// File: /workspace/github_c_makefile_star2_O0/mjosaarinen[P]brutus/crypto_aead/primatesv1hanuman80/ref/encrypt.cpp
// Function: crypto_aead_decrypt
int crypto_aead_decrypt(
    unsigned char *m,unsigned long long *mlen,
    unsigned char *nsec,
    const unsigned char *c,unsigned long long clen,
    const unsigned char *ad,unsigned long long adlen,
    const unsigned char *npub,
    const unsigned char *k
)
{
	/*
    ... generating a plaintext m[0],m[1],...,m[*mlen-1]
    ... and secret message number nsec[0],nsec[1],...
    ... from a ciphertext c[0],c[1],...,c[clen-1]
    ... and associated data ad[0],ad[1],...,ad[adlen-1]
    ... and public message number npub[0],npub[1],...
    ... and secret key k[0],k[1],...
    ...
	*/
	unsigned char V[StateSize]; //the state represented in Elements
	//Temp variables represented as elements
	unsigned char key[KeySizeElements];
	unsigned char nonce[NonceSizeElements];
	unsigned char tag[TagSizeElements];
	unsigned char data[RateSizeElements];
	unsigned char cipher[RateSizeElements];
	
	*mlen=clen-TagSizeBytes;
	
	if(clen<TagSizeBytes) return -1; //invalid ciphertext
   
	//a temporary array for message
	unsigned char *mT = (unsigned char*) malloc(clen-TagSizeBytes);
    if (mT == NULL) return -2; // memory allocation failure
	
	Bytes2Element(key,k,0,KeySizeElements); //representing k as elements
	Bytes2Element(nonce,npub,0,NonceSizeElements); //representing npub as elements

	// V <-- p_1(O||K||N)
	InitializeState(V,key,nonce);
	p_1(V); 
	
	if(adlen!=0)
	{ 
		// for i=1 to u-1
		if(adlen>RateSizeBytes)
		{
			for(unsigned long long i=0; i<adlen-RateSizeBytes; i=i+RateSizeBytes)
			{
				Bytes2Element(data,ad,i,RateSizeElements); // representing a block of ad as elements
				// V <-- p_4 (A[i]^V_r || V_c)
				for(int j=0; j<RateSizeElements; j++)
					V[j]^=data[j];
				p_4(V);
			}
		}
		// V <-- A[u]^v_r || V_c
		int l = adlen%RateSizeBytes;
		if(l==0){ //do padding with spill over			
			Bytes2Element(data,ad,adlen-RateSizeBytes,RateSizeElements);
			for(int i=0; i<RateSizeElements; i++)
				V[i]^=data[i];
			V[RateSizeElements]^=16; //padding spills over to capacity
		}
		else{ //do standard padding
			unsigned char dataP[RateSizeBytes];
			for(int i=0; i< l; i++)
				dataP[i]=ad[adlen-l+i];
			dataP[l]=128; //padding over bytes
			for(int i=l+1; i<RateSizeBytes; i++)
				dataP[i]=0;
			Bytes2Element(data,dataP,0,RateSizeElements);
			for(int i=0; i<RateSizeElements; i++)
				V[i]^=data[i];
		}
		// V <-- p_1(V)
		p_1(V);	
	}

	//for i=1 to w-1 (except the last block which needs padding)
	if(clen-TagSizeBytes>RateSizeBytes)
	{
		for(unsigned long long i=0; i<clen-(TagSizeBytes+RateSizeBytes); i=i+RateSizeBytes)
		{ 
			Bytes2Element(cipher,c,i,RateSizeElements); //representing a block of c as elements
			// M[i] <-- C[i]^V_r
			for(int j=0; j<RateSizeElements; j++)
				data[j]=V[j]^cipher[j];
			Element2Bytes(mT,data,i,RateSizeBytes); //representing m as bytes
			//V <-- p_1 (C[i] || V_c)
			for(int j=0; j<RateSizeElements; j++)
				V[j]=cipher[j];
			p_1(V);
		}
	}
	//for i=w
	int l = clen%RateSizeBytes;
	// M[w] <-- C[w]^V_r
	// V <-- M[w]||10* ^ V
	if((l==0) && ((clen-TagSizeBytes)!=0)){ //do padding with spill over			
		Bytes2Element(cipher,c,clen-(TagSizeBytes+RateSizeBytes),RateSizeElements);
		for(int i=0; i<RateSizeElements; i++){
			data[i]=V[i]^cipher[i];
			V[i]=cipher[i];
		}
		Element2Bytes(mT,data,clen-(TagSizeBytes+RateSizeBytes),RateSizeBytes); //representing last block m as bytes
		V[RateSizeElements]^=16; //padding spills over to capacity
	}
	else{ //do standard padding
		unsigned char cipherP[RateSizeElements];
		unsigned char mtmp[RateSizeBytes];
		for(int i=0; i< RateSizeElements; i++)
			cipherP[i]=V[i];
		Element2Bytes(mtmp,cipherP,0,RateSizeBytes);
		for(int i=0; i< l; i++)
			mT[clen-TagSizeBytes-l+i]=mtmp[i]^c[clen-TagSizeBytes-l+i];		
		unsigned char dataP[RateSizeBytes];
		for(int i=0; i< l; i++)
			dataP[i]=mT[clen-TagSizeBytes-l+i];
		dataP[l]=128; //padding over bytes
		for(int i=l+1; i<RateSizeBytes; i++)
			dataP[i]=0;
		Bytes2Element(data,dataP,0,RateSizeElements);
		for(int i=0; i<RateSizeElements; i++)
			V[i]^=data[i];
	}
	//V <-- p_1 (V)
	p_1(V);

	// T <-- (V_c)_c/2 ^ K
	for(int i=0; i<TagSizeElements; i++)
		tag[i]=V[RateSizeElements+i]^key[i]; 
	unsigned char tagT[TagSizeBytes];
	Element2Bytes(tagT,tag,0,TagSizeBytes) ;

	unsigned char cor=0;
	for(int i=0; i<TagSizeBytes; i++) //check if tags match
		cor = cor || (tagT[i]^c[clen-TagSizeBytes+i]);

	if(cor==0) //if tags match release the message
		for(unsigned long long i=0; i<clen-TagSizeBytes; i++)
			m[i]=mT[i];

