b3 := namedComponent{b.Field("l3"), "b3"}
	b4 := namedComponent{b.Field("l4"), "b4"}

	// r0 = a0×b0 + 19×(a1×b4 + a2×b3 + a3×b2 + a4×b1)
	r0 := uint128{"r0", GP64(), GP64()}
	mul64(r0, 1, a0, b0)
	addMul64(r0, 19, a1, b4)
	addMul64(r0, 19, a2, b3)
	addMul64(r0, 19, a3, b2)
	addMul64(r0, 19, a4, b1)

	// r1 = a0×b1 + a1×b0 + 19×(a2×b4 + a3×b3 + a4×b2)
	r1 := uint128{"r1", GP64(), GP64()}

	r2 := mul64(a0, b2)
	r2 = addMul64(r2, a1, b1)
	r2 = addMul64(r2, a2, b0)
	r2 = addMul64(r2, a3_19, b4)
	r2 = addMul64(r2, a4_19, b3)

	// r3 = a0×b3 + a1×b2 + a2×b1 + a3×b0 + 19×a4×b4
	r3 := mul64(a0, b3)
	r3 = addMul64(r3, a1, b2)
	r3 = addMul64(r3, a2, b1)
	r3 = addMul64(r3, a3, b0)
	r3 = addMul64(r3, a4_19, b4)

	// r4 = a0×b4 + a1×b3 + a2×b2 + a3×b1 + a4×b0

initLoop:
		MOVOU B2, T0
		MOVOU B2, T1
		MOVOU B3, T2
		PCLMULQDQ $0x00, B0, T0
		PCLMULQDQ $0x11, B0, T1
		PCLMULQDQ $0x00, B1, T2

		PXOR T0, T2
		PXOR T1, T2
		MOVOU T2, B4
		PSLLDQ $8, B4
		PSRLDQ $8, T2
		PXOR B4, T0
		PXOR T2, T1

		MOVOU POLY, B2
		PCLMULQDQ $0x01, T0, B2
		PSHUFD $78, T0, T0
		PXOR B2, T0
		MOVOU POLY, B2
		PCLMULQDQ $0x01, T0, B2
		PSHUFD $78, T0, T0

	AESMC	B3.B16, B3.B16   \
	AESE	K.B16, B4.B16    \
	AESMC	B4.B16, B4.B16   \
	AESE	K.B16, B5.B16    \
	AESMC	B5.B16, B5.B16   \
	AESE	K.B16, B6.B16    \
	AESMC	B6.B16, B6.B16   \
	AESE	K.B16, B7.B16    \
	AESMC	B7.B16, B7.B16

#define aesrndlastx8(K) \
	AESE	K.B16, B0.B16    \
	AESE	K.B16, B1.B16    \
	AESE	K.B16, B2.B16    \
	AESE	K.B16, B3.B16    \
	AESE	K.B16, B4.B16    \
	AESE	K.B16, B5.B16    \

00000150  7d e9 8a 1f f8 48 d1 74  d5 70 97 e7 b4 e2 c8 ce  |}....H.t.p......|
00000160  dc 74 27 e9 af b1 64 56  19 28 8a 34 93 4e 1c 03  |.t'...dV.(.4.N..|
00000170  67 ae 41 fb 5f d1 e3 20  45 6b bd 49 25 d8 b4 8b  |g.A._.. Ek.I%...|
00000180  d4 96 d6 96 b2 72 72 f0  d0 68 f1 f7 f3 17 76 85  |.....rr..h....v.|
00000190  78 0e dd 35 83 8a 7a 45  c5 91 86 4b a6 b5 77 b4  |x..5..zE...K..w.|

00000280  2a 05 12 52 bf 2b e2 4b  64 94 9c 89 bb 2c 65 cb  |*..R.+.Kd....,e.|
00000290  59 2a f0 1a 15 b2 e3 6e  5a cc 48 b4 44 6c 44 07  |Y*.....nZ.H.DlD.|
000002a0  80 01 93 25 86 83 f2 8f  01 e6 ef 5e 9a 36 4e 7f  |...%.......^.6N.|
000002b0  bc 27 0e 4d f0 67 3a de  29 b5 e9 6a 7f 4b b4 77  |.'.M.g:.)..j.K.w|
000002c0  9b e2 3b 73 c9 51 e5 a6  df 97 a7 02 fa f2 f7 db  |..;s.Q..........|

	ADDQ AX, R13
	ADCQ DX, R12

	// r3 += a3×b0
	MOVQ 24(CX), AX
	MULQ (BX)
	ADDQ AX, R13
	ADCQ DX, R12

	// r3 += 19×a4×b4
	MOVQ   32(CX), AX
	IMUL3Q $0x13, AX, AX
	MULQ   32(BX)
	ADDQ   AX, R13
	ADCQ   DX, R12

	// r4 = a0×b4
	MOVQ (CX), AX
	MULQ 32(BX)
	MOVQ AX, R15
	MOVQ DX, R14

	// r4 += a1×b3
	MOVQ 8(CX), AX
	MULQ 24(BX)
	ADDQ AX, R15

			Valu("cmp", OpLess64, c.config.Types.Bool, 0, nil, "v1", "v2"),
			If("cmp", "b2", "b3")),
		Bloc("b2",
			Valu("v3", OpConst64, c.config.Types.Int64, 3, nil),
			Goto("b4")),
		Bloc("b3",
			Valu("v4", OpConst64, c.config.Types.Int64, 4, nil),
			Goto("b4")),
		Bloc("b4",
			Valu("merge", OpPhi, c.config.Types.Int64, 0, nil, "v3", "v4"),
			Exit("mem")))
	sccp(fun.f)
	CheckFunc(fun.f)
	for _, b := range fun.blocks {

			b0, b5, b10, b15 = qr(b0, b5, b10, b15)
			b1, b6, b11, b12 = qr(b1, b6, b11, b12)
			b2, b7, b8, b13 = qr(b2, b7, b8, b13)
			b3, b4, b9, b14 = qr(b3, b4, b9, b14)
		}

		// Store block i back into b[*][i].
		// Add b4..b11 back to the original key material,
		// like in ChaCha20, to avoid trivial invertibility.
		// There is no entropy in b0..b3 and b12..b15

00000300  93 f6 27 74 24 b4 e2 3d  22 04 30 a0 d6 5b c8 da  |..'t$..=".0..[..|
00000310  6e 56 30 d4 fb 86 fd 76  8f 1b 47 c0 55 95 cd 15  |nV0....v..G.U...|
00000320  bf a7 27 ce 2d c3 43 6b  ed 2d 09 bb eb 55 73 c9  |..'.-.Ck.-...Us.|
00000330  2c ee cd 23 af d9 1c 51  1d 0c 00 14 01 61 8a fd  |,..#...Q.....a..|
00000340  8f 95 d1 ce 32 57 ae 2b  09 15 b4 86 41 1e 74 f5  |....2W.+....A.t.|