Function at 0x42d9d0
Capabilities:
Create http request
Encode data using xor
Query remote server for available data
Read .ini file
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1954
call fcn.00433390
mov eax, dword [0x43d00c]
xor eax, esp
mov dword [esp + 0x1950], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
push str.TestLicense
mov dword [esp + 0x28], edx
mov dword [esp + 0x30], esi
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBegin]
push 0xe09
lea eax, [esp + 0x3c]
mov dword [esp + 0x38], 0
push 0
push eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea edx, [esp + 0xe48]
call fcn.0042d6d0
test al, al
je 0x42da71
test dword [esp + 0xe48], 0x8000
jne 0x42da71
push 0x14
lea eax, [esp + 0xa45]
push eax
lea eax, [esp + 0xe64]
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll__swab]
add esp, 0xc
jmp 0x42da94
push str.ffffffffff
call dword [sym.imp.VMProtectSDK32.dll_VMProtectDecryptStringA]
mov ecx, eax
lea edx, [esp + 0xa41]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x42da87
push 0xa
lea eax, [esp + 0xc45]
push eax
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
push edx
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__i64toa]
lea esi, [esp + 0xc51]
mov byte [esp + 0x23], 9
add esp, 0x10
mov byte [esp + 0x1b], 3
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x42dac8
sub esi, ecx
lea eax, [esi - 1]
test eax, eax
js 0x42db22
nop dword [eax + eax]
mov cl, byte [esp + eax + 0xc41]
dec eax
cmp cl, 0x30
jne 0x42daf3
test eax, eax
jns 0x42dae0
jmp 0x42db22
lea ebx, [ecx - 0x30]
mov byte [esp + 0x13], bl
test eax, eax
js 0x42db22
nop
mov dl, byte [esp + eax + 0xc41]
movsx ecx, dl
cmp ecx, 0x30
je 0x42db14
cmp ecx, 0x37
jle 0x42db1b
sub eax, 1
jns 0x42db00
jmp 0x42db22
lea ebx, [edx - 0x30]
mov byte [esp + 0x1b], bl
lea eax, [esi + 1]
push eax
call fcn.00432738
add esp, 4
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0xc41]
push esi
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [esp + 0xc41]
push esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor edi, edi
test esi, esi
je 0x42db83
lea ebx, [esp + 0xc41]
mov eax, dword [esp + 0x1c]
movzx eax, byte [edi + eax]
push eax
push str._02x
push ebx
call fcn.00415760
inc edi
add esp, 0xc
add ebx, 2
cmp edi, esi
jb 0x42db64
push dword [esp + 0x1c]
call fcn.004326fe
lea esi, [esp + 0xa45]
mov byte [esp + 0xa59], 0
add esp, 4
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x42dba1
movzx ebx, byte [esp + 0x1b]
xor edx, edx
mov dword [esp + 0x1c], ebx
sub esi, ecx
je 0x42dbdb
nop word [eax + eax]
mov al, byte [esp + edx + 0xa41]
mov ecx, ebx
xor al, byte [esp + 0x13]
rol al, cl
mov byte [esp + edx + 0xa41], al
inc edx
cmp edx, esi
jb 0x42dbc0
lea eax, [esi + 1]
push eax
call fcn.00432738
add esp, 4
mov dword [esp + 0x14], eax
lea ecx, [esp + 0xa41]
push esi
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [esp + 0xa41]
push esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor edi, edi
test esi, esi
je 0x42dc43
lea ebx, [esp + 0xa41]
nop dword [eax]
mov eax, dword [esp + 0x14]
movzx eax, byte [edi + eax]
push eax
push str._02x
push ebx
call fcn.00415760
inc edi
add esp, 0xc
add ebx, 2
cmp edi, esi
jb 0x42dc20
mov ebx, dword [esp + 0x1c]
push dword [esp + 0x14]
call fcn.004326fe
add esp, 4
lea eax, [esp + 0x1050]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x42dcb5
lea eax, [esp + 0x1050]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_strrchr]
movq xmm0, qword [str.Config.ini]
mov ecx, eax
add esp, 8
movq qword [ecx], xmm0
