{"ok":true,"data":{"evidence_id":"ev_d1b7b2d0eca2777cd56463e23751000963f2054f7c1d86768bf3b51f9f2831df","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x183285440;pdgo @ 0x183285440;afij @ 0x183285440","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x183285440;pdgo @ 0x183285440;afij @ 0x183285440","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x183285440    |void fcn.183285440(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4)\r\n                   |{\r\n                   |    int32_t iVar1;\r\n                   |    int32_t *piVar2;\r\n                   |    int64_t *piVar3;\r\n                   |    code *pcVar4;\r\n                   |    undefined4 uVar5;\r\n                   |    undefined4 uVar6;\r\n                   |    undefined4 uVar7;\r\n                   |    undefined4 uVar8;\r\n                   |    undefined8 uVar9;\r\n                   |    char cVar10;\r\n                   |    int64_t iVar11;\r\n                   |    int64_t iVar12;\r\n                   |    undefined8 uVar13;\r\n                   |    int64_t unaff_GS_OFFSET;\r\n                   |    int64_t var_180h;\r\n                   |    int64_t var_178h;\r\n                   |    int64_t var_170h;\r\n                   |    int64_t var_168h;\r\n                   |    int64_t var_158h;\r\n                   |    int64_t var_150h;\r\n                   |    int64_t iStack_148;\r\n                   |    int64_t var_110h;\r\n                   |    int64_t var_100h;\r\n                   |    int64_t var_e8h;\r\n                   |    \r\n    0x18328546a    |    if ((*(int64_t *)arg3 == 0) || (*(char *)(*(int64_t *)arg3 + 4) != '\\0')) {\r\n    0x18328546c    |        iVar12 = 0;\r\n                   |    } else {\r\n    0x1832854a8    |        iVar12 = *(int64_t *)(arg3 + 8);\r\n                   |    }\r\n    0x183285475    |    if (*(int64_t *)arg1 != 0) {\r\n    0x1832854e6    |        if ((*(char *)(*(int64_t *)arg1 + 4) == '\\0') && (*(int64_t *)(arg1 + 8) != 0)) {\r\n    0x1832854f9    |            if ((*(int64_t *)arg1 == 0) || (*(char *)(*(int64_t *)arg1 + 4) != '\\0')) {\r\n    0x1832857e6    |                pcVar4 = (code *)swi(3);\r\n    0x1832857e6    |                (*pcVar4)();\r\n    0x1832857e6    |                return;\r\n                   |            }\r\n    0x18328552d    |            if ((((*(char *)(*(int64_t *)(*(int64_t *)(arg1 + 8) + 0x18) + 0x30) == '\\0') && (*(int64_t *)arg2 != 0)) &&\r\n    0x18328551d    |                (*(char *)(*(int64_t *)arg2 + 4) == '\\0')) && (*(int64_t *)(arg2 + 8) != 0)) {\r\n    0x183285544    |                if ((*(int64_t *)arg2 == 0) || (*(char *)(*(int64_t *)arg2 + 4) != '\\0')) {\r\n    0x1832857e9    |                    pcVar4 = (code *)swi(3);\r\n    0x1832857e9    |                    (*pcVar4)();\r\n    0x1832857e9    |                    return;\r\n                   |                }\r\n    0x183285555    |                iVar11 = (*(code *)0x185f59da0)();\r\n    0x18328555e    |                if (iVar12 == iVar11) {\r\n    0x183285564    |                    var_180h = *(int64_t *)arg2;\r\n    0x18328556f    |                    if ((int32_t *)var_180h != (int32_t *)0x0) {\r\n    0x183285576    |                        LOCK();\r\n    0x183285576    |                        iVar1 = *(int32_t *)var_180h;\r\n    0x183285576    |                        *(int32_t *)var_180h = *(int32_t *)var_180h + 1;\r\n    0x183285576    |                        UNLOCK();\r\n    0x183285580    |                        if (iVar1 == 0x7fffffff) {\r\n    0x1832857ec    |                            pcVar4 = (code *)swi(3);\r\n    0x1832857ec    |                            (*pcVar4)();\r\n    0x1832857ec    |                            return;\r\n                   |                        }\r\n                   |                    }\r\n    0x183285586    |                    var_178h = *(int64_t *)(arg2 + 8);\r\n    0x18328559c    |                    if ((*(int64_t *)arg1 == 0) || (*(char *)(*(int64_t *)arg1 + 4) != '\\0')) {\r\n    0x18328559e    |                        uVar13 = 0;\r\n                   |                    } else {\r\n    0x1832855d3    |                        uVar13 = *(undefined8 *)(arg1 + 8);\r\n                   |                    }\r\n    0x1832855a5    |                    cVar10 = func_0x000183284de0(uVar13, &var_180h);\r\n    0x1832855ac    |                    if (cVar10 == '\\0') {\r\n    0x1832855bf    |                        if ((*(int64_t *)arg2 == 0) || (*(char *)(*(int64_t *)arg2 + 4) != '\\0')) {\r\n    0x1832855c1    |                            uVar13 = 0;\r\n                   |                        } else {\r\n    0x1832855d9    |                            uVar13 = *(undefined8 *)(arg2 + 8);\r\n                   |                        }\r\n    0x1832855c3    |                        iVar12 = func_0x000185569cf0(uVar13);\r\n    0x1832855cb    |                        if (iVar12 != 0) {\r\n    0x1832855ef    |                            iVar11 = (*(code *)0x185f59da0)(iVar12);\r\n    0x183285609    |                            if ((iVar11 != 0) && (*(int64_t *)(*(int64_t *)(iVar11 + 0x30) + 0xb0) == iVar12)) {\r\n    0x183285612    |                                if ((int32_t)arg4 < 2) {\r\n    0x183285636    |                                    if ((*(int32_t *)0x191de85c0 < 2) &&\r\n    0x183285625    |                                       ((*(int32_t *)0x191cd6be0 != 0 || (*(int64_t *)0x191de85c8 != 0)))) {\r\n    0x183285643    |                                        func_0x00018030d390(&var_168h, 0x190124b20, 0x90, 1);\r\n    0x18328565c    |                                        func_0x000184dcd0d0(&var_158h, 0x190124b70, 0x45);\r\n    0x18328567d    |                                        var_168h = 0x18ff81648;\r\n    0x183285643    |                                        func_0x00018030e9d0(&var_168h);\r\n    0x183285697    |                                        *(undefined8 *)((int64_t)&var_158h + (int64_t)*(int32_t *)(var_158h + 4)) =\r\n    0x183285697    |                                             0x18fe1b290;\r\n    0x1832856a3    |                                        var_150h = 0x18fe20d40;\r\n    0x1832856ac    |                                        if (var_100h._7_1_ < '\\0') {\r\n    0x1832856c8    |                                            func_0x0001841dcbe0(var_110h, \r\n    0x1832856b8    |                                                                CONCAT17(var_100h._7_1_, (unkbyte7)var_100h) &\r\n    0x1832856c8    |                                                                0x7fffffffffffffff);\r\n                   |                                        }\r\n    0x1832856d9    |                                        var_150h = 0x18fe20db0;\r\n    0x1832856ea    |                                        if (iStack_148 != 0x191de1450) {\r\n    0x1832857f7    |                                            LOCK();\r\n    0x1832857f7    |                                            piVar2 = (int32_t *)(iStack_148 + 8);\r\n    0x1832857f7    |                                            iVar1 = *piVar2;\r\n    0x1832857f7    |                                            *piVar2 = *piVar2 + -1;\r\n    0x1832857f7    |                                            UNLOCK();\r\n    0x1832857fe    |                                            if (iVar1 == 0) {\r\n    0x18328580b    |                                                (*(code *)0x185f59da0)();\r\n                   |                                            }\r\n                   |                                        }\r\n    0x1832856cd    |                                        func_0x00018424db70(&var_150h);\r\n    0x1832856f0    |                                        func_0x0001848f8b80(&var_e8h);\r\n                   |                                    }\r\n                   |                                } else {\r\n    0x183285720    |                                    piVar3 = *(int64_t **)\r\n    0x18328571c    |                                              (*(int64_t *)\r\n    0x183285713    |                                                (*(int64_t *)(unaff_GS_OFFSET + 0x58) +\r\n    0x18328570d    |                                                (uint64_t)*(uint32_t *)0x191d832e0 * 8) + 0x3d8);\r\n    0x183285736    |                                    if ((piVar3 == (int64_t *)0x0) || (iVar12 = *piVar3, iVar12 == 0)) {\r\n    0x1832857ef    |                                        pcVar4 = (code *)swi(3);\r\n    0x1832857ef    |                                        (*pcVar4)();\r\n    0x1832857ef    |                                        return;\r\n                   |                                    }\r\n    0x183285743    |                                    var_170h = func_0x000185f006b8(0x60);\r\n    0x183285748    |                                    *(undefined4 *)var_170h = 1;\r\n    0x183285755    |                                    *(undefined8 *)(var_170h + 8) = 0x183285820;\r\n    0x183285760    |                                    *(undefined8 *)(var_170h + 0x10) = 0x1832858a0;\r\n    0x18328576b    |                                    *(undefined8 *)(var_170h + 0x18) = 0x1841d75d0;\r\n    0x183285776    |                                    *(code **)(var_170h + 0x20) = fcn.183285440;\r\n    0x18328577a    |                                    uVar13 = *(undefined8 *)arg1;\r\n    0x18328577a    |                                    uVar9 = *(undefined8 *)(arg1 + 8);\r\n    0x18328577f    |                                    *(undefined8 *)arg1 = 0;\r\n    0x183285782    |                                    *(undefined8 *)(var_170h + 0x28) = uVar13;\r\n    0x183285782    |                                    *(undefined8 *)(var_170h + 0x30) = uVar9;\r\n    0x183285786    |                                    uVar13 = *(undefined8 *)arg2;\r\n    0x183285786    |                                    uVar9 = *(undefined8 *)(arg2 + 8);\r\n    0x183285789    |                                    *(undefined8 *)arg2 = 0;\r\n    0x18328578c    |                                    *(undefined8 *)(var_170h + 0x38) = uVar13;\r\n    0x18328578c    |                                    *(undefined8 *)(var_170h + 0x40) = uVar9;\r\n    0x183285790    |                                    uVar5 = *(undefined4 *)arg3;\r\n    0x183285790    |                                    uVar6 = *(undefined4 *)(arg3 + 4);\r\n    0x183285790    |                                    uVar7 = *(undefined4 *)(arg3 + 8);\r\n    0x183285790    |                                    uVar8 = *(undefined4 *)(arg3 + 0xc);\r\n    0x183285793    |                                    *(undefined8 *)arg3 = 0;\r\n    0x183285796    |                                    *(undefined4 *)(var_170h + 0x48) = uVar5;\r\n    0x183285796    |                                    *(undefined4 *)(var_170h + 0x4c) = uVar6;\r\n    0x183285796    |                                    *(undefined4 *)(var_170h + 0x50) = uVar7;\r\n    0x183285796    |                                    *(undefined4 *)(var_170h + 0x54) = uVar8;\r\n    0x18328579a    |                                    *(int32_t *)(var_170h + 0x58) = (int32_t)arg4 + -1;\r\n    0x1832857b3    |                                    func_0x000184339cd0(&var_168h, 0x190124bb8, 0x190124b20, 0x96);\r\n    0x1832857db    |                                    (*(code *)0x185f59da0)(iVar12, &var_168h, &var_170h, 100000);\r\n                   |                                }\r\n                   |                            }\r\n                   |                        }\r\n                   |                    }\r\n                   |                }\r\n                   |            }\r\n                   |        }\r\n    0x18328547e    |        piVar2 = *(int32_t **)arg1;\r\n    0x183285484    |        if (piVar2 != (int32_t *)0x0) {\r\n    0x1832854bf    |            LOCK();\r\n    0x1832854bf    |            *piVar2 = *piVar2 + -1;\r\n    0x1832854bf    |            UNLOCK();\r\n    0x1832854c2    |            if (*piVar2 == 0) {\r\n    0x1832854c9    |                func_0x0001841dcbe0(piVar2, 8);\r\n                   |            }\r\n                   |        }\r\n                   |    }\r\n    0x183285486    |    piVar2 = *(int32_t **)arg2;\r\n    0x18328548c    |    if (piVar2 != (int32_t *)0x0) {\r\n    0x1832854d0    |        LOCK();\r\n    0x1832854d0    |        *piVar2 = *piVar2 + -1;\r\n    0x1832854d0    |        UNLOCK();\r\n    0x1832854d3    |        if (*piVar2 == 0) {\r\n    0x1832854da    |            func_0x0001841dcbe0(piVar2, 8);\r\n                   |        }\r\n                   |    }\r\n    0x18328548e    |    piVar2 = *(int32_t **)arg3;\r\n    0x183285494    |    if (piVar2 != (int32_t *)0x0) {\r\n    0x1832854ae    |        LOCK();\r\n    0x1832854ae    |        *piVar2 = *piVar2 + -1;\r\n    0x1832854ae    |        UNLOCK();\r\n    0x1832854b1    |        if (*piVar2 == 0) {\r\n    0x1832854b8    |            func_0x0001841dcbe0(piVar2, 8);\r\n                   |        }\r\n                   |    }\r\n    0x1832854a7    |    return;\r\n                   |}\r\n[{\"offset\":6495425600,\"name\":\"fcn.183285440\",\"size\":982,\"is-pure\":false,\"realsz\":974,\"noreturn\":false,\"stackframe\":424,\"calltype\":\"ms\",\"cost\":335,\"cc\":44,\"loops\":25,\"bits\":64,\"type\":\"fcn\",\"nbbs\":58,\"edges\":92,\"ebbs\":5,\"signature\":\"fcn.183285440(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4);\",\"minbound\":6495425600,\"maxbound\":6495426582,\"callrefs\":[{\"from\":6495425708,\"to\":6495425647,\"type\":\"CODE\"},{\"from\":6495425720,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6495425725,\"to\":6495425686,\"type\":\"CODE\"},{\"from\":6495425737,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6495425742,\"to\":6495425670,\"type\":\"CODE\"},{\"from\":6495425754,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6495425759,\"to\":6495425678,\"type\":\"CODE\"},{\"from\":6495425877,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6495425957,\"to\":6495423968,\"type\":\"CALL\"},{\"from\":6495425987,\"to\":6532013296,\"type\":\"CALL\"},{\"from\":6495426001,\"to\":6495426015,\"type\":\"CODE\"},{\"from\":6495426007,\"to\":6495425952,\"type\":\"CODE\"},{\"from\":6495426013,\"to\":6495425987,\"type\":\"CODE\"},{\"from\":6495426031,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6495426135,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6495426161,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6495426180,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6495426248,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6495426299,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6495426307,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6495426312,\"to\":6495425662,\"type\":\"CODE\"},{\"from\":6495426371,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6495426497,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6495426523,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6495426529,\"to\":6495425662,\"type\":\"CODE\"},{\"from\":6495426571,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6495426577,\"to\":6495426288,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6495426072,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6495426085,\"to\":6741126112,\"type\":\"DATA\"},{\"from\":6495426094,\"to\":6742246856,\"type\":\"DATA\"},{\"from\":6495426108,\"to\":6712085280,\"type\":\"DATA\"},{\"from\":6495426145,\"to\":6712085360,\"type\":\"DATA\"},{\"from\":6495426166,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6495426192,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6495426204,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6495426258,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6495426272,\"to\":6742217808,\"type\":\"DATA\"},{\"from\":6495426317,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6495426382,\"to\":6495426592,\"type\":\"DATA\"},{\"from\":6495426393,\"to\":6495426720,\"type\":\"DATA\"},{\"from\":6495426404,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6495426415,\"to\":6495425600,\"type\":\"DATA\"},{\"from\":6495426469,\"to\":6712085432,\"type\":\"DATA\"},{\"from\":6495426476,\"to\":6712085280,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6495425708,\"to\":6495425647,\"type\":\"CODE\"},{\"from\":6495425725,\"to\":6495425686,\"type\":\"CODE\"},{\"from\":6495425742,\"to\":6495425670,\"type\":\"CODE\"},{\"from\":6495425759,\"to\":6495425678,\"type\":\"CODE\"},{\"from\":6495426001,\"to\":6495426015,\"type\":\"CODE\"},{\"from\":6495426007,\"to\":6495425952,\"type\":\"CODE\"},{\"from\":6495426013,\"to\":6495425987,\"type\":\"CODE\"},{\"from\":6495426312,\"to\":6495425662,\"type\":\"CODE\"},{\"from\":6495426529,\"to\":6495425662,\"type\":\"CODE\"},{\"from\":6495426577,\"to\":6495426288,\"type\":\"CODE\"}],\"dataxrefs\":[{\"from\":6495426415,\"to\":6495425600,\"type\":\"DATA\"}],\"indegree\":10,\"outdegree\":17,\"nlocals\":9,\"nargs\":4,\"stackvars\":[{\"name\":\"var_180h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-384}},{\"name\":\"var_178h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-376}},{\"name\":\"var_170h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-368}},{\"name\":\"var_168h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-360}},{\"name\":\"var_158h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-344}},{\"name\":\"var_150h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-336}},{\"name\":\"var_110h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-272}},{\"name\":\"var_100h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-256}},{\"name\":\"var_e8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-232}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg4\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r9\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x183285440    |void fcn.183285440(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4)\r\n                   |{\r\n                   |    int32_t iVar1;\r\n                   |    int32_t *piVar2;\r\n                   |    int64_t *piVar3;\r\n                   |    code *pcVar4;\r\n                   |    undefined4 uVar5;\r\n                   |    undefined4 uVar6;\r\n                   |    undefined4 uVar7;\r\n                   |    undefined4 uVar8;\r\n                   |    undefined8 uVar9;\r\n                   |    char cVar10;\r\n                   |    int64_t iVar11;\r\n                   |    int64_t iVar12;\r\n                   |    undefined8 uVar13;\r\n                   |    int64_t unaff_GS_OFFSET;\r\n                   |    int64_t var_180h;\r\n                   |    int64_t var_178h;\r\n                   |    int64_t var_170h;\r\n                   |    int64_t var_168h;\r\n                   |    int64_t var_158h;\r\n                   |    int64_t var_150h;\r\n                   |    int64_t iStack_148;\r\n                   |    int64_t var_110h;\r\n                   |    int64_t var_100h;\r\n                   |    int64_t var_e8h;\r\n                   |    \r\n    0x18328546a    |    if ((*(int64_t *)arg3 == 0) || (*(char *)(*(int64_t *)arg3 + 4) != '\\0')) {\r\n    0x18328546c    |        iVar12 = 0;\r\n                   |    } else {\r\n    0x1832854a8    |        iVar12 = *(int64_t *)(arg3 + 8);\r\n                   |    }\r\n    0x183285475    |    if (*(int64_t *)arg1 != 0) {\r\n    0x1832854e6    |        if ((*(char *)(*(int64_t *)arg1 + 4) == '\\0') && (*(int64_t *)(arg1 + 8) != 0)) {\r\n    0x1832854f9    |            if ((*(int64_t *)arg1 == 0) || (*(char *)(*(int64_t *)arg1 + 4) != '\\0')) {\r\n    0x1832857e6    |                pcVar4 = (code *)swi(3);\r\n    0x1832857e6    |                (*pcVar4)();\r\n    0x1832857e6    |                return;\r\n                   |            }\r\n    0x18328552d    |            if ((((*(char *)(*(int64_t *)(*(int64_t *)(arg1 + 8) + 0x18) + 0x30) == '\\0') && (*(int64_t *)arg2 != 0)) &&\r\n    0x18328551d    |                (*(char *)(*(int64_t *)arg2 + 4) == '\\0')) && (*(int64_t *)(arg2 + 8) != 0)) {\r\n    0x183285544    |                if ((*(int64_t *)arg2 == 0) || (*(char *)(*(int64_t *)arg2 + 4) != '\\0')) {\r\n    0x1832857e9    |                    pcVar4 = (code *)swi(3);\r\n    0x1832857e9    |                    (*pcVar4)();\r\n    0x1832857e9    |                    return;\r\n                   |                }\r\n    0x183285555    |                iVar11 = (*(code *)0x185f59da0)();\r\n    0x18328555e    |                if (iVar12 == iVar11) {\r\n    0x183285564    |                    var_180h = *(int64_t *)arg2;\r\n    0x18328556f    |                    if ((int32_t *)var_180h != (int32_t *)0x0) {\r\n    0x183285576    |                        LOCK();\r\n    0x183285576    |                        iVar1 = *(int32_t *)var_180h;\r\n    0x183285576    |                        *(int32_t *)var_180h = *(int32_t *)var_180h + 1;\r\n    0x183285576    |                        UNLOCK();\r\n    0x183285580    |                        if (iVar1 == 0x7fffffff) {\r\n    0x1832857ec    |                            pcVar4 = (code *)swi(3);\r\n    0x1832857ec    |                            (*pcVar4)();\r\n    0x1832857ec    |                            return;\r\n                   |                        }\r\n                   |                    }\r\n    0x183285586    |                    var_178h = *(int64_t *)(arg2 + 8);\r\n    0x18328559c    |                    if ((*(int64_t *)arg1 == 0) || (*(char *)(*(int64_t *)arg1 + 4) != '\\0')) {\r\n    0x18328559e    |                        uVar13 = 0;\r\n                   |                    } else {\r\n    0x1832855d3    |                        uVar13 = *(undefined8 *)(arg1 + 8);\r\n                   |                    }\r\n    0x1832855a5    |                    cVar10 = func_0x000183284de0(uVar13, &var_180h);\r\n    0x1832855ac    |                    if (cVar10 == '\\0') {\r\n    0x1832855bf    |                        if ((*(int64_t *)arg2 == 0) || (*(char *)(*(int64_t *)arg2 + 4) != '\\0')) {\r\n    0x1832855c1    |                            uVar13 = 