// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: crypto_check_final
int crypto_check_final(crypto_check_ctx_abstract *ctx)
{
    u8 *s = ctx->buf + 32; // s
    u8  h_ram[64];
    u32 s32[8];            // s (different encoding)
    ge  A;

    ctx->hash->final(ctx, h_ram);
    reduce(h_ram);
    load32_le_buf(s32, s, 8);
    if (ge_frombytes_neg_vartime(&A, ctx->pk) ||  // A = -pk
        is_above_l(s32)) {                        // prevent s malleability
        return -1;
    }
    ge_double_scalarmult_vartime(&A, h_ram, s);   // A = [s]B - [h_ram]pk
    ge_tobytes(ctx->pk, &A);                      // R_check = A
    return crypto_verify32(ctx->buf, ctx->pk);    // R == R_check ? OK : fail
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x408, %rsp            # imm = 0x408
movq %rdi, %r14
leaq 0x28(%rdi), %rax
movq %rax, 0x8(%rsp)
movq (%rdi), %rax
leaq 0x1e0(%rsp), %r15
movq %r15, %rsi
callq *0x18(%rax)
movq %r15, %rdi
callq 0x6584
xorl %eax, %eax
movl 0x28(%r14,%rax,4), %ecx
movl %ecx, 0x160(%rsp,%rax,4)
incq %rax
cmpq $0x8, %rax
jne 0x6826
leaq 0x68(%r14), %rbx
leaq 0x48(%rsp), %r12
movq %r12, %rdi
movq %rbx, %rsi
movl $0x1, %edx
callq 0x7eb2
movl $0x1, 0x28(%r12)
xorps %xmm0, %xmm0
movups %xmm0, 0x2c(%r12)
movups %xmm0, 0x3c(%r12)
movl $0x0, 0x4c(%r12)
leaq 0x98(%rsp), %r15
movq %r15, %rdi
movq %r12, %rsi
callq 0x810e
leaq 0x7141(%rip), %rdx      # 0xd9d0
leaq 0x20(%rsp), %rdi
movq %r15, %rsi
callq 0x6ea3
movl $0x1e, %eax
movl -0x8(%rsp,%rax,4), %ecx
subl %ecx, 0x20(%rsp,%rax,4)
incq %rax
cmpq $0x28, %rax
jne 0x68a1
xorl %eax, %eax
movl 0x70(%rsp,%rax,4), %ecx
addl %ecx, 0x20(%rsp,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x68b4
leaq 0x20(%rsp), %r13
movq %r13, %rdi
movq %r15, %rsi
movq %r13, %rdx
callq 0x6ea3
movq %r13, %rdi
movq %r13, %rsi
callq 0x85ef
movl %eax, %r13d
movl $0xffffffff, %eax       # imm = 0xFFFFFFFF
testl %r13d, %r13d
je 0x6cf6
leaq 0x8(%r14), %rax
movq %rax, 0x18(%rsp)
leaq 0x20(%rsp), %r12
movq %r12, %rdi
movq %r15, %rsi
movq %r12, %rdx
callq 0x6ea3
leaq 0x220(%rsp), %rbp
movq %rbp, %rdi
movq %r12, %rsi
callq 0x76b5
xorl %ecx, %ecx
movb (%rbp), %al
movb $0x0, 0x220(%rsp,%rcx)
incq %rcx
cmpq $0x20, %rcx
jne 0x6928
andb $0x1, %al
movb 0x87(%r14), %cl
shrb $0x7, %cl
cmpb %cl, %al
leaq 0x48(%rsp), %rdx
jne 0x695d
xorl %eax, %eax
negl 0x20(%rsp,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x6950
leaq 0x20(%rsp), %rsi
movq %r15, %rdi
callq 0x6ea3
testl %r13d, %r13d
je 0x6cf1
movl $0x1, %edx
xorl %eax, %eax
leaq 0x753f(%rip), %rcx      # 0xdec0
movl 0x160(%rsp,%rax), %edi
addq %rdx, %rdi
movl (%rax,%rcx), %esi
notl %esi
addq %rdi, %rsi
movq %rsi, %rdx
shrq $0x20, %rdx
addq $0x4, %rax
cmpq $0x20, %rax
jne 0x6981
shrq $0x20, %rsi
movl $0xffffffff, %eax       # imm = 0xFFFFFFFF
jne 0x6cf6
leaq 0xc0(%rsp), %r14
leaq 0x20(%rsp), %r15
leaq 0x368(%rsp), %r12
movq %r14, %rdi
movq %r15, %rsi
movq %r12, %rdx
callq 0x97e0
leaq 0x220(%rsp), %r13
movq %r13, %rdi
movq %r15, %rsi
callq 0x9905
movq %r12, %rdi
movq %r14, %rsi
movq %r13, %rdx
callq 0x9957
leaq 0x2c0(%rsp), %rdi
movq %r12, %rsi
callq 0x9905
movl $0xfc, %eax
movl %eax, %ecx
shrl $0x3, %ecx
movzbl 0x1e0(%rsp,%rcx), %ecx
movl %eax, %edx
andl $0x7, %edx
btl %edx, %ecx
jb 0x6a2f
leal -0x1(%rax), %ecx
cmpl $0x1, %eax
movl %ecx, %eax
ja 0x6a0c
xorl %eax, %eax
incb %al
movb %al, 0x3(%rsp)
movw $0xffff, (%rsp)         # imm = 0xFFFF
movb $-0x1, 0x2(%rsp)
movl $0xfc, %ecx
leaq 0x48(%rsp), %rdi
movq %rbx, 0x10(%rsp)
movl %ecx, %edx
shrl $0x3, %edx
movq 0x8(%rsp), %rsi
movzbl (%rsi,%rdx), %edx
movl %ecx, %esi
andl $0x7, %esi
btl %esi, %edx
jb 0x6a73
leal -0x1(%rcx), %edx
cmpl $0x1, %ecx
movl %edx, %ecx
ja 0x6a4f
xorl %ecx, %ecx
incb %cl
leaq 0x4(%rsp), %rdx
movb %cl, 0x3(%rdx)
movw $0xffff, (%rdx)         # imm = 0xFFFF
movb $-0x1, 0x2(%rdx)
movzbl %al, %edx
movzbl %cl, %ecx
cmpb %cl, %al
cmovbel %ecx, %edx
movzbl %dl, %ebp
xorps %xmm0, %xmm0
leaq 0x20(%rsp), %r15
movaps %xmm0, (%r15)
movaps %xmm0, 0x10(%r15)
movq $0x0, 0x20(%r15)
movl $0x1, 0x28(%r15)
movups %xmm0, 0x2c(%r15)
movups %xmm0, 0x3c(%r15)
movabsq $0x100000000, %rax      # imm = 0x100000000
movq %rax, 0x4c(%r15)
movups %xmm0, 0x68(%rdi)
movups %xmm0, 0x5c(%rdi)
movups %xmm0, 0x4c(%rdi)
movups %xmm0, 0x3c(%rdi)
movups %xmm0, 0x2c(%rdi)
leaq 0xe8(%rsp), %r14
leaq 0x6f10(%rip), %rbx      # 0xda00
movq %r15, %rdi
movq %r15, %rsi
leaq 0x368(%rsp), %rdx
callq 0x97e0
movq %rsp, %rdi
movl $0x3, %esi
movl %ebp, %edx
leaq 0x1e0(%rsp), %rcx
callq 0x9ab0
movl %eax, %r12d
leaq 0x4(%rsp), %rdi
movl $0x5, %esi
movl %ebp, %edx
movq 0x8(%rsp), %rcx
callq 0x9ab0
movl %eax, %r13d
testl %r12d, %r12d
jle 0x6b5e
movl %r12d, %eax
shrl %eax
leaq (%rax,%rax,4), %rax
shlq $0x5, %rax
leaq (%rsp,%rax), %rdx
addq $0x220, %rdx            # imm = 0x220
movq %r15, %rdi
movq %r15, %rsi
callq 0x9957
testl %r12d, %r12d
jns 0x6c01
negl %r12d
shrl %r12d
leaq (%r12,%r12,4), %rax
shlq $0x5, %rax
addq %rsp, %rax
addq $0x220, %rax            # imm = 0x220
movq 0x20(%rax), %rcx
movq %rcx, 0x20(%r14)
movups (%rax), %xmm0
movups 0x10(%rax), %xmm1
movups %xmm1, 0x10(%r14)
movups %xmm0, (%r14)
movq 0x48(%rax), %rcx
movq %rcx, 0xe0(%rsp)
movups 0x28(%rax), %xmm0
movups 0x38(%rax), %xmm1
movaps %xmm1, 0xd0(%rsp)
movaps %xmm0, 0xc0(%rsp)
movq 0x70(%rax), %rcx
movq %rcx, 0x48(%r14)
movups 0x50(%rax), %xmm0
movups 0x60(%rax), %xmm1
movups %xmm1, 0x38(%r14)
movups %xmm0, 0x28(%r14)
movl $0x1e, %ecx
xorl %edx, %edx
subl (%rax,%rcx,4), %edx
movl %edx, 0xc0(%rsp,%rcx,4)
incq %rcx
cmpq $0x28, %rcx
jne 0x6bd9
movq %r15, %rdi
movq %r15, %rsi
leaq 0xc0(%rsp), %rdx
callq 0x9957
testl %r13d, %r13d
jle 0x6c2d
movl %r13d, %eax
shrl %eax
imulq $0x78, %rax, %rdx
addq %rbx, %rdx
movq %r15, %rdi
movq %r15, %rsi
leaq 0x1b0(%rsp), %rcx
leaq 0x180(%rsp), %r8
callq 0x7b57
testl %r13d, %r13d
jns 0x6cc3
negl %r13d
shrl %r13d
imulq $0x78, %r13, %rcx
leaq (%rbx,%rcx), %rax
movq 0x20(%rcx,%rbx), %rdx
movq %rdx, 0x20(%r14)
movups (%rcx,%rbx), %xmm0
movups 0x10(%rcx,%rbx), %xmm1
movups %xmm1, 0x10(%r14)
movups %xmm0, (%r14)
movups 0x28(%rcx,%rbx), %xmm0
movaps %xmm0, 0xc0(%rsp)
movups 0x38(%rcx,%rbx), %xmm0
movaps %xmm0, 0xd0(%rsp)
movq 0x48(%rcx,%rbx), %rcx
movq %rcx, 0xe0(%rsp)
movl $0x14, %ecx
xorl %edx, %edx
subl (%rax,%rcx,4), %edx
movl %edx, 0xc0(%rsp,%rcx,4)
incq %rcx
cmpq $0x1e, %rcx
jne 0x6c8b
movq %r15, %rdi
movq %r15, %rsi
leaq 0xc0(%rsp), %rdx
leaq 0x1b0(%rsp), %rcx
leaq 0x180(%rsp), %r8
callq 0x7b57
leal -0x1(%rbp), %eax
testl %ebp, %ebp
movl %eax, %ebp
jg 0x6af0
leaq 0x20(%rsp), %rsi
movq 0x10(%rsp), %rbx
movq %rbx, %rdi
callq 0x638e
movq 0x18(%rsp), %rdi
movq %rbx, %rsi
callq 0x254b
jmp 0x6cf6
movl $0xffffffff, %eax       # imm = 0xFFFFFFFF
addq $0x408, %rsp            # imm = 0x408
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq