Function at 0x1400032b0
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Get explorer pid
Get file size
Read file on windows
Resume thread
Spoof parent pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x910
mov rax, qword [0x140022008]
xor rax, rsp
mov qword [rsp + 0x900], rax
lea rcx, str.CAPE_loader._n
call fcn.1400011f0
call fcn.140007b9c
cmp dword [rax], 2
jge 0x1400032f3
lea rcx, str.Loader:_Error___too_few_arguments__n
jmp 0x140003342
xor edi, edi
mov qword [rsp + 0x60], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x60]
lea edx, [rdi + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000333b
lea r8, [rsp + 0xf0]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x60]
test eax, eax
jne 0x14000336e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Loader:_Error___unable_to_obtain_debug_privileges._n
call fcn.1400011f0
xor eax, eax
mov rcx, qword [rsp + 0x900]
xor rcx, rsp
call fcn.140003c30
lea r11, [rsp + 0x910]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov dword [rsp + 0x68], 1
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x6c], rax
mov dword [rsp + 0x74], 2
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov r9d, 0x10
lea r8, [rsp + 0x68]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x14000333b
call fcn.140007ba4
mov rcx, qword [rax]
mov rdx, rdi
mov r8, qword [rcx + 8]
lea rcx, str.rinject
nop
movzx eax, byte [r8 + rdx]
inc rdx
cmp al, byte [rcx + rdx - 1]
jne 0x1400034cf
cmp rdx, 8
jne 0x1400033d0
call fcn.140007b9c
cmp dword [rax], 4
jge 0x14000340a
call fcn.140007b9c
mov edx, dword [rax]
lea rcx, str.Loader:_Error___too_few_arguments_for_injection___d__n
call fcn.1400011f0
jmp 0x140003347
call fcn.140007ba4
mov rcx, qword [rax]
mov rcx, qword [rcx + 0x10]
call fcn.140007ea8
mov ebx, eax
call fcn.140007ba4
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x18]
mov rdx, rdi
mov ecx, ebx
call fcn.140001540
test eax, eax
jne 0x140003445
mov edx, ebx
lea rcx, str.Loader:_Failed_to_load_config_for_process__d._n
call fcn.1400011f0
mov r8, rdi
mov edx, ebx
lea rcx, str.Loader:_Injecting_process__d_with__s._n
call fcn.1400011f0
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x14000347f
lea rcx, str.Failed_to_open_process
call fcn.140001320
jmp 0x140003347
call fcn.140007ba4
mov rdx, qword [rax]
mov rdx, qword [rdx + 0x18]
mov rcx, rbx
call fcn.140001ec0
mov edi, eax
test eax, eax
je 0x1400034a7
call fcn.140007ba4
lea rcx, str.Successfully_injected_DLL__s._n
jmp 0x1400034b3
call fcn.140007ba4
lea rcx, str.Failed_to_inject_DLL__s._n
mov rdx, qword [rax]
mov rdx, qword [rdx + 0x18]
call fcn.1400011f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x140003349
call fcn.140007ba4
mov rcx, qword [rax]
mov rdx, rdi
mov r8, qword [rcx + 8]
lea rcx, str.inject
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
inc rdx
cmp al, byte [rcx + rdx - 1]
jne 0x1400035dd
cmp rdx, 7
jne 0x1400034f0
call fcn.140007b9c
cmp dword [rax], 5
jl 0x1400033f2
call fcn.140007ba4
mov rcx, qword [rax]
mov rcx, qword [rcx + 0x10]
call fcn.140007ea8
mov ebx, eax
call fcn.140007ba4
mov rcx, qword [rax]
mov rcx, qword [rcx + 0x18]
call fcn.140007ea8
mov esi, eax
call fcn.140007ba4
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x20]
mov rdx, rdi
mov ecx, ebx
call fcn.140001540
test eax, eax
jne 0x140003564
mov edx, ebx
lea rcx, str.Loader:_Failed_to_load_config_for_process__d._n
call fcn.1400011f0
mov edx, ebx
test esi, esi
je 0x14000357e
mov r9, rdi
mov r8d, esi
lea rcx, str.Loader:_Injecting_process__d__thread__d__with__s._n
call fcn.1400011f0
jmp 0x14000358d
mov r8, rdi
lea rcx, str.Loader:_Injecting_process__d_with__s._n
call fcn.1400011f0
mov r8, rdi
mov edx, esi
mov ecx, ebx
call fcn.140002c30
mov ebx, eax
test eax, eax
js 0x1400035be
call fcn.140007ba4
lea rcx, str.Successfully_injected_DLL__s._n
mov rdx, qword [rax]
mov rdx, qword [rdx + 0x20]
call fcn.1400011f0
mov eax, ebx
jmp 0x140003349
call fcn.140007ba4
lea rcx, str.Failed_to_inject_DLL__s._n
mov rdx, qword [rax]
mov rdx, qword [rdx + 0x20]
call fcn.1400011f0
mov eax, ebx
jmp 0x140003349
call fcn.140007ba4
mov rcx, qword [rax]
mov rdx, rdi
mov r8, qword [rcx + 8]
lea rcx, str.load
movzx eax, byte [r8 + rdx]
inc rdx
cmp al, byte [rcx + rdx - 1]
jne 0x1400039e1
cmp rdx, 5
jne 0x1400035f3
mov dword [rsp + 0x58], edi
mov qword [rsp + 0xf0], rdi
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x88]
call fcn.140004c80
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x100], dil
call fcn.140007ba4
mov rcx, qword [rax]
cmp qword [rcx + 0x20], rdi
je 0x1400036b6
call fcn.140007ba4
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x20]
mov rsi, 0xffffffffffffffff
mov rax, rsi
nop
inc rax
cmp byte [rdx + rax], dil
jne 0x140003660
test rax, rax
je 0x1400036bd
call fcn.140007ba4
mov r8, qword [rax]
mov r8, qword [r8 + 0x18]
lea rcx, [rsp + 0x100]
call fcn.140001140
lea r8, [0x14001f5fc]
lea rcx, [rsp + 0x100]
call fcn.140001140
call fcn.140007ba4
mov r8, qword [rax]
mov r8, qword [r8 + 0x20]
lea rcx, [rsp + 0x100]
call fcn.140001140
jmp 0x1400036f1
mov rsi, 0xffffffffffffffff
call fcn.140007ba4
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x18]
call fcn.140007ba4
mov r8, rsi
inc r8
cmp byte [rbx + r8], dil
jne 0x1400036d1
inc r8
mov rdx, qword [rax]
mov rdx, qword [rdx + 0x18]
lea rcx, [rsp + 0x100]
call fcn.140007a10
call fcn.140007ba4
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x10]
call fcn.140007ba4
mov rdx, qword [rax]
mov r9, rbx
lea r8, [rsp + 0x100]
mov rdx, qword [rdx + 0x18]
lea rcx, str.Loader:_Loading__s___s__with_DLL__s._n
call fcn.1400011f0
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x80]
call fcn.140004c80
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
call fcn.140007ba4
mov rdx, qword [rax]
lea r8, [rsp + 0x100]
mov rdx, qword [rdx + 0x18]
lea rcx, str.Loader:_Executing__s___s_._n
call fcn.1400011f0
lea r9, [rsp + 0xf0]
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, qword [rsp + 0xf0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x1400037ad
lea rcx, str.Loader:_HeapAlloc_error
call fcn.140001320
jmp 0x140003347
lea r9, [rsp + 0xf0]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x1400037da
lea rcx, str.Loader:_InitializeProcThreadAttributeList_error
call fcn.140001320
jmp 0x140003347
call qword [sym.imp.USER32.dll_GetShellWindow]
mov rcx, rax
lea rdx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x14000381b
lea rcx, str.Loader:_OpenProcess_error
call fcn.140001320
jmp 0x140003347
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 8
lea r9, [rsp + 0x60]
xor edx, edx
mov r8d, 0x20000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x140003859
lea rcx, str.Loader:_UpdateProcThreadAttribute_error
call fcn.140001320
jmp 0x140003347
mov qword [rsp + 0xe8], rbx
call fcn.140007ba4
mov rcx, qword [rax]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x4080004
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x100]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400038c3
lea rcx, str.Loader:_CreateProcess_error
call fcn.140001320
jmp 0x140003347
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x78], edi
jne 0x1400038fa
call fcn.140007ba4
mov rdx, qword [rax]
mov rdx, qword [rdx + 0x18]
lea rcx, str.Loader:_Failed_to_execute__s._n
call fcn.1400011f0
jmp 0x140003347
call fcn.140007ba4
mov rdx, qword [rax]
mov rdx, qword [rdx + 0x10]
mov ecx, dword [rsp + 0x78]
call fcn.140001540
test eax, eax
jne 0x140003923
mov edx, dword [rsp + 0x78]
lea rcx, str.Loader:_Failed_to_load_config_for_process__d._n
call fcn.1400011f0
call fcn.140007ba4
mov r8, qword [rax]
mov r8, qword [r8 + 0x10]
mov edx, dword [rsp + 0x7c]
mov ecx, dword [rsp + 0x78]
call fcn.140002c30
test eax, eax
je 0x14000394e
call fcn.140007ba4
lea rcx, str.Successfully_injected_DLL__s._n
jmp 0x14000395a
call fcn.140007ba4
lea rcx, str.Failed_to_inject_DLL__s._n
mov rdx, qword [rax]
mov rdx, qword [rdx + 0x10]
call fcn.1400011f0
mov r8d, dword [rsp + 0x7c]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x140003992
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400039aa
call fcn.140007ba4
mov rdx, qword [rax]
mov rdx, qword [rdx + 0x18]
lea rcx, str.There_was_a_problem_resuming_the_new_process__s._n
call fcn.1400011f0
lea rbx, [0x140023c00]
inc rsi
cmp byte [rbx + rsi], dil
jne 0x1400039b1
test rsi, rsi
jne 0x1400039c8
mov eax, dword [rsp + 0x78]
jmp 0x140003349
call fcn.140007ba4
mov rdx, qword [rax]
mov rdx, qword [rdx + 0x10]
mov rcx, rbx
call fcn.140003080
jmp 0x140003349
call fcn.140007ba4
mov rcx, qword [rax]
lea rdx, str.shellcode
mov rcx, qword [rcx + 8]
call fcn.140015170
test eax, eax
jne 0x140003bc2
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x58], edi
call fcn.140007ba4
mov rcx, qword [rax]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
mov qword [rsp + 0x68], rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140003bb1
lea rdx, [rsp + 0xf0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140003a78
lea rcx, str.Error_getting_file_size
call fcn.140001320
jmp 0x140003347
cmp dword [rsp + 0xf4], edi
je 0x140003a8d
lea rcx, str.Input_file_is_too_big_._n
jmp 0x140003342
mov edx, dword [rsp + 0xf0]
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x140003abf
lea rcx, str.Error_allocating_memory_for_file_buffer._n
jmp 0x140003342
mov r8d, dword [rsp + 0xf0]
xor edx, edx
mov rcx, rbx
call fcn.140004c80
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x60]
mov r8d, dword [rsp + 0xf0]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140003aff
lea rcx, str.ReadFile_error_on_input_file._n
jmp 0x140003342
call fcn.140007b9c
cmp dword [rax], 4
jle 0x140003b61
call fcn.140007ba4
mov rcx, qword [rax]
mov r8d, 2
lea rdx, [0x14001f808]
mov rcx, qword [rcx + 0x18]
call fcn.140007bf4
test eax, eax
jne 0x140003b45
mov rcx, rbx
call fcn.1400017d0
test rax, rax
je 0x140003b45
mov rcx, rbx
call fcn.1400017d0
mov edi, dword [rax + 0x28]
jmp 0x140003b5d
call fcn.140007ba4
mov rcx, qword [rax]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0x18]
call fcn.140005eb0
mov edi, eax
mov dword [rsp + 0x58], edi
mov edi, edi
add rdi, rbx
call rdi
mov rdx, rdi
lea rcx, str.Successfully_executed_payload_at_0x_p._n
call fcn.1400011f0
jmp 0x140003b96
mov rcx, rbx
call fcn.140007ea0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140003349
lea rcx, str.Error_opening_input_file
call fcn.140001320
jmp 0x140003347
call fcn.140007ba4
mov rcx, qword [rax]
mov rdx, qword [rcx + 8]
lea rcx, str.pipe
movzx eax, byte [rdx + rdi]
inc rdi
cmp al, byte [rcx + rdi - 1]
jne 0x140003347
cmp rdi, 5
jne 0x140003bd5
call fcn.140007ba4
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x18]
call fcn.140007ba4
mov rcx, qword [rax]
mov rdx, rbx
mov rcx, qword [rcx + 0x10]
call fcn.140003080
jmp 0x140003349