Function at 0x140049ae0
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x58], 0xffffffffffffffff
mov ecx, 0x202000
call fcn.1400490b0
mov rcx, qword [0x140098620]
mov rcx, qword [rcx + 0x10]
mov qword [rcx + 0x980], rax
mov rax, qword [0x140098620]
mov rax, qword [rax + 0x10]
cmp qword [rax + 0x980], 0
jne 0x140049b40
mov r8d, 0xef
lea rdx, [0x140076170]
lea rcx, [0x140076190]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140049e54
mov rax, qword [0x140098620]
mov rax, qword [rax + 0x10]
mov rax, qword [rax + 0x980]
mov qword [rsp + 0x20], rax
mov edx, 0x202000
mov rcx, qword [rsp + 0x20]
call fcn.140024220
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + rax + 0x1000]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
sar rax, 0xc
mov ecx, 8
imul rcx, rcx, 0
movabs rdx, 0xfffffffff
and rax, rdx
shl rax, 0xc
mov rdx, qword [rsp + 0x20]
movabs r8, 0xffff000000000fff
mov rcx, qword [rdx + rcx]
and rcx, r8
or rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x20]
mov qword [rdx + rcx], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + rax]
or rax, 1
mov ecx, 8
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x20]
mov qword [rdx + rcx], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + rax]
or rax, 2
mov ecx, 8
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x20]
mov qword [rdx + rcx], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + rax]
or rax, 4
mov ecx, 8
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x20]
mov qword [rdx + rcx], rax
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x40]
or rax, 1
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
or rax, 2
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
or rax, 4
mov qword [rsp + 0x40], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + rax + 0x1000]
mov rdi, rax
mov rax, qword [rsp + 0x40]
mov ecx, 0x200
rep stosq qword [rdi], rax
mov dword [rsp + 0x28], 0
jmp 0x140049cc8
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x200
jge 0x140049d5f
movsxd rax, dword [rsp + 0x28]
imul rax, rax, 0x1000
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + rax + 0x2000]
mov ecx, 8
imul rcx, rcx, 0
add rax, rcx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
sar rax, 0xc
movsxd rcx, dword [rsp + 0x28]
movabs rdx, 0xfffffffff
and rax, rdx
shl rax, 0xc
mov rdx, qword [rsp + 0x20]
movabs rdi, 0xffff000000000fff
mov rcx, qword [rdx + rcx*8 + 0x1000]
and rcx, rdi
or rcx, rax
mov rax, rcx
movsxd rcx, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov qword [rdx + rcx*8 + 0x1000], rax
jmp 0x140049cbe
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x38]
or rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
or rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
or rax, 4
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
bts rax, 7
mov qword [rsp + 0x38], rax
mov eax, 0x1000
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + rax + 0x2000]
mov rdi, rax
mov rax, qword [rsp + 0x38]
mov ecx, 0x40000
rep stosq qword [rdi], rax
mov dword [rsp + 0x2c], 0
jmp 0x140049de3
mov eax, dword [rsp + 0x2c]
inc eax
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0x200
jge 0x140049e52
mov dword [rsp + 0x30], 0
jmp 0x140049e01
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x200
jge 0x140049e50
imul eax, dword [rsp + 0x2c], 0x200
add eax, dword [rsp + 0x30]
cdqe
movsxd rcx, dword [rsp + 0x2c]
imul rcx, rcx, 0x1000
mov rdx, qword [rsp + 0x20]
lea rcx, [rdx + rcx + 0x2000]
movsxd rdx, dword [rsp + 0x30]
lea rcx, [rcx + rdx*8]
mov rdx, rax
call fcn.14004b920
movzx eax, al
test eax, eax
jne 0x140049e4e
xor al, al
jmp 0x140049e54
jmp 0x140049df7
jmp 0x140049dd9
mov al, 1
add rsp, 0x60
pop rdi
ret