// File: /workspace/github_c_makefile_star2_O0/mjosaarinen[P]brutus/crypto_aead/shellaes128v1d5n64/ref/shellaes.c
// Function: shellaesDec_nfb
int shellaesDec_nfb(const u8 key[], const u8 nonce[], const u8 ad[], unsigned long long int adlen, const u8 c[], unsigned long long int ctlen, u8 p[], const u8 tag[]){
    u8 V[16], U[16], checksum[16], F[16], keyprime[16], L[16], Lprime[16];
    u8* S;
    u8* I;
    u8* Z;
    u8 tempTag[16], tempTag2[16];
    int i, flag;

    unsigned long long int ct_fblen;
    unsigned int ct_nfblen;

    ct_nfblen=ctlen%16;
    ct_fblen=ctlen-ct_nfblen;

    S= (u8 *) malloc(ctlen);
    I= (u8 *) malloc(ctlen);
    Z= (u8 *) malloc(ct_fblen);

    memset(V, 0, 16);
    memset(U, 0, 16);
    memset(checksum, 0, 16);
    memset(keyprime, 0, 16);
    memset(F, 0, 16);
    memset(L, 0, 16);
    memset(Lprime, 0, 16);

    u32 mk[4*d], sk[12*d], isk[12*d], rk[44], irk[44], rkprime[44];

    /*setup key*/
    aesKeySetupEnc(rk, key);
    aesKeySetupDec(irk, key);
    KeySetupDec(mk, sk, isk, L, Lprime, keyprime, rk, key);
    aesKeySetupEnc(rkprime, keyprime);

    /*decrypt the last non-full block*/
    memcpy(tempTag, tag, 16);
    XLSInv(irk, Lprime, c+ct_fblen, ct_fblen, ct_nfblen, p+ct_fblen, tempTag);

    /*process associated data*/
    PXMAC(mk, sk, L, V, rk, ad, adlen);

    /*decryption of XEX layer*/
    XEXLayerDec(irk, Lprime, c, Z, ct_fblen);

    /*decryption of PXENC layer*/
    PXDEC(mk, isk, L, V, Z, rk, I, ct_fblen);
    memcpy(U, V, 16);

    /*process nonce*/
    CENC(rkprime, S, F, nonce, ctlen);

    /*produce plaintext*/
    memcpy(p, I, ct_fblen);
    xor_byte_string(S, p, ct_fblen);

    /*verify the validness of tag*/
    checksum_state_string(I, checksum, ct_fblen);
    tagGen(rk, checksum, Lprime, U, F, tempTag2, ct_fblen);

    flag=1;

    for(i=0; i<16; ++i){
        if(tempTag[i]!=tempTag2[i]){
            flag=0;
        }
    }

    /*

    if(flag){
        printf("the plaintext is: \n");
        printf_byte_string(p, ctlen);
    }
    else{
        printf("the tag is invalid!");
    }
    */

    return flag;

}

// Assembly:
subq $0x558, %rsp            # imm = 0x558
movq 0x568(%rsp), %rax
movq 0x560(%rsp), %rax
movq %rdi, 0x550(%rsp)
movq %rsi, 0x548(%rsp)
movq %rdx, 0x540(%rsp)
movq %rcx, 0x538(%rsp)
movq %r8, 0x530(%rsp)
movq %r9, 0x528(%rsp)
movq 0x528(%rsp), %rax
andq $0xf, %rax
movl %eax, 0x45c(%rsp)
movq 0x528(%rsp), %rax
movl 0x45c(%rsp), %ecx
subq %rcx, %rax
movq %rax, 0x460(%rsp)
movq 0x528(%rsp), %rdi
callq 0x20d0
movq %rax, 0x4a8(%rsp)
movq 0x528(%rsp), %rdi
callq 0x20d0
movq %rax, 0x4a0(%rsp)
movq 0x460(%rsp), %rdi
callq 0x20d0
movq %rax, 0x498(%rsp)
leaq 0x510(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x2070
leaq 0x500(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x2070
leaq 0x4f0(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x2070
leaq 0x4d0(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x2070
leaq 0x4e0(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x2070
leaq 0x4c0(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x2070
leaq 0x4b0(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x2070
leaq 0x170(%rsp), %rdi
movq 0x550(%rsp), %rsi
callq 0x2170
leaq 0xc0(%rsp), %rdi
movq 0x550(%rsp), %rsi
callq 0x2250
leaq 0x400(%rsp), %rdi
leaq 0x310(%rsp), %rsi
leaq 0x220(%rsp), %rdx
leaq 0x4c0(%rsp), %rcx
leaq 0x4b0(%rsp), %r8
leaq 0x4d0(%rsp), %r9
leaq 0x170(%rsp), %r10
movq 0x550(%rsp), %rax
movq %r10, (%rsp)
movq %rax, 0x8(%rsp)
callq 0x2060
leaq 0x10(%rsp), %rdi
leaq 0x4d0(%rsp), %rsi
callq 0x2170
movq 0x568(%rsp), %rax
movq (%rax), %rcx
movq %rcx, 0x480(%rsp)
movq 0x8(%rax), %rax
movq %rax, 0x488(%rsp)
leaq 0xc0(%rsp), %rdi
leaq 0x4b0(%rsp), %rsi
movq 0x530(%rsp), %rdx
addq 0x460(%rsp), %rdx
movq 0x460(%rsp), %rcx
movl 0x45c(%rsp), %r8d
movq 0x560(%rsp), %r9
addq 0x460(%rsp), %r9
leaq 0x480(%rsp), %rax
movq %rax, (%rsp)
callq 0x2040
leaq 0x400(%rsp), %rdi
leaq 0x310(%rsp), %rsi
leaq 0x4c0(%rsp), %rdx
leaq 0x510(%rsp), %rcx
leaq 0x170(%rsp), %r8
movq 0x540(%rsp), %r9
movq 0x538(%rsp), %rax
movq %rax, (%rsp)
callq 0x21a0
leaq 0xc0(%rsp), %rdi
leaq 0x4b0(%rsp), %rsi
movq 0x530(%rsp), %rdx
movq 0x498(%rsp), %rcx
movq 0x460(%rsp), %r8
callq 0x2140
leaq 0x400(%rsp), %rdi
leaq 0x220(%rsp), %rsi
leaq 0x4c0(%rsp), %rdx
leaq 0x510(%rsp), %rcx
movq 0x498(%rsp), %r8
leaq 0x170(%rsp), %r9
movq 0x4a0(%rsp), %r10
movq 0x460(%rsp), %rax
movq %r10, (%rsp)
movq %rax, 0x8(%rsp)
callq 0x20a0
movq 0x510(%rsp), %rax
movq %rax, 0x500(%rsp)
movq 0x518(%rsp), %rax
movq %rax, 0x508(%rsp)
leaq 0x10(%rsp), %rdi
movq 0x4a8(%rsp), %rsi
leaq 0x4e0(%rsp), %rdx
movq 0x548(%rsp), %rcx
movq 0x528(%rsp), %r8
callq 0x2180
movq 0x560(%rsp), %rdi
movq 0x4a0(%rsp), %rsi
movq 0x460(%rsp), %rdx
callq 0x2270
movq 0x4a8(%rsp), %rdi
movq 0x560(%rsp), %rsi
movq 0x460(%rsp), %rdx
callq 0x2240
movq 0x4a0(%rsp), %rdi
leaq 0x4f0(%rsp), %rsi
movq 0x460(%rsp), %rdx
callq 0x21b0
leaq 0x170(%rsp), %rdi
leaq 0x4f0(%rsp), %rsi
leaq 0x4b0(%rsp), %rdx
leaq 0x500(%rsp), %rcx
leaq 0x4e0(%rsp), %r8
leaq 0x470(%rsp), %r9
movq 0x460(%rsp), %rax
movq %rax, (%rsp)
callq 0x2080
movl $0x1, 0x468(%rsp)
movl $0x0, 0x46c(%rsp)
cmpl $0x10, 0x46c(%rsp)
jge 0x89db
movslq 0x46c(%rsp), %rax
movzbl 0x480(%rsp,%rax), %eax
movslq 0x46c(%rsp), %rcx
movzbl 0x470(%rsp,%rcx), %ecx
cmpl %ecx, %eax
je 0x89c6
movl $0x0, 0x468(%rsp)
jmp 0x89c8
movl 0x46c(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x46c(%rsp)
jmp 0x898d
movl 0x468(%rsp), %eax
addq $0x558, %rsp            # imm = 0x558
retq
nopw (%rax,%rax)