Function at 0x10001800
Capabilities:
Contain obfuscated stackstrings
Create http request
Get http content length
Read data from internet
Receive data
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x10064040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ecx + 4]
mov dword [ebp - 0xb8], ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
test edx, 0xf00000
jbe 0x100018d5
mov eax, edx
and eax, 0xf00000
cmp eax, 0xb00000
jae 0x100018d5
mov eax, edx
sar eax, 0x18
test eax, eax
jle 0x100018d5
cmp eax, 6
jge 0x100018d5
mov eax, edx
and eax, 0xf00000
cmp eax, 0x100000
jne 0x100018ba
cmp dword [ecx], 0
je 0x100018d5
mov eax, edx
and eax, 0xfffff
cmp eax, 1
jne 0x100018d5
and edx, 0xf00000
cmp edx, 0x300000
jne 0x1000188f
cmp dword [ecx], 0
je 0x100018d5
cmp byte [ebp + 8], 0
jne 0x10001d28
push 0
push 0
push 0
push 4
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_125.0.0.0_Safari_537.36_Edg_125.0.0.0
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ebx, eax
test ebx, ebx
jne 0x100018f0
mov dword [edi], 2
jmp 0x100018db
mov eax, edx
and eax, 0xf00000
cmp eax, 0x700000
jne 0x1000187c
cmp dword [ecx], 0
je 0x100018d5
test edx, 0xfffff
je 0x1000188f
mov dword [edi], 1
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d2b1
mov esp, ebp
pop ebp
ret 8
push 0x208
call fcn.1002d821
add esp, 4
mov esi, eax
mov dword [ebp - 0xb0], esi
push 0x208
push 0
push esi
call fcn.1002eee0
mov eax, dword [ebp - 0xb8]
add esp, 0xc
push dword [eax + 4]
push dword [eax]
push str.https:__steamcommunity.com_profiles__lld__xml1
push 0xffffffffffffffff
push 0x104
push esi
call fcn.10001360
add esp, 0x18
push 0
push 0x84ac0300
push 0
push 0
push esi
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 0xac], eax
test eax, eax
je 0x10001d85
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x9c], 0
push ecx
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0xa8], 4
push ecx
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0xa4], 0
push ecx
push 0x20000005
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x100019c5
push dword [ebp - 0xac]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
push dword [ebp - 0xb0]
call fcn.1002d2c4
add esp, 4
mov dword [edi], 4
jmp 0x100018db
mov esi, dword [ebp - 0x9c]
test esi, esi
jne 0x100019fb
push dword [ebp - 0xac]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
push dword [ebp - 0xb0]
call fcn.1002d2c4
add esp, 4
mov dword [edi], 5
jmp 0x100018db
inc esi
push esi
call fcn.1002d821
add esp, 4
mov dword [ebp - 0xb4], eax
push esi
mov esi, eax
push 0
push esi
call fcn.1002eee0
add esp, 0xc
mov dword [ebp - 0xa0], 0
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0x9c]
push esi
push dword [ebp - 0xac]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x10001a85
push dword [ebp - 0xac]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
mov eax, dword [ebp - 0xb4]
push eax
call fcn.1002d2c4
add esp, 4
push dword [ebp - 0xb0]
call fcn.1002d2c4
add esp, 4
mov dword [edi], 6
jmp 0x100018db
mov eax, dword [ebp - 0xa0]
test eax, eax
je 0x10001d43
cmp dword [ebp - 0x9c], eax
jne 0x10001d43
mov dword [ebp - 0x98], 0x6d783f3c
mov dword [ebp - 0x94], 0x6576206c
mov dword [ebp - 0x90], 0x6f697372
mov dword [ebp - 0x8c], 0x31223d6e
mov dword [ebp - 0x88], 0x2022302e
mov dword [ebp - 0x84], 0x6f636e65
mov dword [ebp - 0x80], 0x676e6964
mov dword [ebp - 0x7c], 0x5455223d
mov dword [ebp - 0x78], 0x22382d46
mov dword [ebp - 0x74], 0x61747320
mov dword [ebp - 0x70], 0x6c61646e
mov dword [ebp - 0x6c], 0x3d656e6f
mov dword [ebp - 0x68], 0x73657922
mov dword [ebp - 0x64], 0x3c3e3f22
mov dword [ebp - 0x60], 0x70736572
mov dword [ebp - 0x5c], 0x65736e6f
mov dword [ebp - 0x58], 0x72653c3e
mov dword [ebp - 0x54], 0x3e726f72
mov dword [ebp - 0x50], 0x435b213c
mov dword [ebp - 0x4c], 0x41544144
mov dword [ebp - 0x48], 0x6568545b
mov dword [ebp - 0x44], 0x65707320
mov dword [ebp - 0x40], 0x69666963
mov dword [ebp - 0x3c], 0x70206465
mov dword [ebp - 0x38], 0x69666f72
mov dword [ebp - 0x34], 0x6320656c
mov dword [ebp - 0x30], 0x646c756f
mov dword [ebp - 0x2c], 0x746f6e20
mov dword [ebp - 0x28], 0x20656220
mov dword [ebp - 0x24], 0x6e756f66
mov dword [ebp - 0x20], 0x5d5d2e64
mov dword [ebp - 0x1c], 0x652f3c3e
mov dword [ebp - 0x18], 0x726f7272
mov dword [ebp - 0x14], 0x722f3c3e
mov dword [ebp - 0x10], 0x6f707365
mov dword [ebp - 0xc], 0x3e65736e
cmp eax, 0x90
jb 0x10001c14
mov ecx, esi
mov dword [ebp - 0xb8], 0x8c
lea edx, [ebp - 0x98]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10001c14
add ecx, 4
add edx, 4
sub dword [ebp - 0xb8], 4
jae 0x10001bc6
push dword [ebp - 0xac]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
mov eax, dword [ebp - 0xb4]
push eax
call fcn.1002d2c4
add esp, 4
push dword [ebp - 0xb0]
call fcn.1002d2c4
add esp, 4
mov dword [edi], 8
jmp 0x100018db
push str._vacBanned_1__vacBanned_
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10001c65
push dword [ebp - 0xac]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
mov eax, dword [ebp - 0xb4]
push eax
call fcn.1002d2c4
add esp, 4
push dword [ebp - 0xb0]
call fcn.1002d2c4
add esp, 4
mov dword [edi], 0xa
jmp 0x100018db
push str._tradeBanState_Probation__tradeBanState_
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10001cb3
push dword [ebp - 0xac]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
mov eax, dword [ebp - 0xb4]
push eax
call fcn.1002d2c4
add esp, 4
push dword [ebp - 0xb0]
call fcn.1002d2c4
add esp, 4
mov dword [edi], 0xb
jmp 0x100018db
push str._tradeBanState_Banned__tradeBanState_
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0xac]
test eax, eax
je 0x10001d05
call esi
push ebx
call esi
mov eax, dword ds:[ebp - 0xb4]
push eax
call fcn.1002d2c4
add esp, 4
push dword [ebp - 0xb0]
call fcn.1002d2c4
add esp, 4
mov dword [edi], 0xc
jmp 0x100018db
call esi
push ebx
call esi
mov eax, dword [ebp - 0xb4]
push eax
call fcn.1002d2c4
add esp, 4
push dword [ebp - 0xb0]
call fcn.1002d2c4
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
mov dword [edi], 0
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1002d2b1
mov esp, ebp
pop ebp
ret 8
push dword [ebp - 0xac]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
mov eax, dword ds:[ebp - 0xb4]
push eax
call fcn.1002d2c4
add esp, 4
push dword [ebp - 0xb0]
call fcn.1002d2c4
add esp, 4
mov dword [edi], 7
jmp 0x100018db
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push esi
call fcn.1002d2c4
add esp, 4
mov dword [edi], 3
jmp 0x100018db