	free(mT);
    if(cor==0) return 0;
	else return -1;
}

// Assembly:
subq $0x148, %rsp            # imm = 0x148
movq 0x160(%rsp), %rax
movq 0x158(%rsp), %rax
movq 0x150(%rsp), %rax
movq %rdi, 0x138(%rsp)
movq %rsi, 0x130(%rsp)
movq %rdx, 0x128(%rsp)
movq %rcx, 0x120(%rsp)
movq %r8, 0x118(%rsp)
movq %r9, 0x110(%rsp)
movq 0x118(%rsp), %rcx
subq $0xa, %rcx
movq 0x130(%rsp), %rax
movq %rcx, (%rax)
cmpq $0xa, 0x118(%rsp)
jae 0x1991
movl $0xffffffff, 0x144(%rsp) # imm = 0xFFFFFFFF
jmp 0x21d1
movq 0x118(%rsp), %rdi
subq $0xa, %rdi
callq 0x1080
movq %rax, 0x98(%rsp)
cmpq $0x0, 0x98(%rsp)
jne 0x19c5
movl $0xfffffffe, 0x144(%rsp) # imm = 0xFFFFFFFE
jmp 0x21d1
leaq 0xd0(%rsp), %rdi
movq 0x160(%rsp), %rsi
xorl %eax, %eax
movl %eax, %edx
movl $0x10, %ecx
callq 0x1150
leaq 0xc0(%rsp), %rdi
movq 0x158(%rsp), %rsi
xorl %eax, %eax
movl %eax, %edx
movl $0x10, %ecx
callq 0x1150
leaq 0xe0(%rsp), %rdi
leaq 0xd0(%rsp), %rsi
leaq 0xc0(%rsp), %rdx
callq 0x10b0
leaq 0xe0(%rsp), %rdi
callq 0x1060
cmpq $0x0, 0x150(%rsp)
je 0x1cb7
cmpq $0x5, 0x150(%rsp)
jbe 0x1b0d
movq $0x0, 0x90(%rsp)
movq 0x90(%rsp), %rax
movq 0x150(%rsp), %rcx
subq $0x5, %rcx
cmpq %rcx, %rax
jae 0x1b0b
leaq 0xa8(%rsp), %rdi
movq 0x110(%rsp), %rsi
movq 0x90(%rsp), %rdx
movl $0x8, %ecx
callq 0x1150
movl $0x0, 0x8c(%rsp)
cmpl $0x8, 0x8c(%rsp)
jge 0x1ae5
movslq 0x8c(%rsp), %rax
movzbl 0xa8(%rsp,%rax), %edx
movslq 0x8c(%rsp), %rax
movzbl 0xe0(%rsp,%rax), %ecx
xorl %edx, %ecx
movb %cl, 0xe0(%rsp,%rax)
movl 0x8c(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x8c(%rsp)
jmp 0x1a9f
leaq 0xe0(%rsp), %rdi
callq 0x1050
movq 0x90(%rsp), %rax
addq $0x5, %rax
movq %rax, 0x90(%rsp)
jmp 0x1a55
jmp 0x1b0d
movq 0x150(%rsp), %rax
movl $0x5, %ecx
xorl %edx, %edx
divq %rcx
movl %edx, %eax
movl %eax, 0x88(%rsp)
cmpl $0x0, 0x88(%rsp)
jne 0x1bc4
leaq 0xa8(%rsp), %rdi
movq 0x110(%rsp), %rsi
movq 0x150(%rsp), %rdx
subq $0x5, %rdx
movl $0x8, %ecx
callq 0x1150
movl $0x0, 0x84(%rsp)
cmpl $0x8, 0x84(%rsp)
jge 0x1bad
movslq 0x84(%rsp), %rax
movzbl 0xa8(%rsp,%rax), %edx
movslq 0x84(%rsp), %rax
movzbl 0xe0(%rsp,%rax), %ecx
xorl %edx, %ecx
movb %cl, 0xe0(%rsp,%rax)
movl 0x84(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x84(%rsp)
jmp 0x1b67
movzbl 0xe8(%rsp), %eax
xorl $0x10, %eax
movb %al, 0xe8(%rsp)
jmp 0x1caa
movl $0x0, 0x78(%rsp)
movl 0x78(%rsp), %eax
cmpl 0x88(%rsp), %eax
jge 0x1c15
movq 0x110(%rsp), %rax
movq 0x150(%rsp), %rcx
movslq 0x88(%rsp), %rdx
subq %rdx, %rcx
movslq 0x78(%rsp), %rdx
addq %rdx, %rcx
movb (%rax,%rcx), %cl
movslq 0x78(%rsp), %rax
movb %cl, 0x7f(%rsp,%rax)
movl 0x78(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x78(%rsp)
jmp 0x1bcc
movslq 0x88(%rsp), %rax
movb $-0x80, 0x7f(%rsp,%rax)
movl 0x88(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x74(%rsp)
cmpl $0x5, 0x74(%rsp)
jge 0x1c4e
movslq 0x74(%rsp), %rax
movb $0x0, 0x7f(%rsp,%rax)
movl 0x74(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x74(%rsp)
jmp 0x1c30
leaq 0xa8(%rsp), %rdi
leaq 0x7f(%rsp), %rsi
xorl %eax, %eax
movl %eax, %edx
movl $0x8, %ecx
callq 0x1150
movl $0x0, 0x70(%rsp)
cmpl $0x8, 0x70(%rsp)
jge 0x1ca8
movslq 0x70(%rsp), %rax
movzbl 0xa8(%rsp,%rax), %edx
movslq 0x70(%rsp), %rax
movzbl 0xe0(%rsp,%rax), %ecx
xorl %edx, %ecx
movb %cl, 0xe0(%rsp,%rax)
movl 0x70(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x70(%rsp)
jmp 0x1c71
jmp 0x1caa
leaq 0xe0(%rsp), %rdi
callq 0x1060
movq 0x118(%rsp), %rax
subq $0xa, %rax
cmpq $0x5, %rax
jbe 0x1dca
movq $0x0, 0x68(%rsp)
movq 0x68(%rsp), %rax
movq 0x118(%rsp), %rcx
subq $0xf, %rcx
cmpq %rcx, %rax
jae 0x1dc8
leaq 0xa0(%rsp), %rdi
movq 0x120(%rsp), %rsi
movq 0x68(%rsp), %rdx
movl $0x8, %ecx
callq 0x1150
movl $0x0, 0x64(%rsp)
cmpl $0x8, 0x64(%rsp)
jge 0x1d55
movslq 0x64(%rsp), %rax
movzbl 0xe0(%rsp,%rax), %eax
movslq 0x64(%rsp), %rcx
movzbl 0xa0(%rsp,%rcx), %ecx
xorl %ecx, %eax
movb %al, %cl
movslq 0x64(%rsp), %rax
movb %cl, 0xa8(%rsp,%rax)
movl 0x64(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x64(%rsp)
jmp 0x1d17
movq 0x98(%rsp), %rdi
leaq 0xa8(%rsp), %rsi
movq 0x68(%rsp), %rdx
movl $0x5, %ecx
callq 0x1070
movl $0x0, 0x60(%rsp)
cmpl $0x8, 0x60(%rsp)
jge 0x1da8
movslq 0x60(%rsp), %rax
movb 0xa0(%rsp,%rax), %cl
movslq 0x60(%rsp), %rax
movb %cl, 0xe0(%rsp,%rax)
movl 0x60(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x60(%rsp)
jmp 0x1d7c
leaq 0xe0(%rsp), %rdi
callq 0x1060
movq 0x68(%rsp), %rax
addq $0x5, %rax
movq %rax, 0x68(%rsp)
jmp 0x1cd6
jmp 0x1dca
movq 0x118(%rsp), %rax
movl $0x5, %ecx
xorl %edx, %edx
divq %rcx
movl %edx, %eax
movl %eax, 0x5c(%rsp)
cmpl $0x0, 0x5c(%rsp)
jne 0x1ec4
movq 0x118(%rsp), %rax
subq $0xa, %rax
cmpq $0x0, %rax
je 0x1ec4
leaq 0xa0(%rsp), %rdi
movq 0x120(%rsp), %rsi
movq 0x118(%rsp), %rdx
subq $0xf, %rdx
movl $0x8, %ecx
callq 0x1150
movl $0x0, 0x58(%rsp)
cmpl $0x8, 0x58(%rsp)
jge 0x1e87
movslq 0x58(%rsp), %rax
movzbl 0xe0(%rsp,%rax), %eax
movslq 0x58(%rsp), %rcx
movzbl 0xa0(%rsp,%rcx), %ecx
xorl %ecx, %eax
movb %al, %cl
movslq 0x58(%rsp), %rax
movb %cl, 0xa8(%rsp,%rax)
movslq 0x58(%rsp), %rax
movb 0xa0(%rsp,%rax), %cl
movslq 0x58(%rsp), %rax
movb %cl, 0xe0(%rsp,%rax)
movl 0x58(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x58(%rsp)
jmp 0x1e31
movq 0x98(%rsp), %rdi
leaq 0xa8(%rsp), %rsi
movq 0x118(%rsp), %rdx
subq $0xf, %rdx
movl $0x5, %ecx
callq 0x1070
movzbl 0xe8(%rsp), %eax
xorl $0x10, %eax
movb %al, 0xe8(%rsp)
jmp 0x2067
movl $0x0, 0x44(%rsp)
cmpl $0x8, 0x44(%rsp)
jge 0x1ef5
movslq 0x44(%rsp), %rax
movb 0xe0(%rsp,%rax), %cl
movslq 0x44(%rsp), %rax
movb %cl, 0x50(%rsp,%rax)
movl 0x44(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x44(%rsp)
jmp 0x1ecc
leaq 0x4b(%rsp), %rdi
leaq 0x50(%rsp), %rsi
xorl %eax, %eax
movl %eax, %edx
movl $0x5, %ecx
callq 0x1070
movl $0x0, 0x40(%rsp)
movl 0x40(%rsp), %eax
cmpl 0x5c(%rsp), %eax
jge 0x1f89
movslq 0x40(%rsp), %rax
movzbl 0x4b(%rsp,%rax), %eax
movq 0x120(%rsp), %rcx
movq 0x118(%rsp), %rdx
subq $0xa, %rdx
movslq 0x5c(%rsp), %rsi
subq %rsi, %rdx
movslq 0x40(%rsp), %rsi
addq %rsi, %rdx
movzbl (%rcx,%rdx), %ecx
xorl %ecx, %eax
movb %al, %dl
movq 0x98(%rsp), %rax
movq 0x118(%rsp), %rcx
subq $0xa, %rcx
movslq 0x5c(%rsp), %rsi
subq %rsi, %rcx
movslq 0x40(%rsp), %rsi
addq %rsi, %rcx
movb %dl, (%rax,%rcx)
movl 0x40(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x40(%rsp)
jmp 0x1f15
movl $0x0, 0x34(%rsp)
movl 0x34(%rsp), %eax
cmpl 0x5c(%rsp), %eax
jge 0x1fd8
movq 0x98(%rsp), %rax
movq 0x118(%rsp), %rcx
subq $0xa, %rcx
movslq 0x5c(%rsp), %rdx
subq %rdx, %rcx
movslq 0x34(%rsp), %rdx
addq %rdx, %rcx
movb (%rax,%rcx), %cl
movslq 0x34(%rsp), %rax
movb %cl, 0x3b(%rsp,%rax)
movl 0x34(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x34(%rsp)
jmp 0x1f91
movslq 0x5c(%rsp), %rax
movb $-0x80, 0x3b(%rsp,%rax)
movl 0x5c(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x30(%rsp)
cmpl $0x5, 0x30(%rsp)
jge 0x200b
movslq 0x30(%rsp), %rax
movb $0x0, 0x3b(%rsp,%rax)
movl 0x30(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x30(%rsp)
jmp 0x1fed
leaq 0xa8(%rsp), %rdi
leaq 0x3b(%rsp), %rsi
xorl %eax, %eax
movl %eax, %edx
movl $0x8, %ecx
callq 0x1150
movl $0x0, 0x2c(%rsp)
cmpl $0x8, 0x2c(%rsp)
jge 0x2065
movslq 0x2c(%rsp), %rax
movzbl 0xa8(%rsp,%rax), %edx
movslq 0x2c(%rsp), %rax
movzbl 0xe0(%rsp,%rax), %ecx
xorl %edx, %ecx
movb %cl, 0xe0(%rsp,%rax)
movl 0x2c(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x2c(%rsp)
jmp 0x202e
jmp 0x2067
leaq 0xe0(%rsp), %rdi
callq 0x1060
movl $0x0, 0x28(%rsp)
cmpl $0x10, 0x28(%rsp)
jge 0x20be
movl 0x28(%rsp), %eax
addl $0x8, %eax
cltq
movzbl 0xe0(%rsp,%rax), %eax
movslq 0x28(%rsp), %rcx
movzbl 0xd0(%rsp,%rcx), %ecx
xorl %ecx, %eax
movb %al, %cl
movslq 0x28(%rsp), %rax
movb %cl, 0xb0(%rsp,%rax)
movl 0x28(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x28(%rsp)
jmp 0x207c
leaq 0x1e(%rsp), %rdi
leaq 0xb0(%rsp), %rsi
xorl %eax, %eax
movl %eax, %edx
movl $0xa, %ecx
callq 0x1070
movb $0x0, 0x1d(%rsp)
movl $0x0, 0x18(%rsp)
cmpl $0xa, 0x18(%rsp)
jge 0x2147
movb $0x1, %al
cmpb $0x0, 0x1d(%rsp)
movb %al, 0xf(%rsp)
jne 0x2130
movslq 0x18(%rsp), %rax
movzbl 0x1e(%rsp,%rax), %eax
movq 0x120(%rsp), %rcx
movq 0x118(%rsp), %rdx
subq $0xa, %rdx
movslq 0x18(%rsp), %rsi
addq %rsi, %rdx
movzbl (%rcx,%rdx), %ecx
xorl %ecx, %eax
cmpl $0x0, %eax
setne %al
movb %al, 0xf(%rsp)
movb 0xf(%rsp), %al
andb $0x1, %al
movb %al, 0x1d(%rsp)
movl 0x18(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x18(%rsp)
jmp 0x20e6
movzbl 0x1d(%rsp), %eax
cmpl $0x0, %eax
jne 0x21a2
movq $0x0, 0x10(%rsp)
movq 0x10(%rsp), %rax
movq 0x118(%rsp), %rcx
subq $0xa, %rcx
cmpq %rcx, %rax
jae 0x21a0
movq 0x98(%rsp), %rax
movq 0x10(%rsp), %rcx
movb (%rax,%rcx), %dl
movq 0x138(%rsp), %rax
movq 0x10(%rsp), %rcx
movb %dl, (%rax,%rcx)
movq 0x10(%rsp), %rax
addq $0x1, %rax
movq %rax, 0x10(%rsp)
jmp 0x215a
jmp 0x21a2
movq 0x98(%rsp), %rdi
callq 0x10d0
movzbl 0x1d(%rsp), %eax
cmpl $0x0, %eax
jne 0x21c6
movl $0x0, 0x144(%rsp)
jmp 0x21d1
movl $0xffffffff, 0x144(%rsp) # imm = 0xFFFFFFFF
movl 0x144(%rsp), %eax
addq $0x148, %rsp            # imm = 0x148
retq