emulate_binary
Emulates a Windows binary (exe/dll) to capture every API call with arguments and return values, returning a structured trace for analysis.
Instructions
Run path under Speakeasy and return a structured per-API trace.
Speakeasy is a Windows API emulator — it loads the .exe / .dll in-process and serves the same Win32 surface that Windows would, but in pure Python. The trace captures every API call the binary makes (CreateFileW, RegOpenKeyExW, NtCreateFile, etc.) with arguments + return values.
Args: path: Windows .exe / .dll to emulate timeout_s: wall-clock budget (default 60s; binaries that loop or call Sleep(INFINITE) can hang the emulator)
Returns::
{"path": "...",
"trace": [
{"api": "CreateFileW", "args": [...], "return": "...",
"timestamp_ns": N, "module": "kernel32"},
...
],
"summary": {"api_count": N, "unique_apis": [...],
"files_accessed": [...], "registry_keys": [...],
"processes_spawned": [...], "network_calls": [...]}}On a missing helper, returns {"status": "WARN", "error":
"speakeasy-cli not installed", ...} so the agent knows to
retry after install.sh.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| timeout_s | No |