// File: /workspace/github_c_makefile_star2_O1/mjosaarinen[P]brutus/crypto_aead/shellaes128v1d5n64/ref/shellaes.c
// Function: shellaesDec_nfb
int shellaesDec_nfb(const u8 key[], const u8 nonce[], const u8 ad[], unsigned long long int adlen, const u8 c[], unsigned long long int ctlen, u8 p[], const u8 tag[]){
    u8 V[16], U[16], checksum[16], F[16], keyprime[16], L[16], Lprime[16];
    u8* S;
    u8* I;
    u8* Z;
    u8 tempTag[16], tempTag2[16];
    int i, flag;

    unsigned long long int ct_fblen;
    unsigned int ct_nfblen;

    ct_nfblen=ctlen%16;
    ct_fblen=ctlen-ct_nfblen;

    S= (u8 *) malloc(ctlen);
    I= (u8 *) malloc(ctlen);
    Z= (u8 *) malloc(ct_fblen);

    memset(V, 0, 16);
    memset(U, 0, 16);
    memset(checksum, 0, 16);
    memset(keyprime, 0, 16);
    memset(F, 0, 16);
    memset(L, 0, 16);
    memset(Lprime, 0, 16);

    u32 mk[4*d], sk[12*d], isk[12*d], rk[44], irk[44], rkprime[44];

    /*setup key*/
    aesKeySetupEnc(rk, key);
    aesKeySetupDec(irk, key);
    KeySetupDec(mk, sk, isk, L, Lprime, keyprime, rk, key);
    aesKeySetupEnc(rkprime, keyprime);

    /*decrypt the last non-full block*/
    memcpy(tempTag, tag, 16);
    XLSInv(irk, Lprime, c+ct_fblen, ct_fblen, ct_nfblen, p+ct_fblen, tempTag);

    /*process associated data*/
    PXMAC(mk, sk, L, V, rk, ad, adlen);

    /*decryption of XEX layer*/
    XEXLayerDec(irk, Lprime, c, Z, ct_fblen);

    /*decryption of PXENC layer*/
    PXDEC(mk, isk, L, V, Z, rk, I, ct_fblen);
    memcpy(U, V, 16);

    /*process nonce*/
    CENC(rkprime, S, F, nonce, ctlen);

    /*produce plaintext*/
    memcpy(p, I, ct_fblen);
    xor_byte_string(S, p, ct_fblen);

    /*verify the validness of tag*/
    checksum_state_string(I, checksum, ct_fblen);
    tagGen(rk, checksum, Lprime, U, F, tempTag2, ct_fblen);

    flag=1;

    for(i=0; i<16; ++i){
        if(tempTag[i]!=tempTag2[i]){
            flag=0;
        }
    }

    /*

    if(flag){
        printf("the plaintext is: \n");
        printf_byte_string(p, ctlen);
    }
    else{
        printf("the tag is invalid!");
    }
    */

    return flag;

