// File: /workspace/github_c_makefile_star2_O1/mjosaarinen[P]brutus/crypto_aead/primatesv1hanuman80/ref/encrypt.cpp
// Function: crypto_aead_decrypt
int crypto_aead_decrypt(
    unsigned char *m,unsigned long long *mlen,
    unsigned char *nsec,
    const unsigned char *c,unsigned long long clen,
    const unsigned char *ad,unsigned long long adlen,
    const unsigned char *npub,
    const unsigned char *k
)
{
	/*
    ... generating a plaintext m[0],m[1],...,m[*mlen-1]
    ... and secret message number nsec[0],nsec[1],...
    ... from a ciphertext c[0],c[1],...,c[clen-1]
    ... and associated data ad[0],ad[1],...,ad[adlen-1]
    ... and public message number npub[0],npub[1],...
    ... and secret key k[0],k[1],...
    ...
	*/
	unsigned char V[StateSize]; //the state represented in Elements
	//Temp variables represented as elements
	unsigned char key[KeySizeElements];
	unsigned char nonce[NonceSizeElements];
	unsigned char tag[TagSizeElements];
	unsigned char data[RateSizeElements];
	unsigned char cipher[RateSizeElements];
	
	*mlen=clen-TagSizeBytes;
	
	if(clen<TagSizeBytes) return -1; //invalid ciphertext
   
	//a temporary array for message
	unsigned char *mT = (unsigned char*) malloc(clen-TagSizeBytes);
    if (mT == NULL) return -2; // memory allocation failure
	
	Bytes2Element(key,k,0,KeySizeElements); //representing k as elements
	Bytes2Element(nonce,npub,0,NonceSizeElements); //representing npub as elements

	// V <-- p_1(O||K||N)
	InitializeState(V,key,nonce);
	p_1(V); 
	
	if(adlen!=0)
	{ 
		// for i=1 to u-1
		if(adlen>RateSizeBytes)
		{
			for(unsigned long long i=0; i<adlen-RateSizeBytes; i=i+RateSizeBytes)
			{
				Bytes2Element(data,ad,i,RateSizeElements); // representing a block of ad as elements
				// V <-- p_4 (A[i]^V_r || V_c)
				for(int j=0; j<RateSizeElements; j++)
					V[j]^=data[j];
				p_4(V);
			}
		}
		// V <-- A[u]^v_r || V_c
		int l = adlen%RateSizeBytes;
		if(l==0){ //do padding with spill over			
			Bytes2Element(data,ad,adlen-RateSizeBytes,RateSizeElements);
			for(int i=0; i<RateSizeElements; i++)
				V[i]^=data[i];
			V[RateSizeElements]^=16; //padding spills over to capacity
		}
		else{ //do standard padding
			unsigned char dataP[RateSizeBytes];
			for(int i=0; i< l; i++)
				dataP[i]=ad[adlen-l+i];
			dataP[l]=128; //padding over bytes
			for(int i=l+1; i<RateSizeBytes; i++)
				dataP[i]=0;
			Bytes2Element(data,dataP,0,RateSizeElements);
			for(int i=0; i<RateSizeElements; i++)
				V[i]^=data[i];
		}
		// V <-- p_1(V)
		p_1(V);	
	}

