Function at 0x1400d6710
Capabilities:
Create thread
Get hostname

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov r14, rdx
mov rdi, rcx
mov dword [rsp + 0x30], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rdi + 0x210], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rdi + 0x218], rax
cmp qword [rdi + 0x210], 0
jne 0x1400d6780
mov rax, qword [rdi]
lea r8, str.Unable_to_create__EWSControlSync
xor edx, edx
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
cmp qword [rdi + 0x218], 0
jne 0x1400d679c
mov rax, qword [rdi]
lea r8, str.Unable_to_create_handshake_event
xor edx, edx
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
mov dword [rsp + 0x70], 0x5f
lea rbx, [rdi + 0x2c8]
xor edx, edx
lea r8d, [rdx + 0x60]
mov rcx, rbx
call fcn.140141ad0
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov rax, qword [rdi]
mov qword [rsp + 0x20], rbx
lea r9, str.InfoPush::Initialize
lea r8, str._s___Found_computer_name___s_
mov edx, 4
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
mov dword [rsp + 0x70], 0x5f
lea rbx, [rdi + 0x268]
xor edx, edx
lea r8d, [rdx + 0x60]
mov rcx, rbx
call fcn.140141ad0
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400d6847
lea rdx, str.GetComputerNameExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400d683e
lea r8, [rsp + 0x70]
mov rdx, rbx
mov ecx, 2
call rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [rbx], 0
jne 0x1400d686d
movsd xmm0, qword [str.DfltDomain]
movsd qword [rbx], xmm0
movzx eax, word [0x140218fc0]
mov word [rbx + 8], ax
movzx eax, byte [0x140218fc2]
mov byte [rbx + 0xa], al
mov rax, qword [rdi]
mov qword [rsp + 0x20], rbx
lea r9, str.InfoPush::Initialize
lea r8, str._s___Found_dns_domain___s_
mov edx, 4
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
mov ebx, 1
mov dword [rdi + 0x328], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rdi + 0x32c], eax
mov rdx, r14
mov rcx, rdi
call fcn.1400d6d00
mov rax, qword [rdi]
lea r9, str.InfoPush::Initialize
lea r8, str._s___Initializing_threads
lea edx, [rbx + 3]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rcx, qword [rdi + 0x248]
call qword [rdi + 0x240]
nop
mov rax, qword [rdi]
lea r9, str.InfoPush::Initialize
lea r8, str._s___Starting_InfoPush_thread
mov edx, 4
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
mov dword [rsp + 0x78], 0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x1400d9c50]
xor edx, edx
xor ecx, ecx
call fcn.14014b7c4
test rax, rax
je 0x1400d6930
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x30], ebx
mov rax, qword [rdi]
lea r9, str.InfoPush::Initialize
lea r8, str._s___Successfully_initialized_InfoPush
mov edx, 4
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
nop
jmp 0x1400d6957
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret