Function at 0x1400027ad
Capabilities:
Check for unexpected memory writes
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov dword [rbp - 4], 0
mov dword [rbp - 8], 0
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x8000
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000280f
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.VirtualAlloc_failed._Last_error:__lu_n
mov rcx, rax
call sym.printf_1
mov eax, dword [rbp - 4]
jmp 0x140002b16
mov r9d, 4
mov r8d, 0x203000
mov edx, 0x1000000
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x140002876
mov rax, qword [rbp - 0x10]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.VirtualAlloc_failed._Last_error:__lu_n
mov rcx, rax
call sym.printf_1
mov eax, dword [rbp - 4]
jmp 0x140002b16
mov rax, qword [rbp - 0x18]
mov r8d, 1
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
call rax
test eax, eax
je 0x1400028b2
lea rax, str.GlobalGetAtomName_succeeded_when_it_shouldve_failed..._not_sure_what_happened__n
mov rcx, rax
call sym.printf_1
mov dword [rbp - 4], 0
mov dword [rbp - 8], 1
mov rax, qword [rbp - 0x18]
mov r8d, 0x1000000
mov rdx, rax
lea rax, str._ThisIsAnInvalidEnvironmentVariableName_________:__
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call rax
test eax, eax
je 0x1400028f3
lea rax, str.GetEnvironmentVariable_succeeded_when_it_shouldve_failed..._not_sure_what_happened__n
mov rcx, rax
call sym.printf_1
mov dword [rbp - 4], 0
mov dword [rbp - 8], 1
mov rax, qword [rbp - 0x18]
mov rdx, rax
lea rax, str._ThisIsAnInvalidFileName_________:__
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
call rax
test eax, eax
je 0x14000292e
lea rax, str.GetBinaryType_succeeded_when_it_shouldve_failed..._not_sure_what_happened__n
mov rcx, rax
call sym.printf_1
mov dword [rbp - 4], 0
mov dword [rbp - 8], 1
mov rax, qword [rbp - 0x18]
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, rax
mov edx, 0x45
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_HeapQueryInformation]
call rax
test eax, eax
je 0x140002978
lea rax, str.HeapQueryInformation_succeeded_when_it_shouldve_failed..._not_sure_what_happened__n
mov rcx, rax
call sym.printf_1
mov dword [rbp - 4], 0
mov dword [rbp - 8], 1
mov rax, qword [rbp - 0x18]
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, rax
mov edx, 0x69696969
mov rcx, 0xffffffffffffffff
mov rax, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call rax
test eax, eax
je 0x1400029c4
lea rax, str.ReadProcessMemory_succeeded_when_it_shouldve_failed..._not_sure_what_happened__n
mov rcx, rax
call sym.printf_1
mov dword [rbp - 4], 0
mov dword [rbp - 8], 1
mov rax, qword [rbp - 0x18]
mov rdx, rax
mov rcx, 0xffffffffffffffff
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadContext]
call rax
test eax, eax
je 0x1400029fc
lea rax, str.GetThreadContext_succeeded_when_it_shouldve_failed..._not_sure_what_happened__n
mov rcx, rax
call sym.printf_1
mov dword [rbp - 4], 0
mov dword [rbp - 8], 1
mov rax, qword [rbp - 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
lea rax, [sym.VirtualAlloc_WriteWatch_APICalls]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetWriteWatch]
call rax
test eax, eax
jne 0x140002a53
lea rax, str.GetWriteWatch_succeeded_when_it_shouldve_failed..._not_sure_what_happened__n
mov rcx, rax
call sym.printf_1
mov dword [rbp - 4], 0
mov dword [rbp - 8], 1
cmp dword [rbp - 8], 0
jne 0x140002ace
mov qword [rbp - 0x20], 0x1000
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x18]
lea rdx, [rbp - 0x24]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0x1000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetWriteWatch]
call rax
test eax, eax
je 0x140002abc
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.GetWriteWatch_failed._Last_error:__lu_n
mov rcx, rax
call sym.printf_1
mov dword [rbp - 4], 0
jmp 0x140002add
mov rax, qword [rbp - 0x20]
test rax, rax
jne 0x140002add
mov rax, qword [rbp - 0x20]
mov dword [rbp - 4], eax
jmp 0x140002add
lea rax, str.Write_watch_API_check_skipped__ignore_the_result_as_it_is_inconclusive._n
mov rcx, rax
call sym.printf_1
mov rax, qword [rbp - 0x10]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov rax, qword [rbp - 0x18]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov eax, dword [rbp - 4]
add rsp, 0x60
pop rbp
ret