  827|    342|   accum.mul(x[2], y[4]);
  828|    342|   accum.mul(x[3], y[3]);
  829|    342|   accum.mul(x[4], y[2]);
  830|    342|   accum.mul(x[5], y[1]);
  831|    342|   accum.mul(x[6], y[0]);
  832|    342|   z[6] = accum.extract();
  833|    342|   accum.mul(x[0], y[7]);
  834|    342|   accum.mul(x[1], y[6]);
  835|    342|   accum.mul(x[2], y[5]);
  836|    342|   accum.mul(x[3], y[4]);
  837|    342|   accum.mul(x[4], y[3]);
  838|    342|   accum.mul(x[5], y[2]);
  839|    342|   accum.mul(x[6], y[1]);
  840|    342|   accum.mul(x[7], y[0]);
  841|    342|   z[7] = accum.extract();
  842|    342|   accum.mul(x[0], y[8]);
  843|    342|   accum.mul(x[1], y[7]);
  844|    342|   accum.mul(x[2], y[6]);
  845|    342|   accum.mul(x[3], y[5]);
  846|    342|   accum.mul(x[4], y[4]);
  847|    342|   accum.mul(x[5], y[3]);
  848|    342|   accum.mul(x[6], y[2]);
  849|    342|   accum.mul(x[7], y[1]);
  850|    342|   accum.mul(x[8], y[0]);
  851|    342|   z[8] = accum.extract();
  852|    342|   accum.mul(x[0], y[9]);
  853|    342|   accum.mul(x[1], y[8]);
  854|    342|   accum.mul(x[2], y[7]);
  855|    342|   accum.mul(x[3], y[6]);
  856|    342|   accum.mul(x[4], y[5]);
  857|    342|   accum.mul(x[5], y[4]);
  858|    342|   accum.mul(x[6], y[3]);
  859|    342|   accum.mul(x[7], y[2]);
  860|    342|   accum.mul(x[8], y[1]);
  861|    342|   accum.mul(x[9], y[0]);
  862|    342|   z[9] = accum.extract();
  863|    342|   accum.mul(x[0], y[10]);
  864|    342|   accum.mul(x[1], y[9]);
  865|    342|   accum.mul(x[2], y[8]);
  866|    342|   accum.mul(x[3], y[7]);
  867|    342|   accum.mul(x[4], y[6]);
  868|    342|   accum.mul(x[5], y[5]);
  869|    342|   accum.mul(x[6], y[4]);
  870|    342|   accum.mul(x[7], y[3]);
  871|    342|   accum.mul(x[8], y[2]);
  872|    342|   accum.mul(x[9], y[1]);
  873|    342|   accum.mul(x[10], y[0]);
  874|    342|   z[10] = accum.extract();
  875|    342|   accum.mul(x[0], y[11]);
  876|    342|   accum.mul(x[1], y[10]);
  877|    342|   accum.mul(x[2], y[9]);
  878|    342|   accum.mul(x[3], y[8]);
  879|    342|   accum.mul(x[4], y[7]);
  880|    342|   accum.mul(x[5], y[6]);
  881|    342|   accum.mul(x[6], y[5]);
  882|    342|   accum.mul(x[7], y[4]);
  883|    342|   accum.mul(x[8], y[3]);
  884|    342|   accum.mul(x[9], y[2]);
  885|    342|   accum.mul(x[10], y[1]);
  886|    342|   accum.mul(x[11], y[0]);
  887|    342|   z[11] = accum.extract();
  888|    342|   accum.mul(x[0], y[12]);
  889|    342|   accum.mul(x[1], y[11]);
  890|    342|   accum.mul(x[2], y[10]);
  891|    342|   accum.mul(x[3], y[9]);
  892|    342|   accum.mul(x[4], y[8]);
  893|    342|   accum.mul(x[5], y[7]);
  894|    342|   accum.mul(x[6], y[6]);
  895|    342|   accum.mul(x[7], y[5]);
  896|    342|   accum.mul(x[8], y[4]);
  897|    342|   accum.mul(x[9], y[3]);
  898|    342|   accum.mul(x[10], y[2]);
  899|    342|   accum.mul(x[11], y[1]);
  900|    342|   accum.mul(x[12], y[0]);
  901|    342|   z[12] = accum.extract();
  902|    342|   accum.mul(x[0], y[13]);
  903|    342|   accum.mul(x[1], y[12]);
  904|    342|   accum.mul(x[2], y[11]);
  905|    342|   accum.mul(x[3], y[10]);
  906|    342|   accum.mul(x[4], y[9]);
  907|    342|   accum.mul(x[5], y[8]);
  908|    342|   accum.mul(x[6], y[7]);
  909|    342|   accum.mul(x[7], y[6]);
  910|    342|   accum.mul(x[8], y[5]);
  911|    342|   accum.mul(x[9], y[4]);
  912|    342|   accum.mul(x[10], y[3]);
  913|    342|   accum.mul(x[11], y[2]);
  914|    342|   accum.mul(x[12], y[1]);
  915|    342|   accum.mul(x[13], y[0]);
  916|    342|   z[13] = accum.extract();
  917|    342|   accum.mul(x[0], y[14]);
  918|    342|   accum.mul(x[1], y[13]);
  919|    342|   accum.mul(x[2], y[12]);
  920|    342|   accum.mul(x[3], y[11]);
  921|    342|   accum.mul(x[4], y[10]);
  922|    342|   accum.mul(x[5], y[9]);
  923|    342|   accum.mul(x[6], y[8]);
  924|    342|   accum.mul(x[7], y[7]);
  925|    342|   accum.mul(x[8], y[6]);
  926|    342|   accum.mul(x[9], y[5]);
  927|    342|   accum.mul(x[10], y[4]);
  928|    342|   accum.mul(x[11], y[3]);
  929|    342|   accum.mul(x[12], y[2]);
  930|    342|   accum.mul(x[13], y[1]);
  931|    342|   accum.mul(x[14], y[0]);
  932|    342|   z[14] = accum.extract();
  933|    342|   accum.mul(x[0], y[15]);
  934|    342|   accum.mul(x[1], y[14]);
  935|    342|   accum.mul(x[2], y[13]);
  936|    342|   accum.mul(x[3], y[12]);
  937|    342|   accum.mul(x[4], y[11]);
  938|    342|   accum.mul(x[5], y[10]);
  939|    342|   accum.mul(x[6], y[9]);
  940|    342|   accum.mul(x[7], y[8]);
  941|    342|   accum.mul(x[8], y[7]);
  942|    342|   accum.mul(x[9], y[6]);
  943|    342|   accum.mul(x[10], y[5]);
  944|    342|   accum.mul(x[11], y[4]);
  945|    342|   accum.mul(x[12], y[3]);
  946|    342|   accum.mul(x[13], y[2]);
  947|    342|   accum.mul(x[14], y[1]);
  948|    342|   accum.mul(x[15], y[0]);
  949|    342|   z[15] = accum.extract();
  950|    342|   accum.mul(x[1], y[15]);
  951|    342|   accum.mul(x[2], y[14]);
  952|    342|   accum.mul(x[3], y[13]);
  953|    342|   accum.mul(x[4], y[12]);
  954|    342|   accum.mul(x[5], y[11]);
  955|    342|   accum.mul(x[6], y[10]);
  956|    342|   accum.mul(x[7], y[9]);
  957|    342|   accum.mul(x[8], y[8]);
  958|    342|   accum.mul(x[9], y[7]);
  959|    342|   accum.mul(x[10], y[6]);
  960|    342|   accum.mul(x[11], y[5]);
  961|    342|   accum.mul(x[12], y[4]);
  962|    342|   accum.mul(x[13], y[3]);
  963|    342|   accum.mul(x[14], y[2]);
  964|    342|   accum.mul(x[15], y[1]);
  965|    342|   z[16] = accum.extract();
  966|    342|   accum.mul(x[2], y[15]);
  967|    342|   accum.mul(x[3], y[14]);
  968|    342|   accum.mul(x[4], y[13]);
  969|    342|   accum.mul(x[5], y[12]);
  970|    342|   accum.mul(x[6], y[11]);
  971|    342|   accum.mul(x[7], y[10]);
  972|    342|   accum.mul(x[8], y[9]);
  973|    342|   accum.mul(x[9], y[8]);
  974|    342|   accum.mul(x[10], y[7]);
  975|    342|   accum.mul(x[11], y[6]);
  976|    342|   accum.mul(x[12], y[5]);
  977|    342|   accum.mul(x[13], y[4]);
  978|    342|   accum.mul(x[14], y[3]);
  979|    342|   accum.mul(x[15], y[2]);
  980|    342|   z[17] = accum.extract();
  981|    342|   accum.mul(x[3], y[15]);
  982|    342|   accum.mul(x[4], y[14]);
  983|    342|   accum.mul(x[5], y[13]);
  984|    342|   accum.mul(x[6], y[12]);
  985|    342|   accum.mul(x[7], y[11]);
  986|    342|   accum.mul(x[8], y[10]);
  987|    342|   accum.mul(x[9], y[9]);
  988|    342|   accum.mul(x[10], y[8]);
  989|    342|   accum.mul(x[11], y[7]);
  990|    342|   accum.mul(x[12], y[6]);
  991|    342|   accum.mul(x[13], y[5]);
  992|    342|   accum.mul(x[14], y[4]);
  993|    342|   accum.mul(x[15], y[3]);
  994|    342|   z[18] = accum.extract();
  995|    342|   accum.mul(x[4], y[15]);
  996|    342|   accum.mul(x[5], y[14]);
  997|    342|   accum.mul(x[6], y[13]);
  998|    342|   accum.mul(x[7], y[12]);
  999|    342|   accum.mul(x[8], y[11]);
 1000|    342|   accum.mul(x[9], y[10]);
 1001|    342|   accum.mul(x[10], y[9]);
 1002|    342|   accum.mul(x[11], y[8]);
 1003|    342|   accum.mul(x[12], y[7]);
 1004|    342|   accum.mul(x[13], y[6]);
 1005|    342|   accum.mul(x[14], y[5]);
 1006|    342|   accum.mul(x[15], y[4]);
 1007|    342|   z[19] = accum.extract();
 1008|    342|   accum.mul(x[5], y[15]);
 1009|    342|   accum.mul(x[6], y[14]);
 1010|    342|   accum.mul(x[7], y[13]);
 1011|    342|   accum.mul(x[8], y[12]);
 1012|    342|   accum.mul(x[9], y[11]);
 1013|    342|   accum.mul(x[10], y[10]);
 1014|    342|   accum.mul(x[11], y[9]);
 1015|    342|   accum.mul(x[12], y[8]);
 1016|    342|   accum.mul(x[13], y[7]);
 1017|    342|   accum.mul(x[14], y[6]);
 1018|    342|   accum.mul(x[15], y[5]);
 1019|    342|   z[20] = accum.extract();
 1020|    342|   accum.mul(x[6], y[15]);
 1021|    342|   accum.mul(x[7], y[14]);
 1022|    342|   accum.mul(x[8], y[13]);
 1023|    342|   accum.mul(x[9], y[12]);
 1024|    342|   accum.mul(x[10], y[11]);
 1025|    342|   accum.mul(x[11], y[10]);
 1026|    342|   accum.mul(x[12], y[9]);
 1027|    342|   accum.mul(x[13], y[8]);
 1028|    342|   accum.mul(x[14], y[7]);
 1029|    342|   accum.mul(x[15], y[6]);
 1030|    342|   z[21] = accum.extract();
 1031|    342|   accum.mul(x[7], y[15]);
 1032|    342|   accum.mul(x[8], y[14]);
 1033|    342|   accum.mul(x[9], y[13]);
 1034|    342|   accum.mul(x[10], y[12]);
 1035|    342|   accum.mul(x[11], y[11]);
 1036|    342|   accum.mul(x[12], y[10]);
 1037|    342|   accum.mul(x[13], y[9]);
 1038|    342|   accum.mul(x[14], y[8]);
 1039|    342|   accum.mul(x[15], y[7]);
 1040|    342|   z[22] = accum.extract();
 1041|    342|   accum.mul(x[8], y[15]);
 1042|    342|   accum.mul(x[9], y[14]);
 1043|    342|   accum.mul(x[10], y[13]);
 1044|    342|   accum.mul(x[11], y[12]);
 1045|    342|   accum.mul(x[12], y[11]);
 1046|    342|   accum.mul(x[13], y[10]);
 1047|    342|   accum.mul(x[14], y[9]);
 1048|    342|   accum.mul(x[15], y[8]);
 1049|    342|   z[23] = accum.extract();
 1050|    342|   accum.mul(x[9], y[15]);
 1051|    342|   accum.mul(x[10], y[14]);
 1052|    342|   accum.mul(x[11], y[13]);
 1053|    342|   accum.mul(x[12], y[12]);
 1054|    342|   accum.mul(x[13], y[11]);
 1055|    342|   accum.mul(x[14], y[10]);
 1056|    342|   accum.mul(x[15], y[9]);
 1057|    342|   z[24] = accum.extract();
 1058|    342|   accum.mul(x[10], y[15]);
 1059|    342|   accum.mul(x[11], y[14]);
 1060|    342|   accum.mul(x[12], y[13]);
 1061|    342|   accum.mul(x[13], y[12]);
 1062|    342|   accum.mul(x[14], y[11]);
 1063|    342|   accum.mul(x[15], y[10]);
 1064|    342|   z[25] = accum.extract();
 1065|    342|   accum.mul(x[11], y[15]);
 1066|    342|   accum.mul(x[12], y[14]);
 1067|    342|   accum.mul(x[13], y[13]);
 1068|    342|   accum.mul(x[14], y[12]);
 1069|    342|   accum.mul(x[15], y[11]);
 1070|    342|   z[26] = accum.extract();
 1071|    342|   accum.mul(x[12], y[15]);
 1072|    342|   accum.mul(x[13], y[14]);
 1073|    342|   accum.mul(x[14], y[13]);
 1074|    342|   accum.mul(x[15], y[12]);
 1075|    342|   z[27] = accum.extract();
 1076|    342|   accum.mul(x[13], y[15]);
 1077|    342|   accum.mul(x[14], y[14]);
 1078|    342|   accum.mul(x[15], y[13]);
 1079|    342|   z[28] = accum.extract();
 1080|    342|   accum.mul(x[14], y[15]);
 1081|    342|   accum.mul(x[15], y[14]);
 1082|    342|   z[29] = accum.extract();
 1083|    342|   accum.mul(x[15], y[15]);
 1084|    342|   z[30] = accum.extract();
 1085|    342|   z[31] = accum.extract();
 1086|    342|}
_ZN5Botan18bigint_comba_sqr24EPmPKm:
 1091|     14|void bigint_comba_sqr24(word z[48], const word x[24]) {
 1092|     14|   word3<word> accum;
 1093|       |
 1094|     14|   accum.mul(x[0], x[0]);
 1095|     14|   z[0] = accum.extract();
 1096|     14|   accum.mul_x2(x[0], x[1]);
 1097|     14|   z[1] = accum.extract();
 1098|     14|   accum.mul_x2(x[0], x[2]);
 1099|     14|   accum.mul(x[1], x[1]);
 1100|     14|   z[2] = accum.extract();
 1101|     14|   accum.mul_x2(x[0], x[3]);
 1102|     14|   accum.mul_x2(x[1], x[2]);
 1103|     14|   z[3] = accum.extract();
 1104|     14|   accum.mul_x2(x[0], x[4]);
 1105|     14|   accum.mul_x2(x[1], x[3]);
 1106|     14|   accum.mul(x[2], x[2]);
 1107|     14|   z[4] = accum.extract();
 1108|     14|   accum.mul_x2(x[0], x[5]);
 1109|     14|   accum.mul_x2(x[1], x[4]);
 1110|     14|   accum.mul_x2(x[2], x[3]);
 1111|     14|   z[5] = accum.extract();
 1112|     14|   accum.mul_x2(x[0], x[6]);
 1113|     14|   accum.mul_x2(x[1], x[5]);
 1114|     14|   accum.mul_x2(x[2], x[4]);
 1115|     14|   accum.mul(x[3], x[3]);
 1116|     14|   z[6] = accum.extract();
 1117|     14|   accum.mul_x2(x[0], x[7]);
 1118|     14|   accum.mul_x2(x[1], x[6]);
 1119|     14|   accum.mul_x2(x[2], x[5]);
 1120|     14|   accum.mul_x2(x[3], x[4]);
 1121|     14|   z[7] = accum.extract();
 1122|     14|   accum.mul_x2(x[0], x[8]);
 1123|     14|   accum.mul_x2(x[1], x[7]);
 1124|     14|   accum.mul_x2(x[2], x[6]);
 1125|     14|   accum.mul_x2(x[3], x[5]);
 1126|     14|   accum.mul(x[4], x[4]);
 1127|     14|   z[8] = accum.extract();
 1128|     14|   accum.mul_x2(x[0], x[9]);
 1129|     14|   accum.mul_x2(x[1], x[8]);
 1130|     14|   accum.mul_x2(x[2], x[7]);
 1131|     14|   accum.mul_x2(x[3], x[6]);
 1132|     14|   accum.mul_x2(x[4], x[5]);
 1133|     14|   z[9] = accum.extract();
 1134|     14|   accum.mul_x2(x[0], x[10]);
 1135|     14|   accum.mul_x2(x[1], x[9]);
 1136|     14|   accum.mul_x2(x[2], x[8]);
 1137|     14|   accum.mul_x2(x[3], x[7]);
 1138|     14|   accum.mul_x2(x[4], x[6]);
 1139|     14|   accum.mul(x[5], x[5]);
 1140|     14|   z[10] = accum.extract();
 1141|     14|   accum.mul_x2(x[0], x[11]);
 1142|     14|   accum.mul_x2(x[1], x[10]);
 1143|     14|   accum.mul_x2(x[2], x[9]);
 1144|     14|   accum.mul_x2(x[3], x[8]);
 1145|     14|   accum.mul_x2(x[4], x[7]);
 1146|     14|   accum.mul_x2(x[5], x[6]);
 1147|     14|   z[11] = accum.extract();
 1148|     14|   accum.mul_x2(x[0], x[12]);
 1149|     14|   accum.mul_x2(x[1], x[11]);
 1150|     14|   accum.mul_x2(x[2], x[10]);
 1151|     14|   accum.mul_x2(x[3], x[9]);
 1152|     14|   accum.mul_x2(x[4], x[8]);
 1153|     14|   accum.mul_x2(x[5], x[7]);
 1154|     14|   accum.mul(x[6], x[6]);
 1155|     14|   z[12] = accum.extract();
 1156|     14|   accum.mul_x2(x[0], x[13]);
 1157|     14|   accum.mul_x2(x[1], x[12]);
 1158|     14|   accum.mul_x2(x[2], x[11]);
 1159|     14|   accum.mul_x2(x[3], x[10]);
 1160|     14|   accum.mul_x2(x[4], x[9]);
 1161|     14|   accum.mul_x2(x[5], x[8]);
 1162|     14|   accum.mul_x2(x[6], x[7]);
 1163|     14|   z[13] = accum.extract();
 1164|     14|   accum.mul_x2(x[0], x[14]);
 1165|     14|   accum.mul_x2(x[1], x[13]);
 1166|     14|   accum.mul_x2(x[2], x[12]);
 1167|     14|   accum.mul_x2(x[3], x[11]);
 1168|     14|   accum.mul_x2(x[4], x[10]);
 1169|     14|   accum.mul_x2(x[5], x[9]);
 1170|     14|   accum.mul_x2(x[6], x[8]);
 1171|     14|   accum.mul(x[7], x[7]);
 1172|     14|   z[14] = accum.extract();
 1173|     14|   accum.mul_x2(x[0], x[15]);
 1174|     14|   accum.mul_x2(x[1], x[14]);
 1175|     14|   accum.mul_x2(x[2], x[13]);
 1176|     14|   accum.mul_x2(x[3], x[12]);
 1177|     14|   accum.mul_x2(x[4], x[11]);
 1178|     14|   accum.mul_x2(x[5], x[10]);
 1179|     14|   accum.mul_x2(x[6], x[9]);
 1180|     14|   accum.mul_x2(x[7], x[8]);
 1181|     14|   z[15] = accum.extract();
 1182|     14|   accum.mul_x2(x[0], x[16]);
 1183|     14|   accum.mul_x2(x[1], x[15]);
 1184|     14|   accum.mul_x2(x[2], x[14]);
 1185|     14|   accum.mul_x2(x[3], x[13]);
 1186|     14|   accum.mul_x2(x[4], x[12]);
 1187|     14|   accum.mul_x2(x[5], x[11]);
 1188|     14|   accum.mul_x2(x[6], x[10]);
 1189|     14|   accum.mul_x2(x[7], x[9]);
 1190|     14|   accum.mul(x[8], x[8]);
 1191|     14|   z[16] = accum.extract();
 1192|     14|   accum.mul_x2(x[0], x[17]);
 1193|     14|   accum.mul_x2(x[1], x[16]);
 1194|     14|   accum.mul_x2(x[2], x[15]);
 1195|     14|   accum.mul_x2(x[3], x[14]);
 1196|     14|   accum.mul_x2(x[4], x[13]);
 1197|     14|   accum.mul_x2(x[5], x[12]);
 1198|     14|   accum.mul_x2(x[6], x[11]);
 1199|     14|   accum.mul_x2(x[7], x[10]);
 1200|     14|   accum.mul_x2(x[8], x[9]);
 1201|     14|   z[17] = accum.extract();
 1202|     14|   accum.mul_x2(x[0], x[18]);
 1203|     14|   accum.mul_x2(x[1], x[17]);
 1204|     14|   accum.mul_x2(x[2], x[16]);
 1205|     14|   accum.mul_x2(x[3], x[15]);
 1206|     14|   accum.mul_x2(x[4], x[14]);
 1207|     14|   accum.mul_x2(x[5], x[13]);
 1208|     14|   accum.mul_x2(x[6], x[12]);
 1209|     14|   accum.mul_x2(x[7], x[11]);
 1210|     14|   accum.mul_x2(x[8], x[10]);
 1211|     14|   accum.mul(x[9], x[9]);
 1212|     14|   z[18] = accum.extract();
 1213|     14|   accum.mul_x2(x[0], x[19]);
 1214|     14|   accum.mul_x2(x[1], x[18]);
 1215|     14|   accum.mul_x2(x[2], x[17]);
 1216|     14|   accum.mul_x2(x[3], x[16]);
 1217|     14|   accum.mul_x2(x[4], x[15]);
 1218|     14|   accum.mul_x2(x[5], x[14]);
 1219|     14|   accum.mul_x2(x[6], x[13]);
 1220|     14|   accum.mul_x2(x[7], x[12]);
 1221|     14|   accum.mul_x2(x[8], x[11]);
 1222|     14|   accum.mul_x2(x[9], x[10]);
 1223|     14|   z[19] = accum.extract();
 1224|     14|   accum.mul_x2(x[0], x[20]);
 1225|     14|   accum.mul_x2(x[1], x[19]);
 1226|     14|   accum.mul_x2(x[2], x[18]);
 1227|     14|   accum.mul_x2(x[3], x[17]);
 1228|     14|   accum.mul_x2(x[4], x[16]);
 1229|     14|   accum.mul_x2(x[5], x[15]);
 1230|     14|   accum.mul_x2(x[6], x[14]);
 1231|     14|   accum.mul_x2(x[7], x[13]);
 1232|     14|   accum.mul_x2(x[8], x[12]);
 1233|     14|   accum.mul_x2(x[9], x[11]);
 1234|     14|   accum.mul(x[10], x[10]);
 1235|     14|   z[20] = accum.extract();
 1236|     14|   accum.mul_x2(x[0], x[21]);
 1237|     14|   accum.mul_x2(x[1], x[20]);
 1238|     14|   accum.mul_x2(x[2], x[19]);
 1239|     14|   accum.mul_x2(x[3], x[18]);
 1240|     14|   accum.mul_x2(x[4], x[17]);
 1241|     14|   accum.mul_x2(x[5], x[16]);
 1242|     14|   accum.mul_x2(x[6], x[15]);
 1243|     14|   accum.mul_x2(x[7], x[14]);
 1244|     14|   accum.mul_x2(x[8], x[13]);
 1245|     14|   accum.mul_x2(x[9], x[12]);
 1246|     14|   accum.mul_x2(x[10], x[11]);
 1247|     14|   z[21] = accum.extract();
 1248|     14|   accum.mul_x2(x[0], x[22]);
 1249|     14|   accum.mul_x2(x[1], x[21]);
 1250|     14|   accum.mul_x2(x[2], x[20]);
 1251|     14|   accum.mul_x2(x[3], x[19]);
 1252|     14|   accum.mul_x2(x[4], x[18]);
 1253|     14|   accum.mul_x2(x[5], x[17]);
 1254|     14|   accum.mul_x2(x[6], x[16]);
 1255|     14|   accum.mul_x2(x[7], x[15]);
 1256|     14|   accum.mul_x2(x[8], x[14]);
 1257|     14|   accum.mul_x2(x[9], x[13]);
 1258|     14|   accum.mul_x2(x[10], x[12]);
 1259|     14|   accum.mul(x[11], x[11]);
 1260|     14|   z[22] = accum.extract();
 1261|     14|   accum.mul_x2(x[0], x[23]);
 1262|     14|   accum.mul_x2(x[1], x[22]);
 1263|     14|   accum.mul_x2(x[2], x[21]);
 1264|     14|   accum.mul_x2(x[3], x[20]);
 1265|     14|   accum.mul_x2(x[4], x[19]);
 1266|     14|   accum.mul_x2(x[5], x[18]);
 1267|     14|   accum.mul_x2(x[6], x[17]);
 1268|     14|   accum.mul_x2(x[7], x[16]);
 1269|     14|   accum.mul_x2(x[8], x[15]);
 1270|     14|   accum.mul_x2(x[9], x[14]);
 1271|     14|   accum.mul_x2(x[10], x[13]);
 1272|     14|   accum.mul_x2(x[11], x[12]);
 1273|     14|   z[23] = accum.extract();
 1274|     14|   accum.mul_x2(x[1], x[23]);
 1275|     14|   accum.mul_x2(x[2], x[22]);
 1276|     14|   accum.mul_x2(x[3], x[21]);
 1277|     14|   accum.mul_x2(x[4], x[20]);
 1278|     14|   accum.mul_x2(x[5], x[19]);
 1279|     14|   accum.mul_x2(x[6], x[18]);
 1280|     14|   accum.mul_x2(x[7], x[17]);
 1281|     14|   accum.mul_x2(x[8], x[16]);
 1282|     14|   accum.mul_x2(x[9], x[15]);
 1283|     14|   accum.mul_x2(x[10], x[14]);
 1284|     14|   accum.mul_x2(x[11], x[13]);
 1285|     14|   accum.mul(x[12], x[12]);
 1286|     14|   z[24] = accum.extract();
 1287|     14|   accum.mul_x2(x[2], x[23]);
 1288|     14|   accum.mul_x2(x[3], x[22]);
 1289|     14|   accum.mul_x2(x[4], x[21]);
 1290|     14|   accum.mul_x2(x[5], x[20]);
 1291|     14|   accum.mul_x2(x[6], x[19]);
 1292|     14|   accum.mul_x2(x[7], x[18]);
 1293|     14|   accum.mul_x2(x[8], x[17]);
 1294|     14|   accum.mul_x2(x[9], x[16]);
 1295|     14|   accum.mul_x2(x[10], x[15]);
 1296|     14|   accum.mul_x2(x[11], x[14]);
 1297|     14|   accum.mul_x2(x[12], x[13]);
 1298|     14|   z[25] = accum.extract();
 1299|     14|   accum.mul_x2(x[3], x[23]);
 1300|     14|   accum.mul_x2(x[4], x[22]);
 1301|     14|   accum.mul_x2(x[5], x[21]);
 1302|     14|   accum.mul_x2(x[6], x[20]);
 1303|     14|   accum.mul_x2(x[7], x[19]);
 1304|     14|   accum.mul_x2(x[8], x[18]);
 1305|     14|   accum.mul_x2(x[9], x[17]);
 1306|     14|   accum.mul_x2(x[10], x[16]);
 1307|     14|   accum.mul_x2(x[11], x[15]);
 1308|     14|   accum.mul_x2(x[12], x[14]);
 1309|     14|   accum.mul(x[13], x[13]);
 1310|     14|   z[26] = accum.extract();
 1311|     14|   accum.mul_x2(x[4], x[23]);
 1312|     14|   accum.mul_x2(x[5], x[22]);
 1313|     14|   accum.mul_x2(x[6], x[21]);
 1314|     14|   accum.mul_x2(x[7], x[20]);
 1315|     14|   accum.mul_x2(x[8], x[19]);
 1316|     14|   accum.mul_x2(x[9], x[18]);
 1317|     14|   accum.mul_x2(x[10], x[17]);
 1318|     14|   accum.mul_x2(x[11], x[16]);
 1319|     14|   accum.mul_x2(x[12], x[15]);
 1320|     14|   accum.mul_x2(x[13], x[14]);
 1321|     14|   z[27] = accum.extract();
 1322|     14|   accum.mul_x2(x[5], x[23]);
 1323|     14|   accum.mul_x2(x[6], x[22]);
 1324|     14|   accum.mul_x2(x[7], x[21]);
 1325|     14|   accum.mul_x2(x[8], x[20]);
 1326|     14|   accum.mul_x2(x[9], x[19]);
 1327|     14|   accum.mul_x2(x[10], x[18]);
 1328|     14|   accum.mul_x2(x[11], x[17]);
 1329|     14|   accum.mul_x2(x[12], x[16]);
 1330|     14|   accum.mul_x2(x[13], x[15]);
 1331|     14|   accum.mul(x[14], x[14]);
 1332|     14|   z[28] = accum.extract();
 1333|     14|   accum.mul_x2(x[6], x[23]);
 1334|     14|   accum.mul_x2(x[7], x[22]);
 1335|     14|   accum.mul_x2(x[8], x[21]);
 1336|     14|   accum.mul_x2(x[9], x[20]);
 1337|     14|   accum.mul_x2(x[10], x[19]);
 1338|     14|   accum.mul_x2(x[11], x[18]);
 1339|     14|   accum.mul_x2(x[12], x[17]);
 1340|     14|   accum.mul_x2(x[13], x[16]);
 1341|     14|   accum.mul_x2(x[14], x[15]);
 1342|     14|   z[29] = accum.extract();
 1343|     14|   accum.mul_x2(x[7], x[23]);
 1344|     14|   accum.mul_x2(x[8], x[22]);
 1345|     14|   accum.mul_x2(x[9], x[21]);
 1346|     14|   accum.mul_x2(x[10], x[20]);
 1347|     14|   accum.mul_x2(x[11], x[19]);
 1348|     14|   accum.mul_x2(x[12], x[18]);
 1349|     14|   accum.mul_x2(x[13], x[17]);
 1350|     14|   accum.mul_x2(x[14], x[16]);
 1351|     14|   accum.mul(x[15], x[15]);
 1352|     14|   z[30] = accum.extract();
 1353|     14|   accum.mul_x2(x[8], x[23]);
 1354|     14|   accum.mul_x2(x[9], x[22]);
 1355|     14|   accum.mul_x2(x[10], x[21]);
 1356|     14|   accum.mul_x2(x[11], x[20]);
 1357|     14|   accum.mul_x2(x[12], x[19]);
 1358|     14|   accum.mul_x2(x[13], x[18]);
 1359|     14|   accum.mul_x2(x[14], x[17]);
 1360|     14|   accum.mul_x2(x[15], x[16]);
 1361|     14|   z[31] = accum.extract();
 1362|     14|   accum.mul_x2(x[9], x[23]);
 1363|     14|   accum.mul_x2(x[10], x[22]);
 1364|     14|   accum.mul_x2(x[11], x[21]);
 1365|     14|   accum.mul_x2(x[12], x[20]);
 1366|     14|   accum.mul_x2(x[13], x[19]);
 1367|     14|   accum.mul_x2(x[14], x[18]);
 1368|     14|   accum.mul_x2(x[15], x[17]);
 1369|     14|   accum.mul(x[16], x[16]);
 1370|     14|   z[32] = accum.extract();
 1371|     14|   accum.mul_x2(x[10], x[23]);
 1372|     14|   accum.mul_x2(x[11], x[22]);
 1373|     14|   accum.mul_x2(x[12], x[21]);
 1374|     14|   accum.mul_x2(x[13], x[20]);
 1375|     14|   accum.mul_x2(x[14], x[19]);
 1376|     14|   accum.mul_x2(x[15], x[18]);
 1377|     14|   accum.mul_x2(x[16], x[17]);
 1378|     14|   z[33] = accum.extract();
 1379|     14|   accum.mul_x2(x[11], x[23]);
 1380|     14|   accum.mul_x2(x[12], x[22]);
 1381|     14|   accum.mul_x2(x[13], x[21]);
 1382|     14|   accum.mul_x2(x[14], x[20]);
 1383|     14|   accum.mul_x2(x[15], x[19]);
 1384|     14|   accum.mul_x2(x[16], x[18]);
 1385|     14|   accum.mul(x[17], x[17]);
 1386|     14|   z[34] = accum.extract();
 1387|     14|   accum.mul_x2(x[12], x[23]);
 1388|     14|   accum.mul_x2(x[13], x[22]);
 1389|     14|   accum.mul_x2(x[14], x[21]);
 1390|     14|   accum.mul_x2(x[15], x[20]);
 1391|     14|   accum.mul_x2(x[16], x[19]);
 1392|     14|   accum.mul_x2(x[17], x[18]);
 1393|     14|   z[35] = accum.extract();
 1394|     14|   accum.mul_x2(x[13], x[23]);
 1395|     14|   accum.mul_x2(x[14], x[22]);
 1396|     14|   accum.mul_x2(x[15], x[21]);
 1397|     14|   accum.mul_x2(x[16], x[20]);
 1398|     14|   accum.mul_x2(x[17], x[19]);
 1399|     14|   accum.mul(x[18], x[18]);
 1400|     14|   z[36] = accum.extract();
 1401|     14|   accum.mul_x2(x[14], x[23]);
 1402|     14|   accum.mul_x2(x[15], x[22]);
 1403|     14|   accum.mul_x2(x[16], x[21]);
 1404|     14|   accum.mul_x2(x[17], x[20]);
 1405|     14|   accum.mul_x2(x[18], x[19]);
 1406|     14|   z[37] = accum.extract();
 1407|     14|   accum.mul_x2(x[15], x[23]);
 1408|     14|   accum.mul_x2(x[16], x[22]);
 1409|     14|   accum.mul_x2(x[17], x[21]);
 1410|     14|   accum.mul_x2(x[18], x[20]);
 1411|     14|   accum.mul(x[19], x[19]);
 1412|     14|   z[38] = accum.extract();
 1413|     14|   accum.mul_x2(x[16], x[23]);
 1414|     14|   accum.mul_x2(x[17], x[22]);
 1415|     14|   accum.mul_x2(x[18], x[21]);
 1416|     14|   accum.mul_x2(x[19], x[20]);
 1417|     14|   z[39] = accum.extract();
 1418|     14|   accum.mul_x2(x[17], x[23]);
 1419|     14|   accum.mul_x2(x[18], x[22]);
 1420|     14|   accum.mul_x2(x[19], x[21]);
 1421|     14|   accum.mul(x[20], x[20]);
 1422|     14|   z[40] = accum.extract();
 1423|     14|   accum.mul_x2(x[18], x[23]);
 1424|     14|   accum.mul_x2(x[19], x[22]);
 1425|     14|   accum.mul_x2(x[20], x[21]);
 1426|     14|   z[41] = accum.extract();
 1427|     14|   accum.mul_x2(x[19], x[23]);
 1428|     14|   accum.mul_x2(x[20], x[22]);
 1429|     14|   accum.mul(x[21], x[21]);
 1430|     14|   z[42] = accum.extract();
 1431|     14|   accum.mul_x2(x[20], x[23]);
 1432|     14|   accum.mul_x2(x[21], x[22]);
 1433|     14|   z[43] = accum.extract();
 1434|     14|   accum.mul_x2(x[21], x[23]);
 1435|     14|   accum.mul(x[22], x[22]);
 1436|     14|   z[44] = accum.extract();
 1437|     14|   accum.mul_x2(x[22], x[23]);
 1438|     14|   z[45] = accum.extract();
 1439|     14|   accum.mul(x[23], x[23]);
 1440|     14|   z[46] = accum.extract();
 1441|     14|   z[47] = accum.extract();
 1442|     14|}
_ZN5Botan18bigint_comba_mul24EPmPKmS2_:
 1447|     62|void bigint_comba_mul24(word z[48], const word x[24], const word y[24]) {
 1448|     62|   word3<word> accum;
 1449|       |
 1450|     62|   accum.mul(x[0], y[0]);
 1451|     62|   z[0] = accum.extract();
 1452|     62|   accum.mul(x[0], y[1]);
 1453|     62|   accum.mul(x[1], y[0]);
 1454|     62|   z[1] = accum.extract();
 1455|     62|   accum.mul(x[0], y[2]);
 1456|     62|   accum.mul(x[1], y[1]);
 1457|     62|   accum.mul(x[2], y[0]);
 1458|     62|   z[2] = accum.extract();
 1459|     62|   accum.mul(x[0], y[3]);
 1460|     62|   accum.mul(x[1], y[2]);
 1461|     62|   accum.mul(x[2], y[1]);
 1462|     62|   accum.mul(x[3], y[0]);
 1463|     62|   z[3] = accum.extract();
 1464|     62|   accum.mul(x[0], y[4]);
 1465|     62|   accum.mul(x[1], y[3]);
 1466|     62|   accum.mul(x[2], y[2]);
 1467|     62|   accum.mul(x[3], y[1]);
 1468|     62|   accum.mul(x[4], y[0]);
 1469|     62|   z[4] = accum.extract();
 1470|     62|   accum.mul(x[0], y[5]);
 1471|     62|   accum.mul(x[1], y[4]);
 1472|     62|   accum.mul(x[2], y[3]);
 1473|     62|   accum.mul(x[3], y[2]);
 1474|     62|   accum.mul(x[4], y[1]);
 1475|     62|   accum.mul(x[5], y[0]);
 1476|     62|   z[5] = accum.extract();
 1477|     62|   accum.mul(x[0], y[6]);
 1478|     62|   accum.mul(x[1], y[5]);
 1479|     62|   accum.mul(x[2], y[4]);
 1480|     62|   accum.mul(x[3], y[3]);
 1481|     62|   accum.mul(x[4], y[2]);
 1482|     62|   accum.mul(x[5], y[1]);
 1483|     62|   accum.mul(x[6], y[0]);
 1484|     62|   z[6] = accum.extract();
 1485|     62|   accum.mul(x[0], y[7]);
 1486|     62|   accum.mul(x[1], y[6]);
 1487|     62|   accum.mul(x[2], y[5]);
 1488|     62|   accum.mul(x[3], y[4]);
 1489|     62|   accum.mul(x[4], y[3]);
 1490|     62|   accum.mul(x[5], y[2]);
 1491|     62|   accum.mul(x[6], y[1]);
 1492|     62|   accum.mul(x[7], y[0]);
 1493|     62|   z[7] = accum.extract();
 1494|     62|   accum.mul(x[0], y[8]);
 1495|     62|   accum.mul(x[1], y[7]);
 1496|     62|   accum.mul(x[2], y[6]);
 1497|     62|   accum.mul(x[3], y[5]);
 1498|     62|   accum.mul(x[4], y[4]);
 1499|     62|   accum.mul(x[5], y[3]);
 1500|     62|   accum.mul(x[6], y[2]);
 1501|     62|   accum.mul(x[7], y[1]);
 1502|     62|   accum.mul(x[8], y[0]);
 1503|     62|   z[8] = accum.extract();
 1504|     62|   accum.mul(x[0], y[9]);
 1505|     62|   accum.mul(x[1], y[8]);
 1506|     62|   accum.mul(x[2], y[7]);
 1507|     62|   accum.mul(x[3], y[6]);
 1508|     62|   accum.mul(x[4], y[5]);
 1509|     62|   accum.mul(x[5], y[4]);
 1510|     62|   accum.mul(x[6], y[3]);
 1511|     62|   accum.mul(x[7], y[2]);
 1512|     62|   accum.mul(x[8], y[1]);
 1513|     62|   accum.mul(x[9], y[0]);
 1514|     62|   z[9] = accum.extract();
 1515|     62|   accum.mul(x[0], y[10]);
 1516|     62|   accum.mul(x[1], y[9]);
 1517|     62|   accum.mul(x[2], y[8]);
 1518|     62|   accum.mul(x[3], y[7]);
 1519|     62|   accum.mul(x[4], y[6]);
 1520|     62|   accum.mul(x[5], y[5]);
 1521|     62|   accum.mul(x[6], y[4]);
 1522|     62|   accum.mul(x[7], y[3]);
 1523|     62|   accum.mul(x[8], y[2]);
 1524|     62|   accum.mul(x[9], y[1]);
 1525|     62|   accum.mul(x[10], y[0]);
 1526|     62|   z[10] = accum.extract();
 1527|     62|   accum.mul(x[0], y[11]);
 1528|     62|   accum.mul(x[1], y[10]);
 1529|     62|   accum.mul(x[2], y[9]);
 1530|     62|   accum.mul(x[3], y[8]);
 1531|     62|   accum.mul(x[4], y[7]);
 1532|     62|   accum.mul(x[5], y[6]);
 1533|     62|   accum.mul(x[6], y[5]);
 1534|     62|   accum.mul(x[7], y[4]);
 1535|     62|   accum.mul(x[8], y[3]);
 1536|     62|   accum.mul(x[9], y[2]);
 1537|     62|   accum.mul(x[10], y[1]);
 1538|     62|   accum.mul(x[11], y[0]);
 1539|     62|   z[11] = accum.extract();
 1540|     62|   accum.mul(x[0], y[12]);
 1541|     62|   accum.mul(x[1], y[11]);
 1542|     62|   accum.mul(x[2], y[10]);
 1543|     62|   accum.mul(x[3], y[9]);
 1544|     62|   accum.mul(x[4], y[8]);
 1545|     62|   accum.mul(x[5], y[7]);
 1546|     62|   accum.mul(x[6], y[6]);
 1547|     62|   accum.mul(x[7], y[5]);
 1548|     62|   accum.mul(x[8], y[4]);
 1549|     62|   accum.mul(x[9], y[3]);
 1550|     62|   accum.mul(x[10], y[2]);
 1551|     62|   accum.mul(x[11], y[1]);
 1552|     62|   accum.mul(x[12], y[0]);
 1553|     62|   z[12] = accum.extract();
 1554|     62|   accum.mul(x[0], y[13]);
 1555|     62|   accum.mul(x[1], y[12]);
 1556|     62|   accum.mul(x[2], y[11]);
 1557|     62|   accum.mul(x[3], y[10]);
 1558|     62|   accum.mul(x[4], y[9]);
 1559|     62|   accum.mul(x[5], y[8]);
 1560|     62|   accum.mul(x[6], y[7]);
 1561|     62|   accum.mul(x[7], y[6]);
 1562|     62|   accum.mul(x[8], y[5]);
 1563|     62|   accum.mul(x[9], y[4]);
 1564|     62|   accum.mul(x[10], y[3]);
 1565|     62|   accum.mul(x[11], y[2]);
 1566|     62|   accum.mul(x[12], y[1]);
 1567|     62|   accum.mul(x[13], y[0]);
 1568|     62|   z[13] = accum.extract();
 1569|     62|   accum.mul(x[0], y[14]);
 1570|     62|   accum.mul(x[1], y[13]);
 1571|     62|   accum.mul(x[2], y[12]);
 1572|     62|   accum.mul(x[3], y[11]);
 1573|     62|   accum.mul(x[4], y[10]);
 1574|     62|   accum.mul(x[5], y[9]);
 1575|     62|   accum.mul(x[6], y[8]);
 1576|     62|   accum.mul(x[7], y[7]);
 1577|     62|   accum.mul(x[8], y[6]);
 1578|     62|   accum.mul(x[9], y[5]);
 1579|     62|   accum.mul(x[10], y[4]);
 1580|     62|   accum.mul(x[11], y[3]);
 1581|     62|   accum.mul(x[12], y[2]);
 1582|     62|   accum.mul(x[13], y[1]);
 1583|     62|   accum.mul(x[14], y[0]);
 1584|     62|   z[14] = accum.extract();
 1585|     62|   accum.mul(x[0], y[15]);
 1586|     62|   accum.mul(x[1], y[14]);
 1587|     62|   accum.mul(x[2], y[13]);
 1588|     62|   accum.mul(x[3], y[12]);
 1589|     62|   accum.mul(x[4], y[11]);
 1590|     62|   accum.mul(x[5], y[10]);
 1591|     62|   accum.mul(x[6], y[9]);
 1592|     62|   accum.mul(x[7], y[8]);
 1593|     62|   accum.mul(x[8], y[7]);
 1594|     62|   accum.mul(x[9], y[6]);
 1595|     62|   accum.mul(x[10], y[5]);
 1596|     62|   accum.mul(x[11], y[4]);
 1597|     62|   accum.mul(x[12], y[3]);
 1598|     62|   accum.mul(x[13], y[2]);
 1599|     62|   accum.mul(x[14], y[1]);
 1600|     62|   accum.mul(x[15], y[0]);
 1601|     62|   z[15] = accum.extract();
 1602|     62|   accum.mul(x[0], y[16]);
 1603|     62|   accum.mul(x[1], y[15]);
 1604|     62|   accum.mul(x[2], y[14]);
 1605|     62|   accum.mul(x[3], y[13]);
 1606|     62|   accum.mul(x[4], y[12]);
 1607|     62|   accum.mul(x[5], y[11]);
 1608|     62|   accum.mul(x[6], y[10]);
 1609|     62|   accum.mul(x[7], y[9]);
 1610|     62|   accum.mul(x[8], y[8]);
 1611|     62|   accum.mul(x[9], y[7]);
 1612|     62|   accum.mul(x[10], y[6]);
 1613|     62|   accum.mul(x[11], y[5]);
 1614|     62|   accum.mul(x[12], y[4]);
 1615|     62|   accum.mul(x[13], y[3]);
 1616|     62|   accum.mul(x[14], y[2]);
 1617|     62|   accum.mul(x[15], y[1]);
 1618|     62|   accum.mul(x[16], y[0]);
 1619|     62|   z[16] = accum.extract();
 1620|     62|   accum.mul(x[0], y[17]);
 1621|     62|   accum.mul(x[1], y[16]);
 1622|     62|   accum.mul(x[2], y[15]);
 1623|     62|   accum.mul(x[3], y[14]);
 1624|     62|   accum.mul(x[4], y[13]);
 1625|     62|   accum.mul(x[5], y[12]);
 1626|     62|   accum.mul(x[6], y[11]);
 1627|     62|   accum.mul(x[7], y[10]);
 1628|     62|   accum.mul(x[8], y[9]);
 1629|     62|   accum.mul(x[9], y[8]);
 1630|     62|   accum.mul(x[10], y[7]);
 1631|     62|   accum.mul(x[11], y[6]);
 1632|     62|   accum.mul(x[12], y[5]);
 1633|     62|   accum.mul(x[13], y[4]);
 1634|     62|   accum.mul(x[14], y[3]);
 1635|     62|   accum.mul(x[15], y[2]);
 1636|     62|   accum.mul(x[16], y[1]);
 1637|     62|   accum.mul(x[17], y[0]);
 1638|     62|   z[17] = accum.extract();
 1639|     62|   accum.mul(x[0], y[18]);
 1640|     62|   accum.mul(x[1], y[17]);
 1641|     62|   accum.mul(x[2], y[16]);
 1642|     62|   accum.mul(x[3], y[15]);
 1643|     62|   accum.mul(x[4], y[14]);
 1644|     62|   accum.mul(x[5], y[13]);
 1645|     62|   accum.mul(x[6], y[12]);
 1646|     62|   accum.mul(x[7], y[11]);
 1647|     62|   accum.mul(x[8], y[10]);
 1648|     62|   accum.mul(x[9], y[9]);
 1649|     62|   accum.mul(x[10], y[8]);
 1650|     62|   accum.mul(x[11], y[7]);
 1651|     62|   accum.mul(x[12], y[6]);
 1652|     62|   accum.mul(x[13], y[5]);
 1653|     62|   accum.mul(x[14], y[4]);
 1654|     62|   accum.mul(x[15], y[3]);
 1655|     62|   accum.mul(x[16], y[2]);
 1656|     62|   accum.mul(x[17], y[1]);
 1657|     62|   accum.mul(x[18], y[0]);
 1658|     62|   z[18] = accum.extract();
 1659|     62|   accum.mul(x[0], y[19]);
 1660|     62|   accum.mul(x[1], y[18]);
 1661|     62|   accum.mul(x[2], y[17]);
 1662|     62|   accum.mul(x[3], y[16]);
 1663|     62|   accum.mul(x[4], y[15]);
 1664|     62|   accum.mul(x[5], y[14]);
 1665|     62|   accum.mul(x[6], y[13]);
 1666|     62|   accum.mul(x[7], y[12]);
 1667|     62|   accum.mul(x[8], y[11]);
 1668|     62|   accum.mul(x[9], y[10]);
 1669|     62|   accum.mul(x[10], y[9]);
 1670|     62|   accum.mul(x[11], y[8]);
 1671|     62|   accum.mul(x[12], y[7]);
 1672|     62|   accum.mul(x[13], y[6]);
 1673|     62|   accum.mul(x[14], y[5]);
 1674|     62|   accum.mul(x[15], y[4]);
 1675|     62|   accum.mul(x[16], y[3]);
 1676|     62|   accum.mul(x[17], y[2]);
 1677|     62|   accum.mul(x[18], y[1]);
 1678|     62|   accum.mul(x[19], y[0]);
 1679|     62|   z[19] = accum.extract();
 1680|     62|   accum.mul(x[0], y[20]);
 1681|     62|   accum.mul(x[1], y[19]);
 1682|     62|   accum.mul(x[2], y[18]);
 1683|     62|   accum.mul(x[3], y[17]);
 1684|     62|   accum.mul(x[4], y[16]);
 1685|     62|   accum.mul(x[5], y[15]);
 1686|     62|   accum.mul(x[6], y[14]);
 1687|     62|   accum.mul(x[7], y[13]);
 1688|     62|   accum.mul(x[8], y[12]);
 1689|     62|   accum.mul(x[9], y[11]);
 1690|     62|   accum.mul(x[10], y[10]);
 1691|     62|   accum.mul(x[11], y[9]);
 1692|     62|   accum.mul(x[12], y[8]);
 1693|     62|   accum.mul(x[13], y[7]);
 1694|     62|   accum.mul(x[14], y[6]);
 1695|     62|   accum.mul(x[15], y[5]);
 1696|     62|   accum.mul(x[16], y[4]);
 1697|     62|   accum.mul(x[17], y[3]);
 1698|     62|   accum.mul(x[18], y[2]);
 1699|     62|   accum.mul(x[19], y[1]);
 1700|     62|   accum.mul(x[20], y[0]);
 1701|     62|   z[20] = accum.extract();
 1702|     62|   accum.mul(x[0], y[21]);
 1703|     62|   accum.mul(x[1], y[20]);
 1704|     62|   accum.mul(x[2], y[19]);
 1705|     62|   accum.mul(x[3], y[18]);
 1706|     62|   accum.mul(x[4], y[17]);
 1707|     62|   accum.mul(x[5], y[16]);
 1708|     62|   accum.mul(x[6], y[15]);
 1709|     62|   accum.mul(x[7], y[14]);
 1710|     62|   accum.mul(x[8], y[13]);
 1711|     62|   accum.mul(x[9], y[12]);
 1712|     62|   accum.mul(x[10], y[11]);
 1713|     62|   accum.mul(x[11], y[10]);
 1714|     62|   accum.mul(x[12], y[9]);
 1715|     62|   accum.mul(x[13], y[8]);
 1716|     62|   accum.mul(x[14], y[7]);
 1717|     62|   accum.mul(x[15], y[6]);
 1718|     62|   accum.mul(x[16], y[5]);
 1719|     62|   accum.mul(x[17], y[4]);
 1720|     62|   accum.mul(x[18], y[3]);
 1721|     62|   accum.mul(x[19], y[2]);
 1722|     62|   accum.mul(x[20], y[1]);
 1723|     62|   accum.mul(x[21], y[0]);
 1724|     62|   z[21] = accum.extract();
 1725|     62|   accum.mul(x[0], y[22]);
 1726|     62|   accum.mul(x[1], y[21]);
 1727|     62|   accum.mul(x[2], y[20]);
 1728|     62|   accum.mul(x[3], y[19]);
 1729|     62|   accum.mul(x[4], y[18]);
 1730|     62|   accum.mul(x[5], y[17]);
 1731|     62|   accum.mul(x[6], y[16]);
 1732|     62|   accum.mul(x[7], y[15]);
 1733|     62|   accum.mul(x[8], y[14]);
 1734|     62|   accum.mul(x[9], y[13]);
 1735|     62|   accum.mul(x[10], y[12]);
 1736|     62|   accum.mul(x[11], y[11]);
