// File: /workspace/github_c_makefile_star2_O2/mjosaarinen[P]brutus/crypto_aead/shellaes128v2d5n64/ref/shellaes.c
// Function: shellaesDecVef_fb
int shellaesDecVef_fb(const u8 key[], const u8 nonce[], const u8 ad[], unsigned long long int adlen, const u8 c[], unsigned long long int ctlen, u8 p[], const u8 tag[]){

    u8 V[16], U[16], checksum[16], keyprime[16], F[16], L[16], Lprime[16];

    u8* S;
    u8* I;
    u8* Z;

    S=(u8 *) malloc(ctlen);
    I=(u8 *) malloc(ctlen);
    Z=(u8 *) malloc(ctlen);

    memset(V, 0, 16);
    memset(U, 0, 16);
    memset(checksum, 0, 16);
    memset(keyprime, 0, 16);
    memset(F, 0, 16);
    memset(L, 0, 16);
    memset(Lprime, 0, 16);

    u32 mk[4*d], sk[12*d], isk[12*d], rk[44], irk[44], rkprime[44];

    /*setup key materials*/
    aesKeySetupEnc(rk, key);
    aesKeySetupDec(irk, key);
    KeySetupDec(mk, sk, isk, L, Lprime, keyprime, rk, key);
    aesKeySetupEnc(rkprime, keyprime);

    /*process associated data*/
    PXMAC(mk, sk, L, V, rk, ad, adlen);

    /*decryption of XEX layer*/
    XEXLayerDec(irk, Lprime, c, Z, ctlen);

    /*decryption of PXENC layer*/
    PXDEC(mk, isk, L, V, Z, rk, I, ctlen);

    /*CENC layer*/
    CENC(rkprime, S, F, nonce, ctlen);

    /*produce the plaintext*/
    memcpy(p, S, ctlen);
    xor_byte_string(I, p, ctlen);

    /*verify the validness of tag*/
    int flag;
    memcpy(U, V, 16);
    checksum_state_string(I, checksum, ctlen);

    flag=tagVef(rk, checksum, Lprime, U, F, tag, ctlen);

    free(I);
    free(S);
    free(Z);

    return flag;

}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x4e8, %rsp            # imm = 0x4E8
movq %r9, %rbx
movq %r8, 0x18(%rsp)
movq %rcx, 0x10(%rsp)
movq %rdx, 0x8(%rsp)
movq %rsi, 0x28(%rsp)
movq %rdi, %r14
movq %r9, %rdi
callq 0x10c0
movq %rax, 0x20(%rsp)
movq %rbx, %rdi
callq 0x10c0
movq %rax, %r13
movq %rbx, %rdi
callq 0x10c0
movq %rax, (%rsp)
vxorps %xmm0, %xmm0, %xmm0
leaq 0x80(%rsp), %rax
vmovaps %xmm0, (%rax)
leaq 0x70(%rsp), %rax
vmovaps %xmm0, (%rax)
leaq 0x30(%rsp), %rax
vmovaps %xmm0, (%rax)
leaq 0x60(%rsp), %rax
vmovaps %xmm0, (%rax)
leaq 0x50(%rsp), %r12
vmovaps %xmm0, (%r12)
leaq 0x40(%rsp), %rbp
vmovaps %xmm0, (%rbp)
leaq 0xf0(%rsp), %rdi
movq %r14, %rsi
callq 0x1140
leaq 0x250(%rsp), %rdi
movq %r14, %rsi
callq 0x1200
leaq 0xa0(%rsp), %r15
leaq 0x3f0(%rsp), %rsi
leaq 0x300(%rsp), %rdx
movq %r15, %rdi
movq %r12, %rcx
movq %rbp, %r8
leaq 0x30(%rsp), %r9
pushq %r14
leaq 0xf8(%rsp), %rax
pushq %rax
callq 0x1050
popq %rax
popq %rcx
leaq 0x1a0(%rsp), %rdi
leaq 0x30(%rsp), %rsi
callq 0x1140
subq $0x8, %rsp
movq %r15, %rdi
leaq 0x3f8(%rsp), %rsi
movq %r12, %rdx
leaq 0x88(%rsp), %r15
movq %r15, %rcx
leaq 0xf8(%rsp), %r8
movq %r8, %r14
movq 0x10(%rsp), %r9
pushq 0x18(%rsp)
callq 0x1160
popq %rax
popq %rcx
leaq 0x250(%rsp), %rdi
movq %rbp, %rsi
movq 0x18(%rsp), %rdx
movq (%rsp), %r12
movq %r12, %rcx
movq %rbx, %r8
callq 0x1110
leaq 0xa0(%rsp), %rdi
leaq 0x300(%rsp), %rsi
leaq 0x50(%rsp), %rdx
movq %r15, %rcx
movq %r15, %rbp
movq %r12, %r8
movq %r14, %r9
pushq %rbx
pushq %r13
callq 0x1090
popq %rax
popq %rcx
leaq 0x1a0(%rsp), %rdi
movq 0x20(%rsp), %r15
movq %r15, %rsi
leaq 0x60(%rsp), %r12
movq %r12, %rdx
movq 0x28(%rsp), %rcx
movq %rbx, %r8
callq 0x1150
movq 0x520(%rsp), %r14
movq %r14, %rdi
movq %r15, %rsi
movq %rbx, %rdx
callq 0x1210
movq %r13, %rdi
movq %r14, %rsi
movq %rbx, %rdx
callq 0x11f0
vmovaps (%rbp), %xmm0
leaq 0x90(%rsp), %r14
vmovaps %xmm0, (%r14)
movq %r13, %rdi
leaq 0x70(%rsp), %rbp
movq %rbp, %rsi
movq %rbx, %rdx
callq 0x1170
subq $0x8, %rsp
leaq 0xf8(%rsp), %rdi
movq %rbp, %rsi
leaq 0x48(%rsp), %rdx
movq %r14, %rcx
movq %r12, %r8
movq 0x530(%rsp), %r9
pushq %rbx
callq 0x1100
popq %rcx
popq %rdx
movl %eax, %ebx
movq %r13, %rdi
callq 0x1120
movq %r15, %rdi
callq 0x1120
movq (%rsp), %rdi
callq 0x1120
movl %ebx, %eax
addq $0x4e8, %rsp            # imm = 0x4E8
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq