CLR is the entrypoint for Jobs that are processed to determine which CLR function should be executed.

CreateProcess spawns a child process with anonymous pipes, executes shellcode in it, and returns the output from the executed shellcode.

Download receives a job from the server to download a file to host where the Agent is running.

ExecuteCommand runs the provided input program and arguments, returning results in a message base.

ExecuteShellcode instructs the agent to load and run shellcode according to the input job.

ExecuteShellcodeCreateProcessWithPipe creates a child process, redirects STDOUT/STDERR to an anonymous pipe, injects/executes shellcode, and retrieves outputlint:ignore SA4009 Function needs to mirror exec_windows.go and inputs must be used.

ExecuteShellcodeQueueUserAPC executes provided shellcode in the provided target process using the Windows QueueUserAPC API calllint:ignore SA4009 Function needs to mirror exec_windows.go and inputs must be used.

ExecuteShellcodeRemote executes provided shellcode in the provided target processlint:ignore SA4009 Function needs to mirror exec_windows.go and inputs must be used.

ExecuteShellcodeRtlCreateUserThread executes provided shellcode in the provided target process using the Windows RtlCreateUserThread calllint:ignore SA4009 Function needs to mirror exec_windows.go and inputs must be used.

ExecuteShellcodeSelf executes provided shellcode in the current processlint:ignore SA4009 Function needs to mirror exec_windows.go and inputs must be used.

Memfd places a linux executable file in-memory, executes it, and returns the results Uses the linux memfd_create API call to create an anonymous file https://man7.org/linux/man-pages/man2/memfd_create.2.html http://manpages.ubuntu.com/manpages/bionic/man2/memfd_create.2.html.

MiniDump is the top-level function used to receive a job and subsequently execute a Windows memory dump on the target process The function returns the memory dump as a file upload to the server.

Native executes a golang native command that does not use any executables on the host.

Upload receives a job from the server to upload a file from the host to the Merlin server.