	//for i=1 to w-1 (except the last block which needs padding)
	if(clen-TagSizeBytes>RateSizeBytes)
	{
		for(unsigned long long i=0; i<clen-(TagSizeBytes+RateSizeBytes); i=i+RateSizeBytes)
		{ 
			Bytes2Element(cipher,c,i,RateSizeElements); //representing a block of c as elements
			// M[i] <-- C[i]^V_r
			for(int j=0; j<RateSizeElements; j++)
				data[j]=V[j]^cipher[j];
			Element2Bytes(mT,data,i,RateSizeBytes); //representing m as bytes
			//V <-- p_1 (C[i] || V_c)
			for(int j=0; j<RateSizeElements; j++)
				V[j]=cipher[j];
			p_1(V);
		}
	}
	//for i=w
	int l = clen%RateSizeBytes;
	// M[w] <-- C[w]^V_r
	// V <-- M[w]||10* ^ V
	if((l==0) && ((clen-TagSizeBytes)!=0)){ //do padding with spill over			
		Bytes2Element(cipher,c,clen-(TagSizeBytes+RateSizeBytes),RateSizeElements);
		for(int i=0; i<RateSizeElements; i++){
			data[i]=V[i]^cipher[i];
			V[i]=cipher[i];
		}
		Element2Bytes(mT,data,clen-(TagSizeBytes+RateSizeBytes),RateSizeBytes); //representing last block m as bytes
		V[RateSizeElements]^=16; //padding spills over to capacity
	}
	else{ //do standard padding
		unsigned char cipherP[RateSizeElements];
		unsigned char mtmp[RateSizeBytes];
		for(int i=0; i< RateSizeElements; i++)
			cipherP[i]=V[i];
		Element2Bytes(mtmp,cipherP,0,RateSizeBytes);
		for(int i=0; i< l; i++)
			mT[clen-TagSizeBytes-l+i]=mtmp[i]^c[clen-TagSizeBytes-l+i];		
		unsigned char dataP[RateSizeBytes];
		for(int i=0; i< l; i++)
			dataP[i]=mT[clen-TagSizeBytes-l+i];
		dataP[l]=128; //padding over bytes
		for(int i=l+1; i<RateSizeBytes; i++)
			dataP[i]=0;
		Bytes2Element(data,dataP,0,RateSizeElements);
		for(int i=0; i<RateSizeElements; i++)
			V[i]^=data[i];
	}
	//V <-- p_1 (V)
	p_1(V);

	// T <-- (V_c)_c/2 ^ K
	for(int i=0; i<TagSizeElements; i++)
		tag[i]=V[RateSizeElements+i]^key[i]; 
	unsigned char tagT[TagSizeBytes];
	Element2Bytes(tagT,tag,0,TagSizeBytes) ;

	unsigned char cor=0;
	for(int i=0; i<TagSizeBytes; i++) //check if tags match
		cor = cor || (tagT[i]^c[clen-TagSizeBytes+i]);

	if(cor==0) //if tags match release the message
		for(unsigned long long i=0; i<clen-TagSizeBytes; i++)
			m[i]=mT[i];

	free(mT);
    if(cor==0) return 0;
	else return -1;
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0xb8, %rsp
movq %r8, %rbx
movq %r8, 0x80(%rsp)
movl $0xffffffff, %eax       # imm = 0xFFFFFFFF
subq $0xa, %rbx
movq %rbx, (%rsi)
jb 0x1b12
movq %r9, %rbp
movq %rcx, %r12
movq %rdi, %r14
movq %rbx, %rdi
callq 0x10b0
testq %rax, %rax
je 0x1769
movq %rax, 0x10(%rsp)
movq %r14, 0x88(%rsp)
movq %rbx, 0x78(%rsp)
movq 0x100(%rsp), %rsi
movq 0xf8(%rsp), %rbx
movq 0xf0(%rsp), %r14
leaq 0x90(%rsp), %r15
movq %r15, %rdi
xorl %edx, %edx
movl $0x10, %ecx
callq 0x1140
leaq 0xa0(%rsp), %r13
movq %r13, %rdi
movq %rbx, %rsi
xorl %edx, %edx
movl $0x10, %ecx
callq 0x1140
leaq 0x20(%rsp), %rbx
movq %rbx, %rdi
movq %r15, %rsi
movq %r13, %rdx
callq 0x10e0
movq %rbx, %rdi
callq 0x1080
testq %r14, %r14
je 0x17a4
cmpq $0x6, %r14
jb 0x16d7
movq 0xf0(%rsp), %r14
addq $-0x5, %r14
je 0x16d7
xorl %r15d, %r15d
movq %rsp, %r13
leaq 0x20(%rsp), %rbx
movq %r13, %rdi
movq %rbp, %rsi
movq %r15, %rdx
movl $0x8, %ecx
callq 0x1140
movq (%rsp), %rax
xorq %rax, 0x20(%rsp)
movq %rbx, %rdi
callq 0x1060
addq $0x5, %r15
cmpq %r14, %r15
jb 0x16aa
movq 0xf0(%rsp), %r15
movq %r15, %rdx
movabsq $-0x3333333333333333, %rax # imm = 0xCCCCCCCCCCCCCCCD
mulxq %rax, %r14, %r14
shrq $0x2, %r14
leaq (%r14,%r14,4), %rax
movq %r15, %rbx
subq %rax, %rbx
je 0x1773
movq %r15, %rax
subq %rbx, %rax
addq %rax, %rbp
leaq 0x60(%rsp), %rdi
movq %rbp, %rsi
movq %rbx, %rdx
callq 0x1150
movb $-0x80, 0x60(%rsp,%rbx)
cmpq $0x3, %rbx
ja 0x1748
leal (%r14,%r14,4), %edx
movl %r15d, %eax
subl %edx, %eax
incl %eax
leaq (%rsp,%rax), %rdi
addq $0x60, %rdi
subl %r15d, %edx
addl $0x3, %edx
incq %rdx
xorl %esi, %esi
callq 0x1040
movq %rsp, %rbx
leaq 0x60(%rsp), %rsi
movq %rbx, %rdi
xorl %edx, %edx
movl $0x8, %ecx
callq 0x1140
movq (%rbx), %rax
xorq %rax, 0x20(%rsp)
jmp 0x179a
movl $0xfffffffe, %eax       # imm = 0xFFFFFFFE
jmp 0x1b12
addq $-0x5, %r15
movq %rsp, %rbx
movq %rbx, %rdi
movq %rbp, %rsi
movq %r15, %rdx
movl $0x8, %ecx
callq 0x1140
movq (%rbx), %rax
xorq %rax, 0x20(%rsp)
xorb $0x10, 0x28(%rsp)
leaq 0x20(%rsp), %rdi
callq 0x1080
cmpq $0x6, 0x78(%rsp)
movq 0x10(%rsp), %rbp
jb 0x181b
movq 0x80(%rsp), %rbx
addq $-0xf, %rbx
je 0x181b
xorl %r14d, %r14d
movq %rsp, %r13
leaq 0x20(%rsp), %r15
leaq 0x18(%rsp), %rdi
movq %r12, %rsi
movq %r14, %rdx
movl $0x8, %ecx
callq 0x1140
movq 0x18(%rsp), %rax
xorq 0x20(%rsp), %rax
movq %rax, (%rsp)
movq %rbp, %rdi
movq %r13, %rsi
movq %r14, %rdx
movl $0x5, %ecx
callq 0x10a0
movq 0x18(%rsp), %rax
movq %rax, 0x20(%rsp)
movq %r15, %rdi
callq 0x1080
addq $0x5, %r14
cmpq %rbx, %r14
jb 0x17ca
movq 0x80(%rsp), %rbp
movq %rbp, %rdx
movabsq $-0x3333333333333333, %rax # imm = 0xCCCCCCCCCCCCCCCD
mulxq %rax, %rbx, %rbx
shrq $0x2, %rbx
leaq (%rbx,%rbx,4), %rax
movq %rbp, %r14
subq %rax, %r14
setne %al
movq 0x78(%rsp), %r15
testq %r15, %r15
sete %cl
orb %al, %cl
je 0x1a46
movq 0x20(%rsp), %rax
leaq 0x60(%rsp), %rsi
movq %rax, (%rsi)
leaq 0x56(%rsp), %rdi
xorl %edx, %edx
movl $0x5, %ecx
callq 0x10a0
testq %r14, %r14
movq 0x10(%rsp), %r13
je 0x19d2
cmpl $0x1, %r14d
movl %r14d, %eax
adcl $0x0, %eax
leaq -0x1(%rax), %rcx
addl $0x1f, %eax
andl $0x20, %eax
vpbroadcastq %rcx, %ymm0
movq %rbp, %rdx
movabsq $-0x3333333333333333, %rcx # imm = 0xCCCCCCCCCCCCCCCD
mulxq %rcx, %rcx, %rcx
shrq $0x2, %rcx
leaq (%rcx,%rcx,4), %rdx
leaq (%rdx,%r13), %rcx
addq $-0xa, %rcx
addq %r12, %rdx
addq $-0xa, %rdx
xorl %esi, %esi
vpmovsxbq 0x182d(%rip), %ymm1 # 0x3100
vpmovsxbq 0x1828(%rip), %ymm2 # 0x3104
vpmovsxbq 0x1823(%rip), %ymm3 # 0x3108
vpmovsxbq 0x181e(%rip), %ymm4 # 0x310c
vpmovsxbq 0x1819(%rip), %ymm5 # 0x3110
vpmovsxbq 0x1814(%rip), %ymm6 # 0x3114
vpmovsxbq 0x180f(%rip), %ymm7 # 0x3118
vpmovsxbq 0x180a(%rip), %ymm8 # 0x311c
vpbroadcastq %rsi, %ymm9
vpor %ymm1, %ymm9, %ymm10
vpor %ymm2, %ymm9, %ymm11
vpor %ymm3, %ymm9, %ymm12
vpor %ymm4, %ymm9, %ymm13
vpor %ymm5, %ymm9, %ymm14
vpor %ymm6, %ymm9, %ymm15
vporq %ymm7, %ymm9, %ymm16
vpor %ymm8, %ymm9, %ymm9
vpcmpleuq %ymm0, %ymm9, %k0
vpcmpleuq %ymm0, %ymm16, %k1
kshiftlb $0x4, %k1, %k1
korb %k1, %k0, %k0
vpcmpleuq %ymm0, %ymm15, %k1
vpcmpleuq %ymm0, %ymm14, %k2
kshiftlb $0x4, %k2, %k2
korb %k2, %k1, %k1
kunpckbw %k0, %k1, %k0
vpcmpleuq %ymm0, %ymm13, %k1
vpcmpleuq %ymm0, %ymm12, %k2
kshiftlb $0x4, %k2, %k2
korb %k2, %k1, %k1
vpcmpleuq %ymm0, %ymm11, %k2
vpcmpleuq %ymm0, %ymm10, %k3
kshiftlb $0x4, %k3, %k3
korb %k3, %k2, %k2
kunpckbw %k1, %k2, %k1
kunpckwd %k0, %k1, %k1
vmovdqu8 0x56(%rsp,%rsi), %ymm9 {%k1} {z}
vmovdqu8 (%rdx,%rsi), %ymm10 {%k1} {z}
vpxor %ymm9, %ymm10, %ymm9
vmovdqu8 %ymm9, (%rcx,%rsi) {%k1}
addq $0x20, %rsi
cmpq %rsi, %rax
jne 0x1912
testq %r14, %r14
je 0x19f3
movq %r15, %rax
subq %r14, %rax
movq %r13, %rsi
addq %rax, %rsi
leaq 0xb(%rsp), %rdi
movq %r14, %rdx
vzeroupper
callq 0x1150
movb $-0x80, 0xb(%rsp,%r14)
cmpq $0x3, %r14
ja 0x1a22
leal (%rbx,%rbx,4), %edx
movl %ebp, %eax
subl %edx, %eax
incl %eax
leaq (%rsp,%rax), %rdi
addq $0xb, %rdi
subl %ebp, %edx
addl $0x3, %edx
incq %rdx
xorl %esi, %esi
vzeroupper
callq 0x1040
movq %rsp, %rbx
leaq 0xb(%rsp), %rsi
movq %rbx, %rdi
xorl %edx, %edx
movl $0x8, %ecx
vzeroupper
callq 0x1140
movq (%rbx), %rax
xorq %rax, 0x20(%rsp)
jmp 0x1a92
leaq -0xf(%rbp), %rbx
leaq 0x18(%rsp), %r14
movq %r14, %rdi
movq %r12, %rsi
movq %rbx, %rdx
movl $0x8, %ecx
callq 0x1140
movq (%r14), %rax
movq 0x20(%rsp), %rcx
xorq %rax, %rcx
movq %rsp, %rsi
movq %rcx, (%rsi)
movq %rax, 0x20(%rsp)
movq 0x10(%rsp), %r13
movq %r13, %rdi
movq %rbx, %rdx
movl $0x5, %ecx
callq 0x10a0
xorb $0x10, 0x28(%rsp)
leaq 0x20(%rsp), %rbx
movq %rbx, %rdi
callq 0x1080
vmovaps 0x90(%rsp), %xmm0
vxorps 0x8(%rbx), %xmm0, %xmm0
leaq 0x60(%rsp), %rsi
vmovaps %xmm0, (%rsi)
xorl %ebx, %ebx
leaq 0x56(%rsp), %rdi
xorl %edx, %edx
movl $0xa, %ecx
callq 0x10a0
addq %rbp, %r12
movq $-0xa, %rax
testb %bl, %bl
movb $0x1, %bl
jne 0x1ae4
movb 0x60(%rsp,%rax), %cl
cmpb (%r12,%rax), %cl
setne %bl
incq %rax
jne 0x1ad3
testq %r15, %r15
je 0x1b05
testb %bl, %bl
jne 0x1b05
movq 0x88(%rsp), %rdi
movq %r13, %rsi
movq %r15, %rdx
callq 0x1150
movq %r13, %rdi
callq 0x10f0
movzbl %bl, %eax
negl %eax
addq $0xb8, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq