{"ok":true,"data":{"evidence_id":"ev_5bf0db5c2aa0e061dafdd813022428b4cda739a1c8dd90378f8a5333abb4ec68","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x18565fc70;pdgo @ 0x18565fc70;afij @ 0x18565fc70","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x18565fc70;pdgo @ 0x18565fc70;afij @ 0x18565fc70","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"    0x18565fc70    |\r\n    0x18565fc70    |// WARNING: [rz-ghidra] Detected overlap for variable var_28h\r\n    0x18565fc70    |// WARNING: [rz-ghidra] Detected overlap for variable var_24h\r\n    0x18565fc70    |// WARNING: [rz-ghidra] Detected overlap for variable var_30h\r\n    0x18565fc70    |// WARNING: [rz-ghidra] Detected overlap for variable var_40h\r\n    0x18565fc70    |// WARNING: [rz-ghidra] Detected overlap for variable var_48h\r\n                   |\r\n    0x18565fc70    |undefined8 fcn.18565fc70(int64_t arg1)\r\n                   |{\r\n                   |    uint64_t *puVar1;\r\n                   |    uint64_t uVar2;\r\n                   |    code *pcVar3;\r\n                   |    char cVar4;\r\n                   |    char cVar5;\r\n                   |    undefined8 uVar6;\r\n                   |    undefined8 *puVar7;\r\n                   |    undefined auStack_78 [32];\r\n                   |    int64_t var_58h;\r\n                   |    unkbyte7 var_48h;\r\n                   |    int64_t var_41h;\r\n                   |    unkbyte7 var_30h;\r\n                   |    int64_t var_29h;\r\n                   |    int64_t var_20h;\r\n                   |    \r\n    0x18565fc81    |    var_20h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_78;\r\n    0x18565fc90    |    cVar4 = (*(code *)0x185f59da0)();\r\n    0x18565fc98    |    var_41h._0_1_ = '\\0';\r\n    0x18565fc98    |    var_41h._1_1_ = 0;\r\n    0x18565fca1    |    var_58h._0_1_ = 0;\r\n    0x18565fca5    |    var_29h._0_1_ = '\\0';\r\n    0x18565fcad    |    stack0xffffffffffffffdc = 0;\r\n    0x18565fcc6    |    var_29h._1_1_ = cVar4;\r\n    0x18565fcc6    |    if (*(int64_t *)(*(int64_t *)arg1 + 0x30) == 0x18565fe10) {\r\n    0x18565fd34    |        if (*(char *)(arg1 + 0x48) != '\\x01') goto code_r0x00018565fcd5;\r\n                   |    } else {\r\n    0x18565fccb    |        cVar5 = (*(code *)0x185f59da0)(arg1);\r\n    0x18565fcd3    |        if (cVar5 == '\\0') goto code_r0x00018565fcd5;\r\n                   |    }\r\n    0x18565fd38    |    if (cVar4 == '\\0') {\r\n    0x18565fd3a    |        pcVar3 = (code *)swi(3);\r\n    0x18565fd3a    |        uVar6 = (*pcVar3)();\r\n    0x18565fd3a    |        return uVar6;\r\n                   |    }\r\n                   |code_r0x00018565fcd5:\r\n    0x18565fcd5    |    puVar1 = *(uint64_t **)(arg1 + 0x18);\r\n    0x18565fcd9    |    puVar7 = (undefined8 *)puVar1[7];\r\n    0x18565fce0    |    if (puVar7 == (undefined8 *)0x0) {\r\n    0x18565fd42    |        puVar7 = (undefined8 *)func_0x000185f006b8(0x38);\r\n    0x18565fd4a    |        uVar2 = *puVar1;\r\n    0x18565fd54    |        *puVar7 = 0x18fbdcd38;\r\n    0x18565fd6b    |        if ((uVar2 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x18565fd70    |            func_0x0001841c7180(uVar2);\r\n                   |        }\r\n    0x18565fd75    |        puVar7[1] = uVar2;\r\n    0x18565fd8b    |        func_0x000180a1dea0(*(undefined8 *)0x191de73d0, puVar7 + 2, 0x19066efd0);\r\n    0x18565fd9a    |        puVar7[4] = 0;\r\n    0x18565fd9a    |        puVar7[5] = 0;\r\n    0x18565fd9e    |        puVar7[3] = puVar7 + 4;\r\n    0x18565fda2    |        uVar2 = puVar1[7];\r\n    0x18565fda6    |        puVar1[7] = (uint64_t)puVar7;\r\n    0x18565fdad    |        if (uVar2 != 0) {\r\n    0x18565fdb8    |            func_0x000181e060c0(uVar2, 1);\r\n    0x18565fdbd    |            puVar7 = (undefined8 *)puVar1[7];\r\n                   |        }\r\n                   |    }\r\n    0x18565fcf0    |    uVar6 = func_0x00018565feb0(puVar7, &var_58h, 1);\r\n    0x18565fcfc    |    if ((char)var_29h < '\\0') goto code_r0x00018565fdd3;\r\n    0x18565fd1f    |    while( true ) {\r\n    0x18565fd07    |        if ((char)var_41h < '\\0') {\r\n    0x18565fe00    |            func_0x0001841dcbe0(CONCAT71(var_58h._1_7_, (undefined)var_58h), \r\n    0x18565fdfb    |                                CONCAT17((char)var_41h, var_48h) & 0x7fffffffffffffff);\r\n                   |        }\r\n    0x18565fd1f    |        if (*(uint64_t *)0x191c71040 == (var_20h ^ (uint64_t)auStack_78)) break;\r\n    0x18565fdcb    |        func_0x000185f05b40(var_20h ^ (uint64_t)auStack_78);\r\n                   |code_r0x00018565fdd3:\r\n    0x18565fde2    |        func_0x0001841dcbe0(CONCAT71(stack0xffffffffffffffc1, var_41h._1_1_), \r\n    0x18565fddd    |                            CONCAT17((char)var_29h, var_30h) & 0x7fffffffffffffff);\r\n                   |    }\r\n    0x18565fd2f    |    return uVar6;\r\n                   |}\r\n[{\"offset\":6533020784,\"name\":\"fcn.18565fc70\",\"size\":415,\"is-pure\":false,\"realsz\":413,\"noreturn\":false,\"stackframe\":120,\"calltype\":\"ms\",\"cost\":137,\"cc\":12,\"loops\":6,\"bits\":64,\"type\":\"fcn\",\"nbbs\":17,\"edges\":25,\"ebbs\":2,\"signature\":\"fcn.18565fc70(int64_t arg1);\",\"minbound\":6533020784,\"maxbound\":6533021199,\"callrefs\":[{\"from\":6533020816,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6533020875,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6533020912,\"to\":6533021360,\"type\":\"CALL\"},{\"from\":6533020994,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6533021040,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6533021067,\"to\":6453059232,\"type\":\"CALL\"},{\"from\":6533021112,\"to\":6473932992,\"type\":\"CALL\"},{\"from\":6533021121,\"to\":6533020898,\"type\":\"CODE\"},{\"from\":6533021134,\"to\":6542089024,\"type\":\"CALL\"},{\"from\":6533021159,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6533021164,\"to\":6533020930,\"type\":\"CODE\"},{\"from\":6533021189,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6533021194,\"to\":6533020941,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6533020794,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6533020860,\"to\":6533021200,\"type\":\"DATA\"},{\"from\":6533020949,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6533021005,\"to\":6706548024,\"type\":\"DATA\"},{\"from\":6533021028,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6533021053,\"to\":6742242256,\"type\":\"DATA\"},{\"from\":6533021060,\"to\":6717632464,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6533021121,\"to\":6533020898,\"type\":\"CODE\"},{\"from\":6533021164,\"to\":6533020930,\"type\":\"CODE\"},{\"from\":6533021194,\"to\":6533020941,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":3,\"outdegree\":10,\"nlocals\":9,\"nargs\":1,\"stackvars\":[{\"name\":\"var_58h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-88}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_41h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-65}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"var_29h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-41}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}},{\"name\":\"var_24h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-36}},{\"name\":\"var_20h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-32}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"    0x18565fc70    |\r\n    0x18565fc70    |// WARNING: [rz-ghidra] Detected overlap for variable var_28h\r\n    0x18565fc70    |// WARNING: [rz-ghidra] Detected overlap for variable var_24h\r\n    0x18565fc70    |// WARNING: [rz-ghidra] Detected overlap for variable var_30h\r\n    0x18565fc70    |// WARNING: [rz-ghidra] Detected overlap for variable var_40h\r\n    0x18565fc70    |// WARNING: [rz-ghidra] Detected overlap for variable var_48h\r\n                   |\r\n    0x18565fc70    |undefined8 fcn.18565fc70(int64_t arg1)\r\n                   |{\r\n                   |    uint64_t *puVar1;\r\n                   |    uint64_t uVar2;\r\n                   |    code *pcVar3;\r\n                   |    char cVar4;\r\n                   |    char cVar5;\r\n                   |    undefined8 uVar6;\r\n                   |    undefined8 *puVar7;\r\n                   |    undefined auStack_78 [32];\r\n                   |    int64_t var_58h;\r\n                   |    unkbyte7 var_48h;\r\n                   |    int64_t var_41h;\r\n                   |    unkbyte7 var_30h;\r\n                   |    int64_t var_29h;\r\n                   |    int64_t var_20h;\r\n                   |    \r\n    0x18565fc81    |    var_20h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_78;\r\n    0x18565fc90    |    cVar4 = (*(code *)0x185f59da0)();\r\n    0x18565fc98    |    var_41h._0_1_ = '\\0';\r\n    0x18565fc98    |    var_41h._1_1_ = 0;\r\n    0x18565fca1    |    var_58h._0_1_ = 0;\r\n    0x18565fca5    |    var_29h._0_1_ = '\\0';\r\n    0x18565fcad    |    stack0xffffffffffffffdc = 0;\r\n    0x18565fcc6    |    var_29h._1_1_ = cVar4;\r\n    0x18565fcc6    |    if (*(int64_t *)(*(int64_t *)arg1 + 0x30) == 0x18565fe10) {\r\n    0x18565fd34    |        if (*(char *)(arg1 + 0x48) != '\\x01') goto code_r0x00018565fcd5;\r\n                   |    } else {\r\n    0x18565fccb    |        cVar5 = (*(code *)0x185f59da0)(arg1);\r\n    0x18565fcd3    |        if (cVar5 == '\\0') goto code_r0x00018565fcd5;\r\n                   |    }\r\n    0x18565fd38    |    if (cVar4 == '\\0') {\r\n    0x18565fd3a    |        pcVar3 = (code *)swi(3);\r\n    0x18565fd3a    |        uVar6 = (*pcVar3)();\r\n    0x18565fd3a    |        return uVar6;\r\n                   |    }\r\n                   |code_r0x00018565fcd5:\r\n    0x18565fcd5    |    puVar1 = *(uint64_t **)(arg1 + 0x18);\r\n    0x18565fcd9    |    puVar7 = (undefined8 *)puVar1[7];\r\n    0x18565fce0    |    if (puVar7 == (undefined8 *)0x0) {\r\n    0x18565fd42    |        puVar7 = (undefined8 *)func_0x000185f006b8(0x38);\r\n    0x18565fd4a    |        uVar2 = *puVar1;\r\n    0x18565fd54    |        *puVar7 = 0x18fbdcd38;\r\n    0x18565fd6b    |        if ((uVar2 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x18565fd70    |            func_0x0001841c7180(uVar2);\r\n                   |        }\r\n    0x18565fd75    |        puVar7[1] = uVar2;\r\n    0x18565fd8b    |        func_0x000180a1dea0(*(undefined8 *)0x191de73d0, puVar7 + 2, 0x19066efd0);\r\n    0x18565fd9a    |        puVar7[4] = 0;\r\n    0x18565fd9a    |        puVar7[5] = 0;\r\n    0x18565fd9e    |        puVar7[3] = puVar7 + 4;\r\n    0x18565fda2    |        uVar2 = puVar1[7];\r\n    0x18565fda6    |        puVar1[7] = (uint64_t)puVar7;\r\n    0x18565fdad    |        if (uVar2 != 0) {\r\n    0x18565fdb8    |            func_0x000181e060c0(uVar2, 1);\r\n    0x18565fdbd    |            puVar7 = (undefined8 *)puVar1[7];\r\n                   |        }\r\n                   |    }\r\n    0x18565fcf0    |    uVar6 = func_0x00018565feb0(puVar7, &var_58h, 1);\r\n    0x18565fcfc    |    if ((char)var_29h < '\\0') goto code_r0x00018565fdd3;\r\n    0x18565fd1f    |    while( true ) {\r\n    0x18565fd07    |        if ((char)var_41h < '\\0') {\r\n    0x18565fe00    |            func_0x0001841dcbe0(CONCAT71(var_58h._1_7_, (undefined)var_58h), \r\n    0x18565fdfb    |                                CONCAT17((char)var_41h, var_48h) & 0x7fffffffffffffff);\r\n                   |        }\r\n    0x18565fd1f    |        if (*(uint64_t *)0x191c71040 == (var_20h ^ (uint64_t)auStack_78)) break;\r\n    0x18565fdcb    |        func_0x000185f05b40(var_20h ^ (uint64_t)auStack_78);\r\n                   |code_r0x00018565fdd3:\r\n    0x18565fde2    |        func_0x0001841dcbe0(CONCAT71(stack0xffffffffffffffc1, var_41h._1_1_), \r\n    0x18565fddd    |                            CONCAT17((char)var_29h, var_30h) & 0x7fffffffffffffff);\r\n                   |    }\r\n    0x18565fd2f    |    return uVar6;\r\n                   |}\r\n[{\"offset\":6533020784,\"name\":\"fcn.18565fc70\",\"size\":415,\"is-pure\":false,\"realsz\":413,\"noreturn\":false,\"stackframe\":120,\"calltype\":\"ms\",\"cost\":137,\"cc\":12,\"loops\":6,\"bits\":64,\"type\":\"fcn\",\"nbbs\":17,\"edges\":25,\"ebbs\":2,\"signature\":\"fcn.18565fc70(int64_t arg1);\",\"minbound\":6533020784,\"maxbound\":6533021199,\"callrefs\":[{\"from\":6533020816,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6533020875,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6533020912,\"to\":6533021360,\"type\":\"CALL\"},{\"from\":6533020994,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6533021040,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6533021067,\"to\":6453059232,\"type\":\"CALL\"},{\"from\":6533021112,\"to\":6473932992,\"type\":\"CALL\"},{\"from\":6533021121,\"to\":6533020898,\"type\":\"CODE\"},{\"from\":6533021134,\"to\":6542089024,\"type\":\"CALL\"},{\"from\":6533021159,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6533021164,\"to\":6533020930,\"type\":\"CODE\"},{\"from\":6533021189,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6533021194,\"to\":6533020941,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6533020794,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6533020860,\"to\":6533021200,\"type\":\"DATA\"},{\"from\":6533020949,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6533021005,\"to\":6706548024,\"type\":\"DATA\"},{\"from\":6533021028,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6533021053,\"to\":6742242256,\"type\":\"DATA\"},{\"from\":6533021060,\"to\":6717632464,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6533021121,\"to\":6533020898,\"type\":\"CODE\"},{\"from\":6533021164,\"to\":6533020930,\"type\":\"CODE\"},{\"from\":6533021194,\"to\":6533020941,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":3,\"outdegree\":10,\"nlocals\":9,\"nargs\":1,\"stackvars\":[{\"name\":\"var_58h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-88}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_41h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-65}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"var_29h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-41}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}},{\"name\":\"var_24h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-36}},{\"name\":\"var_20h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-32}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5245ms"}}