Function at 0x40edb0
Capabilities:
Check for unexpected memory writes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x440008]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor esi, esi
push 4
push 0x3000
push 0x4000
push esi
call edi
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x40ee0a
push 4
push 0x203000
push 0x1000000
push esi
call edi
mov edi, eax
test edi, edi
jne 0x40ee32
push 0x8000
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.VirtualAlloc_failed._Last_error:__u_n
call fcn.00409df0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0041396d
mov esp, ebp
pop ebp
ret
push 1
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
test eax, eax
je 0x40ee53
push str.GlobalGetAtomName_succeeded_when_it_shouldve_failed..._not_sure_what_happened__n
call fcn.00409df0
add esp, 4
mov esi, 1
push 0x1000000
push edi
push str._ThisIsAnInvalidEnvironmentVariableName_________:__
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40ee7a
push str.GetEnvironmentVariable_succeeded_when_it_shouldve_failed..._not_sure_what_happened__n
call fcn.00409df0
add esp, 4
mov esi, 1
push edi
push str._ThisIsAnInvalidFileName_________:__
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
test eax, eax
je 0x40ee9c
push str.GetBinaryType_succeeded_when_it_shouldve_failed..._not_sure_what_happened__n
call fcn.00409df0
add esp, 4
mov esi, 1
push 0
push 0x1000
push edi
push 0x45
push 0
call dword [sym.imp.KERNEL32.dll_HeapQueryInformation]
test eax, eax
je 0x40eec4
push str.HeapQueryInformation_succeeded_when_it_shouldve_failed..._not_sure_what_happened__n
call fcn.00409df0
add esp, 4
mov esi, 1
push 0
push 0x1000
push edi
push 0x69696969
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x40eeef
push str.ReadProcessMemory_succeeded_when_it_shouldve_failed..._not_sure_what_happened__n
call fcn.00409df0
add esp, 4
mov esi, 1
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x40ef0e
push str.GetThreadContext_succeeded_when_it_shouldve_failed..._not_sure_what_happened__n
call fcn.00409df0
add esp, 4
mov esi, 1
push edi
push 0
push 0
push 0
push fcn.0040edb0
push 0
call dword [sym.imp.KERNEL32.dll_GetWriteWatch]
test eax, eax
jne 0x40ef73
push str.GetWriteWatch_succeeded_when_it_shouldve_failed..._not_sure_what_happened__n
call fcn.00409df0
add esp, 4
push str.Write_watch_API_check_skipped__ignore_the_result_as_it_is_inconclusive._n
call fcn.00409df0
add esp, 4
xor ebx, ebx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x8000
push 0
push dword [esp + 0x18]
call esi
push 0x8000
push 0
push edi
call esi
mov ecx, dword [esp + 0x1c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041396d
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x40ef33
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0x1000
push eax
lea eax, [esp + 0x18]
push eax
push ebx
push 0x1000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetWriteWatch]
test eax, eax
je 0x40efb1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetWriteWatch_failed._Last_error:__u_n
call fcn.00409df0
add esp, 8
jmp 0x40ef40
xor ebx, ebx
cmp dword [esp + 0x14], ebx
setne bl
jmp 0x40ef42