Function at 0x1400018c0
Capabilities:
Connect pipe
Create pipe
Create process on windows

Disassembly:
push rbp
push rbx
push r14
lea rbp, [rsp - 0x20010]
mov eax, 0x20110
call fcn.14004f660
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1fff0], rax
mov rax, qword [0x1400842d8]
lea r14, [0x140084308]
mov qword [rbp - 0x20], rax
lea r8, [0x140084310]
mov rax, qword [0x1400842f8]
lea rcx, str.D:P_A__GA___SY__A__GA___BA__A__0x12019b___AU_
mov qword [rbp - 0x18], rax
xorps xmm0, xmm0
xor eax, eax
mov r9, r14
movups xmmword [0x140084308], xmm0
mov edx, 1
mov qword [0x140084318], rax
mov dword [0x140084308], 0x18
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x140001e47
mov qword [rsp + 0x20130], rsi
xor ebx, ebx
mov qword [rsp + 0x20138], rdi
lea rsi, str.Failed_to_create_child_process__ls_ERROR:_d
mov qword [rsp + 0x20140], r12
lea r12, str.Client_has_already_connected
mov qword [rsp + 0x20108], r13
lea r13, str.cannot_create_listener_pipe_ERROR:_d
mov qword [rsp + 0x20100], r15
lea r15, str.ConnectNamedPipe_returned_TRUE_unexpectedly
mov dword [0x140084318], ebx
mov qword [rsp + 0x38], r14
lea rcx, str..pipeopenssh_ssh_agent
mov dword [rsp + 0x30], ebx
lea rdi, str.ConnectNamedPipe_failed_ERROR:__d
mov dword [rsp + 0x28], 0x1400
mov r9d, 0xff
xor r8d, r8d
mov dword [rsp + 0x20], 0x1400
mov edx, 0x40000003
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [0x140084320], rax
cmp rax, 0xffffffffffffffff
jne 0x140001a17
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
xor r9d, r9d
mov qword [rsp + 0x30], r13
lea rdx, str.agent_listen_loop
mov qword [rsp + 0x28], rbx
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agent_agent.c
mov r8d, 0x84
mov dword [rsp + 0x20], 4
call fcn.14001ae20
jmp 0x140001a59
lea rdx, [0x1400842e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x140001a66
mov qword [rsp + 0x30], r15
lea rdx, str.agent_listen_loop
mov qword [rsp + 0x28], rbx
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agent_agent.c
xor r9d, r9d
mov dword [rsp + 0x20], 4
mov r8d, 0x87
call fcn.14001ae20
mov rcx, qword [0x1400842d8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x140001aaa
mov qword [rsp + 0x30], r12
lea rdx, str.agent_listen_loop
mov qword [rsp + 0x28], rbx
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agent_agent.c
xor r9d, r9d
mov dword [rsp + 0x20], 5
mov r8d, 0x8c
call fcn.14001ae20
mov rcx, qword [0x1400842f8]
jmp 0x140001af6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x140001afc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea rdx, str.agent_listen_loop
mov qword [rsp + 0x28], rbx
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agent_agent.c
mov r8d, 0x8f
mov dword [rsp + 0x20], 5
call fcn.14001ae20
mov rcx, qword [0x1400842d8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov r9d, 0xffffffff
lea rdx, [rbp - 0x20]
xor r8d, r8d
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edi, eax
test eax, eax
je 0x140001d98
lea ecx, [rax - 1]
test ecx, ecx
jne 0x140001e89
mov rdi, qword [0x140084320]
lea rdx, [rsp + 0x68]
mov rcx, rdi
mov dword [rsp + 0x68], ebx
mov qword [0x140084320], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientProcessId]
mov eax, dword [rsp + 0x68]
lea rdx, str.agent_listen_loop
mov dword [rsp + 0x38], eax
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agent_agent.c
lea rax, str.client_pid__d_connected
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov r8d, 0x9f
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 4
call fcn.14001ae20
cmp dword [0x1400842d4], ebx
jne 0x140001d8e
xorps xmm0, xmm0
lea rdx, [rbp - 0x10]
xor eax, eax
mov r8d, 0x8000
xor ecx, ecx
mov qword [rbp - 0x30], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 1
mov rcx, rdi
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
cmp dword [0x1400a6730], 1
lea r9, [rbp - 0x10]
mov rax, qword [0x1400841c0]
lea rcx, [rbp + 0xfff0]
mov edx, 0x8000
jne 0x140001c2f
mov qword [rsp + 0x30], rax
lea r8, str._s__d__s__P___S_
lea rax, str._Oallow_remote_pkcs11
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
call fcn.140001800
cmp eax, 0xffffffff
jne 0x140001c8a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0xb0
jmp 0x140001c55
mov qword [rsp + 0x28], rax
lea r8, str._s__d__P___S_
mov dword [rsp + 0x20], edi
call fcn.140001800
cmp eax, 0xffffffff
jne 0x140001c8a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0xb4
mov dword [rsp + 0x40], eax
lea rdx, str.agent_listen_loop
lea rax, [rbp - 0x10]
xor r9d, r9d
mov qword [rsp + 0x38], rax
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agent_agent.c
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 4
call fcn.14001ae20
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0xfff0]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140001d14
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
xor r9d, r9d
mov r8d, 0xb7
lea rdx, str.agent_listen_loop
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agent_agent.c
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 4
call fcn.14001ae20
jmp 0x140001d6f
mov eax, dword [rsp + 0x68]
lea rdx, str.agent_listen_loop
mov dword [rsp + 0x40], eax
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agent_agent.c
mov eax, dword [rsp + 0x60]
xor r9d, r9d
mov dword [rsp + 0x38], eax
mov r8d, 0xb9
lea rax, str.spawned_worker__d_for_agent_client_pid__d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 5
call fcn.14001ae20
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov edx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001995
mov rcx, rdi
call fcn.1400027b0
jmp 0x140001dcd
lea rax, str.shutting_down
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rdx, str.agent_listen_loop
mov qword [rsp + 0x28], rbx
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agent_agent.c
mov r8d, 0x96
mov dword [rsp + 0x20], 5
call fcn.14001ae20
mov rcx, qword [0x1400842f8]
test rcx, rcx
je 0x140001ddf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140084320]
cmp rcx, 0xffffffffffffffff
je 0x140001df2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140084300]
test rcx, rcx
je 0x140001e04
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x20108]
mov r12, qword [rsp + 0x20140]
mov rdi, qword [rsp + 0x20138]
mov rsi, qword [rsp + 0x20130]
mov r15, qword [rsp + 0x20100]
mov rcx, qword [rbp + 0x1fff0]
xor rcx, rsp
call fcn.1400313f0
add rsp, 0x20110
pop r14
pop rbx
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
xor ebx, ebx
xor r9d, r9d
lea rdx, str.agent_listen_loop
lea rax, str.cannot_convert_sddl_ERROR:_d
mov r8d, WSAStartup
mov qword [rsp + 0x30], rax
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agent_agent.c
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 1
call fcn.14001aa60
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
xor r9d, r9d
mov dword [rsp + 0x38], edi
lea rdx, str.agent_listen_loop
lea rax, str.wait_on_events_ended_with__d_ERROR:_d
mov r8d, 0xc2
mov qword [rsp + 0x30], rax
lea rcx, str.C:__w1_scontribwin32win32compat_ssh_agent_agent.c
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 1
call fcn.14001aa60
int3