{"ok":true,"data":{"evidence_id":"ev_cdb090f95d3173735fe6f8cbdf9d3cddccc8ed210531fc287ad5eda5516017cc","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x183598130;pdgo @ 0x183598130;afij @ 0x183598130","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x183598130;pdgo @ 0x183598130;afij @ 0x183598130","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"    0x183598130    |\r\n    0x183598130    |// WARNING: [rz-ghidra] Detected overlap for variable var_68h\r\n                   |\r\n    0x183598130    |void fcn.183598130(int64_t arg1)\r\n                   |{\r\n                   |    int32_t iVar1;\r\n                   |    int32_t *piVar2;\r\n                   |    int32_t *piVar3;\r\n                   |    code *pcVar4;\r\n                   |    char cVar5;\r\n                   |    int64_t iVar6;\r\n                   |    undefined4 *puVar7;\r\n                   |    undefined8 uVar8;\r\n                   |    undefined8 uVar9;\r\n                   |    int64_t iVar10;\r\n                   |    int64_t unaff_GS_OFFSET;\r\n                   |    undefined auStack_98 [32];\r\n                   |    int64_t var_78h;\r\n                   |    int64_t var_6ch;\r\n                   |    undefined4 uStack_64;\r\n                   |    int64_t var_60h;\r\n                   |    int64_t var_58h;\r\n                   |    undefined8 uStack_50;\r\n                   |    int64_t var_48h;\r\n                   |    \r\n    0x18359814a    |    var_48h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_98;\r\n    0x183598152    |    func_0x000184cb7790(arg1 + 0xa0);\r\n    0x183598162    |    if (*(char *)(arg1 + 0x40) == '\\x01') {\r\n    0x183598172    |        iVar6 = func_0x0001815af9b0(*(undefined4 *)(arg1 + 0x28), arg1 + 0x30, 0);\r\n    0x18359817e    |        if (*(char *)(arg1 + 0x40) == '\\x01') {\r\n    0x183598180    |            *(undefined *)(arg1 + 0x40) = 0;\r\n                   |        }\r\n    0x183598184    |        *(undefined *)(arg1 + 0x181) = 0;\r\n    0x18359818e    |        if (iVar6 != 0) {\r\n    0x1835981a1    |            cVar5 = (*(code *)0x185f59da0)(iVar6);\r\n    0x1835981a9    |            if (cVar5 != '\\0') {\r\n    0x1835981b4    |                var_6ch._0_4_ = 0;\r\n    0x1835981bd    |                cVar5 = func_0x0001835985d0(arg1);\r\n    0x1835981c4    |                if (cVar5 == '\\0') {\r\n    0x1835983d5    |                    if (*(int64_t *)(arg1 + 0x18) != 0) {\r\n    0x1835983e2    |                        uVar8 = (*(code *)0x185f59da0)();\r\n    0x18359840a    |                        if (*(int32_t *)\r\n    0x183598400    |                             (*(int64_t *)\r\n    0x1835983f7    |                               (*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) + 4) <\r\n    0x18359840a    |                            *(int32_t *)0x191dc18e8) {\r\n    0x18359854a    |                            func_0x000185f00fe8(0x191dc18e8);\r\n    0x183598556    |                            if (*(int32_t *)0x191dc18e8 == -1) {\r\n    0x18359855c    |                                uVar9 = func_0x0001802b58a0();\r\n    0x183598575    |                                func_0x0001815b9430(0x191dc18b0, 0x1906cd660, uVar9, 0);\r\n    0x18359857d    |                                *(undefined8 *)0x191dc18d0 = 0;\r\n    0x18359857d    |                                *(undefined8 *)0x191dc18d8 = 0;\r\n    0x183598584    |                                *(undefined8 *)0x191dc18e0 = 0;\r\n    0x183598596    |                                *(undefined8 *)0x191dc18b0 = 0x18fbe8f40;\r\n    0x1835985a4    |                                func_0x000185f00f7c(0x191dc18e8);\r\n                   |                            }\r\n                   |                        }\r\n    0x18359841d    |                        iVar10 = func_0x000184300b20(0x191dc18b0, uVar8, 1);\r\n    0x183598425    |                        if (iVar10 != 0) {\r\n    0x18359843d    |                            *(undefined4 **)0x0 = (undefined4 *)func_0x000185f006b8(0x30);\r\n    0x183598447    |                            var_60h = 0x20;\r\n    0x183598454    |                            var_58h = -0x7fffffffffffffd0;\r\n    0x18359847d    |                            if ((*(undefined4 **)0x0 + 8 < *(undefined4 **)0x0) ||\r\n    0x183598477    |                               ((undefined4 *)0x1906e3600 < *(undefined4 **)0x0 + 8 &&\r\n    0x183598470    |                                *(undefined4 **)0x0 < (undefined4 *)0x1906e3601)) goto code_r0x000183598541;\r\n    0x18359848e    |                            *(undefined8 *)(*(undefined4 **)0x0 + 4) = 0x696a6a6164656c61;\r\n    0x18359848e    |                            *(undefined8 *)(*(undefined4 **)0x0 + 6) = 0x6266616d686e6961;\r\n    0x183598499    |                            **(undefined4 **)0x0 = 0x69626f69;\r\n    0x183598499    |                            (*(undefined4 **)0x0)[1] = 0x62626a61;\r\n    0x183598499    |                            (*(undefined4 **)0x0)[2] = 0x696f676a;\r\n    0x183598499    |                            (*(undefined4 **)0x0)[3] = 0x6a696865;\r\n    0x18359849c    |                            *(undefined *)(*(undefined4 **)0x0 + 8) = 0;\r\n    0x1835984ab    |                            cVar5 = func_0x0001802b5c40(iVar10 + 8, (int64_t)&var_6ch + 4);\r\n    0x1835984b7    |                            if (var_58h < 0) {\r\n    0x1835984c6    |                                func_0x0001841dcbe0(stack0xffffffffffffff98, var_58h & 0x7fffffffffffffff);\r\n                   |                            }\r\n    0x1835984ce    |                            if (cVar5 != '\\0') goto code_r0x0001835981ca;\r\n                   |                        }\r\n                   |                    }\r\n    0x1835984db    |                    if (*(char *)(arg1 + 0x80) == '\\x01') {\r\n    0x1835984e1    |                        *(undefined *)(arg1 + 0x80) = 0;\r\n                   |                    }\r\n                   |                } else {\r\n                   |code_r0x0001835981ca:\r\n    0x1835981d1    |                    piVar2 = *(int32_t **)(arg1 + 0x188);\r\n    0x1835981d8    |                    iVar10 = *(int64_t *)(arg1 + 0x178) + 1;\r\n    0x1835981db    |                    *(int64_t *)(arg1 + 0x178) = iVar10;\r\n    0x1835981e2    |                    uVar8 = *(undefined8 *)(arg1 + 400);\r\n    0x1835981ec    |                    if (piVar2 != (int32_t *)0x0) {\r\n    0x1835981f3    |                        LOCK();\r\n    0x1835981f3    |                        iVar1 = *piVar2;\r\n    0x1835981f3    |                        *piVar2 = *piVar2 + 1;\r\n    0x1835981f3    |                        UNLOCK();\r\n    0x1835981fd    |                        if (iVar1 == 0x7fffffff) goto code_r0x0001835985bb;\r\n                   |                    }\r\n    0x18359820f    |                    puVar7 = (undefined4 *)func_0x000185f006b8(0x48);\r\n    0x183598217    |                    *puVar7 = 1;\r\n    0x183598224    |                    *(undefined8 *)(puVar7 + 2) = 0x183599e50;\r\n    0x18359822f    |                    *(undefined8 *)(puVar7 + 4) = 0x182bf38a0;\r\n    0x18359823a    |                    *(undefined8 *)(puVar7 + 6) = 0x1832818a0;\r\n    0x183598245    |                    *(undefined8 *)(puVar7 + 8) = 0x183598a30;\r\n    0x183598249    |                    puVar7[10] = 0;\r\n    0x183598251    |                    *(int32_t **)(puVar7 + 0xc) = piVar2;\r\n    0x183598255    |                    *(undefined8 *)(puVar7 + 0xe) = uVar8;\r\n    0x183598259    |                    *(int64_t *)(puVar7 + 0x10) = iVar10;\r\n    0x18359826b    |                    func_0x000184339cd0((int64_t)&var_6ch + 4, 0x190b98950, 0x190b988d0, 0x1b7);\r\n    0x18359827b    |                    piVar2 = *(int32_t **)(arg1 + 0x158);\r\n    0x183598282    |                    *(undefined4 **)(arg1 + 0x158) = puVar7;\r\n    0x18359828c    |                    if (piVar2 != (int32_t *)0x0) {\r\n    0x1835984ed    |                        LOCK();\r\n    0x1835984ed    |                        *piVar2 = *piVar2 + -1;\r\n    0x1835984ed    |                        UNLOCK();\r\n    0x1835984f1    |                        if (*piVar2 == 0) {\r\n    0x183598505    |                            if (*(int64_t *)(piVar2 + 4) == 0x182bf38a0) {\r\n    0x183598515    |                                piVar3 = *(int32_t **)(piVar2 + 0xc);\r\n    0x18359851c    |                                if (piVar3 != (int32_t *)0x0) {\r\n    0x183598530    |                                    LOCK();\r\n    0x183598530    |                                    *piVar3 = *piVar3 + -1;\r\n    0x183598530    |                                    UNLOCK();\r\n    0x183598533    |                                    if (*piVar3 == 0) {\r\n    0x18359853a    |                                        func_0x0001841dcbe0(piVar3, 8);\r\n                   |                                    }\r\n                   |                                }\r\n    0x183598526    |                                func_0x0001841dcbe0(piVar2, 0x48);\r\n                   |                            } else {\r\n    0x18359850a    |                                (*(code *)0x185f59da0)(piVar2);\r\n                   |                            }\r\n                   |                        }\r\n                   |                    }\r\n    0x18359829b    |                    *(undefined4 *)(arg1 + 0x120) = (undefined4)var_58h;\r\n    0x1835982a5    |                    *(undefined4 *)(arg1 + 0x110) = var_6ch._4_4_;\r\n    0x1835982a5    |                    *(undefined4 *)(arg1 + 0x114) = uStack_64;\r\n    0x1835982a5    |                    *(undefined4 *)(arg1 + 0x118) = (undefined4)var_60h;\r\n    0x1835982a5    |                    *(undefined4 *)(arg1 + 0x11c) = var_60h._4_4_;\r\n    0x1835982b0    |                    *(undefined8 *)(arg1 + 0x128) = uStack_50;\r\n    0x1835982b7    |                    *(undefined8 *)(arg1 + 0x140) = 5000000;\r\n    0x183598203    |                    func_0x00018477a0a0(arg1 + 0x100);\r\n    0x1835982da    |                    (*(code *)0x185f59da0)(iVar6, (int64_t)&var_6ch + 4);\r\n    0x1835982e0    |                    puVar7 = (undefined4 *)(arg1 + 0x48);\r\n    0x1835982e8    |                    if (*(char *)(arg1 + 0x60) == '\\x01') {\r\n    0x18359830f    |                        *(int64_t *)(arg1 + 0x58) = var_58h;\r\n    0x183598318    |                        *puVar7 = var_6ch._4_4_;\r\n    0x183598318    |                        *(undefined4 *)(arg1 + 0x4c) = uStack_64;\r\n    0x183598318    |                        *(undefined4 *)(arg1 + 0x50) = (undefined4)var_60h;\r\n    0x183598318    |                        *(undefined4 *)(arg1 + 0x54) = var_60h._4_4_;\r\n                   |                    } else {\r\n    0x1835982ed    |                        if (puVar7 == (undefined4 *)0x0) {\r\n                   |code_r0x000183598541:\r\n    0x183598541    |    // WARNING: Does not return\r\n    0x183598541    |                            pcVar4 = (code *)invalidInstructionException();\r\n    0x183598541    |                            (*pcVar4)();\r\n                   |                        }\r\n    0x1835982f8    |                        *(int64_t *)(arg1 + 0x58) = var_58h;\r\n    0x183598301    |                        *puVar7 = var_6ch._4_4_;\r\n    0x183598301    |                        *(undefined4 *)(arg1 + 0x4c) = uStack_64;\r\n    0x183598301    |                        *(undefined4 *)(arg1 + 0x50) = (undefined4)var_60h;\r\n    0x183598301    |                        *(undefined4 *)(arg1 + 0x54) = var_60h._4_4_;\r\n    0x183598304    |                        *(undefined *)(arg1 + 0x60) = 1;\r\n                   |                    }\r\n    0x18359831b    |                    piVar2 = *(int32_t **)(arg1 + 0x188);\r\n    0x183598322    |                    uVar8 = *(undefined8 *)(arg1 + 400);\r\n    0x18359832c    |                    if (piVar2 != (int32_t *)0x0) {\r\n    0x183598333    |                        LOCK();\r\n    0x183598333    |                        iVar1 = *piVar2;\r\n    0x183598333    |                        *piVar2 = *piVar2 + 1;\r\n    0x183598333    |                        UNLOCK();\r\n    0x18359833d    |                        if (iVar1 == 0x7fffffff) {\r\n    0x1835985be    |                            pcVar4 = (code *)swi(3);\r\n    0x1835985be    |                            (*pcVar4)();\r\n    0x1835985be    |                            return;\r\n                   |                        }\r\n                   |                    }\r\n    0x183598348    |                    var_78h = func_0x000185f006b8(0x48);\r\n    0x18359834d    |                    *(undefined4 *)var_78h = 1;\r\n    0x18359835a    |                    *(undefined8 *)(var_78h + 8) = 0x183599ea0;\r\n    0x183598365    |                    *(undefined8 *)(var_78h + 0x10) = 0x182bf38a0;\r\n    0x183598370    |                    *(undefined8 *)(var_78h + 0x18) = 0x1832818a0;\r\n    0x18359837b    |                    *(undefined8 *)(var_78h + 0x20) = 0x183598e00;\r\n    0x18359837f    |                    *(undefined4 *)(var_78h + 0x28) = 0;\r\n    0x183598386    |                    *(int32_t **)(var_78h + 0x30) = piVar2;\r\n    0x18359838a    |                    *(undefined8 *)(var_78h + 0x38) = uVar8;\r\n    0x18359838e    |                    *(int64_t *)(var_78h + 0x40) = iVar10;\r\n    0x1835983a0    |                    func_0x000183598700(arg1, iVar6);\r\n                   |                }\r\n                   |            }\r\n                   |        }\r\n                   |    }\r\n    0x1835983b7    |    if (*(uint64_t *)0x191c71040 == (var_48h ^ (uint64_t)auStack_98)) {\r\n    0x1835983cd    |        return;\r\n                   |    }\r\n    0x1835985b3    |    func_0x000185f05b40(var_48h ^ (uint64_t)auStack_98);\r\n                   |code_r0x0001835985bb:\r\n    0x1835985bb    |    pcVar4 = (code *)swi(3);\r\n    0x1835985bb    |    (*pcVar4)();\r\n    0x1835985bb    |    return;\r\n                   |}\r\n[{\"offset\":6498648368,\"name\":\"fcn.183598130\",\"size\":1167,\"is-pure\":false,\"realsz\":1165,\"noreturn\":false,\"stackframe\":152,\"calltype\":\"ms\",\"cost\":339,\"cc\":30,\"loops\":10,\"bits\":64,\"type\":\"fcn\",\"nbbs\":41,\"edges\":63,\"ebbs\":4,\"signature\":\"fcn.183598130(int64_t arg1);\",\"minbound\":6498648368,\"maxbound\":6498649535,\"callrefs\":[{\"from\":6498648409,\"to\":6522894224,\"type\":\"CALL\"},{\"from\":6498648434,\"to\":6465190320,\"type\":\"CALL\"},{\"from\":6498648481,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6498648509,\"to\":6498649552,\"type\":\"CALL\"},{\"from\":6498648591,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6498648694,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6498648773,\"to\":6517399712,\"type\":\"CALL\"},{\"from\":6498648794,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6498648840,\"to\":6498648859,\"type\":\"CODE\"},{\"from\":6498648904,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6498648992,\"to\":6498649856,\"type\":\"CALL\"},{\"from\":6498649058,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6498649117,\"to\":6512708384,\"type\":\"CALL\"},{\"from\":6498649149,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6498649259,\"to\":6445292608,\"type\":\"CALL\"},{\"from\":6498649286,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6498649320,\"to\":6498648997,\"type\":\"CODE\"},{\"from\":6498649354,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6498649360,\"to\":6498648722,\"type\":\"CODE\"},{\"from\":6498649382,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6498649387,\"to\":6498648722,\"type\":\"CODE\"},{\"from\":6498649402,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6498649407,\"to\":6498649374,\"type\":\"CODE\"},{\"from\":6498649418,\"to\":6542069736,\"type\":\"CALL\"},{\"from\":6498649436,\"to\":6445291680,\"type\":\"CALL\"},{\"from\":6498649461,\"to\":6465229872,\"type\":\"CALL\"},{\"from\":6498649508,\"to\":6542069628,\"type\":\"CALL\"},{\"from\":6498649513,\"to\":6498649104,\"type\":\"CODE\"},{\"from\":6498649526,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6498648387,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6498648605,\"to\":6498655824,\"type\":\"DATA\"},{\"from\":6498648616,\"to\":6488537248,\"type\":\"DATA\"},{\"from\":6498648627,\"to\":6495410336,\"type\":\"DATA\"},{\"from\":6498648638,\"to\":6498650672,\"type\":\"DATA\"},{\"from\":6498648669,\"to\":6723045712,\"type\":\"DATA\"},{\"from\":6498648676,\"to\":6723045584,\"type\":\"DATA\"},{\"from\":6498648915,\"to\":6498655904,\"type\":\"DATA\"},{\"from\":6498648926,\"to\":6488537248,\"type\":\"DATA\"},{\"from\":6498648937,\"to\":6495410336,\"type\":\"DATA\"},{\"from\":6498648948,\"to\":6498651648,\"type\":\"DATA\"},{\"from\":6498649005,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6498649067,\"to\":6742087912,\"type\":\"DATA\"},{\"from\":6498649073,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6498649104,\"to\":6742087856,\"type\":\"DATA\"},{\"from\":6498649190,\"to\":6718109184,\"type\":\"DATA\"},{\"from\":6498649223,\"to\":6718109200,\"type\":\"DATA\"},{\"from\":6498649234,\"to\":6718109184,\"type\":\"DATA\"},{\"from\":6498649339,\"to\":6488537248,\"type\":\"DATA\"},{\"from\":6498649411,\"to\":6742087912,\"type\":\"DATA\"},{\"from\":6498649423,\"to\":6742087912,\"type\":\"DATA\"},{\"from\":6498649441,\"to\":6742087856,\"type\":\"DATA\"},{\"from\":6498649448,\"to\":6718019168,\"type\":\"DATA\"},{\"from\":6498649469,\"to\":6742087888,\"type\":\"DATA\"},{\"from\":6498649476,\"to\":6742087904,\"type\":\"DATA\"},{\"from\":6498649487,\"to\":6706597696,\"type\":\"DATA\"},{\"from\":6498649494,\"to\":6742087856,\"type\":\"DATA\"},{\"from\":6498649501,\"to\":6742087912,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6498648840,\"to\":6498648859,\"type\":\"CODE\"},{\"from\":6498649320,\"to\":6498648997,\"type\":\"CODE\"},{\"from\":6498649360,\"to\":6498648722,\"type\":\"CODE\"},{\"from\":6498649387,\"to\":6498648722,\"type\":\"CODE\"},{\"from\":6498649407,\"to\":6498649374,\"type\":\"CODE\"},{\"from\":6498649513,\"to\":6498649104,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":6,\"outdegree\":23,\"nlocals\":6,\"nargs\":1,\"stackvars\":[{\"name\":\"var_78h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-120}},{\"name\":\"var_6ch\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-108}},{\"name\":\"var_68h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-104}},{\"name\":\"var_60h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-96}},{\"name\":\"var_58h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-88}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"    0x183598130    |\r\n    0x183598130    |// WARNING: [rz-ghidra] Detected overlap for variable var_68h\r\n                   |\r\n    0x183598130    |void fcn.183598130(int64_t arg1)\r\n                   |{\r\n                   |    int32_t iVar1;\r\n                   |    int32_t *piVar2;\r\n                   |    int32_t *piVar3;\r\n                   |    code *pcVar4;\r\n                   |    char cVar5;\r\n                   |    int64_t iVar6;\r\n                   |    undefined4 *puVar7;\r\n                   |    undefined8 uVar8;\r\n                   |    undefined8 uVar9;\r\n                   |    int64_t iVar10;\r\n                   |    int64_t unaff_GS_OFFSET;\r\n                   |    undefined auStack_98 [32];\r\n                   |    int64_t var_78h;\r\n                   |    int64_t var_6ch;\r\n                   |    undefined4 uStack_64;\r\n                   |    int64_t var_60h;\r\n                   |    int64_t var_58h;\r\n                   |    undefined8 uStack_50;\r\n                   |    int64_t var_48h;\r\n                   |    \r\n    0x18359814a    |    var_48h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_98;\r\n    0x183598152    |    func_0x000184cb7790(arg1 + 0xa0);\r\n    0x183598162    |    if (*(char *)(arg1 + 0x40) == '\\x01') {\r\n    0x183598172    |        iVar6 = func_0x0001815af9b0(*(undefined4 *)(arg1 + 0x28), arg1 + 0x30, 0);\r\n    0x18359817e    |        if (*(char *)(arg1 + 0x40) == '\\x01') {\r\n    0x183598180    |            *(undefined *)(arg1 + 0x40) = 0;\r\n                   |        }\r\n    0x183598184    |        *(undefined *)(arg1 + 0x181) = 0;\r\n    0x18359818e    |        if (iVar6 != 0) {\r\n    0x1835981a1    |            cVar5 = (*(code *)0x185f59da0)(iVar6);\r\n    0x1835981a9    |            if (cVar5 != '\\0') {\r\n    0x1835981b4    |                var_6ch._0_4_ = 0;\r\n    0x1835981bd    |                cVar5 = func_0x0001835985d0(arg1);\r\n    0x1835981c4    |                if (cVar5 == '\\0') {\r\n    0x1835983d5    |                    if (*(int64_t *)(arg1 + 0x18) != 0) {\r\n    0x1835983e2    |                        uVar8 = (*(code *)0x185f59da0)();\r\n    0x18359840a    |                        if (*(int32_t *)\r\n    0x183598400    |                             (*(int64_t *)\r\n    0x1835983f7    |                               (*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) + 4) <\r\n    0x18359840a    |                            *(int32_t *)0x191dc18e8) {\r\n    0x18359854a    |                            func_0x000185f00fe8(0x191dc18e8);\r\n    0x183598556    |                            if (*(int32_t *)0x191dc18e8 == -1) {\r\n    0x18359855c    |                                uVar9 = func_0x0001802b58a0();\r\n    0x183598575    |                                func_0x0001815b9430(0x191dc18b0, 0x1906cd660, uVar9, 0);\r\n    0x18359857d    |                                *(undefined8 *)0x191dc18d0 = 0;\r\n    0x18359857d    |                                *(undefined8 *)0x191dc18d8 = 0;\r\n    0x183598584    |                                *(undefined8 *)0x191dc18e0 = 0;\r\n    0x183598596    |                                *(undefined8 *)0x191dc18b0 = 0x18fbe8f40;\r\n    0x1835985a4    |                                func_0x000185f00f7c(0x191dc18e8);\r\n                   |                            }\r\n                   |                        }\r\n    0x18359841d    |                        iVar10 = func_0x000184300b20(0x191dc18b0, uVar8, 1);\r\n    0x183598425    |                        if (iVar10 != 0) {\r\n    0x18359843d    |                            *(undefined4 **)0x0 = (undefined4 *)func_0x000185f006b8(0x30);\r\n    0x183598447    |                            var_60h = 0x20;\r\n    0x183598454    |                            var_58h = -0x7fffffffffffffd0;\r\n    0x18359847d    |                            if ((*(undefined4 **)0x0 + 8 < *(undefined4 **)0x0) ||\r\n    0x183598477    |                               ((undefined4 *)0x1906e3600 < *(undefined4 **)0x0 + 8 &&\r\n    0x183598470    |                                *(undefined4 **)0x0 < (undefined4 *)0x1906e3601)) goto code_r0x000183598541;\r\n    0x18359848e    |                            *(undefined8 *)(*(undefined4 **)0x0 + 4) = 0x696a6a6164656c61;\r\n    0x18359848e    |                            *(undefined8 *)(*(undefined4 **)0x0 + 6) = 0x6266616d686e6961;\r\n    0x183598499    |                            **(undefined4 **)0x0 = 0x69626f69;\r\n    0x183598499    |                            (*(undefined4 **)0x0)[1] = 0x62626a61;\r\n    0x183598499    |                            (*(undefined4 **)0x0)[2] = 0x696f676a;\r\n    0x183598499    |                            (*(undefined4 **)0x0)[3] = 0x6a696865;\r\n    0x18359849c    |                            *(undefined *)(*(undefined4 **)0x0 + 8) = 0;\r\n    0x1835984ab    |                            cVar5 = func_0x0001802b5c40(iVar10 + 8, (int64_t)&var_6ch + 4);\r\n    0x1835984b7    |                            if (var_58h < 0) {\r\n    0x1835984c6    |                                func_0x0001841dcbe0(stack0xffffffffffffff98, var_58h & 0x7fffffffffffffff);\r\n                   |                            }\r\n    0x1835984ce    |                            if (cVar5 != '\\0') goto code_r0x0001835981ca;\r\n                   |                        }\r\n                   |                    }\r\n    0x1835984db    |                    if (*(char *)(arg1 + 0x80) == '\\x01') {\r\n    0x1835984e1    |                        *(undefined *)(arg1 + 0x80) = 0;\r\n                   |                    }\r\n                   |                } else {\r\n                   |code_r0x0001835981ca:\r\n    0x1835981d1    |                    piVar2 = *(int32_t **)(arg1 + 0x188);\r\n    0x1835981d8    |                    iVar10 = *(int64_t *)(arg1 + 0x178) + 1;\r\n    0x1835981db    |                    *(int64_t *)(arg1 + 0x178) = iVar10;\r\n    0x1835981e2    |                    uVar8 = *(undefined8 *)(arg1 + 400);\r\n    0x1835981ec    |                    if (piVar2 != (int32_t *)0x0) {\r\n    0x1835981f3    |                        LOCK();\r\n    0x1835981f3    |                        iVar1 = *piVar2;\r\n    0x1835981f3    |                        *piVar2 = *piVar2 + 1;\r\n    0x1835981f3    |                        UNLOCK();\r\n    0x1835981fd    |                        if (iVar1 == 0x7fffffff) goto code_r0x0001835985bb;\r\n                   |                    }\r\n    0x18359820f    |                    puVar7 = (undefined4 *)func_0x000185f006b8(0x48);\r\n    0x183598217    |                    *puVar7 = 1;\r\n    0x183598224    |                    *(undefined8 *)(puVar7 + 2) = 0x183599e50;\r\n    0x18359822f    |                    *(undefined8 *)(puVar7 + 4) = 0x182bf38a0;\r\n    0x18359823a    |                    *(undefined8 *)(puVar7 + 6) = 0x1832818a0;\r\n    0x183598245    |                    *(undefined8 *)(puVar7 + 8) = 0x183598a30;\r\n    0x183598249    |                    puVar7[10] = 0;\r\n    0x183598251    |                    *(int32_t **)(puVar7 + 0xc) = piVar2;\r\n    0x183598255    |                    *(undefined8 *)(puVar7 + 0xe) = uVar8;\r\n    0x183598259    |                    *(int64_t *)(puVar7 + 0x10) = iVar10;\r\n    0x18359826b    |                    func_0x000184339cd0((int64_t)&var_6ch + 4, 0x190b98950, 0x190b988d0, 0x1b7);\r\n    0x18359827b    |                    piVar2 = *(int32_t **)(arg1 + 0x158);\r\n    0x183598282    |                    *(undefined4 **)(arg1 + 0x158) = puVar7;\r\n    0x18359828c    |                    if (piVar2 != (int32_t *)0x0) {\r\n    0x1835984ed    |                        LOCK();\r\n    0x1835984ed    |                        *piVar2 = *piVar2 + -1;\r\n    0x1835984ed    |                        UNLOCK();\r\n    0x1835984f1    |                        if (*piVar2 == 0) {\r\n    0x183598505    |                            if (*(int64_t *)(piVar2 + 4) == 0x182bf38a0) {\r\n    0x183598515    |                                piVar3 = *(int32_t **)(piVar2 + 0xc);\r\n    0x18359851c    |                                if (piVar3 != (int32_t *)0x0) {\r\n    0x183598530    |                                    LOCK();\r\n    0x183598530    |                                    *piVar3 = *piVar3 + -1;\r\n    0x183598530    |                                    UNLOCK();\r\n    0x183598533    |                                    if (*piVar3 == 0) {\r\n    0x18359853a    |                                        func_0x0001841dcbe0(piVar3, 8);\r\n                   |                                    }\r\n                   |                                }\r\n    0x183598526    |                                func_0x0001841dcbe0(piVar2, 0x48);\r\n                   |                            } else {\r\n    0x18359850a    |                                (*(code *)0x185f59da0)(piVar2);\r\n                   |                            }\r\n                   |                        }\r\n                   |                    }\r\n    0x18359829b    |                    *(undefined4 *)(arg1 + 0x120) = (undefined4)var_58h;\r\n    0x1835982a5    |                    *(undefined4 *)(arg1 + 0x110) = var_6ch._4_4_;\r\n    0x1835982a5    |                    *(undefined4 *)(arg1 + 0x114) = uStack_64;\r\n    0x1835982a5    |                    *(undefined4 *)(arg1 + 0x118) = (undefined4)var_60h;\r\n    0x1835982a5    |                    *(undefined4 *)(arg1 + 0x11c) = var_60h._4_4_;\r\n    0x1835982b0    |                    *(undefined8 *)(arg1 + 0x128) = uStack_50;\r\n    0x1835982b7    |                    *(undefined8 *)(arg1 + 0x140) = 5000000;\r\n    0x183598203    |                    func_0x00018477a0a0(arg1 + 0x100);\r\n    0x1835982da    |                    (*(code *)0x185f59da0)(iVar6, (int64_t)&var_6ch + 4);\r\n    0x1835982e0    |                    puVar7 = (undefined4 *)(arg1 + 0x48);\r\n    0x1835982e8    |                    if (*(char *)(arg1 + 0x60) == '\\x01') {\r\n    0x18359830f    |                        *(int64_t *)(arg1 + 0x58) = var_58h;\r\n    0x183598318    |                        *puVar7 = var_6ch._4_4_;\r\n    0x183598318    |                        *(undefined4 *)(arg1 + 0x4c) = uStack_64;\r\n    0x183598318    |                        *(undefined4 *)(arg1 + 0x50) = (undefined4)var_60h;\r\n    0x183598318    |                        *(undefined4 *)(arg1 + 0x54) = var_60h._4_4_;\r\n                   |                    } else {\r\n    0x1835982ed    |                        if (puVar7 == (undefined4 *)0x0) {\r\n                   |code_r0x000183598541:\r\n    0x183598541    |    // WARNING: Does not return\r\n    0x183598541    |                            pcVar4 = (code *)invalidInstructionException();\r\n    0x183598541    |                            (*pcVar4)();\r\n                   |                        }\r\n    0x1835982f8    |                        *(int64_t *)(arg1 + 0x58) = var_58h;\r\n    0x183598301    |                        *puVar7 = var_6ch._4_4_;\r\n    0x183598301    |                        *(undefined4 *)(arg1 + 0x4c) = uStack_64;\r\n    0x183598301    |                        *(undefined4 *)(arg1 + 0x50) = (undefined4)var_60h;\r\n    0x183598301    |                        *(undefined4 *)(arg1 + 0x54) = var_60h._4_4_;\r\n    0x183598304    |                        *(undefined *)(arg1 + 0x60) = 1;\r\n                   |                    }\r\n    0x18359831b    |                    piVar2 = *(int32_t **)(arg1 + 0x188);\r\n    0x183598322    |                    uVar8 = *(undefined8 *)(arg1 + 400);\r\n    0x18359832c    |                    if (piVar2 != (int32_t *)0x0) {\r\n    0x183598333    |                        LOCK();\r\n    0x183598333    |                        iVar1 = *piVar2;\r\n    0x183598333    |                        *piVar2 = *piVar2 + 1;\r\n    0x183598333    |                        UNLOCK();\r\n    0x18359833d    |                        if (iVar1 == 0x7fffffff) {\r\n    0x1835985be    |                            pcVar4 = (code *)swi(3);\r\n    0x1835985be    |                            (*pcVar4)();\r\n    0x1835985be    |                            return;\r\n                   |                        }\r\n                   |                    }\r\n    0x183598348    |                    var_78h = func_0x000185f006b8(0x48);\r\n    0x18359834d    |                    *(undefined4 *)var_78h = 1;\r\n    0x18359835a    |                    *(undefined8 *)(var_78h + 8) = 0x183599ea0;\r\n    0x183598365    |                    *(undefined8 *)(var_78h + 0x10) = 0x182bf38a0;\r\n    0x183598370    |                    *(undefined8 *)(var_78h + 0x18) = 0x1832818a0;\r\n    0x18359837b    |                    *(undefined8 *)(var_78h + 0x20) = 0x183598e00;\r\n    0x18359837f    |                    *(undefined4 *)(var_78h + 0x28) = 0;\r\n    0x183598386    |                    *(int32_t **)(var_78h + 0x30) = piVar2;\r\n    0x18359838a    |                    *(undefined8 *)(var_78h + 0x38) = uVar8;\r\n    0x18359838e    |                    *(int64_t *)(var_78h + 0x40) = iVar10;\r\n    0x1835983a0    |                    func_0x000183598700(arg1, iVar6);\r\n                   |                }\r\n                   |            }\r\n                   |        }\r\n                   |    }\r\n    0x1835983b7    |    if (*(uint64_t *)0x191c71040 == (var_48h ^ (uint64_t)auStack_98)) {\r\n    0x1835983cd    |        return;\r\n                   |    }\r\n    0x1835985b3    |    func_0x000185f05b40(var_48h ^ (uint64_t)auStack_98);\r\n                   |code_r0x0001835985bb:\r\n    0x1835985bb    |    pcVar4 = (code *)swi(3);\r\n    0x1835985bb    |    (*pcVar4)();\r\n    0x1835985bb    |    return;\r\n                   |}\r\n[{\"offset\":6498648368,\"name\":\"fcn.183598130\",\"size\":1167,\"is-pure\":false,\"realsz\":1165,\"noreturn\":false,\"stackframe\":152,\"calltype\":\"ms\",\"cost\":339,\"cc\":30,\"loops\":10,\"bits\":64,\"type\":\"fcn\",\"nbbs\":41,\"edges\":63,\"ebbs\":4,\"signature\":\"fcn.183598130(int64_t arg1);\",\"minbound\":6498648368,\"maxbound\":6498649535,\"callrefs\":[{\"from\":6498648409,\"to\":6522894224,\"type\":\"CALL\"},{\"from\":6498648434,\"to\":6465190320,\"type\":\"CALL\"},{\"from\":6498648481,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6498648509,\"to\":6498649552,\"type\":\"CALL\"},{\"from\":6498648591,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6498648694,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6498648773,\"to\":6517399712,\"type\":\"CALL\"},{\"from\":6498648794,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6498648840,\"to\":6498648859,\"type\":\"CODE\"},{\"from\":6498648904,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6498648992,\"to\":6498649856,\"type\":\"CALL\"},{\"from\":6498649058,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6498649117,\"to\":6512708384,\"type\":\"CALL\"},{\"from\":6498649149,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6498649259,\"to\":6445292608,\"type\":\"CALL\"},{\"from\":6498649286,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6498649320,\"to\":6498648997,\"type\":\"CODE\"},{\"from\":6498649354,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6498649360,\"to\":6498648722,\"type\":\"CODE\"},{\"from\":6498649382,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6498649387,\"to\":6498648722,\"type\":\"CODE\"},{\"from\":6498649402,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6498649407,\"to\":6498649374,\"type\":\"CODE\"},{\"from\":6498649418,\"to\":6542069736,\"type\":\"CALL\"},{\"from\":6498649436,\"to\":6445291680,\"type\":\"CALL\"},{\"from\":6498649461,\"to\":6465229872,\"type\":\"CALL\"},{\"from\":6498649508,\"to\":6542069628,\"type\":\"CALL\"},{\"from\":6498649513,\"to\":6498649104,\"type\":\"CODE\"},{\"from\":6498649526,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6498648387,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6498648605,\"to\":6498655824,\"type\":\"DATA\"},{\"from\":6498648616,\"to\":6488537248,\"type\":\"DATA\"},{\"from\":6498648627,\"to\":6495410336,\"type\":\"DATA\"},{\"from\":6498648638,\"to\":6498650672,\"type\":\"DATA\"},{\"from\":6498648669,\"to\":6723045712,\"type\":\"DATA\"},{\"from\":6498648676,\"to\":6723045584,\"type\":\"DATA\"},{\"from\":6498648915,\"to\":6498655904,\"type\":\"DATA\"},{\"from\":6498648926,\"to\":6488537248,\"type\":\"DATA\"},{\"from\":6498648937,\"to\":6495410336,\"type\":\"DATA\"},{\"from\":6498648948,\"to\":6498651648,\"type\":\"DATA\"},{\"from\":6498649005,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6498649067,\"to\":6742087912,\"type\":\"DATA\"},{\"from\":6498649073,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6498649104,\"to\":6742087856,\"type\":\"DATA\"},{\"from\":6498649190,\"to\":6718109184,\"type\":\"DATA\"},{\"from\":6498649223,\"to\":6718109200,\"type\":\"DATA\"},{\"from\":6498649234,\"to\":6718109184,\"type\":\"DATA\"},{\"from\":6498649339,\"to\":6488537248,\"type\":\"DATA\"},{\"from\":6498649411,\"to\":6742087912,\"type\":\"DATA\"},{\"from\":6498649423,\"to\":6742087912,\"type\":\"DATA\"},{\"from\":6498649441,\"to\":6742087856,\"type\":\"DATA\"},{\"from\":6498649448,\"to\":6718019168,\"type\":\"DATA\"},{\"from\":6498649469,\"to\":6742087888,\"type\":\"DATA\"},{\"from\":6498649476,\"to\":6742087904,\"type\":\"DATA\"},{\"from\":6498649487,\"to\":6706597696,\"type\":\"DATA\"},{\"from\":6498649494,\"to\":6742087856,\"type\":\"DATA\"},{\"from\":6498649501,\"to\":6742087912,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6498648840,\"to\":6498648859,\"type\":\"CODE\"},{\"from\":6498649320,\"to\":6498648997,\"type\":\"CODE\"},{\"from\":6498649360,\"to\":6498648722,\"type\":\"CODE\"},{\"from\":6498649387,\"to\":6498648722,\"type\":\"CODE\"},{\"from\":6498649407,\"to\":6498649374,\"type\":\"CODE\"},{\"from\":6498649513,\"to\":6498649104,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":6,\"outdegree\":23,\"nlocals\":6,\"nargs\":1,\"stackvars\":[{\"name\":\"var_78h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-120}},{\"name\":\"var_6ch\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-108}},{\"name\":\"var_68h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-104}},{\"name\":\"var_60h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-96}},{\"name\":\"var_58h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-88}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5178ms"}}