def _decrypt_queue_message(message, require_encryption, key_encryption_key, resolver):
try:<EOL><INDENT>message = loads(message)<EOL>encryption_data = _dict_to_encryption_data(message['<STR_LIT>'])<EOL>decoded_data = _decode_base64_to_bytes(message['<STR_LIT>'])<EOL><DEDENT>except (KeyError, ValueError) as e:<EOL><INDENT>if require_encryption:<EOL><INDENT>raise ValueError(_ERROR_MESSAGE_NOT_ENCRYPTED)<EOL><DEDENT>else:<EOL><INDENT>return message<EOL><DEDENT><DEDENT>try:<EOL><INDENT>return _decrypt(decoded_data, encryption_data, key_encryption_key, resolver).decode('<STR_LIT:utf-8>')<EOL><DEDENT>except Exception as e:<EOL><INDENT>raise AzureException(_ERROR_DECRYPTION_FAILURE)<EOL><DEDENT>
Returns the decrypted message contents from an EncryptedQueueMessage.
If no encryption metadata is present, will return the unaltered message.
:param str message:
    The JSON formatted QueueEncryptedMessage contents with all associated metadata.
:param bool require_encryption:
    If set, will enforce that the retrieved messages are encrypted and decrypt them.
:param object key_encryption_key:
    The user-provided key-encryption-key. Must implement the following methods:
    unwrap_key(key, algorithm)--returns the unwrapped form of the specified symmetric key using the string-specified algorithm.
    get_kid()--returns a string key id for this key-encryption-key.
:param function resolver(kid):
    The user-provided key resolver. Uses the kid string to return a key-encryption-key implementing the interface defined above.
:return: The plain text message from the queue message.
:rtype: str