// File: /workspace/github_c_makefile_star2_O2/mjosaarinen[P]brutus/crypto_aead/shellaes128v1d5n64/ref/shellaes.c
// Function: XLSInv
void XLSInv(const u32 irk[], const u8 Lprime[], const u8 c[], unsigned long long fb_ctlen, unsigned int nfb_ctlen, u8 p[], u8 tag[]){
    u8 pt[16], ct[16];
    u8 temp[16];
    u8 mask1[16], mask2[16];
    u8 byte1[nfb_ctlen], byte2[nfb_ctlen];

    int i;

    /*produce mask 3^2*Lprime, and save it to mask1[]*/
    memcpy(mask1, Lprime, 16);
    for(i=0; i<2; ++i){
        memcpy(temp, mask1, 16);
        double_mask(mask1);
        xor_byte_string(temp, mask1, 16);
    }

    /*produce mask 7^2*Lprime, and save it to mask2[]*/
    memcpy(mask2, Lprime, 16);
    for(i=0; i<2; ++i){
        memcpy(temp, mask2, 16);
        double_mask(mask2);
        xor_byte_string(mask2, temp, 16);
        double_mask(mask2);
        xor_byte_string(temp, mask2, 16);
    }

    /*produce the masks for E' and E'', and save them to mask1[] and mask2[] respectively*/
    while(fb_ctlen!=0){
        double_mask(mask1);
        double_mask(mask2);
        fb_ctlen-=16;
    }
    double_mask(mask1);
    double_mask(mask2);

    memcpy(ct, c, nfb_ctlen);
    memcpy(ct+nfb_ctlen, tag, 16-nfb_ctlen);
    memcpy(byte2, tag+16-nfb_ctlen, nfb_ctlen);

    /*the first round */

    xor_byte_string(mask1, ct, 16);
    aesDecrypt(irk, ct, pt);
    xor_byte_string(mask1, pt, 16);

    pt[15-nfb_ctlen]^=0x01;
    memcpy(byte1, pt+16-nfb_ctlen, nfb_ctlen);
    MIX(byte1, byte2, nfb_ctlen);
    memcpy(pt+16-nfb_ctlen, byte1, nfb_ctlen);
    memcpy(ct, pt, 16);

    /*The second round*/

    xor_byte_string(mask2, ct, 16);
    aesDecrypt(irk, ct, pt);
    xor_byte_string(mask2, pt, 16);

    pt[15-nfb_ctlen]^=0x01;
    memcpy(byte1, pt+16-nfb_ctlen, nfb_ctlen);
    MIX(byte1, byte2, nfb_ctlen);

    memcpy(pt+16-nfb_ctlen, byte1, nfb_ctlen);
    memcpy(ct, pt, 16);

    /*the third round */

    xor_byte_string(mask1, ct, 16);
    aesDecrypt(irk, ct, pt);
    xor_byte_string(mask1, pt, 16);

    /*separate the output to plaintext and tag*/
    memcpy(p, pt, nfb_ctlen);
    memcpy(tag, pt+nfb_ctlen, 16-nfb_ctlen);
    memcpy(tag+16-nfb_ctlen, byte2, nfb_ctlen);