0;\r\n                   |                        } else {\r\n    0x1832855d9    |                            uVar13 = *(undefined8 *)(arg2 + 8);\r\n                   |                        }\r\n    0x1832855c3    |                        iVar12 = func_0x000185569cf0(uVar13);\r\n    0x1832855cb    |                        if (iVar12 != 0) {\r\n    0x1832855ef    |                            iVar11 = (*(code *)0x185f59da0)(iVar12);\r\n    0x183285609    |                            if ((iVar11 != 0) && (*(int64_t *)(*(int64_t *)(iVar11 + 0x30) + 0xb0) == iVar12)) {\r\n    0x183285612    |                                if ((int32_t)arg4 < 2) {\r\n    0x183285636    |                                    if ((*(int32_t *)0x191de85c0 < 2) &&\r\n    0x183285625    |                                       ((*(int32_t *)0x191cd6be0 != 0 || (*(int64_t *)0x191de85c8 != 0)))) {\r\n    0x183285643    |                                        func_0x00018030d390(&var_168h, 0x190124b20, 0x90, 1);\r\n    0x18328565c    |                                        func_0x000184dcd0d0(&var_158h, 0x190124b70, 0x45);\r\n    0x18328567d    |                                        var_168h = 0x18ff81648;\r\n    0x183285643    |                                        func_0x00018030e9d0(&var_168h);\r\n    0x183285697    |                                        *(undefined8 *)((int64_t)&var_158h + (int64_t)*(int32_t *)(var_158h + 4)) =\r\n    0x183285697    |                                             0x18fe1b290;\r\n    0x1832856a3    |                                        var_150h = 0x18fe20d40;\r\n    0x1832856ac    |                                        if (var_100h._7_1_ < '\\0') {\r\n    0x1832856c8    |                                            func_0x0001841dcbe0(var_110h, \r\n    0x1832856b8    |                                                                CONCAT17(var_100h._7_1_, (unkbyte7)var_100h) &\r\n    0x1832856c8    |                                                                0x7fffffffffffffff);\r\n                   |                                        }\r\n    0x1832856d9    |                                        var_150h = 0x18fe20db0;\r\n    0x1832856ea    |                                        if (iStack_148 != 0x191de1450) {\r\n    0x1832857f7    |                                            LOCK();\r\n    0x1832857f7    |                                            piVar2 = (int32_t *)(iStack_148 + 8);\r\n    0x1832857f7    |                                            iVar1 = *piVar2;\r\n    0x1832857f7    |                                            *piVar2 = *piVar2 + -1;\r\n    0x1832857f7    |                                            UNLOCK();\r\n    0x1832857fe    |                                            if (iVar1 == 0) {\r\n    0x18328580b    |                                                (*(code *)0x185f59da0)();\r\n                   |                                            }\r\n                   |                                        }\r\n    0x1832856cd    |                                        func_0x00018424db70(&var_150h);\r\n    0x1832856f0    |                                        func_0x0001848f8b80(&var_e8h);\r\n                   |                                    }\r\n                   |                                } else {\r\n    0x183285720    |                                    piVar3 = *(int64_t **)\r\n    0x18328571c    |                                              (*(int64_t *)\r\n    0x183285713    |                                                (*(int64_t *)(unaff_GS_OFFSET + 0x58) +\r\n    0x18328570d    |                                                (uint64_t)*(uint32_t *)0x191d832e0 * 8) + 0x3d8);\r\n    0x183285736    |                                    if ((piVar3 == (int64_t *)0x0) || (iVar12 = *piVar3, iVar12 == 0)) {\r\n    0x1832857ef    |                                        pcVar4 = (code *)swi(3);\r\n    0x1832857ef    |                                        (*pcVar4)();\r\n    0x1832857ef    |                                        return;\r\n                   |                                    }\r\n    0x183285743    |                                    var_170h = func_0x000185f006b8(0x60);\r\n    0x183285748    |                                    *(undefined4 *)var_170h = 1;\r\n    0x183285755    |                                    *(undefined8 *)(var_170h + 8) = 0x183285820;\r\n    0x183285760    |                                    *(undefined8 *)(var_170h + 0x10) = 0x1832858a0;\r\n    0x18328576b    |                                    *(undefined8 *)(var_170h + 0x18) = 0x1841d75d0;\r\n    0x183285776    |                                    *(code **)(var_170h + 0x20) = fcn.183285440;\r\n    0x18328577a    |                                    uVar13 = *(undefined8 *)arg1;\r\n    0x18328577a    |                                    uVar9 = *(undefined8 *)(arg1 + 8);\r\n    0x18328577f    |                                    *(undefined8 *)arg1 = 0;\r\n    0x183285782    |                                    *(undefined8 *)(var_170h + 0x28) = uVar13;\r\n    0x183285782    |                                    *(undefined8 *)(var_170h + 0x30) = uVar9;\r\n    0x183285786    |                                    uVar13 = *(undefined8 *)arg2;\r\n    0x183285786    |                                    uVar9 = *(undefined8 *)(arg2 + 8);\r\n    0x183285789    |                                    *(undefined8 *)arg2 = 0;\r\n    0x18328578c    |                                    *(undefined8 *)(var_170h + 0x38) = uVar13;\r\n    0x18328578c    |                                    *(undefined8 *)(var_170h + 0x40) = uVar9;\r\n    0x183285790    |                                    uVar5 = *(undefined4 *)arg3;\r\n    0x183285790    |                                    uVar6 = *(undefined4 *)(arg3 + 4);\r\n    0x183285790    |                                    uVar7 = *(undefined4 *)(arg3 + 8);\r\n    0x183285790    |                                    uVar8 = *(undefined4 *)(arg3 + 0xc);\r\n    0x183285793    |                                    *(undefined8 *)arg3 = 0;\r\n    0x183285796    |                                    *(undefined4 *)(var_170h + 0x48) = uVar5;\r\n    0x183285796    |                                    *(undefined4 *)(var_170h + 0x4c) = uVar6;\r\n    0x183285796    |                                    *(undefined4 *)(var_170h + 0x50) = uVar7;\r\n    0x183285796    |                                    *(undefined4 *)(var_170h + 0x54) = uVar8;\r\n    0x18328579a    |                                    *(int32_t *)(var_170h + 0x58) = (int32_t)arg4 + -1;\r\n    0x1832857b3    |                                    func_0x000184339cd0(&var_168h, 0x190124bb8, 0x190124b20, 0x96);\r\n    0x1832857db    |                                    (*(code *)0x185f59da0)(iVar12, &var_168h, &var_170h, 100000);\r\n                   |                                }\r\n                   |                            }\r\n                   |                        }\r\n                   |                    }\r\n                   |                }\r\n                   |            }\r\n                   |        }\r\n    0x18328547e    |        piVar2 = *(int32_t **)arg1;\r\n    0x183285484    |        if (piVar2 != (int32_t *)0x0) {\r\n    0x1832854bf    |            LOCK();\r\n    0x1832854bf    |            *piVar2 = *piVar2 + -1;\r\n    0x1832854bf    |            UNLOCK();\r\n    0x1832854c2    |            if (*piVar2 == 0) {\r\n    0x1832854c9    |                func_0x0001841dcbe0(piVar2, 8);\r\n                   |            }\r\n                   |        }\r\n                   |    }\r\n    0x183285486    |    piVar2 = *(int32_t **)arg2;\r\n    0x18328548c    |    if (piVar2 != (int32_t *)0x0) {\r\n    0x1832854d0    |        LOCK();\r\n    0x1832854d0    |        *piVar2 = *piVar2 + -1;\r\n    0x1832854d0    |        UNLOCK();\r\n    0x1832854d3    |        if (*piVar2 == 0) {\r\n    0x1832854da    |            func_0x0001841dcbe0(piVar2, 8);\r\n                   |        }\r\n                   |    }\r\n    0x18328548e    |    piVar2 = *(int32_t **)arg3;\r\n    0x183285494    |    if (piVar2 != (int32_t *)0x0) {\r\n    0x1832854ae    |        LOCK();\r\n    0x1832854ae    |        *piVar2 = *piVar2 + -1;\r\n    0x1832854ae    |        UNLOCK();\r\n    0x1832854b1    |        if (*piVar2 == 0) {\r\n    0x1832854b8    |            func_0x0001841dcbe0(piVar2, 8);\r\n                   |        }\r\n                   |    }\r\n    0x1832854a7    |    return;\r\n                   |}\r\n[{\"offset\":6495425600,\"name\":\"fcn.183285440\",\"size\":982,\"is-pure\":false,\"realsz\":974,\"noreturn\":false,\"stackframe\":424,\"calltype\":\"ms\",\"cost\":335,\"cc\":44,\"loops\":25,\"bits\":64,\"type\":\"fcn\",\"nbbs\":58,\"edges\":92,\"ebbs\":5,\"signature\":\"fcn.183285440(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4);\",\"minbound\":6495425600,\"maxbound\":6495426582,\"callrefs\":[{\"from\":6495425708,\"to\":6495425647,\"type\":\"CODE\"},{\"from\":6495425720,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6495425725,\"to\":6495425686,\"type\":\"CODE\"},{\"from\":6495425737,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6495425742,\"to\":6495425670,\"type\":\"CODE\"},{\"from\":6495425754,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6495425759,\"to\":6495425678,\"type\":\"CODE\"},{\"from\":6495425877,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6495425957,\"to\":6495423968,\"type\":\"CALL\"},{\"from\":6495425987,\"to\":6532013296,\"type\":\"CALL\"},{\"from\":6495426001,\"to\":6495426015,\"type\":\"CODE\"},{\"from\":6495426007,\"to\":6495425952,\"type\":\"CODE\"},{\"from\":6495426013,\"to\":6495425987,\"type\":\"CODE\"},{\"from\":6495426031,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6495426135,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6495426161,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6495426180,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6495426248,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6495426299,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6495426307,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6495426312,\"to\":6495425662,\"type\":\"CODE\"},{\"from\":6495426371,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6495426497,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6495426523,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6495426529,\"to\":6495425662,\"type\":\"CODE\"},{\"from\":6495426571,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6495426577,\"to\":6495426288,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6495426072,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6495426085,\"to\":6741126112,\"type\":\"DATA\"},{\"from\":6495426094,\"to\":6742246856,\"type\":\"DATA\"},{\"from\":6495426108,\"to\":6712085280,\"type\":\"DATA\"},{\"from\":6495426145,\"to\":6712085360,\"type\":\"DATA\"},{\"from\":6495426166,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6495426192,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6495426204,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6495426258,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6495426272,\"to\":6742217808,\"type\":\"DATA\"},{\"from\":6495426317,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6495426382,\"to\":6495426592,\"type\":\"DATA\"},{\"from\":6495426393,\"to\":6495426720,\"type\":\"DATA\"},{\"from\":6495426404,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6495426415,\"to\":6495425600,\"type\":\"DATA\"},{\"from\":6495426469,\"to\":6712085432,\"type\":\"DATA\"},{\"from\":6495426476,\"to\":6712085280,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6495425708,\"to\":6495425647,\"type\":\"CODE\"},{\"from\":6495425725,\"to\":6495425686,\"type\":\"CODE\"},{\"from\":6495425742,\"to\":6495425670,\"type\":\"CODE\"},{\"from\":6495425759,\"to\":6495425678,\"type\":\"CODE\"},{\"from\":6495426001,\"to\":6495426015,\"type\":\"CODE\"},{\"from\":6495426007,\"to\":6495425952,\"type\":\"CODE\"},{\"from\":6495426013,\"to\":6495425987,\"type\":\"CODE\"},{\"from\":6495426312,\"to\":6495425662,\"type\":\"CODE\"},{\"from\":6495426529,\"to\":6495425662,\"type\":\"CODE\"},{\"from\":6495426577,\"to\":6495426288,\"type\":\"CODE\"}],\"dataxrefs\":[{\"from\":6495426415,\"to\":6495425600,\"type\":\"DATA\"}],\"indegree\":10,\"outdegree\":17,\"nlocals\":9,\"nargs\":4,\"stackvars\":[{\"name\":\"var_180h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-384}},{\"name\":\"var_178h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-376}},{\"name\":\"var_170h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-368}},{\"name\":\"var_168h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-360}},{\"name\":\"var_158h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-344}},{\"name\":\"var_150h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-336}},{\"name\":\"var_110h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-272}},{\"name\":\"var_100h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-256}},{\"name\":\"var_e8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-232}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg4\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r9\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"4981ms"}}