Set the last error code for the current thread

Based on the API name, determine the character width being used by the function

Update the raw data associated with a decoy PE

Allocate memory in the cpu engine

Modify register values

Read register values

Adds a callback to the emulation callback list. A "callback" in this context refers to a function that in not imported statically or

Get the architecture of the emulator return: emulator architecture constant value

Get the arguments for a function given the supplied calling convention

Get the current process that is emulating

Get the value of the current program counter return: value of the program counter

Load a module into the speakeasy emulator. args: path: file path to PE module data: bytes object containing

Get the address mapping object associated with the specified address args: addr: Address in the emulation space

Retrieve a valid address range that can satisfy the requested size. Optionally, a base address can be specified to test if it can be

Set a callback to fire when a specified API is called during emulation args: cb: Callable python function to execute

Get the current emulated architecture

Run a previously loaded module through the configured emulator args: module: The module whose entry point to be run

Closes the emulation instance and releases underlying engine resources. Removes all Unicorn hooks so the native engine can be safely

Format a string similar to msvcrt.printf

Get the number of arguments in the variable argument list

Read a value from an emulated cpu register

Get the current thread that is emulating

Write a value to an emulated cpu register

Read bytes from a memory address args: addr: address to read bytes from size: number of bytes to read

Write bytes to a memory address args: addr: address to write bytes to data: data to write return:

Set the value of the current program counter args: addr: address to set the program counter to return:

Collect emulator state information in the event of an error.

Get the current run that is being emulated

Get the pointer size of the current emulation state

Get the emulation report from the emulator return: Get the emulation report as a Pydantic Report model

Add a run to the emulation run queue

Convert the structure to bytes and respecting endianness

Get all memory maps in the emulation space return: A list of all valid memory maps from the emulator

Clean up after a run completes (implemented in the child class) since this may mean different things depending. This function will po

Arguments: se_obj: speakeasy emulator object emu_eng: emulation engine object cb: Python callback functio

Get the crypto manager

Set a callback to fire for every CPU instruction that is emulated args: cb: Callable python function to execute

Given a search pattern like ``C:\\*`` or ``C:\\Windows\\*.exe``, yield ``(name, is_dir)`` tuples for immediate children that match,

Returns the value stored at the top of the stack return: value stored at the top of the stack

Get the current address of the stack pointer return: address of stack pointer

Was this address previously reserved or mapped? args: address: address to check return: True if add

Set the arguments before an emulated function call. This is how we pass arguments to a function when calling it through the emulator.

Get the size of the C structure