// File: /workspace/github_c_makefile_star2_O0/mjosaarinen[P]brutus/crypto_aead/shellaes128v1d5n64/ref/shellaes.c
// Function: XLS
void XLS(const u32 rk[], const u8 Lprime[], const u8 p[], unsigned long long int fb_ptlen, unsigned int nfb_ptlen, u8 c[], u8 tag[]){
    u8 mask1[16], mask2[16];
    u8 temp[16];
    u8 pt[16], ct[16], byte1[nfb_ptlen], byte2[nfb_ptlen];
    int i;

    /*produce mask 3^2*Lprime, and save it to mask1[]*/
    memcpy(mask1, Lprime, 16);
    for(i=0; i<2; ++i){
        memcpy(temp, mask1, 16);
        double_mask(mask1);
        xor_byte_string(temp, mask1, 16);
    }

    /*produce mask 7^2*Lprime, and save it to mask2[]*/
    memcpy(mask2, Lprime, 16);
    for(i=0; i<2; ++i){
        memcpy(temp, mask2, 16);
        double_mask(mask2);
        xor_byte_string(mask2, temp, 16);
        double_mask(mask2);
        xor_byte_string(temp, mask2, 16);
    }

    /*produce the masks for E' and E'', and save them to mask1[] and mask2[] respectively*/
    while(fb_ptlen!=0){
        double_mask(mask1);
        double_mask(mask2);
        fb_ptlen-=16;
    }
    double_mask(mask1);
    double_mask(mask2);

    /*First round of XLS*/

    memcpy(pt, p, nfb_ptlen);
    memcpy(pt+nfb_ptlen, tag, 16-nfb_ptlen);

    /*apply E'*/
    xor_byte_string(mask1, pt, 16);
    aesEncrypt(rk, pt, ct);
    xor_byte_string(mask1, ct, 16);

    /*flip one bit*/
    ct[15-nfb_ptlen]^=0x01;

    memcpy(byte1, ct+16-nfb_ptlen, nfb_ptlen);
    memcpy(byte2, tag+16-nfb_ptlen, nfb_ptlen);

    /*MIX function*/
    MIX(byte1, byte2, nfb_ptlen);

    memcpy(ct+16-nfb_ptlen, byte1, nfb_ptlen);

    memcpy(pt, ct, 16);

    /*Second round of XLS*/

    /*apply E''*/
    xor_byte_string(mask2, pt, 16);
    aesEncrypt(rk, pt, ct);
    xor_byte_string(mask2, ct, 16);

    ct[15-nfb_ptlen]^=0x01;

    memcpy(byte1, ct+16-nfb_ptlen, nfb_ptlen);
    MIX(byte1, byte2, nfb_ptlen);

    memcpy(ct+16-nfb_ptlen, byte1, nfb_ptlen);
    memcpy(pt, ct, 16);

    /*the third round of XLS*/

    xor_byte_string(mask1, pt, 16);
    aesEncrypt(rk, pt, ct);
    xor_byte_string(mask1, ct, 16);

    /*produce ciphertext and tag*/
    memcpy(c, ct, nfb_ptlen);
    memcpy(tag, ct+nfb_ptlen, 16-nfb_ptlen);
    memcpy(tag+16-nfb_ptlen, byte2, nfb_ptlen);

}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0xb0, %rsp
movq 0x10(%rbp), %rax
movq %rdi, -0x8(%rbp)
movq %rsi, -0x10(%rbp)
movq %rdx, -0x18(%rbp)
movq %rcx, -0x20(%rbp)
movl %r8d, -0x24(%rbp)
movq %r9, -0x30(%rbp)
movl -0x24(%rbp), %eax
movq %rsp, %rcx
movq %rcx, -0x88(%rbp)
movq %rax, %rdx
addq $0xf, %rdx
andq $-0x10, %rdx
movq %rsp, %rcx
subq %rdx, %rcx
movq %rcx, -0xb0(%rbp)
movq %rcx, %rsp
movq %rax, -0x90(%rbp)
movl -0x24(%rbp), %eax
movq %rax, %rdx
addq $0xf, %rdx
andq $-0x10, %rdx
movq %rsp, %rcx
subq %rdx, %rcx
movq %rcx, -0xa8(%rbp)
movq %rcx, %rsp
movq %rax, -0x98(%rbp)
movq -0x10(%rbp), %rax
movq (%rax), %rcx
movq %rcx, -0x40(%rbp)
movq 0x8(%rax), %rax
movq %rax, -0x38(%rbp)
movl $0x0, -0x9c(%rbp)
cmpl $0x2, -0x9c(%rbp)
jge 0x7a8d
movq -0x40(%rbp), %rax
movq %rax, -0x60(%rbp)
movq -0x38(%rbp), %rax
movq %rax, -0x58(%rbp)
leaq -0x40(%rbp), %rdi
callq 0x21e0
leaq -0x60(%rbp), %rdi
leaq -0x40(%rbp), %rsi
movl $0x10, %edx
callq 0x2240
movl -0x9c(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x9c(%rbp)
jmp 0x7a48
movq -0x10(%rbp), %rax
movq (%rax), %rcx
movq %rcx, -0x50(%rbp)
movq 0x8(%rax), %rax
movq %rax, -0x48(%rbp)
movl $0x0, -0x9c(%rbp)
cmpl $0x2, -0x9c(%rbp)
jge 0x7b0a
movq -0x50(%rbp), %rax
movq %rax, -0x60(%rbp)
movq -0x48(%rbp), %rax
movq %rax, -0x58(%rbp)
leaq -0x50(%rbp), %rdi
callq 0x21e0
leaq -0x50(%rbp), %rdi
leaq -0x60(%rbp), %rsi
movl $0x10, %edx
callq 0x2240
leaq -0x50(%rbp), %rdi
callq 0x21e0
leaq -0x60(%rbp), %rdi
leaq -0x50(%rbp), %rsi
movl $0x10, %edx
callq 0x2240
movl -0x9c(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x9c(%rbp)
jmp 0x7aaa
jmp 0x7b0c
cmpq $0x0, -0x20(%rbp)
je 0x7b33
leaq -0x40(%rbp), %rdi
callq 0x21e0
leaq -0x50(%rbp), %rdi
callq 0x21e0
movq -0x20(%rbp), %rax
subq $0x10, %rax
movq %rax, -0x20(%rbp)
jmp 0x7b0c
leaq -0x40(%rbp), %rdi
callq 0x21e0
leaq -0x50(%rbp), %rdi
callq 0x21e0
leaq -0x70(%rbp), %rdi
movq -0x18(%rbp), %rsi
movl -0x24(%rbp), %eax
movl %eax, %edx
callq 0x2270
leaq -0x70(%rbp), %rdi
movl -0x24(%rbp), %eax
addq %rax, %rdi
movq 0x10(%rbp), %rsi
movl $0x10, %eax
subl -0x24(%rbp), %eax
movl %eax, %eax
movl %eax, %edx
callq 0x2270
leaq -0x40(%rbp), %rdi
leaq -0x70(%rbp), %rsi
movl $0x10, %edx
callq 0x2240
movq -0x8(%rbp), %rdi
leaq -0x70(%rbp), %rsi
leaq -0x80(%rbp), %rdx
callq 0x2200
leaq -0x40(%rbp), %rdi
leaq -0x80(%rbp), %rsi
movl $0x10, %edx
callq 0x2240
movq -0xb0(%rbp), %rdi
movl $0xf, %eax
subl -0x24(%rbp), %eax
movl %eax, %eax
movzbl -0x80(%rbp,%rax), %ecx
xorl $0x1, %ecx
movb %cl, -0x80(%rbp,%rax)
leaq -0x80(%rbp), %rsi
addq $0x10, %rsi
movl -0x24(%rbp), %eax
movl %eax, %ecx
xorl %eax, %eax
subq %rcx, %rax
addq %rax, %rsi
movl -0x24(%rbp), %eax
movl %eax, %edx
callq 0x2270
movq -0xa8(%rbp), %rdi
movq 0x10(%rbp), %rsi
addq $0x10, %rsi
movl -0x24(%rbp), %eax
movl %eax, %ecx
xorl %eax, %eax
subq %rcx, %rax
addq %rax, %rsi
movl -0x24(%rbp), %eax
movl %eax, %edx
callq 0x2270
movq -0xb0(%rbp), %rdi
movq -0xa8(%rbp), %rsi
movl -0x24(%rbp), %edx
callq 0x2190
movq -0xb0(%rbp), %rsi
leaq -0x80(%rbp), %rdi
addq $0x10, %rdi
movl -0x24(%rbp), %eax
movl %eax, %ecx
xorl %eax, %eax
subq %rcx, %rax
addq %rax, %rdi
movl -0x24(%rbp), %eax
movl %eax, %edx
callq 0x2270
movq -0x80(%rbp), %rax
movq %rax, -0x70(%rbp)
movq -0x78(%rbp), %rax
movq %rax, -0x68(%rbp)
leaq -0x50(%rbp), %rdi
leaq -0x70(%rbp), %rsi
movl $0x10, %edx
callq 0x2240
movq -0x8(%rbp), %rdi
leaq -0x70(%rbp), %rsi
leaq -0x80(%rbp), %rdx
callq 0x2200
leaq -0x50(%rbp), %rdi
leaq -0x80(%rbp), %rsi
movl $0x10, %edx
callq 0x2240
movq -0xb0(%rbp), %rdi
movl $0xf, %eax
subl -0x24(%rbp), %eax
movl %eax, %eax
movzbl -0x80(%rbp,%rax), %ecx
xorl $0x1, %ecx
movb %cl, -0x80(%rbp,%rax)
leaq -0x80(%rbp), %rsi
addq $0x10, %rsi
movl -0x24(%rbp), %eax
movl %eax, %ecx
xorl %eax, %eax
subq %rcx, %rax
addq %rax, %rsi
movl -0x24(%rbp), %eax
movl %eax, %edx
callq 0x2270
movq -0xb0(%rbp), %rdi
movq -0xa8(%rbp), %rsi
movl -0x24(%rbp), %edx
callq 0x2190
movq -0xb0(%rbp), %rsi
leaq -0x80(%rbp), %rdi
addq $0x10, %rdi
movl -0x24(%rbp), %eax
movl %eax, %ecx
xorl %eax, %eax
subq %rcx, %rax
addq %rax, %rdi
movl -0x24(%rbp), %eax
movl %eax, %edx
callq 0x2270
movq -0x80(%rbp), %rax
movq %rax, -0x70(%rbp)
movq -0x78(%rbp), %rax
movq %rax, -0x68(%rbp)
leaq -0x40(%rbp), %rdi
leaq -0x70(%rbp), %rsi
movl $0x10, %edx
callq 0x2240
movq -0x8(%rbp), %rdi
leaq -0x70(%rbp), %rsi
leaq -0x80(%rbp), %rdx
callq 0x2200
leaq -0x40(%rbp), %rdi
leaq -0x80(%rbp), %rsi
movl $0x10, %edx
callq 0x2240
movq -0x30(%rbp), %rdi
leaq -0x80(%rbp), %rsi
movl -0x24(%rbp), %eax
movl %eax, %edx
callq 0x2270
movq 0x10(%rbp), %rdi
leaq -0x80(%rbp), %rsi
movl -0x24(%rbp), %eax
addq %rax, %rsi
movl $0x10, %eax
subl -0x24(%rbp), %eax
movl %eax, %eax
movl %eax, %edx
callq 0x2270
movq -0xa8(%rbp), %rsi
movq 0x10(%rbp), %rdi
addq $0x10, %rdi
movl -0x24(%rbp), %eax
movl %eax, %ecx
xorl %eax, %eax
subq %rcx, %rax
addq %rax, %rdi
movl -0x24(%rbp), %eax
movl %eax, %edx
callq 0x2270
movq -0x88(%rbp), %rax
movq %rax, %rsp
movq %rbp, %rsp
popq %rbp
retq
nopw %cs:(%rax,%rax)