reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/debugging-malware-with-x64dbg/references/api-reference.md

@@ -0,0 +1,43 @@
+# API Reference: Debugging Malware with x64dbg
+
+## Overview
+
+`scripts/analyst.py` generates an x64dbg command script of strategic API breakpoints for a
+chosen goal (unpacking, injection, crypto, network, persistence). The output is a text script
+to load in x64dbg; the tool does not run any process.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | argument handling, text output |
+
+## External tools
+
+| Tool | Purpose |
+|------|---------|
+| x64dbg | Windows user-mode debugging |
+| Scylla (x64dbg plugin) | Dump memory and rebuild import tables when unpacking |
+
+## Core functions
+
+### `build_script(presets)`
+Returns an x64dbg `.txt` script of `bp` commands for the selected presets, de-duplicating APIs
+across presets.
+
+### `PRESETS`
+Maps each analysis goal to the relevant Windows APIs.
+
+## Usage
+
+```bash
+python scripts/analyst.py breakpoints --preset unpacking > bp.txt
+python scripts/analyst.py breakpoints --preset injection --preset crypto > bp.txt
+# in x64dbg: scriptload bp.txt
+```
+
+## Sources
+
+- x64dbg documentation — https://help.x64dbg.com/
+- Windows API reference — https://learn.microsoft.com/windows/win32/api/
+- Common API-breakpoint strategy for manual unpacking (standard RE practice)