subtract_u64
subtract_u64(&out[0], &carry, result & kPrime[0]);
subtract_u64(&out[1], &carry, carry);
subtract_u64(&out[2], &carry, carry);
subtract_u64(&out[3], &carry, carry);
subtract_u64(&out[1], &carry, result & kPrime[1]);
subtract_u64(&out[2], &carry, carry);
subtract_u64(&out[3], &carry, carry);
subtract_u64(&out[2], &carry, result & kPrime[2]);
subtract_u64(&out[3], &carry, carry);
subtract_u64(&out[3], &carry, result & kPrime[3]);