// File: /workspace/github_cpp_makefile_star2_O2/occivink[P]pyct/monocypher.cpp
// Function: crypto_check_final
int crypto_check_final(crypto_check_ctx_abstract *ctx)
{
    u8 *s = ctx->buf + 32; // s
    u8  h_ram[64];
    u32 s32[8];            // s (different encoding)
    ge  A;

    ctx->hash->final(ctx, h_ram);
    reduce(h_ram);
    load32_le_buf(s32, s, 8);
    if (ge_frombytes_neg_vartime(&A, ctx->pk) ||  // A = -pk
        is_above_l(s32)) {                        // prevent s malleability
        return -1;
    }
    ge_double_scalarmult_vartime(&A, h_ram, s);   // A = [s]B - [h_ram]pk
    ge_tobytes(ctx->pk, &A);                      // R_check = A
    return crypto_verify32(ctx->buf, ctx->pk);    // R == R_check ? OK : fail
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x408, %rsp            # imm = 0x408
movq %rdi, %r14
leaq 0x28(%rdi), %r15
movq (%rdi), %rax
leaq 0x1e0(%rsp), %rbx
movq %rbx, %rsi
callq *0x18(%rax)
movq %rbx, %rdi
callq 0x5e01
leaq 0x20(%rsp), %rdi
pushq $0x8
popq %rdx
movq %r15, 0x18(%rsp)
movq %r15, %rsi
callq 0x264b
leaq 0x68(%r14), %rsi
leaq 0x68(%rsp), %rbx
movq %rbx, %rdi
movq %rsi, 0x10(%rsp)
callq 0x651c
leaq 0x90(%rsp), %r12
movq %r12, %rdi
callq 0x8aee
leaq 0xb8(%rsp), %r15
movq %r15, %rdi
movq %rbx, %rsi
callq 0x76c3
leaq 0x68fb(%rip), %rdx      # 0xc9d0
leaq 0x40(%rsp), %r13
movq %r13, %rdi
movq %r15, %rsi
callq 0x65a5
movq %r15, %rdi
movq %r15, %rsi
movq %r12, %rdx
callq 0x653b
movq %r13, %rdi
movq %r13, %rsi
movq %r12, %rdx
callq 0x6524
movq %r13, %rdi
movq %r15, %rsi
movq %r13, %rdx
callq 0x65a5
movq %r13, %rdi
movq %r13, %rsi
callq 0x7b97
pushq $-0x1
popq %rbp
testl %eax, %eax
je 0x63d0
leaq 0x40(%rsp), %r12
movq %r12, %rdi
movq %r15, %rsi
movq %r12, %rdx
callq 0x65a5
movq %r12, %rdi
callq 0x81bf
movzbl 0x87(%r14), %ecx
shrl $0x7, %ecx
cmpl %ecx, %eax
jne 0x615c
leaq 0x40(%rsp), %rdi
movq %rdi, %rsi
callq 0x7ed8
leaq 0x40(%rsp), %rsi
movq %r15, %rdi
movq %rbx, %rdx
callq 0x65a5
leaq 0x20(%rsp), %rdi
callq 0x63e4
testl %eax, %eax
jne 0x63d0
addq $0x8, %r14
movq %r14, 0x8(%rsp)
leaq 0x140(%rsp), %r14
leaq 0x40(%rsp), %r13
leaq 0x368(%rsp), %r15
movq %r14, %rdi
movq %r13, %rsi
movq %r15, %rdx
callq 0x8ce9
leaq 0x220(%rsp), %rbx
movq %rbx, %rdi
movq %r13, %rsi
callq 0x8ddc
movq %r15, %rdi
movq %r14, %rsi
movq %rbx, %rdx
callq 0x8e31
leaq 0x2c0(%rsp), %rdi
movq %r15, %rsi
callq 0x8ddc
leaq 0x4(%rsp), %rbx
leaq 0x1e0(%rsp), %rsi
movq %rbx, %rdi
callq 0x8f5c
movq %rsp, %r12
movq %r12, %rdi
movq 0x18(%rsp), %r14
movq %r14, %rsi
callq 0x8f5c
movzbl 0x3(%rbx), %eax
movzbl 0x3(%r12), %ecx
cmpb %cl, %al
cmoval %eax, %ecx
movzbl %cl, %ebp
movq %r13, %rdi
callq 0x8b54
testl %ebp, %ebp
js 0x63af
movq %r13, %rdi
movq %r13, %rsi
movq %r15, %rdx
callq 0x8ce9
leaq 0x4(%rsp), %rdi
pushq $0x3
popq %rsi
movl %ebp, %edx
leaq 0x1e0(%rsp), %rcx
callq 0x8f8c
movl %eax, %r12d
movq %rsp, %rdi
pushq $0x5
popq %rsi
movl %ebp, %edx
movq %r14, %rcx
callq 0x8f8c
movl %eax, %ebx
testl %r12d, %r12d
jle 0x6286
shrl %r12d
imulq $0xa0, %r12, %rax
leaq (%rsp,%rax), %rdx
addq $0x220, %rdx            # imm = 0x220
movq %r13, %rdi
movq %r13, %rsi
callq 0x8e31
jmp 0x6288
js 0x62c6
testl %ebx, %ebx
jle 0x62b9
shrl %ebx
imulq $0x78, %rbx, %rdx
leaq 0x6787(%rip), %rax      # 0xca20
addq %rax, %rdx
movq %r13, %rdi
movq %r13, %rsi
leaq 0x110(%rsp), %rcx
leaq 0xe0(%rsp), %r8
callq 0x71e2
jmp 0x62bf
js 0x634c
decl %ebp
jmp 0x621d
negl %r12d
shrl %r12d
imulq $0xa0, %r12, %r12
leaq (%rsp,%r12), %rsi
addq $0x220, %rsi            # imm = 0x220
leaq 0x168(%rsp), %rdi
callq 0x8b19
leaq (%rsp,%r12), %rsi
addq $0x248, %rsi            # imm = 0x248
leaq 0x140(%rsp), %r15
movq %r15, %rdi
callq 0x8b19
leaq (%rsp,%r12), %rsi
addq $0x270, %rsi            # imm = 0x270
leaq 0x190(%rsp), %rdi
callq 0x8b19
leaq (%rsp,%r12), %rsi
addq $0x298, %rsi            # imm = 0x298
leaq 0x1b8(%rsp), %rdi
callq 0x7ed8
movq %r13, %rdi
movq %r13, %rsi
movq %r15, %rdx
leaq 0x368(%rsp), %r15
jmp 0x627f
negl %ebx
shrl %ebx
imulq $0x78, %rbx, %rbx
leaq 0x66c5(%rip), %r12      # 0xca20
leaq (%r12,%rbx), %rsi
leaq 0x168(%rsp), %rdi
callq 0x8b19
leaq (%rbx,%r12), %rsi
addq $0x28, %rsi
leaq 0x140(%rsp), %r15
movq %r15, %rdi
callq 0x8b19
leaq (%rbx,%r12), %rsi
addq $0x50, %rsi
leaq 0x190(%rsp), %rdi
callq 0x7ed8
movq %r13, %rdi
movq %r13, %rsi
movq %r15, %rdx
leaq 0x368(%rsp), %r15
jmp 0x62a2
leaq 0x40(%rsp), %rsi
movq 0x10(%rsp), %rbx
movq %rbx, %rdi
callq 0x5c42
movq 0x8(%rsp), %rdi
movq %rbx, %rsi
callq 0x2514
movl %eax, %ebp
movl %ebp, %eax
addq $0x408, %rsp            # imm = 0x408
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq