user: 请将以下的汇编代码转换成C语言代码:

```asm
<crypto_aead_decrypt>:
  endbr64
  push   %r15
  push   %r14
  push   %r13
  push   %r12
  push   %rbp
  push   %rbx
  sub    $0x168,%rsp
  mov    %rcx,0x18(%rsp)
  lea    0x60(%rsp),%r12
  lea    0x70(%rsp),%rbx
  mov    0x1a8(%rsp),%rax
  mov    %r8,0x20(%rsp)
  lea    0x130(%rsp),%rbp
  mov    0x1a0(%rsp),%r13
  lea    0x80(%rsp),%r15
  mov    %r9,0x50(%rsp)
  mov    %rdi,0x28(%rsp)
  lea    0xc0(%rsp),%rdi
  mov    %rsi,0x40(%rsp)
  mov    $0xa,%esi
  mov    %rax,0x48(%rsp)
  mov    %fs:0x28,%rax
  mov    %rax,0x158(%rsp)
  mov    0x1b0(%rsp),%rax
  movdqu (%rax),%xmm2
  xor    %eax,%eax
  movaps %xmm2,0xc0(%rsp)
  call   <keyschedule@plt>
  pxor   %xmm0,%xmm0
  mov    %r12,%rsi
  mov    %rbp,%rdi
  xor    %eax,%eax
  movaps %xmm0,0x130(%rsp)
  call   <AES128Enc@plt>
  mov    %rbx,%rsi
  mov    %r12,%rdi
  xor    %eax,%eax
  mov    %rbx,0x58(%rsp)
  call   <Times2@plt>
  mov    %rbx,%rdi
  mov    %r15,%rsi
  xor    %eax,%eax
  lea    0x110(%rsp),%rbx
  mov    %r15,0x30(%rsp)
  call   <Times2@plt>
  xor    %eax,%eax
  mov    %rbx,%rsi
  mov    %r15,%rdi
  call   <Times2@plt>
  test   %r13,%r13
  pxor   %xmm0,%xmm0
  jne    L874
  movaps %xmm0,0xb0(%rsp)
L702:
  mov    0x20(%rsp),%r15
  cmp    $0xf,%r15
  jbe    L409
  mov    0x48(%rsp),%rsi
  mov    0x40(%rsp),%rdi
  lea    -0x10(%r15),%rax
  lea    0x120(%rsp),%r13
  xor    %r8d,%r8d
  movb   $0x80,0xed(%rsp)
  mov    %rax,(%rdi)
  mov    (%rsi),%rax
  lea    0xe0(%rsp),%rdi
  mov    %r8w,0xee(%rsp)
  mov    %rax,0xe0(%rsp)
  mov    0x8(%rsi),%eax
  mov    %eax,0xe8(%rsp)
  movzbl 0xc(%rsi),%eax
  mov    %r13,%rsi
  mov    %al,0xec(%rsp)
  xor    %eax,%eax
  call   <AES128Enc@plt>
  cmp    $0x10,%r15
  je     L446
  mov    0x20(%rsp),%rax
  mov    %rax,%rdi
  shr    $0x4,%rdi
  mov    %rdi,0x20(%rsp)
  sub    $0x1,%rdi
  and    $0xf,%eax
  mov    %rdi,0x10(%rsp)
  mov    %rax,%r14
  jne    L108
  mov    0x20(%rsp),%rax
  mov    0x10(%rsp),%rdi
  pxor   %xmm0,%xmm0
  movaps %xmm0,0xf0(%rsp)
  sub    $0x2,%rax
  mov    %rdi,0x20(%rsp)
  mov    %rax,0x10(%rsp)
L342:
  mov    0x30(%rsp),%rdi
  mov    %rbx,%rsi
  xor    %eax,%eax
  call   <Times2@plt>
  xor    %eax,%eax
L159:
  movzbl (%rbx,%rax,1),%edx
  xor    0x0(%r13,%rax,1),%dl
  mov    %dl,0x0(%rbp,%rax,1)
  add    $0x1,%rax
  cmp    $0x10,%rax
  jne    L159
  lea    0x140(%rsp),%r15
  xor    %eax,%eax
  mov    %rbp,%rdi
  mov    %r15,%rsi
  call   <AES128Enc@plt>
  cmpq   $0x0,0x10(%rsp)
  je     L747
  mov    0x18(%rsp),%r9
  mov    0x28(%rsp),%rcx
  movq   $0x0,(%rsp)
  lea    0xd0(%rsp),%r12
  mov    %r14,0x38(%rsp)
  mov    %r13,%r14
  mov    %r12,0x8(%rsp)
  mov    %r9,%r13
  mov    %r15,%r12
  mov    %rbx,%r15
  mov    %rcx,%rbx
  nopl   0x0(%rax,%rax,1)
L10:
  mov    0x8(%rsp),%rsi
  mov    %r15,%rdi
  xor    %eax,%eax
  call   <Times2@plt>
  mov    0x8(%rsp),%r9
  xor    %eax,%eax
  cs nopw 0x0(%rax,%rax,1)
L373:
  movzbl (%r9,%rax,1),%esi
  movzbl (%r14,%rax,1),%ecx
  movzbl (%r12,%rax,1),%edx
  xor    0x0(%r13,%rax,1),%dl
  xor    %esi,%ecx
  mov    %dl,0x0(%rbp,%rax,1)
  xor    %ecx,%edx
  mov    %sil,(%r15,%rax,1)
  mov    %dl,(%rbx,%rax,1)
  add    $0x1,%rax
  cmp    $0x10,%rax
  jne    L373
  mov    %r12,%rsi
  mov    %rbp,%rdi
  xor    %eax,%eax
  add    $0x10,%r13
  call   <AES128Enc@plt>
  add    $0x10,%rbx
  addq   $0x1,(%rsp)
  mov    (%rsp),%rax
  cmp    0x10(%rsp),%rax
  jne    L10
  mov    %r14,%r13
  mov    0x38(%rsp),%r14
  mov    %r12,%r15
  shlq   $0x4,0x10(%rsp)
L747:
  test   %r14,%r14
  je     L646
  mov    0x10(%rsp),%rdi
  mov    %r15,%rsi
  mov    0x28(%rsp),%rcx
  mov    %rdi,%rax
  lea    (%r14,%rdi,1),%rbx
  sub    %rdi,%rsi
  mov    0x18(%rsp),%rdi
  nopl   0x0(%rax,%rax,1)
L493:
  movzbl (%rsi,%rax,1),%edx
  xor    (%rdi,%rax,1),%dl
  mov    %dl,(%rcx,%rax,1)
  add    $0x1,%rax
  cmp    %rax,%rbx
  jne    L493
  lea    0x100(%rsp),%rdi
  mov    %r14d,%esi
  xor    %r8d,%r8d
  mov    %rdi,%rax
  cmp    $0x8,%r14d
  jae    L489
L210:
  test   $0x4,%sil
  jne    L675
  test   $0x2,%sil
  jne    L413
L723:
  and    $0x1,%esi
  jne    L284
L456:
  mov    %r14,%rcx
  lea    0xf0(%rsp),%rax
  cs nopw 0x0(%rax,%rax,1)
L100:
  movzbl (%r15,%rcx,1),%edx
  xor    (%rax,%rcx,1),%dl
  mov    %dl,(%rdi,%rcx,1)
  add    $0x1,%rcx
  cmp    $0x10,%rcx
  jne    L100
  mov    0x10(%rsp),%rcx
  mov    0x28(%rsp),%rsi
  xor    %eax,%eax
  add    %rcx,%rsi
  mov    0x58(%rsp),%rcx
  nopl   0x0(%rax)
L104:
  movzbl (%rsi,%rax,1),%edx
  xor    (%rcx,%rax,1),%dl
  xor    0x0(%r13,%rax,1),%dl
  mov    %dl,0x0(%rbp,%rax,1)
  add    $0x1,%rax
  cmp    %rax,%r14
  jne    L104
  mov    %rcx,%rdx
  nopl   0x0(%rax)
L14:
  movzbl (%rdi,%r14,1),%eax
  xor    (%rdx,%r14,1),%al
  xor    0x0(%r13,%r14,1),%al
  mov    %al,0x0(%rbp,%r14,1)
  add    $0x1,%r14
  cmp    $0x10,%r14
  jne    L14
  mov    %r15,%rsi
  mov    %rbp,%rdi
  xor    %eax,%eax
  call   <AES128Enc@plt>
  mov    0x18(%rsp),%rdi
  xor    %eax,%eax
  lea    0xb0(%rsp),%rsi
  lea    (%rdi,%rbx,1),%rcx
  nopl   (%rax)
L754:
  movzbl (%r15,%rax,1),%edx
