Review and fix the code below. It is giving an error when decrypting:

unit Main;

interface

uses
  Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
  Vcl.Controls, Vcl.Forms, Vcl.Dialogs, ORM_Utils, Vcl.StdCtrls;

type
  TMainForm = class(TForm)
    Memo1: TMemo;
    ORM_Test1: TButton;
    ORM_Test2: TButton;
    procedure ORM_Test2Click(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

var
  MainForm: TMainForm;

implementation

Uses  DECHash, DECCipherBase, DECHashBase, DECCiphers, DECUtil, DECFormat, DECRandom, DECHashAuthentication, DECCipherModes, DECCipherFormats, System.NetEncoding,  System.Hash;

{$R *.dfm}

// HexToBytes Function
function HexToBytes(const Hex: string): TBytes;
var
  I: Integer;
  ByteValue: Byte;
  Temp: string;
  ByteInt: Integer;
begin
  if Length(Hex) mod 2 <> 0 then
    raise Exception.Create('Invalid hex string length');

  SetLength(Result, Length(Hex) div 2);

  for I := 0 to Length(Result) - 1 do
  begin
    // Extract two characters from the hex string
    Temp := Copy(Hex, 2 * I + 1, 2);

    // Attempt to convert the hex substring to an integer
    if not TryStrToInt('$' + Temp, ByteInt) then
      raise Exception.CreateFmt('Invalid hex character at position %d', [2 * I + 1]);

    // Ensure the integer is within the byte range
    if (ByteInt < 0) or (ByteInt > 255) then
      raise Exception.CreateFmt('Hex value out of byte range at position %d', [2 * I + 1]);

    // Assign the byte value
    ByteValue := Byte(ByteInt);
    Result[I] := ByteValue;
  end;
end;

// Base64ToBytes and BytesToBase64 Functions
function BytesToBase64(const Bytes: TBytes): string;
begin
  Result := TNetEncoding.Base64.EncodeBytesToString(Bytes);
end;

function Base64ToBytes(const Base64: string): TBytes;
begin
  Result := TNetEncoding.Base64.DecodeStringToBytes(Base64);
end;

function ComputeHMACSHA256(const Key, Data: TBytes): TBytes;
begin
  Result := THashSHA2.GetHMACAsBytes(Data, Key, SHA256);
end;

// During Encryption
function EncryptStringWithMAC(const SourceText, Password: string): string;
var
  Cipher: TCipher_Rijndael;
  CipherKeyBytes: TBytes;
  KeyKDF: TBytes;
  IVBytes: TBytes;
  Input, Ciphertext, SeedBytes, CombinedOutput, MAC: TBytes;
  EncryptedBase64: string;
begin
  Cipher := TCipher_Rijndael.Create;
  try
    // ... [Same as EncryptString]

    // Encrypt the input bytes
    Ciphertext := Cipher.EncodeBytes(Input);

    // Combine SeedBytes, IVBytes, and Ciphertext
    SetLength(CombinedOutput, Length(SeedBytes) + Length(IVBytes) + Length(Ciphertext));
    Move(SeedBytes[0], CombinedOutput[0], Length(SeedBytes));
    Move(IVBytes[0], CombinedOutput[Length(SeedBytes)], Length(IVBytes));
    Move(Ciphertext[0], CombinedOutput[Length(SeedBytes) + Length(IVBytes)], Length(Ciphertext));

    // Compute MAC over SeedBytes + IVBytes + Ciphertext
    MAC := ComputeHMACSHA256(KeyKDF, CombinedOutput);

    // Combine SeedBytes, IVBytes, Ciphertext, and MAC
    SetLength(CombinedOutput, Length(CombinedOutput) + Length(MAC));
    Move(MAC[0], CombinedOutput[Length(CombinedOutput) - Length(MAC)], Length(MAC));

    // Encode to Base64
    EncryptedBase64 := BytesToBase64(CombinedOutput);

    Result := EncryptedBase64;

    // Clean up cipher
    Cipher.Done;
  finally
    Cipher.Free;
  end;
end;

// During Decryption
function DecryptStringWithMAC(const EncryptedBase64: string; const Password: string): string;
var
  Cipher: TCipher_Rijndael;
  CipherKeyBytes: TBytes;
  KeyKDF: TBytes;
  IVBytes: TBytes;
  CombinedBytes, SeedBytes, CipherBytes, MAC, ComputedMAC, PlainBytes: TBytes;
  DecryptedText: string;
begin
  Cipher := TCipher_Rijndael.Create;
  try
    // Decode Base64
    CombinedBytes := Base64ToBytes(EncryptedBase64);

    // Ensure minimum length for SeedBytes, IVBytes, and MAC (16 + 16 + 32 for HMACSHA256)
    if Length(CombinedBytes) < 64 then // Adjust based on MAC length
      raise Exception.Create('Invalid encrypted data: insufficient length for SeedBytes, IVBytes, and MAC');

    // Extract SeedBytes, IVBytes, CipherBytes, and MAC
    SetLength(SeedBytes, 16);
    Move(CombinedBytes[0], SeedBytes[0], 16);

    SetLength(IVBytes, 16);
    Move(CombinedBytes[16], IVBytes[0], 16);

    SetLength(CipherBytes, Length(CombinedBytes) - 16 - 16 - 32); // Adjust based on HMAC length
    Move(CombinedBytes[32], CipherBytes[0], Length(CipherBytes));

    SetLength(MAC, 32); // HMACSHA256 produces a 32-byte MAC
    Move(CombinedBytes[32 + Length(CipherBytes)], MAC[0], 32);

    // Set cipher mode
    Cipher.Mode := cmCBCx;

    // Convert password to bytes
    CipherKeyBytes := TEncoding.UTF8.GetBytes(Password);

    // Derive key
    KeyKDF := THash_Whirlpool0.KDFx(
      CipherKeyBytes[0],
      Length(CipherKeyBytes),
      SeedBytes[0],
      Length(SeedBytes),
      8
    );

    // Initialize cipher
    Cipher.Init(RawByteString(KeyKDF), RawByteString(IVBytes), 0);

    // Compute MAC over SeedBytes + IVBytes + CipherBytes
    ComputedMAC := ComputeHMACSHA256(KeyKDF, Copy(CombinedBytes, 0, 32 + Length(CipherBytes))); // Adjust indices

    // Compare MACs
    if not CompareMem(@MAC[0], @ComputedMAC[0], Length(MAC)) then
      raise Exception.Create('MAC verification failed: data integrity compromised.');

    // Decrypt
    PlainBytes := Cipher.DecodeBytes(CipherBytes);

    // Convert bytes to string
    try
      DecryptedText := TEncoding.UTF8.GetString(PlainBytes);
    except
      on E: Exception do
        raise Exception.Create('Decryption succeeded, but the decrypted data is not valid UTF-8: ' + E.Message);
    end;

    Result := DecryptedText;

    // Clean up cipher
    Cipher.Done;
  finally
    Cipher.Free;
  end;
end;

procedure TMainForm.ORM_Test2Click(Sender: TObject);
begin
 var encstring:= EncryptStringWithMAC('aBcé','#$GetIntoH^&%$');
 inputbox('','',encstring);
 var decstring:= DecryptStringWithMAC(encstring,'#$GetIntoH^&%$');

 showmessage(encstring+#13+decstring);
end;

initialization

RandomSeed; // Initialize cryptographically secure random number generator in DECRandom.pas with random seed

finalization

end.