Function at 0x140001680
Capabilities:
Connect pipe
Create pipe
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x520
mov rax, qword [0x1400761f0]
xor rax, rsp
mov qword [rsp + 0x510], rax
mov rax, qword [0x140078ff8]
lea rsi, [0x140079020]
mov qword [rsp + 0x58], rax
xor edi, edi
mov rax, qword [0x140079018]
mov qword [rsp + 0x60], rax
nop word [rax + rax]
mov qword [rsp + 0x38], rsi
lea rcx, str..pipeopenssh_ssh_agent
mov dword [rsp + 0x30], edi
mov r9d, 0xff
mov dword [rsp + 0x28], 0x1400
xor r8d, r8d
mov edx, 0x40000003
mov dword [rsp + 0x20], 0x1400
call qword [sym.imp.api_ms_win_core_namedpipe_l1_1_0.dll_CreateNamedPipeW]
mov qword [0x140079038], rax
cmp rax, 0xffffffffffffffff
jne 0x140001727
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.cannot_create_listener_pipe_ERROR:_d
call fcn.140003980
jmp 0x140001747
lea rdx, [0x140079000]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_namedpipe_l1_1_0.dll_ConnectNamedPipe]
test eax, eax
je 0x140001754
lea rcx, str.ConnectNamedPipe_returned_TRUE_unexpectedly
call fcn.140003980
mov rcx, qword [0x140078ff8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x217
jne 0x140001776
lea rcx, str.Client_has_already_connected
call fcn.1400039b0
mov rcx, qword [0x140079018]
jmp 0x14000179e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x3e5
je 0x1400017a4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.ConnectNamedPipe_failed_ERROR:__d
call fcn.1400039b0
mov rcx, qword [0x140078ff8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
xor r8d, r8d
lea rdx, [rsp + 0x58]
or r9d, 0xffffffff
lea ecx, [r8 + 2]
call qword [sym.imp.api_ms_win_core_synch_l1_2_1.dll_WaitForMultipleObjects]
mov ebx, eax
test eax, eax
je 0x140001930
lea ecx, [rax - 1]
test ecx, ecx
jne 0x140001998
mov rbx, qword [0x140079038]
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov dword [rsp + 0x50], edi
mov qword [0x140079038], 0xffffffffffffffff
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_GetNamedPipeClientProcessId]
mov edx, dword [rsp + 0x50]
lea rcx, str.client_pid__d_connected
call fcn.140003980
cmp dword [0x140078fc0], edi
jne 0x140001926
xor edx, edx
lea rcx, [rsp + 0x80]
lea r8d, [rdx + 0x68]
call fcn.14002bc10
mov r8d, 0x104
lea rdx, [rsp + 0xf0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
mov edx, 1
mov rcx, rbx
mov r8d, edx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_SetHandleInformation]
lea r9, [rsp + 0xf0]
mov dword [rsp + 0x20], ebx
lea r8, str._s__d
mov edx, 0x104
lea rcx, [rsp + 0x300]
call fcn.140001520
cmp eax, 0xffffffff
je 0x1400018eb
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x300]
lea rax, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 1
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
je 0x1400018eb
mov r8d, dword [rsp + 0x50]
lea rcx, str.spawned_worker__d_for_agent_client_pid__d
mov edx, dword [rsp + 0x78]
call fcn.1400039b0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x140001908
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0xf0]
lea rcx, str.Failed_to_create_child_process__ls_ERROR:_d
call fcn.140003980
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 1]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_SetHandleInformation]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x1400016d0
mov rcx, rbx
call fcn.140001ff0
jmp 0x14000193c
lea rcx, str.shutting_down
call fcn.1400039b0
mov rcx, qword [0x140079018]
test rcx, rcx
je 0x14000194e
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [0x140079038]
cmp rcx, 0xffffffffffffffff
je 0x140001961
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [0x140078fc8]
test rcx, rcx
je 0x140001973
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rsp + 0x510]
xor rcx, rsp
call fcn.14002a0e0
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, ebx
lea rcx, str.wait_on_events_ended_with__d_ERROR:_d
mov r8d, eax
call fcn.1400038c0
int3