// File: /workspace/github_c_makefile_star2_O3/mjosaarinen[P]brutus/crypto_aead/aezv3/ref/aez_ref.c
// Function: E
static void E(byte *K, unsigned kbytes, int i, unsigned j,
                                                byte src[16], byte dst[16]) {
    byte k, extracted_key[3*16], iJ[16], jJ[16], buf[16], I[16], J[16], L[16];

    Extract(K, kbytes, extracted_key);
    memcpy(I,extracted_key,16);
    memcpy(J,extracted_key+16,16);
    memcpy(L,extracted_key+32,16);

    /* Encipher */
    if (i < 0) {
        u32 aes_key[4*11];
        memset(aes_key,0,16);                                  /* 0        */
        memcpy((byte*)aes_key+ 16, I, 16);                     /* I        */
        memcpy((byte*)aes_key+ 32, L, 16);                     /* L        */
        memcpy((byte*)aes_key+ 48, J, 16);                     /* J        */
        correct_key(aes_key,4*16);
        memcpy((byte*)aes_key+ 64, (byte*)aes_key+16, 48);     /* I L J    */
        memcpy((byte*)aes_key+112, (byte*)aes_key+16, 48);     /* I L J    */
        memcpy((byte*)aes_key+160, (byte*)aes_key+16, 16);     /* I        */
        mult_block(j,J,jJ); xor_bytes(jJ,src,16,buf);
        rijndaelEncryptRound(aes_key, 11, buf, 10); /* incl final MixColumns */
    } else {
        u32 aes4_key[4*5];
        unsigned first = (i>=3?0:i);  /* Which key comes first in aes4_key */
        /* Build AES4 key in use */
        memset((byte *)aes4_key, 0, 16);
        for (k=0; k<3; k++)
            memcpy((byte*)aes4_key+16+k*16, extracted_key+(k+first)%3*16, 16);
        if (i==2) memcpy((byte*)aes4_key+64, I, 16);
        else      memset((byte*)aes4_key+64, 0, 16);
        correct_key(aes4_key,5*16);
        /* Build encryption buffer from src and various offsets used */
        memcpy(buf, src, 16);
        if (i == 0) {
            mult_block(j,J,jJ); xor_bytes(buf,jJ,16,buf);
        } else if (i==1 || i==2) {
            mult_block(j%8,J,jJ); xor_bytes(buf,jJ,16,buf);
            for ( ; j>8; j-=8) mult_block(2,L,L);  /* L = 2^((j-1)/8) L */
            xor_bytes(buf, L, 16, buf);
        } else /* i >= 3 */ {
            mult_block((i-2)*8,J,iJ); xor_bytes(buf,iJ,16,buf);
            if (j>0) {
                mult_block(j%8,J,jJ); xor_bytes(buf,jJ,16,buf);
                for ( ; j>8; j-=8) mult_block(2,L,L);  /* L = 2^((j-1)/8) L */
                xor_bytes(buf, L, 16, buf);
            }
        }
        rijndaelEncryptRound(aes4_key, 10, buf, 4);
    }
    memcpy(dst, buf, 16);
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x1c8, %rsp            # imm = 0x1C8
vxorps %xmm0, %xmm0, %xmm0
vmovups %ymm0, 0xe0(%rsp)
vmovups %ymm0, 0xf0(%rsp)
movq %r9, %r12
movq %r8, 0x58(%rsp)
movq %rdi, 0x30(%rsp)
vmovaps 0x3756(%rip), %xmm0     # 0x5140
vmovaps %xmm0, 0x110(%rsp)
xorl %eax, %eax
movl 0x110(%rsp,%rax,4), %edi
movbel %edi, 0x110(%rsp,%rax,4)
