Retrieves the exception handler list for the current thread

Imports are patched with invalid memory addresses. When the API is called by the emulated binary, the invalid memory fetch callback w

Prepare CPU and memory state for the given run without starting emulation.

Unmap reserved memory space so we can handle events (e.g. import APIs, entry point returns, etc.)

Set up the GDT so we can access segment registers correctly This will be done a little differently depending on architecture

Add a hook that will fire for IN, SYSCALL, or SYSENTER instructions

Add a section to the decoy PE

Add a vectored exception handler that will be executed on an exception

Allocate memory for the Process Environment Block (PEB)

Allocate memory to use for the program stack

int bind( SOCKET s, const sockaddr *addr, int namelen );

Create a formatted structure from bytes

Get a section from a given offset

Adjust the stack for arguments that were supplied

int WSAAPI connect( SOCKET s, const sockaddr *name, int namelen );

Create a kernel mutant object

Dereferece an object and remove it from the object manager when its reference count is 0

Disassemble bytes at a specified address

Delete a file

Get the tag for a supplied memory address

Get all ansi strings from a supplied memory blob

If an API hook has been set, return it here

Retrieve the execution profile for the emulator as a json string

Get the kernel image module

See if the emulator config file contains a handler for the requested registry path

Get the last error code for the current thread

Get ansi and unicode strings from emulated memory

Get ctypes value for the required pointer size

Get registry key by path or handle args: handle: handle corresponding for a registry key path: Path to a reg

Retrieve the execution profile for the emulator

Get the session manager for the emulator. This will manage things like desktops, windows, and session isolation

Get the current stack state

Get the process object for the system process (PID 4)

Get all unicode strings from a supplied memory blob

Data that is imported (e.g. KeTickCount) is handled with a initializer function. Call it here if there is a handler for the imported

Create a process to be used to host shellcode or DLLs

Set the current thread CPU context

Map a previously reserved block of memory

Free a block of emulated memory

This function attempts to fold as many function handlers together as possible. For example, ntdll functions will be handled by the nt

Convert registry values to python types

Parse a ``host_path:guest_path`` volume specification. Handles Windows drive-letter colons on both sides (e.g. ``C:\\samples:C:\\guest``). T