Function at 0x180002d1b
Capabilities:
Check for time delay via queryperformancecounter
Encode data using xor
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rax, qword [0x18003e280]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor esi, esi
lea r15, [0x18003f258]
mov r12, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r13, qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdi, [0x18002e220]
mov rcx, r15
call r12
call r13
mov ebx, eax
rdtsc
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, r14d
rol ecx, 0xd
mov edx, ebx
rol edx, 0xf
imul r8d, eax, 0x7fed5213
mov r9d, esi
and r9d, 7
mov r9d, dword [rdi + r9*4]
imul r10d, r9d, 0x7ed55d16
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor r10d, ebx
xor r10d, r14d
xor r10d, eax
xor r10d, edx
or r9d, 1
imul r9d, r10d
mov dword [rsp + rsi*4 + 0x30], r9d
inc rsi
cmp rsi, 0x10
jne 0x180002d5e
xor eax, eax
lea rbx, [0x18003f258]
lea r14, [0x18002ecec]
xor esi, esi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x24], esi
xor esi, esi
mov rcx, rbx
call r12
call r13
mov ebp, eax
rdtsc
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, r15d
rol ecx, 0xd
mov edx, ebp
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor ebp, r15d
xor ebp, eax
xor ebp, edx
mov eax, 2
mov rdx, rdi
mov ecx, dword [rdx]
mov r8d, ebp
rol r8d, cl
mov ebp, dword [rsp + rax*4 + 0x28]
shr ecx, 8
ror ebp, cl
xor ebp, r8d
mov ecx, eax
and ecx, 7
mov ecx, dword [rdi + rcx*4]
mov r8d, ecx
or r8d, 1
imul r8d, ebp
rol r8d, cl
xor dword [rsp + rax*4 + 0x2c], r8d
inc rax
add rdx, 4
cmp rax, 9
jne 0x180002e30
mov eax, dword [rdi + rsi*4]
imul ecx, eax, 0x7ed55d16
xor ecx, ebp
or eax, 1
imul eax, ecx
mov dword [rsp + rsi*4 + 0x70], eax
inc rsi
cmp rsi, 8
jne 0x180002de8
lea rcx, [rsp + 0x30]
call fcn.18000b09c
mov rcx, rbx
call r12
call r13
mov ebp, eax
rdtsc
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, r15d
rol ecx, 0xd
mov edx, ebp
rol edx, 0xf
imul r8d, eax, 0x7fed5213
xor edx, dword [0x18003f258]
xor edx, r8d
xor edx, ecx
xor edx, dword [0x18003f25c]
xor ebp, r15d
xor ebp, eax
xor ebp, edx
xor edx, edx
mov eax, edx
and eax, 7
mov eax, dword [rdi + rax*4]
mov ecx, eax
rol ebp, cl
mov ecx, eax
shr ecx, 8
ror eax, cl
xor eax, ebp
lea r8, [rdx + 1]
mov ecx, r8d
and ecx, 7
mov ecx, dword [rdi + rcx*4]
mov ebp, ecx
or ebp, 1
imul ebp, eax
rol ebp, cl
xor dword [rsp + rdx*4 + 0x30], ebp
mov rdx, r8
cmp r8, 0xa
jne case.default.0x180002f38
mov r12d, 4
lea r8, [r12 - 4]
mov eax, dword [rdi]
mov ecx, eax
shr ecx, 0x18
and ecx, 7
movsxd rcx, dword [r14 + rcx*4]
add rcx, r14
xor r15d, r15d
xor r13d, r13d
mov rsi, rdi
jmp rcx
add r15, 3
add r13, 7
add rsi, 4
lea r8, [r12 - 4]
mov eax, dword [rsi]
mov ecx, eax
shr ecx, 0x18
and ecx, 7
movsxd rcx, dword [r14 + rcx*4]
add rcx, r14
jmp rcx
mov edx, dword [rsp + r12*4 + 0x60]
mov ecx, eax
rol edx, cl
mov r9d, dword [rsp + r12*4 + 0x20]
shr eax, 8
mov ecx, eax
ror r9d, cl
xor r9d, ebp
xor r9d, edx
mov ebp, r9d
jmp 0x18000304a
lea eax, [r12 - 3]
and eax, 7