incq %rax
cmpq $0x4, %rax
jne 0x19f5
movl $0x10, %eax
vmovaps 0x110(%rsp), %xmm0
vmovaps %xmm0, 0x110(%rsp,%rax)
addq $0x10, %rax
cmpq $0x50, %rax
jne 0x1a13
movl %ecx, 0x1c(%rsp)
cmpl $0x10, %esi
movq %rdx, 0xd8(%rsp)
jb 0x1b77
movq %r12, 0xd0(%rsp)
movq %rsi, 0xc8(%rsp)
leal -0x10(%rsi), %eax
shrl $0x4, %eax
incl %eax
movl %eax, 0x3c(%rsp)
movl $0x1, %ebp
leaq 0x70(%rsp), %r14
movl %ebp, %r13d
shrl $0x18, %r13d
movl %ebp, %ebx
shrl $0x10, %ebx
movl %ebp, %r15d
shrl $0x8, %r15d
movl $0x1, %r12d
movq $0x0, 0x70(%rsp)
movl $0x0, 0x78(%rsp)
movb %r12b, 0x77(%rsp)
movb %r13b, 0x7c(%rsp)
movb %bl, 0x7d(%rsp)
movb %r15b, 0x7e(%rsp)
movb %bpl, 0x7f(%rsp)
leaq 0x110(%rsp), %rdi
movl $0xa, %esi
movq %r14, %rdx
movl $0x4, %ecx
vzeroupper
callq 0x10c0
xorl %eax, %eax
movl 0x70(%rsp,%rax,4), %ecx
movbel %ecx, 0x70(%rsp,%rax,4)
incq %rax
cmpq $0x4, %rax
jne 0x1acb
movl $0x10, %eax
vmovaps 0x70(%rsp), %xmm0
vmovaps %xmm0, 0x70(%rsp,%rax)
addq $0x10, %rax
cmpq $0x50, %rax
jne 0x1ae3
movq 0x30(%rsp), %rax
vmovups (%rax), %xmm0
vmovaps %xmm0, 0x20(%rsp)
movq %r14, %rdi
movl $0xa, %esi
leaq 0x20(%rsp), %rdx
movl $0x4, %ecx
callq 0x10c0
movq %r12, %rax
shlq $0x4, %rax
vmovaps 0x20(%rsp), %xmm0
vxorps 0xd0(%rsp,%rax), %xmm0, %xmm0
vmovaps %xmm0, 0xd0(%rsp,%rax)
incq %r12
cmpq $0x4, %r12
jne 0x1a83
addq $0x10, 0x30(%rsp)
leal 0x1(%rbp), %eax
cmpl 0x3c(%rsp), %ebp
movl %eax, %ebp
jne 0x1a6a
movq 0xc8(%rsp), %rsi
movl %esi, %eax
andl $0xf, %eax
movq 0xd0(%rsp), %r12
jmp 0x1b79
movl %esi, %eax
testl %esi, %esi
setne %cl
testl %eax, %eax
sete %dl
testb %dl, %cl
jne 0x1c5f
movl %eax, %ebx
movl $0x1, %ebp
vxorps %xmm0, %xmm0, %xmm0
leaq 0x110(%rsp), %r14
leaq 0x70(%rsp), %r15
leaq 0x20(%rsp), %r13
vmovaps %xmm0, 0x70(%rsp)
movb %bpl, 0x77(%rsp)
movq %r14, %rdi
movl $0xa, %esi
movq %r15, %rdx
movl $0x4, %ecx
vzeroupper
callq 0x10c0
xorl %eax, %eax
movl 0x70(%rsp,%rax,4), %ecx
movbel %ecx, 0x70(%rsp,%rax,4)
incq %rax
cmpq $0x4, %rax
jne 0x1bcd
movl $0x10, %eax
vmovaps 0x70(%rsp), %xmm0
vmovaps %xmm0, 0x70(%rsp,%rax)
addq $0x10, %rax
cmpq $0x50, %rax
jne 0x1be5
vxorps %xmm0, %xmm0, %xmm0
vmovaps %xmm0, 0x20(%rsp)
movq %r13, %rdi
movq 0x30(%rsp), %rsi
movq %rbx, %rdx
callq 0x10d0
movb $-0x80, 0x20(%rsp,%rbx)
movq %r15, %rdi
movl $0xa, %esi
movq %r13, %rdx
movl $0x4, %ecx
callq 0x10c0
movq %rbp, %rax
shlq $0x4, %rax
vmovaps 0x20(%rsp), %xmm0
vxorps 0xd0(%rsp,%rax), %xmm0, %xmm0
vmovaps %xmm0, 0xd0(%rsp,%rax)
vxorps %xmm0, %xmm0, %xmm0
incq %rbp
cmpq $0x4, %rbp
jne 0x1ba8
vmovaps 0xf0(%rsp), %xmm0
vmovaps 0x100(%rsp), %xmm1
vmovaps %xmm0, 0x40(%rsp)
vmovaps %xmm1, 0x60(%rsp)
movq 0xd8(%rsp), %r9
testl %r9d, %r9d
js 0x1d10
xorl %eax, %eax
cmpl $0x3, %r9d
cmovbl %r9d, %eax
vxorps %xmm0, %xmm0, %xmm0
vmovaps %xmm0, 0x110(%rsp)
movl %eax, %ecx
shll $0x4, %ecx
movl $0x10, %edx
movl $0xaaaaaaab, %esi       # imm = 0xAAAAAAAB
movl 0x1c(%rsp), %ebp
movl %eax, %edi
imulq %rsi, %rdi
shrq $0x21, %rdi
shll $0x4, %edi
leal (%rdi,%rdi,2), %edi
movl %ecx, %r8d
subl %edi, %r8d
vmovaps 0xe0(%rsp,%r8), %xmm0
vmovaps %xmm0, 0x110(%rsp,%rdx)
addl $0x10, %ecx
incl %eax
addq $0x10, %rdx
cmpq $0x40, %rdx
jne 0x1cb8
leaq 0x150(%rsp), %rax
cmpl $0x2, %r9d
jne 0x1ddd
vmovaps 0xe0(%rsp), %xmm0
jmp 0x1de1
leaq 0xf0(%rsp), %rcx
vxorps %xmm0, %xmm0, %xmm0
leaq 0x120(%rsp), %rax
vmovaps %xmm0, -0x10(%rax)
vmovaps -0x10(%rcx), %xmm0
vmovaps %xmm0, (%rax)
vmovaps 0x10(%rcx), %xmm0
vmovaps %xmm0, 0x10(%rax)
vmovaps (%rcx), %xmm0
vmovaps %xmm0, 0x20(%rax)
xorl %ecx, %ecx
movl 0x1c(%rsp), %edi
movl 0x110(%rsp,%rcx,4), %edx
movbel %edx, 0x110(%rsp,%rcx,4)
incq %rcx
cmpq $0x10, %rcx
jne 0x1d4b
vmovups (%rax), %ymm0
vmovups 0x10(%rax), %ymm1
leaq 0x110(%rsp), %rbx
vmovups %ymm1, 0x50(%rbx)
vmovups %ymm0, 0x40(%rbx)
vmovups (%rax), %ymm0
vmovups 0x10(%rax), %ymm1
vmovups %ymm0, 0x70(%rbx)
vmovups %ymm1, 0x80(%rbx)
vmovaps (%rax), %xmm0
vmovaps %xmm0, 0xa0(%rbx)
leaq 0x40(%rsp), %rsi
leaq 0x20(%rsp), %r14
movq %r14, %rdx
vzeroupper
callq 0x1f46
movq 0x58(%rsp), %rax
vmovups (%rax), %xmm0
vxorps (%r14), %xmm0, %xmm0
movq %rsp, %rdx
vmovaps %xmm0, (%rdx)
movq %rbx, %rdi
movl $0xb, %esi
movl $0xa, %ecx
jmp 0x1f24
vxorps %xmm0, %xmm0, %xmm0
vmovaps %xmm0, (%rax)
xorl %eax, %eax
movl 0x110(%rsp,%rax,4), %ecx
movbel %ecx, 0x110(%rsp,%rax,4)
incq %rax
cmpq $0x14, %rax
jne 0x1de7
movq 0x58(%rsp), %rax
vmovups (%rax), %xmm0
vmovaps %xmm0, (%rsp)
testl %r9d, %r9d
je 0x1e6c
cmpl $0x2, %r9d
ja 0x1e89
movl %ebp, %edi
andl $0x7, %edi
leaq 0x40(%rsp), %rsi
leaq 0x20(%rsp), %rbx
movq %rbx, %rdx
vzeroupper
callq 0x1f46
vmovaps (%rbx), %xmm0
vxorps (%rsp), %xmm0, %xmm0
vmovaps %xmm0, (%rsp)
cmpl $0x9, %ebp
jb 0x1eff
leaq 0x60(%rsp), %rbx
movl $0x2, %edi
movq %rbx, %rsi
movq %rbx, %rdx
callq 0x1f46
addl $-0x8, %ebp
cmpl $0x8, %ebp
ja 0x1e4f
jmp 0x1eff
leaq 0x40(%rsp), %rsi
leaq 0x20(%rsp), %rbx
movl %ebp, %edi
movq %rbx, %rdx
vzeroupper
callq 0x1f46
vmovaps (%rbx), %xmm0
jmp 0x1f05
leal -0x10(,%r9,8), %edi
leaq 0x40(%rsp), %rsi
leaq 0x70(%rsp), %rbx
movq %rbx, %rdx
vzeroupper
callq 0x1f46
vmovaps (%rbx), %xmm0
vxorps (%rsp), %xmm0, %xmm0
vmovaps %xmm0, (%rsp)
testl %ebp, %ebp
je 0x1f0f
movl %ebp, %edi
andl $0x7, %edi
leaq 0x40(%rsp), %rsi
leaq 0x20(%rsp), %rbx
movq %rbx, %rdx
callq 0x1f46
vmovaps (%rbx), %xmm0
vxorps (%rsp), %xmm0, %xmm0
vmovaps %xmm0, (%rsp)
cmpl $0x9, %ebp
jb 0x1eff
leaq 0x60(%rsp), %rbx
movl $0x2, %edi
movq %rbx, %rsi
movq %rbx, %rdx
callq 0x1f46
addl $-0x8, %ebp
cmpl $0x8, %ebp
ja 0x1ee7
vmovaps 0x60(%rsp), %xmm0
vxorps (%rsp), %xmm0, %xmm0
vmovaps %xmm0, (%rsp)
leaq 0x110(%rsp), %rdi
movq %rsp, %rdx
movl $0xa, %esi
movl $0x4, %ecx
callq 0x10c0
vmovaps (%rsp), %xmm0
vmovups %xmm0, (%r12)
addq $0x1c8, %rsp            # imm = 0x1C8
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq