// File: /workspace/github_c_makefile_star2_O0/mjosaarinen[P]brutus/crypto_aead/aezv3/ref/aez_ref.c
// Function: Extract
static void Extract(byte *K, unsigned kbytes, byte extracted_key[3*16]) {
    unsigned i,j,k,empty;
    byte buf[16];
    u32 aes4_key_z[4*5],aes4_key_c[4*5];
    
    empty = (kbytes==0);
    memset(extracted_key,0,48);
    for (i=0;i<16;i++) ((byte *)aes4_key_z)[i]=(byte)i;
    correct_key(aes4_key_z, 16);
    for (i=1;i<5;i++) memcpy((byte*)aes4_key_z+16*i,aes4_key_z,16);

    for (j=1; kbytes >= 16; K+=16, kbytes-=16, j++) {
        for (i=1; i<=3; i++) {
            /* aes4 ([i]_64 [j]_64) */
            memset(aes4_key_c,0,12); ((byte *)aes4_key_c)[7]=(byte)i;
            write32_big_endian(j, (byte *)aes4_key_c+12);
            rijndaelEncryptRound(aes4_key_z, 10, (byte *)aes4_key_c, 4);
            /* Set aes4 key to derived key, aes4 K_j, accumulate result */
            correct_key(aes4_key_c, 16);
            for (k=1; k<5; k++) memcpy((byte*)aes4_key_c+16*k, aes4_key_c, 16);
            memcpy(buf, K, 16);
            rijndaelEncryptRound(aes4_key_c, 10, buf, 4);
            xor_bytes(extracted_key+(i-1)*16, buf, 16, extracted_key+(i-1)*16);
        }
    }
    if (kbytes || empty) {  /* If key remains, or kbytes was initially zero */
        for (i=1; i<=3; i++) {
            /* aes4 ([i]_64 [0]_64) */
            memset(aes4_key_c,0,16); ((byte *)aes4_key_c)[7]=(byte)i;
            rijndaelEncryptRound(aes4_key_z, 10, (byte *)aes4_key_c, 4);
            /* Set aes4 key to derived key, aes4 K_m10*, accumulate result */
            correct_key(aes4_key_c, 16);
            for (k=1; k<5; k++) memcpy((byte*)aes4_key_c+16*k, aes4_key_c, 16);
            memset(buf,0,16); memcpy(buf,K,kbytes); buf[kbytes]=0x80;
            rijndaelEncryptRound(aes4_key_c, 10, buf, 4);
            xor_bytes(extracted_key+(i-1)*16, buf, 16, extracted_key+(i-1)*16);
        }
    }
}

// Assembly:
subq $0xd8, %rsp
movq %rdi, 0xd0(%rsp)
movl %esi, 0xcc(%rsp)
movq %rdx, 0xc0(%rsp)
cmpl $0x0, 0xcc(%rsp)
sete %al
andb $0x1, %al
movzbl %al, %eax
movl %eax, 0xb0(%rsp)
movq 0xc0(%rsp), %rdi
xorl %esi, %esi
movl $0x30, %edx
callq 0x1040
movl $0x0, 0xbc(%rsp)
cmpl $0x10, 0xbc(%rsp)
jae 0x2255
movl 0xbc(%rsp), %eax
movb %al, %cl
movl 0xbc(%rsp), %eax
movb %cl, 0x50(%rsp,%rax)
movl 0xbc(%rsp), %eax
addl $0x1, %eax
movl %eax, 0xbc(%rsp)
jmp 0x2224
leaq 0x50(%rsp), %rdi
movl $0x10, %esi
callq 0x25c0
movl $0x1, 0xbc(%rsp)
cmpl $0x5, 0xbc(%rsp)
jae 0x22ac
movl 0xbc(%rsp), %eax
shll $0x4, %eax
movl %eax, %eax
movq 0x50(%rsp), %rcx
movq %rcx, 0x50(%rsp,%rax)
movq 0x58(%rsp), %rcx
movq %rcx, 0x58(%rsp,%rax)
movl 0xbc(%rsp), %eax
addl $0x1, %eax
movl %eax, 0xbc(%rsp)
jmp 0x226f
movl $0x1, 0xb8(%rsp)
cmpl $0x10, 0xcc(%rsp)
jb 0x2447
movl $0x1, 0xbc(%rsp)
cmpl $0x3, 0xbc(%rsp)
ja 0x240a
movq %rsp, %rdi
xorl %esi, %esi
movl $0xc, %edx
callq 0x1040
movl 0xbc(%rsp), %eax
movb %al, 0x7(%rsp)
movl 0xb8(%rsp), %edi
movq %rsp, %rsi
addq $0xc, %rsi
callq 0x1be0
leaq 0x50(%rsp), %rdi
movq %rsp, %rdx
movl $0xa, %esi
movl $0x4, %ecx
callq 0x10c0
movq %rsp, %rdi
movl $0x10, %esi
callq 0x25c0
movl $0x1, 0xb4(%rsp)
cmpl $0x5, 0xb4(%rsp)
jae 0x2375
movl 0xb4(%rsp), %eax
shll $0x4, %eax
movl %eax, %eax
movq (%rsp), %rcx
movq %rcx, (%rsp,%rax)
movq 0x8(%rsp), %rcx
movq %rcx, 0x8(%rsp,%rax)
movl 0xb4(%rsp), %eax
addl $0x1, %eax
movl %eax, 0xb4(%rsp)
jmp 0x233a
movq 0xd0(%rsp), %rax
movq (%rax), %rcx
movq %rcx, 0xa0(%rsp)
movq 0x8(%rax), %rax
movq %rax, 0xa8(%rsp)
movq %rsp, %rdi
leaq 0xa0(%rsp), %rdx
movl $0xa, %esi
movl $0x4, %ecx
callq 0x10c0
movq 0xc0(%rsp), %rdi
movl 0xbc(%rsp), %eax
subl $0x1, %eax
shll $0x4, %eax
movl %eax, %eax
addq %rax, %rdi
leaq 0xa0(%rsp), %rsi
movq 0xc0(%rsp), %rcx
movl 0xbc(%rsp), %eax
subl $0x1, %eax
shll $0x4, %eax
movl %eax, %eax
addq %rax, %rcx
movl $0x10, %edx
callq 0x2170
movl 0xbc(%rsp), %eax
addl $0x1, %eax
movl %eax, 0xbc(%rsp)
jmp 0x22d0
jmp 0x240c
movq 0xd0(%rsp), %rax
addq $0x10, %rax
movq %rax, 0xd0(%rsp)
movl 0xcc(%rsp), %eax
subl $0x10, %eax
movl %eax, 0xcc(%rsp)
movl 0xb8(%rsp), %eax
addl $0x1, %eax
movl %eax, 0xb8(%rsp)
jmp 0x22b7
cmpl $0x0, 0xcc(%rsp)
jne 0x245f
cmpl $0x0, 0xb0(%rsp)
je 0x25b5
movl $0x1, 0xbc(%rsp)
cmpl $0x3, 0xbc(%rsp)
ja 0x25b3
movq %rsp, %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x1040
movl 0xbc(%rsp), %eax
movb %al, 0x7(%rsp)
leaq 0x50(%rsp), %rdi
movq %rsp, %rdx
movl $0xa, %esi
movl $0x4, %ecx
callq 0x10c0
movq %rsp, %rdi
movl $0x10, %esi
callq 0x25c0
movl $0x1, 0xb4(%rsp)
cmpl $0x5, 0xb4(%rsp)
jae 0x24fc
movl 0xb4(%rsp), %eax
shll $0x4, %eax
movl %eax, %eax
movq (%rsp), %rcx
movq %rcx, (%rsp,%rax)
movq 0x8(%rsp), %rcx
movq %rcx, 0x8(%rsp,%rax)
movl 0xb4(%rsp), %eax
addl $0x1, %eax
movl %eax, 0xb4(%rsp)
jmp 0x24c1
leaq 0xa0(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x1040
leaq 0xa0(%rsp), %rdi
movq 0xd0(%rsp), %rsi
movl 0xcc(%rsp), %eax
movl %eax, %edx
callq 0x10d0
movl 0xcc(%rsp), %eax
movb $-0x80, 0xa0(%rsp,%rax)
movq %rsp, %rdi
leaq 0xa0(%rsp), %rdx
movl $0xa, %esi
movl $0x4, %ecx
callq 0x10c0
movq 0xc0(%rsp), %rdi
movl 0xbc(%rsp), %eax
subl $0x1, %eax
shll $0x4, %eax
movl %eax, %eax
addq %rax, %rdi
leaq 0xa0(%rsp), %rsi
movq 0xc0(%rsp), %rcx
movl 0xbc(%rsp), %eax
subl $0x1, %eax
shll $0x4, %eax
movl %eax, %eax
addq %rax, %rcx
movl $0x10, %edx
callq 0x2170
movl 0xbc(%rsp), %eax
addl $0x1, %eax
movl %eax, 0xbc(%rsp)
jmp 0x246a
jmp 0x25b5
addq $0xd8, %rsp
retq
nopl (%rax)