{"ok":true,"data":{"evidence_id":"ev_3e72f38a959ce82cc62b14d9eea115226de383e6f4ffaaec56330eb2f23b682c","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x1836718d0;pdgo @ 0x1836718d0;afij @ 0x1836718d0","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x1836718d0;pdgo @ 0x1836718d0;afij @ 0x1836718d0","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x1836718d0    |void fcn.1836718d0(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    code *pcVar1;\r\n                   |    undefined8 uVar2;\r\n                   |    int64_t iVar3;\r\n                   |    undefined auStack_168 [32];\r\n                   |    int64_t var_148h;\r\n                   |    int64_t var_138h;\r\n                   |    int64_t var_18h;\r\n                   |    \r\n    0x1836718e6    |    var_18h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_168;\r\n    0x1836718f8    |    if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x183671905    |        func_0x00018030d390(&var_148h, 0x190bfffb0, 0x1ed, 2);\r\n    0x18367192d    |        uVar2 = func_0x000184dcd0d0(&var_138h, 0x190c005a8, 0x2b);\r\n    0x183671932    |        iVar3 = (int64_t)*(char *)(arg2 + 0x17);\r\n    0x18367193a    |        if (iVar3 < 0) {\r\n    0x18367193c    |            iVar3 = *(int64_t *)(arg2 + 8);\r\n                   |        }\r\n    0x183671943    |        uVar2 = func_0x0001813014a0(uVar2, iVar3);\r\n    0x183671958    |        uVar2 = func_0x000184dcd0d0(uVar2, 0x190bcbae0, 7);\r\n    0x183671963    |        uVar2 = func_0x00018041ca10(uVar2, *(undefined4 *)(arg1 + 0x10));\r\n    0x183671978    |        uVar2 = func_0x000184dcd0d0(uVar2, 0x190c005d8, 0xd);\r\n    0x183671986    |        func_0x00018084a240(uVar2, *(undefined *)(arg1 + 0x93));\r\n    0x18367198b    |        func_0x0001804b0120(&var_148h);\r\n                   |    }\r\n    0x183671995    |    *(undefined *)(arg1 + 0x93) = 1;\r\n    0x18367199c    |    func_0x00018367d6a0(*(undefined8 *)(arg1 + 0xb0), arg2);\r\n    0x1836719c0    |    if (*(uint64_t *)0x191c71040 == (var_18h ^ (uint64_t)auStack_168)) {\r\n    0x1836719cb    |        return;\r\n                   |    }\r\n    0x1836719d4    |    func_0x000185f05b40(var_18h ^ (uint64_t)auStack_168);\r\n    0x1836719dc    |    pcVar1 = (code *)swi(3);\r\n    0x1836719dc    |    (*pcVar1)();\r\n    0x1836719dc    |    return;\r\n                   |}\r\n[{\"offset\":6499539152,\"name\":\"fcn.1836718d0\",\"size\":269,\"is-pure\":false,\"realsz\":269,\"noreturn\":false,\"stackframe\":360,\"calltype\":\"ms\",\"cost\":83,\"cc\":5,\"loops\":0,\"bits\":64,\"type\":\"fcn\",\"nbbs\":7,\"edges\":8,\"ebbs\":2,\"signature\":\"fcn.1836718d0(int64_t arg1, int64_t arg2);\",\"minbound\":6499539152,\"maxbound\":6499539421,\"callrefs\":[{\"from\":6499539222,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499539245,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499539267,\"to\":6462379168,\"type\":\"CALL\"},{\"from\":6499539288,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499539299,\"to\":6446762512,\"type\":\"CALL\"},{\"from\":6499539320,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499539334,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499539344,\"to\":6447366432,\"type\":\"CALL\"},{\"from\":6499539366,\"to\":6499587744,\"type\":\"CALL\"},{\"from\":6499539415,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6499539167,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499539185,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499539198,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499539232,\"to\":6723470760,\"type\":\"DATA\"},{\"from\":6499539272,\"to\":6723255008,\"type\":\"DATA\"},{\"from\":6499539304,\"to\":6723470808,\"type\":\"DATA\"},{\"from\":6499539382,\"to\":6740709440,\"type\":\"DATA\"}],\"indegree\":0,\"outdegree\":10,\"nlocals\":3,\"nargs\":2,\"stackvars\":[{\"name\":\"var_148h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-328}},{\"name\":\"var_138h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-312}},{\"name\":\"var_18h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-24}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x1836718d0    |void fcn.1836718d0(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    code *pcVar1;\r\n                   |    undefined8 uVar2;\r\n                   |    int64_t iVar3;\r\n                   |    undefined auStack_168 [32];\r\n                   |    int64_t var_148h;\r\n                   |    int64_t var_138h;\r\n                   |    int64_t var_18h;\r\n                   |    \r\n    0x1836718e6    |    var_18h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_168;\r\n    0x1836718f8    |    if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x183671905    |        func_0x00018030d390(&var_148h, 0x190bfffb0, 0x1ed, 2);\r\n    0x18367192d    |        uVar2 = func_0x000184dcd0d0(&var_138h, 0x190c005a8, 0x2b);\r\n    0x183671932    |        iVar3 = (int64_t)*(char *)(arg2 + 0x17);\r\n    0x18367193a    |        if (iVar3 < 0) {\r\n    0x18367193c    |            iVar3 = *(int64_t *)(arg2 + 8);\r\n                   |        }\r\n    0x183671943    |        uVar2 = func_0x0001813014a0(uVar2, iVar3);\r\n    0x183671958    |        uVar2 = func_0x000184dcd0d0(uVar2, 0x190bcbae0, 7);\r\n    0x183671963    |        uVar2 = func_0x00018041ca10(uVar2, *(undefined4 *)(arg1 + 0x10));\r\n    0x183671978    |        uVar2 = func_0x000184dcd0d0(uVar2, 0x190c005d8, 0xd);\r\n    0x183671986    |        func_0x00018084a240(uVar2, *(undefined *)(arg1 + 0x93));\r\n    0x18367198b    |        func_0x0001804b0120(&var_148h);\r\n                   |    }\r\n    0x183671995    |    *(undefined *)(arg1 + 0x93) = 1;\r\n    0x18367199c    |    func_0x00018367d6a0(*(undefined8 *)(arg1 + 0xb0), arg2);\r\n    0x1836719c0    |    if (*(uint64_t *)0x191c71040 == (var_18h ^ (uint64_t)auStack_168)) {\r\n    0x1836719cb    |        return;\r\n                   |    }\r\n    0x1836719d4    |    func_0x000185f05b40(var_18h ^ (uint64_t)auStack_168);\r\n    0x1836719dc    |    pcVar1 = (code *)swi(3);\r\n    0x1836719dc    |    (*pcVar1)();\r\n    0x1836719dc    |    return;\r\n                   |}\r\n[{\"offset\":6499539152,\"name\":\"fcn.1836718d0\",\"size\":269,\"is-pure\":false,\"realsz\":269,\"noreturn\":false,\"stackframe\":360,\"calltype\":\"ms\",\"cost\":83,\"cc\":5,\"loops\":0,\"bits\":64,\"type\":\"fcn\",\"nbbs\":7,\"edges\":8,\"ebbs\":2,\"signature\":\"fcn.1836718d0(int64_t arg1, int64_t arg2);\",\"minbound\":6499539152,\"maxbound\":6499539421,\"callrefs\":[{\"from\":6499539222,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499539245,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499539267,\"to\":6462379168,\"type\":\"CALL\"},{\"from\":6499539288,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499539299,\"to\":6446762512,\"type\":\"CALL\"},{\"from\":6499539320,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499539334,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499539344,\"to\":6447366432,\"type\":\"CALL\"},{\"from\":6499539366,\"to\":6499587744,\"type\":\"CALL\"},{\"from\":6499539415,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6499539167,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499539185,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499539198,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499539232,\"to\":6723470760,\"type\":\"DATA\"},{\"from\":6499539272,\"to\":6723255008,\"type\":\"DATA\"},{\"from\":6499539304,\"to\":6723470808,\"type\":\"DATA\"},{\"from\":6499539382,\"to\":6740709440,\"type\":\"DATA\"}],\"indegree\":0,\"outdegree\":10,\"nlocals\":3,\"nargs\":2,\"stackvars\":[{\"name\":\"var_148h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-328}},{\"name\":\"var_138h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-312}},{\"name\":\"var_18h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-24}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"4998ms"}}