Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
PEsieve_report PESIEVE_API_FUNC PESieve_scan_ex(IN const PEsieve_params *args, IN const PEsieve_rtype rtype, OUT char *json_buf, IN size_t json_buf_size, OUT size_t *buf_needed_size)
Performs a PE-sieve scan with a supplied set of parameters (defined as a structure t_params)....