// File: /workspace/github_c_makefile_star2_O3/mjosaarinen[P]brutus/crypto_aead/aegis128l/ref/ecrypt.c
// Function: aegis128L_tag_generation
void aegis128L_tag_generation(unsigned long msglen, unsigned long adlen, unsigned char maclen, unsigned char *mac, unsigned char *state)
{
        int i;

        unsigned char tmp[16];
        unsigned char msgtmp[16];

        ((unsigned long long*)msgtmp)[0] = adlen << 3;
        ((unsigned long long*)msgtmp)[1] = msglen << 3;

        XOR128(msgtmp, msgtmp, state+32);

        for (i = 0; i < 7; i++) {
            //state update function
            memcpy(tmp, state+112, 16);
            AESROUND(state+112,state+96, state+112);
            AESROUND(state+96, state+80, state+96);
            AESROUND(state+80, state+64, state+80);
            AESROUND(state+64, state+48, state+64);
            AESROUND(state+48, state+32, state+48);
            AESROUND(state+32, state+16, state+32);
            AESROUND(state+16, state+0,  state+16);
            AESROUND(state+0,  tmp,      state+0);

            //message is used to update the state.
            XOR128(state,    state,    msgtmp);
            XOR128(state+64, state+64, msgtmp);
        }

        XOR128(state+96, state+96, state+80);
        XOR128(state+96, state+96, state+64);
        XOR128(state+96, state+96, state+48);
        XOR128(state+96, state+96, state+32);
        XOR128(state+96, state+96, state+16);
        XOR128(state+96, state+96, state+0);

        //in this program, the mac length is assumed to be multiple of bytes
        memcpy(mac,state+96,maclen);
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x68, %rsp
movq %r8, %r15
movq %rcx, 0x30(%rsp)
movl %edx, 0xc(%rsp)
vmovq %rdi, %xmm0
vmovq %rsi, %xmm1
vpunpcklqdq %xmm0, %xmm1, %xmm0 # xmm0 = xmm1[0],xmm0[0]
vpsllq $0x3, %xmm0, %xmm0
leaq 0x20(%r8), %rax
movq %rax, 0x20(%rsp)
vpxor 0x20(%r8), %xmm0, %xmm0
vmovdqa %xmm0, 0x40(%rsp)
leaq 0x70(%r8), %rax
movq %rax, 0x38(%rsp)
leaq 0x60(%r8), %rax
movq %rax, 0x28(%rsp)
leaq 0x50(%r8), %rax
movq %rax, 0x10(%rsp)
leaq 0x40(%r8), %r12
leaq 0x30(%r8), %r14
leaq 0x10(%r8), %rax
movq %rax, 0x18(%rsp)
movl $0x7, %ebx
movq 0x38(%rsp), %rdi
vmovups (%rdi), %xmm0
vmovaps %xmm0, 0x50(%rsp)
movq 0x28(%rsp), %r13
movq %r13, %rsi
movq %rdi, %rdx
callq 0x1050
movq %r13, %rdi
movq 0x10(%rsp), %rbp
movq %rbp, %rsi
movq %r13, %rdx
callq 0x1050
movq %rbp, %rdi
movq %r12, %rsi
movq %rbp, %rdx
callq 0x1050
movq %r12, %rdi
movq %r14, %rsi
movq %r12, %rdx
callq 0x1050
movq %r14, %rdi
movq 0x20(%rsp), %r13
movq %r13, %rsi
movq %r14, %rdx
callq 0x1050
movq %r13, %rdi
movq 0x18(%rsp), %rbp
movq %rbp, %rsi
movq %r13, %rdx
callq 0x1050
movq %rbp, %rdi
movq %r15, %rsi
movq %rbp, %rdx
callq 0x1050
movq %r15, %rdi
leaq 0x50(%rsp), %rsi
movq %r15, %rdx
callq 0x1050
vmovdqa 0x40(%rsp), %xmm1
vpxor (%r15), %xmm1, %xmm0
vmovdqu %xmm0, (%r15)
vpxor 0x40(%r15), %xmm1, %xmm1
vmovdqu %xmm1, 0x40(%r15)
decl %ebx
jne 0x14af
movq 0x10(%rsp), %rax
vmovdqu (%rax), %xmm2
vmovdqu (%r14), %xmm3
movq 0x28(%rsp), %rsi
vpternlogq $0x96, (%rsi), %xmm2, %xmm3
movq 0x18(%rsp), %rax
vmovdqu (%rax), %xmm2
movq 0x20(%rsp), %rax
vpternlogq $0x96, (%rax), %xmm3, %xmm2
vpternlogq $0x96, %xmm1, %xmm2, %xmm0
vmovdqu %xmm0, (%rsi)
movzbl 0xc(%rsp), %edx
movq 0x30(%rsp), %rdi
callq 0x10c0
addq $0x68, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq