Function at 0x10015710
Capabilities:
Decode data using base64 via winapi
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x100f3e22
mov eax, dword fs:[0]
push eax
mov eax, 0x1928
call fcn.100d4920
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x1920], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10139d00]
xor eax, esp
push eax
lea eax, [esp + 0x193c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x194c]
xor ebx, ebx
push 0x800
lea eax, [esp + 0x138]
push ebx
push eax
mov dword [esp + 0x58], ebp
mov dword [esp + 0x28], ebx
call fcn.100d4cc0
add esp, 0xc
push 0x400
lea ecx, [esp + 0x138]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x134]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str...360NetBase.dll
mov eax, 0x800
lea edi, [esp + 0x138]
call fcn.100044f0
mov eax, edi
push eax
call fcn.10007240
mov ecx, eax
call fcn.10007320
test eax, eax
je 0x10015ef9
push 0x1000
push ebx
push 0x101ded60
call fcn.100d4cc0
add esp, 0xc
call fcn.10007240
mov eax, dword [eax + 0x38]
cmp eax, ebx
je 0x10015ef9
call eax
mov esi, eax
cmp esi, ebx
je 0x10015ef9
call fcn.10007240
mov eax, dword [eax + 0xd4]
cmp eax, ebx
je 0x1001581b
push str.Cache_Control:_no_cache
push ebx
call eax
add esp, 8
mov dword [esp + 0x2c], eax
jmp 0x1001581f
mov dword [esp + 0x2c], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
call ebx
inc eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x10015ef9
push ebp
call ebx
push eax
push ebp
push edi
call fcn.100d0e10
add esp, 0xc
push str.http:__inf.safe.360.cn_p_decode1_i
call ebx
inc eax
push eax
lea ecx, [esp + 0x938]
push str.http:__inf.safe.360.cn_p_decode1_i
push ecx
call fcn.100d0e10
add esp, 0xc
push edi
xor ebp, ebp
call ebx
xor ecx, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], ecx
test eax, eax
jbe 0x100158d7
mov edx, 1
sub edx, edi
mov ebx, edi
mov dword [esp + 0x28], edx
cmp byte [ebx], 0x2b
jne 0x100158c7
sub ecx, ebp
mov byte [ebx], 0
je 0x100158a5
add ebp, edi
push ebp
lea edx, [esp + 0x938]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x10129f38
lea eax, [esp + 0x938]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
lea ebp, [ecx + ebx]
mov ecx, dword [esp + 0x20]
inc ecx
inc ebx
mov dword [esp + 0x20], ecx
cmp ecx, eax
jb 0x10015888
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
add ebp, edi
push ebp
lea edx, [esp + 0x938]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebp, 0xf
xor edi, edi
mov dword [esp + 0xa0], ebp
mov dword [esp + 0x9c], edi
mov byte [esp + 0x8c], 0
push 0x2710
push 0x9c
push esi
mov dword [esp + 0x1950], edi
call fcn.100070d0
push 0x2710
push 0x9b
push esi
call fcn.100070d0
lea eax, [esp + 0x94c]
push eax
push 0x2712
push esi
call fcn.100070d0
push edi
push 0x34
push esi
call fcn.100070d0
push 1
push 0x50
push esi
call fcn.100070d0
mov ecx, dword [esp + 0x68]
push ecx
push 0x2727
push esi
call fcn.100070d0
add esp, 0x48
push 0x10011630
push 0x4e2b
push esi
call fcn.100070d0
lea edx, [esp + 0x94]
push edx
push 0x2711
push esi
call fcn.100070d0
push edi
push 0x51
push esi
call fcn.100070d0
push edi
push 0x40
push esi
call fcn.100070d0
add esp, 0x30
call fcn.10007240
mov eax, dword [eax + 0x40]
cmp eax, edi
je 0x100159b6
push esi
call eax
add esp, 4
lea eax, [esp + 0x48]
push eax
push 0x200002
push esi
mov dword [esp + 0x54], edi
call fcn.10007080
add esp, 0xc
cmp eax, edi
jne 0x10015edf
cmp dword [esp + 0x48], 0xc8
jne 0x10015edf
lea ecx, [esp + 0xa4]
call fcn.10053f10
push edi
lea ecx, [esp + 0x38]
mov byte [esp + 0x1948], 1
call fcn.1005e4a0
mov dword [esp + 0x84], ebp
mov dword [esp + 0x80], edi
mov byte [esp + 0x70], 0
push 1
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x90]
push edx
lea ecx, [esp + 0xb0]
mov byte [esp + 0x1950], 3
call fcn.10053fd0
test al, al
je 0x10015b2b
lea ecx, [esp + 0x34]
call fcn.1005f800
test al, al
je 0x10015a9a
push str.output
lea ecx, [esp + 0x38]
call fcn.1005f790
test al, al
je 0x10015a9a
lea eax, [esp + 0x50]
push eax
push str.output
lea ecx, [esp + 0x3c]
call fcn.1005f6d0
mov ecx, eax
call fcn.1005ec00
cmp dword [eax + 0x18], 0x10
mov dword [esp + 0x1c], 1
jb 0x10015a8b
mov eax, dword [eax + 4]
jmp 0x10015a8e
add eax, 4
push eax
call ebx
mov byte [esp + 0x1b], 1
test eax, eax
jne 0x10015a9f
mov byte [esp + 0x1b], 0
test byte [esp + 0x1c], 1
je 0x10015ab4
and dword [esp + 0x1c], 0xfffffffe
lea ecx, [esp + 0x50]
call fcn.10002cc0
cmp byte [esp + 0x1b], 0
je 0x10015b2b
lea ecx, [esp + 0x50]
push ecx
push str.output
lea ecx, [esp + 0x3c]
call fcn.1005f6d0
mov ecx, eax
call fcn.1005ec00
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x78]
mov byte [esp + 0x1950], 4
call fcn.10002a30
lea ecx, [esp + 0x50]
mov byte [esp + 0x1944], 3
call fcn.10002cc0
cmp dword [esp + 0x84], 0x10
mov eax, dword [esp + 0x70]
mov dword [esp + 0x24], 0x1000
jae 0x10015b15
lea eax, [esp + 0x70]
push edi
push edi
lea edx, [esp + 0x2c]
push edx
push 0x101ded60
push 1
push edi
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
cmp dword [esp + 0x80], edi
jne 0x10015e18
mov ebp, dword [esp + 0x4c]
push ebp
call ebx
inc eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x10015b86
lea ecx, [esp + 0x6c]
call fcn.10002cc0
lea ecx, [esp + 0x34]
mov byte [esp + 0x1944], 1
call fcn.1005e9c0
lea edi, [esp + 0xa4]
call fcn.100119a0
lea ecx, [esp + 0x88]
call fcn.10002cc0
jmp 0x10015ef9
push ebp
call ebx
push eax
push ebp
push edi
call fcn.100d0e10
add esp, 0xc
push str.http:__inf.safe.360.cn_p_decode2019_i
call ebx
inc eax
push eax
lea eax, [esp + 0x938]
push str.http:__inf.safe.360.cn_p_decode2019_i
push eax
call fcn.100d0e10
add esp, 0xc
push edi
xor ebp, ebp
call ebx
xor ecx, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], ecx
test eax, eax
jbe 0x10015c21
mov edx, 1
sub edx, edi
mov ebx, edi
mov dword [esp + 0x28], edx
cmp byte [ebx], 0x2b
jne 0x10015c11
sub ecx, ebp
mov byte [ebx], 0
je 0x10015bef
add ebp, edi
push ebp
lea ecx, [esp + 0x938]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x10129f38
lea edx, [esp + 0x938]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
lea ebp, [ebx + eax]
mov eax, dword [esp + 0x30]
inc ecx
inc ebx
mov dword [esp + 0x20], ecx
cmp ecx, eax
jb 0x10015bd2
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
add ebp, edi
push ebp
lea ecx, [esp + 0x938]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea edi, [esp + 0x88]
call fcn.100160b0
push 0x2710
push 0x9c
push esi
call fcn.100070d0
push 0x2710
push 0x9b
push esi
call fcn.100070d0
lea edx, [esp + 0x94c]
push edx
push 0x2712
push esi
call fcn.100070d0
xor edi, edi
push edi
push 0x34
push esi
call fcn.100070d0
push 1
push 0x50
push esi
call fcn.100070d0
mov eax, dword [esp + 0x68]
push eax
push 0x2727
push esi
call fcn.100070d0
add esp, 0x48
push 0x10011630
push 0x4e2b
push esi
call fcn.100070d0
lea ecx, [esp + 0x94]
push ecx
push 0x2711
push esi
call fcn.100070d0
push edi
push 0x51
push esi
call fcn.100070d0
push edi
push 0x40
push esi
call fcn.100070d0
add esp, 0x30
call fcn.10007240
mov eax, dword [eax + 0x40]
cmp eax, edi
je 0x10015cea
push esi
call eax
add esp, 4
lea edx, [esp + 0x24]
push edx
push 0x200002
push esi
mov dword [esp + 0x30], edi
call fcn.10007080
add esp, 0xc
cmp eax, edi
jne 0x10015e87
cmp dword [esp + 0x24], 0xc8
jne 0x10015e87
push 1
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0xb0]
call fcn.10053fd0
test al, al
je 0x10015e0f
lea ecx, [esp + 0x34]
call fcn.1005f800
test al, al
je 0x10015d91
push str.output
lea ecx, [esp + 0x38]
call fcn.1005f790
test al, al
je 0x10015d91
lea edx, [esp + 0x50]
push edx
push str.output
lea ecx, [esp + 0x3c]
call fcn.1005f6d0
mov ecx, eax
call fcn.1005ec00
or dword [esp + 0x1c], 2
cmp dword [eax + 0x18], 0x10
jb 0x10015d83
mov eax, dword [eax + 4]
jmp 0x10015d86
add eax, 4
push eax
call ebx
test eax, eax
je 0x10015d91
mov bl, 1
jmp 0x10015d93
xor bl, bl
test byte [esp + 0x1c], 2
je 0x10015da3
lea ecx, [esp + 0x50]
call fcn.10002cc0
test bl, bl
je 0x10015e0f
lea eax, [esp + 0x50]
push eax
push str.output
lea ecx, [esp + 0x3c]
call fcn.1005f6d0
mov ecx, eax
call fcn.1005ec00
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x78]
mov byte [esp + 0x1950], 5
call fcn.10002a30
lea ecx, [esp + 0x50]
call fcn.10002cc0
cmp dword [esp + 0x84], 0x10
mov eax, dword [esp + 0x70]
mov dword [esp + 0x20], 0x1000
jae 0x10015df9
lea eax, [esp + 0x70]
push edi
push edi
lea ecx, [esp + 0x28]
push ecx
push 0x101ded60
push 1
push edi
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
xor edi, edi
cmp dword [esp + 0x80], edi
mov esi, 0x10
setne bl
cmp dword [esp + 0x84], esi
jb 0x10015e36
mov ecx, dword [esp + 0x70]
push ecx
call fcn.100d072d
add esp, 4
lea ecx, [esp + 0x34]
mov dword [esp + 0x84], 0xf
mov dword [esp + 0x80], edi
mov byte [esp + 0x70], 0
mov byte [esp + 0x1944], 1
call fcn.1005e9c0
lea edi, [esp + 0xa4]
call fcn.100119a0
cmp dword [esp + 0xa0], esi
jb 0x10015e83
mov edx, dword [esp + 0x8c]
push edx
call fcn.100d072d
add esp, 4
mov al, bl
jmp 0x10015efb
mov esi, 0x10
cmp dword [esp + 0x84], esi
jb 0x10015ea2
mov edx, dword [esp + 0x70]
push edx
call fcn.100d072d
add esp, 4
lea ecx, [esp + 0x34]
mov dword [esp + 0x84], 0xf
mov dword [esp + 0x80], edi
mov byte [esp + 0x70], 0
mov byte [esp + 0x1944], 1
call fcn.1005e9c0
lea edi, [esp + 0xa4]
call fcn.100119a0
cmp dword [esp + 0xa0], esi
jmp 0x10015ee7
cmp dword [esp + 0xa0], 0x10
jb 0x10015ef9
mov eax, dword [esp + 0x8c]
push eax
call fcn.100d072d
add esp, 4
xor al, al
mov ecx, dword [esp + 0x193c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1920]
xor ecx, esp
call fcn.100d0738
add esp, 0x1934
ret 4