// File: /workspace/github_c_makefile_star2_O1/mjosaarinen[P]brutus/crypto_aead/shellaes128v1d5n64/ref/shellaes.c
// Function: shellaesEnc_short
void shellaesEnc_short(const u8 key[], const u8 nonce[], const u8 ad[], unsigned long long int adlen, const u8 p[], unsigned long long int ptlen, u8 c[], u8 tag[]){

         u8 V[16], F[16], keyprime[16], L[16], Lprime[16], S[16], I[16];

         u32 mk[4*d], sk[12*d], rk[44], rkprime[44];

         u8 pt[16], pt1[16], pt2[16], ct1[16], ct2[16];
         u8 mask[16];
         u8 temp[16];
         int i;

         /*key setup*/
         aesKeySetupEnc(rk, key);
         KeySetupEnc(mk, sk, L, Lprime, keyprime, rk, key);
         aesKeySetupEnc(rkprime, keyprime);

         /*PXMAC: process the associated data and save output to V[]*/
         memset(V, 0, 16);
         PXMAC(mk, sk, L, V, rk, ad, adlen);

         /*CENC: process nonce and save the output to S[] and F[]*/
         CENC(rkprime, S, F, nonce, 16);


         /*pad p[] to a full block and save it to pt[]*/
         memset(pt, 0, 16);
         memcpy(pt, p, ptlen);
         pt[ptlen]=0x80;

         /*mask pt[] by xoring the output S[] of CENC, and save it to I[] */
         memcpy(I, S, 16);
         xor_byte_string(pt, I, 16);

         /*compute 3^3*Lprime and save it to mask[]*/
         memcpy(mask, Lprime, 16);
         for(i=0; i<3; ++i){
            memcpy(temp, mask, 16);
            double_mask(mask);
            xor_byte_string(temp, mask, 16);
         }

         /*compute XEX cipher with tweak of 3^3*Lprime and input I[], and save the output to ct1[]*/

         memcpy(pt1, I, 16);
         xor_byte_string(mask, pt1, 16);
         aesEncrypt(rk, pt1, ct1);
         xor_byte_string(mask, ct1, 16);

         /*compute XEX cipher with tweak of 2*3^3*Lprime and input I[], and save the output to ct2[]*/
         double_mask(mask);
         memcpy(pt2, I, 16);
         xor_byte_string(mask, pt2, 16);
         aesEncrypt(rk, pt2, ct2);
         xor_byte_string(mask, ct2, 16);

         /*compute XEX cipher with tweak of 2^2*3^3*Lprime and input of xoring ct1 and the output V of PX-MAC,
           and save the output to ct1[]*/
         xor_byte_string(ct1, V, 16);
         memcpy(pt1, V, 16);
         double_mask(mask);
         xor_byte_string(mask, pt1, 16);
         aesEncrypt(rk, pt1, ct1);
         xor_byte_string(mask, ct1, 16);

        /*compute XEX cipher with tweak of 2^3*3^3*Lprime and input of xoring ct2 and the updated V,
          and save the output to ct2[]*/
         xor_byte_string(ct2, V, 16);
         memcpy(pt2, V, 16);
         double_mask(mask);
         xor_byte_string(mask, pt2, 16);
         aesEncrypt(rk, pt2, ct2);
         xor_byte_string(mask, ct2, 16);

         /*xor ct2 with the output F of CENC*/
         xor_byte_string(F, ct2, 16);

         /*tag splitting:
         produce the ciphertext and tag from ct1 and ct2*/
         memcpy(c, ct1, ptlen);
         for(i=ptlen; i<16; ++i){
            tag[i-ptlen]=ct1[i];
         }
         for(i=0; i<ptlen; ++i){
            tag[16-ptlen+i]=ct2[i];
         }

        /*
        printf("ciphertext is: \n");
        printf_byte_string(c, ptlen);

        printf("tag value is: \n");
        printf_byte_string(tag, 16);
        */

}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x3a8, %rsp            # imm = 0x3A8
movq %r9, %rbx
movq %r8, 0x20(%rsp)
movq %rcx, %r14
movq %rdx, 0x78(%rsp)
movq %rsi, 0x30(%rsp)
movq %rdi, %r12
leaq 0x100(%rsp), %rbp
movq %rbp, %rdi
movq %r12, %rsi
callq 0x2170
movq %r12, (%rsp)
leaq 0x1b0(%rsp), %r12
leaq 0x2b0(%rsp), %rsi
leaq 0xe0(%rsp), %r13
leaq 0xb0(%rsp), %rcx
leaq 0xf0(%rsp), %r15
movq %r12, %rdi
movq %r13, %rdx
movq %r15, %r8
movq %rbp, %r9
callq 0x2210
leaq 0x200(%rsp), %rdi
movq %r15, %rsi
movq %rbx, %r15
callq 0x2170
vxorps %xmm0, %xmm0, %xmm0
leaq 0x50(%rsp), %rcx
vmovaps %xmm0, (%rcx)
movq %r14, (%rsp)
movq %r12, %rdi
leaq 0x2b0(%rsp), %rsi
movq %r13, %rdx
movq %rbp, %r8
movq 0x78(%rsp), %r9
callq 0x21a0
leaq 0xd0(%rsp), %rbx
leaq 0xc0(%rsp), %rdx
movl $0x10, %r8d
leaq 0x200(%rsp), %rdi
movq %rbx, %rsi
movq 0x30(%rsp), %rcx
callq 0x2180
leaq 0xa0(%rsp), %r14
vxorps %xmm0, %xmm0, %xmm0
vmovaps %xmm0, (%r14)
movq %r14, %rdi
movq 0x20(%rsp), %rsi
movq %r15, %rdx
callq 0x2240
movb $-0x80, 0xa0(%rsp,%r15)
vmovaps (%rbx), %xmm0
vxorps (%r14), %xmm0, %xmm1
leaq 0xb0(%rsp), %rax
vmovaps (%rax), %xmm0
vmovaps %xmm0, 0x10(%rsp)
xorl %eax, %eax
vmovaps 0x10(%rsp), %xmm0
movl $0xf, %edx
movb 0x10(%rsp), %cl
xorl %esi, %esi
movb 0x10(%rsp,%rdx), %dil
leal (%rdi,%rdi), %r8d
orb %sil, %r8b
movb %r8b, 0x10(%rsp,%rdx)
shrb $0x7, %dil
movl %edi, %esi
addq $-0x1, %rdx
jb 0x5703
testb %cl, %cl
jns 0x5729
xorb $-0x79, 0x1f(%rsp)
vxorps 0x10(%rsp), %xmm0, %xmm0
vmovaps %xmm0, 0x10(%rsp)
incl %eax
cmpl $0x3, %eax
jne 0x56f2
vmovaps 0x10(%rsp), %xmm0
vmovaps %xmm0, 0x30(%rsp)
vmovaps %xmm1, 0x20(%rsp)
vxorps %xmm0, %xmm1, %xmm0
leaq 0x90(%rsp), %rsi
vmovaps %xmm0, (%rsi)
leaq 0x100(%rsp), %rdi
leaq 0x40(%rsp), %rbx
movq %rbx, %rdx
callq 0x21e0
vmovaps 0x30(%rsp), %xmm0
vxorps (%rbx), %xmm0, %xmm0
vmovaps %xmm0, (%rbx)
movl $0xf, %eax
xorl %edx, %edx
movb 0x10(%rsp), %cl
movb 0x10(%rsp,%rax), %sil
leal (%rsi,%rsi), %edi
orb %dl, %dil
movb %dil, 0x10(%rsp,%rax)
shrb $0x7, %sil
movl %esi, %edx
addq $-0x1, %rax
jb 0x578c
testb %cl, %cl
jns 0x57b1
xorb $-0x79, 0x1f(%rsp)
vmovaps 0x10(%rsp), %xmm0
vmovaps %xmm0, 0x30(%rsp)
vxorps 0x20(%rsp), %xmm0, %xmm0
leaq 0x80(%rsp), %rsi
vmovaps %xmm0, (%rsi)
leaq 0x100(%rsp), %rdi
leaq 0x60(%rsp), %rbx
movq %rbx, %rdx
callq 0x21e0
vmovaps 0x30(%rsp), %xmm0
vxorps (%rbx), %xmm0, %xmm0
vmovaps %xmm0, (%rbx)
vmovaps 0x50(%rsp), %xmm0
vxorps 0x40(%rsp), %xmm0, %xmm0
vmovaps %xmm0, 0x50(%rsp)
vmovaps %xmm0, 0x90(%rsp)
movl $0xf, %eax
xorl %edx, %edx
movb 0x10(%rsp), %cl
movb 0x10(%rsp,%rax), %sil
leal (%rsi,%rsi), %edi
orb %dl, %dil
movb %dil, 0x10(%rsp,%rax)
shrb $0x7, %sil
movl %esi, %edx
addq $-0x1, %rax
jb 0x5818
testb %cl, %cl
jns 0x583d
xorb $-0x79, 0x1f(%rsp)
vmovaps 0x10(%rsp), %xmm0
vmovaps %xmm0, 0x20(%rsp)
leaq 0x90(%rsp), %rsi
vxorps (%rsi), %xmm0, %xmm0
vmovaps %xmm0, (%rsi)
leaq 0x100(%rsp), %rdi
leaq 0x40(%rsp), %rbx
movq %rbx, %rdx
callq 0x21e0
vmovaps 0x20(%rsp), %xmm0
vxorps (%rbx), %xmm0, %xmm0
vmovaps %xmm0, (%rbx)
vmovaps 0x50(%rsp), %xmm0
vxorps 0x60(%rsp), %xmm0, %xmm0
vmovaps %xmm0, 0x50(%rsp)
vmovaps %xmm0, 0x80(%rsp)
movl $0xf, %eax
xorl %edx, %edx
movb 0x10(%rsp), %cl
movb 0x10(%rsp,%rax), %sil
leal (%rsi,%rsi), %edi
orb %dl, %dil
movb %dil, 0x10(%rsp,%rax)
shrb $0x7, %sil
movl %esi, %edx
addq $-0x1, %rax
jb 0x58a2
testb %cl, %cl
jns 0x58c7
xorb $-0x79, 0x1f(%rsp)
vmovaps 0x10(%rsp), %xmm0
vmovaps %xmm0, 0x20(%rsp)
leaq 0x80(%rsp), %rsi
vxorps (%rsi), %xmm0, %xmm0
vmovaps %xmm0, (%rsi)
leaq 0x100(%rsp), %rdi
leaq 0x60(%rsp), %rbx
movq %rbx, %rdx
callq 0x21e0
vmovdqa (%rbx), %xmm0
vmovdqa 0x20(%rsp), %xmm1
vpternlogq $0x96, 0xc0(%rsp), %xmm1, %xmm0
vmovdqa %xmm0, (%rbx)
leaq 0x40(%rsp), %rsi
movq 0x3e0(%rsp), %rdi
movq %r15, %rdx
callq 0x2240
cmpl $0xf, %r15d
movq 0x3e8(%rsp), %rbx
jg 0x5952
movslq %r15d, %rdi
leaq (%rsp,%rdi), %rsi
addq $0x40, %rsi
movl $0xf, %edx
subl %edi, %edx
subq %r15, %rdi
addq %rbx, %rdi
incq %rdx
callq 0x2240
testq %r15, %r15
je 0x596e
subq %r15, %rbx
addq $0x10, %rbx
leaq 0x60(%rsp), %rsi
movq %rbx, %rdi
movq %r15, %rdx
callq 0x2240
addq $0x3a8, %rsp            # imm = 0x3A8
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq