// File: /workspace/github_cpp_makefile_star2_O1/occivink[P]pyct/monocypher.cpp
// Function: poly_block(crypto_poly1305_ctx*, unsigned char const*, unsigned int)
static void poly_block(crypto_poly1305_ctx *ctx, const u8 in[16], unsigned end)
{
    u32 s[4];
    load32_le_buf(s, in, 4);

    // s = h + c, without carry propagation
    const u64 s0 = ctx->h[0] + (u64)s[0]; // s0 <= 1_fffffffe
    const u64 s1 = ctx->h[1] + (u64)s[1]; // s1 <= 1_fffffffe
    const u64 s2 = ctx->h[2] + (u64)s[2]; // s2 <= 1_fffffffe
    const u64 s3 = ctx->h[3] + (u64)s[3]; // s3 <= 1_fffffffe
    const u32 s4 = ctx->h[4] + end;       // s4 <=          5

    // Local all the things!
    const u32 r0 = ctx->r[0];       // r0  <= 0fffffff
    const u32 r1 = ctx->r[1];       // r1  <= 0ffffffc
    const u32 r2 = ctx->r[2];       // r2  <= 0ffffffc
    const u32 r3 = ctx->r[3];       // r3  <= 0ffffffc
    const u32 rr0 = (r0 >> 2) * 5;  // rr0 <= 13fffffb // lose 2 bits...
    const u32 rr1 = (r1 >> 2) + r1; // rr1 <= 13fffffb // rr1 == (r1 >> 2) * 5
    const u32 rr2 = (r2 >> 2) + r2; // rr2 <= 13fffffb // rr1 == (r2 >> 2) * 5
    const u32 rr3 = (r3 >> 2) + r3; // rr3 <= 13fffffb // rr1 == (r3 >> 2) * 5

    // (h + c) * r, without carry propagation
    const u64 x0 = s0*r0+ s1*rr3+ s2*rr2+ s3*rr1+ s4*rr0; // <= 97ffffe007fffff8
    const u64 x1 = s0*r1+ s1*r0 + s2*rr3+ s3*rr2+ s4*rr1; // <= 8fffffe20ffffff6
    const u64 x2 = s0*r2+ s1*r1 + s2*r0 + s3*rr3+ s4*rr2; // <= 87ffffe417fffff4
    const u64 x3 = s0*r3+ s1*r2 + s2*r1 + s3*r0 + s4*rr3; // <= 7fffffe61ffffff2
    const u32 x4 = s4 * (r0 & 3); // ...recover 2 bits    // <=                f

    // partial reduction modulo 2^130 - 5
    const u32 u5 = x4 + (x3 >> 32); // u5 <= 7ffffff5
    const u64 u0 = (u5 >>  2) * 5 + (x0 & 0xffffffff);
    const u64 u1 = (u0 >> 32)     + (x1 & 0xffffffff) + (x0 >> 32);
    const u64 u2 = (u1 >> 32)     + (x2 & 0xffffffff) + (x1 >> 32);
    const u64 u3 = (u2 >> 32)     + (x3 & 0xffffffff) + (x2 >> 32);
    const u64 u4 = (u3 >> 32)     + (u5 & 3);

    // Update the hash
    ctx->h[0] = (u32)u0; // u0 <= 1_9ffffff0
    ctx->h[1] = (u32)u1; // u1 <= 1_97ffffe0
    ctx->h[2] = (u32)u2; // u2 <= 1_8fffffe2
    ctx->h[3] = (u32)u3; // u3 <= 1_87ffffe4
    ctx->h[4] = (u32)u4; // u4 <=          4
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
movl %edx, %r12d
xorl %eax, %eax
movl (%rsi,%rax,4), %ecx
movl %ecx, -0x28(%rsp,%rax,4)
incq %rax
cmpq $0x4, %rax
jne 0x2c4d
movl 0x10(%rdi), %eax
movl -0x28(%rsp), %r10d
movl -0x24(%rsp), %edx
addq %rax, %r10
movl 0x14(%rdi), %eax
addq %rax, %rdx
movl 0x18(%rdi), %eax
movl -0x20(%rsp), %r14d
addq %rax, %r14
movl 0x1c(%rdi), %eax
movl -0x1c(%rsp), %r13d
addq %rax, %r13
addl 0x20(%rdi), %r12d
movl (%rdi), %r11d
movl 0x4(%rdi), %r15d
movl 0x8(%rdi), %r8d
movq %r8, -0x8(%rsp)
movl 0xc(%rdi), %r9d
movl %r11d, %esi
shrl $0x2, %esi
movl %r15d, %ecx
shrl $0x2, %ecx
addl %r15d, %ecx
movl %r8d, %eax
shrl $0x2, %eax
addl %r8d, %eax
movq %r14, %r8
imulq %rax, %r8
movq %rcx, %rbp
imulq %r13, %rbp
addq %r8, %rbp
movq %r10, %r8
imulq %r11, %r8
imull %r12d, %esi
leal (%rsi,%rsi,4), %esi
addq %r8, %rsi
movq %r9, -0x10(%rsp)
movl %r9d, %r8d
shrl $0x2, %r8d
addl %r9d, %r8d
addq %rbp, %rsi
movq %rdx, %rbp
imulq %r8, %rbp
addq %rbp, %rsi
movq %r10, %rbp
imulq %r15, %rbp
movq %rdx, %r9
imulq %r11, %r9
addq %rbp, %r9
movq %r14, %rbp
imulq %r8, %rbp
movq %r13, %rbx
imulq %rax, %rbx
addq %rbp, %rbx
imull %r12d, %ecx
addq %r9, %rcx
addq %rbx, %rcx
movq %rdx, %r9
imulq %r15, %r9
movq %r14, %rbx
imulq %r11, %rbx
addq %r9, %rbx
movq %r10, %r9
movq -0x8(%rsp), %rbp
imulq %rbp, %r9
addq %r9, %rbx
movq %r13, %r9
imulq %r8, %r9
imull %r12d, %eax
addq %r9, %rax
addq %rbx, %rax
imulq -0x10(%rsp), %r10
imulq %rbp, %rdx
addq %r10, %rdx
imulq %r15, %r14
imulq %r11, %r13
addq %r14, %r13
addq %rdx, %r13
imull %r12d, %r8d
addq %r13, %r8
andl $0x3, %r11d
imull %r12d, %r11d
movq %r8, %rdx
shrq $0x20, %rdx
addl %r11d, %edx
movl %edx, %r9d
shrl $0x2, %r9d
leal (%r9,%r9,4), %r10d
movl %esi, %r9d
addq %r10, %r9
movl %ecx, %r10d
shrq $0x20, %rsi
addq %r10, %rsi
movl %r9d, 0x10(%rdi)
shrq $0x20, %r9
addq %r9, %rsi
movl %eax, %r9d
shrq $0x20, %rcx
addq %r9, %rcx
movl %esi, 0x14(%rdi)
shrq $0x20, %rsi
addq %rsi, %rcx
movl %r8d, %esi
shrq $0x20, %rax
addq %rsi, %rax
movl %ecx, 0x18(%rdi)
shrq $0x20, %rcx
addq %rcx, %rax
movl %eax, 0x1c(%rdi)
shrq $0x20, %rax
andl $0x3, %edx
addl %edx, %eax
movl %eax, 0x20(%rdi)
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq