{"ok":true,"data":{"evidence_id":"ev_74ee9037bdef843155e15ae4272cd3ef29404316b338bb04d8255fbbf713580e","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x183382320;pdgo @ 0x183382320;afij @ 0x183382320","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x183382320;pdgo @ 0x183382320;afij @ 0x183382320","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x183382320    |void fcn.183382320(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    uint8_t uVar2;\r\n                   |    int32_t iVar3;\r\n                   |    undefined8 *puVar4;\r\n                   |    int64_t iVar5;\r\n                   |    uint64_t uVar6;\r\n                   |    uint64_t uVar7;\r\n                   |    uint64_t uVar8;\r\n                   |    undefined8 *puVar9;\r\n                   |    int64_t var_160h;\r\n                   |    int64_t var_150h;\r\n                   |    int64_t var_148h;\r\n                   |    int64_t iStack_140;\r\n                   |    int64_t var_108h;\r\n                   |    int64_t var_f8h;\r\n                   |    int64_t var_e0h;\r\n                   |    \r\n    0x183382333    |    iVar5 = *(int64_t *)(arg1 + 0x18);\r\n    0x183382337    |    *(int64_t *)(arg1 + 0x18) = arg2;\r\n    0x18338233e    |    if (iVar5 != 0) {\r\n    0x183382340    |        LOCK();\r\n    0x183382340    |        piVar1 = (int32_t *)(iVar5 + 8);\r\n    0x183382340    |        *piVar1 = *piVar1 + -1;\r\n    0x183382340    |        UNLOCK();\r\n    0x183382344    |        if (*piVar1 == 0) {\r\n    0x18338234b    |            func_0x000182e5f240(iVar5, 1);\r\n                   |        }\r\n    0x183382350    |        arg2 = *(int64_t *)(arg1 + 0x18);\r\n                   |    }\r\n    0x183382357    |    if (arg2 != 0) {\r\n    0x18338235d    |        uVar8 = (uint64_t)*(char *)(arg2 + 0x47);\r\n    0x183382365    |        uVar7 = uVar8;\r\n    0x183382365    |        if ((int64_t)uVar8 < 0) {\r\n    0x1833824fd    |            uVar7 = *(uint64_t *)(arg2 + 0x38);\r\n                   |        }\r\n    0x18338237e    |        if ((uVar7 != 0) && (puVar9 = *(undefined8 **)(arg2 + 0x18), puVar9 != (undefined8 *)0x0)) {\r\n    0x183382387    |            if (*(char *)(arg2 + 0x47) < '\\0') {\r\n    0x183382389    |                uVar8 = *(uint64_t *)(arg2 + 0x38);\r\n    0x18338238d    |                iVar5 = *(int64_t *)(arg2 + 0x30);\r\n                   |            } else {\r\n    0x183382393    |                iVar5 = arg2 + 0x30;\r\n                   |            }\r\n                   |            do {\r\n    0x1833823c7    |                uVar7 = (uint64_t)*(char *)((int64_t)puVar9 + 0x37);\r\n    0x1833823cf    |                if ((int64_t)uVar7 < 0) {\r\n    0x1833823d1    |                    uVar7 = puVar9[5];\r\n    0x1833823d5    |                    puVar4 = (undefined8 *)puVar9[4];\r\n                   |                } else {\r\n    0x1833823a2    |                    puVar4 = puVar9 + 4;\r\n                   |                }\r\n    0x1833823ac    |                uVar6 = uVar8;\r\n    0x1833823ac    |                if (uVar7 < uVar8) {\r\n    0x1833823ac    |                    uVar6 = uVar7;\r\n                   |                }\r\n    0x1833823b3    |                iVar3 = func_0x000185f59f10(iVar5, puVar4, uVar6);\r\n    0x1833823ba    |                if (iVar3 == 0) {\r\n    0x1833823e5    |                    if (uVar8 == uVar7) {\r\n    0x1833823ea    |                        if (puVar9 != (undefined8 *)(arg2 + 0x18)) {\r\n    0x1833823ec    |                            uVar2 = *(uint8_t *)(puVar9 + 0xc);\r\n    0x1833823f5    |                            *(uint8_t *)(arg1 + 0x163) = uVar2 ^ 1;\r\n    0x1833823fd    |                            if (uVar2 != 0) goto code_r0x0001833824df;\r\n    0x1833823fd    |                            goto code_r0x00018338240b;\r\n                   |                        }\r\n                   |                        break;\r\n                   |                    }\r\n    0x1833823db    |                    if (uVar7 <= uVar8) goto code_r0x0001833823be;\r\n                   |code_r0x0001833823dd:\r\n    0x1833823dd    |                    puVar9 = (undefined8 *)*puVar9;\r\n                   |                } else {\r\n    0x1833823bc    |                    if (iVar3 < 0) goto code_r0x0001833823dd;\r\n                   |code_r0x0001833823be:\r\n    0x1833823be    |                    puVar9 = (undefined8 *)puVar9[1];\r\n                   |                }\r\n    0x1833823c5    |            } while (puVar9 != (undefined8 *)0x0);\r\n                   |        }\r\n                   |    }\r\n    0x183382404    |    *(undefined *)(arg1 + 0x163) = 1;\r\n                   |code_r0x00018338240b:\r\n    0x183382412    |    if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x18338241f    |        func_0x00018030d390(&var_160h, 0x19088bd90, 0x2da, 2);\r\n    0x183382438    |        func_0x000184dcd0d0(&var_150h, 0x19088be00, 0x42);\r\n    0x183382459    |        var_160h = 0x18ff81648;\r\n    0x18338241f    |        func_0x00018030e9d0(&var_160h);\r\n    0x183382473    |        *(undefined8 *)((int64_t)&var_150h + (int64_t)*(int32_t *)(var_150h + 4)) = 0x18fe1b290;\r\n    0x18338247f    |        var_148h = 0x18fe20d40;\r\n    0x183382487    |        if (var_f8h._7_1_ < '\\0') {\r\n    0x1833824a3    |            func_0x0001841dcbe0(var_108h, CONCAT17(var_f8h._7_1_, (unkbyte7)var_f8h) & 0x7fffffffffffffff);\r\n                   |        }\r\n    0x1833824b4    |        var_148h = 0x18fe20db0;\r\n    0x1833824c5    |        if (iStack_140 != 0x191de1450) {\r\n    0x183382507    |            LOCK();\r\n    0x183382507    |            piVar1 = (int32_t *)(iStack_140 + 8);\r\n    0x183382507    |            iVar3 = *piVar1;\r\n    0x183382507    |            *piVar1 = *piVar1 + -1;\r\n    0x183382507    |            UNLOCK();\r\n    0x18338250e    |            if (iVar3 == 0) {\r\n    0x183382517    |                (*(code *)0x185f59da0)();\r\n                   |            }\r\n                   |        }\r\n    0x1833824a8    |        func_0x00018424db70(&var_148h);\r\n    0x1833824c7    |        func_0x0001848f8b80(&var_e0h);\r\n                   |    }\r\n                   |code_r0x0001833824df:\r\n    0x1833824e2    |    func_0x000183382520(arg1);\r\n    0x1833824f8    |    return;\r\n                   |}\r\n[{\"offset\":6496461600,\"name\":\"fcn.183382320\",\"size\":511,\"is-pure\":false,\"realsz\":511,\"noreturn\":false,\"stackframe\":392,\"calltype\":\"ms\",\"cost\":183,\"cc\":20,\"loops\":9,\"bits\":64,\"type\":\"fcn\",\"nbbs\":37,\"edges\":55,\"ebbs\":1,\"signature\":\"fcn.183382320(int64_t arg1, int64_t arg2);\",\"minbound\":6496461600,\"maxbound\":6496462111,\"callrefs\":[{\"from\":6496461643,\"to\":6491075136,\"type\":\"CALL\"},{\"from\":6496461713,\"to\":6496461719,\"type\":\"CODE\"},{\"from\":6496461723,\"to\":6496461767,\"type\":\"CODE\"},{\"from\":6496461728,\"to\":6496461652,\"type\":\"CODE\"},{\"from\":6496461747,\"to\":6542434064,\"type\":\"CALL\"},{\"from\":6496461785,\"to\":6496461734,\"type\":\"CODE\"},{\"from\":6496461792,\"to\":6496461762,\"type\":\"CODE\"},{\"from\":6496461823,\"to\":6496462047,\"type\":\"CODE\"},{\"from\":6496461875,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6496461901,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6496461920,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6496461987,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6496462034,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6496462042,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6496462050,\"to\":6496462112,\"type\":\"CALL\"},{\"from\":6496462077,\"to\":6496461678,\"type\":\"CODE\"},{\"from\":6496462103,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496462109,\"to\":6496462023,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6496461835,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6496461848,\"to\":6719847824,\"type\":\"DATA\"},{\"from\":6496461885,\"to\":6719847936,\"type\":\"DATA\"},{\"from\":6496461906,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6496461932,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6496461944,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6496461997,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6496462011,\"to\":6742217808,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6496461713,\"to\":6496461719,\"type\":\"CODE\"},{\"from\":6496461723,\"to\":6496461767,\"type\":\"CODE\"},{\"from\":6496461728,\"to\":6496461652,\"type\":\"CODE\"},{\"from\":6496461785,\"to\":6496461734,\"type\":\"CODE\"},{\"from\":6496461792,\"to\":6496461762,\"type\":\"CODE\"},{\"from\":6496461823,\"to\":6496462047,\"type\":\"CODE\"},{\"from\":6496462077,\"to\":6496461678,\"type\":\"CODE\"},{\"from\":6496462109,\"to\":6496462023,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":8,\"outdegree\":10,\"nlocals\":6,\"nargs\":2,\"stackvars\":[{\"name\":\"var_160h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-352}},{\"name\":\"var_150h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-336}},{\"name\":\"var_148h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-328}},{\"name\":\"var_108h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-264}},{\"name\":\"var_f8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-248}},{\"name\":\"var_e0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-224}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x183382320    |void fcn.183382320(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    uint8_t uVar2;\r\n                   |    int32_t iVar3;\r\n                   |    undefined8 *puVar4;\r\n                   |    int64_t iVar5;\r\n                   |    uint64_t uVar6;\r\n                   |    uint64_t uVar7;\r\n                   |    uint64_t uVar8;\r\n                   |    undefined8 *puVar9;\r\n                   |    int64_t var_160h;\r\n                   |    int64_t var_150h;\r\n                   |    int64_t var_148h;\r\n                   |    int64_t iStack_140;\r\n                   |    int64_t var_108h;\r\n                   |    int64_t var_f8h;\r\n                   |    int64_t var_e0h;\r\n                   |    \r\n    0x183382333    |    iVar5 = *(int64_t *)(arg1 + 0x18);\r\n    0x183382337    |    *(int64_t *)(arg1 + 0x18) = arg2;\r\n    0x18338233e    |    if (iVar5 != 0) {\r\n    0x183382340    |        LOCK();\r\n    0x183382340    |        piVar1 = (int32_t *)(iVar5 + 8);\r\n    0x183382340    |        *piVar1 = *piVar1 + -1;\r\n    0x183382340    |        UNLOCK();\r\n    0x183382344    |        if (*piVar1 == 0) {\r\n    0x18338234b    |            func_0x000182e5f240(iVar5, 1);\r\n                   |        }\r\n    0x183382350    |        arg2 = *(int64_t *)(arg1 + 0x18);\r\n                   |    }\r\n    0x183382357    |    if (arg2 != 0) {\r\n    0x18338235d    |        uVar8 = (uint64_t)*(char *)(arg2 + 0x47);\r\n    0x183382365    |        uVar7 = uVar8;\r\n    0x183382365    |        if ((int64_t)uVar8 < 0) {\r\n    0x1833824fd    |            uVar7 = *(uint64_t *)(arg2 + 0x38);\r\n                   |        }\r\n    0x18338237e    |        if ((uVar7 != 0) && (puVar9 = *(undefined8 **)(arg2 + 0x18), puVar9 != (undefined8 *)0x0)) {\r\n    0x183382387    |            if (*(char *)(arg2 + 0x47) < '\\0') {\r\n    0x183382389    |                uVar8 = *(uint64_t *)(arg2 + 0x38);\r\n    0x18338238d    |                iVar5 = *(int64_t *)(arg2 + 0x30);\r\n                   |            } else {\r\n    0x183382393    |                iVar5 = arg2 + 0x30;\r\n                   |            }\r\n                   |            do {\r\n    0x1833823c7    |                uVar7 = (uint64_t)*(char *)((int64_t)puVar9 + 0x37);\r\n    0x1833823cf    |                if ((int64_t)uVar7 < 0) {\r\n    0x1833823d1    |                    uVar7 = puVar9[5];\r\n    0x1833823d5    |                    puVar4 = (undefined8 *)puVar9[4];\r\n                   |                } else {\r\n    0x1833823a2    |                    puVar4 = puVar9 + 4;\r\n                   |                }\r\n    0x1833823ac    |                uVar6 = uVar8;\r\n    0x1833823ac    |                if (uVar7 < uVar8) {\r\n    0x1833823ac    |                    uVar6 = uVar7;\r\n                   |                }\r\n    0x1833823b3    |                iVar3 = func_0x000185f59f10(iVar5, puVar4, uVar6);\r\n    0x1833823ba    |                if (iVar3 == 0) {\r\n    0x1833823e5    |                    if (uVar8 == uVar7) {\r\n    0x1833823ea    |                        if (puVar9 != (undefined8 *)(arg2 + 0x18)) {\r\n    0x1833823ec    |                            uVar2 = *(uint8_t *)(puVar9 + 0xc);\r\n    0x1833823f5    |                            *(uint8_t *)(arg1 + 0x163) = uVar2 ^ 1;\r\n    0x1833823fd    |                            if (uVar2 != 0) goto code_r0x0001833824df;\r\n    0x1833823fd    |                            goto code_r0x00018338240b;\r\n                   |                        }\r\n                   |                        break;\r\n                   |                    }\r\n    0x1833823db    |                    if (uVar7 <= uVar8) goto code_r0x0001833823be;\r\n                   |code_r0x0001833823dd:\r\n    0x1833823dd    |                    puVar9 = (undefined8 *)*puVar9;\r\n                   |                } else {\r\n    0x1833823bc    |                    if (iVar3 < 0) goto code_r0x0001833823dd;\r\n                   |code_r0x0001833823be:\r\n    0x1833823be    |                    puVar9 = (undefined8 *)puVar9[1];\r\n                   |                }\r\n    0x1833823c5    |            } while (puVar9 != (undefined8 *)0x0);\r\n                   |        }\r\n                   |    }\r\n    0x183382404    |    *(undefined *)(arg1 + 0x163) = 1;\r\n                   |code_r0x00018338240b:\r\n    0x183382412    |    if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x18338241f    |        func_0x00018030d390(&var_160h, 0x19088bd90, 0x2da, 2);\r\n    0x183382438    |        func_0x000184dcd0d0(&var_150h, 0x19088be00, 0x42);\r\n    0x183382459    |        var_160h = 0x18ff81648;\r\n    0x18338241f    |        func_0x00018030e9d0(&var_160h);\r\n    0x183382473    |        *(undefined8 *)((int64_t)&var_150h + (int64_t)*(int32_t *)(var_150h + 4)) = 0x18fe1b290;\r\n    0x18338247f    |        var_148h = 0x18fe20d40;\r\n    0x183382487    |        if (var_f8h._7_1_ < '\\0') {\r\n    0x1833824a3    |            func_0x0001841dcbe0(var_108h, CONCAT17(var_f8h._7_1_, (unkbyte7)var_f8h) & 0x7fffffffffffffff);\r\n                   |        }\r\n    0x1833824b4    |        var_148h = 0x18fe20db0;\r\n    0x1833824c5    |        if (iStack_140 != 0x191de1450) {\r\n    0x183382507    |            LOCK();\r\n    0x183382507    |            piVar1 = (int32_t *)(iStack_140 + 8);\r\n    0x183382507    |            iVar3 = *piVar1;\r\n    0x183382507    |            *piVar1 = *piVar1 + -1;\r\n    0x183382507    |            UNLOCK();\r\n    0x18338250e    |            if (iVar3 == 0) {\r\n    0x183382517    |                (*(code *)0x185f59da0)();\r\n                   |            }\r\n                   |        }\r\n    0x1833824a8    |        func_0x00018424db70(&var_148h);\r\n    0x1833824c7    |        func_0x0001848f8b80(&var_e0h);\r\n                   |    }\r\n                   |code_r0x0001833824df:\r\n    0x1833824e2    |    func_0x000183382520(arg1);\r\n    0x1833824f8    |    return;\r\n                   |}\r\n[{\"offset\":6496461600,\"name\":\"fcn.183382320\",\"size\":511,\"is-pure\":false,\"realsz\":511,\"noreturn\":false,\"stackframe\":392,\"calltype\":\"ms\",\"cost\":183,\"cc\":20,\"loops\":9,\"bits\":64,\"type\":\"fcn\",\"nbbs\":37,\"edges\":55,\"ebbs\":1,\"signature\":\"fcn.183382320(int64_t arg1, int64_t arg2);\",\"minbound\":6496461600,\"maxbound\":6496462111,\"callrefs\":[{\"from\":6496461643,\"to\":6491075136,\"type\":\"CALL\"},{\"from\":6496461713,\"to\":6496461719,\"type\":\"CODE\"},{\"from\":6496461723,\"to\":6496461767,\"type\":\"CODE\"},{\"from\":6496461728,\"to\":6496461652,\"type\":\"CODE\"},{\"from\":6496461747,\"to\":6542434064,\"type\":\"CALL\"},{\"from\":6496461785,\"to\":6496461734,\"type\":\"CODE\"},{\"from\":6496461792,\"to\":6496461762,\"type\":\"CODE\"},{\"from\":6496461823,\"to\":6496462047,\"type\":\"CODE\"},{\"from\":6496461875,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6496461901,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6496461920,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6496461987,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6496462034,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6496462042,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6496462050,\"to\":6496462112,\"type\":\"CALL\"},{\"from\":6496462077,\"to\":6496461678,\"type\":\"CODE\"},{\"from\":6496462103,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6496462109,\"to\":6496462023,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6496461835,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6496461848,\"to\":6719847824,\"type\":\"DATA\"},{\"from\":6496461885,\"to\":6719847936,\"type\":\"DATA\"},{\"from\":6496461906,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6496461932,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6496461944,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6496461997,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6496462011,\"to\":6742217808,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6496461713,\"to\":6496461719,\"type\":\"CODE\"},{\"from\":6496461723,\"to\":6496461767,\"type\":\"CODE\"},{\"from\":6496461728,\"to\":6496461652,\"type\":\"CODE\"},{\"from\":6496461785,\"to\":6496461734,\"type\":\"CODE\"},{\"from\":6496461792,\"to\":6496461762,\"type\":\"CODE\"},{\"from\":6496461823,\"to\":6496462047,\"type\":\"CODE\"},{\"from\":6496462077,\"to\":6496461678,\"type\":\"CODE\"},{\"from\":6496462109,\"to\":6496462023,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":8,\"outdegree\":10,\"nlocals\":6,\"nargs\":2,\"stackvars\":[{\"name\":\"var_160h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-352}},{\"name\":\"var_150h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-336}},{\"name\":\"var_148h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-328}},{\"name\":\"var_108h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-264}},{\"name\":\"var_f8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-248}},{\"name\":\"var_e0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-224}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5085ms"}}