Get the disassembly from an address

Called when all runs have completed emulation

Create a formatted structure from bytes

Get the current event profiler object (if any)

Add a callback function for a specific event type or address

Create a new IRP

Store binary data and return its artifact reference.

time_t time( time_t *destTime );

Call a WDM driver dispatch function with a supplied IRP

Start emulating at the specified address args: addr: Address to being emulation at params: list of arguments

Create a kernel event object

Get a pointer for a supplied function name, similar to how the "GetProcAddress" API functions.

Get the size of a pointer return: pointer size

Get a PE section by name

Get the current address of the stack pointer

Forward imported functions to the corresponding handler (if any).

Cast an address as an object for easy access args: obj: object to cast into addr: address containing the dat

Begin emulation executing each run in the specified run queue

Get the variable argument list

Set a callback to fire when a memory address is written to args: cb: Callable python function to execute beg

Get command line arguments (if any) that are being passed to the emulated process. (e.g. main(argv))

Get the current offset (or size) of the PE

Get the file emulation manager

Get the full filesystem path of a default decoy that is supplied by speakeasy

Get the network emulation manager

If the supplied address is related to a known symbol, look it up here

Turn bytes from an emulated memory pointer into an object

Get a pipe object from a handle

Stops emulation

Append data to the decoy PE

Create a registry key

Create a process object that will exist in the emulator

Set the emulation state after a call has completed

Get the drive manager

Get the version of the emulator

Get the current value in the return register

Get the current thread CPU context

Map a block of memory with specified permissions and a tag