FLARE-VM is a collection of PowerShell and Python scripts for automating the setup of a Windows-based reverse engineering virtual machine. The core installer (`install.ps1`) uses Chocolatey and Boxstarter to deploy a curated set of malware analysis tools, configure environment variables, registry settings, and taskbar layout. It provides both a GUI and CLI mode for package selection. The repository also includes a set of VirtualBox helper scripts (`virtualbox/`) for building, exporting, and cleaning VM snapshots, as well as monitoring network adapter status. These scripts are well-structured and can be reused independently for VirtualBox automation. The project is actively maintained by Mandiant (Google) and serves the malware analysis community.

Speakeasy is a Windows malware emulation framework developed by Mandiant (FireEye). It executes Windows PE executables, DLLs, drivers, and shellcode in a fully emulated Windows environment, intercepting API calls via a large set of stub handlers that model kernel32, ntdll, ws2_32, user32, ntoskrnl, and many other DLLs. The emulation is powered by Unicorn (CPU emulation) and Capstone (disassembly). It provides both a CLI tool (`speakeasy`) and a Python library (`Speakeasy` class) for programmatic use. Key features include: user-mode and kernel-mode emulation, GDB remote debugging support, configurable file system, registry, network, and process models, SEH handling, API hammering detection, and structured JSON reports with profiling events, memory captures, and artifact deduplication. The architecture is a monolithic Python package with a core emulator class, platform-specific emulators (Win32Emulator, WinKernelEmulator), and a large set of API handler modules organized by DLL. Dependencies include unicorn, capstone, pefile, pydantic, rich, and pyelftools. The project is primarily used for automated malware analysis and reverse engineering.