{"ok":true,"data":{"evidence_id":"ev_a3b27f8c034940a083372bc8a4e36710aec9a190e56cddd1bb08d8ed2714f416","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x1836759d0;pdgo @ 0x1836759d0;afij @ 0x1836759d0","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x1836759d0;pdgo @ 0x1836759d0;afij @ 0x1836759d0","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x1836759d0    |void fcn.1836759d0(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    int32_t iVar2;\r\n                   |    code *pcVar3;\r\n                   |    uint64_t uVar4;\r\n                   |    undefined8 uVar5;\r\n                   |    undefined uVar6;\r\n                   |    int64_t var_148h;\r\n                   |    int64_t var_138h;\r\n                   |    int64_t var_130h;\r\n                   |    int64_t iStack_128;\r\n                   |    int64_t var_f0h;\r\n                   |    int64_t var_e0h;\r\n                   |    int64_t var_c8h;\r\n                   |    \r\n    0x1836759ea    |    if ((arg2 == 0) || (*(char *)(arg2 + 0x48) == '\\x01')) {\r\n    0x183675ac7    |        if (2 < *(int32_t *)0x191de85c0) {\r\n    0x183675bd3    |            return;\r\n                   |        }\r\n    0x183675ad4    |        func_0x00018030d390(&var_148h, 0x190c01080, 0x53, 2);\r\n    0x183675afc    |        uVar5 = func_0x000184dcd0d0(&var_138h, 0x190c010c0, 0x38);\r\n    0x183675b07    |        uVar5 = func_0x000180190e70(uVar5, arg2);\r\n    0x183675b1c    |        uVar5 = func_0x000184dcd0d0(uVar5, 0x190c00320, 0x10);\r\n    0x183675b24    |        if (arg2 == 0) {\r\n    0x183675bd4    |            uVar6 = 0;\r\n                   |        } else {\r\n    0x183675b2a    |            uVar6 = *(undefined *)(arg2 + 0x48);\r\n                   |        }\r\n    0x183675b30    |        func_0x00018084a240(uVar5, uVar6);\r\n    0x183675b41    |        var_148h = 0x18ff81648;\r\n    0x183675b3c    |        func_0x00018030e9d0(&var_148h);\r\n    0x183675b5b    |        *(undefined8 *)((int64_t)&var_138h + (int64_t)*(int32_t *)(var_138h + 4)) = 0x18fe1b290;\r\n                   |    } else {\r\n    0x183675a0a    |        if ((arg2 & 0xfffffffc00000000U) == *(uint64_t *)0x191cd6d08) {\r\n    0x183675a0f    |            func_0x0001841c7180(arg2);\r\n                   |        }\r\n    0x183675a24    |        if ((*(uint64_t *)arg1 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x183675a26    |            func_0x00018005f390();\r\n                   |        }\r\n    0x183675a2b    |        *(int64_t *)arg1 = arg2;\r\n    0x183675a33    |        if (*(int64_t *)(arg1 + 8) == 0) {\r\n    0x183675bf4    |            *(int64_t *)0x191dd79c0 = arg1;\r\n    0x183675bf4    |            uVar4 = (*_sym.imp.USER32.dll_SetWindowsHookExW)(0xd, 0x183675cf0, 0, 0);\r\n    0x183675c07    |            if ((uVar4 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x183675c0c    |                func_0x0001841c7180(uVar4);\r\n                   |            }\r\n    0x183675c1f    |            if ((*(uint64_t *)(arg1 + 8) & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x183675c21    |                func_0x00018005f390();\r\n                   |            }\r\n    0x183675c26    |            *(uint64_t *)(arg1 + 8) = uVar4;\r\n    0x183675c2d    |            if (uVar4 == 0) {\r\n    0x183675ce5    |                pcVar3 = (code *)swi(3);\r\n    0x183675ce5    |                (*pcVar3)();\r\n    0x183675ce5    |                return;\r\n                   |            }\r\n    0x183675c3a    |            if (2 < *(int32_t *)0x191de85c0) {\r\n    0x183675bd3    |                return;\r\n                   |            }\r\n    0x183675c43    |            func_0x00018030d390(&var_148h, 0x190c01080, 0x61, 2);\r\n    0x183675c71    |            uVar5 = func_0x000184dcd0d0(&var_138h, 0x190c01138, 0x39);\r\n    0x183675c7c    |            func_0x000180190e70(uVar5, *(undefined8 *)arg1);\r\n    0x183675c88    |            var_148h = 0x18ff81648;\r\n    0x183675c43    |            func_0x00018030e9d0(&var_148h);\r\n    0x183675ca2    |            *(undefined8 *)((int64_t)&var_138h + (int64_t)*(int32_t *)(var_138h + 4)) = 0x18fe1b290;\r\n                   |        } else {\r\n    0x183675a40    |            if (2 < *(int32_t *)0x191de85c0) {\r\n    0x183675bd3    |                return;\r\n                   |            }\r\n    0x183675a4d    |            func_0x00018030d390(&var_148h, 0x190c01080, 0x5a, 2);\r\n    0x183675a66    |            func_0x000184dcd0d0(&var_138h, 0x190c01100, 0x34);\r\n    0x183675a87    |            var_148h = 0x18ff81648;\r\n    0x183675a4d    |            func_0x00018030e9d0(&var_148h);\r\n    0x183675aa1    |            *(undefined8 *)((int64_t)&var_138h + (int64_t)*(int32_t *)(var_138h + 4)) = 0x18fe1b290;\r\n                   |        }\r\n                   |    }\r\n    0x183675cb6    |    if (var_e0h._7_1_ < '\\0') {\r\n    0x183675b71    |        var_130h = 0x18fe20d40;\r\n    0x183675b88    |        func_0x0001841dcbe0(var_f0h, CONCAT17(var_e0h._7_1_, (unkbyte7)var_e0h) & 0x7fffffffffffffff);\r\n                   |    }\r\n    0x183675b99    |    var_130h = 0x18fe20db0;\r\n    0x183675baa    |    if (iStack_128 != 0x191de1450) {\r\n    0x183675cc6    |        LOCK();\r\n    0x183675cc6    |        piVar1 = (int32_t *)(iStack_128 + 8);\r\n    0x183675cc6    |        iVar2 = *piVar1;\r\n    0x183675cc6    |        *piVar1 = *piVar1 + -1;\r\n    0x183675cc6    |        UNLOCK();\r\n    0x183675ccd    |        if (iVar2 == 0) {\r\n    0x183675cda    |            (*(code *)0x185f59da0)();\r\n                   |        }\r\n                   |    }\r\n    0x183675b8d    |    func_0x00018424db70(&var_130h);\r\n    0x183675bb0    |    func_0x0001848f8b80(&var_c8h);\r\n    0x183675bd3    |    return;\r\n                   |}\r\n[{\"offset\":6499555792,\"name\":\"fcn.1836759d0\",\"size\":790,\"is-pure\":false,\"realsz\":790,\"noreturn\":false,\"stackframe\":360,\"calltype\":\"ms\",\"cost\":239,\"cc\":19,\"loops\":6,\"bits\":64,\"type\":\"fcn\",\"nbbs\":30,\"edges\":45,\"ebbs\":2,\"signature\":\"fcn.1836759d0(int64_t arg1, int64_t arg2);\",\"minbound\":6499555792,\"maxbound\":6499556582,\"callrefs\":[{\"from\":6499555855,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6499555878,\"to\":6442840976,\"type\":\"CALL\"},{\"from\":6499555937,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499555963,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499555982,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6499556027,\"to\":6499556237,\"type\":\"CODE\"},{\"from\":6499556069,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499556092,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499556103,\"to\":6444093040,\"type\":\"CALL\"},{\"from\":6499556124,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499556144,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499556167,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6499556232,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499556283,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6499556291,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6499556310,\"to\":6499556141,\"type\":\"CODE\"},{\"from\":6499556340,\"to\":6741827280,\"type\":\"CALL\"},{\"from\":6499556364,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6499556385,\"to\":6442840976,\"type\":\"CALL\"},{\"from\":6499556439,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499556465,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499556476,\"to\":6444093040,\"type\":\"CALL\"},{\"from\":6499556495,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6499556540,\"to\":6499556237,\"type\":\"CODE\"},{\"from\":6499556570,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6499556576,\"to\":6499556272,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6499555843,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6499555869,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6499555897,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499555910,\"to\":6723473536,\"type\":\"DATA\"},{\"from\":6499555947,\"to\":6723473664,\"type\":\"DATA\"},{\"from\":6499555968,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6499555994,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6499556006,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6499556032,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499556045,\"to\":6723473536,\"type\":\"DATA\"},{\"from\":6499556079,\"to\":6723473600,\"type\":\"DATA\"},{\"from\":6499556108,\"to\":6723470112,\"type\":\"DATA\"},{\"from\":6499556149,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6499556180,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6499556192,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6499556242,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6499556256,\"to\":6742217808,\"type\":\"DATA\"},{\"from\":6499556315,\"to\":6742178240,\"type\":\"DATA\"},{\"from\":6499556322,\"to\":6499556592,\"type\":\"DATA\"},{\"from\":6499556352,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6499556376,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6499556403,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499556412,\"to\":6723473536,\"type\":\"DATA\"},{\"from\":6499556449,\"to\":6723473720,\"type\":\"DATA\"},{\"from\":6499556481,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6499556507,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6499556519,\"to\":6708923712,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499556027,\"to\":6499556237,\"type\":\"CODE\"},{\"from\":6499556310,\"to\":6499556141,\"type\":\"CODE\"},{\"from\":6499556540,\"to\":6499556237,\"type\":\"CODE\"},{\"from\":6499556576,\"to\":6499556272,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":4,\"outdegree\":22,\"nlocals\":6,\"nargs\":2,\"stackvars\":[{\"name\":\"var_148h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-328}},{\"name\":\"var_138h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-312}},{\"name\":\"var_130h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-304}},{\"name\":\"var_f0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-240}},{\"name\":\"var_e0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-224}},{\"name\":\"var_c8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-200}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x1836759d0    |void fcn.1836759d0(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    int32_t iVar2;\r\n                   |    code *pcVar3;\r\n                   |    uint64_t uVar4;\r\n                   |    undefined8 uVar5;\r\n                   |    undefined uVar6;\r\n                   |    int64_t var_148h;\r\n                   |    int64_t var_138h;\r\n                   |    int64_t var_130h;\r\n                   |    int64_t iStack_128;\r\n                   |    int64_t var_f0h;\r\n                   |    int64_t var_e0h;\r\n                   |    int64_t var_c8h;\r\n                   |    \r\n    0x1836759ea    |    if ((arg2 == 0) || (*(char *)(arg2 + 0x48) == '\\x01')) {\r\n    0x183675ac7    |        if (2 < *(int32_t *)0x191de85c0) {\r\n    0x183675bd3    |            return;\r\n                   |        }\r\n    0x183675ad4    |        func_0x00018030d390(&var_148h, 0x190c01080, 0x53, 2);\r\n    0x183675afc    |        uVar5 = func_0x000184dcd0d0(&var_138h, 0x190c010c0, 0x38);\r\n    0x183675b07    |        uVar5 = func_0x000180190e70(uVar5, arg2);\r\n    0x183675b1c    |        uVar5 = func_0x000184dcd0d0(uVar5, 0x190c00320, 0x10);\r\n    0x183675b24    |        if (arg2 == 0) {\r\n    0x183675bd4    |            uVar6 = 0;\r\n                   |        } else {\r\n    0x183675b2a    |            uVar6 = *(undefined *)(arg2 + 0x48);\r\n                   |        }\r\n    0x183675b30    |        func_0x00018084a240(uVar5, uVar6);\r\n    0x183675b41    |        var_148h = 0x18ff81648;\r\n    0x183675b3c    |        func_0x00018030e9d0(&var_148h);\r\n    0x183675b5b    |        *(undefined8 *)((int64_t)&var_138h + (int64_t)*(int32_t *)(var_138h + 4)) = 0x18fe1b290;\r\n                   |    } else {\r\n    0x183675a0a    |        if ((arg2 & 0xfffffffc00000000U) == *(uint64_t *)0x191cd6d08) {\r\n    0x183675a0f    |            func_0x0001841c7180(arg2);\r\n                   |        }\r\n    0x183675a24    |        if ((*(uint64_t *)arg1 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x183675a26    |            func_0x00018005f390();\r\n                   |        }\r\n    0x183675a2b    |        *(int64_t *)arg1 = arg2;\r\n    0x183675a33    |        if (*(int64_t *)(arg1 + 8) == 0) {\r\n    0x183675bf4    |            *(int64_t *)0x191dd79c0 = arg1;\r\n    0x183675bf4    |            uVar4 = (*_sym.imp.USER32.dll_SetWindowsHookExW)(0xd, 0x183675cf0, 0, 0);\r\n    0x183675c07    |            if ((uVar4 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x183675c0c    |                func_0x0001841c7180(uVar4);\r\n                   |            }\r\n    0x183675c1f    |            if ((*(uint64_t *)(arg1 + 8) & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x183675c21    |                func_0x00018005f390();\r\n                   |            }\r\n    0x183675c26    |            *(uint64_t *)(arg1 + 8) = uVar4;\r\n    0x183675c2d    |            if (uVar4 == 0) {\r\n    0x183675ce5    |                pcVar3 = (code *)swi(3);\r\n    0x183675ce5    |                (*pcVar3)();\r\n    0x183675ce5    |                return;\r\n                   |            }\r\n    0x183675c3a    |            if (2 < *(int32_t *)0x191de85c0) {\r\n    0x183675bd3    |                return;\r\n                   |            }\r\n    0x183675c43    |            func_0x00018030d390(&var_148h, 0x190c01080, 0x61, 2);\r\n    0x183675c71    |            uVar5 = func_0x000184dcd0d0(&var_138h, 0x190c01138, 0x39);\r\n    0x183675c7c    |            func_0x000180190e70(uVar5, *(undefined8 *)arg1);\r\n    0x183675c88    |            var_148h = 0x18ff81648;\r\n    0x183675c43    |            func_0x00018030e9d0(&var_148h);\r\n    0x183675ca2    |            *(undefined8 *)((int64_t)&var_138h + (int64_t)*(int32_t *)(var_138h + 4)) = 0x18fe1b290;\r\n                   |        } else {\r\n    0x183675a40    |            if (2 < *(int32_t *)0x191de85c0) {\r\n    0x183675bd3    |                return;\r\n                   |            }\r\n    0x183675a4d    |            func_0x00018030d390(&var_148h, 0x190c01080, 0x5a, 2);\r\n    0x183675a66    |            func_0x000184dcd0d0(&var_138h, 0x190c01100, 0x34);\r\n    0x183675a87    |            var_148h = 0x18ff81648;\r\n    0x183675a4d    |            func_0x00018030e9d0(&var_148h);\r\n    0x183675aa1    |            *(undefined8 *)((int64_t)&var_138h + (int64_t)*(int32_t *)(var_138h + 4)) = 0x18fe1b290;\r\n                   |        }\r\n                   |    }\r\n    0x183675cb6    |    if (var_e0h._7_1_ < '\\0') {\r\n    0x183675b71    |        var_130h = 0x18fe20d40;\r\n    0x183675b88    |        func_0x0001841dcbe0(var_f0h, CONCAT17(var_e0h._7_1_, (unkbyte7)var_e0h) & 0x7fffffffffffffff);\r\n                   |    }\r\n    0x183675b99    |    var_130h = 0x18fe20db0;\r\n    0x183675baa    |    if (iStack_128 != 0x191de1450) {\r\n    0x183675cc6    |        LOCK();\r\n    0x183675cc6    |        piVar1 = (int32_t *)(iStack_128 + 8);\r\n    0x183675cc6    |        iVar2 = *piVar1;\r\n    0x183675cc6    |        *piVar1 = *piVar1 + -1;\r\n    0x183675cc6    |        UNLOCK();\r\n    0x183675ccd    |        if (iVar2 == 0) {\r\n    0x183675cda    |            (*(code *)0x185f59da0)();\r\n                   |        }\r\n                   |    }\r\n    0x183675b8d    |    func_0x00018424db70(&var_130h);\r\n    0x183675bb0    |    func_0x0001848f8b80(&var_c8h);\r\n    0x183675bd3    |    return;\r\n                   |}\r\n[{\"offset\":6499555792,\"name\":\"fcn.1836759d0\",\"size\":790,\"is-pure\":false,\"realsz\":790,\"noreturn\":false,\"stackframe\":360,\"calltype\":\"ms\",\"cost\":239,\"cc\":19,\"loops\":6,\"bits\":64,\"type\":\"fcn\",\"nbbs\":30,\"edges\":45,\"ebbs\":2,\"signature\":\"fcn.1836759d0(int64_t arg1, int64_t arg2);\",\"minbound\":6499555792,\"maxbound\":6499556582,\"callrefs\":[{\"from\":6499555855,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6499555878,\"to\":6442840976,\"type\":\"CALL\"},{\"from\":6499555937,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499555963,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499555982,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6499556027,\"to\":6499556237,\"type\":\"CODE\"},{\"from\":6499556069,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499556092,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499556103,\"to\":6444093040,\"type\":\"CALL\"},{\"from\":6499556124,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499556144,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499556167,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6499556232,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499556283,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6499556291,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6499556310,\"to\":6499556141,\"type\":\"CODE\"},{\"from\":6499556340,\"to\":6741827280,\"type\":\"CALL\"},{\"from\":6499556364,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6499556385,\"to\":6442840976,\"type\":\"CALL\"},{\"from\":6499556439,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499556465,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499556476,\"to\":6444093040,\"type\":\"CALL\"},{\"from\":6499556495,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6499556540,\"to\":6499556237,\"type\":\"CODE\"},{\"from\":6499556570,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6499556576,\"to\":6499556272,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6499555843,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6499555869,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6499555897,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499555910,\"to\":6723473536,\"type\":\"DATA\"},{\"from\":6499555947,\"to\":6723473664,\"type\":\"DATA\"},{\"from\":6499555968,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6499555994,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6499556006,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6499556032,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499556045,\"to\":6723473536,\"type\":\"DATA\"},{\"from\":6499556079,\"to\":6723473600,\"type\":\"DATA\"},{\"from\":6499556108,\"to\":6723470112,\"type\":\"DATA\"},{\"from\":6499556149,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6499556180,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6499556192,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6499556242,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6499556256,\"to\":6742217808,\"type\":\"DATA\"},{\"from\":6499556315,\"to\":6742178240,\"type\":\"DATA\"},{\"from\":6499556322,\"to\":6499556592,\"type\":\"DATA\"},{\"from\":6499556352,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6499556376,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6499556403,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499556412,\"to\":6723473536,\"type\":\"DATA\"},{\"from\":6499556449,\"to\":6723473720,\"type\":\"DATA\"},{\"from\":6499556481,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6499556507,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6499556519,\"to\":6708923712,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499556027,\"to\":6499556237,\"type\":\"CODE\"},{\"from\":6499556310,\"to\":6499556141,\"type\":\"CODE\"},{\"from\":6499556540,\"to\":6499556237,\"type\":\"CODE\"},{\"from\":6499556576,\"to\":6499556272,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":4,\"outdegree\":22,\"nlocals\":6,\"nargs\":2,\"stackvars\":[{\"name\":\"var_148h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-328}},{\"name\":\"var_138h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-312}},{\"name\":\"var_130h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-304}},{\"name\":\"var_f0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-240}},{\"name\":\"var_e0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-224}},{\"name\":\"var_c8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-200}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5049ms"}}