I am using speakeasy to run emulate with a dll.
The input exe is winapiexec, downloaded at https://github.com/m417z/winapiexec
The parameter is:
speakeasy.py -t winapiexec.exe -p malware.bin@exportApi -a x86.....
winapiexec.exe was loaded, but when it parse cmdlines has been transfer, it only always get from file config json, at line:
"command_line": "C:\\Windows\\system32\\svchost.exe arg1 arg2"