 1737|     62|   accum.mul(x[12], y[10]);
 1738|     62|   accum.mul(x[13], y[9]);
 1739|     62|   accum.mul(x[14], y[8]);
 1740|     62|   accum.mul(x[15], y[7]);
 1741|     62|   accum.mul(x[16], y[6]);
 1742|     62|   accum.mul(x[17], y[5]);
 1743|     62|   accum.mul(x[18], y[4]);
 1744|     62|   accum.mul(x[19], y[3]);
 1745|     62|   accum.mul(x[20], y[2]);
 1746|     62|   accum.mul(x[21], y[1]);
 1747|     62|   accum.mul(x[22], y[0]);
 1748|     62|   z[22] = accum.extract();
 1749|     62|   accum.mul(x[0], y[23]);
 1750|     62|   accum.mul(x[1], y[22]);
 1751|     62|   accum.mul(x[2], y[21]);
 1752|     62|   accum.mul(x[3], y[20]);
 1753|     62|   accum.mul(x[4], y[19]);
 1754|     62|   accum.mul(x[5], y[18]);
 1755|     62|   accum.mul(x[6], y[17]);
 1756|     62|   accum.mul(x[7], y[16]);
 1757|     62|   accum.mul(x[8], y[15]);
 1758|     62|   accum.mul(x[9], y[14]);
 1759|     62|   accum.mul(x[10], y[13]);
 1760|     62|   accum.mul(x[11], y[12]);
 1761|     62|   accum.mul(x[12], y[11]);
 1762|     62|   accum.mul(x[13], y[10]);
 1763|     62|   accum.mul(x[14], y[9]);
 1764|     62|   accum.mul(x[15], y[8]);
 1765|     62|   accum.mul(x[16], y[7]);
 1766|     62|   accum.mul(x[17], y[6]);
 1767|     62|   accum.mul(x[18], y[5]);
 1768|     62|   accum.mul(x[19], y[4]);
 1769|     62|   accum.mul(x[20], y[3]);
 1770|     62|   accum.mul(x[21], y[2]);
 1771|     62|   accum.mul(x[22], y[1]);
 1772|     62|   accum.mul(x[23], y[0]);
 1773|     62|   z[23] = accum.extract();
 1774|     62|   accum.mul(x[1], y[23]);
 1775|     62|   accum.mul(x[2], y[22]);
 1776|     62|   accum.mul(x[3], y[21]);
 1777|     62|   accum.mul(x[4], y[20]);
 1778|     62|   accum.mul(x[5], y[19]);
 1779|     62|   accum.mul(x[6], y[18]);
 1780|     62|   accum.mul(x[7], y[17]);
 1781|     62|   accum.mul(x[8], y[16]);
 1782|     62|   accum.mul(x[9], y[15]);
 1783|     62|   accum.mul(x[10], y[14]);
 1784|     62|   accum.mul(x[11], y[13]);
 1785|     62|   accum.mul(x[12], y[12]);
 1786|     62|   accum.mul(x[13], y[11]);
 1787|     62|   accum.mul(x[14], y[10]);
 1788|     62|   accum.mul(x[15], y[9]);
 1789|     62|   accum.mul(x[16], y[8]);
 1790|     62|   accum.mul(x[17], y[7]);
 1791|     62|   accum.mul(x[18], y[6]);
 1792|     62|   accum.mul(x[19], y[5]);
 1793|     62|   accum.mul(x[20], y[4]);
 1794|     62|   accum.mul(x[21], y[3]);
 1795|     62|   accum.mul(x[22], y[2]);
 1796|     62|   accum.mul(x[23], y[1]);
 1797|     62|   z[24] = accum.extract();
 1798|     62|   accum.mul(x[2], y[23]);
 1799|     62|   accum.mul(x[3], y[22]);
 1800|     62|   accum.mul(x[4], y[21]);
 1801|     62|   accum.mul(x[5], y[20]);
 1802|     62|   accum.mul(x[6], y[19]);
 1803|     62|   accum.mul(x[7], y[18]);
 1804|     62|   accum.mul(x[8], y[17]);
 1805|     62|   accum.mul(x[9], y[16]);
 1806|     62|   accum.mul(x[10], y[15]);
 1807|     62|   accum.mul(x[11], y[14]);
 1808|     62|   accum.mul(x[12], y[13]);
 1809|     62|   accum.mul(x[13], y[12]);
 1810|     62|   accum.mul(x[14], y[11]);
 1811|     62|   accum.mul(x[15], y[10]);
 1812|     62|   accum.mul(x[16], y[9]);
 1813|     62|   accum.mul(x[17], y[8]);
 1814|     62|   accum.mul(x[18], y[7]);
 1815|     62|   accum.mul(x[19], y[6]);
 1816|     62|   accum.mul(x[20], y[5]);
 1817|     62|   accum.mul(x[21], y[4]);
 1818|     62|   accum.mul(x[22], y[3]);
 1819|     62|   accum.mul(x[23], y[2]);
 1820|     62|   z[25] = accum.extract();
 1821|     62|   accum.mul(x[3], y[23]);
 1822|     62|   accum.mul(x[4], y[22]);
 1823|     62|   accum.mul(x[5], y[21]);
 1824|     62|   accum.mul(x[6], y[20]);
 1825|     62|   accum.mul(x[7], y[19]);
 1826|     62|   accum.mul(x[8], y[18]);
 1827|     62|   accum.mul(x[9], y[17]);
 1828|     62|   accum.mul(x[10], y[16]);
 1829|     62|   accum.mul(x[11], y[15]);
 1830|     62|   accum.mul(x[12], y[14]);
 1831|     62|   accum.mul(x[13], y[13]);
 1832|     62|   accum.mul(x[14], y[12]);
 1833|     62|   accum.mul(x[15], y[11]);
 1834|     62|   accum.mul(x[16], y[10]);
 1835|     62|   accum.mul(x[17], y[9]);
 1836|     62|   accum.mul(x[18], y[8]);
 1837|     62|   accum.mul(x[19], y[7]);
 1838|     62|   accum.mul(x[20], y[6]);
 1839|     62|   accum.mul(x[21], y[5]);
 1840|     62|   accum.mul(x[22], y[4]);
 1841|     62|   accum.mul(x[23], y[3]);
 1842|     62|   z[26] = accum.extract();
 1843|     62|   accum.mul(x[4], y[23]);
 1844|     62|   accum.mul(x[5], y[22]);
 1845|     62|   accum.mul(x[6], y[21]);
 1846|     62|   accum.mul(x[7], y[20]);
 1847|     62|   accum.mul(x[8], y[19]);
 1848|     62|   accum.mul(x[9], y[18]);
 1849|     62|   accum.mul(x[10], y[17]);
 1850|     62|   accum.mul(x[11], y[16]);
 1851|     62|   accum.mul(x[12], y[15]);
 1852|     62|   accum.mul(x[13], y[14]);
 1853|     62|   accum.mul(x[14], y[13]);
 1854|     62|   accum.mul(x[15], y[12]);
 1855|     62|   accum.mul(x[16], y[11]);
 1856|     62|   accum.mul(x[17], y[10]);
 1857|     62|   accum.mul(x[18], y[9]);
 1858|     62|   accum.mul(x[19], y[8]);
 1859|     62|   accum.mul(x[20], y[7]);
 1860|     62|   accum.mul(x[21], y[6]);
 1861|     62|   accum.mul(x[22], y[5]);
 1862|     62|   accum.mul(x[23], y[4]);
 1863|     62|   z[27] = accum.extract();
 1864|     62|   accum.mul(x[5], y[23]);
 1865|     62|   accum.mul(x[6], y[22]);
 1866|     62|   accum.mul(x[7], y[21]);
 1867|     62|   accum.mul(x[8], y[20]);
 1868|     62|   accum.mul(x[9], y[19]);
 1869|     62|   accum.mul(x[10], y[18]);
 1870|     62|   accum.mul(x[11], y[17]);
 1871|     62|   accum.mul(x[12], y[16]);
 1872|     62|   accum.mul(x[13], y[15]);
 1873|     62|   accum.mul(x[14], y[14]);
 1874|     62|   accum.mul(x[15], y[13]);
 1875|     62|   accum.mul(x[16], y[12]);
 1876|     62|   accum.mul(x[17], y[11]);
 1877|     62|   accum.mul(x[18], y[10]);
 1878|     62|   accum.mul(x[19], y[9]);
 1879|     62|   accum.mul(x[20], y[8]);
 1880|     62|   accum.mul(x[21], y[7]);
 1881|     62|   accum.mul(x[22], y[6]);
 1882|     62|   accum.mul(x[23], y[5]);
 1883|     62|   z[28] = accum.extract();
 1884|     62|   accum.mul(x[6], y[23]);
 1885|     62|   accum.mul(x[7], y[22]);
 1886|     62|   accum.mul(x[8], y[21]);
 1887|     62|   accum.mul(x[9], y[20]);
 1888|     62|   accum.mul(x[10], y[19]);
 1889|     62|   accum.mul(x[11], y[18]);
 1890|     62|   accum.mul(x[12], y[17]);
 1891|     62|   accum.mul(x[13], y[16]);
 1892|     62|   accum.mul(x[14], y[15]);
 1893|     62|   accum.mul(x[15], y[14]);
 1894|     62|   accum.mul(x[16], y[13]);
 1895|     62|   accum.mul(x[17], y[12]);
 1896|     62|   accum.mul(x[18], y[11]);
 1897|     62|   accum.mul(x[19], y[10]);
 1898|     62|   accum.mul(x[20], y[9]);
 1899|     62|   accum.mul(x[21], y[8]);
 1900|     62|   accum.mul(x[22], y[7]);
 1901|     62|   accum.mul(x[23], y[6]);
 1902|     62|   z[29] = accum.extract();
 1903|     62|   accum.mul(x[7], y[23]);
 1904|     62|   accum.mul(x[8], y[22]);
 1905|     62|   accum.mul(x[9], y[21]);
 1906|     62|   accum.mul(x[10], y[20]);
 1907|     62|   accum.mul(x[11], y[19]);
 1908|     62|   accum.mul(x[12], y[18]);
 1909|     62|   accum.mul(x[13], y[17]);
 1910|     62|   accum.mul(x[14], y[16]);
 1911|     62|   accum.mul(x[15], y[15]);
 1912|     62|   accum.mul(x[16], y[14]);
 1913|     62|   accum.mul(x[17], y[13]);
 1914|     62|   accum.mul(x[18], y[12]);
 1915|     62|   accum.mul(x[19], y[11]);
 1916|     62|   accum.mul(x[20], y[10]);
 1917|     62|   accum.mul(x[21], y[9]);
 1918|     62|   accum.mul(x[22], y[8]);
 1919|     62|   accum.mul(x[23], y[7]);
 1920|     62|   z[30] = accum.extract();
 1921|     62|   accum.mul(x[8], y[23]);
 1922|     62|   accum.mul(x[9], y[22]);
 1923|     62|   accum.mul(x[10], y[21]);
 1924|     62|   accum.mul(x[11], y[20]);
 1925|     62|   accum.mul(x[12], y[19]);
 1926|     62|   accum.mul(x[13], y[18]);
 1927|     62|   accum.mul(x[14], y[17]);
 1928|     62|   accum.mul(x[15], y[16]);
 1929|     62|   accum.mul(x[16], y[15]);
 1930|     62|   accum.mul(x[17], y[14]);
 1931|     62|   accum.mul(x[18], y[13]);
 1932|     62|   accum.mul(x[19], y[12]);
 1933|     62|   accum.mul(x[20], y[11]);
 1934|     62|   accum.mul(x[21], y[10]);
 1935|     62|   accum.mul(x[22], y[9]);
 1936|     62|   accum.mul(x[23], y[8]);
 1937|     62|   z[31] = accum.extract();
 1938|     62|   accum.mul(x[9], y[23]);
 1939|     62|   accum.mul(x[10], y[22]);
 1940|     62|   accum.mul(x[11], y[21]);
 1941|     62|   accum.mul(x[12], y[20]);
 1942|     62|   accum.mul(x[13], y[19]);
 1943|     62|   accum.mul(x[14], y[18]);
 1944|     62|   accum.mul(x[15], y[17]);
 1945|     62|   accum.mul(x[16], y[16]);
 1946|     62|   accum.mul(x[17], y[15]);
 1947|     62|   accum.mul(x[18], y[14]);
 1948|     62|   accum.mul(x[19], y[13]);
 1949|     62|   accum.mul(x[20], y[12]);
 1950|     62|   accum.mul(x[21], y[11]);
 1951|     62|   accum.mul(x[22], y[10]);
 1952|     62|   accum.mul(x[23], y[9]);
 1953|     62|   z[32] = accum.extract();
 1954|     62|   accum.mul(x[10], y[23]);
 1955|     62|   accum.mul(x[11], y[22]);
 1956|     62|   accum.mul(x[12], y[21]);
 1957|     62|   accum.mul(x[13], y[20]);
 1958|     62|   accum.mul(x[14], y[19]);
 1959|     62|   accum.mul(x[15], y[18]);
 1960|     62|   accum.mul(x[16], y[17]);
 1961|     62|   accum.mul(x[17], y[16]);
 1962|     62|   accum.mul(x[18], y[15]);
 1963|     62|   accum.mul(x[19], y[14]);
 1964|     62|   accum.mul(x[20], y[13]);
 1965|     62|   accum.mul(x[21], y[12]);
 1966|     62|   accum.mul(x[22], y[11]);
 1967|     62|   accum.mul(x[23], y[10]);
 1968|     62|   z[33] = accum.extract();
 1969|     62|   accum.mul(x[11], y[23]);
 1970|     62|   accum.mul(x[12], y[22]);
 1971|     62|   accum.mul(x[13], y[21]);
 1972|     62|   accum.mul(x[14], y[20]);
 1973|     62|   accum.mul(x[15], y[19]);
 1974|     62|   accum.mul(x[16], y[18]);
 1975|     62|   accum.mul(x[17], y[17]);
 1976|     62|   accum.mul(x[18], y[16]);
 1977|     62|   accum.mul(x[19], y[15]);
 1978|     62|   accum.mul(x[20], y[14]);
 1979|     62|   accum.mul(x[21], y[13]);
 1980|     62|   accum.mul(x[22], y[12]);
 1981|     62|   accum.mul(x[23], y[11]);
 1982|     62|   z[34] = accum.extract();
 1983|     62|   accum.mul(x[12], y[23]);
 1984|     62|   accum.mul(x[13], y[22]);
 1985|     62|   accum.mul(x[14], y[21]);
 1986|     62|   accum.mul(x[15], y[20]);
 1987|     62|   accum.mul(x[16], y[19]);
 1988|     62|   accum.mul(x[17], y[18]);
 1989|     62|   accum.mul(x[18], y[17]);
 1990|     62|   accum.mul(x[19], y[16]);
 1991|     62|   accum.mul(x[20], y[15]);
 1992|     62|   accum.mul(x[21], y[14]);
 1993|     62|   accum.mul(x[22], y[13]);
 1994|     62|   accum.mul(x[23], y[12]);
 1995|     62|   z[35] = accum.extract();
 1996|     62|   accum.mul(x[13], y[23]);
 1997|     62|   accum.mul(x[14], y[22]);
 1998|     62|   accum.mul(x[15], y[21]);
 1999|     62|   accum.mul(x[16], y[20]);
 2000|     62|   accum.mul(x[17], y[19]);
 2001|     62|   accum.mul(x[18], y[18]);
 2002|     62|   accum.mul(x[19], y[17]);
 2003|     62|   accum.mul(x[20], y[16]);
 2004|     62|   accum.mul(x[21], y[15]);
 2005|     62|   accum.mul(x[22], y[14]);
 2006|     62|   accum.mul(x[23], y[13]);
 2007|     62|   z[36] = accum.extract();
 2008|     62|   accum.mul(x[14], y[23]);
 2009|     62|   accum.mul(x[15], y[22]);
 2010|     62|   accum.mul(x[16], y[21]);
 2011|     62|   accum.mul(x[17], y[20]);
 2012|     62|   accum.mul(x[18], y[19]);
 2013|     62|   accum.mul(x[19], y[18]);
 2014|     62|   accum.mul(x[20], y[17]);
 2015|     62|   accum.mul(x[21], y[16]);
 2016|     62|   accum.mul(x[22], y[15]);
 2017|     62|   accum.mul(x[23], y[14]);
 2018|     62|   z[37] = accum.extract();
 2019|     62|   accum.mul(x[15], y[23]);
 2020|     62|   accum.mul(x[16], y[22]);
 2021|     62|   accum.mul(x[17], y[21]);
 2022|     62|   accum.mul(x[18], y[20]);
 2023|     62|   accum.mul(x[19], y[19]);
 2024|     62|   accum.mul(x[20], y[18]);
 2025|     62|   accum.mul(x[21], y[17]);
 2026|     62|   accum.mul(x[22], y[16]);
 2027|     62|   accum.mul(x[23], y[15]);
 2028|     62|   z[38] = accum.extract();
 2029|     62|   accum.mul(x[16], y[23]);
 2030|     62|   accum.mul(x[17], y[22]);
 2031|     62|   accum.mul(x[18], y[21]);
 2032|     62|   accum.mul(x[19], y[20]);
 2033|     62|   accum.mul(x[20], y[19]);
 2034|     62|   accum.mul(x[21], y[18]);
 2035|     62|   accum.mul(x[22], y[17]);
 2036|     62|   accum.mul(x[23], y[16]);
 2037|     62|   z[39] = accum.extract();
 2038|     62|   accum.mul(x[17], y[23]);
 2039|     62|   accum.mul(x[18], y[22]);
 2040|     62|   accum.mul(x[19], y[21]);
 2041|     62|   accum.mul(x[20], y[20]);
 2042|     62|   accum.mul(x[21], y[19]);
 2043|     62|   accum.mul(x[22], y[18]);
 2044|     62|   accum.mul(x[23], y[17]);
 2045|     62|   z[40] = accum.extract();
 2046|     62|   accum.mul(x[18], y[23]);
 2047|     62|   accum.mul(x[19], y[22]);
 2048|     62|   accum.mul(x[20], y[21]);
 2049|     62|   accum.mul(x[21], y[20]);
 2050|     62|   accum.mul(x[22], y[19]);
 2051|     62|   accum.mul(x[23], y[18]);
 2052|     62|   z[41] = accum.extract();
 2053|     62|   accum.mul(x[19], y[23]);
 2054|     62|   accum.mul(x[20], y[22]);
 2055|     62|   accum.mul(x[21], y[21]);
 2056|     62|   accum.mul(x[22], y[20]);
 2057|     62|   accum.mul(x[23], y[19]);
 2058|     62|   z[42] = accum.extract();
 2059|     62|   accum.mul(x[20], y[23]);
 2060|     62|   accum.mul(x[21], y[22]);
 2061|     62|   accum.mul(x[22], y[21]);
 2062|     62|   accum.mul(x[23], y[20]);
 2063|     62|   z[43] = accum.extract();
 2064|     62|   accum.mul(x[21], y[23]);
 2065|     62|   accum.mul(x[22], y[22]);
 2066|     62|   accum.mul(x[23], y[21]);
 2067|     62|   z[44] = accum.extract();
 2068|     62|   accum.mul(x[22], y[23]);
 2069|     62|   accum.mul(x[23], y[22]);
 2070|     62|   z[45] = accum.extract();
 2071|     62|   accum.mul(x[23], y[23]);
 2072|     62|   z[46] = accum.extract();
 2073|     62|   z[47] = accum.extract();
 2074|     62|}

_ZN5Botan12basecase_mulEPmmPKmmS2_m:
   20|    356|void basecase_mul(word z[], size_t z_size, const word x[], size_t x_size, const word y[], size_t y_size) {
   21|    356|   if(z_size < x_size + y_size) {
  ------------------
  |  Branch (21:7): [True: 0, False: 356]
  ------------------
   22|      0|      throw Invalid_Argument("basecase_mul z_size too small");
   23|      0|   }
   24|       |
   25|    356|   const size_t x_size_8 = x_size - (x_size % 8);
   26|       |
   27|    356|   zeroize_buffer(z, z_size);
   28|       |
   29|  9.06k|   for(size_t i = 0; i != y_size; ++i) {
  ------------------
  |  Branch (29:22): [True: 8.71k, False: 356]
  ------------------
   30|  8.71k|      const word y_i = y[i];
   31|       |
   32|  8.71k|      word carry = 0;
   33|       |
   34|  31.5k|      for(size_t j = 0; j != x_size_8; j += 8) {
  ------------------
  |  Branch (34:25): [True: 22.8k, False: 8.71k]
  ------------------
   35|  22.8k|         carry = word8_madd3(z + i + j, x + j, y_i, carry);
   36|  22.8k|      }
   37|       |
   38|  47.8k|      for(size_t j = x_size_8; j != x_size; ++j) {
  ------------------
  |  Branch (38:32): [True: 39.0k, False: 8.71k]
  ------------------
   39|  39.0k|         z[i + j] = word_madd3(x[j], y_i, z[i + j], &carry);
   40|  39.0k|      }
   41|       |
   42|  8.71k|      z[x_size + i] = carry;
   43|  8.71k|   }
   44|    356|}
_ZN5Botan12basecase_sqrEPmmPKmm:
   46|    257|void basecase_sqr(word z[], size_t z_size, const word x[], size_t x_size) {
   47|    257|   if(z_size < 2 * x_size) {
  ------------------
  |  Branch (47:7): [True: 0, False: 257]
  ------------------
   48|      0|      throw Invalid_Argument("basecase_sqr z_size too small");
   49|      0|   }
   50|       |
   51|    257|   const size_t x_size_8 = x_size - (x_size % 8);
   52|       |
   53|    257|   zeroize_buffer(z, z_size);
   54|       |
   55|  8.14k|   for(size_t i = 0; i != x_size; ++i) {
  ------------------
  |  Branch (55:22): [True: 7.89k, False: 257]
  ------------------
   56|  7.89k|      const word x_i = x[i];
   57|       |
   58|  7.89k|      word carry = 0;
   59|       |
   60|  53.4k|      for(size_t j = 0; j != x_size_8; j += 8) {
  ------------------
  |  Branch (60:25): [True: 45.5k, False: 7.89k]
  ------------------
   61|  45.5k|         carry = word8_madd3(z + i + j, x + j, x_i, carry);
   62|  45.5k|      }
   63|       |
   64|  40.7k|      for(size_t j = x_size_8; j != x_size; ++j) {
  ------------------
  |  Branch (64:32): [True: 32.8k, False: 7.89k]
  ------------------
   65|  32.8k|         z[i + j] = word_madd3(x[j], x_i, z[i + j], &carry);
   66|  32.8k|      }
   67|       |
   68|  7.89k|      z[x_size + i] = carry;
   69|  7.89k|   }
   70|    257|}
_ZN5Botan10bigint_mulEPmmPKmmmS2_mmS0_m:
  292|    174|                size_t ws_size) {
  293|    174|   zeroize_buffer(z, z_size);
  294|       |
  295|    174|   if(x_sw == 1) {
  ------------------
  |  Branch (295:7): [True: 0, False: 174]
  ------------------
  296|      0|      bigint_linmul3(z, y, y_sw, x[0]);
  297|    174|   } else if(y_sw == 1) {
  ------------------
  |  Branch (297:14): [True: 0, False: 174]
  ------------------
  298|      0|      bigint_linmul3(z, x, x_sw, y[0]);
  299|    174|   } else if(sized_for_comba_mul<4>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (299:14): [True: 19, False: 155]
  ------------------
  300|     19|      bigint_comba_mul4(z, x, y);
  301|    155|   } else if(sized_for_comba_mul<6>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (301:14): [True: 7, False: 148]
  ------------------
  302|      7|      bigint_comba_mul6(z, x, y);
  303|    148|   } else if(sized_for_comba_mul<8>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (303:14): [True: 11, False: 137]
  ------------------
  304|     11|      bigint_comba_mul8(z, x, y);
  305|    137|   } else if(sized_for_comba_mul<9>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (305:14): [True: 5, False: 132]
  ------------------
  306|      5|      bigint_comba_mul9(z, x, y);
  307|    132|   } else if(sized_for_comba_mul<16>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (307:14): [True: 15, False: 117]
  ------------------
  308|     15|      bigint_comba_mul16(z, x, y);
  309|    117|   } else if(sized_for_comba_mul<24>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (309:14): [True: 17, False: 100]
  ------------------
  310|     17|      bigint_comba_mul24(z, x, y);
  311|    100|   } else if(x_sw < KARATSUBA_MULTIPLY_THRESHOLD || y_sw < KARATSUBA_MULTIPLY_THRESHOLD || workspace == nullptr) {
  ------------------
  |  Branch (311:14): [True: 14, False: 86]
  |  Branch (311:53): [True: 0, False: 86]
  |  Branch (311:92): [True: 0, False: 86]
  ------------------
  312|     14|      basecase_mul(z, z_size, x, x_sw, y, y_sw);
  313|     86|   } else {
  314|     86|      const size_t N = karatsuba_size(z_size, x_size, x_sw, y_size, y_sw);
  315|       |
  316|     86|      if(N > 0 && z_size >= 2 * N && ws_size >= 2 * N) {
  ------------------
  |  Branch (316:10): [True: 86, False: 0]
  |  Branch (316:19): [True: 86, False: 0]
  |  Branch (316:38): [True: 86, False: 0]
  ------------------
  317|     86|         karatsuba_mul(z, x, y, N, workspace);
  318|     86|      } else {
  319|      0|         basecase_mul(z, z_size, x, x_sw, y, y_sw);
  320|      0|      }
  321|     86|   }
  322|    174|}
_ZN5Botan10bigint_sqrEPmmPKmmmS0_m:
  327|    297|void bigint_sqr(word z[], size_t z_size, const word x[], size_t x_size, size_t x_sw, word workspace[], size_t ws_size) {
  328|    297|   zeroize_buffer(z, z_size);
  329|       |
  330|    297|   BOTAN_ASSERT(z_size / 2 >= x_sw, "Output size is sufficient");
  ------------------
  |  |   71|    297|   do {                                                                                 \
  |  |   72|    297|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                                     \
  |  |   73|    297|      if(!(expr)) {                                                                     \
  |  |  ------------------
  |  |  |  Branch (73:10): [True: 0, False: 297]
  |  |  ------------------
  |  |   74|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                            \
  |  |   75|      0|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   76|      0|      }                                                                                 \
  |  |   77|    297|   } while(0)
  |  |  ------------------
  |  |  |  Branch (77:12): [Folded, False: 297]
  |  |  ------------------
  ------------------
  331|       |
  332|    297|   if(x_sw == 1) {
  ------------------
  |  Branch (332:7): [True: 119, False: 178]
  ------------------
  333|    119|      bigint_linmul3(z, x, x_sw, x[0]);
  334|    178|   } else if(sized_for_comba_sqr<4>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (334:14): [True: 4, False: 174]
  ------------------
  335|      4|      bigint_comba_sqr4(z, x);
  336|    174|   } else if(sized_for_comba_sqr<6>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (336:14): [True: 2, False: 172]
  ------------------
  337|      2|      bigint_comba_sqr6(z, x);
  338|    172|   } else if(sized_for_comba_sqr<8>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (338:14): [True: 5, False: 167]
  ------------------
  339|      5|      bigint_comba_sqr8(z, x);
  340|    167|   } else if(sized_for_comba_sqr<9>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (340:14): [True: 5, False: 162]
  ------------------
  341|      5|      bigint_comba_sqr9(z, x);
  342|    162|   } else if(sized_for_comba_sqr<16>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (342:14): [True: 1, False: 161]
  ------------------
  343|      1|      bigint_comba_sqr16(z, x);
  344|    161|   } else if(sized_for_comba_sqr<24>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (344:14): [True: 2, False: 159]
  ------------------
  345|      2|      bigint_comba_sqr24(z, x);
  346|    159|   } else if(x_size < KARATSUBA_SQUARE_THRESHOLD || workspace == nullptr) {
  ------------------
  |  Branch (346:14): [True: 36, False: 123]
  |  Branch (346:53): [True: 2, False: 121]
  ------------------
  347|     38|      basecase_sqr(z, z_size, x, x_sw);
  348|    121|   } else {
  349|    121|      const size_t N = karatsuba_size(z_size, x_size, x_sw);
  350|       |
  351|    121|      if(N > 0 && z_size >= 2 * N && ws_size >= 2 * N) {
  ------------------
  |  Branch (351:10): [True: 70, False: 51]
  |  Branch (351:19): [True: 70, False: 0]
  |  Branch (351:38): [True: 70, False: 0]
  ------------------
  352|     70|         karatsuba_sqr(z, x, N, workspace);
  353|     70|      } else {
  354|     51|         basecase_sqr(z, z_size, x, x_sw);
  355|     51|      }
  356|    121|   }
  357|    297|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_114karatsuba_sizeEmmmmm:
  203|     86|size_t karatsuba_size(size_t z_size, size_t x_size, size_t x_sw, size_t y_size, size_t y_sw) {
  204|     86|   if(x_sw > x_size || x_sw > y_size || y_sw > x_size || y_sw > y_size) {
  ------------------
  |  Branch (204:7): [True: 0, False: 86]
  |  Branch (204:24): [True: 0, False: 86]
  |  Branch (204:41): [True: 0, False: 86]
  |  Branch (204:58): [True: 0, False: 86]
  ------------------
  205|      0|      return 0;
  206|      0|   }
  207|       |
  208|     86|   if(((x_size == x_sw) && (x_size % 2 != 0)) || ((y_size == y_sw) && (y_size % 2 != 0))) {
  ------------------
  |  Branch (208:8): [True: 22, False: 64]
  |  Branch (208:28): [True: 0, False: 22]
  |  Branch (208:51): [True: 22, False: 64]
  |  Branch (208:71): [True: 0, False: 22]
  ------------------
  209|      0|      return 0;
  210|      0|   }
  211|       |
  212|     86|   const size_t start = (x_sw > y_sw) ? x_sw : y_sw;
  ------------------
  |  Branch (212:25): [True: 0, False: 86]
  ------------------
  213|     86|   const size_t end = (x_size < y_size) ? x_size : y_size;
  ------------------
  |  Branch (213:23): [True: 0, False: 86]
  ------------------
  214|       |
  215|     86|   if(start == end) {
  ------------------
  |  Branch (215:7): [True: 22, False: 64]
  ------------------
  216|     22|      if(start % 2 != 0) {
  ------------------
  |  Branch (216:10): [True: 0, False: 22]
  ------------------
  217|      0|         return 0;
  218|      0|      }
  219|     22|      return start;
  220|     22|   }
  221|       |
  222|     98|   for(size_t j = start; j <= end; ++j) {
  ------------------
  |  Branch (222:26): [True: 98, False: 0]
  ------------------
  223|     98|      if(j % 2 != 0) {
  ------------------
  |  Branch (223:10): [True: 34, False: 64]
  ------------------
  224|     34|         continue;
  225|     34|      }
  226|       |
  227|     64|      if(2 * j > z_size) {
  ------------------
  |  Branch (227:10): [True: 0, False: 64]
  ------------------
  228|      0|         return 0;
  229|      0|      }
  230|       |
  231|     64|      if(x_sw <= j && j <= x_size && y_sw <= j && j <= y_size) {
  ------------------
  |  Branch (231:10): [True: 64, False: 0]
  |  Branch (231:23): [True: 64, False: 0]
  |  Branch (231:38): [True: 64, False: 0]
  |  Branch (231:51): [True: 64, False: 0]
  ------------------
  232|     64|         if(j % 4 == 2 && (j + 2) <= x_size && (j + 2) <= y_size && 2 * (j + 2) <= z_size) {
  ------------------
  |  Branch (232:13): [True: 42, False: 22]
  |  Branch (232:27): [True: 42, False: 0]
  |  Branch (232:48): [True: 42, False: 0]
  |  Branch (232:69): [True: 42, False: 0]
  ------------------
  233|     42|            return j + 2;
  234|     42|         }
  235|     22|         return j;
  236|     64|      }
  237|     64|   }
  238|       |
  239|      0|   return 0;
  240|     64|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_113karatsuba_mulEPmPKmS3_mS1_:
   80|  1.02k|void karatsuba_mul(word z[], const word x[], const word y[], size_t N, word workspace[]) {
   81|  1.02k|   if(N < KARATSUBA_MULTIPLY_THRESHOLD || N % 2 != 0) {
  ------------------
  |  Branch (81:7): [True: 714, False: 314]
  |  Branch (81:43): [True: 0, False: 314]
  ------------------
   82|    714|      switch(N) {
   83|      0|         case 6:
  ------------------
  |  Branch (83:10): [True: 0, False: 714]
  ------------------
   84|      0|            return bigint_comba_mul6(z, x, y);
   85|      0|         case 8:
  ------------------
  |  Branch (85:10): [True: 0, False: 714]
  ------------------
   86|      0|            return bigint_comba_mul8(z, x, y);
   87|      0|         case 9:
  ------------------
  |  Branch (87:10): [True: 0, False: 714]
  ------------------
   88|      0|            return bigint_comba_mul9(z, x, y);
   89|    327|         case 16:
  ------------------
  |  Branch (89:10): [True: 327, False: 387]
  ------------------
   90|    327|            return bigint_comba_mul16(z, x, y);
   91|     45|         case 24:
  ------------------
  |  Branch (91:10): [True: 45, False: 669]
  ------------------
   92|     45|            return bigint_comba_mul24(z, x, y);
   93|    342|         default:
  ------------------
  |  Branch (93:10): [True: 342, False: 372]
  ------------------
   94|    342|            return basecase_mul(z, 2 * N, x, N, y, N);
   95|    714|      }
   96|    714|   }
   97|       |
   98|    314|   const size_t N2 = N / 2;
   99|       |
  100|    314|   const word* x0 = x;
  101|    314|   const word* x1 = x + N2;
  102|    314|   const word* y0 = y;
  103|    314|   const word* y1 = y + N2;
  104|    314|   word* z0 = z;
  105|    314|   word* z1 = z + N;
  106|       |
  107|    314|   word* ws0 = workspace;
  108|    314|   word* ws1 = workspace + N;
  109|       |
  110|    314|   zeroize_buffer(workspace, 2 * N);
  111|       |
  112|       |   /*
  113|       |   * If either of cmp0 or cmp1 is zero then z0 or z1 resp is zero here,
  114|       |   * resulting in a no-op - z0*z1 will be equal to zero so we don't need to do
  115|       |   * anything, zeroize_buffer above already set the correct result.
  116|       |   *
  117|       |   * However we ignore the result of the comparisons and always perform the
  118|       |   * subtractions and recursively multiply to avoid the timing channel.
  119|       |   */
  120|       |
  121|       |   // First compute (X_lo - X_hi)*(Y_hi - Y_lo)
  122|    314|   const auto cmp0 = bigint_sub_abs(z0, x0, x1, N2, workspace);
  123|    314|   const auto cmp1 = bigint_sub_abs(z1, y1, y0, N2, workspace);
  124|    314|   const auto neg_mask = ~(cmp0 ^ cmp1);
  125|       |
  126|    314|   karatsuba_mul(ws0, z0, z1, N2, ws1);
  127|       |
  128|       |   // Compute X_lo * Y_lo
  129|    314|   karatsuba_mul(z0, x0, y0, N2, ws1);
  130|       |
  131|       |   // Compute X_hi * Y_hi
  132|    314|   karatsuba_mul(z1, x1, y1, N2, ws1);
  133|       |
  134|    314|   const word ws_carry = bigint_add3(ws1, z0, N, z1, N);
  135|    314|   word z_carry = bigint_add2(z + N2, N, ws1, N);
  136|       |
  137|    314|   z_carry += bigint_add2(z + N + N2, N2, &ws_carry, 1);
  138|    314|   bigint_add2(z + N + N2, N2, &z_carry, 1);
  139|       |
  140|    314|   zeroize_buffer(workspace + N, N2);
  141|       |
  142|    314|   bigint_cnd_add(neg_mask.value(), z + N2, workspace, 2 * N - N2);
  143|    314|   bigint_cnd_sub((~neg_mask).value(), z + N2, workspace, 2 * N - N2);
  144|    314|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_114karatsuba_sizeEmmm:
  245|    121|size_t karatsuba_size(size_t z_size, size_t x_size, size_t x_sw) {
  246|    121|   if(x_sw == x_size) {
  ------------------
  |  Branch (246:7): [True: 22, False: 99]
  ------------------
  247|     22|      if(x_sw % 2 != 0) {
  ------------------
  |  Branch (247:10): [True: 0, False: 22]
  ------------------
  248|      0|         return 0;
  249|      0|      }
  250|     22|      return x_sw;
  251|     22|   }
  252|       |
  253|    150|   for(size_t j = x_sw; j <= x_size; ++j) {
  ------------------
  |  Branch (253:25): [True: 150, False: 0]
  ------------------
  254|    150|      if(j % 2 != 0) {
  ------------------
  |  Branch (254:10): [True: 51, False: 99]
  ------------------
  255|     51|         continue;
  256|     51|      }
  257|       |
  258|     99|      if(2 * j > z_size) {
  ------------------
  |  Branch (258:10): [True: 51, False: 48]
  ------------------
  259|     51|         return 0;
  260|     51|      }
  261|       |
  262|     48|      if(j % 4 == 2 && (j + 2) <= x_size && 2 * (j + 2) <= z_size) {
  ------------------
  |  Branch (262:10): [True: 33, False: 15]
  |  Branch (262:24): [True: 33, False: 0]
  |  Branch (262:45): [True: 0, False: 33]
  ------------------
  263|      0|         return j + 2;
  264|      0|      }
  265|     48|      return j;
  266|     48|   }
  267|       |
  268|      0|   return 0;
  269|     99|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_113karatsuba_sqrEPmPKmmS1_:
  149|    523|void karatsuba_sqr(word z[], const word x[], size_t N, word workspace[]) {
  150|    523|   if(N < KARATSUBA_SQUARE_THRESHOLD || N % 2 != 0) {
  ------------------
  |  Branch (150:7): [True: 342, False: 181]
  |  Branch (150:41): [True: 30, False: 151]
  ------------------
  151|    372|      switch(N) {
  152|      0|         case 6:
  ------------------
  |  Branch (152:10): [True: 0, False: 372]
  ------------------
  153|      0|            return bigint_comba_sqr6(z, x);
  154|      0|         case 8:
  ------------------
  |  Branch (154:10): [True: 0, False: 372]
  ------------------
  155|      0|            return bigint_comba_sqr8(z, x);
  156|      0|         case 9:
  ------------------
  |  Branch (156:10): [True: 0, False: 372]
  ------------------
  157|      0|            return bigint_comba_sqr9(z, x);
  158|    192|         case 16:
  ------------------
  |  Branch (158:10): [True: 192, False: 180]
  ------------------
  159|    192|            return bigint_comba_sqr16(z, x);
  160|     12|         case 24:
  ------------------
  |  Branch (160:10): [True: 12, False: 360]
  ------------------
  161|     12|            return bigint_comba_sqr24(z, x);
  162|    168|         default:
  ------------------
  |  Branch (162:10): [True: 168, False: 204]
  ------------------
  163|    168|            return basecase_sqr(z, 2 * N, x, N);
  164|    372|      }
  165|    372|   }
  166|       |
  167|    151|   const size_t N2 = N / 2;
  168|       |
  169|    151|   const word* x0 = x;
  170|    151|   const word* x1 = x + N2;
  171|    151|   word* z0 = z;
  172|    151|   word* z1 = z + N;
  173|       |
  174|    151|   word* ws0 = workspace;
  175|    151|   word* ws1 = workspace + N;
  176|       |
  177|    151|   zeroize_buffer(workspace, 2 * N);
  178|       |
  179|       |   // See comment in karatsuba_mul
  180|    151|   bigint_sub_abs(z0, x0, x1, N2, workspace);
  181|    151|   karatsuba_sqr(ws0, z0, N2, ws1);
  182|       |
  183|    151|   karatsuba_sqr(z0, x0, N2, ws1);
  184|    151|   karatsuba_sqr(z1, x1, N2, ws1);
  185|       |
  186|    151|   const word ws_carry = bigint_add3(ws1, z0, N, z1, N);
  187|    151|   word z_carry = bigint_add2(z + N2, N, ws1, N);
  188|       |
  189|    151|   z_carry += bigint_add2(z + N + N2, N2, &ws_carry, 1);
  190|    151|   bigint_add2(z + N + N2, N2, &z_carry, 1);
  191|       |
  192|       |   /*
  193|       |   * This is only actually required if cmp (result of bigint_sub_abs) is != 0,
  194|       |   * however if cmp==0 then ws0[0:N] == 0 and avoiding the jump hides a
  195|       |   * timing channel.
  196|       |   */
  197|    151|   bigint_sub2(z + N2, 2 * N - N2, ws0, N);
  198|    151|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm4EEEbmmmmm:
  272|    174|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|    174|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 19, False: 155]
  |  Branch (273:26): [True: 19, False: 0]
  |  Branch (273:42): [True: 19, False: 0]
  |  Branch (273:56): [True: 19, False: 0]
  |  Branch (273:72): [True: 19, False: 0]
  ------------------
  274|    174|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm6EEEbmmmmm:
  272|    155|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|    155|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 7, False: 148]
  |  Branch (273:26): [True: 7, False: 0]
  |  Branch (273:42): [True: 7, False: 0]
  |  Branch (273:56): [True: 7, False: 0]
  |  Branch (273:72): [True: 7, False: 0]
  ------------------
  274|    155|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm8EEEbmmmmm:
  272|    148|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|    148|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 11, False: 137]
  |  Branch (273:26): [True: 11, False: 0]
  |  Branch (273:42): [True: 11, False: 0]
  |  Branch (273:56): [True: 11, False: 0]
  |  Branch (273:72): [True: 11, False: 0]
  ------------------
  274|    148|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm9EEEbmmmmm:
  272|    137|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|    137|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 5, False: 132]
  |  Branch (273:26): [True: 5, False: 0]
  |  Branch (273:42): [True: 5, False: 0]
  |  Branch (273:56): [True: 5, False: 0]
  |  Branch (273:72): [True: 5, False: 0]
  ------------------
  274|    137|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm16EEEbmmmmm:
  272|    132|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|    132|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 15, False: 117]
  |  Branch (273:26): [True: 15, False: 0]
  |  Branch (273:42): [True: 15, False: 0]
  |  Branch (273:56): [True: 15, False: 0]
  |  Branch (273:72): [True: 15, False: 0]
  ------------------
  274|    132|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm24EEEbmmmmm:
  272|    117|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|    117|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 17, False: 100]
  |  Branch (273:26): [True: 17, False: 0]
  |  Branch (273:42): [True: 17, False: 0]
  |  Branch (273:56): [True: 17, False: 0]
  |  Branch (273:72): [True: 17, False: 0]
  ------------------
  274|    117|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm4EEEbmmm:
  277|    178|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  278|    178|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (278:12): [True: 23, False: 155]
  |  Branch (278:26): [True: 23, False: 0]
  |  Branch (278:42): [True: 4, False: 19]
  ------------------
  279|    178|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm6EEEbmmm:
  277|    174|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  278|    174|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (278:12): [True: 26, False: 148]
  |  Branch (278:26): [True: 26, False: 0]
  |  Branch (278:42): [True: 2, False: 24]
  ------------------
  279|    174|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm8EEEbmmm:
  277|    172|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  278|    172|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (278:12): [True: 35, False: 137]
  |  Branch (278:26): [True: 35, False: 0]
  |  Branch (278:42): [True: 5, False: 30]
  ------------------
  279|    172|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm9EEEbmmm:
  277|    167|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  278|    167|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (278:12): [True: 35, False: 132]
  |  Branch (278:26): [True: 23, False: 12]
  |  Branch (278:42): [True: 5, False: 18]
  ------------------
  279|    167|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm16EEEbmmm:
  277|    162|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  278|    162|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (278:12): [True: 45, False: 117]
  |  Branch (278:26): [True: 33, False: 12]
  |  Branch (278:42): [True: 1, False: 32]
  ------------------
  279|    162|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm24EEEbmmm:
  277|    161|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  278|    161|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (278:12): [True: 61, False: 100]
  |  Branch (278:26): [True: 38, False: 23]
  |  Branch (278:42): [True: 2, False: 36]
  ------------------
  279|    161|}

_ZN5Botan6squareERKNS_6BigIntE:
  184|    297|BigInt square(const BigInt& x) {
  185|    297|   BigInt z = x;
  186|    297|   secure_vector<word> ws;
  187|    297|   z.square(ws);
  188|    297|   return z;
  189|    297|}

_ZN5Botan15allocate_memoryEmm:
   21|  1.65k|BOTAN_MALLOC_FN void* allocate_memory(size_t elems, size_t elem_size) {
   22|  1.65k|   if(elems == 0 || elem_size == 0) {
  ------------------
  |  Branch (22:7): [True: 0, False: 1.65k]
  |  Branch (22:21): [True: 0, False: 1.65k]
  ------------------
   23|      0|      return nullptr;
   24|      0|   }
   25|       |
   26|       |   // Some calloc implementations do not check for overflow (?!?)
   27|  1.65k|   if(!checked_mul(elems, elem_size).has_value()) {
  ------------------
  |  Branch (27:7): [True: 0, False: 1.65k]
  ------------------
   28|      0|      throw std::bad_alloc();
   29|      0|   }
   30|       |
   31|       |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR)
   32|       |   // NOLINTNEXTLINE(*-const-correctness) bug in clang-tidy
   33|       |   if(void* p = mlock_allocator::instance().allocate(elems, elem_size)) {
   34|       |      return p;
   35|       |   }
   36|       |#endif
   37|       |
   38|       |#if defined(BOTAN_TARGET_OS_HAS_ALLOC_CONCEAL)
   39|       |   void* ptr = ::calloc_conceal(elems, elem_size);
   40|       |#else
   41|       |   // NOLINTNEXTLINE(*-const-correctness) bug in clang-tidy
   42|  1.65k|   void* ptr = std::calloc(elems, elem_size);  // NOLINT(*-no-malloc,*-owning-memory)
   43|  1.65k|#endif
   44|  1.65k|   if(ptr == nullptr) {
  ------------------
  |  Branch (44:7): [True: 0, False: 1.65k]
  ------------------
   45|      0|      [[unlikely]] throw std::bad_alloc();
   46|      0|   }
   47|  1.65k|   return ptr;
   48|  1.65k|}
_ZN5Botan17deallocate_memoryEPvmm:
   50|  1.65k|void deallocate_memory(void* p, size_t elems, size_t elem_size) {
   51|  1.65k|   if(p == nullptr) {
  ------------------
  |  Branch (51:7): [True: 0, False: 1.65k]
  ------------------
   52|      0|      [[unlikely]] return;
   53|      0|   }
   54|       |
   55|  1.65k|   secure_scrub_memory(p, elems * elem_size);
   56|       |
   57|       |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR)
   58|       |   if(mlock_allocator::instance().deallocate(p, elems, elem_size)) {
   59|       |      return;
   60|       |   }
   61|       |#endif
   62|       |
   63|  1.65k|   std::free(p);  // NOLINT(*-no-malloc,*-owning-memory)
   64|  1.65k|}

_ZN5Botan19secure_scrub_memoryEPvm:
   24|  1.65k|void secure_scrub_memory(void* ptr, size_t n) {
   25|  1.65k|   return secure_zeroize_buffer(ptr, n);
   26|  1.65k|}
_ZN5Botan21secure_zeroize_bufferEPvm:
   28|  1.65k|void secure_zeroize_buffer(void* ptr, size_t n) {
   29|  1.65k|   if(n == 0) {
  ------------------
  |  Branch (29:7): [True: 0, False: 1.65k]
  ------------------
   30|      0|      return;
   31|      0|   }
   32|       |
   33|       |#if defined(BOTAN_TARGET_OS_HAS_RTLSECUREZEROMEMORY)
   34|       |   ::RtlSecureZeroMemory(ptr, n);
   35|       |
   36|       |#elif defined(BOTAN_TARGET_OS_HAS_EXPLICIT_BZERO)
   37|  1.65k|   ::explicit_bzero(ptr, n);
   38|       |
   39|       |#elif defined(BOTAN_TARGET_OS_HAS_EXPLICIT_MEMSET)
   40|       |   (void)::explicit_memset(ptr, 0, n);
   41|       |
   42|       |#else
   43|       |   /*
   44|       |   * Call memset through a static volatile pointer, which the compiler should
   45|       |   * not elide. This construct should be safe in conforming compilers, but who
   46|       |   * knows. This has been checked to generate the expected code, which saves the
   47|       |   * memset address in the data segment and unconditionally loads and jumps to
   48|       |   * that address, with the following targets:
   49|       |   *
   50|       |   * x86-64: Clang 19, GCC 6, 11, 13, 14
   51|       |   * riscv64: GCC 14
   52|       |   * aarch64: GCC 14
   53|       |   * armv7: GCC 14
   54|       |   *
   55|       |   * Actually all of them generated the expected jump even without marking the
   56|       |   * function pointer as volatile. However this seems worth including as an
   57|       |   * additional precaution.
   58|       |   */
   59|       |   static void* (*const volatile memset_ptr)(void*, int, size_t) = std::memset;
   60|       |   (memset_ptr)(ptr, 0, n);
   61|       |#endif
   62|  1.65k|}