// File: /workspace/github_c_makefile_star2_O0/mjosaarinen[P]brutus/crypto_aead/shellaes128v1d5n64/ref/shellaes.c
// Function: XLSInv
void XLSInv(const u32 irk[], const u8 Lprime[], const u8 c[], unsigned long long fb_ctlen, unsigned int nfb_ctlen, u8 p[], u8 tag[]){
    u8 pt[16], ct[16];
    u8 temp[16];
    u8 mask1[16], mask2[16];
    u8 byte1[nfb_ctlen], byte2[nfb_ctlen];

    int i;

    /*produce mask 3^2*Lprime, and save it to mask1[]*/
    memcpy(mask1, Lprime, 16);
    for(i=0; i<2; ++i){
        memcpy(temp, mask1, 16);
        double_mask(mask1);
        xor_byte_string(temp, mask1, 16);
    }

    /*produce mask 7^2*Lprime, and save it to mask2[]*/
    memcpy(mask2, Lprime, 16);
    for(i=0; i<2; ++i){
        memcpy(temp, mask2, 16);
        double_mask(mask2);
        xor_byte_string(mask2, temp, 16);
        double_mask(mask2);
        xor_byte_string(temp, mask2, 16);
    }

    /*produce the masks for E' and E'', and save them to mask1[] and mask2[] respectively*/
    while(fb_ctlen!=0){
        double_mask(mask1);
        double_mask(mask2);
        fb_ctlen-=16;
    }
    double_mask(mask1);
    double_mask(mask2);

    memcpy(ct, c, nfb_ctlen);
    memcpy(ct+nfb_ctlen, tag, 16-nfb_ctlen);
    memcpy(byte2, tag+16-nfb_ctlen, nfb_ctlen);

    /*the first round */

    xor_byte_string(mask1, ct, 16);
    aesDecrypt(irk, ct, pt);
    xor_byte_string(mask1, pt, 16);

    pt[15-nfb_ctlen]^=0x01;
    memcpy(byte1, pt+16-nfb_ctlen, nfb_ctlen);
    MIX(byte1, byte2, nfb_ctlen);
    memcpy(pt+16-nfb_ctlen, byte1, nfb_ctlen);
    memcpy(ct, pt, 16);

    /*The second round*/

    xor_byte_string(mask2, ct, 16);
    aesDecrypt(irk, ct, pt);
    xor_byte_string(mask2, pt, 16);

    pt[15-nfb_ctlen]^=0x01;
    memcpy(byte1, pt+16-nfb_ctlen, nfb_ctlen);
    MIX(byte1, byte2, nfb_ctlen);

    memcpy(pt+16-nfb_ctlen, byte1, nfb_ctlen);
    memcpy(ct, pt, 16);

    /*the third round */

    xor_byte_string(mask1, ct, 16);
    aesDecrypt(irk, ct, pt);
    xor_byte_string(mask1, pt, 16);

    /*separate the output to plaintext and tag*/
    memcpy(p, pt, nfb_ctlen);
    memcpy(tag, pt+nfb_ctlen, 16-nfb_ctlen);
    memcpy(tag+16-nfb_ctlen, byte2, nfb_ctlen);


}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0xb0, %rsp
movq 0x10(%rbp), %rax
movq %rdi, -0x8(%rbp)
movq %rsi, -0x10(%rbp)
movq %rdx, -0x18(%rbp)
movq %rcx, -0x20(%rbp)
movl %r8d, -0x24(%rbp)
movq %r9, -0x30(%rbp)
movl -0x24(%rbp), %eax
movq %rsp, %rcx
movq %rcx, -0x88(%rbp)
movq %rax, %rdx
addq $0xf, %rdx
andq $-0x10, %rdx
movq %rsp, %rcx
subq %rdx, %rcx
movq %rcx, -0xb0(%rbp)
movq %rcx, %rsp
movq %rax, -0x90(%rbp)
movl -0x24(%rbp), %eax
movq %rax, %rdx
addq $0xf, %rdx
andq $-0x10, %rdx
movq %rsp, %rcx
subq %rdx, %rcx
movq %rcx, -0xa8(%rbp)
movq %rcx, %rsp
movq %rax, -0x98(%rbp)
movq -0x10(%rbp), %rax
movq (%rax), %rcx
movq %rcx, -0x70(%rbp)
movq 0x8(%rax), %rax
movq %rax, -0x68(%rbp)
movl $0x0, -0x9c(%rbp)
cmpl $0x2, -0x9c(%rbp)
jge 0x7e9d
movq -0x70(%rbp), %rax
movq %rax, -0x60(%rbp)
movq -0x68(%rbp), %rax
movq %rax, -0x58(%rbp)
leaq -0x70(%rbp), %rdi
callq 0x21e0
leaq -0x60(%rbp), %rdi
leaq -0x70(%rbp), %rsi
movl $0x10, %edx
callq 0x2240
movl -0x9c(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x9c(%rbp)
jmp 0x7e58
movq -0x10(%rbp), %rax
movq (%rax), %rcx
movq %rcx, -0x80(%rbp)
movq 0x8(%rax), %rax
movq %rax, -0x78(%rbp)
movl $0x0, -0x9c(%rbp)
cmpl $0x2, -0x9c(%rbp)
jge 0x7f1a
movq -0x80(%rbp), %rax
movq %rax, -0x60(%rbp)
movq -0x78(%rbp), %rax
movq %rax, -0x58(%rbp)
leaq -0x80(%rbp), %rdi
callq 0x21e0
leaq -0x80(%rbp), %rdi
leaq -0x60(%rbp), %rsi
movl $0x10, %edx
callq 0x2240
leaq -0x80(%rbp), %rdi
callq 0x21e0
leaq -0x60(%rbp), %rdi
leaq -0x80(%rbp), %rsi
movl $0x10, %edx
callq 0x2240
movl -0x9c(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x9c(%rbp)
jmp 0x7eba
jmp 0x7f1c
cmpq $0x0, -0x20(%rbp)
je 0x7f43
leaq -0x70(%rbp), %rdi
callq 0x21e0
leaq -0x80(%rbp), %rdi
callq 0x21e0
movq -0x20(%rbp), %rax
subq $0x10, %rax
movq %rax, -0x20(%rbp)
jmp 0x7f1c
leaq -0x70(%rbp), %rdi
callq 0x21e0
leaq -0x80(%rbp), %rdi
callq 0x21e0
leaq -0x50(%rbp), %rdi
movq -0x18(%rbp), %rsi
movl -0x24(%rbp), %eax
movl %eax, %edx
callq 0x2270
leaq -0x50(%rbp), %rdi
movl -0x24(%rbp), %eax
addq %rax, %rdi
movq 0x10(%rbp), %rsi
movl $0x10, %eax
subl -0x24(%rbp), %eax
movl %eax, %eax
movl %eax, %edx
callq 0x2270
movq -0xa8(%rbp), %rdi
movq 0x10(%rbp), %rsi
addq $0x10, %rsi
movl -0x24(%rbp), %eax
movl %eax, %ecx
xorl %eax, %eax
subq %rcx, %rax
addq %rax, %rsi
movl -0x24(%rbp), %eax
movl %eax, %edx
callq 0x2270
leaq -0x70(%rbp), %rdi
leaq -0x50(%rbp), %rsi
movl $0x10, %edx
callq 0x2240
movq -0x8(%rbp), %rdi
leaq -0x50(%rbp), %rsi
leaq -0x40(%rbp), %rdx
callq 0x20b0
leaq -0x70(%rbp), %rdi
leaq -0x40(%rbp), %rsi
movl $0x10, %edx
callq 0x2240
movq -0xb0(%rbp), %rdi
movl $0xf, %eax
subl -0x24(%rbp), %eax
movl %eax, %eax
movzbl -0x40(%rbp,%rax), %ecx
xorl $0x1, %ecx
movb %cl, -0x40(%rbp,%rax)
leaq -0x40(%rbp), %rsi
addq $0x10, %rsi
movl -0x24(%rbp), %eax
movl %eax, %ecx
xorl %eax, %eax
subq %rcx, %rax
addq %rax, %rsi
movl -0x24(%rbp), %eax
movl %eax, %edx
callq 0x2270
movq -0xb0(%rbp), %rdi
movq -0xa8(%rbp), %rsi
movl -0x24(%rbp), %edx
callq 0x2190
movq -0xb0(%rbp), %rsi
leaq -0x40(%rbp), %rdi
addq $0x10, %rdi
movl -0x24(%rbp), %eax
movl %eax, %ecx
xorl %eax, %eax
subq %rcx, %rax
addq %rax, %rdi
movl -0x24(%rbp), %eax
movl %eax, %edx
callq 0x2270
movq -0x40(%rbp), %rax
movq %rax, -0x50(%rbp)
movq -0x38(%rbp), %rax
movq %rax, -0x48(%rbp)
leaq -0x80(%rbp), %rdi
leaq -0x50(%rbp), %rsi
movl $0x10, %edx
callq 0x2240
movq -0x8(%rbp), %rdi
leaq -0x50(%rbp), %rsi
leaq -0x40(%rbp), %rdx
callq 0x20b0
leaq -0x80(%rbp), %rdi
leaq -0x40(%rbp), %rsi
movl $0x10, %edx
callq 0x2240
movq -0xb0(%rbp), %rdi
movl $0xf, %eax
subl -0x24(%rbp), %eax
movl %eax, %eax
movzbl -0x40(%rbp,%rax), %ecx
xorl $0x1, %ecx
movb %cl, -0x40(%rbp,%rax)
leaq -0x40(%rbp), %rsi
addq $0x10, %rsi
movl -0x24(%rbp), %eax
movl %eax, %ecx
xorl %eax, %eax
subq %rcx, %rax
addq %rax, %rsi
movl -0x24(%rbp), %eax
movl %eax, %edx
callq 0x2270
movq -0xb0(%rbp), %rdi
movq -0xa8(%rbp), %rsi
movl -0x24(%rbp), %edx
callq 0x2190
movq -0xb0(%rbp), %rsi
leaq -0x40(%rbp), %rdi
addq $0x10, %rdi
movl -0x24(%rbp), %eax
movl %eax, %ecx
xorl %eax, %eax
subq %rcx, %rax
addq %rax, %rdi
movl -0x24(%rbp), %eax
movl %eax, %edx
callq 0x2270
movq -0x40(%rbp), %rax
movq %rax, -0x50(%rbp)
movq -0x38(%rbp), %rax
movq %rax, -0x48(%rbp)
leaq -0x70(%rbp), %rdi
leaq -0x50(%rbp), %rsi
movl $0x10, %edx
callq 0x2240
movq -0x8(%rbp), %rdi
leaq -0x50(%rbp), %rsi
leaq -0x40(%rbp), %rdx
callq 0x20b0
leaq -0x70(%rbp), %rdi
leaq -0x40(%rbp), %rsi
movl $0x10, %edx
callq 0x2240
movq -0x30(%rbp), %rdi
leaq -0x40(%rbp), %rsi
movl -0x24(%rbp), %eax
movl %eax, %edx
callq 0x2270
movq 0x10(%rbp), %rdi
leaq -0x40(%rbp), %rsi
movl -0x24(%rbp), %eax
addq %rax, %rsi
movl $0x10, %eax
subl -0x24(%rbp), %eax
movl %eax, %eax
movl %eax, %edx
callq 0x2270
movq -0xa8(%rbp), %rsi
movq 0x10(%rbp), %rdi
addq $0x10, %rdi
movl -0x24(%rbp), %eax
movl %eax, %ecx
xorl %eax, %eax
subq %rcx, %rax
addq %rax, %rdi
movl -0x24(%rbp), %eax
movl %eax, %edx
callq 0x2270
movq -0x88(%rbp), %rax
movq %rax, %rsp
movq %rbp, %rsp
popq %rbp
retq
nopw %cs:(%rax,%rax)