// File: /workspace/github_c_makefile_star2_O2/mjosaarinen[P]brutus/crypto_aead/ascon128v11/ref/ascon.c
// Function: crypto_aead_decrypt
int crypto_aead_decrypt(
    unsigned char *m, unsigned long long *mlen,
    unsigned char *nsec,
    const unsigned char *c, unsigned long long clen,
    const unsigned char *ad, unsigned long long adlen,
    const unsigned char *npub,
    const unsigned char *k) {

  *mlen = 0;
  if (clen < CRYPTO_KEYBYTES)
    return -1;

  int klen = CRYPTO_KEYBYTES;
  //int nlen = CRYPTO_NPUBBYTES;
  int size = 320 / 8;
  int rate = 64 / 8;
  int capacity = size - rate;
  int a = 12;
  int b = 6;
  i64 s = adlen / rate + 1;
  i64 t = (clen - klen) / rate + 1;
  i64 l = (clen - klen) % rate;

  u8 S[size];
  u8 A[s * rate];
  u8 M[t * rate];
  i64 i, j;

  // pad associated data
  for (i = 0; i < adlen; ++i)
    A[i] = ad[i];
  A[adlen] = 0x80;
  for (i = adlen + 1; i < s * rate; ++i)
    A[i] = 0;

  // initialization
  S[0] = klen * 8;
  S[1] = rate * 8;
  S[2] = a;
  S[3] = b;
  for (i = 4; i < size - 2 * klen; ++i)
    S[i] = 0;
  for (i = 0; i < klen; ++i)
    S[size - 2 * klen + i] = k[i];
  for (i = 0; i < klen; ++i)
    S[size - klen + i] = npub[i];
  printstate("initial value:", S);
  permutation(S, a);
  for (i = 0; i < klen; ++i)
    S[rate + klen + i] ^= k[i];
  printstate("initialization:", S);

  // process associated data
  if (adlen) {
    for (i = 0; i < s; ++i) {
      for (j = 0; j < rate; ++j)
        S[j] ^= A[i * rate + j];
      permutation(S, b);
    }
  }
  S[size - 1] ^= 1;
  printstate("process associated data:", S);

  // process plaintext
  for (i = 0; i < t - 1; ++i) {
    for (j = 0; j < rate; ++j) {
      M[i * rate + j] = S[j] ^ c[i * rate + j];
      S[j] = c[i * rate + j];
    }
    permutation(S, b);
  }
  for (j = 0; j < l; ++j)
    M[(t - 1) * rate + j] = S[j] ^ c[(t - 1) * rate + j];
  for (j = 0; j < l; ++j)
    S[j] = c[(t - 1) * rate + j];
  S[l] ^= 0x80;
  printstate("process plaintext:", S);

  // finalization
  for (i = 0; i < klen; ++i)
    S[rate + i] ^= k[i];
  permutation(S, a);
  for (i = 0; i < klen; ++i)
    S[rate + klen + i] ^= k[i];
  printstate("finalization:", S);

  // return -1 if verification fails
  for (i = 0; i < klen; ++i)
    if (c[clen - klen + i] != S[rate + klen + i])
      return -1;

  // return plaintext
  *mlen = clen - klen;
  for (i = 0; i < *mlen; ++i)
    m[i] = M[i];

  return 0;
}

// Assembly:
andq $0x0, (%rsi)
cmpq $0x10, %r8
jae 0x15e3
pushq $-0x1
popq %rax
retq
pushq %rbp
movq %rsp, %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x48, %rsp
movq %rcx, -0x40(%rbp)
movq %rdi, -0x48(%rbp)
movq %rsi, -0x50(%rbp)
movq %rsp, -0x60(%rbp)
movq 0x20(%rbp), %rdi
movq 0x18(%rbp), %rax
movq 0x10(%rbp), %r15
movq %r8, -0x30(%rbp)
leaq -0x10(%r8), %rbx
movq %rbx, %rcx
shrq $0x3, %rcx
movq %rcx, -0x68(%rbp)
movq %rsp, %r12
addq $-0x30, %r12
movq %r12, %rsp
movq %r15, %rdx
andq $-0x8, %rdx
leaq 0x8(%rdx), %rcx
movq %rsp, %r14
addq $0x17, %rdx
andq $-0x10, %rdx
subq %rdx, %r14
movq %r14, %rsp
movq %rbx, -0x58(%rbp)
andq $-0x8, %rbx
movq %rsp, %rsi
leaq 0x17(%rbx), %rdx
andq $-0x10, %rdx
subq %rdx, %rsi
movq %rsi, -0x38(%rbp)
movq %rsi, %rsp
xorl %edx, %edx
cmpq %rdx, %r15
je 0x167a
movb (%r9,%rdx), %sil
movb %sil, (%r14,%rdx)
incq %rdx
jmp 0x1668
movq %r15, %r13
shrq $0x3, %r13
movb $-0x80, %sil
movq %r15, %rdx
movb %sil, (%r14,%rdx)
incq %rdx
xorl %esi, %esi
cmpq %rcx, %rdx
jl 0x1687
movl $0x60c4080, (%r12)      # imm = 0x60C4080
pushq $0x4
popq %rcx
cmpq $0x8, %rcx
je 0x16b0
movb $0x0, (%r12,%rcx)
incq %rcx
jmp 0x16a0
pushq $0x8
popq %rcx
cmpq $0x18, %rcx
je 0x16c6
movb -0x8(%rdi,%rcx), %dl
movb %dl, (%r12,%rcx)
incq %rcx
jmp 0x16b3
xorl %ecx, %ecx
cmpq $0x10, %rcx
je 0x16db
movb (%rax,%rcx), %dl
movb %dl, 0x18(%r12,%rcx)
incq %rcx
jmp 0x16c8
pushq $0xc
popq %rsi
movq %r12, %rdi
callq 0x1070
movq 0x20(%rbp), %rsi
pushq $0x18
popq %rax
cmpq $0x28, %rax
je 0x1700
movb -0x18(%rsi,%rax), %cl
xorb %cl, (%r12,%rax)
incq %rax
jmp 0x16ed
movq -0x30(%rbp), %rax
andl $0x7, %eax
movq %rax, -0x30(%rbp)
testq %r15, %r15
je 0x1748
incq %r13
xorl %r15d, %r15d
cmpq %r13, %r15
je 0x1748
xorl %eax, %eax
cmpq $0x8, %rax
je 0x1730
movb (%r14,%rax), %cl
xorb %cl, (%r12,%rax)
incq %rax
jmp 0x171d
movq %r12, %rdi
pushq $0x6
popq %rsi
callq 0x1070
movq 0x20(%rbp), %rsi
incq %r15
addq $0x8, %r14
jmp 0x1716
xorb $0x1, 0x27(%r12)
xorl %r15d, %r15d
movq -0x38(%rbp), %r13
movq -0x40(%rbp), %r14
cmpq -0x68(%rbp), %r15
je 0x179b
xorl %eax, %eax
cmpq $0x8, %rax
je 0x177f
movb (%r14,%rax), %cl
movb (%r12,%rax), %dl
xorb %cl, %dl
movb %dl, (%r13,%rax)
movb %cl, (%r12,%rax)
incq %rax
jmp 0x1761
movq %r12, %rdi
pushq $0x6
popq %rsi
callq 0x1070
movq 0x20(%rbp), %rsi
incq %r15
addq $0x8, %r14
addq $0x8, %r13
jmp 0x1759
movq -0x38(%rbp), %r15
leaq (%r15,%rbx), %rax
movq -0x40(%rbp), %r14
addq %r14, %rbx
xorl %ecx, %ecx
movq -0x30(%rbp), %rdi
cmpq %rcx, %rdi
je 0x17c4
movb (%rbx,%rcx), %dl
xorb (%r12,%rcx), %dl
movb %dl, (%rax,%rcx)
incq %rcx
jmp 0x17b0
xorl %eax, %eax
cmpq %rax, %rdi
je 0x17d7
movb (%rbx,%rax), %cl
movb %cl, (%r12,%rax)
incq %rax
jmp 0x17c6
xorb $-0x80, (%r12,%rdi)
pushq $0x8
popq %rax
movq -0x58(%rbp), %rbx
cmpq $0x18, %rax
je 0x17f6
movb -0x8(%rsi,%rax), %cl
xorb %cl, (%r12,%rax)
incq %rax
jmp 0x17e3
pushq $0xc
popq %rsi
movq %r12, %rdi
callq 0x1070
movq 0x20(%rbp), %rdx
xorl %eax, %eax
cmpq $0x10, %rax
je 0x181a
movb (%rdx,%rax), %cl
xorb %cl, 0x18(%r12,%rax)
incq %rax
jmp 0x1807
addq %rbx, %r14
xorl %ecx, %ecx
pushq $-0x1
popq %rax
cmpq $0x10, %rcx
je 0x184d
movb (%r14,%rcx), %dl
leaq 0x1(%rcx), %rsi
cmpb 0x18(%r12,%rcx), %dl
movq %rsi, %rcx
je 0x1822
movq -0x60(%rbp), %rsp
leaq -0x28(%rbp), %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
movq -0x50(%rbp), %rsi
movq %rbx, (%rsi)
xorl %eax, %eax
xorl %ecx, %ecx
movq -0x48(%rbp), %rdi
cmpq %rbx, %rcx
jae 0x183a
movb (%r15,%rcx), %dl
movb %dl, (%rdi,%rcx)
incq %rcx
movq (%rsi), %rbx
jmp 0x185c