// File: /workspace/github_c_makefile_star2_O3/mjosaarinen[P]brutus/crypto_aead/shellaes128v1d5n64/ref/shellaes.c
// Function: shellaesDec_short
int shellaesDec_short(const u8 key[], const u8 nonce[], const u8 ad[], unsigned long long int adlen, const u8 c[], unsigned long long int ctlen, u8 p[], const u8 tag[]){

    u8 V[16], F[16], keyprime[16], L[16], Lprime[16], S[16], I[16];
    u32 mk[4*d], sk[12*d], rk[44], irk[44], rkprime[44];
    u8  pt1[16], pt2[16], ct1[16], ct2[16];
    u8 mask[16], mask1[16];
    u8 temp[16];

    int i, flag;

    /* key setup */
    aesKeySetupEnc(rk, key);
    KeySetupEnc(mk, sk, L, Lprime, keyprime, rk, key);
    aesKeySetupDec(irk, key);
    aesKeySetupEnc(rkprime, keyprime);

    memset(V, 0, 16);

    /*PX-MAC*/
    PXMAC(mk, sk, L, V, rk, ad, adlen);

    /*derive the block of ciphertext and save it to ct1[]*/

    memcpy(ct1, c, ctlen);
    for(i=ctlen; i<16; ++i){
        ct1[i]=tag[i-ctlen];
    }

    /*produce mask 3^3*Lprime*/
    memcpy(mask, Lprime, 16);
    for(i=0; i<3; ++i){
        memcpy(temp, mask, 16);
        double_mask(mask);
        xor_byte_string(temp, mask, 16);
    }

    /*produce mask 2^2*3^3*Lprime*/
    memcpy(mask1, mask, 16);
    double_mask(mask1);
    double_mask(mask1);

    /*decrypt to obtain I[]*/
    xor_byte_string(mask1, ct1, 16);
    aesDecrypt(irk, ct1, pt1);
    xor_byte_string(mask1, pt1, 16);

    xor_byte_string(V, pt1, 16);
    memcpy(ct1, pt1, 16);

    xor_byte_string(ct1, V, 16);

    xor_byte_string(mask, ct1, 16);
    aesDecrypt(irk, ct1, pt1);
    xor_byte_string(mask, pt1, 16);

    memcpy(I, pt1, 16);

    /*decrypt the plaintext*/
    CENC(rkprime, S, F, nonce, 16);
    xor_byte_string(S, pt1, 16);
    memcpy(p, pt1, ctlen);

    /*verify the validness of tag*/
    memcpy(pt2, I, 16);
    double_mask(mask);

    xor_byte_string(mask, pt2, 16);
    aesEncrypt(rk, pt2, ct2);
    xor_byte_string(mask, ct2, 16);

    xor_byte_string(V, ct2, 16);

    memcpy(pt2, ct2, 16);

    double_mask(mask1);

    xor_byte_string(mask1, pt2, 16);
    aesEncrypt(rk, pt2, ct2);
    xor_byte_string(mask1, ct2, 16);

    xor_byte_string(F, ct2, 16);


    flag=1;

    if(pt1[ctlen]!=0x80){
        flag=0;
    }

    for(i=ctlen+1; i<16; ++i){
        if(pt1[i]!=0){
            flag=0;
        }
    }

    for(i=0; i<ctlen; ++i){
        if(ct2[i]!=tag[i+16-ctlen]){
            flag=0;
        }
    }

    /*
     if(flag){
        printf("the plaintext is:\n");
        printf_byte_string(p, ctlen);
    }
    else{
        printf("the tag is invalid!");
    }
    */

