// File: /workspace/github_c_makefile_star2_O3/mjosaarinen[P]brutus/crypto_aead/scream12v2/ref/tae.c
// Function: crypto_aead_decrypt
int crypto_aead_decrypt(
                        unsigned char *m,unsigned long long *outputmlen,
                        unsigned char *nsec,
                        const unsigned char *c,unsigned long long clen,
                        const unsigned char *ad,unsigned long long adlen,
                        const unsigned char *npub,
                        const unsigned char *k
                        )
{
    unsigned char K[blocklen];
    unsigned char T[blocklen] = {0};
    unsigned char auth[blocklen] = {0};
    unsigned char sum[blocklen] = {0};
    unsigned long long i;
    unsigned j;
    memcpy(K, k, blocklen);

    if (clen < CRYPTO_ABYTES) return -1;
    *outputmlen = clen - CRYPTO_ABYTES;

    /* Process Associated Data */
    memcpy(T, npub, CRYPTO_NPUBBYTES);
    T[15]  = 0x02;           /* control byte for a.d. */
    
    for (i=0; i<adlen; i+=blocklen) {

      unsigned char block[blocklen] = {0};

      if (i+blocklen < adlen) {
	/* Normal block */
	memcpy(block, ad+i, blocklen);
      } else if (i+blocklen == adlen) {
	/* Final block: full */
	memcpy(block, ad+i, blocklen);
	T[15] = 0x04;	
      } else {
	/* Final block: partial with padding */
	memcpy(block, ad+i, adlen % blocklen);
	block[adlen % blocklen] = 0x80;
	T[15] = 0x06;
      }

      LS_encrypt(block, K, T, block);
      for (j = 0; j < blocklen; j++)
	auth[j] ^= block[j];
      increment(T);
    }

    
    /* Process Message */
    memset(T, 0, blocklen);
    memcpy(T, npub, CRYPTO_NPUBBYTES);

    for (i=0; i < *outputmlen; i+=blocklen) {
      if (i+blocklen <= *outputmlen) {
	/* Full block (can be last block) */
	LS_decrypt(c+i, K, T, m+i);
	for (j=0; j < blocklen; j++)
	  sum[j] ^= m[i+j];

	increment(T);
      } else {
	/* Partial block (final) */
	unsigned char block[blocklen] = {0};
	block[15] = 8*(*outputmlen % blocklen);
	LS_encrypt(block, K, T, block);

	for (j=0; j < *outputmlen%blocklen; j++) {
	  m[i+j] = block[j] ^ c[i+j];
	  sum[j] ^= m[i+j];
	}
      }
    }

    /* Generate Tag */
    T[15] = ((8*(*outputmlen % blocklen)) << 1) | 1;

    LS_encrypt(sum, K, T, sum);
    for (i = 0; i < CRYPTO_ABYTES; i++)
      if (c[*outputmlen+i] != (auth[i] ^ sum[i])) {
	memset(m, 0, *outputmlen);
	return -1;
      }
    
    return 0;
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x78, %rsp
movq %rdi, 0x28(%rsp)
movq 0xc0(%rsp), %rax
vxorps %xmm0, %xmm0, %xmm0
vmovaps %xmm0, (%rsp)
vmovaps %xmm0, 0x50(%rsp)
vmovaps %xmm0, 0x30(%rsp)
vmovups (%rax), %xmm0
vmovaps %xmm0, 0x40(%rsp)
movl $0xffffffff, %eax       # imm = 0xFFFFFFFF
cmpq $0x10, %r8
jb 0x1fd7
movq %rsi, %r12
movq %rcx, 0x20(%rsp)
movq 0xb8(%rsp), %rcx
movq 0xb0(%rsp), %rbx
addq $-0x10, %r8
movq %r8, (%rsi)
movl 0x7(%rcx), %eax
movl %eax, 0x7(%rsp)
movq (%rcx), %rax
movq %rax, (%rsp)
movb $0x2, 0xf(%rsp)
testq %rbx, %rbx
je 0x1e8a
movq %r9, %r13
movl %ebx, %ebp
andl $0xf, %ebp
vmovaps 0x50(%rsp), %xmm0
xorl %esi, %esi
leaq 0x10(%rsp), %r15
vxorps %xmm1, %xmm1, %xmm1
vmovaps %xmm1, 0x10(%rsp)
leaq 0x10(%rsi), %r14
cmpq %rbx, %r14
vmovaps %xmm0, 0x60(%rsp)
jae 0x1e12
vmovups (%r13,%rsi), %xmm0
vmovaps %xmm0, 0x10(%rsp)
jmp 0x1e40
addq %r13, %rsi
cmpq %rbx, %r14
jne 0x1e2b
vmovups (%rsi), %xmm0
vmovaps %xmm0, 0x10(%rsp)
movb $0x4, 0xf(%rsp)
jmp 0x1e40
movq %r15, %rdi
movq %rbp, %rdx
callq 0x1090
movb $-0x80, 0x10(%rsp,%rbp)
movb $0x6, 0xf(%rsp)
movq %r15, %rdi
leaq 0x40(%rsp), %rsi
movq %rsp, %rdx
movq %r15, %rcx
callq 0x1080
vmovaps 0x60(%rsp), %xmm0
vxorps 0x10(%rsp), %xmm0, %xmm0
leaq 0xe(%rsp), %rax
incb (%rax)
leaq -0x1(%rax), %rax
je 0x1e64
movq %r14, %rsi
cmpq %rbx, %r14
jb 0x1dea
vmovaps %xmm0, 0x50(%rsp)
movq (%r12), %r8
movq 0xb8(%rsp), %rcx
movb $0x0, 0xf(%rsp)
movl $0x0, 0xb(%rsp)
movq (%rcx), %rax
movq %rax, (%rsp)
movl 0x7(%rcx), %eax
movl %eax, 0x7(%rsp)
testq %r8, %r8
je 0x1f82
xorl %r13d, %r13d
movq 0x20(%rsp), %rbx
movq %rbx, %r15
movq 0x28(%rsp), %r14
leaq 0x10(%r13), %rbp
cmpq %r8, %rbp
jbe 0x1f23
vxorps %xmm0, %xmm0, %xmm0
vmovaps %xmm0, 0x10(%rsp)
shlb $0x3, %r8b
andb $0x78, %r8b
movb %r8b, 0x1f(%rsp)
leaq 0x10(%rsp), %rcx
movq %rcx, %rdi
leaq 0x40(%rsp), %rsi
movq %rsp, %rdx
callq 0x1080
movq (%r12), %r8
testb $0xf, %r8b
je 0x1f65
xorl %eax, %eax
movb (%r15,%rax), %cl
xorb 0x10(%rsp,%rax), %cl
movb %cl, (%r14,%rax)
xorb %cl, 0x30(%rsp,%rax)
movq (%r12), %r8
movl %r8d, %ecx
andl $0xf, %ecx
incq %rax
cmpq %rax, %rcx
ja 0x1eff
jmp 0x1f65
leaq (%rbx,%r13), %rdi
movq 0x28(%rsp), %rbx
leaq (%rbx,%r13), %rcx
leaq 0x40(%rsp), %rsi
movq %rsp, %rdx
callq 0x1060
vmovaps 0x30(%rsp), %xmm0
vxorps (%rbx,%r13), %xmm0, %xmm0
vmovaps %xmm0, 0x30(%rsp)
leaq 0xe(%rsp), %rax
incb (%rax)
leaq -0x1(%rax), %rax
je 0x1f54
movq (%r12), %r8
movq 0x20(%rsp), %rbx
addq $0x10, %r14
addq $0x10, %r15
movq %rbp, %r13
cmpq %r8, %rbp
jb 0x1ebe
shlb $0x4, %r8b
incb %r8b
jmp 0x1f8a
movb $0x1, %r8b
movq 0x20(%rsp), %rbx
movq %rsp, %rdx
movb %r8b, 0xf(%rdx)
leaq 0x40(%rsp), %rsi
leaq 0x30(%rsp), %rcx
movq %rcx, %rdi
callq 0x1080
movq (%r12), %rdx
addq %rdx, %rbx
xorl %eax, %eax
movb 0x30(%rsp,%rax), %cl
xorb 0x50(%rsp,%rax), %cl
cmpb %cl, (%rbx,%rax)
jne 0x1fc6
incq %rax
cmpq $0x10, %rax
jne 0x1fac
xorl %eax, %eax
jmp 0x1fd7
movq 0x28(%rsp), %rdi
xorl %esi, %esi
callq 0x1030
movl $0xffffffff, %eax       # imm = 0xFFFFFFFF
addq $0x78, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
nop