// File: /workspace/github_c_makefile_star2_O0/mjosaarinen[P]brutus/crypto_aead/scream12v2/ref/tae.c
// Function: crypto_aead_decrypt
int crypto_aead_decrypt(
                        unsigned char *m,unsigned long long *outputmlen,
                        unsigned char *nsec,
                        const unsigned char *c,unsigned long long clen,
                        const unsigned char *ad,unsigned long long adlen,
                        const unsigned char *npub,
                        const unsigned char *k
                        )
{
    unsigned char K[blocklen];
    unsigned char T[blocklen] = {0};
    unsigned char auth[blocklen] = {0};
    unsigned char sum[blocklen] = {0};
    unsigned long long i;
    unsigned j;
    memcpy(K, k, blocklen);

    if (clen < CRYPTO_ABYTES) return -1;
    *outputmlen = clen - CRYPTO_ABYTES;

    /* Process Associated Data */
    memcpy(T, npub, CRYPTO_NPUBBYTES);
    T[15]  = 0x02;           /* control byte for a.d. */
    
    for (i=0; i<adlen; i+=blocklen) {

      unsigned char block[blocklen] = {0};

      if (i+blocklen < adlen) {
	/* Normal block */
	memcpy(block, ad+i, blocklen);
      } else if (i+blocklen == adlen) {
	/* Final block: full */
	memcpy(block, ad+i, blocklen);
	T[15] = 0x04;	
      } else {
	/* Final block: partial with padding */
	memcpy(block, ad+i, adlen % blocklen);
	block[adlen % blocklen] = 0x80;
	T[15] = 0x06;
      }

      LS_encrypt(block, K, T, block);
      for (j = 0; j < blocklen; j++)
	auth[j] ^= block[j];
      increment(T);
    }

    
    /* Process Message */
    memset(T, 0, blocklen);
    memcpy(T, npub, CRYPTO_NPUBBYTES);

    for (i=0; i < *outputmlen; i+=blocklen) {
      if (i+blocklen <= *outputmlen) {
	/* Full block (can be last block) */
	LS_decrypt(c+i, K, T, m+i);
	for (j=0; j < blocklen; j++)
	  sum[j] ^= m[i+j];

	increment(T);
      } else {
	/* Partial block (final) */
	unsigned char block[blocklen] = {0};
	block[15] = 8*(*outputmlen % blocklen);
	LS_encrypt(block, K, T, block);

	for (j=0; j < *outputmlen%blocklen; j++) {
	  m[i+j] = block[j] ^ c[i+j];
	  sum[j] ^= m[i+j];
	}
      }
    }

    /* Generate Tag */
    T[15] = ((8*(*outputmlen % blocklen)) << 1) | 1;

    LS_encrypt(sum, K, T, sum);
    for (i = 0; i < CRYPTO_ABYTES; i++)
      if (c[*outputmlen+i] != (auth[i] ^ sum[i])) {
	memset(m, 0, *outputmlen);
	return -1;
      }
    
    return 0;
}

// Assembly:
subq $0xa8, %rsp
movq 0xc0(%rsp), %rax
movq 0xb8(%rsp), %rax
movq 0xb0(%rsp), %rax
movq %rdi, 0x98(%rsp)
movq %rsi, 0x90(%rsp)
movq %rdx, 0x88(%rsp)
movq %rcx, 0x80(%rsp)
movq %r8, 0x78(%rsp)
movq %r9, 0x70(%rsp)
leaq 0x50(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x1030
leaq 0x40(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x1030
leaq 0x30(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x1030
movq 0xc0(%rsp), %rax
movq (%rax), %rcx
movq %rcx, 0x60(%rsp)
movq 0x8(%rax), %rax
movq %rax, 0x68(%rsp)
cmpq $0x10, 0x78(%rsp)
jae 0x27ed
movl $0xffffffff, 0xa4(%rsp) # imm = 0xFFFFFFFF
jmp 0x2be5
movq 0x78(%rsp), %rcx
subq $0x10, %rcx
movq 0x90(%rsp), %rax
movq %rcx, (%rax)
movq 0xb8(%rsp), %rax
movq (%rax), %rcx
movq %rcx, 0x50(%rsp)
movw 0x8(%rax), %cx
movw %cx, 0x58(%rsp)
movb 0xa(%rax), %al
movb %al, 0x5a(%rsp)
movb $0x2, 0x5f(%rsp)
movq $0x0, 0x28(%rsp)
movq 0x28(%rsp), %rax
cmpq 0xb0(%rsp), %rax
jae 0x295e
leaq 0x10(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x1030
movq 0x28(%rsp), %rax
addq $0x10, %rax
cmpq 0xb0(%rsp), %rax
jae 0x2885
movq 0x70(%rsp), %rax
movq 0x28(%rsp), %rcx
movq (%rax,%rcx), %rdx
movq %rdx, 0x10(%rsp)
movq 0x8(%rax,%rcx), %rax
movq %rax, 0x18(%rsp)
jmp 0x28f4
movq 0x28(%rsp), %rax
addq $0x10, %rax
cmpq 0xb0(%rsp), %rax
jne 0x28bc
movq 0x70(%rsp), %rax
movq 0x28(%rsp), %rcx
movq (%rax,%rcx), %rdx
movq %rdx, 0x10(%rsp)
movq 0x8(%rax,%rcx), %rax
movq %rax, 0x18(%rsp)
movb $0x4, 0x5f(%rsp)
jmp 0x28f2
leaq 0x10(%rsp), %rdi
movq 0x70(%rsp), %rsi
addq 0x28(%rsp), %rsi
movq 0xb0(%rsp), %rdx
andq $0xf, %rdx
callq 0x1090
movq 0xb0(%rsp), %rax
andq $0xf, %rax
movb $-0x80, 0x10(%rsp,%rax)
movb $0x6, 0x5f(%rsp)
jmp 0x28f4
leaq 0x10(%rsp), %rdi
leaq 0x60(%rsp), %rsi
leaq 0x50(%rsp), %rdx
leaq 0x10(%rsp), %rcx
callq 0x1080
movl $0x0, 0x24(%rsp)
cmpl $0x10, 0x24(%rsp)
jae 0x2941
movl 0x24(%rsp), %eax
movzbl 0x10(%rsp,%rax), %edx
movl 0x24(%rsp), %eax
movzbl 0x40(%rsp,%rax), %ecx
xorl %edx, %ecx
movb %cl, 0x40(%rsp,%rax)
movl 0x24(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x24(%rsp)
jmp 0x2915
leaq 0x50(%rsp), %rdi
callq 0x2700
movq 0x28(%rsp), %rax
addq $0x10, %rax
movq %rax, 0x28(%rsp)
jmp 0x282f
leaq 0x50(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x1030
movq 0xb8(%rsp), %rax
movq (%rax), %rcx
movq %rcx, 0x50(%rsp)
movw 0x8(%rax), %cx
movw %cx, 0x58(%rsp)
movb 0xa(%rax), %al
movb %al, 0x5a(%rsp)
movq $0x0, 0x28(%rsp)
movq 0x28(%rsp), %rax
movq 0x90(%rsp), %rcx
cmpq (%rcx), %rax
jae 0x2b23
movq 0x28(%rsp), %rax
addq $0x10, %rax
movq 0x90(%rsp), %rcx
cmpq (%rcx), %rax
ja 0x2a3f
movq 0x80(%rsp), %rdi
addq 0x28(%rsp), %rdi
leaq 0x60(%rsp), %rsi
leaq 0x50(%rsp), %rdx
movq 0x98(%rsp), %rcx
addq 0x28(%rsp), %rcx
callq 0x1060
movl $0x0, 0x24(%rsp)
cmpl $0x10, 0x24(%rsp)
jae 0x2a30
movq 0x98(%rsp), %rax
movq 0x28(%rsp), %rcx
movl 0x24(%rsp), %edx
addq %rdx, %rcx
movzbl (%rax,%rcx), %edx
movl 0x24(%rsp), %eax
movzbl 0x30(%rsp,%rax), %ecx
xorl %edx, %ecx
movb %cl, 0x30(%rsp,%rax)
movl 0x24(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x24(%rsp)
jmp 0x29f5
leaq 0x50(%rsp), %rdi
callq 0x2700
jmp 0x2b0e
movq %rsp, %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x1030
movq 0x90(%rsp), %rax
movq (%rax), %rax
andq $0xf, %rax
shlq $0x3, %rax
movb %al, 0xf(%rsp)
movq %rsp, %rdi
leaq 0x60(%rsp), %rsi
leaq 0x50(%rsp), %rdx
movq %rsp, %rcx
callq 0x1080
movl $0x0, 0x24(%rsp)
movl 0x24(%rsp), %eax
movq 0x90(%rsp), %rcx
movq (%rcx), %rcx
andq $0xf, %rcx
cmpq %rcx, %rax
jae 0x2b0c
movl 0x24(%rsp), %eax
movzbl (%rsp,%rax), %eax
movq 0x80(%rsp), %rcx
movq 0x28(%rsp), %rdx
movl 0x24(%rsp), %esi
addq %rsi, %rdx
movzbl (%rcx,%rdx), %ecx
xorl %ecx, %eax
movb %al, %dl
movq 0x98(%rsp), %rax
movq 0x28(%rsp), %rcx
movl 0x24(%rsp), %esi
addq %rsi, %rcx
movb %dl, (%rax,%rcx)
movq 0x98(%rsp), %rax
movq 0x28(%rsp), %rcx
movl 0x24(%rsp), %edx
addq %rdx, %rcx
movzbl (%rax,%rcx), %edx
movl 0x24(%rsp), %eax
movzbl 0x30(%rsp,%rax), %ecx
xorl %edx, %ecx
movb %cl, 0x30(%rsp,%rax)
movl 0x24(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x24(%rsp)
jmp 0x2a82
jmp 0x2b0e
jmp 0x2b10
movq 0x28(%rsp), %rax
addq $0x10, %rax
movq %rax, 0x28(%rsp)
jmp 0x2998
movq 0x90(%rsp), %rax
movq (%rax), %rax
andq $0xf, %rax
shlq $0x3, %rax
shlq %rax
orq $0x1, %rax
movb %al, 0x5f(%rsp)
leaq 0x30(%rsp), %rdi
leaq 0x60(%rsp), %rsi
leaq 0x50(%rsp), %rdx
leaq 0x30(%rsp), %rcx
callq 0x1080
movq $0x0, 0x28(%rsp)
cmpq $0x10, 0x28(%rsp)
jae 0x2bda
movq 0x80(%rsp), %rax
movq 0x90(%rsp), %rcx
movq (%rcx), %rcx
addq 0x28(%rsp), %rcx
movzbl (%rax,%rcx), %eax
movq 0x28(%rsp), %rcx
movzbl 0x40(%rsp,%rcx), %ecx
movq 0x28(%rsp), %rdx
movzbl 0x30(%rsp,%rdx), %edx
xorl %edx, %ecx
cmpl %ecx, %eax
je 0x2bc8
movq 0x98(%rsp), %rdi
movq 0x90(%rsp), %rax
movq (%rax), %rdx
xorl %esi, %esi
callq 0x1030
movl $0xffffffff, 0xa4(%rsp) # imm = 0xFFFFFFFF
jmp 0x2be5
jmp 0x2bca
movq 0x28(%rsp), %rax
addq $0x1, %rax
movq %rax, 0x28(%rsp)
jmp 0x2b63
movl $0x0, 0xa4(%rsp)
movl 0xa4(%rsp), %eax
addq $0xa8, %rsp
retq
nopw %cs:(%rax,%rax)
nop