Function at 0x180073380
Capabilities:
Check for time delay via queryperformancecounter
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 0x10], rdx
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rax - 0x308]
sub rsp, 0x3e0
mov rbx, r8
mov rsi, rdx
mov edi, ecx
test ecx, ecx
jne 0x180073a50
call fcn.180071420
test al, al
jne 0x180073a50
mov r13, qword [rbx]
call fcn.180071464
mov ecx, dword [0x18010a070]
lea r14d, [rdi + 1]
mov r12b, al
cmp dword [rbx + 8], ecx
jne 0x18007346b
cmp byte [0x18010a364], dil
je 0x18007344c
lea rcx, [rbp + 0x310]
call fcn.18006dc70
mov rdi, rax
cmp byte [rax + 0x68], 0
je 0x180073428
xor r9d, r9d
mov cl, r9b
movabs r8, 0xd993efbb19cfe32d
and cl, 7
shl cl, 3
shr r8, cl
xor byte [r9 + rax], r8b
add r9, r14
cmp r9, 0x68
jb 0x180073401
mov byte [rax + 0x68], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor r8d, r8d
mov rdx, rdi
cmp dword [0x18010a5a0], r8d
mov r9d, eax
mov ecx, 4
setne r8b
call fcn.18006a848
xor eax, eax
lock cmpxchg dword [0x18010a5b0], r14d
jne 0x18007345e
call fcn.180071a20
mov rcx, qword [0x18010a5e0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [rbx + 8]
lea eax, [rcx - 0x100]
cmp eax, r14d
jbe 0x1800737a6
lea eax, [rcx - 0x200]
cmp eax, 0xd
ja 0x180073492
mov edx, 0x2c0f
bt edx, eax
jb 0x1800734a1
lea eax, [rcx - 0xa0]
cmp eax, 3
ja 0x180073a3a
lea rcx, [rsp + 0x38]
call fcn.18003d8c0
mov edx, 0x53a
lea rcx, [rsp + 0x38]
call fcn.18003e08c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea rcx, [rsp + 0x38]
call fcn.18003e084
cmp qword [reloc.OLEAUT32.dll_SysReAllocString], 0
lea rdi, [0x180102570]
je 0x1800734f5
lea rdx, [0x1800eaeec]
mov rcx, rdi
call fcn.180021520
test al, al
je 0x1800734f5
mov sil, r14b
jmp 0x1800734f8
xor sil, sil
test r12b, r12b
je 0x18007350d
mov r8, r13
lea rcx, [rsp + 0x38]
mov dl, sil
call fcn.180071fb8
test sil, sil
je 0x18007352f
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea rcx, [rsp + 0x38]
cmovae rdi, qword [0x180102570]
mov rdx, rdi
call fcn.18003de6c
xor eax, eax
mov edi, 0x201
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
mov eax, dword [rbx + 8]
mov r14d, 0x3e8
movups xmmword [rsp + 0x20], xmm0
sub eax, edi
je 0x180073569
sub eax, 2
je 0x180073569
sub eax, 8
je 0x18007355f
cmp eax, 2
jne 0x1800735ca
mov dword [rsp + 0x24], 0x2001
jmp 0x18007358d
cmp dword [0x18010a5b4], 0
je 0x180073585
cmp dword [rbx + 8], edi
jne 0x180073585
call fcn.18005cbb8
test al, al
jne 0x180073585
call fcn.18005953c
mov dword [rsp + 0x24], 0x2000
mov dword [rsp + 0x20], 0x405
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor r9d, r9d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x28], eax
lea r8d, [r9 + 0x18]
call fcn.18003de9c
call fcn.180049c04
mov r8d, r14d
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.180077c5c
mov edx, dword [rbx + 8]
mov eax, edx
sub eax, 0xa0
je 0x180073794
sub eax, 1
je 0x18007369c
sub eax, 1
je 0x18007369c
sub eax, 1
je 0x18007369c
sub eax, 0x15d
je 0x180073794
sub eax, 1
je 0x18007369c
sub eax, 1
je 0x18007369c
sub eax, 1
je 0x18007369c
cmp eax, 7
jne 0x18007379c
mov rcx, r13
call fcn.18005da74
mov esi, 0x104
lea rcx, [rbp - 0x48]
mov r8d, esi
xor edx, edx
call fcn.1800a02d0
mov dword [rbp - 0x50], 0x425
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, esi
lea rdx, [rbp - 0x48]
xor ecx, ecx
mov dword [rbp - 0x4c], eax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x54a
lea rcx, [rsp + 0x38]
call fcn.18003e08c
xor r9d, r9d
lea r8d, [rsi + 8]
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x38]
call fcn.18003de9c
call fcn.180049c04
mov rcx, rax
lea rdx, [rsp + 0x38]
mov r8d, r14d
call fcn.180077c5c
jmp 0x18007379c
mov eax, dword [rbx + 0x18]
lea rcx, [rsp + 0x30]
and qword [rsp + 0x2c], 0
and dword [rsp + 0x34], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0x424
mov dword [rsp + 0x24], edx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r9d, r9d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x38]
lea r8d, [r9 + 0x18]
call fcn.18003de9c
call fcn.180049c04
mov rcx, rax
lea rdx, [rsp + 0x38]
mov r8d, r14d
call fcn.180077c5c
cmp dword [rbx + 8], 0xa1