mov eax, dword [0x438cb0]
mov dword [ecx + 8], eax
lea eax, [esp + 0x1050]
push eax
push 0x200
lea eax, [esp + 0x40]
push eax
push 0
push 0x438cb8
push str.license
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea esi, [esp + 0x38]
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x42dcc0
sub esi, ecx
jne 0x42dce2
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1950]
xor ecx, esp
call fcn.00432001
mov esp, ebp
pop ebp
ret
xor edx, edx
test esi, esi
je 0x42dd05
nop dword [eax + eax]
mov al, byte [esp + edx + 0x38]
mov ecx, ebx
xor al, byte [esp + 0x13]
rol al, cl
mov byte [esp + edx + 0x38], al
inc edx
cmp edx, esi
jb 0x42dcf0
lea eax, [esi + 1]
push eax
call fcn.00432738
add esp, 4
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x38]
push esi
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [esp + 0x38]
push esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor edi, edi
test esi, esi
je 0x42dd5f
lea ebx, [esp + 0x38]
nop
mov eax, dword [esp + 0x14]
movzx eax, byte [edi + eax]
push eax
push str._02x
push ebx
call fcn.00415760
inc edi
add esp, 0xc
add ebx, 2
cmp edi, esi
jb 0x42dd40
push dword [esp + 0x14]
call fcn.004326fe
add esp, 4
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + str.RFO_BOT]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x237], al
test al, al
jne 0x42dd70
lea esi, [esp + 0x238]
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x42dd90
xor edx, edx
sub esi, ecx
je 0x42ddbc
mov ecx, dword [esp + 0x1c]
mov bl, byte [esp + 0x13]
mov al, byte [esp + edx + 0x238]
xor al, bl
rol al, cl
mov byte [esp + edx + 0x238], al
inc edx
cmp edx, esi
jb 0x42dda5
lea eax, [esi + 1]
push eax
call fcn.00432738
add esp, 4
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x238]
push esi
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [esp + 0x238]
push esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor edi, edi
test esi, esi
je 0x42de1f
lea ebx, [esp + 0x238]
nop
mov eax, dword [esp + 0x14]
movzx eax, byte [edi + eax]
push eax
push str._02x
push ebx
call fcn.00415760
inc edi
add esp, 0xc
add ebx, 2
cmp edi, esi
jb 0x42de00
push dword [esp + 0x14]
call fcn.004326fe
mov edx, dword [esp + 0x28]
add esp, 4
test edx, edx
je 0x42e09b
lea ecx, [esp + 0x438]
sub ecx, edx
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x42de40
lea esi, [esp + 0x438]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x42de57
xor edx, edx
sub esi, ecx
je 0x42de87
mov ecx, dword [esp + 0x1c]
mov bl, byte [esp + 0x13]
nop dword [eax]
mov al, byte [esp + edx + 0x438]
xor al, bl
rol al, cl
mov byte [esp + edx + 0x438], al
inc edx
cmp edx, esi
jb 0x42de70
lea eax, [esi + 1]
push eax
call fcn.00432738
add esp, 4
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x438]
push esi
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [esp + 0x438]
push esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor edi, edi
test esi, esi
je 0x42deef
lea ebx, [esp + 0x438]
nop dword [eax]
mov eax, dword [esp + 0x14]
movzx eax, byte [edi + eax]
push eax
push str._02x
push ebx
call fcn.00415760
inc edi
add esp, 0xc
add ebx, 2
cmp edi, esi
jb 0x42ded0
push dword [esp + 0x14]
call fcn.004326fe
mov ecx, dword [ebp + 8]
add esp, 4
test ecx, ecx
je 0x42dfcb
lea edx, [esp + 0x641]
sub edx, ecx
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x42df10
lea esi, [esp + 0x641]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x42df27
xor edx, edx
sub esi, ecx
je 0x42df57
mov ecx, dword [esp + 0x1c]
mov bl, byte [esp + 0x13]
nop dword [eax]
mov al, byte [esp + edx + 0x641]
xor al, bl
rol al, cl
mov byte [esp + edx + 0x641], al
inc edx
cmp edx, esi
jb 0x42df40
lea eax, [esi + 1]
push eax
call fcn.00432738
add esp, 4
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x641]
push esi
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [esp + 0x641]
push esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor edi, edi
test esi, esi
je 0x42dfbf
lea ebx, [esp + 0x641]
nop dword [eax]
mov eax, dword [esp + 0x14]
movzx eax, byte [edi + eax]
push eax
push str._02x
push ebx
call fcn.00415760
inc edi
add esp, 0xc
add ebx, 2
cmp edi, esi
jb 0x42dfa0
push dword [esp + 0x14]
call fcn.004326fe
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x42e09b
lea edx, [esp + 0x841]
sub edx, ecx
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x42dfe0
lea esi, [esp + 0x841]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x42dff7
xor edx, edx
sub esi, ecx
je 0x42e027
mov ecx, dword [esp + 0x1c]
mov bl, byte [esp + 0x13]
nop dword [eax]
mov al, byte [esp + edx + 0x841]
xor al, bl
rol al, cl
mov byte [esp + edx + 0x841], al
inc edx
cmp edx, esi
jb 0x42e010
lea eax, [esi + 1]
push eax
call fcn.00432738
add esp, 4
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x841]
push esi
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [esp + 0x841]
push esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor edi, edi
test esi, esi
je 0x42e08f
lea ebx, [esp + 0x841]
nop dword [eax]
mov eax, dword [esp + 0x14]
movzx eax, byte [edi + eax]
push eax
push str._02x
push ebx
call fcn.00415760
inc edi
add esp, 0xc
add ebx, 2
cmp edi, esi
jb 0x42e070
push dword [esp + 0x14]
call fcn.004326fe
add esp, 4
lea eax, [esp + 0x841]
push eax
lea eax, [esp + 0x645]
push eax
lea eax, [esp + 0xc49]
push eax
lea eax, [esp + 0x444]
push eax
lea eax, [esp + 0xa51]
push eax
lea eax, [esp + 0x24c]
push eax
lea eax, [esp + 0x50]
push eax
push str.https:__www.helspont.com_Loader_RFOscrp.php_unk0_sunk1_sunk2_sunk3_sunk4_sunk5_sunk6_s
call dword [sym.imp.VMProtectSDK32.dll_VMProtectDecryptStringA]
push eax
lea eax, [esp + 0x1178]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
push 0
push 0
push 0
push 0
push str.Rd3Qrf2
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esp + 0x24], eax
test eax, eax
je 0x42e1c5
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x1168]
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov esi, eax
test esi, esi
je 0x42e1bf
mov edi, dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
lea eax, [esp + 0x34]
push 0
push 0
push eax
push esi
call edi
test eax, eax
je 0x42e18b
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
nop
mov eax, dword [esp + 0x34]
test eax, eax
je 0x42e185
lea ecx, [esp + 0x30]
push ecx
push eax
push dword [esp + 0x28]
push esi
call ebx
test eax, eax
je 0x42e185
mov eax, dword [esp + 0x20]
add eax, dword [esp + 0x30]
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x38]
push 0
push eax
push esi
call edi
test eax, eax
jne 0x42e150
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
push esi
call ebx
mov esi, dword [esp + 0x20]
mov edx, 0
mov edi, dword [esp + 0x2c]
sub esi, edi
mov dword [esp + 0x28], esi
je 0x42e1bf
mov ecx, dword [esp + 0x1c]
mov ah, byte [esp + 0x13]
nop dword [eax + eax]
mov al, byte [edx + edi]
ror al, cl
xor al, ah
mov byte [edx + edi], al
inc edx
cmp edx, esi
jb 0x42e1b0
push dword [esp + 0x24]
call ebx
mov ecx, dword [esp + 0x195c]
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00432001
mov esp, ebp
pop ebp
ret