// File: /workspace/github_cpp_makefile_star2_O2/DiplIngFrankGerlach[P]MST/./aes/aes.c
// Function: aes_decrypt_ccm
int aes_decrypt_ccm(const BYTE ciphertext[], WORD ciphertext_len, const BYTE assoc[], unsigned short assoc_len,
                    const BYTE nonce[], unsigned short nonce_len, BYTE plaintext[], WORD *plaintext_len,
                    WORD mac_len, int *mac_auth, const BYTE key_str[], int keysize)
{
	BYTE temp_iv[AES_BLOCK_SIZE], counter[AES_BLOCK_SIZE], mac[16], mac_buf[16], *buf;
	int end_of_buf, plaintext_len_store_size;
	WORD key[60];

	if (ciphertext_len <= mac_len)
		return(FALSE);

	buf = (BYTE*)malloc(assoc_len + ciphertext_len /*ciphertext_len = plaintext_len + mac_len*/ + 48);
	if (! buf)
		return(FALSE);

	// Prepare the key for usage.
	aes_key_setup(key_str, key, keysize);

	// Copy the plaintext and MAC to the output buffers.
	*plaintext_len = ciphertext_len - mac_len;
	plaintext_len_store_size = AES_BLOCK_SIZE - 1 - nonce_len;
	memcpy(plaintext, ciphertext, *plaintext_len);
	memcpy(mac, &ciphertext[*plaintext_len], mac_len);

	// Prepare the first counter block for use in decryption.
	ccm_prepare_first_ctr_blk(counter, nonce, nonce_len, plaintext_len_store_size);

	// Decrypt the Payload with CTR mode with a counter starting at 1.
	memcpy(temp_iv, counter, AES_BLOCK_SIZE);
	increment_iv(temp_iv, AES_BLOCK_SIZE - 1 - mac_len);   // (AES_BLOCK_SIZE - 1 - mac_len) is the byte size of the counting portion of the counter block.
	aes_decrypt_ctr(plaintext, *plaintext_len, plaintext, key, keysize, temp_iv);

	// Setting mac_auth to NULL disables the authentication check.
	if (mac_auth != NULL) {
		// Decrypt the MAC with CTR mode with a counter starting at 0.
		aes_decrypt_ctr(mac, mac_len, mac, key, keysize, counter);

		// Format the first block of the formatted data.
		plaintext_len_store_size = AES_BLOCK_SIZE - 1 - nonce_len;
		ccm_prepare_first_format_blk(buf, assoc_len, *plaintext_len, plaintext_len_store_size, mac_len, nonce, nonce_len);
		end_of_buf = AES_BLOCK_SIZE;

		// Format the Associated Data into the authentication buffer.
		ccm_format_assoc_data(buf, &end_of_buf, assoc, assoc_len);

		// Format the Payload into the authentication buffer.
		ccm_format_payload_data(buf, &end_of_buf, plaintext, *plaintext_len);

		// Perform the CBC operation with an IV of zeros on the formatted buffer to calculate the MAC.
		memset(temp_iv, 0, AES_BLOCK_SIZE);
		aes_encrypt_cbc_mac(buf, end_of_buf, mac_buf, key, keysize, temp_iv);

		// Compare the calculated MAC against the MAC embedded in the ciphertext to see if they are the same.
		if (! memcmp(mac, mac_buf, mac_len)) {
			*mac_auth = TRUE;
		}
		else {
			*mac_auth = FALSE;
			memset(plaintext, 0, *plaintext_len);
		}
	}

	free(buf);

	return(TRUE);
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x178, %rsp            # imm = 0x178
xorl %r15d, %r15d
movl %esi, %r13d
subl 0x1c0(%rsp), %r13d
jbe 0x2947
movl %r9d, %r14d
movq %r8, %r12
movq %rdx, %rbx
movq %rdi, %rbp
movzwl %cx, %eax
movq %rax, 0x30(%rsp)
leal (%rsi,%rax), %edi
addl $0x30, %edi
callq 0x1150
testq %rax, %rax
je 0x2947
movq %rbx, 0x20(%rsp)
movl 0x1d8(%rsp), %edx
movq 0x1d0(%rsp), %rdi
movq %rax, 0x28(%rsp)
movq 0x1b8(%rsp), %rbx
leaq 0x80(%rsp), %rsi
callq 0x24af
movl %r13d, (%rbx)
movzwl %r14w, %ebx
pushq $0xf
popq %r14
movl %r14d, %r15d
subl %ebx, %r15d
movq 0x1b0(%rsp), %rdi
movq %rbp, %rsi
movq %r13, %rdx
callq 0x10e0
movq 0x1b8(%rsp), %rax
movl (%rax), %r13d
addq %r13, %rbp
movl 0x1c0(%rsp), %eax
movl %eax, %edx
leaq 0x40(%rsp), %rdi
movq %rbp, %rsi
movq %rdx, 0x8(%rsp)
callq 0x10e0
leaq 0x51(%rsp), %rbp
andq $0x0, (%rbp)
andq $0x0, 0x7(%rbp)
leal -0x1(%r15), %eax
andb $0x7, %al
movb %al, -0x1(%rbp)
movq %rbp, %rdi
movq %r12, 0x18(%rsp)
movq %r12, %rsi
movq 0x28(%rsp), %r12
movq %rbx, 0x10(%rsp)
movq %rbx, %rdx
callq 0x10e0
movaps -0x1(%rbp), %xmm0
leaq 0x60(%rsp), %rbp
movaps %xmm0, (%rbp)
subl 0x1c0(%rsp), %r14d
movq %rbp, %rdi
movl %r14d, %esi
callq 0x216d
movq 0x1b0(%rsp), %rdi
movq %r13, %rsi
movq %rdi, %rdx
leaq 0x80(%rsp), %rcx
movl 0x1d8(%rsp), %r8d
movl %r8d, %r14d
movq %rbp, %r9
callq 0x219d
cmpq $0x0, 0x1c8(%rsp)
je 0x293b
leaq 0x40(%rsp), %rdi
leaq 0x80(%rsp), %rcx
leaq 0x50(%rsp), %r9
movq 0x8(%rsp), %rsi
movq %rdi, %rdx
movl %r14d, %r8d
callq 0x219d
movq 0x1b8(%rsp), %rax
movl (%rax), %ebp
movq 0x10(%rsp), %rax
movl %eax, (%rsp)
movq %r12, %rdi
movq 0x30(%rsp), %r13
movl %r13d, %esi
movl %ebp, %edx
movl %r15d, %ecx
movl 0x1c0(%rsp), %r8d
movq 0x18(%rsp), %r9
callq 0x257e
pushq $0x10
popq %r14
leaq 0x3c(%rsp), %r15
movl %r14d, (%r15)
movq %r12, %rdi
movq %r15, %rsi
movq 0x20(%rsp), %rdx
movl %r13d, %ecx
callq 0x25e5
movslq (%r15), %r15
leaq (%r12,%r15), %rdi
movq %r12, %rbx
movslq %ebp, %r12
movq 0x1b0(%rsp), %rsi
movq %r12, %rdx
callq 0x10e0
addq %r12, %r15
movq %rbx, %r12
movl %r15d, %eax
cltd
idivl %r14d
subl %edx, %r14d
testl %edx, %edx
cmovel %edx, %r14d
movq %r15, %rdi
addq %rbx, %rdi
xorl %esi, %esi
movq %r14, %rdx
callq 0x1090
addl %r15d, %r14d
xorps %xmm0, %xmm0
leaq 0x60(%rsp), %r9
movaps %xmm0, (%r9)
movslq %r14d, %rsi
leaq 0x70(%rsp), %r14
movq %rbx, %rdi
movq %r14, %rdx
leaq 0x80(%rsp), %rcx
movl 0x1d8(%rsp), %r8d
callq 0x19f6
leaq 0x40(%rsp), %rdi
movq %r14, %rsi
movq 0x8(%rsp), %rdx
callq 0x1110
testl %eax, %eax
je 0x292d
movq 0x1c8(%rsp), %rax
andl $0x0, (%rax)
movq 0x1b8(%rsp), %rax
movl (%rax), %edx
movq 0x1b0(%rsp), %rdi
xorl %esi, %esi
callq 0x1090
jmp 0x293b
movq 0x1c8(%rsp), %rax
movl $0x1, (%rax)
movq %r12, %rdi
callq 0x1130
pushq $0x1
popq %r15
movl %r15d, %eax
addq $0x178, %rsp            # imm = 0x178
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq