Function at 0x140001720
Capabilities:
Connect pipe
Create pipe
Create process on windows

Disassembly:
push rbx
push rsi
mov eax, 0x20118
call fcn.1400307f0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x200f0], rax
mov rax, qword [0x14006e288]
lea rsi, [0x14006e2b0]
mov qword [rsp + 0x58], rax
lea r8, [0x14006e2b8]
mov rax, qword [0x14006e2a8]
lea rcx, str.D:P_A__GA___SY__A__GA___BA__A__0x12019b___AU_
mov qword [rsp + 0x60], rax
mov r9, rsi
xor eax, eax
mov qword [0x14006e2b0], rax
mov qword [0x14006e2b8], rax
mov qword [0x14006e2c0], rax
lea edx, [rax + 1]
mov dword [0x14006e2b0], 0x18
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x140001bf3
mov qword [rsp + 0x20130], rbp
xor ebx, ebx
mov qword [rsp + 0x20138], rdi
lea rbp, str.ConnectNamedPipe_returned_TRUE_unexpectedly
mov qword [rsp + 0x20140], r12
lea r12, str.ConnectNamedPipe_failed_ERROR:__d
mov qword [rsp + 0x20110], r13
lea r13, str.client_pid__d_connected
mov qword [rsp + 0x20108], r14
lea r14, str.Client_has_already_connected
mov qword [rsp + 0x20100], r15
lea r15, str.cannot_create_listener_pipe_ERROR:_d
mov dword [0x14006e2c0], ebx
nop
mov qword [rsp + 0x38], rsi
lea rcx, str..pipeopenssh_ssh_agent
mov dword [rsp + 0x30], ebx
mov r9d, 0xff
mov dword [rsp + 0x28], 0x1400
xor r8d, r8d
mov edx, 0x40000003
mov dword [rsp + 0x20], 0x1400
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [0x14006e2c8], rax
cmp rax, 0xffffffffffffffff
jne 0x140001879
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
xor r9d, r9d
mov qword [rsp + 0x30], r15
lea rdx, str.agent_listen_loop
mov qword [rsp + 0x28], rbx
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent.c
mov dword [rsp + 0x20], 4
lea r8d, [r9 + 0x75]
call fcn.140008ef0
jmp 0x1400018b9
lea rdx, [0x14006e290]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x1400018c6
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
lea rdx, str.agent_listen_loop
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent.c
mov dword [rsp + 0x20], 4
lea r8d, [r9 + 0x78]
call fcn.140008ef0
mov rcx, qword [0x14006e288]
call qword [sym.imp.KERNEL32.dll_SetEvent]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x140001908
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rbx
lea rdx, str.agent_listen_loop
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent.c
mov dword [rsp + 0x20], 5
lea r8d, [r9 + 0x7d]
call fcn.140008ef0
mov rcx, qword [0x14006e2a8]
jmp 0x140001954
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x14000195a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
xor r9d, r9d
mov qword [rsp + 0x30], r12
lea rdx, str.agent_listen_loop
mov qword [rsp + 0x28], rbx
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent.c
mov r8d, 0x80
mov dword [rsp + 0x20], 5
call fcn.140008ef0
mov rcx, qword [0x14006e288]
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor r8d, r8d
lea rdx, [rsp + 0x58]
or r9d, 0xffffffff
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edi, eax
test eax, eax
je 0x140001b6f
lea ecx, [rax - 1]
test ecx, ecx
jne 0x140001c33
mov rdi, qword [0x14006e2c8]
lea rdx, [rsp + 0x50]
mov rcx, rdi
mov dword [rsp + 0x50], ebx
mov qword [0x14006e2c8], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientProcessId]
mov eax, dword [rsp + 0x50]
lea rdx, str.agent_listen_loop
mov dword [rsp + 0x38], eax
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent.c
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov qword [rsp + 0x28], rbx
mov r8d, 0x90
mov dword [rsp + 0x20], 4
call fcn.140008ef0
cmp dword [0x14005e140], ebx
jne 0x140001b65
xor edx, edx
lea rcx, [rsp + 0x80]
lea r8d, [rdx + 0x68]
call fcn.14001a770
mov r8d, 0x8000
lea rdx, [rsp + 0xf0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 1
mov rcx, rdi
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea r9, [rsp + 0xf0]
mov dword [rsp + 0x20], edi
lea r8, str._s__d
mov edx, 0x8000
lea rcx, [rsp + 0x100f0]
call fcn.140001590
cmp eax, 0xffffffff
je 0x140001afb
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x100f0]
lea rax, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140001afb
mov eax, dword [rsp + 0x50]
lea rdx, str.agent_listen_loop
mov dword [rsp + 0x40], eax
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent.c
mov eax, dword [rsp + 0x78]
xor r9d, r9d
mov dword [rsp + 0x38], eax
mov r8d, 0xa5
lea rax, str.spawned_worker__d_for_agent_client_pid__d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 5
call fcn.140008ef0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001b47
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
xor r9d, r9d
mov r8d, 0xa3
lea rdx, str.agent_listen_loop
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x38], rax
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent.c
lea rax, str.Failed_to_create_child_process__ls_ERROR:_d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 4
call fcn.140008ef0
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001800
mov rcx, rdi
call fcn.1400022d0
jmp 0x140001ba4
lea rax, str.shutting_down
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rdx, str.agent_listen_loop
mov qword [rsp + 0x28], rbx
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent.c
mov r8d, 0x87
mov dword [rsp + 0x20], 5
call fcn.140008ef0
call fcn.1400015f0
mov r14, qword [rsp + 0x20108]
mov r13, qword [rsp + 0x20110]
mov r12, qword [rsp + 0x20140]
mov rdi, qword [rsp + 0x20138]
mov rbp, qword [rsp + 0x20130]
mov r15, qword [rsp + 0x20100]
mov rcx, qword [rsp + 0x200f0]
xor rcx, rsp
call fcn.140018df0
add rsp, 0x20118
pop rsi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
xor ebx, ebx
xor r9d, r9d
lea rdx, str.agent_listen_loop
lea rax, str.cannot_convert_sddl_ERROR:_d
mov qword [rsp + 0x30], rax
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent.c
mov qword [rsp + 0x28], rbx
lea r8d, [rbx + 0x63]
mov dword [rsp + 0x20], 1
call fcn.140008b00
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
xor r9d, r9d
mov dword [rsp + 0x38], edi
lea rdx, str.agent_listen_loop
lea rax, str.wait_on_events_ended_with__d_ERROR:_d
mov r8d, 0xae
mov qword [rsp + 0x30], rax
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent.c
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 1
call fcn.140008b00
int3