// File: /workspace/github_c_makefile_star2_O1/mjosaarinen[P]brutus/crypto_aead/hs1sivv2/ref/encrypt.c
// Function: prf_hash2
void prf_hash2(uint64_t *h, uint32_t *in, unsigned inbytes, uint32_t *nhkey,
               uint64_t *polykey, uint64_t *asukey) {
    uint64_t s0 = 1, s1 = 1;
    unsigned i=0, j;

    /* Hash full blocks of HS1_SIV_NH_LEN bytes */
    while (inbytes >= HS1_SIV_NH_LEN) {
        uint64_t a0 = 0, a1 = 0;
        for (i=0;i<HS1_SIV_NH_LEN/4;i+=8) {
            a0 += (uint64_t)(read32le(in+i+0) + nhkey[i+0]) *
                            (read32le(in+i+2) + nhkey[i+2]);
            a0 += (uint64_t)(read32le(in+i+1) + nhkey[i+1]) *
                            (read32le(in+i+3) + nhkey[i+3]);
            a1 += (uint64_t)(read32le(in+i+0) + nhkey[i+4]) *
                            (read32le(in+i+2) + nhkey[i+6]);
            a1 += (uint64_t)(read32le(in+i+1) + nhkey[i+5]) *
                            (read32le(in+i+3) + nhkey[i+7]);
            a0 += (uint64_t)(read32le(in+i+4) + nhkey[i+4]) *
                            (read32le(in+i+6) + nhkey[i+6]);
            a0 += (uint64_t)(read32le(in+i+5) + nhkey[i+5]) *
                            (read32le(in+i+7) + nhkey[i+7]);
            a1 += (uint64_t)(read32le(in+i+4) + nhkey[i+8]) *
                            (read32le(in+i+6) + nhkey[i+10]);
            a1 += (uint64_t)(read32le(in+i+5) + nhkey[i+9]) *
                            (read32le(in+i+7) + nhkey[i+11]);
        }
        s0 = poly_step(s0, a0&m60, polykey[0]);
        s1 = poly_step(s1, a1&m60, polykey[1]);
        inbytes -= HS1_SIV_NH_LEN;
        in += HS1_SIV_NH_LEN/4;
    }
    /* If partial block remains, hash it */
    i=0;
    if (inbytes != 0) {
        uint64_t a0 = 0, a1 = 0;
        while (inbytes >= 16) {
            a0 += (uint64_t)(read32le(in+i+0) + nhkey[i+0]) *
                            (read32le(in+i+2) + nhkey[i+2]);
            a0 += (uint64_t)(read32le(in+i+1) + nhkey[i+1]) *
                            (read32le(in+i+3) + nhkey[i+3]);
            a1 += (uint64_t)(read32le(in+i+0) + nhkey[i+4]) *
                            (read32le(in+i+2) + nhkey[i+6]);
            a1 += (uint64_t)(read32le(in+i+1) + nhkey[i+5]) *
                            (read32le(in+i+3) + nhkey[i+7]);
            i += 4; inbytes -= 16;
        }
        if (inbytes) {
            uint32_t tail[4] = {0,0,0,0};
            for (j=0;j<inbytes;j++)
                ((unsigned char *)tail)[j] = ((unsigned char *)(in+i))[j];
            a0 += (uint64_t)(read32le(tail+0) + nhkey[i+0]) *
                            (read32le(tail+2) + nhkey[i+2]);
            a0 += (uint64_t)(read32le(tail+1) + nhkey[i+1]) *
                            (read32le(tail+3) + nhkey[i+3]);
            a1 += (uint64_t)(read32le(tail+0) + nhkey[i+4]) *
                            (read32le(tail+2) + nhkey[i+6]);
            a1 += (uint64_t)(read32le(tail+1) + nhkey[i+5]) *
                            (read32le(tail+3) + nhkey[i+7]);
            a0 += inbytes;
            a1 += inbytes;
        }
        s0 = poly_step(s0, a0&m60, polykey[0]);
        s1 = poly_step(s1, a1&m60, polykey[1]);
    }
    s0 = poly_finalize(s0);
    s1 = poly_finalize(s1);
    #if (HS1_SIV_HASH_RNDS > 4)
    write64le(h, (uint64_t)asu_hash(s1, asukey+3) << 32 | asu_hash(s0, asukey));
    #else
    (void)asukey;
    write64le(h,s0);
    write64le(h+1,s1);
    #endif
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
movl %edx, %r9d
movabsq $0x1fffffffffffffff, %r14 # imm = 0x1FFFFFFFFFFFFFFF
movabsq $0xfffffffffffffff, %r15 # imm = 0xFFFFFFFFFFFFFFF
movl $0x1, %eax
cmpl $0x40, %edx
jb 0x16c3
movq (%r8), %r11
movq 0x8(%r8), %rbx
vmovdqu 0x10(%rcx), %ymm0
vmovdqu 0x30(%rcx), %ymm1
vpunpckhdq %xmm1, %xmm0, %xmm2 # xmm2 = xmm0[2],xmm1[2],xmm0[3],xmm1[3]
vpunpckldq %xmm1, %xmm0, %xmm3 # xmm3 = xmm0[0],xmm1[0],xmm0[1],xmm1[1]
vpshufd $0xee, %xmm2, %xmm4     # xmm4 = xmm2[2,3,2,3]
vpsrlq $0x20, %xmm0, %xmm5
vpblendd $0x2, %xmm1, %xmm5, %xmm5 # xmm5 = xmm5[0],xmm1[1],xmm5[2,3]
vmovd 0x8(%rcx), %xmm6
vpinsrd $0x1, 0x28(%rcx), %xmm6, %xmm6
vmovd (%rcx), %xmm7
vpinsrd $0x1, 0x20(%rcx), %xmm7, %xmm7
vmovd 0xc(%rcx), %xmm8
vpinsrd $0x1, 0x2c(%rcx), %xmm8, %xmm8
vmovd 0x4(%rcx), %xmm9
vpinsrd $0x1, 0x24(%rcx), %xmm9, %xmm9
movl $0x1, %r10d
vpbroadcastq 0xb31(%rip), %ymm10 # 0x2010
vmovdqu (%rsi), %ymm13
vmovdqu 0x20(%rsi), %ymm11
vpunpckhdq %xmm11, %xmm13, %xmm14 # xmm14 = xmm13[2],xmm11[2],xmm13[3],xmm11[3]
vpaddd %xmm2, %xmm14, %xmm12
vpmovzxdq %xmm12, %xmm12  # xmm12 = xmm12[0],zero,xmm12[1],zero
vpunpckldq %xmm11, %xmm13, %xmm15 # xmm15 = xmm13[0],xmm11[0],xmm13[1],xmm11[1]
vpaddd %xmm15, %xmm3, %xmm16
vpmovzxdq %xmm16, %xmm16  # xmm16 = xmm16[0],zero,xmm16[1],zero
vpmuludq %xmm16, %xmm12, %xmm16
vpshufd $0xee, %xmm14, %xmm17   # xmm17 = xmm14[2,3,2,3]
vpaddd %xmm17, %xmm4, %xmm12
vpmovzxdq %xmm12, %xmm18  # xmm18 = xmm12[0],zero,xmm12[1],zero
vpsrlq $0x20, %xmm13, %xmm12
vpblendd $0x2, %xmm11, %xmm12, %xmm12 # xmm12 = xmm12[0],xmm11[1],xmm12[2,3]
vpaddd %xmm12, %xmm5, %xmm19
vpmovzxdq %xmm19, %xmm19  # xmm19 = xmm19[0],zero,xmm19[1],zero
vpmuludq %xmm19, %xmm18, %xmm18
vpaddq %xmm18, %xmm16, %xmm16
vpaddd %ymm11, %ymm1, %ymm18
vpaddd %ymm13, %ymm0, %ymm19
vpunpckhdq %ymm18, %ymm19, %ymm20 # ymm20 = ymm19[2],ymm18[2],ymm19[3],ymm18[3],ymm19[6],ymm18[6],ymm19[7],ymm18[7]
vextracti32x4 $0x1, %ymm20, %xmm21
vpmovzxdq %xmm21, %xmm21  # xmm21 = xmm21[0],zero,xmm21[1],zero
vpunpckldq %ymm18, %ymm19, %ymm22 # ymm22 = ymm19[0],ymm18[0],ymm19[1],ymm18[1],ymm19[4],ymm18[4],ymm19[5],ymm18[5]
vextracti32x4 $0x1, %ymm22, %xmm22
vpmovzxdq %xmm22, %xmm22  # xmm22 = xmm22[0],zero,xmm22[1],zero
vpmuludq %xmm22, %xmm21, %xmm21
vpaddq %xmm21, %xmm16, %xmm16
vpshufd $0xee, %ymm20, %ymm20   # ymm20 = ymm20[2,3,2,3,6,7,6,7]
vextracti32x4 $0x1, %ymm20, %xmm20
vpmovzxdq %xmm20, %xmm20  # xmm20 = xmm20[0],zero,xmm20[1],zero
vpermt2d %ymm18, %ymm10, %ymm19
vextracti32x4 $0x1, %ymm19, %xmm18
vpmovzxdq %xmm18, %xmm18  # xmm18 = xmm18[0],zero,xmm18[1],zero
vpmuludq %xmm18, %xmm20, %xmm18
vpaddq %xmm18, %xmm16, %xmm16
vpunpckhdq %ymm11, %ymm13, %ymm18 # ymm18 = ymm13[2],ymm11[2],ymm13[3],ymm11[3],ymm13[6],ymm11[6],ymm13[7],ymm11[7]
vpshufd $0xee, %ymm18, %ymm19   # ymm19 = ymm18[2,3,2,3,6,7,6,7]
vextracti32x4 $0x1, %ymm19, %xmm19
vpunpckldq %ymm11, %ymm13, %ymm20 # ymm20 = ymm13[0],ymm11[0],ymm13[1],ymm11[1],ymm13[4],ymm11[4],ymm13[5],ymm11[5]
vpermt2d %ymm11, %ymm10, %ymm13
vextracti128 $0x1, %ymm13, %xmm11
vextracti32x4 $0x1, %ymm18, %xmm13
vextracti32x4 $0x1, %ymm20, %xmm18
vpaddd %xmm6, %xmm14, %xmm14
vpmovzxdq %xmm14, %xmm14  # xmm14 = xmm14[0],zero,xmm14[1],zero
vpaddd %xmm7, %xmm15, %xmm15
vpmovzxdq %xmm15, %xmm15  # xmm15 = xmm15[0],zero,xmm15[1],zero
vpmuludq %xmm15, %xmm14, %xmm14
vpaddd %xmm17, %xmm8, %xmm15
vpmovzxdq %xmm15, %xmm15  # xmm15 = xmm15[0],zero,xmm15[1],zero
vpaddd %xmm12, %xmm9, %xmm12
vpmovzxdq %xmm12, %xmm12  # xmm12 = xmm12[0],zero,xmm12[1],zero
vpmuludq %xmm12, %xmm15, %xmm12
vpaddq %xmm12, %xmm14, %xmm12
vpaddd %xmm2, %xmm13, %xmm13
vpmovzxdq %xmm13, %xmm13  # xmm13 = xmm13[0],zero,xmm13[1],zero
vpaddd %xmm3, %xmm18, %xmm14
vpmovzxdq %xmm14, %xmm14  # xmm14 = xmm14[0],zero,xmm14[1],zero
vpmuludq %xmm14, %xmm13, %xmm13
vpaddq %xmm13, %xmm12, %xmm12
vpaddd %xmm4, %xmm19, %xmm13
vpmovzxdq %xmm13, %xmm13  # xmm13 = xmm13[0],zero,xmm13[1],zero
vpaddd %xmm5, %xmm11, %xmm11
vpmovzxdq %xmm11, %xmm11  # xmm11 = xmm11[0],zero,xmm11[1],zero
vpmuludq %xmm11, %xmm13, %xmm11
vpaddq %xmm11, %xmm12, %xmm11
vpshufd $0xee, %xmm16, %xmm12   # xmm12 = xmm16[2,3,2,3]
vpaddq %xmm12, %xmm16, %xmm12
vmovq %xmm12, %r12
vpshufd $0xee, %xmm11, %xmm12   # xmm12 = xmm11[2,3,2,3]
vpaddq %xmm12, %xmm11, %xmm11
vmovq %xmm11, %r13
andq %r15, %r13
movq %r11, %rdx
mulxq %rax, %rax, %rdx
shldq $0x3, %rax, %rdx
andq %r14, %rax
addq %rdx, %rax
addq %r13, %rax
andq %r15, %r12
movq %rbx, %rdx
mulxq %r10, %r10, %rdx
shldq $0x3, %r10, %rdx
andq %r14, %r10
addq %rdx, %r10
addq %r12, %r10
addl $-0x40, %r9d
addq $0x40, %rsi
cmpl $0x3f, %r9d
ja 0x14df
jmp 0x16c9
movl $0x1, %r10d
testl %r9d, %r9d
je 0x1864
cmpl $0x10, %r9d
movq %rdi, -0x8(%rsp)
movq %r8, -0x10(%rsp)
jb 0x1780
leal -0x10(%r9), %edx
shrl $0x2, %edx
andl $-0x4, %edx
movq %rdx, -0x30(%rsp)
xorl %r12d, %r12d
xorl %r11d, %r11d
xorl %ebx, %ebx
movl (%rsi,%r12), %edi
movl 0x4(%rsi,%r12), %r13d
movl (%rcx,%r12), %r8d
addl %edi, %r8d
movl 0x8(%rsi,%r12), %ebp
movl 0x8(%rcx,%r12), %edx
addl %ebp, %edx
imulq %r8, %rdx
addq %rbx, %rdx
movl 0x4(%rcx,%r12), %r8d
addl %r13d, %r8d
addl 0x10(%rcx,%r12), %edi
addl 0x18(%rcx,%r12), %ebp
imulq %rdi, %rbp
addq %r11, %rbp
movl 0xc(%rsi,%r12), %r11d
movl 0xc(%rcx,%r12), %ebx
addl %r11d, %ebx
imulq %r8, %rbx
addl 0x14(%rcx,%r12), %r13d
addl 0x1c(%rcx,%r12), %r11d
addq %rdx, %rbx
imulq %r13, %r11
addq %rbp, %r11
addl $-0x10, %r9d
addq $0x10, %r12
cmpl $0xf, %r9d
ja 0x16fd
movq -0x30(%rsp), %rdx
addl $0x4, %edx
movq -0x8(%rsp), %rdi
movq -0x10(%rsp), %r8
jmp 0x1787
xorl %edx, %edx
xorl %ebx, %ebx
xorl %r11d, %r11d
testl %r9d, %r9d
je 0x1831
vpxor %xmm0, %xmm0, %xmm0
vmovdqa %xmm0, -0x28(%rsp)
movl %edx, %r12d
leaq (%rsi,%r12,4), %rsi
movl %r9d, %edx
xorl %edi, %edi
movb (%rsi,%rdi), %r8b
movb %r8b, -0x28(%rsp,%rdi)
incq %rdi
cmpq %rdi, %rdx
jne 0x17a6
movl -0x28(%rsp), %r13d
movl -0x24(%rsp), %esi
movq %rsi, -0x30(%rsp)
movl (%rcx,%r12,4), %r8d
addl %r13d, %r8d
movl -0x20(%rsp), %edi
movl 0x8(%rcx,%r12,4), %r9d
addl %edi, %r9d
imulq %r8, %r9
movl 0x4(%rcx,%r12,4), %ebp
addl %esi, %ebp
movl -0x1c(%rsp), %r8d
movl 0xc(%rcx,%r12,4), %esi
addl %r8d, %esi
imulq %rbp, %rsi
addl 0x10(%rcx,%r12,4), %r13d
addl 0x18(%rcx,%r12,4), %edi
imulq %r13, %rdi
movq -0x30(%rsp), %r13
addl 0x14(%rcx,%r12,4), %r13d
addl 0x1c(%rcx,%r12,4), %r8d
imulq %r13, %r8
addq %rdx, %rbx
addq %r9, %rbx
addq %rsi, %rbx
addq %rdx, %r11
addq %rdi, %r11
addq %r8, %r11
movq -0x8(%rsp), %rdi
movq -0x10(%rsp), %r8
andq %r15, %rbx
movq %rax, %rdx
mulxq (%r8), %rax, %rcx
shldq $0x3, %rax, %rcx
andq %r14, %rax
addq %rcx, %rax
movq %r10, %rdx
mulxq 0x8(%r8), %r10, %rcx
addq %rbx, %rax
andq %r15, %r11
shldq $0x3, %r10, %rcx
andq %r14, %r10
addq %rcx, %r10
addq %r11, %r10
movq %rax, %rcx
andq %r14, %rcx
shrq $0x3d, %rax
addq %rcx, %rax
xorl %ecx, %ecx
cmpq %r14, %rax
cmoveq %rcx, %rax
movq %r10, %rdx
andq %r14, %rdx
shrq $0x3d, %r10
addq %rdx, %r10
cmpq %r14, %r10
cmoveq %rcx, %r10
movq %rax, (%rdi)
movq %r10, 0x8(%rdi)
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
vzeroupper
retq