// File: /workspace/github_c_makefile_star2_O0/mjosaarinen[P]brutus/crypto_aead/shellaes128v1d5n64/ref/shellaes.c
// Function: shellaesDec_short
int shellaesDec_short(const u8 key[], const u8 nonce[], const u8 ad[], unsigned long long int adlen, const u8 c[], unsigned long long int ctlen, u8 p[], const u8 tag[]){

    u8 V[16], F[16], keyprime[16], L[16], Lprime[16], S[16], I[16];
    u32 mk[4*d], sk[12*d], rk[44], irk[44], rkprime[44];
    u8  pt1[16], pt2[16], ct1[16], ct2[16];
    u8 mask[16], mask1[16];
    u8 temp[16];

    int i, flag;

    /* key setup */
    aesKeySetupEnc(rk, key);
    KeySetupEnc(mk, sk, L, Lprime, keyprime, rk, key);
    aesKeySetupDec(irk, key);
    aesKeySetupEnc(rkprime, keyprime);

    memset(V, 0, 16);

    /*PX-MAC*/
    PXMAC(mk, sk, L, V, rk, ad, adlen);

    /*derive the block of ciphertext and save it to ct1[]*/

    memcpy(ct1, c, ctlen);
    for(i=ctlen; i<16; ++i){
        ct1[i]=tag[i-ctlen];
    }

    /*produce mask 3^3*Lprime*/
    memcpy(mask, Lprime, 16);
    for(i=0; i<3; ++i){
        memcpy(temp, mask, 16);
        double_mask(mask);
        xor_byte_string(temp, mask, 16);
    }

    /*produce mask 2^2*3^3*Lprime*/
    memcpy(mask1, mask, 16);
    double_mask(mask1);
    double_mask(mask1);

    /*decrypt to obtain I[]*/
    xor_byte_string(mask1, ct1, 16);
    aesDecrypt(irk, ct1, pt1);
    xor_byte_string(mask1, pt1, 16);

    xor_byte_string(V, pt1, 16);
    memcpy(ct1, pt1, 16);

    xor_byte_string(ct1, V, 16);

    xor_byte_string(mask, ct1, 16);
    aesDecrypt(irk, ct1, pt1);
    xor_byte_string(mask, pt1, 16);

    memcpy(I, pt1, 16);

    /*decrypt the plaintext*/
    CENC(rkprime, S, F, nonce, 16);
    xor_byte_string(S, pt1, 16);
    memcpy(p, pt1, ctlen);

    /*verify the validness of tag*/
    memcpy(pt2, I, 16);
    double_mask(mask);

    xor_byte_string(mask, pt2, 16);
    aesEncrypt(rk, pt2, ct2);
    xor_byte_string(mask, ct2, 16);

    xor_byte_string(V, ct2, 16);

    memcpy(pt2, ct2, 16);

    double_mask(mask1);

    xor_byte_string(mask1, pt2, 16);
    aesEncrypt(rk, pt2, ct2);
    xor_byte_string(mask1, ct2, 16);

    xor_byte_string(F, ct2, 16);


    flag=1;

    if(pt1[ctlen]!=0x80){
        flag=0;
    }

    for(i=ctlen+1; i<16; ++i){
        if(pt1[i]!=0){
            flag=0;
        }
    }

    for(i=0; i<ctlen; ++i){
        if(ct2[i]!=tag[i+16-ctlen]){
            flag=0;
        }
    }

    /*
     if(flag){
        printf("the plaintext is:\n");
        printf_byte_string(p, ctlen);
    }
    else{
        printf("the tag is invalid!");
    }
    */

    return flag;
}

// Assembly:
subq $0x478, %rsp            # imm = 0x478
movq 0x488(%rsp), %rax
movq 0x480(%rsp), %rax
movq %rdi, 0x470(%rsp)
movq %rsi, 0x468(%rsp)
movq %rdx, 0x460(%rsp)
movq %rcx, 0x458(%rsp)
movq %r8, 0x450(%rsp)
movq %r9, 0x448(%rsp)
leaq 0x1e0(%rsp), %rdi
movq 0x470(%rsp), %rsi
callq 0x2170
leaq 0x380(%rsp), %rdi
leaq 0x290(%rsp), %rsi
leaq 0x400(%rsp), %rdx
leaq 0x3f0(%rsp), %rcx
leaq 0x410(%rsp), %r8
leaq 0x1e0(%rsp), %r9
movq 0x470(%rsp), %rax
movq %rax, (%rsp)
callq 0x2230
leaq 0x130(%rsp), %rdi
movq 0x470(%rsp), %rsi
callq 0x2250
leaq 0x80(%rsp), %rdi
leaq 0x410(%rsp), %rsi
callq 0x2170
leaq 0x430(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x2070
leaq 0x380(%rsp), %rdi
leaq 0x290(%rsp), %rsi
leaq 0x400(%rsp), %rdx
leaq 0x430(%rsp), %rcx
leaq 0x1e0(%rsp), %r8
movq 0x460(%rsp), %r9
movq 0x458(%rsp), %rax
movq %rax, (%rsp)
callq 0x21a0
leaq 0x50(%rsp), %rdi
movq 0x450(%rsp), %rsi
movq 0x448(%rsp), %rdx
callq 0x2270
movq 0x448(%rsp), %rax
movl %eax, 0xc(%rsp)
cmpl $0x10, 0xc(%rsp)
jge 0x7627
movq 0x488(%rsp), %rax
movslq 0xc(%rsp), %rcx
subq 0x448(%rsp), %rcx
movb (%rax,%rcx), %cl
movslq 0xc(%rsp), %rax
movb %cl, 0x50(%rsp,%rax)
movl 0xc(%rsp), %eax
addl $0x1, %eax
movl %eax, 0xc(%rsp)
jmp 0x75f2
movq 0x3f0(%rsp), %rax
movq %rax, 0x30(%rsp)
movq 0x3f8(%rsp), %rax
movq %rax, 0x38(%rsp)
movl $0x0, 0xc(%rsp)
cmpl $0x3, 0xc(%rsp)
jge 0x768f
movq 0x30(%rsp), %rax
movq %rax, 0x10(%rsp)
movq 0x38(%rsp), %rax
movq %rax, 0x18(%rsp)
leaq 0x30(%rsp), %rdi
callq 0x21e0
leaq 0x10(%rsp), %rdi
leaq 0x30(%rsp), %rsi
movl $0x10, %edx
callq 0x2240
movl 0xc(%rsp), %eax
addl $0x1, %eax
movl %eax, 0xc(%rsp)
jmp 0x7649
movq 0x30(%rsp), %rax
movq %rax, 0x20(%rsp)
movq 0x38(%rsp), %rax
movq %rax, 0x28(%rsp)
leaq 0x20(%rsp), %rdi
callq 0x21e0
leaq 0x20(%rsp), %rdi
callq 0x21e0
leaq 0x20(%rsp), %rdi
leaq 0x50(%rsp), %rsi
movl $0x10, %edx
callq 0x2240
leaq 0x130(%rsp), %rdi
leaq 0x50(%rsp), %rsi
leaq 0x70(%rsp), %rdx
callq 0x20b0
leaq 0x20(%rsp), %rdi
leaq 0x70(%rsp), %rsi
movl $0x10, %edx
callq 0x2240
leaq 0x430(%rsp), %rdi
leaq 0x70(%rsp), %rsi
movl $0x10, %edx
callq 0x2240
movq 0x70(%rsp), %rax
movq %rax, 0x50(%rsp)
movq 0x78(%rsp), %rax
movq %rax, 0x58(%rsp)
leaq 0x50(%rsp), %rdi
leaq 0x430(%rsp), %rsi
movl $0x10, %edx
callq 0x2240
leaq 0x30(%rsp), %rdi
leaq 0x50(%rsp), %rsi
movl $0x10, %edx
callq 0x2240
leaq 0x130(%rsp), %rdi
leaq 0x50(%rsp), %rsi
leaq 0x70(%rsp), %rdx
callq 0x20b0
leaq 0x30(%rsp), %rdi
leaq 0x70(%rsp), %rsi
movl $0x10, %edx
callq 0x2240
movq 0x70(%rsp), %rax
movq %rax, 0x3d0(%rsp)
movq 0x78(%rsp), %rax
movq %rax, 0x3d8(%rsp)
leaq 0x80(%rsp), %rdi
leaq 0x3e0(%rsp), %rsi
leaq 0x420(%rsp), %rdx
movq 0x468(%rsp), %rcx
movl $0x10, %r8d
callq 0x2180
leaq 0x3e0(%rsp), %rdi
leaq 0x70(%rsp), %rsi
movl $0x10, %edx
callq 0x2240
movq 0x480(%rsp), %rdi
leaq 0x70(%rsp), %rsi
movq 0x448(%rsp), %rdx
callq 0x2270
movq 0x3d0(%rsp), %rax
movq %rax, 0x60(%rsp)
movq 0x3d8(%rsp), %rax
movq %rax, 0x68(%rsp)
leaq 0x30(%rsp), %rdi
callq 0x21e0
leaq 0x30(%rsp), %rdi
leaq 0x60(%rsp), %rsi
movl $0x10, %edx
callq 0x2240
leaq 0x1e0(%rsp), %rdi
leaq 0x60(%rsp), %rsi
leaq 0x40(%rsp), %rdx
callq 0x2200
leaq 0x30(%rsp), %rdi
leaq 0x40(%rsp), %rsi
movl $0x10, %edx
callq 0x2240
leaq 0x430(%rsp), %rdi
leaq 0x40(%rsp), %rsi
movl $0x10, %edx
callq 0x2240
movq 0x40(%rsp), %rax
movq %rax, 0x60(%rsp)
movq 0x48(%rsp), %rax
movq %rax, 0x68(%rsp)
leaq 0x20(%rsp), %rdi
callq 0x21e0
leaq 0x20(%rsp), %rdi
leaq 0x60(%rsp), %rsi
movl $0x10, %edx
callq 0x2240
leaq 0x1e0(%rsp), %rdi
leaq 0x60(%rsp), %rsi
leaq 0x40(%rsp), %rdx
callq 0x2200
leaq 0x20(%rsp), %rdi
leaq 0x40(%rsp), %rsi
movl $0x10, %edx
callq 0x2240
leaq 0x420(%rsp), %rdi
leaq 0x40(%rsp), %rsi
movl $0x10, %edx
callq 0x2240
movl $0x1, 0x8(%rsp)
movq 0x448(%rsp), %rax
movzbl 0x70(%rsp,%rax), %eax
cmpl $0x80, %eax
je 0x78ff
movl $0x0, 0x8(%rsp)
movq 0x448(%rsp), %rax
addq $0x1, %rax
movl %eax, 0xc(%rsp)
cmpl $0x10, 0xc(%rsp)
jge 0x793c
movslq 0xc(%rsp), %rax
movzbl 0x70(%rsp,%rax), %eax
cmpl $0x0, %eax
je 0x792d
movl $0x0, 0x8(%rsp)
jmp 0x792f
movl 0xc(%rsp), %eax
addl $0x1, %eax
movl %eax, 0xc(%rsp)
jmp 0x790f
movl $0x0, 0xc(%rsp)
movslq 0xc(%rsp), %rax
cmpq 0x448(%rsp), %rax
jae 0x7996
movslq 0xc(%rsp), %rax
movzbl 0x40(%rsp,%rax), %eax
movq 0x488(%rsp), %rcx
movl 0xc(%rsp), %edx
addl $0x10, %edx
movslq %edx, %rdx
subq 0x448(%rsp), %rdx
movzbl (%rcx,%rdx), %ecx
cmpl %ecx, %eax
je 0x7987
movl $0x0, 0x8(%rsp)
jmp 0x7989
movl 0xc(%rsp), %eax
addl $0x1, %eax
movl %eax, 0xc(%rsp)
jmp 0x7944
movl 0x8(%rsp), %eax
addq $0x478, %rsp            # imm = 0x478
retq
nopw %cs:(%rax,%rax)