// File: DiplIngFrankGerlach[P]MST/./aes/aes.c
// Function: aes_encrypt_ccm
int aes_encrypt_ccm(const BYTE payload[], WORD payload_len, const BYTE assoc[], unsigned short assoc_len,
                    const BYTE nonce[], unsigned short nonce_len, BYTE out[], WORD *out_len,
                    WORD mac_len, const BYTE key_str[], int keysize)
{
	BYTE temp_iv[AES_BLOCK_SIZE], counter[AES_BLOCK_SIZE], mac[16], *buf;
	int end_of_buf, payload_len_store_size;
	WORD key[60];

	if (mac_len != 4 && mac_len != 6 && mac_len != 8 && mac_len != 10 &&
	   mac_len != 12 && mac_len != 14 && mac_len != 16)
		return(FALSE);

	if (nonce_len < 7 || nonce_len > 13)
		return(FALSE);

	if (assoc_len > 32768 /* = 2^15 */)
		return(FALSE);

	buf = (BYTE*)malloc(payload_len + assoc_len + 48 /*Round both payload and associated data up a block size and add an extra block.*/);
	if (! buf)
		return(FALSE);

	// Prepare the key for usage.
	aes_key_setup(key_str, key, keysize);

	// Format the first block of the formatted data.
	payload_len_store_size = AES_BLOCK_SIZE - 1 - nonce_len;
	ccm_prepare_first_format_blk(buf, assoc_len, payload_len, payload_len_store_size, mac_len, nonce, nonce_len);
	end_of_buf = AES_BLOCK_SIZE;

	// Format the Associated Data, aka, assoc[].
	ccm_format_assoc_data(buf, &end_of_buf, assoc, assoc_len);

	// Format the Payload, aka payload[].
	ccm_format_payload_data(buf, &end_of_buf, payload, payload_len);

	// Create the first counter block.
	ccm_prepare_first_ctr_blk(counter, nonce, nonce_len, payload_len_store_size);

	// Perform the CBC operation with an IV of zeros on the formatted buffer to calculate the MAC.
	memset(temp_iv, 0, AES_BLOCK_SIZE);
	aes_encrypt_cbc_mac(buf, end_of_buf, mac, key, keysize, temp_iv);

	// Copy the Payload and MAC to the output buffer.
	memcpy(out, payload, payload_len);
	memcpy(&out[payload_len], mac, mac_len);

	// Encrypt the Payload with CTR mode with a counter starting at 1.
	memcpy(temp_iv, counter, AES_BLOCK_SIZE);
	increment_iv(temp_iv, AES_BLOCK_SIZE - 1 - mac_len);   // Last argument is the byte size of the counting portion of the counter block. /*BUG?*/
	aes_encrypt_ctr(out, payload_len, out, key, keysize, temp_iv);

	// Encrypt the MAC with CTR mode with a counter starting at 0.
	aes_encrypt_ctr(&out[payload_len], mac_len, &out[payload_len], key, keysize, counter);

	free(buf);
	*out_len = payload_len + mac_len;

