{"ok":true,"data":{"evidence_id":"ev_aaa681c12bb6596b80a9f5617c31c10eb87eba8f2e09b90b16464517d525764d","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x18134a090;pdgo @ 0x18134a090;afij @ 0x18134a090","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x18134a090;pdgo @ 0x18134a090;afij @ 0x18134a090","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x18134a090    |int64_t fcn.18134a090(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg_28h)\r\n                   |{\r\n                   |    int32_t iVar1;\r\n                   |    undefined8 uVar2;\r\n                   |    code *pcVar3;\r\n                   |    int32_t *piVar4;\r\n                   |    int64_t iVar5;\r\n                   |    undefined auStack_78 [40];\r\n                   |    int64_t var_50h;\r\n                   |    int64_t var_30h;\r\n                   |    \r\n    0x18134a0b0    |    var_30h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_78;\r\n    0x18134a0bf    |    *(undefined8 *)arg1 = 0x18fd6c3b0;\r\n    0x18134a0c2    |    *(int32_t *)(arg1 + 8) = (int32_t)arg2;\r\n    0x18134a0c5    |    *(int32_t *)(arg1 + 0xc) = (int32_t)arg3;\r\n    0x18134a0c9    |    *(int64_t *)(arg1 + 0x10) = arg_28h;\r\n    0x18134a0cd    |    uVar2 = *(undefined8 *)arg4;\r\n    0x18134a0d2    |    *(undefined8 *)arg4 = 0;\r\n    0x18134a0d5    |    *(undefined8 *)(arg1 + 0x18) = uVar2;\r\n    0x18134a0dd    |    *(undefined8 *)(arg1 + 0x20) = *(undefined8 *)(arg4 + 8);\r\n    0x18134a0e1    |    *(undefined8 *)(arg4 + 8) = 0;\r\n    0x18134a0ea    |    piVar4 = (int32_t *)func_0x000185f006b8(8);\r\n    0x18134a0ef    |    *piVar4 = 0;\r\n    0x18134a0f5    |    *(undefined *)(piVar4 + 1) = 0;\r\n    0x18134a0f9    |    *(int32_t **)(arg1 + 0x28) = piVar4;\r\n    0x18134a100    |    if (piVar4 != (int32_t *)0x0) {\r\n    0x18134a107    |        LOCK();\r\n    0x18134a107    |        iVar1 = *piVar4;\r\n    0x18134a107    |        *piVar4 = *piVar4 + 1;\r\n    0x18134a107    |        UNLOCK();\r\n    0x18134a111    |        if (iVar1 == 0x7fffffff) goto code_r0x00018134a1b4;\r\n                   |    }\r\n    0x18134a117    |    *(int64_t *)(arg1 + 0x30) = arg1;\r\n    0x18134a11b    |    iVar5 = *(int64_t *)arg4;\r\n    0x18134a11e    |    *(undefined8 *)arg4 = 0;\r\n    0x18134a128    |    if (iVar5 != 0) {\r\n    0x18134a15c    |        uVar2 = *(undefined8 *)(arg4 + 8);\r\n    0x18134a16e    |        func_0x000184339cd0(&var_50h, 0x190124590, 0x1901b9970, 0x19e);\r\n    0x18134a198    |        (*(code *)0x185f59da0)(uVar2, &var_50h, 0x18336e430, iVar5);\r\n                   |    }\r\n    0x18134a131    |    if (*(int64_t *)(arg4 + 8) != 0) {\r\n    0x18134a133    |        LOCK();\r\n    0x18134a133    |        piVar4 = (int32_t *)(*(int64_t *)(arg4 + 8) + 8);\r\n    0x18134a133    |        *piVar4 = *piVar4 + -1;\r\n    0x18134a133    |        UNLOCK();\r\n    0x18134a137    |        if (*piVar4 == 0) {\r\n    0x18134a1a0    |            func_0x000185578b40();\r\n                   |        }\r\n                   |    }\r\n    0x18134a14b    |    if (*(uint64_t *)0x191c71040 == (var_30h ^ (uint64_t)auStack_78)) {\r\n    0x18134a15b    |        return arg1;\r\n                   |    }\r\n    0x18134a1ac    |    func_0x000185f05b40(var_30h ^ (uint64_t)auStack_78);\r\n                   |code_r0x00018134a1b4:\r\n    0x18134a1b4    |    pcVar3 = (code *)swi(3);\r\n    0x18134a1b4    |    iVar5 = (*pcVar3)();\r\n    0x18134a1b4    |    return iVar5;\r\n                   |}\r\n[{\"offset\":6462677136,\"name\":\"fcn.18134a090\",\"size\":293,\"is-pure\":false,\"realsz\":293,\"noreturn\":false,\"stackframe\":120,\"calltype\":\"ms\",\"cost\":100,\"cc\":8,\"loops\":2,\"bits\":64,\"type\":\"fcn\",\"nbbs\":11,\"edges\":15,\"ebbs\":2,\"signature\":\"fcn.18134a090(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg_28h);\",\"minbound\":6462677136,\"maxbound\":6462677429,\"callrefs\":[{\"from\":6462677226,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6462677372,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6462677400,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6462677406,\"to\":6462677290,\"type\":\"CODE\"},{\"from\":6462677408,\"to\":6532074304,\"type\":\"CALL\"},{\"from\":6462677413,\"to\":6462677305,\"type\":\"CODE\"},{\"from\":6462677423,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6462677161,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6462677176,\"to\":6708183984,\"type\":\"DATA\"},{\"from\":6462677313,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6462677344,\"to\":6712083856,\"type\":\"DATA\"},{\"from\":6462677351,\"to\":6712695152,\"type\":\"DATA\"},{\"from\":6462677384,\"to\":6496379952,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6462677406,\"to\":6462677290,\"type\":\"CODE\"},{\"from\":6462677413,\"to\":6462677305,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":5,\"nlocals\":2,\"nargs\":5,\"stackvars\":[{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"arg_28h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":40}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg4\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r9\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x18134a090    |int64_t fcn.18134a090(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg_28h)\r\n                   |{\r\n                   |    int32_t iVar1;\r\n                   |    undefined8 uVar2;\r\n                   |    code *pcVar3;\r\n                   |    int32_t *piVar4;\r\n                   |    int64_t iVar5;\r\n                   |    undefined auStack_78 [40];\r\n                   |    int64_t var_50h;\r\n                   |    int64_t var_30h;\r\n                   |    \r\n    0x18134a0b0    |    var_30h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_78;\r\n    0x18134a0bf    |    *(undefined8 *)arg1 = 0x18fd6c3b0;\r\n    0x18134a0c2    |    *(int32_t *)(arg1 + 8) = (int32_t)arg2;\r\n    0x18134a0c5    |    *(int32_t *)(arg1 + 0xc) = (int32_t)arg3;\r\n    0x18134a0c9    |    *(int64_t *)(arg1 + 0x10) = arg_28h;\r\n    0x18134a0cd    |    uVar2 = *(undefined8 *)arg4;\r\n    0x18134a0d2    |    *(undefined8 *)arg4 = 0;\r\n    0x18134a0d5    |    *(undefined8 *)(arg1 + 0x18) = uVar2;\r\n    0x18134a0dd    |    *(undefined8 *)(arg1 + 0x20) = *(undefined8 *)(arg4 + 8);\r\n    0x18134a0e1    |    *(undefined8 *)(arg4 + 8) = 0;\r\n    0x18134a0ea    |    piVar4 = (int32_t *)func_0x000185f006b8(8);\r\n    0x18134a0ef    |    *piVar4 = 0;\r\n    0x18134a0f5    |    *(undefined *)(piVar4 + 1) = 0;\r\n    0x18134a0f9    |    *(int32_t **)(arg1 + 0x28) = piVar4;\r\n    0x18134a100    |    if (piVar4 != (int32_t *)0x0) {\r\n    0x18134a107    |        LOCK();\r\n    0x18134a107    |        iVar1 = *piVar4;\r\n    0x18134a107    |        *piVar4 = *piVar4 + 1;\r\n    0x18134a107    |        UNLOCK();\r\n    0x18134a111    |        if (iVar1 == 0x7fffffff) goto code_r0x00018134a1b4;\r\n                   |    }\r\n    0x18134a117    |    *(int64_t *)(arg1 + 0x30) = arg1;\r\n    0x18134a11b    |    iVar5 = *(int64_t *)arg4;\r\n    0x18134a11e    |    *(undefined8 *)arg4 = 0;\r\n    0x18134a128    |    if (iVar5 != 0) {\r\n    0x18134a15c    |        uVar2 = *(undefined8 *)(arg4 + 8);\r\n    0x18134a16e    |        func_0x000184339cd0(&var_50h, 0x190124590, 0x1901b9970, 0x19e);\r\n    0x18134a198    |        (*(code *)0x185f59da0)(uVar2, &var_50h, 0x18336e430, iVar5);\r\n                   |    }\r\n    0x18134a131    |    if (*(int64_t *)(arg4 + 8) != 0) {\r\n    0x18134a133    |        LOCK();\r\n    0x18134a133    |        piVar4 = (int32_t *)(*(int64_t *)(arg4 + 8) + 8);\r\n    0x18134a133    |        *piVar4 = *piVar4 + -1;\r\n    0x18134a133    |        UNLOCK();\r\n    0x18134a137    |        if (*piVar4 == 0) {\r\n    0x18134a1a0    |            func_0x000185578b40();\r\n                   |        }\r\n                   |    }\r\n    0x18134a14b    |    if (*(uint64_t *)0x191c71040 == (var_30h ^ (uint64_t)auStack_78)) {\r\n    0x18134a15b    |        return arg1;\r\n                   |    }\r\n    0x18134a1ac    |    func_0x000185f05b40(var_30h ^ (uint64_t)auStack_78);\r\n                   |code_r0x00018134a1b4:\r\n    0x18134a1b4    |    pcVar3 = (code *)swi(3);\r\n    0x18134a1b4    |    iVar5 = (*pcVar3)();\r\n    0x18134a1b4    |    return iVar5;\r\n                   |}\r\n[{\"offset\":6462677136,\"name\":\"fcn.18134a090\",\"size\":293,\"is-pure\":false,\"realsz\":293,\"noreturn\":false,\"stackframe\":120,\"calltype\":\"ms\",\"cost\":100,\"cc\":8,\"loops\":2,\"bits\":64,\"type\":\"fcn\",\"nbbs\":11,\"edges\":15,\"ebbs\":2,\"signature\":\"fcn.18134a090(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg_28h);\",\"minbound\":6462677136,\"maxbound\":6462677429,\"callrefs\":[{\"from\":6462677226,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6462677372,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6462677400,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6462677406,\"to\":6462677290,\"type\":\"CODE\"},{\"from\":6462677408,\"to\":6532074304,\"type\":\"CALL\"},{\"from\":6462677413,\"to\":6462677305,\"type\":\"CODE\"},{\"from\":6462677423,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6462677161,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6462677176,\"to\":6708183984,\"type\":\"DATA\"},{\"from\":6462677313,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6462677344,\"to\":6712083856,\"type\":\"DATA\"},{\"from\":6462677351,\"to\":6712695152,\"type\":\"DATA\"},{\"from\":6462677384,\"to\":6496379952,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6462677406,\"to\":6462677290,\"type\":\"CODE\"},{\"from\":6462677413,\"to\":6462677305,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":5,\"nlocals\":2,\"nargs\":5,\"stackvars\":[{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"arg_28h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":40}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg4\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r9\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5369ms"}}