// File: occivink[P]pyct/monocypher.cpp
// Function: crypto_chacha20_ctr
u64 crypto_chacha20_ctr(u8 *cipher_text, const u8 *plain_text,
                        size_t text_size, const u8 key[32], const u8 nonce[8],
                        u64 ctr)
{
    u32 input[16];
    load32_le_buf(input     , chacha20_constant, 4);
    load32_le_buf(input +  4, key              , 8);
    load32_le_buf(input + 14, nonce            , 2);
    input[12] = (u32) ctr;
    input[13] = (u32)(ctr >> 32);

    // Whole blocks
    u32    pool[16];
    size_t nb_blocks = text_size >> 6;
    FOR (i, 0, nb_blocks) {
        chacha20_rounds(pool, input);
        if (plain_text != 0) {
            FOR (j, 0, 16) {
                u32 p = pool[j] + input[j];
                store32_le(cipher_text, p ^ load32_le(plain_text));
                cipher_text += 4;
                plain_text  += 4;
            }
        } else {
            FOR (j, 0, 16) {
                u32 p = pool[j] + input[j];
                store32_le(cipher_text, p);
                cipher_text += 4;
            }
        }
        input[12]++;
        if (input[12] == 0) {
            input[13]++;
        }
    }
    text_size &= 63;

    // Last (incomplete) block
    if (text_size > 0) {
        if (plain_text == 0) {
            plain_text = zero;
        }
        chacha20_rounds(pool, input);
        u8 tmp[64];
        FOR (i, 0, 16) {
            store32_le(tmp + i*4, pool[i] + input[i]);
        }
        FOR (i, 0, text_size) {
            cipher_text[i] = tmp[i] ^ plain_text[i];
        }
        WIPE_BUFFER(tmp);
    }
    ctr = input[12] + ((u64)input[13] << 32) + (text_size > 0);

    WIPE_BUFFER(pool);
    WIPE_BUFFER(input);
    return ctr;
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x140, %rsp            # imm = 0x140
movq %rdi, -0x8(%rbp)
movq %rsi, -0x10(%rbp)
movq %rdx, -0x18(%rbp)
movq %rcx, -0x20(%rbp)
movq %r8, -0x28(%rbp)
movq %r9, -0x30(%rbp)
leaq -0x70(%rbp), %rdi
movq 0x2034a(%rip), %rsi     # 0x242c8
movl $0x4, %edx
callq 0x3990
leaq -0x70(%rbp), %rdi
addq $0x10, %rdi
movq -0x20(%rbp), %rsi
movl $0x8, %edx
callq 0x3990
leaq -0x70(%rbp), %rdi
addq $0x38, %rdi
movq -0x28(%rbp), %rsi
movl $0x2, %edx
callq 0x3990
movq -0x30(%rbp), %rax
movl %eax, -0x40(%rbp)
movq -0x30(%rbp), %rax
shrq $0x20, %rax
movl %eax, -0x3c(%rbp)
movq -0x18(%rbp), %rax
shrq $0x6, %rax
movq %rax, -0xb8(%rbp)
movq $0x0, -0xc0(%rbp)
movq -0xc0(%rbp), %rax
cmpq -0xb8(%rbp), %rax
jae 0x4142
leaq -0xb0(%rbp), %rdi
leaq -0x70(%rbp), %rsi
callq 0x39f0
cmpq $0x0, -0x10(%rbp)
je 0x40ac
movq $0x0, -0xc8(%rbp)
cmpq $0x10, -0xc8(%rbp)
jae 0x40aa
movq -0xc8(%rbp), %rax
movl -0xb0(%rbp,%rax,4), %eax
movq -0xc8(%rbp), %rcx
addl -0x70(%rbp,%rcx,4), %eax
movl %eax, -0xcc(%rbp)
movq -0x8(%rbp), %rax
movq %rax, -0x138(%rbp)
movl -0xcc(%rbp), %eax
movl %eax, -0x13c(%rbp)
movq -0x10(%rbp), %rdi
callq 0x4300
movl -0x13c(%rbp), %esi
movq -0x138(%rbp), %rdi
xorl %eax, %esi
callq 0x42a0
movq -0x8(%rbp), %rax
addq $0x4, %rax
movq %rax, -0x8(%rbp)
movq -0x10(%rbp), %rax
addq $0x4, %rax
movq %rax, -0x10(%rbp)
movq -0xc8(%rbp), %rax
addq $0x1, %rax
movq %rax, -0xc8(%rbp)
jmp 0x401a
jmp 0x4111
movq $0x0, -0xd8(%rbp)
cmpq $0x10, -0xd8(%rbp)
jae 0x410f
movq -0xd8(%rbp), %rax
movl -0xb0(%rbp,%rax,4), %eax
movq -0xd8(%rbp), %rcx
addl -0x70(%rbp,%rcx,4), %eax
movl %eax, -0xdc(%rbp)
movq -0x8(%rbp), %rdi
movl -0xdc(%rbp), %esi
callq 0x42a0
movq -0x8(%rbp), %rax
addq $0x4, %rax
movq %rax, -0x8(%rbp)
movq -0xd8(%rbp), %rax
addq $0x1, %rax
movq %rax, -0xd8(%rbp)
jmp 0x40b7
jmp 0x4111
movl -0x40(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x40(%rbp)
cmpl $0x0, -0x40(%rbp)
jne 0x4129
movl -0x3c(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x3c(%rbp)
jmp 0x412b
movq -0xc0(%rbp), %rax
addq $0x1, %rax
movq %rax, -0xc0(%rbp)
jmp 0x3fe0
movq -0x18(%rbp), %rax
andq $0x3f, %rax
movq %rax, -0x18(%rbp)
cmpq $0x0, -0x18(%rbp)
jbe 0x4244
cmpq $0x0, -0x10(%rbp)
jne 0x416b
leaq 0x17eb9(%rip), %rax     # 0x1c020
movq %rax, -0x10(%rbp)
leaq -0xb0(%rbp), %rdi
leaq -0x70(%rbp), %rsi
callq 0x39f0
movq $0x0, -0x128(%rbp)
cmpq $0x10, -0x128(%rbp)
jae 0x41d7
leaq -0x120(%rbp), %rdi
movq -0x128(%rbp), %rax
shlq $0x2, %rax
addq %rax, %rdi
movq -0x128(%rbp), %rax
movl -0xb0(%rbp,%rax,4), %esi
movq -0x128(%rbp), %rax
addl -0x70(%rbp,%rax,4), %esi
callq 0x42a0
movq -0x128(%rbp), %rax
addq $0x1, %rax
movq %rax, -0x128(%rbp)
jmp 0x4186
movq $0x0, -0x130(%rbp)
movq -0x130(%rbp), %rax
cmpq -0x18(%rbp), %rax
jae 0x4233
movq -0x130(%rbp), %rax
movzbl -0x120(%rbp,%rax), %eax
movq -0x10(%rbp), %rcx
movq -0x130(%rbp), %rdx
movzbl (%rcx,%rdx), %ecx
xorl %ecx, %eax
movb %al, %dl
movq -0x8(%rbp), %rax
movq -0x130(%rbp), %rcx
movb %dl, (%rax,%rcx)
movq -0x130(%rbp), %rax
addq $0x1, %rax
movq %rax, -0x130(%rbp)
jmp 0x41e2
leaq -0x120(%rbp), %rdi
movl $0x40, %esi
callq 0x3890
movl -0x40(%rbp), %eax
movl -0x3c(%rbp), %ecx
shlq $0x20, %rcx
addq %rcx, %rax
cmpq $0x0, -0x18(%rbp)
seta %cl
andb $0x1, %cl
movzbl %cl, %ecx
addq %rcx, %rax
movq %rax, -0x30(%rbp)
leaq -0xb0(%rbp), %rdi
movl $0x40, %esi
callq 0x3890
leaq -0x70(%rbp), %rdi
movl $0x40, %esi
callq 0x3890
movq -0x30(%rbp), %rax
addq $0x140, %rsp            # imm = 0x140
popq %rbp
retq
nopw %cs:(%rax,%rax)