// File: /workspace/github_c_makefile_star2_O2/mjosaarinen[P]brutus/crypto_aead/aezv3/ref/aez_ref.c
// Function: AEZcore
static void AEZcore(byte *K, unsigned kbytes, byte delta[16],
                        byte *in, unsigned inbytes, unsigned d, byte *out) {
    byte tmp[16], X[16], Y[16], S[16];
    byte *in_orig = in, *out_orig = out;
    unsigned j, inbytes_orig = inbytes;

    memset(X,0,16); memset(Y,0,16);
    
    /* Pass 1 over in[0:-32], store intermediate values in out[0:-32] */
    for (j=1; inbytes >= 64; j++, inbytes-=32, in+=32, out+=32) {
        E(K, kbytes, 1, j, in+16, tmp); xor_bytes(in, tmp, 16, out);
        E(K, kbytes, 0, 0, out, tmp); xor_bytes(in+16, tmp, 16, out+16);
        xor_bytes(out+16, X, 16, X);
    }

    /* Finish X calculation */
    inbytes -= 32;                /* inbytes now has fragment length 0..31 */
    if (inbytes >= 16) {
        E(K, kbytes, 0, 4, in, tmp); xor_bytes(X, tmp, 16, X);
        inbytes -= 16; in += 16; out += 16;
        memset(tmp,0,16); memcpy(tmp,in,inbytes); tmp[inbytes] = 0x80;
        E(K, kbytes, 0, 5, tmp, tmp); xor_bytes(X, tmp, 16, X);
    } else if (inbytes > 0) {
        memset(tmp,0,16); memcpy(tmp,in,inbytes); tmp[inbytes] = 0x80;
        E(K, kbytes, 0, 4, tmp, tmp); xor_bytes(X, tmp, 16, X);
    }
    in += inbytes; out += inbytes;

    /* Calculate S */
    E(K, kbytes, 0, 1+d, in+16, tmp);
    xor_bytes(X, in, 16, out);
    xor_bytes(delta, out, 16, out);
    xor_bytes(tmp, out, 16, out);
    E(K, kbytes, -1, 1+d, out, tmp);
    xor_bytes(in+16, tmp, 16, out+16);
    xor_bytes(out, out+16, 16, S);

    /* Pass 2 over intermediate values in out[32..]. Final values written */
    inbytes = inbytes_orig; out = out_orig; in = in_orig;
    for (j=1; inbytes >= 64; j++, inbytes-=32, in+=32, out+=32) {
        E(K, kbytes, 2, j, S, tmp);
        xor_bytes(out, tmp, 16, out); xor_bytes(out+16, tmp, 16, out+16);
        xor_bytes(out, Y, 16, Y);
        E(K, kbytes, 0, 0, out+16, tmp); xor_bytes(out, tmp, 16, out);
        E(K, kbytes, 1, j, out, tmp); xor_bytes(out+16, tmp, 16, out+16);
        memcpy(tmp, out, 16); memcpy(out, out+16, 16); memcpy(out+16, tmp, 16);
    }

    /* Finish Y calculation and finish encryption of fragment bytes */
    inbytes -= 32;                /* inbytes now has fragment length 0..31 */
    if (inbytes >= 16) {