mov eax, dword [rsp + rax*4 + 0x70]
add eax, ebp
lea ecx, [r12 - 2]
and ecx, 7
mov ecx, dword [rdi + rcx*4]
mov ebp, ecx
or ebp, 1
imul ebp, eax
rol ebp, cl
jmp 0x18000304a
or eax, 1
imul eax, ebp
mov edx, 0xd14a7d10
mov ecx, r15d
shr edx, cl
mov ecx, edx
rol eax, cl
mov ebp, eax
jmp 0x18000304a
mov eax, r12d
and eax, 7
mov ecx, dword [rdi + rax*4]
rol ebp, cl
lea eax, [r12 - 1]
and eax, 7
mov eax, dword [rsp + rax*4 + 0x70]
shr ecx, 8
ror eax, cl
jmp 0x180002ffb
mov ecx, r15d
and ecx, 0xf
mov ecx, dword [rsp + rcx*4 + 0x30]
imul edx, eax, 0x7ed55d16
xor edx, ecx
or eax, 1
imul eax, edx
xor ebp, eax
jmp 0x18000304a
mov ecx, r13d
and ecx, 0xf
mov edx, dword [rsp + rcx*4 + 0x30]
add edx, ebp
shr eax, 0x10
mov ecx, eax
ror edx, cl
jmp 0x180003048
mov eax, dword [rsp + r12*4 + 0x60]
or eax, 1
lea ecx, [r12 + 1]
and ecx, 7
xor eax, dword [rdi + rcx*4]
imul ebp, eax
jmp 0x18000304a
lea ecx, [r12 - 2]
and ecx, 7
mov edx, dword [rsp + rcx*4 + 0x70]
xor edx, eax
or edx, 1
imul edx, ebp
mov ecx, dword [rsp + rcx*4 + 0x70]
xor ecx, eax
rol edx, cl
mov ebp, edx
test r8b, 1
jne 0x18000308d
inc r12
cmp r12, 0xc
jne 0x180002f3a
mov esi, dword [rsp + 0x24]
xor esi, ebp
lea rcx, [rsp + 0x30]
call fcn.18000b09c
mov rax, qword [rsp + 0x28]
inc eax
cmp eax, 0xa
mov r12, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r13, qword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x180002ddd
jmp 0x180003099
lea rcx, [rsp + 0x30]
call fcn.18000b09c
jmp 0x180003050
xor esi, 0xd14a7d10
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18000f5a0
mov eax, esi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add rbp, 3
add rbx, 0x1c
add rdi, 7
mov rax, rdi
mul r13
add r15, 4
mov rax, rdi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
call 0x1406b7ef7
push rsp
call 0x1406b7ef7
push rsp
mov rcx, rbx
sub rcx, rax
mov eax, dword [r15]
mov edx, eax
shr edx, 0x18
and edx, 7
movsxd rdx, dword [r10 + rdx*4]
add rdx, r10
jmp rdx
add byte [rcx + 0x46c2d3c1], cl
mov eax, dword [rsp + riz*4 + 0x2c]
shr eax, 8
mov ecx, eax
ror r8d, cl
xor r8d, esi
xor r8d, edx
mov esi, r8d
jmp 0x180003801
add byte [rax], al
add byte [rcx], al
invalid
jmp 0x180003801
add al, 0x83
loopne 0x180003784
mov ecx, dword [r14 + rax*4]
rol esi, cl
lea eax, [r12 + 3]
lea eax, [rsp + 3]
and eax, 7
mov eax, dword [rsp + rax*4 + 0x80]
shr ecx, 8
ror eax, cl
jmp 0x1800037ae
xor esi, eax
jmp 0x180003801
test r12b, 1
jne 0x180003868
inc r12
cmp r12, 7
jne 0x1800036ca
xor ebx, ebx
lea rdi, [rsp + 0x2c]
mov rcx, rdi
call fcn.18000b164
mov eax, dword [rsp + rbx*4 + 0x2c]
or eax, 1
imul esi, eax
mov ecx, dword [rsp + rbx*4 + 0x2c]
rol esi, cl
inc rbx
cmp rbx, 0xa
jne 0x18000381b
xor esi, 0x9bb4e95
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.18000f5a0
mov eax, esi
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x2c]
mov qword [rsp + 0x20], r12
mov r12, rdi
mov rdi, r15
mov r15, rbx
mov rbx, r10
call fcn.18000b164
mov r10, rbx
mov rbx, r15
mov r15, rdi
mov rdi, r12
mov r12, qword [rsp + 0x20]
jmp 0x180003807