Put a value on the stack and adjust the stack pointer args: val: value to push to the stack return:

void GetSystemTimeAsFileTime( LPFILETIME lpSystemTimeAsFileTime );

Based on the PE metadata, use the appropriate emulator. That is, a user mode emulator vs a kernel mode emulator

Lazily add hooks if users added them early before emulator engine was instantiated

Return 'module+0xoffset' string for an address inside a loaded module, or None.

Set the top level dispatch hook for dynamic code execution

Add top level profiler fields containing metadata for the module that will be emulated

Get a callback for software interrupts args: cb: Callable python function to execute return: Hook ob

Get a callback for when a memory access violation occurs args: cb: Callable python function to execute return:

Set a callback to fire when a memory address is read from args: cb: Callable python function to execute begi

Parse *volume_specs* and prepend the resulting file entries to *config*. Entries are prepended so they win first-match resolution in ``get_em

Create a device object to use for kernel emulation

Create a driver object for the driver that is going to be emulated

Get the "MemMap" object associated with a specific address

Get the path of the current directory

Get COM interface

Get the current regions of mapped memory

If the supplied address belongs to a module, return it

Get the human readable OS version string

Get the current state of registers from the emulator

Check the configuration file so see if there is a handler for the current WinInet request

Get the time spent emulating a specific "run"

Based on the emulation config, determine what data to return from the read request

Load a module by name using the appropriate loader. Priority: native PE file -> API handler (JIT PE) -> placeholder stub.

Load a shellcode blob into emulation space args: fpath: file path containing shellcode blob arch: Architectu

Change the memory protections for pages in the emu engine

Free memory in the cpu engine

Append raw bytes to an existing artifact payload and store the merged result.

Run a previously loaded shellcode blob by address args: sc_addr: address of the previously loaded shellcode blog to emul

Get the start time for a sample so we can time the execution length

For APIs that call functions, we will setup the stack to make this flow naturally.

SOCKET WSAAPI socket( int af, int type, int protocol );

Decode GDB RSP run-length encoding. x*N means: one explicit x, then (ord(N)-29) additional copies.

Execute the next run from the emulation queue