{"ok":true,"data":{"evidence_id":"ev_922b5b054d0630e1071f14b92e881255ebc4daeae4c44a41edfb25f23f6e0e8d","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x183598700;pdgo @ 0x183598700;pdf @ 0x183598700;afij @ 0x183598700","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x183598700;pdgo @ 0x183598700;pdf @ 0x183598700;afij @ 0x183598700","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x183598700    |void fcn.183598700(int64_t arg1, int64_t arg2, int64_t arg3)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    int32_t iVar2;\r\n                   |    int64_t iVar3;\r\n                   |    undefined8 uVar4;\r\n                   |    code *pcVar5;\r\n                   |    int64_t iVar6;\r\n                   |    undefined auStack_68 [32];\r\n                   |    int64_t var_48h;\r\n                   |    int64_t var_40h;\r\n                   |    int64_t var_38h;\r\n                   |    int64_t var_30h;\r\n                   |    \r\n    0x18359871b    |    var_30h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_68;\r\n    0x183598723    |    iVar6 = *(int64_t *)(arg1 + 0x160);\r\n    0x18359872a    |    iVar3 = *(int64_t *)(arg1 + 0x170);\r\n    0x183598733    |    *(undefined8 *)(arg1 + 0x160) = 0;\r\n    0x18359873a    |    *(undefined4 *)(arg1 + 0x168) = 0;\r\n    0x183598744    |    *(undefined8 *)(arg1 + 0x170) = 0;\r\n    0x18359874e    |    if (iVar3 != 0) {\r\n    0x183598755    |        func_0x0001811b5ec0(iVar3, 1);\r\n                   |    }\r\n    0x18359875d    |    if (iVar6 != 0) {\r\n    0x183598896    |        func_0x000184777f70(iVar6, 1);\r\n                   |    }\r\n    0x183598770    |    iVar6 = (*(code *)0x185f59da0)(arg2);\r\n    0x183598780    |    if (*(int64_t *)(iVar6 + 0x20) != 0) {\r\n    0x183598787    |        LOCK();\r\n    0x183598787    |        piVar1 = (int32_t *)(*(int64_t *)(iVar6 + 0x20) + 8);\r\n    0x183598787    |        iVar2 = *piVar1;\r\n    0x183598787    |        *piVar1 = *piVar1 + 1;\r\n    0x183598787    |        UNLOCK();\r\n    0x183598792    |        if (iVar2 == 0x7fffffff) {\r\n    0x1835988c1    |            pcVar5 = (code *)swi(3);\r\n    0x1835988c1    |            (*pcVar5)();\r\n    0x1835988c1    |            return;\r\n                   |        }\r\n                   |    }\r\n    0x183598798    |    func_0x00018359a140(arg1 + 0x160, &var_38h);\r\n    0x1835987b5    |    func_0x000183599ff0(iVar6, &var_38h);\r\n    0x1835987ba    |    piVar1 = *(int32_t **)(arg1 + 0x188);\r\n    0x1835987c1    |    uVar4 = *(undefined8 *)(arg1 + 400);\r\n    0x1835987cb    |    if (piVar1 != (int32_t *)0x0) {\r\n    0x1835987d2    |        LOCK();\r\n    0x1835987d2    |        iVar2 = *piVar1;\r\n    0x1835987d2    |        *piVar1 = *piVar1 + 1;\r\n    0x1835987d2    |        UNLOCK();\r\n    0x1835987dc    |        if (iVar2 == 0x7fffffff) goto code_r0x0001835988be;\r\n                   |    }\r\n    0x1835987e7    |    var_40h = func_0x000185f006b8(0x48);\r\n    0x1835987ec    |    *(undefined4 *)var_40h = 1;\r\n    0x1835987f9    |    *(undefined8 *)(var_40h + 8) = 0x183599e50;\r\n    0x183598804    |    *(undefined8 *)(var_40h + 0x10) = 0x182bf38a0;\r\n    0x18359880f    |    *(undefined8 *)(var_40h + 0x18) = 0x1832818a0;\r\n    0x18359881a    |    *(undefined8 *)(var_40h + 0x20) = 0x183598a30;\r\n    0x18359881e    |    *(undefined4 *)(var_40h + 0x28) = 0;\r\n    0x183598825    |    *(int32_t **)(var_40h + 0x30) = piVar1;\r\n    0x183598829    |    *(undefined8 *)(var_40h + 0x38) = uVar4;\r\n    0x183598834    |    *(undefined8 *)(var_40h + 0x40) = *(undefined8 *)(arg1 + 0x178);\r\n    0x183598798    |    func_0x0001835988d0(arg1 + 0x160);\r\n    0x183598848    |    uVar4 = *(undefined8 *)(arg1 + 0x170);\r\n    0x18359884f    |    var_48h = *(int64_t *)arg3;\r\n    0x18359885a    |    *(undefined8 *)arg3 = 0;\r\n    0x183598861    |    func_0x00018340d080(uVar4);\r\n    0x183598866    |    piVar1 = *(int32_t **)arg3;\r\n    0x18359886c    |    if (piVar1 != (int32_t *)0x0) {\r\n    0x1835988a0    |        LOCK();\r\n    0x1835988a0    |        *piVar1 = *piVar1 + -1;\r\n    0x1835988a0    |        UNLOCK();\r\n    0x1835988a3    |        if (*piVar1 == 0) {\r\n    0x1835988a9    |            (*(code *)0x185f59da0)();\r\n                   |        }\r\n                   |    }\r\n    0x183598880    |    if (*(uint64_t *)0x191c71040 == (var_30h ^ (uint64_t)auStack_68)) {\r\n    0x18359888d    |        return;\r\n                   |    }\r\n    0x1835988b6    |    func_0x000185f05b40(var_30h ^ (uint64_t)auStack_68);\r\n                   |code_r0x0001835988be:\r\n    0x1835988be    |    pcVar5 = (code *)swi(3);\r\n    0x1835988be    |    (*pcVar5)();\r\n    0x1835988be    |    return;\r\n                   |}\r\n/ fcn.183598700(int64_t arg1, int64_t arg2, int64_t arg3);\r\n|           ; arg int64_t arg1 @ rcx\r\n|           ; arg int64_t arg2 @ rdx\r\n|           ; arg int64_t arg3 @ r8\r\n|           ; var int64_t var_48h @ stack - 0x48\r\n|           ; var int64_t var_40h @ stack - 0x40\r\n|           ; var int64_t var_38h @ stack - 0x38\r\n|           ; var int64_t var_30h @ stack - 0x30\r\n|           0x183598700      push  r15\r\n|           0x183598702      push  r14\r\n|           0x183598704      push  rsi\r\n|           0x183598705      push  rdi\r\n|           0x183598706      push  rbx\r\n|           0x183598707      sub   rsp, 0x40\r\n|           0x18359870b      mov   rsi, r8                             ; arg3\r\n|           0x18359870e      mov   rbx, rdx                            ; arg2\r\n|           0x183598711      mov   rdi, rcx                            ; arg1\r\n|           0x183598714      mov   rax, qword [0x191c71040]            ; [0x191c71040:8]=0x2b992ddfa232\r\n|           0x18359871b      xor   rax, rsp\r\n|           0x18359871e      mov   qword [var_30h], rax\r\n|           0x183598723      mov   r14, qword [rcx+0x160]              ; arg1\r\n|           0x18359872a      mov   rcx, qword [rcx+0x170]              ; arg1\r\n|           0x183598731      xor   eax, eax\r\n|           0x183598733      mov   qword [rdi+0x160], rax\r\n|           0x18359873a      mov   dword [rdi+0x168], 0x00\r\n|           0x183598744      mov   qword [rdi+0x170], rax\r\n|           0x18359874b      test  rcx, rcx                            ; arg1\r\n|       ,=< 0x18359874e      jz    0x18359875a\r\n|       |   0x183598750      mov   edx, 0x01\r\n|       |   0x183598755      call  0x1811b5ec0\r\n|       `-> 0x18359875a      test  r14, r14\r\n|       ,=< 0x18359875d      jnz   0x18359888e\r\n|       |   ; CODE XREF from fcn.183598700 @ 0x18359889b\r\n|      .--> 0x183598763      mov   rax, qword [rbx]\r\n|      :|   0x183598766      mov   rax, qword [rax+0x208]\r\n|      :|   0x18359876d      mov   rcx, rbx\r\n|      :|   0x183598770      call  qword [0x191c186b0]                 ; [0x191c186b0:8]=0x185f59da0\r\n|      :|   0x183598776      mov   r14, rax\r\n|      :|   0x183598779      mov   r8, qword [rax+0x20]\r\n|      :|   0x18359877d      test  r8, r8\r\n|     ,===< 0x183598780      jz    0x183598798\r\n|     |:|   0x183598782      mov   eax, 0x01\r\n|     |:|   0x183598787      lock  xadd dword [r8+0x08], eax\r\n|     |:|   0x18359878d      cmp   eax, 0x7fffffff\r\n|    ,====< 0x183598792      jz    0x1835988c1\r\n|    |`---> 0x183598798      lea   rbx, qword [rdi+0x160]\r\n|    | :|   0x18359879f      lea   r15, qword [var_38h]\r\n|    | :|   0x1835987a4      mov   rcx, rbx\r\n|    | :|   0x1835987a7      mov   rdx, r15\r\n|    | :|   0x1835987aa      call  0x18359a140\r\n|    | :|   0x1835987af      mov   rcx, r14\r\n|    | :|   0x1835987b2      mov   rdx, r15\r\n|    | :|   0x1835987b5      call  0x183599ff0\r\n|    | :|   0x1835987ba      mov   r15, qword [rdi+0x188]\r\n|    | :|   0x1835987c1      mov   r14, qword [rdi+0x190]\r\n|    | :|   0x1835987c8      test  r15, r15\r\n|    |,===< 0x1835987cb      jz    0x1835987e2\r\n|    ||:|   0x1835987cd      mov   eax, 0x01\r\n|    ||:|   0x1835987d2      lock  xadd dword [r15], eax\r\n|    ||:|   0x1835987d7      cmp   eax, 0x7fffffff\r\n|   ,=====< 0x1835987dc      jz    0x1835988be\r\n|   ||`---> 0x1835987e2      mov   ecx, 0x48                           ; 'H' ; 72\r\n|   || :|   0x1835987e7      call  0x185f006b8\r\n|   || :|   0x1835987ec      mov   dword [rax], 0x01\r\n|   || :|   0x1835987f2      lea   rcx, qword [0x183599e50]\r\n|   || :|   0x1835987f9      mov   qword [rax+0x08], rcx\r\n|   || :|   0x1835987fd      lea   rcx, qword [0x182bf38a0]\r\n|   || :|   0x183598804      mov   qword [rax+0x10], rcx\r\n|   || :|   0x183598808      lea   rcx, qword [0x1832818a0]\r\n|   || :|   0x18359880f      mov   qword [rax+0x18], rcx\r\n|   || :|   0x183598813      lea   rcx, qword [0x183598a30]\r\n|   || :|   0x18359881a      mov   qword [rax+0x20], rcx\r\n|   || :|   0x18359881e      mov   dword [rax+0x28], 0x00\r\n|   || :|   0x183598825      mov   qword [rax+0x30], r15\r\n|   || :|   0x183598829      mov   qword [rax+0x38], r14\r\n|   || :|   0x18359882d      mov   rcx, qword [rdi+0x178]\r\n|   || :|   0x183598834      mov   qword [rax+0x40], rcx\r\n|   || :|   0x183598838      lea   rdx, qword [var_40h]\r\n|   || :|   0x18359883d      mov   qword [rdx], rax\r\n|   || :|   0x183598840      mov   rcx, rbx\r\n|   || :|   0x183598843      call  0x1835988d0\r\n|   || :|   0x183598848      mov   rcx, qword [rdi+0x170]\r\n|   || :|   0x18359884f      mov   rax, qword [rsi]\r\n|   || :|   0x183598852      lea   rdx, qword [var_48h]\r\n|   || :|   0x183598857      mov   qword [rdx], rax\r\n|   || :|   0x18359885a      mov   qword [rsi], 0x00\r\n|   || :|   0x183598861      call  0x18340d080\r\n|   || :|   0x183598866      mov   rcx, qword [rsi]\r\n|   || :|   0x183598869      test  rcx, rcx\r\n|   ||,===< 0x18359886c      jnz   0x1835988a0\r\n|   |||:|   ; CODE XREF from fcn.183598700 @ 0x1835988af\r\n| ..