{"ok":true,"data":{"evidence_id":"ev_77dde321d16dbbff6bf5f3abe5107d8c83d8ed0e27cdfd04426f5608ccf877f2","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x183673ae0;pdgo @ 0x183673ae0;afij @ 0x183673ae0","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x183673ae0;pdgo @ 0x183673ae0;afij @ 0x183673ae0","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x183673ae0    |void fcn.183673ae0(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    int32_t iVar1;\r\n                   |    char cVar2;\r\n                   |    undefined8 *puVar3;\r\n                   |    int64_t *piVar4;\r\n                   |    int32_t *piVar5;\r\n                   |    code *pcVar6;\r\n                   |    undefined8 uVar7;\r\n                   |    undefined4 *puVar8;\r\n                   |    int64_t iVar9;\r\n                   |    int64_t unaff_GS_OFFSET;\r\n                   |    undefined auStack_188 [40];\r\n                   |    int64_t var_160h;\r\n                   |    int64_t var_158h;\r\n                   |    int64_t var_148h;\r\n                   |    int64_t var_28h;\r\n                   |    \r\n    0x183673af9    |    var_28h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_188;\r\n    0x183673b0b    |    if (*(char *)(arg1 + 0x91) == '\\x01') {\r\n    0x183673cab    |        cVar2 = *(char *)(arg1 + 0x92);\r\n    0x183673cb1    |        *(undefined4 *)(arg1 + 0x10) = 0;\r\n    0x183673cbf    |        if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x183673cc8    |            func_0x00018030d390(&var_158h, 0x190bfffb0, 0x281, 2);\r\n    0x183673cf0    |            uVar7 = func_0x000184dcd0d0(&var_148h, 0x190c007a0, 0x2d);\r\n    0x183673cf5    |            iVar9 = (int64_t)*(char *)(arg2 + 0x17);\r\n    0x183673cfd    |            if (iVar9 < 0) {\r\n    0x183673cff    |                iVar9 = *(int64_t *)(arg2 + 8);\r\n                   |            }\r\n    0x183673d06    |            uVar7 = func_0x0001813014a0(uVar7, iVar9);\r\n    0x183673d1b    |            uVar7 = func_0x000184dcd0d0(uVar7, 0x190c007d0, 0x11);\r\n    0x183673d20    |            iVar9 = (int64_t)*(char *)(arg1 + 0x47);\r\n    0x183673d28    |            if (iVar9 < 0) {\r\n    0x183673d2a    |                iVar9 = *(int64_t *)(arg1 + 0x38);\r\n                   |            }\r\n    0x183673d31    |            func_0x0001813014a0(uVar7, iVar9);\r\n    0x183673d36    |            func_0x0001804b0120(&var_158h);\r\n                   |        }\r\n    0x183673d4a    |        if (*(int64_t *)(arg1 + 0xb8) != 0) {\r\n    0x183673d40    |            func_0x000183675390(*(int64_t *)(arg1 + 0xb8), arg2);\r\n                   |        }\r\n    0x183673d54    |        *(undefined *)(arg1 + 0x91) = 0;\r\n    0x183673d5f    |        if (*(char *)(arg1 + 0x47) < '\\0') {\r\n    0x183673c9b    |            **(undefined **)(arg1 + 0x30) = 0;\r\n    0x183673c9e    |            *(undefined8 *)(arg1 + 0x38) = 0;\r\n                   |        } else {\r\n    0x183673d67    |            *(undefined *)(arg1 + 0x30) = 0;\r\n    0x183673d6a    |            *(undefined *)(arg1 + 0x47) = 0;\r\n                   |        }\r\n    0x183673d6d    |        func_0x000184cb7790(arg1 + 0x128);\r\n    0x183673d7d    |        if (*(char *)(arg1 + 0x5f) < '\\0') {\r\n    0x183673c87    |            **(undefined **)(arg1 + 0x48) = 0;\r\n    0x183673c8a    |            *(undefined8 *)(arg1 + 0x50) = 0;\r\n                   |        } else {\r\n    0x183673d85    |            *(undefined *)(arg1 + 0x48) = 0;\r\n    0x183673d88    |            *(undefined *)(arg1 + 0x5f) = 0;\r\n                   |        }\r\n    0x183673d8f    |        if (*(char *)(arg1 + 0x77) < '\\0') {\r\n    0x183673c71    |            **(undefined2 **)(arg1 + 0x60) = 0;\r\n    0x183673c76    |            *(undefined8 *)(arg1 + 0x68) = 0;\r\n                   |        } else {\r\n    0x183673d95    |            *(undefined2 *)(arg1 + 0x60) = 0;\r\n    0x183673d9b    |            *(undefined *)(arg1 + 0x77) = 0;\r\n                   |        }\r\n    0x183673da6    |        if (*(char *)(arg1 + 0x8f) < '\\0') {\r\n    0x183673ee7    |            **(undefined2 **)(arg1 + 0x78) = 0;\r\n    0x183673eec    |            *(undefined8 *)(arg1 + 0x80) = 0;\r\n                   |        } else {\r\n    0x183673dac    |            *(undefined2 *)(arg1 + 0x78) = 0;\r\n    0x183673db2    |            *(undefined *)(arg1 + 0x8f) = 0;\r\n                   |        }\r\n    0x183673db9    |        *(undefined2 *)(arg1 + 0x93) = 0;\r\n    0x183673dc9    |        puVar3 = (undefined8 *)**(int64_t **)(arg1 + 0xb0);\r\n    0x183673dcc    |        *(undefined *)((int64_t)puVar3 + 0x2c) = 0;\r\n    0x183673dd5    |        (*_sym.imp.USER32.dll_ShowWindow)(*puVar3, 0);\r\n    0x183673ddd    |        if (cVar2 != '\\0') {\r\n    0x183673df6    |            piVar4 = *(int64_t **)\r\n    0x183673df2    |                      (*(int64_t *)(*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) +\r\n    0x183673df6    |                      0x3d0);\r\n    0x183673e0c    |            if ((piVar4 == (int64_t *)0x0) || (iVar9 = *piVar4, iVar9 == 0)) goto code_r0x000183673f0c;\r\n    0x183673e12    |            piVar5 = *(int32_t **)(arg1 + 0x1e8);\r\n    0x183673e19    |            uVar7 = *(undefined8 *)(arg1 + 0x1f0);\r\n    0x183673e23    |            if (piVar5 != (int32_t *)0x0) {\r\n    0x183673e2a    |                LOCK();\r\n    0x183673e2a    |                iVar1 = *piVar5;\r\n    0x183673e2a    |                *piVar5 = *piVar5 + 1;\r\n    0x183673e2a    |                UNLOCK();\r\n    0x183673e34    |                if (iVar1 == 0x7fffffff) {\r\n    0x183673f0f    |                    pcVar6 = (code *)swi(3);\r\n    0x183673f0f    |                    (*pcVar6)();\r\n    0x183673f0f    |                    return;\r\n                   |                }\r\n                   |            }\r\n    0x183673e3f    |            puVar8 = (undefined4 *)func_0x000185f006b8(0x38);\r\n    0x183673e47    |            *puVar8 = 1;\r\n    0x183673e54    |            *(undefined8 *)(puVar8 + 2) = 0x18339d600;\r\n    0x183673e5f    |            *(undefined8 *)(puVar8 + 4) = 0x182beced0;\r\n    0x183673e6a    |            *(undefined8 *)(puVar8 + 6) = 0x18339cdd0;\r\n    0x183673e75    |            *(undefined8 *)(puVar8 + 8) = 0x183673070;\r\n    0x183673e79    |            *(int32_t **)(puVar8 + 10) = piVar5;\r\n    0x183673e7d    |            *(undefined8 *)(puVar8 + 0xc) = uVar7;\r\n    0x183673e8f    |            func_0x000184339cd0(&var_158h, 0x190898430, 0x190bfffb0, 0x2f7);\r\n    0x183673eb9    |            var_160h = (int64_t)puVar8;\r\n    0x183673eb9    |            (*(code *)0x185f59da0)(iVar9, &var_158h, &var_160h, 0);\r\n                   |        }\r\n                   |    } else {\r\n    0x183673b18    |        if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x183673b25    |            func_0x00018030d390(&var_158h, 0x190bfffb0, 0x301, 2);\r\n    0x183673b4d    |            uVar7 = func_0x000184dcd0d0(&var_148h, 0x190c00a38, 0x30);\r\n    0x183673b52    |            iVar9 = (int64_t)*(char *)(arg2 + 0x17);\r\n    0x183673b5a    |            if (iVar9 < 0) {\r\n    0x183673b5c    |                iVar9 = *(int64_t *)(arg2 + 8);\r\n                   |            }\r\n    0x183673b63    |            uVar7 = func_0x0001813014a0(uVar7, iVar9);\r\n    0x183673b78    |            uVar7 = func_0x000184dcd0d0(uVar7, 0x190c008c0, 9);\r\n    0x183673b86    |            uVar7 = func_0x00018084a240(uVar7, *(undefined *)(arg1 + 0x90));\r\n    0x183673b9b    |            uVar7 = func_0x000184dcd0d0(uVar7, 0x190c00150, 0xd);\r\n    0x183673ba9    |            uVar7 = func_0x00018084a240(uVar7, *(undefined *)(arg1 + 0x91));\r\n    0x183673bbe    |            uVar7 = func_0x000184dcd0d0(uVar7, 0x190c00a70, 0x15);\r\n    0x183673bd1    |            func_0x00018084a240(uVar7, *(int64_t *)(arg1 + 0xb8) != 0);\r\n    0x183673bd6    |            func_0x0001804b0120(&var_158h);\r\n                   |        }\r\n    0x183673be0    |        *(undefined4 *)(arg1 + 0x10) = 0;\r\n    0x183673be9    |        *(undefined *)(arg1 + 0x93) = 0;\r\n    0x183673bf6    |        puVar3 = (undefined8 *)**(int64_t **)(arg1 + 0xb0);\r\n    0x183673bf9    |        *(undefined *)((int64_t)puVar3 + 0x2c) = 0;\r\n    0x183673c01    |        (*_sym.imp.USER32.dll_ShowWindow)(*puVar3, 0);\r\n    0x183673c0e    |        if (*(char *)(arg1 + 0x90) == '\\x01') {\r\n    0x183673c3e    |            *(undefined *)(arg1 + 0x90) = 0;\r\n    0x183673c4d    |            if (*(int64_t *)(arg1 + 0x98) != 0) {\r\n    0x183673c53    |                func_0x0001865eba70(arg1 + 0x98, arg2, 1);\r\n                   |            }\r\n                   |        } else {\r\n    0x183673c10    |            *(undefined *)(arg1 + 0x91) = 0;\r\n    0x183673c1b    |            if (*(char *)(arg1 + 0x47) < '\\0') {\r\n    0x183673c2e    |                **(undefined **)(arg1 + 0x30) = 0;\r\n    0x183673c31    |                *(undefined8 *)(arg1 + 0x38) = 0;\r\n                   |            } else {\r\n    0x183673c1f    |                *(undefined *)(arg1 + 0x30) = 0;\r\n    0x183673c22    |                *(undefined *)(arg1 + 0x47) = 0;\r\n                   |            }\r\n                   |        }\r\n                   |    }\r\n    0x183673ed4    |    if (*(uint64_t *)0x191c71040 == (var_28h ^ (uint64_t)auStack_188)) {\r\n    0x183673ee2    |        return;\r\n                   |    }\r\n    0x183673f04    |    func_0x000185f05b40(var_28h ^ (uint64_t)auStack_188);\r\n                   |code_r0x000183673f0c:\r\n    0x183673f0c    |    pcVar6 = (code *)swi(3);\r\n    0x183673f0c    |    (*pcVar6)();\r\n    0x183673f0c    |    return;\r\n                   |}\r\n[{\"offset\":6499547872,\"name\":\"fcn.183673ae0\",\"size\":1072,\"is-pure\":false,\"realsz\":1070,\"noreturn\":false,\"stackframe\":392,\"calltype\":\"ms\",\"cost\":309,\"cc\":23,\"loops\":4,\"bits\":64,\"type\":\"fcn\",\"nbbs\":42,\"edges\":59,\"ebbs\":3,\"signature\":\"fcn.183673ae0(int64_t arg1, int64_t arg2);\",\"minbound\":6499547872,\"maxbound\":6499548944,\"callrefs\":[{\"from\":6499547958,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499547981,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499548003,\"to\":6462379168,\"type\":\"CALL\"},{\"from\":6499548024,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499548038,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499548059,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499548073,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499548094,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499548113,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499548123,\"to\":6447366432,\"type\":\"CALL\"},{\"from\":6499548161,\"to\":6741827296,\"type\":\"CALL\"},{\"from\":6499548197,\"to\":6499548863,\"type\":\"CODE\"},{\"from\":6499548217,\"to\":6499548863,\"type\":\"CODE\"},{\"from\":6499548259,\"to\":6549322352,\"type\":\"CALL\"},{\"from\":6499548264,\"to\":6499548863,\"type\":\"CODE\"},{\"from\":6499548286,\"to\":6499548575,\"type\":\"CODE\"},{\"from\":6499548306,\"to\":6499548555,\"type\":\"CODE\"},{\"from\":6499548326,\"to\":6499548525,\"type\":\"CODE\"},{\"from\":6499548377,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499548400,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499548422,\"to\":6462379168,\"type\":\"CALL\"},{\"from\":6499548443,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499548465,\"to\":6462379168,\"type\":\"CALL\"},{\"from\":6499548475,\"to\":6447366432,\"type\":\"CALL\"},{\"from\":6499548495,\"to\":6499554192,\"type\":\"CALL\"},{\"from\":6499548532,\"to\":6522894224,\"type\":\"CALL\"},{\"from\":6499548629,\"to\":6741827296,\"type\":\"CALL\"},{\"from\":6499548735,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499548829,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6499548857,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6499548919,\"to\":6499548601,\"type\":\"CODE\"},{\"from\":6499548935,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6499547890,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499547921,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499547934,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499547968,\"to\":6723471928,\"type\":\"DATA\"},{\"from\":6499548008,\"to\":6723471552,\"type\":\"DATA\"},{\"from\":6499548043,\"to\":6723469648,\"type\":\"DATA\"},{\"from\":6499548078,\"to\":6723471984,\"type\":\"DATA\"},{\"from\":6499548344,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499548353,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499548387,\"to\":6723471264,\"type\":\"DATA\"},{\"from\":6499548427,\"to\":6723471312,\"type\":\"DATA\"},{\"from\":6499548643,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6499548749,\"to\":6496572928,\"type\":\"DATA\"},{\"from\":6499548760,\"to\":6488510160,\"type\":\"DATA\"},{\"from\":6499548771,\"to\":6496570832,\"type\":\"DATA\"},{\"from\":6499548782,\"to\":6499545200,\"type\":\"DATA\"},{\"from\":6499548801,\"to\":6719898672,\"type\":\"DATA\"},{\"from\":6499548808,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499548874,\"to\":6740709440,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499548197,\"to\":6499548863,\"type\":\"CODE\"},{\"from\":6499548217,\"to\":6499548863,\"type\":\"CODE\"},{\"from\":6499548264,\"to\":6499548863,\"type\":\"CODE\"},{\"from\":6499548286,\"to\":6499548575,\"type\":\"CODE\"},{\"from\":6499548306,\"to\":6499548555,\"type\":\"CODE\"},{\"from\":6499548326,\"to\":6499548525,\"type\":\"CODE\"},{\"from\":6499548919,\"to\":6499548601,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":7,\"outdegree\":25,\"nlocals\":4,\"nargs\":2,\"stackvars\":[{\"name\":\"var_160h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-352}},{\"name\":\"var_158h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-344}},{\"name\":\"var_148h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-328}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x183673ae0    |void fcn.183673ae0(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    int32_t iVar1;\r\n                   |    char cVar2;\r\n                   |    undefined8 *puVar3;\r\n                   |    int64_t *piVar4;\r\n                   |    int32_t *piVar5;\r\n                   |    code *pcVar6;\r\n                   |    undefined8 uVar7;\r\n                   |    undefined4 *puVar8;\r\n                   |    int64_t iVar9;\r\n                   |    int64_t unaff_GS_OFFSET;\r\n                   |    undefined auStack_188 [40];\r\n                   |    int64_t var_160h;\r\n                   |    int64_t var_158h;\r\n                   |    int64_t var_148h;\r\n                   |    int64_t var_28h;\r\n                   |    \r\n    0x183673af9    |    var_28h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_188;\r\n    0x183673b0b    |    if (*(char *)(arg1 + 0x91) == '\\x01') {\r\n    0x183673cab    |        cVar2 = *(char *)(arg1 + 0x92);\r\n    0x183673cb1    |        *(undefined4 *)(arg1 + 0x10) = 0;\r\n    0x183673cbf    |        if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x183673cc8    |            func_0x00018030d390(&var_158h, 0x190bfffb0, 0x281, 2);\r\n    0x183673cf0    |            uVar7 = func_0x000184dcd0d0(&var_148h, 0x190c007a0, 0x2d);\r\n    0x183673cf5    |            iVar9 = (int64_t)*(char *)(arg2 + 0x17);\r\n    0x183673cfd    |            if (iVar9 < 0) {\r\n    0x183673cff    |                iVar9 = *(int64_t *)(arg2 + 8);\r\n                   |            }\r\n    0x183673d06    |            uVar7 = func_0x0001813014a0(uVar7, iVar9);\r\n    0x183673d1b    |            uVar7 = func_0x000184dcd0d0(uVar7, 0x190c007d0, 0x11);\r\n    0x183673d20    |            iVar9 = (int64_t)*(char *)(arg1 + 0x47);\r\n    0x183673d28    |            if (iVar9 < 0) {\r\n    0x183673d2a    |                iVar9 = *(int64_t *)(arg1 + 0x38);\r\n                   |            }\r\n    0x183673d31    |            func_0x0001813014a0(uVar7, iVar9);\r\n    0x183673d36    |            func_0x0001804b0120(&var_158h);\r\n                   |        }\r\n    0x183673d4a    |        if (*(int64_t *)(arg1 + 0xb8) != 0) {\r\n    0x183673d40    |            func_0x000183675390(*(int64_t *)(arg1 + 0xb8), arg2);\r\n                   |        }\r\n    0x183673d54    |        *(undefined *)(arg1 + 0x91) = 0;\r\n    0x183673d5f    |        if (*(char *)(arg1 + 0x47) < '\\0') {\r\n    0x183673c9b    |            **(undefined **)(arg1 + 0x30) = 0;\r\n    0x183673c9e    |            *(undefined8 *)(arg1 + 0x38) = 0;\r\n                   |        } else {\r\n    0x183673d67    |            *(undefined *)(arg1 + 0x30) = 0;\r\n    0x183673d6a    |            *(undefined *)(arg1 + 0x47) = 0;\r\n                   |        }\r\n    0x183673d6d    |        func_0x000184cb7790(arg1 + 0x128);\r\n    0x183673d7d    |        if (*(char *)(arg1 + 0x5f) < '\\0') {\r\n    0x183673c87    |            **(undefined **)(arg1 + 0x48) = 0;\r\n    0x183673c8a    |            *(undefined8 *)(arg1 + 0x50) = 0;\r\n                   |        } else {\r\n    0x183673d85    |            *(undefined *)(arg1 + 0x48) = 0;\r\n    0x183673d88    |            *(undefined *)(arg1 + 0x5f) = 0;\r\n                   |        }\r\n    0x183673d8f    |        if (*(char *)(arg1 + 0x77) < '\\0') {\r\n    0x183673c71    |            **(undefined2 **)(arg1 + 0x60) = 0;\r\n    0x183673c76    |            *(undefined8 *)(arg1 + 0x68) = 0;\r\n                   |        } else {\r\n    0x183673d95    |            *(undefined2 *)(arg1 + 0x60) = 0;\r\n    0x183673d9b    |            *(undefined *)(arg1 + 0x77) = 0;\r\n                   |        }\r\n    0x183673da6    |        if (*(char *)(arg1 + 0x8f) < '\\0') {\r\n    0x183673ee7    |            **(undefined2 **)(arg1 + 0x78) = 0;\r\n    0x183673eec    |            *(undefined8 *)(arg1 + 0x80) = 0;\r\n                   |        } else {\r\n    0x183673dac    |            *(undefined2 *)(arg1 + 0x78) = 0;\r\n    0x183673db2    |            *(undefined *)(arg1 + 0x8f) = 0;\r\n                   |        }\r\n    0x183673db9    |        *(undefined2 *)(arg1 + 0x93) = 0;\r\n    0x183673dc9    |        puVar3 = (undefined8 *)**(int64_t **)(arg1 + 0xb0);\r\n    0x183673dcc    |        *(undefined *)((int64_t)puVar3 + 0x2c) = 0;\r\n    0x183673dd5    |        (*_sym.imp.USER32.dll_ShowWindow)(*puVar3, 0);\r\n    0x183673ddd    |        if (cVar2 != '\\0') {\r\n    0x183673df6    |            piVar4 = *(int64_t **)\r\n    0x183673df2    |                      (*(int64_t *)(*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) +\r\n    0x183673df6    |                      0x3d0);\r\n    0x183673e0c    |            if ((piVar4 == (int64_t *)0x0) || (iVar9 = *piVar4, iVar9 == 0)) goto code_r0x000183673f0c;\r\n    0x183673e12    |            piVar5 = *(int32_t **)(arg1 + 0x1e8);\r\n    0x183673e19    |            uVar7 = *(undefined8 *)(arg1 + 0x1f0);\r\n    0x183673e23    |            if (piVar5 != (int32_t *)0x0) {\r\n    0x183673e2a    |                LOCK();\r\n    0x183673e2a    |                iVar1 = *piVar5;\r\n    0x183673e2a    |                *piVar5 = *piVar5 + 1;\r\n    0x183673e2a    |                UNLOCK();\r\n    0x183673e34    |                if (iVar1 == 0x7fffffff) {\r\n    0x183673f0f    |                    pcVar6 = (code *)swi(3);\r\n    0x183673f0f    |                    (*pcVar6)();\r\n    0x183673f0f    |                    return;\r\n                   |                }\r\n                   |            }\r\n    0x183673e3f    |            puVar8 = (undefined4 *)func_0x000185f006b8(0x38);\r\n    0x183673e47    |            *puVar8 = 1;\r\n    0x183673e54    |            *(undefined8 *)(puVar8 + 2) = 0x18339d600;\r\n    0x183673e5f    |            *(undefined8 *)(puVar8 + 4) = 0x182beced0;\r\n    0x183673e6a    |            *(undefined8 *)(puVar8 + 6) = 0x18339cdd0;\r\n    0x183673e75    |            *(undefined8 *)(puVar8 + 8) = 0x183673070;\r\n    0x183673e79    |            *(int32_t **)(puVar8 + 10) = piVar5;\r\n    0x183673e7d    |            *(undefined8 *)(puVar8 + 0xc) = uVar7;\r\n    0x183673e8f    |            func_0x000184339cd0(&var_158h, 0x190898430, 0x190bfffb0, 0x2f7);\r\n    0x183673eb9    |            var_160h = (int64_t)puVar8;\r\n    0x183673eb9    |            (*(code *)0x185f59da0)(iVar9, &var_158h, &var_160h, 0);\r\n                   |        }\r\n                   |    } else {\r\n    0x183673b18    |        if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x183673b25    |            func_0x00018030d390(&var_158h, 0x190bfffb0, 0x301, 2);\r\n    0x183673b4d    |            uVar7 = func_0x000184dcd0d0(&var_148h, 0x190c00a38, 0x30);\r\n    0x183673b52    |            iVar9 = (int64_t)*(char *)(arg2 + 0x17);\r\n    0x183673b5a    |            if (iVar9 < 0) {\r\n    0x183673b5c    |                iVar9 = *(int64_t *)(arg2 + 8);\r\n                   |            }\r\n    0x183673b63    |            uVar7 = func_0x0001813014a0(uVar7, iVar9);\r\n    0x183673b78    |            uVar7 = func_0x000184dcd0d0(uVar7, 0x190c008c0, 9);\r\n    0x183673b86    |            uVar7 = func_0x00018084a240(uVar7, *(undefined *)(arg1 + 0x90));\r\n    0x183673b9b    |            uVar7 = func_0x000184dcd0d0(uVar7, 0x190c00150, 0xd);\r\n    0x183673ba9    |            uVar7 = func_0x00018084a240(uVar7, *(undefined *)(arg1 + 0x91));\r\n    0x183673bbe    |            uVar7 = func_0x000184dcd0d0(uVar7, 0x190c00a70, 0x15);\r\n    0x183673bd1    |            func_0x00018084a240(uVar7, *(int64_t *)(arg1 + 0xb8) != 0);\r\n    0x183673bd6    |            func_0x0001804b0120(&var_158h);\r\n                   |        }\r\n    0x183673be0    |        *(undefined4 *)(arg1 + 0x10) = 0;\r\n    0x183673be9    |        *(undefined *)(arg1 + 0x93) = 0;\r\n    0x183673bf6    |        puVar3 = (undefined8 *)**(int64_t **)(arg1 + 0xb0);\r\n    0x183673bf9    |        *(undefined *)((int64_t)puVar3 + 0x2c) = 0;\r\n    0x183673c01    |        (*_sym.imp.USER32.dll_ShowWindow)(*puVar3, 0);\r\n    0x183673c0e    |        if (*(char *)(arg1 + 0x90) == '\\x01') {\r\n    0x183673c3e    |            *(undefined *)(arg1 + 0x90) = 0;\r\n    0x183673c4d    |            if (*(int64_t *)(arg1 + 0x98) != 0) {\r\n    0x183673c53    |                func_0x0001865eba70(arg1 + 0x98, arg2, 1);\r\n                   |            }\r\n                   |        } else {\r\n    0x183673c10    |            *(undefined *)(arg1 + 0x91) = 0;\r\n    0x183673c1b    |            if (*(char *)(arg1 + 0x47) < '\\0') {\r\n    0x183673c2e    |                **(undefined **)(arg1 + 0x30) = 0;\r\n    0x183673c31    |                *(undefined8 *)(arg1 + 0x38) = 0;\r\n                   |            } else {\r\n    0x183673c1f    |                *(undefined *)(arg1 + 0x30) = 0;\r\n    0x183673c22    |                *(undefined *)(arg1 + 0x47) = 0;\r\n                   |            }\r\n                   |        }\r\n                   |    }\r\n    0x183673ed4    |    if (*(uint64_t *)0x191c71040 == (var_28h ^ (uint64_t)auStack_188)) {\r\n    0x183673ee2    |        return;\r\n                   |    }\r\n    0x183673f04    |    func_0x000185f05b40(var_28h ^ (uint64_t)auStack_188);\r\n                   |code_r0x000183673f0c:\r\n    0x183673f0c    |    pcVar6 = (code *)swi(3);\r\n    0x183673f0c    |    (*pcVar6)();\r\n    0x183673f0c    |    return;\r\n                   |}\r\n[{\"offset\":6499547872,\"name\":\"fcn.183673ae0\",\"size\":1072,\"is-pure\":false,\"realsz\":1070,\"noreturn\":false,\"stackframe\":392,\"calltype\":\"ms\",\"cost\":309,\"cc\":23,\"loops\":4,\"bits\":64,\"type\":\"fcn\",\"nbbs\":42,\"edges\":59,\"ebbs\":3,\"signature\":\"fcn.183673ae0(int64_t arg1, int64_t arg2);\",\"minbound\":6499547872,\"maxbound\":6499548944,\"callrefs\":[{\"from\":6499547958,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499547981,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499548003,\"to\":6462379168,\"type\":\"CALL\"},{\"from\":6499548024,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499548038,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499548059,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499548073,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499548094,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499548113,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499548123,\"to\":6447366432,\"type\":\"CALL\"},{\"from\":6499548161,\"to\":6741827296,\"type\":\"CALL\"},{\"from\":6499548197,\"to\":6499548863,\"type\":\"CODE\"},{\"from\":6499548217,\"to\":6499548863,\"type\":\"CODE\"},{\"from\":6499548259,\"to\":6549322352,\"type\":\"CALL\"},{\"from\":6499548264,\"to\":6499548863,\"type\":\"CODE\"},{\"from\":6499548286,\"to\":6499548575,\"type\":\"CODE\"},{\"from\":6499548306,\"to\":6499548555,\"type\":\"CODE\"},{\"from\":6499548326,\"to\":6499548525,\"type\":\"CODE\"},{\"from\":6499548377,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499548400,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499548422,\"to\":6462379168,\"type\":\"CALL\"},{\"from\":6499548443,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499548465,\"to\":6462379168,\"type\":\"CALL\"},{\"from\":6499548475,\"to\":6447366432,\"type\":\"CALL\"},{\"from\":6499548495,\"to\":6499554192,\"type\":\"CALL\"},{\"from\":6499548532,\"to\":6522894224,\"type\":\"CALL\"},{\"from\":6499548629,\"to\":6741827296,\"type\":\"CALL\"},{\"from\":6499548735,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499548829,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6499548857,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6499548919,\"to\":6499548601,\"type\":\"CODE\"},{\"from\":6499548935,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6499547890,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499547921,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499547934,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499547968,\"to\":6723471928,\"type\":\"DATA\"},{\"from\":6499548008,\"to\":6723471552,\"type\":\"DATA\"},{\"from\":6499548043,\"to\":6723469648,\"type\":\"DATA\"},{\"from\":6499548078,\"to\":6723471984,\"type\":\"DATA\"},{\"from\":6499548344,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499548353,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499548387,\"to\":6723471264,\"type\":\"DATA\"},{\"from\":6499548427,\"to\":6723471312,\"type\":\"DATA\"},{\"from\":6499548643,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6499548749,\"to\":6496572928,\"type\":\"DATA\"},{\"from\":6499548760,\"to\":6488510160,\"type\":\"DATA\"},{\"from\":6499548771,\"to\":6496570832,\"type\":\"DATA\"},{\"from\":6499548782,\"to\":6499545200,\"type\":\"DATA\"},{\"from\":6499548801,\"to\":6719898672,\"type\":\"DATA\"},{\"from\":6499548808,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499548874,\"to\":6740709440,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499548197,\"to\":6499548863,\"type\":\"CODE\"},{\"from\":6499548217,\"to\":6499548863,\"type\":\"CODE\"},{\"from\":6499548264,\"to\":6499548863,\"type\":\"CODE\"},{\"from\":6499548286,\"to\":6499548575,\"type\":\"CODE\"},{\"from\":6499548306,\"to\":6499548555,\"type\":\"CODE\"},{\"from\":6499548326,\"to\":6499548525,\"type\":\"CODE\"},{\"from\":6499548919,\"to\":6499548601,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":7,\"outdegree\":25,\"nlocals\":4,\"nargs\":2,\"stackvars\":[{\"name\":\"var_160h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-352}},{\"name\":\"var_158h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-344}},{\"name\":\"var_148h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-328}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5207ms"}}