// File: /workspace/github_c_makefile_star2_O3/mjosaarinen[P]brutus/crypto_aead/shellaes128v1d5n64/ref/shellaes.c
// Function: XLS
void XLS(const u32 rk[], const u8 Lprime[], const u8 p[], unsigned long long int fb_ptlen, unsigned int nfb_ptlen, u8 c[], u8 tag[]){
    u8 mask1[16], mask2[16];
    u8 temp[16];
    u8 pt[16], ct[16], byte1[nfb_ptlen], byte2[nfb_ptlen];
    int i;

    /*produce mask 3^2*Lprime, and save it to mask1[]*/
    memcpy(mask1, Lprime, 16);
    for(i=0; i<2; ++i){
        memcpy(temp, mask1, 16);
        double_mask(mask1);
        xor_byte_string(temp, mask1, 16);
    }

    /*produce mask 7^2*Lprime, and save it to mask2[]*/
    memcpy(mask2, Lprime, 16);
    for(i=0; i<2; ++i){
        memcpy(temp, mask2, 16);
        double_mask(mask2);
        xor_byte_string(mask2, temp, 16);
        double_mask(mask2);
        xor_byte_string(temp, mask2, 16);
    }

    /*produce the masks for E' and E'', and save them to mask1[] and mask2[] respectively*/
    while(fb_ptlen!=0){
        double_mask(mask1);
        double_mask(mask2);
        fb_ptlen-=16;
    }
    double_mask(mask1);
    double_mask(mask2);

    /*First round of XLS*/

    memcpy(pt, p, nfb_ptlen);
    memcpy(pt+nfb_ptlen, tag, 16-nfb_ptlen);

    /*apply E'*/
    xor_byte_string(mask1, pt, 16);
    aesEncrypt(rk, pt, ct);
    xor_byte_string(mask1, ct, 16);

    /*flip one bit*/
    ct[15-nfb_ptlen]^=0x01;

    memcpy(byte1, ct+16-nfb_ptlen, nfb_ptlen);
    memcpy(byte2, tag+16-nfb_ptlen, nfb_ptlen);

    /*MIX function*/
    MIX(byte1, byte2, nfb_ptlen);

    memcpy(ct+16-nfb_ptlen, byte1, nfb_ptlen);

    memcpy(pt, ct, 16);

    /*Second round of XLS*/

    /*apply E''*/
    xor_byte_string(mask2, pt, 16);
    aesEncrypt(rk, pt, ct);
    xor_byte_string(mask2, ct, 16);

    ct[15-nfb_ptlen]^=0x01;

    memcpy(byte1, ct+16-nfb_ptlen, nfb_ptlen);
    MIX(byte1, byte2, nfb_ptlen);

    memcpy(ct+16-nfb_ptlen, byte1, nfb_ptlen);
    memcpy(pt, ct, 16);

    /*the third round of XLS*/

    xor_byte_string(mask1, pt, 16);
    aesEncrypt(rk, pt, ct);
    xor_byte_string(mask1, ct, 16);

    /*produce ciphertext and tag*/
    memcpy(c, ct, nfb_ptlen);
    memcpy(tag, ct+nfb_ptlen, 16-nfb_ptlen);
    memcpy(tag+16-nfb_ptlen, byte2, nfb_ptlen);

}

// Assembly:
pushq %rbp
movq %rsp, %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0xa8, %rsp
movq %r9, -0xb8(%rbp)
movl %r8d, %r12d
movq %rdi, %r13
movq %rsp, -0xc0(%rbp)
movl %r8d, %ebx
movq %rsp, %rdi
leaq 0xf(%rbx), %rax
andq $-0x10, %rax
subq %rax, %rdi
movq %rdi, -0x98(%rbp)
movq %rdi, %rsp
movq %rsp, %rdi
subq %rax, %rdi
movq %rdi, -0xb0(%rbp)
movq %rdi, %rsp
vmovups (%rsi), %xmm0
vmovaps %xmm0, -0x50(%rbp)
movb $0x1, %al
vmovaps -0x50(%rbp), %xmm0
movl $0xf, %r8d
movb -0x50(%rbp), %dil
xorl %r9d, %r9d
movb -0x50(%rbp,%r8), %r10b
leal (%r10,%r10), %r11d
orb %r9b, %r11b
movb %r11b, -0x50(%rbp,%r8)
shrb $0x7, %r10b
movl %r10d, %r9d
addq $-0x1, %r8
jb 0x5db6
testb %dil, %dil
jns 0x5ddd
xorb $-0x79, -0x41(%rbp)
vxorps -0x50(%rbp), %xmm0, %xmm0
vmovaps %xmm0, -0x50(%rbp)
testb $0x1, %al
movl $0x0, %eax
jne 0x5da4
vmovups (%rsi), %xmm0
vmovaps %xmm0, -0x40(%rbp)
movb $0x1, %al
vmovaps -0x40(%rbp), %xmm0
movl $0xf, %edi
movb -0x40(%rbp), %sil
xorl %r8d, %r8d
movb -0x40(%rbp,%rdi), %r9b
leal (%r9,%r9), %r10d
orb %r8b, %r10b
movb %r10b, -0x40(%rbp,%rdi)
shrb $0x7, %r9b
movl %r9d, %r8d
addq $-0x1, %rdi
jb 0x5e0c
testb %sil, %sil
jns 0x5e33
xorb $-0x79, -0x31(%rbp)
vxorps -0x40(%rbp), %xmm0, %xmm0
movl $0xf, %edi
movb -0x40(%rbp), %sil
xorl %r8d, %r8d
movb -0x40(%rbp,%rdi), %r9b
leal (%r9,%r9), %r10d
orb %r8b, %r10b
movb %r10b, -0x40(%rbp,%rdi)
shrb $0x7, %r9b
movl %r9d, %r8d
addq $-0x1, %rdi
jb 0x5e44
testb %sil, %sil
jns 0x5e6b
xorb $-0x79, -0x31(%rbp)
vxorps -0x40(%rbp), %xmm0, %xmm0
vmovaps %xmm0, -0x40(%rbp)
testb $0x1, %al
movl $0x0, %eax
jne 0x5dfb
testq %rcx, %rcx
je 0x5eed
movl $0xf, %esi
movb -0x50(%rbp), %al
xorl %edi, %edi
movb -0x50(%rbp,%rsi), %r8b
leal (%r8,%r8), %r9d
orb %dil, %r9b
movb %r9b, -0x50(%rbp,%rsi)
shrb $0x7, %r8b
movl %r8d, %edi
addq $-0x1, %rsi
jb 0x5e91
testb %al, %al
jns 0x5eb7
xorb $-0x79, -0x41(%rbp)
movl $0xf, %esi
movb -0x40(%rbp), %al
xorl %edi, %edi
movb -0x40(%rbp,%rsi), %r8b
leal (%r8,%r8), %r9d
orb %dil, %r9b
movb %r9b, -0x40(%rbp,%rsi)
shrb $0x7, %r8b
movl %r8d, %edi
addq $-0x1, %rsi
jb 0x5ec1
testb %al, %al
jns 0x5ee7
xorb $-0x79, -0x31(%rbp)
addq $-0x10, %rcx
jne 0x5e87
movl $0xf, %ecx
movb -0x50(%rbp), %al
xorl %esi, %esi
movb -0x50(%rbp,%rcx), %dil
leal (%rdi,%rdi), %r8d
orb %sil, %r8b
movb %r8b, -0x50(%rbp,%rcx)
shrb $0x7, %dil
movl %edi, %esi
addq $-0x1, %rcx
jb 0x5ef7
testb %al, %al
jns 0x5f1c
xorb $-0x79, -0x41(%rbp)
movl $0xf, %ecx
movb -0x40(%rbp), %al
xorl %esi, %esi
movb -0x40(%rbp,%rcx), %dil
leal (%rdi,%rdi), %r8d
orb %sil, %r8b
movb %r8b, -0x40(%rbp,%rcx)
shrb $0x7, %dil
movl %edi, %esi
addq $-0x1, %rcx
jb 0x5f26
testb %al, %al
jns 0x5f4b
xorb $-0x79, -0x31(%rbp)
leaq -0x90(%rbp), %r15
movq %r15, %rdi
movq %rdx, %rsi
movq %rbx, %rdx
callq 0x2240
leaq (%rbx,%rbp), %rdi
addq $-0x90, %rdi
movl $0x10, %edx
subl %r12d, %edx
movq %rdx, -0xa8(%rbp)
movq 0x10(%rbp), %r14
movq %r14, %rsi
callq 0x2240
vmovaps -0x50(%rbp), %xmm0
vmovaps %xmm0, -0x80(%rbp)
movq %r15, %rsi
vxorps (%r15), %xmm0, %xmm0
vmovaps %xmm0, (%r15)
leaq -0x60(%rbp), %r15
movq %r13, %rdi
movq %r15, %rdx
callq 0x21e0
vmovaps -0x80(%rbp), %xmm0
vxorps (%r15), %xmm0, %xmm0
vmovaps %xmm0, (%r15)
movq %r13, -0x80(%rbp)
movl $0xf, %eax
subl %r12d, %eax
movq %rax, -0xa0(%rbp)
xorb $0x1, -0x60(%rbp,%rax)
movl %r12d, -0x70(%rbp)
movq %r15, %r12
subq %rbx, %r12
addq $0x10, %r12
movq -0x98(%rbp), %r13
movq %r13, %rdi
movq %r12, %rsi
movq %rbx, %rdx
callq 0x2240
movq %r14, %r15
subq %rbx, %r15
addq $0x10, %r15
movq -0xb0(%rbp), %r14
movq %r14, %rdi
movq %r15, %rsi
movq %rbx, %rdx
callq 0x2240
movq %r13, %rdi
movq %r14, %rsi
movl -0x70(%rbp), %edx
callq 0x2190
movq %r12, %rdi
movq %r13, %rsi
movq %rbx, %rdx
callq 0x2240
vmovaps -0x40(%rbp), %xmm0
vmovaps %xmm0, -0xd0(%rbp)
leaq -0x60(%rbp), %rdx
vxorps (%rdx), %xmm0, %xmm0
leaq -0x90(%rbp), %rsi
vmovaps %xmm0, (%rsi)
movq -0x80(%rbp), %rdi
callq 0x21e0
leaq -0x60(%rbp), %rax
vmovaps -0xd0(%rbp), %xmm0
vxorps (%rax), %xmm0, %xmm0
vmovaps %xmm0, (%rax)
movq -0xa0(%rbp), %rax
xorb $0x1, -0x60(%rbp,%rax)
movq %r13, %rdi
movq %r12, %rsi
movq %rbx, %rdx
callq 0x2240
movq %r13, %rdi
movq %r14, %rsi
movl -0x70(%rbp), %edx
callq 0x2190
movq %r12, %rdi
movq %r13, %rsi
movq %rbx, %rdx
callq 0x2240
vmovaps -0x50(%rbp), %xmm0
vmovaps %xmm0, -0x70(%rbp)
leaq -0x60(%rbp), %rdx
vxorps (%rdx), %xmm0, %xmm0
leaq -0x90(%rbp), %rsi
vmovaps %xmm0, (%rsi)
movq -0x80(%rbp), %rdi
movq %rdx, %r12
callq 0x21e0
movq %r12, %rsi
vmovaps -0x70(%rbp), %xmm0
vxorps (%r12), %xmm0, %xmm0
vmovaps %xmm0, (%r12)
movq -0xb8(%rbp), %rdi
movq %rbx, %rdx
callq 0x2240
leaq (%rbx,%rbp), %rsi
addq $-0x60, %rsi
movq 0x10(%rbp), %rdi
movq -0xa8(%rbp), %rdx
callq 0x2240
movq %r15, %rdi
movq %r14, %rsi
movq %rbx, %rdx
callq 0x2240
movq -0xc0(%rbp), %rsp
leaq -0x28(%rbp), %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq