// File: /workspace/github_c_makefile_star2_O2/mjosaarinen[P]brutus/crypto_aead/aegis128l/ref/ecrypt.c
// Function: aegis128L_tag_generation
void aegis128L_tag_generation(unsigned long msglen, unsigned long adlen, unsigned char maclen, unsigned char *mac, unsigned char *state)
{
        int i;

        unsigned char tmp[16];
        unsigned char msgtmp[16];

        ((unsigned long long*)msgtmp)[0] = adlen << 3;
        ((unsigned long long*)msgtmp)[1] = msglen << 3;

        XOR128(msgtmp, msgtmp, state+32);

        for (i = 0; i < 7; i++) {
            //state update function
            memcpy(tmp, state+112, 16);
            AESROUND(state+112,state+96, state+112);
            AESROUND(state+96, state+80, state+96);
            AESROUND(state+80, state+64, state+80);
            AESROUND(state+64, state+48, state+64);
            AESROUND(state+48, state+32, state+48);
            AESROUND(state+32, state+16, state+32);
            AESROUND(state+16, state+0,  state+16);
            AESROUND(state+0,  tmp,      state+0);

            //message is used to update the state.
            XOR128(state,    state,    msgtmp);
            XOR128(state+64, state+64, msgtmp);
        }

        XOR128(state+96, state+96, state+80);
        XOR128(state+96, state+96, state+64);
        XOR128(state+96, state+96, state+48);
        XOR128(state+96, state+96, state+32);
        XOR128(state+96, state+96, state+16);
        XOR128(state+96, state+96, state+0);

        //in this program, the mac length is assumed to be multiple of bytes
        memcpy(mac,state+96,maclen);
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x68, %rsp
movq %r8, %r14
movq %rcx, 0x18(%rsp)
movl %edx, 0xc(%rsp)
vmovq %rdi, %xmm0
vmovq %rsi, %xmm1
vpunpcklqdq %xmm0, %xmm1, %xmm0 # xmm0 = xmm1[0],xmm0[0]
vpsllq $0x3, %xmm0, %xmm0
leaq 0x20(%r8), %rax
movq %rax, 0x38(%rsp)
vpxor 0x20(%r8), %xmm0, %xmm0
vmovdqa %xmm0, 0x40(%rsp)
leaq 0x70(%r8), %rax
movq %rax, 0x30(%rsp)
leaq 0x60(%r8), %rax
movq %rax, 0x10(%rsp)
leaq 0x50(%r8), %rax
movq %rax, 0x28(%rsp)
leaq 0x40(%r8), %rax
movq %rax, 0x20(%rsp)
leaq 0x30(%r8), %r15
leaq 0x10(%r8), %r12
pushq $0x7
popq %r13
movq 0x28(%rsp), %rbp
subl $0x1, %r13d
jb 0x1572
movq 0x30(%rsp), %rdi
vmovups (%rdi), %xmm0
vmovaps %xmm0, 0x50(%rsp)
movq 0x10(%rsp), %rbx
movq %rbx, %rsi
movq %rdi, %rdx
callq 0x1050
movq %rbx, %rdi
movq %rbp, %rsi
movq %rbx, %rdx
callq 0x1050
movq %rbp, %rdi
movq 0x20(%rsp), %rbx
movq %rbx, %rsi
movq %rbp, %rdx
callq 0x1050
movq %rbx, %rdi
movq %r15, %rsi
movq %rbx, %rdx
callq 0x1050
movq %r15, %rdi
movq 0x38(%rsp), %rbx
movq %rbx, %rsi
movq %r15, %rdx
callq 0x1050
movq %rbx, %rdi
movq %r12, %rsi
movq %rbx, %rdx
callq 0x1050
movq %r12, %rdi
movq %r14, %rsi
movq %r12, %rdx
callq 0x1050
movq %r14, %rdi
leaq 0x50(%rsp), %rsi
movq %r14, %rdx
callq 0x1050
vmovdqa 0x40(%rsp), %xmm1
vpxor (%r14), %xmm1, %xmm0
vmovdqu %xmm0, (%r14)
vpxor 0x40(%r14), %xmm1, %xmm0
vmovdqu %xmm0, 0x40(%r14)
jmp 0x14ba
vmovdqu 0x10(%r14), %xmm0
vmovdqu 0x30(%r14), %xmm1
vmovdqu 0x40(%r14), %xmm2
vmovdqu 0x50(%r14), %xmm3
vpternlogq $0x96, 0x60(%r14), %xmm2, %xmm3
vpternlogq $0x96, 0x20(%r14), %xmm1, %xmm3
vpternlogq $0x96, (%r14), %xmm0, %xmm3
vmovdqu %xmm3, 0x60(%r14)
movzbl 0xc(%rsp), %edx
movq 0x18(%rsp), %rdi
movq 0x10(%rsp), %rsi
callq 0x10c0
addq $0x68, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq