# Functions
CLR is the entrypoint for Jobs that are processed to determine which CLR function should be executed.
CreateProcess spawns a child process with anonymous pipes, executes shellcode in it, and returns the output from the executed shellcode.
Download receives a job from the server to download a file to host where the Agent is running.
ExecuteCommand runs the provided input program and arguments, returning results in a message base.
ExecuteShellcode instructs the agent to load and run shellcode according to the input job.
ExecuteShellcodeCreateProcessWithPipe creates a child process, redirects STDOUT/STDERR to an anonymous pipe, injects/executes shellcode, and retrieves outputlint:ignore SA4009 Function needs to mirror exec_windows.go and inputs must be used.
ExecuteShellcodeQueueUserAPC executes provided shellcode in the provided target process using the Windows QueueUserAPC API calllint:ignore SA4009 Function needs to mirror exec_windows.go and inputs must be used.
ExecuteShellcodeRemote executes provided shellcode in the provided target processlint:ignore SA4009 Function needs to mirror exec_windows.go and inputs must be used.
ExecuteShellcodeRtlCreateUserThread executes provided shellcode in the provided target process using the Windows RtlCreateUserThread calllint:ignore SA4009 Function needs to mirror exec_windows.go and inputs must be used.
ExecuteShellcodeSelf executes provided shellcode in the current processlint:ignore SA4009 Function needs to mirror exec_windows.go and inputs must be used.
Memfd places a linux executable file in-memory, executes it, and returns the results Uses the linux memfd_create API call to create an anonymous file https://man7.org/linux/man-pages/man2/memfd_create.2.html http://manpages.ubuntu.com/manpages/bionic/man2/memfd_create.2.html.
MiniDump is the top-level function used to receive a job and subsequently execute a Windows memory dump on the target process The function returns the memory dump as a file upload to the server.
Native executes a golang native command that does not use any executables on the host.
Upload receives a job from the server to upload a file from the host to the Merlin server.