diff --git a/examples/crypto.zr b/examples/crypto.zr
deleted file mode 100644
index eef3238..0000000
--- a/examples/crypto.zr
+++ /dev/null
@@ -1,59 +0,0 @@
-func main[] : i64
-    // Blake2b
-    let out: ptr = crypto.blake2b.hash(32, 0, 0, "Hello, World!", 13)
-    io.print("Blake2b-256: ")
-    io.println(str.hex_encode(out, 32))
-
-    io.print("Blake2b-512: ")
-    out = crypto.blake2b.hash(64, 0, 0, "Hello, World!", 13)
-    io.println(str.hex_encode(out, 64))
-
-    // XChaCha20
-    let key: ptr = str.hex_decode("000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f")
-    let nonce: ptr = str.hex_decode("000102030405060708090a0b0c0d0e0f1011121314151617")
-
-    let input: str = "Hello, World!"
-    let input_len: i64 = str.len(input)
-
-    let ciphertext: ptr = crypto.xchacha20.xor_no_auth(key, nonce, input, input_len)
-    io.println(str.hex_encode(ciphertext, input_len))
-
-    // X25519
-    let scalar: ptr = str.hex_decode("a546e36bf0527c9d3b16154b82465edd62144c0ac1fc5a18506a2244ba449ac4")
-    let point: ptr = str.hex_decode("e6db6867583030db3594c1a424b15f7c726624ec26b3353b10a903a6d0ab1c4c")
-    let expected: ptr = str.hex_decode("c3da55379de9c6908e94ea4df28d084f32eccf03491c71f754b4075577a28552")
-
-    out = crypto.x25519.scalarmult(scalar, point)
-
-    io.print("Computed: ")
-    io.println(str.hex_encode(out, 32))
-    io.print("Expected: ")
-    io.println(str.hex_encode(expected, 32))
-
-    let base_point: ptr = mem.alloc(32)
-    mem.zero(base_point, 32)
-    base_point[0] = 9
-
-    let alice_private: ptr = str.hex_decode("77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a")
-    io.print("A_priv: ")
-    io.println(str.hex_encode(alice_private, 32))
-
-    let alice_public: ptr = crypto.x25519.scalarmult(alice_private, base_point)
-    io.print("A_pub: ")
-    io.println(str.hex_encode(alice_public, 32))
-
-    let bob_private: ptr = str.hex_decode("5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6dbddb79b1732920165")
-    io.print("B_priv: ")
-    io.println(str.hex_encode(bob_private, 32))
-
-    let bob_public: ptr = crypto.x25519.scalarmult(bob_private, base_point)
-    io.print("B_pub: ")
-    io.println(str.hex_encode(bob_public, 32))
-
-    let alice_shared: ptr = crypto.x25519.scalarmult(alice_private, bob_public)
-    io.print("A_shared: ")
-    io.println(str.hex_encode(alice_shared, 32))
-
-    let bob_shared: ptr = crypto.x25519.scalarmult(bob_private, alice_public)
-    io.print("B_shared: ")
-    io.println(str.hex_encode(bob_shared, 32))
diff --git a/src/main.rs b/src/main.rs
index b202732..ed804a8 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -70,11 +70,6 @@ fn compile_file(args: Args) -> Result<(), ZernError> {
         include_str!("std/syscalls.zr").into(),
     )?;
     compile_file_to(&mut codegen, "std.zr", include_str!("std/std.zr").into())?;
-    compile_file_to(
-        &mut codegen,
-        "crypto.zr",
-        include_str!("std/crypto.zr").into(),
-    )?;
     compile_file_to(&mut codegen, filename, source)?;
 
     if !args.output_asm {
@@ -133,6 +128,11 @@ struct Args {
 fn main() {
     let args = Args::parse();
 
+    if !args.use_gcc && !args.cflags.is_empty() {
+        eprintln!("You can't set CFLAGS if you're not using gcc. Add the -m flag.");
+        process::exit(1);
+    }
+
     if let Err(err) = compile_file(args) {
         eprintln!("{}", err);
         process::exit(1);
diff --git a/src/std/crypto.zr b/src/std/crypto.zr
deleted file mode 100644
index b462c4d..0000000
--- a/src/std/crypto.zr
+++ /dev/null
@@ -1,407 +0,0 @@
-// absolutely not production-ready
