// File: /workspace/github_cpp_makefile_star2_O3/occivink[P]pyct/monocypher.cpp
// Function: crypto_check_final
int crypto_check_final(crypto_check_ctx_abstract *ctx)
{
    u8 *s = ctx->buf + 32; // s
    u8  h_ram[64];
    u32 s32[8];            // s (different encoding)
    ge  A;

    ctx->hash->final(ctx, h_ram);
    reduce(h_ram);
    load32_le_buf(s32, s, 8);
    if (ge_frombytes_neg_vartime(&A, ctx->pk) ||  // A = -pk
        is_above_l(s32)) {                        // prevent s malleability
        return -1;
    }
    ge_double_scalarmult_vartime(&A, h_ram, s);   // A = [s]B - [h_ram]pk
    ge_tobytes(ctx->pk, &A);                      // R_check = A
    return crypto_verify32(ctx->buf, ctx->pk);    // R == R_check ? OK : fail
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x408, %rsp            # imm = 0x408
movq %rdi, %r13
movq (%rdi), %rax
leaq 0x1e0(%rsp), %rbx
movq %rbx, %rsi
callq *0x18(%rax)
movaps (%rbx), %xmm0
movaps 0x10(%rbx), %xmm1
movdqa 0x20(%rbx), %xmm2
movaps 0x30(%rbx), %xmm3
leaq 0x220(%rsp), %rsi
movaps %xmm3, 0x30(%rsi)
movdqa %xmm2, 0x20(%rsi)
movaps %xmm1, 0x10(%rsi)
movaps %xmm0, (%rsi)
movq %rbx, %rdi
callq 0x91a1
xorl %eax, %eax
movb $0x0, 0x220(%rsp,%rax)
incq %rax
cmpq $0x40, %rax
jne 0x695e
leaq 0x28(%r13), %r14
movdqu 0x28(%r13), %xmm0
movdqu 0x38(%r13), %xmm1
movdqa %xmm0, 0x20(%rsp)
movdqa %xmm1, 0x30(%rsp)
leaq 0x68(%r13), %rsi
leaq 0x68(%rsp), %r12
movq %r12, %rdi
movq %rsi, 0x18(%rsp)
movl $0x1, %edx
callq 0x8084
movl $0x1, 0x28(%r12)
pxor %xmm0, %xmm0
movdqu %xmm0, 0x2c(%r12)
movdqu %xmm0, 0x3c(%r12)
movl $0x0, 0x4c(%r12)
leaq 0xb8(%rsp), %rbx
movq %rbx, %rdi
movq %r12, %rsi
callq 0x82b2
leaq 0x700c(%rip), %rdx      # 0xd9f0
leaq 0x40(%rsp), %rdi
movq %rbx, %rsi
callq 0x7075
movl $0x1e, %eax
movl 0x18(%rsp,%rax,4), %ecx
subl %ecx, 0x40(%rsp,%rax,4)
incq %rax
cmpq $0x28, %rax
jne 0x69f6
xorl %eax, %eax
movl 0x90(%rsp,%rax,4), %ecx
addl %ecx, 0x40(%rsp,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x6a09
leaq 0x40(%rsp), %r15
movq %r15, %rdi
movq %rbx, %rsi
movq %r15, %rdx
callq 0x7075
movq %r15, %rdi
movq %r15, %rsi
callq 0x8793
movl $0xffffffff, %ebp       # imm = 0xFFFFFFFF
testl %eax, %eax
je 0x6e65
movq %r13, 0x10(%rsp)
leaq 0x40(%rsp), %r15
movq %r15, %rdi
movq %rbx, %rsi
movq %r15, %rdx
callq 0x7075
leaq 0x220(%rsp), %r13
movq %r13, %rdi
movq %r15, %rsi
callq 0x7887
xorl %ecx, %ecx
movb (%r13), %al
movb $0x0, 0x220(%rsp,%rcx)
incq %rcx
cmpq $0x20, %rcx
jne 0x6a79
andb $0x1, %al
movq 0x10(%rsp), %rcx
movb 0x87(%rcx), %cl
shrb $0x7, %cl
cmpb %cl, %al
jne 0x6aad
xorl %eax, %eax
negl 0x40(%rsp,%rax,4)
incq %rax
cmpq $0xa, %rax
jne 0x6aa0
leaq 0x40(%rsp), %rsi
movq %rbx, %rdi
movq %r12, %rdx
callq 0x7075
movl $0x1, %edx
xorl %eax, %eax
leaq 0x7415(%rip), %rcx      # 0xdee0
movl 0x20(%rsp,%rax), %edi
addq %rdx, %rdi
movl (%rax,%rcx), %esi
notl %esi
addq %rdi, %rsi
movq %rsi, %rdx
shrq $0x20, %rdx
addq $0x4, %rax
cmpq $0x20, %rax
jne 0x6acb
shrq $0x20, %rsi
jne 0x6e65
leaq 0xe0(%rsp), %rbx
leaq 0x40(%rsp), %r15
leaq 0x368(%rsp), %r13
movq %rbx, %rdi
movq %r15, %rsi
movq %r13, %rdx
callq 0x99c3
leaq 0x220(%rsp), %rbp
movq %rbp, %rdi
movq %r15, %rsi
callq 0x9ae8
movq %r13, %rdi
movq %rbx, %rsi
movq %rbp, %rdx
callq 0x9b3a
leaq 0x2c0(%rsp), %rdi
movq %r13, %rsi
callq 0x9ae8
movl $0xfc, %eax
movl %eax, %ecx
shrl $0x3, %ecx
movzbl 0x1e0(%rsp,%rcx), %ecx
movl %eax, %edx
andl $0x7, %edx
btl %edx, %ecx
jb 0x6b71
leal -0x1(%rax), %ecx
cmpl $0x1, %eax
movl %ecx, %eax
ja 0x6b4e
xorl %eax, %eax
incb %al
movb %al, 0xb(%rsp)
movw $0xffff, 0x8(%rsp)      # imm = 0xFFFF
movb $-0x1, 0xa(%rsp)
movl $0xfc, %ecx
movl %ecx, %edx
shrl $0x3, %edx
movzbl (%r14,%rdx), %edx
movl %ecx, %esi
andl $0x7, %esi
btl %esi, %edx
jb 0x6ba8
leal -0x1(%rcx), %edx
cmpl $0x1, %ecx
movl %edx, %ecx
ja 0x6b88
xorl %ecx, %ecx
incb %cl
leaq 0xc(%rsp), %rdx
movb %cl, 0x3(%rdx)
movw $0xffff, (%rdx)         # imm = 0xFFFF
movb $-0x1, 0x2(%rdx)
movzbl %al, %edx
movzbl %cl, %ecx
cmpb %cl, %al
cmovbel %ecx, %edx
movzbl %dl, %ebp
pxor %xmm0, %xmm0
leaq 0x40(%rsp), %r15
movdqa %xmm0, (%r15)
movdqa %xmm0, 0x10(%r15)
movq $0x0, 0x20(%r15)
movl $0x1, 0x28(%r15)
movdqu %xmm0, 0x2c(%r15)
movdqu %xmm0, 0x3c(%r15)
movabsq $0x100000000, %rax      # imm = 0x100000000
movq %rax, 0x4c(%r15)
movdqu %xmm0, 0x68(%r12)
movdqu %xmm0, 0x5c(%r12)
movdqu %xmm0, 0x4c(%r12)
movdqu %xmm0, 0x3c(%r12)
movdqu %xmm0, 0x2c(%r12)
leaq 0x6def(%rip), %r13      # 0xda20
movq %r15, %rdi
movq %r15, %rsi
leaq 0x368(%rsp), %rdx
callq 0x99c3
leaq 0x8(%rsp), %rdi
movl $0x3, %esi
movl %ebp, %edx
leaq 0x1e0(%rsp), %rcx
callq 0x9c93
movl %eax, %ebx
leaq 0xc(%rsp), %rdi
movl $0x5, %esi
movl %ebp, %edx
movq %r14, %rcx
callq 0x9c93
movl %eax, %r12d
testl %ebx, %ebx
jle 0x6c9c
shrl %ebx
leaq (%rbx,%rbx,4), %rax
shlq $0x5, %rax
leaq (%rsp,%rax), %rdx
addq $0x220, %rdx            # imm = 0x220
movq %r15, %rdi
movq %r15, %rsi
callq 0x9b3a
jmp 0x6c9e
js 0x6ce2
testl %r12d, %r12d
jle 0x6cca
shrl %r12d
imulq $0x78, %r12, %rdx
addq %r13, %rdx
movq %r15, %rdi
movq %r15, %rsi
leaq 0x1b0(%rsp), %rcx
leaq 0x180(%rsp), %r8
callq 0x7d29
jmp 0x6cd0
js 0x6d82
leal -0x1(%rbp), %eax
testl %ebp, %ebp
movl %eax, %ebp
jg 0x6c31
jmp 0x6e0d
negl %ebx
shrl %ebx
leaq (%rbx,%rbx,4), %rax
shlq $0x5, %rax
addq %rsp, %rax
addq $0x220, %rax            # imm = 0x220
movq 0x20(%rax), %rcx
leaq 0x108(%rsp), %rdx
movq %rcx, 0x20(%rdx)
movups (%rax), %xmm0
movups 0x10(%rax), %xmm1
movups %xmm1, 0x10(%rdx)
movups %xmm0, (%rdx)
movq 0x48(%rax), %rcx
movq %rcx, 0x100(%rsp)
movups 0x28(%rax), %xmm0
movups 0x38(%rax), %xmm1
movaps %xmm1, 0xf0(%rsp)
movaps %xmm0, 0xe0(%rsp)
movq 0x70(%rax), %rcx
movq %rcx, 0x48(%rdx)
movdqu 0x50(%rax), %xmm0
movdqu 0x60(%rax), %xmm1
movdqu %xmm1, 0x38(%rdx)
movdqu %xmm0, 0x28(%rdx)
movl $0x1e, %ecx
xorl %edx, %edx
subl (%rax,%rcx,4), %edx
movl %edx, 0xe0(%rsp,%rcx,4)
incq %rcx
cmpq $0x28, %rcx
jne 0x6d5a
movq %r15, %rdi
movq %r15, %rsi
leaq 0xe0(%rsp), %rdx
jmp 0x6c95
negl %r12d
shrl %r12d
imulq $0x78, %r12, %rcx
leaq (%rcx,%r13), %rax
movq 0x20(%rcx,%r13), %rdx
leaq 0x108(%rsp), %rsi
movq %rdx, 0x20(%rsi)
movups (%rcx,%r13), %xmm0
movdqu 0x10(%rcx,%r13), %xmm1
movdqu %xmm1, 0x10(%rsi)
movups %xmm0, (%rsi)
movups 0x28(%rcx,%r13), %xmm0
movaps %xmm0, 0xe0(%rsp)
movdqu 0x38(%rcx,%r13), %xmm0
movdqa %xmm0, 0xf0(%rsp)
movq 0x48(%rcx,%r13), %rcx
movq %rcx, 0x100(%rsp)
movl $0x14, %ecx
xorl %edx, %edx
subl (%rax,%rcx,4), %edx
movl %edx, 0xe0(%rsp,%rcx,4)
incq %rcx
cmpq $0x1e, %rcx
jne 0x6de5
movq %r15, %rdi
movq %r15, %rsi
leaq 0xe0(%rsp), %rdx
jmp 0x6cb3
leaq 0x40(%rsp), %rsi
movq 0x18(%rsp), %rdi
callq 0x6475
movq 0x10(%rsp), %rax
movdqu 0x8(%rax), %xmm0
movdqu 0x18(%rax), %xmm1
movdqu 0x68(%rax), %xmm2
pxor %xmm0, %xmm2
movdqu 0x78(%rax), %xmm0
pxor %xmm1, %xmm0
por %xmm2, %xmm0
pshufd $0xee, %xmm0, %xmm1     # xmm1 = xmm0[2,3,2,3]
por %xmm0, %xmm1
movq %xmm1, %rax
movl %eax, %ecx
shrq $0x20, %rax
orq %rax, %rcx
decq %rcx
xorl %ebp, %ebp
btq $0x20, %rcx
adcl $-0x1, %ebp
movl %ebp, %eax
addq $0x408, %rsp            # imm = 0x408
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq