#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ aes256ctr(unsigned char *, unsigned char *,
                             unsigned long long, unsigned char *,
                             unsigned char *);
int /*<<< orphan*/ aescrypt(unsigned char *, unsigned char *, unsigned int *);
int /*<<< orphan*/ aeskey(unsigned int *, unsigned char *);
int /*<<< orphan*/ bzero(unsigned char *, int);
int /*<<< orphan*/ crypto_ghash(unsigned char *, unsigned char *,
                                unsigned long long, unsigned char *,
                                unsigned char *);
int /*<<< orphan*/ memcpy(unsigned char *, unsigned char *, int);
scalar_t__ verify16(unsigned char *, unsigned char *);
extern int aes256gcmdecrypt(unsigned char *m, unsigned char *c,
                            unsigned long long clen, unsigned char *nonce,
                            unsigned char *key) {
  unsigned char zeros[16];
  unsigned char h[16];
  unsigned int space[60];
  unsigned char j0[16];
  unsigned char tagkey[16];
  unsigned char tag[16];
  if (clen < 16)
    return -1;
  bzero(zeros, 16);
  memcpy(j0, nonce, 12);
  j0[12] = 0;
  j0[13] = 0;
  j0[14] = 0;
  j0[15] = 1;
  aeskey(space, key);
  aescrypt(h, zeros, space);
  aescrypt(tagkey, j0, space);
  crypto_ghash(tag, c + 16, clen - 16, h, tagkey);
  if (verify16(tag, c)) {
    bzero(h, 16);
    for (int i = 0; i < 60; i++) {
      space[i] = 0;
    }
    return -1;
  }
  aes256ctr(m, c, clen, key, j0);
  bzero(m, 16);
  bzero(h, 16);
  for (int i = 0; i < 60; i++) {
    space[i] = 0;
  }
  return 0;
}


x86 assembly (clang, -O0):
<aes256gcmdecrypt>:
push   %rbp
mov    %rsp,%rbp
sub    $0x180,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %rcx,-0x28(%rbp)
mov    %r8,-0x30(%rbp)
cmpq   $0x10,-0x20(%rbp)
jae    11a6 <aes256gcmdecrypt+0x36>
movl   $0xffffffff,-0x4(%rbp)
jmp    1337 <aes256gcmdecrypt+0x1c7>
lea    -0x40(%rbp),%rdi
mov    $0x10,%esi
call   1060 <bzero@plt>
lea    -0x150(%rbp),%rdi
mov    -0x28(%rbp),%rsi
mov    $0xc,%edx
call   1050 <memcpy@plt>
movb   $0x0,-0x144(%rbp)
movb   $0x0,-0x143(%rbp)
movb   $0x0,-0x142(%rbp)
movb   $0x1,-0x141(%rbp)
lea    -0x140(%rbp),%rdi
mov    -0x30(%rbp),%rsi
call   1070 <aeskey@plt>
lea    -0x50(%rbp),%rdi
lea    -0x40(%rbp),%rsi
lea    -0x140(%rbp),%rdx
call   1030 <aescrypt@plt>
lea    -0x160(%rbp),%rdi
lea    -0x150(%rbp),%rsi
lea    -0x140(%rbp),%rdx
call   1030 <aescrypt@plt>
lea    -0x170(%rbp),%rdi
mov    -0x18(%rbp),%rsi
add    $0x10,%rsi
mov    -0x20(%rbp),%rdx
sub    $0x10,%rdx
lea    -0x50(%rbp),%rcx
lea    -0x160(%rbp),%r8
call   1090 <crypto_ghash@plt>
lea    -0x170(%rbp),%rdi
mov    -0x18(%rbp),%rsi
call   1040 <verify16@plt>
cmp    $0x0,%rax
je     12bb <aes256gcmdecrypt+0x14b>
lea    -0x50(%rbp),%rdi
mov    $0x10,%esi
call   1060 <bzero@plt>
movl   $0x0,-0x174(%rbp)
cmpl   $0x3c,-0x174(%rbp)
jge    12af <aes256gcmdecrypt+0x13f>
movslq -0x174(%rbp),%rax
movl   $0x0,-0x140(%rbp,%rax,4)
mov    -0x174(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x174(%rbp)
jmp    127c <aes256gcmdecrypt+0x10c>
movl   $0xffffffff,-0x4(%rbp)
jmp    1337 <aes256gcmdecrypt+0x1c7>
mov    -0x10(%rbp),%rdi
mov    -0x18(%rbp),%rsi
mov    -0x20(%rbp),%rdx
mov    -0x30(%rbp),%rcx
lea    -0x150(%rbp),%r8
call   1080 <aes256ctr@plt>
mov    -0x10(%rbp),%rdi
mov    $0x10,%esi
call   1060 <bzero@plt>
lea    -0x50(%rbp),%rdi
mov    $0x10,%esi
call   1060 <bzero@plt>
movl   $0x0,-0x178(%rbp)
cmpl   $0x3c,-0x178(%rbp)
jge    1330 <aes256gcmdecrypt+0x1c0>
movslq -0x178(%rbp),%rax
movl   $0x0,-0x140(%rbp,%rax,4)
mov    -0x178(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x178(%rbp)
jmp    12fd <aes256gcmdecrypt+0x18d>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x180,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<aes256gcmdecrypt>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x158,%rsp
mov    $0xffffffff,%r12d
cmp    $0x10,%rdx
jb     1255 <aes256gcmdecrypt+0xe5>
mov    %r8,%r15
mov    %rcx,%rbp
mov    %rdx,%rbx
mov    %rsi,%r13
mov    %rdi,0x18(%rsp)
lea    0x50(%rsp),%r14
mov    %r14,%rdi
mov    $0x10,%esi
call   1060 <bzero@plt>
mov    %rsp,%rdi
mov    %rbp,%rsi
mov    $0xc,%edx
call   1050 <memcpy@plt>
movl   $0x1000000,0xc(%rsp)
01
lea    0x60(%rsp),%rbp
mov    %rbp,%rdi
mov    %r15,%rsi
call   1070 <aeskey@plt>
lea    0x20(%rsp),%rdi
mov    %r14,%rsi
mov    %rbp,%rdx
call   1030 <aescrypt@plt>
lea    0x40(%rsp),%r14
mov    %r14,%rdi
mov    %rsp,%rsi
mov    %rbp,%rdx
call   1030 <aescrypt@plt>
lea    0x10(%r13),%rsi
lea    -0x10(%rbx),%rdx
lea    0x30(%rsp),%rbp
mov    %rbp,%rdi
lea    0x20(%rsp),%rcx
mov    %r14,%r8
call   1090 <crypto_ghash@plt>
mov    %rbp,%rdi
mov    %r13,%rsi
call   1040 <verify16@plt>
test   %rax,%rax
jne    1255 <aes256gcmdecrypt+0xe5>
mov    %rsp,%r8
mov    0x18(%rsp),%rbp
mov    %rbp,%rdi
mov    %r13,%rsi
mov    %rbx,%rdx
mov    %r15,%rcx
call   1080 <aes256ctr@plt>
mov    %rbp,%rdi
mov    $0x10,%esi
call   1060 <bzero@plt>
xor    %r12d,%r12d
mov    %r12d,%eax
add    $0x158,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
define i32 @aes256gcmdecrypt(i8* %0, i8* %1, i64 %2, i8* %3, i8* %4) {
%6 = alloca i32
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i64
%10 = alloca i8*
%11 = alloca i8*
%12 = alloca [16 x i8]
%13 = alloca [16 x i8]
%14 = alloca [60 x i32]
%15 = alloca [16 x i8]
%16 = alloca [16 x i8]
%17 = alloca [16 x i8]
%18 = alloca i32
%19 = alloca i32
store i8* %0, i8** %7
store i8* %1, i8** %8
store i64 %2, i64* %9
store i8* %3, i8** %10
store i8* %4, i8** %11
%20 = load i64, i64* %9
%21 = icmp ult i64 %20, 16
br i1 %21, label %22, label %23
22: ; preds = %5
store i32 -1, i32* %6
br label %92
23: ; preds = %5
%24 = getelementptr inbounds [16 x i8], [16 x i8]* %12, i64 0, i64 0
%25 = call i32 @bzero(i8* %24, i32 16)
%26 = getelementptr inbounds [16 x i8], [16 x i8]* %15, i64 0, i64 0
%27 = load i8*, i8** %10
%28 = call i32 @memcpy(i8* %26, i8* %27, i32 12)
%29 = getelementptr inbounds [16 x i8], [16 x i8]* %15, i64 0, i64 12
store i8 0, i8* %29
%30 = getelementptr inbounds [16 x i8], [16 x i8]* %15, i64 0, i64 13
store i8 0, i8* %30
%31 = getelementptr inbounds [16 x i8], [16 x i8]* %15, i64 0, i64 14
store i8 0, i8* %31
%32 = getelementptr inbounds [16 x i8], [16 x i8]* %15, i64 0, i64 15
store i8 1, i8* %32
%33 = getelementptr inbounds [60 x i32], [60 x i32]* %14, i64 0, i64 0
%34 = load i8*, i8** %11
%35 = call i32 @aeskey(i32* %33, i8* %34)
%36 = getelementptr inbounds [16 x i8], [16 x i8]* %13, i64 0, i64 0
%37 = getelementptr inbounds [16 x i8], [16 x i8]* %12, i64 0, i64 0
%38 = getelementptr inbounds [60 x i32], [60 x i32]* %14, i64 0, i64 0
%39 = call i32 @aescrypt(i8* %36, i8* %37, i32* %38)
%40 = getelementptr inbounds [16 x i8], [16 x i8]* %16, i64 0, i64 0
%41 = getelementptr inbounds [16 x i8], [16 x i8]* %15, i64 0, i64 0
%42 = getelementptr inbounds [60 x i32], [60 x i32]* %14, i64 0, i64 0
%43 = call i32 @aescrypt(i8* %40, i8* %41, i32* %42)
%44 = getelementptr inbounds [16 x i8], [16 x i8]* %17, i64 0, i64 0
%45 = load i8*, i8** %8
%46 = getelementptr inbounds i8, i8* %45, i64 16
%47 = load i64, i64* %9
%48 = sub i64 %47, 16
%49 = getelementptr inbounds [16 x i8], [16 x i8]* %13, i64 0, i64 0
%50 = getelementptr inbounds [16 x i8], [16 x i8]* %16, i64 0, i64 0
%51 = call i32 @crypto_ghash(i8* %44, i8* %46, i64 %48, i8* %49, i8* %50)
%52 = getelementptr inbounds [16 x i8], [16 x i8]* %17, i64 0, i64 0
%53 = load i8*, i8** %8
%54 = call i64 @verify16(i8* %52, i8* %53)
%55 = icmp ne i64 %54, 0
br i1 %55, label %56, label %70
56: ; preds = %23
%57 = getelementptr inbounds [16 x i8], [16 x i8]* %13, i64 0, i64 0
%58 = call i32 @bzero(i8* %57, i32 16)
store i32 0, i32* %18
br label %59
59: ; preds = %66, %56
%60 = load i32, i32* %18
%61 = icmp slt i32 %60, 60
br i1 %61, label %62, label %69
62: ; preds = %59
%63 = load i32, i32* %18
%64 = sext i32 %63 to i64
%65 = getelementptr inbounds [60 x i32], [60 x i32]* %14, i64 0, i64 %64
store i32 0, i32* %65
br label %66
66: ; preds = %62
%67 = load i32, i32* %18
%68 = add nsw i32 %67, 1
store i32 %68, i32* %18
br label %59
69: ; preds = %59
store i32 -1, i32* %6
br label %92
70: ; preds = %23
%71 = load i8*, i8** %7
%72 = load i8*, i8** %8
%73 = load i64, i64* %9
%74 = load i8*, i8** %11
%75 = getelementptr inbounds [16 x i8], [16 x i8]* %15, i64 0, i64 0
%76 = call i32 @aes256ctr(i8* %71, i8* %72, i64 %73, i8* %74, i8* %75)
%77 = load i8*, i8** %7
%78 = call i32 @bzero(i8* %77, i32 16)
%79 = getelementptr inbounds [16 x i8], [16 x i8]* %13, i64 0, i64 0
%80 = call i32 @bzero(i8* %79, i32 16)
store i32 0, i32* %19
br label %81
81: ; preds = %88, %70
%82 = load i32, i32* %19
%83 = icmp slt i32 %82, 60
br i1 %83, label %84, label %91
84: ; preds = %81
%85 = load i32, i32* %19
%86 = sext i32 %85 to i64
%87 = getelementptr inbounds [60 x i32], [60 x i32]* %14, i64 0, i64 %86
store i32 0, i32* %87
br label %88
88: ; preds = %84
%89 = load i32, i32* %19
%90 = add nsw i32 %89, 1
store i32 %90, i32* %19
br label %81
91: ; preds = %81
store i32 0, i32* %6
br label %92
92: ; preds = %91, %69, %22
%93 = load i32, i32* %6
ret i32 %93
}

LLVM IR (-O2):
define i32 @aes256gcmdecrypt(i8* %0, i8* %1, i64 %2, i8* %3, i8* %4) {
%6 = alloca [16 x i8]
%7 = alloca [16 x i8]
%8 = alloca [60 x i32]
%9 = bitcast [60 x i32]* %8 to i8*
%10 = alloca [16 x i8]
%11 = alloca [16 x i8]
%12 = alloca [16 x i8]
%13 = getelementptr inbounds [16 x i8], [16 x i8]* %6, i64 0, i64 0
%14 = getelementptr inbounds [16 x i8], [16 x i8]* %7, i64 0, i64 0
%15 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 0
%16 = getelementptr inbounds [16 x i8], [16 x i8]* %11, i64 0, i64 0
%17 = getelementptr inbounds [16 x i8], [16 x i8]* %12, i64 0, i64 0
%18 = icmp ult i64 %2, 16
br i1 %18, label %38, label %19
19: ; preds = %5
%20 = call i32 @bzero(i8* %13, i32 16)
%21 = call i32 @memcpy(i8* %15, i8* %3, i32 12)
%22 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 12
store i8 0, i8* %22
%23 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 13
store i8 0, i8* %23
%24 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 14
store i8 0, i8* %24
%25 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 15
store i8 1, i8* %25
%26 = getelementptr inbounds [60 x i32], [60 x i32]* %8, i64 0, i64 0
%27 = call i32 @aeskey(i32* %26, i8* %4)
%28 = call i32 @aescrypt(i8* %14, i8* %13, i32* %26)
%29 = call i32 @aescrypt(i8* %16, i8* %15, i32* %26)
%30 = getelementptr inbounds i8, i8* %1, i64 16
%31 = add i64 %2, -16
%32 = call i32 @crypto_ghash(i8* %17, i8* %30, i64 %31, i8* %14, i8* %16)
%33 = call i64 @verify16(i8* %17, i8* %1)
%34 = icmp eq i64 %33, 0
br i1 %34, label %35, label %38
35: ; preds = %19
%36 = call i32 @aes256ctr(i8* %0, i8* %1, i64 %2, i8* %4, i8* %15)
%37 = call i32 @bzero(i8* %0, i32 16)
br label %38
38: ; preds = %19, %35, %5
%39 = phi i32 [ -1, %5 ], [ 0, %35 ], [ -1, %19 ]
ret i32 %39
}