	return(TRUE);
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x180, %rsp            # imm = 0x180
movw %r9w, %ax
movl 0x30(%rbp), %r9d
movq 0x28(%rbp), %r9
movl 0x20(%rbp), %r9d
movq 0x18(%rbp), %r9
movq 0x10(%rbp), %r9
movq %rdi, -0x10(%rbp)
movl %esi, -0x14(%rbp)
movq %rdx, -0x20(%rbp)
movw %cx, -0x22(%rbp)
movq %r8, -0x30(%rbp)
movw %ax, -0x32(%rbp)
cmpl $0x4, 0x20(%rbp)
je 0x3270
cmpl $0x6, 0x20(%rbp)
je 0x3270
cmpl $0x8, 0x20(%rbp)
je 0x3270
cmpl $0xa, 0x20(%rbp)
je 0x3270
cmpl $0xc, 0x20(%rbp)
je 0x3270
cmpl $0xe, 0x20(%rbp)
je 0x3270
cmpl $0x10, 0x20(%rbp)
je 0x3270
movl $0x0, -0x4(%rbp)
jmp 0x343d
movzwl -0x32(%rbp), %eax
cmpl $0x7, %eax
jl 0x3282
movzwl -0x32(%rbp), %eax
cmpl $0xd, %eax
jle 0x328e
movl $0x0, -0x4(%rbp)
jmp 0x343d
movzwl -0x22(%rbp), %eax
cmpl $0x8000, %eax           # imm = 0x8000
jle 0x32a5
movl $0x0, -0x4(%rbp)
jmp 0x343d
movl -0x14(%rbp), %eax
movzwl -0x22(%rbp), %ecx
addl %ecx, %eax
addl $0x30, %eax
movl %eax, %eax
movl %eax, %edi
callq 0x2230
movq %rax, -0x78(%rbp)
cmpq $0x0, -0x78(%rbp)
jne 0x32d1
movl $0x0, -0x4(%rbp)
jmp 0x343d
movq 0x28(%rbp), %rdi
leaq -0x170(%rbp), %rsi
movl 0x30(%rbp), %edx
callq 0x3450
movzwl -0x32(%rbp), %ecx
movl $0xf, %eax
subl %ecx, %eax
movl %eax, -0x80(%rbp)
movq -0x78(%rbp), %rdi
movzwl -0x22(%rbp), %esi
movl -0x14(%rbp), %edx
movl -0x80(%rbp), %ecx
movl 0x20(%rbp), %r8d
movq -0x30(%rbp), %r9
movzwl -0x32(%rbp), %eax
movl %eax, (%rsp)
callq 0x3640
movl $0x10, -0x7c(%rbp)
movq -0x78(%rbp), %rdi
movq -0x20(%rbp), %rdx
movzwl -0x22(%rbp), %ecx
leaq -0x7c(%rbp), %rsi
callq 0x3700
movq -0x78(%rbp), %rdi
movq -0x10(%rbp), %rdx
movl -0x14(%rbp), %ecx
leaq -0x7c(%rbp), %rsi
callq 0x37d0
leaq -0x60(%rbp), %rdi
movq -0x30(%rbp), %rsi
movzwl -0x32(%rbp), %edx
movl -0x80(%rbp), %ecx
callq 0x3860
leaq -0x50(%rbp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x20c0
movq -0x78(%rbp), %rdi
movslq -0x7c(%rbp), %rsi
leaq -0x70(%rbp), %rdx
leaq -0x170(%rbp), %rcx
movl 0x30(%rbp), %r8d
leaq -0x50(%rbp), %r9
callq 0x2a20
movq 0x10(%rbp), %rdi
movq -0x10(%rbp), %rsi
movl -0x14(%rbp), %eax
movl %eax, %edx
callq 0x2130
movq 0x10(%rbp), %rdi
movl -0x14(%rbp), %eax
addq %rax, %rdi
leaq -0x70(%rbp), %rsi
movl 0x20(%rbp), %eax
movl %eax, %edx
callq 0x2130
movq -0x60(%rbp), %rax
movq %rax, -0x50(%rbp)
movq -0x58(%rbp), %rax
movq %rax, -0x48(%rbp)
leaq -0x50(%rbp), %rdi
movl $0xf, %esi
subl 0x20(%rbp), %esi
callq 0x3040
movq 0x10(%rbp), %rdi
movl -0x14(%rbp), %eax
movl %eax, %esi
movq 0x10(%rbp), %rdx
leaq -0x170(%rbp), %rcx
movl 0x30(%rbp), %r8d
leaq -0x50(%rbp), %r9
callq 0x30b0
movq 0x10(%rbp), %rdi
movl -0x14(%rbp), %eax
addq %rax, %rdi
movl 0x20(%rbp), %eax
movl %eax, %esi
movq 0x10(%rbp), %rdx
movl -0x14(%rbp), %eax
addq %rax, %rdx
leaq -0x170(%rbp), %rcx
movl 0x30(%rbp), %r8d
leaq -0x60(%rbp), %r9
callq 0x30b0
movq -0x78(%rbp), %rdi
callq 0x2200
movl -0x14(%rbp), %ecx
addl 0x20(%rbp), %ecx
movq 0x18(%rbp), %rax
movl %ecx, (%rax)
movl $0x1, -0x4(%rbp)
movl -0x4(%rbp), %eax
addq $0x180, %rsp            # imm = 0x180
popq %rbp
retq
nopl (%rax)