// File: /workspace/github_c_makefile_star2_O2/mjosaarinen[P]brutus/crypto_aead/aescopav2/ref/encrypt.c
// Function: crypto_aead_decrypt
int crypto_aead_decrypt(
   unsigned char *m,unsigned long long *mlen,
   unsigned char *nsec,
   const unsigned char *c,unsigned long long clen,
   const unsigned char *ad,unsigned long long adlen,
   const unsigned char *npub,
   const unsigned char *k
   )
{
	unsigned char* macdata;
	const unsigned char* in = c;
	unsigned char* out = m;
	unsigned long long remaining;
	int partial;

	block_t V;
	block_t lastblock, newlastblock;
	block_t checksum = { 0 };
	block_t tag;
	block_t block, Lup, Ldown;
	block_t LL = { 0 };

	AES_ENCRYPT(LL, LL, k); /* LL = AES(LL) */

	/* verify that we have 16*x+1 bytes */
	if (clen % 16 != 1) {
		return -1;
	}

	/* Verify bit P */
	if (c[clen-1] > 1) {
		return -1;
	} else {
		partial = c[clen-1];
	}

	*mlen = clen - 16 - 1; /* provisional, will be adjusted later for incomplete last block */

	/* mac AD + nonce */
	macdata = malloc(adlen + 16);
	memcpy(macdata, ad, adlen);
	memcpy(macdata+adlen, npub, 16);
	mac(V, macdata, adlen+16, LL, k);
	free(macdata);

	xor_block(lastblock, LL, V); /* lastblock = LL ^ V; */

	gf128_mul3(Lup, LL); /* Lup = 3*LL */
	gf128_mul2(Ldown, LL); /* Ldown = 2*LL */

	remaining = *mlen;
	while (remaining > 16) {
		xor_block(block, in, Ldown);
		AES_DECRYPT(newlastblock, block, k);

		xor_block(block, newlastblock, lastblock);
		copy_block(lastblock, newlastblock);

		AES_DECRYPT(block, block, k);
		xor_block(out, block, Lup);
		xor_block(checksum, checksum, out);

		gf128_mul2(Lup, Lup);
		gf128_mul2(Ldown, Ldown);

		in += 16;
		out += 16;
		remaining -= 16;
	}

	/* verify correct length */
	if ((!partial && remaining != 16) || (partial && remaining == 0)) {
		return -1;
	}

	if (!partial) { /* full last block, normal processing */
		xor_block(block, in, Ldown);
		AES_DECRYPT(newlastblock, block, k);

		xor_block(block, newlastblock, lastblock);
		copy_block(lastblock, newlastblock);

		AES_DECRYPT(block, block, k);
		xor_block(out, block, Lup);
		xor_block(checksum, checksum, out);

		in += 16;
		out += 16;
		remaining -= 16;
	} else { /* last partial block remaining */
		int i, j;

		xor_block(block, in, Ldown);
		AES_DECRYPT(newlastblock, block, k);

		xor_block(block, newlastblock, lastblock);
		copy_block(lastblock, newlastblock);

		AES_DECRYPT(block, block, k);
		gf128_mul7(Lup, Lup);
		xor_block(newlastblock, block, Lup);
		xor_block(checksum, checksum, newlastblock);

		i = 15;
		while (i > 0 && newlastblock[i] == 0)
			--i;
		if ((newlastblock[i] != 0x80)) {
			return -1;
		}
		for (j = 0; j < i; j++) {
			out[j] = newlastblock[j];
		}

		/* adjust mlen */
		*mlen -= 16-i;

		in += remaining;
		out += i;
		remaining -= remaining;
	}

	/* compute tag */
	gf128_mul3(LL, Lup);
	xor_block(checksum, checksum, LL);
	AES_ENCRYPT(checksum, checksum, k);

	xor_block(checksum, checksum, lastblock);

	AES_ENCRYPT(checksum, checksum, k);
	gf128_mul7(LL, Ldown);
	xor_block(tag, checksum, LL);

	if (memcmp(tag, in, 16) == 0) {
		return 0;
	} else {
		return -1;
	}
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0xc8, %rsp
movq %r9, %rbx
movq %r8, %r14
movq %rcx, %r13
movq %rsi, %rbp
movq %rdi, %r15
movq 0x110(%rsp), %rdx
vxorps %xmm0, %xmm0, %xmm0
vmovaps %xmm0, 0x40(%rsp)
leaq 0x90(%rsp), %rdi
vmovaps %xmm0, (%rdi)
movq %rdi, %rsi
callq 0x1140
movl %r14d, %ecx
andl $0xf, %ecx
pushq $-0x1
popq %rax
cmpl $0x1, %ecx
jne 0x21d2
movb -0x1(%r13,%r14), %cl
cmpb $0x1, %cl
ja 0x21d2
movb %cl, 0x7(%rsp)
movq %r15, 0x8(%rsp)
movq 0x100(%rsp), %r12
addq $-0x11, %r14
movq %r14, (%rbp)
leaq 0x10(%r12), %r14
movq %r14, %rdi
callq 0x1070
movq %rbp, %r15
movq %rax, %rbp
movq %rax, %rdi
movq %rbx, %rsi
movq %r12, %rdx
callq 0x1120
movq 0x108(%rsp), %rax
vmovups (%rax), %xmm0
vmovups %xmm0, (%rbp,%r12)
leaq 0xb0(%rsp), %r12
leaq 0x90(%rsp), %rbx
movq %r12, %rdi
movq %rbp, %rsi
movq %r14, %rdx
movq %rbx, %rcx
movq 0x110(%rsp), %r8
callq 0x1110
movq %rbp, %rdi
callq 0x1090
leaq 0x70(%rsp), %rdi
movq %rbx, %rsi
movq %r12, %rdx
callq 0x1c11
leaq 0x30(%rsp), %rdi
movq %rbx, %rsi
callq 0x1bdf
leaq 0x50(%rsp), %rdi
movq %rbx, %rsi
callq 0x1c28
movq %r15, 0x88(%rsp)
movq (%r15), %r12
leaq 0x60(%rsp), %r14
cmpq $0x11, %r12
movq %r12, 0x28(%rsp)
jb 0x21a9
movq %r14, %rdi
movq %r13, %rsi
leaq 0x50(%rsp), %r12
movq %r12, %rdx
callq 0x1c11
leaq 0x10(%rsp), %rbx
movq %rbx, %rdi
movq %r14, %rsi
movq 0x110(%rsp), %r15
movq %r15, %rdx
callq 0x1130
movq %r14, %rdi
movq %rbx, %rsi
leaq 0x70(%rsp), %rbp
movq %rbp, %rdx
callq 0x1c11
movq %rbp, %rdi
movq %rbx, %rsi
callq 0x1a57
movq %r14, %rdi
movq %r14, %rsi
movq %r15, %rdx
callq 0x1130
movq 0x8(%rsp), %r15
movq %r15, %rdi
movq %r14, %rsi
leaq 0x30(%rsp), %rbp
movq %rbp, %rdx
callq 0x1c11
leaq 0x40(%rsp), %rdi
movq %rdi, %rsi
movq %r15, %rdx
callq 0x1c11
movq %rbp, %rdi
movq %rbp, %rsi
callq 0x1c28
movq %r12, %rdi
movq %r12, %rsi
callq 0x1c28
movq 0x28(%rsp), %r12
addq $0x10, %r13
addq $0x10, %r15
movq %r15, 0x8(%rsp)
addq $-0x10, %r12
jmp 0x20e7
movb 0x7(%rsp), %bpl
testb %bpl, %bpl
sete %al
cmpq $0x10, %r12
setne %cl
testb %cl, %al
jne 0x21cf
testb %bpl, %bpl
setne %al
testq %r12, %r12
sete %cl
testb %cl, %al
je 0x21e4
pushq $-0x1
popq %rax
addq $0xc8, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
leaq 0x60(%rsp), %rbx
leaq 0x50(%rsp), %rdx
movq %rbx, %rdi
movq %r13, %rsi
callq 0x1c11
leaq 0x10(%rsp), %r14
movq %r14, %rdi
movq %rbx, %rsi
movq 0x110(%rsp), %r15
movq %r15, %rdx
callq 0x1130
leaq 0x70(%rsp), %r12
movq %rbx, %rdi
movq %r14, %rsi
movq %r12, %rdx
callq 0x1c11
movq %r12, %rdi
movq %r14, %rsi
callq 0x1a57
movq %rbx, %rdi
movq %rbx, %rsi
movq %r15, %rdx
callq 0x1130
testb %bpl, %bpl
je 0x22bf
leaq 0x30(%rsp), %rbx
movq %rbx, %rdi
movq %rbx, %rsi
callq 0x1f75
leaq 0x10(%rsp), %r14
leaq 0x60(%rsp), %rsi
movq %r14, %rdi
movq %rbx, %rdx
callq 0x1c11
leaq 0x40(%rsp), %rdi
movq %rdi, %rsi
movq %r14, %rdx
callq 0x1c11
pushq $0xf
popq %r8
movq 0x8(%rsp), %rdi
testl %r8d, %r8d
je 0x2297
movl %r8d, %ecx
cmpb $0x0, 0x10(%rsp,%rcx)
jne 0x2297
decq %r8
jmp 0x2283
xorl %ecx, %ecx
cmpb 0x10(%rsp,%r8), %cl
pushq $-0x1
popq %rax
jno 0x21d2
movl %r8d, %ecx
xorl %edx, %edx
cmpq %rdx, %rcx
je 0x22ec
movb 0x10(%rsp,%rdx), %sil
movb %sil, (%rdi,%rdx)
incq %rdx
jmp 0x22ac
leaq 0x60(%rsp), %rsi
leaq 0x30(%rsp), %rdx
movq 0x8(%rsp), %rbx
movq %rbx, %rdi
callq 0x1c11
leaq 0x40(%rsp), %rdi
movq %rdi, %rsi
movq %rbx, %rdx
callq 0x1c11
pushq $0x10
popq %r12
jmp 0x2307
movq 0x88(%rsp), %rdx
movq (%rdx), %rcx
leaq (%rcx,%r8), %rax
addq $-0x10, %rax
movq %rax, (%rdx)
movq 0x28(%rsp), %r12
leaq 0x90(%rsp), %rbx
leaq 0x30(%rsp), %rsi
movq %rbx, %rdi
callq 0x1bdf
leaq 0x40(%rsp), %r14
movq %r14, %rdi
movq %r14, %rsi
movq %rbx, %rdx
callq 0x1c11
movq %r14, %rdi
movq %r14, %rsi
movq 0x110(%rsp), %r15
movq %r15, %rdx
callq 0x1140
leaq 0x70(%rsp), %rdx
movq %r14, %rdi
movq %r14, %rsi
callq 0x1c11
movq %r14, %rdi
movq %r14, %rsi
movq %r15, %rdx
callq 0x1140
leaq 0x50(%rsp), %rsi
movq %rbx, %rdi
callq 0x1f75
leaq 0xa0(%rsp), %r15
movq %r15, %rdi
movq %r14, %rsi
movq %rbx, %rdx
callq 0x1c11
vmovdqa (%r15), %xmm0
vpxor (%r13,%r12), %xmm0, %xmm0
xorl %eax, %eax
vptest %xmm0, %xmm0
setne %al
negl %eax
jmp 0x21d2
nop