    return flag;
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x468, %rsp            # imm = 0x468
movq %r9, 0x68(%rsp)
movq %r8, 0x30(%rsp)
movq %rcx, %r13
movq %rdx, %r12
movq %rsi, 0x40(%rsp)
movq %rdi, %rbx
movq 0x4a8(%rsp), %r15
leaq 0x160(%rsp), %rbp
movq %rbp, %rdi
movq %rbx, %rsi
callq 0x2170
movq %rbx, (%rsp)
leaq 0x110(%rsp), %rdi
leaq 0x370(%rsp), %rsi
leaq 0xd0(%rsp), %rdx
leaq 0xc0(%rsp), %rcx
leaq 0x100(%rsp), %r14
movq %r14, %r8
movq %rbp, %r9
callq 0x2210
leaq 0x2c0(%rsp), %rdi
movq %rbx, %rsi
callq 0x2220
leaq 0x210(%rsp), %rdi
movq %r14, %rsi
callq 0x2170
vxorps %xmm0, %xmm0, %xmm0
leaq 0x50(%rsp), %rcx
vmovaps %xmm0, (%rcx)
movq %r13, (%rsp)
leaq 0x110(%rsp), %rdi
leaq 0x370(%rsp), %rsi
leaq 0xd0(%rsp), %rdx
movq %rbp, %r8
movq 0x68(%rsp), %rbp
movq %r12, %r9
callq 0x21a0
leaq 0x80(%rsp), %rdi
movq 0x30(%rsp), %rsi
movq %rbp, %rdx
callq 0x2240
cmpl $0xf, %ebp
jg 0x59a7
movslq %ebp, %rsi
leaq (%rsp,%rsi), %rdi
addq $0x80, %rdi
movl $0xf, %edx
subl %esi, %edx
subq %rbp, %rsi
addq %r15, %rsi
incq %rdx
callq 0x2240
movq 0x4a0(%rsp), %r13
vmovaps 0xc0(%rsp), %xmm0
vmovaps %xmm0, 0x20(%rsp)
xorl %eax, %eax
vmovaps 0x20(%rsp), %xmm0
movl $0xf, %edx
movb 0x20(%rsp), %cl
xorl %esi, %esi
movb 0x20(%rsp,%rdx), %dil
leal (%rdi,%rdi), %r8d
orb %sil, %r8b
movb %r8b, 0x20(%rsp,%rdx)
shrb $0x7, %dil
movl %edi, %esi
addq $-0x1, %rdx
jb 0x59d1
testb %cl, %cl
jns 0x59f7
xorb $-0x79, 0x2f(%rsp)
vxorps 0x20(%rsp), %xmm0, %xmm0
vmovaps %xmm0, 0x20(%rsp)
incl %eax
cmpl $0x3, %eax
jne 0x59c0
vmovaps 0x20(%rsp), %xmm0
vmovaps %xmm0, 0x10(%rsp)
movl $0xf, %eax
xorl %edx, %edx
movb 0x10(%rsp), %cl
movb 0x10(%rsp,%rax), %sil
leal (%rsi,%rsi), %edi
orb %dl, %dil
movb %dil, 0x10(%rsp,%rax)
shrb $0x7, %sil
movl %esi, %edx
addq $-0x1, %rax
jb 0x5a21
testb %cl, %cl
jns 0x5a46
xorb $-0x79, 0x1f(%rsp)
movl $0xf, %ecx
movb 0x10(%rsp), %al
xorl %edx, %edx
movb 0x10(%rsp,%rcx), %sil
leal (%rsi,%rsi), %edi
orb %dl, %dil
movb %dil, 0x10(%rsp,%rcx)
shrb $0x7, %sil
movl %esi, %edx
addq $-0x1, %rcx
jb 0x5a51
testb %al, %al
jns 0x5a76
xorb $-0x79, 0x1f(%rsp)
vmovaps 0x10(%rsp), %xmm0
vmovaps %xmm0, 0x30(%rsp)
leaq 0x80(%rsp), %rbx
vxorps (%rbx), %xmm0, %xmm0
vmovaps %xmm0, (%rbx)
leaq 0x2c0(%rsp), %r14
leaq 0xa0(%rsp), %r12
movq %r14, %rdi
movq %rbx, %rsi
movq %r12, %rdx
callq 0x20b0
vmovaps 0x30(%rsp), %xmm0
vxorps (%r12), %xmm0, %xmm0
vxorps 0x50(%rsp), %xmm0, %xmm1
vmovaps %xmm1, (%r12)
vmovaps %xmm0, 0x50(%rsp)
vmovaps 0x20(%rsp), %xmm0
vmovaps %xmm0, 0x30(%rsp)
vxorps %xmm0, %xmm1, %xmm0
vmovaps %xmm0, (%rbx)
movq %r14, %rdi
movq %rbx, %rsi
movq %r12, %rdx
callq 0x20b0
vmovaps 0x30(%rsp), %xmm0
vxorps (%r12), %xmm0, %xmm0
vmovaps %xmm0, (%r12)
vmovaps %xmm0, 0xb0(%rsp)
leaq 0x210(%rsp), %rdi
leaq 0xf0(%rsp), %rbx
leaq 0xe0(%rsp), %rdx
movl $0x10, %r8d
movq %rbx, %rsi
movq 0x40(%rsp), %rcx
callq 0x2180
vmovaps (%r12), %xmm0
vxorps (%rbx), %xmm0, %xmm0
vmovaps %xmm0, (%r12)
movq %r13, %rdi
movq %r12, %rsi
movq %rbp, %rdx
callq 0x2240
vmovaps 0xb0(%rsp), %xmm0
vmovaps %xmm0, 0x90(%rsp)
movl $0xf, %eax
xorl %edx, %edx
movb 0x20(%rsp), %cl
movb 0x20(%rsp,%rax), %sil
leal (%rsi,%rsi), %edi
orb %dl, %dil
movb %dil, 0x20(%rsp,%rax)
shrb $0x7, %sil
movl %esi, %edx
addq $-0x1, %rax
jb 0x5b71
testb %cl, %cl
jns 0x5b96
xorb $-0x79, 0x2f(%rsp)
vmovaps 0x20(%rsp), %xmm0
vmovaps %xmm0, 0x40(%rsp)
leaq 0x90(%rsp), %rbx
vxorps (%rbx), %xmm0, %xmm0
vmovaps %xmm0, (%rbx)
leaq 0x160(%rsp), %rdi
leaq 0x70(%rsp), %r14
movq %rbx, %rsi
movq %r14, %rdx
callq 0x21e0
vmovdqa (%r14), %xmm0
vmovdqa 0x40(%rsp), %xmm1
vpternlogq $0x96, 0x50(%rsp), %xmm1, %xmm0
vmovdqa %xmm0, (%r14)
vmovdqa %xmm0, (%rbx)
movl $0xf, %eax
xorl %edx, %edx
movb 0x10(%rsp), %cl
movb 0x10(%rsp,%rax), %sil
leal (%rsi,%rsi), %edi
orb %dl, %dil
movb %dil, 0x10(%rsp,%rax)
shrb $0x7, %sil
movl %esi, %edx
addq $-0x1, %rax
jb 0x5bf2
testb %cl, %cl
jns 0x5c17
xorb $-0x79, 0x1f(%rsp)
vmovaps 0x10(%rsp), %xmm0
vmovaps %xmm0, 0x40(%rsp)
leaq 0x90(%rsp), %rsi
vxorps (%rsi), %xmm0, %xmm0
vmovaps %xmm0, (%rsi)
leaq 0x160(%rsp), %rdi
leaq 0x70(%rsp), %rbx
movq %rbx, %rdx
callq 0x21e0
vmovdqa (%rbx), %xmm0
vmovdqa 0x40(%rsp), %xmm1
vpternlogq $0x96, 0xe0(%rsp), %xmm1, %xmm0
vmovdqa %xmm0, (%rbx)
xorl %ecx, %ecx
xorl %eax, %eax
cmpb 0xa0(%rsp,%rbp), %cl
seto %al
leal 0x1(%rbp), %edx
cmpl $0xf, %edx
jg 0x5c94
movslq %edx, %rdx
incq %rdx
movq %rdx, %rsi
cmpb $0x0, 0x9f(%rsp,%rdx)
cmovnel %ecx, %eax
incq %rsi
cmpl $0x10, %edx
movq %rsi, %rdx
jne 0x5c7e
testq %rbp, %rbp
je 0x5d31
leaq 0x7(%rbp), %rcx
andq $-0x8, %rcx
leaq -0x1(%rbp), %rdx
vpbroadcastq %rdx, %ymm0
subq %rbp, %r15
addq $0x10, %r15
kxorw %k0, %k0, %k1
xorl %edx, %edx
vpmovsxbq 0x64f7(%rip), %ymm1 # 0xc1bc
vpmovsxbq 0x64f2(%rip), %ymm2 # 0xc1c0
kmovq %k1, %k0
vpbroadcastq %rdx, %ymm3
vpor %ymm1, %ymm3, %ymm4
vpor %ymm2, %ymm3, %ymm3
vpcmpleuq %ymm0, %ymm3, %k1
vpcmpleuq %ymm0, %ymm4, %k2
kshiftlb $0x4, %k2, %k2
korb %k2, %k1, %k2
kmovb %k2, %k1
vmovdqu8 0x70(%rsp,%rdx), %xmm3 {%k1} {z}
vmovdqu8 (%r15,%rdx), %xmm4 {%k1} {z}
vpcmpneqb %xmm4, %xmm3, %k1
korb %k1, %k0, %k1
addq $0x8, %rdx
cmpq %rdx, %rcx
jne 0x5cce
kandnb %k0, %k2, %k0
kandb %k2, %k1, %k1
xorl %ecx, %ecx
kortestb %k0, %k1
cmovnel %ecx, %eax
addq $0x468, %rsp            # imm = 0x468
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
vzeroupper
retq