  xor    (%rsi,%rax,1),%dl
  cmp    %dl,(%rcx,%rax,1)
  jne    L548
  add    $0x1,%rax
  cmp    $0x10,%rax
  jne    L754
L883:
  xor    %eax,%eax
L273:
  mov    0x158(%rsp),%rdx
  sub    %fs:0x28,%rdx
  jne    L518
  add    $0x168,%rsp
  pop    %rbx
  pop    %rbp
  pop    %r12
  pop    %r13
  pop    %r14
  pop    %r15
  ret
L874:
  mov    %r13,%rax
  movaps %xmm0,0x90(%rsp)
  shr    $0x4,%rax
  and    $0xf,%r13d
  mov    %rax,(%rsp)
  mov    %r13,0x38(%rsp)
  je     L401
  cmpq   $0x0,(%rsp)
  je     L207
L875:
  mov    0x50(%rsp),%r13
  lea    0x90(%rsp),%rax
  xor    %edi,%edi
  lea    0xa0(%rsp),%r14
  lea    0xd0(%rsp),%r12
  mov    %rax,0x8(%rsp)
  mov    %r14,%rax
  lea    0x140(%rsp),%r15
  mov    %r12,0x10(%rsp)
  mov    %r13,%r14
  mov    %rdi,%r12
  mov    %rbp,%r13
  mov    %rax,%rbp
  nopl   0x0(%rax,%rax,1)
L824:
  xor    %eax,%eax
  nopw   0x0(%rax,%rax,1)
L811:
  movzbl (%r14,%rax,1),%edx
  xor    (%rbx,%rax,1),%dl
  mov    %dl,0x0(%r13,%rax,1)
  add    $0x1,%rax
  cmp    $0x10,%rax
  jne    L811
  mov    %r15,%rsi
  mov    %r13,%rdi
  xor    %eax,%eax
  call   <AES128Enc@plt>
  mov    0x8(%rsp),%rax
  mov    %r15,%rdx
  nopl   0x0(%rax)
L393:
  movzbl (%rdx),%ecx
  xor    %cl,(%rax)
  add    $0x1,%rax
  add    $0x1,%rdx
  cmp    %rax,%rbp
  jne    L393
  mov    0x10(%rsp),%rsi
  mov    %rbx,%rdi
  xor    %eax,%eax
  add    $0x1,%r12
  add    $0x10,%r14
  call   <Times2@plt>
  movdqa 0xd0(%rsp),%xmm1
  movaps %xmm1,0x110(%rsp)
  cmp    %r12,(%rsp)
  jne    L824
  shlq   $0x4,(%rsp)
  cmpq   $0x0,0x38(%rsp)
  mov    %rbp,%r14
  mov    %r13,%rbp
  je     L533
L830:
  mov    0x38(%rsp),%rcx
  mov    0x50(%rsp),%rsi
  mov    %r14,%rdi
  add    (%rsp),%rsi
  mov    %rsi,%rax
  cmp    $0x8,%ecx
  jae    L31
L500:
  xor    %edx,%edx
  testb  $0x4,0x38(%rsp)
  jne    L785
  testb  $0x2,0x38(%rsp)
  jne    L711
L854:
  testb  $0x1,0x38(%rsp)
  jne    L231
L267:
  mov    0x38(%rsp),%rax
  movb   $0x80,0xa0(%rsp,%rax,1)
  lea    0x1(%rax),%rdx
  cmp    $0xf,%rax
  je     L38
  mov    $0xf,%eax
  sub    0x38(%rsp),%rax
  add    %r14,%rdx
  xor    %edi,%edi
  cmp    $0x8,%eax
  jb     L452
  mov    %eax,%esi
  movq   $0x0,(%rdx)
  movq   $0x0,-0x8(%rdx,%rsi,1)
  lea    0x8(%rdx),%rsi
  and    $0xfffffffffffffff8,%rsi
  sub    %rsi,%rdx
  add    %edx,%eax
  and    $0xfffffff8,%eax
  cmp    $0x8,%eax
  jb     L38
  and    $0xfffffff8,%eax
  xor    %edx,%edx
L286:
  mov    %edx,%ecx
  add    $0x8,%edx
  mov    %rdi,(%rsi,%rcx,1)
  cmp    %eax,%edx
  jb     L286
L38:
  mov    0x58(%rsp),%rcx
  mov    0x8(%rsp),%rsi
  xor    %eax,%eax
  nopl   0x0(%rax,%rax,1)
L562:
  movzbl (%rsi,%rax,1),%edx
  xor    (%r14,%rax,1),%dl
  xor    (%rcx,%rax,1),%dl
  mov    %dl,0x0(%rbp,%rax,1)
  add    $0x1,%rax
  cmp    $0x10,%rax
  jne    L562
L227:
  lea    0xb0(%rsp),%rsi
  mov    %rbp,%rdi
  xor    %eax,%eax
  call   <AES128Enc@plt>
  jmp    L702
L108:
  lea    0xf0(%rsp),%rax
  mov    %r14d,%esi
  xor    %r8d,%r8d
  mov    %rax,%rcx
  cmp    $0x8,%r14d
  jae    L676
L183:
  test   $0x4,%sil
  jne    L610
  test   $0x2,%sil
  jne    L237
L122:
  and    $0x1,%esi
  jne    L606
L295:
  movb   $0x80,0xf0(%rsp,%r14,1)
  lea    0x1(%r14),%rsi
  cmp    $0xf,%r14
  je     L342
  mov    $0xf,%ecx
  lea    (%rax,%rsi,1),%rdi
  xor    %esi,%esi
  sub    %r14,%rcx
  cmp    $0x8,%ecx
  jb     L720
  mov    %ecx,%eax
  movq   $0x0,(%rdi)
  movq   $0x0,-0x8(%rdi,%rax,1)
  lea    0x8(%rdi),%rax
  and    $0xfffffffffffffff8,%rax
  sub    %rax,%rdi
  add    %edi,%ecx
  and    $0xfffffff8,%ecx
  cmp    $0x8,%ecx
  jb     L342
  and    $0xfffffff8,%ecx
  xor    %edi,%edi
L707:
  mov    %edi,%edx
  add    $0x8,%edi
  mov    %rsi,(%rax,%rdx,1)
  cmp    %ecx,%edi
  jb     L707
  jmp    L342
L401:
  sub    $0x1,%rax
  mov    %rax,(%rsp)
  jne    L875
  lea    0x90(%rsp),%rax
  mov    %rax,0x8(%rsp)
L533:
  mov    0x50(%rsp),%rdi
  mov    (%rsp),%rsi
  xor    %eax,%eax
  lea    (%rdi,%rsi,1),%rcx
  mov    0x30(%rsp),%rsi
  mov    0x8(%rsp),%rdi
  nopl   0x0(%rax)
L93:
  movzbl (%rcx,%rax,1),%edx
  xor    (%rdi,%rax,1),%dl
  xor    (%rsi,%rax,1),%dl
  mov    %dl,0x0(%rbp,%rax,1)
  add    $0x1,%rax
  cmp    $0x10,%rax
  jne    L93
  jmp    L227
L548:
  mov    $0xffffffff,%eax
  jmp    L273
L446:
  mov    0x30(%rsp),%rcx
  xor    %eax,%eax
  xchg   %ax,%ax
L417:
  movzbl (%rcx,%rax,1),%edx
  xor    0x0(%r13,%rax,1),%dl
  mov    %dl,0x0(%rbp,%rax,1)
  add    $0x1,%rax
  cmp    $0x10,%rax
  jne    L417
  lea    0x140(%rsp),%r15
  mov    %rbp,%rdi
  xor    %eax,%eax
  mov    %r15,%rsi
  call   <AES128Enc@plt>
  mov    0x18(%rsp),%rcx
  xor    %eax,%eax
  lea    0xb0(%rsp),%rsi
  nopl   0x0(%rax,%rax,1)
L749:
  movzbl (%r15,%rax,1),%edx
  xor    (%rsi,%rax,1),%dl
  cmp    %dl,(%rcx,%rax,1)
  jne    L548
  add    $0x1,%rax
  cmp    $0x10,%rax
  jne    L749
  jmp    L883
L646:
  mov    0x28(%rsp),%rbx
  mov    0x10(%rsp),%rdi
  xor    %eax,%eax
  lea    (%rbx,%rdi,1),%rsi
  mov    0x18(%rsp),%rbx
  add    %rbx,%rdi
  nopl   0x0(%rax)
L726:
  movzbl (%rdi,%rax,1),%edx
  xor    (%r15,%rax,1),%dl
  mov    %dl,(%rsi,%rax,1)
  add    $0x1,%rax
  cmp    $0x10,%rax
  jne    L726
  mov    0x30(%rsp),%rcx
  xor    %eax,%eax
  nopl   0x0(%rax)
L241:
  movzbl (%rsi,%rax,1),%edx
  xor    (%rcx,%rax,1),%dl
  xor    0x0(%r13,%rax,1),%dl
  mov    %dl,0x0(%rbp,%rax,1)
  add    $0x1,%rax
  cmp    $0x10,%rax
  jne    L241
  mov    %r15,%rsi
  mov    %rbp,%rdi
  xor    %eax,%eax
  call   <AES128Enc@plt>
  mov    0x20(%rsp),%rax
  mov    0x18(%rsp),%rdi
  lea    0xb0(%rsp),%rsi
  shl    $0x4,%rax
  lea    (%rdi,%rax,1),%rdx
  nopl   0x0(%rax)
L869:
  movzbl (%r15,%r14,1),%eax
  xor    (%rsi,%r14,1),%al
  cmp    %al,(%rdx,%r14,1)
  jne    L548
  add    $0x1,%r14
  cmp    $0x10,%r14
  jne    L869
  jmp    L883
L720:
  test   $0x4,%cl
  jne    L892
  test   %ecx,%ecx
  je     L342
  movb   $0x0,(%rdi)
  test   $0x2,%cl
  je     L342
  mov    %ecx,%ecx
  xor    %esi,%esi
  mov    %si,-0x2(%rdi,%rcx,1)
  jmp    L342
  nopl   (%rax)
L606:
  movb   $0x0,(%rcx)
  jmp    L295
L237:
  xor    %edi,%edi
  add    $0x2,%rcx
  mov    %di,-0x2(%rcx)
  and    $0x1,%esi
  je     L295
  jmp    L606
L675:
  movl   $0x0,(%rax)
  add    $0x4,%rax
  test   $0x2,%sil
  je     L723
  jmp    L413
L610:
  movl   $0x0,(%rcx)
  add    $0x4,%rcx
  test   $0x2,%sil
  je     L122
  jmp    L237
L676:
  mov    %r14d,%r9d
  xor    %ecx,%ecx
  and    $0xfffffff8,%r9d
L215:
  mov    %ecx,%edx
  add    $0x8,%ecx
  mov    %r8,(%rax,%rdx,1)
  cmp    %r9d,%ecx
  jb     L215
  add    %rax,%rcx
  jmp    L183
L489:
  mov    %r14d,%r9d
  xor    %eax,%eax
  and    $0xfffffff8,%r9d
L11:
  mov    %eax,%edx
  add    $0x8,%eax
  mov    %r8,(%rdi,%rdx,1)
  cmp    %r9d,%eax
  jb     L11
  add    %rdi,%rax
  jmp    L210
L284:
  movb   $0x0,(%rax)
  jmp    L456
L413:
  xor    %edx,%edx
  add    $0x2,%rax
  mov    %dx,-0x2(%rax)
  and    $0x1,%esi
  je     L456
  jmp    L284
L785:
  mov    (%rax),%edx
  mov    %edx,(%rdi)
  mov    $0x4,%edx
  testb  $0x2,0x38(%rsp)
  je     L854
L711:
  movzwl (%rax,%rdx,1),%esi
  mov    %si,(%rdi,%rdx,1)
  add    $0x2,%rdx
  testb  $0x1,0x38(%rsp)
  je     L267
  jmp    L231
L452:
  test   $0x4,%al
  jne    L744
  test   %eax,%eax
  je     L38
  movb   $0x0,(%rdx)
  test   $0x2,%al
  je     L38
  mov    %eax,%eax
  xor    %r9d,%r9d
  mov    %r9w,-0x2(%rdx,%rax,1)
  jmp    L38
  nopl   0x0(%rax)
L231:
  movzbl (%rax,%rdx,1),%eax
  mov    %al,(%rdi,%rdx,1)
  jmp    L267
L31:
  mov    %ecx,%r8d
  xor    %eax,%eax
  and    $0xfffffff8,%r8d
L775:
  mov    %eax,%edx
  add    $0x8,%eax
  mov    (%rsi,%rdx,1),%rcx
  mov    %rcx,(%r14,%rdx,1)
  cmp    %r8d,%eax
  jb     L775
  lea    (%r14,%rax,1),%rdi
  add    %rsi,%rax
  jmp    L500
L207:
  lea    0x90(%rsp),%rax
  lea    0xa0(%rsp),%r14
  mov    %rax,0x8(%rsp)
  jmp    L830
L892:
  mov    %ecx,%ecx
  movl   $0x0,(%rdi)
  movl   $0x0,-0x4(%rdi,%rcx,1)
  jmp    L342
L744:
  mov    %eax,%eax
  movl   $0x0,(%rdx)
  movl   $0x0,-0x4(%rdx,%rax,1)
  jmp    L38
L409:
  mov    $0xfffffffe,%eax
  jmp    L273
L518:
  call   <__stack_chk_fail@plt>
```

assistant: ```c
int crypto_aead_decrypt(unsigned char *m, unsigned long long *mlen, unsigned char *nsec, const unsigned char *c, unsigned long long clen, const unsigned char *ad, unsigned long long adlen, const unsigned char *npub, const unsigned char *k) {
  unsigned char SumB[16], LastABlock[16], MacAESTag[16], Key[16], Double[16];
  unsigned long long a;
  unsigned char PaddedPMN[16];
  unsigned char LastCiphertextBlock[16], PaddedBlock[16];
  unsigned long long l;
  unsigned char StolenR[16];
  unsigned char Z[3][16], NextZ[16], U[16];
  unsigned char AESInputBlock[16], AESOutputBlock[16];
  unsigned long long i, j;
  for (j = 0; j < 16; j++)
    Key[j] = k[j];
  keyschedule(Key, 10);
  for (j = 0; j < 16; j++)
    AESInputBlock[j] = 0x0;
  AES128Enc(AESInputBlock, Z[0]);
  for (i = 0; i < 2; i++)
    Times2(Z[i], Z[i + 1]);
  Times2(Z[2], NextZ);
  if (adlen == 0) {
    for (j = 0; j < 16; j++)
      MacAESTag[j] = 0x0;
  } else {
    if (adlen % 16 == 0)
      a = adlen / 16;
    else
      a = adlen / 16 + 1;
    for (j = 0; j < 16; j++)
      SumB[j] = 0x0;
    for (i = 0; i < a - 1; i++) {
      for (j = 0; j < 16; j++)
        AESInputBlock[j] = ad[i * 16 + j] ^ NextZ[j];
      AES128Enc(AESInputBlock, AESOutputBlock);
      for (j = 0; j < 16; j++)
        SumB[j] = SumB[j] ^ AESOutputBlock[j];
      Times2(NextZ, Double);
      for (j = 0; j < 16; j++)
        NextZ[j] = Double[j];
    }
    if (adlen % 16 != 0) {
      for (j = 0; j < adlen % 16; j++)
        LastABlock[j] = ad[(a - 1) * 16 + j];
      LastABlock[adlen % 16] = 0x80;
      for (j = adlen % 16 + 1; j < 16; j++)
        LastABlock[j] = 0x0;
      for (j = 0; j < 16; j++)
        AESInputBlock[j] = SumB[j] ^ LastABlock[j] ^ Z[1][j];
    } else {
      for (j = 0; j < 16; j++)
        AESInputBlock[j] = SumB[j] ^ ad[(a - 1) * 16 + j] ^ Z[2][j];
    }
    AES128Enc(AESInputBlock, MacAESTag);
  }
  if (clen < 16)
    return -2;
  *mlen = clen - 16;
  for (j = 0; j < 13; j++)
    PaddedPMN[j] = npub[j];
  PaddedPMN[13] = 0x80;
  for (j = 13 + 1; j < 16; j++)
    PaddedPMN[j] = 0x0;
  AES128Enc(PaddedPMN, U);
  if (clen == 16) {
    for (j = 0; j < 16; j++)
      AESInputBlock[j] = Z[2][j] ^ U[j];
    AES128Enc(AESInputBlock, AESOutputBlock);
    for (j = 0; j < 16; j++) {
      if (c[j] != (AESOutputBlock[j] ^ MacAESTag[j]))
        return -1;
    }
  } else {
    l = clen / 16 - 1;
    if (clen % 16 != 0) {
      l = l + 1;
      for (j = 0; j < clen % 16; j++) {
        LastCiphertextBlock[j] = c[(l - 1) * 16 + j];
        PaddedBlock[j] = 0x0;
      }
      LastCiphertextBlock[clen % 16] = 0x0;
      PaddedBlock[clen % 16] = 0x80;
      for (j = clen % 16 + 1; j < 16; j++) {
        LastCiphertextBlock[j] = 0x0;
        PaddedBlock[j] = 0x0;
      }
    } else {
      for (j = 0; j < 16; j++) {
        LastCiphertextBlock[j] = c[(l - 1) * 16 + j];
        PaddedBlock[j] = 0x0;
      }
    }
    Times2(Z[2], NextZ);
    for (j = 0; j < 16; j++)
      AESInputBlock[j] = NextZ[j] ^ U[j];
    AES128Enc(AESInputBlock, AESOutputBlock);
    for (i = 0; i < l - 1; i++) {
      Times2(NextZ, Double);
      for (j = 0; j < 16; j++) {
        AESInputBlock[j] = AESOutputBlock[j] ^ c[i * 16 + j];
        m[i * 16 + j] = AESInputBlock[j] ^ Double[j] ^ U[j];
        NextZ[j] = Double[j];
      }
      AES128Enc(AESInputBlock, AESOutputBlock);
    }
    if (clen % 16 != 0) {
      for (j = 0; j < clen % 16; j++) {
        m[(l - 1) * 16 + j] = AESOutputBlock[j] ^ c[(l - 1) * 16 + j];
        StolenR[j] = 0x0;
      }
      for (j = (clen % 16); j < 16; j++)
        StolenR[j] = AESOutputBlock[j] ^ PaddedBlock[j];
    } else {
      for (j = 0; j < 16; j++) {
        m[(l - 1) * 16 + j] = AESOutputBlock[j] ^ c[(l - 1) * 16 + j];
        StolenR[j] = 0x0;
      }
    }
    if (clen % 16 != 0) {
      for (j = 0; j < (clen % 16); j++)
        AESInputBlock[j] = m[(l - 1) * 16 + j] ^ Z[1][j] ^ U[j];
      for (j = (clen % 16); j < 16; j++)
        AESInputBlock[j] = StolenR[j] ^ Z[1][j] ^ U[j];
      AES128Enc(AESInputBlock, AESOutputBlock);
      for (j = 0; j < 16; j++) {
        if (c[(l - 1) * 16 + clen % 16 + j] != (AESOutputBlock[j] ^ MacAESTag[j]))
          return -1;
      }
    } else {
      for (j = 0; j < 16; j++)
        AESInputBlock[j] = m[(l - 1) * 16 + j] ^ Z[2][j] ^ U[j];
      AES128Enc(AESInputBlock, AESOutputBlock);
      for (j = 0; j < 16; j++) {
        if (c[l * 16 + j] != (AESOutputBlock[j] ^ MacAESTag[j]))
          return -1;
      }
    }
  }
  return 0;
}
```