{"ok":true,"data":{"evidence_id":"ev_bf26f2d79840304a9605dd759e6b9117bba1e69f7769b145511f7134eac2b009","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x18366fbc0;pdgo @ 0x18366fbc0;afij @ 0x18366fbc0","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x18366fbc0;pdgo @ 0x18366fbc0;afij @ 0x18366fbc0","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x18366fbc0    |uint64_t fcn.18366fbc0(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    code *pcVar1;\r\n                   |    char cVar2;\r\n                   |    undefined8 uVar3;\r\n                   |    int64_t *piVar4;\r\n                   |    uint64_t uVar5;\r\n                   |    int64_t iVar6;\r\n                   |    unkbyte7 Var7;\r\n                   |    undefined8 uVar8;\r\n                   |    undefined auStack_178 [40];\r\n                   |    int64_t var_150h;\r\n                   |    undefined8 uStack_148;\r\n                   |    int64_t var_140h;\r\n                   |    int64_t var_20h;\r\n                   |    \r\n    0x18366fbd6    |    var_20h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_178;\r\n    0x18366fbe8    |    if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x18366fbf1    |        func_0x00018030d390(&var_150h, 0x190bfffb0, 0xa6, 2);\r\n    0x18366fc1c    |        uVar3 = func_0x000184dcd0d0(&var_140h, 0x190c00048, 0x2a);\r\n    0x18366fc26    |        uVar3 = func_0x00018084a240(uVar3, arg2 & 0xffffffffU);\r\n    0x18366fc3b    |        uVar3 = func_0x000184dcd0d0(uVar3, 0x190c00078, 9);\r\n    0x18366fc46    |        func_0x000180190e70(uVar3, arg1);\r\n    0x18366fbf1    |        func_0x0001804b0120(&var_150h);\r\n                   |    }\r\n    0x18366fc53    |    iVar6 = *(int64_t *)0x191dd79b8;\r\n    0x18366fc55    |    Var7 = (unkbyte7)((uint64_t)arg1 >> 8);\r\n    0x18366fc55    |    if ((char)(arg2 & 0xffffffffU) == '\\0') {\r\n    0x18366fe75    |        if (*(int64_t *)0x191dd79b8 != 0) {\r\n    0x18366fe77    |            *(undefined *)(*(int64_t *)0x191dd79b8 + 0x92) = 0;\r\n    0x18366fe8b    |            if ((*(int32_t *)(iVar6 + 0x10) == 1) && (*(char *)(iVar6 + 0x91) == '\\x01')) {\r\n    0x18366ff35    |                func_0x0001836700c0(iVar6);\r\n    0x18366ff3a    |                uVar5 = CONCAT71(Var7, 1);\r\n    0x18366ff44    |                if (2 < *(int32_t *)0x191de85c0) goto code_r0x00018366ff0a;\r\n    0x18366ff4d    |                func_0x00018030d390(&var_150h, 0x190bfffb0, 0xb4, 2);\r\n    0x18366ff6b    |                uVar3 = 0x190c000d8;\r\n    0x18366ff72    |                uVar8 = 0x31;\r\n                   |code_r0x00018366ff78:\r\n    0x18366ffef    |                func_0x000184dcd0d0(&var_140h, uVar3, uVar8);\r\n                   |            } else {\r\n    0x18366fe91    |                uVar5 = CONCAT71(Var7, 1);\r\n    0x18366fe9b    |                if (2 < *(int32_t *)0x191de85c0) goto code_r0x00018366ff0a;\r\n    0x18366fea4    |                func_0x00018030d390(&var_150h, 0x190bfffb0, 0xb7, 2);\r\n    0x18366fecf    |                uVar3 = func_0x000184dcd0d0(&var_140h, 0x190c00110, 0x39);\r\n    0x18366feda    |                uVar3 = func_0x00018041ca10(uVar3, *(undefined4 *)(iVar6 + 0x10));\r\n    0x18366feef    |                uVar3 = func_0x000184dcd0d0(uVar3, 0x190c00150, 0xd);\r\n    0x18366fefd    |                func_0x00018084a240(uVar3, *(undefined *)(iVar6 + 0x91));\r\n                   |            }\r\n                   |code_r0x00018366ff05:\r\n    0x18366ff05    |            uVar5 = CONCAT71(Var7, 1);\r\n    0x18366ff05    |            func_0x0001804b0120(&var_150h);\r\n    0x18366ff05    |            goto code_r0x00018366ff0a;\r\n                   |        }\r\n    0x18366fe23    |        if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x18366fe2c    |            func_0x00018030d390(&var_150h, 0x190bfffb0, 0xac, 2);\r\n    0x18366fe4a    |            uVar3 = 0x190c00090;\r\n    0x18366fe51    |            uVar8 = 0x40;\r\n    0x18366fe51    |            goto code_r0x00018366fe57;\r\n                   |        }\r\n                   |    } else {\r\n    0x18366fc5e    |        piVar4 = (int64_t *)func_0x00018366f340(arg1);\r\n    0x18366fc66    |        if (piVar4 == (int64_t *)0x0) {\r\n    0x18366fde6    |            if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x18366fdef    |                func_0x00018030d390(&var_150h, 0x190bfffb0, 0xbf, 2);\r\n    0x18366fe0d    |                uVar3 = 0x190c00160;\r\n    0x18366fe14    |                uVar8 = 0x3f;\r\n                   |code_r0x00018366fe57:\r\n    0x18366fe08    |                func_0x000184dcd0d0(&var_140h, uVar3, uVar8);\r\n    0x18366fe57    |                func_0x0001804b0120(&var_150h);\r\n                   |            }\r\n                   |        } else {\r\n    0x18366fc6f    |            *(undefined *)((int64_t)piVar4 + 0x92) = 1;\r\n    0x18366fc7a    |            if ((int32_t)piVar4[2] != 0) {\r\n    0x18366fc80    |                uVar5 = CONCAT71(Var7, 1);\r\n    0x18366fc8a    |                if (2 < *(int32_t *)0x191de85c0) goto code_r0x00018366ff0a;\r\n    0x18366fc97    |                func_0x00018030d390(&var_150h, 0x190bfffb0, 0xc5, 2);\r\n    0x18366fcbf    |                uVar3 = func_0x000184dcd0d0(&var_140h, 0x190c001a0, 0x37);\r\n    0x18366fcd4    |                uVar3 = func_0x000184dcd0d0(uVar3, 0x190c001d8, 6);\r\n    0x18366fcdf    |                uVar3 = func_0x00018041ca10(uVar3, (int32_t)piVar4[2]);\r\n    0x18366fcf4    |                uVar3 = func_0x000184dcd0d0(uVar3, 0x190c001e0, 0x10);\r\n    0x18366fd02    |                uVar3 = func_0x00018084a240(uVar3, *(undefined *)((int64_t)piVar4 + 0x93));\r\n    0x18366fd17    |                uVar3 = func_0x000184dcd0d0(uVar3, 0x190c00150, 0xd);\r\n    0x18366fd25    |                uVar3 = func_0x00018084a240(uVar3, *(undefined *)((int64_t)piVar4 + 0x91));\r\n    0x18366fd3a    |                uVar3 = func_0x000184dcd0d0(uVar3, 0x190c001f8, 0x15);\r\n    0x18366fd3f    |                iVar6 = (int64_t)*(char *)((int64_t)piVar4 + 0x2f);\r\n    0x18366fd47    |                if (iVar6 < 0) {\r\n    0x18366fd49    |                    iVar6 = piVar4[4];\r\n                   |                }\r\n    0x18366fd50    |                func_0x0001813014a0(uVar3, iVar6);\r\n    0x18366fd5a    |                goto code_r0x00018366ff05;\r\n                   |            }\r\n    0x18366fd65    |            if (*piVar4 == 0) {\r\n                   |code_r0x00018366fd8b:\r\n    0x18366fd92    |                if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x18366fd9b    |                    func_0x00018030d390(&var_150h, 0x190bfffb0, 0xce, 2);\r\n    0x18366fdb9    |                    uVar3 = 0x190c00210;\r\n    0x18366fdc0    |                    uVar8 = 0x4f;\r\n                   |code_r0x00018366fdc6:\r\n    0x18366fdb4    |                    func_0x000184dcd0d0(&var_140h, uVar3, uVar8);\r\n    0x18366fdc6    |                    func_0x0001804b0120(&var_150h);\r\n                   |                }\r\n                   |            } else {\r\n    0x18366fd73    |                var_150h = 0x1908612a0;\r\n    0x18366fd76    |                uStack_148 = 0x1a;\r\n    0x18366fd7e    |                cVar2 = func_0x000184dc6ec0();\r\n    0x18366fd85    |                if (cVar2 == '\\0') goto code_r0x00018366fd8b;\r\n    0x18366ff8c    |                if (piVar4[0x17] != 0) {\r\n    0x18366ff95    |                    cVar2 = func_0x000183674860(piVar4[0x17], arg1);\r\n    0x18366ff9c    |                    if (cVar2 != '\\0') {\r\n    0x18366ffa2    |                        *(undefined *)((int64_t)piVar4 + 0x91) = 1;\r\n    0x18366ffad    |                        if (*(char *)((int64_t)piVar4 + 0x47) < '\\0') {\r\n    0x18367000a    |                            *(undefined *)piVar4[6] = 0;\r\n    0x18367000d    |                            piVar4[7] = 0;\r\n                   |                        } else {\r\n    0x18366ffb1    |                            *(undefined *)(piVar4 + 6) = 0;\r\n    0x18366ffb4    |                            *(undefined *)((int64_t)piVar4 + 0x47) = 0;\r\n                   |                        }\r\n    0x18366ffba    |                        func_0x000183670310(piVar4);\r\n    0x18366ffbf    |                        uVar5 = CONCAT71(Var7, 1);\r\n    0x18366ffc9    |                        if (2 < *(int32_t *)0x191de85c0) goto code_r0x00018366ff0a;\r\n    0x18366ffd6    |                        func_0x00018030d390(&var_150h, 0x190bfffb0, 0xda, 2);\r\n    0x18366fff4    |                        uVar3 = 0x190c002b8;\r\n    0x18366fffb    |                        uVar8 = 0x2f;\r\n    0x183670001    |                        goto code_r0x00018366ff78;\r\n                   |                    }\r\n                   |code_r0x000183670063:\r\n    0x18367006a    |                    if (2 < *(int32_t *)0x191de85c0) goto code_r0x00018366fdd3;\r\n    0x183670077    |                    func_0x00018030d390(&var_150h, 0x190bfffb0, 0xd4, 2);\r\n    0x183670095    |                    uVar3 = 0x190c00260;\r\n    0x18367009c    |                    uVar8 = 0x50;\r\n    0x1836700a2    |                    goto code_r0x00018366fdc6;\r\n                   |                }\r\n    0x18367001e    |                if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x18367002b    |                    func_0x00018030d390(&var_150h, 0x190bfffb0, 0x264, 2);\r\n    0x183670044    |                    func_0x000184dcd0d0(&var_140h, 0x190c00710, 0x41);\r\n    0x18367002b    |                    func_0x0001804b0120(&var_150h);\r\n    0x18367005e    |                    goto code_r0x000183670063;\r\n                   |                }\r\n                   |            }\r\n                   |code_r0x00018366fdd3:\r\n    0x18366fdd3    |            *(undefined *)((int64_t)piVar4 + 0x92) = 0;\r\n                   |        }\r\n                   |    }\r\n    0x18366fe64    |    uVar5 = 0;\r\n                   |code_r0x00018366ff0a:\r\n    0x18366ff1f    |    if (*(uint64_t *)0x191c71040 == (var_20h ^ (uint64_t)auStack_178)) {\r\n    0x18366ff31    |        return uVar5 & 0xffffffff;\r\n                   |    }\r\n    0x1836700af    |    func_0x000185f05b40(var_20h ^ (uint64_t)auStack_178);\r\n    0x1836700b7    |    pcVar1 = (code *)swi(3);\r\n    0x1836700b7    |    uVar5 = (*pcVar1)();\r\n    0x1836700b7    |    return uVar5;\r\n                   |}\r\n[{\"offset\":6499531712,\"name\":\"fcn.18366fbc0\",\"size\":1272,\"is-pure\":false,\"realsz\":1272,\"noreturn\":false,\"stackframe\":376,\"calltype\":\"ms\",\"cost\":382,\"cc\":25,\"loops\":9,\"bits\":64,\"type\":\"fcn\",\"nbbs\":44,\"edges\":65,\"ebbs\":2,\"signature\":\"fcn.18366fbc0(int64_t arg1, int64_t arg2);\",\"minbound\":6499531712,\"maxbound\":6499532984,\"callrefs\":[{\"from\":6499531781,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499531804,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499531814,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499531835,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499531846,\"to\":6444093040,\"type\":\"CALL\"},{\"from\":6499531854,\"to\":6447366432,\"type\":\"CALL\"},{\"from\":6499531870,\"to\":6499529536,\"type\":\"CALL\"},{\"from\":6499531944,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499531967,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499531988,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499531999,\"to\":6446762512,\"type\":\"CALL\"},{\"from\":6499532020,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499532034,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499532055,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499532069,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499532090,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499532112,\"to\":6462379168,\"type\":\"CALL\"},{\"from\":6499532122,\"to\":6499532549,\"type\":\"CODE\"},{\"from\":6499532158,\"to\":6524006080,\"type\":\"CALL\"},{\"from\":6499532207,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499532230,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499532238,\"to\":6447366432,\"type\":\"CALL\"},{\"from\":6499532250,\"to\":6499532388,\"type\":\"CODE\"},{\"from\":6499532291,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499532314,\"to\":6499532375,\"type\":\"CODE\"},{\"from\":6499532352,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499532375,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499532383,\"to\":6447366432,\"type\":\"CALL\"},{\"from\":6499532390,\"to\":6499532554,\"type\":\"CODE\"},{\"from\":6499532472,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499532495,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499532506,\"to\":6446762512,\"type\":\"CALL\"},{\"from\":6499532527,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499532541,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499532549,\"to\":6447366432,\"type\":\"CALL\"},{\"from\":6499532597,\"to\":6499532992,\"type\":\"CALL\"},{\"from\":6499532641,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499532664,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499532672,\"to\":6499532549,\"type\":\"CODE\"},{\"from\":6499532693,\"to\":6499551328,\"type\":\"CALL\"},{\"from\":6499532730,\"to\":6499533584,\"type\":\"CALL\"},{\"from\":6499532778,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499532801,\"to\":6499532664,\"type\":\"CODE\"},{\"from\":6499532821,\"to\":6499532727,\"type\":\"CODE\"},{\"from\":6499532863,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499532886,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499532894,\"to\":6447366432,\"type\":\"CALL\"},{\"from\":6499532939,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499532962,\"to\":6499532230,\"type\":\"CODE\"},{\"from\":6499532978,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6499531727,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499531745,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499531754,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499531791,\"to\":6723469384,\"type\":\"DATA\"},{\"from\":6499531819,\"to\":6723469432,\"type\":\"DATA\"},{\"from\":6499531907,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499531920,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499531954,\"to\":6723469728,\"type\":\"DATA\"},{\"from\":6499531972,\"to\":6723469784,\"type\":\"DATA\"},{\"from\":6499532004,\"to\":6723469792,\"type\":\"DATA\"},{\"from\":6499532039,\"to\":6723469648,\"type\":\"DATA\"},{\"from\":6499532074,\"to\":6723469816,\"type\":\"DATA\"},{\"from\":6499532135,\"to\":6719672992,\"type\":\"DATA\"},{\"from\":6499532171,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499532180,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499532217,\"to\":6723469840,\"type\":\"DATA\"},{\"from\":6499532255,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499532264,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499532301,\"to\":6723469664,\"type\":\"DATA\"},{\"from\":6499532316,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499532325,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499532362,\"to\":6723469456,\"type\":\"DATA\"},{\"from\":6499532395,\"to\":6742178232,\"type\":\"DATA\"},{\"from\":6499532436,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499532445,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499532482,\"to\":6723469584,\"type\":\"DATA\"},{\"from\":6499532511,\"to\":6723469648,\"type\":\"DATA\"},{\"from\":6499532565,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499532605,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499532614,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499532651,\"to\":6723469528,\"type\":\"DATA\"},{\"from\":6499532738,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499532751,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499532788,\"to\":6723470008,\"type\":\"DATA\"},{\"from\":6499532823,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499532836,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499532873,\"to\":6723471120,\"type\":\"DATA\"},{\"from\":6499532899,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499532912,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499532949,\"to\":6723469920,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499532122,\"to\":6499532549,\"type\":\"CODE\"},{\"from\":6499532250,\"to\":6499532388,\"type\":\"CODE\"},{\"from\":6499532314,\"to\":6499532375,\"type\":\"CODE\"},{\"from\":6499532390,\"to\":6499532554,\"type\":\"CODE\"},{\"from\":6499532672,\"to\":6499532549,\"type\":\"CODE\"},{\"from\":6499532801,\"to\":6499532664,\"type\":\"CODE\"},{\"from\":6499532821,\"to\":6499532727,\"type\":\"CODE\"},{\"from\":6499532962,\"to\":6499532230,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":8,\"outdegree\":42,\"nlocals\":3,\"nargs\":2,\"stackvars\":[{\"name\":\"var_150h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-336}},{\"name\":\"var_140h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-320}},{\"name\":\"var_20h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-32}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x18366fbc0    |uint64_t fcn.18366fbc0(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    code *pcVar1;\r\n                   |    char cVar2;\r\n                   |    undefined8 uVar3;\r\n                   |    int64_t *piVar4;\r\n                   |    uint64_t uVar5;\r\n                   |    int64_t iVar6;\r\n                   |    unkbyte7 Var7;\r\n                   |    undefined8 uVar8;\r\n                   |    undefined auStack_178 [40];\r\n                   |    int64_t var_150h;\r\n                   |    undefined8 uStack_148;\r\n                   |    int64_t var_140h;\r\n                   |    int64_t var_20h;\r\n                   |    \r\n    0x18366fbd6    |    var_20h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_178;\r\n    0x18366fbe8    |    if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x18366fbf1    |        func_0x00018030d390(&var_150h, 0x190bfffb0, 0xa6, 2);\r\n    0x18366fc1c    |        uVar3 = func_0x000184dcd0d0(&var_140h, 0x190c00048, 0x2a);\r\n    0x18366fc26    |        uVar3 = func_0x00018084a240(uVar3, arg2 & 0xffffffffU);\r\n    0x18366fc3b    |        uVar3 = func_0x000184dcd0d0(uVar3, 0x190c00078, 9);\r\n    0x18366fc46    |        func_0x000180190e70(uVar3, arg1);\r\n    0x18366fbf1    |        func_0x0001804b0120(&var_150h);\r\n                   |    }\r\n    0x18366fc53    |    iVar6 = *(int64_t *)0x191dd79b8;\r\n    0x18366fc55    |    Var7 = (unkbyte7)((uint64_t)arg1 >> 8);\r\n    0x18366fc55    |    if ((char)(arg2 & 0xffffffffU) == '\\0') {\r\n    0x18366fe75    |        if (*(int64_t *)0x191dd79b8 != 0) {\r\n    0x18366fe77    |            *(undefined *)(*(int64_t *)0x191dd79b8 + 0x92) = 0;\r\n    0x18366fe8b    |            if ((*(int32_t *)(iVar6 + 0x10) == 1) && (*(char *)(iVar6 + 0x91) == '\\x01')) {\r\n    0x18366ff35    |                func_0x0001836700c0(iVar6);\r\n    0x18366ff3a    |                uVar5 = CONCAT71(Var7, 1);\r\n    0x18366ff44    |                if (2 < *(int32_t *)0x191de85c0) goto code_r0x00018366ff0a;\r\n    0x18366ff4d    |                func_0x00018030d390(&var_150h, 0x190bfffb0, 0xb4, 2);\r\n    0x18366ff6b    |                uVar3 = 0x190c000d8;\r\n    0x18366ff72    |                uVar8 = 0x31;\r\n                   |code_r0x00018366ff78:\r\n    0x18366ffef    |                func_0x000184dcd0d0(&var_140h, uVar3, uVar8);\r\n                   |            } else {\r\n    0x18366fe91    |                uVar5 = CONCAT71(Var7, 1);\r\n    0x18366fe9b    |                if (2 < *(int32_t *)0x191de85c0) goto code_r0x00018366ff0a;\r\n    0x18366fea4    |                func_0x00018030d390(&var_150h, 0x190bfffb0, 0xb7, 2);\r\n    0x18366fecf    |                uVar3 = func_0x000184dcd0d0(&var_140h, 0x190c00110, 0x39);\r\n    0x18366feda    |                uVar3 = func_0x00018041ca10(uVar3, *(undefined4 *)(iVar6 + 0x10));\r\n    0x18366feef    |                uVar3 = func_0x000184dcd0d0(uVar3, 0x190c00150, 0xd);\r\n    0x18366fefd    |                func_0x00018084a240(uVar3, *(undefined *)(iVar6 + 0x91));\r\n                   |            }\r\n                   |code_r0x00018366ff05:\r\n    0x18366ff05    |            uVar5 = CONCAT71(Var7, 1);\r\n    0x18366ff05    |            func_0x0001804b0120(&var_150h);\r\n    0x18366ff05    |            goto code_r0x00018366ff0a;\r\n                   |        }\r\n    0x18366fe23    |        if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x18366fe2c    |            func_0x00018030d390(&var_150h, 0x190bfffb0, 0xac, 2);\r\n    0x18366fe4a    |            uVar3 = 0x190c00090;\r\n    0x18366fe51    |            uVar8 = 0x40;\r\n    0x18366fe51    |            goto code_r0x00018366fe57;\r\n                   |        }\r\n                   |    } else {\r\n    0x18366fc5e    |        piVar4 = (int64_t *)func_0x00018366f340(arg1);\r\n    0x18366fc66    |        if (piVar4 == (int64_t *)0x0) {\r\n    0x18366fde6    |            if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x18366fdef    |                func_0x00018030d390(&var_150h, 0x190bfffb0, 0xbf, 2);\r\n    0x18366fe0d    |                uVar3 = 0x190c00160;\r\n    0x18366fe14    |                uVar8 = 0x3f;\r\n                   |code_r0x00018366fe57:\r\n    0x18366fe08    |                func_0x000184dcd0d0(&var_140h, uVar3, uVar8);\r\n    0x18366fe57    |                func_0x0001804b0120(&var_150h);\r\n                   |            }\r\n                   |        } else {\r\n    0x18366fc6f    |            *(undefined *)((int64_t)piVar4 + 0x92) = 1;\r\n    0x18366fc7a    |            if ((int32_t)piVar4[2] != 0) {\r\n    0x18366fc80    |                uVar5 = CONCAT71(Var7, 1);\r\n    0x18366fc8a    |                if (2 < *(int32_t *)0x191de85c0) goto code_r0x00018366ff0a;\r\n    0x18366fc97    |                func_0x00018030d390(&var_150h, 0x190bfffb0, 0xc5, 2);\r\n    0x18366fcbf    |                uVar3 = func_0x000184dcd0d0(&var_140h, 0x190c001a0, 0x37);\r\n    0x18366fcd4    |                uVar3 = func_0x000184dcd0d0(uVar3, 0x190c001d8, 6);\r\n    0x18366fcdf    |                uVar3 = func_0x00018041ca10(uVar3, (int32_t)piVar4[2]);\r\n    0x18366fcf4    |                uVar3 = func_0x000184dcd0d0(uVar3, 0x190c001e0, 0x10);\r\n    0x18366fd02    |                uVar3 = func_0x00018084a240(uVar3, *(undefined *)((int64_t)piVar4 + 0x93));\r\n    0x18366fd17    |                uVar3 = func_0x000184dcd0d0(uVar3, 0x190c00150, 0xd);\r\n    0x18366fd25    |                uVar3 = func_0x00018084a240(uVar3, *(undefined *)((int64_t)piVar4 + 0x91));\r\n    0x18366fd3a    |                uVar3 = func_0x000184dcd0d0(uVar3, 0x190c001f8, 0x15);\r\n    0x18366fd3f    |                iVar6 = (int64_t)*(char *)((int64_t)piVar4 + 0x2f);\r\n    0x18366fd47    |                if (iVar6 < 0) {\r\n    0x18366fd49    |                    iVar6 = piVar4[4];\r\n                   |                }\r\n    0x18366fd50    |                func_0x0001813014a0(uVar3, iVar6);\r\n    0x18366fd5a    |                goto code_r0x00018366ff05;\r\n                   |            }\r\n    0x18366fd65    |            if (*piVar4 == 0) {\r\n                   |code_r0x00018366fd8b:\r\n    0x18366fd92    |                if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x18366fd9b    |                    func_0x00018030d390(&var_150h, 0x190bfffb0, 0xce, 2);\r\n    0x18366fdb9    |                    uVar3 = 0x190c00210;\r\n    0x18366fdc0    |                    uVar8 = 0x4f;\r\n                   |code_r0x00018366fdc6:\r\n    0x18366fdb4    |                    func_0x000184dcd0d0(&var_140h, uVar3, uVar8);\r\n    0x18366fdc6    |                    func_0x0001804b0120(&var_150h);\r\n                   |                }\r\n                   |            } else {\r\n    0x18366fd73    |                var_150h = 0x1908612a0;\r\n    0x18366fd76    |                uStack_148 = 0x1a;\r\n    0x18366fd7e    |                cVar2 = func_0x000184dc6ec0();\r\n    0x18366fd85    |                if (cVar2 == '\\0') goto code_r0x00018366fd8b;\r\n    0x18366ff8c    |                if (piVar4[0x17] != 0) {\r\n    0x18366ff95    |                    cVar2 = func_0x000183674860(piVar4[0x17], arg1);\r\n    0x18366ff9c    |                    if (cVar2 != '\\0') {\r\n    0x18366ffa2    |                        *(undefined *)((int64_t)piVar4 + 0x91) = 1;\r\n    0x18366ffad    |                        if (*(char *)((int64_t)piVar4 + 0x47) < '\\0') {\r\n    0x18367000a    |                            *(undefined *)piVar4[6] = 0;\r\n    0x18367000d    |                            piVar4[7] = 0;\r\n                   |                        } else {\r\n    0x18366ffb1    |                            *(undefined *)(piVar4 + 6) = 0;\r\n    0x18366ffb4    |                            *(undefined *)((int64_t)piVar4 + 0x47) = 0;\r\n                   |                        }\r\n    0x18366ffba    |                        func_0x000183670310(piVar4);\r\n    0x18366ffbf    |                        uVar5 = CONCAT71(Var7, 1);\r\n    0x18366ffc9    |                        if (2 < *(int32_t *)0x191de85c0) goto code_r0x00018366ff0a;\r\n    0x18366ffd6    |                        func_0x00018030d390(&var_150h, 0x190bfffb0, 0xda, 2);\r\n    0x18366fff4    |                        uVar3 = 0x190c002b8;\r\n    0x18366fffb    |                        uVar8 = 0x2f;\r\n    0x183670001    |                        goto code_r0x00018366ff78;\r\n                   |                    }\r\n                   |code_r0x000183670063:\r\n    0x18367006a    |                    if (2 < *(int32_t *)0x191de85c0) goto code_r0x00018366fdd3;\r\n    0x183670077    |                    func_0x00018030d390(&var_150h, 0x190bfffb0, 0xd4, 2);\r\n    0x183670095    |                    uVar3 = 0x190c00260;\r\n    0x18367009c    |                    uVar8 = 0x50;\r\n    0x1836700a2    |                    goto code_r0x00018366fdc6;\r\n                   |                }\r\n    0x18367001e    |                if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x18367002b    |                    func_0x00018030d390(&var_150h, 0x190bfffb0, 0x264, 2);\r\n    0x183670044    |                    func_0x000184dcd0d0(&var_140h, 0x190c00710, 0x41);\r\n    0x18367002b    |                    func_0x0001804b0120(&var_150h);\r\n    0x18367005e    |                    goto code_r0x000183670063;\r\n                   |                }\r\n                   |            }\r\n                   |code_r0x00018366fdd3:\r\n    0x18366fdd3    |            *(undefined *)((int64_t)piVar4 + 0x92) = 0;\r\n                   |        }\r\n                   |    }\r\n    0x18366fe64    |    uVar5 = 0;\r\n                   |code_r0x00018366ff0a:\r\n    0x18366ff1f    |    if (*(uint64_t *)0x191c71040 == (var_20h ^ (uint64_t)auStack_178)) {\r\n    0x18366ff31    |        return uVar5 & 0xffffffff;\r\n                   |    }\r\n    0x1836700af    |    func_0x000185f05b40(var_20h ^ (uint64_t)auStack_178);\r\n    0x1836700b7    |    pcVar1 = (code *)swi(3);\r\n    0x1836700b7    |    uVar5 = (*pcVar1)();\r\n    0x1836700b7    |    return uVar5;\r\n                   |}\r\n[{\"offset\":6499531712,\"name\":\"fcn.18366fbc0\",\"size\":1272,\"is-pure\":false,\"realsz\":1272,\"noreturn\":false,\"stackframe\":376,\"calltype\":\"ms\",\"cost\":382,\"cc\":25,\"loops\":9,\"bits\":64,\"type\":\"fcn\",\"nbbs\":44,\"edges\":65,\"ebbs\":2,\"signature\":\"fcn.18366fbc0(int64_t arg1, int64_t arg2);\",\"minbound\":6499531712,\"maxbound\":6499532984,\"callrefs\":[{\"from\":6499531781,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499531804,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499531814,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499531835,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499531846,\"to\":6444093040,\"type\":\"CALL\"},{\"from\":6499531854,\"to\":6447366432,\"type\":\"CALL\"},{\"from\":6499531870,\"to\":6499529536,\"type\":\"CALL\"},{\"from\":6499531944,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499531967,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499531988,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499531999,\"to\":6446762512,\"type\":\"CALL\"},{\"from\":6499532020,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499532034,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499532055,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499532069,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499532090,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499532112,\"to\":6462379168,\"type\":\"CALL\"},{\"from\":6499532122,\"to\":6499532549,\"type\":\"CODE\"},{\"from\":6499532158,\"to\":6524006080,\"type\":\"CALL\"},{\"from\":6499532207,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499532230,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499532238,\"to\":6447366432,\"type\":\"CALL\"},{\"from\":6499532250,\"to\":6499532388,\"type\":\"CODE\"},{\"from\":6499532291,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499532314,\"to\":6499532375,\"type\":\"CODE\"},{\"from\":6499532352,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499532375,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499532383,\"to\":6447366432,\"type\":\"CALL\"},{\"from\":6499532390,\"to\":6499532554,\"type\":\"CODE\"},{\"from\":6499532472,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499532495,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499532506,\"to\":6446762512,\"type\":\"CALL\"},{\"from\":6499532527,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499532541,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499532549,\"to\":6447366432,\"type\":\"CALL\"},{\"from\":6499532597,\"to\":6499532992,\"type\":\"CALL\"},{\"from\":6499532641,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499532664,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499532672,\"to\":6499532549,\"type\":\"CODE\"},{\"from\":6499532693,\"to\":6499551328,\"type\":\"CALL\"},{\"from\":6499532730,\"to\":6499533584,\"type\":\"CALL\"},{\"from\":6499532778,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499532801,\"to\":6499532664,\"type\":\"CODE\"},{\"from\":6499532821,\"to\":6499532727,\"type\":\"CODE\"},{\"from\":6499532863,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499532886,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499532894,\"to\":6447366432,\"type\":\"CALL\"},{\"from\":6499532939,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499532962,\"to\":6499532230,\"type\":\"CODE\"},{\"from\":6499532978,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6499531727,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499531745,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499531754,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499531791,\"to\":6723469384,\"type\":\"DATA\"},{\"from\":6499531819,\"to\":6723469432,\"type\":\"DATA\"},{\"from\":6499531907,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499531920,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499531954,\"to\":6723469728,\"type\":\"DATA\"},{\"from\":6499531972,\"to\":6723469784,\"type\":\"DATA\"},{\"from\":6499532004,\"to\":6723469792,\"type\":\"DATA\"},{\"from\":6499532039,\"to\":6723469648,\"type\":\"DATA\"},{\"from\":6499532074,\"to\":6723469816,\"type\":\"DATA\"},{\"from\":6499532135,\"to\":6719672992,\"type\":\"DATA\"},{\"from\":6499532171,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499532180,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499532217,\"to\":6723469840,\"type\":\"DATA\"},{\"from\":6499532255,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499532264,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499532301,\"to\":6723469664,\"type\":\"DATA\"},{\"from\":6499532316,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499532325,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499532362,\"to\":6723469456,\"type\":\"DATA\"},{\"from\":6499532395,\"to\":6742178232,\"type\":\"DATA\"},{\"from\":6499532436,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499532445,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499532482,\"to\":6723469584,\"type\":\"DATA\"},{\"from\":6499532511,\"to\":6723469648,\"type\":\"DATA\"},{\"from\":6499532565,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499532605,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499532614,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499532651,\"to\":6723469528,\"type\":\"DATA\"},{\"from\":6499532738,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499532751,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499532788,\"to\":6723470008,\"type\":\"DATA\"},{\"from\":6499532823,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499532836,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499532873,\"to\":6723471120,\"type\":\"DATA\"},{\"from\":6499532899,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499532912,\"to\":6723469232,\"type\":\"DATA\"},{\"from\":6499532949,\"to\":6723469920,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499532122,\"to\":6499532549,\"type\":\"CODE\"},{\"from\":6499532250,\"to\":6499532388,\"type\":\"CODE\"},{\"from\":6499532314,\"to\":6499532375,\"type\":\"CODE\"},{\"from\":6499532390,\"to\":6499532554,\"type\":\"CODE\"},{\"from\":6499532672,\"to\":6499532549,\"type\":\"CODE\"},{\"from\":6499532801,\"to\":6499532664,\"type\":\"CODE\"},{\"from\":6499532821,\"to\":6499532727,\"type\":\"CODE\"},{\"from\":6499532962,\"to\":6499532230,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":8,\"outdegree\":42,\"nlocals\":3,\"nargs\":2,\"stackvars\":[{\"name\":\"var_150h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-336}},{\"name\":\"var_140h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-320}},{\"name\":\"var_20h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-32}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"4951ms"}}