}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x528, %rsp            # imm = 0x528
movq %r9, %r14
movq %r8, 0x40(%rsp)
movq %rcx, 0x50(%rsp)
movq %rdx, 0x58(%rsp)
movq %rsi, 0x68(%rsp)
movq %rdi, %r13
movq 0x560(%rsp), %r15
movl %r14d, %eax
andl $0xf, %eax
movl %eax, 0x1c(%rsp)
movq %r9, %rbx
andq $-0x10, %rbx
movq %r9, %rdi
movq %r9, 0x60(%rsp)
callq 0x20e0
movq %rax, %r12
movq %r14, %rdi
callq 0x20e0
movq %rax, %r14
movq %rbx, %rdi
callq 0x20e0
movq %rax, 0x48(%rsp)
vxorps %xmm0, %xmm0, %xmm0
leaq 0xd0(%rsp), %rax
vmovaps %xmm0, (%rax)
vmovaps %xmm0, 0x20(%rsp)
leaq 0xb0(%rsp), %rax
vmovaps %xmm0, (%rax)
leaq 0x80(%rsp), %rax
vmovaps %xmm0, (%rax)
leaq 0x30(%rsp), %rax
vmovaps %xmm0, (%rax)
leaq 0x70(%rsp), %rbp
vmovaps %xmm0, (%rbp)
leaq 0x130(%rsp), %rdi
movq %r13, %rsi
callq 0x2170
leaq 0x1e0(%rsp), %rdi
movq %r13, %rsi
callq 0x2220
movq %r13, 0x8(%rsp)
leaq 0x130(%rsp), %rax
movq %rax, (%rsp)
leaq 0xe0(%rsp), %rdi
leaq 0x430(%rsp), %rsi
leaq 0x340(%rsp), %rdx
leaq 0x30(%rsp), %rcx
movq %rbp, %r8
leaq 0xb0(%rsp), %r13
movq %r13, %r9
callq 0x2060
leaq 0x290(%rsp), %rdi
movq %r13, %rsi
callq 0x2170
movq 0x568(%rsp), %rax
vmovups (%rax), %xmm0
leaq 0xa0(%rsp), %rax
vmovaps %xmm0, (%rax)
movq 0x40(%rsp), %r13
leaq (%r13,%rbx), %rdx
leaq (%r15,%rbx), %r9
movq %rax, (%rsp)
leaq 0x1e0(%rsp), %rdi
movq %rbp, %rsi
movq %rbx, %rcx
movl 0x1c(%rsp), %r8d
callq 0x2040
movq 0x50(%rsp), %rax
movq %rax, (%rsp)
leaq 0xe0(%rsp), %rdi
leaq 0x430(%rsp), %rsi
leaq 0x30(%rsp), %rdx
leaq 0xd0(%rsp), %rbp
movq %rbp, %rcx
leaq 0x130(%rsp), %r8
movq 0x58(%rsp), %r9
callq 0x21a0
leaq 0x1e0(%rsp), %rdi
leaq 0x70(%rsp), %rsi
movq %r13, %rdx
movq 0x48(%rsp), %r13
movq %r13, %rcx
movq %rbx, %r8
callq 0x2140
movq %rbx, 0x8(%rsp)
movq %r14, (%rsp)
leaq 0xe0(%rsp), %rdi
leaq 0x340(%rsp), %rsi
leaq 0x30(%rsp), %rdx
movq %rbp, %rcx
movq %r13, %r8
leaq 0x130(%rsp), %r9
callq 0x20a0
vmovdqa (%rbp), %xmm0
vmovdqa %xmm0, 0xc0(%rsp)
leaq 0x290(%rsp), %rdi
movq %r12, %rsi
leaq 0x80(%rsp), %rdx
movq 0x68(%rsp), %rcx
movq 0x60(%rsp), %r8
callq 0x2180
movq %r15, %rdi
movq %r14, %rsi
movq %rbx, %rdx
callq 0x2240
testq %rbx, %rbx
je 0x6d13
leaq 0x1f(%rbx), %rax
andq $-0x20, %rax
leaq -0x1(%rbx), %rcx
vpbroadcastq %rcx, %ymm0
xorl %ecx, %ecx
vpmovsxbq 0x55a9(%rip), %ymm1 # 0xc1a4
vpmovsxbq 0x55a4(%rip), %ymm2 # 0xc1a8
vpmovsxbq 0x559f(%rip), %ymm3 # 0xc1ac
vpmovsxbq 0x559a(%rip), %ymm4 # 0xc1b0
vpmovsxbq 0x5595(%rip), %ymm5 # 0xc1b4
vpmovsxbq 0x5590(%rip), %ymm6 # 0xc1b8
vpmovsxbq 0x558b(%rip), %ymm7 # 0xc1bc
vpmovsxbq 0x5586(%rip), %ymm8 # 0xc1c0
vpbroadcastq %rcx, %ymm9
vpor %ymm1, %ymm9, %ymm10
vpor %ymm2, %ymm9, %ymm11
vpor %ymm3, %ymm9, %ymm12
vpor %ymm4, %ymm9, %ymm13
vpor %ymm5, %ymm9, %ymm14
vpor %ymm6, %ymm9, %ymm15
vporq %ymm7, %ymm9, %ymm16
vpor %ymm8, %ymm9, %ymm9
vpcmpleuq %ymm0, %ymm9, %k0
vpcmpleuq %ymm0, %ymm16, %k1
kshiftlb $0x4, %k1, %k1
korb %k1, %k0, %k0
vpcmpleuq %ymm0, %ymm15, %k1
vpcmpleuq %ymm0, %ymm14, %k2
kshiftlb $0x4, %k2, %k2
korb %k2, %k1, %k1
kunpckbw %k0, %k1, %k0
vpcmpleuq %ymm0, %ymm13, %k1
vpcmpleuq %ymm0, %ymm12, %k2
kshiftlb $0x4, %k2, %k2
korb %k2, %k1, %k1
vpcmpleuq %ymm0, %ymm11, %k2
vpcmpleuq %ymm0, %ymm10, %k3
kshiftlb $0x4, %k3, %k3
korb %k3, %k2, %k2
kunpckbw %k1, %k2, %k1
kunpckwd %k0, %k1, %k1
vmovdqu8 (%r12,%rcx), %ymm9 {%k1} {z}
vmovdqu8 (%r15,%rcx), %ymm10 {%k1} {z}
vpxor %ymm9, %ymm10, %ymm9
vmovdqu8 %ymm9, (%r15,%rcx) {%k1}
addq $0x20, %rcx
cmpq %rcx, %rax
jne 0x6c3a
vpxor %xmm0, %xmm0, %xmm0
vmovdqa %xmm0, 0x20(%rsp)
xorl %eax, %eax
vpxor (%r14,%rax), %xmm0, %xmm0
addq $0x10, %rax
cmpq %rax, %rbx
jne 0x6d02
jmp 0x6d17
vpxor %xmm0, %xmm0, %xmm0
vmovdqa %xmm0, 0x20(%rsp)
movq %rbx, (%rsp)
leaq 0x130(%rsp), %rdi
leaq 0x20(%rsp), %rsi
leaq 0x70(%rsp), %rdx
leaq 0xc0(%rsp), %rcx
leaq 0x80(%rsp), %r8
leaq 0x90(%rsp), %r9
vzeroupper
callq 0x2080
kxorw %k0, %k0, %k0
xorl %eax, %eax
vmovq 0xa0(%rsp,%rax), %xmm0
vmovq 0x90(%rsp,%rax), %xmm1
vpcmpneqb %xmm1, %xmm0, %k1
korb %k1, %k0, %k0
addq $0x8, %rax
cmpq $0x10, %rax
jne 0x6d59
xorl %eax, %eax
kortestb %k0, %k0
sete %al
addq $0x528, %rsp            # imm = 0x528
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq