// File: /workspace/github_c_makefile_star2_O0/mjosaarinen[P]brutus/crypto_aead/aes128poetv1aes4/ni/poet.c
// Function: decrypt_final
int decrypt_final(struct poet_ctx *ctx, const uint8_t *ciphertext,
		   uint64_t clen, const uint8_t tag[BLOCKLEN],
		   uint8_t *plaintext)
{
#ifdef DEBUG
  int i;
#endif
  uint64_t offset=0;
  block s;
  block tmp;
  block tmp2;
  int alpha;
  int beta;
  uint64_t len;

  while( clen > BLOCKLEN )
    {
      decrypt_block(ctx, ciphertext+offset, plaintext+offset);
      clen   -= BLOCKLEN;
      offset += BLOCKLEN;
    }

  /* Encrypt length of message */
  ctx->mlen+=(clen*8);
  memset(s,0,BLOCKLEN);
  len =  TO_LITTLE_ENDIAN_64(ctx->mlen);
  memcpy(s, &len, 8);
  AESNI_encrypt(s, s ,ctx->aes_enc);


  /* Last ciphertext block must be padded if necesscary */
  memcpy(tmp,ciphertext+offset,clen);
  memcpy(tmp+clen,tag,BLOCKLEN-clen);


  /* Process last block + tag generation */
  BOTTOM_HASH;
  xor_block(tmp,s,tmp);
  xor_block(ctx->y, tmp,ctx->y);

  AESNI_decrypt(ctx->y, tmp, ctx->aes_dec);

  TOP_HASH;
  xor_block(tmp2, tmp, ctx->x);
  xor_block(tmp2, s, tmp2);
  memcpy(ctx->x,tmp,BLOCKLEN);


#ifdef DEBUG
  puts("S"); for(i=0;i<16;i++) printf("%02x ",s[i]); puts("");
  puts("X"); for(i=0;i<16;i++) printf("%02x ",ctx->x[i]); puts("");
  puts("Y"); for(i=0;i<16;i++) printf("%02x ",ctx->y[i]); puts("");
#endif

  /* Do tag splitting if needed */
  memcpy(plaintext+offset,tmp2,clen);

  alpha = memcmp(tmp2+clen,ctx->tau,BLOCKLEN-clen);

  /* Generate tag */
  TOP_HASH;
  xor_block(ctx->x, ctx->tau ,ctx->x);
  xor_block(ctx->x, ctx->tm ,ctx->x);

  AESNI_encrypt(ctx->x, tmp, ctx->aes_enc);

  BOTTOM_HASH;
  xor_block(tmp, ctx->y, tmp);
  xor_block(tmp, ctx->tm, tmp);

#ifdef DEBUG
  puts("tmp"); for(i=0;i<16;i++) printf("%02x ",tmp[i]); puts("");
  puts("tag"); for(i=0;i<16;i++) printf("%02x ",tag[i]); puts("");
#endif

  beta = memcmp(tmp,tag+(BLOCKLEN-clen),clen);

  return alpha|beta;
}

// Assembly:
subq $0x78, %rsp
movq %rdi, 0x70(%rsp)
movq %rsi, 0x68(%rsp)
movq %rdx, 0x60(%rsp)
movq %rcx, 0x58(%rsp)
movq %r8, 0x50(%rsp)
movq $0x0, 0x48(%rsp)
cmpq $0x10, 0x60(%rsp)
jbe 0x311a
movq 0x70(%rsp), %rdi
movq 0x68(%rsp), %rsi
addq 0x48(%rsp), %rsi
movq 0x50(%rsp), %rdx
addq 0x48(%rsp), %rdx
callq 0x10d0
movq 0x60(%rsp), %rax
subq $0x10, %rax
movq %rax, 0x60(%rsp)
movq 0x48(%rsp), %rax
addq $0x10, %rax
movq %rax, 0x48(%rsp)
jmp 0x30d6
movq 0x60(%rsp), %rcx
shlq $0x3, %rcx
movq 0x70(%rsp), %rax
addq 0x280(%rax), %rcx
movq %rcx, 0x280(%rax)
leaq 0x30(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x1030
movq 0x70(%rsp), %rax
movq 0x280(%rax), %rax
movq %rax, (%rsp)
movq (%rsp), %rax
movq %rax, 0x30(%rsp)
leaq 0x30(%rsp), %rdi
leaq 0x30(%rsp), %rsi
movq 0x70(%rsp), %rdx
callq 0x1130
leaq 0x20(%rsp), %rdi
movq 0x68(%rsp), %rsi
addq 0x48(%rsp), %rsi
movq 0x60(%rsp), %rdx
callq 0x1160
leaq 0x20(%rsp), %rdi
addq 0x60(%rsp), %rdi
movq 0x58(%rsp), %rsi
movl $0x10, %edx
subq 0x60(%rsp), %rdx
callq 0x1160
movq 0x70(%rsp), %rdi
addq $0x260, %rdi            # imm = 0x260
movq 0x70(%rsp), %rsi
addq $0x260, %rsi            # imm = 0x260
movq 0x70(%rsp), %rdx
addq $0x1b0, %rdx            # imm = 0x1B0
callq 0x1040
leaq 0x20(%rsp), %rdi
leaq 0x30(%rsp), %rsi
leaq 0x20(%rsp), %rdx
callq 0x1150
movq 0x70(%rsp), %rdi
addq $0x260, %rdi            # imm = 0x260
leaq 0x20(%rsp), %rsi
movq 0x70(%rsp), %rdx
addq $0x260, %rdx            # imm = 0x260
callq 0x1150
movq 0x70(%rsp), %rdi
addq $0x260, %rdi            # imm = 0x260
leaq 0x20(%rsp), %rsi
movq 0x70(%rsp), %rdx
addq $0xb0, %rdx
callq 0x1080
movq 0x70(%rsp), %rdi
addq $0x250, %rdi            # imm = 0x250
movq 0x70(%rsp), %rsi
addq $0x250, %rsi            # imm = 0x250
movq 0x70(%rsp), %rdx
addq $0x160, %rdx            # imm = 0x160
callq 0x1040
leaq 0x10(%rsp), %rdi
leaq 0x20(%rsp), %rsi
movq 0x70(%rsp), %rdx
addq $0x250, %rdx            # imm = 0x250
callq 0x1150
leaq 0x10(%rsp), %rdi
leaq 0x30(%rsp), %rsi
leaq 0x10(%rsp), %rdx
callq 0x1150
movq 0x70(%rsp), %rax
movq 0x20(%rsp), %rcx
movq %rcx, 0x250(%rax)
movq 0x28(%rsp), %rcx
movq %rcx, 0x258(%rax)
movq 0x50(%rsp), %rdi
addq 0x48(%rsp), %rdi
leaq 0x10(%rsp), %rsi
movq 0x60(%rsp), %rdx
callq 0x1160
leaq 0x10(%rsp), %rdi
addq 0x60(%rsp), %rdi
movq 0x70(%rsp), %rsi
addq $0x270, %rsi            # imm = 0x270
movl $0x10, %edx
subq 0x60(%rsp), %rdx
callq 0x1140
movl %eax, 0xc(%rsp)
movq 0x70(%rsp), %rdi
addq $0x250, %rdi            # imm = 0x250
movq 0x70(%rsp), %rsi
addq $0x250, %rsi            # imm = 0x250
movq 0x70(%rsp), %rdx
addq $0x160, %rdx            # imm = 0x160
callq 0x1040
movq 0x70(%rsp), %rdi
addq $0x250, %rdi            # imm = 0x250
movq 0x70(%rsp), %rsi
addq $0x270, %rsi            # imm = 0x270
movq 0x70(%rsp), %rdx
addq $0x250, %rdx            # imm = 0x250
callq 0x1150
movq 0x70(%rsp), %rdi
addq $0x250, %rdi            # imm = 0x250
movq 0x70(%rsp), %rsi
addq $0x210, %rsi            # imm = 0x210
movq 0x70(%rsp), %rdx
addq $0x250, %rdx            # imm = 0x250
callq 0x1150
movq 0x70(%rsp), %rdi
addq $0x250, %rdi            # imm = 0x250
leaq 0x20(%rsp), %rsi
movq 0x70(%rsp), %rdx
callq 0x1130
movq 0x70(%rsp), %rdi
addq $0x260, %rdi            # imm = 0x260
movq 0x70(%rsp), %rsi
addq $0x260, %rsi            # imm = 0x260
movq 0x70(%rsp), %rdx
addq $0x1b0, %rdx            # imm = 0x1B0
callq 0x1040
leaq 0x20(%rsp), %rdi
movq 0x70(%rsp), %rsi
addq $0x260, %rsi            # imm = 0x260
leaq 0x20(%rsp), %rdx
callq 0x1150
leaq 0x20(%rsp), %rdi
movq 0x70(%rsp), %rsi
addq $0x210, %rsi            # imm = 0x210
leaq 0x20(%rsp), %rdx
callq 0x1150
leaq 0x20(%rsp), %rdi
movq 0x58(%rsp), %rsi
movl $0x10, %eax
subq 0x60(%rsp), %rax
addq %rax, %rsi
movq 0x60(%rsp), %rdx
callq 0x1140
movl %eax, 0x8(%rsp)
movl 0xc(%rsp), %eax
orl 0x8(%rsp), %eax
addq $0x78, %rsp
retq
nopw (%rax,%rax)