######################################################################

## Constant-time SSSE3 AES core implementation.

## version 0.1

##

## By Mike Hamburg (Stanford University), 2009

## Public domain.

##

## For details see https://shiftleft.org/papers/vector_aes/ and

## https://crypto.stanford.edu/vpaes/.

#

# *** This file is auto-generated ***

#

.text	

.def	_vpaes_encrypt_core;	.scl 3;	.type 32;	.endef

.p2align	4

_vpaes_encrypt_core:

	movq	%rdx,%r9

	movq	$16,%r11

	movl	240(%rdx),%eax

	movdqa	%xmm9,%xmm1

	movdqa	.Lk_ipt(%rip),%xmm2

	pandn	%xmm0,%xmm1

	movdqu	(%r9),%xmm5

	psrld	$4,%xmm1

	pand	%xmm9,%xmm0

.byte	102,15,56,0,208

	movdqa	.Lk_ipt+16(%rip),%xmm0

.byte	102,15,56,0,193

	pxor	%xmm5,%xmm2

	addq	$16,%r9

	pxor	%xmm2,%xmm0

	leaq	.Lk_mc_backward(%rip),%r10

	jmp	.Lenc_entry

.p2align	4

.Lenc_loop:

	movdqa	%xmm13,%xmm4

	movdqa	%xmm12,%xmm0

.byte	102,15,56,0,226

.byte	102,15,56,0,195

	pxor	%xmm5,%xmm4

	movdqa	%xmm15,%xmm5

	pxor	%xmm4,%xmm0

	movdqa	-64(%r11,%r10,1),%xmm1

.byte	102,15,56,0,234

	movdqa	(%r11,%r10,1),%xmm4

	movdqa	%xmm14,%xmm2

.byte	102,15,56,0,211

	movdqa	%xmm0,%xmm3

	pxor	%xmm5,%xmm2

.byte	102,15,56,0,193

	addq	$16,%r9

	pxor	%xmm2,%xmm0

.byte	102,15,56,0,220

	addq	$16,%r11

	pxor	%xmm0,%xmm3

.byte	102,15,56,0,193

	andq	$0x30,%r11

	subq	$1,%rax

	pxor	%xmm3,%xmm0

.Lenc_entry:

	movdqa	%xmm9,%xmm1

	movdqa	%xmm11,%xmm5

	pandn	%xmm0,%xmm1

	psrld	$4,%xmm1

	pand	%xmm9,%xmm0

.byte	102,15,56,0,232

	movdqa	%xmm10,%xmm3

	pxor	%xmm1,%xmm0

.byte	102,15,56,0,217

	movdqa	%xmm10,%xmm4

	pxor	%xmm5,%xmm3

.byte	102,15,56,0,224

	movdqa	%xmm10,%xmm2

	pxor	%xmm5,%xmm4

.byte	102,15,56,0,211

	movdqa	%xmm10,%xmm3

	pxor	%xmm0,%xmm2

.byte	102,15,56,0,220

	movdqu	(%r9),%xmm5

	pxor	%xmm1,%xmm3

	jnz	.Lenc_loop

	movdqa	-96(%r10),%xmm4

	movdqa	-80(%r10),%xmm0

.byte	102,15,56,0,226

	pxor	%xmm5,%xmm4

.byte	102,15,56,0,195

	movdqa	64(%r11,%r10,1),%xmm1

	pxor	%xmm4,%xmm0

.byte	102,15,56,0,193

	.byte	0xf3,0xc3

.def	_vpaes_decrypt_core;	.scl 3;	.type 32;	.endef

.p2align	4

_vpaes_decrypt_core:

	movq	%rdx,%r9

	movl	240(%rdx),%eax

	movdqa	%xmm9,%xmm1

	movdqa	.Lk_dipt(%rip),%xmm2

	pandn	%xmm0,%xmm1

	movq	%rax,%r11

	psrld	$4,%xmm1

	movdqu	(%r9),%xmm5

	shlq	$4,%r11

	pand	%xmm9,%xmm0

.byte	102,15,56,0,208

	movdqa	.Lk_dipt+16(%rip),%xmm0

	xorq	$0x30,%r11

	leaq	.Lk_dsbd(%rip),%r10

.byte	102,15,56,0,193

	andq	$0x30,%r11

	pxor	%xmm5,%xmm2

	movdqa	.Lk_mc_forward+48(%rip),%xmm5

	pxor	%xmm2,%xmm0

	addq	$16,%r9

	addq	%r10,%r11

	jmp	.Ldec_entry

.p2align	4

.Ldec_loop:

	movdqa	-32(%r10),%xmm4

	movdqa	-16(%r10),%xmm1

.byte	102,15,56,0,226

.byte	102,15,56,0,203

	pxor	%xmm4,%xmm0

	movdqa	0(%r10),%xmm4

	pxor	%xmm1,%xmm0

	movdqa	16(%r10),%xmm1

.byte	102,15,56,0,226

.byte	102,15,56,0,197

.byte	102,15,56,0,203

	pxor	%xmm4,%xmm0

	movdqa	32(%r10),%xmm4

	pxor	%xmm1,%xmm0

	movdqa	48(%r10),%xmm1

.byte	102,15,56,0,226

.byte	102,15,56,0,197

.byte	102,15,56,0,203

	pxor	%xmm4,%xmm0

	movdqa	64(%r10),%xmm4

	pxor	%xmm1,%xmm0

	movdqa	80(%r10),%xmm1

.byte	102,15,56,0,226

.byte	102,15,56,0,197

.byte	102,15,56,0,203

	pxor	%xmm4,%xmm0

	addq	$16,%r9

.byte	102,15,58,15,237,12

	pxor	%xmm1,%xmm0

	subq	$1,%rax

.Ldec_entry:

	movdqa	%xmm9,%xmm1

	pandn	%xmm0,%xmm1

	movdqa	%xmm11,%xmm2

	psrld	$4,%xmm1

	pand	%xmm9,%xmm0

.byte	102,15,56,0,208

	movdqa	%xmm10,%xmm3

	pxor	%xmm1,%xmm0

.byte	102,15,56,0,217

	movdqa	%xmm10,%xmm4

	pxor	%xmm2,%xmm3

.byte	102,15,56,0,224

	pxor	%xmm2,%xmm4

	movdqa	%xmm10,%xmm2

.byte	102,15,56,0,211

	movdqa	%xmm10,%xmm3

	pxor	%xmm0,%xmm2

.byte	102,15,56,0,220

	movdqu	(%r9),%xmm0

	pxor	%xmm1,%xmm3

	jnz	.Ldec_loop

	movdqa	96(%r10),%xmm4

.byte	102,15,56,0,226

	pxor	%xmm0,%xmm4

	movdqa	112(%r10),%xmm0

	movdqa	-352(%r11),%xmm2

.byte	102,15,56,0,195

	pxor	%xmm4,%xmm0

.byte	102,15,56,0,194

	.byte	0xf3,0xc3

.def	_vpaes_schedule_core;	.scl 3;	.type 32;	.endef

.p2align	4

_vpaes_schedule_core:

	call	_vpaes_preheat

	movdqa	.Lk_rcon(%rip),%xmm8

	movdqu	(%rdi),%xmm0

	movdqa	%xmm0,%xmm3

	leaq	.Lk_ipt(%rip),%r11

	call	_vpaes_schedule_transform

	movdqa	%xmm0,%xmm7

	leaq	.Lk_sr(%rip),%r10

	testq	%rcx,%rcx

	jnz	.Lschedule_am_decrypting

	movdqu	%xmm0,(%rdx)

	jmp	.Lschedule_go

.Lschedule_am_decrypting:

	movdqa	(%r8,%r10,1),%xmm1

.byte	102,15,56,0,217

	movdqu	%xmm3,(%rdx)

	xorq	$0x30,%r8

.Lschedule_go:

	cmpl	$192,%esi

	ja	.Lschedule_256

	je	.Lschedule_192

.Lschedule_128:

	movl	$10,%esi

.Loop_schedule_128:

	call	_vpaes_schedule_round

	decq	%rsi

	jz	.Lschedule_mangle_last

	call	_vpaes_schedule_mangle

	jmp	.Loop_schedule_128

.p2align	4

.Lschedule_192:

	movdqu	8(%rdi),%xmm0

	call	_vpaes_schedule_transform

	movdqa	%xmm0,%xmm6

	pxor	%xmm4,%xmm4

	movhlps	%xmm4,%xmm6

	movl	$4,%esi

.Loop_schedule_192:

	call	_vpaes_schedule_round

.byte	102,15,58,15,198,8

	call	_vpaes_schedule_mangle

	call	_vpaes_schedule_192_smear

	call	_vpaes_schedule_mangle

	call	_vpaes_schedule_round

	decq	%rsi

	jz	.Lschedule_mangle_last

	call	_vpaes_schedule_mangle

	call	_vpaes_schedule_192_smear

	jmp	.Loop_schedule_192

.p2align	4

.Lschedule_256:

	movdqu	16(%rdi),%xmm0

	call	_vpaes_schedule_transform

	movl	$7,%esi

.Loop_schedule_256:

	call	_vpaes_schedule_mangle

	movdqa	%xmm0,%xmm6

	call	_vpaes_schedule_round

	decq	%rsi

	jz	.Lschedule_mangle_last

	call	_vpaes_schedule_mangle

	pshufd	$0xFF,%xmm0,%xmm0

	movdqa	%xmm7,%xmm5

	movdqa	%xmm6,%xmm7

	call	_vpaes_schedule_low_round

	movdqa	%xmm5,%xmm7

	jmp	.Loop_schedule_256

.p2align	4

.Lschedule_mangle_last:

	leaq	.Lk_deskew(%rip),%r11

	testq	%rcx,%rcx

	jnz	.Lschedule_mangle_last_dec

	movdqa	(%r8,%r10,1),%xmm1

.byte	102,15,56,0,193

	leaq	.Lk_opt(%rip),%r11

	addq	$32,%rdx

.Lschedule_mangle_last_dec:

	addq	$-16,%rdx

	pxor	.Lk_s63(%rip),%xmm0

	call	_vpaes_schedule_transform

	movdqu	%xmm0,(%rdx)

	pxor	%xmm0,%xmm0

	pxor	%xmm1,%xmm1

	pxor	%xmm2,%xmm2

	pxor	%xmm3,%xmm3

	pxor	%xmm4,%xmm4

	pxor	%xmm5,%xmm5

	pxor	%xmm6,%xmm6

	pxor	%xmm7,%xmm7

	.byte	0xf3,0xc3

.def	_vpaes_schedule_192_smear;	.scl 3;	.type 32;	.endef

.p2align	4

_vpaes_schedule_192_smear:

	pshufd	$0x80,%xmm6,%xmm1

	pshufd	$0xFE,%xmm7,%xmm0

	pxor	%xmm1,%xmm6

	pxor	%xmm1,%xmm1

	pxor	%xmm0,%xmm6

	movdqa	%xmm6,%xmm0

	movhlps	%xmm1,%xmm6

	.byte	0xf3,0xc3

.def	_vpaes_schedule_round;	.scl 3;	.type 32;	.endef

.p2align	4

_vpaes_schedule_round:

	pxor	%xmm1,%xmm1

.byte	102,65,15,58,15,200,15

.byte	102,69,15,58,15,192,15

	pxor	%xmm1,%xmm7

	pshufd	$0xFF,%xmm0,%xmm0

.byte	102,15,58,15,192,1

_vpaes_schedule_low_round:

	movdqa	%xmm7,%xmm1

	pslldq	$4,%xmm7

	pxor	%xmm1,%xmm7

	movdqa	%xmm7,%xmm1

	pslldq	$8,%xmm7

	pxor	%xmm1,%xmm7

	pxor	.Lk_s63(%rip),%xmm7

	movdqa	%xmm9,%xmm1

	pandn	%xmm0,%xmm1

	psrld	$4,%xmm1

	pand	%xmm9,%xmm0

	movdqa	%xmm11,%xmm2

.byte	102,15,56,0,208

	pxor	%xmm1,%xmm0

	movdqa	%xmm10,%xmm3

.byte	102,15,56,0,217

	pxor	%xmm2,%xmm3

	movdqa	%xmm10,%xmm4

.byte	102,15,56,0,224

	pxor	%xmm2,%xmm4

	movdqa	%xmm10,%xmm2

.byte	102,15,56,0,211

	pxor	%xmm0,%xmm2

	movdqa	%xmm10,%xmm3

.byte	102,15,56,0,220

	pxor	%xmm1,%xmm3

	movdqa	%xmm13,%xmm4

.byte	102,15,56,0,226

	movdqa	%xmm12,%xmm0

.byte	102,15,56,0,195

	pxor	%xmm4,%xmm0

	pxor	%xmm7,%xmm0

	movdqa	%xmm0,%xmm7

	.byte	0xf3,0xc3

.def	_vpaes_schedule_transform;	.scl 3;	.type 32;	.endef

.p2align	4

_vpaes_schedule_transform:

	movdqa	%xmm9,%xmm1

	pandn	%xmm0,%xmm1

	psrld	$4,%xmm1

	pand	%xmm9,%xmm0

	movdqa	(%r11),%xmm2

.byte	102,15,56,0,208

	movdqa	16(%r11),%xmm0

.byte	102,15,56,0,193

	pxor	%xmm2,%xmm0

	.byte	0xf3,0xc3

.def	_vpaes_schedule_mangle;	.scl 3;	.type 32;	.endef

.p2align	4

_vpaes_schedule_mangle:

	movdqa	%xmm0,%xmm4

	movdqa	.Lk_mc_forward(%rip),%xmm5

	testq	%rcx,%rcx

	jnz	.Lschedule_mangle_dec

	addq	$16,%rdx

	pxor	.Lk_s63(%rip),%xmm4

.byte	102,15,56,0,229

	movdqa	%xmm4,%xmm3

.byte	102,15,56,0,229

	pxor	%xmm4,%xmm3

.byte	102,15,56,0,229

	pxor	%xmm4,%xmm3

	jmp	.Lschedule_mangle_both

.p2align	4

.Lschedule_mangle_dec:

	leaq	.Lk_dksd(%rip),%r11

	movdqa	%xmm9,%xmm1

	pandn	%xmm4,%xmm1

	psrld	$4,%xmm1

	pand	%xmm9,%xmm4

	movdqa	0(%r11),%xmm2

.byte	102,15,56,0,212

	movdqa	16(%r11),%xmm3

.byte	102,15,56,0,217

	pxor	%xmm2,%xmm3

.byte	102,15,56,0,221

	movdqa	32(%r11),%xmm2

.byte	102,15,56,0,212

	pxor	%xmm3,%xmm2

	movdqa	48(%r11),%xmm3

.byte	102,15,56,0,217

	pxor	%xmm2,%xmm3

.byte	102,15,56,0,221

	movdqa	64(%r11),%xmm2

.byte	102,15,56,0,212

	pxor	%xmm3,%xmm2

	movdqa	80(%r11),%xmm3

.byte	102,15,56,0,217

	pxor	%xmm2,%xmm3

.byte	102,15,56,0,221

	movdqa	96(%r11),%xmm2

.byte	102,15,56,0,212

	pxor	%xmm3,%xmm2

	movdqa	112(%r11),%xmm3

.byte	102,15,56,0,217

	pxor	%xmm2,%xmm3

	addq	$-16,%rdx

.Lschedule_mangle_both:

	movdqa	(%r8,%r10,1),%xmm1

.byte	102,15,56,0,217

	addq	$-16,%r8

	andq	$0x30,%r8

	movdqu	%xmm3,(%rdx)

	.byte	0xf3,0xc3

.globl	vpaes_set_encrypt_key

.def	vpaes_set_encrypt_key;	.scl 2;	.type 32;	.endef

.p2align	4

vpaes_set_encrypt_key:

	movq	%rdi,8(%rsp)

	movq	%rsi,16(%rsp)

	movq	%rsp,%rax

.LSEH_begin_vpaes_set_encrypt_key:

	movq	%rcx,%rdi

	movq	%rdx,%rsi

	movq	%r8,%rdx

	leaq	-184(%rsp),%rsp

	movaps	%xmm6,16(%rsp)

	movaps	%xmm7,32(%rsp)

	movaps	%xmm8,48(%rsp)

	movaps	%xmm9,64(%rsp)

	movaps	%xmm10,80(%rsp)

	movaps	%xmm11,96(%rsp)

	movaps	%xmm12,112(%rsp)

	movaps	%xmm13,128(%rsp)

	movaps	%xmm14,144(%rsp)

	movaps	%xmm15,160(%rsp)

.Lenc_key_body:

	movl	%esi,%eax

	shrl	$5,%eax

	addl	$5,%eax

	movl	%eax,240(%rdx)

	movl	$0,%ecx

	movl	$0x30,%r8d

	call	_vpaes_schedule_core

	movaps	16(%rsp),%xmm6

	movaps	32(%rsp),%xmm7

	movaps	48(%rsp),%xmm8

	movaps	64(%rsp),%xmm9

	movaps	80(%rsp),%xmm10

	movaps	96(%rsp),%xmm11

	movaps	112(%rsp),%xmm12

	movaps	128(%rsp),%xmm13

	movaps	144(%rsp),%xmm14

	movaps	160(%rsp),%xmm15

	leaq	184(%rsp),%rsp

.Lenc_key_epilogue:

	xorl	%eax,%eax

	movq	8(%rsp),%rdi

	movq	16(%rsp),%rsi

	.byte	0xf3,0xc3

.LSEH_end_vpaes_set_encrypt_key:

.globl	vpaes_set_decrypt_key

.def	vpaes_set_decrypt_key;	.scl 2;	.type 32;	.endef

.p2align	4

vpaes_set_decrypt_key:

	movq	%rdi,8(%rsp)

	movq	%rsi,16(%rsp)

	movq	%rsp,%rax

.LSEH_begin_vpaes_set_decrypt_key:

	movq	%rcx,%rdi

	movq	%rdx,%rsi

	movq	%r8,%rdx

	leaq	-184(%rsp),%rsp

	movaps	%xmm6,16(%rsp)

	movaps	%xmm7,32(%rsp)

	movaps	%xmm8,48(%rsp)

	movaps	%xmm9,64(%rsp)

	movaps	%xmm10,80(%rsp)

	movaps	%xmm11,96(%rsp)

	movaps	%xmm12,112(%rsp)

	movaps	%xmm13,128(%rsp)

	movaps	%xmm14,144(%rsp)

	movaps	%xmm15,160(%rsp)

.Ldec_key_body:

	movl	%esi,%eax

	shrl	$5,%eax

	addl	$5,%eax

	movl	%eax,240(%rdx)

	shll	$4,%eax

	leaq	16(%rdx,%rax,1),%rdx

	movl	$1,%ecx

	movl	%esi,%r8d

	shrl	$1,%r8d

	andl	$32,%r8d

	xorl	$32,%r8d

	call	_vpaes_schedule_core

	movaps	16(%rsp),%xmm6

	movaps	32(%rsp),%xmm7

	movaps	48(%rsp),%xmm8

	movaps	64(%rsp),%xmm9

	movaps	80(%rsp),%xmm10

	movaps	96(%rsp),%xmm11

	movaps	112(%rsp),%xmm12

	movaps	128(%rsp),%xmm13

	movaps	144(%rsp),%xmm14

	movaps	160(%rsp),%xmm15

	leaq	184(%rsp),%rsp

.Ldec_key_epilogue:

	xorl	%eax,%eax

	movq	8(%rsp),%rdi

	movq	16(%rsp),%rsi

	.byte	0xf3,0xc3

.LSEH_end_vpaes_set_decrypt_key:

.globl	vpaes_encrypt

.def	vpaes_encrypt;	.scl 2;	.type 32;	.endef

.p2align	4

vpaes_encrypt:

	movq	%rdi,8(%rsp)

	movq	%rsi,16(%rsp)

	movq	%rsp,%rax

.LSEH_begin_vpaes_encrypt:

	movq	%rcx,%rdi

	movq	%rdx,%rsi

	movq	%r8,%rdx

	leaq	-184(%rsp),%rsp

	movaps	%xmm6,16(%rsp)

	movaps	%xmm7,32(%rsp)

	movaps	%xmm8,48(%rsp)

	movaps	%xmm9,64(%rsp)

	movaps	%xmm10,80(%rsp)

	movaps	%xmm11,96(%rsp)

	movaps	%xmm12,112(%rsp)

	movaps	%xmm13,128(%rsp)

	movaps	%xmm14,144(%rsp)

	movaps	%xmm15,160(%rsp)

.Lenc_body:

	movdqu	(%rdi),%xmm0

	call	_vpaes_preheat

	call	_vpaes_encrypt_core

	movdqu	%xmm0,(%rsi)

	movaps	16(%rsp),%xmm6

	movaps	32(%rsp),%xmm7

	movaps	48(%rsp),%xmm8

	movaps	64(%rsp),%xmm9

	movaps	80(%rsp),%xmm10

	movaps	96(%rsp),%xmm11

	movaps	112(%rsp),%xmm12

	movaps	128(%rsp),%xmm13

	movaps	144(%rsp),%xmm14

	movaps	160(%rsp),%xmm15

	leaq	184(%rsp),%rsp

.Lenc_epilogue:

	movq	8(%rsp),%rdi

	movq	16(%rsp),%rsi

	.byte	0xf3,0xc3

.LSEH_end_vpaes_encrypt:

.globl	vpaes_decrypt

.def	vpaes_decrypt;	.scl 2;	.type 32;	.endef

.p2align	4

vpaes_decrypt:

	movq	%rdi,8(%rsp)

	movq	%rsi,16(%rsp)

	movq	%rsp,%rax

.LSEH_begin_vpaes_decrypt:

	movq	%rcx,%rdi

	movq	%rdx,%rsi

	movq	%r8,%rdx

	leaq	-184(%rsp),%rsp

	movaps	%xmm6,16(%rsp)

	movaps	%xmm7,32(%rsp)

	movaps	%xmm8,48(%rsp)

	movaps	%xmm9,64(%rsp)

	movaps	%xmm10,80(%rsp)

	movaps	%xmm11,96(%rsp)

	movaps	%xmm12,112(%rsp)

	movaps	%xmm13,128(%rsp)

	movaps	%xmm14,144(%rsp)

	movaps	%xmm15,160(%rsp)

.Ldec_body:

	movdqu	(%rdi),%xmm0

	call	_vpaes_preheat

	call	_vpaes_decrypt_core

	movdqu	%xmm0,(%rsi)

	movaps	16(%rsp),%xmm6

	movaps	32(%rsp),%xmm7

	movaps	48(%rsp),%xmm8

	movaps	64(%rsp),%xmm9

	movaps	80(%rsp),%xmm10

	movaps	96(%rsp),%xmm11

	movaps	112(%rsp),%xmm12

	movaps	128(%rsp),%xmm13

	movaps	144(%rsp),%xmm14

	movaps	160(%rsp),%xmm15

	leaq	184(%rsp),%rsp

.Ldec_epilogue:

	movq	8(%rsp),%rdi

	movq	16(%rsp),%rsi

	.byte	0xf3,0xc3

.LSEH_end_vpaes_decrypt:

.globl	vpaes_cbc_encrypt

.def	vpaes_cbc_encrypt;	.scl 2;	.type 32;	.endef

.p2align	4

vpaes_cbc_encrypt:

	movq	%rdi,8(%rsp)

	movq	%rsi,16(%rsp)

	movq	%rsp,%rax

.LSEH_begin_vpaes_cbc_encrypt:

	movq	%rcx,%rdi

	movq	%rdx,%rsi

	movq	%r8,%rdx

	movq	%r9,%rcx

	movq	40(%rsp),%r8

	movq	48(%rsp),%r9

	xchgq	%rcx,%rdx

	subq	$16,%rcx

	jc	.Lcbc_abort

	leaq	-184(%rsp),%rsp

	movaps	%xmm6,16(%rsp)

	movaps	%xmm7,32(%rsp)

	movaps	%xmm8,48(%rsp)

	movaps	%xmm9,64(%rsp)

	movaps	%xmm10,80(%rsp)

	movaps	%xmm11,96(%rsp)

	movaps	%xmm12,112(%rsp)

	movaps	%xmm13,128(%rsp)

	movaps	%xmm14,144(%rsp)

	movaps	%xmm15,160(%rsp)

.Lcbc_body:

	movdqu	(%r8),%xmm6

	subq	%rdi,%rsi

	call	_vpaes_preheat

	cmpl	$0,%r9d

	je	.Lcbc_dec_loop

	jmp	.Lcbc_enc_loop

.p2align	4

.Lcbc_enc_loop:

	movdqu	(%rdi),%xmm0

	pxor	%xmm6,%xmm0

	call	_vpaes_encrypt_core

	movdqa	%xmm0,%xmm6

	movdqu	%xmm0,(%rsi,%rdi,1)

	leaq	16(%rdi),%rdi

	subq	$16,%rcx

	jnc	.Lcbc_enc_loop

	jmp	.Lcbc_done

.p2align	4

.Lcbc_dec_loop:

	movdqu	(%rdi),%xmm0

	movdqa	%xmm0,%xmm7

	call	_vpaes_decrypt_core

	pxor	%xmm6,%xmm0

	movdqa	%xmm7,%xmm6

	movdqu	%xmm0,(%rsi,%rdi,1)

	leaq	16(%rdi),%rdi

	subq	$16,%rcx

	jnc	.Lcbc_dec_loop

.Lcbc_done:

	movdqu	%xmm6,(%r8)

	movaps	16(%rsp),%xmm6

	movaps	32(%rsp),%xmm7

	movaps	48(%rsp),%xmm8

	movaps	64(%rsp),%xmm9

	movaps	80(%rsp),%xmm10

	movaps	96(%rsp),%xmm11

	movaps	112(%rsp),%xmm12