// File: cgvwzq[P]aes_bf/src/aes-brute-force.cpp
// Function: aes_brute_force::search(voffset, unsigned char*, unsigned char*, unsigned char*, unsigned char*, unsigned char*, unsigned long&, bool&)
static
	void search(voffset_t v, uint8_t cipher[16], uint8_t key[16], uint8_t iv[16], uint8_t plain_mask[16], uint8_t plain[16], uint64_t &aes_cnt, bool &found)
	{
		uint8_t r[16];
		uint64_t n_loops = 1 << v.n_offsets; // iterate over all offsets combinations 
		found = false;
		__m128i key_schedule[20] = {0};
		aes128_load_key (key, key_schedule);
		aes_cnt = 0;

		for (uint64_t cnt=1; cnt < n_loops; cnt++)
		{
			// create index of offsets. more elegant with hamming weight and binary operations...
			uint8_t index[16] = {0}, ones = 0;
			for (uint8_t i=0; i < v.n_offsets; i++)
			{
				if (cnt & (1 << i))
				{
					index[ones++] = i;
				}
			}
			uint64_t n_chars = std::pow(v.n_valid_chars, ones);
			for (uint64_t c=0; c < n_chars; c++)
			{
				uint64_t t = c;
				for (uint8_t o=0; o < ones; o++)
				{
					cipher[v.offsets[index[o]]] = v.valid_chars[index[o]][t % v.n_valid_chars];
					t = t / v.n_valid_chars;
					
				}
				aes128_dec (key_schedule, cipher, r);
				#ifndef PADDING
					if (is_valid_plaintext (r, plain_mask, plain, iv))
				#else
					if (is_valid_plaintext_padding (r, plain_mask, plain, iv))
				#endif
				{
					found = true;
					done = true;
					return;
				}
				aes_cnt++;
				if (debug && !((aes_cnt+1) % 300000000))
				{
					println_128 ("\t(debug): ", cipher);
				}
			}
		}
	}

// Assembly:
subq $0x1f8, %rsp            # imm = 0x1F8
movq 0x1228(%rsp), %rax
leaq 0x200(%rsp), %rax
movq %rax, 0x10(%rsp)
movq %rdi, 0x1f0(%rsp)
movq %rsi, 0x1e8(%rsp)
movq %rdx, 0x1e0(%rsp)
movq %rcx, 0x1d8(%rsp)
movq %r8, 0x1d0(%rsp)
movq %r9, 0x1c8(%rsp)
movzbl 0x10(%rax), %ecx
movl $0x1, %eax
shll %cl, %eax
cltq
movq %rax, 0x1a8(%rsp)
movq 0x1228(%rsp), %rax
movb $0x0, (%rax)
leaq 0x60(%rsp), %rdi
xorl %esi, %esi
movl $0x140, %edx            # imm = 0x140
callq 0x20d0
movq 0x1e8(%rsp), %rdi
leaq 0x60(%rsp), %rsi
callq 0x4250
movq 0x1c8(%rsp), %rax
movq $0x0, (%rax)
movq $0x1, 0x58(%rsp)
movq 0x58(%rsp), %rax
cmpq 0x1a8(%rsp), %rax
jae 0x6421
leaq 0x40(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x20d0
movb $0x0, 0x3f(%rsp)
movb $0x0, 0x3e(%rsp)
movq 0x10(%rsp), %rcx
movzbl 0x3e(%rsp), %eax
movzbl 0x10(%rcx), %ecx
cmpl %ecx, %eax
jge 0x627c
movq 0x58(%rsp), %rax
movzbl 0x3e(%rsp), %ecx
movl $0x1, %edx
shll %cl, %edx
movl %edx, %ecx
movslq %ecx, %rcx
andq %rcx, %rax
cmpq $0x0, %rax
je 0x626e
movb 0x3e(%rsp), %cl
movb 0x3f(%rsp), %al
movb %al, %dl
addb $0x1, %dl
movb %dl, 0x3f(%rsp)
movzbl %al, %eax
movb %cl, 0x40(%rsp,%rax)
jmp 0x6270
movb 0x3e(%rsp), %al
addb $0x1, %al
movb %al, 0x3e(%rsp)
jmp 0x6225
movq 0x10(%rsp), %rax
movzbl 0x1011(%rax), %edi
movzbl 0x3f(%rsp), %esi
callq 0x6470
vcvttsd2usi %xmm0, %rax
movq %rax, 0x30(%rsp)
movq $0x0, 0x28(%rsp)
movq 0x28(%rsp), %rax
cmpq 0x30(%rsp), %rax
jae 0x640c
movq 0x28(%rsp), %rax
movq %rax, 0x20(%rsp)
movb $0x0, 0x1f(%rsp)
movzbl 0x1f(%rsp), %eax
movzbl 0x3f(%rsp), %ecx
cmpl %ecx, %eax
jge 0x6350
movq 0x10(%rsp), %rcx
movq %rcx, %rax
addq $0x11, %rax
movzbl 0x1f(%rsp), %edx
movzbl 0x40(%rsp,%rdx), %edx
shlq $0x8, %rdx
addq %rdx, %rax
movq %rax, 0x8(%rsp)
movq 0x20(%rsp), %rax
movzbl 0x1011(%rcx), %edx
movl %edx, %esi
xorl %edx, %edx
divq %rsi
movq 0x8(%rsp), %rax
movb (%rax,%rdx), %sil
movq 0x1f0(%rsp), %rax
movzbl 0x1f(%rsp), %edx
movzbl 0x40(%rsp,%rdx), %edx
movzbl (%rcx,%rdx), %edx
movb %sil, (%rax,%rdx)
movq 0x20(%rsp), %rax
movzbl 0x1011(%rcx), %ecx
xorl %edx, %edx
divq %rcx
movq %rax, 0x20(%rsp)
movb 0x1f(%rsp), %al
addb $0x1, %al
movb %al, 0x1f(%rsp)
jmp 0x62c5
leaq 0x60(%rsp), %rdi
movq 0x1f0(%rsp), %rsi
leaq 0x1b0(%rsp), %rdx
callq 0x44c0
leaq 0x1b0(%rsp), %rdi
movq 0x1d8(%rsp), %rsi
movq 0x1d0(%rsp), %rdx
movq 0x1e0(%rsp), %rcx
callq 0x64a0
testb $0x1, %al
jne 0x6395
jmp 0x63a9
movq 0x1228(%rsp), %rax
movb $0x1, (%rax)
movb $0x1, 0x5d9b(%rip)      # 0xc142
jmp 0x6421
movq 0x1c8(%rsp), %rax
movq (%rax), %rcx
addq $0x1, %rcx
movq %rcx, (%rax)
testb $0x1, 0x5d6e(%rip)      # 0xc130
je 0x63f7
movq 0x1c8(%rsp), %rax
movq (%rax), %rax
addq $0x1, %rax
movl $0x11e1a300, %ecx       # imm = 0x11E1A300
xorl %edx, %edx
divq %rcx
cmpq $0x0, %rdx
jne 0x63f7
movq 0x1f0(%rsp), %rsi
leaq 0x2019(%rip), %rdi      # 0x840b
callq 0x43e0
jmp 0x63f9
movq 0x28(%rsp), %rax
addq $0x1, %rax
movq %rax, 0x28(%rsp)
jmp 0x62a6
jmp 0x640e
movq 0x58(%rsp), %rax
addq $0x1, %rax
movq %rax, 0x58(%rsp)
jmp 0x61f7
addq $0x1f8, %rsp            # imm = 0x1F8
retq
nopl (%rax)