// File: DiplIngFrankGerlach[P]MST/./aes/aes.c
// Function: aes_decrypt_ccm
int aes_decrypt_ccm(const BYTE ciphertext[], WORD ciphertext_len, const BYTE assoc[], unsigned short assoc_len,
                    const BYTE nonce[], unsigned short nonce_len, BYTE plaintext[], WORD *plaintext_len,
                    WORD mac_len, int *mac_auth, const BYTE key_str[], int keysize)
{
	BYTE temp_iv[AES_BLOCK_SIZE], counter[AES_BLOCK_SIZE], mac[16], mac_buf[16], *buf;
	int end_of_buf, plaintext_len_store_size;
	WORD key[60];

	if (ciphertext_len <= mac_len)
		return(FALSE);

	buf = (BYTE*)malloc(assoc_len + ciphertext_len /*ciphertext_len = plaintext_len + mac_len*/ + 48);
	if (! buf)
		return(FALSE);

	// Prepare the key for usage.
	aes_key_setup(key_str, key, keysize);

	// Copy the plaintext and MAC to the output buffers.
	*plaintext_len = ciphertext_len - mac_len;
	plaintext_len_store_size = AES_BLOCK_SIZE - 1 - nonce_len;
	memcpy(plaintext, ciphertext, *plaintext_len);
	memcpy(mac, &ciphertext[*plaintext_len], mac_len);

	// Prepare the first counter block for use in decryption.
	ccm_prepare_first_ctr_blk(counter, nonce, nonce_len, plaintext_len_store_size);

	// Decrypt the Payload with CTR mode with a counter starting at 1.
	memcpy(temp_iv, counter, AES_BLOCK_SIZE);
	increment_iv(temp_iv, AES_BLOCK_SIZE - 1 - mac_len);   // (AES_BLOCK_SIZE - 1 - mac_len) is the byte size of the counting portion of the counter block.
	aes_decrypt_ctr(plaintext, *plaintext_len, plaintext, key, keysize, temp_iv);

	// Setting mac_auth to NULL disables the authentication check.
	if (mac_auth != NULL) {
		// Decrypt the MAC with CTR mode with a counter starting at 0.
		aes_decrypt_ctr(mac, mac_len, mac, key, keysize, counter);

		// Format the first block of the formatted data.
		plaintext_len_store_size = AES_BLOCK_SIZE - 1 - nonce_len;
		ccm_prepare_first_format_blk(buf, assoc_len, *plaintext_len, plaintext_len_store_size, mac_len, nonce, nonce_len);
		end_of_buf = AES_BLOCK_SIZE;

		// Format the Associated Data into the authentication buffer.
		ccm_format_assoc_data(buf, &end_of_buf, assoc, assoc_len);

		// Format the Payload into the authentication buffer.
		ccm_format_payload_data(buf, &end_of_buf, plaintext, *plaintext_len);

		// Perform the CBC operation with an IV of zeros on the formatted buffer to calculate the MAC.
		memset(temp_iv, 0, AES_BLOCK_SIZE);
		aes_encrypt_cbc_mac(buf, end_of_buf, mac_buf, key, keysize, temp_iv);

		// Compare the calculated MAC against the MAC embedded in the ciphertext to see if they are the same.
		if (! memcmp(mac, mac_buf, mac_len)) {
			*mac_auth = TRUE;
		}
		else {
			*mac_auth = FALSE;
			memset(plaintext, 0, *plaintext_len);
		}
	}

	free(buf);

	return(TRUE);
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x190, %rsp            # imm = 0x190
movw %r9w, %ax
movl 0x38(%rbp), %r9d
movq 0x30(%rbp), %r9
movq 0x28(%rbp), %r9
movl 0x20(%rbp), %r9d
movq 0x18(%rbp), %r9
movq 0x10(%rbp), %r9
movq %rdi, -0x10(%rbp)
movl %esi, -0x14(%rbp)
movq %rdx, -0x20(%rbp)
movw %cx, -0x22(%rbp)
movq %r8, -0x30(%rbp)
movw %ax, -0x32(%rbp)
movl -0x14(%rbp), %eax
cmpl 0x20(%rbp), %eax
ja 0x3912
movl $0x0, -0x4(%rbp)
jmp 0x3b33
movzwl -0x22(%rbp), %eax
addl -0x14(%rbp), %eax
addl $0x30, %eax
movl %eax, %eax
movl %eax, %edi
callq 0x2230
movq %rax, -0x88(%rbp)
cmpq $0x0, -0x88(%rbp)
jne 0x3942
movl $0x0, -0x4(%rbp)
jmp 0x3b33
movq 0x30(%rbp), %rdi
leaq -0x180(%rbp), %rsi
movl 0x38(%rbp), %edx
callq 0x3450
movl -0x14(%rbp), %ecx
subl 0x20(%rbp), %ecx
movq 0x18(%rbp), %rax
movl %ecx, (%rax)
movzwl -0x32(%rbp), %ecx
movl $0xf, %eax
subl %ecx, %eax
movl %eax, -0x90(%rbp)
movq 0x10(%rbp), %rdi
movq -0x10(%rbp), %rsi
movq 0x18(%rbp), %rax
movl (%rax), %eax
movl %eax, %edx
callq 0x2130
leaq -0x70(%rbp), %rdi
movq -0x10(%rbp), %rsi
movq 0x18(%rbp), %rax
movl (%rax), %eax
addq %rax, %rsi
movl 0x20(%rbp), %eax
movl %eax, %edx
callq 0x2130
leaq -0x60(%rbp), %rdi
movq -0x30(%rbp), %rsi
movzwl -0x32(%rbp), %edx
movl -0x90(%rbp), %ecx
callq 0x3860
movq -0x60(%rbp), %rax
movq %rax, -0x50(%rbp)
movq -0x58(%rbp), %rax
movq %rax, -0x48(%rbp)
leaq -0x50(%rbp), %rdi
movl $0xf, %esi
subl 0x20(%rbp), %esi
callq 0x3040
movq 0x10(%rbp), %rdi
movq 0x18(%rbp), %rax
movl (%rax), %eax
movl %eax, %esi
movq 0x10(%rbp), %rdx
leaq -0x180(%rbp), %rcx
movl 0x38(%rbp), %r8d
leaq -0x50(%rbp), %r9
callq 0x31b0
cmpq $0x0, 0x28(%rbp)
je 0x3b20
leaq -0x70(%rbp), %rdi
movl 0x20(%rbp), %eax
movl %eax, %esi
leaq -0x70(%rbp), %rdx
leaq -0x180(%rbp), %rcx
movl 0x38(%rbp), %r8d
leaq -0x60(%rbp), %r9
callq 0x31b0
movzwl -0x32(%rbp), %ecx
movl $0xf, %eax
subl %ecx, %eax
movl %eax, -0x90(%rbp)
movq -0x88(%rbp), %rdi
movzwl -0x22(%rbp), %esi
movq 0x18(%rbp), %rax
movl (%rax), %edx
movl -0x90(%rbp), %ecx
movl 0x20(%rbp), %r8d
movq -0x30(%rbp), %r9
movzwl -0x32(%rbp), %eax
movl %eax, (%rsp)
callq 0x3640
movl $0x10, -0x8c(%rbp)
movq -0x88(%rbp), %rdi
movq -0x20(%rbp), %rdx
movzwl -0x22(%rbp), %ecx
leaq -0x8c(%rbp), %rsi
callq 0x3700
movq -0x88(%rbp), %rdi
movq 0x10(%rbp), %rdx
movq 0x18(%rbp), %rax
movl (%rax), %ecx
leaq -0x8c(%rbp), %rsi
callq 0x37d0
leaq -0x50(%rbp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x20c0
movq -0x88(%rbp), %rdi
movslq -0x8c(%rbp), %rsi
leaq -0x80(%rbp), %rdx
leaq -0x180(%rbp), %rcx
movl 0x38(%rbp), %r8d
leaq -0x50(%rbp), %r9
callq 0x2a20
leaq -0x70(%rbp), %rdi
leaq -0x80(%rbp), %rsi
movl 0x20(%rbp), %eax
movl %eax, %edx
callq 0x20b0
cmpl $0x0, %eax
jne 0x3b01
movq 0x28(%rbp), %rax
movl $0x1, (%rax)
jmp 0x3b1e
movq 0x28(%rbp), %rax
movl $0x0, (%rax)
movq 0x10(%rbp), %rdi
movq 0x18(%rbp), %rax
movl (%rax), %eax
movl %eax, %edx
xorl %esi, %esi
callq 0x20c0
jmp 0x3b20
movq -0x88(%rbp), %rdi
callq 0x2200
movl $0x1, -0x4(%rbp)
movl -0x4(%rbp), %eax
addq $0x190, %rsp            # imm = 0x190
popq %rbp
retq
nop