Speakeasy is Mandiant's Windows binary emulation framework for dynamic malware analysis and reverse engineering. It uses the Unicorn CPU emulator to execute x86/x64 Windows PE executables, DLLs, kernel drivers, and raw shellcode in a virtualized Windows environment, with Capstone for disassembly and pefile for PE parsing. Instead of booting a real OS, the framework intercepts hundreds of hand-written API handlers from user-mode and kernel-mode DLLs (kernel32, ntdll, ws2_32, ntoskrnl, etc.) and falls back to signature-derived emulation for unknown APIs using metadata generated from Microsoft win32metadata and phnt headers. It captures system calls, file/registry/network activity, memory access patterns, dynamic code execution, and dropped-file artifacts, then emits structured JSON behavioral reports for downstream triage. The architecture centers on a BinaryEmulator core layered over Unicorn, specialized into user-mode (Win32Emulator) and kernel-mode (WinKernelEmulator) subclasses. The public interface is the Speakeasy library class, which offers module loading, shellcode execution, hook registration, and report generation, plus a CLI (speakeasy -t target) that exposes a rich set of execution, environment, and network controls. A notable feature is a built-in GDB Remote Serial Protocol server that allows interactive debugging with standard GDB clients or IDA Pro, including breakpoints, watchpoints, register/memory access, and stepping. The emulator also builds synthetic PE modules backed by real Windows DLL export manifests (Windows 10 26100-era snapshots) and uses a handle allocator to model processes, threads, files, and registry keys. Although classified as an application, the repository ships data-like assets and reusable machinery: per-architecture export manifests for over 100 Windows DLLs, generated signature databases, a pointer-size-aware ctypes structure factory, a SHA-256 deduplicating artifact store, and an independent API argument formatter. These components are suitable for extraction into other binary-analysis, reverse-engineering, or sandbox-reporting projects. The test suite is extensive (150+ tests) and includes compressed real-world binaries, a PE builder, and declarative Practical Malware Analysis sample expectations, giving confidence in the emulation harness. The project is versioned at v2.0.0b9 and saw a commit on 2026-10-11, indicating active maintenance. Technical drift is moderate: signature generation depends on external git submodules, export manifests are fixed to a specific Windows build, many API handlers are shallow stubs, x64 table-based SEH is not implemented, and some Unicorn internals are accessed through brittle internal bindings. The config schema and report format are deliberately versioned, so evolution is controlled but breaking changes are possible.