N3DS 9.5 decrypt

//Decrypts N3DS 9.5 arm9bin by passing arm9 header address to it.
void decryptArm9Bin(void *armHdr){
    unsigned char keyX[0x10];
    unsigned char keyY[0x10];
    unsigned char CTR[0x10];
    memcpy(keyY, armHdr+0x10, 0x10);
    memcpy(CTR, armHdr+0x20, 0x10);
    size_t size = atoi(armHdr+0x30);

    aes_use_keyslot(0x11);
    aes(keyX, armHdr+0x60, 1, NULL, AES_ECB_DECRYPT_MODE, 0);

    aes_setkey(0x16, keyX, AES_KEYX, AES_INPUT_BE | AES_INPUT_NORMAL);
    aes_setkey(0x16, keyY, AES_KEYY, AES_INPUT_BE | AES_INPUT_NORMAL);
    aes_setiv(CTR, AES_INPUT_BE | AES_INPUT_NORMAL);
    aes_use_keyslot(0x16);

    aes(armHdr+0x800, armHdr+0x800, size/AES_BLOCK_SIZE, CTR, AES_CTR_MODE, AES_INPUT_BE | AES_INPUT_NORMAL);
}