-
-func crypto.rotl32[x: i64, r: i64] : i64
-    return ((x << r) | (x >> (32 - r))) & 0xffffffff
-
-func crypto.rotr64[x: i64, y: i64] : i64
-    y = y & 63
-    if y == 0
-        return x
-    let lhs_mask: i64 = ((1 << (64 - y)) - 1)
-    let r: i64 = (x >> y) & lhs_mask
-    let l: i64 = (x << (64 - y))
-    return (r | l)
-
-func crypto.blake2b._G[v: ptr, a: i64, b: i64, c: i64, d: i64, x: i64, y: i64] : void
-    mem.write64(v + a * 8, mem.read64(v + a * 8) + mem.read64(v + b * 8) + x)
-    mem.write64(v + d * 8, crypto.rotr64(mem.read64(v + d * 8) ^ mem.read64(v + a * 8), 32))
-    mem.write64(v + c * 8, mem.read64(v + c * 8) + mem.read64(v + d * 8))
-    mem.write64(v + b * 8, crypto.rotr64(mem.read64(v + b * 8) ^ mem.read64(v + c * 8), 24))
-    mem.write64(v + a * 8, mem.read64(v + a * 8) + mem.read64(v + b * 8) + y)
-    mem.write64(v + d * 8, crypto.rotr64(mem.read64(v + d * 8) ^ mem.read64(v + a * 8), 16))
-    mem.write64(v + c * 8, mem.read64(v + c * 8) + mem.read64(v + d * 8))
-    mem.write64(v + b * 8, crypto.rotr64(mem.read64(v + b * 8) ^ mem.read64(v + c * 8), 63))
-
-func crypto.blake2b._compress[h: ptr, block: ptr, t0: i64, t1: i64, last: i64, iv: Array, sigma: Array] : void
-    let v: ptr = mem.alloc(16 * 8)
-    let m: ptr = mem.alloc(16 * 8)
-
-    for j in 0..8
-        mem.write64(v + j * 8, mem.read64(h + j * 8))
-        mem.write64(v + (j + 8) * 8, array.nth(iv, j))
-
-    mem.write64(v + 12 * 8, mem.read64(v + 12 * 8) ^ t0)
-    mem.write64(v + 13 * 8, mem.read64(v + 13 * 8) ^ t1)
-    if last
-        mem.write64(v + 14 * 8, mem.read64(v + 14 * 8) ^ 0xffffffffffffffff)
-
-    for j in 0..16
-        let w = 0
-        for k in 0..8
-            w = w | ((block[j * 8 + k] & 0xff) << (8 * k))
-        mem.write64(m + j * 8, w)
-
-    for r in 0..12
-        let base: i64 = r * 16
-        crypto.blake2b._G(v, 0, 4, 8, 12, mem.read64(m + array.nth(sigma, base + 0) * 8), mem.read64(m + array.nth(sigma, base + 1) * 8))
-        crypto.blake2b._G(v, 1, 5, 9, 13, mem.read64(m + array.nth(sigma, base + 2) * 8), mem.read64(m + array.nth(sigma, base + 3) * 8))
-        crypto.blake2b._G(v, 2, 6, 10, 14, mem.read64(m + array.nth(sigma, base + 4) * 8), mem.read64(m + array.nth(sigma, base + 5) * 8))
-        crypto.blake2b._G(v, 3, 7, 11, 15, mem.read64(m + array.nth(sigma, base + 6) * 8), mem.read64(m + array.nth(sigma, base + 7) * 8))
-        crypto.blake2b._G(v, 0, 5, 10, 15, mem.read64(m + array.nth(sigma, base + 8) * 8), mem.read64(m + array.nth(sigma, base + 9) * 8))
-        crypto.blake2b._G(v, 1, 6, 11, 12, mem.read64(m + array.nth(sigma, base + 10) * 8), mem.read64(m + array.nth(sigma, base + 11) * 8))
-        crypto.blake2b._G(v, 2, 7, 8, 13, mem.read64(m + array.nth(sigma, base + 12) * 8), mem.read64(m + array.nth(sigma, base + 13) * 8))
-        crypto.blake2b._G(v, 3, 4, 9, 14, mem.read64(m + array.nth(sigma, base + 14) * 8), mem.read64(m + array.nth(sigma, base + 15) * 8))
-
-    for j in 0..8
-        mem.write64(h + j * 8, mem.read64(h + j * 8) ^ (mem.read64(v + j * 8) ^ mem.read64(v + (j + 8) * 8)))
-    
-    mem.zero_and_free(v, 16 * 8)
-    mem.zero_and_free(m, 16 * 8)
-
-func crypto.blake2b.hash[outlen: i64, key: ptr, keylen: i64, input: ptr, inputlen: i64] : ptr
-    if outlen == 0 || outlen > 64 || keylen > 64
-        panic("invalid length passed to crypto.blake2b.hash")
-    let out: ptr = mem.alloc(outlen)
-    
-    // IV[i] = floor(2**w * frac(sqrt(prime(i+1)))), where prime(i)
-    // is the i:th prime number ( 2, 3, 5, 7, 11, 13, 17, 19 )
-    // and sqrt(x) is the square root of x.
-    // https://www.ietf.org/rfc/rfc7693#section-2.6
-    let iv: Array = [0x6a09e667f3bcc908, 0xbb67ae8584caa73b, 0x3c6ef372fe94f82b, 0xa54ff53a5f1d36f1, 0x510e527fade682d1, 0x9b05688c2b3e6c1f, 0x1f83d9abfb41bd6b, 0x5be0cd19137e2179]
-
-    // https://crypto.stackexchange.com/questions/108987/rationale-for-blake2-message-schedule
-    let sigma: Array = [0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,14,10,4,8,9,15,13,6,1,12,0,2,11,7,5,3,11,8,12,0,5,2,15,13,10,14,3,6,7,1,9,4,7,9,3,1,13,12,11,14,2,6,5,10,4,0,15,8,9,0,5,7,2,4,10,15,14,1,11,12,6,8,3,13,2,12,6,10,0,11,8,3,4,13,7,5,15,14,1,9,12,5,1,15,14,13,4,10,0,7,6,3,9,2,8,11,13,11,7,14,12,1,3,9,5,0,15,4,8,6,2,10,6,15,14,9,11,3,0,8,12,2,13,7,1,4,10,5,10,2,8,4,7,6,1,5,15,11,9,14,3,12,13,0,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,14,10,4,8,9,15,13,6,1,12,0,2,11,7,5,3]
-    
-    let h: ptr = mem.alloc(8 * 8)
-    let t0 = 0
-    let t1 = 0
-    let block: ptr = mem.alloc(128)
-    let c = 0
-
-    for i in 0..8
-        mem.write64(h + i * 8, array.nth(iv, i))
-
-    mem.write64(h, mem.read64(h) ^ (0x01010000 ^ ((keylen << 8) ^ outlen)))
-
-    if keylen > 0
-        mem.zero(block, 128)
-        mem.copy(key, block, keylen)
-        c = 128
-    else
-        c = 0
-    
-    for i in 0..inputlen
-        if c == 128
-            t0 = t0 + c
-            if t0 < c
-                t1 = t1 + 1
-            crypto.blake2b._compress(h, block, t0, t1, 0, iv, sigma)
-            c = 0
-        block[c] = input[i]
-        c = c + 1
-    
-    t0 = t0 + c
-    if t0 < c
-        t1 = t1 + 1
-    
-    if c < 128
-        for i in (c)..128
-            block[i] = 0
-    crypto.blake2b._compress(h, block, t0, t1, 1, iv, sigma)
-
-    for i in 0..outlen
-        out[i] = (mem.read64(h + (i >> 3) * 8) >> (8 * (i & 7))) & 0xff
-
-    mem.zero_and_free(h, 8 * 8)
-    mem.zero_and_free(block, 128)
-    array.free(iv)
-    array.free(sigma)
-    return out
-
-func crypto.chacha20._quarter_round[state: ptr, a: i64, b: i64, c: i64, d: i64] : void
-    let va: i64 = mem.read32(state + a * 4)
-    let vb: i64 = mem.read32(state + b * 4)
-    let vc: i64 = mem.read32(state + c * 4)
-    let vd: i64 = mem.read32(state + d * 4)
-    va = (va + vb) & 0xffffffff
-    vd = vd ^ va
-    vd = crypto.rotl32(vd, 16)
-    vc = (vc + vd) & 0xffffffff
-    vb = vb ^ vc
-    vb = crypto.rotl32(vb, 12)
-    va = (va + vb) & 0xffffffff
-    vd = vd ^ va
-    vd = crypto.rotl32(vd, 8)
-    vc = (vc + vd) & 0xffffffff
-    vb = vb ^ vc
-    vb = crypto.rotl32(vb, 7)
-    mem.write32(state + a * 4, va)
-    mem.write32(state + b * 4, vb)
-    mem.write32(state + c * 4, vc)
-    mem.write32(state + d * 4, vd)
-
-func crypto.xchacha20._permute[state: ptr] : void
-    for i in 0..10
-        crypto.chacha20._quarter_round(state, 0, 4, 8, 12)
-        crypto.chacha20._quarter_round(state, 1, 5, 9, 13)
-        crypto.chacha20._quarter_round(state, 2, 6, 10, 14)
-        crypto.chacha20._quarter_round(state, 3, 7, 11, 15)
-        crypto.chacha20._quarter_round(state, 0, 5, 10, 15)
-        crypto.chacha20._quarter_round(state, 1, 6, 11, 12)
-        crypto.chacha20._quarter_round(state, 2, 7, 8, 13)
-        crypto.chacha20._quarter_round(state, 3, 4, 9, 14)
-
-func crypto.xchacha20._block[key: ptr, nonce: ptr, blocknum: i64, out: ptr] : void
-    let sigma: str = "expand 32-byte k"
-    let state: ptr = mem.alloc(16 * 4)
-
-    mem.write32(state + 0, mem.read32(sigma + 0))
-    mem.write32(state + 4, mem.read32(sigma + 4))
-    mem.write32(state + 8, mem.read32(sigma + 8))
-    mem.write32(state + 12, mem.read32(sigma + 12))
-
-    for i in 0..8
-        mem.write32(state + (4 + i) * 4, mem.read32(key + i * 4))
-
-    mem.write32(state + 12 * 4, blocknum)
-    mem.write32(state + 13 * 4, mem.read32(nonce + 0))
-    mem.write32(state + 14 * 4, mem.read32(nonce + 4))
-    mem.write32(state + 15 * 4, mem.read32(nonce + 8))
-
-    let working: ptr = mem.alloc(16 * 4)
-    for i in 0..16
-        mem.write32(working + i * 4, mem.read32(state + i * 4))
-
-    crypto.xchacha20._permute(working)
-
-    for i in 0..16
-        let v: i64 = (mem.read32(working + i * 4) + mem.read32(state + i * 4)) & 0xffffffff
-        mem.write32(out + i * 4, v)
-    mem.zero_and_free(working, 16 * 4)
-    mem.zero_and_free(state, 16 * 4)
-
-func crypto.xchacha20._hchacha20[key: ptr, input: ptr, out32: ptr] : void
-    let sigma: str = "expand 32-byte k"
-    let state: ptr = mem.alloc(16 * 4)
-
-    mem.write32(state + 0, mem.read32(sigma + 0))
-    mem.write32(state + 4, mem.read32(sigma + 4))
-    mem.write32(state + 8, mem.read32(sigma + 8))
-    mem.write32(state + 12, mem.read32(sigma + 12))
-
-    for i in 0..8
-        mem.write32(state + (4 + i) * 4, mem.read32(key + i * 4))
-
-    for i in 0..4
-        mem.write32(state + (12 + i) * 4, mem.read32(input + i * 4))
-
-    crypto.xchacha20._permute(state)
-
-    for i in 0..4
-        mem.write32(out32 + i * 4, mem.read32(state + i * 4))
-    for i in 0..4
-        mem.write32(out32 + 16 + i * 4, mem.read32(state + (12 + i) * 4))
-    mem.zero_and_free(state, 16 * 4)
-
-func crypto.xchacha20._stream[key: ptr, nonce: ptr, out: ptr, len: i64] : void
-    let subkey: ptr = mem.alloc(32)
-    crypto.xchacha20._hchacha20(key, nonce, subkey)
-
-    let nonce12: ptr = mem.alloc(12)
-    mem.zero(nonce12, 12)
-    mem.copy(nonce + 16, nonce12 + 4, 8)
-
-    let blocknum = 0
-    let remaining: i64 = len
-    let block: ptr = mem.alloc(64)
-
-    while remaining > 0
-        crypto.xchacha20._block(subkey, nonce12, blocknum, block)
-        let take = 64
-        if remaining < 64
-            take = remaining
-        mem.copy(block, out + len - remaining, take)
-        remaining = remaining - take
-        blocknum = blocknum + 1
-    mem.zero_and_free(block, 64)
-    mem.zero_and_free(nonce12, 12)
-    mem.zero_and_free(subkey, 32)
-
-// expects 32-byte key and 24-byte nonce
-// no way to verify that until we get actual strings
-func crypto.xchacha20.xor_no_auth[key: ptr, nonce: ptr, input: ptr, len: i64] : ptr
-    if len <= 0
-        let out: ptr = mem.alloc(1)
-        out[0] = 0
-        return out
-    let out: ptr = mem.alloc(len)
-    let ks: ptr = mem.alloc(len)
-    crypto.xchacha20._stream(key, nonce, ks, len)
-    for i in 0..len
-        out[i] = input[i] ^ ks[i]
-    mem.zero_and_free(ks, len)
-    return out
-
-func crypto.x25519.carry[elem: ptr] : void
-    for i in 0..16
-        let carry: i64 = mem.read64(elem + i * 8) >> 16
-        mem.write64(elem + i * 8, mem.read64(elem + i * 8) - (carry << 16))
-        if i < 15
-            mem.write64(elem + (i + 1) * 8, mem.read64(elem + (i + 1) * 8) + carry)
-        else
-            mem.write64(elem, mem.read64(elem) + 38 * carry)
-
-func crypto.x25519.fadd[out: ptr, a: ptr, b: ptr] : void
-    for i in 0..16
-        mem.write64(out + i * 8, mem.read64(a + i * 8) + mem.read64(b + i * 8))
-
-func crypto.x25519.fsub[out: ptr, a: ptr, b: ptr] : void
-    for i in 0..16
-        mem.write64(out + i * 8, mem.read64(a + i * 8) - mem.read64(b + i * 8))
-
-func crypto.x25519.fmul[out: ptr, a: ptr, b: ptr] : void
-    let product: ptr = mem.alloc(31 * 8)
-    for i in 0..31
-        mem.write64(product + i * 8, 0)
-    for i in 0..16
-        for j in 0..16
-            mem.write64(product + (i + j) * 8, mem.read64(product + (i + j) * 8) + (mem.read64(a + i * 8) * mem.read64(b + j * 8)))
-    for i in 0..15
-        mem.write64(product + i * 8, mem.read64(product + i * 8) + 38 * mem.read64(product + (i + 16) * 8))
-    for i in 0..16
-        mem.write64(out + i * 8, mem.read64(product + i * 8))
-
-    crypto.x25519.carry(out)
-    crypto.x25519.carry(out)
-    mem.zero_and_free(product, 31 * 8)
-
-func crypto.x25519.finverse[out: ptr, input: ptr] : void
-    let c: ptr = mem.alloc(16 * 8)
-    for i in 0..16
-        mem.write64(c + i * 8, mem.read64(input + i * 8))
-    
-    let i = 253
-    while i >= 0
-        crypto.x25519.fmul(c, c, c)
-        if i != 2 && i != 4
-            crypto.x25519.fmul(c, c, input)
-        i = i - 1
-
-    for i in 0..16
-        mem.write64(out + i * 8, mem.read64(c + i * 8))
-    mem.zero_and_free(c, 16 * 8)
-
-func crypto.x25519.swap[p: ptr, q: ptr, bit: i64] : void
-    for i in 0..16
-        let t: i64 = (-bit) & (mem.read64(p + i * 8) ^ mem.read64(q + i * 8))
-        mem.write64(p + i * 8, mem.read64(p + i * 8) ^ t)
-        mem.write64(q + i * 8, mem.read64(q + i * 8) ^ t)
-
-func crypto.x25519.unpack[out: ptr, input: ptr] : void
-    for i in 0..16
-        mem.write64(out + i * 8, input[i * 2] + (input[i * 2 + 1] << 8))
-    mem.write64(out + 8 * 15, mem.read64(out + 8 * 15) & 0x7fff)
-
-func crypto.x25519.pack[out: ptr, input: ptr] : void
-    let t: ptr = mem.alloc(16 * 8)
-    for i in 0..16
-        mem.write64(t + i * 8, mem.read64(input + i * 8))
-    let m: ptr = mem.alloc(16 * 8)
-
-    crypto.x25519.carry(t)
-    crypto.x25519.carry(t)
-    crypto.x25519.carry(t)
-    for j in 0..2
-        mem.write64(m, mem.read64(t) - 0xffed)
-        for i in 1..15
-            mem.write64(m + i * 8, mem.read64(t + i * 8) - 0xffff - ((mem.read64(m + (i - 1) * 8) >> 16) & 1))
-            mem.write64(m + (i - 1) * 8, mem.read64(m + (i - 1) * 8) & 0xffff)
-        mem.write64(m + 15 * 8, mem.read64(t + 15 * 8) - 0x7fff - ((mem.read64(m + 14 * 8) >> 16) & 1))
-        let carry: i64 = (mem.read64(m + 15 * 8) >> 16) & 1
-        mem.write64(m + 14 * 8, mem.read64(m + 14 * 8) & 0xffff)
-        crypto.x25519.swap(t, m, 1 - carry)
-    
-    for i in 0..16
-        let v: i64 = mem.read64(t + i * 8)
-        out[i * 2] = v & 0xff
-        out[i * 2 + 1] = (v >> 8) & 0xff
-
-    mem.zero_and_free(t, 16 * 8)
-    mem.zero_and_free(m, 16 * 8)
-
-func crypto.x25519.scalarmult[scalar: ptr, point: ptr] : ptr
-    let clamped: ptr = mem.alloc(32)
-    let a: ptr = mem.alloc(16 * 8)
-    let b: ptr = mem.alloc(16 * 8)
-    let c: ptr = mem.alloc(16 * 8)
-    let d: ptr = mem.alloc(16 * 8)
-    let e: ptr = mem.alloc(16 * 8)
-    let f: ptr = mem.alloc(16 * 8)
-    let x: ptr = mem.alloc(16 * 8)
-
-    // "A" parameter in Curve25519
-    // 121665 = (486662 - 2)/4
-    let magic: ptr = mem.alloc(16 * 8)
-    mem.zero(magic, 16 * 8)
-    mem.write64(magic, 0xdb41)
-    mem.write64(magic + 8, 1)
-
-    // copy and clamp scalar
-    mem.copy(scalar, clamped, 32)
-    clamped[0] = clamped[0] & 0xf8
-    clamped[31] = (clamped[31] & 0x7f) | 0x40
-
-    // load point
-    crypto.x25519.unpack(x, point)
-
-    // initialize ladder state
-    for i in 0..16
-        mem.write64(a + i * 8, 0)
-        mem.write64(b + i * 8, mem.read64(x + i * 8))
-        mem.write64(c + i * 8, 0)
-        mem.write64(d + i * 8, 0)
-    mem.write64(a, 1)
-    mem.write64(d, 1)
-
-    let i = 254
-    while i >= 0
-        let bit: i64 = (clamped[i >> 3] >> (i & 7)) & 1
-        crypto.x25519.swap(a, b, bit)
-        crypto.x25519.swap(c, d, bit)
-        crypto.x25519.fadd(e, a, c)
-        crypto.x25519.fsub(a, a, c)
-        crypto.x25519.fadd(c, b, d)
-        crypto.x25519.fsub(b, b, d)
-        crypto.x25519.fmul(d, e, e)
-        crypto.x25519.fmul(f, a, a)
-        crypto.x25519.fmul(a, c, a)
-        crypto.x25519.fmul(c, b, e)
-        crypto.x25519.fadd(e, a, c)
-        crypto.x25519.fsub(a, a, c)
-        crypto.x25519.fmul(b, a, a)
-        crypto.x25519.fsub(c, d, f)
-        crypto.x25519.fmul(a, c, magic)
-        crypto.x25519.fadd(a, a, d)
-        crypto.x25519.fmul(c, c, a)
-        crypto.x25519.fmul(a, d, f)
-        crypto.x25519.fmul(d, b, x)
-        crypto.x25519.fmul(b, e, e)
-        crypto.x25519.swap(a, b, bit)
-        crypto.x25519.swap(c, d, bit)
-        i = i - 1
-
-    crypto.x25519.finverse(c, c)
-    crypto.x25519.fmul(a, a, c)
-    let out: ptr = mem.alloc(32)
-    crypto.x25519.pack(out, a)
-
-    mem.zero_and_free(clamped, 32)
-    mem.zero_and_free(a, 16 * 8)
-    mem.zero_and_free(b, 16 * 8)
-    mem.zero_and_free(c, 16 * 8)
-    mem.zero_and_free(d, 16 * 8)
-    mem.zero_and_free(e, 16 * 8)
-    mem.zero_and_free(f, 16 * 8)
-    mem.zero_and_free(x, 16 * 8)
-    mem.free(magic)
-    return out