Function at 0x140001690
Capabilities:
Connect pipe
Create pipe
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20100
call fcn.14002e040
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x200f0], rax
mov rax, qword [0x14006c260]
lea rsi, [0x14006c288]
mov qword [rsp + 0x58], rax
xor edi, edi
mov rax, qword [0x14006c280]
mov qword [rsp + 0x60], rax
nop dword [rax + rax]
mov qword [rsp + 0x38], rsi
lea rcx, str..pipeopenssh_ssh_agent
mov dword [rsp + 0x30], edi
mov r9d, 0xff
mov dword [rsp + 0x28], 0x1400
xor r8d, r8d
mov edx, 0x40000003
mov dword [rsp + 0x20], 0x1400
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [0x14006c2a0], rax
cmp rax, 0xffffffffffffffff
jne 0x140001737
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.cannot_create_listener_pipe_ERROR:_d
call fcn.140007ce0
jmp 0x140001757
lea rdx, [0x14006c268]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x140001764
lea rcx, str.ConnectNamedPipe_returned_TRUE_unexpectedly
call fcn.140007ce0
mov rcx, qword [0x14006c260]
call qword [sym.imp.KERNEL32.dll_SetEvent]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x140001786
lea rcx, str.Client_has_already_connected
call fcn.140007d10
mov rcx, qword [0x14006c280]
jmp 0x1400017ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1400017b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ConnectNamedPipe_failed_ERROR:__d
call fcn.140007d10
mov rcx, qword [0x14006c260]
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor r8d, r8d
lea rdx, [rsp + 0x58]
or r9d, 0xffffffff
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ebx, eax
test eax, eax
je 0x140001940
lea ecx, [rax - 1]
test ecx, ecx
jne 0x1400019a8
mov rbx, qword [0x14006c2a0]
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov dword [rsp + 0x50], edi
mov qword [0x14006c2a0], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientProcessId]
mov edx, dword [rsp + 0x50]
lea rcx, str.client_pid__d_connected
call fcn.140007ce0
cmp dword [0x14005c140], edi
jne 0x140001936
xor edx, edx
lea rcx, [rsp + 0x80]
lea r8d, [rdx + 0x68]
call fcn.140017e30
mov r8d, 0x8000
lea rdx, [rsp + 0xf0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 1
mov rcx, rbx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea r9, [rsp + 0xf0]
mov dword [rsp + 0x20], ebx
lea r8, str._s__d
mov edx, 0x8000
lea rcx, [rsp + 0x100f0]
call fcn.140001530
cmp eax, 0xffffffff
je 0x1400018fb
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x100f0]
lea rax, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400018fb
mov r8d, dword [rsp + 0x50]
lea rcx, str.spawned_worker__d_for_agent_client_pid__d
mov edx, dword [rsp + 0x78]
call fcn.140007d10
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001918
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0xf0]
lea rcx, str.Failed_to_create_child_process__ls_ERROR:_d
call fcn.140007ce0
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400016e0
mov rcx, rbx
call fcn.140001e80
jmp 0x14000194c
lea rcx, str.shutting_down
call fcn.140007d10
mov rcx, qword [0x14006c280]
test rcx, rcx
je 0x14000195e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14006c2a0]
cmp rcx, 0xffffffffffffffff
je 0x140001971
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14005c148]
test rcx, rcx
je 0x140001983
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x200f0]
xor rcx, rsp
call fcn.1400164b0
lea r11, [rsp + 0x20100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, ebx
lea rcx, str.wait_on_events_ended_with__d_ERROR:_d
mov r8d, eax
call fcn.140007c80
int3