je 0x180073702
cmp dword [rbx + 8], edi
jne 0x180073784
mov rcx, r13
call fcn.18005d9a0
mov esi, 0x104
lea rcx, [rbp + 0xc8]
mov r8d, esi
xor edx, edx
call fcn.1800a02d0
mov dword [rbp + 0xc0], 0x421
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, esi
lea rdx, [rbp + 0xc8]
xor ecx, ecx
mov dword [rbp + 0xc4], eax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x54a
lea rcx, [rsp + 0x38]
call fcn.18003e08c
xor r9d, r9d
lea r8d, [rsi + 8]
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x38]
call fcn.18003de9c
call fcn.180049c04
mov rcx, rax
lea rdx, [rsp + 0x38]
mov r8d, r14d
call fcn.180077c5c
call fcn.180047b40
test eax, eax
je 0x18007379c
call fcn.180047bf8
jmp 0x18007379c
mov rcx, rbx
call fcn.18005d9cc
lea rcx, [rsp + 0x38]
jmp 0x180073a28
lea rcx, [rsp + 0x70]
call fcn.18003d8c0
call fcn.1800658a0
mov edx, 0x53a
lea rcx, [rsp + 0x70]
mov r14, rax
call fcn.18003e08c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.18003e084
cmp qword [reloc.OLEAUT32.dll_SysReAllocString], 0
lea rdi, [0x180102570]
je 0x180073802
lea rdx, [0x1800eaeec]
mov rcx, rdi
call fcn.180021520
test al, al
je 0x180073802
mov sil, 1
jmp 0x180073805
xor sil, sil
test r12b, r12b
je 0x18007381a
mov r8, r13
lea rcx, [rsp + 0x70]
mov dl, sil
call fcn.180071fb8
test sil, sil
je 0x18007383c
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea rcx, [rsp + 0x70]
mov rdx, rdi
cmovae rdx, qword [0x180102570]
call fcn.18003de6c
mov rcx, r14
call fcn.180065898
mov r14d, 0x3e8
test al, al
je 0x1800738d6
mov eax, dword [rbx + 0x18]
bt rax, 0x1f
jb 0x1800738d6
mov rax, qword [rbx + 0x10]
cmp rax, 0x20
ja 0x180073876
movabs rcx, 0x100002100
bt rcx, rax
jb 0x18007387c
cmp rax, 0x74
jne 0x1800738d6
and qword [rsp + 0x64], 0
and dword [rsp + 0x6c], 0
mov dword [rsp + 0x58], 0x405
mov dword [rsp + 0x5c], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor r9d, r9d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x60], eax
lea r8d, [r9 + 0x18]
call fcn.18003de9c
call fcn.180049c04
mov rcx, rax
lea rdx, [rsp + 0x70]
mov r8d, r14d
call fcn.180077c5c
call fcn.180047b40
test eax, eax
je 0x1800738d6
call fcn.180047bf8
mov eax, dword [rbx + 0x18]
bt rax, 0x1f
jb 0x1800739cc
call fcn.18005d97c
lea rcx, [rbp - 0x70]
call fcn.18003d8c0
mov esi, 0x104
lea rcx, [rbp + 0x1d8]
mov r8d, esi
xor edx, edx
call fcn.1800a02d0
mov dword [rbp + 0x1d0], 0x420
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, esi
lea rdx, [rbp + 0x1d8]
xor ecx, ecx
mov dword [rbp + 0x1d4], eax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x54a
lea rcx, [rbp - 0x70]
call fcn.18003e08c
xor r9d, r9d
lea r8d, [rsi + 8]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp - 0x70]
call fcn.18003de9c
cmp qword [reloc.OLEAUT32.dll_SysReAllocString], 0
je 0x180073977
lea rdx, [0x1800eaeec]
mov rcx, rdi
call fcn.180021520
test al, al
je 0x180073977
mov sil, 1
jmp 0x18007397a
xor sil, sil
test r12b, r12b
je 0x18007398e
mov r8, r13
lea rcx, [rbp - 0x70]
mov dl, sil
call fcn.180071fb8
test sil, sil
je 0x1800739af
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea rcx, [rbp - 0x70]
cmovae rdi, qword [0x180102570]
mov rdx, rdi
call fcn.18003de6c
call fcn.180049c04
mov rcx, rax
lea rdx, [rbp - 0x70]
mov r8d, r14d
call fcn.180077c5c
lea rcx, [rbp - 0x70]
call fcn.18001d6c0
mov eax, dword [rbx + 0x10]
lea rcx, [rsp + 0x68]
and qword [rsp + 0x64], 0
and dword [rsp + 0x6c], 0
mov dword [rsp + 0x5c], eax
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], 0x423
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r9d, r9d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
lea r8d, [r9 + 0x18]
call fcn.18003de9c
call fcn.180049c04
mov rcx, rax
lea rdx, [rsp + 0x70]
mov r8d, r14d
call fcn.180077c5c
lea rcx, [rsp + 0x70]
call fcn.18001d6c0
mov rsi, qword [rbp + 0x318]
mov r14d, 1
xor eax, eax
lock cmpxchg dword [0x18010a5b0], r14d
jne 0x180073a4c
call fcn.180071a20
xor edx, edx
jmp 0x180073a52
mov edx, edi
mov r9, rbx
mov r8, rsi
xor ecx, ecx
lea r11, [rsp + 0x3e0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
jmp qword [sym.imp.USER32.dll_CallNextHookEx]