        E(K, kbytes, -1, 4, S, tmp); xor_bytes(in, tmp, 16, out);
        E(K, kbytes, 0, 4, out, tmp); xor_bytes(Y, tmp, 16, Y);
        inbytes -= 16; in += 16; out += 16;
        E(K, kbytes, -1, 5, S, tmp); xor_bytes(in, tmp, inbytes, tmp);
        memcpy(out,tmp,inbytes);
        memset(tmp+inbytes,0,16-inbytes); tmp[inbytes] = 0x80;
        E(K, kbytes, 0, 5, tmp, tmp); xor_bytes(Y, tmp, 16, Y);
    } else if (inbytes > 0) {
        E(K, kbytes, -1, 4, S, tmp); xor_bytes(in, tmp, inbytes, tmp);
        memcpy(out,tmp,inbytes);
        memset(tmp+inbytes,0,16-inbytes); tmp[inbytes] = 0x80;
        E(K, kbytes, 0, 4, tmp, tmp); xor_bytes(Y, tmp, 16, Y);
    }
    in += inbytes; out += inbytes;

    /* Finish encryption of last two blocks */
    E(K, kbytes, -1, 2-d, out+16, tmp);
    xor_bytes(out, tmp, 16, out);
    E(K, kbytes, 0, 2-d, out, tmp);
    xor_bytes(tmp, out+16, 16, out+16);
    xor_bytes(delta, out+16, 16, out+16);
    xor_bytes(Y, out+16, 16, out+16);
    memcpy(tmp, out, 16); memcpy(out, out+16, 16); memcpy(out+16, tmp, 16);
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x98, %rsp
movq %r9, 0x50(%rsp)
movq %rdx, 0x58(%rsp)
movl %esi, 0x8(%rsp)
movq %rdi, 0x30(%rsp)
movq 0xd0(%rsp), %rbp
vxorps %xmm0, %xmm0, %xmm0
leaq 0x80(%rsp), %rax
vmovaps %xmm0, (%rax)
vmovaps %xmm0, 0x70(%rsp)
pushq $0x1
popq %rax
leaq 0x20(%rsp), %rdi
xorl %r15d, %r15d
movq %r8, 0x38(%rsp)
movl %r8d, %edx
movq %rcx, 0x40(%rsp)
leaq (%r15,%rbp), %r12
leaq (%rcx,%r15), %r8
cmpl $0x40, %edx
jb 0x2319
leaq (%rcx,%r15), %r9
addq $0x10, %r9
movq %r9, 0x48(%rsp)
movq 0x30(%rsp), %rbp
movq %rdi, 0x10(%rsp)
movq %rbp, %rdi
movl 0x8(%rsp), %ebx
movl %ebx, %esi
movl %edx, 0x18(%rsp)
pushq $0x1
popq %rdx
movl %eax, %ecx
movq %r8, %r14
movq %r9, %r8
movq %r15, %r13
leaq 0x20(%rsp), %r15
movq %r15, %r9
movl %eax, 0xc(%rsp)
callq 0x17ac
movq %r14, %rdi
movq %r15, %rsi
pushq $0x10
popq %r14
movl %r14d, %edx
movq %r12, %rcx
callq 0x1d24
movq %rbp, %rdi
movq 0xd0(%rsp), %rbp
movl %ebx, %esi
xorl %edx, %edx
xorl %ecx, %ecx
movq %r12, %r8
movq %r15, %r9
callq 0x17ac
leaq 0x10(,%r13), %rbx
addq %rbp, %rbx
movq 0x48(%rsp), %rdi
movq %r15, %rsi
movq %r13, %r15
movl %r14d, %edx
movq %rbx, %rcx
callq 0x1d24
movq %rbx, %rdi
leaq 0x80(%rsp), %rcx
movq %rcx, %rsi
movl %r14d, %edx
callq 0x1d24
movl 0xc(%rsp), %eax
movl 0x18(%rsp), %edx
movq 0x10(%rsp), %rdi
movq 0x40(%rsp), %rcx
incl %eax
addl $-0x20, %edx
addq $0x20, %r15
addq $-0x20, %rdi
jmp 0x2239
movq %r12, 0x10(%rsp)
movq 0x38(%rsp), %r14
leal -0x20(%r14), %eax
movq %rax, %r13
subq %r15, %r13
cmpl $0x10, %r13d
movq 0x30(%rsp), %rbx
movq %rax, 0x48(%rsp)
jb 0x23c2
leaq (%rcx,%r15), %rax
addq $0x10, %rax
movq %rax, 0x18(%rsp)
pushq $0x4
popq %rcx
leaq 0x20(%rsp), %r13
movq %rbx, %rdi
movl 0x8(%rsp), %r12d
movl %r12d, %esi
xorl %edx, %edx
movq %r13, %r9
callq 0x17ac
pushq $0x10
popq %rdx
leaq 0x80(%rsp), %rcx
movq %rcx, %rdi
movq %r13, %rsi
callq 0x1d24
leal -0x30(%r14), %r13d
subq %r15, %r13
leaq (%r15,%rbp), %rax
addq $0x10, %rax
movq %rax, 0x10(%rsp)
movl %r12d, %r15d
vxorps %xmm0, %xmm0, %xmm0
leaq 0x20(%rsp), %rdi
vmovaps %xmm0, (%rdi)
movl %r13d, %r14d
movq 0x18(%rsp), %r12
movq %r12, %rsi
movq %r14, %rdx
callq 0x10d0
pushq $0x5
popq %rcx
movq %r12, 0x18(%rsp)
jmp 0x2417
cmpl %r15d, %eax
jne 0x23d6
xorl %r12d, %r12d
movl 0x8(%rsp), %r15d
movq 0x30(%rsp), %rbx
jmp 0x2453
pushq $0x4
popq %rbx
movq %rax, %r14
subq %r15, %r14
subq %rax, %r15
addq $0x10, %r15
addq %rax, %rdi
xorl %esi, %esi
movq %r15, %rdx
movq %r8, %r15
callq 0x1040
leaq 0x20(%rsp), %rdi
movq %r15, 0x18(%rsp)
movq %r15, %rsi
movq %r14, %rdx
callq 0x10d0
movl %ebx, %ecx
movl 0x8(%rsp), %r15d
movq 0x30(%rsp), %rbx
movb $-0x80, 0x20(%rsp,%r14)
leaq 0x20(%rsp), %r14
movq %rbx, %rdi
movl %r15d, %esi
xorl %edx, %edx
movq %r14, %r8
movq %r14, %r9
callq 0x17ac
pushq $0x10
popq %rdx
leaq 0x80(%rsp), %rcx
movq %rcx, %rdi
movq %r14, %rsi
callq 0x1d24
movl %r13d, %r12d
movq 0x18(%rsp), %r8
movq 0x10(%rsp), %rax
leaq (%rax,%r12), %r14
movq 0x50(%rsp), %rax
leal 0x1(%rax), %ecx
movl %ecx, 0xc(%rsp)
leaq (%r8,%r12), %rax
addq $0x10, %rax
movq %rax, 0x18(%rsp)
addq %r12, %r8
xorl %r13d, %r13d
leaq 0x20(%rsp), %r9
movq %rbx, %rdi
movl %r15d, %esi
xorl %edx, %edx
movq %r8, %rbx
movq %rax, %r8
callq 0x17ac
leaq 0x80(%rsp), %rdi
pushq $0x10
popq %r15
movq %rbx, %rsi
movl %r15d, %edx
movq %r14, %rcx
callq 0x1d24
movq 0x58(%rsp), %rdi
movq %r14, %rsi
movl %r15d, %edx
movq %r14, %rcx
callq 0x1d24
leaq 0x20(%rsp), %rdi
movq %r14, %rsi
movl %r15d, %edx
movq %r14, %rcx
callq 0x1d24
pushq $-0x1
popq %rdx
movq 0x30(%rsp), %rdi
movl 0x8(%rsp), %esi
movl 0xc(%rsp), %ecx
movq %r14, %r8
leaq 0x20(%rsp), %r9
callq 0x17ac
movq 0x10(%rsp), %rax
leaq (%rax,%r12), %rbx
addq $0x10, %rbx
movq 0x18(%rsp), %rdi
leaq 0x20(%rsp), %rsi
movl %r15d, %edx
movq %rbx, %rcx
callq 0x1d24
leaq 0x60(%rsp), %rcx
movq %r14, %rdi
movq %rbx, %rsi
movl %r15d, %edx
callq 0x1d24
pushq $0x1
popq %rbx
movq 0x38(%rsp), %rax
movq 0x30(%rsp), %r15
movq %rbp, %r12
addq %r13, %r12
cmpl $0x40, %eax
movq %r13, 0x18(%rsp)
jb 0x2655
movq %r15, %rdi
movl 0x8(%rsp), %r13d
movl %r13d, %esi
pushq $0x2
popq %rdx
movl %ebx, 0x10(%rsp)
movl 0x10(%rsp), %ecx
leaq 0x60(%rsp), %r8
leaq 0x20(%rsp), %rbx
movq %rbx, %r9
movl %eax, 0xc(%rsp)
callq 0x17ac
movq %r12, %rdi
movq %rbx, %rsi
movq %r12, %r14
pushq $0x10
popq %r12
movl %r12d, %edx
movq %r14, %rcx
callq 0x1d24
movq 0xd0(%rsp), %rax
movq 0x18(%rsp), %rcx
leaq (%rax,%rcx), %rbp
addq $0x10, %rbp
movq %rbp, %rdi
movq %rbx, %rsi
movl %r12d, %edx
movq %rbp, %rcx
callq 0x1d24
movq %r14, %rdi
leaq 0x70(%rsp), %rcx
movq %rcx, %rsi
movl %r12d, %edx
callq 0x1d24
movq %r15, %rdi
movl %r13d, %esi
xorl %edx, %edx
xorl %ecx, %ecx
movq %rbp, %r8
movq %rbx, %r9
callq 0x17ac
movq %r14, %rdi
movq %rbx, %rsi
movl %r12d, %edx
movq %r14, %rcx
callq 0x1d24
movq %r15, %rdi
movl %r13d, %esi
movq 0x18(%rsp), %r13
pushq $0x1
popq %rdx
movl 0x10(%rsp), %ecx
movq %r14, %r8
movq %rbx, %r9
callq 0x17ac
movq %rbp, %rdi
movq %rbx, %rsi
movl %r12d, %edx
movq %rbp, %rcx
callq 0x1d24
movl 0x10(%rsp), %ebx
movl 0xc(%rsp), %eax
vmovups (%r14), %xmm0
vmovaps %xmm0, 0x20(%rsp)
vmovups (%rbp), %xmm0
vmovups %xmm0, (%r14)
vmovaps 0x20(%rsp), %xmm0
vmovups %xmm0, (%rbp)
movq 0xd0(%rsp), %rbp
incl %ebx
addl $-0x20, %eax
addq $0x20, %r13
jmp 0x2532
movq 0x48(%rsp), %r14
movq %r14, %r15
subq %r13, %r15
movq 0x40(%rsp), %rax
leaq (%rax,%r13), %rbx
cmpl $0x10, %r15d
jb 0x275f
pushq $-0x1
popq %rdx
pushq $0x4
popq %rcx
leaq 0x60(%rsp), %r8
leaq 0x20(%rsp), %r14
movq %rbx, %r15
movq %r12, %rbx
movq 0x30(%rsp), %r12
movq %r12, %rdi
movl 0x8(%rsp), %r13d
movl %r13d, %esi
movq %r14, %r9
callq 0x17ac
pushq $0x10
popq %rbp
movq %r15, %rdi
movq %r14, %rsi
movl %ebp, %edx
movq %rbx, %rcx
callq 0x1d24
movq %r12, %rdi
movl %r13d, %esi
xorl %edx, %edx
pushq $0x4
popq %rcx
movq %rbx, %r8
movq %r14, %r9
callq 0x17ac
leaq 0x70(%rsp), %rcx
movq %rcx, %rdi
movq %r14, %rsi
movl %ebp, %edx
callq 0x1d24
movq 0x38(%rsp), %rbp
leal -0x30(%rbp), %r15d
movq 0x18(%rsp), %r14
subq %r14, %r15
movq 0x40(%rsp), %rax
addq %r14, %rax
addq $0x10, %rax
movq %rax, 0x10(%rsp)
movq 0xd0(%rsp), %rax
leaq 0x10(%rax,%r14), %rbx
movq %r12, %rdi
movl %r13d, %esi
pushq $-0x1
popq %rdx
pushq $0x5
popq %rcx
movl %ecx, 0xc(%rsp)
leaq 0x60(%rsp), %r8
leaq 0x20(%rsp), %r9
callq 0x17ac
movq 0x10(%rsp), %rdi
movq %r14, %r13
leaq 0x20(%rsp), %rcx
movq %rcx, %rsi
movl %r15d, %edx
callq 0x1d24
movl %r15d, %r14d
movq %rbx, 0x10(%rsp)
movq %rbx, %rdi
leaq 0x20(%rsp), %rsi
movq %r14, %rdx
callq 0x10d0
pushq $0x40
popq %rax
jmp 0x27d2
movq %r12, 0x10(%rsp)
cmpl 0x18(%rsp), %r14d
movl 0x8(%rsp), %ebp
jne 0x277b
xorl %eax, %eax
movq 0x30(%rsp), %r12
jmp 0x2824
pushq $-0x1
popq %rdx
pushq $0x4
popq %rcx
leaq 0x60(%rsp), %r8
movl %ebp, %esi
leaq 0x20(%rsp), %rbp
movq 0x30(%rsp), %r12
movq %r12, %rdi
movl %ecx, 0xc(%rsp)
movq %rbp, %r9
callq 0x17ac
movq %rbx, %rdi
movq %rbp, %rsi
movl %r15d, %edx
movq %rbp, %rcx
callq 0x1d24
movq 0x18(%rsp), %r13
subq %r13, %r14
movq 0x10(%rsp), %rdi
movq %rbp, %rsi
movq %r14, %rdx
callq 0x10d0
pushq $0x30
popq %rax
movq 0x38(%rsp), %rbp
addq %rsp, %r14
addq $0x20, %r14
subl %ebp, %eax
addl %eax, %r13d
movq %r14, %rdi
xorl %esi, %esi
movq %r13, %rdx
callq 0x1040
movb $-0x80, (%r14)
leaq 0x20(%rsp), %r14
movq %r12, %rdi
movl 0x8(%rsp), %ebp
movl %ebp, %esi
xorl %edx, %edx
movl 0xc(%rsp), %ecx
movq %r14, %r8
movq %r14, %r9
callq 0x17ac
pushq $0x10
popq %rdx
leaq 0x70(%rsp), %rcx
movq %rcx, %rdi
movq %r14, %rsi
callq 0x1d24
movl %r15d, %eax
movq 0x10(%rsp), %rcx
leaq (%rcx,%rax), %r15
pushq $0x2
popq %r13
subl 0x50(%rsp), %r13d
leaq (%rcx,%rax), %rbx
addq $0x10, %rbx
pushq $-0x1
popq %rdx
leaq 0x20(%rsp), %r14
movq %r12, %rdi
movl %ebp, %esi
movl %r13d, %ecx
movq %rbx, %r8
movq %r14, %r9
callq 0x17ac
pushq $0x10
popq %rdx
movq %r15, %rdi
movq %r14, %rsi
movq %r15, %rcx
callq 0x1d24
movq %r12, %rdi
movl %ebp, %esi
xorl %edx, %edx
movl %r13d, %ecx
movq %r15, %r8
movq %r14, %r9
callq 0x17ac
movq %r14, %rdi
movq %rbx, %rsi
pushq $0x10
popq %rbp
movl %ebp, %edx
movq %rbx, %rcx
callq 0x1d24
movq 0x58(%rsp), %rdi
movq %rbx, %rsi
movl %ebp, %edx
movq %rbx, %rcx
callq 0x1d24
leaq 0x70(%rsp), %rdi
movq %rbx, %rsi
movl %ebp, %edx
movq %rbx, %rcx
callq 0x1d24
vmovups -0x10(%rbx), %xmm0
vmovaps %xmm0, (%r14)
vmovups (%rbx), %xmm0
vmovups %xmm0, -0x10(%rbx)
vmovaps (%r14), %xmm0
vmovups %xmm0, (%rbx)
addq $0x98, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq