{"ok":true,"data":{"evidence_id":"ev_1b592964cec52b2d61b0e9777afa6f11841622ee056ec32ba1fed6fc10991079","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x18336e860;pdgo @ 0x18336e860;afij @ 0x18336e860","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x18336e860;pdgo @ 0x18336e860;afij @ 0x18336e860","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x18336e860    |void fcn.18336e860(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    int64_t *piVar1;\r\n                   |    code *pcVar2;\r\n                   |    char cVar3;\r\n                   |    int64_t iVar4;\r\n                   |    undefined8 uVar5;\r\n                   |    int64_t iVar6;\r\n                   |    int64_t unaff_GS_OFFSET;\r\n                   |    undefined auStack_88 [40];\r\n                   |    int64_t var_60h;\r\n                   |    int64_t var_40h;\r\n                   |    int64_t var_38h;\r\n                   |    undefined8 uStack_30;\r\n                   |    int64_t var_28h;\r\n                   |    int64_t var_20h;\r\n                   |    \r\n    0x18336e874    |    var_20h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_88;\r\n    0x18336e886    |    iVar4 = (*(code *)0x185f59da0)(arg2);\r\n    0x18336e890    |    if (iVar4 == *(int64_t *)(arg1 + 0x30)) {\r\n    0x18336e8a0    |        cVar3 = (*(code *)0x185f59da0)(arg2);\r\n    0x18336e8a8    |        if (cVar3 == '\\0') {\r\n                   |code_r0x00018336e8f4:\r\n    0x18336e8f4    |            cVar3 = '\\0';\r\n                   |        } else {\r\n    0x18336e8b7    |            cVar3 = (*(code *)0x185f59da0)(arg2);\r\n    0x18336e8bf    |            if (cVar3 == '\\0') goto code_r0x00018336e8f4;\r\n    0x18336e8ce    |            cVar3 = (*(code *)0x185f59da0)(arg2);\r\n    0x18336e8d6    |            if (cVar3 != '\\0') goto code_r0x00018336e8f4;\r\n    0x18336e8e2    |            uVar5 = (*(code *)0x185f59da0)(arg2);\r\n    0x18336e8eb    |            cVar3 = func_0x000185236570(uVar5);\r\n                   |        }\r\n    0x18336e8f6    |        iVar4 = *(int64_t *)(arg1 + 0x18);\r\n    0x18336e902    |        var_38h = 0;\r\n    0x18336e902    |        uStack_30 = 0;\r\n    0x18336e90f    |        (*(code *)0x185f59da0)(iVar4);\r\n    0x18336e915    |        var_40h = *(int64_t *)(arg1 + 0x38);\r\n    0x18336e91e    |        *(undefined8 *)(arg1 + 0x38) = 0;\r\n    0x18336e92b    |        func_0x000180f4f6b0(arg1, 0);\r\n    0x18336e930    |        func_0x000184a86230(iVar4 + 8, 0x19088bb1c);\r\n    0x18336e946    |        if (cVar3 != '\\0') {\r\n    0x18336e9b1    |            piVar1 = *(int64_t **)\r\n    0x18336e9ad    |                      (*(int64_t *)(*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) +\r\n    0x18336e9b1    |                      0x3d8);\r\n    0x18336e9c3    |            if ((piVar1 == (int64_t *)0x0) || (iVar4 = *piVar1, iVar4 == 0)) goto code_r0x00018336ea3b;\r\n    0x18336e9ca    |            iVar6 = func_0x000185f006b8(0x38);\r\n    0x18336e9e6    |            func_0x0001893814f0(iVar6, 0x189381480, &var_40h, &var_38h);\r\n    0x18336e9f9    |            func_0x000184339cd0(&var_60h, 0x190124a80, 0x19088bad0, 0x3c);\r\n    0x18336ea23    |            var_28h = iVar6;\r\n    0x18336ea23    |            (*(code *)0x185f59da0)(iVar4, &var_60h, &var_28h, 0);\r\n                   |        }\r\n    0x18336e950    |        if (var_40h != 0) {\r\n    0x18336e98d    |            LOCK();\r\n    0x18336e98d    |            *(int32_t *)var_40h = *(int32_t *)var_40h + -1;\r\n    0x18336e98d    |            UNLOCK();\r\n    0x18336e990    |            if (*(int32_t *)var_40h == 0) {\r\n    0x18336e996    |                (*(code *)0x185f59da0)();\r\n                   |            }\r\n                   |        }\r\n    0x18336e95a    |        if (var_38h != 0) {\r\n    0x18336e97c    |            LOCK();\r\n    0x18336e97c    |            *(int32_t *)var_38h = *(int32_t *)var_38h + -1;\r\n    0x18336e97c    |            UNLOCK();\r\n    0x18336e97f    |            if (*(int32_t *)var_38h == 0) {\r\n    0x18336e986    |                func_0x0001841dcbe0(var_38h, 8);\r\n                   |            }\r\n                   |        }\r\n                   |    }\r\n    0x18336e96e    |    if (*(uint64_t *)0x191c71040 == (var_20h ^ (uint64_t)auStack_88)) {\r\n    0x18336e97b    |        return;\r\n                   |    }\r\n    0x18336ea33    |    func_0x000185f05b40(var_20h ^ (uint64_t)auStack_88);\r\n                   |code_r0x00018336ea3b:\r\n    0x18336ea3b    |    pcVar2 = (code *)swi(3);\r\n    0x18336ea3b    |    (*pcVar2)();\r\n    0x18336ea3b    |    return;\r\n                   |}\r\n[{\"offset\":6496381024,\"name\":\"fcn.18336e860\",\"size\":476,\"is-pure\":false,\"realsz\":476,\"noreturn\":false,\"stackframe\":136,\"calltype\":\"ms\",\"cost\":182,\"cc\":14,\"loops\":5,\"bits\":64,\"type\":\"fcn\",\"nbbs\":20,\"edges\":30,\"ebbs\":2,\"signature\":\"fcn.18336e860(int64_t arg1, int64_t arg2);\",\"minbound\":6496381024,\"maxbound\":6496381500,\"callrefs\":[{\"from\":6496381062,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496381088,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496381111,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496381134,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496381154,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496381163,\"to\":6528656752,\"type\":\"CALL\"},{\"from\":6496381170,\"to\":6496381174,\"type\":\"CODE\"},{\"from\":6496381199,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496381227,\"to\":6458504880,\"type\":\"CALL\"},{\"from\":6496381246,\"to\":6520594992,\"type\":\"CALL\"},{\"from\":6496381318,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6496381323,\"to\":6496381276,\"type\":\"CODE\"},{\"from\":6496381334,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496381340,\"to\":6496381266,\"type\":\"CODE\"},{\"from\":6496381386,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6496381414,\"to\":6597121264,\"type\":\"CALL\"},{\"from\":6496381447,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6496381475,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496381481,\"to\":6496381256,\"type\":\"CODE\"},{\"from\":6496381494,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6496381037,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6496381236,\"to\":6719847196,\"type\":\"DATA\"},{\"from\":6496381284,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6496381342,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6496381394,\"to\":6597121152,\"type\":\"DATA\"},{\"from\":6496381419,\"to\":6712085120,\"type\":\"DATA\"},{\"from\":6496381426,\"to\":6719847120,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6496381170,\"to\":6496381174,\"type\":\"CODE\"},{\"from\":6496381323,\"to\":6496381276,\"type\":\"CODE\"},{\"from\":6496381340,\"to\":6496381266,\"type\":\"CODE\"},{\"from\":6496381481,\"to\":6496381256,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":4,\"outdegree\":16,\"nlocals\":5,\"nargs\":2,\"stackvars\":[{\"name\":\"var_60h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-96}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}},{\"name\":\"var_20h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-32}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x18336e860    |void fcn.18336e860(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    int64_t *piVar1;\r\n                   |    code *pcVar2;\r\n                   |    char cVar3;\r\n                   |    int64_t iVar4;\r\n                   |    undefined8 uVar5;\r\n                   |    int64_t iVar6;\r\n                   |    int64_t unaff_GS_OFFSET;\r\n                   |    undefined auStack_88 [40];\r\n                   |    int64_t var_60h;\r\n                   |    int64_t var_40h;\r\n                   |    int64_t var_38h;\r\n                   |    undefined8 uStack_30;\r\n                   |    int64_t var_28h;\r\n                   |    int64_t var_20h;\r\n                   |    \r\n    0x18336e874    |    var_20h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_88;\r\n    0x18336e886    |    iVar4 = (*(code *)0x185f59da0)(arg2);\r\n    0x18336e890    |    if (iVar4 == *(int64_t *)(arg1 + 0x30)) {\r\n    0x18336e8a0    |        cVar3 = (*(code *)0x185f59da0)(arg2);\r\n    0x18336e8a8    |        if (cVar3 == '\\0') {\r\n                   |code_r0x00018336e8f4:\r\n    0x18336e8f4    |            cVar3 = '\\0';\r\n                   |        } else {\r\n    0x18336e8b7    |            cVar3 = (*(code *)0x185f59da0)(arg2);\r\n    0x18336e8bf    |            if (cVar3 == '\\0') goto code_r0x00018336e8f4;\r\n    0x18336e8ce    |            cVar3 = (*(code *)0x185f59da0)(arg2);\r\n    0x18336e8d6    |            if (cVar3 != '\\0') goto code_r0x00018336e8f4;\r\n    0x18336e8e2    |            uVar5 = (*(code *)0x185f59da0)(arg2);\r\n    0x18336e8eb    |            cVar3 = func_0x000185236570(uVar5);\r\n                   |        }\r\n    0x18336e8f6    |        iVar4 = *(int64_t *)(arg1 + 0x18);\r\n    0x18336e902    |        var_38h = 0;\r\n    0x18336e902    |        uStack_30 = 0;\r\n    0x18336e90f    |        (*(code *)0x185f59da0)(iVar4);\r\n    0x18336e915    |        var_40h = *(int64_t *)(arg1 + 0x38);\r\n    0x18336e91e    |        *(undefined8 *)(arg1 + 0x38) = 0;\r\n    0x18336e92b    |        func_0x000180f4f6b0(arg1, 0);\r\n    0x18336e930    |        func_0x000184a86230(iVar4 + 8, 0x19088bb1c);\r\n    0x18336e946    |        if (cVar3 != '\\0') {\r\n    0x18336e9b1    |            piVar1 = *(int64_t **)\r\n    0x18336e9ad    |                      (*(int64_t *)(*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) +\r\n    0x18336e9b1    |                      0x3d8);\r\n    0x18336e9c3    |            if ((piVar1 == (int64_t *)0x0) || (iVar4 = *piVar1, iVar4 == 0)) goto code_r0x00018336ea3b;\r\n    0x18336e9ca    |            iVar6 = func_0x000185f006b8(0x38);\r\n    0x18336e9e6    |            func_0x0001893814f0(iVar6, 0x189381480, &var_40h, &var_38h);\r\n    0x18336e9f9    |            func_0x000184339cd0(&var_60h, 0x190124a80, 0x19088bad0, 0x3c);\r\n    0x18336ea23    |            var_28h = iVar6;\r\n    0x18336ea23    |            (*(code *)0x185f59da0)(iVar4, &var_60h, &var_28h, 0);\r\n                   |        }\r\n    0x18336e950    |        if (var_40h != 0) {\r\n    0x18336e98d    |            LOCK();\r\n    0x18336e98d    |            *(int32_t *)var_40h = *(int32_t *)var_40h + -1;\r\n    0x18336e98d    |            UNLOCK();\r\n    0x18336e990    |            if (*(int32_t *)var_40h == 0) {\r\n    0x18336e996    |                (*(code *)0x185f59da0)();\r\n                   |            }\r\n                   |        }\r\n    0x18336e95a    |        if (var_38h != 0) {\r\n    0x18336e97c    |            LOCK();\r\n    0x18336e97c    |            *(int32_t *)var_38h = *(int32_t *)var_38h + -1;\r\n    0x18336e97c    |            UNLOCK();\r\n    0x18336e97f    |            if (*(int32_t *)var_38h == 0) {\r\n    0x18336e986    |                func_0x0001841dcbe0(var_38h, 8);\r\n                   |            }\r\n                   |        }\r\n                   |    }\r\n    0x18336e96e    |    if (*(uint64_t *)0x191c71040 == (var_20h ^ (uint64_t)auStack_88)) {\r\n    0x18336e97b    |        return;\r\n                   |    }\r\n    0x18336ea33    |    func_0x000185f05b40(var_20h ^ (uint64_t)auStack_88);\r\n                   |code_r0x00018336ea3b:\r\n    0x18336ea3b    |    pcVar2 = (code *)swi(3);\r\n    0x18336ea3b    |    (*pcVar2)();\r\n    0x18336ea3b    |    return;\r\n                   |}\r\n[{\"offset\":6496381024,\"name\":\"fcn.18336e860\",\"size\":476,\"is-pure\":false,\"realsz\":476,\"noreturn\":false,\"stackframe\":136,\"calltype\":\"ms\",\"cost\":182,\"cc\":14,\"loops\":5,\"bits\":64,\"type\":\"fcn\",\"nbbs\":20,\"edges\":30,\"ebbs\":2,\"signature\":\"fcn.18336e860(int64_t arg1, int64_t arg2);\",\"minbound\":6496381024,\"maxbound\":6496381500,\"callrefs\":[{\"from\":6496381062,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496381088,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496381111,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496381134,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496381154,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496381163,\"to\":6528656752,\"type\":\"CALL\"},{\"from\":6496381170,\"to\":6496381174,\"type\":\"CODE\"},{\"from\":6496381199,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496381227,\"to\":6458504880,\"type\":\"CALL\"},{\"from\":6496381246,\"to\":6520594992,\"type\":\"CALL\"},{\"from\":6496381318,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6496381323,\"to\":6496381276,\"type\":\"CODE\"},{\"from\":6496381334,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496381340,\"to\":6496381266,\"type\":\"CODE\"},{\"from\":6496381386,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6496381414,\"to\":6597121264,\"type\":\"CALL\"},{\"from\":6496381447,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6496381475,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496381481,\"to\":6496381256,\"type\":\"CODE\"},{\"from\":6496381494,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6496381037,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6496381236,\"to\":6719847196,\"type\":\"DATA\"},{\"from\":6496381284,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6496381342,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6496381394,\"to\":6597121152,\"type\":\"DATA\"},{\"from\":6496381419,\"to\":6712085120,\"type\":\"DATA\"},{\"from\":6496381426,\"to\":6719847120,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6496381170,\"to\":6496381174,\"type\":\"CODE\"},{\"from\":6496381323,\"to\":6496381276,\"type\":\"CODE\"},{\"from\":6496381340,\"to\":6496381266,\"type\":\"CODE\"},{\"from\":6496381481,\"to\":6496381256,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":4,\"outdegree\":16,\"nlocals\":5,\"nargs\":2,\"stackvars\":[{\"name\":\"var_60h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-96}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}},{\"name\":\"var_20h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-32}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5097ms"}}