------> 0x18359886e      mov   rax, qword [var_30h]\r\n| ::|||:|   0x183598873      xor   rax, rsp\r\n| ::|||:|   0x183598876      mov   rcx, qword [0x191c71040]            ; [0x191c71040:8]=0x2b992ddfa232\r\n| ::|||:|   0x18359887d      cmp   rcx, rax\r\n| ========< 0x183598880      jnz   0x1835988b1\r\n| ::|||:|   0x183598882      add   rsp, 0x40\r\n| ::|||:|   0x183598886      pop   rbx\r\n| ::|||:|   0x183598887      pop   rdi\r\n| ::|||:|   0x183598888      pop   rsi\r\n| ::|||:|   0x183598889      pop   r14\r\n| ::|||:|   0x18359888b      pop   r15\r\n| ::|||:|   0x18359888d      ret\r\n| ::|||:`-> 0x18359888e      mov   rcx, r14\r\n| ::|||:    0x183598891      mov   edx, 0x01\r\n| ::|||:    0x183598896      call  0x184777f70\r\n| ::|||`==< 0x18359889b      jmp   0x183598763\r\n| ::||`---> 0x1835988a0      lock  dec dword [rcx]\r\n| `=======< 0x1835988a3      jnz   0x18359886e\r\n|  :||      0x1835988a5      mov   rax, qword [rcx+0x10]\r\n|  :||      0x1835988a9      call  qword [0x191c186b0]                 ; [0x191c186b0:8]=0x185f59da0\r\n|  `======< 0x1835988af      jmp   0x18359886e\r\n| --------> 0x1835988b1      mov   rcx, qword [var_30h]\r\n|   ||      0x1835988b6      xor   rcx, rsp\r\n|   ||      0x1835988b9      call  0x185f05b40\r\n|   `-----> 0x1835988be      int3\r\n..\r\n\\    `----> 0x1835988c1      int3\r\n[{\"offset\":6498649856,\"name\":\"fcn.183598700\",\"size\":450,\"is-pure\":false,\"realsz\":448,\"noreturn\":false,\"stackframe\":104,\"calltype\":\"ms\",\"cost\":142,\"cc\":12,\"loops\":3,\"bits\":64,\"type\":\"fcn\",\"nbbs\":16,\"edges\":22,\"ebbs\":3,\"signature\":\"fcn.183598700(int64_t arg1, int64_t arg2, int64_t arg3);\",\"minbound\":6498649856,\"maxbound\":6498650306,\"callrefs\":[{\"from\":6498649941,\"to\":6461021888,\"type\":\"CALL\"},{\"from\":6498649968,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6498650026,\"to\":6498656576,\"type\":\"CALL\"},{\"from\":6498650037,\"to\":6498656240,\"type\":\"CALL\"},{\"from\":6498650087,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6498650179,\"to\":6498650320,\"type\":\"CALL\"},{\"from\":6498650209,\"to\":6497030272,\"type\":\"CALL\"},{\"from\":6498650262,\"to\":6517391216,\"type\":\"CALL\"},{\"from\":6498650267,\"to\":6498649955,\"type\":\"CODE\"},{\"from\":6498650281,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6498650287,\"to\":6498650222,\"type\":\"CODE\"},{\"from\":6498650297,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6498649876,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6498650098,\"to\":6498655824,\"type\":\"DATA\"},{\"from\":6498650109,\"to\":6488537248,\"type\":\"DATA\"},{\"from\":6498650120,\"to\":6495410336,\"type\":\"DATA\"},{\"from\":6498650131,\"to\":6498650672,\"type\":\"DATA\"},{\"from\":6498650230,\"to\":6740709440,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6498650267,\"to\":6498649955,\"type\":\"CODE\"},{\"from\":6498650287,\"to\":6498650222,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":10,\"nlocals\":4,\"nargs\":3,\"stackvars\":[{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x183598700    |void fcn.183598700(int64_t arg1, int64_t arg2, int64_t arg3)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    int32_t iVar2;\r\n                   |    int64_t iVar3;\r\n                   |    undefined8 uVar4;\r\n                   |    code *pcVar5;\r\n                   |    int64_t iVar6;\r\n                   |    undefined auStack_68 [32];\r\n                   |    int64_t var_48h;\r\n                   |    int64_t var_40h;\r\n                   |    int64_t var_38h;\r\n                   |    int64_t var_30h;\r\n                   |    \r\n    0x18359871b    |    var_30h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_68;\r\n    0x183598723    |    iVar6 = *(int64_t *)(arg1 + 0x160);\r\n    0x18359872a    |    iVar3 = *(int64_t *)(arg1 + 0x170);\r\n    0x183598733    |    *(undefined8 *)(arg1 + 0x160) = 0;\r\n    0x18359873a    |    *(undefined4 *)(arg1 + 0x168) = 0;\r\n    0x183598744    |    *(undefined8 *)(arg1 + 0x170) = 0;\r\n    0x18359874e    |    if (iVar3 != 0) {\r\n    0x183598755    |        func_0x0001811b5ec0(iVar3, 1);\r\n                   |    }\r\n    0x18359875d    |    if (iVar6 != 0) {\r\n    0x183598896    |        func_0x000184777f70(iVar6, 1);\r\n                   |    }\r\n    0x183598770    |    iVar6 = (*(code *)0x185f59da0)(arg2);\r\n    0x183598780    |    if (*(int64_t *)(iVar6 + 0x20) != 0) {\r\n    0x183598787    |        LOCK();\r\n    0x183598787    |        piVar1 = (int32_t *)(*(int64_t *)(iVar6 + 0x20) + 8);\r\n    0x183598787    |        iVar2 = *piVar1;\r\n    0x183598787    |        *piVar1 = *piVar1 + 1;\r\n    0x183598787    |        UNLOCK();\r\n    0x183598792    |        if (iVar2 == 0x7fffffff) {\r\n    0x1835988c1    |            pcVar5 = (code *)swi(3);\r\n    0x1835988c1    |            (*pcVar5)();\r\n    0x1835988c1    |            return;\r\n                   |        }\r\n                   |    }\r\n    0x183598798    |    func_0x00018359a140(arg1 + 0x160, &var_38h);\r\n    0x1835987b5    |    func_0x000183599ff0(iVar6, &var_38h);\r\n    0x1835987ba    |    piVar1 = *(int32_t **)(arg1 + 0x188);\r\n    0x1835987c1    |    uVar4 = *(undefined8 *)(arg1 + 400);\r\n    0x1835987cb    |    if (piVar1 != (int32_t *)0x0) {\r\n    0x1835987d2    |        LOCK();\r\n    0x1835987d2    |        iVar2 = *piVar1;\r\n    0x1835987d2    |        *piVar1 = *piVar1 + 1;\r\n    0x1835987d2    |        UNLOCK();\r\n    0x1835987dc    |        if (iVar2 == 0x7fffffff) goto code_r0x0001835988be;\r\n                   |    }\r\n    0x1835987e7    |    var_40h = func_0x000185f006b8(0x48);\r\n    0x1835987ec    |    *(undefined4 *)var_40h = 1;\r\n    0x1835987f9    |    *(undefined8 *)(var_40h + 8) = 0x183599e50;\r\n    0x183598804    |    *(undefined8 *)(var_40h + 0x10) = 0x182bf38a0;\r\n    0x18359880f    |    *(undefined8 *)(var_40h + 0x18) = 0x1832818a0;\r\n    0x18359881a    |    *(undefined8 *)(var_40h + 0x20) = 0x183598a30;\r\n    0x18359881e    |    *(undefined4 *)(var_40h + 0x28) = 0;\r\n    0x183598825    |    *(int32_t **)(var_40h + 0x30) = piVar1;\r\n    0x183598829    |    *(undefined8 *)(var_40h + 0x38) = uVar4;\r\n    0x183598834    |    *(undefined8 *)(var_40h + 0x40) = *(undefined8 *)(arg1 + 0x178);\r\n    0x183598798    |    func_0x0001835988d0(arg1 + 0x160);\r\n    0x183598848    |    uVar4 = *(undefined8 *)(arg1 + 0x170);\r\n    0x18359884f    |    var_48h = *(int64_t *)arg3;\r\n    0x18359885a    |    *(undefined8 *)arg3 = 0;\r\n    0x183598861    |    func_0x00018340d080(uVar4);\r\n    0x183598866    |    piVar1 = *(int32_t **)arg3;\r\n    0x18359886c    |    if (piVar1 != (int32_t *)0x0) {\r\n    0x1835988a0    |        LOCK();\r\n    0x1835988a0    |        *piVar1 = *piVar1 + -1;\r\n    0x1835988a0    |        UNLOCK();\r\n    0x1835988a3    |        if (*piVar1 == 0) {\r\n    0x1835988a9    |            (*(code *)0x185f59da0)();\r\n                   |        }\r\n                   |    }\r\n    0x183598880    |    if (*(uint64_t *)0x191c71040 == (var_30h ^ (uint64_t)auStack_68)) {\r\n    0x18359888d    |        return;\r\n                   |    }\r\n    0x1835988b6    |    func_0x000185f05b40(var_30h ^ (uint64_t)auStack_68);\r\n                   |code_r0x0001835988be:\r\n    0x1835988be    |    pcVar5 = (code *)swi(3);\r\n    0x1835988be    |    (*pcVar5)();\r\n    0x1835988be    |    return;\r\n                   |}\r\n/ fcn.183598700(int64_t arg1, int64_t arg2, int64_t arg3);\r\n|           ; arg int64_t arg1 @ rcx\r\n|           ; arg int64_t arg2 @ rdx\r\n|           ; arg int64_t arg3 @ r8\r\n|           ; var int64_t var_48h @ stack - 0x48\r\n|           ; var int64_t var_40h @ stack - 0x40\r\n|           ; var int64_t var_38h @ stack - 0x38\r\n|           ; var int64_t var_30h @ stack - 0x30\r\n|           0x183598700      push  r15\r\n|           0x183598702      push  r14\r\n|           0x183598704      push  rsi\r\n|           0x183598705      push  rdi\r\n|           0x183598706      push  rbx\r\n|           0x183598707      sub   rsp, 0x40\r\n|           0x18359870b      mov   rsi, r8                             ; arg3\r\n|           0x18359870e      mov   rbx, rdx                            ; arg2\r\n|           0x183598711      mov   rdi, rcx                            ; arg1\r\n|           0x183598714      mov   rax, qword [0x191c71040]            ; [0x191c71040:8]=0x2b992ddfa232\r\n|           0x18359871b      xor   rax, rsp\r\n|           0x18359871e      mov   qword [var_30h], rax\r\n|           0x183598723      mov   r14, qword [rcx+0x160]              ; arg1\r\n|           0x18359872a      mov   rcx, qword [rcx+0x170]              ; arg1\r\n|           0x183598731      xor   eax, eax\r\n|           0x183598733      mov   qword [rdi+0x160], rax\r\n|           0x18359873a      mov   dword [rdi+0x168], 0x00\r\n|           0x183598744      mov   qword [rdi+0x170], rax\r\n|           0x18359874b      test  rcx, rcx                            ; arg1\r\n|       ,=< 0x18359874e      jz    0x18359875a\r\n|       |   0x183598750      mov   edx, 0x01\r\n|       |   0x183598755      call  0x1811b5ec0\r\n|       `-> 0x18359875a      test  r14, r14\r\n|       ,=< 0x18359875d      jnz   0x18359888e\r\n|       |   ; CODE XREF from fcn.183598700 @ 0x18359889b\r\n|      .--> 0x183598763      mov   rax, qword [rbx]\r\n|      :|   0x183598766      mov   rax, qword [rax+0x208]\r\n|      :|   0x18359876d      mov   rcx, rbx\r\n|      :|   0x183598770      call  qword [0x191c186b0]                 ; [0x191c186b0:8]=0x185f59da0\r\n|      :|   0x183598776      mov   r14, rax\r\n|      :|   0x183598779      mov   r8, qword [rax+0x20]\r\n|      :|   0x18359877d      test  r8, r8\r\n|     ,===< 0x183598780      jz    0x183598798\r\n|     |:|   0x183598782      mov   eax, 0x01\r\n|     |:|   0x183598787      lock  xadd dword [r8+0x08], eax\r\n|     |:|   0x18359878d      cmp   eax, 0x7fffffff\r\n|    ,====< 0x183598792      jz    0x1835988c1\r\n|    |`---> 0x183598798      lea   rbx, qword [rdi+0x160]\r\n|    | :|   0x18359879f      lea   r15, qword [var_38h]\r\n|    | :|   0x1835987a4      mov   rcx, rbx\r\n|    | :|   0x1835987a7      mov   rdx, r15\r\n|    | :|   0x1835987aa      call  0x18359a140\r\n|    | :|   0x1835987af      mov   rcx, r14\r\n|    | :|   0x1835987b2      mov   rdx, r15\r\n|    | :|   0x1835987b5      call  0x183599ff0\r\n|    | :|   0x1835987ba      mov   r15, qword [rdi+0x188]\r\n|    | :|   0x1835987c1      mov   r14, qword [rdi+0x190]\r\n|    | :|   0x1835987c8      test  r15, r15\r\n|    |,===< 0x1835987cb      jz    0x1835987e2\r\n|    ||:|   0x1835987cd      mov   eax, 0x01\r\n|    ||:|   0x1835987d2      lock  xadd dword [r15], eax\r\n|    ||:|   0x1835987d7      cmp   eax, 0x7fffffff\r\n|   ,=====< 0x1835987dc      jz    0x1835988be\r\n|   ||`---> 0x1835987e2      mov   ecx, 0x48                           ; 'H' ; 72\r\n|   || :|   0x1835987e7      call  0x185f006b8\r\n|   || :|   0x1835987ec      mov   dword [rax], 0x01\r\n|   || :|   0x1835987f2      lea   rcx, qword [0x183599e50]\r\n|   || :|   0x1835987f9      mov   qword [rax+0x08], rcx\r\n|   || :|   0x1835987fd      lea   rcx, qword [0x182bf38a0]\r\n|   || :|   0x183598804      mov   qword [rax+0x10], rcx\r\n|   || :|   0x183598808      lea   rcx, qword [0x1832818a0]\r\n|   || :|   0x18359880f      mov   qword [rax+0x18], rcx\r\n|   || :|   0x183598813      lea   rcx, qword [0x183598a30]\r\n|   || :|   0x18359881a      mov   qword [rax+0x20], rcx\r\n|   || :|   0x18359881e      mov   dword [rax+0x28], 0x00\r\n|   || :|   0x183598825      mov   qword [rax+0x30], r15\r\n|   || :|   0x183598829      mov   qword [rax+0x38], r14\r\n|   || :|   0x18359882d      mov   rcx, qword [rdi+0x178]\r\n|   || :|   0x183598834      mov   qword [rax+0x40], rcx\r\n|   || :|   0x183598838      lea   rdx, qword [var_40h]\r\n|   || :|   0x18359883d      mov   qword [rdx], rax\r\n|   || :|   0x183598840      mov   rcx, rbx\r\n|   || :|   0x183598843      call  0x1835988d0\r\n|   || :|   0x183598848      mov   rcx, qword [rdi+0x170]\r\n|   || :|   0x18359884f      mov   rax, qword [rsi]\r\n|   || :|   0x183598852      lea   rdx, qword [var_48h]\r\n|   || :|   0x183598857      mov   qword [rdx], rax\r\n|   || :|   0x18359885a      mov   qword [rsi], 0x00\r\n|   || :|   0x183598861      call  0x18340d080\r\n|   || :|   0x183598866      mov   rcx, qword [rsi]\r\n|   || :|   0x183598869      test  rcx, rcx\r\n|   ||,===< 0x18359886c      jnz   0x1835988a0\r\n|   |||:|   ; CODE XREF from fcn.183598700 @ 0x1835988af\r\n| ..------> 0x18359886e      mov   rax, qword [var_30h]\r\n| ::|||:|   0x183598873      xor   rax, rsp\r\n| ::|||:|   0x183598876      mov   rcx, qword [0x191c71040]            ; [0x191c71040:8]=0x2b992ddfa232\r\n| ::|||:|   0x18359887d      cmp   rcx, rax\r\n| ========< 0x183598880      jnz   0x1835988b1\r\n| ::|||:|   0x183598882      add   rsp, 0x40\r\n| ::|||:|   0x183598886      pop   rbx\r\n| ::|||:|   0x183598887      pop   rdi\r\n| ::|||:|   0x183598888      pop   rsi\r\n| ::|||:|   0x183598889      pop   r14\r\n| ::|||:|   0x18359888b      pop   r15\r\n| ::|||:|   0x18359888d      ret\r\n| ::|||:`-> 0x18359888e      mov   rcx, r14\r\n| ::|||:    0x183598891      mov   edx, 0x01\r\n| ::|||:    0x183598896      call  0x184777f70\r\n| ::|||`==< 0x18359889b      jmp   0x183598763\r\n| ::||`---> 0x1835988a0      lock  dec dword [rcx]\r\n| `=======< 0x1835988a3      jnz   0x18359886e\r\n|  :||      0x1835988a5      mov   rax, qword [rcx+0x10]\r\n|  :||      0x1835988a9      call  qword [0x191c186b0]                 ; [0x191c186b0:8]=0x185f59da0\r\n|  `======< 0x1835988af      jmp   0x18359886e\r\n| --------> 0x1835988b1      mov   rcx, qword [var_30h]\r\n|   ||      0x1835988b6      xor   rcx, rsp\r\n|   ||      0x1835988b9      call  0x185f05b40\r\n|   `-----> 0x1835988be      int3\r\n..\r\n\\    `----> 0x1835988c1      int3\r\n[{\"offset\":6498649856,\"name\":\"fcn.183598700\",\"size\":450,\"is-pure\":false,\"realsz\":448,\"noreturn\":false,\"stackframe\":104,\"calltype\":\"ms\",\"cost\":142,\"cc\":12,\"loops\":3,\"bits\":64,\"type\":\"fcn\",\"nbbs\":16,\"edges\":22,\"ebbs\":3,\"signature\":\"fcn.183598700(int64_t arg1, int64_t arg2, int64_t arg3);\",\"minbound\":6498649856,\"maxbound\":6498650306,\"callrefs\":[{\"from\":6498649941,\"to\":6461021888,\"type\":\"CALL\"},{\"from\":6498649968,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6498650026,\"to\":6498656576,\"type\":\"CALL\"},{\"from\":6498650037,\"to\":6498656240,\"type\":\"CALL\"},{\"from\":6498650087,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6498650179,\"to\":6498650320,\"type\":\"CALL\"},{\"from\":6498650209,\"to\":6497030272,\"type\":\"CALL\"},{\"from\":6498650262,\"to\":6517391216,\"type\":\"CALL\"},{\"from\":6498650267,\"to\":6498649955,\"type\":\"CODE\"},{\"from\":6498650281,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6498650287,\"to\":6498650222,\"type\":\"CODE\"},{\"from\":6498650297,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6498649876,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6498650098,\"to\":6498655824,\"type\":\"DATA\"},{\"from\":6498650109,\"to\":6488537248,\"type\":\"DATA\"},{\"from\":6498650120,\"to\":6495410336,\"type\":\"DATA\"},{\"from\":6498650131,\"to\":6498650672,\"type\":\"DATA\"},{\"from\":6498650230,\"to\":6740709440,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6498650267,\"to\":6498649955,\"type\":\"CODE\"},{\"from\":6498650287,\"to\":6498650222,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":10,\"nlocals\":4,\"nargs\":3,\"stackvars\":[{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5035ms"}}