}

// Assembly:
pushq %rbp
movq %rsp, %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x98, %rsp
movq %r9, -0xb0(%rbp)
movq %rcx, %r12
movq %rdx, -0x40(%rbp)
movq %rdi, -0x48(%rbp)
movq %rsp, -0xc0(%rbp)
movl %r8d, -0x2c(%rbp)
movl %r8d, %eax
movq %rsp, %rcx
movq %rax, -0xb8(%rbp)
addq $0xf, %rax
andq $-0x10, %rax
subq %rax, %rcx
movq %rcx, -0xa8(%rbp)
movq %rcx, %rsp
movq %rsp, %rcx
subq %rax, %rcx
movq %rcx, -0x50(%rbp)
movq %rcx, %rsp
movq %rsi, -0x38(%rbp)
vmovups (%rsi), %xmm0
leaq -0x80(%rbp), %r14
vmovaps %xmm0, (%r14)
pushq $0x2
popq %rbx
leaq -0xa0(%rbp), %r15
pushq $0x10
popq %r13
subl $0x1, %ebx
jb 0x54b7
vmovaps -0x80(%rbp), %xmm0
vmovaps %xmm0, -0xa0(%rbp)
movq %r14, %rdi
callq 0x21f0
movq %r15, %rdi
movq %r14, %rsi
movq %r13, %rdx
callq 0x2250
jmp 0x548d
movq -0x38(%rbp), %rax
vmovups (%rax), %xmm0
leaq -0x70(%rbp), %r13
vmovaps %xmm0, (%r13)
pushq $0x2
popq %rbx
leaq -0xa0(%rbp), %r14
pushq $0x10
popq %r15
subl $0x1, %ebx
jb 0x5517
vmovaps -0x70(%rbp), %xmm0
vmovaps %xmm0, -0xa0(%rbp)
movq %r13, %rdi
callq 0x21f0
movq %r13, %rdi
movq %r14, %rsi
movq %r15, %rdx
callq 0x2250
movq %r13, %rdi
callq 0x21f0
movq %r14, %rdi
movq %r13, %rsi
movq %r15, %rdx
callq 0x2250
jmp 0x54d7
addq $0x10, %r12
leaq -0x80(%rbp), %r14
leaq -0x70(%rbp), %r15
movq %r14, %rdi
callq 0x21f0
movq %r15, %rdi
callq 0x21f0
addq $-0x10, %r12
jne 0x5523
leaq -0x60(%rbp), %rdi
movq %rdi, %r15
movq -0x40(%rbp), %rsi
movq -0xb8(%rbp), %rbx
movq %rbx, %rdx
callq 0x2280
leaq (%rbx,%rbp), %rdi
addq $-0x60, %rdi
pushq $0x10
popq %rdx
subl -0x2c(%rbp), %edx
movq %rdx, -0x40(%rbp)
movq 0x10(%rbp), %r14
movq %r14, %rsi
callq 0x2280
subq %rbx, %r14
addq $0x10, %r14
movq %r14, -0x38(%rbp)
movq -0x50(%rbp), %rdi
movq %r14, %rsi
movq %rbx, %rdx
callq 0x2280
leaq -0x80(%rbp), %r14
pushq $0x10
popq %r13
movq %r14, %rdi
movq %r15, %rsi
movq %r13, %rdx
callq 0x2250
leaq -0x90(%rbp), %r12
movq -0x48(%rbp), %rdi
movq %r15, %rsi
movq %r12, %rdx
callq 0x20b0
movq %r14, %rdi
movq %r12, %rsi
movq %r13, %rdx
callq 0x2250
pushq $0xf
popq %r15
movl -0x2c(%rbp), %r14d
subl %r14d, %r15d
xorb $0x1, -0x90(%rbp,%r15)
movq %r12, %r13
subq %rbx, %r13
addq $0x10, %r13
movq -0xa8(%rbp), %r12
movq %r12, %rdi
movq %r13, %rsi
movq %rbx, %rdx
callq 0x2280
movq %r12, %rdi
movq -0x50(%rbp), %rsi
movl %r14d, %edx
callq 0x21a0
movq %r13, %rdi
movq %r12, %rsi
movq %rbx, %rdx
callq 0x2280
leaq -0x90(%rbp), %r14
vmovaps (%r14), %xmm0
leaq -0x60(%rbp), %rsi
vmovaps %xmm0, (%rsi)
leaq -0x70(%rbp), %rdi
pushq $0x10
popq %rdx
callq 0x2250
movq -0x48(%rbp), %rdi
leaq -0x60(%rbp), %rsi
movq %r14, %rdx
callq 0x20b0
leaq -0x70(%rbp), %rdi
movq %r14, %rsi
pushq $0x10
popq %rdx
callq 0x2250
xorb $0x1, -0x90(%rbp,%r15)
movq %r12, %rdi
movq %r13, %rsi
movq %rbx, %rdx
callq 0x2280
movq %r12, %rdi
movq -0x50(%rbp), %r15
movq %r15, %rsi
movl -0x2c(%rbp), %edx
callq 0x21a0
movq %r13, %rdi
movq %r12, %rsi
movq %rbx, %rdx
callq 0x2280
movq %r14, %r12
vmovaps (%r14), %xmm0
leaq -0x60(%rbp), %rsi
vmovaps %xmm0, (%rsi)
leaq -0x80(%rbp), %r14
movq %r14, %rdi
pushq $0x10
popq %r13
movq %r13, %rdx
callq 0x2250
movq -0x48(%rbp), %rdi
leaq -0x60(%rbp), %rsi
movq %r12, %rdx
callq 0x20b0
movq %r14, %rdi
movq %r12, %rsi
movq %r13, %rdx
callq 0x2250
movq -0xb0(%rbp), %rdi
movq %r12, %rsi
movq %rbx, %rdx
callq 0x2280
leaq (%rbx,%rbp), %rsi
addq $-0x90, %rsi
movq 0x10(%rbp), %rdi
movq -0x40(%rbp), %rdx
callq 0x2280
movq -0x38(%rbp), %rdi
movq %r15, %rsi
movq %rbx, %rdx
callq 0x2280
movq -0xc0(%rbp), %rsp
leaq -0x28(%rbp), %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq