pub unsafe extern "C" fn yr_rules_scan_mem(
    rules: *mut YR_RULES,
    buffer: *const u8,
    buffer_size: size_t,
    flags: c_int,
    callback: YR_CALLBACK_FUNC,
    user_data: *mut c_void,
    timeout: c_int
) -> c_int